HDDS-778. Add an interface for CA and Clients for Certificate operations Contributed by Anu Engineer.
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/4770e9de Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/4770e9de Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/4770e9de Branch: refs/heads/HDDS-4 Commit: 4770e9dea8199753962c6517bff96fd39fbfd826 Parents: 8bbc95e Author: Anu Engineer <aengin...@apache.org> Authored: Thu Nov 8 09:54:27 2018 -0800 Committer: Xiaoyu Yao <x...@apache.org> Committed: Thu Nov 29 11:57:47 2018 -0800 ---------------------------------------------------------------------- .../authority/CertificateServer.java | 99 ++++++++++++ .../certificate/authority/package-info.java | 22 +++ .../certificate/client/CertificateClient.java | 159 +++++++++++++++++++ .../x509/certificate/client/package-info.java | 22 +++ 4 files changed, 302 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/hadoop/blob/4770e9de/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/CertificateServer.java ---------------------------------------------------------------------- diff --git a/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/CertificateServer.java b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/CertificateServer.java new file mode 100644 index 0000000..9332e5b --- /dev/null +++ b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/CertificateServer.java @@ -0,0 +1,99 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ + +package org.apache.hadoop.hdds.security.x509.certificate.authority; + +import org.apache.hadoop.hdds.security.x509.certificates.CertificateSignRequest; +import org.apache.hadoop.hdds.security.x509.exceptions.SCMSecurityException; +import org.apache.hadoop.hdds.security.x509.SecurityConfig; +import org.bouncycastle.cert.X509CertificateHolder; + +import java.security.cert.X509Certificate; +import java.util.concurrent.Future; + +/** + * Interface for Certificate Authority. This can be extended to talk to external + * CAs later or HSMs later. + */ +public interface CertificateServer { + /** + * Initialize the Certificate Authority. + * + * @param securityConfig - Security Configuration. + * @param type - The Type of CertificateServer we are creating, we make this + * explicit so that when we read code it is visible to the users. + * @throws SCMSecurityException - Throws if the init fails. + */ + void init(SecurityConfig securityConfig, CAType type) + throws SCMSecurityException; + + /** + * Returns the CA Certificate for this CA. + * + * @return X509CertificateHolder - Certificate for this CA. + * @throws SCMSecurityException -- usually thrown if this CA is not + * initialized. + */ + X509CertificateHolder getCACertificate() + throws SCMSecurityException; + + /** + * Request a Certificate based on Certificate Signing Request. + * + * @param csr - Certificate Signing Request. + * @return A future that will have this certificate when this request is + * approved. + * @throws SCMSecurityException - on Error. + */ + Future<X509CertificateHolder> requestCertificate(CertificateSignRequest csr, + CertificateApprover approver) throws SCMSecurityException; + + /** + * Revokes a Certificate issued by this CertificateServer. + * + * @param certificate - Certificate to revoke + * @param approver - Approval process to follow. + * @return Future that tells us what happened. + * @throws SCMSecurityException - on Error. + */ + Future<Boolean> revokeCertificate(X509Certificate certificate, + CertificateApprover approver) throws SCMSecurityException; + + /** + * TODO : CRL, OCSP etc. Later. This is the start of a CertificateServer + * framework. + */ + + /** + * Approval Types for a certificate request. + */ + enum CertificateApprover { + KERBEROS_TRUSTED, /* The Request came from a DN using Kerberos Identity*/ + MANUAL, /* Wait for a Human being to approve this certificate */ + TESTING_AUTOMATIC /* For testing purpose, Automatic Approval. */ + } + + /** + * Make it explicit what type of CertificateServer we are creating here. + */ + enum CAType { + SELF_SIGNED_CA, + INTERMEDIARY_CA + } +} http://git-wip-us.apache.org/repos/asf/hadoop/blob/4770e9de/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/package-info.java ---------------------------------------------------------------------- diff --git a/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/package-info.java b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/package-info.java new file mode 100644 index 0000000..af53904 --- /dev/null +++ b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/package-info.java @@ -0,0 +1,22 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +/** + * Classes related to Certificate Life Cycle or Certificate Authority Server. + */ +package org.apache.hadoop.hdds.security.x509.certificate.authority; \ No newline at end of file http://git-wip-us.apache.org/repos/asf/hadoop/blob/4770e9de/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java ---------------------------------------------------------------------- diff --git a/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java new file mode 100644 index 0000000..1b6f576 --- /dev/null +++ b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/CertificateClient.java @@ -0,0 +1,159 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ + +package org.apache.hadoop.hdds.security.x509.certificate.client; + +import org.apache.hadoop.hdds.security.x509.certificates.CertificateSignRequest; +import org.apache.hadoop.hdds.security.x509.exceptions.CertificateException; + +import java.io.InputStream; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.security.cert.CertStore; +import java.security.cert.X509Certificate; +import java.util.List; + +/** + * Certificate client provides and interface to certificate operations that + * needs to be performed by all clients in the Ozone eco-system. + */ +public interface CertificateClient { + + /** + * Returns the private key of the specified component if it exists on the + * local system. + * + * @param component - String name like DN, OM, SCM etc. + * @return private key or Null if there is no data. + */ + PrivateKey getPrivateKey(String component); + + /** + * Returns the public key of the specified component if it exists on the local + * system. + * + * @param component - String name like DN, OM, SCM etc. + * @return public key or Null if there is no data. + */ + PublicKey getPublicKey(String component); + + /** + * Returns the certificate of the specified component if it exists on the + * local system. + * + * @param component - String name like DN, OM, SCM etc. + * @return certificate or Null if there is no data. + */ + X509Certificate getCertificate(String component); + + /** + * Verifies if this certificate is part of a trusted chain. + * + * @return true if it trusted, false otherwise. + */ + boolean verifyCertificate(X509Certificate certificate); + + /** + * Creates digital signature over the data stream using the components private + * key. + * + * @param stream - Data stream to sign. + * @return byte array - containing the signature. + */ + byte[] signDataStream(InputStream stream, String component) + throws CertificateException; + + /** + * Verifies a digital Signature, given the signature and the certificate of + * the signer. + * @param stream - Data Stream. + * @param signature - Byte Array containing the signature. + * @param cert - Certificate of the Signer. + * @return true if verified, false if not. + */ + boolean verifySignature(InputStream stream, byte[] signature, + X509Certificate cert); + + /** + * Returns a CSR builder that can be used to creates a Certificate sigining + * request. + * + * @return CertificateSignRequest.Builder + */ + CertificateSignRequest.Builder getCSRBuilder(); + + /** + * Get the certificate of well-known entity from SCM. + * + * @param query - String Query, please see the implementation for the + * discussion on the query formats. + * @return X509Certificate or null if not found. + */ + X509Certificate queryCertificate(String query); + + /** + * Stores the private key of a specified component. + * + * @param key - private key + * @param component - name of the component. + * @throws CertificateException + */ + void storePrivateKey(PrivateKey key, String component) + throws CertificateException; + + /** + * Stores the public key of a specified component. + * + * @param key - public key + * @throws CertificateException + */ + void storePublicKey(PublicKey key, String component) + throws CertificateException; + + /** + * Stores the Certificate of a specific component. + * + * @param certificate - X509 Certificate + * @param component - Name of the component. + * @throws CertificateException + */ + void storeCertificate(X509Certificate certificate, String component) + throws CertificateException; + + /** + * Stores the trusted chain of certificates for a specific component. + * + * @param certStore - Cert Store. + * @param component - Trust Chain. + * @throws CertificateException + */ + void storeTrustChain(CertStore certStore, + String component) throws CertificateException; + + /** + * Stores the trusted chain of certificates for a specific component. + * + * @param certificates - List of Certificates. + * @param component - String component. + * @throws CertificateException + */ + void storeTrustChain(List<X509Certificate> certificates, + String component) throws CertificateException; + +} http://git-wip-us.apache.org/repos/asf/hadoop/blob/4770e9de/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/package-info.java ---------------------------------------------------------------------- diff --git a/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/package-info.java b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/package-info.java new file mode 100644 index 0000000..dea609b --- /dev/null +++ b/hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/client/package-info.java @@ -0,0 +1,22 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +/** + * Classes related to creating and using certificates. + */ +package org.apache.hadoop.hdds.security.x509.certificate.client; \ No newline at end of file --------------------------------------------------------------------- To unsubscribe, e-mail: common-commits-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-commits-h...@hadoop.apache.org
