Github user markap14 commented on a diff in the pull request:
https://github.com/apache/nifi/pull/163#discussion_r49474547
--- Diff:
nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/x509/ocsp/OcspCertificateValidatorTest.java
---
@@ -0,0 +1,337 @@
+package org.apache.nifi.web.security.x509.ocsp;
+
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
+import org.bouncycastle.asn1.x509.KeyPurposeId;
+import org.bouncycastle.asn1.x509.KeyUsage;
+import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
+import org.bouncycastle.asn1.x509.X509Extension;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
+import org.bouncycastle.cert.ocsp.OCSPReq;
+import org.bouncycastle.cert.ocsp.OCSPResp;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Ignore;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.math.BigInteger;
+import java.security.InvalidKeyException;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Security;
+import java.security.SignatureException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.Date;
+import java.util.Vector;
+
+public class OcspCertificateValidatorTest {
+ private static final Logger logger =
LoggerFactory.getLogger(OcspCertificateValidatorTest.class);
+
+ private static final int KEY_SIZE = 2048;
+
+ private static final long YESTERDAY = System.currentTimeMillis() - 24
* 60 * 60 * 1000;
+ private static final long ONE_YEAR_FROM_NOW =
System.currentTimeMillis() + 365 * 24 * 60 * 60 * 1000;
+ private static final String SIGNATURE_ALGORITHM = "SHA256withRSA";
+ private static final String PROVIDER = "BC";
+
+ private static final String ISSUER_DN = "CN=NiFi Test
CA,OU=Security,O=Apache,ST=CA,C=US";
+
+ private static X509Certificate ISSUER_CERTIFICATE;
+
+ @BeforeClass
+ public static void setUpOnce() throws Exception {
+ Security.addProvider(new BouncyCastleProvider());
+
+// ISSUER_CERTIFICATE = generateCertificate(ISSUER_DN);
+ }
+
+ @Before
+ public void setUp() throws Exception {
+ }
+
+ @After
+ public void tearDown() throws Exception {
+
+ }
+
+ /**
+ * Generates a public/private RSA keypair using the default key size.
+ *
+ * @return the keypair
+ * @throws NoSuchAlgorithmException if the RSA algorithm is not
available
+ */
+ private static KeyPair generateKeyPair() throws
NoSuchAlgorithmException {
+ KeyPairGenerator keyPairGenerator =
KeyPairGenerator.getInstance("RSA");
+ keyPairGenerator.initialize(KEY_SIZE);
+ return keyPairGenerator.generateKeyPair();
+ }
+
+ /**
+ * Generates a signed certificate using an on-demand keypair.
+ *
+ * @param dn the DN
+ * @return the certificate
+ * @throws IOException
+ * @throws NoSuchAlgorithmException
+ * @throws CertificateException
+ * @throws NoSuchProviderException
+ * @throws SignatureException
+ * @throws InvalidKeyException
+ * @throws OperatorCreationException
+ */
+ private static X509Certificate generateCertificate(String dn) throws
IOException, NoSuchAlgorithmException, CertificateException,
NoSuchProviderException, SignatureException, InvalidKeyException,
OperatorCreationException {
+ KeyPair keyPair = generateKeyPair();
+ return generateCertificate(dn, keyPair);
+ }
+
+ /**
+ * Generates a signed certificate with a specific keypair.
+ *
+ * @param dn the DN
+ * @param keyPair the public key will be included in the certificate
and the the private key is used to sign the certificate
+ * @return the certificate
+ * @throws IOException
+ * @throws NoSuchAlgorithmException
+ * @throws CertificateException
+ * @throws NoSuchProviderException
+ * @throws SignatureException
+ * @throws InvalidKeyException
+ * @throws OperatorCreationException
+ */
+ private static X509Certificate generateCertificate(String dn, KeyPair
keyPair) throws IOException, NoSuchAlgorithmException, CertificateException,
NoSuchProviderException, SignatureException, InvalidKeyException,
OperatorCreationException {
+ PrivateKey privateKey = keyPair.getPrivate();
+ ContentSigner sigGen = new
JcaContentSignerBuilder(SIGNATURE_ALGORITHM).setProvider(PROVIDER).build(privateKey);
+ SubjectPublicKeyInfo subPubKeyInfo =
SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());
+ Date startDate = new Date(YESTERDAY);
+ Date endDate = new Date(ONE_YEAR_FROM_NOW);
+
+ X509v3CertificateBuilder certBuilder = new
X509v3CertificateBuilder(
+ new X500Name(dn),
+ BigInteger.valueOf(System.currentTimeMillis()),
+ startDate, endDate,
+ new X500Name(dn),
+ subPubKeyInfo);
+
+ // Set certificate extensions
+ // (1) digitalSignature extension
+ certBuilder.addExtension(X509Extension.keyUsage, true,
+ new KeyUsage(KeyUsage.digitalSignature |
KeyUsage.keyEncipherment | KeyUsage.dataEncipherment | KeyUsage.keyAgreement));
+
+ // (2) extendedKeyUsage extension
+ Vector<KeyPurposeId> ekUsages = new Vector<>();
+ ekUsages.add(KeyPurposeId.id_kp_clientAuth);
+ ekUsages.add(KeyPurposeId.id_kp_serverAuth);
+ certBuilder.addExtension(X509Extension.extendedKeyUsage, false,
new ExtendedKeyUsage(ekUsages));
+
+ // Sign the certificate
+ X509CertificateHolder certificateHolder =
certBuilder.build(sigGen);
+ return new JcaX509CertificateConverter().setProvider(PROVIDER)
+ .getCertificate(certificateHolder);
+ }
+
+ /**
+ * Generates a certificate signed by the issuer key.
+ *
+ * @param dn the subject DN
+ * @param issuerDn the issuer DN
+ * @param issuerKey the issuer private key
+ * @return the certificate
+ * @throws IOException
+ * @throws NoSuchAlgorithmException
+ * @throws CertificateException
+ * @throws NoSuchProviderException
+ * @throws SignatureException
+ * @throws InvalidKeyException
+ * @throws OperatorCreationException
+ */
+ private static X509Certificate generateIssuedCertificate(String dn,
String issuerDn, PrivateKey issuerKey) throws IOException,
NoSuchAlgorithmException, CertificateException, NoSuchProviderException,
SignatureException, InvalidKeyException, OperatorCreationException {
+ KeyPair keyPair = generateKeyPair();
+ return generateIssuedCertificate(dn, keyPair.getPublic(),
issuerDn, issuerKey);
+ }
+
+ /**
+ * Generates a certificate with a specific public key signed by the
issuer key.
+ *
+ * @param dn the subject DN
+ * @param publicKey the subject public key
+ * @param issuerDn the issuer DN
+ * @param issuerKey the issuer private key
+ * @return the certificate
+ * @throws IOException
+ * @throws NoSuchAlgorithmException
+ * @throws CertificateException
+ * @throws NoSuchProviderException
+ * @throws SignatureException
+ * @throws InvalidKeyException
+ * @throws OperatorCreationException
+ */
+ private static X509Certificate generateIssuedCertificate(String dn,
PublicKey publicKey, String issuerDn, PrivateKey issuerKey) throws IOException,
NoSuchAlgorithmException, CertificateException, NoSuchProviderException,
SignatureException, InvalidKeyException, OperatorCreationException {
+ ContentSigner sigGen = new
JcaContentSignerBuilder(SIGNATURE_ALGORITHM).setProvider(PROVIDER).build(issuerKey);
+ SubjectPublicKeyInfo subPubKeyInfo =
SubjectPublicKeyInfo.getInstance(publicKey.getEncoded());
+ Date startDate = new Date(YESTERDAY);
+ Date endDate = new Date(ONE_YEAR_FROM_NOW);
+
+ X509v3CertificateBuilder v3CertGen = new X509v3CertificateBuilder(
+ new X500Name(issuerDn),
+ BigInteger.valueOf(System.currentTimeMillis()),
+ startDate, endDate,
+ new X500Name(dn),
+ subPubKeyInfo);
+
+ X509CertificateHolder certificateHolder = v3CertGen.build(sigGen);
+ return new JcaX509CertificateConverter().setProvider(PROVIDER)
+ .getCertificate(certificateHolder);
+ }
+
+ private static OCSPResp generateFailedOCSPResponse(OCSPReq request) {
+ return null;
+ }
+
+// private static OCSPResp generateSuccessfulOCSPResponse(OCSPReq
request) {
--- End diff --
Should remove this method, rather than leaving it commented out, if it is
no longer needed.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---
