[
https://issues.apache.org/jira/browse/HDDS-16970?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng reassigned HDDS-16970:
---------------------------------
Component/s: Certificates
Epic Link: HDDS-15763
Assignee: Siyao Meng
Description:
{{HddsServerUtil.getValidInetsForCurrentHost}} skips every IPv6 address of the
host. {{NetworkInterface.getInetAddresses()}} returns IPv6 addresses with the
interface as scope, also for global and unique local addresses (for example
{{fd00:172:25:0:0:0:0:102%eth0}}), and {{isScopedOrMaskingIPv6Address}} rejects
any address whose text contains a percent sign.
{noformat}
INFO utils.HddsServerUtil: ip:fd00:172:25:0:0:0:0:102%eth0 not returned.
{noformat}
On an IPv6-only host the certificate has DNS names only. Connections that
verify the peer by IP address fail:
{noformat}
CertificateException: No subject alternative names matching IP address
fd00:172:25:0:0:0:0:104 found for SNIHostName=null and
peerHost=[fd00:172:25:0:0:0:0:104] in the chain of 3 certificate(s): 1.
subjectAlternativeNames=[DNS:b945fe54756e], CN=dn@b945fe54756e. 2.
subjectAlternativeNames=[DNS:scm1.org], [email protected]. 3.
subjectAlternativeNames=[DNS:scm1.org], [email protected].
{noformat}
* Datanode Ratis: no pipeline gets a leader and SCM stays in safe mode.
* SCM follower checkpoint download from the leader ({{SCMSnapshotProvider}}
connects to the leader by IP address).
Found with the {{ozonesecure-ha}} compose cluster on an IPv6-only network.
Workaround for datanodes: {{hdds.datanode.use.datanode.hostname=true}}.
Proposed fix: drop the scope of IPv6 addresses that are not link local before
the check. {{TestHddsServerUtils}} only covers addresses from
{{InetAddress.getByName}}, which have no scope.
was:Certificates generated on an IPv6-only host have no IP subject
alternative name.
> Certificates do not include IPv6 addresses in subject alternative names
> -----------------------------------------------------------------------
>
> Key: HDDS-16970
> URL: https://issues.apache.org/jira/browse/HDDS-16970
> Project: Apache Ozone
> Issue Type: Bug
> Components: Certificates
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
>
> {{HddsServerUtil.getValidInetsForCurrentHost}} skips every IPv6 address of
> the host. {{NetworkInterface.getInetAddresses()}} returns IPv6 addresses with
> the interface as scope, also for global and unique local addresses (for
> example {{fd00:172:25:0:0:0:0:102%eth0}}), and
> {{isScopedOrMaskingIPv6Address}} rejects any address whose text contains a
> percent sign.
> {noformat}
> INFO utils.HddsServerUtil: ip:fd00:172:25:0:0:0:0:102%eth0 not returned.
> {noformat}
> On an IPv6-only host the certificate has DNS names only. Connections that
> verify the peer by IP address fail:
> {noformat}
> CertificateException: No subject alternative names matching IP address
> fd00:172:25:0:0:0:0:104 found for SNIHostName=null and
> peerHost=[fd00:172:25:0:0:0:0:104] in the chain of 3 certificate(s): 1.
> subjectAlternativeNames=[DNS:b945fe54756e], CN=dn@b945fe54756e. 2.
> subjectAlternativeNames=[DNS:scm1.org], [email protected]. 3.
> subjectAlternativeNames=[DNS:scm1.org], [email protected].
> {noformat}
> * Datanode Ratis: no pipeline gets a leader and SCM stays in safe mode.
> * SCM follower checkpoint download from the leader ({{SCMSnapshotProvider}}
> connects to the leader by IP address).
> Found with the {{ozonesecure-ha}} compose cluster on an IPv6-only network.
> Workaround for datanodes: {{hdds.datanode.use.datanode.hostname=true}}.
> Proposed fix: drop the scope of IPv6 addresses that are not link local before
> the check. {{TestHddsServerUtils}} only covers addresses from
> {{InetAddress.getByName}}, which have no scope.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
