|
|
|
|
@ -26,12 +26,15 @@ |
|
|
|
|
#include <grpc/support/log.h> |
|
|
|
|
#include <grpc/support/sync.h> |
|
|
|
|
|
|
|
|
|
#include "src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.h" |
|
|
|
|
#include "src/core/lib/channel/channel_args.h" |
|
|
|
|
#include "src/core/lib/gpr/env.h" |
|
|
|
|
#include "src/core/lib/gpr/string.h" |
|
|
|
|
#include "src/core/lib/http/httpcli.h" |
|
|
|
|
#include "src/core/lib/http/parser.h" |
|
|
|
|
#include "src/core/lib/iomgr/load_file.h" |
|
|
|
|
#include "src/core/lib/iomgr/polling_entity.h" |
|
|
|
|
#include "src/core/lib/security/credentials/alts/alts_credentials.h" |
|
|
|
|
#include "src/core/lib/security/credentials/google_default/google_default_credentials.h" |
|
|
|
|
#include "src/core/lib/security/credentials/jwt/jwt_credentials.h" |
|
|
|
|
#include "src/core/lib/security/credentials/oauth2/oauth2_credentials.h" |
|
|
|
|
@ -45,8 +48,8 @@ |
|
|
|
|
|
|
|
|
|
/* -- Default credentials. -- */ |
|
|
|
|
|
|
|
|
|
static grpc_channel_credentials* default_credentials = nullptr; |
|
|
|
|
static int compute_engine_detection_done = 0; |
|
|
|
|
static grpc_channel_credentials* g_default_credentials = nullptr; |
|
|
|
|
static int g_compute_engine_detection_done = 0; |
|
|
|
|
static gpr_mu g_state_mu; |
|
|
|
|
static gpr_mu* g_polling_mu; |
|
|
|
|
static gpr_once g_once = GPR_ONCE_INIT; |
|
|
|
|
@ -60,6 +63,52 @@ typedef struct { |
|
|
|
|
grpc_http_response response; |
|
|
|
|
} compute_engine_detector; |
|
|
|
|
|
|
|
|
|
static void google_default_credentials_destruct( |
|
|
|
|
grpc_channel_credentials* creds) { |
|
|
|
|
grpc_google_default_channel_credentials* c = |
|
|
|
|
reinterpret_cast<grpc_google_default_channel_credentials*>(creds); |
|
|
|
|
grpc_channel_credentials_unref(c->alts_creds); |
|
|
|
|
grpc_channel_credentials_unref(c->ssl_creds); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
static grpc_security_status google_default_create_security_connector( |
|
|
|
|
grpc_channel_credentials* creds, grpc_call_credentials* call_creds, |
|
|
|
|
const char* target, const grpc_channel_args* args, |
|
|
|
|
grpc_channel_security_connector** sc, grpc_channel_args** new_args) { |
|
|
|
|
grpc_google_default_channel_credentials* c = |
|
|
|
|
reinterpret_cast<grpc_google_default_channel_credentials*>(creds); |
|
|
|
|
bool is_grpclb_load_balancer = grpc_channel_arg_get_bool( |
|
|
|
|
grpc_channel_args_find(args, GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER), |
|
|
|
|
false); |
|
|
|
|
bool is_backend_from_grpclb_load_balancer = grpc_channel_arg_get_bool( |
|
|
|
|
grpc_channel_args_find( |
|
|
|
|
args, GRPC_ARG_ADDRESS_IS_BACKEND_FROM_GRPCLB_LOAD_BALANCER), |
|
|
|
|
false); |
|
|
|
|
bool use_alts = |
|
|
|
|
is_grpclb_load_balancer || is_backend_from_grpclb_load_balancer; |
|
|
|
|
grpc_security_status status = GRPC_SECURITY_ERROR; |
|
|
|
|
status = use_alts ? c->alts_creds->vtable->create_security_connector( |
|
|
|
|
c->alts_creds, call_creds, target, args, sc, new_args) |
|
|
|
|
: c->ssl_creds->vtable->create_security_connector( |
|
|
|
|
c->ssl_creds, call_creds, target, args, sc, new_args); |
|
|
|
|
/* grpclb-specific channel args are removed from the channel args set
|
|
|
|
|
* to ensure backends and fallback adresses will have the same set of channel |
|
|
|
|
* args. By doing that, it guarantees the connections to backends will not be |
|
|
|
|
* torn down and re-connected when switching in and out of fallback mode. |
|
|
|
|
*/ |
|
|
|
|
static const char* args_to_remove[] = { |
|
|
|
|
GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER, |
|
|
|
|
GRPC_ARG_ADDRESS_IS_BACKEND_FROM_GRPCLB_LOAD_BALANCER, |
|
|
|
|
}; |
|
|
|
|
*new_args = grpc_channel_args_copy_and_add_and_remove( |
|
|
|
|
args, args_to_remove, GPR_ARRAY_SIZE(args_to_remove), nullptr, 0); |
|
|
|
|
return status; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
static grpc_channel_credentials_vtable google_default_credentials_vtable = { |
|
|
|
|
google_default_credentials_destruct, |
|
|
|
|
google_default_create_security_connector, nullptr}; |
|
|
|
|
|
|
|
|
|
static void on_compute_engine_detection_http_response(void* user_data, |
|
|
|
|
grpc_error* error) { |
|
|
|
|
compute_engine_detector* detector = |
|
|
|
|
@ -234,8 +283,8 @@ grpc_channel_credentials* grpc_google_default_credentials_create(void) { |
|
|
|
|
|
|
|
|
|
gpr_mu_lock(&g_state_mu); |
|
|
|
|
|
|
|
|
|
if (default_credentials != nullptr) { |
|
|
|
|
result = grpc_channel_credentials_ref(default_credentials); |
|
|
|
|
if (g_default_credentials != nullptr) { |
|
|
|
|
result = grpc_channel_credentials_ref(g_default_credentials); |
|
|
|
|
goto end; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@ -253,9 +302,9 @@ grpc_channel_credentials* grpc_google_default_credentials_create(void) { |
|
|
|
|
|
|
|
|
|
/* At last try to see if we're on compute engine (do the detection only once
|
|
|
|
|
since it requires a network test). */ |
|
|
|
|
if (!compute_engine_detection_done) { |
|
|
|
|
if (!g_compute_engine_detection_done) { |
|
|
|
|
int need_compute_engine_creds = is_stack_running_on_compute_engine(); |
|
|
|
|
compute_engine_detection_done = 1; |
|
|
|
|
g_compute_engine_detection_done = 1; |
|
|
|
|
if (need_compute_engine_creds) { |
|
|
|
|
call_creds = grpc_google_compute_engine_credentials_create(nullptr); |
|
|
|
|
if (call_creds == nullptr) { |
|
|
|
|
@ -269,18 +318,25 @@ grpc_channel_credentials* grpc_google_default_credentials_create(void) { |
|
|
|
|
end: |
|
|
|
|
if (result == nullptr) { |
|
|
|
|
if (call_creds != nullptr) { |
|
|
|
|
/* Blend with default ssl credentials and add a global reference so that
|
|
|
|
|
it |
|
|
|
|
can be cached and re-served. */ |
|
|
|
|
grpc_channel_credentials* ssl_creds = |
|
|
|
|
grpc_ssl_credentials_create(nullptr, nullptr, nullptr); |
|
|
|
|
default_credentials = grpc_channel_credentials_ref( |
|
|
|
|
grpc_composite_channel_credentials_create(ssl_creds, call_creds, |
|
|
|
|
nullptr)); |
|
|
|
|
GPR_ASSERT(default_credentials != nullptr); |
|
|
|
|
grpc_channel_credentials_unref(ssl_creds); |
|
|
|
|
/* Create google default credentials. */ |
|
|
|
|
auto creds = static_cast<grpc_google_default_channel_credentials*>( |
|
|
|
|
gpr_zalloc(sizeof(grpc_google_default_channel_credentials))); |
|
|
|
|
creds->base.vtable = &google_default_credentials_vtable; |
|
|
|
|
creds->base.type = GRPC_CHANNEL_CREDENTIALS_TYPE_GOOGLE_DEFAULT; |
|
|
|
|
gpr_ref_init(&creds->base.refcount, 1); |
|
|
|
|
creds->ssl_creds = grpc_ssl_credentials_create(nullptr, nullptr, nullptr); |
|
|
|
|
GPR_ASSERT(creds->ssl_creds != nullptr); |
|
|
|
|
grpc_alts_credentials_options* options = |
|
|
|
|
grpc_alts_credentials_client_options_create(); |
|
|
|
|
creds->alts_creds = grpc_alts_credentials_create(options); |
|
|
|
|
grpc_alts_credentials_options_destroy(options); |
|
|
|
|
/* Add a global reference so that it can be cached and re-served. */ |
|
|
|
|
g_default_credentials = grpc_composite_channel_credentials_create( |
|
|
|
|
&creds->base, call_creds, nullptr); |
|
|
|
|
GPR_ASSERT(g_default_credentials != nullptr); |
|
|
|
|
grpc_channel_credentials_unref(&creds->base); |
|
|
|
|
grpc_call_credentials_unref(call_creds); |
|
|
|
|
result = default_credentials; |
|
|
|
|
result = grpc_channel_credentials_ref(g_default_credentials); |
|
|
|
|
} else { |
|
|
|
|
gpr_log(GPR_ERROR, "Could not create google default credentials."); |
|
|
|
|
} |
|
|
|
|
@ -299,11 +355,11 @@ void grpc_flush_cached_google_default_credentials(void) { |
|
|
|
|
grpc_core::ExecCtx exec_ctx; |
|
|
|
|
gpr_once_init(&g_once, init_default_credentials); |
|
|
|
|
gpr_mu_lock(&g_state_mu); |
|
|
|
|
if (default_credentials != nullptr) { |
|
|
|
|
grpc_channel_credentials_unref(default_credentials); |
|
|
|
|
default_credentials = nullptr; |
|
|
|
|
if (g_default_credentials != nullptr) { |
|
|
|
|
grpc_channel_credentials_unref(g_default_credentials); |
|
|
|
|
g_default_credentials = nullptr; |
|
|
|
|
} |
|
|
|
|
compute_engine_detection_done = 0; |
|
|
|
|
g_compute_engine_detection_done = 0; |
|
|
|
|
gpr_mu_unlock(&g_state_mu); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
Yihua Zhang
7 years ago