natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

update jBCrypt dependency to version 0.4 

patch by Stefan Miklosovic; reviewed by Dinesh Joshi for CASSANDRA-9384
This commit is contained in:
Stefan Miklosovic 2021-09-29 07:39:29 +02:00
parent b6678a002c
commit 6b16b67cd4
5 changed files with 53 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.txt
View File

@ -1,4 +1,5 @@
3.0.26:
* CVE-2015-0886 Security vulnerability in jbcrypt is addressed (CASSANDRA-9384)
* Avoid useless SSTable reads during single partition queries (CASSANDRA-16944)
* Debian init respects CASSANDRA_HEAPDUMP_DIR (CASSANDRA-13843)
* Catch UnsatisfiedLinkError in WindowsTimer (CASSANDRA-16085)

10
NEWS.txt
View File

@ -42,6 +42,16 @@ restore snapshots created with the previous major version using the
'sstableloader' tool. You can upgrade the file format of your snapshots
using the provided 'sstableupgrade' tool.
3.0.26
======
Upgrading
---------
- Before you upgrade, if you are using `cassandra.auth_bcrypt_gensalt_log2_rounds` property,
confirm it is set to value lower than 31 otherwise Cassandra will fail to start. See CASSANDRA-9384
for further details. You also need to regenerate passwords for users for who the password
was created while the above property was set to be more than 30 otherwise they will not be able to log in.
3.0.25
======

2
build.xml
View File

@ -382,7 +382,7 @@
<dependency groupId="com.addthis.metrics" artifactId="reporter-config3" version="3.0.0">
<exclusion groupId="org.hibernate" artifactId="hibernate-validator" />
</dependency>
<dependency groupId="org.mindrot" artifactId="jbcrypt" version="0.3m" />
<dependency groupId="org.mindrot" artifactId="jbcrypt" version="0.4" />
<dependency groupId="io.airlift" artifactId="airline" version="0.6">
<exclusion groupId="com.google.code.findbugs" artifactId="jsr305" />
</dependency>

8
src/java/org/apache/cassandra/auth/CassandraRoleManager.java
View File

@ -21,6 +21,7 @@ import java.util.*;
import java.util.concurrent.Callable;
import java.util.concurrent.TimeUnit;
import com.google.common.annotations.VisibleForTesting;
import com.google.common.base.*;
import com.google.common.base.Objects;
import com.google.common.collect.ImmutableSet;
@ -118,15 +119,16 @@ public class CassandraRoleManager implements IRoleManager
};
// 2 ** GENSALT_LOG2_ROUNDS rounds of hashing will be performed.
private static final String GENSALT_LOG2_ROUNDS_PROPERTY = Config.PROPERTY_PREFIX + "auth_bcrypt_gensalt_log2_rounds";
@VisibleForTesting
public static final String GENSALT_LOG2_ROUNDS_PROPERTY = Config.PROPERTY_PREFIX + "auth_bcrypt_gensalt_log2_rounds";
private static final int GENSALT_LOG2_ROUNDS = getGensaltLogRounds();
static int getGensaltLogRounds()
{
int rounds = Integer.getInteger(GENSALT_LOG2_ROUNDS_PROPERTY, 10);
if (rounds < 4 || rounds > 31)
if (rounds < 4 || rounds > 30)
throw new ConfigurationException(String.format("Bad value for system property -D%s." +
"Please use a value between 4 and 31 inclusively",
"Please use a value between 4 and 30 inclusively",
GENSALT_LOG2_ROUNDS_PROPERTY));
return rounds;
}

39
test/unit/org/apache/cassandra/auth/PasswordAuthenticatorTest.java
View File

@ -22,6 +22,7 @@ import java.nio.charset.StandardCharsets;
import com.google.common.collect.Iterables;
import org.junit.AfterClass;
import org.junit.Assert;
import org.junit.BeforeClass;
import org.junit.Test;
@ -31,6 +32,7 @@ import org.apache.cassandra.SchemaLoader;
import org.apache.cassandra.config.CFMetaData;
import org.apache.cassandra.cql3.CQLTester;
import org.apache.cassandra.exceptions.AuthenticationException;
import org.apache.cassandra.exceptions.ConfigurationException;
import org.apache.cassandra.schema.KeyspaceParams;
import static org.apache.cassandra.auth.CassandraRoleManager.*;
@ -46,17 +48,17 @@ public class PasswordAuthenticatorTest extends CQLTester
private static PasswordAuthenticator authenticator = new PasswordAuthenticator();
@Test
public void testCheckpw() throws Exception
public void testCheckpw()
{
// Valid and correct
assertTrue(checkpw(DEFAULT_SUPERUSER_PASSWORD, hashpw(DEFAULT_SUPERUSER_PASSWORD, gensalt(getGensaltLogRounds()))));
assertTrue(checkpw(DEFAULT_SUPERUSER_PASSWORD, hashpw(DEFAULT_SUPERUSER_PASSWORD, gensalt(4))));
assertTrue(checkpw(DEFAULT_SUPERUSER_PASSWORD, hashpw(DEFAULT_SUPERUSER_PASSWORD, gensalt(31))));
assertTrue(checkpw(DEFAULT_SUPERUSER_PASSWORD, hashpw(DEFAULT_SUPERUSER_PASSWORD, gensalt(12))));
// Valid but incorrect hashes
assertFalse(checkpw(DEFAULT_SUPERUSER_PASSWORD, hashpw("incorrect0", gensalt(4))));
assertFalse(checkpw(DEFAULT_SUPERUSER_PASSWORD, hashpw("incorrect1", gensalt(10))));
assertFalse(checkpw(DEFAULT_SUPERUSER_PASSWORD, hashpw("incorrect2", gensalt(31))));
assertFalse(checkpw(DEFAULT_SUPERUSER_PASSWORD, hashpw("incorrect2", gensalt(12))));
// Invalid hash values, the jBCrypt library implementation
// throws an exception which we catch and treat as a failure
@ -78,6 +80,37 @@ public class PasswordAuthenticatorTest extends CQLTester
assertFalse(checkpw(DEFAULT_SUPERUSER_PASSWORD, "$2a$6$abcdefghijklmnopqrstuvABCDEFGHIJKLMNOPQRSTUVWXYZ01234"));
}
@Test(expected = ConfigurationException.class)
public void testInvalidUpperBoundHashingRoundsValue()
{
executeSaltRoundsPropertyTest(31);
}
@Test(expected = ConfigurationException.class)
public void testInvalidLowerBoundHashingRoundsValue()
{
executeSaltRoundsPropertyTest(3);
}
private void executeSaltRoundsPropertyTest(Integer rounds)
{
String oldProperty = System.getProperty(GENSALT_LOG2_ROUNDS_PROPERTY);
try
{
System.setProperty(GENSALT_LOG2_ROUNDS_PROPERTY, rounds.toString());
getGensaltLogRounds();
Assert.fail("Property " + GENSALT_LOG2_ROUNDS_PROPERTY + " must be in interval [4,30]");
}
finally
{
if (oldProperty != null)
System.setProperty(GENSALT_LOG2_ROUNDS_PROPERTY, oldProperty);
else
System.clearProperty(GENSALT_LOG2_ROUNDS_PROPERTY);
}
}
@Test(expected = AuthenticationException.class)
public void testEmptyUsername()
{