From 6b09379f6b53602e3ecf58b90f15cf1080da246c Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Tue, 16 Mar 2021 10:40:14 +0100 Subject: [PATCH] Polishing. Make SslConfiguration.enabledProtocols and enabledCipherSuites non-null. Update since tags. Add author tags. Update documentation. See gh-635 Original pull request: gh-640. --- .../client/ClientHttpConnectorFactory.java | 13 ++-- .../ClientHttpRequestFactoryFactory.java | 23 +++---- .../config/EnvironmentVaultConfiguration.java | 41 +++++-------- .../vault/support/SslConfiguration.java | 61 +++++++++++++++---- ...tHttpConnectorFactoryIntegrationTests.java | 12 ++-- ...RequestFactoryFactoryIntegrationTests.java | 6 +- ...nvironmentVaultConfigurationUnitTests.java | 10 +-- .../support/SslConfigurationUnitTests.java | 23 ++++--- .../reference/imperative-template.adoc | 2 + 9 files changed, 110 insertions(+), 81 deletions(-) diff --git a/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpConnectorFactory.java b/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpConnectorFactory.java index e407fa5b..f77869f2 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpConnectorFactory.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpConnectorFactory.java @@ -32,9 +32,7 @@ import org.springframework.util.ClassUtils; import org.springframework.vault.support.ClientOptions; import org.springframework.vault.support.SslConfiguration; -import static org.springframework.vault.client.ClientHttpRequestFactoryFactory.createKeyManagerFactory; -import static org.springframework.vault.client.ClientHttpRequestFactoryFactory.createTrustManagerFactory; -import static org.springframework.vault.client.ClientHttpRequestFactoryFactory.hasSslConfiguration; +import static org.springframework.vault.client.ClientHttpRequestFactoryFactory.*; /** * Factory for {@link ClientHttpConnector} that supports @@ -44,6 +42,7 @@ import static org.springframework.vault.client.ClientHttpRequestFactoryFactory.h * dependencies. * * @author Mark Paluch + * @author Ryan Gow * @since 2.2 */ public class ClientHttpConnectorFactory { @@ -106,11 +105,11 @@ public class ClientHttpConnectorFactory { sslConfiguration.getKeyConfiguration())); } - if (sslConfiguration.getEnabledProtocols() != null) { + if (!sslConfiguration.getEnabledProtocols().isEmpty()) { sslContextBuilder.protocols(sslConfiguration.getEnabledProtocols()); } - if (sslConfiguration.getEnabledCipherSuites() != null) { + if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) { sslContextBuilder.ciphers(sslConfiguration.getEnabledCipherSuites()); } } @@ -197,12 +196,12 @@ public class ClientHttpConnectorFactory { sslContextFactory.setKeyManagerPassword(new String(keyConfiguration.getKeyPassword())); } - if (sslConfiguration.getEnabledProtocols() != null) { + if (!sslConfiguration.getEnabledProtocols().isEmpty()) { sslContextFactory .setIncludeProtocols(sslConfiguration.getEnabledProtocols().toArray(new String[0])); } - if (sslConfiguration.getEnabledCipherSuites() != null) { + if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) { sslContextFactory .setIncludeCipherSuites(sslConfiguration.getEnabledCipherSuites().toArray(new String[0])); } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpRequestFactoryFactory.java b/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpRequestFactoryFactory.java index 2abe6fe6..8b03c6db 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpRequestFactoryFactory.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpRequestFactoryFactory.java @@ -43,6 +43,10 @@ import javax.net.ssl.TrustManagerFactory; import javax.net.ssl.X509ExtendedKeyManager; import javax.net.ssl.X509TrustManager; +import io.netty.handler.ssl.SslContextBuilder; +import io.netty.handler.ssl.SslProvider; +import okhttp3.ConnectionSpec; +import okhttp3.OkHttpClient.Builder; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.apache.http.client.config.RequestConfig; @@ -52,6 +56,7 @@ import org.apache.http.impl.client.HttpClients; import org.apache.http.impl.client.LaxRedirectStrategy; import org.apache.http.impl.conn.DefaultSchemePortResolver; import org.apache.http.impl.conn.SystemDefaultRoutePlanner; + import org.springframework.http.client.ClientHttpRequestFactory; import org.springframework.http.client.HttpComponentsClientHttpRequestFactory; import org.springframework.http.client.Netty4ClientHttpRequestFactory; @@ -68,17 +73,13 @@ import org.springframework.vault.support.SslConfiguration; import org.springframework.vault.support.SslConfiguration.KeyConfiguration; import org.springframework.vault.support.SslConfiguration.KeyStoreConfiguration; -import io.netty.handler.ssl.SslContextBuilder; -import io.netty.handler.ssl.SslProvider; -import okhttp3.ConnectionSpec; -import okhttp3.OkHttpClient.Builder; - /** * Factory for {@link ClientHttpRequestFactory} that supports Apache HTTP Components, * OkHttp, Netty and the JDK HTTP client (in that order). This factory configures a * {@link ClientHttpRequestFactory} depending on the available dependencies. * * @author Mark Paluch + * @author Ryan Gow * @since 2.2 */ public class ClientHttpRequestFactoryFactory { @@ -301,13 +302,13 @@ public class ClientHttpRequestFactoryFactory { String[] enabledProtocols = null; - if (sslConfiguration.getEnabledProtocols() != null) { + if (!sslConfiguration.getEnabledProtocols().isEmpty()) { enabledProtocols = sslConfiguration.getEnabledProtocols().toArray(new String[0]); } String[] enabledCipherSuites = null; - if (sslConfiguration.getEnabledCipherSuites() != null) { + if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) { enabledCipherSuites = sslConfiguration.getEnabledCipherSuites().toArray(new String[0]); } @@ -362,11 +363,11 @@ public class ClientHttpRequestFactoryFactory { ConnectionSpec.Builder sslConnectionSpecBuilder = new ConnectionSpec.Builder(sslConnectionSpec); - if (sslConfiguration.getEnabledProtocols() != null) { + if (!sslConfiguration.getEnabledProtocols().isEmpty()) { sslConnectionSpecBuilder.tlsVersions(sslConfiguration.getEnabledProtocols().toArray(new String[0])); } - if (sslConfiguration.getEnabledCipherSuites() != null) { + if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) { sslConnectionSpecBuilder .cipherSuites(sslConfiguration.getEnabledCipherSuites().toArray(new String[0])); } @@ -413,11 +414,11 @@ public class ClientHttpRequestFactoryFactory { sslConfiguration.getKeyConfiguration())); } - if (sslConfiguration.getEnabledProtocols() != null) { + if (!sslConfiguration.getEnabledProtocols().isEmpty()) { sslContextBuilder.protocols(sslConfiguration.getEnabledProtocols()); } - if (sslConfiguration.getEnabledCipherSuites() != null) { + if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) { sslContextBuilder.ciphers(sslConfiguration.getEnabledCipherSuites()); } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java index 67eccdec..f0ef1c24 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java @@ -17,10 +17,13 @@ package org.springframework.vault.config; import java.net.URI; import java.util.Arrays; +import java.util.Collections; import java.util.List; +import java.util.stream.Collectors; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; + import org.springframework.beans.BeansException; import org.springframework.context.ApplicationContext; import org.springframework.context.ApplicationContextAware; @@ -29,35 +32,15 @@ import org.springframework.core.io.Resource; import org.springframework.lang.Nullable; import org.springframework.util.Assert; import org.springframework.util.StringUtils; -import org.springframework.vault.authentication.AppIdAuthentication; -import org.springframework.vault.authentication.AppIdAuthenticationOptions; +import org.springframework.vault.authentication.*; import org.springframework.vault.authentication.AppIdAuthenticationOptions.AppIdAuthenticationOptionsBuilder; -import org.springframework.vault.authentication.AppIdUserIdMechanism; -import org.springframework.vault.authentication.AppRoleAuthentication; -import org.springframework.vault.authentication.AppRoleAuthenticationOptions; import org.springframework.vault.authentication.AppRoleAuthenticationOptions.AppRoleAuthenticationOptionsBuilder; import org.springframework.vault.authentication.AppRoleAuthenticationOptions.RoleId; import org.springframework.vault.authentication.AppRoleAuthenticationOptions.SecretId; -import org.springframework.vault.authentication.AwsEc2Authentication; -import org.springframework.vault.authentication.AwsEc2AuthenticationOptions; import org.springframework.vault.authentication.AwsEc2AuthenticationOptions.AwsEc2AuthenticationOptionsBuilder; -import org.springframework.vault.authentication.AzureMsiAuthentication; -import org.springframework.vault.authentication.AzureMsiAuthenticationOptions; import org.springframework.vault.authentication.AzureMsiAuthenticationOptions.AzureMsiAuthenticationOptionsBuilder; -import org.springframework.vault.authentication.ClientAuthentication; -import org.springframework.vault.authentication.ClientCertificateAuthentication; -import org.springframework.vault.authentication.CubbyholeAuthentication; -import org.springframework.vault.authentication.CubbyholeAuthenticationOptions; import org.springframework.vault.authentication.CubbyholeAuthenticationOptions.CubbyholeAuthenticationOptionsBuilder; -import org.springframework.vault.authentication.IpAddressUserId; -import org.springframework.vault.authentication.KubernetesAuthentication; -import org.springframework.vault.authentication.KubernetesAuthenticationOptions; import org.springframework.vault.authentication.KubernetesAuthenticationOptions.KubernetesAuthenticationOptionsBuilder; -import org.springframework.vault.authentication.KubernetesJwtSupplier; -import org.springframework.vault.authentication.KubernetesServiceAccountTokenFile; -import org.springframework.vault.authentication.MacAddressUserId; -import org.springframework.vault.authentication.StaticUserId; -import org.springframework.vault.authentication.TokenAuthentication; import org.springframework.vault.client.VaultEndpoint; import org.springframework.vault.support.SslConfiguration; import org.springframework.vault.support.SslConfiguration.KeyStoreConfiguration; @@ -105,6 +88,10 @@ import org.springframework.web.client.RestOperations; *
  • Truststore resource: {@code vault.ssl.trust-store} (optional)
    • *
  • Truststore password: {@code vault.ssl.trust-store-password} (optional)
    • *
  • Truststore type: {@code vault.ssl.trust-store-password} (since 2.3, optional)
    • + *
  • Enabled SSL/TLS protocols: {@code vault.ssl.enabled-protocols} (since 2.3.2, + * optional, protocols separated with comma)
    • + *
  • Enabled SSL/TLS cipher suites: {@code vault.ssl.enabled-cipher-suites} (since + * 2.3.2, optional, cipher suites separated with comma)
    • * * *
  • Authentication method: {@code vault.authentication} (defaults to {@literal TOKEN}, @@ -174,6 +161,7 @@ import org.springframework.web.client.RestOperations; * @author Michal Budzyn * @author Raoof Mohammed * @author Justin Bertrand + * @author Ryan Gow * @see org.springframework.core.env.Environment * @see org.springframework.core.env.PropertySource * @see VaultEndpoint @@ -232,9 +220,9 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration im KeyStoreConfiguration trustStoreConfiguration = getKeyStoreConfiguration("vault.ssl.trust-store", "vault.ssl.trust-store-password", "vault.ssl.trust-store-type"); - List enabledProtocols = getList("vault.ssl.enabled-protocols"); + List enabledProtocols = getPropertyAsList("vault.ssl.enabled-protocols"); - List enabledCipherSuites = getList("vault.ssl.enabled-cipher-suites"); + List enabledCipherSuites = getPropertyAsList("vault.ssl.enabled-cipher-suites"); return new SslConfiguration(keyStoreConfiguration, trustStoreConfiguration, enabledProtocols, enabledCipherSuites); @@ -427,14 +415,15 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration im return new KubernetesAuthentication(builder.build(), restOperations()); } - private List getList(String key) { + private List getPropertyAsList(String key) { + String val = getEnvironment().getProperty(key); if (val == null) { - return null; + return Collections.emptyList(); } - return Arrays.asList(val.split(",")); + return Arrays.stream(val.split(",")).map(String::trim).collect(Collectors.toList()); } @Nullable diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java b/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java index 84f178af..b6f207c6 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java @@ -37,6 +37,7 @@ import org.springframework.util.Assert; * for Client Certificate authentication. * * @author Mark Paluch + * @author Ryan Gow * @see Resource * @see java.security.KeyStore * @see org.springframework.vault.authentication.ClientCertificateAuthentication @@ -113,7 +114,7 @@ public class SslConfiguration { * cipher suite strings used by the enabled Java SSL provider. May be {@literal null} * to indicate the SSL socket factory should use a default list of enabled cipher * suites. - * @since 2.4 + * @since 2.3.2 * @see sun.security.ssl.ProtocolVersion * @see sun.security.ssl.CipherSuite */ @@ -128,10 +129,8 @@ public class SslConfiguration { this.keyStoreConfiguration = keyStoreConfiguration; this.keyConfiguration = keyConfiguration; this.trustStoreConfiguration = trustStoreConfiguration; - this.enabledProtocols = enabledProtocols != null - ? Collections.unmodifiableList(new ArrayList<>(enabledProtocols)) : null; - this.enabledCipherSuites = enabledCipherSuites != null - ? Collections.unmodifiableList(new ArrayList<>(enabledCipherSuites)) : null; + this.enabledProtocols = Collections.unmodifiableList(new ArrayList<>(enabledProtocols)); + this.enabledCipherSuites = Collections.unmodifiableList(new ArrayList<>(enabledCipherSuites)); } /** @@ -146,7 +145,8 @@ public class SslConfiguration { */ public SslConfiguration(KeyStoreConfiguration keyStoreConfiguration, KeyConfiguration keyConfiguration, KeyStoreConfiguration trustStoreConfiguration) { - this(keyStoreConfiguration, keyConfiguration, trustStoreConfiguration, null, null); + this(keyStoreConfiguration, keyConfiguration, trustStoreConfiguration, Collections.emptyList(), + Collections.emptyList()); } /** @@ -163,7 +163,7 @@ public class SslConfiguration { * cipher suite strings used by the enabled Java SSL provider. May be {@literal null} * to indicate the SSL socket factory should use a default list of enabled cipher * suites. - * @since 2.4 + * @since 2.3.2 * @see sun.security.ssl.ProtocolVersion * @see sun.security.ssl.CipherSuite */ @@ -364,7 +364,7 @@ public class SslConfiguration { * indicates that the SSL socket factory should use a default list of enabled protocol * versions. * @return the list of enabled SSL protocol versions. - * @since 2.4 + * @since 2.3.2 */ public List getEnabledProtocols() { return this.enabledProtocols; @@ -373,12 +373,29 @@ public class SslConfiguration { /** * Create a new {@link SslConfiguration} with the enabled protocol versions applied * retaining the other configuration from this instance. - * @param enabledProtocols may be {@literal null}. + * @param enabledProtocols must not be {@literal null}. * @return a new {@link SslConfiguration} with the enabled protocol versions applied. - * @since 2.4 + * @since 2.3.2 + * @see sun.security.ssl.ProtocolVersion + */ + public SslConfiguration withEnabledProtocols(String... enabledProtocols) { + + Assert.notNull(enabledProtocols, "Enabled protocols must not be null"); + + return withEnabledProtocols(Arrays.asList(enabledProtocols)); + } + + /** + * Create a new {@link SslConfiguration} with the enabled protocol versions applied + * retaining the other configuration from this instance. + * @param enabledProtocols must not be {@literal null}. + * @return a new {@link SslConfiguration} with the enabled protocol versions applied. + * @since 2.3.2 * @see sun.security.ssl.ProtocolVersion */ public SslConfiguration withEnabledProtocols(List enabledProtocols) { + + Assert.notNull(enabledProtocols, "Enabled protocols must not be null"); return new SslConfiguration(this.keyStoreConfiguration, this.keyConfiguration, this.trustStoreConfiguration, enabledProtocols, this.enabledCipherSuites); } @@ -388,7 +405,7 @@ public class SslConfiguration { * indicates that the SSL socket factory should use a default list of enabled cipher * suites. * @return the list of enabled SSL cipher suites. - * @since 2.4 + * @since 2.3.2 */ public List getEnabledCipherSuites() { return this.enabledCipherSuites; @@ -397,12 +414,30 @@ public class SslConfiguration { /** * Create a new {@link SslConfiguration} with the enabled cipher suites applied * retaining the other configuration from this instance. - * @param enabledCipherSuites may be {@literal null}. + * @param enabledCipherSuites must not be {@literal null}. * @return a new {@link SslConfiguration} with the enabled cipher suites applied. - * @since 2.4 + * @since 2.3.2 + * @see sun.security.ssl.CipherSuite + */ + public SslConfiguration withEnabledCipherSuites(String... enabledCipherSuites) { + + Assert.notNull(enabledProtocols, "Enabled cipher suites must not be null"); + + return withEnabledCipherSuites(Arrays.asList(enabledCipherSuites)); + } + + /** + * Create a new {@link SslConfiguration} with the enabled cipher suites applied + * retaining the other configuration from this instance. + * @param enabledCipherSuites must not be {@literal null}. + * @return a new {@link SslConfiguration} with the enabled cipher suites applied. + * @since 2.3.2 * @see sun.security.ssl.CipherSuite */ public SslConfiguration withEnabledCipherSuites(List enabledCipherSuites) { + + Assert.notNull(enabledProtocols, "Enabled cipher suites must not be null"); + return new SslConfiguration(this.keyStoreConfiguration, this.keyConfiguration, this.trustStoreConfiguration, this.enabledProtocols, enabledCipherSuites); } diff --git a/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpConnectorFactoryIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpConnectorFactoryIntegrationTests.java index c58d149a..18efcf0e 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpConnectorFactoryIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpConnectorFactoryIntegrationTests.java @@ -15,6 +15,9 @@ */ package org.springframework.vault.client; +import java.util.ArrayList; +import java.util.List; + import org.junit.jupiter.api.Test; import org.springframework.http.client.reactive.ClientHttpConnector; @@ -23,17 +26,14 @@ import org.springframework.vault.util.Settings; import org.springframework.web.reactive.function.client.WebClient; import org.springframework.web.reactive.function.client.WebClientResponseException; -import static org.assertj.core.api.AssertionsForClassTypes.assertThat; -import static org.springframework.vault.client.ClientHttpConnectorFactory.JettyClient; -import static org.springframework.vault.client.ClientHttpConnectorFactory.ReactorNetty; - -import java.util.ArrayList; -import java.util.List; +import static org.assertj.core.api.AssertionsForClassTypes.*; +import static org.springframework.vault.client.ClientHttpConnectorFactory.*; /** * Integration tests for {@link ClientHttpConnectorFactory}. * * @author Mark Paluch + * @author Ryan Gow */ class ClientHttpConnectorFactoryIntegrationTests { diff --git a/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpRequestFactoryFactoryIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpRequestFactoryFactoryIntegrationTests.java index 1af062e9..28c58802 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpRequestFactoryFactoryIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpRequestFactoryFactoryIntegrationTests.java @@ -15,13 +15,12 @@ */ package org.springframework.vault.client; -import static org.assertj.core.api.AssertionsForClassTypes.assertThat; - import java.io.File; import java.util.ArrayList; import java.util.List; import org.junit.jupiter.api.Test; + import org.springframework.beans.factory.DisposableBean; import org.springframework.beans.factory.InitializingBean; import org.springframework.core.io.FileSystemResource; @@ -41,10 +40,13 @@ import org.springframework.vault.util.Settings; import org.springframework.web.client.HttpStatusCodeException; import org.springframework.web.client.RestTemplate; +import static org.assertj.core.api.AssertionsForClassTypes.*; + /** * Integration tests for {@link ClientHttpRequestFactory}. * * @author Mark Paluch + * @author Ryan Gow */ class ClientHttpRequestFactoryFactoryIntegrationTests { diff --git a/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationUnitTests.java b/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationUnitTests.java index 97468cb7..266dc5cf 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationUnitTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationUnitTests.java @@ -15,13 +15,12 @@ */ package org.springframework.vault.config; -import static org.assertj.core.api.Assertions.assertThat; - import java.util.HashMap; import java.util.Map; import org.junit.jupiter.api.Test; import org.junit.jupiter.api.extension.ExtendWith; + import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Import; @@ -35,10 +34,13 @@ import org.springframework.vault.authentication.TokenAuthentication; import org.springframework.vault.support.SslConfiguration; import org.springframework.vault.support.VaultToken; +import static org.assertj.core.api.Assertions.*; + /** * Unit tests for {@link EnvironmentVaultConfiguration}. * * @author Mark Paluch + * @author Ryan Gow */ @ExtendWith(SpringExtension.class) @TestPropertySource(properties = { "vault.uri=https://localhost:8123", "vault.token=my-token", @@ -77,9 +79,9 @@ class EnvironmentVaultConfigurationUnitTests { Map map = new HashMap(); map.put("vault.ssl.key-store", "classpath:certificate.json"); map.put("vault.ssl.trust-store", "classpath:certificate.json"); - map.put("vault.ssl.enabled-protocols", "TLSv1.2,TLSv1.1"); + map.put("vault.ssl.enabled-protocols", "TLSv1.2 , TLSv1.1 "); map.put("vault.ssl.enabled-cipher-suites", - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"); + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 , TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"); MapPropertySource propertySource = new MapPropertySource("shouldConfigureSsl", map); this.configurableEnvironment.getPropertySources().addFirst(propertySource); diff --git a/spring-vault-core/src/test/java/org/springframework/vault/support/SslConfigurationUnitTests.java b/spring-vault-core/src/test/java/org/springframework/vault/support/SslConfigurationUnitTests.java index d7447f98..a9475e90 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/support/SslConfigurationUnitTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/support/SslConfigurationUnitTests.java @@ -15,19 +15,19 @@ */ package org.springframework.vault.support; -import static org.assertj.core.api.Assertions.assertThat; - -import java.util.Arrays; - import org.junit.jupiter.api.Test; + import org.springframework.core.io.ClassPathResource; import org.springframework.vault.support.SslConfiguration.KeyStoreConfiguration; import org.springframework.vault.util.Settings; +import static org.assertj.core.api.Assertions.*; + /** * Unit tests for {@link SslConfiguration}. * * @author Mark Paluch + * @author Ryan Gow */ class SslConfigurationUnitTests { @@ -47,8 +47,8 @@ class SslConfigurationUnitTests { assertThat(sslConfiguration.getKeyStoreConfiguration().isPresent()).isFalse(); assertThat(sslConfiguration.getTrustStoreConfiguration().isPresent()).isFalse(); - assertThat(sslConfiguration.getEnabledCipherSuites()).isNull(); - assertThat(sslConfiguration.getEnabledProtocols()).isNull(); + assertThat(sslConfiguration.getEnabledCipherSuites()).isEmpty(); + assertThat(sslConfiguration.getEnabledProtocols()).isEmpty(); } @Test @@ -70,13 +70,12 @@ class SslConfigurationUnitTests { void shouldCreateConfigurationWithEnabledCipherSuites() { KeyStoreConfiguration keystore = KeyStoreConfiguration.of(new ClassPathResource("certificate.json")); - SslConfiguration tsConfig = SslConfiguration.unconfigured().withTrustStore(keystore) - .withEnabledCipherSuites(Arrays.asList(new String[] { "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" })); + SslConfiguration tsConfig = SslConfiguration.unconfigured().withTrustStore(keystore).withEnabledCipherSuites( + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"); assertThat(tsConfig.getTrustStoreConfiguration()).isSameAs(keystore); assertThat(tsConfig.getKeyStoreConfiguration().isPresent()).isFalse(); - assertThat(tsConfig.getEnabledCipherSuites().size()).isEqualTo(2); + assertThat(tsConfig.getEnabledCipherSuites()).hasSize(2); assertThat(tsConfig.getEnabledCipherSuites().get(0)).isEqualTo("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"); assertThat(tsConfig.getEnabledCipherSuites().get(1)).isEqualTo("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"); } @@ -86,11 +85,11 @@ class SslConfigurationUnitTests { KeyStoreConfiguration keystore = KeyStoreConfiguration.of(new ClassPathResource("certificate.json")); SslConfiguration tsConfig = SslConfiguration.unconfigured().withTrustStore(keystore) - .withEnabledProtocols(Arrays.asList(new String[] { "TLSv1.2", "TLSv1.1" })); + .withEnabledProtocols("TLSv1.2", "TLSv1.1"); assertThat(tsConfig.getTrustStoreConfiguration()).isSameAs(keystore); assertThat(tsConfig.getKeyStoreConfiguration().isPresent()).isFalse(); - assertThat(tsConfig.getEnabledProtocols().size()).isEqualTo(2); + assertThat(tsConfig.getEnabledProtocols()).hasSize(2); assertThat(tsConfig.getEnabledProtocols().get(0)).isEqualTo("TLSv1.2"); assertThat(tsConfig.getEnabledProtocols().get(1)).isEqualTo("TLSv1.1"); } diff --git a/src/main/asciidoc/reference/imperative-template.adoc b/src/main/asciidoc/reference/imperative-template.adoc index 1aaa2e89..0ed81cbc 100644 --- a/src/main/asciidoc/reference/imperative-template.adoc +++ b/src/main/asciidoc/reference/imperative-template.adoc @@ -176,6 +176,8 @@ vault.token=00000000-0000-0000-0000-000000000000 ** Truststore resource: `vault.ssl.trust-store` (optional) ** Truststore password: `vault.ssl.trust-store-password` (optional) ** Truststore type: `vault.ssl.trust-store-type` (optional, typically `jks`, supports also `pem`) +** Enabled SSL/TLS protocols: `vault.ssl.enabled-protocols` (since 2.3.2, optional, protocols separated with comma) +** Enabled SSL/TLS cipher suites: `vault.ssl.enabled-cipher-suites` (since 2.3.2, optional, cipher suites separated with comma) * Authentication method: `vault.authentication` (defaults to `TOKEN`, supported authentication methods are: `TOKEN`, `APPID`, `APPROLE`, `AWS_EC2`, `AZURE`, `CERT`, `CUBBYHOLE`, `KUBERNETES`) **Authentication-specific property keys**