Examples with ClientSslConfigBuilder io.servicetalk.transport.api.ClientSslConfigBuilder used on opensource projects

Example 11 with ClientSslConfigBuilder

use of io.servicetalk.transport.api.ClientSslConfigBuilder in project servicetalk by apple.

the class DefaultSingleAddressHttpClientBuilderTest method hostToCharSequenceFunction.

private static void hostToCharSequenceFunction(String hostNamePrefix, String hostName, String hostNameSuffix, @Nullable Integer port) throws Exception {
    try (ServerContext serverCtx = HttpServers.forAddress(localAddress(0)).sslConfig(new ServerSslConfigBuilder(DefaultTestCerts::loadServerPem, DefaultTestCerts::loadServerKey).build()).listenBlockingAndAwait((ctx, request, responseFactory) -> responseFactory.ok());
        BlockingHttpClient client = new DefaultSingleAddressHttpClientBuilder<>(hostNamePrefix + hostName + hostNameSuffix + (port == null ? "" : port), GlobalDnsServiceDiscoverer.mappingServiceDiscoverer(u -> serverCtx.listenAddress())).sslConfig(new ClientSslConfigBuilder(DefaultTestCerts::loadServerCAPem).hostnameVerificationAlgorithm("").build()).buildBlocking()) {
        ReservedBlockingHttpConnection conn = client.reserveConnection(client.get("/"));
        try {
            SSLSession sslSession = conn.connectionContext().sslSession();
            assertNotNull(sslSession);
            assertThat(sslSession.getPeerHost(), startsWith(hostName));
            InetSocketAddress socketAddress = (InetSocketAddress) conn.connectionContext().remoteAddress();
            assertEquals(socketAddress.getPort(), sslSession.getPeerPort());
        } finally {
            conn.release();
        }
    }
}

Example 12 with ClientSslConfigBuilder

use of io.servicetalk.transport.api.ClientSslConfigBuilder in project servicetalk by apple.

the class AbstractTcpServerTest method getTcpClientConfig.

// Visible for overriding.
TcpClientConfig getTcpClientConfig() {
    TcpClientConfig tcpClientConfig = new TcpClientConfig();
    if (sslEnabled) {
        HostAndPort serverHostAndPort = serverHostAndPort(serverContext);
        tcpClientConfig.sslConfig(new ClientSslConfigBuilder(DefaultTestCerts::loadServerCAPem).peerHost(serverPemHostname()).peerPort(serverHostAndPort.port()).build());
    }
    tcpClientConfig.enableWireLogging("servicetalk-tests-wire-logger", TRACE, () -> true);
    return tcpClientConfig;
}

Example 13 with ClientSslConfigBuilder

use of io.servicetalk.transport.api.ClientSslConfigBuilder in project servicetalk by apple.

the class SecureTcpTransportObserverErrorsTest method setUp.

private void setUp(ErrorReason errorReason, SslProvider clientProvider, SslProvider serverProvider) throws Exception {
    ClientSslConfigBuilder clientSslBuilder = defaultClientSslBuilder(clientProvider);
    ServerSslConfigBuilder serverSslBuilder = defaultServerSslBuilder(serverProvider);
    switch(errorReason) {
        case SECURE_CLIENT_TO_PLAIN_SERVER:
            clientConfig.sslConfig(clientSslBuilder.build());
            // In this scenario server may close the connection with or without an exception, depending on OS events
            // Using CountDownLatch to verify that any of these two methods was invoked:
            doAnswer(__ -> {
                serverConnectionClosed.countDown();
                return null;
            // In most cases it closes with
            // io.netty.channel.unix.Errors$NativeIoException: readAddress(..) failed: Connection reset by peer
            }).when(serverConnectionObserver).connectionClosed(any(IOException.class));
            doAnswer(__ -> {
                serverConnectionClosed.countDown();
                return null;
            // But sometimes netty may close the connection before we generate StacklessClosedChannelException
            // in io.servicetalk.transport.netty.internal.DefaultNettyConnection.channelInactive(...)
            }).when(serverConnectionObserver).connectionClosed();
            break;
        case PLAIN_CLIENT_TO_SECURE_SERVER:
            serverConfig.sslConfig(serverSslBuilder.build());
            break;
        case WRONG_HOSTNAME_VERIFICATION:
            clientSslBuilder.hostnameVerificationAlgorithm("HTTPS");
            clientSslBuilder.peerHost("foo");
            clientConfig.sslConfig(clientSslBuilder.build());
            serverConfig.sslConfig(serverSslBuilder.build());
            break;
        case UNTRUSTED_SERVER_CERTIFICATE:
            clientSslBuilder = defaultClientSslBuilder(clientProvider, () -> null);
            clientConfig.sslConfig(clientSslBuilder.build());
            serverConfig.sslConfig(serverSslBuilder.build());
            break;
        case UNTRUSTED_CLIENT_CERTIFICATE:
            clientSslBuilder.keyManager(DefaultTestCerts::loadClientPem, DefaultTestCerts::loadClientKey);
            clientConfig.sslConfig(clientSslBuilder.build());
            serverSslBuilder.clientAuthMode(REQUIRE);
            serverConfig.sslConfig(serverSslBuilder.build());
            break;
        case MISSED_CLIENT_CERTIFICATE:
            clientConfig.sslConfig(clientSslBuilder.build());
            serverSslBuilder.clientAuthMode(REQUIRE);
            serverConfig.sslConfig(serverSslBuilder.build());
            break;
        case NOT_MATCHING_PROTOCOLS:
            clientSslBuilder.sslProtocols("TLSv1.2");
            clientConfig.sslConfig(clientSslBuilder.build());
            serverSslBuilder.sslProtocols("TLSv1.3");
            serverConfig.sslConfig(serverSslBuilder.build());
            break;
        case NOT_MATCHING_CIPHERS:
            clientSslBuilder.ciphers(singletonList("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"));
            clientConfig.sslConfig(clientSslBuilder.build());
            serverSslBuilder.ciphers(singletonList("TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"));
            serverConfig.sslConfig(serverSslBuilder.build());
            break;
        default:
            throw new IllegalArgumentException("Unsupported ErrorSource: " + errorReason);
    }
    setUp();
}

Example 14 with ClientSslConfigBuilder

use of io.servicetalk.transport.api.ClientSslConfigBuilder in project servicetalk by apple.

the class AbstractNettyHttpServerTest method startServer.

private void startServer() throws Exception {
    final InetSocketAddress bindAddress = localAddress(0);
    service(new TestServiceStreaming(publisherSupplier));
    // A small SNDBUF is needed to test that the server defers closing the connection until writes are complete.
    // However, if it is too small, tests that expect certain chunks of data will see those chunks broken up
    // differently.
    final HttpServerBuilder serverBuilder = HttpServers.forAddress(bindAddress).executor(serverExecutor).socketOption(StandardSocketOptions.SO_SNDBUF, 100).protocols(protocol).transportObserver(serverTransportObserver).enableWireLogging("servicetalk-tests-wire-logger", TRACE, () -> true);
    configureServerBuilder(serverBuilder);
    if (sslEnabled) {
        serverBuilder.sslConfig(new ServerSslConfigBuilder(DefaultTestCerts::loadServerPem, DefaultTestCerts::loadServerKey).build());
    }
    if (nonOffloadingServiceFilterFactory != null) {
        serverBuilder.appendNonOffloadingServiceFilter(nonOffloadingServiceFilterFactory);
    }
    if (serviceFilterFactory != null) {
        serverBuilder.appendServiceFilter(serviceFilterFactory);
    }
    if (serverLifecycleObserver != NoopHttpLifecycleObserver.INSTANCE) {
        serverBuilder.lifecycleObserver(serverLifecycleObserver);
    }
    serverContext = awaitIndefinitelyNonNull(listen(serverBuilder.ioExecutor(serverIoExecutor).appendConnectionAcceptorFilter(original -> new DelegatingConnectionAcceptor(connectionAcceptor))).beforeOnSuccess(ctx -> LOGGER.debug("Server started on {}.", ctx.listenAddress())).beforeOnError(throwable -> LOGGER.debug("Failed starting server on {}.", bindAddress)));
    final SingleAddressHttpClientBuilder<HostAndPort, InetSocketAddress> clientBuilder = newClientBuilder();
    if (sslEnabled) {
        clientBuilder.sslConfig(new ClientSslConfigBuilder(DefaultTestCerts::loadServerCAPem).peerHost(serverPemHostname()).build());
    }
    if (connectionFactoryFilter != null) {
        clientBuilder.appendConnectionFactoryFilter(connectionFactoryFilter);
    }
    if (connectionFilterFactory != null) {
        clientBuilder.appendConnectionFilter(connectionFilterFactory);
    }
    if (clientTransportObserver != NoopTransportObserver.INSTANCE) {
        clientBuilder.appendConnectionFactoryFilter(new TransportObserverConnectionFactoryFilter<>(clientTransportObserver));
    }
    if (clientLifecycleObserver != NoopHttpLifecycleObserver.INSTANCE) {
        clientBuilder.appendClientFilter(new HttpLifecycleObserverRequesterFilter(clientLifecycleObserver));
    }
    if (clientFilterFactory != null) {
        clientBuilder.appendClientFilter(clientFilterFactory);
    }
    httpClient = clientBuilder.ioExecutor(clientIoExecutor).executor(clientExecutor).executionStrategy(defaultStrategy()).protocols(protocol).enableWireLogging("servicetalk-tests-wire-logger", TRACE, Boolean.TRUE::booleanValue).buildStreaming();
    httpConnection = httpClient.reserveConnection(httpClient.get("/")).toFuture().get();
}

Example 15 with ClientSslConfigBuilder

use of io.servicetalk.transport.api.ClientSslConfigBuilder in project servicetalk by apple.

the class GrpcSslAndNonSslConnectionsTest method connectingToSecureServerWithSecureClient.

@Test
void connectingToSecureServerWithSecureClient() throws Exception {
    try (ServerContext serverContext = secureGrpcServer();
        BlockingTesterClient client = secureGrpcClient(serverContext, new ClientSslConfigBuilder(DefaultTestCerts::loadServerCAPem).peerHost(serverPemHostname())).buildBlocking(clientFactory())) {
        final TesterProto.TestResponse response = client.test(REQUEST);
        assertThat(response, is(notNullValue()));
        assertThat(response.getMessage(), is(notNullValue()));
    }
}