1 /*
2 *
3 * Copyright 2016 gRPC authors.
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 */
18
19 #include "test/cpp/util/cli_credentials.h"
20
21 #include <gflags/gflags.h>
22 #include <grpc/slice.h>
23 #include <grpc/support/log.h>
24 #include <grpcpp/impl/codegen/slice.h>
25
26 #include "src/core/lib/iomgr/load_file.h"
27
28 DEFINE_bool(
29 enable_ssl, false,
30 "Whether to use ssl/tls. Deprecated. Use --channel_creds_type=ssl.");
31 DEFINE_bool(use_auth, false,
32 "Whether to create default google credentials. Deprecated. Use "
33 "--channel_creds_type=gdc.");
34 DEFINE_string(
35 access_token, "",
36 "The access token that will be sent to the server to authenticate RPCs. "
37 "Deprecated. Use --call_creds=access_token=<token>.");
38 DEFINE_string(
39 ssl_target, "",
40 "If not empty, treat the server host name as this for ssl/tls certificate "
41 "validation.");
42 DEFINE_string(
43 ssl_client_cert, "",
44 "If not empty, load this PEM formated client certificate file. Requires "
45 "use of --ssl_client_key.");
46 DEFINE_string(
47 ssl_client_key, "",
48 "If not empty, load this PEM formated private key. Requires use of "
49 "--ssl_client_cert");
50 DEFINE_string(
51 channel_creds_type, "",
52 "The channel creds type: insecure, ssl, gdc (Google Default Credentials) "
53 "or alts.");
54 DEFINE_string(
55 call_creds, "",
56 "Call credentials to use: none (default), or access_token=<token>. If "
57 "provided, the call creds are composited on top of channel creds.");
58
59 namespace grpc {
60 namespace testing {
61
62 namespace {
63
64 const char ACCESS_TOKEN_PREFIX[] = "access_token=";
65 constexpr int ACCESS_TOKEN_PREFIX_LEN =
66 sizeof(ACCESS_TOKEN_PREFIX) / sizeof(*ACCESS_TOKEN_PREFIX) - 1;
67
IsAccessToken(const grpc::string & auth)68 bool IsAccessToken(const grpc::string& auth) {
69 return auth.length() > ACCESS_TOKEN_PREFIX_LEN &&
70 auth.compare(0, ACCESS_TOKEN_PREFIX_LEN, ACCESS_TOKEN_PREFIX) == 0;
71 }
72
AccessToken(const grpc::string & auth)73 grpc::string AccessToken(const grpc::string& auth) {
74 if (!IsAccessToken(auth)) {
75 return "";
76 }
77 return grpc::string(auth, ACCESS_TOKEN_PREFIX_LEN);
78 }
79
80 } // namespace
81
GetDefaultChannelCredsType() const82 grpc::string CliCredentials::GetDefaultChannelCredsType() const {
83 // Compatibility logic for --enable_ssl.
84 if (FLAGS_enable_ssl) {
85 fprintf(stderr,
86 "warning: --enable_ssl is deprecated. Use "
87 "--channel_creds_type=ssl.\n");
88 return "ssl";
89 }
90 // Compatibility logic for --use_auth.
91 if (FLAGS_access_token.empty() && FLAGS_use_auth) {
92 fprintf(stderr,
93 "warning: --use_auth is deprecated. Use "
94 "--channel_creds_type=gdc.\n");
95 return "gdc";
96 }
97 return "insecure";
98 }
99
GetDefaultCallCreds() const100 grpc::string CliCredentials::GetDefaultCallCreds() const {
101 if (!FLAGS_access_token.empty()) {
102 fprintf(stderr,
103 "warning: --access_token is deprecated. Use "
104 "--call_creds=access_token=<token>.\n");
105 return grpc::string("access_token=") + FLAGS_access_token;
106 }
107 return "none";
108 }
109
110 std::shared_ptr<grpc::ChannelCredentials>
GetChannelCredentials() const111 CliCredentials::GetChannelCredentials() const {
112 if (FLAGS_channel_creds_type.compare("insecure") == 0) {
113 return grpc::InsecureChannelCredentials();
114 } else if (FLAGS_channel_creds_type.compare("ssl") == 0) {
115 grpc::SslCredentialsOptions ssl_creds_options;
116 // TODO(@Capstan): This won't affect Google Default Credentials using SSL.
117 if (!FLAGS_ssl_client_cert.empty()) {
118 grpc_slice cert_slice = grpc_empty_slice();
119 GRPC_LOG_IF_ERROR(
120 "load_file",
121 grpc_load_file(FLAGS_ssl_client_cert.c_str(), 1, &cert_slice));
122 ssl_creds_options.pem_cert_chain =
123 grpc::StringFromCopiedSlice(cert_slice);
124 grpc_slice_unref(cert_slice);
125 }
126 if (!FLAGS_ssl_client_key.empty()) {
127 grpc_slice key_slice = grpc_empty_slice();
128 GRPC_LOG_IF_ERROR(
129 "load_file",
130 grpc_load_file(FLAGS_ssl_client_key.c_str(), 1, &key_slice));
131 ssl_creds_options.pem_private_key =
132 grpc::StringFromCopiedSlice(key_slice);
133 grpc_slice_unref(key_slice);
134 }
135 return grpc::SslCredentials(ssl_creds_options);
136 } else if (FLAGS_channel_creds_type.compare("gdc") == 0) {
137 return grpc::GoogleDefaultCredentials();
138 } else if (FLAGS_channel_creds_type.compare("alts") == 0) {
139 return grpc::experimental::AltsCredentials(
140 grpc::experimental::AltsCredentialsOptions());
141 }
142 fprintf(stderr,
143 "--channel_creds_type=%s invalid; must be insecure, ssl, gdc or "
144 "alts.\n",
145 FLAGS_channel_creds_type.c_str());
146 return std::shared_ptr<grpc::ChannelCredentials>();
147 }
148
GetCallCredentials() const149 std::shared_ptr<grpc::CallCredentials> CliCredentials::GetCallCredentials()
150 const {
151 if (IsAccessToken(FLAGS_call_creds)) {
152 return grpc::AccessTokenCredentials(AccessToken(FLAGS_call_creds));
153 }
154 if (FLAGS_call_creds.compare("none") != 0) {
155 // Nothing to do; creds, if any, are baked into the channel.
156 return std::shared_ptr<grpc::CallCredentials>();
157 }
158 fprintf(stderr,
159 "--call_creds=%s invalid; must be none "
160 "or access_token=<token>.\n",
161 FLAGS_call_creds.c_str());
162 return std::shared_ptr<grpc::CallCredentials>();
163 }
164
GetCredentials() const165 std::shared_ptr<grpc::ChannelCredentials> CliCredentials::GetCredentials()
166 const {
167 if (FLAGS_call_creds.empty()) {
168 FLAGS_call_creds = GetDefaultCallCreds();
169 } else if (!FLAGS_access_token.empty() && !IsAccessToken(FLAGS_call_creds)) {
170 fprintf(stderr,
171 "warning: ignoring --access_token because --call_creds "
172 "already set to %s.\n",
173 FLAGS_call_creds.c_str());
174 }
175 if (FLAGS_channel_creds_type.empty()) {
176 FLAGS_channel_creds_type = GetDefaultChannelCredsType();
177 } else if (FLAGS_enable_ssl && FLAGS_channel_creds_type.compare("ssl") != 0) {
178 fprintf(stderr,
179 "warning: ignoring --enable_ssl because "
180 "--channel_creds_type already set to %s.\n",
181 FLAGS_channel_creds_type.c_str());
182 } else if (FLAGS_use_auth && FLAGS_channel_creds_type.compare("gdc") != 0) {
183 fprintf(stderr,
184 "warning: ignoring --use_auth because "
185 "--channel_creds_type already set to %s.\n",
186 FLAGS_channel_creds_type.c_str());
187 }
188 // Legacy transport upgrade logic for insecure requests.
189 if (IsAccessToken(FLAGS_call_creds) &&
190 FLAGS_channel_creds_type.compare("insecure") == 0) {
191 fprintf(stderr,
192 "warning: --channel_creds_type=insecure upgraded to ssl because "
193 "an access token was provided.\n");
194 FLAGS_channel_creds_type = "ssl";
195 }
196 std::shared_ptr<grpc::ChannelCredentials> channel_creds =
197 GetChannelCredentials();
198 // Composite any call-type credentials on top of the base channel.
199 std::shared_ptr<grpc::CallCredentials> call_creds = GetCallCredentials();
200 return (channel_creds == nullptr || call_creds == nullptr)
201 ? channel_creds
202 : grpc::CompositeChannelCredentials(channel_creds, call_creds);
203 }
204
GetCredentialUsage() const205 const grpc::string CliCredentials::GetCredentialUsage() const {
206 return " --enable_ssl ; Set whether to use ssl (deprecated)\n"
207 " --use_auth ; Set whether to create default google"
208 " credentials\n"
209 " ; (deprecated)\n"
210 " --access_token ; Set the access token in metadata,"
211 " overrides --use_auth\n"
212 " ; (deprecated)\n"
213 " --ssl_target ; Set server host for ssl validation\n"
214 " --ssl_client_cert ; Client cert for ssl\n"
215 " --ssl_client_key ; Client private key for ssl\n"
216 " --channel_creds_type ; Set to insecure, ssl, gdc, or alts\n"
217 " --call_creds ; Set to none, or"
218 " access_token=<token>\n";
219 }
220
GetSslTargetNameOverride() const221 const grpc::string CliCredentials::GetSslTargetNameOverride() const {
222 bool use_ssl = FLAGS_channel_creds_type.compare("ssl") == 0 ||
223 FLAGS_channel_creds_type.compare("gdc") == 0;
224 return use_ssl ? FLAGS_ssl_target : "";
225 }
226
227 } // namespace testing
228 } // namespace grpc
229