aboutsummaryrefslogtreecommitdiffhomepage
path: root/src/core/lib/security/transport/security_connector.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/core/lib/security/transport/security_connector.c')
-rw-r--r--src/core/lib/security/transport/security_connector.c70
1 files changed, 28 insertions, 42 deletions
diff --git a/src/core/lib/security/transport/security_connector.c b/src/core/lib/security/transport/security_connector.c
index b15196e677..a7a5d65caf 100644
--- a/src/core/lib/security/transport/security_connector.c
+++ b/src/core/lib/security/transport/security_connector.c
@@ -695,6 +695,7 @@ static grpc_security_connector_vtable ssl_channel_vtable = {
static grpc_security_connector_vtable ssl_server_vtable = {
ssl_server_destroy, ssl_server_check_peer};
+/* returns a NULL terminated slice. */
static grpc_slice compute_default_pem_root_certs_once(void) {
grpc_slice result = grpc_empty_slice();
@@ -703,7 +704,7 @@ static grpc_slice compute_default_pem_root_certs_once(void) {
gpr_getenv(GRPC_DEFAULT_SSL_ROOTS_FILE_PATH_ENV_VAR);
if (default_root_certs_path != NULL) {
GRPC_LOG_IF_ERROR("load_file",
- grpc_load_file(default_root_certs_path, 0, &result));
+ grpc_load_file(default_root_certs_path, 1, &result));
gpr_free(default_root_certs_path);
}
@@ -714,15 +715,18 @@ static grpc_slice compute_default_pem_root_certs_once(void) {
ovrd_res = ssl_roots_override_cb(&pem_root_certs);
if (ovrd_res == GRPC_SSL_ROOTS_OVERRIDE_OK) {
GPR_ASSERT(pem_root_certs != NULL);
- result = grpc_slice_new(pem_root_certs, strlen(pem_root_certs), gpr_free);
+ result = grpc_slice_from_copied_buffer(
+ pem_root_certs,
+ strlen(pem_root_certs) + 1); // NULL terminator.
}
+ gpr_free(pem_root_certs);
}
/* Fall back to installed certs if needed. */
if (GRPC_SLICE_IS_EMPTY(result) &&
ovrd_res != GRPC_SSL_ROOTS_OVERRIDE_FAIL_PERMANENTLY) {
GRPC_LOG_IF_ERROR("load_file",
- grpc_load_file(installed_roots_path, 0, &result));
+ grpc_load_file(installed_roots_path, 1, &result));
}
return result;
}
@@ -762,13 +766,14 @@ get_tsi_client_certificate_request_type(
}
}
-size_t grpc_get_default_ssl_roots(const unsigned char **pem_root_certs) {
+const char *grpc_get_default_ssl_roots(void) {
/* TODO(jboeuf@google.com): Maybe revisit the approach which consists in
loading all the roots once for the lifetime of the process. */
static gpr_once once = GPR_ONCE_INIT;
gpr_once_init(&once, init_default_pem_root_certs);
- *pem_root_certs = GRPC_SLICE_START_PTR(default_pem_root_certs);
- return GRPC_SLICE_LENGTH(default_pem_root_certs);
+ return GRPC_SLICE_IS_EMPTY(default_pem_root_certs)
+ ? NULL
+ : (const char *)GRPC_SLICE_START_PTR(default_pem_root_certs);
}
grpc_security_status grpc_ssl_channel_security_connector_create(
@@ -776,22 +781,16 @@ grpc_security_status grpc_ssl_channel_security_connector_create(
const grpc_ssl_config *config, const char *target_name,
const char *overridden_target_name, grpc_channel_security_connector **sc) {
size_t num_alpn_protocols = grpc_chttp2_num_alpn_versions();
- const unsigned char **alpn_protocol_strings =
+ const char **alpn_protocol_strings =
gpr_malloc(sizeof(const char *) * num_alpn_protocols);
- unsigned char *alpn_protocol_string_lengths =
- gpr_malloc(sizeof(unsigned char) * num_alpn_protocols);
tsi_result result = TSI_OK;
grpc_ssl_channel_security_connector *c;
size_t i;
- const unsigned char *pem_root_certs;
- size_t pem_root_certs_size;
+ const char *pem_root_certs;
char *port;
for (i = 0; i < num_alpn_protocols; i++) {
- alpn_protocol_strings[i] =
- (const unsigned char *)grpc_chttp2_get_alpn_version_index(i);
- alpn_protocol_string_lengths[i] =
- (unsigned char)strlen(grpc_chttp2_get_alpn_version_index(i));
+ alpn_protocol_strings[i] = grpc_chttp2_get_alpn_version_index(i);
}
if (config == NULL || target_name == NULL) {
@@ -799,14 +798,13 @@ grpc_security_status grpc_ssl_channel_security_connector_create(
goto error;
}
if (config->pem_root_certs == NULL) {
- pem_root_certs_size = grpc_get_default_ssl_roots(&pem_root_certs);
- if (pem_root_certs == NULL || pem_root_certs_size == 0) {
+ pem_root_certs = grpc_get_default_ssl_roots();
+ if (pem_root_certs == NULL) {
gpr_log(GPR_ERROR, "Could not get default pem root certs.");
goto error;
}
} else {
pem_root_certs = config->pem_root_certs;
- pem_root_certs_size = config->pem_root_certs_size;
}
c = gpr_zalloc(sizeof(grpc_ssl_channel_security_connector));
@@ -823,11 +821,12 @@ grpc_security_status grpc_ssl_channel_security_connector_create(
if (overridden_target_name != NULL) {
c->overridden_target_name = gpr_strdup(overridden_target_name);
}
+
+ bool has_key_cert_pair = config->pem_key_cert_pair.private_key != NULL &&
+ config->pem_key_cert_pair.cert_chain != NULL;
result = tsi_create_ssl_client_handshaker_factory(
- config->pem_private_key, config->pem_private_key_size,
- config->pem_cert_chain, config->pem_cert_chain_size, pem_root_certs,
- pem_root_certs_size, ssl_cipher_suites(), alpn_protocol_strings,
- alpn_protocol_string_lengths, (uint16_t)num_alpn_protocols,
+ has_key_cert_pair ? &config->pem_key_cert_pair : NULL, pem_root_certs,
+ ssl_cipher_suites(), alpn_protocol_strings, (uint16_t)num_alpn_protocols,
&c->handshaker_factory);
if (result != TSI_OK) {
gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
@@ -838,12 +837,10 @@ grpc_security_status grpc_ssl_channel_security_connector_create(
}
*sc = &c->base;
gpr_free((void *)alpn_protocol_strings);
- gpr_free(alpn_protocol_string_lengths);
return GRPC_SECURITY_OK;
error:
gpr_free((void *)alpn_protocol_strings);
- gpr_free(alpn_protocol_string_lengths);
return GRPC_SECURITY_ERROR;
}
@@ -851,19 +848,14 @@ grpc_security_status grpc_ssl_server_security_connector_create(
grpc_exec_ctx *exec_ctx, const grpc_ssl_server_config *config,
grpc_server_security_connector **sc) {
size_t num_alpn_protocols = grpc_chttp2_num_alpn_versions();
- const unsigned char **alpn_protocol_strings =
+ const char **alpn_protocol_strings =
gpr_malloc(sizeof(const char *) * num_alpn_protocols);
- unsigned char *alpn_protocol_string_lengths =
- gpr_malloc(sizeof(unsigned char) * num_alpn_protocols);
tsi_result result = TSI_OK;
grpc_ssl_server_security_connector *c;
size_t i;
for (i = 0; i < num_alpn_protocols; i++) {
- alpn_protocol_strings[i] =
- (const unsigned char *)grpc_chttp2_get_alpn_version_index(i);
- alpn_protocol_string_lengths[i] =
- (unsigned char)strlen(grpc_chttp2_get_alpn_version_index(i));
+ alpn_protocol_strings[i] = grpc_chttp2_get_alpn_version_index(i);
}
if (config == NULL || config->num_key_cert_pairs == 0) {
@@ -876,15 +868,11 @@ grpc_security_status grpc_ssl_server_security_connector_create(
c->base.base.url_scheme = GRPC_SSL_URL_SCHEME;
c->base.base.vtable = &ssl_server_vtable;
result = tsi_create_ssl_server_handshaker_factory_ex(
- (const unsigned char **)config->pem_private_keys,
- config->pem_private_keys_sizes,
- (const unsigned char **)config->pem_cert_chains,
- config->pem_cert_chains_sizes, config->num_key_cert_pairs,
- config->pem_root_certs, config->pem_root_certs_size,
- get_tsi_client_certificate_request_type(
- config->client_certificate_request),
- ssl_cipher_suites(), alpn_protocol_strings, alpn_protocol_string_lengths,
- (uint16_t)num_alpn_protocols, &c->handshaker_factory);
+ config->pem_key_cert_pairs, config->num_key_cert_pairs,
+ config->pem_root_certs, get_tsi_client_certificate_request_type(
+ config->client_certificate_request),
+ ssl_cipher_suites(), alpn_protocol_strings, (uint16_t)num_alpn_protocols,
+ &c->handshaker_factory);
if (result != TSI_OK) {
gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
tsi_result_to_string(result));
@@ -895,11 +883,9 @@ grpc_security_status grpc_ssl_server_security_connector_create(
c->base.add_handshakers = ssl_server_add_handshakers;
*sc = &c->base;
gpr_free((void *)alpn_protocol_strings);
- gpr_free(alpn_protocol_string_lengths);
return GRPC_SECURITY_OK;
error:
gpr_free((void *)alpn_protocol_strings);
- gpr_free(alpn_protocol_string_lengths);
return GRPC_SECURITY_ERROR;
}
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-30 19:14:29 +0000