test/core/end2end/h2_ssl_cert_test.cc

   1 /*
   2  *
   3  * Copyright 2015 gRPC authors.
   4  *
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  *
  17  */
  18
  19 #include "test/core/end2end/end2end_tests.h"
  20
  21 #include <stdio.h>
  22 #include <string.h>
  23
  24 #include <grpc/support/alloc.h>
  25 #include <grpc/support/log.h>
  26
  27 #include "src/core/lib/channel/channel_args.h"
  28 #include "src/core/lib/gpr/host_port.h"
  29 #include "src/core/lib/gpr/string.h"
  30 #include "src/core/lib/gpr/tmpfile.h"
  31 #include "src/core/lib/security/credentials/credentials.h"
  32 #include "src/core/lib/security/security_connector/ssl_utils.h"
  33 #include "test/core/end2end/cq_verifier.h"
  34 #include "test/core/end2end/data/ssl_test_data.h"
  35 #include "test/core/util/port.h"
  36 #include "test/core/util/test_config.h"
  37
  38 #include <gtest/gtest.h>
  39
  40 namespace grpc {
  41 namespace testing {
  42
  43 typedef struct fullstack_secure_fixture_data {
  44   char* localaddr;
  45 } fullstack_secure_fixture_data;
  46
  47 static grpc_end2end_test_fixture chttp2_create_fixture_secure_fullstack(
  48     grpc_channel_args* client_args, grpc_channel_args* server_args) {
  49   grpc_end2end_test_fixture f;
  50   int port = grpc_pick_unused_port_or_die();
  51   fullstack_secure_fixture_data* ffd =
  52       static_cast<fullstack_secure_fixture_data*>(
  53           gpr_malloc(sizeof(fullstack_secure_fixture_data)));
  54   memset(&f, 0, sizeof(f));
  55
  56   gpr_join_host_port(&ffd->localaddr, "localhost", port);
  57
  58   f.fixture_data = ffd;
  59   f.cq = grpc_completion_queue_create_for_next(nullptr);
  60   return f;
  61 }
  62
  63 static void process_auth_failure(void* state, grpc_auth_context* ctx,
  64                                  const grpc_metadata* md, size_t md_count,
  65                                  grpc_process_auth_metadata_done_cb cb,
  66                                  void* user_data) {
  67   GPR_ASSERT(state == nullptr);
  68   cb(user_data, nullptr, 0, nullptr, 0, GRPC_STATUS_UNAUTHENTICATED, nullptr);
  69 }
  70
  71 static void chttp2_init_client_secure_fullstack(
  72     grpc_end2end_test_fixture* f, grpc_channel_args* client_args,
  73     grpc_channel_credentials* creds) {
  74   fullstack_secure_fixture_data* ffd =
  75       static_cast<fullstack_secure_fixture_data*>(f->fixture_data);
  76   f->client =
  77       grpc_secure_channel_create(creds, ffd->localaddr, client_args, nullptr);
  78   GPR_ASSERT(f->client != nullptr);
  79   grpc_channel_credentials_release(creds);
  80 }
  81
  82 static void chttp2_init_server_secure_fullstack(
  83     grpc_end2end_test_fixture* f, grpc_channel_args* server_args,
  84     grpc_server_credentials* server_creds) {
  85   fullstack_secure_fixture_data* ffd =
  86       static_cast<fullstack_secure_fixture_data*>(f->fixture_data);
  87   if (f->server) {
  88     grpc_server_destroy(f->server);
  89   }
  90   f->server = grpc_server_create(server_args, nullptr);
  91   grpc_server_register_completion_queue(f->server, f->cq, nullptr);
  92   GPR_ASSERT(grpc_server_add_secure_http2_port(f->server, ffd->localaddr,
  93                                                server_creds));
  94   grpc_server_credentials_release(server_creds);
  95   grpc_server_start(f->server);
  96 }
  97
  98 void chttp2_tear_down_secure_fullstack(grpc_end2end_test_fixture* f) {
  99   fullstack_secure_fixture_data* ffd =
 100       static_cast<fullstack_secure_fixture_data*>(f->fixture_data);
 101   gpr_free(ffd->localaddr);
 102   gpr_free(ffd);
 103 }
 104
 105 static int fail_server_auth_check(grpc_channel_args* server_args) {
 106   size_t i;
 107   if (server_args == nullptr) return 0;
 108   for (i = 0; i < server_args->num_args; i++) {
 109     if (strcmp(server_args->args[i].key, FAIL_AUTH_CHECK_SERVER_ARG_NAME) ==
 110         0) {
 111       return 1;
 112     }
 113   }
 114   return 0;
 115 }
 116
 117 #define SERVER_INIT_NAME(REQUEST_TYPE) \
 118   chttp2_init_server_simple_ssl_secure_fullstack_##REQUEST_TYPE
 119
 120 #define SERVER_INIT(REQUEST_TYPE)                                           \
 121   static void SERVER_INIT_NAME(REQUEST_TYPE)(                               \
 122       grpc_end2end_test_fixture * f, grpc_channel_args * server_args) {     \
 123     grpc_ssl_pem_key_cert_pair pem_cert_key_pair = {test_server1_key,       \
 124                                                     test_server1_cert};     \
 125     grpc_server_credentials* ssl_creds =                                    \
 126         grpc_ssl_server_credentials_create_ex(                              \
 127             test_root_cert, &pem_cert_key_pair, 1, REQUEST_TYPE, NULL);     \
 128     if (fail_server_auth_check(server_args)) {                              \
 129       grpc_auth_metadata_processor processor = {process_auth_failure, NULL, \
 130                                                 NULL};                      \
 131       grpc_server_credentials_set_auth_metadata_processor(ssl_creds,        \
 132                                                           processor);       \
 133     }                                                                       \
 134     chttp2_init_server_secure_fullstack(f, server_args, ssl_creds);         \
 135   }
 136
 137 SERVER_INIT(GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE)
 138 SERVER_INIT(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY)
 139 SERVER_INIT(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY)
 140 SERVER_INIT(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY)
 141 SERVER_INIT(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY)
 142
 143 #define CLIENT_INIT_NAME(cert_type) \
 144   chttp2_init_client_simple_ssl_secure_fullstack_##cert_type
 145
 146 typedef enum { NONE, SELF_SIGNED, SIGNED, BAD_CERT_PAIR } certtype;
 147
 148 #define CLIENT_INIT(cert_type)                                               \
 149   static void CLIENT_INIT_NAME(cert_type)(grpc_end2end_test_fixture * f,     \
 150                                           grpc_channel_args * client_args) { \
 151     grpc_channel_credentials* ssl_creds = NULL;                              \
 152     grpc_ssl_pem_key_cert_pair self_signed_client_key_cert_pair = {          \
 153         test_self_signed_client_key, test_self_signed_client_cert};          \
 154     grpc_ssl_pem_key_cert_pair signed_client_key_cert_pair = {               \
 155         test_signed_client_key, test_signed_client_cert};                    \
 156     grpc_ssl_pem_key_cert_pair bad_client_key_cert_pair = {                  \
 157         test_self_signed_client_key, test_signed_client_cert};               \
 158     grpc_ssl_pem_key_cert_pair* key_cert_pair = NULL;                        \
 159     switch (cert_type) {                                                     \
 160       case SELF_SIGNED:                                                      \
 161         key_cert_pair = &self_signed_client_key_cert_pair;                   \
 162         break;                                                               \
 163       case SIGNED:                                                           \
 164         key_cert_pair = &signed_client_key_cert_pair;                        \
 165         break;                                                               \
 166       case BAD_CERT_PAIR:                                                    \
 167         key_cert_pair = &bad_client_key_cert_pair;                           \
 168         break;                                                               \
 169       default:                                                               \
 170         break;                                                               \
 171     }                                                                        \
 172     ssl_creds = grpc_ssl_credentials_create(test_root_cert, key_cert_pair,   \
 173                                             NULL, NULL);                     \
 174     grpc_arg ssl_name_override = {                                           \
 175         GRPC_ARG_STRING,                                                     \
 176         const_cast<char*>(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG),                \
 177         {const_cast<char*>("foo.test.google.fr")}};                          \
 178     grpc_channel_args* new_client_args =                                     \
 179         grpc_channel_args_copy_and_add(client_args, &ssl_name_override, 1);  \
 180     chttp2_init_client_secure_fullstack(f, new_client_args, ssl_creds);      \
 181     {                                                                        \
 182       grpc_core::ExecCtx exec_ctx;                                           \
 183       grpc_channel_args_destroy(new_client_args);                            \
 184     }                                                                        \
 185   }
 186
 187 CLIENT_INIT(NONE)
 188 CLIENT_INIT(SELF_SIGNED)
 189 CLIENT_INIT(SIGNED)
 190 CLIENT_INIT(BAD_CERT_PAIR)
 191
 192 #define TEST_NAME(enum_name, cert_type, result) \
 193   "chttp2/ssl_" #enum_name "_" #cert_type "_" #result "_"
 194
 195 typedef enum { SUCCESS, FAIL } test_result;
 196
 197 #define SSL_TEST(request_type, cert_type, result)     \
 198   {                                                   \
 199     {TEST_NAME(request_type, cert_type, result),      \
 200      FEATURE_MASK_SUPPORTS_DELAYED_CONNECTION |       \
 201          FEATURE_MASK_SUPPORTS_PER_CALL_CREDENTIALS | \
 202          FEATURE_MASK_SUPPORTS_CLIENT_CHANNEL,        \
 203      "foo.test.google.fr",                            \
 204      chttp2_create_fixture_secure_fullstack,          \
 205      CLIENT_INIT_NAME(cert_type),                     \
 206      SERVER_INIT_NAME(request_type),                  \
 207      chttp2_tear_down_secure_fullstack},              \
 208         result                                        \
 209   }
 210
 211 /* All test configurations */
 212 typedef struct grpc_end2end_test_config_wrapper {
 213   grpc_end2end_test_config config;
 214   test_result result;
 215 } grpc_end2end_test_config_wrapper;
 216
 217 static grpc_end2end_test_config_wrapper configs[] = {
 218     SSL_TEST(GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE, NONE, SUCCESS),
 219     SSL_TEST(GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE, SELF_SIGNED, SUCCESS),
 220     SSL_TEST(GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE, SIGNED, SUCCESS),
 221     SSL_TEST(GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE, BAD_CERT_PAIR, FAIL),
 222
 223     SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY, NONE,
 224              SUCCESS),
 225     SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY, SELF_SIGNED,
 226              SUCCESS),
 227     SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY, SIGNED,
 228              SUCCESS),
 229     SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY, BAD_CERT_PAIR,
 230              FAIL),
 231
 232     SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY, NONE, SUCCESS),
 233     SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY, SELF_SIGNED, FAIL),
 234     SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY, SIGNED, SUCCESS),
 235     SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY, BAD_CERT_PAIR,
 236              FAIL),
 237
 238     SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY,
 239              NONE, FAIL),
 240     SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY,
 241              SELF_SIGNED, SUCCESS),
 242     SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY,
 243              SIGNED, SUCCESS),
 244     SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY,
 245              BAD_CERT_PAIR, FAIL),
 246
 247     SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY, NONE,
 248              FAIL),
 249     SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY,
 250              SELF_SIGNED, FAIL),
 251     SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY, SIGNED,
 252              SUCCESS),
 253     SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY,
 254              BAD_CERT_PAIR, FAIL),
 255 };
 256
 257 static void* tag(intptr_t t) { return (void*)t; }
 258
 259 static gpr_timespec n_seconds_time(int n) {
 260   return grpc_timeout_seconds_to_deadline(n);
 261 }
 262
 263 static gpr_timespec five_seconds_time(void) { return n_seconds_time(5); }
 264
 265 static void drain_cq(grpc_completion_queue* cq) {
 266   grpc_event ev;
 267   do {
 268     ev = grpc_completion_queue_next(cq, five_seconds_time(), nullptr);
 269   } while (ev.type != GRPC_QUEUE_SHUTDOWN);
 270 }
 271
 272 // Shuts down the server.
 273 // Side effect - Also shuts down and drains the completion queue.
 274 static void shutdown_server(grpc_end2end_test_fixture* f) {
 275   if (!f->server) return;
 276   grpc_server_shutdown_and_notify(f->server, f->cq, tag(1000));
 277   grpc_completion_queue_shutdown(f->cq);
 278   drain_cq(f->cq);
 279   grpc_server_destroy(f->server);
 280   f->server = nullptr;
 281 }
 282
 283 static void shutdown_client(grpc_end2end_test_fixture* f) {
 284   if (!f->client) return;
 285   grpc_channel_destroy(f->client);
 286   f->client = nullptr;
 287 }
 288
 289 static void end_test(grpc_end2end_test_fixture* f) {
 290   shutdown_client(f);
 291   shutdown_server(f);
 292   grpc_completion_queue_destroy(f->cq);
 293 }
 294
 295 static void simple_request_body(grpc_end2end_test_fixture f,
 296                                 test_result expected_result) {
 297   grpc_call* c;
 298   gpr_timespec deadline = five_seconds_time();
 299   cq_verifier* cqv = cq_verifier_create(f.cq);
 300   grpc_op ops[6];
 301   grpc_op* op;
 302   grpc_call_error error;
 303
 304   grpc_slice host = grpc_slice_from_static_string("foo.test.google.fr:1234");
 305   c = grpc_channel_create_call(f.client, nullptr, GRPC_PROPAGATE_DEFAULTS, f.cq,
 306                                grpc_slice_from_static_string("/foo"), &host,
 307                                deadline, nullptr);
 308   GPR_ASSERT(c);
 309
 310   memset(ops, 0, sizeof(ops));
 311   op = ops;
 312   op->op = GRPC_OP_SEND_INITIAL_METADATA;
 313   op->data.send_initial_metadata.count = 0;
 314   op->flags = GRPC_INITIAL_METADATA_WAIT_FOR_READY;
 315   op->reserved = nullptr;
 316   op++;
 317   error = grpc_call_start_batch(c, ops, static_cast<size_t>(op - ops), tag(1),
 318                                 nullptr);
 319   GPR_ASSERT(GRPC_CALL_OK == error);
 320
 321   CQ_EXPECT_COMPLETION(cqv, tag(1), expected_result == SUCCESS);
 322   cq_verify(cqv);
 323
 324   grpc_call_unref(c);
 325   cq_verifier_destroy(cqv);
 326 }
 327
 328 class H2SslCertTest
 329     : public ::testing::TestWithParam<grpc_end2end_test_config_wrapper> {
 330  protected:
 331   H2SslCertTest() {
 332     gpr_log(GPR_INFO, "SSL_CERT_tests/%s", GetParam().config.name);
 333   }
 334   void SetUp() override {
 335     fixture_ = GetParam().config.create_fixture(nullptr, nullptr);
 336     GetParam().config.init_server(&fixture_, nullptr);
 337     GetParam().config.init_client(&fixture_, nullptr);
 338   }
 339   void TearDown() override {
 340     end_test(&fixture_);
 341     GetParam().config.tear_down_data(&fixture_);
 342   }
 343
 344   grpc_end2end_test_fixture fixture_;
 345 };
 346
 347 TEST_P(H2SslCertTest, SimpleRequestBody) {
 348   simple_request_body(fixture_, GetParam().result);
 349 }
 350
 351 INSTANTIATE_TEST_CASE_P(H2SslCert, H2SslCertTest, ::testing::ValuesIn(configs));
 352
 353 }  // namespace testing
 354 }  // namespace grpc
 355
 356 int main(int argc, char** argv) {
 357   FILE* roots_file;
 358   size_t roots_size = strlen(test_root_cert);
 359   char* roots_filename;
 360
 361   grpc::testing::TestEnvironment env(argc, argv);
 362   /* Set the SSL roots env var. */
 363   roots_file =
 364       gpr_tmpfile("chttp2_simple_ssl_cert_fullstack_test", &roots_filename);
 365   GPR_ASSERT(roots_filename != nullptr);
 366   GPR_ASSERT(roots_file != nullptr);
 367   GPR_ASSERT(fwrite(test_root_cert, 1, roots_size, roots_file) == roots_size);
 368   fclose(roots_file);
 369   GPR_GLOBAL_CONFIG_SET(grpc_default_ssl_roots_file_path, roots_filename);
 370
 371   grpc_init();
 372   ::testing::InitGoogleTest(&argc, argv);
 373   int ret = RUN_ALL_TESTS();
 374   grpc_shutdown();
 375
 376   /* Cleanup. */
 377   remove(roots_filename);
 378   gpr_free(roots_filename);
 379
 380   return ret;
 381 }