grpc 1.52.2 → 1.53.0.pre2

data/src/core/tsi/fake_transport_security.h

@@ -16,8 +16,8 @@
 //
 //
 
-#ifndef GRPC_CORE_TSI_FAKE_TRANSPORT_SECURITY_H
-#define GRPC_CORE_TSI_FAKE_TRANSPORT_SECURITY_H
+#ifndef GRPC_SRC_CORE_TSI_FAKE_TRANSPORT_SECURITY_H
+#define GRPC_SRC_CORE_TSI_FAKE_TRANSPORT_SECURITY_H
 
 #include <grpc/support/port_platform.h>
 
@@ -50,4 +50,4 @@ tsi_zero_copy_grpc_protector* tsi_create_fake_zero_copy_grpc_protector(
 // contained frame
 uint32_t tsi_fake_zero_copy_grpc_protector_next_frame_size(
     const grpc_slice_buffer* protected_slices);
-#endif  // GRPC_CORE_TSI_FAKE_TRANSPORT_SECURITY_H
+#endif  // GRPC_SRC_CORE_TSI_FAKE_TRANSPORT_SECURITY_H

data/src/core/tsi/local_transport_security.h

@@ -16,8 +16,8 @@
 //
 //
 
-#ifndef GRPC_CORE_TSI_LOCAL_TRANSPORT_SECURITY_H
-#define GRPC_CORE_TSI_LOCAL_TRANSPORT_SECURITY_H
+#ifndef GRPC_SRC_CORE_TSI_LOCAL_TRANSPORT_SECURITY_H
+#define GRPC_SRC_CORE_TSI_LOCAL_TRANSPORT_SECURITY_H
 
 #include <grpc/support/port_platform.h>
 
@@ -44,4 +44,4 @@
 ///
 tsi_result tsi_local_handshaker_create(tsi_handshaker** self);
 
-#endif  // GRPC_CORE_TSI_LOCAL_TRANSPORT_SECURITY_H
+#endif  // GRPC_SRC_CORE_TSI_LOCAL_TRANSPORT_SECURITY_H

data/src/core/tsi/ssl/key_logging/ssl_key_logging.cc

@@ -50,7 +50,7 @@ TlsSessionKeyLoggerCache::TlsSessionKeyLogger::TlsSessionKeyLogger(
       cache_(std::move(cache)) {
   GPR_ASSERT(!tls_session_key_log_file_path_.empty());
   GPR_ASSERT(cache_ != nullptr);
-  fd_ = fopen(tls_session_key_log_file_path_.c_str(), "w+");
+  fd_ = fopen(tls_session_key_log_file_path_.c_str(), "a");
   if (fd_ == nullptr) {
     grpc_error_handle error = GRPC_OS_ERROR(errno, "fopen");
     gpr_log(GPR_ERROR,

data/src/core/tsi/ssl/key_logging/ssl_key_logging.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef GRPC_CORE_TSI_SSL_KEY_LOGGING_SSL_KEY_LOGGING_H
-#define GRPC_CORE_TSI_SSL_KEY_LOGGING_SSL_KEY_LOGGING_H
+#ifndef GRPC_SRC_CORE_TSI_SSL_KEY_LOGGING_SSL_KEY_LOGGING_H
+#define GRPC_SRC_CORE_TSI_SSL_KEY_LOGGING_SSL_KEY_LOGGING_H
 
 #include <grpc/support/port_platform.h>
 
@@ -78,4 +78,4 @@ class TlsSessionKeyLoggerCache
 
 }  // namespace tsi
 
-#endif  // GRPC_CORE_TSI_SSL_KEY_LOGGING_SSL_KEY_LOGGING_H
+#endif  // GRPC_SRC_CORE_TSI_SSL_KEY_LOGGING_SSL_KEY_LOGGING_H

data/src/core/tsi/ssl/session_cache/ssl_session.h

@@ -16,8 +16,8 @@
 //
 //
 
-#ifndef GRPC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_H
-#define GRPC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_H
+#ifndef GRPC_SRC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_H
+#define GRPC_SRC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_H
 
 #include <grpc/support/port_platform.h>
 
@@ -68,4 +68,4 @@ class SslCachedSession {
 
 }  // namespace tsi
 
-#endif  // GRPC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_H
+#endif  // GRPC_SRC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_H

data/src/core/tsi/ssl/session_cache/ssl_session_cache.h

@@ -16,8 +16,8 @@
 //
 //
 
-#ifndef GRPC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_CACHE_H
-#define GRPC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_CACHE_H
+#ifndef GRPC_SRC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_CACHE_H
+#define GRPC_SRC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_CACHE_H
 
 #include <grpc/support/port_platform.h>
 
@@ -96,4 +96,4 @@ class SslSessionLRUCache
 
 }  // namespace tsi
 
-#endif  // GRPC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_CACHE_H
+#endif  // GRPC_SRC_CORE_TSI_SSL_SESSION_CACHE_SSL_SESSION_CACHE_H

data/src/core/tsi/ssl_transport_security.cc

@@ -144,6 +144,7 @@ struct tsi_ssl_frame_protector {
 static gpr_once g_init_openssl_once = GPR_ONCE_INIT;
 static int g_ssl_ctx_ex_factory_index = -1;
 static const unsigned char kSslSessionIdContext[] = {'g', 'r', 'p', 'c'};
+static int g_ssl_ex_verified_root_cert_index = -1;
 #if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_NO_ENGINE)
 static const char kSslEnginePrefix[] = "engine:";
 #endif
@@ -193,6 +194,10 @@ static void init_openssl(void) {
   g_ssl_ctx_ex_factory_index =
       SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
   GPR_ASSERT(g_ssl_ctx_ex_factory_index != -1);
+
+  g_ssl_ex_verified_root_cert_index =
+      SSL_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
+  GPR_ASSERT(g_ssl_ex_verified_root_cert_index != -1);
 }
 
 // --- Ssl utils. ---
@@ -306,7 +311,8 @@ static tsi_result peer_property_from_x509_common_name(
 
 // Gets the subject of an X509 cert as a tsi_peer_property.
 static tsi_result peer_property_from_x509_subject(X509* cert,
-                                                  tsi_peer_property* property) {
+                                                  tsi_peer_property* property,
+                                                  bool is_verified_root_cert) {
   X509_NAME* subject_name = X509_get_subject_name(cert);
   if (subject_name == nullptr) {
     gpr_log(GPR_INFO, "Could not get subject name from certificate.");
@@ -321,9 +327,16 @@ static tsi_result peer_property_from_x509_subject(X509* cert,
     BIO_free(bio);
     return TSI_INTERNAL_ERROR;
   }
-  tsi_result result = tsi_construct_string_peer_property(
-      TSI_X509_SUBJECT_PEER_PROPERTY, contents, static_cast<size_t>(len),
-      property);
+  tsi_result result;
+  if (!is_verified_root_cert) {
+    result = tsi_construct_string_peer_property(
+        TSI_X509_SUBJECT_PEER_PROPERTY, contents, static_cast<size_t>(len),
+        property);
+  } else {
+    result = tsi_construct_string_peer_property(
+        TSI_X509_VERIFIED_ROOT_CERT_SUBECT_PEER_PROPERTY, contents,
+        static_cast<size_t>(len), property);
+  }
   BIO_free(bio);
   return result;
 }
@@ -472,7 +485,8 @@ static tsi_result peer_from_x509(X509* cert, int include_certificate_type,
     }
 
     result = peer_property_from_x509_subject(
-        cert, &peer->properties[current_insert_index++]);
+        cert, &peer->properties[current_insert_index++],
+        /*is_verified_root_cert=*/false);
     if (result != TSI_OK) break;
 
     result = peer_property_from_x509_common_name(
@@ -845,6 +859,22 @@ static tsi_result build_alpn_protocol_name_list(
   return TSI_OK;
 }
 
+// This callback is invoked when the CRL has been verified and will soft-fail
+// errors in verification depending on certain error types.
+static int verify_cb(int ok, X509_STORE_CTX* ctx) {
+  int cert_error = X509_STORE_CTX_get_error(ctx);
+  if (cert_error == X509_V_ERR_UNABLE_TO_GET_CRL) {
+    gpr_log(
+        GPR_INFO,
+        "Certificate verification failed to get CRL files. Ignoring error.");
+    return 1;
+  }
+  if (cert_error != 0) {
+    gpr_log(GPR_ERROR, "Certificate verify failed with code %d", cert_error);
+  }
+  return ok;
+}
+
 // The verification callback is used for clients that don't really care about
 // the server's certificate, but we need to pull it anyway, in case a higher
 // layer wants to look at it. In this case the verification may fail, but
@@ -853,6 +883,64 @@ static int NullVerifyCallback(int /*preverify_ok*/, X509_STORE_CTX* /*ctx*/) {
   return 1;
 }
 
+static int RootCertExtractCallback(int preverify_ok, X509_STORE_CTX* ctx) {
+  if (ctx == nullptr) {
+    return preverify_ok;
+  }
+
+  // There's a case where this function is set in SSL_CTX_set_verify and a CRL
+  // related callback is set with X509_STORE_set_verify_cb. They overlap and
+  // this will take precedence, thus we need to ensure the CRL related callback
+  // is still called
+  X509_VERIFY_PARAM* param = X509_STORE_CTX_get0_param(ctx);
+  auto flags = X509_VERIFY_PARAM_get_flags(param);
+  if (flags & X509_V_FLAG_CRL_CHECK) {
+    preverify_ok = verify_cb(preverify_ok, ctx);
+  }
+
+  // If preverify_ok == 0, verification failed. We shouldn't expect to have a
+  // verified chain, so there is no need to attempt to extract the root cert
+  // from it
+  if (preverify_ok == 0) {
+    return preverify_ok;
+  }
+
+  // If we're here, verification was successful
+  // Get the verified chain from the X509_STORE_CTX and put it on the SSL object
+  // so that we have access to it when populating the tsi_peer
+#if OPENSSL_VERSION_NUMBER >= 0x10100000
+  STACK_OF(X509)* chain = X509_STORE_CTX_get0_chain(ctx);
+#else
+  STACK_OF(X509)* chain = X509_STORE_CTX_get_chain(ctx);
+#endif
+
+  if (chain == nullptr) {
+    return preverify_ok;
+  }
+
+  // The root cert is the last in the chain
+  size_t chain_length = sk_X509_num(chain);
+  if (chain_length == 0) {
+    return preverify_ok;
+  }
+  X509* root_cert = sk_X509_value(chain, chain_length - 1);
+  if (root_cert == nullptr) {
+    return preverify_ok;
+  }
+
+  SSL* ssl = static_cast<SSL*>(
+      X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()));
+  if (ssl == nullptr) {
+    return preverify_ok;
+  }
+  int success =
+      SSL_set_ex_data(ssl, g_ssl_ex_verified_root_cert_index, root_cert);
+  if (success == 0) {
+    gpr_log(GPR_INFO, "Could not set verified root cert in SSL's ex_data");
+  }
+  return preverify_ok;
+}
+
 // Sets the min and max TLS version of |ssl_context| to |min_tls_version| and
 // |max_tls_version|, respectively. Calling this method is a no-op when using
 // OpenSSL versions < 1.1.
@@ -1107,10 +1195,14 @@ static tsi_result ssl_handshaker_result_extract_peer(
   // peer's certificate; When called on the server side,
   // the peer's certificate is not present in the stack
   STACK_OF(X509)* peer_chain = SSL_get_peer_cert_chain(impl->ssl);
+
+  X509* verified_root_cert = static_cast<X509*>(
+      SSL_get_ex_data(impl->ssl, g_ssl_ex_verified_root_cert_index));
   // 1 is for session reused property.
   size_t new_property_count = peer->property_count + 3;
   if (alpn_selected != nullptr) new_property_count++;
   if (peer_chain != nullptr) new_property_count++;
+  if (verified_root_cert != nullptr) new_property_count++;
   tsi_peer_property* new_properties = static_cast<tsi_peer_property*>(
       gpr_zalloc(sizeof(*new_properties) * new_property_count));
   for (size_t i = 0; i < peer->property_count; i++) {
@@ -1146,6 +1238,18 @@ static tsi_result ssl_handshaker_result_extract_peer(
       &peer->properties[peer->property_count]);
   if (result != TSI_OK) return result;
   peer->property_count++;
+
+  if (verified_root_cert != nullptr) {
+    result = peer_property_from_x509_subject(
+        verified_root_cert, &peer->properties[peer->property_count], true);
+    if (result != TSI_OK) {
+      gpr_log(GPR_DEBUG,
+              "Problem extracting subject from verified_root_cert. result: %d",
+              static_cast<int>(result));
+    }
+    peer->property_count++;
+  }
+
   return result;
 }
 
@@ -1808,22 +1912,6 @@ static void ssl_keylogging_callback(const SSL* ssl, const char* info) {
   factory->key_logger->LogSessionKeys(ssl_context, info);
 }
 
-// This callback is invoked when the CRL has been verified and will soft-fail
-// errors in verification depending on certain error types.
-static int verify_cb(int ok, X509_STORE_CTX* ctx) {
-  int cert_error = X509_STORE_CTX_get_error(ctx);
-  if (cert_error == X509_V_ERR_UNABLE_TO_GET_CRL) {
-    gpr_log(
-        GPR_INFO,
-        "Certificate verification failed to get CRL files. Ignoring error.");
-    return 1;
-  }
-  if (cert_error != 0) {
-    gpr_log(GPR_ERROR, "Certificate verify failed with code %d", cert_error);
-  }
-  return ok;
-}
-
 // --- tsi_ssl_handshaker_factory constructors. ---
 
 static tsi_ssl_handshaker_factory_vtable client_handshaker_factory_vtable = {
@@ -1957,7 +2045,7 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
   if (options->skip_server_certificate_verification) {
     SSL_CTX_set_verify(ssl_context, SSL_VERIFY_PEER, NullVerifyCallback);
   } else {
-    SSL_CTX_set_verify(ssl_context, SSL_VERIFY_PEER, nullptr);
+    SSL_CTX_set_verify(ssl_context, SSL_VERIFY_PEER, RootCertExtractCallback);
   }
 
 #if OPENSSL_VERSION_NUMBER >= 0x10100000
@@ -2129,7 +2217,8 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
                              NullVerifyCallback);
           break;
         case TSI_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY:
-          SSL_CTX_set_verify(impl->ssl_contexts[i], SSL_VERIFY_PEER, nullptr);
+          SSL_CTX_set_verify(impl->ssl_contexts[i], SSL_VERIFY_PEER,
+                             RootCertExtractCallback);
           break;
         case TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY:
           SSL_CTX_set_verify(impl->ssl_contexts[i],
@@ -2139,7 +2228,7 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
         case TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY:
           SSL_CTX_set_verify(impl->ssl_contexts[i],
                              SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
-                             nullptr);
+                             RootCertExtractCallback);
           break;
       }
 

data/src/core/tsi/ssl_transport_security.h

@@ -16,8 +16,8 @@
 //
 //
 
-#ifndef GRPC_CORE_TSI_SSL_TRANSPORT_SECURITY_H
-#define GRPC_CORE_TSI_SSL_TRANSPORT_SECURITY_H
+#ifndef GRPC_SRC_CORE_TSI_SSL_TRANSPORT_SECURITY_H
+#define GRPC_SRC_CORE_TSI_SSL_TRANSPORT_SECURITY_H
 
 #include <grpc/support/port_platform.h>
 
@@ -47,6 +47,8 @@
 #define TSI_X509_URI_PEER_PROPERTY "x509_uri"
 #define TSI_X509_EMAIL_PEER_PROPERTY "x509_email"
 #define TSI_X509_IP_PEER_PROPERTY "x509_ip"
+#define TSI_X509_VERIFIED_ROOT_CERT_SUBECT_PEER_PROPERTY \
+  "x509_verified_root_cert_subject"
 
 // --- tsi_ssl_root_certs_store object ---
 
@@ -403,4 +405,4 @@ tsi_result tsi_ssl_extract_x509_subject_names_from_pem_cert(
 tsi_result tsi_ssl_get_cert_chain_contents(STACK_OF(X509) * peer_chain,
                                            tsi_peer_property* property);
 
-#endif  // GRPC_CORE_TSI_SSL_TRANSPORT_SECURITY_H
+#endif  // GRPC_SRC_CORE_TSI_SSL_TRANSPORT_SECURITY_H

data/src/core/tsi/ssl_transport_security_utils.h

@@ -16,8 +16,8 @@
 //
 //
 
-#ifndef GRPC_CORE_TSI_SSL_TRANSPORT_SECURITY_UTILS_H
-#define GRPC_CORE_TSI_SSL_TRANSPORT_SECURITY_UTILS_H
+#ifndef GRPC_SRC_CORE_TSI_SSL_TRANSPORT_SECURITY_UTILS_H
+#define GRPC_SRC_CORE_TSI_SSL_TRANSPORT_SECURITY_UTILS_H
 
 #include <grpc/support/port_platform.h>
 
@@ -144,4 +144,4 @@ tsi_result SslProtectorUnprotect(const unsigned char* protected_frames_bytes,
 
 }  // namespace grpc_core
 
-#endif  // GRPC_CORE_TSI_SSL_TRANSPORT_SECURITY_UTILS_H
+#endif  // GRPC_SRC_CORE_TSI_SSL_TRANSPORT_SECURITY_UTILS_H

data/src/core/tsi/ssl_types.h

@@ -16,8 +16,8 @@
 //
 //
 
-#ifndef GRPC_CORE_TSI_SSL_TYPES_H
-#define GRPC_CORE_TSI_SSL_TYPES_H
+#ifndef GRPC_SRC_CORE_TSI_SSL_TYPES_H
+#define GRPC_SRC_CORE_TSI_SSL_TYPES_H
 
 // A collection of macros to cast between various integer types that are
 // used differently between BoringSSL and OpenSSL:
@@ -39,4 +39,4 @@
 #define TSI_SIZE_AS_SIZE(x) ((int)(x))
 #endif
 
-#endif  // GRPC_CORE_TSI_SSL_TYPES_H
+#endif  // GRPC_SRC_CORE_TSI_SSL_TYPES_H

data/src/core/tsi/transport_security.h

@@ -16,8 +16,8 @@
 //
 //
 
-#ifndef GRPC_CORE_TSI_TRANSPORT_SECURITY_H
-#define GRPC_CORE_TSI_TRANSPORT_SECURITY_H
+#ifndef GRPC_SRC_CORE_TSI_TRANSPORT_SECURITY_H
+#define GRPC_SRC_CORE_TSI_TRANSPORT_SECURITY_H
 
 #include <grpc/support/port_platform.h>
 
@@ -140,4 +140,4 @@ const tsi_peer_property* tsi_peer_get_property_by_name(const tsi_peer* peer,
 // Utils.
 char* tsi_strdup(const char* src);  // Sadly, no strdup in C89.
 
-#endif  // GRPC_CORE_TSI_TRANSPORT_SECURITY_H
+#endif  // GRPC_SRC_CORE_TSI_TRANSPORT_SECURITY_H

data/src/core/tsi/transport_security_grpc.h

@@ -16,8 +16,8 @@
 //
 //
 
-#ifndef GRPC_CORE_TSI_TRANSPORT_SECURITY_GRPC_H
-#define GRPC_CORE_TSI_TRANSPORT_SECURITY_GRPC_H
+#ifndef GRPC_SRC_CORE_TSI_TRANSPORT_SECURITY_GRPC_H
+#define GRPC_SRC_CORE_TSI_TRANSPORT_SECURITY_GRPC_H
 
 #include <grpc/support/port_platform.h>
 
@@ -80,4 +80,4 @@ struct tsi_zero_copy_grpc_protector {
   const tsi_zero_copy_grpc_protector_vtable* vtable;
 };
 
-#endif  // GRPC_CORE_TSI_TRANSPORT_SECURITY_GRPC_H
+#endif  // GRPC_SRC_CORE_TSI_TRANSPORT_SECURITY_GRPC_H

data/src/core/tsi/transport_security_interface.h

@@ -16,8 +16,8 @@
 //
 //
 
-#ifndef GRPC_CORE_TSI_TRANSPORT_SECURITY_INTERFACE_H
-#define GRPC_CORE_TSI_TRANSPORT_SECURITY_INTERFACE_H
+#ifndef GRPC_SRC_CORE_TSI_TRANSPORT_SECURITY_INTERFACE_H
+#define GRPC_SRC_CORE_TSI_TRANSPORT_SECURITY_INTERFACE_H
 
 #include <grpc/support/port_platform.h>
 
@@ -518,4 +518,4 @@ void tsi_init();
 // This method destroys the shared objects created by tsi_init.
 void tsi_destroy();
 
-#endif  // GRPC_CORE_TSI_TRANSPORT_SECURITY_INTERFACE_H
+#endif  // GRPC_SRC_CORE_TSI_TRANSPORT_SECURITY_INTERFACE_H

data/src/ruby/lib/grpc/version.rb

@@ -14,5 +14,5 @@
 
 # GRPC contains the General RPC module.
 module GRPC
-  VERSION = '1.52.2'
+  VERSION = '1.53.0.pre2'
 end

data/src/ruby/pb/generate_proto_ruby.sh

@@ -33,12 +33,6 @@ $PROTOC -I . \
     --ruby_out=src/ruby/pb \
     --plugin=$PLUGIN
 
-$PROTOC -I . \
-    src/proto/grpc/core/stats.proto \
-    --grpc_out=src/ruby/qps \
-    --ruby_out=src/ruby/qps \
-    --plugin=$PLUGIN
-
 $PROTOC -I . \
     -I third_party/protobuf/src \
     src/proto/grpc/testing/{messages,payloads,stats,benchmark_service,report_qps_scenario_service,worker_service,control}.proto \