Skip to content

Commit 5640cc0

Browse files
mp911demp911de
committed
Polishing.
Make SslConfiguration.enabledProtocols and enabledCipherSuites non-null. Update since tags. Add author tags. Update documentation. See gh-635 Original pull request: gh-640.
1 parent a85fa86 commit 5640cc0

File tree

9 files changed

+110
-81
lines changed

9 files changed

+110
-81
lines changed

‎spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpConnectorFactory.java‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,7 @@
3232
import org.springframework.vault.support.ClientOptions;
3333
import org.springframework.vault.support.SslConfiguration;
3434

35-
import static org.springframework.vault.client.ClientHttpRequestFactoryFactory.createKeyManagerFactory;
36-
import static org.springframework.vault.client.ClientHttpRequestFactoryFactory.createTrustManagerFactory;
37-
import static org.springframework.vault.client.ClientHttpRequestFactoryFactory.hasSslConfiguration;
35+
import static org.springframework.vault.client.ClientHttpRequestFactoryFactory.*;
3836

3937
/**
4038
* Factory for {@link ClientHttpConnector} that supports
@@ -44,6 +42,7 @@
4442
* dependencies.
4543
*
4644
* @author Mark Paluch
45+
* @author Ryan Gow
4746
* @since 2.2
4847
*/
4948
public class ClientHttpConnectorFactory {
@@ -106,11 +105,11 @@ private static void configureSsl(SslConfiguration sslConfiguration, SslContextBu
106105
sslConfiguration.getKeyConfiguration()));
107106
}
108107

109-
if (sslConfiguration.getEnabledProtocols() != null) {
108+
if (!sslConfiguration.getEnabledProtocols().isEmpty()) {
110109
sslContextBuilder.protocols(sslConfiguration.getEnabledProtocols());
111110
}
112111

113-
if (sslConfiguration.getEnabledCipherSuites() != null) {
112+
if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) {
114113
sslContextBuilder.ciphers(sslConfiguration.getEnabledCipherSuites());
115114
}
116115
}
@@ -197,12 +196,12 @@ private static org.eclipse.jetty.client.HttpClient getHttpClient(SslConfiguratio
197196
sslContextFactory.setKeyManagerPassword(new String(keyConfiguration.getKeyPassword()));
198197
}
199198

200-
if (sslConfiguration.getEnabledProtocols() != null) {
199+
if (!sslConfiguration.getEnabledProtocols().isEmpty()) {
201200
sslContextFactory
202201
.setIncludeProtocols(sslConfiguration.getEnabledProtocols().toArray(new String[0]));
203202
}
204203

205-
if (sslConfiguration.getEnabledCipherSuites() != null) {
204+
if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) {
206205
sslContextFactory
207206
.setIncludeCipherSuites(sslConfiguration.getEnabledCipherSuites().toArray(new String[0]));
208207
}

‎spring-vault-core/src/main/java/org/springframework/vault/client/ClientHttpRequestFactoryFactory.java‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,10 @@
4343
import javax.net.ssl.X509ExtendedKeyManager;
4444
import javax.net.ssl.X509TrustManager;
4545

46+
import io.netty.handler.ssl.SslContextBuilder;
47+
import io.netty.handler.ssl.SslProvider;
48+
import okhttp3.ConnectionSpec;
49+
import okhttp3.OkHttpClient.Builder;
4650
import org.apache.commons.logging.Log;
4751
import org.apache.commons.logging.LogFactory;
4852
import org.apache.http.client.config.RequestConfig;
@@ -52,6 +56,7 @@
5256
import org.apache.http.impl.client.LaxRedirectStrategy;
5357
import org.apache.http.impl.conn.DefaultSchemePortResolver;
5458
import org.apache.http.impl.conn.SystemDefaultRoutePlanner;
59+
5560
import org.springframework.http.client.ClientHttpRequestFactory;
5661
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
5762
import org.springframework.http.client.Netty4ClientHttpRequestFactory;
@@ -68,17 +73,13 @@
6873
import org.springframework.vault.support.SslConfiguration.KeyConfiguration;
6974
import org.springframework.vault.support.SslConfiguration.KeyStoreConfiguration;
7075

71-
import io.netty.handler.ssl.SslContextBuilder;
72-
import io.netty.handler.ssl.SslProvider;
73-
import okhttp3.ConnectionSpec;
74-
import okhttp3.OkHttpClient.Builder;
75-
7676
/**
7777
* Factory for {@link ClientHttpRequestFactory} that supports Apache HTTP Components,
7878
* OkHttp, Netty and the JDK HTTP client (in that order). This factory configures a
7979
* {@link ClientHttpRequestFactory} depending on the available dependencies.
8080
*
8181
* @author Mark Paluch
82+
* @author Ryan Gow
8283
* @since 2.2
8384
*/
8485
public class ClientHttpRequestFactoryFactory {
@@ -301,13 +302,13 @@ static ClientHttpRequestFactory usingHttpComponents(ClientOptions options, SslCo
301302

302303
String[] enabledProtocols = null;
303304

304-
if (sslConfiguration.getEnabledProtocols() != null) {
305+
if (!sslConfiguration.getEnabledProtocols().isEmpty()) {
305306
enabledProtocols = sslConfiguration.getEnabledProtocols().toArray(new String[0]);
306307
}
307308

308309
String[] enabledCipherSuites = null;
309310

310-
if (sslConfiguration.getEnabledCipherSuites() != null) {
311+
if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) {
311312
enabledCipherSuites = sslConfiguration.getEnabledCipherSuites().toArray(new String[0]);
312313
}
313314

@@ -362,11 +363,11 @@ static ClientHttpRequestFactory usingOkHttp3(ClientOptions options, SslConfigura
362363

363364
ConnectionSpec.Builder sslConnectionSpecBuilder = new ConnectionSpec.Builder(sslConnectionSpec);
364365

365-
if (sslConfiguration.getEnabledProtocols() != null) {
366+
if (!sslConfiguration.getEnabledProtocols().isEmpty()) {
366367
sslConnectionSpecBuilder.tlsVersions(sslConfiguration.getEnabledProtocols().toArray(new String[0]));
367368
}
368369

369-
if (sslConfiguration.getEnabledCipherSuites() != null) {
370+
if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) {
370371
sslConnectionSpecBuilder
371372
.cipherSuites(sslConfiguration.getEnabledCipherSuites().toArray(new String[0]));
372373
}
@@ -413,11 +414,11 @@ static ClientHttpRequestFactory usingNetty(ClientOptions options, SslConfigurati
413414
sslConfiguration.getKeyConfiguration()));
414415
}
415416

416-
if (sslConfiguration.getEnabledProtocols() != null) {
417+
if (!sslConfiguration.getEnabledProtocols().isEmpty()) {
417418
sslContextBuilder.protocols(sslConfiguration.getEnabledProtocols());
418419
}
419420

420-
if (sslConfiguration.getEnabledCipherSuites() != null) {
421+
if (!sslConfiguration.getEnabledCipherSuites().isEmpty()) {
421422
sslContextBuilder.ciphers(sslConfiguration.getEnabledCipherSuites());
422423
}
423424

‎spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java‎

Lines changed: 15 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,13 @@
1717

1818
import java.net.URI;
1919
import java.util.Arrays;
20+
import java.util.Collections;
2021
import java.util.List;
22+
import java.util.stream.Collectors;
2123

2224
import org.apache.commons.logging.Log;
2325
import org.apache.commons.logging.LogFactory;
26+
2427
import org.springframework.beans.BeansException;
2528
import org.springframework.context.ApplicationContext;
2629
import org.springframework.context.ApplicationContextAware;
@@ -29,35 +32,15 @@
2932
import org.springframework.lang.Nullable;
3033
import org.springframework.util.Assert;
3134
import org.springframework.util.StringUtils;
32-
import org.springframework.vault.authentication.AppIdAuthentication;
33-
import org.springframework.vault.authentication.AppIdAuthenticationOptions;
35+
import org.springframework.vault.authentication.*;
3436
import org.springframework.vault.authentication.AppIdAuthenticationOptions.AppIdAuthenticationOptionsBuilder;
35-
import org.springframework.vault.authentication.AppIdUserIdMechanism;
36-
import org.springframework.vault.authentication.AppRoleAuthentication;
37-
import org.springframework.vault.authentication.AppRoleAuthenticationOptions;
3837
import org.springframework.vault.authentication.AppRoleAuthenticationOptions.AppRoleAuthenticationOptionsBuilder;
3938
import org.springframework.vault.authentication.AppRoleAuthenticationOptions.RoleId;
4039
import org.springframework.vault.authentication.AppRoleAuthenticationOptions.SecretId;
41-
import org.springframework.vault.authentication.AwsEc2Authentication;
42-
import org.springframework.vault.authentication.AwsEc2AuthenticationOptions;
4340
import org.springframework.vault.authentication.AwsEc2AuthenticationOptions.AwsEc2AuthenticationOptionsBuilder;
44-
import org.springframework.vault.authentication.AzureMsiAuthentication;
45-
import org.springframework.vault.authentication.AzureMsiAuthenticationOptions;
4641
import org.springframework.vault.authentication.AzureMsiAuthenticationOptions.AzureMsiAuthenticationOptionsBuilder;
47-
import org.springframework.vault.authentication.ClientAuthentication;
48-
import org.springframework.vault.authentication.ClientCertificateAuthentication;
49-
import org.springframework.vault.authentication.CubbyholeAuthentication;
50-
import org.springframework.vault.authentication.CubbyholeAuthenticationOptions;
5142
import org.springframework.vault.authentication.CubbyholeAuthenticationOptions.CubbyholeAuthenticationOptionsBuilder;
52-
import org.springframework.vault.authentication.IpAddressUserId;
53-
import org.springframework.vault.authentication.KubernetesAuthentication;
54-
import org.springframework.vault.authentication.KubernetesAuthenticationOptions;
5543
import org.springframework.vault.authentication.KubernetesAuthenticationOptions.KubernetesAuthenticationOptionsBuilder;
56-
import org.springframework.vault.authentication.KubernetesJwtSupplier;
57-
import org.springframework.vault.authentication.KubernetesServiceAccountTokenFile;
58-
import org.springframework.vault.authentication.MacAddressUserId;
59-
import org.springframework.vault.authentication.StaticUserId;
60-
import org.springframework.vault.authentication.TokenAuthentication;
6144
import org.springframework.vault.client.VaultEndpoint;
6245
import org.springframework.vault.support.SslConfiguration;
6346
import org.springframework.vault.support.SslConfiguration.KeyStoreConfiguration;
@@ -105,6 +88,10 @@
10588
* <li>Truststore resource: {@code vault.ssl.trust-store} (optional)</li>
10689
* <li>Truststore password: {@code vault.ssl.trust-store-password} (optional)</li>
10790
* <li>Truststore type: {@code vault.ssl.trust-store-password} (since 2.3, optional)</li>
91+
* <li>Enabled SSL/TLS protocols: {@code vault.ssl.enabled-protocols} (since 2.3.2,
92+
* optional, protocols separated with comma)</li>
93+
* <li>Enabled SSL/TLS cipher suites: {@code vault.ssl.enabled-cipher-suites} (since
94+
* 2.3.2, optional, cipher suites separated with comma)</li>
10895
* </ul>
10996
* </li>
11097
* <li>Authentication method: {@code vault.authentication} (defaults to {@literal TOKEN},
@@ -174,6 +161,7 @@
174161
* @author Michal Budzyn
175162
* @author Raoof Mohammed
176163
* @author Justin Bertrand
164+
* @author Ryan Gow
177165
* @see org.springframework.core.env.Environment
178166
* @see org.springframework.core.env.PropertySource
179167
* @see VaultEndpoint
@@ -232,9 +220,9 @@ public SslConfiguration sslConfiguration() {
232220
KeyStoreConfiguration trustStoreConfiguration = getKeyStoreConfiguration("vault.ssl.trust-store",
233221
"vault.ssl.trust-store-password", "vault.ssl.trust-store-type");
234222

235-
List<String> enabledProtocols = getList("vault.ssl.enabled-protocols");
223+
List<String> enabledProtocols = getPropertyAsList("vault.ssl.enabled-protocols");
236224

237-
List<String> enabledCipherSuites = getList("vault.ssl.enabled-cipher-suites");
225+
List<String> enabledCipherSuites = getPropertyAsList("vault.ssl.enabled-cipher-suites");
238226

239227
return new SslConfiguration(keyStoreConfiguration, trustStoreConfiguration, enabledProtocols,
240228
enabledCipherSuites);
@@ -427,14 +415,15 @@ protected ClientAuthentication kubeAuthentication() {
427415
return new KubernetesAuthentication(builder.build(), restOperations());
428416
}
429417

430-
private List<String> getList(String key) {
418+
private List<String> getPropertyAsList(String key) {
419+
431420
String val = getEnvironment().getProperty(key);
432421

433422
if (val == null) {
434-
return null;
423+
return Collections.emptyList();
435424
}
436425

437-
return Arrays.asList(val.split(","));
426+
return Arrays.stream(val.split(",")).map(String::trim).collect(Collectors.toList());
438427
}
439428

440429
@Nullable

‎spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java‎

Lines changed: 48 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
* for Client Certificate authentication.
3838
*
3939
* @author Mark Paluch
40+
* @author Ryan Gow
4041
* @see Resource
4142
* @see java.security.KeyStore
4243
* @see org.springframework.vault.authentication.ClientCertificateAuthentication
@@ -113,7 +114,7 @@ public SslConfiguration(KeyStoreConfiguration keyStoreConfiguration,
113114
* cipher suite strings used by the enabled Java SSL provider. May be {@literal null}
114115
* to indicate the SSL socket factory should use a default list of enabled cipher
115116
* suites.
116-
* @since 2.4
117+
* @since 2.3.2
117118
* @see sun.security.ssl.ProtocolVersion
118119
* @see sun.security.ssl.CipherSuite
119120
*/
@@ -128,10 +129,8 @@ public SslConfiguration(KeyStoreConfiguration keyStoreConfiguration, KeyConfigur
128129
this.keyStoreConfiguration = keyStoreConfiguration;
129130
this.keyConfiguration = keyConfiguration;
130131
this.trustStoreConfiguration = trustStoreConfiguration;
131-
this.enabledProtocols = enabledProtocols != null
132-
? Collections.unmodifiableList(new ArrayList<>(enabledProtocols)) : null;
133-
this.enabledCipherSuites = enabledCipherSuites != null
134-
? Collections.unmodifiableList(new ArrayList<>(enabledCipherSuites)) : null;
132+
this.enabledProtocols = Collections.unmodifiableList(new ArrayList<>(enabledProtocols));
133+
this.enabledCipherSuites = Collections.unmodifiableList(new ArrayList<>(enabledCipherSuites));
135134
}
136135

137136
/**
@@ -146,7 +145,8 @@ public SslConfiguration(KeyStoreConfiguration keyStoreConfiguration, KeyConfigur
146145
*/
147146
public SslConfiguration(KeyStoreConfiguration keyStoreConfiguration, KeyConfiguration keyConfiguration,
148147
KeyStoreConfiguration trustStoreConfiguration) {
149-
this(keyStoreConfiguration, keyConfiguration, trustStoreConfiguration, null, null);
148+
this(keyStoreConfiguration, keyConfiguration, trustStoreConfiguration, Collections.emptyList(),
149+
Collections.emptyList());
150150
}
151151

152152
/**
@@ -163,7 +163,7 @@ public SslConfiguration(KeyStoreConfiguration keyStoreConfiguration, KeyConfigur
163163
* cipher suite strings used by the enabled Java SSL provider. May be {@literal null}
164164
* to indicate the SSL socket factory should use a default list of enabled cipher
165165
* suites.
166-
* @since 2.4
166+
* @since 2.3.2
167167
* @see sun.security.ssl.ProtocolVersion
168168
* @see sun.security.ssl.CipherSuite
169169
*/
@@ -364,7 +364,7 @@ public static SslConfiguration unconfigured() {
364364
* indicates that the SSL socket factory should use a default list of enabled protocol
365365
* versions.
366366
* @return the list of enabled SSL protocol versions.
367-
* @since 2.4
367+
* @since 2.3.2
368368
*/
369369
public List<String> getEnabledProtocols() {
370370
return this.enabledProtocols;
@@ -373,12 +373,29 @@ public List<String> getEnabledProtocols() {
373373
/**
374374
* Create a new {@link SslConfiguration} with the enabled protocol versions applied
375375
* retaining the other configuration from this instance.
376-
* @param enabledProtocols may be {@literal null}.
376+
* @param enabledProtocols must not be {@literal null}.
377377
* @return a new {@link SslConfiguration} with the enabled protocol versions applied.
378-
* @since 2.4
378+
* @since 2.3.2
379+
* @see sun.security.ssl.ProtocolVersion
380+
*/
381+
public SslConfiguration withEnabledProtocols(String... enabledProtocols) {
382+
383+
Assert.notNull(enabledProtocols, "Enabled protocols must not be null");
384+
385+
return withEnabledProtocols(Arrays.asList(enabledProtocols));
386+
}
387+
388+
/**
389+
* Create a new {@link SslConfiguration} with the enabled protocol versions applied
390+
* retaining the other configuration from this instance.
391+
* @param enabledProtocols must not be {@literal null}.
392+
* @return a new {@link SslConfiguration} with the enabled protocol versions applied.
393+
* @since 2.3.2
379394
* @see sun.security.ssl.ProtocolVersion
380395
*/
381396
public SslConfiguration withEnabledProtocols(List<String> enabledProtocols) {
397+
398+
Assert.notNull(enabledProtocols, "Enabled protocols must not be null");
382399
return new SslConfiguration(this.keyStoreConfiguration, this.keyConfiguration, this.trustStoreConfiguration,
383400
enabledProtocols, this.enabledCipherSuites);
384401
}
@@ -388,7 +405,7 @@ public SslConfiguration withEnabledProtocols(List<String> enabledProtocols) {
388405
* indicates that the SSL socket factory should use a default list of enabled cipher
389406
* suites.
390407
* @return the list of enabled SSL cipher suites.
391-
* @since 2.4
408+
* @since 2.3.2
392409
*/
393410
public List<String> getEnabledCipherSuites() {
394411
return this.enabledCipherSuites;
@@ -397,12 +414,30 @@ public List<String> getEnabledCipherSuites() {
397414
/**
398415
* Create a new {@link SslConfiguration} with the enabled cipher suites applied
399416
* retaining the other configuration from this instance.
400-
* @param enabledCipherSuites may be {@literal null}.
417+
* @param enabledCipherSuites must not be {@literal null}.
401418
* @return a new {@link SslConfiguration} with the enabled cipher suites applied.
402-
* @since 2.4
419+
* @since 2.3.2
420+
* @see sun.security.ssl.CipherSuite
421+
*/
422+
public SslConfiguration withEnabledCipherSuites(String... enabledCipherSuites) {
423+
424+
Assert.notNull(enabledProtocols, "Enabled cipher suites must not be null");
425+
426+
return withEnabledCipherSuites(Arrays.asList(enabledCipherSuites));
427+
}
428+
429+
/**
430+
* Create a new {@link SslConfiguration} with the enabled cipher suites applied
431+
* retaining the other configuration from this instance.
432+
* @param enabledCipherSuites must not be {@literal null}.
433+
* @return a new {@link SslConfiguration} with the enabled cipher suites applied.
434+
* @since 2.3.2
403435
* @see sun.security.ssl.CipherSuite
404436
*/
405437
public SslConfiguration withEnabledCipherSuites(List<String> enabledCipherSuites) {
438+
439+
Assert.notNull(enabledProtocols, "Enabled cipher suites must not be null");
440+
406441
return new SslConfiguration(this.keyStoreConfiguration, this.keyConfiguration, this.trustStoreConfiguration,
407442
this.enabledProtocols, enabledCipherSuites);
408443
}

‎spring-vault-core/src/test/java/org/springframework/vault/client/ClientHttpConnectorFactoryIntegrationTests.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@
1515
*/
1616
package org.springframework.vault.client;
1717

18+
import java.util.ArrayList;
19+
import java.util.List;
20+
1821
import org.junit.jupiter.api.Test;
1922

2023
import org.springframework.http.client.reactive.ClientHttpConnector;
@@ -23,17 +26,14 @@
2326
import org.springframework.web.reactive.function.client.WebClient;
2427
import org.springframework.web.reactive.function.client.WebClientResponseException;
2528

26-
import static org.assertj.core.api.AssertionsForClassTypes.assertThat;
27-
import static org.springframework.vault.client.ClientHttpConnectorFactory.JettyClient;
28-
import static org.springframework.vault.client.ClientHttpConnectorFactory.ReactorNetty;
29-
30-
import java.util.ArrayList;
31-
import java.util.List;
29+
import static org.assertj.core.api.AssertionsForClassTypes.*;
30+
import static org.springframework.vault.client.ClientHttpConnectorFactory.*;
3231

3332
/**
3433
* Integration tests for {@link ClientHttpConnectorFactory}.
3534
*
3635
* @author Mark Paluch
36+
* @author Ryan Gow
3737
*/
3838
class ClientHttpConnectorFactoryIntegrationTests {
3939

0 commit comments

Comments
 (0)