grpc 1.43.1 → 1.53.0

data/src/core/ext/filters/rbac/rbac_filter.cc

@@ -0,0 +1,175 @@
+//
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/ext/filters/rbac/rbac_filter.h"
+
+#include <new>
+#include <utility>
+
+#include "absl/status/status.h"
+
+#include <grpc/grpc_security.h>
+#include <grpc/status.h>
+#include <grpc/support/log.h>
+
+#include "src/core/ext/filters/rbac/rbac_service_config_parser.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/config/core_configuration.h"
+#include "src/core/lib/gprpp/debug_location.h"
+#include "src/core/lib/gprpp/status_helper.h"
+#include "src/core/lib/security/authorization/authorization_engine.h"
+#include "src/core/lib/security/authorization/grpc_authorization_engine.h"
+#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/service_config/service_config_call_data.h"
+#include "src/core/lib/transport/transport_fwd.h"
+#include "src/core/lib/transport/transport_impl.h"
+
+namespace grpc_core {
+
+//
+// RbacFilter::CallData
+//
+
+// CallData
+
+grpc_error_handle RbacFilter::CallData::Init(
+    grpc_call_element* elem, const grpc_call_element_args* args) {
+  new (elem->call_data) CallData(elem, *args);
+  return absl::OkStatus();
+}
+
+void RbacFilter::CallData::Destroy(grpc_call_element* elem,
+                                   const grpc_call_final_info* /*final_info*/,
+                                   grpc_closure* /*then_schedule_closure*/) {
+  auto* calld = static_cast<CallData*>(elem->call_data);
+  calld->~CallData();
+}
+
+void RbacFilter::CallData::StartTransportStreamOpBatch(
+    grpc_call_element* elem, grpc_transport_stream_op_batch* op) {
+  CallData* calld = static_cast<CallData*>(elem->call_data);
+  if (op->recv_initial_metadata) {
+    calld->recv_initial_metadata_ =
+        op->payload->recv_initial_metadata.recv_initial_metadata;
+    calld->original_recv_initial_metadata_ready_ =
+        op->payload->recv_initial_metadata.recv_initial_metadata_ready;
+    op->payload->recv_initial_metadata.recv_initial_metadata_ready =
+        &calld->recv_initial_metadata_ready_;
+  }
+  // Chain to the next filter.
+  grpc_call_next_op(elem, op);
+}
+
+RbacFilter::CallData::CallData(grpc_call_element* elem,
+                               const grpc_call_element_args& args)
+    : call_context_(args.context) {
+  GRPC_CLOSURE_INIT(&recv_initial_metadata_ready_, RecvInitialMetadataReady,
+                    elem, grpc_schedule_on_exec_ctx);
+}
+
+void RbacFilter::CallData::RecvInitialMetadataReady(void* user_data,
+                                                    grpc_error_handle error) {
+  grpc_call_element* elem = static_cast<grpc_call_element*>(user_data);
+  CallData* calld = static_cast<CallData*>(elem->call_data);
+  RbacFilter* filter = static_cast<RbacFilter*>(elem->channel_data);
+  if (error.ok()) {
+    // Fetch and apply the rbac policy from the service config.
+    auto* service_config_call_data = static_cast<ServiceConfigCallData*>(
+        calld->call_context_[GRPC_CONTEXT_SERVICE_CONFIG_CALL_DATA].value);
+    auto* method_params = static_cast<RbacMethodParsedConfig*>(
+        service_config_call_data->GetMethodParsedConfig(
+            filter->service_config_parser_index_));
+    if (method_params == nullptr) {
+      error = GRPC_ERROR_CREATE("No RBAC policy found.");
+    } else {
+      RbacFilter* chand = static_cast<RbacFilter*>(elem->channel_data);
+      auto* authorization_engine =
+          method_params->authorization_engine(chand->index_);
+      if (authorization_engine
+              ->Evaluate(EvaluateArgs(calld->recv_initial_metadata_,
+                                      &chand->per_channel_evaluate_args_))
+              .type == AuthorizationEngine::Decision::Type::kDeny) {
+        error = GRPC_ERROR_CREATE("Unauthorized RPC rejected");
+      }
+    }
+    if (!error.ok()) {
+      error = grpc_error_set_int(error, StatusIntProperty::kRpcStatus,
+                                 GRPC_STATUS_PERMISSION_DENIED);
+    }
+  }
+  grpc_closure* closure = calld->original_recv_initial_metadata_ready_;
+  calld->original_recv_initial_metadata_ready_ = nullptr;
+  Closure::Run(DEBUG_LOCATION, closure, error);
+}
+
+//
+// RbacFilter
+//
+
+const grpc_channel_filter RbacFilter::kFilterVtable = {
+    RbacFilter::CallData::StartTransportStreamOpBatch,
+    nullptr,
+    grpc_channel_next_op,
+    sizeof(RbacFilter::CallData),
+    RbacFilter::CallData::Init,
+    grpc_call_stack_ignore_set_pollset_or_pollset_set,
+    RbacFilter::CallData::Destroy,
+    sizeof(RbacFilter),
+    RbacFilter::Init,
+    grpc_channel_stack_no_post_init,
+    RbacFilter::Destroy,
+    grpc_channel_next_get_info,
+    "rbac_filter",
+};
+
+RbacFilter::RbacFilter(size_t index,
+                       EvaluateArgs::PerChannelArgs per_channel_evaluate_args)
+    : index_(index),
+      service_config_parser_index_(RbacServiceConfigParser::ParserIndex()),
+      per_channel_evaluate_args_(std::move(per_channel_evaluate_args)) {}
+
+grpc_error_handle RbacFilter::Init(grpc_channel_element* elem,
+                                   grpc_channel_element_args* args) {
+  GPR_ASSERT(elem->filter == &kFilterVtable);
+  auto* auth_context = args->channel_args.GetObject<grpc_auth_context>();
+  if (auth_context == nullptr) {
+    return GRPC_ERROR_CREATE("No auth context found");
+  }
+  auto* transport = args->channel_args.GetObject<grpc_transport>();
+  if (transport == nullptr) {
+    // This should never happen since the transport is always set on the server
+    // side.
+    return GRPC_ERROR_CREATE("No transport configured");
+  }
+  new (elem->channel_data) RbacFilter(
+      grpc_channel_stack_filter_instance_number(args->channel_stack, elem),
+      EvaluateArgs::PerChannelArgs(auth_context,
+                                   grpc_transport_get_endpoint(transport)));
+  return absl::OkStatus();
+}
+
+void RbacFilter::Destroy(grpc_channel_element* elem) {
+  auto* chand = static_cast<RbacFilter*>(elem->channel_data);
+  chand->~RbacFilter();
+}
+
+void RbacFilterRegister(CoreConfiguration::Builder* builder) {
+  RbacServiceConfigParser::Register(builder);
+}
+
+}  // namespace grpc_core

data/src/core/ext/filters/rbac/rbac_filter.h

@@ -0,0 +1,84 @@
+//
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_EXT_FILTERS_RBAC_RBAC_FILTER_H
+#define GRPC_SRC_CORE_EXT_FILTERS_RBAC_RBAC_FILTER_H
+
+#include <grpc/support/port_platform.h>
+
+#include <stddef.h>
+
+#include "src/core/lib/channel/channel_fwd.h"
+#include "src/core/lib/channel/channel_stack.h"
+#include "src/core/lib/channel/context.h"
+#include "src/core/lib/iomgr/closure.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/security/authorization/evaluate_args.h"
+#include "src/core/lib/transport/metadata_batch.h"
+#include "src/core/lib/transport/transport.h"
+
+namespace grpc_core {
+
+// Filter used when xDS server config fetcher provides a configuration with an
+// HTTP RBAC filter. Also serves as the type for channel data for the filter.
+class RbacFilter {
+ public:
+  // This channel filter is intended to be used by connections on xDS enabled
+  // servers configured with RBAC. The RBAC filter fetches the RBAC policy from
+  // the method config of service config returned by the ServerConfigSelector,
+  // and enforces the RBAC policy.
+  static const grpc_channel_filter kFilterVtable;
+
+ private:
+  class CallData {
+   public:
+    static grpc_error_handle Init(grpc_call_element* elem,
+                                  const grpc_call_element_args* args);
+    static void Destroy(grpc_call_element* elem,
+                        const grpc_call_final_info* /* final_info */,
+                        grpc_closure* /* then_schedule_closure */);
+    static void StartTransportStreamOpBatch(grpc_call_element* elem,
+                                            grpc_transport_stream_op_batch* op);
+
+   private:
+    CallData(grpc_call_element* elem, const grpc_call_element_args& args);
+    static void RecvInitialMetadataReady(void* user_data,
+                                         grpc_error_handle error);
+
+    grpc_call_context_element* call_context_;
+    // State for keeping track of recv_initial_metadata
+    grpc_metadata_batch* recv_initial_metadata_ = nullptr;
+    grpc_closure* original_recv_initial_metadata_ready_ = nullptr;
+    grpc_closure recv_initial_metadata_ready_;
+  };
+
+  RbacFilter(size_t index,
+             EvaluateArgs::PerChannelArgs per_channel_evaluate_args);
+  static grpc_error_handle Init(grpc_channel_element* elem,
+                                grpc_channel_element_args* args);
+  static void Destroy(grpc_channel_element* elem);
+
+  // The index of this filter instance among instances of the same filter.
+  size_t index_;
+  // Assigned index for service config data from the parser.
+  const size_t service_config_parser_index_;
+  // Per channel args used for authorization.
+  EvaluateArgs::PerChannelArgs per_channel_evaluate_args_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_EXT_FILTERS_RBAC_RBAC_FILTER_H