[
https://issues.apache.org/jira/browse/NIFI-888?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14708107#comment-14708107
]
ASF GitHub Bot commented on NIFI-888:
-------------------------------------
Github user markap14 commented on a diff in the pull request:
https://github.com/apache/nifi/pull/76#discussion_r37697819
--- Diff:
nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/main/java/org/apache/nifi/processors/standard/util/OpenPGPKeyBasedEncryptor.java
---
@@ -139,75 +151,88 @@ public static PGPPublicKey getPublicKey(String
userId, String publicKeyring) thr
private String secretKeyring;
private char[] passphrase;
- OpenPGPDecryptCallback(final String provider, final String
keyring, final char[] passphrase) {
+ OpenPGPDecryptCallback(final String provider, final String keyring,
+ final char[] passphrase) {
this.provider = provider;
this.secretKeyring = keyring;
this.passphrase = passphrase;
}
@Override
- public void process(InputStream in, OutputStream out) throws
IOException {
- InputStream pgpin = PGPUtil.getDecoderStream(in);
- PGPObjectFactory pgpFactory = new PGPObjectFactory(pgpin);
+ public void process(InputStream in, OutputStream out)
+ throws IOException {
+ try (InputStream pgpin = PGPUtil.getDecoderStream(in)) {
+ PGPObjectFactory pgpFactory = new PGPObjectFactory(pgpin);
- Object obj = pgpFactory.nextObject();
- if (!(obj instanceof PGPEncryptedDataList)) {
- obj = pgpFactory.nextObject();
+ Object obj = pgpFactory.nextObject();
if (!(obj instanceof PGPEncryptedDataList)) {
- throw new ProcessException("Invalid OpenPGP data");
- }
- }
- PGPEncryptedDataList encList = (PGPEncryptedDataList) obj;
-
- PGPSecretKeyRingCollection pgpSecretKeyring;
- try {
- // open secret keyring file
- pgpSecretKeyring = new
PGPSecretKeyRingCollection(PGPUtil.getDecoderStream(Files
- .newInputStream(Paths.get(secretKeyring))));
- } catch (Exception e) {
- throw new ProcessException("Invalid secret keyring - " +
e.getMessage());
- }
-
- try {
- PGPPrivateKey privateKey = null;
- PGPPublicKeyEncryptedData encData = null;
-
- // find the secret key in the encrypted data
- Iterator it = encList.getEncryptedDataObjects();
- while (privateKey == null && it.hasNext()) {
- obj = it.next();
- if (!(obj instanceof PGPPublicKeyEncryptedData)) {
+ obj = pgpFactory.nextObject();
+ if (!(obj instanceof PGPEncryptedDataList)) {
throw new ProcessException("Invalid OpenPGP data");
}
- encData = (PGPPublicKeyEncryptedData) obj;
- PGPSecretKey secretkey =
pgpSecretKeyring.getSecretKey(encData.getKeyID());
- if (secretkey != null) {
- privateKey =
secretkey.extractPrivateKey(passphrase, provider);
- }
}
- if (privateKey == null) {
- throw new ProcessException("Secret keyring does not
contain the key required to decrypt");
+ PGPEncryptedDataList encList = (PGPEncryptedDataList) obj;
+
+ PGPSecretKeyRingCollection pgpSecretKeyring;
+ try {
+ // open secret keyring file
+ pgpSecretKeyring = new PGPSecretKeyRingCollection(
+
PGPUtil.getDecoderStream(Files.newInputStream(Paths
--- End diff --
The InputStream returned by Files.newInputStream is leaked here.
> EncryptContent for PGP Leaks File Handles
> -----------------------------------------
>
> Key: NIFI-888
> URL: https://issues.apache.org/jira/browse/NIFI-888
> Project: Apache NiFi
> Issue Type: Bug
> Components: Core Framework
> Affects Versions: 0.2.0
> Reporter: Alan Jackoway
> Assignee: Mark Payne
> Priority: Critical
> Fix For: 0.3.0
>
>
> I had some nifi nodes crash last night with errors that suggested file
> handles where exhausted. When I looked into lsof, I found tens of thousands
> of open file handles to a public key I was using in EncryptContent.
> It looks to me like the OpenPGPKeyBasedEncryptor.getPublicKey leaks file
> handles. Because this is called in EncryptContent's validate method, these
> file handles build up even when there is no data flow. You can reproduce by
> the following:
> * Create a PGP public key
> * Set up an EncryptContent processor with the public key for PGP encryption.
> * Do lsof | grep publicKey and see the file handles build up.
> I have a patch. Will post a pull request shortly. I have no idea how to test
> it though other than that I ran it locally and the file handles stopped
> building up when I used the patched code.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
