{"action":"created","comment":{"url":"https://api.github.com/repos/apache/nifi/pulls/comments/72715741","id":72715741,"diff_hunk":"@@ -0,0 +1,144 @@\n+/*\n+ * Licensed to the Apache Software Foundation (ASF) under one or more\n+ * contributor license agreements.  See the NOTICE file distributed with\n+ * this work for additional information regarding copyright ownership.\n+ * The ASF licenses this file to You under the Apache License, Version 2.0\n+ * (the \"License\"); you may not use this file except in compliance with\n+ * the License.  You may obtain a copy of the License at\n+ *\n+ *     http://www.apache.org/licenses/LICENSE-2.0\n+ *\n+ * Unless required by applicable law or agreed to in writing, software\n+ * distributed under the License is distributed on an \"AS IS\" BASIS,\n+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n+ * See the License for the specific language governing permissions and\n+ * limitations under the License.\n+ */\n+\n+package org.apache.nifi.toolkit.tls.service;\n+\n+import com.fasterxml.jackson.databind.ObjectMapper;\n+import org.apache.commons.io.IOUtils;\n+import org.apache.commons.io.input.BoundedInputStream;\n+import org.apache.http.HttpHost;\n+import org.apache.http.client.methods.CloseableHttpResponse;\n+import org.apache.http.client.methods.HttpPost;\n+import org.apache.http.conn.ssl.TrustSelfSignedStrategy;\n+import org.apache.http.entity.ByteArrayEntity;\n+import org.apache.http.impl.client.CloseableHttpClient;\n+import org.apache.http.impl.client.HttpClientBuilder;\n+import org.apache.http.ssl.SSLContextBuilder;\n+import org.apache.nifi.toolkit.tls.configuration.TlsClientConfig;\n+import org.apache.nifi.toolkit.tls.util.TlsHelper;\n+import org.bouncycastle.pkcs.jcajce.JcaPKCS10CertificationRequest;\n+import org.eclipse.jetty.server.Response;\n+\n+import java.io.IOException;\n+import java.nio.charset.StandardCharsets;\n+import java.security.KeyPair;\n+import java.security.NoSuchAlgorithmException;\n+import java.security.cert.X509Certificate;\n+import java.util.ArrayList;\n+import java.util.List;\n+import java.util.function.Supplier;\n+\n+public class TlsCertificateSigningRequestPerformer {\n+    public static final String RECEIVED_RESPONSE_CODE = \"Received response code \";\n+    public static final String EXPECTED_ONE_CERTIFICATE = \"Expected one certificate\";\n+    public static final String EXPECTED_RESPONSE_TO_CONTAIN_HMAC = \"Expected response to contain hmac\";\n+    public static final String UNEXPECTED_HMAC_RECEIVED_POSSIBLE_MAN_IN_THE_MIDDLE = \"Unexpected hmac received, possible man in the middle\";\n+    public static final String EXPECTED_RESPONSE_TO_CONTAIN_CERTIFICATE = \"Expected response to contain certificate\";\n+    private final Supplier<HttpClientBuilder> httpClientBuilderSupplier;\n+    private final String caHostname;\n+    private final String dn;\n+    private final String token;\n+    private final int port;\n+    private final TlsHelper tlsHelper;\n+\n+    public TlsCertificateSigningRequestPerformer(TlsClientConfig tlsClientConfig) throws NoSuchAlgorithmException {\n+        this(HttpClientBuilder::create, tlsClientConfig.getCaHostname(), tlsClientConfig.getDn(), tlsClientConfig.getToken(), tlsClientConfig.getPort(), tlsClientConfig.createTlsHelper());\n+    }\n+\n+    public TlsCertificateSigningRequestPerformer(Supplier<HttpClientBuilder> httpClientBuilderSupplier, TlsClientConfig tlsClientConfig) throws NoSuchAlgorithmException {\n+        this(httpClientBuilderSupplier, tlsClientConfig.getCaHostname(), tlsClientConfig.getDn(), tlsClientConfig.getToken(), tlsClientConfig.getPort(), tlsClientConfig.createTlsHelper());\n+    }\n+\n+    public TlsCertificateSigningRequestPerformer(Supplier<HttpClientBuilder> httpClientBuilderSupplier, String caHostname, String dn, String token, int port, TlsHelper tlsHelper) {\n+        this.httpClientBuilderSupplier = httpClientBuilderSupplier;\n+        this.caHostname = caHostname;\n+        this.dn = dn;\n+        this.token = token;\n+        this.port = port;\n+        this.tlsHelper = tlsHelper;\n+    }\n+\n+    public static String getDn(String hostname) {\n+        return \"CN=\" + hostname + \",OU=NIFI\";\n+    }\n+\n+    /**\n+     * Submits a CSR to the Certificate authority, checks the resulting hmac, and returns the chain if everything succeeds\n+     *\n+     * @param objectMapper for serialization\n+     * @param keyPair      the keypair to generate the csr for\n+     * @throws IOException if there is a problem during the process\n+     * @returnd the resulting certificate chain\n+     */\n+    public X509Certificate[] perform(ObjectMapper objectMapper, KeyPair keyPair) throws IOException {\n+        try {\n+            List<X509Certificate> certificates = new ArrayList<>();\n+\n+            HttpClientBuilder httpClientBuilder = httpClientBuilderSupplier.get();\n+            SSLContextBuilder sslContextBuilder = SSLContextBuilder.create();\n+\n+            // We will be validating that we are talking to the correct host once we get the response's hmac of the token and public key of the ca\n+            sslContextBuilder.loadTrustMaterial(null, new TrustSelfSignedStrategy());\n+            httpClientBuilder.setSSLSocketFactory(new TlsCertificateAuthorityClientSocketFactory(sslContextBuilder.build(), caHostname, certificates));\n+\n+            String jsonResponseString;\n+            int responseCode;\n+            try (CloseableHttpClient client = httpClientBuilder.build()) {\n+                JcaPKCS10CertificationRequest request = tlsHelper.generateCertificationRequest(dn, keyPair);\n+                TlsCertificateAuthorityRequest tlsCertificateAuthorityRequest = new TlsCertificateAuthorityRequest(tlsHelper.calculateHMac(token, request.getPublicKey()),\n+                        tlsHelper.pemEncodeJcaObject(request));\n+\n+                HttpPost httpPost = new HttpPost();\n+                httpPost.setEntity(new ByteArrayEntity(objectMapper.writeValueAsBytes(tlsCertificateAuthorityRequest)));\n+\n+                try (CloseableHttpResponse response = client.execute(new HttpHost(caHostname, port, \"https\"), httpPost)) {\n+                    jsonResponseString = IOUtils.toString(new BoundedInputStream(response.getEntity().getContent(), 1024 * 1024), StandardCharsets.UTF_8);\n+                    responseCode = response.getStatusLine().getStatusCode();\n+                }\n+            }\n+\n+            if (responseCode != Response.SC_OK) {\n+                throw new IOException(RECEIVED_RESPONSE_CODE + responseCode + \" with payload \" + jsonResponseString);\n+            }\n+\n+            if (certificates.size() != 1) {\n+                throw new IOException(EXPECTED_ONE_CERTIFICATE);\n+            }\n+\n+            TlsCertificateAuthorityResponse tlsCertificateAuthorityResponse = objectMapper.readValue(jsonResponseString, TlsCertificateAuthorityResponse.class);\n+            if (!tlsCertificateAuthorityResponse.hasHmac()) {\n+                throw new IOException(EXPECTED_RESPONSE_TO_CONTAIN_HMAC);\n+            }\n+\n+            X509Certificate caCertificate = certificates.get(0);\n+            if (!tlsHelper.checkHMac(tlsCertificateAuthorityResponse.getHmac(), token, caCertificate.getPublicKey())) {","path":"nifi-toolkit/nifi-toolkit-tls/src/main/java/org/apache/nifi/toolkit/tls/service/TlsCertificateSigningRequestPerformer.java","position":128,"original_position":128,"commit_id":"abdfbf09b14e9079d2695fadde6ee576e0ac4da3","original_commit_id":"abdfbf09b14e9079d2695fadde6ee576e0ac4da3","user":{"login":"alopresto","id":798465,"avatar_url":"https://avatars.githubusercontent.com/u/798465?v=3","gravatar_id":"","url":"https://api.github.com/users/alopresto","html_url":"https://github.com/alopresto","followers_url":"https://api.github.com/users/alopresto/followers","following_url":"https://api.github.com/users/alopresto/following{/other_user}","gists_url":"https://api.github.com/users/alopresto/gists{/gist_id}","starred_url":"https://api.github.com/users/alopresto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alopresto/subscriptions","organizations_url":"https://api.github.com/users/alopresto/orgs","repos_url":"https://api.github.com/users/alopresto/repos","events_url":"https://api.github.com/users/alopresto/events{/privacy}","received_events_url":"https://api.github.com/users/alopresto/received_events","type":"User","site_admin":false},"body":"Please move the HMAC verification above the response parsing and certificate extraction. ","created_at":"2016-07-28T22:35:54Z","updated_at":"2016-07-28T22:35:54Z","html_url":"https://github.com/apache/nifi/pull/695#discussion_r72715741","pull_request_url":"https://api.github.com/repos/apache/nifi/pulls/695","_links":{"self":{"href":"https://api.github.com/repos/apache/nifi/pulls/comments/72715741"},"html":{"href":"https://github.com/apache/nifi/pull/695#discussion_r72715741"},"pull_request":{"href":"https://api.github.com/repos/apache/nifi/pulls/695"}}},"pull_request":{"url":"https://api.github.com/repos/apache/nifi/pulls/695","id":78217748,"html_url":"https://github.com/apache/nifi/pull/695","diff_url":"https://github.com/apache/nifi/pull/695.diff","patch_url":"https://github.com/apache/nifi/pull/695.patch","issue_url":"https://api.github.com/repos/apache/nifi/issues/695","number":695,"state":"open","locked":false,"title":"NIFI-2193 - Command line SSL config utility as well as certificate au…","user":{"login":"brosander","id":596137,"avatar_url":"https://avatars.githubusercontent.com/u/596137?v=3","gravatar_id":"","url":"https://api.github.com/users/brosander","html_url":"https://github.com/brosander","followers_url":"https://api.github.com/users/brosander/followers","following_url":"https://api.github.com/users/brosander/following{/other_user}","gists_url":"https://api.github.com/users/brosander/gists{/gist_id}","starred_url":"https://api.github.com/users/brosander/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brosander/subscriptions","organizations_url":"https://api.github.com/users/brosander/orgs","repos_url":"https://api.github.com/users/brosander/repos","events_url":"https://api.github.com/users/brosander/events{/privacy}","received_events_url":"https://api.github.com/users/brosander/received_events","type":"User","site_admin":false},"body":"…thority client/server","created_at":"2016-07-20T20:56:01Z","updated_at":"2016-07-28T22:35:54Z","closed_at":null,"merged_at":null,"merge_commit_sha":"feeb09f813a6aa9b7eedbde069f3e970b7ff5adf","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/apache/nifi/pulls/695/commits","review_comments_url":"https://api.github.com/repos/apache/nifi/pulls/695/comments","review_comment_url":"https://api.github.com/repos/apache/nifi/pulls/comments{/number}","comments_url":"https://api.github.com/repos/apache/nifi/issues/695/comments","statuses_url":"https://api.github.com/repos/apache/nifi/statuses/abdfbf09b14e9079d2695fadde6ee576e0ac4da3","head":{"label":"brosander:NIFI-2193-pr","ref":"NIFI-2193-pr","sha":"abdfbf09b14e9079d2695fadde6ee576e0ac4da3","user":{"login":"brosander","id":596137,"avatar_url":"https://avatars.githubusercontent.com/u/596137?v=3","gravatar_id":"","url":"https://api.github.com/users/brosander","html_url":"https://github.com/brosander","followers_url":"https://api.github.com/users/brosander/followers","following_url":"https://api.github.com/users/brosander/following{/other_user}","gists_url":"https://api.github.com/users/brosander/gists{/gist_id}","starred_url":"https://api.github.com/users/brosander/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brosander/subscriptions","organizations_url":"https://api.github.com/users/brosander/orgs","repos_url":"https://api.github.com/users/brosander/repos","events_url":"https://api.github.com/users/brosander/events{/privacy}","received_events_url":"https://api.github.com/users/brosander/received_events","type":"User","site_admin":false},"repo":{"id":59511630,"name":"nifi","full_name":"brosander/nifi","owner":{"login":"brosander","id":596137,"avatar_url":"https://avatars.githubusercontent.com/u/596137?v=3","gravatar_id":"","url":"https://api.github.com/users/brosander","html_url":"https://github.com/brosander","followers_url":"https://api.github.com/users/brosander/followers","following_url":"https://api.github.com/users/brosander/following{/other_user}","gists_url":"https://api.github.com/users/brosander/gists{/gist_id}","starred_url":"https://api.github.com/users/brosander/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brosander/subscriptions","organizations_url":"https://api.github.com/users/brosander/orgs","repos_url":"https://api.github.com/users/brosander/repos","events_url":"https://api.github.com/users/brosander/events{/privacy}","received_events_url":"https://api.github.com/users/brosander/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/brosander/nifi","description":"Mirror of Apache NiFi","fork":true,"url":"https://api.github.com/repos/brosander/nifi","forks_url":"https://api.github.com/repos/brosander/nifi/forks","keys_url":"https://api.github.com/repos/brosander/nifi/keys{/key_id}","collaborators_url":"https://api.github.com/repos/brosander/nifi/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/brosander/nifi/teams","hooks_url":"https://api.github.com/repos/brosander/nifi/hooks","issue_events_url":"https://api.github.com/repos/brosander/nifi/issues/events{/number}","events_url":"https://api.github.com/repos/brosander/nifi/events","assignees_url":"https://api.github.com/repos/brosander/nifi/assignees{/user}","branches_url":"https://api.github.com/repos/brosander/nifi/branches{/branch}","tags_url":"https://api.github.com/repos/brosander/nifi/tags","blobs_url":"https://api.github.com/repos/brosander/nifi/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/brosander/nifi/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/brosander/nifi/git/refs{/sha}","trees_url":"https://api.github.com/repos/brosander/nifi/git/trees{/sha}","statuses_url":"https://api.github.com/repos/brosander/nifi/statuses/{sha}","languages_url":"https://api.github.com/repos/brosander/nifi/languages","stargazers_url":"https://api.github.com/repos/brosander/nifi/stargazers","contributors_url":"https://api.github.com/repos/brosander/nifi/contributors","subscribers_url":"https://api.github.com/repos/brosander/nifi/subscribers","subscription_url":"https://api.github.com/repos/brosander/nifi/subscription","commits_url":"https://api.github.com/repos/brosander/nifi/commits{/sha}","git_commits_url":"https://api.github.com/repos/brosander/nifi/git/commits{/sha}","comments_url":"https://api.github.com/repos/brosander/nifi/comments{/number}","issue_comment_url":"https://api.github.com/repos/brosander/nifi/issues/comments{/number}","contents_url":"https://api.github.com/repos/brosander/nifi/contents/{+path}","compare_url":"https://api.github.com/repos/brosander/nifi/compare/{base}...{head}","merges_url":"https://api.github.com/repos/brosander/nifi/merges","archive_url":"https://api.github.com/repos/brosander/nifi/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/brosander/nifi/downloads","issues_url":"https://api.github.com/repos/brosander/nifi/issues{/number}","pulls_url":"https://api.github.com/repos/brosander/nifi/pulls{/number}","milestones_url":"https://api.github.com/repos/brosander/nifi/milestones{/number}","notifications_url":"https://api.github.com/repos/brosander/nifi/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/brosander/nifi/labels{/name}","releases_url":"https://api.github.com/repos/brosander/nifi/releases{/id}","deployments_url":"https://api.github.com/repos/brosander/nifi/deployments","created_at":"2016-05-23T19:17:53Z","updated_at":"2016-05-23T19:18:08Z","pushed_at":"2016-07-27T18:10:41Z","git_url":"git://github.com/brosander/nifi.git","ssh_url":"git@github.com:brosander/nifi.git","clone_url":"https://github.com/brosander/nifi.git","svn_url":"https://github.com/brosander/nifi","homepage":"","size":52779,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"apache:master","ref":"master","sha":"15d1e1bbf83fb8d5259d24997b7c0c56aa8e636e","user":{"login":"apache","id":47359,"avatar_url":"https://avatars.githubusercontent.com/u/47359?v=3","gravatar_id":"","url":"https://api.github.com/users/apache","html_url":"https://github.com/apache","followers_url":"https://api.github.com/users/apache/followers","following_url":"https://api.github.com/users/apache/following{/other_user}","gists_url":"https://api.github.com/users/apache/gists{/gist_id}","starred_url":"https://api.github.com/users/apache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apache/subscriptions","organizations_url":"https://api.github.com/users/apache/orgs","repos_url":"https://api.github.com/users/apache/repos","events_url":"https://api.github.com/users/apache/events{/privacy}","received_events_url":"https://api.github.com/users/apache/received_events","type":"Organization","site_admin":false},"repo":{"id":27911088,"name":"nifi","full_name":"apache/nifi","owner":{"login":"apache","id":47359,"avatar_url":"https://avatars.githubusercontent.com/u/47359?v=3","gravatar_id":"","url":"https://api.github.com/users/apache","html_url":"https://github.com/apache","followers_url":"https://api.github.com/users/apache/followers","following_url":"https://api.github.com/users/apache/following{/other_user}","gists_url":"https://api.github.com/users/apache/gists{/gist_id}","starred_url":"https://api.github.com/users/apache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apache/subscriptions","organizations_url":"https://api.github.com/users/apache/orgs","repos_url":"https://api.github.com/users/apache/repos","events_url":"https://api.github.com/users/apache/events{/privacy}","received_events_url":"https://api.github.com/users/apache/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/apache/nifi","description":"Mirror of Apache NiFi","fork":false,"url":"https://api.github.com/repos/apache/nifi","forks_url":"https://api.github.com/repos/apache/nifi/forks","keys_url":"https://api.github.com/repos/apache/nifi/keys{/key_id}","collaborators_url":"https://api.github.com/repos/apache/nifi/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/apache/nifi/teams","hooks_url":"https://api.github.com/repos/apache/nifi/hooks","issue_events_url":"https://api.github.com/repos/apache/nifi/issues/events{/number}","events_url":"https://api.github.com/repos/apache/nifi/events","assignees_url":"https://api.github.com/repos/apache/nifi/assignees{/user}","branches_url":"https://api.github.com/repos/apache/nifi/branches{/branch}","tags_url":"https://api.github.com/repos/apache/nifi/tags","blobs_url":"https://api.github.com/repos/apache/nifi/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/apache/nifi/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/apache/nifi/git/refs{/sha}","trees_url":"https://api.github.com/repos/apache/nifi/git/trees{/sha}","statuses_url":"https://api.github.com/repos/apache/nifi/statuses/{sha}","languages_url":"https://api.github.com/repos/apache/nifi/languages","stargazers_url":"https://api.github.com/repos/apache/nifi/stargazers","contributors_url":"https://api.github.com/repos/apache/nifi/contributors","subscribers_url":"https://api.github.com/repos/apache/nifi/subscribers","subscription_url":"https://api.github.com/repos/apache/nifi/subscription","commits_url":"https://api.github.com/repos/apache/nifi/commits{/sha}","git_commits_url":"https://api.github.com/repos/apache/nifi/git/commits{/sha}","comments_url":"https://api.github.com/repos/apache/nifi/comments{/number}","issue_comment_url":"https://api.github.com/repos/apache/nifi/issues/comments{/number}","contents_url":"https://api.github.com/repos/apache/nifi/contents/{+path}","compare_url":"https://api.github.com/repos/apache/nifi/compare/{base}...{head}","merges_url":"https://api.github.com/repos/apache/nifi/merges","archive_url":"https://api.github.com/repos/apache/nifi/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/apache/nifi/downloads","issues_url":"https://api.github.com/repos/apache/nifi/issues{/number}","pulls_url":"https://api.github.com/repos/apache/nifi/pulls{/number}","milestones_url":"https://api.github.com/repos/apache/nifi/milestones{/number}","notifications_url":"https://api.github.com/repos/apache/nifi/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/apache/nifi/labels{/name}","releases_url":"https://api.github.com/repos/apache/nifi/releases{/id}","deployments_url":"https://api.github.com/repos/apache/nifi/deployments","created_at":"2014-12-12T08:00:05Z","updated_at":"2016-07-28T17:09:25Z","pushed_at":"2016-07-28T22:31:11Z","git_url":"git://github.com/apache/nifi.git","ssh_url":"git@github.com:apache/nifi.git","clone_url":"https://github.com/apache/nifi.git","svn_url":"https://github.com/apache/nifi","homepage":"","size":75166,"stargazers_count":320,"watchers_count":320,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":284,"mirror_url":"git://git.apache.org/nifi.git","open_issues_count":63,"forks":284,"open_issues":63,"watchers":320,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/apache/nifi/pulls/695"},"html":{"href":"https://github.com/apache/nifi/pull/695"},"issue":{"href":"https://api.github.com/repos/apache/nifi/issues/695"},"comments":{"href":"https://api.github.com/repos/apache/nifi/issues/695/comments"},"review_comments":{"href":"https://api.github.com/repos/apache/nifi/pulls/695/comments"},"review_comment":{"href":"https://api.github.com/repos/apache/nifi/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/apache/nifi/pulls/695/commits"},"statuses":{"href":"https://api.github.com/repos/apache/nifi/statuses/abdfbf09b14e9079d2695fadde6ee576e0ac4da3"}}}}
{"actor":{"display_login":"alopresto"}}