grpc 1.28.0 → 1.42.0

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -21,117 +21,26 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "absl/container/inlined_vector.h"
+
 #include <grpc/grpc_security.h>
 
-#include "src/core/lib/gprpp/inlined_vector.h"
 #include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 
-/** TLS key materials config. **/
-struct grpc_tls_key_materials_config
-    : public grpc_core::RefCounted<grpc_tls_key_materials_config> {
+struct grpc_tls_error_details
+    : public grpc_core::RefCounted<grpc_tls_error_details> {
  public:
-  typedef grpc_core::InlinedVector<grpc_core::PemKeyCertPair, 1>
-      PemKeyCertPairList;
-
-  /** Getters for member fields. **/
-  const char* pem_root_certs() const { return pem_root_certs_.get(); }
-  const PemKeyCertPairList& pem_key_cert_pair_list() const {
-    return pem_key_cert_pair_list_;
-  }
-  int version() const { return version_; }
-
-  /** Setters for member fields. **/
-  void set_pem_root_certs(grpc_core::UniquePtr<char> pem_root_certs) {
-    pem_root_certs_ = std::move(pem_root_certs);
-  }
-  void add_pem_key_cert_pair(grpc_core::PemKeyCertPair pem_key_cert_pair) {
-    pem_key_cert_pair_list_.push_back(pem_key_cert_pair);
+  grpc_tls_error_details() : error_details_("") {}
+  void set_error_details(const char* err_details) {
+    error_details_ = err_details;
   }
-  void set_key_materials(grpc_core::UniquePtr<char> pem_root_certs,
-                         PemKeyCertPairList pem_key_cert_pair_list);
-  void set_version(int version) { version_ = version; }
+  const std::string& error_details() { return error_details_; }
 
  private:
-  int version_ = 0;
-  PemKeyCertPairList pem_key_cert_pair_list_;
-  grpc_core::UniquePtr<char> pem_root_certs_;
-};
-
-/** TLS credential reload config. **/
-struct grpc_tls_credential_reload_config
-    : public grpc_core::RefCounted<grpc_tls_credential_reload_config> {
- public:
-  grpc_tls_credential_reload_config(
-      const void* config_user_data,
-      int (*schedule)(void* config_user_data,
-                      grpc_tls_credential_reload_arg* arg),
-      void (*cancel)(void* config_user_data,
-                     grpc_tls_credential_reload_arg* arg),
-      void (*destruct)(void* config_user_data));
-  ~grpc_tls_credential_reload_config();
-
-  void* context() const { return context_; }
-  void set_context(void* context) { context_ = context; }
-
-  int Schedule(grpc_tls_credential_reload_arg* arg) const {
-    if (schedule_ == nullptr) {
-      gpr_log(GPR_ERROR, "schedule API is nullptr");
-      if (arg != nullptr) {
-        arg->status = GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_FAIL;
-        arg->error_details =
-            gpr_strdup("schedule API in credential reload config is nullptr");
-      }
-      return 1;
-    }
-    if (arg != nullptr) {
-      arg->config = const_cast<grpc_tls_credential_reload_config*>(this);
-    }
-    return schedule_(config_user_data_, arg);
-  }
-  void Cancel(grpc_tls_credential_reload_arg* arg) const {
-    if (cancel_ == nullptr) {
-      gpr_log(GPR_ERROR, "cancel API is nullptr.");
-      if (arg != nullptr) {
-        arg->status = GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_FAIL;
-        arg->error_details =
-            gpr_strdup("cancel API in credential reload config is nullptr");
-      }
-      return;
-    }
-    if (arg != nullptr) {
-      arg->config = const_cast<grpc_tls_credential_reload_config*>(this);
-    }
-    cancel_(config_user_data_, arg);
-  }
-
- private:
-  /** This is a pointer to the wrapped language implementation of
-   * grpc_tls_credential_reload_config. It is necessary to implement the C
-   * schedule and cancel functions, given the schedule or cancel function in a
-   * wrapped language. **/
-  void* context_ = nullptr;
-  /** config-specific, read-only user data that works for all channels created
-     with a credential using the config. */
-  void* config_user_data_;
-  /** callback function for invoking credential reload API. The implementation
-     of this method has to be non-blocking, but can be performed synchronously
-     or asynchronously.
-     If processing occurs synchronously, it populates \a arg->key_materials, \a
-     arg->status, and \a arg->error_details and returns zero.
-     If processing occurs asynchronously, it returns a non-zero value.
-     Application then invokes \a arg->cb when processing is completed. Note that
-     \a arg->cb cannot be invoked before \a schedule returns.
-  */
-  int (*schedule_)(void* config_user_data, grpc_tls_credential_reload_arg* arg);
-  /** callback function for cancelling a credential reload request scheduled via
-     an asynchronous \a schedule. \a arg is used to pinpoint an exact reloading
-     request to be cancelled, and the operation may not have any effect if the
-     request has already been processed. */
-  void (*cancel_)(void* config_user_data, grpc_tls_credential_reload_arg* arg);
-  /** callback function for cleaning up any data associated with credential
-     reload config. */
-  void (*destruct_)(void* config_user_data);
+  std::string error_details_;
 };
 
 /** TLS server authorization check config. **/
@@ -145,43 +54,15 @@ struct grpc_tls_server_authorization_check_config
       void (*cancel)(void* config_user_data,
                      grpc_tls_server_authorization_check_arg* arg),
       void (*destruct)(void* config_user_data));
-  ~grpc_tls_server_authorization_check_config();
+  ~grpc_tls_server_authorization_check_config() override;
 
   void* context() const { return context_; }
+
   void set_context(void* context) { context_ = context; }
 
-  int Schedule(grpc_tls_server_authorization_check_arg* arg) const {
-    if (schedule_ == nullptr) {
-      gpr_log(GPR_ERROR, "schedule API is nullptr");
-      if (arg != nullptr) {
-        arg->status = GRPC_STATUS_NOT_FOUND;
-        arg->error_details = gpr_strdup(
-            "schedule API in server authorization check config is nullptr");
-      }
-      return 1;
-    }
-    if (arg != nullptr && context_ != nullptr) {
-      arg->config =
-          const_cast<grpc_tls_server_authorization_check_config*>(this);
-    }
-    return schedule_(config_user_data_, arg);
-  }
-  void Cancel(grpc_tls_server_authorization_check_arg* arg) const {
-    if (cancel_ == nullptr) {
-      gpr_log(GPR_ERROR, "cancel API is nullptr.");
-      if (arg != nullptr) {
-        arg->status = GRPC_STATUS_NOT_FOUND;
-        arg->error_details = gpr_strdup(
-            "schedule API in server authorization check config is nullptr");
-      }
-      return;
-    }
-    if (arg != nullptr) {
-      arg->config =
-          const_cast<grpc_tls_server_authorization_check_config*>(this);
-    }
-    cancel_(config_user_data_, arg);
-  }
+  int Schedule(grpc_tls_server_authorization_check_arg* arg) const;
+
+  void Cancel(grpc_tls_server_authorization_check_arg* arg) const;
 
  private:
   /** This is a pointer to the wrapped language implementation of
@@ -214,41 +95,38 @@ struct grpc_tls_server_authorization_check_config
   void (*destruct_)(void* config_user_data);
 };
 
-/* TLS credentials options. */
+// Contains configurable options specified by callers to configure their certain
+// security features supported in TLS.
+// TODO(ZhenLian): consider making this not ref-counted.
 struct grpc_tls_credentials_options
     : public grpc_core::RefCounted<grpc_tls_credentials_options> {
  public:
-  ~grpc_tls_credentials_options() {
-    if (key_materials_config_.get() != nullptr) {
-      key_materials_config_.get()->Unref();
-    }
-    if (credential_reload_config_.get() != nullptr) {
-      credential_reload_config_.get()->Unref();
-    }
-    if (server_authorization_check_config_.get() != nullptr) {
-      server_authorization_check_config_.get()->Unref();
-    }
-  }
+  ~grpc_tls_credentials_options() override = default;
 
-  /* Getters for member fields. */
+  // Getters for member fields.
   grpc_ssl_client_certificate_request_type cert_request_type() const {
     return cert_request_type_;
   }
   grpc_tls_server_verification_option server_verification_option() const {
     return server_verification_option_;
   }
-  grpc_tls_key_materials_config* key_materials_config() const {
-    return key_materials_config_.get();
-  }
-  grpc_tls_credential_reload_config* credential_reload_config() const {
-    return credential_reload_config_.get();
-  }
+  grpc_tls_version min_tls_version() const { return min_tls_version_; }
+  grpc_tls_version max_tls_version() const { return max_tls_version_; }
   grpc_tls_server_authorization_check_config*
   server_authorization_check_config() const {
     return server_authorization_check_config_.get();
   }
+  // Returns the distributor from provider_ if it is set, nullptr otherwise.
+  grpc_tls_certificate_distributor* certificate_distributor() {
+    if (provider_ != nullptr) return provider_->distributor().get();
+    return nullptr;
+  }
+  bool watch_root_cert() { return watch_root_cert_; }
+  const std::string& root_cert_name() { return root_cert_name_; }
+  bool watch_identity_pair() { return watch_identity_pair_; }
+  const std::string& identity_cert_name() { return identity_cert_name_; }
 
-  /* Setters for member fields. */
+  // Setters for member fields.
   void set_cert_request_type(
       const grpc_ssl_client_certificate_request_type type) {
     cert_request_type_ = type;
@@ -257,30 +135,59 @@ struct grpc_tls_credentials_options
       const grpc_tls_server_verification_option server_verification_option) {
     server_verification_option_ = server_verification_option;
   }
-  void set_key_materials_config(
-      grpc_core::RefCountedPtr<grpc_tls_key_materials_config> config) {
-    key_materials_config_ = std::move(config);
+  void set_min_tls_version(grpc_tls_version min_tls_version) {
+    min_tls_version_ = min_tls_version;
   }
-  void set_credential_reload_config(
-      grpc_core::RefCountedPtr<grpc_tls_credential_reload_config> config) {
-    credential_reload_config_ = std::move(config);
+  void set_max_tls_version(grpc_tls_version max_tls_version) {
+    max_tls_version_ = max_tls_version;
   }
   void set_server_authorization_check_config(
       grpc_core::RefCountedPtr<grpc_tls_server_authorization_check_config>
           config) {
     server_authorization_check_config_ = std::move(config);
   }
+  // Sets the provider in the options.
+  void set_certificate_provider(
+      grpc_core::RefCountedPtr<grpc_tls_certificate_provider> provider) {
+    provider_ = std::move(provider);
+  }
+  // If need to watch the updates of root certificates with name
+  // |root_cert_name|. The default value is false. If used in tls_credentials,
+  // it should always be set to true unless the root certificates are not
+  // needed.
+  void set_watch_root_cert(bool watch) { watch_root_cert_ = watch; }
+  // Sets the name of root certificates being watched, if |set_watch_root_cert|
+  // is called. If not set, an empty string will be used as the name.
+  void set_root_cert_name(std::string root_cert_name) {
+    root_cert_name_ = std::move(root_cert_name);
+  }
+  // If need to watch the updates of identity certificates with name
+  // |identity_cert_name|.
+  // The default value is false.
+  // If used in tls_credentials, it should always be set to true
+  // unless the identity key-cert pairs are not needed.
+  void set_watch_identity_pair(bool watch) { watch_identity_pair_ = watch; }
+  // Sets the name of identity key-cert pairs being watched, if
+  // |set_watch_identity_pair| is called. If not set, an empty string will
+  // be used as the name.
+  void set_identity_cert_name(std::string identity_cert_name) {
+    identity_cert_name_ = std::move(identity_cert_name);
+  }
 
  private:
-  grpc_ssl_client_certificate_request_type cert_request_type_;
+  grpc_ssl_client_certificate_request_type cert_request_type_ =
+      GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE;
   grpc_tls_server_verification_option server_verification_option_ =
       GRPC_TLS_SERVER_VERIFICATION;
-  grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
-  grpc_core::RefCountedPtr<grpc_tls_credential_reload_config>
-      credential_reload_config_;
+  grpc_tls_version min_tls_version_ = grpc_tls_version::TLS1_2;
+  grpc_tls_version max_tls_version_ = grpc_tls_version::TLS1_3;
   grpc_core::RefCountedPtr<grpc_tls_server_authorization_check_config>
       server_authorization_check_config_;
+  grpc_core::RefCountedPtr<grpc_tls_certificate_provider> provider_;
+  bool watch_root_cert_ = false;
+  std::string root_cert_name_;
+  bool watch_identity_pair_ = false;
+  std::string identity_cert_name_;
 };
 
-#endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H \
-        */
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H

data/src/core/lib/security/credentials/tls/tls_credentials.cc

@@ -40,18 +40,18 @@ bool CredentialOptionSanityCheck(const grpc_tls_credentials_options* options,
     gpr_log(GPR_ERROR, "TLS credentials options is nullptr.");
     return false;
   }
-  if (options->key_materials_config() == nullptr &&
-      options->credential_reload_config() == nullptr) {
-    gpr_log(GPR_ERROR,
-            "TLS credentials options must specify either key materials or "
-            "credential reload config.");
-    return false;
-  }
+  // TODO(ZhenLian): remove this when it is also supported on server side.
   if (!is_client && options->server_authorization_check_config() != nullptr) {
     gpr_log(GPR_INFO,
             "Server's credentials options should not contain server "
             "authorization check config.");
   }
+  if (options->server_verification_option() != GRPC_TLS_SERVER_VERIFICATION &&
+      options->server_authorization_check_config() == nullptr) {
+    gpr_log(GPR_ERROR,
+            "Should provider custom verifications if bypassing default ones.");
+    return false;
+  }
   return true;
 }
 
@@ -85,14 +85,16 @@ TlsCredentials::create_security_connector(
   }
   grpc_core::RefCountedPtr<grpc_channel_security_connector> sc =
       grpc_core::TlsChannelSecurityConnector::CreateTlsChannelSecurityConnector(
-          this->Ref(), std::move(call_creds), target_name,
+          this->Ref(), options_, std::move(call_creds), target_name,
           overridden_target_name, ssl_session_cache);
   if (sc == nullptr) {
     return nullptr;
   }
-  grpc_arg new_arg = grpc_channel_arg_string_create(
-      (char*)GRPC_ARG_HTTP2_SCHEME, (char*)"https");
-  *new_args = grpc_channel_args_copy_and_add(args, &new_arg, 1);
+  if (args != nullptr) {
+    grpc_arg new_arg = grpc_channel_arg_string_create(
+        const_cast<char*>(GRPC_ARG_HTTP2_SCHEME), const_cast<char*>("https"));
+    *new_args = grpc_channel_args_copy_and_add(args, &new_arg, 1);
+  }
   return sc;
 }
 
@@ -104,11 +106,14 @@ TlsServerCredentials::TlsServerCredentials(
 TlsServerCredentials::~TlsServerCredentials() {}
 
 grpc_core::RefCountedPtr<grpc_server_security_connector>
-TlsServerCredentials::create_security_connector() {
+TlsServerCredentials::create_security_connector(
+    const grpc_channel_args* /* args */) {
   return grpc_core::TlsServerSecurityConnector::
-      CreateTlsServerSecurityConnector(this->Ref());
+      CreateTlsServerSecurityConnector(this->Ref(), options_);
 }
 
+/** -- Wrapper APIs declared in grpc_security.h -- **/
+
 grpc_channel_credentials* grpc_tls_credentials_create(
     grpc_tls_credentials_options* options) {
   if (!CredentialOptionSanityCheck(options, true /* is_client */)) {

data/src/core/lib/security/credentials/tls/tls_credentials.h

@@ -38,7 +38,7 @@ class TlsCredentials final : public grpc_channel_credentials {
       const char* target_name, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
-  const grpc_tls_credentials_options& options() const { return *options_; }
+  grpc_tls_credentials_options* options() const { return options_.get(); }
 
  private:
   grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
@@ -51,9 +51,9 @@ class TlsServerCredentials final : public grpc_server_credentials {
   ~TlsServerCredentials() override;
 
   grpc_core::RefCountedPtr<grpc_server_security_connector>
-  create_security_connector() override;
+  create_security_connector(const grpc_channel_args* /* args */) override;
 
-  const grpc_tls_credentials_options& options() const { return *options_; }
+  grpc_tls_credentials_options* options() const { return options_.get(); }
 
  private:
   grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;

data/src/core/lib/security/credentials/tls/tls_utils.cc

@@ -0,0 +1,123 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/tls/tls_utils.h"
+
+#include "absl/strings/ascii.h"
+#include "absl/strings/match.h"
+#include "absl/strings/str_cat.h"
+
+namespace grpc_core {
+
+// Based on
+// https://github.com/grpc/grpc-java/blob/ca12e7a339add0ef48202fb72434b9dc0df41756/xds/src/main/java/io/grpc/xds/internal/sds/trust/SdsX509TrustManager.java#L62
+bool VerifySubjectAlternativeName(absl::string_view subject_alternative_name,
+                                  const std::string& matcher) {
+  if (subject_alternative_name.empty() ||
+      absl::StartsWith(subject_alternative_name, ".")) {
+    // Illegal pattern/domain name
+    return false;
+  }
+  if (matcher.empty() || absl::StartsWith(matcher, ".")) {
+    // Illegal domain name
+    return false;
+  }
+  // Normalize \a subject_alternative_name and \a matcher by turning them into
+  // absolute domain names if they are not yet absolute. This is needed because
+  // server certificates do not normally contain absolute names or patterns, but
+  // they should be treated as absolute. At the same time, any
+  // subject_alternative_name presented to this method should also be treated as
+  // absolute for the purposes of matching to the server certificate.
+  std::string normalized_san =
+      absl::EndsWith(subject_alternative_name, ".")
+          ? std::string(subject_alternative_name)
+          : absl::StrCat(subject_alternative_name, ".");
+  std::string normalized_matcher =
+      absl::EndsWith(matcher, ".") ? matcher : absl::StrCat(matcher, ".");
+  absl::AsciiStrToLower(&normalized_san);
+  absl::AsciiStrToLower(&normalized_matcher);
+  if (!absl::StrContains(normalized_san, "*")) {
+    return normalized_san == normalized_matcher;
+  }
+  // WILDCARD PATTERN RULES:
+  // 1. Asterisk (*) is only permitted in the left-most domain name label and
+  //    must be the only character in that label (i.e., must match the whole
+  //    left-most label). For example, *.example.com is permitted, while
+  //    *a.example.com, a*.example.com, a*b.example.com, a.*.example.com are
+  //    not permitted.
+  // 2. Asterisk (*) cannot match across domain name labels.
+  //    For example, *.example.com matches test.example.com but does not match
+  //    sub.test.example.com.
+  // 3. Wildcard patterns for single-label domain names are not permitted.
+  if (!absl::StartsWith(normalized_san, "*.")) {
+    // Asterisk (*) is only permitted in the left-most domain name label and
+    // must be the only character in that label
+    return false;
+  }
+  if (normalized_san == "*.") {
+    // Wildcard pattern for single-label domain name -- not permitted.
+    return false;
+  }
+  absl::string_view suffix = absl::string_view(normalized_san).substr(1);
+  if (absl::StrContains(suffix, "*")) {
+    // Asterisk (*) is not permitted in the suffix
+    return false;
+  }
+  if (!absl::EndsWith(normalized_matcher, suffix)) return false;
+  int suffix_start_index = normalized_matcher.length() - suffix.length();
+  // Asterisk matching across domain labels is not permitted.
+  return suffix_start_index <= 0 /* should not happen */ ||
+         normalized_matcher.find_last_of('.', suffix_start_index - 1) ==
+             std::string::npos;
+}
+
+absl::string_view GetAuthPropertyValue(grpc_auth_context* context,
+                                       const char* property_name) {
+  grpc_auth_property_iterator it =
+      grpc_auth_context_find_properties_by_name(context, property_name);
+  const grpc_auth_property* prop = grpc_auth_property_iterator_next(&it);
+  if (prop == nullptr) {
+    gpr_log(GPR_DEBUG, "No value found for %s property.", property_name);
+    return "";
+  }
+  if (grpc_auth_property_iterator_next(&it) != nullptr) {
+    gpr_log(GPR_DEBUG, "Multiple values found for %s property.", property_name);
+    return "";
+  }
+  return absl::string_view(prop->value, prop->value_length);
+}
+
+std::vector<absl::string_view> GetAuthPropertyArray(grpc_auth_context* context,
+                                                    const char* property_name) {
+  std::vector<absl::string_view> values;
+  grpc_auth_property_iterator it =
+      grpc_auth_context_find_properties_by_name(context, property_name);
+  const grpc_auth_property* prop = grpc_auth_property_iterator_next(&it);
+  while (prop != nullptr) {
+    values.emplace_back(prop->value, prop->value_length);
+    prop = grpc_auth_property_iterator_next(&it);
+  }
+  if (values.empty()) {
+    gpr_log(GPR_DEBUG, "No value found for %s property.", property_name);
+  }
+  return values;
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/credentials/tls/tls_utils.h

@@ -0,0 +1,51 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_TLS_UTILS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_TLS_UTILS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <string>
+#include <vector>
+
+#include "absl/strings/string_view.h"
+
+#include "src/core/lib/security/context/security_context.h"
+
+namespace grpc_core {
+
+// Matches \a subject_alternative_name with \a matcher. Returns true if there
+// is a match, false otherwise.
+bool VerifySubjectAlternativeName(absl::string_view subject_alternative_name,
+                                  const std::string& matcher);
+
+// Returns value for the specified property_name from auth context. Here the
+// property is expected to have a single value. Returns empty if multiple values
+// are found.
+absl::string_view GetAuthPropertyValue(grpc_auth_context* context,
+                                       const char* property_name);
+
+// Returns values for the specified property_name from auth context. Here the
+// property can have any number of values.
+std::vector<absl::string_view> GetAuthPropertyArray(grpc_auth_context* context,
+                                                    const char* property_name);
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_TLS_UTILS_H