grpc 1.43.1 → 1.44.0.pre2

data/src/core/tsi/ssl_transport_security.cc

@@ -35,6 +35,15 @@
 
 #include <string>
 
+#include <openssl/bio.h>
+#include <openssl/crypto.h> /* For OPENSSL_free */
+#include <openssl/engine.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+#include <openssl/tls1.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
 #include "absl/strings/match.h"
 #include "absl/strings/string_view.h"
 
@@ -45,17 +54,6 @@
 #include <grpc/support/sync.h>
 #include <grpc/support/thd_id.h>
 
-extern "C" {
-#include <openssl/bio.h>
-#include <openssl/crypto.h> /* For OPENSSL_free */
-#include <openssl/engine.h>
-#include <openssl/err.h>
-#include <openssl/ssl.h>
-#include <openssl/tls1.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-}
-
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/tsi/ssl/session_cache/ssl_session_cache.h"
 #include "src/core/tsi/ssl_types.h"
@@ -1923,6 +1921,14 @@ static int server_handshaker_factory_new_session_callback(
   return 1;
 }
 
+static int verify_cb(int ok, X509_STORE_CTX* ctx) {
+  int cert_error = X509_STORE_CTX_get_error(ctx);
+  if (cert_error != 0) {
+    gpr_log(GPR_ERROR, "Certificate verify failed with code %d", cert_error);
+  }
+  return ok;
+}
+
 /* --- tsi_ssl_handshaker_factory constructors. --- */
 
 static tsi_ssl_handshaker_factory_vtable client_handshaker_factory_vtable = {
@@ -2043,7 +2049,24 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
   } else {
     SSL_CTX_set_verify(ssl_context, SSL_VERIFY_PEER, nullptr);
   }
-  /* TODO(jboeuf): Add revocation verification. */
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000
+  if (options->crl_directory != nullptr &&
+      strcmp(options->crl_directory, "") != 0) {
+    gpr_log(GPR_INFO, "enabling client CRL checking with path: %s",
+            options->crl_directory);
+    X509_STORE* cert_store = SSL_CTX_get_cert_store(ssl_context);
+    X509_STORE_set_verify_cb(cert_store, verify_cb);
+    if (!X509_STORE_load_locations(cert_store, nullptr,
+                                   options->crl_directory)) {
+      gpr_log(GPR_ERROR, "Failed to load CRL File from directory.");
+    } else {
+      X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
+      X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
+      gpr_log(GPR_INFO, "enabled client side CRL checking.");
+    }
+  }
+#endif
 
   *factory = impl;
   return TSI_OK;
@@ -2205,7 +2228,24 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
                              nullptr);
           break;
       }
-      /* TODO(jboeuf): Add revocation verification. */
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000
+      if (options->crl_directory != nullptr &&
+          strcmp(options->crl_directory, "") != 0) {
+        gpr_log(GPR_INFO, "enabling server CRL checking with path %s",
+                options->crl_directory);
+        X509_STORE* cert_store = SSL_CTX_get_cert_store(impl->ssl_contexts[i]);
+        X509_STORE_set_verify_cb(cert_store, verify_cb);
+        if (!X509_STORE_load_locations(cert_store, nullptr,
+                                       options->crl_directory)) {
+          gpr_log(GPR_ERROR, "Failed to load CRL File from directory.");
+        } else {
+          X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
+          X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
+          gpr_log(GPR_INFO, "enabled server CRL checking.");
+        }
+      }
+#endif
 
       result = tsi_ssl_extract_x509_subject_names_from_pem_cert(
           options->pem_key_cert_pairs[i].cert_chain,

data/src/core/tsi/ssl_transport_security.h

@@ -21,16 +21,14 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <openssl/x509.h>
+
 #include "absl/strings/string_view.h"
 
 #include <grpc/grpc_security_constants.h>
 
 #include "src/core/tsi/transport_security_interface.h"
 
-extern "C" {
-#include <openssl/x509.h>
-}
-
 /* Value for the TSI_CERTIFICATE_TYPE_PEER_PROPERTY property for X509 certs. */
 #define TSI_X509_CERTIFICATE_TYPE "X509"
 
@@ -159,6 +157,12 @@ struct tsi_ssl_client_handshaker_options {
   tsi_tls_version min_tls_version;
   tsi_tls_version max_tls_version;
 
+  /* The directory where all hashed CRL files enforced by the handshaker are
+     located. If the directory is invalid, CRL checking will fail open and just
+     log. An empty directory will not enable crl checking. Only OpenSSL version
+     > 1.1 is supported for CRL checking*/
+  const char* crl_directory;
+
   tsi_ssl_client_handshaker_options()
       : pem_key_cert_pair(nullptr),
         pem_root_certs(nullptr),
@@ -169,7 +173,8 @@ struct tsi_ssl_client_handshaker_options {
         session_cache(nullptr),
         skip_server_certificate_verification(false),
         min_tls_version(tsi_tls_version::TSI_TLS1_2),
-        max_tls_version(tsi_tls_version::TSI_TLS1_3) {}
+        max_tls_version(tsi_tls_version::TSI_TLS1_3),
+        crl_directory(nullptr) {}
 };
 
 /* Creates a client handshaker factory.
@@ -289,6 +294,12 @@ struct tsi_ssl_server_handshaker_options {
   tsi_tls_version min_tls_version;
   tsi_tls_version max_tls_version;
 
+  /* The directory where all hashed CRL files are cached in the x.509 store and
+   * enforced by the handshaker are located. If the directory is invalid, CRL
+   * checking will fail open and just log. An empty directory will not enable
+   * crl checking. Only OpenSSL version > 1.1 is supported for CRL checking */
+  const char* crl_directory;
+
   tsi_ssl_server_handshaker_options()
       : pem_key_cert_pairs(nullptr),
         num_key_cert_pairs(0),
@@ -300,7 +311,8 @@ struct tsi_ssl_server_handshaker_options {
         session_ticket_key(nullptr),
         session_ticket_key_size(0),
         min_tls_version(tsi_tls_version::TSI_TLS1_2),
-        max_tls_version(tsi_tls_version::TSI_TLS1_3) {}
+        max_tls_version(tsi_tls_version::TSI_TLS1_3),
+        crl_directory(nullptr) {}
 };
 
 /* Creates a server handshaker factory.

data/src/ruby/ext/grpc/extconf.rb

@@ -60,7 +60,7 @@ end
 
 ENV['CPPFLAGS'] = '-DGPR_BACKWARDS_COMPATIBILITY_MODE'
 ENV['CPPFLAGS'] += ' -DGRPC_XDS_USER_AGENT_NAME_SUFFIX="\"RUBY\"" '
-ENV['CPPFLAGS'] += ' -DGRPC_XDS_USER_AGENT_VERSION_SUFFIX="\"1.43.1\"" '
+ENV['CPPFLAGS'] += ' -DGRPC_XDS_USER_AGENT_VERSION_SUFFIX="\"1.44.0.pre2\"" '
 
 output_dir = File.expand_path(RbConfig::CONFIG['topdir'])
 grpc_lib_dir = File.join(output_dir, 'libs', grpc_config)
@@ -69,9 +69,16 @@ ENV['BUILDDIR'] = output_dir
 unless windows
   puts 'Building internal gRPC into ' + grpc_lib_dir
   nproc = 4
-  nproc = Etc.nprocessors * 2 if Etc.respond_to? :nprocessors
+  nproc = Etc.nprocessors if Etc.respond_to? :nprocessors
+  nproc_override = ENV['GRPC_RUBY_BUILD_PROCS']
+  unless nproc_override.nil? or nproc_override.size == 0
+    nproc = nproc_override
+    puts "Overriding make parallelism to #{nproc}"
+  end
   make = bsd ? 'gmake' : 'make'
-  system("#{make} -j#{nproc} -C #{grpc_root} #{grpc_lib_dir}/libgrpc.a CONFIG=#{grpc_config} Q=")
+  cmd = "#{make} -j#{nproc} -C #{grpc_root} #{grpc_lib_dir}/libgrpc.a CONFIG=#{grpc_config} Q="
+  puts "Building grpc native library: #{cmd}"
+  system(cmd)
   exit 1 unless $? == 0
 end
 

data/src/ruby/ext/grpc/rb_grpc_imports.generated.c

@@ -178,6 +178,7 @@ grpc_tls_credentials_options_set_root_cert_name_type grpc_tls_credentials_option
 grpc_tls_credentials_options_watch_identity_key_cert_pairs_type grpc_tls_credentials_options_watch_identity_key_cert_pairs_import;
 grpc_tls_credentials_options_set_identity_cert_name_type grpc_tls_credentials_options_set_identity_cert_name_import;
 grpc_tls_credentials_options_set_cert_request_type_type grpc_tls_credentials_options_set_cert_request_type_import;
+grpc_tls_credentials_options_set_crl_directory_type grpc_tls_credentials_options_set_crl_directory_import;
 grpc_tls_credentials_options_set_verify_server_cert_type grpc_tls_credentials_options_set_verify_server_cert_import;
 grpc_tls_credentials_options_set_check_call_host_type grpc_tls_credentials_options_set_check_call_host_import;
 grpc_xds_credentials_create_type grpc_xds_credentials_create_import;
@@ -466,6 +467,7 @@ void grpc_rb_load_imports(HMODULE library) {
   grpc_tls_credentials_options_watch_identity_key_cert_pairs_import = (grpc_tls_credentials_options_watch_identity_key_cert_pairs_type) GetProcAddress(library, "grpc_tls_credentials_options_watch_identity_key_cert_pairs");
   grpc_tls_credentials_options_set_identity_cert_name_import = (grpc_tls_credentials_options_set_identity_cert_name_type) GetProcAddress(library, "grpc_tls_credentials_options_set_identity_cert_name");
   grpc_tls_credentials_options_set_cert_request_type_import = (grpc_tls_credentials_options_set_cert_request_type_type) GetProcAddress(library, "grpc_tls_credentials_options_set_cert_request_type");
+  grpc_tls_credentials_options_set_crl_directory_import = (grpc_tls_credentials_options_set_crl_directory_type) GetProcAddress(library, "grpc_tls_credentials_options_set_crl_directory");
   grpc_tls_credentials_options_set_verify_server_cert_import = (grpc_tls_credentials_options_set_verify_server_cert_type) GetProcAddress(library, "grpc_tls_credentials_options_set_verify_server_cert");
   grpc_tls_credentials_options_set_check_call_host_import = (grpc_tls_credentials_options_set_check_call_host_type) GetProcAddress(library, "grpc_tls_credentials_options_set_check_call_host");
   grpc_xds_credentials_create_import = (grpc_xds_credentials_create_type) GetProcAddress(library, "grpc_xds_credentials_create");

data/src/ruby/ext/grpc/rb_grpc_imports.generated.h

@@ -509,6 +509,9 @@ extern grpc_tls_credentials_options_set_identity_cert_name_type grpc_tls_credent
 typedef void(*grpc_tls_credentials_options_set_cert_request_type_type)(grpc_tls_credentials_options* options, grpc_ssl_client_certificate_request_type type);
 extern grpc_tls_credentials_options_set_cert_request_type_type grpc_tls_credentials_options_set_cert_request_type_import;
 #define grpc_tls_credentials_options_set_cert_request_type grpc_tls_credentials_options_set_cert_request_type_import
+typedef void(*grpc_tls_credentials_options_set_crl_directory_type)(grpc_tls_credentials_options* options, const char* crl_directory);
+extern grpc_tls_credentials_options_set_crl_directory_type grpc_tls_credentials_options_set_crl_directory_import;
+#define grpc_tls_credentials_options_set_crl_directory grpc_tls_credentials_options_set_crl_directory_import
 typedef void(*grpc_tls_credentials_options_set_verify_server_cert_type)(grpc_tls_credentials_options* options, int verify_server_cert);
 extern grpc_tls_credentials_options_set_verify_server_cert_type grpc_tls_credentials_options_set_verify_server_cert_import;
 #define grpc_tls_credentials_options_set_verify_server_cert grpc_tls_credentials_options_set_verify_server_cert_import

data/src/ruby/lib/grpc/version.rb

@@ -14,5 +14,5 @@
 
 # GRPC contains the General RPC module.
 module GRPC
-  VERSION = '1.43.1'
+  VERSION = '1.44.0.pre2'
 end

data/src/ruby/pb/src/proto/grpc/testing/test_pb.rb

@@ -1,9 +1,10 @@
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
 # source: src/proto/grpc/testing/test.proto
 
+require 'google/protobuf'
+
 require 'src/proto/grpc/testing/empty_pb'
 require 'src/proto/grpc/testing/messages_pb'
-require 'google/protobuf'
 
 Google::Protobuf::DescriptorPool.generated_pool.build do
   add_file("src/proto/grpc/testing/test.proto", :syntax => :proto3) do

data/third_party/abseil-cpp/absl/base/internal/fast_type_id.h

@@ -0,0 +1,48 @@
+//
+// Copyright 2020 The Abseil Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef ABSL_BASE_INTERNAL_FAST_TYPE_ID_H_
+#define ABSL_BASE_INTERNAL_FAST_TYPE_ID_H_
+
+#include "absl/base/config.h"
+
+namespace absl {
+ABSL_NAMESPACE_BEGIN
+namespace base_internal {
+
+template <typename Type>
+struct FastTypeTag {
+  constexpr static char dummy_var = 0;
+};
+
+template <typename Type>
+constexpr char FastTypeTag<Type>::dummy_var;
+
+// FastTypeId<Type>() evaluates at compile/link-time to a unique pointer for the
+// passed-in type. These are meant to be good match for keys into maps or
+// straight up comparisons.
+using FastTypeIdType = const void*;
+
+template <typename Type>
+constexpr inline FastTypeIdType FastTypeId() {
+  return &FastTypeTag<Type>::dummy_var;
+}
+
+}  // namespace base_internal
+ABSL_NAMESPACE_END
+}  // namespace absl
+
+#endif  // ABSL_BASE_INTERNAL_FAST_TYPE_ID_H_

data/third_party/abseil-cpp/absl/random/bernoulli_distribution.h

@@ -0,0 +1,200 @@
+// Copyright 2017 The Abseil Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef ABSL_RANDOM_BERNOULLI_DISTRIBUTION_H_
+#define ABSL_RANDOM_BERNOULLI_DISTRIBUTION_H_
+
+#include <cstdint>
+#include <istream>
+#include <limits>
+
+#include "absl/base/optimization.h"
+#include "absl/random/internal/fast_uniform_bits.h"
+#include "absl/random/internal/iostream_state_saver.h"
+
+namespace absl {
+ABSL_NAMESPACE_BEGIN
+
+// absl::bernoulli_distribution is a drop in replacement for
+// std::bernoulli_distribution. It guarantees that (given a perfect
+// UniformRandomBitGenerator) the acceptance probability is *exactly* equal to
+// the given double.
+//
+// The implementation assumes that double is IEEE754
+class bernoulli_distribution {
+ public:
+  using result_type = bool;
+
+  class param_type {
+   public:
+    using distribution_type = bernoulli_distribution;
+
+    explicit param_type(double p = 0.5) : prob_(p) {
+      assert(p >= 0.0 && p <= 1.0);
+    }
+
+    double p() const { return prob_; }
+
+    friend bool operator==(const param_type& p1, const param_type& p2) {
+      return p1.p() == p2.p();
+    }
+    friend bool operator!=(const param_type& p1, const param_type& p2) {
+      return p1.p() != p2.p();
+    }
+
+   private:
+    double prob_;
+  };
+
+  bernoulli_distribution() : bernoulli_distribution(0.5) {}
+
+  explicit bernoulli_distribution(double p) : param_(p) {}
+
+  explicit bernoulli_distribution(param_type p) : param_(p) {}
+
+  // no-op
+  void reset() {}
+
+  template <typename URBG>
+  bool operator()(URBG& g) {  // NOLINT(runtime/references)
+    return Generate(param_.p(), g);
+  }
+
+  template <typename URBG>
+  bool operator()(URBG& g,  // NOLINT(runtime/references)
+                  const param_type& param) {
+    return Generate(param.p(), g);
+  }
+
+  param_type param() const { return param_; }
+  void param(const param_type& param) { param_ = param; }
+
+  double p() const { return param_.p(); }
+
+  result_type(min)() const { return false; }
+  result_type(max)() const { return true; }
+
+  friend bool operator==(const bernoulli_distribution& d1,
+                         const bernoulli_distribution& d2) {
+    return d1.param_ == d2.param_;
+  }
+
+  friend bool operator!=(const bernoulli_distribution& d1,
+                         const bernoulli_distribution& d2) {
+    return d1.param_ != d2.param_;
+  }
+
+ private:
+  static constexpr uint64_t kP32 = static_cast<uint64_t>(1) << 32;
+
+  template <typename URBG>
+  static bool Generate(double p, URBG& g);  // NOLINT(runtime/references)
+
+  param_type param_;
+};
+
+template <typename CharT, typename Traits>
+std::basic_ostream<CharT, Traits>& operator<<(
+    std::basic_ostream<CharT, Traits>& os,  // NOLINT(runtime/references)
+    const bernoulli_distribution& x) {
+  auto saver = random_internal::make_ostream_state_saver(os);
+  os.precision(random_internal::stream_precision_helper<double>::kPrecision);
+  os << x.p();
+  return os;
+}
+
+template <typename CharT, typename Traits>
+std::basic_istream<CharT, Traits>& operator>>(
+    std::basic_istream<CharT, Traits>& is,  // NOLINT(runtime/references)
+    bernoulli_distribution& x) {            // NOLINT(runtime/references)
+  auto saver = random_internal::make_istream_state_saver(is);
+  auto p = random_internal::read_floating_point<double>(is);
+  if (!is.fail()) {
+    x.param(bernoulli_distribution::param_type(p));
+  }
+  return is;
+}
+
+template <typename URBG>
+bool bernoulli_distribution::Generate(double p,
+                                      URBG& g) {  // NOLINT(runtime/references)
+  random_internal::FastUniformBits<uint32_t> fast_u32;
+
+  while (true) {
+    // There are two aspects of the definition of `c` below that are worth
+    // commenting on.  First, because `p` is in the range [0, 1], `c` is in the
+    // range [0, 2^32] which does not fit in a uint32_t and therefore requires
+    // 64 bits.
+    //
+    // Second, `c` is constructed by first casting explicitly to a signed
+    // integer and then converting implicitly to an unsigned integer of the same
+    // size.  This is done because the hardware conversion instructions produce
+    // signed integers from double; if taken as a uint64_t the conversion would
+    // be wrong for doubles greater than 2^63 (not relevant in this use-case).
+    // If converted directly to an unsigned integer, the compiler would end up
+    // emitting code to handle such large values that are not relevant due to
+    // the known bounds on `c`.  To avoid these extra instructions this
+    // implementation converts first to the signed type and then use the
+    // implicit conversion to unsigned (which is a no-op).
+    const uint64_t c = static_cast<int64_t>(p * kP32);
+    const uint32_t v = fast_u32(g);
+    // FAST PATH: this path fails with probability 1/2^32.  Note that simply
+    // returning v <= c would approximate P very well (up to an absolute error
+    // of 1/2^32); the slow path (taken in that range of possible error, in the
+    // case of equality) eliminates the remaining error.
+    if (ABSL_PREDICT_TRUE(v != c)) return v < c;
+
+    // It is guaranteed that `q` is strictly less than 1, because if `q` were
+    // greater than or equal to 1, the same would be true for `p`. Certainly `p`
+    // cannot be greater than 1, and if `p == 1`, then the fast path would
+    // necessary have been taken already.
+    const double q = static_cast<double>(c) / kP32;
+
+    // The probability of acceptance on the fast path is `q` and so the
+    // probability of acceptance here should be `p - q`.
+    //
+    // Note that `q` is obtained from `p` via some shifts and conversions, the
+    // upshot of which is that `q` is simply `p` with some of the
+    // least-significant bits of its mantissa set to zero. This means that the
+    // difference `p - q` will not have any rounding errors. To see why, pretend
+    // that double has 10 bits of resolution and q is obtained from `p` in such
+    // a way that the 4 least-significant bits of its mantissa are set to zero.
+    // For example:
+    //   p   = 1.1100111011 * 2^-1
+    //   q   = 1.1100110000 * 2^-1
+    // p - q = 1.011        * 2^-8
+    // The difference `p - q` has exactly the nonzero mantissa bits that were
+    // "lost" in `q` producing a number which is certainly representable in a
+    // double.
+    const double left = p - q;
+
+    // By construction, the probability of being on this slow path is 1/2^32, so
+    // P(accept in slow path) = P(accept| in slow path) * P(slow path),
+    // which means the probability of acceptance here is `1 / (left * kP32)`:
+    const double here = left * kP32;
+
+    // The simplest way to compute the result of this trial is to repeat the
+    // whole algorithm with the new probability. This terminates because even
+    // given  arbitrarily unfriendly "random" bits, each iteration either
+    // multiplies a tiny probability by 2^32 (if c == 0) or strips off some
+    // number of nonzero mantissa bits. That process is bounded.
+    if (here == 0) return false;
+    p = here;
+  }
+}
+
+ABSL_NAMESPACE_END
+}  // namespace absl
+
+#endif  // ABSL_RANDOM_BERNOULLI_DISTRIBUTION_H_