From ac91f14f05ccf7d2198f6e313f03a5c73cc1c296 Mon Sep 17 00:00:00 2001 From: Madhura Bhave Date: Tue, 11 Feb 2020 17:03:50 -0800 Subject: [PATCH] Polish "Verify ssl key alias on server startup" See gh-19202 --- .../embedded/jetty/SslServerCustomizer.java | 7 +++--- .../embedded/netty/SslServerCustomizer.java | 7 +++--- .../undertow/SslBuilderCustomizer.java | 7 +++--- ...ls.java => SslConfigurationValidator.java} | 10 ++++---- .../NettyReactiveWebServerFactoryTests.java | 2 +- .../TomcatServletWebServerFactoryTests.java | 2 +- ...AbstractReactiveWebServerFactoryTests.java | 2 +- ...ava => SslConfigurationValidatorTest.java} | 24 +++++++++---------- .../AbstractServletWebServerFactoryTests.java | 2 +- 9 files changed, 31 insertions(+), 32 deletions(-) rename spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/{SslUtils.java => SslConfigurationValidator.java} (83%) rename spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/server/{SslUtilsTest.java => SslConfigurationValidatorTest.java} (66%) diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/jetty/SslServerCustomizer.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/jetty/SslServerCustomizer.java index ef4d5499e7..27cece2965 100644 --- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/jetty/SslServerCustomizer.java +++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/jetty/SslServerCustomizer.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2019 the original author or authors. + * Copyright 2012-2020 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -37,8 +37,8 @@ import org.eclipse.jetty.util.ssl.SslContextFactory; import org.springframework.boot.web.server.Http2; import org.springframework.boot.web.server.Ssl; +import org.springframework.boot.web.server.SslConfigurationValidator; import org.springframework.boot.web.server.SslStoreProvider; -import org.springframework.boot.web.server.SslUtils; import org.springframework.boot.web.server.WebServerException; import org.springframework.util.Assert; import org.springframework.util.ClassUtils; @@ -50,6 +50,7 @@ import org.springframework.util.ResourceUtils; * * @author Brian Clozel * @author Olivier Lamy + * @author Chris Bono */ class SslServerCustomizer implements JettyServerCustomizer { @@ -245,7 +246,7 @@ class SslServerCustomizer implements JettyServerCustomizer { @Override protected void doStart() throws Exception { super.doStart(); - SslUtils.assertStoreContainsAlias(this.sslContextFactory.getKeyStore(), this.keyAlias); + SslConfigurationValidator.validateKeyAlias(this.sslContextFactory.getKeyStore(), this.keyAlias); } } diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/netty/SslServerCustomizer.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/netty/SslServerCustomizer.java index ac3fd47990..eeab11a5f9 100644 --- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/netty/SslServerCustomizer.java +++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/netty/SslServerCustomizer.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2019 the original author or authors. + * Copyright 2012-2020 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -43,8 +43,8 @@ import reactor.netty.tcp.SslProvider; import org.springframework.boot.web.server.Http2; import org.springframework.boot.web.server.Ssl; +import org.springframework.boot.web.server.SslConfigurationValidator; import org.springframework.boot.web.server.SslStoreProvider; -import org.springframework.boot.web.server.SslUtils; import org.springframework.boot.web.server.WebServerException; import org.springframework.util.ResourceUtils; @@ -107,8 +107,7 @@ public class SslServerCustomizer implements NettyServerCustomizer { protected KeyManagerFactory getKeyManagerFactory(Ssl ssl, SslStoreProvider sslStoreProvider) { try { KeyStore keyStore = getKeyStore(ssl, sslStoreProvider); - SslUtils.assertStoreContainsAlias(keyStore, ssl.getKeyAlias()); - + SslConfigurationValidator.validateKeyAlias(keyStore, ssl.getKeyAlias()); KeyManagerFactory keyManagerFactory = (ssl.getKeyAlias() == null) ? KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()) : new ConfigurableAliasKeyManagerFactory(ssl.getKeyAlias(), diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/undertow/SslBuilderCustomizer.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/undertow/SslBuilderCustomizer.java index 1bde5d121b..65c948be88 100644 --- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/undertow/SslBuilderCustomizer.java +++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/undertow/SslBuilderCustomizer.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2019 the original author or authors. + * Copyright 2012-2020 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -40,8 +40,8 @@ import org.xnio.Sequence; import org.xnio.SslClientAuthMode; import org.springframework.boot.web.server.Ssl; +import org.springframework.boot.web.server.SslConfigurationValidator; import org.springframework.boot.web.server.SslStoreProvider; -import org.springframework.boot.web.server.SslUtils; import org.springframework.boot.web.server.WebServerException; import org.springframework.util.ResourceUtils; @@ -108,8 +108,7 @@ class SslBuilderCustomizer implements UndertowBuilderCustomizer { private KeyManager[] getKeyManagers(Ssl ssl, SslStoreProvider sslStoreProvider) { try { KeyStore keyStore = getKeyStore(ssl, sslStoreProvider); - SslUtils.assertStoreContainsAlias(keyStore, ssl.getKeyAlias()); - + SslConfigurationValidator.validateKeyAlias(keyStore, ssl.getKeyAlias()); KeyManagerFactory keyManagerFactory = KeyManagerFactory .getInstance(KeyManagerFactory.getDefaultAlgorithm()); char[] keyPassword = (ssl.getKeyPassword() != null) ? ssl.getKeyPassword().toCharArray() : null; diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/SslUtils.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/SslConfigurationValidator.java similarity index 83% rename from spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/SslUtils.java rename to spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/SslConfigurationValidator.java index 4f51a3d6b9..a04027619a 100644 --- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/SslUtils.java +++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/SslConfigurationValidator.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2019 the original author or authors. + * Copyright 2012-2020 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -26,14 +26,14 @@ import org.springframework.util.StringUtils; * Provides utilities around SSL. * * @author Chris Bono - * @since 2.1.x + * @since 2.1.13 */ -public final class SslUtils { +public final class SslConfigurationValidator { - private SslUtils() { + private SslConfigurationValidator() { } - public static void assertStoreContainsAlias(KeyStore keyStore, String keyAlias) { + public static void validateKeyAlias(KeyStore keyStore, String keyAlias) { if (!StringUtils.isEmpty(keyAlias)) { try { Assert.state(keyStore.containsAlias(keyAlias), diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/netty/NettyReactiveWebServerFactoryTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/netty/NettyReactiveWebServerFactoryTests.java index e9f35f8c72..c455ae901b 100644 --- a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/netty/NettyReactiveWebServerFactoryTests.java +++ b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/netty/NettyReactiveWebServerFactoryTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2019 the original author or authors. + * Copyright 2012-2020 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java index c8f1ad9121..59060a67f5 100644 --- a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java +++ b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2019 the original author or authors. + * Copyright 2012-2020 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/reactive/server/AbstractReactiveWebServerFactoryTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/reactive/server/AbstractReactiveWebServerFactoryTests.java index 2949fd1d12..8746030ebf 100644 --- a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/reactive/server/AbstractReactiveWebServerFactoryTests.java +++ b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/reactive/server/AbstractReactiveWebServerFactoryTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2019 the original author or authors. + * Copyright 2012-2020 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/server/SslUtilsTest.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/server/SslConfigurationValidatorTest.java similarity index 66% rename from spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/server/SslUtilsTest.java rename to spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/server/SslConfigurationValidatorTest.java index e3504dc7e2..3a48b29433 100644 --- a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/server/SslUtilsTest.java +++ b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/server/SslConfigurationValidatorTest.java @@ -27,12 +27,12 @@ import org.junit.Test; import static org.assertj.core.api.Assertions.assertThatThrownBy; /** - * Tests for {@link SslUtils}. + * Tests for {@link SslConfigurationValidator}. * * @author Chris Bono */ -public class SslUtilsTest { +public class SslConfigurationValidatorTest { private static final String VALID_ALIAS = "test-alias"; @@ -47,31 +47,31 @@ public class SslUtilsTest { } @Test - public void assertStoreContainsAliasPassesWhenAliasFound() throws KeyStoreException { - SslUtils.assertStoreContainsAlias(this.keyStore, VALID_ALIAS); + public void validateKeyAliasWhenAliasFoundShouldNotFail() { + SslConfigurationValidator.validateKeyAlias(this.keyStore, VALID_ALIAS); } @Test - public void assertStoreContainsAliasPassesWhenNullAlias() throws KeyStoreException { - SslUtils.assertStoreContainsAlias(this.keyStore, null); + public void validateKeyAliasWhenNullAliasShouldNotFail() { + SslConfigurationValidator.validateKeyAlias(this.keyStore, null); } @Test - public void assertStoreContainsAliasPassesWhenEmptyAlias() throws KeyStoreException { - SslUtils.assertStoreContainsAlias(this.keyStore, ""); + public void validateKeyAliasWhenEmptyAliasShouldNotFail() { + SslConfigurationValidator.validateKeyAlias(this.keyStore, ""); } @Test - public void assertStoreContainsAliasFailsWhenAliasNotFound() throws KeyStoreException { - assertThatThrownBy(() -> SslUtils.assertStoreContainsAlias(this.keyStore, INVALID_ALIAS)) + public void validateKeyAliasWhenAliasNotFoundShouldThrowException() { + assertThatThrownBy(() -> SslConfigurationValidator.validateKeyAlias(this.keyStore, INVALID_ALIAS)) .isInstanceOf(IllegalStateException.class) .hasMessage("Keystore does not contain specified alias '" + INVALID_ALIAS + "'"); } @Test - public void assertStoreContainsAliasFailsWhenKeyStoreThrowsExceptionOnContains() throws KeyStoreException { + public void validateKeyAliasWhenKeyStoreThrowsExceptionOnContains() throws KeyStoreException { KeyStore uninitializedKeyStore = KeyStore.getInstance(KeyStore.getDefaultType()); - assertThatThrownBy(() -> SslUtils.assertStoreContainsAlias(uninitializedKeyStore, "alias")) + assertThatThrownBy(() -> SslConfigurationValidator.validateKeyAlias(uninitializedKeyStore, "alias")) .isInstanceOf(IllegalStateException.class) .hasMessage("Could not determine if keystore contains alias 'alias'"); } diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/servlet/server/AbstractServletWebServerFactoryTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/servlet/server/AbstractServletWebServerFactoryTests.java index a160da3dd1..30f79af5c1 100644 --- a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/servlet/server/AbstractServletWebServerFactoryTests.java +++ b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/servlet/server/AbstractServletWebServerFactoryTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2019 the original author or authors. + * Copyright 2012-2020 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License.