From 91e1ddc9a3280a83a2ccdfb349bbfee00d67ac48 Mon Sep 17 00:00:00 2001 From: Dave Syer Date: Mon, 10 Nov 2014 09:57:45 +0000 Subject: [PATCH] Add fail fast flag for config client if local decryption fails On the server we choose not to fail if a property cannot be decrypted (clients might be relying on the other values to be able to deal with the failure). Fixes gh-31 --- .../EncryptionBootstrapConfiguration.java | 7 ++- ...EnvironmentDecryptApplicationListener.java | 29 +++++++-- .../bootstrap/encrypt/KeyProperties.java | 10 +++ ...onmentDecryptApplicationListenerTests.java | 62 +++++++++++++++++++ ...pringApplicationEnvironmentRepository.java | 12 ++++ 5 files changed, 113 insertions(+), 7 deletions(-) create mode 100644 spring-cloud-config-client/src/test/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListenerTests.java diff --git a/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/EncryptionBootstrapConfiguration.java b/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/EncryptionBootstrapConfiguration.java index ea019aff..e5df3033 100644 --- a/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/EncryptionBootstrapConfiguration.java +++ b/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/EncryptionBootstrapConfiguration.java @@ -47,6 +47,9 @@ public class EncryptionBootstrapConfiguration { @Autowired(required = false) private TextEncryptor encryptor; + @Autowired + private KeyProperties key; + @Configuration @Conditional(KeyCondition.class) @ConditionalOnClass(RsaSecretEncryptor.class) @@ -91,7 +94,9 @@ public class EncryptionBootstrapConfiguration { if (encryptor == null) { encryptor = new FailsafeTextEncryptor(); } - return new EnvironmentDecryptApplicationListener(encryptor); + EnvironmentDecryptApplicationListener listener = new EnvironmentDecryptApplicationListener(encryptor); + listener.setFailOnError(key.isFailOnError()); + return listener; } public static class KeyCondition extends SpringBootCondition { diff --git a/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListener.java b/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListener.java index 54d9a0e7..a6927992 100644 --- a/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListener.java +++ b/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListener.java @@ -50,6 +50,8 @@ public class EnvironmentDecryptApplicationListener implements private Field propertySourcesField; + private boolean failOnError = true; + { initField(); } @@ -64,6 +66,15 @@ public class EnvironmentDecryptApplicationListener implements this.encryptor = encryptor; } + /** + * Strategy to determine how to handle exceptions during decryption. + * + * @param failOnError the flag value (default true) + */ + public void setFailOnError(boolean failOnError) { + this.failOnError = failOnError; + } + @Override public int getOrder() { return order; @@ -71,7 +82,7 @@ public class EnvironmentDecryptApplicationListener implements @Override public void initialize(ConfigurableApplicationContext applicationContext) { - + ConfigurableEnvironment environment = applicationContext.getEnvironment(); Map overrides = new LinkedHashMap(); for (PropertySource source : environment.getPropertySources()) { @@ -99,12 +110,18 @@ public class EnvironmentDecryptApplicationListener implements } } catch (Exception e) { - if (logger.isDebugEnabled()) { - logger.warn("Cannot decrypt: key=" + key, e); - } else { - logger.warn("Cannot decrypt: key=" + key); + String message = "Cannot decrypt: key=" + key; + if (failOnError) { + throw new IllegalStateException(message, e); } - // Set value to empty to avoid making a password out of the cipher text + if (logger.isDebugEnabled()) { + logger.warn(message, e); + } + else { + logger.warn(message); + } + // Set value to empty to avoid making a password out of the + // cipher text value = ""; } overrides.put(key, value); diff --git a/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/KeyProperties.java b/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/KeyProperties.java index 141fd44b..4b213624 100644 --- a/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/KeyProperties.java +++ b/spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/KeyProperties.java @@ -22,9 +22,19 @@ import org.springframework.core.io.Resource; public class KeyProperties { private String key; + + private boolean failOnError = true; private KeyProperties.KeyStore keyStore = new KeyStore(); + public boolean isFailOnError() { + return failOnError; + } + + public void setFailOnError(boolean failOnError) { + this.failOnError = failOnError; + } + public String getKey() { return key; } diff --git a/spring-cloud-config-client/src/test/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListenerTests.java b/spring-cloud-config-client/src/test/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListenerTests.java new file mode 100644 index 00000000..32c422ac --- /dev/null +++ b/spring-cloud-config-client/src/test/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListenerTests.java @@ -0,0 +1,62 @@ +/* + * Copyright 2013-2014 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.cloud.bootstrap.encrypt; + +import static org.junit.Assert.assertEquals; + +import org.junit.Test; +import org.springframework.boot.test.EnvironmentTestUtils; +import org.springframework.context.ConfigurableApplicationContext; +import org.springframework.context.annotation.AnnotationConfigApplicationContext; +import org.springframework.security.crypto.encrypt.Encryptors; + +/** + * @author Dave Syer + * + */ +public class EnvironmentDecryptApplicationListenerTests { + + private EnvironmentDecryptApplicationListener listener = new EnvironmentDecryptApplicationListener(Encryptors.noOpText()); + + @Test + public void decryptCipherKey() { + ConfigurableApplicationContext context = new AnnotationConfigApplicationContext(); + EnvironmentTestUtils.addEnvironment(context, "foo: {cipher}bar"); + listener.initialize(context); + assertEquals("bar", context.getEnvironment().getProperty("foo")); + } + + @Test(expected=IllegalStateException.class) + public void errorOnDecrypt() { + listener = new EnvironmentDecryptApplicationListener(Encryptors.text("deadbeef", "AFFE37")); + ConfigurableApplicationContext context = new AnnotationConfigApplicationContext(); + EnvironmentTestUtils.addEnvironment(context, "foo: {cipher}bar"); + listener.initialize(context); + assertEquals("bar", context.getEnvironment().getProperty("foo")); + } + + @Test + public void errorOnDecryptWithEmpty() { + listener = new EnvironmentDecryptApplicationListener(Encryptors.text("deadbeef", "AFFE37")); + listener.setFailOnError(false); + ConfigurableApplicationContext context = new AnnotationConfigApplicationContext(); + EnvironmentTestUtils.addEnvironment(context, "foo: {cipher}bar"); + listener.initialize(context); + // Empty is safest fallback for undecryptable cipher + assertEquals("", context.getEnvironment().getProperty("foo")); + } + +} diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/SpringApplicationEnvironmentRepository.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/SpringApplicationEnvironmentRepository.java index b8b48a21..a8482212 100644 --- a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/SpringApplicationEnvironmentRepository.java +++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/SpringApplicationEnvironmentRepository.java @@ -42,6 +42,17 @@ public class SpringApplicationEnvironmentRepository implements EnvironmentReposi private String[] locations; + private boolean failOnError = false; + + /** + * Strategy to determine how to handle exceptions during decryption. + * + * @param failOnError the flag value (default false) + */ + public void setFailOnError(boolean failOnError) { + this.failOnError = failOnError; + } + @Override public Environment findOne(String config, String profile, String label) { SpringApplicationBuilder builder = new SpringApplicationBuilder( @@ -78,6 +89,7 @@ public class SpringApplicationEnvironmentRepository implements EnvironmentReposi } list.add("--spring.config.name=" + config); list.add("--spring.cloud.bootstrap.enabled=false"); + list.add("--encrypt.failOnError=" + failOnError); if (locations != null) { list.add("--spring.config.location=" + StringUtils.arrayToCommaDelimitedString(locations));