Examples with DownstreamTlsContext io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext used on opensource projects

Example 6 with DownstreamTlsContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext in project grpc-java by grpc.

the class ServerSslContextProviderFactoryTest method createCertProviderServerSslContextProvider_withStaticContext.

@Test
public void createCertProviderServerSslContextProvider_withStaticContext() throws XdsInitializationException {
    final CertificateProvider.DistributorWatcher[] watcherCaptor = new CertificateProvider.DistributorWatcher[1];
    createAndRegisterProviderProvider(certificateProviderRegistry, watcherCaptor, "testca", 0);
    CertificateValidationContext staticCertValidationContext = CertificateValidationContext.newBuilder().addAllMatchSubjectAltNames(ImmutableSet.of(StringMatcher.newBuilder().setExact("foo").build(), StringMatcher.newBuilder().setExact("bar").build())).build();
    DownstreamTlsContext downstreamTlsContext = CommonTlsContextTestsUtil.buildDownstreamTlsContextForCertProviderInstance("gcp_id", "cert-default", "gcp_id", "root-default", /* alpnProtocols= */
    null, staticCertValidationContext, /* requireClientCert= */
    true);
    Bootstrapper.BootstrapInfo bootstrapInfo = CommonBootstrapperTestUtils.getTestBootstrapInfo();
    serverSslContextProviderFactory = new ServerSslContextProviderFactory(bootstrapInfo, certProviderServerSslContextProviderFactory);
    SslContextProvider sslContextProvider = serverSslContextProviderFactory.create(downstreamTlsContext);
    assertThat(sslContextProvider).isInstanceOf(CertProviderServerSslContextProvider.class);
    verifyWatcher(sslContextProvider, watcherCaptor[0]);
}

Example 7 with DownstreamTlsContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext in project grpc-java by grpc.

the class ClientXdsClientDataTest method validateDownstreamTlsContext_hasRequireSni.

@Test
@SuppressWarnings("deprecation")
public void validateDownstreamTlsContext_hasRequireSni() throws ResourceInvalidException {
    CommonTlsContext commonTlsContext = CommonTlsContext.newBuilder().setCombinedValidationContext(CommonTlsContext.CombinedCertificateValidationContext.newBuilder().setValidationContextCertificateProviderInstance(CommonTlsContext.CertificateProviderInstance.getDefaultInstance())).setTlsCertificateCertificateProviderInstance(CommonTlsContext.CertificateProviderInstance.getDefaultInstance()).build();
    DownstreamTlsContext downstreamTlsContext = DownstreamTlsContext.newBuilder().setCommonTlsContext(commonTlsContext).setRequireSni(BoolValue.of(true)).build();
    thrown.expect(ResourceInvalidException.class);
    thrown.expectMessage("downstream-tls-context with require-sni is not supported");
    ClientXdsClient.validateDownstreamTlsContext(downstreamTlsContext, ImmutableSet.of(""));
}

Example 8 with DownstreamTlsContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext in project grpc-java by grpc.

the class ClientXdsClient method parseFilterChain.

@VisibleForTesting
static FilterChain parseFilterChain(io.envoyproxy.envoy.config.listener.v3.FilterChain proto, Set<String> rdsResources, TlsContextManager tlsContextManager, FilterRegistry filterRegistry, Set<FilterChainMatch> uniqueSet, Set<String> certProviderInstances, boolean parseHttpFilters) throws ResourceInvalidException {
    if (proto.getFiltersCount() != 1) {
        throw new ResourceInvalidException("FilterChain " + proto.getName() + " should contain exact one HttpConnectionManager filter");
    }
    io.envoyproxy.envoy.config.listener.v3.Filter filter = proto.getFiltersList().get(0);
    if (!filter.hasTypedConfig()) {
        throw new ResourceInvalidException("FilterChain " + proto.getName() + " contains filter " + filter.getName() + " without typed_config");
    }
    Any any = filter.getTypedConfig();
    // HttpConnectionManager is the only supported network filter at the moment.
    if (!any.getTypeUrl().equals(TYPE_URL_HTTP_CONNECTION_MANAGER)) {
        throw new ResourceInvalidException("FilterChain " + proto.getName() + " contains filter " + filter.getName() + " with unsupported typed_config type " + any.getTypeUrl());
    }
    HttpConnectionManager hcmProto;
    try {
        hcmProto = any.unpack(HttpConnectionManager.class);
    } catch (InvalidProtocolBufferException e) {
        throw new ResourceInvalidException("FilterChain " + proto.getName() + " with filter " + filter.getName() + " failed to unpack message", e);
    }
    io.grpc.xds.HttpConnectionManager httpConnectionManager = parseHttpConnectionManager(hcmProto, rdsResources, filterRegistry, parseHttpFilters, false);
    EnvoyServerProtoData.DownstreamTlsContext downstreamTlsContext = null;
    if (proto.hasTransportSocket()) {
        if (!TRANSPORT_SOCKET_NAME_TLS.equals(proto.getTransportSocket().getName())) {
            throw new ResourceInvalidException("transport-socket with name " + proto.getTransportSocket().getName() + " not supported.");
        }
        DownstreamTlsContext downstreamTlsContextProto;
        try {
            downstreamTlsContextProto = proto.getTransportSocket().getTypedConfig().unpack(DownstreamTlsContext.class);
        } catch (InvalidProtocolBufferException e) {
            throw new ResourceInvalidException("FilterChain " + proto.getName() + " failed to unpack message", e);
        }
        downstreamTlsContext = EnvoyServerProtoData.DownstreamTlsContext.fromEnvoyProtoDownstreamTlsContext(validateDownstreamTlsContext(downstreamTlsContextProto, certProviderInstances));
    }
    FilterChainMatch filterChainMatch = parseFilterChainMatch(proto.getFilterChainMatch());
    checkForUniqueness(uniqueSet, filterChainMatch);
    return FilterChain.create(proto.getName(), filterChainMatch, httpConnectionManager, downstreamTlsContext, tlsContextManager);
}