This is an automated email from the ASF dual-hosted git repository.
pvillard31 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git
The following commit(s) were added to refs/heads/main by this push:
new dd624f508fa NIFI-16420 Removed Security Protocol from Splunk
Processors (#11753)
dd624f508fa is described below
commit dd624f508fa3da8e61d203f95ac23d5442040196
Author: David Handermann <[email protected]>
AuthorDate: Mon Oct 5 04:52:26 2026 -0500
NIFI-16420 Removed Security Protocol from Splunk Processors (#11753)
---
.../apache/nifi/processors/splunk/GetSplunk.java | 44 +++++-----------------
.../nifi/processors/splunk/SplunkAPICall.java | 43 ++-------------------
.../nifi/processors/splunk/TestGetSplunk.java | 23 +++++------
.../nifi/processors/splunk/TestPutSplunkHTTP.java | 15 +-------
.../splunk/TestQuerySplunkIndexingStatus.java | 2 +
5 files changed, 26 insertions(+), 101 deletions(-)
diff --git
a/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/main/java/org/apache/nifi/processors/splunk/GetSplunk.java
b/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/main/java/org/apache/nifi/processors/splunk/GetSplunk.java
index 381e71dd690..213bc5778c7 100644
---
a/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/main/java/org/apache/nifi/processors/splunk/GetSplunk.java
+++
b/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/main/java/org/apache/nifi/processors/splunk/GetSplunk.java
@@ -18,7 +18,6 @@ package org.apache.nifi.processors.splunk;
import com.splunk.HttpException;
import com.splunk.JobExportArgs;
-import com.splunk.SSLSecurityProtocol;
import com.splunk.Service;
import com.splunk.ServiceArgs;
import org.apache.commons.io.IOUtils;
@@ -45,6 +44,7 @@ import org.apache.nifi.components.state.Scope;
import org.apache.nifi.components.state.StateMap;
import org.apache.nifi.context.PropertyContext;
import org.apache.nifi.flowfile.FlowFile;
+import org.apache.nifi.migration.PropertyConfiguration;
import org.apache.nifi.processor.AbstractProcessor;
import org.apache.nifi.processor.ProcessContext;
import org.apache.nifi.processor.ProcessSession;
@@ -263,18 +263,7 @@ public class GetSplunk extends AbstractProcessor
implements ClassloaderIsolation
.required(true)
.build();
- public static final AllowableValue TLS_1_2_VALUE = new
AllowableValue(SSLSecurityProtocol.TLSv1_2.name(),
SSLSecurityProtocol.TLSv1_2.name());
- public static final AllowableValue TLS_1_1_VALUE = new
AllowableValue(SSLSecurityProtocol.TLSv1_1.name(),
SSLSecurityProtocol.TLSv1_1.name());
- public static final AllowableValue TLS_1_VALUE = new
AllowableValue(SSLSecurityProtocol.TLSv1.name(),
SSLSecurityProtocol.TLSv1.name());
- public static final AllowableValue SSL_3_VALUE = new
AllowableValue(SSLSecurityProtocol.SSLv3.name(),
SSLSecurityProtocol.SSLv3.name());
-
- public static final PropertyDescriptor SECURITY_PROTOCOL = new
PropertyDescriptor.Builder()
- .name("Security Protocol")
- .description("The security protocol to use for communicating with
Splunk.")
- .addValidator(StandardValidators.NON_EMPTY_VALIDATOR)
- .allowableValues(TLS_1_2_VALUE, TLS_1_1_VALUE, TLS_1_VALUE,
SSL_3_VALUE)
- .defaultValue(TLS_1_2_VALUE.getValue())
- .build();
+ private static final String OBSOLETE_SECURITY_PROTOCOL = "Security
Protocol";
public static final PropertyDescriptor SSL_CONTEXT_SERVICE = new
PropertyDescriptor.Builder()
.name("SSL Context Service")
@@ -318,7 +307,6 @@ public class GetSplunk extends AbstractProcessor implements
ClassloaderIsolation
TOKEN,
USERNAME,
PASSWORD,
- SECURITY_PROTOCOL,
OUTPUT_MODE,
SSL_CONTEXT_SERVICE);
@@ -341,15 +329,6 @@ public class GetSplunk extends AbstractProcessor
implements ClassloaderIsolation
protected Collection<ValidationResult> customValidate(ValidationContext
validationContext) {
final Collection<ValidationResult> results = new ArrayList<>();
- final String scheme = validationContext.getProperty(SCHEME).getValue();
- final String secProtocol =
validationContext.getProperty(SECURITY_PROTOCOL).getValue();
-
- if (HTTPS_SCHEME.equals(scheme) && StringUtils.isBlank(secProtocol)) {
- results.add(new ValidationResult.Builder()
- .explanation("Security Protocol must be specified when
using HTTPS")
- .valid(false).subject("Security Protocol").build());
- }
-
final String username =
validationContext.getProperty(USERNAME).getValue();
final String password =
validationContext.getProperty(PASSWORD).getValue();
@@ -594,20 +573,10 @@ public class GetSplunk extends AbstractProcessor
implements ClassloaderIsolation
serviceArgs.setPassword(password);
}
- final String secProtocol =
context.getProperty(SECURITY_PROTOCOL).getValue();
- final SSLSecurityProtocol securityProtocol =
(!StringUtils.isBlank(secProtocol) && HTTPS_SCHEME.equals(scheme)) ?
SSLSecurityProtocol.valueOf(secProtocol) : null;
- if (securityProtocol != null) {
- serviceArgs.setSSLSecurityProtocol(securityProtocol);
- }
-
final SSLContextProvider sslContextProvider =
context.getProperty(SSL_CONTEXT_SERVICE).asControllerService(SSLContextProvider.class);
if (sslContextProvider != null) {
- // Constructing a Splunk Service applies the Security Protocol to
static configuration, and changing the protocol discards the
- // current Socket Factory. Applying the protocol first leaves the
configured Socket Factory in place once the Service connects.
- if (securityProtocol != null) {
- Service.setSslSecurityProtocol(securityProtocol);
- }
-
+ // Service construction reapplies the static security protocol and
replaces the Socket Factory when that protocol changes.
+ // Leaving the protocol unchanged keeps the Socket Factory
supplied by the SSL Context Service.
Service.setSSLSocketFactory(sslContextProvider.createContext().getSocketFactory());
}
@@ -650,6 +619,11 @@ public class GetSplunk extends AbstractProcessor
implements ClassloaderIsolation
}
}
+ @Override
+ public void migrateProperties(final PropertyConfiguration config) {
+ config.removeProperty(OBSOLETE_SECURITY_PROTOCOL);
+ }
+
@Override
public String getClassloaderIsolationKey(PropertyContext context) {
final SSLContextProvider sslContextProvider =
context.getProperty(SSL_CONTEXT_SERVICE).asControllerService(SSLContextProvider.class);
diff --git
a/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/main/java/org/apache/nifi/processors/splunk/SplunkAPICall.java
b/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/main/java/org/apache/nifi/processors/splunk/SplunkAPICall.java
index 184eeacfef1..e5c9c1b8810 100644
---
a/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/main/java/org/apache/nifi/processors/splunk/SplunkAPICall.java
+++
b/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/main/java/org/apache/nifi/processors/splunk/SplunkAPICall.java
@@ -21,13 +21,11 @@ import com.fasterxml.jackson.databind.ObjectMapper;
import com.splunk.HttpException;
import com.splunk.RequestMessage;
import com.splunk.ResponseMessage;
-import com.splunk.SSLSecurityProtocol;
import com.splunk.Service;
import com.splunk.ServiceArgs;
import org.apache.nifi.annotation.behavior.RequiresInstanceClassLoading;
import org.apache.nifi.annotation.lifecycle.OnScheduled;
import org.apache.nifi.annotation.lifecycle.OnStopped;
-import org.apache.nifi.components.AllowableValue;
import org.apache.nifi.components.ClassloaderIsolationKeyProvider;
import org.apache.nifi.components.PropertyDescriptor;
import org.apache.nifi.context.PropertyContext;
@@ -50,10 +48,7 @@ abstract class SplunkAPICall extends AbstractProcessor
implements ClassloaderIso
private static final String HTTP_SCHEME = "http";
private static final String HTTPS_SCHEME = "https";
- private static final AllowableValue TLS_1_2_VALUE = new
AllowableValue(SSLSecurityProtocol.TLSv1_2.name(),
SSLSecurityProtocol.TLSv1_2.name());
- private static final AllowableValue TLS_1_1_VALUE = new
AllowableValue(SSLSecurityProtocol.TLSv1_1.name(),
SSLSecurityProtocol.TLSv1_1.name());
- private static final AllowableValue TLS_1_VALUE = new
AllowableValue(SSLSecurityProtocol.TLSv1.name(),
SSLSecurityProtocol.TLSv1.name());
- private static final AllowableValue SSL_3_VALUE = new
AllowableValue(SSLSecurityProtocol.SSLv3.name(),
SSLSecurityProtocol.SSLv3.name());
+ private static final String OBSOLETE_SECURITY_PROTOCOL = "Security
Protocol";
static final String ACKNOWLEDGEMENT_ID_ATTRIBUTE =
"splunk.acknowledgement.id";
static final String RESPONDED_AT_ATTRIBUTE = "splunk.responded.at";
@@ -84,14 +79,6 @@ abstract class SplunkAPICall extends AbstractProcessor
implements ClassloaderIso
.expressionLanguageSupported(ExpressionLanguageScope.ENVIRONMENT)
.build();
- static final PropertyDescriptor SECURITY_PROTOCOL = new
PropertyDescriptor.Builder()
- .name("Security Protocol")
- .description("The security protocol to use for communicating with
Splunk.")
- .addValidator(StandardValidators.NON_EMPTY_VALIDATOR)
- .allowableValues(TLS_1_2_VALUE, TLS_1_1_VALUE, TLS_1_VALUE,
SSL_3_VALUE)
- .defaultValue(TLS_1_2_VALUE.getValue())
- .build();
-
static final PropertyDescriptor SSL_CONTEXT_SERVICE = new
PropertyDescriptor.Builder()
.name("SSL Context Service")
.description("The SSL Context Service used to provide client
certificate information for TLS/SSL connections.")
@@ -143,7 +130,6 @@ abstract class SplunkAPICall extends AbstractProcessor
implements ClassloaderIso
SCHEME,
HOSTNAME,
PORT,
- SECURITY_PROTOCOL,
SSL_CONTEXT_SERVICE,
OWNER,
TOKEN,
@@ -187,13 +173,8 @@ abstract class SplunkAPICall extends AbstractProcessor
implements ClassloaderIso
return;
}
- // Constructing a Splunk Service applies the Security Protocol to
static configuration, and changing the protocol discards the
- // current Socket Factory. Applying the protocol first leaves the
configured Socket Factory in place once the Service connects.
- final SSLSecurityProtocol securityProtocol =
getSecurityProtocol(context);
- if (securityProtocol != null) {
- Service.setSslSecurityProtocol(securityProtocol);
- }
-
+ // Service construction reapplies the static security protocol and
replaces the Socket Factory when that protocol changes.
+ // Leaving the protocol unchanged keeps the Socket Factory supplied by
the SSL Context Service.
Service.setSSLSocketFactory(sslContextProvider.createContext().getSocketFactory());
}
@@ -220,26 +201,9 @@ abstract class SplunkAPICall extends AbstractProcessor
implements ClassloaderIso
splunkServiceArguments.setPassword(context.getProperty(PASSWORD).getValue());
}
- final SSLSecurityProtocol securityProtocol =
getSecurityProtocol(context);
- if (securityProtocol != null) {
- splunkServiceArguments.setSSLSecurityProtocol(securityProtocol);
- }
-
return splunkServiceArguments;
}
- private SSLSecurityProtocol getSecurityProtocol(final ProcessContext
context) {
- final SSLSecurityProtocol sslSecurityProtocol;
-
- if (HTTPS_SCHEME.equals(context.getProperty(SCHEME).getValue()) &&
context.getProperty(SECURITY_PROTOCOL).isSet()) {
- sslSecurityProtocol =
SSLSecurityProtocol.valueOf(context.getProperty(SECURITY_PROTOCOL).getValue());
- } else {
- sslSecurityProtocol = null;
- }
-
- return sslSecurityProtocol;
- }
-
protected Service getSplunkService(final ServiceArgs
splunkServiceArguments) {
return Service.connect(splunkServiceArguments);
}
@@ -278,6 +242,7 @@ abstract class SplunkAPICall extends AbstractProcessor
implements ClassloaderIso
config.renameProperty("Port", PORT.getName());
config.renameProperty("Token", TOKEN.getName());
config.renameProperty("request-channel", REQUEST_CHANNEL.getName());
+ config.removeProperty(OBSOLETE_SECURITY_PROTOCOL);
}
protected String getTransitBaseUri() {
diff --git
a/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestGetSplunk.java
b/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestGetSplunk.java
index 8059ac823f1..37d04f54039 100644
---
a/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestGetSplunk.java
+++
b/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestGetSplunk.java
@@ -17,7 +17,6 @@
package org.apache.nifi.processors.splunk;
import com.splunk.JobExportArgs;
-import com.splunk.SSLSecurityProtocol;
import com.splunk.Service;
import org.apache.nifi.components.state.Scope;
import org.apache.nifi.components.state.StateMap;
@@ -27,6 +26,7 @@ import org.apache.nifi.provenance.ProvenanceEventType;
import org.apache.nifi.reporting.InitializationException;
import org.apache.nifi.ssl.SSLContextProvider;
import org.apache.nifi.util.MockFlowFile;
+import org.apache.nifi.util.PropertyMigrationResult;
import org.apache.nifi.util.TestRunner;
import org.apache.nifi.util.TestRunners;
import org.junit.jupiter.api.AfterEach;
@@ -40,6 +40,7 @@ import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.List;
+import java.util.Set;
import java.util.TimeZone;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
@@ -64,10 +65,6 @@ public class TestGetSplunk {
private Service service;
private TestableGetSplunk proc;
private TestRunner runner;
-
- // The Splunk Service holds the Security Protocol and the Socket Factory
in static state shared by every test running in the
- // same JVM, so both are captured and restored around each test.
- private SSLSecurityProtocol splunkSecurityProtocol;
private SSLSocketFactory splunkSocketFactory;
@BeforeEach
@@ -76,14 +73,11 @@ public class TestGetSplunk {
proc = new TestableGetSplunk(service);
runner = TestRunners.newTestRunner(proc);
-
- splunkSecurityProtocol = Service.getSslSecurityProtocol();
splunkSocketFactory = Service.getSSLSocketFactory();
}
@AfterEach
public void restoreSplunkTlsConfiguration() {
- Service.setSslSecurityProtocol(splunkSecurityProtocol);
Service.setSSLSocketFactory(splunkSocketFactory);
}
@@ -394,10 +388,6 @@ public class TestGetSplunk {
@Test
public void testSslContextServiceProvidesSplunkSocketFactory() throws
InitializationException {
- // Splunk discards the configured Socket Factory when the static
Security Protocol changes, so the Processor is configured with
- // a protocol other than the one applied here to confirm the Socket
Factory survives connecting the Splunk Service.
- Service.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_1);
-
final SSLSocketFactory socketFactory =
Mockito.mock(SSLSocketFactory.class);
final SSLContext sslContext = Mockito.mock(SSLContext.class);
when(sslContext.getSocketFactory()).thenReturn(socketFactory);
@@ -412,13 +402,18 @@ public class TestGetSplunk {
connectingRunner.enableControllerService(sslContextProvider);
connectingRunner.setProperty(GetSplunk.SSL_CONTEXT_SERVICE,
SSL_CONTEXT_SERVICE_ID);
connectingRunner.setProperty(GetSplunk.SCHEME, GetSplunk.HTTPS_SCHEME);
- connectingRunner.setProperty(GetSplunk.SECURITY_PROTOCOL,
SSLSecurityProtocol.TLSv1_2.name());
connectingRunner.setProperty(GetSplunk.TOKEN, "Splunk
888c5a81-8777-49a0-a3af-f76e050ab5d9");
getSplunk.createSplunkService(connectingRunner.getProcessContext());
assertSame(socketFactory, Service.getSSLSocketFactory());
- assertEquals(SSLSecurityProtocol.TLSv1_2,
Service.getSslSecurityProtocol());
+ }
+
+ @Test
+ public void testMigrateProperties() {
+ final TestRunner migrationRunner =
TestRunners.newTestRunner(GetSplunk.class);
+ final PropertyMigrationResult propertyMigrationResult =
migrationRunner.migrateProperties();
+ assertEquals(Set.of("Security Protocol"),
propertyMigrationResult.getPropertiesRemoved());
}
@Test
diff --git
a/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestPutSplunkHTTP.java
b/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestPutSplunkHTTP.java
index 0bd18b44356..00f614ce2cc 100644
---
a/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestPutSplunkHTTP.java
+++
b/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestPutSplunkHTTP.java
@@ -18,7 +18,6 @@ package org.apache.nifi.processors.splunk;
import com.splunk.RequestMessage;
import com.splunk.ResponseMessage;
-import com.splunk.SSLSecurityProtocol;
import com.splunk.Service;
import com.splunk.ServiceArgs;
import org.apache.nifi.flowfile.FlowFile;
@@ -46,6 +45,7 @@ import java.nio.charset.StandardCharsets;
import java.util.Collections;
import java.util.HashMap;
import java.util.Map;
+import java.util.Set;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
@@ -86,21 +86,15 @@ public class TestPutSplunkHTTP {
private MockedPutSplunkHTTP processor;
private TestRunner testRunner;
-
- private SSLSecurityProtocol splunkSecurityProtocol;
private SSLSocketFactory splunkSocketFactory;
- // The Splunk Service holds the Security Protocol and the Socket Factory
in static state shared by every test running in the
- // same JVM, so both are captured and restored around each test.
@BeforeEach
public void captureSplunkTlsConfiguration() {
- splunkSecurityProtocol = Service.getSslSecurityProtocol();
splunkSocketFactory = Service.getSSLSocketFactory();
}
@AfterEach
public void restoreSplunkTlsConfiguration() {
- Service.setSslSecurityProtocol(splunkSecurityProtocol);
Service.setSSLSocketFactory(splunkSocketFactory);
}
@@ -231,10 +225,6 @@ public class TestPutSplunkHTTP {
@Test
public void testSslContextServiceProvidesSplunkSocketFactory() throws
InitializationException {
- // Splunk discards the configured Socket Factory when the static
Security Protocol changes, so the Processor is configured with
- // a protocol other than the one applied here to confirm the Socket
Factory survives connecting the Splunk Service.
- Service.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_1);
-
final SSLSocketFactory socketFactory =
Mockito.mock(SSLSocketFactory.class);
final SSLContext sslContext = Mockito.mock(SSLContext.class);
Mockito.when(sslContext.getSocketFactory()).thenReturn(socketFactory);
@@ -248,14 +238,12 @@ public class TestPutSplunkHTTP {
connectingRunner.enableControllerService(sslContextProvider);
connectingRunner.setProperty(SplunkAPICall.SSL_CONTEXT_SERVICE,
SSL_CONTEXT_SERVICE_ID);
connectingRunner.setProperty(SplunkAPICall.SCHEME, "https");
- connectingRunner.setProperty(SplunkAPICall.SECURITY_PROTOCOL,
SSLSecurityProtocol.TLSv1_2.name());
connectingRunner.setProperty(SplunkAPICall.TOKEN, "Splunk
888c5a81-8777-49a0-a3af-f76e050ab5d9");
connectingRunner.setProperty(SplunkAPICall.REQUEST_CHANNEL,
"22bd7414-0d77-4c73-936d-c8f5d1b21862");
connectingRunner.run();
assertSame(socketFactory, Service.getSSLSocketFactory());
- assertEquals(SSLSecurityProtocol.TLSv1_2,
Service.getSslSecurityProtocol());
}
@Test
@@ -292,6 +280,7 @@ public class TestPutSplunkHTTP {
final PropertyMigrationResult propertyMigrationResult =
testRunner.migrateProperties();
assertEquals(expectedRenamed,
propertyMigrationResult.getPropertiesRenamed());
+ assertEquals(Set.of("Security Protocol"),
propertyMigrationResult.getPropertiesRemoved());
}
private MockFlowFile givenFlowFile() {
diff --git
a/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestQuerySplunkIndexingStatus.java
b/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestQuerySplunkIndexingStatus.java
index 86f612733f5..2597a765377 100644
---
a/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestQuerySplunkIndexingStatus.java
+++
b/nifi-extension-bundles/nifi-splunk-bundle/nifi-splunk-processors/src/test/java/org/apache/nifi/processors/splunk/TestQuerySplunkIndexingStatus.java
@@ -39,6 +39,7 @@ import java.nio.charset.StandardCharsets;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
+import java.util.Set;
import java.util.stream.Collectors;
import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -158,6 +159,7 @@ public class TestQuerySplunkIndexingStatus {
final PropertyMigrationResult propertyMigrationResult =
testRunner.migrateProperties();
assertEquals(expectedRenamed,
propertyMigrationResult.getPropertiesRenamed());
+ assertEquals(Set.of("Security Protocol"),
propertyMigrationResult.getPropertiesRemoved());
}
private void givenSplunkReturns(final Map<Integer, Boolean> acks) {
