grpc 1.60.0 → 1.61.0

data/src/core/lib/security/credentials/xds/xds_credentials.cc

@@ -74,10 +74,8 @@ bool XdsVerifySubjectAlternativeNames(
 //
 
 XdsCertificateVerifier::XdsCertificateVerifier(
-    RefCountedPtr<XdsCertificateProvider> xds_certificate_provider,
-    std::string cluster_name)
-    : xds_certificate_provider_(std::move(xds_certificate_provider)),
-      cluster_name_(std::move(cluster_name)) {}
+    RefCountedPtr<XdsCertificateProvider> xds_certificate_provider)
+    : xds_certificate_provider_(std::move(xds_certificate_provider)) {}
 
 bool XdsCertificateVerifier::Verify(
     grpc_tls_custom_verification_check_request* request,
@@ -86,15 +84,15 @@ bool XdsCertificateVerifier::Verify(
   if (!XdsVerifySubjectAlternativeNames(
           request->peer_info.san_names.uri_names,
           request->peer_info.san_names.uri_names_size,
-          xds_certificate_provider_->GetSanMatchers(cluster_name_)) &&
+          xds_certificate_provider_->san_matchers()) &&
       !XdsVerifySubjectAlternativeNames(
           request->peer_info.san_names.ip_names,
           request->peer_info.san_names.ip_names_size,
-          xds_certificate_provider_->GetSanMatchers(cluster_name_)) &&
+          xds_certificate_provider_->san_matchers()) &&
       !XdsVerifySubjectAlternativeNames(
           request->peer_info.san_names.dns_names,
           request->peer_info.san_names.dns_names_size,
-          xds_certificate_provider_->GetSanMatchers(cluster_name_))) {
+          xds_certificate_provider_->san_matchers())) {
     *sync_status = absl::Status(
         absl::StatusCode::kUnauthenticated,
         "SANs from certificate did not match SANs from xDS control plane");
@@ -108,9 +106,12 @@ void XdsCertificateVerifier::Cancel(
 int XdsCertificateVerifier::CompareImpl(
     const grpc_tls_certificate_verifier* other) const {
   auto* o = static_cast<const XdsCertificateVerifier*>(other);
-  int r = QsortCompare(xds_certificate_provider_, o->xds_certificate_provider_);
-  if (r != 0) return r;
-  return cluster_name_.compare(o->cluster_name_);
+  if (xds_certificate_provider_ == nullptr ||
+      o->xds_certificate_provider_ == nullptr) {
+    return QsortCompare(xds_certificate_provider_,
+                        o->xds_certificate_provider_);
+  }
+  return xds_certificate_provider_->Compare(o->xds_certificate_provider_.get());
 }
 
 UniqueTypeName XdsCertificateVerifier::type() const {
@@ -140,12 +141,9 @@ XdsCredentials::create_security_connector(
   RefCountedPtr<grpc_channel_security_connector> security_connector;
   auto xds_certificate_provider = args->GetObjectRef<XdsCertificateProvider>();
   if (xds_certificate_provider != nullptr) {
-    std::string cluster_name(
-        args->GetString(GRPC_ARG_XDS_CLUSTER_NAME).value());
-    const bool watch_root =
-        xds_certificate_provider->ProvidesRootCerts(cluster_name);
+    const bool watch_root = xds_certificate_provider->ProvidesRootCerts();
     const bool watch_identity =
-        xds_certificate_provider->ProvidesIdentityCerts(cluster_name);
+        xds_certificate_provider->ProvidesIdentityCerts();
     if (watch_root || watch_identity) {
       auto tls_credentials_options =
           MakeRefCounted<grpc_tls_credentials_options>();
@@ -153,16 +151,14 @@ XdsCredentials::create_security_connector(
           xds_certificate_provider);
       if (watch_root) {
         tls_credentials_options->set_watch_root_cert(true);
-        tls_credentials_options->set_root_cert_name(cluster_name);
       }
       if (watch_identity) {
         tls_credentials_options->set_watch_identity_pair(true);
-        tls_credentials_options->set_identity_cert_name(cluster_name);
       }
       tls_credentials_options->set_verify_server_cert(true);
       tls_credentials_options->set_certificate_verifier(
-          MakeRefCounted<XdsCertificateVerifier>(xds_certificate_provider,
-                                                 std::move(cluster_name)));
+          MakeRefCounted<XdsCertificateVerifier>(
+              std::move(xds_certificate_provider)));
       tls_credentials_options->set_check_call_host(false);
       auto tls_credentials =
           MakeRefCounted<TlsCredentials>(std::move(tls_credentials_options));
@@ -189,20 +185,17 @@ XdsServerCredentials::create_security_connector(const ChannelArgs& args) {
   auto xds_certificate_provider = args.GetObjectRef<XdsCertificateProvider>();
   // Identity certs are a must for TLS.
   if (xds_certificate_provider != nullptr &&
-      xds_certificate_provider->ProvidesIdentityCerts("")) {
+      xds_certificate_provider->ProvidesIdentityCerts()) {
     auto tls_credentials_options =
         MakeRefCounted<grpc_tls_credentials_options>();
     tls_credentials_options->set_watch_identity_pair(true);
     tls_credentials_options->set_certificate_provider(xds_certificate_provider);
-    if (xds_certificate_provider->ProvidesRootCerts("")) {
+    if (xds_certificate_provider->ProvidesRootCerts()) {
       tls_credentials_options->set_watch_root_cert(true);
-      if (xds_certificate_provider->GetRequireClientCertificate("")) {
-        tls_credentials_options->set_cert_request_type(
-            GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY);
-      } else {
-        tls_credentials_options->set_cert_request_type(
-            GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY);
-      }
+      tls_credentials_options->set_cert_request_type(
+          xds_certificate_provider->require_client_certificate()
+              ? GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY
+              : GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY);
     } else {
       // Do not request client certificate if there is no way to verify.
       tls_credentials_options->set_cert_request_type(

data/src/core/lib/security/credentials/xds/xds_credentials.h

@@ -46,9 +46,8 @@ namespace grpc_core {
 
 class XdsCertificateVerifier : public grpc_tls_certificate_verifier {
  public:
-  XdsCertificateVerifier(
-      RefCountedPtr<XdsCertificateProvider> xds_certificate_provider,
-      std::string cluster_name);
+  explicit XdsCertificateVerifier(
+      RefCountedPtr<XdsCertificateProvider> xds_certificate_provider);
 
   bool Verify(grpc_tls_custom_verification_check_request* request,
               std::function<void(absl::Status)>,
@@ -61,7 +60,6 @@ class XdsCertificateVerifier : public grpc_tls_certificate_verifier {
   int CompareImpl(const grpc_tls_certificate_verifier* other) const override;
 
   RefCountedPtr<XdsCertificateProvider> xds_certificate_provider_;
-  std::string cluster_name_;
 };
 
 class XdsCredentials final : public grpc_channel_credentials {

data/src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -379,7 +379,8 @@ void TlsChannelSecurityConnector::check_peer(
       grpc_ssl_peer_to_auth_context(&peer, GRPC_TLS_TRANSPORT_SECURITY_TYPE);
   GPR_ASSERT(options_->certificate_verifier() != nullptr);
   auto* pending_request = new ChannelPendingVerifierRequest(
-      Ref(), on_peer_checked, peer, target_name);
+      RefAsSubclass<TlsChannelSecurityConnector>(), on_peer_checked, peer,
+      target_name);
   {
     MutexLock lock(&verifier_request_map_mu_);
     pending_verifier_requests_.emplace(on_peer_checked, pending_request);
@@ -653,8 +654,8 @@ void TlsServerSecurityConnector::check_peer(
   *auth_context =
       grpc_ssl_peer_to_auth_context(&peer, GRPC_TLS_TRANSPORT_SECURITY_TYPE);
   if (options_->certificate_verifier() != nullptr) {
-    auto* pending_request =
-        new ServerPendingVerifierRequest(Ref(), on_peer_checked, peer);
+    auto* pending_request = new ServerPendingVerifierRequest(
+        RefAsSubclass<TlsServerSecurityConnector>(), on_peer_checked, peer);
     {
       MutexLock lock(&verifier_request_map_mu_);
       pending_verifier_requests_.emplace(on_peer_checked, pending_request);

data/src/core/lib/security/transport/auth_filters.h

@@ -62,23 +62,90 @@ class ClientAuthFilter final : public ChannelFilter {
   grpc_call_credentials::GetRequestMetadataArgs args_;
 };
 
-class ServerAuthFilter final : public ChannelFilter {
+class LegacyServerAuthFilter final : public ChannelFilter {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ServerAuthFilter> Create(const ChannelArgs& args,
-                                                 ChannelFilter::Args);
+  static absl::StatusOr<LegacyServerAuthFilter> Create(const ChannelArgs& args,
+                                                       ChannelFilter::Args);
 
   // Construct a promise for one call.
   ArenaPromise<ServerMetadataHandle> MakeCallPromise(
       CallArgs call_args, NextPromiseFactory next_promise_factory) override;
 
+ private:
+  LegacyServerAuthFilter(
+      RefCountedPtr<grpc_server_credentials> server_credentials,
+      RefCountedPtr<grpc_auth_context> auth_context);
+
+  class RunApplicationCode;
+
+  ArenaPromise<absl::StatusOr<CallArgs>> GetCallCredsMetadata(
+      CallArgs call_args);
+
+  RefCountedPtr<grpc_server_credentials> server_credentials_;
+  RefCountedPtr<grpc_auth_context> auth_context_;
+};
+
+class ServerAuthFilter final : public ImplementChannelFilter<ServerAuthFilter> {
  private:
   ServerAuthFilter(RefCountedPtr<grpc_server_credentials> server_credentials,
                    RefCountedPtr<grpc_auth_context> auth_context);
 
-  class RunApplicationCode;
+  class RunApplicationCode {
+   public:
+    RunApplicationCode(ServerAuthFilter* filter, ClientMetadata& metadata);
+
+    RunApplicationCode(const RunApplicationCode&) = delete;
+    RunApplicationCode& operator=(const RunApplicationCode&) = delete;
+    RunApplicationCode(RunApplicationCode&& other) noexcept
+        : state_(std::exchange(other.state_, nullptr)) {}
+    RunApplicationCode& operator=(RunApplicationCode&& other) noexcept {
+      state_ = std::exchange(other.state_, nullptr);
+      return *this;
+    }
+
+    Poll<absl::Status> operator()();
+
+   private:
+    // Called from application code.
+    static void OnMdProcessingDone(void* user_data,
+                                   const grpc_metadata* consumed_md,
+                                   size_t num_consumed_md,
+                                   const grpc_metadata* response_md,
+                                   size_t num_response_md,
+                                   grpc_status_code status,
+                                   const char* error_details);
+
+    struct State;
+    State* state_;
+  };
+
+ public:
+  static const grpc_channel_filter kFilter;
 
+  static absl::StatusOr<ServerAuthFilter> Create(const ChannelArgs& args,
+                                                 ChannelFilter::Args);
+
+  class Call {
+   public:
+    explicit Call(ServerAuthFilter* filter);
+    auto OnClientInitialMetadata(ClientMetadata& md, ServerAuthFilter* filter) {
+      return If(
+          filter->server_credentials_ == nullptr ||
+              filter->server_credentials_->auth_metadata_processor().process ==
+                  nullptr,
+          ImmediateOkStatus(),
+          [filter, md = &md]() { return RunApplicationCode(filter, *md); });
+    }
+    static const NoInterceptor OnServerInitialMetadata;
+    static const NoInterceptor OnClientToServerMessage;
+    static const NoInterceptor OnServerToClientMessage;
+    static const NoInterceptor OnServerTrailingMetadata;
+    static const NoInterceptor OnFinalize;
+  };
+
+ private:
   ArenaPromise<absl::StatusOr<CallArgs>> GetCallCredsMetadata(
       CallArgs call_args);
 

data/src/core/lib/security/transport/client_auth_filter.cc

@@ -216,10 +216,8 @@ absl::StatusOr<ClientAuthFilter> ClientAuthFilter::Create(
     return absl::InvalidArgumentError(
         "Auth context missing from client auth filter args");
   }
-
-  return ClientAuthFilter(
-      static_cast<grpc_channel_security_connector*>(sc)->Ref(),
-      auth_context->Ref());
+  return ClientAuthFilter(sc->RefAsSubclass<grpc_channel_security_connector>(),
+                          auth_context->Ref());
 }
 
 const grpc_channel_filter ClientAuthFilter::kFilter =

data/src/core/lib/security/transport/legacy_server_auth_filter.cc

@@ -0,0 +1,244 @@
+//
+//
+// Copyright 2015 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include <algorithm>
+#include <atomic>
+#include <cstddef>
+#include <functional>
+#include <memory>
+#include <utility>
+
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/status.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/channel/channel_fwd.h"
+#include "src/core/lib/channel/channel_stack.h"
+#include "src/core/lib/channel/context.h"
+#include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/debug/trace.h"
+#include "src/core/lib/gprpp/debug_location.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/status_helper.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
+#include "src/core/lib/promise/activity.h"
+#include "src/core/lib/promise/arena_promise.h"
+#include "src/core/lib/promise/context.h"
+#include "src/core/lib/promise/poll.h"
+#include "src/core/lib/promise/try_seq.h"
+#include "src/core/lib/resource_quota/arena.h"
+#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/transport/auth_filters.h"  // IWYU pragma: keep
+#include "src/core/lib/slice/slice.h"
+#include "src/core/lib/slice/slice_internal.h"
+#include "src/core/lib/surface/call_trace.h"
+#include "src/core/lib/transport/metadata_batch.h"
+#include "src/core/lib/transport/transport.h"
+
+namespace grpc_core {
+
+const grpc_channel_filter LegacyServerAuthFilter::kFilter =
+    MakePromiseBasedFilter<LegacyServerAuthFilter, FilterEndpoint::kServer>(
+        "server-auth");
+
+namespace {
+
+class ArrayEncoder {
+ public:
+  explicit ArrayEncoder(grpc_metadata_array* result) : result_(result) {}
+
+  void Encode(const Slice& key, const Slice& value) {
+    Append(key.Ref(), value.Ref());
+  }
+
+  template <typename Which>
+  void Encode(Which, const typename Which::ValueType& value) {
+    Append(Slice(StaticSlice::FromStaticString(Which::key())),
+           Slice(Which::Encode(value)));
+  }
+
+  void Encode(HttpMethodMetadata,
+              const typename HttpMethodMetadata::ValueType&) {}
+
+ private:
+  void Append(Slice key, Slice value) {
+    if (result_->count == result_->capacity) {
+      result_->capacity =
+          std::max(result_->capacity + 8, result_->capacity * 2);
+      result_->metadata = static_cast<grpc_metadata*>(gpr_realloc(
+          result_->metadata, result_->capacity * sizeof(grpc_metadata)));
+    }
+    auto* usr_md = &result_->metadata[result_->count++];
+    usr_md->key = key.TakeCSlice();
+    usr_md->value = value.TakeCSlice();
+  }
+
+  grpc_metadata_array* result_;
+};
+
+// TODO(ctiller): seek out all users of this functionality and change API so
+// that this unilateral format conversion IS NOT REQUIRED.
+grpc_metadata_array MetadataBatchToMetadataArray(
+    const grpc_metadata_batch* batch) {
+  grpc_metadata_array result;
+  grpc_metadata_array_init(&result);
+  ArrayEncoder encoder(&result);
+  batch->Encode(&encoder);
+  return result;
+}
+
+}  // namespace
+
+class LegacyServerAuthFilter::RunApplicationCode {
+ public:
+  // TODO(ctiller): Allocate state_ into a pool on the arena to reuse this
+  // memory later
+  RunApplicationCode(LegacyServerAuthFilter* filter, CallArgs call_args)
+      : state_(GetContext<Arena>()->ManagedNew<State>(std::move(call_args))) {
+    if (grpc_call_trace.enabled()) {
+      gpr_log(GPR_ERROR,
+              "%s[server-auth]: Delegate to application: filter=%p this=%p "
+              "auth_ctx=%p",
+              Activity::current()->DebugTag().c_str(), filter, this,
+              filter->auth_context_.get());
+    }
+    filter->server_credentials_->auth_metadata_processor().process(
+        filter->server_credentials_->auth_metadata_processor().state,
+        filter->auth_context_.get(), state_->md.metadata, state_->md.count,
+        OnMdProcessingDone, state_);
+  }
+
+  RunApplicationCode(const RunApplicationCode&) = delete;
+  RunApplicationCode& operator=(const RunApplicationCode&) = delete;
+  RunApplicationCode(RunApplicationCode&& other) noexcept
+      : state_(std::exchange(other.state_, nullptr)) {}
+  RunApplicationCode& operator=(RunApplicationCode&& other) noexcept {
+    state_ = std::exchange(other.state_, nullptr);
+    return *this;
+  }
+
+  Poll<absl::StatusOr<CallArgs>> operator()() {
+    if (state_->done.load(std::memory_order_acquire)) {
+      return Poll<absl::StatusOr<CallArgs>>(std::move(state_->call_args));
+    }
+    return Pending{};
+  }
+
+ private:
+  struct State {
+    explicit State(CallArgs call_args) : call_args(std::move(call_args)) {}
+    Waker waker{Activity::current()->MakeOwningWaker()};
+    absl::StatusOr<CallArgs> call_args;
+    grpc_metadata_array md =
+        MetadataBatchToMetadataArray(call_args->client_initial_metadata.get());
+    std::atomic<bool> done{false};
+  };
+
+  // Called from application code.
+  static void OnMdProcessingDone(
+      void* user_data, const grpc_metadata* consumed_md, size_t num_consumed_md,
+      const grpc_metadata* response_md, size_t num_response_md,
+      grpc_status_code status, const char* error_details) {
+    ApplicationCallbackExecCtx callback_exec_ctx;
+    ExecCtx exec_ctx;
+
+    auto* state = static_cast<State*>(user_data);
+
+    // TODO(ZhenLian): Implement support for response_md.
+    if (response_md != nullptr && num_response_md > 0) {
+      gpr_log(GPR_ERROR,
+              "response_md in auth metadata processing not supported for now. "
+              "Ignoring...");
+    }
+
+    if (status == GRPC_STATUS_OK) {
+      ClientMetadataHandle& md = state->call_args->client_initial_metadata;
+      for (size_t i = 0; i < num_consumed_md; i++) {
+        md->Remove(StringViewFromSlice(consumed_md[i].key));
+      }
+    } else {
+      if (error_details == nullptr) {
+        error_details = "Authentication metadata processing failed.";
+      }
+      state->call_args = grpc_error_set_int(
+          absl::Status(static_cast<absl::StatusCode>(status), error_details),
+          StatusIntProperty::kRpcStatus, status);
+    }
+
+    // Clean up.
+    for (size_t i = 0; i < state->md.count; i++) {
+      CSliceUnref(state->md.metadata[i].key);
+      CSliceUnref(state->md.metadata[i].value);
+    }
+    grpc_metadata_array_destroy(&state->md);
+
+    auto waker = std::move(state->waker);
+    state->done.store(true, std::memory_order_release);
+    waker.Wakeup();
+  }
+
+  State* state_;
+};
+
+ArenaPromise<ServerMetadataHandle> LegacyServerAuthFilter::MakeCallPromise(
+    CallArgs call_args, NextPromiseFactory next_promise_factory) {
+  // Create server security context.  Set its auth context from channel
+  // data and save it in the call context.
+  grpc_server_security_context* server_ctx =
+      grpc_server_security_context_create(GetContext<Arena>());
+  server_ctx->auth_context =
+      auth_context_->Ref(DEBUG_LOCATION, "server_auth_filter");
+  grpc_call_context_element& context =
+      GetContext<grpc_call_context_element>()[GRPC_CONTEXT_SECURITY];
+  if (context.value != nullptr) context.destroy(context.value);
+  context.value = server_ctx;
+  context.destroy = grpc_server_security_context_destroy;
+
+  if (server_credentials_ == nullptr ||
+      server_credentials_->auth_metadata_processor().process == nullptr) {
+    return next_promise_factory(std::move(call_args));
+  }
+
+  return TrySeq(RunApplicationCode(this, std::move(call_args)),
+                std::move(next_promise_factory));
+}
+
+LegacyServerAuthFilter::LegacyServerAuthFilter(
+    RefCountedPtr<grpc_server_credentials> server_credentials,
+    RefCountedPtr<grpc_auth_context> auth_context)
+    : server_credentials_(server_credentials), auth_context_(auth_context) {}
+
+absl::StatusOr<LegacyServerAuthFilter> LegacyServerAuthFilter::Create(
+    const ChannelArgs& args, ChannelFilter::Args) {
+  auto auth_context = args.GetObjectRef<grpc_auth_context>();
+  GPR_ASSERT(auth_context != nullptr);
+  auto creds = args.GetObjectRef<grpc_server_credentials>();
+  return LegacyServerAuthFilter(std::move(creds), std::move(auth_context));
+}
+
+}  // namespace grpc_core