Skip to content

Commit aa59965

Browse files
kannanjgithubkannanjgithub
committed
Unit tests and using HostnameVerifier in per-rpc.
1 parent 4af94ec commit aa59965

File tree

5 files changed

+461
-57
lines changed

5 files changed

+461
-57
lines changed

‎okhttp/src/main/java/io/grpc/okhttp/OkHttpChannelBuilder.java‎

Lines changed: 39 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,38 @@
1616

1717
package io.grpc.okhttp;
1818

19+
import static com.google.common.base.Preconditions.checkNotNull;
20+
import static io.grpc.internal.CertificateUtils.createTrustManager;
21+
import static io.grpc.internal.GrpcUtil.DEFAULT_KEEPALIVE_TIMEOUT_NANOS;
22+
import static io.grpc.internal.GrpcUtil.KEEPALIVE_TIME_NANOS_DISABLED;
23+
1924
import com.google.common.annotations.VisibleForTesting;
2025
import com.google.common.base.Preconditions;
21-
import io.grpc.*;
22-
import io.grpc.internal.*;
26+
import io.grpc.CallCredentials;
27+
import io.grpc.ChannelCredentials;
28+
import io.grpc.ChannelLogger;
29+
import io.grpc.ChoiceChannelCredentials;
30+
import io.grpc.CompositeCallCredentials;
31+
import io.grpc.CompositeChannelCredentials;
32+
import io.grpc.ExperimentalApi;
33+
import io.grpc.ForwardingChannelBuilder2;
34+
import io.grpc.InsecureChannelCredentials;
35+
import io.grpc.Internal;
36+
import io.grpc.ManagedChannelBuilder;
37+
import io.grpc.TlsChannelCredentials;
38+
import io.grpc.internal.AtomicBackoff;
39+
import io.grpc.internal.ClientTransportFactory;
40+
import io.grpc.internal.ConnectionClientTransport;
41+
import io.grpc.internal.FixedObjectPool;
42+
import io.grpc.internal.GrpcUtil;
43+
import io.grpc.internal.KeepAliveManager;
44+
import io.grpc.internal.ManagedChannelImplBuilder;
2345
import io.grpc.internal.ManagedChannelImplBuilder.ChannelBuilderDefaultPortProvider;
2446
import io.grpc.internal.ManagedChannelImplBuilder.ClientTransportFactoryBuilder;
47+
import io.grpc.internal.ObjectPool;
2548
import io.grpc.internal.SharedResourceHolder.Resource;
26-
import io.grpc.internal.TransportTracer.Factory;
49+
import io.grpc.internal.SharedResourcePool;
50+
import io.grpc.internal.TransportTracer;
2751
import io.grpc.okhttp.internal.CipherSuite;
2852
import io.grpc.okhttp.internal.ConnectionSpec;
2953
import io.grpc.okhttp.internal.Platform;
@@ -42,18 +66,22 @@
4266
import java.util.Collections;
4367
import java.util.EnumSet;
4468
import java.util.Set;
45-
import java.util.concurrent.*;
69+
import java.util.concurrent.Executor;
70+
import java.util.concurrent.ExecutorService;
71+
import java.util.concurrent.Executors;
72+
import java.util.concurrent.ScheduledExecutorService;
73+
import java.util.concurrent.TimeUnit;
4674
import java.util.logging.Level;
4775
import java.util.logging.Logger;
4876
import javax.annotation.CheckReturnValue;
4977
import javax.annotation.Nullable;
5078
import javax.net.SocketFactory;
51-
import javax.net.ssl.*;
52-
53-
import static com.google.common.base.Preconditions.checkNotNull;
54-
import static io.grpc.internal.CertificateUtils.createTrustManager;
55-
import static io.grpc.internal.GrpcUtil.DEFAULT_KEEPALIVE_TIMEOUT_NANOS;
56-
import static io.grpc.internal.GrpcUtil.KEEPALIVE_TIME_NANOS_DISABLED;
79+
import javax.net.ssl.HostnameVerifier;
80+
import javax.net.ssl.KeyManager;
81+
import javax.net.ssl.KeyManagerFactory;
82+
import javax.net.ssl.SSLContext;
83+
import javax.net.ssl.SSLSocketFactory;
84+
import javax.net.ssl.TrustManager;
5785

5886
/** Convenience class for building channels with the OkHttp transport. */
5987
@ExperimentalApi("https://github.com/grpc/grpc-java/issues/1785")
@@ -762,7 +790,7 @@ private OkHttpTransportFactory(
762790
int flowControlWindow,
763791
boolean keepAliveWithoutCalls,
764792
int maxInboundMetadataSize,
765-
Factory transportTracerFactory,
793+
TransportTracer.Factory transportTracerFactory,
766794
boolean useGetForSafeMethods,
767795
ChannelCredentials channelCredentials) {
768796
this.executorPool = executorPool;

‎okhttp/src/main/java/io/grpc/okhttp/OkHttpClientTransport.java‎

Lines changed: 53 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,19 @@
8484
import java.security.cert.Certificate;
8585
import java.security.cert.CertificateException;
8686
import java.security.cert.X509Certificate;
87-
import java.util.*;
87+
import java.util.Arrays;
88+
import java.util.Collections;
89+
import java.util.Deque;
90+
import java.util.EnumMap;
91+
import java.util.HashMap;
92+
import java.util.Iterator;
93+
import java.util.LinkedHashMap;
94+
import java.util.LinkedList;
95+
import java.util.List;
96+
import java.util.Locale;
97+
import java.util.Map;
98+
import java.util.Optional;
99+
import java.util.Random;
88100
import java.util.concurrent.BrokenBarrierException;
89101
import java.util.concurrent.CountDownLatch;
90102
import java.util.concurrent.CyclicBarrier;
@@ -421,48 +433,47 @@ public ClientStream newStream(
421433
Preconditions.checkNotNull(headers, "headers");
422434
StatsTraceContext statsTraceContext =
423435
StatsTraceContext.newClientContext(tracers, getAttributes(), headers);
436+
if (hostnameVerifier != null && socket instanceof SSLSocket
437+
&& !hostnameVerifier.verify(callOptions.getAuthority(),
438+
((SSLSocket) socket).getSession())) {
439+
return new FailingClientStream(Status.UNAVAILABLE.withDescription(
440+
String.format("HostNameVerifier verification failed for authority '%s'",
441+
callOptions.getAuthority())), tracers);
442+
}
424443
if (socket instanceof SSLSocket && callOptions.getAuthority() != null
425444
&& channelCredentials != null && channelCredentials instanceof TlsChannelCredentials) {
426445
Status peerVerificationStatus;
427446
if (peerVerificationResults.containsKey(callOptions.getAuthority())) {
428447
peerVerificationStatus = peerVerificationResults.get(callOptions.getAuthority());
429448
} else {
430-
if (hostnameVerifier != null &&
431-
!hostnameVerifier.verify(callOptions.getAuthority(),
432-
((SSLSocket) socket).getSession())) {
433-
peerVerificationStatus = Status.UNAVAILABLE.withDescription(
434-
String.format("HostNameVerifier verification failed for authority '%s'.",
435-
callOptions.getAuthority()));
436-
} else {
437-
Optional<TrustManager> x509ExtendedTrustManager;
438-
try {
439-
x509ExtendedTrustManager = getX509ExtendedTrustManager(
440-
(TlsChannelCredentials) channelCredentials);
441-
} catch (GeneralSecurityException e) {
442-
return new FailingClientStream(Status.UNAVAILABLE.withDescription(
443-
"Failure getting X509ExtendedTrustManager from TlsCredentials").withCause(e),
444-
tracers);
445-
}
446-
if (!x509ExtendedTrustManager.isPresent()) {
447-
return new FailingClientStream(Status.UNAVAILABLE.withDescription(
448-
"Can't allow authority override in rpc when X509ExtendedTrustManager is not "
449-
+ "available"), tracers);
450-
}
451-
try {
452-
Certificate[] peerCertificates = sslSession.getPeerCertificates();
453-
X509Certificate[] x509PeerCertificates = new X509Certificate[peerCertificates.length];
454-
for (int i = 0; i < peerCertificates.length; i++) {
455-
x509PeerCertificates[i] = (X509Certificate) peerCertificates[i];
456-
}
457-
((X509ExtendedTrustManager) x509ExtendedTrustManager.get()).checkServerTrusted(
458-
x509PeerCertificates, "RSA",
459-
new SslSocketWrapper((SSLSocket) socket, callOptions.getAuthority()));
460-
peerVerificationStatus = Status.OK;
461-
} catch (SSLPeerUnverifiedException | CertificateException e) {
462-
peerVerificationStatus = Status.INTERNAL.withDescription(
463-
String.format("Failure in verifying authority '%s' against peer",
464-
callOptions.getAuthority())).withCause(e);
449+
Optional<TrustManager> x509ExtendedTrustManager;
450+
try {
451+
x509ExtendedTrustManager = getX509ExtendedTrustManager(
452+
(TlsChannelCredentials) channelCredentials);
453+
} catch (GeneralSecurityException e) {
454+
return new FailingClientStream(Status.UNAVAILABLE.withDescription(
455+
"Failure getting X509ExtendedTrustManager from TlsCredentials").withCause(e),
456+
tracers);
457+
}
458+
if (!x509ExtendedTrustManager.isPresent()) {
459+
return new FailingClientStream(Status.UNAVAILABLE.withDescription(
460+
"Can't allow authority override in rpc when X509ExtendedTrustManager is not "
461+
+ "available"), tracers);
462+
}
463+
try {
464+
Certificate[] peerCertificates = sslSession.getPeerCertificates();
465+
X509Certificate[] x509PeerCertificates = new X509Certificate[peerCertificates.length];
466+
for (int i = 0; i < peerCertificates.length; i++) {
467+
x509PeerCertificates[i] = (X509Certificate) peerCertificates[i];
465468
}
469+
((X509ExtendedTrustManager) x509ExtendedTrustManager.get()).checkServerTrusted(
470+
x509PeerCertificates, "RSA",
471+
new SslSocketWrapper((SSLSocket) socket, callOptions.getAuthority()));
472+
peerVerificationStatus = Status.OK;
473+
} catch (SSLPeerUnverifiedException | CertificateException e) {
474+
peerVerificationStatus = Status.UNAVAILABLE.withDescription(
475+
String.format("Failure in verifying authority '%s' against peer",
476+
callOptions.getAuthority())).withCause(e);
466477
}
467478
peerVerificationResults.put(callOptions.getAuthority(), peerVerificationStatus);
468479
}
@@ -493,7 +504,8 @@ public ClientStream newStream(
493504
private Optional<TrustManager> getX509ExtendedTrustManager(TlsChannelCredentials tlsCreds)
494505
throws GeneralSecurityException {
495506
TrustManager[] tm = null;
496-
// Using the same way of creating TrustManager from {@link OkHttpChannelBuilder#sslSocketFactoryFrom}.
507+
// Using the same way of creating TrustManager from
508+
// {@link OkHttpChannelBuilder#sslSocketFactoryFrom}.
497509
if (tlsCreds.getTrustManagers() != null) {
498510
tm = tlsCreds.getTrustManagers().toArray(new TrustManager[0]);
499511
} else if (tlsCreds.getRootCertificates() != null) {
@@ -504,7 +516,9 @@ private Optional<TrustManager> getX509ExtendedTrustManager(TlsChannelCredentials
504516
tmf.init((KeyStore) null);
505517
tm = tmf.getTrustManagers();
506518
}
507-
return Arrays.stream(tm).filter(trustManager -> trustManager instanceof X509ExtendedTrustManager).findFirst();
519+
return Arrays.stream(tm).filter(
520+
trustManager -> trustManager instanceof X509ExtendedTrustManager)
521+
.findFirst();
508522
}
509523

510524
@GuardedBy("lock")
@@ -1690,6 +1704,7 @@ public String getPeerHost() {
16901704
}
16911705

16921706
@SuppressWarnings("deprecation")
1707+
@Override
16931708
public javax.security.cert.X509Certificate[] getPeerCertificateChain() {
16941709
throw new UnsupportedOperationException("This method is deprecated and marked for removal. "
16951710
+ "Use the getPeerCertificates() method instead.");

0 commit comments

Comments
 (0)