Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

xds: listener type validation #11933

Open
wants to merge 18 commits into
base: master
Choose a base branch
from
Open

xds: listener type validation #11933

Show file tree
Hide file tree
Changes from 16 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
4eb625a
XdsNameResolver and XdsServerWrapper checks listener type
shivaspeaks Feb 17, 2025
ad90963
XdsNameResolver and XdsServerWrapper check listener type
shivaspeaks Feb 24, 2025
01927a6
xds listener type validation
shivaspeaks Feb 25, 2025
8780c52
xds listener type validation
shivaspeaks Mar 3, 2025
76270a4
Address comments
shivaspeaks Mar 6, 2025
da0d5ab
Address comments
shivaspeaks Mar 6, 2025
ba8af22
Merge branch 'master' into listener-type-validation
shivaspeaks Mar 6, 2025
694c2f1
Pull from master
shivaspeaks Mar 6, 2025
506bbe4
remove wildcard handling
shivaspeaks Mar 7, 2025
87aad6f
rebase
shivaspeaks Mar 7, 2025
239f167
typo
shivaspeaks Mar 7, 2025
ca5bb14
address comments
shivaspeaks Mar 18, 2025
cb41652
communicate protocol through EnvoyServerData.Address
shivaspeaks Mar 19, 2025
e07158f
Merge branch 'master' into listener-type-validation
shivaspeaks Mar 19, 2025
9f79e8c
resolve conflicts
shivaspeaks Mar 19, 2025
d8fb13a
resolve conflicts
shivaspeaks Mar 19, 2025
6873d59
Final code
shivaspeaks Mar 19, 2025
b3908f1
remove unwanted line
shivaspeaks Mar 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cronet/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ dependencies {

task javadocs(type: Javadoc) {
source = android.sourceSets.main.java.srcDirs
classpath += files(android.getBootClasspath())
// classpath += files(android.getBootClasspath())
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll uncomment this in the next commit.

classpath += files({
android.libraryVariants.collect { variant ->
variant.javaCompileProvider.get().classpath
Expand Down
9 changes: 7 additions & 2 deletions xds/src/main/java/io/grpc/xds/EnvoyServerProtoData.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
import com.google.common.annotations.VisibleForTesting;
import com.google.common.collect.ImmutableList;
import com.google.protobuf.util.Durations;
import io.envoyproxy.envoy.config.core.v3.SocketAddress.Protocol;
import io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CommonTlsContext;
import io.grpc.Internal;
import io.grpc.xds.client.EnvoyProtoData;
Expand Down Expand Up @@ -248,13 +249,17 @@ abstract static class Listener {
@Nullable
abstract FilterChain defaultFilterChain();

@Nullable
abstract Protocol protocol();

static Listener create(
String name,
@Nullable String address,
ImmutableList<FilterChain> filterChains,
@Nullable FilterChain defaultFilterChain) {
@Nullable FilterChain defaultFilterChain,
@Nullable Protocol protocol) {
return new AutoValue_EnvoyServerProtoData_Listener(name, address, filterChains,
defaultFilterChain);
defaultFilterChain, protocol);
}
}

Expand Down
13 changes: 8 additions & 5 deletions xds/src/main/java/io/grpc/xds/XdsListenerResource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,13 +162,16 @@
}

String address = null;
SocketAddress socketAddress = null;
if (proto.getAddress().hasSocketAddress()) {
SocketAddress socketAddress = proto.getAddress().getSocketAddress();
socketAddress = proto.getAddress().getSocketAddress();
address = socketAddress.getAddress();
if (address.isEmpty()) {
throw new ResourceInvalidException("Invalid address: Empty address is not allowed.");

Check warning on line 170 in xds/src/main/java/io/grpc/xds/XdsListenerResource.java

View check run for this annotation

Codecov / codecov/patch

xds/src/main/java/io/grpc/xds/XdsListenerResource.java#L170 

Added line #L170 was not covered by tests
}
switch (socketAddress.getPortSpecifierCase()) {
case NAMED_PORT:
address = address + ":" + socketAddress.getNamedPort();
break;
throw new ResourceInvalidException("NAMED_PORT is not supported in gRPC.");

Check warning on line 174 in xds/src/main/java/io/grpc/xds/XdsListenerResource.java

View check run for this annotation

Codecov / codecov/patch

xds/src/main/java/io/grpc/xds/XdsListenerResource.java#L174 

Added line #L174 was not covered by tests
case PORT_VALUE:
address = address + ":" + socketAddress.getPortValue();
break;
Expand Down Expand Up @@ -209,8 +212,8 @@
null, certProviderInstances, args);
}

return EnvoyServerProtoData.Listener.create(
proto.getName(), address, filterChains.build(), defaultFilterChain);
return EnvoyServerProtoData.Listener.create(proto.getName(), address, filterChains.build(),
defaultFilterChain, socketAddress == null ? null : socketAddress.getProtocol());
}

@VisibleForTesting
Expand Down
8 changes: 8 additions & 0 deletions xds/src/main/java/io/grpc/xds/XdsNameResolver.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -676,6 +676,14 @@
// Process Route
XdsConfig update = updateOrStatus.getValue();
HttpConnectionManager httpConnectionManager = update.getListener().httpConnectionManager();
if (httpConnectionManager == null) {
String error = "API Listener: httpConnectionManager does not exist.";
logger.log(XdsLogLevel.INFO, error);
updateActiveFilters(null);
cleanUpRoutes(updateOrStatus.getStatus());
return;

Check warning on line 684 in xds/src/main/java/io/grpc/xds/XdsNameResolver.java

View check run for this annotation

Codecov / codecov/patch

xds/src/main/java/io/grpc/xds/XdsNameResolver.java#L680-L684 

Added lines #L680 - L684 were not covered by tests
}

VirtualHost virtualHost = update.getVirtualHost();
ImmutableList<NamedFilterConfig> filterConfigs = httpConnectionManager.httpFilterConfigs();
long streamDurationNano = httpConnectionManager.httpMaxStreamDurationNano();
Expand Down
38 changes: 35 additions & 3 deletions xds/src/main/java/io/grpc/xds/XdsServerWrapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,10 @@
import com.google.common.annotations.VisibleForTesting;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import com.google.common.net.HostAndPort;
import com.google.common.net.InetAddresses;
import com.google.common.util.concurrent.SettableFuture;
import io.envoyproxy.envoy.config.core.v3.SocketAddress.Protocol;
import io.grpc.Attributes;
import io.grpc.InternalServerInterceptors;
import io.grpc.Metadata;
Expand Down Expand Up @@ -57,6 +60,7 @@
import io.grpc.xds.client.XdsClient.ResourceWatcher;
import io.grpc.xds.internal.security.SslContextProviderSupplier;
import java.io.IOException;
import java.net.InetAddress;
import java.net.SocketAddress;
import java.util.ArrayList;
import java.util.HashMap;
Expand Down Expand Up @@ -383,7 +387,21 @@
return;
}
logger.log(Level.FINEST, "Received Lds update {0}", update);
checkNotNull(update.listener(), "update");
if (update.listener() == null) {
onResourceDoesNotExist("Non-API");
return;

Check warning on line 392 in xds/src/main/java/io/grpc/xds/XdsServerWrapper.java

View check run for this annotation

Codecov / codecov/patch

xds/src/main/java/io/grpc/xds/XdsServerWrapper.java#L391-L392 

Added lines #L391 - L392 were not covered by tests
}

String ldsAddress = update.listener().address();
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For my education: what would be the "best/most appropriate" behaviour if the String ldsAddress is the empty string or null?

Currently, if ldsAddress is null, we skip ipAddressesMatch entirely and proceed with the remaining logic. Would this still be fine?

Likewise, if ldsAddress is the empty string, we check ipAddressesMatch, AFAIK, this would throw an exception and would this be fine? HostAndPort.fromString would return a HostAndPort(host="", port=-1, hasBracketlessColons=false) then InetAddresses.forString would throw an IllegalArgumentException

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmmm. Good point. I couldn't find any mention about this case in gRFC A36.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ldsAddress == null means (based on XdsListenerResource) that the address type was not a SocketAddress, which is covered in the gRFC.

In most NR/LB logic, exceptions cause the channel to go into panic mode. NR/LB should only throw in case of a bug.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Empty address is disallowed in the proto, but is not in our validation so we should add validation. The ip matching logic here should also be checking that it is a TCP listener, which is not being communicated through EnvoyServerData.Address.

And the validation should probably be NACKing (throw ResourceInvalidException) NAMED_PORT as gRPC does not support resolver_name, which is mentioned as being required to use it in its documentation.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How do we check if it is a TCP listener?

if ("raw_buffer".equals(update.listener().filterChains().get(0).filterChainMatch().transportProtocol())) this could tell us but I'm not very sure about this. I could have pasted the above condition with default filter chain but that is a Nullable field.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This gRPC code is always TCP. So we need to not match when xDS tells us to use UDP.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The transport protocol doesn't seem to be about TCP vs UDP. That's raw_buffer or tls: the higher-level protocol. And that is part of filter chain matches; used to select which filter chain to use. You should never loop through all the matchers and then copy details about it to other matchers.

We were talking about the address, and SocketAddress has a TCP vs UDP protocol.

Copy link
Member Author

@shivaspeaks shivaspeaks Mar 19, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Got it.

You said we need not match addresses when it's UDP, so I assume we don't call handleConfigNotFoundOrMismatch when it's UDP and continue?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand. If you don't call handleConfigNotFoundOrMismatch, that's the same as matching... If !ipAddressesMatch() you call handleConfigNotFoundOrMismatch. Why would you not call it?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep. I was thinking right at first before editing the comment and then I messed up with thoughts.

if (ldsAddress != null && update.listener().protocol() == Protocol.TCP
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From gRFC A36:

To be useful, the xDS-returned Listener must have an address that matches the listening address provided. The Listener's address would be a TCP SocketAddress with matching address and port_value. The XdsServer must be "not serving" if the address does not match.

If ldsAddress == null, then there was not a (supported) address and it should not be serving. If the protocol is not TCP then it should not be serving.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This means that every place in our tests that calls Listener.newBuilder() needs to set the address.

&& !ipAddressesMatch(ldsAddress)) {
handleConfigNotFoundOrMismatch(
Status.UNKNOWN.withDescription(
String.format(
"Listener address mismatch: expected %s, but got %s.",
listenerAddress, ldsAddress)).asException());
return;
}
if (!pendingRds.isEmpty()) {
// filter chain state has not yet been applied to filterChainSelectorManager and there
// are two sets of sslContextProviderSuppliers, so we release the old ones.
Expand Down Expand Up @@ -432,6 +450,20 @@
}
}

private boolean ipAddressesMatch(String ldsAddress) {
HostAndPort ldsAddressHnP = HostAndPort.fromString(ldsAddress);
HostAndPort listenerAddressHnP = HostAndPort.fromString(listenerAddress);

InetAddress listenerIp = InetAddresses.forString(listenerAddressHnP.getHost());
InetAddress ldsIp = InetAddresses.forString(ldsAddressHnP.getHost());
if (!ldsAddressHnP.hasPort() || !listenerAddressHnP.hasPort()
|| ldsAddressHnP.getPort() != listenerAddressHnP.getPort()) {
return false;

Check warning on line 461 in xds/src/main/java/io/grpc/xds/XdsServerWrapper.java

View check run for this annotation

Codecov / codecov/patch

xds/src/main/java/io/grpc/xds/XdsServerWrapper.java#L461 

Added line #L461 was not covered by tests
}

return listenerIp.equals(ldsIp);
}

@Override
public void onResourceDoesNotExist(final String resourceName) {
if (stopped) {
Expand All @@ -440,7 +472,7 @@
StatusException statusException = Status.UNAVAILABLE.withDescription(
String.format("Listener %s unavailable, xDS node ID: %s", resourceName,
xdsClient.getBootstrapInfo().node().getId())).asException();
handleConfigNotFound(statusException);
handleConfigNotFoundOrMismatch(statusException);
}

@Override
Expand Down Expand Up @@ -673,7 +705,7 @@
};
}

private void handleConfigNotFound(StatusException exception) {
private void handleConfigNotFoundOrMismatch(StatusException exception) {
cleanUpRouteDiscoveryStates();
shutdownActiveFilters();
List<SslContextProviderSupplier> toRelease = getSuppliersInUse();
Expand Down
6 changes: 4 additions & 2 deletions xds/src/test/java/io/grpc/xds/XdsClientWrapperForServerSdsTestMisc.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@

import com.google.common.collect.ImmutableList;
import com.google.common.util.concurrent.SettableFuture;
import io.envoyproxy.envoy.config.core.v3.SocketAddress.Protocol;
import io.grpc.Server;
import io.grpc.ServerBuilder;
import io.grpc.Status;
Expand Down Expand Up @@ -165,9 +166,10 @@ public void run() {
EnvoyServerProtoData.Listener tcpListener =
EnvoyServerProtoData.Listener.create(
"listener1",
"10.1.2.3",
"0.0.0.0:7000",
ImmutableList.of(),
null);
null,
Protocol.TCP);
LdsUpdate listenerUpdate = LdsUpdate.forTcpListener(tcpListener);
xdsClient.ldsWatcher.onChanged(listenerUpdate);
verify(listener, timeout(5000)).onServing();
Expand Down
7 changes: 4 additions & 3 deletions xds/src/test/java/io/grpc/xds/XdsSecurityClientServerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import com.google.common.util.concurrent.SettableFuture;
import io.envoyproxy.envoy.config.core.v3.SocketAddress.Protocol;
import io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext;
import io.grpc.Attributes;
import io.grpc.EquivalentAddressGroup;
Expand Down Expand Up @@ -488,7 +489,7 @@ public void mtlsClientServer_changeServerContext_expectException()
DownstreamTlsContext downstreamTlsContext =
CommonTlsContextTestsUtil.buildDownstreamTlsContext(
"cert-instance-name2", true, true);
EnvoyServerProtoData.Listener listener = buildListener("listener1", "0.0.0.0",
EnvoyServerProtoData.Listener listener = buildListener("listener1", "0.0.0.0:0",
downstreamTlsContext,
tlsContextManagerForServer);
xdsClient.deliverLdsUpdate(LdsUpdate.forTcpListener(listener));
Expand Down Expand Up @@ -592,7 +593,7 @@ private void buildServer(
tlsContextManagerForServer = new TlsContextManagerImpl(bootstrapInfoForServer);
XdsServerWrapper xdsServer = (XdsServerWrapper) builder.build();
SettableFuture<Throwable> startFuture = startServerAsync(xdsServer);
EnvoyServerProtoData.Listener listener = buildListener("listener1", "10.1.2.3",
EnvoyServerProtoData.Listener listener = buildListener("listener1", "0.0.0.0:0",
downstreamTlsContext, tlsContextManagerForServer);
LdsUpdate listenerUpdate = LdsUpdate.forTcpListener(listener);
xdsClient.deliverLdsUpdate(listenerUpdate);
Expand Down Expand Up @@ -633,7 +634,7 @@ static EnvoyServerProtoData.Listener buildListener(
"filter-chain-foo", filterChainMatch, httpConnectionManager, tlsContext,
tlsContextManager);
EnvoyServerProtoData.Listener listener = EnvoyServerProtoData.Listener.create(
name, address, ImmutableList.of(defaultFilterChain), null);
name, address, ImmutableList.of(defaultFilterChain), null, Protocol.TCP);
return listener;
}

Expand Down
12 changes: 9 additions & 3 deletions xds/src/test/java/io/grpc/xds/XdsServerBuilderTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
package io.grpc.xds;

import static com.google.common.truth.Truth.assertThat;
import static io.grpc.xds.XdsServerTestHelper.buildTestListener;
import static org.junit.Assert.fail;
import static org.mockito.Mockito.any;
import static org.mockito.Mockito.mock;
Expand All @@ -26,13 +27,15 @@
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;

import com.google.common.collect.ImmutableList;
import com.google.common.util.concurrent.SettableFuture;
import io.grpc.BindableService;
import io.grpc.InsecureServerCredentials;
import io.grpc.ServerServiceDefinition;
import io.grpc.Status;
import io.grpc.StatusException;
import io.grpc.testing.GrpcCleanupRule;
import io.grpc.xds.XdsListenerResource.LdsUpdate;
import io.grpc.xds.XdsServerTestHelper.FakeXdsClient;
import io.grpc.xds.XdsServerTestHelper.FakeXdsClientPoolFactory;
import io.grpc.xds.internal.security.CommonTlsContextTestsUtil;
Expand Down Expand Up @@ -221,10 +224,13 @@ public void xdsServer_startError()
buildServer(mockXdsServingStatusListener);
Future<Throwable> future = startServerAsync();
// create port conflict for start to fail
XdsServerTestHelper.generateListenerUpdate(
xdsClient,
EnvoyServerProtoData.Listener listener = buildTestListener(
"listener1", "0.0.0.0:" + port, ImmutableList.of(),
CommonTlsContextTestsUtil.buildTestInternalDownstreamTlsContext("CERT1", "VA1"),
tlsContextManager);
null, tlsContextManager);
LdsUpdate listenerUpdate = LdsUpdate.forTcpListener(listener);
xdsClient.deliverLdsUpdate(listenerUpdate);

Throwable exception = future.get(5, TimeUnit.SECONDS);
assertThat(exception).isInstanceOf(IOException.class);
assertThat(exception).hasMessageThat().contains("Failed to bind");
Expand Down
15 changes: 8 additions & 7 deletions xds/src/test/java/io/grpc/xds/XdsServerTestHelper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import com.google.common.util.concurrent.SettableFuture;
import io.envoyproxy.envoy.config.core.v3.SocketAddress.Protocol;
import io.grpc.InsecureChannelCredentials;
import io.grpc.MetricRecorder;
import io.grpc.internal.ObjectPool;
Expand Down Expand Up @@ -74,7 +75,7 @@ public class XdsServerTestHelper {
static void generateListenerUpdate(FakeXdsClient xdsClient,
EnvoyServerProtoData.DownstreamTlsContext tlsContext,
TlsContextManager tlsContextManager) {
EnvoyServerProtoData.Listener listener = buildTestListener("listener1", "10.1.2.3",
EnvoyServerProtoData.Listener listener = buildTestListener("listener1", "0.0.0.0:0",
ImmutableList.of(), tlsContext, null, tlsContextManager);
LdsUpdate listenerUpdate = LdsUpdate.forTcpListener(listener);
xdsClient.deliverLdsUpdate(listenerUpdate);
Expand All @@ -85,7 +86,8 @@ static void generateListenerUpdate(
EnvoyServerProtoData.DownstreamTlsContext tlsContext,
EnvoyServerProtoData.DownstreamTlsContext tlsContextForDefaultFilterChain,
TlsContextManager tlsContextManager) {
EnvoyServerProtoData.Listener listener = buildTestListener("listener1", "10.1.2.3", sourcePorts,
EnvoyServerProtoData.Listener listener = buildTestListener(
"listener1", "0.0.0.0:7000", sourcePorts,
tlsContext, tlsContextForDefaultFilterChain, tlsContextManager);
LdsUpdate listenerUpdate = LdsUpdate.forTcpListener(listener);
xdsClient.deliverLdsUpdate(listenerUpdate);
Expand Down Expand Up @@ -128,9 +130,8 @@ static EnvoyServerProtoData.Listener buildTestListener(
EnvoyServerProtoData.FilterChain defaultFilterChain = EnvoyServerProtoData.FilterChain.create(
"filter-chain-bar", defaultFilterChainMatch, httpConnectionManager,
tlsContextForDefaultFilterChain, tlsContextManager);
EnvoyServerProtoData.Listener listener =
EnvoyServerProtoData.Listener.create(
name, address, ImmutableList.of(filterChain1), defaultFilterChain);
EnvoyServerProtoData.Listener listener = EnvoyServerProtoData.Listener.create(
name, address, ImmutableList.of(filterChain1), defaultFilterChain, Protocol.TCP);
return listener;
}

Expand Down Expand Up @@ -297,8 +298,8 @@ void deliverLdsUpdate(LdsUpdate ldsUpdate) {
void deliverLdsUpdate(
List<FilterChain> filterChains,
@Nullable FilterChain defaultFilterChain) {
deliverLdsUpdate(LdsUpdate.forTcpListener(Listener.create(
"listener", "0.0.0.0:1", ImmutableList.copyOf(filterChains), defaultFilterChain)));
deliverLdsUpdate(LdsUpdate.forTcpListener(Listener.create("listener", "0.0.0.0:1",
ImmutableList.copyOf(filterChains), defaultFilterChain, Protocol.TCP)));
}

void deliverLdsUpdate(FilterChain filterChain, @Nullable FilterChain defaultFilterChain) {
Expand Down
43 changes: 43 additions & 0 deletions xds/src/test/java/io/grpc/xds/XdsServerWrapperTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@
import com.google.common.collect.ImmutableMap;
import com.google.common.net.InetAddresses;
import com.google.common.util.concurrent.SettableFuture;
import io.envoyproxy.envoy.config.core.v3.SocketAddress.Protocol;
import io.grpc.Attributes;
import io.grpc.InsecureChannelCredentials;
import io.grpc.Metadata;
Expand All @@ -54,13 +55,15 @@
import io.grpc.xds.EnvoyServerProtoData.CidrRange;
import io.grpc.xds.EnvoyServerProtoData.FilterChain;
import io.grpc.xds.EnvoyServerProtoData.FilterChainMatch;
import io.grpc.xds.EnvoyServerProtoData.Listener;
import io.grpc.xds.Filter.FilterConfig;
import io.grpc.xds.Filter.NamedFilterConfig;
import io.grpc.xds.FilterChainMatchingProtocolNegotiators.FilterChainMatchingHandler.FilterChainSelector;
import io.grpc.xds.StatefulFilter.Config;
import io.grpc.xds.VirtualHost.Route;
import io.grpc.xds.VirtualHost.Route.RouteMatch;
import io.grpc.xds.VirtualHost.Route.RouteMatch.PathMatcher;
import io.grpc.xds.XdsListenerResource.LdsUpdate;
import io.grpc.xds.XdsRouteConfigureResource.RdsUpdate;
import io.grpc.xds.XdsServerBuilder.XdsServingStatusListener;
import io.grpc.xds.XdsServerTestHelper.FakeXdsClient;
Expand Down Expand Up @@ -538,6 +541,46 @@ public void run() {
verify(mockServer).start();
}

@Test
public void onChanged_listenerAddressMismatch()
throws ExecutionException, InterruptedException, TimeoutException {

when(mockBuilder.build()).thenReturn(mockServer);
xdsServerWrapper = new XdsServerWrapper("10.1.2.3:1", mockBuilder, listener,
selectorManager, new FakeXdsClientPoolFactory(xdsClient),
filterRegistry, executor.getScheduledExecutorService());

final SettableFuture<Server> start = SettableFuture.create();
Executors.newSingleThreadExecutor().execute(new Runnable() {
@Override
public void run() {
try {
start.set(xdsServerWrapper.start());
} catch (Exception ex) {
start.setException(ex);
}
}
});
String ldsResource = xdsClient.ldsResource.get(5, TimeUnit.SECONDS);
assertThat(ldsResource).isEqualTo("grpc/server?udpa.resource.listening_address=10.1.2.3:1");

VirtualHost virtualHost =
VirtualHost.create(
"virtual-host", Collections.singletonList("auth"), new ArrayList<Route>(),
ImmutableMap.<String, FilterConfig>of());
HttpConnectionManager httpConnectionManager = HttpConnectionManager.forVirtualHosts(
0L, Collections.singletonList(virtualHost), new ArrayList<NamedFilterConfig>());
EnvoyServerProtoData.FilterChain filterChain = EnvoyServerProtoData.FilterChain.create(
"filter-chain-foo", createMatch(), httpConnectionManager, createTls(),
mock(TlsContextManager.class));

LdsUpdate listenerUpdate = LdsUpdate.forTcpListener(
Listener.create("listener", "20.3.4.5:1",
ImmutableList.copyOf(Collections.singletonList(filterChain)), null, Protocol.TCP));
xdsClient.deliverLdsUpdate(listenerUpdate);
verify(listener, timeout(10000)).onNotServing(any());
}

@Test
public void discoverState_rds() throws Exception {
final SettableFuture<Server> start = SettableFuture.create();
Expand Down