[HDDS-10604] Whitelist based compliance check for crypto related configuration options

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0
• Labels: pull-request-available
• Epic Link: crypto-compliance
• Assignee: Zita Dombi
• Reporter: István Fajth
• Created: 28/Mar/24 01:52
• Updated: 12/Jul/24 14:24
• Resolved: 12/Jul/24 14:24

Description

In our configuration objects, create a method/ensure the existing methods check configuration options that are tagged with CRYPTO_COMPLIANCE against their respective whitelist options.

The basic idea is that we have the ozone.security.crypto.compliance.mode option, that contains a String value and defaults to "unrestricted".
This check should allow any option for a given CRYPTO_COMPLIANCE tagged configuration option in case the ozone.security.crypto.compliance.mode is the default value ("unrestricted").
This check should check if a configured whitelist exists for the property for the given compliance mode, and if the whitelist exists, it should ensure that the value for a property is whitelisted. The whitelist property for a given cryptography parameter should be expected to be defined based on the cryptography parameter name. As an example, if ozone.security.crypto.compliance.mode is set to "foo", and we are getting the hdds.key.algo property, then this check should expect a hdds.key.algo.foo.whitelist property, and if it exists, it should check that the value configured for hdds.key.algo is present in the whitelist.

Issue Links

• links to: GitHub Pull Request #6860