Skip to content

Commit fdc6e94

Browse files
kannanjgithubkannanjgithub
committed
Added flag with default false for the per-rpc authority check.
1 parent 4ef0fdb commit fdc6e94

File tree

2 files changed

+90
-51
lines changed

2 files changed

+90
-51
lines changed

‎netty/src/main/java/io/grpc/netty/NettyClientTransport.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,11 @@ public ClientStream newStream(
197197
if (callOptions.getAuthority() != null) {
198198
Status verificationStatus = negotiator.verifyAuthority(callOptions.getAuthority());
199199
if (!verificationStatus.isOk()) {
200-
return new FailingClientStream(verificationStatus, tracers);
200+
if (GrpcUtil.getFlag("GRPC_ENABLE_PER_RPC_AUTHORITY_CHECK", false)) {
201+
return new FailingClientStream(verificationStatus, tracers);
202+
}
203+
channelLogger.log(ChannelLogger.ChannelLogLevel.WARNING, "Authority '{}' specified via call" +
204+
" options for rpc did not match peer certificate's subject names.");
201205
}
202206
}
203207
StatsTraceContext statsTraceCtx =

‎netty/src/test/java/io/grpc/netty/NettyClientTransportTest.java‎

Lines changed: 85 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -842,64 +842,99 @@ public void tlsNegotiationServerExecutorShouldSucceed() throws Exception {
842842
@Test
843843
public void authorityOverrideInCallOptions_noX509ExtendedTrustManager_newStreamCreationFails()
844844
throws IOException, InterruptedException, GeneralSecurityException {
845-
startServer();
846-
InputStream caCert = TlsTesting.loadCert("ca.pem");
847-
X509TrustManager x509ExtendedTrustManager =
848-
(X509TrustManager) getX509ExtendedTrustManager(caCert).get();
849-
ProtocolNegotiators.FromChannelCredentialsResult result =
850-
ProtocolNegotiators.from(TlsChannelCredentials.newBuilder()
851-
.trustManager(new FakeTrustManager(x509ExtendedTrustManager)).build());
852-
NettyClientTransport transport = newTransport(result.negotiator.newNegotiator());
853-
FakeClientTransportListener fakeClientTransportListener = new FakeClientTransportListener();
854-
callMeMaybe(transport.start(fakeClientTransportListener));
855-
synchronized (fakeClientTransportListener) {
856-
fakeClientTransportListener.wait(10000);
845+
System.setProperty("GRPC_ENABLE_PER_RPC_AUTHORITY_CHECK", "true");
846+
try {
847+
startServer();
848+
InputStream caCert = TlsTesting.loadCert("ca.pem");
849+
X509TrustManager x509ExtendedTrustManager =
850+
(X509TrustManager) getX509ExtendedTrustManager(caCert).get();
851+
ProtocolNegotiators.FromChannelCredentialsResult result =
852+
ProtocolNegotiators.from(TlsChannelCredentials.newBuilder()
853+
.trustManager(new FakeTrustManager(x509ExtendedTrustManager)).build());
854+
NettyClientTransport transport = newTransport(result.negotiator.newNegotiator());
855+
FakeClientTransportListener fakeClientTransportListener = new FakeClientTransportListener();
856+
callMeMaybe(transport.start(fakeClientTransportListener));
857+
synchronized (fakeClientTransportListener) {
858+
fakeClientTransportListener.wait(10000);
859+
}
860+
assertThat(fakeClientTransportListener.isConnected).isTrue();
861+
862+
ClientStream stream = transport.newStream(
863+
Rpc.METHOD, new Metadata(), CallOptions.DEFAULT.withAuthority("foo.test.google.in"),
864+
new ClientStreamTracer[]{new ClientStreamTracer() {
865+
}});
866+
867+
assertThat(stream).isInstanceOf(FailingClientStream.class);
868+
InsightBuilder insightBuilder = new InsightBuilder();
869+
stream.appendTimeoutInsight(insightBuilder);
870+
assertThat(insightBuilder.toString()).contains(
871+
"Status{code=FAILED_PRECONDITION, description=Can't allow authority override in rpc when "
872+
+ "SslEngine or X509ExtendedTrustManager is not available, cause=null}");
873+
} finally {
874+
System.clearProperty("GRPC_ENABLE_PER_RPC_AUTHORITY_CHECK");
857875
}
858-
assertThat(fakeClientTransportListener.isConnected).isTrue();
859-
860-
ClientStream stream = transport.newStream(
861-
Rpc.METHOD, new Metadata(), CallOptions.DEFAULT.withAuthority("foo.test.google.in"),
862-
new ClientStreamTracer[]{new ClientStreamTracer() {
863-
}});
864-
865-
assertThat(stream).isInstanceOf(FailingClientStream.class);
866-
InsightBuilder insightBuilder = new InsightBuilder();
867-
stream.appendTimeoutInsight(insightBuilder);
868-
assertThat(insightBuilder.toString()).contains(
869-
"Status{code=FAILED_PRECONDITION, description=Can't allow authority override in rpc when "
870-
+ "SslEngine or X509ExtendedTrustManager is not available, cause=null}");
871876
}
872877

873878
@Test
874879
public void authorityOverrideInCallOptions_doesntMatchServerPeerHost_newStreamCreationFails()
875880
throws IOException, InterruptedException, GeneralSecurityException {
876-
startServer();
877-
NettyClientTransport transport = newTransport(newNegotiator());
878-
FakeClientTransportListener fakeClientTransportListener = new FakeClientTransportListener();
879-
callMeMaybe(transport.start(fakeClientTransportListener));
880-
synchronized (fakeClientTransportListener) {
881-
fakeClientTransportListener.wait(10000);
881+
System.setProperty("GRPC_ENABLE_PER_RPC_AUTHORITY_CHECK", "true");
882+
try {
883+
startServer();
884+
NettyClientTransport transport = newTransport(newNegotiator());
885+
FakeClientTransportListener fakeClientTransportListener = new FakeClientTransportListener();
886+
callMeMaybe(transport.start(fakeClientTransportListener));
887+
synchronized (fakeClientTransportListener) {
888+
fakeClientTransportListener.wait(10000);
889+
}
890+
assertThat(fakeClientTransportListener.isConnected).isTrue();
891+
892+
ClientStream stream = transport.newStream(
893+
Rpc.METHOD, new Metadata(), CallOptions.DEFAULT.withAuthority("foo.test.google.in"),
894+
new ClientStreamTracer[]{new ClientStreamTracer() {
895+
}});
896+
897+
assertThat(stream).isInstanceOf(FailingClientStream.class);
898+
InsightBuilder insightBuilder = new InsightBuilder();
899+
stream.appendTimeoutInsight(insightBuilder);
900+
assertThat(insightBuilder.toString()).contains(
901+
"Status{code=UNAVAILABLE, description=Peer hostname verification during rpc failed for"
902+
+ " authority 'foo.test.google.in'");
903+
assertThat(insightBuilder.toString()).contains("cause=java.security.cert.CertificateException:"
904+
+ " No subject alternative DNS name matching foo.test.google.in found.");
905+
} finally {
906+
System.clearProperty("GRPC_ENABLE_PER_RPC_AUTHORITY_CHECK");
882907
}
883-
assertThat(fakeClientTransportListener.isConnected).isTrue();
884-
885-
ClientStream stream = transport.newStream(
886-
Rpc.METHOD, new Metadata(), CallOptions.DEFAULT.withAuthority("foo.test.google.in"),
887-
new ClientStreamTracer[]{new ClientStreamTracer() {
888-
}});
889-
890-
assertThat(stream).isInstanceOf(FailingClientStream.class);
891-
InsightBuilder insightBuilder = new InsightBuilder();
892-
stream.appendTimeoutInsight(insightBuilder);
893-
assertThat(insightBuilder.toString()).contains(
894-
"Status{code=UNAVAILABLE, description=Peer hostname verification during rpc failed for"
895-
+ " authority 'foo.test.google.in'");
896-
assertThat(insightBuilder.toString()).contains("cause=java.security.cert.CertificateException:"
897-
+ " No subject alternative DNS name matching foo.test.google.in found.");
898908
}
899909

900910
@Test
901911
public void authorityOverrideInCallOptions_matchesServerPeerHost_newStreamCreationSucceeds()
902912
throws IOException, InterruptedException, GeneralSecurityException {
913+
System.setProperty("GRPC_ENABLE_PER_RPC_AUTHORITY_CHECK", "true");
914+
try {
915+
startServer();
916+
NettyClientTransport transport = newTransport(newNegotiator());
917+
FakeClientTransportListener fakeClientTransportListener = new FakeClientTransportListener();
918+
callMeMaybe(transport.start(fakeClientTransportListener));
919+
synchronized (fakeClientTransportListener) {
920+
fakeClientTransportListener.wait(10000);
921+
}
922+
assertThat(fakeClientTransportListener.isConnected).isTrue();
923+
924+
ClientStream stream = transport.newStream(
925+
Rpc.METHOD, new Metadata(), CallOptions.DEFAULT.withAuthority("zoo.test.google.fr"),
926+
new ClientStreamTracer[]{new ClientStreamTracer() {
927+
}});
928+
929+
assertThat(stream).isNotInstanceOf(FailingClientStream.class);
930+
} finally {
931+
System.clearProperty("GRPC_ENABLE_PER_RPC_AUTHORITY_CHECK");
932+
}
933+
}
934+
935+
@Test
936+
public void authorityOverrideInCallOptions_notMatches_flagDisabled_createsStream()
937+
throws IOException, InterruptedException, GeneralSecurityException {
903938
startServer();
904939
NettyClientTransport transport = newTransport(newNegotiator());
905940
FakeClientTransportListener fakeClientTransportListener = new FakeClientTransportListener();
@@ -910,11 +945,11 @@ public void authorityOverrideInCallOptions_matchesServerPeerHost_newStreamCreati
910945
assertThat(fakeClientTransportListener.isConnected).isTrue();
911946

912947
ClientStream stream = transport.newStream(
913-
Rpc.METHOD, new Metadata(), CallOptions.DEFAULT.withAuthority("zoo.test.google.fr"),
914-
new ClientStreamTracer[]{new ClientStreamTracer() {
915-
}});
948+
Rpc.METHOD, new Metadata(), CallOptions.DEFAULT.withAuthority("foo.test.google.in"),
949+
new ClientStreamTracer[]{new ClientStreamTracer() {
950+
}});
916951

917-
assertThat(stream).isNotInstanceOf(FailingClientStream.class);
952+
assertThat(stream).isInstanceOf(NettyClientStream.class);
918953
}
919954

920955
private Throwable getRootCause(Throwable t) {

0 commit comments

Comments
 (0)