grpc 1.31.0.pre2 → 1.34.0

data/src/core/ext/xds/certificate_provider_store.h

@@ -0,0 +1,107 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_EXT_XDS_CERTIFICATE_PROVIDER_STORE_H
+#define GRPC_CORE_EXT_XDS_CERTIFICATE_PROVIDER_STORE_H
+
+#include <grpc/support/port_platform.h>
+
+#include <map>
+
+#include "absl/strings/string_view.h"
+
+#include "src/core/ext/xds/certificate_provider_factory.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/sync.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
+
+namespace grpc_core {
+
+// Map for xDS based grpc_tls_certificate_provider instances. The store should
+// outlive the refs taken via `CreateOrGetCertificateProvider()`.
+class CertificateProviderStore {
+ public:
+  struct PluginDefinition {
+    std::string plugin_name;
+    RefCountedPtr<CertificateProviderFactory::Config> config;
+  };
+
+  // Maps plugin instance (opaque) name to plugin defition.
+  typedef std::map<std::string, PluginDefinition> PluginDefinitionMap;
+
+  CertificateProviderStore(PluginDefinitionMap plugin_config_map)
+      : plugin_config_map_(std::move(plugin_config_map)) {}
+
+  // If a certificate provider corresponding to the instance name \a key is
+  // found, a ref to the grpc_tls_certificate_provider is returned. If no
+  // provider is found for the key, a new provider is created from the plugin
+  // definition map.
+  // Returns nullptr on failure to get or create a new certificate provider.
+  RefCountedPtr<grpc_tls_certificate_provider> CreateOrGetCertificateProvider(
+      absl::string_view key);
+
+ private:
+  // A thin wrapper around `grpc_tls_certificate_provider` which allows removing
+  // the entry from the CertificateProviderStore when the refcount reaches zero.
+  class CertificateProviderWrapper : public grpc_tls_certificate_provider {
+   public:
+    CertificateProviderWrapper(
+        RefCountedPtr<grpc_tls_certificate_provider> certificate_provider,
+        CertificateProviderStore* store, absl::string_view key)
+        : certificate_provider_(std::move(certificate_provider)),
+          store_(store),
+          key_(key) {}
+
+    ~CertificateProviderWrapper() override {
+      store_->ReleaseCertificateProvider(key_, this);
+    }
+
+    grpc_core::RefCountedPtr<grpc_tls_certificate_distributor> distributor()
+        const override {
+      return certificate_provider_->distributor();
+    }
+
+    grpc_pollset_set* interested_parties() const override {
+      return certificate_provider_->interested_parties();
+    }
+
+   private:
+    RefCountedPtr<grpc_tls_certificate_provider> certificate_provider_;
+    CertificateProviderStore* store_;
+    absl::string_view key_;
+  };
+
+  RefCountedPtr<CertificateProviderWrapper> CreateCertificateProviderLocked(
+      absl::string_view key);
+
+  // Releases a previously created certificate provider from the certificate
+  // provider map if the value matches \a wrapper.
+  void ReleaseCertificateProvider(absl::string_view key,
+                                  CertificateProviderWrapper* wrapper);
+
+  Mutex mu_;
+  // Map of plugin configurations
+  PluginDefinitionMap plugin_config_map_;
+  // Underlying map for the providers.
+  std::map<absl::string_view, CertificateProviderWrapper*>
+      certificate_providers_map_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_EXT_XDS_CERTIFICATE_PROVIDER_STORE_H

data/src/core/ext/xds/file_watcher_certificate_provider_factory.cc

@@ -0,0 +1,119 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/ext/xds/file_watcher_certificate_provider_factory.h"
+
+#include "absl/strings/str_format.h"
+#include "absl/strings/str_join.h"
+
+#include "src/core/lib/json/json_util.h"
+
+namespace grpc_core {
+
+namespace {
+
+const char* kFileWatcherPlugin = "file_watcher";
+
+}  // namespace
+
+//
+// FileWatcherCertificateProviderFactory::Config
+//
+
+const char* FileWatcherCertificateProviderFactory::Config::name() const {
+  return kFileWatcherPlugin;
+}
+
+std::string FileWatcherCertificateProviderFactory::Config::ToString() const {
+  std::vector<std::string> parts;
+  parts.push_back("{");
+  if (!identity_cert_file_.empty()) {
+    parts.push_back(
+        absl::StrFormat("certificate_file=\"%s\", ", identity_cert_file_));
+  }
+  if (!identity_cert_file_.empty()) {
+    parts.push_back(
+        absl::StrFormat("private_key_file=\"%s\", ", private_key_file_));
+  }
+  if (!identity_cert_file_.empty()) {
+    parts.push_back(
+        absl::StrFormat("ca_certificate_file=\"%s\", ", root_cert_file_));
+  }
+  parts.push_back(
+      absl::StrFormat("refresh_interval=%ldms}", refresh_interval_ms_));
+  return absl::StrJoin(parts, "");
+}
+
+RefCountedPtr<FileWatcherCertificateProviderFactory::Config>
+FileWatcherCertificateProviderFactory::Config::Parse(const Json& config_json,
+                                                     grpc_error** error) {
+  auto config = MakeRefCounted<FileWatcherCertificateProviderFactory::Config>();
+  if (config_json.type() != Json::Type::OBJECT) {
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "error:config type should be OBJECT.");
+    return nullptr;
+  }
+  std::vector<grpc_error*> error_list;
+  ParseJsonObjectField(config_json.object_value(), "certificate_file",
+                       &config->identity_cert_file_, &error_list, false);
+  ParseJsonObjectField(config_json.object_value(), "private_key_file",
+                       &config->private_key_file_, &error_list, false);
+  if (config->identity_cert_file_.empty() !=
+      config->private_key_file_.empty()) {
+    error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "fields \"certificate_file\" and \"private_key_file\" must be both set "
+        "or both unset."));
+  }
+  ParseJsonObjectField(config_json.object_value(), "ca_certificate_file",
+                       &config->root_cert_file_, &error_list, false);
+  if (config->identity_cert_file_.empty() && config->root_cert_file_.empty()) {
+    error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "At least one of \"certificate_file\" and \"ca_certificate_file\" must "
+        "be specified."));
+  }
+  if (!ParseJsonObjectFieldAsDuration(
+          config_json.object_value(), "refresh_interval",
+          &config->refresh_interval_ms_, &error_list, false)) {
+    config->refresh_interval_ms_ = 10 * 60 * 1000;  // 10 minutes default
+  }
+  if (!error_list.empty()) {
+    *error = GRPC_ERROR_CREATE_FROM_VECTOR(
+        "Error parsing file watcher certificate provider config", &error_list);
+    return nullptr;
+  }
+  return config;
+}
+
+//
+// FileWatcherCertificateProviderFactory
+//
+
+const char* FileWatcherCertificateProviderFactory::name() const {
+  return kFileWatcherPlugin;
+}
+
+RefCountedPtr<CertificateProviderFactory::Config>
+FileWatcherCertificateProviderFactory::CreateCertificateProviderConfig(
+    const Json& config_json, grpc_error** error) {
+  return FileWatcherCertificateProviderFactory::Config::Parse(config_json,
+                                                              error);
+}
+
+}  // namespace grpc_core

data/src/core/ext/xds/file_watcher_certificate_provider_factory.h

@@ -0,0 +1,72 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_EXT_XDS_FILE_WATCHER_CERTIFICATE_PROVIDER_FACTORY_H
+#define GRPC_CORE_EXT_XDS_FILE_WATCHER_CERTIFICATE_PROVIDER_FACTORY_H
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/ext/xds/certificate_provider_factory.h"
+
+namespace grpc_core {
+
+class FileWatcherCertificateProviderFactory
+    : public CertificateProviderFactory {
+ public:
+  class Config : public CertificateProviderFactory::Config {
+   public:
+    static RefCountedPtr<Config> Parse(const Json& config_json,
+                                       grpc_error** error);
+
+    const char* name() const override;
+
+    std::string ToString() const override;
+
+    const std::string& identity_cert_file() const {
+      return identity_cert_file_;
+    }
+
+    const std::string& private_key_file() const { return private_key_file_; }
+
+    const std::string& root_cert_file() const { return root_cert_file_; }
+
+    grpc_millis refresh_interval_ms() const { return refresh_interval_ms_; }
+
+   private:
+    std::string identity_cert_file_;
+    std::string private_key_file_;
+    std::string root_cert_file_;
+    grpc_millis refresh_interval_ms_;
+  };
+
+  const char* name() const override;
+
+  RefCountedPtr<CertificateProviderFactory::Config>
+  CreateCertificateProviderConfig(const Json& config_json,
+                                  grpc_error** error) override;
+
+  RefCountedPtr<grpc_tls_certificate_provider> CreateCertificateProvider(
+      RefCountedPtr<CertificateProviderFactory::Config> config) override {
+    // TODO(yashykt) : To be implemented
+    return nullptr;
+  }
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_EXT_XDS_FILE_WATCHER_CERTIFICATE_PROVIDER_FACTORY_H

data/src/core/ext/xds/google_mesh_ca_certificate_provider_factory.cc

@@ -0,0 +1,265 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/ext/xds/google_mesh_ca_certificate_provider_factory.h"
+
+#include <sstream>
+#include <type_traits>
+
+#include "absl/strings/str_cat.h"
+
+#include <grpc/support/string_util.h>
+
+#include "src/core/lib/gpr/string.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/json/json_util.h"
+
+namespace grpc_core {
+
+namespace {
+
+const char* kMeshCaPlugin = "meshCA";
+
+}  // namespace
+
+//
+// GoogleMeshCaCertificateProviderFactory::Config
+//
+
+const char* GoogleMeshCaCertificateProviderFactory::Config::name() const {
+  return kMeshCaPlugin;
+}
+
+std::string GoogleMeshCaCertificateProviderFactory::Config::ToString() const {
+  // TODO(yashykt): To be filled
+  return "{}";
+}
+
+std::vector<grpc_error*>
+GoogleMeshCaCertificateProviderFactory::Config::ParseJsonObjectStsService(
+    const Json::Object& sts_service) {
+  std::vector<grpc_error*> error_list_sts_service;
+  if (!ParseJsonObjectField(sts_service, "token_exchange_service_uri",
+                            &sts_config_.token_exchange_service_uri,
+                            &error_list_sts_service, false)) {
+    sts_config_.token_exchange_service_uri =
+        "securetoken.googleapis.com";  // default
+  }
+  ParseJsonObjectField(sts_service, "resource", &sts_config_.resource,
+                       &error_list_sts_service, false);
+  ParseJsonObjectField(sts_service, "audience", &sts_config_.audience,
+                       &error_list_sts_service, false);
+  if (!ParseJsonObjectField(sts_service, "scope", &sts_config_.scope,
+                            &error_list_sts_service, false)) {
+    sts_config_.scope =
+        "https://www.googleapis.com/auth/cloud-platform";  // default
+  }
+  ParseJsonObjectField(sts_service, "requested_token_type",
+                       &sts_config_.requested_token_type,
+                       &error_list_sts_service, false);
+  ParseJsonObjectField(sts_service, "subject_token_path",
+                       &sts_config_.subject_token_path,
+                       &error_list_sts_service);
+  ParseJsonObjectField(sts_service, "subject_token_type",
+                       &sts_config_.subject_token_type,
+                       &error_list_sts_service);
+  ParseJsonObjectField(sts_service, "actor_token_path",
+                       &sts_config_.actor_token_path, &error_list_sts_service,
+                       false);
+  ParseJsonObjectField(sts_service, "actor_token_type",
+                       &sts_config_.actor_token_type, &error_list_sts_service,
+                       false);
+  return error_list_sts_service;
+}
+
+std::vector<grpc_error*>
+GoogleMeshCaCertificateProviderFactory::Config::ParseJsonObjectCallCredentials(
+    const Json::Object& call_credentials) {
+  std::vector<grpc_error*> error_list_call_credentials;
+  const Json::Object* sts_service = nullptr;
+  if (ParseJsonObjectField(call_credentials, "sts_service", &sts_service,
+                           &error_list_call_credentials)) {
+    std::vector<grpc_error*> error_list_sts_service =
+        ParseJsonObjectStsService(*sts_service);
+    if (!error_list_sts_service.empty()) {
+      error_list_call_credentials.push_back(GRPC_ERROR_CREATE_FROM_VECTOR(
+          "field:sts_service", &error_list_sts_service));
+    }
+  }
+  return error_list_call_credentials;
+}
+
+std::vector<grpc_error*>
+GoogleMeshCaCertificateProviderFactory::Config::ParseJsonObjectGoogleGrpc(
+    const Json::Object& google_grpc) {
+  std::vector<grpc_error*> error_list_google_grpc;
+  if (!ParseJsonObjectField(google_grpc, "target_uri", &endpoint_,
+                            &error_list_google_grpc, false)) {
+    endpoint_ = "meshca.googleapis.com";  // Default target
+  }
+  const Json::Array* call_credentials_array = nullptr;
+  if (ParseJsonObjectField(google_grpc, "call_credentials",
+                           &call_credentials_array, &error_list_google_grpc)) {
+    if (call_credentials_array->size() != 1) {
+      error_list_google_grpc.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "field:call_credentials error:Need exactly one entry."));
+    } else {
+      const Json::Object* call_credentials = nullptr;
+      if (ExtractJsonType((*call_credentials_array)[0], "call_credentials[0]",
+                          &call_credentials, &error_list_google_grpc)) {
+        std::vector<grpc_error*> error_list_call_credentials =
+            ParseJsonObjectCallCredentials(*call_credentials);
+        if (!error_list_call_credentials.empty()) {
+          error_list_google_grpc.push_back(GRPC_ERROR_CREATE_FROM_VECTOR(
+              "field:call_credentials", &error_list_call_credentials));
+        }
+      }
+    }
+  }
+
+  return error_list_google_grpc;
+}
+
+std::vector<grpc_error*>
+GoogleMeshCaCertificateProviderFactory::Config::ParseJsonObjectGrpcServices(
+    const Json::Object& grpc_service) {
+  std::vector<grpc_error*> error_list_grpc_services;
+  const Json::Object* google_grpc = nullptr;
+  if (ParseJsonObjectField(grpc_service, "google_grpc", &google_grpc,
+                           &error_list_grpc_services)) {
+    std::vector<grpc_error*> error_list_google_grpc =
+        ParseJsonObjectGoogleGrpc(*google_grpc);
+    if (!error_list_google_grpc.empty()) {
+      error_list_grpc_services.push_back(GRPC_ERROR_CREATE_FROM_VECTOR(
+          "field:google_grpc", &error_list_google_grpc));
+    }
+  }
+  if (!ParseJsonObjectFieldAsDuration(grpc_service, "timeout", &timeout_,
+                                      &error_list_grpc_services, false)) {
+    timeout_ = 10 * 1000;  // 10sec default
+  }
+  return error_list_grpc_services;
+}
+
+std::vector<grpc_error*>
+GoogleMeshCaCertificateProviderFactory::Config::ParseJsonObjectServer(
+    const Json::Object& server) {
+  std::vector<grpc_error*> error_list_server;
+  std::string api_type;
+  if (ParseJsonObjectField(server, "api_type", &api_type, &error_list_server,
+                           false)) {
+    if (api_type != "GRPC") {
+      error_list_server.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "field:api_type error:Only GRPC is supported"));
+    }
+  }
+  const Json::Array* grpc_services = nullptr;
+  if (ParseJsonObjectField(server, "grpc_services", &grpc_services,
+                           &error_list_server)) {
+    if (grpc_services->size() != 1) {
+      error_list_server.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "field:grpc_services error:Need exactly one entry"));
+    } else {
+      const Json::Object* grpc_service = nullptr;
+      if (ExtractJsonType((*grpc_services)[0], "grpc_services[0]",
+                          &grpc_service, &error_list_server)) {
+        std::vector<grpc_error*> error_list_grpc_services =
+            ParseJsonObjectGrpcServices(*grpc_service);
+        if (!error_list_grpc_services.empty()) {
+          error_list_server.push_back(GRPC_ERROR_CREATE_FROM_VECTOR(
+              "field:grpc_services", &error_list_grpc_services));
+        }
+      }
+    }
+  }
+  return error_list_server;
+}
+
+RefCountedPtr<GoogleMeshCaCertificateProviderFactory::Config>
+GoogleMeshCaCertificateProviderFactory::Config::Parse(const Json& config_json,
+                                                      grpc_error** error) {
+  auto config =
+      MakeRefCounted<GoogleMeshCaCertificateProviderFactory::Config>();
+  if (config_json.type() != Json::Type::OBJECT) {
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "error:config type should be OBJECT.");
+    return nullptr;
+  }
+  std::vector<grpc_error*> error_list;
+  const Json::Object* server = nullptr;
+  if (ParseJsonObjectField(config_json.object_value(), "server", &server,
+                           &error_list)) {
+    std::vector<grpc_error*> error_list_server =
+        config->ParseJsonObjectServer(*server);
+    if (!error_list_server.empty()) {
+      error_list.push_back(
+          GRPC_ERROR_CREATE_FROM_VECTOR("field:server", &error_list_server));
+    }
+  }
+  if (!ParseJsonObjectFieldAsDuration(
+          config_json.object_value(), "certificate_lifetime",
+          &config->certificate_lifetime_, &error_list, false)) {
+    config->certificate_lifetime_ = 24 * 60 * 60 * 1000;  // 24hrs default
+  }
+  if (!ParseJsonObjectFieldAsDuration(
+          config_json.object_value(), "renewal_grace_period",
+          &config->renewal_grace_period_, &error_list, false)) {
+    config->renewal_grace_period_ = 12 * 60 * 60 * 1000;  // 12hrs default
+  }
+  std::string key_type;
+  if (ParseJsonObjectField(config_json.object_value(), "key_type", &key_type,
+                           &error_list, false)) {
+    if (key_type != "RSA") {
+      error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "field:key_type error:Only RSA is supported."));
+    }
+  }
+  if (!ParseJsonObjectField(config_json.object_value(), "key_size",
+                            &config->key_size_, &error_list, false)) {
+    config->key_size_ = 2048;  // default 2048 bit key size
+  }
+  if (!ParseJsonObjectField(config_json.object_value(), "location",
+                            &config->location_, &error_list, false)) {
+    // GCE/GKE Metadata server needs to be contacted to get the value.
+  }
+  if (!error_list.empty()) {
+    *error = GRPC_ERROR_CREATE_FROM_VECTOR(
+        "Error parsing google Mesh CA config", &error_list);
+    return nullptr;
+  }
+  return config;
+}
+
+//
+// GoogleMeshCaCertificateProviderFactory
+//
+
+const char* GoogleMeshCaCertificateProviderFactory::name() const {
+  return kMeshCaPlugin;
+}
+
+RefCountedPtr<CertificateProviderFactory::Config>
+GoogleMeshCaCertificateProviderFactory::CreateCertificateProviderConfig(
+    const Json& config_json, grpc_error** error) {
+  return GoogleMeshCaCertificateProviderFactory::Config::Parse(config_json,
+                                                               error);
+}
+
+}  // namespace grpc_core