|  | @@ -0,0 +1,185 @@
 | 
	
		
			
				|  |  | +/*
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  | + * Copyright 2015, Google Inc.
 | 
	
		
			
				|  |  | + * All rights reserved.
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  | + * Redistribution and use in source and binary forms, with or without
 | 
	
		
			
				|  |  | + * modification, are permitted provided that the following conditions are
 | 
	
		
			
				|  |  | + * met:
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  | + *     * Redistributions of source code must retain the above copyright
 | 
	
		
			
				|  |  | + * notice, this list of conditions and the following disclaimer.
 | 
	
		
			
				|  |  | + *     * Redistributions in binary form must reproduce the above
 | 
	
		
			
				|  |  | + * copyright notice, this list of conditions and the following disclaimer
 | 
	
		
			
				|  |  | + * in the documentation and/or other materials provided with the
 | 
	
		
			
				|  |  | + * distribution.
 | 
	
		
			
				|  |  | + *     * Neither the name of Google Inc. nor the names of its
 | 
	
		
			
				|  |  | + * contributors may be used to endorse or promote products derived from
 | 
	
		
			
				|  |  | + * this software without specific prior written permission.
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  | + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 | 
	
		
			
				|  |  | + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 | 
	
		
			
				|  |  | + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 | 
	
		
			
				|  |  | + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 | 
	
		
			
				|  |  | + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 | 
	
		
			
				|  |  | + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 | 
	
		
			
				|  |  | + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 | 
	
		
			
				|  |  | + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 | 
	
		
			
				|  |  | + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 | 
	
		
			
				|  |  | + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 | 
	
		
			
				|  |  | + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 | 
	
		
			
				|  |  | + *
 | 
	
		
			
				|  |  | + */
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +#include "src/core/security/credentials.h"
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +#include <string.h>
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +#include <grpc/support/alloc.h>
 | 
	
		
			
				|  |  | +#include <grpc/support/log.h>
 | 
	
		
			
				|  |  | +#include <grpc/support/sync.h>
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +#include "src/core/httpcli/httpcli.h"
 | 
	
		
			
				|  |  | +#include "src/core/support/env.h"
 | 
	
		
			
				|  |  | +#include "src/core/support/file.h"
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +/* -- Constants. -- */
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +#define GRPC_COMPUTE_ENGINE_DETECTION_HOST "metadata.google.internal"
 | 
	
		
			
				|  |  | +#define GRPC_GOOGLE_CREDENTIALS_ENV_VAR "GOOGLE_APPLICATION_CREDENTIALS"
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +/* -- Default credentials. -- */
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +static grpc_credentials *default_credentials = NULL;
 | 
	
		
			
				|  |  | +static int compute_engine_detection_done = 0;
 | 
	
		
			
				|  |  | +static gpr_mu g_mu;
 | 
	
		
			
				|  |  | +static gpr_once g_once = GPR_ONCE_INIT;
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +static void init_default_credentials(void) {
 | 
	
		
			
				|  |  | +  gpr_mu_init(&g_mu);
 | 
	
		
			
				|  |  | +}
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +typedef struct {
 | 
	
		
			
				|  |  | +  gpr_cv cv;
 | 
	
		
			
				|  |  | +  gpr_mu mu;
 | 
	
		
			
				|  |  | +  int is_done;
 | 
	
		
			
				|  |  | +  int success;
 | 
	
		
			
				|  |  | +} compute_engine_detector;
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +static void on_compute_engine_detection_http_response(
 | 
	
		
			
				|  |  | +    void *user_data, const grpc_httpcli_response *response) {
 | 
	
		
			
				|  |  | +  compute_engine_detector *detector = (compute_engine_detector *)user_data;
 | 
	
		
			
				|  |  | +  if (response != NULL && response->status == 200 && response->hdr_count > 0) {
 | 
	
		
			
				|  |  | +    /* Internet providers can return a generic response to all requests, so
 | 
	
		
			
				|  |  | +       it is necessary to check that metadata header is present also. */
 | 
	
		
			
				|  |  | +    size_t i;
 | 
	
		
			
				|  |  | +    for (i = 0; i < response->hdr_count; i++) {
 | 
	
		
			
				|  |  | +      grpc_httpcli_header *header = &response->hdrs[i];
 | 
	
		
			
				|  |  | +      if (!strcmp(header->key, "Metadata-Flavor") &&
 | 
	
		
			
				|  |  | +          !strcmp(header->value, "Google")) {
 | 
	
		
			
				|  |  | +        detector->success = 1;
 | 
	
		
			
				|  |  | +        break;
 | 
	
		
			
				|  |  | +      }
 | 
	
		
			
				|  |  | +    }
 | 
	
		
			
				|  |  | +  }
 | 
	
		
			
				|  |  | +  gpr_mu_lock(&detector->mu);
 | 
	
		
			
				|  |  | +  detector->is_done = 1;
 | 
	
		
			
				|  |  | +  gpr_mu_unlock(&detector->mu);
 | 
	
		
			
				|  |  | +  gpr_cv_signal(&detector->cv);
 | 
	
		
			
				|  |  | +}
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +static int is_stack_running_on_compute_engine(void) {
 | 
	
		
			
				|  |  | +  compute_engine_detector detector;
 | 
	
		
			
				|  |  | +  grpc_httpcli_request request;
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +  /* The http call is local. If it takes more than one sec, it is for sure not
 | 
	
		
			
				|  |  | +     on compute engine. */
 | 
	
		
			
				|  |  | +  gpr_timespec max_detection_delay = {1, 0};
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +  gpr_mu_init(&detector.mu);
 | 
	
		
			
				|  |  | +  gpr_cv_init(&detector.cv);
 | 
	
		
			
				|  |  | +  detector.is_done = 0;
 | 
	
		
			
				|  |  | +  detector.success = 0;
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +  memset(&request, 0, sizeof(grpc_httpcli_request));
 | 
	
		
			
				|  |  | +  request.host = GRPC_COMPUTE_ENGINE_DETECTION_HOST;
 | 
	
		
			
				|  |  | +  request.path = "/";
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +  grpc_httpcli_get(&request, gpr_time_add(gpr_now(), max_detection_delay),
 | 
	
		
			
				|  |  | +                   on_compute_engine_detection_http_response, &detector);
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +  /* Block until we get the response. This is not ideal but this should only be
 | 
	
		
			
				|  |  | +     called once for the lifetime of the process by the default credentials. */
 | 
	
		
			
				|  |  | +  gpr_mu_lock(&detector.mu);
 | 
	
		
			
				|  |  | +  while (!detector.is_done) {
 | 
	
		
			
				|  |  | +    gpr_cv_wait(&detector.cv, &detector.mu, gpr_inf_future);
 | 
	
		
			
				|  |  | +  }
 | 
	
		
			
				|  |  | +  gpr_mu_unlock(&detector.mu);
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +  gpr_mu_destroy(&detector.mu);
 | 
	
		
			
				|  |  | +  gpr_cv_destroy(&detector.cv);
 | 
	
		
			
				|  |  | +  return detector.success;
 | 
	
		
			
				|  |  | +}
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +/* Takes ownership of creds_path if not NULL. */
 | 
	
		
			
				|  |  | +static grpc_credentials *create_jwt_creds_from_path(char *creds_path) {
 | 
	
		
			
				|  |  | +  grpc_credentials *result = NULL;
 | 
	
		
			
				|  |  | +  gpr_slice creds_data;
 | 
	
		
			
				|  |  | +  int file_ok = 0;
 | 
	
		
			
				|  |  | +  if (creds_path == NULL) return NULL;
 | 
	
		
			
				|  |  | +  creds_data = gpr_load_file(creds_path, &file_ok);
 | 
	
		
			
				|  |  | +  gpr_free(creds_path);
 | 
	
		
			
				|  |  | +  if (file_ok) {
 | 
	
		
			
				|  |  | +    result = grpc_jwt_credentials_create(
 | 
	
		
			
				|  |  | +        (const char *)GPR_SLICE_START_PTR(creds_data),
 | 
	
		
			
				|  |  | +        grpc_max_auth_token_lifetime);
 | 
	
		
			
				|  |  | +    gpr_slice_unref(creds_data);
 | 
	
		
			
				|  |  | +  }
 | 
	
		
			
				|  |  | +  return result;
 | 
	
		
			
				|  |  | +}
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +grpc_credentials *grpc_google_default_credentials_create(void) {
 | 
	
		
			
				|  |  | +  grpc_credentials *result = NULL;
 | 
	
		
			
				|  |  | +  int serving_cached_credentials = 0;
 | 
	
		
			
				|  |  | +  gpr_once_init(&g_once, init_default_credentials);
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +  gpr_mu_lock(&g_mu);
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +  if (default_credentials != NULL) {
 | 
	
		
			
				|  |  | +    result = default_credentials;
 | 
	
		
			
				|  |  | +    serving_cached_credentials = 1;
 | 
	
		
			
				|  |  | +    goto end;
 | 
	
		
			
				|  |  | +  }
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +  /* First, try the environment variable. */
 | 
	
		
			
				|  |  | +  result =
 | 
	
		
			
				|  |  | +      create_jwt_creds_from_path(gpr_getenv(GRPC_GOOGLE_CREDENTIALS_ENV_VAR));
 | 
	
		
			
				|  |  | +  if (result != NULL) goto end;
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +  /* Then the well-known file. */
 | 
	
		
			
				|  |  | +  result = create_jwt_creds_from_path(
 | 
	
		
			
				|  |  | +      grpc_get_well_known_google_credentials_file_path());
 | 
	
		
			
				|  |  | +  if (result != NULL) goto end;
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +  /* At last try to see if we're on compute engine (do the detection only once
 | 
	
		
			
				|  |  | +     since it requires a network test). */
 | 
	
		
			
				|  |  | +  if (!compute_engine_detection_done) {
 | 
	
		
			
				|  |  | +    int need_compute_engine_creds = is_stack_running_on_compute_engine();
 | 
	
		
			
				|  |  | +    compute_engine_detection_done = 1;
 | 
	
		
			
				|  |  | +    if (need_compute_engine_creds) {
 | 
	
		
			
				|  |  | +      result = grpc_compute_engine_credentials_create();
 | 
	
		
			
				|  |  | +    }
 | 
	
		
			
				|  |  | +  }
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +end:
 | 
	
		
			
				|  |  | +  if (!serving_cached_credentials && result != NULL) {
 | 
	
		
			
				|  |  | +    /* Blend with default ssl credentials and add a global reference so that it
 | 
	
		
			
				|  |  | +       can be cached and re-served. */
 | 
	
		
			
				|  |  | +    result = grpc_composite_credentials_create(
 | 
	
		
			
				|  |  | +        grpc_ssl_credentials_create(NULL, NULL), result);
 | 
	
		
			
				|  |  | +    GPR_ASSERT(result != NULL);
 | 
	
		
			
				|  |  | +    default_credentials = grpc_credentials_ref(result);
 | 
	
		
			
				|  |  | +  }
 | 
	
		
			
				|  |  | +  gpr_mu_unlock(&g_mu);
 | 
	
		
			
				|  |  | +  return result;
 | 
	
		
			
				|  |  | +}
 |