| /* |
| * |
| * Copyright 2015, Google Inc. |
| * All rights reserved. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions are |
| * met: |
| * |
| * * Redistributions of source code must retain the above copyright |
| * notice, this list of conditions and the following disclaimer. |
| * * Redistributions in binary form must reproduce the above |
| * copyright notice, this list of conditions and the following disclaimer |
| * in the documentation and/or other materials provided with the |
| * distribution. |
| * * Neither the name of Google Inc. nor the names of its |
| * contributors may be used to endorse or promote products derived from |
| * this software without specific prior written permission. |
| * |
| * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
| * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
| * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
| * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
| * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| * |
| */ |
| |
| #include "src/core/security/credentials.h" |
| |
| #include <string.h> |
| |
| #include "src/core/httpcli/httpcli.h" |
| #include "src/core/security/json_token.h" |
| #include "src/core/support/string.h" |
| #include <grpc/support/alloc.h> |
| #include <grpc/support/log.h> |
| #include <grpc/support/time.h> |
| #include "test/core/util/test_config.h" |
| #include <openssl/rsa.h> |
| |
| static const char test_iam_authorization_token[] = "blahblahblhahb"; |
| static const char test_iam_authority_selector[] = "respectmyauthoritah"; |
| static const char test_oauth2_bearer_token[] = |
| "Bearer blaaslkdjfaslkdfasdsfasf"; |
| static const char test_root_cert[] = "I am the root!"; |
| |
| /* This JSON key was generated with the GCE console and revoked immediately. |
| The identifiers have been changed as well. |
| Maximum size for a string literal is 509 chars in C89, yay! */ |
| static const char test_json_key_str_part1[] = |
| "{ \"private_key\": \"-----BEGIN PRIVATE KEY-----" |
| "\\nMIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOEvJsnoHnyHkXcp\\n7mJE" |
| "qg" |
| "WGjiw71NfXByguekSKho65FxaGbsnSM9SMQAqVk7Q2rG+I0OpsT0LrWQtZ\\nyjSeg/" |
| "rWBQvS4hle4LfijkP3J5BG+" |
| "IXDMP8RfziNRQsenAXDNPkY4kJCvKux2xdD\\nOnVF6N7dL3nTYZg+" |
| "uQrNsMTz9UxVAgMBAAECgYEAzbLewe1xe9vy+2GoSsfib+28\\nDZgSE6Bu/" |
| "zuFoPrRc6qL9p2SsnV7txrunTyJkkOnPLND9ABAXybRTlcVKP/sGgza\\n/" |
| "8HpCqFYM9V8f34SBWfD4fRFT+n/" |
| "73cfRUtGXdXpseva2lh8RilIQfPhNZAncenU\\ngqXjDvpkypEusgXAykECQQD+"; |
| static const char test_json_key_str_part2[] = |
| "53XxNVnxBHsYb+AYEfklR96yVi8HywjVHP34+OQZ\\nCslxoHQM8s+" |
| "dBnjfScLu22JqkPv04xyxmt0QAKm9+vTdAkEA4ib7YvEAn2jXzcCI\\nEkoy2L/" |
| "XydR1GCHoacdfdAwiL2npOdnbvi4ZmdYRPY1LSTO058tQHKVXV7NLeCa3\\nAARh2QJBAMKeDA" |
| "G" |
| "W303SQv2cZTdbeaLKJbB5drz3eo3j7dDKjrTD9JupixFbzcGw\\n8FZi5c8idxiwC36kbAL6Hz" |
| "A" |
| "ZoX+ofI0CQE6KCzPJTtYNqyShgKAZdJ8hwOcvCZtf\\n6z8RJm0+" |
| "6YBd38lfh5j8mZd7aHFf6I17j5AQY7oPEc47TjJj/" |
| "5nZ68ECQQDvYuI3\\nLyK5fS8g0SYbmPOL9TlcHDOqwG0mrX9qpg5DC2fniXNSrrZ64GTDKdzZ" |
| "Y" |
| "Ap6LI9W\\nIqv4vr6y38N79TTC\\n-----END PRIVATE KEY-----\\n\", "; |
| static const char test_json_key_str_part3[] = |
| "\"private_key_id\": \"e6b5137873db8d2ef81e06a47289e6434ec8a165\", " |
| "\"client_email\": " |
| "\"777-abaslkan11hlb6nmim3bpspl31ud@developer.gserviceaccount." |
| "com\", \"client_id\": " |
| "\"777-abaslkan11hlb6nmim3bpspl31ud.apps.googleusercontent." |
| "com\", \"type\": \"service_account\" }"; |
| |
| /* Test refresh token. */ |
| static const char test_refresh_token_str[] = |
| "{ \"client_id\": \"32555999999.apps.googleusercontent.com\"," |
| " \"client_secret\": \"EmssLNjJy1332hD4KFsecret\"," |
| " \"refresh_token\": \"1/Blahblasj424jladJDSGNf-u4Sua3HDA2ngjd42\"," |
| " \"type\": \"authorized_user\"}"; |
| |
| static const char valid_oauth2_json_response[] = |
| "{\"access_token\":\"ya29.AHES6ZRN3-HlhAPya30GnW_bHSb_\"," |
| " \"expires_in\":3599, " |
| " \"token_type\":\"Bearer\"}"; |
| |
| static const char test_user_data[] = "user data"; |
| |
| static const char test_scope[] = "perm1 perm2"; |
| |
| static const char test_signed_jwt[] = |
| "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImY0OTRkN2M1YWU2MGRmOTcyNmM4YW" |
| "U0MDcyZTViYTdmZDkwODg2YzcifQ"; |
| |
| static const char test_service_url[] = "https://foo.com/foo.v1"; |
| static const char other_test_service_url[] = "https://bar.com/bar.v1"; |
| |
| static char *test_json_key_str(void) { |
| size_t result_len = strlen(test_json_key_str_part1) + |
| strlen(test_json_key_str_part2) + |
| strlen(test_json_key_str_part3); |
| char *result = gpr_malloc(result_len + 1); |
| char *current = result; |
| strcpy(result, test_json_key_str_part1); |
| current += strlen(test_json_key_str_part1); |
| strcpy(current, test_json_key_str_part2); |
| current += strlen(test_json_key_str_part2); |
| strcpy(current, test_json_key_str_part3); |
| return result; |
| } |
| |
| typedef struct { |
| const char *key; |
| const char *value; |
| } expected_md; |
| |
| static grpc_httpcli_response http_response(int status, const char *body) { |
| grpc_httpcli_response response; |
| memset(&response, 0, sizeof(grpc_httpcli_response)); |
| response.status = status; |
| response.body = (char *)body; |
| response.body_length = strlen(body); |
| return response; |
| } |
| |
| static void test_oauth2_token_fetcher_creds_parsing_ok(void) { |
| grpc_mdctx *ctx = grpc_mdctx_create(); |
| grpc_mdelem *token_elem = NULL; |
| gpr_timespec token_lifetime; |
| grpc_httpcli_response response = |
| http_response(200, valid_oauth2_json_response); |
| GPR_ASSERT(grpc_oauth2_token_fetcher_credentials_parse_server_response( |
| &response, ctx, &token_elem, &token_lifetime) == |
| GRPC_CREDENTIALS_OK); |
| GPR_ASSERT(token_lifetime.tv_sec == 3599); |
| GPR_ASSERT(token_lifetime.tv_nsec == 0); |
| GPR_ASSERT(strcmp(grpc_mdstr_as_c_string(token_elem->key), |
| "Authorization") == 0); |
| GPR_ASSERT(strcmp(grpc_mdstr_as_c_string(token_elem->value), |
| "Bearer ya29.AHES6ZRN3-HlhAPya30GnW_bHSb_") == 0); |
| grpc_mdelem_unref(token_elem); |
| grpc_mdctx_unref(ctx); |
| } |
| |
| static void test_oauth2_token_fetcher_creds_parsing_bad_http_status(void) { |
| grpc_mdctx *ctx = grpc_mdctx_create(); |
| grpc_mdelem *token_elem = NULL; |
| gpr_timespec token_lifetime; |
| grpc_httpcli_response response = |
| http_response(401, valid_oauth2_json_response); |
| GPR_ASSERT(grpc_oauth2_token_fetcher_credentials_parse_server_response( |
| &response, ctx, &token_elem, &token_lifetime) == |
| GRPC_CREDENTIALS_ERROR); |
| grpc_mdctx_unref(ctx); |
| } |
| |
| static void test_oauth2_token_fetcher_creds_parsing_empty_http_body(void) { |
| grpc_mdctx *ctx = grpc_mdctx_create(); |
| grpc_mdelem *token_elem = NULL; |
| gpr_timespec token_lifetime; |
| grpc_httpcli_response response = http_response(200, ""); |
| GPR_ASSERT(grpc_oauth2_token_fetcher_credentials_parse_server_response( |
| &response, ctx, &token_elem, &token_lifetime) == |
| GRPC_CREDENTIALS_ERROR); |
| grpc_mdctx_unref(ctx); |
| } |
| |
| static void test_oauth2_token_fetcher_creds_parsing_invalid_json(void) { |
| grpc_mdctx *ctx = grpc_mdctx_create(); |
| grpc_mdelem *token_elem = NULL; |
| gpr_timespec token_lifetime; |
| grpc_httpcli_response response = |
| http_response(200, |
| "{\"access_token\":\"ya29.AHES6ZRN3-HlhAPya30GnW_bHSb_\"," |
| " \"expires_in\":3599, " |
| " \"token_type\":\"Bearer\""); |
| GPR_ASSERT(grpc_oauth2_token_fetcher_credentials_parse_server_response( |
| &response, ctx, &token_elem, &token_lifetime) == |
| GRPC_CREDENTIALS_ERROR); |
| grpc_mdctx_unref(ctx); |
| } |
| |
| static void test_oauth2_token_fetcher_creds_parsing_missing_token(void) { |
| grpc_mdctx *ctx = grpc_mdctx_create(); |
| grpc_mdelem *token_elem = NULL; |
| gpr_timespec token_lifetime; |
| grpc_httpcli_response response = http_response(200, |
| "{" |
| " \"expires_in\":3599, " |
| " \"token_type\":\"Bearer\"}"); |
| GPR_ASSERT(grpc_oauth2_token_fetcher_credentials_parse_server_response( |
| &response, ctx, &token_elem, &token_lifetime) == |
| GRPC_CREDENTIALS_ERROR); |
| grpc_mdctx_unref(ctx); |
| } |
| |
| static void test_oauth2_token_fetcher_creds_parsing_missing_token_type(void) { |
| grpc_mdctx *ctx = grpc_mdctx_create(); |
| grpc_mdelem *token_elem = NULL; |
| gpr_timespec token_lifetime; |
| grpc_httpcli_response response = |
| http_response(200, |
| "{\"access_token\":\"ya29.AHES6ZRN3-HlhAPya30GnW_bHSb_\"," |
| " \"expires_in\":3599, " |
| "}"); |
| GPR_ASSERT(grpc_oauth2_token_fetcher_credentials_parse_server_response( |
| &response, ctx, &token_elem, &token_lifetime) == |
| GRPC_CREDENTIALS_ERROR); |
| grpc_mdctx_unref(ctx); |
| } |
| |
| static void test_oauth2_token_fetcher_creds_parsing_missing_token_lifetime( |
| void) { |
| grpc_mdctx *ctx = grpc_mdctx_create(); |
| grpc_mdelem *token_elem = NULL; |
| gpr_timespec token_lifetime; |
| grpc_httpcli_response response = |
| http_response(200, |
| "{\"access_token\":\"ya29.AHES6ZRN3-HlhAPya30GnW_bHSb_\"," |
| " \"token_type\":\"Bearer\"}"); |
| GPR_ASSERT(grpc_oauth2_token_fetcher_credentials_parse_server_response( |
| &response, ctx, &token_elem, &token_lifetime) == |
| GRPC_CREDENTIALS_ERROR); |
| grpc_mdctx_unref(ctx); |
| } |
| |
| static void check_metadata(expected_md *expected, grpc_mdelem **md_elems, |
| size_t num_md) { |
| size_t i; |
| for (i = 0; i < num_md; i++) { |
| size_t j; |
| for (j = 0; j < num_md; j++) { |
| if (0 == gpr_slice_str_cmp(md_elems[j]->key->slice, expected[i].key)) { |
| GPR_ASSERT(0 == gpr_slice_str_cmp(md_elems[j]->value->slice, |
| expected[i].value)); |
| break; |
| } |
| } |
| if (j == num_md) { |
| gpr_log(GPR_ERROR, "key %s not found", expected[i].key); |
| GPR_ASSERT(0); |
| } |
| } |
| } |
| |
| static void check_iam_metadata(void *user_data, grpc_mdelem **md_elems, |
| size_t num_md, grpc_credentials_status status) { |
| grpc_credentials *c = (grpc_credentials *)user_data; |
| expected_md emd[] = { |
| {GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY, test_iam_authorization_token}, |
| {GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY, test_iam_authority_selector}}; |
| GPR_ASSERT(status == GRPC_CREDENTIALS_OK); |
| GPR_ASSERT(num_md == 2); |
| check_metadata(emd, md_elems, num_md); |
| grpc_credentials_unref(c); |
| } |
| |
| static void test_iam_creds(void) { |
| grpc_credentials *creds = grpc_iam_credentials_create( |
| test_iam_authorization_token, test_iam_authority_selector); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(creds)); |
| GPR_ASSERT(grpc_credentials_has_request_metadata_only(creds)); |
| grpc_credentials_get_request_metadata(creds, test_service_url, |
| check_iam_metadata, creds); |
| } |
| |
| static void check_ssl_oauth2_composite_metadata( |
| void *user_data, grpc_mdelem **md_elems, size_t num_md, |
| grpc_credentials_status status) { |
| grpc_credentials *c = (grpc_credentials *)user_data; |
| expected_md emd[] = { |
| {GRPC_AUTHORIZATION_METADATA_KEY, test_oauth2_bearer_token}}; |
| GPR_ASSERT(status == GRPC_CREDENTIALS_OK); |
| GPR_ASSERT(num_md == 1); |
| check_metadata(emd, md_elems, num_md); |
| grpc_credentials_unref(c); |
| } |
| |
| static void test_ssl_oauth2_composite_creds(void) { |
| grpc_credentials *ssl_creds = |
| grpc_ssl_credentials_create(test_root_cert, NULL); |
| const grpc_credentials_array *creds_array; |
| grpc_credentials *oauth2_creds = |
| grpc_fake_oauth2_credentials_create(test_oauth2_bearer_token, 0); |
| grpc_credentials *composite_creds = |
| grpc_composite_credentials_create(ssl_creds, oauth2_creds); |
| grpc_credentials_unref(ssl_creds); |
| grpc_credentials_unref(oauth2_creds); |
| GPR_ASSERT(strcmp(composite_creds->type, |
| GRPC_CREDENTIALS_TYPE_COMPOSITE) == 0); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(composite_creds)); |
| GPR_ASSERT(!grpc_credentials_has_request_metadata_only(composite_creds)); |
| creds_array = grpc_composite_credentials_get_credentials(composite_creds); |
| GPR_ASSERT(creds_array->num_creds == 2); |
| GPR_ASSERT(strcmp(creds_array->creds_array[0]->type, |
| GRPC_CREDENTIALS_TYPE_SSL) == 0); |
| GPR_ASSERT(strcmp(creds_array->creds_array[1]->type, |
| GRPC_CREDENTIALS_TYPE_OAUTH2) == 0); |
| grpc_credentials_get_request_metadata(composite_creds, test_service_url, |
| check_ssl_oauth2_composite_metadata, |
| composite_creds); |
| } |
| |
| static void check_ssl_oauth2_iam_composite_metadata( |
| void *user_data, grpc_mdelem **md_elems, size_t num_md, |
| grpc_credentials_status status) { |
| grpc_credentials *c = (grpc_credentials *)user_data; |
| expected_md emd[] = { |
| {GRPC_AUTHORIZATION_METADATA_KEY, test_oauth2_bearer_token}, |
| {GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY, test_iam_authorization_token}, |
| {GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY, test_iam_authority_selector}}; |
| GPR_ASSERT(status == GRPC_CREDENTIALS_OK); |
| GPR_ASSERT(num_md == 3); |
| check_metadata(emd, md_elems, num_md); |
| grpc_credentials_unref(c); |
| } |
| |
| static void test_ssl_oauth2_iam_composite_creds(void) { |
| grpc_credentials *ssl_creds = |
| grpc_ssl_credentials_create(test_root_cert, NULL); |
| const grpc_credentials_array *creds_array; |
| grpc_credentials *oauth2_creds = |
| grpc_fake_oauth2_credentials_create(test_oauth2_bearer_token, 0); |
| grpc_credentials *aux_creds = |
| grpc_composite_credentials_create(ssl_creds, oauth2_creds); |
| grpc_credentials *iam_creds = grpc_iam_credentials_create( |
| test_iam_authorization_token, test_iam_authority_selector); |
| grpc_credentials *composite_creds = |
| grpc_composite_credentials_create(aux_creds, iam_creds); |
| grpc_credentials_unref(ssl_creds); |
| grpc_credentials_unref(oauth2_creds); |
| grpc_credentials_unref(aux_creds); |
| grpc_credentials_unref(iam_creds); |
| GPR_ASSERT(strcmp(composite_creds->type, |
| GRPC_CREDENTIALS_TYPE_COMPOSITE) == 0); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(composite_creds)); |
| GPR_ASSERT(!grpc_credentials_has_request_metadata_only(composite_creds)); |
| creds_array = grpc_composite_credentials_get_credentials(composite_creds); |
| GPR_ASSERT(creds_array->num_creds == 3); |
| GPR_ASSERT(strcmp(creds_array->creds_array[0]->type, |
| GRPC_CREDENTIALS_TYPE_SSL) == 0); |
| GPR_ASSERT(strcmp(creds_array->creds_array[1]->type, |
| GRPC_CREDENTIALS_TYPE_OAUTH2) == 0); |
| GPR_ASSERT(strcmp(creds_array->creds_array[2]->type, |
| GRPC_CREDENTIALS_TYPE_IAM) == 0); |
| grpc_credentials_get_request_metadata(composite_creds, test_service_url, |
| check_ssl_oauth2_iam_composite_metadata, |
| composite_creds); |
| } |
| |
| static void on_oauth2_creds_get_metadata_success( |
| void *user_data, grpc_mdelem **md_elems, size_t num_md, |
| grpc_credentials_status status) { |
| GPR_ASSERT(status == GRPC_CREDENTIALS_OK); |
| GPR_ASSERT(num_md == 1); |
| GPR_ASSERT(strcmp(grpc_mdstr_as_c_string(md_elems[0]->key), |
| "Authorization") == 0); |
| GPR_ASSERT(strcmp(grpc_mdstr_as_c_string(md_elems[0]->value), |
| "Bearer ya29.AHES6ZRN3-HlhAPya30GnW_bHSb_") == 0); |
| GPR_ASSERT(user_data != NULL); |
| GPR_ASSERT(strcmp((const char *)user_data, test_user_data) == 0); |
| } |
| |
| static void on_oauth2_creds_get_metadata_failure( |
| void *user_data, grpc_mdelem **md_elems, size_t num_md, |
| grpc_credentials_status status) { |
| GPR_ASSERT(status == GRPC_CREDENTIALS_ERROR); |
| GPR_ASSERT(num_md == 0); |
| GPR_ASSERT(user_data != NULL); |
| GPR_ASSERT(strcmp((const char *)user_data, test_user_data) == 0); |
| } |
| |
| static void validate_compute_engine_http_request( |
| const grpc_httpcli_request *request) { |
| GPR_ASSERT(!request->use_ssl); |
| GPR_ASSERT(strcmp(request->host, "metadata") == 0); |
| GPR_ASSERT(strcmp(request->path, |
| "/computeMetadata/v1/instance/service-accounts/default/token") |
| == 0); |
| GPR_ASSERT(request->hdr_count == 1); |
| GPR_ASSERT(strcmp(request->hdrs[0].key, "Metadata-Flavor") == 0); |
| GPR_ASSERT(strcmp(request->hdrs[0].value, "Google") == 0); |
| } |
| |
| static int compute_engine_httpcli_get_success_override( |
| const grpc_httpcli_request *request, gpr_timespec deadline, |
| grpc_httpcli_response_cb on_response, void *user_data) { |
| grpc_httpcli_response response = |
| http_response(200, valid_oauth2_json_response); |
| validate_compute_engine_http_request(request); |
| on_response(user_data, &response); |
| return 1; |
| } |
| |
| static int compute_engine_httpcli_get_failure_override( |
| const grpc_httpcli_request *request, gpr_timespec deadline, |
| grpc_httpcli_response_cb on_response, void *user_data) { |
| grpc_httpcli_response response = http_response(403, "Not Authorized."); |
| validate_compute_engine_http_request(request); |
| on_response(user_data, &response); |
| return 1; |
| } |
| |
| static int httpcli_post_should_not_be_called( |
| const grpc_httpcli_request *request, const char *body_bytes, |
| size_t body_size, gpr_timespec deadline, |
| grpc_httpcli_response_cb on_response, void *user_data) { |
| GPR_ASSERT("HTTP POST should not be called" == NULL); |
| return 1; |
| } |
| |
| static int httpcli_get_should_not_be_called( |
| const grpc_httpcli_request *request, gpr_timespec deadline, |
| grpc_httpcli_response_cb on_response, void *user_data) { |
| GPR_ASSERT("HTTP GET should not be called" == NULL); |
| return 1; |
| } |
| |
| static void test_compute_engine_creds_success(void) { |
| grpc_credentials *compute_engine_creds = |
| grpc_compute_engine_credentials_create(); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(compute_engine_creds)); |
| GPR_ASSERT(grpc_credentials_has_request_metadata_only(compute_engine_creds)); |
| |
| /* First request: http get should be called. */ |
| grpc_httpcli_set_override(compute_engine_httpcli_get_success_override, |
| httpcli_post_should_not_be_called); |
| grpc_credentials_get_request_metadata(compute_engine_creds, test_service_url, |
| on_oauth2_creds_get_metadata_success, |
| (void *)test_user_data); |
| |
| /* Second request: the cached token should be served directly. */ |
| grpc_httpcli_set_override(httpcli_get_should_not_be_called, |
| httpcli_post_should_not_be_called); |
| grpc_credentials_get_request_metadata(compute_engine_creds, test_service_url, |
| on_oauth2_creds_get_metadata_success, |
| (void *)test_user_data); |
| |
| grpc_credentials_unref(compute_engine_creds); |
| grpc_httpcli_set_override(NULL, NULL); |
| } |
| |
| static void test_compute_engine_creds_failure(void) { |
| grpc_credentials *compute_engine_creds = |
| grpc_compute_engine_credentials_create(); |
| grpc_httpcli_set_override(compute_engine_httpcli_get_failure_override, |
| httpcli_post_should_not_be_called); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(compute_engine_creds)); |
| GPR_ASSERT(grpc_credentials_has_request_metadata_only(compute_engine_creds)); |
| grpc_credentials_get_request_metadata(compute_engine_creds, test_service_url, |
| on_oauth2_creds_get_metadata_failure, |
| (void *)test_user_data); |
| grpc_credentials_unref(compute_engine_creds); |
| grpc_httpcli_set_override(NULL, NULL); |
| } |
| |
| static void validate_refresh_token_http_request( |
| const grpc_httpcli_request *request, const char *body, size_t body_size) { |
| /* The content of the assertion is tested extensively in json_token_test. */ |
| char *expected_body = NULL; |
| GPR_ASSERT(body != NULL); |
| GPR_ASSERT(body_size != 0); |
| gpr_asprintf(&expected_body, GRPC_REFRESH_TOKEN_POST_BODY_FORMAT_STRING, |
| "32555999999.apps.googleusercontent.com", |
| "EmssLNjJy1332hD4KFsecret", |
| "1/Blahblasj424jladJDSGNf-u4Sua3HDA2ngjd42"); |
| GPR_ASSERT(strlen(expected_body) == body_size); |
| GPR_ASSERT(memcmp(expected_body, body, body_size) == 0); |
| gpr_free(expected_body); |
| GPR_ASSERT(request->use_ssl); |
| GPR_ASSERT(strcmp(request->host, GRPC_GOOGLE_OAUTH2_SERVICE_HOST) == 0); |
| GPR_ASSERT(strcmp(request->path, GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH) == 0); |
| GPR_ASSERT(request->hdr_count == 1); |
| GPR_ASSERT(strcmp(request->hdrs[0].key, "Content-Type") == 0); |
| GPR_ASSERT(strcmp(request->hdrs[0].value, |
| "application/x-www-form-urlencoded") == 0); |
| } |
| |
| static int refresh_token_httpcli_post_success( |
| const grpc_httpcli_request *request, const char *body, size_t body_size, |
| gpr_timespec deadline, grpc_httpcli_response_cb on_response, |
| void *user_data) { |
| grpc_httpcli_response response = |
| http_response(200, valid_oauth2_json_response); |
| validate_refresh_token_http_request(request, body, body_size); |
| on_response(user_data, &response); |
| return 1; |
| } |
| |
| static int refresh_token_httpcli_post_failure( |
| const grpc_httpcli_request *request, const char *body, size_t body_size, |
| gpr_timespec deadline, grpc_httpcli_response_cb on_response, |
| void *user_data) { |
| grpc_httpcli_response response = http_response(403, "Not Authorized."); |
| validate_refresh_token_http_request(request, body, body_size); |
| on_response(user_data, &response); |
| return 1; |
| } |
| |
| static void test_refresh_token_creds_success(void) { |
| grpc_credentials *refresh_token_creds = |
| grpc_refresh_token_credentials_create(test_refresh_token_str); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(refresh_token_creds)); |
| GPR_ASSERT(grpc_credentials_has_request_metadata_only(refresh_token_creds)); |
| |
| /* First request: http get should be called. */ |
| grpc_httpcli_set_override(httpcli_get_should_not_be_called, |
| refresh_token_httpcli_post_success); |
| grpc_credentials_get_request_metadata(refresh_token_creds, test_service_url, |
| on_oauth2_creds_get_metadata_success, |
| (void *)test_user_data); |
| |
| /* Second request: the cached token should be served directly. */ |
| grpc_httpcli_set_override(httpcli_get_should_not_be_called, |
| httpcli_post_should_not_be_called); |
| grpc_credentials_get_request_metadata(refresh_token_creds, test_service_url, |
| on_oauth2_creds_get_metadata_success, |
| (void *)test_user_data); |
| |
| grpc_credentials_unref(refresh_token_creds); |
| grpc_httpcli_set_override(NULL, NULL); |
| } |
| |
| static void test_refresh_token_creds_failure(void) { |
| grpc_credentials *refresh_token_creds = |
| grpc_refresh_token_credentials_create(test_refresh_token_str); |
| grpc_httpcli_set_override(httpcli_get_should_not_be_called, |
| refresh_token_httpcli_post_failure); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(refresh_token_creds)); |
| GPR_ASSERT(grpc_credentials_has_request_metadata_only(refresh_token_creds)); |
| grpc_credentials_get_request_metadata(refresh_token_creds, test_service_url, |
| on_oauth2_creds_get_metadata_failure, |
| (void *)test_user_data); |
| grpc_credentials_unref(refresh_token_creds); |
| grpc_httpcli_set_override(NULL, NULL); |
| } |
| |
| static void validate_jwt_encode_and_sign_params( |
| const grpc_auth_json_key *json_key, const char *scope, |
| gpr_timespec token_lifetime) { |
| GPR_ASSERT(grpc_auth_json_key_is_valid(json_key)); |
| GPR_ASSERT(json_key->private_key != NULL); |
| GPR_ASSERT(RSA_check_key(json_key->private_key)); |
| GPR_ASSERT(json_key->type != NULL && |
| strcmp(json_key->type, "service_account") == 0); |
| GPR_ASSERT(json_key->private_key_id != NULL && |
| strcmp(json_key->private_key_id, |
| "e6b5137873db8d2ef81e06a47289e6434ec8a165") == 0); |
| GPR_ASSERT(json_key->client_id != NULL && |
| strcmp(json_key->client_id, |
| "777-abaslkan11hlb6nmim3bpspl31ud.apps." |
| "googleusercontent.com") == 0); |
| GPR_ASSERT(json_key->client_email != NULL && |
| strcmp(json_key->client_email, |
| "777-abaslkan11hlb6nmim3bpspl31ud@developer." |
| "gserviceaccount.com") == 0); |
| if (scope != NULL) GPR_ASSERT(strcmp(scope, test_scope) == 0); |
| GPR_ASSERT(!gpr_time_cmp(token_lifetime, grpc_max_auth_token_lifetime)); |
| } |
| |
| static char *encode_and_sign_jwt_success(const grpc_auth_json_key *json_key, |
| const char *audience, |
| gpr_timespec token_lifetime, |
| const char *scope) { |
| validate_jwt_encode_and_sign_params(json_key, scope, token_lifetime); |
| return gpr_strdup(test_signed_jwt); |
| } |
| |
| static char *encode_and_sign_jwt_failure(const grpc_auth_json_key *json_key, |
| const char *audience, |
| gpr_timespec token_lifetime, |
| const char *scope) { |
| validate_jwt_encode_and_sign_params(json_key, scope, token_lifetime); |
| return NULL; |
| } |
| |
| static char *encode_and_sign_jwt_should_not_be_called( |
| const grpc_auth_json_key *json_key, const char *audience, |
| gpr_timespec token_lifetime, const char *scope) { |
| GPR_ASSERT("grpc_jwt_encode_and_sign should not be called" == NULL); |
| } |
| |
| static void validate_service_account_http_request( |
| const grpc_httpcli_request *request, const char *body, size_t body_size) { |
| /* The content of the assertion is tested extensively in json_token_test. */ |
| char *expected_body = NULL; |
| GPR_ASSERT(body != NULL); |
| GPR_ASSERT(body_size != 0); |
| gpr_asprintf(&expected_body, "%s%s", |
| GRPC_SERVICE_ACCOUNT_POST_BODY_PREFIX, test_signed_jwt); |
| GPR_ASSERT(strlen(expected_body) == body_size); |
| GPR_ASSERT(memcmp(expected_body, body, body_size) == 0); |
| gpr_free(expected_body); |
| GPR_ASSERT(request->use_ssl); |
| GPR_ASSERT(strcmp(request->host, GRPC_GOOGLE_OAUTH2_SERVICE_HOST) == 0); |
| GPR_ASSERT(strcmp(request->path, GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH) == 0); |
| GPR_ASSERT(request->hdr_count == 1); |
| GPR_ASSERT(strcmp(request->hdrs[0].key, "Content-Type") == 0); |
| GPR_ASSERT(strcmp(request->hdrs[0].value, |
| "application/x-www-form-urlencoded") == 0); |
| } |
| |
| static int service_account_httpcli_post_success( |
| const grpc_httpcli_request *request, const char *body, size_t body_size, |
| gpr_timespec deadline, grpc_httpcli_response_cb on_response, |
| void *user_data) { |
| grpc_httpcli_response response = |
| http_response(200, valid_oauth2_json_response); |
| validate_service_account_http_request(request, body, body_size); |
| on_response(user_data, &response); |
| return 1; |
| } |
| |
| static int service_account_httpcli_post_failure( |
| const grpc_httpcli_request *request, const char *body, size_t body_size, |
| gpr_timespec deadline, grpc_httpcli_response_cb on_response, |
| void *user_data) { |
| grpc_httpcli_response response = http_response(403, "Not Authorized."); |
| validate_service_account_http_request(request, body, body_size); |
| on_response(user_data, &response); |
| return 1; |
| } |
| |
| static void test_service_account_creds_success(void) { |
| char *json_key_string = test_json_key_str(); |
| grpc_credentials *service_account_creds = |
| grpc_service_account_credentials_create(json_key_string, test_scope, |
| grpc_max_auth_token_lifetime); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(service_account_creds)); |
| GPR_ASSERT(grpc_credentials_has_request_metadata_only(service_account_creds)); |
| |
| /* First request: http get should be called. */ |
| grpc_jwt_encode_and_sign_set_override(encode_and_sign_jwt_success); |
| grpc_httpcli_set_override(httpcli_get_should_not_be_called, |
| service_account_httpcli_post_success); |
| grpc_credentials_get_request_metadata(service_account_creds, test_service_url, |
| on_oauth2_creds_get_metadata_success, |
| (void *)test_user_data); |
| |
| /* Second request: the cached token should be served directly. */ |
| grpc_jwt_encode_and_sign_set_override( |
| encode_and_sign_jwt_should_not_be_called); |
| grpc_httpcli_set_override(httpcli_get_should_not_be_called, |
| httpcli_post_should_not_be_called); |
| grpc_credentials_get_request_metadata(service_account_creds, test_service_url, |
| on_oauth2_creds_get_metadata_success, |
| (void *)test_user_data); |
| |
| gpr_free(json_key_string); |
| grpc_credentials_unref(service_account_creds); |
| grpc_jwt_encode_and_sign_set_override(NULL); |
| grpc_httpcli_set_override(NULL, NULL); |
| } |
| |
| static void test_service_account_creds_http_failure(void) { |
| char *json_key_string = test_json_key_str(); |
| grpc_credentials *service_account_creds = |
| grpc_service_account_credentials_create(json_key_string, test_scope, |
| grpc_max_auth_token_lifetime); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(service_account_creds)); |
| GPR_ASSERT(grpc_credentials_has_request_metadata_only(service_account_creds)); |
| |
| grpc_jwt_encode_and_sign_set_override(encode_and_sign_jwt_success); |
| grpc_httpcli_set_override(httpcli_get_should_not_be_called, |
| service_account_httpcli_post_failure); |
| grpc_credentials_get_request_metadata(service_account_creds, test_service_url, |
| on_oauth2_creds_get_metadata_failure, |
| (void *)test_user_data); |
| |
| gpr_free(json_key_string); |
| grpc_credentials_unref(service_account_creds); |
| grpc_httpcli_set_override(NULL, NULL); |
| } |
| |
| static void test_service_account_creds_signing_failure(void) { |
| char *json_key_string = test_json_key_str(); |
| grpc_credentials *service_account_creds = |
| grpc_service_account_credentials_create(json_key_string, test_scope, |
| grpc_max_auth_token_lifetime); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(service_account_creds)); |
| GPR_ASSERT(grpc_credentials_has_request_metadata_only(service_account_creds)); |
| |
| grpc_jwt_encode_and_sign_set_override(encode_and_sign_jwt_failure); |
| grpc_httpcli_set_override(httpcli_get_should_not_be_called, |
| httpcli_post_should_not_be_called); |
| grpc_credentials_get_request_metadata(service_account_creds, test_service_url, |
| on_oauth2_creds_get_metadata_failure, |
| (void *)test_user_data); |
| |
| gpr_free(json_key_string); |
| grpc_credentials_unref(service_account_creds); |
| grpc_httpcli_set_override(NULL, NULL); |
| grpc_jwt_encode_and_sign_set_override(NULL); |
| } |
| |
| static void on_jwt_creds_get_metadata_success(void *user_data, |
| grpc_mdelem **md_elems, |
| size_t num_md, |
| grpc_credentials_status status) { |
| char *expected_md_value; |
| gpr_asprintf(&expected_md_value, "Bearer %s", test_signed_jwt); |
| GPR_ASSERT(status == GRPC_CREDENTIALS_OK); |
| GPR_ASSERT(num_md == 1); |
| GPR_ASSERT(strcmp(grpc_mdstr_as_c_string(md_elems[0]->key), |
| "Authorization") == 0); |
| GPR_ASSERT(strcmp(grpc_mdstr_as_c_string(md_elems[0]->value), |
| expected_md_value) == 0); |
| GPR_ASSERT(user_data != NULL); |
| GPR_ASSERT(strcmp((const char *)user_data, test_user_data) == 0); |
| gpr_free(expected_md_value); |
| } |
| |
| static void on_jwt_creds_get_metadata_failure(void *user_data, |
| grpc_mdelem **md_elems, |
| size_t num_md, |
| grpc_credentials_status status) { |
| GPR_ASSERT(status == GRPC_CREDENTIALS_ERROR); |
| GPR_ASSERT(num_md == 0); |
| GPR_ASSERT(user_data != NULL); |
| GPR_ASSERT(strcmp((const char *)user_data, test_user_data) == 0); |
| } |
| |
| static void test_jwt_creds_success(void) { |
| char *json_key_string = test_json_key_str(); |
| grpc_credentials *jwt_creds = grpc_jwt_credentials_create( |
| json_key_string, grpc_max_auth_token_lifetime); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(jwt_creds)); |
| GPR_ASSERT(grpc_credentials_has_request_metadata_only(jwt_creds)); |
| |
| /* First request: jwt_encode_and_sign should be called. */ |
| grpc_jwt_encode_and_sign_set_override(encode_and_sign_jwt_success); |
| grpc_credentials_get_request_metadata(jwt_creds, test_service_url, |
| on_jwt_creds_get_metadata_success, |
| (void *)test_user_data); |
| |
| /* Second request: the cached token should be served directly. */ |
| grpc_jwt_encode_and_sign_set_override( |
| encode_and_sign_jwt_should_not_be_called); |
| grpc_credentials_get_request_metadata(jwt_creds, test_service_url, |
| on_jwt_creds_get_metadata_success, |
| (void *)test_user_data); |
| |
| /* Third request: Different service url so jwt_encode_and_sign should be |
| called again (no caching). */ |
| grpc_jwt_encode_and_sign_set_override(encode_and_sign_jwt_success); |
| grpc_credentials_get_request_metadata(jwt_creds, other_test_service_url, |
| on_jwt_creds_get_metadata_success, |
| (void *)test_user_data); |
| |
| gpr_free(json_key_string); |
| grpc_credentials_unref(jwt_creds); |
| grpc_jwt_encode_and_sign_set_override(NULL); |
| } |
| |
| static void test_jwt_creds_signing_failure(void) { |
| char *json_key_string = test_json_key_str(); |
| grpc_credentials *jwt_creds = grpc_jwt_credentials_create( |
| json_key_string, grpc_max_auth_token_lifetime); |
| GPR_ASSERT(grpc_credentials_has_request_metadata(jwt_creds)); |
| GPR_ASSERT(grpc_credentials_has_request_metadata_only(jwt_creds)); |
| |
| grpc_jwt_encode_and_sign_set_override(encode_and_sign_jwt_failure); |
| grpc_credentials_get_request_metadata(jwt_creds, test_service_url, |
| on_jwt_creds_get_metadata_failure, |
| (void *)test_user_data); |
| |
| gpr_free(json_key_string); |
| grpc_credentials_unref(jwt_creds); |
| grpc_jwt_encode_and_sign_set_override(NULL); |
| } |
| |
| int main(int argc, char **argv) { |
| grpc_test_init(argc, argv); |
| test_oauth2_token_fetcher_creds_parsing_ok(); |
| test_oauth2_token_fetcher_creds_parsing_bad_http_status(); |
| test_oauth2_token_fetcher_creds_parsing_empty_http_body(); |
| test_oauth2_token_fetcher_creds_parsing_invalid_json(); |
| test_oauth2_token_fetcher_creds_parsing_missing_token(); |
| test_oauth2_token_fetcher_creds_parsing_missing_token_type(); |
| test_oauth2_token_fetcher_creds_parsing_missing_token_lifetime(); |
| test_iam_creds(); |
| test_ssl_oauth2_composite_creds(); |
| test_ssl_oauth2_iam_composite_creds(); |
| test_compute_engine_creds_success(); |
| test_compute_engine_creds_failure(); |
| test_refresh_token_creds_success(); |
| test_refresh_token_creds_failure(); |
| test_service_account_creds_success(); |
| test_service_account_creds_http_failure(); |
| test_service_account_creds_signing_failure(); |
| test_jwt_creds_success(); |
| test_jwt_creds_signing_failure(); |
| return 0; |
| } |