credentials/google: support new-style xDS cluster names (#5399)

credentials/google/google_test.go

@@ -122,6 +122,22 @@ func (s) TestClientHandshakeBasedOnClusterName(t *testing.T) {
 				// CFE should use tls.
 				wantTyp: "tls",
 			},
+			{
+				name: "with xdstp CFE cluster name",
+				ctx: icredentials.NewClientHandshakeInfoContext(context.Background(), credentials.ClientHandshakeInfo{
+					Attributes: internal.SetXDSHandshakeClusterName(resolver.Address{}, "xdstp://traffic-director-c2p.xds.googleapis.com/envoy.config.cluster.v3.Cluster/google_cfe_bigtable.googleapis.com").Attributes,
+				}),
+				// CFE should use tls.
+				wantTyp: "tls",
+			},
+			{
+				name: "with xdstp non-CFE cluster name",
+				ctx: icredentials.NewClientHandshakeInfoContext(context.Background(), credentials.ClientHandshakeInfo{
+					Attributes: internal.SetXDSHandshakeClusterName(resolver.Address{}, "xdstp://other.com/envoy.config.cluster.v3.Cluster/google_cfe_bigtable.googleapis.com").Attributes,
+				}),
+				// non-CFE should use atls.
+				wantTyp: "alts",
+			},
 		}
 		for _, tt := range tests {
 			t.Run(bundleTyp+" "+tt.name, func(t *testing.T) {

credentials/google/xds.go

@@ -21,6 +21,7 @@ package google
 import (
 	"context"
 	"net"
+	"net/url"
 	"strings"
 
 	"google.golang.org/grpc/credentials"
@@ -28,12 +29,16 @@ import (
 )
 
 const cfeClusterNamePrefix = "google_cfe_"
+const cfeClusterResourceNamePrefix = "/envoy.config.cluster.v3.Cluster/google_cfe_"
+const cfeClusterAuthorityName = "traffic-director-c2p.xds.googleapis.com"
 
 // clusterTransportCreds is a combo of TLS + ALTS.
 //
 // On the client, ClientHandshake picks TLS or ALTS based on address attributes.
 // - if attributes has cluster name
-//   - if cluster name has prefix "google_cfe_", use TLS
+//   - if cluster name has prefix "google_cfe_", or
+//     "xdstp://traffic-director-c2p.xds.googleapis.com/envoy.config.cluster.v3.Cluster/google_cfe_",
+//     use TLS
 //   - otherwise, use ALTS
 // - else, do TLS
 //
@@ -50,18 +55,49 @@ func newClusterTransportCreds(tls, alts credentials.TransportCredentials) *clust
 	}
 }
 
-func (c *clusterTransportCreds) ClientHandshake(ctx context.Context, authority string, rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+// clusterName returns the xDS cluster name stored in the attributes in the
+// context.
+func clusterName(ctx context.Context) string {
 	chi := credentials.ClientHandshakeInfoFromContext(ctx)
 	if chi.Attributes == nil {
-		return c.tls.ClientHandshake(ctx, authority, rawConn)
+		return ""
 	}
-	cn, ok := internal.GetXDSHandshakeClusterName(chi.Attributes)
+	cluster, _ := internal.GetXDSHandshakeClusterName(chi.Attributes)
-	if !ok || strings.HasPrefix(cn, cfeClusterNamePrefix) {
+	return cluster
-		return c.tls.ClientHandshake(ctx, authority, rawConn)
+}
+
+// isDirectPathCluster returns true if the cluster in the context is a
+// directpath cluster, meaning ALTS should be used.
+func isDirectPathCluster(ctx context.Context) bool {
+	cluster := clusterName(ctx)
+	if cluster == "" {
+		// No cluster; not xDS; use TLS.
+		return false
 	}
+	if strings.HasPrefix(cluster, cfeClusterNamePrefix) {
+		// xDS cluster prefixed by "google_cfe_"; use TLS.
+		return false
+	}
+	if !strings.HasPrefix(cluster, "xdstp:") {
+		// Other xDS cluster name; use ALTS.
+		return true
+	}
+	u, err := url.Parse(cluster)
+	if err != nil {
+		// Shouldn't happen, but assume ALTS.
+		return true
+	}
+	// If authority AND path match our CFE checks, use TLS; otherwise use ALTS.
+	return u.Host != cfeClusterAuthorityName || !strings.HasPrefix(u.Path, cfeClusterResourceNamePrefix)
+}
+
+func (c *clusterTransportCreds) ClientHandshake(ctx context.Context, authority string, rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	if isDirectPathCluster(ctx) {
 		// If attributes have cluster name, and cluster name is not cfe, it's a
 		// backend address, use ALTS.
 		return c.alts.ClientHandshake(ctx, authority, rawConn)
+	}
+	return c.tls.ClientHandshake(ctx, authority, rawConn)
 }
 
 func (c *clusterTransportCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {

credentials/google/xds_test.go

@@ -0,0 +1,58 @@
+/*
+ *
+ * Copyright 2021 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package google
+
+import (
+	"context"
+	"testing"
+
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal"
+	icredentials "google.golang.org/grpc/internal/credentials"
+	"google.golang.org/grpc/resolver"
+)
+
+func (s) TestIsDirectPathCluster(t *testing.T) {
+	c := func(cluster string) context.Context {
+		return icredentials.NewClientHandshakeInfoContext(context.Background(), credentials.ClientHandshakeInfo{
+			Attributes: internal.SetXDSHandshakeClusterName(resolver.Address{}, cluster).Attributes,
+		})
+	}
+
+	testCases := []struct {
+		name string
+		ctx  context.Context
+		want bool
+	}{
+		{"not an xDS cluster", context.Background(), false},
+		{"cfe", c("google_cfe_bigtable.googleapis.com"), false},
+		{"non-cfe", c("google_bigtable.googleapis.com"), true},
+		{"starts with xdstp but not cfe format", c("xdstp:google_cfe_bigtable.googleapis.com"), true},
+		{"no authority", c("xdstp:///envoy.config.cluster.v3.Cluster/google_cfe_"), true},
+		{"wrong authority", c("xdstp://foo.bar/envoy.config.cluster.v3.Cluster/google_cfe_"), true},
+		{"xdstp CFE", c("xdstp://traffic-director-c2p.xds.googleapis.com/envoy.config.cluster.v3.Cluster/google_cfe_"), false},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isDirectPathCluster(tc.ctx); got != tc.want {
+				t.Errorf("isDirectPathCluster(_) = %v; want %v", got, tc.want)
+			}
+		})
+	}
+}