Skip to content

Conversation

@bharatviswa504
Copy link
Contributor

What changes were proposed in this pull request?

This PR implements

  1. Create SCM CertClient, which generates a public key, private key, and generates CSR with ClusterID, SCMID.
  2. Modify DefaultCA Server to work in 2 modes, SELF_SIGNED_CA and INTERMEDIARY_CA.
  3. Modify SCMStorageConfig to persist SCM cert serial ID.

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-4897

How was this patch tested?

Added tests

@bharatviswa504 bharatviswa504 changed the title HDDS-4897. Create SCM Cert Client and change DefaultCA to allow selfsigned and intermediary HDDS-4897. [SCM HA Security] Create SCM Cert Client and change DefaultCA to allow selfsigned and intermediary Mar 15, 2021
Copy link
Contributor

@xiaoyuyao xiaoyuyao left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @bharatviswa504 for working on this and the offline discussions. The PR LGTM overall, a few comments added inline.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems to overlap with most of the existing DefaultCAServer#generateSelfSignedCA, can we dedup the code?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see it is completely different. As DefaultCAServer uses its own SelfSignedCertificate builder and persist, whereas this new method uses generate CSR and persist.

Where as taken care of dedup between getRootCASignedSCMCert and this method.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add some comments to highlight this is only used for Sub-CA?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we keep the root ca subject scm@host to be backward compatible?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sub scm can have scm-sub@host

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this sub scm cert should have subject like scm-sub@host.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we start with the DefaultCAProfile?

Copy link
Contributor Author

@bharatviswa504 bharatviswa504 Mar 19, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When this PR code is integrated, when 2 CA Servers are started will change this. It will come in next in PR. As to make current code work, used DefaultProfile

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we combine the exception handling if the logic are the same?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we check the result from RPC response before attempting further operations?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Already ClientSideTranslator has performed this. So, check if it has a certificate should be enough.

  private SCMSecurityResponse handleError(SCMSecurityResponse resp)
      throws SCMSecurityException {
    if (resp.getStatus() != SCMSecurityProtocolProtos.Status.OK) {
      throw new SCMSecurityException(resp.getMessage(),
          SCMSecurityException.ErrorCode.values()[resp.getStatus().ordinal()]);
    }
    return resp;
  }

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you elaborate the logic behind this? Are we assume only the root CA start with the DefaultCAProfile?

Copy link
Contributor Author

@bharatviswa504 bharatviswa504 Mar 19, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My idea here is DefaultCAProfile when used by CA Server it will issue only CA Certificate.
And RootCA Server right now starts with DefaultCAProfile on fresh installed clusters, where as on upgraded cluster from non-HA rootCAServer will be started like before with DefaultProfile. The integration of DefaultCAServer and starting 2 CA will be taken care in further Jiras.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bq. My idea here is DefaultCAProfile when used by CA Server it will issue only CA Certificate.
Should we rename to RootCAProfile in this case?

Also, when Primary starts two DefaultCA server in the follow up JIRA, one with RootCAProfile and one without?

Copy link
Contributor Author

@bharatviswa504 bharatviswa504 Mar 23, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, when Primary starts two DefaultCA server in the follow up JIRA, one with RootCAProfile and one without?
Yes.

@bharatviswa504
Copy link
Contributor Author

Thank You @xiaoyuyao for the review. I have addressed/replied to the review comments.

Copy link
Contributor

@xiaoyuyao xiaoyuyao left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @bharatviswa504 for the update. Just few questions inline. Otherwise, LGTM.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bq. My idea here is DefaultCAProfile when used by CA Server it will issue only CA Certificate.
Should we rename to RootCAProfile in this case?

Also, when Primary starts two DefaultCA server in the follow up JIRA, one with RootCAProfile and one without?

@bharatviswa504 bharatviswa504 merged commit cdc170d into apache:HDDS-2823 Mar 23, 2021
@bharatviswa504
Copy link
Contributor Author

Thank You @xiaoyuyao for the review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants