mirror of https://github.com/grpc/grpc-java.git
xds: remove unused SecretManager code based on separate TlsCertificate and CertificateValidationContext secrets (#6310)
This commit is contained in:
sanjaypujare
GitHub
parent
13fad99549
commit
ed845991db
|
|
@ -1,54 +0,0 @@
|
|||
/*
|
||||
* Copyright 2019 The gRPC Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package io.grpc.xds.sds;
|
||||
|
||||
import static com.google.common.base.Preconditions.checkNotNull;
|
||||
|
||||
import io.envoyproxy.envoy.api.v2.core.ConfigSource;
|
||||
import io.grpc.Internal;
|
||||
|
||||
/**
|
||||
* SecretManager to manage secrets. This is used by gRPC-xds to access secrets
|
||||
* and not part of the public API of gRPC
|
||||
*/
|
||||
// TODO(sanjaypujare): Lifecycle management for this manager and the {@link SecretProvider}s
|
||||
// to be implemented using an object-pool mechanism
|
||||
@Internal
|
||||
public final class SecretManager {
|
||||
|
||||
/**
|
||||
* Finds an existing SecretProvider or creates it if it doesn't exist.
|
||||
*
|
||||
* @param configSource from the SdsSecretConfig
|
||||
* @param name from the SdsSecretConfig
|
||||
* @return the SecretProvider
|
||||
*/
|
||||
public SecretProvider<TlsCertificateStore> findOrCreateTlsCertificateProvider(
|
||||
ConfigSource configSource, String name) {
|
||||
checkNotNull(configSource, "configSource");
|
||||
checkNotNull(name, "name");
|
||||
// for now we support only path/volume based secret provider
|
||||
if (configSource.getConfigSourceSpecifierCase()
|
||||
!= ConfigSource.ConfigSourceSpecifierCase.PATH) {
|
||||
throw new UnsupportedOperationException("Only file based secret supported");
|
||||
}
|
||||
return secretVolumeCertificateProviders.findOrCreate(configSource, name);
|
||||
}
|
||||
|
||||
private final TlsCertificateSecretProviderMap secretVolumeCertificateProviders =
|
||||
new TlsCertificateSecretProviderMap();
|
||||
}
|
||||
|
|
@ -1,61 +0,0 @@
|
|||
/*
|
||||
* Copyright 2019 The gRPC Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package io.grpc.xds.sds;
|
||||
|
||||
import static com.google.common.base.Preconditions.checkNotNull;
|
||||
|
||||
import io.envoyproxy.envoy.api.v2.core.ConfigSource;
|
||||
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
/**
|
||||
* SecretProviderMap used by SecretManager to maintain certificateProviders.
|
||||
*
|
||||
* @param <T> Type of secret stored in this Map
|
||||
*/
|
||||
abstract class SecretProviderMap<T> {
|
||||
|
||||
private final Map<String, SecretProvider<T>> providers;
|
||||
|
||||
protected SecretProviderMap() {
|
||||
providers = new HashMap<>();
|
||||
}
|
||||
|
||||
/**
|
||||
* Finds an existing SecretProvider or creates it if it doesn't exist.
|
||||
*
|
||||
* @param configSource source part of the SdsSecretConfig
|
||||
* @param name name of the SdsSecretConfig
|
||||
* @return SecrerProvider
|
||||
*/
|
||||
final synchronized SecretProvider<T> findOrCreate(
|
||||
ConfigSource configSource, String name) {
|
||||
checkNotNull(configSource, "configSource");
|
||||
checkNotNull(name, "name");
|
||||
|
||||
String mapKey = "" + configSource.hashCode() + "." + name;
|
||||
SecretProvider<T> provider = providers.get(mapKey);
|
||||
if (provider == null) {
|
||||
provider = create(configSource, name);
|
||||
providers.put(mapKey, provider);
|
||||
}
|
||||
return provider;
|
||||
}
|
||||
|
||||
abstract SecretProvider<T> create(ConfigSource configSource, String name);
|
||||
}
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
/*
|
||||
* Copyright 2019 The gRPC Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package io.grpc.xds.sds;
|
||||
|
||||
import static com.google.common.base.Preconditions.checkNotNull;
|
||||
|
||||
import io.envoyproxy.envoy.api.v2.core.ConfigSource;
|
||||
|
||||
final class TlsCertificateSecretProviderMap extends SecretProviderMap<TlsCertificateStore> {
|
||||
|
||||
@Override
|
||||
SecretProvider<TlsCertificateStore> create(ConfigSource configSource, String name) {
|
||||
checkNotNull(configSource, "configSource");
|
||||
checkNotNull(name, "name");
|
||||
// for now we support only path/volume based secret provider
|
||||
if (configSource.getConfigSourceSpecifierCase()
|
||||
!= ConfigSource.ConfigSourceSpecifierCase.PATH) {
|
||||
throw new UnsupportedOperationException("Only file based secret supported");
|
||||
}
|
||||
return new TlsCertificateSecretVolumeSecretProvider(configSource.getPath(), name);
|
||||
}
|
||||
}
|
||||
|
|
@ -1,89 +0,0 @@
|
|||
/*
|
||||
* Copyright 2019 The gRPC Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package io.grpc.xds.sds;
|
||||
|
||||
import static com.google.common.base.Preconditions.checkNotNull;
|
||||
|
||||
import com.google.common.annotations.VisibleForTesting;
|
||||
import com.google.protobuf.ByteString;
|
||||
import java.io.FileInputStream;
|
||||
import java.io.IOException;
|
||||
import java.util.concurrent.ExecutionException;
|
||||
import java.util.concurrent.Executor;
|
||||
import java.util.logging.Level;
|
||||
import java.util.logging.Logger;
|
||||
|
||||
/**
|
||||
* Implementation of a file based secret provider.
|
||||
*/
|
||||
final class TlsCertificateSecretVolumeSecretProvider
|
||||
implements SecretProvider<TlsCertificateStore> {
|
||||
|
||||
public static final String PEM = ".pem";
|
||||
public static final String CRT = ".crt";
|
||||
private static final Logger logger = Logger
|
||||
.getLogger(TlsCertificateSecretVolumeSecretProvider.class.getName());
|
||||
private final String path;
|
||||
|
||||
// for now mark it unused
|
||||
@SuppressWarnings("unused")
|
||||
private final String name;
|
||||
|
||||
TlsCertificateSecretVolumeSecretProvider(String path, String name) {
|
||||
this.path = checkNotNull(path, "path");
|
||||
this.name = checkNotNull(name, "name");
|
||||
}
|
||||
|
||||
@Override
|
||||
public void addCallback(final Callback<TlsCertificateStore> callback, Executor executor) {
|
||||
checkNotNull(callback, "callback");
|
||||
checkNotNull(executor, "executor");
|
||||
executor.execute(new Runnable() {
|
||||
@Override
|
||||
public void run() {
|
||||
// as per the contract of this provider we will get the current on-disk
|
||||
// contents of the files
|
||||
try {
|
||||
TlsCertificateStore tlsCert = get();
|
||||
callback.updateSecret(tlsCert);
|
||||
} catch (ExecutionException e) {
|
||||
logger.log(
|
||||
Level.SEVERE,
|
||||
"RuntimeException from get()",
|
||||
e);
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the current contents of the private key and cert file. Assume the key has
|
||||
* <literal>.pem</literal> extension and cert has <literal>.crt</literal> extension
|
||||
* (needs to match mounted secrets).
|
||||
*/
|
||||
@VisibleForTesting
|
||||
TlsCertificateStore get() throws ExecutionException {
|
||||
try {
|
||||
final FileInputStream pemStream = new FileInputStream(path + PEM);
|
||||
final FileInputStream crtStream = new FileInputStream(path + CRT);
|
||||
return new TlsCertificateStore(ByteString.readFrom(pemStream),
|
||||
ByteString.readFrom(crtStream));
|
||||
} catch (IOException e) {
|
||||
throw new ExecutionException(e);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,92 +0,0 @@
|
|||
/*
|
||||
* Copyright 2019 The gRPC Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package io.grpc.xds.sds;
|
||||
|
||||
import static com.google.common.base.Preconditions.checkNotNull;
|
||||
|
||||
import com.google.protobuf.ByteString;
|
||||
import io.envoyproxy.envoy.api.v2.auth.TlsCertificate;
|
||||
import io.envoyproxy.envoy.api.v2.core.DataSource;
|
||||
import io.grpc.Internal;
|
||||
|
||||
/**
|
||||
* TlsCertificate's PrivateKey and Certificate are extracted into ByteString's.
|
||||
* Used by the gRPC SSLContext/Protocol Negotiator and is internal.
|
||||
* See {@link SecretManager} for a note on lifecycle management.
|
||||
*/
|
||||
@Internal
|
||||
public final class TlsCertificateStore {
|
||||
|
||||
private final ByteString privateKey;
|
||||
private final ByteString certChain;
|
||||
|
||||
private static ByteString getByteStringFromDataSource(DataSource dataSource) {
|
||||
checkNotNull(dataSource);
|
||||
ByteString dataSourceByteString = null;
|
||||
if (dataSource.getSpecifierCase() == DataSource.SpecifierCase.INLINE_BYTES) {
|
||||
dataSourceByteString = dataSource.getInlineBytes();
|
||||
} else if (dataSource.getSpecifierCase() == DataSource.SpecifierCase.INLINE_STRING) {
|
||||
dataSourceByteString = dataSource.getInlineStringBytes();
|
||||
} else {
|
||||
throw new UnsupportedOperationException(
|
||||
"dataSource of type " + dataSource.getSpecifierCase() + " not supported");
|
||||
}
|
||||
return dataSourceByteString;
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates the Store out of the TlsCertificate object of xDS.
|
||||
*
|
||||
* @param tlsCertificate TlsCertificate Object of xDS
|
||||
*/
|
||||
public TlsCertificateStore(TlsCertificate tlsCertificate) {
|
||||
this(
|
||||
getByteStringFromDataSource(checkNotNull(tlsCertificate).getPrivateKey()),
|
||||
getByteStringFromDataSource(tlsCertificate.getCertificateChain()));
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates the Store out of 2 streams for the 2 certs on disk.
|
||||
*
|
||||
* @param privateKeySteam stream representing private key on disk
|
||||
* @param certChain stream representing cert on disk
|
||||
*/
|
||||
public TlsCertificateStore(ByteString privateKeySteam, ByteString certChain) {
|
||||
checkNotNull(privateKeySteam);
|
||||
checkNotNull(certChain);
|
||||
this.privateKey = privateKeySteam;
|
||||
this.certChain = certChain;
|
||||
}
|
||||
|
||||
/**
|
||||
* getter for private key stream.
|
||||
*
|
||||
* @return inputStream representing private key
|
||||
*/
|
||||
public ByteString getPrivateKey() {
|
||||
return privateKey;
|
||||
}
|
||||
|
||||
/**
|
||||
* getter for cert key stream.
|
||||
*
|
||||
* @return inputStream representing cert
|
||||
*/
|
||||
public ByteString getCertChain() {
|
||||
return certChain;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,77 +0,0 @@
|
|||
/*
|
||||
* Copyright 2019 The gRPC Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package io.grpc.xds.sds;
|
||||
|
||||
import static com.google.common.truth.Truth.assertThat;
|
||||
|
||||
import io.envoyproxy.envoy.api.v2.core.ApiConfigSource;
|
||||
import io.envoyproxy.envoy.api.v2.core.ConfigSource;
|
||||
import java.io.IOException;
|
||||
import java.util.concurrent.ExecutionException;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
import org.junit.rules.TemporaryFolder;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.junit.runners.JUnit4;
|
||||
|
||||
/**
|
||||
* Unit tests for {@link SecretManager}.
|
||||
*/
|
||||
@RunWith(JUnit4.class)
|
||||
public class SecretManagerTest {
|
||||
|
||||
@Rule
|
||||
public TemporaryFolder temporaryFolder = new TemporaryFolder();
|
||||
|
||||
@Test
|
||||
public void createTest() throws IOException, ExecutionException, InterruptedException {
|
||||
ConfigSource configSource = TlsCertificateSecretProviderMapTest
|
||||
.createFileAndConfigSource(temporaryFolder);
|
||||
|
||||
SecretManager secretManager = new SecretManager();
|
||||
SecretProvider<TlsCertificateStore> provider = secretManager
|
||||
.findOrCreateTlsCertificateProvider(configSource, "test");
|
||||
assertThat(provider).isNotNull();
|
||||
TlsCertificateStore tlsCertificateStore =
|
||||
TlsCertificateSecretProviderMapTest.getValueThruCallback(provider);
|
||||
assertThat(tlsCertificateStore).isNotNull();
|
||||
TlsCertificateStoreTest
|
||||
.verifyKeyAndCertsWithStrings(tlsCertificateStore, "pemContents", "crtContents");
|
||||
}
|
||||
|
||||
@Test
|
||||
@SuppressWarnings("unused")
|
||||
public void nonFilePathConfigSource() {
|
||||
ConfigSource configSource =
|
||||
ConfigSource.newBuilder()
|
||||
.setApiConfigSource(ApiConfigSource.newBuilder().build())
|
||||
.build();
|
||||
|
||||
//thrown.expect(UnsupportedOperationException.class);
|
||||
SecretManager secretManager = new SecretManager();
|
||||
try {
|
||||
SecretProvider<TlsCertificateStore> provider = secretManager
|
||||
.findOrCreateTlsCertificateProvider(configSource, "test");
|
||||
Assert.fail("no exception thrown");
|
||||
} catch (UnsupportedOperationException expected) {
|
||||
assertThat(expected).hasMessageThat()
|
||||
.contains("Only file based secret supported");
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
|
@ -1,100 +0,0 @@
|
|||
/*
|
||||
* Copyright 2019 The gRPC Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package io.grpc.xds.sds;
|
||||
|
||||
import static com.google.common.truth.Truth.assertThat;
|
||||
|
||||
import com.google.common.util.concurrent.MoreExecutors;
|
||||
import io.envoyproxy.envoy.api.v2.core.ApiConfigSource;
|
||||
import io.envoyproxy.envoy.api.v2.core.ConfigSource;
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
import java.util.concurrent.ExecutionException;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
import org.junit.rules.TemporaryFolder;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.junit.runners.JUnit4;
|
||||
|
||||
/**
|
||||
* Unit tests for {@link TlsCertificateSecretProviderMap}.
|
||||
*/
|
||||
@RunWith(JUnit4.class)
|
||||
public class TlsCertificateSecretProviderMapTest {
|
||||
|
||||
@Rule
|
||||
public TemporaryFolder temporaryFolder = new TemporaryFolder();
|
||||
|
||||
/**
|
||||
* Utility function for creation of test files in a temp folder.
|
||||
* Used in other classes
|
||||
*
|
||||
* @param temporaryFolder temporary folder to use
|
||||
* @return a config source representing the file based secret
|
||||
* @throws IOException represents IO exception
|
||||
*/
|
||||
static ConfigSource createFileAndConfigSource(TemporaryFolder temporaryFolder)
|
||||
throws IOException {
|
||||
File filePath = TlsCertificateSecretVolumeSecretProviderTest
|
||||
.createTestCertFiles(temporaryFolder);
|
||||
|
||||
return ConfigSource.newBuilder()
|
||||
.setPath(filePath.getPath())
|
||||
.build();
|
||||
}
|
||||
|
||||
/**
|
||||
* Helper method to get the value thru directExecutore callback. Used by other classes.
|
||||
*/
|
||||
static TlsCertificateStore getValueThruCallback(SecretProvider<TlsCertificateStore> provider) {
|
||||
SslContextSecretVolumeSecretProviderTest.TestCallback<TlsCertificateStore> testCallback
|
||||
= new SslContextSecretVolumeSecretProviderTest.TestCallback<>();
|
||||
provider.addCallback(testCallback, MoreExecutors.directExecutor());
|
||||
return testCallback.updatedSecret;
|
||||
}
|
||||
|
||||
@Test
|
||||
public void createTest() throws IOException, ExecutionException, InterruptedException {
|
||||
ConfigSource configSource = createFileAndConfigSource(temporaryFolder);
|
||||
TlsCertificateSecretProviderMap map = new TlsCertificateSecretProviderMap();
|
||||
SecretProvider<TlsCertificateStore> provider = map.findOrCreate(configSource, "test");
|
||||
assertThat(provider).isNotNull();
|
||||
TlsCertificateStore tlsCertificateStore = getValueThruCallback(provider);
|
||||
assertThat(tlsCertificateStore).isNotNull();
|
||||
TlsCertificateStoreTest
|
||||
.verifyKeyAndCertsWithStrings(tlsCertificateStore, "pemContents", "crtContents");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void nonFilePathConfigSource() {
|
||||
ConfigSource configSource =
|
||||
ConfigSource.newBuilder()
|
||||
.setApiConfigSource(ApiConfigSource.newBuilder().build())
|
||||
.build();
|
||||
|
||||
TlsCertificateSecretProviderMap map = new TlsCertificateSecretProviderMap();
|
||||
try {
|
||||
SecretProvider<TlsCertificateStore> unused = map.findOrCreate(configSource, "test");
|
||||
Assert.fail("no exception thrown");
|
||||
} catch (UnsupportedOperationException expected) {
|
||||
assertThat(expected).hasMessageThat()
|
||||
.contains("Only file based secret supported");
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
|
@ -1,147 +0,0 @@
|
|||
/*
|
||||
* Copyright 2019 The gRPC Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package io.grpc.xds.sds;
|
||||
|
||||
import static com.google.common.truth.Truth.assertThat;
|
||||
import static java.nio.charset.StandardCharsets.UTF_8;
|
||||
|
||||
import com.google.common.util.concurrent.MoreExecutors;
|
||||
import java.io.File;
|
||||
import java.io.FileNotFoundException;
|
||||
import java.io.IOException;
|
||||
import java.io.Writer;
|
||||
import java.nio.file.Files;
|
||||
import java.util.concurrent.ExecutionException;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
import org.junit.rules.TemporaryFolder;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.junit.runners.JUnit4;
|
||||
|
||||
/**
|
||||
* Unit tests for {@link TlsCertificateSecretVolumeSecretProvider}.
|
||||
*/
|
||||
@RunWith(JUnit4.class)
|
||||
public class TlsCertificateSecretVolumeSecretProviderTest {
|
||||
|
||||
@Rule
|
||||
public TemporaryFolder temporaryFolder = new TemporaryFolder();
|
||||
|
||||
/**
|
||||
* Utility function for creation of test files in a temp folder.
|
||||
*
|
||||
* @param temporaryFolder temporary folder to use
|
||||
* @return a config source representing the file based secret
|
||||
* @throws IOException represents an IO exception
|
||||
*/
|
||||
static File createTestCertFiles(TemporaryFolder temporaryFolder) throws IOException {
|
||||
createATestCertFile(temporaryFolder, "mycert.pem", "pemContents");
|
||||
createATestCertFile(temporaryFolder, "mycert.crt", "crtContents");
|
||||
|
||||
return new File(temporaryFolder.getRoot(), "mycert");
|
||||
}
|
||||
|
||||
private static void createATestCertFile(
|
||||
TemporaryFolder temporaryFolder,
|
||||
String s,
|
||||
String pemContents) throws IOException {
|
||||
File pem = temporaryFolder.newFile(s);
|
||||
Writer pemFile = Files.newBufferedWriter(pem.toPath(), UTF_8);
|
||||
pemFile.write(pemContents);
|
||||
pemFile.close();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void readBothFiles() throws IOException, ExecutionException, InterruptedException {
|
||||
File filePath = createTestCertFiles(temporaryFolder);
|
||||
TlsCertificateSecretVolumeSecretProvider provider =
|
||||
new TlsCertificateSecretVolumeSecretProvider(filePath.getPath(), "test");
|
||||
|
||||
TlsCertificateStore tlsCertificateStore = provider.get();
|
||||
assertThat(tlsCertificateStore).isNotNull();
|
||||
TlsCertificateStoreTest
|
||||
.verifyKeyAndCertsWithStrings(tlsCertificateStore, "pemContents", "crtContents");
|
||||
}
|
||||
|
||||
private boolean listenerRun;
|
||||
|
||||
@Test
|
||||
public void verifyCallbackExecuted()
|
||||
throws IOException, ExecutionException, InterruptedException {
|
||||
// with a valid file we should get a callback
|
||||
File filePath = createTestCertFiles(temporaryFolder);
|
||||
TlsCertificateSecretVolumeSecretProvider provider =
|
||||
new TlsCertificateSecretVolumeSecretProvider(filePath.getPath(), "test");
|
||||
|
||||
listenerRun = false;
|
||||
provider.addCallback(new SecretProvider.Callback<TlsCertificateStore>() {
|
||||
|
||||
@Override
|
||||
public void updateSecret(TlsCertificateStore secret) {
|
||||
listenerRun = true;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void onException(Throwable throwable) {
|
||||
|
||||
}
|
||||
}, MoreExecutors.directExecutor());
|
||||
assertThat(listenerRun).isTrue();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void readMissingFile() throws IOException, ExecutionException, InterruptedException {
|
||||
createATestCertFile(temporaryFolder, "mycert.pem", "pemContents");
|
||||
|
||||
// no crt file
|
||||
File filePath = new File(temporaryFolder.getRoot(), "mycert");
|
||||
TlsCertificateSecretVolumeSecretProvider provider =
|
||||
new TlsCertificateSecretVolumeSecretProvider(filePath.getPath(), "test");
|
||||
|
||||
try {
|
||||
provider.get();
|
||||
Assert.fail("no exception thrown");
|
||||
} catch (ExecutionException expected) {
|
||||
assertThat(expected.getCause()).isInstanceOf(FileNotFoundException.class);
|
||||
}
|
||||
}
|
||||
|
||||
@Test
|
||||
public void verifyCallbackNotExecuted()
|
||||
throws IOException, ExecutionException, InterruptedException {
|
||||
// with an invalid file we should NOT get a callback
|
||||
|
||||
TlsCertificateSecretVolumeSecretProvider provider =
|
||||
new TlsCertificateSecretVolumeSecretProvider("/a/b/test", "test");
|
||||
|
||||
listenerRun = false;
|
||||
provider.addCallback(new SecretProvider.Callback<TlsCertificateStore>() {
|
||||
|
||||
@Override
|
||||
public void updateSecret(TlsCertificateStore secret) {
|
||||
listenerRun = true;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void onException(Throwable throwable) {
|
||||
|
||||
}
|
||||
}, MoreExecutors.directExecutor());
|
||||
assertThat(listenerRun).isFalse();
|
||||
}
|
||||
}
|
||||
|
|
@ -1,140 +0,0 @@
|
|||
/*
|
||||
* Copyright 2019 The gRPC Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package io.grpc.xds.sds;
|
||||
|
||||
import static com.google.common.truth.Truth.assertThat;
|
||||
|
||||
import com.google.protobuf.ByteString;
|
||||
import io.envoyproxy.envoy.api.v2.auth.TlsCertificate;
|
||||
import io.envoyproxy.envoy.api.v2.core.DataSource;
|
||||
import java.io.IOException;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.junit.runners.JUnit4;
|
||||
|
||||
/**
|
||||
* Unit tests for {@link TlsCertificateStore}.
|
||||
*/
|
||||
@RunWith(JUnit4.class)
|
||||
public class TlsCertificateStoreTest {
|
||||
|
||||
static void verifyKeyAndCertsWithStrings(TlsCertificateStore tlsCertificateStore, String s1,
|
||||
String s2) throws IOException {
|
||||
verifyKeyAndCertsWithStrings(tlsCertificateStore.getPrivateKey(), s1);
|
||||
verifyKeyAndCertsWithStrings(tlsCertificateStore.getCertChain(), s2);
|
||||
}
|
||||
|
||||
private static void verifyKeyAndCertsWithStrings(ByteString byteString, String s)
|
||||
throws IOException {
|
||||
assertThat(byteString).isNotNull();
|
||||
assertThat(byteString.toStringUtf8()).isEqualTo(s);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void convertFromTlsCertificateUsingString() throws IOException {
|
||||
DataSource privateKey =
|
||||
DataSource.newBuilder()
|
||||
.setInlineString("test-privateKey")
|
||||
.build();
|
||||
DataSource certChain =
|
||||
DataSource.newBuilder()
|
||||
.setInlineString("test-certChain")
|
||||
.build();
|
||||
|
||||
TlsCertificate tlsCertificate =
|
||||
TlsCertificate.newBuilder()
|
||||
.setPrivateKey(privateKey)
|
||||
.setCertificateChain(certChain)
|
||||
.build();
|
||||
|
||||
TlsCertificateStore tlsCertificateStore = new TlsCertificateStore(tlsCertificate);
|
||||
|
||||
verifyKeyAndCertsWithStrings(tlsCertificateStore, "test-privateKey", "test-certChain");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void convertFromTlsCertificateUsingBytes() throws IOException {
|
||||
byte[] privateKeyBytes = {1, 2, 3, 4};
|
||||
byte[] certChainBytes = {4, 3, 2, 1};
|
||||
|
||||
DataSource privateKey =
|
||||
DataSource.newBuilder()
|
||||
.setInlineBytes(ByteString.copyFrom(privateKeyBytes))
|
||||
.build();
|
||||
DataSource certChain =
|
||||
DataSource.newBuilder()
|
||||
.setInlineBytes(ByteString.copyFrom(certChainBytes))
|
||||
.build();
|
||||
|
||||
TlsCertificate tlsCertificate =
|
||||
TlsCertificate.newBuilder()
|
||||
.setPrivateKey(privateKey)
|
||||
.setCertificateChain(certChain)
|
||||
.build();
|
||||
|
||||
TlsCertificateStore tlsCertificateStore = new TlsCertificateStore(tlsCertificate);
|
||||
|
||||
ByteString privateKeyByteString = tlsCertificateStore.getPrivateKey();
|
||||
assertThat(privateKeyByteString).isNotNull();
|
||||
assertThat(privateKeyByteString.toByteArray()).isEqualTo(privateKeyBytes);
|
||||
|
||||
ByteString certChainByteString = tlsCertificateStore.getCertChain();
|
||||
assertThat(certChainByteString).isNotNull();
|
||||
assertThat(certChainByteString.toByteArray()).isEqualTo(certChainBytes);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void privateKeyNotSet() {
|
||||
DataSource certChain =
|
||||
DataSource.newBuilder()
|
||||
.setInlineString("test-certChain")
|
||||
.build();
|
||||
TlsCertificate tlsCertificate =
|
||||
TlsCertificate.newBuilder()
|
||||
.setCertificateChain(certChain)
|
||||
.build();
|
||||
|
||||
try {
|
||||
new TlsCertificateStore(tlsCertificate);
|
||||
Assert.fail("no exception thrown");
|
||||
} catch (UnsupportedOperationException expected) {
|
||||
assertThat(expected).hasMessageThat()
|
||||
.contains("dataSource of type SPECIFIER_NOT_SET not supported");
|
||||
}
|
||||
}
|
||||
|
||||
@Test
|
||||
public void certChainNotSet() {
|
||||
DataSource privateKey =
|
||||
DataSource.newBuilder()
|
||||
.setInlineString("test-privateKey")
|
||||
.build();
|
||||
TlsCertificate tlsCertificate =
|
||||
TlsCertificate.newBuilder()
|
||||
.setPrivateKey(privateKey)
|
||||
.build();
|
||||
try {
|
||||
new TlsCertificateStore(tlsCertificate);
|
||||
Assert.fail("no exception thrown");
|
||||
} catch (UnsupportedOperationException expected) {
|
||||
assertThat(expected).hasMessageThat()
|
||||
.contains("dataSource of type SPECIFIER_NOT_SET not supported");
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
Loading…
Reference in New Issue