Merge branch 'master' of https://github.com/grpc/grpc into channelz-subchannels

7 files changed, 200 insertions, 47 deletions

diff --git a/test/cpp/naming/address_sorting_test.cc b/test/cpp/naming/address_sorting_test.cc
index a92e9e3b3e..04c300876c 100644
--- a/test/cpp/naming/address_sorting_test.cc
+++ b/test/cpp/naming/address_sorting_test.cc
@@ -24,10 +24,8 @@
 #include <grpc/support/time.h>
 #include <string.h>
 
-#include <arpa/inet.h>
 #include <gflags/gflags.h>
 #include <gmock/gmock.h>
-#include <sys/socket.h>
 #include <sys/types.h>
 #include <vector>
 
@@ -51,6 +49,11 @@
 #include "test/core/util/port.h"
 #include "test/core/util/test_config.h"
 
+#ifndef GPR_WINDOWS
+#include <arpa/inet.h>
+#include <sys/socket.h>
+#endif
+
 namespace {
 
 struct TestAddress {
@@ -190,10 +193,18 @@ void VerifyLbAddrOutputs(grpc_lb_addresses* lb_addrs,
   grpc_lb_addresses_destroy(lb_addrs);
 }
 
-}  // namespace
+/* We need to run each test case inside of its own
+ * isolated grpc_init/grpc_shutdown pair, so that
+ * the "address sorting source addr factory" can be
+ * restored to its default for each test case. */
+class AddressSortingTest : public ::testing::Test {
+ protected:
+  void SetUp() override { grpc_init(); }
+  void TearDown() override { grpc_shutdown(); }
+};
 
 /* Tests for rule 1 */
-TEST(AddressSortingTest, TestDepriotizesUnreachableAddresses) {
+TEST_F(AddressSortingTest, TestDepriotizesUnreachableAddresses) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -212,7 +223,7 @@ TEST(AddressSortingTest, TestDepriotizesUnreachableAddresses) {
                                 });
 }
 
-TEST(AddressSortingTest, TestDepriotizesUnsupportedDomainIpv6) {
+TEST_F(AddressSortingTest, TestDepriotizesUnsupportedDomainIpv6) {
   bool ipv4_supported = true;
   bool ipv6_supported = false;
   OverrideAddressSortingSourceAddrFactory(
@@ -231,7 +242,7 @@ TEST(AddressSortingTest, TestDepriotizesUnsupportedDomainIpv6) {
                                 });
 }
 
-TEST(AddressSortingTest, TestDepriotizesUnsupportedDomainIpv4) {
+TEST_F(AddressSortingTest, TestDepriotizesUnsupportedDomainIpv4) {
   bool ipv4_supported = false;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -253,7 +264,7 @@ TEST(AddressSortingTest, TestDepriotizesUnsupportedDomainIpv4) {
 
 /* Tests for rule 2 */
 
-TEST(AddressSortingTest, TestDepriotizesNonMatchingScope) {
+TEST_F(AddressSortingTest, TestDepriotizesNonMatchingScope) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -277,7 +288,7 @@ TEST(AddressSortingTest, TestDepriotizesNonMatchingScope) {
 
 /* Tests for rule 5 */
 
-TEST(AddressSortingTest, TestUsesLabelFromDefaultTable) {
+TEST_F(AddressSortingTest, TestUsesLabelFromDefaultTable) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -300,7 +311,7 @@ TEST(AddressSortingTest, TestUsesLabelFromDefaultTable) {
 
 /* Flip the input on the test above to reorder the sort function's
  * comparator's inputs. */
-TEST(AddressSortingTest, TestUsesLabelFromDefaultTableInputFlipped) {
+TEST_F(AddressSortingTest, TestUsesLabelFromDefaultTableInputFlipped) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -323,8 +334,8 @@ TEST(AddressSortingTest, TestUsesLabelFromDefaultTableInputFlipped) {
 
 /* Tests for rule 6 */
 
-TEST(AddressSortingTest,
-     TestUsesDestinationWithHigherPrecedenceWithAnIpv4Address) {
+TEST_F(AddressSortingTest,
+       TestUsesDestinationWithHigherPrecedenceWithAnIpv4Address) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -348,8 +359,8 @@ TEST(AddressSortingTest,
                 });
 }
 
-TEST(AddressSortingTest,
-     TestUsesDestinationWithHigherPrecedenceWithV4CompatAndLocalhostAddress) {
+TEST_F(AddressSortingTest,
+       TestUsesDestinationWithHigherPrecedenceWithV4CompatAndLocalhostAddress) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
 // Handle unique observed behavior of inet_ntop(v4-compatible-address) on OS X.
@@ -377,8 +388,8 @@ TEST(AddressSortingTest,
                                 });
 }
 
-TEST(AddressSortingTest,
-     TestUsesDestinationWithHigherPrecedenceWithCatchAllAndLocalhostAddress) {
+TEST_F(AddressSortingTest,
+       TestUsesDestinationWithHigherPrecedenceWithCatchAllAndLocalhostAddress) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -403,8 +414,8 @@ TEST(AddressSortingTest,
       });
 }
 
-TEST(AddressSortingTest,
-     TestUsesDestinationWithHigherPrecedenceWith2000PrefixedAddress) {
+TEST_F(AddressSortingTest,
+       TestUsesDestinationWithHigherPrecedenceWith2000PrefixedAddress) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -426,7 +437,7 @@ TEST(AddressSortingTest,
                 });
 }
 
-TEST(
+TEST_F(
     AddressSortingTest,
     TestUsesDestinationWithHigherPrecedenceWith2000PrefixedAddressEnsurePrefixMatchHasNoEffect) {
   bool ipv4_supported = true;
@@ -448,8 +459,8 @@ TEST(
                                 });
 }
 
-TEST(AddressSortingTest,
-     TestUsesDestinationWithHigherPrecedenceWithLinkAndSiteLocalAddresses) {
+TEST_F(AddressSortingTest,
+       TestUsesDestinationWithHigherPrecedenceWithLinkAndSiteLocalAddresses) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -469,19 +480,22 @@ TEST(AddressSortingTest,
                                 });
 }
 
-TEST(
+TEST_F(
     AddressSortingTest,
     TestUsesDestinationWithHigherPrecedenceWithCatchAllAndAndV4MappedAddresses) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
+  // Use embedded ipv4 addresses with leading 1's instead of zero's to be
+  // compatible with inet_ntop implementations that can display such
+  // addresses with leading zero's as e.g.: "::ffff:0:2", as on windows.
   OverrideAddressSortingSourceAddrFactory(
       ipv4_supported, ipv6_supported,
       {
-          {"[::ffff:0.0.0.2]:443", {"[::ffff:0.0.0.3]:0", AF_INET6}},
+          {"[::ffff:1.1.1.2]:443", {"[::ffff:1.1.1.3]:0", AF_INET6}},
           {"[1234::2]:443", {"[1234::3]:0", AF_INET6}},
       });
   grpc_lb_addresses* lb_addrs = BuildLbAddrInputs({
-      {"[::ffff:0.0.0.2]:443", AF_INET6},
+      {"[::ffff:1.1.1.2]:443", AF_INET6},
       {"[1234::2]:443", AF_INET6},
   });
   grpc_cares_wrapper_test_only_address_sorting_sort(lb_addrs);
@@ -489,13 +503,13 @@ TEST(
                                     // ::ffff:0:2 should match the v4-mapped
                                     // precedence entry and be deprioritized.
                                     "[1234::2]:443",
-                                    "[::ffff:0.0.0.2]:443",
+                                    "[::ffff:1.1.1.2]:443",
                                 });
 }
 
 /* Tests for rule 8 */
 
-TEST(AddressSortingTest, TestPrefersSmallerScope) {
+TEST_F(AddressSortingTest, TestPrefersSmallerScope) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -520,7 +534,7 @@ TEST(AddressSortingTest, TestPrefersSmallerScope) {
 
 /* Tests for rule 9 */
 
-TEST(AddressSortingTest, TestPrefersLongestMatchingSrcDstPrefix) {
+TEST_F(AddressSortingTest, TestPrefersLongestMatchingSrcDstPrefix) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -543,8 +557,8 @@ TEST(AddressSortingTest, TestPrefersLongestMatchingSrcDstPrefix) {
                                 });
 }
 
-TEST(AddressSortingTest,
-     TestPrefersLongestMatchingSrcDstPrefixMatchesWholeAddress) {
+TEST_F(AddressSortingTest,
+       TestPrefersLongestMatchingSrcDstPrefixMatchesWholeAddress) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -564,7 +578,7 @@ TEST(AddressSortingTest,
                                 });
 }
 
-TEST(AddressSortingTest, TestPrefersLongestPrefixStressInnerBytePrefix) {
+TEST_F(AddressSortingTest, TestPrefersLongestPrefixStressInnerBytePrefix) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -584,7 +598,7 @@ TEST(AddressSortingTest, TestPrefersLongestPrefixStressInnerBytePrefix) {
                                 });
 }
 
-TEST(AddressSortingTest, TestPrefersLongestPrefixDiffersOnHighestBitOfByte) {
+TEST_F(AddressSortingTest, TestPrefersLongestPrefixDiffersOnHighestBitOfByte) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -604,7 +618,7 @@ TEST(AddressSortingTest, TestPrefersLongestPrefixDiffersOnHighestBitOfByte) {
                                 });
 }
 
-TEST(AddressSortingTest, TestPrefersLongestPrefixDiffersByLastBit) {
+TEST_F(AddressSortingTest, TestPrefersLongestPrefixDiffersByLastBit) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -628,7 +642,7 @@ TEST(AddressSortingTest, TestPrefersLongestPrefixDiffersByLastBit) {
 
 /* Tests for rule 10 */
 
-TEST(AddressSortingTest, TestStableSort) {
+TEST_F(AddressSortingTest, TestStableSort) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -648,7 +662,7 @@ TEST(AddressSortingTest, TestStableSort) {
                                 });
 }
 
-TEST(AddressSortingTest, TestStableSortFiveElements) {
+TEST_F(AddressSortingTest, TestStableSortFiveElements) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(
@@ -677,7 +691,7 @@ TEST(AddressSortingTest, TestStableSortFiveElements) {
                                 });
 }
 
-TEST(AddressSortingTest, TestStableSortNoSrcAddrsExist) {
+TEST_F(AddressSortingTest, TestStableSortNoSrcAddrsExist) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(ipv4_supported, ipv6_supported, {});
@@ -698,7 +712,7 @@ TEST(AddressSortingTest, TestStableSortNoSrcAddrsExist) {
                                 });
 }
 
-TEST(AddressSortingTest, TestStableSortNoSrcAddrsExistWithIpv4) {
+TEST_F(AddressSortingTest, TestStableSortNoSrcAddrsExistWithIpv4) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
   OverrideAddressSortingSourceAddrFactory(ipv4_supported, ipv6_supported, {});
@@ -713,7 +727,7 @@ TEST(AddressSortingTest, TestStableSortNoSrcAddrsExistWithIpv4) {
                                 });
 }
 
-TEST(AddressSortingTest, TestStableSortV4CompatAndSiteLocalAddresses) {
+TEST_F(AddressSortingTest, TestStableSortV4CompatAndSiteLocalAddresses) {
   bool ipv4_supported = true;
   bool ipv6_supported = true;
 // Handle unique observed behavior of inet_ntop(v4-compatible-address) on OS X.
@@ -744,6 +758,78 @@ TEST(AddressSortingTest, TestStableSortV4CompatAndSiteLocalAddresses) {
                       });
 }
 
+/* TestPrefersIpv6Loopback tests the actual "address probing" code
+ * for the current platform, without any mocks.
+ * This test relies on the assumption that the ipv6 loopback address is
+ * available in the hosts/containers that grpc C/C++ tests run on
+ * (whether ipv4 loopback is available or not, an available ipv6
+ * loopback should be preferred). */
+TEST_F(AddressSortingTest, TestPrefersIpv6Loopback) {
+  grpc_lb_addresses* lb_addrs = BuildLbAddrInputs({
+      {"[::1]:443", AF_INET6},
+      {"127.0.0.1:443", AF_INET},
+  });
+  grpc_cares_wrapper_test_only_address_sorting_sort(lb_addrs);
+  VerifyLbAddrOutputs(lb_addrs, {
+                                    "[::1]:443",
+                                    "127.0.0.1:443",
+                                });
+}
+
+/* Flip the order of the inputs above and expect the same output order
+ * (try to rule out influence of arbitrary qsort ordering) */
+TEST_F(AddressSortingTest, TestPrefersIpv6LoopbackInputsFlipped) {
+  grpc_lb_addresses* lb_addrs = BuildLbAddrInputs({
+      {"127.0.0.1:443", AF_INET},
+      {"[::1]:443", AF_INET6},
+  });
+  grpc_cares_wrapper_test_only_address_sorting_sort(lb_addrs);
+  VerifyLbAddrOutputs(lb_addrs, {
+                                    "[::1]:443",
+                                    "127.0.0.1:443",
+                                });
+}
+
+/* Try to rule out false positives in the above two tests in which
+ * the sorter might think that neither ipv6 or ipv4 loopback is
+ * available, but ipv6 loopback is still preferred only due
+ * to precedance table lookups. */
+TEST_F(AddressSortingTest, TestSorterKnowsIpv6LoopbackIsAvailable) {
+  sockaddr_in6 ipv6_loopback;
+  memset(&ipv6_loopback, 0, sizeof(ipv6_loopback));
+  ipv6_loopback.sin6_family = AF_INET6;
+  ((char*)&ipv6_loopback.sin6_addr)[15] = 1;
+  ipv6_loopback.sin6_port = htons(443);
+  // Set up the source and destination parameters of
+  // address_sorting_get_source_addr
+  address_sorting_address sort_input_dest;
+  memcpy(&sort_input_dest.addr, &ipv6_loopback, sizeof(ipv6_loopback));
+  sort_input_dest.len = sizeof(ipv6_loopback);
+  address_sorting_address source_for_sort_input_dest;
+  memset(&source_for_sort_input_dest, 0, sizeof(source_for_sort_input_dest));
+  // address_sorting_get_source_addr returns true if a source address was found
+  // for the destination address, otherwise false.
+  EXPECT_TRUE(address_sorting_get_source_addr_for_testing(
+      &sort_input_dest, &source_for_sort_input_dest));
+  // Now also check that the source address was filled in correctly.
+  EXPECT_GT(source_for_sort_input_dest.len, 0u);
+  sockaddr_in6* source_addr_output =
+      (sockaddr_in6*)source_for_sort_input_dest.addr;
+  EXPECT_EQ(source_addr_output->sin6_family, AF_INET6);
+  char* buf = static_cast<char*>(gpr_zalloc(100));
+  EXPECT_NE(inet_ntop(AF_INET6, &source_addr_output->sin6_addr, buf, 100),
+            nullptr)
+      << "inet_ntop failed. Errno: " + std::to_string(errno);
+  std::string source_addr_str(buf);
+  gpr_free(buf);
+  // This test
+  // assumes that the source address for any loopback destination is also the
+  // loopback address.
+  EXPECT_EQ(source_addr_str, "::1");
+}
+
+}  // namespace
+
 int main(int argc, char** argv) {
   char* resolver = gpr_getenv("GRPC_DNS_RESOLVER");
   if (resolver == nullptr || strlen(resolver) == 0) {
@@ -754,9 +840,7 @@ int main(int argc, char** argv) {
   gpr_free(resolver);
   grpc_test_init(argc, argv);
   ::testing::InitGoogleTest(&argc, argv);
-  grpc_init();
   auto result = RUN_ALL_TESTS();
-  grpc_shutdown();
   // Test sequential and nested inits and shutdowns.
   grpc_init();
   grpc_init();
diff --git a/test/cpp/naming/gen_build_yaml.py b/test/cpp/naming/gen_build_yaml.py
index baa6512f62..5dad2ea7af 100755
--- a/test/cpp/naming/gen_build_yaml.py
+++ b/test/cpp/naming/gen_build_yaml.py
@@ -110,7 +110,7 @@ def main():
               'gtest': True,
               'run': True,
               'src': ['test/cpp/naming/address_sorting_test.cc'],
-              'platforms': ['linux', 'posix', 'mac'],
+              'platforms': ['linux', 'posix', 'mac', 'windows'],
               'deps': [
                   'grpc++_test_util' + unsecure_build_config_suffix,
                   'grpc_test_util' + unsecure_build_config_suffix,
diff --git a/test/cpp/util/BUILD b/test/cpp/util/BUILD
index 9b42bb28b1..c3bfeb7615 100644
--- a/test/cpp/util/BUILD
+++ b/test/cpp/util/BUILD
@@ -177,6 +177,7 @@ grpc_cc_test(
         "//:grpc++_reflection",
         "//src/proto/grpc/testing:echo_messages_proto",
         "//src/proto/grpc/testing:echo_proto",
+        "//test/core/end2end:ssl_test_data",
         "//test/core/util:grpc_test_util",
     ],
 )
diff --git a/test/cpp/util/cli_credentials.cc b/test/cpp/util/cli_credentials.cc
index aa4eafb756..d14dc18f16 100644
--- a/test/cpp/util/cli_credentials.cc
+++ b/test/cpp/util/cli_credentials.cc
@@ -25,6 +25,10 @@ DEFINE_bool(use_auth, false, "Whether to create default google credentials.");
 DEFINE_string(
     access_token, "",
     "The access token that will be sent to the server to authenticate RPCs.");
+DEFINE_string(
+    ssl_target, "",
+    "If not empty, treat the server host name as this for ssl/tls certificate "
+    "validation.");
 
 namespace grpc {
 namespace testing {
@@ -58,7 +62,15 @@ const grpc::string CliCredentials::GetCredentialUsage() const {
          "    --use_auth               ; Set whether to create default google"
          " credentials\n"
          "    --access_token           ; Set the access token in metadata,"
-         " overrides --use_auth\n";
+         " overrides --use_auth\n"
+         "    --ssl_target             ; Set server host for tls validation\n";
+}
+
+const grpc::string CliCredentials::GetSslTargetNameOverride() const {
+  bool use_tls =
+      FLAGS_enable_ssl || (FLAGS_access_token.empty() && FLAGS_use_auth);
+  return use_tls ? FLAGS_ssl_target : "";
 }
+
 }  // namespace testing
 }  // namespace grpc
diff --git a/test/cpp/util/cli_credentials.h b/test/cpp/util/cli_credentials.h
index b1358e77d8..8d662356de 100644
--- a/test/cpp/util/cli_credentials.h
+++ b/test/cpp/util/cli_credentials.h
@@ -30,6 +30,7 @@ class CliCredentials {
   virtual ~CliCredentials() {}
   virtual std::shared_ptr<grpc::ChannelCredentials> GetCredentials() const;
   virtual const grpc::string GetCredentialUsage() const;
+  virtual const grpc::string GetSslTargetNameOverride() const;
 };
 
 }  // namespace testing
diff --git a/test/cpp/util/grpc_tool.cc b/test/cpp/util/grpc_tool.cc
index 840ca07d2b..ccc60cca27 100644
--- a/test/cpp/util/grpc_tool.cc
+++ b/test/cpp/util/grpc_tool.cc
@@ -206,6 +206,15 @@ void ReadResponse(CliCall* call, const grpc::string& method_name,
   }
 }
 
+std::shared_ptr<grpc::Channel> CreateCliChannel(
+    const grpc::string& server_address, const CliCredentials& cred) {
+  grpc::ChannelArguments args;
+  if (!cred.GetSslTargetNameOverride().empty()) {
+    args.SetSslTargetNameOverride(cred.GetSslTargetNameOverride());
+  }
+  return grpc::CreateCustomChannel(server_address, cred.GetCredentials(), args);
+}
+
 struct Command {
   const char* command;
   std::function<bool(GrpcTool*, int, const char**, const CliCredentials&,
@@ -324,7 +333,7 @@ bool GrpcTool::ListServices(int argc, const char** argv,
 
   grpc::string server_address(argv[0]);
   std::shared_ptr<grpc::Channel> channel =
-      grpc::CreateChannel(server_address, cred.GetCredentials());
+      CreateCliChannel(server_address, cred);
   grpc::ProtoReflectionDescriptorDatabase desc_db(channel);
   grpc::protobuf::DescriptorPool desc_pool(&desc_db);
 
@@ -422,7 +431,7 @@ bool GrpcTool::PrintType(int argc, const char** argv,
 
   grpc::string server_address(argv[0]);
   std::shared_ptr<grpc::Channel> channel =
-      grpc::CreateChannel(server_address, cred.GetCredentials());
+      CreateCliChannel(server_address, cred);
   grpc::ProtoReflectionDescriptorDatabase desc_db(channel);
   grpc::protobuf::DescriptorPool desc_pool(&desc_db);
 
@@ -469,7 +478,7 @@ bool GrpcTool::CallMethod(int argc, const char** argv,
   bool print_mode = false;
 
   std::shared_ptr<grpc::Channel> channel =
-      grpc::CreateChannel(server_address, cred.GetCredentials());
+      CreateCliChannel(server_address, cred);
 
   if (!FLAGS_binary_input || !FLAGS_binary_output) {
     parser.reset(
@@ -820,7 +829,7 @@ bool GrpcTool::ParseMessage(int argc, const char** argv,
 
   if (!FLAGS_binary_input || !FLAGS_binary_output) {
     std::shared_ptr<grpc::Channel> channel =
-        grpc::CreateChannel(server_address, cred.GetCredentials());
+        CreateCliChannel(server_address, cred);
     parser.reset(
         new grpc::testing::ProtoFileParser(FLAGS_remotedb ? channel : nullptr,
                                            FLAGS_proto_path, FLAGS_protofiles));
diff --git a/test/cpp/util/grpc_tool_test.cc b/test/cpp/util/grpc_tool_test.cc
index 6574d1bb44..7e7f44551e 100644
--- a/test/cpp/util/grpc_tool_test.cc
+++ b/test/cpp/util/grpc_tool_test.cc
@@ -35,6 +35,7 @@
 #include "src/core/lib/gpr/env.h"
 #include "src/proto/grpc/testing/echo.grpc.pb.h"
 #include "src/proto/grpc/testing/echo.pb.h"
+#include "test/core/end2end/data/ssl_test_data.h"
 #include "test/core/util/port.h"
 #include "test/core/util/test_config.h"
 #include "test/cpp/util/cli_credentials.h"
@@ -80,6 +81,9 @@ using grpc::testing::EchoResponse;
   "  peer: \"peer\"\n"        \
   "}\n\n"
 
+DECLARE_bool(enable_ssl);
+DECLARE_string(ssl_target);
+
 namespace grpc {
 namespace testing {
 
@@ -97,10 +101,18 @@ const int kServerDefaultResponseStreamsToSend = 3;
 
 class TestCliCredentials final : public grpc::testing::CliCredentials {
  public:
+  TestCliCredentials(bool secure = false) : secure_(secure) {}
   std::shared_ptr<grpc::ChannelCredentials> GetCredentials() const override {
-    return InsecureChannelCredentials();
+    if (!secure_) {
+      return InsecureChannelCredentials();
+    }
+    SslCredentialsOptions ssl_opts = {test_root_cert, "", ""};
+    return SslCredentials(grpc::SslCredentialsOptions(ssl_opts));
   }
   const grpc::string GetCredentialUsage() const override { return ""; }
+
+ private:
+  const bool secure_;
 };
 
 bool PrintStream(std::stringstream* ss, const grpc::string& output) {
@@ -206,13 +218,24 @@ class GrpcToolTest : public ::testing::Test {
   // SetUpServer cannot be used with EXPECT_EXIT. grpc_pick_unused_port_or_die()
   // uses atexit() to free chosen ports, and it will spawn a new thread in
   // resolve_address_posix.c:192 at exit time.
-  const grpc::string SetUpServer() {
+  const grpc::string SetUpServer(bool secure = false) {
     std::ostringstream server_address;
     int port = grpc_pick_unused_port_or_die();
     server_address << "localhost:" << port;
     // Setup server
     ServerBuilder builder;
-    builder.AddListeningPort(server_address.str(), InsecureServerCredentials());
+    std::shared_ptr<grpc::ServerCredentials> creds;
+    if (secure) {
+      SslServerCredentialsOptions::PemKeyCertPair pkcp = {test_server1_key,
+                                                          test_server1_cert};
+      SslServerCredentialsOptions ssl_opts;
+      ssl_opts.pem_root_certs = "";
+      ssl_opts.pem_key_cert_pairs.push_back(pkcp);
+      creds = SslServerCredentials(ssl_opts);
+    } else {
+      creds = InsecureServerCredentials();
+    }
+    builder.AddListeningPort(server_address.str(), creds);
     builder.RegisterService(&service_);
     server_ = builder.BuildAndStart();
     return server_address.str();
@@ -743,6 +766,29 @@ TEST_F(GrpcToolTest, CallCommandWithBadMetadata) {
   gpr_free(test_srcdir);
 }
 
+TEST_F(GrpcToolTest, ListCommand_OverrideSslHostName) {
+  const grpc::string server_address = SetUpServer(true);
+
+  // Test input "grpc_cli ls localhost:<port> --enable_ssl
+  // --ssl_target=z.test.google.fr"
+  std::stringstream output_stream;
+  const char* argv[] = {"grpc_cli", "ls", server_address.c_str()};
+  FLAGS_l = false;
+  FLAGS_enable_ssl = true;
+  FLAGS_ssl_target = "z.test.google.fr";
+  EXPECT_TRUE(
+      0 == GrpcToolMainLib(
+               ArraySize(argv), argv, TestCliCredentials(true),
+               std::bind(PrintStream, &output_stream, std::placeholders::_1)));
+  EXPECT_TRUE(0 == strcmp(output_stream.str().c_str(),
+                          "grpc.testing.EchoTestService\n"
+                          "grpc.reflection.v1alpha.ServerReflection\n"));
+
+  FLAGS_enable_ssl = false;
+  FLAGS_ssl_target = "";
+  ShutdownServer();
+}
+
 }  // namespace testing
 }  // namespace grpc