Skip to content

Commit 2ecbdb9

Browse files
kannanjgithubkannanjgithub
committed
Save changes.
1 parent b8dba99 commit 2ecbdb9

File tree

5 files changed

+63
-29
lines changed

5 files changed

+63
-29
lines changed

‎xds/src/main/java/io/grpc/xds/GcpAuthenticationFilter.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -198,8 +198,6 @@ public <ReqT, RespT> ClientCall<ReqT, RespT> interceptCall(
198198
} else {
199199
callOptions = callOptions.withCallCredentials(newCallCredentials);
200200
}
201-
logger.log(XdsLogLevel.INFO, "Time to expiry of the auth token=" + callOptions.getDeadline().timeRemaining(
202-
TimeUnit.SECONDS));
203201
return next.newCall(method, callOptions);
204202
}
205203
};

‎xds/src/main/java/io/grpc/xds/internal/security/certprovider/CertProviderClientSslContextProvider.java‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -85,18 +85,23 @@ protected final SslContextBuilder getSslContextBuilder(
8585
if (rootCertInstance != null) {
8686
if (savedSpiffeTrustMap != null) {
8787
sslContextBuilder = sslContextBuilder.trustManager(
88-
new XdsTrustManagerFactory(
89-
savedSpiffeTrustMap,
90-
certificateValidationContext, sniForSanMatching));
88+
new XdsTrustManagerFactory(
89+
savedSpiffeTrustMap,
90+
certificateValidationContext, sniForSanMatching));
9191
} else {
92-
try {
93-
sslContextBuilder = sslContextBuilder.trustManager(
94-
new XdsTrustManagerFactory(
95-
getX509CertificatesFromSystemTrustStore(),
96-
certificateValidationContext));
97-
} catch (KeyStoreException | NoSuchAlgorithmException e) {
98-
throw new CertStoreException(e);
99-
}
92+
sslContextBuilder = sslContextBuilder.trustManager(
93+
new XdsTrustManagerFactory(
94+
savedTrustedRoots.toArray(new X509Certificate[0]),
95+
certificateValidationContext, sniForSanMatching));
96+
}
97+
} else {
98+
try {
99+
sslContextBuilder = sslContextBuilder.trustManager(
100+
new XdsTrustManagerFactory(
101+
getX509CertificatesFromSystemTrustStore(),
102+
certificateValidationContext, sniForSanMatching));
103+
} catch (KeyStoreException | NoSuchAlgorithmException e) {
104+
throw new CertStoreException(e);
100105
}
101106
}
102107
if (isMtls()) {

‎xds/src/test/java/io/grpc/xds/XdsSecurityClientServerTest.java‎

Lines changed: 38 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@
118118
@RunWith(Parameterized.class)
119119
public class XdsSecurityClientServerTest {
120120

121-
// TODO: Change this is a specific domain after
121+
// TODO: Change this to a specific domain after
122122
// https://github.com/grpc/grpc-java/issues/12326 is fixed
123123
private static final String SAN_TO_MATCH = "*.test.google.fr";
124124

@@ -223,7 +223,7 @@ public void tlsClientServer_useSystemRootCerts_noMtls_useCombinedValidationConte
223223

224224
UpstreamTlsContext upstreamTlsContext =
225225
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
226-
CLIENT_PEM_FILE, true, SAN_TO_MATCH, false);
226+
CLIENT_PEM_FILE, true, SAN_TO_MATCH, false, null);
227227

228228
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
229229
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -250,7 +250,7 @@ public void tlsClientServer_useSystemRootCerts_noMtls_validationContext() throws
250250

251251
UpstreamTlsContext upstreamTlsContext =
252252
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
253-
CLIENT_PEM_FILE, false, SAN_TO_MATCH, false);
253+
CLIENT_PEM_FILE, false, SAN_TO_MATCH, false, null);
254254

255255
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
256256
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -273,7 +273,7 @@ public void tlsClientServer_useSystemRootCerts_mtls() throws Exception {
273273

274274
UpstreamTlsContext upstreamTlsContext =
275275
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
276-
CLIENT_PEM_FILE, true, SAN_TO_MATCH, true);
276+
CLIENT_PEM_FILE, true, SAN_TO_MATCH, true, null);
277277

278278
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
279279
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -286,10 +286,11 @@ public void tlsClientServer_useSystemRootCerts_mtls() throws Exception {
286286

287287
/**
288288
* Use system root ca cert for TLS channel - no mTLS.
289-
* Subj Alt Names to match are specified in the validaton context.
289+
* Subj Alt Names to match are specified in the validation context.
290290
*/
291291
@Test
292-
public void tlsClientServer_useSystemRootCerts_failureToMatchSubjAltNames() throws Exception {
292+
public void tlsClientServer_useSystemRootCerts_noAutoSniValidation_failureToMatchSubjAltNames()
293+
throws Exception {
293294
Path trustStoreFilePath = getCacertFilePathForTestCa();
294295
try {
295296
setTrustStoreSystemProperties(trustStoreFilePath.toAbsolutePath().toString());
@@ -300,7 +301,7 @@ public void tlsClientServer_useSystemRootCerts_failureToMatchSubjAltNames() thro
300301

301302
UpstreamTlsContext upstreamTlsContext =
302303
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
303-
CLIENT_PEM_FILE, true, "server1.test.google.in", false);
304+
CLIENT_PEM_FILE, true, "server1.test.google.in", false, null);
304305

305306
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
306307
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -317,6 +318,33 @@ public void tlsClientServer_useSystemRootCerts_failureToMatchSubjAltNames() thro
317318
}
318319
}
319320

321+
@Test
322+
public void tlsClientServer_useSystemRootCerts_autoSniValidation()
323+
throws Exception {
324+
Path trustStoreFilePath = getCacertFilePathForTestCa();
325+
try {
326+
setTrustStoreSystemProperties(trustStoreFilePath.toAbsolutePath().toString());
327+
DownstreamTlsContext downstreamTlsContext =
328+
setBootstrapInfoAndBuildDownstreamTlsContext(SERVER_1_PEM_FILE, null, null, null, null,
329+
null, false, false);
330+
buildServerWithTlsContext(downstreamTlsContext);
331+
332+
UpstreamTlsContext upstreamTlsContext =
333+
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
334+
CLIENT_PEM_FILE, true,
335+
// won't be used
336+
"server1.test.google.in",
337+
false, SAN_TO_MATCH);
338+
339+
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
340+
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
341+
unaryRpc(/* requestMessage= */ "buddy", blockingStub);
342+
} finally {
343+
Files.deleteIfExists(trustStoreFilePath);
344+
clearTrustStoreSystemProperties();
345+
}
346+
}
347+
320348
/**
321349
* Use system root ca cert for TLS channel - mTLS.
322350
* Uses common_tls_context.combined_validation_context in upstream_tls_context.
@@ -333,7 +361,7 @@ public void tlsClientServer_useSystemRootCerts_requireClientAuth() throws Except
333361

334362
UpstreamTlsContext upstreamTlsContext =
335363
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
336-
CLIENT_PEM_FILE, true, SAN_TO_MATCH, false);
364+
CLIENT_PEM_FILE, true, SAN_TO_MATCH, false, null);
337365

338366
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
339367
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -615,7 +643,7 @@ private UpstreamTlsContext setBootstrapInfoAndBuildUpstreamTlsContext(String cli
615643
private UpstreamTlsContext setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(
616644
String clientKeyFile,
617645
String clientPemFile,
618-
boolean useCombinedValidationContext, String sanToMatch, boolean isMtls) {
646+
boolean useCombinedValidationContext, String sanToMatch, boolean isMtls, String sni) {
619647
bootstrapInfoForClient = CommonBootstrapperTestUtils
620648
.buildBootstrapInfo("google_cloud_private_spiffe-client", clientKeyFile, clientPemFile,
621649
CA_PEM_FILE, null, null, null, null, null);
@@ -630,7 +658,7 @@ private UpstreamTlsContext setBootstrapInfoAndBuildUpstreamTlsContextForUsingSys
630658
.addMatchSubjectAltNames(
631659
StringMatcher.newBuilder()
632660
.setExact(sanToMatch))
633-
.build());
661+
.build(), sni, false);
634662
}
635663
return CommonTlsContextTestsUtil.buildNewUpstreamTlsContextForCertProviderInstance(
636664
"google_cloud_private_spiffe-client", "ROOT", null,

‎xds/src/test/java/io/grpc/xds/internal/security/CommonTlsContextTestsUtil.java‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -149,9 +149,12 @@ public static String getTempFileNameForResourcesFile(String resFile) throws IOEx
149149
* Helper method to build UpstreamTlsContext for above tests. Called from other classes as well.
150150
*/
151151
static EnvoyServerProtoData.UpstreamTlsContext buildUpstreamTlsContext(
152-
CommonTlsContext commonTlsContext, String sni, boolean autoHostSni) {
152+
CommonTlsContext commonTlsContext, String sni, boolean autoHostSni, boolean autoSniSanValidation) {
153153
UpstreamTlsContext.Builder upstreamTlsContext =
154-
UpstreamTlsContext.newBuilder().setCommonTlsContext(commonTlsContext).setAutoHostSni(autoHostSni);
154+
UpstreamTlsContext.newBuilder()
155+
.setCommonTlsContext(commonTlsContext)
156+
.setAutoHostSni(autoHostSni)
157+
.setAutoSniSanValidation(autoSniSanValidation);
155158
if (sni != null) {
156159
upstreamTlsContext.setSni(sni);
157160
}
@@ -290,7 +293,7 @@ private static CommonTlsContext.Builder addNewCertificateValidationContext(
290293
rootCertName,
291294
alpnProtocols,
292295
staticCertValidationContext),
293-
sni, autoHostSni);
296+
sni, autoHostSni, false);
294297
}
295298

296299
/** Helper method to build UpstreamTlsContext for CertProvider tests. */
@@ -309,7 +312,7 @@ private static CommonTlsContext.Builder addNewCertificateValidationContext(
309312
rootInstanceName,
310313
rootCertName,
311314
alpnProtocols,
312-
staticCertValidationContext), null, false);
315+
staticCertValidationContext), null, false, false);
313316
}
314317

315318
/** Helper method to build DownstreamTlsContext for CertProvider tests. */

‎xds/src/test/java/io/grpc/xds/internal/security/SecurityProtocolNegotiatorsTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ public void clientSecurityProtocolNegotiatorNewHandler_noFallback_expectExceptio
124124
@Test
125125
public void clientSecurityProtocolNegotiatorNewHandler_withTlsContextAttribute() {
126126
UpstreamTlsContext upstreamTlsContext =
127-
CommonTlsContextTestsUtil.buildUpstreamTlsContext(CommonTlsContext.newBuilder().build(), null, false);
127+
CommonTlsContextTestsUtil.buildUpstreamTlsContext(CommonTlsContext.newBuilder().build(), null, false, false);
128128
ClientSecurityProtocolNegotiator pn =
129129
new ClientSecurityProtocolNegotiator(InternalProtocolNegotiators.plaintext());
130130
GrpcHttp2ConnectionHandler mockHandler = mock(GrpcHttp2ConnectionHandler.class);
@@ -146,7 +146,7 @@ public void clientSecurityProtocolNegotiatorNewHandler_withTlsContextAttribute()
146146
@Test
147147
public void clientSecurityProtocolNegotiatorNewHandler_autoHostSni_hostnameIsPassedToClientSecurityHandler() {
148148
UpstreamTlsContext upstreamTlsContext =
149-
CommonTlsContextTestsUtil.buildUpstreamTlsContext(CommonTlsContext.newBuilder().build(), null, true);
149+
CommonTlsContextTestsUtil.buildUpstreamTlsContext(CommonTlsContext.newBuilder().build(), null, true, false);
150150
ClientSecurityProtocolNegotiator pn =
151151
new ClientSecurityProtocolNegotiator(InternalProtocolNegotiators.plaintext());
152152
GrpcHttp2ConnectionHandler mockHandler = mock(GrpcHttp2ConnectionHandler.class);

0 commit comments

Comments
 (0)