Chiebot-Mirror
/
grpc
mirror of https://github.com/grpc/grpc.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

add lock annotations to TLS security connectors (#26044)

Browse Source
pull/26071/head
Mark D. Roth 4 years ago committed by GitHub
parent 4c7bd972d3
commit 265dc3bd33
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 86 additions and 86 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 84
      src/core/lib/security/security_connector/tls/tls_security_connector.cc
  2. 86
      src/core/lib/security/security_connector/tls/tls_security_connector.h

84
src/core/lib/security/security_connector/tls/tls_security_connector.cc
Unescape View File

@ -46,7 +46,7 @@ namespace grpc_core {
namespace {
tsi_ssl_pem_key_cert_pair* ConvertToTsiPemKeyCertPair(
const grpc_core::PemKeyCertPairList& cert_pair_list) {
const PemKeyCertPairList& cert_pair_list) {
tsi_ssl_pem_key_cert_pair* tsi_pairs = nullptr;
size_t num_key_cert_pairs = cert_pair_list.size();
if (num_key_cert_pairs > 0) {
@ -68,11 +68,11 @@ tsi_ssl_pem_key_cert_pair* ConvertToTsiPemKeyCertPair(
} // namespace
// -------------------channel security connector-------------------
grpc_core::RefCountedPtr<grpc_channel_security_connector>
RefCountedPtr<grpc_channel_security_connector>
TlsChannelSecurityConnector::CreateTlsChannelSecurityConnector(
grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
grpc_core::RefCountedPtr<grpc_tls_credentials_options> options,
grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
RefCountedPtr<grpc_channel_credentials> channel_creds,
RefCountedPtr<grpc_tls_credentials_options> options,
RefCountedPtr<grpc_call_credentials> request_metadata_creds,
const char* target_name, const char* overridden_target_name,
tsi_ssl_session_cache* ssl_session_cache) {
if (channel_creds == nullptr) {
@ -93,18 +93,16 @@ TlsChannelSecurityConnector::CreateTlsChannelSecurityConnector(
"TlsChannelSecurityConnectorCreate()");
return nullptr;
}
grpc_core::RefCountedPtr<TlsChannelSecurityConnector> c =
grpc_core::MakeRefCounted<TlsChannelSecurityConnector>(
return MakeRefCounted<TlsChannelSecurityConnector>(
std::move(channel_creds), std::move(options),
std::move(request_metadata_creds), target_name,
overridden_target_name, ssl_session_cache);
return c;
std::move(request_metadata_creds), target_name, overridden_target_name,
ssl_session_cache);
}
TlsChannelSecurityConnector::TlsChannelSecurityConnector(
grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
grpc_core::RefCountedPtr<grpc_tls_credentials_options> options,
grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
RefCountedPtr<grpc_channel_credentials> channel_creds,
RefCountedPtr<grpc_tls_credentials_options> options,
RefCountedPtr<grpc_call_credentials> request_metadata_creds,
const char* target_name, const char* overridden_target_name,
tsi_ssl_session_cache* ssl_session_cache)
: grpc_channel_security_connector(GRPC_SSL_URL_SCHEME,
@ -120,7 +118,7 @@ TlsChannelSecurityConnector::TlsChannelSecurityConnector(
check_arg_ = ServerAuthorizationCheckArgCreate(this);
absl::string_view host;
absl::string_view port;
grpc_core::SplitHostPort(target_name, &host, &port);
SplitHostPort(target_name, &host, &port);
target_name_ = std::string(host);
// Create a watcher.
auto watcher_ptr = absl::make_unique<TlsChannelCertificateWatcher>(this);
@ -172,8 +170,8 @@ TlsChannelSecurityConnector::~TlsChannelSecurityConnector() {
void TlsChannelSecurityConnector::add_handshakers(
const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
grpc_core::HandshakeManager* handshake_mgr) {
grpc_core::MutexLock lock(&mu_);
HandshakeManager* handshake_mgr) {
MutexLock lock(&mu_);
if (client_handshaker_factory_ != nullptr) {
// Instantiate TSI handshaker.
tsi_handshaker* tsi_hs = nullptr;
@ -188,7 +186,7 @@ void TlsChannelSecurityConnector::add_handshakers(
return;
}
// Create handshakers.
handshake_mgr->Add(grpc_core::SecurityHandshakerCreate(tsi_hs, this, args));
handshake_mgr->Add(SecurityHandshakerCreate(tsi_hs, this, args));
return;
}
// TODO(ZhenLian): Implement the logic(delegation to
@ -199,14 +197,14 @@ void TlsChannelSecurityConnector::add_handshakers(
void TlsChannelSecurityConnector::check_peer(
tsi_peer peer, grpc_endpoint* /*ep*/,
grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
RefCountedPtr<grpc_auth_context>* auth_context,
grpc_closure* on_peer_checked) {
const char* target_name = overridden_target_name_.empty()
? target_name_.c_str()
: overridden_target_name_.c_str();
grpc_error* error = grpc_ssl_check_alpn(&peer);
if (error != GRPC_ERROR_NONE) {
grpc_core::ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
tsi_peer_destruct(&peer);
return;
}
@ -216,7 +214,7 @@ void TlsChannelSecurityConnector::check_peer(
/* Do the default host name check if specifying the target name. */
error = internal::TlsCheckHostName(target_name, &peer);
if (error != GRPC_ERROR_NONE) {
grpc_core::ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
tsi_peer_destruct(&peer);
return;
}
@ -299,7 +297,7 @@ void TlsChannelSecurityConnector::check_peer(
error = ProcessServerAuthorizationCheckResult(check_arg_);
}
}
grpc_core::ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
tsi_peer_destruct(&peer);
}
@ -335,11 +333,10 @@ void TlsChannelSecurityConnector::cancel_check_call_host(
}
void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
OnCertificatesChanged(
absl::optional<absl::string_view> root_certs,
absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) {
OnCertificatesChanged(absl::optional<absl::string_view> root_certs,
absl::optional<PemKeyCertPairList> key_cert_pairs) {
GPR_ASSERT(security_connector_ != nullptr);
grpc_core::MutexLock lock(&security_connector_->mu_);
MutexLock lock(&security_connector_->mu_);
if (root_certs.has_value()) {
security_connector_->pem_root_certs_ = root_certs;
}
@ -417,11 +414,11 @@ TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
void TlsChannelSecurityConnector::ServerAuthorizationCheckDone(
grpc_tls_server_authorization_check_arg* arg) {
GPR_ASSERT(arg != nullptr);
grpc_core::ExecCtx exec_ctx;
ExecCtx exec_ctx;
grpc_error* error = ProcessServerAuthorizationCheckResult(arg);
TlsChannelSecurityConnector* connector =
static_cast<TlsChannelSecurityConnector*>(arg->cb_user_data);
grpc_core::ExecCtx::Run(DEBUG_LOCATION, connector->on_peer_checked_, error);
ExecCtx::Run(DEBUG_LOCATION, connector->on_peer_checked_, error);
}
grpc_error* TlsChannelSecurityConnector::ProcessServerAuthorizationCheckResult(
@ -491,10 +488,10 @@ void TlsChannelSecurityConnector::ServerAuthorizationCheckArgDestroy(
}
// -------------------server security connector-------------------
grpc_core::RefCountedPtr<grpc_server_security_connector>
RefCountedPtr<grpc_server_security_connector>
TlsServerSecurityConnector::CreateTlsServerSecurityConnector(
grpc_core::RefCountedPtr<grpc_server_credentials> server_creds,
grpc_core::RefCountedPtr<grpc_tls_credentials_options> options) {
RefCountedPtr<grpc_server_credentials> server_creds,
RefCountedPtr<grpc_tls_credentials_options> options) {
if (server_creds == nullptr) {
gpr_log(GPR_ERROR,
"server_creds is nullptr in "
@ -507,15 +504,13 @@ TlsServerSecurityConnector::CreateTlsServerSecurityConnector(
"TlsServerSecurityConnectorCreate()");
return nullptr;
}
grpc_core::RefCountedPtr<TlsServerSecurityConnector> c =
grpc_core::MakeRefCounted<TlsServerSecurityConnector>(
std::move(server_creds), std::move(options));
return c;
return MakeRefCounted<TlsServerSecurityConnector>(std::move(server_creds),
std::move(options));
}
TlsServerSecurityConnector::TlsServerSecurityConnector(
grpc_core::RefCountedPtr<grpc_server_credentials> server_creds,
grpc_core::RefCountedPtr<grpc_tls_credentials_options> options)
RefCountedPtr<grpc_server_credentials> server_creds,
RefCountedPtr<grpc_tls_credentials_options> options)
: grpc_server_security_connector(GRPC_SSL_URL_SCHEME,
std::move(server_creds)),
options_(std::move(options)) {
@ -551,8 +546,8 @@ TlsServerSecurityConnector::~TlsServerSecurityConnector() {
void TlsServerSecurityConnector::add_handshakers(
const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
grpc_core::HandshakeManager* handshake_mgr) {
grpc_core::MutexLock lock(&mu_);
HandshakeManager* handshake_mgr) {
MutexLock lock(&mu_);
if (server_handshaker_factory_ != nullptr) {
// Instantiate TSI handshaker.
tsi_handshaker* tsi_hs = nullptr;
@ -564,7 +559,7 @@ void TlsServerSecurityConnector::add_handshakers(
return;
}
// Create handshakers.
handshake_mgr->Add(grpc_core::SecurityHandshakerCreate(tsi_hs, this, args));
handshake_mgr->Add(SecurityHandshakerCreate(tsi_hs, this, args));
return;
}
// TODO(ZhenLian): Implement the logic(delegation to
@ -575,13 +570,13 @@ void TlsServerSecurityConnector::add_handshakers(
void TlsServerSecurityConnector::check_peer(
tsi_peer peer, grpc_endpoint* /*ep*/,
grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
RefCountedPtr<grpc_auth_context>* auth_context,
grpc_closure* on_peer_checked) {
grpc_error* error = grpc_ssl_check_alpn(&peer);
*auth_context =
grpc_ssl_peer_to_auth_context(&peer, GRPC_TLS_TRANSPORT_SECURITY_TYPE);
tsi_peer_destruct(&peer);
grpc_core::ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
}
int TlsServerSecurityConnector::cmp(
@ -591,11 +586,10 @@ int TlsServerSecurityConnector::cmp(
}
void TlsServerSecurityConnector::TlsServerCertificateWatcher::
OnCertificatesChanged(
absl::optional<absl::string_view> root_certs,
absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) {
OnCertificatesChanged(absl::optional<absl::string_view> root_certs,
absl::optional<PemKeyCertPairList> key_cert_pairs) {
GPR_ASSERT(security_connector_ != nullptr);
grpc_core::MutexLock lock(&security_connector_->mu_);
MutexLock lock(&security_connector_->mu_);
if (root_certs.has_value()) {
security_connector_->pem_root_certs_ = root_certs;
}

86
src/core/lib/security/security_connector/tls/tls_security_connector.h
Unescape View File

@ -35,18 +35,18 @@ class TlsChannelSecurityConnector final
: public grpc_channel_security_connector {
public:
// static factory method to create a TLS channel security connector.
static grpc_core::RefCountedPtr<grpc_channel_security_connector>
static RefCountedPtr<grpc_channel_security_connector>
CreateTlsChannelSecurityConnector(
grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
grpc_core::RefCountedPtr<grpc_tls_credentials_options> options,
grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
RefCountedPtr<grpc_channel_credentials> channel_creds,
RefCountedPtr<grpc_tls_credentials_options> options,
RefCountedPtr<grpc_call_credentials> request_metadata_creds,
const char* target_name, const char* overridden_target_name,
tsi_ssl_session_cache* ssl_session_cache);
TlsChannelSecurityConnector(
grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
grpc_core::RefCountedPtr<grpc_tls_credentials_options> options,
grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
RefCountedPtr<grpc_channel_credentials> channel_creds,
RefCountedPtr<grpc_tls_credentials_options> options,
RefCountedPtr<grpc_call_credentials> request_metadata_creds,
const char* target_name, const char* overridden_target_name,
tsi_ssl_session_cache* ssl_session_cache);
@ -54,10 +54,10 @@ class TlsChannelSecurityConnector final
void add_handshakers(const grpc_channel_args* args,
grpc_pollset_set* interested_parties,
grpc_core::HandshakeManager* handshake_mgr) override;
HandshakeManager* handshake_mgr) override;
void check_peer(tsi_peer peer, grpc_endpoint* ep,
grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
RefCountedPtr<grpc_auth_context>* auth_context,
grpc_closure* on_peer_checked) override;
void cancel_check_peer(grpc_closure* /*on_peer_checked*/,
@ -76,17 +76,17 @@ class TlsChannelSecurityConnector final
grpc_error* error) override;
tsi_ssl_client_handshaker_factory* ClientHandshakerFactoryForTesting() {
grpc_core::MutexLock lock(&mu_);
MutexLock lock(&mu_);
return client_handshaker_factory_;
};
absl::optional<absl::string_view> RootCertsForTesting() {
grpc_core::MutexLock lock(&mu_);
MutexLock lock(&mu_);
return pem_root_certs_;
}
absl::optional<grpc_core::PemKeyCertPairList> KeyCertPairListForTesting() {
grpc_core::MutexLock lock(&mu_);
absl::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
MutexLock lock(&mu_);
return pem_key_cert_pair_list_;
}
@ -102,7 +102,7 @@ class TlsChannelSecurityConnector final
: security_connector_(security_connector) {}
void OnCertificatesChanged(
absl::optional<absl::string_view> root_certs,
absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) override;
absl::optional<PemKeyCertPairList> key_cert_pairs) override;
void OnError(grpc_error* root_cert_error,
grpc_error* identity_cert_error) override;
@ -112,7 +112,8 @@ class TlsChannelSecurityConnector final
// Updates |client_handshaker_factory_| when the certificates that
// |certificate_watcher_| is watching get updated.
grpc_security_status UpdateHandshakerFactoryLocked();
grpc_security_status UpdateHandshakerFactoryLocked()
ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
// gRPC-provided callback executed by application, which servers to bring the
// control back to gRPC core.
@ -131,40 +132,43 @@ class TlsChannelSecurityConnector final
static void ServerAuthorizationCheckArgDestroy(
grpc_tls_server_authorization_check_arg* arg);
grpc_core::Mutex mu_;
grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
RefCountedPtr<grpc_tls_credentials_options> options_;
grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
certificate_watcher_ = nullptr;
grpc_closure* on_peer_checked_ = nullptr;
std::string target_name_;
std::string overridden_target_name_;
tsi_ssl_client_handshaker_factory* client_handshaker_factory_ = nullptr;
grpc_tls_server_authorization_check_arg* check_arg_ = nullptr;
tsi_ssl_session_cache* ssl_session_cache_ = nullptr;
absl::optional<absl::string_view> pem_root_certs_;
absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pair_list_;
Mutex mu_;
tsi_ssl_client_handshaker_factory* client_handshaker_factory_
ABSL_GUARDED_BY(mu_) = nullptr;
tsi_ssl_session_cache* ssl_session_cache_ ABSL_GUARDED_BY(mu_) = nullptr;
absl::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
absl::optional<PemKeyCertPairList> pem_key_cert_pair_list_
ABSL_GUARDED_BY(mu_);
};
// Server security connector using TLS as transport security protocol.
class TlsServerSecurityConnector final : public grpc_server_security_connector {
public:
// static factory method to create a TLS server security connector.
static grpc_core::RefCountedPtr<grpc_server_security_connector>
static RefCountedPtr<grpc_server_security_connector>
CreateTlsServerSecurityConnector(
grpc_core::RefCountedPtr<grpc_server_credentials> server_creds,
grpc_core::RefCountedPtr<grpc_tls_credentials_options> options);
RefCountedPtr<grpc_server_credentials> server_creds,
RefCountedPtr<grpc_tls_credentials_options> options);
TlsServerSecurityConnector(
grpc_core::RefCountedPtr<grpc_server_credentials> server_creds,
grpc_core::RefCountedPtr<grpc_tls_credentials_options> options);
RefCountedPtr<grpc_server_credentials> server_creds,
RefCountedPtr<grpc_tls_credentials_options> options);
~TlsServerSecurityConnector() override;
void add_handshakers(const grpc_channel_args* args,
grpc_pollset_set* interested_parties,
grpc_core::HandshakeManager* handshake_mgr) override;
HandshakeManager* handshake_mgr) override;
void check_peer(tsi_peer peer, grpc_endpoint* ep,
grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
RefCountedPtr<grpc_auth_context>* auth_context,
grpc_closure* on_peer_checked) override;
void cancel_check_peer(grpc_closure* /*on_peer_checked*/,
@ -176,18 +180,17 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
int cmp(const grpc_security_connector* other) const override;
tsi_ssl_server_handshaker_factory* ServerHandshakerFactoryForTesting() {
grpc_core::MutexLock lock(&mu_);
MutexLock lock(&mu_);
return server_handshaker_factory_;
};
const absl::optional<absl::string_view>& RootCertsForTesting() {
grpc_core::MutexLock lock(&mu_);
MutexLock lock(&mu_);
return pem_root_certs_;
}
const absl::optional<grpc_core::PemKeyCertPairList>&
KeyCertPairListForTesting() {
grpc_core::MutexLock lock(&mu_);
const absl::optional<PemKeyCertPairList>& KeyCertPairListForTesting() {
MutexLock lock(&mu_);
return pem_key_cert_pair_list_;
}
@ -203,7 +206,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
: security_connector_(security_connector) {}
void OnCertificatesChanged(
absl::optional<absl::string_view> root_certs,
absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) override;
absl::optional<PemKeyCertPairList> key_cert_pairs) override;
void OnError(grpc_error* root_cert_error,
grpc_error* identity_cert_error) override;
@ -213,16 +216,19 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
// Updates |server_handshaker_factory_| when the certificates that
// |certificate_watcher_| is watching get updated.
grpc_security_status UpdateHandshakerFactoryLocked();
grpc_security_status UpdateHandshakerFactoryLocked()
ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
grpc_core::Mutex mu_;
grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
RefCountedPtr<grpc_tls_credentials_options> options_;
grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
certificate_watcher_ = nullptr;
tsi_ssl_server_handshaker_factory* server_handshaker_factory_ = nullptr;
absl::optional<absl::string_view> pem_root_certs_;
absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pair_list_;
Mutex mu_;
tsi_ssl_server_handshaker_factory* server_handshaker_factory_
ABSL_GUARDED_BY(mu_) = nullptr;
absl::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
absl::optional<PemKeyCertPairList> pem_key_cert_pair_list_
ABSL_GUARDED_BY(mu_);
};
// ---- Functions below are exposed for testing only -----------------------

Write Preview
Loading…
Cancel
Save