1 /*
2 *
3 * Copyright 2015 gRPC authors.
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 */
18
19 #include <functional>
20 #include <map>
21 #include <memory>
22
23 #include <grpcpp/impl/codegen/slice.h>
24 #include <grpcpp/impl/grpc_library.h>
25 #include <grpcpp/security/auth_metadata_processor.h>
26
27 #include "src/cpp/common/secure_auth_context.h"
28 #include "src/cpp/server/secure_server_credentials.h"
29
30 namespace grpc {
31
Destroy(void * wrapper)32 void AuthMetadataProcessorAyncWrapper::Destroy(void* wrapper) {
33 auto* w = static_cast<AuthMetadataProcessorAyncWrapper*>(wrapper);
34 delete w;
35 }
36
Process(void * wrapper,grpc_auth_context * context,const grpc_metadata * md,size_t num_md,grpc_process_auth_metadata_done_cb cb,void * user_data)37 void AuthMetadataProcessorAyncWrapper::Process(
38 void* wrapper, grpc_auth_context* context, const grpc_metadata* md,
39 size_t num_md, grpc_process_auth_metadata_done_cb cb, void* user_data) {
40 auto* w = static_cast<AuthMetadataProcessorAyncWrapper*>(wrapper);
41 if (!w->processor_) {
42 // Early exit.
43 cb(user_data, nullptr, 0, nullptr, 0, GRPC_STATUS_OK, nullptr);
44 return;
45 }
46 if (w->processor_->IsBlocking()) {
47 w->thread_pool_->Add([w, context, md, num_md, cb, user_data] {
48 w->AuthMetadataProcessorAyncWrapper::InvokeProcessor(context, md, num_md,
49 cb, user_data);
50 });
51 } else {
52 // invoke directly.
53 w->InvokeProcessor(context, md, num_md, cb, user_data);
54 }
55 }
56
InvokeProcessor(grpc_auth_context * ctx,const grpc_metadata * md,size_t num_md,grpc_process_auth_metadata_done_cb cb,void * user_data)57 void AuthMetadataProcessorAyncWrapper::InvokeProcessor(
58 grpc_auth_context* ctx, const grpc_metadata* md, size_t num_md,
59 grpc_process_auth_metadata_done_cb cb, void* user_data) {
60 AuthMetadataProcessor::InputMetadata metadata;
61 for (size_t i = 0; i < num_md; i++) {
62 metadata.insert(std::make_pair(StringRefFromSlice(&md[i].key),
63 StringRefFromSlice(&md[i].value)));
64 }
65 SecureAuthContext context(ctx);
66 AuthMetadataProcessor::OutputMetadata consumed_metadata;
67 AuthMetadataProcessor::OutputMetadata response_metadata;
68
69 Status status = processor_->Process(metadata, &context, &consumed_metadata,
70 &response_metadata);
71
72 std::vector<grpc_metadata> consumed_md;
73 for (const auto& consumed : consumed_metadata) {
74 grpc_metadata md_entry;
75 md_entry.key = SliceReferencingString(consumed.first);
76 md_entry.value = SliceReferencingString(consumed.second);
77 md_entry.flags = 0;
78 consumed_md.push_back(md_entry);
79 }
80 std::vector<grpc_metadata> response_md;
81 for (const auto& response : response_metadata) {
82 grpc_metadata md_entry;
83 md_entry.key = SliceReferencingString(response.first);
84 md_entry.value = SliceReferencingString(response.second);
85 md_entry.flags = 0;
86 response_md.push_back(md_entry);
87 }
88 auto consumed_md_data = consumed_md.empty() ? nullptr : &consumed_md[0];
89 auto response_md_data = response_md.empty() ? nullptr : &response_md[0];
90 cb(user_data, consumed_md_data, consumed_md.size(), response_md_data,
91 response_md.size(), static_cast<grpc_status_code>(status.error_code()),
92 status.error_message().c_str());
93 }
94
95 } // namespace grpc
96
97 namespace grpc_impl {
98
AddPortToServer(const std::string & addr,grpc_server * server)99 int SecureServerCredentials::AddPortToServer(const std::string& addr,
100 grpc_server* server) {
101 return grpc_server_add_secure_http2_port(server, addr.c_str(), creds_);
102 }
103
SetAuthMetadataProcessor(const std::shared_ptr<grpc::AuthMetadataProcessor> & processor)104 void SecureServerCredentials::SetAuthMetadataProcessor(
105 const std::shared_ptr<grpc::AuthMetadataProcessor>& processor) {
106 auto* wrapper = new grpc::AuthMetadataProcessorAyncWrapper(processor);
107 grpc_server_credentials_set_auth_metadata_processor(
108 creds_, {grpc::AuthMetadataProcessorAyncWrapper::Process,
109 grpc::AuthMetadataProcessorAyncWrapper::Destroy, wrapper});
110 }
111
SslServerCredentials(const grpc::SslServerCredentialsOptions & options)112 std::shared_ptr<ServerCredentials> SslServerCredentials(
113 const grpc::SslServerCredentialsOptions& options) {
114 std::vector<grpc_ssl_pem_key_cert_pair> pem_key_cert_pairs;
115 for (const auto& key_cert_pair : options.pem_key_cert_pairs) {
116 grpc_ssl_pem_key_cert_pair p = {key_cert_pair.private_key.c_str(),
117 key_cert_pair.cert_chain.c_str()};
118 pem_key_cert_pairs.push_back(p);
119 }
120 grpc_server_credentials* c_creds = grpc_ssl_server_credentials_create_ex(
121 options.pem_root_certs.empty() ? nullptr : options.pem_root_certs.c_str(),
122 pem_key_cert_pairs.empty() ? nullptr : &pem_key_cert_pairs[0],
123 pem_key_cert_pairs.size(),
124 options.force_client_auth
125 ? GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY
126 : options.client_certificate_request,
127 nullptr);
128 return std::shared_ptr<ServerCredentials>(
129 new SecureServerCredentials(c_creds));
130 }
131
132 namespace experimental {
133
AltsServerCredentials(const AltsServerCredentialsOptions &)134 std::shared_ptr<ServerCredentials> AltsServerCredentials(
135 const AltsServerCredentialsOptions& /* options */) {
136 grpc_alts_credentials_options* c_options =
137 grpc_alts_credentials_server_options_create();
138 grpc_server_credentials* c_creds =
139 grpc_alts_server_credentials_create(c_options);
140 grpc_alts_credentials_options_destroy(c_options);
141 return std::shared_ptr<ServerCredentials>(
142 new SecureServerCredentials(c_creds));
143 }
144
LocalServerCredentials(grpc_local_connect_type type)145 std::shared_ptr<ServerCredentials> LocalServerCredentials(
146 grpc_local_connect_type type) {
147 return std::shared_ptr<ServerCredentials>(
148 new SecureServerCredentials(grpc_local_server_credentials_create(type)));
149 }
150
TlsServerCredentials(const TlsCredentialsOptions & options)151 std::shared_ptr<ServerCredentials> TlsServerCredentials(
152 const TlsCredentialsOptions& options) {
153 grpc::GrpcLibraryCodegen init;
154 return std::shared_ptr<ServerCredentials>(new SecureServerCredentials(
155 grpc_tls_server_credentials_create(options.c_credentials_options())));
156 }
157
158 } // namespace experimental
159 } // namespace grpc_impl
160