grpc 1.15.0 → 1.30.0

data/src/core/lib/security/context/security_context.h

@@ -21,91 +21,122 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/lib/gprpp/arena.h"
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/pollset.h"
 #include "src/core/lib/security/credentials/credentials.h"
 
 extern grpc_core::DebugOnlyTraceFlag grpc_trace_auth_context_refcount;
 
-struct gpr_arena;
-
 /* --- grpc_auth_context ---
 
    High level authentication context object. Can optionally be chained. */
 
 /* Property names are always NULL terminated. */
 
-typedef struct {
-  grpc_auth_property* array;
-  size_t count;
-  size_t capacity;
-} grpc_auth_property_array;
-
-struct grpc_auth_context {
-  struct grpc_auth_context* chained;
-  grpc_auth_property_array properties;
-  gpr_refcount refcount;
-  const char* peer_identity_property_name;
-  grpc_pollset* pollset;
+struct grpc_auth_property_array {
+  grpc_auth_property* array = nullptr;
+  size_t count = 0;
+  size_t capacity = 0;
 };
 
-/* Creation. */
-grpc_auth_context* grpc_auth_context_create(grpc_auth_context* chained);
-
-/* Refcounting. */
-#ifndef NDEBUG
-#define GRPC_AUTH_CONTEXT_REF(p, r) \
-  grpc_auth_context_ref((p), __FILE__, __LINE__, (r))
-#define GRPC_AUTH_CONTEXT_UNREF(p, r) \
-  grpc_auth_context_unref((p), __FILE__, __LINE__, (r))
-grpc_auth_context* grpc_auth_context_ref(grpc_auth_context* policy,
-                                         const char* file, int line,
-                                         const char* reason);
-void grpc_auth_context_unref(grpc_auth_context* policy, const char* file,
-                             int line, const char* reason);
-#else
-#define GRPC_AUTH_CONTEXT_REF(p, r) grpc_auth_context_ref((p))
-#define GRPC_AUTH_CONTEXT_UNREF(p, r) grpc_auth_context_unref((p))
-grpc_auth_context* grpc_auth_context_ref(grpc_auth_context* policy);
-void grpc_auth_context_unref(grpc_auth_context* policy);
-#endif
-
 void grpc_auth_property_reset(grpc_auth_property* property);
 
+// This type is forward declared as a C struct and we cannot define it as a
+// class. Otherwise, compiler will complain about type mismatch due to
+// -Wmismatched-tags.
+struct grpc_auth_context
+    : public grpc_core::RefCounted<grpc_auth_context,
+                                   grpc_core::NonPolymorphicRefCount> {
+ public:
+  explicit grpc_auth_context(
+      grpc_core::RefCountedPtr<grpc_auth_context> chained)
+      : grpc_core::RefCounted<grpc_auth_context,
+                              grpc_core::NonPolymorphicRefCount>(
+            &grpc_trace_auth_context_refcount),
+        chained_(std::move(chained)) {
+    if (chained_ != nullptr) {
+      peer_identity_property_name_ = chained_->peer_identity_property_name_;
+    }
+  }
+
+  ~grpc_auth_context() {
+    chained_.reset(DEBUG_LOCATION, "chained");
+    if (properties_.array != nullptr) {
+      for (size_t i = 0; i < properties_.count; i++) {
+        grpc_auth_property_reset(&properties_.array[i]);
+      }
+      gpr_free(properties_.array);
+    }
+  }
+
+  const grpc_auth_context* chained() const { return chained_.get(); }
+  const grpc_auth_property_array& properties() const { return properties_; }
+
+  bool is_authenticated() const {
+    return peer_identity_property_name_ != nullptr;
+  }
+  const char* peer_identity_property_name() const {
+    return peer_identity_property_name_;
+  }
+  void set_peer_identity_property_name(const char* name) {
+    peer_identity_property_name_ = name;
+  }
+
+  void ensure_capacity();
+  void add_property(const char* name, const char* value, size_t value_length);
+  void add_cstring_property(const char* name, const char* value);
+
+ private:
+  grpc_core::RefCountedPtr<grpc_auth_context> chained_;
+  grpc_auth_property_array properties_;
+  const char* peer_identity_property_name_ = nullptr;
+};
+
 /* --- grpc_security_context_extension ---
 
    Extension to the security context that may be set in a filter and accessed
    later by a higher level method on a grpc_call object. */
 
-typedef struct {
-  void* instance;
-  void (*destroy)(void*);
-} grpc_security_context_extension;
+struct grpc_security_context_extension {
+  void* instance = nullptr;
+  void (*destroy)(void*) = nullptr;
+};
 
 /* --- grpc_client_security_context ---
 
    Internal client-side security context. */
 
-typedef struct {
-  grpc_call_credentials* creds;
-  grpc_auth_context* auth_context;
+struct grpc_client_security_context {
+  explicit grpc_client_security_context(
+      grpc_core::RefCountedPtr<grpc_call_credentials> creds)
+      : creds(std::move(creds)) {}
+  ~grpc_client_security_context();
+
+  grpc_core::RefCountedPtr<grpc_call_credentials> creds;
+  grpc_core::RefCountedPtr<grpc_auth_context> auth_context;
   grpc_security_context_extension extension;
-} grpc_client_security_context;
+};
 
 grpc_client_security_context* grpc_client_security_context_create(
-    gpr_arena* arena);
+    grpc_core::Arena* arena, grpc_call_credentials* creds);
 void grpc_client_security_context_destroy(void* ctx);
 
 /* --- grpc_server_security_context ---
 
    Internal server-side security context. */
 
-typedef struct {
-  grpc_auth_context* auth_context;
+struct grpc_server_security_context {
+  grpc_server_security_context() = default;
+  ~grpc_server_security_context();
+
+  grpc_core::RefCountedPtr<grpc_auth_context> auth_context;
   grpc_security_context_extension extension;
-} grpc_server_security_context;
+};
 
 grpc_server_security_context* grpc_server_security_context_create(
-    gpr_arena* arena);
+    grpc_core::Arena* arena);
 void grpc_server_security_context_destroy(void* ctx);
 
 /* --- Channel args for auth context --- */

data/src/core/lib/security/credentials/alts/alts_credentials.cc

@@ -28,45 +28,56 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
-#include "src/core/lib/security/security_connector/alts_security_connector.h"
+#include "src/core/lib/security/security_connector/alts/alts_security_connector.h"
 
 #define GRPC_CREDENTIALS_TYPE_ALTS "Alts"
-#define GRPC_ALTS_HANDSHAKER_SERVICE_URL "metadata.google.internal:8080"
+#define GRPC_ALTS_HANDSHAKER_SERVICE_URL "metadata.google.internal.:8080"
 
-static void alts_credentials_destruct(grpc_channel_credentials* creds) {
-  grpc_alts_credentials* alts_creds =
-      reinterpret_cast<grpc_alts_credentials*>(creds);
-  grpc_alts_credentials_options_destroy(alts_creds->options);
-  gpr_free(alts_creds->handshaker_service_url);
+grpc_alts_credentials::grpc_alts_credentials(
+    const grpc_alts_credentials_options* options,
+    const char* handshaker_service_url)
+    : grpc_channel_credentials(GRPC_CREDENTIALS_TYPE_ALTS),
+      options_(grpc_alts_credentials_options_copy(options)),
+      handshaker_service_url_(handshaker_service_url == nullptr
+                                  ? gpr_strdup(GRPC_ALTS_HANDSHAKER_SERVICE_URL)
+                                  : gpr_strdup(handshaker_service_url)) {
+  grpc_alts_set_rpc_protocol_versions(&options_->rpc_versions);
 }
 
-static void alts_server_credentials_destruct(grpc_server_credentials* creds) {
-  grpc_alts_server_credentials* alts_creds =
-      reinterpret_cast<grpc_alts_server_credentials*>(creds);
-  grpc_alts_credentials_options_destroy(alts_creds->options);
-  gpr_free(alts_creds->handshaker_service_url);
+grpc_alts_credentials::~grpc_alts_credentials() {
+  grpc_alts_credentials_options_destroy(options_);
+  gpr_free(handshaker_service_url_);
 }
 
-static grpc_security_status alts_create_security_connector(
-    grpc_channel_credentials* creds,
-    grpc_call_credentials* request_metadata_creds, const char* target_name,
-    const grpc_channel_args* args, grpc_channel_security_connector** sc,
-    grpc_channel_args** new_args) {
+grpc_core::RefCountedPtr<grpc_channel_security_connector>
+grpc_alts_credentials::create_security_connector(
+    grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+    const char* target_name, const grpc_channel_args* /*args*/,
+    grpc_channel_args** /*new_args*/) {
   return grpc_alts_channel_security_connector_create(
-      creds, request_metadata_creds, target_name, sc);
+      this->Ref(), std::move(call_creds), target_name);
 }
 
-static grpc_security_status alts_server_create_security_connector(
-    grpc_server_credentials* creds, grpc_server_security_connector** sc) {
-  return grpc_alts_server_security_connector_create(creds, sc);
+grpc_alts_server_credentials::grpc_alts_server_credentials(
+    const grpc_alts_credentials_options* options,
+    const char* handshaker_service_url)
+    : grpc_server_credentials(GRPC_CREDENTIALS_TYPE_ALTS),
+      options_(grpc_alts_credentials_options_copy(options)),
+      handshaker_service_url_(handshaker_service_url == nullptr
+                                  ? gpr_strdup(GRPC_ALTS_HANDSHAKER_SERVICE_URL)
+                                  : gpr_strdup(handshaker_service_url)) {
+  grpc_alts_set_rpc_protocol_versions(&options_->rpc_versions);
 }
 
-static const grpc_channel_credentials_vtable alts_credentials_vtable = {
-    alts_credentials_destruct, alts_create_security_connector,
-    /*duplicate_without_call_credentials=*/nullptr};
+grpc_core::RefCountedPtr<grpc_server_security_connector>
+grpc_alts_server_credentials::create_security_connector() {
+  return grpc_alts_server_security_connector_create(this->Ref());
+}
 
-static const grpc_server_credentials_vtable alts_server_credentials_vtable = {
-    alts_server_credentials_destruct, alts_server_create_security_connector};
+grpc_alts_server_credentials::~grpc_alts_server_credentials() {
+  grpc_alts_credentials_options_destroy(options_);
+  gpr_free(handshaker_service_url_);
+}
 
 grpc_channel_credentials* grpc_alts_credentials_create_customized(
     const grpc_alts_credentials_options* options,
@@ -74,17 +85,7 @@ grpc_channel_credentials* grpc_alts_credentials_create_customized(
   if (!enable_untrusted_alts && !grpc_alts_is_running_on_gcp()) {
     return nullptr;
   }
-  auto creds = static_cast<grpc_alts_credentials*>(
-      gpr_zalloc(sizeof(grpc_alts_credentials)));
-  creds->options = grpc_alts_credentials_options_copy(options);
-  creds->handshaker_service_url =
-      handshaker_service_url == nullptr
-          ? gpr_strdup(GRPC_ALTS_HANDSHAKER_SERVICE_URL)
-          : gpr_strdup(handshaker_service_url);
-  creds->base.type = GRPC_CREDENTIALS_TYPE_ALTS;
-  creds->base.vtable = &alts_credentials_vtable;
-  gpr_ref_init(&creds->base.refcount, 1);
-  return &creds->base;
+  return new grpc_alts_credentials(options, handshaker_service_url);
 }
 
 grpc_server_credentials* grpc_alts_server_credentials_create_customized(
@@ -93,17 +94,7 @@ grpc_server_credentials* grpc_alts_server_credentials_create_customized(
   if (!enable_untrusted_alts && !grpc_alts_is_running_on_gcp()) {
     return nullptr;
   }
-  auto creds = static_cast<grpc_alts_server_credentials*>(
-      gpr_zalloc(sizeof(grpc_alts_server_credentials)));
-  creds->options = grpc_alts_credentials_options_copy(options);
-  creds->handshaker_service_url =
-      handshaker_service_url == nullptr
-          ? gpr_strdup(GRPC_ALTS_HANDSHAKER_SERVICE_URL)
-          : gpr_strdup(handshaker_service_url);
-  creds->base.type = GRPC_CREDENTIALS_TYPE_ALTS;
-  creds->base.vtable = &alts_server_credentials_vtable;
-  gpr_ref_init(&creds->base.refcount, 1);
-  return &creds->base;
+  return new grpc_alts_server_credentials(options, handshaker_service_url);
 }
 
 grpc_channel_credentials* grpc_alts_credentials_create(

data/src/core/lib/security/credentials/alts/alts_credentials.h

@@ -27,18 +27,45 @@
 #include "src/core/lib/security/credentials/credentials.h"
 
 /* Main struct for grpc ALTS channel credential. */
-typedef struct grpc_alts_credentials {
-  grpc_channel_credentials base;
-  grpc_alts_credentials_options* options;
-  char* handshaker_service_url;
-} grpc_alts_credentials;
+class grpc_alts_credentials final : public grpc_channel_credentials {
+ public:
+  grpc_alts_credentials(const grpc_alts_credentials_options* options,
+                        const char* handshaker_service_url);
+  ~grpc_alts_credentials() override;
+
+  grpc_core::RefCountedPtr<grpc_channel_security_connector>
+  create_security_connector(
+      grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+      const char* target_name, const grpc_channel_args* args,
+      grpc_channel_args** new_args) override;
+
+  const grpc_alts_credentials_options* options() const { return options_; }
+  grpc_alts_credentials_options* mutable_options() { return options_; }
+  const char* handshaker_service_url() const { return handshaker_service_url_; }
+
+ private:
+  grpc_alts_credentials_options* options_;
+  char* handshaker_service_url_;
+};
 
 /* Main struct for grpc ALTS server credential. */
-typedef struct grpc_alts_server_credentials {
-  grpc_server_credentials base;
-  grpc_alts_credentials_options* options;
-  char* handshaker_service_url;
-} grpc_alts_server_credentials;
+class grpc_alts_server_credentials final : public grpc_server_credentials {
+ public:
+  grpc_alts_server_credentials(const grpc_alts_credentials_options* options,
+                               const char* handshaker_service_url);
+  ~grpc_alts_server_credentials() override;
+
+  grpc_core::RefCountedPtr<grpc_server_security_connector>
+  create_security_connector() override;
+
+  const grpc_alts_credentials_options* options() const { return options_; }
+  grpc_alts_credentials_options* mutable_options() { return options_; }
+  const char* handshaker_service_url() const { return handshaker_service_url_; }
+
+ private:
+  grpc_alts_credentials_options* options_;
+  char* handshaker_service_url_;
+};
 
 /**
  * This method creates an ALTS channel credential object with customized

data/src/core/lib/security/credentials/alts/check_gcp_environment.cc

@@ -30,7 +30,7 @@
 const size_t kBiosDataBufferSize = 256;
 
 static char* trim(const char* src) {
-  if (src == nullptr) {
+  if (src == nullptr || *src == '\0') {
     return nullptr;
   }
   char* des = nullptr;

data/src/core/lib/security/credentials/alts/check_gcp_environment_no_op.cc

@@ -25,8 +25,8 @@
 #include <grpc/support/log.h>
 
 bool grpc_alts_is_running_on_gcp() {
-  gpr_log(GPR_ERROR,
-          "Platforms other than Linux and Windows are not supported");
+  gpr_log(GPR_INFO,
+          "ALTS: Platforms other than Linux and Windows are not supported");
   return false;
 }
 

data/src/core/lib/security/credentials/alts/check_gcp_environment_windows.cc

@@ -31,80 +31,68 @@
 #include <grpc/support/log.h>
 #include <grpc/support/sync.h>
 
-#define GRPC_ALTS_EXPECT_NAME_GOOGLE "Google"
-#define GRPC_ALTS_WINDOWS_CHECK_COMMAND "powershell.exe"
-#define GRPC_ALTS_WINDOWS_CHECK_COMMAND_ARGS \
-  "(Get-WmiObject -Class Win32_BIOS).Manufacturer"
-#define GRPC_ALTS_WINDOWS_CHECK_BIOS_FILE "windows_bios.data"
-
-const size_t kBiosDataBufferSize = 256;
-
-static bool g_compute_engine_detection_done = false;
-static bool g_is_on_compute_engine = false;
-static gpr_mu g_mu;
-static gpr_once g_once = GPR_ONCE_INIT;
-
 namespace grpc_core {
 namespace internal {
 
-bool check_bios_data(const char* bios_data_file) {
-  char* bios_data = read_bios_file(bios_data_file);
-  bool result = !strcmp(bios_data, GRPC_ALTS_EXPECT_NAME_GOOGLE);
-  remove(GRPC_ALTS_WINDOWS_CHECK_BIOS_FILE);
-  gpr_free(bios_data);
-  return result;
-}
+bool check_bios_data(const char*) { return false; }
 
-}  // namespace internal
-}  // namespace grpc_core
+bool check_windows_registry_product_name(HKEY root_key,
+                                         const char* reg_key_path,
+                                         const char* reg_key_name) {
+  const size_t kProductNameBufferSize = 256;
+  char const expected_substr[] = "Google";
 
-static void init_mu(void) { gpr_mu_init(&g_mu); }
+  // Get the size of the string first to allocate our buffer. This includes
+  // enough space for the trailing NUL character that will be included.
+  DWORD buffer_size{};
+  auto rc = ::RegGetValueA(
+      root_key, reg_key_path, reg_key_name, RRF_RT_REG_SZ,
+      nullptr,        // We know the type will be REG_SZ.
+      nullptr,        // We're only fetching the size; no buffer given yet.
+      &buffer_size);  // Fetch the size in bytes of the value, if it exists.
+  if (rc != 0) {
+    return false;
+  }
 
-static bool run_powershell() {
-  SECURITY_ATTRIBUTES sa;
-  sa.nLength = sizeof(sa);
-  sa.lpSecurityDescriptor = NULL;
-  sa.bInheritHandle = TRUE;
-  HANDLE h = CreateFile(_T(GRPC_ALTS_WINDOWS_CHECK_BIOS_FILE), GENERIC_WRITE,
-                        FILE_SHARE_WRITE | FILE_SHARE_READ, &sa, OPEN_ALWAYS,
-                        FILE_ATTRIBUTE_NORMAL, NULL);
-  if (h == INVALID_HANDLE_VALUE) {
-    gpr_log(GPR_ERROR, "CreateFile failed (%d).", GetLastError());
+  if (buffer_size > kProductNameBufferSize) {
     return false;
   }
-  PROCESS_INFORMATION pi;
-  STARTUPINFO si;
-  DWORD flags = CREATE_NO_WINDOW;
-  ZeroMemory(&pi, sizeof(pi));
-  ZeroMemory(&si, sizeof(si));
-  si.cb = sizeof(si);
-  si.dwFlags |= STARTF_USESTDHANDLES;
-  si.hStdInput = NULL;
-  si.hStdError = h;
-  si.hStdOutput = h;
-  TCHAR cmd[kBiosDataBufferSize];
-  _sntprintf(cmd, kBiosDataBufferSize, _T("%s %s"),
-             _T(GRPC_ALTS_WINDOWS_CHECK_COMMAND),
-             _T(GRPC_ALTS_WINDOWS_CHECK_COMMAND_ARGS));
-  if (!CreateProcess(NULL, cmd, NULL, NULL, TRUE, flags, NULL, NULL, &si,
-                     &pi)) {
-    gpr_log(GPR_ERROR, "CreateProcess failed (%d).\n", GetLastError());
+
+  // Retrieve the product name string.
+  char buffer[kProductNameBufferSize];
+  buffer_size = kProductNameBufferSize;
+  rc = ::RegGetValueA(
+      root_key, reg_key_path, reg_key_name, RRF_RT_REG_SZ,
+      nullptr,                     // We know the type will be REG_SZ.
+      static_cast<void*>(buffer),  // Fetch the string value this time.
+      &buffer_size);  // The string size in bytes, not including trailing NUL.
+  if (rc != 0) {
     return false;
   }
-  WaitForSingleObject(pi.hProcess, INFINITE);
-  CloseHandle(pi.hProcess);
-  CloseHandle(pi.hThread);
-  CloseHandle(h);
-  return true;
+
+  return strstr(buffer, expected_substr) != nullptr;
 }
 
+}  // namespace internal
+}  // namespace grpc_core
+
+static bool g_compute_engine_detection_done = false;
+static bool g_is_on_compute_engine = false;
+static gpr_mu g_mu;
+static gpr_once g_once = GPR_ONCE_INIT;
+
+static void init_mu(void) { gpr_mu_init(&g_mu); }
+
 bool grpc_alts_is_running_on_gcp() {
+  char const reg_key_path[] = "SYSTEM\\HardwareConfig\\Current\\";
+  char const reg_key_name[] = "SystemProductName";
+
   gpr_once_init(&g_once, init_mu);
   gpr_mu_lock(&g_mu);
   if (!g_compute_engine_detection_done) {
     g_is_on_compute_engine =
-        run_powershell() &&
-        grpc_core::internal::check_bios_data(GRPC_ALTS_WINDOWS_CHECK_BIOS_FILE);
+        grpc_core::internal::check_windows_registry_product_name(
+            HKEY_LOCAL_MACHINE, reg_key_path, reg_key_name);
     g_compute_engine_detection_done = true;
   }
   gpr_mu_unlock(&g_mu);