grpc 1.34.0 → 1.42.0

data/src/core/lib/security/credentials/credentials.h

@@ -28,13 +28,13 @@
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/sync.h>
-#include "src/core/lib/transport/metadata_batch.h"
 
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/http/httpcli.h"
 #include "src/core/lib/http/parser.h"
 #include "src/core/lib/iomgr/polling_entity.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
+#include "src/core/lib/transport/metadata_batch.h"
 
 struct grpc_http_response;
 
@@ -93,7 +93,7 @@ void grpc_override_well_known_credentials_path_getter(
 
 /* --- grpc_channel_credentials. --- */
 
-#define GRPC_ARG_CHANNEL_CREDENTIALS "grpc.channel_credentials"
+#define GRPC_ARG_CHANNEL_CREDENTIALS "grpc.internal.channel_credentials"
 
 // This type is forward declared as a C struct and we cannot define it as a
 // class. Otherwise, compiler will complain about type mismatch due to
@@ -137,6 +137,11 @@ struct grpc_channel_credentials
   const char* type_;
 };
 
+// TODO(roth): Once we eliminate insecure builds, find a better way to
+// plumb credentials so that it doesn't need to flow through channel
+// args.  For example, we'll want to expose it to LB policies by adding
+// methods on the helper API.
+
 /* Util to encapsulate the channel credentials in a channel arg. */
 grpc_arg grpc_channel_credentials_to_arg(grpc_channel_credentials* credentials);
 
@@ -187,13 +192,13 @@ struct grpc_call_credentials
                                     grpc_auth_metadata_context context,
                                     grpc_credentials_mdelem_array* md_array,
                                     grpc_closure* on_request_metadata,
-                                    grpc_error** error) = 0;
+                                    grpc_error_handle* error) = 0;
 
   // Cancels a pending asynchronous operation started by
   // grpc_call_credentials_get_request_metadata() with the corresponding
   // value of \a md_array.
   virtual void cancel_get_request_metadata(
-      grpc_credentials_mdelem_array* md_array, grpc_error* error) = 0;
+      grpc_credentials_mdelem_array* md_array, grpc_error_handle error) = 0;
 
   virtual grpc_security_level min_security_level() const {
     return min_security_level_;
@@ -227,8 +232,9 @@ struct grpc_server_credentials
 
   ~grpc_server_credentials() override { DestroyProcessor(); }
 
+  // Ownership of \a args is not passed.
   virtual grpc_core::RefCountedPtr<grpc_server_security_connector>
-  create_security_connector() = 0;
+  create_security_connector(const grpc_channel_args* args) = 0;
 
   const char* type() const { return type_; }
 

data/src/core/lib/security/credentials/credentials_metadata.cc

@@ -18,12 +18,11 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/security/credentials/credentials.h"
+#include <string.h>
 
 #include <grpc/support/alloc.h>
 
-#include <string.h>
-
+#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/slice/slice_internal.h"
 
 static void mdelem_list_ensure_capacity(grpc_credentials_mdelem_array* list,

data/src/core/lib/security/credentials/external/aws_external_account_credentials.cc

@@ -0,0 +1,404 @@
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/external/aws_external_account_credentials.h"
+
+#include "absl/strings/str_format.h"
+#include "absl/strings/str_join.h"
+#include "absl/strings/str_replace.h"
+
+#include "src/core/lib/gpr/env.h"
+
+namespace grpc_core {
+
+namespace {
+
+const char* kExpectedEnvironmentId = "aws1";
+
+const char* kRegionEnvVar = "AWS_REGION";
+const char* kDefaultRegionEnvVar = "AWS_DEFAULT_REGION";
+const char* kAccessKeyIdEnvVar = "AWS_ACCESS_KEY_ID";
+const char* kSecretAccessKeyEnvVar = "AWS_SECRET_ACCESS_KEY";
+const char* kSessionTokenEnvVar = "AWS_SESSION_TOKEN";
+
+std::string UrlEncode(const absl::string_view& s) {
+  const char* hex = "0123456789ABCDEF";
+  std::string result;
+  result.reserve(s.length());
+  for (auto c : s) {
+    if ((c >= '0' && c <= '9') || (c >= 'A' && c <= 'Z') ||
+        (c >= 'a' && c <= 'z') || c == '-' || c == '_' || c == '!' ||
+        c == '\'' || c == '(' || c == ')' || c == '*' || c == '~' || c == '.') {
+      result.push_back(c);
+    } else {
+      result.push_back('%');
+      result.push_back(hex[static_cast<unsigned char>(c) >> 4]);
+      result.push_back(hex[static_cast<unsigned char>(c) & 15]);
+    }
+  }
+  return result;
+}
+
+}  // namespace
+
+RefCountedPtr<AwsExternalAccountCredentials>
+AwsExternalAccountCredentials::Create(Options options,
+                                      std::vector<std::string> scopes,
+                                      grpc_error_handle* error) {
+  auto creds = MakeRefCounted<AwsExternalAccountCredentials>(
+      std::move(options), std::move(scopes), error);
+  if (*error == GRPC_ERROR_NONE) {
+    return creds;
+  } else {
+    return nullptr;
+  }
+}
+
+AwsExternalAccountCredentials::AwsExternalAccountCredentials(
+    Options options, std::vector<std::string> scopes, grpc_error_handle* error)
+    : ExternalAccountCredentials(options, std::move(scopes)) {
+  audience_ = options.audience;
+  auto it = options.credential_source.object_value().find("environment_id");
+  if (it == options.credential_source.object_value().end()) {
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "environment_id field not present.");
+    return;
+  }
+  if (it->second.type() != Json::Type::STRING) {
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "environment_id field must be a string.");
+    return;
+  }
+  if (it->second.string_value() != kExpectedEnvironmentId) {
+    *error =
+        GRPC_ERROR_CREATE_FROM_STATIC_STRING("environment_id does not match.");
+    return;
+  }
+  it = options.credential_source.object_value().find("region_url");
+  if (it == options.credential_source.object_value().end()) {
+    *error =
+        GRPC_ERROR_CREATE_FROM_STATIC_STRING("region_url field not present.");
+    return;
+  }
+  if (it->second.type() != Json::Type::STRING) {
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "region_url field must be a string.");
+    return;
+  }
+  region_url_ = it->second.string_value();
+  it = options.credential_source.object_value().find("url");
+  if (it != options.credential_source.object_value().end() &&
+      it->second.type() == Json::Type::STRING) {
+    url_ = it->second.string_value();
+  }
+  it = options.credential_source.object_value().find(
+      "regional_cred_verification_url");
+  if (it == options.credential_source.object_value().end()) {
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "regional_cred_verification_url field not present.");
+    return;
+  }
+  if (it->second.type() != Json::Type::STRING) {
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "regional_cred_verification_url field must be a string.");
+    return;
+  }
+  regional_cred_verification_url_ = it->second.string_value();
+}
+
+void AwsExternalAccountCredentials::RetrieveSubjectToken(
+    HTTPRequestContext* ctx, const Options& /*options*/,
+    std::function<void(std::string, grpc_error_handle)> cb) {
+  if (ctx == nullptr) {
+    FinishRetrieveSubjectToken(
+        "",
+        GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+            "Missing HTTPRequestContext to start subject token retrieval."));
+    return;
+  }
+  ctx_ = ctx;
+  cb_ = cb;
+  if (signer_ != nullptr) {
+    BuildSubjectToken();
+  } else {
+    RetrieveRegion();
+  }
+}
+
+void AwsExternalAccountCredentials::RetrieveRegion() {
+  UniquePtr<char> region_from_env(gpr_getenv(kRegionEnvVar));
+  if (region_from_env == nullptr) {
+    region_from_env = UniquePtr<char>(gpr_getenv(kDefaultRegionEnvVar));
+  }
+  if (region_from_env != nullptr) {
+    region_ = std::string(region_from_env.get());
+    if (url_.empty()) {
+      RetrieveSigningKeys();
+    } else {
+      RetrieveRoleName();
+    }
+    return;
+  }
+  absl::StatusOr<URI> uri = URI::Parse(region_url_);
+  if (!uri.ok()) {
+    FinishRetrieveSubjectToken(
+        "", GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrFormat(
+                "Invalid region url. %s", uri.status().ToString())));
+    return;
+  }
+  grpc_httpcli_request request;
+  memset(&request, 0, sizeof(grpc_httpcli_request));
+  request.host = const_cast<char*>(uri->authority().c_str());
+  request.http.path = gpr_strdup(uri->path().c_str());
+  request.handshaker =
+      uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
+  grpc_resource_quota* resource_quota =
+      grpc_resource_quota_create("external_account_credentials");
+  grpc_http_response_destroy(&ctx_->response);
+  ctx_->response = {};
+  GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRegion, this, nullptr);
+  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
+                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  grpc_http_request_destroy(&request.http);
+}
+
+void AwsExternalAccountCredentials::OnRetrieveRegion(void* arg,
+                                                     grpc_error_handle error) {
+  AwsExternalAccountCredentials* self =
+      static_cast<AwsExternalAccountCredentials*>(arg);
+  self->OnRetrieveRegionInternal(GRPC_ERROR_REF(error));
+}
+
+void AwsExternalAccountCredentials::OnRetrieveRegionInternal(
+    grpc_error_handle error) {
+  if (error != GRPC_ERROR_NONE) {
+    FinishRetrieveSubjectToken("", error);
+    return;
+  }
+  // Remove the last letter of availability zone to get pure region
+  absl::string_view response_body(ctx_->response.body,
+                                  ctx_->response.body_length);
+  region_ = std::string(response_body.substr(0, response_body.size() - 1));
+  if (url_.empty()) {
+    RetrieveSigningKeys();
+  } else {
+    RetrieveRoleName();
+  }
+}
+
+void AwsExternalAccountCredentials::RetrieveRoleName() {
+  absl::StatusOr<URI> uri = URI::Parse(url_);
+  if (!uri.ok()) {
+    FinishRetrieveSubjectToken(
+        "", GRPC_ERROR_CREATE_FROM_CPP_STRING(
+                absl::StrFormat("Invalid url: %s.", uri.status().ToString())));
+    return;
+  }
+  grpc_httpcli_request request;
+  memset(&request, 0, sizeof(grpc_httpcli_request));
+  request.host = const_cast<char*>(uri->authority().c_str());
+  request.http.path = gpr_strdup(uri->path().c_str());
+  request.handshaker =
+      uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
+  grpc_resource_quota* resource_quota =
+      grpc_resource_quota_create("external_account_credentials");
+  grpc_http_response_destroy(&ctx_->response);
+  ctx_->response = {};
+  GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRoleName, this, nullptr);
+  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
+                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  grpc_http_request_destroy(&request.http);
+}
+
+void AwsExternalAccountCredentials::OnRetrieveRoleName(
+    void* arg, grpc_error_handle error) {
+  AwsExternalAccountCredentials* self =
+      static_cast<AwsExternalAccountCredentials*>(arg);
+  self->OnRetrieveRoleNameInternal(GRPC_ERROR_REF(error));
+}
+
+void AwsExternalAccountCredentials::OnRetrieveRoleNameInternal(
+    grpc_error_handle error) {
+  if (error != GRPC_ERROR_NONE) {
+    FinishRetrieveSubjectToken("", error);
+    return;
+  }
+  role_name_ = std::string(ctx_->response.body, ctx_->response.body_length);
+  RetrieveSigningKeys();
+}
+
+void AwsExternalAccountCredentials::RetrieveSigningKeys() {
+  UniquePtr<char> access_key_id_from_env(gpr_getenv(kAccessKeyIdEnvVar));
+  UniquePtr<char> secret_access_key_from_env(
+      gpr_getenv(kSecretAccessKeyEnvVar));
+  UniquePtr<char> token_from_env(gpr_getenv(kSessionTokenEnvVar));
+  if (access_key_id_from_env != nullptr &&
+      secret_access_key_from_env != nullptr && token_from_env != nullptr) {
+    access_key_id_ = std::string(access_key_id_from_env.get());
+    secret_access_key_ = std::string(secret_access_key_from_env.get());
+    token_ = std::string(token_from_env.get());
+    BuildSubjectToken();
+    return;
+  }
+  if (role_name_.empty()) {
+    FinishRetrieveSubjectToken(
+        "", GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+                "Missing role name when retrieving signing keys."));
+    return;
+  }
+  std::string url_with_role_name = absl::StrCat(url_, "/", role_name_);
+  absl::StatusOr<URI> uri = URI::Parse(url_with_role_name);
+  if (!uri.ok()) {
+    FinishRetrieveSubjectToken(
+        "", GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrFormat(
+                "Invalid url with role name: %s.", uri.status().ToString())));
+    return;
+  }
+  grpc_httpcli_request request;
+  memset(&request, 0, sizeof(grpc_httpcli_request));
+  request.host = const_cast<char*>(uri->authority().c_str());
+  request.http.path = gpr_strdup(uri->path().c_str());
+  request.handshaker =
+      uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
+  grpc_resource_quota* resource_quota =
+      grpc_resource_quota_create("external_account_credentials");
+  grpc_http_response_destroy(&ctx_->response);
+  ctx_->response = {};
+  GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveSigningKeys, this, nullptr);
+  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
+                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  grpc_http_request_destroy(&request.http);
+}
+
+void AwsExternalAccountCredentials::OnRetrieveSigningKeys(
+    void* arg, grpc_error_handle error) {
+  AwsExternalAccountCredentials* self =
+      static_cast<AwsExternalAccountCredentials*>(arg);
+  self->OnRetrieveSigningKeysInternal(GRPC_ERROR_REF(error));
+}
+
+void AwsExternalAccountCredentials::OnRetrieveSigningKeysInternal(
+    grpc_error_handle error) {
+  if (error != GRPC_ERROR_NONE) {
+    FinishRetrieveSubjectToken("", error);
+    return;
+  }
+  absl::string_view response_body(ctx_->response.body,
+                                  ctx_->response.body_length);
+  Json json = Json::Parse(response_body, &error);
+  if (error != GRPC_ERROR_NONE || json.type() != Json::Type::OBJECT) {
+    FinishRetrieveSubjectToken(
+        "", GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
+                "Invalid retrieve signing keys response.", &error, 1));
+    GRPC_ERROR_UNREF(error);
+    return;
+  }
+  auto it = json.object_value().find("AccessKeyId");
+  if (it != json.object_value().end() &&
+      it->second.type() == Json::Type::STRING) {
+    access_key_id_ = it->second.string_value();
+  } else {
+    FinishRetrieveSubjectToken(
+        "", GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrFormat(
+                "Missing or invalid AccessKeyId in %s.", response_body)));
+    return;
+  }
+  it = json.object_value().find("SecretAccessKey");
+  if (it != json.object_value().end() &&
+      it->second.type() == Json::Type::STRING) {
+    secret_access_key_ = it->second.string_value();
+  } else {
+    FinishRetrieveSubjectToken(
+        "", GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrFormat(
+                "Missing or invalid SecretAccessKey in %s.", response_body)));
+    return;
+  }
+  it = json.object_value().find("Token");
+  if (it != json.object_value().end() &&
+      it->second.type() == Json::Type::STRING) {
+    token_ = it->second.string_value();
+  } else {
+    FinishRetrieveSubjectToken(
+        "", GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrFormat(
+                "Missing or invalid Token in %s.", response_body)));
+    return;
+  }
+  BuildSubjectToken();
+}
+
+void AwsExternalAccountCredentials::BuildSubjectToken() {
+  grpc_error_handle error = GRPC_ERROR_NONE;
+  if (signer_ == nullptr) {
+    cred_verification_url_ = absl::StrReplaceAll(
+        regional_cred_verification_url_, {{"{region}", region_}});
+    signer_ = absl::make_unique<AwsRequestSigner>(
+        access_key_id_, secret_access_key_, token_, "POST",
+        cred_verification_url_, region_, "",
+        std::map<std::string, std::string>(), &error);
+    if (error != GRPC_ERROR_NONE) {
+      FinishRetrieveSubjectToken(
+          "", GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
+                  "Creating aws request signer failed.", &error, 1));
+      GRPC_ERROR_UNREF(error);
+      return;
+    }
+  }
+  auto signed_headers = signer_->GetSignedRequestHeaders();
+  if (error != GRPC_ERROR_NONE) {
+    FinishRetrieveSubjectToken("",
+                               GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
+                                   "Invalid getting signed request"
+                                   "headers.",
+                                   &error, 1));
+    GRPC_ERROR_UNREF(error);
+    return;
+  }
+  // Construct subject token
+  Json::Array headers;
+  headers.push_back(Json(
+      {{"key", "Authorization"}, {"value", signed_headers["Authorization"]}}));
+  headers.push_back(Json({{"key", "host"}, {"value", signed_headers["host"]}}));
+  headers.push_back(
+      Json({{"key", "x-amz-date"}, {"value", signed_headers["x-amz-date"]}}));
+  headers.push_back(Json({{"key", "x-amz-security-token"},
+                          {"value", signed_headers["x-amz-security-token"]}}));
+  headers.push_back(
+      Json({{"key", "x-goog-cloud-target-resource"}, {"value", audience_}}));
+  Json::Object object{{"url", Json(cred_verification_url_)},
+                      {"method", Json("POST")},
+                      {"headers", Json(headers)}};
+  Json subject_token_json(object);
+  std::string subject_token = UrlEncode(subject_token_json.Dump());
+  FinishRetrieveSubjectToken(subject_token, GRPC_ERROR_NONE);
+}
+
+void AwsExternalAccountCredentials::FinishRetrieveSubjectToken(
+    std::string subject_token, grpc_error_handle error) {
+  // Reset context
+  ctx_ = nullptr;
+  // Move object state into local variables.
+  auto cb = cb_;
+  cb_ = nullptr;
+  // Invoke the callback.
+  if (error != GRPC_ERROR_NONE) {
+    cb("", error);
+  } else {
+    cb(subject_token, GRPC_ERROR_NONE);
+  }
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/credentials/external/aws_external_account_credentials.h

@@ -0,0 +1,81 @@
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/external/aws_request_signer.h"
+#include "src/core/lib/security/credentials/external/external_account_credentials.h"
+
+namespace grpc_core {
+
+class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
+ public:
+  static RefCountedPtr<AwsExternalAccountCredentials> Create(
+      Options options, std::vector<std::string> scopes,
+      grpc_error_handle* error);
+
+  AwsExternalAccountCredentials(Options options,
+                                std::vector<std::string> scopes,
+                                grpc_error_handle* error);
+
+ private:
+  void RetrieveSubjectToken(
+      HTTPRequestContext* ctx, const Options& options,
+      std::function<void(std::string, grpc_error_handle)> cb) override;
+
+  void RetrieveRegion();
+  static void OnRetrieveRegion(void* arg, grpc_error_handle error);
+  void OnRetrieveRegionInternal(grpc_error_handle error);
+
+  void RetrieveRoleName();
+  static void OnRetrieveRoleName(void* arg, grpc_error_handle error);
+  void OnRetrieveRoleNameInternal(grpc_error_handle error);
+
+  void RetrieveSigningKeys();
+  static void OnRetrieveSigningKeys(void* arg, grpc_error_handle error);
+  void OnRetrieveSigningKeysInternal(grpc_error_handle error);
+
+  void BuildSubjectToken();
+  void FinishRetrieveSubjectToken(std::string subject_token,
+                                  grpc_error_handle error);
+
+  std::string audience_;
+
+  // Fields of credential source
+  std::string region_url_;
+  std::string url_;
+  std::string regional_cred_verification_url_;
+
+  // Information required by request signer
+  std::string region_;
+  std::string role_name_;
+  std::string access_key_id_;
+  std::string secret_access_key_;
+  std::string token_;
+
+  std::unique_ptr<AwsRequestSigner> signer_;
+  std::string cred_verification_url_;
+
+  HTTPRequestContext* ctx_ = nullptr;
+  std::function<void(std::string, grpc_error_handle)> cb_ = nullptr;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H

data/src/core/lib/security/credentials/external/aws_request_signer.cc

@@ -17,6 +17,9 @@
 
 #include "src/core/lib/security/credentials/external/aws_request_signer.h"
 
+#include <openssl/hmac.h>
+#include <openssl/sha.h>
+
 #include "absl/strings/ascii.h"
 #include "absl/strings/escaping.h"
 #include "absl/strings/str_format.h"
@@ -25,9 +28,6 @@
 #include "absl/time/clock.h"
 #include "absl/time/time.h"
 
-#include <openssl/hmac.h>
-#include <openssl/sha.h>
-
 namespace grpc_core {
 
 namespace {
@@ -55,7 +55,8 @@ std::string HMAC(const std::string& key, const std::string& msg) {
   unsigned int len;
   unsigned char digest[EVP_MAX_MD_SIZE];
   HMAC(EVP_sha256(), key.c_str(), key.length(),
-       (const unsigned char*)msg.c_str(), msg.length(), digest, &len);
+       reinterpret_cast<const unsigned char*>(msg.c_str()), msg.length(),
+       digest, &len);
   return std::string(digest, digest + len);
 }
 
@@ -65,7 +66,8 @@ AwsRequestSigner::AwsRequestSigner(
     std::string access_key_id, std::string secret_access_key, std::string token,
     std::string method, std::string url, std::string region,
     std::string request_payload,
-    std::map<std::string, std::string> additional_headers, grpc_error** error)
+    std::map<std::string, std::string> additional_headers,
+    grpc_error_handle* error)
     : access_key_id_(std::move(access_key_id)),
       secret_access_key_(std::move(secret_access_key)),
       token_(std::move(token)),
@@ -94,15 +96,14 @@ AwsRequestSigner::AwsRequestSigner(
     static_request_date_ =
         absl::FormatTime(kXAmzDateFormat, request_date, absl::UTCTimeZone());
   }
-  url_ = grpc_uri_parse(url, false);
-  if (url_ == nullptr) {
+  absl::StatusOr<URI> tmp_url = URI::Parse(url);
+  if (!tmp_url.ok()) {
     *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Invalid Aws request url.");
     return;
   }
+  url_ = tmp_url.value();
 }
 
-AwsRequestSigner::~AwsRequestSigner() { grpc_uri_destroy(url_); }
-
 std::map<std::string, std::string> AwsRequestSigner::GetSignedRequestHeaders() {
   std::string request_date_full;
   if (!static_request_date_.empty()) {
@@ -123,15 +124,20 @@ std::map<std::string, std::string> AwsRequestSigner::GetSignedRequestHeaders() {
   canonical_request_vector.emplace_back(method_);
   canonical_request_vector.emplace_back("\n");
   // 2. CanonicalURI
-
-  canonical_request_vector.emplace_back(*url_->path == '\0' ? "/" : url_->path);
+  canonical_request_vector.emplace_back(
+      url_.path().empty() ? "/" : absl::string_view(url_.path()));
   canonical_request_vector.emplace_back("\n");
   // 3. CanonicalQueryString
-  canonical_request_vector.emplace_back(url_->query);
+  std::vector<std::string> query_vector;
+  for (const URI::QueryParam& query_kv : url_.query_parameter_pairs()) {
+    query_vector.emplace_back(absl::StrCat(query_kv.key, "=", query_kv.value));
+  }
+  std::string query = absl::StrJoin(query_vector, "&");
+  canonical_request_vector.emplace_back(query);
   canonical_request_vector.emplace_back("\n");
   // 4. CanonicalHeaders
   if (request_headers_.empty()) {
-    request_headers_.insert({"host", url_->authority});
+    request_headers_.insert({"host", url_.authority()});
     if (!token_.empty()) {
       request_headers_.insert({"x-amz-security-token", token_});
     }
@@ -176,7 +182,7 @@ std::map<std::string, std::string> AwsRequestSigner::GetSignedRequestHeaders() {
   string_to_sign_vector.emplace_back("\n");
   // 3. CredentialScope
   std::pair<absl::string_view, absl::string_view> host_parts =
-      absl::StrSplit(url_->authority, absl::MaxSplits('.', 1));
+      absl::StrSplit(url_.authority(), absl::MaxSplits('.', 1));
   std::string service_name(host_parts.first);
   std::string credential_scope = absl::StrFormat(
       "%s/%s/%s/aws4_request", request_date_short, region_, service_name);

data/src/core/lib/security/credentials/external/aws_request_signer.h

@@ -45,8 +45,7 @@ class AwsRequestSigner {
                    std::string token, std::string method, std::string url,
                    std::string region, std::string request_payload,
                    std::map<std::string, std::string> additional_headers,
-                   grpc_error** error);
-  ~AwsRequestSigner();
+                   grpc_error_handle* error);
 
   // This method triggers the signing process then returns the headers of the
   // signed request as a map. In case there is an error, the input `error`
@@ -59,7 +58,7 @@ class AwsRequestSigner {
   std::string secret_access_key_;
   std::string token_;
   std::string method_;
-  grpc_uri* url_ = nullptr;
+  URI url_;
   std::string region_;
   std::string request_payload_;
   std::map<std::string, std::string> additional_headers_;