[BUG] Outdated proxy's IP address

[willtn]

Describe the bug
A clear and concise description of what the bug is.
Our service use com.azure.security.keyvault.keys.cryptography.CryptographyClient to send requests to Azure Key Vault through our proxy, configured via JAVA_OPTS. Whenever we change the IP address of our proxy, our service becomes unable to connect to Azure key vault via a proxy.

Exception or Stack Trace

Max retries 3 times exceeded. Error Details: connection timed out: proxy.domain.name/100.100.0.237:1000

To Reproduce

1. Start the JVM app with the following options -Dhttp.proxyHost=proxy.domain.name -Dhttp.proxyPort=1000 -Djava.net.useSystemProxies=true
2. Build an Azure CryptographyClient and invoke CryptographyClient.sign. This will succeed.
3. Change the actual IP address of proxy.domain.name in the DNS server.
4. Invoke CryptographyClient.sign again. This will fail.

Code Snippet

// Start the JVM app with the following options `-Dhttp.proxyHost=proxy.domain.name -Dhttp.proxyPort=1000 -Djava.net.useSystemProxies=true`
CryptographyClient cryptoClient = new CryptographyClientBuilder()
        .keyIdentifier(vaultConfig.keyId.toString())
        .credential(credential)
        .buildClient()

cryptoClient.sign(toAzure(vaultConfig.signingAlgorithm), hash)

Expected behavior
The CryptographyClient should connect to the key vault properly through the configured proxy.

Setup (please complete the following information):

azure-security-keyvault-keys: 4.2.5
azure-identity: 1.2.3

Information Checklist

• Bug Description Added
• Repro Steps Added
• Setup information Added

[willtn]

After digging into the library, I believe the root cause is the fact that the proxy's host is resolved per initialization instead of per HTTP requests. According to Java doc, InetSocketAddress attempts to resolve the hostname.

https://github.com/Azure/azure-sdk-for-java/blob/master/sdk/core/azure-core/src/main/java/com/azure/core/http/ProxyOptions.java#L302:L302

[alzimmermsft]

Thank you for filing this issue @willtn.

I'll investigate better handling for validating the socket address per request rather than initialization. For a little more clarification on the issue, the proxy has a DNS name such as https://my-proxy.com which has a backing IP which is non-static.

[willtn]

@alzimmermsft thank you for resolving this issue. When can we expect the releases of azure-security-keyvault-keys and azure-identity containing this patch? Thanks again.

[alzimmermsft]

Hi @willtn, a release containing this fix will be shipped before the end of the week (2021/04/02), I'll update this issue once shipped.

[willtn]

Hello @alzimmermsft , may I get an update on this please? Thanks.

[alzimmermsft]

Thanks for the reminder @willtn, the fix for this shipped in the latest releases of azure-core, azure-core-http-netty, and azure-core-http-okhttp.

Azure Core Changelog
Azure Core HTTP Netty Changelog
Azure Core HTTP OkHttp Changelog