grpc 1.30.2 → 1.32.0

data/src/core/lib/iomgr/unix_sockets_posix.cc

@@ -28,6 +28,8 @@
 #include <sys/types.h>
 #include <sys/un.h>
 
+#include "absl/strings/str_cat.h"
+
 #include "src/core/lib/iomgr/unix_sockets_posix.h"
 
 #include <grpc/support/alloc.h>
@@ -44,14 +46,10 @@ grpc_error* grpc_resolve_unix_domain_address(const char* name,
   struct sockaddr_un* un;
   if (strlen(name) >
       GPR_ARRAY_SIZE(((struct sockaddr_un*)nullptr)->sun_path) - 1) {
-    char* err_msg;
-    grpc_error* err;
-    gpr_asprintf(&err_msg,
-                 "Path name should not have more than %" PRIuPTR " characters.",
-                 GPR_ARRAY_SIZE(un->sun_path) - 1);
-    err = GRPC_ERROR_CREATE_FROM_COPIED_STRING(err_msg);
-    gpr_free(err_msg);
-    return err;
+    return GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("Path name should not have more than ",
+                     GPR_ARRAY_SIZE(un->sun_path) - 1, " characters")
+            .c_str());
   }
   *addrs = static_cast<grpc_resolved_addresses*>(
       gpr_malloc(sizeof(grpc_resolved_addresses)));
@@ -88,17 +86,14 @@ void grpc_unlink_if_unix_domain_socket(
   }
 }
 
-char* grpc_sockaddr_to_uri_unix_if_possible(
+std::string grpc_sockaddr_to_uri_unix_if_possible(
     const grpc_resolved_address* resolved_addr) {
   const grpc_sockaddr* addr =
       reinterpret_cast<const grpc_sockaddr*>(resolved_addr->addr);
   if (addr->sa_family != AF_UNIX) {
-    return nullptr;
+    return "";
   }
-
-  char* result;
-  gpr_asprintf(&result, "unix:%s", ((struct sockaddr_un*)addr)->sun_path);
-  return result;
+  return absl::StrCat("unix:", ((struct sockaddr_un*)addr)->sun_path);
 }
 
 #endif

data/src/core/lib/iomgr/unix_sockets_posix.h

@@ -21,6 +21,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <string>
+
 #include "src/core/lib/iomgr/port.h"
 
 #include <grpc/support/string_util.h>
@@ -37,7 +39,7 @@ int grpc_is_unix_socket(const grpc_resolved_address* resolved_addr);
 void grpc_unlink_if_unix_domain_socket(
     const grpc_resolved_address* resolved_addr);
 
-char* grpc_sockaddr_to_uri_unix_if_possible(
+std::string grpc_sockaddr_to_uri_unix_if_possible(
     const grpc_resolved_address* resolved_addr);
 
 #endif /* GRPC_CORE_LIB_IOMGR_UNIX_SOCKETS_POSIX_H */

data/src/core/lib/iomgr/unix_sockets_posix_noop.cc

@@ -22,6 +22,8 @@
 
 #ifndef GRPC_HAVE_UNIX_SOCKET
 
+#include <string>
+
 #include <grpc/support/log.h>
 
 void grpc_create_socketpair_if_unix(int sv[2]) {
@@ -42,8 +44,9 @@ int grpc_is_unix_socket(const grpc_resolved_address* addr) { return false; }
 
 void grpc_unlink_if_unix_domain_socket(const grpc_resolved_address* addr) {}
 
-char* grpc_sockaddr_to_uri_unix_if_possible(const grpc_resolved_address* addr) {
-  return NULL;
+std::string grpc_sockaddr_to_uri_unix_if_possible(
+    const grpc_resolved_address* addr) {
+  return "";
 }
 
 #endif

data/src/core/lib/json/json_reader.cc

@@ -20,8 +20,12 @@
 
 #include <string.h>
 
+#include <string>
+
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_format.h"
+
 #include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
 
 #include "src/core/lib/json/json.h"
 
@@ -176,11 +180,10 @@ Json* JsonReader::CreateAndLinkValue() {
         if (errors_.size() == GRPC_JSON_MAX_ERRORS) {
           truncated_errors_ = true;
         } else {
-          char* msg;
-          gpr_asprintf(&msg, "duplicate key \"%s\" at index %" PRIuPTR,
-                       key_.c_str(), CurrentIndex());
-          errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg));
-          gpr_free(msg);
+          errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+              absl::StrFormat("duplicate key \"%s\" at index %" PRIuPTR, key_,
+                              CurrentIndex())
+                  .c_str()));
         }
       }
       value = &(*parent->mutable_object())[std::move(key_)];
@@ -198,11 +201,10 @@ bool JsonReader::StartContainer(Json::Type type) {
     if (errors_.size() == GRPC_JSON_MAX_ERRORS) {
       truncated_errors_ = true;
     } else {
-      char* msg;
-      gpr_asprintf(&msg, "exceeded max stack depth (%d) at index %" PRIuPTR,
-                   GRPC_JSON_MAX_DEPTH, CurrentIndex());
-      errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg));
-      gpr_free(msg);
+      errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrFormat("exceeded max stack depth (%d) at index %" PRIuPTR,
+                          GRPC_JSON_MAX_DEPTH, CurrentIndex())
+              .c_str()));
     }
     return false;
   }
@@ -824,17 +826,14 @@ grpc_error* JsonReader::Parse(absl::string_view input, Json* output) {
         "errors and try again to see additional errors"));
   }
   if (status == Status::GRPC_JSON_INTERNAL_ERROR) {
-    char* msg;
-    gpr_asprintf(&msg, "internal error in JSON parser at index %" PRIuPTR,
-                 reader.CurrentIndex());
-    reader.errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg));
-    gpr_free(msg);
+    reader.errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("internal error in JSON parser at index ",
+                     reader.CurrentIndex())
+            .c_str()));
   } else if (status == Status::GRPC_JSON_PARSE_ERROR) {
-    char* msg;
-    gpr_asprintf(&msg, "JSON parse error at index %" PRIuPTR,
-                 reader.CurrentIndex());
-    reader.errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg));
-    gpr_free(msg);
+    reader.errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("JSON parse error at index ", reader.CurrentIndex())
+            .c_str()));
   }
   if (!reader.errors_.empty()) {
     return GRPC_ERROR_CREATE_FROM_VECTOR("JSON parsing failed",

data/src/core/lib/security/authorization/authorization_engine.cc

@@ -0,0 +1,177 @@
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "absl/memory/memory.h"
+
+#include "src/core/lib/security/authorization/authorization_engine.h"
+
+namespace grpc_core {
+
+namespace {
+
+// Symbols for traversing Envoy Attributes
+constexpr char kUrlPath[] = "url_path";
+constexpr char kHost[] = "host";
+constexpr char kMethod[] = "method";
+constexpr char kHeaders[] = "headers";
+constexpr char kSourceAddress[] = "source_address";
+constexpr char kSourcePort[] = "source_port";
+constexpr char kDestinationAddress[] = "destination_address";
+constexpr char kDestinationPort[] = "destination_port";
+constexpr char kSpiffeId[] = "spiffe_id";
+constexpr char kCertServerName[] = "cert_server_name";
+
+}  // namespace
+
+std::unique_ptr<AuthorizationEngine>
+AuthorizationEngine::CreateAuthorizationEngine(
+    const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies) {
+  if (rbac_policies.empty() || rbac_policies.size() > 2) {
+    gpr_log(GPR_ERROR,
+            "Invalid rbac policies vector. Must contain either one or two rbac "
+            "policies.");
+    return nullptr;
+  } else if (rbac_policies.size() == 2 &&
+             (envoy_config_rbac_v3_RBAC_action(rbac_policies[0]) != kDeny ||
+              envoy_config_rbac_v3_RBAC_action(rbac_policies[1]) != kAllow)) {
+    gpr_log(GPR_ERROR,
+            "Invalid rbac policies vector. Must contain one deny \
+                         policy and one allow policy, in that order.");
+    return nullptr;
+  } else {
+    return absl::make_unique<AuthorizationEngine>(rbac_policies);
+  }
+}
+
+AuthorizationEngine::AuthorizationEngine(
+    const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies) {
+  for (const auto& rbac_policy : rbac_policies) {
+    // Extract array of policies and store their condition fields in either
+    // allow_if_matched_ or deny_if_matched_, depending on the policy action.
+    upb::Arena temp_arena;
+    size_t policy_num = UPB_MAP_BEGIN;
+    const envoy_config_rbac_v3_RBAC_PoliciesEntry* policy_entry;
+    while ((policy_entry = envoy_config_rbac_v3_RBAC_policies_next(
+                rbac_policy, &policy_num)) != nullptr) {
+      const upb_strview policy_name_strview =
+          envoy_config_rbac_v3_RBAC_PoliciesEntry_key(policy_entry);
+      const std::string policy_name(policy_name_strview.data,
+                                    policy_name_strview.size);
+      const envoy_config_rbac_v3_Policy* policy =
+          envoy_config_rbac_v3_RBAC_PoliciesEntry_value(policy_entry);
+      const google_api_expr_v1alpha1_Expr* condition =
+          envoy_config_rbac_v3_Policy_condition(policy);
+      // Parse condition to make a pointer tied to the lifetime of arena_.
+      size_t serial_len;
+      const char* serialized = google_api_expr_v1alpha1_Expr_serialize(
+          condition, temp_arena.ptr(), &serial_len);
+      const google_api_expr_v1alpha1_Expr* parsed_condition =
+          google_api_expr_v1alpha1_Expr_parse(serialized, serial_len,
+                                              arena_.ptr());
+      if (envoy_config_rbac_v3_RBAC_action(rbac_policy) == kAllow) {
+        allow_if_matched_.insert(std::make_pair(policy_name, parsed_condition));
+      } else {
+        deny_if_matched_.insert(std::make_pair(policy_name, parsed_condition));
+      }
+    }
+  }
+}
+
+std::unique_ptr<mock_cel::Activation> AuthorizationEngine::CreateActivation(
+    const EvaluateArgs& args) {
+  std::unique_ptr<mock_cel::Activation> activation;
+  for (const auto& elem : envoy_attributes_) {
+    if (elem == kUrlPath) {
+      absl::string_view url_path(args.GetPath());
+      if (!url_path.empty()) {
+        activation->InsertValue(kUrlPath,
+                                mock_cel::CelValue::CreateStringView(url_path));
+      }
+    } else if (elem == kHost) {
+      absl::string_view host(args.GetHost());
+      if (!host.empty()) {
+        activation->InsertValue(kHost,
+                                mock_cel::CelValue::CreateStringView(host));
+      }
+    } else if (elem == kMethod) {
+      absl::string_view method(args.GetMethod());
+      if (!method.empty()) {
+        activation->InsertValue(kMethod,
+                                mock_cel::CelValue::CreateStringView(method));
+      }
+    } else if (elem == kHeaders) {
+      std::multimap<absl::string_view, absl::string_view> headers =
+          args.GetHeaders();
+      std::vector<std::pair<mock_cel::CelValue, mock_cel::CelValue>>
+          header_items;
+      for (const auto& header_key : header_keys_) {
+        auto header_item = headers.find(header_key);
+        if (header_item != headers.end()) {
+          header_items.push_back(
+              std::pair<mock_cel::CelValue, mock_cel::CelValue>(
+                  mock_cel::CelValue::CreateStringView(header_key),
+                  mock_cel::CelValue::CreateStringView(header_item->second)));
+        }
+      }
+      headers_ = mock_cel::ContainerBackedMapImpl::Create(
+          absl::Span<std::pair<mock_cel::CelValue, mock_cel::CelValue>>(
+              header_items));
+      activation->InsertValue(kHeaders,
+                              mock_cel::CelValue::CreateMap(headers_.get()));
+    } else if (elem == kSourceAddress) {
+      absl::string_view source_address(args.GetPeerAddress());
+      if (!source_address.empty()) {
+        activation->InsertValue(
+            kSourceAddress,
+            mock_cel::CelValue::CreateStringView(source_address));
+      }
+    } else if (elem == kSourcePort) {
+      activation->InsertValue(
+          kSourcePort, mock_cel::CelValue::CreateInt64(args.GetPeerPort()));
+    } else if (elem == kDestinationAddress) {
+      absl::string_view destination_address(args.GetLocalAddress());
+      if (!destination_address.empty()) {
+        activation->InsertValue(
+            kDestinationAddress,
+            mock_cel::CelValue::CreateStringView(destination_address));
+      }
+    } else if (elem == kDestinationPort) {
+      activation->InsertValue(kDestinationPort, mock_cel::CelValue::CreateInt64(
+                                                    args.GetLocalPort()));
+    } else if (elem == kSpiffeId) {
+      absl::string_view spiffe_id(args.GetSpiffeId());
+      if (!spiffe_id.empty()) {
+        activation->InsertValue(
+            kSpiffeId, mock_cel::CelValue::CreateStringView(spiffe_id));
+      }
+    } else if (elem == kCertServerName) {
+      absl::string_view cert_server_name(args.GetCertServerName());
+      if (!cert_server_name.empty()) {
+        activation->InsertValue(
+            kCertServerName,
+            mock_cel::CelValue::CreateStringView(cert_server_name));
+      }
+    } else {
+      gpr_log(GPR_ERROR,
+              "Error: Authorization engine does not support evaluating "
+              "attribute %s.",
+              elem.c_str());
+    }
+  }
+  return activation;
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/authorization/authorization_engine.h

@@ -0,0 +1,84 @@
+
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/support/log.h>
+#include <map>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "absl/container/flat_hash_set.h"
+#include "envoy/config/rbac/v3/rbac.upb.h"
+#include "google/api/expr/v1alpha1/syntax.upb.h"
+#include "upb/upb.hpp"
+
+#include "src/core/lib/security/authorization/evaluate_args.h"
+#include "src/core/lib/security/authorization/mock_cel/activation.h"
+
+namespace grpc_core {
+
+// AuthorizationEngine makes an AuthorizationDecision to ALLOW or DENY the
+// current action based on the condition fields in provided RBAC policies.
+// The engine may be constructed with one or two policies. If two polcies,
+// the first policy is deny-if-matched and the second is allow-if-matched.
+// The engine returns UNDECIDED decision if it fails to find a match in any
+// policy. This engine ignores the principal and permission fields in RBAC
+// policies. It is the caller's responsibility to provide RBAC policies that
+// are compatible with this engine.
+//
+// Example:
+// AuthorizationEngine*
+// auth_engine = AuthorizationEngine::CreateAuthorizationEngine(rbac_policies);
+// auth_engine->Evaluate(evaluate_args); // returns authorization decision.
+class AuthorizationEngine {
+ public:
+  // rbac_policies must be a vector containing either a single policy of any
+  // kind, or one deny policy and one allow policy, in that order.
+  static std::unique_ptr<AuthorizationEngine> CreateAuthorizationEngine(
+      const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies);
+
+  // Users should use the CreateAuthorizationEngine factory function
+  // instead of calling the AuthorizationEngine constructor directly.
+  explicit AuthorizationEngine(
+      const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies);
+  // TODO(mywang@google.com): add an Evaluate member function.
+
+ private:
+  enum Action {
+    kAllow,
+    kDeny,
+  };
+
+  std::unique_ptr<mock_cel::Activation> CreateActivation(
+      const EvaluateArgs& args);
+
+  std::map<const std::string, const google_api_expr_v1alpha1_Expr*>
+      deny_if_matched_;
+  std::map<const std::string, const google_api_expr_v1alpha1_Expr*>
+      allow_if_matched_;
+  upb::Arena arena_;
+  absl::flat_hash_set<std::string> envoy_attributes_;
+  absl::flat_hash_set<std::string> header_keys_;
+  std::unique_ptr<mock_cel::CelMap> headers_;
+};
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H */

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -0,0 +1,153 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/evaluate_args.h"
+
+#include "src/core/lib/iomgr/parse_address.h"
+#include "src/core/lib/iomgr/resolve_address.h"
+#include "src/core/lib/iomgr/sockaddr_utils.h"
+#include "src/core/lib/slice/slice_utils.h"
+
+namespace grpc_core {
+
+absl::string_view EvaluateArgs::GetPath() const {
+  absl::string_view path;
+  if (metadata_ != nullptr && metadata_->idx.named.path != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->idx.named.path;
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    path = StringViewFromSlice(val);
+  }
+  return path;
+}
+
+absl::string_view EvaluateArgs::GetHost() const {
+  absl::string_view host;
+  if (metadata_ != nullptr && metadata_->idx.named.host != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->idx.named.host;
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    host = StringViewFromSlice(val);
+  }
+  return host;
+}
+
+absl::string_view EvaluateArgs::GetMethod() const {
+  absl::string_view method;
+  if (metadata_ != nullptr && metadata_->idx.named.method != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->idx.named.method;
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    method = StringViewFromSlice(val);
+  }
+  return method;
+}
+
+std::multimap<absl::string_view, absl::string_view> EvaluateArgs::GetHeaders()
+    const {
+  std::multimap<absl::string_view, absl::string_view> headers;
+  if (metadata_ == nullptr) {
+    return headers;
+  }
+  for (grpc_linked_mdelem* elem = metadata_->list.head; elem != nullptr;
+       elem = elem->next) {
+    const grpc_slice& key = GRPC_MDKEY(elem->md);
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    headers.emplace(StringViewFromSlice(key), StringViewFromSlice(val));
+  }
+  return headers;
+}
+
+absl::string_view EvaluateArgs::GetLocalAddress() const {
+  absl::string_view addr = grpc_endpoint_get_local_address(endpoint_);
+  size_t first_colon = addr.find(":");
+  size_t last_colon = addr.rfind(":");
+  if (first_colon == std::string::npos || last_colon == std::string::npos) {
+    return "";
+  } else {
+    return addr.substr(first_colon + 1, last_colon - first_colon - 1);
+  }
+}
+
+int EvaluateArgs::GetLocalPort() const {
+  if (endpoint_ == nullptr) {
+    return 0;
+  }
+  grpc_uri* uri = grpc_uri_parse(
+      std::string(grpc_endpoint_get_local_address(endpoint_)).c_str(), true);
+  grpc_resolved_address resolved_addr;
+  if (uri == nullptr || !grpc_parse_uri(uri, &resolved_addr)) {
+    grpc_uri_destroy(uri);
+    return 0;
+  }
+  grpc_uri_destroy(uri);
+  return grpc_sockaddr_get_port(&resolved_addr);
+}
+
+absl::string_view EvaluateArgs::GetPeerAddress() const {
+  absl::string_view addr = grpc_endpoint_get_peer(endpoint_);
+  size_t first_colon = addr.find(":");
+  size_t last_colon = addr.rfind(":");
+  if (first_colon == std::string::npos || last_colon == std::string::npos) {
+    return "";
+  } else {
+    return addr.substr(first_colon + 1, last_colon - first_colon - 1);
+  }
+}
+
+int EvaluateArgs::GetPeerPort() const {
+  if (endpoint_ == nullptr) {
+    return 0;
+  }
+  grpc_uri* uri = grpc_uri_parse(
+      std::string(grpc_endpoint_get_peer(endpoint_)).c_str(), true);
+  grpc_resolved_address resolved_addr;
+  if (uri == nullptr || !grpc_parse_uri(uri, &resolved_addr)) {
+    grpc_uri_destroy(uri);
+    return 0;
+  }
+  grpc_uri_destroy(uri);
+  return grpc_sockaddr_get_port(&resolved_addr);
+}
+
+absl::string_view EvaluateArgs::GetSpiffeId() const {
+  if (auth_context_ == nullptr) {
+    return "";
+  }
+  grpc_auth_property_iterator it = grpc_auth_context_find_properties_by_name(
+      auth_context_, GRPC_PEER_SPIFFE_ID_PROPERTY_NAME);
+  const grpc_auth_property* prop = grpc_auth_property_iterator_next(&it);
+  if (prop == nullptr || grpc_auth_property_iterator_next(&it) != nullptr) {
+    return "";
+  }
+  return absl::string_view(prop->value, prop->value_length);
+}
+
+absl::string_view EvaluateArgs::GetCertServerName() const {
+  if (auth_context_ == nullptr) {
+    return "";
+  }
+  grpc_auth_property_iterator it = grpc_auth_context_find_properties_by_name(
+      auth_context_, GRPC_X509_CN_PROPERTY_NAME);
+  const grpc_auth_property* prop = grpc_auth_property_iterator_next(&it);
+  if (prop == nullptr || grpc_auth_property_iterator_next(&it) != nullptr) {
+    return "";
+  }
+  return absl::string_view(prop->value, prop->value_length);
+}
+
+}  // namespace grpc_core