grpc 1.31.0.pre2 → 1.34.0

data/src/core/lib/iomgr/unix_sockets_posix_noop.cc

@@ -40,6 +40,13 @@ grpc_error* grpc_resolve_unix_domain_address(
       "Unix domain sockets are not supported on Windows");
 }
 
+grpc_error* grpc_resolve_unix_abstract_domain_address(
+    absl::string_view, grpc_resolved_addresses** addresses) {
+  *addresses = NULL;
+  return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+      "Unix domain sockets are not supported on Windows");
+}
+
 int grpc_is_unix_socket(const grpc_resolved_address* addr) { return false; }
 
 void grpc_unlink_if_unix_domain_socket(const grpc_resolved_address* addr) {}

data/src/core/lib/iomgr/wakeup_fd_pipe.cc

@@ -71,8 +71,8 @@ static grpc_error* pipe_consume(grpc_wakeup_fd* fd_info) {
 
 static grpc_error* pipe_wakeup(grpc_wakeup_fd* fd_info) {
   char c = 0;
-  while (write(fd_info->write_fd, &c, 1) != 1 && errno == EINTR)
-    ;
+  while (write(fd_info->write_fd, &c, 1) != 1 && errno == EINTR) {
+  }
   return GRPC_ERROR_NONE;
 }
 

data/src/core/lib/json/json.h

@@ -68,8 +68,8 @@ class Json {
   }
 
   // Moveable.
-  Json(Json&& other) { MoveFrom(std::move(other)); }
-  Json& operator=(Json&& other) {
+  Json(Json&& other) noexcept { MoveFrom(std::move(other)); }
+  Json& operator=(Json&& other) noexcept {
     MoveFrom(std::move(other));
     return *this;
   }

data/src/core/lib/json/json_reader.cc

@@ -413,8 +413,9 @@ JsonReader::Status JsonReader::Run() {
 
           /* This is the \\ case. */
           case State::GRPC_JSON_STATE_STRING_ESCAPE:
-            if (unicode_high_surrogate_ != 0)
+            if (unicode_high_surrogate_ != 0) {
               return Status::GRPC_JSON_PARSE_ERROR;
+            }
             StringAddChar('\\');
             if (escaped_string_was_key_) {
               state_ = State::GRPC_JSON_STATE_OBJECT_KEY_STRING;
@@ -593,14 +594,16 @@ JsonReader::Status JsonReader::Run() {
                  */
                 if ((unicode_char_ & 0xfc00) == 0xd800) {
                   /* high surrogate utf-16 */
-                  if (unicode_high_surrogate_ != 0)
+                  if (unicode_high_surrogate_ != 0) {
                     return Status::GRPC_JSON_PARSE_ERROR;
+                  }
                   unicode_high_surrogate_ = unicode_char_;
                 } else if ((unicode_char_ & 0xfc00) == 0xdc00) {
                   /* low surrogate utf-16 */
                   uint32_t utf32;
-                  if (unicode_high_surrogate_ == 0)
+                  if (unicode_high_surrogate_ == 0) {
                     return Status::GRPC_JSON_PARSE_ERROR;
+                  }
                   utf32 = 0x10000;
                   utf32 += static_cast<uint32_t>(
                       (unicode_high_surrogate_ - 0xd800) * 0x400);
@@ -609,8 +612,9 @@ JsonReader::Status JsonReader::Run() {
                   unicode_high_surrogate_ = 0;
                 } else {
                   /* anything else */
-                  if (unicode_high_surrogate_ != 0)
+                  if (unicode_high_surrogate_ != 0) {
                     return Status::GRPC_JSON_PARSE_ERROR;
+                  }
                   StringAddUtf32(unicode_char_);
                 }
                 if (escaped_string_was_key_) {

data/src/core/lib/json/json_util.cc

@@ -0,0 +1,58 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/json/json_util.h"
+
+#include <grpc/support/string_util.h>
+
+#include "src/core/lib/gpr/string.h"
+
+namespace grpc_core {
+
+bool ParseDurationFromJson(const Json& field, grpc_millis* duration) {
+  if (field.type() != Json::Type::STRING) return false;
+  size_t len = field.string_value().size();
+  if (field.string_value()[len - 1] != 's') return false;
+  grpc_core::UniquePtr<char> buf(gpr_strdup(field.string_value().c_str()));
+  *(buf.get() + len - 1) = '\0';  // Remove trailing 's'.
+  char* decimal_point = strchr(buf.get(), '.');
+  int nanos = 0;
+  if (decimal_point != nullptr) {
+    *decimal_point = '\0';
+    nanos = gpr_parse_nonnegative_int(decimal_point + 1);
+    if (nanos == -1) {
+      return false;
+    }
+    int num_digits = static_cast<int>(strlen(decimal_point + 1));
+    if (num_digits > 9) {  // We don't accept greater precision than nanos.
+      return false;
+    }
+    for (int i = 0; i < (9 - num_digits); ++i) {
+      nanos *= 10;
+    }
+  }
+  int seconds =
+      decimal_point == buf.get() ? 0 : gpr_parse_nonnegative_int(buf.get());
+  if (seconds == -1) return false;
+  *duration = seconds * GPR_MS_PER_SEC + nanos / GPR_NS_PER_MS;
+  return true;
+}
+
+}  // namespace grpc_core

data/src/core/lib/json/json_util.h

@@ -0,0 +1,204 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_JSON_JSON_UTIL_H
+#define GRPC_CORE_LIB_JSON_JSON_UTIL_H
+
+#include <grpc/support/port_platform.h>
+
+#include "absl/strings/numbers.h"
+#include "absl/strings/str_cat.h"
+
+#include "src/core/lib/iomgr/exec_ctx.h"
+#include "src/core/lib/json/json.h"
+
+namespace grpc_core {
+
+// Parses a JSON field of the form generated for a google.proto.Duration
+// proto message, as per:
+//   https://developers.google.com/protocol-buffers/docs/proto3#json
+// Returns true on success, false otherwise.
+bool ParseDurationFromJson(const Json& field, grpc_millis* duration);
+
+//
+// Helper functions for extracting types from JSON.
+// Return true on success, false otherwise. If an error is encountered during
+// parsing, a descriptive error is appended to \a error_list.
+//
+template <typename NumericType, typename ErrorVectorType>
+inline bool ExtractJsonNumber(const Json& json, const std::string& field_name,
+                              NumericType* output,
+                              ErrorVectorType* error_list) {
+  static_assert(std::is_integral<NumericType>::value, "Integral required");
+  if (json.type() != Json::Type::NUMBER) {
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name, " error:type should be NUMBER")
+            .c_str()));
+    return false;
+  }
+  if (!absl::SimpleAtoi(json.string_value(), output)) {
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name, " error:failed to parse.").c_str()));
+    return false;
+  }
+  return true;
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonBool(const Json& json, const std::string& field_name,
+                            bool* output, ErrorVectorType* error_list) {
+  switch (json.type()) {
+    case Json::Type::JSON_TRUE:
+      *output = true;
+      return true;
+    case Json::Type::JSON_FALSE:
+      *output = false;
+      return true;
+    default:
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrCat("field:", field_name, " error:type should be BOOLEAN")
+              .c_str()));
+      return false;
+  }
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonString(const Json& json, const std::string& field_name,
+                              std::string* output,
+                              ErrorVectorType* error_list) {
+  if (json.type() != Json::Type::STRING) {
+    *output = "";
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name, " error:type should be STRING")
+            .c_str()));
+    return false;
+  }
+  *output = json.string_value();
+  return true;
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonArray(const Json& json, const std::string& field_name,
+                             const Json::Array** output,
+                             ErrorVectorType* error_list) {
+  if (json.type() != Json::Type::ARRAY) {
+    *output = nullptr;
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name, " error:type should be ARRAY")
+            .c_str()));
+    return false;
+  }
+  *output = &json.array_value();
+  return true;
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonObject(const Json& json, const std::string& field_name,
+                              const Json::Object** output,
+                              ErrorVectorType* error_list) {
+  if (json.type() != Json::Type::OBJECT) {
+    *output = nullptr;
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name, " error:type should be OBJECT")
+            .c_str()));
+    return false;
+  }
+  *output = &json.object_value();
+  return true;
+}
+
+template <typename NumericType, typename ErrorVectorType>
+inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+                            NumericType* output, ErrorVectorType* error_list) {
+  return ExtractJsonNumber(json, field_name, output, error_list);
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+                            bool* output, ErrorVectorType* error_list) {
+  return ExtractJsonBool(json, field_name, output, error_list);
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+                            std::string* output, ErrorVectorType* error_list) {
+  return ExtractJsonString(json, field_name, output, error_list);
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+                            const Json::Array** output,
+                            ErrorVectorType* error_list) {
+  return ExtractJsonArray(json, field_name, output, error_list);
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+                            const Json::Object** output,
+                            ErrorVectorType* error_list) {
+  return ExtractJsonObject(json, field_name, output, error_list);
+}
+
+template <typename T, typename ErrorVectorType>
+inline bool ParseJsonObjectField(const Json::Object& object,
+                                 const std::string& field_name, T* output,
+                                 ErrorVectorType* error_list,
+                                 bool required = true) {
+  auto it = object.find(field_name);
+  if (it == object.end()) {
+    if (required) {
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrCat("field:", field_name, " error:does not exist.")
+              .c_str()));
+    }
+    return false;
+  }
+  auto& child_object_json = it->second;
+  return ExtractJsonType(child_object_json, field_name, output, error_list);
+}
+
+template <typename ErrorVectorType>
+inline bool ParseJsonObjectFieldAsDuration(const Json::Object& object,
+                                           const std::string& field_name,
+                                           grpc_millis* output,
+                                           ErrorVectorType* error_list,
+                                           bool required = true) {
+  auto it = object.find(field_name);
+  if (it == object.end()) {
+    if (required) {
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrCat("field:", field_name, " error:does not exist.")
+              .c_str()));
+    }
+    return false;
+  }
+  if (!ParseDurationFromJson(it->second, output)) {
+    *output = GRPC_MILLIS_INF_PAST;
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name,
+                     " error:type should be STRING of the form given by "
+                     "google.proto.Duration.")
+            .c_str()));
+    return false;
+  }
+  return true;
+}
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_JSON_JSON_UTIL_H

data/src/core/lib/json/json_writer.cc

@@ -207,8 +207,9 @@ void JsonWriter::EscapeString(const std::string& string) {
        * Any other range is technically reserved for future usage, so if we
        * don't want the software to break in the future, we have to allow
        * anything else. The first non-unicode character is 0x110000. */
-      if (((utf32 >= 0xd800) && (utf32 <= 0xdfff)) || (utf32 >= 0x110000))
+      if (((utf32 >= 0xd800) && (utf32 <= 0xdfff)) || (utf32 >= 0x110000)) {
         break;
+      }
       if (utf32 >= 0x10000) {
         /* If utf32 contains a character that is above 0xffff, it needs to be
          * broken down into a utf-16 surrogate pair. A surrogate pair is first

data/src/core/lib/security/authorization/authorization_engine.cc

@@ -0,0 +1,177 @@
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "absl/memory/memory.h"
+
+#include "src/core/lib/security/authorization/authorization_engine.h"
+
+namespace grpc_core {
+
+namespace {
+
+// Symbols for traversing Envoy Attributes
+constexpr char kUrlPath[] = "url_path";
+constexpr char kHost[] = "host";
+constexpr char kMethod[] = "method";
+constexpr char kHeaders[] = "headers";
+constexpr char kSourceAddress[] = "source_address";
+constexpr char kSourcePort[] = "source_port";
+constexpr char kDestinationAddress[] = "destination_address";
+constexpr char kDestinationPort[] = "destination_port";
+constexpr char kSpiffeId[] = "spiffe_id";
+constexpr char kCertServerName[] = "cert_server_name";
+
+}  // namespace
+
+std::unique_ptr<AuthorizationEngine>
+AuthorizationEngine::CreateAuthorizationEngine(
+    const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies) {
+  if (rbac_policies.empty() || rbac_policies.size() > 2) {
+    gpr_log(GPR_ERROR,
+            "Invalid rbac policies vector. Must contain either one or two rbac "
+            "policies.");
+    return nullptr;
+  } else if (rbac_policies.size() == 2 &&
+             (envoy_config_rbac_v3_RBAC_action(rbac_policies[0]) != kDeny ||
+              envoy_config_rbac_v3_RBAC_action(rbac_policies[1]) != kAllow)) {
+    gpr_log(GPR_ERROR,
+            "Invalid rbac policies vector. Must contain one deny \
+                         policy and one allow policy, in that order.");
+    return nullptr;
+  } else {
+    return absl::make_unique<AuthorizationEngine>(rbac_policies);
+  }
+}
+
+AuthorizationEngine::AuthorizationEngine(
+    const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies) {
+  for (const auto& rbac_policy : rbac_policies) {
+    // Extract array of policies and store their condition fields in either
+    // allow_if_matched_ or deny_if_matched_, depending on the policy action.
+    upb::Arena temp_arena;
+    size_t policy_num = UPB_MAP_BEGIN;
+    const envoy_config_rbac_v3_RBAC_PoliciesEntry* policy_entry;
+    while ((policy_entry = envoy_config_rbac_v3_RBAC_policies_next(
+                rbac_policy, &policy_num)) != nullptr) {
+      const upb_strview policy_name_strview =
+          envoy_config_rbac_v3_RBAC_PoliciesEntry_key(policy_entry);
+      const std::string policy_name(policy_name_strview.data,
+                                    policy_name_strview.size);
+      const envoy_config_rbac_v3_Policy* policy =
+          envoy_config_rbac_v3_RBAC_PoliciesEntry_value(policy_entry);
+      const google_api_expr_v1alpha1_Expr* condition =
+          envoy_config_rbac_v3_Policy_condition(policy);
+      // Parse condition to make a pointer tied to the lifetime of arena_.
+      size_t serial_len;
+      const char* serialized = google_api_expr_v1alpha1_Expr_serialize(
+          condition, temp_arena.ptr(), &serial_len);
+      const google_api_expr_v1alpha1_Expr* parsed_condition =
+          google_api_expr_v1alpha1_Expr_parse(serialized, serial_len,
+                                              arena_.ptr());
+      if (envoy_config_rbac_v3_RBAC_action(rbac_policy) == kAllow) {
+        allow_if_matched_.insert(std::make_pair(policy_name, parsed_condition));
+      } else {
+        deny_if_matched_.insert(std::make_pair(policy_name, parsed_condition));
+      }
+    }
+  }
+}
+
+std::unique_ptr<mock_cel::Activation> AuthorizationEngine::CreateActivation(
+    const EvaluateArgs& args) {
+  std::unique_ptr<mock_cel::Activation> activation;
+  for (const auto& elem : envoy_attributes_) {
+    if (elem == kUrlPath) {
+      absl::string_view url_path(args.GetPath());
+      if (!url_path.empty()) {
+        activation->InsertValue(kUrlPath,
+                                mock_cel::CelValue::CreateStringView(url_path));
+      }
+    } else if (elem == kHost) {
+      absl::string_view host(args.GetHost());
+      if (!host.empty()) {
+        activation->InsertValue(kHost,
+                                mock_cel::CelValue::CreateStringView(host));
+      }
+    } else if (elem == kMethod) {
+      absl::string_view method(args.GetMethod());
+      if (!method.empty()) {
+        activation->InsertValue(kMethod,
+                                mock_cel::CelValue::CreateStringView(method));
+      }
+    } else if (elem == kHeaders) {
+      std::multimap<absl::string_view, absl::string_view> headers =
+          args.GetHeaders();
+      std::vector<std::pair<mock_cel::CelValue, mock_cel::CelValue>>
+          header_items;
+      for (const auto& header_key : header_keys_) {
+        auto header_item = headers.find(header_key);
+        if (header_item != headers.end()) {
+          header_items.push_back(
+              std::pair<mock_cel::CelValue, mock_cel::CelValue>(
+                  mock_cel::CelValue::CreateStringView(header_key),
+                  mock_cel::CelValue::CreateStringView(header_item->second)));
+        }
+      }
+      headers_ = mock_cel::ContainerBackedMapImpl::Create(
+          absl::Span<std::pair<mock_cel::CelValue, mock_cel::CelValue>>(
+              header_items));
+      activation->InsertValue(kHeaders,
+                              mock_cel::CelValue::CreateMap(headers_.get()));
+    } else if (elem == kSourceAddress) {
+      absl::string_view source_address(args.GetPeerAddress());
+      if (!source_address.empty()) {
+        activation->InsertValue(
+            kSourceAddress,
+            mock_cel::CelValue::CreateStringView(source_address));
+      }
+    } else if (elem == kSourcePort) {
+      activation->InsertValue(
+          kSourcePort, mock_cel::CelValue::CreateInt64(args.GetPeerPort()));
+    } else if (elem == kDestinationAddress) {
+      absl::string_view destination_address(args.GetLocalAddress());
+      if (!destination_address.empty()) {
+        activation->InsertValue(
+            kDestinationAddress,
+            mock_cel::CelValue::CreateStringView(destination_address));
+      }
+    } else if (elem == kDestinationPort) {
+      activation->InsertValue(kDestinationPort, mock_cel::CelValue::CreateInt64(
+                                                    args.GetLocalPort()));
+    } else if (elem == kSpiffeId) {
+      absl::string_view spiffe_id(args.GetSpiffeId());
+      if (!spiffe_id.empty()) {
+        activation->InsertValue(
+            kSpiffeId, mock_cel::CelValue::CreateStringView(spiffe_id));
+      }
+    } else if (elem == kCertServerName) {
+      absl::string_view cert_server_name(args.GetCertServerName());
+      if (!cert_server_name.empty()) {
+        activation->InsertValue(
+            kCertServerName,
+            mock_cel::CelValue::CreateStringView(cert_server_name));
+      }
+    } else {
+      gpr_log(GPR_ERROR,
+              "Error: Authorization engine does not support evaluating "
+              "attribute %s.",
+              elem.c_str());
+    }
+  }
+  return activation;
+}
+
+}  // namespace grpc_core