Return-Path: Delivered-To: apmail-db-derby-dev-archive@www.apache.org Received: (qmail 90065 invoked from network); 1 Apr 2008 23:19:53 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2) by minotaur.apache.org with SMTP; 1 Apr 2008 23:19:53 -0000 Received: (qmail 40305 invoked by uid 500); 1 Apr 2008 23:19:52 -0000 Delivered-To: apmail-db-derby-dev-archive@db.apache.org Received: (qmail 40272 invoked by uid 500); 1 Apr 2008 23:19:52 -0000 Mailing-List: contact derby-dev-help@db.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: Delivered-To: mailing list derby-dev@db.apache.org Received: (qmail 40258 invoked by uid 99); 1 Apr 2008 23:19:52 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 01 Apr 2008 16:19:52 -0700 X-ASF-Spam-Status: No, hits=-2000.0 required=10.0 tests=ALL_TRUSTED X-Spam-Check-By: apache.org Received: from [140.211.11.140] (HELO brutus.apache.org) (140.211.11.140) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 01 Apr 2008 23:19:09 +0000 Received: from brutus (localhost [127.0.0.1]) by brutus.apache.org (Postfix) with ESMTP id AD582234C0B7 for ; Tue, 1 Apr 2008 16:17:24 -0700 (PDT) Message-ID: <1431816804.1207091844709.JavaMail.jira@brutus> Date: Tue, 1 Apr 2008 16:17:24 -0700 (PDT) From: "Martin Zaun (JIRA)" To: derby-dev@db.apache.org Subject: [jira] Resolved: (DERBY-3537) Invalid use shutdown authentication checks in NetworkServerControlImpl.directShutdown() In-Reply-To: <1708882271.1205465364289.JavaMail.jira@brutus> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked by ClamAV on apache.org [ https://issues.apache.org/jira/browse/DERBY-3537?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Martin Zaun resolved DERBY-3537. -------------------------------- Resolution: Fixed Fix Version/s: 10.4.0.0 Changes committed, resolving this issue. > Invalid use shutdown authentication checks in NetworkServerControlImpl.directShutdown() > ---------------------------------------------------------------------------------------- > > Key: DERBY-3537 > URL: https://issues.apache.org/jira/browse/DERBY-3537 > Project: Derby > Issue Type: Bug > Components: Network Server > Reporter: Daniel John Debrunner > Assignee: Martin Zaun > Priority: Minor > Fix For: 10.4.0.0 > > Attachments: DERBY-3537-01.diff, DERBY-3537-01.stat > > > If ClientThread hits an SSLException exception it will call NetworkServerControlImpl.directShutdown(). > DERBY-2109 added privilege checking to directShutdown() that includes authentication. > I can't see how this call by ClientThread can be valid. Authentication is not required to start the network server, thus a NetworkServerControl with no user,password may be used and thus passed onto directShutdown() failing authentication and then failing to perform the failed shutdown? > I think the error was adding the privilege check in DERBY-2109, it looks like this method is for use only within the network server (actually this is the only use of it), maybe the correct security mechanism would have been to make the method package private? -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online.