Typo fix Author: fengpan0403 <fengpan0403@163.com> Reviewers: maoling <maoling@apache.org> Closes #1778 from fengpan0403/master
Added enforce.auth.enabled and enforce.auth.scheme to enforce any authentication scheme. Author: Mohammad Arshad <arshad@apache.org> Reviewers: Michael Han <hanm@apache.org>, Damien Diederen <dd@crosstwine.com>, Enrico Olivelli <eolivelli@gmail.com>, Andor Molnár <andor@apache.org> Closes #1500 from arshadmohammad/ZOOKEEPER-3561-master
Add comment at bottom of ZOO_ERRORS reminding developers to also update zerror(int) when adding or changing values. Suggested by phunt in https://github.com/apache/zookeeper/pull/575#issuecomment-406356144. Signed-off-by: Kent R. Spillner <kspillneracm.org> Author: Kent R. Spillner <kspillner@acm.org> Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>, Benjamin Reed <breed@apache.org> Closes #581 from sl4mmy/zookeeper-3101
Some environments experience high DNS load because of the name resolutions introduced by [ZOOKEEPER-1355](https://issues.apache.org/jira/browse/ZOOKEEPER-1355). This patch allows clients to set a minimum delay to observe between "routine" resolutions using a `zoo_set_servers_resolution_delay` API function. An application can influence the rate of polling via its `delay_ms` parameter: when set to a value greater than zero, the client skips most "routine" resolutions which would have happened in a window of that many milliseconds since the last successful one. Setting `delay_ms` to `0` disables the new logic, reverting to the default behavior. Setting it to `-1` disables network resolutions during normal operation (but not, e.g., on connection loss). Author: Damien Diederen <dd@crosstwine.com> Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>, Suhas Dantkale Closes #1068 from ztzg/ZOOKEEPER-1998-throttle-dns-resolutions
…gured threshold Author: Jie Huang <jiehuang@fb.com> Author: Ivailo Nedelchev <nedelchev@fb.com> Reviewers: Michael Han <hanm@apache.org>, Allan Lyu <fangmin@apache.org>, Damien Diederen <dd@crosstwine.com> Closes #1211 from jhuan31/ZOOKEEPER-3683
This is a "respin" of https://github.com/apache/zookeeper/pull/1054, which I withdrew due to some annoying shortcomings. This changeset allows C clients to use SASL to authenticate with the ZooKeeper server. It is loosely based on patches #1 and #2 by Tom Klonikowski, at https://reviews.apache.org/r/2252/, but the result has been extensively reworked to follow the semantics of the Java client: * No SASL operations are exposed through the API; * The configuration is provided, and stored, at "handle init time"; * SASL authentication is automatically performed after each (re)connect. It introduces an optional dependency on the Cyrus SASL library, which can either be autodetected (default) or configured using the `--without-sasl`/`--with-sasl[=DIR]` flags, or -DWITH_CYRUS_SASL for CMake/Windows. `TestServerRequireClientSASLAuth.cc` has been renamed to `TestSASLAuth.cc`, and a test has been added which successfully (re)authenticates using the `DIGEST-MD5` mechanism. The code has also been used to successfully authenticate clients via `GSSAPI`/Kerberos. This commit also adds SASL support to the `cli.c` client. Co-authored-by: Tom Klonikowski <klonik_tinformatik.haw-hamburg.de> Author: Damien Diederen <dd@crosstwine.com> Reviewers: Mate Szalay-Beko <szalay.beko.mate@gmail.com>, Norbert Kalmar <nkalmar@apache.org> Closes #1134 from ztzg/ZOOKEEPER-1112-c-client-sasl-support-v2
- configure maven-release-plugin - configure maven-scm-plugin - use maven-antrun-plugin in order to alter C client files during release procedure - update Apache Parent pom to 21 - use openjdk8 for building releases Author: Enrico Olivelli <eolivelli@apache.org> Author: Enrico Olivelli <eolivelli@gmail.com> Author: Enrico Olivelli <enrico.olivelli@diennea.com> Reviewers: Norbert Kalmar <nkalmar@apache.org> Closes #1162 from eolivelli/fix/ZOOKEEPER-3635-new-release-proc
This PR is based on the works of Asnish Amarnath and Suhas Dantkale. Most of the kudos should go to them and those who were reviewing all the previous PRs. **The PR includes the following changes from PR#639:** - OPENSSL 1.1.1 version support in C-client **The PR includes the following changes from PR#990:** - also supporting OPENSSL 1.0.2 - SSL connection on non-blocking socket is handled correctly - Support of Certificate Chains - Fix Memory leaks - Dynamically generated test certificates **The following new changes were added into the PR:** - fix CMake + VisualStudio2019 build with windows - fix C CLI to compile / work both with windows and linux (I tested them manually) - fix (and simplify) the way how the server is started with C unit tests, so it is compatible with maven build now - the test case `testReadOnly` was failing with the previous PR because there was a bug in the C-client code, I fixed that - I also added new test case: `testReadOnlyWithSSL` **Testing this PR on linux:** ``` git clean -xdf # compile ZooKeeper server plus the C-client code mvn clean install -DskipTests -Pfull-build # compile and execute C-client unit tests cd zookeeper-client/ mvn clean install -Pfull-build ``` **Compile the code on windows (only cmake is supported):** - download C-Make: https://cmake.org/download/ - Install community edition of Visual Studio: https://visualstudio.microsoft.com/downloads/ - Download OpenSSL (e.g. 1.0.2): https://slproweb.com/products/Win32OpenSSL.html (e.g. install it to `c:\OpenSSL-Win64`) - compile the java code using: `mvn clean install -DskipTests` - go to the Client folder: `cd zookeeper-client\zookeeper-client-c` - configure the project: `cmake . -D WITH_OPENSSL=c:\OpenSSL-Win64` - build the project: `cmake --build .` **Testing the C-client with SSL manually:** - run the `zookeeper-client/zookeeper-client-c/ssl/gencerts.sh` to generate certificate files (e.g. copy it to an empty folder like `/tmp/ssl/` and start is) - start a ZooKeeper server, using some config file like this one: ``` tickTime=3000 initLimit=10 syncLimit=5 dataDir=/tmp/zkdata secureClientPort=22281 serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory ssl.keyStore.location=/tmp/ssl/server.jks ssl.keyStore.password=password ssl.trustStore.location=/tmp/ssl/servertrust.jks ssl.trustStore.password=password ``` - start the command line client (cli.exe on windows, cli_mt or cli_st on linux): `./cli_mt --host localhost:22281 --ssl /tmp/ssl/server.crt,/tmp/ssl/client.crt,/tmp/ssl/clientkey.pem,password` Author: Mate Szalay-Beko <szalay.beko.mate@gmail.com> Author: Mate Szalay-Beko <mszalay@cloudera.com> Reviewers: andor@apache.org Closes #1107 from symat/ZOOKEEPER-2122 and squashes the following commits: 08294ce91 [Mate Szalay-Beko] ZOOKEEPER-2122: update readme + use FQDN in SSL certs during testing 17e504a98 [Mate Szalay-Beko] Merge remote-tracking branch 'apache/master' into ZOOKEEPER-2122 317241d13 [Mate Szalay-Beko] ZOOKEEPER-2122: minor fix in SSL certificates used for testing 6f37b6653 [Mate Szalay-Beko] Merge remote-tracking branch 'apache/master' into HEAD 980914313 [Mate Szalay-Beko] ZOOKEEPER-2122: add SSL support for C-client