| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332 | /* * * Copyright 2015 gRPC authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * *     http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. * */#include "src/cpp/client/secure_credentials.h"#include <grpc/support/log.h>#include <grpc/support/string_util.h>#include <grpcpp/channel.h>#include <grpcpp/impl/grpc_library.h>#include <grpcpp/support/channel_arguments.h>#include "src/core/lib/security/transport/auth_filters.h"#include "src/cpp/client/create_channel_internal.h"#include "src/cpp/common/secure_auth_context.h"namespace grpc_impl {static grpc::internal::GrpcLibraryInitializer g_gli_initializer;SecureChannelCredentials::SecureChannelCredentials(    grpc_channel_credentials* c_creds)    : c_creds_(c_creds) {  g_gli_initializer.summon();}std::shared_ptr<grpc::Channel> SecureChannelCredentials::CreateChannelImpl(    const grpc::string& target, const grpc::ChannelArguments& args) {  return CreateChannelWithInterceptors(      target, args,      std::vector<std::unique_ptr<          grpc::experimental::ClientInterceptorFactoryInterface>>());}std::shared_ptr<grpc::Channel>SecureChannelCredentials::CreateChannelWithInterceptors(    const grpc::string& target, const grpc::ChannelArguments& args,    std::vector<        std::unique_ptr<grpc::experimental::ClientInterceptorFactoryInterface>>        interceptor_creators) {  grpc_channel_args channel_args;  args.SetChannelArgs(&channel_args);  return ::grpc::CreateChannelInternal(      args.GetSslTargetNameOverride(),      grpc_secure_channel_create(c_creds_, target.c_str(), &channel_args,                                 nullptr),      std::move(interceptor_creators));}SecureCallCredentials::SecureCallCredentials(grpc_call_credentials* c_creds)    : c_creds_(c_creds) {  g_gli_initializer.summon();}bool SecureCallCredentials::ApplyToCall(grpc_call* call) {  return grpc_call_set_credentials(call, c_creds_) == GRPC_CALL_OK;}namespace {std::shared_ptr<ChannelCredentials> WrapChannelCredentials(    grpc_channel_credentials* creds) {  return creds == nullptr ? nullptr                          : std::shared_ptr<ChannelCredentials>(                                new SecureChannelCredentials(creds));}std::shared_ptr<CallCredentials> WrapCallCredentials(    grpc_call_credentials* creds) {  return creds == nullptr ? nullptr                          : std::shared_ptr<CallCredentials>(                                new SecureCallCredentials(creds));}}  // namespacestd::shared_ptr<ChannelCredentials> GoogleDefaultCredentials() {  grpc::GrpcLibraryCodegen init;  // To call grpc_init().  return WrapChannelCredentials(grpc_google_default_credentials_create());}// Builds SSL Credentials given SSL specific optionsstd::shared_ptr<ChannelCredentials> SslCredentials(    const SslCredentialsOptions& options) {  grpc::GrpcLibraryCodegen init;  // To call grpc_init().  grpc_ssl_pem_key_cert_pair pem_key_cert_pair = {      options.pem_private_key.c_str(), options.pem_cert_chain.c_str()};  grpc_channel_credentials* c_creds = grpc_ssl_credentials_create(      options.pem_root_certs.empty() ? nullptr : options.pem_root_certs.c_str(),      options.pem_private_key.empty() ? nullptr : &pem_key_cert_pair, nullptr,      nullptr);  return WrapChannelCredentials(c_creds);}namespace experimental {// Builds ALTS Credentials given ALTS specific optionsstd::shared_ptr<ChannelCredentials> AltsCredentials(    const AltsCredentialsOptions& options) {  grpc::GrpcLibraryCodegen init;  // To call grpc_init().  grpc_alts_credentials_options* c_options =      grpc_alts_credentials_client_options_create();  for (auto service_account = options.target_service_accounts.begin();       service_account != options.target_service_accounts.end();       service_account++) {    grpc_alts_credentials_client_options_add_target_service_account(        c_options, service_account->c_str());  }  grpc_channel_credentials* c_creds = grpc_alts_credentials_create(c_options);  grpc_alts_credentials_options_destroy(c_options);  return WrapChannelCredentials(c_creds);}// Builds Local Credentialsstd::shared_ptr<ChannelCredentials> LocalCredentials(    grpc_local_connect_type type) {  grpc::GrpcLibraryCodegen init;  // To call grpc_init().  return WrapChannelCredentials(grpc_local_credentials_create(type));}}  // namespace experimental// Builds credentials for use when running in GCEstd::shared_ptr<CallCredentials> GoogleComputeEngineCredentials() {  grpc::GrpcLibraryCodegen init;  // To call grpc_init().  return WrapCallCredentials(      grpc_google_compute_engine_credentials_create(nullptr));}// Builds JWT credentials.std::shared_ptr<CallCredentials> ServiceAccountJWTAccessCredentials(    const grpc::string& json_key, long token_lifetime_seconds) {  grpc::GrpcLibraryCodegen init;  // To call grpc_init().  if (token_lifetime_seconds <= 0) {    gpr_log(GPR_ERROR,            "Trying to create JWTCredentials with non-positive lifetime");    return WrapCallCredentials(nullptr);  }  gpr_timespec lifetime =      gpr_time_from_seconds(token_lifetime_seconds, GPR_TIMESPAN);  return WrapCallCredentials(grpc_service_account_jwt_access_credentials_create(      json_key.c_str(), lifetime, nullptr));}// Builds refresh token credentials.std::shared_ptr<CallCredentials> GoogleRefreshTokenCredentials(    const grpc::string& json_refresh_token) {  grpc::GrpcLibraryCodegen init;  // To call grpc_init().  return WrapCallCredentials(grpc_google_refresh_token_credentials_create(      json_refresh_token.c_str(), nullptr));}// Builds access token credentials.std::shared_ptr<CallCredentials> AccessTokenCredentials(    const grpc::string& access_token) {  grpc::GrpcLibraryCodegen init;  // To call grpc_init().  return WrapCallCredentials(      grpc_access_token_credentials_create(access_token.c_str(), nullptr));}// Builds IAM credentials.std::shared_ptr<CallCredentials> GoogleIAMCredentials(    const grpc::string& authorization_token,    const grpc::string& authority_selector) {  grpc::GrpcLibraryCodegen init;  // To call grpc_init().  return WrapCallCredentials(grpc_google_iam_credentials_create(      authorization_token.c_str(), authority_selector.c_str(), nullptr));}// Combines one channel credentials and one call credentials into a channel// composite credentials.std::shared_ptr<ChannelCredentials> CompositeChannelCredentials(    const std::shared_ptr<ChannelCredentials>& channel_creds,    const std::shared_ptr<CallCredentials>& call_creds) {  // Note that we are not saving shared_ptrs to the two credentials passed in  // here. This is OK because the underlying C objects (i.e., channel_creds and  // call_creds) into grpc_composite_credentials_create will see their refcounts  // incremented.  SecureChannelCredentials* s_channel_creds =      channel_creds->AsSecureCredentials();  SecureCallCredentials* s_call_creds = call_creds->AsSecureCredentials();  if (s_channel_creds && s_call_creds) {    return WrapChannelCredentials(grpc_composite_channel_credentials_create(        s_channel_creds->GetRawCreds(), s_call_creds->GetRawCreds(), nullptr));  }  return nullptr;}std::shared_ptr<CallCredentials> CompositeCallCredentials(    const std::shared_ptr<CallCredentials>& creds1,    const std::shared_ptr<CallCredentials>& creds2) {  SecureCallCredentials* s_creds1 = creds1->AsSecureCredentials();  SecureCallCredentials* s_creds2 = creds2->AsSecureCredentials();  if (s_creds1 != nullptr && s_creds2 != nullptr) {    return WrapCallCredentials(grpc_composite_call_credentials_create(        s_creds1->GetRawCreds(), s_creds2->GetRawCreds(), nullptr));  }  return nullptr;}std::shared_ptr<grpc_impl::CallCredentials> MetadataCredentialsFromPlugin(    std::unique_ptr<MetadataCredentialsPlugin> plugin) {  grpc::GrpcLibraryCodegen init;  // To call grpc_init().  const char* type = plugin->GetType();  grpc::MetadataCredentialsPluginWrapper* wrapper =      new grpc::MetadataCredentialsPluginWrapper(std::move(plugin));  grpc_metadata_credentials_plugin c_plugin = {      grpc::MetadataCredentialsPluginWrapper::GetMetadata,      grpc::MetadataCredentialsPluginWrapper::Destroy, wrapper, type};  return WrapCallCredentials(      grpc_metadata_credentials_create_from_plugin(c_plugin, nullptr));}}  // namespace grpc_implnamespace grpc {void MetadataCredentialsPluginWrapper::Destroy(void* wrapper) {  if (wrapper == nullptr) return;  MetadataCredentialsPluginWrapper* w =      static_cast<MetadataCredentialsPluginWrapper*>(wrapper);  delete w;}int MetadataCredentialsPluginWrapper::GetMetadata(    void* wrapper, grpc_auth_metadata_context context,    grpc_credentials_plugin_metadata_cb cb, void* user_data,    grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX],    size_t* num_creds_md, grpc_status_code* status,    const char** error_details) {  GPR_ASSERT(wrapper);  MetadataCredentialsPluginWrapper* w =      static_cast<MetadataCredentialsPluginWrapper*>(wrapper);  if (!w->plugin_) {    *num_creds_md = 0;    *status = GRPC_STATUS_OK;    *error_details = nullptr;    return true;  }  if (w->plugin_->IsBlocking()) {    grpc_auth_metadata_context context_copy = grpc_auth_metadata_context();    grpc_auth_metadata_context_copy(&context, &context_copy);    // Asynchronous return.    w->thread_pool_->Add([w, context_copy, cb, user_data]() mutable {      w->MetadataCredentialsPluginWrapper::InvokePlugin(          context_copy, cb, user_data, nullptr, nullptr, nullptr, nullptr);      grpc_auth_metadata_context_reset(&context_copy);    });    return 0;  } else {    // Synchronous return.    w->InvokePlugin(context, cb, user_data, creds_md, num_creds_md, status,                    error_details);    return 1;  }}namespace {void UnrefMetadata(const std::vector<grpc_metadata>& md) {  for (auto it = md.begin(); it != md.end(); ++it) {    grpc_slice_unref(it->key);    grpc_slice_unref(it->value);  }}}  // namespacevoid MetadataCredentialsPluginWrapper::InvokePlugin(    grpc_auth_metadata_context context, grpc_credentials_plugin_metadata_cb cb,    void* user_data, grpc_metadata creds_md[4], size_t* num_creds_md,    grpc_status_code* status_code, const char** error_details) {  std::multimap<grpc::string, grpc::string> metadata;  // const_cast is safe since the SecureAuthContext only inc/dec the refcount  // and the object is passed as a const ref to plugin_->GetMetadata.  SecureAuthContext cpp_channel_auth_context(      const_cast<grpc_auth_context*>(context.channel_auth_context));  Status status = plugin_->GetMetadata(context.service_url, context.method_name,                                       cpp_channel_auth_context, &metadata);  std::vector<grpc_metadata> md;  for (auto it = metadata.begin(); it != metadata.end(); ++it) {    grpc_metadata md_entry;    md_entry.key = SliceFromCopiedString(it->first);    md_entry.value = SliceFromCopiedString(it->second);    md_entry.flags = 0;    md.push_back(md_entry);  }  if (creds_md != nullptr) {    // Synchronous return.    if (md.size() > GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX) {      *num_creds_md = 0;      *status_code = GRPC_STATUS_INTERNAL;      *error_details = gpr_strdup(          "blocking plugin credentials returned too many metadata keys");      UnrefMetadata(md);    } else {      for (const auto& elem : md) {        creds_md[*num_creds_md].key = elem.key;        creds_md[*num_creds_md].value = elem.value;        creds_md[*num_creds_md].flags = elem.flags;        ++(*num_creds_md);      }      *status_code = static_cast<grpc_status_code>(status.error_code());      *error_details =          status.ok() ? nullptr : gpr_strdup(status.error_message().c_str());    }  } else {    // Asynchronous return.    cb(user_data, md.empty() ? nullptr : &md[0], md.size(),       static_cast<grpc_status_code>(status.error_code()),       status.error_message().c_str());    UnrefMetadata(md);  }}MetadataCredentialsPluginWrapper::MetadataCredentialsPluginWrapper(    std::unique_ptr<MetadataCredentialsPlugin> plugin)    : thread_pool_(CreateDefaultThreadPool()), plugin_(std::move(plugin)) {}}  // namespace grpc
 |