[HDDS-4558] Support Ozone block token with access mode check

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0.0
• Fix Version/s: 1.1.0
• Component/s: Security
• Labels: pull-request-available
• Assignee: Xiaoyu Yao
• Reporter: Marton Elek
• Created: 07/Dec/20 20:19
• Updated: 06/Jan/21 19:00
• Resolved: 04/Jan/21 22:31

Description

Thanks elek for reporting the issue. There is a TODO in the Ozone block token verifier to support this. Currently the block token is giving all access to the client without access mode check. This ticket is opened to set access mode properly for block token and validate them in the token verifier.

Issue Links

• causes: HDDS-4644 Block token verification failed: no READ permission for WriteChunk
• causes: HDDS-4648 DN should set the block token when Read StateMachine data for WriteChunk
• links to: GitHub Pull Request #1672