grpc 1.32.0 → 1.36.0

data/src/core/lib/security/authorization/matchers.h

@@ -0,0 +1,158 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+#include <string>
+
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
+
+#include "re2/re2.h"
+
+namespace grpc_core {
+
+class StringMatcher {
+ public:
+  enum class Type {
+    EXACT,       // value stored in string_matcher_ field
+    PREFIX,      // value stored in string_matcher_ field
+    SUFFIX,      // value stored in string_matcher_ field
+    SAFE_REGEX,  // pattern stored in regex_matcher_ field
+    CONTAINS,    // value stored in string_matcher_ field
+  };
+
+  // Creates StringMatcher instance. Returns error status on failure.
+  static absl::StatusOr<StringMatcher> Create(Type type,
+                                              const std::string& matcher,
+                                              bool case_sensitive = true);
+
+  StringMatcher() = default;
+  StringMatcher(const StringMatcher& other);
+  StringMatcher& operator=(const StringMatcher& other);
+  StringMatcher(StringMatcher&& other) noexcept;
+  StringMatcher& operator=(StringMatcher&& other) noexcept;
+  bool operator==(const StringMatcher& other) const;
+
+  bool Match(absl::string_view value) const;
+
+  std::string ToString() const;
+
+  Type type() const { return type_; }
+
+  // Valid for EXACT, PREFIX, SUFFIX and CONTAINS
+  const std::string& string_matcher() const { return string_matcher_; }
+
+  // Valid for SAFE_REGEX
+  RE2* regex_matcher() const { return regex_matcher_.get(); }
+
+  bool case_sensitive() const { return case_sensitive_; }
+
+ private:
+  StringMatcher(Type type, const std::string& matcher, bool case_sensitive);
+  StringMatcher(std::unique_ptr<RE2> regex_matcher, bool case_sensitive);
+
+  Type type_ = Type::EXACT;
+  std::string string_matcher_;
+  std::unique_ptr<RE2> regex_matcher_;
+  bool case_sensitive_ = true;
+};
+
+class HeaderMatcher {
+ public:
+  enum class Type {
+    EXACT,       // value stored in StringMatcher field
+    PREFIX,      // value stored in StringMatcher field
+    SUFFIX,      // value stored in StringMatcher field
+    SAFE_REGEX,  // value stored in StringMatcher field
+    CONTAINS,    // value stored in StringMatcher field
+    RANGE,       // uses range_start and range_end fields
+    PRESENT,     // uses present_match field
+  };
+
+  // Make sure that the first five HeaderMatcher::Type enum values match up to
+  // the corresponding StringMatcher::Type enum values, so that it's safe to
+  // convert by casting when delegating to StringMatcher.
+  static_assert(static_cast<StringMatcher::Type>(Type::EXACT) ==
+                    StringMatcher::Type::EXACT,
+                "");
+  static_assert(static_cast<StringMatcher::Type>(Type::PREFIX) ==
+                    StringMatcher::Type::PREFIX,
+                "");
+  static_assert(static_cast<StringMatcher::Type>(Type::SUFFIX) ==
+                    StringMatcher::Type::SUFFIX,
+                "");
+  static_assert(static_cast<StringMatcher::Type>(Type::SAFE_REGEX) ==
+                    StringMatcher::Type::SAFE_REGEX,
+                "");
+  static_assert(static_cast<StringMatcher::Type>(Type::CONTAINS) ==
+                    StringMatcher::Type::CONTAINS,
+                "");
+
+  // Creates HeaderMatcher instance. Returns error status on failure.
+  static absl::StatusOr<HeaderMatcher> Create(
+      const std::string& name, Type type, const std::string& matcher,
+      int64_t range_start = 0, int64_t range_end = 0,
+      bool present_match = false, bool invert_match = false);
+
+  HeaderMatcher() = default;
+  HeaderMatcher(const HeaderMatcher& other);
+  HeaderMatcher& operator=(const HeaderMatcher& other);
+  HeaderMatcher(HeaderMatcher&& other) noexcept;
+  HeaderMatcher& operator=(HeaderMatcher&& other) noexcept;
+  bool operator==(const HeaderMatcher& other) const;
+
+  const std::string& name() const { return name_; }
+
+  Type type() const { return type_; }
+
+  // Valid for EXACT, PREFIX, SUFFIX and CONTAINS
+  const std::string& string_matcher() const {
+    return matcher_.string_matcher();
+  }
+
+  // Valid for SAFE_REGEX
+  RE2* regex_matcher() const { return matcher_.regex_matcher(); }
+
+  bool Match(const absl::optional<absl::string_view>& value) const;
+
+  std::string ToString() const;
+
+ private:
+  // For StringMatcher.
+  HeaderMatcher(const std::string& name, Type type, StringMatcher matcher,
+                bool invert_match);
+  // For RangeMatcher.
+  HeaderMatcher(const std::string& name, int64_t range_start, int64_t range_end,
+                bool invert_match);
+  // For PresentMatcher.
+  HeaderMatcher(const std::string& name, bool present_match, bool invert_match);
+
+  std::string name_;
+  Type type_ = Type::EXACT;
+  StringMatcher matcher_;
+  int64_t range_start_;
+  int64_t range_end_;
+  bool present_match_;
+  bool invert_match_ = false;
+};
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H */

data/src/core/lib/security/authorization/mock_cel/activation.h

@@ -48,7 +48,7 @@ class Activation : public BaseActivation {
   Activation& operator=(const Activation&) = delete;
 
   // Insert value into Activation.
-  void InsertValue(absl::string_view name, const CelValue& value) {}
+  void InsertValue(absl::string_view /*name*/, const CelValue& /*value*/) {}
 };
 
 }  // namespace mock_cel

data/src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h

@@ -19,6 +19,8 @@
 
 #include <memory>
 
+#include "absl/memory/memory.h"
+
 #include "src/core/lib/security/authorization/mock_cel/flat_expr_builder.h"
 
 namespace grpc_core {
@@ -31,7 +33,7 @@ struct InterpreterOptions {
   bool short_circuiting = true;
 };
 
-std::unique_ptr<CelExpressionBuilder> CreateCelExpressionBuilder(
+inline std::unique_ptr<CelExpressionBuilder> CreateCelExpressionBuilder(
     const InterpreterOptions& options) {
   return absl::make_unique<FlatExprBuilder>();
 }

data/src/core/lib/security/authorization/mock_cel/cel_expression.h

@@ -20,10 +20,11 @@
 #include <memory>
 #include <vector>
 
+#include "absl/status/statusor.h"
+
 #include "google/api/expr/v1alpha1/syntax.upb.h"
 #include "src/core/lib/security/authorization/mock_cel/activation.h"
 #include "src/core/lib/security/authorization/mock_cel/cel_value.h"
-#include "src/core/lib/security/authorization/mock_cel/statusor.h"
 
 namespace grpc_core {
 namespace mock_cel {
@@ -38,7 +39,7 @@ class CelExpression {
 
   // Evaluates expression and returns value.
   // activation contains bindings from parameter names to values
-  virtual StatusOr<CelValue> Evaluate(
+  virtual absl::StatusOr<CelValue> Evaluate(
       const BaseActivation& activation) const = 0;
 };
 
@@ -52,11 +53,11 @@ class CelExpressionBuilder {
 
   // Creates CelExpression object from AST tree.
   // expr specifies root of AST tree
-  virtual StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
+  virtual absl::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
       const google_api_expr_v1alpha1_Expr* expr,
       const google_api_expr_v1alpha1_SourceInfo* source_info) const = 0;
 
-  virtual StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
+  virtual absl::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
       const google_api_expr_v1alpha1_Expr* expr,
       const google_api_expr_v1alpha1_SourceInfo* source_info,
       std::vector<absl::Status>* warnings) const = 0;

data/src/core/lib/security/authorization/mock_cel/cel_value.h

@@ -32,7 +32,11 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <memory>
+
+#include "absl/memory/memory.h"
 #include "absl/strings/string_view.h"
+#include "absl/types/span.h"
 
 namespace grpc_core {
 namespace mock_cel {
@@ -57,23 +61,25 @@ class CelValue {
   // We rely on copy elision to avoid extra copying.
   static CelValue CreateNull() { return CelValue(nullptr); }
 
-  static CelValue CreateInt64(int64_t value) { return CreateNull(); }
+  static CelValue CreateInt64(int64_t /*value*/) { return CreateNull(); }
 
-  static CelValue CreateUint64(uint64_t value) { return CreateNull(); }
+  static CelValue CreateUint64(uint64_t /*value*/) { return CreateNull(); }
 
-  static CelValue CreateStringView(absl::string_view value) {
+  static CelValue CreateStringView(absl::string_view /*value*/) {
     return CreateNull();
   }
 
-  static CelValue CreateString(const std::string* str) { return CreateNull(); }
+  static CelValue CreateString(const std::string* /*str*/) {
+    return CreateNull();
+  }
 
-  static CelValue CreateMap(const CelMap* value) { return CreateNull(); }
+  static CelValue CreateMap(const CelMap* /*value*/) { return CreateNull(); }
 
  private:
   // Constructs CelValue wrapping value supplied as argument.
   // Value type T should be supported by specification of ValueHolder.
   template <class T>
-  explicit CelValue(T value) {}
+  explicit CelValue(T /*value*/) {}
 };
 
 // CelMap implementation that uses STL map container as backing storage.
@@ -82,7 +88,7 @@ class ContainerBackedMapImpl : public CelMap {
   ContainerBackedMapImpl() = default;
 
   static std::unique_ptr<CelMap> Create(
-      absl::Span<std::pair<CelValue, CelValue>> key_values) {
+      absl::Span<std::pair<CelValue, CelValue>> /*key_values*/) {
     return absl::make_unique<ContainerBackedMapImpl>();
   }
 };

data/src/core/lib/security/authorization/mock_cel/evaluator_core.h

@@ -21,11 +21,12 @@
 #include <set>
 #include <vector>
 
+#include "absl/status/statusor.h"
+
 #include "google/api/expr/v1alpha1/syntax.upb.h"
 #include "src/core/lib/security/authorization/mock_cel/activation.h"
 #include "src/core/lib/security/authorization/mock_cel/cel_expression.h"
 #include "src/core/lib/security/authorization/mock_cel/cel_value.h"
-#include "src/core/lib/security/authorization/mock_cel/statusor.h"
 
 namespace grpc_core {
 namespace mock_cel {
@@ -33,13 +34,11 @@ namespace mock_cel {
 // This is a temporary stub implementation of CEL APIs.
 // Once gRPC imports the CEL library, this file will be removed.
 
-class ExpressionStep {
+class ExecutionPath {
  public:
-  virtual ~ExpressionStep() = default;
+  ExecutionPath() = default;
 };
 
-using ExecutionPath = std::vector<std::unique_ptr<const ExpressionStep>>;
-
 // Implementation of the CelExpression that utilizes flattening
 // of the expression tree.
 class CelExpressionFlatImpl : public CelExpression {
@@ -56,7 +55,8 @@ class CelExpressionFlatImpl : public CelExpression {
                         bool enable_unknown_function_results = false) {}
 
   // Implementation of CelExpression evaluate method.
-  StatusOr<CelValue> Evaluate(const BaseActivation& activation) const override {
+  absl::StatusOr<CelValue> Evaluate(
+      const BaseActivation& activation) const override {
     return CelValue::CreateNull();
   }
 };

data/src/core/lib/security/authorization/mock_cel/flat_expr_builder.h

@@ -33,20 +33,21 @@ class FlatExprBuilder : public CelExpressionBuilder {
  public:
   FlatExprBuilder() = default;
 
-  cel_base::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
-      const google::api::expr::v1alpha1::Expr* expr,
-      const google::api::expr::v1alpha1::SourceInfo* source_info)
-      const override {
+  absl::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
+      const google_api_expr_v1alpha1_Expr* expr,
+      const google_api_expr_v1alpha1_SourceInfo* source_info) const override {
     ExecutionPath path;
-    return absl::make_unique<CelExpressionFlatImpl>(nullptr, path, 0);
+    return absl::make_unique<CelExpressionFlatImpl>(nullptr, path, 0,
+                                                    std::set<std::string>{});
   }
 
-  cel_base::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
-      const google::api::expr::v1alpha1::Expr* expr,
-      const google::api::expr::v1alpha1::SourceInfo* source_info,
+  absl::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
+      const google_api_expr_v1alpha1_Expr* expr,
+      const google_api_expr_v1alpha1_SourceInfo* source_info,
       std::vector<absl::Status>* warnings) const override {
     ExecutionPath path;
-    return absl::make_unique<CelExpressionFlatImpl>(nullptr, path, 0);
+    return absl::make_unique<CelExpressionFlatImpl>(nullptr, path, 0,
+                                                    std::set<std::string>{});
   }
 };
 

data/src/core/lib/security/context/security_context.cc

@@ -294,9 +294,10 @@ static const grpc_arg_pointer_vtable auth_context_pointer_vtable = {
     auth_context_pointer_arg_copy, auth_context_pointer_arg_destroy,
     auth_context_pointer_cmp};
 
-grpc_arg grpc_auth_context_to_arg(grpc_auth_context* p) {
-  return grpc_channel_arg_pointer_create((char*)GRPC_AUTH_CONTEXT_ARG, p,
-                                         &auth_context_pointer_vtable);
+grpc_arg grpc_auth_context_to_arg(grpc_auth_context* c) {
+  return grpc_channel_arg_pointer_create(
+      const_cast<char*>(GRPC_AUTH_CONTEXT_ARG), c,
+      &auth_context_pointer_vtable);
 }
 
 grpc_auth_context* grpc_auth_context_from_arg(const grpc_arg* arg) {

data/src/core/lib/security/context/security_context.h

@@ -54,7 +54,9 @@ struct grpc_auth_context
       grpc_core::RefCountedPtr<grpc_auth_context> chained)
       : grpc_core::RefCounted<grpc_auth_context,
                               grpc_core::NonPolymorphicRefCount>(
-            &grpc_trace_auth_context_refcount),
+            GRPC_TRACE_FLAG_ENABLED(grpc_trace_auth_context_refcount)
+                ? "auth_context_refcount"
+                : nullptr),
         chained_(std::move(chained)) {
     if (chained_ != nullptr) {
       peer_identity_property_name_ = chained_->peer_identity_property_name_;

data/src/core/lib/security/credentials/alts/alts_credentials.cc

@@ -70,7 +70,8 @@ grpc_alts_server_credentials::grpc_alts_server_credentials(
 }
 
 grpc_core::RefCountedPtr<grpc_server_security_connector>
-grpc_alts_server_credentials::create_security_connector() {
+grpc_alts_server_credentials::create_security_connector(
+    const grpc_channel_args* /* args */) {
   return grpc_alts_server_security_connector_create(this->Ref());
 }
 

data/src/core/lib/security/credentials/alts/alts_credentials.h

@@ -56,7 +56,7 @@ class grpc_alts_server_credentials final : public grpc_server_credentials {
   ~grpc_alts_server_credentials() override;
 
   grpc_core::RefCountedPtr<grpc_server_security_connector>
-  create_security_connector() override;
+  create_security_connector(const grpc_channel_args* /* args */) override;
 
   const grpc_alts_credentials_options* options() const { return options_; }
   grpc_alts_credentials_options* mutable_options() { return options_; }

data/src/core/lib/security/credentials/alts/check_gcp_environment.cc

@@ -57,7 +57,7 @@ namespace internal {
 char* read_bios_file(const char* bios_file) {
   FILE* fp = fopen(bios_file, "r");
   if (!fp) {
-    gpr_log(GPR_ERROR, "BIOS data file cannot be opened.");
+    gpr_log(GPR_INFO, "BIOS data file does not exist or cannot be opened.");
     return nullptr;
   }
   char buf[kBiosDataBufferSize + 1];

data/src/core/lib/security/credentials/credentials.cc

@@ -67,14 +67,14 @@ static const grpc_arg_pointer_vtable credentials_pointer_vtable = {
 
 grpc_arg grpc_channel_credentials_to_arg(
     grpc_channel_credentials* credentials) {
-  return grpc_channel_arg_pointer_create((char*)GRPC_ARG_CHANNEL_CREDENTIALS,
-                                         credentials,
-                                         &credentials_pointer_vtable);
+  return grpc_channel_arg_pointer_create(
+      const_cast<char*>(GRPC_ARG_CHANNEL_CREDENTIALS), credentials,
+      &credentials_pointer_vtable);
 }
 
 grpc_channel_credentials* grpc_channel_credentials_from_arg(
     const grpc_arg* arg) {
-  if (strcmp(arg->key, GRPC_ARG_CHANNEL_CREDENTIALS)) return nullptr;
+  if (strcmp(arg->key, GRPC_ARG_CHANNEL_CREDENTIALS) != 0) return nullptr;
   if (arg->type != GRPC_ARG_POINTER) {
     gpr_log(GPR_ERROR, "Invalid type %d for arg %s", arg->type,
             GRPC_ARG_CHANNEL_CREDENTIALS);
@@ -134,9 +134,9 @@ static const grpc_arg_pointer_vtable cred_ptr_vtable = {
     server_credentials_pointer_arg_copy, server_credentials_pointer_arg_destroy,
     server_credentials_pointer_cmp};
 
-grpc_arg grpc_server_credentials_to_arg(grpc_server_credentials* p) {
-  return grpc_channel_arg_pointer_create((char*)GRPC_SERVER_CREDENTIALS_ARG, p,
-                                         &cred_ptr_vtable);
+grpc_arg grpc_server_credentials_to_arg(grpc_server_credentials* c) {
+  return grpc_channel_arg_pointer_create(
+      const_cast<char*>(GRPC_SERVER_CREDENTIALS_ARG), c, &cred_ptr_vtable);
 }
 
 grpc_server_credentials* grpc_server_credentials_from_arg(const grpc_arg* arg) {

data/src/core/lib/security/credentials/credentials.h

@@ -102,7 +102,7 @@ struct grpc_channel_credentials
     : grpc_core::RefCounted<grpc_channel_credentials> {
  public:
   explicit grpc_channel_credentials(const char* type) : type_(type) {}
-  virtual ~grpc_channel_credentials() = default;
+  ~grpc_channel_credentials() override = default;
 
   // Creates a security connector for the channel. May also create new channel
   // args for the channel to be used in place of the passed in const args if
@@ -177,7 +177,7 @@ struct grpc_call_credentials
       grpc_security_level min_security_level = GRPC_PRIVACY_AND_INTEGRITY)
       : type_(type), min_security_level_(min_security_level) {}
 
-  virtual ~grpc_call_credentials() = default;
+  ~grpc_call_credentials() override = default;
 
   // Returns true if completed synchronously, in which case \a error will
   // be set to indicate the result.  Otherwise, \a on_request_metadata will
@@ -225,10 +225,11 @@ struct grpc_server_credentials
  public:
   explicit grpc_server_credentials(const char* type) : type_(type) {}
 
-  virtual ~grpc_server_credentials() { DestroyProcessor(); }
+  ~grpc_server_credentials() override { DestroyProcessor(); }
 
+  // Ownership of \a args is not passed.
   virtual grpc_core::RefCountedPtr<grpc_server_security_connector>
-  create_security_connector() = 0;
+  create_security_connector(const grpc_channel_args* args) = 0;
 
   const char* type() const { return type_; }