refactor some ssl code

Change-Id: I4dc033f55c300324389c57ed39c6ce30af3b657a
Signed-off-by: Kuat Yessenov <[email protected]>

contrib/cryptomb/private_key_providers/source/config.cc

@@ -26,7 +26,7 @@ namespace CryptoMb {
 Ssl::PrivateKeyMethodProviderSharedPtr
 CryptoMbPrivateKeyMethodFactory::createPrivateKeyMethodProviderInstance(
     const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& proto_config,
-    Server::Configuration::TransportSocketFactoryContext& private_key_provider_context) {
+    Server::Configuration::ServerFactoryContext& private_key_provider_context) {
   ProtobufTypes::MessagePtr message =
       std::make_unique<envoy::extensions::private_key_providers::cryptomb::v3alpha::
                            CryptoMbPrivateKeyMethodConfig>();

contrib/cryptomb/private_key_providers/source/config.h

@@ -15,7 +15,7 @@ class CryptoMbPrivateKeyMethodFactory : public Ssl::PrivateKeyMethodProviderInst
   // Ssl::PrivateKeyMethodProviderInstanceFactory
   Ssl::PrivateKeyMethodProviderSharedPtr createPrivateKeyMethodProviderInstance(
       const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& message,
-      Server::Configuration::TransportSocketFactoryContext& private_key_provider_context) override;
+      Server::Configuration::ServerFactoryContext& private_key_provider_context) override;
   std::string name() const override { return "cryptomb"; };
 };
 

contrib/cryptomb/private_key_providers/source/cryptomb_private_key_provider.cc

@@ -681,11 +681,10 @@ void CryptoMbPrivateKeyMethodProvider::unregisterPrivateKeyMethod(SSL* ssl) {
 CryptoMbPrivateKeyMethodProvider::CryptoMbPrivateKeyMethodProvider(
     const envoy::extensions::private_key_providers::cryptomb::v3alpha::
         CryptoMbPrivateKeyMethodConfig& conf,
-    Server::Configuration::TransportSocketFactoryContext& factory_context, IppCryptoSharedPtr ipp)
-    : api_(factory_context.serverFactoryContext().api()),
-      tls_(ThreadLocal::TypedSlot<ThreadLocalData>::makeUnique(
-          factory_context.serverFactoryContext().threadLocal())),
-      stats_(generateCryptoMbStats("cryptomb", factory_context.statsScope())) {
+    Server::Configuration::ServerFactoryContext& factory_context, IppCryptoSharedPtr ipp)
+    : api_(factory_context.api()),
+      tls_(ThreadLocal::TypedSlot<ThreadLocalData>::makeUnique(factory_context.threadLocal())),
+      stats_(generateCryptoMbStats("cryptomb", factory_context.scope())) {
 
   if (!ipp->mbxIsCryptoMbApplicable(0)) {
     ENVOY_LOG(warn, "Multi-buffer CPU instructions not available.");

contrib/cryptomb/private_key_providers/source/cryptomb_private_key_provider.h

@@ -185,7 +185,7 @@ class CryptoMbPrivateKeyMethodProvider : public virtual Ssl::PrivateKeyMethodPro
   CryptoMbPrivateKeyMethodProvider(
       const envoy::extensions::private_key_providers::cryptomb::v3alpha::
           CryptoMbPrivateKeyMethodConfig& config,
-      Server::Configuration::TransportSocketFactoryContext& private_key_provider_context,
+      Server::Configuration::ServerFactoryContext& private_key_provider_context,
       IppCryptoSharedPtr ipp);
 
   // Ssl::PrivateKeyMethodProvider

contrib/cryptomb/private_key_providers/test/config_test.cc

@@ -37,7 +37,12 @@ class CryptoMbConfigTest : public Event::TestUsingSimulatedTime, public testing:
   CryptoMbConfigTest() : api_(Api::createApiForTest(store_, time_system_)) {
     ON_CALL(factory_context_.server_context_, api()).WillByDefault(ReturnRef(*api_));
     ON_CALL(factory_context_.server_context_, threadLocal()).WillByDefault(ReturnRef(tls_));
-    ON_CALL(factory_context_, sslContextManager()).WillByDefault(ReturnRef(context_manager_));
+    ON_CALL(factory_context_.server_context_, sslContextManager())
+        .WillByDefault(ReturnRef(context_manager_));
+    ON_CALL(factory_context_.server_context_, messageValidationVisitor())
+        .WillByDefault(ReturnRef(ProtobufMessage::getStrictValidationVisitor()));
+    ON_CALL(factory_context_.server_context_, scope())
+        .WillByDefault(ReturnRef(*store_.rootScope()));
     ON_CALL(context_manager_, privateKeyMethodManager())
         .WillByDefault(ReturnRef(private_key_method_manager_));
   }
@@ -48,9 +53,10 @@ class CryptoMbConfigTest : public Event::TestUsingSimulatedTime, public testing:
     Registry::InjectFactory<Ssl::PrivateKeyMethodProviderInstanceFactory>
         cryptomb_private_key_method_factory(cryptomb_factory);
 
-    return factory_context_.sslContextManager()
+    return factory_context_.server_context_.sslContextManager()
         .privateKeyMethodManager()
-        .createPrivateKeyMethodProvider(parsePrivateKeyProviderFromV3Yaml(yaml), factory_context_);
+        .createPrivateKeyMethodProvider(parsePrivateKeyProviderFromV3Yaml(yaml),
+                                        factory_context_.server_context_);
   }
 
   Event::SimulatedTimeSystem time_system_;

contrib/cryptomb/private_key_providers/test/fake_factory.cc

@@ -151,7 +151,7 @@ FakeCryptoMbPrivateKeyMethodFactory::FakeCryptoMbPrivateKeyMethodFactory(
 Ssl::PrivateKeyMethodProviderSharedPtr
 FakeCryptoMbPrivateKeyMethodFactory::createPrivateKeyMethodProviderInstance(
     const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& proto_config,
-    Server::Configuration::TransportSocketFactoryContext& private_key_provider_context) {
+    Server::Configuration::ServerFactoryContext& private_key_provider_context) {
   ProtobufTypes::MessagePtr message =
       std::make_unique<envoy::extensions::private_key_providers::cryptomb::v3alpha::
                            CryptoMbPrivateKeyMethodConfig>();
@@ -169,8 +169,7 @@ FakeCryptoMbPrivateKeyMethodFactory::createPrivateKeyMethodProviderInstance(
 
   // We need to get more RSA key params in order to be able to use BoringSSL signing functions.
   std::string private_key = THROW_OR_RETURN_VALUE(
-      Config::DataSource::read(conf.private_key(), false,
-                               private_key_provider_context.serverFactoryContext().api()),
+      Config::DataSource::read(conf.private_key(), false, private_key_provider_context.api()),
       std::string);
 
   bssl::UniquePtr<BIO> bio(

contrib/cryptomb/private_key_providers/test/fake_factory.h

@@ -51,7 +51,7 @@ class FakeCryptoMbPrivateKeyMethodFactory : public Ssl::PrivateKeyMethodProvider
   // Ssl::PrivateKeyMethodProviderInstanceFactory
   Ssl::PrivateKeyMethodProviderSharedPtr createPrivateKeyMethodProviderInstance(
       const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& message,
-      Server::Configuration::TransportSocketFactoryContext& private_key_provider_context) override;
+      Server::Configuration::ServerFactoryContext& private_key_provider_context) override;
   std::string name() const override { return "cryptomb"; };
 
 private:

contrib/qat/private_key_providers/source/config.cc

@@ -25,7 +25,7 @@ namespace Qat {
 Ssl::PrivateKeyMethodProviderSharedPtr
 QatPrivateKeyMethodFactory::createPrivateKeyMethodProviderInstance(
     const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& proto_config,
-    Server::Configuration::TransportSocketFactoryContext& private_key_provider_context) {
+    Server::Configuration::ServerFactoryContext& private_key_provider_context) {
   ProtobufTypes::MessagePtr message = std::make_unique<
       envoy::extensions::private_key_providers::qat::v3alpha::QatPrivateKeyMethodConfig>();
 

contrib/qat/private_key_providers/source/config.h

@@ -17,7 +17,7 @@ class QatPrivateKeyMethodFactory : public Ssl::PrivateKeyMethodProviderInstanceF
   // Ssl::PrivateKeyMethodProviderInstanceFactory
   Ssl::PrivateKeyMethodProviderSharedPtr createPrivateKeyMethodProviderInstance(
       const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& message,
-      Server::Configuration::TransportSocketFactoryContext& private_key_provider_context) override;
+      Server::Configuration::ServerFactoryContext& private_key_provider_context) override;
 
 public:
   std::string name() const override { return "qat"; };

contrib/qat/private_key_providers/source/qat_private_key_provider.cc

@@ -347,11 +347,10 @@ void QatPrivateKeyMethodProvider::unregisterPrivateKeyMethod(SSL* ssl) {
 
 QatPrivateKeyMethodProvider::QatPrivateKeyMethodProvider(
     const envoy::extensions::private_key_providers::qat::v3alpha::QatPrivateKeyMethodConfig& conf,
-    Server::Configuration::TransportSocketFactoryContext& factory_context,
-    LibQatCryptoSharedPtr libqat)
-    : api_(factory_context.serverFactoryContext().api()), libqat_(libqat) {
+    Server::Configuration::ServerFactoryContext& factory_context, LibQatCryptoSharedPtr libqat)
+    : api_(factory_context.api()), libqat_(libqat) {
 
-  manager_ = factory_context.serverFactoryContext().singletonManager().getTyped<QatManager>(
+  manager_ = factory_context.singletonManager().getTyped<QatManager>(
       SINGLETON_MANAGER_REGISTERED_NAME(qat_manager),
       [libqat] { return std::make_shared<QatManager>(libqat); });
 

contrib/qat/private_key_providers/source/qat_private_key_provider.h

@@ -40,7 +40,7 @@ class QatPrivateKeyMethodProvider : public virtual Ssl::PrivateKeyMethodProvider
   QatPrivateKeyMethodProvider(
       const envoy::extensions::private_key_providers::qat::v3alpha::QatPrivateKeyMethodConfig&
           config,
-      Server::Configuration::TransportSocketFactoryContext& private_key_provider_context,
+      Server::Configuration::ServerFactoryContext& private_key_provider_context,
       LibQatCryptoSharedPtr libqat);
   // Ssl::PrivateKeyMethodProvider
   void registerPrivateKeyMethod(SSL* ssl, Ssl::PrivateKeyConnectionCallbacks& cb,

contrib/qat/private_key_providers/test/config_test.cc

@@ -50,7 +50,10 @@ class QatConfigTest : public Event::TestUsingSimulatedTime, public testing::Test
       : api_(Api::createApiForTest(store_, time_system_)),
         libqat_(std::make_shared<FakeLibQatCryptoImpl>()), fsm_(libqat_) {
     ON_CALL(factory_context_.server_context_, api()).WillByDefault(ReturnRef(*api_));
-    ON_CALL(factory_context_, sslContextManager()).WillByDefault(ReturnRef(context_manager_));
+    ON_CALL(factory_context_.server_context_, sslContextManager())
+        .WillByDefault(ReturnRef(context_manager_));
+    ON_CALL(factory_context_.server_context_, messageValidationVisitor())
+        .WillByDefault(ReturnRef(ProtobufMessage::getStrictValidationVisitor()));
     ON_CALL(context_manager_, privateKeyMethodManager())
         .WillByDefault(ReturnRef(private_key_method_manager_));
     ON_CALL(factory_context_.server_context_, singletonManager()).WillByDefault(ReturnRef(fsm_));
@@ -61,9 +64,10 @@ class QatConfigTest : public Event::TestUsingSimulatedTime, public testing::Test
     Registry::InjectFactory<Ssl::PrivateKeyMethodProviderInstanceFactory>
         qat_private_key_method_factory(qat_factory);
 
-    return factory_context_.sslContextManager()
+    return factory_context_.server_context_.sslContextManager()
         .privateKeyMethodManager()
-        .createPrivateKeyMethodProvider(parsePrivateKeyProviderFromV3Yaml(yaml), factory_context_);
+        .createPrivateKeyMethodProvider(parsePrivateKeyProviderFromV3Yaml(yaml),
+                                        factory_context_.server_context_);
   }
 
   Event::SimulatedTimeSystem time_system_;

contrib/qat/private_key_providers/test/fake_factory.cc

@@ -154,7 +154,7 @@ CpaStatus FakeLibQatCryptoImpl::cpaCyStopInstance(CpaInstanceHandle instance_han
 Ssl::PrivateKeyMethodProviderSharedPtr
 FakeQatPrivateKeyMethodFactory::createPrivateKeyMethodProviderInstance(
     const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& proto_config,
-    Server::Configuration::TransportSocketFactoryContext& private_key_provider_context) {
+    Server::Configuration::ServerFactoryContext& private_key_provider_context) {
   ProtobufTypes::MessagePtr message = std::make_unique<
       envoy::extensions::private_key_providers::qat::v3alpha::QatPrivateKeyMethodConfig>();
 

contrib/qat/private_key_providers/test/fake_factory.h

@@ -78,7 +78,7 @@ class FakeQatPrivateKeyMethodFactory : public Ssl::PrivateKeyMethodProviderInsta
   // Ssl::PrivateKeyMethodProviderInstanceFactory
   Ssl::PrivateKeyMethodProviderSharedPtr createPrivateKeyMethodProviderInstance(
       const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& message,
-      Server::Configuration::TransportSocketFactoryContext& private_key_provider_context) override;
+      Server::Configuration::ServerFactoryContext& private_key_provider_context) override;
   std::string name() const override { return "qat"; };
 };
 

contrib/qat/private_key_providers/test/ops_test.cc

@@ -251,8 +251,8 @@ TEST_F(QatProviderRsaTest, TestQatDeviceInit) {
 
   // no device found
   libqat_->icpSalUserStart_return_value_ = CPA_STATUS_FAIL;
-  Ssl::PrivateKeyMethodProviderSharedPtr provider =
-      std::make_shared<QatPrivateKeyMethodProvider>(conf, factory_context_, libqat_);
+  Ssl::PrivateKeyMethodProviderSharedPtr provider = std::make_shared<QatPrivateKeyMethodProvider>(
+      conf, factory_context_.server_context_, libqat_);
   EXPECT_EQ(provider->isAvailable(), false);
   delete private_key;
 }

envoy/server/factory_context.h

@@ -145,6 +145,11 @@ class CommonFactoryContext {
    * @return the server regex engine.
    */
   virtual Regex::Engine& regexEngine() PURE;
+
+  /**
+   * @return Ssl::ContextManager& the SSL context manager.
+   */
+  virtual Ssl::ContextManager& sslContextManager() PURE;
 };
 
 /**

envoy/server/transport_socket_config.h

@@ -48,11 +48,6 @@ class TransportSocketFactoryContext {
    */
   virtual ProtobufMessage::ValidationVisitor& messageValidationVisitor() PURE;
 
-  /**
-   * @return Ssl::ContextManager& the SSL context manager.
-   */
-  virtual Ssl::ContextManager& sslContextManager() PURE;
-
   /**
    * @return Stats::Scope& the transport socket's stats scope.
    */

envoy/ssl/private_key/BUILD

@@ -26,6 +26,7 @@ envoy_cc_library(
         ":private_key_interface",
         "//envoy/config:typed_config_interface",
         "//envoy/registry",
+        "//envoy/server:factory_context_interface",
         "@envoy_api//envoy/extensions/transport_sockets/tls/v3:pkg_cc_proto",
     ],
 )

envoy/ssl/private_key/private_key.h

@@ -14,7 +14,7 @@ namespace Envoy {
 namespace Server {
 namespace Configuration {
 // Prevent a dependency loop with the forward declaration.
-class TransportSocketFactoryContext;
+class ServerFactoryContext;
 } // namespace Configuration
 } // namespace Server
 
@@ -88,7 +88,7 @@ class PrivateKeyMethodManager {
    */
   virtual PrivateKeyMethodProviderSharedPtr createPrivateKeyMethodProvider(
       const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& config,
-      Envoy::Server::Configuration::TransportSocketFactoryContext& factory_context) PURE;
+      Envoy::Server::Configuration::ServerFactoryContext& factory_context) PURE;
 };
 
 } // namespace Ssl

envoy/ssl/private_key/private_key_config.h

@@ -3,6 +3,7 @@
 #include "envoy/config/typed_config.h"
 #include "envoy/extensions/transport_sockets/tls/v3/cert.pb.h"
 #include "envoy/registry/registry.h"
+#include "envoy/server/factory_context.h"
 #include "envoy/ssl/private_key/private_key.h"
 
 namespace Envoy {
@@ -19,11 +20,11 @@ class PrivateKeyMethodProviderInstanceFactory : public Config::UntypedFactory {
    * unable to produce a PrivateKeyMethodProvider with the provided parameters, it should throw
    * an EnvoyException. The returned pointer should always be valid.
    * @param config supplies the custom proto configuration for the PrivateKeyMethodProvider
-   * @param context supplies the factory context
+   * @param context supplies the server factory context
    */
   virtual PrivateKeyMethodProviderSharedPtr createPrivateKeyMethodProviderInstance(
       const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& config,
-      Server::Configuration::TransportSocketFactoryContext& factory_context) PURE;
+      Server::Configuration::ServerFactoryContext& factory_context) PURE;
 
   std::string category() const override { return "envoy.tls.key_providers"; };
 };

source/common/listener_manager/listener_impl.cc

@@ -335,8 +335,8 @@ ListenerImpl::ListenerImpl(const envoy::config::listener::v3::Listener& config,
                           }),
       transport_factory_context_(
           std::make_shared<Server::Configuration::TransportSocketFactoryContextImpl>(
-              parent_.server_.serverFactoryContext(), parent_.server_.sslContextManager(),
-              listenerScope(), parent_.server_.clusterManager(), validation_visitor_)),
+              parent_.server_.serverFactoryContext(), listenerScope(),
+              parent_.server_.clusterManager(), validation_visitor_)),
       quic_stat_names_(parent_.quicStatNames()),
       missing_listener_config_stats_({ALL_MISSING_LISTENER_CONFIG_STATS(
           POOL_COUNTER(listener_factory_context_->listenerScope()))}) {

source/common/quic/quic_client_transport_socket_factory.cc

@@ -47,7 +47,8 @@ QuicClientTransportSocketFactory::QuicClientTransportSocketFactory(
     : QuicTransportSocketFactoryBase(factory_context.statsScope(), "client"),
       tls_slot_(factory_context.serverFactoryContext().threadLocal()) {
   auto factory_or_error = Extensions::TransportSockets::Tls::ClientSslSocketFactory::create(
-      std::move(config), factory_context.sslContextManager(), factory_context.statsScope());
+      std::move(config), factory_context.serverFactoryContext().sslContextManager(),
+      factory_context.statsScope());
   SET_AND_RETURN_IF_NOT_OK(factory_or_error.status(), creation_status);
   fallback_factory_ = std::move(*factory_or_error);
   tls_slot_.set([](Event::Dispatcher&) { return std::make_shared<ThreadLocalQuicConfig>(); });

source/common/quic/quic_server_transport_socket_factory.cc

@@ -31,7 +31,8 @@ QuicServerTransportSocketConfigFactory::createTransportSocketFactory(
 
   auto factory_or_error = QuicServerTransportSocketFactory::create(
       PROTOBUF_GET_WRAPPED_OR_DEFAULT(quic_transport, enable_early_data, true),
-      context.statsScope(), std::move(server_config), context.sslContextManager(), server_names);
+      context.statsScope(), std::move(server_config),
+      context.serverFactoryContext().sslContextManager(), server_names);
   RETURN_IF_NOT_OK(factory_or_error.status());
   (*factory_or_error)->initialize();
   return std::move(*factory_or_error);

source/common/ssl/tls_certificate_config_impl.cc

@@ -47,34 +47,38 @@ static const std::string INLINE_STRING = "<inline>";
 
 absl::StatusOr<std::unique_ptr<TlsCertificateConfigImpl>> TlsCertificateConfigImpl::create(
     const envoy::extensions::transport_sockets::tls::v3::TlsCertificate& config,
-    Server::Configuration::TransportSocketFactoryContext& factory_context, Api::Api& api) {
+    Server::Configuration::ServerFactoryContext& factory_context) {
   absl::Status creation_status = absl::OkStatus();
   std::unique_ptr<TlsCertificateConfigImpl> ret(
-      new TlsCertificateConfigImpl(config, factory_context, api, creation_status));
+      new TlsCertificateConfigImpl(config, factory_context, creation_status));
   RETURN_IF_NOT_OK(creation_status);
   return ret;
 }
 
 TlsCertificateConfigImpl::TlsCertificateConfigImpl(
     const envoy::extensions::transport_sockets::tls::v3::TlsCertificate& config,
-    Server::Configuration::TransportSocketFactoryContext& factory_context, Api::Api& api,
-    absl::Status& creation_status)
-    : certificate_chain_(maybeSet(Config::DataSource::read(config.certificate_chain(), true, api),
-                                  creation_status)),
+    Server::Configuration::ServerFactoryContext& factory_context, absl::Status& creation_status)
+    : certificate_chain_(maybeSet(
+          Config::DataSource::read(config.certificate_chain(), true, factory_context.api()),
+          creation_status)),
       certificate_chain_path_(
           Config::DataSource::getPath(config.certificate_chain())
               .value_or(certificate_chain_.empty() ? EMPTY_STRING : INLINE_STRING)),
       private_key_(
-          maybeSet(Config::DataSource::read(config.private_key(), true, api), creation_status)),
+          maybeSet(Config::DataSource::read(config.private_key(), true, factory_context.api()),
+                   creation_status)),
       private_key_path_(Config::DataSource::getPath(config.private_key())
                             .value_or(private_key_.empty() ? EMPTY_STRING : INLINE_STRING)),
-      pkcs12_(maybeSet(Config::DataSource::read(config.pkcs12(), true, api), creation_status)),
+      pkcs12_(maybeSet(Config::DataSource::read(config.pkcs12(), true, factory_context.api()),
+                       creation_status)),
       pkcs12_path_(Config::DataSource::getPath(config.pkcs12())
                        .value_or(pkcs12_.empty() ? EMPTY_STRING : INLINE_STRING)),
-      password_(maybeSet(Config::DataSource::read(config.password(), true, api), creation_status)),
+      password_(maybeSet(Config::DataSource::read(config.password(), true, factory_context.api()),
+                         creation_status)),
       password_path_(Config::DataSource::getPath(config.password())
                          .value_or(password_.empty() ? EMPTY_STRING : INLINE_STRING)),
-      ocsp_staple_(maybeReadOcspStaple(config.ocsp_staple(), api, creation_status)),
+      ocsp_staple_(
+          maybeReadOcspStaple(config.ocsp_staple(), factory_context.api(), creation_status)),
       ocsp_staple_path_(Config::DataSource::getPath(config.ocsp_staple())
                             .value_or(ocsp_staple_.empty() ? EMPTY_STRING : INLINE_STRING)),
       private_key_method_(nullptr) {