Spring/spring-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove OkHttp support.

Browse Source 
Closes #900
This commit is contained in:
Mark Paluch
2025-02-18 14:23:30 +01:00
parent 1412f5a80c
commit b220444679
5 changed files with 13 additions and 188 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pom.xml
View File

@@ -219,13 +219,6 @@
<optional>true</optional>
</dependency>
<dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
<version>${okhttp3.version}</version>
<optional>true</optional>
</dependency>
<!-- AWS SDK -->
<dependency>
<groupId>software.amazon.awssdk</groupId>

6
spring-vault-core/pom.xml
View File

@@ -168,12 +168,6 @@
<optional>true</optional>
</dependency>
<dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>auth</artifactId>

121
spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpRequestFactoryFactory.java
View File

@@ -39,11 +39,18 @@ import java.security.Principal;
import java.security.PrivateKey;
import java.security.UnrecoverableKeyException;
import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.List;
import java.util.concurrent.TimeUnit;
import okhttp3.ConnectionSpec;
import okhttp3.OkHttpClient.Builder;
import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.KeyManagerFactorySpi;
import javax.net.ssl.ManagerFactoryParameters;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLEngine;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509ExtendedKeyManager;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.hc.client5.http.config.ConnectionConfig;
@@ -60,7 +67,6 @@ import org.apache.hc.core5.util.Timeout;
import org.springframework.http.client.ClientHttpRequestFactory;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.http.client.OkHttp3ClientHttpRequestFactory;
import org.springframework.http.client.SimpleClientHttpRequestFactory;
import org.springframework.lang.Nullable;
import org.springframework.util.Assert;
@@ -75,7 +81,7 @@ import org.springframework.vault.support.SslConfiguration.KeyStoreConfiguration;
/**
* Factory for {@link ClientHttpRequestFactory} that supports Apache HTTP Components,
* OkHttp, Netty and the JDK HTTP client (in that order). This factory configures a
* Netty and the JDK HTTP client (in that order). This factory configures a
* {@link ClientHttpRequestFactory} depending on the available dependencies.
*
* @author Mark Paluch
@@ -93,9 +99,6 @@ public class ClientHttpRequestFactoryFactory {
"org.apache.hc.client5.http.impl.classic.HttpClientBuilder",
ClientHttpRequestFactoryFactory.class.getClassLoader());
private static final boolean okHttp3Present = ClassUtils.isPresent("okhttp3.OkHttpClient",
ClientHttpRequestFactoryFactory.class.getClassLoader());
/**
* Create a {@link ClientHttpRequestFactory} for the given {@link ClientOptions} and
* {@link SslConfiguration}.
@@ -114,10 +117,6 @@ public class ClientHttpRequestFactoryFactory {
if (httpComponentsPresent) {
return HttpComponents.usingHttpComponents(options, sslConfiguration);
}
if (okHttp3Present) {
return OkHttp3.usingOkHttp3(options, sslConfiguration);
}
}
catch (GeneralSecurityException | IOException e) {
throw new IllegalStateException(e);
@@ -348,102 +347,6 @@ public class ClientHttpRequestFactoryFactory {
}
/**
* Utilities to create a {@link ClientHttpRequestFactory} for the
* {@link okhttp3.OkHttpClient}.
*
* @author Mark Paluch
*/
public static class OkHttp3 {
/**
* Create a {@link ClientHttpRequestFactory} using {@link okhttp3.OkHttpClient}.
* @param options must not be {@literal null}
* @param sslConfiguration must not be {@literal null}
* @return a new and configured {@link OkHttp3ClientHttpRequestFactory} instance.
* @throws GeneralSecurityException
* @throws IOException
*/
public static OkHttp3ClientHttpRequestFactory usingOkHttp3(ClientOptions options,
SslConfiguration sslConfiguration) throws GeneralSecurityException, IOException {
Builder builder = getBuilder(options, sslConfiguration);
return new OkHttp3ClientHttpRequestFactory(builder.build());
}
public static Builder getBuilder(ClientOptions options, SslConfiguration sslConfiguration)
throws GeneralSecurityException, IOException {
Builder builder = new Builder();
ConnectionSpec sslConnectionSpec = ConnectionSpec.MODERN_TLS;
if (hasSslConfiguration(sslConfiguration)) {
TrustManager[] trustManagers = getTrustManagers(sslConfiguration);
if (trustManagers == null || trustManagers.length != 1
|| !(trustManagers[0] instanceof X509TrustManager)) {
throw new IllegalStateException(
"Unexpected default trust managers:" + Arrays.toString(trustManagers));
}
SSLContext sslContext = getSSLContext(sslConfiguration.getKeyStoreConfiguration(),
sslConfiguration.getKeyConfiguration(), trustManagers);
ConnectionSpec.Builder sslConnectionSpecBuilder = new ConnectionSpec.Builder(sslConnectionSpec);
if (!sslConfiguration.getEnabledProtocols().isEmpty()) {
sslConnectionSpecBuilder.tlsVersions(sslConfiguration.getEnabledProtocols().toArray(new String[0]));
}
if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) {
sslConnectionSpecBuilder
.cipherSuites(sslConfiguration.getEnabledCipherSuites().toArray(new String[0]));
}
sslConnectionSpec = sslConnectionSpecBuilder.build();
builder.sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustManagers[0]);
}
builder.connectionSpecs(Arrays.asList(sslConnectionSpec, ConnectionSpec.CLEARTEXT));
builder.connectTimeout(options.getConnectionTimeout().toMillis(), TimeUnit.MILLISECONDS)
.readTimeout(options.getReadTimeout().toMillis(), TimeUnit.MILLISECONDS);
return builder;
}
}
/**
* Utilities to create a {@link ClientHttpRequestFactory} for the
* {@link SimpleClientHttpRequestFactory}.
*
* @author Luciano Canales
* @since 3.1.3
*/
public static class SimpleClient {
/**
* Create a {@link ClientHttpRequestFactory} using
* {@link SimpleClientHttpRequestFactory}.
* @param options must not be {@literal null}
* @return a new and configured {@link SimpleClientHttpRequestFactory} instance.
*/
public static SimpleClientHttpRequestFactory usingSimpleClientHttpRequest(ClientOptions options) {
SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
factory.setConnectTimeout((int) options.getConnectionTimeout().toMillis());
factory.setReadTimeout((int) options.getReadTimeout().toMillis());
return factory;
}
}
static class KeySelectingKeyManagerFactory extends KeyManagerFactory {
KeySelectingKeyManagerFactory(KeyManagerFactory factory, KeyConfiguration keyConfiguration) {

53
spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpRequestFactoryFactoryIntegrationTests.java
View File

@@ -27,9 +27,7 @@ import org.springframework.http.HttpMethod;
import org.springframework.http.ResponseEntity;
import org.springframework.http.client.ClientHttpRequestFactory;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.http.client.OkHttp3ClientHttpRequestFactory;
import org.springframework.vault.client.ClientHttpRequestFactoryFactory.HttpComponents;
import org.springframework.vault.client.ClientHttpRequestFactoryFactory.OkHttp3;
import org.springframework.vault.support.ClientOptions;
import org.springframework.vault.support.SslConfiguration;
import org.springframework.vault.util.Settings;
@@ -119,57 +117,6 @@ class ClientHttpRequestFactoryFactoryIntegrationTests {
((DisposableBean) factory).destroy();
}
@Test
void okHttp3ClientShouldWork() throws Exception {
ClientHttpRequestFactory factory = OkHttp3.usingOkHttp3(new ClientOptions(), Settings.createSslConfiguration());
RestTemplate template = new RestTemplate(factory);
String response = request(template);
assertThat(factory).isInstanceOf(OkHttp3ClientHttpRequestFactory.class);
assertThat(response).isNotNull().contains("initialized");
((DisposableBean) factory).destroy();
}
@Test
void okHttp3ClientWithExplicitCipherSuitesShouldWork() throws Exception {
List<String> enabledCipherSuites = new ArrayList<String>();
enabledCipherSuites.add("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384");
enabledCipherSuites.add("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256");
ClientHttpRequestFactory factory = OkHttp3.usingOkHttp3(new ClientOptions(),
Settings.createSslConfiguration().withEnabledCipherSuites(enabledCipherSuites));
RestTemplate template = new RestTemplate(factory);
String response = request(template);
assertThat(factory).isInstanceOf(OkHttp3ClientHttpRequestFactory.class);
assertThat(response).isNotNull().contains("initialized");
((DisposableBean) factory).destroy();
}
@Test
void okHttp3ClientWithExplicitProtocolsShouldWork() throws Exception {
List<String> enabledProtocols = new ArrayList<String>();
enabledProtocols.add("TLSv1.2");
ClientHttpRequestFactory factory = OkHttp3.usingOkHttp3(new ClientOptions(),
Settings.createSslConfiguration().withEnabledProtocols(enabledProtocols));
RestTemplate template = new RestTemplate(factory);
String response = request(template);
assertThat(factory).isInstanceOf(OkHttp3ClientHttpRequestFactory.class);
assertThat(response).isNotNull().contains("initialized");
((DisposableBean) factory).destroy();
}
private String request(RestTemplate template) {
// Uninitialized and sealed can cause status 500

14
src/main/antora/modules/ROOT/pages/vault/client-support.adoc
View File

@@ -10,7 +10,6 @@ Spring Vault supports following HTTP imperative clients:
* Java's builtin `HttpURLConnection` (default client if no other is available)
* Apache Http Components
* OkHttp 3
Spring Vault's reactive integration supports the following reactive HTTP clients:
@@ -51,17 +50,6 @@ dependencies to your project. You can omit the version number if using
NOTE: Apache HttpClient's https://hc.apache.org/httpcomponents-client-5.2.x/logging.html[wire logging] can be enabled through logging configuration. Make sure to not accidentally enable wire logging as logs may expose traffic (tokens and secrets) between your application and Vault in plain text.
.Square OkHttp 3
====
[source, xml]
----
<dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
</dependency>
----
====
.Reactor Netty
====
[source, xml]
@@ -128,7 +116,7 @@ SslConfiguration.forKeyStore(new FileSystemResource("keystore.jks"), <4>
<4> Configuring only key store settings with providing a key-configuration.
====
Please note that providing javadoc:org.springframework.vault.support.SslConfiguration[] can be only applied when either Apache Http Components or the OkHttp client is on your class-path.
Please note that providing javadoc:org.springframework.vault.support.SslConfiguration[] can be only applied when Apache Http Components is on your class-path.
The SSL configuration supports also PEM-encoded certificates as alternative to a Java Key Store.