grpc 1.73.0 → 1.75.0

data/src/core/credentials/transport/alts/alts_credentials.cc

@@ -25,6 +25,7 @@
 
 #include <utility>
 
+#include "absl/log/log.h"
 #include "src/core/credentials/transport/alts/alts_security_connector.h"
 #include "src/core/credentials/transport/alts/check_gcp_environment.h"
 #include "src/core/credentials/transport/alts/grpc_alts_credentials_options.h"
@@ -89,6 +90,8 @@ grpc_channel_credentials* grpc_alts_credentials_create_customized(
     const grpc_alts_credentials_options* options,
     const char* handshaker_service_url, bool enable_untrusted_alts) {
   if (!enable_untrusted_alts && !grpc_alts_is_running_on_gcp()) {
+    LOG(ERROR) << "ALTS creds ignored. Not running on GCP and untrusted ALTS "
+                  "is not enabled.";
     return nullptr;
   }
   return new grpc_alts_credentials(options, handshaker_service_url);
@@ -98,6 +101,8 @@ grpc_server_credentials* grpc_alts_server_credentials_create_customized(
     const grpc_alts_credentials_options* options,
     const char* handshaker_service_url, bool enable_untrusted_alts) {
   if (!enable_untrusted_alts && !grpc_alts_is_running_on_gcp()) {
+    LOG(ERROR) << "ALTS server creds ignored. Not running on GCP and untrusted "
+                  "ALTS is not enabled.";
     return nullptr;
   }
   return new grpc_alts_server_credentials(options, handshaker_service_url);

data/src/core/credentials/transport/alts/check_gcp_environment_windows.cc

@@ -27,6 +27,8 @@
 #include <tchar.h>
 #include <windows.h>
 
+#include <memory>
+
 #include "src/core/credentials/transport/alts/check_gcp_environment.h"
 #include "src/core/util/crash.h"
 

data/src/core/credentials/transport/channel_creds_registry_init.cc

@@ -57,7 +57,7 @@ class GoogleDefaultChannelCredsFactory : public ChannelCredsFactory<> {
   RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
       RefCountedPtr<ChannelCredsConfig> /*config*/) const override {
     return RefCountedPtr<grpc_channel_credentials>(
-        grpc_google_default_credentials_create(nullptr));
+        grpc_google_default_credentials_create(nullptr, nullptr));
   }
 
  private:
@@ -87,10 +87,12 @@ class TlsChannelCredsFactory : public ChannelCredsFactory<> {
     auto options = MakeRefCounted<grpc_tls_credentials_options>();
     if (!config->certificate_file().empty() ||
         !config->ca_certificate_file().empty()) {
+      // TODO(gtcooke94): Expose the spiffe_bundle_map option in the XDS
+      // bootstrap config to use here.
       options->set_certificate_provider(
           MakeRefCounted<FileWatcherCertificateProvider>(
               config->private_key_file(), config->certificate_file(),
-              config->ca_certificate_file(),
+              config->ca_certificate_file(), /*spiffe_bundle_map_file=*/"",
               config->refresh_interval().millis() / GPR_MS_PER_SEC));
     }
     options->set_watch_root_cert(!config->ca_certificate_file().empty());

data/src/core/credentials/transport/google_default/google_default_credentials.cc

@@ -42,6 +42,7 @@
 #include "src/core/credentials/call/jwt/json_token.h"
 #include "src/core/credentials/call/jwt/jwt_credentials.h"
 #include "src/core/credentials/call/oauth2/oauth2_credentials.h"
+#include "src/core/credentials/transport/alts/alts_security_connector.h"
 #include "src/core/credentials/transport/alts/check_gcp_environment.h"
 #include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/lib/channel/channel_args.h"
@@ -338,6 +339,65 @@ static bool metadata_server_available() {
   return static_cast<bool>(g_metadata_server_available);
 }
 
+// A grpc_call_credentials implementation that uses two
+// underlying credentials: one for TLS and one for ALTS.
+// The implementation will pick the right credentials based on the auth
+// context's GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME property.
+class GoogleDefaultCallCredentialsWrapper : public grpc_call_credentials {
+ public:
+  GoogleDefaultCallCredentialsWrapper(
+      grpc_core::RefCountedPtr<grpc_call_credentials> tls_credentials,
+      grpc_core::RefCountedPtr<grpc_call_credentials> alts_credentials)
+      : tls_credentials_(std::move(tls_credentials)),
+        alts_credentials_(std::move(alts_credentials)) {};
+
+  void Orphaned() override {
+    tls_credentials_.reset();
+    alts_credentials_.reset();
+  }
+
+  static grpc_core::UniqueTypeName Type() {
+    static grpc_core::UniqueTypeName::Factory kFactory("Dual");
+    return kFactory.Create();
+  }
+
+  grpc_core::UniqueTypeName type() const override { return Type(); }
+
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
+                     const GetRequestMetadataArgs* args) override {
+    bool use_alts = false;
+    if (args != nullptr) {
+      auto auth_context = args->auth_context;
+      if (auth_context != nullptr &&
+          grpc_auth_context_peer_is_authenticated(auth_context.get()) == 1) {
+        // This channel is authenticated.
+        grpc_auth_property_iterator property_it =
+            grpc_auth_context_find_properties_by_name(
+                auth_context.get(), GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME);
+        const grpc_auth_property* property =
+            grpc_auth_property_iterator_next(&property_it);
+        use_alts =
+            property != nullptr &&
+            strcmp(property->value, GRPC_ALTS_TRANSPORT_SECURITY_TYPE) == 0;
+      }
+    }
+    return (use_alts ? alts_credentials_ : tls_credentials_)
+        ->GetRequestMetadata(std::move(initial_metadata), args);
+  }
+
+ private:
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    return QsortCompare(static_cast<const grpc_call_credentials*>(this), other);
+  }
+  std::string debug_string() override {
+    return "GoogleDefaultCallCredentialsWrapper";
+  }
+
+  grpc_core::RefCountedPtr<grpc_call_credentials> tls_credentials_;
+  grpc_core::RefCountedPtr<grpc_call_credentials> alts_credentials_;
+};
+
 static grpc_core::RefCountedPtr<grpc_call_credentials> make_default_call_creds(
     grpc_error_handle* error) {
   grpc_core::RefCountedPtr<grpc_call_credentials> call_creds;
@@ -373,14 +433,16 @@ static grpc_core::RefCountedPtr<grpc_call_credentials> make_default_call_creds(
 }
 
 grpc_channel_credentials* grpc_google_default_credentials_create(
-    grpc_call_credentials* call_credentials) {
+    grpc_call_credentials* call_creds_for_tls,
+    grpc_call_credentials* call_creds_for_alts) {
   grpc_channel_credentials* result = nullptr;
-  grpc_core::RefCountedPtr<grpc_call_credentials> call_creds(call_credentials);
+  grpc_core::RefCountedPtr<grpc_call_credentials> call_creds(
+      call_creds_for_tls);
   grpc_error_handle error;
   grpc_core::ExecCtx exec_ctx;
 
   GRPC_TRACE_LOG(api, INFO)
-      << "grpc_google_default_credentials_create(" << call_credentials << ")";
+      << "grpc_google_default_credentials_create(" << call_creds_for_tls << ")";
 
   if (call_creds == nullptr) {
     call_creds = make_default_call_creds(&error);
@@ -400,6 +462,13 @@ grpc_channel_credentials* grpc_google_default_credentials_create(
         grpc_core::MakeRefCounted<grpc_google_default_channel_credentials>(
             grpc_core::RefCountedPtr<grpc_channel_credentials>(alts_creds),
             grpc_core::RefCountedPtr<grpc_channel_credentials>(ssl_creds));
+    if (call_creds_for_alts != nullptr) {
+      grpc_core::RefCountedPtr<grpc_call_credentials> alts_call_creds(
+          call_creds_for_alts);
+      call_creds =
+          grpc_core::MakeRefCounted<GoogleDefaultCallCredentialsWrapper>(
+              std::move(call_creds), std::move(alts_call_creds));
+    }
     result = grpc_composite_channel_credentials_create(
         creds.get(), call_creds.get(), nullptr);
     CHECK_NE(result, nullptr);
@@ -412,7 +481,6 @@ grpc_channel_credentials* grpc_google_default_credentials_create(
 
 namespace grpc_core {
 namespace internal {
-
 void set_gce_tenancy_checker_for_testing(grpc_gce_tenancy_checker checker) {
   g_gce_tenancy_checker = checker;
 }

data/src/core/credentials/transport/ssl/ssl_credentials.cc

@@ -58,7 +58,6 @@ grpc_ssl_credentials::grpc_ssl_credentials(
       root_store_ = grpc_core::DefaultSslRootStore::GetRootStore();
     }
   } else {
-    config_.pem_root_certs = config_.pem_root_certs;
     root_store_ = nullptr;
   }
 
@@ -194,7 +193,7 @@ grpc_security_status grpc_ssl_credentials::InitializeClientHandshakerFactory(
                   "be nullptr";
     return GRPC_SECURITY_ERROR;
   }
-  options.pem_root_certs = pem_root_certs;
+  options.root_cert_info = std::make_shared<RootCertInfo>(pem_root_certs);
   options.root_store = root_store;
   options.alpn_protocols =
       grpc_fill_alpn_protocol_strings(&options.num_alpn_protocols);

data/src/core/credentials/transport/ssl/ssl_security_connector.cc

@@ -243,8 +243,10 @@ class grpc_ssl_server_security_connector
           server_credentials->config().pem_key_cert_pairs;
       options.num_key_cert_pairs =
           server_credentials->config().num_key_cert_pairs;
-      options.pem_client_root_certs =
-          server_credentials->config().pem_root_certs;
+      if (server_credentials->config().pem_root_certs != nullptr) {
+        options.root_cert_info = std::make_shared<RootCertInfo>(
+            server_credentials->config().pem_root_certs);
+      }
       options.client_certificate_request =
           grpc_get_tsi_client_certificate_request_type(
               server_credentials->config().client_certificate_request);
@@ -360,7 +362,10 @@ class grpc_ssl_server_security_connector
     options.pem_key_cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
         config->pem_key_cert_pairs, config->num_key_cert_pairs);
     options.num_key_cert_pairs = config->num_key_cert_pairs;
-    options.pem_client_root_certs = config->pem_root_certs;
+    if (config->pem_root_certs != nullptr) {
+      options.root_cert_info =
+          std::make_shared<RootCertInfo>(config->pem_root_certs);
+    }
     options.client_certificate_request =
         grpc_get_tsi_client_certificate_request_type(
             server_creds->config().client_certificate_request);

data/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.cc

@@ -22,14 +22,20 @@
 
 #include "absl/log/check.h"
 #include "absl/status/status.h"
+#include "src/core/credentials/transport/tls/spiffe_utils.h"
+#include "src/core/tsi/ssl_transport_security.h"
+
+bool grpc_tls_certificate_distributor::CertificateInfo::AreRootsEmpty() {
+  return IsRootCertInfoEmpty(roots.get());
+}
 
 void grpc_tls_certificate_distributor::SetKeyMaterials(
-    const std::string& cert_name, std::optional<std::string> pem_root_certs,
+    const std::string& cert_name, std::shared_ptr<RootCertInfo> roots,
     std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs) {
-  CHECK(pem_root_certs.has_value() || pem_key_cert_pairs.has_value());
+  CHECK(roots != nullptr || pem_key_cert_pairs.has_value());
   grpc_core::MutexLock lock(&mu_);
   auto& cert_info = certificate_info_map_[cert_name];
-  if (pem_root_certs.has_value()) {
+  if (roots != nullptr) {
     // Successful credential updates will clear any pre-existing error.
     cert_info.SetRootError(absl::OkStatus());
     for (auto* watcher_ptr : cert_info.root_cert_watchers) {
@@ -49,9 +55,9 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
         }
       }
       watcher_ptr->OnCertificatesChanged(
-          pem_root_certs, std::move(pem_key_cert_pairs_to_report));
+          roots, std::move(pem_key_cert_pairs_to_report));
     }
-    cert_info.pem_root_certs = std::move(*pem_root_certs);
+    cert_info.roots = roots;
   }
   if (pem_key_cert_pairs.has_value()) {
     // Successful credential updates will clear any pre-existing error.
@@ -61,20 +67,19 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
       const auto watcher_it = watchers_.find(watcher_ptr);
       CHECK(watcher_it != watchers_.end());
       CHECK(watcher_it->second.identity_cert_name.has_value());
-      std::optional<absl::string_view> pem_root_certs_to_report;
-      if (pem_root_certs.has_value() &&
-          watcher_it->second.root_cert_name == cert_name) {
+      std::shared_ptr<RootCertInfo> roots_to_report;
+      if (roots != nullptr && watcher_it->second.root_cert_name == cert_name) {
         // In this case, We've already sent the credential updates at the time
         // when checking pem_root_certs, so we will skip here.
         continue;
       } else if (watcher_it->second.root_cert_name.has_value()) {
         auto& root_cert_info =
             certificate_info_map_[*watcher_it->second.root_cert_name];
-        if (!root_cert_info.pem_root_certs.empty()) {
-          pem_root_certs_to_report = root_cert_info.pem_root_certs;
+        if (!root_cert_info.AreRootsEmpty()) {
+          roots_to_report = root_cert_info.roots;
         }
       }
-      watcher_ptr->OnCertificatesChanged(pem_root_certs_to_report,
+      watcher_ptr->OnCertificatesChanged(std::move(roots_to_report),
                                          pem_key_cert_pairs);
     }
     cert_info.pem_key_cert_pairs = std::move(*pem_key_cert_pairs);
@@ -85,8 +90,7 @@ bool grpc_tls_certificate_distributor::HasRootCerts(
     const std::string& root_cert_name) {
   grpc_core::MutexLock lock(&mu_);
   const auto it = certificate_info_map_.find(root_cert_name);
-  return it != certificate_info_map_.end() &&
-         !it->second.pem_root_certs.empty();
+  return it != certificate_info_map_.end() && !it->second.AreRootsEmpty();
 };
 
 bool grpc_tls_certificate_distributor::HasKeyCertPairs(
@@ -129,9 +133,9 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
       CHECK_NE(watcher_ptr, nullptr);
       const auto watcher_it = watchers_.find(watcher_ptr);
       CHECK(watcher_it != watchers_.end());
-      // root_cert_error_to_report is the error of the root cert this watcher is
-      // watching, if there is any.
-      grpc_error_handle root_cert_error_to_report;
+      // root_error_to_report is the error of the roots this watcher
+      // is watching, if there is any.
+      grpc_error_handle root_error_to_report;
       if (root_cert_error.has_value() &&
           watcher_it->second.root_cert_name == cert_name) {
         // In this case, We've already sent the error updates at the time when
@@ -140,9 +144,9 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
       } else if (watcher_it->second.root_cert_name.has_value()) {
         auto& root_cert_info =
             certificate_info_map_[*watcher_it->second.root_cert_name];
-        root_cert_error_to_report = root_cert_info.root_cert_error;
+        root_error_to_report = root_cert_info.root_cert_error;
       }
-      watcher_ptr->OnError(root_cert_error_to_report, *identity_cert_error);
+      watcher_ptr->OnError(root_error_to_report, *identity_cert_error);
     }
     cert_info.SetIdentityError(*identity_cert_error);
   }
@@ -186,7 +190,7 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
     CHECK(watcher_it == watchers_.end());
     watchers_[watcher_ptr] = {std::move(watcher), root_cert_name,
                               identity_cert_name};
-    std::optional<absl::string_view> updated_root_certs;
+    std::shared_ptr<RootCertInfo> updated_roots;
     std::optional<grpc_core::PemKeyCertPairList> updated_identity_pairs;
     grpc_error_handle root_error;
     grpc_error_handle identity_error;
@@ -198,8 +202,8 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
       cert_info.root_cert_watchers.insert(watcher_ptr);
       root_error = cert_info.root_cert_error;
       // Empty credentials will be treated as no updates.
-      if (!cert_info.pem_root_certs.empty()) {
-        updated_root_certs = cert_info.pem_root_certs;
+      if (!cert_info.AreRootsEmpty()) {
+        updated_roots = cert_info.roots;
       }
     }
     if (identity_cert_name.has_value()) {
@@ -219,11 +223,12 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
     // occurred while trying to fetch the latest cert, but the updated_*_certs
     // should always be valid. So we will send the updates regardless of
     // *_cert_error.
-    if (updated_root_certs.has_value() || updated_identity_pairs.has_value()) {
-      watcher_ptr->OnCertificatesChanged(updated_root_certs,
+    if (updated_roots != nullptr || updated_identity_pairs.has_value()) {
+      watcher_ptr->OnCertificatesChanged(updated_roots,
                                          std::move(updated_identity_pairs));
     }
-    // Notify this watcher if the certs it is watching already had some errors.
+    // Notify this watcher if the certs it is watching already had some
+    // errors.
     if (!root_error.ok() || !identity_error.ok()) {
       watcher_ptr->OnError(root_error, identity_error);
     }

data/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h

@@ -29,8 +29,10 @@
 
 #include "absl/base/thread_annotations.h"
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/lib/iomgr/error.h"
+#include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/util/ref_counted.h"
 #include "src/core/util/sync.h"
 
@@ -53,11 +55,11 @@ struct grpc_tls_certificate_distributor
     // latest contents for both root and identity certificates, even when only
     // one side of it got updated.
     //
-    // @param root_certs the contents of the reloaded root certs.
+    // @param roots the contents of the reloaded roots.
     // @param key_cert_pairs the contents of the reloaded identity key-cert
     // pairs.
     virtual void OnCertificatesChanged(
-        std::optional<absl::string_view> root_certs,
+        std::shared_ptr<RootCertInfo> roots,
         std::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) = 0;
 
     // Handles an error that occurs while attempting to fetch certificate data.
@@ -81,10 +83,11 @@ struct grpc_tls_certificate_distributor
   // Sets the key materials based on their certificate name.
   //
   // @param cert_name The name of the certificates being updated.
-  // @param pem_root_certs The content of root certificates.
+  // @param roots The content of the roots, either the pem root certificates or
+  // the SpiffeBundleMap.
   // @param pem_key_cert_pairs The content of identity key-cert pairs.
   void SetKeyMaterials(
-      const std::string& cert_name, std::optional<std::string> pem_root_certs,
+      const std::string& cert_name, std::shared_ptr<RootCertInfo> roots,
       std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs);
 
   bool HasRootCerts(const std::string& root_cert_name);
@@ -171,10 +174,12 @@ struct grpc_tls_certificate_distributor
   // root certs, while pem_root_certs still contains the valid old data.
   struct CertificateInfo {
     // The contents of the root certificates.
-    std::string pem_root_certs;
+    std::shared_ptr<RootCertInfo> roots;
     // The contents of the identity key-certificate pairs.
     grpc_core::PemKeyCertPairList pem_key_cert_pairs;
-    // The root cert reloading error propagated by the caller.
+    // TODO(gtcooke94) Swap to using absl::StatusOr<>
+    // https://github.com/grpc/grpc/pull/39708/files#r2144014200 The root cert
+    // reloading error propagated by the caller.
     grpc_error_handle root_cert_error;
     // The identity cert reloading error propagated by the caller.
     grpc_error_handle identity_cert_error;
@@ -188,10 +193,16 @@ struct grpc_tls_certificate_distributor
     std::set<TlsCertificatesWatcherInterface*> identity_cert_watchers;
 
     ~CertificateInfo() {}
+    // TODO(gtcooke94) These can be set directly, no need for setters
+    // https://github.com/grpc/grpc/pull/39708/files#r2144015746
     void SetRootError(grpc_error_handle error) { root_cert_error = error; }
     void SetIdentityError(grpc_error_handle error) {
       identity_cert_error = error;
     }
+
+    // Returns if the root variant contains either "", an empty SpiffeBundleMap,
+    // or a nullptr to a SpiffeBundleMap
+    bool AreRootsEmpty();
   };
 
   grpc_core::Mutex mu_;
@@ -202,8 +213,8 @@ struct grpc_tls_certificate_distributor
   // Stores information about each watcher.
   std::map<TlsCertificatesWatcherInterface*, WatcherInfo> watchers_
       ABSL_GUARDED_BY(mu_);
-  // The callback to notify the caller, e.g. the Producer, that the watch status
-  // is changed.
+  // The callback to notify the caller, e.g. the Producer, that the watch
+  // status is changed.
   std::function<void(std::string, bool, bool)> watch_status_callback_
       ABSL_GUARDED_BY(callback_mu_);
   // Stores the names of each certificate, and their corresponding credential