Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 1 | /* |
| 2 | * |
Craig Tiller | 0605995 | 2015-02-18 08:34:56 -0800 | [diff] [blame] | 3 | * Copyright 2015, Google Inc. |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 4 | * All rights reserved. |
| 5 | * |
| 6 | * Redistribution and use in source and binary forms, with or without |
| 7 | * modification, are permitted provided that the following conditions are |
| 8 | * met: |
| 9 | * |
| 10 | * * Redistributions of source code must retain the above copyright |
| 11 | * notice, this list of conditions and the following disclaimer. |
| 12 | * * Redistributions in binary form must reproduce the above |
| 13 | * copyright notice, this list of conditions and the following disclaimer |
| 14 | * in the documentation and/or other materials provided with the |
| 15 | * distribution. |
| 16 | * * Neither the name of Google Inc. nor the names of its |
| 17 | * contributors may be used to endorse or promote products derived from |
| 18 | * this software without specific prior written permission. |
| 19 | * |
| 20 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| 21 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| 22 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
| 23 | * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
| 24 | * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| 25 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
| 26 | * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| 27 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| 28 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 29 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
| 30 | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 31 | * |
| 32 | */ |
| 33 | |
Julien Boeuf | c6f8d0a | 2015-05-11 22:40:02 -0700 | [diff] [blame] | 34 | #include "src/core/security/auth_filters.h" |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 35 | |
| 36 | #include <string.h> |
| 37 | |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 38 | #include <grpc/support/alloc.h> |
| 39 | #include <grpc/support/log.h> |
Masood Malekghassemi | 701af60 | 2015-06-03 15:01:17 -0700 | [diff] [blame] | 40 | #include <grpc/support/string_util.h> |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 41 | |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 42 | #include "src/core/support/string.h" |
| 43 | #include "src/core/channel/channel_stack.h" |
Julien Boeuf | d7f768b | 2015-05-08 16:37:16 -0700 | [diff] [blame] | 44 | #include "src/core/security/security_context.h" |
Julien Boeuf | 7d1d9ca | 2015-04-17 14:38:48 -0700 | [diff] [blame] | 45 | #include "src/core/security/security_connector.h" |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 46 | #include "src/core/security/credentials.h" |
| 47 | #include "src/core/surface/call.h" |
| 48 | |
Craig Tiller | 9c9d4e0 | 2015-04-20 09:03:29 -0700 | [diff] [blame] | 49 | #define MAX_CREDENTIALS_METADATA_COUNT 4 |
Craig Tiller | 6902ad2 | 2015-04-16 08:01:49 -0700 | [diff] [blame] | 50 | |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 51 | /* We can have a per-call credentials. */ |
| 52 | typedef struct { |
| 53 | grpc_credentials *creds; |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 54 | grpc_mdstr *host; |
Julien Boeuf | f47a5cb | 2015-02-18 12:24:08 -0800 | [diff] [blame] | 55 | grpc_mdstr *method; |
Craig Tiller | 6174b9a | 2015-06-18 08:13:05 -0700 | [diff] [blame] | 56 | /* pollset bound to this call; if we need to make external |
| 57 | network requests, they should be done under this pollset |
| 58 | so that work can progress when this call wants work to |
| 59 | progress */ |
Craig Tiller | 06bac34 | 2015-06-01 12:55:57 -0700 | [diff] [blame] | 60 | grpc_pollset *pollset; |
Craig Tiller | b7959a0 | 2015-06-25 08:50:54 -0700 | [diff] [blame] | 61 | grpc_transport_stream_op op; |
Craig Tiller | 6e84aba | 2015-04-23 15:08:17 -0700 | [diff] [blame] | 62 | size_t op_md_idx; |
| 63 | int sent_initial_metadata; |
yang-g | d8c466e | 2015-06-30 09:50:53 -0700 | [diff] [blame] | 64 | gpr_uint8 security_context_set; |
Craig Tiller | 9c9d4e0 | 2015-04-20 09:03:29 -0700 | [diff] [blame] | 65 | grpc_linked_mdelem md_links[MAX_CREDENTIALS_METADATA_COUNT]; |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 66 | } call_data; |
| 67 | |
| 68 | /* We can have a per-channel credentials. */ |
| 69 | typedef struct { |
Julien Boeuf | 7d1d9ca | 2015-04-17 14:38:48 -0700 | [diff] [blame] | 70 | grpc_channel_security_connector *security_connector; |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 71 | grpc_mdctx *md_ctx; |
| 72 | grpc_mdstr *authority_string; |
Julien Boeuf | f47a5cb | 2015-02-18 12:24:08 -0800 | [diff] [blame] | 73 | grpc_mdstr *path_string; |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 74 | grpc_mdstr *error_msg_key; |
Craig Tiller | eb131bb | 2015-03-03 11:00:40 -0800 | [diff] [blame] | 75 | grpc_mdstr *status_key; |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 76 | } channel_data; |
| 77 | |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 78 | static void bubble_up_error(grpc_call_element *elem, const char *error_msg) { |
| 79 | call_data *calld = elem->call_data; |
| 80 | channel_data *chand = elem->channel_data; |
Craig Tiller | b7959a0 | 2015-06-25 08:50:54 -0700 | [diff] [blame] | 81 | grpc_transport_stream_op_add_cancellation( |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 82 | &calld->op, GRPC_STATUS_UNAUTHENTICATED, |
| 83 | grpc_mdstr_from_string(chand->md_ctx, error_msg)); |
| 84 | grpc_call_next_op(elem, &calld->op); |
| 85 | } |
| 86 | |
Julien Boeuf | 75c9b6f | 2015-05-29 13:12:12 -0700 | [diff] [blame] | 87 | static void on_credentials_metadata(void *user_data, |
| 88 | grpc_credentials_md *md_elems, |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 89 | size_t num_md, |
| 90 | grpc_credentials_status status) { |
| 91 | grpc_call_element *elem = (grpc_call_element *)user_data; |
Craig Tiller | 6902ad2 | 2015-04-16 08:01:49 -0700 | [diff] [blame] | 92 | call_data *calld = elem->call_data; |
Julien Boeuf | 75c9b6f | 2015-05-29 13:12:12 -0700 | [diff] [blame] | 93 | channel_data *chand = elem->channel_data; |
Craig Tiller | b7959a0 | 2015-06-25 08:50:54 -0700 | [diff] [blame] | 94 | grpc_transport_stream_op *op = &calld->op; |
Craig Tiller | 6e84aba | 2015-04-23 15:08:17 -0700 | [diff] [blame] | 95 | grpc_metadata_batch *mdb; |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 96 | size_t i; |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 97 | if (status != GRPC_CREDENTIALS_OK) { |
| 98 | bubble_up_error(elem, "Credentials failed to get metadata."); |
| 99 | return; |
| 100 | } |
Craig Tiller | 9c9d4e0 | 2015-04-20 09:03:29 -0700 | [diff] [blame] | 101 | GPR_ASSERT(num_md <= MAX_CREDENTIALS_METADATA_COUNT); |
Craig Tiller | 1a727fd | 2015-04-24 13:21:22 -0700 | [diff] [blame] | 102 | GPR_ASSERT(op->send_ops && op->send_ops->nops > calld->op_md_idx && |
| 103 | op->send_ops->ops[calld->op_md_idx].type == GRPC_OP_METADATA); |
Craig Tiller | 6e84aba | 2015-04-23 15:08:17 -0700 | [diff] [blame] | 104 | mdb = &op->send_ops->ops[calld->op_md_idx].data.metadata; |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 105 | for (i = 0; i < num_md; i++) { |
Julien Boeuf | 75c9b6f | 2015-05-29 13:12:12 -0700 | [diff] [blame] | 106 | grpc_metadata_batch_add_tail( |
| 107 | mdb, &calld->md_links[i], |
| 108 | grpc_mdelem_from_slices(chand->md_ctx, gpr_slice_ref(md_elems[i].key), |
| 109 | gpr_slice_ref(md_elems[i].value))); |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 110 | } |
Craig Tiller | 6e84aba | 2015-04-23 15:08:17 -0700 | [diff] [blame] | 111 | grpc_call_next_op(elem, op); |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 112 | } |
| 113 | |
Julien Boeuf | f47a5cb | 2015-02-18 12:24:08 -0800 | [diff] [blame] | 114 | static char *build_service_url(const char *url_scheme, call_data *calld) { |
| 115 | char *service_url; |
| 116 | char *service = gpr_strdup(grpc_mdstr_as_c_string(calld->method)); |
| 117 | char *last_slash = strrchr(service, '/'); |
| 118 | if (last_slash == NULL) { |
| 119 | gpr_log(GPR_ERROR, "No '/' found in fully qualified method name"); |
| 120 | service[0] = '\0'; |
| 121 | } else if (last_slash == service) { |
| 122 | /* No service part in fully qualified method name: will just be "/". */ |
| 123 | service[1] = '\0'; |
| 124 | } else { |
| 125 | *last_slash = '\0'; |
| 126 | } |
| 127 | if (url_scheme == NULL) url_scheme = ""; |
| 128 | gpr_asprintf(&service_url, "%s://%s%s", url_scheme, |
| 129 | grpc_mdstr_as_c_string(calld->host), service); |
| 130 | gpr_free(service); |
| 131 | return service_url; |
| 132 | } |
| 133 | |
Craig Tiller | 1a727fd | 2015-04-24 13:21:22 -0700 | [diff] [blame] | 134 | static void send_security_metadata(grpc_call_element *elem, |
Craig Tiller | b7959a0 | 2015-06-25 08:50:54 -0700 | [diff] [blame] | 135 | grpc_transport_stream_op *op) { |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 136 | call_data *calld = elem->call_data; |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 137 | channel_data *chand = elem->channel_data; |
| 138 | grpc_client_security_context *ctx = |
Julien Boeuf | 83b0297 | 2015-05-20 22:50:34 -0700 | [diff] [blame] | 139 | (grpc_client_security_context *)op->context[GRPC_CONTEXT_SECURITY].value; |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 140 | char *service_url = NULL; |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 141 | grpc_credentials *channel_creds = |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 142 | chand->security_connector->request_metadata_creds; |
| 143 | int channel_creds_has_md = |
| 144 | (channel_creds != NULL) && |
| 145 | grpc_credentials_has_request_metadata(channel_creds); |
| 146 | int call_creds_has_md = (ctx != NULL) && (ctx->creds != NULL) && |
| 147 | grpc_credentials_has_request_metadata(ctx->creds); |
| 148 | |
| 149 | if (!channel_creds_has_md && !call_creds_has_md) { |
| 150 | /* Skip sending metadata altogether. */ |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 151 | grpc_call_next_op(elem, op); |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 152 | return; |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 153 | } |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 154 | |
| 155 | if (channel_creds_has_md && call_creds_has_md) { |
| 156 | calld->creds = grpc_composite_credentials_create(channel_creds, ctx->creds); |
| 157 | if (calld->creds == NULL) { |
| 158 | bubble_up_error(elem, |
| 159 | "Incompatible credentials set on channel and call."); |
| 160 | return; |
| 161 | } |
| 162 | } else { |
| 163 | calld->creds = |
| 164 | grpc_credentials_ref(call_creds_has_md ? ctx->creds : channel_creds); |
| 165 | } |
| 166 | |
| 167 | service_url = |
| 168 | build_service_url(chand->security_connector->base.url_scheme, calld); |
| 169 | calld->op = *op; /* Copy op (originates from the caller's stack). */ |
Craig Tiller | 06bac34 | 2015-06-01 12:55:57 -0700 | [diff] [blame] | 170 | GPR_ASSERT(calld->pollset); |
| 171 | grpc_credentials_get_request_metadata( |
| 172 | calld->creds, calld->pollset, service_url, on_credentials_metadata, elem); |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 173 | gpr_free(service_url); |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 174 | } |
| 175 | |
| 176 | static void on_host_checked(void *user_data, grpc_security_status status) { |
| 177 | grpc_call_element *elem = (grpc_call_element *)user_data; |
| 178 | call_data *calld = elem->call_data; |
| 179 | |
| 180 | if (status == GRPC_SECURITY_OK) { |
| 181 | send_security_metadata(elem, &calld->op); |
| 182 | } else { |
| 183 | char *error_msg; |
| 184 | gpr_asprintf(&error_msg, "Invalid host %s set in :authority metadata.", |
| 185 | grpc_mdstr_as_c_string(calld->host)); |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 186 | bubble_up_error(elem, error_msg); |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 187 | gpr_free(error_msg); |
| 188 | } |
| 189 | } |
| 190 | |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 191 | /* Called either: |
| 192 | - in response to an API call (or similar) from above, to send something |
| 193 | - a network event (or similar) from below, to receive something |
| 194 | op contains type and call direction information, in addition to the data |
| 195 | that is being sent or received. */ |
Craig Tiller | 1a727fd | 2015-04-24 13:21:22 -0700 | [diff] [blame] | 196 | static void auth_start_transport_op(grpc_call_element *elem, |
Craig Tiller | b7959a0 | 2015-06-25 08:50:54 -0700 | [diff] [blame] | 197 | grpc_transport_stream_op *op) { |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 198 | /* grab pointers to our data from the call element */ |
| 199 | call_data *calld = elem->call_data; |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 200 | channel_data *chand = elem->channel_data; |
Craig Tiller | 6902ad2 | 2015-04-16 08:01:49 -0700 | [diff] [blame] | 201 | grpc_linked_mdelem *l; |
Craig Tiller | 6e84aba | 2015-04-23 15:08:17 -0700 | [diff] [blame] | 202 | size_t i; |
yang-g | d8c466e | 2015-06-30 09:50:53 -0700 | [diff] [blame] | 203 | grpc_client_security_context* sec_ctx = NULL; |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 204 | |
yang-g | d8c466e | 2015-06-30 09:50:53 -0700 | [diff] [blame] | 205 | if (calld->security_context_set == 0) { |
| 206 | calld->security_context_set = 1; |
| 207 | GPR_ASSERT(op->context); |
| 208 | if (op->context[GRPC_CONTEXT_SECURITY].value == NULL) { |
| 209 | op->context[GRPC_CONTEXT_SECURITY].value = |
| 210 | grpc_client_security_context_create(); |
| 211 | op->context[GRPC_CONTEXT_SECURITY].destroy = |
| 212 | grpc_client_security_context_destroy; |
| 213 | } |
| 214 | sec_ctx = op->context[GRPC_CONTEXT_SECURITY].value; |
yang-g | f9e8e59 | 2015-07-09 12:32:15 -0700 | [diff] [blame] | 215 | GRPC_AUTH_CONTEXT_UNREF(sec_ctx->auth_context, "client auth filter"); |
| 216 | sec_ctx->auth_context = GRPC_AUTH_CONTEXT_REF( |
| 217 | chand->security_connector->base.auth_context, "client_auth_filter"); |
yang-g | d8c466e | 2015-06-30 09:50:53 -0700 | [diff] [blame] | 218 | } |
Julien Boeuf | 84d964a | 2015-04-29 11:31:06 -0700 | [diff] [blame] | 219 | |
Craig Tiller | 06bac34 | 2015-06-01 12:55:57 -0700 | [diff] [blame] | 220 | if (op->bind_pollset) { |
| 221 | calld->pollset = op->bind_pollset; |
| 222 | } |
| 223 | |
Craig Tiller | 6e84aba | 2015-04-23 15:08:17 -0700 | [diff] [blame] | 224 | if (op->send_ops && !calld->sent_initial_metadata) { |
| 225 | size_t nops = op->send_ops->nops; |
| 226 | grpc_stream_op *ops = op->send_ops->ops; |
| 227 | for (i = 0; i < nops; i++) { |
| 228 | grpc_stream_op *sop = &ops[i]; |
| 229 | if (sop->type != GRPC_OP_METADATA) continue; |
Craig Tiller | 4e87e00 | 2015-04-24 08:49:10 -0700 | [diff] [blame] | 230 | calld->op_md_idx = i; |
Craig Tiller | 6e84aba | 2015-04-23 15:08:17 -0700 | [diff] [blame] | 231 | calld->sent_initial_metadata = 1; |
| 232 | for (l = sop->data.metadata.list.head; l != NULL; l = l->next) { |
Craig Tiller | 6902ad2 | 2015-04-16 08:01:49 -0700 | [diff] [blame] | 233 | grpc_mdelem *md = l->md; |
Craig Tiller | 87d5b19 | 2015-04-16 14:37:57 -0700 | [diff] [blame] | 234 | /* Pointer comparison is OK for md_elems created from the same context. |
| 235 | */ |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 236 | if (md->key == chand->authority_string) { |
Craig Tiller | 1a65a23 | 2015-07-06 10:22:32 -0700 | [diff] [blame] | 237 | if (calld->host != NULL) GRPC_MDSTR_UNREF(calld->host); |
| 238 | calld->host = GRPC_MDSTR_REF(md->value); |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 239 | } else if (md->key == chand->path_string) { |
Craig Tiller | 1a65a23 | 2015-07-06 10:22:32 -0700 | [diff] [blame] | 240 | if (calld->method != NULL) GRPC_MDSTR_UNREF(calld->method); |
| 241 | calld->method = GRPC_MDSTR_REF(md->value); |
Craig Tiller | 6902ad2 | 2015-04-16 08:01:49 -0700 | [diff] [blame] | 242 | } |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 243 | } |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 244 | if (calld->host != NULL) { |
| 245 | grpc_security_status status; |
| 246 | const char *call_host = grpc_mdstr_as_c_string(calld->host); |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 247 | calld->op = *op; /* Copy op (originates from the caller's stack). */ |
Julien Boeuf | 7d1d9ca | 2015-04-17 14:38:48 -0700 | [diff] [blame] | 248 | status = grpc_channel_security_connector_check_call_host( |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 249 | chand->security_connector, call_host, on_host_checked, elem); |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 250 | if (status != GRPC_SECURITY_OK) { |
| 251 | if (status == GRPC_SECURITY_ERROR) { |
| 252 | char *error_msg; |
| 253 | gpr_asprintf(&error_msg, |
| 254 | "Invalid host %s set in :authority metadata.", |
| 255 | call_host); |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 256 | bubble_up_error(elem, error_msg); |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 257 | gpr_free(error_msg); |
| 258 | } |
Craig Tiller | 6e84aba | 2015-04-23 15:08:17 -0700 | [diff] [blame] | 259 | return; /* early exit */ |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 260 | } |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 261 | } |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 262 | send_security_metadata(elem, op); |
Craig Tiller | 6e84aba | 2015-04-23 15:08:17 -0700 | [diff] [blame] | 263 | return; /* early exit */ |
| 264 | } |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 265 | } |
Craig Tiller | 6e84aba | 2015-04-23 15:08:17 -0700 | [diff] [blame] | 266 | |
| 267 | /* pass control up or down the stack */ |
| 268 | grpc_call_next_op(elem, op); |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 269 | } |
| 270 | |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 271 | /* Constructor for call_data */ |
| 272 | static void init_call_elem(grpc_call_element *elem, |
Craig Tiller | 1a727fd | 2015-04-24 13:21:22 -0700 | [diff] [blame] | 273 | const void *server_transport_data, |
Craig Tiller | b7959a0 | 2015-06-25 08:50:54 -0700 | [diff] [blame] | 274 | grpc_transport_stream_op *initial_op) { |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 275 | call_data *calld = elem->call_data; |
| 276 | calld->creds = NULL; |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 277 | calld->host = NULL; |
Julien Boeuf | f47a5cb | 2015-02-18 12:24:08 -0800 | [diff] [blame] | 278 | calld->method = NULL; |
Craig Tiller | 06bac34 | 2015-06-01 12:55:57 -0700 | [diff] [blame] | 279 | calld->pollset = NULL; |
Craig Tiller | 4e87e00 | 2015-04-24 08:49:10 -0700 | [diff] [blame] | 280 | calld->sent_initial_metadata = 0; |
yang-g | d8c466e | 2015-06-30 09:50:53 -0700 | [diff] [blame] | 281 | calld->security_context_set = 0; |
Craig Tiller | 6e84aba | 2015-04-23 15:08:17 -0700 | [diff] [blame] | 282 | |
| 283 | GPR_ASSERT(!initial_op || !initial_op->send_ops); |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 284 | } |
| 285 | |
| 286 | /* Destructor for call_data */ |
| 287 | static void destroy_call_elem(grpc_call_element *elem) { |
| 288 | call_data *calld = elem->call_data; |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 289 | grpc_credentials_unref(calld->creds); |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 290 | if (calld->host != NULL) { |
Craig Tiller | 1a65a23 | 2015-07-06 10:22:32 -0700 | [diff] [blame] | 291 | GRPC_MDSTR_UNREF(calld->host); |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 292 | } |
Craig Tiller | 7d0f9ea | 2015-02-23 13:37:07 -0800 | [diff] [blame] | 293 | if (calld->method != NULL) { |
Craig Tiller | 1a65a23 | 2015-07-06 10:22:32 -0700 | [diff] [blame] | 294 | GRPC_MDSTR_UNREF(calld->method); |
Craig Tiller | 7d0f9ea | 2015-02-23 13:37:07 -0800 | [diff] [blame] | 295 | } |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 296 | } |
| 297 | |
| 298 | /* Constructor for channel_data */ |
Craig Tiller | 079a11b | 2015-06-30 10:07:15 -0700 | [diff] [blame] | 299 | static void init_channel_elem(grpc_channel_element *elem, grpc_channel *master, |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 300 | const grpc_channel_args *args, |
| 301 | grpc_mdctx *metadata_context, int is_first, |
| 302 | int is_last) { |
Julien Boeuf | c6f8d0a | 2015-05-11 22:40:02 -0700 | [diff] [blame] | 303 | grpc_security_connector *sc = grpc_find_security_connector_in_args(args); |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 304 | /* grab pointers to our data from the channel element */ |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 305 | channel_data *chand = elem->channel_data; |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 306 | |
| 307 | /* The first and the last filters tend to be implemented differently to |
| 308 | handle the case that there's no 'next' filter to call on the up or down |
| 309 | path */ |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 310 | GPR_ASSERT(!is_last); |
Julien Boeuf | c6f8d0a | 2015-05-11 22:40:02 -0700 | [diff] [blame] | 311 | GPR_ASSERT(sc != NULL); |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 312 | |
| 313 | /* initialize members */ |
Julien Boeuf | c6f8d0a | 2015-05-11 22:40:02 -0700 | [diff] [blame] | 314 | GPR_ASSERT(sc->is_client_side); |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 315 | chand->security_connector = |
Craig Tiller | b367153 | 2015-07-01 10:37:40 -0700 | [diff] [blame] | 316 | (grpc_channel_security_connector *)GRPC_SECURITY_CONNECTOR_REF( |
| 317 | sc, "client_auth_filter"); |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 318 | chand->md_ctx = metadata_context; |
Craig Tiller | 8674cb1 | 2015-06-05 07:09:25 -0700 | [diff] [blame] | 319 | chand->authority_string = grpc_mdstr_from_string(chand->md_ctx, ":authority"); |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 320 | chand->path_string = grpc_mdstr_from_string(chand->md_ctx, ":path"); |
Craig Tiller | 8674cb1 | 2015-06-05 07:09:25 -0700 | [diff] [blame] | 321 | chand->error_msg_key = grpc_mdstr_from_string(chand->md_ctx, "grpc-message"); |
| 322 | chand->status_key = grpc_mdstr_from_string(chand->md_ctx, "grpc-status"); |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 323 | } |
| 324 | |
| 325 | /* Destructor for channel data */ |
| 326 | static void destroy_channel_elem(grpc_channel_element *elem) { |
| 327 | /* grab pointers to our data from the channel element */ |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 328 | channel_data *chand = elem->channel_data; |
| 329 | grpc_channel_security_connector *ctx = chand->security_connector; |
Craig Tiller | b367153 | 2015-07-01 10:37:40 -0700 | [diff] [blame] | 330 | if (ctx != NULL) |
| 331 | GRPC_SECURITY_CONNECTOR_UNREF(&ctx->base, "client_auth_filter"); |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 332 | if (chand->authority_string != NULL) { |
Craig Tiller | 1a65a23 | 2015-07-06 10:22:32 -0700 | [diff] [blame] | 333 | GRPC_MDSTR_UNREF(chand->authority_string); |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 334 | } |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 335 | if (chand->error_msg_key != NULL) { |
Craig Tiller | 1a65a23 | 2015-07-06 10:22:32 -0700 | [diff] [blame] | 336 | GRPC_MDSTR_UNREF(chand->error_msg_key); |
Julien Boeuf | 54b2192 | 2015-02-04 16:39:35 -0800 | [diff] [blame] | 337 | } |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 338 | if (chand->status_key != NULL) { |
Craig Tiller | 1a65a23 | 2015-07-06 10:22:32 -0700 | [diff] [blame] | 339 | GRPC_MDSTR_UNREF(chand->status_key); |
Craig Tiller | eb131bb | 2015-03-03 11:00:40 -0800 | [diff] [blame] | 340 | } |
Julien Boeuf | 9f218dd | 2015-04-23 10:24:02 -0700 | [diff] [blame] | 341 | if (chand->path_string != NULL) { |
Craig Tiller | 1a65a23 | 2015-07-06 10:22:32 -0700 | [diff] [blame] | 342 | GRPC_MDSTR_UNREF(chand->path_string); |
Craig Tiller | 7d0f9ea | 2015-02-23 13:37:07 -0800 | [diff] [blame] | 343 | } |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 344 | } |
| 345 | |
| 346 | const grpc_channel_filter grpc_client_auth_filter = { |
Craig Tiller | 079a11b | 2015-06-30 10:07:15 -0700 | [diff] [blame] | 347 | auth_start_transport_op, grpc_channel_next_op, sizeof(call_data), |
Craig Tiller | 8674cb1 | 2015-06-05 07:09:25 -0700 | [diff] [blame] | 348 | init_call_elem, destroy_call_elem, sizeof(channel_data), |
| 349 | init_channel_elem, destroy_channel_elem, "client-auth"}; |