grpc 1.42.0 → 1.46.3

data/src/core/lib/security/authorization/rbac_policy.cc

@@ -0,0 +1,442 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/rbac_policy.h"
+
+#include "absl/strings/str_format.h"
+#include "absl/strings/str_join.h"
+
+namespace grpc_core {
+
+//
+// Rbac
+//
+
+Rbac::Rbac(Rbac::Action action, std::map<std::string, Policy> policies)
+    : action(action), policies(std::move(policies)) {}
+
+Rbac::Rbac(Rbac&& other) noexcept
+    : action(other.action), policies(std::move(other.policies)) {}
+
+Rbac& Rbac::operator=(Rbac&& other) noexcept {
+  action = other.action;
+  policies = std::move(other.policies);
+  return *this;
+}
+
+std::string Rbac::ToString() const {
+  std::vector<std::string> contents;
+  contents.push_back(absl::StrFormat(
+      "Rbac action=%s{", action == Rbac::Action::kAllow ? "Allow" : "Deny"));
+  for (const auto& p : policies) {
+    contents.push_back(absl::StrFormat("{\n  policy_name=%s\n%s\n}", p.first,
+                                       p.second.ToString()));
+  }
+  contents.push_back("}");
+  return absl::StrJoin(contents, "\n");
+}
+
+//
+// CidrRange
+//
+
+Rbac::CidrRange::CidrRange(std::string address_prefix, uint32_t prefix_len)
+    : address_prefix(std::move(address_prefix)), prefix_len(prefix_len) {}
+
+Rbac::CidrRange::CidrRange(Rbac::CidrRange&& other) noexcept
+    : address_prefix(std::move(other.address_prefix)),
+      prefix_len(other.prefix_len) {}
+
+Rbac::CidrRange& Rbac::CidrRange::operator=(Rbac::CidrRange&& other) noexcept {
+  address_prefix = std::move(other.address_prefix);
+  prefix_len = other.prefix_len;
+  return *this;
+}
+
+std::string Rbac::CidrRange::ToString() const {
+  return absl::StrFormat("CidrRange{address_prefix=%s,prefix_len=%d}",
+                         address_prefix, prefix_len);
+}
+
+//
+// Permission
+//
+
+Rbac::Permission Rbac::Permission::MakeAndPermission(
+    std::vector<std::unique_ptr<Permission>> permissions) {
+  Permission permission;
+  permission.type = Permission::RuleType::kAnd;
+  permission.permissions = std::move(permissions);
+  return permission;
+}
+
+Rbac::Permission Rbac::Permission::MakeOrPermission(
+    std::vector<std::unique_ptr<Permission>> permissions) {
+  Permission permission;
+  permission.type = Permission::RuleType::kOr;
+  permission.permissions = std::move(permissions);
+  return permission;
+}
+
+Rbac::Permission Rbac::Permission::MakeNotPermission(Permission permission) {
+  Permission not_permission;
+  not_permission.type = Permission::RuleType::kNot;
+  not_permission.permissions.push_back(
+      absl::make_unique<Rbac::Permission>(std::move(permission)));
+  return not_permission;
+}
+
+Rbac::Permission Rbac::Permission::MakeAnyPermission() {
+  Permission permission;
+  permission.type = Permission::RuleType::kAny;
+  return permission;
+}
+
+Rbac::Permission Rbac::Permission::MakeHeaderPermission(
+    HeaderMatcher header_matcher) {
+  Permission permission;
+  permission.type = Permission::RuleType::kHeader;
+  permission.header_matcher = std::move(header_matcher);
+  return permission;
+}
+
+Rbac::Permission Rbac::Permission::MakePathPermission(
+    StringMatcher string_matcher) {
+  Permission permission;
+  permission.type = Permission::RuleType::kPath;
+  permission.string_matcher = std::move(string_matcher);
+  return permission;
+}
+
+Rbac::Permission Rbac::Permission::MakeDestIpPermission(CidrRange ip) {
+  Permission permission;
+  permission.type = Permission::RuleType::kDestIp;
+  permission.ip = std::move(ip);
+  return permission;
+}
+
+Rbac::Permission Rbac::Permission::MakeDestPortPermission(int port) {
+  Permission permission;
+  permission.type = Permission::RuleType::kDestPort;
+  permission.port = port;
+  return permission;
+}
+
+Rbac::Permission Rbac::Permission::MakeMetadataPermission(bool invert) {
+  Permission permission;
+  permission.type = Permission::RuleType::kMetadata;
+  permission.invert = invert;
+  return permission;
+}
+
+Rbac::Permission Rbac::Permission::MakeReqServerNamePermission(
+    StringMatcher string_matcher) {
+  Permission permission;
+  permission.type = Permission::RuleType::kReqServerName;
+  permission.string_matcher = std::move(string_matcher);
+  return permission;
+}
+
+Rbac::Permission::Permission(Rbac::Permission&& other) noexcept
+    : type(other.type), invert(other.invert) {
+  switch (type) {
+    case RuleType::kAnd:
+    case RuleType::kOr:
+    case RuleType::kNot:
+      permissions = std::move(other.permissions);
+      break;
+    case RuleType::kAny:
+      break;
+    case RuleType::kHeader:
+      header_matcher = std::move(other.header_matcher);
+      break;
+    case RuleType::kPath:
+    case RuleType::kReqServerName:
+      string_matcher = std::move(other.string_matcher);
+      break;
+    case RuleType::kDestIp:
+      ip = std::move(other.ip);
+      break;
+    default:
+      port = other.port;
+  }
+}
+
+Rbac::Permission& Rbac::Permission::operator=(
+    Rbac::Permission&& other) noexcept {
+  type = other.type;
+  invert = other.invert;
+  switch (type) {
+    case RuleType::kAnd:
+    case RuleType::kOr:
+    case RuleType::kNot:
+      permissions = std::move(other.permissions);
+      break;
+    case RuleType::kAny:
+      break;
+    case RuleType::kHeader:
+      header_matcher = std::move(other.header_matcher);
+      break;
+    case RuleType::kPath:
+    case RuleType::kReqServerName:
+      string_matcher = std::move(other.string_matcher);
+      break;
+    case RuleType::kDestIp:
+      ip = std::move(other.ip);
+      break;
+    default:
+      port = other.port;
+  }
+  return *this;
+}
+
+std::string Rbac::Permission::ToString() const {
+  switch (type) {
+    case RuleType::kAnd: {
+      std::vector<std::string> contents;
+      contents.reserve(permissions.size());
+      for (const auto& permission : permissions) {
+        contents.push_back(permission->ToString());
+      }
+      return absl::StrFormat("and=[%s]", absl::StrJoin(contents, ","));
+    }
+    case RuleType::kOr: {
+      std::vector<std::string> contents;
+      contents.reserve(permissions.size());
+      for (const auto& permission : permissions) {
+        contents.push_back(permission->ToString());
+      }
+      return absl::StrFormat("or=[%s]", absl::StrJoin(contents, ","));
+    }
+    case RuleType::kNot:
+      return absl::StrFormat("not %s", permissions[0]->ToString());
+    case RuleType::kAny:
+      return "any";
+    case RuleType::kHeader:
+      return absl::StrFormat("header=%s", header_matcher.ToString());
+    case RuleType::kPath:
+      return absl::StrFormat("path=%s", string_matcher.ToString());
+    case RuleType::kDestIp:
+      return absl::StrFormat("dest_ip=%s", ip.ToString());
+    case RuleType::kDestPort:
+      return absl::StrFormat("dest_port=%d", port);
+    case RuleType::kMetadata:
+      return absl::StrFormat("%smetadata", invert ? "invert " : "");
+    case RuleType::kReqServerName:
+      return absl::StrFormat("requested_server_name=%s",
+                             string_matcher.ToString());
+    default:
+      return "";
+  }
+}
+
+//
+// Principal
+//
+
+Rbac::Principal Rbac::Principal::MakeAndPrincipal(
+    std::vector<std::unique_ptr<Principal>> principals) {
+  Principal principal;
+  principal.type = Principal::RuleType::kAnd;
+  principal.principals = std::move(principals);
+  return principal;
+}
+
+Rbac::Principal Rbac::Principal::MakeOrPrincipal(
+    std::vector<std::unique_ptr<Principal>> principals) {
+  Principal principal;
+  principal.type = Principal::RuleType::kOr;
+  principal.principals = std::move(principals);
+  return principal;
+}
+
+Rbac::Principal Rbac::Principal::MakeNotPrincipal(Principal principal) {
+  Principal not_principal;
+  not_principal.type = Principal::RuleType::kNot;
+  not_principal.principals.push_back(
+      absl::make_unique<Rbac::Principal>(std::move(principal)));
+  return not_principal;
+}
+
+Rbac::Principal Rbac::Principal::MakeAnyPrincipal() {
+  Principal principal;
+  principal.type = Principal::RuleType::kAny;
+  return principal;
+}
+
+Rbac::Principal Rbac::Principal::MakeAuthenticatedPrincipal(
+    absl::optional<StringMatcher> string_matcher) {
+  Principal principal;
+  principal.type = Principal::RuleType::kPrincipalName;
+  principal.string_matcher = std::move(string_matcher);
+  return principal;
+}
+
+Rbac::Principal Rbac::Principal::MakeSourceIpPrincipal(CidrRange ip) {
+  Principal principal;
+  principal.type = Principal::RuleType::kSourceIp;
+  principal.ip = std::move(ip);
+  return principal;
+}
+
+Rbac::Principal Rbac::Principal::MakeDirectRemoteIpPrincipal(CidrRange ip) {
+  Principal principal;
+  principal.type = Principal::RuleType::kDirectRemoteIp;
+  principal.ip = std::move(ip);
+  return principal;
+}
+
+Rbac::Principal Rbac::Principal::MakeRemoteIpPrincipal(CidrRange ip) {
+  Principal principal;
+  principal.type = Principal::RuleType::kRemoteIp;
+  principal.ip = std::move(ip);
+  return principal;
+}
+
+Rbac::Principal Rbac::Principal::MakeHeaderPrincipal(
+    HeaderMatcher header_matcher) {
+  Principal principal;
+  principal.type = Principal::RuleType::kHeader;
+  principal.header_matcher = std::move(header_matcher);
+  return principal;
+}
+
+Rbac::Principal Rbac::Principal::MakePathPrincipal(
+    StringMatcher string_matcher) {
+  Principal principal;
+  principal.type = Principal::RuleType::kPath;
+  principal.string_matcher = std::move(string_matcher);
+  return principal;
+}
+
+Rbac::Principal Rbac::Principal::MakeMetadataPrincipal(bool invert) {
+  Principal principal;
+  principal.type = Principal::RuleType::kMetadata;
+  principal.invert = invert;
+  return principal;
+}
+
+Rbac::Principal::Principal(Rbac::Principal&& other) noexcept
+    : type(other.type), invert(other.invert) {
+  switch (type) {
+    case RuleType::kAnd:
+    case RuleType::kOr:
+    case RuleType::kNot:
+      principals = std::move(other.principals);
+      break;
+    case RuleType::kAny:
+      break;
+    case RuleType::kHeader:
+      header_matcher = std::move(other.header_matcher);
+      break;
+    case RuleType::kPrincipalName:
+    case RuleType::kPath:
+      string_matcher = std::move(other.string_matcher);
+      break;
+    default:
+      ip = std::move(other.ip);
+  }
+}
+
+Rbac::Principal& Rbac::Principal::operator=(Rbac::Principal&& other) noexcept {
+  type = other.type;
+  invert = other.invert;
+  switch (type) {
+    case RuleType::kAnd:
+    case RuleType::kOr:
+    case RuleType::kNot:
+      principals = std::move(other.principals);
+      break;
+    case RuleType::kAny:
+      break;
+    case RuleType::kHeader:
+      header_matcher = std::move(other.header_matcher);
+      break;
+    case RuleType::kPrincipalName:
+    case RuleType::kPath:
+      string_matcher = std::move(other.string_matcher);
+      break;
+    default:
+      ip = std::move(other.ip);
+  }
+  return *this;
+}
+
+std::string Rbac::Principal::ToString() const {
+  switch (type) {
+    case RuleType::kAnd: {
+      std::vector<std::string> contents;
+      contents.reserve(principals.size());
+      for (const auto& principal : principals) {
+        contents.push_back(principal->ToString());
+      }
+      return absl::StrFormat("and=[%s]", absl::StrJoin(contents, ","));
+    }
+    case RuleType::kOr: {
+      std::vector<std::string> contents;
+      contents.reserve(principals.size());
+      for (const auto& principal : principals) {
+        contents.push_back(principal->ToString());
+      }
+      return absl::StrFormat("or=[%s]", absl::StrJoin(contents, ","));
+    }
+    case RuleType::kNot:
+      return absl::StrFormat("not %s", principals[0]->ToString());
+    case RuleType::kAny:
+      return "any";
+    case RuleType::kPrincipalName:
+      return absl::StrFormat("principal_name=%s", string_matcher->ToString());
+    case RuleType::kSourceIp:
+      return absl::StrFormat("source_ip=%s", ip.ToString());
+    case RuleType::kDirectRemoteIp:
+      return absl::StrFormat("direct_remote_ip=%s", ip.ToString());
+    case RuleType::kRemoteIp:
+      return absl::StrFormat("remote_ip=%s", ip.ToString());
+    case RuleType::kHeader:
+      return absl::StrFormat("header=%s", header_matcher.ToString());
+    case RuleType::kPath:
+      return absl::StrFormat("path=%s", string_matcher->ToString());
+    case RuleType::kMetadata:
+      return absl::StrFormat("%smetadata", invert ? "invert " : "");
+    default:
+      return "";
+  }
+}
+
+//
+// Policy
+//
+
+Rbac::Policy::Policy(Permission permissions, Principal principals)
+    : permissions(std::move(permissions)), principals(std::move(principals)) {}
+
+Rbac::Policy::Policy(Rbac::Policy&& other) noexcept
+    : permissions(std::move(other.permissions)),
+      principals(std::move(other.principals)) {}
+
+Rbac::Policy& Rbac::Policy::operator=(Rbac::Policy&& other) noexcept {
+  permissions = std::move(other.permissions);
+  principals = std::move(other.principals);
+  return *this;
+}
+
+std::string Rbac::Policy::ToString() const {
+  return absl::StrFormat(
+      "  Policy  {\n    Permissions{%s}\n    Principals{%s}\n  }",
+      permissions.ToString(), principals.ToString());
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/authorization/rbac_policy.h

@@ -0,0 +1,171 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+
+#include "src/core/lib/matchers/matchers.h"
+
+namespace grpc_core {
+
+// Represents Envoy RBAC Proto. [See
+// https://github.com/envoyproxy/envoy/blob/release/v1.17/api/envoy/config/rbac/v3/rbac.proto]
+struct Rbac {
+  enum class Action {
+    kAllow,
+    kDeny,
+  };
+
+  struct CidrRange {
+    CidrRange() = default;
+    CidrRange(std::string address_prefix, uint32_t prefix_len);
+
+    CidrRange(CidrRange&& other) noexcept;
+    CidrRange& operator=(CidrRange&& other) noexcept;
+
+    std::string ToString() const;
+
+    std::string address_prefix;
+    uint32_t prefix_len;
+  };
+
+  // TODO(ashithasantosh): Support for destination_port_range.
+  struct Permission {
+    enum class RuleType {
+      kAnd,
+      kOr,
+      kNot,
+      kAny,
+      kHeader,
+      kPath,
+      kDestIp,
+      kDestPort,
+      kMetadata,
+      kReqServerName,
+    };
+
+    static Permission MakeAndPermission(
+        std::vector<std::unique_ptr<Permission>> permissions);
+    static Permission MakeOrPermission(
+        std::vector<std::unique_ptr<Permission>> permissions);
+    static Permission MakeNotPermission(Permission permission);
+    static Permission MakeAnyPermission();
+    static Permission MakeHeaderPermission(HeaderMatcher header_matcher);
+    static Permission MakePathPermission(StringMatcher string_matcher);
+    static Permission MakeDestIpPermission(CidrRange ip);
+    static Permission MakeDestPortPermission(int port);
+    // All the other fields in MetadataMatcher are ignored except invert.
+    static Permission MakeMetadataPermission(bool invert);
+    static Permission MakeReqServerNamePermission(StringMatcher string_matcher);
+
+    Permission() = default;
+
+    Permission(Permission&& other) noexcept;
+    Permission& operator=(Permission&& other) noexcept;
+
+    std::string ToString() const;
+
+    RuleType type = RuleType::kAnd;
+    HeaderMatcher header_matcher;
+    StringMatcher string_matcher;
+    CidrRange ip;
+    int port;
+    // For type kAnd/kOr/kNot. For kNot type, the vector will have only one
+    // element.
+    std::vector<std::unique_ptr<Permission>> permissions;
+    // For kMetadata
+    bool invert = false;
+  };
+
+  struct Principal {
+    enum class RuleType {
+      kAnd,
+      kOr,
+      kNot,
+      kAny,
+      kPrincipalName,
+      kSourceIp,
+      kDirectRemoteIp,
+      kRemoteIp,
+      kHeader,
+      kPath,
+      kMetadata,
+    };
+
+    static Principal MakeAndPrincipal(
+        std::vector<std::unique_ptr<Principal>> principals);
+    static Principal MakeOrPrincipal(
+        std::vector<std::unique_ptr<Principal>> principals);
+    static Principal MakeNotPrincipal(Principal principal);
+    static Principal MakeAnyPrincipal();
+    static Principal MakeAuthenticatedPrincipal(
+        absl::optional<StringMatcher> string_matcher);
+    static Principal MakeSourceIpPrincipal(CidrRange ip);
+    static Principal MakeDirectRemoteIpPrincipal(CidrRange ip);
+    static Principal MakeRemoteIpPrincipal(CidrRange ip);
+    static Principal MakeHeaderPrincipal(HeaderMatcher header_matcher);
+    static Principal MakePathPrincipal(StringMatcher string_matcher);
+    // All the other fields in MetadataMatcher are ignored except invert.
+    static Principal MakeMetadataPrincipal(bool invert);
+
+    Principal() = default;
+
+    Principal(Principal&& other) noexcept;
+    Principal& operator=(Principal&& other) noexcept;
+
+    std::string ToString() const;
+
+    RuleType type = RuleType::kAnd;
+    HeaderMatcher header_matcher;
+    absl::optional<StringMatcher> string_matcher;
+    CidrRange ip;
+    // For type kAnd/kOr/kNot. For kNot type, the vector will have only one
+    // element.
+    std::vector<std::unique_ptr<Principal>> principals;
+    // For kMetadata
+    bool invert = false;
+  };
+
+  struct Policy {
+    Policy() = default;
+    Policy(Permission permissions, Principal principals);
+
+    Policy(Policy&& other) noexcept;
+    Policy& operator=(Policy&& other) noexcept;
+
+    std::string ToString() const;
+
+    Permission permissions;
+    Principal principals;
+  };
+
+  Rbac() = default;
+  Rbac(Rbac::Action action, std::map<std::string, Policy> policies);
+
+  Rbac(Rbac&& other) noexcept;
+  Rbac& operator=(Rbac&& other) noexcept;
+
+  std::string ToString() const;
+
+  Action action;
+  std::map<std::string, Policy> policies;
+};
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H */

data/src/core/lib/security/context/security_context.cc

@@ -29,9 +29,9 @@
 
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/string.h"
-#include "src/core/lib/gprpp/arena.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/surface/call.h"
 
@@ -235,7 +235,9 @@ void grpc_auth_context::add_property(const char* name, const char* value,
   grpc_auth_property* prop = &properties_.array[properties_.count++];
   prop->name = gpr_strdup(name);
   prop->value = static_cast<char*>(gpr_malloc(value_length + 1));
-  memcpy(prop->value, value, value_length);
+  if (value != nullptr) {
+    memcpy(prop->value, value, value_length);
+  }
   prop->value[value_length] = '\0';
   prop->value_length = value_length;
 }

data/src/core/lib/security/context/security_context.h

@@ -21,10 +21,10 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/gprpp/arena.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/pollset.h"
+#include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/security/credentials/credentials.h"
 
 extern grpc_core::DebugOnlyTraceFlag grpc_trace_auth_context_refcount;
@@ -43,6 +43,8 @@ struct grpc_auth_property_array {
 
 void grpc_auth_property_reset(grpc_auth_property* property);
 
+#define GRPC_AUTH_CONTEXT_ARG "grpc.auth_context"
+
 // This type is forward declared as a C struct and we cannot define it as a
 // class. Otherwise, compiler will complain about type mismatch due to
 // -Wmismatched-tags.
@@ -73,6 +75,12 @@ struct grpc_auth_context
     }
   }
 
+  static absl::string_view ChannelArgName() { return GRPC_AUTH_CONTEXT_ARG; }
+  static int ChannelArgsCompare(const grpc_auth_context* a,
+                                const grpc_auth_context* b) {
+    return QsortCompare(a, b);
+  }
+
   const grpc_auth_context* chained() const { return chained_.get(); }
   const grpc_auth_property_array& properties() const { return properties_; }
 
@@ -142,7 +150,6 @@ grpc_server_security_context* grpc_server_security_context_create(
 void grpc_server_security_context_destroy(void* ctx);
 
 /* --- Channel args for auth context --- */
-#define GRPC_AUTH_CONTEXT_ARG "grpc.auth_context"
 
 grpc_arg grpc_auth_context_to_arg(grpc_auth_context* c);
 grpc_auth_context* grpc_auth_context_from_arg(const grpc_arg* arg);