Skip to content

Commit 123cdb6

Browse files
retareta
committed
Fix tests after Apache HttpClient5 / HttpCore5 update since those use deprecated APIs
Signed-off-by: Andriy Redko <[email protected]>
1 parent 36f67f0 commit 123cdb6

File tree

10 files changed

+93
-95
lines changed

10 files changed

+93
-95
lines changed

‎src/main/java/com/amazon/dlic/auth/http/jwt/keybyoidc/KeySetRetriever.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import org.apache.hc.client5.http.impl.classic.HttpClients;
2929
import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
3030
import org.apache.hc.client5.http.io.HttpClientConnectionManager;
31+
import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy;
3132
import org.apache.hc.core5.http.HttpEntity;
3233
import org.apache.logging.log4j.LogManager;
3334
import org.apache.logging.log4j.Logger;
@@ -223,7 +224,7 @@ private CloseableHttpClient createHttpClient(HttpCacheStorage httpCacheStorage)
223224

224225
if (sslConfig != null) {
225226
final HttpClientConnectionManager cm = PoolingHttpClientConnectionManagerBuilder.create()
226-
.setSSLSocketFactory(sslConfig.toSSLConnectionSocketFactory())
227+
.setTlsSocketStrategy(new DefaultClientTlsStrategy(sslConfig.getSslContext()))
227228
.build();
228229

229230
builder.setConnectionManager(cm);

‎src/main/java/org/opensearch/security/auditlog/sink/WebhookSink.java‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,15 @@
3232
import org.apache.hc.client5.http.impl.classic.HttpClients;
3333
import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
3434
import org.apache.hc.client5.http.io.HttpClientConnectionManager;
35+
import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy;
3536
import org.apache.hc.client5.http.ssl.DefaultHostnameVerifier;
3637
import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
37-
import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
38+
import org.apache.hc.client5.http.ssl.TrustAllStrategy;
3839
import org.apache.hc.core5.http.ContentType;
3940
import org.apache.hc.core5.http.io.SocketConfig;
4041
import org.apache.hc.core5.http.io.entity.StringEntity;
42+
import org.apache.hc.core5.reactor.ssl.SSLBufferMode;
4143
import org.apache.hc.core5.ssl.SSLContextBuilder;
42-
import org.apache.hc.core5.ssl.TrustStrategy;
4344
import org.apache.http.HttpStatus;
4445

4546
import org.opensearch.common.settings.Settings;
@@ -368,27 +369,20 @@ CloseableHttpClient getHttpClient() {
368369
.setConnectionRequestTimeout(timeout, TimeUnit.SECONDS)
369370
.build();
370371

371-
final TrustStrategy trustAllStrategy = new TrustStrategy() {
372-
@Override
373-
public boolean isTrusted(X509Certificate[] chain, String authType) {
374-
return true;
375-
}
376-
};
377-
378372
try {
379-
380373
HttpClientBuilder hcb = HttpClients.custom().setDefaultRequestConfig(config);
381374
if (!verifySSL) {
382-
SSLContext sslContext = SSLContextBuilder.create().loadTrustMaterial(trustAllStrategy).build();
383-
final SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
375+
SSLContext sslContext = SSLContextBuilder.create().loadTrustMaterial(TrustAllStrategy.INSTANCE).build();
376+
final DefaultClientTlsStrategy sslsf = new DefaultClientTlsStrategy(
384377
sslContext,
385378
null,
386379
null,
380+
SSLBufferMode.STATIC,
387381
NoopHostnameVerifier.INSTANCE
388382
);
389383

390384
final HttpClientConnectionManager cm = PoolingHttpClientConnectionManagerBuilder.create()
391-
.setSSLSocketFactory(sslsf)
385+
.setTlsSocketStrategy(sslsf)
392386
.setDefaultSocketConfig(SocketConfig.custom().setSoTimeout(timeout, TimeUnit.SECONDS).build())
393387
.build();
394388
hcb.setConnectionManager(cm);
@@ -399,10 +393,16 @@ public boolean isTrusted(X509Certificate[] chain, String authType) {
399393
return HttpClients.custom().setDefaultRequestConfig(config).build();
400394
}
401395
SSLContext sslContext = SSLContextBuilder.create().loadTrustMaterial(effectiveTruststore, null).build();
402-
final SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, null, null, new DefaultHostnameVerifier());
396+
final DefaultClientTlsStrategy sslsf = new DefaultClientTlsStrategy(
397+
sslContext,
398+
null,
399+
null,
400+
SSLBufferMode.STATIC,
401+
new DefaultHostnameVerifier()
402+
);
403403

404404
final HttpClientConnectionManager cm = PoolingHttpClientConnectionManagerBuilder.create()
405-
.setSSLSocketFactory(sslsf)
405+
.setTlsSocketStrategy(sslsf)
406406
.setDefaultSocketConfig(SocketConfig.custom().setSoTimeout(timeout, TimeUnit.SECONDS).build())
407407
.build();
408408
hcb.setConnectionManager(cm);

‎src/main/java/org/opensearch/security/httpclient/HttpClient.java‎

Lines changed: 9 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -30,23 +30,21 @@
3030
import java.util.stream.Collectors;
3131
import javax.net.ssl.HostnameVerifier;
3232
import javax.net.ssl.SSLContext;
33-
import javax.net.ssl.SSLEngine;
3433
import javax.net.ssl.SSLParameters;
3534

3635
import com.google.common.collect.Lists;
3736
import org.apache.hc.client5.http.config.RequestConfig;
3837
import org.apache.hc.client5.http.impl.async.HttpAsyncClientBuilder;
3938
import org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManagerBuilder;
4039
import org.apache.hc.client5.http.nio.AsyncClientConnectionManager;
41-
import org.apache.hc.client5.http.ssl.ClientTlsStrategyBuilder;
40+
import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy;
4241
import org.apache.hc.client5.http.ssl.DefaultHostnameVerifier;
4342
import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
44-
import org.apache.hc.core5.function.Factory;
4543
import org.apache.hc.core5.http.HttpHeaders;
4644
import org.apache.hc.core5.http.HttpHost;
4745
import org.apache.hc.core5.http.message.BasicHeader;
4846
import org.apache.hc.core5.http.nio.ssl.TlsStrategy;
49-
import org.apache.hc.core5.reactor.ssl.TlsDetails;
47+
import org.apache.hc.core5.reactor.ssl.SSLBufferMode;
5048
import org.apache.hc.core5.ssl.PrivateKeyDetails;
5149
import org.apache.hc.core5.ssl.PrivateKeyStrategy;
5250
import org.apache.hc.core5.ssl.SSLContextBuilder;
@@ -280,19 +278,13 @@ public String chooseAlias(Map<String, PrivateKeyDetails> aliases, SSLParameters
280278
final HostnameVerifier hnv = verifyHostnames ? new DefaultHostnameVerifier() : NoopHostnameVerifier.INSTANCE;
281279

282280
final SSLContext sslContext = sslContextBuilder.build();
283-
TlsStrategy tlsStrategy = ClientTlsStrategyBuilder.create()
284-
.setSslContext(sslContext)
285-
.setTlsVersions(supportedProtocols)
286-
.setCiphers(supportedCipherSuites)
287-
.setHostnameVerifier(hnv)
288-
// See please https://issues.apache.org/jira/browse/HTTPCLIENT-2219
289-
.setTlsDetailsFactory(new Factory<SSLEngine, TlsDetails>() {
290-
@Override
291-
public TlsDetails create(final SSLEngine sslEngine) {
292-
return new TlsDetails(sslEngine.getSession(), sslEngine.getApplicationProtocol());
293-
}
294-
})
295-
.build();
281+
final TlsStrategy tlsStrategy = new DefaultClientTlsStrategy(
282+
sslContext,
283+
supportedProtocols,
284+
supportedCipherSuites,
285+
SSLBufferMode.STATIC,
286+
hnv
287+
);
296288

297289
final AsyncClientConnectionManager cm = PoolingAsyncClientConnectionManagerBuilder.create().setTlsStrategy(tlsStrategy).build();
298290
httpClientBuilder.setConnectionManager(cm);

‎src/test/java/com/amazon/dlic/auth/http/jwt/keybyoidc/MockIpdServer.java‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -62,24 +62,27 @@ class MockIpdServer implements Closeable {
6262
this.ssl = ssl;
6363
this.jwks = jwks;
6464

65-
ServerBootstrap serverBootstrap = ServerBootstrap.bootstrap()
66-
.setListenerPort(port)
67-
.register(CTX_DISCOVER, new HttpRequestHandler() {
68-
69-
@Override
70-
public void handle(ClassicHttpRequest request, ClassicHttpResponse response, HttpContext context) throws HttpException,
71-
IOException {
72-
handleDiscoverRequest(request, response, context);
73-
}
74-
})
75-
.register(CTX_KEYS, new HttpRequestHandler() {
76-
77-
@Override
78-
public void handle(ClassicHttpRequest request, ClassicHttpResponse response, HttpContext context) throws HttpException,
79-
IOException {
80-
handleKeysRequest(request, response, context);
81-
}
82-
});
65+
ServerBootstrap serverBootstrap = ServerBootstrap.bootstrap().setListenerPort(port).setRequestRouter((request, context) -> {
66+
if (request.getRequestUri().startsWith(CTX_DISCOVER)) {
67+
return new HttpRequestHandler() {
68+
@Override
69+
public void handle(ClassicHttpRequest request, ClassicHttpResponse response, HttpContext context) throws HttpException,
70+
IOException {
71+
handleDiscoverRequest(request, response, context);
72+
}
73+
};
74+
} else if (request.getRequestUri().startsWith(CTX_KEYS)) {
75+
return new HttpRequestHandler() {
76+
@Override
77+
public void handle(ClassicHttpRequest request, ClassicHttpResponse response, HttpContext context) throws HttpException,
78+
IOException {
79+
handleKeysRequest(request, response, context);
80+
}
81+
};
82+
} else {
83+
return null;
84+
}
85+
});
8386

8487
if (ssl) {
8588
serverBootstrap = serverBootstrap.setSslContext(createSSLContext()).setSslSetupHandler(new Callback<SSLParameters>() {

‎src/test/java/com/amazon/dlic/auth/http/saml/MockSamlIdpServer.java‎

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -195,34 +195,35 @@ class MockSamlIdpServer implements Closeable {
195195

196196
this.loadSigningKeys("saml/kirk-keystore.jks", "kirk");
197197

198-
ServerBootstrap serverBootstrap = ServerBootstrap.bootstrap()
199-
.setListenerPort(port)
200-
.register(CTX_METADATA, new HttpRequestHandler() {
201-
202-
@Override
203-
public void handle(ClassicHttpRequest request, ClassicHttpResponse response, HttpContext context) throws HttpException,
204-
IOException {
205-
206-
handleMetadataRequest(request, response, context);
207-
208-
}
209-
})
210-
.register(CTX_SAML_SSO, new HttpRequestHandler() {
211-
212-
@Override
213-
public void handle(ClassicHttpRequest request, ClassicHttpResponse response, HttpContext context) throws HttpException,
214-
IOException {
215-
handleSsoRequest(request, response, context);
216-
}
217-
})
218-
.register(CTX_SAML_SLO, new HttpRequestHandler() {
219-
220-
@Override
221-
public void handle(ClassicHttpRequest request, ClassicHttpResponse response, HttpContext context) throws HttpException,
222-
IOException {
223-
handleSloRequest(request, response, context);
224-
}
225-
});
198+
ServerBootstrap serverBootstrap = ServerBootstrap.bootstrap().setListenerPort(port).setRequestRouter((request, context) -> {
199+
if (request.getRequestUri().startsWith(CTX_METADATA)) {
200+
return new HttpRequestHandler() {
201+
@Override
202+
public void handle(ClassicHttpRequest request, ClassicHttpResponse response, HttpContext context) throws HttpException,
203+
IOException {
204+
handleMetadataRequest(request, response, context);
205+
}
206+
};
207+
} else if (request.getRequestUri().startsWith(CTX_SAML_SSO)) {
208+
return new HttpRequestHandler() {
209+
@Override
210+
public void handle(ClassicHttpRequest request, ClassicHttpResponse response, HttpContext context) throws HttpException,
211+
IOException {
212+
handleSsoRequest(request, response, context);
213+
}
214+
};
215+
} else if (request.getRequestUri().startsWith(CTX_SAML_SLO)) {
216+
return new HttpRequestHandler() {
217+
@Override
218+
public void handle(ClassicHttpRequest request, ClassicHttpResponse response, HttpContext context) throws HttpException,
219+
IOException {
220+
handleSloRequest(request, response, context);
221+
}
222+
};
223+
} else {
224+
return null;
225+
}
226+
});
226227

227228
if (ssl) {
228229

‎src/test/java/org/opensearch/security/InitializationIntegrationTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ public void testWhoAmIForceHttp1() throws Exception {
178178
Response whoAmIRes = restHighLevelClient.getLowLevelClient().performRequest(new Request("GET", "/_plugins/_security/whoami"));
179179
assertThat(200, is(whoAmIRes.getStatusLine().getStatusCode()));
180180
// The HTTP/1.1 is forced and should be used instead
181-
assertThat(HttpVersion.HTTP_1_1, is(whoAmIRes.getStatusLine().getProtocolVersion()));
181+
assertThat(whoAmIRes.getStatusLine().getProtocolVersion(), is(HttpVersion.HTTP_1_1));
182182
JsonNode whoAmIResNode = DefaultObjectMapper.objectMapper.readTree(whoAmIRes.getEntity().getContent());
183183
String whoAmIResponsePayload = whoAmIResNode.toPrettyString();
184184
assertThat(whoAmIResponsePayload, whoAmIResNode.get("dn").asText(), is("CN=spock,OU=client,O=client,L=Test,C=DE"));

‎src/test/java/org/opensearch/security/auditlog/sink/SinkProviderTLSTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ public void testTlsConfigurationNoFallback() throws Exception {
6565
.setListenerPort(port)
6666
.setHttpProcessor(HttpProcessors.server("Test/1.1"))
6767
.setSslContext(createSSLContext())
68-
.register("*", handler)
68+
.setRequestRouter((request, context) -> handler)
6969
.create();
7070

7171
server.start();

‎src/test/java/org/opensearch/security/auditlog/sink/WebhookAuditLogTest.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -240,7 +240,7 @@ public void postGetHttpTest() throws Exception {
240240
server = ServerBootstrap.bootstrap()
241241
.setListenerPort(port)
242242
.setHttpProcessor(HttpProcessors.server("Test/1.1"))
243-
.register("*", handler)
243+
.setRequestRouter((request, context) -> handler)
244244
.create();
245245

246246
server.start();
@@ -355,7 +355,7 @@ public void httpsTestWithoutTLSServer() throws Exception {
355355
server = ServerBootstrap.bootstrap()
356356
.setListenerPort(port)
357357
.setHttpProcessor(HttpProcessors.server("Test/1.1"))
358-
.register("*", handler)
358+
.setRequestRouter((request, context) -> handler)
359359
.create();
360360

361361
server.start();
@@ -394,7 +394,7 @@ public void httpsTest() throws Exception {
394394
.setListenerPort(port)
395395
.setHttpProcessor(HttpProcessors.server("Test/1.1"))
396396
.setSslContext(createSSLContext())
397-
.register("*", handler)
397+
.setRequestRouter((request, context) -> handler)
398398
.create();
399399

400400
server.start();
@@ -482,7 +482,7 @@ public void httpsTestPemDefault() throws Exception {
482482
.setListenerPort(port)
483483
.setHttpProcessor(HttpProcessors.server("Test/1.1"))
484484
.setSslContext(createSSLContext())
485-
.register("*", handler)
485+
.setRequestRouter((request, context) -> handler)
486486
.create();
487487

488488
server.start();
@@ -611,7 +611,7 @@ public void httpsTestPemEndpoint() throws Exception {
611611
.setListenerPort(port)
612612
.setHttpProcessor(HttpProcessors.server("Test/1.1"))
613613
.setSslContext(createSSLContext())
614-
.register("*", handler)
614+
.setRequestRouter((request, context) -> handler)
615615
.create();
616616

617617
server.start();
@@ -718,7 +718,7 @@ public void httpsTestPemContentEndpoint() throws Exception {
718718
.setListenerPort(port)
719719
.setHttpProcessor(HttpProcessors.server("Test/1.1"))
720720
.setSslContext(createSSLContext())
721-
.register("*", handler)
721+
.setRequestRouter((request, context) -> handler)
722722
.create();
723723

724724
server.start();

‎src/test/java/org/opensearch/security/test/AbstractSecurityUnitTest.java‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@
4444
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakScope.Scope;
4545
import com.google.common.collect.ImmutableList;
4646
import com.google.common.collect.ImmutableSet;
47+
import org.apache.hc.client5.http.config.TlsConfig;
4748
import org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManagerBuilder;
48-
import org.apache.hc.client5.http.nio.AsyncClientConnectionManager;
4949
import org.apache.hc.client5.http.ssl.ClientTlsStrategyBuilder;
5050
import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
5151
import org.apache.hc.core5.function.Factory;
@@ -197,14 +197,13 @@ public TlsDetails create(final SSLEngine sslEngine) {
197197
})
198198
.build();
199199

200-
final AsyncClientConnectionManager cm = PoolingAsyncClientConnectionManagerBuilder.create()
201-
.setTlsStrategy(tlsStrategy)
202-
.build();
203-
builder.setConnectionManager(cm);
200+
final PoolingAsyncClientConnectionManagerBuilder cm = PoolingAsyncClientConnectionManagerBuilder.create()
201+
.setTlsStrategy(tlsStrategy);
202+
204203
if (httpVersionPolicy != null) {
205-
builder.setVersionPolicy(httpVersionPolicy);
204+
cm.setDefaultTlsConfig(TlsConfig.custom().setVersionPolicy(httpVersionPolicy).build());
206205
}
207-
return builder;
206+
return builder.setConnectionManager(cm.build());
208207
});
209208
return new RestHighLevelClient(restClientBuilder);
210209
} catch (Exception e) {

‎src/test/java/org/opensearch/security/test/helper/rest/RestHelper.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -381,7 +381,9 @@ public TlsDetails create(final SSLEngine sslEngine) {
381381
hcb.setConnectionManager(cm);
382382
}
383383

384-
final RequestConfig.Builder requestConfigBuilder = RequestConfig.custom().setResponseTimeout(Timeout.ofSeconds(60));
384+
final RequestConfig.Builder requestConfigBuilder = RequestConfig.custom()
385+
.setResponseTimeout(Timeout.ofSeconds(60))
386+
.setProtocolUpgradeEnabled(false);
385387

386388
return hcb.setDefaultRequestConfig(requestConfigBuilder.build()).disableAutomaticRetries().build();
387389
}

0 commit comments

Comments
 (0)