1 //
2 //
3 // Copyright 2015 gRPC authors.
4 //
5 // Licensed under the Apache License, Version 2.0 (the "License");
6 // you may not use this file except in compliance with the License.
7 // You may obtain a copy of the License at
8 //
9 // http://www.apache.org/licenses/LICENSE-2.0
10 //
11 // Unless required by applicable law or agreed to in writing, software
12 // distributed under the License is distributed on an "AS IS" BASIS,
13 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 // See the License for the specific language governing permissions and
15 // limitations under the License.
16 //
17 //
18
19 #include "src/cpp/server/secure_server_credentials.h"
20
21 #include <memory>
22 #include <utility>
23 #include <vector>
24
25 #include <grpc/grpc_security_constants.h>
26 #include <grpc/status.h>
27 #include <grpcpp/security/auth_metadata_processor.h>
28 #include <grpcpp/security/tls_credentials_options.h>
29 #include <grpcpp/support/slice.h>
30 #include <grpcpp/support/status.h>
31 #include <grpcpp/support/string_ref.h>
32
33 #include "src/cpp/common/secure_auth_context.h"
34
35 namespace grpc {
36
Destroy(void * wrapper)37 void AuthMetadataProcessorAsyncWrapper::Destroy(void* wrapper) {
38 auto* w = static_cast<AuthMetadataProcessorAsyncWrapper*>(wrapper);
39 delete w;
40 }
41
Process(void * wrapper,grpc_auth_context * context,const grpc_metadata * md,size_t num_md,grpc_process_auth_metadata_done_cb cb,void * user_data)42 void AuthMetadataProcessorAsyncWrapper::Process(
43 void* wrapper, grpc_auth_context* context, const grpc_metadata* md,
44 size_t num_md, grpc_process_auth_metadata_done_cb cb, void* user_data) {
45 auto* w = static_cast<AuthMetadataProcessorAsyncWrapper*>(wrapper);
46 if (!w->processor_) {
47 // Early exit.
48 cb(user_data, nullptr, 0, nullptr, 0, GRPC_STATUS_OK, nullptr);
49 return;
50 }
51 if (w->processor_->IsBlocking()) {
52 // TODO(hork): replace with EventEngine::Run
53 w->thread_pool_->Add([w, context, md, num_md, cb, user_data] {
54 w->AuthMetadataProcessorAsyncWrapper::InvokeProcessor(context, md, num_md,
55 cb, user_data);
56 });
57 } else {
58 // invoke directly.
59 w->InvokeProcessor(context, md, num_md, cb, user_data);
60 }
61 }
62
InvokeProcessor(grpc_auth_context * context,const grpc_metadata * md,size_t num_md,grpc_process_auth_metadata_done_cb cb,void * user_data)63 void AuthMetadataProcessorAsyncWrapper::InvokeProcessor(
64 grpc_auth_context* context, const grpc_metadata* md, size_t num_md,
65 grpc_process_auth_metadata_done_cb cb, void* user_data) {
66 AuthMetadataProcessor::InputMetadata metadata;
67 for (size_t i = 0; i < num_md; i++) {
68 metadata.insert(std::make_pair(StringRefFromSlice(&md[i].key),
69 StringRefFromSlice(&md[i].value)));
70 }
71 SecureAuthContext ctx(context);
72 AuthMetadataProcessor::OutputMetadata consumed_metadata;
73 AuthMetadataProcessor::OutputMetadata response_metadata;
74
75 Status status = processor_->Process(metadata, &ctx, &consumed_metadata,
76 &response_metadata);
77
78 std::vector<grpc_metadata> consumed_md;
79 for (const auto& consumed : consumed_metadata) {
80 grpc_metadata md_entry;
81 md_entry.key = SliceReferencingString(consumed.first);
82 md_entry.value = SliceReferencingString(consumed.second);
83 consumed_md.push_back(md_entry);
84 }
85 std::vector<grpc_metadata> response_md;
86 for (const auto& response : response_metadata) {
87 grpc_metadata md_entry;
88 md_entry.key = SliceReferencingString(response.first);
89 md_entry.value = SliceReferencingString(response.second);
90 response_md.push_back(md_entry);
91 }
92 auto consumed_md_data = consumed_md.empty() ? nullptr : &consumed_md[0];
93 auto response_md_data = response_md.empty() ? nullptr : &response_md[0];
94 cb(user_data, consumed_md_data, consumed_md.size(), response_md_data,
95 response_md.size(), static_cast<grpc_status_code>(status.error_code()),
96 status.error_message().c_str());
97 }
98
SecureServerCredentials(grpc_server_credentials * creds)99 SecureServerCredentials::SecureServerCredentials(grpc_server_credentials* creds)
100 : ServerCredentials(creds) {}
101
SetAuthMetadataProcessor(const std::shared_ptr<grpc::AuthMetadataProcessor> & processor)102 void SecureServerCredentials::SetAuthMetadataProcessor(
103 const std::shared_ptr<grpc::AuthMetadataProcessor>& processor) {
104 auto* wrapper = new grpc::AuthMetadataProcessorAsyncWrapper(processor);
105 grpc_server_credentials_set_auth_metadata_processor(
106 c_creds(), {grpc::AuthMetadataProcessorAsyncWrapper::Process,
107 grpc::AuthMetadataProcessorAsyncWrapper::Destroy, wrapper});
108 }
109
SslServerCredentials(const grpc::SslServerCredentialsOptions & options)110 std::shared_ptr<ServerCredentials> SslServerCredentials(
111 const grpc::SslServerCredentialsOptions& options) {
112 std::vector<grpc_ssl_pem_key_cert_pair> pem_key_cert_pairs;
113 for (const auto& key_cert_pair : options.pem_key_cert_pairs) {
114 grpc_ssl_pem_key_cert_pair p = {key_cert_pair.private_key.c_str(),
115 key_cert_pair.cert_chain.c_str()};
116 pem_key_cert_pairs.push_back(p);
117 }
118 grpc_server_credentials* c_creds = grpc_ssl_server_credentials_create_ex(
119 options.pem_root_certs.empty() ? nullptr : options.pem_root_certs.c_str(),
120 pem_key_cert_pairs.empty() ? nullptr : &pem_key_cert_pairs[0],
121 pem_key_cert_pairs.size(),
122 options.force_client_auth
123 ? GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY
124 : options.client_certificate_request,
125 nullptr);
126 return std::shared_ptr<ServerCredentials>(
127 new SecureServerCredentials(c_creds));
128 }
129
130 namespace experimental {
131
AltsServerCredentials(const AltsServerCredentialsOptions &)132 std::shared_ptr<ServerCredentials> AltsServerCredentials(
133 const AltsServerCredentialsOptions& /* options */) {
134 grpc_alts_credentials_options* c_options =
135 grpc_alts_credentials_server_options_create();
136 grpc_server_credentials* c_creds =
137 grpc_alts_server_credentials_create(c_options);
138 grpc_alts_credentials_options_destroy(c_options);
139 return std::shared_ptr<ServerCredentials>(
140 new SecureServerCredentials(c_creds));
141 }
142
LocalServerCredentials(grpc_local_connect_type type)143 std::shared_ptr<ServerCredentials> LocalServerCredentials(
144 grpc_local_connect_type type) {
145 return std::shared_ptr<ServerCredentials>(
146 new SecureServerCredentials(grpc_local_server_credentials_create(type)));
147 }
148
TlsServerCredentials(const grpc::experimental::TlsServerCredentialsOptions & options)149 std::shared_ptr<ServerCredentials> TlsServerCredentials(
150 const grpc::experimental::TlsServerCredentialsOptions& options) {
151 grpc_server_credentials* c_creds =
152 grpc_tls_server_credentials_create(options.c_credentials_options());
153 if (c_creds == nullptr) {
154 return nullptr;
155 }
156 return std::shared_ptr<ServerCredentials>(
157 new SecureServerCredentials(c_creds));
158 }
159
160 } // namespace experimental
161 } // namespace grpc
162