#19778

Committed 11 Apr 2025 03:25PM UTC coverage: 88.572% (-0.01%) from 88.586%

Build # #19778

Build Type

push

github

Committed by

web-flow

Commit Message

xds: Enable deprecation warnings

The security code referenced fields removed from gRFC A29 before it was
finalized.

Note that this fixes a bug in CommonTlsContextUtil where
CombinedValidationContext was not checked. I believe this was the only
location with such a bug as I audited all non-test usages of
has/getValidationContext() and confirmed they have have a corresponding
has/getCombinedValidationContext().

Run Details

34707 of 39185 relevant lines covered (88.57%)

0.89 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

94.74

/../xds/src/main/java/io/grpc/xds/internal/security/CommonTlsContextUtil.java

/*
 * Copyright 2019 The gRPC Authors
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package io.grpc.xds.internal.security;

import io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstance;
import io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CommonTlsContext;

/** Class for utility functions for {@link CommonTlsContext}. */
public final class CommonTlsContextUtil {

  private CommonTlsContextUtil() {}

  public static boolean hasCertProviderInstance(CommonTlsContext commonTlsContext) {
    if (commonTlsContext == null) {
      return false;
    }
    return commonTlsContext.hasTlsCertificateProviderInstance()
        || hasValidationProviderInstance(commonTlsContext);
  }

  private static boolean hasValidationProviderInstance(CommonTlsContext commonTlsContext) {
    if (commonTlsContext.hasValidationContext() && commonTlsContext.getValidationContext()
        .hasCaCertificateProviderInstance()) {
      return true;
    }
    return commonTlsContext.hasCombinedValidationContext()
        && commonTlsContext.getCombinedValidationContext().getDefaultValidationContext()
          .hasCaCertificateProviderInstance();
  }

  /**
   * Converts {@link CertificateProviderPluginInstance} to
   * {@link CommonTlsContext.CertificateProviderInstance}.
   */
  public static CommonTlsContext.CertificateProviderInstance convert(
      CertificateProviderPluginInstance pluginInstance) {
    return CommonTlsContext.CertificateProviderInstance.newBuilder()
        .setInstanceName(pluginInstance.getInstanceName())
        .setCertificateName(pluginInstance.getCertificateName()).build();
  }

  public static boolean isUsingSystemRootCerts(CommonTlsContext commonTlsContext) {
    if (commonTlsContext.hasCombinedValidationContext()) {
      return commonTlsContext.getCombinedValidationContext().getDefaultValidationContext()
          .hasSystemRootCerts();
    }
    if (commonTlsContext.hasValidationContext()) {
      return commonTlsContext.getValidationContext().hasSystemRootCerts();
    }
    return false;
  }
}

1	/*
2	* Copyright 2019 The gRPC Authors
3	*
4	* Licensed under the Apache License, Version 2.0 (the "License");
5	* you may not use this file except in compliance with the License.
6	* You may obtain a copy of the License at
7	*
8	* http://www.apache.org/licenses/LICENSE-2.0
9	*
10	* Unless required by applicable law or agreed to in writing, software
11	* distributed under the License is distributed on an "AS IS" BASIS,
12	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13	* See the License for the specific language governing permissions and
14	* limitations under the License.
15	*/
16
17	package io.grpc.xds.internal.security;
18
19	import io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstance;
20	import io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CommonTlsContext;
21
22	/** Class for utility functions for {@link CommonTlsContext}. */
23	public final class CommonTlsContextUtil {
24
25	private CommonTlsContextUtil() {}
26
27	public static boolean hasCertProviderInstance(CommonTlsContext commonTlsContext) {
28	if (commonTlsContext == null) {	1✔
29	return false;	×
30	}
31	return commonTlsContext.hasTlsCertificateProviderInstance()	1✔
32	\|\| hasValidationProviderInstance(commonTlsContext);	1✔
33	}
34
35	private static boolean hasValidationProviderInstance(CommonTlsContext commonTlsContext) {
36	if (commonTlsContext.hasValidationContext() && commonTlsContext.getValidationContext()	1✔
37	.hasCaCertificateProviderInstance()) {	1✔
38	return true;	1✔
39	}
40	return commonTlsContext.hasCombinedValidationContext()	1✔
41	&& commonTlsContext.getCombinedValidationContext().getDefaultValidationContext()	1✔
42	.hasCaCertificateProviderInstance();	1✔
43	}
44
45	/**
46	* Converts {@link CertificateProviderPluginInstance} to
47	* {@link CommonTlsContext.CertificateProviderInstance}.
48	*/
49	public static CommonTlsContext.CertificateProviderInstance convert(
50	CertificateProviderPluginInstance pluginInstance) {
51	return CommonTlsContext.CertificateProviderInstance.newBuilder()	1✔
52	.setInstanceName(pluginInstance.getInstanceName())	1✔
53	.setCertificateName(pluginInstance.getCertificateName()).build();	1✔
54	}
55
56	public static boolean isUsingSystemRootCerts(CommonTlsContext commonTlsContext) {
57	if (commonTlsContext.hasCombinedValidationContext()) {	1✔
58	return commonTlsContext.getCombinedValidationContext().getDefaultValidationContext()	1✔
59	.hasSystemRootCerts();	1✔
60	}
61	if (commonTlsContext.hasValidationContext()) {	1✔
62	return commonTlsContext.getValidationContext().hasSystemRootCerts();	1✔
63	}
64	return false;	1✔
65	}
66	}

grpc / grpc-java / #19778

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous