Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 1 | /* |
| 2 | * |
Craig Tiller | 0605995 | 2015-02-18 08:34:56 -0800 | [diff] [blame] | 3 | * Copyright 2015, Google Inc. |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 4 | * All rights reserved. |
| 5 | * |
| 6 | * Redistribution and use in source and binary forms, with or without |
| 7 | * modification, are permitted provided that the following conditions are |
| 8 | * met: |
| 9 | * |
| 10 | * * Redistributions of source code must retain the above copyright |
| 11 | * notice, this list of conditions and the following disclaimer. |
| 12 | * * Redistributions in binary form must reproduce the above |
| 13 | * copyright notice, this list of conditions and the following disclaimer |
| 14 | * in the documentation and/or other materials provided with the |
| 15 | * distribution. |
| 16 | * * Neither the name of Google Inc. nor the names of its |
| 17 | * contributors may be used to endorse or promote products derived from |
| 18 | * this software without specific prior written permission. |
| 19 | * |
| 20 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| 21 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| 22 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
| 23 | * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
| 24 | * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| 25 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
| 26 | * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| 27 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| 28 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 29 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
| 30 | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 31 | * |
| 32 | */ |
| 33 | |
Nicolas "Pixel" Noble | 1ff52d5 | 2015-03-01 05:24:36 +0100 | [diff] [blame] | 34 | #ifndef GRPC_INTERNAL_CORE_SECURITY_CREDENTIALS_H |
| 35 | #define GRPC_INTERNAL_CORE_SECURITY_CREDENTIALS_H |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 36 | |
| 37 | #include "src/core/transport/stream_op.h" |
| 38 | #include <grpc/grpc.h> |
| 39 | #include <grpc/grpc_security.h> |
| 40 | #include <grpc/support/sync.h> |
| 41 | |
| 42 | struct grpc_httpcli_response; |
| 43 | |
| 44 | /* --- Constants. --- */ |
| 45 | |
| 46 | typedef enum { |
| 47 | GRPC_CREDENTIALS_OK = 0, |
| 48 | GRPC_CREDENTIALS_ERROR |
| 49 | } grpc_credentials_status; |
| 50 | |
| 51 | #define GRPC_CREDENTIALS_TYPE_SSL "Ssl" |
| 52 | #define GRPC_CREDENTIALS_TYPE_OAUTH2 "Oauth2" |
Julien Boeuf | f47a5cb | 2015-02-18 12:24:08 -0800 | [diff] [blame] | 53 | #define GRPC_CREDENTIALS_TYPE_JWT "Jwt" |
nnoble | 0c475f0 | 2014-12-05 15:37:39 -0800 | [diff] [blame] | 54 | #define GRPC_CREDENTIALS_TYPE_IAM "Iam" |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 55 | #define GRPC_CREDENTIALS_TYPE_COMPOSITE "Composite" |
| 56 | #define GRPC_CREDENTIALS_TYPE_FAKE_TRANSPORT_SECURITY "FakeTransportSecurity" |
| 57 | |
nnoble | 0c475f0 | 2014-12-05 15:37:39 -0800 | [diff] [blame] | 58 | #define GRPC_AUTHORIZATION_METADATA_KEY "Authorization" |
| 59 | #define GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY \ |
| 60 | "x-goog-iam-authorization-token" |
| 61 | #define GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY "x-goog-iam-authority-selector" |
| 62 | |
Julien Boeuf | cd9b1c8 | 2015-02-20 17:40:41 -0800 | [diff] [blame] | 63 | #define GRPC_GOOGLE_CLOUD_SDK_CONFIG_DIRECTORY "gcloud" |
| 64 | #define GRPC_GOOGLE_WELL_KNOWN_CREDENTIALS_FILE \ |
| 65 | "application_default_credentials.json" |
| 66 | |
Julien Boeuf | 9835cf0 | 2015-03-09 16:56:44 -0700 | [diff] [blame] | 67 | #define GRPC_SECURE_TOKEN_REFRESH_THRESHOLD_SECS 60 |
| 68 | |
| 69 | #define GRPC_COMPUTE_ENGINE_METADATA_HOST "metadata" |
| 70 | #define GRPC_COMPUTE_ENGINE_METADATA_TOKEN_PATH \ |
| 71 | "/computeMetadata/v1/instance/service-accounts/default/token" |
| 72 | |
| 73 | #define GRPC_GOOGLE_OAUTH2_SERVICE_HOST "www.googleapis.com" |
| 74 | #define GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH "/oauth2/v3/token" |
| 75 | |
| 76 | #define GRPC_SERVICE_ACCOUNT_POST_BODY_PREFIX \ |
| 77 | "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&" \ |
| 78 | "assertion=" |
| 79 | |
| 80 | #define GRPC_REFRESH_TOKEN_POST_BODY_FORMAT_STRING \ |
| 81 | "client_id=%s&client_secret=%s&refresh_token=%s&grant_type=refresh_token" |
| 82 | |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 83 | /* --- grpc_credentials. --- */ |
| 84 | |
Julien Boeuf | cd9b1c8 | 2015-02-20 17:40:41 -0800 | [diff] [blame] | 85 | /* It is the caller's responsibility to gpr_free the result if not NULL. */ |
Julien Boeuf | c66f2a8 | 2015-02-23 13:00:36 -0800 | [diff] [blame] | 86 | char *grpc_get_well_known_google_credentials_file_path(void); |
Julien Boeuf | cd9b1c8 | 2015-02-20 17:40:41 -0800 | [diff] [blame] | 87 | |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 88 | typedef void (*grpc_credentials_metadata_cb)(void *user_data, |
| 89 | grpc_mdelem **md_elems, |
| 90 | size_t num_md, |
| 91 | grpc_credentials_status status); |
| 92 | |
| 93 | typedef struct { |
| 94 | void (*destroy)(grpc_credentials *c); |
| 95 | int (*has_request_metadata)(const grpc_credentials *c); |
| 96 | int (*has_request_metadata_only)(const grpc_credentials *c); |
Craig Tiller | c4885ed | 2015-04-14 09:51:28 -0700 | [diff] [blame^] | 97 | grpc_mdctx *(*get_metadata_context)(grpc_credentials *c); |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 98 | void (*get_request_metadata)(grpc_credentials *c, |
Julien Boeuf | f47a5cb | 2015-02-18 12:24:08 -0800 | [diff] [blame] | 99 | const char *service_url, |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 100 | grpc_credentials_metadata_cb cb, |
| 101 | void *user_data); |
| 102 | } grpc_credentials_vtable; |
| 103 | |
| 104 | struct grpc_credentials { |
| 105 | const grpc_credentials_vtable *vtable; |
| 106 | const char *type; |
| 107 | gpr_refcount refcount; |
| 108 | }; |
| 109 | |
| 110 | grpc_credentials *grpc_credentials_ref(grpc_credentials *creds); |
| 111 | void grpc_credentials_unref(grpc_credentials *creds); |
| 112 | int grpc_credentials_has_request_metadata(grpc_credentials *creds); |
| 113 | int grpc_credentials_has_request_metadata_only(grpc_credentials *creds); |
| 114 | void grpc_credentials_get_request_metadata(grpc_credentials *creds, |
Julien Boeuf | f47a5cb | 2015-02-18 12:24:08 -0800 | [diff] [blame] | 115 | const char *service_url, |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 116 | grpc_credentials_metadata_cb cb, |
| 117 | void *user_data); |
Craig Tiller | c4885ed | 2015-04-14 09:51:28 -0700 | [diff] [blame^] | 118 | grpc_mdctx *grpc_credentials_get_metadata_context(grpc_credentials *creds); |
| 119 | |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 120 | typedef struct { |
| 121 | unsigned char *pem_private_key; |
| 122 | size_t pem_private_key_size; |
| 123 | unsigned char *pem_cert_chain; |
| 124 | size_t pem_cert_chain_size; |
| 125 | unsigned char *pem_root_certs; |
| 126 | size_t pem_root_certs_size; |
| 127 | } grpc_ssl_config; |
| 128 | |
| 129 | const grpc_ssl_config *grpc_ssl_credentials_get_config( |
| 130 | const grpc_credentials *ssl_creds); |
| 131 | |
nnoble | 0c475f0 | 2014-12-05 15:37:39 -0800 | [diff] [blame] | 132 | typedef struct { |
| 133 | grpc_credentials **creds_array; |
| 134 | size_t num_creds; |
| 135 | } grpc_credentials_array; |
| 136 | |
| 137 | const grpc_credentials_array *grpc_composite_credentials_get_credentials( |
| 138 | grpc_credentials *composite_creds); |
| 139 | |
jboeuf | 6ad120e | 2015-01-12 17:08:15 -0800 | [diff] [blame] | 140 | /* Returns creds if creds is of the specified type or the inner creds of the |
| 141 | specified type (if found), if the creds is of type COMPOSITE. |
| 142 | If composite_creds is not NULL, *composite_creds will point to creds if of |
| 143 | type COMPOSITE in case of success. */ |
| 144 | grpc_credentials *grpc_credentials_contains_type( |
| 145 | grpc_credentials *creds, const char *type, |
| 146 | grpc_credentials **composite_creds); |
| 147 | |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 148 | /* Exposed for testing only. */ |
jboeuf | 1a809c0 | 2014-12-19 15:44:30 -0800 | [diff] [blame] | 149 | grpc_credentials_status |
Yang Gao | 5fd0d29 | 2015-01-26 00:19:48 -0800 | [diff] [blame] | 150 | grpc_oauth2_token_fetcher_credentials_parse_server_response( |
| 151 | const struct grpc_httpcli_response *response, grpc_mdctx *ctx, |
| 152 | grpc_mdelem **token_elem, gpr_timespec *token_lifetime); |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 153 | |
| 154 | /* Simulates an oauth2 token fetch with the specified value for testing. */ |
| 155 | grpc_credentials *grpc_fake_oauth2_credentials_create( |
| 156 | const char *token_md_value, int is_async); |
| 157 | |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 158 | /* --- grpc_server_credentials. --- */ |
| 159 | |
| 160 | typedef struct { |
| 161 | void (*destroy)(grpc_server_credentials *c); |
| 162 | } grpc_server_credentials_vtable; |
| 163 | |
| 164 | struct grpc_server_credentials { |
| 165 | const grpc_server_credentials_vtable *vtable; |
| 166 | const char *type; |
| 167 | }; |
| 168 | |
Julien Boeuf | 8fbcc43 | 2015-01-15 16:44:13 -0800 | [diff] [blame] | 169 | typedef struct { |
| 170 | unsigned char **pem_private_keys; |
| 171 | size_t *pem_private_keys_sizes; |
| 172 | unsigned char **pem_cert_chains; |
| 173 | size_t *pem_cert_chains_sizes; |
| 174 | size_t num_key_cert_pairs; |
| 175 | unsigned char *pem_root_certs; |
| 176 | size_t pem_root_certs_size; |
| 177 | } grpc_ssl_server_config; |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 178 | |
Julien Boeuf | 8fbcc43 | 2015-01-15 16:44:13 -0800 | [diff] [blame] | 179 | const grpc_ssl_server_config *grpc_ssl_server_credentials_get_config( |
Nicolas Noble | b7ebd3b | 2014-11-26 16:33:03 -0800 | [diff] [blame] | 180 | const grpc_server_credentials *ssl_creds); |
| 181 | |
Nicolas "Pixel" Noble | 1ff52d5 | 2015-03-01 05:24:36 +0100 | [diff] [blame] | 182 | #endif /* GRPC_INTERNAL_CORE_SECURITY_CREDENTIALS_H */ |