diff --git a/grpc.def b/grpc.def index 922f95383a3..32289dffeb7 100644 --- a/grpc.def +++ b/grpc.def @@ -101,6 +101,7 @@ EXPORTS grpc_google_default_credentials_create grpc_set_ssl_roots_override_callback grpc_ssl_credentials_create + grpc_ssl_credentials_create_ex grpc_call_credentials_release grpc_composite_channel_credentials_create grpc_composite_call_credentials_create diff --git a/include/grpc/grpc_security.h b/include/grpc/grpc_security.h index ebdf86b7d50..12a94dc95ea 100644 --- a/include/grpc/grpc_security.h +++ b/include/grpc/grpc_security.h @@ -163,6 +163,28 @@ typedef struct { const char* cert_chain; } grpc_ssl_pem_key_cert_pair; +/** Deprecated in favor of grpc_ssl_verify_peer_options. It will be removed + after all of its call sites are migrated to grpc_ssl_verify_peer_options. + Object that holds additional peer-verification options on a secure + channel. */ +typedef struct { + /** If non-NULL this callback will be invoked with the expected + target_name, the peer's certificate (in PEM format), and whatever + userdata pointer is set below. If a non-zero value is returned by this + callback then it is treated as a verification failure. Invocation of + the callback is blocking, so any implementation should be light-weight. + */ + int (*verify_peer_callback)(const char* target_name, const char* peer_pem, + void* userdata); + /** Arbitrary userdata that will be passed as the last argument to + verify_peer_callback. */ + void* verify_peer_callback_userdata; + /** A destruct callback that will be invoked when the channel is being + cleaned up. The userdata argument will be passed to it. The intent is + to perform any cleanup associated with that userdata. */ + void (*verify_peer_destruct)(void* userdata); +} verify_peer_options; + /** Object that holds additional peer-verification options on a secure channel. */ typedef struct { @@ -181,9 +203,11 @@ typedef struct { cleaned up. The userdata argument will be passed to it. The intent is to perform any cleanup associated with that userdata. */ void (*verify_peer_destruct)(void* userdata); -} verify_peer_options; +} grpc_ssl_verify_peer_options; -/** Creates an SSL credentials object. +/** Deprecated in favor of grpc_ssl_server_credentials_create_ex. It will be + removed after all of its call sites are migrated to + grpc_ssl_server_credentials_create_ex. Creates an SSL credentials object. - pem_root_certs is the NULL-terminated string containing the PEM encoding of the server root certificates. If this parameter is NULL, the implementation will first try to dereference the file pointed by the @@ -214,6 +238,37 @@ GRPCAPI grpc_channel_credentials* grpc_ssl_credentials_create( const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair, const verify_peer_options* verify_options, void* reserved); +/* Creates an SSL credentials object. + - pem_root_certs is the NULL-terminated string containing the PEM encoding + of the server root certificates. If this parameter is NULL, the + implementation will first try to dereference the file pointed by the + GRPC_DEFAULT_SSL_ROOTS_FILE_PATH environment variable, and if that fails, + try to get the roots set by grpc_override_ssl_default_roots. Eventually, + if all these fail, it will try to get the roots from a well-known place on + disk (in the grpc install directory). + + gRPC has implemented root cache if the underlying OpenSSL library supports + it. The gRPC root certificates cache is only applicable on the default + root certificates, which is used when this parameter is nullptr. If user + provides their own pem_root_certs, when creating an SSL credential object, + gRPC would not be able to cache it, and each subchannel will generate a + copy of the root store. So it is recommended to avoid providing large room + pem with pem_root_certs parameter to avoid excessive memory consumption, + particularly on mobile platforms such as iOS. + - pem_key_cert_pair is a pointer on the object containing client's private + key and certificate chain. This parameter can be NULL if the client does + not have such a key/cert pair. + - verify_options is an optional verify_peer_options object which holds + additional options controlling how peer certificates are verified. For + example, you can supply a callback which receives the peer's certificate + with which you can do additional verification. Can be NULL, in which + case verification will retain default behavior. Any settings in + verify_options are copied during this call, so the verify_options + object can be released afterwards. */ +GRPCAPI grpc_channel_credentials* grpc_ssl_credentials_create_ex( + const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair, + const grpc_ssl_verify_peer_options* verify_options, void* reserved); + /** --- grpc_call_credentials object. A call credentials object represents a way to authenticate on a particular diff --git a/src/core/lib/security/credentials/ssl/ssl_credentials.cc b/src/core/lib/security/credentials/ssl/ssl_credentials.cc index 83db86f1eac..65e57cebeb5 100644 --- a/src/core/lib/security/credentials/ssl/ssl_credentials.cc +++ b/src/core/lib/security/credentials/ssl/ssl_credentials.cc @@ -46,7 +46,7 @@ void grpc_tsi_ssl_pem_key_cert_pairs_destroy(tsi_ssl_pem_key_cert_pair* kp, grpc_ssl_credentials::grpc_ssl_credentials( const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair, - const verify_peer_options* verify_options) + const grpc_ssl_verify_peer_options* verify_options) : grpc_channel_credentials(GRPC_CHANNEL_CREDENTIALS_TYPE_SSL) { build_config(pem_root_certs, pem_key_cert_pair, verify_options); } @@ -94,7 +94,7 @@ grpc_ssl_credentials::create_security_connector( void grpc_ssl_credentials::build_config( const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair, - const verify_peer_options* verify_options) { + const grpc_ssl_verify_peer_options* verify_options) { config_.pem_root_certs = gpr_strdup(pem_root_certs); if (pem_key_cert_pair != nullptr) { GPR_ASSERT(pem_key_cert_pair->private_key != nullptr); @@ -117,6 +117,8 @@ void grpc_ssl_credentials::build_config( } } +/* Deprecated in favor of grpc_ssl_credentials_create_ex. Will be removed + * once all of its call sites are migrated to grpc_ssl_credentials_create_ex. */ grpc_channel_credentials* grpc_ssl_credentials_create( const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair, const verify_peer_options* verify_options, void* reserved) { @@ -128,6 +130,22 @@ grpc_channel_credentials* grpc_ssl_credentials_create( 4, (pem_root_certs, pem_key_cert_pair, verify_options, reserved)); GPR_ASSERT(reserved == nullptr); + return grpc_core::New( + pem_root_certs, pem_key_cert_pair, + reinterpret_cast(verify_options)); +} + +grpc_channel_credentials* grpc_ssl_credentials_create_ex( + const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair, + const grpc_ssl_verify_peer_options* verify_options, void* reserved) { + GRPC_API_TRACE( + "grpc_ssl_credentials_create(pem_root_certs=%s, " + "pem_key_cert_pair=%p, " + "verify_options=%p, " + "reserved=%p)", + 4, (pem_root_certs, pem_key_cert_pair, verify_options, reserved)); + GPR_ASSERT(reserved == nullptr); + return grpc_core::New(pem_root_certs, pem_key_cert_pair, verify_options); } diff --git a/src/core/lib/security/credentials/ssl/ssl_credentials.h b/src/core/lib/security/credentials/ssl/ssl_credentials.h index e1174327b30..545a27f0be4 100644 --- a/src/core/lib/security/credentials/ssl/ssl_credentials.h +++ b/src/core/lib/security/credentials/ssl/ssl_credentials.h @@ -28,7 +28,7 @@ class grpc_ssl_credentials : public grpc_channel_credentials { public: grpc_ssl_credentials(const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair, - const verify_peer_options* verify_options); + const grpc_ssl_verify_peer_options* verify_options); ~grpc_ssl_credentials() override; @@ -41,7 +41,7 @@ class grpc_ssl_credentials : public grpc_channel_credentials { private: void build_config(const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair, - const verify_peer_options* verify_options); + const grpc_ssl_verify_peer_options* verify_options); grpc_ssl_config config_; }; diff --git a/src/ruby/ext/grpc/rb_grpc_imports.generated.c b/src/ruby/ext/grpc/rb_grpc_imports.generated.c index f8a31286115..b1165a6d6eb 100644 --- a/src/ruby/ext/grpc/rb_grpc_imports.generated.c +++ b/src/ruby/ext/grpc/rb_grpc_imports.generated.c @@ -124,6 +124,7 @@ grpc_channel_credentials_release_type grpc_channel_credentials_release_import; grpc_google_default_credentials_create_type grpc_google_default_credentials_create_import; grpc_set_ssl_roots_override_callback_type grpc_set_ssl_roots_override_callback_import; grpc_ssl_credentials_create_type grpc_ssl_credentials_create_import; +grpc_ssl_credentials_create_ex_type grpc_ssl_credentials_create_ex_import; grpc_call_credentials_release_type grpc_call_credentials_release_import; grpc_composite_channel_credentials_create_type grpc_composite_channel_credentials_create_import; grpc_composite_call_credentials_create_type grpc_composite_call_credentials_create_import; @@ -393,6 +394,7 @@ void grpc_rb_load_imports(HMODULE library) { grpc_google_default_credentials_create_import = (grpc_google_default_credentials_create_type) GetProcAddress(library, "grpc_google_default_credentials_create"); grpc_set_ssl_roots_override_callback_import = (grpc_set_ssl_roots_override_callback_type) GetProcAddress(library, "grpc_set_ssl_roots_override_callback"); grpc_ssl_credentials_create_import = (grpc_ssl_credentials_create_type) GetProcAddress(library, "grpc_ssl_credentials_create"); + grpc_ssl_credentials_create_ex_import = (grpc_ssl_credentials_create_ex_type) GetProcAddress(library, "grpc_ssl_credentials_create_ex"); grpc_call_credentials_release_import = (grpc_call_credentials_release_type) GetProcAddress(library, "grpc_call_credentials_release"); grpc_composite_channel_credentials_create_import = (grpc_composite_channel_credentials_create_type) GetProcAddress(library, "grpc_composite_channel_credentials_create"); grpc_composite_call_credentials_create_import = (grpc_composite_call_credentials_create_type) GetProcAddress(library, "grpc_composite_call_credentials_create"); diff --git a/src/ruby/ext/grpc/rb_grpc_imports.generated.h b/src/ruby/ext/grpc/rb_grpc_imports.generated.h index c25d789a95b..5809194f1ae 100644 --- a/src/ruby/ext/grpc/rb_grpc_imports.generated.h +++ b/src/ruby/ext/grpc/rb_grpc_imports.generated.h @@ -347,6 +347,9 @@ extern grpc_set_ssl_roots_override_callback_type grpc_set_ssl_roots_override_cal typedef grpc_channel_credentials*(*grpc_ssl_credentials_create_type)(const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair, const verify_peer_options* verify_options, void* reserved); extern grpc_ssl_credentials_create_type grpc_ssl_credentials_create_import; #define grpc_ssl_credentials_create grpc_ssl_credentials_create_import +typedef grpc_channel_credentials*(*grpc_ssl_credentials_create_ex_type)(const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair, const grpc_ssl_verify_peer_options* verify_options, void* reserved); +extern grpc_ssl_credentials_create_ex_type grpc_ssl_credentials_create_ex_import; +#define grpc_ssl_credentials_create_ex grpc_ssl_credentials_create_ex_import typedef void(*grpc_call_credentials_release_type)(grpc_call_credentials* creds); extern grpc_call_credentials_release_type grpc_call_credentials_release_import; #define grpc_call_credentials_release grpc_call_credentials_release_import diff --git a/test/core/surface/public_headers_must_be_c89.c b/test/core/surface/public_headers_must_be_c89.c index fa02e76ec92..3aaa1e709ee 100644 --- a/test/core/surface/public_headers_must_be_c89.c +++ b/test/core/surface/public_headers_must_be_c89.c @@ -161,6 +161,7 @@ int main(int argc, char **argv) { printf("%lx", (unsigned long) grpc_google_default_credentials_create); printf("%lx", (unsigned long) grpc_set_ssl_roots_override_callback); printf("%lx", (unsigned long) grpc_ssl_credentials_create); + printf("%lx", (unsigned long) grpc_ssl_credentials_create_ex); printf("%lx", (unsigned long) grpc_call_credentials_release); printf("%lx", (unsigned long) grpc_composite_channel_credentials_create); printf("%lx", (unsigned long) grpc_composite_call_credentials_create);