Uploaded image for project: 'Kafka'
  1. Kafka
  2. KAFKA-9190

Server leaves connections with expired authentication sessions open

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.2.0, 2.3.0, 2.2.1
    • Fix Version/s: 2.4.0, 2.2.3, 2.3.2
    • Component/s: None
    • Labels:
      None

      Description

      SocketServer implements some logic to disconnect connections which have expired authentication sessions. At the moment, we just call `SelectionKey.cancel` in order to trigger this disconnect. I think the expectation is that this causes the channel to be closed on the next `poll`, but as far as I can tell, all it does is disassociate the selection key from the selector. This means that the key never gets selected again and we never close the connection until the client times out.

      This was found when debugging the flaky test failure `EndToEndAuthorizationTest.testNoDescribeProduceOrConsumeWithoutTopicDescribeAcl`. I modified the code to call `Selector.close` instead of `TransportLayer.disconnect`. I was able to reproduce the session authentication expiration, but the connection properly closes and the test does no longer times out.

        Attachments

        Issue Links

          Activity

            People

            • Assignee:
              rndgstn Ron Dagostino
              Reporter:
              hachikuji Jason Gustafson

              Dates

              • Created:
                Updated:
                Resolved:

                Issue deployment