pull/23203/head
Richard Belleville 5 years ago
parent 330eaea53d
commit 257fd6953e
  1. 8
      include/grpc/grpc_security.h
  2. 14
      src/core/lib/security/credentials/google_default/gce_channel_credentials.cc

@ -306,14 +306,14 @@ GRPCAPI grpc_call_credentials* grpc_google_compute_engine_credentials_create(
call_credentials is expected to be a gce_call_credentials object. call_credentials is expected to be a gce_call_credentials object.
The grpc_call_credentials instance passed to this function is expected to The grpc_call_credentials instance passed to this function is expected to
remain valid for the lifetime of the grpc_channel_credentials object returned. remain valid for the lifetime of the grpc_channel_credentials object
returned.
WARNING: Do NOT use this credentials to connect to a non-google service as WARNING: Do NOT use this credentials to connect to a non-google service as
this could result in an oauth2 token leak. The security level of the this could result in an oauth2 token leak. The security level of the
resulting connection is GRPC_PRIVACY_AND_INTEGRITY. */ resulting connection is GRPC_PRIVACY_AND_INTEGRITY. */
GRPCAPI grpc_channel_credentials* grpc_gce_channel_credentials_create(grpc_call_credentials* call_credentials, GRPCAPI grpc_channel_credentials* grpc_gce_channel_credentials_create(
void* reserved); grpc_call_credentials* call_credentials, void* reserved);
GRPCAPI gpr_timespec grpc_max_auth_token_lifetime(void); GRPCAPI gpr_timespec grpc_max_auth_token_lifetime(void);

@ -44,8 +44,8 @@
#include "src/core/lib/slice/slice_string_helpers.h" #include "src/core/lib/slice/slice_string_helpers.h"
#include "src/core/lib/surface/api_trace.h" #include "src/core/lib/surface/api_trace.h"
grpc_channel_credentials* grpc_channel_credentials* grpc_gce_channel_credentials_create(
grpc_gce_channel_credentials_create(grpc_call_credentials* call_credentials, void* reserved) { grpc_call_credentials* call_credentials, void* reserved) {
// If we haven't initialized the google_default_credentials singleton, // If we haven't initialized the google_default_credentials singleton,
// then we don't know whether or not we're on GCE and can't safely // then we don't know whether or not we're on GCE and can't safely
// created an ALTS connection. // created an ALTS connection.
@ -56,7 +56,8 @@ grpc_gce_channel_credentials_create(grpc_call_credentials* call_credentials, voi
"Failed to create GCE channel credentials"); "Failed to create GCE channel credentials");
grpc_core::ExecCtx exec_ctx; grpc_core::ExecCtx exec_ctx;
GRPC_API_TRACE("grpc_gce_channel_credentials_create(%p, %p)", 2, (call_credentials, reserved)); GRPC_API_TRACE("grpc_gce_channel_credentials_create(%p, %p)", 2,
(call_credentials, reserved));
// TODO: Should we cache this here? // TODO: Should we cache this here?
grpc_channel_credentials* ssl_creds = grpc_channel_credentials* ssl_creds =
@ -64,8 +65,7 @@ grpc_gce_channel_credentials_create(grpc_call_credentials* call_credentials, voi
GPR_ASSERT(ssl_creds != nullptr); GPR_ASSERT(ssl_creds != nullptr);
grpc_alts_credentials_options* options = grpc_alts_credentials_options* options =
grpc_alts_credentials_client_options_create(); grpc_alts_credentials_client_options_create();
grpc_channel_credentials* alts_creds = grpc_channel_credentials* alts_creds = grpc_alts_credentials_create(options);
grpc_alts_credentials_create(options);
grpc_alts_credentials_options_destroy(options); grpc_alts_credentials_options_destroy(options);
auto creds = auto creds =
@ -76,8 +76,8 @@ grpc_gce_channel_credentials_create(grpc_call_credentials* call_credentials, voi
if (alts_creds) alts_creds->Unref(); if (alts_creds) alts_creds->Unref();
// TODO: Why not let the wrapped language do this? // TODO: Why not let the wrapped language do this?
result = grpc_composite_channel_credentials_create( result = grpc_composite_channel_credentials_create(creds.get(),
creds.get(), call_credentials, nullptr); call_credentials, nullptr);
GPR_ASSERT(result != nullptr); GPR_ASSERT(result != nullptr);
GRPC_ERROR_UNREF(error); GRPC_ERROR_UNREF(error);
return result; return result;

Loading…
Cancel
Save