Examples with CertificateValidationContext io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext used on opensource projects

Example 16 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsX509TrustManagerTest method missingPeerCerts.

@Test
public void missingPeerCerts() {
    StringMatcher stringMatcher = StringMatcher.newBuilder().setExact("foo.com").build();
    CertificateValidationContext certContext = CertificateValidationContext.newBuilder().addMatchSubjectAltNames(stringMatcher).build();
    trustManager = new SdsX509TrustManager(certContext, mockDelegate);
    try {
        trustManager.verifySubjectAltNameInChain(null);
        fail("no exception thrown");
    } catch (CertificateException expected) {
        assertThat(expected).hasMessageThat().isEqualTo("Peer certificate(s) missing");
    }
}

Example 17 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class CertProviderServerSslContextProviderTest method testProviderForServer_sslContextException_onError.

@Test
public void testProviderForServer_sslContextException_onError() throws Exception {
    CertificateValidationContext staticCertValidationContext = CertificateValidationContext.newBuilder().setTrustedCa(DataSource.newBuilder().setInlineString("foo")).build();
    final CertificateProvider.DistributorWatcher[] watcherCaptor = new CertificateProvider.DistributorWatcher[1];
    TestCertificateProvider.createAndRegisterProviderProvider(certificateProviderRegistry, watcherCaptor, "testca", 0);
    CertProviderServerSslContextProvider provider = getSslContextProvider(/* certInstanceName= */
    "gcp_id", /* rootInstanceName= */
    "gcp_id", CommonBootstrapperTestUtils.getTestBootstrapInfo(), /* alpnProtocols= */
    null, staticCertValidationContext, /* requireClientCert= */
    true);
    // now generate cert update
    watcherCaptor[0].updateCertificate(CommonCertProviderTestUtils.getPrivateKey(SERVER_0_KEY_FILE), ImmutableList.of(getCertFromResourceName(SERVER_0_PEM_FILE)));
    TestCallback testCallback = new TestCallback(MoreExecutors.directExecutor());
    provider.addCallback(testCallback);
    try {
        watcherCaptor[0].updateTrustedRoots(ImmutableList.of(getCertFromResourceName(CA_PEM_FILE)));
        fail("exception expected");
    } catch (RuntimeException expected) {
        assertThat(expected).hasMessageThat().contains("only static certificateValidationContext expected");
    }
    assertThat(testCallback.updatedThrowable).isNotNull();
    assertThat(testCallback.updatedThrowable).hasCauseThat().hasMessageThat().contains("only static certificateValidationContext expected");
}

Example 18 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class CertProviderServerSslContextProviderTest method testProviderForServer_mtls_newXds.

@Test
public void testProviderForServer_mtls_newXds() throws Exception {
    final CertificateProvider.DistributorWatcher[] watcherCaptor = new CertificateProvider.DistributorWatcher[1];
    TestCertificateProvider.createAndRegisterProviderProvider(certificateProviderRegistry, watcherCaptor, "testca", 0);
    CertificateValidationContext staticCertValidationContext = CertificateValidationContext.newBuilder().addAllMatchSubjectAltNames(Arrays.asList(StringMatcher.newBuilder().setExact("foo.com").build(), StringMatcher.newBuilder().setExact("bar.com").build())).build();
    CertProviderServerSslContextProvider provider = getNewSslContextProvider("gcp_id", "gcp_id", CommonBootstrapperTestUtils.getTestBootstrapInfo(), /* alpnProtocols= */
    null, staticCertValidationContext, /* requireClientCert= */
    true);
    assertThat(provider.savedKey).isNull();
    assertThat(provider.savedCertChain).isNull();
    assertThat(provider.savedTrustedRoots).isNull();
    assertThat(provider.getSslContext()).isNull();
    // now generate cert update
    watcherCaptor[0].updateCertificate(CommonCertProviderTestUtils.getPrivateKey(SERVER_0_KEY_FILE), ImmutableList.of(getCertFromResourceName(SERVER_0_PEM_FILE)));
    assertThat(provider.savedKey).isNotNull();
    assertThat(provider.savedCertChain).isNotNull();
    assertThat(provider.getSslContext()).isNull();
    // now generate root cert update
    watcherCaptor[0].updateTrustedRoots(ImmutableList.of(getCertFromResourceName(CA_PEM_FILE)));
    assertThat(provider.getSslContext()).isNotNull();
    assertThat(provider.savedKey).isNull();
    assertThat(provider.savedCertChain).isNull();
    assertThat(provider.savedTrustedRoots).isNull();
    TestCallback testCallback = CommonTlsContextTestsUtil.getValueThruCallback(provider);
    doChecksOnSslContext(true, testCallback.updatedSslContext, /* expectedApnProtos= */
    null);
    TestCallback testCallback1 = CommonTlsContextTestsUtil.getValueThruCallback(provider);
    assertThat(testCallback1.updatedSslContext).isSameInstanceAs(testCallback.updatedSslContext);
    // just do root cert update: sslContext should still be the same
    watcherCaptor[0].updateTrustedRoots(ImmutableList.of(getCertFromResourceName(CLIENT_PEM_FILE)));
    assertThat(provider.savedKey).isNull();
    assertThat(provider.savedCertChain).isNull();
    assertThat(provider.savedTrustedRoots).isNotNull();
    testCallback1 = CommonTlsContextTestsUtil.getValueThruCallback(provider);
    assertThat(testCallback1.updatedSslContext).isSameInstanceAs(testCallback.updatedSslContext);
    // now update id cert: sslContext should be updated i.e.different from the previous one
    watcherCaptor[0].updateCertificate(CommonCertProviderTestUtils.getPrivateKey(SERVER_1_KEY_FILE), ImmutableList.of(getCertFromResourceName(SERVER_1_PEM_FILE)));
    assertThat(provider.savedKey).isNull();
    assertThat(provider.savedCertChain).isNull();
    assertThat(provider.savedTrustedRoots).isNull();
    assertThat(provider.getSslContext()).isNotNull();
    testCallback1 = CommonTlsContextTestsUtil.getValueThruCallback(provider);
    assertThat(testCallback1.updatedSslContext).isNotSameInstanceAs(testCallback.updatedSslContext);
}

Example 19 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class ClientSslContextProviderFactoryTest method createCertProviderClientSslContextProvider_withStaticContext.

@Test
public void createCertProviderClientSslContextProvider_withStaticContext() throws XdsInitializationException {
    final CertificateProvider.DistributorWatcher[] watcherCaptor = new CertificateProvider.DistributorWatcher[1];
    createAndRegisterProviderProvider(certificateProviderRegistry, watcherCaptor, "testca", 0);
    CertificateValidationContext staticCertValidationContext = CertificateValidationContext.newBuilder().addAllMatchSubjectAltNames(ImmutableSet.of(StringMatcher.newBuilder().setExact("foo").build(), StringMatcher.newBuilder().setExact("bar").build())).build();
    UpstreamTlsContext upstreamTlsContext = CommonTlsContextTestsUtil.buildUpstreamTlsContextForCertProviderInstance(/* certInstanceName= */
    null, /* certName= */
    null, "gcp_id", "root-default", /* alpnProtocols= */
    null, staticCertValidationContext);
    Bootstrapper.BootstrapInfo bootstrapInfo = CommonBootstrapperTestUtils.getTestBootstrapInfo();
    clientSslContextProviderFactory = new ClientSslContextProviderFactory(bootstrapInfo, certProviderClientSslContextProviderFactory);
    SslContextProvider sslContextProvider = clientSslContextProviderFactory.create(upstreamTlsContext);
    assertThat(sslContextProvider).isInstanceOf(CertProviderClientSslContextProvider.class);
    verifyWatcher(sslContextProvider, watcherCaptor[0]);
}

Example 20 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class DynamicSslContextProvider method updateSslContext.

// this gets called only when requested secrets are ready...
protected final void updateSslContext() {
    try {
        CertificateValidationContext localCertValidationContext = generateCertificateValidationContext();
        SslContextBuilder sslContextBuilder = getSslContextBuilder(localCertValidationContext);
        CommonTlsContext commonTlsContext = getCommonTlsContext();
        if (commonTlsContext != null && commonTlsContext.getAlpnProtocolsCount() > 0) {
            List<String> alpnList = commonTlsContext.getAlpnProtocolsList();
            ApplicationProtocolConfig apn = new ApplicationProtocolConfig(ApplicationProtocolConfig.Protocol.ALPN, ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE, ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT, alpnList);
            sslContextBuilder.applicationProtocolConfig(apn);
        }
        List<Callback> pendingCallbacksCopy;
        SslContext sslContextCopy;
        synchronized (pendingCallbacks) {
            sslContext = sslContextBuilder.build();
            sslContextCopy = sslContext;
            pendingCallbacksCopy = clonePendingCallbacksAndClear();
        }
        makePendingCallbacks(sslContextCopy, pendingCallbacksCopy);
    } catch (Exception e) {
        onError(Status.fromThrowable(e));
        throw new RuntimeException(e);
    }
}