src/core/lib/security/security_connector/tls/spiffe_security_connector.h

   1 /*
   2  *
   3  * Copyright 2018 gRPC authors.
   4  *
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  *
  17  */
  18
  19 #ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_SPIFFE_SECURITY_CONNECTOR_H
  20 #define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_SPIFFE_SECURITY_CONNECTOR_H
  21
  22 #include <grpc/support/port_platform.h>
  23
  24 #include "src/core/lib/gprpp/sync.h"
  25 #include "src/core/lib/security/context/security_context.h"
  26 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
  27
  28 #define GRPC_TLS_SPIFFE_TRANSPORT_SECURITY_TYPE "spiffe"
  29
  30 namespace grpc_core {
  31
  32 // Spiffe channel security connector.
  33 class SpiffeChannelSecurityConnector final
  34     : public grpc_channel_security_connector {
  35  public:
  36   // static factory method to create a SPIFFE channel security connector.
  37   static grpc_core::RefCountedPtr<grpc_channel_security_connector>
  38   CreateSpiffeChannelSecurityConnector(
  39       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
  40       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
  41       const char* target_name, const char* overridden_target_name,
  42       tsi_ssl_session_cache* ssl_session_cache);
  43
  44   SpiffeChannelSecurityConnector(
  45       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
  46       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
  47       const char* target_name, const char* overridden_target_name);
  48   ~SpiffeChannelSecurityConnector() override;
  49
  50   void add_handshakers(const grpc_channel_args* args,
  51                        grpc_pollset_set* interested_parties,
  52                        grpc_core::HandshakeManager* handshake_mgr) override;
  53
  54   void check_peer(tsi_peer peer, grpc_endpoint* ep,
  55                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
  56                   grpc_closure* on_peer_checked) override;
  57
  58   int cmp(const grpc_security_connector* other_sc) const override;
  59
  60   bool check_call_host(grpc_core::StringView host,
  61                        grpc_auth_context* auth_context,
  62                        grpc_closure* on_call_host_checked,
  63                        grpc_error** error) override;
  64
  65   void cancel_check_call_host(grpc_closure* on_call_host_checked,
  66                               grpc_error* error) override;
  67
  68  private:
  69   // Initialize SSL TSI client handshaker factory.
  70   grpc_security_status InitializeHandshakerFactory(
  71       tsi_ssl_session_cache* ssl_session_cache);
  72
  73   // A util function to create a new client handshaker factory to replace
  74   // the existing one if exists.
  75   grpc_security_status ReplaceHandshakerFactory(
  76       tsi_ssl_session_cache* ssl_session_cache);
  77
  78   // gRPC-provided callback executed by application, which servers to bring the
  79   // control back to gRPC core.
  80   static void ServerAuthorizationCheckDone(
  81       grpc_tls_server_authorization_check_arg* arg);
  82
  83   // A util function to process server authorization check result.
  84   static grpc_error* ProcessServerAuthorizationCheckResult(
  85       grpc_tls_server_authorization_check_arg* arg);
  86
  87   // A util function to create a server authorization check arg instance.
  88   static grpc_tls_server_authorization_check_arg*
  89   ServerAuthorizationCheckArgCreate(void* user_data);
  90
  91   // A util function to destroy a server authorization check arg instance.
  92   static void ServerAuthorizationCheckArgDestroy(
  93       grpc_tls_server_authorization_check_arg* arg);
  94
  95   // A util function to refresh SSL TSI client handshaker factory with a valid
  96   // credential.
  97   grpc_security_status RefreshHandshakerFactory();
  98
  99   grpc_core::Mutex mu_;
 100   grpc_closure* on_peer_checked_;
 101   grpc_core::UniquePtr<char> target_name_;
 102   grpc_core::UniquePtr<char> overridden_target_name_;
 103   tsi_ssl_client_handshaker_factory* client_handshaker_factory_ = nullptr;
 104   grpc_tls_server_authorization_check_arg* check_arg_;
 105   grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
 106 };
 107
 108 // Spiffe server security connector.
 109 class SpiffeServerSecurityConnector final
 110     : public grpc_server_security_connector {
 111  public:
 112   // static factory method to create a SPIFFE server security connector.
 113   static grpc_core::RefCountedPtr<grpc_server_security_connector>
 114   CreateSpiffeServerSecurityConnector(
 115       grpc_core::RefCountedPtr<grpc_server_credentials> server_creds);
 116
 117   explicit SpiffeServerSecurityConnector(
 118       grpc_core::RefCountedPtr<grpc_server_credentials> server_creds);
 119   ~SpiffeServerSecurityConnector() override;
 120
 121   void add_handshakers(const grpc_channel_args* args,
 122                        grpc_pollset_set* interested_parties,
 123                        grpc_core::HandshakeManager* handshake_mgr) override;
 124
 125   void check_peer(tsi_peer peer, grpc_endpoint* ep,
 126                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
 127                   grpc_closure* on_peer_checked) override;
 128
 129   int cmp(const grpc_security_connector* other) const override;
 130
 131  private:
 132   // Initialize SSL TSI server handshaker factory.
 133   grpc_security_status InitializeHandshakerFactory();
 134
 135   // A util function to create a new server handshaker factory to replace the
 136   // existing once if exists.
 137   grpc_security_status ReplaceHandshakerFactory();
 138
 139   // A util function to refresh SSL TSI server handshaker factory with a valid
 140   // credential.
 141   grpc_security_status RefreshHandshakerFactory();
 142
 143   grpc_core::Mutex mu_;
 144   tsi_ssl_server_handshaker_factory* server_handshaker_factory_ = nullptr;
 145   grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
 146 };
 147
 148 // Exposed for testing only.
 149 grpc_status_code TlsFetchKeyMaterials(
 150     const grpc_core::RefCountedPtr<grpc_tls_key_materials_config>&
 151         key_materials_config,
 152     const grpc_tls_credentials_options& options,
 153     grpc_ssl_certificate_config_reload_status* status);
 154
 155 }  // namespace grpc_core
 156
 157 #endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_SPIFFE_SECURITY_CONNECTOR_H \
 158         */