You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by "ASF subversion and git services (JIRA)" <ji...@apache.org> on 2018/08/07 03:03:00 UTC
[jira] [Commented] (NIFI-5400) NiFiHostnameVerifier should be
replaced
[ https://issues.apache.org/jira/browse/NIFI-5400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16571066#comment-16571066 ]
ASF subversion and git services commented on NIFI-5400:
-------------------------------------------------------
Commit 8106af699c4dba21c03b1d8ba6c3e702dc7b1380 in nifi's branch refs/heads/master from thenatog
[ https://git-wip-us.apache.org/repos/asf?p=nifi.git;h=8106af6 ]
NIFI-5400 - Changed the hostname verifier from the custom NiFi verifier to the Apache http-client DefaultHostnameVerifier
Removed NiFiHostnameVerifier. Removed NiFi WebUtils usage of NiFiHostnameVerifier.
Added unit tests for the DefaultHostnameVerifier to WebUtils.java
Added groovy-eclipse-compiler definition to nifi-web-utils/pom.xml to execute Groovy unit tests.
This closes #2919.
Co-authored-by: Andy LoPresto <al...@apache.org>
Signed-off-by: Andy LoPresto <al...@apache.org>
> NiFiHostnameVerifier should be replaced
> ---------------------------------------
>
> Key: NIFI-5400
> URL: https://issues.apache.org/jira/browse/NIFI-5400
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Core Framework
> Affects Versions: 1.7.0
> Reporter: Andy LoPresto
> Priority: Major
> Labels: certificate, hostname, security, tls
>
> The {{NiFiHostnameVerifier}} does not handle wildcard certificates or complex {{SubjectAlternativeNames}}. It should be replaced with a more full-featured implementation, like {{OkHostnameVerifier}} from {{okhttp}} or {{DefaultHostnameVerifier}} from {{http-client}}. Either of these options requires introducing a new Maven dependency to {{nifi-commons}} and requires further investigation.
> *Note: * the {{sun.net.www.protocol.httpsDefaultHostnameVerifier}} simply returns {{false}} on all inputs and is not a valid solution.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)