From dcfd16a1b5d934da740ee76647e231ddc7ad5edd Mon Sep 17 00:00:00 2001
From: wuyuhao <wuyuhao1@xiaohongshu.com>
Date: Thu, 20 Jun 2024 16:05:19 +0800
Subject: [PATCH] Add comments

---
 .../dubbo/xds/listener/XdsTlsConfigRepository.java  |  2 ++
 .../dubbo/xds/security/api/XdsCertProvider.java     | 13 +++++++++++--
 .../dubbo/xds/security/authn/UpstreamTlsConfig.java |  2 +-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/dubbo-xds/src/main/java/org/apache/dubbo/xds/listener/XdsTlsConfigRepository.java b/dubbo-xds/src/main/java/org/apache/dubbo/xds/listener/XdsTlsConfigRepository.java
index 2e65d28145..553eb2cea0 100644
--- a/dubbo-xds/src/main/java/org/apache/dubbo/xds/listener/XdsTlsConfigRepository.java
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/xds/listener/XdsTlsConfigRepository.java
@@ -28,11 +28,13 @@ public class XdsTlsConfigRepository {
 
     /**
      * inbound ports -> configs
+     * Indicates the TLS configuration for inbound connections.
      */
     private volatile Map<String, DownstreamTlsConfig> downstreamConfigs = Collections.emptyMap();
 
     /**
      * clusterName -> configs
+     * Indicates the TLS configuration for outbound connection to certain cluster.
      */
     private volatile Map<String, UpstreamTlsConfig> upstreamConfigs = Collections.emptyMap();
 
diff --git a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/api/XdsCertProvider.java b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/api/XdsCertProvider.java
index 787a2ba99f..ee0b9b014d 100644
--- a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/api/XdsCertProvider.java
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/api/XdsCertProvider.java
@@ -67,7 +67,7 @@ public class XdsCertProvider implements CertProvider {
     @Override
     public boolean isSupport(URL address) {
         String side = address.getSide();
-        if (PROVIDER.equals(side)) {
+        if (CONSUMER.equals(side)) {
             // TODO: If XDS URL can support version tag, key should be address.getServiceKey()
             UpstreamTlsConfig upstreamConfig = configRepo.getUpstreamConfig(address.getServiceInterface());
             if (upstreamConfig == null || upstreamConfig.getGeneralTlsConfig() == null) {
@@ -80,7 +80,7 @@ public class XdsCertProvider implements CertProvider {
 
             // At least one config provided by LDS
             return !trustConfigs.isEmpty() || !certConfigs.isEmpty();
-        } else if (CONSUMER.equals(side)) {
+        } else if (PROVIDER.equals(side)) {
             DownstreamTlsConfig downstreamConfig = configRepo.getDownstreamConfig(String.valueOf(address.getPort()));
             if (downstreamConfig == null) {
                 return false;
@@ -94,6 +94,15 @@ public class XdsCertProvider implements CertProvider {
             return !secretConfigs.isEmpty() || !certConfigs.isEmpty();
         }
         throw new IllegalStateException("Can't determine side for url:" + address);
+
+        // seems we don't need url to check here anymore
+        //        if (TlsType.PERMISSIVE.equals(type)) {
+        //            String security = address.getParameter("security");
+        //            String mesh = address.getParameter("mesh");
+        //            return mesh != null
+        //                    && security != null
+        //                    && Arrays.asList(security.split(",")).contains("mTLS");
+        //        }
     }
 
     @Override
diff --git a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authn/UpstreamTlsConfig.java b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authn/UpstreamTlsConfig.java
index 37b47271d4..e50bd4c454 100644
--- a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authn/UpstreamTlsConfig.java
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authn/UpstreamTlsConfig.java
@@ -17,7 +17,7 @@
 package org.apache.dubbo.xds.security.authn;
 
 /**
- * Tls config for outbound request
+ * Tls config for outbound connection
  */
 public class UpstreamTlsConfig {