You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by "ASF GitHub Bot (JIRA)" <ji...@apache.org> on 2016/06/08 02:48:20 UTC
[jira] [Commented] (NIFI-1981) Cluster communication requires
client certificates even if needClientAuth set to false
[ https://issues.apache.org/jira/browse/NIFI-1981?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15319888#comment-15319888 ]
ASF GitHub Bot commented on NIFI-1981:
--------------------------------------
GitHub user alopresto opened a pull request:
https://github.com/apache/nifi/pull/508
NIFI-1981 Cluster communication without client certificate
This PR resolves an issue where cluster communications were failing when the node sent a heartbeat without a client certificate chain because `nifi.security.needClientAuth` was set to false on the NCM. Even though the TLS negotiation did not require or expect a client certificate and the handshake was successful, the NiFi code in `SocketProtocolListener` immediately attempted to determine the incoming node's DN from the certificate, which was missing, and thus `SSLSocketImpl` threw an `SSLPeerNotVerifiedException` saying "peer not authenticated".
With this patch, the NCM will now respect the `needClientAuth` setting when attempting to extract the node DN.
This PR is targeted to the `0.x` branch as this is where the issue was discovered and does not merge cleanly with the `master` branch. These changes will need to be selectively merged to the `master` branch.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/alopresto/nifi NIFI-1981
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/nifi/pull/508.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #508
----
commit 2c463d13cf9d25ab4af283abb00a88942b2d2f12
Author: Andy LoPresto <al...@apache.org>
Date: 2016-06-07T23:19:02Z
NIFI-1981 Added ClientAuth enum and CertificateUtil methods to extract this setting from an SSLSocket.
Added logic to compare X509Certificate DNs regardless of RDN element order.
Added logic to suppress peer certificate exceptions when client authentication is not required.
commit ace35a23e1b13519b38cdd41839af11f32e4b9d2
Author: Andy LoPresto <al...@apache.org>
Date: 2016-06-08T00:01:37Z
NIFI-1981 Added test scope dependency on BouncyCastle and BC PKIX modules for CertificateUtils tests.
commit b50f473d1a65376c8f501b306f3aa0de9c34a81c
Author: Andy LoPresto <al...@apache.org>
Date: 2016-06-08T00:02:47Z
NIFI-1981 Finished logic to suppress exception on missing client certificates when clientAuth is set to WANT.
Added unit tests for CertificateUtil methods.
commit 4c3b17418b1740182617753865aaf7fd71a28f9b
Author: Andy LoPresto <al...@apache.org>
Date: 2016-06-08T00:39:01Z
NIFI-1981 Lowered logging level of client auth setting on cluster connection receive.
commit 42ddc78933c64d14ca991f99f8ca2b7c7840488b
Author: Andy LoPresto <al...@apache.org>
Date: 2016-06-08T01:15:12Z
NIFI-1981 Fixed IDE setting for import wildcarding on Groovy files.
----
> Cluster communication requires client certificates even if needClientAuth set to false
> --------------------------------------------------------------------------------------
>
> Key: NIFI-1981
> URL: https://issues.apache.org/jira/browse/NIFI-1981
> Project: Apache NiFi
> Issue Type: Bug
> Components: Core Framework
> Affects Versions: 0.6.1
> Reporter: Andy LoPresto
> Assignee: Andy LoPresto
> Priority: Critical
> Labels: certificate, client-auth, cluster, ssl, tls
> Fix For: 1.0.0, 0.7.0
>
>
> A user reported having issues with "peer not authenticated" errors appearing in the NCM app log when a node tried to connect. Upon debugging, it was discovered that the certificates issues to the client specifically prohibited being used as a client certificate ({{Extended Key Usage}} was set to {{serverAuth}} only). Setting {{nifi.security.needClientAuth}} to {{false}} in {{nifi.properties}} did not solve the problem because while the TLS handshake negotiation is successful without the client certificate, cluster communication in {{SocketProtocolListener}} still attempts to resolve the DN of the node requestor regardless of the {{needClientAuth}} setting.
> The error message should be improved and the requestor DN extraction should respect the {{needClientAuth}} setting rather than throwing an unnecessary exception.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)