Uploaded image for project: 'Apache NiFi'
  1. Apache NiFi
  2. NIFI-7468

Improve internal handling of SSL channels

    XMLWordPrintableJSON

Details

    Description

      While refactoring the TLS protocol version issue in NIFI-7407, I discovered that some processors make use of NiFi custom implementations of SSLSocketChannel, SSLCommsSession, and SSLSocketChannelInputStream. These implementations break on TLSv1.3.

      Further investigation is needed to determine why these custom implementations were provided originally, whether they are still required, and why they do not handle TLSv1.3 successfully.

      Diagnostic error:

      Error reading from channel due to Tag mismatch!: javax.net.ssl.SSLException: Tag mismatch!

      Attachments

        Issue Links

          depends upon

          Improvement - An improvement or enhancement to an existing feature or task. NIFI-7407 Change cluster communication protocol listener

          • Critical - Crashes, loss of data, severe memory leak.
          • Resolved
          is depended upon by

          Sub-task - The sub-task of the issue NIFI-6563 Add support for TLSv1.3 when running on Java 11

          • Major - Major loss of function.
          • Resolved
          is related to

          Epic - Created by Jira Software - do not edit or delete. Issue type for a big user story that needs to be broken down. NIFI-5458 Improve NiFi TLS and certificate management

          • Major - Major loss of function.
          • Resolved

          Improvement - An improvement or enhancement to an existing feature or task. NIFI-8298 Refactor nifi-security-utils to reduce dependence on Bouncy Castle

          • Major - Major loss of function.
          • Resolved
          relates to

          Improvement - An improvement or enhancement to an existing feature or task. NIFI-8462 Refactor PutSyslog and ListenSyslog using Netty

          • Major - Major loss of function.
          • Resolved

          Improvement - An improvement or enhancement to an existing feature or task. NIFI-8616 Migrate SSL socket code to use Netty

          • Major - Major loss of function.
          • Resolved
          links to

          Web Link GitHub Pull Request #4979

          Web Link GitHub Pull Request #5152

          Activity

            People

              exceptionfactory David Handermann
              alopresto Andy LoPresto
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 2h 20m
                  2h 20m