Merge pull request #24076 from topikachu

* pr/24076: Polish "Add configuration for Rabbit's key store and trust store algorithm" Add configuration for Rabbit's key store and trust store algorithm Closes gh-24076
spring-projects · Dec 15, 2020 · eb14f06 · eb14f06
2 parents 315067b + 5991033
commit eb14f06
Show file tree

Hide file tree

Showing 3 changed files with 71 additions and 0 deletions.
diff --git a/...re/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfiguration.java b/...re/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfiguration.java
@@ -140,9 +140,11 @@ private RabbitConnectionFactoryBean getRabbitConnectionFactoryBean(RabbitPropert
 				map.from(ssl::getKeyStoreType).to(factory::setKeyStoreType);
 				map.from(ssl::getKeyStore).to(factory::setKeyStore);
 				map.from(ssl::getKeyStorePassword).to(factory::setKeyStorePassphrase);
+				map.from(ssl::getKeyStoreAlgorithm).whenNonNull().to(factory::setKeyStoreAlgorithm);
 				map.from(ssl::getTrustStoreType).to(factory::setTrustStoreType);
 				map.from(ssl::getTrustStore).to(factory::setTrustStore);
 				map.from(ssl::getTrustStorePassword).to(factory::setTrustStorePassphrase);
+				map.from(ssl::getTrustStoreAlgorithm).whenNonNull().to(factory::setTrustStoreAlgorithm);
 				map.from(ssl::isValidateServerCertificate)
 						.to((validate) -> factory.setSkipServerCertificateValidation(!validate));
 				map.from(ssl::getVerifyHostname).to(factory::setEnableHostnameVerification);

diff --git a/...configure/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitProperties.java b/...configure/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitProperties.java
@@ -363,6 +363,8 @@ public Template getTemplate() {
 
 	public class Ssl {
 
+		private static final String SUN_X509 = "SunX509";
+
 		/**
 		 * Whether to enable SSL support. Determined automatically if an address is
 		 * provided with the protocol (amqp:// vs. amqps://).
@@ -384,6 +386,11 @@ public class Ssl {
 		 */
 		private String keyStorePassword;
 
+		/**
+		 * Key store algorithm.
+		 */
+		private String keyStoreAlgorithm = SUN_X509;
+
 		/**
 		 * Trust store that holds SSL certificates.
 		 */
@@ -399,6 +406,11 @@ public class Ssl {
 		 */
 		private String trustStorePassword;
 
+		/**
+		 * Trust store algorithm.
+		 */
+		private String trustStoreAlgorithm = SUN_X509;
+
 		/**
 		 * SSL algorithm to use. By default, configured by the Rabbit client library.
 		 */
@@ -462,6 +474,14 @@ public void setKeyStorePassword(String keyStorePassword) {
 			this.keyStorePassword = keyStorePassword;
 		}
 
+		public String getKeyStoreAlgorithm() {
+			return this.keyStoreAlgorithm;
+		}
+
+		public void setKeyStoreAlgorithm(String keyStoreAlgorithm) {
+			this.keyStoreAlgorithm = keyStoreAlgorithm;
+		}
+
 		public String getTrustStore() {
 			return this.trustStore;
 		}
@@ -486,6 +506,14 @@ public void setTrustStorePassword(String trustStorePassword) {
 			this.trustStorePassword = trustStorePassword;
 		}
 
+		public String getTrustStoreAlgorithm() {
+			return this.trustStoreAlgorithm;
+		}
+
+		public void setTrustStoreAlgorithm(String trustStoreAlgorithm) {
+			this.trustStoreAlgorithm = trustStoreAlgorithm;
+		}
+
 		public String getAlgorithm() {
 			return this.algorithm;
 		}

diff --git a/...c/test/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfigurationTests.java b/...c/test/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfigurationTests.java
@@ -738,6 +738,47 @@ void enableSslWithValidateServerCertificateDefault() throws Exception {
 				});
 	}
 
+	@Test
+	void enableSslWithValidStoreAlgorithmShouldWork() {
+		this.contextRunner.withUserConfiguration(TestConfiguration.class)
+				.withPropertyValues("spring.rabbitmq.ssl.enabled:true",
+						"spring.rabbitmq.ssl.keyStore=/org/springframework/boot/autoconfigure/amqp/test.jks",
+						"spring.rabbitmq.ssl.keyStoreType=jks", "spring.rabbitmq.ssl.keyStorePassword=secret",
+						"spring.rabbitmq.ssl.keyStoreAlgorithm=PKIX",
+						"spring.rabbitmq.ssl.trustStore=/org/springframework/boot/autoconfigure/amqp/test.jks",
+						"spring.rabbitmq.ssl.trustStoreType=jks", "spring.rabbitmq.ssl.trustStorePassword=secret",
+						"spring.rabbitmq.ssl.trustStoreAlgorithm=PKIX")
+				.run((context) -> assertThat(context).hasNotFailed());
+	}
+
+	@Test
+	void enableSslWithInvalidKeyStoreAlgorithmShouldFail() {
+		this.contextRunner.withUserConfiguration(TestConfiguration.class)
+				.withPropertyValues("spring.rabbitmq.ssl.enabled:true",
+						"spring.rabbitmq.ssl.keyStore=/org/springframework/boot/autoconfigure/amqp/test.jks",
+						"spring.rabbitmq.ssl.keyStoreType=jks", "spring.rabbitmq.ssl.keyStorePassword=secret",
+						"spring.rabbitmq.ssl.keyStoreAlgorithm=test-invalid-algo")
+				.run((context) -> {
+					assertThat(context).hasFailed();
+					assertThat(context).getFailure().hasMessageContaining("test-invalid-algo");
+					assertThat(context).getFailure().hasRootCauseInstanceOf(NoSuchAlgorithmException.class);
+				});
+	}
+
+	@Test
+	void enableSslWithInvalidTrustStoreAlgorithmShouldFail() {
+		this.contextRunner.withUserConfiguration(TestConfiguration.class)
+				.withPropertyValues("spring.rabbitmq.ssl.enabled:true",
+						"spring.rabbitmq.ssl.trustStore=/org/springframework/boot/autoconfigure/amqp/test.jks",
+						"spring.rabbitmq.ssl.trustStoreType=jks", "spring.rabbitmq.ssl.trustStorePassword=secret",
+						"spring.rabbitmq.ssl.trustStoreAlgorithm=test-invalid-algo")
+				.run((context) -> {
+					assertThat(context).hasFailed();
+					assertThat(context).getFailure().hasMessageContaining("test-invalid-algo");
+					assertThat(context).getFailure().hasRootCauseInstanceOf(NoSuchAlgorithmException.class);
+				});
+	}
+
 	@Test
 	void whenACredentialsProviderIsAvailableThenConnectionFactoryIsConfiguredToUseIt() throws Exception {
 		this.contextRunner.withUserConfiguration(CredentialsProviderConfiguration.class)