xds_credentials_test.cc
Go to the documentation of this file.
1 //
2 //
3 // Copyright 2020 gRPC authors.
4 //
5 // Licensed under the Apache License, Version 2.0 (the "License");
6 // you may not use this file except in compliance with the License.
7 // You may obtain a copy of the License at
8 //
9 // http://www.apache.org/licenses/LICENSE-2.0
10 //
11 // Unless required by applicable law or agreed to in writing, software
12 // distributed under the License is distributed on an "AS IS" BASIS,
13 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 // See the License for the specific language governing permissions and
15 // limitations under the License.
16 //
17 //
18 
19 #include "src/core/lib/security/credentials/xds/xds_credentials.h"
20 
21 #include <gtest/gtest.h>
22 
23 #include <grpc/grpc.h>
24 
25 #include "test/core/util/test_config.h"
26 
27 namespace grpc_core {
28 namespace testing {
29 
30 namespace {
31 
32 StringMatcher ExactMatcher(const char* string) {
33  return StringMatcher::Create(StringMatcher::Type::kExact, string).value();
34 }
35 
36 StringMatcher PrefixMatcher(const char* string, bool case_sensitive = true) {
37  return StringMatcher::Create(StringMatcher::Type::kPrefix, string,
38  case_sensitive)
39  .value();
40 }
41 
42 StringMatcher SuffixMatcher(const char* string, bool case_sensitive = true) {
43  return StringMatcher::Create(StringMatcher::Type::kSuffix, string,
44  case_sensitive)
45  .value();
46 }
47 
48 StringMatcher ContainsMatcher(const char* string, bool case_sensitive = true) {
49  return StringMatcher::Create(StringMatcher::Type::kContains, string,
50  case_sensitive)
51  .value();
52 }
53 
54 StringMatcher SafeRegexMatcher(const char* string) {
55  return StringMatcher::Create(StringMatcher::Type::kSafeRegex, string).value();
56 }
57 
58 TEST(XdsSanMatchingTest, EmptySansList) {
59  std::vector<const char*> sans = {};
60  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
61  sans.data(), sans.size(),
62  {ExactMatcher("a.example.com"), ExactMatcher("b.example.com")}));
63 }
64 
65 TEST(XdsSanMatchingTest, EmptyMatchersList) {
66  std::vector<const char*> sans = {"a.example.com", "foo.example.com"};
67  EXPECT_TRUE(
68  TestOnlyXdsVerifySubjectAlternativeNames(sans.data(), sans.size(), {}));
69 }
70 
71 TEST(XdsSanMatchingTest, ExactMatchIllegalValues) {
72  std::vector<const char*> sans = {".a.example.com"};
73  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
74  sans.data(), sans.size(),
75  {ExactMatcher(""), ExactMatcher("a.example.com"),
76  ExactMatcher(".a.example.com")}));
77  sans = {""};
78  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
79  sans.data(), sans.size(),
80  {ExactMatcher(""), ExactMatcher("a.example.com"),
81  ExactMatcher(".a.example.com")}));
82  sans = {"a.example.com"};
83  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
84  sans.data(), sans.size(),
85  {ExactMatcher(""), ExactMatcher("a.example.com"),
86  ExactMatcher(".a.example.com")}));
87 }
88 
89 TEST(XdsSanMatchingTest, ExactMatchDns) {
90  std::vector<const char*> sans = {"a.example.com"};
91  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
92  sans.data(), sans.size(), {ExactMatcher("a.example.com")}));
93  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
94  sans.data(), sans.size(), {ExactMatcher("b.example.com")}));
95  sans = {"b.example.com."};
96  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
97  sans.data(), sans.size(), {ExactMatcher("a.example.com.")}));
98  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
99  sans.data(), sans.size(), {ExactMatcher("b.example.com.")}));
100 }
101 
102 TEST(XdsSanMatchingTest, ExactMatchWithFullyQualifiedSan) {
103  std::vector<const char*> sans = {"a.example.com."};
104  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
105  sans.data(), sans.size(), {ExactMatcher("a.example.com")}));
106  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
107  sans.data(), sans.size(), {ExactMatcher("b.example.com")}));
108 }
109 
110 TEST(XdsSanMatchingTest, ExactMatchWithFullyQualifiedMatcher) {
111  std::vector<const char*> sans = {"a.example.com"};
112  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
113  sans.data(), sans.size(), {ExactMatcher("a.example.com.")}));
114  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
115  sans.data(), sans.size(), {ExactMatcher("b.example.com.")}));
116 }
117 
118 TEST(XdsSanMatchingTest, ExactMatchDnsCaseInsensitive) {
119  std::vector<const char*> sans = {"A.eXaMpLe.CoM"};
120  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
121  sans.data(), sans.size(), {ExactMatcher("a.example.com")}));
122  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
123  sans.data(), sans.size(), {ExactMatcher("a.ExAmPlE.cOm")}));
124 }
125 
126 TEST(XdsSanMatchingTest, ExactMatchMultipleSansMultipleMatchers) {
127  std::vector<const char*> sans = {"a.example.com", "foo.example.com",
128  "b.example.com"};
129  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
130  sans.data(), sans.size(),
131  {ExactMatcher("abc.example.com"), ExactMatcher("foo.example.com"),
132  ExactMatcher("xyz.example.com")}));
133 }
134 
135 TEST(XdsSanMatchingTest, ExactMatchWildCard) {
136  std::vector<const char*> sans = {"*.example.com"};
137  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
138  sans.data(), sans.size(), {ExactMatcher("a.example.com")}));
139  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
140  sans.data(), sans.size(), {ExactMatcher("fOo.ExAmPlE.cOm")}));
141  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
142  sans.data(), sans.size(), {ExactMatcher("BaR.eXaMpLe.CoM")}));
143  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
144  sans.data(), sans.size(), {ExactMatcher(".example.com")}));
145  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
146  sans.data(), sans.size(), {ExactMatcher("example.com")}));
147  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
148  sans.data(), sans.size(), {ExactMatcher("foo.bar.com")}));
149 }
150 
151 TEST(XdsSanMatchingTest, ExactMatchWildCardDoesNotMatchSingleLabelDomain) {
152  std::vector<const char*> sans = {"*"};
153  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
154  sans.data(), sans.size(), {ExactMatcher("abc")}));
155  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
156  sans.data(), sans.size(), {ExactMatcher("abc.com.")}));
157  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
158  sans.data(), sans.size(), {ExactMatcher("bar.baz.com")}));
159  sans = {"*."};
160  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
161  sans.data(), sans.size(), {ExactMatcher("abc")}));
162  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
163  sans.data(), sans.size(), {ExactMatcher("abc.com.")}));
164  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
165  sans.data(), sans.size(), {ExactMatcher("bar.baz.com")}));
166 }
167 
168 TEST(XdsSanMatchingTest, ExactMatchAsteriskOnlyPermittedInLeftMostDomainName) {
169  std::vector<const char*> sans = {"*.example.*.com"};
170  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
171  sans.data(), sans.size(), {ExactMatcher("abc.example.xyz.com")}));
172  sans = {"*.exam*ple.com"};
173  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
174  sans.data(), sans.size(), {ExactMatcher("abc.example.com")}));
175 }
176 
177 TEST(XdsSanMatchingTest,
178  ExactMatchAsteriskMustBeOnlyCharacterInLeftMostDomainName) {
179  std::vector<const char*> sans = {"*c.example.com"};
180  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
181  sans.data(), sans.size(), {ExactMatcher("abc.example.com")}));
182 }
183 
184 TEST(XdsSanMatchingTest,
185  ExactMatchAsteriskMatchingAcrossDomainLabelsNotPermitted) {
186  std::vector<const char*> sans = {"*.com"};
187  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
188  sans.data(), sans.size(), {ExactMatcher("abc.example.com")}));
189  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
190  sans.data(), sans.size(), {ExactMatcher("foo.bar.baz.com")}));
191  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
192  sans.data(), sans.size(), {ExactMatcher("abc.com")}));
193 }
194 
195 TEST(XdsSanMatchingTest, PrefixMatch) {
196  std::vector<const char*> sans = {"abc.com"};
197  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(sans.data(), sans.size(),
198  {PrefixMatcher("abc")}));
199  sans = {"AbC.CoM"};
200  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
201  sans.data(), sans.size(), {PrefixMatcher("abc")}));
202  sans = {"xyz.com"};
203  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
204  sans.data(), sans.size(), {PrefixMatcher("abc")}));
205 }
206 
207 TEST(XdsSanMatchingTest, PrefixMatchIgnoreCase) {
208  std::vector<const char*> sans = {"aBc.cOm"};
209  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
210  sans.data(), sans.size(),
211  {PrefixMatcher("AbC", false /* case_sensitive */)}));
212  sans = {"abc.com"};
213  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
214  sans.data(), sans.size(),
215  {PrefixMatcher("AbC", false /* case_sensitive */)}));
216  sans = {"xyz.com"};
217  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
218  sans.data(), sans.size(),
219  {PrefixMatcher("AbC", false /* case_sensitive */)}));
220 }
221 
222 TEST(XdsSanMatchingTest, SuffixMatch) {
223  std::vector<const char*> sans = {"abc.com"};
224  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
225  sans.data(), sans.size(), {SuffixMatcher(".com")}));
226  sans = {"AbC.CoM"};
227  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
228  sans.data(), sans.size(), {SuffixMatcher(".com")}));
229  sans = {"abc.xyz"};
230  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
231  sans.data(), sans.size(), {SuffixMatcher(".com")}));
232 }
233 
234 TEST(XdsSanMatchingTest, SuffixMatchIgnoreCase) {
235  std::vector<const char*> sans = {"abc.com"};
236  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
237  sans.data(), sans.size(),
238  {SuffixMatcher(".CoM", false /* case_sensitive */)}));
239  sans = {"AbC.cOm"};
240  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
241  sans.data(), sans.size(),
242  {SuffixMatcher(".CoM", false /* case_sensitive */)}));
243  sans = {"abc.xyz"};
244  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
245  sans.data(), sans.size(),
246  {SuffixMatcher(".CoM", false /* case_sensitive */)}));
247 }
248 
249 TEST(XdsSanMatchingTest, ContainsMatch) {
250  std::vector<const char*> sans = {"abc.com"};
251  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
252  sans.data(), sans.size(), {ContainsMatcher("abc")}));
253  sans = {"xyz.abc.com"};
254  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
255  sans.data(), sans.size(), {ContainsMatcher("abc")}));
256  sans = {"foo.AbC.com"};
257  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
258  sans.data(), sans.size(), {ContainsMatcher("abc")}));
259 }
260 
261 TEST(XdsSanMatchingTest, ContainsMatchIgnoresCase) {
262  std::vector<const char*> sans = {"abc.com"};
263  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
264  sans.data(), sans.size(),
265  {ContainsMatcher("AbC", false /* case_sensitive */)}));
266  sans = {"xyz.abc.com"};
267  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
268  sans.data(), sans.size(),
269  {ContainsMatcher("AbC", false /* case_sensitive */)}));
270  sans = {"foo.aBc.com"};
271  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
272  sans.data(), sans.size(),
273  {ContainsMatcher("AbC", false /* case_sensitive */)}));
274  sans = {"foo.Ab.com"};
275  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
276  sans.data(), sans.size(),
277  {ContainsMatcher("AbC", false /* case_sensitive */)}));
278 }
279 
280 TEST(XdsSanMatchingTest, RegexMatch) {
281  std::vector<const char*> sans = {"abc.example.com"};
282  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
283  sans.data(), sans.size(), {SafeRegexMatcher("(abc|xyz).example.com")}));
284  sans = {"xyz.example.com"};
285  EXPECT_TRUE(TestOnlyXdsVerifySubjectAlternativeNames(
286  sans.data(), sans.size(), {SafeRegexMatcher("(abc|xyz).example.com")}));
287  sans = {"foo.example.com"};
288  EXPECT_FALSE(TestOnlyXdsVerifySubjectAlternativeNames(
289  sans.data(), sans.size(), {SafeRegexMatcher("(abc|xyz).example.com")}));
290 }
291 
292 TEST(XdsCertificateVerifierTest, CompareSuccess) {
293  XdsCertificateVerifier verifier_1(nullptr, "");
294  XdsCertificateVerifier verifier_2(nullptr, "");
295  EXPECT_EQ(verifier_1.Compare(&verifier_2), 0);
296  EXPECT_EQ(verifier_2.Compare(&verifier_1), 0);
297 }
298 
299 TEST(XdsCertificateVerifierTest, CompareFailureDifferentCertificateProviders) {
300  XdsCertificateVerifier verifier_1(MakeRefCounted<XdsCertificateProvider>(),
301  "");
302  XdsCertificateVerifier verifier_2(MakeRefCounted<XdsCertificateProvider>(),
303  "");
304  EXPECT_NE(verifier_1.Compare(&verifier_2), 0);
305  EXPECT_NE(verifier_2.Compare(&verifier_1), 0);
306 }
307 
308 TEST(XdsCertificateVerifierTest, CompareFailureDifferentClusterNames) {
309  XdsCertificateVerifier verifier_1(nullptr, "cluster1");
310  XdsCertificateVerifier verifier_2(nullptr, "cluster2");
311  EXPECT_NE(verifier_1.Compare(&verifier_2), 0);
312  EXPECT_NE(verifier_2.Compare(&verifier_1), 0);
313 }
314 
315 } // namespace
316 
317 } // namespace testing
318 } // namespace grpc_core
319 
320 int main(int argc, char** argv) {
321  ::testing::InitGoogleTest(&argc, argv);
322  grpc::testing::TestEnvironment env(&argc, argv);
323  grpc_init();
324  auto result = RUN_ALL_TESTS();
325  grpc_shutdown();
326  return result;
327 }
EXPECT_FALSE
#define EXPECT_FALSE(condition)
Definition: bloaty/third_party/googletest/googletest/include/gtest/gtest.h:1970
_gevent_test_main.result
result
Definition: _gevent_test_main.py:96
testing
Definition: aws_request_signer_test.cc:25
generate.env
env
Definition: generate.py:37
grpc_core::TestOnlyXdsVerifySubjectAlternativeNames
bool TestOnlyXdsVerifySubjectAlternativeNames(const char *const *subject_alternative_names, size_t subject_alternative_names_size, const std::vector< StringMatcher > &matchers)
Definition: core/lib/security/credentials/xds/xds_credentials.cc:120
grpc_core
Definition: call_metric_recorder.h:31
grpc_core::StringMatcher::Create
static absl::StatusOr< StringMatcher > Create(Type type, absl::string_view matcher, bool case_sensitive=true)
Definition: matchers/matchers.cc:34
grpc_core::StringMatcher::Type::kSuffix
@ kSuffix
EXPECT_EQ
#define EXPECT_EQ(a, b)
Definition: iomgr/time_averaged_stats_test.cc:27
main
int main(int argc, char **argv)
Definition: xds_credentials_test.cc:320
EXPECT_NE
#define EXPECT_NE(val1, val2)
Definition: bloaty/third_party/googletest/googletest/include/gtest/gtest.h:2028
grpc.h
RUN_ALL_TESTS
int RUN_ALL_TESTS() GTEST_MUST_USE_RESULT_
Definition: bloaty/third_party/googletest/googletest/include/gtest/gtest.h:2471
xds_credentials.h
test_config.h
testing::InitGoogleTest
GTEST_API_ void InitGoogleTest(int *argc, char **argv)
Definition: bloaty/third_party/googletest/googletest/src/gtest.cc:6106
grpc::testing::TestEnvironment
Definition: test/core/util/test_config.h:54
grpc_core::StringMatcher::Type::kExact
@ kExact
grpc_core::StringMatcher::Type::kSafeRegex
@ kSafeRegex
grpc_core::testing::TEST
TEST(ServiceConfigParserTest, DoubleRegistration)
Definition: service_config_test.cc:448
EXPECT_TRUE
#define EXPECT_TRUE(condition)
Definition: bloaty/third_party/googletest/googletest/include/gtest/gtest.h:1967
grpc_core::StringMatcher::Type::kContains
@ kContains
grpc_init
GRPCAPI void grpc_init(void)
Definition: init.cc:146
grpc_core::StringMatcher::Type::kPrefix
@ kPrefix
grpc_shutdown
GRPCAPI void grpc_shutdown(void)
Definition: init.cc:209

grpc
Author(s):
autogenerated on Fri May 16 2025 03:00:58