From a2ca131b50a2a35308fe5274b1120ef9fe216d4b Mon Sep 17 00:00:00 2001
From: Spencer Gibb <spencer@gibb.us>
Date: Wed, 28 Feb 2018 14:10:48 -0500
Subject: [PATCH] Allow configuration of netty httpclient insecure trust
 manager.

---
 .../config/GatewayAutoConfiguration.java      | 11 +++++++
 .../gateway/config/HttpClientProperties.java  | 33 +++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/config/GatewayAutoConfiguration.java b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/config/GatewayAutoConfiguration.java
index 19d3f639..79a59a3f 100644
--- a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/config/GatewayAutoConfiguration.java
+++ b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/config/GatewayAutoConfiguration.java
@@ -20,6 +20,7 @@ package org.springframework.cloud.gateway.config;
 import java.util.List;
 import java.util.function.Consumer;
 
+import io.netty.handler.ssl.util.InsecureTrustManagerFactory;
 import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.boot.actuate.autoconfigure.endpoint.condition.ConditionalOnEnabledEndpoint;
@@ -137,6 +138,16 @@ public class GatewayAutoConfiguration {
 		public Consumer<? super HttpClientOptions.Builder> nettyClientOptions(HttpClientProperties properties) {
 			return opts -> {
 
+				// configure ssl
+				HttpClientProperties.Ssl ssl = properties.getSsl();
+
+				if (ssl.isUseInsecureTrustManager()) {
+					opts.sslSupport(sslContextBuilder -> {
+						sslContextBuilder.trustManager(InsecureTrustManagerFactory.INSTANCE);
+					});
+				}
+
+				// configure pool resources
 				HttpClientProperties.Pool pool = properties.getPool();
 
 				PoolResources poolResources;
diff --git a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/config/HttpClientProperties.java b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/config/HttpClientProperties.java
index f8168fe6..ff6a2ce3 100644
--- a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/config/HttpClientProperties.java
+++ b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/config/HttpClientProperties.java
@@ -32,6 +32,9 @@ public class HttpClientProperties {
 	/** Proxy configuration for Netty HttpClient */
 	private Proxy proxy = new Proxy();
 
+	/** SSL configuration for Netty HttpClient */
+	private Ssl ssl = new Ssl();
+
 	public Pool getPool() {
 		return pool;
 	}
@@ -48,6 +51,14 @@ public class HttpClientProperties {
 		this.proxy = proxy;
 	}
 
+	public Ssl getSsl() {
+		return ssl;
+	}
+
+	public void setSsl(Ssl ssl) {
+		this.ssl = ssl;
+	}
+
 	public static class Pool {
 
 		public enum PoolType { ELASTIC, FIXED }
@@ -172,6 +183,28 @@ public class HttpClientProperties {
 		}
 	}
 
+	public class Ssl {
+		/** Installs the netty InsecureTrustManagerFactory. This is insecure and not suitable for production. */
+		private boolean useInsecureTrustManager = false;
+
+		//TODO: support configuration of other trust manager factories
+
+		public boolean isUseInsecureTrustManager() {
+			return useInsecureTrustManager;
+		}
+
+		public void setUseInsecureTrustManager(boolean useInsecureTrustManager) {
+			this.useInsecureTrustManager = useInsecureTrustManager;
+		}
+
+		@Override
+		public String toString() {
+			return "Ssl{" +
+					"useInsecureTrustManager=" + useInsecureTrustManager +
+					'}';
+		}
+	}
+
 	@Override
 	public String toString() {
 		return "HttpClientProperties{" +