Skip to content

Commit 51f748a

Browse files
ejona86ejona86
committed
xds: Enable deprecation warnings
The security code referenced fields removed from gRFC A29 before it was finalized.
1 parent c8d1e6e commit 51f748a

9 files changed

Lines changed: 29 additions & 53 deletions

File tree

‎xds/build.gradle‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -133,8 +133,6 @@ tasks.named("checkstyleThirdparty").configure {
133133

134134
tasks.named("compileJava").configure {
135135
it.options.compilerArgs += [
136-
// TODO: remove
137-
"-Xlint:-deprecation",
138136
// only has AutoValue annotation processor
139137
"-Xlint:-processing",
140138
]

‎xds/src/main/java/io/grpc/xds/LazyLoadBalancer.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,7 @@ public PickResult pickSubchannel(PickSubchannelArgs args) {
108108
return PickResult.withNoResult();
109109
}
110110

111+
@Deprecated
111112
@Override
112113
public void requestConnection() {
113114
helper.getSynchronizationContext().execute(LazyDelegate.this::requestConnection);

‎xds/src/main/java/io/grpc/xds/RbacFilter.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -276,8 +276,13 @@ private static Matcher parsePrincipal(Principal principal) {
276276
return createSourceIpMatcher(principal.getDirectRemoteIp());
277277
case REMOTE_IP:
278278
return createSourceIpMatcher(principal.getRemoteIp());
279-
case SOURCE_IP:
280-
return createSourceIpMatcher(principal.getSourceIp());
279+
case SOURCE_IP: {
280+
// gRFC A41 has identical handling of source_ip as remote_ip and direct_remote_ip and
281+
// pre-dates the deprecation.
282+
@SuppressWarnings("deprecation")
283+
CidrRange sourceIp = principal.getSourceIp();
284+
return createSourceIpMatcher(sourceIp);
285+
}
281286
case HEADER:
282287
return parseHeaderMatcher(principal.getHeader());
283288
case NOT_ID:

‎xds/src/main/java/io/grpc/xds/XdsClusterResource.java‎

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -450,15 +450,6 @@ static void validateCommonTlsContext(
450450
throw new ResourceInvalidException(
451451
"common-tls-context with validation_context_sds_secret_config is not supported");
452452
}
453-
if (commonTlsContext.hasValidationContextCertificateProvider()) {
454-
throw new ResourceInvalidException(
455-
"common-tls-context with validation_context_certificate_provider is not supported");
456-
}
457-
if (commonTlsContext.hasValidationContextCertificateProviderInstance()) {
458-
throw new ResourceInvalidException(
459-
"common-tls-context with validation_context_certificate_provider_instance is not"
460-
+ " supported");
461-
}
462453
String certInstanceName = getIdentityCertInstanceName(commonTlsContext);
463454
if (certInstanceName == null) {
464455
if (server) {
@@ -473,10 +464,6 @@ static void validateCommonTlsContext(
473464
throw new ResourceInvalidException(
474465
"tls_certificate_provider_instance is unset");
475466
}
476-
if (commonTlsContext.hasTlsCertificateCertificateProvider()) {
477-
throw new ResourceInvalidException(
478-
"tls_certificate_provider_instance is unset");
479-
}
480467
} else if (certProviderInstances == null || !certProviderInstances.contains(certInstanceName)) {
481468
throw new ResourceInvalidException(
482469
"CertificateProvider instance name '" + certInstanceName
@@ -505,7 +492,9 @@ static void validateCommonTlsContext(
505492
.getDefaultValidationContext();
506493
}
507494
if (certificateValidationContext != null) {
508-
if (certificateValidationContext.getMatchSubjectAltNamesCount() > 0 && server) {
495+
@SuppressWarnings("deprecation") // gRFC A29 predates match_typed_subject_alt_names
496+
int matchSubjectAltNamesCount = certificateValidationContext.getMatchSubjectAltNamesCount();
497+
if (matchSubjectAltNamesCount > 0 && server) {
509498
throw new ResourceInvalidException(
510499
"match_subject_alt_names only allowed in upstream_tls_context");
511500
}
@@ -536,8 +525,6 @@ static void validateCommonTlsContext(
536525
private static String getIdentityCertInstanceName(CommonTlsContext commonTlsContext) {
537526
if (commonTlsContext.hasTlsCertificateProviderInstance()) {
538527
return commonTlsContext.getTlsCertificateProviderInstance().getInstanceName();
539-
} else if (commonTlsContext.hasTlsCertificateCertificateProviderInstance()) {
540-
return commonTlsContext.getTlsCertificateCertificateProviderInstance().getInstanceName();
541528
}
542529
return null;
543530
}
@@ -556,10 +543,6 @@ private static String getRootCertInstanceName(CommonTlsContext commonTlsContext)
556543
.hasCaCertificateProviderInstance()) {
557544
return combinedCertificateValidationContext.getDefaultValidationContext()
558545
.getCaCertificateProviderInstance().getInstanceName();
559-
} else if (combinedCertificateValidationContext
560-
.hasValidationContextCertificateProviderInstance()) {
561-
return combinedCertificateValidationContext
562-
.getValidationContextCertificateProviderInstance().getInstanceName();
563546
}
564547
}
565548
return null;

‎xds/src/main/java/io/grpc/xds/XdsRouteConfigureResource.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -451,8 +451,7 @@ static StructOrError<RouteAction> parseRouteAction(
451451
config.getHeader();
452452
Pattern regEx = null;
453453
String regExSubstitute = null;
454-
if (headerCfg.hasRegexRewrite() && headerCfg.getRegexRewrite().hasPattern()
455-
&& headerCfg.getRegexRewrite().getPattern().hasGoogleRe2()) {
454+
if (headerCfg.hasRegexRewrite() && headerCfg.getRegexRewrite().hasPattern()) {
456455
regEx = Pattern.compile(headerCfg.getRegexRewrite().getPattern().getRegex());
457456
regExSubstitute = headerCfg.getRegexRewrite().getSubstitution();
458457
}

‎xds/src/main/java/io/grpc/xds/internal/MatcherParser.java‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,12 @@ public static Matchers.HeaderMatcher parseHeaderMatcher(
2626
io.envoyproxy.envoy.config.route.v3.HeaderMatcher proto) {
2727
switch (proto.getHeaderMatchSpecifierCase()) {
2828
case EXACT_MATCH:
29+
@SuppressWarnings("deprecation") // gRFC A63: support indefinitely
30+
String exactMatch = proto.getExactMatch();
2931
return Matchers.HeaderMatcher.forExactValue(
30-
proto.getName(), proto.getExactMatch(), proto.getInvertMatch());
32+
proto.getName(), exactMatch, proto.getInvertMatch());
3133
case SAFE_REGEX_MATCH:
34+
@SuppressWarnings("deprecation") // gRFC A63: support indefinitely
3235
String rawPattern = proto.getSafeRegexMatch().getRegex();
3336
Pattern safeRegExMatch;
3437
try {
@@ -49,14 +52,20 @@ public static Matchers.HeaderMatcher parseHeaderMatcher(
4952
return Matchers.HeaderMatcher.forPresent(
5053
proto.getName(), proto.getPresentMatch(), proto.getInvertMatch());
5154
case PREFIX_MATCH:
55+
@SuppressWarnings("deprecation") // gRFC A63: support indefinitely
56+
String prefixMatch = proto.getPrefixMatch();
5257
return Matchers.HeaderMatcher.forPrefix(
53-
proto.getName(), proto.getPrefixMatch(), proto.getInvertMatch());
58+
proto.getName(), prefixMatch, proto.getInvertMatch());
5459
case SUFFIX_MATCH:
60+
@SuppressWarnings("deprecation") // gRFC A63: support indefinitely
61+
String suffixMatch = proto.getSuffixMatch();
5562
return Matchers.HeaderMatcher.forSuffix(
56-
proto.getName(), proto.getSuffixMatch(), proto.getInvertMatch());
63+
proto.getName(), suffixMatch, proto.getInvertMatch());
5764
case CONTAINS_MATCH:
65+
@SuppressWarnings("deprecation") // gRFC A63: support indefinitely
66+
String containsMatch = proto.getContainsMatch();
5867
return Matchers.HeaderMatcher.forContains(
59-
proto.getName(), proto.getContainsMatch(), proto.getInvertMatch());
68+
proto.getName(), containsMatch, proto.getInvertMatch());
6069
case STRING_MATCH:
6170
return Matchers.HeaderMatcher.forString(
6271
proto.getName(), parseStringMatcher(proto.getStringMatch()), proto.getInvertMatch());

‎xds/src/main/java/io/grpc/xds/internal/security/CommonTlsContextUtil.java‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -34,25 +34,16 @@ public static boolean hasCertProviderInstance(CommonTlsContext commonTlsContext)
3434
}
3535

3636
private static boolean hasCertProviderValidationContext(CommonTlsContext commonTlsContext) {
37-
if (commonTlsContext.hasCombinedValidationContext()) {
38-
CombinedCertificateValidationContext combinedCertificateValidationContext =
39-
commonTlsContext.getCombinedValidationContext();
40-
return combinedCertificateValidationContext.hasValidationContextCertificateProviderInstance();
41-
}
4237
return hasValidationProviderInstance(commonTlsContext);
4338
}
4439

4540
private static boolean hasIdentityCertificateProviderInstance(CommonTlsContext commonTlsContext) {
46-
return commonTlsContext.hasTlsCertificateProviderInstance()
47-
|| commonTlsContext.hasTlsCertificateCertificateProviderInstance();
41+
return commonTlsContext.hasTlsCertificateProviderInstance();
4842
}
4943

5044
private static boolean hasValidationProviderInstance(CommonTlsContext commonTlsContext) {
51-
if (commonTlsContext.hasValidationContext() && commonTlsContext.getValidationContext()
52-
.hasCaCertificateProviderInstance()) {
53-
return true;
54-
}
55-
return commonTlsContext.hasValidationContextCertificateProviderInstance();
45+
return commonTlsContext.hasValidationContext() && commonTlsContext.getValidationContext()
46+
.hasCaCertificateProviderInstance();
5647
}
5748

5849
/**

‎xds/src/main/java/io/grpc/xds/internal/security/certprovider/CertProviderSslContextProvider.java‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -99,8 +99,6 @@ protected static CertificateProviderInstance getCertProviderInstance(
9999
CommonTlsContext commonTlsContext) {
100100
if (commonTlsContext.hasTlsCertificateProviderInstance()) {
101101
return CommonTlsContextUtil.convert(commonTlsContext.getTlsCertificateProviderInstance());
102-
} else if (commonTlsContext.hasTlsCertificateCertificateProviderInstance()) {
103-
return commonTlsContext.getTlsCertificateCertificateProviderInstance();
104102
}
105103
return null;
106104
}
@@ -128,15 +126,6 @@ protected static CommonTlsContext.CertificateProviderInstance getRootCertProvide
128126
if (certValidationContext != null && certValidationContext.hasCaCertificateProviderInstance()) {
129127
return CommonTlsContextUtil.convert(certValidationContext.getCaCertificateProviderInstance());
130128
}
131-
if (commonTlsContext.hasCombinedValidationContext()) {
132-
CommonTlsContext.CombinedCertificateValidationContext combinedValidationContext =
133-
commonTlsContext.getCombinedValidationContext();
134-
if (combinedValidationContext.hasValidationContextCertificateProviderInstance()) {
135-
return combinedValidationContext.getValidationContextCertificateProviderInstance();
136-
}
137-
} else if (commonTlsContext.hasValidationContextCertificateProviderInstance()) {
138-
return commonTlsContext.getValidationContextCertificateProviderInstance();
139-
}
140129
return null;
141130
}
142131

‎xds/src/main/java/io/grpc/xds/internal/security/trust/XdsX509TrustManager.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,7 @@ void verifySubjectAltNameInChain(X509Certificate[] peerCertChain) throws Certifi
207207
if (certContext == null) {
208208
return;
209209
}
210+
@SuppressWarnings("deprecation") // gRFC A29 predates match_typed_subject_alt_names
210211
List<StringMatcher> verifyList = certContext.getMatchSubjectAltNamesList();
211212
if (verifyList.isEmpty()) {
212213
return;

0 commit comments

Comments
 (0)