You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by sz...@apache.org on 2023/04/20 16:34:52 UTC
[nifi-minifi-cpp] 03/03: MINIFICPP-2037 Build SSLContext from minifi.properties for SSL communication on C2
This is an automated email from the ASF dual-hosted git repository.
szaszm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi-minifi-cpp.git
commit 0f6cabc75146727262252c3d70a3d09330be1864
Author: Gabor Gyimesi <ga...@gmail.com>
AuthorDate: Thu Apr 20 18:26:51 2023 +0200
MINIFICPP-2037 Build SSLContext from minifi.properties for SSL communication on C2
Closes #1539
Signed-off-by: Marton Szasz <sz...@apache.org>
---
docker/test/integration/MiNiFi_integration_test_driver.py | 3 +++
docker/test/integration/cluster/ContainerStore.py | 3 +++
docker/test/integration/cluster/DockerTestCluster.py | 3 +++
docker/test/integration/cluster/containers/MinifiContainer.py | 8 ++++++++
docker/test/integration/features/minifi_c2_server.feature | 11 ++++++++++-
docker/test/integration/steps/steps.py | 6 ++++++
extensions/http-curl/protocols/RESTSender.cpp | 7 +++++++
7 files changed, 40 insertions(+), 1 deletion(-)
diff --git a/docker/test/integration/MiNiFi_integration_test_driver.py b/docker/test/integration/MiNiFi_integration_test_driver.py
index 56ce946cb..981b0802c 100644
--- a/docker/test/integration/MiNiFi_integration_test_driver.py
+++ b/docker/test/integration/MiNiFi_integration_test_driver.py
@@ -318,6 +318,9 @@ class MiNiFi_integration_test:
def fetch_flow_config_from_c2_url_in_minifi(self):
self.cluster.fetch_flow_config_from_c2_url_in_minifi()
+ def set_ssl_context_properties_in_minifi(self):
+ self.cluster.set_ssl_context_properties_in_minifi()
+
def enable_prometheus_in_minifi(self):
self.cluster.enable_prometheus_in_minifi()
diff --git a/docker/test/integration/cluster/ContainerStore.py b/docker/test/integration/cluster/ContainerStore.py
index 8a2e3d847..a463a5e0c 100644
--- a/docker/test/integration/cluster/ContainerStore.py
+++ b/docker/test/integration/cluster/ContainerStore.py
@@ -154,6 +154,9 @@ class ContainerStore:
def fetch_flow_config_from_c2_url_in_minifi(self):
self.minifi_options.use_flow_config_from_url = True
+ def set_ssl_context_properties_in_minifi(self):
+ self.minifi_options.set_ssl_context_properties = True
+
def enable_prometheus_in_minifi(self):
self.minifi_options.enable_prometheus = True
diff --git a/docker/test/integration/cluster/DockerTestCluster.py b/docker/test/integration/cluster/DockerTestCluster.py
index c71e04af5..0f71655a2 100644
--- a/docker/test/integration/cluster/DockerTestCluster.py
+++ b/docker/test/integration/cluster/DockerTestCluster.py
@@ -79,6 +79,9 @@ class DockerTestCluster:
def fetch_flow_config_from_c2_url_in_minifi(self):
self.container_store.fetch_flow_config_from_c2_url_in_minifi()
+ def set_ssl_context_properties_in_minifi(self):
+ self.container_store.set_ssl_context_properties_in_minifi()
+
def enable_prometheus_in_minifi(self):
self.container_store.enable_prometheus_in_minifi()
diff --git a/docker/test/integration/cluster/containers/MinifiContainer.py b/docker/test/integration/cluster/containers/MinifiContainer.py
index def15df26..e784c647b 100644
--- a/docker/test/integration/cluster/containers/MinifiContainer.py
+++ b/docker/test/integration/cluster/containers/MinifiContainer.py
@@ -33,6 +33,7 @@ class MinifiOptions:
self.enable_sql = False
self.config_format = "json"
self.use_flow_config_from_url = False
+ self.set_ssl_context_properties = False
class MinifiContainer(FlowContainer):
@@ -94,6 +95,13 @@ class MinifiContainer(FlowContainer):
f.write("nifi.c2.agent.class=minifi-test-class\n")
f.write("nifi.c2.agent.identifier=minifi-test-id\n")
+ if self.options.set_ssl_context_properties:
+ f.write("nifi.remote.input.secure=true\n")
+ f.write("nifi.security.client.certificate=/tmp/resources/minifi-c2-server-ssl/minifi-cpp-flow.crt\n")
+ f.write("nifi.security.client.private.key=/tmp/resources/minifi-c2-server-ssl/minifi-cpp-flow.key\n")
+ f.write("nifi.security.client.pass.phrase=abcdefgh\n")
+ f.write("nifi.security.client.ca.certificate=/tmp/resources/minifi-c2-server-ssl/root-ca.pem\n")
+
if not self.options.enable_provenance:
f.write("nifi.provenance.repository.class.name=NoOpRepository\n")
diff --git a/docker/test/integration/features/minifi_c2_server.feature b/docker/test/integration/features/minifi_c2_server.feature
index d4e7e11bf..24dc491c5 100644
--- a/docker/test/integration/features/minifi_c2_server.feature
+++ b/docker/test/integration/features/minifi_c2_server.feature
@@ -27,7 +27,7 @@ Feature: MiNiFi can communicate with Apache NiFi MiNiFi C2 server
Then the MiNiFi C2 server logs contain the following message: "acknowledged with a state of FULLY_APPLIED(DONE)" in less than 30 seconds
And a flowfile with the content "test" is placed in the monitored directory in less than 10 seconds
- Scenario: MiNiFi flow config is updated from MiNiFi C2 server through SSL
+ Scenario: MiNiFi flow config is updated from MiNiFi C2 server through SSL with SSL controller service
Given a file with the content "test" is present in "/tmp/input"
And a ssl context service is set up for MiNiFi C2 server
And a MiNiFi C2 server is set up with SSL
@@ -43,3 +43,12 @@ Feature: MiNiFi can communicate with Apache NiFi MiNiFi C2 server
When all instances start up
Then the MiNiFi C2 server logs contain the following message: "acknowledged with a state of FULLY_APPLIED(DONE)" in less than 30 seconds
And a flowfile with the content "test" is placed in the monitored directory in less than 10 seconds
+
+ Scenario: MiNiFi flow config is updated from MiNiFi C2 server through SSL with SSL properties
+ Given a file with the content "test" is present in "/tmp/input"
+ And a GenerateFlowFile processor
+ And a ssl properties are set up for MiNiFi C2 server
+ And a MiNiFi C2 server is set up with SSL
+ When all instances start up
+ Then the MiNiFi C2 SSL server logs contain the following message: "acknowledged with a state of FULLY_APPLIED(DONE)" in less than 60 seconds
+ And a flowfile with the content "test" is placed in the monitored directory in less than 10 seconds
diff --git a/docker/test/integration/steps/steps.py b/docker/test/integration/steps/steps.py
index bcc78ffcc..83baf1d44 100644
--- a/docker/test/integration/steps/steps.py
+++ b/docker/test/integration/steps/steps.py
@@ -1008,6 +1008,12 @@ def step_impl(context):
context.test.enable_c2_with_ssl_in_minifi()
+@given("a ssl properties are set up for MiNiFi C2 server")
+def step_impl(context):
+ context.test.enable_c2_with_ssl_in_minifi()
+ context.test.set_ssl_context_properties_in_minifi()
+
+
@given(u'a MiNiFi C2 server is set up')
def step_impl(context):
context.test.acquire_container("minifi-c2-server", "minifi-c2-server")
diff --git a/extensions/http-curl/protocols/RESTSender.cpp b/extensions/http-curl/protocols/RESTSender.cpp
index 5eb8c2d8f..0d188af84 100644
--- a/extensions/http-curl/protocols/RESTSender.cpp
+++ b/extensions/http-curl/protocols/RESTSender.cpp
@@ -50,6 +50,13 @@ void RESTSender::initialize(core::controller::ControllerServiceProvider* control
ssl_context_service_ = std::static_pointer_cast<minifi::controllers::SSLContextService>(service);
}
}
+ if (nullptr == ssl_context_service_) {
+ std::string ssl_context_str;
+ if (configure->get(Configure::nifi_remote_input_secure, ssl_context_str) && org::apache::nifi::minifi::utils::StringUtils::toBool(ssl_context_str).value_or(false)) {
+ ssl_context_service_ = std::make_shared<minifi::controllers::SSLContextService>("RESTSenderSSL", configure);
+ ssl_context_service_->onEnable();
+ }
+ }
if (auto req_encoding_str = configure->get(Configuration::nifi_c2_rest_request_encoding)) {
if (auto req_encoding = RequestEncoding::parse(req_encoding_str->c_str(), RequestEncoding{}, false)) {
logger_->log_debug("Using request encoding '%s'", req_encoding.toString());