aboutsummaryrefslogtreecommitdiffhomepage
path: root/src/core/security
diff options
context:
space:
mode:
Diffstat (limited to 'src/core/security')
-rw-r--r--src/core/security/credentials.c48
-rw-r--r--src/core/security/credentials.h13
-rw-r--r--src/core/security/security_connector.c32
-rw-r--r--src/core/security/security_context.c100
-rw-r--r--src/core/security/security_context.h33
-rw-r--r--src/core/security/server_auth_filter.c151
6 files changed, 279 insertions, 98 deletions
diff --git a/src/core/security/credentials.c b/src/core/security/credentials.c
index 15268cefbe..b76a60405c 100644
--- a/src/core/security/credentials.c
+++ b/src/core/security/credentials.c
@@ -765,19 +765,19 @@ grpc_credentials *grpc_refresh_token_credentials_create(
grpc_auth_refresh_token_create_from_string(json_refresh_token));
}
-/* -- Fake Oauth2 credentials. -- */
+/* -- Metadata-only credentials. -- */
-static void fake_oauth2_destroy(grpc_credentials *creds) {
- grpc_fake_oauth2_credentials *c = (grpc_fake_oauth2_credentials *)creds;
- grpc_credentials_md_store_unref(c->access_token_md);
+static void md_only_test_destroy(grpc_credentials *creds) {
+ grpc_md_only_test_credentials *c = (grpc_md_only_test_credentials *)creds;
+ grpc_credentials_md_store_unref(c->md_store);
gpr_free(c);
}
-static int fake_oauth2_has_request_metadata(const grpc_credentials *creds) {
+static int md_only_test_has_request_metadata(const grpc_credentials *creds) {
return 1;
}
-static int fake_oauth2_has_request_metadata_only(
+static int md_only_test_has_request_metadata_only(
const grpc_credentials *creds) {
return 1;
}
@@ -785,19 +785,19 @@ static int fake_oauth2_has_request_metadata_only(
void on_simulated_token_fetch_done(void *user_data, int success) {
grpc_credentials_metadata_request *r =
(grpc_credentials_metadata_request *)user_data;
- grpc_fake_oauth2_credentials *c = (grpc_fake_oauth2_credentials *)r->creds;
+ grpc_md_only_test_credentials *c = (grpc_md_only_test_credentials *)r->creds;
GPR_ASSERT(success);
- r->cb(r->user_data, c->access_token_md->entries,
- c->access_token_md->num_entries, GRPC_CREDENTIALS_OK);
+ r->cb(r->user_data, c->md_store->entries,
+ c->md_store->num_entries, GRPC_CREDENTIALS_OK);
grpc_credentials_metadata_request_destroy(r);
}
-static void fake_oauth2_get_request_metadata(grpc_credentials *creds,
+static void md_only_test_get_request_metadata(grpc_credentials *creds,
grpc_pollset *pollset,
const char *service_url,
grpc_credentials_metadata_cb cb,
void *user_data) {
- grpc_fake_oauth2_credentials *c = (grpc_fake_oauth2_credentials *)creds;
+ grpc_md_only_test_credentials *c = (grpc_md_only_test_credentials *)creds;
if (c->is_async) {
grpc_credentials_metadata_request *cb_arg =
@@ -806,26 +806,26 @@ static void fake_oauth2_get_request_metadata(grpc_credentials *creds,
on_simulated_token_fetch_done, cb_arg);
grpc_iomgr_add_callback(cb_arg->on_simulated_token_fetch_done_closure);
} else {
- cb(user_data, c->access_token_md->entries, 1, GRPC_CREDENTIALS_OK);
+ cb(user_data, c->md_store->entries, 1, GRPC_CREDENTIALS_OK);
}
}
-static grpc_credentials_vtable fake_oauth2_vtable = {
- fake_oauth2_destroy, fake_oauth2_has_request_metadata,
- fake_oauth2_has_request_metadata_only, fake_oauth2_get_request_metadata,
+static grpc_credentials_vtable md_only_test_vtable = {
+ md_only_test_destroy, md_only_test_has_request_metadata,
+ md_only_test_has_request_metadata_only, md_only_test_get_request_metadata,
NULL};
-grpc_credentials *grpc_fake_oauth2_credentials_create(
- const char *token_md_value, int is_async) {
- grpc_fake_oauth2_credentials *c =
- gpr_malloc(sizeof(grpc_fake_oauth2_credentials));
- memset(c, 0, sizeof(grpc_fake_oauth2_credentials));
+grpc_credentials *grpc_md_only_test_credentials_create(const char *md_key,
+ const char *md_value,
+ int is_async) {
+ grpc_md_only_test_credentials *c =
+ gpr_malloc(sizeof(grpc_md_only_test_credentials));
+ memset(c, 0, sizeof(grpc_md_only_test_credentials));
c->base.type = GRPC_CREDENTIALS_TYPE_OAUTH2;
- c->base.vtable = &fake_oauth2_vtable;
+ c->base.vtable = &md_only_test_vtable;
gpr_ref_init(&c->base.refcount, 1);
- c->access_token_md = grpc_credentials_md_store_create(1);
- grpc_credentials_md_store_add_cstrings(
- c->access_token_md, GRPC_AUTHORIZATION_METADATA_KEY, token_md_value);
+ c->md_store = grpc_credentials_md_store_create(1);
+ grpc_credentials_md_store_add_cstrings(c->md_store, md_key, md_value);
c->is_async = is_async;
return &c->base;
}
diff --git a/src/core/security/credentials.h b/src/core/security/credentials.h
index 8d40da47c1..ecec2623ef 100644
--- a/src/core/security/credentials.h
+++ b/src/core/security/credentials.h
@@ -190,9 +190,10 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response(
grpc_credentials_md_store **token_md, gpr_timespec *token_lifetime);
void grpc_flush_cached_google_default_credentials(void);
-/* Simulates an oauth2 token fetch with the specified value for testing. */
-grpc_credentials *grpc_fake_oauth2_credentials_create(
- const char *token_md_value, int is_async);
+/* Metadata-only credentials with the specified key and value where
+ asynchronicity can be simulated for testing. */
+grpc_credentials *grpc_md_only_test_credentials_create(
+ const char *md_key, const char *md_value, int is_async);
/* Private constructor for jwt credentials from an already parsed json key.
Takes ownership of the key. */
@@ -297,13 +298,13 @@ typedef struct {
grpc_credentials_md_store *access_token_md;
} grpc_access_token_credentials;
-/* -- Fake Oauth2 credentials. -- */
+/* -- Metadata-only Test credentials. -- */
typedef struct {
grpc_credentials base;
- grpc_credentials_md_store *access_token_md;
+ grpc_credentials_md_store *md_store;
int is_async;
-} grpc_fake_oauth2_credentials;
+} grpc_md_only_test_credentials;
/* -- IAM credentials. -- */
diff --git a/src/core/security/security_connector.c b/src/core/security/security_connector.c
index 726b4c1e12..a354536dcd 100644
--- a/src/core/security/security_connector.c
+++ b/src/core/security/security_connector.c
@@ -263,9 +263,9 @@ static grpc_security_status fake_check_peer(grpc_security_connector *sc,
goto end;
}
GRPC_AUTH_CONTEXT_UNREF(sc->auth_context, "connector");
- sc->auth_context = grpc_auth_context_create(NULL, 1);
- sc->auth_context->properties[0] = grpc_auth_property_init_from_cstring(
- GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
+ sc->auth_context = grpc_auth_context_create(NULL);
+ grpc_auth_context_add_cstring_property(
+ sc->auth_context, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
GRPC_FAKE_TRANSPORT_SECURITY_TYPE);
end:
@@ -409,31 +409,35 @@ static int ssl_host_matches_name(const tsi_peer *peer, const char *peer_name) {
grpc_auth_context *tsi_ssl_peer_to_auth_context(const tsi_peer *peer) {
size_t i;
grpc_auth_context *ctx = NULL;
+ const char *peer_identity_property_name = NULL;
/* The caller has checked the certificate type property. */
GPR_ASSERT(peer->property_count >= 1);
- ctx = grpc_auth_context_create(NULL, peer->property_count);
- ctx->properties[0] = grpc_auth_property_init_from_cstring(
- GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
+ ctx = grpc_auth_context_create(NULL);
+ grpc_auth_context_add_cstring_property(
+ ctx, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
GRPC_SSL_TRANSPORT_SECURITY_TYPE);
- ctx->property_count = 1;
for (i = 0; i < peer->property_count; i++) {
const tsi_peer_property *prop = &peer->properties[i];
if (prop->name == NULL) continue;
if (strcmp(prop->name, TSI_X509_SUBJECT_COMMON_NAME_PEER_PROPERTY) == 0) {
/* If there is no subject alt name, have the CN as the identity. */
- if (ctx->peer_identity_property_name == NULL) {
- ctx->peer_identity_property_name = GRPC_X509_CN_PROPERTY_NAME;
+ if (peer_identity_property_name == NULL) {
+ peer_identity_property_name = GRPC_X509_CN_PROPERTY_NAME;
}
- ctx->properties[ctx->property_count++] = grpc_auth_property_init(
- GRPC_X509_CN_PROPERTY_NAME, prop->value.data, prop->value.length);
+ grpc_auth_context_add_property(ctx, GRPC_X509_CN_PROPERTY_NAME,
+ prop->value.data, prop->value.length);
} else if (strcmp(prop->name,
TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY) == 0) {
- ctx->peer_identity_property_name = GRPC_X509_SAN_PROPERTY_NAME;
- ctx->properties[ctx->property_count++] = grpc_auth_property_init(
- GRPC_X509_SAN_PROPERTY_NAME, prop->value.data, prop->value.length);
+ peer_identity_property_name = GRPC_X509_SAN_PROPERTY_NAME;
+ grpc_auth_context_add_property(ctx, GRPC_X509_SAN_PROPERTY_NAME,
+ prop->value.data, prop->value.length);
}
}
+ if (peer_identity_property_name != NULL) {
+ GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name(
+ ctx, peer_identity_property_name) == 1);
+ }
return ctx;
}
diff --git a/src/core/security/security_context.c b/src/core/security/security_context.c
index 8ce7876bd8..8ccce89ba9 100644
--- a/src/core/security/security_context.c
+++ b/src/core/security/security_context.c
@@ -42,6 +42,19 @@
#include <grpc/support/log.h>
#include <grpc/support/string_util.h>
+/* --- grpc_process_auth_metadata_func --- */
+
+static grpc_auth_metadata_processor server_processor = {NULL, NULL};
+
+grpc_auth_metadata_processor grpc_server_get_auth_metadata_processor(void) {
+ return server_processor;
+}
+
+void grpc_server_register_auth_metadata_processor(
+ grpc_auth_metadata_processor processor) {
+ server_processor = processor;
+}
+
/* --- grpc_call --- */
grpc_call_error grpc_call_set_credentials(grpc_call *call,
@@ -120,15 +133,15 @@ void grpc_server_security_context_destroy(void *ctx) {
static grpc_auth_property_iterator empty_iterator = {NULL, 0, NULL};
-grpc_auth_context *grpc_auth_context_create(grpc_auth_context *chained,
- size_t property_count) {
+grpc_auth_context *grpc_auth_context_create(grpc_auth_context *chained) {
grpc_auth_context *ctx = gpr_malloc(sizeof(grpc_auth_context));
memset(ctx, 0, sizeof(grpc_auth_context));
- ctx->properties = gpr_malloc(property_count * sizeof(grpc_auth_property));
- memset(ctx->properties, 0, property_count * sizeof(grpc_auth_property));
- ctx->property_count = property_count;
gpr_ref_init(&ctx->refcount, 1);
- if (chained != NULL) ctx->chained = GRPC_AUTH_CONTEXT_REF(chained, "chained");
+ if (chained != NULL) {
+ ctx->chained = GRPC_AUTH_CONTEXT_REF(chained, "chained");
+ ctx->peer_identity_property_name =
+ ctx->chained->peer_identity_property_name;
+ }
return ctx;
}
@@ -162,11 +175,11 @@ void grpc_auth_context_unref(grpc_auth_context *ctx) {
if (gpr_unref(&ctx->refcount)) {
size_t i;
GRPC_AUTH_CONTEXT_UNREF(ctx->chained, "chained");
- if (ctx->properties != NULL) {
- for (i = 0; i < ctx->property_count; i++) {
- grpc_auth_property_reset(&ctx->properties[i]);
+ if (ctx->properties.array != NULL) {
+ for (i = 0; i < ctx->properties.count; i++) {
+ grpc_auth_property_reset(&ctx->properties.array[i]);
}
- gpr_free(ctx->properties);
+ gpr_free(ctx->properties.array);
}
gpr_free(ctx);
}
@@ -177,6 +190,20 @@ const char *grpc_auth_context_peer_identity_property_name(
return ctx->peer_identity_property_name;
}
+int grpc_auth_context_set_peer_identity_property_name(grpc_auth_context *ctx,
+ const char *name) {
+ grpc_auth_property_iterator it =
+ grpc_auth_context_find_properties_by_name(ctx, name);
+ const grpc_auth_property *prop = grpc_auth_property_iterator_next(&it);
+ if (prop == NULL) {
+ gpr_log(GPR_ERROR, "Property name %s not found in auth context.",
+ name != NULL ? name : "NULL");
+ return 0;
+ }
+ ctx->peer_identity_property_name = prop->name;
+ return 1;
+}
+
int grpc_auth_context_peer_is_authenticated(
const grpc_auth_context *ctx) {
return ctx->peer_identity_property_name == NULL ? 0 : 1;
@@ -193,16 +220,16 @@ grpc_auth_property_iterator grpc_auth_context_property_iterator(
const grpc_auth_property *grpc_auth_property_iterator_next(
grpc_auth_property_iterator *it) {
if (it == NULL || it->ctx == NULL) return NULL;
- while (it->index == it->ctx->property_count) {
+ while (it->index == it->ctx->properties.count) {
if (it->ctx->chained == NULL) return NULL;
it->ctx = it->ctx->chained;
it->index = 0;
}
if (it->name == NULL) {
- return &it->ctx->properties[it->index++];
+ return &it->ctx->properties.array[it->index++];
} else {
- while (it->index < it->ctx->property_count) {
- const grpc_auth_property *prop = &it->ctx->properties[it->index++];
+ while (it->index < it->ctx->properties.count) {
+ const grpc_auth_property *prop = &it->ctx->properties.array[it->index++];
GPR_ASSERT(prop->name != NULL);
if (strcmp(it->name, prop->name) == 0) {
return prop;
@@ -229,24 +256,37 @@ grpc_auth_property_iterator grpc_auth_context_peer_identity(
ctx, ctx->peer_identity_property_name);
}
-grpc_auth_property grpc_auth_property_init_from_cstring(const char *name,
- const char *value) {
- grpc_auth_property prop;
- prop.name = gpr_strdup(name);
- prop.value = gpr_strdup(value);
- prop.value_length = strlen(value);
- return prop;
+static void ensure_auth_context_capacity(grpc_auth_context *ctx) {
+ if (ctx->properties.count == ctx->properties.capacity) {
+ ctx->properties.capacity =
+ GPR_MAX(ctx->properties.capacity + 8, ctx->properties.capacity * 2);
+ ctx->properties.array =
+ gpr_realloc(ctx->properties.array,
+ ctx->properties.capacity * sizeof(grpc_auth_property));
+ }
+}
+
+void grpc_auth_context_add_property(grpc_auth_context *ctx, const char *name,
+ const char *value, size_t value_length) {
+ grpc_auth_property *prop;
+ ensure_auth_context_capacity(ctx);
+ prop = &ctx->properties.array[ctx->properties.count++];
+ prop->name = gpr_strdup(name);
+ prop->value = gpr_malloc(value_length + 1);
+ memcpy(prop->value, value, value_length);
+ prop->value[value_length] = '\0';
+ prop->value_length = value_length;
}
-grpc_auth_property grpc_auth_property_init(const char *name, const char *value,
- size_t value_length) {
- grpc_auth_property prop;
- prop.name = gpr_strdup(name);
- prop.value = gpr_malloc(value_length + 1);
- memcpy(prop.value, value, value_length);
- prop.value[value_length] = '\0';
- prop.value_length = value_length;
- return prop;
+void grpc_auth_context_add_cstring_property(grpc_auth_context *ctx,
+ const char *name,
+ const char *value) {
+ grpc_auth_property *prop;
+ ensure_auth_context_capacity(ctx);
+ prop = &ctx->properties.array[ctx->properties.count++];
+ prop->name = gpr_strdup(name);
+ prop->value = gpr_strdup(value);
+ prop->value_length = strlen(value);
}
void grpc_auth_property_reset(grpc_auth_property *property) {
diff --git a/src/core/security/security_context.h b/src/core/security/security_context.h
index 76a45910bb..d4351cb74c 100644
--- a/src/core/security/security_context.h
+++ b/src/core/security/security_context.h
@@ -34,11 +34,13 @@
#ifndef GRPC_INTERNAL_CORE_SECURITY_SECURITY_CONTEXT_H
#define GRPC_INTERNAL_CORE_SECURITY_SECURITY_CONTEXT_H
+#include "src/core/iomgr/pollset.h"
#include "src/core/security/credentials.h"
-#ifdef __cplusplus
-extern "C" {
-#endif
+/* --- grpc_auth_ticket --- */
+struct grpc_auth_ticket {
+ grpc_pollset *pollset;
+};
/* --- grpc_auth_context ---
@@ -46,18 +48,19 @@ extern "C" {
/* Property names are always NULL terminated. */
+typedef struct {
+ grpc_auth_property *array;
+ size_t count;
+ size_t capacity;
+} grpc_auth_property_array;
+
struct grpc_auth_context {
struct grpc_auth_context *chained;
- grpc_auth_property *properties;
- size_t property_count;
+ grpc_auth_property_array properties;
gpr_refcount refcount;
const char *peer_identity_property_name;
};
-/* Constructor. */
-grpc_auth_context *grpc_auth_context_create(grpc_auth_context *chained,
- size_t property_count);
-
/* Refcounting. */
#ifdef GRPC_AUTH_CONTEXT_REFCOUNT_DEBUG
#define GRPC_AUTH_CONTEXT_REF(p, r) \
@@ -76,12 +79,6 @@ grpc_auth_context *grpc_auth_context_ref(grpc_auth_context *policy);
void grpc_auth_context_unref(grpc_auth_context *policy);
#endif
-grpc_auth_property grpc_auth_property_init_from_cstring(const char *name,
- const char *value);
-
-grpc_auth_property grpc_auth_property_init(const char *name, const char *value,
- size_t value_length);
-
void grpc_auth_property_reset(grpc_auth_property *property);
/* --- grpc_client_security_context ---
@@ -107,9 +104,9 @@ typedef struct {
grpc_server_security_context *grpc_server_security_context_create(void);
void grpc_server_security_context_destroy(void *ctx);
-#ifdef __cplusplus
-}
-#endif
+/* --- Auth metadata processing. --- */
+
+grpc_auth_metadata_processor grpc_server_get_auth_metadata_processor(void);
#endif /* GRPC_INTERNAL_CORE_SECURITY_SECURITY_CONTEXT_H */
diff --git a/src/core/security/server_auth_filter.c b/src/core/security/server_auth_filter.c
index 69789c2f0d..10dfb09926 100644
--- a/src/core/security/server_auth_filter.c
+++ b/src/core/security/server_auth_filter.c
@@ -31,20 +31,149 @@
*
*/
+#include <string.h>
+
#include "src/core/security/auth_filters.h"
#include "src/core/security/security_connector.h"
#include "src/core/security/security_context.h"
+#include <grpc/support/alloc.h>
#include <grpc/support/log.h>
typedef struct call_data {
- int unused; /* C89 requires at least one struct element */
+ gpr_uint8 got_client_metadata;
+ grpc_stream_op_buffer *recv_ops;
+ /* Closure to call when finished with the auth_on_recv hook. */
+ grpc_iomgr_closure *on_done_recv;
+ /* Receive closures are chained: we inject this closure as the on_done_recv
+ up-call on transport_op, and remember to call our on_done_recv member after
+ handling it. */
+ grpc_iomgr_closure auth_on_recv;
+ grpc_transport_stream_op transport_op;
+ const grpc_metadata *consumed_md;
+ size_t num_consumed_md;
+ grpc_stream_op *md_op;
+ grpc_auth_context **call_auth_context;
+ grpc_auth_ticket ticket;
} call_data;
typedef struct channel_data {
grpc_security_connector *security_connector;
+ grpc_mdctx *mdctx;
} channel_data;
+static grpc_metadata_array metadata_batch_to_md_array(
+ const grpc_metadata_batch *batch) {
+ grpc_linked_mdelem *l;
+ grpc_metadata_array result;
+ grpc_metadata_array_init(&result);
+ for (l = batch->list.head; l != NULL; l = l->next) {
+ grpc_metadata *usr_md = NULL;
+ grpc_mdelem *md = l->md;
+ grpc_mdstr *key = md->key;
+ grpc_mdstr *value = md->value;
+ if (result.count == result.capacity) {
+ result.capacity = GPR_MAX(result.capacity + 8, result.capacity * 2);
+ result.metadata =
+ gpr_realloc(result.metadata, result.capacity * sizeof(grpc_metadata));
+ }
+ usr_md = &result.metadata[result.count++];
+ usr_md->key = grpc_mdstr_as_c_string(key);
+ usr_md->value = grpc_mdstr_as_c_string(value);
+ usr_md->value_length = GPR_SLICE_LENGTH(value->slice);
+ }
+ return result;
+}
+
+static grpc_mdelem *remove_consumed_md(void *user_data, grpc_mdelem *md) {
+ grpc_call_element *elem = user_data;
+ call_data *calld = elem->call_data;
+ size_t i;
+ for (i = 0; i < calld->num_consumed_md; i++) {
+ /* Maybe we could do a pointer comparison but we do not have any guarantee
+ that the metadata processor used the same pointers for consumed_md in the
+ callback. */
+ if (memcmp(GPR_SLICE_START_PTR(md->key->slice), calld->consumed_md[i].key,
+ GPR_SLICE_LENGTH(md->key->slice)) == 0 &&
+ memcmp(GPR_SLICE_START_PTR(md->value->slice),
+ calld->consumed_md[i].value,
+ GPR_SLICE_LENGTH(md->value->slice)) == 0) {
+ return NULL; /* Delete. */
+ }
+ }
+ return md;
+}
+
+static void on_md_processing_done(void *user_data,
+ const grpc_metadata *consumed_md,
+ size_t num_consumed_md, int success,
+ grpc_auth_context *result) {
+ grpc_call_element *elem = user_data;
+ call_data *calld = elem->call_data;
+ channel_data *chand = elem->channel_data;
+
+ if (success) {
+ calld->consumed_md = consumed_md;
+ calld->num_consumed_md = num_consumed_md;
+ grpc_metadata_batch_filter(&calld->md_op->data.metadata, remove_consumed_md,
+ elem);
+ GPR_ASSERT(calld->call_auth_context != NULL);
+ GRPC_AUTH_CONTEXT_UNREF(*calld->call_auth_context,
+ "releasing old context.");
+ *calld->call_auth_context =
+ GRPC_AUTH_CONTEXT_REF(result, "refing new context.");
+ calld->on_done_recv->cb(calld->on_done_recv->cb_arg, success);
+ } else {
+ grpc_transport_stream_op_add_cancellation(
+ &calld->transport_op, GRPC_STATUS_UNAUTHENTICATED,
+ grpc_mdstr_from_string(chand->mdctx,
+ "Authentication metadata processing failed."));
+ grpc_call_next_op(elem, &calld->transport_op);
+ }
+}
+
+static void auth_on_recv(void *user_data, int success) {
+ grpc_call_element *elem = user_data;
+ call_data *calld = elem->call_data;
+ channel_data *chand = elem->channel_data;
+ if (success) {
+ size_t i;
+ size_t nops = calld->recv_ops->nops;
+ grpc_stream_op *ops = calld->recv_ops->ops;
+ for (i = 0; i < nops; i++) {
+ grpc_metadata_array md_array;
+ grpc_auth_metadata_processor processor =
+ grpc_server_get_auth_metadata_processor();
+ grpc_stream_op *op = &ops[i];
+ if (op->type != GRPC_OP_METADATA || calld->got_client_metadata) continue;
+ calld->got_client_metadata = 1;
+ if (processor.process == NULL) continue;
+ calld->md_op = op;
+ md_array = metadata_batch_to_md_array(&op->data.metadata);
+ processor.process(processor.state, &calld->ticket,
+ chand->security_connector->auth_context,
+ md_array.metadata, md_array.count,
+ on_md_processing_done, elem);
+ grpc_metadata_array_destroy(&md_array);
+ return;
+ }
+ }
+ calld->on_done_recv->cb(calld->on_done_recv->cb_arg, success);
+}
+
+static void set_recv_ops_md_callbacks(grpc_call_element *elem,
+ grpc_transport_stream_op *op) {
+ call_data *calld = elem->call_data;
+
+ if (op->recv_ops && !calld->got_client_metadata) {
+ /* substitute our callback for the higher callback */
+ calld->recv_ops = op->recv_ops;
+ calld->on_done_recv = op->on_done_recv;
+ op->on_done_recv = &calld->auth_on_recv;
+ calld->transport_op = *op;
+ }
+}
+
/* Called either:
- in response to an API call (or similar) from above, to send something
- a network event (or similar) from below, to receive something
@@ -52,9 +181,7 @@ typedef struct channel_data {
that is being sent or received. */
static void auth_start_transport_op(grpc_call_element *elem,
grpc_transport_stream_op *op) {
- /* TODO(jboeuf): Get the metadata and get a new context from it. */
-
- /* pass control down the stack */
+ set_recv_ops_md_callbacks(elem, op);
grpc_call_next_op(elem, op);
}
@@ -68,11 +195,17 @@ static void init_call_elem(grpc_call_element *elem,
grpc_server_security_context *server_ctx = NULL;
/* initialize members */
- calld->unused = 0;
+ memset(calld, 0, sizeof(*calld));
+ grpc_iomgr_closure_init(&calld->auth_on_recv, auth_on_recv, elem);
GPR_ASSERT(initial_op && initial_op->context != NULL &&
initial_op->context[GRPC_CONTEXT_SECURITY].value == NULL);
+ /* Get the pollset for the ticket. */
+ if (initial_op->bind_pollset) {
+ calld->ticket.pollset = initial_op->bind_pollset;
+ }
+
/* Create a security context for the call and reference the auth context from
the channel. */
if (initial_op->context[GRPC_CONTEXT_SECURITY].value != NULL) {
@@ -85,10 +218,15 @@ static void init_call_elem(grpc_call_element *elem,
initial_op->context[GRPC_CONTEXT_SECURITY].value = server_ctx;
initial_op->context[GRPC_CONTEXT_SECURITY].destroy =
grpc_server_security_context_destroy;
+ calld->call_auth_context = &server_ctx->auth_context;
+
+ /* Set the metadata callbacks. */
+ set_recv_ops_md_callbacks(elem, initial_op);
}
/* Destructor for call_data */
-static void destroy_call_elem(grpc_call_element *elem) {}
+static void destroy_call_elem(grpc_call_element *elem) {
+}
/* Constructor for channel_data */
static void init_channel_elem(grpc_channel_element *elem, grpc_channel *master,
@@ -109,6 +247,7 @@ static void init_channel_elem(grpc_channel_element *elem, grpc_channel *master,
GPR_ASSERT(!sc->is_client_side);
chand->security_connector =
GRPC_SECURITY_CONNECTOR_REF(sc, "server_auth_filter");
+ chand->mdctx = mdctx;
}
/* Destructor for channel data */
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-18 13:03:23 +0000