grpc 1.43.1 → 1.46.2

data/src/core/lib/security/authorization/rbac_policy.h

@@ -0,0 +1,171 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+
+#include "src/core/lib/matchers/matchers.h"
+
+namespace grpc_core {
+
+// Represents Envoy RBAC Proto. [See
+// https://github.com/envoyproxy/envoy/blob/release/v1.17/api/envoy/config/rbac/v3/rbac.proto]
+struct Rbac {
+  enum class Action {
+    kAllow,
+    kDeny,
+  };
+
+  struct CidrRange {
+    CidrRange() = default;
+    CidrRange(std::string address_prefix, uint32_t prefix_len);
+
+    CidrRange(CidrRange&& other) noexcept;
+    CidrRange& operator=(CidrRange&& other) noexcept;
+
+    std::string ToString() const;
+
+    std::string address_prefix;
+    uint32_t prefix_len;
+  };
+
+  // TODO(ashithasantosh): Support for destination_port_range.
+  struct Permission {
+    enum class RuleType {
+      kAnd,
+      kOr,
+      kNot,
+      kAny,
+      kHeader,
+      kPath,
+      kDestIp,
+      kDestPort,
+      kMetadata,
+      kReqServerName,
+    };
+
+    static Permission MakeAndPermission(
+        std::vector<std::unique_ptr<Permission>> permissions);
+    static Permission MakeOrPermission(
+        std::vector<std::unique_ptr<Permission>> permissions);
+    static Permission MakeNotPermission(Permission permission);
+    static Permission MakeAnyPermission();
+    static Permission MakeHeaderPermission(HeaderMatcher header_matcher);
+    static Permission MakePathPermission(StringMatcher string_matcher);
+    static Permission MakeDestIpPermission(CidrRange ip);
+    static Permission MakeDestPortPermission(int port);
+    // All the other fields in MetadataMatcher are ignored except invert.
+    static Permission MakeMetadataPermission(bool invert);
+    static Permission MakeReqServerNamePermission(StringMatcher string_matcher);
+
+    Permission() = default;
+
+    Permission(Permission&& other) noexcept;
+    Permission& operator=(Permission&& other) noexcept;
+
+    std::string ToString() const;
+
+    RuleType type = RuleType::kAnd;
+    HeaderMatcher header_matcher;
+    StringMatcher string_matcher;
+    CidrRange ip;
+    int port;
+    // For type kAnd/kOr/kNot. For kNot type, the vector will have only one
+    // element.
+    std::vector<std::unique_ptr<Permission>> permissions;
+    // For kMetadata
+    bool invert = false;
+  };
+
+  struct Principal {
+    enum class RuleType {
+      kAnd,
+      kOr,
+      kNot,
+      kAny,
+      kPrincipalName,
+      kSourceIp,
+      kDirectRemoteIp,
+      kRemoteIp,
+      kHeader,
+      kPath,
+      kMetadata,
+    };
+
+    static Principal MakeAndPrincipal(
+        std::vector<std::unique_ptr<Principal>> principals);
+    static Principal MakeOrPrincipal(
+        std::vector<std::unique_ptr<Principal>> principals);
+    static Principal MakeNotPrincipal(Principal principal);
+    static Principal MakeAnyPrincipal();
+    static Principal MakeAuthenticatedPrincipal(
+        absl::optional<StringMatcher> string_matcher);
+    static Principal MakeSourceIpPrincipal(CidrRange ip);
+    static Principal MakeDirectRemoteIpPrincipal(CidrRange ip);
+    static Principal MakeRemoteIpPrincipal(CidrRange ip);
+    static Principal MakeHeaderPrincipal(HeaderMatcher header_matcher);
+    static Principal MakePathPrincipal(StringMatcher string_matcher);
+    // All the other fields in MetadataMatcher are ignored except invert.
+    static Principal MakeMetadataPrincipal(bool invert);
+
+    Principal() = default;
+
+    Principal(Principal&& other) noexcept;
+    Principal& operator=(Principal&& other) noexcept;
+
+    std::string ToString() const;
+
+    RuleType type = RuleType::kAnd;
+    HeaderMatcher header_matcher;
+    absl::optional<StringMatcher> string_matcher;
+    CidrRange ip;
+    // For type kAnd/kOr/kNot. For kNot type, the vector will have only one
+    // element.
+    std::vector<std::unique_ptr<Principal>> principals;
+    // For kMetadata
+    bool invert = false;
+  };
+
+  struct Policy {
+    Policy() = default;
+    Policy(Permission permissions, Principal principals);
+
+    Policy(Policy&& other) noexcept;
+    Policy& operator=(Policy&& other) noexcept;
+
+    std::string ToString() const;
+
+    Permission permissions;
+    Principal principals;
+  };
+
+  Rbac() = default;
+  Rbac(Rbac::Action action, std::map<std::string, Policy> policies);
+
+  Rbac(Rbac&& other) noexcept;
+  Rbac& operator=(Rbac&& other) noexcept;
+
+  std::string ToString() const;
+
+  Action action;
+  std::map<std::string, Policy> policies;
+};
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H */

data/src/core/lib/security/context/security_context.cc

@@ -29,9 +29,9 @@
 
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/string.h"
-#include "src/core/lib/gprpp/arena.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/surface/call.h"
 
@@ -235,7 +235,9 @@ void grpc_auth_context::add_property(const char* name, const char* value,
   grpc_auth_property* prop = &properties_.array[properties_.count++];
   prop->name = gpr_strdup(name);
   prop->value = static_cast<char*>(gpr_malloc(value_length + 1));
-  memcpy(prop->value, value, value_length);
+  if (value != nullptr) {
+    memcpy(prop->value, value, value_length);
+  }
   prop->value[value_length] = '\0';
   prop->value_length = value_length;
 }

data/src/core/lib/security/context/security_context.h

@@ -21,10 +21,10 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/gprpp/arena.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/pollset.h"
+#include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/security/credentials/credentials.h"
 
 extern grpc_core::DebugOnlyTraceFlag grpc_trace_auth_context_refcount;
@@ -43,6 +43,8 @@ struct grpc_auth_property_array {
 
 void grpc_auth_property_reset(grpc_auth_property* property);
 
+#define GRPC_AUTH_CONTEXT_ARG "grpc.auth_context"
+
 // This type is forward declared as a C struct and we cannot define it as a
 // class. Otherwise, compiler will complain about type mismatch due to
 // -Wmismatched-tags.
@@ -73,6 +75,12 @@ struct grpc_auth_context
     }
   }
 
+  static absl::string_view ChannelArgName() { return GRPC_AUTH_CONTEXT_ARG; }
+  static int ChannelArgsCompare(const grpc_auth_context* a,
+                                const grpc_auth_context* b) {
+    return QsortCompare(a, b);
+  }
+
   const grpc_auth_context* chained() const { return chained_.get(); }
   const grpc_auth_property_array& properties() const { return properties_; }
 
@@ -142,7 +150,6 @@ grpc_server_security_context* grpc_server_security_context_create(
 void grpc_server_security_context_destroy(void* ctx);
 
 /* --- Channel args for auth context --- */
-#define GRPC_AUTH_CONTEXT_ARG "grpc.auth_context"
 
 grpc_arg grpc_auth_context_to_arg(grpc_auth_context* c);
 grpc_auth_context* grpc_auth_context_from_arg(const grpc_arg* arg);

data/src/core/lib/security/credentials/alts/alts_credentials.cc

@@ -30,14 +30,12 @@
 #include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
 #include "src/core/lib/security/security_connector/alts/alts_security_connector.h"
 
-#define GRPC_CREDENTIALS_TYPE_ALTS "Alts"
 #define GRPC_ALTS_HANDSHAKER_SERVICE_URL "metadata.google.internal.:8080"
 
 grpc_alts_credentials::grpc_alts_credentials(
     const grpc_alts_credentials_options* options,
     const char* handshaker_service_url)
-    : grpc_channel_credentials(GRPC_CREDENTIALS_TYPE_ALTS),
-      options_(grpc_alts_credentials_options_copy(options)),
+    : options_(grpc_alts_credentials_options_copy(options)),
       handshaker_service_url_(handshaker_service_url == nullptr
                                   ? gpr_strdup(GRPC_ALTS_HANDSHAKER_SERVICE_URL)
                                   : gpr_strdup(handshaker_service_url)) {
@@ -58,11 +56,12 @@ grpc_alts_credentials::create_security_connector(
       this->Ref(), std::move(call_creds), target_name);
 }
 
+const char* grpc_alts_credentials::type() const { return "Alts"; }
+
 grpc_alts_server_credentials::grpc_alts_server_credentials(
     const grpc_alts_credentials_options* options,
     const char* handshaker_service_url)
-    : grpc_server_credentials(GRPC_CREDENTIALS_TYPE_ALTS),
-      options_(grpc_alts_credentials_options_copy(options)),
+    : options_(grpc_alts_credentials_options_copy(options)),
       handshaker_service_url_(handshaker_service_url == nullptr
                                   ? gpr_strdup(GRPC_ALTS_HANDSHAKER_SERVICE_URL)
                                   : gpr_strdup(handshaker_service_url)) {
@@ -80,6 +79,8 @@ grpc_alts_server_credentials::~grpc_alts_server_credentials() {
   gpr_free(handshaker_service_url_);
 }
 
+const char* grpc_alts_server_credentials::type() const { return "Alts"; }
+
 grpc_channel_credentials* grpc_alts_credentials_create_customized(
     const grpc_alts_credentials_options* options,
     const char* handshaker_service_url, bool enable_untrusted_alts) {

data/src/core/lib/security/credentials/alts/alts_credentials.h

@@ -39,11 +39,19 @@ class grpc_alts_credentials final : public grpc_channel_credentials {
       const char* target_name, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
+  const char* type() const override;
+
   const grpc_alts_credentials_options* options() const { return options_; }
   grpc_alts_credentials_options* mutable_options() { return options_; }
   const char* handshaker_service_url() const { return handshaker_service_url_; }
 
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_channel_credentials*>(this), other);
+  }
+
   grpc_alts_credentials_options* options_;
   char* handshaker_service_url_;
 };
@@ -58,6 +66,8 @@ class grpc_alts_server_credentials final : public grpc_server_credentials {
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_channel_args* /* args */) override;
 
+  const char* type() const override;
+
   const grpc_alts_credentials_options* options() const { return options_; }
   grpc_alts_credentials_options* mutable_options() { return options_; }
   const char* handshaker_service_url() const { return handshaker_service_url_; }

data/src/core/lib/security/credentials/call_creds_util.cc

@@ -0,0 +1,87 @@
+//
+// Copyright 2022 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/call_creds_util.h"
+
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+
+namespace grpc_core {
+
+namespace {
+
+struct ServiceUrlAndMethod {
+  std::string service_url;
+  absl::string_view method_name;
+};
+
+ServiceUrlAndMethod MakeServiceUrlAndMethod(
+    const ClientMetadataHandle& initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs* args) {
+  auto service =
+      initial_metadata->get_pointer(HttpPathMetadata())->as_string_view();
+  auto last_slash = service.find_last_of('/');
+  absl::string_view method_name;
+  if (last_slash == absl::string_view::npos) {
+    gpr_log(GPR_ERROR, "No '/' found in fully qualified method name");
+    service = "";
+    method_name = "";
+  } else if (last_slash == 0) {
+    method_name = "";
+  } else {
+    method_name = service.substr(last_slash + 1);
+    service = service.substr(0, last_slash);
+  }
+  auto host_and_port =
+      initial_metadata->get_pointer(HttpAuthorityMetadata())->as_string_view();
+  absl::string_view url_scheme = args->security_connector->url_scheme();
+  if (url_scheme == GRPC_SSL_URL_SCHEME) {
+    // Remove the port if it is 443.
+    auto port_delimiter = host_and_port.find_last_of(':');
+    if (port_delimiter != absl::string_view::npos &&
+        host_and_port.substr(port_delimiter + 1) == "443") {
+      host_and_port = host_and_port.substr(0, port_delimiter);
+    }
+  }
+  return ServiceUrlAndMethod{
+      absl::StrCat(url_scheme, "://", host_and_port, service), method_name};
+}
+
+}  // namespace
+
+std::string MakeJwtServiceUrl(
+    const ClientMetadataHandle& initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs* args) {
+  return MakeServiceUrlAndMethod(initial_metadata, args).service_url;
+}
+
+grpc_auth_metadata_context MakePluginAuthMetadataContext(
+    const ClientMetadataHandle& initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs* args) {
+  auto fields = MakeServiceUrlAndMethod(initial_metadata, args);
+  grpc_auth_metadata_context ctx;
+  memset(&ctx, 0, sizeof(ctx));
+  ctx.channel_auth_context = args->auth_context != nullptr
+                                 ? args->auth_context->Ref().release()
+                                 : nullptr;
+  ctx.service_url = gpr_strdup(fields.service_url.c_str());
+  ctx.method_name = gpr_strdup(std::string(fields.method_name).c_str());
+  return ctx;
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/credentials/call_creds_util.h

@@ -0,0 +1,42 @@
+//
+// Copyright 2022 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_CALL_CREDS_UTIL_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_CALL_CREDS_UTIL_H
+
+#include <grpc/support/port_platform.h>
+
+#include <string>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/security/credentials/credentials.h"
+
+namespace grpc_core {
+
+// Helper function to construct service URL for jwt call creds.
+std::string MakeJwtServiceUrl(
+    const ClientMetadataHandle& initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs* args);
+
+// Helper function to construct context for plugin call creds.
+grpc_auth_metadata_context MakePluginAuthMetadataContext(
+    const ClientMetadataHandle& initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs* args);
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_CALL_CREDS_UTIL_H */

data/src/core/lib/security/credentials/channel_creds_registry.h

@@ -0,0 +1,97 @@
+//
+// Copyright 2022 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_CHANNEL_CREDS_REGISTRY_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_CHANNEL_CREDS_REGISTRY_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/impl/codegen/grpc_types.h>
+
+#include "src/core/lib/json/json.h"
+
+struct grpc_channel_credentials;
+
+namespace grpc_core {
+
+template <typename T = grpc_channel_credentials>
+class ChannelCredsFactory final {
+ public:
+  virtual ~ChannelCredsFactory() {}
+  virtual absl::string_view creds_type() const = delete;
+  virtual bool IsValidConfig(const Json& config) const = delete;
+  virtual RefCountedPtr<T> CreateChannelCreds(const Json& config) const =
+      delete;
+};
+
+template <>
+class ChannelCredsFactory<grpc_channel_credentials> {
+ public:
+  virtual ~ChannelCredsFactory() {}
+  virtual absl::string_view creds_type() const = 0;
+  virtual bool IsValidConfig(const Json& config) const = 0;
+  virtual RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
+      const Json& config) const = 0;
+};
+
+template <typename T = grpc_channel_credentials>
+class ChannelCredsRegistry {
+ public:
+  static_assert(std::is_base_of<grpc_channel_credentials, T>::value,
+                "ChannelCredsRegistry must be instantiated with "
+                "grpc_channel_credentials.");
+  class Builder {
+   public:
+    void RegisterChannelCredsFactory(
+        std::unique_ptr<ChannelCredsFactory<T>> factory) {
+      factories_[factory->creds_type()] = std::move(factory);
+    }
+    ChannelCredsRegistry Build() {
+      ChannelCredsRegistry<T> registry;
+      registry.factories_.swap(factories_);
+      return registry;
+    }
+
+   private:
+    std::map<absl::string_view, std::unique_ptr<ChannelCredsFactory<T>>>
+        factories_;
+  };
+
+  bool IsSupported(const std::string& creds_type) const {
+    return factories_.find(creds_type) != factories_.end();
+  }
+
+  bool IsValidConfig(const std::string& creds_type, const Json& config) const {
+    const auto iter = factories_.find(creds_type);
+    return iter != factories_.cend() && iter->second->IsValidConfig(config);
+  }
+
+  RefCountedPtr<T> CreateChannelCreds(const std::string& creds_type,
+                                      const Json& config) const {
+    const auto iter = factories_.find(creds_type);
+    if (iter == factories_.cend()) return nullptr;
+    return iter->second->CreateChannelCreds(config);
+  }
+
+ private:
+  ChannelCredsRegistry() = default;
+  std::map<absl::string_view, std::unique_ptr<ChannelCredsFactory<T>>>
+      factories_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_CHANNEL_CREDS_REGISTRY_H

data/src/core/lib/security/credentials/channel_creds_registry_init.cc

@@ -0,0 +1,70 @@
+//
+//
+// Copyright 2022 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/config/core_configuration.h"
+#include "src/core/lib/json/json.h"
+#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/fake/fake_credentials.h"
+
+namespace grpc_core {
+
+class GoogleDefaultChannelCredsFactory : public ChannelCredsFactory<> {
+ public:
+  absl::string_view creds_type() const override { return "google_default"; }
+  bool IsValidConfig(const Json& /*config*/) const override { return true; }
+  RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
+      const Json& /*config*/) const override {
+    return RefCountedPtr<grpc_channel_credentials>(
+        grpc_google_default_credentials_create(nullptr));
+  }
+};
+
+class InsecureChannelCredsFactory : public ChannelCredsFactory<> {
+ public:
+  absl::string_view creds_type() const override { return "insecure"; }
+  bool IsValidConfig(const Json& /*config*/) const override { return true; }
+  RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
+      const Json& /*config*/) const override {
+    return RefCountedPtr<grpc_channel_credentials>(
+        grpc_insecure_credentials_create());
+  }
+};
+
+class FakeChannelCredsFactory : public ChannelCredsFactory<> {
+ public:
+  absl::string_view creds_type() const override { return "fake"; }
+  bool IsValidConfig(const Json& /*config*/) const override { return true; }
+  RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
+      const Json& /*config*/) const override {
+    return RefCountedPtr<grpc_channel_credentials>(
+        grpc_fake_transport_security_credentials_create());
+  }
+};
+
+void RegisterChannelDefaultCreds(CoreConfiguration::Builder* builder) {
+  builder->channel_creds_registry()->RegisterChannelCredsFactory(
+      absl::make_unique<GoogleDefaultChannelCredsFactory>());
+  builder->channel_creds_registry()->RegisterChannelCredsFactory(
+      absl::make_unique<InsecureChannelCredsFactory>());
+  builder->channel_creds_registry()->RegisterChannelCredsFactory(
+      absl::make_unique<FakeChannelCredsFactory>());
+}
+
+}  // namespace grpc_core