grpc 1.55.0 → 1.58.0

data/src/core/ext/filters/rbac/rbac_filter.cc

@@ -18,20 +18,22 @@
 
 #include "src/core/ext/filters/rbac/rbac_filter.h"
 
-#include <new>
+#include <functional>
+#include <memory>
 #include <utility>
 
 #include "absl/status/status.h"
 
 #include <grpc/grpc_security.h>
-#include <grpc/status.h>
-#include <grpc/support/log.h>
 
 #include "src/core/ext/filters/rbac/rbac_service_config_parser.h"
 #include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/channel/channel_stack.h"
+#include "src/core/lib/channel/context.h"
 #include "src/core/lib/config/core_configuration.h"
-#include "src/core/lib/gprpp/debug_location.h"
-#include "src/core/lib/gprpp/status_helper.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/promise/context.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/authorization/authorization_engine.h"
 #include "src/core/lib/security/authorization/grpc_authorization_engine.h"
 #include "src/core/lib/security/context/security_context.h"
@@ -41,101 +43,34 @@
 
 namespace grpc_core {
 
-//
-// RbacFilter::CallData
-//
-
-// CallData
-
-grpc_error_handle RbacFilter::CallData::Init(
-    grpc_call_element* elem, const grpc_call_element_args* args) {
-  new (elem->call_data) CallData(elem, *args);
-  return absl::OkStatus();
-}
-
-void RbacFilter::CallData::Destroy(grpc_call_element* elem,
-                                   const grpc_call_final_info* /*final_info*/,
-                                   grpc_closure* /*then_schedule_closure*/) {
-  auto* calld = static_cast<CallData*>(elem->call_data);
-  calld->~CallData();
-}
-
-void RbacFilter::CallData::StartTransportStreamOpBatch(
-    grpc_call_element* elem, grpc_transport_stream_op_batch* op) {
-  CallData* calld = static_cast<CallData*>(elem->call_data);
-  if (op->recv_initial_metadata) {
-    calld->recv_initial_metadata_ =
-        op->payload->recv_initial_metadata.recv_initial_metadata;
-    calld->original_recv_initial_metadata_ready_ =
-        op->payload->recv_initial_metadata.recv_initial_metadata_ready;
-    op->payload->recv_initial_metadata.recv_initial_metadata_ready =
-        &calld->recv_initial_metadata_ready_;
-  }
-  // Chain to the next filter.
-  grpc_call_next_op(elem, op);
-}
-
-RbacFilter::CallData::CallData(grpc_call_element* elem,
-                               const grpc_call_element_args& args)
-    : call_context_(args.context) {
-  GRPC_CLOSURE_INIT(&recv_initial_metadata_ready_, RecvInitialMetadataReady,
-                    elem, grpc_schedule_on_exec_ctx);
-}
-
-void RbacFilter::CallData::RecvInitialMetadataReady(void* user_data,
-                                                    grpc_error_handle error) {
-  grpc_call_element* elem = static_cast<grpc_call_element*>(user_data);
-  CallData* calld = static_cast<CallData*>(elem->call_data);
-  RbacFilter* filter = static_cast<RbacFilter*>(elem->channel_data);
-  if (error.ok()) {
-    // Fetch and apply the rbac policy from the service config.
-    auto* service_config_call_data = static_cast<ServiceConfigCallData*>(
-        calld->call_context_[GRPC_CONTEXT_SERVICE_CONFIG_CALL_DATA].value);
-    auto* method_params = static_cast<RbacMethodParsedConfig*>(
-        service_config_call_data->GetMethodParsedConfig(
-            filter->service_config_parser_index_));
-    if (method_params == nullptr) {
-      error = GRPC_ERROR_CREATE("No RBAC policy found.");
-    } else {
-      RbacFilter* chand = static_cast<RbacFilter*>(elem->channel_data);
-      auto* authorization_engine =
-          method_params->authorization_engine(chand->index_);
-      if (authorization_engine
-              ->Evaluate(EvaluateArgs(calld->recv_initial_metadata_,
-                                      &chand->per_channel_evaluate_args_))
-              .type == AuthorizationEngine::Decision::Type::kDeny) {
-        error = GRPC_ERROR_CREATE("Unauthorized RPC rejected");
-      }
-    }
-    if (!error.ok()) {
-      error = grpc_error_set_int(error, StatusIntProperty::kRpcStatus,
-                                 GRPC_STATUS_PERMISSION_DENIED);
+ArenaPromise<ServerMetadataHandle> RbacFilter::MakeCallPromise(
+    CallArgs call_args, NextPromiseFactory next_promise_factory) {
+  // Fetch and apply the rbac policy from the service config.
+  auto* service_config_call_data = static_cast<ServiceConfigCallData*>(
+      GetContext<
+          grpc_call_context_element>()[GRPC_CONTEXT_SERVICE_CONFIG_CALL_DATA]
+          .value);
+  auto* method_params = static_cast<RbacMethodParsedConfig*>(
+      service_config_call_data->GetMethodParsedConfig(
+          service_config_parser_index_));
+  if (method_params == nullptr) {
+    return Immediate(ServerMetadataFromStatus(
+        absl::PermissionDeniedError("No RBAC policy found.")));
+  } else {
+    auto* authorization_engine = method_params->authorization_engine(index_);
+    if (authorization_engine
+            ->Evaluate(EvaluateArgs(call_args.client_initial_metadata.get(),
+                                    &per_channel_evaluate_args_))
+            .type == AuthorizationEngine::Decision::Type::kDeny) {
+      return Immediate(ServerMetadataFromStatus(
+          absl::PermissionDeniedError("Unauthorized RPC rejected")));
     }
   }
-  grpc_closure* closure = calld->original_recv_initial_metadata_ready_;
-  calld->original_recv_initial_metadata_ready_ = nullptr;
-  Closure::Run(DEBUG_LOCATION, closure, error);
+  return next_promise_factory(std::move(call_args));
 }
 
-//
-// RbacFilter
-//
-
-const grpc_channel_filter RbacFilter::kFilterVtable = {
-    RbacFilter::CallData::StartTransportStreamOpBatch,
-    nullptr,
-    grpc_channel_next_op,
-    sizeof(RbacFilter::CallData),
-    RbacFilter::CallData::Init,
-    grpc_call_stack_ignore_set_pollset_or_pollset_set,
-    RbacFilter::CallData::Destroy,
-    sizeof(RbacFilter),
-    RbacFilter::Init,
-    grpc_channel_stack_no_post_init,
-    RbacFilter::Destroy,
-    grpc_channel_next_get_info,
-    "rbac_filter",
-};
+const grpc_channel_filter RbacFilter::kFilterVtable =
+    MakePromiseBasedFilter<RbacFilter, FilterEndpoint::kServer>("rbac_filter");
 
 RbacFilter::RbacFilter(size_t index,
                        EvaluateArgs::PerChannelArgs per_channel_evaluate_args)
@@ -143,29 +78,23 @@ RbacFilter::RbacFilter(size_t index,
       service_config_parser_index_(RbacServiceConfigParser::ParserIndex()),
       per_channel_evaluate_args_(std::move(per_channel_evaluate_args)) {}
 
-grpc_error_handle RbacFilter::Init(grpc_channel_element* elem,
-                                   grpc_channel_element_args* args) {
-  GPR_ASSERT(elem->filter == &kFilterVtable);
-  auto* auth_context = args->channel_args.GetObject<grpc_auth_context>();
+absl::StatusOr<RbacFilter> RbacFilter::Create(const ChannelArgs& args,
+                                              ChannelFilter::Args filter_args) {
+  auto* auth_context = args.GetObject<grpc_auth_context>();
   if (auth_context == nullptr) {
     return GRPC_ERROR_CREATE("No auth context found");
   }
-  auto* transport = args->channel_args.GetObject<grpc_transport>();
+  auto* transport = args.GetObject<grpc_transport>();
   if (transport == nullptr) {
     // This should never happen since the transport is always set on the server
     // side.
     return GRPC_ERROR_CREATE("No transport configured");
   }
-  new (elem->channel_data) RbacFilter(
-      grpc_channel_stack_filter_instance_number(args->channel_stack, elem),
-      EvaluateArgs::PerChannelArgs(auth_context,
-                                   grpc_transport_get_endpoint(transport)));
-  return absl::OkStatus();
-}
-
-void RbacFilter::Destroy(grpc_channel_element* elem) {
-  auto* chand = static_cast<RbacFilter*>(elem->channel_data);
-  chand->~RbacFilter();
+  return RbacFilter(grpc_channel_stack_filter_instance_number(
+                        filter_args.channel_stack(),
+                        filter_args.uninitialized_channel_element()),
+                    EvaluateArgs::PerChannelArgs(
+                        auth_context, grpc_transport_get_endpoint(transport)));
 }
 
 void RbacFilterRegister(CoreConfiguration::Builder* builder) {

data/src/core/ext/filters/rbac/rbac_filter.h

@@ -21,20 +21,20 @@
 
 #include <stddef.h>
 
+#include "absl/status/statusor.h"
+
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
-#include "src/core/lib/channel/channel_stack.h"
-#include "src/core/lib/channel/context.h"
-#include "src/core/lib/iomgr/closure.h"
-#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/authorization/evaluate_args.h"
-#include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/lib/transport/transport.h"
 
 namespace grpc_core {
 
 // Filter used when xDS server config fetcher provides a configuration with an
 // HTTP RBAC filter. Also serves as the type for channel data for the filter.
-class RbacFilter {
+class RbacFilter : public ChannelFilter {
  public:
   // This channel filter is intended to be used by connections on xDS enabled
   // servers configured with RBAC. The RBAC filter fetches the RBAC policy from
@@ -42,34 +42,16 @@ class RbacFilter {
   // and enforces the RBAC policy.
   static const grpc_channel_filter kFilterVtable;
 
- private:
-  class CallData {
-   public:
-    static grpc_error_handle Init(grpc_call_element* elem,
-                                  const grpc_call_element_args* args);
-    static void Destroy(grpc_call_element* elem,
-                        const grpc_call_final_info* /* final_info */,
-                        grpc_closure* /* then_schedule_closure */);
-    static void StartTransportStreamOpBatch(grpc_call_element* elem,
-                                            grpc_transport_stream_op_batch* op);
-
-   private:
-    CallData(grpc_call_element* elem, const grpc_call_element_args& args);
-    static void RecvInitialMetadataReady(void* user_data,
-                                         grpc_error_handle error);
+  static absl::StatusOr<RbacFilter> Create(const ChannelArgs& args,
+                                           ChannelFilter::Args filter_args);
 
-    grpc_call_context_element* call_context_;
-    // State for keeping track of recv_initial_metadata
-    grpc_metadata_batch* recv_initial_metadata_ = nullptr;
-    grpc_closure* original_recv_initial_metadata_ready_ = nullptr;
-    grpc_closure recv_initial_metadata_ready_;
-  };
+  // Construct a promise for one call.
+  ArenaPromise<ServerMetadataHandle> MakeCallPromise(
+      CallArgs call_args, NextPromiseFactory next_promise_factory) override;
 
+ private:
   RbacFilter(size_t index,
              EvaluateArgs::PerChannelArgs per_channel_evaluate_args);
-  static grpc_error_handle Init(grpc_channel_element* elem,
-                                grpc_channel_element_args* args);
-  static void Destroy(grpc_channel_element* elem);
 
   // The index of this filter instance among instances of the same filter.
   size_t index_;

data/src/core/ext/filters/rbac/rbac_service_config_parser.cc

@@ -20,21 +20,29 @@
 
 #include <cstdint>
 #include <map>
+#include <memory>
 #include <string>
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/str_cat.h"
 #include "absl/types/optional.h"
 
+#include <grpc/grpc_audit_logging.h>
+
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/json/json_args.h"
 #include "src/core/lib/json/json_object_loader.h"
 #include "src/core/lib/matchers/matchers.h"
+#include "src/core/lib/security/authorization/audit_logging.h"
 
 namespace grpc_core {
 
 namespace {
 
+using experimental::AuditLoggerFactory;
+using experimental::AuditLoggerRegistry;
+
 // RbacConfig: one or more RbacPolicy structs
 struct RbacConfig {
   // RbacPolicy: optional Rules
@@ -179,10 +187,29 @@ struct RbacConfig {
         static const JsonLoaderInterface* JsonLoader(const JsonArgs&);
       };
 
+      // AuditLogger: the name of logger and its config in json
+      struct AuditLogger {
+        std::string name;
+        Json::Object config;
+
+        AuditLogger() = default;
+        AuditLogger(const AuditLogger&) = delete;
+        AuditLogger& operator=(const AuditLogger&) = delete;
+        AuditLogger(AuditLogger&&) = default;
+        AuditLogger& operator=(AuditLogger&&) = default;
+
+        static const JsonLoaderInterface* JsonLoader(const JsonArgs&);
+        void JsonPostLoad(const Json&, const JsonArgs&,
+                          ValidationErrors* errors);
+      };
+
       int action;
       std::map<std::string, Policy> policies;
+      // Defaults to kNone since its json field is optional.
+      Rbac::AuditCondition audit_condition = Rbac::AuditCondition::kNone;
+      std::vector<std::unique_ptr<AuditLoggerFactory::Config>> logger_configs;
 
-      Rules() = default;
+      Rules() {}
       Rules(const Rules&) = delete;
       Rules& operator=(const Rules&) = delete;
       Rules(Rules&&) = default;
@@ -715,6 +742,32 @@ const JsonLoaderInterface* RbacConfig::RbacPolicy::Rules::Policy::JsonLoader(
   return loader;
 }
 
+//
+// RbacConfig::RbacPolicy::Rules::AuditLogger
+//
+
+const JsonLoaderInterface*
+RbacConfig::RbacPolicy::Rules::AuditLogger::JsonLoader(const JsonArgs&) {
+  // All fields handled in JsonPostLoad().
+  static const auto* loader = JsonObjectLoader<AuditLogger>().Finish();
+  return loader;
+}
+
+void RbacConfig::RbacPolicy::Rules::AuditLogger::JsonPostLoad(
+    const Json& json, const JsonArgs& args, ValidationErrors* errors) {
+  // Should have exactly one field as the logger name.
+  if (json.object().size() != 1) {
+    errors->AddError("audit logger should have exactly one field");
+    return;
+  }
+  name = json.object().begin()->first;
+  auto config_or =
+      LoadJsonObjectField<Json::Object>(json.object(), args, name, errors);
+  if (config_or.has_value()) {
+    config = std::move(*config_or);
+  }
+}
+
 //
 // RbacConfig::RbacPolicy::Rules
 //
@@ -722,14 +775,17 @@ const JsonLoaderInterface* RbacConfig::RbacPolicy::Rules::Policy::JsonLoader(
 Rbac RbacConfig::RbacPolicy::Rules::TakeAsRbac() {
   Rbac rbac;
   rbac.action = static_cast<Rbac::Action>(action);
+  rbac.audit_condition = audit_condition;
   for (auto& p : policies) {
     rbac.policies.emplace(p.first, p.second.TakeAsRbacPolicy());
   }
+  rbac.logger_configs = std::move(logger_configs);
   return rbac;
 }
 
 const JsonLoaderInterface* RbacConfig::RbacPolicy::Rules::JsonLoader(
     const JsonArgs&) {
+  // Audit logger configs handled in post load.
   static const auto* loader = JsonObjectLoader<Rules>()
                                   .Field("action", &Rules::action)
                                   .OptionalField("policies", &Rules::policies)
@@ -737,7 +793,8 @@ const JsonLoaderInterface* RbacConfig::RbacPolicy::Rules::JsonLoader(
   return loader;
 }
 
-void RbacConfig::RbacPolicy::Rules::JsonPostLoad(const Json&, const JsonArgs&,
+void RbacConfig::RbacPolicy::Rules::JsonPostLoad(const Json& json,
+                                                 const JsonArgs& args,
                                                  ValidationErrors* errors) {
   // Validate action field.
   auto rbac_action = static_cast<Rbac::Action>(action);
@@ -746,6 +803,40 @@ void RbacConfig::RbacPolicy::Rules::JsonPostLoad(const Json&, const JsonArgs&,
     ValidationErrors::ScopedField field(errors, ".action");
     errors->AddError("unknown action");
   }
+  // Parse and validate audit_condition field.
+  auto condition = LoadJsonObjectField<int>(json.object(), args,
+                                            "audit_condition", errors, false);
+  if (condition.has_value()) {
+    switch (*condition) {
+      case static_cast<int>(Rbac::AuditCondition::kNone):
+      case static_cast<int>(Rbac::AuditCondition::kOnAllow):
+      case static_cast<int>(Rbac::AuditCondition::kOnDeny):
+      case static_cast<int>(Rbac::AuditCondition::kOnDenyAndAllow):
+        audit_condition = static_cast<Rbac::AuditCondition>(*condition);
+        break;
+      default: {
+        ValidationErrors::ScopedField field(errors, ".audit_condition");
+        errors->AddError("unknown audit condition");
+      }
+    }
+  }
+  // Parse and validate audit logger configs.
+  auto configs = LoadJsonObjectField<std::vector<AuditLogger>>(
+      json.object(), args, "audit_loggers", errors, false);
+  if (configs.has_value()) {
+    for (size_t i = 0; i < configs->size(); ++i) {
+      auto& logger = (*configs)[i];
+      auto config = AuditLoggerRegistry::ParseConfig(
+          logger.name, Json::FromObject(std::move(logger.config)));
+      if (!config.ok()) {
+        ValidationErrors::ScopedField field(
+            errors, absl::StrCat(".audit_loggers[", i, "]"));
+        errors->AddError(config.status().message());
+        continue;
+      }
+      logger_configs.push_back(std::move(*config));
+    }
+  }
 }
 
 //
@@ -756,7 +847,7 @@ Rbac RbacConfig::RbacPolicy::TakeAsRbac() {
   if (!rules.has_value()) {
     // No enforcing to be applied. An empty deny policy with an empty map
     // is equivalent to no enforcing.
-    return Rbac(Rbac::Action::kDeny, {});
+    return Rbac("", Rbac::Action::kDeny, {});
   }
   return rules->TakeAsRbac();
 }

data/src/core/ext/filters/server_config_selector/server_config_selector_filter.cc

@@ -38,6 +38,7 @@
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/resource_quota/arena.h"
+#include "src/core/lib/service_config/service_config.h"
 #include "src/core/lib/service_config/service_config_call_data.h"
 #include "src/core/lib/transport/transport.h"
 
@@ -139,14 +140,11 @@ ArenaPromise<ServerMetadataHandle> ServerConfigSelectorFilter::MakeCallPromise(
         absl::UnavailableError(StatusToString(call_config.status()))));
     return std::move(r);
   }
-  auto& ctx = GetContext<
-      grpc_call_context_element>()[GRPC_CONTEXT_SERVICE_CONFIG_CALL_DATA];
-  ctx.value = GetContext<Arena>()->New<ServiceConfigCallData>(
-      std::move(call_config->service_config), call_config->method_configs,
-      ServiceConfigCallData::CallAttributes{});
-  ctx.destroy = [](void* p) {
-    static_cast<ServiceConfigCallData*>(p)->~ServiceConfigCallData();
-  };
+  auto* service_config_call_data =
+      GetContext<Arena>()->New<ServiceConfigCallData>(
+          GetContext<Arena>(), GetContext<grpc_call_context_element>());
+  service_config_call_data->SetServiceConfig(
+      std::move(call_config->service_config), call_config->method_configs);
   return next_promise_factory(std::move(call_args));
 }