mirror of https://github.com/grpc/grpc.git
Merge pull request #24313 from yashykt/xdscredscpp
C++ API to create Xds channel credentialspull/24215/head
Yash Tibrewal
4 years ago
committed by
GitHub
commit
4013fd9dc9
31 changed files with 665 additions and 11 deletions
@ -0,0 +1,51 @@ |
||||
//
|
||||
//
|
||||
// Copyright 2020 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
//
|
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include <grpc/grpc_security.h> |
||||
|
||||
#include "src/core/lib/security/credentials/credentials.h" |
||||
#include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h" |
||||
|
||||
namespace grpc_core { |
||||
namespace { |
||||
|
||||
constexpr char kCredentialsTypeInsecure[] = "insecure"; |
||||
|
||||
class InsecureCredentials final : public grpc_channel_credentials { |
||||
public: |
||||
explicit InsecureCredentials() |
||||
: grpc_channel_credentials(kCredentialsTypeInsecure) {} |
||||
|
||||
grpc_core::RefCountedPtr<grpc_channel_security_connector> |
||||
create_security_connector( |
||||
grpc_core::RefCountedPtr<grpc_call_credentials> call_creds, |
||||
const char* /* target_name */, const grpc_channel_args* /* args */, |
||||
grpc_channel_args** /* new_args */) override { |
||||
return MakeRefCounted<InsecureChannelSecurityConnector>( |
||||
Ref(), std::move(call_creds)); |
||||
} |
||||
}; |
||||
|
||||
} // namespace
|
||||
} // namespace grpc_core
|
||||
|
||||
grpc_channel_credentials* grpc_insecure_credentials_create() { |
||||
return new grpc_core::InsecureCredentials(); |
||||
} |
||||
@ -0,0 +1,88 @@ |
||||
//
|
||||
//
|
||||
// Copyright 2020 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
//
|
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h" |
||||
|
||||
#include "src/core/lib/gprpp/ref_counted_ptr.h" |
||||
#include "src/core/lib/security/transport/security_handshaker.h" |
||||
#include "src/core/tsi/local_transport_security.h" |
||||
|
||||
namespace grpc_core { |
||||
|
||||
const char kInsecureTransportSecurityType[] = "insecure"; |
||||
|
||||
// check_call_host and cancel_check_call_host are no-ops since we want to
|
||||
// provide an insecure channel.
|
||||
bool InsecureChannelSecurityConnector::check_call_host( |
||||
absl::string_view host, grpc_auth_context* auth_context, |
||||
grpc_closure* on_call_host_checked, grpc_error** error) { |
||||
*error = GRPC_ERROR_NONE; |
||||
return true; |
||||
} |
||||
|
||||
void InsecureChannelSecurityConnector::cancel_check_call_host( |
||||
grpc_closure* on_call_host_checked, grpc_error* error) { |
||||
GRPC_ERROR_UNREF(error); |
||||
} |
||||
|
||||
// add_handshakers should have been a no-op but we need to add a minimalist
|
||||
// security handshaker so that check_peer is invoked and an auth_context is
|
||||
// created with the security level of TSI_SECURITY_NONE.
|
||||
void InsecureChannelSecurityConnector::add_handshakers( |
||||
const grpc_channel_args* args, grpc_pollset_set* /* interested_parties */, |
||||
HandshakeManager* handshake_manager) { |
||||
tsi_handshaker* handshaker = nullptr; |
||||
// Re-use local_tsi_handshaker_create as a minimalist handshaker.
|
||||
GPR_ASSERT(tsi_local_handshaker_create(true /* is_client */, &handshaker) == |
||||
TSI_OK); |
||||
handshake_manager->Add(SecurityHandshakerCreate(handshaker, this, args)); |
||||
} |
||||
|
||||
void InsecureChannelSecurityConnector::check_peer( |
||||
tsi_peer peer, grpc_endpoint* ep, |
||||
RefCountedPtr<grpc_auth_context>* auth_context, |
||||
grpc_closure* on_peer_checked) { |
||||
*auth_context = MakeAuthContext(); |
||||
tsi_peer_destruct(&peer); |
||||
ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, GRPC_ERROR_NONE); |
||||
} |
||||
|
||||
int InsecureChannelSecurityConnector::cmp( |
||||
const grpc_security_connector* other_sc) const { |
||||
return channel_security_connector_cmp( |
||||
static_cast<const grpc_channel_security_connector*>(other_sc)); |
||||
} |
||||
|
||||
RefCountedPtr<grpc_auth_context> |
||||
InsecureChannelSecurityConnector::MakeAuthContext() { |
||||
auto ctx = MakeRefCounted<grpc_auth_context>(nullptr); |
||||
grpc_auth_context_add_cstring_property( |
||||
ctx.get(), GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||
kInsecureTransportSecurityType); |
||||
GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name( |
||||
ctx.get(), GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME) == 1); |
||||
const char* security_level = tsi_security_level_to_string(TSI_SECURITY_NONE); |
||||
grpc_auth_context_add_property(ctx.get(), |
||||
GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME, |
||||
security_level, strlen(security_level)); |
||||
return ctx; |
||||
} |
||||
|
||||
} // namespace grpc_core
|
||||
@ -0,0 +1,70 @@ |
||||
//
|
||||
//
|
||||
// Copyright 2020 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
//
|
||||
|
||||
#ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_INSECURE_INSECURE_SECURITY_CONNECTOR_H |
||||
#define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_INSECURE_INSECURE_SECURITY_CONNECTOR_H |
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include "src/core/lib/security/context/security_context.h" |
||||
#include "src/core/lib/security/credentials/credentials.h" |
||||
#include "src/core/lib/security/security_connector/security_connector.h" |
||||
|
||||
namespace grpc_core { |
||||
|
||||
extern const char kInsecureTransportSecurityType[]; |
||||
|
||||
class InsecureChannelSecurityConnector |
||||
: public grpc_channel_security_connector { |
||||
public: |
||||
InsecureChannelSecurityConnector( |
||||
grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds, |
||||
grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds) |
||||
: grpc_channel_security_connector(/* url_scheme */ nullptr, |
||||
std::move(channel_creds), |
||||
std::move(request_metadata_creds)) {} |
||||
|
||||
bool check_call_host(absl::string_view host, grpc_auth_context* auth_context, |
||||
grpc_closure* on_call_host_checked, |
||||
grpc_error** error) override; |
||||
|
||||
void cancel_check_call_host(grpc_closure* on_call_host_checked, |
||||
grpc_error* error) override; |
||||
|
||||
void add_handshakers(const grpc_channel_args* args, |
||||
grpc_pollset_set* /* interested_parties */, |
||||
grpc_core::HandshakeManager* handshake_manager) override; |
||||
|
||||
void check_peer(tsi_peer peer, grpc_endpoint* ep, |
||||
grpc_core::RefCountedPtr<grpc_auth_context>* auth_context, |
||||
grpc_closure* on_peer_checked) override; |
||||
|
||||
int cmp(const grpc_security_connector* other_sc) const override; |
||||
|
||||
// Exposed for testing purposes only.
|
||||
// Create an auth context which is necessary to pass the santiy check in
|
||||
// client_auth_filter that verifies if the peer's auth context is obtained
|
||||
// during handshakes. The auth context is only checked for its existence and
|
||||
// not actually used.
|
||||
static RefCountedPtr<grpc_auth_context> MakeAuthContext(); |
||||
}; |
||||
|
||||
} // namespace grpc_core
|
||||
|
||||
#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_INSECURE_INSECURE_SECURITY_CONNECTOR_H \ |
||||
*/ |
||||
@ -0,0 +1,59 @@ |
||||
//
|
||||
//
|
||||
// Copyright 2020 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
//
|
||||
|
||||
#include <gmock/gmock.h> |
||||
#include <gtest/gtest.h> |
||||
|
||||
#include <grpc/grpc_security.h> |
||||
|
||||
#include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h" |
||||
#include "src/core/lib/security/security_connector/ssl_utils.h" |
||||
#include "src/core/tsi/transport_security.h" |
||||
#include "test/core/util/test_config.h" |
||||
|
||||
namespace grpc_core { |
||||
namespace testing { |
||||
namespace { |
||||
|
||||
TEST(InsecureSecurityConnector, MakeAuthContextTest) { |
||||
auto auth_context = InsecureChannelSecurityConnector::MakeAuthContext(); |
||||
// Verify that peer identity is set
|
||||
auto it = grpc_auth_context_peer_identity(auth_context.get()); |
||||
const grpc_auth_property* prop = grpc_auth_property_iterator_next(&it); |
||||
ASSERT_NE(prop, nullptr); |
||||
EXPECT_STREQ(prop->name, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME); |
||||
EXPECT_STREQ(prop->value, kInsecureTransportSecurityType); |
||||
// Verify that security level is set to none
|
||||
it = grpc_auth_context_find_properties_by_name( |
||||
auth_context.get(), GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME); |
||||
prop = grpc_auth_property_iterator_next(&it); |
||||
ASSERT_NE(prop, nullptr); |
||||
EXPECT_EQ(grpc_tsi_security_level_string_to_enum(prop->value), |
||||
GRPC_SECURITY_NONE); |
||||
} |
||||
|
||||
} // namespace
|
||||
} // namespace testing
|
||||
} // namespace grpc_core
|
||||
|
||||
int main(int argc, char** argv) { |
||||
::testing::InitGoogleTest(&argc, argv); |
||||
grpc::testing::TestEnvironment env(argc, argv); |
||||
const auto result = RUN_ALL_TESTS(); |
||||
return result; |
||||
} |
||||
@ -0,0 +1,86 @@ |
||||
//
|
||||
//
|
||||
// Copyright 2020 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
//
|
||||
|
||||
#include <gmock/gmock.h> |
||||
#include <gtest/gtest.h> |
||||
|
||||
#include <grpc/grpc.h> |
||||
#include <grpcpp/server_builder.h> |
||||
|
||||
#include "test/core/util/port.h" |
||||
#include "test/core/util/test_config.h" |
||||
#include "test/cpp/end2end/test_service_impl.h" |
||||
#include "test/cpp/util/test_credentials_provider.h" |
||||
|
||||
namespace grpc { |
||||
namespace testing { |
||||
namespace { |
||||
|
||||
class XdsCredentialsEnd2EndFallbackTest |
||||
: public ::testing::TestWithParam<const char*> { |
||||
protected: |
||||
XdsCredentialsEnd2EndFallbackTest() { |
||||
int port = grpc_pick_unused_port_or_die(); |
||||
ServerBuilder builder; |
||||
server_address_ = "localhost:" + std::to_string(port); |
||||
builder.AddListeningPort( |
||||
server_address_, |
||||
GetCredentialsProvider()->GetServerCredentials(GetParam())); |
||||
builder.RegisterService(&service_); |
||||
server_ = builder.BuildAndStart(); |
||||
} |
||||
|
||||
std::string server_address_; |
||||
TestServiceImpl service_; |
||||
std::unique_ptr<Server> server_; |
||||
}; |
||||
|
||||
TEST_P(XdsCredentialsEnd2EndFallbackTest, NoXdsSchemeInTarget) { |
||||
// Target does not use 'xds:///' scheme and should result in using fallback
|
||||
// credentials.
|
||||
ChannelArguments args; |
||||
auto channel = grpc::CreateCustomChannel( |
||||
server_address_, |
||||
grpc::experimental::XdsCredentials( |
||||
GetCredentialsProvider()->GetChannelCredentials(GetParam(), &args)), |
||||
args); |
||||
auto stub = grpc::testing::EchoTestService::NewStub(channel); |
||||
ClientContext ctx; |
||||
EchoRequest req; |
||||
req.set_message("Hello"); |
||||
EchoResponse resp; |
||||
Status s = stub->Echo(&ctx, req, &resp); |
||||
EXPECT_EQ(s.ok(), true); |
||||
EXPECT_EQ(resp.message(), "Hello"); |
||||
} |
||||
|
||||
INSTANTIATE_TEST_SUITE_P(XdsCredentialsEnd2EndFallback, |
||||
XdsCredentialsEnd2EndFallbackTest, |
||||
::testing::ValuesIn(std::vector<const char*>( |
||||
{kInsecureCredentialsType, kTlsCredentialsType}))); |
||||
|
||||
} // namespace
|
||||
} // namespace testing
|
||||
} // namespace grpc
|
||||
|
||||
int main(int argc, char** argv) { |
||||
::testing::InitGoogleTest(&argc, argv); |
||||
grpc::testing::TestEnvironment env(argc, argv); |
||||
const auto result = RUN_ALL_TESTS(); |
||||
return result; |
||||
} |
||||
Loading…
Reference in new issue