Examples with DownstreamTlsContext io.grpc.xds.EnvoyServerProtoData.DownstreamTlsContext used on opensource projects

Example 11 with DownstreamTlsContext

use of io.grpc.xds.EnvoyServerProtoData.DownstreamTlsContext in project grpc-java by grpc.

the class TlsContextManagerTest method createServerSslContextProvider_differentInstance.

@Test
public void createServerSslContextProvider_differentInstance() {
    Bootstrapper.BootstrapInfo bootstrapInfoForServer = CommonBootstrapperTestUtils.buildBootstrapInfo("google_cloud_private_spiffe-server", SERVER_1_KEY_FILE, SERVER_1_PEM_FILE, CA_PEM_FILE, "cert-instance2", SERVER_0_KEY_FILE, SERVER_0_PEM_FILE, CA_PEM_FILE);
    DownstreamTlsContext downstreamTlsContext = CommonTlsContextTestsUtil.buildDownstreamTlsContext("google_cloud_private_spiffe-server", false, false);
    TlsContextManagerImpl tlsContextManagerImpl = new TlsContextManagerImpl(bootstrapInfoForServer);
    SslContextProvider serverSecretProvider = tlsContextManagerImpl.findOrCreateServerSslContextProvider(downstreamTlsContext);
    assertThat(serverSecretProvider).isNotNull();
    DownstreamTlsContext downstreamTlsContext1 = CommonTlsContextTestsUtil.buildDownstreamTlsContext("cert-instance2", true, true);
    SslContextProvider serverSecretProvider1 = tlsContextManagerImpl.findOrCreateServerSslContextProvider(downstreamTlsContext1);
    assertThat(serverSecretProvider1).isNotNull();
    assertThat(serverSecretProvider1).isNotSameInstanceAs(serverSecretProvider);
}

Example 12 with DownstreamTlsContext

use of io.grpc.xds.EnvoyServerProtoData.DownstreamTlsContext in project grpc-java by grpc.

the class TlsContextManagerTest method createServerSslContextProvider.

@Test
public void createServerSslContextProvider() {
    Bootstrapper.BootstrapInfo bootstrapInfoForServer = CommonBootstrapperTestUtils.buildBootstrapInfo("google_cloud_private_spiffe-server", SERVER_1_KEY_FILE, SERVER_1_PEM_FILE, CA_PEM_FILE, null, null, null, null);
    DownstreamTlsContext downstreamTlsContext = CommonTlsContextTestsUtil.buildDownstreamTlsContext("google_cloud_private_spiffe-server", false, false);
    TlsContextManagerImpl tlsContextManagerImpl = new TlsContextManagerImpl(bootstrapInfoForServer);
    SslContextProvider serverSecretProvider = tlsContextManagerImpl.findOrCreateServerSslContextProvider(downstreamTlsContext);
    assertThat(serverSecretProvider).isNotNull();
    SslContextProvider serverSecretProvider1 = tlsContextManagerImpl.findOrCreateServerSslContextProvider(downstreamTlsContext);
    assertThat(serverSecretProvider1).isSameInstanceAs(serverSecretProvider);
}

Example 13 with DownstreamTlsContext

use of io.grpc.xds.EnvoyServerProtoData.DownstreamTlsContext in project grpc-java by grpc.

the class TlsContextManagerTest method createServerSslContextProvider_releaseInstance.

@Test
public void createServerSslContextProvider_releaseInstance() {
    DownstreamTlsContext downstreamTlsContext = CommonTlsContextTestsUtil.buildDownstreamTlsContext("google_cloud_private_spiffe-server", false, false);
    TlsContextManagerImpl tlsContextManagerImpl = new TlsContextManagerImpl(mockClientFactory, mockServerFactory);
    SslContextProvider mockProvider = mock(SslContextProvider.class);
    when(mockServerFactory.create(downstreamTlsContext)).thenReturn(mockProvider);
    SslContextProvider serverSecretProvider = tlsContextManagerImpl.findOrCreateServerSslContextProvider(downstreamTlsContext);
    assertThat(serverSecretProvider).isSameInstanceAs(mockProvider);
    verify(mockProvider, never()).close();
    when(mockProvider.getDownstreamTlsContext()).thenReturn(downstreamTlsContext);
    tlsContextManagerImpl.releaseServerSslContextProvider(mockProvider);
    verify(mockProvider, times(1)).close();
}

Example 14 with DownstreamTlsContext

use of io.grpc.xds.EnvoyServerProtoData.DownstreamTlsContext in project grpc-java by grpc.

the class XdsSdsClientServerTest method requireClientAuth_noClientCert_expectException.

@Test
public void requireClientAuth_noClientCert_expectException() throws Exception {
    DownstreamTlsContext downstreamTlsContext = setBootstrapInfoAndBuildDownstreamTlsContext(null, null, null, null, true, true);
    buildServerWithTlsContext(downstreamTlsContext);
    // for TLS, client only uses trustCa
    UpstreamTlsContext upstreamTlsContext = setBootstrapInfoAndBuildUpstreamTlsContext(CLIENT_KEY_FILE, CLIENT_PEM_FILE, false);
    SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub = getBlockingStub(upstreamTlsContext, /* overrideAuthority= */
    OVERRIDE_AUTHORITY);
    try {
        unaryRpc(/* requestMessage= */
        "buddy", blockingStub);
        fail("exception expected");
    } catch (StatusRuntimeException sre) {
        if (sre.getCause() instanceof SSLHandshakeException) {
            assertThat(sre).hasCauseThat().isInstanceOf(SSLHandshakeException.class);
            assertThat(sre).hasCauseThat().hasMessageThat().contains("HANDSHAKE_FAILURE");
        } else {
            // Client cert verification is after handshake in TLSv1.3
            assertThat(sre).hasCauseThat().hasCauseThat().isInstanceOf(SSLException.class);
            assertThat(sre).hasCauseThat().hasMessageThat().contains("CERTIFICATE_REQUIRED");
        }
    }
}

Example 15 with DownstreamTlsContext

use of io.grpc.xds.EnvoyServerProtoData.DownstreamTlsContext in project grpc-java by grpc.

the class XdsSdsClientServerTest method mtlsClientServer_changeServerContext_expectException.

/**
 * mTLS - client auth enabled then update server certs to untrusted.
 */
@Test
public void mtlsClientServer_changeServerContext_expectException() throws Exception {
    UpstreamTlsContext upstreamTlsContext = setBootstrapInfoAndBuildUpstreamTlsContext(CLIENT_KEY_FILE, CLIENT_PEM_FILE, true);
    performMtlsTestAndGetListenerWatcher(upstreamTlsContext, "cert-instance-name2", BAD_SERVER_KEY_FILE, BAD_SERVER_PEM_FILE, CA_PEM_FILE);
    DownstreamTlsContext downstreamTlsContext = CommonTlsContextTestsUtil.buildDownstreamTlsContext("cert-instance-name2", true, true);
    EnvoyServerProtoData.Listener listener = buildListener("listener1", "0.0.0.0", downstreamTlsContext, tlsContextManagerForServer);
    xdsClient.deliverLdsUpdate(LdsUpdate.forTcpListener(listener));
    try {
        SimpleServiceGrpc.SimpleServiceBlockingStub blockingStub = getBlockingStub(upstreamTlsContext, OVERRIDE_AUTHORITY);
        assertThat(unaryRpc("buddy", blockingStub)).isEqualTo("Hello buddy");
        fail("exception expected");
    } catch (StatusRuntimeException sre) {
        assertThat(sre).hasCauseThat().isInstanceOf(SSLHandshakeException.class);
        assertThat(sre).hasCauseThat().hasMessageThat().isEqualTo("General OpenSslEngine problem");
    }
}