qpid-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF subversion and git services (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (PROTON-1209) CLONE - Proton's use of Cyrus SASL is not thread-safe - long term fix
Date Fri, 09 Jun 2017 22:34:18 GMT

    [ https://issues.apache.org/jira/browse/PROTON-1209?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16045141#comment-16045141
] 

ASF subversion and git services commented on PROTON-1209:
---------------------------------------------------------

Commit 21a74d980298d3eeb5b4c57c93815a5e6643cb38 in qpid-proton's branch refs/heads/PROTON-1500
from [~astitcher]
[ https://git-wip-us.apache.org/repos/asf?p=qpid-proton.git;h=21a74d9 ]

PROTON-1500: Implement plugin interface for SASL implementations
- Allow sasl implementation to be selected per connection
- Compile both default and cyrus implementation (if we can)
- No current change in behaviour (get cyrus is available and default otherwise)
- But now have frqamework to solve PROTON-1209; Stil to do for this:
- Need to have API to turn on cyrus, with default being the initial implementation
- Need to deprecate cyrus specific APIs:
-- pn_sasl_extended
-- pn_sasl_config_path
-- pn_sasl_config_name
- Need to deprecate pn_sasl_done


> CLONE - Proton's use of Cyrus SASL is not thread-safe - long term fix
> ---------------------------------------------------------------------
>
>                 Key: PROTON-1209
>                 URL: https://issues.apache.org/jira/browse/PROTON-1209
>             Project: Qpid Proton
>          Issue Type: Bug
>          Components: proton-c
>    Affects Versions: 0.10
>            Reporter: michael goulish
>            Assignee: Andrew Stitcher
>            Priority: Critical
>             Fix For: 0.18.0
>
>
> Documentation for the Cyrus SASL library says that the library is believed to be thread-safe
only if the code that uses it meets several requirements.
> The requirements are:
>     * you supply mutex functions (see sasl_set_mutex())
>     * you make no libsasl calls until sasl_client/server_init() completes
>     * no libsasl calls are made after sasl_done() is begun
>     * when using GSSAPI, you use a thread-safe GSS / Kerberos 5 library.
> It says explicitly that that sasl_set* calls are not thread safe, since they set global
state.
> The proton library makes calls to sasl_set* functions in :
>           pni_init_client()
>           pni_init_server(), and
>           pni_process_init()
> Since those are internal functions, there is no way for code that uses Proton to lock
around those calls.
> I think proton needs a new API call to let applications call sasl_set_mutex().  Or something.
> We probably also need other protections to meet the other requirements specified in the
Cyrus documentation (and quoted above).



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org


Mime
View raw message