Siyao Meng created HDDS-17030:
---------------------------------
Summary: DefaultApprover.inspectCSR never completes its future
when the CSR passes inspection
Key: HDDS-17030
URL: https://issues.apache.org/jira/browse/HDDS-17030
Project: Apache Ozone
Issue Type: Improvement
Reporter: Siyao Meng
{{CertificateApprover.inspectCSR}} is documented to return a future that
contains Void if the CSR is valid and an exception otherwise.
{{DefaultApprover.inspectCSR}}, the only implementation, only ever calls
{{completeExceptionally}}, so for a CSR that passes inspection the returned
future is never completed. Its only caller,
{{DefaultCAServer.requestCertificate}}, checks {{isCompletedExceptionally()}},
so an incomplete future is read as approved.
This works today because the inspection is synchronous and there is one caller.
But a caller that waits on the future ({{get()}} or {{join()}}) would block
forever on every valid CSR, and "incomplete means approved" is easy to get
wrong when a validation step is added.
Also, after a failed step {{inspectCSR}} goes on with the remaining steps: the
RDN and extension checks run on a CSR whose signature did not verify, each
logging its own error.
Proposed change:
* complete the future with {{null}} once every step passes
* return right after the first failed step
* in {{DefaultCAServer.requestCertificate}}, treat a future that did not
complete normally as a rejection, so an incomplete future is no longer read as
approved
Raised in the review of HDDS-16936:
https://github.com/apache/ozone/pull/11486#pullrequestreview-5526283040. Code
references are to master at 55c834b9050.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
