[
https://issues.apache.org/jira/browse/IGNITE-29193?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Maksim Davydov updated IGNITE-29193:
------------------------------------
Summary: Remove sensitive data from node attributes after join in
ZookeeperDiscoverySpi (was: Remove node certificates from node attributes
after join in ZookeeperDiscoverySpi)
> Remove sensitive data from node attributes after join in ZookeeperDiscoverySpi
> ------------------------------------------------------------------------------
>
> Key: IGNITE-29193
> URL: https://issues.apache.org/jira/browse/IGNITE-29193
> Project: Ignite
> Issue Type: Task
> Reporter: Maksim Davydov
> Assignee: Maksim Davydov
> Priority: Major
>
> IGNITE-27216 added the {{IgniteNodeAttributes.ATTR_NODE_CERTIFICATES}} node
> attribute, so a security implementation can validate a node's certificate
> during the join. {{TcpDiscoverySpi}} fills it from the SSL session and
> removes it from the node once the join completes.
> {{ZookeeperDiscoverySpi}} has no node-to-node SSL session, so a security
> implementation that needs the certificate supplies the attribute itself. The
> SPI never removes it: the {{Certificate[]}} stays in the attributes of every
> topology node, on every node of the cluster.
> Every reader of node attributes then gets the certificates. For example,
> {{IgniteClient#cluster().nodes()}} fails on JDK 17:
> {noformat}
> Failed to serialize object [typeName=[Ljava.security.cert.Certificate;]
> java.lang.reflect.InaccessibleObjectException: Unable to make field private
> final java.lang.String java.security.cert.Certificate.type accessible: module
> java.base does not "opens java.security.cert" to unnamed module
> {noformat}
> A test reproduces it by supplying the attribute through a test discovery SPI.
> {{ZookeeperDiscoverySpi}} should remove the attribute when a node enters the
> topology, after authentication and before {{EVT_NODE_JOINED}}, as
> {{TcpDiscoverySpi}} does.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
