Polish "Honour SSL key alias when using Netty"

See gh-19197
pull/19202/head
Andy Wilkinson 5 years ago
parent eda7b7c3e6
commit effdc8f359

@ -55,6 +55,7 @@ import org.springframework.util.ResourceUtils;
* *
* @author Brian Clozel * @author Brian Clozel
* @author Raheela Aslam * @author Raheela Aslam
* @author Chris Bono
* @since 2.0.0 * @since 2.0.0
*/ */
public class SslServerCustomizer implements NettyServerCustomizer { public class SslServerCustomizer implements NettyServerCustomizer {
@ -185,9 +186,9 @@ public class SslServerCustomizer implements NettyServerCustomizer {
* {@link ConfigurableAliasKeyManager}. The actual SPI has to be wrapped as well due * {@link ConfigurableAliasKeyManager}. The actual SPI has to be wrapped as well due
* to the fact that {@link KeyManagerFactory#getKeyManagers()} is final. * to the fact that {@link KeyManagerFactory#getKeyManagers()} is final.
*/ */
private static class ConfigurableAliasKeyManagerFactory extends KeyManagerFactory { private static final class ConfigurableAliasKeyManagerFactory extends KeyManagerFactory {
static final ConfigurableAliasKeyManagerFactory instance(String alias, String algorithm) private static ConfigurableAliasKeyManagerFactory instance(String alias, String algorithm)
throws NoSuchAlgorithmException { throws NoSuchAlgorithmException {
KeyManagerFactory originalFactory = KeyManagerFactory.getInstance(algorithm); KeyManagerFactory originalFactory = KeyManagerFactory.getInstance(algorithm);
ConfigurableAliasKeyManagerFactorySpi spi = new ConfigurableAliasKeyManagerFactorySpi(originalFactory, ConfigurableAliasKeyManagerFactorySpi spi = new ConfigurableAliasKeyManagerFactorySpi(originalFactory,
@ -195,20 +196,20 @@ public class SslServerCustomizer implements NettyServerCustomizer {
return new ConfigurableAliasKeyManagerFactory(spi, originalFactory.getProvider(), algorithm); return new ConfigurableAliasKeyManagerFactory(spi, originalFactory.getProvider(), algorithm);
} }
ConfigurableAliasKeyManagerFactory(ConfigurableAliasKeyManagerFactorySpi spi, Provider provider, private ConfigurableAliasKeyManagerFactory(ConfigurableAliasKeyManagerFactorySpi spi, Provider provider,
String algorithm) { String algorithm) {
super(spi, provider, algorithm); super(spi, provider, algorithm);
} }
} }
private static class ConfigurableAliasKeyManagerFactorySpi extends KeyManagerFactorySpi { private static final class ConfigurableAliasKeyManagerFactorySpi extends KeyManagerFactorySpi {
private KeyManagerFactory originalFactory; private KeyManagerFactory originalFactory;
private String alias; private String alias;
ConfigurableAliasKeyManagerFactorySpi(KeyManagerFactory originalFactory, String alias) { private ConfigurableAliasKeyManagerFactorySpi(KeyManagerFactory originalFactory, String alias) {
this.originalFactory = originalFactory; this.originalFactory = originalFactory;
this.alias = alias; this.alias = alias;
} }
@ -238,13 +239,13 @@ public class SslServerCustomizer implements NettyServerCustomizer {
} }
private static class ConfigurableAliasKeyManager extends X509ExtendedKeyManager { private static final class ConfigurableAliasKeyManager extends X509ExtendedKeyManager {
private final X509ExtendedKeyManager keyManager; private final X509ExtendedKeyManager keyManager;
private final String alias; private final String alias;
ConfigurableAliasKeyManager(X509ExtendedKeyManager keyManager, String alias) { private ConfigurableAliasKeyManager(X509ExtendedKeyManager keyManager, String alias) {
this.keyManager = keyManager; this.keyManager = keyManager;
this.alias = alias; this.alias = alias;
} }

@ -47,6 +47,7 @@ import static org.mockito.Mockito.mock;
* Tests for {@link NettyReactiveWebServerFactory}. * Tests for {@link NettyReactiveWebServerFactory}.
* *
* @author Brian Clozel * @author Brian Clozel
* @author Chris Bono
*/ */
public class NettyReactiveWebServerFactoryTests extends AbstractReactiveWebServerFactoryTests { public class NettyReactiveWebServerFactoryTests extends AbstractReactiveWebServerFactoryTests {
@ -94,14 +95,14 @@ public class NettyReactiveWebServerFactoryTests extends AbstractReactiveWebServe
} }
@Test @Test
public void testSslWithValidAlias() { public void whenSslIsConfiguredWithAValidAliasARequestSucceeds() {
Mono<String> result = testSslWithAlias("test-alias"); Mono<String> result = testSslWithAlias("test-alias");
StepVerifier.setDefaultTimeout(Duration.ofSeconds(30)); StepVerifier.setDefaultTimeout(Duration.ofSeconds(30));
StepVerifier.create(result).expectNext("Hello World").verifyComplete(); StepVerifier.create(result).expectNext("Hello World").verifyComplete();
} }
@Test @Test
public void testSslWithInvalidAlias() { public void whenSslIsConfiguredWithAnInvalidAliasTheSslHandshakeFails() {
Mono<String> result = testSslWithAlias("test-alias-bad"); Mono<String> result = testSslWithAlias("test-alias-bad");
StepVerifier.setDefaultTimeout(Duration.ofSeconds(30)); StepVerifier.setDefaultTimeout(Duration.ofSeconds(30));
StepVerifier.create(result).expectErrorMatches((throwable) -> throwable instanceof SSLHandshakeException StepVerifier.create(result).expectErrorMatches((throwable) -> throwable instanceof SSLHandshakeException

Loading…
Cancel
Save