arpadboda commented on a change in pull request #937: URL: https://github.com/apache/nifi-minifi-cpp/pull/937#discussion_r528639539
########## File path: encrypt-config/ArgParser.h ########## @@ -0,0 +1,72 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#pragma once + +#include <string> +#include <set> +#include <vector> +#include <map> +#include "utils/OptionalUtils.h" + +namespace org { +namespace apache { +namespace nifi { +namespace minifi { +namespace encrypt_config { + +struct Argument { + std::vector<std::string> names; Review comment: I wonder if we can assume these to be unique and use set instad. That would help making other parts of the code simple (use count instead of iterator-based search for eg.) ########## File path: encrypt-config/ArgParser.cpp ########## @@ -0,0 +1,187 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include <string> +#include <set> +#include <iostream> +#include <algorithm> +#include "ArgParser.h" +#include "utils/OptionalUtils.h" +#include "utils/StringUtils.h" + +namespace org { +namespace apache { +namespace nifi { +namespace minifi { +namespace encrypt_config { + +const std::vector<Argument> Arguments::simple_arguments_{ + {std::vector<std::string>{"--minifi-home", "-m"}, + true, + "minifi home", + "Specifies the home directory used by the minifi agent"} +}; + +const std::vector<FlagArgument> Arguments::flag_arguments_{ + {std::vector<std::string>{"--help", "-h"}, + "Prints this help message"}, + {std::vector<std::string>{"--encrypt-flow-config"}, + "If set, the flow configuration file (as specified in minifi.properties) is also encrypted."} +}; + +std::string Arguments::getHelp() { + std::stringstream ss; + ss << "Usage: " << "encrypt-config"; + for (const auto& simple_arg : simple_arguments_) { + ss << " "; + if (!simple_arg.required) { + ss << "["; + } + ss << utils::StringUtils::join("|", simple_arg.names) + << " <" << simple_arg.value_name << ">"; + if (!simple_arg.required) { + ss << "]"; + } + } + for (const auto& flag : flag_arguments_) { + ss << " [" << utils::StringUtils::join("|", flag.names) << "]"; + } + ss << std::endl; + for (const auto& simple_arg : simple_arguments_) { + ss << "\t"; + ss << utils::StringUtils::join("|", simple_arg.names) << " : "; + if (simple_arg.required) { + ss << "(required)"; + } else { + ss << "(optional)"; + } + ss << " " << simple_arg.description; + ss << std::endl; + } + for (const auto& flag : flag_arguments_) { + ss << "\t" << utils::StringUtils::join("|", flag.names) << " : " + << flag.description << std::endl; + } + return ss.str(); +} + +void Arguments::set(const std::string& key, const std::string& value) { + if (get(key)) { + std::cerr << "Key is specified more than once \"" << key << "\"" << std::endl; + std::cerr << getHelp(); + std::exit(1); + } + simple_args_[key] = value; +} + +void Arguments::set(const std::string& flag) { + if (isSet(flag)) { + std::cerr << "Flag is specified more than once \"" << flag << "\"" << std::endl; + std::cerr << getHelp(); + std::exit(1); + } + flag_args_.insert(flag); +} + +utils::optional<std::string> Arguments::get(const std::string &key) const { + utils::optional<Argument> opt_arg = getSimpleArg(key); + if (!opt_arg) { + return {}; + } + for (const auto& name : opt_arg->names) { + auto it = simple_args_.find(name); + if (it != simple_args_.end()) { + return it->second; + } + } + return {}; +} + +bool Arguments::isSet(const std::string &flag) const { + utils::optional<FlagArgument> opt_flag = getFlag(flag); + if (!opt_flag) { + return false; + } + return std::any_of(opt_flag->names.begin(), opt_flag->names.end(), [&] (const std::string& name) { + return flag_args_.find(name) != flag_args_.end(); + }); +} + +Arguments Arguments::parse(int argc, char* argv[]) { Review comment: I wonder if we can make it throw instead of having many exit points. This way we could reduce the number of usage of the well-famous copy-paste pattern by only printing help and calling std::exit in the catch block. ########## File path: encrypt-config/EncryptConfig.cpp ########## @@ -42,81 +40,119 @@ namespace nifi { namespace minifi { namespace encrypt_config { -EncryptConfig::EncryptConfig(int argc, char* argv[]) : minifi_home_(parseMinifiHomeFromTheOptions(argc, argv)) { +EncryptConfig::EncryptConfig(const std::string& minifi_home) : minifi_home_(minifi_home) { if (sodium_init() < 0) { throw std::runtime_error{"Could not initialize the libsodium library!"}; } + // encryption/decryption depends on the libsodium library which needs to be initialized + keys_ = getEncryptionKeys(); } -std::string EncryptConfig::parseMinifiHomeFromTheOptions(int argc, char* argv[]) { - if (argc >= 2) { - for (int i = 1; i < argc; ++i) { - std::string argstr(argv[i]); - if ((argstr == "-h") || (argstr == "--help")) { - std::cout << USAGE_STRING << std::endl; - std::exit(0); - } - } +EncryptConfig::EncryptionType EncryptConfig::encryptSensitiveProperties() const { + encryptSensitiveProperties(keys_); + if (keys_.old_key) { + return EncryptionType::RE_ENCRYPT; } + return EncryptionType::ENCRYPT; +} - if (argc >= 3) { - for (int i = 1; i < argc; ++i) { - std::string argstr(argv[i]); - if ((argstr == "-m") || (argstr == "--minifi-home")) { - if (i+1 < argc) { - return std::string(argv[i+1]); - } - } - } +void EncryptConfig::encryptFlowConfig() const { + encrypt_config::ConfigFile properties_file{std::ifstream{propertiesFilePath()}}; + utils::optional<std::string> config_path = properties_file.getValue(Configure::nifi_flow_configuration_file); + if (!config_path) { + config_path = utils::file::PathUtils::resolve(minifi_home_, "conf/config.yml"); + std::cout << "Couldn't find path of configuration file, using default: \"" << *config_path << "\"\n"; + } else { + config_path = utils::file::PathUtils::resolve(minifi_home_, *config_path); + std::cout << "Encrypting flow configuration file: \"" << *config_path << "\"\n"; + } + std::string config_content; + try { + std::ifstream config_file{*config_path, std::ios::binary}; + config_file.exceptions(std::ios::failbit | std::ios::badbit); + config_content = std::string{std::istreambuf_iterator<char>(config_file), {}}; + } catch (...) { + std::cerr << "Error while reading flow configuration file \"" << *config_path << "\"\n"; + throw; } + try { + utils::crypto::decrypt(config_content, keys_.encryption_key); + std::cout << "Flow config file is already properly encrypted.\n"; Review comment: Do we also provide an option to encrypt it improperly? :) ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
