grpc 1.26.0 → 1.27.0.pre1

data/src/core/lib/security/credentials/composite/composite_credentials.cc

@@ -151,6 +151,13 @@ grpc_composite_call_credentials::grpc_composite_call_credentials(
   inner_.reserve(size);
   push_to_inner(std::move(creds1), creds1_is_composite);
   push_to_inner(std::move(creds2), creds2_is_composite);
+  min_security_level_ = GRPC_SECURITY_NONE;
+  for (size_t i = 0; i < inner_.size(); ++i) {
+    if (static_cast<int>(min_security_level_) <
+        static_cast<int>(inner_[i]->min_security_level())) {
+      min_security_level_ = inner_[i]->min_security_level();
+    }
+  }
 }
 
 static grpc_core::RefCountedPtr<grpc_call_credentials>

data/src/core/lib/security/credentials/composite/composite_credentials.h

@@ -86,12 +86,16 @@ class grpc_composite_call_credentials : public grpc_call_credentials {
   void cancel_get_request_metadata(grpc_credentials_mdelem_array* md_array,
                                    grpc_error* error) override;
 
+  grpc_security_level min_security_level() const override {
+    return min_security_level_;
+  }
+
   const CallCredentialsList& inner() const { return inner_; }
 
  private:
   void push_to_inner(grpc_core::RefCountedPtr<grpc_call_credentials> creds,
                      bool is_composite);
-
+  grpc_security_level min_security_level_;
   CallCredentialsList inner_;
 };
 

data/src/core/lib/security/credentials/credentials.h

@@ -225,7 +225,11 @@ void grpc_credentials_mdelem_array_destroy(grpc_credentials_mdelem_array* list);
 struct grpc_call_credentials
     : public grpc_core::RefCounted<grpc_call_credentials> {
  public:
-  explicit grpc_call_credentials(const char* type) : type_(type) {}
+  explicit grpc_call_credentials(
+      const char* type,
+      grpc_security_level min_security_level = GRPC_PRIVACY_AND_INTEGRITY)
+      : type_(type), min_security_level_(min_security_level) {}
+
   virtual ~grpc_call_credentials() = default;
 
   // Returns true if completed synchronously, in which case \a error will
@@ -244,10 +248,15 @@ struct grpc_call_credentials
   virtual void cancel_get_request_metadata(
       grpc_credentials_mdelem_array* md_array, grpc_error* error) = 0;
 
+  virtual grpc_security_level min_security_level() const {
+    return min_security_level_;
+  }
+
   const char* type() const { return type_; }
 
  private:
   const char* type_;
+  const grpc_security_level min_security_level_;
 };
 
 /* Metadata-only credentials with the specified key and value where

data/src/core/lib/security/credentials/fake/fake_credentials.h

@@ -59,7 +59,8 @@ class grpc_md_only_test_credentials : public grpc_call_credentials {
  public:
   grpc_md_only_test_credentials(const char* md_key, const char* md_value,
                                 bool is_async)
-      : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_OAUTH2),
+      : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_OAUTH2,
+                              GRPC_SECURITY_NONE),
         md_(grpc_mdelem_from_slices(grpc_slice_from_copied_string(md_key),
                                     grpc_slice_from_copied_string(md_value))),
         is_async_(is_async) {}

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -611,7 +611,7 @@ class StsTokenFetcherCredentials
     MaybeAddToBody(&body_strvec, "scope", scope_.get());
     MaybeAddToBody(&body_strvec, "requested_token_type",
                    requested_token_type_.get());
-    if (actor_token_path_ != nullptr) {
+    if ((actor_token_path_ != nullptr) && *actor_token_path_ != '\0') {
       err = LoadTokenFile(actor_token_path_.get(), &actor_token);
       if (err != GRPC_ERROR_NONE) return cleanup();
       MaybeAddToBody(

data/src/core/lib/security/credentials/plugin/plugin_credentials.cc

@@ -240,15 +240,17 @@ void grpc_plugin_credentials::cancel_get_request_metadata(
 }
 
 grpc_plugin_credentials::grpc_plugin_credentials(
-    grpc_metadata_credentials_plugin plugin)
-    : grpc_call_credentials(plugin.type), plugin_(plugin) {
+    grpc_metadata_credentials_plugin plugin,
+    grpc_security_level min_security_level)
+    : grpc_call_credentials(plugin.type, min_security_level), plugin_(plugin) {
   gpr_mu_init(&mu_);
 }
 
 grpc_call_credentials* grpc_metadata_credentials_create_from_plugin(
-    grpc_metadata_credentials_plugin plugin, void* reserved) {
+    grpc_metadata_credentials_plugin plugin,
+    grpc_security_level min_security_level, void* reserved) {
   GRPC_API_TRACE("grpc_metadata_credentials_create_from_plugin(reserved=%p)", 1,
                  (reserved));
   GPR_ASSERT(reserved == nullptr);
-  return new grpc_plugin_credentials(plugin);
+  return new grpc_plugin_credentials(plugin, min_security_level);
 }

data/src/core/lib/security/credentials/plugin/plugin_credentials.h

@@ -39,7 +39,8 @@ struct grpc_plugin_credentials final : public grpc_call_credentials {
     struct pending_request* next;
   };
 
-  explicit grpc_plugin_credentials(grpc_metadata_credentials_plugin plugin);
+  explicit grpc_plugin_credentials(grpc_metadata_credentials_plugin plugin,
+                                   grpc_security_level min_security_level);
   ~grpc_plugin_credentials() override;
 
   bool get_request_metadata(grpc_polling_entity* pollent,

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc

@@ -92,6 +92,26 @@ int grpc_tls_credentials_options_set_cert_request_type(
   return 1;
 }
 
+int grpc_tls_credentials_options_set_server_verification_option(
+    grpc_tls_credentials_options* options,
+    grpc_tls_server_verification_option server_verification_option) {
+  if (options == nullptr) {
+    gpr_log(GPR_ERROR,
+            "Invalid nullptr arguments to "
+            "grpc_tls_credentials_options_set_server_verification_option()");
+    return 0;
+  }
+  if (server_verification_option != GRPC_TLS_SERVER_VERIFICATION &&
+      options->server_authorization_check_config() == nullptr) {
+    gpr_log(GPR_ERROR,
+            "server_authorization_check_config needs to be specified when"
+            "server_verification_option is not GRPC_TLS_SERVER_VERIFICATION");
+    return 0;
+  }
+  options->set_server_verification_option(server_verification_option);
+  return 1;
+}
+
 int grpc_tls_credentials_options_set_key_materials_config(
     grpc_tls_credentials_options* options,
     grpc_tls_key_materials_config* config) {

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -234,6 +234,9 @@ struct grpc_tls_credentials_options
   grpc_ssl_client_certificate_request_type cert_request_type() const {
     return cert_request_type_;
   }
+  grpc_tls_server_verification_option server_verification_option() const {
+    return server_verification_option_;
+  }
   grpc_tls_key_materials_config* key_materials_config() const {
     return key_materials_config_.get();
   }
@@ -250,6 +253,10 @@ struct grpc_tls_credentials_options
       const grpc_ssl_client_certificate_request_type type) {
     cert_request_type_ = type;
   }
+  void set_server_verification_option(
+      const grpc_tls_server_verification_option server_verification_option) {
+    server_verification_option_ = server_verification_option;
+  }
   void set_key_materials_config(
       grpc_core::RefCountedPtr<grpc_tls_key_materials_config> config) {
     key_materials_config_ = std::move(config);
@@ -266,6 +273,7 @@ struct grpc_tls_credentials_options
 
  private:
   grpc_ssl_client_certificate_request_type cert_request_type_;
+  grpc_tls_server_verification_option server_verification_option_;
   grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
   grpc_core::RefCountedPtr<grpc_tls_credential_reload_config>
       credential_reload_config_;

data/src/core/lib/security/credentials/tls/{spiffe_credentials.cc → tls_credentials.cc}

@@ -18,7 +18,7 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/security/credentials/tls/spiffe_credentials.h"
+#include "src/core/lib/security/credentials/tls/tls_credentials.h"
 
 #include <cstring>
 
@@ -28,24 +28,23 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/security/security_connector/tls/spiffe_security_connector.h"
+#include "src/core/lib/security/security_connector/tls/tls_security_connector.h"
 
-#define GRPC_CREDENTIALS_TYPE_SPIFFE "Spiffe"
+#define GRPC_CREDENTIALS_TYPE_TLS "Tls"
 
 namespace {
 
 bool CredentialOptionSanityCheck(const grpc_tls_credentials_options* options,
                                  bool is_client) {
   if (options == nullptr) {
-    gpr_log(GPR_ERROR, "SPIFFE TLS credentials options is nullptr.");
+    gpr_log(GPR_ERROR, "TLS credentials options is nullptr.");
     return false;
   }
   if (options->key_materials_config() == nullptr &&
       options->credential_reload_config() == nullptr) {
-    gpr_log(
-        GPR_ERROR,
-        "SPIFFE TLS credentials options must specify either key materials or "
-        "credential reload config.");
+    gpr_log(GPR_ERROR,
+            "TLS credentials options must specify either key materials or "
+            "credential reload config.");
     return false;
   }
   if (!is_client && options->server_authorization_check_config() != nullptr) {
@@ -58,15 +57,15 @@ bool CredentialOptionSanityCheck(const grpc_tls_credentials_options* options,
 
 }  // namespace
 
-SpiffeCredentials::SpiffeCredentials(
+TlsCredentials::TlsCredentials(
     grpc_core::RefCountedPtr<grpc_tls_credentials_options> options)
-    : grpc_channel_credentials(GRPC_CREDENTIALS_TYPE_SPIFFE),
+    : grpc_channel_credentials(GRPC_CREDENTIALS_TYPE_TLS),
       options_(std::move(options)) {}
 
-SpiffeCredentials::~SpiffeCredentials() {}
+TlsCredentials::~TlsCredentials() {}
 
 grpc_core::RefCountedPtr<grpc_channel_security_connector>
-SpiffeCredentials::create_security_connector(
+TlsCredentials::create_security_connector(
     grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
     const char* target_name, const grpc_channel_args* args,
     grpc_channel_args** new_args) {
@@ -84,8 +83,8 @@ SpiffeCredentials::create_security_connector(
           static_cast<tsi_ssl_session_cache*>(arg->value.pointer.p);
     }
   }
-  grpc_core::RefCountedPtr<grpc_channel_security_connector> sc = grpc_core::
-      SpiffeChannelSecurityConnector::CreateSpiffeChannelSecurityConnector(
+  grpc_core::RefCountedPtr<grpc_channel_security_connector> sc =
+      grpc_core::TlsChannelSecurityConnector::CreateTlsChannelSecurityConnector(
           this->Ref(), std::move(call_creds), target_name,
           overridden_target_name, ssl_session_cache);
   if (sc == nullptr) {
@@ -97,33 +96,33 @@ SpiffeCredentials::create_security_connector(
   return sc;
 }
 
-SpiffeServerCredentials::SpiffeServerCredentials(
+TlsServerCredentials::TlsServerCredentials(
     grpc_core::RefCountedPtr<grpc_tls_credentials_options> options)
-    : grpc_server_credentials(GRPC_CREDENTIALS_TYPE_SPIFFE),
+    : grpc_server_credentials(GRPC_CREDENTIALS_TYPE_TLS),
       options_(std::move(options)) {}
 
-SpiffeServerCredentials::~SpiffeServerCredentials() {}
+TlsServerCredentials::~TlsServerCredentials() {}
 
 grpc_core::RefCountedPtr<grpc_server_security_connector>
-SpiffeServerCredentials::create_security_connector() {
-  return grpc_core::SpiffeServerSecurityConnector::
-      CreateSpiffeServerSecurityConnector(this->Ref());
+TlsServerCredentials::create_security_connector() {
+  return grpc_core::TlsServerSecurityConnector::
+      CreateTlsServerSecurityConnector(this->Ref());
 }
 
-grpc_channel_credentials* grpc_tls_spiffe_credentials_create(
+grpc_channel_credentials* grpc_tls_credentials_create(
     grpc_tls_credentials_options* options) {
   if (!CredentialOptionSanityCheck(options, true /* is_client */)) {
     return nullptr;
   }
-  return new SpiffeCredentials(
+  return new TlsCredentials(
       grpc_core::RefCountedPtr<grpc_tls_credentials_options>(options));
 }
 
-grpc_server_credentials* grpc_tls_spiffe_server_credentials_create(
+grpc_server_credentials* grpc_tls_server_credentials_create(
     grpc_tls_credentials_options* options) {
   if (!CredentialOptionSanityCheck(options, false /* is_client */)) {
     return nullptr;
   }
-  return new SpiffeServerCredentials(
+  return new TlsServerCredentials(
       grpc_core::RefCountedPtr<grpc_tls_credentials_options>(options));
 }

data/src/core/lib/security/credentials/tls/{spiffe_credentials.h → tls_credentials.h}

@@ -16,8 +16,8 @@
  *
  */
 
-#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_SPIFFE_CREDENTIALS_H
-#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_SPIFFE_CREDENTIALS_H
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_TLS_CREDENTIALS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_TLS_CREDENTIALS_H
 
 #include <grpc/support/port_platform.h>
 
@@ -26,11 +26,11 @@
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 
-class SpiffeCredentials final : public grpc_channel_credentials {
+class TlsCredentials final : public grpc_channel_credentials {
  public:
-  explicit SpiffeCredentials(
+  explicit TlsCredentials(
       grpc_core::RefCountedPtr<grpc_tls_credentials_options> options);
-  ~SpiffeCredentials() override;
+  ~TlsCredentials() override;
 
   grpc_core::RefCountedPtr<grpc_channel_security_connector>
   create_security_connector(
@@ -44,11 +44,11 @@ class SpiffeCredentials final : public grpc_channel_credentials {
   grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
 };
 
-class SpiffeServerCredentials final : public grpc_server_credentials {
+class TlsServerCredentials final : public grpc_server_credentials {
  public:
-  explicit SpiffeServerCredentials(
+  explicit TlsServerCredentials(
       grpc_core::RefCountedPtr<grpc_tls_credentials_options> options);
-  ~SpiffeServerCredentials() override;
+  ~TlsServerCredentials() override;
 
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector() override;
@@ -59,4 +59,4 @@ class SpiffeServerCredentials final : public grpc_server_credentials {
   grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
 };
 
-#endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_SPIFFE_CREDENTIALS_H */
+#endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_TLS_CREDENTIALS_H */

data/src/core/lib/security/security_connector/alts/alts_security_connector.cc

@@ -178,6 +178,13 @@ grpc_alts_auth_context_from_tsi_peer(const tsi_peer* peer) {
     gpr_log(GPR_ERROR, "Invalid or missing certificate type property.");
     return nullptr;
   }
+  /* Check if security level exists. */
+  const tsi_peer_property* security_level_prop =
+      tsi_peer_get_property_by_name(peer, TSI_SECURITY_LEVEL_PEER_PROPERTY);
+  if (security_level_prop == nullptr) {
+    gpr_log(GPR_ERROR, "Missing security level property.");
+    return nullptr;
+  }
   /* Validate RPC protocol versions. */
   const tsi_peer_property* rpc_versions_prop =
       tsi_peer_get_property_by_name(peer, TSI_ALTS_RPC_VERSIONS);
@@ -232,6 +239,12 @@ grpc_alts_auth_context_from_tsi_peer(const tsi_peer* peer) {
                                      tsi_prop->value.data,
                                      tsi_prop->value.length);
     }
+    /* Add security level to auth context. */
+    if (strcmp(tsi_prop->name, TSI_SECURITY_LEVEL_PEER_PROPERTY) == 0) {
+      grpc_auth_context_add_property(
+          ctx.get(), GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME,
+          tsi_prop->value.data, tsi_prop->value.length);
+    }
   }
   if (!grpc_auth_context_peer_is_authenticated(ctx.get())) {
     gpr_log(GPR_ERROR, "Invalid unauthenticated peer.");

data/src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -219,9 +219,9 @@ static void fake_check_peer(
   const char* prop_name;
   grpc_error* error = GRPC_ERROR_NONE;
   *auth_context = nullptr;
-  if (peer.property_count != 1) {
+  if (peer.property_count != 2) {
     error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "Fake peers should only have 1 property.");
+        "Fake peers should only have 2 properties.");
     goto end;
   }
   prop_name = peer.properties[0].name;
@@ -240,10 +240,30 @@ static void fake_check_peer(
         "Invalid value for cert type property.");
     goto end;
   }
+  prop_name = peer.properties[1].name;
+  if (prop_name == nullptr ||
+      strcmp(prop_name, TSI_SECURITY_LEVEL_PEER_PROPERTY) != 0) {
+    char* msg;
+    gpr_asprintf(&msg, "Unexpected property in fake peer: %s.",
+                 prop_name == nullptr ? "<EMPTY>" : prop_name);
+    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
+    gpr_free(msg);
+    goto end;
+  }
+  if (strncmp(peer.properties[1].value.data, TSI_FAKE_SECURITY_LEVEL,
+              peer.properties[1].value.length) != 0) {
+    error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "Invalid value for security level property.");
+    goto end;
+  }
+
   *auth_context = grpc_core::MakeRefCounted<grpc_auth_context>(nullptr);
   grpc_auth_context_add_cstring_property(
       auth_context->get(), GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
       GRPC_FAKE_TRANSPORT_SECURITY_TYPE);
+  grpc_auth_context_add_cstring_property(
+      auth_context->get(), GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME,
+      TSI_FAKE_SECURITY_LEVEL);
 end:
   grpc_core::ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
   tsi_peer_destruct(&peer);

data/src/core/lib/security/security_connector/load_system_roots_fallback.cc

@@ -21,7 +21,7 @@
 #include <grpc/slice_buffer.h>
 #include "src/core/lib/security/security_connector/load_system_roots.h"
 
-#ifndef GPR_LINUX
+#if !defined(GPR_LINUX) && !defined(GPR_ANDROID)
 
 namespace grpc_core {
 
@@ -29,4 +29,4 @@ grpc_slice LoadSystemRootCerts() { return grpc_empty_slice(); }
 
 }  // namespace grpc_core
 
-#endif /* GPR_LINUX */
+#endif /* !(GPR_LINUX || GPR_ANDROID) */

data/src/core/lib/security/security_connector/load_system_roots_linux.cc

@@ -21,7 +21,7 @@
 #include <grpc/slice_buffer.h>
 #include "src/core/lib/security/security_connector/load_system_roots_linux.h"
 
-#ifdef GPR_LINUX
+#if defined(GPR_LINUX) || defined(GPR_ANDROID)
 
 #include "src/core/lib/security/security_connector/load_system_roots.h"
 
@@ -167,4 +167,4 @@ grpc_slice LoadSystemRootCerts() {
 
 }  // namespace grpc_core
 
-#endif /* GPR_LINUX */
+#endif /* GPR_LINUX || GPR_ANDROID */

data/src/core/lib/security/security_connector/local/local_security_connector.cc

@@ -46,7 +46,8 @@
 
 namespace {
 
-grpc_core::RefCountedPtr<grpc_auth_context> local_auth_context_create() {
+grpc_core::RefCountedPtr<grpc_auth_context> local_auth_context_create(
+    const tsi_peer* peer) {
   /* Create auth context. */
   grpc_core::RefCountedPtr<grpc_auth_context> ctx =
       grpc_core::MakeRefCounted<grpc_auth_context>(nullptr);
@@ -55,10 +56,17 @@ grpc_core::RefCountedPtr<grpc_auth_context> local_auth_context_create() {
       GRPC_LOCAL_TRANSPORT_SECURITY_TYPE);
   GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name(
                  ctx.get(), GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME) == 1);
+  GPR_ASSERT(peer->property_count == 1);
+  const tsi_peer_property* prop = &peer->properties[0];
+  GPR_ASSERT(prop != nullptr);
+  GPR_ASSERT(strcmp(prop->name, TSI_SECURITY_LEVEL_PEER_PROPERTY) == 0);
+  grpc_auth_context_add_property(ctx.get(),
+                                 GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME,
+                                 prop->value.data, prop->value.length);
   return ctx;
 }
 
-void local_check_peer(grpc_security_connector* /*sc*/, tsi_peer /*peer*/,
+void local_check_peer(grpc_security_connector* sc, tsi_peer peer,
                       grpc_endpoint* ep,
                       grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                       grpc_closure* on_peer_checked,
@@ -103,12 +111,31 @@ void local_check_peer(grpc_security_connector* /*sc*/, tsi_peer /*peer*/,
     grpc_core::ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
     return;
   }
+  // Add TSI_SECURITY_LEVEL_PEER_PROPERTY type peer property.
+  size_t new_property_count = peer.property_count + 1;
+  tsi_peer_property* new_properties = static_cast<tsi_peer_property*>(
+      gpr_zalloc(sizeof(*new_properties) * new_property_count));
+  for (size_t i = 0; i < peer.property_count; i++) {
+    new_properties[i] = peer.properties[i];
+  }
+  if (peer.properties != nullptr) gpr_free(peer.properties);
+  peer.properties = new_properties;
+  const char* security_level =
+      type == LOCAL_TCP
+          ? tsi_security_level_to_string(TSI_SECURITY_NONE)
+          : tsi_security_level_to_string(TSI_PRIVACY_AND_INTEGRITY);
+  tsi_result result = tsi_construct_string_peer_property_from_cstring(
+      TSI_SECURITY_LEVEL_PEER_PROPERTY, security_level,
+      &peer.properties[peer.property_count]);
+  if (result != TSI_OK) return;
+  peer.property_count++;
   /* Create an auth context which is necessary to pass the santiy check in
    * {client, server}_auth_filter that verifies if the peer's auth context is
    * obtained during handshakes. The auth context is only checked for its
    * existence and not actually used.
    */
-  *auth_context = local_auth_context_create();
+  *auth_context = local_auth_context_create(&peer);
+  tsi_peer_destruct(&peer);
   error = *auth_context != nullptr ? GRPC_ERROR_NONE
                                    : GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                                          "Could not create local auth context");