Skip to content

Commit c488934

Browse files
wilkinsonawilkinsona
committed
Merge pull request #15709 from Raheela Aslam
* gh-15709: Polish "Always fail fast when SSL is enabled without a key store" Always fail fast when SSL is enabled without a key store
2 parents acf9e8a + a172e14 commit c488934

File tree

9 files changed

+143
-24
lines changed

9 files changed

+143
-24
lines changed

‎spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/jetty/SslServerCustomizer.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2018 the original author or authors.
2+
* Copyright 2012-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -190,9 +190,9 @@ private void configureSslKeyStore(SslContextFactory factory, Ssl ssl) {
190190
URL url = ResourceUtils.getURL(ssl.getKeyStore());
191191
factory.setKeyStoreResource(Resource.newResource(url));
192192
}
193-
catch (IOException ex) {
193+
catch (Exception ex) {
194194
throw new WebServerException(
195-
"Could not find key store '" + ssl.getKeyStore() + "'", ex);
195+
"Could not load key store '" + ssl.getKeyStore() + "'", ex);
196196
}
197197
if (ssl.getKeyStoreType() != null) {
198198
factory.setKeyStoreType(ssl.getKeyStoreType());

‎spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/netty/SslServerCustomizer.java

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2018 the original author or authors.
2+
* Copyright 2012-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -31,13 +31,15 @@
3131
import org.springframework.boot.web.server.Http2;
3232
import org.springframework.boot.web.server.Ssl;
3333
import org.springframework.boot.web.server.SslStoreProvider;
34+
import org.springframework.boot.web.server.WebServerException;
3435
import org.springframework.util.ResourceUtils;
3536

3637
/**
3738
* {@link NettyServerCustomizer} that configures SSL for the given Reactor Netty server
3839
* instance.
3940
*
4041
* @author Brian Clozel
42+
* @author Raheela Aslam
4143
*/
4244
public class SslServerCustomizer implements NettyServerCustomizer {
4345

@@ -135,21 +137,42 @@ private KeyStore getTrustStore(Ssl ssl, SslStoreProvider sslStoreProvider)
135137
if (sslStoreProvider != null) {
136138
return sslStoreProvider.getTrustStore();
137139
}
138-
return loadKeyStore(ssl.getTrustStoreType(), ssl.getTrustStoreProvider(),
140+
return loadTrustStore(ssl.getTrustStoreType(), ssl.getTrustStoreProvider(),
139141
ssl.getTrustStore(), ssl.getTrustStorePassword());
140142
}
141143

142144
private KeyStore loadKeyStore(String type, String provider, String resource,
143145
String password) throws Exception {
144-
type = (type != null) ? type : "JKS";
146+
147+
return loadStore(type, provider, resource, password);
148+
}
149+
150+
private KeyStore loadTrustStore(String type, String provider, String resource,
151+
String password) throws Exception {
145152
if (resource == null) {
146153
return null;
147154
}
155+
else {
156+
return loadStore(type, provider, resource, password);
157+
}
158+
}
159+
160+
private KeyStore loadStore(String type, String provider, String resource,
161+
String password) throws Exception {
162+
type = (type != null) ? type : "JKS";
148163
KeyStore store = (provider != null) ? KeyStore.getInstance(type, provider)
149164
: KeyStore.getInstance(type);
150-
URL url = ResourceUtils.getURL(resource);
151-
store.load(url.openStream(), (password != null) ? password.toCharArray() : null);
152-
return store;
165+
try {
166+
URL url = ResourceUtils.getURL(resource);
167+
store.load(url.openStream(),
168+
(password != null) ? password.toCharArray() : null);
169+
return store;
170+
}
171+
catch (Exception ex) {
172+
throw new WebServerException("Could not load key store '" + resource + "'",
173+
ex);
174+
}
175+
153176
}
154177

155178
}

‎spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/SslConnectorCustomizer.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2018 the original author or authors.
2+
* Copyright 2012-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -132,9 +132,9 @@ private void configureSslKeyStore(AbstractHttp11JsseProtocol<?> protocol, Ssl ss
132132
try {
133133
protocol.setKeystoreFile(ResourceUtils.getURL(ssl.getKeyStore()).toString());
134134
}
135-
catch (FileNotFoundException ex) {
136-
throw new WebServerException("Could not load key store: " + ex.getMessage(),
137-
ex);
135+
catch (Exception ex) {
136+
throw new WebServerException(
137+
"Could not load key store '" + ssl.getKeyStore() + "'", ex);
138138
}
139139
if (ssl.getKeyStoreType() != null) {
140140
protocol.setKeystoreType(ssl.getKeyStoreType());

‎spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/undertow/SslBuilderCustomizer.java

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2018 the original author or authors.
2+
* Copyright 2012-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -41,12 +41,14 @@
4141

4242
import org.springframework.boot.web.server.Ssl;
4343
import org.springframework.boot.web.server.SslStoreProvider;
44+
import org.springframework.boot.web.server.WebServerException;
4445
import org.springframework.util.ResourceUtils;
4546

4647
/**
4748
* {@link UndertowBuilderCustomizer} that configures SSL on the given builder instance.
4849
*
4950
* @author Brian Clozel
51+
* @author Raheela Aslam
5052
*/
5153
class SslBuilderCustomizer implements UndertowBuilderCustomizer {
5254

@@ -166,21 +168,40 @@ private KeyStore getTrustStore(Ssl ssl, SslStoreProvider sslStoreProvider)
166168
if (sslStoreProvider != null) {
167169
return sslStoreProvider.getTrustStore();
168170
}
169-
return loadKeyStore(ssl.getTrustStoreType(), ssl.getTrustStoreProvider(),
171+
return loadTrustStore(ssl.getTrustStoreType(), ssl.getTrustStoreProvider(),
170172
ssl.getTrustStore(), ssl.getTrustStorePassword());
171173
}
172174

173175
private KeyStore loadKeyStore(String type, String provider, String resource,
174176
String password) throws Exception {
175-
type = (type != null) ? type : "JKS";
177+
return loadStore(type, provider, resource, password);
178+
}
179+
180+
private KeyStore loadTrustStore(String type, String provider, String resource,
181+
String password) throws Exception {
176182
if (resource == null) {
177183
return null;
178184
}
185+
else {
186+
return loadStore(type, provider, resource, password);
187+
}
188+
}
189+
190+
private KeyStore loadStore(String type, String provider, String resource,
191+
String password) throws Exception {
192+
type = (type != null) ? type : "JKS";
179193
KeyStore store = (provider != null) ? KeyStore.getInstance(type, provider)
180194
: KeyStore.getInstance(type);
181-
URL url = ResourceUtils.getURL(resource);
182-
store.load(url.openStream(), (password != null) ? password.toCharArray() : null);
183-
return store;
195+
try {
196+
URL url = ResourceUtils.getURL(resource);
197+
store.load(url.openStream(),
198+
(password != null) ? password.toCharArray() : null);
199+
return store;
200+
}
201+
catch (Exception ex) {
202+
throw new WebServerException("Could not load key store '" + resource + "'",
203+
ex);
204+
}
184205
}
185206

186207
/**

‎spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/jetty/SslServerCustomizerTests.java

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2018 the original author or authors.
2+
* Copyright 2012-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -26,10 +26,12 @@
2626
import org.eclipse.jetty.server.HttpConnectionFactory;
2727
import org.eclipse.jetty.server.Server;
2828
import org.eclipse.jetty.server.SslConnectionFactory;
29+
import org.eclipse.jetty.util.ssl.SslContextFactory;
2930
import org.junit.Test;
3031

3132
import org.springframework.boot.web.server.Http2;
3233
import org.springframework.boot.web.server.Ssl;
34+
import org.springframework.boot.web.server.WebServerException;
3335

3436
import static org.assertj.core.api.Assertions.assertThat;
3537

@@ -78,6 +80,20 @@ public void alpnConnectionFactoryHasNullDefaultProtocolToAllowNegotiationToHttp1
7880
.isNull();
7981
}
8082

83+
@Test
84+
public void configureSslWhenSslIsEnabledWithNoKeyStoreThrowsWebServerException()
85+
throws Exception {
86+
Ssl ssl = new Ssl();
87+
SslServerCustomizer customizer = new SslServerCustomizer(null, ssl, null, null);
88+
try {
89+
customizer.configureSsl(new SslContextFactory(), ssl, null);
90+
}
91+
catch (Exception ex) {
92+
assertThat(ex).isInstanceOf(WebServerException.class);
93+
assertThat(ex).hasMessageContaining("Could not load key store 'null'");
94+
}
95+
}
96+
8197
private Server createCustomizedServer() {
8298
return createCustomizedServer(new Http2());
8399
}

‎spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/netty/SslServerCustomizerTests.java

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2018 the original author or authors.
2+
* Copyright 2012-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@
2121
import org.junit.Test;
2222

2323
import org.springframework.boot.web.server.Ssl;
24+
import org.springframework.boot.web.server.WebServerException;
2425

2526
import static org.assertj.core.api.Assertions.assertThat;
2627
import static org.junit.Assert.fail;
@@ -29,6 +30,7 @@
2930
* Tests for {@link SslServerCustomizer}.
3031
*
3132
* @author Andy Wilkinson
33+
* @author Raheela Aslam
3234
*/
3335
public class SslServerCustomizerTests {
3436

@@ -68,4 +70,20 @@ public void trustStoreProviderIsUsedWhenCreatingTrustStore() throws Exception {
6870
}
6971
}
7072

73+
@Test
74+
public void getKeyManagerFactoryWhenSslIsEnabledWithNoKeyStoreThrowsWebServerException()
75+
throws Exception {
76+
Ssl ssl = new Ssl();
77+
SslServerCustomizer customizer = new SslServerCustomizer(ssl, null, null);
78+
try {
79+
customizer.getKeyManagerFactory(ssl, null);
80+
fail();
81+
}
82+
catch (IllegalStateException ex) {
83+
Throwable cause = ex.getCause();
84+
assertThat(cause).isInstanceOf(WebServerException.class);
85+
assertThat(cause).hasMessageContaining("Could not load key store 'null'");
86+
}
87+
}
88+
7189
}

‎spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/SslConnectorCustomizerTests.java

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2018 the original author or authors.
2+
* Copyright 2012-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -37,11 +37,13 @@
3737
import org.springframework.boot.testsupport.rule.OutputCapture;
3838
import org.springframework.boot.web.server.Ssl;
3939
import org.springframework.boot.web.server.SslStoreProvider;
40+
import org.springframework.boot.web.server.WebServerException;
4041
import org.springframework.core.io.ClassPathResource;
4142
import org.springframework.core.io.Resource;
4243
import org.springframework.test.util.ReflectionTestUtils;
4344

4445
import static org.assertj.core.api.Assertions.assertThat;
46+
import static org.junit.Assert.fail;
4547
import static org.mockito.BDDMockito.given;
4648
import static org.mockito.Mockito.mock;
4749

@@ -189,6 +191,19 @@ public void customizeWhenSslStoreProviderPresentShouldIgnorePasswordFromSsl()
189191
assertThat(this.output.toString()).doesNotContain("Password verification failed");
190192
}
191193

194+
@Test
195+
public void customizeWhenSslIsEnabledWithNoKeyStoreThrowsWebServerException() {
196+
try {
197+
new SslConnectorCustomizer(new Ssl(), null)
198+
.customize(this.tomcat.getConnector());
199+
fail();
200+
}
201+
catch (Exception ex) {
202+
assertThat(ex).isInstanceOf(WebServerException.class);
203+
assertThat(ex).hasMessageContaining("Could not load key store 'null'");
204+
}
205+
}
206+
192207
private KeyStore loadStore() throws KeyStoreException, IOException,
193208
NoSuchAlgorithmException, CertificateException {
194209
KeyStore keyStore = KeyStore.getInstance("JKS");

‎spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/undertow/SslBuilderCustomizerTests.java

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2018 the original author or authors.
2+
* Copyright 2012-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -24,6 +24,7 @@
2424
import org.junit.Test;
2525

2626
import org.springframework.boot.web.server.Ssl;
27+
import org.springframework.boot.web.server.WebServerException;
2728
import org.springframework.test.util.ReflectionTestUtils;
2829

2930
import static org.assertj.core.api.Assertions.assertThat;
@@ -33,6 +34,7 @@
3334
* Tests for {@link SslBuilderCustomizer}
3435
*
3536
* @author Brian Clozel
37+
* @author Raheela Aslam
3638
*/
3739
public class SslBuilderCustomizerTests {
3840

@@ -88,4 +90,21 @@ public void trustStoreProviderIsUsedWhenCreatingTrustStore() throws Exception {
8890
}
8991
}
9092

93+
@Test
94+
public void getKeyManagersWhenSslIsEnabledWithNoKeyStoreThrowsWebServerException()
95+
throws Exception {
96+
Ssl ssl = new Ssl();
97+
SslBuilderCustomizer customizer = new SslBuilderCustomizer(8080,
98+
InetAddress.getLocalHost(), ssl, null);
99+
try {
100+
ReflectionTestUtils.invokeMethod(customizer, "getKeyManagers", ssl, null);
101+
fail();
102+
}
103+
catch (IllegalStateException ex) {
104+
Throwable cause = ex.getCause();
105+
assertThat(cause).isInstanceOf(WebServerException.class);
106+
assertThat(cause).hasMessageContaining("Could not load key store 'null'");
107+
}
108+
}
109+
91110
}

‎spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/reactive/server/AbstractReactiveWebServerFactoryTests.java

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2018 the original author or authors.
2+
* Copyright 2012-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -62,6 +62,7 @@
6262
import org.springframework.web.reactive.function.client.WebClient;
6363

6464
import static org.assertj.core.api.Assertions.assertThat;
65+
import static org.assertj.core.api.Assertions.assertThatThrownBy;
6566

6667
/**
6768
* Base for testing classes that extends {@link AbstractReactiveWebServerFactory}.
@@ -291,6 +292,12 @@ public void noCompressionForUserAgent() {
291292
assertResponseIsNotCompressed(response);
292293
}
293294

295+
@Test
296+
public void whenSslIsEnabledAndNoKeyStoreIsConfiguredThenServerFailsToStart() {
297+
assertThatThrownBy(() -> testBasicSslWithKeyStore(null, null))
298+
.hasMessageContaining("Could not load key store 'null'");
299+
}
300+
294301
protected WebClient prepareCompressionTest() {
295302
Compression compression = new Compression();
296303
compression.setEnabled(true);

0 commit comments

Comments
 (0)