grpc 1.35.0 → 1.38.0

data/src/core/lib/matchers/matchers.h

@@ -0,0 +1,160 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_MATCHERS_MATCHERS_H
+#define GRPC_CORE_LIB_MATCHERS_MATCHERS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+#include <string>
+
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
+
+#include "re2/re2.h"
+
+namespace grpc_core {
+
+class StringMatcher {
+ public:
+  enum class Type {
+    kExact,      // value stored in string_matcher_ field
+    kPrefix,     // value stored in string_matcher_ field
+    kSuffix,     // value stored in string_matcher_ field
+    kSafeRegex,  // pattern stored in regex_matcher_ field
+    kContains,   // value stored in string_matcher_ field
+  };
+
+  // Creates StringMatcher instance. Returns error status on failure.
+  static absl::StatusOr<StringMatcher> Create(Type type,
+                                              absl::string_view matcher,
+                                              bool case_sensitive = true);
+
+  StringMatcher() = default;
+  StringMatcher(const StringMatcher& other);
+  StringMatcher& operator=(const StringMatcher& other);
+  StringMatcher(StringMatcher&& other) noexcept;
+  StringMatcher& operator=(StringMatcher&& other) noexcept;
+  bool operator==(const StringMatcher& other) const;
+
+  bool Match(absl::string_view value) const;
+
+  std::string ToString() const;
+
+  Type type() const { return type_; }
+
+  // Valid for kExact, kPrefix, kSuffix and kContains.
+  const std::string& string_matcher() const { return string_matcher_; }
+
+  // Valid for kSafeRegex.
+  RE2* regex_matcher() const { return regex_matcher_.get(); }
+
+  bool case_sensitive() const { return case_sensitive_; }
+
+ private:
+  StringMatcher(Type type, absl::string_view matcher, bool case_sensitive);
+  StringMatcher(std::unique_ptr<RE2> regex_matcher, bool case_sensitive);
+
+  Type type_ = Type::kExact;
+  std::string string_matcher_;
+  std::unique_ptr<RE2> regex_matcher_;
+  bool case_sensitive_ = true;
+};
+
+class HeaderMatcher {
+ public:
+  enum class Type {
+    kExact,      // value stored in StringMatcher field
+    kPrefix,     // value stored in StringMatcher field
+    kSuffix,     // value stored in StringMatcher field
+    kSafeRegex,  // value stored in StringMatcher field
+    kContains,   // value stored in StringMatcher field
+    kRange,      // uses range_start and range_end fields
+    kPresent,    // uses present_match field
+  };
+
+  // Make sure that the first five HeaderMatcher::Type enum values match up to
+  // the corresponding StringMatcher::Type enum values, so that it's safe to
+  // convert by casting when delegating to StringMatcher.
+  static_assert(static_cast<StringMatcher::Type>(Type::kExact) ==
+                    StringMatcher::Type::kExact,
+                "");
+  static_assert(static_cast<StringMatcher::Type>(Type::kPrefix) ==
+                    StringMatcher::Type::kPrefix,
+                "");
+  static_assert(static_cast<StringMatcher::Type>(Type::kSuffix) ==
+                    StringMatcher::Type::kSuffix,
+                "");
+  static_assert(static_cast<StringMatcher::Type>(Type::kSafeRegex) ==
+                    StringMatcher::Type::kSafeRegex,
+                "");
+  static_assert(static_cast<StringMatcher::Type>(Type::kContains) ==
+                    StringMatcher::Type::kContains,
+                "");
+
+  // Creates HeaderMatcher instance. Returns error status on failure.
+  static absl::StatusOr<HeaderMatcher> Create(absl::string_view name, Type type,
+                                              absl::string_view matcher,
+                                              int64_t range_start = 0,
+                                              int64_t range_end = 0,
+                                              bool present_match = false,
+                                              bool invert_match = false);
+
+  HeaderMatcher() = default;
+  HeaderMatcher(const HeaderMatcher& other);
+  HeaderMatcher& operator=(const HeaderMatcher& other);
+  HeaderMatcher(HeaderMatcher&& other) noexcept;
+  HeaderMatcher& operator=(HeaderMatcher&& other) noexcept;
+  bool operator==(const HeaderMatcher& other) const;
+
+  const std::string& name() const { return name_; }
+
+  Type type() const { return type_; }
+
+  // Valid for kExact, kPrefix, kSuffix and kContains.
+  const std::string& string_matcher() const {
+    return matcher_.string_matcher();
+  }
+
+  // Valid for kSafeRegex.
+  RE2* regex_matcher() const { return matcher_.regex_matcher(); }
+
+  bool Match(const absl::optional<absl::string_view>& value) const;
+
+  std::string ToString() const;
+
+ private:
+  // For StringMatcher.
+  HeaderMatcher(absl::string_view name, Type type, StringMatcher matcher,
+                bool invert_match);
+  // For RangeMatcher.
+  HeaderMatcher(absl::string_view name, int64_t range_start, int64_t range_end,
+                bool invert_match);
+  // For PresentMatcher.
+  HeaderMatcher(absl::string_view name, bool present_match, bool invert_match);
+
+  std::string name_;
+  Type type_ = Type::kExact;
+  StringMatcher matcher_;
+  int64_t range_start_;
+  int64_t range_end_;
+  bool present_match_;
+  bool invert_match_ = false;
+};
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_LIB_MATCHERS_MATCHERS_H */

data/src/core/lib/security/credentials/alts/alts_credentials.cc

@@ -70,7 +70,8 @@ grpc_alts_server_credentials::grpc_alts_server_credentials(
 }
 
 grpc_core::RefCountedPtr<grpc_server_security_connector>
-grpc_alts_server_credentials::create_security_connector() {
+grpc_alts_server_credentials::create_security_connector(
+    const grpc_channel_args* /* args */) {
   return grpc_alts_server_security_connector_create(this->Ref());
 }
 

data/src/core/lib/security/credentials/alts/alts_credentials.h

@@ -56,7 +56,7 @@ class grpc_alts_server_credentials final : public grpc_server_credentials {
   ~grpc_alts_server_credentials() override;
 
   grpc_core::RefCountedPtr<grpc_server_security_connector>
-  create_security_connector() override;
+  create_security_connector(const grpc_channel_args* /* args */) override;
 
   const grpc_alts_credentials_options* options() const { return options_; }
   grpc_alts_credentials_options* mutable_options() { return options_; }

data/src/core/lib/security/credentials/composite/composite_credentials.cc

@@ -36,7 +36,7 @@
 
 /* -- Composite call credentials. -- */
 
-static void composite_call_metadata_cb(void* arg, grpc_error* error);
+static void composite_call_metadata_cb(void* arg, grpc_error_handle error);
 
 namespace {
 struct grpc_composite_call_credentials_metadata_context {
@@ -64,7 +64,7 @@ struct grpc_composite_call_credentials_metadata_context {
 };
 }  // namespace
 
-static void composite_call_metadata_cb(void* arg, grpc_error* error) {
+static void composite_call_metadata_cb(void* arg, grpc_error_handle error) {
   grpc_composite_call_credentials_metadata_context* ctx =
       static_cast<grpc_composite_call_credentials_metadata_context*>(arg);
   if (error == GRPC_ERROR_NONE) {
@@ -91,7 +91,7 @@ static void composite_call_metadata_cb(void* arg, grpc_error* error) {
 bool grpc_composite_call_credentials::get_request_metadata(
     grpc_polling_entity* pollent, grpc_auth_metadata_context auth_md_context,
     grpc_credentials_mdelem_array* md_array, grpc_closure* on_request_metadata,
-    grpc_error** error) {
+    grpc_error_handle* error) {
   grpc_composite_call_credentials_metadata_context* ctx;
   ctx = new grpc_composite_call_credentials_metadata_context(
       this, pollent, auth_md_context, md_array, on_request_metadata);
@@ -112,7 +112,7 @@ bool grpc_composite_call_credentials::get_request_metadata(
 }
 
 void grpc_composite_call_credentials::cancel_get_request_metadata(
-    grpc_credentials_mdelem_array* md_array, grpc_error* error) {
+    grpc_credentials_mdelem_array* md_array, grpc_error_handle error) {
   for (size_t i = 0; i < inner_.size(); ++i) {
     inner_[i]->cancel_get_request_metadata(md_array, GRPC_ERROR_REF(error));
   }

data/src/core/lib/security/credentials/composite/composite_credentials.h

@@ -83,10 +83,10 @@ class grpc_composite_call_credentials : public grpc_call_credentials {
                             grpc_auth_metadata_context context,
                             grpc_credentials_mdelem_array* md_array,
                             grpc_closure* on_request_metadata,
-                            grpc_error** error) override;
+                            grpc_error_handle* error) override;
 
   void cancel_get_request_metadata(grpc_credentials_mdelem_array* md_array,
-                                   grpc_error* error) override;
+                                   grpc_error_handle error) override;
 
   grpc_security_level min_security_level() const override {
     return min_security_level_;

data/src/core/lib/security/credentials/credentials.h

@@ -187,13 +187,13 @@ struct grpc_call_credentials
                                     grpc_auth_metadata_context context,
                                     grpc_credentials_mdelem_array* md_array,
                                     grpc_closure* on_request_metadata,
-                                    grpc_error** error) = 0;
+                                    grpc_error_handle* error) = 0;
 
   // Cancels a pending asynchronous operation started by
   // grpc_call_credentials_get_request_metadata() with the corresponding
   // value of \a md_array.
   virtual void cancel_get_request_metadata(
-      grpc_credentials_mdelem_array* md_array, grpc_error* error) = 0;
+      grpc_credentials_mdelem_array* md_array, grpc_error_handle error) = 0;
 
   virtual grpc_security_level min_security_level() const {
     return min_security_level_;
@@ -227,8 +227,9 @@ struct grpc_server_credentials
 
   ~grpc_server_credentials() override { DestroyProcessor(); }
 
+  // Ownership of \a args is not passed.
   virtual grpc_core::RefCountedPtr<grpc_server_security_connector>
-  create_security_connector() = 0;
+  create_security_connector(const grpc_channel_args* args) = 0;
 
   const char* type() const { return type_; }
 

data/src/core/lib/security/credentials/external/aws_external_account_credentials.cc

@@ -30,6 +30,7 @@ namespace {
 const char* kExpectedEnvironmentId = "aws1";
 
 const char* kRegionEnvVar = "AWS_REGION";
+const char* kDefaultRegionEnvVar = "AWS_DEFAULT_REGION";
 const char* kAccessKeyIdEnvVar = "AWS_ACCESS_KEY_ID";
 const char* kSecretAccessKeyEnvVar = "AWS_SECRET_ACCESS_KEY";
 const char* kSessionTokenEnvVar = "AWS_SESSION_TOKEN";
@@ -57,7 +58,7 @@ std::string UrlEncode(const absl::string_view& s) {
 RefCountedPtr<AwsExternalAccountCredentials>
 AwsExternalAccountCredentials::Create(Options options,
                                       std::vector<std::string> scopes,
-                                      grpc_error** error) {
+                                      grpc_error_handle* error) {
   auto creds = MakeRefCounted<AwsExternalAccountCredentials>(
       std::move(options), std::move(scopes), error);
   if (*error == GRPC_ERROR_NONE) {
@@ -68,7 +69,7 @@ AwsExternalAccountCredentials::Create(Options options,
 }
 
 AwsExternalAccountCredentials::AwsExternalAccountCredentials(
-    Options options, std::vector<std::string> scopes, grpc_error** error)
+    Options options, std::vector<std::string> scopes, grpc_error_handle* error)
     : ExternalAccountCredentials(options, std::move(scopes)) {
   audience_ = options.audience;
   auto it = options.credential_source.object_value().find("environment_id");
@@ -120,8 +121,8 @@ AwsExternalAccountCredentials::AwsExternalAccountCredentials(
 }
 
 void AwsExternalAccountCredentials::RetrieveSubjectToken(
-    HTTPRequestContext* ctx, const Options& options,
-    std::function<void(std::string, grpc_error*)> cb) {
+    HTTPRequestContext* ctx, const Options& /*options*/,
+    std::function<void(std::string, grpc_error_handle)> cb) {
   if (ctx == nullptr) {
     FinishRetrieveSubjectToken(
         "",
@@ -140,6 +141,9 @@ void AwsExternalAccountCredentials::RetrieveSubjectToken(
 
 void AwsExternalAccountCredentials::RetrieveRegion() {
   UniquePtr<char> region_from_env(gpr_getenv(kRegionEnvVar));
+  if (region_from_env == nullptr) {
+    region_from_env = UniquePtr<char>(gpr_getenv(kDefaultRegionEnvVar));
+  }
   if (region_from_env != nullptr) {
     region_ = std::string(region_from_env.get());
     if (url_.empty()) {
@@ -175,14 +179,14 @@ void AwsExternalAccountCredentials::RetrieveRegion() {
 }
 
 void AwsExternalAccountCredentials::OnRetrieveRegion(void* arg,
-                                                     grpc_error* error) {
+                                                     grpc_error_handle error) {
   AwsExternalAccountCredentials* self =
       static_cast<AwsExternalAccountCredentials*>(arg);
   self->OnRetrieveRegionInternal(GRPC_ERROR_REF(error));
 }
 
 void AwsExternalAccountCredentials::OnRetrieveRegionInternal(
-    grpc_error* error) {
+    grpc_error_handle error) {
   if (error != GRPC_ERROR_NONE) {
     FinishRetrieveSubjectToken("", error);
     return;
@@ -224,15 +228,15 @@ void AwsExternalAccountCredentials::RetrieveRoleName() {
   grpc_http_request_destroy(&request.http);
 }
 
-void AwsExternalAccountCredentials::OnRetrieveRoleName(void* arg,
-                                                       grpc_error* error) {
+void AwsExternalAccountCredentials::OnRetrieveRoleName(
+    void* arg, grpc_error_handle error) {
   AwsExternalAccountCredentials* self =
       static_cast<AwsExternalAccountCredentials*>(arg);
   self->OnRetrieveRoleNameInternal(GRPC_ERROR_REF(error));
 }
 
 void AwsExternalAccountCredentials::OnRetrieveRoleNameInternal(
-    grpc_error* error) {
+    grpc_error_handle error) {
   if (error != GRPC_ERROR_NONE) {
     FinishRetrieveSubjectToken("", error);
     return;
@@ -287,15 +291,15 @@ void AwsExternalAccountCredentials::RetrieveSigningKeys() {
   grpc_http_request_destroy(&request.http);
 }
 
-void AwsExternalAccountCredentials::OnRetrieveSigningKeys(void* arg,
-                                                          grpc_error* error) {
+void AwsExternalAccountCredentials::OnRetrieveSigningKeys(
+    void* arg, grpc_error_handle error) {
   AwsExternalAccountCredentials* self =
       static_cast<AwsExternalAccountCredentials*>(arg);
   self->OnRetrieveSigningKeysInternal(GRPC_ERROR_REF(error));
 }
 
 void AwsExternalAccountCredentials::OnRetrieveSigningKeysInternal(
-    grpc_error* error) {
+    grpc_error_handle error) {
   if (error != GRPC_ERROR_NONE) {
     FinishRetrieveSubjectToken("", error);
     return;
@@ -350,7 +354,7 @@ void AwsExternalAccountCredentials::OnRetrieveSigningKeysInternal(
 }
 
 void AwsExternalAccountCredentials::BuildSubjectToken() {
-  grpc_error* error = GRPC_ERROR_NONE;
+  grpc_error_handle error = GRPC_ERROR_NONE;
   if (signer_ == nullptr) {
     cred_verification_url_ = absl::StrReplaceAll(
         regional_cred_verification_url_, {{"{region}", region_}});
@@ -396,7 +400,7 @@ void AwsExternalAccountCredentials::BuildSubjectToken() {
 }
 
 void AwsExternalAccountCredentials::FinishRetrieveSubjectToken(
-    std::string subject_token, grpc_error* error) {
+    std::string subject_token, grpc_error_handle error) {
   // Reset context
   ctx_ = nullptr;
   // Move object state into local variables.

data/src/core/lib/security/credentials/external/aws_external_account_credentials.h

@@ -28,31 +28,33 @@ namespace grpc_core {
 class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
  public:
   static RefCountedPtr<AwsExternalAccountCredentials> Create(
-      Options options, std::vector<std::string> scopes, grpc_error** error);
+      Options options, std::vector<std::string> scopes,
+      grpc_error_handle* error);
 
   AwsExternalAccountCredentials(Options options,
                                 std::vector<std::string> scopes,
-                                grpc_error** error);
+                                grpc_error_handle* error);
 
  private:
   void RetrieveSubjectToken(
       HTTPRequestContext* ctx, const Options& options,
-      std::function<void(std::string, grpc_error*)> cb) override;
+      std::function<void(std::string, grpc_error_handle)> cb) override;
 
   void RetrieveRegion();
-  static void OnRetrieveRegion(void* arg, grpc_error* error);
-  void OnRetrieveRegionInternal(grpc_error* error);
+  static void OnRetrieveRegion(void* arg, grpc_error_handle error);
+  void OnRetrieveRegionInternal(grpc_error_handle error);
 
   void RetrieveRoleName();
-  static void OnRetrieveRoleName(void* arg, grpc_error* error);
-  void OnRetrieveRoleNameInternal(grpc_error* error);
+  static void OnRetrieveRoleName(void* arg, grpc_error_handle error);
+  void OnRetrieveRoleNameInternal(grpc_error_handle error);
 
   void RetrieveSigningKeys();
-  static void OnRetrieveSigningKeys(void* arg, grpc_error* error);
-  void OnRetrieveSigningKeysInternal(grpc_error* error);
+  static void OnRetrieveSigningKeys(void* arg, grpc_error_handle error);
+  void OnRetrieveSigningKeysInternal(grpc_error_handle error);
 
   void BuildSubjectToken();
-  void FinishRetrieveSubjectToken(std::string subject_token, grpc_error* error);
+  void FinishRetrieveSubjectToken(std::string subject_token,
+                                  grpc_error_handle error);
 
   std::string audience_;
 
@@ -72,7 +74,7 @@ class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
   std::string cred_verification_url_;
 
   HTTPRequestContext* ctx_ = nullptr;
-  std::function<void(std::string, grpc_error*)> cb_ = nullptr;
+  std::function<void(std::string, grpc_error_handle)> cb_ = nullptr;
 };
 
 }  // namespace grpc_core

data/src/core/lib/security/credentials/external/aws_request_signer.cc

@@ -66,7 +66,8 @@ AwsRequestSigner::AwsRequestSigner(
     std::string access_key_id, std::string secret_access_key, std::string token,
     std::string method, std::string url, std::string region,
     std::string request_payload,
-    std::map<std::string, std::string> additional_headers, grpc_error** error)
+    std::map<std::string, std::string> additional_headers,
+    grpc_error_handle* error)
     : access_key_id_(std::move(access_key_id)),
       secret_access_key_(std::move(secret_access_key)),
       token_(std::move(token)),

data/src/core/lib/security/credentials/external/aws_request_signer.h

@@ -45,7 +45,7 @@ class AwsRequestSigner {
                    std::string token, std::string method, std::string url,
                    std::string region, std::string request_payload,
                    std::map<std::string, std::string> additional_headers,
-                   grpc_error** error);
+                   grpc_error_handle* error);
 
   // This method triggers the signing process then returns the headers of the
   // signed request as a map. In case there is an error, the input `error`