[KNOX-1881] DefaultKeystoreService should use Java NIO API locking as well

• Type: Improvement
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 1.3.0
• Component/s: KnoxCLI, Server
• Assignee: Kevin Risden
• Reporter: Robert Levas
• Created: 20/Jun/19 19:09
• Updated: 27/Jan/20 16:35
• Resolved: 21/Jun/19 19:06

Description

The file locking mechanism in org.apache.knox.gateway.services.security.impl.DefaultKeystoreService today relies on read/write locks to prevent multiple threads from editing a single keystore. Java NIO API file locking adds the protection for reading/writing from multiple JVMs. Since DefaultKeystoreService is used in both gateway and knoxcli, we need to protect against this type of access happening at once.

https://docs.oracle.com/javase/8/docs/api/java/nio/channels/FileLock.html

Issue Links

• is a clone of: KNOX-1821 Change file locking mechanism in DefaultKeystoreService to use Java NIO API
• is related to: KNOX-2200 DefaultKeystoreService can lose entries under concurrent access
• is related to: KNOX-1917 DefaultKeystoreService should use a shared read lock
• relates to: KNOX-1230 Many Concurrent Requests to Knox causes URL Mangling
• links to: GitHub Pull Request #104
• links to: PR #104