grpc 1.55.0 → 1.58.0

data/src/core/lib/security/authorization/rbac_policy.cc

@@ -22,6 +22,7 @@
 
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
+#include "absl/strings/string_view.h"
 
 namespace grpc_core {
 
@@ -29,26 +30,57 @@ namespace grpc_core {
 // Rbac
 //
 
-Rbac::Rbac(Rbac::Action action, std::map<std::string, Policy> policies)
-    : action(action), policies(std::move(policies)) {}
+Rbac::Rbac(std::string name, Rbac::Action action,
+           std::map<std::string, Policy> policies)
+    : name(std::move(name)),
+      action(action),
+      policies(std::move(policies)),
+      audit_condition(Rbac::AuditCondition::kNone) {}
 
 Rbac::Rbac(Rbac&& other) noexcept
-    : action(other.action), policies(std::move(other.policies)) {}
+    : name(std::move(other.name)),
+      action(other.action),
+      policies(std::move(other.policies)),
+      audit_condition(other.audit_condition),
+      logger_configs(std::move(other.logger_configs)) {}
 
 Rbac& Rbac::operator=(Rbac&& other) noexcept {
+  name = std::move(other.name);
   action = other.action;
   policies = std::move(other.policies);
+  audit_condition = other.audit_condition;
+  logger_configs = std::move(other.logger_configs);
   return *this;
 }
 
 std::string Rbac::ToString() const {
   std::vector<std::string> contents;
+  absl::string_view condition_str;
+  switch (audit_condition) {
+    case Rbac::AuditCondition::kNone:
+      condition_str = "None";
+      break;
+    case AuditCondition::kOnDeny:
+      condition_str = "OnDeny";
+      break;
+    case AuditCondition::kOnAllow:
+      condition_str = "OnAllow";
+      break;
+    case AuditCondition::kOnDenyAndAllow:
+      condition_str = "OnDenyAndAllow";
+      break;
+  }
   contents.push_back(absl::StrFormat(
-      "Rbac action=%s{", action == Rbac::Action::kAllow ? "Allow" : "Deny"));
+      "Rbac name=%s action=%s audit_condition=%s{", name,
+      action == Rbac::Action::kAllow ? "Allow" : "Deny", condition_str));
   for (const auto& p : policies) {
     contents.push_back(absl::StrFormat("{\n  policy_name=%s\n%s\n}", p.first,
                                        p.second.ToString()));
   }
+  for (const auto& config : logger_configs) {
+    contents.push_back(absl::StrFormat("{\n  audit_logger=%s\n%s\n}",
+                                       config->name(), config->ToString()));
+  }
   contents.push_back("}");
   return absl::StrJoin(contents, "\n");
 }

data/src/core/lib/security/authorization/rbac_policy.h

@@ -26,18 +26,27 @@
 
 #include "absl/types/optional.h"
 
+#include <grpc/grpc_audit_logging.h>
+
 #include "src/core/lib/matchers/matchers.h"
 
 namespace grpc_core {
 
 // Represents Envoy RBAC Proto. [See
-// https://github.com/envoyproxy/envoy/blob/release/v1.17/api/envoy/config/rbac/v3/rbac.proto]
+// https://github.com/envoyproxy/envoy/blob/release/v1.26/api/envoy/config/rbac/v3/rbac.proto]
 struct Rbac {
   enum class Action {
     kAllow,
     kDeny,
   };
 
+  enum class AuditCondition {
+    kNone,
+    kOnDeny,
+    kOnAllow,
+    kOnDenyAndAllow,
+  };
+
   struct CidrRange {
     CidrRange() = default;
     CidrRange(std::string address_prefix, uint32_t prefix_len);
@@ -162,15 +171,23 @@ struct Rbac {
   };
 
   Rbac() = default;
-  Rbac(Rbac::Action action, std::map<std::string, Policy> policies);
+  Rbac(std::string name, Rbac::Action action,
+       std::map<std::string, Policy> policies);
 
   Rbac(Rbac&& other) noexcept;
   Rbac& operator=(Rbac&& other) noexcept;
 
   std::string ToString() const;
 
+  // The authorization policy name or empty string in xDS case.
+  std::string name;
+
   Action action;
   std::map<std::string, Policy> policies;
+
+  AuditCondition audit_condition;
+  std::vector<std::unique_ptr<experimental::AuditLoggerFactory::Config>>
+      logger_configs;
 };
 
 }  // namespace grpc_core

data/src/core/lib/security/authorization/stdout_logger.cc

@@ -0,0 +1,75 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/stdout_logger.h"
+
+#include <cstdio>
+#include <initializer_list>
+#include <memory>
+#include <string>
+
+#include "absl/status/statusor.h"
+#include "absl/strings/str_format.h"
+#include "absl/strings/string_view.h"
+#include "absl/time/clock.h"
+#include "absl/time/time.h"
+
+#include <grpc/grpc_audit_logging.h>
+#include <grpc/support/json.h>
+#include <grpc/support/log.h>
+
+namespace grpc_core {
+namespace experimental {
+
+namespace {
+
+constexpr absl::string_view kName = "stdout_logger";
+constexpr char kLogFormat[] =
+    "{\"grpc_audit_log\":{\"timestamp\":\"%s\",\"rpc_method\":\"%s\","
+    "\"principal\":\"%s\",\"policy_name\":\"%s\",\"matched_rule\":\"%s\","
+    "\"authorized\":%s}}\n";
+
+}  // namespace
+
+void StdoutAuditLogger::Log(const AuditContext& context) {
+  absl::FPrintF(stdout, kLogFormat, absl::FormatTime(absl::Now()),
+                context.rpc_method(), context.principal(),
+                context.policy_name(), context.matched_rule(),
+                context.authorized() ? "true" : "false");
+}
+
+absl::string_view StdoutAuditLoggerFactory::Config::name() const {
+  return kName;
+}
+
+std::string StdoutAuditLoggerFactory::Config::ToString() const { return "{}"; }
+
+absl::string_view StdoutAuditLoggerFactory::name() const { return kName; }
+
+absl::StatusOr<std::unique_ptr<AuditLoggerFactory::Config>>
+StdoutAuditLoggerFactory::ParseAuditLoggerConfig(const Json&) {
+  return std::make_unique<StdoutAuditLoggerFactory::Config>();
+}
+
+std::unique_ptr<AuditLogger> StdoutAuditLoggerFactory::CreateAuditLogger(
+    std::unique_ptr<AuditLoggerFactory::Config> config) {
+  // Sanity check.
+  GPR_ASSERT(config != nullptr && config->name() == name());
+  return std::make_unique<StdoutAuditLogger>();
+}
+
+}  // namespace experimental
+}  // namespace grpc_core

data/src/core/lib/security/authorization/stdout_logger.h

@@ -0,0 +1,61 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_STDOUT_LOGGER_H
+#define GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_STDOUT_LOGGER_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+#include <string>
+
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
+#include <grpc/grpc_audit_logging.h>
+#include <grpc/support/json.h>
+
+namespace grpc_core {
+namespace experimental {
+
+class StdoutAuditLogger : public AuditLogger {
+ public:
+  StdoutAuditLogger() = default;
+  absl::string_view name() const override { return "stdout_logger"; }
+  void Log(const AuditContext&) override;
+};
+
+class StdoutAuditLoggerFactory : public AuditLoggerFactory {
+ public:
+  class Config : public AuditLoggerFactory::Config {
+   public:
+    Config() = default;
+    absl::string_view name() const override;
+    std::string ToString() const override;
+  };
+  StdoutAuditLoggerFactory() = default;
+
+  absl::string_view name() const override;
+
+  absl::StatusOr<std::unique_ptr<AuditLoggerFactory::Config>>
+  ParseAuditLoggerConfig(const Json& json) override;
+
+  std::unique_ptr<AuditLogger> CreateAuditLogger(
+      std::unique_ptr<AuditLoggerFactory::Config>) override;
+};
+
+}  // namespace experimental
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_STDOUT_LOGGER_H

data/src/core/lib/security/certificate_provider/certificate_provider_factory.h

@@ -23,12 +23,15 @@
 
 #include <string>
 
+#include "absl/strings/string_view.h"
+
 #include <grpc/grpc_security.h>
 
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/gprpp/validation_errors.h"
 #include "src/core/lib/json/json.h"
+#include "src/core/lib/json/json_args.h"
 
 namespace grpc_core {
 
@@ -43,7 +46,7 @@ class CertificateProviderFactory {
 
     // Name of the type of the CertificateProvider. Unique to each type of
     // config.
-    virtual const char* name() const = 0;
+    virtual absl::string_view name() const = 0;
 
     virtual std::string ToString() const = 0;
   };
@@ -51,10 +54,11 @@ class CertificateProviderFactory {
   virtual ~CertificateProviderFactory() = default;
 
   // Name of the plugin.
-  virtual const char* name() const = 0;
+  virtual absl::string_view name() const = 0;
 
   virtual RefCountedPtr<Config> CreateCertificateProviderConfig(
-      const Json& config_json, grpc_error_handle* error) = 0;
+      const Json& config_json, const JsonArgs& args,
+      ValidationErrors* errors) = 0;
 
   // Create a CertificateProvider instance from config.
   virtual RefCountedPtr<grpc_tls_certificate_provider>

data/src/core/lib/security/certificate_provider/certificate_provider_registry.cc

@@ -20,11 +20,8 @@
 
 #include "src/core/lib/security/certificate_provider/certificate_provider_registry.h"
 
-#include <string.h>
-
-#include <algorithm>
+#include <string>
 #include <utility>
-#include <vector>
 
 #include <grpc/support/log.h>
 
@@ -32,29 +29,22 @@ namespace grpc_core {
 
 void CertificateProviderRegistry::Builder::RegisterCertificateProviderFactory(
     std::unique_ptr<CertificateProviderFactory> factory) {
+  absl::string_view name = factory->name();
   gpr_log(GPR_DEBUG, "registering certificate provider factory for \"%s\"",
-          factory->name());
-  for (size_t i = 0; i < factories_.size(); ++i) {
-    GPR_ASSERT(strcmp(factories_[i]->name(), factory->name()) != 0);
-  }
-  factories_.push_back(std::move(factory));
+          std::string(name).c_str());
+  GPR_ASSERT(factories_.emplace(name, std::move(factory)).second);
 }
 
 CertificateProviderRegistry CertificateProviderRegistry::Builder::Build() {
-  CertificateProviderRegistry r;
-  r.factories_ = std::move(factories_);
-  return r;
+  return CertificateProviderRegistry(std::move(factories_));
 }
 
 CertificateProviderFactory*
 CertificateProviderRegistry::LookupCertificateProviderFactory(
     absl::string_view name) const {
-  for (size_t i = 0; i < factories_.size(); ++i) {
-    if (name == factories_[i]->name()) {
-      return factories_[i].get();
-    }
-  }
-  return nullptr;
+  auto it = factories_.find(name);
+  if (it == factories_.end()) return nullptr;
+  return it->second.get();
 }
 
 }  // namespace grpc_core

data/src/core/lib/security/certificate_provider/certificate_provider_registry.h

@@ -21,8 +21,9 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <map>
 #include <memory>
-#include <vector>
+#include <utility>
 
 #include "absl/strings/string_view.h"
 
@@ -32,20 +33,24 @@ namespace grpc_core {
 
 // Global registry for all the certificate provider plugins.
 class CertificateProviderRegistry {
+ private:
+  using FactoryMap =
+      std::map<absl::string_view, std::unique_ptr<CertificateProviderFactory>>;
+
  public:
   class Builder {
    public:
-    // Register a provider with the registry. Can only be called after calling
-    // InitRegistry(). The key of the factory is extracted from factory
-    // parameter with method CertificateProviderFactory::name. If the same key
-    // is registered twice, an exception is raised.
+    // Register a provider with the registry. The key of the factory is
+    // extracted from factory parameter with method
+    // CertificateProviderFactory::name. The registry with a given name
+    // cannot be registered twice.
     void RegisterCertificateProviderFactory(
         std::unique_ptr<CertificateProviderFactory> factory);
 
     CertificateProviderRegistry Build();
 
    private:
-    std::vector<std::unique_ptr<CertificateProviderFactory>> factories_;
+    FactoryMap factories_;
   };
 
   CertificateProviderRegistry(const CertificateProviderRegistry&) = delete;
@@ -60,9 +65,10 @@ class CertificateProviderRegistry {
       absl::string_view name) const;
 
  private:
-  CertificateProviderRegistry() = default;
+  explicit CertificateProviderRegistry(FactoryMap factories)
+      : factories_(std::move(factories)) {}
 
-  std::vector<std::unique_ptr<CertificateProviderFactory>> factories_;
+  FactoryMap factories_;
 };
 
 }  // namespace grpc_core

data/src/core/lib/security/credentials/channel_creds_registry.h

@@ -21,81 +21,105 @@
 
 #include <map>
 #include <memory>
-#include <string>
 #include <type_traits>
+#include <utility>
 
 #include "absl/strings/string_view.h"
 
+#include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/validation_errors.h"
 #include "src/core/lib/json/json.h"
+#include "src/core/lib/json/json_args.h"
 
 struct grpc_channel_credentials;
 
 namespace grpc_core {
 
+class ChannelCredsConfig : public RefCounted<ChannelCredsConfig> {
+ public:
+  virtual absl::string_view type() const = 0;
+
+  virtual bool Equals(const ChannelCredsConfig& other) const = 0;
+
+  virtual Json ToJson() const = 0;
+};
+
 template <typename T = grpc_channel_credentials>
 class ChannelCredsFactory final {
  public:
   virtual ~ChannelCredsFactory() {}
-  virtual absl::string_view creds_type() const = delete;
-  virtual bool IsValidConfig(const Json& config) const = delete;
-  virtual RefCountedPtr<T> CreateChannelCreds(const Json& config) const =
-      delete;
+  virtual absl::string_view type() const = delete;
+  virtual RefCountedPtr<ChannelCredsConfig> ParseConfig(
+      const Json& config, const JsonArgs& args,
+      ValidationErrors* errors) const = delete;
+  virtual RefCountedPtr<T> CreateChannelCreds(
+      RefCountedPtr<ChannelCredsConfig> config) const = delete;
 };
 
 template <>
 class ChannelCredsFactory<grpc_channel_credentials> {
  public:
   virtual ~ChannelCredsFactory() {}
-  virtual absl::string_view creds_type() const = 0;
-  virtual bool IsValidConfig(const Json& config) const = 0;
+  virtual absl::string_view type() const = 0;
+  virtual RefCountedPtr<ChannelCredsConfig> ParseConfig(
+      const Json& config, const JsonArgs& args,
+      ValidationErrors* errors) const = 0;
   virtual RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
-      const Json& config) const = 0;
+      RefCountedPtr<ChannelCredsConfig> config) const = 0;
 };
 
 template <typename T = grpc_channel_credentials>
 class ChannelCredsRegistry {
+ private:
+  using FactoryMap =
+      std::map<absl::string_view, std::unique_ptr<ChannelCredsFactory<T>>>;
+
  public:
   static_assert(std::is_base_of<grpc_channel_credentials, T>::value,
                 "ChannelCredsRegistry must be instantiated with "
                 "grpc_channel_credentials.");
+
   class Builder {
    public:
     void RegisterChannelCredsFactory(
         std::unique_ptr<ChannelCredsFactory<T>> factory) {
-      factories_[factory->creds_type()] = std::move(factory);
+      absl::string_view type = factory->type();
+      factories_[type] = std::move(factory);
     }
     ChannelCredsRegistry Build() {
-      ChannelCredsRegistry<T> registry;
-      registry.factories_.swap(factories_);
-      return registry;
+      return ChannelCredsRegistry<T>(std::move(factories_));
     }
 
    private:
-    std::map<absl::string_view, std::unique_ptr<ChannelCredsFactory<T>>>
-        factories_;
+    FactoryMap factories_;
   };
 
-  bool IsSupported(const std::string& creds_type) const {
-    return factories_.find(creds_type) != factories_.end();
+  bool IsSupported(absl::string_view type) const {
+    return factories_.find(type) != factories_.end();
   }
 
-  bool IsValidConfig(const std::string& creds_type, const Json& config) const {
-    const auto iter = factories_.find(creds_type);
-    return iter != factories_.cend() && iter->second->IsValidConfig(config);
+  RefCountedPtr<ChannelCredsConfig> ParseConfig(
+      absl::string_view type, const Json& config, const JsonArgs& args,
+      ValidationErrors* errors) const {
+    const auto it = factories_.find(type);
+    if (it == factories_.cend()) return nullptr;
+    return it->second->ParseConfig(config, args, errors);
   }
 
-  RefCountedPtr<T> CreateChannelCreds(const std::string& creds_type,
-                                      const Json& config) const {
-    const auto iter = factories_.find(creds_type);
-    if (iter == factories_.cend()) return nullptr;
-    return iter->second->CreateChannelCreds(config);
+  RefCountedPtr<T> CreateChannelCreds(
+      RefCountedPtr<ChannelCredsConfig> config) const {
+    if (config == nullptr) return nullptr;
+    const auto it = factories_.find(config->type());
+    if (it == factories_.cend()) return nullptr;
+    return it->second->CreateChannelCreds(std::move(config));
   }
 
  private:
-  ChannelCredsRegistry() = default;
-  std::map<absl::string_view, std::unique_ptr<ChannelCredsFactory<T>>>
-      factories_;
+  explicit ChannelCredsRegistry(FactoryMap factories)
+      : factories_(std::move(factories)) {}
+
+  FactoryMap factories_;
 };
 
 }  // namespace grpc_core