Skip to content

Commit 9ff6251

Browse files
lfranckelfrancke
committed
Backport NIFI-14858 to NiFi 2.4.0
1 parent 6c406ca commit 9ff6251

File tree

2 files changed

+108
-0
lines changed

2 files changed

+108
-0
lines changed

‎CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file.
99
- ubi9-rust-builder: Include `.tar.gz` snapshots of the operator source code in container images ([#1207])
1010
- opensearch: Add Opensearch as new product with version `3.1.0` ([#1215]).
1111
- opensearch: Use build-repo.stackable.tech instead of Maven Central ([#1222]).
12+
- nifi: Backport NIFI-14848 to NiFi ([#1225])
1213

1314
### Changed
1415

@@ -20,6 +21,7 @@ All notable changes to this project will be documented in this file.
2021
[#1219]: https://github.com/stackabletech/docker-images/pull/1219
2122
[#1220]: https://github.com/stackabletech/docker-images/pull/1220
2223
[#1222]: https://github.com/stackabletech/docker-images/pull/1222
24+
[#1225]: https://github.com/stackabletech/docker-images/pull/1225
2325

2426
## [25.7.0] - 2025-07-23
2527

‎nifi/stackable/patches/2.4.0/0004-NIFI-14858-Make-SNI-checking-configurable.patch

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
From 6f36be44f82a759fe7f4604839b5e528e5037fea Mon Sep 17 00:00:00 2001
2+
From: Lars Francke <[email protected]>
3+
Date: Wed, 13 Aug 2025 14:16:55 +0200
4+
Subject: NIFI-14858: Make SNI checking configurable
5+
6+
Introduces two new properties:
7+
- nifi.web.https.sni.required
8+
- nifi.web.https.sni.host.check
9+
---
10+
.../StandardServerConnectorFactory.java | 24 +++++++++++++++++++
11+
.../org/apache/nifi/util/NiFiProperties.java | 10 ++++++++
12+
.../FrameworkServerConnectorFactory.java | 4 ++++
13+
3 files changed, 38 insertions(+)
14+
15+
diff --git a/nifi-commons/nifi-jetty-configuration/src/main/java/org/apache/nifi/jetty/configuration/connector/StandardServerConnectorFactory.java b/nifi-commons/nifi-jetty-configuration/src/main/java/org/apache/nifi/jetty/configuration/connector/StandardServerConnectorFactory.java
16+
index 26d09706a1..37fda0929d 100644
17+
--- a/nifi-commons/nifi-jetty-configuration/src/main/java/org/apache/nifi/jetty/configuration/connector/StandardServerConnectorFactory.java
18+
+++ b/nifi-commons/nifi-jetty-configuration/src/main/java/org/apache/nifi/jetty/configuration/connector/StandardServerConnectorFactory.java
19+
@@ -70,6 +70,10 @@ public class StandardServerConnectorFactory implements ServerConnectorFactory {
20+
21+
private int requestHeaderSize = 8192;
22+
23+
+ private boolean sniRequired = true;
24+
+
25+
+ private boolean sniHostCheck = true;
26+
+
27+
/**
28+
* Standard Server Connector Factory Constructor with required properties
29+
*
30+
@@ -181,6 +185,24 @@ public class StandardServerConnectorFactory implements ServerConnectorFactory {
31+
this.requestHeaderSize = requestHeaderSize;
32+
}
33+
34+
+ /**
35+
+ * Set SNI Required controls whether SNI is required for TLS connections
36+
+ *
37+
+ * @param sniRequired SNI Required status
38+
+ */
39+
+ public void setSniRequired(final boolean sniRequired) {
40+
+ this.sniRequired = sniRequired;
41+
+ }
42+
+
43+
+ /**
44+
+ * Set SNI Host Check controls whether SNI host checking is enabled for TLS connections
45+
+ *
46+
+ * @param sniHostCheck SNI Host Check status
47+
+ */
48+
+ public void setSniHostCheck(final boolean sniHostCheck) {
49+
+ this.sniHostCheck = sniHostCheck;
50+
+ }
51+
+
52+
protected Server getServer() {
53+
return server;
54+
}
55+
@@ -195,6 +217,8 @@ public class StandardServerConnectorFactory implements ServerConnectorFactory {
56+
httpConfiguration.setSendServerVersion(SEND_SERVER_VERSION);
57+
58+
final SecureRequestCustomizer secureRequestCustomizer = new SecureRequestCustomizer();
59+
+ secureRequestCustomizer.setSniRequired(sniRequired);
60+
+ secureRequestCustomizer.setSniHostCheck(sniHostCheck);
61+
httpConfiguration.addCustomizer(secureRequestCustomizer);
62+
}
63+
64+
diff --git a/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java b/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java
65+
index cd3cd0b27e..0e07d5a141 100644
66+
--- a/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java
67+
+++ b/nifi-commons/nifi-properties/src/main/java/org/apache/nifi/util/NiFiProperties.java
68+
@@ -206,6 +206,8 @@ public class NiFiProperties extends ApplicationProperties {
69+
public static final String WEB_HTTPS_CIPHERSUITES_INCLUDE = "nifi.web.https.ciphersuites.include";
70+
public static final String WEB_HTTPS_CIPHERSUITES_EXCLUDE = "nifi.web.https.ciphersuites.exclude";
71+
public static final String WEB_HTTPS_NETWORK_INTERFACE_PREFIX = "nifi.web.https.network.interface.";
72+
+ public static final String WEB_HTTPS_SNI_REQUIRED = "nifi.web.https.sni.required";
73+
+ public static final String WEB_HTTPS_SNI_HOST_CHECK = "nifi.web.https.sni.host.check";
74+
public static final String WEB_WORKING_DIR = "nifi.web.jetty.working.directory";
75+
public static final String WEB_THREADS = "nifi.web.jetty.threads";
76+
public static final String WEB_MAX_HEADER_SIZE = "nifi.web.max.header.size";
77+
@@ -710,6 +712,14 @@ public class NiFiProperties extends ApplicationProperties {
78+
return Arrays.stream(protocols.split("\\s+")).collect(Collectors.toSet());
79+
}
80+
81+
+ public boolean isWebHttpsSniRequired() {
82+
+ return Boolean.parseBoolean(getProperty(WEB_HTTPS_SNI_REQUIRED, "true"));
83+
+ }
84+
+
85+
+ public boolean isWebHttpsSniHostCheck() {
86+
+ return Boolean.parseBoolean(getProperty(WEB_HTTPS_SNI_HOST_CHECK, "true"));
87+
+ }
88+
+
89+
public String getWebMaxHeaderSize() {
90+
return getProperty(WEB_MAX_HEADER_SIZE, DEFAULT_WEB_MAX_HEADER_SIZE);
91+
}
92+
diff --git a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java
93+
index b58c886f4f..55a28b1c3c 100644
94+
--- a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java
95+
+++ b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/FrameworkServerConnectorFactory.java
96+
@@ -90,6 +90,10 @@ public class FrameworkServerConnectorFactory extends StandardServerConnectorFact
97+
98+
// Set Transport Layer Security Protocols based on platform configuration
99+
setIncludeSecurityProtocols(TlsPlatform.getPreferredProtocols().toArray(new String[0]));
100+
+
101+
+ // Set SNI configuration from properties
102+
+ setSniRequired(properties.isWebHttpsSniRequired());
103+
+ setSniHostCheck(properties.isWebHttpsSniHostCheck());
104+
}
105+
}
106+

0 commit comments

Comments
 (0)