Skip to content

LOG-2093: adding a mutex to the functions which call certificate generation #822

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Dec 24, 2021
Merged

LOG-2093: adding a mutex to the functions which call certificate generation #822

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 10 additions & 12 deletions internal/elasticsearch/certificates.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,6 @@ type certificate struct {
key []byte
x509Cert *x509.Certificate
privKey *rsa.PrivateKey
certMutex sync.Mutex
}

type certCA struct {
Expand Down Expand Up @@ -115,6 +114,10 @@ var (
// In ASN.1, "2 5 29 17" is the OID for subjectAltName (SAN)
// The FullBytes are ASN.1-encoded 1.2.3.4.5.5
sanIdentifier asn1.ObjectIdentifier = asn1.ObjectIdentifier{2, 5, 29, 17}
//Fixing a race condition between GenerateComponentsCerts and GenerateKibanaCerts functions
//Here make mutex global. Probably temporary solution, need more deep refactoring of code related to certificate
//generation. Problem was founded during working on issue: https://issues.redhat.com/browse/LOG-1923
certMutex = sync.Mutex{}
)

type CertificateRequest struct {
Expand Down Expand Up @@ -168,6 +171,8 @@ func (cr *CertificateRequest) getSigningSecretName() string {
}

func (cr *CertificateRequest) GenerateComponentCerts(secretName, cn string) {
certMutex.Lock()
defer certMutex.Unlock()
key := client.ObjectKey{Name: secretName, Namespace: cr.Namespace}
s, err := secret.Get(context.TODO(), cr.K8sClient, key)
if err != nil && !apierrors.IsNotFound(kverrors.Root(err)) {
Expand Down Expand Up @@ -205,6 +210,8 @@ func (cr *CertificateRequest) GenerateComponentCerts(secretName, cn string) {
}

func (cr *CertificateRequest) GenerateKibanaCerts(componentName string) {
certMutex.Lock()
defer certMutex.Unlock()
key := client.ObjectKey{Name: kibanaSecretName, Namespace: cr.Namespace}
s, err := secret.Get(context.TODO(), cr.K8sClient, key)
if err != nil && !apierrors.IsNotFound(kverrors.Root(err)) {
Expand Down Expand Up @@ -281,6 +288,8 @@ func (cr *CertificateRequest) GenerateKibanaCerts(componentName string) {
}

func (cr *CertificateRequest) GenerateElasticsearchCerts(clusterName string) {
certMutex.Lock()
defer certMutex.Unlock()
// get from secret
key := client.ObjectKey{Name: clusterName, Namespace: cr.Namespace}
s, err := secret.Get(context.TODO(), cr.K8sClient, key)
Expand Down Expand Up @@ -358,9 +367,6 @@ func (cr *CertificateRequest) persistCA(caCert *certCA) error {
}

func (cr *CertificateRequest) ensureCA(caCert *certCA) error {
caCert.certMutex.Lock()
defer caCert.certMutex.Unlock()

secretName := cr.getSigningSecretName()

// get the ca from the secret if we can
Expand Down Expand Up @@ -406,9 +412,6 @@ func (cr *CertificateRequest) ensureCA(caCert *certCA) error {
}

func (cr *CertificateRequest) incrementCertSerial(ca *certCA) (*big.Int, error) {
ca.certMutex.Lock()
defer ca.certMutex.Unlock()

ca.serial.Add(ca.serial, bigOne)
serial := big.NewInt(0)
serial.Set(ca.serial)
Expand Down Expand Up @@ -461,9 +464,6 @@ func (cr *CertificateRequest) generateCert(componentName string, cert *certifica
return err
}

cert.certMutex.Lock()
defer cert.certMutex.Unlock()

x509Cert := &x509.Certificate{
SerialNumber: serial,
SignatureAlgorithm: x509.SHA512WithRSA,
Expand Down Expand Up @@ -591,7 +591,6 @@ func genCA() (*certCA, error) {
keyPEMBytes,
ca,
caPrivKey,
sync.Mutex{},
},
serial,
caPubKeySHA1[:],
Expand Down Expand Up @@ -793,7 +792,6 @@ func validateCASecret(secret *v1.Secret) (*certCA, error) {
keyBytes,
x509Cert,
rsaKey,
sync.Mutex{},
},
serial,
pubKeySHA1[:],
Expand Down