aboutsummaryrefslogtreecommitdiffhomepage
path: root/src/core
diff options
context:
space:
mode:
Diffstat (limited to 'src/core')
-rw-r--r--src/core/client_config/subchannel_index.c1
-rw-r--r--src/core/iomgr/pollset.h12
-rw-r--r--src/core/security/security_connector.c16
-rw-r--r--src/core/tsi/ssl_transport_security.c27
-rw-r--r--src/core/tsi/ssl_transport_security.h2
5 files changed, 46 insertions, 12 deletions
diff --git a/src/core/client_config/subchannel_index.c b/src/core/client_config/subchannel_index.c
index 3f948998f9..24cc76cf22 100644
--- a/src/core/client_config/subchannel_index.c
+++ b/src/core/client_config/subchannel_index.c
@@ -108,6 +108,7 @@ static int subchannel_key_compare(grpc_subchannel_key *a,
if (c != 0) return c;
c = memcmp(a->args.filters, b->args.filters,
a->args.filter_count * sizeof(*a->args.filters));
+ if (c != 0) return c;
return grpc_channel_args_compare(a->args.args, b->args.args);
}
diff --git a/src/core/iomgr/pollset.h b/src/core/iomgr/pollset.h
index 92a0374ddd..ee1debfb71 100644
--- a/src/core/iomgr/pollset.h
+++ b/src/core/iomgr/pollset.h
@@ -55,7 +55,7 @@ typedef struct grpc_pollset_worker grpc_pollset_worker;
size_t grpc_pollset_size(void);
void grpc_pollset_init(grpc_pollset *pollset, gpr_mu **mu);
/* Begin shutting down the pollset, and call closure when done.
- * GRPC_POLLSET_MU(pollset) must be held */
+ * pollset's mutex must be held */
void grpc_pollset_shutdown(grpc_exec_ctx *exec_ctx, grpc_pollset *pollset,
grpc_closure *closure);
/** Reset the pollset to its initial state (perhaps with some cached objects);
@@ -66,16 +66,16 @@ void grpc_pollset_destroy(grpc_pollset *pollset);
/* Do some work on a pollset.
May involve invoking asynchronous callbacks, or actually polling file
descriptors.
- Requires GRPC_POLLSET_MU(pollset) locked.
- May unlock GRPC_POLLSET_MU(pollset) during its execution.
+ Requires pollset's mutex locked.
+ May unlock its mutex during its execution.
worker is a (platform-specific) handle that can be used to wake up
from grpc_pollset_work before any events are received and before the timeout
has expired. It is both initialized and destroyed by grpc_pollset_work.
Initialization of worker is guaranteed to occur BEFORE the
- GRPC_POLLSET_MU(pollset) is released for the first time by
- grpc_pollset_work, and it is guaranteed that GRPC_POLLSET_MU(pollset) will
- not be released by grpc_pollset_work AFTER worker has been destroyed.
+ pollset's mutex is released for the first time by grpc_pollset_work
+ and it is guaranteed that it will not be released by grpc_pollset_work
+ AFTER worker has been destroyed.
Tries not to block past deadline.
May call grpc_closure_list_run on grpc_closure_list, without holding the
diff --git a/src/core/security/security_connector.c b/src/core/security/security_connector.c
index 33c62a20c2..fbec263eed 100644
--- a/src/core/security/security_connector.c
+++ b/src/core/security/security_connector.c
@@ -492,6 +492,9 @@ grpc_auth_context *tsi_ssl_peer_to_auth_context(const tsi_peer *peer) {
peer_identity_property_name = GRPC_X509_SAN_PROPERTY_NAME;
grpc_auth_context_add_property(ctx, GRPC_X509_SAN_PROPERTY_NAME,
prop->value.data, prop->value.length);
+ } else if (strcmp(prop->name, TSI_X509_PEM_CERT_PROPERTY) == 0) {
+ grpc_auth_context_add_property(ctx, GRPC_X509_PEM_CERT_PROPERTY_NAME,
+ prop->value.data, prop->value.length);
}
}
if (peer_identity_property_name != NULL) {
@@ -554,9 +557,9 @@ static void ssl_server_check_peer(grpc_exec_ctx *exec_ctx,
grpc_auth_context_unref(auth_context);
}
-static void add_shalow_auth_property_to_peer(tsi_peer *peer,
- const grpc_auth_property *prop,
- const char *tsi_prop_name) {
+static void add_shallow_auth_property_to_peer(tsi_peer *peer,
+ const grpc_auth_property *prop,
+ const char *tsi_prop_name) {
tsi_peer_property *tsi_prop = &peer->properties[peer->property_count++];
tsi_prop->name = (char *)tsi_prop_name;
tsi_prop->value.data = prop->value;
@@ -579,11 +582,14 @@ tsi_peer tsi_shallow_peer_from_ssl_auth_context(
it = grpc_auth_context_property_iterator(auth_context);
while ((prop = grpc_auth_property_iterator_next(&it)) != NULL) {
if (strcmp(prop->name, GRPC_X509_SAN_PROPERTY_NAME) == 0) {
- add_shalow_auth_property_to_peer(
+ add_shallow_auth_property_to_peer(
&peer, prop, TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY);
} else if (strcmp(prop->name, GRPC_X509_CN_PROPERTY_NAME) == 0) {
- add_shalow_auth_property_to_peer(
+ add_shallow_auth_property_to_peer(
&peer, prop, TSI_X509_SUBJECT_COMMON_NAME_PEER_PROPERTY);
+ } else if (strcmp(prop->name, GRPC_X509_PEM_CERT_PROPERTY_NAME) == 0) {
+ add_shallow_auth_property_to_peer(&peer, prop,
+ TSI_X509_PEM_CERT_PROPERTY);
}
}
}
diff --git a/src/core/tsi/ssl_transport_security.c b/src/core/tsi/ssl_transport_security.c
index fcbd910f07..42d25ca929 100644
--- a/src/core/tsi/ssl_transport_security.c
+++ b/src/core/tsi/ssl_transport_security.c
@@ -293,6 +293,26 @@ static tsi_result peer_property_from_x509_common_name(
return result;
}
+/* Gets the X509 cert in PEM format as a tsi_peer_property. */
+static tsi_result add_pem_certificate(X509 *cert, tsi_peer_property *property) {
+ BIO *bio = BIO_new(BIO_s_mem());
+ if (!PEM_write_bio_X509(bio, cert)) {
+ BIO_free(bio);
+ return TSI_INTERNAL_ERROR;
+ }
+ char *contents;
+ long len = BIO_get_mem_data(bio, &contents);
+ if (len <= 0) {
+ BIO_free(bio);
+ return TSI_INTERNAL_ERROR;
+ }
+ tsi_result result = tsi_construct_string_peer_property(
+ TSI_X509_PEM_CERT_PROPERTY, (const char *)contents, (size_t)len,
+ property);
+ BIO_free(bio);
+ return result;
+}
+
/* Gets the subject SANs from an X509 cert as a tsi_peer_property. */
static tsi_result add_subject_alt_names_properties_to_peer(
tsi_peer *peer, GENERAL_NAMES *subject_alt_names,
@@ -363,7 +383,8 @@ static tsi_result peer_from_x509(X509 *cert, int include_certificate_type,
tsi_result result;
GPR_ASSERT(subject_alt_name_count >= 0);
property_count = (include_certificate_type ? (size_t)1 : 0) +
- 1 /* common name */ + (size_t)subject_alt_name_count;
+ 2 /* common name, certificate */ +
+ (size_t)subject_alt_name_count;
result = tsi_construct_peer(property_count, peer);
if (result != TSI_OK) return result;
do {
@@ -377,6 +398,10 @@ static tsi_result peer_from_x509(X509 *cert, int include_certificate_type,
cert, &peer->properties[include_certificate_type ? 1 : 0]);
if (result != TSI_OK) break;
+ result = add_pem_certificate(
+ cert, &peer->properties[include_certificate_type ? 2 : 1]);
+ if (result != TSI_OK) break;
+
if (subject_alt_name_count != 0) {
result = add_subject_alt_names_properties_to_peer(
peer, subject_alt_names, (size_t)subject_alt_name_count);
diff --git a/src/core/tsi/ssl_transport_security.h b/src/core/tsi/ssl_transport_security.h
index 4909af4c47..32bb067f0b 100644
--- a/src/core/tsi/ssl_transport_security.h
+++ b/src/core/tsi/ssl_transport_security.h
@@ -48,6 +48,8 @@ extern "C" {
#define TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY \
"x509_subject_alternative_name"
+#define TSI_X509_PEM_CERT_PROPERTY "x509_pem_cert"
+
#define TSI_SSL_ALPN_SELECTED_PROTOCOL "ssl_alpn_selected_protocol"
/* --- tsi_ssl_handshaker_factory object ---
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-30 21:34:33 +0000