diff --git a/pom.xml b/pom.xml index d138ebaa..5b79083a 100644 --- a/pom.xml +++ b/pom.xml @@ -219,13 +219,6 @@ true - - com.squareup.okhttp3 - okhttp - ${okhttp3.version} - true - - software.amazon.awssdk diff --git a/spring-vault-core/pom.xml b/spring-vault-core/pom.xml index 28d718a7..2728e9a3 100644 --- a/spring-vault-core/pom.xml +++ b/spring-vault-core/pom.xml @@ -168,12 +168,6 @@ true - - com.squareup.okhttp3 - okhttp - true - - software.amazon.awssdk auth diff --git a/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpRequestFactoryFactory.java b/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpRequestFactoryFactory.java index a02b78df..5c940367 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpRequestFactoryFactory.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpRequestFactoryFactory.java @@ -39,11 +39,18 @@ import java.security.Principal; import java.security.PrivateKey; import java.security.UnrecoverableKeyException; import java.security.cert.X509Certificate; -import java.util.Arrays; import java.util.List; -import java.util.concurrent.TimeUnit; -import okhttp3.ConnectionSpec; -import okhttp3.OkHttpClient.Builder; + +import javax.net.ssl.KeyManager; +import javax.net.ssl.KeyManagerFactory; +import javax.net.ssl.KeyManagerFactorySpi; +import javax.net.ssl.ManagerFactoryParameters; +import javax.net.ssl.SSLContext; +import javax.net.ssl.SSLEngine; +import javax.net.ssl.TrustManager; +import javax.net.ssl.TrustManagerFactory; +import javax.net.ssl.X509ExtendedKeyManager; + import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.apache.hc.client5.http.config.ConnectionConfig; @@ -60,7 +67,6 @@ import org.apache.hc.core5.util.Timeout; import org.springframework.http.client.ClientHttpRequestFactory; import org.springframework.http.client.HttpComponentsClientHttpRequestFactory; -import org.springframework.http.client.OkHttp3ClientHttpRequestFactory; import org.springframework.http.client.SimpleClientHttpRequestFactory; import org.springframework.lang.Nullable; import org.springframework.util.Assert; @@ -75,7 +81,7 @@ import org.springframework.vault.support.SslConfiguration.KeyStoreConfiguration; /** * Factory for {@link ClientHttpRequestFactory} that supports Apache HTTP Components, - * OkHttp, Netty and the JDK HTTP client (in that order). This factory configures a + * Netty and the JDK HTTP client (in that order). This factory configures a * {@link ClientHttpRequestFactory} depending on the available dependencies. * * @author Mark Paluch @@ -93,9 +99,6 @@ public class ClientHttpRequestFactoryFactory { "org.apache.hc.client5.http.impl.classic.HttpClientBuilder", ClientHttpRequestFactoryFactory.class.getClassLoader()); - private static final boolean okHttp3Present = ClassUtils.isPresent("okhttp3.OkHttpClient", - ClientHttpRequestFactoryFactory.class.getClassLoader()); - /** * Create a {@link ClientHttpRequestFactory} for the given {@link ClientOptions} and * {@link SslConfiguration}. @@ -114,10 +117,6 @@ public class ClientHttpRequestFactoryFactory { if (httpComponentsPresent) { return HttpComponents.usingHttpComponents(options, sslConfiguration); } - - if (okHttp3Present) { - return OkHttp3.usingOkHttp3(options, sslConfiguration); - } } catch (GeneralSecurityException | IOException e) { throw new IllegalStateException(e); @@ -348,102 +347,6 @@ public class ClientHttpRequestFactoryFactory { } - /** - * Utilities to create a {@link ClientHttpRequestFactory} for the - * {@link okhttp3.OkHttpClient}. - * - * @author Mark Paluch - */ - public static class OkHttp3 { - - /** - * Create a {@link ClientHttpRequestFactory} using {@link okhttp3.OkHttpClient}. - * @param options must not be {@literal null} - * @param sslConfiguration must not be {@literal null} - * @return a new and configured {@link OkHttp3ClientHttpRequestFactory} instance. - * @throws GeneralSecurityException - * @throws IOException - */ - public static OkHttp3ClientHttpRequestFactory usingOkHttp3(ClientOptions options, - SslConfiguration sslConfiguration) throws GeneralSecurityException, IOException { - - Builder builder = getBuilder(options, sslConfiguration); - - return new OkHttp3ClientHttpRequestFactory(builder.build()); - } - - public static Builder getBuilder(ClientOptions options, SslConfiguration sslConfiguration) - throws GeneralSecurityException, IOException { - - Builder builder = new Builder(); - - ConnectionSpec sslConnectionSpec = ConnectionSpec.MODERN_TLS; - - if (hasSslConfiguration(sslConfiguration)) { - - TrustManager[] trustManagers = getTrustManagers(sslConfiguration); - - if (trustManagers == null || trustManagers.length != 1 - || !(trustManagers[0] instanceof X509TrustManager)) { - throw new IllegalStateException( - "Unexpected default trust managers:" + Arrays.toString(trustManagers)); - } - - SSLContext sslContext = getSSLContext(sslConfiguration.getKeyStoreConfiguration(), - sslConfiguration.getKeyConfiguration(), trustManagers); - - ConnectionSpec.Builder sslConnectionSpecBuilder = new ConnectionSpec.Builder(sslConnectionSpec); - - if (!sslConfiguration.getEnabledProtocols().isEmpty()) { - sslConnectionSpecBuilder.tlsVersions(sslConfiguration.getEnabledProtocols().toArray(new String[0])); - } - - if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) { - sslConnectionSpecBuilder - .cipherSuites(sslConfiguration.getEnabledCipherSuites().toArray(new String[0])); - } - - sslConnectionSpec = sslConnectionSpecBuilder.build(); - - builder.sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustManagers[0]); - } - - builder.connectionSpecs(Arrays.asList(sslConnectionSpec, ConnectionSpec.CLEARTEXT)); - - builder.connectTimeout(options.getConnectionTimeout().toMillis(), TimeUnit.MILLISECONDS) - .readTimeout(options.getReadTimeout().toMillis(), TimeUnit.MILLISECONDS); - return builder; - } - - } - - /** - * Utilities to create a {@link ClientHttpRequestFactory} for the - * {@link SimpleClientHttpRequestFactory}. - * - * @author Luciano Canales - * @since 3.1.3 - */ - public static class SimpleClient { - - /** - * Create a {@link ClientHttpRequestFactory} using - * {@link SimpleClientHttpRequestFactory}. - * @param options must not be {@literal null} - * @return a new and configured {@link SimpleClientHttpRequestFactory} instance. - */ - public static SimpleClientHttpRequestFactory usingSimpleClientHttpRequest(ClientOptions options) { - - SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory(); - - factory.setConnectTimeout((int) options.getConnectionTimeout().toMillis()); - factory.setReadTimeout((int) options.getReadTimeout().toMillis()); - - return factory; - } - - } - static class KeySelectingKeyManagerFactory extends KeyManagerFactory { KeySelectingKeyManagerFactory(KeyManagerFactory factory, KeyConfiguration keyConfiguration) { diff --git a/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpRequestFactoryFactoryIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpRequestFactoryFactoryIntegrationTests.java index aca62d7e..5ec517ec 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpRequestFactoryFactoryIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpRequestFactoryFactoryIntegrationTests.java @@ -27,9 +27,7 @@ import org.springframework.http.HttpMethod; import org.springframework.http.ResponseEntity; import org.springframework.http.client.ClientHttpRequestFactory; import org.springframework.http.client.HttpComponentsClientHttpRequestFactory; -import org.springframework.http.client.OkHttp3ClientHttpRequestFactory; import org.springframework.vault.client.ClientHttpRequestFactoryFactory.HttpComponents; -import org.springframework.vault.client.ClientHttpRequestFactoryFactory.OkHttp3; import org.springframework.vault.support.ClientOptions; import org.springframework.vault.support.SslConfiguration; import org.springframework.vault.util.Settings; @@ -119,57 +117,6 @@ class ClientHttpRequestFactoryFactoryIntegrationTests { ((DisposableBean) factory).destroy(); } - @Test - void okHttp3ClientShouldWork() throws Exception { - - ClientHttpRequestFactory factory = OkHttp3.usingOkHttp3(new ClientOptions(), Settings.createSslConfiguration()); - RestTemplate template = new RestTemplate(factory); - - String response = request(template); - - assertThat(factory).isInstanceOf(OkHttp3ClientHttpRequestFactory.class); - assertThat(response).isNotNull().contains("initialized"); - - ((DisposableBean) factory).destroy(); - } - - @Test - void okHttp3ClientWithExplicitCipherSuitesShouldWork() throws Exception { - - List enabledCipherSuites = new ArrayList(); - enabledCipherSuites.add("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"); - enabledCipherSuites.add("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"); - - ClientHttpRequestFactory factory = OkHttp3.usingOkHttp3(new ClientOptions(), - Settings.createSslConfiguration().withEnabledCipherSuites(enabledCipherSuites)); - RestTemplate template = new RestTemplate(factory); - - String response = request(template); - - assertThat(factory).isInstanceOf(OkHttp3ClientHttpRequestFactory.class); - assertThat(response).isNotNull().contains("initialized"); - - ((DisposableBean) factory).destroy(); - } - - @Test - void okHttp3ClientWithExplicitProtocolsShouldWork() throws Exception { - - List enabledProtocols = new ArrayList(); - enabledProtocols.add("TLSv1.2"); - - ClientHttpRequestFactory factory = OkHttp3.usingOkHttp3(new ClientOptions(), - Settings.createSslConfiguration().withEnabledProtocols(enabledProtocols)); - RestTemplate template = new RestTemplate(factory); - - String response = request(template); - - assertThat(factory).isInstanceOf(OkHttp3ClientHttpRequestFactory.class); - assertThat(response).isNotNull().contains("initialized"); - - ((DisposableBean) factory).destroy(); - } - private String request(RestTemplate template) { // Uninitialized and sealed can cause status 500 diff --git a/src/main/antora/modules/ROOT/pages/vault/client-support.adoc b/src/main/antora/modules/ROOT/pages/vault/client-support.adoc index 18d0a63d..318df669 100644 --- a/src/main/antora/modules/ROOT/pages/vault/client-support.adoc +++ b/src/main/antora/modules/ROOT/pages/vault/client-support.adoc @@ -10,7 +10,6 @@ Spring Vault supports following HTTP imperative clients: * Java's builtin `HttpURLConnection` (default client if no other is available) * Apache Http Components -* OkHttp 3 Spring Vault's reactive integration supports the following reactive HTTP clients: @@ -51,17 +50,6 @@ dependencies to your project. You can omit the version number if using NOTE: Apache HttpClient's https://hc.apache.org/httpcomponents-client-5.2.x/logging.html[wire logging] can be enabled through logging configuration. Make sure to not accidentally enable wire logging as logs may expose traffic (tokens and secrets) between your application and Vault in plain text. -.Square OkHttp 3 -==== -[source, xml] ----- - - com.squareup.okhttp3 - okhttp - ----- -==== - .Reactor Netty ==== [source, xml] @@ -128,7 +116,7 @@ SslConfiguration.forKeyStore(new FileSystemResource("keystore.jks"), <4> <4> Configuring only key store settings with providing a key-configuration. ==== -Please note that providing javadoc:org.springframework.vault.support.SslConfiguration[] can be only applied when either Apache Http Components or the OkHttp client is on your class-path. +Please note that providing javadoc:org.springframework.vault.support.SslConfiguration[] can be only applied when Apache Http Components is on your class-path. The SSL configuration supports also PEM-encoded certificates as alternative to a Java Key Store.