You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by al...@apache.org on 2018/02/10 01:45:44 UTC
nifi git commit: NIFI-3367 Added token length check and unit test.
Repository: nifi
Updated Branches:
refs/heads/master 61c6f0305 -> b7fdb235e
NIFI-3367 Added token length check and unit test.
This closes #2463.
Signed-off-by: Andy LoPresto <al...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/nifi/repo
Commit: http://git-wip-us.apache.org/repos/asf/nifi/commit/b7fdb235
Tree: http://git-wip-us.apache.org/repos/asf/nifi/tree/b7fdb235
Diff: http://git-wip-us.apache.org/repos/asf/nifi/diff/b7fdb235
Branch: refs/heads/master
Commit: b7fdb235ee1055e24fdb3ac000cc8039751199ad
Parents: 61c6f03
Author: Lori Buettner <lo...@gmail.com>
Authored: Sat Feb 10 00:46:33 2018 +0000
Committer: Andy LoPresto <al...@apache.org>
Committed: Fri Feb 9 17:43:41 2018 -0800
----------------------------------------------------------------------
.../apache/nifi/toolkit/tls/util/TlsHelper.java | 19 ++++++----
...sCertificateSigningRequestPerformerTest.java | 2 +-
...sCertificateAuthorityServiceHandlerTest.java | 2 +-
.../nifi/toolkit/tls/util/TlsHelperTest.java | 37 +++++++++++++++++++-
4 files changed, 51 insertions(+), 9 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/nifi/blob/b7fdb235/nifi-toolkit/nifi-toolkit-tls/src/main/java/org/apache/nifi/toolkit/tls/util/TlsHelper.java
----------------------------------------------------------------------
diff --git a/nifi-toolkit/nifi-toolkit-tls/src/main/java/org/apache/nifi/toolkit/tls/util/TlsHelper.java b/nifi-toolkit/nifi-toolkit-tls/src/main/java/org/apache/nifi/toolkit/tls/util/TlsHelper.java
index d1d93e4..1dee905 100644
--- a/nifi-toolkit/nifi-toolkit-tls/src/main/java/org/apache/nifi/toolkit/tls/util/TlsHelper.java
+++ b/nifi-toolkit/nifi-toolkit-tls/src/main/java/org/apache/nifi/toolkit/tls/util/TlsHelper.java
@@ -100,7 +100,7 @@ public class TlsHelper {
logger.warn("resulting client certificate: " + fileToString);
logger.warn("");
logger.warn("openssl pkcs12 -in '" + fileToString + "' -out '/tmp/" + fileName + "'");
- logger.warn("openssl pkcs12 -export -in '/tmp/" + fileName + "' -out '" + fileToString + "'");
+ logger.warn("openssl pkcs12 -export -in '/tmp/" + fileName + "' -out '" + fileToString + "'");
logger.warn("rm -f '/tmp/" + fileName + "'");
logger.warn("");
logger.warn("**********************************************************************************");
@@ -146,7 +146,14 @@ public class TlsHelper {
}
public static byte[] calculateHMac(String token, PublicKey publicKey) throws GeneralSecurityException {
- SecretKeySpec keySpec = new SecretKeySpec(token.getBytes(StandardCharsets.UTF_8), "RAW");
+ if (token == null) {
+ throw new IllegalArgumentException("Token cannot be null");
+ }
+ byte[] tokenBytes = token.getBytes(StandardCharsets.UTF_8);
+ if (tokenBytes.length < 16) {
+ throw new GeneralSecurityException("Token does not meet minimum size of 16 bytes.");
+ }
+ SecretKeySpec keySpec = new SecretKeySpec(tokenBytes, "RAW");
Mac mac = Mac.getInstance("Hmac-SHA256", BouncyCastleProvider.PROVIDER_NAME);
mac.init(keySpec);
return mac.doFinal(getKeyIdentifier(publicKey));
@@ -197,7 +204,7 @@ public class TlsHelper {
}
public static JcaPKCS10CertificationRequest generateCertificationRequest(String requestedDn, String domainAlternativeNames,
- KeyPair keyPair, String signingAlgorithm) throws OperatorCreationException {
+ KeyPair keyPair, String signingAlgorithm) throws OperatorCreationException {
JcaPKCS10CertificationRequestBuilder jcaPKCS10CertificationRequestBuilder = new JcaPKCS10CertificationRequestBuilder(new X500Name(requestedDn), keyPair.getPublic());
// add Subject Alternative Name(s)
@@ -221,13 +228,13 @@ public class TlsHelper {
throw new IOException("Failed to extract CN from request DN: " + requestedDn, e);
}
- if(StringUtils.isNotBlank(domainAlternativeNames)) {
- for(String alternativeName : domainAlternativeNames.split(",")) {
+ if (StringUtils.isNotBlank(domainAlternativeNames)) {
+ for (String alternativeName : domainAlternativeNames.split(",")) {
namesList.add(new GeneralName(GeneralName.dNSName, alternativeName));
}
}
- GeneralNames subjectAltNames = new GeneralNames(namesList.toArray(new GeneralName [] {}));
+ GeneralNames subjectAltNames = new GeneralNames(namesList.toArray(new GeneralName[]{}));
ExtensionsGenerator extGen = new ExtensionsGenerator();
extGen.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);
return extGen.generate();
http://git-wip-us.apache.org/repos/asf/nifi/blob/b7fdb235/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/service/client/TlsCertificateSigningRequestPerformerTest.java
----------------------------------------------------------------------
diff --git a/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/service/client/TlsCertificateSigningRequestPerformerTest.java b/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/service/client/TlsCertificateSigningRequestPerformerTest.java
index fb20739..5ecb3b1 100644
--- a/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/service/client/TlsCertificateSigningRequestPerformerTest.java
+++ b/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/service/client/TlsCertificateSigningRequestPerformerTest.java
@@ -95,7 +95,7 @@ public class TlsCertificateSigningRequestPerformerTest {
objectMapper = new ObjectMapper();
keyPair = TlsHelper.generateKeyPair(TlsConfig.DEFAULT_KEY_PAIR_ALGORITHM, TlsConfig.DEFAULT_KEY_SIZE);
- testToken = "testToken";
+ testToken = "testTokenTestToken";
testCaHostname = "testCaHostname";
testPort = 8993;
certificates = new ArrayList<>();
http://git-wip-us.apache.org/repos/asf/nifi/blob/b7fdb235/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/service/server/TlsCertificateAuthorityServiceHandlerTest.java
----------------------------------------------------------------------
diff --git a/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/service/server/TlsCertificateAuthorityServiceHandlerTest.java b/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/service/server/TlsCertificateAuthorityServiceHandlerTest.java
index 00c5ec8..b9b6945 100644
--- a/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/service/server/TlsCertificateAuthorityServiceHandlerTest.java
+++ b/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/service/server/TlsCertificateAuthorityServiceHandlerTest.java
@@ -98,7 +98,7 @@ public class TlsCertificateAuthorityServiceHandlerTest {
@Before
public void setup() throws Exception {
- testToken = "testToken";
+ testToken = "testTokenTestToken";
testPemEncodedSignedCertificate = "testPemEncodedSignedCertificate";
keyPair = TlsHelper.generateKeyPair(TlsConfig.DEFAULT_KEY_PAIR_ALGORITHM, TlsConfig.DEFAULT_KEY_SIZE);
objectMapper = new ObjectMapper();
http://git-wip-us.apache.org/repos/asf/nifi/blob/b7fdb235/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/util/TlsHelperTest.java
----------------------------------------------------------------------
diff --git a/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/util/TlsHelperTest.java b/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/util/TlsHelperTest.java
index 9e23496..91da17a 100644
--- a/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/util/TlsHelperTest.java
+++ b/nifi-toolkit/nifi-toolkit-tls/src/test/java/org/apache/nifi/toolkit/tls/util/TlsHelperTest.java
@@ -43,6 +43,7 @@ import java.security.KeyStoreSpi;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.Provider;
+import java.security.PublicKey;
import java.security.SignatureException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
@@ -52,7 +53,6 @@ import java.util.Date;
import java.util.List;
import java.util.concurrent.TimeUnit;
import java.util.stream.Collectors;
-
import org.apache.commons.lang3.StringUtils;
import org.apache.nifi.security.util.CertificateUtils;
import org.apache.nifi.toolkit.tls.configuration.TlsConfig;
@@ -172,6 +172,41 @@ public class TlsHelperTest {
}
@Test
+ public void testTokenLengthInCalculateHmac() throws CertificateException, NoSuchAlgorithmException {
+ List<String> badTokens = new ArrayList<>();
+ List<String> goodTokens = new ArrayList<>();
+ badTokens.add(null);
+ badTokens.add("");
+ badTokens.add("123");
+ goodTokens.add("0123456789abcdefghijklm");
+ goodTokens.add("0123456789abcdef");
+
+ String dn = "CN=testDN,O=testOrg";
+ X509Certificate x509Certificate = CertificateUtils.generateSelfSignedX509Certificate(TlsHelper.generateKeyPair(keyPairAlgorithm, keySize), dn, signingAlgorithm, days);
+ PublicKey pubKey = x509Certificate.getPublicKey();
+
+ for (String token : badTokens) {
+ try {
+ TlsHelper.calculateHMac(token, pubKey);
+ fail("HMAC was calculated with a token that was too short.");
+ } catch (GeneralSecurityException e) {
+ assertEquals("Token does not meet minimum size of 16 bytes.", e.getMessage());
+ } catch (IllegalArgumentException e) {
+ assertEquals("Token cannot be null", e.getMessage());
+ }
+ }
+
+ for (String token : goodTokens) {
+ try {
+ byte[] hmac = TlsHelper.calculateHMac(token, pubKey);
+ assertTrue("HMAC length ok", hmac.length > 0);
+ } catch (GeneralSecurityException e) {
+ fail(e.getMessage());
+ }
+ }
+ }
+
+ @Test
public void testGenerateSelfSignedCert() throws GeneralSecurityException, IOException, OperatorCreationException {
String dn = "CN=testDN,O=testOrg";