1 /*
2 *
3 * Copyright 2015 gRPC authors.
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 */
18
19 #include <grpc/support/port_platform.h>
20
21 #include "src/core/tsi/transport_security.h"
22
23 #include <grpc/support/alloc.h>
24 #include <grpc/support/string_util.h>
25
26 #include <stdlib.h>
27 #include <string.h>
28
29 /* --- Tracing. --- */
30
31 grpc_core::TraceFlag tsi_tracing_enabled(false, "tsi");
32
33 /* --- tsi_result common implementation. --- */
34
tsi_result_to_string(tsi_result result)35 const char* tsi_result_to_string(tsi_result result) {
36 switch (result) {
37 case TSI_OK:
38 return "TSI_OK";
39 case TSI_UNKNOWN_ERROR:
40 return "TSI_UNKNOWN_ERROR";
41 case TSI_INVALID_ARGUMENT:
42 return "TSI_INVALID_ARGUMENT";
43 case TSI_PERMISSION_DENIED:
44 return "TSI_PERMISSION_DENIED";
45 case TSI_INCOMPLETE_DATA:
46 return "TSI_INCOMPLETE_DATA";
47 case TSI_FAILED_PRECONDITION:
48 return "TSI_FAILED_PRECONDITION";
49 case TSI_UNIMPLEMENTED:
50 return "TSI_UNIMPLEMENTED";
51 case TSI_INTERNAL_ERROR:
52 return "TSI_INTERNAL_ERROR";
53 case TSI_DATA_CORRUPTED:
54 return "TSI_DATA_CORRUPTED";
55 case TSI_NOT_FOUND:
56 return "TSI_NOT_FOUND";
57 case TSI_PROTOCOL_FAILURE:
58 return "TSI_PROTOCOL_FAILURE";
59 case TSI_HANDSHAKE_IN_PROGRESS:
60 return "TSI_HANDSHAKE_IN_PROGRESS";
61 case TSI_OUT_OF_RESOURCES:
62 return "TSI_OUT_OF_RESOURCES";
63 case TSI_ASYNC:
64 return "TSI_ASYNC";
65 default:
66 return "UNKNOWN";
67 }
68 }
69
tsi_security_level_to_string(tsi_security_level security_level)70 const char* tsi_security_level_to_string(tsi_security_level security_level) {
71 switch (security_level) {
72 case TSI_SECURITY_NONE:
73 return "TSI_SECURITY_NONE";
74 case TSI_INTEGRITY_ONLY:
75 return "TSI_INTEGRITY_ONLY";
76 case TSI_PRIVACY_AND_INTEGRITY:
77 return "TSI_PRIVACY_AND_INTEGRITY";
78 default:
79 return "UNKNOWN";
80 }
81 }
82
83 /* --- tsi_frame_protector common implementation. ---
84
85 Calls specific implementation after state/input validation. */
86
tsi_frame_protector_protect(tsi_frame_protector * self,const unsigned char * unprotected_bytes,size_t * unprotected_bytes_size,unsigned char * protected_output_frames,size_t * protected_output_frames_size)87 tsi_result tsi_frame_protector_protect(tsi_frame_protector* self,
88 const unsigned char* unprotected_bytes,
89 size_t* unprotected_bytes_size,
90 unsigned char* protected_output_frames,
91 size_t* protected_output_frames_size) {
92 if (self == nullptr || self->vtable == nullptr ||
93 unprotected_bytes == nullptr || unprotected_bytes_size == nullptr ||
94 protected_output_frames == nullptr ||
95 protected_output_frames_size == nullptr) {
96 return TSI_INVALID_ARGUMENT;
97 }
98 if (self->vtable->protect == nullptr) return TSI_UNIMPLEMENTED;
99 return self->vtable->protect(self, unprotected_bytes, unprotected_bytes_size,
100 protected_output_frames,
101 protected_output_frames_size);
102 }
103
tsi_frame_protector_protect_flush(tsi_frame_protector * self,unsigned char * protected_output_frames,size_t * protected_output_frames_size,size_t * still_pending_size)104 tsi_result tsi_frame_protector_protect_flush(
105 tsi_frame_protector* self, unsigned char* protected_output_frames,
106 size_t* protected_output_frames_size, size_t* still_pending_size) {
107 if (self == nullptr || self->vtable == nullptr ||
108 protected_output_frames == nullptr ||
109 protected_output_frames_size == nullptr ||
110 still_pending_size == nullptr) {
111 return TSI_INVALID_ARGUMENT;
112 }
113 if (self->vtable->protect_flush == nullptr) return TSI_UNIMPLEMENTED;
114 return self->vtable->protect_flush(self, protected_output_frames,
115 protected_output_frames_size,
116 still_pending_size);
117 }
118
tsi_frame_protector_unprotect(tsi_frame_protector * self,const unsigned char * protected_frames_bytes,size_t * protected_frames_bytes_size,unsigned char * unprotected_bytes,size_t * unprotected_bytes_size)119 tsi_result tsi_frame_protector_unprotect(
120 tsi_frame_protector* self, const unsigned char* protected_frames_bytes,
121 size_t* protected_frames_bytes_size, unsigned char* unprotected_bytes,
122 size_t* unprotected_bytes_size) {
123 if (self == nullptr || self->vtable == nullptr ||
124 protected_frames_bytes == nullptr ||
125 protected_frames_bytes_size == nullptr || unprotected_bytes == nullptr ||
126 unprotected_bytes_size == nullptr) {
127 return TSI_INVALID_ARGUMENT;
128 }
129 if (self->vtable->unprotect == nullptr) return TSI_UNIMPLEMENTED;
130 return self->vtable->unprotect(self, protected_frames_bytes,
131 protected_frames_bytes_size, unprotected_bytes,
132 unprotected_bytes_size);
133 }
134
tsi_frame_protector_destroy(tsi_frame_protector * self)135 void tsi_frame_protector_destroy(tsi_frame_protector* self) {
136 if (self == nullptr) return;
137 self->vtable->destroy(self);
138 }
139
140 /* --- tsi_handshaker common implementation. ---
141
142 Calls specific implementation after state/input validation. */
143
tsi_handshaker_get_bytes_to_send_to_peer(tsi_handshaker * self,unsigned char * bytes,size_t * bytes_size)144 tsi_result tsi_handshaker_get_bytes_to_send_to_peer(tsi_handshaker* self,
145 unsigned char* bytes,
146 size_t* bytes_size) {
147 if (self == nullptr || self->vtable == nullptr || bytes == nullptr ||
148 bytes_size == nullptr) {
149 return TSI_INVALID_ARGUMENT;
150 }
151 if (self->frame_protector_created) return TSI_FAILED_PRECONDITION;
152 if (self->handshake_shutdown) return TSI_HANDSHAKE_SHUTDOWN;
153 if (self->vtable->get_bytes_to_send_to_peer == nullptr) {
154 return TSI_UNIMPLEMENTED;
155 }
156 return self->vtable->get_bytes_to_send_to_peer(self, bytes, bytes_size);
157 }
158
tsi_handshaker_process_bytes_from_peer(tsi_handshaker * self,const unsigned char * bytes,size_t * bytes_size)159 tsi_result tsi_handshaker_process_bytes_from_peer(tsi_handshaker* self,
160 const unsigned char* bytes,
161 size_t* bytes_size) {
162 if (self == nullptr || self->vtable == nullptr || bytes == nullptr ||
163 bytes_size == nullptr) {
164 return TSI_INVALID_ARGUMENT;
165 }
166 if (self->frame_protector_created) return TSI_FAILED_PRECONDITION;
167 if (self->handshake_shutdown) return TSI_HANDSHAKE_SHUTDOWN;
168 if (self->vtable->process_bytes_from_peer == nullptr) {
169 return TSI_UNIMPLEMENTED;
170 }
171 return self->vtable->process_bytes_from_peer(self, bytes, bytes_size);
172 }
173
tsi_handshaker_get_result(tsi_handshaker * self)174 tsi_result tsi_handshaker_get_result(tsi_handshaker* self) {
175 if (self == nullptr || self->vtable == nullptr) return TSI_INVALID_ARGUMENT;
176 if (self->frame_protector_created) return TSI_FAILED_PRECONDITION;
177 if (self->handshake_shutdown) return TSI_HANDSHAKE_SHUTDOWN;
178 if (self->vtable->get_result == nullptr) return TSI_UNIMPLEMENTED;
179 return self->vtable->get_result(self);
180 }
181
tsi_handshaker_extract_peer(tsi_handshaker * self,tsi_peer * peer)182 tsi_result tsi_handshaker_extract_peer(tsi_handshaker* self, tsi_peer* peer) {
183 if (self == nullptr || self->vtable == nullptr || peer == nullptr) {
184 return TSI_INVALID_ARGUMENT;
185 }
186 memset(peer, 0, sizeof(tsi_peer));
187 if (self->frame_protector_created) return TSI_FAILED_PRECONDITION;
188 if (self->handshake_shutdown) return TSI_HANDSHAKE_SHUTDOWN;
189 if (tsi_handshaker_get_result(self) != TSI_OK) {
190 return TSI_FAILED_PRECONDITION;
191 }
192 if (self->vtable->extract_peer == nullptr) return TSI_UNIMPLEMENTED;
193 return self->vtable->extract_peer(self, peer);
194 }
195
tsi_handshaker_create_frame_protector(tsi_handshaker * self,size_t * max_output_protected_frame_size,tsi_frame_protector ** protector)196 tsi_result tsi_handshaker_create_frame_protector(
197 tsi_handshaker* self, size_t* max_output_protected_frame_size,
198 tsi_frame_protector** protector) {
199 tsi_result result;
200 if (self == nullptr || self->vtable == nullptr || protector == nullptr) {
201 return TSI_INVALID_ARGUMENT;
202 }
203 if (self->frame_protector_created) return TSI_FAILED_PRECONDITION;
204 if (self->handshake_shutdown) return TSI_HANDSHAKE_SHUTDOWN;
205 if (tsi_handshaker_get_result(self) != TSI_OK) return TSI_FAILED_PRECONDITION;
206 if (self->vtable->create_frame_protector == nullptr) return TSI_UNIMPLEMENTED;
207 result = self->vtable->create_frame_protector(
208 self, max_output_protected_frame_size, protector);
209 if (result == TSI_OK) {
210 self->frame_protector_created = true;
211 }
212 return result;
213 }
214
tsi_handshaker_next(tsi_handshaker * self,const unsigned char * received_bytes,size_t received_bytes_size,const unsigned char ** bytes_to_send,size_t * bytes_to_send_size,tsi_handshaker_result ** handshaker_result,tsi_handshaker_on_next_done_cb cb,void * user_data)215 tsi_result tsi_handshaker_next(
216 tsi_handshaker* self, const unsigned char* received_bytes,
217 size_t received_bytes_size, const unsigned char** bytes_to_send,
218 size_t* bytes_to_send_size, tsi_handshaker_result** handshaker_result,
219 tsi_handshaker_on_next_done_cb cb, void* user_data) {
220 if (self == nullptr || self->vtable == nullptr) return TSI_INVALID_ARGUMENT;
221 if (self->handshaker_result_created) return TSI_FAILED_PRECONDITION;
222 if (self->handshake_shutdown) return TSI_HANDSHAKE_SHUTDOWN;
223 if (self->vtable->next == nullptr) return TSI_UNIMPLEMENTED;
224 return self->vtable->next(self, received_bytes, received_bytes_size,
225 bytes_to_send, bytes_to_send_size,
226 handshaker_result, cb, user_data);
227 }
228
tsi_handshaker_shutdown(tsi_handshaker * self)229 void tsi_handshaker_shutdown(tsi_handshaker* self) {
230 if (self == nullptr || self->vtable == nullptr) return;
231 if (self->vtable->shutdown != nullptr) {
232 self->vtable->shutdown(self);
233 }
234 self->handshake_shutdown = true;
235 }
236
tsi_handshaker_destroy(tsi_handshaker * self)237 void tsi_handshaker_destroy(tsi_handshaker* self) {
238 if (self == nullptr) return;
239 self->vtable->destroy(self);
240 }
241
242 /* --- tsi_handshaker_result implementation. --- */
243
tsi_handshaker_result_extract_peer(const tsi_handshaker_result * self,tsi_peer * peer)244 tsi_result tsi_handshaker_result_extract_peer(const tsi_handshaker_result* self,
245 tsi_peer* peer) {
246 if (self == nullptr || self->vtable == nullptr || peer == nullptr) {
247 return TSI_INVALID_ARGUMENT;
248 }
249 memset(peer, 0, sizeof(tsi_peer));
250 if (self->vtable->extract_peer == nullptr) return TSI_UNIMPLEMENTED;
251 return self->vtable->extract_peer(self, peer);
252 }
253
tsi_handshaker_result_create_frame_protector(const tsi_handshaker_result * self,size_t * max_output_protected_frame_size,tsi_frame_protector ** protector)254 tsi_result tsi_handshaker_result_create_frame_protector(
255 const tsi_handshaker_result* self, size_t* max_output_protected_frame_size,
256 tsi_frame_protector** protector) {
257 if (self == nullptr || self->vtable == nullptr || protector == nullptr) {
258 return TSI_INVALID_ARGUMENT;
259 }
260 if (self->vtable->create_frame_protector == nullptr) return TSI_UNIMPLEMENTED;
261 return self->vtable->create_frame_protector(
262 self, max_output_protected_frame_size, protector);
263 }
264
tsi_handshaker_result_get_unused_bytes(const tsi_handshaker_result * self,const unsigned char ** bytes,size_t * bytes_size)265 tsi_result tsi_handshaker_result_get_unused_bytes(
266 const tsi_handshaker_result* self, const unsigned char** bytes,
267 size_t* bytes_size) {
268 if (self == nullptr || self->vtable == nullptr || bytes == nullptr ||
269 bytes_size == nullptr) {
270 return TSI_INVALID_ARGUMENT;
271 }
272 if (self->vtable->get_unused_bytes == nullptr) return TSI_UNIMPLEMENTED;
273 return self->vtable->get_unused_bytes(self, bytes, bytes_size);
274 }
275
tsi_handshaker_result_destroy(tsi_handshaker_result * self)276 void tsi_handshaker_result_destroy(tsi_handshaker_result* self) {
277 if (self == nullptr) return;
278 self->vtable->destroy(self);
279 }
280
281 /* --- tsi_peer implementation. --- */
282
tsi_init_peer_property(void)283 tsi_peer_property tsi_init_peer_property(void) {
284 tsi_peer_property property;
285 memset(&property, 0, sizeof(tsi_peer_property));
286 return property;
287 }
288
tsi_peer_destroy_list_property(tsi_peer_property * children,size_t child_count)289 static void tsi_peer_destroy_list_property(tsi_peer_property* children,
290 size_t child_count) {
291 size_t i;
292 for (i = 0; i < child_count; i++) {
293 tsi_peer_property_destruct(&children[i]);
294 }
295 gpr_free(children);
296 }
297
tsi_peer_property_destruct(tsi_peer_property * property)298 void tsi_peer_property_destruct(tsi_peer_property* property) {
299 if (property->name != nullptr) {
300 gpr_free(property->name);
301 }
302 if (property->value.data != nullptr) {
303 gpr_free(property->value.data);
304 }
305 *property = tsi_init_peer_property(); /* Reset everything to 0. */
306 }
307
tsi_peer_destruct(tsi_peer * self)308 void tsi_peer_destruct(tsi_peer* self) {
309 if (self == nullptr) return;
310 if (self->properties != nullptr) {
311 tsi_peer_destroy_list_property(self->properties, self->property_count);
312 self->properties = nullptr;
313 }
314 self->property_count = 0;
315 }
316
tsi_construct_allocated_string_peer_property(const char * name,size_t value_length,tsi_peer_property * property)317 tsi_result tsi_construct_allocated_string_peer_property(
318 const char* name, size_t value_length, tsi_peer_property* property) {
319 *property = tsi_init_peer_property();
320 if (name != nullptr) property->name = gpr_strdup(name);
321 if (value_length > 0) {
322 property->value.data = static_cast<char*>(gpr_zalloc(value_length));
323 property->value.length = value_length;
324 }
325 return TSI_OK;
326 }
327
tsi_construct_string_peer_property_from_cstring(const char * name,const char * value,tsi_peer_property * property)328 tsi_result tsi_construct_string_peer_property_from_cstring(
329 const char* name, const char* value, tsi_peer_property* property) {
330 return tsi_construct_string_peer_property(name, value, strlen(value),
331 property);
332 }
333
tsi_construct_string_peer_property(const char * name,const char * value,size_t value_length,tsi_peer_property * property)334 tsi_result tsi_construct_string_peer_property(const char* name,
335 const char* value,
336 size_t value_length,
337 tsi_peer_property* property) {
338 tsi_result result = tsi_construct_allocated_string_peer_property(
339 name, value_length, property);
340 if (result != TSI_OK) return result;
341 if (value_length > 0) {
342 memcpy(property->value.data, value, value_length);
343 }
344 return TSI_OK;
345 }
346
tsi_construct_peer(size_t property_count,tsi_peer * peer)347 tsi_result tsi_construct_peer(size_t property_count, tsi_peer* peer) {
348 memset(peer, 0, sizeof(tsi_peer));
349 if (property_count > 0) {
350 peer->properties = static_cast<tsi_peer_property*>(
351 gpr_zalloc(property_count * sizeof(tsi_peer_property)));
352 peer->property_count = property_count;
353 }
354 return TSI_OK;
355 }
356
tsi_peer_get_property_by_name(const tsi_peer * peer,const char * name)357 const tsi_peer_property* tsi_peer_get_property_by_name(const tsi_peer* peer,
358 const char* name) {
359 size_t i;
360 if (peer == nullptr) return nullptr;
361 for (i = 0; i < peer->property_count; i++) {
362 const tsi_peer_property* property = &peer->properties[i];
363 if (name == nullptr && property->name == nullptr) {
364 return property;
365 }
366 if (name != nullptr && property->name != nullptr &&
367 strcmp(property->name, name) == 0) {
368 return property;
369 }
370 }
371 return nullptr;
372 }
373