You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by xy...@apache.org on 2018/11/22 01:17:39 UTC
[36/50] [abbrv] hadoop git commit: HDDS-778. Add an interface for CA
and Clients for Certificate operations Contributed by Anu Engineer.
HDDS-778. Add an interface for CA and Clients for Certificate operations
Contributed by Anu Engineer.
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo
Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/1e52b9d4
Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/1e52b9d4
Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/1e52b9d4
Branch: refs/heads/HDDS-4
Commit: 1e52b9d4072eeab0caa4ed4b6f3f29cd8f1266f6
Parents: 2f32bcf
Author: Anu Engineer <ae...@apache.org>
Authored: Thu Nov 8 09:54:27 2018 -0800
Committer: Xiaoyu Yao <xy...@apache.org>
Committed: Wed Nov 21 12:13:04 2018 -0800
----------------------------------------------------------------------
.../authority/CertificateServer.java | 99 ++++++++++++
.../certificate/authority/package-info.java | 22 +++
.../certificate/client/CertificateClient.java | 159 +++++++++++++++++++
.../x509/certificate/client/package-info.java | 22 +++
4 files changed, 302 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hadoop/blob/1e52b9d4/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/CertificateServer.java
----------------------------------------------------------------------
diff --git a/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/CertificateServer.java b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/CertificateServer.java
new file mode 100644
index 0000000..9332e5b
--- /dev/null
+++ b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/CertificateServer.java
@@ -0,0 +1,99 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.apache.hadoop.hdds.security.x509.certificate.authority;
+
+import org.apache.hadoop.hdds.security.x509.certificates.CertificateSignRequest;
+import org.apache.hadoop.hdds.security.x509.exceptions.SCMSecurityException;
+import org.apache.hadoop.hdds.security.x509.SecurityConfig;
+import org.bouncycastle.cert.X509CertificateHolder;
+
+import java.security.cert.X509Certificate;
+import java.util.concurrent.Future;
+
+/**
+ * Interface for Certificate Authority. This can be extended to talk to external
+ * CAs later or HSMs later.
+ */
+public interface CertificateServer {
+ /**
+ * Initialize the Certificate Authority.
+ *
+ * @param securityConfig - Security Configuration.
+ * @param type - The Type of CertificateServer we are creating, we make this
+ * explicit so that when we read code it is visible to the users.
+ * @throws SCMSecurityException - Throws if the init fails.
+ */
+ void init(SecurityConfig securityConfig, CAType type)
+ throws SCMSecurityException;
+
+ /**
+ * Returns the CA Certificate for this CA.
+ *
+ * @return X509CertificateHolder - Certificate for this CA.
+ * @throws SCMSecurityException -- usually thrown if this CA is not
+ * initialized.
+ */
+ X509CertificateHolder getCACertificate()
+ throws SCMSecurityException;
+
+ /**
+ * Request a Certificate based on Certificate Signing Request.
+ *
+ * @param csr - Certificate Signing Request.
+ * @return A future that will have this certificate when this request is
+ * approved.
+ * @throws SCMSecurityException - on Error.
+ */
+ Future<X509CertificateHolder> requestCertificate(CertificateSignRequest csr,
+ CertificateApprover approver) throws SCMSecurityException;
+
+ /**
+ * Revokes a Certificate issued by this CertificateServer.
+ *
+ * @param certificate - Certificate to revoke
+ * @param approver - Approval process to follow.
+ * @return Future that tells us what happened.
+ * @throws SCMSecurityException - on Error.
+ */
+ Future<Boolean> revokeCertificate(X509Certificate certificate,
+ CertificateApprover approver) throws SCMSecurityException;
+
+ /**
+ * TODO : CRL, OCSP etc. Later. This is the start of a CertificateServer
+ * framework.
+ */
+
+ /**
+ * Approval Types for a certificate request.
+ */
+ enum CertificateApprover {
+ KERBEROS_TRUSTED, /* The Request came from a DN using Kerberos Identity*/
+ MANUAL, /* Wait for a Human being to approve this certificate */
+ TESTING_AUTOMATIC /* For testing purpose, Automatic Approval. */
+ }
+
+ /**
+ * Make it explicit what type of CertificateServer we are creating here.
+ */
+ enum CAType {
+ SELF_SIGNED_CA,
+ INTERMEDIARY_CA
+ }
+}
http://git-wip-us.apache.org/repos/asf/hadoop/blob/1e52b9d4/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/package-info.java
----------------------------------------------------------------------
diff --git a/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/package-info.java b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/package-info.java
new file mode 100644
index 0000000..af53904
--- /dev/null
+++ b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/package-info.java
@@ -0,0 +1,22 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+/**
+ * Classes related to Certificate Life Cycle or Certificate Authority Server.
+ */
+package org.apache.hadoop.hdds.security.x509.certificate.authority;
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/hadoop/blob/1e52b9d4/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java
----------------------------------------------------------------------
diff --git a/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java
new file mode 100644
index 0000000..1b6f576
--- /dev/null
+++ b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java
@@ -0,0 +1,159 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.apache.hadoop.hdds.security.x509.certificate.client;
+
+import org.apache.hadoop.hdds.security.x509.certificates.CertificateSignRequest;
+import org.apache.hadoop.hdds.security.x509.exceptions.CertificateException;
+
+import java.io.InputStream;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.cert.CertStore;
+import java.security.cert.X509Certificate;
+import java.util.List;
+
+/**
+ * Certificate client provides and interface to certificate operations that
+ * needs to be performed by all clients in the Ozone eco-system.
+ */
+public interface CertificateClient {
+
+ /**
+ * Returns the private key of the specified component if it exists on the
+ * local system.
+ *
+ * @param component - String name like DN, OM, SCM etc.
+ * @return private key or Null if there is no data.
+ */
+ PrivateKey getPrivateKey(String component);
+
+ /**
+ * Returns the public key of the specified component if it exists on the local
+ * system.
+ *
+ * @param component - String name like DN, OM, SCM etc.
+ * @return public key or Null if there is no data.
+ */
+ PublicKey getPublicKey(String component);
+
+ /**
+ * Returns the certificate of the specified component if it exists on the
+ * local system.
+ *
+ * @param component - String name like DN, OM, SCM etc.
+ * @return certificate or Null if there is no data.
+ */
+ X509Certificate getCertificate(String component);
+
+ /**
+ * Verifies if this certificate is part of a trusted chain.
+ *
+ * @return true if it trusted, false otherwise.
+ */
+ boolean verifyCertificate(X509Certificate certificate);
+
+ /**
+ * Creates digital signature over the data stream using the components private
+ * key.
+ *
+ * @param stream - Data stream to sign.
+ * @return byte array - containing the signature.
+ */
+ byte[] signDataStream(InputStream stream, String component)
+ throws CertificateException;
+
+ /**
+ * Verifies a digital Signature, given the signature and the certificate of
+ * the signer.
+ * @param stream - Data Stream.
+ * @param signature - Byte Array containing the signature.
+ * @param cert - Certificate of the Signer.
+ * @return true if verified, false if not.
+ */
+ boolean verifySignature(InputStream stream, byte[] signature,
+ X509Certificate cert);
+
+ /**
+ * Returns a CSR builder that can be used to creates a Certificate sigining
+ * request.
+ *
+ * @return CertificateSignRequest.Builder
+ */
+ CertificateSignRequest.Builder getCSRBuilder();
+
+ /**
+ * Get the certificate of well-known entity from SCM.
+ *
+ * @param query - String Query, please see the implementation for the
+ * discussion on the query formats.
+ * @return X509Certificate or null if not found.
+ */
+ X509Certificate queryCertificate(String query);
+
+ /**
+ * Stores the private key of a specified component.
+ *
+ * @param key - private key
+ * @param component - name of the component.
+ * @throws CertificateException
+ */
+ void storePrivateKey(PrivateKey key, String component)
+ throws CertificateException;
+
+ /**
+ * Stores the public key of a specified component.
+ *
+ * @param key - public key
+ * @throws CertificateException
+ */
+ void storePublicKey(PublicKey key, String component)
+ throws CertificateException;
+
+ /**
+ * Stores the Certificate of a specific component.
+ *
+ * @param certificate - X509 Certificate
+ * @param component - Name of the component.
+ * @throws CertificateException
+ */
+ void storeCertificate(X509Certificate certificate, String component)
+ throws CertificateException;
+
+ /**
+ * Stores the trusted chain of certificates for a specific component.
+ *
+ * @param certStore - Cert Store.
+ * @param component - Trust Chain.
+ * @throws CertificateException
+ */
+ void storeTrustChain(CertStore certStore,
+ String component) throws CertificateException;
+
+ /**
+ * Stores the trusted chain of certificates for a specific component.
+ *
+ * @param certificates - List of Certificates.
+ * @param component - String component.
+ * @throws CertificateException
+ */
+ void storeTrustChain(List<X509Certificate> certificates,
+ String component) throws CertificateException;
+
+}
http://git-wip-us.apache.org/repos/asf/hadoop/blob/1e52b9d4/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/package-info.java
----------------------------------------------------------------------
diff --git a/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/package-info.java b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/package-info.java
new file mode 100644
index 0000000..dea609b
--- /dev/null
+++ b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/package-info.java
@@ -0,0 +1,22 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+/**
+ * Classes related to creating and using certificates.
+ */
+package org.apache.hadoop.hdds.security.x509.certificate.client;
\ No newline at end of file
---------------------------------------------------------------------
To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-commits-help@hadoop.apache.org