grpc 1.28.0 → 1.31.0.pre2

data/src/core/lib/security/credentials/jwt/jwt_verifier.h

@@ -71,7 +71,7 @@ gpr_timespec grpc_jwt_claims_not_before(const grpc_jwt_claims* claims);
 
 typedef struct grpc_jwt_verifier grpc_jwt_verifier;
 
-typedef struct {
+struct grpc_jwt_verifier_email_domain_key_url_mapping {
   /* The email domain is the part after the @ sign. */
   const char* email_domain;
 
@@ -79,8 +79,7 @@ typedef struct {
      https://<key_url_prefix>/<issuer_email>
      Therefore the key_url_prefix must NOT contain https://. */
   const char* key_url_prefix;
-} grpc_jwt_verifier_email_domain_key_url_mapping;
-
+};
 /* Globals to control the verifier. Not thread-safe. */
 extern gpr_timespec grpc_jwt_verifier_clock_skew;
 extern grpc_millis grpc_jwt_verifier_max_delay;

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -23,6 +23,11 @@
 
 #include <string.h>
 
+#include "absl/container/inlined_vector.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_format.h"
+#include "absl/strings/str_join.h"
+
 #include <grpc/grpc_security.h>
 #include <grpc/impl/codegen/slice.h>
 #include <grpc/slice.h>
@@ -31,7 +36,6 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/gpr/string.h"
-#include "src/core/lib/gprpp/inlined_vector.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/load_file.h"
@@ -96,7 +100,7 @@ grpc_auth_refresh_token grpc_auth_refresh_token_create_from_string(
     gpr_log(GPR_ERROR, "JSON parsing failed: %s", grpc_error_string(error));
     GRPC_ERROR_UNREF(error);
   }
-  return grpc_auth_refresh_token_create_from_json(std::move(json));
+  return grpc_auth_refresh_token_create_from_json(json);
 }
 
 void grpc_auth_refresh_token_destruct(grpc_auth_refresh_token* refresh_token) {
@@ -133,7 +137,6 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response(
     const grpc_http_response* response, grpc_mdelem* token_md,
     grpc_millis* token_lifetime) {
   char* null_terminated_body = nullptr;
-  char* new_access_token = nullptr;
   grpc_credentials_status status = GRPC_CREDENTIALS_OK;
   Json json;
 
@@ -199,12 +202,12 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response(
       goto end;
     }
     expires_in = it->second.string_value().c_str();
-    gpr_asprintf(&new_access_token, "%s %s", token_type, access_token);
     *token_lifetime = strtol(expires_in, nullptr, 10) * GPR_MS_PER_SEC;
     if (!GRPC_MDISNULL(*token_md)) GRPC_MDELEM_UNREF(*token_md);
     *token_md = grpc_mdelem_from_slices(
         grpc_core::ExternallyManagedSlice(GRPC_AUTHORIZATION_METADATA_KEY),
-        grpc_core::UnmanagedMemorySlice(new_access_token));
+        grpc_slice_from_cpp_string(
+            absl::StrCat(token_type, " ", access_token)));
     status = GRPC_CREDENTIALS_OK;
   }
 
@@ -213,8 +216,7 @@ end:
     GRPC_MDELEM_UNREF(*token_md);
     *token_md = GRPC_MDNULL;
   }
-  if (null_terminated_body != nullptr) gpr_free(null_terminated_body);
-  if (new_access_token != nullptr) gpr_free(new_access_token);
+  gpr_free(null_terminated_body);
   return status;
 }
 
@@ -358,6 +360,10 @@ grpc_oauth2_token_fetcher_credentials::grpc_oauth2_token_fetcher_credentials()
   grpc_httpcli_context_init(&httpcli_context_);
 }
 
+std::string grpc_oauth2_token_fetcher_credentials::debug_string() {
+  return "OAuth2TokenFetcherCredentials";
+}
+
 //
 //  Google Compute Engine credentials.
 //
@@ -396,6 +402,12 @@ class grpc_compute_engine_token_fetcher_credentials
     grpc_resource_quota_unref_internal(resource_quota);
   }
 
+  std::string debug_string() override {
+    return absl::StrFormat(
+        "GoogleComputeEngineTokenFetcherCredentials{%s}",
+        grpc_oauth2_token_fetcher_credentials::debug_string());
+  }
+
  private:
   grpc_closure http_get_cb_closure_;
 };
@@ -429,10 +441,9 @@ void grpc_google_refresh_token_credentials::fetch_oauth2(
       const_cast<char*>("Content-Type"),
       const_cast<char*>("application/x-www-form-urlencoded")};
   grpc_httpcli_request request;
-  char* body = nullptr;
-  gpr_asprintf(&body, GRPC_REFRESH_TOKEN_POST_BODY_FORMAT_STRING,
-               refresh_token_.client_id, refresh_token_.client_secret,
-               refresh_token_.refresh_token);
+  std::string body = absl::StrFormat(
+      GRPC_REFRESH_TOKEN_POST_BODY_FORMAT_STRING, refresh_token_.client_id,
+      refresh_token_.client_secret, refresh_token_.refresh_token);
   memset(&request, 0, sizeof(grpc_httpcli_request));
   request.host = (char*)GRPC_GOOGLE_OAUTH2_SERVICE_HOST;
   request.http.path = (char*)GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH;
@@ -444,13 +455,12 @@ void grpc_google_refresh_token_credentials::fetch_oauth2(
      extreme memory pressure. */
   grpc_resource_quota* resource_quota =
       grpc_resource_quota_create("oauth2_credentials_refresh");
-  grpc_httpcli_post(httpcli_context, pollent, resource_quota, &request, body,
-                    strlen(body), deadline,
+  grpc_httpcli_post(httpcli_context, pollent, resource_quota, &request,
+                    body.c_str(), body.size(), deadline,
                     GRPC_CLOSURE_INIT(&http_post_cb_closure_, response_cb,
                                       metadata_req, grpc_schedule_on_exec_ctx),
                     &metadata_req->response);
   grpc_resource_quota_unref_internal(resource_quota);
-  gpr_free(body);
 }
 
 grpc_google_refresh_token_credentials::grpc_google_refresh_token_credentials(
@@ -468,16 +478,21 @@ grpc_refresh_token_credentials_create_from_auth_refresh_token(
       refresh_token);
 }
 
-static char* create_loggable_refresh_token(grpc_auth_refresh_token* token) {
+std::string grpc_google_refresh_token_credentials::debug_string() {
+  return absl::StrFormat("GoogleRefreshToken{ClientID:%s,%s}",
+                         refresh_token_.client_id,
+                         grpc_oauth2_token_fetcher_credentials::debug_string());
+}
+
+static std::string create_loggable_refresh_token(
+    grpc_auth_refresh_token* token) {
   if (strcmp(token->type, GRPC_AUTH_JSON_TYPE_INVALID) == 0) {
-    return gpr_strdup("<Invalid json token>");
+    return "<Invalid json token>";
   }
-  char* loggable_token = nullptr;
-  gpr_asprintf(&loggable_token,
-               "{\n type: %s\n client_id: %s\n client_secret: "
-               "<redacted>\n refresh_token: <redacted>\n}",
-               token->type, token->client_id);
-  return loggable_token;
+  return absl::StrFormat(
+      "{\n type: %s\n client_id: %s\n client_secret: "
+      "<redacted>\n refresh_token: <redacted>\n}",
+      token->type, token->client_id);
 }
 
 grpc_call_credentials* grpc_google_refresh_token_credentials_create(
@@ -485,12 +500,10 @@ grpc_call_credentials* grpc_google_refresh_token_credentials_create(
   grpc_auth_refresh_token token =
       grpc_auth_refresh_token_create_from_string(json_refresh_token);
   if (GRPC_TRACE_FLAG_ENABLED(grpc_api_trace)) {
-    char* loggable_token = create_loggable_refresh_token(&token);
     gpr_log(GPR_INFO,
             "grpc_refresh_token_credentials_create(json_refresh_token=%s, "
             "reserved=%p)",
-            loggable_token, reserved);
-    gpr_free(loggable_token);
+            create_loggable_refresh_token(&token).c_str(), reserved);
   }
   GPR_ASSERT(reserved == nullptr);
   return grpc_refresh_token_credentials_create_from_auth_refresh_token(token)
@@ -505,12 +518,10 @@ namespace grpc_core {
 
 namespace {
 
-void MaybeAddToBody(gpr_strvec* body_strvec, const char* field_name,
-                    const char* field) {
+void MaybeAddToBody(const char* field_name, const char* field,
+                    std::vector<std::string>* body) {
   if (field == nullptr || strlen(field) == 0) return;
-  char* new_query;
-  gpr_asprintf(&new_query, "&%s=%s", field_name, field);
-  gpr_strvec_add(body_strvec, new_query);
+  body->push_back(absl::StrFormat("&%s=%s", field_name, field));
 }
 
 grpc_error* LoadTokenFile(const char* path, gpr_slice* token) {
@@ -540,6 +551,13 @@ class StsTokenFetcherCredentials
 
   ~StsTokenFetcherCredentials() override { grpc_uri_destroy(sts_url_); }
 
+  std::string debug_string() override {
+    return absl::StrFormat(
+        "StsTokenFetcherCredentials{Path:%s,Authority:%s,%s}", sts_url_->path,
+        sts_url_->authority,
+        grpc_oauth2_token_fetcher_credentials::debug_string());
+  }
+
  private:
   void fetch_oauth2(grpc_credentials_metadata_request* metadata_req,
                     grpc_httpcli_context* http_context,
@@ -583,20 +601,18 @@ class StsTokenFetcherCredentials
 
   grpc_error* FillBody(char** body, size_t* body_length) {
     *body = nullptr;
-    gpr_strvec body_strvec;
-    gpr_strvec_init(&body_strvec);
+    std::vector<std::string> body_parts;
     grpc_slice subject_token = grpc_empty_slice();
     grpc_slice actor_token = grpc_empty_slice();
     grpc_error* err = GRPC_ERROR_NONE;
 
-    auto cleanup = [&body, &body_length, &body_strvec, &subject_token,
+    auto cleanup = [&body, &body_length, &body_parts, &subject_token,
                     &actor_token, &err]() {
       if (err == GRPC_ERROR_NONE) {
-        *body = gpr_strvec_flatten(&body_strvec, body_length);
-      } else {
-        gpr_free(*body);
+        std::string body_str = absl::StrJoin(body_parts, "");
+        *body = gpr_strdup(body_str.c_str());
+        *body_length = body_str.size();
       }
-      gpr_strvec_destroy(&body_strvec);
       grpc_slice_unref_internal(subject_token);
       grpc_slice_unref_internal(actor_token);
       return err;
@@ -604,23 +620,23 @@ class StsTokenFetcherCredentials
 
     err = LoadTokenFile(subject_token_path_.get(), &subject_token);
     if (err != GRPC_ERROR_NONE) return cleanup();
-    gpr_asprintf(
-        body, GRPC_STS_POST_MINIMAL_BODY_FORMAT_STRING,
+    body_parts.push_back(absl::StrFormat(
+        GRPC_STS_POST_MINIMAL_BODY_FORMAT_STRING,
         reinterpret_cast<const char*>(GRPC_SLICE_START_PTR(subject_token)),
-        subject_token_type_.get());
-    gpr_strvec_add(&body_strvec, *body);
-    MaybeAddToBody(&body_strvec, "resource", resource_.get());
-    MaybeAddToBody(&body_strvec, "audience", audience_.get());
-    MaybeAddToBody(&body_strvec, "scope", scope_.get());
-    MaybeAddToBody(&body_strvec, "requested_token_type",
-                   requested_token_type_.get());
+        subject_token_type_.get()));
+    MaybeAddToBody("resource", resource_.get(), &body_parts);
+    MaybeAddToBody("audience", audience_.get(), &body_parts);
+    MaybeAddToBody("scope", scope_.get(), &body_parts);
+    MaybeAddToBody("requested_token_type", requested_token_type_.get(),
+                   &body_parts);
     if ((actor_token_path_ != nullptr) && *actor_token_path_ != '\0') {
       err = LoadTokenFile(actor_token_path_.get(), &actor_token);
       if (err != GRPC_ERROR_NONE) return cleanup();
       MaybeAddToBody(
-          &body_strvec, "actor_token",
-          reinterpret_cast<const char*>(GRPC_SLICE_START_PTR(actor_token)));
-      MaybeAddToBody(&body_strvec, "actor_token_type", actor_token_type_.get());
+          "actor_token",
+          reinterpret_cast<const char*>(GRPC_SLICE_START_PTR(actor_token)),
+          &body_parts);
+      MaybeAddToBody("actor_token_type", actor_token_type_.get(), &body_parts);
     }
     return cleanup();
   }
@@ -645,7 +661,7 @@ grpc_error* ValidateStsCredentialsOptions(
     void operator()(grpc_uri* uri) { grpc_uri_destroy(uri); }
   };
   *sts_url_out = nullptr;
-  InlinedVector<grpc_error*, 3> error_list;
+  absl::InlinedVector<grpc_error*, 3> error_list;
   std::unique_ptr<grpc_uri, GrpcUriDeleter> sts_url(
       options->token_exchange_service_uri != nullptr
           ? grpc_uri_parse(options->token_exchange_service_uri, false)
@@ -722,13 +738,16 @@ void grpc_access_token_credentials::cancel_get_request_metadata(
 grpc_access_token_credentials::grpc_access_token_credentials(
     const char* access_token)
     : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_OAUTH2) {
-  char* token_md_value;
-  gpr_asprintf(&token_md_value, "Bearer %s", access_token);
   grpc_core::ExecCtx exec_ctx;
   access_token_md_ = grpc_mdelem_from_slices(
       grpc_core::ExternallyManagedSlice(GRPC_AUTHORIZATION_METADATA_KEY),
-      grpc_core::UnmanagedMemorySlice(token_md_value));
-  gpr_free(token_md_value);
+      grpc_slice_from_cpp_string(absl::StrCat("Bearer ", access_token)));
+}
+
+std::string grpc_access_token_credentials::debug_string() {
+  bool access_token_present = !GRPC_MDISNULL(access_token_md_);
+  return absl::StrFormat("AccessTokenCredentials{Token:%s}",
+                         access_token_present ? "present" : "absent");
 }
 
 grpc_call_credentials* grpc_access_token_credentials_create(

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.h

@@ -21,6 +21,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <string>
+
 #include <grpc/grpc_security.h>
 #include "src/core/lib/json/json.h"
 #include "src/core/lib/security/credentials/credentials.h"
@@ -32,13 +34,12 @@
   "s&subject_token_type=%s"
 
 // auth_refresh_token parsing.
-typedef struct {
+struct grpc_auth_refresh_token {
   const char* type;
   char* client_id;
   char* client_secret;
   char* refresh_token;
-} grpc_auth_refresh_token;
-
+};
 /// Returns 1 if the object is valid, 0 otherwise.
 int grpc_auth_refresh_token_is_valid(
     const grpc_auth_refresh_token* refresh_token);
@@ -84,6 +85,7 @@ class grpc_oauth2_token_fetcher_credentials : public grpc_call_credentials {
 
   void on_http_response(grpc_credentials_metadata_request* r,
                         grpc_error* error);
+  std::string debug_string() override;
 
  protected:
   virtual void fetch_oauth2(grpc_credentials_metadata_request* req,
@@ -112,6 +114,8 @@ class grpc_google_refresh_token_credentials final
     return refresh_token_;
   }
 
+  std::string debug_string() override;
+
  protected:
   void fetch_oauth2(grpc_credentials_metadata_request* req,
                     grpc_httpcli_context* httpcli_context,
@@ -138,6 +142,8 @@ class grpc_access_token_credentials final : public grpc_call_credentials {
   void cancel_get_request_metadata(grpc_credentials_mdelem_array* md_array,
                                    grpc_error* error) override;
 
+  std::string debug_string() override;
+
  private:
   grpc_mdelem access_token_md_;
 };

data/src/core/lib/security/credentials/plugin/plugin_credentials.cc

@@ -22,10 +22,11 @@
 
 #include <string.h>
 
+#include "absl/strings/str_cat.h"
+
 #include <grpc/grpc.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
 #include <grpc/support/sync.h>
 
 #include "src/core/lib/slice/slice_internal.h"
@@ -42,6 +43,19 @@ grpc_plugin_credentials::~grpc_plugin_credentials() {
   }
 }
 
+std::string grpc_plugin_credentials::debug_string() {
+  char* debug_c_str = nullptr;
+  if (plugin_.debug_string != nullptr) {
+    debug_c_str = plugin_.debug_string(plugin_.state);
+  }
+  std::string debug_str(
+      debug_c_str != nullptr
+          ? debug_c_str
+          : "grpc_plugin_credentials did not provide a debug string");
+  gpr_free(debug_c_str);
+  return debug_str;
+}
+
 void grpc_plugin_credentials::pending_request_remove_locked(
     pending_request* pending_request) {
   if (pending_request->prev == nullptr) {
@@ -73,11 +87,10 @@ static grpc_error* process_plugin_result(
     size_t num_md, grpc_status_code status, const char* error_details) {
   grpc_error* error = GRPC_ERROR_NONE;
   if (status != GRPC_STATUS_OK) {
-    char* msg;
-    gpr_asprintf(&msg, "Getting metadata from plugin failed with error: %s",
-                 error_details);
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
-    gpr_free(msg);
+    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("Getting metadata from plugin failed with error: ",
+                     error_details)
+            .c_str());
   } else {
     bool seen_illegal_header = false;
     for (size_t i = 0; i < num_md; ++i) {

data/src/core/lib/security/credentials/plugin/plugin_credentials.h

@@ -59,6 +59,8 @@ struct grpc_plugin_credentials final : public grpc_call_credentials {
   // cancelled before completion.
   void pending_request_complete(pending_request* r);
 
+  std::string debug_string() override;
+
  private:
   void pending_request_remove_locked(pending_request* pending_request);
 

data/src/core/lib/security/credentials/ssl/ssl_credentials.cc

@@ -117,6 +117,16 @@ void grpc_ssl_credentials::build_config(
   }
 }
 
+void grpc_ssl_credentials::set_min_tls_version(
+    grpc_tls_version min_tls_version) {
+  config_.min_tls_version = min_tls_version;
+}
+
+void grpc_ssl_credentials::set_max_tls_version(
+    grpc_tls_version max_tls_version) {
+  config_.max_tls_version = max_tls_version;
+}
+
 /* Deprecated in favor of grpc_ssl_credentials_create_ex. Will be removed
  * once all of its call sites are migrated to grpc_ssl_credentials_create_ex. */
 grpc_channel_credentials* grpc_ssl_credentials_create(
@@ -213,6 +223,16 @@ void grpc_ssl_server_credentials::build_config(
   config_.num_key_cert_pairs = num_key_cert_pairs;
 }
 
+void grpc_ssl_server_credentials::set_min_tls_version(
+    grpc_tls_version min_tls_version) {
+  config_.min_tls_version = min_tls_version;
+}
+
+void grpc_ssl_server_credentials::set_max_tls_version(
+    grpc_tls_version max_tls_version) {
+  config_.max_tls_version = max_tls_version;
+}
+
 grpc_ssl_server_certificate_config* grpc_ssl_server_certificate_config_create(
     const char* pem_root_certs,
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,

data/src/core/lib/security/credentials/ssl/ssl_credentials.h

@@ -38,6 +38,11 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
       const char* target, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
+  // TODO(mattstev): Plumb to wrapped languages. Until then, setting the TLS
+  // version should be done for testing purposes only.
+  void set_min_tls_version(grpc_tls_version min_tls_version);
+  void set_max_tls_version(grpc_tls_version max_tls_version);
+
  private:
   void build_config(const char* pem_root_certs,
                     grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
@@ -77,6 +82,11 @@ class grpc_ssl_server_credentials final : public grpc_server_credentials {
                                           config);
   }
 
+  // TODO(mattstev): Plumb to wrapped languages. Until then, setting the TLS
+  // version should be done for testing purposes only.
+  void set_min_tls_version(grpc_tls_version min_tls_version);
+  void set_max_tls_version(grpc_tls_version max_tls_version);
+
   const grpc_ssl_server_config& config() const { return config_; }
 
  private: