grpc 1.34.0 → 1.35.0.pre1

data/src/core/ext/xds/xds_api.h

@@ -175,23 +175,40 @@ class XdsApi {
     VirtualHost* FindVirtualHostForDomain(const std::string& domain);
   };
 
-  struct StringMatcher {
+  class StringMatcher {
+   public:
     enum class StringMatcherType {
-      EXACT,       // value stored in string_matcher_field
-      PREFIX,      // value stored in string_matcher_field
-      SUFFIX,      // value stored in string_matcher_field
-      SAFE_REGEX,  // use regex_match field
-      CONTAINS,    // value stored in string_matcher_field
+      EXACT,       // value stored in string_matcher_ field
+      PREFIX,      // value stored in string_matcher_ field
+      SUFFIX,      // value stored in string_matcher_ field
+      SAFE_REGEX,  // pattern stored in regex_matcher_ field
+      CONTAINS,    // value stored in string_matcher_ field
     };
-    StringMatcherType type;
-    std::string string_matcher;
-    std::unique_ptr<RE2> regex_match;
-    bool ignore_case;
 
     StringMatcher() = default;
     StringMatcher(const StringMatcher& other);
+    StringMatcher(StringMatcherType type, const std::string& matcher,
+                  bool ignore_case = false);
     StringMatcher& operator=(const StringMatcher& other);
     bool operator==(const StringMatcher& other) const;
+
+    bool Match(absl::string_view value) const;
+
+    std::string ToString() const;
+
+    StringMatcherType type() const { return type_; }
+
+    // Valid for EXACT, PREFIX, SUFFIX and CONTAINS
+    const std::string& string_matcher() const { return string_matcher_; }
+
+    // Valid for SAFE_REGEX
+    RE2* regex_matcher() const { return regex_matcher_.get(); }
+
+   private:
+    StringMatcherType type_ = StringMatcherType::EXACT;
+    std::string string_matcher_;
+    std::unique_ptr<RE2> regex_matcher_;
+    bool ignore_case_ = false;
   };
 
   struct CommonTlsContext {
@@ -201,6 +218,9 @@ class XdsApi {
       bool operator==(const CertificateValidationContext& other) const {
         return match_subject_alt_names == other.match_subject_alt_names;
       }
+
+      std::string ToString() const;
+      bool Empty() const;
     };
 
     struct CertificateProviderInstance {
@@ -211,6 +231,9 @@ class XdsApi {
         return instance_name == other.instance_name &&
                certificate_name == other.certificate_name;
       }
+
+      std::string ToString() const;
+      bool Empty() const;
     };
 
     struct CombinedCertificateValidationContext {
@@ -223,6 +246,9 @@ class XdsApi {
                validation_context_certificate_provider_instance ==
                    other.validation_context_certificate_provider_instance;
       }
+
+      std::string ToString() const;
+      bool Empty() const;
     };
 
     CertificateProviderInstance tls_certificate_certificate_provider_instance;
@@ -233,6 +259,9 @@ class XdsApi {
                  other.tls_certificate_certificate_provider_instance &&
              combined_validation_context == other.combined_validation_context;
     }
+
+    std::string ToString() const;
+    bool Empty() const;
   };
 
   // TODO(roth): When we can use absl::variant<>, consider using that
@@ -280,6 +309,8 @@ class XdsApi {
                  other.lrs_load_reporting_server_name &&
              max_concurrent_requests == other.max_concurrent_requests;
     }
+
+    std::string ToString() const;
   };
 
   using CdsUpdateMap = std::map<std::string /*cluster_name*/, CdsUpdate>;

data/src/core/ext/xds/xds_bootstrap.h

@@ -29,7 +29,6 @@
 #include <grpc/slice.h>
 
 #include "src/core/ext/xds/certificate_provider_store.h"
-#include "src/core/lib/gprpp/map.h"
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/error.h"

data/src/core/ext/xds/xds_certificate_provider.cc

@@ -18,10 +18,12 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/ext/xds/xds_certificate_provider.h"
+
 #include "absl/functional/bind_front.h"
 #include "absl/strings/str_cat.h"
 
-#include "src/core/ext/xds/xds_certificate_provider.h"
+#include "src/core/lib/gpr/useful.h"
 
 namespace grpc_core {
 
@@ -100,20 +102,30 @@ XdsCertificateProvider::XdsCertificateProvider(
     absl::string_view root_cert_name,
     RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor,
     absl::string_view identity_cert_name,
-    RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor)
+    RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor,
+    std::vector<XdsApi::StringMatcher> san_matchers)
     : root_cert_name_(root_cert_name),
       identity_cert_name_(identity_cert_name),
       root_cert_distributor_(std::move(root_cert_distributor)),
       identity_cert_distributor_(std::move(identity_cert_distributor)),
+      san_matchers_(std::move(san_matchers)),
       distributor_(MakeRefCounted<grpc_tls_certificate_distributor>()) {
   distributor_->SetWatchStatusCallback(
       absl::bind_front(&XdsCertificateProvider::WatchStatusCallback, this));
 }
 
+XdsCertificateProvider::~XdsCertificateProvider() {
+  distributor_->SetWatchStatusCallback(nullptr);
+}
+
 void XdsCertificateProvider::UpdateRootCertNameAndDistributor(
     absl::string_view root_cert_name,
     RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor) {
   MutexLock lock(&mu_);
+  if (root_cert_name_ == root_cert_name &&
+      root_cert_distributor_ == root_cert_distributor) {
+    return;
+  }
   root_cert_name_ = std::string(root_cert_name);
   if (watching_root_certs_) {
     // The root certificates are being watched. Swap out the watcher.
@@ -139,6 +151,10 @@ void XdsCertificateProvider::UpdateIdentityCertNameAndDistributor(
     absl::string_view identity_cert_name,
     RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor) {
   MutexLock lock(&mu_);
+  if (identity_cert_name_ == identity_cert_name &&
+      identity_cert_distributor_ == identity_cert_distributor) {
+    return;
+  }
   identity_cert_name_ = std::string(identity_cert_name);
   if (watching_identity_certs_) {
     // The identity certificates are being watched. Swap out the watcher.
@@ -160,6 +176,12 @@ void XdsCertificateProvider::UpdateIdentityCertNameAndDistributor(
   identity_cert_distributor_ = std::move(identity_cert_distributor);
 }
 
+void XdsCertificateProvider::UpdateSubjectAlternativeNameMatchers(
+    std::vector<XdsApi::StringMatcher> matchers) {
+  MutexLock lock(&san_matchers_mu_);
+  san_matchers_ = std::move(matchers);
+}
+
 void XdsCertificateProvider::WatchStatusCallback(std::string cert_name,
                                                  bool root_being_watched,
                                                  bool identity_being_watched) {
@@ -237,4 +259,41 @@ void XdsCertificateProvider::UpdateIdentityCertWatcher(
       std::move(watcher), absl::nullopt, identity_cert_name_);
 }
 
+namespace {
+
+void* XdsCertificateProviderArgCopy(void* p) {
+  XdsCertificateProvider* xds_certificate_provider =
+      static_cast<XdsCertificateProvider*>(p);
+  return xds_certificate_provider->Ref().release();
+}
+
+void XdsCertificateProviderArgDestroy(void* p) {
+  XdsCertificateProvider* xds_certificate_provider =
+      static_cast<XdsCertificateProvider*>(p);
+  xds_certificate_provider->Unref();
+}
+
+int XdsCertificateProviderArgCmp(void* p, void* q) { return GPR_ICMP(p, q); }
+
+const grpc_arg_pointer_vtable kChannelArgVtable = {
+    XdsCertificateProviderArgCopy, XdsCertificateProviderArgDestroy,
+    XdsCertificateProviderArgCmp};
+
+}  // namespace
+
+grpc_arg XdsCertificateProvider::MakeChannelArg() const {
+  return grpc_channel_arg_pointer_create(
+      const_cast<char*>(GRPC_ARG_XDS_CERTIFICATE_PROVIDER),
+      const_cast<XdsCertificateProvider*>(this), &kChannelArgVtable);
+}
+
+RefCountedPtr<XdsCertificateProvider>
+XdsCertificateProvider::GetFromChannelArgs(const grpc_channel_args* args) {
+  XdsCertificateProvider* xds_certificate_provider =
+      grpc_channel_args_find_pointer<XdsCertificateProvider>(
+          args, GRPC_ARG_XDS_CERTIFICATE_PROVIDER);
+  return xds_certificate_provider != nullptr ? xds_certificate_provider->Ref()
+                                             : nullptr;
+}
+
 }  // namespace grpc_core

data/src/core/ext/xds/xds_certificate_provider.h

@@ -21,8 +21,12 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/ext/xds/xds_api.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 
+#define GRPC_ARG_XDS_CERTIFICATE_PROVIDER \
+  "grpc.internal.xds_certificate_provider"
+
 namespace grpc_core {
 
 class XdsCertificateProvider : public grpc_tls_certificate_provider {
@@ -31,8 +35,10 @@ class XdsCertificateProvider : public grpc_tls_certificate_provider {
       absl::string_view root_cert_name,
       RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor,
       absl::string_view identity_cert_name,
-      RefCountedPtr<grpc_tls_certificate_distributor>
-          identity_cert_distributor);
+      RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor,
+      std::vector<XdsApi::StringMatcher> san_matchers);
+
+  ~XdsCertificateProvider() override;
 
   void UpdateRootCertNameAndDistributor(
       absl::string_view root_cert_name,
@@ -41,12 +47,34 @@ class XdsCertificateProvider : public grpc_tls_certificate_provider {
       absl::string_view identity_cert_name,
       RefCountedPtr<grpc_tls_certificate_distributor>
           identity_cert_distributor);
+  void UpdateSubjectAlternativeNameMatchers(
+      std::vector<XdsApi::StringMatcher> matchers);
 
   grpc_core::RefCountedPtr<grpc_tls_certificate_distributor> distributor()
       const override {
     return distributor_;
   }
 
+  bool ProvidesRootCerts() {
+    MutexLock lock(&mu_);
+    return root_cert_distributor_ != nullptr;
+  }
+
+  bool ProvidesIdentityCerts() {
+    MutexLock lock(&mu_);
+    return identity_cert_distributor_ != nullptr;
+  }
+
+  std::vector<XdsApi::StringMatcher> subject_alternative_name_matchers() {
+    MutexLock lock(&san_matchers_mu_);
+    return san_matchers_;
+  }
+
+  grpc_arg MakeChannelArg() const;
+
+  static RefCountedPtr<XdsCertificateProvider> GetFromChannelArgs(
+      const grpc_channel_args* args);
+
  private:
   void WatchStatusCallback(std::string cert_name, bool root_being_watched,
                            bool identity_being_watched);
@@ -56,12 +84,22 @@ class XdsCertificateProvider : public grpc_tls_certificate_provider {
       grpc_tls_certificate_distributor* identity_cert_distributor);
 
   Mutex mu_;
+  // Use a separate mutex for san_matchers_ to avoid deadlocks since
+  // san_matchers_ needs to be accessed when a handshake is being done and we
+  // run into a possible deadlock scenario if using the same mutex. The mutex
+  // deadlock cycle is formed as -
+  // WatchStatusCallback() -> SetKeyMaterials() ->
+  // TlsChannelSecurityConnector::TlsChannelCertificateWatcher::OnCertificatesChanged()
+  // -> HandshakeManager::Add() -> SecurityHandshaker::DoHandshake() ->
+  // subject_alternative_names_matchers()
+  Mutex san_matchers_mu_;
   bool watching_root_certs_ = false;
   bool watching_identity_certs_ = false;
   std::string root_cert_name_;
   std::string identity_cert_name_;
   RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor_;
   RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor_;
+  std::vector<XdsApi::StringMatcher> san_matchers_;
   RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
   grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
       root_cert_watcher_ = nullptr;

data/src/core/ext/xds/xds_client.cc

@@ -42,7 +42,6 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/gpr/string.h"
-#include "src/core/lib/gprpp/map.h"
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/orphanable.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
@@ -66,6 +65,7 @@
 namespace grpc_core {
 
 TraceFlag grpc_xds_client_trace(false, "xds_client");
+TraceFlag grpc_xds_client_refcount_trace(false, "xds_client_refcount");
 
 namespace {
 
@@ -460,8 +460,9 @@ grpc_channel* CreateXdsChannel(const XdsBootstrap::XdsServer& server) {
 XdsClient::ChannelState::ChannelState(WeakRefCountedPtr<XdsClient> xds_client,
                                       const XdsBootstrap::XdsServer& server)
     : InternallyRefCounted<ChannelState>(
-          GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace) ? "ChannelState"
-                                                         : nullptr),
+          GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_refcount_trace)
+              ? "ChannelState"
+              : nullptr),
       xds_client_(std::move(xds_client)),
       server_(server) {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace)) {
@@ -668,8 +669,9 @@ void XdsClient::ChannelState::RetryableCall<T>::OnRetryTimerLocked(
 XdsClient::ChannelState::AdsCallState::AdsCallState(
     RefCountedPtr<RetryableCall<AdsCallState>> parent)
     : InternallyRefCounted<AdsCallState>(
-          GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace) ? "AdsCallState"
-                                                         : nullptr),
+          GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_refcount_trace)
+              ? "AdsCallState"
+              : nullptr),
       parent_(std::move(parent)) {
   // Init the ADS call. Note that the call will progress every time there's
   // activity in xds_client()->interested_parties_, which is comprised of
@@ -707,8 +709,8 @@ XdsClient::ChannelState::AdsCallState::AdsCallState(
               GRPC_INITIAL_METADATA_WAIT_FOR_READY_EXPLICITLY_SET;
   op->reserved = nullptr;
   op++;
-  call_error = grpc_call_start_batch_and_execute(call_, ops, (size_t)(op - ops),
-                                                 nullptr);
+  call_error = grpc_call_start_batch_and_execute(
+      call_, ops, static_cast<size_t>(op - ops), nullptr);
   GPR_ASSERT(GRPC_CALL_OK == call_error);
   // Op: send request message.
   GRPC_CLOSURE_INIT(&on_request_sent_, OnRequestSent, this,
@@ -742,8 +744,8 @@ XdsClient::ChannelState::AdsCallState::AdsCallState(
   Ref(DEBUG_LOCATION, "ADS+OnResponseReceivedLocked").release();
   GRPC_CLOSURE_INIT(&on_response_received_, OnResponseReceived, this,
                     grpc_schedule_on_exec_ctx);
-  call_error = grpc_call_start_batch_and_execute(call_, ops, (size_t)(op - ops),
-                                                 &on_response_received_);
+  call_error = grpc_call_start_batch_and_execute(
+      call_, ops, static_cast<size_t>(op - ops), &on_response_received_);
   GPR_ASSERT(GRPC_CALL_OK == call_error);
   // Op: recv server status.
   op = ops;
@@ -759,8 +761,8 @@ XdsClient::ChannelState::AdsCallState::AdsCallState(
   // unreffed.
   GRPC_CLOSURE_INIT(&on_status_received_, OnStatusReceived, this,
                     grpc_schedule_on_exec_ctx);
-  call_error = grpc_call_start_batch_and_execute(call_, ops, (size_t)(op - ops),
-                                                 &on_status_received_);
+  call_error = grpc_call_start_batch_and_execute(
+      call_, ops, static_cast<size_t>(op - ops), &on_status_received_);
   GPR_ASSERT(GRPC_CALL_OK == call_error);
 }
 
@@ -1005,13 +1007,8 @@ void XdsClient::ChannelState::AdsCallState::AcceptCdsUpdate(
     auto& state = cds_state.subscribed_resources[cluster_name];
     if (state != nullptr) state->Finish();
     if (GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace)) {
-      gpr_log(GPR_INFO,
-              "[xds_client %p] cluster=%s: eds_service_name=%s, "
-              "lrs_load_reporting_server_name=%s",
-              xds_client(), cluster_name, cds_update.eds_service_name.c_str(),
-              cds_update.lrs_load_reporting_server_name.has_value()
-                  ? cds_update.lrs_load_reporting_server_name.value().c_str()
-                  : "(N/A)");
+      gpr_log(GPR_INFO, "[xds_client %p] cluster=%s: %s", xds_client(),
+              cluster_name, cds_update.ToString().c_str());
     }
     // Record the EDS resource names seen.
     eds_resource_names_seen.insert(cds_update.eds_service_name.empty()
@@ -1425,8 +1422,9 @@ bool XdsClient::ChannelState::LrsCallState::Reporter::OnReportDoneLocked(
 XdsClient::ChannelState::LrsCallState::LrsCallState(
     RefCountedPtr<RetryableCall<LrsCallState>> parent)
     : InternallyRefCounted<LrsCallState>(
-          GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace) ? "LrsCallState"
-                                                         : nullptr),
+          GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_refcount_trace)
+              ? "LrsCallState"
+              : nullptr),
       parent_(std::move(parent)) {
   // Init the LRS call. Note that the call will progress every time there's
   // activity in xds_client()->interested_parties_, which is comprised of
@@ -1479,8 +1477,8 @@ XdsClient::ChannelState::LrsCallState::LrsCallState(
   Ref(DEBUG_LOCATION, "LRS+OnInitialRequestSentLocked").release();
   GRPC_CLOSURE_INIT(&on_initial_request_sent_, OnInitialRequestSent, this,
                     grpc_schedule_on_exec_ctx);
-  call_error = grpc_call_start_batch_and_execute(call_, ops, (size_t)(op - ops),
-                                                 &on_initial_request_sent_);
+  call_error = grpc_call_start_batch_and_execute(
+      call_, ops, static_cast<size_t>(op - ops), &on_initial_request_sent_);
   GPR_ASSERT(GRPC_CALL_OK == call_error);
   // Op: recv initial metadata.
   op = ops;
@@ -1499,8 +1497,8 @@ XdsClient::ChannelState::LrsCallState::LrsCallState(
   Ref(DEBUG_LOCATION, "LRS+OnResponseReceivedLocked").release();
   GRPC_CLOSURE_INIT(&on_response_received_, OnResponseReceived, this,
                     grpc_schedule_on_exec_ctx);
-  call_error = grpc_call_start_batch_and_execute(call_, ops, (size_t)(op - ops),
-                                                 &on_response_received_);
+  call_error = grpc_call_start_batch_and_execute(
+      call_, ops, static_cast<size_t>(op - ops), &on_response_received_);
   GPR_ASSERT(GRPC_CALL_OK == call_error);
   // Op: recv server status.
   op = ops;
@@ -1516,8 +1514,8 @@ XdsClient::ChannelState::LrsCallState::LrsCallState(
   // unreffed.
   GRPC_CLOSURE_INIT(&on_status_received_, OnStatusReceived, this,
                     grpc_schedule_on_exec_ctx);
-  call_error = grpc_call_start_batch_and_execute(call_, ops, (size_t)(op - ops),
-                                                 &on_status_received_);
+  call_error = grpc_call_start_batch_and_execute(
+      call_, ops, static_cast<size_t>(op - ops), &on_status_received_);
   GPR_ASSERT(GRPC_CALL_OK == call_error);
 }
 
@@ -1737,13 +1735,17 @@ grpc_millis GetRequestTimeout() {
 }  // namespace
 
 XdsClient::XdsClient(grpc_error** error)
-    : DualRefCounted<XdsClient>(GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace)
-                                    ? "XdsClient"
-                                    : nullptr),
+    : DualRefCounted<XdsClient>(
+          GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_refcount_trace) ? "XdsClient"
+                                                                  : nullptr),
       request_timeout_(GetRequestTimeout()),
       interested_parties_(grpc_pollset_set_create()),
       bootstrap_(
           XdsBootstrap::ReadFromFile(this, &grpc_xds_client_trace, error)),
+      certificate_provider_store_(MakeOrphanable<CertificateProviderStore>(
+          bootstrap_ == nullptr
+              ? CertificateProviderStore::PluginDefinitionMap()
+              : bootstrap_->certificate_providers())),
       api_(this, &grpc_xds_client_trace,
            bootstrap_ == nullptr ? nullptr : bootstrap_->node()) {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace)) {

data/src/core/ext/xds/xds_client.h

@@ -30,7 +30,6 @@
 #include "src/core/ext/xds/xds_client_stats.h"
 #include "src/core/lib/channel/channelz.h"
 #include "src/core/lib/gprpp/dual_ref_counted.h"
-#include "src/core/lib/gprpp/map.h"
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/orphanable.h"
 #include "src/core/lib/gprpp/ref_counted.h"
@@ -40,6 +39,7 @@
 namespace grpc_core {
 
 extern TraceFlag grpc_xds_client_trace;
+extern TraceFlag grpc_xds_client_refcount_trace;
 
 class XdsClient : public DualRefCounted<XdsClient> {
  public:
@@ -88,6 +88,10 @@ class XdsClient : public DualRefCounted<XdsClient> {
   explicit XdsClient(grpc_error** error);
   ~XdsClient() override;
 
+  CertificateProviderStore& certificate_provider_store() {
+    return *certificate_provider_store_;
+  }
+
   grpc_pollset_set* interested_parties() const { return interested_parties_; }
 
   // TODO(roth): When we add federation, there will be multiple channels
@@ -292,6 +296,7 @@ class XdsClient : public DualRefCounted<XdsClient> {
   const grpc_millis request_timeout_;
   grpc_pollset_set* interested_parties_;
   std::unique_ptr<XdsBootstrap> bootstrap_;
+  OrphanablePtr<CertificateProviderStore> certificate_provider_store_;
   XdsApi api_;
 
   Mutex mu_;