mirror of https://github.com/grpc/grpc.git
Merge pull request #9194 from dgquintas/lb_secure_naming_3
Secure naming support for gRPCLB.pull/9636/head
David G. Quintas
8 years ago
committed by
GitHub
commit
5ef95a96ab
40 changed files with 1098 additions and 210 deletions
@ -0,0 +1,77 @@ |
||||
/*
|
||||
* |
||||
* Copyright 2017, Google Inc. |
||||
* All rights reserved. |
||||
* |
||||
* Redistribution and use in source and binary forms, with or without |
||||
* modification, are permitted provided that the following conditions are |
||||
* met: |
||||
* |
||||
* * Redistributions of source code must retain the above copyright |
||||
* notice, this list of conditions and the following disclaimer. |
||||
* * Redistributions in binary form must reproduce the above |
||||
* copyright notice, this list of conditions and the following disclaimer |
||||
* in the documentation and/or other materials provided with the |
||||
* distribution. |
||||
* * Neither the name of Google Inc. nor the names of its |
||||
* contributors may be used to endorse or promote products derived from |
||||
* this software without specific prior written permission. |
||||
* |
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
||||
* |
||||
*/ |
||||
|
||||
#include <grpc/support/alloc.h> |
||||
#include <grpc/support/string_util.h> |
||||
|
||||
#include "src/core/ext/client_channel/client_channel.h" |
||||
#include "src/core/ext/lb_policy/grpclb/grpclb_channel.h" |
||||
#include "src/core/lib/channel/channel_args.h" |
||||
#include "src/core/lib/iomgr/sockaddr_utils.h" |
||||
#include "src/core/lib/support/string.h" |
||||
|
||||
grpc_channel *grpc_lb_policy_grpclb_create_lb_channel( |
||||
grpc_exec_ctx *exec_ctx, const char *lb_service_target_addresses, |
||||
grpc_client_channel_factory *client_channel_factory, |
||||
grpc_channel_args *args) { |
||||
grpc_channel *lb_channel = grpc_client_channel_factory_create_channel( |
||||
exec_ctx, client_channel_factory, lb_service_target_addresses, |
||||
GRPC_CLIENT_CHANNEL_TYPE_LOAD_BALANCING, args); |
||||
return lb_channel; |
||||
} |
||||
|
||||
grpc_channel_args *get_lb_channel_args(grpc_exec_ctx *exec_ctx, |
||||
grpc_slice_hash_table *targets_info, |
||||
const grpc_channel_args *args) { |
||||
/* We strip out the channel arg for the LB policy name, since we want
|
||||
* to use the default (pick_first) in this case. |
||||
* |
||||
* We also strip out the channel arg for the resolved addresses, since |
||||
* that will be generated by the name resolver used in the LB channel. |
||||
* Note that the LB channel will use the sockaddr resolver, so this |
||||
* won't actually generate a query to DNS (or some other name service). |
||||
* However, the addresses returned by the sockaddr resolver will have |
||||
* is_balancer=false, whereas our own addresses have is_balancer=true. |
||||
* We need the LB channel to return addresses with is_balancer=false |
||||
* so that it does not wind up recursively using the grpclb LB policy, |
||||
* as per the special case logic in client_channel.c. |
||||
* |
||||
* Lastly, we also strip out the channel arg for the server URI, |
||||
* since that will be different for the LB channel than for the parent |
||||
* channel (the client channel factory will re-add this arg with |
||||
* the right value). */ |
||||
static const char *keys_to_remove[] = { |
||||
GRPC_ARG_LB_POLICY_NAME, GRPC_ARG_LB_ADDRESSES, GRPC_ARG_SERVER_URI}; |
||||
return grpc_channel_args_copy_and_remove(args, keys_to_remove, |
||||
GPR_ARRAY_SIZE(keys_to_remove)); |
||||
} |
||||
@ -0,0 +1,56 @@ |
||||
/*
|
||||
* |
||||
* Copyright 2017, Google Inc. |
||||
* All rights reserved. |
||||
* |
||||
* Redistribution and use in source and binary forms, with or without |
||||
* modification, are permitted provided that the following conditions are |
||||
* met: |
||||
* |
||||
* * Redistributions of source code must retain the above copyright |
||||
* notice, this list of conditions and the following disclaimer. |
||||
* * Redistributions in binary form must reproduce the above |
||||
* copyright notice, this list of conditions and the following disclaimer |
||||
* in the documentation and/or other materials provided with the |
||||
* distribution. |
||||
* * Neither the name of Google Inc. nor the names of its |
||||
* contributors may be used to endorse or promote products derived from |
||||
* this software without specific prior written permission. |
||||
* |
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
||||
* |
||||
*/ |
||||
|
||||
#ifndef GRPC_CORE_EXT_LB_POLICY_GRPCLB_GRPCLB_CHANNEL_H |
||||
#define GRPC_CORE_EXT_LB_POLICY_GRPCLB_GRPCLB_CHANNEL_H |
||||
|
||||
#include "src/core/ext/client_channel/lb_policy_factory.h" |
||||
#include "src/core/lib/slice/slice_hash_table.h" |
||||
|
||||
/** Create the channel used for communicating with an LB service.
|
||||
* Note that an LB *service* may be comprised of several LB *servers*. |
||||
* |
||||
* \a lb_service_target_addresses is the target URI containing the addresses |
||||
* from resolving the LB service's name (eg, ipv4:10.0.0.1:1234,10.2.3.4:9876). |
||||
* \a client_channel_factory will be used for the creation of the LB channel, |
||||
* alongside the channel args passed in \a args. */ |
||||
grpc_channel *grpc_lb_policy_grpclb_create_lb_channel( |
||||
grpc_exec_ctx *exec_ctx, const char *lb_service_target_addresses, |
||||
grpc_client_channel_factory *client_channel_factory, |
||||
grpc_channel_args *args); |
||||
|
||||
grpc_channel_args *get_lb_channel_args(grpc_exec_ctx *exec_ctx, |
||||
grpc_slice_hash_table *targets_info, |
||||
const grpc_channel_args *args); |
||||
|
||||
#endif /* GRPC_CORE_EXT_LB_POLICY_GRPCLB_GRPCLB_CHANNEL_H */ |
||||
@ -0,0 +1,107 @@ |
||||
/*
|
||||
* |
||||
* Copyright 2017, Google Inc. |
||||
* All rights reserved. |
||||
* |
||||
* Redistribution and use in source and binary forms, with or without |
||||
* modification, are permitted provided that the following conditions are |
||||
* met: |
||||
* |
||||
* * Redistributions of source code must retain the above copyright |
||||
* notice, this list of conditions and the following disclaimer. |
||||
* * Redistributions in binary form must reproduce the above |
||||
* copyright notice, this list of conditions and the following disclaimer |
||||
* in the documentation and/or other materials provided with the |
||||
* distribution. |
||||
* * Neither the name of Google Inc. nor the names of its |
||||
* contributors may be used to endorse or promote products derived from |
||||
* this software without specific prior written permission. |
||||
* |
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
||||
* |
||||
*/ |
||||
|
||||
#include <grpc/support/alloc.h> |
||||
#include <grpc/support/string_util.h> |
||||
|
||||
#include "src/core/ext/client_channel/client_channel.h" |
||||
#include "src/core/ext/lb_policy/grpclb/grpclb_channel.h" |
||||
#include "src/core/lib/channel/channel_args.h" |
||||
#include "src/core/lib/iomgr/sockaddr_utils.h" |
||||
#include "src/core/lib/security/credentials/credentials.h" |
||||
#include "src/core/lib/security/transport/lb_targets_info.h" |
||||
#include "src/core/lib/slice/slice_internal.h" |
||||
#include "src/core/lib/support/string.h" |
||||
|
||||
grpc_channel *grpc_lb_policy_grpclb_create_lb_channel( |
||||
grpc_exec_ctx *exec_ctx, const char *lb_service_target_addresses, |
||||
grpc_client_channel_factory *client_channel_factory, |
||||
grpc_channel_args *args) { |
||||
grpc_channel_args *new_args = args; |
||||
grpc_channel_credentials *channel_credentials = |
||||
grpc_channel_credentials_find_in_args(args); |
||||
if (channel_credentials != NULL) { |
||||
/* Substitute the channel credentials with a version without call
|
||||
* credentials: the load balancer is not necessarily trusted to handle |
||||
* bearer token credentials */ |
||||
static const char *keys_to_remove[] = {GRPC_ARG_CHANNEL_CREDENTIALS}; |
||||
grpc_channel_credentials *creds_sans_call_creds = |
||||
grpc_channel_credentials_duplicate_without_call_credentials( |
||||
channel_credentials); |
||||
GPR_ASSERT(creds_sans_call_creds != NULL); |
||||
grpc_arg args_to_add[] = { |
||||
grpc_channel_credentials_to_arg(creds_sans_call_creds)}; |
||||
/* Create the new set of channel args */ |
||||
new_args = grpc_channel_args_copy_and_add_and_remove( |
||||
args, keys_to_remove, GPR_ARRAY_SIZE(keys_to_remove), args_to_add, |
||||
GPR_ARRAY_SIZE(args_to_add)); |
||||
grpc_channel_credentials_unref(exec_ctx, creds_sans_call_creds); |
||||
} |
||||
grpc_channel *lb_channel = grpc_client_channel_factory_create_channel( |
||||
exec_ctx, client_channel_factory, lb_service_target_addresses, |
||||
GRPC_CLIENT_CHANNEL_TYPE_LOAD_BALANCING, new_args); |
||||
if (channel_credentials != NULL) { |
||||
grpc_channel_args_destroy(exec_ctx, new_args); |
||||
} |
||||
return lb_channel; |
||||
} |
||||
|
||||
grpc_channel_args *get_lb_channel_args(grpc_exec_ctx *exec_ctx, |
||||
grpc_slice_hash_table *targets_info, |
||||
const grpc_channel_args *args) { |
||||
const grpc_arg targets_info_arg = |
||||
grpc_lb_targets_info_create_channel_arg(targets_info); |
||||
/* We strip out the channel arg for the LB policy name, since we want
|
||||
* to use the default (pick_first) in this case. |
||||
* |
||||
* We also strip out the channel arg for the resolved addresses, since |
||||
* that will be generated by the name resolver used in the LB channel. |
||||
* Note that the LB channel will use the sockaddr resolver, so this |
||||
* won't actually generate a query to DNS (or some other name service). |
||||
* However, the addresses returned by the sockaddr resolver will have |
||||
* is_balancer=false, whereas our own addresses have is_balancer=true. |
||||
* We need the LB channel to return addresses with is_balancer=false |
||||
* so that it does not wind up recursively using the grpclb LB policy, |
||||
* as per the special case logic in client_channel.c. |
||||
* |
||||
* Lastly, we also strip out the channel arg for the server URI, |
||||
* since that will be different for the LB channel than for the parent |
||||
* channel (the client channel factory will re-add this arg with |
||||
* the right value). */ |
||||
static const char *keys_to_remove[] = { |
||||
GRPC_ARG_LB_POLICY_NAME, GRPC_ARG_LB_ADDRESSES, GRPC_ARG_SERVER_URI}; |
||||
/* Add the targets info table to be used for secure naming */ |
||||
return grpc_channel_args_copy_and_add_and_remove( |
||||
args, keys_to_remove, GPR_ARRAY_SIZE(keys_to_remove), &targets_info_arg, |
||||
1); |
||||
} |
||||
@ -0,0 +1,70 @@ |
||||
/*
|
||||
* |
||||
* Copyright 2017, Google Inc. |
||||
* All rights reserved. |
||||
* |
||||
* Redistribution and use in source and binary forms, with or without |
||||
* modification, are permitted provided that the following conditions are |
||||
* met: |
||||
* |
||||
* * Redistributions of source code must retain the above copyright |
||||
* notice, this list of conditions and the following disclaimer. |
||||
* * Redistributions in binary form must reproduce the above |
||||
* copyright notice, this list of conditions and the following disclaimer |
||||
* in the documentation and/or other materials provided with the |
||||
* distribution. |
||||
* * Neither the name of Google Inc. nor the names of its |
||||
* contributors may be used to endorse or promote products derived from |
||||
* this software without specific prior written permission. |
||||
* |
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
||||
* |
||||
*/ |
||||
|
||||
#include <grpc/support/log.h> |
||||
|
||||
#include "src/core/lib/channel/channel_args.h" |
||||
#include "src/core/lib/security/transport/lb_targets_info.h" |
||||
|
||||
/* Channel arg key for the mapping of LB server addresses to their names for
|
||||
* secure naming purposes. */ |
||||
#define GRPC_ARG_LB_SECURE_NAMING_MAP "grpc.lb_secure_naming_map" |
||||
|
||||
static void *targets_info_copy(void *p) { return grpc_slice_hash_table_ref(p); } |
||||
static void targets_info_destroy(grpc_exec_ctx *exec_ctx, void *p) { |
||||
grpc_slice_hash_table_unref(exec_ctx, p); |
||||
} |
||||
static int targets_info_cmp(void *a, void *b) { return GPR_ICMP(a, b); } |
||||
static const grpc_arg_pointer_vtable server_to_balancer_names_vtable = { |
||||
targets_info_copy, targets_info_destroy, targets_info_cmp}; |
||||
|
||||
grpc_arg grpc_lb_targets_info_create_channel_arg( |
||||
grpc_slice_hash_table *targets_info) { |
||||
grpc_arg arg; |
||||
arg.type = GRPC_ARG_POINTER; |
||||
arg.key = GRPC_ARG_LB_SECURE_NAMING_MAP; |
||||
arg.value.pointer.p = targets_info; |
||||
arg.value.pointer.vtable = &server_to_balancer_names_vtable; |
||||
return arg; |
||||
} |
||||
|
||||
grpc_slice_hash_table *grpc_lb_targets_info_find_in_args( |
||||
const grpc_channel_args *args) { |
||||
const grpc_arg *targets_info_arg = |
||||
grpc_channel_args_find(args, GRPC_ARG_LB_SECURE_NAMING_MAP); |
||||
if (targets_info_arg != NULL) { |
||||
GPR_ASSERT(targets_info_arg->type == GRPC_ARG_POINTER); |
||||
return targets_info_arg->value.pointer.p; |
||||
} |
||||
return NULL; |
||||
} |
||||
@ -0,0 +1,47 @@ |
||||
/*
|
||||
* |
||||
* Copyright 2017, Google Inc. |
||||
* All rights reserved. |
||||
* |
||||
* Redistribution and use in source and binary forms, with or without |
||||
* modification, are permitted provided that the following conditions are |
||||
* met: |
||||
* |
||||
* * Redistributions of source code must retain the above copyright |
||||
* notice, this list of conditions and the following disclaimer. |
||||
* * Redistributions in binary form must reproduce the above |
||||
* copyright notice, this list of conditions and the following disclaimer |
||||
* in the documentation and/or other materials provided with the |
||||
* distribution. |
||||
* * Neither the name of Google Inc. nor the names of its |
||||
* contributors may be used to endorse or promote products derived from |
||||
* this software without specific prior written permission. |
||||
* |
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
||||
* |
||||
*/ |
||||
|
||||
#ifndef GRPC_CORE_LIB_SECURITY_TRANSPORT_LB_TARGETS_INFO_H |
||||
#define GRPC_CORE_LIB_SECURITY_TRANSPORT_LB_TARGETS_INFO_H |
||||
|
||||
#include "src/core/lib/slice/slice_hash_table.h" |
||||
|
||||
/** Return a channel argument containing \a targets_info. */ |
||||
grpc_arg grpc_lb_targets_info_create_channel_arg( |
||||
grpc_slice_hash_table *targets_info); |
||||
|
||||
/** Return the instance of targets info in \a args or NULL */ |
||||
grpc_slice_hash_table *grpc_lb_targets_info_find_in_args( |
||||
const grpc_channel_args *args); |
||||
|
||||
#endif /* GRPC_CORE_LIB_SECURITY_TRANSPORT_LB_TARGETS_INFO_H */ |
||||
Loading…
Reference in new issue