You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@nifi.apache.org by brosander <gi...@git.apache.org> on 2016/10/27 21:32:50 UTC

[GitHub] nifi pull request #1165: NIFI-2943 - pkcs12 keystore improvements

GitHub user brosander opened a pull request:

    https://github.com/apache/nifi/pull/1165

    NIFI-2943 - pkcs12 keystore improvements

    Thank you for submitting a contribution to Apache NiFi.
    
    In order to streamline the review of the contribution we ask you
    to ensure the following steps have been taken:
    
    ### For all changes:
    - [x] Is there a JIRA ticket associated with this PR? Is it referenced 
         in the commit message?
    
    - [x] Does your PR title start with NIFI-XXXX where XXXX is the JIRA number you are trying to resolve? Pay particular attention to the hyphen "-" character.
    
    - [x] Has your PR been rebased against the latest commit within the target branch (typically master)?
    
    - [x] Is your initial contribution a single, squashed commit?
    
    ### For code changes:
    - [x] Have you ensured that the full suite of tests is executed via mvn -Pcontrib-check clean install at the root nifi folder?
    - [x] Have you written or updated unit tests to verify your changes?
    - [x] N/A - If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)? 
    - [x] N/A - If applicable, have you updated the LICENSE file, including the main LICENSE file under nifi-assembly?
    - [x] N/A - If applicable, have you updated the NOTICE file, including the main NOTICE file found under nifi-assembly?
    - [x] N/A - If adding new Properties, have you added .displayName in addition to .name (programmatic access) for each of the new properties?
    
    ### For documentation related changes:
    - [x] Have you ensured that format looks appropriate for the output in which it is rendered?
    
    ### Note:
    Please ensure that once the PR is submitted, you check travis-ci for build issues and submit an update to your PR as soon as possible.
    
    1. loading pkcs12 keystores with bouncy castle everywhere
    2. tls-toolkit client using jks truststore when keystore type is specified differently
    3. tests

You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/brosander/nifi NIFI-2943

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/nifi/pull/1165.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #1165
    
----
commit ee6d791a87a875319e748a8cab05a0961d1ff561
Author: Bryan Rosander <br...@apache.org>
Date:   2016-10-27T14:27:06Z

    NIFI-2943 - pkcs12 keystore improvements
    
    1. loading pkcs12 keystores with bouncy castle everywhere
    2. tls-toolkit client using jks truststore when keystore type is specified differently
    3. tests

----


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] nifi pull request #1165: NIFI-2943 - pkcs12 keystore improvements

Posted by brosander <gi...@git.apache.org>.

Github user brosander commented on a diff in the pull request:

    https://github.com/apache/nifi/pull/1165#discussion_r88056091
  
    --- Diff: nifi-commons/nifi-security-utils/src/main/java/org/apache/nifi/security/util/KeyStoreUtils.java ---
    @@ -0,0 +1,62 @@
    +/*
    + * Licensed to the Apache Software Foundation (ASF) under one or more
    + * contributor license agreements.  See the NOTICE file distributed with
    + * this work for additional information regarding copyright ownership.
    + * The ASF licenses this file to You under the Apache License, Version 2.0
    + * (the "License"); you may not use this file except in compliance with
    + * the License.  You may obtain a copy of the License at
    + *
    + *     http://www.apache.org/licenses/LICENSE-2.0
    + *
    + * Unless required by applicable law or agreed to in writing, software
    + * distributed under the License is distributed on an "AS IS" BASIS,
    + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    + * See the License for the specific language governing permissions and
    + * limitations under the License.
    + */
    +
    +package org.apache.nifi.security.util;
    +
    +import org.apache.commons.lang3.StringUtils;
    +import org.bouncycastle.jce.provider.BouncyCastleProvider;
    +import org.slf4j.Logger;
    +import org.slf4j.LoggerFactory;
    +
    +import java.security.KeyStore;
    +import java.security.KeyStoreException;
    +import java.security.Security;
    +
    +public class KeyStoreUtils {
    +    private static final Logger logger = LoggerFactory.getLogger(KeyStoreUtils.class);
    +
    +    static {
    +        Security.addProvider(new BouncyCastleProvider());
    +    }
    +
    +    public static String getKeyStoreProvider(String keyStoreType) {
    +        if (KeystoreType.PKCS12.toString().equalsIgnoreCase(keyStoreType)) {
    +            return BouncyCastleProvider.PROVIDER_NAME;
    +        }
    +        return null;
    +    }
    +
    +    public static KeyStore getKeyStore(String keyStoreType) throws KeyStoreException {
    +        String keyStoreProvider = getKeyStoreProvider(keyStoreType);
    +        if (StringUtils.isNoneEmpty(keyStoreProvider)) {
    --- End diff --
    
    autocomplete fail, will address


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] nifi pull request #1165: NIFI-2943 - pkcs12 keystore improvements

Posted by brosander <gi...@git.apache.org>.

Github user brosander commented on a diff in the pull request:

    https://github.com/apache/nifi/pull/1165#discussion_r88102064
  
    --- Diff: nifi-toolkit/nifi-toolkit-tls/src/main/java/org/apache/nifi/toolkit/tls/commandLine/BaseCommandLine.java ---
    @@ -202,6 +206,10 @@ protected CommandLine doParse(String[] args) throws CommandLineParseException {
                 keySize = getIntValue(commandLine, KEY_SIZE_ARG, TlsConfig.DEFAULT_KEY_SIZE);
                 keyAlgorithm = commandLine.getOptionValue(KEY_ALGORITHM_ARG, TlsConfig.DEFAULT_KEY_PAIR_ALGORITHM);
                 keyStoreType = commandLine.getOptionValue(KEY_STORE_TYPE_ARG, getKeyStoreTypeDefault());
    +            if (KeystoreType.PKCS12.toString().equalsIgnoreCase(keyStoreType)) {
    +                logger.info("Command line argument --" + KEY_STORE_TYPE_ARG + "=" + keyStoreType + " only applies to keyStore, recommended trustStore type of " + KeystoreType.JKS.toString() +
    --- End diff --
    
    +1


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---