src/core/lib/security/security_connector/tls/tls_security_connector.h

   1 /*
   2  *
   3  * Copyright 2018 gRPC authors.
   4  *
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  *
  17  */
  18
  19 #ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H
  20 #define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H
  21
  22 #include <grpc/support/port_platform.h>
  23
  24 #include "src/core/lib/gprpp/sync.h"
  25 #include "src/core/lib/security/context/security_context.h"
  26 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
  27
  28 #define GRPC_TLS_TRANSPORT_SECURITY_TYPE "tls"
  29
  30 namespace grpc_core {
  31
  32 // TLS channel security connector.
  33 class TlsChannelSecurityConnector final
  34     : public grpc_channel_security_connector {
  35  public:
  36   // static factory method to create a TLS channel security connector.
  37   static grpc_core::RefCountedPtr<grpc_channel_security_connector>
  38   CreateTlsChannelSecurityConnector(
  39       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
  40       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
  41       const char* target_name, const char* overridden_target_name,
  42       tsi_ssl_session_cache* ssl_session_cache);
  43
  44   TlsChannelSecurityConnector(
  45       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
  46       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
  47       const char* target_name, const char* overridden_target_name);
  48   ~TlsChannelSecurityConnector() override;
  49
  50   void add_handshakers(const grpc_channel_args* args,
  51                        grpc_pollset_set* interested_parties,
  52                        grpc_core::HandshakeManager* handshake_mgr) override;
  53
  54   void check_peer(tsi_peer peer, grpc_endpoint* ep,
  55                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
  56                   grpc_closure* on_peer_checked) override;
  57
  58   int cmp(const grpc_security_connector* other_sc) const override;
  59
  60   bool check_call_host(grpc_core::StringView host,
  61                        grpc_auth_context* auth_context,
  62                        grpc_closure* on_call_host_checked,
  63                        grpc_error** error) override;
  64
  65   void cancel_check_call_host(grpc_closure* on_call_host_checked,
  66                               grpc_error* error) override;
  67
  68  private:
  69   // Initialize SSL TSI client handshaker factory.
  70   grpc_security_status InitializeHandshakerFactory(
  71       tsi_ssl_session_cache* ssl_session_cache);
  72
  73   // A util function to create a new client handshaker factory to replace
  74   // the existing one if exists.
  75   grpc_security_status ReplaceHandshakerFactory(
  76       tsi_ssl_session_cache* ssl_session_cache);
  77
  78   // gRPC-provided callback executed by application, which servers to bring the
  79   // control back to gRPC core.
  80   static void ServerAuthorizationCheckDone(
  81       grpc_tls_server_authorization_check_arg* arg);
  82
  83   // A util function to process server authorization check result.
  84   static grpc_error* ProcessServerAuthorizationCheckResult(
  85       grpc_tls_server_authorization_check_arg* arg);
  86
  87   // A util function to create a server authorization check arg instance.
  88   static grpc_tls_server_authorization_check_arg*
  89   ServerAuthorizationCheckArgCreate(void* user_data);
  90
  91   // A util function to destroy a server authorization check arg instance.
  92   static void ServerAuthorizationCheckArgDestroy(
  93       grpc_tls_server_authorization_check_arg* arg);
  94
  95   // A util function to refresh SSL TSI client handshaker factory with a valid
  96   // credential.
  97   grpc_security_status RefreshHandshakerFactory();
  98
  99   grpc_core::Mutex mu_;
 100   grpc_closure* on_peer_checked_;
 101   grpc_core::UniquePtr<char> target_name_;
 102   grpc_core::UniquePtr<char> overridden_target_name_;
 103   tsi_ssl_client_handshaker_factory* client_handshaker_factory_ = nullptr;
 104   grpc_tls_server_authorization_check_arg* check_arg_;
 105   grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
 106 };
 107
 108 // TLS server security connector.
 109 class TlsServerSecurityConnector final : public grpc_server_security_connector {
 110  public:
 111   // static factory method to create a TLS server security connector.
 112   static grpc_core::RefCountedPtr<grpc_server_security_connector>
 113   CreateTlsServerSecurityConnector(
 114       grpc_core::RefCountedPtr<grpc_server_credentials> server_creds);
 115
 116   explicit TlsServerSecurityConnector(
 117       grpc_core::RefCountedPtr<grpc_server_credentials> server_creds);
 118   ~TlsServerSecurityConnector() override;
 119
 120   void add_handshakers(const grpc_channel_args* args,
 121                        grpc_pollset_set* interested_parties,
 122                        grpc_core::HandshakeManager* handshake_mgr) override;
 123
 124   void check_peer(tsi_peer peer, grpc_endpoint* ep,
 125                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
 126                   grpc_closure* on_peer_checked) override;
 127
 128   int cmp(const grpc_security_connector* other) const override;
 129
 130  private:
 131   // Initialize SSL TSI server handshaker factory.
 132   grpc_security_status InitializeHandshakerFactory();
 133
 134   // A util function to create a new server handshaker factory to replace the
 135   // existing once if exists.
 136   grpc_security_status ReplaceHandshakerFactory();
 137
 138   // A util function to refresh SSL TSI server handshaker factory with a valid
 139   // credential.
 140   grpc_security_status RefreshHandshakerFactory();
 141
 142   grpc_core::Mutex mu_;
 143   tsi_ssl_server_handshaker_factory* server_handshaker_factory_ = nullptr;
 144   grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
 145 };
 146
 147 // Exposed for testing only.
 148 grpc_status_code TlsFetchKeyMaterials(
 149     const grpc_core::RefCountedPtr<grpc_tls_key_materials_config>&
 150         key_materials_config,
 151     const grpc_tls_credentials_options& options, bool server_config,
 152     grpc_ssl_certificate_config_reload_status* status);
 153
 154 }  // namespace grpc_core
 155
 156 #endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H \
 157         */