zheng1771 opened a new pull request, #14596: URL: https://github.com/apache/cloudstack/pull/14596
### Description Validate client certificate signatures with the configured Root CA when strict authentication is enabled. Run this check before the existing revocation, validity and ownership checks. Reject the certificate if signature verification fails or the Root CA certificate is missing. Rejected certificates are not added to the active certificate map. Keep the current non-strict authentication and expired certificate settings. Add six tests using real certificates. <!--- Describe your changes in DETAIL - And how has behaviour functionally changed. --> <!-- For new features, provide link to FS, dev ML discussion etc. --> <!-- In case of bug fix, the expected and actual behaviours, steps to reproduce. --> <!-- When "Fixes: #<id>" is specified, the issue/PR will automatically be closed when this PR gets merged --> <!-- For addressing multiple issues/PRs, use multiple "Fixes: #<id>" --> <!-- Fixes: # --> <!--- ******************************************************************************* --> <!--- NOTE: AUTOMATION USES THE DESCRIPTIONS TO SET LABELS AND PRODUCE DOCUMENTATION. --> <!--- PLEASE PUT AN 'X' in only **ONE** box --> <!--- ******************************************************************************* --> ### Types of changes - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] New feature (non-breaking change which adds functionality) - [x] Bug fix (non-breaking change which fixes an issue) - [ ] Enhancement (improves an existing feature and functionality) - [ ] Cleanup (Code refactoring and cleanup, that may add test cases) - [ ] Build/CI - [ ] Test (unit or integration test code) ### Feature/Enhancement Scale or Bug Severity #### Feature/Enhancement Scale - [ ] Major - [ ] Minor #### Bug Severity - [ ] BLOCKER - [x] Critical - [ ] Major - [ ] Minor - [ ] Trivial Strict authentication must verify certificates against the configured CA. ### Screenshots (if appropriate): Not applicable. ### How Has This Been Tested? Tested with OpenJDK 17 and Maven 3.8.7. All 28 tests in RootCACustomTrustManagerTest and RootCAProviderTest passed. Required modules compiled and Checkstyle passed. Full project build and live TLS handshake testing were not run. <!-- Please describe in detail how you tested your changes. --> <!-- Include details of your testing environment, and the tests you ran to --> #### How did you try to break this feature and the system with this change? Added tests for: - A valid client certificate signed by the configured Root CA. - A self-signed client certificate in strict mode. - A client certificate signed by a different CA with the same subject. - An untrusted client certificate with the trusted root added to its chain. - A missing Root CA certificate. - A self-signed client certificate in non-strict mode. Four rejection tests failed before the change and passed after it. Rejected certificates leave the active certificate map empty. Existing expiry, revocation and ownership tests also passed. <!-- see how your change affects other areas of the code, etc. --> <!-- Please read the [CONTRIBUTING](https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md) document --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
