1 /*
2 *
3 * Copyright 2015 gRPC authors.
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 */
18
19 #include <grpc/support/alloc.h>
20 #include <grpc/support/log.h>
21 #include <stdio.h>
22 #include <string.h>
23
24 #include "src/core/lib/channel/channel_args.h"
25 #include "src/core/lib/gpr/string.h"
26 #include "src/core/lib/gpr/tmpfile.h"
27 #include "src/core/lib/gprpp/host_port.h"
28 #include "src/core/lib/iomgr/load_file.h"
29 #include "src/core/lib/security/credentials/credentials.h"
30 #include "src/core/lib/security/credentials/ssl/ssl_credentials.h"
31 #include "src/core/lib/security/security_connector/ssl_utils_config.h"
32 #include "test/core/end2end/end2end_tests.h"
33 #include "test/core/util/port.h"
34 #include "test/core/util/test_config.h"
35
36 #define CA_CERT_PATH "src/core/tsi/test_creds/ca.pem"
37 #define SERVER_CERT_PATH "src/core/tsi/test_creds/server1.pem"
38 #define SERVER_KEY_PATH "src/core/tsi/test_creds/server1.key"
39
40 struct fullstack_secure_fixture_data {
41 std::string localaddr;
42 grpc_tls_version tls_version;
43 };
44
chttp2_create_fixture_secure_fullstack(grpc_channel_args *,grpc_channel_args *,grpc_tls_version tls_version)45 static grpc_end2end_test_fixture chttp2_create_fixture_secure_fullstack(
46 grpc_channel_args* /*client_args*/, grpc_channel_args* /*server_args*/,
47 grpc_tls_version tls_version) {
48 grpc_end2end_test_fixture f;
49 int port = grpc_pick_unused_port_or_die();
50 fullstack_secure_fixture_data* ffd = new fullstack_secure_fixture_data();
51 memset(&f, 0, sizeof(f));
52
53 ffd->localaddr = grpc_core::JoinHostPort("localhost", port);
54 ffd->tls_version = tls_version;
55
56 f.fixture_data = ffd;
57 f.cq = grpc_completion_queue_create_for_next(nullptr);
58 f.shutdown_cq = grpc_completion_queue_create_for_pluck(nullptr);
59
60 return f;
61 }
62
chttp2_create_fixture_secure_fullstack_tls1_2(grpc_channel_args * client_args,grpc_channel_args * server_args)63 static grpc_end2end_test_fixture chttp2_create_fixture_secure_fullstack_tls1_2(
64 grpc_channel_args* client_args, grpc_channel_args* server_args) {
65 return chttp2_create_fixture_secure_fullstack(client_args, server_args,
66 grpc_tls_version::TLS1_2);
67 }
68
chttp2_create_fixture_secure_fullstack_tls1_3(grpc_channel_args * client_args,grpc_channel_args * server_args)69 static grpc_end2end_test_fixture chttp2_create_fixture_secure_fullstack_tls1_3(
70 grpc_channel_args* client_args, grpc_channel_args* server_args) {
71 return chttp2_create_fixture_secure_fullstack(client_args, server_args,
72 grpc_tls_version::TLS1_3);
73 }
74
process_auth_failure(void * state,grpc_auth_context *,const grpc_metadata *,size_t,grpc_process_auth_metadata_done_cb cb,void * user_data)75 static void process_auth_failure(void* state, grpc_auth_context* /*ctx*/,
76 const grpc_metadata* /*md*/,
77 size_t /*md_count*/,
78 grpc_process_auth_metadata_done_cb cb,
79 void* user_data) {
80 GPR_ASSERT(state == nullptr);
81 cb(user_data, nullptr, 0, nullptr, 0, GRPC_STATUS_UNAUTHENTICATED, nullptr);
82 }
83
chttp2_init_client_secure_fullstack(grpc_end2end_test_fixture * f,grpc_channel_args * client_args,grpc_channel_credentials * creds)84 static void chttp2_init_client_secure_fullstack(
85 grpc_end2end_test_fixture* f, grpc_channel_args* client_args,
86 grpc_channel_credentials* creds) {
87 fullstack_secure_fixture_data* ffd =
88 static_cast<fullstack_secure_fixture_data*>(f->fixture_data);
89 f->client = grpc_secure_channel_create(creds, ffd->localaddr.c_str(),
90 client_args, nullptr);
91 GPR_ASSERT(f->client != nullptr);
92 grpc_channel_credentials_release(creds);
93 }
94
chttp2_init_server_secure_fullstack(grpc_end2end_test_fixture * f,grpc_channel_args * server_args,grpc_server_credentials * server_creds)95 static void chttp2_init_server_secure_fullstack(
96 grpc_end2end_test_fixture* f, grpc_channel_args* server_args,
97 grpc_server_credentials* server_creds) {
98 fullstack_secure_fixture_data* ffd =
99 static_cast<fullstack_secure_fixture_data*>(f->fixture_data);
100 if (f->server) {
101 grpc_server_destroy(f->server);
102 }
103 f->server = grpc_server_create(server_args, nullptr);
104 grpc_server_register_completion_queue(f->server, f->cq, nullptr);
105 GPR_ASSERT(grpc_server_add_secure_http2_port(
106 f->server, ffd->localaddr.c_str(), server_creds));
107 grpc_server_credentials_release(server_creds);
108 grpc_server_start(f->server);
109 }
110
chttp2_tear_down_secure_fullstack(grpc_end2end_test_fixture * f)111 void chttp2_tear_down_secure_fullstack(grpc_end2end_test_fixture* f) {
112 fullstack_secure_fixture_data* ffd =
113 static_cast<fullstack_secure_fixture_data*>(f->fixture_data);
114 delete ffd;
115 }
116
chttp2_init_client_simple_ssl_secure_fullstack(grpc_end2end_test_fixture * f,grpc_channel_args * client_args)117 static void chttp2_init_client_simple_ssl_secure_fullstack(
118 grpc_end2end_test_fixture* f, grpc_channel_args* client_args) {
119 grpc_channel_credentials* ssl_creds =
120 grpc_ssl_credentials_create(nullptr, nullptr, nullptr, nullptr);
121 if (f != nullptr && ssl_creds != nullptr) {
122 // Set the min and max TLS version.
123 grpc_ssl_credentials* creds =
124 reinterpret_cast<grpc_ssl_credentials*>(ssl_creds);
125 fullstack_secure_fixture_data* ffd =
126 static_cast<fullstack_secure_fixture_data*>(f->fixture_data);
127 creds->set_min_tls_version(ffd->tls_version);
128 creds->set_max_tls_version(ffd->tls_version);
129 }
130 grpc_arg ssl_name_override = {
131 GRPC_ARG_STRING,
132 const_cast<char*>(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG),
133 {const_cast<char*>("foo.test.google.fr")}};
134 grpc_channel_args* new_client_args =
135 grpc_channel_args_copy_and_add(client_args, &ssl_name_override, 1);
136 chttp2_init_client_secure_fullstack(f, new_client_args, ssl_creds);
137 grpc_channel_args_destroy(new_client_args);
138 }
139
fail_server_auth_check(grpc_channel_args * server_args)140 static int fail_server_auth_check(grpc_channel_args* server_args) {
141 size_t i;
142 if (server_args == nullptr) return 0;
143 for (i = 0; i < server_args->num_args; i++) {
144 if (strcmp(server_args->args[i].key, FAIL_AUTH_CHECK_SERVER_ARG_NAME) ==
145 0) {
146 return 1;
147 }
148 }
149 return 0;
150 }
151
chttp2_init_server_simple_ssl_secure_fullstack(grpc_end2end_test_fixture * f,grpc_channel_args * server_args)152 static void chttp2_init_server_simple_ssl_secure_fullstack(
153 grpc_end2end_test_fixture* f, grpc_channel_args* server_args) {
154 grpc_slice cert_slice, key_slice;
155 GPR_ASSERT(GRPC_LOG_IF_ERROR(
156 "load_file", grpc_load_file(SERVER_CERT_PATH, 1, &cert_slice)));
157 GPR_ASSERT(GRPC_LOG_IF_ERROR("load_file",
158 grpc_load_file(SERVER_KEY_PATH, 1, &key_slice)));
159 const char* server_cert =
160 reinterpret_cast<const char*> GRPC_SLICE_START_PTR(cert_slice);
161 const char* server_key =
162 reinterpret_cast<const char*> GRPC_SLICE_START_PTR(key_slice);
163 grpc_ssl_pem_key_cert_pair pem_key_cert_pair = {server_key, server_cert};
164 grpc_server_credentials* ssl_creds = grpc_ssl_server_credentials_create(
165 nullptr, &pem_key_cert_pair, 1, 0, nullptr);
166 if (f != nullptr && ssl_creds != nullptr) {
167 // Set the min and max TLS version.
168 grpc_ssl_server_credentials* creds =
169 reinterpret_cast<grpc_ssl_server_credentials*>(ssl_creds);
170 fullstack_secure_fixture_data* ffd =
171 static_cast<fullstack_secure_fixture_data*>(f->fixture_data);
172 creds->set_min_tls_version(ffd->tls_version);
173 creds->set_max_tls_version(ffd->tls_version);
174 }
175 grpc_slice_unref(cert_slice);
176 grpc_slice_unref(key_slice);
177 if (fail_server_auth_check(server_args)) {
178 grpc_auth_metadata_processor processor = {process_auth_failure, nullptr,
179 nullptr};
180 grpc_server_credentials_set_auth_metadata_processor(ssl_creds, processor);
181 }
182 chttp2_init_server_secure_fullstack(f, server_args, ssl_creds);
183 }
184
185 /* All test configurations */
186
187 static grpc_end2end_test_config configs[] = {
188 {"chttp2/simple_ssl_fullstack_tls1_2",
189 FEATURE_MASK_SUPPORTS_DELAYED_CONNECTION |
190 FEATURE_MASK_SUPPORTS_PER_CALL_CREDENTIALS |
191 FEATURE_MASK_SUPPORTS_CLIENT_CHANNEL |
192 FEATURE_MASK_SUPPORTS_AUTHORITY_HEADER,
193 "foo.test.google.fr", chttp2_create_fixture_secure_fullstack_tls1_2,
194 chttp2_init_client_simple_ssl_secure_fullstack,
195 chttp2_init_server_simple_ssl_secure_fullstack,
196 chttp2_tear_down_secure_fullstack},
197 {"chttp2/simple_ssl_fullstack_tls1_3",
198 FEATURE_MASK_SUPPORTS_DELAYED_CONNECTION |
199 FEATURE_MASK_SUPPORTS_PER_CALL_CREDENTIALS |
200 FEATURE_MASK_SUPPORTS_CLIENT_CHANNEL |
201 FEATURE_MASK_SUPPORTS_AUTHORITY_HEADER |
202 FEATURE_MASK_DOES_NOT_SUPPORT_CLIENT_HANDSHAKE_COMPLETE_FIRST,
203 "foo.test.google.fr", chttp2_create_fixture_secure_fullstack_tls1_3,
204 chttp2_init_client_simple_ssl_secure_fullstack,
205 chttp2_init_server_simple_ssl_secure_fullstack,
206 chttp2_tear_down_secure_fullstack},
207 };
208
main(int argc,char ** argv)209 int main(int argc, char** argv) {
210 size_t i;
211 grpc::testing::TestEnvironment env(argc, argv);
212 grpc_end2end_tests_pre_init();
213 GPR_GLOBAL_CONFIG_SET(grpc_default_ssl_roots_file_path, CA_CERT_PATH);
214
215 grpc_init();
216
217 for (i = 0; i < sizeof(configs) / sizeof(*configs); i++) {
218 grpc_end2end_tests(argc, argv, configs[i]);
219 }
220
221 grpc_shutdown();
222 return 0;
223 }
224