test/core/end2end/tests/call_creds.cc

   1 /*
   2  *
   3  * Copyright 2015 gRPC authors.
   4  *
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  *
  17  */
  18
  19 #include "test/core/end2end/end2end_tests.h"
  20
  21 #include <stdio.h>
  22 #include <string.h>
  23
  24 #include <grpc/byte_buffer.h>
  25 #include <grpc/grpc_security.h>
  26 #include <grpc/support/alloc.h>
  27 #include <grpc/support/log.h>
  28 #include <grpc/support/time.h>
  29
  30 #include "src/core/lib/gpr/string.h"
  31 #include "src/core/lib/security/credentials/credentials.h"
  32 #include "test/core/end2end/cq_verifier.h"
  33
  34 static const char iam_token[] = "token";
  35 static const char iam_selector[] = "selector";
  36 static const char overridden_iam_token[] = "overridden_token";
  37 static const char overridden_iam_selector[] = "overridden_selector";
  38
  39 typedef enum { NONE, OVERRIDE, DESTROY, FAIL } override_mode;
  40
  41 static void* tag(intptr_t t) { return (void*)t; }
  42
  43 static grpc_end2end_test_fixture begin_test(grpc_end2end_test_config config,
  44                                             const char* test_name,
  45                                             int fail_server_auth_check) {
  46   grpc_end2end_test_fixture f;
  47   gpr_log(GPR_INFO, "Running test: %s/%s", test_name, config.name);
  48   f = config.create_fixture(nullptr, nullptr);
  49   config.init_client(&f, nullptr);
  50   if (fail_server_auth_check) {
  51     grpc_arg fail_auth_arg = {
  52         GRPC_ARG_STRING,
  53         const_cast<char*>(FAIL_AUTH_CHECK_SERVER_ARG_NAME),
  54         {nullptr}};
  55     grpc_channel_args args;
  56     args.num_args = 1;
  57     args.args = &fail_auth_arg;
  58     config.init_server(&f, &args);
  59   } else {
  60     config.init_server(&f, nullptr);
  61   }
  62   return f;
  63 }
  64
  65 static gpr_timespec n_seconds_from_now(int n) {
  66   return grpc_timeout_seconds_to_deadline(n);
  67 }
  68
  69 static gpr_timespec five_seconds_from_now(void) {
  70   return n_seconds_from_now(5);
  71 }
  72
  73 static void drain_cq(grpc_completion_queue* cq) {
  74   grpc_event ev;
  75   do {
  76     ev = grpc_completion_queue_next(cq, five_seconds_from_now(), nullptr);
  77   } while (ev.type != GRPC_QUEUE_SHUTDOWN);
  78 }
  79
  80 static void shutdown_server(grpc_end2end_test_fixture* f) {
  81   if (!f->server) return;
  82   grpc_server_shutdown_and_notify(f->server, f->shutdown_cq, tag(1000));
  83   GPR_ASSERT(grpc_completion_queue_pluck(f->shutdown_cq, tag(1000),
  84                                          grpc_timeout_seconds_to_deadline(5),
  85                                          nullptr)
  86                  .type == GRPC_OP_COMPLETE);
  87   grpc_server_destroy(f->server);
  88   f->server = nullptr;
  89 }
  90
  91 static void shutdown_client(grpc_end2end_test_fixture* f) {
  92   if (!f->client) return;
  93   grpc_channel_destroy(f->client);
  94   f->client = nullptr;
  95 }
  96
  97 static void end_test(grpc_end2end_test_fixture* f) {
  98   shutdown_server(f);
  99   shutdown_client(f);
 100
 101   grpc_completion_queue_shutdown(f->cq);
 102   drain_cq(f->cq);
 103   grpc_completion_queue_destroy(f->cq);
 104   grpc_completion_queue_destroy(f->shutdown_cq);
 105 }
 106
 107 static void print_auth_context(int is_client, const grpc_auth_context* ctx) {
 108   const grpc_auth_property* p;
 109   grpc_auth_property_iterator it;
 110   gpr_log(GPR_INFO, "%s peer:", is_client ? "client" : "server");
 111   gpr_log(GPR_INFO, "\tauthenticated: %s",
 112           grpc_auth_context_peer_is_authenticated(ctx) ? "YES" : "NO");
 113   it = grpc_auth_context_peer_identity(ctx);
 114   while ((p = grpc_auth_property_iterator_next(&it)) != nullptr) {
 115     gpr_log(GPR_INFO, "\t\t%s: %s", p->name, p->value);
 116   }
 117   gpr_log(GPR_INFO, "\tall properties:");
 118   it = grpc_auth_context_property_iterator(ctx);
 119   while ((p = grpc_auth_property_iterator_next(&it)) != nullptr) {
 120     gpr_log(GPR_INFO, "\t\t%s: %s", p->name, p->value);
 121   }
 122 }
 123
 124 static void request_response_with_payload_and_call_creds(
 125     const char* test_name, grpc_end2end_test_config config,
 126     override_mode mode) {
 127   grpc_call* c;
 128   grpc_call* s;
 129   grpc_slice request_payload_slice =
 130       grpc_slice_from_copied_string("hello world");
 131   grpc_slice response_payload_slice =
 132       grpc_slice_from_copied_string("hello you");
 133   grpc_byte_buffer* request_payload =
 134       grpc_raw_byte_buffer_create(&request_payload_slice, 1);
 135   grpc_byte_buffer* response_payload =
 136       grpc_raw_byte_buffer_create(&response_payload_slice, 1);
 137   grpc_end2end_test_fixture f;
 138   cq_verifier* cqv;
 139   grpc_op ops[6];
 140   grpc_op* op;
 141   grpc_metadata_array initial_metadata_recv;
 142   grpc_metadata_array trailing_metadata_recv;
 143   grpc_metadata_array request_metadata_recv;
 144   grpc_byte_buffer* request_payload_recv = nullptr;
 145   grpc_byte_buffer* response_payload_recv = nullptr;
 146   grpc_call_details call_details;
 147   grpc_status_code status;
 148   grpc_call_error error;
 149   grpc_slice details;
 150   int was_cancelled = 2;
 151   grpc_call_credentials* creds = nullptr;
 152   grpc_auth_context* s_auth_context = nullptr;
 153   grpc_auth_context* c_auth_context = nullptr;
 154
 155   f = begin_test(config, test_name, 0);
 156   cqv = cq_verifier_create(f.cq);
 157
 158   gpr_timespec deadline = five_seconds_from_now();
 159   c = grpc_channel_create_call(f.client, nullptr, GRPC_PROPAGATE_DEFAULTS, f.cq,
 160                                grpc_slice_from_static_string("/foo"), nullptr,
 161                                deadline, nullptr);
 162   GPR_ASSERT(c);
 163   creds = grpc_google_iam_credentials_create(iam_token, iam_selector, nullptr);
 164   GPR_ASSERT(creds != nullptr);
 165   GPR_ASSERT(grpc_call_set_credentials(c, creds) == GRPC_CALL_OK);
 166   switch (mode) {
 167     case NONE:
 168       break;
 169     case OVERRIDE:
 170       grpc_call_credentials_release(creds);
 171       creds = grpc_google_iam_credentials_create(
 172           overridden_iam_token, overridden_iam_selector, nullptr);
 173       GPR_ASSERT(creds != nullptr);
 174       GPR_ASSERT(grpc_call_set_credentials(c, creds) == GRPC_CALL_OK);
 175       break;
 176     case DESTROY:
 177     case FAIL:
 178       GPR_ASSERT(grpc_call_set_credentials(c, nullptr) == GRPC_CALL_OK);
 179       break;
 180   }
 181   grpc_call_credentials_release(creds);
 182
 183   grpc_metadata_array_init(&initial_metadata_recv);
 184   grpc_metadata_array_init(&trailing_metadata_recv);
 185   grpc_metadata_array_init(&request_metadata_recv);
 186   grpc_call_details_init(&call_details);
 187
 188   memset(ops, 0, sizeof(ops));
 189   op = ops;
 190   op->op = GRPC_OP_SEND_INITIAL_METADATA;
 191   op->data.send_initial_metadata.count = 0;
 192   op->flags = 0;
 193   op->reserved = nullptr;
 194   op++;
 195   op->op = GRPC_OP_SEND_MESSAGE;
 196   op->data.send_message.send_message = request_payload;
 197   op->flags = 0;
 198   op->reserved = nullptr;
 199   op++;
 200   op->op = GRPC_OP_SEND_CLOSE_FROM_CLIENT;
 201   op->flags = 0;
 202   op->reserved = nullptr;
 203   op++;
 204   op->op = GRPC_OP_RECV_INITIAL_METADATA;
 205   op->data.recv_initial_metadata.recv_initial_metadata = &initial_metadata_recv;
 206   op->flags = 0;
 207   op->reserved = nullptr;
 208   op++;
 209   op->op = GRPC_OP_RECV_MESSAGE;
 210   op->data.recv_message.recv_message = &response_payload_recv;
 211   op->flags = 0;
 212   op->reserved = nullptr;
 213   op++;
 214   op->op = GRPC_OP_RECV_STATUS_ON_CLIENT;
 215   op->data.recv_status_on_client.trailing_metadata = &trailing_metadata_recv;
 216   op->data.recv_status_on_client.status = &status;
 217   op->data.recv_status_on_client.status_details = &details;
 218   op->flags = 0;
 219   op->reserved = nullptr;
 220   op++;
 221   error = grpc_call_start_batch(c, ops, static_cast<size_t>(op - ops), tag(1),
 222                                 nullptr);
 223   GPR_ASSERT(GRPC_CALL_OK == error);
 224
 225   error =
 226       grpc_server_request_call(f.server, &s, &call_details,
 227                                &request_metadata_recv, f.cq, f.cq, tag(101));
 228   GPR_ASSERT(GRPC_CALL_OK == error);
 229   CQ_EXPECT_COMPLETION(cqv, tag(101), 1);
 230   cq_verify(cqv);
 231   s_auth_context = grpc_call_auth_context(s);
 232   GPR_ASSERT(s_auth_context != nullptr);
 233   print_auth_context(0, s_auth_context);
 234   grpc_auth_context_release(s_auth_context);
 235
 236   c_auth_context = grpc_call_auth_context(c);
 237   GPR_ASSERT(c_auth_context != nullptr);
 238   print_auth_context(1, c_auth_context);
 239   grpc_auth_context_release(c_auth_context);
 240
 241   /* Cannot set creds on the server call object. */
 242   GPR_ASSERT(grpc_call_set_credentials(s, nullptr) != GRPC_CALL_OK);
 243
 244   memset(ops, 0, sizeof(ops));
 245   op = ops;
 246   op->op = GRPC_OP_SEND_INITIAL_METADATA;
 247   op->data.send_initial_metadata.count = 0;
 248   op->flags = 0;
 249   op->reserved = nullptr;
 250   op++;
 251   op->op = GRPC_OP_RECV_MESSAGE;
 252   op->data.recv_message.recv_message = &request_payload_recv;
 253   op->flags = 0;
 254   op->reserved = nullptr;
 255   op++;
 256   error = grpc_call_start_batch(s, ops, static_cast<size_t>(op - ops), tag(102),
 257                                 nullptr);
 258   GPR_ASSERT(GRPC_CALL_OK == error);
 259
 260   CQ_EXPECT_COMPLETION(cqv, tag(102), 1);
 261   cq_verify(cqv);
 262
 263   memset(ops, 0, sizeof(ops));
 264   op = ops;
 265   op->op = GRPC_OP_RECV_CLOSE_ON_SERVER;
 266   op->data.recv_close_on_server.cancelled = &was_cancelled;
 267   op->flags = 0;
 268   op->reserved = nullptr;
 269   op++;
 270   op->op = GRPC_OP_SEND_MESSAGE;
 271   op->data.send_message.send_message = response_payload;
 272   op->flags = 0;
 273   op->reserved = nullptr;
 274   op++;
 275   op->op = GRPC_OP_SEND_STATUS_FROM_SERVER;
 276   op->data.send_status_from_server.trailing_metadata_count = 0;
 277   op->data.send_status_from_server.status = GRPC_STATUS_OK;
 278   grpc_slice status_details = grpc_slice_from_static_string("xyz");
 279   op->data.send_status_from_server.status_details = &status_details;
 280   op->flags = 0;
 281   op->reserved = nullptr;
 282   op++;
 283   error = grpc_call_start_batch(s, ops, static_cast<size_t>(op - ops), tag(103),
 284                                 nullptr);
 285   GPR_ASSERT(GRPC_CALL_OK == error);
 286
 287   CQ_EXPECT_COMPLETION(cqv, tag(103), 1);
 288   CQ_EXPECT_COMPLETION(cqv, tag(1), 1);
 289   cq_verify(cqv);
 290
 291   GPR_ASSERT(status == GRPC_STATUS_OK);
 292   GPR_ASSERT(0 == grpc_slice_str_cmp(details, "xyz"));
 293   GPR_ASSERT(0 == grpc_slice_str_cmp(call_details.method, "/foo"));
 294   GPR_ASSERT(was_cancelled == 0);
 295   GPR_ASSERT(byte_buffer_eq_string(request_payload_recv, "hello world"));
 296   GPR_ASSERT(byte_buffer_eq_string(response_payload_recv, "hello you"));
 297
 298   switch (mode) {
 299     case NONE:
 300       GPR_ASSERT(contains_metadata(&request_metadata_recv,
 301                                    GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
 302                                    iam_token));
 303       GPR_ASSERT(contains_metadata(&request_metadata_recv,
 304                                    GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
 305                                    iam_selector));
 306       break;
 307     case OVERRIDE:
 308       GPR_ASSERT(contains_metadata(&request_metadata_recv,
 309                                    GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
 310                                    overridden_iam_token));
 311       GPR_ASSERT(contains_metadata(&request_metadata_recv,
 312                                    GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
 313                                    overridden_iam_selector));
 314       break;
 315     case DESTROY:
 316     case FAIL:
 317       GPR_ASSERT(!contains_metadata(&request_metadata_recv,
 318                                     GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
 319                                     iam_token));
 320       GPR_ASSERT(!contains_metadata(&request_metadata_recv,
 321                                     GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
 322                                     iam_selector));
 323       GPR_ASSERT(!contains_metadata(&request_metadata_recv,
 324                                     GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
 325                                     overridden_iam_token));
 326       GPR_ASSERT(!contains_metadata(&request_metadata_recv,
 327                                     GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
 328                                     overridden_iam_selector));
 329       break;
 330   }
 331
 332   grpc_slice_unref(details);
 333   grpc_metadata_array_destroy(&initial_metadata_recv);
 334   grpc_metadata_array_destroy(&trailing_metadata_recv);
 335   grpc_metadata_array_destroy(&request_metadata_recv);
 336   grpc_call_details_destroy(&call_details);
 337
 338   grpc_call_unref(c);
 339   grpc_call_unref(s);
 340
 341   cq_verifier_destroy(cqv);
 342
 343   grpc_byte_buffer_destroy(request_payload);
 344   grpc_byte_buffer_destroy(response_payload);
 345   grpc_byte_buffer_destroy(request_payload_recv);
 346   grpc_byte_buffer_destroy(response_payload_recv);
 347
 348   end_test(&f);
 349   config.tear_down_data(&f);
 350 }
 351
 352 static void test_request_response_with_payload_and_call_creds(
 353     grpc_end2end_test_config config) {
 354   request_response_with_payload_and_call_creds(
 355       "test_request_response_with_payload_and_call_creds", config, NONE);
 356 }
 357
 358 static void test_request_response_with_payload_and_overridden_call_creds(
 359     grpc_end2end_test_config config) {
 360   request_response_with_payload_and_call_creds(
 361       "test_request_response_with_payload_and_overridden_call_creds", config,
 362       OVERRIDE);
 363 }
 364
 365 static void test_request_response_with_payload_and_deleted_call_creds(
 366     grpc_end2end_test_config config) {
 367   request_response_with_payload_and_call_creds(
 368       "test_request_response_with_payload_and_deleted_call_creds", config,
 369       DESTROY);
 370 }
 371
 372 static void test_request_response_with_payload_fail_to_send_call_creds(
 373     grpc_end2end_test_config config) {
 374   request_response_with_payload_and_call_creds(
 375       "test_request_response_with_payload_fail_to_send_call_creds", config,
 376       FAIL);
 377 }
 378
 379 static void test_request_with_server_rejecting_client_creds(
 380     grpc_end2end_test_config config) {
 381   grpc_op ops[6];
 382   grpc_op* op;
 383   grpc_call* c;
 384   grpc_end2end_test_fixture f;
 385   gpr_timespec deadline = five_seconds_from_now();
 386   cq_verifier* cqv;
 387   grpc_metadata_array initial_metadata_recv;
 388   grpc_metadata_array trailing_metadata_recv;
 389   grpc_metadata_array request_metadata_recv;
 390   grpc_call_details call_details;
 391   grpc_status_code status;
 392   grpc_call_error error;
 393   grpc_slice details;
 394   grpc_byte_buffer* response_payload_recv = nullptr;
 395   grpc_slice request_payload_slice =
 396       grpc_slice_from_copied_string("hello world");
 397   grpc_byte_buffer* request_payload =
 398       grpc_raw_byte_buffer_create(&request_payload_slice, 1);
 399   grpc_call_credentials* creds;
 400
 401   f = begin_test(config, "test_request_with_server_rejecting_client_creds", 1);
 402   cqv = cq_verifier_create(f.cq);
 403
 404   c = grpc_channel_create_call(f.client, nullptr, GRPC_PROPAGATE_DEFAULTS, f.cq,
 405                                grpc_slice_from_static_string("/foo"), nullptr,
 406                                deadline, nullptr);
 407   GPR_ASSERT(c);
 408
 409   creds = grpc_google_iam_credentials_create(iam_token, iam_selector, nullptr);
 410   GPR_ASSERT(creds != nullptr);
 411   GPR_ASSERT(grpc_call_set_credentials(c, creds) == GRPC_CALL_OK);
 412   grpc_call_credentials_release(creds);
 413
 414   grpc_metadata_array_init(&initial_metadata_recv);
 415   grpc_metadata_array_init(&trailing_metadata_recv);
 416   grpc_metadata_array_init(&request_metadata_recv);
 417   grpc_call_details_init(&call_details);
 418
 419   memset(ops, 0, sizeof(ops));
 420   op = ops;
 421   op->op = GRPC_OP_RECV_STATUS_ON_CLIENT;
 422   op->data.recv_status_on_client.trailing_metadata = &trailing_metadata_recv;
 423   op->data.recv_status_on_client.status = &status;
 424   op->data.recv_status_on_client.status_details = &details;
 425   op->flags = 0;
 426   op->reserved = nullptr;
 427   op++;
 428   op->op = GRPC_OP_SEND_INITIAL_METADATA;
 429   op->data.send_initial_metadata.count = 0;
 430   op->flags = 0;
 431   op->reserved = nullptr;
 432   op++;
 433   op->op = GRPC_OP_SEND_MESSAGE;
 434   op->data.send_message.send_message = request_payload;
 435   op->flags = 0;
 436   op->reserved = nullptr;
 437   op++;
 438   op->op = GRPC_OP_SEND_CLOSE_FROM_CLIENT;
 439   op->flags = 0;
 440   op->reserved = nullptr;
 441   op++;
 442   op->op = GRPC_OP_RECV_INITIAL_METADATA;
 443   op->data.recv_initial_metadata.recv_initial_metadata = &initial_metadata_recv;
 444   op->flags = 0;
 445   op->reserved = nullptr;
 446   op++;
 447   op->op = GRPC_OP_RECV_MESSAGE;
 448   op->data.recv_message.recv_message = &response_payload_recv;
 449   op->flags = 0;
 450   op->reserved = nullptr;
 451   op++;
 452   error = grpc_call_start_batch(c, ops, static_cast<size_t>(op - ops), tag(1),
 453                                 nullptr);
 454   GPR_ASSERT(error == GRPC_CALL_OK);
 455
 456   CQ_EXPECT_COMPLETION(cqv, tag(1), 1);
 457   cq_verify(cqv);
 458
 459   GPR_ASSERT(status == GRPC_STATUS_UNAUTHENTICATED);
 460
 461   grpc_metadata_array_destroy(&initial_metadata_recv);
 462   grpc_metadata_array_destroy(&trailing_metadata_recv);
 463   grpc_metadata_array_destroy(&request_metadata_recv);
 464   grpc_call_details_destroy(&call_details);
 465
 466   grpc_byte_buffer_destroy(request_payload);
 467   grpc_byte_buffer_destroy(response_payload_recv);
 468   grpc_slice_unref(details);
 469
 470   grpc_call_unref(c);
 471
 472   cq_verifier_destroy(cqv);
 473   end_test(&f);
 474   config.tear_down_data(&f);
 475 }
 476
 477 void call_creds(grpc_end2end_test_config config) {
 478   if (config.feature_mask & FEATURE_MASK_SUPPORTS_PER_CALL_CREDENTIALS) {
 479     test_request_response_with_payload_and_call_creds(config);
 480     test_request_response_with_payload_and_overridden_call_creds(config);
 481     test_request_response_with_payload_and_deleted_call_creds(config);
 482     test_request_with_server_rejecting_client_creds(config);
 483   }
 484   if (config.feature_mask &
 485       FEATURE_MASK_DOES_NOT_SUPPORT_SEND_CALL_CREDENTIALS) {
 486     test_request_response_with_payload_fail_to_send_call_creds(config);
 487   }
 488 }
 489
 490 void call_creds_pre_init(void) {}