mirror of https://github.com/grpc/grpc.git
Yihua Zhang
6 years ago
parent
588486120d
commit
a3d997cbdc
22 changed files with 724 additions and 0 deletions
@ -0,0 +1,192 @@ |
||||
/*
|
||||
* |
||||
* Copyright 2018 gRPC authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
* |
||||
*/ |
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h" |
||||
|
||||
#include <stdlib.h> |
||||
#include <string.h> |
||||
|
||||
#include <grpc/support/alloc.h> |
||||
#include <grpc/support/log.h> |
||||
#include <grpc/support/string_util.h> |
||||
|
||||
/** -- gRPC TLS key materials config API implementation. -- **/ |
||||
void grpc_tls_key_materials_config::set_key_materials( |
||||
grpc_core::UniquePtr<char> pem_root_certs, |
||||
PemKeyCertPairList pem_key_cert_pair_list) { |
||||
pem_key_cert_pair_list_ = std::move(pem_key_cert_pair_list); |
||||
pem_root_certs_ = std::move(pem_root_certs); |
||||
} |
||||
|
||||
/** -- gRPC TLS credential reload config API implementation. -- **/ |
||||
grpc_tls_credential_reload_config::grpc_tls_credential_reload_config( |
||||
const void* config_user_data, |
||||
int (*schedule)(void* config_user_data, |
||||
grpc_tls_credential_reload_arg* arg), |
||||
void (*cancel)(void* config_user_data, grpc_tls_credential_reload_arg* arg), |
||||
void (*destruct)(void* config_user_data)) |
||||
: config_user_data_(const_cast<void*>(config_user_data)), |
||||
schedule_(schedule), |
||||
cancel_(cancel), |
||||
destruct_(destruct) {} |
||||
|
||||
grpc_tls_credential_reload_config::~grpc_tls_credential_reload_config() { |
||||
if (destruct_ != nullptr) { |
||||
destruct_((void*)config_user_data_); |
||||
} |
||||
} |
||||
|
||||
/** -- gRPC TLS server authorization check API implementation. -- **/ |
||||
grpc_tls_server_authorization_check_config:: |
||||
grpc_tls_server_authorization_check_config( |
||||
const void* config_user_data, |
||||
int (*schedule)(void* config_user_data, |
||||
grpc_tls_server_authorization_check_arg* arg), |
||||
void (*cancel)(void* config_user_data, |
||||
grpc_tls_server_authorization_check_arg* arg), |
||||
void (*destruct)(void* config_user_data)) |
||||
: config_user_data_(const_cast<void*>(config_user_data)), |
||||
schedule_(schedule), |
||||
cancel_(cancel), |
||||
destruct_(destruct) {} |
||||
|
||||
grpc_tls_server_authorization_check_config:: |
||||
~grpc_tls_server_authorization_check_config() { |
||||
if (destruct_ != nullptr) { |
||||
destruct_((void*)config_user_data_); |
||||
} |
||||
} |
||||
|
||||
/** -- Wrapper APIs declared in grpc_security.h -- **/ |
||||
grpc_tls_credentials_options* grpc_tls_credentials_options_create() { |
||||
return grpc_core::New<grpc_tls_credentials_options>(); |
||||
} |
||||
|
||||
int grpc_tls_credentials_options_set_cert_request_type( |
||||
grpc_tls_credentials_options* options, |
||||
grpc_ssl_client_certificate_request_type type) { |
||||
if (options == nullptr) { |
||||
gpr_log(GPR_ERROR, |
||||
"Invalid nullptr arguments to " |
||||
"grpc_tls_credentials_options_set_cert_request_type()"); |
||||
return 0; |
||||
} |
||||
options->set_cert_request_type(type); |
||||
return 1; |
||||
} |
||||
|
||||
int grpc_tls_credentials_options_set_key_materials_config( |
||||
grpc_tls_credentials_options* options, |
||||
grpc_tls_key_materials_config* config) { |
||||
if (options == nullptr || config == nullptr) { |
||||
gpr_log(GPR_ERROR, |
||||
"Invalid nullptr arguments to " |
||||
"grpc_tls_credentials_options_set_key_materials_config()"); |
||||
return 0; |
||||
} |
||||
options->set_key_materials_config(config->Ref()); |
||||
return 1; |
||||
} |
||||
|
||||
int grpc_tls_credentials_options_set_credential_reload_config( |
||||
grpc_tls_credentials_options* options, |
||||
grpc_tls_credential_reload_config* config) { |
||||
if (options == nullptr || config == nullptr) { |
||||
gpr_log(GPR_ERROR, |
||||
"Invalid nullptr arguments to " |
||||
"grpc_tls_credentials_options_set_credential_reload_config()"); |
||||
return 0; |
||||
} |
||||
options->set_credential_reload_config(config->Ref()); |
||||
return 1; |
||||
} |
||||
|
||||
int grpc_tls_credentials_options_set_server_authorization_check_config( |
||||
grpc_tls_credentials_options* options, |
||||
grpc_tls_server_authorization_check_config* config) { |
||||
if (options == nullptr || config == nullptr) { |
||||
gpr_log( |
||||
GPR_ERROR, |
||||
"Invalid nullptr arguments to " |
||||
"grpc_tls_credentials_options_set_server_authorization_check_config()"); |
||||
return 0; |
||||
} |
||||
options->set_server_authorization_check_config(config->Ref()); |
||||
return 1; |
||||
} |
||||
|
||||
grpc_tls_key_materials_config* grpc_tls_key_materials_config_create() { |
||||
return grpc_core::New<grpc_tls_key_materials_config>(); |
||||
} |
||||
|
||||
int grpc_tls_key_materials_config_set_key_materials( |
||||
grpc_tls_key_materials_config* config, const char* root_certs, |
||||
const grpc_ssl_pem_key_cert_pair** key_cert_pairs, size_t num) { |
||||
if (config == nullptr || key_cert_pairs == nullptr || num == 0) { |
||||
gpr_log(GPR_ERROR, |
||||
"Invalid arguments to " |
||||
"grpc_tls_key_materials_config_set_key_materials()"); |
||||
return 0; |
||||
} |
||||
grpc_core::UniquePtr<char> pem_root(const_cast<char*>(root_certs)); |
||||
grpc_tls_key_materials_config::PemKeyCertPairList cert_pair_list; |
||||
for (size_t i = 0; i < num; i++) { |
||||
grpc_core::PemKeyCertPair key_cert_pair( |
||||
const_cast<grpc_ssl_pem_key_cert_pair*>(key_cert_pairs[i])); |
||||
cert_pair_list.emplace_back(std::move(key_cert_pair)); |
||||
} |
||||
config->set_key_materials(std::move(pem_root), std::move(cert_pair_list)); |
||||
gpr_free(key_cert_pairs); |
||||
return 1; |
||||
} |
||||
|
||||
grpc_tls_credential_reload_config* grpc_tls_credential_reload_config_create( |
||||
const void* config_user_data, |
||||
int (*schedule)(void* config_user_data, |
||||
grpc_tls_credential_reload_arg* arg), |
||||
void (*cancel)(void* config_user_data, grpc_tls_credential_reload_arg* arg), |
||||
void (*destruct)(void* config_user_data)) { |
||||
if (schedule == nullptr) { |
||||
gpr_log( |
||||
GPR_ERROR, |
||||
"Schedule API is nullptr in creating TLS credential reload config."); |
||||
return nullptr; |
||||
} |
||||
return grpc_core::New<grpc_tls_credential_reload_config>( |
||||
config_user_data, schedule, cancel, destruct); |
||||
} |
||||
|
||||
grpc_tls_server_authorization_check_config* |
||||
grpc_tls_server_authorization_check_config_create( |
||||
const void* config_user_data, |
||||
int (*schedule)(void* config_user_data, |
||||
grpc_tls_server_authorization_check_arg* arg), |
||||
void (*cancel)(void* config_user_data, |
||||
grpc_tls_server_authorization_check_arg* arg), |
||||
void (*destruct)(void* config_user_data)) { |
||||
if (schedule == nullptr) { |
||||
gpr_log(GPR_ERROR, |
||||
"Schedule API is nullptr in creating TLS server authorization " |
||||
"check config."); |
||||
return nullptr; |
||||
} |
||||
return grpc_core::New<grpc_tls_server_authorization_check_config>( |
||||
config_user_data, schedule, cancel, destruct); |
||||
} |
||||
@ -0,0 +1,213 @@ |
||||
/*
|
||||
* |
||||
* Copyright 2018 gRPC authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
* |
||||
*/ |
||||
|
||||
#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H |
||||
#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H |
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include <grpc/grpc_security.h> |
||||
|
||||
#include "src/core/lib/gprpp/inlined_vector.h" |
||||
#include "src/core/lib/gprpp/ref_counted.h" |
||||
#include "src/core/lib/security/security_connector/ssl_utils.h" |
||||
|
||||
/** TLS key materials config. **/ |
||||
struct grpc_tls_key_materials_config |
||||
: public grpc_core::RefCounted<grpc_tls_key_materials_config> { |
||||
public: |
||||
typedef grpc_core::InlinedVector<grpc_core::PemKeyCertPair, 1> |
||||
PemKeyCertPairList; |
||||
|
||||
/** Getters for member fields. **/ |
||||
const char* pem_root_certs() const { return pem_root_certs_.get(); } |
||||
const PemKeyCertPairList& pem_key_cert_pair_list() const { |
||||
return pem_key_cert_pair_list_; |
||||
} |
||||
|
||||
/** Setters for member fields. **/ |
||||
void set_key_materials(grpc_core::UniquePtr<char> pem_root_certs, |
||||
PemKeyCertPairList pem_key_cert_pair_list); |
||||
|
||||
private: |
||||
PemKeyCertPairList pem_key_cert_pair_list_; |
||||
grpc_core::UniquePtr<char> pem_root_certs_; |
||||
}; |
||||
|
||||
/** TLS credential reload config. **/ |
||||
struct grpc_tls_credential_reload_config |
||||
: public grpc_core::RefCounted<grpc_tls_credential_reload_config> { |
||||
public: |
||||
grpc_tls_credential_reload_config( |
||||
const void* config_user_data, |
||||
int (*schedule)(void* config_user_data, |
||||
grpc_tls_credential_reload_arg* arg), |
||||
void (*cancel)(void* config_user_data, |
||||
grpc_tls_credential_reload_arg* arg), |
||||
void (*destruct)(void* config_user_data)); |
||||
~grpc_tls_credential_reload_config(); |
||||
|
||||
int Schedule(grpc_tls_credential_reload_arg* arg) const { |
||||
return schedule_(config_user_data_, arg); |
||||
} |
||||
void Cancel(grpc_tls_credential_reload_arg* arg) const { |
||||
if (cancel_ == nullptr) { |
||||
gpr_log(GPR_ERROR, "cancel API is nullptr."); |
||||
return; |
||||
} |
||||
cancel_(config_user_data_, arg); |
||||
} |
||||
|
||||
private: |
||||
/** config-specific, read-only user data that works for all channels created
|
||||
with a credential using the config. */ |
||||
void* config_user_data_; |
||||
/** callback function for invoking credential reload API. The implementation
|
||||
of this method has to be non-blocking, but can be performed synchronously |
||||
or asynchronously. |
||||
If processing occurs synchronously, it populates \a arg->key_materials, \a |
||||
arg->status, and \a arg->error_details and returns zero. |
||||
If processing occurs asynchronously, it returns a non-zero value. |
||||
Application then invokes \a arg->cb when processing is completed. Note that |
||||
\a arg->cb cannot be invoked before \a schedule returns. |
||||
*/ |
||||
int (*schedule_)(void* config_user_data, grpc_tls_credential_reload_arg* arg); |
||||
/** callback function for cancelling a credential reload request scheduled via
|
||||
an asynchronous \a schedule. \a arg is used to pinpoint an exact reloading |
||||
request to be cancelled, and the operation may not have any effect if the |
||||
request has already been processed. */ |
||||
void (*cancel_)(void* config_user_data, grpc_tls_credential_reload_arg* arg); |
||||
/** callback function for cleaning up any data associated with credential
|
||||
reload config. */ |
||||
void (*destruct_)(void* config_user_data); |
||||
}; |
||||
|
||||
/** TLS server authorization check config. **/ |
||||
struct grpc_tls_server_authorization_check_config |
||||
: public grpc_core::RefCounted<grpc_tls_server_authorization_check_config> { |
||||
public: |
||||
grpc_tls_server_authorization_check_config( |
||||
const void* config_user_data, |
||||
int (*schedule)(void* config_user_data, |
||||
grpc_tls_server_authorization_check_arg* arg), |
||||
void (*cancel)(void* config_user_data, |
||||
grpc_tls_server_authorization_check_arg* arg), |
||||
void (*destruct)(void* config_user_data)); |
||||
~grpc_tls_server_authorization_check_config(); |
||||
|
||||
int Schedule(grpc_tls_server_authorization_check_arg* arg) const { |
||||
return schedule_(config_user_data_, arg); |
||||
} |
||||
void Cancel(grpc_tls_server_authorization_check_arg* arg) const { |
||||
if (cancel_ == nullptr) { |
||||
gpr_log(GPR_ERROR, "cancel API is nullptr."); |
||||
return; |
||||
} |
||||
cancel_(config_user_data_, arg); |
||||
} |
||||
|
||||
private: |
||||
/** config-specific, read-only user data that works for all channels created
|
||||
with a Credential using the config. */ |
||||
void* config_user_data_; |
||||
|
||||
/** callback function for invoking server authorization check. The
|
||||
implementation of this method has to be non-blocking, but can be performed |
||||
synchronously or asynchronously. |
||||
If processing occurs synchronously, it populates \a arg->result, \a |
||||
arg->status, and \a arg->error_details, and returns zero. |
||||
If processing occurs asynchronously, it returns a non-zero value. |
||||
Application then invokes \a arg->cb when processing is completed. Note that |
||||
\a arg->cb cannot be invoked before \a schedule() returns. |
||||
*/ |
||||
int (*schedule_)(void* config_user_data, |
||||
grpc_tls_server_authorization_check_arg* arg); |
||||
|
||||
/** callback function for canceling a server authorization check request. */ |
||||
void (*cancel_)(void* config_user_data, |
||||
grpc_tls_server_authorization_check_arg* arg); |
||||
|
||||
/** callback function for cleaning up any data associated with server
|
||||
authorization check config. */ |
||||
void (*destruct_)(void* config_user_data); |
||||
}; |
||||
|
||||
/* TLS credentials options. */ |
||||
struct grpc_tls_credentials_options |
||||
: public grpc_core::RefCounted<grpc_tls_credentials_options> { |
||||
public: |
||||
~grpc_tls_credentials_options() { |
||||
if (key_materials_config_.get() != nullptr) { |
||||
key_materials_config_.get()->Unref(); |
||||
} |
||||
if (credential_reload_config_.get() != nullptr) { |
||||
credential_reload_config_.get()->Unref(); |
||||
} |
||||
if (server_authorization_check_config_.get() != nullptr) { |
||||
server_authorization_check_config_.get()->Unref(); |
||||
} |
||||
} |
||||
|
||||
/* Getters for member fields. */ |
||||
grpc_ssl_client_certificate_request_type cert_request_type() const { |
||||
return cert_request_type_; |
||||
} |
||||
const grpc_tls_key_materials_config* key_materials_config() const { |
||||
return key_materials_config_.get(); |
||||
} |
||||
const grpc_tls_credential_reload_config* credential_reload_config() const { |
||||
return credential_reload_config_.get(); |
||||
} |
||||
const grpc_tls_server_authorization_check_config* |
||||
server_authorization_check_config() const { |
||||
return server_authorization_check_config_.get(); |
||||
} |
||||
grpc_tls_key_materials_config* mutable_key_materials_config() { |
||||
return key_materials_config_.get(); |
||||
} |
||||
|
||||
/* Setters for member fields. */ |
||||
void set_cert_request_type( |
||||
const grpc_ssl_client_certificate_request_type type) { |
||||
cert_request_type_ = type; |
||||
} |
||||
void set_key_materials_config( |
||||
grpc_core::RefCountedPtr<grpc_tls_key_materials_config> config) { |
||||
key_materials_config_ = std::move(config); |
||||
} |
||||
void set_credential_reload_config( |
||||
grpc_core::RefCountedPtr<grpc_tls_credential_reload_config> config) { |
||||
credential_reload_config_ = std::move(config); |
||||
} |
||||
void set_server_authorization_check_config( |
||||
grpc_core::RefCountedPtr<grpc_tls_server_authorization_check_config> |
||||
config) { |
||||
server_authorization_check_config_ = std::move(config); |
||||
} |
||||
|
||||
private: |
||||
grpc_ssl_client_certificate_request_type cert_request_type_; |
||||
grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_; |
||||
grpc_core::RefCountedPtr<grpc_tls_credential_reload_config> |
||||
credential_reload_config_; |
||||
grpc_core::RefCountedPtr<grpc_tls_server_authorization_check_config> |
||||
server_authorization_check_config_; |
||||
}; |
||||
|
||||
#endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H \ |
||||
*/ |
||||
Loading…
Reference in new issue