This is an automated email from the ASF dual-hosted git repository.
pifta pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/master by this push:
new 08258d6a24 HDDS-9418. Consolidate CertificateClient handleCase
handling (#5415)
08258d6a24 is described below
commit 08258d6a24c721993bb7710770c47512bad228e9
Author: Sammi Chen <[email protected]>
AuthorDate: Wed Oct 18 01:02:54 2023 +0800
HDDS-9418. Consolidate CertificateClient handleCase handling (#5415)
---
.../x509/certificate/client/CertificateClient.java | 3 +-
.../apache/hadoop/ozone/HddsDatanodeService.java | 4 -
.../client/CommonCertificateClient.java | 129 ---------------------
.../certificate/client/DNCertificateClient.java | 4 +-
.../client/DefaultCertificateClient.java | 4 +-
.../certificate/client/SCMCertificateClient.java | 62 ----------
.../apache/hadoop/hdds/scm/ha/HASecurityUtils.java | 4 -
.../hadoop/ozone/om/TestSecureOzoneManager.java | 4 +-
.../org/apache/hadoop/ozone/om/OzoneManager.java | 4 -
.../hadoop/ozone/security/OMCertificateClient.java | 8 +-
.../security/TestOmCertificateClientInit.java | 3 +-
.../org/apache/hadoop/ozone/recon/ReconServer.java | 4 -
.../recon/security/ReconCertificateClient.java | 4 +-
13 files changed, 13 insertions(+), 224 deletions(-)
diff --git
a/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java
b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java
index 656f2acab5..aa1217598b 100644
---
a/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java
+++
b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java
@@ -262,7 +262,6 @@ public interface CertificateClient extends Closeable {
enum InitResponse {
SUCCESS,
FAILURE,
- GETCERT,
- RECOVER
+ GETCERT
}
}
diff --git
a/hadoop-hdds/container-service/src/main/java/org/apache/hadoop/ozone/HddsDatanodeService.java
b/hadoop-hdds/container-service/src/main/java/org/apache/hadoop/ozone/HddsDatanodeService.java
index 4b79907620..c9934c41bf 100644
---
a/hadoop-hdds/container-service/src/main/java/org/apache/hadoop/ozone/HddsDatanodeService.java
+++
b/hadoop-hdds/container-service/src/main/java/org/apache/hadoop/ozone/HddsDatanodeService.java
@@ -412,10 +412,6 @@ public class HddsDatanodeService extends GenericCli
implements ServicePlugin {
case FAILURE:
LOG.error("DN security initialization failed, case:{}.", response);
throw new RuntimeException("DN security initialization failed.");
- case RECOVER:
- LOG.error("DN security initialization failed, case:{}. OM certificate " +
- "is missing.", response);
- throw new RuntimeException("DN security initialization failed.");
default:
LOG.error("DN security initialization failed. Init response: {}",
response);
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CommonCertificateClient.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CommonCertificateClient.java
deleted file mode 100644
index 5882bdb611..0000000000
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CommonCertificateClient.java
+++ /dev/null
@@ -1,129 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with this
- * work for additional information regarding copyright ownership. The ASF
- * licenses this file to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * <p>
- * http://www.apache.org/licenses/LICENSE-2.0
- * <p>
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations
under
- * the License.
- */
-
-package org.apache.hadoop.hdds.security.x509.certificate.client;
-
-import
org.apache.hadoop.hdds.protocolPB.SCMSecurityProtocolClientSideTranslatorPB;
-import org.apache.hadoop.hdds.security.SecurityConfig;
-import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest;
-import org.apache.hadoop.hdds.security.x509.exception.CertificateException;
-import org.slf4j.Logger;
-
-import java.util.function.Consumer;
-
-import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.FAILURE;
-import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.GETCERT;
-import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.RECOVER;
-import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.SUCCESS;
-
-/**
- * Common Certificate client.
- */
-public abstract class CommonCertificateClient extends DefaultCertificateClient
{
-
- private final Logger log;
-
- @SuppressWarnings("checkstyle:ParameterNumber")
- public CommonCertificateClient(
- SecurityConfig securityConfig,
- SCMSecurityProtocolClientSideTranslatorPB scmSecurityClient,
- Logger log,
- String certSerialId,
- String component,
- String threadNamePrefix,
- Consumer<String> saveCertIdCallback,
- Runnable shutdownCallback
- ) {
- super(securityConfig, scmSecurityClient, log, certSerialId, component,
- threadNamePrefix, saveCertIdCallback, shutdownCallback);
- this.log = log;
- }
-
- /**
- * Returns a CSR builder that can be used to creates a Certificate signing
- * request.
- *
- * @return CertificateSignRequest.Builder
- */
- @Override
- public CertificateSignRequest.Builder getCSRBuilder()
- throws CertificateException {
- return super.getCSRBuilder()
- .setDigitalEncryption(true)
- .setDigitalSignature(true);
- }
-
- @Override
- protected InitResponse handleCase(InitCase init)
- throws CertificateException {
- switch (init) {
- case NONE:
- log.info("Creating keypair for client as keypair and certificate not " +
- "found.");
- bootstrapClientKeys();
- return GETCERT;
- case CERT:
- log.error("Private key not found, while certificate is still present." +
- "Delete keypair and try again.");
- return FAILURE;
- case PUBLIC_KEY:
- log.error("Found public key but private key and certificate missing.");
- return FAILURE;
- case PRIVATE_KEY:
- log.info("Found private key but public key and certificate is missing.");
- // TODO: Recovering public key from private might be possible in some
- // cases.
- return FAILURE;
- case PUBLICKEY_CERT:
- log.error("Found public key and certificate but private key is " +
- "missing.");
- return FAILURE;
- case PRIVATEKEY_CERT:
- log.info("Found private key and certificate but public key missing.");
- if (recoverPublicKey()) {
- return SUCCESS;
- } else {
- log.error("Public key recovery failed.");
- return FAILURE;
- }
- case PUBLICKEY_PRIVATEKEY:
- log.info("Found private and public key but certificate is missing.");
- if (validateKeyPair(getPublicKey())) {
- return RECOVER;
- } else {
- log.error("Keypair validation failed.");
- return FAILURE;
- }
- case ALL:
- log.info("Found certificate file along with KeyPair.");
- if (validateKeyPairAndCertificate()) {
- return SUCCESS;
- } else {
- return FAILURE;
- }
- default:
- log.error("Unexpected case: {} (private/public/cert)",
- Integer.toBinaryString(init.ordinal()));
- return FAILURE;
- }
- }
-
- @Override
- public Logger getLogger() {
- return log;
- }
-}
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DNCertificateClient.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DNCertificateClient.java
index ca56325e69..e9f7c4465d 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DNCertificateClient.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DNCertificateClient.java
@@ -72,9 +72,7 @@ public class DNCertificateClient extends
DefaultCertificateClient {
@Override
public CertificateSignRequest.Builder getCSRBuilder()
throws CertificateException {
- CertificateSignRequest.Builder builder = super.getCSRBuilder()
- .setDigitalEncryption(true)
- .setDigitalSignature(true);
+ CertificateSignRequest.Builder builder = super.getCSRBuilder();
try {
String hostname = InetAddress.getLocalHost().getCanonicalHostName();
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DefaultCertificateClient.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DefaultCertificateClient.java
index ef538d3f0a..55f2e4e386 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DefaultCertificateClient.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/DefaultCertificateClient.java
@@ -584,7 +584,9 @@ public abstract class DefaultCertificateClient implements
CertificateClient {
CertificateSignRequest.Builder builder =
new CertificateSignRequest.Builder()
.setConfiguration(securityConfig)
- .addInetAddresses();
+ .addInetAddresses()
+ .setDigitalEncryption(true)
+ .setDigitalSignature(true);
return builder;
}
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/SCMCertificateClient.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/SCMCertificateClient.java
index 63fe9784cd..00e3dd1602 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/SCMCertificateClient.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/SCMCertificateClient.java
@@ -44,10 +44,6 @@ import java.util.Set;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
-import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.FAILURE;
-import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.GETCERT;
-import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.RECOVER;
-import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.SUCCESS;
import static
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest.getEncodedString;
import static org.apache.hadoop.ozone.OzoneConsts.SCM_SUB_CA_PREFIX;
@@ -105,62 +101,6 @@ public class SCMCertificateClient extends
DefaultCertificateClient {
component);
}
- @Override
- protected InitResponse handleCase(InitCase init)
- throws CertificateException {
- // This is similar to OM.
- switch (init) {
- case NONE:
- LOG.info("Creating keypair for client as keypair and certificate not " +
- "found.");
- bootstrapClientKeys();
- return GETCERT;
- case CERT:
- LOG.error("Private key not found, while certificate is still present." +
- "Delete keypair and try again.");
- return FAILURE;
- case PUBLIC_KEY:
- LOG.error("Found public key but private key and certificate missing.");
- return FAILURE;
- case PRIVATE_KEY:
- LOG.info("Found private key but public key and certificate is missing.");
- // TODO: Recovering public key from private might be possible in some
- // cases.
- return FAILURE;
- case PUBLICKEY_CERT:
- LOG.error("Found public key and certificate but private key is " +
- "missing.");
- return FAILURE;
- case PRIVATEKEY_CERT:
- LOG.info("Found private key and certificate but public key missing.");
- if (recoverPublicKey()) {
- return SUCCESS;
- } else {
- LOG.error("Public key recovery failed.");
- return FAILURE;
- }
- case PUBLICKEY_PRIVATEKEY:
- LOG.info("Found private and public key but certificate is missing.");
- if (validateKeyPair(getPublicKey())) {
- return RECOVER;
- } else {
- LOG.error("Keypair validation failed.");
- return FAILURE;
- }
- case ALL:
- LOG.info("Found certificate file along with KeyPair.");
- if (validateKeyPairAndCertificate()) {
- return SUCCESS;
- } else {
- return FAILURE;
- }
- default:
- LOG.error("Unexpected case: {} (private/public/cert)",
- Integer.toBinaryString(init.ordinal()));
- return FAILURE;
- }
- }
-
/**
* Returns a CSR builder that can be used to creates a Certificate signing
* request.
@@ -180,8 +120,6 @@ public class SCMCertificateClient extends
DefaultCertificateClient {
.setSubject(subject)
.setScmID(scmId)
.setClusterID(cId)
- .setDigitalEncryption(true)
- .setDigitalSignature(true)
// Set CA to true, as this will be used to sign certs for OM/DN.
.setCA(true)
.setKey(new KeyPair(getPublicKey(), getPrivateKey()));
diff --git
a/hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/ha/HASecurityUtils.java
b/hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/ha/HASecurityUtils.java
index f307a40308..139a4ca99b 100644
---
a/hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/ha/HASecurityUtils.java
+++
b/hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/ha/HASecurityUtils.java
@@ -123,10 +123,6 @@ public final class HASecurityUtils {
case FAILURE:
LOG.error("SCM security initialization failed.");
throw new RuntimeException("OM security initialization failed.");
- case RECOVER:
- LOG.error("SCM security initialization failed. SCM certificate is " +
- "missing.");
- throw new RuntimeException("SCM security initialization failed.");
default:
LOG.error("SCM security initialization failed. Init response: {}",
response);
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestSecureOzoneManager.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestSecureOzoneManager.java
index 6b899943e8..03477f851e 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestSecureOzoneManager.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestSecureOzoneManager.java
@@ -135,11 +135,11 @@ public class TestSecureOzoneManager {
Assert.assertNull(client.getCertificate());
client.close();
- // Case 2: If key pair already exist than response should be RECOVER.
+ // Case 2: If key pair already exist than response should be GETCERT.
client =
new OMCertificateClient(
securityConfig, null, omStorage, omInfo, "", scmId, null, null);
- Assert.assertEquals(CertificateClient.InitResponse.RECOVER, client.init());
+ Assert.assertEquals(CertificateClient.InitResponse.GETCERT, client.init());
Assert.assertNotNull(client.getPrivateKey());
Assert.assertNotNull(client.getPublicKey());
Assert.assertNull(client.getCertificate());
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
index 3f2543ade1..2a6c0d3535 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
@@ -1419,10 +1419,6 @@ public final class OzoneManager extends
ServiceRuntimeInfoImpl
case FAILURE:
LOG.error("OM security initialization failed.");
throw new RuntimeException("OM security initialization failed.");
- case RECOVER:
- LOG.error("OM security initialization failed. OM certificate is " +
- "missing.");
- throw new RuntimeException("OM security initialization failed.");
default:
LOG.error("OM security initialization failed. Init response: {}",
response);
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/OMCertificateClient.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/OMCertificateClient.java
index 02f1f78495..a6bfed699f 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/OMCertificateClient.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/OMCertificateClient.java
@@ -25,7 +25,7 @@ import org.apache.hadoop.hdds.protocol.proto.HddsProtos;
import
org.apache.hadoop.hdds.protocol.proto.SCMSecurityProtocolProtos.SCMGetCertResponseProto;
import
org.apache.hadoop.hdds.protocolPB.SCMSecurityProtocolClientSideTranslatorPB;
import org.apache.hadoop.hdds.security.SecurityConfig;
-import
org.apache.hadoop.hdds.security.x509.certificate.client.CommonCertificateClient;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.DefaultCertificateClient;
import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest;
import org.apache.hadoop.hdds.security.x509.exception.CertificateException;
import org.apache.hadoop.ozone.om.OMStorage;
@@ -43,7 +43,7 @@ import static
org.apache.hadoop.hdds.security.x509.certificate.utils.Certificate
/**
* Certificate client for OzoneManager.
*/
-public class OMCertificateClient extends CommonCertificateClient {
+public class OMCertificateClient extends DefaultCertificateClient {
public static final Logger LOG =
LoggerFactory.getLogger(OMCertificateClient.class);
@@ -83,9 +83,7 @@ public class OMCertificateClient extends
CommonCertificateClient {
@Override
public CertificateSignRequest.Builder getCSRBuilder()
throws CertificateException {
- CertificateSignRequest.Builder builder = super.getCSRBuilder()
- .setDigitalEncryption(true)
- .setDigitalSignature(true);
+ CertificateSignRequest.Builder builder = super.getCSRBuilder();
String hostname = omInfo.getHostName();
String subject;
diff --git
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOmCertificateClientInit.java
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOmCertificateClientInit.java
index 7bbd2d390b..ce480cd0ad 100644
---
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOmCertificateClientInit.java
+++
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/security/TestOmCertificateClientInit.java
@@ -51,7 +51,6 @@ import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_METADATA_DIR_NAME;
import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse;
import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.FAILURE;
import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.GETCERT;
-import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.RECOVER;
import static
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient.InitResponse.SUCCESS;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -155,7 +154,7 @@ public class TestOmCertificateClientInit {
InitResponse response = omCertificateClient.init();
if (pvtKeyPresent && pubKeyPresent && !certPresent) {
- assertEquals(RECOVER, response);
+ assertEquals(GETCERT, response);
} else {
assertEquals(expectedResult, response);
}
diff --git
a/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconServer.java
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconServer.java
index 7b63595f55..7a02f08375 100644
---
a/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconServer.java
+++
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/ReconServer.java
@@ -201,10 +201,6 @@ public class ReconServer extends GenericCli {
case FAILURE:
LOG.error("Recon security initialization failed, case:{}.", response);
throw new RuntimeException("Recon security initialization failed.");
- case RECOVER:
- LOG.error("Recon security initialization failed. Recon certificate is " +
- "missing.");
- throw new RuntimeException("Recon security initialization failed.");
default:
LOG.error("Recon security initialization failed. Init response: {}",
response);
diff --git
a/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/security/ReconCertificateClient.java
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/security/ReconCertificateClient.java
index cc1d64c91d..92b540ecd1 100644
---
a/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/security/ReconCertificateClient.java
+++
b/hadoop-ozone/recon/src/main/java/org/apache/hadoop/ozone/recon/security/ReconCertificateClient.java
@@ -21,7 +21,7 @@ import org.apache.hadoop.hdds.protocol.proto.HddsProtos;
import
org.apache.hadoop.hdds.protocol.proto.SCMSecurityProtocolProtos.SCMGetCertResponseProto;
import
org.apache.hadoop.hdds.protocolPB.SCMSecurityProtocolClientSideTranslatorPB;
import org.apache.hadoop.hdds.security.SecurityConfig;
-import
org.apache.hadoop.hdds.security.x509.certificate.client.CommonCertificateClient;
+import
org.apache.hadoop.hdds.security.x509.certificate.client.DefaultCertificateClient;
import
org.apache.hadoop.hdds.security.x509.certificate.utils.CertificateSignRequest;
import org.apache.hadoop.hdds.security.x509.exception.CertificateException;
import org.apache.hadoop.ozone.recon.scm.ReconStorageConfig;
@@ -41,7 +41,7 @@ import static
org.apache.hadoop.hdds.security.x509.exception.CertificateExceptio
/**
* Certificate client for Recon.
*/
-public class ReconCertificateClient extends CommonCertificateClient {
+public class ReconCertificateClient extends DefaultCertificateClient {
private static final Logger LOG =
LoggerFactory.getLogger(ReconCertificateClient.class);
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
