Skip to content

Commit 0ca4f8b

Browse files
kannanjgithubkannanjgithub
committed
Save changes.
1 parent 825b954 commit 0ca4f8b

File tree

6 files changed

+36
-20
lines changed

6 files changed

+36
-20
lines changed

‎xds/src/main/java/io/grpc/xds/EnvoyServerProtoData.java‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,8 @@ public UpstreamTlsContext(io.envoyproxy.envoy.extensions.transport_sockets.tls.v
9696
public static UpstreamTlsContext fromEnvoyProtoUpstreamTlsContext(
9797
io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
9898
upstreamTlsContext) {
99-
return new UpstreamTlsContext(upstreamTlsContext);
99+
UpstreamTlsContext o = new UpstreamTlsContext(upstreamTlsContext);
100+
return o;
100101
}
101102

102103
public String getSni() {
@@ -113,7 +114,12 @@ public boolean getAutoSniSanValidation() {
113114

114115
@Override
115116
public String toString() {
116-
return "UpstreamTlsContext{" + "commonTlsContext=" + commonTlsContext + '}';
117+
return "UpstreamTlsContext{" +
118+
"commonTlsContext=" + commonTlsContext
119+
+ "sni=" + sni
120+
+ "\nauto_host_sni=" + auto_host_sni
121+
+ "\nauto_sni_san_validation=" + auto_sni_san_validation
122+
+ "}";
117123
}
118124
}
119125

‎xds/src/main/java/io/grpc/xds/internal/security/certprovider/CertProviderClientSslContextProvider.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ final class CertProviderClientSslContextProvider extends CertProviderSslContextP
6363
staticCertValidationContext,
6464
upstreamTlsContext,
6565
certificateProviderStore);
66+
this.sniForSanMatching = upstreamTlsContext.getAutoSniSanValidation()? sniForSanMatching : null;
6667
if (rootCertInstance == null
6768
&& CommonTlsContextUtil.isUsingSystemRootCerts(tlsContext.getCommonTlsContext())
6869
&& !isMtls()) {
@@ -74,7 +75,6 @@ final class CertProviderClientSslContextProvider extends CertProviderSslContextP
7475
throw new RuntimeException(e);
7576
}
7677
}
77-
this.sniForSanMatching = upstreamTlsContext.getAutoSniSanValidation()? sniForSanMatching : null;
7878
}
7979

8080
@Override

‎xds/src/test/java/io/grpc/xds/XdsSecurityClientServerTest.java‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -221,7 +221,7 @@ public void tlsClientServer_useSystemRootCerts_noMtls_useCombinedValidationConte
221221

222222
UpstreamTlsContext upstreamTlsContext =
223223
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
224-
CLIENT_PEM_FILE, true, SAN_TO_MATCH, false, null);
224+
CLIENT_PEM_FILE, true, SAN_TO_MATCH, false, null, false);
225225

226226
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
227227
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -248,7 +248,7 @@ public void tlsClientServer_useSystemRootCerts_noMtls_validationContext() throws
248248

249249
UpstreamTlsContext upstreamTlsContext =
250250
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
251-
CLIENT_PEM_FILE, false, SAN_TO_MATCH, false, null);
251+
CLIENT_PEM_FILE, false, SAN_TO_MATCH, false, null, false);
252252

253253
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
254254
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -271,7 +271,7 @@ public void tlsClientServer_useSystemRootCerts_mtls() throws Exception {
271271

272272
UpstreamTlsContext upstreamTlsContext =
273273
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
274-
CLIENT_PEM_FILE, true, SAN_TO_MATCH, true, null);
274+
CLIENT_PEM_FILE, true, SAN_TO_MATCH, true, null, false);
275275

276276
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
277277
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -299,7 +299,7 @@ public void tlsClientServer_useSystemRootCerts_noAutoSniValidation_failureToMatc
299299

300300
UpstreamTlsContext upstreamTlsContext =
301301
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
302-
CLIENT_PEM_FILE, true, "server1.test.google.in", false, null);
302+
CLIENT_PEM_FILE, true, "server1.test.google.in", false, null, false);
303303

304304
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
305305
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -330,9 +330,12 @@ public void tlsClientServer_useSystemRootCerts_autoSniValidation()
330330
UpstreamTlsContext upstreamTlsContext =
331331
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
332332
CLIENT_PEM_FILE, true,
333-
// won't be used
333+
// SAN matcher in CommonValidationContext. Will be overridden by autoSniSanValidation
334334
"server1.test.google.in",
335-
false, SAN_TO_MATCH);
335+
false,
336+
// SNI in UpstreamTlsContext
337+
SAN_TO_MATCH,
338+
true);
336339

337340
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
338341
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -359,7 +362,7 @@ public void tlsClientServer_useSystemRootCerts_requireClientAuth() throws Except
359362

360363
UpstreamTlsContext upstreamTlsContext =
361364
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
362-
CLIENT_PEM_FILE, true, SAN_TO_MATCH, false, null);
365+
CLIENT_PEM_FILE, true, SAN_TO_MATCH, false, null, false);
363366

364367
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
365368
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -641,7 +644,11 @@ private UpstreamTlsContext setBootstrapInfoAndBuildUpstreamTlsContext(String cli
641644
private UpstreamTlsContext setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(
642645
String clientKeyFile,
643646
String clientPemFile,
644-
boolean useCombinedValidationContext, String sanToMatch, boolean isMtls, String sni) {
647+
boolean useCombinedValidationContext,
648+
String sanToMatch,
649+
boolean isMtls,
650+
String sniInUpstreamTlsContext,
651+
boolean autoSniSanValidation) {
645652
bootstrapInfoForClient = CommonBootstrapperTestUtils
646653
.buildBootstrapInfo("google_cloud_private_spiffe-client", clientKeyFile, clientPemFile,
647654
CA_PEM_FILE, null, null, null, null, null);
@@ -656,7 +663,7 @@ private UpstreamTlsContext setBootstrapInfoAndBuildUpstreamTlsContextForUsingSys
656663
.addMatchSubjectAltNames(
657664
StringMatcher.newBuilder()
658665
.setExact(sanToMatch))
659-
.build(), sni, false);
666+
.build(), sniInUpstreamTlsContext, false, autoSniSanValidation);
660667
}
661668
return CommonTlsContextTestsUtil.buildNewUpstreamTlsContextForCertProviderInstance(
662669
"google_cloud_private_spiffe-client", "ROOT", null,

‎xds/src/test/java/io/grpc/xds/internal/security/ClientSslContextProviderFactoryTest.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ public void createCertProviderClientSslContextProvider() throws XdsInitializatio
7979
"gcp_id",
8080
"root-default",
8181
/* alpnProtocols= */ null,
82-
/* staticCertValidationContext= */ null, null, false);
82+
/* staticCertValidationContext= */ null, null, false, false);
8383

8484
Bootstrapper.BootstrapInfo bootstrapInfo = CommonBootstrapperTestUtils.getTestBootstrapInfo();
8585
clientSslContextProviderFactory =
@@ -138,7 +138,7 @@ public void createCertProviderClientSslContextProvider_onlyRootCert()
138138
"gcp_id",
139139
"root-default",
140140
/* alpnProtocols= */ null,
141-
/* staticCertValidationContext= */ null, null, false);
141+
/* staticCertValidationContext= */ null, null, false, false);
142142

143143
Bootstrapper.BootstrapInfo bootstrapInfo = CommonBootstrapperTestUtils.getTestBootstrapInfo();
144144
clientSslContextProviderFactory =
@@ -172,7 +172,7 @@ public void createCertProviderClientSslContextProvider_withStaticContext()
172172
"gcp_id",
173173
"root-default",
174174
/* alpnProtocols= */ null,
175-
staticCertValidationContext, null, false);
175+
staticCertValidationContext, null, false, false);
176176

177177
Bootstrapper.BootstrapInfo bootstrapInfo = CommonBootstrapperTestUtils.getTestBootstrapInfo();
178178
clientSslContextProviderFactory =
@@ -202,7 +202,7 @@ public void createCertProviderClientSslContextProvider_2providers()
202202
"file_provider",
203203
"root-default",
204204
/* alpnProtocols= */ null,
205-
/* staticCertValidationContext= */ null, null, false);
205+
/* staticCertValidationContext= */ null, null, false, false);
206206

207207
Bootstrapper.BootstrapInfo bootstrapInfo = CommonBootstrapperTestUtils.getTestBootstrapInfo();
208208
clientSslContextProviderFactory =

‎xds/src/test/java/io/grpc/xds/internal/security/CommonTlsContextTestsUtil.java‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ public static EnvoyServerProtoData.UpstreamTlsContext buildUpstreamTlsContext(
173173
null,
174174
null,
175175
sni,
176-
autoHostSni);
176+
autoHostSni, false);
177177
}
178178

179179
/** Gets a cert from contents of a resource. */
@@ -284,7 +284,10 @@ private static CommonTlsContext.Builder addNewCertificateValidationContext(
284284
@Nullable String rootInstanceName,
285285
@Nullable String rootCertName,
286286
Iterable<String> alpnProtocols,
287-
CertificateValidationContext staticCertValidationContext, String sni, boolean autoHostSni) {
287+
CertificateValidationContext staticCertValidationContext,
288+
String sni,
289+
boolean autoHostSni,
290+
boolean autoSniSanValidation) {
288291
return buildUpstreamTlsContext(
289292
buildCommonTlsContextForCertProviderInstance(
290293
certInstanceName,
@@ -293,7 +296,7 @@ private static CommonTlsContext.Builder addNewCertificateValidationContext(
293296
rootCertName,
294297
alpnProtocols,
295298
staticCertValidationContext),
296-
sni, autoHostSni, false);
299+
sni, autoHostSni, autoSniSanValidation);
297300
}
298301

299302
/** Helper method to build UpstreamTlsContext for CertProvider tests. */

‎xds/src/test/java/io/grpc/xds/internal/security/certprovider/CertProviderClientSslContextProviderTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ private CertProviderClientSslContextProvider getSslContextProvider(
9494
"root-default",
9595
alpnProtocols,
9696
staticCertValidationContext,
97-
null, false);
97+
null, false, false);
9898
}
9999
return (CertProviderClientSslContextProvider)
100100
certProviderClientSslContextProviderFactory.getProvider(

0 commit comments

Comments
 (0)