grpc 1.44.0.pre2 → 1.46.3

data/src/core/lib/security/credentials/insecure/insecure_credentials.cc

@@ -18,45 +18,44 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/grpc_security.h>
+#include "src/core/lib/security/credentials/insecure/insecure_credentials.h"
 
-#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h"
 
 namespace grpc_core {
-namespace {
 
-constexpr char kCredentialsTypeInsecure[] = "insecure";
+RefCountedPtr<grpc_channel_security_connector>
+InsecureCredentials::create_security_connector(
+    RefCountedPtr<grpc_call_credentials> request_metadata_creds,
+    const char* /* target_name */, const grpc_channel_args* /* args */,
+    grpc_channel_args** /* new_args */) {
+  return MakeRefCounted<InsecureChannelSecurityConnector>(
+      Ref(), std::move(request_metadata_creds));
+}
 
-class InsecureCredentials final : public grpc_channel_credentials {
- public:
-  InsecureCredentials() : grpc_channel_credentials(kCredentialsTypeInsecure) {}
+const char* InsecureCredentials::Type() { return "Insecure"; }
 
-  RefCountedPtr<grpc_channel_security_connector> create_security_connector(
-      RefCountedPtr<grpc_call_credentials> call_creds,
-      const char* /* target_name */, const grpc_channel_args* /* args */,
-      grpc_channel_args** /* new_args */) override {
-    return MakeRefCounted<InsecureChannelSecurityConnector>(
-        Ref(), std::move(call_creds));
-  }
-};
+int InsecureCredentials::cmp_impl(
+    const grpc_channel_credentials* /* other */) const {
+  // All insecure credentials objects should compare equal.
+  return 0;
+}
 
-class InsecureServerCredentials final : public grpc_server_credentials {
- public:
-  InsecureServerCredentials()
-      : grpc_server_credentials(kCredentialsTypeInsecure) {}
+RefCountedPtr<grpc_server_security_connector>
+InsecureServerCredentials::create_security_connector(
+    const grpc_channel_args* /* args */) {
+  return MakeRefCounted<InsecureServerSecurityConnector>(Ref());
+}
 
-  RefCountedPtr<grpc_server_security_connector> create_security_connector(
-      const grpc_channel_args* /* args */) override {
-    return MakeRefCounted<InsecureServerSecurityConnector>(Ref());
-  }
-};
+const char* InsecureServerCredentials::Type() { return "Insecure"; }
 
-}  // namespace
 }  // namespace grpc_core
 
 grpc_channel_credentials* grpc_insecure_credentials_create() {
-  return new grpc_core::InsecureCredentials();
+  // Create a singleton object for InsecureCredentials so that channels to the
+  // same target with InsecureCredentials can reuse the subchannels.
+  static auto* creds = new grpc_core::InsecureCredentials();
+  return creds->Ref().release();
 }
 
 grpc_server_credentials* grpc_insecure_server_credentials_create() {

data/src/core/lib/security/credentials/insecure/insecure_credentials.h

@@ -0,0 +1,57 @@
+//
+//
+// Copyright 2022 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/security/credentials/credentials.h"
+
+namespace grpc_core {
+
+class InsecureCredentials final : public grpc_channel_credentials {
+ public:
+  RefCountedPtr<grpc_channel_security_connector> create_security_connector(
+      RefCountedPtr<grpc_call_credentials> request_metadata_creds,
+      const char* /* target_name */, const grpc_channel_args* /* args */,
+      grpc_channel_args** /* new_args */) override;
+
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
+ private:
+  int cmp_impl(const grpc_channel_credentials* other) const override;
+};
+
+class InsecureServerCredentials final : public grpc_server_credentials {
+ public:
+  RefCountedPtr<grpc_server_security_connector> create_security_connector(
+      const grpc_channel_args* /* args */) override;
+
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H

data/src/core/lib/security/credentials/jwt/jwt_credentials.cc

@@ -34,6 +34,8 @@
 
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/promise/promise.h"
+#include "src/core/lib/security/credentials/call_creds_util.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/transport/error_utils.h"
@@ -47,22 +49,21 @@ grpc_service_account_jwt_access_credentials::
   gpr_mu_destroy(&cache_mu_);
 }
 
-bool grpc_service_account_jwt_access_credentials::get_request_metadata(
-    grpc_polling_entity* /*pollent*/, grpc_auth_metadata_context context,
-    grpc_core::CredentialsMetadataArray* md_array,
-    grpc_closure* /*on_request_metadata*/, grpc_error_handle* error) {
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+grpc_service_account_jwt_access_credentials::GetRequestMetadata(
+    grpc_core::ClientMetadataHandle initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs* args) {
   gpr_timespec refresh_threshold = gpr_time_from_seconds(
       GRPC_SECURE_TOKEN_REFRESH_THRESHOLD_SECS, GPR_TIMESPAN);
 
   // Remove service name from service_url to follow the audience format
   // dictated in https://google.aip.dev/auth/4111.
-  absl::StatusOr<std::string> uri =
-      grpc_core::RemoveServiceNameFromJwtUri(context.service_url);
+  absl::StatusOr<std::string> uri = grpc_core::RemoveServiceNameFromJwtUri(
+      grpc_core::MakeJwtServiceUrl(initial_metadata, args));
   if (!uri.ok()) {
-    *error = absl_status_to_grpc_error(uri.status());
-    return true;
+    return grpc_core::Immediate(uri.status());
   }
-  /* See if we can return a cached jwt. */
+  // See if we can return a cached jwt.
   absl::optional<grpc_core::Slice> jwt_value;
   {
     gpr_mu_lock(&cache_mu_);
@@ -77,7 +78,7 @@ bool grpc_service_account_jwt_access_credentials::get_request_metadata(
 
   if (!jwt_value.has_value()) {
     char* jwt = nullptr;
-    /* Generate a new jwt. */
+    // Generate a new jwt.
     gpr_mu_lock(&cache_mu_);
     cached_.reset();
     jwt = grpc_jwt_encode_and_sign(&key_, uri->c_str(), jwt_lifetime_, nullptr);
@@ -91,26 +92,21 @@ bool grpc_service_account_jwt_access_credentials::get_request_metadata(
     gpr_mu_unlock(&cache_mu_);
   }
 
-  if (jwt_value.has_value()) {
-    md_array->emplace_back(
-        grpc_core::Slice::FromStaticString(GRPC_AUTHORIZATION_METADATA_KEY),
-        std::move(*jwt_value));
-  } else {
-    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Could not generate JWT.");
+  if (!jwt_value.has_value()) {
+    return grpc_core::Immediate(
+        absl::UnauthenticatedError("Could not generate JWT."));
   }
-  return true;
-}
 
-void grpc_service_account_jwt_access_credentials::cancel_get_request_metadata(
-    grpc_core::CredentialsMetadataArray* /*md_array*/,
-    grpc_error_handle error) {
-  GRPC_ERROR_UNREF(error);
+  initial_metadata->Append(
+      GRPC_AUTHORIZATION_METADATA_KEY, std::move(*jwt_value),
+      [](absl::string_view, const grpc_core::Slice&) { abort(); });
+  return grpc_core::Immediate(std::move(initial_metadata));
 }
 
 grpc_service_account_jwt_access_credentials::
     grpc_service_account_jwt_access_credentials(grpc_auth_json_key key,
                                                 gpr_timespec token_lifetime)
-    : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_JWT), key_(key) {
+    : key_(key) {
   gpr_timespec max_token_lifetime = grpc_max_auth_token_lifetime();
   if (gpr_time_cmp(token_lifetime, max_token_lifetime) > 0) {
     gpr_log(GPR_INFO,
@@ -122,6 +118,10 @@ grpc_service_account_jwt_access_credentials::
   gpr_mu_init(&cache_mu_);
 }
 
+const char* grpc_service_account_jwt_access_credentials::Type() {
+  return "Jwt";
+}
+
 grpc_core::RefCountedPtr<grpc_call_credentials>
 grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
     grpc_auth_json_key key, gpr_timespec token_lifetime) {

data/src/core/lib/security/credentials/jwt/jwt_credentials.h

@@ -38,15 +38,9 @@ class grpc_service_account_jwt_access_credentials
                                               gpr_timespec token_lifetime);
   ~grpc_service_account_jwt_access_credentials() override;
 
-  bool get_request_metadata(grpc_polling_entity* pollent,
-                            grpc_auth_metadata_context context,
-                            grpc_core::CredentialsMetadataArray* md_array,
-                            grpc_closure* on_request_metadata,
-                            grpc_error_handle* error) override;
-
-  void cancel_get_request_metadata(
-      grpc_core::CredentialsMetadataArray* md_array,
-      grpc_error_handle error) override;
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
+                     const GetRequestMetadataArgs* args) override;
 
   const gpr_timespec& jwt_lifetime() const { return jwt_lifetime_; }
   const grpc_auth_json_key& key() const { return key_; }
@@ -58,7 +52,17 @@ class grpc_service_account_jwt_access_credentials
             static_cast<int64_t>(gpr_timespec_to_micros(jwt_lifetime_)))));
   };
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
  private:
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_call_credentials*>(this), other);
+  }
+
   // Have a simple cache for now with just 1 entry. We could have a map based on
   // the service_url for a more sophisticated one.
   gpr_mu cache_mu_;

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -35,6 +35,7 @@
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/manual_constructor.h"
 #include "src/core/lib/http/httpcli.h"
+#include "src/core/lib/http/httpcli_ssl_credentials.h"
 #include "src/core/lib/iomgr/polling_entity.h"
 #include "src/core/lib/slice/b64.h"
 #include "src/core/lib/slice/slice_internal.h"
@@ -344,6 +345,7 @@ struct verifier_cb_ctx {
   void* user_data;
   grpc_jwt_verification_done_cb user_cb;
   grpc_http_response responses[HTTP_RESPONSE_COUNT];
+  grpc_core::OrphanablePtr<grpc_core::HttpRequest> http_request;
 };
 /* Takes ownership of the header, claims and signature. */
 static verifier_cb_ctx* verifier_cb_ctx_create(
@@ -385,7 +387,8 @@ void verifier_cb_ctx_destroy(verifier_cb_ctx* ctx) {
 gpr_timespec grpc_jwt_verifier_clock_skew = {60, 0, GPR_TIMESPAN};
 
 /* Max delay defaults to one minute. */
-grpc_millis grpc_jwt_verifier_max_delay = 60 * GPR_MS_PER_SEC;
+grpc_core::Duration grpc_jwt_verifier_max_delay =
+    grpc_core::Duration::Minutes(1);
 
 struct email_key_mapping {
   char* email_domain;
@@ -397,7 +400,7 @@ struct grpc_jwt_verifier {
   size_t allocated_mappings;
 };
 
-static Json json_from_http(const grpc_httpcli_response* response) {
+static Json json_from_http(const grpc_http_response* response) {
   if (response == nullptr) {
     gpr_log(GPR_ERROR, "HTTP response is NULL.");
     return Json();  // JSON null
@@ -666,9 +669,13 @@ static void on_openid_config_retrieved(void* user_data,
   verifier_cb_ctx* ctx = static_cast<verifier_cb_ctx*>(user_data);
   const grpc_http_response* response = &ctx->responses[HTTP_RESPONSE_OPENID];
   Json json = json_from_http(response);
-  grpc_httpcli_request req;
+  grpc_http_request req;
+  memset(&req, 0, sizeof(grpc_http_request));
   const char* jwks_uri;
   const Json* cur;
+  absl::StatusOr<grpc_core::URI> uri;
+  char* host;
+  char* path;
 
   /* TODO(jboeuf): Cache the jwks_uri in order to avoid this hop next time. */
   if (json.type() == Json::Type::JSON_NULL) goto error;
@@ -684,24 +691,30 @@ static void on_openid_config_retrieved(void* user_data,
     goto error;
   }
   jwks_uri += 8;
-  req.handshaker = &grpc_httpcli_ssl;
-  req.host = gpr_strdup(jwks_uri);
-  req.http.path = const_cast<char*>(strchr(jwks_uri, '/'));
-  if (req.http.path == nullptr) {
-    req.http.path = const_cast<char*>("");
+  host = gpr_strdup(jwks_uri);
+  path = const_cast<char*>(strchr(jwks_uri, '/'));
+  if (path == nullptr) {
+    path = const_cast<char*>("");
   } else {
-    *(req.host + (req.http.path - jwks_uri)) = '\0';
+    *(host + (path - jwks_uri)) = '\0';
   }
 
   /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
      channel. This would allow us to cancel an authentication query when under
      extreme memory pressure. */
-  grpc_httpcli_get(
-      &ctx->pollent, grpc_core::ResourceQuota::Default(), &req,
+  uri = grpc_core::URI::Create("https", host, path, {} /* query params /*/,
+                               "" /* fragment */);
+  if (!uri.ok()) {
+    goto error;
+  }
+  ctx->http_request = grpc_core::HttpRequest::Get(
+      std::move(*uri), nullptr /* channel args */, &ctx->pollent, &req,
       grpc_core::ExecCtx::Get()->Now() + grpc_jwt_verifier_max_delay,
       GRPC_CLOSURE_CREATE(on_keys_retrieved, ctx, grpc_schedule_on_exec_ctx),
-      &ctx->responses[HTTP_RESPONSE_KEYS]);
-  gpr_free(req.host);
+      &ctx->responses[HTTP_RESPONSE_KEYS],
+      grpc_core::CreateHttpRequestSSLCredentials());
+  ctx->http_request->Start();
+  gpr_free(host);
   return;
 
 error:
@@ -759,10 +772,12 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
   grpc_closure* http_cb;
   char* path_prefix = nullptr;
   const char* iss;
-  grpc_httpcli_request req;
-  memset(&req, 0, sizeof(grpc_httpcli_request));
-  req.handshaker = &grpc_httpcli_ssl;
+  grpc_http_request req;
+  memset(&req, 0, sizeof(grpc_http_request));
   http_response_index rsp_idx;
+  char* host;
+  char* path;
+  absl::StatusOr<grpc_core::URI> uri;
 
   GPR_ASSERT(ctx != nullptr && ctx->header != nullptr &&
              ctx->claims != nullptr);
@@ -790,26 +805,25 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
       gpr_log(GPR_ERROR, "Missing mapping for issuer email.");
       goto error;
     }
-    req.host = gpr_strdup(mapping->key_url_prefix);
-    path_prefix = strchr(req.host, '/');
+    host = gpr_strdup(mapping->key_url_prefix);
+    path_prefix = strchr(host, '/');
     if (path_prefix == nullptr) {
-      gpr_asprintf(&req.http.path, "/%s", iss);
+      gpr_asprintf(&path, "/%s", iss);
     } else {
       *(path_prefix++) = '\0';
-      gpr_asprintf(&req.http.path, "/%s/%s", path_prefix, iss);
+      gpr_asprintf(&path, "/%s/%s", path_prefix, iss);
     }
     http_cb =
         GRPC_CLOSURE_CREATE(on_keys_retrieved, ctx, grpc_schedule_on_exec_ctx);
     rsp_idx = HTTP_RESPONSE_KEYS;
   } else {
-    req.host = gpr_strdup(strstr(iss, "https://") == iss ? iss + 8 : iss);
-    path_prefix = strchr(req.host, '/');
+    host = gpr_strdup(strstr(iss, "https://") == iss ? iss + 8 : iss);
+    path_prefix = strchr(host, '/');
     if (path_prefix == nullptr) {
-      req.http.path = gpr_strdup(GRPC_OPENID_CONFIG_URL_SUFFIX);
+      path = gpr_strdup(GRPC_OPENID_CONFIG_URL_SUFFIX);
     } else {
       *(path_prefix++) = 0;
-      gpr_asprintf(&req.http.path, "/%s%s", path_prefix,
-                   GRPC_OPENID_CONFIG_URL_SUFFIX);
+      gpr_asprintf(&path, "/%s%s", path_prefix, GRPC_OPENID_CONFIG_URL_SUFFIX);
     }
     http_cb = GRPC_CLOSURE_CREATE(on_openid_config_retrieved, ctx,
                                   grpc_schedule_on_exec_ctx);
@@ -819,12 +833,18 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
   /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
      channel. This would allow us to cancel an authentication query when under
      extreme memory pressure. */
-  grpc_httpcli_get(
-      &ctx->pollent, grpc_core::ResourceQuota::Default(), &req,
+  uri = grpc_core::URI::Create("https", host, path, {} /* query params */,
+                               "" /* fragment */);
+  if (!uri.ok()) {
+    goto error;
+  }
+  ctx->http_request = grpc_core::HttpRequest::Get(
+      std::move(*uri), nullptr /* channel args */, &ctx->pollent, &req,
       grpc_core::ExecCtx::Get()->Now() + grpc_jwt_verifier_max_delay, http_cb,
-      &ctx->responses[rsp_idx]);
-  gpr_free(req.host);
-  gpr_free(req.http.path);
+      &ctx->responses[rsp_idx], grpc_core::CreateHttpRequestSSLCredentials());
+  ctx->http_request->Start();
+  gpr_free(host);
+  gpr_free(path);
   return;
 
 error:

data/src/core/lib/security/credentials/jwt/jwt_verifier.h

@@ -82,7 +82,7 @@ struct grpc_jwt_verifier_email_domain_key_url_mapping {
 };
 /* Globals to control the verifier. Not thread-safe. */
 extern gpr_timespec grpc_jwt_verifier_clock_skew;
-extern grpc_millis grpc_jwt_verifier_max_delay;
+extern grpc_core::Duration grpc_jwt_verifier_max_delay;
 
 /* The verifier can be created with some custom mappings to help with key
    discovery in the case where the issuer is an email address.

data/src/core/lib/security/credentials/local/local_credentials.cc

@@ -27,8 +27,6 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/security/security_connector/local/local_security_connector.h"
 
-#define GRPC_CREDENTIALS_TYPE_LOCAL "Local"
-
 grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_local_credentials::create_security_connector(
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
@@ -38,16 +36,19 @@ grpc_local_credentials::create_security_connector(
       this->Ref(), std::move(request_metadata_creds), args, target_name);
 }
 
+const char* grpc_local_credentials::type() const { return "Local"; }
+
 grpc_core::RefCountedPtr<grpc_server_security_connector>
 grpc_local_server_credentials::create_security_connector(
     const grpc_channel_args* /* args */) {
   return grpc_local_server_security_connector_create(this->Ref());
 }
 
+const char* grpc_local_server_credentials::type() const { return "Local"; }
+
 grpc_local_credentials::grpc_local_credentials(
     grpc_local_connect_type connect_type)
-    : grpc_channel_credentials(GRPC_CREDENTIALS_TYPE_LOCAL),
-      connect_type_(connect_type) {}
+    : connect_type_(connect_type) {}
 
 grpc_channel_credentials* grpc_local_credentials_create(
     grpc_local_connect_type connect_type) {
@@ -56,8 +57,7 @@ grpc_channel_credentials* grpc_local_credentials_create(
 
 grpc_local_server_credentials::grpc_local_server_credentials(
     grpc_local_connect_type connect_type)
-    : grpc_server_credentials(GRPC_CREDENTIALS_TYPE_LOCAL),
-      connect_type_(connect_type) {}
+    : connect_type_(connect_type) {}
 
 grpc_server_credentials* grpc_local_server_credentials_create(
     grpc_local_connect_type connect_type) {

data/src/core/lib/security/credentials/local/local_credentials.h

@@ -37,9 +37,17 @@ class grpc_local_credentials final : public grpc_channel_credentials {
       const char* target_name, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
+  const char* type() const override;
+
   grpc_local_connect_type connect_type() const { return connect_type_; }
 
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_channel_credentials*>(this), other);
+  }
+
   grpc_local_connect_type connect_type_;
 };
 
@@ -52,6 +60,8 @@ class grpc_local_server_credentials final : public grpc_server_credentials {
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_channel_args* /* args */) override;
 
+  const char* type() const override;
+
   grpc_local_connect_type connect_type() const { return connect_type_; }
 
  private: