Return-Path: X-Original-To: apmail-hadoop-common-issues-archive@minotaur.apache.org Delivered-To: apmail-hadoop-common-issues-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 4907E18095 for ; Wed, 17 Feb 2016 21:03:20 +0000 (UTC) Received: (qmail 76885 invoked by uid 500); 17 Feb 2016 21:03:18 -0000 Delivered-To: apmail-hadoop-common-issues-archive@hadoop.apache.org Received: (qmail 76583 invoked by uid 500); 17 Feb 2016 21:03:18 -0000 Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: common-issues@hadoop.apache.org Delivered-To: mailing list common-issues@hadoop.apache.org Received: (qmail 76532 invoked by uid 99); 17 Feb 2016 21:03:18 -0000 Received: from arcas.apache.org (HELO arcas) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 17 Feb 2016 21:03:18 +0000 Received: from arcas.apache.org (localhost [127.0.0.1]) by arcas (Postfix) with ESMTP id 153882C1F57 for ; Wed, 17 Feb 2016 21:03:18 +0000 (UTC) Date: Wed, 17 Feb 2016 21:03:18 +0000 (UTC) From: "Wei-Chiu Chuang (JIRA)" To: common-issues@hadoop.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Updated] (HADOOP-12816) Log peer's address if the peer does not negotiate AES cipher codec MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/HADOOP-12816?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Wei-Chiu Chuang updated HADOOP-12816: ------------------------------------- Summary: Log peer's address if the peer does not negotiate AES cipher codec (was: Log peer's address if the pree does not negotiate AES cipher codec) > Log peer's address if the peer does not negotiate AES cipher codec > ------------------------------------------------------------------ > > Key: HADOOP-12816 > URL: https://issues.apache.org/jira/browse/HADOOP-12816 > Project: Hadoop Common > Issue Type: Improvement > Reporter: Wei-Chiu Chuang > Assignee: Wei-Chiu Chuang > Labels: encryption, supportability > > We've had difficulty probing the root cause of performance slowdown with in-transit encryption using AES-NI. We finally found the root cause was the Hadoop client did not configure encryption properties correctly, so they did not negotiate AES cipher suite when creating an encrypted stream pair, despite the server (a data node) supports it. Existing debug message did not help. We saw debug message "Server using cipher suite AES/CTR/NoPadding" on the same data node, but that refers to the communication with other data nodes. > It would be really helpful to log a debug message if a SASL server configures AES cipher suite, but the SASL client doesn't, or vice versa. This debug message should also log the client address to differentiate it from other stream pairs. > More over, the debug message "Server using cipher suite AES/CTR/NoPadding" should also be extended to include the client's address. -- This message was sent by Atlassian JIRA (v6.3.4#6332)