From da43a613221b61864dbfc9d4e521ce2d6ecf9d7b Mon Sep 17 00:00:00 2001 From: AJ Heller Date: Mon, 1 Apr 2024 19:49:00 -0700 Subject: [PATCH] Automated rollback of commit 822311c0d94c22262606bc28fb034b1765a58115. PiperOrigin-RevId: 621025232 --- BUILD | 22 +- CMakeLists.txt | 33 +- build_autogenerated.yaml | 35 +- gRPC-C++.podspec | 4 +- include/grpcpp/security/credentials.h | 62 +-- include/grpcpp/security/server_credentials.h | 30 +- include/grpcpp/support/channel_arguments.h | 4 +- .../server/binder_server_credentials.cc | 9 +- src/cpp/client/call_credentials.cc | 39 -- src/cpp/client/channel_credentials.cc | 47 --- src/cpp/client/cronet_credentials.cc | 14 +- src/cpp/client/insecure_credentials.cc | 31 +- src/cpp/client/secure_credentials.cc | 380 ++++++++++-------- src/cpp/client/secure_credentials.h | 99 ++++- src/cpp/client/xds_credentials.cc | 23 +- src/cpp/common/channel_arguments.cc | 13 - src/cpp/common/secure_channel_arguments.cc | 41 ++ src/cpp/ext/chaotic_good.cc | 19 +- src/cpp/server/insecure_server_credentials.cc | 21 +- src/cpp/server/secure_server_credentials.cc | 13 +- src/cpp/server/secure_server_credentials.h | 23 +- src/cpp/server/server_credentials.cc | 39 -- src/cpp/server/xds_server_credentials.cc | 16 +- .../binder/end2end/binder_server_test.cc | 10 +- test/cpp/end2end/client_lb_end2end_test.cc | 5 +- test/cpp/end2end/end2end_test.cc | 25 +- test/cpp/end2end/grpclb_end2end_test.cc | 7 +- .../resource_quota_end2end_stress_test.cc | 6 +- test/cpp/end2end/rls_end2end_test.cc | 9 +- .../end2end/service_config_end2end_test.cc | 5 +- test/cpp/end2end/xds/xds_csds_end2end_test.cc | 5 +- test/cpp/end2end/xds/xds_end2end_test_lib.cc | 6 +- test/cpp/ext/BUILD | 2 +- test/cpp/interop/client_helper.cc | 8 +- test/cpp/util/BUILD | 1 - test/cpp/util/credentials.h | 41 -- tools/doxygen/Doxyfile.c++.internal | 4 +- 37 files changed, 589 insertions(+), 562 deletions(-) delete mode 100644 src/cpp/client/call_credentials.cc delete mode 100644 src/cpp/client/channel_credentials.cc create mode 100644 src/cpp/common/secure_channel_arguments.cc delete mode 100644 src/cpp/server/server_credentials.cc delete mode 100644 test/cpp/util/credentials.h diff --git a/BUILD b/BUILD index 3e778582fbc..33915ce87db 100644 --- a/BUILD +++ b/BUILD @@ -324,9 +324,7 @@ GRPC_PUBLIC_EVENT_ENGINE_HDRS = [ ] GRPCXX_SRCS = [ - "src/cpp/client/call_credentials.cc", "src/cpp/client/channel_cc.cc", - "src/cpp/client/channel_credentials.cc", "src/cpp/client/client_callback.cc", "src/cpp/client/client_context.cc", "src/cpp/client/client_interceptor.cc", @@ -352,7 +350,6 @@ GRPCXX_SRCS = [ "src/cpp/server/server_callback.cc", "src/cpp/server/server_cc.cc", "src/cpp/server/server_context.cc", - "src/cpp/server/server_credentials.cc", "src/cpp/server/server_posix.cc", "src/cpp/thread_manager/thread_manager.cc", "src/cpp/util/byte_buffer_cc.cc", @@ -941,7 +938,9 @@ grpc_cc_library( }, ], tags = ["nofixdeps"], - visibility = ["@grpc:public"], + visibility = [ + "@grpc:public", + ], deps = [ "grpc++_base", "//src/core:gpr_atm", @@ -1214,9 +1213,6 @@ grpc_cc_library( ], ) -# TODO(hork): restructure the grpc++_unsecure and grpc++ build targets in a -# similar way to how the grpc_unsecure and grpc targets were restructured in -# #25586 grpc_cc_library( name = "grpc++_unsecure", srcs = [ @@ -1224,26 +1220,18 @@ grpc_cc_library( "src/cpp/common/insecure_create_auth_context.cc", "src/cpp/server/insecure_server_credentials.cc", ], - external_deps = [ - "absl/strings", - "absl/synchronization", - ], language = "c++", - public_hdrs = GRPCXX_PUBLIC_HDRS, tags = [ "avoid_dep", "nofixdeps", ], visibility = ["@grpc:public"], deps = [ - "channel_arg_names", "gpr", "grpc++_base_unsecure", "grpc++_codegen_proto", "grpc_public_hdrs", - "grpc_security_base", "grpc_unsecure", - "//src/core:gpr_atm", "//src/core:grpc_insecure_credentials", ], ) @@ -2382,6 +2370,7 @@ grpc_cc_library( "src/cpp/client/secure_credentials.cc", "src/cpp/common/auth_property_iterator.cc", "src/cpp/common/secure_auth_context.cc", + "src/cpp/common/secure_channel_arguments.cc", "src/cpp/common/secure_create_auth_context.cc", "src/cpp/common/tls_certificate_provider.cc", "src/cpp/common/tls_certificate_verifier.cc", @@ -2505,7 +2494,6 @@ grpc_cc_library( "grpc_base", "grpc_health_upb", "grpc_public_hdrs", - "grpc_security_base", "grpc_service_config_impl", "grpc_trace", "grpc_unsecure", @@ -4712,7 +4700,7 @@ grpc_cc_library( visibility = ["@grpc:chaotic_good"], deps = [ "gpr", - "grpc++_base_unsecure", + "grpc++_public_hdrs", "grpc_public_hdrs", "//src/core:chaotic_good_connector", "//src/core:chaotic_good_server", diff --git a/CMakeLists.txt b/CMakeLists.txt index e47a5c4f0d4..95a26f71fc6 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -4041,9 +4041,7 @@ add_library(grpc++ src/core/ext/transport/binder/wire_format/transaction.cc src/core/ext/transport/binder/wire_format/wire_reader_impl.cc src/core/ext/transport/binder/wire_format/wire_writer.cc - src/cpp/client/call_credentials.cc src/cpp/client/channel_cc.cc - src/cpp/client/channel_credentials.cc src/cpp/client/client_callback.cc src/cpp/client/client_context.cc src/cpp/client/client_interceptor.cc @@ -4061,6 +4059,7 @@ add_library(grpc++ src/cpp/common/resource_quota_cc.cc src/cpp/common/rpc_method.cc src/cpp/common/secure_auth_context.cc + src/cpp/common/secure_channel_arguments.cc src/cpp/common/secure_create_auth_context.cc src/cpp/common/tls_certificate_provider.cc src/cpp/common/tls_certificate_verifier.cc @@ -4081,7 +4080,6 @@ add_library(grpc++ src/cpp/server/server_callback.cc src/cpp/server/server_cc.cc src/cpp/server/server_context.cc - src/cpp/server/server_credentials.cc src/cpp/server/server_posix.cc src/cpp/server/xds_server_builder.cc src/cpp/server/xds_server_credentials.cc @@ -4791,9 +4789,7 @@ target_link_libraries(grpc++_test_util endif() add_library(grpc++_unsecure - src/cpp/client/call_credentials.cc src/cpp/client/channel_cc.cc - src/cpp/client/channel_credentials.cc src/cpp/client/client_callback.cc src/cpp/client/client_context.cc src/cpp/client/client_interceptor.cc @@ -4823,7 +4819,6 @@ add_library(grpc++_unsecure src/cpp/server/server_callback.cc src/cpp/server/server_cc.cc src/cpp/server/server_context.cc - src/cpp/server/server_credentials.cc src/cpp/server/server_posix.cc src/cpp/thread_manager/thread_manager.cc src/cpp/util/byte_buffer_cc.cc @@ -8151,9 +8146,7 @@ add_executable(binder_transport_test src/core/ext/transport/binder/wire_format/transaction.cc src/core/ext/transport/binder/wire_format/wire_reader_impl.cc src/core/ext/transport/binder/wire_format/wire_writer.cc - src/cpp/client/call_credentials.cc src/cpp/client/channel_cc.cc - src/cpp/client/channel_credentials.cc src/cpp/client/client_callback.cc src/cpp/client/client_context.cc src/cpp/client/client_interceptor.cc @@ -8170,6 +8163,7 @@ add_executable(binder_transport_test src/cpp/common/resource_quota_cc.cc src/cpp/common/rpc_method.cc src/cpp/common/secure_auth_context.cc + src/cpp/common/secure_channel_arguments.cc src/cpp/common/secure_create_auth_context.cc src/cpp/common/tls_certificate_provider.cc src/cpp/common/tls_certificate_verifier.cc @@ -8190,7 +8184,6 @@ add_executable(binder_transport_test src/cpp/server/server_callback.cc src/cpp/server/server_cc.cc src/cpp/server/server_context.cc - src/cpp/server/server_credentials.cc src/cpp/server/server_posix.cc src/cpp/thread_manager/thread_manager.cc src/cpp/util/byte_buffer_cc.cc @@ -12665,9 +12658,7 @@ add_executable(endpoint_binder_pool_test src/core/ext/transport/binder/wire_format/transaction.cc src/core/ext/transport/binder/wire_format/wire_reader_impl.cc src/core/ext/transport/binder/wire_format/wire_writer.cc - src/cpp/client/call_credentials.cc src/cpp/client/channel_cc.cc - src/cpp/client/channel_credentials.cc src/cpp/client/client_callback.cc src/cpp/client/client_context.cc src/cpp/client/client_interceptor.cc @@ -12684,6 +12675,7 @@ add_executable(endpoint_binder_pool_test src/cpp/common/resource_quota_cc.cc src/cpp/common/rpc_method.cc src/cpp/common/secure_auth_context.cc + src/cpp/common/secure_channel_arguments.cc src/cpp/common/secure_create_auth_context.cc src/cpp/common/tls_certificate_provider.cc src/cpp/common/tls_certificate_verifier.cc @@ -12704,7 +12696,6 @@ add_executable(endpoint_binder_pool_test src/cpp/server/server_callback.cc src/cpp/server/server_cc.cc src/cpp/server/server_context.cc - src/cpp/server/server_credentials.cc src/cpp/server/server_posix.cc src/cpp/thread_manager/thread_manager.cc src/cpp/util/byte_buffer_cc.cc @@ -13522,9 +13513,7 @@ add_executable(fake_binder_test src/core/ext/transport/binder/wire_format/transaction.cc src/core/ext/transport/binder/wire_format/wire_reader_impl.cc src/core/ext/transport/binder/wire_format/wire_writer.cc - src/cpp/client/call_credentials.cc src/cpp/client/channel_cc.cc - src/cpp/client/channel_credentials.cc src/cpp/client/client_callback.cc src/cpp/client/client_context.cc src/cpp/client/client_interceptor.cc @@ -13541,6 +13530,7 @@ add_executable(fake_binder_test src/cpp/common/resource_quota_cc.cc src/cpp/common/rpc_method.cc src/cpp/common/secure_auth_context.cc + src/cpp/common/secure_channel_arguments.cc src/cpp/common/secure_create_auth_context.cc src/cpp/common/tls_certificate_provider.cc src/cpp/common/tls_certificate_verifier.cc @@ -13561,7 +13551,6 @@ add_executable(fake_binder_test src/cpp/server/server_callback.cc src/cpp/server/server_cc.cc src/cpp/server/server_context.cc - src/cpp/server/server_credentials.cc src/cpp/server/server_posix.cc src/cpp/thread_manager/thread_manager.cc src/cpp/util/byte_buffer_cc.cc @@ -30173,7 +30162,7 @@ target_include_directories(test_cpp_ext_chaotic_good_test target_link_libraries(test_cpp_ext_chaotic_good_test ${_gRPC_ALLTARGETS_LIBRARIES} gtest - grpc++_unsecure + grpc++ grpc_test_util ) @@ -31357,9 +31346,7 @@ add_executable(transport_stream_receiver_test src/core/ext/transport/binder/wire_format/transaction.cc src/core/ext/transport/binder/wire_format/wire_reader_impl.cc src/core/ext/transport/binder/wire_format/wire_writer.cc - src/cpp/client/call_credentials.cc src/cpp/client/channel_cc.cc - src/cpp/client/channel_credentials.cc src/cpp/client/client_callback.cc src/cpp/client/client_context.cc src/cpp/client/client_interceptor.cc @@ -31376,6 +31363,7 @@ add_executable(transport_stream_receiver_test src/cpp/common/resource_quota_cc.cc src/cpp/common/rpc_method.cc src/cpp/common/secure_auth_context.cc + src/cpp/common/secure_channel_arguments.cc src/cpp/common/secure_create_auth_context.cc src/cpp/common/tls_certificate_provider.cc src/cpp/common/tls_certificate_verifier.cc @@ -31396,7 +31384,6 @@ add_executable(transport_stream_receiver_test src/cpp/server/server_callback.cc src/cpp/server/server_cc.cc src/cpp/server/server_context.cc - src/cpp/server/server_credentials.cc src/cpp/server/server_posix.cc src/cpp/thread_manager/thread_manager.cc src/cpp/util/byte_buffer_cc.cc @@ -32191,9 +32178,7 @@ add_executable(wire_reader_test src/core/ext/transport/binder/wire_format/transaction.cc src/core/ext/transport/binder/wire_format/wire_reader_impl.cc src/core/ext/transport/binder/wire_format/wire_writer.cc - src/cpp/client/call_credentials.cc src/cpp/client/channel_cc.cc - src/cpp/client/channel_credentials.cc src/cpp/client/client_callback.cc src/cpp/client/client_context.cc src/cpp/client/client_interceptor.cc @@ -32210,6 +32195,7 @@ add_executable(wire_reader_test src/cpp/common/resource_quota_cc.cc src/cpp/common/rpc_method.cc src/cpp/common/secure_auth_context.cc + src/cpp/common/secure_channel_arguments.cc src/cpp/common/secure_create_auth_context.cc src/cpp/common/tls_certificate_provider.cc src/cpp/common/tls_certificate_verifier.cc @@ -32230,7 +32216,6 @@ add_executable(wire_reader_test src/cpp/server/server_callback.cc src/cpp/server/server_cc.cc src/cpp/server/server_context.cc - src/cpp/server/server_credentials.cc src/cpp/server/server_posix.cc src/cpp/thread_manager/thread_manager.cc src/cpp/util/byte_buffer_cc.cc @@ -32299,9 +32284,7 @@ add_executable(wire_writer_test src/core/ext/transport/binder/wire_format/transaction.cc src/core/ext/transport/binder/wire_format/wire_reader_impl.cc src/core/ext/transport/binder/wire_format/wire_writer.cc - src/cpp/client/call_credentials.cc src/cpp/client/channel_cc.cc - src/cpp/client/channel_credentials.cc src/cpp/client/client_callback.cc src/cpp/client/client_context.cc src/cpp/client/client_interceptor.cc @@ -32318,6 +32301,7 @@ add_executable(wire_writer_test src/cpp/common/resource_quota_cc.cc src/cpp/common/rpc_method.cc src/cpp/common/secure_auth_context.cc + src/cpp/common/secure_channel_arguments.cc src/cpp/common/secure_create_auth_context.cc src/cpp/common/tls_certificate_provider.cc src/cpp/common/tls_certificate_verifier.cc @@ -32338,7 +32322,6 @@ add_executable(wire_writer_test src/cpp/server/server_callback.cc src/cpp/server/server_cc.cc src/cpp/server/server_context.cc - src/cpp/server/server_credentials.cc src/cpp/server/server_posix.cc src/cpp/thread_manager/thread_manager.cc src/cpp/util/byte_buffer_cc.cc diff --git a/build_autogenerated.yaml b/build_autogenerated.yaml index 990de687205..130752f1638 100644 --- a/build_autogenerated.yaml +++ b/build_autogenerated.yaml @@ -3884,9 +3884,7 @@ libs: - src/core/ext/transport/binder/wire_format/transaction.cc - src/core/ext/transport/binder/wire_format/wire_reader_impl.cc - src/core/ext/transport/binder/wire_format/wire_writer.cc - - src/cpp/client/call_credentials.cc - src/cpp/client/channel_cc.cc - - src/cpp/client/channel_credentials.cc - src/cpp/client/client_callback.cc - src/cpp/client/client_context.cc - src/cpp/client/client_interceptor.cc @@ -3904,6 +3902,7 @@ libs: - src/cpp/common/resource_quota_cc.cc - src/cpp/common/rpc_method.cc - src/cpp/common/secure_auth_context.cc + - src/cpp/common/secure_channel_arguments.cc - src/cpp/common/secure_create_auth_context.cc - src/cpp/common/tls_certificate_provider.cc - src/cpp/common/tls_certificate_verifier.cc @@ -3924,7 +3923,6 @@ libs: - src/cpp/server/server_callback.cc - src/cpp/server/server_cc.cc - src/cpp/server/server_context.cc - - src/cpp/server/server_credentials.cc - src/cpp/server/server_posix.cc - src/cpp/server/xds_server_builder.cc - src/cpp/server/xds_server_credentials.cc @@ -4024,7 +4022,6 @@ libs: - test/core/util/tracer_util.h - test/cpp/util/byte_buffer_proto_helper.h - test/cpp/util/create_test_channel.h - - test/cpp/util/credentials.h - test/cpp/util/string_ref_helper.h - test/cpp/util/subprocess.h - test/cpp/util/test_credentials_provider.h @@ -4267,9 +4264,7 @@ libs: - src/cpp/server/thread_pool_interface.h - src/cpp/thread_manager/thread_manager.h src: - - src/cpp/client/call_credentials.cc - src/cpp/client/channel_cc.cc - - src/cpp/client/channel_credentials.cc - src/cpp/client/client_callback.cc - src/cpp/client/client_context.cc - src/cpp/client/client_interceptor.cc @@ -4299,7 +4294,6 @@ libs: - src/cpp/server/server_callback.cc - src/cpp/server/server_cc.cc - src/cpp/server/server_context.cc - - src/cpp/server/server_credentials.cc - src/cpp/server/server_posix.cc - src/cpp/thread_manager/thread_manager.cc - src/cpp/util/byte_buffer_cc.cc @@ -5281,7 +5275,6 @@ targets: - test/core/util/slice_splitter.h - test/core/util/tracer_util.h - test/cpp/util/byte_buffer_proto_helper.h - - test/cpp/util/credentials.h - test/cpp/util/string_ref_helper.h - test/cpp/util/subprocess.h src: @@ -6170,9 +6163,7 @@ targets: - src/core/ext/transport/binder/wire_format/transaction.cc - src/core/ext/transport/binder/wire_format/wire_reader_impl.cc - src/core/ext/transport/binder/wire_format/wire_writer.cc - - src/cpp/client/call_credentials.cc - src/cpp/client/channel_cc.cc - - src/cpp/client/channel_credentials.cc - src/cpp/client/client_callback.cc - src/cpp/client/client_context.cc - src/cpp/client/client_interceptor.cc @@ -6189,6 +6180,7 @@ targets: - src/cpp/common/resource_quota_cc.cc - src/cpp/common/rpc_method.cc - src/cpp/common/secure_auth_context.cc + - src/cpp/common/secure_channel_arguments.cc - src/cpp/common/secure_create_auth_context.cc - src/cpp/common/tls_certificate_provider.cc - src/cpp/common/tls_certificate_verifier.cc @@ -6209,7 +6201,6 @@ targets: - src/cpp/server/server_callback.cc - src/cpp/server/server_cc.cc - src/cpp/server/server_context.cc - - src/cpp/server/server_credentials.cc - src/cpp/server/server_posix.cc - src/cpp/thread_manager/thread_manager.cc - src/cpp/util/byte_buffer_cc.cc @@ -8857,9 +8848,7 @@ targets: - src/core/ext/transport/binder/wire_format/transaction.cc - src/core/ext/transport/binder/wire_format/wire_reader_impl.cc - src/core/ext/transport/binder/wire_format/wire_writer.cc - - src/cpp/client/call_credentials.cc - src/cpp/client/channel_cc.cc - - src/cpp/client/channel_credentials.cc - src/cpp/client/client_callback.cc - src/cpp/client/client_context.cc - src/cpp/client/client_interceptor.cc @@ -8876,6 +8865,7 @@ targets: - src/cpp/common/resource_quota_cc.cc - src/cpp/common/rpc_method.cc - src/cpp/common/secure_auth_context.cc + - src/cpp/common/secure_channel_arguments.cc - src/cpp/common/secure_create_auth_context.cc - src/cpp/common/tls_certificate_provider.cc - src/cpp/common/tls_certificate_verifier.cc @@ -8896,7 +8886,6 @@ targets: - src/cpp/server/server_callback.cc - src/cpp/server/server_cc.cc - src/cpp/server/server_context.cc - - src/cpp/server/server_credentials.cc - src/cpp/server/server_posix.cc - src/cpp/thread_manager/thread_manager.cc - src/cpp/util/byte_buffer_cc.cc @@ -9349,9 +9338,7 @@ targets: - src/core/ext/transport/binder/wire_format/transaction.cc - src/core/ext/transport/binder/wire_format/wire_reader_impl.cc - src/core/ext/transport/binder/wire_format/wire_writer.cc - - src/cpp/client/call_credentials.cc - src/cpp/client/channel_cc.cc - - src/cpp/client/channel_credentials.cc - src/cpp/client/client_callback.cc - src/cpp/client/client_context.cc - src/cpp/client/client_interceptor.cc @@ -9368,6 +9355,7 @@ targets: - src/cpp/common/resource_quota_cc.cc - src/cpp/common/rpc_method.cc - src/cpp/common/secure_auth_context.cc + - src/cpp/common/secure_channel_arguments.cc - src/cpp/common/secure_create_auth_context.cc - src/cpp/common/tls_certificate_provider.cc - src/cpp/common/tls_certificate_verifier.cc @@ -9388,7 +9376,6 @@ targets: - src/cpp/server/server_callback.cc - src/cpp/server/server_cc.cc - src/cpp/server/server_context.cc - - src/cpp/server/server_credentials.cc - src/cpp/server/server_posix.cc - src/cpp/thread_manager/thread_manager.cc - src/cpp/util/byte_buffer_cc.cc @@ -19025,7 +19012,7 @@ targets: - test/cpp/ext/chaotic_good_test.cc deps: - gtest - - grpc++_unsecure + - grpc++ - grpc_test_util - name: test_cpp_server_credentials_test gtest: true @@ -19541,9 +19528,7 @@ targets: - src/core/ext/transport/binder/wire_format/transaction.cc - src/core/ext/transport/binder/wire_format/wire_reader_impl.cc - src/core/ext/transport/binder/wire_format/wire_writer.cc - - src/cpp/client/call_credentials.cc - src/cpp/client/channel_cc.cc - - src/cpp/client/channel_credentials.cc - src/cpp/client/client_callback.cc - src/cpp/client/client_context.cc - src/cpp/client/client_interceptor.cc @@ -19560,6 +19545,7 @@ targets: - src/cpp/common/resource_quota_cc.cc - src/cpp/common/rpc_method.cc - src/cpp/common/secure_auth_context.cc + - src/cpp/common/secure_channel_arguments.cc - src/cpp/common/secure_create_auth_context.cc - src/cpp/common/tls_certificate_provider.cc - src/cpp/common/tls_certificate_verifier.cc @@ -19580,7 +19566,6 @@ targets: - src/cpp/server/server_callback.cc - src/cpp/server/server_cc.cc - src/cpp/server/server_context.cc - - src/cpp/server/server_credentials.cc - src/cpp/server/server_posix.cc - src/cpp/thread_manager/thread_manager.cc - src/cpp/util/byte_buffer_cc.cc @@ -19918,9 +19903,7 @@ targets: - src/core/ext/transport/binder/wire_format/transaction.cc - src/core/ext/transport/binder/wire_format/wire_reader_impl.cc - src/core/ext/transport/binder/wire_format/wire_writer.cc - - src/cpp/client/call_credentials.cc - src/cpp/client/channel_cc.cc - - src/cpp/client/channel_credentials.cc - src/cpp/client/client_callback.cc - src/cpp/client/client_context.cc - src/cpp/client/client_interceptor.cc @@ -19937,6 +19920,7 @@ targets: - src/cpp/common/resource_quota_cc.cc - src/cpp/common/rpc_method.cc - src/cpp/common/secure_auth_context.cc + - src/cpp/common/secure_channel_arguments.cc - src/cpp/common/secure_create_auth_context.cc - src/cpp/common/tls_certificate_provider.cc - src/cpp/common/tls_certificate_verifier.cc @@ -19957,7 +19941,6 @@ targets: - src/cpp/server/server_callback.cc - src/cpp/server/server_cc.cc - src/cpp/server/server_context.cc - - src/cpp/server/server_credentials.cc - src/cpp/server/server_posix.cc - src/cpp/thread_manager/thread_manager.cc - src/cpp/util/byte_buffer_cc.cc @@ -20027,9 +20010,7 @@ targets: - src/core/ext/transport/binder/wire_format/transaction.cc - src/core/ext/transport/binder/wire_format/wire_reader_impl.cc - src/core/ext/transport/binder/wire_format/wire_writer.cc - - src/cpp/client/call_credentials.cc - src/cpp/client/channel_cc.cc - - src/cpp/client/channel_credentials.cc - src/cpp/client/client_callback.cc - src/cpp/client/client_context.cc - src/cpp/client/client_interceptor.cc @@ -20046,6 +20027,7 @@ targets: - src/cpp/common/resource_quota_cc.cc - src/cpp/common/rpc_method.cc - src/cpp/common/secure_auth_context.cc + - src/cpp/common/secure_channel_arguments.cc - src/cpp/common/secure_create_auth_context.cc - src/cpp/common/tls_certificate_provider.cc - src/cpp/common/tls_certificate_verifier.cc @@ -20066,7 +20048,6 @@ targets: - src/cpp/server/server_callback.cc - src/cpp/server/server_cc.cc - src/cpp/server/server_context.cc - - src/cpp/server/server_credentials.cc - src/cpp/server/server_posix.cc - src/cpp/thread_manager/thread_manager.cc - src/cpp/util/byte_buffer_cc.cc diff --git a/gRPC-C++.podspec b/gRPC-C++.podspec index d04409492fd..4b51f0c3ffa 100644 --- a/gRPC-C++.podspec +++ b/gRPC-C++.podspec @@ -1345,9 +1345,7 @@ Pod::Spec.new do |s| 'src/core/tsi/transport_security.h', 'src/core/tsi/transport_security_grpc.h', 'src/core/tsi/transport_security_interface.h', - 'src/cpp/client/call_credentials.cc', 'src/cpp/client/channel_cc.cc', - 'src/cpp/client/channel_credentials.cc', 'src/cpp/client/client_callback.cc', 'src/cpp/client/client_context.cc', 'src/cpp/client/client_interceptor.cc', @@ -1369,6 +1367,7 @@ Pod::Spec.new do |s| 'src/cpp/common/rpc_method.cc', 'src/cpp/common/secure_auth_context.cc', 'src/cpp/common/secure_auth_context.h', + 'src/cpp/common/secure_channel_arguments.cc', 'src/cpp/common/secure_create_auth_context.cc', 'src/cpp/common/tls_certificate_provider.cc', 'src/cpp/common/tls_certificate_verifier.cc', @@ -1394,7 +1393,6 @@ Pod::Spec.new do |s| 'src/cpp/server/server_callback.cc', 'src/cpp/server/server_cc.cc', 'src/cpp/server/server_context.cc', - 'src/cpp/server/server_credentials.cc', 'src/cpp/server/server_posix.cc', 'src/cpp/server/thread_pool_interface.h', 'src/cpp/server/xds_server_builder.cc', diff --git a/include/grpcpp/security/credentials.h b/include/grpcpp/security/credentials.h index 402dd9edb23..cdbdbaf396e 100644 --- a/include/grpcpp/security/credentials.h +++ b/include/grpcpp/security/credentials.h @@ -37,10 +37,9 @@ struct grpc_call; namespace grpc { class CallCredentials; +class SecureCallCredentials; +class SecureChannelCredentials; class ChannelCredentials; -namespace testing { -std::string GetOauth2AccessToken(); -} std::shared_ptr CreateCustomChannel( const grpc::string& target, @@ -69,18 +68,26 @@ std::shared_ptr XdsCredentials( /// \see https://grpc.io/docs/guides/auth.html class ChannelCredentials : private grpc::internal::GrpcLibrary { public: - ~ChannelCredentials() override; - protected: - explicit ChannelCredentials(grpc_channel_credentials* creds); + friend std::shared_ptr CompositeChannelCredentials( + const std::shared_ptr& channel_creds, + const std::shared_ptr& call_creds); - grpc_channel_credentials* c_creds() { return c_creds_; } + // TODO(yashykt): We need this friend declaration mainly for access to + // AsSecureCredentials(). Once we are able to remove insecure builds from gRPC + // (and also internal dependencies on the indirect method of creating a + // channel through credentials), we would be able to remove this. + friend std::shared_ptr grpc::XdsCredentials( + const std::shared_ptr& fallback_creds); + + virtual SecureChannelCredentials* AsSecureCredentials() = 0; private: friend std::shared_ptr CreateCustomChannel( const grpc::string& target, const std::shared_ptr& creds, const grpc::ChannelArguments& args); + friend std::shared_ptr grpc::experimental::CreateCustomChannelWithInterceptors( const grpc::string& target, @@ -89,23 +96,24 @@ class ChannelCredentials : private grpc::internal::GrpcLibrary { std::vector> interceptor_creators); - friend std::shared_ptr CompositeChannelCredentials( - const std::shared_ptr& channel_creds, - const std::shared_ptr& call_creds); - friend class XdsChannelCredentialsImpl; virtual std::shared_ptr CreateChannelImpl( - const grpc::string& target, const ChannelArguments& args) { - return CreateChannelWithInterceptors(target, args, {}); - } + const grpc::string& target, const ChannelArguments& args) = 0; + // This function should have been a pure virtual function, but it is + // implemented as a virtual function so that it does not break API. virtual std::shared_ptr CreateChannelWithInterceptors( - const grpc::string& target, const ChannelArguments& args, + const grpc::string& /*target*/, const ChannelArguments& /*args*/, std::vector> - interceptor_creators); + /*interceptor_creators*/) { + return nullptr; + } - grpc_channel_credentials* const c_creds_; + // TODO(yashkt): This is a hack that is needed since InsecureCredentials can + // not use grpc_channel_credentials internally and should be removed after + // insecure builds are removed from gRPC. + virtual bool IsInsecure() const { return false; } }; /// A call credentials object encapsulates the state needed by a client to @@ -114,24 +122,22 @@ class ChannelCredentials : private grpc::internal::GrpcLibrary { /// \see https://grpc.io/docs/guides/auth.html class CallCredentials : private grpc::internal::GrpcLibrary { public: - ~CallCredentials() override; - /// Apply this instance's credentials to \a call. - bool ApplyToCall(grpc_call* call); - - grpc::string DebugString(); + virtual bool ApplyToCall(grpc_call* call) = 0; + virtual grpc::string DebugString() { + return "CallCredentials did not provide a debug string"; + } protected: - explicit CallCredentials(grpc_call_credentials* creds); - - private: friend std::shared_ptr CompositeChannelCredentials( const std::shared_ptr& channel_creds, const std::shared_ptr& call_creds); - friend class CompositeCallCredentialsImpl; - friend std::string grpc::testing::GetOauth2AccessToken(); - grpc_call_credentials* c_creds_ = nullptr; + friend std::shared_ptr CompositeCallCredentials( + const std::shared_ptr& creds1, + const std::shared_ptr& creds2); + + virtual SecureCallCredentials* AsSecureCredentials() = 0; }; /// Options used to build SslCredentials. diff --git a/include/grpcpp/security/server_credentials.h b/include/grpcpp/security/server_credentials.h index fe8c546190d..850dd2b4880 100644 --- a/include/grpcpp/security/server_credentials.h +++ b/include/grpcpp/security/server_credentials.h @@ -34,7 +34,7 @@ namespace grpc { class Server; class ServerCredentials; - +class SecureServerCredentials; /// Options to create ServerCredentials with SSL struct SslServerCredentialsOptions { /// \warning Deprecated @@ -68,22 +68,17 @@ std::shared_ptr XdsServerCredentials( /// Wrapper around \a grpc_server_credentials, a way to authenticate a server. class ServerCredentials : private grpc::internal::GrpcLibrary { public: - ~ServerCredentials() override; - /// This method is not thread-safe and has to be called before the server is /// started. The last call to this function wins. virtual void SetAuthMetadataProcessor( - const std::shared_ptr& processor); - - protected: - explicit ServerCredentials(grpc_server_credentials* creds); - - grpc_server_credentials* c_creds() const { return c_creds_; } + const std::shared_ptr& processor) = 0; private: - // Needed for access to AddPortToServer. friend class Server; - // Needed for access to c_creds_. + + // We need this friend declaration for access to Insecure() and + // AsSecureServerCredentials(). When these two functions are no longer + // necessary, this friend declaration can be removed too. friend std::shared_ptr grpc::XdsServerCredentials( const std::shared_ptr& fallback_credentials); @@ -92,9 +87,18 @@ class ServerCredentials : private grpc::internal::GrpcLibrary { /// /// \return bound port number on success, 0 on failure. // TODO(dgq): the "port" part seems to be a misnomer. - virtual int AddPortToServer(const std::string& addr, grpc_server* server); + virtual int AddPortToServer(const std::string& addr, grpc_server* server) = 0; - grpc_server_credentials* c_creds_; + // TODO(yashykt): This is a hack since InsecureServerCredentials() cannot use + // grpc_insecure_server_credentials_create() and should be removed after + // insecure builds are removed from gRPC. + virtual bool IsInsecure() const { return false; } + + // TODO(yashkt): This is a hack that should be removed once we remove insecure + // builds and the indirect method of adding ports to a server. + virtual SecureServerCredentials* AsSecureServerCredentials() { + return nullptr; + } }; /// Builds SSL ServerCredentials given SSL specific options diff --git a/include/grpcpp/support/channel_arguments.h b/include/grpcpp/support/channel_arguments.h index a149a6d72ba..bfda5a69760 100644 --- a/include/grpcpp/support/channel_arguments.h +++ b/include/grpcpp/support/channel_arguments.h @@ -28,7 +28,7 @@ #include namespace grpc { -class ChannelCredentials; +class SecureChannelCredentials; namespace testing { class ChannelArgumentsTest; } // namespace testing @@ -120,7 +120,7 @@ class ChannelArguments { } private: - friend class grpc::ChannelCredentials; + friend class grpc::SecureChannelCredentials; friend class grpc::testing::ChannelArgumentsTest; /// Default pointer argument operations. diff --git a/src/core/ext/transport/binder/server/binder_server_credentials.cc b/src/core/ext/transport/binder/server/binder_server_credentials.cc index 03bbe6229e1..56440f9d27e 100644 --- a/src/core/ext/transport/binder/server/binder_server_credentials.cc +++ b/src/core/ext/transport/binder/server/binder_server_credentials.cc @@ -32,7 +32,7 @@ class BinderServerCredentialsImpl final : public ServerCredentials { explicit BinderServerCredentialsImpl( std::shared_ptr security_policy) - : ServerCredentials(nullptr), security_policy_(security_policy) {} + : security_policy_(security_policy) {} #ifdef GPR_SUPPORT_BINDER_TRANSPORT int AddPortToServer(const std::string& addr, grpc_server* server) override { return grpc_core::AddBinderPort( @@ -50,7 +50,14 @@ class BinderServerCredentialsImpl final : public ServerCredentials { } #endif // GPR_SUPPORT_BINDER_TRANSPORT + void SetAuthMetadataProcessor( + const std::shared_ptr& /*processor*/) override { + grpc_core::Crash("unreachable"); + } + private: + bool IsInsecure() const override { return true; } + std::shared_ptr security_policy_; }; diff --git a/src/cpp/client/call_credentials.cc b/src/cpp/client/call_credentials.cc deleted file mode 100644 index 0badb7a7efc..00000000000 --- a/src/cpp/client/call_credentials.cc +++ /dev/null @@ -1,39 +0,0 @@ -// Copyright 2024 The gRPC Authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. -#include - -#include "absl/strings/str_cat.h" - -#include - -#include "src/core/lib/security/credentials/credentials.h" - -namespace grpc { - -CallCredentials::CallCredentials(grpc_call_credentials* c_creds) - : c_creds_(c_creds) { - GPR_ASSERT(c_creds != nullptr); -} - -CallCredentials::~CallCredentials() { grpc_call_credentials_release(c_creds_); } - -grpc::string CallCredentials::DebugString() { - return absl::StrCat("CallCredentials{", c_creds_->debug_string(), "}"); -} - -bool CallCredentials::ApplyToCall(grpc_call* call) { - return grpc_call_set_credentials(call, c_creds_) == GRPC_CALL_OK; -} - -} // namespace grpc diff --git a/src/cpp/client/channel_credentials.cc b/src/cpp/client/channel_credentials.cc deleted file mode 100644 index aa3deffa1d4..00000000000 --- a/src/cpp/client/channel_credentials.cc +++ /dev/null @@ -1,47 +0,0 @@ -// Copyright 2024 The gRPC Authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. -#include - -#include -#include -#include - -#include -#include -#include -#include - -namespace grpc { - -ChannelCredentials::ChannelCredentials(grpc_channel_credentials* c_creds) - : c_creds_(c_creds) {} - -ChannelCredentials::~ChannelCredentials() { - grpc_channel_credentials_release(c_creds_); -} - -std::shared_ptr ChannelCredentials::CreateChannelWithInterceptors( - const std::string& target, const ChannelArguments& args, - std::vector< - std::unique_ptr> - interceptor_creators) { - grpc_channel_args channel_args; - args.SetChannelArgs(&channel_args); - return grpc::CreateChannelInternal( - args.GetSslTargetNameOverride(), - grpc_channel_create(target.c_str(), c_creds_, &channel_args), - std::move(interceptor_creators)); -} - -} // namespace grpc diff --git a/src/cpp/client/cronet_credentials.cc b/src/cpp/client/cronet_credentials.cc index da133a62f9c..feba455278f 100644 --- a/src/cpp/client/cronet_credentials.cc +++ b/src/cpp/client/cronet_credentials.cc @@ -35,8 +35,17 @@ namespace grpc { class CronetChannelCredentialsImpl final : public ChannelCredentials { public: - explicit CronetChannelCredentialsImpl(void* engine) - : ChannelCredentials(nullptr), engine_(engine) {} + explicit CronetChannelCredentialsImpl(void* engine) : engine_(engine) {} + + std::shared_ptr CreateChannelImpl( + const string& target, const grpc::ChannelArguments& args) override { + return CreateChannelWithInterceptors( + target, args, + std::vector>()); + } + + SecureChannelCredentials* AsSecureCredentials() override { return nullptr; } private: std::shared_ptr CreateChannelWithInterceptors( @@ -52,7 +61,6 @@ class CronetChannelCredentialsImpl final : public ChannelCredentials { &channel_args, nullptr), std::move(interceptor_creators)); } - void* engine_; }; diff --git a/src/cpp/client/insecure_credentials.cc b/src/cpp/client/insecure_credentials.cc index 0f3d000bd29..3916f1ca0be 100644 --- a/src/cpp/client/insecure_credentials.cc +++ b/src/cpp/client/insecure_credentials.cc @@ -16,6 +16,9 @@ // // #include +#include +#include +#include #include #include @@ -24,14 +27,21 @@ #include #include +#include "src/cpp/client/create_channel_internal.h" + namespace grpc { + namespace { class InsecureChannelCredentialsImpl final : public ChannelCredentials { public: - InsecureChannelCredentialsImpl() - : ChannelCredentials(grpc_insecure_credentials_create()) {} + std::shared_ptr CreateChannelImpl( + const std::string& target, const ChannelArguments& args) override { + return CreateChannelWithInterceptors( + target, args, + std::vector>()); + } - private: std::shared_ptr CreateChannelWithInterceptors( const std::string& target, const ChannelArguments& args, std::vector channel = grpc::CreateChannelInternal( + "", grpc_channel_create(target.c_str(), creds, &channel_args), std::move(interceptor_creators)); + grpc_channel_credentials_release(creds); + return channel; } + + SecureChannelCredentials* AsSecureCredentials() override { return nullptr; } + + private: + bool IsInsecure() const override { return true; } }; } // namespace std::shared_ptr InsecureChannelCredentials() { - return std::make_shared(); + return std::shared_ptr( + new InsecureChannelCredentialsImpl()); } } // namespace grpc diff --git a/src/cpp/client/secure_credentials.cc b/src/cpp/client/secure_credentials.cc index 913378a2ee9..00b3ee266ab 100644 --- a/src/cpp/client/secure_credentials.cc +++ b/src/cpp/client/secure_credentials.cc @@ -20,8 +20,8 @@ #include +#include #include -#include #include #include "absl/status/status.h" @@ -30,7 +30,6 @@ #include "absl/types/optional.h" #include -#include #include #include #include @@ -48,44 +47,73 @@ #include "src/core/lib/event_engine/default_event_engine.h" #include "src/core/lib/gprpp/env.h" #include "src/core/lib/gprpp/load_file.h" +#include "src/core/lib/gprpp/status_helper.h" +#include "src/core/lib/iomgr/error.h" #include "src/core/lib/json/json.h" #include "src/core/lib/json/json_reader.h" #include "src/core/lib/security/util/json_util.h" +#include "src/cpp/client/create_channel_internal.h" #include "src/cpp/common/secure_auth_context.h" -#include "src/cpp/server/thread_pool_interface.h" namespace grpc { -namespace { -class WrappedCallCredentials : public CallCredentials { - public: - explicit WrappedCallCredentials(grpc_call_credentials* creds) - : CallCredentials(creds) {} -}; +SecureChannelCredentials::SecureChannelCredentials( + grpc_channel_credentials* c_creds) + : c_creds_(c_creds) {} -std::shared_ptr WrapCallCredentials( - grpc_call_credentials* creds) { - return creds == nullptr ? nullptr - : std::make_shared(creds); +std::shared_ptr SecureChannelCredentials::CreateChannelImpl( + const std::string& target, const ChannelArguments& args) { + return CreateChannelWithInterceptors( + target, args, + std::vector>()); } -class WrappedChannelCredentials final : public ChannelCredentials { - public: - explicit WrappedChannelCredentials(grpc_channel_credentials* c_creds) - : ChannelCredentials(c_creds) {} -}; +std::shared_ptr +SecureChannelCredentials::CreateChannelWithInterceptors( + const std::string& target, const ChannelArguments& args, + std::vector< + std::unique_ptr> + interceptor_creators) { + grpc_channel_args channel_args; + args.SetChannelArgs(&channel_args); + return grpc::CreateChannelInternal( + args.GetSslTargetNameOverride(), + grpc_channel_create(target.c_str(), c_creds_, &channel_args), + std::move(interceptor_creators)); +} -std::shared_ptr WrapChannelCredentials( +SecureCallCredentials::SecureCallCredentials(grpc_call_credentials* c_creds) + : c_creds_(c_creds) {} + +bool SecureCallCredentials::ApplyToCall(grpc_call* call) { + return grpc_call_set_credentials(call, c_creds_) == GRPC_CALL_OK; +} + +namespace internal { + +std::shared_ptr WrapChannelCredentials( grpc_channel_credentials* creds) { return creds == nullptr ? nullptr - : std::make_shared(creds); + : std::shared_ptr( + new SecureChannelCredentials(creds)); } +} // namespace internal + +namespace { + +std::shared_ptr WrapCallCredentials( + grpc_call_credentials* creds) { + return creds == nullptr ? nullptr + : std::shared_ptr( + new SecureCallCredentials(creds)); +} } // namespace std::shared_ptr GoogleDefaultCredentials() { grpc::internal::GrpcLibrary init; // To call grpc_init(). - return WrapChannelCredentials( + return internal::WrapChannelCredentials( grpc_google_default_credentials_create(nullptr)); } @@ -102,10 +130,12 @@ std::shared_ptr SslCredentials( grpc::internal::GrpcLibrary init; // To call grpc_init(). grpc_ssl_pem_key_cert_pair pem_key_cert_pair = { options.pem_private_key.c_str(), options.pem_cert_chain.c_str()}; - return WrapChannelCredentials(grpc_ssl_credentials_create( + + grpc_channel_credentials* c_creds = grpc_ssl_credentials_create( options.pem_root_certs.empty() ? nullptr : options.pem_root_certs.c_str(), options.pem_private_key.empty() ? nullptr : &pem_key_cert_pair, nullptr, - nullptr)); + nullptr); + return internal::WrapChannelCredentials(c_creds); } namespace experimental { @@ -229,6 +259,21 @@ std::shared_ptr StsCredentials( return WrapCallCredentials(grpc_sts_credentials_create(&opts, nullptr)); } +std::shared_ptr MetadataCredentialsFromPlugin( + std::unique_ptr plugin, + grpc_security_level min_security_level) { + grpc::internal::GrpcLibrary init; // To call grpc_init(). + const char* type = plugin->GetType(); + grpc::MetadataCredentialsPluginWrapper* wrapper = + new grpc::MetadataCredentialsPluginWrapper(std::move(plugin)); + grpc_metadata_credentials_plugin c_plugin = { + grpc::MetadataCredentialsPluginWrapper::GetMetadata, + grpc::MetadataCredentialsPluginWrapper::DebugString, + grpc::MetadataCredentialsPluginWrapper::Destroy, wrapper, type}; + return WrapCallCredentials(grpc_metadata_credentials_create_from_plugin( + c_plugin, min_security_level, nullptr)); +} + // Builds ALTS Credentials given ALTS specific options std::shared_ptr AltsCredentials( const AltsCredentialsOptions& options) { @@ -241,20 +286,20 @@ std::shared_ptr AltsCredentials( } grpc_channel_credentials* c_creds = grpc_alts_credentials_create(c_options); grpc_alts_credentials_options_destroy(c_options); - return WrapChannelCredentials(c_creds); + return internal::WrapChannelCredentials(c_creds); } // Builds Local Credentials std::shared_ptr LocalCredentials( grpc_local_connect_type type) { grpc::internal::GrpcLibrary init; // To call grpc_init(). - return WrapChannelCredentials(grpc_local_credentials_create(type)); + return internal::WrapChannelCredentials(grpc_local_credentials_create(type)); } // Builds TLS Credentials given TLS options. std::shared_ptr TlsCredentials( const TlsChannelCredentialsOptions& options) { - return WrapChannelCredentials( + return internal::WrapChannelCredentials( grpc_tls_credentials_create(options.c_credentials_options())); } @@ -316,24 +361,93 @@ std::shared_ptr CompositeChannelCredentials( // here. This is OK because the underlying C objects (i.e., channel_creds and // call_creds) into grpc_composite_credentials_create will see their refcounts // incremented. - return channel_creds->c_creds_ == nullptr - ? nullptr - : WrapChannelCredentials(grpc_composite_channel_credentials_create( - channel_creds->c_creds_, call_creds->c_creds_, nullptr)); + SecureChannelCredentials* s_channel_creds = + channel_creds->AsSecureCredentials(); + SecureCallCredentials* s_call_creds = call_creds->AsSecureCredentials(); + if (s_channel_creds && s_call_creds) { + return internal::WrapChannelCredentials( + grpc_composite_channel_credentials_create( + s_channel_creds->GetRawCreds(), s_call_creds->GetRawCreds(), + nullptr)); + } + return nullptr; } -class CompositeCallCredentialsImpl : public CallCredentials { - public: - CompositeCallCredentialsImpl(const std::shared_ptr& creds1, - const std::shared_ptr& creds2) - : CallCredentials(grpc_composite_call_credentials_create( - creds1->c_creds_, creds2->c_creds_, nullptr)) {} -}; - std::shared_ptr CompositeCallCredentials( const std::shared_ptr& creds1, const std::shared_ptr& creds2) { - return std::make_shared(creds1, creds2); + SecureCallCredentials* s_creds1 = creds1->AsSecureCredentials(); + SecureCallCredentials* s_creds2 = creds2->AsSecureCredentials(); + if (s_creds1 != nullptr && s_creds2 != nullptr) { + return WrapCallCredentials(grpc_composite_call_credentials_create( + s_creds1->GetRawCreds(), s_creds2->GetRawCreds(), nullptr)); + } + return nullptr; +} + +std::shared_ptr MetadataCredentialsFromPlugin( + std::unique_ptr plugin) { + grpc::internal::GrpcLibrary init; // To call grpc_init(). + const char* type = plugin->GetType(); + grpc::MetadataCredentialsPluginWrapper* wrapper = + new grpc::MetadataCredentialsPluginWrapper(std::move(plugin)); + grpc_metadata_credentials_plugin c_plugin = { + grpc::MetadataCredentialsPluginWrapper::GetMetadata, + grpc::MetadataCredentialsPluginWrapper::DebugString, + grpc::MetadataCredentialsPluginWrapper::Destroy, wrapper, type}; + return WrapCallCredentials(grpc_metadata_credentials_create_from_plugin( + c_plugin, GRPC_PRIVACY_AND_INTEGRITY, nullptr)); +} + +char* MetadataCredentialsPluginWrapper::DebugString(void* wrapper) { + GPR_ASSERT(wrapper); + MetadataCredentialsPluginWrapper* w = + static_cast(wrapper); + return gpr_strdup(w->plugin_->DebugString().c_str()); +} + +void MetadataCredentialsPluginWrapper::Destroy(void* wrapper) { + if (wrapper == nullptr) return; + grpc_event_engine::experimental::GetDefaultEventEngine()->Run([wrapper] { + grpc_core::ApplicationCallbackExecCtx callback_exec_ctx; + grpc_core::ExecCtx exec_ctx; + delete static_cast(wrapper); + }); +} + +int MetadataCredentialsPluginWrapper::GetMetadata( + void* wrapper, grpc_auth_metadata_context context, + grpc_credentials_plugin_metadata_cb cb, void* user_data, + grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX], + size_t* num_creds_md, grpc_status_code* status, + const char** error_details) { + GPR_ASSERT(wrapper); + MetadataCredentialsPluginWrapper* w = + static_cast(wrapper); + if (!w->plugin_) { + *num_creds_md = 0; + *status = GRPC_STATUS_OK; + *error_details = nullptr; + return 1; + } + if (w->plugin_->IsBlocking()) { + // The internals of context may be destroyed if GetMetadata is cancelled. + // Make a copy for InvokePlugin. + grpc_auth_metadata_context context_copy = grpc_auth_metadata_context(); + grpc_auth_metadata_context_copy(&context, &context_copy); + // Asynchronous return. + w->thread_pool_->Add([w, context_copy, cb, user_data]() mutable { + w->MetadataCredentialsPluginWrapper::InvokePlugin( + context_copy, cb, user_data, nullptr, nullptr, nullptr, nullptr); + grpc_auth_metadata_context_reset(&context_copy); + }); + return 0; + } else { + // Synchronous return. + w->InvokePlugin(context, cb, user_data, creds_md, num_creds_md, status, + error_details); + return 1; + } } namespace { @@ -345,147 +459,61 @@ void UnrefMetadata(const std::vector& md) { } } -class MetadataCredentialsPluginWrapper final : private internal::GrpcLibrary { - public: - static void Destroy(void* wrapper) { - if (wrapper == nullptr) return; - grpc_event_engine::experimental::GetDefaultEventEngine()->Run([wrapper] { - grpc_core::ApplicationCallbackExecCtx callback_exec_ctx; - grpc_core::ExecCtx exec_ctx; - delete static_cast(wrapper); - }); - } - - static int GetMetadata( - void* wrapper, grpc_auth_metadata_context context, - grpc_credentials_plugin_metadata_cb cb, void* user_data, - grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX], - size_t* num_creds_md, grpc_status_code* status, - const char** error_details) { - GPR_ASSERT(wrapper); - MetadataCredentialsPluginWrapper* w = - static_cast(wrapper); - if (!w->plugin_) { - *num_creds_md = 0; - *status = GRPC_STATUS_OK; - *error_details = nullptr; - return 1; - } - if (w->plugin_->IsBlocking()) { - // The internals of context may be destroyed if GetMetadata is cancelled. - // Make a copy for InvokePlugin. - grpc_auth_metadata_context context_copy = grpc_auth_metadata_context(); - grpc_auth_metadata_context_copy(&context, &context_copy); - // Asynchronous return. - // TODO(hork): replace with EventEngine::Run - w->thread_pool_->Add([w, context_copy, cb, user_data]() mutable { - w->MetadataCredentialsPluginWrapper::InvokePlugin( - context_copy, cb, user_data, nullptr, nullptr, nullptr, nullptr); - grpc_auth_metadata_context_reset(&context_copy); - }); - return 0; - } else { - // Synchronous return. - w->InvokePlugin(context, cb, user_data, creds_md, num_creds_md, status, - error_details); - return 1; - } - } - - static char* DebugString(void* wrapper) { - GPR_ASSERT(wrapper); - MetadataCredentialsPluginWrapper* w = - static_cast(wrapper); - return gpr_strdup(w->plugin_->DebugString().c_str()); - } - - explicit MetadataCredentialsPluginWrapper( - std::unique_ptr plugin) - : plugin_(std::move(plugin)) { - if (plugin_->IsBlocking()) { - thread_pool_.reset(CreateDefaultThreadPool()); - } - } - - private: - void InvokePlugin( - grpc_auth_metadata_context context, - grpc_credentials_plugin_metadata_cb cb, void* user_data, - grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX], - size_t* num_creds_md, grpc_status_code* status_code, - const char** error_details) { - std::multimap metadata; - - // const_cast is safe since the SecureAuthContext only inc/dec the refcount - // and the object is passed as a const ref to plugin_->GetMetadata. - SecureAuthContext cpp_channel_auth_context( - const_cast(context.channel_auth_context)); - - Status status = - plugin_->GetMetadata(context.service_url, context.method_name, - cpp_channel_auth_context, &metadata); - std::vector md; - for (auto& metadatum : metadata) { - grpc_metadata md_entry; - md_entry.key = SliceFromCopiedString(metadatum.first); - md_entry.value = SliceFromCopiedString(metadatum.second); - md.push_back(md_entry); - } - if (creds_md != nullptr) { - // Synchronous return. - if (md.size() > GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX) { - *num_creds_md = 0; - *status_code = GRPC_STATUS_INTERNAL; - *error_details = gpr_strdup( - "blocking plugin credentials returned too many metadata keys"); - UnrefMetadata(md); - } else { - for (const auto& elem : md) { - creds_md[*num_creds_md].key = elem.key; - creds_md[*num_creds_md].value = elem.value; - ++(*num_creds_md); - } - *status_code = static_cast(status.error_code()); - *error_details = - status.ok() ? nullptr : gpr_strdup(status.error_message().c_str()); - } - } else { - // Asynchronous return. - cb(user_data, md.empty() ? nullptr : &md[0], md.size(), - static_cast(status.error_code()), - status.error_message().c_str()); - UnrefMetadata(md); - } - } - - std::unique_ptr thread_pool_; - std::unique_ptr plugin_; -}; - } // namespace -namespace experimental { -std::shared_ptr MetadataCredentialsFromPlugin( - std::unique_ptr plugin, - grpc_security_level min_security_level) { - grpc::internal::GrpcLibrary init; // To call grpc_init(). - const char* type = plugin->GetType(); - MetadataCredentialsPluginWrapper* wrapper = - new MetadataCredentialsPluginWrapper(std::move(plugin)); - grpc_metadata_credentials_plugin c_plugin = { - MetadataCredentialsPluginWrapper::GetMetadata, - MetadataCredentialsPluginWrapper::DebugString, - MetadataCredentialsPluginWrapper::Destroy, wrapper, type}; - return WrapCallCredentials(grpc_metadata_credentials_create_from_plugin( - c_plugin, min_security_level, nullptr)); +void MetadataCredentialsPluginWrapper::InvokePlugin( + grpc_auth_metadata_context context, grpc_credentials_plugin_metadata_cb cb, + void* user_data, grpc_metadata creds_md[4], size_t* num_creds_md, + grpc_status_code* status_code, const char** error_details) { + std::multimap metadata; + + // const_cast is safe since the SecureAuthContext only inc/dec the refcount + // and the object is passed as a const ref to plugin_->GetMetadata. + SecureAuthContext cpp_channel_auth_context( + const_cast(context.channel_auth_context)); + + Status status = plugin_->GetMetadata(context.service_url, context.method_name, + cpp_channel_auth_context, &metadata); + std::vector md; + for (auto& metadatum : metadata) { + grpc_metadata md_entry; + md_entry.key = SliceFromCopiedString(metadatum.first); + md_entry.value = SliceFromCopiedString(metadatum.second); + md.push_back(md_entry); + } + if (creds_md != nullptr) { + // Synchronous return. + if (md.size() > GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX) { + *num_creds_md = 0; + *status_code = GRPC_STATUS_INTERNAL; + *error_details = gpr_strdup( + "blocking plugin credentials returned too many metadata keys"); + UnrefMetadata(md); + } else { + for (const auto& elem : md) { + creds_md[*num_creds_md].key = elem.key; + creds_md[*num_creds_md].value = elem.value; + ++(*num_creds_md); + } + *status_code = static_cast(status.error_code()); + *error_details = + status.ok() ? nullptr : gpr_strdup(status.error_message().c_str()); + } + } else { + // Asynchronous return. + cb(user_data, md.empty() ? nullptr : &md[0], md.size(), + static_cast(status.error_code()), + status.error_message().c_str()); + UnrefMetadata(md); + } } -} // namespace experimental - -std::shared_ptr MetadataCredentialsFromPlugin( - std::unique_ptr plugin) { - return experimental::MetadataCredentialsFromPlugin( - std::move(plugin), GRPC_PRIVACY_AND_INTEGRITY); +MetadataCredentialsPluginWrapper::MetadataCredentialsPluginWrapper( + std::unique_ptr plugin) + : plugin_(std::move(plugin)) { + if (plugin_->IsBlocking()) { + thread_pool_.reset(CreateDefaultThreadPool()); + } } } // namespace grpc diff --git a/src/cpp/client/secure_credentials.h b/src/cpp/client/secure_credentials.h index c2045beb22b..e969736f8b7 100644 --- a/src/cpp/client/secure_credentials.h +++ b/src/cpp/client/secure_credentials.h @@ -19,6 +19,14 @@ #ifndef GRPC_SRC_CPP_CLIENT_SECURE_CREDENTIALS_H #define GRPC_SRC_CPP_CLIENT_SECURE_CREDENTIALS_H +#include + +#include +#include +#include + +#include "absl/strings/str_cat.h" + #include #include #include @@ -27,9 +35,65 @@ #include #include #include +// TODO(yashykt): We shouldn't be including "src/core" headers. +#include "src/core/lib/iomgr/exec_ctx.h" +#include "src/core/lib/security/credentials/credentials.h" +#include "src/cpp/server/thread_pool_interface.h" namespace grpc { +class Channel; + +class SecureChannelCredentials final : public ChannelCredentials { + public: + explicit SecureChannelCredentials(grpc_channel_credentials* c_creds); + ~SecureChannelCredentials() override { + grpc_core::ExecCtx exec_ctx; + if (c_creds_ != nullptr) c_creds_->Unref(); + } + grpc_channel_credentials* GetRawCreds() { return c_creds_; } + + std::shared_ptr CreateChannelImpl( + const std::string& target, const ChannelArguments& args) override; + + SecureChannelCredentials* AsSecureCredentials() override { return this; } + + private: + std::shared_ptr CreateChannelWithInterceptors( + const std::string& target, const ChannelArguments& args, + std::vector> + interceptor_creators) override; + grpc_channel_credentials* const c_creds_; +}; + +class SecureCallCredentials final : public CallCredentials { + public: + explicit SecureCallCredentials(grpc_call_credentials* c_creds); + ~SecureCallCredentials() override { + grpc_core::ExecCtx exec_ctx; + if (c_creds_ != nullptr) c_creds_->Unref(); + } + grpc_call_credentials* GetRawCreds() { return c_creds_; } + + bool ApplyToCall(grpc_call* call) override; + SecureCallCredentials* AsSecureCredentials() override { return this; } + std::string DebugString() override { + return absl::StrCat("SecureCallCredentials{", + std::string(c_creds_->debug_string()), "}"); + } + + private: + grpc_call_credentials* const c_creds_; +}; + +namespace internal { + +std::shared_ptr WrapChannelCredentials( + grpc_channel_credentials* creds); + +} // namespace internal + namespace experimental { // Transforms C++ STS Credentials options to core options. The pointers of the @@ -40,22 +104,29 @@ grpc_sts_credentials_options StsCredentialsCppToCoreOptions( } // namespace experimental -/// ---- DEPRECATED ---- -/// This type is going away. Prefer creating a subclass of -/// grpc::ChannelCredentials. -class SecureChannelCredentials final : public grpc::ChannelCredentials { +class MetadataCredentialsPluginWrapper final : private internal::GrpcLibrary { public: - SecureChannelCredentials(grpc_channel_credentials* c_creds) - : ChannelCredentials(c_creds) {} -}; + static void Destroy(void* wrapper); + static int GetMetadata( + void* wrapper, grpc_auth_metadata_context context, + grpc_credentials_plugin_metadata_cb cb, void* user_data, + grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX], + size_t* num_creds_md, grpc_status_code* status, + const char** error_details); + static char* DebugString(void* wrapper); -/// ---- DEPRECATED ---- -/// This type is going away. Prefer creating a subclass of -/// grpc::CallCredentials. -class SecureCallCredentials final : public grpc::CallCredentials { - public: - SecureCallCredentials(grpc_call_credentials* c_creds) - : CallCredentials(c_creds) {} + explicit MetadataCredentialsPluginWrapper( + std::unique_ptr plugin); + + private: + void InvokePlugin( + grpc_auth_metadata_context context, + grpc_credentials_plugin_metadata_cb cb, void* user_data, + grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX], + size_t* num_creds_md, grpc_status_code* status_code, + const char** error_details); + std::unique_ptr thread_pool_; + std::unique_ptr plugin_; }; } // namespace grpc diff --git a/src/cpp/client/xds_credentials.cc b/src/cpp/client/xds_credentials.cc index 43a96108c8c..360d44c94b2 100644 --- a/src/cpp/client/xds_credentials.cc +++ b/src/cpp/client/xds_credentials.cc @@ -23,21 +23,24 @@ #include #include +#include "src/cpp/client/secure_credentials.h" + namespace grpc { -class XdsChannelCredentialsImpl final : public ChannelCredentials { - public: - explicit XdsChannelCredentialsImpl( - const std::shared_ptr& fallback_creds) - : ChannelCredentials( - grpc_xds_credentials_create(fallback_creds->c_creds_)) { - GPR_ASSERT(fallback_creds->c_creds_ != nullptr); - } -}; std::shared_ptr XdsCredentials( const std::shared_ptr& fallback_creds) { GPR_ASSERT(fallback_creds != nullptr); - return std::make_shared(fallback_creds); + if (fallback_creds->IsInsecure()) { + grpc_channel_credentials* insecure_creds = + grpc_insecure_credentials_create(); + auto xds_creds = internal::WrapChannelCredentials( + grpc_xds_credentials_create(insecure_creds)); + grpc_channel_credentials_release(insecure_creds); + return xds_creds; + } else { + return internal::WrapChannelCredentials(grpc_xds_credentials_create( + fallback_creds->AsSecureCredentials()->GetRawCreds())); + } } namespace experimental { diff --git a/src/cpp/common/channel_arguments.cc b/src/cpp/common/channel_arguments.cc index 60f334ce3cf..b975b2e4edd 100644 --- a/src/cpp/common/channel_arguments.cc +++ b/src/cpp/common/channel_arguments.cc @@ -217,17 +217,4 @@ void ChannelArguments::SetChannelArgs(grpc_channel_args* channel_args) const { } } -void ChannelArguments::SetSslTargetNameOverride(const std::string& name) { - SetString(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG, name); -} - -std::string ChannelArguments::GetSslTargetNameOverride() const { - for (unsigned int i = 0; i < args_.size(); i++) { - if (std::string(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG) == args_[i].key) { - return args_[i].value.string; - } - } - return ""; -} - } // namespace grpc diff --git a/src/cpp/common/secure_channel_arguments.cc b/src/cpp/common/secure_channel_arguments.cc new file mode 100644 index 00000000000..66e34506ffb --- /dev/null +++ b/src/cpp/common/secure_channel_arguments.cc @@ -0,0 +1,41 @@ +// +// +// Copyright 2015 gRPC authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +// + +#include +#include + +#include +#include +#include + +namespace grpc { + +void ChannelArguments::SetSslTargetNameOverride(const std::string& name) { + SetString(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG, name); +} + +std::string ChannelArguments::GetSslTargetNameOverride() const { + for (unsigned int i = 0; i < args_.size(); i++) { + if (std::string(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG) == args_[i].key) { + return args_[i].value.string; + } + } + return ""; +} + +} // namespace grpc diff --git a/src/cpp/ext/chaotic_good.cc b/src/cpp/ext/chaotic_good.cc index 7268598118e..4c9beac14e9 100644 --- a/src/cpp/ext/chaotic_good.cc +++ b/src/cpp/ext/chaotic_good.cc @@ -20,6 +20,7 @@ #include "src/core/ext/transport/chaotic_good/client/chaotic_good_connector.h" #include "src/core/ext/transport/chaotic_good/server/chaotic_good_server.h" +#include "src/core/lib/gprpp/crash.h" namespace grpc { @@ -28,9 +29,11 @@ namespace { class ChaoticGoodInsecureChannelCredentialsImpl final : public ChannelCredentials { public: - ChaoticGoodInsecureChannelCredentialsImpl() : ChannelCredentials(nullptr) {} + std::shared_ptr CreateChannelImpl( + const grpc::string& target, const grpc::ChannelArguments& args) override { + return CreateChannelWithInterceptors(target, args, {}); + } - private: std::shared_ptr CreateChannelWithInterceptors( const grpc::string& target, const grpc::ChannelArguments& args, std::vector< @@ -43,16 +46,24 @@ class ChaoticGoodInsecureChannelCredentialsImpl final std::move(interceptor_creators)); return channel; } + + SecureChannelCredentials* AsSecureCredentials() override { return nullptr; } + + private: + bool IsInsecure() const override { return true; } }; class ChaoticGoodInsecureServerCredentialsImpl final : public ServerCredentials { public: - ChaoticGoodInsecureServerCredentialsImpl() : ServerCredentials(nullptr) {} - int AddPortToServer(const std::string& addr, grpc_server* server) override { return grpc_server_add_chaotic_good_port(server, addr.c_str()); } + + void SetAuthMetadataProcessor( + const std::shared_ptr&) override { + grpc_core::Crash("Not supported on insecure server credentials"); + } }; } // namespace diff --git a/src/cpp/server/insecure_server_credentials.cc b/src/cpp/server/insecure_server_credentials.cc index ed14ac3def9..920fe3a1a55 100644 --- a/src/cpp/server/insecure_server_credentials.cc +++ b/src/cpp/server/insecure_server_credentials.cc @@ -17,6 +17,7 @@ // #include +#include #include #include @@ -28,13 +29,27 @@ namespace grpc { namespace { class InsecureServerCredentialsImpl final : public ServerCredentials { public: - InsecureServerCredentialsImpl() - : ServerCredentials(grpc_insecure_server_credentials_create()) {} + int AddPortToServer(const std::string& addr, grpc_server* server) override { + grpc_server_credentials* server_creds = + grpc_insecure_server_credentials_create(); + int result = grpc_server_add_http2_port(server, addr.c_str(), server_creds); + grpc_server_credentials_release(server_creds); + return result; + } + void SetAuthMetadataProcessor( + const std::shared_ptr& processor) override { + (void)processor; + GPR_ASSERT(0); // Should not be called on InsecureServerCredentials. + } + + private: + bool IsInsecure() const override { return true; } }; } // namespace std::shared_ptr InsecureServerCredentials() { - return std::make_shared(); + return std::shared_ptr( + new InsecureServerCredentialsImpl()); } } // namespace grpc diff --git a/src/cpp/server/secure_server_credentials.cc b/src/cpp/server/secure_server_credentials.cc index 4a68e8e33c2..fd198898d2f 100644 --- a/src/cpp/server/secure_server_credentials.cc +++ b/src/cpp/server/secure_server_credentials.cc @@ -18,6 +18,8 @@ #include "src/cpp/server/secure_server_credentials.h" +#include +#include #include #include #include @@ -49,7 +51,6 @@ void AuthMetadataProcessorAsyncWrapper::Process( return; } if (w->processor_->IsBlocking()) { - // TODO(hork): replace with EventEngine::Run w->thread_pool_->Add([w, context, md, num_md, cb, user_data] { w->AuthMetadataProcessorAsyncWrapper::InvokeProcessor(context, md, num_md, cb, user_data); @@ -96,15 +97,17 @@ void AuthMetadataProcessorAsyncWrapper::InvokeProcessor( status.error_message().c_str()); } -SecureServerCredentials::SecureServerCredentials(grpc_server_credentials* creds) - : ServerCredentials(creds) {} +int SecureServerCredentials::AddPortToServer(const std::string& addr, + grpc_server* server) { + return grpc_server_add_http2_port(server, addr.c_str(), creds_); +} void SecureServerCredentials::SetAuthMetadataProcessor( const std::shared_ptr& processor) { auto* wrapper = new grpc::AuthMetadataProcessorAsyncWrapper(processor); grpc_server_credentials_set_auth_metadata_processor( - c_creds(), {grpc::AuthMetadataProcessorAsyncWrapper::Process, - grpc::AuthMetadataProcessorAsyncWrapper::Destroy, wrapper}); + creds_, {grpc::AuthMetadataProcessorAsyncWrapper::Process, + grpc::AuthMetadataProcessorAsyncWrapper::Destroy, wrapper}); } std::shared_ptr SslServerCredentials( diff --git a/src/cpp/server/secure_server_credentials.h b/src/cpp/server/secure_server_credentials.h index 3167b257a4b..a62e51f2c24 100644 --- a/src/cpp/server/secure_server_credentials.h +++ b/src/cpp/server/secure_server_credentials.h @@ -19,7 +19,10 @@ #ifndef GRPC_SRC_CPP_SERVER_SECURE_SERVER_CREDENTIALS_H #define GRPC_SRC_CPP_SERVER_SECURE_SERVER_CREDENTIALS_H +#include + #include +#include #include #include @@ -29,6 +32,9 @@ #include "src/cpp/server/thread_pool_interface.h" namespace grpc { + +class SecureServerCredentials; + class AuthMetadataProcessorAsyncWrapper final { public: static void Destroy(void* wrapper); @@ -53,18 +59,25 @@ class AuthMetadataProcessorAsyncWrapper final { std::shared_ptr processor_; }; -// TODO(hork): Remove this class once we either (a) allow AuthMetadataProcessor -// to be used with any creds type as requested in #21589 or (b) find a way to -// remove AuthMetadataProcessor in favor of some new server-side interception -// API. class SecureServerCredentials final : public ServerCredentials { public: - explicit SecureServerCredentials(grpc_server_credentials* creds); + explicit SecureServerCredentials(grpc_server_credentials* creds) + : creds_(creds) {} + ~SecureServerCredentials() override { + grpc_server_credentials_release(creds_); + } + + int AddPortToServer(const std::string& addr, grpc_server* server) override; void SetAuthMetadataProcessor( const std::shared_ptr& processor) override; + grpc_server_credentials* c_creds() { return creds_; } + private: + SecureServerCredentials* AsSecureServerCredentials() override { return this; } + + grpc_server_credentials* creds_; std::unique_ptr processor_; }; diff --git a/src/cpp/server/server_credentials.cc b/src/cpp/server/server_credentials.cc deleted file mode 100644 index 68eece06c26..00000000000 --- a/src/cpp/server/server_credentials.cc +++ /dev/null @@ -1,39 +0,0 @@ -// Copyright 2024 The gRPC Authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. -#include - -#include - -#include "src/core/lib/gprpp/crash.h" - -namespace grpc { - -ServerCredentials::ServerCredentials(grpc_server_credentials* creds) - : c_creds_(creds) {} - -ServerCredentials::~ServerCredentials() { - grpc_server_credentials_release(c_creds_); -} - -void ServerCredentials::SetAuthMetadataProcessor( - const std::shared_ptr& /* processor */) { - grpc_core::Crash("Not Supported"); -} - -int ServerCredentials::AddPortToServer(const std::string& addr, - grpc_server* server) { - return grpc_server_add_http2_port(server, addr.c_str(), c_creds_); -} - -} // namespace grpc diff --git a/src/cpp/server/xds_server_credentials.cc b/src/cpp/server/xds_server_credentials.cc index 185fbb6ac6d..329052488c0 100644 --- a/src/cpp/server/xds_server_credentials.cc +++ b/src/cpp/server/xds_server_credentials.cc @@ -23,14 +23,24 @@ #include #include +#include "src/cpp/server/secure_server_credentials.h" + namespace grpc { std::shared_ptr XdsServerCredentials( const std::shared_ptr& fallback_credentials) { GPR_ASSERT(fallback_credentials != nullptr); - GPR_ASSERT(fallback_credentials->c_creds_ != nullptr); - return std::shared_ptr(new ServerCredentials( - grpc_xds_server_credentials_create(fallback_credentials->c_creds_))); + if (fallback_credentials->IsInsecure()) { + grpc_server_credentials* insecure_creds = + grpc_insecure_server_credentials_create(); + auto xds_creds = std::make_shared( + grpc_xds_server_credentials_create(insecure_creds)); + grpc_server_credentials_release(insecure_creds); + return xds_creds; + } + return std::make_shared( + grpc_xds_server_credentials_create( + fallback_credentials->AsSecureServerCredentials()->c_creds())); } namespace experimental { diff --git a/test/core/transport/binder/end2end/binder_server_test.cc b/test/core/transport/binder/end2end/binder_server_test.cc index 37bd246b592..5f226c84196 100644 --- a/test/core/transport/binder/end2end/binder_server_test.cc +++ b/test/core/transport/binder/end2end/binder_server_test.cc @@ -38,8 +38,6 @@ namespace { class BinderServerCredentialsImpl final : public ServerCredentials { public: - BinderServerCredentialsImpl() : ServerCredentials(nullptr) {} - int AddPortToServer(const std::string& addr, grpc_server* server) override { return grpc_core::AddBinderPort( addr, server, @@ -51,6 +49,14 @@ class BinderServerCredentialsImpl final : public ServerCredentials { std::make_shared< grpc::experimental::binder::UntrustedSecurityPolicy>()); } + + void SetAuthMetadataProcessor( + const std::shared_ptr& /*processor*/) override { + grpc_core::Crash("unreachable"); + } + + private: + bool IsInsecure() const override { return true; } }; } // namespace diff --git a/test/cpp/end2end/client_lb_end2end_test.cc b/test/cpp/end2end/client_lb_end2end_test.cc index 366c933dfea..d5ee65ad9d0 100644 --- a/test/cpp/end2end/client_lb_end2end_test.cc +++ b/test/cpp/end2end/client_lb_end2end_test.cc @@ -70,6 +70,7 @@ #include "src/core/resolver/fake/fake_resolver.h" #include "src/core/service_config/service_config.h" #include "src/core/service_config/service_config_impl.h" +#include "src/cpp/client/secure_credentials.h" #include "src/cpp/server/secure_server_credentials.h" #include "src/proto/grpc/health/v1/health.grpc.pb.h" #include "src/proto/grpc/testing/echo.grpc.pb.h" @@ -80,7 +81,6 @@ #include "test/core/util/test_lb_policies.h" #include "test/cpp/end2end/connection_attempt_injector.h" #include "test/cpp/end2end/test_service_impl.h" -#include "test/cpp/util/credentials.h" namespace grpc { namespace testing { @@ -262,7 +262,8 @@ class ClientLbEnd2endTest : public ::testing::Test { protected: ClientLbEnd2endTest() : server_host_("localhost"), - creds_(std::make_shared()) {} + creds_(new SecureChannelCredentials( + grpc_fake_transport_security_credentials_create())) {} void SetUp() override { grpc_init(); } diff --git a/test/cpp/end2end/end2end_test.cc b/test/cpp/end2end/end2end_test.cc index 5e3b44bfaf8..6647c331fd9 100644 --- a/test/cpp/end2end/end2end_test.cc +++ b/test/cpp/end2end/end2end_test.cc @@ -84,53 +84,52 @@ const char kTestCredsPluginErrorMsg[] = "Could not find plugin metadata."; const char kFakeToken[] = "fake_token"; const char kFakeSelector[] = "fake_selector"; const char kExpectedFakeCredsDebugString[] = - "CallCredentials{GoogleIAMCredentials{Token:present," + "SecureCallCredentials{GoogleIAMCredentials{Token:present," "AuthoritySelector:fake_selector}}"; const char kWrongToken[] = "wrong_token"; const char kWrongSelector[] = "wrong_selector"; const char kExpectedWrongCredsDebugString[] = - "CallCredentials{GoogleIAMCredentials{Token:present," + "SecureCallCredentials{GoogleIAMCredentials{Token:present," "AuthoritySelector:wrong_selector}}"; const char kFakeToken1[] = "fake_token1"; const char kFakeSelector1[] = "fake_selector1"; const char kExpectedFakeCreds1DebugString[] = - "CallCredentials{GoogleIAMCredentials{Token:present," + "SecureCallCredentials{GoogleIAMCredentials{Token:present," "AuthoritySelector:fake_selector1}}"; const char kFakeToken2[] = "fake_token2"; const char kFakeSelector2[] = "fake_selector2"; const char kExpectedFakeCreds2DebugString[] = - "CallCredentials{GoogleIAMCredentials{Token:present," + "SecureCallCredentials{GoogleIAMCredentials{Token:present," "AuthoritySelector:fake_selector2}}"; const char kExpectedAuthMetadataPluginKeyFailureCredsDebugString[] = - "CallCredentials{TestMetadataCredentials{key:TestPluginMetadata," + "SecureCallCredentials{TestMetadataCredentials{key:TestPluginMetadata," "value:Does not matter, will fail the key is invalid.}}"; const char kExpectedAuthMetadataPluginValueFailureCredsDebugString[] = - "CallCredentials{TestMetadataCredentials{key:test-plugin-metadata," + "SecureCallCredentials{TestMetadataCredentials{key:test-plugin-metadata," "value:With illegal \n value.}}"; const char kExpectedAuthMetadataPluginWithDeadlineCredsDebugString[] = - "CallCredentials{TestMetadataCredentials{key:meta_key,value:Does " - "not " + "SecureCallCredentials{TestMetadataCredentials{key:meta_key,value:Does not " "matter}}"; const char kExpectedNonBlockingAuthMetadataPluginFailureCredsDebugString[] = - "CallCredentials{TestMetadataCredentials{key:test-plugin-metadata," + "SecureCallCredentials{TestMetadataCredentials{key:test-plugin-metadata," "value:Does not matter, will fail anyway (see 3rd param)}}"; const char kExpectedNonBlockingAuthMetadataPluginAndProcessorSuccessCredsDebugString - [] = "CallCredentials{TestMetadataCredentials{key:test-plugin-" + [] = "SecureCallCredentials{TestMetadataCredentials{key:test-plugin-" "metadata,value:Dr Jekyll}}"; const char kExpectedNonBlockingAuthMetadataPluginAndProcessorFailureCredsDebugString - [] = "CallCredentials{TestMetadataCredentials{key:test-plugin-" + [] = "SecureCallCredentials{TestMetadataCredentials{key:test-plugin-" "metadata,value:Mr Hyde}}"; const char kExpectedBlockingAuthMetadataPluginFailureCredsDebugString[] = - "CallCredentials{TestMetadataCredentials{key:test-plugin-metadata," + "SecureCallCredentials{TestMetadataCredentials{key:test-plugin-metadata," "value:Does not matter, will fail anyway (see 3rd param)}}"; const char kExpectedCompositeCallCredsDebugString[] = - "CallCredentials{CompositeCallCredentials{TestMetadataCredentials{" + "SecureCallCredentials{CompositeCallCredentials{TestMetadataCredentials{" "key:call-creds-key1,value:call-creds-val1},TestMetadataCredentials{key:" "call-creds-key2,value:call-creds-val2}}}"; diff --git a/test/cpp/end2end/grpclb_end2end_test.cc b/test/cpp/end2end/grpclb_end2end_test.cc index 5f90950902e..6b95dbf569a 100644 --- a/test/cpp/end2end/grpclb_end2end_test.cc +++ b/test/cpp/end2end/grpclb_end2end_test.cc @@ -58,6 +58,7 @@ #include "src/core/resolver/endpoint_addresses.h" #include "src/core/resolver/fake/fake_resolver.h" #include "src/core/service_config/service_config_impl.h" +#include "src/cpp/client/secure_credentials.h" #include "src/cpp/server/secure_server_credentials.h" #include "src/proto/grpc/lb/v1/load_balancer.grpc.pb.h" #include "src/proto/grpc/testing/echo.grpc.pb.h" @@ -66,7 +67,6 @@ #include "test/core/util/test_config.h" #include "test/cpp/end2end/counted_service.h" #include "test/cpp/end2end/test_service_impl.h" -#include "test/cpp/util/credentials.h" #include "test/cpp/util/test_config.h" // TODO(dgq): Other scenarios in need of testing: @@ -605,8 +605,9 @@ class GrpclbEnd2endTest : public ::testing::Test { grpc_fake_transport_security_credentials_create(); grpc_call_credentials* call_creds = grpc_md_only_test_credentials_create( kCallCredsMdKey, kCallCredsMdValue); - auto creds = std::make_shared( - channel_creds, call_creds); + std::shared_ptr creds( + new SecureChannelCredentials(grpc_composite_channel_credentials_create( + channel_creds, call_creds, nullptr))); call_creds->Unref(); channel_creds->Unref(); channel_ = grpc::CreateCustomChannel( diff --git a/test/cpp/end2end/resource_quota_end2end_stress_test.cc b/test/cpp/end2end/resource_quota_end2end_stress_test.cc index 25231e5e9ce..19c9a9ad6c6 100644 --- a/test/cpp/end2end/resource_quota_end2end_stress_test.cc +++ b/test/cpp/end2end/resource_quota_end2end_stress_test.cc @@ -34,11 +34,11 @@ #include "src/core/lib/experiments/config.h" #include "src/core/lib/gprpp/notification.h" #include "src/core/lib/security/credentials/fake/fake_credentials.h" +#include "src/cpp/client/secure_credentials.h" #include "src/cpp/server/secure_server_credentials.h" #include "src/proto/grpc/testing/echo.grpc.pb.h" #include "test/core/util/port.h" #include "test/core/util/test_config.h" -#include "test/cpp/util/credentials.h" // IWYU pragma: no_include @@ -186,7 +186,9 @@ class End2EndConnectionQuotaTest : public ::testing::TestWithParam { return EchoTestService::NewStub(CreateCustomChannel( connect_address_, - std::make_shared(), args)); + std::make_shared( + grpc_fake_transport_security_credentials_create()), + args)); } void TestExceedingConnectionQuota() { diff --git a/test/cpp/end2end/rls_end2end_test.cc b/test/cpp/end2end/rls_end2end_test.cc index 07d9359b95b..ec48de736da 100644 --- a/test/cpp/end2end/rls_end2end_test.cc +++ b/test/cpp/end2end/rls_end2end_test.cc @@ -52,6 +52,7 @@ #include "src/core/load_balancing/rls/rls.h" #include "src/core/resolver/fake/fake_resolver.h" #include "src/core/service_config/service_config_impl.h" +#include "src/cpp/client/secure_credentials.h" #include "src/cpp/server/secure_server_credentials.h" #include "src/proto/grpc/lookup/v1/rls.grpc.pb.h" #include "src/proto/grpc/lookup/v1/rls.pb.h" @@ -64,7 +65,6 @@ #include "test/cpp/end2end/counted_service.h" #include "test/cpp/end2end/rls_server.h" #include "test/cpp/end2end/test_service_impl.h" -#include "test/cpp/util/credentials.h" #include "test/cpp/util/test_config.h" using ::grpc::lookup::v1::RouteLookupRequest; @@ -198,12 +198,13 @@ class RlsEnd2endTest : public ::testing::Test { grpc_fake_transport_security_credentials_create(); grpc_call_credentials* call_creds = grpc_md_only_test_credentials_create( kCallCredsMdKey, kCallCredsMdValue); - auto creds = std::make_shared( - channel_creds, call_creds); + auto creds = std::make_shared( + grpc_composite_channel_credentials_create(channel_creds, call_creds, + nullptr)); call_creds->Unref(); channel_creds->Unref(); target_uri_ = absl::StrCat("fake:///", kServerName); - channel_ = grpc::CreateCustomChannel(target_uri_, creds, args); + channel_ = grpc::CreateCustomChannel(target_uri_, std::move(creds), args); stub_ = grpc::testing::EchoTestService::NewStub(channel_); } diff --git a/test/cpp/end2end/service_config_end2end_test.cc b/test/cpp/end2end/service_config_end2end_test.cc index 966097015ac..5793117b08b 100644 --- a/test/cpp/end2end/service_config_end2end_test.cc +++ b/test/cpp/end2end/service_config_end2end_test.cc @@ -59,13 +59,13 @@ #include "src/core/resolver/endpoint_addresses.h" #include "src/core/resolver/fake/fake_resolver.h" #include "src/core/service_config/service_config_impl.h" +#include "src/cpp/client/secure_credentials.h" #include "src/cpp/server/secure_server_credentials.h" #include "src/proto/grpc/testing/echo.grpc.pb.h" #include "test/core/util/port.h" #include "test/core/util/resolve_localhost_ip46.h" #include "test/core/util/test_config.h" #include "test/cpp/end2end/test_service_impl.h" -#include "test/cpp/util/credentials.h" namespace grpc { namespace testing { @@ -119,7 +119,8 @@ class ServiceConfigEnd2endTest : public ::testing::Test { ServiceConfigEnd2endTest() : server_host_("localhost"), kRequestMessage_("Live long and prosper."), - creds_(std::make_shared()) {} + creds_(new SecureChannelCredentials( + grpc_fake_transport_security_credentials_create())) {} static void SetUpTestSuite() { // Make the backup poller poll very frequently in order to pick up diff --git a/test/cpp/end2end/xds/xds_csds_end2end_test.cc b/test/cpp/end2end/xds/xds_csds_end2end_test.cc index fb7cfd0cc06..2aa0c0645e4 100644 --- a/test/cpp/end2end/xds/xds_csds_end2end_test.cc +++ b/test/cpp/end2end/xds/xds_csds_end2end_test.cc @@ -29,6 +29,7 @@ #include "src/core/client_channel/backup_poller.h" #include "src/core/lib/config/config_vars.h" +#include "src/cpp/client/secure_credentials.h" #include "src/proto/grpc/testing/xds/v3/cluster.grpc.pb.h" #include "src/proto/grpc/testing/xds/v3/endpoint.grpc.pb.h" #include "src/proto/grpc/testing/xds/v3/http_connection_manager.grpc.pb.h" @@ -37,7 +38,6 @@ #include "test/core/util/resolve_localhost_ip46.h" #include "test/core/util/test_config.h" #include "test/cpp/end2end/xds/xds_end2end_test_lib.h" -#include "test/cpp/util/credentials.h" #ifndef DISABLED_XDS_PROTO_IN_CC @@ -246,7 +246,8 @@ class ClientStatusDiscoveryServiceTest : public XdsEnd2endTest { grpc_core::LocalIpAndPort(admin_server_thread_->port()); admin_channel_ = grpc::CreateChannel( admin_server_address, - std::make_shared()); + std::make_shared( + grpc_fake_transport_security_credentials_create())); csds_stub_ = envoy::service::status::v3::ClientStatusDiscoveryService::NewStub( admin_channel_); diff --git a/test/cpp/end2end/xds/xds_end2end_test_lib.cc b/test/cpp/end2end/xds/xds_end2end_test_lib.cc index db2c5a48f4a..121f92328fc 100644 --- a/test/cpp/end2end/xds/xds_end2end_test_lib.cc +++ b/test/cpp/end2end/xds/xds_end2end_test_lib.cc @@ -30,6 +30,7 @@ #include "absl/strings/str_cat.h" #include "absl/strings/str_format.h" #include "absl/strings/str_join.h" +#include "absl/strings/str_replace.h" #include "absl/strings/string_view.h" #include "absl/types/optional.h" @@ -41,10 +42,10 @@ #include "src/core/lib/gpr/tmpfile.h" #include "src/core/lib/gprpp/env.h" #include "src/core/lib/surface/server.h" +#include "src/cpp/client/secure_credentials.h" #include "src/proto/grpc/testing/xds/v3/router.grpc.pb.h" #include "test/core/util/resolve_localhost_ip46.h" #include "test/core/util/tls_utils.h" -#include "test/cpp/util/credentials.h" #include "test/cpp/util/tls_test_utils.h" namespace grpc { @@ -571,7 +572,8 @@ std::shared_ptr XdsEnd2endTest::CreateChannel( std::shared_ptr channel_creds = GetParam().use_xds_credentials() ? XdsCredentials(CreateTlsFallbackCredentials()) - : std::make_shared(); + : std::make_shared( + grpc_fake_transport_security_credentials_create()); return grpc::CreateCustomChannel(uri, channel_creds, *args); } diff --git a/test/cpp/ext/BUILD b/test/cpp/ext/BUILD index f25f3e27da6..ecdba7d8f7e 100644 --- a/test/cpp/ext/BUILD +++ b/test/cpp/ext/BUILD @@ -32,7 +32,7 @@ grpc_cc_test( language = "C++", tags = [], deps = [ - "//:grpc++_unsecure", + "//:grpc++", "//:grpcpp_chaotic_good", "//test/core/util:grpc_test_util", ], diff --git a/test/cpp/interop/client_helper.cc b/test/cpp/interop/client_helper.cc index c88fc495d42..374eb4085d3 100644 --- a/test/cpp/interop/client_helper.cc +++ b/test/cpp/interop/client_helper.cc @@ -34,6 +34,8 @@ #include #include +#include "src/core/lib/gprpp/crash.h" +#include "src/cpp/client/secure_credentials.h" #include "test/core/security/oauth2_utils.h" #include "test/cpp/util/create_test_channel.h" #include "test/cpp/util/test_credentials_provider.h" @@ -66,7 +68,11 @@ std::string GetServiceAccountJsonKey() { std::string GetOauth2AccessToken() { std::shared_ptr creds = GoogleComputeEngineCredentials(); - char* token = grpc_test_fetch_oauth2_token_with_credentials(creds->c_creds_); + SecureCallCredentials* secure_creds = + dynamic_cast(creds.get()); + GPR_ASSERT(secure_creds != nullptr); + grpc_call_credentials* c_creds = secure_creds->GetRawCreds(); + char* token = grpc_test_fetch_oauth2_token_with_credentials(c_creds); GPR_ASSERT(token != nullptr); gpr_log(GPR_INFO, "Get raw oauth2 access token: %s", token); std::string access_token(token + sizeof("Bearer ") - 1); diff --git a/test/cpp/util/BUILD b/test/cpp/util/BUILD index fe324d5fa78..e4b98dc1ec2 100644 --- a/test/cpp/util/BUILD +++ b/test/cpp/util/BUILD @@ -60,7 +60,6 @@ GRPCXX_TESTUTIL_SRCS = [ GRPCXX_TESTUTIL_HDRS = [ "byte_buffer_proto_helper.h", - "credentials.h", "string_ref_helper.h", "subprocess.h", ] diff --git a/test/cpp/util/credentials.h b/test/cpp/util/credentials.h deleted file mode 100644 index b57e293498a..00000000000 --- a/test/cpp/util/credentials.h +++ /dev/null @@ -1,41 +0,0 @@ -// Copyright 2024 The gRPC Authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. -#ifndef GRPC_TEST_CPP_UTIL_CREDENTIALS_H -#define GRPC_TEST_CPP_UTIL_CREDENTIALS_H - -#include - -#include "src/core/lib/security/credentials/fake/fake_credentials.h" - -namespace grpc { -namespace testing { - -class FakeTransportSecurityChannelCredentials : public ChannelCredentials { - public: - FakeTransportSecurityChannelCredentials() - : ChannelCredentials(grpc_fake_transport_security_credentials_create()) {} -}; - -class TestCompositeChannelCredentials : public ChannelCredentials { - public: - TestCompositeChannelCredentials(grpc_channel_credentials* channel_creds, - grpc_call_credentials* call_creds) - : ChannelCredentials(grpc_composite_channel_credentials_create( - channel_creds, call_creds, nullptr)) {} -}; - -} // namespace testing -} // namespace grpc - -#endif // GRPC_TEST_CPP_UTIL_CREDENTIALS_H diff --git a/tools/doxygen/Doxyfile.c++.internal b/tools/doxygen/Doxyfile.c++.internal index 405f81d1e3c..5a2eb6013b1 100644 --- a/tools/doxygen/Doxyfile.c++.internal +++ b/tools/doxygen/Doxyfile.c++.internal @@ -3011,9 +3011,7 @@ src/core/tsi/transport_security_grpc.cc \ src/core/tsi/transport_security_grpc.h \ src/core/tsi/transport_security_interface.h \ src/cpp/README.md \ -src/cpp/client/call_credentials.cc \ src/cpp/client/channel_cc.cc \ -src/cpp/client/channel_credentials.cc \ src/cpp/client/client_callback.cc \ src/cpp/client/client_context.cc \ src/cpp/client/client_interceptor.cc \ @@ -3035,6 +3033,7 @@ src/cpp/common/resource_quota_cc.cc \ src/cpp/common/rpc_method.cc \ src/cpp/common/secure_auth_context.cc \ src/cpp/common/secure_auth_context.h \ +src/cpp/common/secure_channel_arguments.cc \ src/cpp/common/secure_create_auth_context.cc \ src/cpp/common/tls_certificate_provider.cc \ src/cpp/common/tls_certificate_verifier.cc \ @@ -3060,7 +3059,6 @@ src/cpp/server/server_builder.cc \ src/cpp/server/server_callback.cc \ src/cpp/server/server_cc.cc \ src/cpp/server/server_context.cc \ -src/cpp/server/server_credentials.cc \ src/cpp/server/server_posix.cc \ src/cpp/server/thread_pool_interface.h \ src/cpp/server/xds_server_builder.cc \