test: trim connectivity test

Author: diegomarquezp

sdk-platform-java/pqc-test/pqc-test-common/src/main/java/com/google/api/gax/httpjson/PqcConnectivityTest.java

@@ -34,126 +34,24 @@
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.fail;
 
-import com.google.api.gax.core.NoCredentialsProvider;
 import io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder;
 import io.grpc.netty.shaded.io.netty.handler.ssl.ApplicationProtocolConfig;
 import io.grpc.netty.shaded.io.netty.handler.ssl.SslContext;
 import io.grpc.netty.shaded.io.netty.handler.ssl.SslContextBuilder;
-import io.grpc.netty.shaded.io.netty.handler.ssl.SslProvider;
 import io.grpc.netty.shaded.io.netty.handler.ssl.util.InsecureTrustManagerFactory;
 import java.io.InputStream;
 import java.security.KeyStore;
-import java.util.ArrayList;
-import java.util.List;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
-/**
- * PqcConnectivityTest serves as the base integration validation suite for confirming transparent,
- * zero-config Post-Quantum Cryptography (PQC) auto-upgrades across all Google Cloud Java SDK
- * transports.
- *
- * <h3>Design and Architectural Workflow</h3>
- *
- * <p>The validation framework operates via an end-to-end hermetic handshake architecture:
- *
- * <pre>
- *  +---------------------------------------+         +-----------------------------------------+
- *  |       Vanilla App Client Code         |         |         PqcTestServer (Enforces MLKEM768)|
- *  | (e.g. BigQueryOptions.getDefaultInst) |         +-----------------------------------------+
- *  +---------------------------------------+                              ^
- *                      |                                                  |
- *                      v                                                  |
- *  +---------------------------------------+                              |
- *  |       google-cloud-core-http          |                              |
- *  |      (DefaultHttpTransportFactory)     |                              |
- *  +---------------------------------------+                              |
- *                      |                                                  |
- *                      v                                                  |
- *  +---------------------------------------+                              |
- *  |       google-http-java-client         |                              |
- *  |   (SslUtils.getTlsSslContext() JJSSE) |                              |
- *  +---------------------------------------+                              |
- *                      |                                                  |
- *                      v                                                  |
- *  +---------------------------------------+                              |
- *  |     PqcDelegatingSSLSocketFactory     |                              |
- *  |  (Wraps default BCSSLSocketFactory)   |                              |
- *  +---------------------------------------+                              |
- *                      |                                                  |
- *                      +-----------------[TLSv1.3 MLKEM768 Hybrid Handshake]
- * </pre>
- *
- * <ul>
- *   <li><b>Auto-Upgrade Detection:</b> The test dynamically detects if the current classpath
- *       includes the snapshot version of <code>google-http-java-client</code> (which contains
- *       <code>PqcDelegatingSSLSocketFactory</code>).
- *   <li><b>Zero-Config Integration:</b> If supported, Bouncy Castle JSSE is promoted to the default
- *       security provider (position 1). The standard client generation libraries automatically wrap
- *       all outbound transport connections in post-quantum hybrid key exchanges (enforcing
- *       ML-KEM-768 and classical curves) without requiring manual transport option overrides.
- *   <li><b>Automatic Fallback:</b> In release test scopes (where older library builds lack PQC
- *       features), the test silently skips dynamic JCA promotion, validating that classical TLS 1.3
- *       paths remain fully robust and operational.
- * </ul>
- */
 public abstract class PqcConnectivityTest {
 
   private static Process serverProcess;
-  protected static int httpPqcPort;
-  protected static int httpClassicalPort;
   protected static int grpcPqcPort;
   protected static int grpcClassicalPort;
-  private static boolean isPqcSupported;
   private static KeyStore ks;
 
-  /**
-   * Configures the integration test harness environment before test cases are executed.
-   *
-   * <p><b>Harness Execution Flow:</b>
-   *
-   * <ol>
-   *   <li>Extracts the secure PKCS12 validation certificate (<code>pqctest.p12</code>) from the
-   *       classpath to a localized temp file to guarantee isolated execution.
-   *   <li>Configures JVM standard truststore system properties (<code>javax.net.ssl.trustStore
-   *       </code>) to point to the extracted certificate, enabling clean default SSLContext
-   *       verification.
-   *   <li>Inspects the runtime classpath to determine if PQC wrapper auto-upgrades are active.
-   *   <li>If PQC is supported, registers <code>BouncyCastleJsseProvider</code> at position 1. This
-   *       automatically causes all standard vanilla clients instantiating default <code>SSLContext
-   *       </code> to negotiate PQC.
-   *   <li>Spins up the hermetic <code>PqcTestServer</code> in a separate JVM process.
-   * </ol>
-   */
-  /**
-   * Configures the integration test harness environment before test cases are executed.
-   *
-   * <p><b>Detailed Security & Keystore Configuration Architecture:</b>
-   *
-   * <ul>
-   *   <li><b>What is a Keystore (PKCS12):</b> A PKCS12 keystore (<code>pqctest.p12</code>) is a
-   *       secure key database containing the server's private key and its self-signed public
-   *       certificate. The server uses it during the TLS handshake to prove its identity and
-   *       establish a secure channel.
-   *   <li><b>How Encryption Works:</b> The certificate itself does not encrypt message data
-   *       directly. Instead, during the TLS handshake, the client and server negotiate a symmetric
-   *       session key using post-quantum cryptography (ML-KEM). This session key is then used to
-   *       encrypt and decrypt all sent/received HTTP/gRPC data.
-   *   <li><b>Why a Custom Temporary Truststore is Required:</b> Because the server uses a
-   *       self-signed test certificate, it is not signed by any public Certificate Authority (CA)
-   *       trusted by the standard JRE truststore (<code>cacerts</code>). Without registering a
-   *       custom truststore containing this certificate, standard JRE TLS clients will reject the
-   *       connection with an <code>SSLHandshakeException</code>. We extract the certificate to a
-   *       temporary file and point <code>javax.net.ssl.trustStore</code> to it, thereby trusting it
-   *       scope-specifically for this test run without polluting or mutating the user's system-wide
-   *       JRE truststore.
-   *   <li><b>JCA Provider Registration:</b> Registers <code>BouncyCastleJsseProvider</code> at
-   *       provider position 1. This registers Bouncy Castle as the primary security provider,
-   *       causing all standard default <code>SSLContext</code> and vanilla client factories to
-   *       utilize Bouncy Castle JSSE and negotiate PQC automatically.
-   * </ul>
-   */
   protected boolean clientSupportsPqc() {
     return true;
   }
@@ -163,16 +61,6 @@ protected boolean clientSupportsPqc() {
   @BeforeAll
   public static void setup() throws Exception {
 
-    // Dynamically detect if PQC auto-upgrade wrapping is supported by current
-    // classpath
-    // dependencies (Snapshot vs Release)
-    try {
-      Class.forName("com.google.api.client.http.javanet.PqcPeerHostSSLSocketFactory");
-      isPqcSupported = true;
-    } catch (ClassNotFoundException e) {
-      isPqcSupported = false;
-    }
-
     ks = KeyStore.getInstance("PKCS12");
     try (InputStream is = PqcConnectivityTest.class.getResourceAsStream("/pqctest.p12")) {
       if (is == null) {
@@ -201,30 +89,22 @@ public static void setup() throws Exception {
                 serverProcess.getInputStream(), java.nio.charset.StandardCharsets.UTF_8));
 
     String line;
-    boolean httpPqcFound = false;
-    boolean httpClassicalFound = false;
     boolean grpcPqcFound = false;
     boolean grpcClassicalFound = false;
 
     // Wait for the server process to output its HTTP and gRPC ports
     long startTime = System.currentTimeMillis();
     while ((line = reader.readLine()) != null) {
       System.out.println("[SERVER-OUT] " + line);
-      if (line.startsWith("HTTP_PQC_PORT: ")) {
-        httpPqcPort = Integer.parseInt(line.substring(15).trim());
-        httpPqcFound = true;
-      } else if (line.startsWith("HTTP_CLASSICAL_PORT: ")) {
-        httpClassicalPort = Integer.parseInt(line.substring(21).trim());
-        httpClassicalFound = true;
-      } else if (line.startsWith("GRPC_PQC_PORT: ")) {
+      if (line.startsWith("GRPC_PQC_PORT: ")) {
         grpcPqcPort = Integer.parseInt(line.substring(15).trim());
         grpcPqcFound = true;
       } else if (line.startsWith("GRPC_CLASSICAL_PORT: ")) {
         grpcClassicalPort = Integer.parseInt(line.substring(21).trim());
         grpcClassicalFound = true;
       }
 
-      if (httpPqcFound && httpClassicalFound && grpcPqcFound && grpcClassicalFound) {
+      if (grpcPqcFound && grpcClassicalFound) {
         break;
       }
 
@@ -236,7 +116,7 @@ public static void setup() throws Exception {
       }
     }
 
-    if (!httpPqcFound || !httpClassicalFound || !grpcPqcFound || !grpcClassicalFound) {
+    if (!grpcPqcFound || !grpcClassicalFound) {
       throw new RuntimeException("PqcTestServer failed to initialize ephemeral ports!");
     }
 
@@ -315,69 +195,6 @@ public void testGrpcClassicalServer() throws Exception {
     runGrpcTest(grpcClassicalPort, true);
   }
 
-
-  private static void configureGrpcChannelForPqc(io.grpc.ManagedChannelBuilder<?> builder) {
-    if (!(builder instanceof NettyChannelBuilder)) {
-      throw new IllegalArgumentException(
-          "Unsupported channel builder type: " + builder.getClass().getName());
-    }
-    NettyChannelBuilder nettyBuilder = (NettyChannelBuilder) builder;
-
-    // Ensures HTTP/2 is used as it's required by gRPC
-    ApplicationProtocolConfig apn =
-        new ApplicationProtocolConfig(
-            ApplicationProtocolConfig.Protocol.ALPN,
-            ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
-            ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
-            "h2");
-
-    try {
-      java.security.Provider bcProvider = new org.bouncycastle.jce.provider.BouncyCastleProvider();
-      java.security.Provider bcJsseProvider =
-          new org.bouncycastle.jsse.provider.BouncyCastleJsseProvider(bcProvider);
-
-      SslContext shadedSslContext =
-          SslContextBuilder.forClient()
-              .sslProvider(SslProvider.JDK)
-              .sslContextProvider(bcJsseProvider)
-              .protocols("TLSv1.3")
-              .applicationProtocolConfig(apn)
-              .trustManager(InsecureTrustManagerFactory.INSTANCE)
-              .build();
-
-      nettyBuilder.sslContext(shadedSslContext);
-    } catch (Exception e) {
-      throw new RuntimeException("Failed to configure shaded gRPC Netty channel for PQC", e);
-    }
-  }
-
-  private static void configureGrpcChannelForClassical(io.grpc.ManagedChannelBuilder<?> builder) {
-    if (!(builder instanceof NettyChannelBuilder)) {
-      throw new IllegalArgumentException(
-          "Unsupported channel builder type: " + builder.getClass().getName());
-    }
-    NettyChannelBuilder nettyBuilder = (NettyChannelBuilder) builder;
-
-    ApplicationProtocolConfig apn =
-        new ApplicationProtocolConfig(
-            ApplicationProtocolConfig.Protocol.ALPN,
-            ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
-            ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
-            "h2");
-
-    try {
-      SslContext shadedSslContext =
-          SslContextBuilder.forClient()
-              .applicationProtocolConfig(apn)
-              .trustManager(InsecureTrustManagerFactory.INSTANCE)
-              .build();
-
-      nettyBuilder.sslContext(shadedSslContext);
-    } catch (Exception e) {
-      throw new RuntimeException("Failed to configure shaded gRPC Netty channel for Classical", e);
-    }
-  }
-
   private static class ByteMarshaller implements io.grpc.MethodDescriptor.Marshaller<byte[]> {
     @Override
     public InputStream stream(byte[] value) {