grpc 1.38.0 → 1.40.0

data/src/core/lib/matchers/matchers.h

@@ -39,6 +39,7 @@ class StringMatcher {
   };
 
   // Creates StringMatcher instance. Returns error status on failure.
+  // Note: case_sensitive is ignored for type kSafeRegex.
   static absl::StatusOr<StringMatcher> Create(Type type,
                                               absl::string_view matcher,
                                               bool case_sensitive = true);
@@ -66,7 +67,7 @@ class StringMatcher {
 
  private:
   StringMatcher(Type type, absl::string_view matcher, bool case_sensitive);
-  StringMatcher(std::unique_ptr<RE2> regex_matcher, bool case_sensitive);
+  explicit StringMatcher(std::unique_ptr<RE2> regex_matcher);
 
   Type type_ = Type::kExact;
   std::string string_matcher_;

data/src/core/lib/security/authorization/authorization_engine.h

@@ -0,0 +1,44 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H
+
+#include <grpc/support/port_platform.h>
+
+#include <string>
+
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/security/authorization/evaluate_args.h"
+
+namespace grpc_core {
+
+// Interface for gRPC Authorization Engine.
+class AuthorizationEngine : public RefCounted<AuthorizationEngine> {
+ public:
+  struct Decision {
+    enum class Type {
+      kAllow,
+      kDeny,
+    };
+    Type type;
+    std::string matching_policy_name;
+  };
+
+  virtual Decision Evaluate(const EvaluateArgs& args) const = 0;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H

data/src/core/lib/security/authorization/authorization_policy_provider.h

@@ -0,0 +1,32 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_POLICY_PROVIDER_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_POLICY_PROVIDER_H
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/gprpp/dual_ref_counted.h"
+#include "src/core/lib/security/authorization/authorization_engine.h"
+
+struct grpc_authorization_policy_provider
+    : public grpc_core::DualRefCounted<grpc_authorization_policy_provider> {
+ public:
+  virtual grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine>
+  allow_engine() const = 0;
+  virtual grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine> deny_engine()
+      const = 0;
+};
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_POLICY_PROVIDER_H

data/src/core/lib/security/authorization/authorization_policy_provider_vtable.cc

@@ -0,0 +1,46 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc.h>
+
+#include "src/core/lib/security/authorization/authorization_policy_provider.h"
+
+namespace {
+
+void* ProviderArgCopy(void* p) {
+  grpc_authorization_policy_provider* provider =
+      static_cast<grpc_authorization_policy_provider*>(p);
+  provider->Ref().release();
+  return provider;
+}
+
+void ProviderArgDestroy(void* p) {
+  grpc_authorization_policy_provider* provider =
+      static_cast<grpc_authorization_policy_provider*>(p);
+  provider->Unref();
+}
+
+int ProviderArgCmp(void* p, void* q) { return GPR_ICMP(p, q); }
+
+}  // namespace
+
+// Wrapper API declared in grpc.h
+
+const grpc_arg_pointer_vtable* grpc_authorization_policy_provider_arg_vtable() {
+  static const grpc_arg_pointer_vtable vtable = {
+      ProviderArgCopy, ProviderArgDestroy, ProviderArgCmp};
+  return &vtable;
+}

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -0,0 +1,209 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/evaluate_args.h"
+
+#include "src/core/lib/address_utils/parse_address.h"
+#include "src/core/lib/address_utils/sockaddr_utils.h"
+#include "src/core/lib/gprpp/host_port.h"
+#include "src/core/lib/security/credentials/tls/tls_utils.h"
+#include "src/core/lib/slice/slice_utils.h"
+
+namespace grpc_core {
+
+namespace {
+
+EvaluateArgs::PerChannelArgs::Address ParseEndpointUri(
+    absl::string_view uri_text) {
+  EvaluateArgs::PerChannelArgs::Address address;
+  absl::StatusOr<URI> uri = URI::Parse(uri_text);
+  if (!uri.ok()) {
+    gpr_log(GPR_DEBUG, "Failed to parse uri.");
+    return address;
+  }
+  absl::string_view host_view;
+  absl::string_view port_view;
+  if (!SplitHostPort(uri->path(), &host_view, &port_view)) {
+    gpr_log(GPR_DEBUG, "Failed to split %s into host and port.",
+            uri->path().c_str());
+    return address;
+  }
+  if (!absl::SimpleAtoi(port_view, &address.port)) {
+    gpr_log(GPR_DEBUG, "Port %s is out of range or null.",
+            std::string(port_view).c_str());
+  }
+  address.address_str = std::string(host_view);
+  grpc_error_handle error = grpc_string_to_sockaddr(
+      &address.address, address.address_str.c_str(), address.port);
+  if (error != GRPC_ERROR_NONE) {
+    gpr_log(GPR_DEBUG, "Address %s is not IPv4/IPv6. Error: %s",
+            address.address_str.c_str(), grpc_error_std_string(error).c_str());
+  }
+  GRPC_ERROR_UNREF(error);
+  return address;
+}
+
+}  // namespace
+
+EvaluateArgs::PerChannelArgs::PerChannelArgs(grpc_auth_context* auth_context,
+                                             grpc_endpoint* endpoint) {
+  if (auth_context != nullptr) {
+    transport_security_type = GetAuthPropertyValue(
+        auth_context, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME);
+    spiffe_id =
+        GetAuthPropertyValue(auth_context, GRPC_PEER_SPIFFE_ID_PROPERTY_NAME);
+    uri_sans = GetAuthPropertyArray(auth_context, GRPC_PEER_URI_PROPERTY_NAME);
+    dns_sans = GetAuthPropertyArray(auth_context, GRPC_PEER_DNS_PROPERTY_NAME);
+    common_name =
+        GetAuthPropertyValue(auth_context, GRPC_X509_CN_PROPERTY_NAME);
+  }
+  if (endpoint != nullptr) {
+    local_address = ParseEndpointUri(grpc_endpoint_get_local_address(endpoint));
+    peer_address = ParseEndpointUri(grpc_endpoint_get_peer(endpoint));
+  }
+}
+
+absl::string_view EvaluateArgs::GetPath() const {
+  absl::string_view path;
+  if (metadata_ != nullptr && metadata_->idx.named.path != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->idx.named.path;
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    path = StringViewFromSlice(val);
+  }
+  return path;
+}
+
+absl::string_view EvaluateArgs::GetHost() const {
+  absl::string_view host;
+  if (metadata_ != nullptr && metadata_->idx.named.host != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->idx.named.host;
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    host = StringViewFromSlice(val);
+  }
+  return host;
+}
+
+absl::string_view EvaluateArgs::GetMethod() const {
+  absl::string_view method;
+  if (metadata_ != nullptr && metadata_->idx.named.method != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->idx.named.method;
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    method = StringViewFromSlice(val);
+  }
+  return method;
+}
+
+std::multimap<absl::string_view, absl::string_view> EvaluateArgs::GetHeaders()
+    const {
+  std::multimap<absl::string_view, absl::string_view> headers;
+  if (metadata_ == nullptr) {
+    return headers;
+  }
+  for (grpc_linked_mdelem* elem = metadata_->list.head; elem != nullptr;
+       elem = elem->next) {
+    const grpc_slice& key = GRPC_MDKEY(elem->md);
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    headers.emplace(StringViewFromSlice(key), StringViewFromSlice(val));
+  }
+  return headers;
+}
+
+absl::optional<absl::string_view> EvaluateArgs::GetHeaderValue(
+    absl::string_view key, std::string* concatenated_value) const {
+  if (metadata_ == nullptr) {
+    return absl::nullopt;
+  }
+  return grpc_metadata_batch_get_value(metadata_, key, concatenated_value);
+}
+
+grpc_resolved_address EvaluateArgs::GetLocalAddress() const {
+  if (channel_args_ == nullptr) {
+    return {};
+  }
+  return channel_args_->local_address.address;
+}
+
+absl::string_view EvaluateArgs::GetLocalAddressString() const {
+  if (channel_args_ == nullptr) {
+    return "";
+  }
+  return channel_args_->local_address.address_str;
+}
+
+int EvaluateArgs::GetLocalPort() const {
+  if (channel_args_ == nullptr) {
+    return 0;
+  }
+  return channel_args_->local_address.port;
+}
+
+grpc_resolved_address EvaluateArgs::GetPeerAddress() const {
+  if (channel_args_ == nullptr) {
+    return {};
+  }
+  return channel_args_->peer_address.address;
+}
+
+absl::string_view EvaluateArgs::GetPeerAddressString() const {
+  if (channel_args_ == nullptr) {
+    return "";
+  }
+  return channel_args_->peer_address.address_str;
+}
+
+int EvaluateArgs::GetPeerPort() const {
+  if (channel_args_ == nullptr) {
+    return 0;
+  }
+  return channel_args_->peer_address.port;
+}
+
+absl::string_view EvaluateArgs::GetTransportSecurityType() const {
+  if (channel_args_ == nullptr) {
+    return "";
+  }
+  return channel_args_->transport_security_type;
+}
+
+absl::string_view EvaluateArgs::GetSpiffeId() const {
+  if (channel_args_ == nullptr) {
+    return "";
+  }
+  return channel_args_->spiffe_id;
+}
+
+std::vector<absl::string_view> EvaluateArgs::GetUriSans() const {
+  if (channel_args_ == nullptr) {
+    return {};
+  }
+  return channel_args_->uri_sans;
+}
+
+std::vector<absl::string_view> EvaluateArgs::GetDnsSans() const {
+  if (channel_args_ == nullptr) {
+    return {};
+  }
+  return channel_args_->dns_sans;
+}
+
+absl::string_view EvaluateArgs::GetCommonName() const {
+  if (channel_args_ == nullptr) {
+    return "";
+  }
+  return channel_args_->common_name;
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/authorization/evaluate_args.h

@@ -0,0 +1,91 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <map>
+
+#include "absl/types/optional.h"
+
+#include "src/core/lib/iomgr/endpoint.h"
+#include "src/core/lib/iomgr/resolve_address.h"
+#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/transport/metadata_batch.h"
+
+namespace grpc_core {
+
+class EvaluateArgs {
+ public:
+  // Caller is responsible for ensuring auth_context outlives PerChannelArgs
+  // struct.
+  struct PerChannelArgs {
+    struct Address {
+      // The address in sockaddr form.
+      grpc_resolved_address address;
+      // The same address with only the host part.
+      std::string address_str;
+      int port = 0;
+    };
+
+    PerChannelArgs(grpc_auth_context* auth_context, grpc_endpoint* endpoint);
+
+    absl::string_view transport_security_type;
+    absl::string_view spiffe_id;
+    std::vector<absl::string_view> uri_sans;
+    std::vector<absl::string_view> dns_sans;
+    absl::string_view common_name;
+    Address local_address;
+    Address peer_address;
+  };
+
+  EvaluateArgs(grpc_metadata_batch* metadata, PerChannelArgs* channel_args)
+      : metadata_(metadata), channel_args_(channel_args) {}
+
+  absl::string_view GetPath() const;
+  absl::string_view GetHost() const;
+  absl::string_view GetMethod() const;
+  std::multimap<absl::string_view, absl::string_view> GetHeaders() const;
+  // Returns metadata value(s) for the specified key.
+  // If the key is not present in the batch, returns absl::nullopt.
+  // If the key is present exactly once in the batch, returns a string_view of
+  // that value.
+  // If the key is present more than once in the batch, constructs a
+  // comma-concatenated string of all values in concatenated_value and returns a
+  // string_view of that string.
+  absl::optional<absl::string_view> GetHeaderValue(
+      absl::string_view key, std::string* concatenated_value) const;
+
+  grpc_resolved_address GetLocalAddress() const;
+  absl::string_view GetLocalAddressString() const;
+  int GetLocalPort() const;
+  grpc_resolved_address GetPeerAddress() const;
+  absl::string_view GetPeerAddressString() const;
+  int GetPeerPort() const;
+  absl::string_view GetTransportSecurityType() const;
+  absl::string_view GetSpiffeId() const;
+  std::vector<absl::string_view> GetUriSans() const;
+  std::vector<absl::string_view> GetDnsSans() const;
+  absl::string_view GetCommonName() const;
+
+ private:
+  grpc_metadata_batch* metadata_;
+  PerChannelArgs* channel_args_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -22,6 +22,8 @@
 
 #include <string.h>
 
+#include "absl/strings/match.h"
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/sync.h>
@@ -91,7 +93,7 @@ grpc_google_default_channel_credentials::create_security_connector(
   const char* xds_cluster =
       grpc_channel_args_find_string(args, GRPC_ARG_XDS_CLUSTER_NAME);
   const bool is_xds_non_cfe_cluster =
-      xds_cluster != nullptr && strcmp(xds_cluster, "google_cfe") != 0;
+      xds_cluster != nullptr && !absl::StartsWith(xds_cluster, "google_cfe_");
   const bool use_alts = is_grpclb_load_balancer ||
                         is_backend_from_grpclb_load_balancer ||
                         is_xds_non_cfe_cluster;