Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish SslOptions usage

Browse Source 
Add helper method and tighten usage so that exceptions are thrown when
options cannot be applied.

See gh-34814
This commit is contained in:
Phillip Webb
2023-04-25 18:01:10 -07:00
parent 423c60acfa
commit b5c9e7c06a
10 changed files with 55 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/cassandra/CassandraAutoConfiguration.java
View File

@@ -58,6 +58,7 @@ import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Lazy;
import org.springframework.context.annotation.Scope;
import org.springframework.core.io.Resource;
import org.springframework.util.Assert;
import org.springframework.util.StringUtils;
/**
@@ -158,7 +159,8 @@ public class CassandraAutoConfiguration {
private void configureSsl(CqlSessionBuilder builder, SslBundle sslBundle) {
SslOptions options = sslBundle.getOptions();
String[] ciphers = (options.getCiphers() != null) ? options.getCiphers().toArray(String[]::new) : null;
Assert.state(options.getEnabledProtocols() == null, "SSL protocol options cannot be specified with Cassandra");
String[] ciphers = SslOptions.toArray(options.getCiphers());
builder.withSslEngineFactory(new ProgrammaticSslEngineFactory(sslBundle.createSslContext(), ciphers));
}

23
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/couchbase/CouchbaseAutoConfiguration.java
View File

@@ -41,6 +41,7 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.autoconfigure.condition.ConditionalOnSingleCandidate;
import org.springframework.boot.autoconfigure.couchbase.CouchbaseAutoConfiguration.CouchbaseCondition;
import org.springframework.boot.autoconfigure.couchbase.CouchbaseProperties.Ssl;
import org.springframework.boot.autoconfigure.couchbase.CouchbaseProperties.Timeouts;
import org.springframework.boot.autoconfigure.jackson.JacksonAutoConfiguration;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
@@ -50,7 +51,9 @@ import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Conditional;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;
import org.springframework.util.Assert;
import org.springframework.util.ResourceUtils;
import org.springframework.util.StringUtils;
/**
* {@link EnableAutoConfiguration Auto-configuration} for Couchbase.
@@ -125,10 +128,14 @@ public class CouchbaseAutoConfiguration {
}
private void configureSsl(Builder builder, SslBundles sslBundles) {
Ssl sslProperties = this.properties.getEnv().getSsl();
SslBundle sslBundle = (StringUtils.hasText(sslProperties.getBundle()))
? sslBundles.getBundle(sslProperties.getBundle()) : null;
Assert.state(sslBundle == null || !sslBundle.getOptions().isSpecified(),
"SSL Options cannot be specified with Couchbase");
builder.securityConfig((config) -> {
config.enableTls(true);
TrustManagerFactory trustManagerFactory = getTrustManagerFactory(this.properties.getEnv().getSsl(),
sslBundles);
TrustManagerFactory trustManagerFactory = getTrustManagerFactory(sslProperties, sslBundle);
if (trustManagerFactory != null) {
config.trustManagerFactory(trustManagerFactory);
}
@@ -136,15 +143,11 @@ public class CouchbaseAutoConfiguration {
}
@SuppressWarnings("removal")
private TrustManagerFactory getTrustManagerFactory(CouchbaseProperties.Ssl ssl, SslBundles sslBundles) {
if (ssl.getKeyStore() != null) {
return loadTrustManagerFactory(ssl);
private TrustManagerFactory getTrustManagerFactory(CouchbaseProperties.Ssl sslProperties, SslBundle sslBundle) {
if (sslProperties.getKeyStore() != null) {
return loadTrustManagerFactory(sslProperties);
}
if (ssl.getBundle() != null) {
SslBundle bundle = sslBundles.getBundle(ssl.getBundle());
return bundle.getManagers().getTrustManagerFactory();
}
return null;
return (sslBundle != null) ? sslBundle.getManagers().getTrustManagerFactory() : null;
}
@SuppressWarnings("removal")

9
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/elasticsearch/ElasticsearchRestClientConfigurations.java
View File

@@ -19,7 +19,6 @@ package org.springframework.boot.autoconfigure.elasticsearch;
import java.net.URI;
import java.time.Duration;
import java.util.List;
import java.util.Set;
import java.util.stream.Stream;
import javax.net.ssl.HostnameVerifier;
@@ -117,16 +116,12 @@ class ElasticsearchRestClientConfigurations {
private void configureSsl(HttpAsyncClientBuilder httpClientBuilder, SslBundle sslBundle) {
SSLContext sslcontext = sslBundle.createSslContext();
SslOptions sslOptions = sslBundle.getOptions();
String[] enabledProtocols = toArray(sslOptions.getEnabledProtocols());
String[] ciphers = toArray(sslOptions.getCiphers());
String[] enabledProtocols = SslOptions.toArray(sslOptions.getEnabledProtocols());
String[] ciphers = SslOptions.toArray(sslOptions.getCiphers());
httpClientBuilder.setSSLStrategy(
new SSLIOSessionStrategy(sslcontext, enabledProtocols, ciphers, (HostnameVerifier) null));
}
private static String[] toArray(Set<String> set) {
return (set != null) ? set.toArray(String[]::new) : null;
}
}
@Configuration(proxyBeanMethods = false)

2
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/mongo/StandardMongoClientSettingsBuilderCustomizer.java
View File

@@ -24,6 +24,7 @@ import org.bson.UuidRepresentation;
import org.springframework.boot.ssl.SslBundle;
import org.springframework.boot.ssl.SslBundles;
import org.springframework.core.Ordered;
import org.springframework.util.Assert;
/**
* A {@link MongoClientSettingsBuilderCustomizer} that applies standard settings to a
@@ -67,6 +68,7 @@ public class StandardMongoClientSettingsBuilderCustomizer implements MongoClient
settings.enabled(true);
if (this.ssl.getBundle() != null) {
SslBundle sslBundle = this.sslBundles.getBundle(this.ssl.getBundle());
Assert.state(!sslBundle.getOptions().isSpecified(), "SSL options cannot be specified with MongoDB");
settings.context(sslBundle.createSslContext());
}
}

4
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/function/client/HttpComponentsClientHttpConnectorFactory.java
View File

@@ -52,10 +52,10 @@ class HttpComponentsClientHttpConnectorFactory
@Override
public TlsDetails verify(NamedEndpoint endpoint, SSLEngine sslEngine) throws SSLException {
if (options.getCiphers() != null) {
sslEngine.setEnabledCipherSuites(options.getCiphers().toArray(String[]::new));
sslEngine.setEnabledCipherSuites(SslOptions.toArray(options.getCiphers()));
}
if (options.getEnabledProtocols() != null) {
sslEngine.setEnabledProtocols(options.getEnabledProtocols().toArray(String[]::new));
sslEngine.setEnabledProtocols(SslOptions.toArray(options.getEnabledProtocols()));
}
return null;
}

12
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/function/client/JdkClientHttpConnectorFactory.java
View File

@@ -18,14 +18,13 @@ package org.springframework.boot.autoconfigure.web.reactive.function.client;
import java.net.http.HttpClient;
import java.net.http.HttpClient.Builder;
import java.util.Set;
import javax.net.ssl.SSLParameters;
import org.springframework.boot.ssl.SslBundle;
import org.springframework.boot.ssl.SslOptions;
import org.springframework.http.client.reactive.JdkClientHttpConnector;
import org.springframework.http.client.reactive.JettyClientHttpConnector;
import org.springframework.util.CollectionUtils;
/**
* {@link ClientHttpConnectorFactory} for {@link JettyClientHttpConnector}.
@@ -38,17 +37,14 @@ class JdkClientHttpConnectorFactory implements ClientHttpConnectorFactory<JdkCli
public JdkClientHttpConnector createClientHttpConnector(SslBundle sslBundle) {
Builder builder = HttpClient.newBuilder();
if (sslBundle != null) {
SslOptions options = sslBundle.getOptions();
builder.sslContext(sslBundle.createSslContext());
SSLParameters parameters = new SSLParameters();
parameters.setCipherSuites(asArray(sslBundle.getOptions().getCiphers()));
parameters.setProtocols(asArray(sslBundle.getOptions().getEnabledProtocols()));
parameters.setCipherSuites(SslOptions.toArray(options.getCiphers()));
parameters.setProtocols(SslOptions.toArray(options.getEnabledProtocols()));
builder.sslParameters(parameters);
}
return new JdkClientHttpConnector(builder.build());
}
private String[] asArray(Set<String> set) {
return (CollectionUtils.isEmpty(set)) ? null : set.toArray(String[]::new);
}
}

4
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/function/client/JettyClientHttpConnectorFactory.java
View File

@@ -46,11 +46,11 @@ class JettyClientHttpConnectorFactory implements ClientHttpConnectorFactory<Jett
if (sslBundle != null) {
SslOptions options = sslBundle.getOptions();
if (options.getCiphers() != null) {
sslContextFactory.setIncludeCipherSuites(options.getCiphers().toArray(String[]::new));
sslContextFactory.setIncludeCipherSuites(SslOptions.toArray(options.getCiphers()));
sslContextFactory.setExcludeCipherSuites();
}
if (options.getEnabledProtocols() != null) {
sslContextFactory.setIncludeProtocols(options.getEnabledProtocols().toArray(String[]::new));
sslContextFactory.setIncludeProtocols(SslOptions.toArray(options.getEnabledProtocols()));
sslContextFactory.setExcludeProtocols();
}
sslContextFactory.setSslContext(sslBundle.createSslContext());