diff --git a/docs/src/main/asciidoc/_configprops.adoc b/docs/src/main/asciidoc/_configprops.adoc index 90d82129..50923ed8 100644 --- a/docs/src/main/asciidoc/_configprops.adoc +++ b/docs/src/main/asciidoc/_configprops.adoc @@ -14,6 +14,7 @@ |spring.cloud.gateway.filter.add-request-header.enabled | `+++true+++` | Enables the add-request-header filter. |spring.cloud.gateway.filter.add-request-parameter.enabled | `+++true+++` | Enables the add-request-parameter filter. |spring.cloud.gateway.filter.add-response-header.enabled | `+++true+++` | Enables the add-response-header filter. +|spring.cloud.gateway.filter.json-to-grpc.enabled | `+++true+++` | Enables the JSON to gRPC filter. |spring.cloud.gateway.filter.circuit-breaker.enabled | `+++true+++` | Enables the circuit-breaker filter. |spring.cloud.gateway.filter.dedupe-response-header.enabled | `+++true+++` | Enables the dedupe-response-header filter. |spring.cloud.gateway.filter.fallback-headers.enabled | `+++true+++` | Enables the fallback-headers filter. @@ -26,7 +27,7 @@ |spring.cloud.gateway.filter.preserve-host-header.enabled | `+++true+++` | Enables the preserve-host-header filter. |spring.cloud.gateway.filter.redirect-to.enabled | `+++true+++` | Enables the redirect-to filter. |spring.cloud.gateway.filter.remove-hop-by-hop.headers | | -|spring.cloud.gateway.filter.remove-hop-by-hop.order | `+++0+++` | +|spring.cloud.gateway.filter.remove-hop-by-hop.order | `+++0+++` | |spring.cloud.gateway.filter.remove-request-header.enabled | `+++true+++` | Enables the remove-request-header filter. |spring.cloud.gateway.filter.remove-request-parameter.enabled | `+++true+++` | Enables the remove-request-parameter filter. |spring.cloud.gateway.filter.remove-response-header.enabled | `+++true+++` | Enables the remove-response-header filter. @@ -42,16 +43,16 @@ |spring.cloud.gateway.filter.rewrite-path.enabled | `+++true+++` | Enables the rewrite-path filter. |spring.cloud.gateway.filter.rewrite-response-header.enabled | `+++true+++` | Enables the rewrite-response-header filter. |spring.cloud.gateway.filter.save-session.enabled | `+++true+++` | Enables the save-session filter. -|spring.cloud.gateway.filter.secure-headers.content-security-policy | `+++default-src 'self' https:; font-src 'self' https: data:; img-src 'self' https: data:; object-src 'none'; script-src https:; style-src 'self' https: 'unsafe-inline'+++` | -|spring.cloud.gateway.filter.secure-headers.content-type-options | `+++nosniff+++` | +|spring.cloud.gateway.filter.secure-headers.content-security-policy | `+++default-src 'self' https:; font-src 'self' https: data:; img-src 'self' https: data:; object-src 'none'; script-src https:; style-src 'self' https: 'unsafe-inline'+++` | +|spring.cloud.gateway.filter.secure-headers.content-type-options | `+++nosniff+++` | |spring.cloud.gateway.filter.secure-headers.disable | | -|spring.cloud.gateway.filter.secure-headers.download-options | `+++noopen+++` | +|spring.cloud.gateway.filter.secure-headers.download-options | `+++noopen+++` | |spring.cloud.gateway.filter.secure-headers.enabled | `+++true+++` | Enables the secure-headers filter. -|spring.cloud.gateway.filter.secure-headers.frame-options | `+++DENY+++` | -|spring.cloud.gateway.filter.secure-headers.permitted-cross-domain-policies | `+++none+++` | -|spring.cloud.gateway.filter.secure-headers.referrer-policy | `+++no-referrer+++` | -|spring.cloud.gateway.filter.secure-headers.strict-transport-security | `+++max-age=631138519+++` | -|spring.cloud.gateway.filter.secure-headers.xss-protection-header | `+++1 ; mode=block+++` | +|spring.cloud.gateway.filter.secure-headers.frame-options | `+++DENY+++` | +|spring.cloud.gateway.filter.secure-headers.permitted-cross-domain-policies | `+++none+++` | +|spring.cloud.gateway.filter.secure-headers.referrer-policy | `+++no-referrer+++` | +|spring.cloud.gateway.filter.secure-headers.strict-transport-security | `+++max-age=631138519+++` | +|spring.cloud.gateway.filter.secure-headers.xss-protection-header | `+++1 ; mode=block+++` | |spring.cloud.gateway.filter.set-path.enabled | `+++true+++` | Enables the set-path filter. |spring.cloud.gateway.filter.set-request-header.enabled | `+++true+++` | Enables the set-request-header filter. |spring.cloud.gateway.filter.set-request-host-header.enabled | `+++true+++` | Enables the set-request-host-header filter. @@ -106,7 +107,7 @@ |spring.cloud.gateway.httpclient.websocket.proxy-ping | `+++true+++` | Proxy ping frames to downstream services, defaults to true. |spring.cloud.gateway.httpclient.wiretap | `+++false+++` | Enables wiretap debugging for Netty HttpClient. |spring.cloud.gateway.httpserver.wiretap | `+++false+++` | Enables wiretap debugging for Netty HttpServer. -|spring.cloud.gateway.loadbalancer.use404 | `+++false+++` | +|spring.cloud.gateway.loadbalancer.use404 | `+++false+++` | |spring.cloud.gateway.metrics.enabled | `+++false+++` | Enables the collection of metrics data. |spring.cloud.gateway.metrics.prefix | `+++spring.cloud.gateway+++` | The prefix of all metrics emitted by gateway. |spring.cloud.gateway.metrics.tags | | Tags map that added to metrics. diff --git a/docs/src/main/asciidoc/spring-cloud-gateway.adoc b/docs/src/main/asciidoc/spring-cloud-gateway.adoc index 0285d51a..df165283 100644 --- a/docs/src/main/asciidoc/spring-cloud-gateway.adoc +++ b/docs/src/main/asciidoc/spring-cloud-gateway.adoc @@ -1894,7 +1894,7 @@ spring: When a request is made through the gateway to `/json/hello` the request will be transformed using the definition provided in `hello.proto`, sent to `com.example.grpcserver.hello.HelloService/hello`, and transform the response back to JSON. -By default, it will create a `NettyChannel` using the default `TrustManagerFactory`. However, this `TrustManager` can be customized by creating a bean of type `GRPCSSLContext`: +By default, it will create a `NettyChannel` using the default `TrustManagerFactory`. However, this `TrustManager` can be customized by creating a bean of type `GrpcSslConfigurer`: [source,java] ---- diff --git a/pom.xml b/pom.xml index 98a25c8d..c1ee9ac8 100644 --- a/pom.xml +++ b/pom.xml @@ -56,7 +56,7 @@ 1.0.0 2.1.4-SNAPSHOT 3.1.4-SNAPSHOT - 1.16.3 + 1.17.2 diff --git a/spring-cloud-gateway-integration-tests/grpc/pom.xml b/spring-cloud-gateway-integration-tests/grpc/pom.xml index 29bc5339..3c89d222 100644 --- a/spring-cloud-gateway-integration-tests/grpc/pom.xml +++ b/spring-cloud-gateway-integration-tests/grpc/pom.xml @@ -30,9 +30,13 @@ org.springframework.cloud spring-cloud-starter-gateway + + org.springframework.boot + spring-boot-starter-actuator + io.grpc - grpc-netty-shaded + grpc-netty ${grpc.version} diff --git a/spring-cloud-gateway-integration-tests/grpc/src/main/java/org/springframework/cloud/gateway/tests/grpc/GRPCApplication.java b/spring-cloud-gateway-integration-tests/grpc/src/main/java/org/springframework/cloud/gateway/tests/grpc/GRPCApplication.java index b2dc170c..a417fa3e 100644 --- a/spring-cloud-gateway-integration-tests/grpc/src/main/java/org/springframework/cloud/gateway/tests/grpc/GRPCApplication.java +++ b/spring-cloud-gateway-integration-tests/grpc/src/main/java/org/springframework/cloud/gateway/tests/grpc/GRPCApplication.java @@ -18,31 +18,24 @@ package org.springframework.cloud.gateway.tests.grpc; import java.io.File; import java.io.IOException; -import java.security.cert.X509Certificate; import java.util.concurrent.TimeUnit; -import javax.net.ssl.SSLException; -import javax.net.ssl.TrustManager; -import javax.net.ssl.X509TrustManager; - import io.grpc.Grpc; import io.grpc.Server; import io.grpc.ServerCredentials; import io.grpc.TlsServerCredentials; import io.grpc.stub.StreamObserver; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; import org.springframework.boot.ApplicationArguments; import org.springframework.boot.ApplicationRunner; import org.springframework.boot.SpringApplication; import org.springframework.boot.SpringBootConfiguration; import org.springframework.boot.autoconfigure.EnableAutoConfiguration; -import org.springframework.cloud.gateway.config.GRPCSSLContext; -import org.springframework.cloud.gateway.route.RouteLocator; -import org.springframework.cloud.gateway.route.builder.RouteLocatorBuilder; -import org.springframework.context.annotation.Bean; +import org.springframework.core.env.Environment; import org.springframework.core.io.ClassPathResource; import org.springframework.stereotype.Component; -import org.springframework.util.SocketUtils; /** * @author Alberto C. Ríos @@ -51,59 +44,39 @@ import org.springframework.util.SocketUtils; @EnableAutoConfiguration public class GRPCApplication { - private static final int GRPC_SERVER_PORT = SocketUtils.findAvailableTcpPort(); - public static void main(String[] args) { SpringApplication.run(GRPCApplication.class, args); } - @Bean - public RouteLocator customRouteLocator(RouteLocatorBuilder builder) { - return builder.routes().route("json-grpc", r -> r.path("/json/hello").filters(f -> { - String protoDescriptor = "file:src/main/proto/hello.pb"; - String protoFile = "file:src/main/proto/hello.proto"; - String service = "HelloService"; - String method = "hello"; - return f.jsonToGRPC(protoDescriptor, protoFile, service, method); - }).uri("https://localhost:" + GRPC_SERVER_PORT)) - .route("grpc", r -> r.predicate(p -> true).uri("https://localhost:" + GRPC_SERVER_PORT)).build(); - } - - @Bean - public GRPCSSLContext sslContext() throws SSLException { - TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() { - public X509Certificate[] getAcceptedIssuers() { - return new X509Certificate[0]; - } - - public void checkClientTrusted(X509Certificate[] certs, String authType) { - } - - public void checkServerTrusted(X509Certificate[] certs, String authType) { - } - } }; - - return new GRPCSSLContext(trustAllCerts[0]); - } - @Component static class GRPCServer implements ApplicationRunner { + private static final Logger log = LoggerFactory.getLogger(GRPCServer.class); + + private final Environment environment; + private Server server; + GRPCServer(Environment environment) { + this.environment = environment; + } + @Override public void run(ApplicationArguments args) throws Exception { - final GRPCServer server = new GRPCServer(); + final GRPCServer server = new GRPCServer(environment); server.start(); } - private void start() throws Exception { - /* The port on which the server should run */ + private void start() throws IOException { + Integer serverPort = environment.getProperty("local.server.port", Integer.class); + int grpcPort = serverPort + 1; + /* + * The port on which the server should run. We run + */ ServerCredentials creds = createServerCredentials(); - server = Grpc.newServerBuilderForPort(GRPC_SERVER_PORT, creds).addService(new HelloService()).build() - .start(); + server = Grpc.newServerBuilderForPort(grpcPort, creds).addService(new HelloService()).build().start(); - System.out.println("Starting gRPC server in port " + GRPC_SERVER_PORT); + log.info("Starting gRPC server in port " + grpcPort); Runtime.getRuntime().addShutdownHook(new Thread(() -> { try { @@ -116,8 +89,9 @@ public class GRPCApplication { } private ServerCredentials createServerCredentials() throws IOException { + File certChain = new ClassPathResource("public.cert").getFile(); File privateKey = new ClassPathResource("private.key").getFile(); - File certChain = new ClassPathResource("certificate.pem").getFile(); + return TlsServerCredentials.create(certChain, privateKey); } @@ -132,8 +106,8 @@ public class GRPCApplication { @Override public void hello(HelloRequest request, StreamObserver responseObserver) { - String greeting = "Hello, " + request.getFirstName() + " " + request.getLastName(); - System.out.println("Sending response: " + greeting); + String greeting = String.format("Hello, %s %s", request.getFirstName(), request.getLastName()); + log.info("Sending response: " + greeting); HelloResponse response = HelloResponse.newBuilder().setGreeting(greeting).build(); diff --git a/spring-cloud-gateway-integration-tests/grpc/src/main/resources/certificate.pem b/spring-cloud-gateway-integration-tests/grpc/src/main/resources/certificate.pem deleted file mode 100644 index 808fb06c..00000000 --- a/spring-cloud-gateway-integration-tests/grpc/src/main/resources/certificate.pem +++ /dev/null @@ -1,21 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDdzCCAl+gAwIBAgIEIon96DANBgkqhkiG9w0BAQsFADBsMRAwDgYDVQQGEwdV -bmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYD -VQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3duMRAwDgYDVQQDEwdVbmtub3du -MB4XDTIxMDkyNzE2NDQwNVoXDTMxMDkyNTE2NDQwNVowbDEQMA4GA1UEBhMHVW5r -bm93bjEQMA4GA1UECBMHVW5rbm93bjEQMA4GA1UEBxMHVW5rbm93bjEQMA4GA1UE -ChMHVW5rbm93bjEQMA4GA1UECxMHVW5rbm93bjEQMA4GA1UEAxMHVW5rbm93bjCC -ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIwevGHY30YdoUdCSB/5q7/F -c0KHetdjb71G2u6vFdeNvSwMpCV8Z1JznOJ/1zuY+0Z105QCPM7fi1ACi+tqxDR+ -L7yjUHhUEMTiGgCHcYJIZZCYfWS3BQXVxgORXhDv7RduCUaCLnkaFY++iPMTUy0C -VxIkplIEhAmqcikIgWaa5ZjBkegKgahlPQLKlfD4Rz/kq2P+LLYFsHNNdKfWv6XQ -u4LMw7ZEAJtfdpaMTzmtQipbTt6Dh87vIa0CIVnCPdlQ3o/5WeaxEA1pnfOLas07 -1VdHih2nC5vHhQcTPQDfa+uwzQvzHrchjuvMUUZaCYJzuT0G6nbGBba54EBT7yUC -AwEAAaMhMB8wHQYDVR0OBBYEFKOHmfytP5ab2C4iFHlSklu6tCcuMA0GCSqGSIb3 -DQEBCwUAA4IBAQAdgWwdOtRbI796Z22weTBc0/tM8kLc6G0raNb08WyZMPZVki04 -jPh73pPQCgYeI/pq5JqH46KgvehmygTzpWDAFIllW0kgABVw3Nu6duV+blt1JG8T -lWP7t5A+qDXgPDm3I5diii7O1YlLB3I37XiBdEV/+2WmF1VGQ7uBWAv+uotQeuW2 -JvHOr4ICOiW45TzRYtAbzWukSYKg/A7lwBs7HE9KVomUxNrkD+7+ugRuy/31pyen -pHsEJQpx5juFRE222B6GXmX0w9xLIOapytl4EoPUx3K8Ecc+yI2q00UUC43x0v28 -c05YqwRZ5vp+jUnRxkxaz85YdArfR7QFYWtO ------END CERTIFICATE----- diff --git a/spring-cloud-gateway-integration-tests/grpc/src/main/resources/keystore.p12 b/spring-cloud-gateway-integration-tests/grpc/src/main/resources/keystore.p12 index b22b3349..991ecbcf 100644 Binary files a/spring-cloud-gateway-integration-tests/grpc/src/main/resources/keystore.p12 and b/spring-cloud-gateway-integration-tests/grpc/src/main/resources/keystore.p12 differ diff --git a/spring-cloud-gateway-integration-tests/grpc/src/main/resources/private.key b/spring-cloud-gateway-integration-tests/grpc/src/main/resources/private.key index 1db2b3cb..d9952a36 100644 --- a/spring-cloud-gateway-integration-tests/grpc/src/main/resources/private.key +++ b/spring-cloud-gateway-integration-tests/grpc/src/main/resources/private.key @@ -1,32 +1,32 @@ Bag Attributes - friendlyName: mykey - localKeyID: 54 69 6D 65 20 31 36 33 32 38 32 34 38 37 31 33 33 35 + friendlyName: bootapp + localKeyID: 54 69 6D 65 20 31 36 35 39 39 37 34 34 38 34 30 33 30 Key Attributes: -----BEGIN PRIVATE KEY----- -MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCMHrxh2N9GHaFH -Qkgf+au/xXNCh3rXY2+9RtrurxXXjb0sDKQlfGdSc5zif9c7mPtGddOUAjzO34tQ -AovrasQ0fi+8o1B4VBDE4hoAh3GCSGWQmH1ktwUF1cYDkV4Q7+0XbglGgi55GhWP -vojzE1MtAlcSJKZSBIQJqnIpCIFmmuWYwZHoCoGoZT0CypXw+Ec/5Ktj/iy2BbBz -TXSn1r+l0LuCzMO2RACbX3aWjE85rUIqW07eg4fO7yGtAiFZwj3ZUN6P+VnmsRAN -aZ3zi2rNO9VXR4odpwubx4UHEz0A32vrsM0L8x63IY7rzFFGWgmCc7k9Bup2xgW2 -ueBAU+8lAgMBAAECggEAGu2xQJDAYCZDn4FCgTqnYkSdIRUOa6SFjfe3DZYCeZmY -2IVZaobdCICFjxYIlECTUfhFADXp38wgZvEGWOj86iWyIOu2BFoLmvrlCmL9Uo99 -TWuw9ZEi2vs5gegHDvQ9OXqBN9a+/bEgoa55fVWib4z6lNcMS8joYz8pj28+ByzE -LW0/3T3p6beM2fUcCJWn3d2M3wUgSuXmcdjVXJSkhEwKTVcc4vTTcOeF6xb2VZ/g -Pozv/39G1qZ+QtM58yBiqnJ1Z2gtAk71l/1ztQa3uY22gzw8Kj5dmqcHgdiN5DWI -bNE+k5Q93FzUmZNYPzmY6YVkdEzaNMtmi96sdtEu5QKBgQD36YdGXUyoRXeNDRuc -yMXr6j/9/ewii+byHhFoUvjLuXWIQ06V+nOtYqohg/zgGIiC5LQ8EB0uFZDMhbDf -kSwtoXbpUDLYD2OPgIyLaPqHiYQ9BampbUz5vHlfYLr0vB+Xp5r22Eb6nDQRRtb5 -EXHoYgAokgpYdeTIcdKRcB/2DwKBgQCQsPePeu7PagM9vYEo4zfbFxfY3Qkr4lOQ -BCZ/tgsS0b0jAAxpfUH0/3O5oXizmB/5K7vgKqGnTuBWJJ/hdCWq27FkKxJ+8ejU -8V9TFd5VQ89VeB5OekZwPks8vftwzW4L82ZRW5hvyQB0jPR+lwqjrNqds+xxH7i+ -c+RFx15biwKBgQCgkGGK0zao7YUGl+zAWNDHgQo9KM5deZr0SUEg/kwhNlbHEEC/ -plxxeauS1XdcdMdFb3bER/N+O31y2Uu7IL0qOJ9ZcRXdFep3sNxWFoHcctZw51AB -accnIEjD21R62bTkditJoL4n5i9a2TS2T/QkfAR6QkvtCz5IDGBCzgoFRQKBgC51 -VBfy3gklPgMt/PHW+1FSuep9FnvLwQ8F9iKdnjKdu8AoPNQGTw5Ok6bwDOSFnQaR -n1Kb/anN7sRaICfw9kNFJVFHbznpjNwK4JO5+tif3EvSNND3+/QAXIIVck3G+GXH -8nt/EJQcExRZSgv3jYf+cXeflPTBvb0RUyOAn3B/AoGAM9aUi2dg3XjlDkZahQlY -P5QNIr9BY25Ordga3GLwfR6rE+jiWTeTmreXBSJ7nvcaEQUNyFMX9n3v/QI84etk -lMJkZ4o2TgzRnCsFJoBV36Ihsa6B5uXVWAvMRLKvwKpptKXfO0TnhUg7oKtN4t3a -/FzAOS2Eu1PFP27z74gAMKY= +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQClCZtSgRjM2uYM +O70+acD4rhwcc8ND23SwoKTNLPH6s1K2Pi5MZqF4Rnx+REJwerQrkgfMnsQ0QHcb +NjI9dhSwHw6aPigAGJQEzR8whDu2PkR57iBmySr3GLtpR+WkVGo/xAK92ozKt9aW +Saxm0miygYI8mgzrNpbaQAu6sZcS3RHkPYWw/izYVZLBB6IEpAJJrUqjzlu53TyN +X4VC4FWddItjOCiyrHe2+A+tFLNK3IZnFZBqoMcYR6/Rq+zsXx8ynCggkUwTFaPd +IVyzSYtooE2oq+aSjkJzKvoPA7BObLnrW+5Dklwj1iPtLhfuCflz2oa54/Hpl60R +Ke6y6/t5AgMBAAECggEAQvJ/sFswDUGq2kGNhfjuT7KJMr1+81Ldphy0XYqi6li9 +77GPpGxpidnF/I6CCRCtb5NAWK/61VtlNYOpo6b3w24FxWn7XfaabMwsn8i0VDw0 +GOYQ/MEUDcJZm96PeDbKFu3TUuKKBF3IzZQ7PEaUM/03MJApN20gio46c9RAfWTK +hN9jX9YkBpkSWPfx9RA9BOIXRrRMTXhidsVPnNxhhM7OAGZ1LhggDPaeiCIbVx6l +yMsyCkNvqdQbKu0hFcVyeQsGjovCC1Ye71F3em3ACguqDu+VAy3flpTbcDVf2D7T +zP2T5e5OEJ2hRTGdnEVSsXxWOWnq6Gt6ydNEe2AWVQKBgQC5HcQAUTnvIMaTez44 +7SBfELNY1AzF24dha24JFIGY78QNRZi+4Agsvxjkx4fKSd4DfmPsCqentmEkEcDr +w6fH0CAFm/rrkzLHmesBCC8byl4WtfMW5i8h1yzOeQbYpx3MGIu5xhkE92gbNj+o +ioM7nkoBvloU0odiYTVnoNYnFwKBgQDkO5ldA8Vl3+BWhmhOtPu+1EKssWry5rdO +m6IiZ1uB6uG4bhAj5dSVVgDRX6pcuppMVZqIbPpdkS7/i0LVwohT7EmpMMJ5bezz +EhG1z6AvZDcGMDC/PPMp7SLjJviYZDaTWLekKwY6yV1T9gtOY70jjWkUcfN1IHpA +renHNNyL7wKBgQCEYvIqW+y3xFPfY1MzePoeop3wl+3ujjo6hI7z9XNdgZNO/ofn +cebGwX+3Fa9aDwu0qe4h/9i4y2ibWAsFUS6ran+MI2oGkYXOU5hKa6TtFgPF8CfC +J6prZCxKGSm5RYK81I0Qtchs0dblJx3NlgmWWHSK3Kwlmg5yYBzGWLLuzwKBgDzg +rNrDq76txcAun9oGqnPPWG2J8XYTFmgQWWIF4cG4rjasnP+GSXr/8r3mX6HWYFvm +JY8oSmv00u107wHnnseL6mYHzIfpS1/WvQSa+iZJ++dZqVcJYe8YAstGVN8JNAl/ +i5RtqX66wXso0QE613OJP7MlZgQjApkICqiJMB7fAoGAVFdv/Nphcju7MCkXGuQe +amk7Z6Q2PjMWvLwiyB39PrIzvTOdaQyQk7oYdnAGFJbkmi7mmGiet5uvcE9OjNRb ++XeXo2LEZ2QWJEnHi9uCXSQF3eeBlJ2wGUsELPTHglWIUTpi5iDB2hHzczPzO8GY +qPb+ckCl8mTsHRKQQse4Bm0= -----END PRIVATE KEY----- diff --git a/spring-cloud-gateway-integration-tests/grpc/src/main/resources/public.cert b/spring-cloud-gateway-integration-tests/grpc/src/main/resources/public.cert new file mode 100644 index 00000000..ecb750c6 --- /dev/null +++ b/spring-cloud-gateway-integration-tests/grpc/src/main/resources/public.cert @@ -0,0 +1,18 @@ +-----BEGIN CERTIFICATE----- +MIIC1zCCAb+gAwIBAgIIEsL9TgSEch8wDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UE +AxMPbXktYm9vdC1hcHAub3JnMB4XDTIyMDgwODE2MDEyNFoXDTMyMDgwNTE2MDEy +NFowGjEYMBYGA1UEAxMPbXktYm9vdC1hcHAub3JnMIIBIjANBgkqhkiG9w0BAQEF +AAOCAQ8AMIIBCgKCAQEApQmbUoEYzNrmDDu9PmnA+K4cHHPDQ9t0sKCkzSzx+rNS +tj4uTGaheEZ8fkRCcHq0K5IHzJ7ENEB3GzYyPXYUsB8Omj4oABiUBM0fMIQ7tj5E +ee4gZskq9xi7aUflpFRqP8QCvdqMyrfWlkmsZtJosoGCPJoM6zaW2kALurGXEt0R +5D2FsP4s2FWSwQeiBKQCSa1Ko85bud08jV+FQuBVnXSLYzgosqx3tvgPrRSzStyG +ZxWQaqDHGEev0avs7F8fMpwoIJFMExWj3SFcs0mLaKBNqKvmko5Ccyr6DwOwTmy5 +61vuQ5JcI9Yj7S4X7gn5c9qGuePx6ZetESnusuv7eQIDAQABoyEwHzAdBgNVHQ4E +FgQUf72EgsQASMCzSGwrFDaKnBoufm8wDQYJKoZIhvcNAQELBQADggEBAAHzJkp/ +q+U0ki+JaFaUBYg85h+yJbi262hmFjLYDQEcz2tvAw93X9ytOzVtmo2H9AgsTJYA +z4UbJHfnTTa1KAHDHhzL/Adh/s2OZ7Y2kazLrHArFteKtGUo815JDL935JpiRBWc +Qn1WJJ6EFb+ZRMG7oROQ3LgvrradH8G51qxvSbH/fpmEFDTSHJNIG8tXcIA3fJkI +dsVJLygrXLzZQo5xI8rwMDX9aujRFU4Dgit58xquCkuzob/BonN7Es1Hp3beQjro +gddts4x5wWyiFun7uYrbPVhGMJNgwRKB5e3QQA6vYDyeQqvIy6n1lnDNIxvaOfPW +Je5gI59jCbxHs5g= +-----END CERTIFICATE----- diff --git a/spring-cloud-gateway-integration-tests/grpc/src/test/java/org/springframework/cloud/gateway/tests/grpc/GRPCApplicationTests.java b/spring-cloud-gateway-integration-tests/grpc/src/test/java/org/springframework/cloud/gateway/tests/grpc/GRPCApplicationTests.java index 0c6289ed..f540862a 100644 --- a/spring-cloud-gateway-integration-tests/grpc/src/test/java/org/springframework/cloud/gateway/tests/grpc/GRPCApplicationTests.java +++ b/spring-cloud-gateway-integration-tests/grpc/src/test/java/org/springframework/cloud/gateway/tests/grpc/GRPCApplicationTests.java @@ -23,8 +23,8 @@ import javax.net.ssl.TrustManager; import javax.net.ssl.X509TrustManager; import io.grpc.ManagedChannel; -import io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts; -import io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder; +import io.grpc.netty.GrpcSslContexts; +import io.grpc.netty.NettyChannelBuilder; import org.assertj.core.api.Assertions; import org.junit.jupiter.api.Test; @@ -32,7 +32,7 @@ import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.web.server.LocalServerPort; import org.springframework.test.annotation.DirtiesContext; -import static io.grpc.netty.shaded.io.grpc.netty.NegotiationType.TLS; +import static io.grpc.netty.NegotiationType.TLS; import static org.springframework.boot.test.context.SpringBootTest.WebEnvironment; /** @@ -47,7 +47,7 @@ public class GRPCApplicationTests { @Test public void gRPCUnaryCalShouldReturnResponse() throws SSLException { - ManagedChannel channel = createSecuredChannel(port); + ManagedChannel channel = createSecuredChannel(port + 1); final HelloResponse response = HelloServiceGrpc.newBlockingStub(channel) .hello(HelloRequest.newBuilder().setFirstName("Sir").setLastName("FromClient").build()); diff --git a/spring-cloud-gateway-integration-tests/grpc/src/test/java/org/springframework/cloud/gateway/tests/grpc/JsonToGrpcApplicationTests.java b/spring-cloud-gateway-integration-tests/grpc/src/test/java/org/springframework/cloud/gateway/tests/grpc/JsonToGrpcApplicationTests.java index f7ee4620..b0ec1e62 100644 --- a/spring-cloud-gateway-integration-tests/grpc/src/test/java/org/springframework/cloud/gateway/tests/grpc/JsonToGrpcApplicationTests.java +++ b/spring-cloud-gateway-integration-tests/grpc/src/test/java/org/springframework/cloud/gateway/tests/grpc/JsonToGrpcApplicationTests.java @@ -19,6 +19,11 @@ package org.springframework.cloud.gateway.tests.grpc; import java.security.KeyManagementException; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; +import java.util.Arrays; +import java.util.Collections; +import java.util.HashMap; +import java.util.Map; +import java.util.UUID; import javax.net.ssl.SSLContext; @@ -39,13 +44,19 @@ import org.junit.jupiter.api.Test; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.web.server.LocalServerPort; +import org.springframework.http.HttpEntity; +import org.springframework.http.HttpMethod; +import org.springframework.http.HttpStatus; +import org.springframework.http.ResponseEntity; import org.springframework.http.client.HttpComponentsClientHttpRequestFactory; +import org.springframework.test.web.reactive.server.WebTestClient; import org.springframework.web.client.RestTemplate; import static org.springframework.boot.test.context.SpringBootTest.WebEnvironment; /** * @author Alberto C. Ríos + * @author Abel Salgado Romero */ @SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT) public class JsonToGrpcApplicationTests { @@ -62,7 +73,14 @@ public class JsonToGrpcApplicationTests { @Test public void shouldConvertFromJSONToGRPC() { - String response = restTemplate.postForEntity("https://localhost:" + port + "/json/hello", + // Since GRPC server and GW run in same instance and don't know server port until + // test starts, + // we need to configure route dynamically using the actuator endpoint. + final RouteConfigurer configurer = new RouteConfigurer(port); + configurer.addRoute(port + 1, "/json/hello", + "JsonToGrpc=file:src/main/proto/hello.pb,file:src/main/proto/hello.proto,HelloService,hello"); + + String response = restTemplate.postForEntity("https://localhost:" + this.port + "/json/hello", "{\"firstName\":\"Duff\", \"lastName\":\"McKagan\"}", String.class).getBody(); Assertions.assertThat(response).isNotNull(); @@ -94,4 +112,46 @@ public class JsonToGrpcApplicationTests { return new RestTemplate(requestFactory); } + class RouteConfigurer { + + private final WebTestClient actuatorWebClient; + + private final int actuatorPort; + + RouteConfigurer(int actuatorPort) { + this.actuatorPort = actuatorPort; + this.actuatorWebClient = WebTestClient.bindToServer().baseUrl("http://localhost:" + actuatorPort).build(); + + } + + public void addRoute(int uriPort, String path, String filter) { + final String routeId = "test-route-" + UUID.randomUUID(); + + Map route = new HashMap<>(); + route.put("id", routeId); + route.put("uri", "http://localhost:" + uriPort); + route.put("predicates", Collections.singletonList("Path=" + path)); + route.put("filters", Arrays.asList(filter)); + + ResponseEntity exchange = restTemplate.exchange(url("/actuator/gateway/routes/" + routeId), + HttpMethod.POST, new HttpEntity<>(route), String.class); + + assert exchange.getStatusCode() == HttpStatus.CREATED; + + refreshRoutes(); + } + + private void refreshRoutes() { + ResponseEntity exchange = restTemplate.exchange(url("/actuator/gateway/refresh"), HttpMethod.POST, + new HttpEntity<>(""), String.class); + + assert exchange.getStatusCode() == HttpStatus.OK; + } + + private String url(String context) { + return String.format("https://localhost:%s%s", this.actuatorPort, context); + } + + } + } diff --git a/spring-cloud-gateway-integration-tests/grpc/src/test/resources/application.yml b/spring-cloud-gateway-integration-tests/grpc/src/test/resources/application.yml index 7cc4ef2e..97c1b950 100644 --- a/spring-cloud-gateway-integration-tests/grpc/src/test/resources/application.yml +++ b/spring-cloud-gateway-integration-tests/grpc/src/test/resources/application.yml @@ -2,11 +2,22 @@ server: http2: enabled: true ssl: - key-store-type: PKCS12 key-store: classpath:keystore.p12 + key-store-type: pkcs12 key-store-password: password - key-password: password - enabled: true + key-alias: bootapp + +management: + endpoint: + health: + show-details: when_authorized + gateway: + enabled: true + endpoints: + web: + exposure: + include: "*" + spring: cloud: gateway: @@ -15,11 +26,10 @@ spring: httpclient: wiretap: true ssl: - key-store-type: PKCS12 - key-store: classpath:keystore.p12 - key-store-password: password - key-password: password use-insecure-trust-manager: true +# Requires faking domain name (modifying /etc/hosts) +# trustedX509Certificates: +# - classpath:public.cert logging: level: diff --git a/spring-cloud-gateway-server/pom.xml b/spring-cloud-gateway-server/pom.xml index d3756764..1c422fbe 100644 --- a/spring-cloud-gateway-server/pom.xml +++ b/spring-cloud-gateway-server/pom.xml @@ -94,7 +94,7 @@ io.grpc - grpc-netty-shaded + grpc-netty true ${grpc.version} diff --git a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/AbstractSslConfigurer.java b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/AbstractSslConfigurer.java new file mode 100644 index 00000000..5f310d3f --- /dev/null +++ b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/AbstractSslConfigurer.java @@ -0,0 +1,139 @@ +/* + * Copyright 2013-2020 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.cloud.gateway.config; + +import java.io.IOException; +import java.net.URL; +import java.security.KeyStore; +import java.security.KeyStoreException; +import java.security.NoSuchProviderException; +import java.security.cert.Certificate; +import java.security.cert.CertificateException; +import java.security.cert.CertificateFactory; +import java.security.cert.X509Certificate; +import java.util.ArrayList; +import java.util.Collection; + +import javax.net.ssl.KeyManagerFactory; +import javax.net.ssl.SSLException; +import javax.net.ssl.TrustManagerFactory; + +import io.netty.handler.ssl.SslContextBuilder; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; + +import org.springframework.util.ResourceUtils; + +/** + * Base class to configure SSL for component T. Returns an instance S with the resulting + * configuration (can be the same as T). + * + * @author Abel Salgado Romero + */ +public abstract class AbstractSslConfigurer { + + protected final Log logger = LogFactory.getLog(this.getClass()); + + private final HttpClientProperties.Ssl ssl; + + protected AbstractSslConfigurer(HttpClientProperties.Ssl sslProperties) { + this.ssl = sslProperties; + } + + abstract public S configureSsl(T client) throws SSLException; + + protected HttpClientProperties.Ssl getSslProperties() { + return ssl; + } + + protected X509Certificate[] getTrustedX509CertificatesForTrustManager() { + + try { + CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509"); + ArrayList allCerts = new ArrayList<>(); + for (String trustedCert : ssl.getTrustedX509Certificates()) { + try { + URL url = ResourceUtils.getURL(trustedCert); + Collection certs = certificateFactory.generateCertificates(url.openStream()); + allCerts.addAll(certs); + } + catch (IOException e) { + throw new RuntimeException("Could not load certificate '" + trustedCert + "'", e); + } + } + return allCerts.toArray(new X509Certificate[allCerts.size()]); + } + catch (CertificateException e1) { + throw new RuntimeException("Could not load CertificateFactory X.509", e1); + } + } + + protected KeyManagerFactory getKeyManagerFactory() { + + try { + if (ssl.getKeyStore() != null && ssl.getKeyStore().length() > 0) { + KeyManagerFactory keyManagerFactory = KeyManagerFactory + .getInstance(KeyManagerFactory.getDefaultAlgorithm()); + char[] keyPassword = ssl.getKeyPassword() != null ? ssl.getKeyPassword().toCharArray() : null; + + if (keyPassword == null && ssl.getKeyStorePassword() != null) { + keyPassword = ssl.getKeyStorePassword().toCharArray(); + } + + keyManagerFactory.init(this.createKeyStore(), keyPassword); + + return keyManagerFactory; + } + + return null; + } + catch (Exception e) { + throw new IllegalStateException(e); + } + } + + protected KeyStore createKeyStore() { + + try { + KeyStore store = ssl.getKeyStoreProvider() != null + ? KeyStore.getInstance(ssl.getKeyStoreType(), ssl.getKeyStoreProvider()) + : KeyStore.getInstance(ssl.getKeyStoreType()); + try { + URL url = ResourceUtils.getURL(ssl.getKeyStore()); + store.load(url.openStream(), + ssl.getKeyStorePassword() != null ? ssl.getKeyStorePassword().toCharArray() : null); + } + catch (Exception e) { + throw new RuntimeException("Could not load key store ' " + ssl.getKeyStore() + "'", e); + } + + return store; + } + catch (KeyStoreException | NoSuchProviderException e) { + throw new RuntimeException("Could not load KeyStore for given type and provider", e); + } + } + + protected void setTrustManager(SslContextBuilder sslContextBuilder, X509Certificate... trustedX509Certificates) { + sslContextBuilder.trustManager(trustedX509Certificates); + } + + protected void setTrustManager(SslContextBuilder sslContextBuilder, TrustManagerFactory factory) { + sslContextBuilder.trustManager(factory); + } + +} diff --git a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GRPCSSLContext.java b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GRPCSSLContext.java deleted file mode 100644 index bbdb34a6..00000000 --- a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GRPCSSLContext.java +++ /dev/null @@ -1,36 +0,0 @@ -/* - * Copyright 2013-2020 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.cloud.gateway.config; - -import javax.net.ssl.TrustManager; - -/** - * @author Alberto C. Ríos - */ -public class GRPCSSLContext { - - private final TrustManager trustManager; - - public GRPCSSLContext(TrustManager trustManager) { - this.trustManager = trustManager; - } - - public TrustManager getTrustManager() { - return trustManager; - } - -} diff --git a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GatewayAutoConfiguration.java b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GatewayAutoConfiguration.java index 99a5f54d..80717349 100644 --- a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GatewayAutoConfiguration.java +++ b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GatewayAutoConfiguration.java @@ -25,6 +25,7 @@ import java.util.function.Supplier; import javax.net.ssl.TrustManagerFactory; +import io.grpc.Channel; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import reactor.core.publisher.Flux; @@ -302,22 +303,23 @@ public class GatewayAutoConfiguration { @Bean @ConditionalOnEnabledFilter @ConditionalOnProperty(name = "server.http2.enabled", matchIfMissing = true) - @ConditionalOnClass(name = "io.grpc.Channel") - public JsonToGrpcGatewayFilterFactory jsonToGRPCFilterFactory(GRPCSSLContext gRPCSSLContext, + @ConditionalOnClass(Channel.class) + public JsonToGrpcGatewayFilterFactory jsonToGRPCFilterFactory(GrpcSslConfigurer gRPCSSLContext, ResourceLoader resourceLoader) { return new JsonToGrpcGatewayFilterFactory(gRPCSSLContext, resourceLoader); } @Bean @ConditionalOnEnabledFilter(JsonToGrpcGatewayFilterFactory.class) - @ConditionalOnMissingBean(GRPCSSLContext.class) + @ConditionalOnMissingBean(GrpcSslConfigurer.class) @ConditionalOnClass(name = "io.grpc.Channel") - public GRPCSSLContext gRPCSSLContext() throws KeyStoreException, NoSuchAlgorithmException { + public GrpcSslConfigurer grpcSslConfigurer(HttpClientProperties properties) + throws KeyStoreException, NoSuchAlgorithmException { TrustManagerFactory trustManagerFactory = TrustManagerFactory .getInstance(TrustManagerFactory.getDefaultAlgorithm()); trustManagerFactory.init(KeyStore.getInstance(KeyStore.getDefaultType())); - return new GRPCSSLContext(trustManagerFactory.getTrustManagers()[0]); + return new GrpcSslConfigurer(properties.getSsl()); } @Bean @@ -683,11 +685,19 @@ public class GatewayAutoConfiguration { }; } + @Bean + public HttpClientSslConfigurer httpClientSslConfigurer(ServerProperties serverProperties, + HttpClientProperties httpClientProperties) { + return new HttpClientSslConfigurer(httpClientProperties.getSsl(), serverProperties) { + }; + } + @Bean @ConditionalOnMissingBean({ HttpClient.class, HttpClientFactory.class }) public HttpClientFactory gatewayHttpClientFactory(HttpClientProperties properties, - ServerProperties serverProperties, List customizers) { - return new HttpClientFactory(properties, serverProperties, customizers); + ServerProperties serverProperties, List customizers, + HttpClientSslConfigurer sslConfigurer) { + return new HttpClientFactory(properties, serverProperties, sslConfigurer, customizers); } @Bean diff --git a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GrpcSslConfigurer.java b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GrpcSslConfigurer.java new file mode 100644 index 00000000..f3b6907e --- /dev/null +++ b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GrpcSslConfigurer.java @@ -0,0 +1,59 @@ +/* + * Copyright 2013-2020 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.cloud.gateway.config; + +import javax.net.ssl.SSLException; + +import io.grpc.ManagedChannel; +import io.grpc.netty.GrpcSslContexts; +import io.grpc.netty.NettyChannelBuilder; +import io.netty.handler.ssl.SslContext; +import io.netty.handler.ssl.SslContextBuilder; +import io.netty.handler.ssl.util.InsecureTrustManagerFactory; + +/** + * @author Alberto C. Ríos + */ +public class GrpcSslConfigurer extends AbstractSslConfigurer { + + public GrpcSslConfigurer(HttpClientProperties.Ssl sslProperties) { + super(sslProperties); + } + + @Override + public ManagedChannel configureSsl(NettyChannelBuilder NettyChannelBuilder) throws SSLException { + return NettyChannelBuilder.useTransportSecurity().sslContext(getSslContext()).build(); + } + + private SslContext getSslContext() throws SSLException { + + final SslContextBuilder sslContextBuilder = GrpcSslContexts.forClient(); + + final HttpClientProperties.Ssl ssl = getSslProperties(); + boolean useInsecureTrustManager = ssl.isUseInsecureTrustManager(); + if (useInsecureTrustManager) { + sslContextBuilder.trustManager(InsecureTrustManagerFactory.INSTANCE.getTrustManagers()[0]); + } + + if (!useInsecureTrustManager && ssl.getTrustedX509Certificates().size() > 0) { + sslContextBuilder.trustManager(getTrustedX509CertificatesForTrustManager()); + } + + return sslContextBuilder.keyManager(getKeyManagerFactory()).build(); + } + +} diff --git a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/HttpClientFactory.java b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/HttpClientFactory.java index 4d033750..7f28268d 100644 --- a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/HttpClientFactory.java +++ b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/HttpClientFactory.java @@ -69,12 +69,23 @@ public class HttpClientFactory extends AbstractFactoryBean { protected final ServerProperties serverProperties; + protected final HttpClientSslConfigurer sslConfigurer; + protected final List customizers; public HttpClientFactory(HttpClientProperties properties, ServerProperties serverProperties, List customizers) { this.properties = properties; this.serverProperties = serverProperties; + this.sslConfigurer = null; + this.customizers = customizers; + } + + public HttpClientFactory(HttpClientProperties properties, ServerProperties serverProperties, + HttpClientSslConfigurer sslConfigurer, List customizers) { + this.properties = properties; + this.serverProperties = serverProperties; + this.sslConfigurer = sslConfigurer; this.customizers = customizers; } @@ -117,17 +128,11 @@ public class HttpClientFactory extends AbstractFactoryBean { return httpClient; } - private HttpClient applyCustomizers(HttpClient httpClient) { - if (!CollectionUtils.isEmpty(customizers)) { - customizers.sort(AnnotationAwareOrderComparator.INSTANCE); - for (HttpClientCustomizer customizer : customizers) { - httpClient = customizer.customize(httpClient); - } - } - return httpClient; - } - protected HttpClient configureSsl(HttpClient httpClient) { + if (sslConfigurer != null) { + return sslConfigurer.configureSsl(httpClient); + } + HttpClientProperties.Ssl ssl = properties.getSsl(); if ((ssl.getKeyStore() != null && ssl.getKeyStore().length() > 0) || getTrustedX509CertificatesForTrustManager().length > 0 || ssl.isUseInsecureTrustManager()) { @@ -139,6 +144,7 @@ public class HttpClientFactory extends AbstractFactoryBean { return httpClient; } + @Deprecated protected void configureSslContext(HttpClientProperties.Ssl ssl, SslProvider.SslContextSpec sslContextSpec) { SslProvider.ProtocolSslContextSpec clientSslContext = (serverProperties.getHttp2().isEnabled()) ? Http2SslContextSpec.forClient() : Http11SslContextSpec.forClient(); @@ -164,6 +170,16 @@ public class HttpClientFactory extends AbstractFactoryBean { .closeNotifyReadTimeout(ssl.getCloseNotifyReadTimeout()); } + private HttpClient applyCustomizers(HttpClient httpClient) { + if (!CollectionUtils.isEmpty(customizers)) { + customizers.sort(AnnotationAwareOrderComparator.INSTANCE); + for (HttpClientCustomizer customizer : customizers) { + httpClient = customizer.customize(httpClient); + } + } + return httpClient; + } + protected HttpClient configureProxy(HttpClient httpClient) { // configure proxy if proxy host is set. if (StringUtils.hasText(properties.getProxy().getHost())) { @@ -176,6 +192,88 @@ public class HttpClientFactory extends AbstractFactoryBean { return httpClient; } + @Deprecated + protected X509Certificate[] getTrustedX509CertificatesForTrustManager() { + HttpClientProperties.Ssl ssl = properties.getSsl(); + + try { + CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509"); + ArrayList allCerts = new ArrayList<>(); + for (String trustedCert : ssl.getTrustedX509Certificates()) { + try { + URL url = ResourceUtils.getURL(trustedCert); + Collection certs = certificateFactory.generateCertificates(url.openStream()); + allCerts.addAll(certs); + } + catch (IOException e) { + throw new RuntimeException("Could not load certificate '" + trustedCert + "'", e); + } + } + return allCerts.toArray(new X509Certificate[allCerts.size()]); + } + catch (CertificateException e1) { + throw new RuntimeException("Could not load CertificateFactory X.509", e1); + } + } + + @Deprecated + protected KeyManagerFactory getKeyManagerFactory() { + HttpClientProperties.Ssl ssl = properties.getSsl(); + try { + if (ssl.getKeyStore() != null && ssl.getKeyStore().length() > 0) { + KeyManagerFactory keyManagerFactory = KeyManagerFactory + .getInstance(KeyManagerFactory.getDefaultAlgorithm()); + char[] keyPassword = ssl.getKeyPassword() != null ? ssl.getKeyPassword().toCharArray() : null; + + if (keyPassword == null && ssl.getKeyStorePassword() != null) { + keyPassword = ssl.getKeyStorePassword().toCharArray(); + } + + keyManagerFactory.init(this.createKeyStore(), keyPassword); + + return keyManagerFactory; + } + + return null; + } + catch (Exception e) { + throw new IllegalStateException(e); + } + } + + @Deprecated + protected KeyStore createKeyStore() { + HttpClientProperties.Ssl ssl = properties.getSsl(); + try { + KeyStore store = ssl.getKeyStoreProvider() != null + ? KeyStore.getInstance(ssl.getKeyStoreType(), ssl.getKeyStoreProvider()) + : KeyStore.getInstance(ssl.getKeyStoreType()); + try { + URL url = ResourceUtils.getURL(ssl.getKeyStore()); + store.load(url.openStream(), + ssl.getKeyStorePassword() != null ? ssl.getKeyStorePassword().toCharArray() : null); + } + catch (Exception e) { + throw new RuntimeException("Could not load key store ' " + ssl.getKeyStore() + "'", e); + } + + return store; + } + catch (KeyStoreException | NoSuchProviderException e) { + throw new RuntimeException("Could not load KeyStore for given type and provider", e); + } + } + + @Deprecated + protected void setTrustManager(SslContextBuilder sslContextBuilder, X509Certificate... trustedX509Certificates) { + sslContextBuilder.trustManager(trustedX509Certificates); + } + + @Deprecated + protected void setTrustManager(SslContextBuilder sslContextBuilder, TrustManagerFactory factory) { + sslContextBuilder.trustManager(factory); + } + protected ProxyProvider.Builder configureProxyProvider(HttpClientProperties.Proxy proxy, ProxyProvider.TypeSpec proxySpec) { ProxyProvider.Builder builder = proxySpec.type(proxy.getType()).host(proxy.getHost()); @@ -201,83 +299,6 @@ public class HttpClientFactory extends AbstractFactoryBean { return spec; } - protected X509Certificate[] getTrustedX509CertificatesForTrustManager() { - HttpClientProperties.Ssl ssl = properties.getSsl(); - - try { - CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509"); - ArrayList allCerts = new ArrayList<>(); - for (String trustedCert : ssl.getTrustedX509Certificates()) { - try { - URL url = ResourceUtils.getURL(trustedCert); - Collection certs = certificateFactory.generateCertificates(url.openStream()); - allCerts.addAll(certs); - } - catch (IOException e) { - throw new RuntimeException("Could not load certificate '" + trustedCert + "'", e); - } - } - return allCerts.toArray(new X509Certificate[allCerts.size()]); - } - catch (CertificateException e1) { - throw new RuntimeException("Could not load CertificateFactory X.509", e1); - } - } - - protected KeyManagerFactory getKeyManagerFactory() { - HttpClientProperties.Ssl ssl = properties.getSsl(); - try { - if (ssl.getKeyStore() != null && ssl.getKeyStore().length() > 0) { - KeyManagerFactory keyManagerFactory = KeyManagerFactory - .getInstance(KeyManagerFactory.getDefaultAlgorithm()); - char[] keyPassword = ssl.getKeyPassword() != null ? ssl.getKeyPassword().toCharArray() : null; - - if (keyPassword == null && ssl.getKeyStorePassword() != null) { - keyPassword = ssl.getKeyStorePassword().toCharArray(); - } - - keyManagerFactory.init(this.createKeyStore(), keyPassword); - - return keyManagerFactory; - } - - return null; - } - catch (Exception e) { - throw new IllegalStateException(e); - } - } - - protected KeyStore createKeyStore() { - HttpClientProperties.Ssl ssl = properties.getSsl(); - try { - KeyStore store = ssl.getKeyStoreProvider() != null - ? KeyStore.getInstance(ssl.getKeyStoreType(), ssl.getKeyStoreProvider()) - : KeyStore.getInstance(ssl.getKeyStoreType()); - try { - URL url = ResourceUtils.getURL(ssl.getKeyStore()); - store.load(url.openStream(), - ssl.getKeyStorePassword() != null ? ssl.getKeyStorePassword().toCharArray() : null); - } - catch (Exception e) { - throw new RuntimeException("Could not load key store ' " + ssl.getKeyStore() + "'", e); - } - - return store; - } - catch (KeyStoreException | NoSuchProviderException e) { - throw new RuntimeException("Could not load KeyStore for given type and provider", e); - } - } - - protected void setTrustManager(SslContextBuilder sslContextBuilder, X509Certificate... trustedX509Certificates) { - sslContextBuilder.trustManager(trustedX509Certificates); - } - - protected void setTrustManager(SslContextBuilder sslContextBuilder, TrustManagerFactory factory) { - sslContextBuilder.trustManager(factory); - } - protected ConnectionProvider buildConnectionProvider(HttpClientProperties properties) { HttpClientProperties.Pool pool = properties.getPool(); diff --git a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/HttpClientSslConfigurer.java b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/HttpClientSslConfigurer.java new file mode 100644 index 00000000..0938a891 --- /dev/null +++ b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/HttpClientSslConfigurer.java @@ -0,0 +1,76 @@ +/* + * Copyright 2013-2020 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.cloud.gateway.config; + +import java.security.cert.X509Certificate; + +import io.netty.handler.ssl.util.InsecureTrustManagerFactory; +import reactor.netty.http.Http11SslContextSpec; +import reactor.netty.http.Http2SslContextSpec; +import reactor.netty.http.client.HttpClient; +import reactor.netty.tcp.SslProvider; + +import org.springframework.boot.autoconfigure.web.ServerProperties; + +public class HttpClientSslConfigurer extends AbstractSslConfigurer { + + private final ServerProperties serverProperties; + + public HttpClientSslConfigurer(HttpClientProperties.Ssl sslProperties, ServerProperties serverProperties) { + super(sslProperties); + this.serverProperties = serverProperties; + } + + public HttpClient configureSsl(HttpClient client) { + final HttpClientProperties.Ssl ssl = getSslProperties(); + + if ((ssl.getKeyStore() != null && ssl.getKeyStore().length() > 0) + || getTrustedX509CertificatesForTrustManager().length > 0 || ssl.isUseInsecureTrustManager()) { + client = client.secure(sslContextSpec -> { + // configure ssl + configureSslContext(ssl, sslContextSpec); + }); + } + return client; + } + + protected void configureSslContext(HttpClientProperties.Ssl ssl, SslProvider.SslContextSpec sslContextSpec) { + SslProvider.ProtocolSslContextSpec clientSslContext = (serverProperties.getHttp2().isEnabled()) + ? Http2SslContextSpec.forClient() : Http11SslContextSpec.forClient(); + clientSslContext.configure(sslContextBuilder -> { + X509Certificate[] trustedX509Certificates = getTrustedX509CertificatesForTrustManager(); + if (trustedX509Certificates.length > 0) { + setTrustManager(sslContextBuilder, trustedX509Certificates); + } + else if (ssl.isUseInsecureTrustManager()) { + setTrustManager(sslContextBuilder, InsecureTrustManagerFactory.INSTANCE); + } + + try { + sslContextBuilder.keyManager(getKeyManagerFactory()); + } + catch (Exception e) { + logger.error(e); + } + }); + + sslContextSpec.sslContext(clientSslContext).handshakeTimeout(ssl.getHandshakeTimeout()) + .closeNotifyFlushTimeout(ssl.getCloseNotifyFlushTimeout()) + .closeNotifyReadTimeout(ssl.getCloseNotifyReadTimeout()); + } + +} diff --git a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/factory/JsonToGrpcGatewayFilterFactory.java b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/factory/JsonToGrpcGatewayFilterFactory.java index adec2f18..aed1911e 100644 --- a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/factory/JsonToGrpcGatewayFilterFactory.java +++ b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/factory/JsonToGrpcGatewayFilterFactory.java @@ -45,8 +45,7 @@ import io.grpc.Channel; import io.grpc.ClientCall; import io.grpc.ManagedChannel; import io.grpc.MethodDescriptor; -import io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts; -import io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder; +import io.grpc.netty.NettyChannelBuilder; import io.grpc.protobuf.ProtoUtils; import io.grpc.stub.ClientCalls; import io.netty.buffer.PooledByteBufAllocator; @@ -54,7 +53,7 @@ import org.reactivestreams.Publisher; import reactor.core.publisher.Flux; import reactor.core.publisher.Mono; -import org.springframework.cloud.gateway.config.GRPCSSLContext; +import org.springframework.cloud.gateway.config.GrpcSslConfigurer; import org.springframework.cloud.gateway.filter.GatewayFilter; import org.springframework.cloud.gateway.filter.GatewayFilterChain; import org.springframework.cloud.gateway.filter.NettyWriteResponseFilter; @@ -70,7 +69,6 @@ import org.springframework.http.codec.json.Jackson2JsonDecoder; import org.springframework.http.server.reactive.ServerHttpResponseDecorator; import org.springframework.web.server.ServerWebExchange; -import static io.grpc.netty.shaded.io.grpc.netty.NegotiationType.TLS; import static org.springframework.cloud.gateway.support.GatewayToStringStyler.filterToStringCreator; /** @@ -85,13 +83,13 @@ import static org.springframework.cloud.gateway.support.GatewayToStringStyler.fi public class JsonToGrpcGatewayFilterFactory extends AbstractGatewayFilterFactory { - private final GRPCSSLContext sslContext; + private final GrpcSslConfigurer grpcSslConfigurer; private final ResourceLoader resourceLoader; - public JsonToGrpcGatewayFilterFactory(GRPCSSLContext sslContext, ResourceLoader resourceLoader) { + public JsonToGrpcGatewayFilterFactory(GrpcSslConfigurer grpcSslConfigurer, ResourceLoader resourceLoader) { super(Config.class); - this.sslContext = sslContext; + this.grpcSslConfigurer = grpcSslConfigurer; this.resourceLoader = resourceLoader; } @@ -298,11 +296,11 @@ public class JsonToGrpcGatewayFilterFactory }; } + // We are creating this on every call, should optimize? private ManagedChannel createChannelChannel(String host, int port) { + NettyChannelBuilder nettyChannelBuilder = NettyChannelBuilder.forAddress(host, port); try { - return NettyChannelBuilder.forAddress(host, port).useTransportSecurity() - .sslContext(GrpcSslContexts.forClient().trustManager(sslContext.getTrustManager()).build()) - .negotiationType(TLS).build(); + return grpcSslConfigurer.configureSsl(nettyChannelBuilder); } catch (SSLException e) { throw new RuntimeException(e); diff --git a/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/actuate/GatewayControllerEndpointTests.java b/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/actuate/GatewayControllerEndpointTests.java index 27f21421..0a1094b9 100644 --- a/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/actuate/GatewayControllerEndpointTests.java +++ b/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/actuate/GatewayControllerEndpointTests.java @@ -163,6 +163,37 @@ public class GatewayControllerEndpointTests { .expectStatus().isCreated(); } + @Test + public void testPostValidShortcutRouteDefinition() { + RouteDefinition testRouteDefinition = new RouteDefinition(); + testRouteDefinition.setId( + "gatewaywithgrpcfiltertest-0-104014-8916263311295787431172436062-test-gateway-tls-client-mapping-0"); + testRouteDefinition.setUri(URI.create("https://localhost:8095")); + testRouteDefinition.setOrder(0); + testRouteDefinition.setMetadata(Collections.emptyMap()); + + FilterDefinition longFilterDefinition = new FilterDefinition(); + FilterDefinition stripPrefix = new FilterDefinition(); + stripPrefix.setName("StripPrefix"); + stripPrefix.addArg("_genkey_0", "1"); + + longFilterDefinition.setName("JsonToGrpc"); + longFilterDefinition.addArg("_genkey_0", "file:src/main/proto/hello.pb"); + longFilterDefinition.addArg("_genkey_1", "file:src/main/proto/hello.proto"); + longFilterDefinition.addArg("_genkey_2", "HelloService"); + longFilterDefinition.addArg("_genkey_3", "hello"); + testRouteDefinition.setFilters(Collections.singletonList(longFilterDefinition)); + + PredicateDefinition hostRoutePredicateDefinition = new PredicateDefinition(); + hostRoutePredicateDefinition.setName("Path"); + hostRoutePredicateDefinition.addArg("_genkey_0", "/json/hello"); + testRouteDefinition.setPredicates(Arrays.asList(hostRoutePredicateDefinition)); + + testClient.post().uri("http://localhost:" + port + "/actuator/gateway/routes/test-route") + .accept(MediaType.APPLICATION_JSON).body(BodyInserters.fromValue(testRouteDefinition)).exchange() + .expectStatus().isCreated(); + } + @Test public void testPostRouteWithNotExistingFilter() { diff --git a/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/config/GatewayAutoConfigurationTests.java b/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/config/GatewayAutoConfigurationTests.java index 6c46143c..32a3a5df 100644 --- a/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/config/GatewayAutoConfigurationTests.java +++ b/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/config/GatewayAutoConfigurationTests.java @@ -18,9 +18,12 @@ package org.springframework.cloud.gateway.config; import java.lang.reflect.InvocationTargetException; import java.lang.reflect.Method; +import java.security.KeyStore; +import java.security.cert.X509Certificate; import java.util.List; import java.util.concurrent.atomic.AtomicBoolean; +import javax.net.ssl.KeyManagerFactory; import javax.net.ssl.TrustManagerFactory; import io.netty.channel.ChannelOption; @@ -51,6 +54,7 @@ import org.springframework.boot.context.properties.EnableConfigurationProperties import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner; import org.springframework.cloud.gateway.actuate.GatewayControllerEndpoint; import org.springframework.cloud.gateway.actuate.GatewayLegacyControllerEndpoint; +import org.springframework.cloud.gateway.config.GatewayAutoConfigurationTests.CustomHttpClientFactory.CustomSslConfigurer; import org.springframework.cloud.gateway.filter.factory.TokenRelayGatewayFilterFactory; import org.springframework.cloud.gateway.filter.headers.GRPCRequestHeadersFilter; import org.springframework.cloud.gateway.filter.headers.GRPCResponseHeadersFilter; @@ -96,7 +100,7 @@ public class GatewayAutoConfigurationTests { assertThat(factory.connectionProvider.maxConnections()).isEqualTo(Integer.MAX_VALUE); // elastic assertThat(factory.proxyProvider).isNull(); - assertThat(factory.sslConfigured).isFalse(); + assertThat(factory.isSslConfigured()).isFalse(); assertThat(httpClient.configuration().isAcceptGzip()).isFalse(); assertThat(httpClient.configuration().loggingHandler()).isNull(); @@ -147,8 +151,8 @@ public class GatewayAutoConfigurationTests { assertThat(factory.proxyProvider).isNotNull(); assertThat(factory.proxyProvider.build().getAddress().get().getHostName()).isEqualTo("myhost"); - assertThat(factory.sslConfigured).isTrue(); - assertThat(factory.insecureTrustManagerSet).isTrue(); + assertThat(factory.isSslConfigured()).isTrue(); + assertThat(factory.isInsecureTrustManagerSet()).isTrue(); assertThat(context).hasSingleBean(ReactorNettyRequestUpgradeStrategy.class); ReactorNettyRequestUpgradeStrategy upgradeStrategy = context @@ -163,6 +167,28 @@ public class GatewayAutoConfigurationTests { }); } + @Test + @Deprecated + public void nettyHttpClientNoSslConfigurerIsBackwardsCompatible() { + new ReactiveWebApplicationContextRunner() + .withConfiguration(AutoConfigurations.of(WebFluxAutoConfiguration.class, MetricsAutoConfiguration.class, + SimpleMetricsExportAutoConfiguration.class, GatewayAutoConfiguration.class, + NoSslConfigurerCustomHttpClientFactoryConfig.class)) + .withPropertyValues("spring.cloud.gateway.httpclient.ssl.use-insecure-trust-manager=true") + .run(context -> { + assertThat(context).hasSingleBean(HttpClient.class); + NoSslConfigurerHttpClientFactory factory = context.getBean(NoSslConfigurerHttpClientFactory.class); + + assertThat(factory.configureSslCalled).isTrue(); + assertThat(factory.configureSslContextCalled).isTrue(); + assertThat(factory.getTrustedX509CertificatesForTrustManagerCalled).isTrue(); + assertThat(factory.getKeyManagerFactoryCalled).isTrue(); + assertThat(factory.createKeyStoreCalled).isFalse(); + assertThat(factory.setTrustManagerCertCalled).isFalse(); + assertThat(factory.setTrustManagerFactoryCalled).isTrue(); + }); + } + @Test public void verboseActuatorEnabledByDefault() { try (ConfigurableApplicationContext ctx = SpringApplication.run(Config.class, "--spring.jmx.enabled=false", @@ -285,7 +311,7 @@ public class GatewayAutoConfigurationTests { .withPropertyValues("server.http2.enabled=true").run(context -> { assertThat(context).hasSingleBean(HttpClient.class); CustomHttpClientFactory factory = context.getBean(CustomHttpClientFactory.class); - assertThat(factory.insecureTrustManagerSet).isFalse(); + assertThat(factory.isInsecureTrustManagerSet()).isFalse(); }); } @@ -310,25 +336,47 @@ public class GatewayAutoConfigurationTests { @Bean @Primary CustomHttpClientFactory customHttpClientFactory(HttpClientProperties properties, + ServerProperties serverProperties, List customizers, + HttpClientSslConfigurer sslConfigurer) { + return new CustomHttpClientFactory(properties, serverProperties, sslConfigurer, customizers); + } + + @Bean + @Primary + CustomSslConfigurer customSslContextFactory(ServerProperties serverProperties, + HttpClientProperties httpClientProperties) { + return new CustomSslConfigurer(httpClientProperties.getSsl(), serverProperties); + } + + } + + @Configuration + @EnableConfigurationProperties(ServerProperties.class) + @AutoConfigureBefore(GatewayAutoConfiguration.class) + @Deprecated + protected static class NoSslConfigurerCustomHttpClientFactoryConfig { + + @Bean + @Primary + NoSslConfigurerHttpClientFactory noSslConfigurerHttpClientFactory(HttpClientProperties properties, ServerProperties serverProperties, List customizers) { - return new CustomHttpClientFactory(properties, serverProperties, customizers); + return new NoSslConfigurerHttpClientFactory(properties, serverProperties, customizers); } } protected static class CustomHttpClientFactory extends HttpClientFactory { - boolean insecureTrustManagerSet; - - boolean sslConfigured; - private ConnectionProvider connectionProvider; private ProxyProvider.Builder proxyProvider; + private CustomSslConfigurer customSslContextFactory; + public CustomHttpClientFactory(HttpClientProperties properties, ServerProperties serverProperties, - List customizers) { - super(properties, serverProperties, customizers); + HttpClientSslConfigurer sslConfigurer, List customizers) { + super(properties, serverProperties, sslConfigurer, customizers); + this.customSslContextFactory = (CustomSslConfigurer) sslConfigurer; } @Override @@ -344,15 +392,106 @@ public class GatewayAutoConfigurationTests { return proxyProvider; } + public boolean isSslConfigured() { + return customSslContextFactory.sslConfigured; + } + + public boolean isInsecureTrustManagerSet() { + return customSslContextFactory.insecureTrustManagerSet; + } + + protected static class CustomSslConfigurer extends HttpClientSslConfigurer { + + boolean sslConfigured; + + boolean insecureTrustManagerSet; + + protected CustomSslConfigurer(HttpClientProperties.Ssl sslProperties, ServerProperties serverProperties) { + super(sslProperties, serverProperties); + } + + @Override + protected void configureSslContext(HttpClientProperties.Ssl ssl, + SslProvider.SslContextSpec sslContextSpec) { + sslConfigured = true; + super.configureSslContext(getSslProperties(), sslContextSpec); + } + + @Override + protected void setTrustManager(SslContextBuilder sslContextBuilder, TrustManagerFactory factory) { + insecureTrustManagerSet = factory == InsecureTrustManagerFactory.INSTANCE; + super.setTrustManager(sslContextBuilder, factory); + } + + } + + } + + /* + * Class to test backwards compatibility if no `SslConfigurer` used. + */ + @Deprecated + protected static class NoSslConfigurerHttpClientFactory extends HttpClientFactory { + + boolean configureSslCalled; + + boolean configureSslContextCalled; + + boolean getTrustedX509CertificatesForTrustManagerCalled; + + boolean getKeyManagerFactoryCalled; + + boolean createKeyStoreCalled; + + boolean setTrustManagerCertCalled; + + boolean setTrustManagerFactoryCalled; + + public NoSslConfigurerHttpClientFactory(HttpClientProperties properties, ServerProperties serverProperties, + List customizers) { + super(properties, serverProperties, customizers); + } + + @Override + protected HttpClient configureSsl(HttpClient httpClient) { + configureSslCalled = true; + return super.configureSsl(httpClient); + } + @Override protected void configureSslContext(HttpClientProperties.Ssl ssl, SslProvider.SslContextSpec sslContextSpec) { - sslConfigured = true; + configureSslContextCalled = true; super.configureSslContext(ssl, sslContextSpec); } + @Override + protected X509Certificate[] getTrustedX509CertificatesForTrustManager() { + getTrustedX509CertificatesForTrustManagerCalled = true; + return super.getTrustedX509CertificatesForTrustManager(); + } + + @Override + protected KeyManagerFactory getKeyManagerFactory() { + getKeyManagerFactoryCalled = true; + return super.getKeyManagerFactory(); + } + + @Override + protected KeyStore createKeyStore() { + createKeyStoreCalled = true; + return super.createKeyStore(); + } + + @Override + protected void setTrustManager(SslContextBuilder sslContextBuilder, + X509Certificate... trustedX509Certificates) { + setTrustManagerCertCalled = true; + super.setTrustManager(sslContextBuilder, trustedX509Certificates); + } + @Override protected void setTrustManager(SslContextBuilder sslContextBuilder, TrustManagerFactory factory) { - insecureTrustManagerSet = factory == InsecureTrustManagerFactory.INSTANCE; + setTrustManagerFactoryCalled = true; super.setTrustManager(sslContextBuilder, factory); }