aboutsummaryrefslogtreecommitdiffhomepage
path: root/src/core
diff options
context:
space:
mode:
Diffstat (limited to 'src/core')
-rw-r--r--src/core/security/credentials.c6
-rw-r--r--src/core/security/credentials.h1
-rw-r--r--src/core/security/security_context.c32
-rw-r--r--src/core/security/security_context.h7
-rw-r--r--src/core/security/server_auth_filter.c17
-rw-r--r--src/core/security/server_secure_chttp2.c14
6 files changed, 66 insertions, 11 deletions
diff --git a/src/core/security/credentials.c b/src/core/security/credentials.c
index b76a60405c..2239f57378 100644
--- a/src/core/security/credentials.c
+++ b/src/core/security/credentials.c
@@ -149,6 +149,12 @@ grpc_security_status grpc_server_credentials_create_security_connector(
return creds->vtable->create_security_connector(creds, sc);
}
+void grpc_server_credentials_set_auth_metadata_processor(
+ grpc_server_credentials *creds, grpc_auth_metadata_processor processor) {
+ if (creds == NULL) return;
+ creds->processor = processor;
+}
+
/* -- Ssl credentials. -- */
static void ssl_destroy(grpc_credentials *creds) {
diff --git a/src/core/security/credentials.h b/src/core/security/credentials.h
index ecec2623ef..04736525dc 100644
--- a/src/core/security/credentials.h
+++ b/src/core/security/credentials.h
@@ -217,6 +217,7 @@ typedef struct {
struct grpc_server_credentials {
const grpc_server_credentials_vtable *vtable;
const char *type;
+ grpc_auth_metadata_processor processor;
};
grpc_security_status grpc_server_credentials_create_security_connector(
diff --git a/src/core/security/security_context.c b/src/core/security/security_context.c
index 8ccce89ba9..1ef0fc9255 100644
--- a/src/core/security/security_context.c
+++ b/src/core/security/security_context.c
@@ -295,3 +295,35 @@ void grpc_auth_property_reset(grpc_auth_property *property) {
memset(property, 0, sizeof(grpc_auth_property));
}
+grpc_arg grpc_auth_metadata_processor_to_arg(grpc_auth_metadata_processor *p) {
+ grpc_arg arg;
+ memset(&arg, 0, sizeof(grpc_arg));
+ arg.type = GRPC_ARG_POINTER;
+ arg.key = GRPC_AUTH_METADATA_PROCESSOR_ARG;
+ arg.value.pointer.p = p;
+ return arg;
+}
+
+grpc_auth_metadata_processor *grpc_auth_metadata_processor_from_arg(
+ const grpc_arg *arg) {
+ if (strcmp(arg->key, GRPC_AUTH_METADATA_PROCESSOR_ARG) != 0) return NULL;
+ if (arg->type != GRPC_ARG_POINTER) {
+ gpr_log(GPR_ERROR, "Invalid type %d for arg %s", arg->type,
+ GRPC_AUTH_METADATA_PROCESSOR_ARG);
+ return NULL;
+ }
+ return arg->value.pointer.p;
+}
+
+grpc_auth_metadata_processor *grpc_find_auth_metadata_processor_in_args(
+ const grpc_channel_args *args) {
+ size_t i;
+ if (args == NULL) return NULL;
+ for (i = 0; i < args->num_args; i++) {
+ grpc_auth_metadata_processor *p =
+ grpc_auth_metadata_processor_from_arg(&args->args[i]);
+ if (p != NULL) return p;
+ }
+ return NULL;
+}
+
diff --git a/src/core/security/security_context.h b/src/core/security/security_context.h
index d4351cb74c..ddc0a7afad 100644
--- a/src/core/security/security_context.h
+++ b/src/core/security/security_context.h
@@ -105,8 +105,13 @@ grpc_server_security_context *grpc_server_security_context_create(void);
void grpc_server_security_context_destroy(void *ctx);
/* --- Auth metadata processing. --- */
+#define GRPC_AUTH_METADATA_PROCESSOR_ARG "grpc.auth_metadata_processor"
-grpc_auth_metadata_processor grpc_server_get_auth_metadata_processor(void);
+grpc_arg grpc_auth_metadata_processor_to_arg(grpc_auth_metadata_processor *p);
+grpc_auth_metadata_processor *grpc_auth_metadata_processor_from_arg(
+ const grpc_arg *arg);
+grpc_auth_metadata_processor *grpc_find_auth_metadata_processor_in_args(
+ const grpc_channel_args *args);
#endif /* GRPC_INTERNAL_CORE_SECURITY_SECURITY_CONTEXT_H */
diff --git a/src/core/security/server_auth_filter.c b/src/core/security/server_auth_filter.c
index fd0f94b19c..41d3110001 100644
--- a/src/core/security/server_auth_filter.c
+++ b/src/core/security/server_auth_filter.c
@@ -59,6 +59,7 @@ typedef struct call_data {
typedef struct channel_data {
grpc_security_connector *security_connector;
+ grpc_auth_metadata_processor processor;
grpc_mdctx *mdctx;
} channel_data;
@@ -142,18 +143,16 @@ static void auth_on_recv(void *user_data, int success) {
grpc_stream_op *ops = calld->recv_ops->ops;
for (i = 0; i < nops; i++) {
grpc_metadata_array md_array;
- grpc_auth_metadata_processor processor =
- grpc_server_get_auth_metadata_processor();
grpc_stream_op *op = &ops[i];
if (op->type != GRPC_OP_METADATA || calld->got_client_metadata) continue;
calld->got_client_metadata = 1;
- if (processor.process == NULL) continue;
+ if (chand->processor.process == NULL) continue;
calld->md_op = op;
md_array = metadata_batch_to_md_array(&op->data.metadata);
- processor.process(processor.state, &calld->ticket,
- chand->security_connector->auth_context,
- md_array.metadata, md_array.count,
- on_md_processing_done, elem);
+ chand->processor.process(chand->processor.state, &calld->ticket,
+ chand->security_connector->auth_context,
+ md_array.metadata, md_array.count,
+ on_md_processing_done, elem);
grpc_metadata_array_destroy(&md_array);
return;
}
@@ -233,6 +232,8 @@ static void init_channel_elem(grpc_channel_element *elem, grpc_channel *master,
const grpc_channel_args *args, grpc_mdctx *mdctx,
int is_first, int is_last) {
grpc_security_connector *sc = grpc_find_security_connector_in_args(args);
+ grpc_auth_metadata_processor *processor =
+ grpc_find_auth_metadata_processor_in_args(args);
/* grab pointers to our data from the channel element */
channel_data *chand = elem->channel_data;
@@ -242,12 +243,14 @@ static void init_channel_elem(grpc_channel_element *elem, grpc_channel *master,
GPR_ASSERT(!is_first);
GPR_ASSERT(!is_last);
GPR_ASSERT(sc != NULL);
+ GPR_ASSERT(processor != NULL);
/* initialize members */
GPR_ASSERT(!sc->is_client_side);
chand->security_connector =
GRPC_SECURITY_CONNECTOR_REF(sc, "server_auth_filter");
chand->mdctx = mdctx;
+ chand->processor = *processor;
}
/* Destructor for channel data */
diff --git a/src/core/security/server_secure_chttp2.c b/src/core/security/server_secure_chttp2.c
index 3717b8989f..8d9d036d80 100644
--- a/src/core/security/server_secure_chttp2.c
+++ b/src/core/security/server_secure_chttp2.c
@@ -43,6 +43,7 @@
#include "src/core/security/auth_filters.h"
#include "src/core/security/credentials.h"
#include "src/core/security/security_connector.h"
+#include "src/core/security/security_context.h"
#include "src/core/security/secure_transport_setup.h"
#include "src/core/surface/server.h"
#include "src/core/transport/chttp2_transport.h"
@@ -60,6 +61,7 @@ typedef struct grpc_server_secure_state {
grpc_server *server;
grpc_tcp_server *tcp;
grpc_security_connector *sc;
+ grpc_auth_metadata_processor processor;
tcp_endpoint_list *handshaking_tcp_endpoints;
int is_shutdown;
gpr_mu mu;
@@ -86,9 +88,13 @@ static void setup_transport(void *statep, grpc_transport *transport,
static grpc_channel_filter const *extra_filters[] = {
&grpc_server_auth_filter, &grpc_http_server_filter};
grpc_server_secure_state *state = statep;
- grpc_arg connector_arg = grpc_security_connector_to_arg(state->sc);
- grpc_channel_args *args_copy = grpc_channel_args_copy_and_add(
- grpc_server_get_channel_args(state->server), &connector_arg, 1);
+ grpc_channel_args *args_copy;
+ grpc_arg args_to_add[2];
+ args_to_add[0] = grpc_security_connector_to_arg(state->sc);
+ args_to_add[1] = grpc_auth_metadata_processor_to_arg(&state->processor);
+ args_copy = grpc_channel_args_copy_and_add(
+ grpc_server_get_channel_args(state->server), args_to_add,
+ GPR_ARRAY_SIZE(args_to_add));
grpc_server_setup_transport(state->server, transport, extra_filters,
GPR_ARRAY_SIZE(extra_filters), mdctx, args_copy);
grpc_channel_args_destroy(args_copy);
@@ -252,9 +258,11 @@ int grpc_server_add_secure_http2_port(grpc_server *server, const char *addr,
grpc_resolved_addresses_destroy(resolved);
state = gpr_malloc(sizeof(*state));
+ memset(state, 0, sizeof(*state));
state->server = server;
state->tcp = tcp;
state->sc = sc;
+ state->processor = creds->processor;
state->handshaking_tcp_endpoints = NULL;
state->is_shutdown = 0;
gpr_mu_init(&state->mu);
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-27 09:05:11 +0000