4.x: TLS replace in HelidonConnector fix (#8247)

TLS replace in HelidonConnector fix

Signed-off-by: David Kral <david.k.kral@oracle.com>

jersey/connector/src/main/java/io/helidon/jersey/connector/HelidonConnector.java

@@ -46,6 +46,7 @@
 import jakarta.ws.rs.core.Response;
 import org.glassfish.jersey.client.ClientRequest;
 import org.glassfish.jersey.client.ClientResponse;
+import org.glassfish.jersey.client.JerseyClient;
 import org.glassfish.jersey.client.spi.AsyncConnectorCallback;
 import org.glassfish.jersey.client.spi.Connector;
 import org.glassfish.jersey.internal.util.PropertiesHelper;
@@ -82,7 +83,8 @@ class HelidonConnector implements Connector {
         var builder = WebClientConfig.builder();
 
         // use config for client
-        builder.config(helidonConfig(config).orElse(Config.empty()));
+        Config helidonConfig = helidonConfig(config).orElse(Config.empty());
+        builder.config(helidonConfig);
 
         // proxy support
         proxy = ProxyBuilder.createProxy(config).orElse(Proxy.create());
@@ -98,11 +100,18 @@ class HelidonConnector implements Connector {
             builder.followRedirects(getValue(properties, FOLLOW_REDIRECTS, true));
         }
 
-        // prefer Tls over SSLContext
-        if (properties.containsKey(TLS)) {
-            builder.tls(getValue(properties, TLS, Tls.class));
-        } else if (client.getSslContext() != null) {
-            builder.tls(Tls.builder().sslContext(client.getSslContext()).build());
+        //Whether WebClient TLS has been already set via config
+        boolean helidonConfigTlsSet = helidonConfig.map(hc -> hc.get("tls").exists()).orElse(false);
+        boolean isJerseyClient = client instanceof JerseyClient;
+        //Whether Jersey client has non-default SslContext set. If so, we should honor these settings
+        boolean jerseyHasDefaultSsl = isJerseyClient && ((JerseyClient) client).isDefaultSslContext();
+
+        if (!helidonConfigTlsSet || !isJerseyClient || !jerseyHasDefaultSsl) {// prefer Tls over SSLContext
+            if (properties.containsKey(TLS)) {
+                builder.tls(getValue(properties, TLS, Tls.class));
+            } else if (client.getSslContext() != null) {
+                builder.tls(Tls.builder().sslContext(client.getSslContext()).build());
+            }
         }
 
         // protocol configs

tests/integration/pom.xml

@@ -59,6 +59,7 @@
         <module>native-image</module>
         <module>oidc</module>
         <module>restclient</module>
+        <module>restclient-connector</module>
         <module>security</module>
         <module>vault</module>
         <module>zipkin-mp-2.2</module>

tests/integration/restclient-connector/pom.xml

@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Copyright (c) 2024 Oracle and/or its affiliates.
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+-->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>io.helidon.tests.integration</groupId>
+        <artifactId>helidon-tests-integration</artifactId>
+        <version>4.0.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>helidon-tests-integration-restclient-connector</artifactId>
+    <name>Helidon Integration Test RestClient Webclient Connector</name>
+
+    <dependencies>
+        <dependency>
+            <groupId>io.helidon.microprofile.bundles</groupId>
+            <artifactId>helidon-microprofile</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.helidon.microprofile.rest-client</groupId>
+            <artifactId>helidon-microprofile-rest-client</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.smallrye</groupId>
+            <artifactId>jandex</artifactId>
+            <scope>runtime</scope>
+            <optional>true</optional>
+        </dependency>
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-api</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hamcrest</groupId>
+            <artifactId>hamcrest-all</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.helidon.microprofile.testing</groupId>
+            <artifactId>helidon-microprofile-testing-junit5</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.helidon.jersey</groupId>
+            <artifactId>helidon-jersey-connector</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+</project>

tests/integration/restclient-connector/src/main/java/io/helidon/tests/integration/resclient/connector/GreetResource.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2024 Oracle and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.helidon.tests.integration.resclient.connector;
+
+import java.util.Collections;
+
+import jakarta.json.Json;
+import jakarta.json.JsonBuilderFactory;
+import jakarta.json.JsonObject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+
+/**
+ * A typical greet resource that only handles a single GET for a default message.
+ */
+@Path("/greet")
+public class GreetResource {
+
+    private static final JsonBuilderFactory JSON = Json.createBuilderFactory(Collections.emptyMap());
+
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    public JsonObject getDefaultMessage() {
+        return createResponse("World");
+    }
+
+    private JsonObject createResponse(String who) {
+        String msg = String.format("%s %s!", "Hello", who);
+
+        return JSON.createObjectBuilder()
+                .add("message", msg)
+                .build();
+    }
+}

tests/integration/restclient-connector/src/main/java/io/helidon/tests/integration/resclient/connector/GreetResourceClient.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2024 Oracle and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.helidon.tests.integration.resclient.connector;
+
+import jakarta.json.JsonObject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import org.eclipse.microprofile.rest.client.annotation.RegisterProvider;
+
+/**
+ * RestClient interface for a simple greet resource that includes a few FT annotations.
+ */
+@Path("/greet")
+@RegisterProvider(GreetResourceFilter.class)
+public interface GreetResourceClient {
+
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    JsonObject getDefaultMessage();
+
+}

tests/integration/restclient-connector/src/main/java/io/helidon/tests/integration/resclient/connector/GreetResourceFilter.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2024 Oracle and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.helidon.tests.integration.resclient.connector;
+
+import java.io.IOException;
+import java.net.URI;
+
+import io.helidon.common.context.Contexts;
+
+import jakarta.ws.rs.client.ClientRequestContext;
+import jakarta.ws.rs.client.ClientRequestFilter;
+
+/**
+ * A client request filter that replaces port 8080 by the ephemeral port allocated for the
+ * webserver in each run. This is necessary since {@link GreetResourceClient} uses an annotation
+ * to specify the base URI, and its value cannot be changed dynamically.
+ */
+public class GreetResourceFilter implements ClientRequestFilter  {
+
+    @Override
+    public void filter(ClientRequestContext requestContext) throws IOException {
+        URI uri = requestContext.getUri();
+        String fixedUri = uri.toString().replace("8080", extractDynamicPort());
+        requestContext.setUri(URI.create(fixedUri));
+    }
+
+    private String extractDynamicPort() {
+        URI uri = Contexts.globalContext().get(getClass(), URI.class).orElseThrow();
+        String uriString = uri.toString();
+        int k = uriString.lastIndexOf(":");
+        int j = uriString.indexOf("/", k);
+        j = j < 0 ? uriString.length() : j; //Prevent failing if / is missing after the port
+        return uriString.substring(k + 1, j);
+    }
+}

tests/integration/restclient-connector/src/main/java/io/helidon/tests/integration/resclient/connector/package-info.java

@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) 2024 Oracle and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.helidon.tests.integration.resclient.connector;

tests/integration/restclient-connector/src/main/resources/META-INF/beans.xml

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Copyright (c) 2024 Oracle and/or its affiliates.
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+  -->
+
+<beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
+                           http://xmlns.jcp.org/xml/ns/javaee/beans_2_0.xsd"
+       version="2.0"
+       bean-discovery-mode="annotated">
+</beans>

tests/integration/restclient-connector/src/test/java/io/helidon/tests/integration/restclient/connector/TlsTest.java

@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2024 Oracle and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.helidon.tests.integration.restclient.connector;
+
+import java.io.UncheckedIOException;
+import java.net.URI;
+import java.security.NoSuchAlgorithmException;
+import java.util.Map;
+
+import javax.net.ssl.SSLContext;
+
+import io.helidon.common.context.Contexts;
+import io.helidon.config.Config;
+import io.helidon.config.ConfigSources;
+import io.helidon.jersey.connector.HelidonProperties;
+import io.helidon.microprofile.testing.junit5.Configuration;
+import io.helidon.microprofile.testing.junit5.HelidonTest;
+import io.helidon.tests.integration.resclient.connector.GreetResourceClient;
+import io.helidon.tests.integration.resclient.connector.GreetResourceFilter;
+
+import jakarta.json.JsonObject;
+import jakarta.ws.rs.ProcessingException;
+import jakarta.ws.rs.client.WebTarget;
+import org.eclipse.microprofile.rest.client.RestClientBuilder;
+import org.junit.jupiter.api.Test;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.endsWith;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+@HelidonTest
+@Configuration(configSources = "tls-config.properties")
+public class TlsTest {
+
+    @Test
+    void testHelloWorld(WebTarget target) {
+        Config config = Config.create(ConfigSources.create(Map.of("tls.trust-all", "true")));
+        Contexts.globalContext().register(GreetResourceFilter.class, target.getUri());
+
+        GreetResourceClient client = RestClientBuilder.newBuilder()
+                .baseUri(URI.create("https://localhost:8080"))
+                .property(HelidonProperties.CONFIG, config)
+                .build(GreetResourceClient.class);
+
+        JsonObject defaultMessage = client.getDefaultMessage();
+        assertThat(defaultMessage.toString(), is("{\"message\":\"Hello World!\"}"));
+    }
+
+    @Test
+    void restClientSslContextPriority(WebTarget target) throws NoSuchAlgorithmException {
+        Config config = Config.create(ConfigSources.create(Map.of("tls.trust-all", "true")));
+        Contexts.globalContext().register(GreetResourceFilter.class, target.getUri());
+
+        GreetResourceClient client = RestClientBuilder.newBuilder()
+                .baseUri(URI.create("https://localhost:8080"))
+                .property(HelidonProperties.CONFIG, config)
+                .sslContext(SSLContext.getDefault())
+                .build(GreetResourceClient.class);
+
+        ProcessingException exception = assertThrows(ProcessingException.class, client::getDefaultMessage);
+        assertThat(exception.getCause(), instanceOf(UncheckedIOException.class));
+        assertThat(exception.getCause().getMessage(), endsWith("Failed to execute SSL handshake"));
+    }
+
+
+}