grpc 1.66.0 → 1.67.0.pre1

data/src/core/lib/security/credentials/external/url_external_account_credentials.h

@@ -37,37 +37,34 @@ namespace grpc_core {
 
 class UrlExternalAccountCredentials final : public ExternalAccountCredentials {
  public:
-  static RefCountedPtr<UrlExternalAccountCredentials> Create(
+  static absl::StatusOr<RefCountedPtr<UrlExternalAccountCredentials>> Create(
       Options options, std::vector<std::string> scopes,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr);
+
+  UrlExternalAccountCredentials(
+      Options options, std::vector<std::string> scopes,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine,
       grpc_error_handle* error);
 
-  UrlExternalAccountCredentials(Options options,
-                                std::vector<std::string> scopes,
-                                grpc_error_handle* error);
+  std::string debug_string() override;
+
+  UniqueTypeName type() const override;
 
  private:
-  void RetrieveSubjectToken(
-      HTTPRequestContext* ctx, const Options& options,
-      std::function<void(std::string, grpc_error_handle)> cb) override;
+  OrphanablePtr<FetchBody> RetrieveSubjectToken(
+      Timestamp deadline,
+      absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done) override;
 
   absl::string_view CredentialSourceType() override;
 
-  static void OnRetrieveSubjectToken(void* arg, grpc_error_handle error);
-  void OnRetrieveSubjectTokenInternal(grpc_error_handle error);
-
-  void FinishRetrieveSubjectToken(std::string subject_token,
-                                  grpc_error_handle error);
-
   // Fields of credential source
   URI url_;
   std::string url_full_path_;
   std::map<std::string, std::string> headers_;
   std::string format_type_;
   std::string format_subject_token_field_name_;
-
-  OrphanablePtr<HttpRequest> http_request_;
-  HTTPRequestContext* ctx_ = nullptr;
-  std::function<void(std::string, grpc_error_handle)> cb_ = nullptr;
 };
 
 }  // namespace grpc_core

data/src/core/lib/security/credentials/fake/fake_credentials.h

@@ -99,6 +99,8 @@ class grpc_md_only_test_credentials : public grpc_call_credentials {
         key_(grpc_core::Slice::FromCopiedString(md_key)),
         value_(grpc_core::Slice::FromCopiedString(md_value)) {}
 
+  void Orphaned() override {}
+
   grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
   GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
                      const GetRequestMetadataArgs* args) override;

data/src/core/lib/security/credentials/gcp_service_account_identity/gcp_service_account_identity_credentials.cc

@@ -0,0 +1,196 @@
+//
+// Copyright 2024 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/lib/security/credentials/gcp_service_account_identity/gcp_service_account_identity_credentials.h"
+
+#include "absl/functional/any_invocable.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/escaping.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_split.h"
+#include "absl/strings/string_view.h"
+
+#include <grpc/support/time.h>
+
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/status_helper.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/transport/metadata.h"
+#include "src/core/lib/transport/status_conversion.h"
+#include "src/core/lib/uri/uri_parser.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/json/json_args.h"
+#include "src/core/util/json/json_object_loader.h"
+#include "src/core/util/json/json_reader.h"
+
+namespace grpc_core {
+
+//
+// JwtTokenFetcherCallCredentials
+//
+
+// State held for a pending HTTP request.
+class JwtTokenFetcherCallCredentials::HttpFetchRequest final
+    : public TokenFetcherCredentials::FetchRequest {
+ public:
+  HttpFetchRequest(
+      JwtTokenFetcherCallCredentials* creds, Timestamp deadline,
+      absl::AnyInvocable<
+          void(absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
+          on_done)
+      : on_done_(std::move(on_done)) {
+    GRPC_CLOSURE_INIT(&on_http_response_, OnHttpResponse, this, nullptr);
+    Ref().release();  // Ref held by HTTP request callback.
+    http_request_ = creds->StartHttpRequest(creds->pollent(), deadline,
+                                            &response_, &on_http_response_);
+  }
+
+  ~HttpFetchRequest() override { grpc_http_response_destroy(&response_); }
+
+  void Orphan() override {
+    http_request_.reset();
+    Unref();
+  }
+
+ private:
+  static void OnHttpResponse(void* arg, grpc_error_handle error) {
+    RefCountedPtr<HttpFetchRequest> self(static_cast<HttpFetchRequest*>(arg));
+    if (!error.ok()) {
+      // TODO(roth): It shouldn't be necessary to explicitly set the
+      // status to UNAVAILABLE here.  Once the HTTP client code is
+      // migrated to stop using legacy grpc_error APIs to create
+      // statuses, we should be able to just propagate the status as-is.
+      self->on_done_(absl::UnavailableError(StatusToString(error)));
+      return;
+    }
+    if (self->response_.status != 200) {
+      grpc_status_code status_code =
+          grpc_http2_status_to_grpc_status(self->response_.status);
+      if (status_code != GRPC_STATUS_UNAVAILABLE) {
+        status_code = GRPC_STATUS_UNAUTHENTICATED;
+      }
+      self->on_done_(absl::Status(static_cast<absl::StatusCode>(status_code),
+                                  absl::StrCat("JWT fetch failed with status ",
+                                               self->response_.status)));
+      return;
+    }
+    absl::string_view body(self->response_.body, self->response_.body_length);
+    // Parse JWT token based on https://datatracker.ietf.org/doc/html/rfc7519.
+    // We don't do full verification here, just enough to extract the
+    // expiration time.
+    // First, split the 3 '.'-delimited parts.
+    std::vector<absl::string_view> parts = absl::StrSplit(body, '.');
+    if (parts.size() != 3) {
+      self->on_done_(absl::UnauthenticatedError("error parsing JWT token"));
+      return;
+    }
+    // Base64-decode the payload.
+    std::string payload;
+    if (!absl::WebSafeBase64Unescape(parts[1], &payload)) {
+      self->on_done_(absl::UnauthenticatedError("error parsing JWT token"));
+      return;
+    }
+    // Parse as JSON.
+    auto json = JsonParse(payload);
+    if (!json.ok()) {
+      self->on_done_(absl::UnauthenticatedError("error parsing JWT token"));
+      return;
+    }
+    // Extract "exp" field.
+    struct ParsedPayload {
+      uint64_t exp = 0;
+
+      static const JsonLoaderInterface* JsonLoader(const JsonArgs&) {
+        static const auto kJsonLoader = JsonObjectLoader<ParsedPayload>()
+                                            .Field("exp", &ParsedPayload::exp)
+                                            .Finish();
+        return kJsonLoader;
+      }
+    };
+    auto parsed_payload = LoadFromJson<ParsedPayload>(*json, JsonArgs(), "");
+    if (!parsed_payload.ok()) {
+      self->on_done_(absl::UnauthenticatedError("error parsing JWT token"));
+      return;
+    }
+    gpr_timespec ts = gpr_time_0(GPR_CLOCK_REALTIME);
+    ts.tv_sec = parsed_payload->exp;
+    Timestamp expiration_time = Timestamp::FromTimespecRoundDown(ts);
+    // Return token object.
+    self->on_done_(MakeRefCounted<Token>(
+        Slice::FromCopiedString(absl::StrCat("Bearer ", body)),
+        expiration_time));
+  }
+
+  OrphanablePtr<HttpRequest> http_request_;
+  grpc_closure on_http_response_;
+  grpc_http_response response_;
+  absl::AnyInvocable<void(
+      absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
+      on_done_;
+};
+
+OrphanablePtr<TokenFetcherCredentials::FetchRequest>
+JwtTokenFetcherCallCredentials::FetchToken(
+    Timestamp deadline,
+    absl::AnyInvocable<
+        void(absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
+        on_done) {
+  return MakeOrphanable<HttpFetchRequest>(this, deadline, std::move(on_done));
+}
+
+//
+// GcpServiceAccountIdentityCallCredentials
+//
+
+std::string GcpServiceAccountIdentityCallCredentials::debug_string() {
+  return absl::StrCat("GcpServiceAccountIdentityCallCredentials(", audience_,
+                      ")");
+}
+
+UniqueTypeName GcpServiceAccountIdentityCallCredentials::Type() {
+  static UniqueTypeName::Factory kFactory("GcpServiceAccountIdentity");
+  return kFactory.Create();
+}
+
+OrphanablePtr<HttpRequest>
+GcpServiceAccountIdentityCallCredentials::StartHttpRequest(
+    grpc_polling_entity* pollent, Timestamp deadline,
+    grpc_http_response* response, grpc_closure* on_complete) {
+  grpc_http_header header = {const_cast<char*>("Metadata-Flavor"),
+                             const_cast<char*>("Google")};
+  grpc_http_request request;
+  memset(&request, 0, sizeof(grpc_http_request));
+  request.hdr_count = 1;
+  request.hdrs = &header;
+  // TODO(ctiller): Carry the memory quota in ctx and share it with the host
+  // channel. This would allow us to cancel an authentication query when under
+  // extreme memory pressure.
+  auto uri = URI::Create(
+      "http", "metadata.google.internal.",
+      "/computeMetadata/v1/instance/service-accounts/default/identity",
+      {{"audience", audience_}}, /*fragment=*/"");
+  CHECK_OK(uri);  // params are hardcoded
+  auto http_request =
+      HttpRequest::Get(std::move(*uri), /*args=*/nullptr, pollent, &request,
+                       deadline, on_complete, response,
+                       RefCountedPtr<grpc_channel_credentials>(
+                           grpc_insecure_credentials_create()));
+  http_request->Start();
+  return http_request;
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/credentials/gcp_service_account_identity/gcp_service_account_identity_credentials.h

@@ -0,0 +1,90 @@
+//
+// Copyright 2024 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_GCP_SERVICE_ACCOUNT_IDENTITY_GCP_SERVICE_ACCOUNT_IDENTITY_CREDENTIALS_H
+#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_GCP_SERVICE_ACCOUNT_IDENTITY_GCP_SERVICE_ACCOUNT_IDENTITY_CREDENTIALS_H
+
+#include <string>
+#include <utility>
+
+#include <grpc/credentials.h>
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/gprpp/orphanable.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/time.h"
+#include "src/core/lib/gprpp/unique_type_name.h"
+#include "src/core/lib/iomgr/closure.h"
+#include "src/core/lib/iomgr/polling_entity.h"
+#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/token_fetcher/token_fetcher_credentials.h"
+#include "src/core/lib/slice/slice.h"
+#include "src/core/lib/transport/metadata.h"
+#include "src/core/util/http_client/httpcli.h"
+#include "src/core/util/http_client/parser.h"
+
+namespace grpc_core {
+
+// A base class for JWT token fetching credentials.
+// Subclasses must implement StartHttpRequest().
+class JwtTokenFetcherCallCredentials : public TokenFetcherCredentials {
+ public:
+  OrphanablePtr<FetchRequest> FetchToken(
+      Timestamp deadline,
+      absl::AnyInvocable<
+          void(absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
+          on_done) final;
+
+ private:
+  class HttpFetchRequest;
+
+  virtual OrphanablePtr<HttpRequest> StartHttpRequest(
+      grpc_polling_entity* pollent, Timestamp deadline,
+      grpc_http_response* response, grpc_closure* on_complete) = 0;
+};
+
+// GCP service account identity call credentials.
+// See gRFC A83 (https://github.com/grpc/proposal/pull/438).
+class GcpServiceAccountIdentityCallCredentials
+    : public JwtTokenFetcherCallCredentials {
+ public:
+  explicit GcpServiceAccountIdentityCallCredentials(absl::string_view audience)
+      : audience_(audience) {}
+
+  std::string debug_string() override;
+
+  static UniqueTypeName Type();
+
+  UniqueTypeName type() const override { return Type(); }
+
+  absl::string_view audience() const { return audience_; }
+
+ private:
+  OrphanablePtr<HttpRequest> StartHttpRequest(
+      grpc_polling_entity* pollent, Timestamp deadline,
+      grpc_http_response* response, grpc_closure* on_complete) override;
+
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return QsortCompare(static_cast<const grpc_call_credentials*>(this), other);
+  }
+
+  std::string audience_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_GCP_SERVICE_ACCOUNT_IDENTITY_GCP_SERVICE_ACCOUNT_IDENTITY_CREDENTIALS_H

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -258,68 +258,54 @@ static int is_metadata_server_reachable() {
 static grpc_error_handle create_default_creds_from_path(
     const std::string& creds_path,
     grpc_core::RefCountedPtr<grpc_call_credentials>* creds) {
-  grpc_auth_json_key key;
-  grpc_auth_refresh_token token;
-  grpc_core::RefCountedPtr<grpc_call_credentials> result;
-  absl::StatusOr<grpc_core::Slice> creds_data;
-  grpc_error_handle error;
-  Json json;
   if (creds_path.empty()) {
-    error = GRPC_ERROR_CREATE("creds_path unset");
-    goto end;
+    return GRPC_ERROR_CREATE("creds_path unset");
   }
-  creds_data = grpc_core::LoadFile(creds_path, /*add_null_terminator=*/false);
+  auto creds_data =
+      grpc_core::LoadFile(creds_path, /*add_null_terminator=*/false);
   if (!creds_data.ok()) {
-    error = absl_status_to_grpc_error(creds_data.status());
-    goto end;
+    return absl_status_to_grpc_error(creds_data.status());
   }
-  {
-    auto json_or = grpc_core::JsonParse(creds_data->as_string_view());
-    if (!json_or.ok()) {
-      error = absl_status_to_grpc_error(json_or.status());
-      goto end;
-    }
-    json = std::move(*json_or);
+  auto json = grpc_core::JsonParse(creds_data->as_string_view());
+  if (!json.ok()) {
+    return absl_status_to_grpc_error(json.status());
   }
-  if (json.type() != Json::Type::kObject) {
-    error = GRPC_ERROR_CREATE(absl::StrCat("Failed to parse JSON \"",
-                                           creds_data->as_string_view(), "\""));
-    goto end;
+  if (json->type() != Json::Type::kObject) {
+    return GRPC_ERROR_CREATE(absl::StrCat("Failed to parse JSON \"",
+                                          creds_data->as_string_view(), "\""));
   }
-
   // First, try an auth json key.
-  key = grpc_auth_json_key_create_from_json(json);
+  grpc_auth_json_key key = grpc_auth_json_key_create_from_json(*json);
   if (grpc_auth_json_key_is_valid(&key)) {
-    result =
+    *creds =
         grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
             key, grpc_max_auth_token_lifetime());
-    if (result == nullptr) {
-      error = GRPC_ERROR_CREATE(
+    if (*creds == nullptr) {
+      return GRPC_ERROR_CREATE(
           "grpc_service_account_jwt_access_credentials_create_from_auth_json_"
           "key failed");
     }
-    goto end;
+    return absl::OkStatus();
   }
-
   // Then try a refresh token if the auth json key was invalid.
-  token = grpc_auth_refresh_token_create_from_json(json);
+  grpc_auth_refresh_token token =
+      grpc_auth_refresh_token_create_from_json(*json);
   if (grpc_auth_refresh_token_is_valid(&token)) {
-    result =
+    *creds =
         grpc_refresh_token_credentials_create_from_auth_refresh_token(token);
-    if (result == nullptr) {
-      error = GRPC_ERROR_CREATE(
+    if (*creds == nullptr) {
+      return GRPC_ERROR_CREATE(
           "grpc_refresh_token_credentials_create_from_auth_refresh_token "
           "failed");
     }
-    goto end;
+    return absl::OkStatus();
   }
-
-  result = grpc_core::ExternalAccountCredentials::Create(json, {}, &error);
-
-end:
-  CHECK((result == nullptr) + (error.ok()) == 1);
-  *creds = result;
-  return error;
+  // Use external creds.
+  auto external_creds =
+      grpc_core::ExternalAccountCredentials::Create(*json, {});
+  if (!external_creds.ok()) return external_creds.status();
+  *creds = std::move(*external_creds);
+  return absl::OkStatus();
 }
 
 static void update_tenancy() {

data/src/core/lib/security/credentials/iam/iam_credentials.cc

@@ -27,7 +27,6 @@
 #include "absl/strings/str_format.h"
 #include "absl/strings/string_view.h"
 
-#include <grpc/support/log.h>
 #include <grpc/support/port_platform.h>
 
 #include "src/core/lib/debug/trace.h"

data/src/core/lib/security/credentials/iam/iam_credentials.h

@@ -40,6 +40,8 @@ class grpc_google_iam_credentials : public grpc_call_credentials {
   grpc_google_iam_credentials(const char* token,
                               const char* authority_selector);
 
+  void Orphaned() override {}
+
   grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
   GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
                      const GetRequestMetadataArgs* args) override;

data/src/core/lib/security/credentials/jwt/jwt_credentials.h

@@ -51,6 +51,8 @@ class grpc_service_account_jwt_access_credentials
                                               gpr_timespec token_lifetime);
   ~grpc_service_account_jwt_access_credentials() override;
 
+  void Orphaned() override {}
+
   grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
   GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
                      const GetRequestMetadataArgs* args) override;