This is an automated email from the ASF dual-hosted git repository. szaszm pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/nifi-minifi-cpp.git
commit 0f6cabc75146727262252c3d70a3d09330be1864 Author: Gabor Gyimesi <[email protected]> AuthorDate: Thu Apr 20 18:26:51 2023 +0200 MINIFICPP-2037 Build SSLContext from minifi.properties for SSL communication on C2 Closes #1539 Signed-off-by: Marton Szasz <[email protected]> --- docker/test/integration/MiNiFi_integration_test_driver.py | 3 +++ docker/test/integration/cluster/ContainerStore.py | 3 +++ docker/test/integration/cluster/DockerTestCluster.py | 3 +++ docker/test/integration/cluster/containers/MinifiContainer.py | 8 ++++++++ docker/test/integration/features/minifi_c2_server.feature | 11 ++++++++++- docker/test/integration/steps/steps.py | 6 ++++++ extensions/http-curl/protocols/RESTSender.cpp | 7 +++++++ 7 files changed, 40 insertions(+), 1 deletion(-) diff --git a/docker/test/integration/MiNiFi_integration_test_driver.py b/docker/test/integration/MiNiFi_integration_test_driver.py index 56ce946cb..981b0802c 100644 --- a/docker/test/integration/MiNiFi_integration_test_driver.py +++ b/docker/test/integration/MiNiFi_integration_test_driver.py @@ -318,6 +318,9 @@ class MiNiFi_integration_test: def fetch_flow_config_from_c2_url_in_minifi(self): self.cluster.fetch_flow_config_from_c2_url_in_minifi() + def set_ssl_context_properties_in_minifi(self): + self.cluster.set_ssl_context_properties_in_minifi() + def enable_prometheus_in_minifi(self): self.cluster.enable_prometheus_in_minifi() diff --git a/docker/test/integration/cluster/ContainerStore.py b/docker/test/integration/cluster/ContainerStore.py index 8a2e3d847..a463a5e0c 100644 --- a/docker/test/integration/cluster/ContainerStore.py +++ b/docker/test/integration/cluster/ContainerStore.py @@ -154,6 +154,9 @@ class ContainerStore: def fetch_flow_config_from_c2_url_in_minifi(self): self.minifi_options.use_flow_config_from_url = True + def set_ssl_context_properties_in_minifi(self): + self.minifi_options.set_ssl_context_properties = True + def enable_prometheus_in_minifi(self): self.minifi_options.enable_prometheus = True diff --git a/docker/test/integration/cluster/DockerTestCluster.py b/docker/test/integration/cluster/DockerTestCluster.py index c71e04af5..0f71655a2 100644 --- a/docker/test/integration/cluster/DockerTestCluster.py +++ b/docker/test/integration/cluster/DockerTestCluster.py @@ -79,6 +79,9 @@ class DockerTestCluster: def fetch_flow_config_from_c2_url_in_minifi(self): self.container_store.fetch_flow_config_from_c2_url_in_minifi() + def set_ssl_context_properties_in_minifi(self): + self.container_store.set_ssl_context_properties_in_minifi() + def enable_prometheus_in_minifi(self): self.container_store.enable_prometheus_in_minifi() diff --git a/docker/test/integration/cluster/containers/MinifiContainer.py b/docker/test/integration/cluster/containers/MinifiContainer.py index def15df26..e784c647b 100644 --- a/docker/test/integration/cluster/containers/MinifiContainer.py +++ b/docker/test/integration/cluster/containers/MinifiContainer.py @@ -33,6 +33,7 @@ class MinifiOptions: self.enable_sql = False self.config_format = "json" self.use_flow_config_from_url = False + self.set_ssl_context_properties = False class MinifiContainer(FlowContainer): @@ -94,6 +95,13 @@ class MinifiContainer(FlowContainer): f.write("nifi.c2.agent.class=minifi-test-class\n") f.write("nifi.c2.agent.identifier=minifi-test-id\n") + if self.options.set_ssl_context_properties: + f.write("nifi.remote.input.secure=true\n") + f.write("nifi.security.client.certificate=/tmp/resources/minifi-c2-server-ssl/minifi-cpp-flow.crt\n") + f.write("nifi.security.client.private.key=/tmp/resources/minifi-c2-server-ssl/minifi-cpp-flow.key\n") + f.write("nifi.security.client.pass.phrase=abcdefgh\n") + f.write("nifi.security.client.ca.certificate=/tmp/resources/minifi-c2-server-ssl/root-ca.pem\n") + if not self.options.enable_provenance: f.write("nifi.provenance.repository.class.name=NoOpRepository\n") diff --git a/docker/test/integration/features/minifi_c2_server.feature b/docker/test/integration/features/minifi_c2_server.feature index d4e7e11bf..24dc491c5 100644 --- a/docker/test/integration/features/minifi_c2_server.feature +++ b/docker/test/integration/features/minifi_c2_server.feature @@ -27,7 +27,7 @@ Feature: MiNiFi can communicate with Apache NiFi MiNiFi C2 server Then the MiNiFi C2 server logs contain the following message: "acknowledged with a state of FULLY_APPLIED(DONE)" in less than 30 seconds And a flowfile with the content "test" is placed in the monitored directory in less than 10 seconds - Scenario: MiNiFi flow config is updated from MiNiFi C2 server through SSL + Scenario: MiNiFi flow config is updated from MiNiFi C2 server through SSL with SSL controller service Given a file with the content "test" is present in "/tmp/input" And a ssl context service is set up for MiNiFi C2 server And a MiNiFi C2 server is set up with SSL @@ -43,3 +43,12 @@ Feature: MiNiFi can communicate with Apache NiFi MiNiFi C2 server When all instances start up Then the MiNiFi C2 server logs contain the following message: "acknowledged with a state of FULLY_APPLIED(DONE)" in less than 30 seconds And a flowfile with the content "test" is placed in the monitored directory in less than 10 seconds + + Scenario: MiNiFi flow config is updated from MiNiFi C2 server through SSL with SSL properties + Given a file with the content "test" is present in "/tmp/input" + And a GenerateFlowFile processor + And a ssl properties are set up for MiNiFi C2 server + And a MiNiFi C2 server is set up with SSL + When all instances start up + Then the MiNiFi C2 SSL server logs contain the following message: "acknowledged with a state of FULLY_APPLIED(DONE)" in less than 60 seconds + And a flowfile with the content "test" is placed in the monitored directory in less than 10 seconds diff --git a/docker/test/integration/steps/steps.py b/docker/test/integration/steps/steps.py index bcc78ffcc..83baf1d44 100644 --- a/docker/test/integration/steps/steps.py +++ b/docker/test/integration/steps/steps.py @@ -1008,6 +1008,12 @@ def step_impl(context): context.test.enable_c2_with_ssl_in_minifi() +@given("a ssl properties are set up for MiNiFi C2 server") +def step_impl(context): + context.test.enable_c2_with_ssl_in_minifi() + context.test.set_ssl_context_properties_in_minifi() + + @given(u'a MiNiFi C2 server is set up') def step_impl(context): context.test.acquire_container("minifi-c2-server", "minifi-c2-server") diff --git a/extensions/http-curl/protocols/RESTSender.cpp b/extensions/http-curl/protocols/RESTSender.cpp index 5eb8c2d8f..0d188af84 100644 --- a/extensions/http-curl/protocols/RESTSender.cpp +++ b/extensions/http-curl/protocols/RESTSender.cpp @@ -50,6 +50,13 @@ void RESTSender::initialize(core::controller::ControllerServiceProvider* control ssl_context_service_ = std::static_pointer_cast<minifi::controllers::SSLContextService>(service); } } + if (nullptr == ssl_context_service_) { + std::string ssl_context_str; + if (configure->get(Configure::nifi_remote_input_secure, ssl_context_str) && org::apache::nifi::minifi::utils::StringUtils::toBool(ssl_context_str).value_or(false)) { + ssl_context_service_ = std::make_shared<minifi::controllers::SSLContextService>("RESTSenderSSL", configure); + ssl_context_service_->onEnable(); + } + } if (auto req_encoding_str = configure->get(Configuration::nifi_c2_rest_request_encoding)) { if (auto req_encoding = RequestEncoding::parse(req_encoding_str->c_str(), RequestEncoding{}, false)) { logger_->log_debug("Using request encoding '%s'", req_encoding.toString());
