This repository has been archived by the owner on Aug 2, 2022. It is now read-only.
Add required mutual auth to gRPC Server/Client #254
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## master #254 +/- ##
============================================
+ Coverage 66.14% 66.16% +0.01%
+ Complexity 1789 1733 -56
============================================
Files 270 259 -11
Lines 11988 11720 -268
Branches 952 929 -23
============================================
- Hits 7929 7754 -175
+ Misses 3744 3666 -78
+ Partials 315 300 -15 Continue to review full report at Codecov.
|
yojs
approved these changes
Jun 25, 2020
src/test/java/com/amazon/opendistro/elasticsearch/performanceanalyzer/net/GRPCTest.java
Show resolved
Hide resolved
ktkrg
reviewed
Jun 29, 2020
.../java/com/amazon/opendistro/elasticsearch/performanceanalyzer/net/GRPCConnectionManager.java
Outdated
Show resolved
Hide resolved
src/main/java/com/amazon/opendistro/elasticsearch/performanceanalyzer/net/NetServer.java
Outdated
Show resolved
Hide resolved
ktkrg
reviewed
Jul 14, 2020
Comment on lines
177
to
193
| private ManagedChannel buildSecureChannel(final String remoteHost) { | ||
| try { | ||
| SslContextBuilder sslContextBuilder = GrpcSslContexts.forClient().keyManager(certFile, pkeyFile); | ||
| if (trustedCasFile != null) { | ||
| sslContextBuilder.trustManager(trustedCasFile); | ||
| } | ||
| return NettyChannelBuilder.forAddress(remoteHost, this.port) | ||
| .sslContext(sslContextBuilder.build()) | ||
| .build(); | ||
| } catch (SSLException e) { | ||
| LOG.error("Unable to build an SSL gRPC client. Exception: {}", e.getMessage()); | ||
| e.printStackTrace(); | ||
|
|
||
| // Wrap the SSL Exception in a generic RTE and re-throw. | ||
| throw new RuntimeException(e); | ||
| } | ||
| } |
ktkrg
reviewed
Jul 14, 2020
| channel.shutdownNow(); | ||
| try { | ||
| channel.awaitTermination(1, TimeUnit.MINUTES); | ||
| } catch (InterruptedException e) { |
There was a problem hiding this comment.
You need to propagate the interrupted status when catching an InterruptedException by calling Thread.currentThread().interrupt() after channel.shutdownNow();
ktkrg
reviewed
Jul 14, 2020
| try { | ||
| server.awaitTermination(1, TimeUnit.MINUTES); | ||
| } catch (InterruptedException e) { | ||
| server.shutdownNow(); |
There was a problem hiding this comment.
Same comment as above. You need to propagate the interrupted status by calling Thread.currentThread().interrupt();
ktkrg
reviewed
Jul 14, 2020
added 3 commits
July 14, 2020 13:27
Previously we had 1 sided TLS on the server side. Data between the client and server was send over an encrypted channel, but any client could make requests to the server. This commit changes the behavior so that only clients with the matching certificates can make requests to the server when TLS is enabled. This commit does NOT add support for installing a trust manager. That must be added in the future.
sidheart
force-pushed
the
grpc-mutual-auth-fix
branch
from
4b13b62
to
73d110e
Compare
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue #, if available: 253
Description of changes:
Previously we had 1 sided TLS on the server side. Data between the
client and server was send over an encrypted channel, but any client
could make requests to the server.
This commit changes the behavior so that only clients with the matching
certificates can make requests to the server when TLS is enabled. This
commit does NOT add support for installing a trust manager. That must be
added in the future.
Tests:
requests, but an unauthenticated client is rejected.
Code coverage percentage for this patch:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.