From fa21b543f1e1b40ee2a74540aad6364a70849224 Mon Sep 17 00:00:00 2001 From: Zoe Wang <33073555+zoewangg@users.noreply.github.com> Date: Fri, 29 Oct 2021 10:38:03 -0700 Subject: [PATCH 1/2] Expose tlsNegotiationTimeout for netty client --- .../feature-NettyNIOHTTPClient-9406031.json | 6 ++++ .../http/SdkHttpConfigurationOption.java | 9 ++++++ .../nio/netty/NettyNioAsyncHttpClient.java | 19 ++++++++++++ .../internal/AwaitCloseChannelPoolMap.java | 2 +- .../internal/ChannelPipelineInitializer.java | 3 +- .../internal/Http1TunnelConnectionPool.java | 21 +++++++++----- .../netty/internal/NettyConfiguration.java | 5 ++++ .../nio/netty/internal/utils/NettyUtils.java | 6 +++- .../NettyNioAsyncHttpClientWireMockTest.java | 15 ++++++++++ .../Http1TunnelConnectionPoolTest.java | 29 ++++++++++--------- .../netty/internal/utils/NettyUtilsTest.java | 6 +++- .../UrlConnectionHttpClient.java | 1 - 12 files changed, 96 insertions(+), 26 deletions(-) create mode 100644 .changes/next-release/feature-NettyNIOHTTPClient-9406031.json diff --git a/.changes/next-release/feature-NettyNIOHTTPClient-9406031.json b/.changes/next-release/feature-NettyNIOHTTPClient-9406031.json new file mode 100644 index 000000000000..d36fbc0e1337 --- /dev/null +++ b/.changes/next-release/feature-NettyNIOHTTPClient-9406031.json @@ -0,0 +1,6 @@ +{ + "category": "Netty NIO HTTP Client", + "contributor": "", + "type": "feature", + "description": "Allow users to configure tlsNegotiationTimeout on NettyNioAsyncHttpClient" +} diff --git a/http-client-spi/src/main/java/software/amazon/awssdk/http/SdkHttpConfigurationOption.java b/http-client-spi/src/main/java/software/amazon/awssdk/http/SdkHttpConfigurationOption.java index ad267264b9c4..7d51658617f1 100644 --- a/http-client-spi/src/main/java/software/amazon/awssdk/http/SdkHttpConfigurationOption.java +++ b/http-client-spi/src/main/java/software/amazon/awssdk/http/SdkHttpConfigurationOption.java @@ -117,12 +117,20 @@ public final class SdkHttpConfigurationOption extends AttributeMap.Key { public static final SdkHttpConfigurationOption TLS_TRUST_MANAGERS_PROVIDER = new SdkHttpConfigurationOption<>("TlsTrustManagersProvider", TlsTrustManagersProvider.class); + /** + * An upper limit on how long from the time a TLS handshake is allowed to take from the time the CLIENT HELLO message is + * sent to the time the client and server have fully negotiated ciphers and exchanged keys. + */ + public static final SdkHttpConfigurationOption TLS_NEGOTIATION_TIMEOUT = + new SdkHttpConfigurationOption<>("TlsNegotiationTimeout", Duration.class); + private static final Duration DEFAULT_SOCKET_READ_TIMEOUT = Duration.ofSeconds(30); private static final Duration DEFAULT_SOCKET_WRITE_TIMEOUT = Duration.ofSeconds(30); private static final Duration DEFAULT_CONNECTION_TIMEOUT = Duration.ofSeconds(2); private static final Duration DEFAULT_CONNECTION_ACQUIRE_TIMEOUT = Duration.ofSeconds(10); private static final Duration DEFAULT_CONNECTION_MAX_IDLE_TIMEOUT = Duration.ofSeconds(60); private static final Duration DEFAULT_CONNECTION_TIME_TO_LIVE = Duration.ZERO; + private static final Duration DEFAULT_TLS_HANDSHAKE_TIMEOUT = Duration.ofSeconds(10); private static final Boolean DEFAULT_REAP_IDLE_CONNECTIONS = Boolean.TRUE; private static final int DEFAULT_MAX_CONNECTIONS = 50; private static final int DEFAULT_MAX_CONNECTION_ACQUIRES = 10_000; @@ -150,6 +158,7 @@ public final class SdkHttpConfigurationOption extends AttributeMap.Key { .put(TCP_KEEPALIVE, DEFAULT_TCP_KEEPALIVE) .put(TLS_KEY_MANAGERS_PROVIDER, DEFAULT_TLS_KEY_MANAGERS_PROVIDER) .put(TLS_TRUST_MANAGERS_PROVIDER, DEFAULT_TLS_TRUST_MANAGERS_PROVIDER) + .put(TLS_NEGOTIATION_TIMEOUT, DEFAULT_TLS_HANDSHAKE_TIMEOUT) .build(); private final String name; diff --git a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClient.java b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClient.java index 03b5eb1a48bb..9b5fe408c0cd 100644 --- a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClient.java +++ b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClient.java @@ -306,6 +306,14 @@ public interface Builder extends SdkAsyncHttpClient.Builder @@ -578,6 +586,17 @@ public void setUseIdleConnectionReaper(Boolean useIdleConnectionReaper) { useIdleConnectionReaper(useIdleConnectionReaper); } + @Override + public Builder tlsNegotiationTimeout(Duration tlsNegotiationTimeout) { + Validate.isPositive(tlsNegotiationTimeout, "tlsNegotiationTimeout"); + standardOptions.put(SdkHttpConfigurationOption.TLS_NEGOTIATION_TIMEOUT, tlsNegotiationTimeout); + return this; + } + + public void setTlsNegotiationTimeout(Duration tlsNegotiationTimeout) { + tlsNegotiationTimeout(tlsNegotiationTimeout); + } + @Override public Builder eventLoopGroup(SdkEventLoopGroup eventLoopGroup) { this.eventLoopGroup = eventLoopGroup; diff --git a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/AwaitCloseChannelPoolMap.java b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/AwaitCloseChannelPoolMap.java index a6ed34f787f3..9bb09e1a7935 100644 --- a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/AwaitCloseChannelPoolMap.java +++ b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/AwaitCloseChannelPoolMap.java @@ -138,7 +138,7 @@ protected SimpleChannelPoolAwareChannelPool newPool(URI key) { tcpChannelPool = new BetterSimpleChannelPool(bootstrap, NOOP_HANDLER); baseChannelPool = new Http1TunnelConnectionPool(bootstrap.config().group().next(), tcpChannelPool, sslContext, proxyAddress(key), proxyConfiguration.username(), proxyConfiguration.password(), - key, pipelineInitializer); + key, pipelineInitializer, configuration); } else { tcpChannelPool = new BetterSimpleChannelPool(bootstrap, pipelineInitializer); baseChannelPool = tcpChannelPool; diff --git a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/ChannelPipelineInitializer.java b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/ChannelPipelineInitializer.java index 2893e6016971..6a26d879489e 100644 --- a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/ChannelPipelineInitializer.java +++ b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/ChannelPipelineInitializer.java @@ -92,7 +92,8 @@ public void channelCreated(Channel ch) { ChannelPipeline pipeline = ch.pipeline(); if (sslCtx != null) { - SslHandler sslHandler = newSslHandler(sslCtx, ch.alloc(), poolKey.getHost(), poolKey.getPort()); + SslHandler sslHandler = newSslHandler(sslCtx, ch.alloc(), poolKey.getHost(), poolKey.getPort(), + configuration.tlsHandshakeTimeout()); pipeline.addLast(sslHandler); pipeline.addLast(SslCloseCompletionEventHandler.getInstance()); diff --git a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/Http1TunnelConnectionPool.java b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/Http1TunnelConnectionPool.java index 06280bc5a243..79112751cd9d 100644 --- a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/Http1TunnelConnectionPool.java +++ b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/Http1TunnelConnectionPool.java @@ -54,27 +54,30 @@ public class Http1TunnelConnectionPool implements ChannelPool { private final URI remoteAddress; private final ChannelPoolHandler handler; private final InitHandlerSupplier initHandlerSupplier; + private final NettyConfiguration nettyConfiguration; public Http1TunnelConnectionPool(EventLoop eventLoop, ChannelPool delegate, SslContext sslContext, URI proxyAddress, String proxyUsername, String proxyPassword, - URI remoteAddress, ChannelPoolHandler handler) { + URI remoteAddress, ChannelPoolHandler handler, NettyConfiguration nettyConfiguration) { this(eventLoop, delegate, sslContext, - proxyAddress, proxyUsername, proxyPassword, remoteAddress, handler, - ProxyTunnelInitHandler::new); + proxyAddress, proxyUsername, proxyPassword, remoteAddress, handler, + ProxyTunnelInitHandler::new, nettyConfiguration); } public Http1TunnelConnectionPool(EventLoop eventLoop, ChannelPool delegate, SslContext sslContext, - URI proxyAddress, URI remoteAddress, ChannelPoolHandler handler) { + URI proxyAddress, URI remoteAddress, ChannelPoolHandler handler, + NettyConfiguration nettyConfiguration) { this(eventLoop, delegate, sslContext, - proxyAddress, null, null, remoteAddress, handler, - ProxyTunnelInitHandler::new); + proxyAddress, null, null, remoteAddress, handler, + ProxyTunnelInitHandler::new, nettyConfiguration); } @SdkTestInternalApi Http1TunnelConnectionPool(EventLoop eventLoop, ChannelPool delegate, SslContext sslContext, URI proxyAddress, String proxyUser, String proxyPassword, URI remoteAddress, - ChannelPoolHandler handler, InitHandlerSupplier initHandlerSupplier) { + ChannelPoolHandler handler, InitHandlerSupplier initHandlerSupplier, + NettyConfiguration nettyConfiguration) { this.eventLoop = eventLoop; this.delegate = delegate; this.sslContext = sslContext; @@ -84,6 +87,7 @@ public Http1TunnelConnectionPool(EventLoop eventLoop, ChannelPool delegate, SslC this.remoteAddress = remoteAddress; this.handler = handler; this.initHandlerSupplier = initHandlerSupplier; + this.nettyConfiguration = nettyConfiguration; } @Override @@ -164,7 +168,8 @@ private SslHandler createSslHandlerIfNeeded(ByteBufAllocator alloc) { return null; } - return newSslHandler(sslContext, alloc, proxyAddress.getHost(), proxyAddress.getPort()); + return newSslHandler(sslContext, alloc, proxyAddress.getHost(), proxyAddress.getPort(), + nettyConfiguration.tlsHandshakeTimeout()); } private static boolean isTunnelEstablished(Channel ch) { diff --git a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/NettyConfiguration.java b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/NettyConfiguration.java index a5b069deacb8..4dd6d7219e72 100644 --- a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/NettyConfiguration.java +++ b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/NettyConfiguration.java @@ -23,6 +23,7 @@ import static software.amazon.awssdk.http.SdkHttpConfigurationOption.TRUST_ALL_CERTIFICATES; import static software.amazon.awssdk.utils.NumericUtils.saturatedCast; +import java.time.Duration; import software.amazon.awssdk.annotations.SdkInternalApi; import software.amazon.awssdk.http.SdkHttpConfigurationOption; import software.amazon.awssdk.http.TlsKeyManagersProvider; @@ -102,4 +103,8 @@ public boolean trustAllCertificates() { public boolean tcpKeepAlive() { return configuration.get(TCP_KEEPALIVE); } + + public Duration tlsHandshakeTimeout() { + return configuration.get(SdkHttpConfigurationOption.TLS_NEGOTIATION_TIMEOUT); + } } diff --git a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/utils/NettyUtils.java b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/utils/NettyUtils.java index 3032f45e0688..cae4e5a538c6 100644 --- a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/utils/NettyUtils.java +++ b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/internal/utils/NettyUtils.java @@ -25,7 +25,9 @@ import io.netty.util.concurrent.GenericFutureListener; import io.netty.util.concurrent.Promise; import io.netty.util.concurrent.SucceededFuture; +import java.time.Duration; import java.util.concurrent.CompletableFuture; +import java.util.concurrent.TimeUnit; import java.util.function.BiConsumer; import java.util.function.Function; import javax.net.ssl.SSLEngine; @@ -196,10 +198,12 @@ public static AttributeKey getOrCreateAttributeKey(String attr) { /** * @return a new {@link SslHandler} with ssl engine configured */ - public static SslHandler newSslHandler(SslContext sslContext, ByteBufAllocator alloc, String peerHost, int peerPort) { + public static SslHandler newSslHandler(SslContext sslContext, ByteBufAllocator alloc, String peerHost, int peerPort, + Duration handshakeTimeout) { // Need to provide host and port to enable SNI // https://github.com/netty/netty/issues/3801#issuecomment-104274440 SslHandler sslHandler = sslContext.newHandler(alloc, peerHost, peerPort); + sslHandler.setHandshakeTimeout(handshakeTimeout.toMillis(), TimeUnit.MILLISECONDS); configureSslEngine(sslHandler.engine()); return sslHandler; } diff --git a/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClientWireMockTest.java b/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClientWireMockTest.java index 843f0a0c4c33..5cd5afae2c58 100644 --- a/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClientWireMockTest.java +++ b/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClientWireMockTest.java @@ -681,6 +681,21 @@ public void createNettyClient_ReadWriteTimeoutCanBeZero() throws Exception { customClient.close(); } + @Test + public void createNettyClient_tlsNegotiationTimeoutNotPositive_shouldThrowException() throws Exception { + assertThatThrownBy(() -> NettyNioAsyncHttpClient.builder() + .tlsNegotiationTimeout(Duration.ZERO) + .build()) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageContaining("must be positive"); + assertThatThrownBy(() -> NettyNioAsyncHttpClient.builder() + .tlsNegotiationTimeout(Duration.ofSeconds(-1)) + .build()) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageContaining("must be positive"); + } + + @Test public void metricsAreCollectedWhenMaxPendingConnectionAcquisitionsAreExceeded() throws Exception { SdkAsyncHttpClient customClient = NettyNioAsyncHttpClient.builder() diff --git a/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/internal/Http1TunnelConnectionPoolTest.java b/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/internal/Http1TunnelConnectionPoolTest.java index 9603fee7fc99..15fc47e58777 100644 --- a/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/internal/Http1TunnelConnectionPoolTest.java +++ b/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/internal/Http1TunnelConnectionPoolTest.java @@ -25,6 +25,7 @@ import static org.mockito.Mockito.verify; import static org.mockito.Mockito.when; import static software.amazon.awssdk.http.nio.netty.internal.Http1TunnelConnectionPool.TUNNEL_ESTABLISHED_KEY; + import io.netty.buffer.ByteBufAllocator; import io.netty.channel.Channel; import io.netty.channel.ChannelHandler; @@ -43,7 +44,6 @@ import java.io.IOException; import java.net.URI; import java.util.List; -import java.util.Map; import java.util.concurrent.CountDownLatch; import javax.net.ssl.SSLEngine; import javax.net.ssl.SSLParameters; @@ -55,7 +55,7 @@ import org.mockito.ArgumentCaptor; import org.mockito.Mock; import org.mockito.runners.MockitoJUnitRunner; -import org.testng.collections.Maps; +import software.amazon.awssdk.http.SdkHttpConfigurationOption; /** * Unit tests for {@link Http1TunnelConnectionPool}. @@ -95,6 +95,8 @@ public class Http1TunnelConnectionPoolTest { @Mock public ChannelId mockId; + public NettyConfiguration configuration; + @Before public void methodSetup() { Future channelFuture = GROUP.next().newSucceededFuture(mockChannel); @@ -106,6 +108,7 @@ public void methodSetup() { when(mockChannel.attr(eq(TUNNEL_ESTABLISHED_KEY))).thenReturn(mockAttr); when(mockChannel.id()).thenReturn(mockId); when(mockChannel.pipeline()).thenReturn(mockPipeline); + configuration = new NettyConfiguration(SdkHttpConfigurationOption.GLOBAL_HTTP_DEFAULTS); } @AfterClass @@ -116,7 +119,7 @@ public static void teardown() { @Test public void tunnelAlreadyEstablished_doesNotAddInitHandler() { Http1TunnelConnectionPool tunnelPool = new Http1TunnelConnectionPool(GROUP.next(), delegatePool, null, - HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler); + HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler, configuration); when(mockAttr.get()).thenReturn(true); @@ -128,7 +131,7 @@ public void tunnelAlreadyEstablished_doesNotAddInitHandler() { @Test(timeout = 1000) public void tunnelNotEstablished_addsInitHandler() throws InterruptedException { Http1TunnelConnectionPool tunnelPool = new Http1TunnelConnectionPool(GROUP.next(), delegatePool, null, - HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler); + HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler, configuration); when(mockAttr.get()).thenReturn(false); @@ -150,7 +153,7 @@ public void tunnelInitFails_acquireFutureFails() { }; Http1TunnelConnectionPool tunnelPool = new Http1TunnelConnectionPool(GROUP.next(), delegatePool, null, - HTTP_PROXY_ADDRESS,null, null, REMOTE_ADDRESS, mockHandler, supplier); + HTTP_PROXY_ADDRESS,null, null, REMOTE_ADDRESS, mockHandler, supplier, configuration); Future acquireFuture = tunnelPool.acquire(); @@ -165,7 +168,7 @@ public void tunnelInitSucceeds_acquireFutureSucceeds() { }; Http1TunnelConnectionPool tunnelPool = new Http1TunnelConnectionPool(GROUP.next(), delegatePool, null, - HTTP_PROXY_ADDRESS, null, null, REMOTE_ADDRESS, mockHandler, supplier); + HTTP_PROXY_ADDRESS, null, null, REMOTE_ADDRESS, mockHandler, supplier, configuration); Future acquireFuture = tunnelPool.acquire(); @@ -175,7 +178,7 @@ public void tunnelInitSucceeds_acquireFutureSucceeds() { @Test public void acquireFromDelegatePoolFails_failsFuture() { Http1TunnelConnectionPool tunnelPool = new Http1TunnelConnectionPool(GROUP.next(), delegatePool, null, - HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler); + HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler, configuration); when(delegatePool.acquire(any(Promise.class))).thenReturn(GROUP.next().newFailedFuture(new IOException("boom"))); @@ -198,7 +201,7 @@ public void sslContextProvided_andProxyUsingHttps_addsSslHandler() { }; Http1TunnelConnectionPool tunnelPool = new Http1TunnelConnectionPool(GROUP.next(), delegatePool, mockSslCtx, - HTTPS_PROXY_ADDRESS, null, null, REMOTE_ADDRESS, mockHandler, supplier); + HTTPS_PROXY_ADDRESS, null, null, REMOTE_ADDRESS, mockHandler, supplier, configuration); tunnelPool.acquire().awaitUninterruptibly(); @@ -219,7 +222,7 @@ public void sslContextProvided_andProxyNotUsingHttps_doesNotAddSslHandler() { }; Http1TunnelConnectionPool tunnelPool = new Http1TunnelConnectionPool(GROUP.next(), delegatePool, mockSslCtx, - HTTP_PROXY_ADDRESS, null, null, REMOTE_ADDRESS, mockHandler, supplier); + HTTP_PROXY_ADDRESS, null, null, REMOTE_ADDRESS, mockHandler, supplier, configuration); tunnelPool.acquire().awaitUninterruptibly(); @@ -232,7 +235,7 @@ public void sslContextProvided_andProxyNotUsingHttps_doesNotAddSslHandler() { @Test public void release_releasedToDelegatePool() { Http1TunnelConnectionPool tunnelPool = new Http1TunnelConnectionPool(GROUP.next(), delegatePool, null, - HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler); + HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler, configuration); tunnelPool.release(mockChannel); verify(delegatePool).release(eq(mockChannel), any(Promise.class)); } @@ -240,7 +243,7 @@ public void release_releasedToDelegatePool() { @Test public void release_withGivenPromise_releasedToDelegatePool() { Http1TunnelConnectionPool tunnelPool = new Http1TunnelConnectionPool(GROUP.next(), delegatePool, null, - HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler); + HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler, configuration); Promise mockPromise = mock(Promise.class); tunnelPool.release(mockChannel, mockPromise); verify(delegatePool).release(eq(mockChannel), eq(mockPromise)); @@ -249,7 +252,7 @@ public void release_withGivenPromise_releasedToDelegatePool() { @Test public void close_closesDelegatePool() { Http1TunnelConnectionPool tunnelPool = new Http1TunnelConnectionPool(GROUP.next(), delegatePool, null, - HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler); + HTTP_PROXY_ADDRESS, REMOTE_ADDRESS, mockHandler, configuration); tunnelPool.close(); verify(delegatePool).close(); } @@ -266,7 +269,7 @@ public void proxyAuthProvided_addInitHandler_withAuth(){ }; Http1TunnelConnectionPool tunnelPool = new Http1TunnelConnectionPool(GROUP.next(), delegatePool, null, - HTTP_PROXY_ADDRESS, PROXY_USER, PROXY_PASSWORD, REMOTE_ADDRESS, mockHandler, supplier); + HTTP_PROXY_ADDRESS, PROXY_USER, PROXY_PASSWORD, REMOTE_ADDRESS, mockHandler, supplier, configuration); tunnelPool.acquire().awaitUninterruptibly(); diff --git a/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/internal/utils/NettyUtilsTest.java b/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/internal/utils/NettyUtilsTest.java index 84f450100a46..3b27dd1c78e8 100644 --- a/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/internal/utils/NettyUtilsTest.java +++ b/http-clients/netty-nio-client/src/test/java/software/amazon/awssdk/http/nio/netty/internal/utils/NettyUtilsTest.java @@ -28,6 +28,7 @@ import io.netty.handler.ssl.SslHandler; import io.netty.util.AttributeKey; import io.netty.util.concurrent.EventExecutor; +import java.time.Duration; import javax.net.ssl.SSLEngine; import org.junit.Test; import software.amazon.awssdk.http.nio.netty.internal.MockChannel; @@ -46,7 +47,10 @@ public void newSslHandler_sslEngineShouldBeConfigured() throws Exception { Channel channel = null; try { channel = new MockChannel(); - SslHandler sslHandler = NettyUtils.newSslHandler(sslContext, channel.alloc(), "localhost", 80); + SslHandler sslHandler = NettyUtils.newSslHandler(sslContext, channel.alloc(), "localhost", 80, + Duration.ofMillis(1000)); + + assertThat(sslHandler.getHandshakeTimeoutMillis()).isEqualTo(1000); SSLEngine engine = sslHandler.engine(); assertThat(engine.getSSLParameters().getEndpointIdentificationAlgorithm()).isEqualTo("HTTPS"); } finally { diff --git a/http-clients/url-connection-client/src/main/java/software/amazon/awssdk/http/urlconnection/UrlConnectionHttpClient.java b/http-clients/url-connection-client/src/main/java/software/amazon/awssdk/http/urlconnection/UrlConnectionHttpClient.java index 1fa17930673e..ae419a7bfef2 100644 --- a/http-clients/url-connection-client/src/main/java/software/amazon/awssdk/http/urlconnection/UrlConnectionHttpClient.java +++ b/http-clients/url-connection-client/src/main/java/software/amazon/awssdk/http/urlconnection/UrlConnectionHttpClient.java @@ -152,7 +152,6 @@ private HttpURLConnection createDefaultConnection(URI uri, SSLSocketFactory sock if (options.get(SdkHttpConfigurationOption.TRUST_ALL_CERTIFICATES)) { httpsConnection.setHostnameVerifier(NoOpHostNameVerifier.INSTANCE); } - httpsConnection.setSSLSocketFactory(socketFactory); } From 6a433cb88e90ebaa40ec5ca1ba8710c1ae6e709c Mon Sep 17 00:00:00 2001 From: Zoe Wang <33073555+zoewangg@users.noreply.github.com> Date: Mon, 1 Nov 2021 11:54:00 -0700 Subject: [PATCH 2/2] Fix javadocs --- .../amazon/awssdk/http/SdkHttpConfigurationOption.java | 4 ++-- .../amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClient.java | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/http-client-spi/src/main/java/software/amazon/awssdk/http/SdkHttpConfigurationOption.java b/http-client-spi/src/main/java/software/amazon/awssdk/http/SdkHttpConfigurationOption.java index 7d51658617f1..3611c5239108 100644 --- a/http-client-spi/src/main/java/software/amazon/awssdk/http/SdkHttpConfigurationOption.java +++ b/http-client-spi/src/main/java/software/amazon/awssdk/http/SdkHttpConfigurationOption.java @@ -118,8 +118,8 @@ public final class SdkHttpConfigurationOption extends AttributeMap.Key { new SdkHttpConfigurationOption<>("TlsTrustManagersProvider", TlsTrustManagersProvider.class); /** - * An upper limit on how long from the time a TLS handshake is allowed to take from the time the CLIENT HELLO message is - * sent to the time the client and server have fully negotiated ciphers and exchanged keys. + * The maximum amount of time that a TLS handshake is allowed to take from the time the CLIENT HELLO + * message is sent to the time the client and server have fully negotiated ciphers and exchanged keys. */ public static final SdkHttpConfigurationOption TLS_NEGOTIATION_TIMEOUT = new SdkHttpConfigurationOption<>("TlsNegotiationTimeout", Duration.class); diff --git a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClient.java b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClient.java index 9b5fe408c0cd..7a1e28b07c09 100644 --- a/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClient.java +++ b/http-clients/netty-nio-client/src/main/java/software/amazon/awssdk/http/nio/netty/NettyNioAsyncHttpClient.java @@ -310,6 +310,10 @@ public interface Builder extends SdkAsyncHttpClient.Builder + * By default, it's 10 seconds. + * * @return this builder for method chaining. */ Builder tlsNegotiationTimeout(Duration tlsNegotiationTimeout);