1 //
2 //
3 // Copyright 2015 gRPC authors.
4 //
5 // Licensed under the Apache License, Version 2.0 (the "License");
6 // you may not use this file except in compliance with the License.
7 // You may obtain a copy of the License at
8 //
9 // http://www.apache.org/licenses/LICENSE-2.0
10 //
11 // Unless required by applicable law or agreed to in writing, software
12 // distributed under the License is distributed on an "AS IS" BASIS,
13 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 // See the License for the specific language governing permissions and
15 // limitations under the License.
16 //
17 //
18
19 #include <grpc/credentials.h>
20 #include <grpc/grpc.h>
21 #include <grpc/grpc_security.h>
22 #include <grpc/impl/channel_arg_names.h>
23 #include <grpc/support/alloc.h>
24 #include <grpc/support/port_platform.h>
25 #include <grpc/support/string_util.h>
26 #include <string.h>
27
28 #include <string>
29
30 #include "absl/log/log.h"
31 #include "absl/status/status.h"
32 #include "absl/strings/str_cat.h"
33 #include "absl/strings/string_view.h"
34 #include "absl/types/optional.h"
35 #include "src/core/handshaker/handshaker.h"
36 #include "src/core/handshaker/security/security_handshaker.h"
37 #include "src/core/lib/channel/channel_args.h"
38 #include "src/core/lib/iomgr/closure.h"
39 #include "src/core/lib/iomgr/endpoint.h"
40 #include "src/core/lib/iomgr/error.h"
41 #include "src/core/lib/iomgr/exec_ctx.h"
42 #include "src/core/lib/iomgr/iomgr_fwd.h"
43 #include "src/core/lib/promise/arena_promise.h"
44 #include "src/core/lib/promise/promise.h"
45 #include "src/core/lib/security/credentials/credentials.h"
46 #include "src/core/lib/security/security_connector/security_connector.h"
47 #include "src/core/lib/security/security_connector/ssl_utils.h"
48 #include "src/core/tsi/ssl_transport_security.h"
49 #include "src/core/tsi/transport_security_interface.h"
50 #include "src/core/util/debug_location.h"
51 #include "src/core/util/ref_counted_ptr.h"
52 #include "src/core/util/unique_type_name.h"
53
54 namespace grpc_core {
55
56 namespace {
57
58 class grpc_httpcli_ssl_channel_security_connector final
59 : public grpc_channel_security_connector {
60 public:
grpc_httpcli_ssl_channel_security_connector(char * secure_peer_name)61 explicit grpc_httpcli_ssl_channel_security_connector(char* secure_peer_name)
62 : grpc_channel_security_connector(
63 /*url_scheme=*/{},
64 /*channel_creds=*/nullptr,
65 /*request_metadata_creds=*/nullptr),
66 secure_peer_name_(secure_peer_name) {}
67
~grpc_httpcli_ssl_channel_security_connector()68 ~grpc_httpcli_ssl_channel_security_connector() override {
69 if (handshaker_factory_ != nullptr) {
70 tsi_ssl_client_handshaker_factory_unref(handshaker_factory_);
71 }
72 if (secure_peer_name_ != nullptr) {
73 gpr_free(secure_peer_name_);
74 }
75 }
76
InitHandshakerFactory(const char * pem_root_certs,const tsi_ssl_root_certs_store * root_store)77 tsi_result InitHandshakerFactory(const char* pem_root_certs,
78 const tsi_ssl_root_certs_store* root_store) {
79 tsi_ssl_client_handshaker_options options;
80 options.pem_root_certs = pem_root_certs;
81 options.root_store = root_store;
82 return tsi_create_ssl_client_handshaker_factory_with_options(
83 &options, &handshaker_factory_);
84 }
85
add_handshakers(const ChannelArgs & args,grpc_pollset_set *,HandshakeManager * handshake_mgr)86 void add_handshakers(const ChannelArgs& args,
87 grpc_pollset_set* /*interested_parties*/,
88 HandshakeManager* handshake_mgr) override {
89 tsi_handshaker* handshaker = nullptr;
90 if (handshaker_factory_ != nullptr) {
91 tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
92 handshaker_factory_, secure_peer_name_, /*network_bio_buf_size=*/0,
93 /*ssl_bio_buf_size=*/0, &handshaker);
94 if (result != TSI_OK) {
95 LOG(ERROR) << "Handshaker creation failed with error "
96 << tsi_result_to_string(result);
97 }
98 }
99 handshake_mgr->Add(SecurityHandshakerCreate(handshaker, this, args));
100 }
101
handshaker_factory() const102 tsi_ssl_client_handshaker_factory* handshaker_factory() const {
103 return handshaker_factory_;
104 }
105
check_peer(tsi_peer peer,grpc_endpoint *,const ChannelArgs &,RefCountedPtr<grpc_auth_context> *,grpc_closure * on_peer_checked)106 void check_peer(tsi_peer peer, grpc_endpoint* /*ep*/,
107 const ChannelArgs& /*args*/,
108 RefCountedPtr<grpc_auth_context>* /*auth_context*/,
109 grpc_closure* on_peer_checked) override {
110 grpc_error_handle error;
111
112 // Check the peer name.
113 if (secure_peer_name_ != nullptr &&
114 !tsi_ssl_peer_matches_name(&peer, secure_peer_name_)) {
115 error = GRPC_ERROR_CREATE(absl::StrCat("Peer name ", secure_peer_name_,
116 " is not in peer certificate"));
117 }
118 ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
119 tsi_peer_destruct(&peer);
120 }
121
cancel_check_peer(grpc_closure *,grpc_error_handle)122 void cancel_check_peer(grpc_closure* /*on_peer_checked*/,
123 grpc_error_handle /*error*/) override {}
124
cmp(const grpc_security_connector * other_sc) const125 int cmp(const grpc_security_connector* other_sc) const override {
126 auto* other =
127 reinterpret_cast<const grpc_httpcli_ssl_channel_security_connector*>(
128 other_sc);
129 return strcmp(secure_peer_name_, other->secure_peer_name_);
130 }
131
CheckCallHost(absl::string_view,grpc_auth_context *)132 ArenaPromise<absl::Status> CheckCallHost(absl::string_view,
133 grpc_auth_context*) override {
134 return ImmediateOkStatus();
135 }
136
secure_peer_name() const137 const char* secure_peer_name() const { return secure_peer_name_; }
138
139 private:
140 tsi_ssl_client_handshaker_factory* handshaker_factory_ = nullptr;
141 char* secure_peer_name_;
142 };
143
144 RefCountedPtr<grpc_channel_security_connector>
httpcli_ssl_channel_security_connector_create(const char * pem_root_certs,const tsi_ssl_root_certs_store * root_store,const char * secure_peer_name)145 httpcli_ssl_channel_security_connector_create(
146 const char* pem_root_certs, const tsi_ssl_root_certs_store* root_store,
147 const char* secure_peer_name) {
148 if (secure_peer_name != nullptr && pem_root_certs == nullptr) {
149 LOG(ERROR) << "Cannot assert a secure peer name without a trust root.";
150 return nullptr;
151 }
152 RefCountedPtr<grpc_httpcli_ssl_channel_security_connector> c =
153 MakeRefCounted<grpc_httpcli_ssl_channel_security_connector>(
154 secure_peer_name == nullptr ? nullptr : gpr_strdup(secure_peer_name));
155 tsi_result result = c->InitHandshakerFactory(pem_root_certs, root_store);
156 if (result != TSI_OK) {
157 LOG(ERROR) << "Handshaker factory creation failed with "
158 << tsi_result_to_string(result);
159 return nullptr;
160 }
161 return c;
162 }
163
164 class HttpRequestSSLCredentials : public grpc_channel_credentials {
165 public:
create_security_connector(RefCountedPtr<grpc_call_credentials>,const char * target,ChannelArgs * args)166 RefCountedPtr<grpc_channel_security_connector> create_security_connector(
167 RefCountedPtr<grpc_call_credentials> /*call_creds*/, const char* target,
168 ChannelArgs* args) override {
169 const char* pem_root_certs = DefaultSslRootStore::GetPemRootCerts();
170 const tsi_ssl_root_certs_store* root_store =
171 DefaultSslRootStore::GetRootStore();
172 if (root_store == nullptr) {
173 LOG(ERROR) << "Could not get default pem root certs.";
174 return nullptr;
175 }
176 absl::optional<std::string> target_string =
177 args->GetOwnedString(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG)
178 .value_or(target);
179 return httpcli_ssl_channel_security_connector_create(
180 pem_root_certs, root_store, target_string->c_str());
181 }
182
duplicate_without_call_credentials()183 RefCountedPtr<grpc_channel_credentials> duplicate_without_call_credentials()
184 override {
185 return Ref();
186 }
187
type() const188 UniqueTypeName type() const override {
189 static UniqueTypeName::Factory kFactory("HttpRequestSSL");
190 return kFactory.Create();
191 }
192
193 private:
cmp_impl(const grpc_channel_credentials *) const194 int cmp_impl(const grpc_channel_credentials* /* other */) const override {
195 // There's no differentiating factor between two HttpRequestSSLCredentials
196 // objects.
197 return 0;
198 }
199 };
200
201 } // namespace
202
CreateHttpRequestSSLCredentials()203 RefCountedPtr<grpc_channel_credentials> CreateHttpRequestSSLCredentials() {
204 // Create a singleton object for HttpRequestSSLCredentials so that channels to
205 // the same target with HttpRequestSSLCredentials can reuse the subchannels.
206 static auto* creds = new HttpRequestSSLCredentials();
207 return creds->Ref();
208 }
209
210 } // namespace grpc_core
211