1 //
2 //
3 // Copyright 2016 gRPC authors.
4 //
5 // Licensed under the Apache License, Version 2.0 (the "License");
6 // you may not use this file except in compliance with the License.
7 // You may obtain a copy of the License at
8 //
9 // http://www.apache.org/licenses/LICENSE-2.0
10 //
11 // Unless required by applicable law or agreed to in writing, software
12 // distributed under the License is distributed on an "AS IS" BASIS,
13 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 // See the License for the specific language governing permissions and
15 // limitations under the License.
16 //
17 //
18
19 #include "test/cpp/util/cli_credentials.h"
20
21 #include <grpc/slice.h>
22 #include <grpcpp/support/slice.h>
23
24 #include "absl/flags/flag.h"
25 #include "absl/log/log.h"
26 #include "src/core/util/crash.h"
27 #include "src/core/util/load_file.h"
28
29 ABSL_RETIRED_FLAG(bool, enable_ssl, false,
30 "Replaced by --channel_creds_type=ssl.");
31 ABSL_RETIRED_FLAG(bool, use_auth, false,
32 "Replaced by --channel_creds_type=gdc.");
33 ABSL_RETIRED_FLAG(std::string, access_token, "",
34 "Replaced by --call_creds=access_token=<token>.");
35 ABSL_FLAG(
36 std::string, ssl_target, "",
37 "If not empty, treat the server host name as this for ssl/tls certificate "
38 "validation.");
39 ABSL_FLAG(
40 std::string, ssl_client_cert, "",
41 "If not empty, load this PEM formatted client certificate file. Requires "
42 "use of --ssl_client_key.");
43 ABSL_FLAG(std::string, ssl_client_key, "",
44 "If not empty, load this PEM formatted private key. Requires use of "
45 "--ssl_client_cert");
46 ABSL_FLAG(
47 std::string, local_connect_type, "local_tcp",
48 "The type of local connections for which local channel credentials will "
49 "be applied. Should be local_tcp or uds.");
50 ABSL_FLAG(
51 std::string, channel_creds_type, "",
52 "The channel creds type: insecure, ssl, gdc (Google Default Credentials), "
53 "alts, or local.");
54 ABSL_FLAG(
55 std::string, call_creds, "",
56 "Call credentials to use: none (default), or access_token=<token>. If "
57 "provided, the call creds are composited on top of channel creds.");
58
59 namespace grpc {
60 namespace testing {
61
62 namespace {
63
64 const char ACCESS_TOKEN_PREFIX[] = "access_token=";
65 constexpr int ACCESS_TOKEN_PREFIX_LEN =
66 (sizeof(ACCESS_TOKEN_PREFIX) / sizeof(*ACCESS_TOKEN_PREFIX)) - 1;
67
IsAccessToken(const std::string & auth)68 bool IsAccessToken(const std::string& auth) {
69 return auth.length() > ACCESS_TOKEN_PREFIX_LEN &&
70 auth.compare(0, ACCESS_TOKEN_PREFIX_LEN, ACCESS_TOKEN_PREFIX) == 0;
71 }
72
AccessToken(const std::string & auth)73 std::string AccessToken(const std::string& auth) {
74 if (!IsAccessToken(auth)) {
75 return "";
76 }
77 return std::string(auth, ACCESS_TOKEN_PREFIX_LEN);
78 }
79
80 } // namespace
81
GetDefaultChannelCredsType() const82 std::string CliCredentials::GetDefaultChannelCredsType() const {
83 return "insecure";
84 }
85
GetDefaultCallCreds() const86 std::string CliCredentials::GetDefaultCallCreds() const { return "none"; }
87
88 std::shared_ptr<grpc::ChannelCredentials>
GetChannelCredentials() const89 CliCredentials::GetChannelCredentials() const {
90 if (absl::GetFlag(FLAGS_channel_creds_type) == "insecure") {
91 return grpc::InsecureChannelCredentials();
92 } else if (absl::GetFlag(FLAGS_channel_creds_type) == "ssl") {
93 grpc::SslCredentialsOptions ssl_creds_options;
94 // TODO(@Capstan): This won't affect Google Default Credentials using SSL.
95 if (!absl::GetFlag(FLAGS_ssl_client_cert).empty()) {
96 auto cert = grpc_core::LoadFile(absl::GetFlag(FLAGS_ssl_client_cert),
97 /*add_null_terminator=*/false);
98 if (!cert.ok()) {
99 LOG(ERROR) << "error loading file "
100 << absl::GetFlag(FLAGS_ssl_client_cert) << ": "
101 << cert.status();
102 } else {
103 ssl_creds_options.pem_cert_chain = std::string(cert->as_string_view());
104 }
105 }
106 if (!absl::GetFlag(FLAGS_ssl_client_key).empty()) {
107 auto key = grpc_core::LoadFile(absl::GetFlag(FLAGS_ssl_client_key),
108 /*add_null_terminator=*/false);
109 if (!key.ok()) {
110 LOG(ERROR) << "error loading file "
111 << absl::GetFlag(FLAGS_ssl_client_key) << ": "
112 << key.status();
113 } else {
114 ssl_creds_options.pem_private_key = std::string(key->as_string_view());
115 }
116 }
117 return grpc::SslCredentials(ssl_creds_options);
118 } else if (absl::GetFlag(FLAGS_channel_creds_type) == "gdc") {
119 return grpc::GoogleDefaultCredentials();
120 } else if (absl::GetFlag(FLAGS_channel_creds_type) == "alts") {
121 return grpc::experimental::AltsCredentials(
122 grpc::experimental::AltsCredentialsOptions());
123 } else if (absl::GetFlag(FLAGS_channel_creds_type) == "local") {
124 if (absl::GetFlag(FLAGS_local_connect_type) == "local_tcp") {
125 return grpc::experimental::LocalCredentials(LOCAL_TCP);
126 } else if (absl::GetFlag(FLAGS_local_connect_type) == "uds") {
127 return grpc::experimental::LocalCredentials(UDS);
128 } else {
129 fprintf(stderr,
130 "--local_connect_type=%s invalid; must be local_tcp or uds.\n",
131 absl::GetFlag(FLAGS_local_connect_type).c_str());
132 }
133 }
134 fprintf(stderr,
135 "--channel_creds_type=%s invalid; must be insecure, ssl, gdc, "
136 "alts, or local.\n",
137 absl::GetFlag(FLAGS_channel_creds_type).c_str());
138 return std::shared_ptr<grpc::ChannelCredentials>();
139 }
140
GetCallCredentials() const141 std::shared_ptr<grpc::CallCredentials> CliCredentials::GetCallCredentials()
142 const {
143 if (IsAccessToken(absl::GetFlag(FLAGS_call_creds))) {
144 return grpc::AccessTokenCredentials(
145 AccessToken(absl::GetFlag(FLAGS_call_creds)));
146 }
147 if (absl::GetFlag(FLAGS_call_creds) == "none") {
148 // Nothing to do; creds, if any, are baked into the channel.
149 return std::shared_ptr<grpc::CallCredentials>();
150 }
151 fprintf(stderr,
152 "--call_creds=%s invalid; must be none "
153 "or access_token=<token>.\n",
154 absl::GetFlag(FLAGS_call_creds).c_str());
155 return std::shared_ptr<grpc::CallCredentials>();
156 }
157
GetCredentials() const158 std::shared_ptr<grpc::ChannelCredentials> CliCredentials::GetCredentials()
159 const {
160 if (absl::GetFlag(FLAGS_call_creds).empty()) {
161 absl::SetFlag(&FLAGS_call_creds, GetDefaultCallCreds());
162 }
163 if (absl::GetFlag(FLAGS_channel_creds_type).empty()) {
164 absl::SetFlag(&FLAGS_channel_creds_type, GetDefaultChannelCredsType());
165 }
166 std::shared_ptr<grpc::ChannelCredentials> channel_creds =
167 GetChannelCredentials();
168 // Composite any call-type credentials on top of the base channel.
169 std::shared_ptr<grpc::CallCredentials> call_creds = GetCallCredentials();
170 return (channel_creds == nullptr || call_creds == nullptr)
171 ? channel_creds
172 : grpc::CompositeChannelCredentials(channel_creds, call_creds);
173 }
174
GetCredentialUsage() const175 std::string CliCredentials::GetCredentialUsage() const {
176 return " --ssl_target ; Set server host for ssl validation\n"
177 " --ssl_client_cert ; Client cert for ssl\n"
178 " --ssl_client_key ; Client private key for ssl\n"
179 " --local_connect_type ; Set to local_tcp or uds\n"
180 " --channel_creds_type ; Set to insecure, ssl, gdc, alts, or "
181 "local\n"
182 " --call_creds ; Set to none, or"
183 " access_token=<token>\n";
184 }
185
GetSslTargetNameOverride() const186 std::string CliCredentials::GetSslTargetNameOverride() const {
187 bool use_ssl = absl::GetFlag(FLAGS_channel_creds_type) == "ssl" ||
188 absl::GetFlag(FLAGS_channel_creds_type) == "gdc";
189 return use_ssl ? absl::GetFlag(FLAGS_ssl_target) : "";
190 }
191
192 } // namespace testing
193 } // namespace grpc
194