Examples with CertificateValidationContext io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext used on opensource projects

Example 6 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsX509TrustManagerTest method oneIpAddressInPeerCertsMismatch.

@Test
public void oneIpAddressInPeerCertsMismatch() throws CertificateException, IOException {
    StringMatcher stringMatcher = StringMatcher.newBuilder().setExact("x.foo.com").build();
    StringMatcher stringMatcher1 = StringMatcher.newBuilder().setExact("192.168.2.3").build();
    CertificateValidationContext certContext = CertificateValidationContext.newBuilder().addMatchSubjectAltNames(stringMatcher).addMatchSubjectAltNames(stringMatcher1).build();
    trustManager = new SdsX509TrustManager(certContext, mockDelegate);
    X509Certificate[] certs = CertificateUtils.toX509Certificates(TestUtils.loadCert(SERVER_1_PEM_FILE));
    try {
        trustManager.verifySubjectAltNameInChain(certs);
        fail("no exception thrown");
    } catch (CertificateException expected) {
        assertThat(expected).hasMessageThat().isEqualTo("Peer certificate SAN check failed");
    }
}

Example 7 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsX509TrustManagerTest method oneSanInPeerCertsSubstring_differentCase_expectException.

@Test
public void oneSanInPeerCertsSubstring_differentCase_expectException() throws CertificateException, IOException {
    StringMatcher stringMatcher = StringMatcher.newBuilder().setContains("zooi.Test.gooGle").setIgnoreCase(false).build();
    CertificateValidationContext certContext = CertificateValidationContext.newBuilder().addMatchSubjectAltNames(stringMatcher).build();
    trustManager = new SdsX509TrustManager(certContext, mockDelegate);
    X509Certificate[] certs = CertificateUtils.toX509Certificates(TestUtils.loadCert(SERVER_1_PEM_FILE));
    try {
        trustManager.verifySubjectAltNameInChain(certs);
        fail("no exception thrown");
    } catch (CertificateException expected) {
        assertThat(expected).hasMessageThat().isEqualTo("Peer certificate SAN check failed");
    }
}

Example 8 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsX509TrustManagerTest method oneSanInPeerCerts_safeRegex_ipAddress.

@Test
public void oneSanInPeerCerts_safeRegex_ipAddress() throws CertificateException, IOException {
    StringMatcher stringMatcher = StringMatcher.newBuilder().setSafeRegex(RegexMatcher.newBuilder().setRegex("([[:digit:]]{1,3}\\.){3}[[:digit:]]{1,3}")).build();
    CertificateValidationContext certContext = CertificateValidationContext.newBuilder().addMatchSubjectAltNames(stringMatcher).build();
    trustManager = new SdsX509TrustManager(certContext, mockDelegate);
    X509Certificate[] certs = CertificateUtils.toX509Certificates(TestUtils.loadCert(SERVER_1_PEM_FILE));
    trustManager.verifySubjectAltNameInChain(certs);
}

Example 9 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsX509TrustManagerTest method unsupportedAltNameType.

@Test
public void unsupportedAltNameType() throws CertificateException, IOException {
    StringMatcher stringMatcher = StringMatcher.newBuilder().setExact("waterzooi.test.google.be").setIgnoreCase(false).build();
    CertificateValidationContext certContext = CertificateValidationContext.newBuilder().addMatchSubjectAltNames(stringMatcher).build();
    trustManager = new SdsX509TrustManager(certContext, mockDelegate);
    X509Certificate mockCert = mock(X509Certificate.class);
    when(mockCert.getSubjectAlternativeNames()).thenReturn(Collections.<List<?>>singleton(ImmutableList.of(Integer.valueOf(1), "foo")));
    X509Certificate[] certs = new X509Certificate[] { mockCert };
    try {
        trustManager.verifySubjectAltNameInChain(certs);
        fail("no exception thrown");
    } catch (CertificateException expected) {
        assertThat(expected).hasMessageThat().isEqualTo("Peer certificate SAN check failed");
    }
}

Example 10 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class CommonTlsContextTestsUtil method buildCommonTlsContextWithAdditionalValues.

/**
 * takes additional values and creates CombinedCertificateValidationContext as needed.
 */
@SuppressWarnings("deprecation")
static CommonTlsContext buildCommonTlsContextWithAdditionalValues(String certInstanceName, String certName, String validationContextCertInstanceName, String validationContextCertName, Iterable<StringMatcher> matchSubjectAltNames, Iterable<String> alpnNames) {
    CommonTlsContext.Builder builder = CommonTlsContext.newBuilder();
    CertificateProviderInstance certificateProviderInstance = CertificateProviderInstance.newBuilder().setInstanceName(certInstanceName).setCertificateName(certName).build();
    if (certificateProviderInstance != null) {
        builder.setTlsCertificateCertificateProviderInstance(certificateProviderInstance);
    }
    CertificateProviderInstance validationCertificateProviderInstance = CertificateProviderInstance.newBuilder().setInstanceName(validationContextCertInstanceName).setCertificateName(validationContextCertName).build();
    CertificateValidationContext certValidationContext = matchSubjectAltNames == null ? null : CertificateValidationContext.newBuilder().addAllMatchSubjectAltNames(matchSubjectAltNames).build();
    if (validationCertificateProviderInstance != null) {
        CombinedCertificateValidationContext.Builder combinedBuilder = CombinedCertificateValidationContext.newBuilder().setValidationContextCertificateProviderInstance(validationCertificateProviderInstance);
        if (certValidationContext != null) {
            combinedBuilder = combinedBuilder.setDefaultValidationContext(certValidationContext);
        }
        builder.setCombinedValidationContext(combinedBuilder);
    } else if (validationCertificateProviderInstance != null) {
        builder.setValidationContextCertificateProviderInstance(validationCertificateProviderInstance);
    } else if (certValidationContext != null) {
        builder.setValidationContext(certValidationContext);
    }
    if (alpnNames != null) {
        builder.addAllAlpnProtocols(alpnNames);
    }
    return builder.build();
}