grpc 1.35.0 → 1.36.0

data/src/core/ext/xds/xds_certificate_provider.h

@@ -31,44 +31,34 @@ namespace grpc_core {
 
 class XdsCertificateProvider : public grpc_tls_certificate_provider {
  public:
-  XdsCertificateProvider(
-      absl::string_view root_cert_name,
-      RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor,
-      absl::string_view identity_cert_name,
-      RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor,
-      std::vector<XdsApi::StringMatcher> san_matchers);
-
+  XdsCertificateProvider();
   ~XdsCertificateProvider() override;
 
-  void UpdateRootCertNameAndDistributor(
-      absl::string_view root_cert_name,
-      RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor);
-  void UpdateIdentityCertNameAndDistributor(
-      absl::string_view identity_cert_name,
-      RefCountedPtr<grpc_tls_certificate_distributor>
-          identity_cert_distributor);
-  void UpdateSubjectAlternativeNameMatchers(
-      std::vector<XdsApi::StringMatcher> matchers);
-
   grpc_core::RefCountedPtr<grpc_tls_certificate_distributor> distributor()
       const override {
     return distributor_;
   }
 
-  bool ProvidesRootCerts() {
-    MutexLock lock(&mu_);
-    return root_cert_distributor_ != nullptr;
-  }
+  bool ProvidesRootCerts(const std::string& cert_name);
+  void UpdateRootCertNameAndDistributor(
+      const std::string& cert_name, absl::string_view root_cert_name,
+      RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor);
 
-  bool ProvidesIdentityCerts() {
-    MutexLock lock(&mu_);
-    return identity_cert_distributor_ != nullptr;
-  }
+  bool ProvidesIdentityCerts(const std::string& cert_name);
+  void UpdateIdentityCertNameAndDistributor(
+      const std::string& cert_name, absl::string_view identity_cert_name,
+      RefCountedPtr<grpc_tls_certificate_distributor>
+          identity_cert_distributor);
 
-  std::vector<XdsApi::StringMatcher> subject_alternative_name_matchers() {
-    MutexLock lock(&san_matchers_mu_);
-    return san_matchers_;
-  }
+  bool GetRequireClientCertificate(const std::string& cert_name);
+  // Updating \a require_client_certificate for a non-existing \a cert_name has
+  // no effect.
+  void UpdateRequireClientCertificate(const std::string& cert_name,
+                                      bool require_client_certificate);
+
+  std::vector<StringMatcher> GetSanMatchers(const std::string& cluster);
+  void UpdateSubjectAlternativeNameMatchers(
+      const std::string& cluster, std::vector<StringMatcher> matchers);
 
   grpc_arg MakeChannelArg() const;
 
@@ -76,14 +66,71 @@ class XdsCertificateProvider : public grpc_tls_certificate_provider {
       const grpc_channel_args* args);
 
  private:
+  class ClusterCertificateState {
+   public:
+    explicit ClusterCertificateState(
+        XdsCertificateProvider* xds_certificate_provider)
+        : xds_certificate_provider_(xds_certificate_provider) {}
+
+    ~ClusterCertificateState();
+
+    // Returns true if the certs aren't being watched and there are no
+    // distributors configured.
+    bool IsSafeToRemove() const;
+
+    bool ProvidesRootCerts() const { return root_cert_distributor_ != nullptr; }
+    bool ProvidesIdentityCerts() const {
+      return identity_cert_distributor_ != nullptr;
+    }
+
+    void UpdateRootCertNameAndDistributor(
+        const std::string& cert_name, absl::string_view root_cert_name,
+        RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor);
+    void UpdateIdentityCertNameAndDistributor(
+        const std::string& cert_name, absl::string_view identity_cert_name,
+        RefCountedPtr<grpc_tls_certificate_distributor>
+            identity_cert_distributor);
+
+    void UpdateRootCertWatcher(
+        const std::string& cert_name,
+        grpc_tls_certificate_distributor* root_cert_distributor);
+    void UpdateIdentityCertWatcher(
+        const std::string& cert_name,
+        grpc_tls_certificate_distributor* identity_cert_distributor);
+
+    bool require_client_certificate() const {
+      return require_client_certificate_;
+    }
+    void set_require_client_certificate(bool require_client_certificate) {
+      require_client_certificate_ = require_client_certificate;
+    }
+
+    void WatchStatusCallback(const std::string& cert_name,
+                             bool root_being_watched,
+                             bool identity_being_watched);
+
+   private:
+    XdsCertificateProvider* xds_certificate_provider_;
+    bool watching_root_certs_ = false;
+    bool watching_identity_certs_ = false;
+    std::string root_cert_name_;
+    std::string identity_cert_name_;
+    RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor_;
+    RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor_;
+    grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
+        root_cert_watcher_ = nullptr;
+    grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
+        identity_cert_watcher_ = nullptr;
+    bool require_client_certificate_ = false;
+  };
+
   void WatchStatusCallback(std::string cert_name, bool root_being_watched,
                            bool identity_being_watched);
-  void UpdateRootCertWatcher(
-      grpc_tls_certificate_distributor* root_cert_distributor);
-  void UpdateIdentityCertWatcher(
-      grpc_tls_certificate_distributor* identity_cert_distributor);
 
   Mutex mu_;
+  std::map<std::string /*cert_name*/, std::unique_ptr<ClusterCertificateState>>
+      certificate_state_map_;
+
   // Use a separate mutex for san_matchers_ to avoid deadlocks since
   // san_matchers_ needs to be accessed when a handshake is being done and we
   // run into a possible deadlock scenario if using the same mutex. The mutex
@@ -93,18 +140,10 @@ class XdsCertificateProvider : public grpc_tls_certificate_provider {
   // -> HandshakeManager::Add() -> SecurityHandshaker::DoHandshake() ->
   // subject_alternative_names_matchers()
   Mutex san_matchers_mu_;
-  bool watching_root_certs_ = false;
-  bool watching_identity_certs_ = false;
-  std::string root_cert_name_;
-  std::string identity_cert_name_;
-  RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor_;
-  RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor_;
-  std::vector<XdsApi::StringMatcher> san_matchers_;
+  std::map<std::string /*cluster_name*/, std::vector<StringMatcher>>
+      san_matcher_map_;
+
   RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
-  grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
-      root_cert_watcher_ = nullptr;
-  grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
-      identity_cert_watcher_ = nullptr;
 };
 
 }  // namespace grpc_core

data/src/core/ext/xds/xds_client.cc

@@ -72,6 +72,7 @@ namespace {
 Mutex* g_mu = nullptr;
 const grpc_channel_args* g_channel_args = nullptr;
 XdsClient* g_xds_client = nullptr;
+char* g_fallback_bootstrap_config = nullptr;
 
 }  // namespace
 
@@ -881,15 +882,8 @@ void XdsClient::ChannelState::AdsCallState::AcceptLdsUpdate(
     auto& state = lds_state.subscribed_resources[listener_name];
     if (state != nullptr) state->Finish();
     if (GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace)) {
-      gpr_log(GPR_INFO, "[xds_client %p] LDS resource %s: route_config_name=%s",
-              xds_client(), listener_name.c_str(),
-              (!lds_update.route_config_name.empty()
-                   ? lds_update.route_config_name.c_str()
-                   : "<inlined>"));
-      if (lds_update.rds_update.has_value()) {
-        gpr_log(GPR_INFO, "RouteConfiguration: %s",
-                lds_update.rds_update->ToString().c_str());
-      }
+      gpr_log(GPR_INFO, "[xds_client %p] LDS resource %s: %s", xds_client(),
+              listener_name.c_str(), lds_update.ToString().c_str());
     }
     // Record the RDS resource names seen.
     if (!lds_update.route_config_name.empty()) {
@@ -1740,8 +1734,8 @@ XdsClient::XdsClient(grpc_error** error)
                                                                   : nullptr),
       request_timeout_(GetRequestTimeout()),
       interested_parties_(grpc_pollset_set_create()),
-      bootstrap_(
-          XdsBootstrap::ReadFromFile(this, &grpc_xds_client_trace, error)),
+      bootstrap_(XdsBootstrap::Create(this, &grpc_xds_client_trace,
+                                      g_fallback_bootstrap_config, error)),
       certificate_provider_store_(MakeOrphanable<CertificateProviderStore>(
           bootstrap_ == nullptr
               ? CertificateProviderStore::PluginDefinitionMap()
@@ -2207,6 +2201,8 @@ void XdsClientGlobalInit() { g_mu = new Mutex; }
 void XdsClientGlobalShutdown() {
   delete g_mu;
   g_mu = nullptr;
+  gpr_free(g_fallback_bootstrap_config);
+  g_fallback_bootstrap_config = nullptr;
 }
 
 RefCountedPtr<XdsClient> XdsClient::GetOrCreate(grpc_error** error) {
@@ -2232,6 +2228,12 @@ void UnsetGlobalXdsClientForTest() {
   g_xds_client = nullptr;
 }
 
+void SetXdsFallbackBootstrapConfig(const char* config) {
+  MutexLock lock(g_mu);
+  gpr_free(g_fallback_bootstrap_config);
+  g_fallback_bootstrap_config = gpr_strdup(config);
+}
+
 }  // namespace internal
 
 }  // namespace grpc_core

data/src/core/ext/xds/xds_client.h

@@ -329,6 +329,9 @@ class XdsClient : public DualRefCounted<XdsClient> {
 namespace internal {
 void SetXdsChannelArgsForTest(grpc_channel_args* args);
 void UnsetGlobalXdsClientForTest();
+// Sets bootstrap config to be used when no env var is set.
+// Does not take ownership of config.
+void SetXdsFallbackBootstrapConfig(const char* config);
 }  // namespace internal
 
 }  // namespace grpc_core

data/src/core/ext/xds/xds_client_stats.cc

@@ -137,7 +137,8 @@ XdsClusterLocalityStats::GetSnapshotAndReset() {
                        // not related to a single reporting interval.
                        total_requests_in_progress_.Load(MemoryOrder::RELAXED),
                        GetAndResetCounter(&total_error_requests_),
-                       GetAndResetCounter(&total_issued_requests_)};
+                       GetAndResetCounter(&total_issued_requests_),
+                       {}};
   MutexLock lock(&backend_metrics_mu_);
   snapshot.backend_metrics = std::move(backend_metrics_);
   return snapshot;

data/src/core/ext/xds/xds_server_config_fetcher.cc

@@ -18,11 +18,18 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/ext/xds/xds_certificate_provider.h"
 #include "src/core/ext/xds/xds_client.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/security/credentials/xds/xds_credentials.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/surface/server.h"
 
 namespace grpc_core {
+
+TraceFlag grpc_xds_server_config_fetcher_trace(false,
+                                               "xds_server_config_fetcher");
+
 namespace {
 
 class XdsServerConfigFetcher : public grpc_server_config_fetcher {
@@ -32,18 +39,18 @@ class XdsServerConfigFetcher : public grpc_server_config_fetcher {
     GPR_ASSERT(xds_client_ != nullptr);
   }
 
-  void StartWatch(std::string listening_address,
+  void StartWatch(std::string listening_address, grpc_channel_args* args,
                   std::unique_ptr<grpc_server_config_fetcher::WatcherInterface>
                       watcher) override {
     grpc_server_config_fetcher::WatcherInterface* watcher_ptr = watcher.get();
-    auto listener_watcher =
-        absl::make_unique<ListenerWatcher>(std::move(watcher));
+    auto listener_watcher = absl::make_unique<ListenerWatcher>(
+        std::move(watcher), args, xds_client_);
     auto* listener_watcher_ptr = listener_watcher.get();
     // TODO(yashykt): Get the resource name id from bootstrap
-    xds_client_->WatchListenerData(
-        absl::StrCat("grpc/server?xds.resource.listening_address=",
-                     listening_address),
-        std::move(listener_watcher));
+    listening_address = absl::StrCat(
+        "grpc/server?xds.resource.listening_address=", listening_address);
+    xds_client_->WatchListenerData(listening_address,
+                                   std::move(listener_watcher));
     MutexLock lock(&mu_);
     auto& watcher_state = watchers_[watcher_ptr];
     watcher_state.listening_address = listening_address;
@@ -73,12 +80,45 @@ class XdsServerConfigFetcher : public grpc_server_config_fetcher {
    public:
     explicit ListenerWatcher(
         std::unique_ptr<grpc_server_config_fetcher::WatcherInterface>
-            server_config_watcher)
-        : server_config_watcher_(std::move(server_config_watcher)) {}
+            server_config_watcher,
+        grpc_channel_args* args, RefCountedPtr<XdsClient> xds_client)
+        : server_config_watcher_(std::move(server_config_watcher)),
+          args_(args),
+          xds_client_(std::move(xds_client)) {}
+
+    ~ListenerWatcher() override { grpc_channel_args_destroy(args_); }
+
+    // Deleted due to special handling required for args_. Copy the channel args
+    // if we ever need these.
+    ListenerWatcher(const ListenerWatcher&) = delete;
+    ListenerWatcher& operator=(const ListenerWatcher&) = delete;
 
     void OnListenerChanged(XdsApi::LdsUpdate listener) override {
-      // TODO(yashykt): Construct channel args according to received update
-      server_config_watcher_->UpdateConfig(nullptr);
+      if (GRPC_TRACE_FLAG_ENABLED(grpc_xds_server_config_fetcher_trace)) {
+        gpr_log(
+            GPR_INFO,
+            "[ListenerWatcher %p] Received LDS update from xds client %p: %s",
+            this, xds_client_.get(), listener.ToString().c_str());
+      }
+      grpc_error* error = GRPC_ERROR_NONE;
+      bool update_needed = UpdateXdsCertificateProvider(listener, &error);
+      if (error != GRPC_ERROR_NONE) {
+        OnError(error);
+        return;
+      }
+      // Only send an update, if something changed.
+      if (updated_once_ && !update_needed) {
+        return;
+      }
+      updated_once_ = true;
+      grpc_channel_args* updated_args = nullptr;
+      if (xds_certificate_provider_ != nullptr) {
+        grpc_arg arg_to_add = xds_certificate_provider_->MakeChannelArg();
+        updated_args = grpc_channel_args_copy_and_add(args_, &arg_to_add, 1);
+      } else {
+        updated_args = grpc_channel_args_copy(args_);
+      }
+      server_config_watcher_->UpdateConfig(updated_args);
     }
 
     void OnError(grpc_error* error) override {
@@ -97,8 +137,103 @@ class XdsServerConfigFetcher : public grpc_server_config_fetcher {
     }
 
    private:
+    // Returns true if the xds certificate provider changed in a way that
+    // required a new security connector to be created, false otherwise.
+    bool UpdateXdsCertificateProvider(const XdsApi::LdsUpdate& listener,
+                                      grpc_error** error) {
+      // Early out if channel is not configured to use xDS security.
+      grpc_server_credentials* server_creds =
+          grpc_find_server_credentials_in_args(args_);
+      if (server_creds == nullptr ||
+          server_creds->type() != kCredentialsTypeXds) {
+        xds_certificate_provider_ = nullptr;
+        return false;
+      }
+      if (xds_certificate_provider_ == nullptr) {
+        xds_certificate_provider_ = MakeRefCounted<XdsCertificateProvider>();
+      }
+      // Configure root cert.
+      absl::string_view root_provider_instance_name =
+          listener.downstream_tls_context.common_tls_context
+              .combined_validation_context
+              .validation_context_certificate_provider_instance.instance_name;
+      absl::string_view root_provider_cert_name =
+          listener.downstream_tls_context.common_tls_context
+              .combined_validation_context
+              .validation_context_certificate_provider_instance
+              .certificate_name;
+      RefCountedPtr<grpc_tls_certificate_provider> new_root_provider;
+      if (!root_provider_instance_name.empty()) {
+        new_root_provider =
+            xds_client_->certificate_provider_store()
+                .CreateOrGetCertificateProvider(root_provider_instance_name);
+        if (new_root_provider == nullptr) {
+          *error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+              absl::StrCat("Certificate provider instance name: \"",
+                           root_provider_instance_name, "\" not recognized.")
+                  .c_str());
+          return false;
+        }
+      }
+      // Configure identity cert.
+      absl::string_view identity_provider_instance_name =
+          listener.downstream_tls_context.common_tls_context
+              .tls_certificate_certificate_provider_instance.instance_name;
+      absl::string_view identity_provider_cert_name =
+          listener.downstream_tls_context.common_tls_context
+              .tls_certificate_certificate_provider_instance.certificate_name;
+      RefCountedPtr<grpc_tls_certificate_provider> new_identity_provider;
+      if (!identity_provider_instance_name.empty()) {
+        new_identity_provider = xds_client_->certificate_provider_store()
+                                    .CreateOrGetCertificateProvider(
+                                        identity_provider_instance_name);
+        if (new_identity_provider == nullptr) {
+          *error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+              absl::StrCat("Certificate provider instance name: \"",
+                           identity_provider_instance_name,
+                           "\" not recognized.")
+                  .c_str());
+          return false;
+        }
+      }
+      bool security_connector_update_required = false;
+      if (((new_root_provider == nullptr) !=
+           (root_certificate_provider_ == nullptr)) ||
+          ((new_identity_provider == nullptr) !=
+           (identity_certificate_provider_ == nullptr)) ||
+          (listener.downstream_tls_context.require_client_certificate !=
+           xds_certificate_provider_->GetRequireClientCertificate(""))) {
+        security_connector_update_required = true;
+      }
+      if (root_certificate_provider_ != new_root_provider) {
+        root_certificate_provider_ = std::move(new_root_provider);
+      }
+      if (identity_certificate_provider_ != new_identity_provider) {
+        identity_certificate_provider_ = std::move(new_identity_provider);
+      }
+      xds_certificate_provider_->UpdateRootCertNameAndDistributor(
+          "", root_provider_cert_name,
+          root_certificate_provider_ == nullptr
+              ? nullptr
+              : root_certificate_provider_->distributor());
+      xds_certificate_provider_->UpdateIdentityCertNameAndDistributor(
+          "", identity_provider_cert_name,
+          identity_certificate_provider_ == nullptr
+              ? nullptr
+              : identity_certificate_provider_->distributor());
+      xds_certificate_provider_->UpdateRequireClientCertificate(
+          "", listener.downstream_tls_context.require_client_certificate);
+      return security_connector_update_required;
+    }
+
     std::unique_ptr<grpc_server_config_fetcher::WatcherInterface>
         server_config_watcher_;
+    grpc_channel_args* args_;
+    RefCountedPtr<XdsClient> xds_client_;
+    RefCountedPtr<grpc_tls_certificate_provider> root_certificate_provider_;
+    RefCountedPtr<grpc_tls_certificate_provider> identity_certificate_provider_;
+    RefCountedPtr<XdsCertificateProvider> xds_certificate_provider_;
+    bool updated_once_ = false;
   };
 
   struct WatcherState {
@@ -125,6 +260,7 @@ grpc_server_config_fetcher* grpc_server_config_fetcher_xds_create() {
   if (error != GRPC_ERROR_NONE) {
     gpr_log(GPR_ERROR, "Failed to create xds client: %s",
             grpc_error_string(error));
+    GRPC_ERROR_UNREF(error);
     return nullptr;
   }
   return new grpc_core::XdsServerConfigFetcher(std::move(xds_client));

data/src/core/lib/channel/handshaker.cc

@@ -53,7 +53,7 @@ std::string HandshakerArgsString(HandshakerArgs* args) {
 
 }  // namespace
 
-HandshakeManager::HandshakeManager() { gpr_mu_init(&mu_); }
+HandshakeManager::HandshakeManager() {}
 
 /// Add \a mgr to the server side list of all pending handshake managers, the
 /// list starts with \a *head.
@@ -104,10 +104,7 @@ void HandshakeManager::Add(RefCountedPtr<Handshaker> handshaker) {
   handshakers_.push_back(std::move(handshaker));
 }
 
-HandshakeManager::~HandshakeManager() {
-  handshakers_.clear();
-  gpr_mu_destroy(&mu_);
-}
+HandshakeManager::~HandshakeManager() { handshakers_.clear(); }
 
 void HandshakeManager::Shutdown(grpc_error* why) {
   {