[IMPALA-4509] Impala should provide SASL a mutex

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: Impala 2.0
• Fix Version/s: Impala 2.8.0
• Component/s: Security
• Labels: kudu security
• Target Version: Impala 2.8.0
• Assignee: Henry Robinson
• Reporter: Matthew Jacobs
• Created: 17/Nov/16 21:44
• Updated: 19/Jun/17 19:00
• Resolved: 19/Nov/16 05:41

Description

From IMPALA-4497 and KUDU-1749 we discovered that Impala is not calling sasl_set_mutex to provide SASL with some mutex implementation. This may expose Impala to races in the sasl code which indicates it is not thread safe. This has likely always been missing, and we're not aware of any issues caused by it, but as Kudu is now using sasl as well this may be more important for the Impala daemon to protect itself (i.e. even if Impala's usage is safe, possibly Kudu client's usage of sasl may expose races more).

We may be able to use Kudu's implementation:
https://gerrit.cloudera.org/#/c/5120/2/src/kudu/rpc/sasl_common.cc

Issue Links

• breaks: IMPALA-5221 Fix TSaslTransport negotiation order leading to crash in SaslMutexLock(void*)
• is related to: IMPALA-4497 Kudu client usage on secure clusters results in crash