grpc
/
grpc-go
mirror of https://github.com/grpc/grpc-go.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

creds/google: fix CFE cluster name check (#4893)

This commit is contained in:
Menghan Li 2021-10-25 17:42:07 -07:00 committed by GitHub
parent 4f21cde702
commit 03753f593c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
credentials/google/google_test.go
View File

@ -101,7 +101,7 @@ func TestClientHandshakeBasedOnClusterName(t *testing.T) {
{
name: "with CFE cluster name",
ctx: icredentials.NewClientHandshakeInfoContext(context.Background(), credentials.ClientHandshakeInfo{
Attributes: internal.SetXDSHandshakeClusterName(resolver.Address{}, cfeClusterName).Attributes,
Attributes: internal.SetXDSHandshakeClusterName(resolver.Address{}, "google_cfe_bigtable.googleapis.com").Attributes,
}),
// CFE should use tls.
wantTyp: "tls",

7
credentials/google/xds.go
View File

@ -21,18 +21,19 @@ package google
import (
"context"
"net"
"strings"
"google.golang.org/grpc/credentials"
"google.golang.org/grpc/internal"
)
const cfeClusterName = "google-cfe"
const cfeClusterNamePrefix = "google_cfe_"
// clusterTransportCreds is a combo of TLS + ALTS.
//
// On the client, ClientHandshake picks TLS or ALTS based on address attributes.
// - if attributes has cluster name
// - if cluster name is "google_cfe", use TLS
// - if cluster name has prefix "google_cfe_", use TLS
// - otherwise, use ALTS
// - else, do TLS
//
@ -55,7 +56,7 @@ func (c *clusterTransportCreds) ClientHandshake(ctx context.Context, authority s
return c.tls.ClientHandshake(ctx, authority, rawConn)
}
cn, ok := internal.GetXDSHandshakeClusterName(chi.Attributes)
if !ok || cn == cfeClusterName {
if !ok || strings.HasPrefix(cn, cfeClusterNamePrefix) {
return c.tls.ClientHandshake(ctx, authority, rawConn)
}
// If attributes have cluster name, and cluster name is not cfe, it's a