natas_hw
/
grpc
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Check for mtls authenticated (#27360) 

* Check for mtls authenticated.
This commit is contained in:
Ashitha Santhosh 2021-09-24 17:18:13 -07:00 committed by GitHub
parent 65644a7bb6
commit 835eacc32d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/grpc/grpc_security_constants.h
View File

@ -25,6 +25,7 @@ extern "C" {
#define GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME "transport_security_type"
#define GRPC_SSL_TRANSPORT_SECURITY_TYPE "ssl"
#define GRPC_TLS_TRANSPORT_SECURITY_TYPE "tls"
#define GRPC_X509_CN_PROPERTY_NAME "x509_common_name"
#define GRPC_X509_SAN_PROPERTY_NAME "x509_subject_alternative_name"

3
src/core/lib/security/authorization/matchers.cc
View File

@ -175,7 +175,8 @@ bool PortAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
bool AuthenticatedAuthorizationMatcher::Matches(
const EvaluateArgs& args) const {
if (args.GetTransportSecurityType() != GRPC_SSL_TRANSPORT_SECURITY_TYPE) {
if (args.GetTransportSecurityType() != GRPC_SSL_TRANSPORT_SECURITY_TYPE &&
args.GetTransportSecurityType() != GRPC_TLS_TRANSPORT_SECURITY_TYPE) {
// Connection is not authenticated.
return false;
}

1
src/core/lib/security/security_connector/tls/tls_security_connector.cc
View File

@ -27,6 +27,7 @@
#include "absl/strings/string_view.h"
#include <grpc/grpc.h>
#include <grpc/grpc_security_constants.h>
#include <grpc/support/alloc.h>
#include <grpc/support/log.h>
#include <grpc/support/string_util.h>

2
src/core/lib/security/security_connector/tls/tls_security_connector.h
View File

@ -26,8 +26,6 @@
#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
#include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
#define GRPC_TLS_TRANSPORT_SECURITY_TYPE "tls"
namespace grpc_core {
// Channel security connector using TLS as transport security protocol.

6
test/core/security/authorization_matchers_test.cc
View File

@ -19,6 +19,8 @@
#include <gmock/gmock.h>
#include <gtest/gtest.h>
#include <grpc/grpc_security_constants.h>
#include "src/core/lib/security/authorization/evaluate_args.h"
#include "src/core/lib/security/authorization/matchers.h"
#include "test/core/util/evaluate_args_test_util.h"
@ -341,7 +343,7 @@ TEST_F(AuthorizationMatchersTest,
TEST_F(AuthorizationMatchersTest, AuthenticatedMatcherSuccessfulUriSanMatches) {
args_.AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
GRPC_SSL_TRANSPORT_SECURITY_TYPE);
GRPC_TLS_TRANSPORT_SECURITY_TYPE);
args_.AddPropertyToAuthContext(GRPC_PEER_URI_PROPERTY_NAME,
"spiffe://foo.abc");
args_.AddPropertyToAuthContext(GRPC_PEER_URI_PROPERTY_NAME,
@ -357,7 +359,7 @@ TEST_F(AuthorizationMatchersTest, AuthenticatedMatcherSuccessfulUriSanMatches) {
TEST_F(AuthorizationMatchersTest, AuthenticatedMatcherFailedUriSanMatches) {
args_.AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
GRPC_SSL_TRANSPORT_SECURITY_TYPE);
GRPC_TLS_TRANSPORT_SECURITY_TYPE);
args_.AddPropertyToAuthContext(GRPC_PEER_URI_PROPERTY_NAME,
"spiffe://bar.abc");
EvaluateArgs args = args_.MakeEvaluateArgs();