snapshot of https://github.com/grpc/grpc-go.git (master, 2026-09-15; blobs > 131072B omitted)

internal/xds/grpcservice/grpcservice_test.go

@@ -0,0 +1,462 @@
+/*
+ *
+ * Copyright 2026 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpcservice
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/envconfig"
+	"google.golang.org/grpc/internal/grpctest"
+	"google.golang.org/grpc/internal/stubserver"
+	"google.golang.org/grpc/internal/testutils"
+	"google.golang.org/grpc/internal/xds/bootstrap"
+	xdscreds "google.golang.org/grpc/internal/xds/credentials"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/testdata"
+
+	v3corepb "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	accesstokenpb "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/call_credentials/access_token/v3"
+	tlscredspb "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/channel_credentials/tls/v3"
+	xdscredspb "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/channel_credentials/xds/v3"
+	v3tlspb "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	testgrpc "google.golang.org/grpc/interop/grpc_testing"
+	testpb "google.golang.org/grpc/interop/grpc_testing"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/durationpb"
+)
+
+type s struct {
+	grpctest.Tester
+}
+
+func Test(t *testing.T) {
+	grpctest.RunSubTests(t, s{})
+}
+
+const (
+	target = "dns:///my-service:443"
+
+	insecureCredsTypeURL = "type.googleapis.com/envoy.extensions.grpc_service.channel_credentials.insecure.v3.InsecureCredentials"
+
+	defaultTestTimeout = 10 * time.Second
+)
+
+// bootstrapConfig builds a bootstrap Config whose allowed_grpc_services is set
+// to the provided JSON (a map from target URI to allowed service config).
+func bootstrapConfig(t *testing.T, allowed string) *bootstrap.Config {
+	t.Helper()
+	// The allowed_grpc_services bootstrap field is parsed only when a
+	// consuming feature is enabled.
+	testutils.SetEnvConfig(t, &envconfig.XDSClientExtProcEnabled, true)
+	contents, err := bootstrap.NewContentsForTesting(bootstrap.ConfigOptionsForTesting{
+		Servers:             json.RawMessage(`[{"server_uri":"td.googleapis.com:443","channel_creds":[{"type":"insecure"}]}]`),
+		Node:                json.RawMessage(`{}`),
+		AllowedGRPCServices: json.RawMessage(allowed),
+	})
+	if err != nil {
+		t.Fatalf("NewContentsForTesting() failed: %v", err)
+	}
+	cfg, err := bootstrap.NewConfigFromContents(contents)
+	if err != nil {
+		t.Fatalf("NewConfigFromContents() failed: %v", err)
+	}
+	return cfg
+}
+
+// trustedServerConfig returns a server config carrying the trusted_xds_server
+// server feature.
+func trustedServerConfig(t *testing.T) *bootstrap.ServerConfig {
+	t.Helper()
+	sc, err := bootstrap.ServerConfigForTesting(bootstrap.ServerConfigTestingOptions{
+		URI:            "trusted-server:443",
+		ServerFeatures: []string{"trusted_xds_server"},
+	})
+	if err != nil {
+		t.Fatalf("ServerConfigForTesting() failed: %v", err)
+	}
+	return sc
+}
+
+// untrustedServerConfig returns a server config without the
+// trusted_xds_server server feature.
+func untrustedServerConfig(t *testing.T) *bootstrap.ServerConfig {
+	t.Helper()
+	sc, err := bootstrap.ServerConfigForTesting(bootstrap.ServerConfigTestingOptions{URI: "untrusted-server:443"})
+	if err != nil {
+		t.Fatalf("ServerConfigForTesting() failed: %v", err)
+	}
+	return sc
+}
+
+func googleGrpcService(target string, channelPlugins, callPlugins []*anypb.Any, timeout *durationpb.Duration) *v3corepb.GrpcService {
+	return &v3corepb.GrpcService{
+		TargetSpecifier: &v3corepb.GrpcService_GoogleGrpc_{
+			GoogleGrpc: &v3corepb.GrpcService_GoogleGrpc{
+				TargetUri:                target,
+				ChannelCredentialsPlugin: channelPlugins,
+				CallCredentialsPlugin:    callPlugins,
+			},
+		},
+		Timeout: timeout,
+	}
+}
+
+// protoIdentity returns the identity of a proto plugin config.
+func protoIdentity(a *anypb.Any) xdscreds.Identity {
+	return xdscreds.Identity{Type: a.GetTypeUrl(), Data: a.GetValue()}
+}
+
+func accessTokenPlugin(t *testing.T, token string) *anypb.Any {
+	t.Helper()
+	a, err := anypb.New(&accesstokenpb.AccessTokenCredentials{Token: token})
+	if err != nil {
+		t.Fatalf("Failed to marshal AccessTokenCredentials: %v", err)
+	}
+	return a
+}
+
+func (s) TestParse(t *testing.T) {
+	insecurePlugin := &anypb.Any{TypeUrl: insecureCredsTypeURL}
+	xdsWithInsecureFallback, err := anypb.New(&xdscredspb.XdsCredentials{FallbackCredentials: insecurePlugin})
+	if err != nil {
+		t.Fatalf("Failed to marshal XdsCredentials: %v", err)
+	}
+	tokenPlugin := accessTokenPlugin(t, "test-token")
+	unsupportedCallPlugin := &anypb.Any{TypeUrl: "type.googleapis.com/unsupported.CallCredentials"}
+	allowedInsecure := `{"dns:///my-service:443":{"channel_creds":[{"type":"insecure"}]}}`
+
+	tests := []struct {
+		name   string
+		gs     *v3corepb.GrpcService
+		sc     *bootstrap.ServerConfig
+		config *bootstrap.Config
+		// want carries the expected target and credential identities;
+		// comparisons use Config.Equal via cmp.Diff.
+		want    *Config
+		wantErr string
+	}{
+		{
+			name:   "trusted_insecure_channel_creds",
+			gs:     googleGrpcService(target, []*anypb.Any{insecurePlugin}, nil, nil),
+			sc:     trustedServerConfig(t),
+			config: bootstrapConfig(t, "{}"),
+			want:   &Config{TargetURI: target, ChannelCredentials: xdscreds.NewChannelCreds(nil, protoIdentity(insecurePlugin), nil)},
+		},
+		{
+			name:   "trusted_xds_creds_resolve_to_fallback",
+			gs:     googleGrpcService(target, []*anypb.Any{xdsWithInsecureFallback}, nil, nil),
+			sc:     trustedServerConfig(t),
+			config: bootstrapConfig(t, "{}"),
+			want:   &Config{TargetURI: target, ChannelCredentials: xdscreds.NewChannelCreds(nil, protoIdentity(xdsWithInsecureFallback), nil)},
+		},
+		{
+			// Call-creds plugins of unsupported types are skipped, while
+			// supported ones are built in order.
+			name:   "trusted_with_call_creds",
+			gs:     googleGrpcService(target, []*anypb.Any{insecurePlugin}, []*anypb.Any{tokenPlugin, unsupportedCallPlugin}, nil),
+			sc:     trustedServerConfig(t),
+			config: bootstrapConfig(t, "{}"),
+			want: &Config{
+				TargetURI:          target,
+				ChannelCredentials: xdscreds.NewChannelCreds(nil, protoIdentity(insecurePlugin), nil),
+				CallCredentials:    []*xdscreds.CallCreds{xdscreds.NewCallCreds(nil, protoIdentity(tokenPlugin), nil)},
+			},
+		},
+		{
+			name:    "trusted_empty_call_creds_token",
+			gs:      googleGrpcService(target, []*anypb.Any{insecurePlugin}, []*anypb.Any{accessTokenPlugin(t, "")}, nil),
+			sc:      trustedServerConfig(t),
+			config:  bootstrapConfig(t, "{}"),
+			wantErr: "access token must be non-empty",
+		},
+		{
+			name:    "trusted_no_supported_channel_creds",
+			gs:      googleGrpcService(target, nil, nil, nil),
+			sc:      trustedServerConfig(t),
+			config:  bootstrapConfig(t, "{}"),
+			wantErr: "no supported channel credentials",
+		},
+		{
+			name:   "untrusted_allowlisted_uses_allowlist_creds",
+			gs:     googleGrpcService(target, []*anypb.Any{insecurePlugin}, nil, nil),
+			sc:     untrustedServerConfig(t),
+			config: bootstrapConfig(t, allowedInsecure),
+			want:   &Config{TargetURI: target, ChannelCredentials: xdscreds.NewChannelCreds(nil, xdscreds.Identity{Type: "insecure"}, nil)},
+		},
+		{
+			// The proto's call-creds plugins are ignored along with its
+			// channel-creds plugins: the allowlist's call creds are used.
+			name:   "untrusted_allowlisted_uses_allowlist_call_creds",
+			gs:     googleGrpcService(target, []*anypb.Any{insecurePlugin}, []*anypb.Any{tokenPlugin}, nil),
+			sc:     untrustedServerConfig(t),
+			config: bootstrapConfig(t, `{"dns:///my-service:443":{"channel_creds":[{"type":"insecure"}],"call_creds":[{"type":"jwt_token_file","config":{"jwt_token_file":"/tokens/token"}}]}}`),
+			want: &Config{
+				TargetURI:          target,
+				ChannelCredentials: xdscreds.NewChannelCreds(nil, xdscreds.Identity{Type: "insecure"}, nil),
+				CallCredentials: []*xdscreds.CallCreds{xdscreds.NewCallCreds(nil, xdscreds.Identity{
+					Type: "jwt_token_file",
+					// Bootstrap parsing normalizes the configuration JSON
+					// via json.Indent, and the identity carries the
+					// normalized bytes.
+					Data: json.RawMessage("{\n\"jwt_token_file\": \"/tokens/token\"\n}"),
+				}, nil)},
+			},
+		},
+		{
+			name:    "untrusted_not_allowlisted",
+			gs:      googleGrpcService(target, nil, nil, nil),
+			sc:      untrustedServerConfig(t),
+			config:  bootstrapConfig(t, "{}"),
+			wantErr: "not present in allowed_grpc_services",
+		},
+		{
+			name:    "missing_google_grpc",
+			gs:      &v3corepb.GrpcService{},
+			sc:      trustedServerConfig(t),
+			config:  bootstrapConfig(t, "{}"),
+			wantErr: "only google_grpc",
+		},
+		{
+			name:    "empty_target_uri",
+			gs:      googleGrpcService("", nil, nil, nil),
+			sc:      trustedServerConfig(t),
+			config:  bootstrapConfig(t, "{}"),
+			wantErr: "target_uri must be non-empty",
+		},
+		{
+			name:   "valid_timeout",
+			gs:     googleGrpcService(target, []*anypb.Any{insecurePlugin}, nil, durationpb.New(10*time.Second)),
+			sc:     trustedServerConfig(t),
+			config: bootstrapConfig(t, "{}"),
+			want: &Config{
+				TargetURI:          target,
+				Timeout:            10 * time.Second,
+				ChannelCredentials: xdscreds.NewChannelCreds(nil, protoIdentity(insecurePlugin), nil),
+			},
+		},
+		{
+			name:    "zero_timeout_rejected",
+			gs:      googleGrpcService(target, []*anypb.Any{insecurePlugin}, nil, durationpb.New(0)),
+			sc:      trustedServerConfig(t),
+			config:  bootstrapConfig(t, "{}"),
+			wantErr: "timeout must be strictly positive",
+		},
+		{
+			name: "initial_metadata",
+			gs: func() *v3corepb.GrpcService {
+				gs := googleGrpcService(target, []*anypb.Any{insecurePlugin}, nil, nil)
+				gs.InitialMetadata = []*v3corepb.HeaderValue{
+					{Key: "key-b", Value: "b"},
+					// raw_value takes precedence over the legacy value field.
+					{Key: "key-a", Value: "legacy", RawValue: []byte("raw-a")},
+				}
+				return gs
+			}(),
+			sc:     trustedServerConfig(t),
+			config: bootstrapConfig(t, "{}"),
+			want: &Config{
+				TargetURI:          target,
+				InitialMetadata:    metadata.MD{"key-b": {"b"}, "key-a": {"raw-a"}},
+				ChannelCredentials: xdscreds.NewChannelCreds(nil, protoIdentity(insecurePlugin), nil),
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := Parse(test.gs, test.config, test.sc)
+			if test.wantErr != "" {
+				if err == nil || !strings.Contains(err.Error(), test.wantErr) {
+					t.Fatalf("Parse() error = %v, want substring %q", err, test.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("Parse() returned unexpected error: %v", err)
+			}
+			// The cmp.Diff below compares credentials by identity only, so it
+			// cannot tell a built credential from a nil one; verify the
+			// credentials were built.
+			if got.ChannelCredentials.Bundle() == nil {
+				t.Error("Parse() returned channel credentials without a built bundle")
+			}
+			for i, cc := range got.CallCredentials {
+				if cc.Credentials() == nil {
+					t.Errorf("Parse() call credentials[%d] have no built credentials", i)
+				}
+			}
+			if diff := cmp.Diff(test.want, got); diff != "" {
+				t.Errorf("Parse() returned unexpected config (-want +got):\n%s", diff)
+			}
+		})
+	}
+}
+
+// Tests that Dial applies the config's credentials to the created channel:
+// call credentials that require transport security combined with insecure
+// channel credentials must fail channel creation.
+func (s) TestConfigDial(t *testing.T) {
+	gs := googleGrpcService(target, []*anypb.Any{{TypeUrl: insecureCredsTypeURL}}, []*anypb.Any{accessTokenPlugin(t, "test-token")}, nil)
+	cfg, err := Parse(gs, bootstrapConfig(t, "{}"), trustedServerConfig(t))
+	if err != nil {
+		t.Fatalf("Parse() returned unexpected error: %v", err)
+	}
+	defer cfg.Close()
+	if _, err := cfg.Dial(); err == nil || !strings.Contains(err.Error(), "transport level security") {
+		t.Fatalf("Dial() returned error %v, want transport security error", err)
+	}
+}
+
+// Tests that a Config carrying TLS channel credentials and access token call
+// credentials, built from a trusted server's GrpcService proto, can dial a
+// TLS-serving backend, and that RPCs on the resulting channel succeed and
+// carry the token.
+func (s) TestConfigDialTLS(t *testing.T) {
+	// Start a TLS-serving backend that verifies the access token arrives.
+	const wantAuthorization = "Bearer test-token"
+	serverCreds, err := credentials.NewServerTLSFromFile(testdata.Path("x509/server1_cert.pem"), testdata.Path("x509/server1_key.pem"))
+	if err != nil {
+		t.Fatalf("Failed to create server TLS credentials: %v", err)
+	}
+	backend := stubserver.StartTestService(t, &stubserver.StubServer{
+		EmptyCallF: func(ctx context.Context, _ *testpb.Empty) (*testpb.Empty, error) {
+			md, ok := metadata.FromIncomingContext(ctx)
+			if !ok {
+				return nil, fmt.Errorf("no incoming metadata")
+			}
+			if got := md.Get("authorization"); len(got) != 1 || got[0] != wantAuthorization {
+				return nil, fmt.Errorf("authorization metadata = %v, want [%q]", got, wantAuthorization)
+			}
+			return &testpb.Empty{}, nil
+		},
+	}, grpc.Creds(serverCreds))
+	defer backend.Stop()
+
+	// Bootstrap configuration with a certificate provider instance watching
+	// the CA certificate that signed the backend's certificate.
+	contents, err := bootstrap.NewContentsForTesting(bootstrap.ConfigOptionsForTesting{
+		Servers: json.RawMessage(`[{"server_uri":"td.googleapis.com:443","channel_creds":[{"type":"insecure"}]}]`),
+		Node:    json.RawMessage(`{}`),
+		CertificateProviders: map[string]json.RawMessage{
+			"root-instance": json.RawMessage(fmt.Sprintf(`{
+				"plugin_name": "file_watcher",
+				"config": {"ca_certificate_file": %q}
+			}`, testdata.Path("x509/server_ca_cert.pem"))),
+		},
+	})
+	if err != nil {
+		t.Fatalf("NewContentsForTesting() failed: %v", err)
+	}
+	bc, err := bootstrap.NewConfigFromContents(contents)
+	if err != nil {
+		t.Fatalf("NewConfigFromContents() failed: %v", err)
+	}
+
+	tlsPlugin, err := anypb.New(&tlscredspb.TlsCredentials{
+		RootCertificateProvider: &v3tlspb.CommonTlsContext_CertificateProviderInstance{InstanceName: "root-instance"},
+	})
+	if err != nil {
+		t.Fatalf("Failed to marshal TlsCredentials: %v", err)
+	}
+	gs := googleGrpcService(backend.Address, []*anypb.Any{tlsPlugin}, []*anypb.Any{accessTokenPlugin(t, "test-token")}, nil)
+	cfg, err := Parse(gs, bc, trustedServerConfig(t))
+	if err != nil {
+		t.Fatalf("Parse() returned unexpected error: %v", err)
+	}
+	defer cfg.Close()
+
+	// The backend certificate's SANs cover x.test.example.com.
+	cc, err := cfg.Dial(grpc.WithAuthority("x.test.example.com"))
+	if err != nil {
+		t.Fatalf("Dial() returned unexpected error: %v", err)
+	}
+	defer cc.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), defaultTestTimeout)
+	defer cancel()
+	if _, err := testgrpc.NewTestServiceClient(cc).EmptyCall(ctx, &testpb.Empty{}); err != nil {
+		t.Fatalf("EmptyCall() failed: %v", err)
+	}
+}
+
+func (s) TestConfigEqual(t *testing.T) {
+	insecurePlugin := &anypb.Any{TypeUrl: insecureCredsTypeURL}
+	protoInsecure := xdscreds.NewChannelCreds(nil, protoIdentity(insecurePlugin), nil)
+	jsonInsecure := xdscreds.NewChannelCreds(nil, xdscreds.Identity{Type: "insecure"}, nil)
+
+	tests := []struct {
+		name string
+		a, b *Config
+		want bool
+	}{
+		{
+			name: "equal",
+			a:    &Config{TargetURI: target, ChannelCredentials: protoInsecure, Timeout: 1, InitialMetadata: metadata.Pairs("k", "v")},
+			b:    &Config{TargetURI: target, ChannelCredentials: xdscreds.NewChannelCreds(nil, protoIdentity(insecurePlugin), nil), Timeout: 1, InitialMetadata: metadata.Pairs("k", "v")},
+			want: true,
+		},
+		{
+			name: "different_timeouts",
+			a:    &Config{TargetURI: target, ChannelCredentials: protoInsecure, Timeout: 1},
+			b:    &Config{TargetURI: target, ChannelCredentials: protoInsecure, Timeout: 2},
+			want: false,
+		},
+		{
+			name: "different_initial_metadata",
+			a:    &Config{TargetURI: target, ChannelCredentials: protoInsecure},
+			b:    &Config{TargetURI: target, ChannelCredentials: protoInsecure, InitialMetadata: metadata.Pairs("k", "v")},
+			want: false,
+		},
+		{
+			name: "different_targets",
+			a:    &Config{TargetURI: target, ChannelCredentials: protoInsecure},
+			b:    &Config{TargetURI: "dns:///other:443", ChannelCredentials: protoInsecure},
+			want: false,
+		},
+		{
+			name: "different_identity_flavors",
+			a:    &Config{TargetURI: target, ChannelCredentials: protoInsecure},
+			b:    &Config{TargetURI: target, ChannelCredentials: jsonInsecure},
+			want: false,
+		},
+		{
+			name: "different_call_creds",
+			a:    &Config{TargetURI: target, ChannelCredentials: protoInsecure},
+			b: &Config{TargetURI: target, ChannelCredentials: protoInsecure, CallCredentials: []*xdscreds.CallCreds{
+				xdscreds.NewCallCreds(nil, xdscreds.Identity{Type: "access_token"}, nil),
+			}},
+			want: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := test.a.Equal(test.b); got != test.want {
+				t.Errorf("Equal() = %v, want %v", got, test.want)
+			}
+		})
+	}
+}