Skip to content

Commit 699664f

Browse files
spencergibbspencergibb
authored
Merge pull request #872 from spring-cloud/rebinder
Creates TextEncryptorBindHandler for Binder decryption. It is registered in TextEncryptorConfigBootstrapper for later use in other ConfigData implementations. Creates DecryptEnvironmentPostProcessor. This is used if bootstrap and legacy processing are not enabled. EnvironmentDecryptApplicationInitializer is only is if bootstrap and legacy processing are enabled. Fixes gh-815 @spencergibb
2 parents 1c2f8c0 + f77a6ec commit 699664f

File tree

12 files changed

+634
-173
lines changed

12 files changed

+634
-173
lines changed

‎spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/TextEncryptorBindHandler.java‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
/*
2+
* Copyright 2013-2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.cloud.bootstrap;
18+
19+
import org.apache.commons.logging.Log;
20+
import org.apache.commons.logging.LogFactory;
21+
22+
import org.springframework.boot.context.properties.bind.AbstractBindHandler;
23+
import org.springframework.boot.context.properties.bind.BindContext;
24+
import org.springframework.boot.context.properties.bind.Bindable;
25+
import org.springframework.boot.context.properties.source.ConfigurationPropertyName;
26+
import org.springframework.cloud.bootstrap.encrypt.KeyProperties;
27+
import org.springframework.security.crypto.encrypt.TextEncryptor;
28+
29+
/**
30+
* BindHandler that uses a TextEncryptor to decrypt text if properly prefixed with
31+
* {cipher}.
32+
*
33+
* @author Marcin Grzejszczak
34+
* @since 3.0.0
35+
*/
36+
class TextEncryptorBindHandler extends AbstractBindHandler {
37+
38+
private static final Log logger = LogFactory.getLog(TextEncryptorBindHandler.class);
39+
40+
/**
41+
* Prefix indicating an encrypted value.
42+
*/
43+
protected static final String ENCRYPTED_PROPERTY_PREFIX = "{cipher}";
44+
45+
private final TextEncryptor textEncryptor;
46+
47+
private final KeyProperties keyProperties;
48+
49+
TextEncryptorBindHandler(TextEncryptor textEncryptor, KeyProperties keyProperties) {
50+
this.textEncryptor = textEncryptor;
51+
this.keyProperties = keyProperties;
52+
}
53+
54+
@Override
55+
public Object onSuccess(ConfigurationPropertyName name, Bindable<?> target, BindContext context, Object result) {
56+
if (result instanceof String && ((String) result).startsWith(ENCRYPTED_PROPERTY_PREFIX)) {
57+
return decrypt(name.toString(), (String) result);
58+
}
59+
return result;
60+
}
61+
62+
private String decrypt(String key, String original) {
63+
String value = original.substring(ENCRYPTED_PROPERTY_PREFIX.length());
64+
try {
65+
value = this.textEncryptor.decrypt(value);
66+
if (logger.isDebugEnabled()) {
67+
logger.debug("Decrypted: key=" + key);
68+
}
69+
return value;
70+
}
71+
catch (Exception e) {
72+
String message = "Cannot decrypt: key=" + key;
73+
if (logger.isDebugEnabled()) {
74+
logger.warn(message, e);
75+
}
76+
else {
77+
logger.warn(message);
78+
}
79+
if (this.keyProperties.isFailOnError()) {
80+
throw new IllegalStateException(message, e);
81+
}
82+
return "";
83+
}
84+
}
85+
86+
}

‎spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/TextEncryptorConfigBootstrapper.java‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
/*
2+
* Copyright 2012-2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.cloud.bootstrap;
18+
19+
import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
20+
import org.springframework.boot.BootstrapContext;
21+
import org.springframework.boot.BootstrapRegistry;
22+
import org.springframework.boot.Bootstrapper;
23+
import org.springframework.boot.context.properties.bind.BindHandler;
24+
import org.springframework.boot.context.properties.bind.Binder;
25+
import org.springframework.cloud.bootstrap.encrypt.KeyProperties;
26+
import org.springframework.cloud.bootstrap.encrypt.RsaProperties;
27+
import org.springframework.cloud.context.encrypt.EncryptorFactory;
28+
import org.springframework.core.env.Environment;
29+
import org.springframework.security.crypto.encrypt.TextEncryptor;
30+
import org.springframework.security.rsa.crypto.KeyStoreKeyFactory;
31+
import org.springframework.security.rsa.crypto.RsaSecretEncryptor;
32+
import org.springframework.util.ClassUtils;
33+
import org.springframework.util.StringUtils;
34+
35+
/**
36+
* Bootstrapper.
37+
*
38+
* @author Marcin Grzejszczak
39+
* @since 3.0.0
40+
*/
41+
public class TextEncryptorConfigBootstrapper implements Bootstrapper {
42+
43+
private static final boolean RSA_IS_PRESENT = ClassUtils
44+
.isPresent("org.springframework.security.rsa.crypto.RsaSecretEncryptor", null);
45+
46+
@Override
47+
public void intitialize(BootstrapRegistry registry) {
48+
if (!ClassUtils.isPresent("org.springframework.security.crypto.encrypt.TextEncryptor", null)) {
49+
return;
50+
}
51+
52+
registry.registerIfAbsent(KeyProperties.class, context -> context.get(Binder.class)
53+
.bind(KeyProperties.PREFIX, KeyProperties.class).orElseGet(KeyProperties::new));
54+
if (RSA_IS_PRESENT) {
55+
registry.registerIfAbsent(RsaProperties.class, context -> context.get(Binder.class)
56+
.bind(RsaProperties.PREFIX, RsaProperties.class).orElseGet(RsaProperties::new));
57+
}
58+
registry.registerIfAbsent(TextEncryptor.class, context -> {
59+
KeyProperties keyProperties = context.get(KeyProperties.class);
60+
if (keysConfigured(keyProperties)) {
61+
if (RSA_IS_PRESENT) {
62+
RsaProperties rsaProperties = context.get(RsaProperties.class);
63+
return rsaTextEncryptor(keyProperties, rsaProperties);
64+
}
65+
return new EncryptorFactory(keyProperties.getSalt()).create(keyProperties.getKey());
66+
}
67+
// no keys configured
68+
return new FailsafeTextEncryptor();
69+
});
70+
registry.registerIfAbsent(BindHandler.class, context -> {
71+
TextEncryptor textEncryptor = context.get(TextEncryptor.class);
72+
if (textEncryptor != null) {
73+
KeyProperties keyProperties = context.get(KeyProperties.class);
74+
return new TextEncryptorBindHandler(textEncryptor, keyProperties);
75+
}
76+
return null;
77+
});
78+
79+
// promote beans to context
80+
registry.addCloseListener(event -> {
81+
if (isLegacyBootstrap(event.getApplicationContext().getEnvironment())) {
82+
return;
83+
}
84+
BootstrapContext bootstrapContext = event.getBootstrapContext();
85+
KeyProperties keyProperties = bootstrapContext.get(KeyProperties.class);
86+
ConfigurableListableBeanFactory beanFactory = event.getApplicationContext().getBeanFactory();
87+
if (keyProperties != null) {
88+
beanFactory.registerSingleton("keyProperties", keyProperties);
89+
}
90+
if (RSA_IS_PRESENT) {
91+
RsaProperties rsaProperties = bootstrapContext.get(RsaProperties.class);
92+
if (rsaProperties != null) {
93+
beanFactory.registerSingleton("rsaProperties", rsaProperties);
94+
}
95+
}
96+
TextEncryptor textEncryptor = bootstrapContext.get(TextEncryptor.class);
97+
if (textEncryptor != null) {
98+
beanFactory.registerSingleton("textEncryptor", textEncryptor);
99+
}
100+
});
101+
}
102+
103+
public static TextEncryptor rsaTextEncryptor(KeyProperties keyProperties, RsaProperties rsaProperties) {
104+
KeyProperties.KeyStore keyStore = keyProperties.getKeyStore();
105+
if (keyStore.getLocation() != null) {
106+
if (keyStore.getLocation().exists()) {
107+
return new RsaSecretEncryptor(
108+
new KeyStoreKeyFactory(keyStore.getLocation(), keyStore.getPassword().toCharArray())
109+
.getKeyPair(keyStore.getAlias(), keyStore.getSecret().toCharArray()),
110+
rsaProperties.getAlgorithm(), rsaProperties.getSalt(), rsaProperties.isStrong());
111+
}
112+
113+
throw new IllegalStateException("Invalid keystore location");
114+
}
115+
116+
return new EncryptorFactory(keyProperties.getSalt()).create(keyProperties.getKey());
117+
}
118+
119+
public static boolean keysConfigured(KeyProperties properties) {
120+
if (hasProperty(properties.getKeyStore().getLocation())) {
121+
if (hasProperty(properties.getKeyStore().getPassword())) {
122+
return true;
123+
}
124+
return false;
125+
}
126+
else if (hasProperty(properties.getKey())) {
127+
return true;
128+
}
129+
return false;
130+
}
131+
132+
static boolean hasProperty(Object value) {
133+
if (value instanceof String) {
134+
return StringUtils.hasText((String) value);
135+
}
136+
return value != null;
137+
}
138+
139+
static boolean isLegacyBootstrap(Environment environment) {
140+
boolean isLegacy = environment.getProperty("spring.config.use-legacy-processing", Boolean.class, false);
141+
boolean isBootstrapEnabled = environment.getProperty("spring.cloud.bootstrap.enabled", Boolean.class, false);
142+
return isLegacy || isBootstrapEnabled;
143+
}
144+
145+
/**
146+
* TextEncryptor that just fails, so that users don't get a false sense of security
147+
* adding ciphers to config files and not getting them decrypted.
148+
*
149+
* @author Dave Syer
150+
*
151+
*/
152+
public static class FailsafeTextEncryptor implements TextEncryptor {
153+
154+
@Override
155+
public String encrypt(String text) {
156+
throw new UnsupportedOperationException(
157+
"No encryption for FailsafeTextEncryptor. Did you configure the keystore correctly?");
158+
}
159+
160+
@Override
161+
public String decrypt(String encryptedText) {
162+
throw new UnsupportedOperationException(
163+
"No decryption for FailsafeTextEncryptor. Did you configure the keystore correctly?");
164+
}
165+
166+
}
167+
168+
}

0 commit comments

Comments
 (0)