grpc 1.26.0 → 1.30.0

data/src/core/lib/security/credentials/credentials.cc

@@ -45,90 +45,6 @@ void grpc_channel_credentials_release(grpc_channel_credentials* creds) {
   if (creds) creds->Unref();
 }
 
-static std::map<grpc_core::UniquePtr<char>,
-                grpc_core::RefCountedPtr<grpc_channel_credentials>,
-                grpc_core::StringLess>* g_grpc_control_plane_creds;
-static gpr_mu g_control_plane_creds_mu;
-
-static void do_control_plane_creds_init() {
-  gpr_mu_init(&g_control_plane_creds_mu);
-  GPR_ASSERT(g_grpc_control_plane_creds == nullptr);
-  g_grpc_control_plane_creds =
-      new std::map<grpc_core::UniquePtr<char>,
-                   grpc_core::RefCountedPtr<grpc_channel_credentials>,
-                   grpc_core::StringLess>();
-}
-
-void grpc_control_plane_credentials_init() {
-  static gpr_once once_init_control_plane_creds = GPR_ONCE_INIT;
-  gpr_once_init(&once_init_control_plane_creds, do_control_plane_creds_init);
-}
-
-void grpc_test_only_control_plane_credentials_destroy() {
-  delete g_grpc_control_plane_creds;
-  g_grpc_control_plane_creds = nullptr;
-  gpr_mu_destroy(&g_control_plane_creds_mu);
-}
-
-void grpc_test_only_control_plane_credentials_force_init() {
-  if (g_grpc_control_plane_creds == nullptr) {
-    do_control_plane_creds_init();
-  }
-}
-
-bool grpc_channel_credentials_attach_credentials(
-    grpc_channel_credentials* credentials, const char* authority,
-    grpc_channel_credentials* control_plane_creds) {
-  grpc_core::ExecCtx exec_ctx;
-  return credentials->attach_credentials(authority, control_plane_creds->Ref());
-}
-
-bool grpc_control_plane_credentials_register(
-    const char* authority, grpc_channel_credentials* control_plane_creds) {
-  grpc_core::ExecCtx exec_ctx;
-  {
-    grpc_core::MutexLock lock(&g_control_plane_creds_mu);
-    auto key = grpc_core::UniquePtr<char>(gpr_strdup(authority));
-    if (g_grpc_control_plane_creds->find(key) !=
-        g_grpc_control_plane_creds->end()) {
-      return false;
-    }
-    (*g_grpc_control_plane_creds)[std::move(key)] = control_plane_creds->Ref();
-  }
-  return true;
-}
-
-bool grpc_channel_credentials::attach_credentials(
-    const char* authority,
-    grpc_core::RefCountedPtr<grpc_channel_credentials> control_plane_creds) {
-  auto key = grpc_core::UniquePtr<char>(gpr_strdup(authority));
-  if (local_control_plane_creds_.find(key) !=
-      local_control_plane_creds_.end()) {
-    return false;
-  }
-  local_control_plane_creds_[std::move(key)] = std::move(control_plane_creds);
-  return true;
-}
-
-grpc_core::RefCountedPtr<grpc_channel_credentials>
-grpc_channel_credentials::get_control_plane_credentials(const char* authority) {
-  {
-    auto key = grpc_core::UniquePtr<char>(gpr_strdup(authority));
-    auto local_lookup = local_control_plane_creds_.find(key);
-    if (local_lookup != local_control_plane_creds_.end()) {
-      return local_lookup->second;
-    }
-    {
-      grpc_core::MutexLock lock(&g_control_plane_creds_mu);
-      auto global_lookup = g_grpc_control_plane_creds->find(key);
-      if (global_lookup != g_grpc_control_plane_creds->end()) {
-        return global_lookup->second;
-      }
-    }
-  }
-  return duplicate_without_call_credentials();
-}
-
 void grpc_call_credentials_release(grpc_call_credentials* creds) {
   GRPC_API_TRACE("grpc_call_credentials_release(creds=%p)", 1, (creds));
   grpc_core::ExecCtx exec_ctx;

data/src/core/lib/security/credentials/credentials.h

@@ -21,14 +21,14 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <string.h>
+
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/sync.h>
 #include "src/core/lib/transport/metadata_batch.h"
 
-#include "src/core/lib/gprpp/map.h"
 #include "src/core/lib/gprpp/ref_counted.h"
-#include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/http/httpcli.h"
 #include "src/core/lib/http/parser.h"
 #include "src/core/lib/iomgr/polling_entity.h"
@@ -129,29 +129,10 @@ struct grpc_channel_credentials
     return args;
   }
 
-  // Attaches control_plane_creds to the local registry, under authority,
-  // if no other creds are currently registered under authority. Returns
-  // true if registered successfully and false if not.
-  bool attach_credentials(
-      const char* authority,
-      grpc_core::RefCountedPtr<grpc_channel_credentials> control_plane_creds);
-
-  // Gets the control plane credentials registered under authority. This
-  // prefers the local control plane creds registry but falls back to the
-  // global registry. Lastly, this returns self but with any attached
-  // call credentials stripped off, in the case that neither the local
-  // registry nor the global registry have an entry for authority.
-  grpc_core::RefCountedPtr<grpc_channel_credentials>
-  get_control_plane_credentials(const char* authority);
-
   const char* type() const { return type_; }
 
  private:
   const char* type_;
-  std::map<grpc_core::UniquePtr<char>,
-           grpc_core::RefCountedPtr<grpc_channel_credentials>,
-           grpc_core::StringLess>
-      local_control_plane_creds_;
 };
 
 /* Util to encapsulate the channel credentials in a channel arg. */
@@ -165,48 +146,12 @@ grpc_channel_credentials* grpc_channel_credentials_from_arg(
 grpc_channel_credentials* grpc_channel_credentials_find_in_args(
     const grpc_channel_args* args);
 
-/** EXPERIMENTAL.  API MAY CHANGE IN THE FUTURE.
-    Attaches \a control_plane_creds to \a credentials
-    under the key \a authority. Returns false if \a authority
-    is already present, in which case no changes are made.
-    Note that this API is not thread safe. Only one thread may
-    attach control plane creds to a given credentials object at
-    any one time, and new control plane creds must not be
-    attached after \a credentials has been used to create a channel. */
-bool grpc_channel_credentials_attach_credentials(
-    grpc_channel_credentials* credentials, const char* authority,
-    grpc_channel_credentials* control_plane_creds);
-
-/** EXPERIMENTAL.  API MAY CHANGE IN THE FUTURE.
-    Registers \a control_plane_creds in the global registry
-    under the key \a authority. Returns false if \a authority
-    is already present, in which case no changes are made. */
-bool grpc_control_plane_credentials_register(
-    const char* authority, grpc_channel_credentials* control_plane_creds);
-
-/* Initializes global control plane credentials data. */
-void grpc_control_plane_credentials_init();
-
-/* Test only: destroy global control plane credentials data.
- * This API is meant for use by a few tests that need to
- * satisdy grpc_core::LeakDetector. */
-void grpc_test_only_control_plane_credentials_destroy();
-
-/* Test only: force re-initialization of global control
- * plane credentials data if it was previously destroyed.
- * This API is meant to be used in
- * tandem with the
- * grpc_test_only_control_plane_credentials_destroy, for
- * the few tests that need it. */
-void grpc_test_only_control_plane_credentials_force_init();
-
 /* --- grpc_credentials_mdelem_array. --- */
 
-typedef struct {
+struct grpc_credentials_mdelem_array {
   grpc_mdelem* md = nullptr;
   size_t size = 0;
-} grpc_credentials_mdelem_array;
-
+};
 /// Takes a new ref to \a md.
 void grpc_credentials_mdelem_array_add(grpc_credentials_mdelem_array* list,
                                        grpc_mdelem md);
@@ -225,7 +170,11 @@ void grpc_credentials_mdelem_array_destroy(grpc_credentials_mdelem_array* list);
 struct grpc_call_credentials
     : public grpc_core::RefCounted<grpc_call_credentials> {
  public:
-  explicit grpc_call_credentials(const char* type) : type_(type) {}
+  explicit grpc_call_credentials(
+      const char* type,
+      grpc_security_level min_security_level = GRPC_PRIVACY_AND_INTEGRITY)
+      : type_(type), min_security_level_(min_security_level) {}
+
   virtual ~grpc_call_credentials() = default;
 
   // Returns true if completed synchronously, in which case \a error will
@@ -244,10 +193,19 @@ struct grpc_call_credentials
   virtual void cancel_get_request_metadata(
       grpc_credentials_mdelem_array* md_array, grpc_error* error) = 0;
 
+  virtual grpc_security_level min_security_level() const {
+    return min_security_level_;
+  }
+
+  virtual std::string debug_string() {
+    return "grpc_call_credentials did not provide debug string";
+  }
+
   const char* type() const { return type_; }
 
  private:
   const char* type_;
+  const grpc_security_level min_security_level_;
 };
 
 /* Metadata-only credentials with the specified key and value where

data/src/core/lib/security/credentials/fake/fake_credentials.h

@@ -21,6 +21,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <string.h>
+
 #include "src/core/lib/security/credentials/credentials.h"
 
 #define GRPC_ARG_FAKE_SECURITY_EXPECTED_TARGETS \
@@ -59,7 +61,8 @@ class grpc_md_only_test_credentials : public grpc_call_credentials {
  public:
   grpc_md_only_test_credentials(const char* md_key, const char* md_value,
                                 bool is_async)
-      : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_OAUTH2),
+      : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_OAUTH2,
+                              GRPC_SECURITY_NONE),
         md_(grpc_mdelem_from_slices(grpc_slice_from_copied_string(md_key),
                                     grpc_slice_from_copied_string(md_value))),
         is_async_(is_async) {}
@@ -74,6 +77,8 @@ class grpc_md_only_test_credentials : public grpc_call_credentials {
   void cancel_get_request_metadata(grpc_credentials_mdelem_array* md_array,
                                    grpc_error* error) override;
 
+  std::string debug_string() override { return "MD only Test Credentials"; };
+
  private:
   grpc_mdelem md_;
   bool is_async_;

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -44,6 +44,8 @@
 #include "src/core/lib/slice/slice_string_helpers.h"
 #include "src/core/lib/surface/api_trace.h"
 
+using grpc_core::Json;
+
 /* -- Constants. -- */
 
 #define GRPC_COMPUTE_ENGINE_DETECTION_HOST "metadata.google.internal."
@@ -66,13 +68,12 @@ static grpc_core::internal::grpc_gce_tenancy_checker g_gce_tenancy_checker =
 
 static void init_default_credentials(void) { gpr_mu_init(&g_state_mu); }
 
-typedef struct {
+struct metadata_server_detector {
   grpc_polling_entity pollent;
   int is_done;
   int success;
   grpc_http_response response;
-} metadata_server_detector;
-
+};
 grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_google_default_channel_credentials::create_security_connector(
     grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
@@ -216,24 +217,21 @@ static int is_metadata_server_reachable() {
 /* Takes ownership of creds_path if not NULL. */
 static grpc_error* create_default_creds_from_path(
     char* creds_path, grpc_core::RefCountedPtr<grpc_call_credentials>* creds) {
-  grpc_json* json = nullptr;
   grpc_auth_json_key key;
   grpc_auth_refresh_token token;
   grpc_core::RefCountedPtr<grpc_call_credentials> result;
   grpc_slice creds_data = grpc_empty_slice();
   grpc_error* error = GRPC_ERROR_NONE;
+  Json json;
   if (creds_path == nullptr) {
     error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("creds_path unset");
     goto end;
   }
   error = grpc_load_file(creds_path, 0, &creds_data);
-  if (error != GRPC_ERROR_NONE) {
-    goto end;
-  }
-  json = grpc_json_parse_string_with_len(
-      reinterpret_cast<char*> GRPC_SLICE_START_PTR(creds_data),
-      GRPC_SLICE_LENGTH(creds_data));
-  if (json == nullptr) {
+  if (error != GRPC_ERROR_NONE) goto end;
+  json = Json::Parse(grpc_core::StringViewFromSlice(creds_data), &error);
+  if (error != GRPC_ERROR_NONE) goto end;
+  if (json.type() != Json::Type::OBJECT) {
     error = grpc_error_set_str(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING("Failed to parse JSON"),
         GRPC_ERROR_STR_RAW_BYTES, grpc_slice_ref_internal(creds_data));
@@ -271,7 +269,6 @@ end:
   GPR_ASSERT((result == nullptr) + (error == GRPC_ERROR_NONE) == 1);
   if (creds_path != nullptr) gpr_free(creds_path);
   grpc_slice_unref_internal(creds_data);
-  grpc_json_destroy(json);
   *creds = result;
   return error;
 }

data/src/core/lib/security/credentials/iam/iam_credentials.cc

@@ -20,16 +20,15 @@
 
 #include "src/core/lib/security/credentials/iam/iam_credentials.h"
 
-#include <string.h>
-
-#include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/surface/api_trace.h"
-
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 #include <grpc/support/sync.h>
 
+#include "absl/strings/str_format.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/surface/api_trace.h"
+
 grpc_google_iam_credentials::~grpc_google_iam_credentials() {
   grpc_credentials_mdelem_array_destroy(&md_array_);
 }
@@ -49,7 +48,10 @@ void grpc_google_iam_credentials::cancel_get_request_metadata(
 
 grpc_google_iam_credentials::grpc_google_iam_credentials(
     const char* token, const char* authority_selector)
-    : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_IAM) {
+    : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_IAM),
+      debug_string_(absl::StrFormat(
+          "GoogleIAMCredentials{Token:%s,AuthoritySelector:%s}",
+          token != nullptr ? "present" : "absent", authority_selector)) {
   grpc_mdelem md = grpc_mdelem_from_slices(
       grpc_slice_from_static_string(GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY),
       grpc_slice_from_copied_string(token));

data/src/core/lib/security/credentials/iam/iam_credentials.h

@@ -21,6 +21,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <string>
+
 #include "src/core/lib/security/credentials/credentials.h"
 
 class grpc_google_iam_credentials : public grpc_call_credentials {
@@ -37,9 +39,11 @@ class grpc_google_iam_credentials : public grpc_call_credentials {
 
   void cancel_get_request_metadata(grpc_credentials_mdelem_array* md_array,
                                    grpc_error* error) override;
+  std::string debug_string() override { return debug_string_; }
 
  private:
   grpc_credentials_mdelem_array md_array_;
+  const std::string debug_string_;
 };
 
 #endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_IAM_IAM_CREDENTIALS_H */

data/src/core/lib/security/credentials/jwt/json_token.cc

@@ -39,6 +39,8 @@ extern "C" {
 #include <openssl/pem.h>
 }
 
+using grpc_core::Json;
+
 /* --- Constants. --- */
 
 /* 1 hour max. */
@@ -65,7 +67,7 @@ int grpc_auth_json_key_is_valid(const grpc_auth_json_key* json_key) {
          strcmp(json_key->type, GRPC_AUTH_JSON_TYPE_INVALID);
 }
 
-grpc_auth_json_key grpc_auth_json_key_create_from_json(const grpc_json* json) {
+grpc_auth_json_key grpc_auth_json_key_create_from_json(const Json& json) {
   grpc_auth_json_key result;
   BIO* bio = nullptr;
   const char* prop_value;
@@ -74,7 +76,7 @@ grpc_auth_json_key grpc_auth_json_key_create_from_json(const grpc_json* json) {
 
   memset(&result, 0, sizeof(grpc_auth_json_key));
   result.type = GRPC_AUTH_JSON_TYPE_INVALID;
-  if (json == nullptr) {
+  if (json.type() == Json::Type::JSON_NULL) {
     gpr_log(GPR_ERROR, "Invalid json.");
     goto end;
   }
@@ -122,12 +124,10 @@ end:
 
 grpc_auth_json_key grpc_auth_json_key_create_from_string(
     const char* json_string) {
-  char* scratchpad = gpr_strdup(json_string);
-  grpc_json* json = grpc_json_parse_string(scratchpad);
-  grpc_auth_json_key result = grpc_auth_json_key_create_from_json(json);
-  grpc_json_destroy(json);
-  gpr_free(scratchpad);
-  return result;
+  grpc_error* error = GRPC_ERROR_NONE;
+  Json json = Json::Parse(json_string, &error);
+  GRPC_LOG_IF_ERROR("JSON key parsing", error);
+  return grpc_auth_json_key_create_from_json(json);
 }
 
 void grpc_auth_json_key_destruct(grpc_auth_json_key* json_key) {
@@ -153,72 +153,42 @@ void grpc_auth_json_key_destruct(grpc_auth_json_key* json_key) {
 
 /* --- jwt encoding and signature. --- */
 
-static grpc_json* create_child(grpc_json* brother, grpc_json* parent,
-                               const char* key, const char* value,
-                               grpc_json_type type) {
-  grpc_json* child = grpc_json_create(type);
-  if (brother) brother->next = child;
-  if (!parent->child) parent->child = child;
-  child->parent = parent;
-  child->value = value;
-  child->key = key;
-  return child;
-}
-
 static char* encoded_jwt_header(const char* key_id, const char* algorithm) {
-  grpc_json* json = grpc_json_create(GRPC_JSON_OBJECT);
-  grpc_json* child = nullptr;
-  char* json_str = nullptr;
-  char* result = nullptr;
-
-  child = create_child(nullptr, json, "alg", algorithm, GRPC_JSON_STRING);
-  child = create_child(child, json, "typ", GRPC_JWT_TYPE, GRPC_JSON_STRING);
-  create_child(child, json, "kid", key_id, GRPC_JSON_STRING);
-
-  json_str = grpc_json_dump_to_string(json, 0);
-  result = grpc_base64_encode(json_str, strlen(json_str), 1, 0);
-  gpr_free(json_str);
-  grpc_json_destroy(json);
-  return result;
+  Json json = Json::Object{
+      {"alg", algorithm},
+      {"typ", GRPC_JWT_TYPE},
+      {"kid", key_id},
+  };
+  std::string json_str = json.Dump();
+  return grpc_base64_encode(json_str.c_str(), json_str.size(), 1, 0);
 }
 
 static char* encoded_jwt_claim(const grpc_auth_json_key* json_key,
                                const char* audience,
                                gpr_timespec token_lifetime, const char* scope) {
-  grpc_json* json = grpc_json_create(GRPC_JSON_OBJECT);
-  grpc_json* child = nullptr;
-  char* json_str = nullptr;
-  char* result = nullptr;
   gpr_timespec now = gpr_now(GPR_CLOCK_REALTIME);
   gpr_timespec expiration = gpr_time_add(now, token_lifetime);
-  char now_str[GPR_LTOA_MIN_BUFSIZE];
-  char expiration_str[GPR_LTOA_MIN_BUFSIZE];
   if (gpr_time_cmp(token_lifetime, grpc_max_auth_token_lifetime()) > 0) {
     gpr_log(GPR_INFO, "Cropping token lifetime to maximum allowed value.");
     expiration = gpr_time_add(now, grpc_max_auth_token_lifetime());
   }
-  int64_ttoa(now.tv_sec, now_str);
-  int64_ttoa(expiration.tv_sec, expiration_str);
 
-  child = create_child(nullptr, json, "iss", json_key->client_email,
-                       GRPC_JSON_STRING);
+  Json::Object object = {
+      {"iss", json_key->client_email},
+      {"aud", audience},
+      {"iat", now.tv_sec},
+      {"exp", expiration.tv_sec},
+  };
   if (scope != nullptr) {
-    child = create_child(child, json, "scope", scope, GRPC_JSON_STRING);
+    object["scope"] = scope;
   } else {
     /* Unscoped JWTs need a sub field. */
-    child = create_child(child, json, "sub", json_key->client_email,
-                         GRPC_JSON_STRING);
+    object["sub"] = json_key->client_email;
   }
 
-  child = create_child(child, json, "aud", audience, GRPC_JSON_STRING);
-  child = create_child(child, json, "iat", now_str, GRPC_JSON_NUMBER);
-  create_child(child, json, "exp", expiration_str, GRPC_JSON_NUMBER);
-
-  json_str = grpc_json_dump_to_string(json, 0);
-  result = grpc_base64_encode(json_str, strlen(json_str), 1, 0);
-  gpr_free(json_str);
-  grpc_json_destroy(json);
-  return result;
+  Json json(object);
+  std::string json_str = json.Dump();
+  return grpc_base64_encode(json_str.c_str(), json_str.size(), 1, 0);
 }
 
 static char* dot_concat_and_free_strings(char* str1, char* str2) {