mirror of https://github.com/grpc/grpc.git
Add experimental XdsCredentials with support for insecure channel_credentials and security_connector
Yash Tibrewal
4 years ago
parent
82726e2c97
commit
c52cb09f47
31 changed files with 665 additions and 11 deletions
@ -0,0 +1,51 @@ |
|||||||
|
//
|
||||||
|
//
|
||||||
|
// Copyright 2020 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
//
|
||||||
|
//
|
||||||
|
|
||||||
|
#include <grpc/support/port_platform.h> |
||||||
|
|
||||||
|
#include <grpc/grpc_security.h> |
||||||
|
|
||||||
|
#include "src/core/lib/security/credentials/credentials.h" |
||||||
|
#include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
namespace { |
||||||
|
|
||||||
|
constexpr char kCredentialsTypeInsecure[] = "insecure"; |
||||||
|
|
||||||
|
class InsecureCredentials final : public grpc_channel_credentials { |
||||||
|
public: |
||||||
|
explicit InsecureCredentials() |
||||||
|
: grpc_channel_credentials(kCredentialsTypeInsecure) {} |
||||||
|
|
||||||
|
grpc_core::RefCountedPtr<grpc_channel_security_connector> |
||||||
|
create_security_connector( |
||||||
|
grpc_core::RefCountedPtr<grpc_call_credentials> call_creds, |
||||||
|
const char* /* target_name */, const grpc_channel_args* /* args */, |
||||||
|
grpc_channel_args** /* new_args */) override { |
||||||
|
return MakeRefCounted<InsecureChannelSecurityConnector>( |
||||||
|
Ref(), std::move(call_creds)); |
||||||
|
} |
||||||
|
}; |
||||||
|
|
||||||
|
} // namespace
|
||||||
|
} // namespace grpc_core
|
||||||
|
|
||||||
|
grpc_channel_credentials* grpc_insecure_credentials_create() { |
||||||
|
return new grpc_core::InsecureCredentials(); |
||||||
|
} |
||||||
@ -0,0 +1,88 @@ |
|||||||
|
//
|
||||||
|
//
|
||||||
|
// Copyright 2020 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
//
|
||||||
|
//
|
||||||
|
|
||||||
|
#include <grpc/support/port_platform.h> |
||||||
|
|
||||||
|
#include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h" |
||||||
|
|
||||||
|
#include "src/core/lib/gprpp/ref_counted_ptr.h" |
||||||
|
#include "src/core/lib/security/transport/security_handshaker.h" |
||||||
|
#include "src/core/tsi/local_transport_security.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
const char kInsecureTransportSecurityType[] = "insecure"; |
||||||
|
|
||||||
|
// check_call_host and cancel_check_call_host are no-ops since we want to
|
||||||
|
// provide an insecure channel.
|
||||||
|
bool InsecureChannelSecurityConnector::check_call_host( |
||||||
|
absl::string_view host, grpc_auth_context* auth_context, |
||||||
|
grpc_closure* on_call_host_checked, grpc_error** error) { |
||||||
|
*error = GRPC_ERROR_NONE; |
||||||
|
return true; |
||||||
|
} |
||||||
|
|
||||||
|
void InsecureChannelSecurityConnector::cancel_check_call_host( |
||||||
|
grpc_closure* on_call_host_checked, grpc_error* error) { |
||||||
|
GRPC_ERROR_UNREF(error); |
||||||
|
} |
||||||
|
|
||||||
|
// add_handshakers should have been a no-op but we need to add a minimalist
|
||||||
|
// security handshaker so that check_peer is invoked and an auth_context is
|
||||||
|
// created with the security level of TSI_SECURITY_NONE.
|
||||||
|
void InsecureChannelSecurityConnector::add_handshakers( |
||||||
|
const grpc_channel_args* args, grpc_pollset_set* /* interested_parties */, |
||||||
|
HandshakeManager* handshake_manager) { |
||||||
|
tsi_handshaker* handshaker = nullptr; |
||||||
|
// Re-use local_tsi_handshaker_create as a minimalist handshaker.
|
||||||
|
GPR_ASSERT(tsi_local_handshaker_create(true /* is_client */, &handshaker) == |
||||||
|
TSI_OK); |
||||||
|
handshake_manager->Add(SecurityHandshakerCreate(handshaker, this, args)); |
||||||
|
} |
||||||
|
|
||||||
|
void InsecureChannelSecurityConnector::check_peer( |
||||||
|
tsi_peer peer, grpc_endpoint* ep, |
||||||
|
RefCountedPtr<grpc_auth_context>* auth_context, |
||||||
|
grpc_closure* on_peer_checked) { |
||||||
|
*auth_context = MakeAuthContext(); |
||||||
|
tsi_peer_destruct(&peer); |
||||||
|
ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, GRPC_ERROR_NONE); |
||||||
|
} |
||||||
|
|
||||||
|
int InsecureChannelSecurityConnector::cmp( |
||||||
|
const grpc_security_connector* other_sc) const { |
||||||
|
return channel_security_connector_cmp( |
||||||
|
static_cast<const grpc_channel_security_connector*>(other_sc)); |
||||||
|
} |
||||||
|
|
||||||
|
RefCountedPtr<grpc_auth_context> |
||||||
|
InsecureChannelSecurityConnector::MakeAuthContext() { |
||||||
|
auto ctx = MakeRefCounted<grpc_auth_context>(nullptr); |
||||||
|
grpc_auth_context_add_cstring_property( |
||||||
|
ctx.get(), GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||||
|
kInsecureTransportSecurityType); |
||||||
|
GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name( |
||||||
|
ctx.get(), GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME) == 1); |
||||||
|
const char* security_level = tsi_security_level_to_string(TSI_SECURITY_NONE); |
||||||
|
grpc_auth_context_add_property(ctx.get(), |
||||||
|
GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME, |
||||||
|
security_level, strlen(security_level)); |
||||||
|
return ctx; |
||||||
|
} |
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
@ -0,0 +1,70 @@ |
|||||||
|
//
|
||||||
|
//
|
||||||
|
// Copyright 2020 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
//
|
||||||
|
//
|
||||||
|
|
||||||
|
#ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_INSECURE_INSECURE_SECURITY_CONNECTOR_H |
||||||
|
#define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_INSECURE_INSECURE_SECURITY_CONNECTOR_H |
||||||
|
|
||||||
|
#include <grpc/support/port_platform.h> |
||||||
|
|
||||||
|
#include "src/core/lib/security/context/security_context.h" |
||||||
|
#include "src/core/lib/security/credentials/credentials.h" |
||||||
|
#include "src/core/lib/security/security_connector/security_connector.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
extern const char kInsecureTransportSecurityType[]; |
||||||
|
|
||||||
|
class InsecureChannelSecurityConnector |
||||||
|
: public grpc_channel_security_connector { |
||||||
|
public: |
||||||
|
InsecureChannelSecurityConnector( |
||||||
|
grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds, |
||||||
|
grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds) |
||||||
|
: grpc_channel_security_connector(/* url_scheme */ nullptr, |
||||||
|
std::move(channel_creds), |
||||||
|
std::move(request_metadata_creds)) {} |
||||||
|
|
||||||
|
bool check_call_host(absl::string_view host, grpc_auth_context* auth_context, |
||||||
|
grpc_closure* on_call_host_checked, |
||||||
|
grpc_error** error) override; |
||||||
|
|
||||||
|
void cancel_check_call_host(grpc_closure* on_call_host_checked, |
||||||
|
grpc_error* error) override; |
||||||
|
|
||||||
|
void add_handshakers(const grpc_channel_args* args, |
||||||
|
grpc_pollset_set* /* interested_parties */, |
||||||
|
grpc_core::HandshakeManager* handshake_manager) override; |
||||||
|
|
||||||
|
void check_peer(tsi_peer peer, grpc_endpoint* ep, |
||||||
|
grpc_core::RefCountedPtr<grpc_auth_context>* auth_context, |
||||||
|
grpc_closure* on_peer_checked) override; |
||||||
|
|
||||||
|
int cmp(const grpc_security_connector* other_sc) const override; |
||||||
|
|
||||||
|
// Exposed for testing purposes only.
|
||||||
|
// Create an auth context which is necessary to pass the santiy check in
|
||||||
|
// client_auth_filter that verifies if the peer's auth context is obtained
|
||||||
|
// during handshakes. The auth context is only checked for its existence and
|
||||||
|
// not actually used.
|
||||||
|
static RefCountedPtr<grpc_auth_context> MakeAuthContext(); |
||||||
|
}; |
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
|
|
||||||
|
#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_INSECURE_INSECURE_SECURITY_CONNECTOR_H \ |
||||||
|
*/ |
||||||
@ -0,0 +1,59 @@ |
|||||||
|
//
|
||||||
|
//
|
||||||
|
// Copyright 2020 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
//
|
||||||
|
//
|
||||||
|
|
||||||
|
#include <gmock/gmock.h> |
||||||
|
#include <gtest/gtest.h> |
||||||
|
|
||||||
|
#include <grpc/grpc_security.h> |
||||||
|
|
||||||
|
#include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h" |
||||||
|
#include "src/core/lib/security/security_connector/ssl_utils.h" |
||||||
|
#include "src/core/tsi/transport_security.h" |
||||||
|
#include "test/core/util/test_config.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
namespace testing { |
||||||
|
namespace { |
||||||
|
|
||||||
|
TEST(InsecureSecurityConnector, MakeAuthContextTest) { |
||||||
|
auto auth_context = InsecureChannelSecurityConnector::MakeAuthContext(); |
||||||
|
// Verify that peer identity is set
|
||||||
|
auto it = grpc_auth_context_peer_identity(auth_context.get()); |
||||||
|
const grpc_auth_property* prop = grpc_auth_property_iterator_next(&it); |
||||||
|
ASSERT_NE(prop, nullptr); |
||||||
|
EXPECT_STREQ(prop->name, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME); |
||||||
|
EXPECT_STREQ(prop->value, kInsecureTransportSecurityType); |
||||||
|
// Verify that security level is set to none
|
||||||
|
it = grpc_auth_context_find_properties_by_name( |
||||||
|
auth_context.get(), GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME); |
||||||
|
prop = grpc_auth_property_iterator_next(&it); |
||||||
|
ASSERT_NE(prop, nullptr); |
||||||
|
EXPECT_EQ(grpc_tsi_security_level_string_to_enum(prop->value), |
||||||
|
GRPC_SECURITY_NONE); |
||||||
|
} |
||||||
|
|
||||||
|
} // namespace
|
||||||
|
} // namespace testing
|
||||||
|
} // namespace grpc_core
|
||||||
|
|
||||||
|
int main(int argc, char** argv) { |
||||||
|
::testing::InitGoogleTest(&argc, argv); |
||||||
|
grpc::testing::TestEnvironment env(argc, argv); |
||||||
|
const auto result = RUN_ALL_TESTS(); |
||||||
|
return result; |
||||||
|
} |
||||||
@ -0,0 +1,86 @@ |
|||||||
|
//
|
||||||
|
//
|
||||||
|
// Copyright 2020 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
//
|
||||||
|
//
|
||||||
|
|
||||||
|
#include <gmock/gmock.h> |
||||||
|
#include <gtest/gtest.h> |
||||||
|
|
||||||
|
#include <grpc/grpc.h> |
||||||
|
#include <grpcpp/server_builder.h> |
||||||
|
|
||||||
|
#include "test/core/util/port.h" |
||||||
|
#include "test/core/util/test_config.h" |
||||||
|
#include "test/cpp/end2end/test_service_impl.h" |
||||||
|
#include "test/cpp/util/test_credentials_provider.h" |
||||||
|
|
||||||
|
namespace grpc { |
||||||
|
namespace testing { |
||||||
|
namespace { |
||||||
|
|
||||||
|
class XdsCredentialsEnd2EndFallbackTest |
||||||
|
: public ::testing::TestWithParam<const char*> { |
||||||
|
protected: |
||||||
|
XdsCredentialsEnd2EndFallbackTest() { |
||||||
|
int port = grpc_pick_unused_port_or_die(); |
||||||
|
ServerBuilder builder; |
||||||
|
server_address_ = "localhost:" + std::to_string(port); |
||||||
|
builder.AddListeningPort( |
||||||
|
server_address_, |
||||||
|
GetCredentialsProvider()->GetServerCredentials(GetParam())); |
||||||
|
builder.RegisterService(&service_); |
||||||
|
server_ = builder.BuildAndStart(); |
||||||
|
} |
||||||
|
|
||||||
|
std::string server_address_; |
||||||
|
TestServiceImpl service_; |
||||||
|
std::unique_ptr<Server> server_; |
||||||
|
}; |
||||||
|
|
||||||
|
TEST_P(XdsCredentialsEnd2EndFallbackTest, NoXdsSchemeInTarget) { |
||||||
|
// Target does not use 'xds:///' scheme and should result in using fallback
|
||||||
|
// credentials.
|
||||||
|
ChannelArguments args; |
||||||
|
auto channel = grpc::CreateCustomChannel( |
||||||
|
server_address_, |
||||||
|
grpc::experimental::XdsCredentials( |
||||||
|
GetCredentialsProvider()->GetChannelCredentials(GetParam(), &args)), |
||||||
|
args); |
||||||
|
auto stub = grpc::testing::EchoTestService::NewStub(channel); |
||||||
|
ClientContext ctx; |
||||||
|
EchoRequest req; |
||||||
|
req.set_message("Hello"); |
||||||
|
EchoResponse resp; |
||||||
|
Status s = stub->Echo(&ctx, req, &resp); |
||||||
|
EXPECT_EQ(s.ok(), true); |
||||||
|
EXPECT_EQ(resp.message(), "Hello"); |
||||||
|
} |
||||||
|
|
||||||
|
INSTANTIATE_TEST_SUITE_P(XdsCredentialsEnd2EndFallback, |
||||||
|
XdsCredentialsEnd2EndFallbackTest, |
||||||
|
::testing::ValuesIn(std::vector<const char*>( |
||||||
|
{kInsecureCredentialsType, kTlsCredentialsType}))); |
||||||
|
|
||||||
|
} // namespace
|
||||||
|
} // namespace testing
|
||||||
|
} // namespace grpc
|
||||||
|
|
||||||
|
int main(int argc, char** argv) { |
||||||
|
::testing::InitGoogleTest(&argc, argv); |
||||||
|
grpc::testing::TestEnvironment env(argc, argv); |
||||||
|
const auto result = RUN_ALL_TESTS(); |
||||||
|
return result; |
||||||
|
} |
||||||
Loading…
Reference in new issue