grpc 1.27.0 → 1.28.0.pre2

data/src/core/lib/security/credentials/jwt/jwt_verifier.h

@@ -56,7 +56,7 @@ typedef struct grpc_jwt_claims grpc_jwt_claims;
 void grpc_jwt_claims_destroy(grpc_jwt_claims* claims);
 
 /* Returns the whole JSON tree of the claims. */
-const grpc_json* grpc_jwt_claims_json(const grpc_jwt_claims* claims);
+const grpc_core::Json* grpc_jwt_claims_json(const grpc_jwt_claims* claims);
 
 /* Access to registered claims in https://tools.ietf.org/html/rfc7519#page-9 */
 const char* grpc_jwt_claims_subject(const grpc_jwt_claims* claims);
@@ -115,8 +115,7 @@ void grpc_jwt_verifier_verify(grpc_jwt_verifier* verifier,
 
 /* --- TESTING ONLY exposed functions. --- */
 
-grpc_jwt_claims* grpc_jwt_claims_from_json(grpc_json* json,
-                                           const grpc_slice& buffer);
+grpc_jwt_claims* grpc_jwt_claims_from_json(grpc_core::Json json);
 grpc_jwt_verifier_status grpc_jwt_claims_check(const grpc_jwt_claims* claims,
                                                const char* audience);
 const char* grpc_jwt_issuer_email_domain(const char* issuer);

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -40,6 +40,8 @@
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/uri/uri_parser.h"
 
+using grpc_core::Json;
+
 //
 // Auth Refresh Token.
 //
@@ -51,7 +53,7 @@ int grpc_auth_refresh_token_is_valid(
 }
 
 grpc_auth_refresh_token grpc_auth_refresh_token_create_from_json(
-    const grpc_json* json) {
+    const Json& json) {
   grpc_auth_refresh_token result;
   const char* prop_value;
   int success = 0;
@@ -59,7 +61,7 @@ grpc_auth_refresh_token grpc_auth_refresh_token_create_from_json(
 
   memset(&result, 0, sizeof(grpc_auth_refresh_token));
   result.type = GRPC_AUTH_JSON_TYPE_INVALID;
-  if (json == nullptr) {
+  if (json.type() != Json::Type::OBJECT) {
     gpr_log(GPR_ERROR, "Invalid json.");
     goto end;
   }
@@ -88,13 +90,13 @@ end:
 
 grpc_auth_refresh_token grpc_auth_refresh_token_create_from_string(
     const char* json_string) {
-  char* scratchpad = gpr_strdup(json_string);
-  grpc_json* json = grpc_json_parse_string(scratchpad);
-  grpc_auth_refresh_token result =
-      grpc_auth_refresh_token_create_from_json(json);
-  grpc_json_destroy(json);
-  gpr_free(scratchpad);
-  return result;
+  grpc_error* error = GRPC_ERROR_NONE;
+  Json json = Json::Parse(json_string, &error);
+  if (error != GRPC_ERROR_NONE) {
+    gpr_log(GPR_ERROR, "JSON parsing failed: %s", grpc_error_string(error));
+    GRPC_ERROR_UNREF(error);
+  }
+  return grpc_auth_refresh_token_create_from_json(std::move(json));
 }
 
 void grpc_auth_refresh_token_destruct(grpc_auth_refresh_token* refresh_token) {
@@ -133,7 +135,7 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response(
   char* null_terminated_body = nullptr;
   char* new_access_token = nullptr;
   grpc_credentials_status status = GRPC_CREDENTIALS_OK;
-  grpc_json* json = nullptr;
+  Json json;
 
   if (response == nullptr) {
     gpr_log(GPR_ERROR, "Received NULL response.");
@@ -155,48 +157,50 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response(
     status = GRPC_CREDENTIALS_ERROR;
     goto end;
   } else {
-    grpc_json* access_token = nullptr;
-    grpc_json* token_type = nullptr;
-    grpc_json* expires_in = nullptr;
-    grpc_json* ptr;
-    json = grpc_json_parse_string(null_terminated_body);
-    if (json == nullptr) {
-      gpr_log(GPR_ERROR, "Could not parse JSON from %s", null_terminated_body);
+    const char* access_token = nullptr;
+    const char* token_type = nullptr;
+    const char* expires_in = nullptr;
+    Json::Object::const_iterator it;
+    grpc_error* error = GRPC_ERROR_NONE;
+    json = Json::Parse(null_terminated_body, &error);
+    if (error != GRPC_ERROR_NONE) {
+      gpr_log(GPR_ERROR, "Could not parse JSON from %s: %s",
+              null_terminated_body, grpc_error_string(error));
+      GRPC_ERROR_UNREF(error);
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
-    if (json->type != GRPC_JSON_OBJECT) {
+    if (json.type() != Json::Type::OBJECT) {
       gpr_log(GPR_ERROR, "Response should be a JSON object");
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
-    for (ptr = json->child; ptr; ptr = ptr->next) {
-      if (strcmp(ptr->key, "access_token") == 0) {
-        access_token = ptr;
-      } else if (strcmp(ptr->key, "token_type") == 0) {
-        token_type = ptr;
-      } else if (strcmp(ptr->key, "expires_in") == 0) {
-        expires_in = ptr;
-      }
-    }
-    if (access_token == nullptr || access_token->type != GRPC_JSON_STRING) {
+    it = json.object_value().find("access_token");
+    if (it == json.object_value().end() ||
+        it->second.type() != Json::Type::STRING) {
       gpr_log(GPR_ERROR, "Missing or invalid access_token in JSON.");
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
-    if (token_type == nullptr || token_type->type != GRPC_JSON_STRING) {
+    access_token = it->second.string_value().c_str();
+    it = json.object_value().find("token_type");
+    if (it == json.object_value().end() ||
+        it->second.type() != Json::Type::STRING) {
       gpr_log(GPR_ERROR, "Missing or invalid token_type in JSON.");
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
-    if (expires_in == nullptr || expires_in->type != GRPC_JSON_NUMBER) {
+    token_type = it->second.string_value().c_str();
+    it = json.object_value().find("expires_in");
+    if (it == json.object_value().end() ||
+        it->second.type() != Json::Type::NUMBER) {
       gpr_log(GPR_ERROR, "Missing or invalid expires_in in JSON.");
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
-    gpr_asprintf(&new_access_token, "%s %s", token_type->value,
-                 access_token->value);
-    *token_lifetime = strtol(expires_in->value, nullptr, 10) * GPR_MS_PER_SEC;
+    expires_in = it->second.string_value().c_str();
+    gpr_asprintf(&new_access_token, "%s %s", token_type, access_token);
+    *token_lifetime = strtol(expires_in, nullptr, 10) * GPR_MS_PER_SEC;
     if (!GRPC_MDISNULL(*token_md)) GRPC_MDELEM_UNREF(*token_md);
     *token_md = grpc_mdelem_from_slices(
         grpc_core::ExternallyManagedSlice(GRPC_AUTHORIZATION_METADATA_KEY),
@@ -211,7 +215,6 @@ end:
   }
   if (null_terminated_body != nullptr) gpr_free(null_terminated_body);
   if (new_access_token != nullptr) gpr_free(new_access_token);
-  grpc_json_destroy(json);
   return status;
 }
 

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.h

@@ -51,7 +51,7 @@ grpc_auth_refresh_token grpc_auth_refresh_token_create_from_string(
 /// Creates a refresh token object from parsed json. Returns an invalid object
 /// if a parsing error has been encountered.
 grpc_auth_refresh_token grpc_auth_refresh_token_create_from_json(
-    const grpc_json* json);
+    const grpc_core::Json& json);
 
 /// Destructs the object.
 void grpc_auth_refresh_token_destruct(grpc_auth_refresh_token* refresh_token);

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -273,7 +273,8 @@ struct grpc_tls_credentials_options
 
  private:
   grpc_ssl_client_certificate_request_type cert_request_type_;
-  grpc_tls_server_verification_option server_verification_option_;
+  grpc_tls_server_verification_option server_verification_option_ =
+      GRPC_TLS_SERVER_VERIFICATION;
   grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
   grpc_core::RefCountedPtr<grpc_tls_credential_reload_config>
       credential_reload_config_;

data/src/core/lib/security/security_connector/local/local_security_connector.cc

@@ -66,8 +66,7 @@ grpc_core::RefCountedPtr<grpc_auth_context> local_auth_context_create(
   return ctx;
 }
 
-void local_check_peer(grpc_security_connector* sc, tsi_peer peer,
-                      grpc_endpoint* ep,
+void local_check_peer(tsi_peer peer, grpc_endpoint* ep,
                       grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                       grpc_closure* on_peer_checked,
                       grpc_local_connect_type type) {
@@ -120,10 +119,9 @@ void local_check_peer(grpc_security_connector* sc, tsi_peer peer,
   }
   if (peer.properties != nullptr) gpr_free(peer.properties);
   peer.properties = new_properties;
+  // TODO(yihuazhang): Set security level of local TCP to TSI_SECURITY_NONE.
   const char* security_level =
-      type == LOCAL_TCP
-          ? tsi_security_level_to_string(TSI_SECURITY_NONE)
-          : tsi_security_level_to_string(TSI_PRIVACY_AND_INTEGRITY);
+      tsi_security_level_to_string(TSI_PRIVACY_AND_INTEGRITY);
   tsi_result result = tsi_construct_string_peer_property_from_cstring(
       TSI_SECURITY_LEVEL_PEER_PROPERTY, security_level,
       &peer.properties[peer.property_count]);
@@ -179,7 +177,7 @@ class grpc_local_channel_security_connector final
                   grpc_closure* on_peer_checked) override {
     grpc_local_credentials* creds =
         reinterpret_cast<grpc_local_credentials*>(mutable_channel_creds());
-    local_check_peer(this, peer, ep, auth_context, on_peer_checked,
+    local_check_peer(peer, ep, auth_context, on_peer_checked,
                      creds->connect_type());
   }
 
@@ -228,7 +226,7 @@ class grpc_local_server_security_connector final
                   grpc_closure* on_peer_checked) override {
     grpc_local_server_credentials* creds =
         static_cast<grpc_local_server_credentials*>(mutable_server_creds());
-    local_check_peer(this, peer, ep, auth_context, on_peer_checked,
+    local_check_peer(peer, ep, auth_context, on_peer_checked,
                      creds->connect_type());
   }
 

data/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc

@@ -190,21 +190,9 @@ class grpc_ssl_channel_security_connector final
                        grpc_auth_context* auth_context,
                        grpc_closure* /*on_call_host_checked*/,
                        grpc_error** error) override {
-    grpc_security_status status = GRPC_SECURITY_ERROR;
-    tsi_peer peer = grpc_shallow_peer_from_ssl_auth_context(auth_context);
-    if (grpc_ssl_host_matches_name(&peer, host)) status = GRPC_SECURITY_OK;
-    /* If the target name was overridden, then the original target_name was
-       'checked' transitively during the previous peer check at the end of the
-       handshake. */
-    if (overridden_target_name_ != nullptr && host == target_name_.get()) {
-      status = GRPC_SECURITY_OK;
-    }
-    if (status != GRPC_SECURITY_OK) {
-      *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-          "call host does not match SSL server name");
-    }
-    grpc_shallow_peer_destruct(&peer);
-    return true;
+    return grpc_ssl_check_call_host(host, target_name_.get(),
+                                    overridden_target_name_.get(), auth_context,
+                                    error);
   }
 
   void cancel_check_call_host(grpc_closure* /*on_call_host_checked*/,

data/src/core/lib/security/security_connector/ssl_utils.cc

@@ -167,11 +167,13 @@ bool grpc_ssl_check_call_host(grpc_core::StringView host,
                               grpc_core::StringView target_name,
                               grpc_core::StringView overridden_target_name,
                               grpc_auth_context* auth_context,
-                              grpc_closure* /*on_call_host_checked*/,
                               grpc_error** error) {
   grpc_security_status status = GRPC_SECURITY_ERROR;
   tsi_peer peer = grpc_shallow_peer_from_ssl_auth_context(auth_context);
   if (grpc_ssl_host_matches_name(&peer, host)) status = GRPC_SECURITY_OK;
+  /* If the target name was overridden, then the original target_name was
+   'checked' transitively during the previous peer check at the end of the
+   handshake. */
   if (!overridden_target_name.empty() && host == target_name) {
     status = GRPC_SECURITY_OK;
   }

data/src/core/lib/security/security_connector/ssl_utils.h

@@ -57,7 +57,6 @@ bool grpc_ssl_check_call_host(grpc_core::StringView host,
                               grpc_core::StringView target_name,
                               grpc_core::StringView overridden_target_name,
                               grpc_auth_context* auth_context,
-                              grpc_closure* on_call_host_checked,
                               grpc_error** error);
 /* Return HTTP2-compliant cipher suites that gRPC accepts by default. */
 const char* grpc_get_ssl_cipher_suites(void);

data/src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -112,6 +112,18 @@ grpc_status_code TlsFetchKeyMaterials(
   return status;
 }
 
+grpc_error* TlsCheckHostName(const char* peer_name, const tsi_peer* peer) {
+  /* Check the peer name if specified. */
+  if (peer_name != nullptr && !grpc_ssl_host_matches_name(peer, peer_name)) {
+    char* msg;
+    gpr_asprintf(&msg, "Peer name %s is not in peer certificate", peer_name);
+    grpc_error* error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
+    gpr_free(msg);
+    return error;
+  }
+  return GRPC_ERROR_NONE;
+}
+
 TlsChannelSecurityConnector::TlsChannelSecurityConnector(
     grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
@@ -180,6 +192,17 @@ void TlsChannelSecurityConnector::check_peer(
       grpc_ssl_peer_to_auth_context(&peer, GRPC_TLS_TRANSPORT_SECURITY_TYPE);
   const TlsCredentials* creds =
       static_cast<const TlsCredentials*>(channel_creds());
+  if (creds->options().server_verification_option() ==
+      GRPC_TLS_SERVER_VERIFICATION) {
+    /* Do the default host name check if specifying the target name. */
+    error = TlsCheckHostName(target_name, &peer);
+    if (error != GRPC_ERROR_NONE) {
+      grpc_core::ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
+      tsi_peer_destruct(&peer);
+      return;
+    }
+  }
+  /* Do the custom server authorization check, if specified by the user. */
   const grpc_tls_server_authorization_check_config* config =
       creds->options().server_authorization_check_config();
   /* If server authorization config is not null, use it to perform
@@ -245,7 +268,7 @@ bool TlsChannelSecurityConnector::check_call_host(
     grpc_closure* on_call_host_checked, grpc_error** error) {
   return grpc_ssl_check_call_host(host, target_name_.get(),
                                   overridden_target_name_.get(), auth_context,
-                                  on_call_host_checked, error);
+                                  error);
 }
 
 void TlsChannelSecurityConnector::cancel_check_call_host(

data/src/core/lib/security/security_connector/tls/tls_security_connector.h

@@ -144,13 +144,17 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
   grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
 };
 
-// Exposed for testing only.
+// ---- Functions below are exposed for testing only -----------------------
 grpc_status_code TlsFetchKeyMaterials(
     const grpc_core::RefCountedPtr<grpc_tls_key_materials_config>&
         key_materials_config,
     const grpc_tls_credentials_options& options, bool server_config,
     grpc_ssl_certificate_config_reload_status* status);
 
+// TlsCheckHostName checks if |peer_name| matches the identity information
+// contained in |peer|. This is AKA hostname check.
+grpc_error* TlsCheckHostName(const char* peer_name, const tsi_peer* peer);
+
 }  // namespace grpc_core
 
 #endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H \

data/src/core/lib/security/transport/security_handshaker.cc

@@ -559,10 +559,10 @@ RefCountedPtr<Handshaker> SecurityHandshakerCreate(
 void SecurityRegisterHandshakerFactories() {
   HandshakerRegistry::RegisterHandshakerFactory(
       false /* at_start */, HANDSHAKER_CLIENT,
-      MakeUnique<ClientSecurityHandshakerFactory>());
+      absl::make_unique<ClientSecurityHandshakerFactory>());
   HandshakerRegistry::RegisterHandshakerFactory(
       false /* at_start */, HANDSHAKER_SERVER,
-      MakeUnique<ServerSecurityHandshakerFactory>());
+      absl::make_unique<ServerSecurityHandshakerFactory>());
 }
 
 }  // namespace grpc_core

data/src/core/lib/security/util/json_util.cc

@@ -26,34 +26,41 @@
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
-const char* grpc_json_get_string_property(const grpc_json* json,
+const char* grpc_json_get_string_property(const grpc_core::Json& json,
                                           const char* prop_name,
                                           grpc_error** error) {
-  grpc_json* child = nullptr;
-  if (error != nullptr) *error = GRPC_ERROR_NONE;
-  for (child = json->child; child != nullptr; child = child->next) {
-    if (child->key == nullptr) {
-      if (error != nullptr) {
-        *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-            "Invalid (null) JSON key encountered");
-      }
-      return nullptr;
+  if (json.type() != grpc_core::Json::Type::OBJECT) {
+    if (error != nullptr) {
+      *error =
+          GRPC_ERROR_CREATE_FROM_STATIC_STRING("JSON value is not an object");
     }
-    if (strcmp(child->key, prop_name) == 0) break;
+    return nullptr;
+  }
+  auto it = json.object_value().find(prop_name);
+  if (it == json.object_value().end()) {
+    if (error != nullptr) {
+      char* error_msg;
+      gpr_asprintf(&error_msg, "Property %s not found in JSON object.",
+                   prop_name);
+      *error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(error_msg);
+      gpr_free(error_msg);
+    }
+    return nullptr;
   }
-  if (child == nullptr || child->type != GRPC_JSON_STRING) {
+  if (it->second.type() != grpc_core::Json::Type::STRING) {
     if (error != nullptr) {
       char* error_msg;
-      gpr_asprintf(&error_msg, "Invalid or missing %s property.", prop_name);
+      gpr_asprintf(&error_msg, "Property %s in JSON object is not a string.",
+                   prop_name);
       *error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(error_msg);
       gpr_free(error_msg);
     }
     return nullptr;
   }
-  return child->value;
+  return it->second.string_value().c_str();
 }
 
-bool grpc_copy_json_string_property(const grpc_json* json,
+bool grpc_copy_json_string_property(const grpc_core::Json& json,
                                     const char* prop_name,
                                     char** copied_value) {
   grpc_error* error = GRPC_ERROR_NONE;

data/src/core/lib/security/util/json_util.h

@@ -32,13 +32,13 @@
 #define GRPC_AUTH_JSON_TYPE_AUTHORIZED_USER "authorized_user"
 
 // Gets a child property from a json node.
-const char* grpc_json_get_string_property(const grpc_json* json,
+const char* grpc_json_get_string_property(const grpc_core::Json& json,
                                           const char* prop_name,
                                           grpc_error** error);
 
 // Copies the value of the json child property specified by prop_name.
 // Returns false if the property was not found.
-bool grpc_copy_json_string_property(const grpc_json* json,
+bool grpc_copy_json_string_property(const grpc_core::Json& json,
                                     const char* prop_name, char** copied_value);
 
 #endif /* GRPC_CORE_LIB_SECURITY_UTIL_JSON_UTIL_H */

data/src/core/lib/surface/version.cc

@@ -25,4 +25,4 @@
 
 const char* grpc_version_string(void) { return "9.0.0"; }
 
-const char* grpc_g_stands_for(void) { return "guantao"; }
+const char* grpc_g_stands_for(void) { return "galactic"; }

data/src/core/tsi/alts/handshaker/alts_handshaker_client.cc

@@ -637,7 +637,7 @@ static void handshaker_client_shutdown(alts_handshaker_client* c) {
   }
 }
 
-static void handshaker_call_unref(void* arg, grpc_error* error) {
+static void handshaker_call_unref(void* arg, grpc_error* /* error */) {
   grpc_call* call = static_cast<grpc_call*>(arg);
   grpc_call_unref(call);
 }

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc

@@ -430,7 +430,7 @@ struct alts_tsi_handshaker_continue_handshaker_next_args {
 };
 
 static void alts_tsi_handshaker_create_channel(void* arg,
-                                               grpc_error* unused_error) {
+                                               grpc_error* /* unused_error */) {
   alts_tsi_handshaker_continue_handshaker_next_args* next_args =
       static_cast<alts_tsi_handshaker_continue_handshaker_next_args*>(arg);
   alts_tsi_handshaker* handshaker = next_args->handshaker;