1 /*
2 *
3 * Copyright 2015 gRPC authors.
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 */
18
19 #include "test/core/end2end/end2end_tests.h"
20
21 #include <stdio.h>
22 #include <string.h>
23
24 #include <grpc/byte_buffer.h>
25 #include <grpc/grpc_security.h>
26 #include <grpc/support/alloc.h>
27 #include <grpc/support/log.h>
28 #include <grpc/support/time.h>
29
30 #include "src/core/lib/gpr/string.h"
31 #include "src/core/lib/security/credentials/credentials.h"
32 #include "test/core/end2end/cq_verifier.h"
33
34 static const char iam_token[] = "token";
35 static const char iam_selector[] = "selector";
36 static const char overridden_iam_token[] = "overridden_token";
37 static const char overridden_iam_selector[] = "overridden_selector";
38
39 typedef enum { NONE, OVERRIDE, DESTROY, FAIL } override_mode;
40
tag(intptr_t t)41 static void* tag(intptr_t t) { return (void*)t; }
42
begin_test(grpc_end2end_test_config config,const char * test_name,int fail_server_auth_check)43 static grpc_end2end_test_fixture begin_test(grpc_end2end_test_config config,
44 const char* test_name,
45 int fail_server_auth_check) {
46 grpc_end2end_test_fixture f;
47 gpr_log(GPR_INFO, "Running test: %s/%s", test_name, config.name);
48 f = config.create_fixture(nullptr, nullptr);
49 config.init_client(&f, nullptr);
50 if (fail_server_auth_check) {
51 grpc_arg fail_auth_arg = {
52 GRPC_ARG_STRING,
53 const_cast<char*>(FAIL_AUTH_CHECK_SERVER_ARG_NAME),
54 {nullptr}};
55 grpc_channel_args args;
56 args.num_args = 1;
57 args.args = &fail_auth_arg;
58 config.init_server(&f, &args);
59 } else {
60 config.init_server(&f, nullptr);
61 }
62 return f;
63 }
64
n_seconds_from_now(int n)65 static gpr_timespec n_seconds_from_now(int n) {
66 return grpc_timeout_seconds_to_deadline(n);
67 }
68
five_seconds_from_now(void)69 static gpr_timespec five_seconds_from_now(void) {
70 return n_seconds_from_now(5);
71 }
72
drain_cq(grpc_completion_queue * cq)73 static void drain_cq(grpc_completion_queue* cq) {
74 grpc_event ev;
75 do {
76 ev = grpc_completion_queue_next(cq, five_seconds_from_now(), nullptr);
77 } while (ev.type != GRPC_QUEUE_SHUTDOWN);
78 }
79
shutdown_server(grpc_end2end_test_fixture * f)80 static void shutdown_server(grpc_end2end_test_fixture* f) {
81 if (!f->server) return;
82 grpc_server_shutdown_and_notify(f->server, f->shutdown_cq, tag(1000));
83 GPR_ASSERT(grpc_completion_queue_pluck(f->shutdown_cq, tag(1000),
84 grpc_timeout_seconds_to_deadline(5),
85 nullptr)
86 .type == GRPC_OP_COMPLETE);
87 grpc_server_destroy(f->server);
88 f->server = nullptr;
89 }
90
shutdown_client(grpc_end2end_test_fixture * f)91 static void shutdown_client(grpc_end2end_test_fixture* f) {
92 if (!f->client) return;
93 grpc_channel_destroy(f->client);
94 f->client = nullptr;
95 }
96
end_test(grpc_end2end_test_fixture * f)97 static void end_test(grpc_end2end_test_fixture* f) {
98 shutdown_server(f);
99 shutdown_client(f);
100
101 grpc_completion_queue_shutdown(f->cq);
102 drain_cq(f->cq);
103 grpc_completion_queue_destroy(f->cq);
104 grpc_completion_queue_destroy(f->shutdown_cq);
105 }
106
print_auth_context(int is_client,const grpc_auth_context * ctx)107 static void print_auth_context(int is_client, const grpc_auth_context* ctx) {
108 const grpc_auth_property* p;
109 grpc_auth_property_iterator it;
110 gpr_log(GPR_INFO, "%s peer:", is_client ? "client" : "server");
111 gpr_log(GPR_INFO, "\tauthenticated: %s",
112 grpc_auth_context_peer_is_authenticated(ctx) ? "YES" : "NO");
113 it = grpc_auth_context_peer_identity(ctx);
114 while ((p = grpc_auth_property_iterator_next(&it)) != nullptr) {
115 gpr_log(GPR_INFO, "\t\t%s: %s", p->name, p->value);
116 }
117 gpr_log(GPR_INFO, "\tall properties:");
118 it = grpc_auth_context_property_iterator(ctx);
119 while ((p = grpc_auth_property_iterator_next(&it)) != nullptr) {
120 gpr_log(GPR_INFO, "\t\t%s: %s", p->name, p->value);
121 }
122 }
123
request_response_with_payload_and_call_creds(const char * test_name,grpc_end2end_test_config config,override_mode mode)124 static void request_response_with_payload_and_call_creds(
125 const char* test_name, grpc_end2end_test_config config,
126 override_mode mode) {
127 grpc_call* c;
128 grpc_call* s;
129 grpc_slice request_payload_slice =
130 grpc_slice_from_copied_string("hello world");
131 grpc_slice response_payload_slice =
132 grpc_slice_from_copied_string("hello you");
133 grpc_byte_buffer* request_payload =
134 grpc_raw_byte_buffer_create(&request_payload_slice, 1);
135 grpc_byte_buffer* response_payload =
136 grpc_raw_byte_buffer_create(&response_payload_slice, 1);
137 grpc_end2end_test_fixture f;
138 cq_verifier* cqv;
139 grpc_op ops[6];
140 grpc_op* op;
141 grpc_metadata_array initial_metadata_recv;
142 grpc_metadata_array trailing_metadata_recv;
143 grpc_metadata_array request_metadata_recv;
144 grpc_byte_buffer* request_payload_recv = nullptr;
145 grpc_byte_buffer* response_payload_recv = nullptr;
146 grpc_call_details call_details;
147 grpc_status_code status;
148 grpc_call_error error;
149 grpc_slice details;
150 int was_cancelled = 2;
151 grpc_call_credentials* creds = nullptr;
152 grpc_auth_context* s_auth_context = nullptr;
153 grpc_auth_context* c_auth_context = nullptr;
154
155 f = begin_test(config, test_name, 0);
156 cqv = cq_verifier_create(f.cq);
157
158 gpr_timespec deadline = five_seconds_from_now();
159 c = grpc_channel_create_call(f.client, nullptr, GRPC_PROPAGATE_DEFAULTS, f.cq,
160 grpc_slice_from_static_string("/foo"), nullptr,
161 deadline, nullptr);
162 GPR_ASSERT(c);
163 creds = grpc_google_iam_credentials_create(iam_token, iam_selector, nullptr);
164 GPR_ASSERT(creds != nullptr);
165 GPR_ASSERT(grpc_call_set_credentials(c, creds) == GRPC_CALL_OK);
166 switch (mode) {
167 case NONE:
168 break;
169 case OVERRIDE:
170 grpc_call_credentials_release(creds);
171 creds = grpc_google_iam_credentials_create(
172 overridden_iam_token, overridden_iam_selector, nullptr);
173 GPR_ASSERT(creds != nullptr);
174 GPR_ASSERT(grpc_call_set_credentials(c, creds) == GRPC_CALL_OK);
175 break;
176 case DESTROY:
177 case FAIL:
178 GPR_ASSERT(grpc_call_set_credentials(c, nullptr) == GRPC_CALL_OK);
179 break;
180 }
181 grpc_call_credentials_release(creds);
182
183 grpc_metadata_array_init(&initial_metadata_recv);
184 grpc_metadata_array_init(&trailing_metadata_recv);
185 grpc_metadata_array_init(&request_metadata_recv);
186 grpc_call_details_init(&call_details);
187
188 memset(ops, 0, sizeof(ops));
189 op = ops;
190 op->op = GRPC_OP_SEND_INITIAL_METADATA;
191 op->data.send_initial_metadata.count = 0;
192 op->flags = 0;
193 op->reserved = nullptr;
194 op++;
195 op->op = GRPC_OP_SEND_MESSAGE;
196 op->data.send_message.send_message = request_payload;
197 op->flags = 0;
198 op->reserved = nullptr;
199 op++;
200 op->op = GRPC_OP_SEND_CLOSE_FROM_CLIENT;
201 op->flags = 0;
202 op->reserved = nullptr;
203 op++;
204 op->op = GRPC_OP_RECV_INITIAL_METADATA;
205 op->data.recv_initial_metadata.recv_initial_metadata = &initial_metadata_recv;
206 op->flags = 0;
207 op->reserved = nullptr;
208 op++;
209 op->op = GRPC_OP_RECV_MESSAGE;
210 op->data.recv_message.recv_message = &response_payload_recv;
211 op->flags = 0;
212 op->reserved = nullptr;
213 op++;
214 op->op = GRPC_OP_RECV_STATUS_ON_CLIENT;
215 op->data.recv_status_on_client.trailing_metadata = &trailing_metadata_recv;
216 op->data.recv_status_on_client.status = &status;
217 op->data.recv_status_on_client.status_details = &details;
218 op->flags = 0;
219 op->reserved = nullptr;
220 op++;
221 error = grpc_call_start_batch(c, ops, static_cast<size_t>(op - ops), tag(1),
222 nullptr);
223 GPR_ASSERT(GRPC_CALL_OK == error);
224
225 error =
226 grpc_server_request_call(f.server, &s, &call_details,
227 &request_metadata_recv, f.cq, f.cq, tag(101));
228 GPR_ASSERT(GRPC_CALL_OK == error);
229 CQ_EXPECT_COMPLETION(cqv, tag(101), 1);
230 cq_verify(cqv);
231 s_auth_context = grpc_call_auth_context(s);
232 GPR_ASSERT(s_auth_context != nullptr);
233 print_auth_context(0, s_auth_context);
234 grpc_auth_context_release(s_auth_context);
235
236 c_auth_context = grpc_call_auth_context(c);
237 GPR_ASSERT(c_auth_context != nullptr);
238 print_auth_context(1, c_auth_context);
239 grpc_auth_context_release(c_auth_context);
240
241 /* Cannot set creds on the server call object. */
242 GPR_ASSERT(grpc_call_set_credentials(s, nullptr) != GRPC_CALL_OK);
243
244 memset(ops, 0, sizeof(ops));
245 op = ops;
246 op->op = GRPC_OP_SEND_INITIAL_METADATA;
247 op->data.send_initial_metadata.count = 0;
248 op->flags = 0;
249 op->reserved = nullptr;
250 op++;
251 op->op = GRPC_OP_RECV_MESSAGE;
252 op->data.recv_message.recv_message = &request_payload_recv;
253 op->flags = 0;
254 op->reserved = nullptr;
255 op++;
256 error = grpc_call_start_batch(s, ops, static_cast<size_t>(op - ops), tag(102),
257 nullptr);
258 GPR_ASSERT(GRPC_CALL_OK == error);
259
260 CQ_EXPECT_COMPLETION(cqv, tag(102), 1);
261 cq_verify(cqv);
262
263 memset(ops, 0, sizeof(ops));
264 op = ops;
265 op->op = GRPC_OP_RECV_CLOSE_ON_SERVER;
266 op->data.recv_close_on_server.cancelled = &was_cancelled;
267 op->flags = 0;
268 op->reserved = nullptr;
269 op++;
270 op->op = GRPC_OP_SEND_MESSAGE;
271 op->data.send_message.send_message = response_payload;
272 op->flags = 0;
273 op->reserved = nullptr;
274 op++;
275 op->op = GRPC_OP_SEND_STATUS_FROM_SERVER;
276 op->data.send_status_from_server.trailing_metadata_count = 0;
277 op->data.send_status_from_server.status = GRPC_STATUS_OK;
278 grpc_slice status_details = grpc_slice_from_static_string("xyz");
279 op->data.send_status_from_server.status_details = &status_details;
280 op->flags = 0;
281 op->reserved = nullptr;
282 op++;
283 error = grpc_call_start_batch(s, ops, static_cast<size_t>(op - ops), tag(103),
284 nullptr);
285 GPR_ASSERT(GRPC_CALL_OK == error);
286
287 CQ_EXPECT_COMPLETION(cqv, tag(103), 1);
288 CQ_EXPECT_COMPLETION(cqv, tag(1), 1);
289 cq_verify(cqv);
290
291 GPR_ASSERT(status == GRPC_STATUS_OK);
292 GPR_ASSERT(0 == grpc_slice_str_cmp(details, "xyz"));
293 GPR_ASSERT(0 == grpc_slice_str_cmp(call_details.method, "/foo"));
294 GPR_ASSERT(was_cancelled == 0);
295 GPR_ASSERT(byte_buffer_eq_string(request_payload_recv, "hello world"));
296 GPR_ASSERT(byte_buffer_eq_string(response_payload_recv, "hello you"));
297
298 switch (mode) {
299 case NONE:
300 GPR_ASSERT(contains_metadata(&request_metadata_recv,
301 GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
302 iam_token));
303 GPR_ASSERT(contains_metadata(&request_metadata_recv,
304 GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
305 iam_selector));
306 break;
307 case OVERRIDE:
308 GPR_ASSERT(contains_metadata(&request_metadata_recv,
309 GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
310 overridden_iam_token));
311 GPR_ASSERT(contains_metadata(&request_metadata_recv,
312 GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
313 overridden_iam_selector));
314 break;
315 case DESTROY:
316 case FAIL:
317 GPR_ASSERT(!contains_metadata(&request_metadata_recv,
318 GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
319 iam_token));
320 GPR_ASSERT(!contains_metadata(&request_metadata_recv,
321 GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
322 iam_selector));
323 GPR_ASSERT(!contains_metadata(&request_metadata_recv,
324 GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
325 overridden_iam_token));
326 GPR_ASSERT(!contains_metadata(&request_metadata_recv,
327 GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
328 overridden_iam_selector));
329 break;
330 }
331
332 grpc_slice_unref(details);
333 grpc_metadata_array_destroy(&initial_metadata_recv);
334 grpc_metadata_array_destroy(&trailing_metadata_recv);
335 grpc_metadata_array_destroy(&request_metadata_recv);
336 grpc_call_details_destroy(&call_details);
337
338 grpc_call_unref(c);
339 grpc_call_unref(s);
340
341 cq_verifier_destroy(cqv);
342
343 grpc_byte_buffer_destroy(request_payload);
344 grpc_byte_buffer_destroy(response_payload);
345 grpc_byte_buffer_destroy(request_payload_recv);
346 grpc_byte_buffer_destroy(response_payload_recv);
347
348 end_test(&f);
349 config.tear_down_data(&f);
350 }
351
test_request_response_with_payload_and_call_creds(grpc_end2end_test_config config)352 static void test_request_response_with_payload_and_call_creds(
353 grpc_end2end_test_config config) {
354 request_response_with_payload_and_call_creds(
355 "test_request_response_with_payload_and_call_creds", config, NONE);
356 }
357
test_request_response_with_payload_and_overridden_call_creds(grpc_end2end_test_config config)358 static void test_request_response_with_payload_and_overridden_call_creds(
359 grpc_end2end_test_config config) {
360 request_response_with_payload_and_call_creds(
361 "test_request_response_with_payload_and_overridden_call_creds", config,
362 OVERRIDE);
363 }
364
test_request_response_with_payload_and_deleted_call_creds(grpc_end2end_test_config config)365 static void test_request_response_with_payload_and_deleted_call_creds(
366 grpc_end2end_test_config config) {
367 request_response_with_payload_and_call_creds(
368 "test_request_response_with_payload_and_deleted_call_creds", config,
369 DESTROY);
370 }
371
test_request_response_with_payload_fail_to_send_call_creds(grpc_end2end_test_config config)372 static void test_request_response_with_payload_fail_to_send_call_creds(
373 grpc_end2end_test_config config) {
374 request_response_with_payload_and_call_creds(
375 "test_request_response_with_payload_fail_to_send_call_creds", config,
376 FAIL);
377 }
378
test_request_with_server_rejecting_client_creds(grpc_end2end_test_config config)379 static void test_request_with_server_rejecting_client_creds(
380 grpc_end2end_test_config config) {
381 grpc_op ops[6];
382 grpc_op* op;
383 grpc_call* c;
384 grpc_end2end_test_fixture f;
385 gpr_timespec deadline = five_seconds_from_now();
386 cq_verifier* cqv;
387 grpc_metadata_array initial_metadata_recv;
388 grpc_metadata_array trailing_metadata_recv;
389 grpc_metadata_array request_metadata_recv;
390 grpc_call_details call_details;
391 grpc_status_code status;
392 grpc_call_error error;
393 grpc_slice details;
394 grpc_byte_buffer* response_payload_recv = nullptr;
395 grpc_slice request_payload_slice =
396 grpc_slice_from_copied_string("hello world");
397 grpc_byte_buffer* request_payload =
398 grpc_raw_byte_buffer_create(&request_payload_slice, 1);
399 grpc_call_credentials* creds;
400
401 f = begin_test(config, "test_request_with_server_rejecting_client_creds", 1);
402 cqv = cq_verifier_create(f.cq);
403
404 c = grpc_channel_create_call(f.client, nullptr, GRPC_PROPAGATE_DEFAULTS, f.cq,
405 grpc_slice_from_static_string("/foo"), nullptr,
406 deadline, nullptr);
407 GPR_ASSERT(c);
408
409 creds = grpc_google_iam_credentials_create(iam_token, iam_selector, nullptr);
410 GPR_ASSERT(creds != nullptr);
411 GPR_ASSERT(grpc_call_set_credentials(c, creds) == GRPC_CALL_OK);
412 grpc_call_credentials_release(creds);
413
414 grpc_metadata_array_init(&initial_metadata_recv);
415 grpc_metadata_array_init(&trailing_metadata_recv);
416 grpc_metadata_array_init(&request_metadata_recv);
417 grpc_call_details_init(&call_details);
418
419 memset(ops, 0, sizeof(ops));
420 op = ops;
421 op->op = GRPC_OP_RECV_STATUS_ON_CLIENT;
422 op->data.recv_status_on_client.trailing_metadata = &trailing_metadata_recv;
423 op->data.recv_status_on_client.status = &status;
424 op->data.recv_status_on_client.status_details = &details;
425 op->flags = 0;
426 op->reserved = nullptr;
427 op++;
428 op->op = GRPC_OP_SEND_INITIAL_METADATA;
429 op->data.send_initial_metadata.count = 0;
430 op->flags = 0;
431 op->reserved = nullptr;
432 op++;
433 op->op = GRPC_OP_SEND_MESSAGE;
434 op->data.send_message.send_message = request_payload;
435 op->flags = 0;
436 op->reserved = nullptr;
437 op++;
438 op->op = GRPC_OP_SEND_CLOSE_FROM_CLIENT;
439 op->flags = 0;
440 op->reserved = nullptr;
441 op++;
442 op->op = GRPC_OP_RECV_INITIAL_METADATA;
443 op->data.recv_initial_metadata.recv_initial_metadata = &initial_metadata_recv;
444 op->flags = 0;
445 op->reserved = nullptr;
446 op++;
447 op->op = GRPC_OP_RECV_MESSAGE;
448 op->data.recv_message.recv_message = &response_payload_recv;
449 op->flags = 0;
450 op->reserved = nullptr;
451 op++;
452 error = grpc_call_start_batch(c, ops, static_cast<size_t>(op - ops), tag(1),
453 nullptr);
454 GPR_ASSERT(error == GRPC_CALL_OK);
455
456 CQ_EXPECT_COMPLETION(cqv, tag(1), 1);
457 cq_verify(cqv);
458
459 GPR_ASSERT(status == GRPC_STATUS_UNAUTHENTICATED);
460
461 grpc_metadata_array_destroy(&initial_metadata_recv);
462 grpc_metadata_array_destroy(&trailing_metadata_recv);
463 grpc_metadata_array_destroy(&request_metadata_recv);
464 grpc_call_details_destroy(&call_details);
465
466 grpc_byte_buffer_destroy(request_payload);
467 grpc_byte_buffer_destroy(response_payload_recv);
468 grpc_slice_unref(details);
469
470 grpc_call_unref(c);
471
472 cq_verifier_destroy(cqv);
473 end_test(&f);
474 config.tear_down_data(&f);
475 }
476
call_creds(grpc_end2end_test_config config)477 void call_creds(grpc_end2end_test_config config) {
478 if (config.feature_mask & FEATURE_MASK_SUPPORTS_PER_CALL_CREDENTIALS) {
479 test_request_response_with_payload_and_call_creds(config);
480 test_request_response_with_payload_and_overridden_call_creds(config);
481 test_request_response_with_payload_and_deleted_call_creds(config);
482 test_request_with_server_rejecting_client_creds(config);
483 }
484 if (config.feature_mask &
485 FEATURE_MASK_DOES_NOT_SUPPORT_SEND_CALL_CREDENTIALS) {
486 test_request_response_with_payload_fail_to_send_call_creds(config);
487 }
488 }
489
call_creds_pre_init(void)490 void call_creds_pre_init(void) {}
491