pull/23203/head
Richard Belleville 4 years ago
parent 330eaea53d
commit 257fd6953e
  1. 8
      include/grpc/grpc_security.h
  2. 14
      src/core/lib/security/credentials/google_default/gce_channel_credentials.cc

@ -306,14 +306,14 @@ GRPCAPI grpc_call_credentials* grpc_google_compute_engine_credentials_create(
call_credentials is expected to be a gce_call_credentials object.
The grpc_call_credentials instance passed to this function is expected to
remain valid for the lifetime of the grpc_channel_credentials object returned.
remain valid for the lifetime of the grpc_channel_credentials object
returned.
WARNING: Do NOT use this credentials to connect to a non-google service as
this could result in an oauth2 token leak. The security level of the
resulting connection is GRPC_PRIVACY_AND_INTEGRITY. */
GRPCAPI grpc_channel_credentials* grpc_gce_channel_credentials_create(grpc_call_credentials* call_credentials,
void* reserved);
GRPCAPI grpc_channel_credentials* grpc_gce_channel_credentials_create(
grpc_call_credentials* call_credentials, void* reserved);
GRPCAPI gpr_timespec grpc_max_auth_token_lifetime(void);

@ -44,8 +44,8 @@
#include "src/core/lib/slice/slice_string_helpers.h"
#include "src/core/lib/surface/api_trace.h"
grpc_channel_credentials*
grpc_gce_channel_credentials_create(grpc_call_credentials* call_credentials, void* reserved) {
grpc_channel_credentials* grpc_gce_channel_credentials_create(
grpc_call_credentials* call_credentials, void* reserved) {
// If we haven't initialized the google_default_credentials singleton,
// then we don't know whether or not we're on GCE and can't safely
// created an ALTS connection.
@ -56,7 +56,8 @@ grpc_gce_channel_credentials_create(grpc_call_credentials* call_credentials, voi
"Failed to create GCE channel credentials");
grpc_core::ExecCtx exec_ctx;
GRPC_API_TRACE("grpc_gce_channel_credentials_create(%p, %p)", 2, (call_credentials, reserved));
GRPC_API_TRACE("grpc_gce_channel_credentials_create(%p, %p)", 2,
(call_credentials, reserved));
// TODO: Should we cache this here?
grpc_channel_credentials* ssl_creds =
@ -64,8 +65,7 @@ grpc_gce_channel_credentials_create(grpc_call_credentials* call_credentials, voi
GPR_ASSERT(ssl_creds != nullptr);
grpc_alts_credentials_options* options =
grpc_alts_credentials_client_options_create();
grpc_channel_credentials* alts_creds =
grpc_alts_credentials_create(options);
grpc_channel_credentials* alts_creds = grpc_alts_credentials_create(options);
grpc_alts_credentials_options_destroy(options);
auto creds =
@ -76,8 +76,8 @@ grpc_gce_channel_credentials_create(grpc_call_credentials* call_credentials, voi
if (alts_creds) alts_creds->Unref();
// TODO: Why not let the wrapped language do this?
result = grpc_composite_channel_credentials_create(
creds.get(), call_credentials, nullptr);
result = grpc_composite_channel_credentials_create(creds.get(),
call_credentials, nullptr);
GPR_ASSERT(result != nullptr);
GRPC_ERROR_UNREF(error);
return result;

Loading…
Cancel
Save