{"action":"created","issue":{"url":"https://api.github.com/repos/corda/corda/issues/3039","repository_url":"https://api.github.com/repos/corda/corda","labels_url":"https://api.github.com/repos/corda/corda/issues/3039/labels{/name}","comments_url":"https://api.github.com/repos/corda/corda/issues/3039/comments","events_url":"https://api.github.com/repos/corda/corda/issues/3039/events","html_url":"https://github.com/corda/corda/pull/3039","id":318892520,"number":3039,"title":"CORDA-1343 Make the RPCClient ssl constructors public. Clean up broke…","user":{"login":"tudor-malene","id":1941897,"avatar_url":"https://avatars0.githubusercontent.com/u/1941897?v=4","gravatar_id":"","url":"https://api.github.com/users/tudor-malene","html_url":"https://github.com/tudor-malene","followers_url":"https://api.github.com/users/tudor-malene/followers","following_url":"https://api.github.com/users/tudor-malene/following{/other_user}","gists_url":"https://api.github.com/users/tudor-malene/gists{/gist_id}","starred_url":"https://api.github.com/users/tudor-malene/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tudor-malene/subscriptions","organizations_url":"https://api.github.com/users/tudor-malene/orgs","repos_url":"https://api.github.com/users/tudor-malene/repos","events_url":"https://api.github.com/users/tudor-malene/events{/privacy}","received_events_url":"https://api.github.com/users/tudor-malene/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-04-30T13:37:06Z","updated_at":"2018-05-04T14:07:37Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/corda/corda/pulls/3039","html_url":"https://github.com/corda/corda/pull/3039","diff_url":"https://github.com/corda/corda/pull/3039.diff","patch_url":"https://github.com/corda/corda/pull/3039.patch"},"body":"Original ticket: https://r3-cev.atlassian.net/browse/CORDA-1343\r\n\r\nChanges:\r\n\r\n1. Create new config objects for RPC SSL. Currently we disable client-side auth as the clients authenticate with username/password. ( Broker has a keystore, client has a truststore)\r\n2. Refactor the ArtemisTcpTransport class to make a clear distinction between connectors/acceptors and p2p/rpc\r\n3. Refactored the rpc ssl tests\r\n4. Replace the 2 NodeLoginModules with one BrokerJaasLoginModule, which is a cleaned-up version that should be much clearer. Also unified the way the Node connects to the RPC and P2P broker ( using the same keystore/truststore). This gives us the option to chose if we want 1 or 2 brokers for rpc and p2p\r\n5. Removed more Verifier logic, and deprecated \"config.certificateChainCheckPolicies\", which were never used. Question: Can I remove them?\r\n6. The RPC admin port is mandatory, as it will have different ssl settings than the normal RPC port (which can be non-ssl) . On startup, the shell will connect to the admin port.\r\n7. Slightly refactored RPCMessagingClient ( renamed to InternalRPCMessagingClient and method names )\r\n8. Modified the standalone Shell to only take a truststore, as client-side auth is disabled\r\n9. Split the NODE_USER into NODE_P2P_USER and NODE_RPC_USER\r\n10. The Integrated shell now uses NODE_RPC_USER to connect. It doesn't need to create a magic user.\r\n\r\n\r\nQuestion: The CertificateChainCheckPolicy logic can be simplified a lot. It is quite elaborate at the moment and there's not really a need for it.\r\n\r\n\r\n### Options around keys management after discussing with @jamesbr3 :\r\n\r\n1. Should we default to SSL for RPC?  ( If we default to SSL, then we need to provide a default keystore for RPC.)\r\n2. Should we separate the RPC keys from the P2P keys? \r\n\r\n   2.1. If we use the existing (doorman issued P2P) SSL keystore, then the RPC clients need to use the root trustore (as there might be an HA setup)\r\n     This is a bit insecure as it exposes the RPC client to a MITM attack by another peer node.\r\n     This can be mitigated by either:\r\n        - \"Certificate pinning\" - the client truststore contains only the node ssl certificate and noot the Doorman Root CA. The downside to this is that it becomes complex to manage for HA setups.\r\n        - alternatively , the RPC client can be setup with a \"name\" (the x500 name of node they are connecting to) that will be used to authenticate the SSL connection\r\n\r\n   2.2 Another option is to separate the RPC certificates from the P2P certificates.   \r\n         The downside is that it makes defaulting to SSL harder, and puts more burden on the node operator to manage these new keystores.\r\n         We could make it better by providing some tooling to generate the required plumbing.\r\n         For an HA setup though, we need a slightly more elaborate process, of generating one certificate (self-signed or issued from a corporate root CA)  that would be used to issue certificates for all nodes in the HA setup. This certificate should  be distributed in a trustore to all RPC clients.\r\n\r\nEven if we don't default to SSL, we still need to provide some guidelines, so we still need to make a decision on what we want to suggest.\r\n\r\nBased on the above, there's implications on the RpcClient api, as we could have 1 trustore per node, or 1 truststore per RpcClient\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/corda/corda/issues/comments/386612612","html_url":"https://github.com/corda/corda/pull/3039#issuecomment-386612612","issue_url":"https://api.github.com/repos/corda/corda/issues/3039","id":386612612,"user":{"login":"tudor-malene","id":1941897,"avatar_url":"https://avatars0.githubusercontent.com/u/1941897?v=4","gravatar_id":"","url":"https://api.github.com/users/tudor-malene","html_url":"https://github.com/tudor-malene","followers_url":"https://api.github.com/users/tudor-malene/followers","following_url":"https://api.github.com/users/tudor-malene/following{/other_user}","gists_url":"https://api.github.com/users/tudor-malene/gists{/gist_id}","starred_url":"https://api.github.com/users/tudor-malene/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tudor-malene/subscriptions","organizations_url":"https://api.github.com/users/tudor-malene/orgs","repos_url":"https://api.github.com/users/tudor-malene/repos","events_url":"https://api.github.com/users/tudor-malene/events{/privacy}","received_events_url":"https://api.github.com/users/tudor-malene/received_events","type":"User","site_admin":false},"created_at":"2018-05-04T14:07:36Z","updated_at":"2018-05-04T14:07:36Z","author_association":"CONTRIBUTOR","body":"back to you @mikehearn "}}
{"actor":{"display_login":"tudor-malene"}}