These tests execute calls against a local secure (TLS-enabled) Showcase server. During the TLS + * handshake, the client and server negotiate cipher suites and key exchange groups. Showcase + * injects information about the negotiated TLS connection parameters into custom headers: + * + *
Verification cases: + * + *
Caches the Conscrypt {@link Provider} instance (or {@code null} if initialization fails) to + * avoid repeated expensive JNI initialization operations on every transport creation. + * + *
Returns {@code null} on failure so that transport creation can fall back to default JDK TLS,
+ * ensuring that setting Conscrypt as the default security provider does not cause breaking
+ * failures for customers running on environments where Conscrypt is unsupported or unavailable.
+ */
+ private static class ConscryptProviderHolder {
+ private static final Provider INSTANCE = createProvider();
+
+ private static Provider createProvider() {
+ try {
+ return Conscrypt.newProvider();
+ } catch (Throwable t) {
+ LOG.log(
+ Level.WARNING, "Conscrypt native libraries not available. Falling back to JDK TLS.", t);
+ return null;
+ }
+ }
+ }
+
+ /**
+ * Creates a {@link NetHttpTransport.Builder} pre-configured with Conscrypt as the security
+ * provider by default if Conscrypt is available. Users can customize the {@link
+ * NetHttpTransport.Builder} to use a different security provider.
+ */
+ public static NetHttpTransport.Builder createConscryptHttpTransportBuilder() {
+ NetHttpTransport.Builder builder = new NetHttpTransport.Builder();
+ Provider conscryptProvider = ConscryptProviderHolder.INSTANCE;
+ if (conscryptProvider == null) {
+ return builder;
+ }
+ return builder
+ .setSecurityProvider(conscryptProvider)
+ .setSslSocketConfigurator(
+ socket -> {
+ if (!Conscrypt.isConscrypt(socket)) {
+ return;
+ }
+ try {
+ Conscrypt.setNamedGroups(socket, DEFAULT_PQC_GROUPS);
+ } catch (Throwable t) {
+ // Catch runtime socket configuration errors (e.g. version mismatch or unexpected
+ // socket implementation) to gracefully fall back to Conscrypt's default TLS groups
+ // without failing transport creation.
+ LOG.log(
+ Level.WARNING,
+ "Failed to set PQC named groups on Conscrypt socket. Falling back to"
+ + " Conscrypt default TLS groups.",
+ t);
+ }
+ });
+ }
+
+ private HttpJsonTransportUtils() {}
+}
diff --git a/sdk-platform-java/gax-java/gax-httpjson/src/main/java/com/google/api/gax/httpjson/InstantiatingHttpJsonChannelProvider.java b/sdk-platform-java/gax-java/gax-httpjson/src/main/java/com/google/api/gax/httpjson/InstantiatingHttpJsonChannelProvider.java
index 495fec1ed450..b31904d64a6a 100644
--- a/sdk-platform-java/gax-java/gax-httpjson/src/main/java/com/google/api/gax/httpjson/InstantiatingHttpJsonChannelProvider.java
+++ b/sdk-platform-java/gax-java/gax-httpjson/src/main/java/com/google/api/gax/httpjson/InstantiatingHttpJsonChannelProvider.java
@@ -191,16 +191,19 @@ public TransportChannelProvider withCredentials(Credentials credentials) {
}
HttpTransport createHttpTransport() throws IOException, GeneralSecurityException {
- if (mtlsProvider == null) {
- return null;
- }
- if (certificateBasedAccess.useMtlsClientCertificate()) {
+ NetHttpTransport.Builder builder = HttpJsonTransportUtils.createConscryptHttpTransportBuilder();
+ return configureMtls(builder).build();
+ }
+
+ private NetHttpTransport.Builder configureMtls(NetHttpTransport.Builder builder)
+ throws IOException, GeneralSecurityException {
+ if (mtlsProvider != null && certificateBasedAccess.useMtlsClientCertificate()) {
KeyStore mtlsKeyStore = mtlsProvider.getKeyStore();
if (mtlsKeyStore != null) {
- return new NetHttpTransport.Builder().trustCertificates(null, mtlsKeyStore, "").build();
+ builder.trustCertificates(null, mtlsKeyStore, "");
}
}
- return null;
+ return builder;
}
private HttpJsonTransportChannel createChannel() throws IOException, GeneralSecurityException {
@@ -364,7 +367,8 @@ public InstantiatingHttpJsonChannelProvider build() {
"DefaultMtlsProviderFactory encountered unexpected IOException: " + e.getMessage());
LOG.log(
Level.WARNING,
- "mTLS configuration was detected on the device, but mTLS failed to initialize. Falling back to non-mTLS channel.");
+ "mTLS configuration was detected on the device, but mTLS failed to initialize."
+ + " Falling back to non-mTLS channel.");
}
}
}
diff --git a/sdk-platform-java/gax-java/gax-httpjson/src/test/java/com/google/api/gax/httpjson/InstantiatingHttpJsonChannelProviderTest.java b/sdk-platform-java/gax-java/gax-httpjson/src/test/java/com/google/api/gax/httpjson/InstantiatingHttpJsonChannelProviderTest.java
index 17ad9f2cbf2b..255628759ad7 100644
--- a/sdk-platform-java/gax-java/gax-httpjson/src/test/java/com/google/api/gax/httpjson/InstantiatingHttpJsonChannelProviderTest.java
+++ b/sdk-platform-java/gax-java/gax-httpjson/src/test/java/com/google/api/gax/httpjson/InstantiatingHttpJsonChannelProviderTest.java
@@ -32,6 +32,7 @@
import static com.google.common.truth.Truth.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals;
+import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.gax.rpc.HeaderProvider;
import com.google.api.gax.rpc.TransportChannelProvider;
import com.google.api.gax.rpc.mtls.AbstractMtlsTransportChannelTest;
@@ -192,6 +193,27 @@ protected Object getMtlsObjectFromTransportChannel(
.setHeaderProvider(Mockito.mock(HeaderProvider.class))
.setExecutor(Mockito.mock(Executor.class))
.build();
- return channelProvider.createHttpTransport();
+ NetHttpTransport transport = (NetHttpTransport) channelProvider.createHttpTransport();
+ return (transport != null && transport.isMtls()) ? transport : null;
+ }
+
+ @Test
+ void testCreateHttpTransport_returnsValidTransport() throws Exception {
+ InstantiatingHttpJsonChannelProvider channelProvider =
+ InstantiatingHttpJsonChannelProvider.newBuilder()
+ .setEndpoint("localhost:8080")
+ .setHeaderProvider(Mockito.mock(HeaderProvider.class))
+ .setExecutor(Mockito.mock(Executor.class))
+ .build();
+ NetHttpTransport transport = (NetHttpTransport) channelProvider.createHttpTransport();
+ assertThat(transport).isNotNull();
+ }
+
+ @Test
+ void testDefaultPqcGroups_containsExpectedGroups() {
+ assertThat(HttpJsonTransportUtils.DEFAULT_PQC_GROUPS)
+ .asList()
+ .containsExactly("X25519MLKEM768", "SecP256r1MLKEM768", "X25519")
+ .inOrder();
}
}
diff --git a/sdk-platform-java/java-core/google-cloud-core-http/pom.xml b/sdk-platform-java/java-core/google-cloud-core-http/pom.xml
index 9bcac047678b..ee8beb09cbf0 100644
--- a/sdk-platform-java/java-core/google-cloud-core-http/pom.xml
+++ b/sdk-platform-java/java-core/google-cloud-core-http/pom.xml
@@ -75,6 +75,11 @@