grpc 1.31.0.pre1 → 1.33.0.pre1

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h

@@ -0,0 +1,214 @@
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_DISTRIBUTOR_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_DISTRIBUTOR_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include "absl/container/inlined_vector.h"
+#include "absl/types/optional.h"
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/security/security_connector/ssl_utils.h"
+
+// TLS certificate distributor.
+struct grpc_tls_certificate_distributor
+    : public grpc_core::RefCounted<grpc_tls_certificate_distributor> {
+ public:
+  typedef absl::InlinedVector<grpc_core::PemKeyCertPair, 1> PemKeyCertPairList;
+
+  // Interface for watching TLS certificates update.
+  class TlsCertificatesWatcherInterface {
+   public:
+    virtual ~TlsCertificatesWatcherInterface() = default;
+
+    // Handles the delivery of the updated root and identity certificates.
+    // An absl::nullopt value indicates no corresponding contents for
+    // root_certs or key_cert_pairs. Note that we will send updates of the
+    // latest contents for both root and identity certificates, even when only
+    // one side of it got updated.
+    //
+    // @param root_certs the contents of the reloaded root certs.
+    // @param key_cert_pairs the contents of the reloaded identity key-cert
+    // pairs.
+    virtual void OnCertificatesChanged(
+        absl::optional<absl::string_view> root_certs,
+        absl::optional<PemKeyCertPairList> key_cert_pairs) = 0;
+
+    // Handles an error that occurs while attempting to fetch certificate data.
+    // Note that if a watcher sees an error, it simply means the Provider is
+    // having problems renewing new data. If the watcher has previously received
+    // several OnCertificatesChanged, all the data received from that function
+    // is valid.
+    // In that case, watcher might simply log the error. If the watcher hasn't
+    // received any OnCertificatesChanged before the error occurs, no valid
+    // data is available yet, and the watcher should either fail or "waiting"
+    // for the valid data in a non-blocking way.
+    //
+    // @param root_cert_error the error occurred while reloading root
+    // certificates.
+    // @param identity_cert_error the error occurred while reloading identity
+    // certificates.
+    virtual void OnError(grpc_error* root_cert_error,
+                         grpc_error* identity_cert_error) = 0;
+  };
+
+  // Sets the key materials based on their certificate name. Note that we are
+  // not doing any copies for pem_root_certs and pem_key_cert_pairs. For
+  // pem_root_certs, the original string contents need to outlive the
+  // distributor; for pem_key_cert_pairs, internally it is taking two
+  // unique_ptr(s) to the credential string, so the ownership is actually
+  // transferred.
+  //
+  // @param cert_name The name of the certificates being updated.
+  // @param pem_root_certs The content of root certificates.
+  // @param pem_key_cert_pairs The content of identity key-cert pairs.
+  void SetKeyMaterials(const std::string& cert_name,
+                       absl::optional<std::string> pem_root_certs,
+                       absl::optional<PemKeyCertPairList> pem_key_cert_pairs);
+
+  bool HasRootCerts(const std::string& root_cert_name);
+
+  bool HasKeyCertPairs(const std::string& identity_cert_name);
+
+  // Propagates the error that the caller (e.g. Producer) encounters to all the
+  // watchers watching a particular certificate name.
+  //
+  // @param cert_name The watching cert name of the watchers that the caller
+  // wants to notify when encountering error.
+  // @param root_cert_error The error that the caller encounters when reloading
+  // root certs.
+  // @param identity_cert_error The error that the caller encounters when
+  // reloading identity certs.
+  void SetErrorForCert(const std::string& cert_name,
+                       absl::optional<grpc_error*> root_cert_error,
+                       absl::optional<grpc_error*> identity_cert_error);
+
+  // Propagates the error that the caller (e.g. Producer) encounters to all
+  // watchers.
+  //
+  // @param error The error that the caller encounters.
+  void SetError(grpc_error* error);
+
+  // Sets the TLS certificate watch status callback function. The
+  // grpc_tls_certificate_distributor will invoke this callback when a new
+  // certificate name is watched by a newly registered watcher, or when a
+  // certificate name is no longer watched by any watchers.
+  // Note that when the callback shows a cert is no longer being watched, the
+  // distributor will delete the corresponding certificate data from its cache,
+  // and clear the corresponding error, if there is any. This means that if the
+  // callback subsequently says the same cert is now being watched again, the
+  // provider must re-provide the credentials or re-invoke the errors to the
+  // distributor, to indicate a successful or failed reloading.
+  // @param callback The callback function being set by the caller, e.g the
+  // Producer. Note that this callback will be invoked for each certificate
+  // name.
+  //
+  // For the parameters in the callback function:
+  // string_value The name of the certificates being watched.
+  // bool_value_1 If the root certificates with the specific name are being
+  // watched. bool_value_2 If the identity certificates with the specific name
+  // are being watched.
+  void SetWatchStatusCallback(
+      std::function<void(std::string, bool, bool)> callback) {
+    grpc_core::MutexLock lock(&mu_);
+    watch_status_callback_ = callback;
+  };
+
+  // Registers a watcher. The caller may keep a raw pointer to the watcher,
+  // which may be used only for cancellation. (Because the caller does not own
+  // the watcher, the pointer must not be used for any other purpose.) At least
+  // one of root_cert_name and identity_cert_name must be specified.
+  //
+  // @param watcher The watcher being registered.
+  // @param root_cert_name The name of the root certificates that will be
+  // watched. If set to absl::nullopt, the root certificates won't be watched.
+  // @param identity_cert_name The name of the identity certificates that will
+  // be watched. If set to absl::nullopt, the identity certificates won't be
+  // watched.
+  void WatchTlsCertificates(
+      std::unique_ptr<TlsCertificatesWatcherInterface> watcher,
+      absl::optional<std::string> root_cert_name,
+      absl::optional<std::string> identity_cert_name);
+
+  // Cancels a watcher.
+  //
+  // @param watcher The watcher being cancelled.
+  void CancelTlsCertificatesWatch(TlsCertificatesWatcherInterface* watcher);
+
+ private:
+  // Contains the information about each watcher.
+  struct WatcherInfo {
+    std::unique_ptr<TlsCertificatesWatcherInterface> watcher;
+    absl::optional<std::string> root_cert_name;
+    absl::optional<std::string> identity_cert_name;
+  };
+  // CertificateInfo contains the credential contents and some additional
+  // watcher information.
+  // Note that having errors doesn't indicate the corresponding credentials are
+  // invalid. For example, if root_cert_error != nullptr but pem_root_certs has
+  // value, it simply means an error occurs while trying to fetch the latest
+  // root certs, while pem_root_certs still contains the valid old data.
+  struct CertificateInfo {
+    // The contents of the root certificates.
+    std::string pem_root_certs;
+    // The contents of the identity key-certificate pairs.
+    PemKeyCertPairList pem_key_cert_pairs;
+    // The root cert reloading error propagated by the caller.
+    grpc_error* root_cert_error = GRPC_ERROR_NONE;
+    // The identity cert reloading error propagated by the caller.
+    grpc_error* identity_cert_error = GRPC_ERROR_NONE;
+    // The set of watchers watching root certificates.
+    // This is mainly used for quickly looking up the affected watchers while
+    // performing a credential reloading.
+    std::set<TlsCertificatesWatcherInterface*> root_cert_watchers;
+    // The set of watchers watching identity certificates. This is mainly used
+    // for quickly looking up the affected watchers while performing a
+    // credential reloading.
+    std::set<TlsCertificatesWatcherInterface*> identity_cert_watchers;
+
+    ~CertificateInfo() {
+      GRPC_ERROR_UNREF(root_cert_error);
+      GRPC_ERROR_UNREF(identity_cert_error);
+    }
+    void SetRootError(grpc_error* error) {
+      GRPC_ERROR_UNREF(root_cert_error);
+      root_cert_error = error;
+    }
+    void SetIdentityError(grpc_error* error) {
+      GRPC_ERROR_UNREF(identity_cert_error);
+      identity_cert_error = error;
+    }
+  };
+
+  grpc_core::Mutex mu_;
+  // We need a dedicated mutex for watch_status_callback_ for allowing
+  // callers(e.g. Producer) to directly set key materials in the callback
+  // functions.
+  grpc_core::Mutex callback_mu_;
+  // Stores information about each watcher.
+  std::map<TlsCertificatesWatcherInterface*, WatcherInfo> watchers_;
+  // The callback to notify the caller, e.g. the Producer, that the watch status
+  // is changed.
+  std::function<void(std::string, bool, bool)> watch_status_callback_;
+  // Stores the names of each certificate, and their corresponding credential
+  // contents as well as some additional watcher information.
+  std::map<std::string, CertificateInfo> certificate_info_map_;
+};
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_DISTRIBUTOR_H

data/src/core/lib/security/credentials/xds/xds_credentials.cc

@@ -0,0 +1,45 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/xds/xds_credentials.h"
+
+namespace grpc_core {
+
+constexpr const char XdsCredentials::kCredentialsTypeXds[];
+
+grpc_core::RefCountedPtr<grpc_channel_security_connector>
+XdsCredentials::create_security_connector(
+    grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+    const char* target_name, const grpc_channel_args* args,
+    grpc_channel_args** new_args) {
+  /* TODO(yashkt) : To be filled */
+  if (fallback_credentials_ != nullptr) {
+    return fallback_credentials_->create_security_connector(
+        std::move(call_creds), target_name, args, new_args);
+  }
+  return nullptr;
+}
+
+}  // namespace grpc_core
+
+grpc_channel_credentials* grpc_xds_credentials_create(
+    grpc_channel_credentials* fallback_credentials) {
+  return new grpc_core::XdsCredentials(fallback_credentials->Ref());
+}

data/src/core/lib/security/credentials/xds/xds_credentials.h

@@ -0,0 +1,51 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_XDS_XDS_CREDENTIALS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_XDS_XDS_CREDENTIALS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/security/credentials/credentials.h"
+
+namespace grpc_core {
+
+class XdsCredentials final : public grpc_channel_credentials {
+ public:
+  static constexpr const char kCredentialsTypeXds[] = "Xds";
+
+  explicit XdsCredentials(
+      grpc_core::RefCountedPtr<grpc_channel_credentials> fallback_credentials)
+      : grpc_channel_credentials(kCredentialsTypeXds),
+        fallback_credentials_(std::move(fallback_credentials)) {}
+
+  grpc_core::RefCountedPtr<grpc_channel_security_connector>
+  create_security_connector(
+      grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+      const char* target_name, const grpc_channel_args* args,
+      grpc_channel_args** new_args) override;
+
+ private:
+  grpc_core::RefCountedPtr<grpc_channel_credentials> fallback_credentials_;
+};
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_XDS_XDS_CREDENTIALS_H */

data/src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -29,8 +29,8 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.h"
-#include "src/core/ext/filters/client_channel/xds/xds_channel_args.h"
 #include "src/core/ext/transport/chttp2/alpn/alpn.h"
+#include "src/core/ext/xds/xds_channel_args.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/handshaker.h"
 #include "src/core/lib/gpr/string.h"
@@ -40,7 +40,6 @@
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/fake/fake_credentials.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
-#include "src/core/lib/security/transport/target_authority_table.h"
 #include "src/core/tsi/fake_transport_security.h"
 
 namespace {
@@ -57,11 +56,9 @@ class grpc_fake_channel_security_connector final
         target_(gpr_strdup(target)),
         expected_targets_(
             gpr_strdup(grpc_fake_transport_get_expected_targets(args))),
-        is_lb_channel_(
-            grpc_channel_args_find(args, GRPC_ARG_ADDRESS_IS_XDS_SERVER) !=
-                nullptr ||
-            grpc_channel_args_find(
-                args, GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER) != nullptr) {
+        is_lb_channel_(grpc_channel_args_find(
+                           args, GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER) !=
+                       nullptr) {
     const grpc_arg* target_name_override_arg =
         grpc_channel_args_find(args, GRPC_SSL_TARGET_NAME_OVERRIDE_ARG);
     if (target_name_override_arg != nullptr) {
@@ -148,9 +145,7 @@ class grpc_fake_channel_security_connector final
   char* target_name_override() const { return target_name_override_; }
 
  private:
-  bool fake_check_target(const char* target_type, const char* target,
-                         const char* set_str) const {
-    GPR_ASSERT(target_type != nullptr);
+  bool fake_check_target(const char* target, const char* set_str) const {
     GPR_ASSERT(target != nullptr);
     char** set = nullptr;
     size_t set_size = 0;
@@ -186,14 +181,14 @@ class grpc_fake_channel_security_connector final
                 expected_targets_);
         goto done;
       }
-      if (!fake_check_target("LB", target_, lbs_and_backends[1])) {
+      if (!fake_check_target(target_, lbs_and_backends[1])) {
         gpr_log(GPR_ERROR, "LB target '%s' not found in expected set '%s'",
                 target_, lbs_and_backends[1]);
         goto done;
       }
       success = true;
     } else {
-      if (!fake_check_target("Backend", target_, lbs_and_backends[0])) {
+      if (!fake_check_target(target_, lbs_and_backends[0])) {
         gpr_log(GPR_ERROR, "Backend target '%s' not found in expected set '%s'",
                 target_, lbs_and_backends[0]);
         goto done;

data/src/core/lib/security/security_connector/ssl_utils.h

@@ -174,6 +174,11 @@ class PemKeyCertPair {
     return *this;
   }
 
+  bool operator==(const PemKeyCertPair& other) const {
+    return std::strcmp(this->private_key(), other.private_key()) == 0 &&
+           std::strcmp(this->cert_chain(), other.cert_chain()) == 0;
+  }
+
   char* private_key() const { return private_key_.get(); }
   char* cert_chain() const { return cert_chain_.get(); }
 

data/src/core/lib/security/transport/secure_endpoint.cc

@@ -401,11 +401,16 @@ static void endpoint_delete_from_pollset_set(grpc_endpoint* secure_ep,
   grpc_endpoint_delete_from_pollset_set(ep->wrapped_ep, pollset_set);
 }
 
-static char* endpoint_get_peer(grpc_endpoint* secure_ep) {
+static absl::string_view endpoint_get_peer(grpc_endpoint* secure_ep) {
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
   return grpc_endpoint_get_peer(ep->wrapped_ep);
 }
 
+static absl::string_view endpoint_get_local_address(grpc_endpoint* secure_ep) {
+  secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
+  return grpc_endpoint_get_local_address(ep->wrapped_ep);
+}
+
 static int endpoint_get_fd(grpc_endpoint* secure_ep) {
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
   return grpc_endpoint_get_fd(ep->wrapped_ep);
@@ -431,6 +436,7 @@ static const grpc_endpoint_vtable vtable = {endpoint_read,
                                             endpoint_destroy,
                                             endpoint_get_resource_user,
                                             endpoint_get_peer,
+                                            endpoint_get_local_address,
                                             endpoint_get_fd,
                                             endpoint_can_track_err};
 

data/src/core/lib/surface/call.cc

@@ -245,7 +245,7 @@ struct grpc_call {
     struct {
       int* cancelled;
       // backpointer to owning server if this is a server side call.
-      grpc_server* server;
+      grpc_core::Server* core_server;
     } server;
   } final_op;
   gpr_atm status_error = 0;
@@ -374,7 +374,7 @@ grpc_error* grpc_call_create(const grpc_call_create_args* args,
   } else {
     GRPC_STATS_INC_SERVER_CALLS_CREATED();
     call->final_op.server.cancelled = nullptr;
-    call->final_op.server.server = args->server;
+    call->final_op.server.core_server = args->server;
     GPR_ASSERT(args->add_initial_metadata_count == 0);
     call->send_extra_metadata_count = 0;
   }
@@ -476,11 +476,11 @@ grpc_error* grpc_call_create(const grpc_call_create_args* args,
     if (channelz_channel != nullptr) {
       channelz_channel->RecordCallStarted();
     }
-  } else {
-    grpc_core::channelz::ServerNode* channelz_server =
-        grpc_server_get_channelz_node(call->final_op.server.server);
-    if (channelz_server != nullptr) {
-      channelz_server->RecordCallStarted();
+  } else if (call->final_op.server.core_server != nullptr) {
+    grpc_core::channelz::ServerNode* channelz_node =
+        call->final_op.server.core_server->channelz_node();
+    if (channelz_node != nullptr) {
+      channelz_node->RecordCallStarted();
     }
   }
 
@@ -759,15 +759,15 @@ static void set_final_status(grpc_call* call, grpc_error* error) {
   } else {
     *call->final_op.server.cancelled =
         error != GRPC_ERROR_NONE || !call->sent_server_trailing_metadata;
-    grpc_core::channelz::ServerNode* channelz_server =
-        grpc_server_get_channelz_node(call->final_op.server.server);
-    if (channelz_server != nullptr) {
+    grpc_core::channelz::ServerNode* channelz_node =
+        call->final_op.server.core_server->channelz_node();
+    if (channelz_node != nullptr) {
       if (*call->final_op.server.cancelled ||
           reinterpret_cast<grpc_error*>(
               gpr_atm_acq_load(&call->status_error)) != GRPC_ERROR_NONE) {
-        channelz_server->RecordCallFailed();
+        channelz_node->RecordCallFailed();
       } else {
-        channelz_server->RecordCallSucceeded();
+        channelz_node->RecordCallSucceeded();
       }
     }
     GRPC_ERROR_UNREF(error);