diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/bootstrap/ConfigServerBootstrapConfiguration.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/bootstrap/ConfigServerBootstrapConfiguration.java index 326cb108..3845f31c 100644 --- a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/bootstrap/ConfigServerBootstrapConfiguration.java +++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/bootstrap/ConfigServerBootstrapConfiguration.java @@ -15,17 +15,22 @@ */ package org.springframework.cloud.config.server.bootstrap; +import org.springframework.beans.BeansException; +import org.springframework.beans.factory.BeanFactory; import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.config.BeanPostProcessor; import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.cloud.config.client.ConfigClientProperties; import org.springframework.cloud.config.server.config.ConfigServerProperties; import org.springframework.cloud.config.server.config.EnvironmentRepositoryConfiguration; +import org.springframework.cloud.config.server.encryption.LocatorTextEncryptor; import org.springframework.cloud.config.server.environment.EnvironmentRepository; import org.springframework.cloud.config.server.environment.EnvironmentRepositoryPropertySourceLocator; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Import; +import org.springframework.security.crypto.encrypt.TextEncryptor; import org.springframework.util.StringUtils; /** @@ -39,9 +44,27 @@ import org.springframework.util.StringUtils; * @author Roy Clarkson */ @Configuration -public class ConfigServerBootstrapConfiguration { +@ConditionalOnProperty("spring.cloud.config.server.bootstrap") +public class ConfigServerBootstrapConfiguration implements BeanPostProcessor { + + @Autowired + private BeanFactory beanFactory; + + @Override + public Object postProcessBeforeInitialization(Object bean, String beanName) + throws BeansException { + return bean; + } + + @Override + public Object postProcessAfterInitialization(Object bean, String beanName) + throws BeansException { + if (bean instanceof TextEncryptor && !(bean instanceof LocatorTextEncryptor)) { + return new LocatorTextEncryptor(beanFactory); + } + return bean; + } - @ConditionalOnProperty("spring.cloud.config.server.bootstrap") @EnableConfigurationProperties(ConfigServerProperties.class) @Import(EnvironmentRepositoryConfiguration.class) protected static class LocalPropertySourceLocatorConfiguration { diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/LocatorTextEncryptor.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/LocatorTextEncryptor.java new file mode 100644 index 00000000..6c4b5497 --- /dev/null +++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/LocatorTextEncryptor.java @@ -0,0 +1,61 @@ +/* + * Copyright 2012-2015 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.cloud.config.server.encryption; + +import java.util.Map; + +import org.springframework.beans.factory.BeanFactory; +import org.springframework.security.crypto.encrypt.TextEncryptor; + +/** + * @author Dave Syer + * + */ +public class LocatorTextEncryptor implements TextEncryptor { + + private EnvironmentPrefixHelper helper = new EnvironmentPrefixHelper(); + + private TextEncryptorLocator locator; + + private BeanFactory beanFactory; + + public LocatorTextEncryptor(BeanFactory beanFactory) { + this.beanFactory = beanFactory; + } + + @Override + public String encrypt(String text) { + Map keys = helper.getEncryptorKeys("configserver", "default", + text); + return getLocator().locate(keys).encrypt(helper.stripPrefix(text)); + } + + private TextEncryptorLocator getLocator() { + if (locator == null) { + locator = beanFactory.getBean(TextEncryptorLocator.class); + } + return locator; + } + + @Override + public String decrypt(String encryptedText) { + Map keys = helper.getEncryptorKeys("configserver", "default", + encryptedText); + return getLocator().locate(keys).decrypt(helper.stripPrefix(encryptedText)); + } + +} \ No newline at end of file diff --git a/spring-cloud-config-server/src/main/resources/META-INF/spring.factories b/spring-cloud-config-server/src/main/resources/META-INF/spring.factories index 94a0bb01..7b893f04 100644 --- a/spring-cloud-config-server/src/main/resources/META-INF/spring.factories +++ b/spring-cloud-config-server/src/main/resources/META-INF/spring.factories @@ -1,6 +1,8 @@ # Bootstrap components org.springframework.cloud.bootstrap.BootstrapConfiguration=\ -org.springframework.cloud.config.server.bootstrap.ConfigServerBootstrapConfiguration +org.springframework.cloud.config.server.bootstrap.ConfigServerBootstrapConfiguration,\ +org.springframework.cloud.config.server.config.EncryptionAutoConfiguration,\ +org.springframework.cloud.config.server.config.SingleEncryptorAutoConfiguration # Application listeners org.springframework.context.ApplicationListener=\ diff --git a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/BootstrapConfigServerIntegrationTests.java b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/BootstrapConfigServerIntegrationTests.java index 5a215621..571a60fa 100644 --- a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/BootstrapConfigServerIntegrationTests.java +++ b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/BootstrapConfigServerIntegrationTests.java @@ -20,7 +20,7 @@ import static org.junit.Assert.assertFalse; @RunWith(SpringRunner.class) @SpringBootTest(classes = ConfigServerApplication.class, properties = "spring.cloud.bootstrap.name:enable-bootstrap", webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT) -@ActiveProfiles("test") +@ActiveProfiles({"test", "encrypt"}) public class BootstrapConfigServerIntegrationTests { @LocalServerPort @@ -29,9 +29,12 @@ public class BootstrapConfigServerIntegrationTests { @Value("${info.foo}") private String foo; + @Value("${config.foo}") + private String config; + @BeforeClass public static void init() throws IOException { - ConfigServerTestUtils.prepareLocalRepo(); + ConfigServerTestUtils.prepareLocalRepo("encrypt-repo"); } @Test @@ -46,6 +49,7 @@ public class BootstrapConfigServerIntegrationTests { @Test public void environmentBootstraps() throws Exception { assertEquals("bar", foo); + assertEquals("foo", config); } } diff --git a/spring-cloud-config-server/src/test/resources/enable-bootstrap.yml b/spring-cloud-config-server/src/test/resources/enable-bootstrap.yml index c780b861..f587c9bb 100644 --- a/spring-cloud-config-server/src/test/resources/enable-bootstrap.yml +++ b/spring-cloud-config-server/src/test/resources/enable-bootstrap.yml @@ -3,5 +3,11 @@ spring: config: server: git: - uri: file:./target/repos/config-repo - bootstrap: true \ No newline at end of file + uri: file:./target/repos/encrypt-repo + bootstrap: true +encrypt: + key-store: + location: classpath:server.jks + password: letmein + secret: changeme + \ No newline at end of file diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/application.yml b/spring-cloud-config-server/src/test/resources/encrypt-repo/application.yml new file mode 100644 index 00000000..13b76fa2 --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/application.yml @@ -0,0 +1,9 @@ +info: + foo: bar + +--- +spring: + profiles: encrypt +config: + foo: '{cipher}{key:mytestkey}AQCohs2V6P8/UiG6a4TF/CZTCBdt5Q7wvNvcyf6vs2ByK2ZYSM77Nu0sOAduxUpMbVwJ/syecmkIXR+hU3EfT2uqPieA7/v5n33ppqIQ9JAt5JggdYIGe+wX25zU3DTXOOJdAAMzNX+zjOVyCh0QtmJf/kFslg6NqQq0E+kSg3zBi3AnkKj5BLnLIxkjxzKA4mnDXpSm7ekLZZP2iQSYSW/82AC7UOLLzTqwInMI3tJLW1e9Ne+LDsjmSxA+nkK9zhidtXPwb/SPaNF74cJCEf9mgzzKYwJlwqChLzJt8UQ1jHwRc8B6FufmizUHSp27nxdtVB4HMqh3nNsMCy137Ces58T09ZS/y/cYNRxcFbp78MHFHUqAgbC0B/p5t6h4XbQ=' + diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/bar.properties b/spring-cloud-config-server/src/test/resources/encrypt-repo/bar.properties new file mode 100644 index 00000000..7daacd5d --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/bar.properties @@ -0,0 +1 @@ +foo: bar \ No newline at end of file diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/COMMIT_EDITMSG b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/COMMIT_EDITMSG new file mode 100644 index 00000000..a6b4e397 --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/COMMIT_EDITMSG @@ -0,0 +1 @@ +Add encrypted property diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/FETCH_HEAD b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/FETCH_HEAD new file mode 100644 index 00000000..527abd40 --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/FETCH_HEAD @@ -0,0 +1,2 @@ +7df4a26d5437d9d4090cd5809967f870444cde8f not-for-merge branch 'raw' of dsyer@localhost:/home/dsyer/dev/platform/config/spring-platform-config-server/target/test-classes/config-repo +7df4a26d5437d9d4090cd5809967f870444cde8f not-for-merge tag 'foo' of dsyer@localhost:/home/dsyer/dev/platform/config/spring-platform-config-server/target/test-classes/config-repo diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/HEAD b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/HEAD new file mode 100644 index 00000000..cb089cd8 --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/HEAD @@ -0,0 +1 @@ +ref: refs/heads/master diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/config b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/config new file mode 100644 index 00000000..9b73bf82 --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/config @@ -0,0 +1,5 @@ +[core] + repositoryformatversion = 0 + filemode = true + logallrefupdates = true +[branch "raw"] diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/gitk.cache b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/gitk.cache new file mode 100644 index 00000000..b420ccba --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/gitk.cache @@ -0,0 +1,3 @@ +1 1 +7df4a26d5437d9d4090cd5809967f870444cde8f 9f01fb972bc9617e4ea59f5c8ee3ceb5ff515cd0 9f01fb972bc9617e4ea59f5c8ee3ceb5ff515cd0 +1 diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/index b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/index new file mode 100644 index 00000000..e9aa8984 Binary files /dev/null and b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/index differ diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/HEAD b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/HEAD new file mode 100644 index 00000000..0eda72a7 --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/HEAD @@ -0,0 +1,7 @@ +0000000000000000000000000000000000000000 7df4a26d5437d9d4090cd5809967f870444cde8f Dave Syer 1406860717 -0700 +7df4a26d5437d9d4090cd5809967f870444cde8f 9f01fb972bc9617e4ea59f5c8ee3ceb5ff515cd0 Ryan Baxter 1481905383 -0500 checkout: moving from raw to master +9f01fb972bc9617e4ea59f5c8ee3ceb5ff515cd0 7df4a26d5437d9d4090cd5809967f870444cde8f Ryan Baxter 1481905407 -0500 checkout: moving from master to raw +7df4a26d5437d9d4090cd5809967f870444cde8f 7df4a26d5437d9d4090cd5809967f870444cde8f Ryan Baxter 1481905544 -0500 checkout: moving from raw to composite +7df4a26d5437d9d4090cd5809967f870444cde8f 7df4a26d5437d9d4090cd5809967f870444cde8f Ryan Baxter 1481905552 -0500 checkout: moving from composite to raw +7df4a26d5437d9d4090cd5809967f870444cde8f 9f01fb972bc9617e4ea59f5c8ee3ceb5ff515cd0 Dave Syer 1498491043 +0100 checkout: moving from raw to master +9f01fb972bc9617e4ea59f5c8ee3ceb5ff515cd0 ad5e0cb7036ed11ddd4b7be6ed86ad3565c8a3fc Dave Syer 1498491468 +0100 commit: Add encrypted property diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/refs/heads/composite b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/refs/heads/composite new file mode 100644 index 00000000..67ab67c5 --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/refs/heads/composite @@ -0,0 +1 @@ +0000000000000000000000000000000000000000 7df4a26d5437d9d4090cd5809967f870444cde8f Ryan Baxter 1481905474 -0500 branch: Created from raw diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/refs/heads/master b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/refs/heads/master new file mode 100644 index 00000000..4310fccd --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/refs/heads/master @@ -0,0 +1,2 @@ +0000000000000000000000000000000000000000 9f01fb972bc9617e4ea59f5c8ee3ceb5ff515cd0 Dave Syer 1406860776 -0700 branch: Created from 9f01fb972bc9617e4ea59f5c8ee3ceb5ff515cd0 +9f01fb972bc9617e4ea59f5c8ee3ceb5ff515cd0 ad5e0cb7036ed11ddd4b7be6ed86ad3565c8a3fc Dave Syer 1498491468 +0100 commit: Add encrypted property diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/refs/heads/raw b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/refs/heads/raw new file mode 100644 index 00000000..c6423ee9 --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/logs/refs/heads/raw @@ -0,0 +1 @@ +0000000000000000000000000000000000000000 7df4a26d5437d9d4090cd5809967f870444cde8f Dave Syer 1406860717 -0700 diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/13/b76fa2acbef52a002372071d08d7967fee9146 b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/13/b76fa2acbef52a002372071d08d7967fee9146 new file mode 100644 index 00000000..c7dc2ed2 Binary files /dev/null and b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/13/b76fa2acbef52a002372071d08d7967fee9146 differ diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/ad/5e0cb7036ed11ddd4b7be6ed86ad3565c8a3fc b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/ad/5e0cb7036ed11ddd4b7be6ed86ad3565c8a3fc new file mode 100644 index 00000000..e9b05f26 --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/ad/5e0cb7036ed11ddd4b7be6ed86ad3565c8a3fc @@ -0,0 +1,4 @@ +xM +0]$o  1z{7p{ ZeP+GDvGJ8i#6pIb + ZVK&摸[FMQ +i\7Z-7:ܤ*3Q~Zۉ[+ս4Pj.\.gI \ No newline at end of file diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/e7/7c14ccb5f9e49c11b6d4172b76b0d3cf4cef56 b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/e7/7c14ccb5f9e49c11b6d4172b76b0d3cf4cef56 new file mode 100644 index 00000000..81eeb0ca Binary files /dev/null and b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/e7/7c14ccb5f9e49c11b6d4172b76b0d3cf4cef56 differ diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/pack/pack-d4edd2290fa647beaa1255881228dc90c1d53fce.idx b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/pack/pack-d4edd2290fa647beaa1255881228dc90c1d53fce.idx new file mode 100644 index 00000000..2a25a7b0 Binary files /dev/null and b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/pack/pack-d4edd2290fa647beaa1255881228dc90c1d53fce.idx differ diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/pack/pack-d4edd2290fa647beaa1255881228dc90c1d53fce.pack b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/pack/pack-d4edd2290fa647beaa1255881228dc90c1d53fce.pack new file mode 100644 index 00000000..a082f3c1 Binary files /dev/null and b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/objects/pack/pack-d4edd2290fa647beaa1255881228dc90c1d53fce.pack differ diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/heads/composite b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/heads/composite new file mode 100644 index 00000000..4389eb3a --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/heads/composite @@ -0,0 +1 @@ +7df4a26d5437d9d4090cd5809967f870444cde8f diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/heads/master b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/heads/master new file mode 100644 index 00000000..ae0c4a61 --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/heads/master @@ -0,0 +1 @@ +ad5e0cb7036ed11ddd4b7be6ed86ad3565c8a3fc diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/heads/raw b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/heads/raw new file mode 100644 index 00000000..4389eb3a --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/heads/raw @@ -0,0 +1 @@ +7df4a26d5437d9d4090cd5809967f870444cde8f diff --git a/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/tags/foo b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/tags/foo new file mode 100644 index 00000000..4389eb3a --- /dev/null +++ b/spring-cloud-config-server/src/test/resources/encrypt-repo/git/refs/tags/foo @@ -0,0 +1 @@ +7df4a26d5437d9d4090cd5809967f870444cde8f