Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,9 @@
#include <grpc/grpc_security.h>
#include <grpc/support/port_platform.h>

#include "src/core/credentials/transport/tls/ssl_utils.h"
#include "src/core/tsi/ssl_transport_security.h"
#include "src/core/util/grpc_check.h"
#include "ssl_utils.h"
#include "absl/status/status.h"

bool grpc_tls_certificate_distributor::CertificateInfo::AreRootsEmpty() {
Expand Down
64 changes: 35 additions & 29 deletions src/core/credentials/transport/tls/grpc_tls_certificate_provider.cc
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
#include <variant>
#include <vector>

#include "grpc_tls_certificate_selector.h"
#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
#include "src/core/credentials/transport/tls/spiffe_utils.h"
#include "src/core/credentials/transport/tls/ssl_utils.h"
#include "src/core/lib/debug/trace.h"
Expand Down Expand Up @@ -234,19 +234,22 @@ absl::Status FileWatcherCertificateProvider::ValidateCredentials() const {
if (!status.ok()) {
return status;
}
return Match(pem_key_cert_pairs_, [](const std::vector<PemKeyCertPair>& pem_pairs) {
for (const PemKeyCertPair& pair : pem_pairs) {
absl::Status status =
ValidatePemKeyCertPair(pair.cert_chain(), pair.private_key());
if (!status.ok()) {
return status;
}
}
return absl::OkStatus();
}, [](const std::shared_ptr<CertificateSelector>& cert_selector){
// We should never be able to get this from files.
return absl::InternalError("Invalid pem key cert pairs");
});
return Match(
pem_key_cert_pairs_,
[](const std::vector<PemKeyCertPair>& pem_pairs) {
for (const PemKeyCertPair& pair : pem_pairs) {
absl::Status status =
ValidatePemKeyCertPair(pair.cert_chain(), pair.private_key());
if (!status.ok()) {
return status;
}
}
return absl::OkStatus();
},
[](const std::shared_ptr<CertificateSelector>& cert_selector) {
// We should never be able to get this from files.
return absl::InternalError("Invalid pem key cert pairs");
});
}

void FileWatcherCertificateProvider::ForceUpdate() {
Expand Down Expand Up @@ -532,21 +535,24 @@ absl::Status InMemoryCertificateProvider::ValidateCredentials() const {
if (!status.ok()) {
return status;
}
return Match(pem_key_cert_pairs_, [](const std::vector<PemKeyCertPair>& pem_pairs) {
for (const PemKeyCertPair& pair : pem_pairs) {
absl::Status status =
ValidatePemKeyCertPair(pair.cert_chain(), pair.private_key());
if (!status.ok()) {
return status;
}
}
return absl::OkStatus();
}, [](const std::shared_ptr<CertificateSelector>& cert_selector){
if (cert_selector == nullptr) {
return absl::InvalidArgumentError("Certificiate selector is nullptr");
}
return absl::OkStatus();
});
return Match(
pem_key_cert_pairs_,
[](const std::vector<PemKeyCertPair>& pem_pairs) {
for (const PemKeyCertPair& pair : pem_pairs) {
absl::Status status =
ValidatePemKeyCertPair(pair.cert_chain(), pair.private_key());
if (!status.ok()) {
return status;
}
}
return absl::OkStatus();
},
[](const std::shared_ptr<CertificateSelector>& cert_selector) {
if (cert_selector == nullptr) {
return absl::InvalidArgumentError("Certificiate selector is nullptr");
}
return absl::OkStatus();
});
}

absl::Status InMemoryCertificateProvider::UpdateRoot(
Expand Down
2 changes: 1 addition & 1 deletion src/core/credentials/transport/tls/ssl_utils.cc
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,8 @@
#include <utility>
#include <vector>

#include "grpc_tls_certificate_selector.h"
#include "src/core/config/config_vars.h"
#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
#include "src/core/credentials/transport/tls/load_system_roots.h"
#include "src/core/ext/transport/chttp2/alpn/alpn.h"
#include "src/core/lib/channel/channel_args.h"
Expand Down
5 changes: 2 additions & 3 deletions src/core/credentials/transport/tls/tls_security_connector.cc
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
#include <utility>
#include <vector>

#include "grpc_tls_certificate_selector.h"
#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
#include "src/core/credentials/transport/tls/grpc_tls_certificate_verifier.h"
#include "src/core/credentials/transport/tls/grpc_tls_credentials_options.h"
#include "src/core/credentials/transport/tls/ssl_utils.h"
Expand Down Expand Up @@ -573,8 +573,7 @@ TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
[](std::shared_ptr<CertificateSelector>*) {});
bool use_default_roots = options_->root_certificate_distributor() == nullptr;
return grpc_ssl_tsi_client_handshaker_factory_init(
pem_key_cert_pair,
use_default_roots ? nullptr : root_cert_info_,
pem_key_cert_pair, use_default_roots ? nullptr : root_cert_info_,
skip_server_certificate_verification,
grpc_get_tsi_tls_version(options_->min_tls_version()),
grpc_get_tsi_tls_version(options_->max_tls_version()), ssl_session_cache_,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@
#include "test/core/test_util/test_config.h"
#include "test/core/test_util/tls_utils.h"
#include "test/cpp/end2end/test_service_impl.h"
#include "tls_test_certificate_selector.h"
#include "test/cpp/end2end/tls_test_certificate_selector.h"
#include "gmock/gmock.h"
#include "gtest/gtest.h"
#include "absl/log/check.h"
Expand Down
9 changes: 4 additions & 5 deletions test/cpp/end2end/tls_test_certificate_selector.h
Original file line number Diff line number Diff line change
Expand Up @@ -22,16 +22,16 @@
#include <grpc/event_engine/event_engine.h>
#include <grpcpp/security/tls_private_key_signer.h>
#include <grpcpp/support/status.h>
#include <openssl/pem.h>

#include <memory>
#include <variant>

#include "absl/log/check.h"
#include "absl/status/statusor.h"
#include "absl/strings/string_view.h"
#include <openssl/pem.h>

#if defined(OPENSSL_IS_BORINGSSL)
#if defined(GRPC_TEST_CPP_END2END_TLS_TEST_CERTIFICATE_SELECTOR_H)

#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"

Expand Down Expand Up @@ -78,8 +78,7 @@ class AsyncTestCertificateSelector : public grpc_core::CertificateSelector {
std::variant<absl::string_view,
std::shared_ptr<grpc::experimental::PrivateKeySigner>>
pem_private_key,
absl::string_view sni,
absl::Duration delay = absl::ZeroDuration())
absl::string_view sni, absl::Duration delay = absl::ZeroDuration())
: pem_cert_chain_(pem_cert_chain),
pem_private_key_(std::move(pem_private_key)),
sni_(sni),
Expand Down Expand Up @@ -107,5 +106,5 @@ class AsyncTestCertificateSelector : public grpc_core::CertificateSelector {
} // namespace testing
} // namespace grpc

#endif // OPENSSL_IS_BORINGSSL
#endif // GRPC_TEST_CPP_END2END_TLS_TEST_CERTIFICATE_SELECTOR_H
#endif //