grpc 1.83.1 → 1.84.0

data/src/core/credentials/call/jwt/jwt_verifier.cc

@@ -538,6 +538,11 @@ static EVP_PKEY* pkey_from_jwk(const Json& json, const char* kty) {
     LOG(ERROR) << "Could not create rsa key.";
     goto end;
   }
+#else
+  if (bld == nullptr) {
+    LOG(ERROR) << "Could not create OSSL_PARAM_BLD.";
+    goto end;
+  }
 #endif
   it = json.object().find("n");
   if (it == json.object().end()) {
@@ -562,7 +567,16 @@ static EVP_PKEY* pkey_from_jwk(const Json& json, const char* kty) {
   tmp_n = nullptr;
   tmp_e = nullptr;
   result = EVP_PKEY_new();
-  EVP_PKEY_set1_RSA(result, rsa);  // uprefs rsa.
+  if (result == nullptr) {
+    LOG(ERROR) << "Could not create EVP_PKEY.";
+    goto end;
+  }
+  if (EVP_PKEY_set1_RSA(result, rsa) == 0) {
+    LOG(ERROR) << "Cannot set RSA key from inputs.";
+    EVP_PKEY_free(result);
+    result = nullptr;
+    goto end;
+  }
 #else
 
   if (!OSSL_PARAM_BLD_push_BN(bld, "n", tmp_n) ||

data/src/core/credentials/call/jwt_token_file/jwt_token_file_call_credentials.cc

@@ -44,7 +44,7 @@ class JwtTokenFileCallCredentials::FileReader final
 
  private:
   void ReadFile() {
-    auto contents = LoadFile(creds_->path_, /*add_null_terminator=*/false);
+    auto contents = LoadFile(creds_->path_);
     if (!contents.ok()) {
       on_done_(absl::UnavailableError(contents.status().message()));
       return;

data/src/core/credentials/call/oauth2/oauth2_credentials.cc

@@ -220,33 +220,20 @@ UniqueTypeName Oauth2TokenFetcherCredentials::type() const {
   return kFactory.Create();
 }
 
-OrphanablePtr<TokenFetcherCredentials::FetchRequest>
-Oauth2TokenFetcherCredentials::FetchToken(
-    Timestamp deadline,
-    absl::AnyInvocable<
-        void(absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
-        on_done) {
-  return MakeOrphanable<HttpTokenFetcherCredentials::HttpFetchRequest>(
-      this, deadline,
-      [on_done = std::move(on_done)](
-          absl::StatusOr<grpc_http_response> response) mutable {
-        if (!response.ok()) {
-          on_done(response.status());
-          return;
-        }
-        // Parse oauth2 token.
-        std::optional<Slice> access_token_value;
-        Duration token_lifetime;
-        grpc_credentials_status status =
-            grpc_oauth2_token_fetcher_credentials_parse_server_response(
-                &(*response), &access_token_value, &token_lifetime);
-        if (status != GRPC_CREDENTIALS_OK) {
-          on_done(absl::UnavailableError("error parsing oauth2 token"));
-          return;
-        }
-        on_done(MakeRefCounted<Token>(std::move(*access_token_value),
-                                      Timestamp::Now() + token_lifetime));
-      });
+absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>
+Oauth2TokenFetcherCredentials::ExtractToken(
+    const grpc_http_response& response) {
+  // Parse oauth2 token.
+  std::optional<Slice> access_token_value;
+  Duration token_lifetime;
+  grpc_credentials_status status =
+      grpc_oauth2_token_fetcher_credentials_parse_server_response(
+          &response, &access_token_value, &token_lifetime);
+  if (status != GRPC_CREDENTIALS_OK) {
+    return absl::UnavailableError("error parsing oauth2 token");
+  }
+  return MakeRefCounted<Token>(std::move(*access_token_value),
+                               Timestamp::Now() + token_lifetime);
 }
 
 }  // namespace grpc_core
@@ -298,6 +285,7 @@ class grpc_compute_engine_token_fetcher_credentials
   grpc_core::OrphanablePtr<grpc_core::HttpRequest> StartHttpRequest(
       grpc_polling_entity* pollent, grpc_core::Timestamp deadline,
       grpc_http_response* response, grpc_closure* on_complete) override {
+    email_fetcher_->StartEmailFetch();
     memset(response, 0, sizeof(*response));
     grpc_http_header header = {const_cast<char*>("Metadata-Flavor"),
                                const_cast<char*>("Google")};
@@ -322,39 +310,25 @@ class grpc_compute_engine_token_fetcher_credentials
     return http_request;
   }
 
-  grpc_core::OrphanablePtr<FetchRequest> FetchToken(
-      grpc_core::Timestamp deadline,
-      absl::AnyInvocable<void(absl::StatusOr<grpc_core::RefCountedPtr<
-                                  TokenFetcherCredentials::Token>>)>
-          on_done) override {
-    email_fetcher_->StartEmailFetch();
-    return grpc_core::MakeOrphanable<HttpFetchRequest>(
-        this, deadline,
-        [email_fetcher = email_fetcher_, on_done = std::move(on_done)](
-            absl::StatusOr<grpc_http_response> response) mutable {
-          if (!response.ok()) {
-            on_done(response.status());
-            return;
-          }
-          std::optional<grpc_core::Slice> access_token_value;
-          grpc_core::Duration token_lifetime;
-          grpc_credentials_status status =
-              grpc_oauth2_token_fetcher_credentials_parse_server_response(
-                  &(*response), &access_token_value, &token_lifetime);
-          if (status != GRPC_CREDENTIALS_OK) {
-            on_done(absl::UnavailableError("error parsing oauth2 token"));
-            return;
-          }
-          on_done(grpc_core::MakeRefCounted<TokenWithEmail>(
-              std::move(*access_token_value),
-              grpc_core::Timestamp::Now() + token_lifetime,
-              std::move(email_fetcher)));
-        });
+  absl::StatusOr<grpc_core::RefCountedPtr<Token>> ExtractToken(
+      const grpc_http_response& response) final {
+    std::optional<grpc_core::Slice> access_token_value;
+    grpc_core::Duration token_lifetime;
+    grpc_credentials_status status =
+        grpc_oauth2_token_fetcher_credentials_parse_server_response(
+            &response, &access_token_value, &token_lifetime);
+    if (status != GRPC_CREDENTIALS_OK) {
+      return absl::UnavailableError("error parsing oauth2 token");
+    }
+    return grpc_core::MakeRefCounted<TokenWithEmail>(
+        std::move(*access_token_value),
+        grpc_core::Timestamp::Now() + token_lifetime, email_fetcher_);
   }
 
   grpc_core::RefCountedPtr<grpc_core::EmailFetcher> email_fetcher_;
   std::vector<grpc_core::URI::QueryParam> query_params_;
 };
+
 }  // namespace
 
 grpc_call_credentials* grpc_google_compute_engine_credentials_create(
@@ -469,21 +443,20 @@ namespace grpc_core {
 
 namespace {
 
-void MaybeAddToBody(const char* field_name, const char* field,
+void MaybeAddToBody(absl::string_view field_name, absl::string_view field,
                     std::vector<std::string>* body) {
-  if (field == nullptr || strlen(field) == 0) return;
+  if (field.empty()) return;
   body->push_back(absl::StrFormat("&%s=%s", field_name, field));
 }
 
-grpc_error_handle LoadTokenFile(const char* path, grpc_slice* token) {
-  auto slice = LoadFile(path, /*add_null_terminator=*/true);
+absl::StatusOr<Slice> LoadTokenFile(const char* path) {
+  auto slice = LoadFile(path);
   if (!slice.ok()) return slice.status();
   if (slice->empty()) {
     LOG(ERROR) << "Token file " << path << " is empty";
     return GRPC_ERROR_CREATE("Token file is empty.");
   }
-  *token = slice->TakeCSlice();
-  return absl::OkStatus();
+  return slice;
 }
 
 class StsTokenFetcherCredentials : public Oauth2TokenFetcherCredentials {
@@ -543,43 +516,33 @@ class StsTokenFetcherCredentials : public Oauth2TokenFetcherCredentials {
   grpc_error_handle FillBody(char** body, size_t* body_length) {
     *body = nullptr;
     std::vector<std::string> body_parts;
-    grpc_slice subject_token = grpc_empty_slice();
-    grpc_slice actor_token = grpc_empty_slice();
-    grpc_error_handle err;
 
-    auto cleanup = [&body, &body_length, &body_parts, &subject_token,
-                    &actor_token, &err]() {
+    auto cleanup = [&body, &body_length, &body_parts](absl::Status err) {
       if (err.ok()) {
         std::string body_str = absl::StrJoin(body_parts, "");
         *body = gpr_strdup(body_str.c_str());
         *body_length = body_str.size();
       }
-      CSliceUnref(subject_token);
-      CSliceUnref(actor_token);
       return err;
     };
 
-    err = LoadTokenFile(subject_token_path_.get(), &subject_token);
-    if (!err.ok()) return cleanup();
+    auto subject_token = LoadTokenFile(subject_token_path_.get());
+    if (!subject_token.ok()) return cleanup(subject_token.status());
     body_parts.push_back(absl::StrFormat(
         GRPC_STS_POST_MINIMAL_BODY_FORMAT_STRING,
-        reinterpret_cast<const char*>(GRPC_SLICE_START_PTR(subject_token)),
-        subject_token_type_.get()));
+        subject_token->as_string_view(), subject_token_type_.get()));
     MaybeAddToBody("resource", resource_.get(), &body_parts);
     MaybeAddToBody("audience", audience_.get(), &body_parts);
     MaybeAddToBody("scope", scope_.get(), &body_parts);
     MaybeAddToBody("requested_token_type", requested_token_type_.get(),
                    &body_parts);
     if ((actor_token_path_ != nullptr) && *actor_token_path_ != '\0') {
-      err = LoadTokenFile(actor_token_path_.get(), &actor_token);
-      if (!err.ok()) return cleanup();
-      MaybeAddToBody(
-          "actor_token",
-          reinterpret_cast<const char*>(GRPC_SLICE_START_PTR(actor_token)),
-          &body_parts);
+      auto actor_token = LoadTokenFile(actor_token_path_.get());
+      if (!actor_token.ok()) return cleanup(actor_token.status());
+      MaybeAddToBody("actor_token", actor_token->as_string_view(), &body_parts);
       MaybeAddToBody("actor_token_type", actor_token_type_.get(), &body_parts);
     }
-    return cleanup();
+    return cleanup(absl::OkStatus());
   }
 
   URI sts_url_;

data/src/core/credentials/call/oauth2/oauth2_credentials.h

@@ -95,11 +95,8 @@ class Oauth2TokenFetcherCredentials : public HttpTokenFetcherCredentials {
 
   UniqueTypeName type() const override;
 
-  OrphanablePtr<FetchRequest> FetchToken(
-      Timestamp deadline,
-      absl::AnyInvocable<
-          void(absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
-          on_done) final;
+  absl::StatusOr<RefCountedPtr<Token>> ExtractToken(
+      const grpc_http_response& response) final;
 
  private:
   int cmp_impl(const grpc_call_credentials* other) const override {

data/src/core/credentials/call/token_fetcher/token_fetcher_credentials.cc

@@ -21,6 +21,7 @@
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/event_engine/default_event_engine.h"
 #include "src/core/lib/iomgr/pollset_set.h"
+#include "src/core/lib/promise/cancel_callback.h"
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
@@ -192,9 +193,6 @@ void TokenFetcherCredentials::FetchState::ResumeQueuedCalls(
     queued_call->result = token;
     queued_call->done.store(true, std::memory_order_release);
     queued_call->waker.Wakeup();
-    grpc_polling_entity_del_from_pollset_set(
-        queued_call->pollent,
-        grpc_polling_entity_pollset_set(&creds_->pollent_));
   }
   queued_calls_.clear();
 }
@@ -204,9 +202,6 @@ TokenFetcherCredentials::FetchState::QueueCall(
     ClientMetadataHandle initial_metadata) {
   auto queued_call = MakeRefCounted<QueuedCall>();
   queued_call->waker = GetContext<Activity>()->MakeNonOwningWaker();
-  queued_call->pollent = GetContext<grpc_polling_entity>();
-  grpc_polling_entity_add_to_pollset_set(
-      queued_call->pollent, grpc_polling_entity_pollset_set(&creds_->pollent_));
   queued_call->md = std::move(initial_metadata);
   queued_calls_.insert(queued_call);
   // If backoff has expired since the last attempt, trigger a new one.
@@ -281,25 +276,39 @@ TokenFetcherCredentials::GetRequestMetadata(
         << " no cached token; queuing call";
     queued_call = fetch_state_->QueueCall(std::move(initial_metadata));
   }
-  return [this, queued_call = std::move(queued_call)]()
-             -> Poll<absl::StatusOr<ClientMetadataHandle>> {
-    if (!queued_call->done.load(std::memory_order_acquire)) {
-      return Pending{};
-    }
-    if (!queued_call->result.ok()) {
-      GRPC_TRACE_LOG(token_fetcher_credentials, INFO)
-          << "[TokenFetcherCredentials " << this
-          << "]: " << GetContext<Activity>()->DebugTag()
-          << " token fetch failed; failing call";
-      return queued_call->result.status();
-    }
-    GRPC_TRACE_LOG(token_fetcher_credentials, INFO)
-        << "[TokenFetcherCredentials " << this
-        << "]: " << GetContext<Activity>()->DebugTag()
-        << " token fetch complete; resuming call";
-    (*queued_call->result)->AddTokenToClientInitialMetadata(*queued_call->md);
-    return std::move(queued_call->md);
-  };
+  grpc_polling_entity_add_to_pollset_set(
+      GetContext<grpc_polling_entity>(),
+      grpc_polling_entity_pollset_set(&pollent_));
+  return OnCancel(
+      [self = WeakRefAsSubclass<TokenFetcherCredentials>(),
+       queued_call = std::move(
+           queued_call)]() -> Poll<absl::StatusOr<ClientMetadataHandle>> {
+        if (!queued_call->done.load(std::memory_order_acquire)) {
+          return Pending{};
+        }
+        grpc_polling_entity_del_from_pollset_set(
+            GetContext<grpc_polling_entity>(),
+            grpc_polling_entity_pollset_set(&self->pollent_));
+        if (!queued_call->result.ok()) {
+          GRPC_TRACE_LOG(token_fetcher_credentials, INFO)
+              << "[TokenFetcherCredentials " << self.get()
+              << "]: " << GetContext<Activity>()->DebugTag()
+              << " token fetch failed; failing call";
+          return queued_call->result.status();
+        }
+        GRPC_TRACE_LOG(token_fetcher_credentials, INFO)
+            << "[TokenFetcherCredentials " << self.get()
+            << "]: " << GetContext<Activity>()->DebugTag()
+            << " token fetch complete; resuming call";
+        (*queued_call->result)
+            ->AddTokenToClientInitialMetadata(*queued_call->md);
+        return std::move(queued_call->md);
+      },
+      [self = WeakRefAsSubclass<TokenFetcherCredentials>(),
+       pollent = GetContext<grpc_polling_entity>()]() {
+        grpc_polling_entity_del_from_pollset_set(
+            pollent, grpc_polling_entity_pollset_set(&self->pollent_));
+      });
 }
 
 //
@@ -307,13 +316,13 @@ TokenFetcherCredentials::GetRequestMetadata(
 //
 
 HttpTokenFetcherCredentials::HttpFetchRequest::HttpFetchRequest(
-    HttpTokenFetcherCredentials* creds, Timestamp deadline,
-    absl::AnyInvocable<void(absl::StatusOr<grpc_http_response>)> on_done)
-    : on_done_(std::move(on_done)) {
+    WeakRefCountedPtr<HttpTokenFetcherCredentials> creds, Timestamp deadline,
+    absl::AnyInvocable<void(absl::StatusOr<RefCountedPtr<Token>>)> on_done)
+    : creds_(std::move(creds)), on_done_(std::move(on_done)) {
   GRPC_CLOSURE_INIT(&on_http_response_, OnHttpResponse, this, nullptr);
   Ref().release();  // Ref held by HTTP request callback.
-  http_request_ = creds->StartHttpRequest(creds->pollent(), deadline,
-                                          &response_, &on_http_response_);
+  http_request_ = creds_->StartHttpRequest(creds_->pollent(), deadline,
+                                           &response_, &on_http_response_);
 }
 
 void HttpTokenFetcherCredentials::HttpFetchRequest::Orphan() {
@@ -332,6 +341,7 @@ void HttpTokenFetcherCredentials::HttpFetchRequest::OnHttpResponse(
     self->on_done_(absl::UnavailableError(StatusToString(error)));
     return;
   }
+  // Check HTTP status code.
   if (self->response_.status != 200) {
     grpc_status_code status_code =
         grpc_http2_status_to_grpc_status(self->response_.status);
@@ -344,7 +354,18 @@ void HttpTokenFetcherCredentials::HttpFetchRequest::OnHttpResponse(
                                   self->response_.status)));
     return;
   }
-  self->on_done_(self->response_);
+  // Extract token and return result.
+  auto token = self->creds_->ExtractToken(self->response_);
+  self->on_done_(std::move(token));
+}
+
+OrphanablePtr<TokenFetcherCredentials::FetchRequest>
+HttpTokenFetcherCredentials::FetchToken(
+    Timestamp deadline,
+    absl::AnyInvocable<void(absl::StatusOr<RefCountedPtr<Token>>)> on_done) {
+  return MakeOrphanable<HttpFetchRequest>(
+      WeakRefAsSubclass<HttpTokenFetcherCredentials>(), deadline,
+      std::move(on_done));
 }
 
 }  // namespace grpc_core

data/src/core/credentials/call/token_fetcher/token_fetcher_credentials.h

@@ -102,7 +102,6 @@ class TokenFetcherCredentials : public grpc_call_credentials {
   struct QueuedCall : public RefCounted<QueuedCall> {
     std::atomic<bool> done{false};
     Waker waker;
-    grpc_polling_entity* pollent;
     ClientMetadataHandle md;
     absl::StatusOr<RefCountedPtr<Token>> result;
   };
@@ -183,32 +182,46 @@ class TokenFetcherCredentials : public grpc_call_credentials {
 };
 
 // A base class for fetching tokens via an HTTP request.
+// Subclasses must implement StartHttpRequest() and ExtractToken().
 class HttpTokenFetcherCredentials : public TokenFetcherCredentials {
  public:
+  // Starts an HTTP request.
   virtual OrphanablePtr<HttpRequest> StartHttpRequest(
       grpc_polling_entity* pollent, Timestamp deadline,
       grpc_http_response* response, grpc_closure* on_complete) = 0;
 
- protected:
+  // Extracts a token from the HTTP response.
+  // This will be called only if the HTTP status code was 200 (OK).
+  virtual absl::StatusOr<RefCountedPtr<Token>> ExtractToken(
+      const grpc_http_response& response) = 0;
+
+ private:
   // State held for a pending HTTP request.
   class HttpFetchRequest : public TokenFetcherCredentials::FetchRequest {
    public:
-    // The given callback should assume the http response status has already
-    // been checked and handle the token parsing.
     HttpFetchRequest(
-        HttpTokenFetcherCredentials* creds, Timestamp deadline,
-        absl::AnyInvocable<void(absl::StatusOr<grpc_http_response>)> on_done);
+        WeakRefCountedPtr<HttpTokenFetcherCredentials> creds,
+        Timestamp deadline,
+        absl::AnyInvocable<void(absl::StatusOr<RefCountedPtr<Token>>)> on_done);
+
     ~HttpFetchRequest() override { grpc_http_response_destroy(&response_); }
 
     void Orphan() override;
 
    private:
     static void OnHttpResponse(void* arg, grpc_error_handle error);
-    OrphanablePtr<HttpRequest> http_request_;
+
+    WeakRefCountedPtr<HttpTokenFetcherCredentials> creds_;
+    absl::AnyInvocable<void(absl::StatusOr<RefCountedPtr<Token>>)> on_done_;
     grpc_closure on_http_response_;
+    OrphanablePtr<HttpRequest> http_request_;
     grpc_http_response response_;
-    absl::AnyInvocable<void(absl::StatusOr<grpc_http_response>)> on_done_;
   };
+
+  OrphanablePtr<FetchRequest> FetchToken(
+      Timestamp deadline,
+      absl::AnyInvocable<void(absl::StatusOr<RefCountedPtr<Token>>)> on_done)
+      final;
 };
 
 }  // namespace grpc_core

data/src/core/credentials/transport/google_default/google_default_credentials.cc

@@ -266,14 +266,13 @@ static grpc_error_handle create_default_creds_from_path(
   if (creds_path.empty()) {
     return GRPC_ERROR_CREATE("creds_path unset");
   }
-  auto creds_data =
-      grpc_core::LoadFile(creds_path, /*add_null_terminator=*/false);
+  auto creds_data = grpc_core::LoadFile(creds_path);
   if (!creds_data.ok()) {
-    return absl_status_to_grpc_error(creds_data.status());
+    return creds_data.status();
   }
   auto json = grpc_core::JsonParse(creds_data->as_string_view());
   if (!json.ok()) {
-    return absl_status_to_grpc_error(json.status());
+    return json.status();
   }
   if (json->type() != Json::Type::kObject) {
     return GRPC_ERROR_CREATE(absl::StrCat("Failed to parse JSON \"",