Maksim Davydov created IGNITE-29193:
---------------------------------------
Summary: Remove node certificates from node attributes after join
in ZookeeperDiscoverySpi
Key: IGNITE-29193
URL: https://issues.apache.org/jira/browse/IGNITE-29193
Project: Ignite
Issue Type: Task
Reporter: Maksim Davydov
Assignee: Maksim Davydov
IGNITE-27216 added the {{IgniteNodeAttributes.ATTR_NODE_CERTIFICATES}} node
attribute, so a security implementation can validate a node's certificate
during the join. {{TcpDiscoverySpi}} fills it from the SSL session and removes
it from the node once the join completes.
{{ZookeeperDiscoverySpi}} has no node-to-node SSL session, so a security
implementation that needs the certificate supplies the attribute itself. The
SPI never removes it: the {{Certificate[]}} stays in the attributes of every
topology node, on every node of the cluster.
Every reader of node attributes then gets the certificates. For example,
{{IgniteClient#cluster().nodes()}} fails on JDK 17:
{noformat}
Failed to serialize object [typeName=[Ljava.security.cert.Certificate;]
java.lang.reflect.InaccessibleObjectException: Unable to make field private
final java.lang.String java.security.cert.Certificate.type accessible: module
java.base does not "opens java.security.cert" to unnamed module
{noformat}
A test reproduces it by supplying the attribute through a test discovery SPI.
{{ZookeeperDiscoverySpi}} should remove the attribute when a node enters the
topology, after authentication and before {{EVT_NODE_JOINED}}, as
{{TcpDiscoverySpi}} does.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
