[
https://issues.apache.org/jira/browse/IGNITE-29209?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29209:
--------------------------------------
Description:
Keep an SSL context and its certificate metadata from the same key-store read.
Applications explicitly replace the accepted material and obtain its new
context from the factory. IGNITE-29210 uses the accepted snapshot for reload
validation and status; IGNITE-29211 uses its certificate expiry dates for
renewal.
h3. Result and acceptance
* {{init()}} prepares a fresh bundle, verifies that its context can create an
engine, then publishes context and metadata together. A failed attempt retains
the previous bundle; a failed first attempt can be retried.
* {{create()}} initializes once, including concurrent first calls, and returns
the currently accepted context. {{sslBundle()}} returns the accepted snapshot.
Repeated reads do not reload stores; serialization keeps configuration rather
than runtime contexts.
* After successful {{init()}}, call {{create()}} or {{sslBundle()}} again to
obtain the replacement. Previously obtained contexts, engines, socket factories
and sockets retain their material. Reusing an initialized factory across node
restarts retains its material until {{init()}}.
* Metadata contains immutable, nonempty X.509 chains of key entries. Unknown
metadata and an empty set of chains remain distinct. Metadata describes loaded
material, not the certificate selected for a connection.
h3. Compatibility
Affected subclasses must be updated and recompiled: {{create()}} becomes final;
the protected {{sslCtx}} field and {{createKeyManagers()}} hook are removed.
Implement the protected {{createSslBundle()}} loading hook, which may throw
{{SSLException}}. A store-backed implementation loads the store once and passes
it, its key password and algorithm to {{createSslBundle(store, keyPassword,
algorithm)}}. Invoking a loading hook alone does not publish a replacement. See
the [factory
contracts|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java#L127]
and [migration
reference|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
A plain {{Factory<SSLContext>}} remains supported. Empty loaded stores support
clients without private keys. Loaded stores must remain unchanged while their
contexts are in use; see [store ownership and metadata
rules|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java#L137].
Unsupported TLS names fail first initialization; certificate-date and
empty-chain replacement policies belong to IGNITE-29210.
h3. Delivery and validation
[PR #13751|https://github.com/apache/ignite/pull/13751] is the standalone API
change; IGNITE-29208's peer-address fix is already merged.
Local validation of {{06489a85}}: all 18 selected API, wrapper and startup
cases passed. Checkstyle and Javadoc/doclint passed; the CLI test sources using
the checked loading hook compiled. These are targeted local checks, not full CI.
was:
Keep an SSL context and its certificate metadata from the same key-store read.
Applications explicitly replace the accepted material and obtain its new
context from the factory. IGNITE-29210 uses the accepted snapshot for reload
validation and status; IGNITE-29211 uses its certificate expiry dates for
renewal.
h3. Result and acceptance
* {{init()}} prepares a fresh bundle, verifies that its context can create an
engine, then publishes context and metadata together. A failed attempt retains
the previous bundle; a failed first attempt can be retried.
* {{create()}} initializes once, including concurrent first calls, and returns
the currently accepted context. {{sslBundle()}} returns the accepted snapshot.
Repeated reads do not reload stores; serialization keeps configuration rather
than runtime contexts.
* After successful {{init()}}, call {{create()}} or {{sslBundle()}} again to
obtain the replacement. Previously obtained contexts, engines, socket factories
and sockets retain their material. Reusing an initialized factory across node
restarts retains its material until {{init()}}.
* Metadata contains immutable, nonempty X.509 chains of key entries. Unknown
metadata and an empty set of chains remain distinct. Metadata describes loaded
material, not the certificate selected for a connection.
* Communication reconnects reuse the retained context, including with a plain
{{Factory<SSLContext>}}.
h3. Compatibility
Affected subclasses must be updated and recompiled: {{create()}} becomes final;
{{loadKeyMaterial()}} replaces {{createKeyManagers()}}, and the protected
{{sslCtx}} field is removed. Custom contexts override the protected
{{createSslBundle()}} loading hook; invoking it alone does not publish a
replacement. See the [factory
contracts|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java#L114]
and [migration
reference|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
A plain {{Factory<SSLContext>}} remains supported. Empty loaded stores support
clients without private keys. Loaded stores must remain unchanged while their
contexts are in use; see [KeyMaterial ownership and metadata
rules|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/KeyMaterial.java#L38].
Unsupported TLS names fail first initialization; certificate-date and
empty-chain replacement policies belong to IGNITE-29210.
h3. Delivery and validation
[PR #13751|https://github.com/apache/ignite/pull/13751] is the standalone API
change; IGNITE-29208's peer-address fix is already merged. All 16 API tests
passed with Checkstyle at {{25894249}}. Current head {{1b17a46f}} adds only the
loading-hook Javadoc correction; Java code is unchanged, and Javadoc/doclint
passed. They cover atomic snapshot replacement, reads during loading, prepared
key managers and filtering across the full certificate chain. Both standalone
startup-regression tests also passed with Checkstyle at {{1b17a46f}}. These are
local targeted checks, not full CI.
> Add SSL bundle metadata and explicit factory initialization
> -----------------------------------------------------------
>
> Key: IGNITE-29209
> URL: https://issues.apache.org/jira/browse/IGNITE-29209
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 3h 40m
> Remaining Estimate: 0h
>
> Keep an SSL context and its certificate metadata from the same key-store
> read. Applications explicitly replace the accepted material and obtain its
> new context from the factory. IGNITE-29210 uses the accepted snapshot for
> reload validation and status; IGNITE-29211 uses its certificate expiry dates
> for renewal.
> h3. Result and acceptance
> * {{init()}} prepares a fresh bundle, verifies that its context can create an
> engine, then publishes context and metadata together. A failed attempt
> retains the previous bundle; a failed first attempt can be retried.
> * {{create()}} initializes once, including concurrent first calls, and
> returns the currently accepted context. {{sslBundle()}} returns the accepted
> snapshot. Repeated reads do not reload stores; serialization keeps
> configuration rather than runtime contexts.
> * After successful {{init()}}, call {{create()}} or {{sslBundle()}} again to
> obtain the replacement. Previously obtained contexts, engines, socket
> factories and sockets retain their material. Reusing an initialized factory
> across node restarts retains its material until {{init()}}.
> * Metadata contains immutable, nonempty X.509 chains of key entries. Unknown
> metadata and an empty set of chains remain distinct. Metadata describes
> loaded material, not the certificate selected for a connection.
> h3. Compatibility
> Affected subclasses must be updated and recompiled: {{create()}} becomes
> final; the protected {{sslCtx}} field and {{createKeyManagers()}} hook are
> removed. Implement the protected {{createSslBundle()}} loading hook, which
> may throw {{SSLException}}. A store-backed implementation loads the store
> once and passes it, its key password and algorithm to
> {{createSslBundle(store, keyPassword, algorithm)}}. Invoking a loading hook
> alone does not publish a replacement. See the [factory
> contracts|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java#L127]
> and [migration
> reference|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
> A plain {{Factory<SSLContext>}} remains supported. Empty loaded stores
> support clients without private keys. Loaded stores must remain unchanged
> while their contexts are in use; see [store ownership and metadata
> rules|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java#L137].
> Unsupported TLS names fail first initialization; certificate-date and
> empty-chain replacement policies belong to IGNITE-29210.
> h3. Delivery and validation
> [PR #13751|https://github.com/apache/ignite/pull/13751] is the standalone API
> change; IGNITE-29208's peer-address fix is already merged.
> Local validation of {{06489a85}}: all 18 selected API, wrapper and startup
> cases passed. Checkstyle and Javadoc/doclint passed; the CLI test sources
> using the checked loading hook compiled. These are targeted local checks, not
> full CI.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
