From b6df5e24250594e7093267a41c3bd79797837f15 Mon Sep 17 00:00:00 2001 From: Dave Syer Date: Thu, 22 Feb 2018 11:07:06 +0000 Subject: [PATCH] Add encrypt.salt configuration option --- .gitignore | 3 +- .../EncryptionBootstrapConfiguration.java | 4 +- .../bootstrap/encrypt/KeyProperties.java | 14 +++++++ .../context/encrypt/EncryptorFactory.java | 41 +++++++++++-------- 4 files changed, 42 insertions(+), 20 deletions(-) diff --git a/.gitignore b/.gitignore index 86f0d9af..6ee2be21 100644 --- a/.gitignore +++ b/.gitignore @@ -11,10 +11,11 @@ _site/ .project .settings .springBeans +.sts4-cache/ .DS_Store *.sw* *.iml .idea .factorypath /spring-cloud-release-tools*.jar -antrun \ No newline at end of file +antrun diff --git a/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/EncryptionBootstrapConfiguration.java b/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/EncryptionBootstrapConfiguration.java index 5321307c..fb4fd5fb 100644 --- a/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/EncryptionBootstrapConfiguration.java +++ b/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/EncryptionBootstrapConfiguration.java @@ -76,7 +76,7 @@ public class EncryptionBootstrapConfiguration { throw new IllegalStateException("Invalid keystore location"); } - return new EncryptorFactory().create(this.key.getKey()); + return new EncryptorFactory(this.key.getSalt()).create(this.key.getKey()); } } @@ -92,7 +92,7 @@ public class EncryptionBootstrapConfiguration { @Bean @ConditionalOnMissingBean(TextEncryptor.class) public TextEncryptor textEncryptor() { - return new EncryptorFactory().create(this.key.getKey()); + return new EncryptorFactory(this.key.getSalt()).create(this.key.getKey()); } } diff --git a/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/KeyProperties.java b/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/KeyProperties.java index 2a2ec029..cbe4c66a 100644 --- a/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/KeyProperties.java +++ b/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/KeyProperties.java @@ -28,6 +28,12 @@ public class KeyProperties { */ private String key; + /** + * A salt for the symmetric key in the form of a hex-encoded byte array. As a stronger + * alternative consider using a keystore. + */ + private String salt = "deadbeef"; + /** * Flag to say that a process should fail if there is an encryption or decryption * error. @@ -72,6 +78,14 @@ public class KeyProperties { this.key = key; } + public String getSalt() { + return salt; + } + + public void setSalt(String salt) { + this.salt = salt; + } + public KeyStore getKeyStore() { return this.keyStore; } diff --git a/spring-cloud-context/src/main/java/org/springframework/cloud/context/encrypt/EncryptorFactory.java b/spring-cloud-context/src/main/java/org/springframework/cloud/context/encrypt/EncryptorFactory.java index edb9cabd..3fcf4830 100644 --- a/spring-cloud-context/src/main/java/org/springframework/cloud/context/encrypt/EncryptorFactory.java +++ b/spring-cloud-context/src/main/java/org/springframework/cloud/context/encrypt/EncryptorFactory.java @@ -15,28 +15,35 @@ */ package org.springframework.cloud.context.encrypt; +import java.io.IOException; +import java.io.StringReader; +import java.io.StringWriter; + import org.bouncycastle.asn1.pkcs.PrivateKeyInfo; import org.bouncycastle.openssl.MiscPEMGenerator; import org.bouncycastle.openssl.PEMKeyPair; import org.bouncycastle.openssl.PEMParser; import org.bouncycastle.util.io.pem.PemObjectGenerator; import org.bouncycastle.util.io.pem.PemWriter; + import org.springframework.security.crypto.encrypt.Encryptors; import org.springframework.security.crypto.encrypt.TextEncryptor; import org.springframework.security.rsa.crypto.RsaSecretEncryptor; -import java.io.IOException; -import java.io.StringReader; -import java.io.StringWriter; - /** * @author Dave Syer * @author Biju Kunjummen */ public class EncryptorFactory { - // TODO: expose as config property - private static final String SALT = "deadbeef"; + private String salt = "deadbeef"; + + public EncryptorFactory() { + } + + public EncryptorFactory(String salt) { + this.salt = salt; + } public TextEncryptor create(String data) { @@ -45,7 +52,8 @@ public class EncryptorFactory { try { String normalizedPemData = normalizePem(data); - encryptor = new RsaSecretEncryptor(normalizedPemData.replaceAll("\\n", "").replaceAll("\\r", "")); + encryptor = new RsaSecretEncryptor( + normalizedPemData.replaceAll("\\n", "").replaceAll("\\r", "")); } catch (IllegalArgumentException e) { throw new KeyFormatException(e); @@ -56,26 +64,27 @@ public class EncryptorFactory { throw new KeyFormatException(); } else { - encryptor = Encryptors.text(data, SALT); + encryptor = Encryptors.text(data, salt); } return encryptor; } private String normalizePem(String data) { - PEMParser pemParser = new PEMParser(new StringReader(data)); PEMKeyPair pemKeyPair = null; - try { + try (PEMParser pemParser = new PEMParser(new StringReader(data))) { pemKeyPair = (PEMKeyPair) pemParser.readObject(); PrivateKeyInfo privateKeyInfo = pemKeyPair.getPrivateKeyInfo(); StringWriter textWriter = new StringWriter(); - PemWriter pemWriter = new PemWriter(textWriter); - PemObjectGenerator pemObjectGenerator = new MiscPEMGenerator(privateKeyInfo); + try (PemWriter pemWriter = new PemWriter(textWriter)) { + PemObjectGenerator pemObjectGenerator = new MiscPEMGenerator( + privateKeyInfo); - pemWriter.writeObject(pemObjectGenerator); - pemWriter.flush(); - return textWriter.toString(); + pemWriter.writeObject(pemObjectGenerator); + pemWriter.flush(); + return textWriter.toString(); + } } catch (IOException e) { throw new RuntimeException(e.getMessage(), e); @@ -83,5 +92,3 @@ public class EncryptorFactory { } } - -