Support gRPC TLS communication and TLS registry

quarkus-qe · Sep 2, 2024 · 8235fb4 · 8235fb4
1 parent 3dcd001
commit 8235fb4
Show file tree

Hide file tree

Showing 17 changed files with 352 additions and 21 deletions.
diff --git a/examples/grpc/pom.xml b/examples/grpc/pom.xml
@@ -14,6 +14,10 @@
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-grpc</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-security</artifactId>
+        </dependency>
         <dependency>
             <groupId>io.quarkus.qe</groupId>
             <artifactId>quarkus-test-core</artifactId>

diff --git a/examples/grpc/src/main/java/io/quarkus/qe/grpc/HelloService.java b/examples/grpc/src/main/java/io/quarkus/qe/grpc/HelloService.java
@@ -1,16 +1,33 @@
 package io.quarkus.qe.grpc;
 
+import jakarta.inject.Inject;
+
 import io.grpc.stub.StreamObserver;
 import io.quarkus.grpc.GrpcService;
+import io.quarkus.security.identity.CurrentIdentityAssociation;
 
 @GrpcService
 public class HelloService extends GreeterGrpc.GreeterImplBase {
 
+    @Inject
+    CurrentIdentityAssociation identityAssociation;
+
     @Override
     public void sayHello(HelloRequest request, StreamObserver<HelloReply> responseObserver) {
         String name = request.getName();
         String message = "Hello " + name;
         responseObserver.onNext(HelloReply.newBuilder().setMessage(message).build());
         responseObserver.onCompleted();
     }
+
+    @Override
+    public void sayHi(HiRequest request, StreamObserver<HiReply> responseObserver) {
+        identityAssociation.getDeferredIdentity().subscribe().with(identity -> {
+            String name = request.getName();
+            String message = "Hello " + name;
+            String principalName = identity.isAnonymous() ? "" : identity.getPrincipal().getName();
+            responseObserver.onNext(HiReply.newBuilder().setMessage(message).setPrincipalName(principalName).build());
+            responseObserver.onCompleted();
+        });
+    }
 }
diff --git a/examples/grpc/src/main/proto/helloworld.proto b/examples/grpc/src/main/proto/helloworld.proto
@@ -9,6 +9,7 @@ package io.quarkus.qe.grpc;
 service Greeter {
   // Sends a greeting
   rpc SayHello (HelloRequest) returns (HelloReply) {}
+  rpc SayHi (HiRequest) returns (HiReply) {}
 }
 
 // The request message containing the user's name.
@@ -19,4 +20,15 @@ message HelloRequest {
 // The response message containing the greetings
 message HelloReply {
   string message = 1;
-}
+}
+
+// The request message containing the user's name.
+message HiRequest {
+  string name = 1;
+}
+
+// The response message containing the greetings
+message HiReply {
+  string message = 1;
+  string principalName = 2;
+}
diff --git a/examples/grpc/src/main/resources/META-INF/resources/server.keystore b/examples/grpc/src/main/resources/META-INF/resources/server.keystore
diff --git a/examples/grpc/src/main/resources/META-INF/resources/server.truststore b/examples/grpc/src/main/resources/META-INF/resources/server.truststore
diff --git a/examples/grpc/src/test/java/io/quarkus/qe/grpc/DevModeGrpcServiceIT.java b/examples/grpc/src/test/java/io/quarkus/qe/grpc/DevModeGrpcServiceIT.java
@@ -18,10 +18,12 @@ public class DevModeGrpcServiceIT {
 
     @Test
     public void shouldHelloWorldServiceWork() {
-        HelloRequest request = HelloRequest.newBuilder().setName(NAME).build();
-        HelloReply response = GreeterGrpc.newBlockingStub(app.grpcChannel()).sayHello(request);
+        try (var channel = app.grpcChannel()) {
+            HelloRequest request = HelloRequest.newBuilder().setName(NAME).build();
+            HelloReply response = GreeterGrpc.newBlockingStub(channel).sayHello(request);
 
-        assertEquals("Hello " + NAME, response.getMessage());
+            assertEquals("Hello " + NAME, response.getMessage());
+        }
     }
 
 }
diff --git a/examples/grpc/src/test/java/io/quarkus/qe/grpc/GrpcMtlsTlsRegistryIT.java b/examples/grpc/src/test/java/io/quarkus/qe/grpc/GrpcMtlsTlsRegistryIT.java
@@ -0,0 +1,41 @@
+package io.quarkus.qe.grpc;
+
+import static io.quarkus.test.services.Certificate.Format.PEM;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import org.junit.jupiter.api.Test;
+
+import io.quarkus.test.bootstrap.GrpcService;
+import io.quarkus.test.scenarios.QuarkusScenario;
+import io.quarkus.test.services.Certificate;
+import io.quarkus.test.services.Certificate.ClientCertificate;
+import io.quarkus.test.services.QuarkusApplication;
+
+@QuarkusScenario
+public class GrpcMtlsTlsRegistryIT {
+
+    private static final String CN = "Hagrid";
+    private static final String NAME = "Albus";
+
+    @QuarkusApplication(grpc = true, ssl = true, certificates = @Certificate(format = PEM, configureHttpServer = true, configureKeystore = true, configureTruststore = true, tlsConfigName = "grpc-tls", clientCertificates = @ClientCertificate(cnAttribute = CN)))
+    static final GrpcService app = (GrpcService) new GrpcService()
+            .withProperty("quarkus.grpc.server.use-separate-server", "false")
+            .withProperty("quarkus.http.insecure-requests", "disabled")
+            .withProperty("quarkus.http.ssl.client-auth", "request")
+            .withProperty("quarkus.http.auth.permission.perm-1.policy", "authenticated")
+            .withProperty("quarkus.http.auth.permission.perm-1.paths", "*")
+            .withProperty("quarkus.http.auth.permission.perm-1.auth-mechanism", "X509");
+
+    @Test
+    public void testMutualTlsCommunicationWithHelloService() {
+        try (var channel = app.securedGrpcChannel()) {
+            // here both server and client certificates are generated and used
+            HiRequest request = HiRequest.newBuilder().setName(NAME).build();
+            HiReply response = GreeterGrpc.newBlockingStub(channel).sayHi(request);
+
+            assertEquals("Hello " + NAME, response.getMessage());
+            assertEquals("CN=Hagrid", response.getPrincipalName());
+        }
+    }
+
+}
diff --git a/examples/grpc/src/test/java/io/quarkus/qe/grpc/GrpcServiceIT.java b/examples/grpc/src/test/java/io/quarkus/qe/grpc/GrpcServiceIT.java
@@ -18,10 +18,12 @@ public class GrpcServiceIT {
 
     @Test
     public void shouldHelloWorldServiceWork() {
-        HelloRequest request = HelloRequest.newBuilder().setName(NAME).build();
-        HelloReply response = GreeterGrpc.newBlockingStub(app.grpcChannel()).sayHello(request);
+        try (var channel = app.grpcChannel()) {
+            HelloRequest request = HelloRequest.newBuilder().setName(NAME).build();
+            HelloReply response = GreeterGrpc.newBlockingStub(channel).sayHello(request);
 
-        assertEquals("Hello " + NAME, response.getMessage());
+            assertEquals("Hello " + NAME, response.getMessage());
+        }
     }
 
 }
diff --git a/examples/grpc/src/test/java/io/quarkus/qe/grpc/GrpcTlsRegistryIT.java b/examples/grpc/src/test/java/io/quarkus/qe/grpc/GrpcTlsRegistryIT.java
@@ -0,0 +1,47 @@
+package io.quarkus.qe.grpc;
+
+import static io.quarkus.test.services.Certificate.Format.PEM;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+import io.grpc.StatusRuntimeException;
+import io.quarkus.test.bootstrap.GrpcService;
+import io.quarkus.test.scenarios.QuarkusScenario;
+import io.quarkus.test.services.Certificate;
+import io.quarkus.test.services.QuarkusApplication;
+
+@QuarkusScenario
+public class GrpcTlsRegistryIT {
+
+    private static final String NAME = "Albus";
+
+    @QuarkusApplication(grpc = true, ssl = true, certificates = @Certificate(format = PEM, configureHttpServer = true, configureKeystore = true, configureTruststore = true, tlsConfigName = "grpc-tls"))
+    static final GrpcService app = (GrpcService) new GrpcService()
+            .withProperty("quarkus.grpc.server.use-separate-server", "false")
+            .withProperty("quarkus.http.insecure-requests", "disabled");
+
+    @Test
+    public void testGrpcServiceUsingTls() {
+        try (var channel = app.securedGrpcChannel()) {
+            HiRequest request = HiRequest.newBuilder().setName(NAME).build();
+            HiReply response = GreeterGrpc.newBlockingStub(channel).sayHi(request);
+
+            assertEquals("Hello " + NAME, response.getMessage());
+            // no authentication
+            assertEquals("", response.getPrincipalName());
+        }
+    }
+
+    @Test
+    public void testUsingTlsIsRequired() {
+        try (var channel = app.grpcChannel()) {
+            var greeterGrpcStub = GreeterGrpc.newBlockingStub(channel);
+            HiRequest request = HiRequest.newBuilder().setName(NAME).build();
+            Assertions.assertThrows(StatusRuntimeException.class, () -> greeterGrpcStub.sayHi(request),
+                    "Secured channel should be required but isn't");
+        }
+    }
+
+}
diff --git a/quarkus-test-core/src/main/java/io/quarkus/test/security/certificate/Certificate.java b/quarkus-test-core/src/main/java/io/quarkus/test/security/certificate/Certificate.java
@@ -1,5 +1,6 @@
 package io.quarkus.test.security.certificate;
 
+import static io.quarkus.test.services.Certificate.Format.PEM;
 import static io.quarkus.test.services.Certificate.Format.PKCS12;
 import static io.quarkus.test.utils.PropertiesUtils.DESTINATION_TO_FILENAME_SEPARATOR;
 import static io.quarkus.test.utils.PropertiesUtils.SECRET_WITH_DESTINATION_PREFIX;
@@ -127,8 +128,18 @@ private static Certificate.PemCertificate of(CertificateOptions o) {
                     // PKCS12 truststore
                     serverTrustStoreLocation = createPkcs12TruststoreForPem(pemCertsFile.trustStore(), o.password(), cn);
                 } else {
-                    // ca-cert
-                    serverTrustStoreLocation = getPathOrNull(pemCertsFile.trustStore());
+                    if (withClientCerts) {
+                        serverTrustStoreLocation = getPathOrNull(pemCertsFile.serverTrustFile());
+                        var clientCertLocation = getPathOrNull(pemCertsFile.clientCertFile());
+                        var clientKeyLocation = getPathOrNull(pemCertsFile.clientKeyFile());
+                        var clientTrustStore = getPathOrNull(pemCertsFile.trustFile());
+                        generatedClientCerts
+                                .add(new ClientCertificateImpl(cn, null, clientTrustStore, clientKeyLocation,
+                                        clientCertLocation));
+                    } else {
+                        // ca-cert
+                        serverTrustStoreLocation = getPathOrNull(pemCertsFile.trustStore());
+                    }
                 }
                 if (o.containerMountStrategy().mountToContainer()) {
                     if (certLocation != null) {
@@ -217,11 +228,29 @@ private static Certificate.PemCertificate of(CertificateOptions o) {
         }
         configureManagementInterfaceProps(o, props, serverKeyStoreLocation);
         configureHttpServerProps(o, props);
+        configurePemConfigurationProperties(o, props, keyLocation, certLocation, serverTrustStoreLocation);
 
         return createCertificate(serverKeyStoreLocation, serverTrustStoreLocation, Map.copyOf(props),
                 List.copyOf(generatedClientCerts), keyLocation, certLocation, o);
     }
 
+    private static void configurePemConfigurationProperties(CertificateOptions options, Map<String, String> props,
+            String keyLocation, String certLocation, String serverTrustStoreLocation) {
+        if (options.format() == PEM) {
+            var keyStorePropertyPrefix = tlsConfigPropPrefix(options, "key-store");
+            if (keyLocation != null) {
+                props.put(keyStorePropertyPrefix + "pem-1.key", keyLocation);
+            }
+            if (certLocation != null) {
+                props.put(keyStorePropertyPrefix + "pem-1.cert", certLocation);
+            }
+            var trustStorePropertyPrefix = tlsConfigPropPrefix(options, "trust-store");
+            if (serverTrustStoreLocation != null) {
+                props.put(trustStorePropertyPrefix + "certs", serverTrustStoreLocation);
+            }
+        }
+    }
+
     private static void configureManagementInterfaceProps(CertificateOptions o, Map<String, String> props,
             String serverKeyStoreLocation) {
         if (o.configureManagementInterface()) {
@@ -259,9 +288,11 @@ private static void configureServerKeyStoreProps(CertificateOptions o, Map<Strin
             String serverKeyStoreLocation) {
         if (o.keystoreProps()) {
             if (o.tlsRegistryEnabled()) {
-                var propPrefix = tlsConfigPropPrefix(o, "key-store");
-                props.put(propPrefix + "path", serverKeyStoreLocation);
-                props.put(propPrefix + "password", o.password());
+                if (o.format() != PEM) {
+                    var propPrefix = tlsConfigPropPrefix(o, "key-store");
+                    props.put(propPrefix + "path", serverKeyStoreLocation);
+                    props.put(propPrefix + "password", o.password());
+                }
             } else {
                 props.put("quarkus.http.ssl.certificate.key-store-file", serverKeyStoreLocation);
                 props.put("quarkus.http.ssl.certificate.key-store-file-type", o.format().toString());
@@ -274,9 +305,11 @@ private static void configureServerTrustStoreProps(CertificateOptions o, Map<Str
             String serverTrustStoreLocation) {
         if (o.truststoreProps()) {
             if (o.tlsRegistryEnabled()) {
-                var propPrefix = tlsConfigPropPrefix(o, "trust-store");
-                props.put(propPrefix + "path", serverTrustStoreLocation);
-                props.put(propPrefix + "password", o.password());
+                if (o.format() != PEM) {
+                    var propPrefix = tlsConfigPropPrefix(o, "trust-store");
+                    props.put(propPrefix + "path", serverTrustStoreLocation);
+                    props.put(propPrefix + "password", o.password());
+                }
             } else {
                 props.put("quarkus.http.ssl.certificate.trust-store-file", serverTrustStoreLocation);
                 props.put("quarkus.http.ssl.certificate.trust-store-file-type", o.format().toString());

diff --git a/...s-test-core/src/main/java/io/quarkus/test/security/certificate/ClientCertificateImpl.java b/...s-test-core/src/main/java/io/quarkus/test/security/certificate/ClientCertificateImpl.java
@@ -1,4 +1,10 @@
 package io.quarkus.test.security.certificate;
 
-record ClientCertificateImpl(String commonName, String keystorePath, String truststorePath) implements ClientCertificate {
+record ClientCertificateImpl(String commonName, String keystorePath, String truststorePath, String keyPath,
+        String certPath) implements PemClientCertificate {
+
+    ClientCertificateImpl(String commonName, String keystorePath, String truststorePath) {
+        this(commonName, keystorePath, truststorePath, null, null);
+    }
+
 }
diff --git a/...us-test-core/src/main/java/io/quarkus/test/security/certificate/PemClientCertificate.java b/...us-test-core/src/main/java/io/quarkus/test/security/certificate/PemClientCertificate.java
@@ -0,0 +1,9 @@
+package io.quarkus.test.security.certificate;
+
+public interface PemClientCertificate extends ClientCertificate {
+
+    String keyPath();
+
+    String certPath();
+
+}
diff --git a/...ain/java/io/quarkus/test/services/quarkus/LocalhostQuarkusApplicationManagedResource.java b/...ain/java/io/quarkus/test/services/quarkus/LocalhostQuarkusApplicationManagedResource.java
@@ -22,6 +22,7 @@
 import io.quarkus.test.logging.Log;
 import io.quarkus.test.logging.LoggingHandler;
 import io.quarkus.test.services.URILike;
+import io.quarkus.test.services.quarkus.model.QuarkusProperties;
 import io.quarkus.test.utils.ProcessBuilderProvider;
 import io.quarkus.test.utils.ProcessUtils;
 import io.quarkus.test.utils.PropertiesUtils;
@@ -150,7 +151,11 @@ private void assignPorts() {
         }
 
         if (model.isGrpcEnabled()) {
-            assignedGrpcPort = getOrAssignPortByProperty(QUARKUS_GRPC_SERVER_PORT_PROPERTY);
+            if (QuarkusProperties.useSeparateGrpcServer(getContext())) {
+                assignedGrpcPort = getOrAssignPortByProperty(QUARKUS_GRPC_SERVER_PORT_PROPERTY);
+            } else {
+                assignedGrpcPort = assignedHttpPort;
+            }
         }
     }
 

diff --git a/...kus-test-core/src/main/java/io/quarkus/test/services/quarkus/model/QuarkusProperties.java b/...kus-test-core/src/main/java/io/quarkus/test/services/quarkus/model/QuarkusProperties.java
@@ -11,6 +11,8 @@
 
 public final class QuarkusProperties {
 
+    public static final PropertyLookup USE_SEPARATE_GRPC_SERVER = new PropertyLookup("quarkus.grpc.server.use-separate-server",
+            "true");
     public static final PropertyLookup PLATFORM_GROUP_ID = new PropertyLookup("quarkus.platform.group-id", "io.quarkus");
     public static final PropertyLookup PLATFORM_VERSION = new PropertyLookup("quarkus.platform.version");
     public static final PropertyLookup PLUGIN_VERSION = new PropertyLookup("quarkus-plugin.version");
@@ -60,6 +62,10 @@ public static boolean isJvmPackageType(ServiceContext context) {
         return !isNativeEnabled() && PACKAGE_TYPE_JVM_VALUES.contains(PACKAGE_TYPE.get(context));
     }
 
+    public static boolean useSeparateGrpcServer(ServiceContext context) {
+        return Boolean.parseBoolean(USE_SEPARATE_GRPC_SERVER.get(context));
+    }
+
     private static String defaultVersionIfEmpty(String version) {
         if (StringUtils.isEmpty(version)) {
             version = Version.getVersion();

diff --git a/quarkus-test-service-grpc/pom.xml b/quarkus-test-service-grpc/pom.xml
@@ -17,5 +17,9 @@
             <groupId>io.grpc</groupId>
             <artifactId>grpc-api</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.grpc</groupId>
+            <artifactId>grpc-netty</artifactId>
+        </dependency>
     </dependencies>
 </project>