Skip to content

Commit 9a817f8

Browse files
kannanjgithubkannanjgithub
committed
Merge from system root certs PR.
1 parent 26733ab commit 9a817f8

12 files changed

Lines changed: 39 additions & 53 deletions

‎api/src/main/java/io/grpc/EquivalentAddressGroup.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,10 @@ public final class EquivalentAddressGroup {
5555
*/
5656
public static final Attributes.Key<String> ATTR_LOCALITY_NAME =
5757
Attributes.Key.create("io.grpc.EquivalentAddressGroup.LOCALITY");
58+
/** Name associated with individual address, if available (e.g., DNS name). */
59+
@Attr
60+
public static final Attributes.Key<String> ATTR_ADDRESS_NAME =
61+
Attributes.Key.create("io.grpc.xds.XdsAttributes.addressName");
5862
private final List<SocketAddress> addrs;
5963
private final Attributes attrs;
6064

‎xds/src/main/java/io/grpc/xds/ClusterImplLoadBalancer.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -241,9 +241,9 @@ public Subchannel createSubchannel(CreateSubchannelArgs args) {
241241
.set(ATTR_CLUSTER_LOCALITY, localityAtomicReference);
242242
if (GrpcUtil.getFlag("GRPC_EXPERIMENTAL_XDS_AUTHORITY_REWRITE", false)) {
243243
String hostname = args.getAddresses().get(0).getAttributes()
244-
.get(SecurityProtocolNegotiators.ATTR_ADDRESS_NAME);
244+
.get(EquivalentAddressGroup.ATTR_ADDRESS_NAME);
245245
if (hostname != null) {
246-
attrsBuilder.set(SecurityProtocolNegotiators.ATTR_ADDRESS_NAME, hostname);
246+
attrsBuilder.set(EquivalentAddressGroup.ATTR_ADDRESS_NAME, hostname);
247247
}
248248
}
249249
args = args.toBuilder().setAddresses(addresses).setAttributes(attrsBuilder.build()).build();
@@ -439,7 +439,7 @@ public PickResult pickSubchannel(PickSubchannelArgs args) {
439439
result = PickResult.withSubchannel(result.getSubchannel(),
440440
result.getStreamTracerFactory(),
441441
result.getSubchannel().getAttributes().get(
442-
SecurityProtocolNegotiators.ATTR_ADDRESS_NAME));
442+
EquivalentAddressGroup.ATTR_ADDRESS_NAME));
443443
}
444444
}
445445
return result;

‎xds/src/main/java/io/grpc/xds/ClusterResolverLoadBalancer.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ StatusOr<ClusterResolutionResult> edsUpdateToResult(
195195
.set(XdsAttributes.ATTR_LOCALITY_WEIGHT,
196196
localityLbInfo.localityWeight())
197197
.set(XdsAttributes.ATTR_SERVER_WEIGHT, weight)
198-
.set(XdsAttributes.ATTR_ADDRESS_NAME, endpoint.hostname())
198+
.set(EquivalentAddressGroup.ATTR_ADDRESS_NAME, endpoint.hostname())
199199
.build();
200200
EquivalentAddressGroup eag;
201201
if (config.isHttp11ProxyAvailable()) {

‎xds/src/main/java/io/grpc/xds/internal/security/SecurityProtocolNegotiators.java‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,6 @@
5757
@VisibleForTesting
5858
public final class SecurityProtocolNegotiators {
5959

60-
/** Name associated with individual address, if available (e.g., DNS name). */
61-
@EquivalentAddressGroup.Attr
62-
public static final Attributes.Key<String> ATTR_ADDRESS_NAME =
63-
Attributes.Key.create("io.grpc.xds.XdsAttributes.addressName");
64-
6560
// Prevent instantiation.
6661
private SecurityProtocolNegotiators() {
6762
}
@@ -155,7 +150,7 @@ public ChannelHandler newHandler(GrpcHttp2ConnectionHandler grpcHandler) {
155150
return fallbackProtocolNegotiator.newHandler(grpcHandler);
156151
}
157152
return new ClientSecurityHandler(grpcHandler, localSslContextProviderSupplier,
158-
grpcHandler.getEagAttributes().get(ATTR_ADDRESS_NAME));
153+
grpcHandler.getEagAttributes().get(EquivalentAddressGroup.ATTR_ADDRESS_NAME));
159154
}
160155

161156
@Override

‎xds/src/main/java/io/grpc/xds/internal/security/certprovider/CertProviderClientSslContextProvider.java‎

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,16 @@
2222
import io.grpc.netty.GrpcSslContexts;
2323
import io.grpc.xds.EnvoyServerProtoData.UpstreamTlsContext;
2424
import io.grpc.xds.client.Bootstrapper.CertificateProviderInfo;
25+
import io.grpc.xds.internal.security.CommonTlsContextUtil;
2526
import io.grpc.xds.internal.security.trust.XdsTrustManagerFactory;
2627
import io.netty.handler.ssl.SslContextBuilder;
2728
import java.security.cert.CertStoreException;
2829
import java.security.cert.X509Certificate;
2930
import java.util.AbstractMap;
3031
import java.util.Arrays;
31-
import java.util.Collection;
32-
import java.util.List;
3332
import java.util.Map;
3433
import javax.annotation.Nullable;
34+
import javax.net.ssl.TrustManager;
3535

3636
/** A client SslContext provider using CertificateProviderInstance to fetch secrets. */
3737
final class CertProviderClientSslContextProvider extends CertProviderSslContextProvider {
@@ -56,30 +56,13 @@ final class CertProviderClientSslContextProvider extends CertProviderSslContextP
5656
upstreamTlsContext,
5757
certificateProviderStore);
5858
this.sniForSanMatching = upstreamTlsContext.getAutoSniSanValidation()? sniForSanMatching : null;
59-
if (rootCertInstance == null
60-
&& CommonTlsContextUtil.isUsingSystemRootCerts(tlsContext.getCommonTlsContext())
61-
&& !isMtls()) {
62-
try {
63-
// Instantiate sslContext so that addCallback will immediately update the callback with
64-
// the SslContext.
65-
AbstractMap.SimpleImmutableEntry<SslContextBuilder, TrustManager> sslContextBuilderAndTm =
66-
getSslContextBuilderAndExtendedX509TrustManager(staticCertificateValidationContext);
67-
sslContextAndExtendedX509TrustManager = new AbstractMap.SimpleImmutableEntry(
68-
sslContextBuilderAndTm.getKey().build(), sslContextBuilderAndTm.getValue());
69-
} catch (CertStoreException | CertificateException | IOException e) {
70-
throw new RuntimeException(e);
71-
}
72-
}
7359
}
7460

7561
@Override
76-
protected final SslContextBuilder getSslContextBuilder(
77-
CertificateValidationContext certificateValidationContextdationContext)
78-
throws CertStoreException {
7962
protected final AbstractMap.SimpleImmutableEntry<SslContextBuilder, TrustManager>
8063
getSslContextBuilderAndExtendedX509TrustManager(
8164
CertificateValidationContext certificateValidationContext)
82-
throws CertificateException, IOException, CertStoreException {
65+
throws CertStoreException {
8366
SslContextBuilder sslContextBuilder = GrpcSslContexts.forClient();
8467
if (savedSpiffeTrustMap != null) {
8568
sslContextBuilder = sslContextBuilder.trustManager(
@@ -91,6 +74,7 @@ protected final SslContextBuilder getSslContextBuilder(
9174
new XdsTrustManagerFactory(
9275
savedTrustedRoots.toArray(new X509Certificate[0]),
9376
certificateValidationContext, sniForSanMatching));
77+
}
9478
XdsTrustManagerFactory trustManagerFactory;
9579
if (rootCertInstance != null) {
9680
if (savedSpiffeTrustMap != null) {

‎xds/src/test/java/io/grpc/xds/ClusterImplLoadBalancerTest.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -811,10 +811,10 @@ public void endpointAddressesAttachedWithClusterName() {
811811
new FixedResultPicker(PickResult.withSubchannel(subchannel)));
812812
}
813813
});
814-
assertThat(subchannel.getAttributes().get(SecurityProtocolNegotiators.ATTR_ADDRESS_NAME)).isEqualTo(
814+
assertThat(subchannel.getAttributes().get(EquivalentAddressGroup.ATTR_ADDRESS_NAME)).isEqualTo(
815815
"authority-host-name");
816816
for (EquivalentAddressGroup eag : subchannel.getAllAddresses()) {
817-
assertThat(eag.getAttributes().get(SecurityProtocolNegotiators.ATTR_ADDRESS_NAME))
817+
assertThat(eag.getAttributes().get(EquivalentAddressGroup.ATTR_ADDRESS_NAME))
818818
.isEqualTo("authority-host-name");
819819
}
820820

@@ -863,9 +863,9 @@ public void endpointAddressesAttachedWithClusterName() {
863863
}
864864
});
865865
// Sub Channel wrapper args won't have the address name although addresses will.
866-
assertThat(subchannel.getAttributes().get(SecurityProtocolNegotiators.ATTR_ADDRESS_NAME)).isNull();
866+
assertThat(subchannel.getAttributes().get(EquivalentAddressGroup.ATTR_ADDRESS_NAME)).isNull();
867867
for (EquivalentAddressGroup eag : subchannel.getAllAddresses()) {
868-
assertThat(eag.getAttributes().get(SecurityProtocolNegotiators.ATTR_ADDRESS_NAME))
868+
assertThat(eag.getAttributes().get(EquivalentAddressGroup.ATTR_ADDRESS_NAME))
869869
.isEqualTo("authority-host-name");
870870
}
871871

@@ -1019,7 +1019,7 @@ public String toString() {
10191019
// Unique but arbitrary string
10201020
.set(EquivalentAddressGroup.ATTR_LOCALITY_NAME, locality.toString());
10211021
if (authorityHostname != null) {
1022-
attributes.set(SecurityProtocolNegotiators.ATTR_ADDRESS_NAME, authorityHostname);
1022+
attributes.set(EquivalentAddressGroup.ATTR_ADDRESS_NAME, authorityHostname);
10231023
}
10241024
EquivalentAddressGroup eag = new EquivalentAddressGroup(new FakeSocketAddress(name),
10251025
attributes.build());

‎xds/src/test/java/io/grpc/xds/ClusterResolverLoadBalancerTest.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -408,7 +408,7 @@ public void edsClustersEndpointHostname_addedToAddressAttribute() {
408408

409409
assertThat(
410410
childBalancer.addresses.get(0).getAttributes()
411-
.get(XdsAttributes.ATTR_ADDRESS_NAME)).isEqualTo("hostname1");
411+
.get(EquivalentAddressGroup.ATTR_ADDRESS_NAME)).isEqualTo("hostname1");
412412
}
413413

414414
@Test
@@ -897,7 +897,7 @@ public void onlyLogicalDnsCluster_endpointsResolved() {
897897
newInetSocketAddress("127.0.2.1", 9000), newInetSocketAddress("127.0.2.2", 9000)))),
898898
childBalancer.addresses);
899899
assertThat(childBalancer.addresses.get(0).getAttributes()
900-
.get(XdsAttributes.ATTR_ADDRESS_NAME)).isEqualTo(DNS_HOST_NAME + ":9000");
900+
.get(EquivalentAddressGroup.ATTR_ADDRESS_NAME)).isEqualTo(DNS_HOST_NAME + ":9000");
901901
}
902902

903903
@Test
@@ -995,7 +995,7 @@ public void config_equalsTester() {
995995
ServerInfo lrsServerInfo =
996996
ServerInfo.create("lrs.googleapis.com", InsecureChannelCredentials.create());
997997
UpstreamTlsContext tlsContext =
998-
CommonTlsContextTestsUtil.buildUpstreamTlsContext("google_cloud_private_spiffe", true);
998+
CommonTlsContextTestsUtil.buildUpstreamTlsContext("google_cloud_private_spiffe", true, null, false);
999999
DiscoveryMechanism edsDiscoveryMechanism1 =
10001000
DiscoveryMechanism.forEds(CLUSTER, EDS_SERVICE_NAME, lrsServerInfo, 100L, tlsContext,
10011001
Collections.emptyMap(), null);

‎xds/src/test/java/io/grpc/xds/XdsSecurityClientServerTest.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,6 @@
8585
import java.net.Inet4Address;
8686
import java.net.InetSocketAddress;
8787
import java.net.URI;
88-
import java.net.URISyntaxException;
8988
import java.nio.file.Files;
9089
import java.nio.file.Path;
9190
import java.security.KeyStore;
@@ -840,7 +839,7 @@ private SimpleServiceGrpc.SimpleServiceBlockingStub getBlockingStub(
840839
upstreamTlsContext, tlsContextManagerForClient))
841840
: Attributes.newBuilder();
842841
if (addrNameAttribute != null) {
843-
sslContextAttributesBuilder.set(SecurityProtocolNegotiators.ATTR_ADDRESS_NAME, addrNameAttribute);
842+
sslContextAttributesBuilder.set(EquivalentAddressGroup.ATTR_ADDRESS_NAME, addrNameAttribute);
844843
}
845844
sslContextAttributes = sslContextAttributesBuilder.build();
846845
fakeNameResolverFactory.setServers(

‎xds/src/test/java/io/grpc/xds/internal/security/ClientSslContextProviderFactoryTest.java‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -87,13 +87,13 @@ public void createCertProviderClientSslContextProvider() throws XdsInitializatio
8787
new ClientSslContextProviderFactory(
8888
bootstrapInfo, certProviderClientSslContextProviderFactory);
8989
SslContextProvider sslContextProvider =
90-
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry(upstreamTlsContext, SNI));
90+
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry<>(upstreamTlsContext, SNI));
9191
assertThat(sslContextProvider.getClass().getSimpleName()).isEqualTo(
9292
"CertProviderClientSslContextProvider");
9393
verifyWatcher(sslContextProvider, watcherCaptor[0], false);
9494
// verify that bootstrapInfo is cached...
9595
sslContextProvider =
96-
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry(upstreamTlsContext, SNI));
96+
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry<>(upstreamTlsContext, SNI));
9797
assertThat(sslContextProvider.getClass().getSimpleName()).isEqualTo(
9898
"CertProviderClientSslContextProvider");
9999
}
@@ -120,7 +120,7 @@ public void bothPresent_expectCertProviderClientSslContextProvider()
120120
new ClientSslContextProviderFactory(
121121
bootstrapInfo, certProviderClientSslContextProviderFactory);
122122
SslContextProvider sslContextProvider =
123-
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry(upstreamTlsContext, SNI));
123+
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry<>(upstreamTlsContext, SNI));
124124
assertThat(sslContextProvider.getClass().getSimpleName()).isEqualTo(
125125
"CertProviderClientSslContextProvider");
126126
verifyWatcher(sslContextProvider, watcherCaptor[0], true);
@@ -146,7 +146,7 @@ public void createCertProviderClientSslContextProvider_onlyRootCert()
146146
new ClientSslContextProviderFactory(
147147
bootstrapInfo, certProviderClientSslContextProviderFactory);
148148
SslContextProvider sslContextProvider =
149-
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry(upstreamTlsContext, SNI));
149+
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry<>(upstreamTlsContext, SNI));
150150
assertThat(sslContextProvider.getClass().getSimpleName()).isEqualTo(
151151
"CertProviderClientSslContextProvider");
152152
verifyWatcher(sslContextProvider, watcherCaptor[0], true);
@@ -180,7 +180,7 @@ public void createCertProviderClientSslContextProvider_withStaticContext()
180180
new ClientSslContextProviderFactory(bootstrapInfo,
181181
certProviderClientSslContextProviderFactory);
182182
SslContextProvider sslContextProvider =
183-
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry(upstreamTlsContext, SNI));
183+
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry<>(upstreamTlsContext, SNI));
184184
assertThat(sslContextProvider.getClass().getSimpleName()).isEqualTo(
185185
"CertProviderClientSslContextProvider");
186186
verifyWatcher(sslContextProvider, watcherCaptor[0], true);
@@ -210,7 +210,7 @@ public void createCertProviderClientSslContextProvider_2providers()
210210
new ClientSslContextProviderFactory(
211211
bootstrapInfo, certProviderClientSslContextProviderFactory);
212212
SslContextProvider sslContextProvider =
213-
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry(upstreamTlsContext, SNI));
213+
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry<>(upstreamTlsContext, SNI));
214214
assertThat(sslContextProvider.getClass().getSimpleName()).isEqualTo(
215215
"CertProviderClientSslContextProvider");
216216
verifyWatcher(sslContextProvider, watcherCaptor[0], true);
@@ -247,7 +247,7 @@ public void createNewCertProviderClientSslContextProvider_withSans() {
247247
new ClientSslContextProviderFactory(
248248
bootstrapInfo, certProviderClientSslContextProviderFactory);
249249
SslContextProvider sslContextProvider =
250-
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry(upstreamTlsContext, SNI));
250+
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry<>(upstreamTlsContext, SNI));
251251
assertThat(sslContextProvider.getClass().getSimpleName()).isEqualTo(
252252
"CertProviderClientSslContextProvider");
253253
verifyWatcher(sslContextProvider, watcherCaptor[0], true);
@@ -281,7 +281,7 @@ public void createNewCertProviderClientSslContextProvider_onlyRootCert() {
281281
new ClientSslContextProviderFactory(
282282
bootstrapInfo, certProviderClientSslContextProviderFactory);
283283
SslContextProvider sslContextProvider =
284-
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry(upstreamTlsContext, SNI));
284+
clientSslContextProviderFactory.create(new AbstractMap.SimpleImmutableEntry<>(upstreamTlsContext, SNI));
285285
assertThat(sslContextProvider.getClass().getSimpleName()).isEqualTo(
286286
"CertProviderClientSslContextProvider");
287287
verifyWatcher(sslContextProvider, watcherCaptor[0], true);

‎xds/src/test/java/io/grpc/xds/internal/security/SecurityProtocolNegotiatorsTest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
import io.grpc.Attributes;
3737
import io.grpc.ChannelLogger;
3838
import io.grpc.ChannelLogger.ChannelLogLevel;
39+
import io.grpc.EquivalentAddressGroup;
3940
import io.grpc.internal.FakeClock;
4041
import io.grpc.internal.TestUtils.NoopChannelLogger;
4142
import io.grpc.netty.GrpcHttp2ConnectionHandler;
@@ -165,7 +166,7 @@ public void clientSecurityProtocolNegotiatorNewHandler_autoHostSni_hostnameIsPas
165166
Attributes.newBuilder()
166167
.set(SecurityProtocolNegotiators.ATTR_SSL_CONTEXT_PROVIDER_SUPPLIER,
167168
new SslContextProviderSupplier(upstreamTlsContext, mockTlsContextManager))
168-
.set(SecurityProtocolNegotiators.ATTR_ADDRESS_NAME, FAKE_AUTHORITY)
169+
.set(EquivalentAddressGroup.ATTR_ADDRESS_NAME, FAKE_AUTHORITY)
169170
.build());
170171
ChannelHandler newHandler = pn.newHandler(mockHandler);
171172
assertThat(newHandler).isNotNull();

0 commit comments

Comments
 (0)