|
|
@@ -26,12 +26,15 @@
|
|
|
#include <grpc/support/log.h>
|
|
|
#include <grpc/support/sync.h>
|
|
|
|
|
|
+#include "src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.h"
|
|
|
+#include "src/core/lib/channel/channel_args.h"
|
|
|
#include "src/core/lib/gpr/env.h"
|
|
|
#include "src/core/lib/gpr/string.h"
|
|
|
#include "src/core/lib/http/httpcli.h"
|
|
|
#include "src/core/lib/http/parser.h"
|
|
|
#include "src/core/lib/iomgr/load_file.h"
|
|
|
#include "src/core/lib/iomgr/polling_entity.h"
|
|
|
+#include "src/core/lib/security/credentials/alts/alts_credentials.h"
|
|
|
#include "src/core/lib/security/credentials/google_default/google_default_credentials.h"
|
|
|
#include "src/core/lib/security/credentials/jwt/jwt_credentials.h"
|
|
|
#include "src/core/lib/security/credentials/oauth2/oauth2_credentials.h"
|
|
|
@@ -45,8 +48,8 @@
|
|
|
|
|
|
/* -- Default credentials. -- */
|
|
|
|
|
|
-static grpc_channel_credentials* default_credentials = nullptr;
|
|
|
-static int compute_engine_detection_done = 0;
|
|
|
+static grpc_channel_credentials* g_default_credentials = nullptr;
|
|
|
+static int g_compute_engine_detection_done = 0;
|
|
|
static gpr_mu g_state_mu;
|
|
|
static gpr_mu* g_polling_mu;
|
|
|
static gpr_once g_once = GPR_ONCE_INIT;
|
|
|
@@ -60,6 +63,52 @@ typedef struct {
|
|
|
grpc_http_response response;
|
|
|
} compute_engine_detector;
|
|
|
|
|
|
+static void google_default_credentials_destruct(
|
|
|
+ grpc_channel_credentials* creds) {
|
|
|
+ grpc_google_default_channel_credentials* c =
|
|
|
+ reinterpret_cast<grpc_google_default_channel_credentials*>(creds);
|
|
|
+ grpc_channel_credentials_unref(c->alts_creds);
|
|
|
+ grpc_channel_credentials_unref(c->ssl_creds);
|
|
|
+}
|
|
|
+
|
|
|
+static grpc_security_status google_default_create_security_connector(
|
|
|
+ grpc_channel_credentials* creds, grpc_call_credentials* call_creds,
|
|
|
+ const char* target, const grpc_channel_args* args,
|
|
|
+ grpc_channel_security_connector** sc, grpc_channel_args** new_args) {
|
|
|
+ grpc_google_default_channel_credentials* c =
|
|
|
+ reinterpret_cast<grpc_google_default_channel_credentials*>(creds);
|
|
|
+ bool is_grpclb_load_balancer = grpc_channel_arg_get_bool(
|
|
|
+ grpc_channel_args_find(args, GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER),
|
|
|
+ false);
|
|
|
+ bool is_backend_from_grpclb_load_balancer = grpc_channel_arg_get_bool(
|
|
|
+ grpc_channel_args_find(
|
|
|
+ args, GRPC_ARG_ADDRESS_IS_BACKEND_FROM_GRPCLB_LOAD_BALANCER),
|
|
|
+ false);
|
|
|
+ bool use_alts =
|
|
|
+ is_grpclb_load_balancer || is_backend_from_grpclb_load_balancer;
|
|
|
+ grpc_security_status status = GRPC_SECURITY_ERROR;
|
|
|
+ status = use_alts ? c->alts_creds->vtable->create_security_connector(
|
|
|
+ c->alts_creds, call_creds, target, args, sc, new_args)
|
|
|
+ : c->ssl_creds->vtable->create_security_connector(
|
|
|
+ c->ssl_creds, call_creds, target, args, sc, new_args);
|
|
|
+ /* grpclb-specific channel args are removed from the channel args set
|
|
|
+ * to ensure backends and fallback adresses will have the same set of channel
|
|
|
+ * args. By doing that, it guarantees the connections to backends will not be
|
|
|
+ * torn down and re-connected when switching in and out of fallback mode.
|
|
|
+ */
|
|
|
+ static const char* args_to_remove[] = {
|
|
|
+ GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER,
|
|
|
+ GRPC_ARG_ADDRESS_IS_BACKEND_FROM_GRPCLB_LOAD_BALANCER,
|
|
|
+ };
|
|
|
+ *new_args = grpc_channel_args_copy_and_add_and_remove(
|
|
|
+ args, args_to_remove, GPR_ARRAY_SIZE(args_to_remove), nullptr, 0);
|
|
|
+ return status;
|
|
|
+}
|
|
|
+
|
|
|
+static grpc_channel_credentials_vtable google_default_credentials_vtable = {
|
|
|
+ google_default_credentials_destruct,
|
|
|
+ google_default_create_security_connector, nullptr};
|
|
|
+
|
|
|
static void on_compute_engine_detection_http_response(void* user_data,
|
|
|
grpc_error* error) {
|
|
|
compute_engine_detector* detector =
|
|
|
@@ -234,8 +283,8 @@ grpc_channel_credentials* grpc_google_default_credentials_create(void) {
|
|
|
|
|
|
gpr_mu_lock(&g_state_mu);
|
|
|
|
|
|
- if (default_credentials != nullptr) {
|
|
|
- result = grpc_channel_credentials_ref(default_credentials);
|
|
|
+ if (g_default_credentials != nullptr) {
|
|
|
+ result = grpc_channel_credentials_ref(g_default_credentials);
|
|
|
goto end;
|
|
|
}
|
|
|
|
|
|
@@ -253,9 +302,9 @@ grpc_channel_credentials* grpc_google_default_credentials_create(void) {
|
|
|
|
|
|
/* At last try to see if we're on compute engine (do the detection only once
|
|
|
since it requires a network test). */
|
|
|
- if (!compute_engine_detection_done) {
|
|
|
+ if (!g_compute_engine_detection_done) {
|
|
|
int need_compute_engine_creds = is_stack_running_on_compute_engine();
|
|
|
- compute_engine_detection_done = 1;
|
|
|
+ g_compute_engine_detection_done = 1;
|
|
|
if (need_compute_engine_creds) {
|
|
|
call_creds = grpc_google_compute_engine_credentials_create(nullptr);
|
|
|
if (call_creds == nullptr) {
|
|
|
@@ -269,18 +318,25 @@ grpc_channel_credentials* grpc_google_default_credentials_create(void) {
|
|
|
end:
|
|
|
if (result == nullptr) {
|
|
|
if (call_creds != nullptr) {
|
|
|
- /* Blend with default ssl credentials and add a global reference so that
|
|
|
- it
|
|
|
- can be cached and re-served. */
|
|
|
- grpc_channel_credentials* ssl_creds =
|
|
|
- grpc_ssl_credentials_create(nullptr, nullptr, nullptr);
|
|
|
- default_credentials = grpc_channel_credentials_ref(
|
|
|
- grpc_composite_channel_credentials_create(ssl_creds, call_creds,
|
|
|
- nullptr));
|
|
|
- GPR_ASSERT(default_credentials != nullptr);
|
|
|
- grpc_channel_credentials_unref(ssl_creds);
|
|
|
+ /* Create google default credentials. */
|
|
|
+ auto creds = static_cast<grpc_google_default_channel_credentials*>(
|
|
|
+ gpr_zalloc(sizeof(grpc_google_default_channel_credentials)));
|
|
|
+ creds->base.vtable = &google_default_credentials_vtable;
|
|
|
+ creds->base.type = GRPC_CHANNEL_CREDENTIALS_TYPE_GOOGLE_DEFAULT;
|
|
|
+ gpr_ref_init(&creds->base.refcount, 1);
|
|
|
+ creds->ssl_creds = grpc_ssl_credentials_create(nullptr, nullptr, nullptr);
|
|
|
+ GPR_ASSERT(creds->ssl_creds != nullptr);
|
|
|
+ grpc_alts_credentials_options* options =
|
|
|
+ grpc_alts_credentials_client_options_create();
|
|
|
+ creds->alts_creds = grpc_alts_credentials_create(options);
|
|
|
+ grpc_alts_credentials_options_destroy(options);
|
|
|
+ /* Add a global reference so that it can be cached and re-served. */
|
|
|
+ g_default_credentials = grpc_composite_channel_credentials_create(
|
|
|
+ &creds->base, call_creds, nullptr);
|
|
|
+ GPR_ASSERT(g_default_credentials != nullptr);
|
|
|
+ grpc_channel_credentials_unref(&creds->base);
|
|
|
grpc_call_credentials_unref(call_creds);
|
|
|
- result = default_credentials;
|
|
|
+ result = grpc_channel_credentials_ref(g_default_credentials);
|
|
|
} else {
|
|
|
gpr_log(GPR_ERROR, "Could not create google default credentials.");
|
|
|
}
|
|
|
@@ -299,11 +355,11 @@ void grpc_flush_cached_google_default_credentials(void) {
|
|
|
grpc_core::ExecCtx exec_ctx;
|
|
|
gpr_once_init(&g_once, init_default_credentials);
|
|
|
gpr_mu_lock(&g_state_mu);
|
|
|
- if (default_credentials != nullptr) {
|
|
|
- grpc_channel_credentials_unref(default_credentials);
|
|
|
- default_credentials = nullptr;
|
|
|
+ if (g_default_credentials != nullptr) {
|
|
|
+ grpc_channel_credentials_unref(g_default_credentials);
|
|
|
+ g_default_credentials = nullptr;
|
|
|
}
|
|
|
- compute_engine_detection_done = 0;
|
|
|
+ g_compute_engine_detection_done = 0;
|
|
|
gpr_mu_unlock(&g_state_mu);
|
|
|
}
|
|
|
|
yihuaz