Delay creating insecure trust manager

FIPS 140-2 isn't keen on alternative trust managers. This
delays the creation of an insecure trust manager until someone
tries to use it.

Author: ryfow

src/clj_http/conn_mgr.clj

@@ -25,26 +25,28 @@
            (org.apache.http.nio.conn NoopIOSessionStrategy)))
 
 (def ^:private insecure-context-verifier
-  {
-   :context (-> (SSLContexts/custom)
-                (.loadTrustMaterial nil (reify TrustStrategy
-                                          (isTrusted [_ _ _] true)))
-                (.build))
-   :verifier NoopHostnameVerifier/INSTANCE})
-
-(def ^SSLConnectionSocketFactory insecure-socket-factory
-  (let [{:keys [context  verifier]} insecure-context-verifier]
-    (SSLConnectionSocketFactory. ^SSLContext context
-                                 ^HostnameVerifier verifier)))
-
-(def ^SSLIOSessionStrategy insecure-strategy
-  (let [{:keys [context  verifier]} insecure-context-verifier]
-    (SSLIOSessionStrategy. ^SSLContext context ^HostnameVerifier verifier)))
-
-(def ^SSLConnectionSocketFactory secure-ssl-socket-factory
+  (delay {
+          :context (-> (SSLContexts/custom)
+                       (.loadTrustMaterial nil (reify TrustStrategy
+                                                 (isTrusted [_ _ _] true)))
+                       (.build))
+          :verifier NoopHostnameVerifier/INSTANCE}))
+
+(def ^:private insecure-socket-factory
+  (delay
+   (let [{:keys [context  verifier]} @insecure-context-verifier]
+     (SSLConnectionSocketFactory. ^SSLContext context
+                                  ^HostnameVerifier verifier))))
+
+(def ^:private insecure-strategy
+  (delay
+   (let [{:keys [context  verifier]} @insecure-context-verifier]
+     (SSLIOSessionStrategy. ^SSLContext context ^HostnameVerifier verifier))))
+
+(def ^:private ^SSLConnectionSocketFactory secure-ssl-socket-factory
   (SSLConnectionSocketFactory/getSocketFactory))
 
-(def ^SSLIOSessionStrategy secure-strategy
+(def ^:private ^SSLIOSessionStrategy secure-strategy
   (SSLIOSessionStrategy/getDefaultStrategy))
 
 (defn ^SSLConnectionSocketFactory SSLGenericSocketFactory
@@ -119,25 +121,27 @@
                  (.build))]
      (PoolingHttpClientConnectionManager. reg))))
 
-(def insecure-scheme-registry
-  (-> (RegistryBuilder/create)
-      (.register "http" PlainConnectionSocketFactory/INSTANCE)
-      (.register "https" insecure-socket-factory)
-      (.build)))
-
-(def insecure-strategy-registry
-  (-> (RegistryBuilder/create)
-      (.register "http" NoopIOSessionStrategy/INSTANCE)
-      (.register "https" insecure-strategy)
-      (.build)))
-
-(def regular-scheme-registry
+(def ^:private insecure-scheme-registry
+  (delay
+   (-> (RegistryBuilder/create)
+       (.register "http" PlainConnectionSocketFactory/INSTANCE)
+       (.register "https" ^SSLConnectionSocketFactory @insecure-socket-factory)
+       (.build))))
+
+(def ^:private insecure-strategy-registry
+  (delay
+   (-> (RegistryBuilder/create)
+       (.register "http" NoopIOSessionStrategy/INSTANCE)
+       (.register "https" ^SSLIOSessionStrategy @insecure-strategy)
+       (.build))))
+
+(def ^:private regular-scheme-registry
   (-> (RegistryBuilder/create)
       (.register "http" (PlainConnectionSocketFactory/getSocketFactory))
       (.register "https" secure-ssl-socket-factory)
       (.build)))
 
-(def regular-strategy-registry
+(def ^:private regular-strategy-registry
   (-> (RegistryBuilder/create)
       (.register "http" NoopIOSessionStrategy/INSTANCE)
       (.register "https" secure-strategy)
@@ -170,7 +174,7 @@
     (BasicHttpClientConnectionManager. (get-keystore-scheme-registry req))
 
     (opt req :insecure) (BasicHttpClientConnectionManager.
-                         insecure-scheme-registry)
+                         @insecure-scheme-registry)
 
     :else (BasicHttpClientConnectionManager. regular-scheme-registry)))
 
@@ -200,7 +204,7 @@
                              (get-keystore-strategy-registry req)
 
                              (opt req :insecure)
-                             insecure-strategy-registry
+                             @insecure-strategy-registry
 
                              :else regular-strategy-registry)
         io-reactor (make-ioreactor {:shutdown-grace-period 1})]
@@ -218,7 +222,7 @@
   timeout value."
   [{:keys [timeout keystore trust-store] :as config}]
   (let [registry (cond
-                   (opt config :insecure) insecure-scheme-registry
+                   (opt config :insecure) @insecure-scheme-registry
 
                    (or keystore trust-store)
                    (get-keystore-scheme-registry config)
@@ -271,7 +275,7 @@
 (defn- ^PoolingNHttpClientConnectionManager make-reusable-async-conn-manager*
   [{:keys [timeout keystore trust-store io-config] :as config}]
   (let [registry (cond
-                   (opt config :insecure) insecure-strategy-registry
+                   (opt config :insecure) @insecure-strategy-registry
 
                    (or keystore trust-store)
                    (get-keystore-scheme-registry config)