Examples with DownstreamTlsContext io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext used on opensource projects

Example 1 with DownstreamTlsContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext in project grpc-java by grpc.

the class ClientXdsClientDataTest method validateDownstreamTlsContext_noCommonTlsContext.

@Test
public void validateDownstreamTlsContext_noCommonTlsContext() throws ResourceInvalidException {
    DownstreamTlsContext downstreamTlsContext = DownstreamTlsContext.getDefaultInstance();
    thrown.expect(ResourceInvalidException.class);
    thrown.expectMessage("common-tls-context is required in downstream-tls-context");
    ClientXdsClient.validateDownstreamTlsContext(downstreamTlsContext, null);
}

Example 2 with DownstreamTlsContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext in project grpc-java by grpc.

the class ClientXdsClientDataTest method validateDownstreamTlsContext_hasOcspStaplePolicy.

@Test
@SuppressWarnings("deprecation")
public void validateDownstreamTlsContext_hasOcspStaplePolicy() throws ResourceInvalidException {
    CommonTlsContext commonTlsContext = CommonTlsContext.newBuilder().setCombinedValidationContext(CommonTlsContext.CombinedCertificateValidationContext.newBuilder().setValidationContextCertificateProviderInstance(CommonTlsContext.CertificateProviderInstance.getDefaultInstance())).setTlsCertificateCertificateProviderInstance(CommonTlsContext.CertificateProviderInstance.getDefaultInstance()).build();
    DownstreamTlsContext downstreamTlsContext = DownstreamTlsContext.newBuilder().setCommonTlsContext(commonTlsContext).setOcspStaplePolicy(DownstreamTlsContext.OcspStaplePolicy.STRICT_STAPLING).build();
    thrown.expect(ResourceInvalidException.class);
    thrown.expectMessage("downstream-tls-context with ocsp_staple_policy value STRICT_STAPLING is not supported");
    ClientXdsClient.validateDownstreamTlsContext(downstreamTlsContext, ImmutableSet.of(""));
}

Example 3 with DownstreamTlsContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext in project grpc-java by grpc.

the class TlsContextManagerImpl method findOrCreateServerSslContextProvider.

@Override
public SslContextProvider findOrCreateServerSslContextProvider(DownstreamTlsContext downstreamTlsContext) {
    checkNotNull(downstreamTlsContext, "downstreamTlsContext");
    CommonTlsContext.Builder builder = downstreamTlsContext.getCommonTlsContext().toBuilder();
    downstreamTlsContext = new DownstreamTlsContext(builder.build(), downstreamTlsContext.isRequireClientCertificate());
    return mapForServers.get(downstreamTlsContext);
}

Example 4 with DownstreamTlsContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext in project grpc-java by grpc.

the class ServerSslContextProviderFactoryTest method createNewCertProviderServerSslContextProvider_withSans.

@Test
public void createNewCertProviderServerSslContextProvider_withSans() throws XdsInitializationException {
    final CertificateProvider.DistributorWatcher[] watcherCaptor = new CertificateProvider.DistributorWatcher[2];
    createAndRegisterProviderProvider(certificateProviderRegistry, watcherCaptor, "testca", 0);
    createAndRegisterProviderProvider(certificateProviderRegistry, watcherCaptor, "file_watcher", 1);
    CertificateValidationContext staticCertValidationContext = CertificateValidationContext.newBuilder().addAllMatchSubjectAltNames(ImmutableSet.of(StringMatcher.newBuilder().setExact("foo").build(), StringMatcher.newBuilder().setExact("bar").build())).build();
    DownstreamTlsContext downstreamTlsContext = CommonTlsContextTestsUtil.buildNewDownstreamTlsContextForCertProviderInstance("gcp_id", "cert-default", "file_provider", "root-default", /* alpnProtocols= */
    null, staticCertValidationContext, /* requireClientCert= */
    true);
    Bootstrapper.BootstrapInfo bootstrapInfo = CommonBootstrapperTestUtils.getTestBootstrapInfo();
    serverSslContextProviderFactory = new ServerSslContextProviderFactory(bootstrapInfo, certProviderServerSslContextProviderFactory);
    SslContextProvider sslContextProvider = serverSslContextProviderFactory.create(downstreamTlsContext);
    assertThat(sslContextProvider).isInstanceOf(CertProviderServerSslContextProvider.class);
    verifyWatcher(sslContextProvider, watcherCaptor[0]);
    verifyWatcher(sslContextProvider, watcherCaptor[1]);
}

Example 5 with DownstreamTlsContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext in project grpc-java by grpc.

the class ServerSslContextProviderFactoryTest method bothPresent_expectCertProviderServerSslContextProvider.

@Test
public void bothPresent_expectCertProviderServerSslContextProvider() throws XdsInitializationException {
    final CertificateProvider.DistributorWatcher[] watcherCaptor = new CertificateProvider.DistributorWatcher[1];
    createAndRegisterProviderProvider(certificateProviderRegistry, watcherCaptor, "testca", 0);
    DownstreamTlsContext downstreamTlsContext = CommonTlsContextTestsUtil.buildDownstreamTlsContextForCertProviderInstance("gcp_id", "cert-default", "gcp_id", "root-default", /* alpnProtocols= */
    null, /* staticCertValidationContext= */
    null, /* requireClientCert= */
    true);
    CommonTlsContext.Builder builder = downstreamTlsContext.getCommonTlsContext().toBuilder();
    builder = ClientSslContextProviderFactoryTest.addFilenames(builder, "foo.pem", "foo.key", "root.pem");
    downstreamTlsContext = new EnvoyServerProtoData.DownstreamTlsContext(builder.build(), downstreamTlsContext.isRequireClientCertificate());
    Bootstrapper.BootstrapInfo bootstrapInfo = CommonBootstrapperTestUtils.getTestBootstrapInfo();
    serverSslContextProviderFactory = new ServerSslContextProviderFactory(bootstrapInfo, certProviderServerSslContextProviderFactory);
    SslContextProvider sslContextProvider = serverSslContextProviderFactory.create(downstreamTlsContext);
    assertThat(sslContextProvider).isInstanceOf(CertProviderServerSslContextProvider.class);
    verifyWatcher(sslContextProvider, watcherCaptor[0]);
}