Skip to content

KAFKA-17014: ScramFormatter should not use String for password #19082

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 12 commits into
base: trunk
Choose a base branch
from
Open

KAFKA-17014: ScramFormatter should not use String for password #19082

wants to merge 12 commits into from

Conversation

mingdaoy
Copy link
Contributor

@mingdaoy mingdaoy commented Mar 3, 2025 •
edited
Loading

https://issues.apache.org/jira/browse/KAFKA-17014

Update saltedPassword, generateCredential, and normalize to use char[] for password handling

Gradle Test Run :clients:test > Gradle Test Executor 3 > ScramFormatterTest > rfc7677Example() PASSED
Gradle Test Run :clients:test > Gradle Test Executor 3 > ScramFormatterTest > saslName() PASSED

image

ScramParserTest:
image

@github-actions github-actions bot added triage PRs from the community core Kafka Broker kraft clients small Small PRs labels Mar 3, 2025
szetszwo
szetszwo reviewed Mar 5, 2025
View reviewed changes
Copy link

@szetszwo szetszwo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mingdaoy , thanks a lot for working on this! The change looks good. Just have a few questions/suggestions.

BTW, I am not a Kafka committer. We need to find a Kafka committer reviewing this.

clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslClient.java Outdated
@@ -190,7 +190,7 @@ private void setState(State state) {

private ClientFinalMessage handleServerFirstMessage(char[] password) throws SaslException {
try {
byte[] passwordBytes = ScramFormatter.normalize(new String(password));
byte[] passwordBytes = ScramFormatter.normalize(new String(password).toCharArray());
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not simply passing the password as below?

byte[] passwordBytes = ScramFormatter.normalize(password);

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image

core/src/main/scala/kafka/server/DelegationTokenManager.scala Outdated
@@ -106,7 +106,7 @@ class DelegationTokenManager(val config: KafkaConfig,
val scramCredentialMap = mutable.Map[String, ScramCredential]()

def scramCredential(mechanism: ScramMechanism): ScramCredential = {
new ScramFormatter(mechanism).generateCredential(hmacString, mechanism.minIterations)
new ScramFormatter(mechanism).generateCredential(hmacString.toCharArray, mechanism.minIterations)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be better if we change hmacString to not using String.

metadata/src/main/java/org/apache/kafka/metadata/storage/ScramParser.java Outdated
@@ -173,7 +173,9 @@ byte[] saltedPassword(byte[] salt, int iterations) throws Exception {
return configuredSaltedPassword.get();
}
return new ScramFormatter(mechanism).saltedPassword(
configuredPasswordString.get(),
configuredPasswordString
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similarly, it would be better if we change configuredPasswordString to not using String.

mingdaoy
mingdaoy commented Mar 5, 2025
View reviewed changes
metadata/src/main/java/org/apache/kafka/metadata/storage/ScramParser.java
@@ -173,7 +173,8 @@ byte[] saltedPassword(byte[] salt, int iterations) throws Exception {
return configuredSaltedPassword.get();
}
return new ScramFormatter(mechanism).saltedPassword(
configuredPasswordString.get(),
configuredPassword
Copy link
Contributor Author

@mingdaoy mingdaoy Mar 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@szetszwo Thanks for the review!

ScramParserTest:
image

mingdaoy
mingdaoy commented Mar 5, 2025
View reviewed changes
core/src/main/scala/kafka/server/DelegationTokenManager.scala
val scramCredentialMap = mutable.Map[String, ScramCredential]()

def scramCredential(mechanism: ScramMechanism): ScramCredential = {
new ScramFormatter(mechanism).generateCredential(hmacString, mechanism.minIterations)
new ScramFormatter(mechanism).generateCredential(hmacChars, mechanism.minIterations)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See hmacChars

mingdaoy
mingdaoy commented Mar 5, 2025
View reviewed changes
clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslClient.java
@@ -190,7 +190,7 @@ private void setState(State state) {

private ClientFinalMessage handleServerFirstMessage(char[] password) throws SaslException {
try {
byte[] passwordBytes = ScramFormatter.normalize(new String(password));
byte[] passwordBytes = ScramFormatter.normalize(password);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

password

@github-actions github-actions bot removed the triage PRs from the community label Mar 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@szetszwo szetszwo szetszwo left review comments

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
ci-approved clients core Kafka Broker kraft small Small PRs
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@mingdaoy @szetszwo @chia7712