grpc 1.82.0 → 1.83.0.pre1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Makefile +8 -5
- data/etc/roots.pem +10400 -3855
- data/include/grpc/grpc_audit_logging.h +2 -2
- data/include/grpc/grpc_security_constants.h +2 -0
- data/include/grpc/impl/channel_arg_names.h +23 -0
- data/src/core/call/call_filters.h +19 -3
- data/src/core/call/call_spine.h +4 -4
- data/src/core/call/client_call.cc +1 -1
- data/src/core/call/metadata.cc +7 -2
- data/src/core/call/server_call.cc +13 -3
- data/src/core/call/server_call.h +5 -3
- data/src/core/client_channel/backup_poller.cc +2 -17
- data/src/core/client_channel/client_channel.cc +17 -14
- data/src/core/client_channel/client_channel.h +3 -1
- data/src/core/client_channel/client_channel_filter.cc +11 -13
- data/src/core/client_channel/client_channel_service_config.cc +5 -13
- data/src/core/client_channel/direct_channel.cc +5 -1
- data/src/core/client_channel/direct_channel.h +3 -1
- data/src/core/config/experiment_env_var.cc +30 -0
- data/src/core/config/experiment_env_var.h +26 -0
- data/src/core/credentials/call/regional_access_boundary_fetcher.cc +6 -6
- data/src/core/credentials/transport/ssl/ssl_security_connector.cc +14 -2
- data/src/core/credentials/transport/tls/grpc_tls_certificate_selector.cc +172 -0
- data/src/core/credentials/transport/tls/grpc_tls_certificate_selector.h +103 -0
- data/src/core/credentials/transport/tls/load_system_roots_fallback.cc +3 -2
- data/src/core/credentials/transport/tls/load_system_roots_supported.cc +10 -3
- data/src/core/credentials/transport/tls/tls_security_connector.cc +14 -2
- data/src/core/credentials/transport/xds/xds_credentials.cc +4 -12
- data/src/core/ext/filters/rbac/rbac_service_config_parser.cc +2 -1
- data/src/core/ext/transport/chttp2/server/chttp2_server.cc +19 -13
- data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc +11 -9
- data/src/core/ext/transport/chttp2/transport/flow_control.cc +2 -2
- data/src/core/ext/transport/chttp2/transport/flow_control.h +3 -2
- data/src/core/ext/transport/chttp2/transport/frame.cc +58 -1
- data/src/core/ext/transport/chttp2/transport/frame.h +13 -1
- data/src/core/ext/transport/chttp2/transport/frame_rst_stream.cc +2 -4
- data/src/core/ext/transport/chttp2/transport/frame_security.cc +10 -1
- data/src/core/ext/transport/chttp2/transport/frame_security.h +2 -1
- data/src/core/ext/transport/chttp2/transport/goaway.cc +11 -1
- data/src/core/ext/transport/chttp2/transport/goaway.h +17 -1
- data/src/core/ext/transport/chttp2/transport/hpack_parser.cc +9 -0
- data/src/core/ext/transport/chttp2/transport/http2_client_transport.cc +117 -276
- data/src/core/ext/transport/chttp2/transport/http2_client_transport.h +44 -17
- data/src/core/ext/transport/chttp2/transport/http2_server_transport.cc +382 -496
- data/src/core/ext/transport/chttp2/transport/http2_server_transport.h +75 -77
- data/src/core/ext/transport/chttp2/transport/http2_settings.cc +1 -1
- data/src/core/ext/transport/chttp2/transport/http2_settings.h +30 -11
- data/src/core/ext/transport/chttp2/transport/http2_settings_promises.h +24 -9
- data/src/core/ext/transport/chttp2/transport/http2_transport.cc +26 -0
- data/src/core/ext/transport/chttp2/transport/http2_transport.h +2 -0
- data/src/core/ext/transport/chttp2/transport/internal.h +4 -0
- data/src/core/ext/transport/chttp2/transport/parsing.cc +3 -2
- data/src/core/ext/transport/chttp2/transport/ping_promise.cc +1 -1
- data/src/core/ext/transport/chttp2/transport/ping_rate_policy.cc +4 -10
- data/src/core/ext/transport/chttp2/transport/read_context.h +62 -20
- data/src/core/ext/transport/chttp2/transport/security_frame.h +1 -0
- data/src/core/ext/transport/chttp2/transport/stream.h +271 -120
- data/src/core/ext/transport/chttp2/transport/stream_data_queue.h +77 -61
- data/src/core/handshaker/security/secure_endpoint.cc +0 -13
- data/src/core/lib/channel/promise_based_filter.cc +77 -3
- data/src/core/lib/channel/promise_based_filter.h +238 -184
- data/src/core/lib/event_engine/extensions/receive_coalescing_extension.h +0 -4
- data/src/core/lib/event_engine/extensions/tcp_trace.h +1 -1
- data/src/core/lib/event_engine/posix_engine/posix_engine.cc +2 -12
- data/src/core/lib/event_engine/shim.cc +2 -16
- data/src/core/lib/event_engine/shim.h +0 -4
- data/src/core/lib/experiments/experiments.cc +51 -102
- data/src/core/lib/experiments/experiments.h +37 -59
- data/src/core/lib/iomgr/error.cc +3 -73
- data/src/core/lib/iomgr/error.h +8 -6
- data/src/core/lib/iomgr/error_cfstream.cc +1 -2
- data/src/core/lib/iomgr/ev_epoll1_linux.cc +2 -6
- data/src/core/lib/iomgr/ev_poll_posix.cc +2 -6
- data/src/core/lib/iomgr/tcp_posix.cc +2 -6
- data/src/core/lib/security/authorization/audit_logging.cc +2 -2
- data/src/core/lib/security/authorization/audit_logging.h +3 -3
- data/src/core/lib/security/authorization/grpc_authorization_engine.cc +11 -13
- data/src/core/lib/security/authorization/grpc_authorization_engine.h +1 -1
- data/src/core/lib/security/authorization/matchers.cc +20 -20
- data/src/core/lib/security/authorization/matchers.h +15 -16
- data/src/core/lib/security/authorization/rbac_policy.h +1 -1
- data/src/core/lib/security/authorization/stdout_logger.cc +3 -3
- data/src/core/lib/security/authorization/stdout_logger.h +6 -5
- data/src/core/lib/surface/call.cc +0 -8
- data/src/core/lib/surface/call.h +2 -0
- data/src/core/lib/surface/channel.cc +21 -2
- data/src/core/lib/surface/channel.h +14 -6
- data/src/core/lib/surface/filter_stack_call.cc +10 -29
- data/src/core/lib/surface/legacy_channel.cc +7 -7
- data/src/core/lib/surface/legacy_channel.h +3 -1
- data/src/core/lib/surface/version.cc +2 -2
- data/src/core/lib/transport/bdp_estimator.cc +13 -13
- data/src/core/lib/transport/bdp_estimator.h +9 -5
- data/src/core/lib/transport/error_utils.cc +26 -138
- data/src/core/lib/transport/promise_endpoint.h +2 -4
- data/src/core/load_balancing/grpclb/grpclb.cc +2 -1
- data/src/core/load_balancing/pick_first/pick_first.cc +33 -2
- data/src/core/load_balancing/pick_first/pick_first.h +6 -0
- data/src/core/load_balancing/ring_hash/ring_hash.cc +3 -10
- data/src/core/load_balancing/rls/rls.cc +2 -1
- data/src/core/load_balancing/weighted_round_robin/weighted_round_robin.cc +2 -7
- data/src/core/load_balancing/xds/cds.cc +80 -56
- data/src/core/load_balancing/xds/cds.h +21 -0
- data/src/core/mitigation_engine/mitigation.h +53 -0
- data/src/core/mitigation_engine/mitigation_provider.h +62 -0
- data/src/core/resolver/dns/dns_resolver_plugin.cc +1 -6
- data/src/core/resolver/xds/xds_resolver.cc +14 -11
- data/src/core/server/server.h +1 -4
- data/src/core/server/server_config_selector.h +5 -4
- data/src/core/server/server_config_selector_filter.cc +67 -80
- data/src/core/server/xds_server_config_fetcher.cc +681 -692
- data/src/core/server/xds_server_config_fetcher_legacy.cc +15 -12
- data/src/core/telemetry/call_tracer.cc +49 -2
- data/src/core/telemetry/call_tracer.h +1 -0
- data/src/core/telemetry/tcp_tracer.h +38 -0
- data/src/core/tsi/alts/handshaker/alts_handshaker_client.cc +1 -1
- data/src/core/tsi/ssl_telemetry_utils.cc +343 -0
- data/src/core/tsi/ssl_telemetry_utils.h +74 -0
- data/src/core/tsi/ssl_transport_security.cc +577 -301
- data/src/core/tsi/ssl_transport_security.h +22 -6
- data/src/core/tsi/ssl_transport_security_utils.cc +2 -0
- data/src/core/tsi/transport_security.h +7 -0
- data/src/core/util/http_client/httpcli.cc +1 -4
- data/src/core/util/http_client/httpcli_security_connector.cc +2 -1
- data/src/core/util/status_helper.cc +71 -192
- data/src/core/util/status_helper.h +16 -21
- data/src/core/xds/grpc/file_watcher_certificate_provider_factory.cc +2 -11
- data/src/core/xds/grpc/xds_bootstrap_grpc.cc +2 -7
- data/src/core/xds/grpc/xds_cluster_parser.cc +5 -16
- data/src/core/xds/grpc/xds_common_types.cc +94 -38
- data/src/core/xds/grpc/xds_common_types.h +33 -18
- data/src/core/xds/grpc/xds_common_types_parser.cc +168 -100
- data/src/core/xds/grpc/xds_common_types_parser.h +18 -1
- data/src/core/xds/grpc/xds_endpoint_parser.cc +6 -17
- data/src/core/xds/grpc/xds_http_filter_registry.cc +2 -10
- data/src/core/xds/grpc/xds_http_rbac_filter.cc +3 -12
- data/src/core/xds/grpc/xds_metadata_parser.cc +0 -2
- data/src/core/xds/grpc/xds_route_config_parser.cc +7 -11
- data/src/core/xds/grpc/xds_routing.cc +113 -82
- data/src/core/xds/grpc/xds_routing.h +70 -20
- data/src/core/xds/grpc/xds_server_grpc.cc +22 -13
- data/src/core/xds/grpc/xds_server_grpc.h +16 -2
- data/src/core/xds/grpc/xds_server_grpc_interface.h +10 -0
- data/src/core/xds/grpc/xds_transport_grpc.cc +123 -18
- data/src/core/xds/grpc/xds_transport_grpc.h +28 -4
- data/src/core/xds/xds_client/lrs_client.cc +3 -7
- data/src/core/xds/xds_client/xds_bootstrap.cc +4 -16
- data/src/core/xds/xds_client/xds_client.cc +2 -15
- data/src/core/xds/xds_client/xds_transport.h +3 -0
- data/src/ruby/lib/grpc/version.rb +1 -1
- data/src/ruby/pb/src/proto/grpc/testing/messages_pb.rb +1 -1
- metadata +9 -1
|
@@ -30,13 +30,13 @@
|
|
|
30
30
|
namespace grpc_core {
|
|
31
31
|
|
|
32
32
|
std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
|
|
33
|
-
Rbac::Permission permission) {
|
|
33
|
+
const Rbac::Permission& permission) {
|
|
34
34
|
switch (permission.type) {
|
|
35
35
|
case Rbac::Permission::RuleType::kAnd: {
|
|
36
36
|
std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
|
|
37
37
|
matchers.reserve(permission.permissions.size());
|
|
38
38
|
for (const auto& rule : permission.permissions) {
|
|
39
|
-
matchers.push_back(AuthorizationMatcher::Create(
|
|
39
|
+
matchers.push_back(AuthorizationMatcher::Create(*rule));
|
|
40
40
|
}
|
|
41
41
|
return std::make_unique<AndAuthorizationMatcher>(std::move(matchers));
|
|
42
42
|
}
|
|
@@ -44,43 +44,43 @@ std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
|
|
|
44
44
|
std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
|
|
45
45
|
matchers.reserve(permission.permissions.size());
|
|
46
46
|
for (const auto& rule : permission.permissions) {
|
|
47
|
-
matchers.push_back(AuthorizationMatcher::Create(
|
|
47
|
+
matchers.push_back(AuthorizationMatcher::Create(*rule));
|
|
48
48
|
}
|
|
49
49
|
return std::make_unique<OrAuthorizationMatcher>(std::move(matchers));
|
|
50
50
|
}
|
|
51
51
|
case Rbac::Permission::RuleType::kNot:
|
|
52
52
|
return std::make_unique<NotAuthorizationMatcher>(
|
|
53
|
-
AuthorizationMatcher::Create(
|
|
53
|
+
AuthorizationMatcher::Create(*permission.permissions[0]));
|
|
54
54
|
case Rbac::Permission::RuleType::kAny:
|
|
55
55
|
return std::make_unique<AlwaysAuthorizationMatcher>();
|
|
56
56
|
case Rbac::Permission::RuleType::kHeader:
|
|
57
57
|
return std::make_unique<HeaderAuthorizationMatcher>(
|
|
58
|
-
|
|
58
|
+
permission.header_matcher);
|
|
59
59
|
case Rbac::Permission::RuleType::kPath:
|
|
60
60
|
return std::make_unique<PathAuthorizationMatcher>(
|
|
61
|
-
|
|
61
|
+
permission.string_matcher);
|
|
62
62
|
case Rbac::Permission::RuleType::kDestIp:
|
|
63
63
|
return std::make_unique<IpAuthorizationMatcher>(
|
|
64
|
-
IpAuthorizationMatcher::Type::kDestIp,
|
|
64
|
+
IpAuthorizationMatcher::Type::kDestIp, permission.ip);
|
|
65
65
|
case Rbac::Permission::RuleType::kDestPort:
|
|
66
66
|
return std::make_unique<PortAuthorizationMatcher>(permission.port);
|
|
67
67
|
case Rbac::Permission::RuleType::kMetadata:
|
|
68
68
|
return std::make_unique<MetadataAuthorizationMatcher>(permission.invert);
|
|
69
69
|
case Rbac::Permission::RuleType::kReqServerName:
|
|
70
70
|
return std::make_unique<ReqServerNameAuthorizationMatcher>(
|
|
71
|
-
|
|
71
|
+
permission.string_matcher);
|
|
72
72
|
}
|
|
73
73
|
return nullptr;
|
|
74
74
|
}
|
|
75
75
|
|
|
76
76
|
std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
|
|
77
|
-
Rbac::Principal principal) {
|
|
77
|
+
const Rbac::Principal& principal) {
|
|
78
78
|
switch (principal.type) {
|
|
79
79
|
case Rbac::Principal::RuleType::kAnd: {
|
|
80
80
|
std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
|
|
81
81
|
matchers.reserve(principal.principals.size());
|
|
82
82
|
for (const auto& id : principal.principals) {
|
|
83
|
-
matchers.push_back(AuthorizationMatcher::Create(
|
|
83
|
+
matchers.push_back(AuthorizationMatcher::Create(*id));
|
|
84
84
|
}
|
|
85
85
|
return std::make_unique<AndAuthorizationMatcher>(std::move(matchers));
|
|
86
86
|
}
|
|
@@ -88,34 +88,33 @@ std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
|
|
|
88
88
|
std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
|
|
89
89
|
matchers.reserve(principal.principals.size());
|
|
90
90
|
for (const auto& id : principal.principals) {
|
|
91
|
-
matchers.push_back(AuthorizationMatcher::Create(
|
|
91
|
+
matchers.push_back(AuthorizationMatcher::Create(*id));
|
|
92
92
|
}
|
|
93
93
|
return std::make_unique<OrAuthorizationMatcher>(std::move(matchers));
|
|
94
94
|
}
|
|
95
95
|
case Rbac::Principal::RuleType::kNot:
|
|
96
96
|
return std::make_unique<NotAuthorizationMatcher>(
|
|
97
|
-
AuthorizationMatcher::Create(
|
|
97
|
+
AuthorizationMatcher::Create(*principal.principals[0]));
|
|
98
98
|
case Rbac::Principal::RuleType::kAny:
|
|
99
99
|
return std::make_unique<AlwaysAuthorizationMatcher>();
|
|
100
100
|
case Rbac::Principal::RuleType::kPrincipalName:
|
|
101
101
|
return std::make_unique<AuthenticatedAuthorizationMatcher>(
|
|
102
|
-
|
|
102
|
+
principal.string_matcher);
|
|
103
103
|
case Rbac::Principal::RuleType::kSourceIp:
|
|
104
104
|
return std::make_unique<IpAuthorizationMatcher>(
|
|
105
|
-
IpAuthorizationMatcher::Type::kSourceIp,
|
|
105
|
+
IpAuthorizationMatcher::Type::kSourceIp, principal.ip);
|
|
106
106
|
case Rbac::Principal::RuleType::kDirectRemoteIp:
|
|
107
107
|
return std::make_unique<IpAuthorizationMatcher>(
|
|
108
|
-
IpAuthorizationMatcher::Type::kDirectRemoteIp,
|
|
109
|
-
std::move(principal.ip));
|
|
108
|
+
IpAuthorizationMatcher::Type::kDirectRemoteIp, principal.ip);
|
|
110
109
|
case Rbac::Principal::RuleType::kRemoteIp:
|
|
111
110
|
return std::make_unique<IpAuthorizationMatcher>(
|
|
112
|
-
IpAuthorizationMatcher::Type::kRemoteIp,
|
|
111
|
+
IpAuthorizationMatcher::Type::kRemoteIp, principal.ip);
|
|
113
112
|
case Rbac::Principal::RuleType::kHeader:
|
|
114
113
|
return std::make_unique<HeaderAuthorizationMatcher>(
|
|
115
|
-
|
|
114
|
+
principal.header_matcher);
|
|
116
115
|
case Rbac::Principal::RuleType::kPath:
|
|
117
116
|
return std::make_unique<PathAuthorizationMatcher>(
|
|
118
|
-
|
|
117
|
+
principal.string_matcher.value());
|
|
119
118
|
case Rbac::Principal::RuleType::kMetadata:
|
|
120
119
|
return std::make_unique<MetadataAuthorizationMatcher>(principal.invert);
|
|
121
120
|
}
|
|
@@ -150,7 +149,8 @@ bool HeaderAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
|
|
|
150
149
|
args.GetHeaderValue(matcher_.name(), &concatenated_value));
|
|
151
150
|
}
|
|
152
151
|
|
|
153
|
-
IpAuthorizationMatcher::IpAuthorizationMatcher(Type type,
|
|
152
|
+
IpAuthorizationMatcher::IpAuthorizationMatcher(Type type,
|
|
153
|
+
const Rbac::CidrRange& range)
|
|
154
154
|
: type_(type), prefix_len_(range.prefix_len) {
|
|
155
155
|
auto address =
|
|
156
156
|
StringToSockaddr(range.address_prefix, 0); // Port does not matter here.
|
|
@@ -42,12 +42,12 @@ class AuthorizationMatcher {
|
|
|
42
42
|
// Creates an instance of a matcher based off the rules defined in Permission
|
|
43
43
|
// config.
|
|
44
44
|
static std::unique_ptr<AuthorizationMatcher> Create(
|
|
45
|
-
Rbac::Permission permission);
|
|
45
|
+
const Rbac::Permission& permission);
|
|
46
46
|
|
|
47
47
|
// Creates an instance of a matcher based off the rules defined in Principal
|
|
48
48
|
// config.
|
|
49
49
|
static std::unique_ptr<AuthorizationMatcher> Create(
|
|
50
|
-
Rbac::Principal principal);
|
|
50
|
+
const Rbac::Principal& principal);
|
|
51
51
|
};
|
|
52
52
|
|
|
53
53
|
class AlwaysAuthorizationMatcher : public AuthorizationMatcher {
|
|
@@ -113,8 +113,8 @@ class MetadataAuthorizationMatcher : public AuthorizationMatcher {
|
|
|
113
113
|
// Perform a match against HTTP headers.
|
|
114
114
|
class HeaderAuthorizationMatcher : public AuthorizationMatcher {
|
|
115
115
|
public:
|
|
116
|
-
explicit HeaderAuthorizationMatcher(HeaderMatcher matcher)
|
|
117
|
-
: matcher_(
|
|
116
|
+
explicit HeaderAuthorizationMatcher(const HeaderMatcher& matcher)
|
|
117
|
+
: matcher_(matcher) {}
|
|
118
118
|
|
|
119
119
|
bool Matches(const EvaluateArgs& args) const override;
|
|
120
120
|
|
|
@@ -132,7 +132,7 @@ class IpAuthorizationMatcher : public AuthorizationMatcher {
|
|
|
132
132
|
kRemoteIp,
|
|
133
133
|
};
|
|
134
134
|
|
|
135
|
-
IpAuthorizationMatcher(Type type, Rbac::CidrRange range);
|
|
135
|
+
IpAuthorizationMatcher(Type type, const Rbac::CidrRange& range);
|
|
136
136
|
|
|
137
137
|
bool Matches(const EvaluateArgs& args) const override;
|
|
138
138
|
|
|
@@ -158,8 +158,9 @@ class PortAuthorizationMatcher : public AuthorizationMatcher {
|
|
|
158
158
|
// or DNS SAN in that order, otherwise uses subject field.
|
|
159
159
|
class AuthenticatedAuthorizationMatcher : public AuthorizationMatcher {
|
|
160
160
|
public:
|
|
161
|
-
explicit AuthenticatedAuthorizationMatcher(
|
|
162
|
-
|
|
161
|
+
explicit AuthenticatedAuthorizationMatcher(
|
|
162
|
+
const std::optional<StringMatcher>& auth)
|
|
163
|
+
: matcher_(auth) {}
|
|
163
164
|
|
|
164
165
|
bool Matches(const EvaluateArgs& args) const override;
|
|
165
166
|
|
|
@@ -172,8 +173,8 @@ class AuthenticatedAuthorizationMatcher : public AuthorizationMatcher {
|
|
|
172
173
|
class ReqServerNameAuthorizationMatcher : public AuthorizationMatcher {
|
|
173
174
|
public:
|
|
174
175
|
explicit ReqServerNameAuthorizationMatcher(
|
|
175
|
-
StringMatcher requested_server_name)
|
|
176
|
-
: matcher_(
|
|
176
|
+
const StringMatcher& requested_server_name)
|
|
177
|
+
: matcher_(requested_server_name) {}
|
|
177
178
|
|
|
178
179
|
bool Matches(const EvaluateArgs&) const override;
|
|
179
180
|
|
|
@@ -184,8 +185,8 @@ class ReqServerNameAuthorizationMatcher : public AuthorizationMatcher {
|
|
|
184
185
|
// Perform a match against the path header of HTTP request.
|
|
185
186
|
class PathAuthorizationMatcher : public AuthorizationMatcher {
|
|
186
187
|
public:
|
|
187
|
-
explicit PathAuthorizationMatcher(StringMatcher path)
|
|
188
|
-
: matcher_(
|
|
188
|
+
explicit PathAuthorizationMatcher(const StringMatcher& path)
|
|
189
|
+
: matcher_(path) {}
|
|
189
190
|
|
|
190
191
|
bool Matches(const EvaluateArgs& args) const override;
|
|
191
192
|
|
|
@@ -198,11 +199,9 @@ class PathAuthorizationMatcher : public AuthorizationMatcher {
|
|
|
198
199
|
// of its permissions and a match in one of its principals.
|
|
199
200
|
class PolicyAuthorizationMatcher : public AuthorizationMatcher {
|
|
200
201
|
public:
|
|
201
|
-
explicit PolicyAuthorizationMatcher(Rbac::Policy policy)
|
|
202
|
-
: permissions_(
|
|
203
|
-
|
|
204
|
-
principals_(
|
|
205
|
-
AuthorizationMatcher::Create(std::move(policy.principals))) {}
|
|
202
|
+
explicit PolicyAuthorizationMatcher(const Rbac::Policy& policy)
|
|
203
|
+
: permissions_(AuthorizationMatcher::Create(policy.permissions)),
|
|
204
|
+
principals_(AuthorizationMatcher::Create(policy.principals)) {}
|
|
206
205
|
|
|
207
206
|
bool Matches(const EvaluateArgs& args) const override;
|
|
208
207
|
|
|
@@ -183,7 +183,7 @@ struct Rbac {
|
|
|
183
183
|
std::map<std::string, Policy> policies;
|
|
184
184
|
|
|
185
185
|
AuditCondition audit_condition;
|
|
186
|
-
std::vector<std::
|
|
186
|
+
std::vector<std::shared_ptr<const experimental::AuditLoggerFactory::Config>>
|
|
187
187
|
logger_configs;
|
|
188
188
|
};
|
|
189
189
|
|
|
@@ -57,13 +57,13 @@ std::string StdoutAuditLoggerFactory::Config::ToString() const { return "{}"; }
|
|
|
57
57
|
|
|
58
58
|
absl::string_view StdoutAuditLoggerFactory::name() const { return kName; }
|
|
59
59
|
|
|
60
|
-
absl::StatusOr<std::
|
|
60
|
+
absl::StatusOr<std::shared_ptr<const AuditLoggerFactory::Config>>
|
|
61
61
|
StdoutAuditLoggerFactory::ParseAuditLoggerConfig(const Json&) {
|
|
62
|
-
return std::
|
|
62
|
+
return std::make_shared<StdoutAuditLoggerFactory::Config>();
|
|
63
63
|
}
|
|
64
64
|
|
|
65
65
|
std::unique_ptr<AuditLogger> StdoutAuditLoggerFactory::CreateAuditLogger(
|
|
66
|
-
std::
|
|
66
|
+
std::shared_ptr<const AuditLoggerFactory::Config> config) {
|
|
67
67
|
// Sanity check.
|
|
68
68
|
GRPC_CHECK(config != nullptr);
|
|
69
69
|
GRPC_CHECK_EQ(config->name(), name());
|
|
@@ -28,30 +28,31 @@
|
|
|
28
28
|
namespace grpc_core {
|
|
29
29
|
namespace experimental {
|
|
30
30
|
|
|
31
|
-
class StdoutAuditLogger : public AuditLogger {
|
|
31
|
+
class StdoutAuditLogger final : public AuditLogger {
|
|
32
32
|
public:
|
|
33
33
|
StdoutAuditLogger() = default;
|
|
34
34
|
absl::string_view name() const override { return "stdout_logger"; }
|
|
35
35
|
void Log(const AuditContext&) override;
|
|
36
36
|
};
|
|
37
37
|
|
|
38
|
-
class StdoutAuditLoggerFactory : public AuditLoggerFactory {
|
|
38
|
+
class StdoutAuditLoggerFactory final : public AuditLoggerFactory {
|
|
39
39
|
public:
|
|
40
|
-
class Config : public AuditLoggerFactory::Config {
|
|
40
|
+
class Config final : public AuditLoggerFactory::Config {
|
|
41
41
|
public:
|
|
42
42
|
Config() = default;
|
|
43
43
|
absl::string_view name() const override;
|
|
44
44
|
std::string ToString() const override;
|
|
45
45
|
};
|
|
46
|
+
|
|
46
47
|
StdoutAuditLoggerFactory() = default;
|
|
47
48
|
|
|
48
49
|
absl::string_view name() const override;
|
|
49
50
|
|
|
50
|
-
absl::StatusOr<std::
|
|
51
|
+
absl::StatusOr<std::shared_ptr<const AuditLoggerFactory::Config>>
|
|
51
52
|
ParseAuditLoggerConfig(const Json& json) override;
|
|
52
53
|
|
|
53
54
|
std::unique_ptr<AuditLogger> CreateAuditLogger(
|
|
54
|
-
std::
|
|
55
|
+
std::shared_ptr<const AuditLoggerFactory::Config> config) override;
|
|
55
56
|
};
|
|
56
57
|
|
|
57
58
|
} // namespace experimental
|
|
@@ -248,14 +248,6 @@ void Call::MaybeUnpublishFromParent() {
|
|
|
248
248
|
}
|
|
249
249
|
|
|
250
250
|
void Call::CancelWithStatus(grpc_status_code status, const char* description) {
|
|
251
|
-
if (!IsErrorFlattenEnabled()) {
|
|
252
|
-
CancelWithError(grpc_error_set_int(
|
|
253
|
-
grpc_error_set_str(
|
|
254
|
-
absl::Status(static_cast<absl::StatusCode>(status), description),
|
|
255
|
-
StatusStrProperty::kGrpcMessage, description),
|
|
256
|
-
StatusIntProperty::kRpcStatus, status));
|
|
257
|
-
return;
|
|
258
|
-
}
|
|
259
251
|
if (status == GRPC_STATUS_OK) {
|
|
260
252
|
VLOG(2) << "CancelWithStatus() called with OK status, using UNKNOWN";
|
|
261
253
|
status = GRPC_STATUS_UNKNOWN;
|
data/src/core/lib/surface/call.h
CHANGED
|
@@ -70,6 +70,8 @@ typedef struct grpc_call_create_args {
|
|
|
70
70
|
|
|
71
71
|
grpc_core::Timestamp send_deadline;
|
|
72
72
|
bool registered_method; // client_only
|
|
73
|
+
|
|
74
|
+
std::optional<absl::FunctionRef<void(grpc_core::Arena*)>> arena_init_function;
|
|
73
75
|
} grpc_call_create_args;
|
|
74
76
|
|
|
75
77
|
namespace grpc_core {
|
|
@@ -22,6 +22,8 @@
|
|
|
22
22
|
#include <grpc/support/alloc.h>
|
|
23
23
|
#include <grpc/support/port_platform.h>
|
|
24
24
|
|
|
25
|
+
#include <optional>
|
|
26
|
+
|
|
25
27
|
#include "src/core/channelz/channel_trace.h"
|
|
26
28
|
#include "src/core/channelz/channelz.h"
|
|
27
29
|
#include "src/core/lib/channel/channel_args.h"
|
|
@@ -112,7 +114,8 @@ grpc_call* grpc_channel_create_call(grpc_channel* channel,
|
|
|
112
114
|
? std::optional<grpc_core::Slice>(grpc_core::CSliceRef(*host))
|
|
113
115
|
: std::nullopt,
|
|
114
116
|
grpc_core::Timestamp::FromTimespecRoundUp(deadline),
|
|
115
|
-
/*registered_method=*/false
|
|
117
|
+
/*registered_method=*/false,
|
|
118
|
+
/*arena_init_function=*/std::nullopt);
|
|
116
119
|
}
|
|
117
120
|
|
|
118
121
|
void* grpc_channel_register_call(grpc_channel* channel, const char* method,
|
|
@@ -148,7 +151,23 @@ grpc_call* grpc_channel_create_registered_call(
|
|
|
148
151
|
? std::optional<grpc_core::Slice>(rc->authority->Ref())
|
|
149
152
|
: std::nullopt,
|
|
150
153
|
grpc_core::Timestamp::FromTimespecRoundUp(deadline),
|
|
151
|
-
/*registered_method=*/true
|
|
154
|
+
/*registered_method=*/true,
|
|
155
|
+
/*arena_init_function=*/std::nullopt);
|
|
156
|
+
}
|
|
157
|
+
|
|
158
|
+
grpc_call* grpc_channel_create_call_with_arena_init(
|
|
159
|
+
grpc_channel* channel, grpc_call* parent_call, uint32_t propagation_mask,
|
|
160
|
+
grpc_completion_queue* completion_queue, grpc_core::Slice method,
|
|
161
|
+
std::optional<grpc_core::Slice> authority, gpr_timespec deadline,
|
|
162
|
+
bool registered_method,
|
|
163
|
+
std::optional<absl::FunctionRef<void(grpc_core::Arena*)>>
|
|
164
|
+
arena_init_function) {
|
|
165
|
+
grpc_core::ExecCtx exec_ctx;
|
|
166
|
+
return grpc_core::Channel::FromC(channel)->CreateCall(
|
|
167
|
+
parent_call, propagation_mask, completion_queue, nullptr,
|
|
168
|
+
std::move(method), std::move(authority),
|
|
169
|
+
grpc_core::Timestamp::FromTimespecRoundUp(deadline), registered_method,
|
|
170
|
+
arena_init_function);
|
|
152
171
|
}
|
|
153
172
|
|
|
154
173
|
char* grpc_channel_get_target(grpc_channel* channel) {
|
|
@@ -73,12 +73,12 @@ class Channel : public UnstartedCallDestination,
|
|
|
73
73
|
virtual bool IsLame() const = 0;
|
|
74
74
|
|
|
75
75
|
// TODO(roth): This should return a C++ type.
|
|
76
|
-
virtual grpc_call* CreateCall(
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
76
|
+
virtual grpc_call* CreateCall(
|
|
77
|
+
grpc_call* parent_call, uint32_t propagation_mask,
|
|
78
|
+
grpc_completion_queue* cq, grpc_pollset_set* pollset_set_alternative,
|
|
79
|
+
Slice path, std::optional<Slice> authority, Timestamp deadline,
|
|
80
|
+
bool registered_method,
|
|
81
|
+
std::optional<absl::FunctionRef<void(Arena*)>> arena_init_function) = 0;
|
|
82
82
|
|
|
83
83
|
virtual grpc_event_engine::experimental::EventEngine* event_engine()
|
|
84
84
|
const = 0;
|
|
@@ -178,4 +178,12 @@ inline grpc_core::channelz::ChannelNode* grpc_channel_get_channelz_node(
|
|
|
178
178
|
void grpc_channel_ping(grpc_channel* channel, grpc_completion_queue* cq,
|
|
179
179
|
void* tag, void* reserved);
|
|
180
180
|
|
|
181
|
+
grpc_call* grpc_channel_create_call_with_arena_init(
|
|
182
|
+
grpc_channel* channel, grpc_call* parent_call, uint32_t propagation_mask,
|
|
183
|
+
grpc_completion_queue* completion_queue, grpc_core::Slice method,
|
|
184
|
+
std::optional<grpc_core::Slice> authority, gpr_timespec deadline,
|
|
185
|
+
bool registered_method,
|
|
186
|
+
std::optional<absl::FunctionRef<void(grpc_core::Arena*)>>
|
|
187
|
+
arena_init_function);
|
|
188
|
+
|
|
181
189
|
#endif // GRPC_SRC_CORE_LIB_SURFACE_CHANNEL_H
|
|
@@ -111,6 +111,9 @@ grpc_error_handle FilterStackCall::Create(grpc_call_create_args* args,
|
|
|
111
111
|
RefCountedPtr<Arena> arena = channel->call_arena_allocator()->MakeArena();
|
|
112
112
|
arena->SetContext<grpc_event_engine::experimental::EventEngine>(
|
|
113
113
|
args->channel->event_engine());
|
|
114
|
+
if (args->arena_init_function.has_value()) {
|
|
115
|
+
(*args->arena_init_function)(arena.get());
|
|
116
|
+
}
|
|
114
117
|
call = new (arena->Alloc(call_alloc_size)) FilterStackCall(arena, *args);
|
|
115
118
|
GRPC_DCHECK(FromC(call->c_ptr()) == call);
|
|
116
119
|
GRPC_DCHECK(FromCallStack(call->call_stack()) == call);
|
|
@@ -458,32 +461,10 @@ void FilterStackCall::RecvTrailingFilter(grpc_metadata_batch* b,
|
|
|
458
461
|
} else {
|
|
459
462
|
std::optional<grpc_status_code> grpc_status = b->Take(GrpcStatusMetadata());
|
|
460
463
|
if (grpc_status.has_value()) {
|
|
461
|
-
|
|
462
|
-
|
|
463
|
-
|
|
464
|
-
|
|
465
|
-
if (grpc_message.has_value()) message = grpc_message->as_string_view();
|
|
466
|
-
error =
|
|
467
|
-
absl::Status(static_cast<absl::StatusCode>(*grpc_status), message);
|
|
468
|
-
} else {
|
|
469
|
-
grpc_status_code status_code = *grpc_status;
|
|
470
|
-
if (status_code != GRPC_STATUS_OK) {
|
|
471
|
-
Slice peer = GetPeerString();
|
|
472
|
-
error = grpc_error_set_int(
|
|
473
|
-
GRPC_ERROR_CREATE(absl::StrCat("Error received from peer ",
|
|
474
|
-
peer.as_string_view())),
|
|
475
|
-
StatusIntProperty::kRpcStatus,
|
|
476
|
-
static_cast<intptr_t>(status_code));
|
|
477
|
-
}
|
|
478
|
-
auto grpc_message = b->Take(GrpcMessageMetadata());
|
|
479
|
-
if (grpc_message.has_value()) {
|
|
480
|
-
error = grpc_error_set_str(error, StatusStrProperty::kGrpcMessage,
|
|
481
|
-
grpc_message->as_string_view());
|
|
482
|
-
} else if (!error.ok()) {
|
|
483
|
-
error =
|
|
484
|
-
grpc_error_set_str(error, StatusStrProperty::kGrpcMessage, "");
|
|
485
|
-
}
|
|
486
|
-
}
|
|
464
|
+
auto grpc_message = b->Take(GrpcMessageMetadata());
|
|
465
|
+
absl::string_view message;
|
|
466
|
+
if (grpc_message.has_value()) message = grpc_message->as_string_view();
|
|
467
|
+
absl::Status error(static_cast<absl::StatusCode>(*grpc_status), message);
|
|
487
468
|
SetFinalStatus(error);
|
|
488
469
|
} else if (!is_client()) {
|
|
489
470
|
SetFinalStatus(absl::OkStatus());
|
|
@@ -929,10 +910,10 @@ grpc_call_error FilterStackCall::StartBatch(const grpc_op* ops, size_t nops,
|
|
|
929
910
|
Slice(grpc_slice_copy(
|
|
930
911
|
*op->data.send_status_from_server.status_details)));
|
|
931
912
|
if (!status_error.ok()) {
|
|
932
|
-
status_error =
|
|
933
|
-
status_error, StatusStrProperty::kGrpcMessage,
|
|
913
|
+
status_error = AddMessageDetail(
|
|
934
914
|
StringViewFromSlice(
|
|
935
|
-
*op->data.send_status_from_server.status_details)
|
|
915
|
+
*op->data.send_status_from_server.status_details),
|
|
916
|
+
status_error);
|
|
936
917
|
}
|
|
937
918
|
}
|
|
938
919
|
|
|
@@ -160,13 +160,12 @@ bool LegacyChannel::IsLame() const {
|
|
|
160
160
|
return elem->filter == &LameClientFilter::kFilter;
|
|
161
161
|
}
|
|
162
162
|
|
|
163
|
-
grpc_call* LegacyChannel::CreateCall(
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
bool registered_method) {
|
|
163
|
+
grpc_call* LegacyChannel::CreateCall(
|
|
164
|
+
grpc_call* parent_call, uint32_t propagation_mask,
|
|
165
|
+
grpc_completion_queue* cq, grpc_pollset_set* pollset_set_alternative,
|
|
166
|
+
Slice path, std::optional<Slice> authority, Timestamp deadline,
|
|
167
|
+
bool registered_method,
|
|
168
|
+
std::optional<absl::FunctionRef<void(Arena*)>> arena_init_function) {
|
|
170
169
|
GRPC_CHECK(is_client_);
|
|
171
170
|
GRPC_CHECK(!(cq != nullptr && pollset_set_alternative != nullptr));
|
|
172
171
|
grpc_call_create_args args;
|
|
@@ -181,6 +180,7 @@ grpc_call* LegacyChannel::CreateCall(grpc_call* parent_call,
|
|
|
181
180
|
args.authority = std::move(authority);
|
|
182
181
|
args.send_deadline = deadline;
|
|
183
182
|
args.registered_method = registered_method;
|
|
183
|
+
args.arena_init_function = arena_init_function;
|
|
184
184
|
grpc_call* call;
|
|
185
185
|
GRPC_LOG_IF_ERROR("call_create", grpc_call_create(&args, &call));
|
|
186
186
|
return call;
|
|
@@ -62,7 +62,9 @@ class LegacyChannel final : public Channel {
|
|
|
62
62
|
grpc_completion_queue* cq,
|
|
63
63
|
grpc_pollset_set* pollset_set_alternative, Slice path,
|
|
64
64
|
std::optional<Slice> authority, Timestamp deadline,
|
|
65
|
-
bool registered_method
|
|
65
|
+
bool registered_method,
|
|
66
|
+
std::optional<absl::FunctionRef<void(Arena*)>>
|
|
67
|
+
arena_init_function) override;
|
|
66
68
|
|
|
67
69
|
void StartCall(UnstartedCallHandler) override {
|
|
68
70
|
Crash("StartCall() not supported on LegacyChannel");
|
|
@@ -22,6 +22,6 @@
|
|
|
22
22
|
#include <grpc/grpc.h>
|
|
23
23
|
#include <grpc/support/port_platform.h>
|
|
24
24
|
|
|
25
|
-
const char* grpc_version_string(void) { return "
|
|
25
|
+
const char* grpc_version_string(void) { return "56.0.0"; }
|
|
26
26
|
|
|
27
|
-
const char* grpc_g_stands_for(void) { return "
|
|
27
|
+
const char* grpc_g_stands_for(void) { return "garden"; }
|
|
@@ -33,23 +33,23 @@ namespace grpc_core {
|
|
|
33
33
|
|
|
34
34
|
BdpEstimator::BdpEstimator(absl::string_view name)
|
|
35
35
|
: accumulator_(0),
|
|
36
|
-
estimate_(
|
|
36
|
+
estimate_(kInitialBdpDefault),
|
|
37
37
|
ping_start_time_(gpr_time_0(GPR_CLOCK_MONOTONIC)),
|
|
38
|
-
inter_ping_delay_(Duration::Milliseconds(
|
|
38
|
+
inter_ping_delay_(Duration::Milliseconds(kDefaultInterPingDelayMillis)),
|
|
39
39
|
stable_estimate_count_(0),
|
|
40
40
|
ping_state_(PingState::UNSCHEDULED),
|
|
41
41
|
bw_est_(0),
|
|
42
|
-
|
|
42
|
+
peer_name_(name) {}
|
|
43
43
|
|
|
44
44
|
Timestamp BdpEstimator::CompletePing() {
|
|
45
|
-
gpr_timespec now = gpr_now(GPR_CLOCK_MONOTONIC);
|
|
46
|
-
gpr_timespec dt_ts = gpr_time_sub(now, ping_start_time_);
|
|
47
|
-
double dt = static_cast<double>(dt_ts.tv_sec) +
|
|
48
|
-
|
|
49
|
-
double bw = dt > 0 ? (static_cast<double>(accumulator_) / dt) : 0;
|
|
50
|
-
Duration start_inter_ping_delay = inter_ping_delay_;
|
|
45
|
+
const gpr_timespec now = gpr_now(GPR_CLOCK_MONOTONIC);
|
|
46
|
+
const gpr_timespec dt_ts = gpr_time_sub(now, ping_start_time_);
|
|
47
|
+
const double dt = static_cast<double>(dt_ts.tv_sec) +
|
|
48
|
+
(1e-9 * static_cast<double>(dt_ts.tv_nsec));
|
|
49
|
+
const double bw = (dt > 0) ? (static_cast<double>(accumulator_) / dt) : 0;
|
|
50
|
+
const Duration start_inter_ping_delay = inter_ping_delay_;
|
|
51
51
|
GRPC_TRACE_LOG(bdp_estimator, INFO)
|
|
52
|
-
<< "bdp[" <<
|
|
52
|
+
<< "bdp[" << peer_name_ << "]:complete acc=" << accumulator_
|
|
53
53
|
<< " est=" << estimate_ << " dt=" << dt << " bw=" << bw / 125000.0
|
|
54
54
|
<< "Mbs bw_est=" << bw_est_ / 125000.0 << "Mbs";
|
|
55
55
|
GRPC_CHECK(ping_state_ == PingState::STARTED);
|
|
@@ -57,10 +57,10 @@ Timestamp BdpEstimator::CompletePing() {
|
|
|
57
57
|
estimate_ = std::max(accumulator_, estimate_ * 2);
|
|
58
58
|
bw_est_ = bw;
|
|
59
59
|
GRPC_TRACE_LOG(bdp_estimator, INFO)
|
|
60
|
-
<< "bdp[" <<
|
|
60
|
+
<< "bdp[" << peer_name_ << "]: estimate increased to " << estimate_;
|
|
61
61
|
inter_ping_delay_ /= 2; // if the ping estimate changes,
|
|
62
62
|
// exponentially get faster at probing
|
|
63
|
-
} else if (inter_ping_delay_ < Duration::Seconds(
|
|
63
|
+
} else if (inter_ping_delay_ < Duration::Seconds(kMaxInterPingDelaySeconds)) {
|
|
64
64
|
stable_estimate_count_++;
|
|
65
65
|
if (stable_estimate_count_ >= 2) {
|
|
66
66
|
// If the ping estimate is steady, slowly ramp down the probe time.
|
|
@@ -72,7 +72,7 @@ Timestamp BdpEstimator::CompletePing() {
|
|
|
72
72
|
if (start_inter_ping_delay != inter_ping_delay_) {
|
|
73
73
|
stable_estimate_count_ = 0;
|
|
74
74
|
GRPC_TRACE_LOG(bdp_estimator, INFO)
|
|
75
|
-
<< "bdp[" <<
|
|
75
|
+
<< "bdp[" << peer_name_ << "]:update_inter_time to "
|
|
76
76
|
<< inter_ping_delay_.millis() << "ms";
|
|
77
77
|
}
|
|
78
78
|
ping_state_ = PingState::UNSCHEDULED;
|
|
@@ -23,6 +23,7 @@
|
|
|
23
23
|
#include <grpc/support/time.h>
|
|
24
24
|
#include <inttypes.h>
|
|
25
25
|
|
|
26
|
+
#include <cstdint>
|
|
26
27
|
#include <string>
|
|
27
28
|
|
|
28
29
|
#include "src/core/lib/debug/trace.h"
|
|
@@ -33,6 +34,10 @@
|
|
|
33
34
|
|
|
34
35
|
namespace grpc_core {
|
|
35
36
|
|
|
37
|
+
constexpr int64_t kInitialBdpDefault = 65536;
|
|
38
|
+
constexpr uint32_t kDefaultInterPingDelayMillis = 100;
|
|
39
|
+
constexpr uint32_t kMaxInterPingDelaySeconds = 10;
|
|
40
|
+
|
|
36
41
|
class BdpEstimator {
|
|
37
42
|
public:
|
|
38
43
|
explicit BdpEstimator(absl::string_view name);
|
|
@@ -48,7 +53,7 @@ class BdpEstimator {
|
|
|
48
53
|
// transport (but not necessarily started)
|
|
49
54
|
void SchedulePing() {
|
|
50
55
|
GRPC_TRACE_LOG(bdp_estimator, INFO)
|
|
51
|
-
<< "bdp[" <<
|
|
56
|
+
<< "bdp[" << peer_name_ << "]:sched acc=" << accumulator_
|
|
52
57
|
<< " est=" << estimate_;
|
|
53
58
|
GRPC_CHECK(ping_state_ == PingState::UNSCHEDULED);
|
|
54
59
|
ping_state_ = PingState::SCHEDULED;
|
|
@@ -56,11 +61,10 @@ class BdpEstimator {
|
|
|
56
61
|
}
|
|
57
62
|
|
|
58
63
|
// Start a ping: call after calling grpc_bdp_estimator_schedule_ping and
|
|
59
|
-
// once
|
|
60
|
-
// the ping is on the wire
|
|
64
|
+
// once the ping is on the wire.
|
|
61
65
|
void StartPing() {
|
|
62
66
|
GRPC_TRACE_LOG(bdp_estimator, INFO)
|
|
63
|
-
<< "bdp[" <<
|
|
67
|
+
<< "bdp[" << peer_name_ << "]:start acc=" << accumulator_
|
|
64
68
|
<< " est=" << estimate_;
|
|
65
69
|
GRPC_CHECK(ping_state_ == PingState::SCHEDULED);
|
|
66
70
|
ping_state_ = PingState::STARTED;
|
|
@@ -83,7 +87,7 @@ class BdpEstimator {
|
|
|
83
87
|
int stable_estimate_count_;
|
|
84
88
|
PingState ping_state_;
|
|
85
89
|
double bw_est_;
|
|
86
|
-
absl::string_view
|
|
90
|
+
absl::string_view peer_name_;
|
|
87
91
|
};
|
|
88
92
|
|
|
89
93
|
} // namespace grpc_core
|