mirror of https://github.com/grpc/grpc.git
This reverts commit 0f0396ae92.
pull/34726/head
apolcyn
1 year ago
committed by
GitHub
parent
975184f04b
commit
7af5efcfd3
51 changed files with 199 additions and 1426 deletions
@ -1,85 +0,0 @@ |
||||
//
|
||||
//
|
||||
// Copyright 2023 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
//
|
||||
|
||||
#ifndef GRPC_GRPC_CRL_PROVIDER_H |
||||
#define GRPC_GRPC_CRL_PROVIDER_H |
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include <memory> |
||||
#include <string> |
||||
|
||||
#include "absl/status/statusor.h" |
||||
#include "absl/strings/string_view.h" |
||||
|
||||
#include <grpc/grpc_security.h> |
||||
#include <grpc/support/sync.h> |
||||
|
||||
namespace grpc_core { |
||||
namespace experimental { |
||||
|
||||
// Opaque representation of a CRL. Must be thread safe.
|
||||
class Crl { |
||||
public: |
||||
static absl::StatusOr<std::unique_ptr<Crl>> Parse( |
||||
absl::string_view crl_string); |
||||
virtual ~Crl() = default; |
||||
virtual absl::string_view Issuer() = 0; |
||||
}; |
||||
|
||||
// Information about a certificate to be used to fetch its associated CRL. Must
|
||||
// be thread safe.
|
||||
class CertificateInfo { |
||||
public: |
||||
virtual ~CertificateInfo() = default; |
||||
virtual absl::string_view Issuer() const = 0; |
||||
}; |
||||
|
||||
// The base class for CRL Provider implementations.
|
||||
// CrlProviders can be passed in as a way to supply CRLs during handshakes.
|
||||
// CrlProviders must be thread safe. They are on the critical path of gRPC
|
||||
// creating a connection and doing a handshake, so the implementation of
|
||||
// `GetCrl` should be very fast. It is suggested to have an in-memory map of
|
||||
// CRLs for quick lookup and return, and doing expensive updates to this map
|
||||
// asynchronously.
|
||||
class CrlProvider { |
||||
public: |
||||
virtual ~CrlProvider() = default; |
||||
// Get the CRL associated with a certificate. Read-only.
|
||||
virtual std::shared_ptr<Crl> GetCrl( |
||||
const CertificateInfo& certificate_info) = 0; |
||||
}; |
||||
|
||||
absl::StatusOr<std::shared_ptr<CrlProvider>> CreateStaticCrlProvider( |
||||
absl::Span<const std::string> crls); |
||||
|
||||
} // namespace experimental
|
||||
} // namespace grpc_core
|
||||
|
||||
// TODO(gtcooke94) - Mark with api macro when all wrapped langauges support C++
|
||||
// in core APIs
|
||||
/**
|
||||
* EXPERIMENTAL API - Subject to change |
||||
* |
||||
* Sets the crl provider in the options. |
||||
*/ |
||||
void grpc_tls_credentials_options_set_crl_provider( |
||||
grpc_tls_credentials_options* options, |
||||
std::shared_ptr<grpc_core::experimental::CrlProvider> provider); |
||||
|
||||
#endif /* GRPC_GRPC_CRL_PROVIDER_H */ |
||||
@ -1,39 +0,0 @@ |
||||
//
|
||||
//
|
||||
// Copyright 2023 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
//
|
||||
|
||||
#ifndef GRPCPP_SECURITY_TLS_CRL_PROVIDER_H |
||||
#define GRPCPP_SECURITY_TLS_CRL_PROVIDER_H |
||||
|
||||
#include <grpc/grpc_crl_provider.h> |
||||
#include <grpcpp/impl/sync.h> |
||||
#include <grpcpp/support/string_ref.h> |
||||
|
||||
namespace grpc { |
||||
namespace experimental { |
||||
|
||||
using grpc_core::experimental:: |
||||
CertificateInfo; // NOLINT(misc-unused-using-decls)
|
||||
using grpc_core::experimental:: |
||||
CreateStaticCrlProvider; // NOLINT(misc-unused-using-decls)
|
||||
using grpc_core::experimental::Crl; // NOLINT(misc-unused-using-decls)
|
||||
using grpc_core::experimental::CrlProvider; // NOLINT(misc-unused-using-decls)
|
||||
|
||||
} // namespace experimental
|
||||
} // namespace grpc
|
||||
|
||||
#endif // GRPCPP_SECURITY_TLS_CRL_PROVIDER_H
|
||||
@ -1,118 +0,0 @@ |
||||
//
|
||||
//
|
||||
// Copyright 2023 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
//
|
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include "src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h" |
||||
|
||||
#include <limits.h> |
||||
|
||||
#include <memory> |
||||
#include <utility> |
||||
|
||||
// IWYU pragma: no_include <openssl/mem.h>
|
||||
#include <openssl/bio.h> |
||||
#include <openssl/crypto.h> // IWYU pragma: keep |
||||
#include <openssl/pem.h> |
||||
#include <openssl/x509.h> |
||||
|
||||
#include "absl/container/flat_hash_map.h" |
||||
#include "absl/status/status.h" |
||||
#include "absl/status/statusor.h" |
||||
#include "absl/strings/str_cat.h" |
||||
#include "absl/types/span.h" |
||||
|
||||
#include <grpc/support/log.h> |
||||
|
||||
namespace grpc_core { |
||||
namespace experimental { |
||||
|
||||
namespace { |
||||
std::string IssuerFromCrl(X509_CRL* crl) { |
||||
char* buf = X509_NAME_oneline(X509_CRL_get_issuer(crl), nullptr, 0); |
||||
std::string ret; |
||||
if (buf != nullptr) { |
||||
ret = buf; |
||||
} |
||||
OPENSSL_free(buf); |
||||
return ret; |
||||
} |
||||
|
||||
} // namespace
|
||||
|
||||
absl::StatusOr<std::unique_ptr<Crl>> Crl::Parse(absl::string_view crl_string) { |
||||
if (crl_string.size() >= INT_MAX) { |
||||
return absl::InvalidArgumentError("crl_string cannot be of size INT_MAX"); |
||||
} |
||||
BIO* crl_bio = |
||||
BIO_new_mem_buf(crl_string.data(), static_cast<int>(crl_string.size())); |
||||
// Errors on BIO
|
||||
if (crl_bio == nullptr) { |
||||
return absl::InvalidArgumentError( |
||||
"Conversion from crl string to BIO failed."); |
||||
} |
||||
X509_CRL* crl = PEM_read_bio_X509_CRL(crl_bio, nullptr, nullptr, nullptr); |
||||
BIO_free(crl_bio); |
||||
if (crl == nullptr) { |
||||
return absl::InvalidArgumentError( |
||||
"Conversion from PEM string to X509 CRL failed."); |
||||
} |
||||
return CrlImpl::Create(crl); |
||||
} |
||||
|
||||
absl::StatusOr<std::unique_ptr<CrlImpl>> CrlImpl::Create(X509_CRL* crl) { |
||||
std::string issuer = IssuerFromCrl(crl); |
||||
if (issuer.empty()) { |
||||
return absl::InvalidArgumentError("Issuer of crl cannot be empty"); |
||||
} |
||||
return std::make_unique<CrlImpl>(crl, issuer); |
||||
} |
||||
|
||||
CrlImpl::~CrlImpl() { X509_CRL_free(crl_); } |
||||
|
||||
absl::StatusOr<std::shared_ptr<CrlProvider>> CreateStaticCrlProvider( |
||||
absl::Span<const std::string> crls) { |
||||
absl::flat_hash_map<std::string, std::shared_ptr<Crl>> crl_map; |
||||
for (const auto& raw_crl : crls) { |
||||
absl::StatusOr<std::unique_ptr<Crl>> crl = Crl::Parse(raw_crl); |
||||
if (!crl.ok()) { |
||||
return absl::InvalidArgumentError(absl::StrCat( |
||||
"Parsing crl string failed with result ", crl.status().ToString())); |
||||
} |
||||
bool inserted = crl_map.emplace((*crl)->Issuer(), std::move(*crl)).second; |
||||
if (!inserted) { |
||||
gpr_log(GPR_ERROR, |
||||
"StaticCrlProvider received multiple CRLs with the same issuer. " |
||||
"The first one in the span will be used."); |
||||
} |
||||
} |
||||
StaticCrlProvider provider = StaticCrlProvider(std::move(crl_map)); |
||||
return std::make_shared<StaticCrlProvider>(std::move(provider)); |
||||
} |
||||
|
||||
std::shared_ptr<Crl> StaticCrlProvider::GetCrl( |
||||
const CertificateInfo& certificate_info) { |
||||
auto it = crls_.find(certificate_info.Issuer()); |
||||
if (it == crls_.end()) { |
||||
return nullptr; |
||||
} |
||||
return it->second; |
||||
} |
||||
|
||||
} // namespace experimental
|
||||
} // namespace grpc_core
|
||||
@ -1,83 +0,0 @@ |
||||
//
|
||||
//
|
||||
// Copyright 2023 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
//
|
||||
|
||||
#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CRL_PROVIDER_H |
||||
#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CRL_PROVIDER_H |
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include <memory> |
||||
#include <string> |
||||
#include <utility> |
||||
|
||||
#include <openssl/crypto.h> |
||||
|
||||
#include "absl/container/flat_hash_map.h" |
||||
#include "absl/status/statusor.h" |
||||
#include "absl/strings/string_view.h" |
||||
|
||||
#include <grpc/grpc_crl_provider.h> |
||||
|
||||
namespace grpc_core { |
||||
namespace experimental { |
||||
|
||||
class StaticCrlProvider : public CrlProvider { |
||||
public: |
||||
// Each element of the input vector is expected to be the raw contents of a
|
||||
// CRL file.
|
||||
explicit StaticCrlProvider( |
||||
absl::flat_hash_map<std::string, std::shared_ptr<Crl>> crls) |
||||
: crls_(std::move(crls)) {} |
||||
std::shared_ptr<Crl> GetCrl(const CertificateInfo& certificate_info) override; |
||||
|
||||
private: |
||||
const absl::flat_hash_map<std::string, std::shared_ptr<Crl>> crls_; |
||||
}; |
||||
|
||||
class CrlImpl : public Crl { |
||||
public: |
||||
static absl::StatusOr<std::unique_ptr<CrlImpl>> Create(X509_CRL* crl); |
||||
// Takes ownership of the X509_CRL pointer.
|
||||
CrlImpl(X509_CRL* crl, absl::string_view issuer) |
||||
: crl_(crl), issuer_(issuer) {} |
||||
~CrlImpl() override; |
||||
// Returns a string view representation of the issuer pulled from the CRL.
|
||||
absl::string_view Issuer() override { return issuer_; } |
||||
// The caller should not take ownership of the returned pointer.
|
||||
X509_CRL* crl() const { return crl_; } |
||||
|
||||
private: |
||||
X509_CRL* crl_; |
||||
const std::string issuer_; |
||||
}; |
||||
|
||||
class CertificateInfoImpl : public CertificateInfo { |
||||
public: |
||||
explicit CertificateInfoImpl(absl::string_view issuer) : issuer_(issuer) {} |
||||
// Returns a string representation of the issuer pulled from the
|
||||
// certificate.
|
||||
absl::string_view Issuer() const override { return issuer_; } |
||||
|
||||
private: |
||||
const std::string issuer_; |
||||
}; |
||||
|
||||
} // namespace experimental
|
||||
} // namespace grpc_core
|
||||
|
||||
#endif // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CRL_PROVIDER_H
|
||||
@ -1,95 +0,0 @@ |
||||
//
|
||||
//
|
||||
// Copyright 2023 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
//
|
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include "src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h" |
||||
|
||||
#include <memory> |
||||
#include <string> |
||||
#include <vector> |
||||
|
||||
#include <gtest/gtest.h> |
||||
|
||||
#include "absl/status/statusor.h" |
||||
|
||||
#include <grpc/grpc_audit_logging.h> |
||||
#include <grpc/grpc_crl_provider.h> |
||||
|
||||
#include "test/core/util/test_config.h" |
||||
#include "test/core/util/tls_utils.h" |
||||
|
||||
const char* kCrlPath = "test/core/tsi/test_creds/crl_data/crls/ab06acdd.r0"; |
||||
const absl::string_view kCrlIssuer = |
||||
"/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd/CN=testca"; |
||||
|
||||
namespace grpc_core { |
||||
namespace testing { |
||||
|
||||
using ::grpc_core::experimental::CertificateInfoImpl; |
||||
using ::grpc_core::experimental::Crl; |
||||
using ::grpc_core::experimental::CrlProvider; |
||||
|
||||
TEST(CrlProviderTest, CanParseCrl) { |
||||
std::string crl_string = GetFileContents(kCrlPath); |
||||
absl::StatusOr<std::shared_ptr<Crl>> crl = Crl::Parse(crl_string); |
||||
ASSERT_TRUE(crl.ok()); |
||||
ASSERT_NE(*crl, nullptr); |
||||
EXPECT_EQ((*crl)->Issuer(), kCrlIssuer); |
||||
} |
||||
|
||||
TEST(CrlProviderTest, InvalidFile) { |
||||
std::string crl_string = "INVALID CRL FILE"; |
||||
absl::StatusOr<std::shared_ptr<Crl>> crl = Crl::Parse(crl_string); |
||||
EXPECT_EQ(crl.status(), |
||||
absl::InvalidArgumentError( |
||||
"Conversion from PEM string to X509 CRL failed.")); |
||||
} |
||||
|
||||
TEST(CrlProviderTest, StaticCrlProviderLookup) { |
||||
std::vector<std::string> crl_strings = {GetFileContents(kCrlPath)}; |
||||
absl::StatusOr<std::shared_ptr<CrlProvider>> provider = |
||||
experimental::CreateStaticCrlProvider(crl_strings); |
||||
ASSERT_TRUE(provider.ok()) << provider.status(); |
||||
CertificateInfoImpl cert = CertificateInfoImpl(kCrlIssuer); |
||||
auto crl = (*provider)->GetCrl(cert); |
||||
ASSERT_NE(crl, nullptr); |
||||
EXPECT_EQ(crl->Issuer(), kCrlIssuer); |
||||
} |
||||
|
||||
TEST(CrlProviderTest, StaticCrlProviderLookupBad) { |
||||
std::vector<std::string> crl_strings = {GetFileContents(kCrlPath)}; |
||||
absl::StatusOr<std::shared_ptr<CrlProvider>> provider = |
||||
experimental::CreateStaticCrlProvider(crl_strings); |
||||
ASSERT_TRUE(provider.ok()) << provider.status(); |
||||
CertificateInfoImpl bad_cert = CertificateInfoImpl("BAD CERT"); |
||||
auto crl = (*provider)->GetCrl(bad_cert); |
||||
EXPECT_EQ(crl, nullptr); |
||||
} |
||||
|
||||
} // namespace testing
|
||||
} // namespace grpc_core
|
||||
|
||||
int main(int argc, char** argv) { |
||||
grpc::testing::TestEnvironment env(&argc, argv); |
||||
::testing::InitGoogleTest(&argc, argv); |
||||
grpc_init(); |
||||
int ret = RUN_ALL_TESTS(); |
||||
grpc_shutdown(); |
||||
return ret; |
||||
} |
||||
@ -1,221 +0,0 @@ |
||||
//
|
||||
//
|
||||
// Copyright 2023 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
//
|
||||
#include <memory> |
||||
|
||||
#include <gmock/gmock.h> |
||||
#include <gtest/gtest.h> |
||||
|
||||
#include "absl/synchronization/notification.h" |
||||
|
||||
#include <grpc/grpc_security.h> |
||||
#include <grpcpp/channel.h> |
||||
#include <grpcpp/client_context.h> |
||||
#include <grpcpp/create_channel.h> |
||||
#include <grpcpp/security/credentials.h> |
||||
#include <grpcpp/security/server_credentials.h> |
||||
#include <grpcpp/server.h> |
||||
#include <grpcpp/server_builder.h> |
||||
|
||||
#include "src/core/lib/iomgr/load_file.h" |
||||
#include "src/cpp/client/secure_credentials.h" |
||||
#include "test/core/util/port.h" |
||||
#include "test/core/util/test_config.h" |
||||
#include "test/core/util/tls_utils.h" |
||||
#include "test/cpp/end2end/test_service_impl.h" |
||||
|
||||
namespace grpc { |
||||
namespace testing { |
||||
namespace { |
||||
|
||||
const char* kRootPath = "test/core/tsi/test_creds/crl_data/ca.pem"; |
||||
const char* kRevokedKeyPath = "test/core/tsi/test_creds/crl_data/revoked.key"; |
||||
const char* kRevokedCertPath = "test/core/tsi/test_creds/crl_data/revoked.pem"; |
||||
const char* kValidKeyPath = "test/core/tsi/test_creds/crl_data/valid.key"; |
||||
const char* kValidCertPath = "test/core/tsi/test_creds/crl_data/valid.pem"; |
||||
const char* kRootCrlPath = "test/core/tsi/test_creds/crl_data/crls/current.crl"; |
||||
constexpr char kMessage[] = "Hello"; |
||||
|
||||
class CrlProviderTest : public ::testing::Test { |
||||
protected: |
||||
void RunServer(absl::Notification* notification, absl::string_view server_key, |
||||
absl::string_view server_cert) { |
||||
experimental::IdentityKeyCertPair key_cert_pair; |
||||
std::string root = grpc_core::testing::GetFileContents(kRootPath); |
||||
key_cert_pair.private_key = server_key.data(); |
||||
key_cert_pair.certificate_chain = server_cert.data(); |
||||
std::vector<experimental::IdentityKeyCertPair> identity_key_cert_pairs; |
||||
identity_key_cert_pairs.emplace_back(key_cert_pair); |
||||
auto certificate_provider = |
||||
std::make_shared<experimental::StaticDataCertificateProvider>( |
||||
root, identity_key_cert_pairs); |
||||
grpc::experimental::TlsServerCredentialsOptions options( |
||||
certificate_provider); |
||||
options.watch_root_certs(); |
||||
options.set_root_cert_name("root"); |
||||
options.watch_identity_key_cert_pairs(); |
||||
options.set_identity_cert_name("identity"); |
||||
options.set_cert_request_type( |
||||
GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY); |
||||
auto server_credentials = grpc::experimental::TlsServerCredentials(options); |
||||
GPR_ASSERT(server_credentials.get() != nullptr); |
||||
|
||||
grpc::ServerBuilder builder; |
||||
TestServiceImpl service_; |
||||
|
||||
builder.AddListeningPort(server_addr_, server_credentials); |
||||
builder.RegisterService("foo.test.google.fr", &service_); |
||||
server_ = builder.BuildAndStart(); |
||||
notification->Notify(); |
||||
server_->Wait(); |
||||
} |
||||
|
||||
void TearDown() override { |
||||
if (server_ != nullptr) { |
||||
server_->Shutdown(); |
||||
server_thread_->join(); |
||||
delete server_thread_; |
||||
} |
||||
} |
||||
|
||||
TestServiceImpl service_; |
||||
std::unique_ptr<Server> server_ = nullptr; |
||||
std::thread* server_thread_ = nullptr; |
||||
std::string server_addr_; |
||||
}; |
||||
|
||||
void DoRpc(const std::string& server_addr, |
||||
const experimental::TlsChannelCredentialsOptions& tls_options, |
||||
bool expect_success) { |
||||
ChannelArguments channel_args; |
||||
channel_args.SetSslTargetNameOverride("foo.test.google.fr"); |
||||
std::shared_ptr<Channel> channel = grpc::CreateCustomChannel( |
||||
server_addr, grpc::experimental::TlsCredentials(tls_options), |
||||
channel_args); |
||||
|
||||
auto stub = grpc::testing::EchoTestService::NewStub(channel); |
||||
grpc::testing::EchoRequest request; |
||||
grpc::testing::EchoResponse response; |
||||
request.set_message(kMessage); |
||||
ClientContext context; |
||||
context.set_deadline(grpc_timeout_seconds_to_deadline(/*time_s=*/10)); |
||||
grpc::Status result = stub->Echo(&context, request, &response); |
||||
if (expect_success) { |
||||
EXPECT_TRUE(result.ok()); |
||||
if (!result.ok()) { |
||||
gpr_log(GPR_ERROR, "%s, %s", result.error_message().c_str(), |
||||
result.error_details().c_str()); |
||||
} |
||||
EXPECT_EQ(response.message(), kMessage); |
||||
} else { |
||||
EXPECT_FALSE(result.ok()); |
||||
} |
||||
} |
||||
|
||||
TEST_F(CrlProviderTest, CrlProviderValid) { |
||||
server_addr_ = absl::StrCat("localhost:", |
||||
std::to_string(grpc_pick_unused_port_or_die())); |
||||
absl::Notification notification; |
||||
std::string server_key = grpc_core::testing::GetFileContents(kValidKeyPath); |
||||
std::string server_cert = grpc_core::testing::GetFileContents(kValidCertPath); |
||||
server_thread_ = new std::thread( |
||||
[&]() { RunServer(¬ification, server_key, server_cert); }); |
||||
notification.WaitForNotification(); |
||||
|
||||
std::string root_cert = grpc_core::testing::GetFileContents(kRootPath); |
||||
std::string client_key = grpc_core::testing::GetFileContents(kValidKeyPath); |
||||
std::string client_cert = grpc_core::testing::GetFileContents(kValidCertPath); |
||||
experimental::IdentityKeyCertPair key_cert_pair; |
||||
key_cert_pair.private_key = client_key; |
||||
key_cert_pair.certificate_chain = client_cert; |
||||
std::vector<experimental::IdentityKeyCertPair> identity_key_cert_pairs; |
||||
identity_key_cert_pairs.emplace_back(key_cert_pair); |
||||
auto certificate_provider = |
||||
std::make_shared<experimental::StaticDataCertificateProvider>( |
||||
root_cert, identity_key_cert_pairs); |
||||
grpc::experimental::TlsChannelCredentialsOptions options; |
||||
options.set_certificate_provider(certificate_provider); |
||||
options.watch_root_certs(); |
||||
options.set_root_cert_name("root"); |
||||
options.watch_identity_key_cert_pairs(); |
||||
options.set_identity_cert_name("identity"); |
||||
std::string root_crl = grpc_core::testing::GetFileContents(kRootCrlPath); |
||||
|
||||
absl::StatusOr<std::shared_ptr<grpc_core::experimental::CrlProvider>> |
||||
provider = grpc_core::experimental::CreateStaticCrlProvider({root_crl}); |
||||
ASSERT_TRUE(provider.ok()); |
||||
|
||||
options.set_crl_provider(*provider); |
||||
options.set_check_call_host(false); |
||||
auto verifier = std::make_shared<experimental::NoOpCertificateVerifier>(); |
||||
options.set_certificate_verifier(verifier); |
||||
|
||||
DoRpc(server_addr_, options, true); |
||||
} |
||||
|
||||
TEST_F(CrlProviderTest, CrlProviderRevokedServer) { |
||||
server_addr_ = absl::StrCat("localhost:", |
||||
std::to_string(grpc_pick_unused_port_or_die())); |
||||
absl::Notification notification; |
||||
std::string server_key = grpc_core::testing::GetFileContents(kRevokedKeyPath); |
||||
std::string server_cert = |
||||
grpc_core::testing::GetFileContents(kRevokedCertPath); |
||||
server_thread_ = new std::thread( |
||||
[&]() { RunServer(¬ification, server_key, server_cert); }); |
||||
notification.WaitForNotification(); |
||||
|
||||
std::string root_cert = grpc_core::testing::GetFileContents(kRootPath); |
||||
std::string client_key = grpc_core::testing::GetFileContents(kValidKeyPath); |
||||
std::string client_cert = grpc_core::testing::GetFileContents(kValidCertPath); |
||||
experimental::IdentityKeyCertPair key_cert_pair; |
||||
key_cert_pair.private_key = client_key; |
||||
key_cert_pair.certificate_chain = client_cert; |
||||
std::vector<experimental::IdentityKeyCertPair> identity_key_cert_pairs; |
||||
identity_key_cert_pairs.emplace_back(key_cert_pair); |
||||
auto certificate_provider = |
||||
std::make_shared<experimental::StaticDataCertificateProvider>( |
||||
root_cert, identity_key_cert_pairs); |
||||
grpc::experimental::TlsChannelCredentialsOptions options; |
||||
options.set_certificate_provider(certificate_provider); |
||||
options.watch_root_certs(); |
||||
options.set_root_cert_name("root"); |
||||
options.watch_identity_key_cert_pairs(); |
||||
options.set_identity_cert_name("identity"); |
||||
std::string root_crl = grpc_core::testing::GetFileContents(kRootCrlPath); |
||||
|
||||
absl::StatusOr<std::shared_ptr<grpc_core::experimental::CrlProvider>> |
||||
provider = grpc_core::experimental::CreateStaticCrlProvider({root_crl}); |
||||
ASSERT_TRUE(provider.ok()); |
||||
|
||||
options.set_crl_provider(*provider); |
||||
options.set_check_call_host(false); |
||||
auto verifier = std::make_shared<experimental::NoOpCertificateVerifier>(); |
||||
options.set_certificate_verifier(verifier); |
||||
|
||||
DoRpc(server_addr_, options, false); |
||||
} |
||||
|
||||
} // namespace
|
||||
} // namespace testing
|
||||
} // namespace grpc
|
||||
|
||||
int main(int argc, char** argv) { |
||||
grpc::testing::TestEnvironment env(&argc, argv); |
||||
::testing::InitGoogleTest(&argc, argv); |
||||
int ret = RUN_ALL_TESTS(); |
||||
return ret; |
||||
} |
||||
Loading…
Reference in new issue