MINIFICPP-2846 minifi-encrypt-config should encrypt sensitive propert… (#2204)

The minifi-encrypt-config utility should encrypt the additional properties files in the
minifi.properties.d directory, too, if they exist. We allow nifi.sensitive.props.additional.keys
(the list of additional sensitive property keys) to be in any of the properties files.

Author: fgerlits

encrypt-config/ConfigFile.cpp

@@ -24,16 +24,18 @@
 #include <stdexcept>
 
 #include "../core-framework/include/Defaults.h"
-#include "ConfigFile.h"
-#include "ConfigFileEncryptor.h"
 #include "FlowConfigEncryptor.h"
-#include "utils/Enum.h"
+#include "PropertiesFileEncryptor.h"
+#include "properties/Properties.h"
+#include "properties/PropertiesFile.h"
 #include "utils/file/FileUtils.h"
 
 namespace {
 constexpr std::string_view ENCRYPTION_KEY_PROPERTY_NAME = "nifi.bootstrap.sensitive.key";
 constexpr std::string_view SENSITIVE_PROPERTIES_KEY_PROPERTY_NAME = "nifi.bootstrap.sensitive.properties.key";
 
+namespace minifi = org::apache::nifi::minifi;
+
 std::string readFile(const std::filesystem::path& file_path) {
   try {
     std::ifstream file_stream{file_path, std::ios::binary};
@@ -43,11 +45,27 @@ std::string readFile(const std::filesystem::path& file_path) {
     throw std::runtime_error("Error while reading file \"" + file_path.string() + "\"");
   }
 }
+
+uint32_t encryptSensitiveValuesInMinifiPropertiesFile(const std::filesystem::path& file_path, const std::vector<std::string>& sensitive_properties,
+    const minifi::encrypt_config::EncryptionKeys& keys) {
+  minifi::PropertiesFile properties_file{std::ifstream{file_path}};
+  if (properties_file.size() == 0) {
+    std::cout << "Properties file " + file_path.string() + " is missing or empty!\n";
+    return 0;
+  }
+
+  uint32_t num_properties_encrypted = minifi::encrypt_config::encryptSensitivePropertiesInFile(properties_file, sensitive_properties, keys);
+  if (num_properties_encrypted > 0) {
+    properties_file.writeTo(file_path);
+    std::cout << "Encrypted " << num_properties_encrypted << " sensitive " << (num_properties_encrypted == 1 ? "property" : "properties") << " in " << file_path.string() << '\n';
+  }
+  return num_properties_encrypted;
+}
 }  // namespace
 
 namespace org::apache::nifi::minifi::encrypt_config {
 
-EncryptConfig::EncryptConfig(const std::string& minifi_home) : minifi_home_(minifi_home) {
+EncryptConfig::EncryptConfig(std::filesystem::path minifi_home) : minifi_home_(std::move(minifi_home)), prev_current_path_(std::filesystem::current_path()) {
   if (sodium_init() < 0) {
     // encryption/decryption depends on the libsodium library which needs to be initialized
     throw std::runtime_error{"Could not initialize the libsodium library!"};
@@ -56,8 +74,12 @@ EncryptConfig::EncryptConfig(const std::string& minifi_home) : minifi_home_(mini
   std::filesystem::current_path(minifi_home_);
 }
 
+EncryptConfig::~EncryptConfig() {
+  std::filesystem::current_path(prev_current_path_);
+}
+
 bool EncryptConfig::isReEncrypting() const {
-  encrypt_config::ConfigFile bootstrap_file{std::ifstream{bootstrapFilePath()}};
+  PropertiesFile bootstrap_file{std::ifstream{bootstrapFilePath()}};
 
   std::string decryption_key_name = utils::string::join_pack(ENCRYPTION_KEY_PROPERTY_NAME, ".old");
   std::optional<std::string> decryption_key_hex = bootstrap_file.getValue(decryption_key_name);
@@ -66,7 +88,7 @@ bool EncryptConfig::isReEncrypting() const {
 }
 
 std::filesystem::path EncryptConfig::flowConfigPath() const {
-  encrypt_config::ConfigFile properties_file{std::ifstream{propertiesFilePath()}};
+  PropertiesFile properties_file{std::ifstream{propertiesFilePath()}};
   std::optional<std::filesystem::path> config_path{properties_file.getValue(Configure::nifi_flow_configuration_file)};
   if (!config_path) {
     config_path = utils::file::PathUtils::resolve(minifi_home_, "conf/config.yml");
@@ -123,7 +145,7 @@ std::filesystem::path EncryptConfig::propertiesFilePath() const {
 }
 
 EncryptionKeys EncryptConfig::getEncryptionKeys(std::string_view property_name) const {
-  encrypt_config::ConfigFile bootstrap_file{std::ifstream{bootstrapFilePath()}};
+  PropertiesFile bootstrap_file{std::ifstream{bootstrapFilePath()}};
 
   std::string decryption_key_name = utils::string::join_pack(property_name, ".old");
   std::optional<std::string> decryption_key_hex = bootstrap_file.getValue(decryption_key_name);
@@ -168,7 +190,7 @@ std::string EncryptConfig::hexDecodeAndValidateKey(const std::string& key, const
 
 void EncryptConfig::writeEncryptionKeyToBootstrapFile(const std::string& encryption_key_name, const utils::crypto::Bytes& encryption_key) const {
   std::string key_encoded = utils::string::to_hex(utils::crypto::bytesToString(encryption_key));
-  encrypt_config::ConfigFile bootstrap_file{std::ifstream{bootstrapFilePath()}};
+  PropertiesFile bootstrap_file{std::ifstream{bootstrapFilePath()}};
 
   if (bootstrap_file.hasValue(encryption_key_name)) {
     bootstrap_file.update(encryption_key_name, key_encoded);
@@ -180,22 +202,28 @@ void EncryptConfig::writeEncryptionKeyToBootstrapFile(const std::string& encrypt
 }
 
 void EncryptConfig::encryptSensitiveValuesInMinifiProperties() const {
-  EncryptionKeys keys = getEncryptionKeys(ENCRYPTION_KEY_PROPERTY_NAME);
+  const auto base_properties_file = propertiesFilePath();
+  if (!utils::file::exists(base_properties_file)) {
+    std::cout << "The minifi properties file " << base_properties_file.string() << " does not exist. Did you specify the minifi home directory correctly?\n";
+    return;
+  }
 
-  encrypt_config::ConfigFile properties_file{std::ifstream{propertiesFilePath()}};
-  if (properties_file.size() == 0) {
-    throw std::runtime_error{"Properties file " + propertiesFilePath().string() + " not found!"};
+  const std::vector<std::string> sensitive_properties = getSensitiveProperties(base_properties_file);
+  const EncryptionKeys keys = getEncryptionKeys(ENCRYPTION_KEY_PROPERTY_NAME);
+
+  uint32_t num_properties_encrypted = encryptSensitiveValuesInMinifiPropertiesFile(base_properties_file, sensitive_properties, keys);
+
+  const auto extra_properties_files_dir = properties::extraPropertiesFilesDirName(base_properties_file);
+  const auto logger = core::logging::LoggerFactory<EncryptConfig>::getLogger();
+  const auto extra_properties_file_names = properties::getExtraPropertiesFileNames(extra_properties_files_dir, logger);
+
+  for (const auto& file_name : extra_properties_file_names) {
+    num_properties_encrypted += encryptSensitiveValuesInMinifiPropertiesFile(extra_properties_files_dir / file_name, sensitive_properties, keys);
   }
 
-  uint32_t num_properties_encrypted = encryptSensitivePropertiesInFile(properties_file, keys);
   if (num_properties_encrypted == 0) {
-    std::cout << "Could not find any (new) sensitive properties to encrypt in " << propertiesFilePath() << '\n';
-    return;
+    std::cout << "Could not find any (new) sensitive properties to encrypt.\n";
   }
-
-  properties_file.writeTo(propertiesFilePath());
-  std::cout << "Encrypted " << num_properties_encrypted << " sensitive "
-      << (num_properties_encrypted == 1 ? "property" : "properties") << " in " << propertiesFilePath() << '\n';
 }
 
 void EncryptConfig::encryptSensitiveValuesInFlowConfig(

encrypt-config/ConfigFileEncryptor.h

@@ -25,7 +25,8 @@ namespace org::apache::nifi::minifi::encrypt_config {
 
 class EncryptConfig {
  public:
-  explicit EncryptConfig(const std::string& minifi_home);
+  explicit EncryptConfig(std::filesystem::path minifi_home);
+  ~EncryptConfig();
 
   void encryptSensitiveValuesInMinifiProperties() const;
   void encryptSensitiveValuesInFlowConfig(
@@ -44,6 +45,7 @@ class EncryptConfig {
   void writeEncryptionKeyToBootstrapFile(const std::string& encryption_key_name, const utils::crypto::Bytes& encryption_key) const;
 
   const std::filesystem::path minifi_home_;
+  const std::filesystem::path prev_current_path_;
 };
 
 }  // namespace org::apache::nifi::minifi::encrypt_config

encrypt-config/EncryptConfig.cpp

@@ -21,6 +21,7 @@
 #include "EncryptConfig.h"
 #include "argparse/argparse.hpp"
 #include "minifi-cpp/agent/agent_version.h"
+#include "utils/file/FileUtils.h"
 #include "utils/StringUtils.h"
 
 namespace minifi = org::apache::nifi::minifi;
@@ -68,7 +69,16 @@ int main(int argc, char* argv[]) try {
     return 1;
   }
 
-  EncryptConfig encrypt_config{argument_parser.get("-m")};
+  std::filesystem::path minifi_home{argument_parser.get("-m")};
+  if (!minifi::utils::file::exists(minifi_home)) {
+    std::cerr << "The minifi home directory " << minifi_home.string() << " does not exist!\n";
+    return 7;
+  }
+  if (!minifi::utils::file::is_directory(minifi_home)) {
+    std::cerr << "The minifi home is set to " << minifi_home.string() << ", which is not a directory!\n";
+    return 8;
+  }
+  EncryptConfig encrypt_config{std::move(minifi_home)};
 
   std::string operation = argument_parser.get("operation");
   const auto re_encrypt = argument_parser.get<bool>("--re-encrypt");

encrypt-config/EncryptConfig.h

@@ -15,33 +15,50 @@
  * limitations under the License.
  */
 
-#include "ConfigFileEncryptor.h"
+#include "PropertiesFileEncryptor.h"
 
 #include <iostream>
 #include <optional>
 #include <string>
 
+#include "properties/Configuration.h"
+#include "properties/Properties.h"
 #include "utils/StringUtils.h"
 
-namespace org::apache::nifi::minifi::encrypt_config {
-
+namespace {
 bool isEncrypted(const std::optional<std::string>& encryption_type) {
   return encryption_type && !encryption_type->empty() && *encryption_type  != "plaintext";
 }
+}  // namespace
+
+namespace org::apache::nifi::minifi::encrypt_config {
+
+std::vector<std::string> getSensitiveProperties(const std::filesystem::path& properties_file_path) {
+  auto minifi_properties = PropertiesImpl{PropertiesImpl::PersistTo::MultipleFiles, "MiNiFi properties"};
+  minifi_properties.loadConfigureFile(properties_file_path);
+
+  auto sensitive_properties = Configuration::getSensitiveProperties([&minifi_properties](const std::string& property_name) {
+    return minifi_properties.getString(property_name);
+  });
+  auto not_found = [&minifi_properties](const std::string& property_name) { return !minifi_properties.getString(property_name).has_value(); };
+  std::erase_if(sensitive_properties, not_found);
+
+  return sensitive_properties;
+}
 
-uint32_t encryptSensitivePropertiesInFile(ConfigFile& config_file, const utils::crypto::Bytes & encryption_key) {
-  return encryptSensitivePropertiesInFile(config_file, EncryptionKeys{{}, encryption_key});
+uint32_t encryptSensitivePropertiesInFile(PropertiesFile& properties_file, const std::vector<std::string>& sensitive_properties, const utils::crypto::Bytes & encryption_key) {
+  return encryptSensitivePropertiesInFile(properties_file, sensitive_properties, EncryptionKeys{{}, encryption_key});
 }
 
-uint32_t encryptSensitivePropertiesInFile(ConfigFile& config_file, const EncryptionKeys& keys) {
-  int num_properties_encrypted = 0;
+uint32_t encryptSensitivePropertiesInFile(PropertiesFile& properties_file, const std::vector<std::string>& sensitive_properties, const EncryptionKeys& keys) {
+  uint32_t num_properties_encrypted = 0;
 
-  for (const auto& property_key : config_file.getSensitiveProperties()) {
-    std::optional<std::string> property_value = config_file.getValue(property_key);
+  for (const auto& property_key : sensitive_properties) {
+    std::optional<std::string> property_value = properties_file.getValue(property_key);
     if (!property_value) { continue; }
 
     std::string encryption_type_key = property_key + ".protected";
-    std::optional<std::string> encryption_type = config_file.getValue(encryption_type_key);
+    std::optional<std::string> encryption_type = properties_file.getValue(encryption_type_key);
 
     std::string raw_value = *property_value;
     if (isEncrypted(encryption_type)) {
@@ -63,12 +80,12 @@ uint32_t encryptSensitivePropertiesInFile(ConfigFile& config_file, const Encrypt
 
     std::string encrypted_property_value = utils::crypto::encrypt(raw_value, keys.encryption_key);
 
-    config_file.update(property_key, encrypted_property_value);
+    properties_file.update(property_key, encrypted_property_value);
 
     if (encryption_type) {
-      config_file.update(encryption_type_key, utils::crypto::EncryptionType::name());
+      properties_file.update(encryption_type_key, utils::crypto::EncryptionType::name());
     } else {
-      config_file.insertAfter(property_key, encryption_type_key, utils::crypto::EncryptionType::name());
+      properties_file.insertAfter(property_key, encryption_type_key, utils::crypto::EncryptionType::name());
     }
 
     std::cout << "Encrypted property: " << property_key << '\n';

encrypt-config/EncryptConfigMain.cpp

@@ -16,22 +16,16 @@
  */
 #pragma once
 
-#include <string>
-#include <vector>
-
-#include "utils/crypto/EncryptionUtils.h"
 #include "properties/PropertiesFile.h"
+#include "utils/crypto/EncryptionUtils.h"
+#include "Utils.h"
 
 namespace org::apache::nifi::minifi::encrypt_config {
 
-class ConfigFile : public PropertiesFile {
- public:
-  using PropertiesFile::PropertiesFile;
+std::vector<std::string> getSensitiveProperties(const std::filesystem::path& properties_file_path);
 
-  [[nodiscard]] std::vector<std::string> getSensitiveProperties() const;
+uint32_t encryptSensitivePropertiesInFile(PropertiesFile& properties_file, const std::vector<std::string>& sensitive_properties, const utils::crypto::Bytes& encryption_key);
 
- private:
-  friend bool operator==(const ConfigFile&, const ConfigFile&);
-};
+uint32_t encryptSensitivePropertiesInFile(PropertiesFile& properties_file, const std::vector<std::string>& sensitive_properties, const EncryptionKeys& keys);
 
 }  // namespace org::apache::nifi::minifi::encrypt_config