[
https://issues.apache.org/jira/browse/IGNITE-29209?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29209:
--------------------------------------
Description:
Keep an SSL context and its certificate metadata from the same key-store read.
Applications explicitly replace the accepted material and obtain its new
context from the factory. IGNITE-29210 uses the accepted snapshot for reload
validation and status; IGNITE-29211 uses its certificate expiry dates for
renewal.
h3. Result and acceptance
* {{init()}} prepares a fresh bundle, verifies that its context can create an
engine, then publishes context and metadata together. A failed attempt retains
the previous bundle; a failed first attempt can be retried.
* {{create()}} initializes once, including concurrent first calls, and returns
the currently accepted context. {{sslBundle()}} returns the accepted snapshot.
Repeated reads do not reload stores; serialization keeps configuration rather
than runtime contexts.
* After successful {{init()}}, call {{create()}} or {{sslBundle()}} again to
obtain the replacement. Previously obtained contexts, engines, socket factories
and sockets retain their material. Reusing an initialized factory across node
restarts retains its material until {{init()}}.
* Metadata contains immutable, nonempty X.509 chains of key entries. Unknown
metadata and an empty set of chains remain distinct. Metadata describes loaded
material, not the certificate selected for a connection.
* Communication reconnects reuse the retained context, including with a plain
{{Factory<SSLContext>}}.
h3. Compatibility
Affected subclasses must be updated and recompiled: {{create()}} becomes final;
{{loadKeyMaterial()}} replaces {{createKeyManagers()}}, and the protected
{{sslCtx}} field is removed. Custom contexts override the protected
{{createSslBundle()}} loading hook; invoking it alone does not publish a
replacement. See the [factory
contracts|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java#L114]
and [migration
reference|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
A plain {{Factory<SSLContext>}} remains supported. Empty loaded stores support
clients without private keys. Loaded stores must remain unchanged while their
contexts are in use; see [KeyMaterial ownership and metadata
rules|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/KeyMaterial.java#L38].
Unsupported TLS names fail first initialization; certificate-date and
empty-chain replacement policies belong to IGNITE-29210.
h3. Delivery and validation
[PR #13751|https://github.com/apache/ignite/pull/13751] is the standalone API
change; IGNITE-29208's peer-address fix is already merged. All 16 API tests
passed with Checkstyle at {{25894249}}. Current head {{1b17a46f}} adds only the
loading-hook Javadoc correction; Java code is unchanged, and Javadoc/doclint
passed. They cover atomic snapshot replacement, reads during loading, prepared
key managers and filtering across the full certificate chain. Both standalone
startup-regression tests also passed with Checkstyle at {{1b17a46f}}. These are
local targeted checks, not full CI.
was:
Keep an SSL context and its certificate metadata from the same key-store read.
Applications can explicitly replace that material without changing their
context reference. IGNITE-29210 uses the accepted snapshot for reload
validation and status; IGNITE-29211 uses its certificate expiry dates for
renewal.
h3. Result and acceptance
* {{init()}} prepares a fresh bundle, verifies that its context can create an
engine, then publishes context and metadata together. A failed attempt retains
the previous bundle; a failed first attempt can be retried.
* {{create()}} initializes once, including concurrent first calls, and returns
one forwarding context. {{sslBundle()}} returns the accepted snapshot. Repeated
reads do not reload stores; serialization keeps configuration rather than
runtime contexts.
* New engines and newly obtained socket factories use the replacement.
Previously obtained engines, socket factories and sockets retain their
material. Reusing an initialized factory across node restarts retains its
material until {{init()}}.
* Metadata contains immutable, nonempty X.509 chains of key entries. Unknown
metadata and an empty set of chains remain distinct. Metadata describes loaded
material, not the certificate selected for a connection.
* Communication reconnects reuse the retained context, including with a plain
{{Factory<SSLContext>}}.
h3. Compatibility
Affected subclasses must be updated and recompiled: {{create()}} becomes final;
{{loadKeyMaterial()}} replaces {{createKeyManagers()}}, and the protected
{{sslCtx}} field is removed. Custom contexts use {{createSslBundle()}};
invoking that loading hook alone does not publish a replacement. See the
[factory
contracts|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java#L116]
and [migration
reference|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
A plain {{Factory<SSLContext>}} remains supported. Empty loaded stores support
clients without private keys. Loaded stores must remain unchanged while their
contexts are in use; see [KeyMaterial ownership and metadata
rules|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/KeyMaterial.java#L38].
Unsupported TLS names fail first initialization; certificate-date and
empty-chain replacement policies belong to IGNITE-29210.
h3. Delivery and validation
[PR #13751|https://github.com/apache/ignite/pull/13751] is the standalone API
change; IGNITE-29208's peer-address fix is already merged. At {{f6b57b36}}, the
two startup-regression tests passed, then all 16 API tests passed after scope
cleanup. Both reactor runs included Checkstyle; Javadoc/doclint passed. These
are local targeted checks, not full CI.
> Add SSL bundle metadata and explicit factory initialization
> -----------------------------------------------------------
>
> Key: IGNITE-29209
> URL: https://issues.apache.org/jira/browse/IGNITE-29209
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 3h 40m
> Remaining Estimate: 0h
>
> Keep an SSL context and its certificate metadata from the same key-store
> read. Applications explicitly replace the accepted material and obtain its
> new context from the factory. IGNITE-29210 uses the accepted snapshot for
> reload validation and status; IGNITE-29211 uses its certificate expiry dates
> for renewal.
> h3. Result and acceptance
> * {{init()}} prepares a fresh bundle, verifies that its context can create an
> engine, then publishes context and metadata together. A failed attempt
> retains the previous bundle; a failed first attempt can be retried.
> * {{create()}} initializes once, including concurrent first calls, and
> returns the currently accepted context. {{sslBundle()}} returns the accepted
> snapshot. Repeated reads do not reload stores; serialization keeps
> configuration rather than runtime contexts.
> * After successful {{init()}}, call {{create()}} or {{sslBundle()}} again to
> obtain the replacement. Previously obtained contexts, engines, socket
> factories and sockets retain their material. Reusing an initialized factory
> across node restarts retains its material until {{init()}}.
> * Metadata contains immutable, nonempty X.509 chains of key entries. Unknown
> metadata and an empty set of chains remain distinct. Metadata describes
> loaded material, not the certificate selected for a connection.
> * Communication reconnects reuse the retained context, including with a plain
> {{Factory<SSLContext>}}.
> h3. Compatibility
> Affected subclasses must be updated and recompiled: {{create()}} becomes
> final; {{loadKeyMaterial()}} replaces {{createKeyManagers()}}, and the
> protected {{sslCtx}} field is removed. Custom contexts override the protected
> {{createSslBundle()}} loading hook; invoking it alone does not publish a
> replacement. See the [factory
> contracts|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java#L114]
> and [migration
> reference|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
> A plain {{Factory<SSLContext>}} remains supported. Empty loaded stores
> support clients without private keys. Loaded stores must remain unchanged
> while their contexts are in use; see [KeyMaterial ownership and metadata
> rules|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/KeyMaterial.java#L38].
> Unsupported TLS names fail first initialization; certificate-date and
> empty-chain replacement policies belong to IGNITE-29210.
> h3. Delivery and validation
> [PR #13751|https://github.com/apache/ignite/pull/13751] is the standalone API
> change; IGNITE-29208's peer-address fix is already merged. All 16 API tests
> passed with Checkstyle at {{25894249}}. Current head {{1b17a46f}} adds only
> the loading-hook Javadoc correction; Java code is unchanged, and
> Javadoc/doclint passed. They cover atomic snapshot replacement, reads during
> loading, prepared key managers and filtering across the full certificate
> chain. Both standalone startup-regression tests also passed with Checkstyle
> at {{1b17a46f}}. These are local targeted checks, not full CI.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
