grpc 1.78.1 → 1.80.0

data/src/core/xds/grpc/xds_cluster.h

@@ -81,6 +81,21 @@ struct XdsClusterResource : public XdsResourceType::ResourceData {
     }
   };
 
+  struct UpstreamTlsContext {
+    CommonTlsContext common_tls_context;
+    std::string sni;
+    bool auto_host_sni = false;
+    bool auto_sni_san_validation = false;
+
+    bool operator==(const UpstreamTlsContext& other) const {
+      return common_tls_context == other.common_tls_context &&
+             sni == other.sni && auto_host_sni == other.auto_host_sni &&
+             auto_sni_san_validation == other.auto_sni_san_validation;
+    }
+
+    std::string ToString() const;
+  };
+
   std::variant<Eds, LogicalDns, Aggregate> type;
 
   // The LB policy to use for locality and endpoint picking.
@@ -97,7 +112,7 @@ struct XdsClusterResource : public XdsResourceType::ResourceData {
   bool use_http_connect = false;
 
   // Tls Context used by clients
-  CommonTlsContext common_tls_context;
+  UpstreamTlsContext upstream_tls_context;
 
   // Connection idle timeout.  Currently used only for SSA.
   Duration connection_idle_timeout = Duration::Hours(1);
@@ -119,7 +134,7 @@ struct XdsClusterResource : public XdsResourceType::ResourceData {
            LrsBackendMetricPropagationEqual(
                lrs_backend_metric_propagation,
                other.lrs_backend_metric_propagation) &&
-           common_tls_context == other.common_tls_context &&
+           upstream_tls_context == other.upstream_tls_context &&
            connection_idle_timeout == other.connection_idle_timeout &&
            max_concurrent_requests == other.max_concurrent_requests &&
            outlier_detection == other.outlier_detection &&

data/src/core/xds/grpc/xds_cluster_parser.cc

@@ -77,6 +77,15 @@ bool XdsHttpConnectEnabled() {
 
 namespace {
 
+// TODO(mlumish): Remove this after the 1.81 release.
+bool XdsSniEnabled() {
+  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_SNI");
+  if (!value.has_value()) return true;
+  bool parsed_value;
+  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
+  return parse_succeeded && parsed_value;
+}
+
 constexpr absl::string_view kUpstreamTlsContextType =
     "envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext";
 
@@ -84,40 +93,56 @@ constexpr absl::string_view kHttp11ProxyType =
     "envoy.extensions.transport_sockets.http_11_proxy.v3"
     ".Http11ProxyUpstreamTransport";
 
-CommonTlsContext UpstreamTlsContextParse(
+XdsClusterResource::UpstreamTlsContext UpstreamTlsContextParse(
     const XdsResourceType::DecodeContext& context,
     const XdsExtension& extension, ValidationErrors* errors) {
+  XdsClusterResource::UpstreamTlsContext upstream_tls_context;
   const absl::string_view* serialized_upstream_tls_context =
       std::get_if<absl::string_view>(&extension.value);
   if (serialized_upstream_tls_context == nullptr) {
     errors->AddError("can't decode UpstreamTlsContext");
     return {};
   }
-  const auto* upstream_tls_context =
+  const auto* upstream_tls_context_proto =
       envoy_extensions_transport_sockets_tls_v3_UpstreamTlsContext_parse(
           serialized_upstream_tls_context->data(),
           serialized_upstream_tls_context->size(), context.arena);
-  if (upstream_tls_context == nullptr) {
+  if (upstream_tls_context_proto == nullptr) {
     errors->AddError("can't decode UpstreamTlsContext");
     return {};
   }
+  if (XdsSniEnabled()) {
+    upstream_tls_context.sni = UpbStringToStdString(
+        envoy_extensions_transport_sockets_tls_v3_UpstreamTlsContext_sni(
+            upstream_tls_context_proto));
+    if (upstream_tls_context.sni.length() > 255) {
+      ValidationErrors::ScopedField field(errors, ".sni");
+      errors->AddError("must be shorter than 255 characters");
+    }
+    upstream_tls_context.auto_host_sni =
+        envoy_extensions_transport_sockets_tls_v3_UpstreamTlsContext_auto_host_sni(
+            upstream_tls_context_proto);
+    upstream_tls_context.auto_sni_san_validation =
+        envoy_extensions_transport_sockets_tls_v3_UpstreamTlsContext_auto_sni_san_validation(
+            upstream_tls_context_proto);
+  }
   ValidationErrors::ScopedField field3(errors, ".common_tls_context");
   const auto* common_tls_context_proto =
       envoy_extensions_transport_sockets_tls_v3_UpstreamTlsContext_common_tls_context(
-          upstream_tls_context);
-  CommonTlsContext common_tls_context;
+          upstream_tls_context_proto);
   if (common_tls_context_proto != nullptr) {
-    common_tls_context =
+    upstream_tls_context.common_tls_context =
         CommonTlsContextParse(context, common_tls_context_proto, errors);
   }
   if (std::holds_alternative<std::monostate>(
-          common_tls_context.certificate_validation_context.ca_certs)) {
+          upstream_tls_context.common_tls_context.certificate_validation_context
+              .ca_certs)) {
     errors->AddError("no CA certs configured");
   }
-  return common_tls_context;
+  return upstream_tls_context;
 }
 
-CommonTlsContext Http11ProxyUpstreamTransportParse(
+XdsClusterResource::UpstreamTlsContext Http11ProxyUpstreamTransportParse(
     const XdsResourceType::DecodeContext& context,
     const XdsExtension& extension, ValidationErrors* errors) {
   const absl::string_view* serialized =
@@ -490,10 +515,10 @@ absl::StatusOr<std::shared_ptr<const XdsClusterResource>> CdsResourceParse(
     if (extension.has_value()) {
       if (XdsHttpConnectEnabled() && extension->type == kHttp11ProxyType) {
         cds_update->use_http_connect = true;
-        cds_update->common_tls_context =
+        cds_update->upstream_tls_context =
             Http11ProxyUpstreamTransportParse(context, *extension, &errors);
       } else if (extension->type == kUpstreamTlsContextType) {
-        cds_update->common_tls_context =
+        cds_update->upstream_tls_context =
             UpstreamTlsContextParse(context, *extension, &errors);
       } else {
         ValidationErrors::ScopedField field(&errors, ".type_url");

data/src/core/xds/grpc/xds_common_types.cc

@@ -100,4 +100,49 @@ bool CommonTlsContext::Empty() const {
          certificate_validation_context.Empty();
 }
 
+//
+// HeaderMutationRules
+//
+
+bool HeaderMutationRules::IsMutationAllowed(
+    const std::string& header_name) const {
+  // If true, all header mutations are disallowed, regardless of any other
+  // setting.
+  if (disallow_all) {
+    return false;
+  }
+  // If a header name matches this regex, then it will be disallowed
+  if (disallow_expression != nullptr &&
+      RE2::FullMatch(header_name, *disallow_expression)) {
+    return false;
+  }
+  // If a header name matches this regex and does not match disallow_expression,
+  // it will be allowed. If unset, then all headers not matching
+  // disallow_expression are allowed
+  if (allow_expression == nullptr ||
+      RE2::FullMatch(header_name, *allow_expression)) {
+    return true;
+  }
+  return false;
+}
+
+std::string HeaderMutationRules::ToString() const {
+  std::vector<std::string> contents;
+  if (disallow_all) {
+    contents.push_back("disallow_all=true");
+  }
+  if (disallow_is_error) {
+    contents.push_back("disallow_is_error=true");
+  }
+  if (allow_expression != nullptr) {
+    contents.push_back(
+        absl::StrCat("allow_expression=", allow_expression->pattern()));
+  }
+  if (disallow_expression != nullptr) {
+    contents.push_back(
+        absl::StrCat("disallow_expression=", disallow_expression->pattern()));
+  }
+  return absl::StrCat("{", absl::StrJoin(contents, ", "), "}");
+}
+
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_common_types.h

@@ -24,6 +24,7 @@
 #include "src/core/util/json/json.h"
 #include "src/core/util/matchers.h"
 #include "src/core/util/validation_errors.h"
+#include "src/core/xds/grpc/xds_server_grpc.h"
 #include "absl/strings/string_view.h"
 
 namespace grpc_core {
@@ -85,6 +86,36 @@ struct XdsExtension {
   std::vector<ValidationErrors::ScopedField> validation_fields;
 };
 
+struct XdsGrpcService {
+  std::unique_ptr<GrpcXdsServerTarget> server_target;
+  Duration timeout;
+  std::vector<std::pair<std::string, std::string>> initial_metadata;
+};
+
+struct HeaderMutationRules {
+  bool disallow_all = false;
+  bool disallow_is_error = false;
+  std::unique_ptr<RE2> allow_expression;
+  std::unique_ptr<RE2> disallow_expression;
+
+  bool IsMutationAllowed(const std::string& header_name) const;
+
+  std::string ToString() const;
+
+  bool operator==(const HeaderMutationRules& other) const {
+    auto is_re_equal = [](RE2* a, RE2* b) {
+      if (a == nullptr) return b == nullptr;
+      if (b == nullptr) return false;
+      return a->pattern() == b->pattern();
+    };
+    return disallow_all == other.disallow_all &&
+           disallow_is_error == other.disallow_is_error &&
+           is_re_equal(disallow_expression.get(),
+                       other.disallow_expression.get()) &&
+           is_re_equal(allow_expression.get(), other.allow_expression.get());
+  }
+};
+
 }  // namespace grpc_core
 
 #endif  // GRPC_SRC_CORE_XDS_GRPC_XDS_COMMON_TYPES_H

data/src/core/xds/grpc/xds_common_types_parser.cc

@@ -32,7 +32,9 @@
 #include "google/protobuf/struct.upb.h"
 #include "google/protobuf/struct.upbdefs.h"
 #include "google/protobuf/wrappers.upb.h"
+#include "src/core/config/core_configuration.h"
 #include "src/core/lib/address_utils/parse_address.h"
+#include "src/core/lib/surface/validate_metadata.h"
 #include "src/core/util/down_cast.h"
 #include "src/core/util/env.h"
 #include "src/core/util/json/json_reader.h"
@@ -521,6 +523,25 @@ absl::StatusOr<Json> ParseProtobufStructToJson(
 // ExtractXdsExtension()
 //
 
+namespace {
+
+bool StripTypePrefix(absl::string_view& type, ValidationErrors* errors) {
+  ValidationErrors::ScopedField field(errors, ".type_url");
+  if (type.empty()) {
+    errors->AddError("field not present");
+    return false;
+  }
+  size_t pos = type.rfind('/');
+  if (pos == absl::string_view::npos || pos == type.size() - 1) {
+    errors->AddError(absl::StrCat("invalid value \"", type, "\""));
+  } else {
+    type = type.substr(pos + 1);
+  }
+  return true;
+}
+
+}  // namespace
+
 std::optional<XdsExtension> ExtractXdsExtension(
     const XdsResourceType::DecodeContext& context,
     const google_protobuf_Any* any, ValidationErrors* errors) {
@@ -529,22 +550,8 @@ std::optional<XdsExtension> ExtractXdsExtension(
     return std::nullopt;
   }
   XdsExtension extension;
-  auto strip_type_prefix = [&]() {
-    ValidationErrors::ScopedField field(errors, ".type_url");
-    if (extension.type.empty()) {
-      errors->AddError("field not present");
-      return false;
-    }
-    size_t pos = extension.type.rfind('/');
-    if (pos == absl::string_view::npos || pos == extension.type.size() - 1) {
-      errors->AddError(absl::StrCat("invalid value \"", extension.type, "\""));
-    } else {
-      extension.type = extension.type.substr(pos + 1);
-    }
-    return true;
-  };
   extension.type = UpbStringToAbsl(google_protobuf_Any_type_url(any));
-  if (!strip_type_prefix()) return std::nullopt;
+  if (!StripTypePrefix(extension.type, errors)) return std::nullopt;
   extension.validation_fields.emplace_back(
       errors, absl::StrCat(".value[", extension.type, "]"));
   absl::string_view any_value = UpbStringToAbsl(google_protobuf_Any_value(any));
@@ -558,7 +565,7 @@ std::optional<XdsExtension> ExtractXdsExtension(
     }
     extension.type =
         UpbStringToAbsl(xds_type_v3_TypedStruct_type_url(typed_struct));
-    if (!strip_type_prefix()) return std::nullopt;
+    if (!StripTypePrefix(extension.type, errors)) return std::nullopt;
     extension.validation_fields.emplace_back(
         errors, absl::StrCat(".value[", extension.type, "]"));
     auto* protobuf_struct = xds_type_v3_TypedStruct_value(typed_struct);
@@ -578,4 +585,255 @@ std::optional<XdsExtension> ExtractXdsExtension(
   return std::move(extension);
 }
 
+//
+// ParseXdsGrpcService()
+//
+
+namespace {
+
+absl::string_view GetHeaderValue(upb_StringView upb_value,
+                                 absl::string_view field_name, bool validate,
+                                 ValidationErrors* errors) {
+  absl::string_view value = UpbStringToAbsl(upb_value);
+  if (!value.empty()) {
+    ValidationErrors::ScopedField field(errors, field_name);
+    if (value.size() > 16384) errors->AddError("longer than 16384 bytes");
+    if (validate) {
+      ValidateMetadataResult result =
+          ValidateNonBinaryHeaderValueIsLegal(value);
+      if (result != ValidateMetadataResult::kOk) {
+        errors->AddError(ValidateMetadataResultToString(result));
+      }
+    }
+  }
+  return value;
+}
+
+std::pair<std::string, std::string> ParseHeader(
+    const envoy_config_core_v3_HeaderValue* header_value,
+    ValidationErrors* errors) {
+  // key
+  absl::string_view key =
+      UpbStringToAbsl(envoy_config_core_v3_HeaderValue_key(header_value));
+  {
+    ValidationErrors::ScopedField field(errors, ".key");
+    if (key.size() > 16384) errors->AddError("longer than 16384 bytes");
+    ValidateMetadataResult result = ValidateHeaderKeyIsLegal(key);
+    if (result != ValidateMetadataResult::kOk) {
+      errors->AddError(ValidateMetadataResultToString(result));
+    }
+  }
+  // value or raw_value
+  absl::string_view value;
+  if (absl::EndsWith(key, "-bin")) {
+    value =
+        GetHeaderValue(envoy_config_core_v3_HeaderValue_raw_value(header_value),
+                       ".raw_value", /*validate=*/false, errors);
+    if (value.empty()) {
+      value =
+          GetHeaderValue(envoy_config_core_v3_HeaderValue_value(header_value),
+                         ".value", /*validate=*/true, errors);
+      if (value.empty()) {
+        errors->AddError("either value or raw_value must be set");
+      }
+    }
+  } else {
+    // Key does not end in "-bin".
+    value = GetHeaderValue(envoy_config_core_v3_HeaderValue_value(header_value),
+                           ".value", /*validate=*/true, errors);
+    if (value.empty()) {
+      ValidationErrors::ScopedField field(errors, ".value");
+      errors->AddError("field not set");
+    }
+  }
+  return {std::string(key), std::string(value)};
+}
+
+}  // namespace
+
+XdsGrpcService ParseXdsGrpcService(
+    const XdsResourceType::DecodeContext& context,
+    const envoy_config_core_v3_GrpcService* grpc_service,
+    ValidationErrors* errors) {
+  if (grpc_service == nullptr) {
+    errors->AddError("field not set");
+    return {};
+  }
+  XdsGrpcService xds_grpc_service;
+  // timeout
+  if (auto* timeout = envoy_config_core_v3_GrpcService_timeout(grpc_service);
+      timeout != nullptr) {
+    ValidationErrors::ScopedField field(errors, ".timeout");
+    xds_grpc_service.timeout = ParseDuration(timeout, errors);
+    if (xds_grpc_service.timeout <= Duration::Zero()) {
+      errors->AddError("duration must be positive");
+    }
+  }
+  // initial_metadata
+  size_t initial_metadata_size;
+  auto* initial_metadata = envoy_config_core_v3_GrpcService_initial_metadata(
+      grpc_service, &initial_metadata_size);
+  for (size_t i = 0; i < initial_metadata_size; ++i) {
+    ValidationErrors::ScopedField field(
+        errors, absl::StrCat(".initial_metadata[", i, "]"));
+    xds_grpc_service.initial_metadata.push_back(
+        ParseHeader(initial_metadata[i], errors));
+  }
+  // google_grpc
+  ValidationErrors::ScopedField field(errors, ".google_grpc");
+  auto* google_grpc =
+      envoy_config_core_v3_GrpcService_google_grpc(grpc_service);
+  if (google_grpc == nullptr) {
+    errors->AddError("field not set");
+  } else {
+    // target_uri
+    std::string target_uri = UpbStringToStdString(
+        envoy_config_core_v3_GrpcService_GoogleGrpc_target_uri(google_grpc));
+    if (!CoreConfiguration::Get().resolver_registry().IsValidTarget(
+            target_uri)) {
+      ValidationErrors::ScopedField field(errors, ".target_uri");
+      errors->AddError("invalid target URI");
+    }
+    // credentials
+    RefCountedPtr<const ChannelCredsConfig> channel_creds_config;
+    std::vector<RefCountedPtr<const CallCredsConfig>> call_creds_configs;
+    if (DownCast<const GrpcXdsServer&>(context.server).TrustedXdsServer()) {
+      // Trusted xDS server.  Use credentials from the GoogleGrpc proto.
+      // First, look at channel creds.
+      {
+        ValidationErrors::ScopedField field(errors,
+                                            ".channel_credentials_plugin");
+        size_t size;
+        const auto* const* channel_creds_plugin =
+            envoy_config_core_v3_GrpcService_GoogleGrpc_channel_credentials_plugin(
+                google_grpc, &size);
+        if (size == 0) {
+          errors->AddError("field not set");
+        } else {
+          const auto& registry =
+              CoreConfiguration::Get().channel_creds_registry();
+          const auto& certificate_providers =
+              DownCast<const GrpcXdsBootstrap&>(context.client->bootstrap())
+                  .certificate_providers();
+          for (size_t i = 0; i < size; ++i) {
+            ValidationErrors::ScopedField field(errors,
+                                                absl::StrCat("[", i, "]"));
+            absl::string_view type = UpbStringToAbsl(
+                google_protobuf_Any_type_url(channel_creds_plugin[i]));
+            if (!StripTypePrefix(type, errors)) continue;
+            if (!registry.IsProtoSupported(type)) continue;
+            ValidationErrors::ScopedField field2(errors, ".value");
+            absl::string_view serialized_config = UpbStringToAbsl(
+                google_protobuf_Any_value(channel_creds_plugin[i]));
+            channel_creds_config = registry.ParseProto(
+                type, serialized_config, certificate_providers, errors);
+            break;
+          }
+          if (channel_creds_config == nullptr) {
+            errors->AddError("no supported channel credentials type found");
+          }
+        }
+      }
+      // Now look at call creds.
+      {
+        ValidationErrors::ScopedField field(errors, ".call_credentials_plugin");
+        size_t size;
+        const auto* const* call_creds_plugin =
+            envoy_config_core_v3_GrpcService_GoogleGrpc_call_credentials_plugin(
+                google_grpc, &size);
+        const auto& registry = CoreConfiguration::Get().call_creds_registry();
+        for (size_t i = 0; i < size; ++i) {
+          ValidationErrors::ScopedField field(errors,
+                                              absl::StrCat("[", i, "]"));
+          absl::string_view type = UpbStringToAbsl(
+              google_protobuf_Any_type_url(call_creds_plugin[i]));
+          if (!StripTypePrefix(type, errors)) continue;
+          if (!registry.IsProtoSupported(type)) continue;
+          ValidationErrors::ScopedField field2(errors, ".value");
+          absl::string_view serialized_config =
+              UpbStringToAbsl(google_protobuf_Any_value(call_creds_plugin[i]));
+          call_creds_configs.push_back(
+              registry.ParseProto(type, serialized_config, errors));
+        }
+      }
+    } else {
+      // Not a trusted xDS server.  Do lookup in bootstrap.
+      const auto& bootstrap =
+          DownCast<const GrpcXdsBootstrap&>(context.client->bootstrap());
+      auto& allowed_grpc_services = bootstrap.allowed_grpc_services();
+      auto it = allowed_grpc_services.find(target_uri);
+      if (it == allowed_grpc_services.end()) {
+        ValidationErrors::ScopedField field(errors, ".target_uri");
+        errors->AddError(
+            "service not present in \"allowed_grpc_services\" "
+            "in bootstrap config");
+      } else {
+        channel_creds_config = it->second.channel_creds_config;
+        call_creds_configs = it->second.call_creds_configs;
+      }
+    }
+    xds_grpc_service.server_target = std::make_unique<GrpcXdsServerTarget>(
+        target_uri, std::move(channel_creds_config),
+        std::move(call_creds_configs));
+  }
+  return xds_grpc_service;
+}
+
+//
+// ParseHeaderMutationRules()
+//
+namespace {
+
+std::unique_ptr<RE2> ParseRegexMatcher(
+    const envoy_type_matcher_v3_RegexMatcher* regex_matcher,
+    ValidationErrors* errors) {
+  auto matcher = UpbStringToStdString(
+      envoy_type_matcher_v3_RegexMatcher_regex(regex_matcher));
+  auto regex = std::make_unique<RE2>(matcher);
+  if (!regex->ok()) {
+    errors->AddError(absl::StrCat("Invalid regex string specified in matcher: ",
+                                  regex->error()));
+    return nullptr;
+  }
+  return regex;
+}
+
+}  // namespace
+
+HeaderMutationRules ParseHeaderMutationRules(
+    const envoy_config_common_mutation_rules_v3_HeaderMutationRules*
+        header_mutation_rules,
+    ValidationErrors* errors) {
+  if (header_mutation_rules == nullptr) {
+    errors->AddError("field is not present");
+    return {};
+  }
+  HeaderMutationRules header_mutation_rules_config;
+  header_mutation_rules_config.disallow_all =
+      envoy_config_common_mutation_rules_v3_HeaderMutationRules_disallow_all(
+          header_mutation_rules);
+  header_mutation_rules_config.disallow_is_error =
+      envoy_config_common_mutation_rules_v3_HeaderMutationRules_disallow_is_error(
+          header_mutation_rules);
+  const auto* disallow_expression_proto =
+      envoy_config_common_mutation_rules_v3_HeaderMutationRules_disallow_expression(
+          header_mutation_rules);
+  if (disallow_expression_proto != nullptr) {
+    ValidationErrors::ScopedField field(
+        errors, ".header_mutation_rules.disallow_expression");
+    header_mutation_rules_config.disallow_expression =
+        ParseRegexMatcher(disallow_expression_proto, errors);
+  }
+  const auto* allow_expression_proto =
+      envoy_config_common_mutation_rules_v3_HeaderMutationRules_allow_expression(
+          header_mutation_rules);
+  if (allow_expression_proto != nullptr) {
+    ValidationErrors::ScopedField field(
+        errors, ".header_mutation_rules.allow_expression");
+    header_mutation_rules_config.allow_expression =
+        ParseRegexMatcher(allow_expression_proto, errors);
+  }
+  return header_mutation_rules_config;
+}
+
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_common_types_parser.h

@@ -19,7 +19,9 @@
 
 #include <optional>
 
+#include "envoy/config/common/mutation_rules/v3/mutation_rules.upb.h"
 #include "envoy/config/core/v3/base.upb.h"
+#include "envoy/config/core/v3/grpc_service.upb.h"
 #include "envoy/extensions/transport_sockets/tls/v3/tls.upb.h"
 #include "envoy/type/matcher/v3/string.upb.h"
 #include "google/protobuf/any.upb.h"
@@ -84,6 +86,16 @@ std::optional<XdsExtension> ExtractXdsExtension(
     const XdsResourceType::DecodeContext& context,
     const google_protobuf_Any* any, ValidationErrors* errors);
 
+XdsGrpcService ParseXdsGrpcService(
+    const XdsResourceType::DecodeContext& context,
+    const envoy_config_core_v3_GrpcService* grpc_service,
+    ValidationErrors* errors);
+
+HeaderMutationRules ParseHeaderMutationRules(
+    const envoy_config_common_mutation_rules_v3_HeaderMutationRules*
+        header_mutation_rules,
+    ValidationErrors* errors);
+
 }  // namespace grpc_core
 
 #endif  // GRPC_SRC_CORE_XDS_GRPC_XDS_COMMON_TYPES_PARSER_H