Skip to content

Commit 7584d0a

Browse files
spencergibbspencergibb
committed
Migrates general decryption to DecryptEnvironmentPostProcessor
This is only used if legacy bootstrap is not being used. This works for both @ConfigurationProperties and calls to Environment. TextEncryptorBindHandler is only used in ConfigData Bootstrapper. Existing EnvironmentDecryptApplicationInitializer is only used if legacy bootstrap is used. Some code could be put in an abstract class that EnvironmentDecryptApplicationInitializer and DecryptEnvironmentPostProcessor could share.
1 parent 77d93c4 commit 7584d0a

12 files changed

+421
-365
lines changed

‎spring-cloud-context/src/main/java/org/springframework/cloud/autoconfigure/EncryptionBootstrapAutoConfiguration.java‎

Lines changed: 0 additions & 151 deletions
This file was deleted.

‎spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/TextEncryptorBindHandler.java‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
/*
2+
* Copyright 2013-2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.cloud.bootstrap;
18+
19+
import org.apache.commons.logging.Log;
20+
import org.apache.commons.logging.LogFactory;
21+
22+
import org.springframework.boot.context.properties.bind.AbstractBindHandler;
23+
import org.springframework.boot.context.properties.bind.BindContext;
24+
import org.springframework.boot.context.properties.bind.Bindable;
25+
import org.springframework.boot.context.properties.source.ConfigurationPropertyName;
26+
import org.springframework.cloud.bootstrap.encrypt.KeyProperties;
27+
import org.springframework.security.crypto.encrypt.TextEncryptor;
28+
29+
/**
30+
* BindHandler that uses a TextEncryptor to decrypt text if properly prefixed with
31+
* {cipher}.
32+
*
33+
* @author Marcin Grzejszczak
34+
* @since 3.0.0
35+
*/
36+
class TextEncryptorBindHandler extends AbstractBindHandler {
37+
38+
private static final Log logger = LogFactory.getLog(TextEncryptorBindHandler.class);
39+
40+
/**
41+
* Prefix indicating an encrypted value.
42+
*/
43+
protected static final String ENCRYPTED_PROPERTY_PREFIX = "{cipher}";
44+
45+
private final TextEncryptor textEncryptor;
46+
47+
private final KeyProperties keyProperties;
48+
49+
TextEncryptorBindHandler(TextEncryptor textEncryptor, KeyProperties keyProperties) {
50+
this.textEncryptor = textEncryptor;
51+
this.keyProperties = keyProperties;
52+
}
53+
54+
@Override
55+
public Object onSuccess(ConfigurationPropertyName name, Bindable<?> target, BindContext context, Object result) {
56+
if (result instanceof String && ((String) result).startsWith(ENCRYPTED_PROPERTY_PREFIX)) {
57+
return decrypt(name.toString(), (String) result);
58+
}
59+
return result;
60+
}
61+
62+
private String decrypt(String key, String original) {
63+
String value = original.substring(ENCRYPTED_PROPERTY_PREFIX.length());
64+
try {
65+
value = this.textEncryptor.decrypt(value);
66+
if (logger.isDebugEnabled()) {
67+
logger.debug("Decrypted: key=" + key);
68+
}
69+
return value;
70+
}
71+
catch (Exception e) {
72+
String message = "Cannot decrypt: key=" + key;
73+
if (logger.isDebugEnabled()) {
74+
logger.warn(message, e);
75+
}
76+
else {
77+
logger.warn(message);
78+
}
79+
if (this.keyProperties.isFailOnError()) {
80+
throw new IllegalStateException(message, e);
81+
}
82+
return "";
83+
}
84+
}
85+
86+
}

‎spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/TextEncryptorConfigBootstrapper.java‎

Lines changed: 37 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@
2222
import org.springframework.boot.Bootstrapper;
2323
import org.springframework.boot.context.properties.bind.BindHandler;
2424
import org.springframework.boot.context.properties.bind.Binder;
25-
import org.springframework.cloud.autoconfigure.EncryptionBootstrapAutoConfiguration;
26-
import org.springframework.cloud.bootstrap.TextEncryptorConfigurationPropertiesBindHandlerAdvisor.TextEncryptorBindHandler;
2725
import org.springframework.cloud.bootstrap.encrypt.KeyProperties;
2826
import org.springframework.cloud.bootstrap.encrypt.RsaProperties;
2927
import org.springframework.cloud.context.encrypt.EncryptorFactory;
3028
import org.springframework.core.env.Environment;
3129
import org.springframework.security.crypto.encrypt.TextEncryptor;
30+
import org.springframework.security.rsa.crypto.KeyStoreKeyFactory;
31+
import org.springframework.security.rsa.crypto.RsaSecretEncryptor;
3232
import org.springframework.util.ClassUtils;
3333
import org.springframework.util.StringUtils;
3434

@@ -40,22 +40,27 @@
4040
*/
4141
public class TextEncryptorConfigBootstrapper implements Bootstrapper {
4242

43+
private static final boolean RSA_IS_PRESENT = ClassUtils
44+
.isPresent("org.springframework.security.rsa.crypto.RsaSecretEncryptor", null);
45+
4346
@Override
4447
public void intitialize(BootstrapRegistry registry) {
4548
if (!ClassUtils.isPresent("org.springframework.security.crypto.encrypt.TextEncryptor", null)) {
4649
return;
4750
}
4851

4952
registry.registerIfAbsent(KeyProperties.class, context -> context.get(Binder.class)
50-
.bind("encrypt", KeyProperties.class).orElseGet(KeyProperties::new));
51-
registry.registerIfAbsent(RsaProperties.class, context -> context.get(Binder.class)
52-
.bind("encrypt.rsa", RsaProperties.class).orElseGet(RsaProperties::new));
53+
.bind(KeyProperties.PREFIX, KeyProperties.class).orElseGet(KeyProperties::new));
54+
if (RSA_IS_PRESENT) {
55+
registry.registerIfAbsent(RsaProperties.class, context -> context.get(Binder.class)
56+
.bind(RsaProperties.PREFIX, RsaProperties.class).orElseGet(RsaProperties::new));
57+
}
5358
registry.registerIfAbsent(TextEncryptor.class, context -> {
5459
KeyProperties keyProperties = context.get(KeyProperties.class);
5560
if (keysConfigured(keyProperties)) {
56-
if (ClassUtils.isPresent("org.springframework.security.rsa.crypto.RsaSecretEncryptor", null)) {
61+
if (RSA_IS_PRESENT) {
5762
RsaProperties rsaProperties = context.get(RsaProperties.class);
58-
return EncryptionBootstrapAutoConfiguration.rsaTextEncryptor(keyProperties, rsaProperties);
63+
return rsaTextEncryptor(keyProperties, rsaProperties);
5964
}
6065
return new EncryptorFactory(keyProperties.getSalt()).create(keyProperties.getKey());
6166
}
@@ -82,9 +87,11 @@ public void intitialize(BootstrapRegistry registry) {
8287
if (keyProperties != null) {
8388
beanFactory.registerSingleton("keyProperties", keyProperties);
8489
}
85-
RsaProperties rsaProperties = bootstrapContext.get(RsaProperties.class);
86-
if (rsaProperties != null) {
87-
beanFactory.registerSingleton("rsaProperties", rsaProperties);
90+
if (RSA_IS_PRESENT) {
91+
RsaProperties rsaProperties = bootstrapContext.get(RsaProperties.class);
92+
if (rsaProperties != null) {
93+
beanFactory.registerSingleton("rsaProperties", rsaProperties);
94+
}
8895
}
8996
TextEncryptor textEncryptor = bootstrapContext.get(TextEncryptor.class);
9097
if (textEncryptor != null) {
@@ -93,7 +100,23 @@ public void intitialize(BootstrapRegistry registry) {
93100
});
94101
}
95102

96-
private boolean keysConfigured(KeyProperties properties) {
103+
public static TextEncryptor rsaTextEncryptor(KeyProperties keyProperties, RsaProperties rsaProperties) {
104+
KeyProperties.KeyStore keyStore = keyProperties.getKeyStore();
105+
if (keyStore.getLocation() != null) {
106+
if (keyStore.getLocation().exists()) {
107+
return new RsaSecretEncryptor(
108+
new KeyStoreKeyFactory(keyStore.getLocation(), keyStore.getPassword().toCharArray())
109+
.getKeyPair(keyStore.getAlias(), keyStore.getSecret().toCharArray()),
110+
rsaProperties.getAlgorithm(), rsaProperties.getSalt(), rsaProperties.isStrong());
111+
}
112+
113+
throw new IllegalStateException("Invalid keystore location");
114+
}
115+
116+
return new EncryptorFactory(keyProperties.getSalt()).create(keyProperties.getKey());
117+
}
118+
119+
public static boolean keysConfigured(KeyProperties properties) {
97120
if (hasProperty(properties.getKeyStore().getLocation())) {
98121
if (hasProperty(properties.getKeyStore().getPassword())) {
99122
return true;
@@ -106,14 +129,14 @@ else if (hasProperty(properties.getKey())) {
106129
return false;
107130
}
108131

109-
private boolean hasProperty(Object value) {
132+
static boolean hasProperty(Object value) {
110133
if (value instanceof String) {
111134
return StringUtils.hasText((String) value);
112135
}
113136
return value != null;
114137
}
115138

116-
private boolean isLegacyBootstrap(Environment environment) {
139+
static boolean isLegacyBootstrap(Environment environment) {
117140
boolean isLegacy = environment.getProperty("spring.config.use-legacy-processing", Boolean.class, false);
118141
boolean isBootstrapEnabled = environment.getProperty("spring.cloud.bootstrap.enabled", Boolean.class, false);
119142
return isLegacy || isBootstrapEnabled;
@@ -126,7 +149,7 @@ private boolean isLegacyBootstrap(Environment environment) {
126149
* @author Dave Syer
127150
*
128151
*/
129-
protected static class FailsafeTextEncryptor implements TextEncryptor {
152+
public static class FailsafeTextEncryptor implements TextEncryptor {
130153

131154
@Override
132155
public String encrypt(String text) {

0 commit comments

Comments
 (0)