src/core/lib/security/credentials/plugin/plugin_credentials.cc

   1 /*
   2  *
   3  * Copyright 2016 gRPC authors.
   4  *
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  *
  17  */
  18
  19 #include <grpc/support/port_platform.h>
  20
  21 #include "src/core/lib/security/credentials/plugin/plugin_credentials.h"
  22
  23 #include <string.h>
  24
  25 #include "absl/strings/str_cat.h"
  26
  27 #include <grpc/grpc.h>
  28 #include <grpc/support/alloc.h>
  29 #include <grpc/support/log.h>
  30 #include <grpc/support/sync.h>
  31
  32 #include "src/core/lib/slice/slice_internal.h"
  33 #include "src/core/lib/slice/slice_string_helpers.h"
  34 #include "src/core/lib/surface/api_trace.h"
  35 #include "src/core/lib/surface/validate_metadata.h"
  36
  37 grpc_core::TraceFlag grpc_plugin_credentials_trace(false, "plugin_credentials");
  38
  39 grpc_plugin_credentials::~grpc_plugin_credentials() {
  40   gpr_mu_destroy(&mu_);
  41   if (plugin_.state != nullptr && plugin_.destroy != nullptr) {
  42     plugin_.destroy(plugin_.state);
  43   }
  44 }
  45
  46 std::string grpc_plugin_credentials::debug_string() {
  47   char* debug_c_str = nullptr;
  48   if (plugin_.debug_string != nullptr) {
  49     debug_c_str = plugin_.debug_string(plugin_.state);
  50   }
  51   std::string debug_str(
  52       debug_c_str != nullptr
  53           ? debug_c_str
  54           : "grpc_plugin_credentials did not provide a debug string");
  55   gpr_free(debug_c_str);
  56   return debug_str;
  57 }
  58
  59 void grpc_plugin_credentials::pending_request_remove_locked(
  60     pending_request* pending_request) {
  61   if (pending_request->prev == nullptr) {
  62     pending_requests_ = pending_request->next;
  63   } else {
  64     pending_request->prev->next = pending_request->next;
  65   }
  66   if (pending_request->next != nullptr) {
  67     pending_request->next->prev = pending_request->prev;
  68   }
  69 }
  70
  71 // Checks if the request has been cancelled.
  72 // If not, removes it from the pending list, so that it cannot be
  73 // cancelled out from under us.
  74 // When this returns, r->cancelled indicates whether the request was
  75 // cancelled before completion.
  76 void grpc_plugin_credentials::pending_request_complete(pending_request* r) {
  77   GPR_DEBUG_ASSERT(r->creds == this);
  78   gpr_mu_lock(&mu_);
  79   if (!r->cancelled) pending_request_remove_locked(r);
  80   gpr_mu_unlock(&mu_);
  81   // Ref to credentials not needed anymore.
  82   Unref();
  83 }
  84
  85 static grpc_error_handle process_plugin_result(
  86     grpc_plugin_credentials::pending_request* r, const grpc_metadata* md,
  87     size_t num_md, grpc_status_code status, const char* error_details) {
  88   grpc_error_handle error = GRPC_ERROR_NONE;
  89   if (status != GRPC_STATUS_OK) {
  90     error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
  91         "Getting metadata from plugin failed with error: ", error_details));
  92   } else {
  93     bool seen_illegal_header = false;
  94     for (size_t i = 0; i < num_md; ++i) {
  95       if (!GRPC_LOG_IF_ERROR("validate_metadata_from_plugin",
  96                              grpc_validate_header_key_is_legal(md[i].key))) {
  97         seen_illegal_header = true;
  98         break;
  99       } else if (!grpc_is_binary_header_internal(md[i].key) &&
 100                  !GRPC_LOG_IF_ERROR(
 101                      "validate_metadata_from_plugin",
 102                      grpc_validate_header_nonbin_value_is_legal(md[i].value))) {
 103         gpr_log(GPR_ERROR, "Plugin added invalid metadata value.");
 104         seen_illegal_header = true;
 105         break;
 106       }
 107     }
 108     if (seen_illegal_header) {
 109       error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Illegal metadata");
 110     } else {
 111       for (size_t i = 0; i < num_md; ++i) {
 112         grpc_mdelem mdelem =
 113             grpc_mdelem_create(md[i].key, md[i].value, nullptr);
 114         grpc_credentials_mdelem_array_add(r->md_array, mdelem);
 115         GRPC_MDELEM_UNREF(mdelem);
 116       }
 117     }
 118   }
 119   return error;
 120 }
 121
 122 static void plugin_md_request_metadata_ready(void* request,
 123                                              const grpc_metadata* md,
 124                                              size_t num_md,
 125                                              grpc_status_code status,
 126                                              const char* error_details) {
 127   /* called from application code */
 128   grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
 129   grpc_core::ExecCtx exec_ctx(GRPC_EXEC_CTX_FLAG_IS_FINISHED |
 130                               GRPC_EXEC_CTX_FLAG_THREAD_RESOURCE_LOOP);
 131   grpc_plugin_credentials::pending_request* r =
 132       static_cast<grpc_plugin_credentials::pending_request*>(request);
 133   if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
 134     gpr_log(GPR_INFO,
 135             "plugin_credentials[%p]: request %p: plugin returned "
 136             "asynchronously",
 137             r->creds, r);
 138   }
 139   // Remove request from pending list if not previously cancelled.
 140   r->creds->pending_request_complete(r);
 141   // If it has not been cancelled, process it.
 142   if (!r->cancelled) {
 143     grpc_error_handle error =
 144         process_plugin_result(r, md, num_md, status, error_details);
 145     grpc_core::ExecCtx::Run(DEBUG_LOCATION, r->on_request_metadata, error);
 146   } else if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
 147     gpr_log(GPR_INFO,
 148             "plugin_credentials[%p]: request %p: plugin was previously "
 149             "cancelled",
 150             r->creds, r);
 151   }
 152   gpr_free(r);
 153 }
 154
 155 bool grpc_plugin_credentials::get_request_metadata(
 156     grpc_polling_entity* /*pollent*/, grpc_auth_metadata_context context,
 157     grpc_credentials_mdelem_array* md_array, grpc_closure* on_request_metadata,
 158     grpc_error_handle* error) {
 159   bool retval = true;  // Synchronous return.
 160   if (plugin_.get_metadata != nullptr) {
 161     // Create pending_request object.
 162     pending_request* request =
 163         static_cast<pending_request*>(gpr_zalloc(sizeof(*request)));
 164     request->creds = this;
 165     request->md_array = md_array;
 166     request->on_request_metadata = on_request_metadata;
 167     // Add it to the pending list.
 168     gpr_mu_lock(&mu_);
 169     if (pending_requests_ != nullptr) {
 170       pending_requests_->prev = request;
 171     }
 172     request->next = pending_requests_;
 173     pending_requests_ = request;
 174     gpr_mu_unlock(&mu_);
 175     // Invoke the plugin.  The callback holds a ref to us.
 176     if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
 177       gpr_log(GPR_INFO, "plugin_credentials[%p]: request %p: invoking plugin",
 178               this, request);
 179     }
 180     Ref().release();
 181     grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX];
 182     size_t num_creds_md = 0;
 183     grpc_status_code status = GRPC_STATUS_OK;
 184     const char* error_details = nullptr;
 185     if (!plugin_.get_metadata(
 186             plugin_.state, context, plugin_md_request_metadata_ready, request,
 187             creds_md, &num_creds_md, &status, &error_details)) {
 188       if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
 189         gpr_log(GPR_INFO,
 190                 "plugin_credentials[%p]: request %p: plugin will return "
 191                 "asynchronously",
 192                 this, request);
 193       }
 194       return false;  // Asynchronous return.
 195     }
 196     // Returned synchronously.
 197     // Remove request from pending list if not previously cancelled.
 198     request->creds->pending_request_complete(request);
 199     // If the request was cancelled, the error will have been returned
 200     // asynchronously by plugin_cancel_get_request_metadata(), so return
 201     // false.  Otherwise, process the result.
 202     if (request->cancelled) {
 203       if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
 204         gpr_log(GPR_INFO,
 205                 "plugin_credentials[%p]: request %p was cancelled, error "
 206                 "will be returned asynchronously",
 207                 this, request);
 208       }
 209       retval = false;
 210     } else {
 211       if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
 212         gpr_log(GPR_INFO,
 213                 "plugin_credentials[%p]: request %p: plugin returned "
 214                 "synchronously",
 215                 this, request);
 216       }
 217       *error = process_plugin_result(request, creds_md, num_creds_md, status,
 218                                      error_details);
 219     }
 220     // Clean up.
 221     for (size_t i = 0; i < num_creds_md; ++i) {
 222       grpc_slice_unref_internal(creds_md[i].key);
 223       grpc_slice_unref_internal(creds_md[i].value);
 224     }
 225     gpr_free(const_cast<char*>(error_details));
 226     gpr_free(request);
 227   }
 228   return retval;
 229 }
 230
 231 void grpc_plugin_credentials::cancel_get_request_metadata(
 232     grpc_credentials_mdelem_array* md_array, grpc_error_handle error) {
 233   gpr_mu_lock(&mu_);
 234   for (pending_request* pending_request = pending_requests_;
 235        pending_request != nullptr; pending_request = pending_request->next) {
 236     if (pending_request->md_array == md_array) {
 237       if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
 238         gpr_log(GPR_INFO, "plugin_credentials[%p]: cancelling request %p", this,
 239                 pending_request);
 240       }
 241       pending_request->cancelled = true;
 242       grpc_core::ExecCtx::Run(DEBUG_LOCATION,
 243                               pending_request->on_request_metadata,
 244                               GRPC_ERROR_REF(error));
 245       pending_request_remove_locked(pending_request);
 246       break;
 247     }
 248   }
 249   gpr_mu_unlock(&mu_);
 250   GRPC_ERROR_UNREF(error);
 251 }
 252
 253 grpc_plugin_credentials::grpc_plugin_credentials(
 254     grpc_metadata_credentials_plugin plugin,
 255     grpc_security_level min_security_level)
 256     : grpc_call_credentials(plugin.type, min_security_level), plugin_(plugin) {
 257   gpr_mu_init(&mu_);
 258 }
 259
 260 grpc_call_credentials* grpc_metadata_credentials_create_from_plugin(
 261     grpc_metadata_credentials_plugin plugin,
 262     grpc_security_level min_security_level, void* reserved) {
 263   GRPC_API_TRACE("grpc_metadata_credentials_create_from_plugin(reserved=%p)", 1,
 264                  (reserved));
 265   GPR_ASSERT(reserved == nullptr);
 266   return new grpc_plugin_credentials(plugin, min_security_level);
 267 }