mirror of https://github.com/grpc/grpc.git
Karthik Ravi Shankar
5 years ago
commit
4a930208e7
48 changed files with 619 additions and 724 deletions
@ -1,142 +0,0 @@ |
||||
//
|
||||
// Copyright 2020 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
|
||||
// This filter reads GRPC_ARG_SERVICE_CONFIG and populates ServiceConfigCallData
|
||||
// in the call context per call for direct channels.
|
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include "src/core/ext/filters/client_channel/service_config_call_data.h" |
||||
#include "src/core/lib/channel/channel_args.h" |
||||
#include "src/core/lib/channel/channel_stack.h" |
||||
#include "src/core/lib/channel/channel_stack_builder.h" |
||||
#include "src/core/lib/surface/channel_init.h" |
||||
|
||||
namespace grpc_core { |
||||
|
||||
namespace { |
||||
|
||||
class ServiceConfigChannelArgChannelData { |
||||
public: |
||||
explicit ServiceConfigChannelArgChannelData( |
||||
const grpc_channel_element_args* args) { |
||||
const char* service_config_str = grpc_channel_args_find_string( |
||||
args->channel_args, GRPC_ARG_SERVICE_CONFIG); |
||||
if (service_config_str != nullptr) { |
||||
grpc_error* service_config_error = GRPC_ERROR_NONE; |
||||
auto service_config = |
||||
ServiceConfig::Create(service_config_str, &service_config_error); |
||||
if (service_config_error == GRPC_ERROR_NONE) { |
||||
service_config_ = std::move(service_config); |
||||
} else { |
||||
gpr_log(GPR_ERROR, "%s", grpc_error_string(service_config_error)); |
||||
} |
||||
GRPC_ERROR_UNREF(service_config_error); |
||||
} |
||||
} |
||||
|
||||
RefCountedPtr<ServiceConfig> service_config() const { |
||||
return service_config_; |
||||
} |
||||
|
||||
private: |
||||
RefCountedPtr<ServiceConfig> service_config_; |
||||
}; |
||||
|
||||
class ServiceConfigChannelArgCallData { |
||||
public: |
||||
ServiceConfigChannelArgCallData(grpc_call_element* elem, |
||||
const grpc_call_element_args* args) { |
||||
ServiceConfigChannelArgChannelData* chand = |
||||
static_cast<ServiceConfigChannelArgChannelData*>(elem->channel_data); |
||||
RefCountedPtr<ServiceConfig> service_config = chand->service_config(); |
||||
if (service_config != nullptr) { |
||||
GPR_DEBUG_ASSERT(args->context != nullptr); |
||||
const auto* method_params_vector = |
||||
service_config->GetMethodParsedConfigVector(args->path); |
||||
args->arena->New<ServiceConfigCallData>( |
||||
std::move(service_config), method_params_vector, args->context); |
||||
} |
||||
} |
||||
}; |
||||
|
||||
grpc_error* ServiceConfigChannelArgInitCallElem( |
||||
grpc_call_element* elem, const grpc_call_element_args* args) { |
||||
ServiceConfigChannelArgCallData* calld = |
||||
static_cast<ServiceConfigChannelArgCallData*>(elem->call_data); |
||||
new (calld) ServiceConfigChannelArgCallData(elem, args); |
||||
return GRPC_ERROR_NONE; |
||||
} |
||||
|
||||
void ServiceConfigChannelArgDestroyCallElem( |
||||
grpc_call_element* elem, const grpc_call_final_info* /* final_info */, |
||||
grpc_closure* /* then_schedule_closure */) { |
||||
ServiceConfigChannelArgCallData* calld = |
||||
static_cast<ServiceConfigChannelArgCallData*>(elem->call_data); |
||||
calld->~ServiceConfigChannelArgCallData(); |
||||
} |
||||
|
||||
grpc_error* ServiceConfigChannelArgInitChannelElem( |
||||
grpc_channel_element* elem, grpc_channel_element_args* args) { |
||||
ServiceConfigChannelArgChannelData* chand = |
||||
static_cast<ServiceConfigChannelArgChannelData*>(elem->channel_data); |
||||
new (chand) ServiceConfigChannelArgChannelData(args); |
||||
return GRPC_ERROR_NONE; |
||||
} |
||||
|
||||
void ServiceConfigChannelArgDestroyChannelElem(grpc_channel_element* elem) { |
||||
ServiceConfigChannelArgChannelData* chand = |
||||
static_cast<ServiceConfigChannelArgChannelData*>(elem->channel_data); |
||||
chand->~ServiceConfigChannelArgChannelData(); |
||||
} |
||||
|
||||
const grpc_channel_filter ServiceConfigChannelArgFilter = { |
||||
grpc_call_next_op, |
||||
grpc_channel_next_op, |
||||
sizeof(ServiceConfigChannelArgCallData), |
||||
ServiceConfigChannelArgInitCallElem, |
||||
grpc_call_stack_ignore_set_pollset_or_pollset_set, |
||||
ServiceConfigChannelArgDestroyCallElem, |
||||
sizeof(ServiceConfigChannelArgChannelData), |
||||
ServiceConfigChannelArgInitChannelElem, |
||||
ServiceConfigChannelArgDestroyChannelElem, |
||||
grpc_channel_next_get_info, |
||||
"service_config_channel_arg"}; |
||||
|
||||
bool maybe_add_service_config_channel_arg_filter( |
||||
grpc_channel_stack_builder* builder, void* /* arg */) { |
||||
const grpc_channel_args* channel_args = |
||||
grpc_channel_stack_builder_get_channel_arguments(builder); |
||||
if (grpc_channel_args_want_minimal_stack(channel_args) || |
||||
grpc_channel_args_find_string(channel_args, GRPC_ARG_SERVICE_CONFIG) == |
||||
nullptr) { |
||||
return true; |
||||
} |
||||
return grpc_channel_stack_builder_prepend_filter( |
||||
builder, &ServiceConfigChannelArgFilter, nullptr, nullptr); |
||||
} |
||||
|
||||
} // namespace
|
||||
|
||||
} // namespace grpc_core
|
||||
|
||||
void grpc_service_config_channel_arg_filter_init(void) { |
||||
grpc_channel_init_register_stage( |
||||
GRPC_CLIENT_DIRECT_CHANNEL, GRPC_CHANNEL_INIT_BUILTIN_PRIORITY, |
||||
grpc_core::maybe_add_service_config_channel_arg_filter, nullptr); |
||||
} |
||||
|
||||
void grpc_service_config_channel_arg_filter_shutdown(void) {} |
||||
@ -0,0 +1,194 @@ |
||||
# Copyright 2020 The gRPC Authors |
||||
# |
||||
# Licensed under the Apache License, Version 2.0 (the "License"); |
||||
# you may not use this file except in compliance with the License. |
||||
# You may obtain a copy of the License at |
||||
# |
||||
# http://www.apache.org/licenses/LICENSE-2.0 |
||||
# |
||||
# Unless required by applicable law or agreed to in writing, software |
||||
# distributed under the License is distributed on an "AS IS" BASIS, |
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
# See the License for the specific language governing permissions and |
||||
# limitations under the License. |
||||
"""Porting auth context tests from sync stack.""" |
||||
|
||||
import pickle |
||||
import unittest |
||||
import logging |
||||
|
||||
import grpc |
||||
from grpc.experimental import aio |
||||
from grpc.experimental import session_cache |
||||
import six |
||||
|
||||
from tests.unit import resources |
||||
from tests_aio.unit._test_base import AioTestBase |
||||
|
||||
_REQUEST = b'\x00\x00\x00' |
||||
_RESPONSE = b'\x00\x00\x00' |
||||
|
||||
_UNARY_UNARY = '/test/UnaryUnary' |
||||
|
||||
_SERVER_HOST_OVERRIDE = 'foo.test.google.fr' |
||||
_CLIENT_IDS = ( |
||||
b'*.test.google.fr', |
||||
b'waterzooi.test.google.be', |
||||
b'*.test.youtube.com', |
||||
b'192.168.1.3', |
||||
) |
||||
_ID = 'id' |
||||
_ID_KEY = 'id_key' |
||||
_AUTH_CTX = 'auth_ctx' |
||||
|
||||
_PRIVATE_KEY = resources.private_key() |
||||
_CERTIFICATE_CHAIN = resources.certificate_chain() |
||||
_TEST_ROOT_CERTIFICATES = resources.test_root_certificates() |
||||
_SERVER_CERTS = ((_PRIVATE_KEY, _CERTIFICATE_CHAIN),) |
||||
_PROPERTY_OPTIONS = (( |
||||
'grpc.ssl_target_name_override', |
||||
_SERVER_HOST_OVERRIDE, |
||||
),) |
||||
|
||||
|
||||
async def handle_unary_unary(unused_request: bytes, |
||||
servicer_context: aio.ServicerContext): |
||||
return pickle.dumps({ |
||||
_ID: servicer_context.peer_identities(), |
||||
_ID_KEY: servicer_context.peer_identity_key(), |
||||
_AUTH_CTX: servicer_context.auth_context() |
||||
}) |
||||
|
||||
|
||||
class TestAuthContext(AioTestBase): |
||||
|
||||
async def test_insecure(self): |
||||
handler = grpc.method_handlers_generic_handler('test', { |
||||
'UnaryUnary': |
||||
grpc.unary_unary_rpc_method_handler(handle_unary_unary) |
||||
}) |
||||
server = aio.server() |
||||
server.add_generic_rpc_handlers((handler,)) |
||||
port = server.add_insecure_port('[::]:0') |
||||
await server.start() |
||||
|
||||
async with aio.insecure_channel('localhost:%d' % port) as channel: |
||||
response = await channel.unary_unary(_UNARY_UNARY)(_REQUEST) |
||||
await server.stop(None) |
||||
|
||||
auth_data = pickle.loads(response) |
||||
self.assertIsNone(auth_data[_ID]) |
||||
self.assertIsNone(auth_data[_ID_KEY]) |
||||
self.assertDictEqual({}, auth_data[_AUTH_CTX]) |
||||
|
||||
async def test_secure_no_cert(self): |
||||
handler = grpc.method_handlers_generic_handler('test', { |
||||
'UnaryUnary': |
||||
grpc.unary_unary_rpc_method_handler(handle_unary_unary) |
||||
}) |
||||
server = aio.server() |
||||
server.add_generic_rpc_handlers((handler,)) |
||||
server_cred = grpc.ssl_server_credentials(_SERVER_CERTS) |
||||
port = server.add_secure_port('[::]:0', server_cred) |
||||
await server.start() |
||||
|
||||
channel_creds = grpc.ssl_channel_credentials( |
||||
root_certificates=_TEST_ROOT_CERTIFICATES) |
||||
channel = aio.secure_channel('localhost:{}'.format(port), |
||||
channel_creds, |
||||
options=_PROPERTY_OPTIONS) |
||||
response = await channel.unary_unary(_UNARY_UNARY)(_REQUEST) |
||||
await channel.close() |
||||
await server.stop(None) |
||||
|
||||
auth_data = pickle.loads(response) |
||||
self.assertIsNone(auth_data[_ID]) |
||||
self.assertIsNone(auth_data[_ID_KEY]) |
||||
self.assertDictEqual( |
||||
{ |
||||
'security_level': [b'TSI_PRIVACY_AND_INTEGRITY'], |
||||
'transport_security_type': [b'ssl'], |
||||
'ssl_session_reused': [b'false'], |
||||
}, auth_data[_AUTH_CTX]) |
||||
|
||||
async def test_secure_client_cert(self): |
||||
handler = grpc.method_handlers_generic_handler('test', { |
||||
'UnaryUnary': |
||||
grpc.unary_unary_rpc_method_handler(handle_unary_unary) |
||||
}) |
||||
server = aio.server() |
||||
server.add_generic_rpc_handlers((handler,)) |
||||
server_cred = grpc.ssl_server_credentials( |
||||
_SERVER_CERTS, |
||||
root_certificates=_TEST_ROOT_CERTIFICATES, |
||||
require_client_auth=True) |
||||
port = server.add_secure_port('[::]:0', server_cred) |
||||
await server.start() |
||||
|
||||
channel_creds = grpc.ssl_channel_credentials( |
||||
root_certificates=_TEST_ROOT_CERTIFICATES, |
||||
private_key=_PRIVATE_KEY, |
||||
certificate_chain=_CERTIFICATE_CHAIN) |
||||
channel = aio.secure_channel('localhost:{}'.format(port), |
||||
channel_creds, |
||||
options=_PROPERTY_OPTIONS) |
||||
|
||||
response = await channel.unary_unary(_UNARY_UNARY)(_REQUEST) |
||||
await channel.close() |
||||
await server.stop(None) |
||||
|
||||
auth_data = pickle.loads(response) |
||||
auth_ctx = auth_data[_AUTH_CTX] |
||||
self.assertCountEqual(_CLIENT_IDS, auth_data[_ID]) |
||||
self.assertEqual('x509_subject_alternative_name', auth_data[_ID_KEY]) |
||||
self.assertSequenceEqual([b'ssl'], auth_ctx['transport_security_type']) |
||||
self.assertSequenceEqual([b'*.test.google.com'], |
||||
auth_ctx['x509_common_name']) |
||||
|
||||
async def _do_one_shot_client_rpc(self, channel_creds, channel_options, |
||||
port, expect_ssl_session_reused): |
||||
channel = aio.secure_channel('localhost:{}'.format(port), |
||||
channel_creds, |
||||
options=channel_options) |
||||
response = await channel.unary_unary(_UNARY_UNARY)(_REQUEST) |
||||
auth_data = pickle.loads(response) |
||||
self.assertEqual(expect_ssl_session_reused, |
||||
auth_data[_AUTH_CTX]['ssl_session_reused']) |
||||
await channel.close() |
||||
|
||||
async def test_session_resumption(self): |
||||
# Set up a secure server |
||||
handler = grpc.method_handlers_generic_handler('test', { |
||||
'UnaryUnary': |
||||
grpc.unary_unary_rpc_method_handler(handle_unary_unary) |
||||
}) |
||||
server = aio.server() |
||||
server.add_generic_rpc_handlers((handler,)) |
||||
server_cred = grpc.ssl_server_credentials(_SERVER_CERTS) |
||||
port = server.add_secure_port('[::]:0', server_cred) |
||||
await server.start() |
||||
|
||||
# Create a cache for TLS session tickets |
||||
cache = session_cache.ssl_session_cache_lru(1) |
||||
channel_creds = grpc.ssl_channel_credentials( |
||||
root_certificates=_TEST_ROOT_CERTIFICATES) |
||||
channel_options = _PROPERTY_OPTIONS + ( |
||||
('grpc.ssl_session_cache', cache),) |
||||
|
||||
# Initial connection has no session to resume |
||||
await self._do_one_shot_client_rpc(channel_creds, |
||||
channel_options, |
||||
port, |
||||
expect_ssl_session_reused=[b'false']) |
||||
|
||||
# Subsequent connections resume sessions |
||||
await self._do_one_shot_client_rpc(channel_creds, |
||||
channel_options, |
||||
port, |
||||
expect_ssl_session_reused=[b'true']) |
||||
await server.stop(None) |
||||
|
||||
|
||||
if __name__ == '__main__': |
||||
logging.basicConfig(level=logging.DEBUG) |
||||
unittest.main() |
||||
@ -0,0 +1,65 @@ |
||||
# Copyright 2020 The gRPC Authors |
||||
# |
||||
# Licensed under the Apache License, Version 2.0 (the "License"); |
||||
# you may not use this file except in compliance with the License. |
||||
# You may obtain a copy of the License at |
||||
# |
||||
# http://www.apache.org/licenses/LICENSE-2.0 |
||||
# |
||||
# Unless required by applicable law or agreed to in writing, software |
||||
# distributed under the License is distributed on an "AS IS" BASIS, |
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
# See the License for the specific language governing permissions and |
||||
# limitations under the License. |
||||
"""Testing the server context ability to access peer info.""" |
||||
|
||||
import asyncio |
||||
import logging |
||||
import os |
||||
import unittest |
||||
from typing import Callable, Iterable, Sequence, Tuple |
||||
|
||||
import grpc |
||||
from grpc.experimental import aio |
||||
|
||||
from src.proto.grpc.testing import messages_pb2, test_pb2_grpc |
||||
from tests.unit.framework.common import test_constants |
||||
from tests_aio.unit import _common |
||||
from tests_aio.unit._test_base import AioTestBase |
||||
from tests_aio.unit._test_server import TestServiceServicer, start_test_server |
||||
|
||||
_REQUEST = b'\x03\x07' |
||||
_TEST_METHOD = '/test/UnaryUnary' |
||||
|
||||
|
||||
class TestContextPeer(AioTestBase): |
||||
|
||||
async def test_peer(self): |
||||
|
||||
@grpc.unary_unary_rpc_method_handler |
||||
async def check_peer_unary_unary(request: bytes, |
||||
context: aio.ServicerContext): |
||||
self.assertEqual(_REQUEST, request) |
||||
# The peer address could be ipv4 or ipv6 |
||||
self.assertIn('ip', context.peer()) |
||||
return request |
||||
|
||||
# Creates a server |
||||
server = aio.server() |
||||
handlers = grpc.method_handlers_generic_handler( |
||||
'test', {'UnaryUnary': check_peer_unary_unary}) |
||||
server.add_generic_rpc_handlers((handlers,)) |
||||
port = server.add_insecure_port('[::]:0') |
||||
await server.start() |
||||
|
||||
# Creates a channel |
||||
async with aio.insecure_channel('localhost:%d' % port) as channel: |
||||
response = await channel.unary_unary(_TEST_METHOD)(_REQUEST) |
||||
self.assertEqual(_REQUEST, response) |
||||
|
||||
await server.stop(None) |
||||
|
||||
|
||||
if __name__ == '__main__': |
||||
logging.basicConfig(level=logging.DEBUG) |
||||
unittest.main(verbosity=2) |
||||
Loading…
Reference in new issue