Skip to content

Commit 5abca14

Browse files
mbhavephilwebb
mbhave
authored and
philwebb
committed
Skip SSL validation when calling Cloud Foundry
Update CloudFoundrySecurityService so that SSL validation is not required. We're unlikely to have configured public keys for the REST endpoints we need to call. Since the endpoints are provided via environment variables we can implicitly trust them. See spring-projectsgh-7108
1 parent 862a06e commit 5abca14

File tree

4 files changed

+188
-9
lines changed

4 files changed

+188
-9
lines changed

‎spring-boot-actuator/src/main/java/org/springframework/boot/actuate/cloudfoundry/CloudFoundrySecurityService.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ class CloudFoundrySecurityService {
4949
String cloudControllerUrl) {
5050
Assert.notNull(restTemplateBuilder, "RestTemplateBuilder must not be null");
5151
Assert.notNull(cloudControllerUrl, "CloudControllerUrl must not be null");
52-
this.restTemplate = restTemplateBuilder.build();
52+
this.restTemplate = restTemplateBuilder
53+
.requestFactory(SkipSslVerificationHttpRequestFactory.class).build();
5354
this.cloudControllerUrl = cloudControllerUrl;
5455
}
5556

‎spring-boot-actuator/src/main/java/org/springframework/boot/actuate/cloudfoundry/SkipSslVerificationHttpRequestFactory.java

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
/*
2+
* Copyright 2012-2016 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.boot.actuate.cloudfoundry;
18+
19+
import java.io.IOException;
20+
import java.net.HttpURLConnection;
21+
import java.security.SecureRandom;
22+
import java.security.cert.X509Certificate;
23+
24+
import javax.net.ssl.HostnameVerifier;
25+
import javax.net.ssl.HttpsURLConnection;
26+
import javax.net.ssl.SSLContext;
27+
import javax.net.ssl.SSLSession;
28+
import javax.net.ssl.SSLSocketFactory;
29+
import javax.net.ssl.TrustManager;
30+
import javax.net.ssl.X509TrustManager;
31+
32+
import org.springframework.http.client.SimpleClientHttpRequestFactory;
33+
34+
/**
35+
* {@link SimpleClientHttpRequestFactory} that skips SSL certificate verification.
36+
*
37+
* @author Madhura Bhave
38+
*/
39+
class SkipSslVerificationHttpRequestFactory extends SimpleClientHttpRequestFactory {
40+
41+
@Override
42+
protected void prepareConnection(HttpURLConnection connection, String httpMethod)
43+
throws IOException {
44+
if (connection instanceof HttpsURLConnection) {
45+
prepareHttpsConnection((HttpsURLConnection) connection);
46+
}
47+
super.prepareConnection(connection, httpMethod);
48+
}
49+
50+
private void prepareHttpsConnection(HttpsURLConnection connection) {
51+
connection.setHostnameVerifier(new SkipHostnameVerifier());
52+
try {
53+
connection.setSSLSocketFactory(createSslSocketFactory());
54+
}
55+
catch (Exception ex) {
56+
// Ignore
57+
}
58+
}
59+
60+
private SSLSocketFactory createSslSocketFactory() throws Exception {
61+
SSLContext context = SSLContext.getInstance("TLS");
62+
context.init(null, new TrustManager[] { new SkipX509TrustManager() },
63+
new SecureRandom());
64+
return context.getSocketFactory();
65+
}
66+
67+
private class SkipHostnameVerifier implements HostnameVerifier {
68+
69+
@Override
70+
public boolean verify(String s, SSLSession sslSession) {
71+
return true;
72+
}
73+
74+
}
75+
76+
private static class SkipX509TrustManager implements X509TrustManager {
77+
78+
@Override
79+
public X509Certificate[] getAcceptedIssuers() {
80+
return new X509Certificate[0];
81+
}
82+
83+
@Override
84+
public void checkClientTrusted(X509Certificate[] chain, String authType) {
85+
}
86+
87+
@Override
88+
public void checkServerTrusted(X509Certificate[] chain, String authType) {
89+
}
90+
91+
}
92+
93+
}

‎spring-boot-actuator/src/test/java/org/springframework/boot/actuate/cloudfoundry/SkipSslVerificationHttpRequestFactoryTests.java

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
/*
2+
* Copyright 2012-2016 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.boot.actuate.cloudfoundry;
18+
19+
import javax.net.ssl.SSLHandshakeException;
20+
21+
import org.junit.Rule;
22+
import org.junit.Test;
23+
import org.junit.rules.ExpectedException;
24+
25+
import org.springframework.boot.context.embedded.EmbeddedServletContainer;
26+
import org.springframework.boot.context.embedded.ExampleServlet;
27+
import org.springframework.boot.context.embedded.Ssl;
28+
import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory;
29+
import org.springframework.boot.web.servlet.ServletRegistrationBean;
30+
import org.springframework.http.HttpStatus;
31+
import org.springframework.http.ResponseEntity;
32+
import org.springframework.web.client.ResourceAccessException;
33+
import org.springframework.web.client.RestTemplate;
34+
35+
import static org.assertj.core.api.Assertions.assertThat;
36+
import static org.hamcrest.Matchers.instanceOf;
37+
38+
/**
39+
* Test for {@link SkipSslVerificationHttpRequestFactory}.
40+
*/
41+
public class SkipSslVerificationHttpRequestFactoryTests {
42+
43+
@Rule
44+
public ExpectedException thrown = ExpectedException.none();
45+
46+
@Test
47+
public void restCallToSelfSignedServershouldNotThrowSslException() throws Exception {
48+
String httpsUrl = getHttpsUrl();
49+
SkipSslVerificationHttpRequestFactory requestFactory = new SkipSslVerificationHttpRequestFactory();
50+
RestTemplate restTemplate = new RestTemplate(requestFactory);
51+
ResponseEntity<String> responseEntity = restTemplate.getForEntity(httpsUrl,
52+
String.class);
53+
assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
54+
this.thrown.expect(ResourceAccessException.class);
55+
this.thrown.expectCause(instanceOf(SSLHandshakeException.class));
56+
RestTemplate otherRestTemplate = new RestTemplate();
57+
otherRestTemplate.getForEntity(httpsUrl, String.class);
58+
}
59+
60+
private String getHttpsUrl() {
61+
TomcatEmbeddedServletContainerFactory factory = new TomcatEmbeddedServletContainerFactory(
62+
0);
63+
factory.setSsl(getSsl("password", "classpath:test.jks"));
64+
EmbeddedServletContainer container = factory.getEmbeddedServletContainer(
65+
new ServletRegistrationBean(new ExampleServlet(), "/hello"));
66+
container.start();
67+
return "https://localhost:" + container.getPort() + "/hello";
68+
}
69+
70+
private Ssl getSsl(String keyPassword, String keyStore) {
71+
Ssl ssl = new Ssl();
72+
ssl.setEnabled(true);
73+
ssl.setKeyPassword(keyPassword);
74+
ssl.setKeyStore(keyStore);
75+
ssl.setKeyStorePassword("secret");
76+
return ssl;
77+
}
78+
79+
}

‎spring-boot-actuator/src/test/java/org/springframework/boot/actuate/cloudfoundry/TokenTests.java

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
import org.springframework.util.Base64Utils;
2525

2626
import static org.assertj.core.api.Assertions.assertThat;
27-
import static org.springframework.boot.actuate.cloudfoundry.AuthorizationExceptionMatcher.withReason;
2827

2928
/**
3029
* Tests for {@link Token}.
@@ -38,15 +37,17 @@ public class TokenTests {
3837

3938
@Test
4039
public void invalidJwtShouldThrowException() throws Exception {
41-
this.thrown.expect(withReason(Reason.INVALID_TOKEN));
40+
this.thrown
41+
.expect(AuthorizationExceptionMatcher.withReason(Reason.INVALID_TOKEN));
4242
new Token("invalid-token");
4343
}
4444

4545
@Test
4646
public void invalidJwtClaimsShouldThrowException() throws Exception {
4747
String header = "{\"alg\": \"RS256\", \"kid\": \"key-id\", \"typ\": \"JWT\"}";
4848
String claims = "invalid-claims";
49-
this.thrown.expect(withReason(Reason.INVALID_TOKEN));
49+
this.thrown
50+
.expect(AuthorizationExceptionMatcher.withReason(Reason.INVALID_TOKEN));
5051
new Token(Base64Utils.encodeToString(header.getBytes()) + "."
5152
+ Base64Utils.encodeToString(claims.getBytes()));
5253
}
@@ -55,7 +56,8 @@ public void invalidJwtClaimsShouldThrowException() throws Exception {
5556
public void invalidJwtHeaderShouldThrowException() throws Exception {
5657
String header = "invalid-header";
5758
String claims = "{\"exp\": 2147483647, \"iss\": \"http://localhost:8080/uaa/oauth/token\"}";
58-
this.thrown.expect(withReason(Reason.INVALID_TOKEN));
59+
this.thrown
60+
.expect(AuthorizationExceptionMatcher.withReason(Reason.INVALID_TOKEN));
5961
new Token(Base64Utils.encodeToString(header.getBytes()) + "."
6062
+ Base64Utils.encodeToString(claims.getBytes()));
6163
}
@@ -64,7 +66,8 @@ public void invalidJwtHeaderShouldThrowException() throws Exception {
6466
public void emptyJwtSignatureShouldThrowException() throws Exception {
6567
String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ0b3B0YWwu"
6668
+ "Y29tIiwiZXhwIjoxNDI2NDIwODAwLCJhd2Vzb21lIjp0cnVlfQ.";
67-
this.thrown.expect(withReason(Reason.INVALID_TOKEN));
69+
this.thrown
70+
.expect(AuthorizationExceptionMatcher.withReason(Reason.INVALID_TOKEN));
6871
new Token(token);
6972
}
7073

@@ -90,7 +93,8 @@ public void getSignatureAlgorithmWhenAlgIsNullShouldThrowException()
9093
String header = "{\"kid\": \"key-id\", \"typ\": \"JWT\"}";
9194
String claims = "{\"exp\": 2147483647, \"iss\": \"http://localhost:8080/uaa/oauth/token\"}";
9295
Token token = createToken(header, claims);
93-
this.thrown.expect(withReason(Reason.INVALID_TOKEN));
96+
this.thrown
97+
.expect(AuthorizationExceptionMatcher.withReason(Reason.INVALID_TOKEN));
9498
token.getSignatureAlgorithm();
9599
}
96100

@@ -99,7 +103,8 @@ public void getIssuerWhenIssIsNullShouldThrowException() throws Exception {
99103
String header = "{\"alg\": \"RS256\", \"kid\": \"key-id\", \"typ\": \"JWT\"}";
100104
String claims = "{\"exp\": 2147483647}";
101105
Token token = createToken(header, claims);
102-
this.thrown.expect(withReason(Reason.INVALID_TOKEN));
106+
this.thrown
107+
.expect(AuthorizationExceptionMatcher.withReason(Reason.INVALID_TOKEN));
103108
token.getIssuer();
104109
}
105110

@@ -108,7 +113,8 @@ public void getExpiryWhenExpIsNullShouldThrowException() throws Exception {
108113
String header = "{\"alg\": \"RS256\", \"kid\": \"key-id\", \"typ\": \"JWT\"}";
109114
String claims = "{\"iss\": \"http://localhost:8080/uaa/oauth/token\"" + "}";
110115
Token token = createToken(header, claims);
111-
this.thrown.expect(withReason(Reason.INVALID_TOKEN));
116+
this.thrown
117+
.expect(AuthorizationExceptionMatcher.withReason(Reason.INVALID_TOKEN));
112118
token.getExpiry();
113119
}
114120

0 commit comments

Comments
 (0)