[nifi] branch main updated: NIFI-11918 Used java.security.cert in ListenGRPC

[exceptionfactory]

This is an automated email from the ASF dual-hosted git repository.

exceptionfactory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git


The following commit(s) were added to refs/heads/main by this push:
     new 2a3ce1cb69 NIFI-11918 Used java.security.cert in ListenGRPC
2a3ce1cb69 is described below

commit 2a3ce1cb6926f569898197afb4bc3011bb788305
Author: Peter Turcsanyi <turcsa...@apache.org>
AuthorDate: Mon Aug 7 23:36:10 2023 +0200

    NIFI-11918 Used java.security.cert in ListenGRPC
    
    This closes #7580
    
    Signed-off-by: David Handermann <exceptionfact...@apache.org>
---
 .../grpc/FlowFileIngestServiceInterceptor.java        | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git 
a/nifi-nar-bundles/nifi-grpc-bundle/nifi-grpc-common/src/main/java/org/apache/nifi/processors/grpc/FlowFileIngestServiceInterceptor.java
 
b/nifi-nar-bundles/nifi-grpc-bundle/nifi-grpc-common/src/main/java/org/apache/nifi/processors/grpc/FlowFileIngestServiceInterceptor.java
index b1044f668d..6614e9be48 100644
--- 
a/nifi-nar-bundles/nifi-grpc-bundle/nifi-grpc-common/src/main/java/org/apache/nifi/processors/grpc/FlowFileIngestServiceInterceptor.java
+++ 
b/nifi-nar-bundles/nifi-grpc-bundle/nifi-grpc-common/src/main/java/org/apache/nifi/processors/grpc/FlowFileIngestServiceInterceptor.java
@@ -26,12 +26,14 @@ import io.grpc.ServerCallHandler;
 import io.grpc.ServerInterceptor;
 import io.grpc.Status;
 import org.apache.nifi.logging.ComponentLog;
+import org.apache.nifi.processor.exception.ProcessException;
 
 import javax.net.ssl.SSLPeerUnverifiedException;
 import javax.net.ssl.SSLSession;
-import javax.security.cert.X509Certificate;
 import java.net.InetSocketAddress;
 import java.net.SocketAddress;
+import java.security.cert.Certificate;
+import java.security.cert.X509Certificate;
 import java.util.regex.Pattern;
 
 import static java.util.Objects.requireNonNull;
@@ -100,10 +102,11 @@ public class FlowFileIngestServiceInterceptor implements 
ServerInterceptor {
         final SSLSession sslSession = 
attributes.get(Grpc.TRANSPORT_ATTR_SSL_SESSION);
         if (this.authorizedDNPattern != null && sslSession != null) {
             try {
-                final X509Certificate[] certs = 
sslSession.getPeerCertificateChain();
+                final Certificate[] certs = sslSession.getPeerCertificates();
                 if (certs != null && certs.length > 0) {
-                    for (final X509Certificate cert : certs) {
-                        foundSubject = cert.getSubjectDN().getName();
+                    for (final Certificate cert : certs) {
+                        final X509Certificate x509Cert = 
toX509Certificate(cert);
+                        foundSubject = 
x509Cert.getSubjectX500Principal().getName();
                         if 
(authorizedDNPattern.matcher(foundSubject).matches()) {
                             break;
                         } else {
@@ -147,4 +150,12 @@ public class FlowFileIngestServiceInterceptor implements 
ServerInterceptor {
         return hostString == null ? UNKNOWN_IP : hostString;
     }
 
+    private X509Certificate toX509Certificate(final Certificate certificate) {
+        if (certificate instanceof X509Certificate) {
+            return (X509Certificate) certificate;
+        } else {
+            throw new ProcessException("Certificate is not an X.509 
certificate. Certificate type: " + certificate.getClass());
+        }
+    }
+
 }