smengcl opened a new pull request, #11486: URL: https://github.com/apache/ozone/pull/11486
Generated-by: Claude Code (Opus 5.5 and Fable 5.1) ## What changes were proposed in this pull request? `SCMSecurityProtocolServer.getEncodedCertToString` signs a CSR for the node type the request names. For the SCM role the result is an SCM sub CA certificate, and neither RPC that can name that role (`getSCMCertificate`, and `getCertificate` with node type SCM) applies the SCM admin check that `SCMBlockProtocolServer.addSCM` applies. Separately, a `DefaultCAServer` built with `DefaultCAProfile` copies a basic constraints extension from the CSR for every role, and `requestCertificate` goes on to sign a CSR after `DefaultApprover.inspectCSR` rejected it. This PR: * calls `checkAdminAccess` with the RPC remote user in `getEncodedCertToString` when the role is SCM, so both RPCs are covered in one place * rejects a CSR that carries the basic constraints extension for any role other than SCM in `DefaultCAServer.requestCertificate` * returns without signing when the approver rejects the CSR There is no wire, protocol or configuration change. An SCM requests its certificate under its own login user, which is in the SCM admin set that `addSCM` already requires, and only `SCMCertificateClient` sets the basic constraints extension, so no legitimate request is expected to be rejected (code reading, see the testing section). ## What is the link to the Apache JIRA https://issues.apache.org/jira/browse/HDDS-16936 ## How was this patch tested? * New `TestDefaultCAServer.testBasicConstraintsAllowedForScmRoleOnly` and a new check inside `TestSecureOzoneCluster.testSecureScmAndOmStartupAndAccessControl`. Both fail without the change. * `TestDefaultCAServer`, `TestDefaultProfile` and `TestRootCARotationManager` pass on this branch (master at 084c60d4fb9). * On commit b9b33851b20 with the change: the SCM part of the `TestSecureOzoneCluster` method passes, and checkstyle is clean on the three touched modules. * Not run locally: a secure multi SCM bootstrap and a certificate renewal with the check in place, and the OM part of the `TestSecureOzoneCluster` method, which times out on the test machine with and without the change. Opened as a draft so that CI covers these first. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
