[
https://issues.apache.org/jira/browse/NIFI-888?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14708110#comment-14708110
]
ASF GitHub Bot commented on NIFI-888:
-------------------------------------
Github user markap14 commented on a diff in the pull request:
https://github.com/apache/nifi/pull/76#discussion_r37697905
--- Diff:
nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/main/java/org/apache/nifi/processors/standard/util/OpenPGPKeyBasedEncryptor.java
---
@@ -85,49 +85,61 @@ public StreamCallback getDecryptionCallback() throws
Exception {
/*
* Validate secret keyring passphrase
*/
- public static boolean validateKeyring(String provider, String
secretKeyringFile, char[] passphrase) throws IOException,
+ public static boolean validateKeyring(String provider,
+ String secretKeyringFile, char[] passphrase) throws
IOException,
PGPException, NoSuchProviderException {
- PGPSecretKeyRingCollection pgpsec = new
PGPSecretKeyRingCollection(PGPUtil.getDecoderStream(Files.newInputStream(Paths
- .get(secretKeyringFile))));
- Iterator ringit = pgpsec.getKeyRings();
- while (ringit.hasNext()) {
- PGPSecretKeyRing secretkeyring = (PGPSecretKeyRing)
ringit.next();
- PGPSecretKey secretkey = secretkeyring.getSecretKey();
- secretkey.extractPrivateKey(passphrase, provider);
- return true;
+ try (InputStream fin = Files.newInputStream(Paths
+ .get(secretKeyringFile))) {
+ try (InputStream pin = PGPUtil.getDecoderStream(fin)) {
+ PGPSecretKeyRingCollection pgpsec = new
PGPSecretKeyRingCollection(
+ pin);
+ Iterator ringit = pgpsec.getKeyRings();
+ while (ringit.hasNext()) {
+ PGPSecretKeyRing secretkeyring = (PGPSecretKeyRing)
ringit
+ .next();
+ PGPSecretKey secretkey = secretkeyring.getSecretKey();
+ secretkey.extractPrivateKey(passphrase, provider);
+ return true;
+ }
+ return false;
+ }
}
- return false;
}
/*
* Get the public key for a specific user id from a keyring.
*/
@SuppressWarnings("rawtypes")
- public static PGPPublicKey getPublicKey(String userId, String
publicKeyring) throws IOException, PGPException {
+ public static PGPPublicKey getPublicKey(String userId, String
publicKeyring)
+ throws IOException, PGPException {
PGPPublicKey pubkey = null;
- PGPPublicKeyRingCollection pgppub = new
-
PGPPublicKeyRingCollection(PGPUtil.getDecoderStream(Files.newInputStream(Paths.get(publicKeyring))));
-
- Iterator ringit = pgppub.getKeyRings();
- while (ringit.hasNext()) {
- PGPPublicKeyRing kring = (PGPPublicKeyRing) ringit.next();
-
- Iterator keyit = kring.getPublicKeys();
- while (keyit.hasNext()) {
- pubkey = (PGPPublicKey) keyit.next();
- boolean userIdMatch = false;
-
- Iterator userit = pubkey.getUserIDs();
- while (userit.hasNext()) {
- String id = userit.next().toString();
- if (id.contains(userId)) {
- userIdMatch = true;
- break;
+ try (InputStream fin =
Files.newInputStream(Paths.get(publicKeyring))) {
+ try (InputStream pin = PGPUtil.getDecoderStream(fin)) {
--- End diff --
I would wrap this up with the previous try-with-resources so that we have:
try (InputStream fin = Files.newInputStream(Paths.get(publicKeyring));
InputStream pin = PGPUtil.getDecoderStream(fin)) { ...
rather than having a new try-with-resources embedded within the outer one.
> EncryptContent for PGP Leaks File Handles
> -----------------------------------------
>
> Key: NIFI-888
> URL: https://issues.apache.org/jira/browse/NIFI-888
> Project: Apache NiFi
> Issue Type: Bug
> Components: Core Framework
> Affects Versions: 0.2.0
> Reporter: Alan Jackoway
> Assignee: Mark Payne
> Priority: Critical
> Fix For: 0.3.0
>
>
> I had some nifi nodes crash last night with errors that suggested file
> handles where exhausted. When I looked into lsof, I found tens of thousands
> of open file handles to a public key I was using in EncryptContent.
> It looks to me like the OpenPGPKeyBasedEncryptor.getPublicKey leaks file
> handles. Because this is called in EncryptContent's validate method, these
> file handles build up even when there is no data flow. You can reproduce by
> the following:
> * Create a PGP public key
> * Set up an EncryptContent processor with the public key for PGP encryption.
> * Do lsof | grep publicKey and see the file handles build up.
> I have a patch. Will post a pull request shortly. I have no idea how to test
> it though other than that I ran it locally and the file handles stopped
> building up when I used the patched code.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
