Skip to content

Commit 92f3182

Browse files
kannanjgithubkannanjgithub
committed
Save changes.
1 parent 0ca4f8b commit 92f3182

File tree

1 file changed

+95
-23
lines changed

1 file changed

+95
-23
lines changed

‎xds/src/test/java/io/grpc/xds/XdsSecurityClientServerTest.java‎

Lines changed: 95 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@
118118
@RunWith(Parameterized.class)
119119
public class XdsSecurityClientServerTest {
120120

121-
private static final String SAN_TO_MATCH = "waterzooi.test.google.be";
121+
private static final String SNI_IN_UTC = "waterzooi.test.google.be";
122122

123123
@Parameter
124124
public Boolean enableSpiffe;
@@ -221,7 +221,7 @@ public void tlsClientServer_useSystemRootCerts_noMtls_useCombinedValidationConte
221221

222222
UpstreamTlsContext upstreamTlsContext =
223223
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
224-
CLIENT_PEM_FILE, true, SAN_TO_MATCH, false, null, false);
224+
CLIENT_PEM_FILE, true, SNI_IN_UTC, false, null, false, false);
225225

226226
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
227227
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -248,7 +248,7 @@ public void tlsClientServer_useSystemRootCerts_noMtls_validationContext() throws
248248

249249
UpstreamTlsContext upstreamTlsContext =
250250
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
251-
CLIENT_PEM_FILE, false, SAN_TO_MATCH, false, null, false);
251+
CLIENT_PEM_FILE, false, SNI_IN_UTC, false, null, false, false);
252252

253253
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
254254
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -271,7 +271,7 @@ public void tlsClientServer_useSystemRootCerts_mtls() throws Exception {
271271

272272
UpstreamTlsContext upstreamTlsContext =
273273
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
274-
CLIENT_PEM_FILE, true, SAN_TO_MATCH, true, null, false);
274+
CLIENT_PEM_FILE, true, SNI_IN_UTC, true, null, false, false);
275275

276276
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
277277
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -287,7 +287,7 @@ public void tlsClientServer_useSystemRootCerts_mtls() throws Exception {
287287
* Subj Alt Names to match are specified in the validation context.
288288
*/
289289
@Test
290-
public void tlsClientServer_useSystemRootCerts_noAutoSniValidation_failureToMatchSubjAltNames()
290+
public void tlsClientServer_noAutoSniValidation_failureToMatchSubjAltNames()
291291
throws Exception {
292292
Path trustStoreFilePath = getCacertFilePathForTestCa();
293293
try {
@@ -299,7 +299,7 @@ public void tlsClientServer_useSystemRootCerts_noAutoSniValidation_failureToMatc
299299

300300
UpstreamTlsContext upstreamTlsContext =
301301
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
302-
CLIENT_PEM_FILE, true, "server1.test.google.in", false, null, false);
302+
CLIENT_PEM_FILE, true, "server1.test.google.in", false, null, false, false);
303303

304304
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
305305
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -317,7 +317,7 @@ public void tlsClientServer_useSystemRootCerts_noAutoSniValidation_failureToMatc
317317
}
318318

319319
@Test
320-
public void tlsClientServer_useSystemRootCerts_autoSniValidation()
320+
public void tlsClientServer_autoSniValidation_sniInUTC()
321321
throws Exception {
322322
Path trustStoreFilePath = getCacertFilePathForTestCa();
323323
try {
@@ -333,9 +333,69 @@ public void tlsClientServer_useSystemRootCerts_autoSniValidation()
333333
// SAN matcher in CommonValidationContext. Will be overridden by autoSniSanValidation
334334
"server1.test.google.in",
335335
false,
336-
// SNI in UpstreamTlsContext
337-
SAN_TO_MATCH,
338-
true);
336+
SNI_IN_UTC,
337+
false, true);
338+
339+
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
340+
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
341+
unaryRpc(/* requestMessage= */ "buddy", blockingStub);
342+
} finally {
343+
Files.deleteIfExists(trustStoreFilePath);
344+
clearTrustStoreSystemProperties();
345+
}
346+
}
347+
348+
@Test
349+
public void tlsClientServer_sni_san_validation_from_hostname()
350+
throws Exception {
351+
Path trustStoreFilePath = getCacertFilePathForTestCa();
352+
try {
353+
setTrustStoreSystemProperties(trustStoreFilePath.toAbsolutePath().toString());
354+
DownstreamTlsContext downstreamTlsContext =
355+
setBootstrapInfoAndBuildDownstreamTlsContext(SERVER_1_PEM_FILE, null, null, null, null,
356+
null, false, false);
357+
buildServerWithTlsContext(downstreamTlsContext);
358+
359+
UpstreamTlsContext upstreamTlsContext =
360+
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
361+
CLIENT_PEM_FILE, true,
362+
// SAN matcher in CommonValidationContext. Will be overridden by autoSniSanValidation
363+
"server1.test.google.in",
364+
false,
365+
"",
366+
true, true);
367+
368+
// TODO: Change this to foo.test.gooogle.fr that needs wildcard matching after
369+
// https://github.com/grpc/grpc-java/pull/12345 is done
370+
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
371+
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY,
372+
"waterzooi.test.google.be");
373+
unaryRpc(/* requestMessage= */ "buddy", blockingStub);
374+
} finally {
375+
Files.deleteIfExists(trustStoreFilePath);
376+
clearTrustStoreSystemProperties();
377+
}
378+
}
379+
380+
@Test
381+
public void tlsClientServer_autoSniValidation_noSNIApplicable_usesMatcherFromCmnVdnCtx()
382+
throws Exception {
383+
Path trustStoreFilePath = getCacertFilePathForTestCa();
384+
try {
385+
setTrustStoreSystemProperties(trustStoreFilePath.toAbsolutePath().toString());
386+
DownstreamTlsContext downstreamTlsContext =
387+
setBootstrapInfoAndBuildDownstreamTlsContext(SERVER_1_PEM_FILE, null, null, null, null,
388+
null, false, false);
389+
buildServerWithTlsContext(downstreamTlsContext);
390+
391+
UpstreamTlsContext upstreamTlsContext =
392+
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
393+
CLIENT_PEM_FILE, true,
394+
// This is what will get used for the SAN validation since no SNI was used
395+
"waterzooi.test.google.be",
396+
false,
397+
"",
398+
false, true);
339399

340400
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
341401
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -362,7 +422,7 @@ public void tlsClientServer_useSystemRootCerts_requireClientAuth() throws Except
362422

363423
UpstreamTlsContext upstreamTlsContext =
364424
setBootstrapInfoAndBuildUpstreamTlsContextForUsingSystemRootCerts(CLIENT_KEY_FILE,
365-
CLIENT_PEM_FILE, true, SAN_TO_MATCH, false, null, false);
425+
CLIENT_PEM_FILE, true, SNI_IN_UTC, false, null, false, false);
366426

367427
SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub =
368428
getBlockingStub(upstreamTlsContext, /* overrideAuthority= */ OVERRIDE_AUTHORITY);
@@ -648,7 +708,7 @@ private UpstreamTlsContext setBootstrapInfoAndBuildUpstreamTlsContextForUsingSys
648708
String sanToMatch,
649709
boolean isMtls,
650710
String sniInUpstreamTlsContext,
651-
boolean autoSniSanValidation) {
711+
boolean autoHostSni, boolean autoSniSanValidation) {
652712
bootstrapInfoForClient = CommonBootstrapperTestUtils
653713
.buildBootstrapInfo("google_cloud_private_spiffe-client", clientKeyFile, clientPemFile,
654714
CA_PEM_FILE, null, null, null, null, null);
@@ -663,7 +723,7 @@ private UpstreamTlsContext setBootstrapInfoAndBuildUpstreamTlsContextForUsingSys
663723
.addMatchSubjectAltNames(
664724
StringMatcher.newBuilder()
665725
.setExact(sanToMatch))
666-
.build(), sniInUpstreamTlsContext, false, autoSniSanValidation);
726+
.build(), sniInUpstreamTlsContext, autoHostSni, autoSniSanValidation);
667727
}
668728
return CommonTlsContextTestsUtil.buildNewUpstreamTlsContextForCertProviderInstance(
669729
"google_cloud_private_spiffe-client", "ROOT", null,
@@ -748,8 +808,18 @@ static EnvoyServerProtoData.Listener buildListener(
748808
}
749809

750810
private SimpleServiceGrpc.SimpleServiceBlockingStub getBlockingStub(
751-
final UpstreamTlsContext upstreamTlsContext, String overrideAuthority)
752-
throws URISyntaxException {
811+
final UpstreamTlsContext upstreamTlsContext, String overrideAuthority) {
812+
return getBlockingStub(upstreamTlsContext, overrideAuthority, overrideAuthority);
813+
}
814+
815+
// Two separate parameters for overrideAuthority and addrAttribute is for the SAN SNI validation test
816+
// tlsClientServer_useSystemRootCerts_sni_san_validation_from_hostname that uses hostname passed for SNI.
817+
// foo.test.google.fr is used for virtual host matching via authority but it can't be used
818+
// for SNI in this testcase because foo.test.google.fr needs wildcard matching to match against *.test.google.fr
819+
// in the certificate SNI, which isn't implemented yet (https://github.com/grpc/grpc-java/pull/12345 implements it)
820+
// so use an exact match SAN such as waterzooi.test.google.be for SNI for this testcase.
821+
private SimpleServiceGrpc.SimpleServiceBlockingStub getBlockingStub(
822+
final UpstreamTlsContext upstreamTlsContext, String overrideAuthority, String addrAttribute) {
753823
ManagedChannelBuilder<?> channelBuilder =
754824
Grpc.newChannelBuilder(
755825
"sectest://localhost:" + port,
@@ -761,14 +831,16 @@ private SimpleServiceGrpc.SimpleServiceBlockingStub getBlockingStub(
761831
InetSocketAddress socketAddress =
762832
new InetSocketAddress(Inet4Address.getLoopbackAddress(), port);
763833
tlsContextManagerForClient = new TlsContextManagerImpl(bootstrapInfoForClient);
764-
sslContextAttributes =
765-
(upstreamTlsContext != null)
766-
? Attributes.newBuilder()
767-
.set(SecurityProtocolNegotiators.ATTR_SSL_CONTEXT_PROVIDER_SUPPLIER,
768-
new SslContextProviderSupplier(
769-
upstreamTlsContext, tlsContextManagerForClient))
770-
.build()
771-
: Attributes.EMPTY;
834+
Attributes.Builder sslContextAttributesBuilder = (upstreamTlsContext != null)
835+
? Attributes.newBuilder()
836+
.set(SecurityProtocolNegotiators.ATTR_SSL_CONTEXT_PROVIDER_SUPPLIER,
837+
new SslContextProviderSupplier(
838+
upstreamTlsContext, tlsContextManagerForClient))
839+
: Attributes.newBuilder();
840+
if (addrAttribute != null) {
841+
sslContextAttributesBuilder.set(SecurityProtocolNegotiators.ATTR_ADDRESS_NAME, addrAttribute);
842+
}
843+
sslContextAttributes = sslContextAttributesBuilder.build();
772844
fakeNameResolverFactory.setServers(
773845
ImmutableList.of(new EquivalentAddressGroup(socketAddress, sslContextAttributes)));
774846
return SimpleServiceGrpc.newBlockingStub(cleanupRule.register(channelBuilder.build()));

0 commit comments

Comments
 (0)