From c83ff851d7a31185f98552ce13ddcf4d14a34cf2 Mon Sep 17 00:00:00 2001 From: Nick Larsen Date: Tue, 22 Sep 2026 11:33:30 +0200 Subject: [PATCH] chore(nifi): Delete old patchsets --- ...able-zip-assembly-to-save-disk-space.patch | 21 -- ...llow-bypassing-check-for-host-header.patch | 62 ------ .../1.27.0/0003-Add-CycloneDX-plugin.patch | 38 ---- .../1.27.0/0004-Fix-CVE-2024-36114.patch | 44 ---- nifi/stackable/patches/1.27.0/patchable.toml | 2 - ...able-zip-assembly-to-save-disk-space.patch | 21 -- ...llow-bypassing-check-for-host-header.patch | 62 ------ .../1.28.1/0003-Add-CycloneDX-plugin.patch | 38 ---- .../1.28.1/0004-Fix-CVE-2024-36114.patch | 44 ---- nifi/stackable/patches/1.28.1/patchable.toml | 2 - .../patches/2.4.0/0001-no-zip-assembly.patch | 21 -- .../2.4.0/0002-add-cyclonedx-plugin.patch | 38 ---- ...t-validation-if-list-of-allowed-host.patch | 48 ----- ...14858-Make-SNI-checking-configurable.patch | 108 ---------- ...ace-process-groups-root-with-root-ID.patch | 193 ------------------ nifi/stackable/patches/2.4.0/patchable.toml | 2 - 16 files changed, 744 deletions(-) delete mode 100644 nifi/stackable/patches/1.27.0/0001-Disable-zip-assembly-to-save-disk-space.patch delete mode 100644 nifi/stackable/patches/1.27.0/0002-Allow-bypassing-check-for-host-header.patch delete mode 100644 nifi/stackable/patches/1.27.0/0003-Add-CycloneDX-plugin.patch delete mode 100644 nifi/stackable/patches/1.27.0/0004-Fix-CVE-2024-36114.patch delete mode 100644 nifi/stackable/patches/1.27.0/patchable.toml delete mode 100644 nifi/stackable/patches/1.28.1/0001-Disable-zip-assembly-to-save-disk-space.patch delete mode 100644 nifi/stackable/patches/1.28.1/0002-Allow-bypassing-check-for-host-header.patch delete mode 100644 nifi/stackable/patches/1.28.1/0003-Add-CycloneDX-plugin.patch delete mode 100644 nifi/stackable/patches/1.28.1/0004-Fix-CVE-2024-36114.patch delete mode 100644 nifi/stackable/patches/1.28.1/patchable.toml delete mode 100644 nifi/stackable/patches/2.4.0/0001-no-zip-assembly.patch delete mode 100644 nifi/stackable/patches/2.4.0/0002-add-cyclonedx-plugin.patch delete mode 100644 nifi/stackable/patches/2.4.0/0003-disable-host-port-validation-if-list-of-allowed-host.patch delete mode 100644 nifi/stackable/patches/2.4.0/0004-NIFI-14858-Make-SNI-checking-configurable.patch delete mode 100644 nifi/stackable/patches/2.4.0/0005-replace-process-groups-root-with-root-ID.patch delete mode 100644 nifi/stackable/patches/2.4.0/patchable.toml diff --git a/nifi/stackable/patches/1.27.0/0001-Disable-zip-assembly-to-save-disk-space.patch b/nifi/stackable/patches/1.27.0/0001-Disable-zip-assembly-to-save-disk-space.patch deleted file mode 100644 index db744bc27..000000000 --- a/nifi/stackable/patches/1.27.0/0001-Disable-zip-assembly-to-save-disk-space.patch +++ /dev/null @@ -1,21 +0,0 @@ -From 94aa5703e1943de9cfdf58da3b67404f81b44b2f Mon Sep 17 00:00:00 2001 -From: Malte Sander -Date: Fri, 17 May 2024 15:38:33 +0200 -Subject: Disable zip assembly to save disk space - ---- - nifi-assembly/pom.xml | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/nifi-assembly/pom.xml b/nifi-assembly/pom.xml -index 08f89da15c..5b95d94c74 100644 ---- a/nifi-assembly/pom.xml -+++ b/nifi-assembly/pom.xml -@@ -66,7 +66,6 @@ language governing permissions and limitations under the License. --> - posix - - dir -- zip - - - diff --git a/nifi/stackable/patches/1.27.0/0002-Allow-bypassing-check-for-host-header.patch b/nifi/stackable/patches/1.27.0/0002-Allow-bypassing-check-for-host-header.patch deleted file mode 100644 index b984fa05c..000000000 --- a/nifi/stackable/patches/1.27.0/0002-Allow-bypassing-check-for-host-header.patch +++ /dev/null @@ -1,62 +0,0 @@ -From eab66d5ff1db7f32062bc1eab252c19ddbf95797 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?S=C3=B6nke=20Liebau?= -Date: Mon, 24 Jun 2024 09:04:43 +0200 -Subject: Allow bypassing check for host header - -NiFi has the configuration option 'nifi.web.proxy.host' which controls allowed -values for the host header field in any incoming request for the web ui. - -This frequently causes issues when trying to expose the NiFi UI via for example -an ingress, loadbalancer or any similar type of mechanism. - -NiFi does not allow to disable this behavior, so at the moment the nifi operator -simply hardcodes all even remotely possible values into this field. -But in order to allow putting for example in ingress in front of NiFi this means -using config overrides to change the value of this option, copy all the values -the operator put in there and add the extra value you need. - -This is less than ideal, the proper solution would probably be -https://github.com/stackabletech/nifi-operator/issues/604 - -But until that is merged this is a simple workaround that allows overriding the list of allowed -hostnames by just setting it to "*" and this will effectively bypass the hostname check entirely if set. - -This allows us to keep the default behavior in place for those users where it works and not remove -security features, but also enables users to disable this check if they know what they are doing. ---- - .../org/apache/nifi/web/server/HostHeaderHandler.java | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java -index dd4bbf54c0..ea1b5b2da1 100644 ---- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java -+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java -@@ -47,6 +47,7 @@ public class HostHeaderHandler extends ScopedHandler { - private final String serverName; - private final int serverPort; - private final List validHosts; -+ private boolean allowAllHosts = false; - - /** - * Instantiates a handler with a given server name and port 0. -@@ -107,6 +108,11 @@ public class HostHeaderHandler extends ScopedHandler { - // The value(s) from nifi.web.proxy.host - hosts.addAll(parseCustomHostnames(niFiProperties)); - -+ // Check if the setting for allowed hosts has only the wildcard entry and -+ // if so store this in allowAllHost for later use -+ List configuredHostNames = niFiProperties.getAllowedHostsAsList(); -+ this.allowAllHosts = configuredHostNames.size() == 1 && configuredHostNames.contains("*"); -+ - // empty is ok here - hosts.add(""); - -@@ -205,7 +211,7 @@ public class HostHeaderHandler extends ScopedHandler { - } - - boolean hostHeaderIsValid(String hostHeader) { -- return validHosts.contains(hostHeader.toLowerCase().trim()); -+ return this.allowAllHosts || validHosts.contains(hostHeader.toLowerCase().trim()); - } - - @Override diff --git a/nifi/stackable/patches/1.27.0/0003-Add-CycloneDX-plugin.patch b/nifi/stackable/patches/1.27.0/0003-Add-CycloneDX-plugin.patch deleted file mode 100644 index 96ca16281..000000000 --- a/nifi/stackable/patches/1.27.0/0003-Add-CycloneDX-plugin.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 1f6bc60943e4340e3fb77fd00a35cfaab62d12fc Mon Sep 17 00:00:00 2001 -From: Lukas Voetmand -Date: Fri, 6 Sep 2024 17:53:52 +0200 -Subject: Add CycloneDX plugin - ---- - pom.xml | 18 ++++++++++++++++++ - 1 file changed, 18 insertions(+) - -diff --git a/pom.xml b/pom.xml -index 0437c2b949..0684bd5a22 100644 ---- a/pom.xml -+++ b/pom.xml -@@ -1090,6 +1090,24 @@ - - - -+ -+ org.cyclonedx -+ cyclonedx-maven-plugin -+ 2.8.0 -+ -+ application -+ 1.5 -+ false -+ -+ -+ -+ package -+ -+ makeBom -+ -+ -+ -+ - - - diff --git a/nifi/stackable/patches/1.27.0/0004-Fix-CVE-2024-36114.patch b/nifi/stackable/patches/1.27.0/0004-Fix-CVE-2024-36114.patch deleted file mode 100644 index f5b67cb14..000000000 --- a/nifi/stackable/patches/1.27.0/0004-Fix-CVE-2024-36114.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 90ff88d3a98fbddbd779b1f010059cd4f48d6cc6 Mon Sep 17 00:00:00 2001 -From: Malte Sander -Date: Tue, 12 Nov 2024 11:54:11 +0100 -Subject: Fix CVE-2024-36114 - -see https://github.com/stackabletech/vulnerabilities/issues/834 - -Aircompressor is a library with ports of the Snappy, LZO, LZ4, and -Zstandard compression algorithms to Java. All decompressor -implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash -the JVM for certain input, and in some cases also leak the content of -other memory of the Java process (which could contain sensitive -information). When decompressing certain data, the decompressors try to -access memory outside the bounds of the given byte arrays or byte -buffers. Because Aircompressor uses the JDK class sun.misc.Unsafe to -speed up memory access, no additional bounds checks are performed and -this has similar security consequences as out-of-bounds access in C or -C++, namely it can lead to non-deterministic behavior or crash the JVM. -Users should update to Aircompressor 0.27 or newer where these issues -have been fixed. When decompressing data from untrusted users, this can -be exploited for a denial-of-service attack by crashing the JVM, or to -leak other sensitive information from the Java process. There are no -known workarounds for this issue. ---- - pom.xml | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/pom.xml b/pom.xml -index 0684bd5a22..d5b97acfcf 100644 ---- a/pom.xml -+++ b/pom.xml -@@ -155,6 +155,12 @@ - - - -+ -+ -+ io.airlift -+ aircompressor -+ 0.27 -+ - - posix - - dir -- zip - - - diff --git a/nifi/stackable/patches/1.28.1/0002-Allow-bypassing-check-for-host-header.patch b/nifi/stackable/patches/1.28.1/0002-Allow-bypassing-check-for-host-header.patch deleted file mode 100644 index ce6147f65..000000000 --- a/nifi/stackable/patches/1.28.1/0002-Allow-bypassing-check-for-host-header.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 456e42ba95135d5a1174e3f543df07f35473e9b6 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?S=C3=B6nke=20Liebau?= -Date: Mon, 24 Jun 2024 09:04:43 +0200 -Subject: Allow bypassing check for host header - -NiFi has the configuration option 'nifi.web.proxy.host' which controls allowed -values for the host header field in any incoming request for the web ui. - -This frequently causes issues when trying to expose the NiFi UI via for example -an ingress, loadbalancer or any similar type of mechanism. - -NiFi does not allow to disable this behavior, so at the moment the nifi operator -simply hardcodes all even remotely possible values into this field. -But in order to allow putting for example in ingress in front of NiFi this means -using config overrides to change the value of this option, copy all the values -the operator put in there and add the extra value you need. - -This is less than ideal, the proper solution would probably be -https://github.com/stackabletech/nifi-operator/issues/604 - -But until that is merged this is a simple workaround that allows overriding the list of allowed -hostnames by just setting it to "*" and this will effectively bypass the hostname check entirely if set. - -This allows us to keep the default behavior in place for those users where it works and not remove -security features, but also enables users to disable this check if they know what they are doing. ---- - .../org/apache/nifi/web/server/HostHeaderHandler.java | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java -index dd4bbf54c0..ea1b5b2da1 100644 ---- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java -+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java -@@ -47,6 +47,7 @@ public class HostHeaderHandler extends ScopedHandler { - private final String serverName; - private final int serverPort; - private final List validHosts; -+ private boolean allowAllHosts = false; - - /** - * Instantiates a handler with a given server name and port 0. -@@ -107,6 +108,11 @@ public class HostHeaderHandler extends ScopedHandler { - // The value(s) from nifi.web.proxy.host - hosts.addAll(parseCustomHostnames(niFiProperties)); - -+ // Check if the setting for allowed hosts has only the wildcard entry and -+ // if so store this in allowAllHost for later use -+ List configuredHostNames = niFiProperties.getAllowedHostsAsList(); -+ this.allowAllHosts = configuredHostNames.size() == 1 && configuredHostNames.contains("*"); -+ - // empty is ok here - hosts.add(""); - -@@ -205,7 +211,7 @@ public class HostHeaderHandler extends ScopedHandler { - } - - boolean hostHeaderIsValid(String hostHeader) { -- return validHosts.contains(hostHeader.toLowerCase().trim()); -+ return this.allowAllHosts || validHosts.contains(hostHeader.toLowerCase().trim()); - } - - @Override diff --git a/nifi/stackable/patches/1.28.1/0003-Add-CycloneDX-plugin.patch b/nifi/stackable/patches/1.28.1/0003-Add-CycloneDX-plugin.patch deleted file mode 100644 index cef05e836..000000000 --- a/nifi/stackable/patches/1.28.1/0003-Add-CycloneDX-plugin.patch +++ /dev/null @@ -1,38 +0,0 @@ -From a883c6b633311959c323dbd43cd731d4e41532cc Mon Sep 17 00:00:00 2001 -From: Lukas Voetmand -Date: Fri, 6 Sep 2024 17:53:52 +0200 -Subject: Add CycloneDX plugin - ---- - pom.xml | 18 ++++++++++++++++++ - 1 file changed, 18 insertions(+) - -diff --git a/pom.xml b/pom.xml -index 672c023277..641d772286 100644 ---- a/pom.xml -+++ b/pom.xml -@@ -1091,6 +1091,24 @@ - - - -+ -+ org.cyclonedx -+ cyclonedx-maven-plugin -+ 2.8.0 -+ -+ application -+ 1.5 -+ false -+ -+ -+ -+ package -+ -+ makeBom -+ -+ -+ -+ - - - diff --git a/nifi/stackable/patches/1.28.1/0004-Fix-CVE-2024-36114.patch b/nifi/stackable/patches/1.28.1/0004-Fix-CVE-2024-36114.patch deleted file mode 100644 index 27650b8db..000000000 --- a/nifi/stackable/patches/1.28.1/0004-Fix-CVE-2024-36114.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 394424a8db4ef6ab4e7a774f4faf2a3bdc3fef35 Mon Sep 17 00:00:00 2001 -From: Malte Sander -Date: Tue, 12 Nov 2024 11:54:11 +0100 -Subject: Fix CVE-2024-36114 - -see https://github.com/stackabletech/vulnerabilities/issues/834 - -Aircompressor is a library with ports of the Snappy, LZO, LZ4, and -Zstandard compression algorithms to Java. All decompressor -implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash -the JVM for certain input, and in some cases also leak the content of -other memory of the Java process (which could contain sensitive -information). When decompressing certain data, the decompressors try to -access memory outside the bounds of the given byte arrays or byte -buffers. Because Aircompressor uses the JDK class sun.misc.Unsafe to -speed up memory access, no additional bounds checks are performed and -this has similar security consequences as out-of-bounds access in C or -C++, namely it can lead to non-deterministic behavior or crash the JVM. -Users should update to Aircompressor 0.27 or newer where these issues -have been fixed. When decompressing data from untrusted users, this can -be exploited for a denial-of-service attack by crashing the JVM, or to -leak other sensitive information from the Java process. There are no -known workarounds for this issue. ---- - nifi-assembly/pom.xml | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/nifi-assembly/pom.xml b/nifi-assembly/pom.xml -index d00154626a..da38056c7a 100644 ---- a/nifi-assembly/pom.xml -+++ b/nifi-assembly/pom.xml -@@ -97,6 +97,12 @@ language governing permissions and limitations under the License. --> - - - -+ -+ -+ io.airlift -+ aircompressor -+ 0.27 -+ - - javax.servlet - javax.servlet-api diff --git a/nifi/stackable/patches/1.28.1/patchable.toml b/nifi/stackable/patches/1.28.1/patchable.toml deleted file mode 100644 index b252ecf5a..000000000 --- a/nifi/stackable/patches/1.28.1/patchable.toml +++ /dev/null @@ -1,2 +0,0 @@ -base = "883338fe28883733417d10f6ffa9319e75f5ea06" -mirror = "https://github.com/stackabletech/nifi.git" diff --git a/nifi/stackable/patches/2.4.0/0001-no-zip-assembly.patch b/nifi/stackable/patches/2.4.0/0001-no-zip-assembly.patch deleted file mode 100644 index 4e93ed77f..000000000 --- a/nifi/stackable/patches/2.4.0/0001-no-zip-assembly.patch +++ /dev/null @@ -1,21 +0,0 @@ -From cef2caa1141df8974ff853ce3bf55736cc22af4f Mon Sep 17 00:00:00 2001 -From: Nick Larsen -Date: Mon, 17 Feb 2025 17:26:20 +0100 -Subject: no zip assembly - ---- - nifi-assembly/pom.xml | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/nifi-assembly/pom.xml b/nifi-assembly/pom.xml -index 41bab2ad37..4ebb494613 100644 ---- a/nifi-assembly/pom.xml -+++ b/nifi-assembly/pom.xml -@@ -66,7 +66,6 @@ language governing permissions and limitations under the License. --> - posix - - dir -- zip - - - diff --git a/nifi/stackable/patches/2.4.0/0002-add-cyclonedx-plugin.patch b/nifi/stackable/patches/2.4.0/0002-add-cyclonedx-plugin.patch deleted file mode 100644 index 78432863b..000000000 --- a/nifi/stackable/patches/2.4.0/0002-add-cyclonedx-plugin.patch +++ /dev/null @@ -1,38 +0,0 @@ -From a9fc3a2eea5add80ca03e8fba97d83d2952f2e5d Mon Sep 17 00:00:00 2001 -From: Nick Larsen -Date: Mon, 17 Feb 2025 17:31:17 +0100 -Subject: add cyclonedx plugin - ---- - pom.xml | 18 ++++++++++++++++++ - 1 file changed, 18 insertions(+) - -diff --git a/pom.xml b/pom.xml -index 78f53a9aab..fdcc97cd51 100644 ---- a/pom.xml -+++ b/pom.xml -@@ -1013,6 +1013,24 @@ - - - -+ -+ org.cyclonedx -+ cyclonedx-maven-plugin -+ 2.8.0 -+ -+ application -+ 1.5 -+ false -+ -+ -+ -+ package -+ -+ makeBom -+ -+ -+ -+ - - - diff --git a/nifi/stackable/patches/2.4.0/0003-disable-host-port-validation-if-list-of-allowed-host.patch b/nifi/stackable/patches/2.4.0/0003-disable-host-port-validation-if-list-of-allowed-host.patch deleted file mode 100644 index 8fac2f395..000000000 --- a/nifi/stackable/patches/2.4.0/0003-disable-host-port-validation-if-list-of-allowed-host.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 5eb0363521dbb30e3e47ec8a604f5a5c678bf4fb Mon Sep 17 00:00:00 2001 -From: Benedikt Labrenz -Date: Thu, 22 May 2025 14:47:24 +0200 -Subject: disable host port validation if list of allowed hosts only contains - '*' - ---- - .../connector/FrameworkServerConnectorFactory.java | 13 +++++++++++-- - 1 file changed, 11 insertions(+), 2 deletions(-) - -diff --git a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java -index ec1bee66fb..b58c886f4f 100644 ---- a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java -+++ b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java -@@ -54,6 +54,8 @@ public class FrameworkServerConnectorFactory extends StandardServerConnectorFact - - private final String excludeCipherSuites; - -+ private final boolean disableHostPortValidator; -+ - private final Set validPorts; - - private SslContextFactory.Server sslContextFactory; -@@ -72,6 +74,11 @@ public class FrameworkServerConnectorFactory extends StandardServerConnectorFact - headerSize = DataUnit.parseDataSize(properties.getWebMaxHeaderSize(), DataUnit.B).intValue(); - validPorts = getValidPorts(properties); - -+ // Check if the property for allowed hosts has only the wildcard entry and -+ // if so store this in disableHostPortValidator for later use -+ List configuredHostNames = properties.getAllowedHostsAsList(); -+ disableHostPortValidator = configuredHostNames.size() == 1 && configuredHostNames.contains("*"); -+ - if (properties.isHTTPSConfigured()) { - if (properties.isClientAuthRequiredForRestApi()) { - setNeedClientAuth(true); -@@ -102,8 +109,10 @@ public class FrameworkServerConnectorFactory extends StandardServerConnectorFact - // Add HostHeaderCustomizer to set Host Header for HTTP/2 and HostHeaderHandler - httpConfiguration.addCustomizer(new HostHeaderCustomizer()); - -- final HostPortValidatorCustomizer hostPortValidatorCustomizer = new HostPortValidatorCustomizer(validPorts); -- httpConfiguration.addCustomizer(hostPortValidatorCustomizer); -+ if (!disableHostPortValidator) { -+ final HostPortValidatorCustomizer hostPortValidatorCustomizer = new HostPortValidatorCustomizer(validPorts); -+ httpConfiguration.addCustomizer(hostPortValidatorCustomizer); -+ } - - return httpConfiguration; - } diff --git a/nifi/stackable/patches/2.4.0/0004-NIFI-14858-Make-SNI-checking-configurable.patch b/nifi/stackable/patches/2.4.0/0004-NIFI-14858-Make-SNI-checking-configurable.patch deleted file mode 100644 index bf11d350d..000000000 --- a/nifi/stackable/patches/2.4.0/0004-NIFI-14858-Make-SNI-checking-configurable.patch +++ /dev/null @@ -1,108 +0,0 @@ -From ba6e0992aa74ab3f991b6214750d3204b859647c Mon Sep 17 00:00:00 2001 -From: xeniape -Date: Wed, 24 Sep 2025 17:12:15 +0200 -Subject: NIFI-14858: Make SNI checking configurable - -Introduces two new properties: -- nifi.web.https.sni.required (default: false) -- nifi.web.https.sni.host.check (default: true) - -These defaults mean that SNI is not required (this is the current behavior already) but if SNI is provided then the host has to match. ---- - .../StandardServerConnectorFactory.java | 24 +++++++++++++++++++ - .../org/apache/nifi/util/NiFiProperties.java | 10 ++++++++ - .../FrameworkServerConnectorFactory.java | 4 ++++ - 3 files changed, 38 insertions(+) - -diff --git a/nifi-commons/nifi-jetty-configuration/src/main/java/org/apache/nifi/jetty/configuration/connector/StandardServerConnectorFactory.java b/nifi-commons/nifi-jetty-configuration/src/main/java/org/apache/nifi/jetty/configuration/connector/StandardServerConnectorFactory.java -index 26d09706a1..132973cad5 100644 ---- a/nifi-commons/nifi-jetty-configuration/src/main/java/org/apache/nifi/jetty/configuration/connector/StandardServerConnectorFactory.java -+++ b/nifi-commons/nifi-jetty-configuration/src/main/java/org/apache/nifi/jetty/configuration/connector/StandardServerConnectorFactory.java -@@ -70,6 +70,10 @@ public class StandardServerConnectorFactory implements ServerConnectorFactory { - - private int requestHeaderSize = 8192; - -+ private boolean sniRequired = false; -+ -+ private boolean sniHostCheck = true; -+ - /** - * Standard Server Connector Factory Constructor with required properties - * -@@ -181,6 +185,24 @@ public class StandardServerConnectorFactory implements ServerConnectorFactory { - this.requestHeaderSize = requestHeaderSize; - } - -+ /** -+ * Set to true if a SNI certificate is required, else requests will be rejected with 400 response. -+ * -+ * @param sniRequired SNI Required status -+ */ -+ public void setSniRequired(final boolean sniRequired) { -+ this.sniRequired = sniRequired; -+ } -+ -+ /** -+ * Set to true if the SNI Host name must match when there is an SNI certificate. -+ * -+ * @param sniHostCheck SNI Host Check status -+ */ -+ public void setSniHostCheck(final boolean sniHostCheck) { -+ this.sniHostCheck = sniHostCheck; -+ } -+ - protected Server getServer() { - return server; - } -@@ -195,6 +217,8 @@ public class StandardServerConnectorFactory implements ServerConnectorFactory { - httpConfiguration.setSendServerVersion(SEND_SERVER_VERSION); - - final SecureRequestCustomizer secureRequestCustomizer = new SecureRequestCustomizer(); -+ secureRequestCustomizer.setSniRequired(sniRequired); -+ secureRequestCustomizer.setSniHostCheck(sniHostCheck); - httpConfiguration.addCustomizer(secureRequestCustomizer); - } - -diff --git a/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java b/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java -index cd3cd0b27e..4bd2f4f810 100644 ---- a/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java -+++ b/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java -@@ -206,6 +206,8 @@ public class NiFiProperties extends ApplicationProperties { - public static final String WEB_HTTPS_CIPHERSUITES_INCLUDE = "nifi.web.https.ciphersuites.include"; - public static final String WEB_HTTPS_CIPHERSUITES_EXCLUDE = "nifi.web.https.ciphersuites.exclude"; - public static final String WEB_HTTPS_NETWORK_INTERFACE_PREFIX = "nifi.web.https.network.interface."; -+ public static final String WEB_HTTPS_SNI_REQUIRED = "nifi.web.https.sni.required"; -+ public static final String WEB_HTTPS_SNI_HOST_CHECK = "nifi.web.https.sni.host.check"; - public static final String WEB_WORKING_DIR = "nifi.web.jetty.working.directory"; - public static final String WEB_THREADS = "nifi.web.jetty.threads"; - public static final String WEB_MAX_HEADER_SIZE = "nifi.web.max.header.size"; -@@ -710,6 +712,14 @@ public class NiFiProperties extends ApplicationProperties { - return Arrays.stream(protocols.split("\\s+")).collect(Collectors.toSet()); - } - -+ public boolean isWebHttpsSniRequired() { -+ return Boolean.parseBoolean(getProperty(WEB_HTTPS_SNI_REQUIRED, "false")); -+ } -+ -+ public boolean isWebHttpsSniHostCheck() { -+ return Boolean.parseBoolean(getProperty(WEB_HTTPS_SNI_HOST_CHECK, "true")); -+ } -+ - public String getWebMaxHeaderSize() { - return getProperty(WEB_MAX_HEADER_SIZE, DEFAULT_WEB_MAX_HEADER_SIZE); - } -diff --git a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java -index b58c886f4f..55a28b1c3c 100644 ---- a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java -+++ b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java -@@ -90,6 +90,10 @@ public class FrameworkServerConnectorFactory extends StandardServerConnectorFact - - // Set Transport Layer Security Protocols based on platform configuration - setIncludeSecurityProtocols(TlsPlatform.getPreferredProtocols().toArray(new String[0])); -+ -+ // Set SNI configuration from properties -+ setSniRequired(properties.isWebHttpsSniRequired()); -+ setSniHostCheck(properties.isWebHttpsSniHostCheck()); - } - } - diff --git a/nifi/stackable/patches/2.4.0/0005-replace-process-groups-root-with-root-ID.patch b/nifi/stackable/patches/2.4.0/0005-replace-process-groups-root-with-root-ID.patch deleted file mode 100644 index 0ea45f418..000000000 --- a/nifi/stackable/patches/2.4.0/0005-replace-process-groups-root-with-root-ID.patch +++ /dev/null @@ -1,193 +0,0 @@ -From ed80d426e85c7b741d865f866092e89b61742c10 Mon Sep 17 00:00:00 2001 -From: Andrew Kenworthy -Date: Fri, 10 Oct 2025 15:28:56 +0200 -Subject: replace process groups root with root ID - ---- - .../org/apache/nifi/util/NiFiProperties.java | 3 ++ - .../nifi/flow/FlowInitializationCallback.java | 9 ++++ - .../FileAccessPolicyProvider.java | 43 +++++++++++++++++++ - .../FileAuthorizerInitializer.java | 25 +++++++++++ - .../nifi/controller/StandardFlowService.java | 17 ++++++++ - 5 files changed, 97 insertions(+) - create mode 100644 nifi-framework-api/src/main/java/org/apache/nifi/flow/FlowInitializationCallback.java - create mode 100644 nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAuthorizerInitializer.java - -diff --git a/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java b/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java -index 4bd2f4f810..24d31960b7 100644 ---- a/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java -+++ b/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java -@@ -336,6 +336,9 @@ public class NiFiProperties extends ApplicationProperties { - // performance tracking defaults - public static final int DEFAULT_TRACK_PERFORMANCE_PERCENTAGE = 0; - -+ // root process group replacement -+ public static final String ROOT_PROCESS_GROUP_PLACEHOLDER ="nifi.process.group.root.placeholder"; -+ - // defaults - public static final Boolean DEFAULT_AUTO_RESUME_STATE = true; - public static final String DEFAULT_AUTHORIZER_CONFIGURATION_FILE = "conf/authorizers.xml"; -diff --git a/nifi-framework-api/src/main/java/org/apache/nifi/flow/FlowInitializationCallback.java b/nifi-framework-api/src/main/java/org/apache/nifi/flow/FlowInitializationCallback.java -new file mode 100644 -index 0000000000..3039c97497 ---- /dev/null -+++ b/nifi-framework-api/src/main/java/org/apache/nifi/flow/FlowInitializationCallback.java -@@ -0,0 +1,9 @@ -+package org.apache.nifi.flow; -+ -+/** -+ * Simple callback interface invoked when the root process group has been -+ * loaded and the flow is fully initialized for the first time. -+ */ -+public interface FlowInitializationCallback { -+ void onRootGroupLoaded(); -+} -diff --git a/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java b/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java -index 5363bb5619..a03a18d444 100644 ---- a/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java -+++ b/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java -@@ -29,6 +29,7 @@ import org.apache.nifi.authorization.resource.ResourceType; - import org.apache.nifi.authorization.util.IdentityMapping; - import org.apache.nifi.authorization.util.IdentityMappingUtil; - import org.apache.nifi.components.PropertyValue; -+import org.apache.nifi.controller.StandardFlowService; - import org.apache.nifi.util.FlowInfo; - import org.apache.nifi.util.FlowParser; - import org.apache.nifi.util.NiFiProperties; -@@ -77,6 +78,8 @@ import java.util.concurrent.atomic.AtomicReference; - import java.util.regex.Matcher; - import java.util.regex.Pattern; - -+import static org.apache.nifi.util.NiFiProperties.ROOT_PROCESS_GROUP_PLACEHOLDER; -+ - public class FileAccessPolicyProvider implements ConfigurableAccessPolicyProvider { - - private static final Logger logger = LoggerFactory.getLogger(FileAccessPolicyProvider.class); -@@ -133,6 +136,9 @@ public class FileAccessPolicyProvider implements ConfigurableAccessPolicyProvide - public void initialize(AccessPolicyProviderInitializationContext initializationContext) throws AuthorizerCreationException { - userGroupProviderLookup = initializationContext.getUserGroupProviderLookup(); - -+ // Register flow initialization hook -+ StandardFlowService.registerInitializationCallback(new FileAuthorizerInitializer(this)); -+ - try { - final SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); - authorizationsSchema = schemaFactory.newSchema(FileAccessPolicyProvider.class.getResource(AUTHORIZATIONS_XSD)); -@@ -744,6 +750,43 @@ public class FileAccessPolicyProvider implements ConfigurableAccessPolicyProvide - } - } - -+ /** -+ * Replaces process group root references with the process group ID. -+ * Relevant when a static authorizations file is provided, which can -+ * then use "root" as a placeholder. -+ */ -+ public void replaceWithRootGroupId() throws JAXBException { -+ String placeholder = this.properties.getProperty(ROOT_PROCESS_GROUP_PLACEHOLDER, ""); -+ -+ if (StringUtils.isNotBlank(placeholder)) { -+ if (rootGroupId == null) { -+ logger.info("Parsing flow as rootGroupId is not yet defined"); -+ parseFlow(); -+ } -+ if (rootGroupId != null) { -+ logger.info("Parsing root group with {}", rootGroupId); -+ Authorizations authorizations = this.authorizationsHolder.get().getAuthorizations(); -+ boolean authorizationsChanged = false; -+ for (Policy policy: authorizations.getPolicies().getPolicy()) { -+ String resource = policy.getResource(); -+ String processGroupRoot = ResourceType.ProcessGroup.getValue() + "/" + placeholder; -+ if (resource.endsWith(processGroupRoot)) { -+ int pos = resource.indexOf(processGroupRoot); -+ policy.setResource(resource.substring(0, pos) + ResourceType.ProcessGroup.getValue() + "/" + rootGroupId); -+ authorizationsChanged = true; -+ } -+ } -+ if (authorizationsChanged) { -+ saveAndRefreshHolder(authorizations); -+ } -+ } else { -+ // this is not expected as this is called from the flow service -+ // once it has been configured -+ logger.info("rootGroupId still not established!"); -+ } -+ } -+ } -+ - /** - * Creates and adds an access policy for the given resource, group identity, and actions to the specified authorizations. - * -diff --git a/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAuthorizerInitializer.java b/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAuthorizerInitializer.java -new file mode 100644 -index 0000000000..f67328ef84 ---- /dev/null -+++ b/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAuthorizerInitializer.java -@@ -0,0 +1,25 @@ -+package org.apache.nifi.authorization; -+ -+import org.apache.nifi.flow.FlowInitializationCallback; -+import org.slf4j.Logger; -+import org.slf4j.LoggerFactory; -+ -+ -+public class FileAuthorizerInitializer implements FlowInitializationCallback { -+ private static final Logger logger = LoggerFactory.getLogger(FileAuthorizerInitializer.class); -+private FileAccessPolicyProvider fileAccessPolicyProvider; -+ -+ public FileAuthorizerInitializer(FileAccessPolicyProvider fileAccessPolicyProvider) { -+ this.fileAccessPolicyProvider = fileAccessPolicyProvider; -+ } -+ -+ @Override -+ public void onRootGroupLoaded() { -+ try { -+ logger.info("Flow initialized; ensuring root group ID is recorded in authorizations.xml"); -+ this.fileAccessPolicyProvider.replaceWithRootGroupId(); -+ } catch (Exception e) { -+ logger.warn("Unable to update authorizations.xml with root group ID", e); -+ } -+ } -+} -\ No newline at end of file -diff --git a/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/controller/StandardFlowService.java b/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/controller/StandardFlowService.java -index 09f4d38f77..b0137c8302 100644 ---- a/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/controller/StandardFlowService.java -+++ b/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/controller/StandardFlowService.java -@@ -55,6 +55,7 @@ import org.apache.nifi.controller.serialization.FlowSynchronizationException; - import org.apache.nifi.controller.status.ProcessGroupStatus; - import org.apache.nifi.engine.FlowEngine; - import org.apache.nifi.events.BulletinFactory; -+import org.apache.nifi.flow.FlowInitializationCallback; - import org.apache.nifi.groups.BundleUpdateStrategy; - import org.apache.nifi.groups.ProcessGroup; - import org.apache.nifi.groups.RemoteProcessGroup; -@@ -148,6 +149,13 @@ public class StandardFlowService implements FlowService, ProtocolHandler { - private static final String CONNECTION_EXCEPTION_MSG_PREFIX = "Failed to connect node to cluster"; - private static final Logger logger = LoggerFactory.getLogger(StandardFlowService.class); - -+ // Static callback registration for post-initialization hooks -+ private static volatile FlowInitializationCallback initializationCallback; -+ -+ public static void registerInitializationCallback(FlowInitializationCallback callback) { -+ initializationCallback = callback; -+ } -+ - public static StandardFlowService createStandaloneInstance( - final FlowController controller, - final NiFiProperties nifiProperties, -@@ -933,6 +941,15 @@ public class StandardFlowService implements FlowService, ProtocolHandler { - // start the processors as indicated by the dataflow - controller.onFlowInitialized(autoResumeState); - -+ // this should be done once the flow has been initialized -+ if (initializationCallback != null) { -+ try { -+ initializationCallback.onRootGroupLoaded(); -+ } catch (Exception e) { -+ logger.warn("Error invoking FlowInitializationCallback", e); -+ } -+ } -+ - loadSnippets(dataFlow.getSnippets()); - - controller.startHeartbeating(); diff --git a/nifi/stackable/patches/2.4.0/patchable.toml b/nifi/stackable/patches/2.4.0/patchable.toml deleted file mode 100644 index d055c6804..000000000 --- a/nifi/stackable/patches/2.4.0/patchable.toml +++ /dev/null @@ -1,2 +0,0 @@ -mirror = "https://github.com/stackabletech/nifi.git" -base = "65c7732e46cdfcb17afe0dd7b0a3e0956226bcbb"