1 /* 2 * 3 * Copyright 2015 gRPC authors. 4 * 5 * Licensed under the Apache License, Version 2.0 (the "License"); 6 * you may not use this file except in compliance with the License. 7 * You may obtain a copy of the License at 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, 13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 * 17 */ 18 19 #ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SECURITY_CONNECTOR_H 20 #define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SECURITY_CONNECTOR_H 21 22 #include <grpc/support/port_platform.h> 23 24 #include <stdbool.h> 25 26 #include <grpc/grpc_security.h> 27 28 #include "src/core/lib/channel/handshaker.h" 29 #include "src/core/lib/gprpp/ref_counted.h" 30 #include "src/core/lib/iomgr/endpoint.h" 31 #include "src/core/lib/iomgr/pollset.h" 32 #include "src/core/lib/iomgr/tcp_server.h" 33 #include "src/core/tsi/ssl_transport_security.h" 34 #include "src/core/tsi/transport_security_interface.h" 35 36 extern grpc_core::DebugOnlyTraceFlag grpc_trace_security_connector_refcount; 37 38 typedef enum { GRPC_SECURITY_OK = 0, GRPC_SECURITY_ERROR } grpc_security_status; 39 40 /* --- security_connector object. --- 41 42 A security connector object represents away to configure the underlying 43 transport security mechanism and check the resulting trusted peer. */ 44 45 #define GRPC_ARG_SECURITY_CONNECTOR "grpc.security_connector" 46 47 class grpc_security_connector 48 : public grpc_core::RefCounted<grpc_security_connector> { 49 public: grpc_security_connector(const char * url_scheme)50 explicit grpc_security_connector(const char* url_scheme) 51 : grpc_core::RefCounted<grpc_security_connector>( 52 GRPC_TRACE_FLAG_ENABLED(grpc_trace_security_connector_refcount) 53 ? "security_connector_refcount" 54 : nullptr), 55 url_scheme_(url_scheme) {} 56 ~grpc_security_connector() override = default; 57 58 /* Check the peer. Callee takes ownership of the peer object. 59 When done, sets *auth_context and invokes on_peer_checked. */ 60 virtual void check_peer( 61 tsi_peer peer, grpc_endpoint* ep, 62 grpc_core::RefCountedPtr<grpc_auth_context>* auth_context, 63 grpc_closure* on_peer_checked) = 0; 64 65 /* Compares two security connectors. */ 66 virtual int cmp(const grpc_security_connector* other) const = 0; 67 url_scheme()68 const char* url_scheme() const { return url_scheme_; } 69 70 private: 71 const char* url_scheme_; 72 }; 73 74 /* Util to encapsulate the connector in a channel arg. */ 75 grpc_arg grpc_security_connector_to_arg(grpc_security_connector* sc); 76 77 /* Util to get the connector from a channel arg. */ 78 grpc_security_connector* grpc_security_connector_from_arg(const grpc_arg* arg); 79 80 /* Util to find the connector from channel args. */ 81 grpc_security_connector* grpc_security_connector_find_in_args( 82 const grpc_channel_args* args); 83 84 /* --- channel_security_connector object. --- 85 86 A channel security connector object represents a way to configure the 87 underlying transport security mechanism on the client side. */ 88 89 class grpc_channel_security_connector : public grpc_security_connector { 90 public: 91 grpc_channel_security_connector( 92 const char* url_scheme, 93 grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds, 94 grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds 95 /*, 96 grpc_channel_args* channel_args = nullptr*/); 97 ~grpc_channel_security_connector() override; 98 99 /// Checks that the host that will be set for a call is acceptable. 100 /// Returns true if completed synchronously, in which case \a error will 101 /// be set to indicate the result. Otherwise, \a on_call_host_checked 102 /// will be invoked when complete. 103 virtual bool check_call_host(absl::string_view host, 104 grpc_auth_context* auth_context, 105 grpc_closure* on_call_host_checked, 106 grpc_error** error) = 0; 107 /// Cancels a pending asynchronous call to 108 /// grpc_channel_security_connector_check_call_host() with 109 /// \a on_call_host_checked as its callback. 110 virtual void cancel_check_call_host(grpc_closure* on_call_host_checked, 111 grpc_error* error) = 0; 112 /// Registers handshakers with \a handshake_mgr. 113 virtual void add_handshakers(const grpc_channel_args* args, 114 grpc_pollset_set* interested_parties, 115 grpc_core::HandshakeManager* handshake_mgr) = 0; 116 channel_creds()117 const grpc_channel_credentials* channel_creds() const { 118 return channel_creds_.get(); 119 } mutable_channel_creds()120 grpc_channel_credentials* mutable_channel_creds() { 121 return channel_creds_.get(); 122 } request_metadata_creds()123 const grpc_call_credentials* request_metadata_creds() const { 124 return request_metadata_creds_.get(); 125 } mutable_request_metadata_creds()126 grpc_call_credentials* mutable_request_metadata_creds() { 127 return request_metadata_creds_.get(); 128 } 129 130 protected: 131 // Helper methods to be used in subclasses. 132 int channel_security_connector_cmp( 133 const grpc_channel_security_connector* other) const; 134 135 // grpc_channel_args* channel_args() const { return channel_args_.get(); } 136 //// Should be called as soon as the channel args are not needed to reduce 137 //// memory usage. 138 // void clear_channel_arg() { channel_args_.reset(); } 139 140 private: 141 grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds_; 142 grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds_; 143 std::unique_ptr<grpc_channel_args> channel_args_; 144 }; 145 146 /* --- server_security_connector object. --- 147 148 A server security connector object represents a way to configure the 149 underlying transport security mechanism on the server side. */ 150 151 class grpc_server_security_connector : public grpc_security_connector { 152 public: 153 grpc_server_security_connector( 154 const char* url_scheme, 155 grpc_core::RefCountedPtr<grpc_server_credentials> server_creds); 156 ~grpc_server_security_connector() override; 157 158 virtual void add_handshakers(const grpc_channel_args* args, 159 grpc_pollset_set* interested_parties, 160 grpc_core::HandshakeManager* handshake_mgr) = 0; 161 server_creds()162 const grpc_server_credentials* server_creds() const { 163 return server_creds_.get(); 164 } mutable_server_creds()165 grpc_server_credentials* mutable_server_creds() { 166 return server_creds_.get(); 167 } 168 169 protected: 170 // Helper methods to be used in subclasses. 171 int server_security_connector_cmp( 172 const grpc_server_security_connector* other) const; 173 174 private: 175 grpc_core::RefCountedPtr<grpc_server_credentials> server_creds_; 176 }; 177 178 #endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SECURITY_CONNECTOR_H */ 179