[
https://issues.apache.org/jira/browse/IGNITE-29193?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18130808#comment-18130808
]
Ignite TC Bot commented on IGNITE-29193:
----------------------------------------
{panel:title=Branch: [pull/13731/head] Base: [master] : No blockers
found!|borderStyle=dashed|borderColor=#ccc|titleBGColor=#D6F7C1}{panel}
{panel:title=Branch: [pull/13731/head] Base: [master] : New Tests
(2)|borderStyle=dashed|borderColor=#ccc|titleBGColor=#D6F7C1}
{color:#00008b}ZooKeeper (Discovery) 1{color} [[tests
2|https://ci2.ignite.apache.org/viewLog.html?buildId=9432573]]
* {color:#013220}ZookeeperDiscoverySpiTestSuite1:
ZookeeperDiscoveryMiscTest.testNodeSensitiveDataRemovedAfterJoin - PASSED{color}
* {color:#013220}ZookeeperDiscoverySpiTestSuite1:
ZookeeperDiscoveryMiscTest.testThinClientNodeDetailsExcludeCertificates -
PASSED{color}
{panel}
[TeamCity *--> Run :: All*
Results|https://ci2.ignite.apache.org/viewLog.html?buildId=9432627&buildTypeId=IgniteTests24Java8_RunAll]
{color:#ffffff}tcbot-analysis-comment chainBuildId=9432627
rerunBuildIds=9435623,9435625,9435627,9435629{color}
> Remove sensitive data from node attributes after join in ZookeeperDiscoverySpi
> ------------------------------------------------------------------------------
>
> Key: IGNITE-29193
> URL: https://issues.apache.org/jira/browse/IGNITE-29193
> Project: Ignite
> Issue Type: Task
> Reporter: Maksim Davydov
> Assignee: Maksim Davydov
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> IGNITE-27216 added the {{IgniteNodeAttributes.ATTR_NODE_CERTIFICATES}} node
> attribute, so a security implementation can validate a node's certificate
> during the join. {{TcpDiscoverySpi}} fills it from the SSL session and
> removes it from the node once the join completes.
> {{ZookeeperDiscoverySpi}} has no node-to-node SSL session, so a security
> implementation that needs the certificate supplies the attribute itself. The
> SPI never removes it: the {{Certificate[]}} stays in the attributes of every
> topology node, on every node of the cluster.
> Every reader of node attributes then gets the certificates. For example,
> {{IgniteClient#cluster().nodes()}} fails on JDK 17:
> {noformat}
> Failed to serialize object [typeName=[Ljava.security.cert.Certificate;]
> java.lang.reflect.InaccessibleObjectException: Unable to make field private
> final java.lang.String java.security.cert.Certificate.type accessible: module
> java.base does not "opens java.security.cert" to unnamed module
> {noformat}
> A test reproduces it by supplying the attribute through a test discovery SPI.
> {{ZookeeperDiscoverySpi}} should remove the attribute when a node enters the
> topology, after authentication and before {{EVT_NODE_JOINED}}, as
> {{TcpDiscoverySpi}} does.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
