mirror of https://github.com/grpc/grpc.git
[xDS] second attempt: clean up cert provider factory and registry APIs (#33249)
Original was #33226, reverted in #33248.pull/33253/head
Mark D. Roth
2 years ago
committed by
GitHub
parent
8cb7e610c3
commit
52d687ad42
20 changed files with 217 additions and 1084 deletions
@ -1,258 +0,0 @@ |
|||||||
//
|
|
||||||
//
|
|
||||||
// Copyright 2020 gRPC authors.
|
|
||||||
//
|
|
||||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
// you may not use this file except in compliance with the License.
|
|
||||||
// You may obtain a copy of the License at
|
|
||||||
//
|
|
||||||
// http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
//
|
|
||||||
// Unless required by applicable law or agreed to in writing, software
|
|
||||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
// See the License for the specific language governing permissions and
|
|
||||||
// limitations under the License.
|
|
||||||
//
|
|
||||||
//
|
|
||||||
|
|
||||||
#include <grpc/support/port_platform.h> |
|
||||||
|
|
||||||
#include "src/core/ext/xds/google_mesh_ca_certificate_provider_factory.h" |
|
||||||
|
|
||||||
#include <algorithm> |
|
||||||
|
|
||||||
#include "src/core/lib/iomgr/error.h" |
|
||||||
#include "src/core/lib/json/json_util.h" |
|
||||||
|
|
||||||
namespace grpc_core { |
|
||||||
|
|
||||||
namespace { |
|
||||||
|
|
||||||
const char* kMeshCaPlugin = "meshCA"; |
|
||||||
|
|
||||||
} // namespace
|
|
||||||
|
|
||||||
//
|
|
||||||
// GoogleMeshCaCertificateProviderFactory::Config
|
|
||||||
//
|
|
||||||
|
|
||||||
const char* GoogleMeshCaCertificateProviderFactory::Config::name() const { |
|
||||||
return kMeshCaPlugin; |
|
||||||
} |
|
||||||
|
|
||||||
std::string GoogleMeshCaCertificateProviderFactory::Config::ToString() const { |
|
||||||
// TODO(yashykt): To be filled
|
|
||||||
return "{}"; |
|
||||||
} |
|
||||||
|
|
||||||
std::vector<grpc_error_handle> |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::ParseJsonObjectStsService( |
|
||||||
const Json::Object& sts_service) { |
|
||||||
std::vector<grpc_error_handle> error_list_sts_service; |
|
||||||
if (!ParseJsonObjectField(sts_service, "token_exchange_service_uri", |
|
||||||
&sts_config_.token_exchange_service_uri, |
|
||||||
&error_list_sts_service, false)) { |
|
||||||
sts_config_.token_exchange_service_uri = |
|
||||||
"securetoken.googleapis.com"; // default
|
|
||||||
} |
|
||||||
ParseJsonObjectField(sts_service, "resource", &sts_config_.resource, |
|
||||||
&error_list_sts_service, false); |
|
||||||
ParseJsonObjectField(sts_service, "audience", &sts_config_.audience, |
|
||||||
&error_list_sts_service, false); |
|
||||||
if (!ParseJsonObjectField(sts_service, "scope", &sts_config_.scope, |
|
||||||
&error_list_sts_service, false)) { |
|
||||||
sts_config_.scope = |
|
||||||
"https://www.googleapis.com/auth/cloud-platform"; // default
|
|
||||||
} |
|
||||||
ParseJsonObjectField(sts_service, "requested_token_type", |
|
||||||
&sts_config_.requested_token_type, |
|
||||||
&error_list_sts_service, false); |
|
||||||
ParseJsonObjectField(sts_service, "subject_token_path", |
|
||||||
&sts_config_.subject_token_path, |
|
||||||
&error_list_sts_service); |
|
||||||
ParseJsonObjectField(sts_service, "subject_token_type", |
|
||||||
&sts_config_.subject_token_type, |
|
||||||
&error_list_sts_service); |
|
||||||
ParseJsonObjectField(sts_service, "actor_token_path", |
|
||||||
&sts_config_.actor_token_path, &error_list_sts_service, |
|
||||||
false); |
|
||||||
ParseJsonObjectField(sts_service, "actor_token_type", |
|
||||||
&sts_config_.actor_token_type, &error_list_sts_service, |
|
||||||
false); |
|
||||||
return error_list_sts_service; |
|
||||||
} |
|
||||||
|
|
||||||
std::vector<grpc_error_handle> |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::ParseJsonObjectCallCredentials( |
|
||||||
const Json::Object& call_credentials) { |
|
||||||
std::vector<grpc_error_handle> error_list_call_credentials; |
|
||||||
const Json::Object* sts_service = nullptr; |
|
||||||
if (ParseJsonObjectField(call_credentials, "sts_service", &sts_service, |
|
||||||
&error_list_call_credentials)) { |
|
||||||
std::vector<grpc_error_handle> error_list_sts_service = |
|
||||||
ParseJsonObjectStsService(*sts_service); |
|
||||||
if (!error_list_sts_service.empty()) { |
|
||||||
error_list_call_credentials.push_back(GRPC_ERROR_CREATE_FROM_VECTOR( |
|
||||||
"field:sts_service", &error_list_sts_service)); |
|
||||||
} |
|
||||||
} |
|
||||||
return error_list_call_credentials; |
|
||||||
} |
|
||||||
|
|
||||||
std::vector<grpc_error_handle> |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::ParseJsonObjectGoogleGrpc( |
|
||||||
const Json::Object& google_grpc) { |
|
||||||
std::vector<grpc_error_handle> error_list_google_grpc; |
|
||||||
if (!ParseJsonObjectField(google_grpc, "target_uri", &endpoint_, |
|
||||||
&error_list_google_grpc, false)) { |
|
||||||
endpoint_ = "meshca.googleapis.com"; // Default target
|
|
||||||
} |
|
||||||
const Json::Array* call_credentials_array = nullptr; |
|
||||||
if (ParseJsonObjectField(google_grpc, "call_credentials", |
|
||||||
&call_credentials_array, &error_list_google_grpc)) { |
|
||||||
if (call_credentials_array->size() != 1) { |
|
||||||
error_list_google_grpc.push_back(GRPC_ERROR_CREATE( |
|
||||||
"field:call_credentials error:Need exactly one entry.")); |
|
||||||
} else { |
|
||||||
const Json::Object* call_credentials = nullptr; |
|
||||||
if (ExtractJsonType((*call_credentials_array)[0], "call_credentials[0]", |
|
||||||
&call_credentials, &error_list_google_grpc)) { |
|
||||||
std::vector<grpc_error_handle> error_list_call_credentials = |
|
||||||
ParseJsonObjectCallCredentials(*call_credentials); |
|
||||||
if (!error_list_call_credentials.empty()) { |
|
||||||
error_list_google_grpc.push_back(GRPC_ERROR_CREATE_FROM_VECTOR( |
|
||||||
"field:call_credentials", &error_list_call_credentials)); |
|
||||||
} |
|
||||||
} |
|
||||||
} |
|
||||||
} |
|
||||||
|
|
||||||
return error_list_google_grpc; |
|
||||||
} |
|
||||||
|
|
||||||
std::vector<grpc_error_handle> |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::ParseJsonObjectGrpcServices( |
|
||||||
const Json::Object& grpc_service) { |
|
||||||
std::vector<grpc_error_handle> error_list_grpc_services; |
|
||||||
const Json::Object* google_grpc = nullptr; |
|
||||||
if (ParseJsonObjectField(grpc_service, "google_grpc", &google_grpc, |
|
||||||
&error_list_grpc_services)) { |
|
||||||
std::vector<grpc_error_handle> error_list_google_grpc = |
|
||||||
ParseJsonObjectGoogleGrpc(*google_grpc); |
|
||||||
if (!error_list_google_grpc.empty()) { |
|
||||||
error_list_grpc_services.push_back(GRPC_ERROR_CREATE_FROM_VECTOR( |
|
||||||
"field:google_grpc", &error_list_google_grpc)); |
|
||||||
} |
|
||||||
} |
|
||||||
if (!ParseJsonObjectFieldAsDuration(grpc_service, "timeout", &timeout_, |
|
||||||
&error_list_grpc_services, false)) { |
|
||||||
timeout_ = Duration::Seconds(10); // 10sec default
|
|
||||||
} |
|
||||||
return error_list_grpc_services; |
|
||||||
} |
|
||||||
|
|
||||||
std::vector<grpc_error_handle> |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::ParseJsonObjectServer( |
|
||||||
const Json::Object& server) { |
|
||||||
std::vector<grpc_error_handle> error_list_server; |
|
||||||
std::string api_type; |
|
||||||
if (ParseJsonObjectField(server, "api_type", &api_type, &error_list_server, |
|
||||||
false)) { |
|
||||||
if (api_type != "GRPC") { |
|
||||||
error_list_server.push_back( |
|
||||||
GRPC_ERROR_CREATE("field:api_type error:Only GRPC is supported")); |
|
||||||
} |
|
||||||
} |
|
||||||
const Json::Array* grpc_services = nullptr; |
|
||||||
if (ParseJsonObjectField(server, "grpc_services", &grpc_services, |
|
||||||
&error_list_server)) { |
|
||||||
if (grpc_services->size() != 1) { |
|
||||||
error_list_server.push_back(GRPC_ERROR_CREATE( |
|
||||||
"field:grpc_services error:Need exactly one entry")); |
|
||||||
} else { |
|
||||||
const Json::Object* grpc_service = nullptr; |
|
||||||
if (ExtractJsonType((*grpc_services)[0], "grpc_services[0]", |
|
||||||
&grpc_service, &error_list_server)) { |
|
||||||
std::vector<grpc_error_handle> error_list_grpc_services = |
|
||||||
ParseJsonObjectGrpcServices(*grpc_service); |
|
||||||
if (!error_list_grpc_services.empty()) { |
|
||||||
error_list_server.push_back(GRPC_ERROR_CREATE_FROM_VECTOR( |
|
||||||
"field:grpc_services", &error_list_grpc_services)); |
|
||||||
} |
|
||||||
} |
|
||||||
} |
|
||||||
} |
|
||||||
return error_list_server; |
|
||||||
} |
|
||||||
|
|
||||||
RefCountedPtr<GoogleMeshCaCertificateProviderFactory::Config> |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::Parse( |
|
||||||
const Json& config_json, grpc_error_handle* error) { |
|
||||||
auto config = |
|
||||||
MakeRefCounted<GoogleMeshCaCertificateProviderFactory::Config>(); |
|
||||||
if (config_json.type() != Json::Type::kObject) { |
|
||||||
*error = GRPC_ERROR_CREATE("error:config type should be OBJECT."); |
|
||||||
return nullptr; |
|
||||||
} |
|
||||||
std::vector<grpc_error_handle> error_list; |
|
||||||
const Json::Object* server = nullptr; |
|
||||||
if (ParseJsonObjectField(config_json.object(), "server", &server, |
|
||||||
&error_list)) { |
|
||||||
std::vector<grpc_error_handle> error_list_server = |
|
||||||
config->ParseJsonObjectServer(*server); |
|
||||||
if (!error_list_server.empty()) { |
|
||||||
error_list.push_back( |
|
||||||
GRPC_ERROR_CREATE_FROM_VECTOR("field:server", &error_list_server)); |
|
||||||
} |
|
||||||
} |
|
||||||
if (!ParseJsonObjectFieldAsDuration( |
|
||||||
config_json.object(), "certificate_lifetime", |
|
||||||
&config->certificate_lifetime_, &error_list, false)) { |
|
||||||
config->certificate_lifetime_ = Duration::Hours(24); // 24hrs default
|
|
||||||
} |
|
||||||
if (!ParseJsonObjectFieldAsDuration( |
|
||||||
config_json.object(), "renewal_grace_period", |
|
||||||
&config->renewal_grace_period_, &error_list, false)) { |
|
||||||
config->renewal_grace_period_ = Duration::Hours(12); // 12hrs default
|
|
||||||
} |
|
||||||
std::string key_type; |
|
||||||
if (ParseJsonObjectField(config_json.object(), "key_type", &key_type, |
|
||||||
&error_list, false)) { |
|
||||||
if (key_type != "RSA") { |
|
||||||
error_list.push_back( |
|
||||||
GRPC_ERROR_CREATE("field:key_type error:Only RSA is supported.")); |
|
||||||
} |
|
||||||
} |
|
||||||
if (!ParseJsonObjectField(config_json.object(), "key_size", |
|
||||||
&config->key_size_, &error_list, false)) { |
|
||||||
config->key_size_ = 2048; // default 2048 bit key size
|
|
||||||
} |
|
||||||
if (!ParseJsonObjectField(config_json.object(), "location", |
|
||||||
&config->location_, &error_list, false)) { |
|
||||||
// GCE/GKE Metadata server needs to be contacted to get the value.
|
|
||||||
} |
|
||||||
if (!error_list.empty()) { |
|
||||||
*error = GRPC_ERROR_CREATE_FROM_VECTOR( |
|
||||||
"Error parsing google Mesh CA config", &error_list); |
|
||||||
return nullptr; |
|
||||||
} |
|
||||||
return config; |
|
||||||
} |
|
||||||
|
|
||||||
//
|
|
||||||
// GoogleMeshCaCertificateProviderFactory
|
|
||||||
//
|
|
||||||
|
|
||||||
const char* GoogleMeshCaCertificateProviderFactory::name() const { |
|
||||||
return kMeshCaPlugin; |
|
||||||
} |
|
||||||
|
|
||||||
RefCountedPtr<CertificateProviderFactory::Config> |
|
||||||
GoogleMeshCaCertificateProviderFactory::CreateCertificateProviderConfig( |
|
||||||
const Json& config_json, grpc_error_handle* error) { |
|
||||||
return GoogleMeshCaCertificateProviderFactory::Config::Parse(config_json, |
|
||||||
error); |
|
||||||
} |
|
||||||
|
|
||||||
} // namespace grpc_core
|
|
||||||
@ -1,115 +0,0 @@ |
|||||||
//
|
|
||||||
//
|
|
||||||
// Copyright 2020 gRPC authors.
|
|
||||||
//
|
|
||||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
// you may not use this file except in compliance with the License.
|
|
||||||
// You may obtain a copy of the License at
|
|
||||||
//
|
|
||||||
// http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
//
|
|
||||||
// Unless required by applicable law or agreed to in writing, software
|
|
||||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
// See the License for the specific language governing permissions and
|
|
||||||
// limitations under the License.
|
|
||||||
//
|
|
||||||
//
|
|
||||||
|
|
||||||
#ifndef GRPC_SRC_CORE_EXT_XDS_GOOGLE_MESH_CA_CERTIFICATE_PROVIDER_FACTORY_H |
|
||||||
#define GRPC_SRC_CORE_EXT_XDS_GOOGLE_MESH_CA_CERTIFICATE_PROVIDER_FACTORY_H |
|
||||||
|
|
||||||
#include <grpc/support/port_platform.h> |
|
||||||
|
|
||||||
#include <stdint.h> |
|
||||||
|
|
||||||
#include <string> |
|
||||||
#include <vector> |
|
||||||
|
|
||||||
#include <grpc/grpc_security.h> |
|
||||||
|
|
||||||
#include "src/core/lib/gprpp/ref_counted_ptr.h" |
|
||||||
#include "src/core/lib/gprpp/time.h" |
|
||||||
#include "src/core/lib/iomgr/error.h" |
|
||||||
#include "src/core/lib/json/json.h" |
|
||||||
#include "src/core/lib/security/certificate_provider/certificate_provider_factory.h" |
|
||||||
#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h" |
|
||||||
|
|
||||||
namespace grpc_core { |
|
||||||
|
|
||||||
class GoogleMeshCaCertificateProviderFactory |
|
||||||
: public CertificateProviderFactory { |
|
||||||
public: |
|
||||||
class Config : public CertificateProviderFactory::Config { |
|
||||||
public: |
|
||||||
struct StsConfig { |
|
||||||
std::string token_exchange_service_uri; |
|
||||||
std::string resource; |
|
||||||
std::string audience; |
|
||||||
std::string scope; |
|
||||||
std::string requested_token_type; |
|
||||||
std::string subject_token_path; |
|
||||||
std::string subject_token_type; |
|
||||||
std::string actor_token_path; |
|
||||||
std::string actor_token_type; |
|
||||||
}; |
|
||||||
|
|
||||||
const char* name() const override; |
|
||||||
|
|
||||||
std::string ToString() const override; |
|
||||||
|
|
||||||
const std::string& endpoint() const { return endpoint_; } |
|
||||||
|
|
||||||
const StsConfig& sts_config() const { return sts_config_; } |
|
||||||
|
|
||||||
Duration timeout() const { return timeout_; } |
|
||||||
|
|
||||||
Duration certificate_lifetime() const { return certificate_lifetime_; } |
|
||||||
|
|
||||||
Duration renewal_grace_period() const { return renewal_grace_period_; } |
|
||||||
|
|
||||||
uint32_t key_size() const { return key_size_; } |
|
||||||
|
|
||||||
const std::string& location() const { return location_; } |
|
||||||
|
|
||||||
static RefCountedPtr<Config> Parse(const Json& config_json, |
|
||||||
grpc_error_handle* error); |
|
||||||
|
|
||||||
private: |
|
||||||
// Helpers for parsing the config
|
|
||||||
std::vector<grpc_error_handle> ParseJsonObjectStsService( |
|
||||||
const Json::Object& sts_service); |
|
||||||
std::vector<grpc_error_handle> ParseJsonObjectCallCredentials( |
|
||||||
const Json::Object& call_credentials); |
|
||||||
std::vector<grpc_error_handle> ParseJsonObjectGoogleGrpc( |
|
||||||
const Json::Object& google_grpc); |
|
||||||
std::vector<grpc_error_handle> ParseJsonObjectGrpcServices( |
|
||||||
const Json::Object& grpc_service); |
|
||||||
std::vector<grpc_error_handle> ParseJsonObjectServer( |
|
||||||
const Json::Object& server); |
|
||||||
|
|
||||||
std::string endpoint_; |
|
||||||
StsConfig sts_config_; |
|
||||||
Duration timeout_; |
|
||||||
Duration certificate_lifetime_; |
|
||||||
Duration renewal_grace_period_; |
|
||||||
uint32_t key_size_; |
|
||||||
std::string location_; |
|
||||||
}; |
|
||||||
|
|
||||||
const char* name() const override; |
|
||||||
|
|
||||||
RefCountedPtr<CertificateProviderFactory::Config> |
|
||||||
CreateCertificateProviderConfig(const Json& config_json, |
|
||||||
grpc_error_handle* error) override; |
|
||||||
|
|
||||||
RefCountedPtr<grpc_tls_certificate_provider> CreateCertificateProvider( |
|
||||||
RefCountedPtr<CertificateProviderFactory::Config> /*config*/) override { |
|
||||||
// TODO(yashykt) : To be implemented
|
|
||||||
return nullptr; |
|
||||||
} |
|
||||||
}; |
|
||||||
|
|
||||||
} // namespace grpc_core
|
|
||||||
|
|
||||||
#endif // GRPC_SRC_CORE_EXT_XDS_GOOGLE_MESH_CA_CERTIFICATE_PROVIDER_FACTORY_H
|
|
||||||
@ -1,367 +0,0 @@ |
|||||||
//
|
|
||||||
//
|
|
||||||
// Copyright 2020 gRPC authors.
|
|
||||||
//
|
|
||||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
// you may not use this file except in compliance with the License.
|
|
||||||
// You may obtain a copy of the License at
|
|
||||||
//
|
|
||||||
// http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
//
|
|
||||||
// Unless required by applicable law or agreed to in writing, software
|
|
||||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
// See the License for the specific language governing permissions and
|
|
||||||
// limitations under the License.
|
|
||||||
//
|
|
||||||
//
|
|
||||||
|
|
||||||
#include "src/core/ext/xds/google_mesh_ca_certificate_provider_factory.h" |
|
||||||
|
|
||||||
#include "absl/status/status.h" |
|
||||||
#include "absl/status/statusor.h" |
|
||||||
#include "gmock/gmock.h" |
|
||||||
#include "gtest/gtest.h" |
|
||||||
|
|
||||||
#include <grpc/grpc.h> |
|
||||||
|
|
||||||
#include "src/core/lib/gprpp/status_helper.h" |
|
||||||
#include "src/core/lib/gprpp/time.h" |
|
||||||
#include "src/core/lib/json/json_reader.h" |
|
||||||
#include "test/core/util/test_config.h" |
|
||||||
|
|
||||||
namespace grpc_core { |
|
||||||
namespace testing { |
|
||||||
namespace { |
|
||||||
|
|
||||||
TEST(GoogleMeshCaConfigTest, Basic) { |
|
||||||
const char* json_str = |
|
||||||
"{" |
|
||||||
" \"server\": {" |
|
||||||
" \"api_type\": \"GRPC\"," |
|
||||||
" \"grpc_services\": [{" |
|
||||||
" \"google_grpc\": {" |
|
||||||
" \"target_uri\": \"newmeshca.googleapis.com\"," |
|
||||||
" \"channel_credentials\": { \"google_default\": {}}," |
|
||||||
" \"call_credentials\": [{" |
|
||||||
" \"sts_service\": {" |
|
||||||
" \"token_exchange_service_uri\": " |
|
||||||
"\"newsecuretoken.googleapis.com\"," |
|
||||||
" \"resource\": \"newmeshca.googleapis.com\"," |
|
||||||
" \"audience\": \"newmeshca.googleapis.com\"," |
|
||||||
" \"scope\": " |
|
||||||
"\"https://www.newgoogleapis.com/auth/cloud-platform\"," |
|
||||||
" \"requested_token_type\": " |
|
||||||
"\"urn:ietf:params:oauth:token-type:jwt\"," |
|
||||||
" \"subject_token_path\": \"/etc/secret/sajwt.token\"," |
|
||||||
" \"subject_token_type\": " |
|
||||||
"\"urn:ietf:params:oauth:token-type:jwt\"," |
|
||||||
" \"actor_token_path\": \"/etc/secret/sajwt.token\"," |
|
||||||
" \"actor_token_type\": " |
|
||||||
"\"urn:ietf:params:oauth:token-type:jwt\"" |
|
||||||
" }" |
|
||||||
" }]" |
|
||||||
" }," |
|
||||||
" \"timeout\": \"20s\"" |
|
||||||
" }]" |
|
||||||
" }," |
|
||||||
" \"certificate_lifetime\": \"400s\"," |
|
||||||
" \"renewal_grace_period\": \"100s\"," |
|
||||||
" \"key_type\": \"RSA\"," |
|
||||||
" \"key_size\": 1024," |
|
||||||
" \"location\": " |
|
||||||
"\"https://container.googleapis.com/v1/project/test-project1/locations/" |
|
||||||
"test-zone2/clusters/test-cluster3\"" |
|
||||||
"}"; |
|
||||||
auto json = JsonParse(json_str); |
|
||||||
ASSERT_TRUE(json.ok()) << json.status(); |
|
||||||
grpc_error_handle error; |
|
||||||
auto config = |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::Parse(*json, &error); |
|
||||||
ASSERT_EQ(error, absl::OkStatus()) << StatusToString(error); |
|
||||||
EXPECT_EQ(config->endpoint(), "newmeshca.googleapis.com"); |
|
||||||
EXPECT_EQ(config->sts_config().token_exchange_service_uri, |
|
||||||
"newsecuretoken.googleapis.com"); |
|
||||||
EXPECT_EQ(config->sts_config().resource, "newmeshca.googleapis.com"); |
|
||||||
EXPECT_EQ(config->sts_config().audience, "newmeshca.googleapis.com"); |
|
||||||
EXPECT_EQ(config->sts_config().scope, |
|
||||||
"https://www.newgoogleapis.com/auth/cloud-platform"); |
|
||||||
EXPECT_EQ(config->sts_config().requested_token_type, |
|
||||||
"urn:ietf:params:oauth:token-type:jwt"); |
|
||||||
EXPECT_EQ(config->sts_config().subject_token_path, "/etc/secret/sajwt.token"); |
|
||||||
EXPECT_EQ(config->sts_config().subject_token_type, |
|
||||||
"urn:ietf:params:oauth:token-type:jwt"); |
|
||||||
EXPECT_EQ(config->sts_config().actor_token_path, "/etc/secret/sajwt.token"); |
|
||||||
EXPECT_EQ(config->sts_config().actor_token_type, |
|
||||||
"urn:ietf:params:oauth:token-type:jwt"); |
|
||||||
EXPECT_EQ(config->timeout(), Duration::Seconds(20)); |
|
||||||
EXPECT_EQ(config->certificate_lifetime(), Duration::Seconds(400)); |
|
||||||
EXPECT_EQ(config->renewal_grace_period(), Duration::Seconds(100)); |
|
||||||
EXPECT_EQ(config->key_size(), 1024); |
|
||||||
EXPECT_EQ(config->location(), |
|
||||||
"https://container.googleapis.com/v1/project/test-project1/" |
|
||||||
"locations/test-zone2/clusters/test-cluster3"); |
|
||||||
} |
|
||||||
|
|
||||||
TEST(GoogleMeshCaConfigTest, Defaults) { |
|
||||||
const char* json_str = |
|
||||||
"{" |
|
||||||
" \"server\": {" |
|
||||||
" \"api_type\": \"GRPC\"," |
|
||||||
" \"grpc_services\": [{" |
|
||||||
" \"google_grpc\": {" |
|
||||||
" \"call_credentials\": [{" |
|
||||||
" \"sts_service\": {" |
|
||||||
" \"scope\": " |
|
||||||
"\"https://www.googleapis.com/auth/cloud-platform\"," |
|
||||||
" \"subject_token_path\": \"/etc/secret/sajwt.token\"," |
|
||||||
" \"subject_token_type\": " |
|
||||||
"\"urn:ietf:params:oauth:token-type:jwt\"" |
|
||||||
" }" |
|
||||||
" }]" |
|
||||||
" }" |
|
||||||
" }]" |
|
||||||
" }," |
|
||||||
" \"location\": " |
|
||||||
"\"https://container.googleapis.com/v1/project/test-project1/locations/" |
|
||||||
"test-zone2/clusters/test-cluster3\"" |
|
||||||
"}"; |
|
||||||
auto json = JsonParse(json_str); |
|
||||||
ASSERT_TRUE(json.ok()) << json.status(); |
|
||||||
grpc_error_handle error; |
|
||||||
auto config = |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::Parse(*json, &error); |
|
||||||
ASSERT_EQ(error, absl::OkStatus()) << StatusToString(error); |
|
||||||
EXPECT_EQ(config->endpoint(), "meshca.googleapis.com"); |
|
||||||
EXPECT_EQ(config->sts_config().token_exchange_service_uri, |
|
||||||
"securetoken.googleapis.com"); |
|
||||||
EXPECT_EQ(config->sts_config().resource, ""); |
|
||||||
EXPECT_EQ(config->sts_config().audience, ""); |
|
||||||
EXPECT_EQ(config->sts_config().scope, |
|
||||||
"https://www.googleapis.com/auth/cloud-platform"); |
|
||||||
EXPECT_EQ(config->sts_config().requested_token_type, ""); |
|
||||||
EXPECT_EQ(config->sts_config().subject_token_path, "/etc/secret/sajwt.token"); |
|
||||||
EXPECT_EQ(config->sts_config().subject_token_type, |
|
||||||
"urn:ietf:params:oauth:token-type:jwt"); |
|
||||||
EXPECT_EQ(config->sts_config().actor_token_path, ""); |
|
||||||
EXPECT_EQ(config->sts_config().actor_token_type, ""); |
|
||||||
EXPECT_EQ(config->timeout(), Duration::Seconds(10)); |
|
||||||
EXPECT_EQ(config->certificate_lifetime(), Duration::Hours(24)); |
|
||||||
EXPECT_EQ(config->renewal_grace_period(), Duration::Hours(12)); |
|
||||||
EXPECT_EQ(config->key_size(), 2048); |
|
||||||
EXPECT_EQ(config->location(), |
|
||||||
"https://container.googleapis.com/v1/project/test-project1/" |
|
||||||
"locations/test-zone2/clusters/test-cluster3"); |
|
||||||
} |
|
||||||
|
|
||||||
TEST(GoogleMeshCaConfigTest, WrongExpectedValues) { |
|
||||||
const char* json_str = |
|
||||||
"{" |
|
||||||
" \"server\": {" |
|
||||||
" \"api_type\": \"REST\"," |
|
||||||
" \"grpc_services\": [{" |
|
||||||
" \"google_grpc\": {" |
|
||||||
" \"call_credentials\": [{" |
|
||||||
" \"sts_service\": {" |
|
||||||
" \"scope\": " |
|
||||||
"\"https://www.googleapis.com/auth/cloud-platform\"," |
|
||||||
" \"subject_token_path\": \"/etc/secret/sajwt.token\"," |
|
||||||
" \"subject_token_type\": " |
|
||||||
"\"urn:ietf:params:oauth:token-type:jwt\"" |
|
||||||
" }" |
|
||||||
" }]" |
|
||||||
" }" |
|
||||||
" }]" |
|
||||||
" }," |
|
||||||
" \"key_type\": \"DSA\"," |
|
||||||
" \"location\": " |
|
||||||
"\"https://container.googleapis.com/v1/project/test-project1/locations/" |
|
||||||
"test-zone2/clusters/test-cluster3\"" |
|
||||||
"}"; |
|
||||||
auto json = JsonParse(json_str); |
|
||||||
ASSERT_TRUE(json.ok()) << json.status(); |
|
||||||
grpc_error_handle error; |
|
||||||
auto config = |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::Parse(*json, &error); |
|
||||||
EXPECT_THAT( |
|
||||||
StatusToString(error), |
|
||||||
::testing::ContainsRegex("field:api_type error:Only GRPC is supported.*" |
|
||||||
"field:key_type error:Only RSA is supported")); |
|
||||||
} |
|
||||||
|
|
||||||
TEST(GoogleMeshCaConfigTest, WrongTypes) { |
|
||||||
const char* json_str = |
|
||||||
"{" |
|
||||||
" \"server\": {" |
|
||||||
" \"api_type\": 123," |
|
||||||
" \"grpc_services\": [{" |
|
||||||
" \"google_grpc\": {" |
|
||||||
" \"target_uri\": 123," |
|
||||||
" \"call_credentials\": [{" |
|
||||||
" \"sts_service\": {" |
|
||||||
" \"token_exchange_service_uri\": 123," |
|
||||||
" \"resource\": 123," |
|
||||||
" \"audience\": 123," |
|
||||||
" \"scope\": 123," |
|
||||||
" \"requested_token_type\": 123," |
|
||||||
" \"subject_token_path\": 123," |
|
||||||
" \"subject_token_type\": 123," |
|
||||||
" \"actor_token_path\": 123," |
|
||||||
" \"actor_token_type\": 123" |
|
||||||
" }" |
|
||||||
" }]" |
|
||||||
" }," |
|
||||||
" \"timeout\": 20" |
|
||||||
" }]" |
|
||||||
" }," |
|
||||||
" \"certificate_lifetime\": 400," |
|
||||||
" \"renewal_grace_period\": 100," |
|
||||||
" \"key_type\": 123," |
|
||||||
" \"key_size\": \"1024A\"," |
|
||||||
" \"location\": 123" |
|
||||||
"}"; |
|
||||||
auto json = JsonParse(json_str); |
|
||||||
ASSERT_TRUE(json.ok()) << json.status(); |
|
||||||
grpc_error_handle error; |
|
||||||
auto config = |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::Parse(*json, &error); |
|
||||||
EXPECT_THAT( |
|
||||||
StatusToString(error), |
|
||||||
::testing::ContainsRegex( |
|
||||||
"field:server.*field:api_type error:type should be STRING.*" |
|
||||||
"field:grpc_services.*field:google_grpc.*field:target_uri " |
|
||||||
"error:type should be STRING.*" |
|
||||||
"field:call_credentials.*field:sts_service.*field:token_exchange_" |
|
||||||
"service_uri error:type should be STRING.*" |
|
||||||
"field:resource error:type should be STRING.*" |
|
||||||
"field:audience error:type should be STRING.*" |
|
||||||
"field:scope error:type should be STRING.*" |
|
||||||
"field:requested_token_type error:type should be STRING.*" |
|
||||||
"field:subject_token_path error:type should be STRING.*" |
|
||||||
"field:subject_token_type error:type should be STRING.*" |
|
||||||
"field:actor_token_path error:type should be STRING.*" |
|
||||||
"field:actor_token_type error:type should be STRING.*" |
|
||||||
"field:timeout error:type should be STRING of the form given by " |
|
||||||
"google.proto.Duration.*" |
|
||||||
"field:certificate_lifetime error:type should be STRING of the form " |
|
||||||
"given by google.proto.Duration.*" |
|
||||||
"field:renewal_grace_period error:type should be STRING of the form " |
|
||||||
"given by google.proto.Duration..*" |
|
||||||
"field:key_type error:type should be STRING.*" |
|
||||||
"field:key_size error:failed to parse.*" |
|
||||||
"field:location error:type should be STRING")); |
|
||||||
} |
|
||||||
|
|
||||||
TEST(GoogleMeshCaConfigTest, GrpcServicesNotAnArray) { |
|
||||||
const char* json_str = |
|
||||||
"{" |
|
||||||
" \"server\": {" |
|
||||||
" \"api_type\": \"GRPC\"," |
|
||||||
" \"grpc_services\": 123" |
|
||||||
" }," |
|
||||||
" \"location\": " |
|
||||||
"\"https://container.googleapis.com/v1/project/test-project1/locations/" |
|
||||||
"test-zone2/clusters/test-cluster3\"" |
|
||||||
"}"; |
|
||||||
auto json = JsonParse(json_str); |
|
||||||
ASSERT_TRUE(json.ok()) << json.status(); |
|
||||||
grpc_error_handle error; |
|
||||||
auto config = |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::Parse(*json, &error); |
|
||||||
EXPECT_THAT( |
|
||||||
StatusToString(error), |
|
||||||
::testing::ContainsRegex( |
|
||||||
"field:server.*field:grpc_services error:type should be ARRAY")); |
|
||||||
} |
|
||||||
|
|
||||||
TEST(GoogleMeshCaConfigTest, GoogleGrpcNotAnObject) { |
|
||||||
const char* json_str = |
|
||||||
"{" |
|
||||||
" \"server\": {" |
|
||||||
" \"api_type\": \"GRPC\"," |
|
||||||
" \"grpc_services\": [{" |
|
||||||
" \"google_grpc\": 123" |
|
||||||
" }]" |
|
||||||
" }," |
|
||||||
" \"location\": " |
|
||||||
"\"https://container.googleapis.com/v1/project/test-project1/locations/" |
|
||||||
"test-zone2/clusters/test-cluster3\"" |
|
||||||
"}"; |
|
||||||
auto json = JsonParse(json_str); |
|
||||||
ASSERT_TRUE(json.ok()) << json.status(); |
|
||||||
grpc_error_handle error; |
|
||||||
auto config = |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::Parse(*json, &error); |
|
||||||
EXPECT_THAT( |
|
||||||
StatusToString(error), |
|
||||||
::testing::ContainsRegex("field:server.*field:grpc_services.*field:" |
|
||||||
"google_grpc error:type should be OBJECT")); |
|
||||||
} |
|
||||||
|
|
||||||
TEST(GoogleMeshCaConfigTest, CallCredentialsNotAnArray) { |
|
||||||
const char* json_str = |
|
||||||
"{" |
|
||||||
" \"server\": {" |
|
||||||
" \"api_type\": \"GRPC\"," |
|
||||||
" \"grpc_services\": [{" |
|
||||||
" \"google_grpc\": {" |
|
||||||
" \"call_credentials\": 123" |
|
||||||
" }" |
|
||||||
" }]" |
|
||||||
" }," |
|
||||||
" \"location\": " |
|
||||||
"\"https://container.googleapis.com/v1/project/test-project1/locations/" |
|
||||||
"test-zone2/clusters/test-cluster3\"" |
|
||||||
"}"; |
|
||||||
auto json = JsonParse(json_str); |
|
||||||
ASSERT_TRUE(json.ok()) << json.status(); |
|
||||||
grpc_error_handle error; |
|
||||||
auto config = |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::Parse(*json, &error); |
|
||||||
EXPECT_THAT(StatusToString(error), |
|
||||||
::testing::ContainsRegex( |
|
||||||
"field:server.*field:grpc_services.*field:google_grpc.*" |
|
||||||
"field:call_credentials error:type should be ARRAY")); |
|
||||||
} |
|
||||||
|
|
||||||
TEST(GoogleMeshCaConfigTest, StsServiceNotAnObject) { |
|
||||||
const char* json_str = |
|
||||||
"{" |
|
||||||
" \"server\": {" |
|
||||||
" \"api_type\": \"GRPC\"," |
|
||||||
" \"grpc_services\": [{" |
|
||||||
" \"google_grpc\": {" |
|
||||||
" \"call_credentials\": [{" |
|
||||||
" \"sts_service\": 123" |
|
||||||
" }]" |
|
||||||
" }" |
|
||||||
" }]" |
|
||||||
" }," |
|
||||||
" \"location\": " |
|
||||||
"\"https://container.googleapis.com/v1/project/test-project1/locations/" |
|
||||||
"test-zone2/clusters/test-cluster3\"" |
|
||||||
"}"; |
|
||||||
auto json = JsonParse(json_str); |
|
||||||
ASSERT_TRUE(json.ok()) << json.status(); |
|
||||||
grpc_error_handle error; |
|
||||||
auto config = |
|
||||||
GoogleMeshCaCertificateProviderFactory::Config::Parse(*json, &error); |
|
||||||
EXPECT_THAT( |
|
||||||
StatusToString(error), |
|
||||||
::testing::ContainsRegex( |
|
||||||
"field:server.*field:grpc_services.*field:google_grpc.*field:" |
|
||||||
"call_credentials.*field:sts_service error:type should be OBJECT")); |
|
||||||
} |
|
||||||
|
|
||||||
} // namespace
|
|
||||||
} // namespace testing
|
|
||||||
} // namespace grpc_core
|
|
||||||
|
|
||||||
int main(int argc, char** argv) { |
|
||||||
::testing::InitGoogleTest(&argc, argv); |
|
||||||
grpc::testing::TestEnvironment env(&argc, argv); |
|
||||||
grpc_init(); |
|
||||||
auto result = RUN_ALL_TESTS(); |
|
||||||
grpc_shutdown(); |
|
||||||
return result; |
|
||||||
} |
|
||||||
Loading…
Reference in new issue