This is an automated email from the ASF dual-hosted git repository.
sammichen pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/master by this push:
new cf0235fb02 HDDS-8030. Cleanup unused/unnecessary code related to
CertificateClient (#4317)
cf0235fb02 is described below
commit cf0235fb02cf65064d0679340f0b457120f66e77
Author: Istvan Fajth <[email protected]>
AuthorDate: Tue Mar 7 04:04:27 2023 +0100
HDDS-8030. Cleanup unused/unnecessary code related to CertificateClient
(#4317)
---
.../apache/hadoop/ozone/HddsDatanodeService.java | 2 -
.../hadoop/ozone/TestHddsSecureDatanodeInit.java | 20 --
hadoop-hdds/framework/pom.xml | 11 +
.../hdds/security/ssl/ReloadingX509KeyManager.java | 13 +-
.../certificate/authority/DefaultApprover.java | 8 +-
.../x509/certificate/client/CertificateClient.java | 274 +++++--------------
.../certificate/client/DNCertificateClient.java | 15 +-
.../client/DefaultCertificateClient.java | 293 ++-------------------
.../certificate/client/SCMCertificateClient.java | 14 +-
.../certificate/utils/CertificateSignRequest.java | 55 +++-
.../certificate/utils/SelfSignedCertificate.java | 24 +-
.../hdds/security/x509/keys/SecurityUtil.java | 55 +---
.../ssl/TestPemFileBasedKeyStoresFactory.java | 6 +-
.../security/ssl/TestReloadingX509KeyManager.java | 7 +-
.../ssl/TestReloadingX509TrustManager.java | 7 +-
.../token/TestOzoneBlockTokenSecretManager.java | 36 ++-
.../hdds/security/x509/CertificateClientTest.java | 291 --------------------
.../certificate/authority/TestDefaultCAServer.java | 8 +-
.../client/CertificateClientTestImpl.java | 141 +++-------
.../client/TestDefaultCertificateClient.java | 40 +--
.../utils/TestCertificateSignRequest.java | 13 +-
.../apache/hadoop/hdds/scm/ha/HASecurityUtils.java | 12 +-
hadoop-ozone/integration-test/pom.xml | 7 +
.../hdds/scm/storage/TestContainerCommandsEC.java | 2 +-
.../apache/hadoop/ozone/TestDelegationToken.java | 2 +-
.../hadoop/ozone/TestSecureOzoneCluster.java | 32 ++-
.../client/rpc/TestContainerStateMachine.java | 2 +-
.../rpc/TestContainerStateMachineFlushDelay.java | 2 +-
.../client/rpc/TestOzoneAtRestEncryption.java | 2 +-
.../ozone/client/rpc/TestSecureOzoneRpcClient.java | 2 +-
.../ozoneimpl/TestOzoneContainerWithTLS.java | 2 +-
.../ozoneimpl/TestSecureOzoneContainer.java | 2 +-
.../server/TestSecureContainerServer.java | 2 +-
.../hadoop/ozone/om/TestSecureOzoneManager.java | 20 +-
.../org/apache/hadoop/ozone/om/OzoneManager.java | 8 +-
.../hadoop/ozone/security/OMCertificateClient.java | 71 ++---
.../om/ratis/TestOzoneManagerRatisServer.java | 9 +-
.../security/TestOmCertificateClientInit.java | 10 +-
.../TestOzoneDelegationTokenSecretManager.java | 11 +-
.../org/apache/hadoop/ozone/recon/ReconServer.java | 10 +-
.../org/apache/hadoop/ozone/recon/ReconUtils.java | 29 --
.../recon/security}/ReconCertificateClient.java | 35 +--
.../hadoop/ozone/recon/security/package-info.java | 22 ++
.../impl/StorageContainerServiceProviderImpl.java | 5 +-
44 files changed, 406 insertions(+), 1226 deletions(-)
diff --git
a/hadoop-hdds/container-service/src/main/java/org/apache/hadoop/ozone/HddsDatanodeService.java
b/hadoop-hdds/container-service/src/main/java/org/apache/hadoop/ozone/HddsDatanodeService.java
index 49784eabc8..41965573b8 100644
---
a/hadoop-hdds/container-service/src/main/java/org/apache/hadoop/ozone/HddsDatanodeService.java
+++
b/hadoop-hdds/container-service/src/main/java/org/apache/hadoop/ozone/HddsDatanodeService.java
@@ -352,8 +352,6 @@ public class HddsDatanodeService extends GenericCli
implements ServicePlugin {
// persist cert ID to VERSION file
datanodeDetails.setCertSerialId(dnCertSerialId);
persistDatanodeDetails(datanodeDetails);
- // set new certificate ID
- certClient.setCertificateId(dnCertSerialId);
LOG.info("Successfully stored SCM signed certificate, case:{}.",
response);
break;
diff --git
a/hadoop-hdds/container-service/src/test/java/org/apache/hadoop/ozone/TestHddsSecureDatanodeInit.java
b/hadoop-hdds/container-service/src/test/java/org/apache/hadoop/ozone/TestHddsSecureDatanodeInit.java
index bb76de1f71..1923044a80 100644
---
a/hadoop-hdds/container-service/src/test/java/org/apache/hadoop/ozone/TestHddsSecureDatanodeInit.java
+++
b/hadoop-hdds/container-service/src/test/java/org/apache/hadoop/ozone/TestHddsSecureDatanodeInit.java
@@ -55,7 +55,6 @@ import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
import org.bouncycastle.cert.X509CertificateHolder;
-import org.bouncycastle.pkcs.PKCS10CertificationRequest;
import org.junit.Assert;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Assertions;
@@ -274,25 +273,6 @@ public class TestHddsSecureDatanodeInit {
}
}
- @Test
- public void testGetCSR() throws Exception {
- keyCodec.writePublicKey(publicKey);
- keyCodec.writePrivateKey(privateKey);
- service.setCertificateClient(client);
- PKCS10CertificationRequest csr =
- client.getCSRBuilder().build();
- Assertions.assertNotNull(csr);
-
- csr = client.getCSRBuilder().build();
- Assertions.assertNotNull(csr);
-
- csr = client.getCSRBuilder().build();
- Assertions.assertNotNull(csr);
-
- csr = client.getCSRBuilder().build();
- Assertions.assertNotNull(csr);
- }
-
@Test
@Disabled("HDDS-7874")
public void testCertificateRotation() throws Exception {
diff --git a/hadoop-hdds/framework/pom.xml b/hadoop-hdds/framework/pom.xml
index d49e86819d..746129aae2 100644
--- a/hadoop-hdds/framework/pom.xml
+++ b/hadoop-hdds/framework/pom.xml
@@ -182,6 +182,17 @@ https://maven.apache.org/xsd/maven-4.0.0.xsd";>
<excludeFilterFile>${basedir}/dev-support/findbugsExcludeFile.xml</excludeFilterFile>
</configuration>
</plugin>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-jar-plugin</artifactId>
+ <executions>
+ <execution>
+ <goals>
+ <goal>test-jar</goal>
+ </goals>
+ </execution>
+ </executions>
+ </plugin>
</plugins>
</build>
</project>
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/ssl/ReloadingX509KeyManager.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/ssl/ReloadingX509KeyManager.java
index 53e640050a..450d422bd5 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/ssl/ReloadingX509KeyManager.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/ssl/ReloadingX509KeyManager.java
@@ -35,6 +35,7 @@ import java.security.Principal;
import java.security.PrivateKey;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
+import java.util.Locale;
import java.util.concurrent.atomic.AtomicReference;
/**
@@ -79,7 +80,7 @@ public class ReloadingX509KeyManager extends
X509ExtendedKeyManager {
public ReloadingX509KeyManager(String type, CertificateClient caClient)
throws GeneralSecurityException, IOException {
this.type = type;
- keyManagerRef = new AtomicReference<X509ExtendedKeyManager>();
+ keyManagerRef = new AtomicReference<>();
keyManagerRef.set(loadKeyManager(caClient));
}
@@ -121,12 +122,18 @@ public class ReloadingX509KeyManager extends
X509ExtendedKeyManager {
@Override
public X509Certificate[] getCertificateChain(String s) {
- return keyManagerRef.get().getCertificateChain(s);
+ // see https://bugs.openjdk.org/browse/JDK-4891485
+ // the KeyManager stores the chain in a case-insensitive way making the
+ // alias lowercase upon initialization.
+ return keyManagerRef.get().getCertificateChain(s.toLowerCase(Locale.ROOT));
}
@Override
public PrivateKey getPrivateKey(String s) {
- return keyManagerRef.get().getPrivateKey(s);
+ // see: https://bugs.openjdk.org/browse/JDK-4891485
+ // the KeyManager stores the chain in a case-insensitive way making the
+ // alias lowercase upon initialization.
+ return keyManagerRef.get().getPrivateKey(s.toLowerCase(Locale.ROOT));
}
public ReloadingX509KeyManager loadFrom(CertificateClient caClient) {
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/DefaultApprover.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/DefaultApprover.java
index c3af15ff4e..4277dbe70f 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/DefaultApprover.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/DefaultApprover.java
@@ -22,7 +22,6 @@ package
org.apache.hadoop.hdds.security.x509.certificate.authority;
import org.apache.hadoop.hdds.security.exception.SCMSecurityException;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
import
org.apache.hadoop.hdds.security.x509.certificate.authority.profile.PKIProfile;
-import org.apache.hadoop.hdds.security.x509.keys.SecurityUtil;
import org.apache.hadoop.util.Time;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.x500.X500Name;
@@ -50,6 +49,9 @@ import java.security.PrivateKey;
import java.util.Date;
import java.util.concurrent.CompletableFuture;
+import static
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest.getDistinguishedName;
+import static
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest.getPkcs9Extensions;
+
/**
* Default Approver used the by the DefaultCA.
*/
@@ -119,7 +121,7 @@ public class DefaultApprover extends BaseApprover {
// will succeed only after datanode has a valid certificate.
String cn = x500Name.getRDNs(BCStyle.CN)[0].getFirst().getValue()
.toASN1Primitive().toString();
- x500Name = SecurityUtil.getDistinguishedName(cn, scmId, clusterId);
+ x500Name = getDistinguishedName(cn, scmId, clusterId);
} else {
// Throw exception if scmId and clusterId doesn't match.
throw new SCMSecurityException("ScmId and ClusterId in CSR subject" +
@@ -142,7 +144,7 @@ public class DefaultApprover extends BaseApprover {
validTill,
x500Name, keyInfo);
- Extensions exts = SecurityUtil.getPkcs9Extensions(certificationRequest);
+ Extensions exts = getPkcs9Extensions(certificationRequest);
for (ASN1ObjectIdentifier extId : getProfile().getSupportedExtensions()) {
Extension ext = exts.getExtension(extId);
if (ext != null) {
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java
index 73123c34a6..8c8a2df056 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java
@@ -23,19 +23,14 @@ import
org.apache.hadoop.hdds.security.OzoneSecurityException;
import org.apache.hadoop.hdds.security.ssl.KeyStoresFactory;
import org.apache.hadoop.hdds.security.x509.certificate.authority.CAType;
import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest;
-import org.apache.hadoop.hdds.security.x509.crl.CRLInfo;
import org.apache.hadoop.hdds.security.x509.exception.CertificateException;
import org.bouncycastle.pkcs.PKCS10CertificationRequest;
import java.io.Closeable;
import java.io.IOException;
-import java.io.InputStream;
-import java.nio.file.Path;
-import java.security.KeyPair;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.cert.CertPath;
-import java.security.cert.CertStore;
import java.security.cert.X509Certificate;
import java.util.List;
import java.util.Objects;
@@ -48,6 +43,12 @@ import static
org.apache.hadoop.hdds.security.OzoneSecurityException.ResultCodes
*/
public interface CertificateClient extends Closeable {
+ /**
+ * Return component name of this certificate client.
+ * @return component name
+ */
+ String getComponentName();
+
/**
* Returns the private key of the specified component if it exists on the
* local system.
@@ -64,6 +65,14 @@ public interface CertificateClient extends Closeable {
*/
PublicKey getPublicKey();
+ /**
+ * Returns the certificate used by the specified component if it exists
+ * on the local system.
+ *
+ * @return the target certificate or null if there is no data.
+ */
+ X509Certificate getCertificate();
+
/**
* Returns the certificate of the specified component if it exists on the
* local system.
@@ -83,12 +92,11 @@ public interface CertificateClient extends Closeable {
CertPath getCertPath();
/**
- * Returns the certificate used by the specified component if it exists
- * on the local system.
+ * Return the latest CA certificate known to the client.
*
- * @return the target certificate or null if there is no data.
+ * @return latest ca certificate known to the client.
*/
- X509Certificate getCertificate();
+ X509Certificate getCACertificate();
/**
* Returns the full certificate path for the CA certificate known to the
@@ -99,50 +107,48 @@ public interface CertificateClient extends Closeable {
CertPath getCACertPath();
/**
- * Return the latest CA certificate known to the client.
+ * Return the latest Root CA certificate known to the client.
+ * @return latest Root CA certificate known to the client.
+ */
+ X509Certificate getRootCACertificate();
+
+ /**
+ * Return the pem encoded CA certificate list.
*
- * @return latest ca certificate known to the client.
+ * If initialized return list of pem encoded CA certificates, else return
+ * null.
+ * @return list of pem encoded CA certificates.
*/
- X509Certificate getCACertificate();
+ List<String> getCAList();
/**
- * Verifies if this certificate is part of a trusted chain.
- * @param certificate - certificate.
- * @return true if it trusted, false otherwise.
+ * Return the pem encoded CA certificate list.
+ *
+ * If list is null, fetch the list from SCM and returns the list.
+ * If list is not null, return the pem encoded CA certificate list.
+ *
+ * @return list of pem encoded CA certificates.
+ * @throws IOException
*/
- boolean verifyCertificate(X509Certificate certificate);
+ List<String> listCA() throws IOException;
/**
- * Set the serial ID of default certificate for the specified component.
- * @param certSerialId - certificate ID.
- * */
- void setCertificateId(String certSerialId);
+ * Update and returns the pem encoded CA certificate list.
+ * @return list of pem encoded CA certificates.
+ * @throws IOException
+ */
+ List<String> updateCAList() throws IOException;
/**
* Creates digital signature over the data stream using the components
private
* key.
*
- * @param stream - Data stream to sign.
- * @return byte array - containing the signature.
- * @throws CertificateException - on Error.
+ * @param data data to be signed
+ * @return byte array - containing the signature
+ * @throws CertificateException - on Error
*/
- byte[] signDataStream(InputStream stream)
- throws CertificateException;
-
byte[] signData(byte[] data) throws CertificateException;
- /**
- * Verifies a digital Signature, given the signature and the certificate of
- * the signer.
- *
- * @param stream - Data Stream.
- * @param signature - Byte Array containing the signature.
- * @param cert - Certificate of the Signer.
- * @return true if verified, false if not.
- */
- boolean verifySignature(InputStream stream, byte[] signature,
- X509Certificate cert) throws CertificateException;
-
/**
* Verifies a digital Signature, given the signature and the certificate of
* the signer.
@@ -154,15 +160,6 @@ public interface CertificateClient extends Closeable {
boolean verifySignature(byte[] data, byte[] signature,
X509Certificate cert) throws CertificateException;
- /**
- * Returns a CSR builder that can be used to creates a Certificate sigining
- * request.
- *
- * @return CertificateSignRequest.Builder
- */
- CertificateSignRequest.Builder getCSRBuilder(KeyPair keyPair)
- throws IOException;
-
/**
* Returns a CSR builder that can be used to create a Certificate sigining
* request.
@@ -172,15 +169,6 @@ public interface CertificateClient extends Closeable {
CertificateSignRequest.Builder getCSRBuilder()
throws CertificateException;
- /**
- * Send request to SCM to sign the certificate and save certificates returned
- * by SCM to PEM files on disk.
- *
- * @return the serial ID of the new certificate
- */
- String signAndStoreCertificate(PKCS10CertificationRequest request,
- Path certPath) throws CertificateException;
-
/**
* Send request to SCM to sign the certificate and save certificates returned
* by SCM to PEM files on disk.
@@ -190,53 +178,45 @@ public interface CertificateClient extends Closeable {
String signAndStoreCertificate(PKCS10CertificationRequest request)
throws CertificateException;
- /**
- * Get the certificate of well-known entity from SCM.
- *
- * @param query - String Query, please see the implementation for the
- * discussion on the query formats.
- * @return X509Certificate or null if not found.
- */
- X509Certificate queryCertificate(String query);
-
/**
* Stores the Certificate for this client. Don't use this api to add
* trusted certificates of others.
*
* @param pemEncodedCert - pem encoded X509 Certificate
+ * @param caType - Is CA certificate.
* @throws CertificateException - on Error.
*/
- void storeCertificate(String pemEncodedCert)
+ void storeCertificate(String pemEncodedCert, CAType caType)
throws CertificateException;
+ default void assertValidKeysAndCertificate() throws OzoneSecurityException {
+ try {
+ Objects.requireNonNull(getPublicKey());
+ Objects.requireNonNull(getPrivateKey());
+ Objects.requireNonNull(getCertificate());
+ } catch (Exception e) {
+ throw new OzoneSecurityException("Error reading keypair & certificate",
e,
+ OM_PUBLIC_PRIVATE_KEY_FILE_NOT_EXIST);
+ }
+ }
+
/**
- * Stores the Certificate for this client. Don't use this api to add
- * trusted certificates of others.
- *
- * @param pemEncodedCert - pem encoded X509 Certificate
- * @param caType - Is CA certificate.
- * @throws CertificateException - on Error.
+ * Return the store factory for key manager and trust manager for server.
*/
- void storeCertificate(String pemEncodedCert, CAType caType)
- throws CertificateException;
+ KeyStoresFactory getServerKeyStoresFactory() throws CertificateException;
/**
- * Stores the trusted chain of certificates.
- *
- * @param certStore - Cert Store.
- * @throws CertificateException - on Error.
+ * Return the store factory for key manager and trust manager for client.
*/
- void storeTrustChain(CertStore certStore) throws CertificateException;
+ KeyStoresFactory getClientKeyStoresFactory() throws CertificateException;
/**
- * Stores the trusted chain of certificates.
+ * Register a receiver that will be called after the certificate renewed.
*
- * @param certificates - List of Certificates.
-
- * @throws CertificateException - on Error.
+ * @param receiver
*/
- void storeTrustChain(List<X509Certificate> certificates)
- throws CertificateException;
+ void registerNotificationReceiver(CertificateNotification receiver);
+
/**
* Initialize certificate client.
@@ -260,128 +240,4 @@ public interface CertificateClient extends Closeable {
RECOVER,
REINIT
}
-
- /**
- * Get signature algorithm used by signer.
- * @return signature algorithm
- */
- String getSignatureAlgorithm();
-
- /**
- * Get security provider.
- * @return security provider
- */
- String getSecurityProvider();
-
- /**
- * Return component name of this certificate client.
- * @return component name
- */
- String getComponentName();
-
- /**
- * Return the latest Root CA certificate known to the client.
- * @return latest Root CA certificate known to the client.
- */
- X509Certificate getRootCACertificate();
-
- /**
- * Store RootCA certificate.
- *
- * @param pemEncodedCert
- * @throws CertificateException
- */
- void storeRootCACertificate(String pemEncodedCert)
- throws CertificateException;
-
- /**
- * Return the pem encoded CA certificate list.
- *
- * If initialized return list of pem encoded CA certificates, else return
- * null.
- * @return list of pem encoded CA certificates.
- */
- List<String> getCAList();
-
- /**
- * Return the pem encoded CA certificate list.
- *
- * If list is null, fetch the list from SCM and returns the list.
- * If list is not null, return the pem encoded CA certificate list.
- *
- * @return list of pem encoded CA certificates.
- * @throws IOException
- */
- List<String> listCA() throws IOException;
-
- /**
- * Update and returns the pem encoded CA certificate list.
- * @return list of pem encoded CA certificates.
- * @throws IOException
- */
- List<String> updateCAList() throws IOException;
-
- /**
- * Get the CRLInfo based on the CRL Ids from SCM.
- * @param crlIds - list of crl ids
- * @return list of CRLInfo
- * @throws IOException
- */
- List<CRLInfo> getCrls(List<Long> crlIds) throws IOException;
-
- /**
- * Get the latest CRL id from SCM.
- * @return latest CRL id.
- * @throws IOException
- */
- long getLatestCrlId() throws IOException;
-
- default void assertValidKeysAndCertificate() throws OzoneSecurityException {
- try {
- Objects.requireNonNull(getPublicKey());
- Objects.requireNonNull(getPrivateKey());
- Objects.requireNonNull(getCertificate());
- } catch (Exception e) {
- throw new OzoneSecurityException("Error reading keypair & certificate",
e,
- OM_PUBLIC_PRIVATE_KEY_FILE_NOT_EXIST);
- }
- }
-
- /**
- * Get Local CRL id received.
- * @return
- */
- long getLocalCrlId();
-
- /**
- * Set Local CRL id.
- * @param crlId
- */
- void setLocalCrlId(long crlId);
-
- /**
- * Process crl and remove the certificates in the revoked cert list from
- * client.
- * @param crl
- * @return true if the client's own cert needs to be reinit
- * false otherwise;
- */
- boolean processCrl(CRLInfo crl);
-
- /**
- * Return the store factory for key manager and trust manager for server.
- */
- KeyStoresFactory getServerKeyStoresFactory() throws CertificateException;
-
- /**
- * Return the store factory for key manager and trust manager for client.
- */
- KeyStoresFactory getClientKeyStoresFactory() throws CertificateException;
-
- /**
- * Register a receiver that will be called after the certificate renewed.
- *
- * @param receiver
- */
- void registerNotificationReceiver(CertificateNotification receiver);
}
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DNCertificateClient.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DNCertificateClient.java
index 6d04d20674..d05de0b05c 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DNCertificateClient.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DNCertificateClient.java
@@ -70,19 +70,6 @@ public class DNCertificateClient extends
DefaultCertificateClient {
@Override
public CertificateSignRequest.Builder getCSRBuilder()
throws CertificateException {
- return getCSRBuilder(new KeyPair(getPublicKey(), getPrivateKey()));
- }
-
- /**
- * Returns a CSR builder that can be used to creates a Certificate signing
- * request.
- * The default flag is added to allow basic SSL handshake.
- *
- * @return CertificateSignRequest.Builder
- */
- @Override
- public CertificateSignRequest.Builder getCSRBuilder(KeyPair keyPair)
- throws CertificateException {
CertificateSignRequest.Builder builder = super.getCSRBuilder()
.setDigitalEncryption(true)
.setDigitalSignature(true);
@@ -92,7 +79,7 @@ public class DNCertificateClient extends
DefaultCertificateClient {
String subject = UserGroupInformation.getCurrentUser()
.getShortUserName() + "@" + hostname;
builder.setCA(false)
- .setKey(keyPair)
+ .setKey(new KeyPair(getPublicKey(), getPrivateKey()))
.setConfiguration(getConfig())
.setSubject(subject);
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DefaultCertificateClient.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DefaultCertificateClient.java
index b0b979f586..57087d0d24 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DefaultCertificateClient.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DefaultCertificateClient.java
@@ -19,10 +19,8 @@
package org.apache.hadoop.hdds.security.x509.certificate.client;
-import java.io.ByteArrayInputStream;
import java.io.File;
import java.io.IOException;
-import java.io.InputStream;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
@@ -38,20 +36,17 @@ import java.security.SecureRandom;
import java.security.Signature;
import java.security.SignatureException;
import java.security.cert.CertPath;
-import java.security.cert.CertStore;
import java.security.cert.X509Certificate;
import java.security.spec.InvalidKeySpecException;
import java.time.Duration;
import java.time.Instant;
import java.time.LocalDateTime;
import java.time.ZoneId;
-import java.util.ArrayList;
import java.util.Date;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Objects;
-import java.util.Random;
import java.util.Set;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.Executors;
@@ -68,7 +63,6 @@ import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import
org.apache.hadoop.hdds.protocolPB.SCMSecurityProtocolClientSideTranslatorPB;
import org.apache.hadoop.hdds.security.ssl.KeyStoresFactory;
import org.apache.hadoop.hdds.security.x509.certificate.authority.CAType;
-import org.apache.hadoop.hdds.security.x509.crl.CRLInfo;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
import org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateCodec;
import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest;
@@ -110,9 +104,8 @@ import org.slf4j.Logger;
*/
public abstract class DefaultCertificateClient implements CertificateClient {
- private static final Random RANDOM = new SecureRandom();
-
public static final String CERT_FILE_NAME_FORMAT = "%s.crt";
+
private final Logger logger;
private final SecurityConfig securityConfig;
private final KeyCodec keyCodec;
@@ -123,7 +116,6 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
private String certSerialId;
private String caCertId;
private String rootCaCertId;
- private long localCrlId;
private String component;
private List<String> pemEncodedCACerts = null;
private KeyStoresFactory serverKeyStoresFactory;
@@ -145,7 +137,7 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
private Set<CertificateNotification> notificationReceivers;
private static UserGroupInformation ugi;
- DefaultCertificateClient(SecurityConfig securityConfig, Logger log,
+ protected DefaultCertificateClient(SecurityConfig securityConfig, Logger log,
String certSerialId, String component,
Consumer<String> saveCertId, Runnable shutdown) {
Objects.requireNonNull(securityConfig);
@@ -153,21 +145,12 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
keyCodec = new KeyCodec(securityConfig, component);
this.logger = log;
this.certificateMap = new ConcurrentHashMap<>();
- this.certSerialId = certSerialId;
this.component = component;
this.certIdSaveCallback = saveCertId;
this.shutdownCallback = shutdown;
this.notificationReceivers = new HashSet<>();
- loadAllCertificates();
- }
-
- public synchronized void setCertificateId(String certId) {
- Preconditions.checkArgument(certSerialId == null,
- "certSerialId should only be set once if not renew");
- this.certSerialId = certId;
- // reload all new certs
- loadAllCertificates();
+ updateCertSerialId(certSerialId);
}
/**
@@ -375,29 +358,6 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
return this.getCertificateFromScm(certId);
}
- @Override
- public List<CRLInfo> getCrls(List<Long> crlIds) throws IOException {
- try {
- return getScmSecureClient().getCrls(crlIds);
- } catch (Exception e) {
- getLogger().error("Error while getting CRL with " +
- "CRL ids:{} from scm.", crlIds, e);
- throw new CertificateException("Error while getting CRL with " +
- "CRL ids:" + crlIds, e);
- }
- }
-
- @Override
- public long getLatestCrlId() throws IOException {
- try {
- return getScmSecureClient().getLatestCrlId();
- } catch (Exception e) {
- getLogger().error("Error while getting latest CRL id from scm.", e);
- throw new CertificateException("Error while getting latest CRL id from" +
- " scm.", e);
- }
- }
-
/**
* Get certificate from SCM and store it in local file system.
* @param certId
@@ -410,7 +370,7 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
certId);
try {
String pemEncodedCert = getScmSecureClient().getCertificate(certId);
- this.storeCertificate(pemEncodedCert);
+ this.storeCertificate(pemEncodedCert, CAType.NONE);
return CertificateCodec.getX509Certificate(pemEncodedCert);
} catch (Exception e) {
getLogger().error("Error while getting Certificate with " +
@@ -420,50 +380,6 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
}
}
- /**
- * Verifies if this certificate is part of a trusted chain.
- *
- * @param certificate - certificate.
- * @return true if it trusted, false otherwise.
- */
- @Override
- public boolean verifyCertificate(X509Certificate certificate) {
- throw new UnsupportedOperationException("Operation not supported.");
- }
-
- /**
- * Creates digital signature over the data stream using the s private key.
- *
- * @param stream - Data stream to sign.
- * @throws CertificateException - on Error.
- */
- @Override
- public byte[] signDataStream(InputStream stream)
- throws CertificateException {
- try {
- Signature sign = Signature.getInstance(getSignatureAlgorithm(),
- getSecurityProvider());
- sign.initSign(getPrivateKey());
- byte[] buffer = new byte[1024 * 4];
-
- int len;
- while (-1 != (len = stream.read(buffer))) {
- sign.update(buffer, 0, len);
- }
- return sign.sign();
- } catch (NoSuchAlgorithmException | NoSuchProviderException
- | InvalidKeyException | SignatureException | IOException e) {
- getLogger().error("Error while signing the stream", e);
- throw new CertificateException("Error while signing the stream", e,
- CRYPTO_SIGN_ERROR);
- }
- }
-
- @Override
- public String getSecurityProvider() {
- return securityConfig.getProvider();
- }
-
/**
* Creates digital signature over the data stream using the s private key.
*
@@ -473,8 +389,8 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
@Override
public byte[] signData(byte[] data) throws CertificateException {
try {
- Signature sign = Signature.getInstance(getSignatureAlgorithm(),
- getSecurityProvider());
+ Signature sign = Signature.getInstance(securityConfig.getSignatureAlgo(),
+ securityConfig.getProvider());
sign.initSign(getPrivateKey());
sign.update(data);
@@ -488,42 +404,6 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
}
}
- @Override
- public String getSignatureAlgorithm() {
- return securityConfig.getSignatureAlgo();
- }
-
- /**
- * Verifies a digital Signature, given the signature and the certificate of
- * the signer.
- *
- * @param stream - Data Stream.
- * @param signature - Byte Array containing the signature.
- * @param cert - Certificate of the Signer.
- * @return true if verified, false if not.
- */
- @Override
- public boolean verifySignature(InputStream stream, byte[] signature,
- X509Certificate cert) throws CertificateException {
- try {
- Signature sign = Signature.getInstance(getSignatureAlgorithm(),
- getSecurityProvider());
- sign.initVerify(cert);
- byte[] buffer = new byte[1024 * 4];
-
- int len;
- while (-1 != (len = stream.read(buffer))) {
- sign.update(buffer, 0, len);
- }
- return sign.verify(signature);
- } catch (NoSuchAlgorithmException | NoSuchProviderException
- | InvalidKeyException | SignatureException | IOException e) {
- getLogger().error("Error while signing the stream", e);
- throw new CertificateException("Error while signing the stream", e,
- CRYPTO_SIGNATURE_VERIFICATION_ERROR);
- }
- }
-
/**
* Verifies a digital Signature, given the signature and the certificate of
* the signer.
@@ -537,8 +417,8 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
public boolean verifySignature(byte[] data, byte[] signature,
X509Certificate cert) throws CertificateException {
try {
- Signature sign = Signature.getInstance(getSignatureAlgorithm(),
- getSecurityProvider());
+ Signature sign = Signature.getInstance(securityConfig.getSignatureAlgo(),
+ securityConfig.getProvider());
sign.initVerify(cert);
sign.update(data);
return sign.verify(signature);
@@ -562,8 +442,8 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
private boolean verifySignature(byte[] data, byte[] signature,
PublicKey pubKey) throws CertificateException {
try {
- Signature sign = Signature.getInstance(getSignatureAlgorithm(),
- getSecurityProvider());
+ Signature sign = Signature.getInstance(securityConfig.getSignatureAlgo(),
+ securityConfig.getProvider());
sign.initVerify(pubKey);
sign.update(data);
return sign.verify(signature);
@@ -606,32 +486,6 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
return builder;
}
- /**
- * Get the certificate of well-known entity from SCM.
- *
- * @param query - String Query, please see the implementation for the
- * discussion on the query formats.
- * @return X509Certificate or null if not found.
- */
- @Override
- public X509Certificate queryCertificate(String query) {
- // TODO:
- throw new UnsupportedOperationException("Operation not supported");
- }
-
- /**
- * Stores the Certificate for this client. Don't use this api to add trusted
- * certificates of others.
- *
- * @param pemEncodedCert - pem encoded X509 Certificate
- * @throws CertificateException - on Error.
- */
- @Override
- public void storeCertificate(String pemEncodedCert)
- throws CertificateException {
- this.storeCertificate(pemEncodedCert, CAType.NONE);
- }
-
/**
* Stores the Certificate for this client. Don't use this api to add trusted
* certificates of others.
@@ -679,31 +533,6 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
}
}
- /**
- * Stores the trusted chain of certificates for a specific .
- *
- * @param ks - Key Store.
- * @throws CertificateException - on Error.
- */
- @Override
- public void storeTrustChain(CertStore ks)
- throws CertificateException {
- throw new UnsupportedOperationException("Operation not supported.");
- }
-
-
- /**
- * Stores the trusted chain of certificates for a specific .
- *
- * @param certificates - List of Certificates.
- * @throws CertificateException - on Error.
- */
- @Override
- public void storeTrustChain(List<X509Certificate> certificates)
- throws CertificateException {
- throw new UnsupportedOperationException("Operation not supported.");
- }
-
/**
* Defines 8 cases of initialization.
* Each case specifies objects found.
@@ -957,10 +786,9 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
protected boolean validateKeyPair(PublicKey pubKey)
throws CertificateException {
byte[] challenge =
- RandomStringUtils.random(1000, 0, 0, false, false, null, RANDOM)
- .getBytes(StandardCharsets.UTF_8);
- byte[] sign = signDataStream(new ByteArrayInputStream(challenge));
- return verifySignature(challenge, sign, pubKey);
+ RandomStringUtils.random(1000, 0, 0, false, false, null,
+ new SecureRandom()).getBytes(StandardCharsets.UTF_8);
+ return verifySignature(challenge, signData(challenge), pubKey);
}
/**
@@ -1014,14 +842,6 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
return null;
}
- @Override
- public void storeRootCACertificate(String pemEncodedCert)
- throws CertificateException {
- CertificateCodec certificateCodec = new CertificateCodec(securityConfig,
- component);
- storeCertificate(pemEncodedCert, CAType.ROOT, certificateCodec, true);
- }
-
@Override
public synchronized List<String> getCAList() {
return pemEncodedCACerts;
@@ -1047,63 +867,6 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
}
}
- @Override
- public boolean processCrl(CRLInfo crl) {
- List<String> certIds2Remove = new ArrayList();
- crl.getX509CRL().getRevokedCertificates().forEach(
- cert -> certIds2Remove.add(cert.getSerialNumber().toString()));
- boolean reinitCert = removeCertificates(certIds2Remove);
- setLocalCrlId(crl.getCrlSequenceID());
- return reinitCert;
- }
-
- private synchronized boolean removeCertificates(List<String> certIds) {
- boolean reInitCert = false;
-
- // For now, remove self cert and ca cert is not implemented
- // both requires a restart of the service.
- if ((certSerialId != null && certIds.contains(certSerialId)) ||
- (caCertId != null && certIds.contains(caCertId)) ||
- (rootCaCertId != null && certIds.contains(rootCaCertId))) {
- reInitCert = true;
- }
-
- Path basePath = securityConfig.getCertificateLocation(component);
- for (String certId : certIds) {
- if (certificateMap.containsKey(certId)) {
- // remove on disk
- String certName = String.format(CERT_FILE_NAME_FORMAT, certId);
-
- if (certId.equals(caCertId)) {
- certName = CAType.SUBORDINATE.getFileNamePrefix() + certName;
- }
-
- if (certId.equals(rootCaCertId)) {
- certName = CAType.ROOT.getFileNamePrefix() + certName;
- }
-
- FileUtils.deleteQuietly(basePath.resolve(certName).toFile());
- // remove in memory
- certificateMap.remove(certId);
-
- // TODO: reset certSerialId, caCertId or rootCaCertId
- }
- }
- return reInitCert;
- }
-
- public long getLocalCrlId() {
- return this.localCrlId;
- }
-
- /**
- * Set Local CRL id.
- * @param crlId
- */
- public void setLocalCrlId(long crlId) {
- this.localCrlId = crlId;
- }
-
@Override
public synchronized KeyStoresFactory getServerKeyStoresFactory()
throws CertificateException {
@@ -1216,7 +979,8 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
// Get certificate signed
String newCertSerialId;
try {
- CertificateSignRequest.Builder csrBuilder = getCSRBuilder(newKeyPair);
+ CertificateSignRequest.Builder csrBuilder = getCSRBuilder();
+ csrBuilder.setKey(newKeyPair);
newCertSerialId = signAndStoreCertificate(csrBuilder.build(),
Paths.get(newCertPath));
} catch (Exception e) {
@@ -1363,11 +1127,10 @@ public abstract class DefaultCertificateClient
implements CertificateClient {
privateKey = null;
publicKey = null;
certPath = null;
- certSerialId = null;
caCertId = null;
rootCaCertId = null;
- setCertificateId(newCertId);
+ updateCertSerialId(newCertId);
getLogger().info("Reset and reload key and all certificates.");
}
@@ -1379,27 +1142,27 @@ public abstract class DefaultCertificateClient
implements CertificateClient {
return (OzoneConfiguration)securityConfig.getConfiguration();
}
- @Override
- public abstract String signAndStoreCertificate(
+ private synchronized void updateCertSerialId(String newCertSerialId) {
+ certSerialId = newCertSerialId;
+ loadAllCertificates();
+ }
+
+ protected abstract String signAndStoreCertificate(
PKCS10CertificationRequest request, Path certificatePath)
throws CertificateException;
- public String signAndStoreCertificate(PKCS10CertificationRequest request)
- throws CertificateException {
- return signAndStoreCertificate(request,
- getSecurityConfig().getCertificateLocation(getComponentName()));
+ public String signAndStoreCertificate(
+ PKCS10CertificationRequest request) throws CertificateException {
+ updateCertSerialId(signAndStoreCertificate(request,
+ getSecurityConfig().getCertificateLocation(getComponentName())));
+ return certSerialId;
}
- @Override
- public abstract CertificateSignRequest.Builder getCSRBuilder(KeyPair keyPair)
- throws CertificateException;
-
public SCMSecurityProtocolClientSideTranslatorPB getScmSecureClient()
throws IOException {
if (scmSecurityProtocolClient == null) {
scmSecurityProtocolClient =
- getScmSecurityClientWithMaxRetry(
- (OzoneConfiguration) securityConfig.getConfiguration(), ugi);
+ getScmSecurityClientWithMaxRetry(getConfig(), ugi);
}
return scmSecurityProtocolClient;
}
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/SCMCertificateClient.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/SCMCertificateClient.java
index 8b687296cb..2f64017af6 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/SCMCertificateClient.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/SCMCertificateClient.java
@@ -54,10 +54,6 @@ public class SCMCertificateClient extends
DefaultCertificateClient {
super(securityConfig, LOG, certSerialId, COMPONENT_NAME, null, null);
}
- public SCMCertificateClient(SecurityConfig securityConfig) {
- super(securityConfig, LOG, null, COMPONENT_NAME, null, null);
- }
-
public SCMCertificateClient(SecurityConfig securityConfig,
String certSerialId, String component) {
super(securityConfig, LOG, certSerialId, component, null, null);
@@ -135,7 +131,8 @@ public class SCMCertificateClient extends
DefaultCertificateClient {
.setDigitalEncryption(true)
.setDigitalSignature(true)
// Set CA to true, as this will be used to sign certs for OM/DN.
- .setCA(true);
+ .setCA(true)
+ .setKey(new KeyPair(getPublicKey(), getPrivateKey()));
}
@@ -150,11 +147,4 @@ public class SCMCertificateClient extends
DefaultCertificateClient {
throw new UnsupportedOperationException("signAndStoreCertificate of " +
" SCMCertificateClient is not supported currently");
}
-
- @Override
- public CertificateSignRequest.Builder getCSRBuilder(KeyPair keyPair)
- throws CertificateException {
- throw new UnsupportedOperationException("getCSRBuilder of " +
- "SCMCertificateClient is not supported currently");
- }
}
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/utils/CertificateSignRequest.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/utils/CertificateSignRequest.java
index e758f31306..68a0a18fe5 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/utils/CertificateSignRequest.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/utils/CertificateSignRequest.java
@@ -30,17 +30,19 @@ import org.apache.hadoop.hdds.conf.ConfigurationSource;
import org.apache.hadoop.hdds.security.exception.SCMSecurityException;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
import org.apache.hadoop.hdds.security.x509.exception.CertificateException;
-import org.apache.hadoop.hdds.security.x509.keys.SecurityUtil;
import com.google.common.base.Preconditions;
import org.apache.logging.log4j.util.Strings;
import org.bouncycastle.asn1.ASN1EncodableVector;
import org.bouncycastle.asn1.ASN1Object;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.ASN1Set;
import org.bouncycastle.asn1.DEROctetString;
import org.bouncycastle.asn1.DERSequence;
import org.bouncycastle.asn1.DERTaggedObject;
import org.bouncycastle.asn1.DERUTF8String;
+import org.bouncycastle.asn1.pkcs.Attribute;
import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x509.BasicConstraints;
@@ -66,6 +68,8 @@ import static
org.apache.hadoop.hdds.security.exception.SCMSecurityException.Err
* PKCS10CertificationRequest to CertificateServer.
*/
public final class CertificateSignRequest {
+ // Ozone Certificate distinguished format: (CN=Subject,OU=ScmID,O=ClusterID).
+ private static final String DISTINGUISHED_NAME_FORMAT = "CN=%s,OU=%s,O=%s";
private final KeyPair keyPair;
private final SecurityConfig config;
private final Extensions extensions;
@@ -94,10 +98,46 @@ public final class CertificateSignRequest {
this.extensions = extensions;
}
+ public static String getDistinguishedNameFormat() {
+ return DISTINGUISHED_NAME_FORMAT;
+ }
+
+ public static X500Name getDistinguishedName(String subject, String scmID,
+ String clusterID) {
+ return new X500Name(String.format(getDistinguishedNameFormat(), subject,
+ scmID, clusterID));
+ }
+
+ public static Extensions getPkcs9Extensions(PKCS10CertificationRequest csr)
+ throws CertificateException {
+ ASN1Set pkcs9ExtReq = getPkcs9ExtRequest(csr);
+ Object extReqElement = pkcs9ExtReq.getObjects().nextElement();
+ if (extReqElement instanceof Extensions) {
+ return (Extensions) extReqElement;
+ } else {
+ if (extReqElement instanceof ASN1Sequence) {
+ return Extensions.getInstance((ASN1Sequence) extReqElement);
+ } else {
+ throw new CertificateException("Unknown element type :" + extReqElement
+ .getClass().getSimpleName());
+ }
+ }
+ }
+
+ public static ASN1Set getPkcs9ExtRequest(PKCS10CertificationRequest csr)
+ throws CertificateException {
+ for (Attribute attr : csr.getAttributes()) {
+ ASN1ObjectIdentifier oid = attr.getAttrType();
+ if (oid.equals(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest)) {
+ return attr.getAttrValues();
+ }
+ }
+ throw new CertificateException("No PKCS#9 extension found in CSR");
+ }
+
private PKCS10CertificationRequest generateCSR() throws
OperatorCreationException {
- X500Name dnName = SecurityUtil.getDistinguishedName(subject, scmID,
- clusterID);
+ X500Name dnName = getDistinguishedName(subject, scmID, clusterID);
PKCS10CertificationRequestBuilder p10Builder =
new JcaPKCS10CertificationRequestBuilder(dnName, keyPair.getPublic());
@@ -331,13 +371,12 @@ public final class CertificateSignRequest {
return csr.generateCSR();
} catch (IOException ioe) {
throw new CertificateException(String.format("Unable to create " +
- "extension for certificate sign request for %s.", SecurityUtil
- .getDistinguishedName(subject, scmID, clusterID)), ioe.getCause());
+ "extension for certificate sign request for %s.",
+ getDistinguishedName(subject, scmID, clusterID)), ioe.getCause());
} catch (OperatorCreationException ex) {
throw new CertificateException(String.format("Unable to create " +
- "certificate sign request for %s.", SecurityUtil
- .getDistinguishedName(subject, scmID, clusterID)),
- ex.getCause());
+ "certificate sign request for %s.",
+ getDistinguishedName(subject, scmID, clusterID)), ex.getCause());
}
}
}
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/utils/SelfSignedCertificate.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/utils/SelfSignedCertificate.java
index db25278c63..a7feb74ce5 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/utils/SelfSignedCertificate.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/utils/SelfSignedCertificate.java
@@ -104,7 +104,7 @@ public final class SelfSignedCertificate {
return new Builder();
}
- private X509CertificateHolder generateCertificate(boolean isCA)
+ private X509CertificateHolder generateCertificate(BigInteger caCertSerialId)
throws OperatorCreationException, IOException {
// For the Root Certificate we form the name from Subject, SCM ID and
// Cluster ID.
@@ -119,13 +119,11 @@ public final class SelfSignedCertificate {
new JcaContentSignerBuilder(config.getSignatureAlgo())
.setProvider(config.getProvider()).build(key.getPrivate());
- // Please note: Since this is a root certificate we use "ONE" as the
- // serial number. Also note that skip enforcing locale or UTC. We are
- // trying to operate at the Days level, hence Time zone is also skipped for
- // now.
- BigInteger serial = BigInteger.ONE;
- if (!isCA) {
+ BigInteger serial;
+ if (caCertSerialId == null) {
serial = new BigInteger(Long.toString(Time.monotonicNow()));
+ } else {
+ serial = caCertSerialId;
}
// Valid from the Start of the day when we generate this Certificate.
@@ -139,7 +137,7 @@ public final class SelfSignedCertificate {
X509v3CertificateBuilder builder = new X509v3CertificateBuilder(name,
serial, validFrom, validTill, name, publicKeyInfo);
- if (isCA) {
+ if (caCertSerialId != null) {
builder.addExtension(Extension.basicConstraints, true,
new BasicConstraints(true));
int keyUsageFlag = KeyUsage.keyCertSign | KeyUsage.cRLSign;
@@ -170,7 +168,7 @@ public final class SelfSignedCertificate {
private LocalDateTime endDate;
private KeyPair key;
private SecurityConfig config;
- private boolean isCA;
+ private BigInteger caCertSerialId;
private List<GeneralName> altNames;
public Builder setConfiguration(ConfigurationSource configuration) {
@@ -209,7 +207,11 @@ public final class SelfSignedCertificate {
}
public Builder makeCA() {
- isCA = true;
+ return makeCA(BigInteger.ONE);
+ }
+
+ public Builder makeCA(BigInteger serialId) {
+ this.caCertSerialId = serialId;
return this;
}
@@ -296,7 +298,7 @@ public final class SelfSignedCertificate {
SelfSignedCertificate rootCertificate =
new SelfSignedCertificate(this);
try {
- return rootCertificate.generateCertificate(isCA);
+ return rootCertificate.generateCertificate(caCertSerialId);
} catch (OperatorCreationException | CertIOException e) {
throw new CertificateException("Unable to create root certificate.",
e.getCause());
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/keys/SecurityUtil.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/keys/SecurityUtil.java
index 6be3e085ce..2740c55c84 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/keys/SecurityUtil.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/keys/SecurityUtil.java
@@ -34,66 +34,18 @@ import
org.apache.hadoop.hdds.security.ssl.PemFileBasedKeyStoresFactory;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient;
import org.apache.hadoop.hdds.security.x509.exception.CertificateException;
-import org.bouncycastle.asn1.ASN1ObjectIdentifier;
-import org.bouncycastle.asn1.ASN1Sequence;
-import org.bouncycastle.asn1.ASN1Set;
-import org.bouncycastle.asn1.pkcs.Attribute;
-import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
-import org.bouncycastle.asn1.x500.X500Name;
-import org.bouncycastle.asn1.x509.Extensions;
-import org.bouncycastle.pkcs.PKCS10CertificationRequest;
/**
* Utility functions for Security modules for Ozone.
*/
public final class SecurityUtil {
- // Ozone Certificate distinguished format: (CN=Subject,OU=ScmID,O=ClusterID).
- private static final String DISTINGUISHED_NAME_FORMAT = "CN=%s,OU=%s,O=%s";
-
private SecurityUtil() {
}
- public static String getDistinguishedNameFormat() {
- return DISTINGUISHED_NAME_FORMAT;
- }
-
- public static X500Name getDistinguishedName(String subject, String scmID,
- String clusterID) {
- return new X500Name(String.format(getDistinguishedNameFormat(), subject,
- scmID, clusterID));
- }
-
- // TODO: move the PKCS10CSRValidator class
- public static Extensions getPkcs9Extensions(PKCS10CertificationRequest csr)
- throws CertificateException {
- ASN1Set pkcs9ExtReq = getPkcs9ExtRequest(csr);
- Object extReqElement = pkcs9ExtReq.getObjects().nextElement();
- if (extReqElement instanceof Extensions) {
- return (Extensions) extReqElement;
- } else {
- if (extReqElement instanceof ASN1Sequence) {
- return Extensions.getInstance((ASN1Sequence) extReqElement);
- } else {
- throw new CertificateException("Unknown element type :" + extReqElement
- .getClass().getSimpleName());
- }
- }
- }
-
- public static ASN1Set getPkcs9ExtRequest(PKCS10CertificationRequest csr)
- throws CertificateException {
- for (Attribute attr : csr.getAttributes()) {
- ASN1ObjectIdentifier oid = attr.getAttrType();
- if (oid.equals(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest)) {
- return attr.getAttrValues();
- }
- }
- throw new CertificateException("No PKCS#9 extension found in CSR");
- }
-
- /*
+ /**
* Returns private key created from encoded key.
+ *
* @return private key if successful else returns null.
*/
public static PrivateKey getPrivateKey(byte[] encodedKey,
@@ -117,8 +69,9 @@ public final class SecurityUtil {
return pvtKey;
}
- /*
+ /**
* Returns public key created from encoded key.
+ *
* @return public key if successful else returns null.
*/
public static PublicKey getPublicKey(byte[] encodedKey,
diff --git
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestPemFileBasedKeyStoresFactory.java
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestPemFileBasedKeyStoresFactory.java
index 236439a376..2f65db72e2 100644
---
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestPemFileBasedKeyStoresFactory.java
+++
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestPemFileBasedKeyStoresFactory.java
@@ -30,8 +30,8 @@ import
org.apache.hadoop.hdds.protocol.datanode.proto.XceiverClientProtocolServi
import org.apache.hadoop.hdds.protocol.proto.HddsProtos;
import org.apache.hadoop.hdds.scm.pipeline.Pipeline;
import org.apache.hadoop.hdds.scm.pipeline.PipelineID;
-import org.apache.hadoop.hdds.security.x509.CertificateClientTest;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.container.ContainerTestHelper;
import org.apache.ratis.thirdparty.io.grpc.ManagedChannel;
import org.apache.ratis.thirdparty.io.grpc.Server;
@@ -57,7 +57,7 @@ import java.util.concurrent.CompletableFuture;
*/
public class TestPemFileBasedKeyStoresFactory {
private OzoneConfiguration conf;
- private CertificateClientTest caClient;
+ private CertificateClientTestImpl caClient;
private SecurityConfig secConf;
private static final int RELOAD_INTERVAL = 2000;
@@ -68,7 +68,7 @@ public class TestPemFileBasedKeyStoresFactory {
RELOAD_INTERVAL);
conf.setLong(HddsConfigKeys.HDDS_SECURITY_SSL_TRUSTSTORE_RELOAD_INTERVAL,
RELOAD_INTERVAL);
- caClient = new CertificateClientTest(conf);
+ caClient = new CertificateClientTestImpl(conf);
secConf = new SecurityConfig(conf);
}
@Test
diff --git
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestReloadingX509KeyManager.java
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestReloadingX509KeyManager.java
index 9dbdee1467..22cb621eaa 100644
---
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestReloadingX509KeyManager.java
+++
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestReloadingX509KeyManager.java
@@ -19,7 +19,7 @@ package org.apache.hadoop.hdds.security.ssl;
import org.apache.commons.lang3.StringUtils;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
-import org.apache.hadoop.hdds.security.x509.CertificateClientTest;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.ozone.test.GenericTestUtils;
import org.apache.ozone.test.GenericTestUtils.LogCapturer;
import org.junit.BeforeClass;
@@ -39,12 +39,12 @@ public class TestReloadingX509KeyManager {
private final LogCapturer reloaderLog =
LogCapturer.captureLogs(ReloadingX509KeyManager.LOG);
private static OzoneConfiguration conf;
- private static CertificateClientTest caClient;
+ private static CertificateClientTestImpl caClient;
@BeforeClass
public static void setUp() throws Exception {
conf = new OzoneConfiguration();
- caClient = new CertificateClientTest(conf);
+ caClient = new CertificateClientTestImpl(conf);
}
@Test
@@ -59,6 +59,7 @@ public class TestReloadingX509KeyManager {
assertEquals(privateKey1,
km.getPrivateKey(caClient.getComponentName() + "_key"));
+ caClient.renewRootCA();
caClient.renewKey();
PrivateKey privateKey2 = caClient.getPrivateKey();
assertNotEquals(privateKey1, privateKey2);
diff --git
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestReloadingX509TrustManager.java
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestReloadingX509TrustManager.java
index 9883275873..b136012731 100644
---
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestReloadingX509TrustManager.java
+++
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestReloadingX509TrustManager.java
@@ -19,7 +19,7 @@ package org.apache.hadoop.hdds.security.ssl;
import org.apache.commons.lang3.StringUtils;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
-import org.apache.hadoop.hdds.security.x509.CertificateClientTest;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.ozone.test.GenericTestUtils;
import org.apache.ozone.test.GenericTestUtils.LogCapturer;
import org.junit.BeforeClass;
@@ -39,12 +39,12 @@ public class TestReloadingX509TrustManager {
private final LogCapturer reloaderLog =
LogCapturer.captureLogs(ReloadingX509TrustManager.LOG);
private static OzoneConfiguration conf;
- private static CertificateClientTest caClient;
+ private static CertificateClientTestImpl caClient;
@BeforeClass
public static void setUp() throws Exception {
conf = new OzoneConfiguration();
- caClient = new CertificateClientTest(conf);
+ caClient = new CertificateClientTestImpl(conf);
}
@Test
@@ -59,6 +59,7 @@ public class TestReloadingX509TrustManager {
X509Certificate cert1 = caClient.getCACertificate();
assertEquals(cert1, tm.getAcceptedIssuers()[0]);
+ caClient.renewRootCA();
caClient.renewKey();
X509Certificate cert2 = caClient.getCACertificate();
assertNotEquals(cert1, cert2);
diff --git
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/token/TestOzoneBlockTokenSecretManager.java
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/token/TestOzoneBlockTokenSecretManager.java
index 00b8b339e9..72aacb4a90 100644
---
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/token/TestOzoneBlockTokenSecretManager.java
+++
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/token/TestOzoneBlockTokenSecretManager.java
@@ -24,7 +24,11 @@ import static
org.apache.hadoop.ozone.container.ContainerTestHelper.newPutBlockR
import static
org.apache.hadoop.ozone.container.ContainerTestHelper.newWriteChunkRequestBuilder;
import static org.junit.Assert.assertThrows;
import static org.junit.Assert.assertTrue;
+import static org.mockito.AdditionalAnswers.delegatesTo;
+import static org.mockito.ArgumentMatchers.any;
import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
import org.apache.hadoop.hdds.HddsConfigKeys;
@@ -54,16 +58,18 @@ import
org.bouncycastle.operator.DefaultDigestAlgorithmIdentifierFinder;
import org.bouncycastle.operator.DefaultSignatureAlgorithmIdentifierFinder;
import org.bouncycastle.operator.OperatorCreationException;
import org.bouncycastle.operator.bc.BcRSAContentSignerBuilder;
+import org.bouncycastle.pkcs.PKCS10CertificationRequest;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
-import org.mockito.Mockito;
+import org.slf4j.Logger;
import java.io.ByteArrayInputStream;
import java.io.DataInputStream;
import java.io.IOException;
import java.math.BigInteger;
+import java.nio.file.Path;
import java.security.KeyPair;
import java.security.SecureRandom;
import java.security.Signature;
@@ -106,18 +112,22 @@ public class TestOzoneBlockTokenSecretManager {
omCertSerialId = x509Certificate.getSerialNumber().toString();
secretManager = new OzoneBlockTokenSecretManager(securityConfig,
TimeUnit.HOURS.toMillis(1));
- client = Mockito.mock(DefaultCertificateClient.class);
- when(client.getCertificate()).thenReturn(x509Certificate);
- when(client.getCertificate(anyString())).
- thenReturn(x509Certificate);
- when(client.getPublicKey()).thenReturn(keyPair.getPublic());
- when(client.getPrivateKey()).thenReturn(keyPair.getPrivate());
- when(client.getSignatureAlgorithm()).thenReturn(
- securityConfig.getSignatureAlgo());
- when(client.getSecurityProvider()).thenReturn(
- securityConfig.getProvider());
- when(client.verifySignature((byte[]) Mockito.any(),
- Mockito.any(), Mockito.any())).thenCallRealMethod();
+ Logger log = mock(Logger.class);
+ DefaultCertificateClient toStub =
+ new DefaultCertificateClient(
+ securityConfig, log, null, "test", null, null) {
+ @Override
+ protected String signAndStoreCertificate(
+ PKCS10CertificationRequest request, Path certificatePath) {
+ return null;
+ }
+ };
+ client = mock(DefaultCertificateClient.class, delegatesTo(toStub));
+ doReturn(x509Certificate).when(client).getCertificate();
+ doReturn(x509Certificate).when(client).getCertificate(anyString());
+ doReturn(keyPair.getPublic()).when(client).getPublicKey();
+ doReturn(keyPair.getPrivate()).when(client).getPrivateKey();
+ doReturn(null).when(client).signData(any(byte[].class));
secretManager.start(client);
tokenVerifier = new BlockTokenVerifier(securityConfig, client);
diff --git
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/CertificateClientTest.java
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/CertificateClientTest.java
deleted file mode 100644
index 87ce8b6000..0000000000
---
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/CertificateClientTest.java
+++ /dev/null
@@ -1,291 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with this
- * work for additional information regarding copyright ownership. The ASF
- * licenses this file to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * <p>
- * http://www.apache.org/licenses/LICENSE-2.0
- * <p>
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations
under
- * the License.
- */
-package org.apache.hadoop.hdds.security.x509;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.file.Path;
-import java.security.KeyPair;
-import java.security.PrivateKey;
-import java.security.PublicKey;
-import java.security.cert.CertPath;
-import java.security.cert.CertStore;
-import java.security.cert.X509Certificate;
-import java.util.Collections;
-import java.util.List;
-
-import com.google.common.collect.ImmutableList;
-import org.apache.hadoop.hdds.conf.OzoneConfiguration;
-import org.apache.hadoop.hdds.security.ssl.KeyStoresFactory;
-import org.apache.hadoop.hdds.security.x509.certificate.authority.CAType;
-import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient;
-import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateNotification;
-import org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateCodec;
-import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest;
-import org.apache.hadoop.hdds.security.x509.crl.CRLInfo;
-import org.apache.hadoop.hdds.security.x509.exception.CertificateException;
-
-import org.apache.hadoop.security.ssl.KeyStoreTestUtil;
-import org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory;
-import org.bouncycastle.pkcs.PKCS10CertificationRequest;
-
-/**
- * Test implementation for CertificateClient. To be used only for test
- * purposes.
- */
-
-public class CertificateClientTest implements CertificateClient {
- private KeyPair keyPair;
- private CertPath certPath;
- private SecurityConfig secConfig;
-
- public CertificateClientTest(OzoneConfiguration conf)
- throws Exception {
- secConfig = new SecurityConfig(conf);
- keyPair = KeyStoreTestUtil.generateKeyPair("RSA");
- CertificateFactory fact = CertificateCodec.getCertFactory();
- X509Certificate singleCert = KeyStoreTestUtil
- .generateCertificate("CN=OzoneMaster", keyPair, 30, "SHA256withRSA");
- certPath = fact.engineGenerateCertPath(ImmutableList.of(singleCert));
- }
-
- @Override
- public PrivateKey getPrivateKey() {
- return keyPair.getPrivate();
- }
-
- @Override
- public PublicKey getPublicKey() {
- return keyPair.getPublic();
- }
-
- /**
- * Returns the certificate of the specified component if it exists on the
- * local system.
- *
- * @return certificate or Null if there is no data.
- */
- @Override
- public X509Certificate getCertificate(String certSerialId)
- throws CertificateException {
- return CertificateCodec.firstCertificateFrom(certPath);
- }
-
- @Override
- public CertPath getCertPath() {
- return certPath;
- }
-
- @Override
- public X509Certificate getCertificate() {
- return CertificateCodec.firstCertificateFrom(certPath);
- }
-
- @Override
- public X509Certificate getCACertificate() {
- return CertificateCodec.firstCertificateFrom(certPath);
- }
-
- @Override
- public CertPath getCACertPath() {
- return certPath;
- }
-
- @Override
- public boolean verifyCertificate(X509Certificate certificate) {
- return true;
- }
-
- @Override
- public void setCertificateId(String certSerialId) {
- }
-
- @Override
- public byte[] signDataStream(InputStream stream)
- throws CertificateException {
- return new byte[0];
- }
-
- @Override
- public byte[] signData(byte[] data) throws CertificateException {
- return new byte[0];
- }
-
- @Override
- public boolean verifySignature(InputStream stream, byte[] signature,
- X509Certificate cert) throws CertificateException {
- return true;
- }
-
- @Override
- public boolean verifySignature(byte[] data, byte[] signature,
- X509Certificate cert) throws CertificateException {
- return true;
- }
-
- @Override
- public CertificateSignRequest.Builder getCSRBuilder(KeyPair key)
- throws IOException {
- return null;
- }
-
- @Override
- public CertificateSignRequest.Builder getCSRBuilder() {
- return new CertificateSignRequest.Builder();
- }
-
- @Override
- public String signAndStoreCertificate(PKCS10CertificationRequest request,
- Path certificatePath) throws CertificateException {
- return null;
- }
-
- @Override
- public String signAndStoreCertificate(PKCS10CertificationRequest request)
- throws CertificateException {
- return null;
- }
-
- @Override
- public X509Certificate queryCertificate(String query) {
- return null;
- }
-
- @Override
- public void storeCertificate(String cert)
- throws CertificateException {
- }
-
- @Override
- public void storeCertificate(String cert, CAType caType)
- throws CertificateException {
- }
-
- /**
- * Stores the trusted chain of certificates for a specific component.
- *
- * @param keyStore - Cert Store.
- * @throws CertificateException - on Error.
- */
- @Override
- public void storeTrustChain(CertStore keyStore) throws CertificateException {
-
- }
-
- @Override
- public void storeTrustChain(List<X509Certificate> certificates)
- throws CertificateException {
- }
-
- @Override
- public InitResponse init() throws CertificateException {
- return null;
- }
-
- @Override
- public String getSignatureAlgorithm() {
- return secConfig.getSignatureAlgo();
- }
-
- @Override
- public String getSecurityProvider() {
- return secConfig.getProvider();
- }
-
- @Override
- public String getComponentName() {
- return "test";
- }
-
- @Override
- public X509Certificate getRootCACertificate() {
- return CertificateCodec.firstCertificateFrom(certPath);
- }
-
- @Override
- public void storeRootCACertificate(String pemEncodedCert) {
-
- }
-
- @Override
- public List<String> getCAList() {
- return null;
- }
- @Override
- public List<String> listCA() throws IOException {
- return null;
- }
-
- @Override
- public List<String> updateCAList() throws IOException {
- return null;
- }
-
- @Override
- public List<CRLInfo> getCrls(List<Long> crlIds) throws IOException {
- return Collections.emptyList();
- }
-
- @Override
- public long getLatestCrlId() throws IOException {
- return 0;
- }
-
- @Override
- public long getLocalCrlId() {
- return 0;
- }
-
- @Override
- public void setLocalCrlId(long crlId) {
- }
-
- @Override
- public boolean processCrl(CRLInfo crl) {
- return false;
- }
-
- @Override
- public KeyStoresFactory getServerKeyStoresFactory()
- throws CertificateException {
- return null;
- }
-
- @Override
- public KeyStoresFactory getClientKeyStoresFactory()
- throws CertificateException {
- return null;
- }
-
- @Override
- public void registerNotificationReceiver(CertificateNotification receiver) {
- }
-
- public void renewKey() throws Exception {
- KeyPair newKeyPair = KeyStoreTestUtil.generateKeyPair("RSA");
- X509Certificate newCert = KeyStoreTestUtil.generateCertificate(
- "CN=OzoneMaster", keyPair, 30, "SHA256withRSA");
-
- keyPair = newKeyPair;
- CertificateFactory fact = CertificateCodec.getCertFactory();
- certPath = fact.engineGenerateCertPath(ImmutableList.of(newCert));
- }
-
- @Override
- public void close() throws IOException {
- }
-}
diff --git
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/authority/TestDefaultCAServer.java
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/authority/TestDefaultCAServer.java
index d2f2441fed..e74aa12e5c 100644
---
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/authority/TestDefaultCAServer.java
+++
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/authority/TestDefaultCAServer.java
@@ -370,7 +370,7 @@ public class TestDefaultCAServer {
SecurityConfig securityConfig = new SecurityConfig(conf);
SCMCertificateClient scmCertificateClient =
- new SCMCertificateClient(new SecurityConfig(conf));
+ new SCMCertificateClient(new SecurityConfig(conf), null);
KeyPair keyPair = KeyStoreTestUtil.generateKeyPair("RSA");
KeyCodec keyPEMWriter = new KeyCodec(securityConfig,
@@ -421,7 +421,7 @@ public class TestDefaultCAServer {
CertificateApprover approver = new DefaultApprover(new DefaultCAProfile(),
securityConfig);
SCMCertificateClient scmCertificateClient =
- new SCMCertificateClient(new SecurityConfig(conf));
+ new SCMCertificateClient(new SecurityConfig(conf), null);
String scmId = RandomStringUtils.randomAlphabetic(4);
String clusterId = RandomStringUtils.randomAlphabetic(4);
KeyPair keyPair = new HDDSKeyGenerator(conf).generateKey();
@@ -485,7 +485,7 @@ public class TestDefaultCAServer {
SCMCertificateClient scmCertificateClient =
- new SCMCertificateClient(new SecurityConfig(conf));
+ new SCMCertificateClient(new SecurityConfig(conf), null);
CertificateClient.InitResponse response = scmCertificateClient.init();
assertEquals(CertificateClient.InitResponse.GETCERT, response);
@@ -525,7 +525,7 @@ public class TestDefaultCAServer {
// Write to the location where Default CA Server reads from.
scmCertificateClient.storeCertificate(
- CertificateCodec.getPEMEncodedString(certificateHolder));
+ CertificateCodec.getPEMEncodedString(certificateHolder), CAType.NONE);
CertificateCodec certCodec =
new CertificateCodec(new SecurityConfig(conf),
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/CertificateClientTestImpl.java
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClientTestImpl.java
similarity index 81%
rename from
hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/CertificateClientTestImpl.java
rename to
hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClientTestImpl.java
index f13e830cc0..6f8abe1cbc 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/CertificateClientTestImpl.java
+++
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClientTestImpl.java
@@ -14,11 +14,10 @@
* License for the specific language governing permissions and limitations
under
* the License.
*/
-package org.apache.hadoop.ozone.client;
+package org.apache.hadoop.hdds.security.x509.certificate.client;
import java.io.IOException;
-import java.io.InputStream;
-import java.nio.file.Path;
+import java.math.BigInteger;
import java.security.InvalidKeyException;
import java.security.KeyPair;
import java.security.NoSuchAlgorithmException;
@@ -28,12 +27,10 @@ import java.security.PublicKey;
import java.security.Signature;
import java.security.SignatureException;
import java.security.cert.CertPath;
-import java.security.cert.CertStore;
import java.security.cert.X509Certificate;
import java.time.Duration;
import java.time.LocalDateTime;
import java.time.ZoneId;
-import java.util.Collections;
import java.util.Date;
import java.util.HashSet;
import java.util.List;
@@ -51,11 +48,8 @@ import org.apache.hadoop.hdds.security.x509.SecurityConfig;
import org.apache.hadoop.hdds.security.x509.certificate.authority.CAType;
import
org.apache.hadoop.hdds.security.x509.certificate.authority.DefaultApprover;
import
org.apache.hadoop.hdds.security.x509.certificate.authority.profile.DefaultProfile;
-import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient;
-import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateNotification;
import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest;
import
org.apache.hadoop.hdds.security.x509.certificate.utils.SelfSignedCertificate;
-import org.apache.hadoop.hdds.security.x509.crl.CRLInfo;
import org.apache.hadoop.hdds.security.x509.exception.CertificateException;
import org.apache.hadoop.hdds.security.x509.keys.HDDSKeyGenerator;
@@ -81,8 +75,8 @@ public class CertificateClientTestImpl implements
CertificateClient {
private final SecurityConfig securityConfig;
private KeyPair keyPair;
private X509Certificate x509Certificate;
- private final KeyPair rootKeyPair;
- private final X509Certificate rootCert;
+ private KeyPair rootKeyPair;
+ private X509Certificate rootCert;
private HDDSKeyGenerator keyGen;
private DefaultApprover approver;
private KeyStoresFactory serverKeyStoresFactory;
@@ -127,7 +121,8 @@ public class CertificateClientTestImpl implements
CertificateClient {
// Generate normal certificate, signed by RootCA certificate
approver = new DefaultApprover(new DefaultProfile(), securityConfig);
- CertificateSignRequest.Builder csrBuilder = getCSRBuilder();
+ CertificateSignRequest.Builder csrBuilder =
+ new CertificateSignRequest.Builder();
// Get host name.
csrBuilder.setKey(keyPair)
.setConfiguration(config)
@@ -217,38 +212,17 @@ public class CertificateClientTestImpl implements
CertificateClient {
return rootCert;
}
- @Override
- public boolean verifyCertificate(X509Certificate certificate) {
- return true;
- }
-
- @Override
- public void setCertificateId(String certSerialId) {
- }
-
- @Override
- public byte[] signDataStream(InputStream stream)
- throws CertificateException {
- return new byte[0];
- }
-
@Override
public byte[] signData(byte[] data) throws CertificateException {
return new byte[0];
}
- @Override
- public boolean verifySignature(InputStream stream, byte[] signature,
- X509Certificate cert) throws CertificateException {
- return true;
- }
-
@Override
public boolean verifySignature(byte[] data, byte[] signature,
X509Certificate cert) throws CertificateException {
try {
- Signature sign = Signature.getInstance(getSignatureAlgorithm(),
- getSecurityProvider());
+ Signature sign = Signature.getInstance(securityConfig.getSignatureAlgo(),
+ securityConfig.getProvider());
sign.initVerify(cert);
sign.update(data);
return sign.verify(signature);
@@ -260,76 +234,27 @@ public class CertificateClientTestImpl implements
CertificateClient {
}
}
- @Override
- public CertificateSignRequest.Builder getCSRBuilder(KeyPair key)
- throws CertificateException {
- return null;
- }
-
@Override
public CertificateSignRequest.Builder getCSRBuilder() {
return new CertificateSignRequest.Builder();
}
- @Override
- public String signAndStoreCertificate(PKCS10CertificationRequest request,
- Path certPath) throws CertificateException {
- return null;
- }
-
@Override
public String signAndStoreCertificate(PKCS10CertificationRequest request)
throws CertificateException {
return null;
}
- @Override
- public X509Certificate queryCertificate(String query) {
- return null;
- }
-
- @Override
- public void storeCertificate(String cert)
- throws CertificateException {
- }
-
@Override
public void storeCertificate(String cert, CAType caType)
throws CertificateException {
}
- /**
- * Stores the trusted chain of certificates for a specific component.
- *
- * @param keyStore - Cert Store.
- * @throws CertificateException - on Error.
- */
- @Override
- public void storeTrustChain(CertStore keyStore) throws CertificateException {
-
- }
-
- @Override
- public void storeTrustChain(List<X509Certificate> certificates)
- throws CertificateException {
-
- }
-
@Override
public InitResponse init() throws CertificateException {
return null;
}
- @Override
- public String getSignatureAlgorithm() {
- return securityConfig.getSignatureAlgo();
- }
-
- @Override
- public String getSecurityProvider() {
- return securityConfig.getProvider();
- }
-
@Override
public String getComponentName() {
return this.getClass().getSimpleName();
@@ -340,11 +265,6 @@ public class CertificateClientTestImpl implements
CertificateClient {
return x509Certificate;
}
- @Override
- public void storeRootCACertificate(String pemEncodedCert) {
-
- }
-
@Override
public List<String> getCAList() {
return null;
@@ -359,33 +279,31 @@ public class CertificateClientTestImpl implements
CertificateClient {
return null;
}
- @Override
- public List<CRLInfo> getCrls(List<Long> crlIds) throws IOException {
- return Collections.emptyList();
- }
-
- @Override
- public long getLatestCrlId() throws IOException {
- return 0;
- }
-
- @Override
- public long getLocalCrlId() {
- return 0;
- }
-
- @Override
- public void setLocalCrlId(long crlId) {
- }
-
- @Override
- public boolean processCrl(CRLInfo crl) {
- return false;
+ public void renewRootCA() throws Exception {
+ LocalDateTime start = LocalDateTime.now();
+ String rootCACertDuration = config.get(HDDS_X509_MAX_DURATION,
+ HDDS_X509_MAX_DURATION_DEFAULT);
+ LocalDateTime end = start.plus(Duration.parse(rootCACertDuration));
+ rootKeyPair = keyGen.generateKey();
+ SelfSignedCertificate.Builder builder =
+ SelfSignedCertificate.newBuilder()
+ .setBeginDate(start)
+ .setEndDate(end)
+ .setClusterID("cluster1")
+ .setKey(rootKeyPair)
+ .setSubject("rootCA-new@localhost")
+ .setConfiguration(config)
+ .setScmID("scm1")
+ .makeCA(BigInteger.ONE.add(BigInteger.ONE));
+ rootCert = new JcaX509CertificateConverter().getCertificate(
+ builder.build());
+ certificateMap.put(rootCert.getSerialNumber().toString(), rootCert);
}
public void renewKey() throws Exception {
KeyPair newKeyPair = keyGen.generateKey();
- CertificateSignRequest.Builder csrBuilder = getCSRBuilder();
+ CertificateSignRequest.Builder csrBuilder =
+ new CertificateSignRequest.Builder();
// Get host name.
csrBuilder.setKey(newKeyPair)
.setConfiguration(config)
@@ -427,6 +345,7 @@ public class CertificateClientTestImpl implements
CertificateClient {
@Override
public void run() {
try {
+ renewRootCA();
renewKey();
} catch (Exception e) {
throw new RuntimeException(e);
diff --git
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/client/TestDefaultCertificateClient.java
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/client/TestDefaultCertificateClient.java
index 46192d91ad..d7ada90e25 100644
---
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/client/TestDefaultCertificateClient.java
+++
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/client/TestDefaultCertificateClient.java
@@ -25,7 +25,6 @@ import
org.apache.hadoop.hdds.protocolPB.SCMSecurityProtocolClientSideTranslator
import org.apache.hadoop.hdds.security.x509.certificate.authority.CAType;
import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse;
import org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateCodec;
-import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest;
import org.apache.hadoop.hdds.security.x509.exception.CertificateException;
import org.apache.hadoop.hdds.security.x509.keys.KeyCodec;
import org.bouncycastle.cert.X509CertificateHolder;
@@ -51,7 +50,6 @@ import java.util.Date;
import java.util.UUID;
import org.apache.commons.io.FileUtils;
-import org.apache.commons.io.IOUtils;
import org.apache.commons.lang3.RandomStringUtils;
@@ -208,11 +206,10 @@ public class TestDefaultCertificateClient {
// Expect error when there is no private key to sign.
LambdaTestUtils.intercept(IOException.class, "Error while " +
"signing the stream",
- () -> dnCertClient.signDataStream(IOUtils.toInputStream(data, UTF_8)));
+ () -> dnCertClient.signData(data.getBytes(UTF_8)));
generateKeyPairFiles();
- byte[] sign = dnCertClient.signDataStream(IOUtils.toInputStream(data,
- UTF_8));
+ byte[] sign = dnCertClient.signData(data.getBytes(UTF_8));
validateHash(sign, data.getBytes(UTF_8));
}
@@ -235,21 +232,15 @@ public class TestDefaultCertificateClient {
@Test
public void verifySignatureStream() throws Exception {
String data = RandomStringUtils.random(500);
- byte[] sign = dnCertClient.signDataStream(IOUtils.toInputStream(data,
- UTF_8));
+ byte[] sign = dnCertClient.signData(data.getBytes(UTF_8));
// Positive tests.
assertTrue(dnCertClient.verifySignature(data.getBytes(UTF_8), sign,
x509Certificate));
- assertTrue(dnCertClient.verifySignature(
- IOUtils.toInputStream(data, UTF_8),
- sign, x509Certificate));
// Negative tests.
assertFalse(dnCertClient.verifySignature(data.getBytes(UTF_8),
"abc".getBytes(UTF_8), x509Certificate));
- assertFalse(dnCertClient.verifySignature(IOUtils.toInputStream(data,
- UTF_8), "abc".getBytes(UTF_8), x509Certificate));
}
@@ -264,23 +255,10 @@ public class TestDefaultCertificateClient {
// Positive tests.
assertTrue(dnCertClient.verifySignature(data.getBytes(UTF_8), sign,
x509Certificate));
- assertTrue(dnCertClient.verifySignature(
- IOUtils.toInputStream(data, UTF_8),
- sign, x509Certificate));
// Negative tests.
assertFalse(dnCertClient.verifySignature(data.getBytes(UTF_8),
"abc".getBytes(UTF_8), x509Certificate));
- assertFalse(dnCertClient.verifySignature(IOUtils.toInputStream(data,
- UTF_8), "abc".getBytes(UTF_8), x509Certificate));
-
- }
-
- @Test
- public void queryCertificate() throws Exception {
- LambdaTestUtils.intercept(UnsupportedOperationException.class,
- "Operation not supported",
- () -> dnCertClient.queryCertificate(""));
}
@Test
@@ -334,9 +312,9 @@ public class TestDefaultCertificateClient {
X509Certificate cert2 = generateX509Cert(keyPair);
X509Certificate cert3 = generateX509Cert(keyPair);
- dnCertClient.storeCertificate(getPEMEncodedString(cert1));
- dnCertClient.storeCertificate(getPEMEncodedString(cert2));
- dnCertClient.storeCertificate(getPEMEncodedString(cert3));
+ dnCertClient.storeCertificate(getPEMEncodedString(cert1), CAType.NONE);
+ dnCertClient.storeCertificate(getPEMEncodedString(cert2), CAType.NONE);
+ dnCertClient.storeCertificate(getPEMEncodedString(cert3), CAType.NONE);
assertNotNull(dnCertClient.getCertificate(cert1.getSerialNumber()
.toString()));
@@ -455,12 +433,6 @@ public class TestDefaultCertificateClient {
throws CertificateException {
return null;
}
-
- @Override
- public CertificateSignRequest.Builder getCSRBuilder(KeyPair keyPair)
- throws CertificateException {
- return null;
- }
};
InitResponse resp = client.init();
diff --git
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/utils/TestCertificateSignRequest.java
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/utils/TestCertificateSignRequest.java
index 82f22e03d5..43981183aa 100644
---
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/utils/TestCertificateSignRequest.java
+++
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/x509/certificate/utils/TestCertificateSignRequest.java
@@ -22,7 +22,6 @@ import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.security.exception.SCMSecurityException;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
import org.apache.hadoop.hdds.security.x509.keys.HDDSKeyGenerator;
-import org.apache.hadoop.hdds.security.x509.keys.SecurityUtil;
import org.bouncycastle.asn1.ASN1Encodable;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.ASN1Sequence;
@@ -52,6 +51,8 @@ import java.util.Iterator;
import java.util.UUID;
import static org.apache.hadoop.hdds.HddsConfigKeys.OZONE_METADATA_DIRS;
+import static
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest.getDistinguishedNameFormat;
+import static
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest.getPkcs9Extensions;
/**
* Certificate Signing Request.
@@ -88,7 +89,7 @@ public class TestCertificateSignRequest {
PKCS10CertificationRequest csr = builder.build();
// Check the Subject Name is in the expected format.
- String dnName = String.format(SecurityUtil.getDistinguishedNameFormat(),
+ String dnName = String.format(getDistinguishedNameFormat(),
subject, scmID, clusterID);
Assertions.assertEquals(dnName, csr.getSubject().toString());
@@ -101,7 +102,7 @@ public class TestCertificateSignRequest {
// Verify CSR with attribute for extensions
Assertions.assertEquals(1, csr.getAttributes().length);
- Extensions extensions = SecurityUtil.getPkcs9Extensions(csr);
+ Extensions extensions = getPkcs9Extensions(csr);
// Verify key usage extension
Extension keyUsageExt = extensions.getExtension(Extension.keyUsage);
@@ -148,7 +149,7 @@ public class TestCertificateSignRequest {
PKCS10CertificationRequest csr = builder.build();
// Check the Subject Name is in the expected format.
- String dnName = String.format(SecurityUtil.getDistinguishedNameFormat(),
+ String dnName = String.format(getDistinguishedNameFormat(),
subject, scmID, clusterID);
Assertions.assertEquals(dnName, csr.getSubject().toString());
@@ -161,7 +162,7 @@ public class TestCertificateSignRequest {
// Verify CSR with attribute for extensions
Assertions.assertEquals(1, csr.getAttributes().length);
- Extensions extensions = SecurityUtil.getPkcs9Extensions(csr);
+ Extensions extensions = getPkcs9Extensions(csr);
// Verify key usage extension
Extension sanExt = extensions.getExtension(Extension.keyUsage);
@@ -230,7 +231,7 @@ public class TestCertificateSignRequest {
PKCS10CertificationRequest csr = builder.build();
// Check the Subject Name is in the expected format.
- String dnName = String.format(SecurityUtil.getDistinguishedNameFormat(),
+ String dnName = String.format(getDistinguishedNameFormat(),
subject, scmID, clusterID);
Assertions.assertEquals(dnName, csr.getSubject().toString());
diff --git
a/hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/ha/HASecurityUtils.java
b/hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/ha/HASecurityUtils.java
index caa48b27ed..59618ee5d6 100644
---
a/hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/ha/HASecurityUtils.java
+++
b/hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/ha/HASecurityUtils.java
@@ -52,7 +52,6 @@ import org.slf4j.LoggerFactory;
import java.io.IOException;
import java.net.InetAddress;
import java.net.InetSocketAddress;
-import java.security.KeyPair;
import java.security.cert.CertPath;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
@@ -93,7 +92,8 @@ public final class HASecurityUtils {
LOG.info("Initializing secure StorageContainerManager.");
CertificateClient certClient =
- new SCMCertificateClient(new SecurityConfig(conf));
+ new SCMCertificateClient(
+ new SecurityConfig(conf), scmStorageConfig.getScmId());
InitResponse response = certClient.init();
LOG.info("Init response: {}", response);
switch (response) {
@@ -157,7 +157,7 @@ public final class HASecurityUtils {
String pemEncodedRootCert = response.getX509CACertificate();
client.storeCertificate(
pemEncodedRootCert, CAType.SUBORDINATE);
- client.storeCertificate(pemEncodedCert);
+ client.storeCertificate(pemEncodedCert, CAType.NONE);
//note: this does exactly the same as store certificate
persistSubCACertificate(config, client,
pemEncodedCert);
@@ -208,7 +208,7 @@ public final class HASecurityUtils {
client.storeCertificate(
pemEncodedRootCert, CAType.SUBORDINATE);
- client.storeCertificate(pemEncodedCert);
+ client.storeCertificate(pemEncodedCert, CAType.NONE);
//note: this does exactly the same as store certificate
persistSubCACertificate(config, client, pemEncodedCert);
X509Certificate cert =
@@ -262,15 +262,13 @@ public final class HASecurityUtils {
OzoneConfiguration config, InetSocketAddress scmAddress)
throws IOException {
CertificateSignRequest.Builder builder = client.getCSRBuilder();
- KeyPair keyPair = new KeyPair(client.getPublicKey(),
- client.getPrivateKey());
// Get host name.
String hostname = scmAddress.getHostName();
String subject = SCM_SUB_CA_PREFIX + hostname;
- builder.setKey(keyPair)
+ builder
.setConfiguration(config)
.setScmID(scmStorageConfig.getScmId())
.setClusterID(scmStorageConfig.getClusterID())
diff --git a/hadoop-ozone/integration-test/pom.xml
b/hadoop-ozone/integration-test/pom.xml
index fca6f3c573..0a35660a39 100644
--- a/hadoop-ozone/integration-test/pom.xml
+++ b/hadoop-ozone/integration-test/pom.xml
@@ -43,6 +43,13 @@ https://maven.apache.org/xsd/maven-4.0.0.xsd";>
<groupId>org.apache.ozone</groupId>
<artifactId>hdds-server-scm</artifactId>
</dependency>
+ <dependency>
+ <groupId>org.apache.ozone</groupId>
+ <artifactId>hdds-server-framework</artifactId>
+ <version>${hdds.version}</version>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
<dependency>
<groupId>org.apache.ozone</groupId>
<artifactId>ozone-manager</artifactId>
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/storage/TestContainerCommandsEC.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/storage/TestContainerCommandsEC.java
index 96c601cbd0..d1a98e890d 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/storage/TestContainerCommandsEC.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/storage/TestContainerCommandsEC.java
@@ -48,9 +48,9 @@ import
org.apache.hadoop.hdds.security.token.ContainerTokenSecretManager;
import org.apache.hadoop.hdds.security.token.OzoneBlockTokenSecretManager;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.MiniOzoneCluster;
import org.apache.hadoop.ozone.OzoneConfigKeys;
-import org.apache.hadoop.ozone.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.client.ObjectStore;
import org.apache.hadoop.ozone.client.OzoneBucket;
import org.apache.hadoop.ozone.client.OzoneClient;
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestDelegationToken.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestDelegationToken.java
index dc6e237591..2484af75fa 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestDelegationToken.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestDelegationToken.java
@@ -32,13 +32,13 @@ import org.apache.hadoop.hdds.scm.ScmConfig;
import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
import org.apache.hadoop.hdds.scm.server.StorageContainerManager;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.hadoop.hdds.security.x509.keys.HDDSKeyGenerator;
import org.apache.hadoop.hdds.security.x509.keys.KeyCodec;
import org.apache.hadoop.io.Text;
import org.apache.hadoop.ipc.Server;
import org.apache.hadoop.metrics2.lib.DefaultMetricsSystem;
import org.apache.hadoop.minikdc.MiniKdc;
-import org.apache.hadoop.ozone.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.om.OMStorage;
import org.apache.hadoop.ozone.om.OzoneManager;
import org.apache.hadoop.ozone.om.exceptions.OMException;
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestSecureOzoneCluster.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestSecureOzoneCluster.java
index 8f7b82b140..b2ad993b9f 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestSecureOzoneCluster.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestSecureOzoneCluster.java
@@ -70,6 +70,7 @@ import
org.apache.hadoop.hdds.security.x509.certificate.authority.CAType;
import
org.apache.hadoop.hdds.security.x509.certificate.authority.DefaultApprover;
import
org.apache.hadoop.hdds.security.x509.certificate.authority.profile.DefaultProfile;
import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import
org.apache.hadoop.hdds.security.x509.certificate.client.DNCertificateClient;
import
org.apache.hadoop.hdds.security.x509.certificate.authority.DefaultCAServer;
import
org.apache.hadoop.hdds.security.x509.certificate.client.DefaultCertificateClient;
@@ -87,7 +88,6 @@ import org.apache.hadoop.ipc.Server;
import org.apache.hadoop.metrics2.lib.DefaultMetricsSystem;
import org.apache.hadoop.minikdc.MiniKdc;
import org.apache.hadoop.net.NetUtils;
-import org.apache.hadoop.ozone.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.client.OzoneClient;
import org.apache.hadoop.ozone.client.OzoneClientFactory;
import org.apache.hadoop.ozone.common.Storage;
@@ -904,21 +904,23 @@ public final class TestSecureOzoneCluster {
OzoneManager.setTestSecureOmFlag(true);
SecurityConfig securityConfig = new SecurityConfig(conf);
- CertificateCodec certCodec = new CertificateCodec(securityConfig, "om");
- OMCertificateClient client =
- new OMCertificateClient(securityConfig, omStorage, scmId);
- client.init();
+
// save first cert
final int certificateLifetime = 20; // seconds
+ KeyCodec keyCodec =
+ new KeyCodec(securityConfig, securityConfig.getKeyLocation("om"));
X509CertificateHolder certHolder = generateX509CertHolder(conf,
- new KeyPair(client.getPublicKey(), client.getPrivateKey()),
+ new KeyPair(keyCodec.readPublicKey(), keyCodec.readPrivateKey()),
null, Duration.ofSeconds(certificateLifetime));
String certId = certHolder.getSerialNumber().toString();
- certCodec.writeCertificate(certHolder);
- client.setCertificateId(certId);
omStorage.setOmCertSerialId(certId);
omStorage.forceInitialize();
+ CertificateCodec certCodec = new CertificateCodec(securityConfig, "om");
+ certCodec.writeCertificate(certHolder);
+ OMCertificateClient client =
+ new OMCertificateClient(securityConfig, omStorage, scmId, null, null);
+ client.init();
// first renewed cert
X509CertificateHolder newCertHolder = generateX509CertHolder(conf,
@@ -981,21 +983,23 @@ public final class TestSecureOzoneCluster {
SecurityConfig securityConfig = new SecurityConfig(conf);
CertificateCodec certCodec = new CertificateCodec(securityConfig, "om");
- OMCertificateClient client =
- new OMCertificateClient(securityConfig, omStorage, scmId);
- client.init();
// save first cert
final int certificateLifetime = 20; // seconds
+ KeyCodec keyCodec =
+ new KeyCodec(securityConfig, securityConfig.getKeyLocation("om"));
X509CertificateHolder certHolder = generateX509CertHolder(conf,
- new KeyPair(client.getPublicKey(), client.getPrivateKey()),
+ new KeyPair(keyCodec.readPublicKey(), keyCodec.readPrivateKey()),
null, Duration.ofSeconds(certificateLifetime));
String certId = certHolder.getSerialNumber().toString();
certCodec.writeCertificate(certHolder);
- client.setCertificateId(certId);
omStorage.setOmCertSerialId(certId);
omStorage.forceInitialize();
+ OMCertificateClient client =
+ new OMCertificateClient(securityConfig, omStorage, scmId, null, null);
+ client.init();
+
// prepare a mocked scmClient to certificate signing
SCMSecurityProtocolClientSideTranslatorPB scmClient =
mock(SCMSecurityProtocolClientSideTranslatorPB.class);
@@ -1070,7 +1074,7 @@ public final class TestSecureOzoneCluster {
SecurityConfig securityConfig = new SecurityConfig(conf);
CertificateCodec certCodec = new CertificateCodec(securityConfig, "om");
OMCertificateClient client =
- new OMCertificateClient(securityConfig, omStorage, scmId);
+ new OMCertificateClient(securityConfig, omStorage, scmId, null, null);
client.init();
// save first cert
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestContainerStateMachine.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestContainerStateMachine.java
index 2fcb41e281..3e19a4577c 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestContainerStateMachine.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestContainerStateMachine.java
@@ -31,9 +31,9 @@ import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.protocol.datanode.proto.ContainerProtos;
import org.apache.hadoop.hdds.scm.OzoneClientConfig;
import org.apache.hadoop.hdds.scm.ScmConfigKeys;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.MiniOzoneCluster;
import org.apache.hadoop.ozone.OzoneConfigKeys;
-import org.apache.hadoop.ozone.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.client.ObjectStore;
import org.apache.hadoop.ozone.client.OzoneClient;
import org.apache.hadoop.ozone.client.OzoneClientFactory;
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestContainerStateMachineFlushDelay.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestContainerStateMachineFlushDelay.java
index 244bee7d01..a7dc787a8b 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestContainerStateMachineFlushDelay.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestContainerStateMachineFlushDelay.java
@@ -23,9 +23,9 @@ import org.apache.hadoop.hdds.client.ReplicationFactor;
import org.apache.hadoop.hdds.client.ReplicationType;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.protocol.datanode.proto.ContainerProtos;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.MiniOzoneCluster;
import org.apache.hadoop.ozone.OzoneConfigKeys;
-import org.apache.hadoop.ozone.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.client.ObjectStore;
import org.apache.hadoop.ozone.client.OzoneClient;
import org.apache.hadoop.ozone.client.OzoneClientFactory;
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestOzoneAtRestEncryption.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestOzoneAtRestEncryption.java
index 9a649b07f8..479eea5f7f 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestOzoneAtRestEncryption.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestOzoneAtRestEncryption.java
@@ -47,10 +47,10 @@ import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.protocol.proto.HddsProtos;
import org.apache.hadoop.hdds.scm.container.ContainerInfo;
import
org.apache.hadoop.hdds.scm.protocolPB.StorageContainerLocationProtocolClientSideTranslatorPB;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.MiniOzoneCluster;
import org.apache.hadoop.ozone.OzoneConsts;
import org.apache.hadoop.ozone.client.BucketArgs;
-import org.apache.hadoop.ozone.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.client.ObjectStore;
import org.apache.hadoop.ozone.client.OzoneBucket;
import org.apache.hadoop.ozone.client.OzoneClient;
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestSecureOzoneRpcClient.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestSecureOzoneRpcClient.java
index f8070eb68d..b8fc491769 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestSecureOzoneRpcClient.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestSecureOzoneRpcClient.java
@@ -28,6 +28,7 @@ import org.apache.hadoop.hdds.scm.ScmConfigKeys;
import org.apache.hadoop.hdds.scm.container.ContainerInfo;
import
org.apache.hadoop.hdds.scm.protocolPB.StorageContainerLocationProtocolClientSideTranslatorPB;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.hadoop.hdds.utils.db.Table;
import org.apache.hadoop.hdds.utils.db.TableIterator;
import org.apache.hadoop.hdds.utils.db.cache.CacheKey;
@@ -35,7 +36,6 @@ import org.apache.hadoop.hdds.utils.db.cache.CacheValue;
import org.apache.hadoop.ozone.ClientVersion;
import org.apache.hadoop.ozone.MiniOzoneCluster;
import org.apache.hadoop.ozone.OzoneConfigKeys;
-import org.apache.hadoop.ozone.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.client.ObjectStore;
import org.apache.hadoop.ozone.client.OzoneBucket;
import org.apache.hadoop.ozone.client.OzoneClient;
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/ozoneimpl/TestOzoneContainerWithTLS.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/ozoneimpl/TestOzoneContainerWithTLS.java
index 551cf9aef0..c3f4902d00 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/ozoneimpl/TestOzoneContainerWithTLS.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/ozoneimpl/TestOzoneContainerWithTLS.java
@@ -30,9 +30,9 @@ import org.apache.hadoop.hdds.scm.pipeline.MockPipeline;
import org.apache.hadoop.hdds.security.token.ContainerTokenIdentifier;
import org.apache.hadoop.hdds.security.token.ContainerTokenSecretManager;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.OzoneConfigKeys;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
-import org.apache.hadoop.ozone.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.container.ContainerTestHelper;
import org.apache.hadoop.hdds.scm.XceiverClientGrpc;
import org.apache.hadoop.hdds.scm.XceiverClientSpi;
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/ozoneimpl/TestSecureOzoneContainer.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/ozoneimpl/TestSecureOzoneContainer.java
index ca722cf442..ba741a71f4 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/ozoneimpl/TestSecureOzoneContainer.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/ozoneimpl/TestSecureOzoneContainer.java
@@ -30,10 +30,10 @@ import
org.apache.hadoop.hdds.security.exception.SCMSecurityException;
import org.apache.hadoop.hdds.security.token.ContainerTokenIdentifier;
import org.apache.hadoop.hdds.security.token.ContainerTokenSecretManager;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.hadoop.metrics2.lib.DefaultMetricsSystem;
import org.apache.hadoop.ozone.OzoneConfigKeys;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
-import org.apache.hadoop.ozone.client.CertificateClientTestImpl;
import org.apache.hadoop.hdds.scm.XceiverClientGrpc;
import org.apache.hadoop.hdds.scm.pipeline.Pipeline;
import
org.apache.hadoop.ozone.container.common.statemachine.DatanodeStateMachine;
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/server/TestSecureContainerServer.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/server/TestSecureContainerServer.java
index 8be6d4e59c..1890a95daa 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/server/TestSecureContainerServer.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/container/server/TestSecureContainerServer.java
@@ -49,10 +49,10 @@ import
org.apache.hadoop.hdds.security.token.OzoneBlockTokenIdentifier;
import org.apache.hadoop.hdds.security.token.ContainerTokenSecretManager;
import org.apache.hadoop.hdds.security.token.TokenVerifier;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClientTestImpl;
import org.apache.hadoop.metrics2.lib.DefaultMetricsSystem;
import org.apache.hadoop.ozone.OzoneConfigKeys;
import org.apache.hadoop.ozone.RatisTestHelper;
-import org.apache.hadoop.ozone.client.CertificateClientTestImpl;
import org.apache.hadoop.ozone.container.common.helpers.ContainerMetrics;
import org.apache.hadoop.ozone.container.common.impl.ContainerSet;
import org.apache.hadoop.ozone.container.common.impl.HddsDispatcher;
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestSecureOzoneManager.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestSecureOzoneManager.java
index 1871fb1bc2..00667432e4 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestSecureOzoneManager.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestSecureOzoneManager.java
@@ -122,7 +122,7 @@ public class TestSecureOzoneManager {
// boot-up. Get certificate will fail when SCM is not running.
SecurityConfig securityConfig = new SecurityConfig(conf);
CertificateClient client =
- new OMCertificateClient(securityConfig, omStorage, scmId);
+ new OMCertificateClient(securityConfig, omStorage, scmId, null, null);
Assert.assertEquals(CertificateClient.InitResponse.GETCERT, client.init());
privateKey = client.getPrivateKey();
publicKey = client.getPublicKey();
@@ -131,14 +131,16 @@ public class TestSecureOzoneManager {
Assert.assertNull(client.getCertificate());
// Case 2: If key pair already exist than response should be RECOVER.
- client = new OMCertificateClient(securityConfig, omStorage, scmId);
+ client =
+ new OMCertificateClient(securityConfig, omStorage, scmId, null, null);
Assert.assertEquals(CertificateClient.InitResponse.RECOVER, client.init());
Assert.assertNotNull(client.getPrivateKey());
Assert.assertNotNull(client.getPublicKey());
Assert.assertNull(client.getCertificate());
// Case 3: When public key as well as certificate is missing.
- client = new OMCertificateClient(securityConfig);
+ client =
+ new OMCertificateClient(securityConfig, omStorage, null, null, null);
FileUtils.deleteQuietly(Paths.get(securityConfig.getKeyLocation(COMPONENT)
.toString(), securityConfig.getPublicKeyFileName()).toFile());
Assert.assertEquals(CertificateClient.InitResponse.FAILURE, client.init());
@@ -147,7 +149,8 @@ public class TestSecureOzoneManager {
Assert.assertNull(client.getCertificate());
// Case 4: When private key and certificate is missing.
- client = new OMCertificateClient(securityConfig);
+ client =
+ new OMCertificateClient(securityConfig, omStorage, null, null, null);
KeyCodec keyCodec = new KeyCodec(securityConfig, COMPONENT);
keyCodec.writePublicKey(publicKey);
FileUtils.deleteQuietly(Paths.get(securityConfig.getKeyLocation(COMPONENT)
@@ -168,14 +171,16 @@ public class TestSecureOzoneManager {
certCodec.writeCertificate(new X509CertificateHolder(
x509Certificate.getEncoded()));
omStorage.setOmCertSerialId(x509Certificate.getSerialNumber().toString());
- client = new OMCertificateClient(securityConfig, omStorage, scmId);
+ client =
+ new OMCertificateClient(securityConfig, omStorage, scmId, null, null);
Assert.assertEquals(CertificateClient.InitResponse.FAILURE, client.init());
Assert.assertNull(client.getPrivateKey());
Assert.assertNull(client.getPublicKey());
Assert.assertNotNull(client.getCertificate());
// Case 6: When private key and certificate is present.
- client = new OMCertificateClient(securityConfig, omStorage, scmId);
+ client =
+ new OMCertificateClient(securityConfig, omStorage, scmId, null, null);
FileUtils.deleteQuietly(Paths.get(securityConfig.getKeyLocation(COMPONENT)
.toString(), securityConfig.getPublicKeyFileName()).toFile());
keyCodec.writePrivateKey(privateKey);
@@ -185,7 +190,8 @@ public class TestSecureOzoneManager {
Assert.assertNotNull(client.getCertificate());
// Case 7 When keypair and certificate is present.
- client = new OMCertificateClient(securityConfig, omStorage, scmId);
+ client =
+ new OMCertificateClient(securityConfig, omStorage, scmId, null, null);
Assert.assertEquals(CertificateClient.InitResponse.SUCCESS, client.init());
Assert.assertNotNull(client.getPrivateKey());
Assert.assertNotNull(client.getPublicKey());
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
index 6c45d4444e..ac4c716579 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
@@ -68,6 +68,7 @@ import org.apache.hadoop.hdds.annotation.InterfaceAudience;
import org.apache.hadoop.hdds.client.ReplicationConfig;
import org.apache.hadoop.hdds.client.ReplicationType;
import org.apache.hadoop.hdds.conf.ConfigurationException;
+import org.apache.hadoop.hdds.conf.ConfigurationSource;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.protocol.ReconfigureProtocol;
import org.apache.hadoop.hdds.protocol.proto.HddsProtos;
@@ -1320,14 +1321,15 @@ public final class OzoneManager extends
ServiceRuntimeInfoImpl
LOG.info("Initializing secure OzoneManager.");
CertificateClient certClient =
- new OMCertificateClient(new SecurityConfig(conf), omStore, scmId);
+ new OMCertificateClient(
+ new SecurityConfig(conf), omStore, scmId, null, null);
CertificateClient.InitResponse response = certClient.init();
if (response.equals(CertificateClient.InitResponse.REINIT)) {
LOG.info("Re-initialize certificate client.");
omStore.unsetOmCertSerialId();
omStore.persistCurrentState();
certClient = new OMCertificateClient(
- new SecurityConfig(conf), omStore, scmId);
+ new SecurityConfig(conf), omStore, scmId, null, null);
response = certClient.init();
}
LOG.info("Init response: {}", response);
@@ -4408,7 +4410,7 @@ public final class OzoneManager extends
ServiceRuntimeInfoImpl
}
public static HddsProtos.OzoneManagerDetailsProto getOmDetailsProto(
- OzoneConfiguration config, String omID) {
+ ConfigurationSource config, String omID) {
boolean flexibleFqdnResolutionEnabled = config.getBoolean(
OZONE_FLEXIBLE_FQDN_RESOLUTION_ENABLED,
OZONE_FLEXIBLE_FQDN_RESOLUTION_ENABLED_DEFAULT);
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/OMCertificateClient.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/OMCertificateClient.java
index 7069181793..73d54d0e7a 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/OMCertificateClient.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/OMCertificateClient.java
@@ -20,7 +20,6 @@
package org.apache.hadoop.ozone.security;
import org.apache.commons.lang3.StringUtils;
-import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.protocol.proto.HddsProtos;
import
org.apache.hadoop.hdds.protocol.proto.SCMSecurityProtocolProtos.SCMGetCertResponseProto;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
@@ -30,7 +29,6 @@ import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateCodec;
import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest;
import org.apache.hadoop.hdds.security.x509.exception.CertificateException;
import org.apache.hadoop.ozone.om.OMStorage;
-import org.apache.hadoop.ozone.om.OzoneManager;
import org.apache.hadoop.ozone.om.ha.OMHANodeDetails;
import org.apache.hadoop.security.UserGroupInformation;
import org.bouncycastle.pkcs.PKCS10CertificationRequest;
@@ -43,6 +41,7 @@ import java.security.KeyPair;
import java.util.function.Consumer;
import static
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest.getEncodedString;
+import static org.apache.hadoop.ozone.om.OzoneManager.getOmDetailsProto;
/**
* Certificate client for OzoneManager.
@@ -57,59 +56,19 @@ public class OMCertificateClient extends
CommonCertificateClient {
private final String clusterID;
private final HddsProtos.OzoneManagerDetailsProto omInfo;
- @SuppressWarnings("parameternumber")
- public OMCertificateClient(SecurityConfig secConfig, String scmId,
- String clusterId, HddsProtos.OzoneManagerDetailsProto omDetails,
- String certSerialId, String localCrlId,
- Consumer<String> persistCertIdCallback, Runnable shutdownCallback) {
- super(secConfig, LOG, certSerialId, COMPONENT_NAME, persistCertIdCallback,
- shutdownCallback);
- this.setLocalCrlId(localCrlId != null ?
- Long.parseLong(localCrlId) : 0);
- this.scmID = scmId;
- this.clusterID = clusterId;
- this.omInfo = omDetails;
- }
-
- public OMCertificateClient(SecurityConfig secConfig,
- OMStorage omStorage, String scmID, Consumer<String> saveCertIdCallback,
- Runnable shutdownCallback) {
- this(secConfig, scmID, omStorage.getClusterID(),
- OzoneManager.getOmDetailsProto(
- (OzoneConfiguration) secConfig.getConfiguration(),
- omStorage.getOmId()),
- omStorage.getOmCertSerialId(), null,
+ public OMCertificateClient(
+ SecurityConfig secConfig,
+ OMStorage omStorage,
+ String scmID,
+ Consumer<String> saveCertIdCallback,
+ Runnable shutdownCallback
+ ) {
+ super(secConfig, LOG, omStorage.getOmCertSerialId(), COMPONENT_NAME,
saveCertIdCallback, shutdownCallback);
- }
-
- public OMCertificateClient(SecurityConfig secConfig, OMStorage omStorage,
- String scmID) {
- this(secConfig, scmID, omStorage.getClusterID(),
- OzoneManager.getOmDetailsProto(
- (OzoneConfiguration) secConfig.getConfiguration(),
- omStorage.getOmId()),
- omStorage.getOmCertSerialId(), null, null, null);
- }
-
- public OMCertificateClient(SecurityConfig secConfig) {
- this(secConfig, null, null, null, null, null, null, null);
- }
-
- public OMCertificateClient(SecurityConfig secConfig, String certSerialId) {
- this(secConfig, null, null, null, certSerialId, null, null, null);
- }
-
- /**
- * Returns a CSR builder that can be used to create a Certificate signing
- * request.
- * The default flag is added to allow basic SSL handshake.
- *
- * @return CertificateSignRequest.Builder
- */
- @Override
- public CertificateSignRequest.Builder getCSRBuilder()
- throws CertificateException {
- return getCSRBuilder(new KeyPair(getPublicKey(), getPrivateKey()));
+ this.scmID = scmID;
+ this.clusterID = omStorage.getClusterID();
+ this.omInfo =
+ getOmDetailsProto(secConfig.getConfiguration(), omStorage.getOmId());
}
/**
@@ -119,7 +78,7 @@ public class OMCertificateClient extends
CommonCertificateClient {
* @return CertificateSignRequest.Builder
*/
@Override
- public CertificateSignRequest.Builder getCSRBuilder(KeyPair keyPair)
+ public CertificateSignRequest.Builder getCSRBuilder()
throws CertificateException {
CertificateSignRequest.Builder builder = super.getCSRBuilder()
.setDigitalEncryption(true)
@@ -141,7 +100,7 @@ public class OMCertificateClient extends
CommonCertificateClient {
}
builder.setCA(false)
- .setKey(keyPair)
+ .setKey(new KeyPair(getPublicKey(), getPrivateKey()))
.setConfiguration(getConfig())
.setScmID(scmID)
.setClusterID(clusterID)
diff --git
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/ratis/TestOzoneManagerRatisServer.java
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/ratis/TestOzoneManagerRatisServer.java
index 94eb040795..0e1e004a0e 100644
---
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/ratis/TestOzoneManagerRatisServer.java
+++
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/ratis/TestOzoneManagerRatisServer.java
@@ -30,6 +30,7 @@ import org.apache.hadoop.hdds.HddsConfigKeys;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.utils.TransactionInfo;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
+import org.apache.hadoop.ozone.om.OMStorage;
import org.apache.hadoop.ozone.security.OMCertificateClient;
import org.apache.hadoop.ozone.OmUtils;
import org.apache.hadoop.ozone.OzoneConsts;
@@ -61,6 +62,7 @@ import org.slf4j.LoggerFactory;
import static java.nio.charset.StandardCharsets.UTF_8;
import static org.apache.hadoop.ozone.OzoneConsts.TRANSACTION_INFO_KEY;
import static org.junit.Assert.assertFalse;
+import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
/**
@@ -109,6 +111,10 @@ public class TestOzoneManagerRatisServer {
.setOMNodeId(omID)
.setOMServiceId(OzoneConsts.OM_SERVICE_ID_DEFAULT)
.build();
+ OMStorage omStorage = mock(OMStorage.class);
+ when(omStorage.getOmCertSerialId()).thenReturn(null);
+ when(omStorage.getClusterID()).thenReturn("test");
+ when(omStorage.getOmId()).thenReturn(UUID.randomUUID().toString());
// Starts a single node Ratis server
ozoneManager = Mockito.mock(OzoneManager.class);
OzoneConfiguration ozoneConfiguration = new OzoneConfiguration();
@@ -121,7 +127,8 @@ public class TestOzoneManagerRatisServer {
when(ozoneManager.getSnapshotInfo()).thenReturn(omRatisSnapshotInfo);
when(ozoneManager.getConfiguration()).thenReturn(conf);
secConfig = new SecurityConfig(conf);
- certClient = new OMCertificateClient(secConfig);
+ certClient =
+ new OMCertificateClient(secConfig, omStorage, null, null, null);
omRatisServer = OzoneManagerRatisServer.newOMRatisServer(conf,
ozoneManager,
omNodeDetails, Collections.emptyMap(), secConfig, certClient, false);
omRatisServer.start();
diff --git
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOmCertificateClientInit.java
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOmCertificateClientInit.java
index e3038d9da8..be4a891f12 100644
---
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOmCertificateClientInit.java
+++
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOmCertificateClientInit.java
@@ -26,6 +26,7 @@ import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateCodec;
import org.apache.hadoop.hdds.security.x509.keys.HDDSKeyGenerator;
import org.apache.hadoop.hdds.security.x509.keys.KeyCodec;
import org.apache.hadoop.ozone.OzoneSecurityUtil;
+import org.apache.hadoop.ozone.om.OMStorage;
import org.apache.hadoop.security.ssl.KeyStoreTestUtil;
import org.apache.ozone.test.GenericTestUtils;
import org.bouncycastle.cert.X509CertificateHolder;
@@ -52,6 +53,8 @@ import static
org.apache.hadoop.hdds.security.x509.certificate.client.Certificat
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.junit.jupiter.params.provider.Arguments.arguments;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
/**
* Test class for {@link OMCertificateClient}.
@@ -93,7 +96,12 @@ public class TestOmCertificateClientInit {
keyPair = keyGenerator.generateKey();
x509Certificate = getX509Certificate();
certSerialId = x509Certificate.getSerialNumber().toString();
- omCertificateClient = new OMCertificateClient(securityConfig,
certSerialId);
+ OMStorage storage = mock(OMStorage.class);
+ when(storage.getOmCertSerialId()).thenReturn(certSerialId);
+ when(storage.getClusterID()).thenReturn("test");
+ when(storage.getOmId()).thenReturn(UUID.randomUUID().toString());
+ omCertificateClient =
+ new OMCertificateClient(securityConfig, storage, null, null, null);
omKeyCodec = new KeyCodec(securityConfig, OM_COMPONENT);
Files.createDirectories(securityConfig.getKeyLocation(OM_COMPONENT));
diff --git
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOzoneDelegationTokenSecretManager.java
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOzoneDelegationTokenSecretManager.java
index 51e2a82ba3..a6d2b86b01 100644
---
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOzoneDelegationTokenSecretManager.java
+++
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOzoneDelegationTokenSecretManager.java
@@ -28,6 +28,7 @@ import java.security.cert.CertPath;
import java.security.cert.X509Certificate;
import java.util.HashMap;
import java.util.Map;
+import java.util.UUID;
import com.google.common.collect.ImmutableList;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
@@ -38,6 +39,7 @@ import org.apache.hadoop.hdds.server.ServerUtils;
import org.apache.hadoop.io.Text;
import org.apache.hadoop.ozone.OzoneConsts;
import org.apache.hadoop.ozone.om.OMMetadataManager;
+import org.apache.hadoop.ozone.om.OMStorage;
import org.apache.hadoop.ozone.om.OmMetadataManagerImpl;
import org.apache.hadoop.ozone.om.OzoneManager;
import org.apache.hadoop.ozone.om.S3SecretCache;
@@ -56,6 +58,8 @@ import org.apache.hadoop.util.Time;
import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_RATIS_ENABLE_KEY;
import static
org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.OMTokenProto.Type.S3AUTHINFO;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
import org.apache.ratis.protocol.RaftPeerId;
import org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory;
@@ -140,7 +144,12 @@ public class TestOzoneDelegationTokenSecretManager {
CertPath certPath = fact.engineGenerateCertPath(
ImmutableList.of(singleCert));
- return new OMCertificateClient(securityConfig) {
+ OMStorage omStorage = mock(OMStorage.class);
+ when(omStorage.getOmCertSerialId()).thenReturn(null);
+ when(omStorage.getClusterID()).thenReturn("test");
+ when(omStorage.getOmId()).thenReturn(UUID.randomUUID().toString());
+ return new OMCertificateClient(
+ securityConfig, omStorage, null, null, null) {
@Override
public CertPath getCertPath() {
return certPath;
diff --git
a/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconServer.java
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconServer.java
index f571618b98..d2fa2f992d 100644
---
a/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconServer.java
+++
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconServer.java
@@ -29,7 +29,7 @@ import org.apache.hadoop.hdds.recon.ReconConfig;
import org.apache.hadoop.hdds.scm.server.OzoneStorageContainerManager;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient;
-import
org.apache.hadoop.hdds.security.x509.certificate.client.ReconCertificateClient;
+import org.apache.hadoop.ozone.recon.security.ReconCertificateClient;
import org.apache.hadoop.hdds.utils.HddsServerUtil;
import org.apache.hadoop.ozone.OzoneSecurityUtil;
import org.apache.hadoop.ozone.recon.scm.ReconSafeModeManager;
@@ -169,8 +169,7 @@ public class ReconServer extends GenericCli {
throws IOException {
LOG.info("Initializing secure Recon.");
certClient = new ReconCertificateClient(new SecurityConfig(configuration),
- reconStorage.getReconCertSerialId(), reconStorage.getClusterID(),
- reconStorage.getReconId(), this::saveNewCertId, null);
+ reconStorage, this::saveNewCertId, null);
CertificateClient.InitResponse response = certClient.init();
if (response.equals(CertificateClient.InitResponse.REINIT)) {
@@ -178,8 +177,7 @@ public class ReconServer extends GenericCli {
reconStorage.unsetReconCertSerialId();
reconStorage.persistCurrentState();
certClient = new ReconCertificateClient(new
SecurityConfig(configuration),
- reconStorage.getReconCertSerialId(), reconStorage.getClusterID(),
- reconStorage.getReconId(), this::saveNewCertId,
this::terminateRecon);
+ reconStorage, this::saveNewCertId, this::terminateRecon);
response = certClient.init();
}
LOG.info("Init response: {}", response);
@@ -192,8 +190,6 @@ public class ReconServer extends GenericCli {
certClient.getCSRBuilder().build());
reconStorage.setReconCertSerialId(certId);
reconStorage.persistCurrentState();
- // set new certificate ID
- certClient.setCertificateId(certId);
LOG.info("Successfully stored SCM signed certificate, case:{}.",
response);
break;
diff --git
a/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconUtils.java
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconUtils.java
index 7ed0c3efd2..7adc78657e 100644
---
a/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconUtils.java
+++
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconUtils.java
@@ -25,20 +25,15 @@ import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.net.HttpURLConnection;
-import java.net.InetAddress;
import java.net.URL;
import java.nio.file.Path;
import java.nio.file.Paths;
-import java.security.KeyPair;
import java.sql.Timestamp;
import com.google.inject.Singleton;
import org.apache.hadoop.hdds.HddsConfigKeys;
import org.apache.hadoop.hdds.HddsUtils;
import org.apache.hadoop.hdds.conf.ConfigurationSource;
-import org.apache.hadoop.hdds.conf.OzoneConfiguration;
-import
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient;
-import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest;
import org.apache.hadoop.hdfs.web.URLConnectionFactory;
import org.apache.hadoop.io.IOUtils;
@@ -52,9 +47,7 @@ import static org.jooq.impl.DSL.currentTimestamp;
import static org.jooq.impl.DSL.select;
import static org.jooq.impl.DSL.using;
-import org.apache.hadoop.security.UserGroupInformation;
import
org.apache.hadoop.security.authentication.client.AuthenticationException;
-import org.bouncycastle.pkcs.PKCS10CertificationRequest;
import org.hadoop.ozone.recon.schema.tables.daos.GlobalStatsDao;
import org.hadoop.ozone.recon.schema.tables.pojos.GlobalStats;
import org.jooq.Configuration;
@@ -325,26 +318,4 @@ public class ReconUtils {
}
return index;
}
-
- /**
- * Creates CertificateSignRequest.
- * @param config
- * */
- public static PKCS10CertificationRequest getCSR(OzoneConfiguration config,
- CertificateClient certClient) throws IOException {
- CertificateSignRequest.Builder builder = certClient.getCSRBuilder();
- KeyPair keyPair = new KeyPair(certClient.getPublicKey(),
- certClient.getPrivateKey());
-
- String hostname = InetAddress.getLocalHost().getCanonicalHostName();
- String subject = UserGroupInformation.getCurrentUser()
- .getShortUserName() + "@" + hostname;
-
- builder.setCA(false)
- .setKey(keyPair)
- .setConfiguration(config)
- .setSubject(subject);
-
- return builder.build();
- }
}
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/ReconCertificateClient.java
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/security/ReconCertificateClient.java
similarity index 84%
rename from
hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/ReconCertificateClient.java
rename to
hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/security/ReconCertificateClient.java
index d949b75c38..5850c44bae 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/ReconCertificateClient.java
+++
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/security/ReconCertificateClient.java
@@ -15,15 +15,17 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.hadoop.hdds.security.x509.certificate.client;
+package org.apache.hadoop.ozone.recon.security;
import org.apache.hadoop.hdds.protocol.proto.HddsProtos;
import org.apache.hadoop.hdds.protocol.proto.SCMSecurityProtocolProtos;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
import org.apache.hadoop.hdds.security.x509.certificate.authority.CAType;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.CommonCertificateClient;
import org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateCodec;
import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest;
import org.apache.hadoop.hdds.security.x509.exception.CertificateException;
+import org.apache.hadoop.ozone.recon.scm.ReconStorageConfig;
import org.apache.hadoop.security.UserGroupInformation;
import org.bouncycastle.pkcs.PKCS10CertificationRequest;
import org.slf4j.Logger;
@@ -50,31 +52,20 @@ public class ReconCertificateClient extends
CommonCertificateClient {
private final String clusterID;
private final String reconID;
- public ReconCertificateClient(SecurityConfig securityConfig,
- String certSerialId, String clusterId, String reconId,
- Consumer<String> saveCertIdCallback, Runnable shutdownCallback) {
- super(securityConfig, LOG, certSerialId, COMPONENT_NAME,
- saveCertIdCallback, shutdownCallback);
- this.clusterID = clusterId;
- this.reconID = reconId;
- }
-
- public ReconCertificateClient(SecurityConfig securityConfig,
- String certSerialId, String clusterId, String reconId) {
- super(securityConfig, LOG, certSerialId, COMPONENT_NAME, null, null);
- this.clusterID = clusterId;
- this.reconID = reconId;
+ public ReconCertificateClient(
+ SecurityConfig config,
+ ReconStorageConfig storage,
+ Consumer<String> saveCertIdCallback,
+ Runnable shutdownCallback) {
+ super(config, LOG, storage.getReconCertSerialId(),
+ COMPONENT_NAME, saveCertIdCallback, shutdownCallback);
+ this.clusterID = storage.getClusterID();
+ this.reconID = storage.getReconId();
}
@Override
public CertificateSignRequest.Builder getCSRBuilder()
throws CertificateException {
- return getCSRBuilder(new KeyPair(getPublicKey(), getPrivateKey()));
- }
-
- @Override
- public CertificateSignRequest.Builder getCSRBuilder(KeyPair keyPair)
- throws CertificateException {
LOG.info("Creating CSR for Recon.");
try {
CertificateSignRequest.Builder builder = super.getCSRBuilder();
@@ -83,7 +74,7 @@ public class ReconCertificateClient extends
CommonCertificateClient {
.getShortUserName() + "@" + hostname;
builder.setCA(false)
- .setKey(keyPair)
+ .setKey(new KeyPair(getPublicKey(), getPrivateKey()))
.setConfiguration(getConfig())
.setSubject(subject);
diff --git
a/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/security/package-info.java
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/security/package-info.java
new file mode 100644
index 0000000000..7d17cb84cb
--- /dev/null
+++
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/security/package-info.java
@@ -0,0 +1,22 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+/**
+ * Home of Recon's security related facilities.
+ */
+package org.apache.hadoop.ozone.recon.security;
diff --git
a/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/spi/impl/StorageContainerServiceProviderImpl.java
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/spi/impl/StorageContainerServiceProviderImpl.java
index b726c8a516..1f2a5c4008 100644
---
a/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/spi/impl/StorageContainerServiceProviderImpl.java
+++
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/spi/impl/StorageContainerServiceProviderImpl.java
@@ -49,7 +49,7 @@ import org.apache.hadoop.hdds.scm.ha.SCMSnapshotDownloader;
import org.apache.hadoop.hdds.scm.pipeline.Pipeline;
import org.apache.hadoop.hdds.scm.protocol.StorageContainerLocationProtocol;
import org.apache.hadoop.hdds.security.x509.SecurityConfig;
-import
org.apache.hadoop.hdds.security.x509.certificate.client.ReconCertificateClient;
+import org.apache.hadoop.ozone.recon.security.ReconCertificateClient;
import org.apache.hadoop.hdds.server.http.HttpConfig;
import org.apache.hadoop.hdds.utils.db.DBCheckpoint;
import org.apache.hadoop.hdds.utils.db.RocksDBCheckpoint;
@@ -201,8 +201,7 @@ public class StorageContainerServiceProviderImpl
try (SCMSnapshotDownloader downloadClient = new InterSCMGrpcClient(
hostAddress, grpcPort, configuration,
new ReconCertificateClient(new SecurityConfig(configuration),
- reconStorage.getReconCertSerialId(),
- reconStorage.getClusterID(), reconStorage.getReconId()))) {
+ reconStorage, null, null))) {
downloadClient.download(targetFile.toPath()).get();
} catch (ExecutionException | InterruptedException e) {
LOG.error("Rocks DB checkpoint downloading failed", e);
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
