This is an automated email from the ASF dual-hosted git repository.
thenatog pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git
The following commit(s) were added to refs/heads/main by this push:
new 98ab42a NIFI-8302 Corrected FingerprintFactory to use decrypt()
method removing wrapping
98ab42a is described below
commit 98ab42aebc11a56da79c2aac849d5463dadb4ef4
Author: exceptionfactory <[email protected]>
AuthorDate: Mon Mar 8 15:52:54 2021 -0600
NIFI-8302 Corrected FingerprintFactory to use decrypt() method removing
wrapping
Signed-off-by: Nathan Gough <[email protected]>
This closes #4876.
---
.../nifi/fingerprint/FingerprintFactory.java | 4 +-
.../nifi/fingerprint/FingerprintFactoryTest.java | 79 ++++++++--------------
2 files changed, 28 insertions(+), 55 deletions(-)
diff --git
a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/fingerprint/FingerprintFactory.java
b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/fingerprint/FingerprintFactory.java
index 345a247..23d8f48 100644
---
a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/fingerprint/FingerprintFactory.java
+++
b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/fingerprint/FingerprintFactory.java
@@ -87,8 +87,6 @@ public class FingerprintFactory {
private final ExtensionManager extensionManager;
private final SensitiveValueEncoder sensitiveValueEncoder;
- private byte[] sensitivePropertyKeyBytes;
-
private static final Logger logger =
LoggerFactory.getLogger(FingerprintFactory.class);
public FingerprintFactory(final PropertyEncryptor encryptor, final
ExtensionManager extensionManager, final SensitiveValueEncoder
sensitiveValueEncoder) {
@@ -545,7 +543,7 @@ public class FingerprintFactory {
* @return a deterministic string value which represents this input but is
safe to print in a log
*/
private String getLoggableRepresentationOfSensitiveValue(String
encryptedPropertyValue) {
- final String plaintextValue =
encryptor.decrypt(encryptedPropertyValue);
+ final String plaintextValue = decrypt(encryptedPropertyValue);
return sensitiveValueEncoder.getEncoded(plaintextValue);
}
diff --git
a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/test/java/org/apache/nifi/fingerprint/FingerprintFactoryTest.java
b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/test/java/org/apache/nifi/fingerprint/FingerprintFactoryTest.java
index f68cd89..5ebcbf8 100644
---
a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/test/java/org/apache/nifi/fingerprint/FingerprintFactoryTest.java
+++
b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/test/java/org/apache/nifi/fingerprint/FingerprintFactoryTest.java
@@ -16,6 +16,8 @@
*/
package org.apache.nifi.fingerprint;
+import org.apache.commons.codec.DecoderException;
+import org.apache.commons.codec.binary.Hex;
import org.apache.commons.io.IOUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.nifi.connectable.Position;
@@ -26,16 +28,12 @@ import
org.apache.nifi.controller.serialization.ScheduledStateLookup;
import org.apache.nifi.controller.serialization.StandardFlowSerializer;
import org.apache.nifi.encrypt.PropertyEncryptor;
import org.apache.nifi.encrypt.SensitiveValueEncoder;
-import org.apache.nifi.encrypt.StandardSensitiveValueEncoder;
import org.apache.nifi.groups.RemoteProcessGroup;
import org.apache.nifi.nar.ExtensionManager;
import org.apache.nifi.nar.StandardExtensionDiscoveringManager;
import org.apache.nifi.remote.RemoteGroupPort;
import org.apache.nifi.remote.protocol.SiteToSiteTransportProtocol;
-import org.apache.nifi.security.util.crypto.Argon2SecureHasher;
import org.apache.nifi.security.xml.XmlUtils;
-import org.apache.nifi.util.NiFiProperties;
-import org.junit.AfterClass;
import org.junit.Before;
import org.junit.Test;
import org.w3c.dom.Document;
@@ -44,8 +42,6 @@ import org.xml.sax.ErrorHandler;
import org.xml.sax.SAXException;
import org.xml.sax.SAXParseException;
-import javax.crypto.Mac;
-import javax.crypto.spec.SecretKeySpec;
import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.ParserConfigurationException;
@@ -55,7 +51,6 @@ import java.io.File;
import java.io.IOException;
import java.lang.reflect.Method;
import java.nio.charset.StandardCharsets;
-import java.util.Base64;
import java.util.Collections;
import java.util.Optional;
@@ -74,56 +69,44 @@ public class FingerprintFactoryTest {
private PropertyEncryptor encryptor;
private ExtensionManager extensionManager;
- private FingerprintFactory fingerprinter;
+ private FingerprintFactory fingerprintFactory;
private SensitiveValueEncoder sensitiveValueEncoder;
- private NiFiProperties niFiProperties;
-
- private static final String ORIGINAL_NIFI_PROPS_PATH =
System.getProperty(NiFiProperties.PROPERTIES_FILE_PATH);
- private static final String TEST_NIFI_PROPS_PATH =
"src/test/resources/conf/nifi.properties";
@Before
public void setup() {
- niFiProperties =
NiFiProperties.createBasicNiFiProperties(TEST_NIFI_PROPS_PATH);
encryptor = createEncryptor();
- sensitiveValueEncoder = new
StandardSensitiveValueEncoder(niFiProperties);
+ sensitiveValueEncoder = createSensitiveValueEncoder();
extensionManager = new StandardExtensionDiscoveringManager();
- fingerprinter = new FingerprintFactory(encryptor, extensionManager,
sensitiveValueEncoder);
- }
-
- @AfterClass
- public static void tearDownOnce() {
- if (ORIGINAL_NIFI_PROPS_PATH != null) {
- System.setProperty(NiFiProperties.PROPERTIES_FILE_PATH,
ORIGINAL_NIFI_PROPS_PATH);
- }
+ fingerprintFactory = new FingerprintFactory(encryptor,
extensionManager, sensitiveValueEncoder);
}
@Test
public void testSameFingerprint() throws IOException {
- final String fp1 =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow1a.xml"),
null);
- final String fp2 =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow1b.xml"),
null);
+ final String fp1 =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow1a.xml"),
null);
+ final String fp2 =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow1b.xml"),
null);
assertEquals(fp1, fp2);
}
@Test
public void testDifferentFingerprint() throws IOException {
- final String fp1 =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow1a.xml"),
null);
- final String fp2 =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow2.xml"),
null);
+ final String fp1 =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow1a.xml"),
null);
+ final String fp2 =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow2.xml"),
null);
assertNotEquals(fp1, fp2);
}
@Test
public void testResourceValueInFingerprint() throws IOException {
- final String fingerprint =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow1a.xml"),
null);
+ final String fingerprint =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow1a.xml"),
null);
assertEquals(3, StringUtils.countMatches(fingerprint, "success"));
assertTrue(fingerprint.contains("In Connection"));
}
@Test
public void
testSameFlowWithDifferentBundleShouldHaveDifferentFingerprints() throws
IOException {
- final String fp1 =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-bundle-1.xml"),
null);
+ final String fp1 =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-bundle-1.xml"),
null);
assertTrue(fp1.contains("org.apache.nifinifi-standard-nar1.0"));
- final String fp2 =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-bundle-2.xml"),
null);
+ final String fp2 =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-bundle-2.xml"),
null);
assertTrue(fp2.contains("org.apache.nifinifi-standard-nar2.0"));
assertNotEquals(fp1, fp2);
@@ -131,10 +114,10 @@ public class FingerprintFactoryTest {
@Test
public void testSameFlowAndOneHasNoBundleShouldHaveDifferentFingerprints()
throws IOException {
- final String fp1 =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-bundle-1.xml"),
null);
+ final String fp1 =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-bundle-1.xml"),
null);
assertTrue(fp1.contains("org.apache.nifinifi-standard-nar1.0"));
- final String fp2 =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-no-bundle.xml"),
null);
+ final String fp2 =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-no-bundle.xml"),
null);
assertTrue(fp2.contains("MISSING_BUNDLE"));
assertNotEquals(fp1, fp2);
@@ -142,10 +125,10 @@ public class FingerprintFactoryTest {
@Test
public void
testSameFlowAndOneHasMissingBundleShouldHaveDifferentFingerprints() throws
IOException {
- final String fp1 =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-bundle-1.xml"),
null);
+ final String fp1 =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-bundle-1.xml"),
null);
assertTrue(fp1.contains("org.apache.nifinifi-standard-nar1.0"));
- final String fp2 =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-missing-bundle.xml"),
null);
+ final String fp2 =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow3-with-missing-bundle.xml"),
null);
assertTrue(fp2.contains("missingmissingmissing"));
assertNotEquals(fp1, fp2);
@@ -153,7 +136,7 @@ public class FingerprintFactoryTest {
@Test
public void testConnectionWithMultipleRelationshipsSortedInFingerprint()
throws IOException {
- final String fingerprint =
fingerprinter.createFingerprint(getResourceBytes("/nifi/fingerprint/flow-connection-with-multiple-rels.xml"),
null);
+ final String fingerprint =
fingerprintFactory.createFingerprint(getResourceBytes("/nifi/fingerprint/flow-connection-with-multiple-rels.xml"),
null);
assertNotNull(fingerprint);
assertTrue(fingerprint.contains("AAABBBCCCDDD"));
}
@@ -161,7 +144,7 @@ public class FingerprintFactoryTest {
@Test
public void testSchemaValidation() throws IOException {
FingerprintFactory fp = new FingerprintFactory(null,
getValidatingDocumentBuilder(), extensionManager, null);
- final String fingerprint =
fp.createFingerprint(getResourceBytes("/nifi/fingerprint/validating-flow.xml"),
null);
+
fp.createFingerprint(getResourceBytes("/nifi/fingerprint/validating-flow.xml"),
null);
}
private byte[] getResourceBytes(final String resource) throws IOException {
@@ -220,7 +203,7 @@ public class FingerprintFactoryTest {
fingerprintFromComponent.setAccessible(true);
final StringBuilder fingerprint = new StringBuilder();
- fingerprintFromComponent.invoke(fingerprinter, fingerprint, input);
+ fingerprintFromComponent.invoke(fingerprintFactory, fingerprint,
input);
return fingerprint.toString();
}
@@ -285,19 +268,7 @@ public class FingerprintFactoryTest {
when(component.getProxyPassword()).thenReturn(proxyPassword);
when(component.getVersionedComponentId()).thenReturn(Optional.empty());
- // Build the same secure hasher to derive the HMAC key
- Argon2SecureHasher a2sh = new Argon2SecureHasher();
-
- // The nifi.properties file needs to be present
- String npsk =
niFiProperties.getProperty(NiFiProperties.SENSITIVE_PROPS_KEY);
-
- // The output will be 32B (256b)
- byte[] sensitivePropertyKeyBytes =
a2sh.hashRaw(npsk.getBytes(StandardCharsets.UTF_8));
-
- Mac mac = Mac.getInstance("HmacSHA256");
- mac.init(new SecretKeySpec(sensitivePropertyKeyBytes, "HmacSHA256"));
- byte[] hashedBytes =
mac.doFinal(proxyPassword.getBytes(StandardCharsets.UTF_8));
- final String hashedProxyPassword = "[MASKED] (" +
Base64.getEncoder().encodeToString(hashedBytes) + ")";
+ final String hashedProxyPassword =
sensitiveValueEncoder.getEncoded(proxyPassword);
// Assert fingerprints with expected one.
final String expected = "id" +
@@ -367,7 +338,7 @@ public class FingerprintFactoryTest {
final Element processGroup = document.getDocumentElement();
final StringBuilder sb = new StringBuilder();
- fingerprinter.addProcessGroupFingerprint(sb, processGroup, new
FlowEncodingVersion(1, 0));
+ fingerprintFactory.addProcessGroupFingerprint(sb, processGroup, new
FlowEncodingVersion(1, 0));
final String fingerprint = sb.toString();
final String[] criticalFingerprintValues = new String[] {
@@ -388,12 +359,16 @@ public class FingerprintFactoryTest {
return new PropertyEncryptor() {
@Override
public String encrypt(String property) {
- return property;
+ return
Hex.encodeHexString(property.getBytes(StandardCharsets.UTF_8));
}
@Override
public String decrypt(String encryptedProperty) {
- return encryptedProperty.substring(4,
encryptedProperty.length() - 1);
+ try {
+ return new String(Hex.decodeHex(encryptedProperty));
+ } catch (DecoderException e) {
+ throw new IllegalArgumentException(e);
+ }
}
};
}
