1 /*
2 *
3 * Copyright 2015 gRPC authors.
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 */
18
19 #include "test/core/end2end/end2end_tests.h"
20
21 #include <stdio.h>
22 #include <string.h>
23
24 #include <grpc/byte_buffer.h>
25 #include <grpc/grpc_security.h>
26 #include <grpc/support/alloc.h>
27 #include <grpc/support/log.h>
28 #include <grpc/support/time.h>
29
30 #include "src/core/lib/gpr/string.h"
31 #include "src/core/lib/security/credentials/credentials.h"
32 #include "test/core/end2end/cq_verifier.h"
33
34 static const char iam_token[] = "token";
35 static const char iam_selector[] = "selector";
36 static const char overridden_iam_token[] = "overridden_token";
37 static const char overridden_iam_selector[] = "overridden_selector";
38
39 typedef enum { NONE, OVERRIDE, DESTROY } override_mode;
40
tag(intptr_t t)41 static void* tag(intptr_t t) { return (void*)t; }
42
begin_test(grpc_end2end_test_config config,const char * test_name,int fail_server_auth_check)43 static grpc_end2end_test_fixture begin_test(grpc_end2end_test_config config,
44 const char* test_name,
45 int fail_server_auth_check) {
46 grpc_end2end_test_fixture f;
47 gpr_log(GPR_INFO, "Running test: %s/%s", test_name, config.name);
48 f = config.create_fixture(nullptr, nullptr);
49 config.init_client(&f, nullptr);
50 if (fail_server_auth_check) {
51 grpc_arg fail_auth_arg = {
52 GRPC_ARG_STRING,
53 const_cast<char*>(FAIL_AUTH_CHECK_SERVER_ARG_NAME),
54 {nullptr}};
55 grpc_channel_args args;
56 args.num_args = 1;
57 args.args = &fail_auth_arg;
58 config.init_server(&f, &args);
59 } else {
60 config.init_server(&f, nullptr);
61 }
62 return f;
63 }
64
n_seconds_from_now(int n)65 static gpr_timespec n_seconds_from_now(int n) {
66 return grpc_timeout_seconds_to_deadline(n);
67 }
68
five_seconds_from_now(void)69 static gpr_timespec five_seconds_from_now(void) {
70 return n_seconds_from_now(5);
71 }
72
drain_cq(grpc_completion_queue * cq)73 static void drain_cq(grpc_completion_queue* cq) {
74 grpc_event ev;
75 do {
76 ev = grpc_completion_queue_next(cq, five_seconds_from_now(), nullptr);
77 } while (ev.type != GRPC_QUEUE_SHUTDOWN);
78 }
79
shutdown_server(grpc_end2end_test_fixture * f)80 static void shutdown_server(grpc_end2end_test_fixture* f) {
81 if (!f->server) return;
82 grpc_server_shutdown_and_notify(f->server, f->shutdown_cq, tag(1000));
83 GPR_ASSERT(grpc_completion_queue_pluck(f->shutdown_cq, tag(1000),
84 grpc_timeout_seconds_to_deadline(5),
85 nullptr)
86 .type == GRPC_OP_COMPLETE);
87 grpc_server_destroy(f->server);
88 f->server = nullptr;
89 }
90
shutdown_client(grpc_end2end_test_fixture * f)91 static void shutdown_client(grpc_end2end_test_fixture* f) {
92 if (!f->client) return;
93 grpc_channel_destroy(f->client);
94 f->client = nullptr;
95 }
96
end_test(grpc_end2end_test_fixture * f)97 static void end_test(grpc_end2end_test_fixture* f) {
98 shutdown_server(f);
99 shutdown_client(f);
100
101 grpc_completion_queue_shutdown(f->cq);
102 drain_cq(f->cq);
103 grpc_completion_queue_destroy(f->cq);
104 grpc_completion_queue_destroy(f->shutdown_cq);
105 }
106
print_auth_context(int is_client,const grpc_auth_context * ctx)107 static void print_auth_context(int is_client, const grpc_auth_context* ctx) {
108 const grpc_auth_property* p;
109 grpc_auth_property_iterator it;
110 gpr_log(GPR_INFO, "%s peer:", is_client ? "client" : "server");
111 gpr_log(GPR_INFO, "\tauthenticated: %s",
112 grpc_auth_context_peer_is_authenticated(ctx) ? "YES" : "NO");
113 it = grpc_auth_context_peer_identity(ctx);
114 while ((p = grpc_auth_property_iterator_next(&it)) != nullptr) {
115 gpr_log(GPR_INFO, "\t\t%s: %s", p->name, p->value);
116 }
117 gpr_log(GPR_INFO, "\tall properties:");
118 it = grpc_auth_context_property_iterator(ctx);
119 while ((p = grpc_auth_property_iterator_next(&it)) != nullptr) {
120 gpr_log(GPR_INFO, "\t\t%s: %s", p->name, p->value);
121 }
122 }
123
request_response_with_payload_and_call_creds(const char * test_name,grpc_end2end_test_config config,override_mode mode)124 static void request_response_with_payload_and_call_creds(
125 const char* test_name, grpc_end2end_test_config config,
126 override_mode mode) {
127 grpc_call* c;
128 grpc_call* s;
129 grpc_slice request_payload_slice =
130 grpc_slice_from_copied_string("hello world");
131 grpc_slice response_payload_slice =
132 grpc_slice_from_copied_string("hello you");
133 grpc_byte_buffer* request_payload =
134 grpc_raw_byte_buffer_create(&request_payload_slice, 1);
135 grpc_byte_buffer* response_payload =
136 grpc_raw_byte_buffer_create(&response_payload_slice, 1);
137 grpc_end2end_test_fixture f;
138 cq_verifier* cqv;
139 grpc_op ops[6];
140 grpc_op* op;
141 grpc_metadata_array initial_metadata_recv;
142 grpc_metadata_array trailing_metadata_recv;
143 grpc_metadata_array request_metadata_recv;
144 grpc_byte_buffer* request_payload_recv = nullptr;
145 grpc_byte_buffer* response_payload_recv = nullptr;
146 grpc_call_details call_details;
147 grpc_status_code status;
148 grpc_call_error error;
149 grpc_slice details;
150 int was_cancelled = 2;
151 grpc_call_credentials* creds = nullptr;
152 grpc_auth_context* s_auth_context = nullptr;
153 grpc_auth_context* c_auth_context = nullptr;
154
155 f = begin_test(config, test_name, 0);
156 cqv = cq_verifier_create(f.cq);
157
158 gpr_timespec deadline = five_seconds_from_now();
159 c = grpc_channel_create_call(f.client, nullptr, GRPC_PROPAGATE_DEFAULTS, f.cq,
160 grpc_slice_from_static_string("/foo"), nullptr,
161 deadline, nullptr);
162 GPR_ASSERT(c);
163 creds = grpc_google_iam_credentials_create(iam_token, iam_selector, nullptr);
164 GPR_ASSERT(creds != nullptr);
165 GPR_ASSERT(grpc_call_set_credentials(c, creds) == GRPC_CALL_OK);
166 switch (mode) {
167 case NONE:
168 break;
169 case OVERRIDE:
170 grpc_call_credentials_release(creds);
171 creds = grpc_google_iam_credentials_create(
172 overridden_iam_token, overridden_iam_selector, nullptr);
173 GPR_ASSERT(creds != nullptr);
174 GPR_ASSERT(grpc_call_set_credentials(c, creds) == GRPC_CALL_OK);
175 break;
176 case DESTROY:
177 GPR_ASSERT(grpc_call_set_credentials(c, nullptr) == GRPC_CALL_OK);
178 break;
179 }
180 grpc_call_credentials_release(creds);
181
182 grpc_metadata_array_init(&initial_metadata_recv);
183 grpc_metadata_array_init(&trailing_metadata_recv);
184 grpc_metadata_array_init(&request_metadata_recv);
185 grpc_call_details_init(&call_details);
186
187 memset(ops, 0, sizeof(ops));
188 op = ops;
189 op->op = GRPC_OP_SEND_INITIAL_METADATA;
190 op->data.send_initial_metadata.count = 0;
191 op->flags = 0;
192 op->reserved = nullptr;
193 op++;
194 op->op = GRPC_OP_SEND_MESSAGE;
195 op->data.send_message.send_message = request_payload;
196 op->flags = 0;
197 op->reserved = nullptr;
198 op++;
199 op->op = GRPC_OP_SEND_CLOSE_FROM_CLIENT;
200 op->flags = 0;
201 op->reserved = nullptr;
202 op++;
203 op->op = GRPC_OP_RECV_INITIAL_METADATA;
204 op->data.recv_initial_metadata.recv_initial_metadata = &initial_metadata_recv;
205 op->flags = 0;
206 op->reserved = nullptr;
207 op++;
208 op->op = GRPC_OP_RECV_MESSAGE;
209 op->data.recv_message.recv_message = &response_payload_recv;
210 op->flags = 0;
211 op->reserved = nullptr;
212 op++;
213 op->op = GRPC_OP_RECV_STATUS_ON_CLIENT;
214 op->data.recv_status_on_client.trailing_metadata = &trailing_metadata_recv;
215 op->data.recv_status_on_client.status = &status;
216 op->data.recv_status_on_client.status_details = &details;
217 op->flags = 0;
218 op->reserved = nullptr;
219 op++;
220 error = grpc_call_start_batch(c, ops, static_cast<size_t>(op - ops), tag(1),
221 nullptr);
222 GPR_ASSERT(GRPC_CALL_OK == error);
223
224 error =
225 grpc_server_request_call(f.server, &s, &call_details,
226 &request_metadata_recv, f.cq, f.cq, tag(101));
227 GPR_ASSERT(GRPC_CALL_OK == error);
228 CQ_EXPECT_COMPLETION(cqv, tag(101), 1);
229 cq_verify(cqv);
230 s_auth_context = grpc_call_auth_context(s);
231 GPR_ASSERT(s_auth_context != nullptr);
232 print_auth_context(0, s_auth_context);
233 grpc_auth_context_release(s_auth_context);
234
235 c_auth_context = grpc_call_auth_context(c);
236 GPR_ASSERT(c_auth_context != nullptr);
237 print_auth_context(1, c_auth_context);
238 grpc_auth_context_release(c_auth_context);
239
240 /* Cannot set creds on the server call object. */
241 GPR_ASSERT(grpc_call_set_credentials(s, nullptr) != GRPC_CALL_OK);
242
243 memset(ops, 0, sizeof(ops));
244 op = ops;
245 op->op = GRPC_OP_SEND_INITIAL_METADATA;
246 op->data.send_initial_metadata.count = 0;
247 op->flags = 0;
248 op->reserved = nullptr;
249 op++;
250 op->op = GRPC_OP_RECV_MESSAGE;
251 op->data.recv_message.recv_message = &request_payload_recv;
252 op->flags = 0;
253 op->reserved = nullptr;
254 op++;
255 error = grpc_call_start_batch(s, ops, static_cast<size_t>(op - ops), tag(102),
256 nullptr);
257 GPR_ASSERT(GRPC_CALL_OK == error);
258
259 CQ_EXPECT_COMPLETION(cqv, tag(102), 1);
260 cq_verify(cqv);
261
262 memset(ops, 0, sizeof(ops));
263 op = ops;
264 op->op = GRPC_OP_RECV_CLOSE_ON_SERVER;
265 op->data.recv_close_on_server.cancelled = &was_cancelled;
266 op->flags = 0;
267 op->reserved = nullptr;
268 op++;
269 op->op = GRPC_OP_SEND_MESSAGE;
270 op->data.send_message.send_message = response_payload;
271 op->flags = 0;
272 op->reserved = nullptr;
273 op++;
274 op->op = GRPC_OP_SEND_STATUS_FROM_SERVER;
275 op->data.send_status_from_server.trailing_metadata_count = 0;
276 op->data.send_status_from_server.status = GRPC_STATUS_OK;
277 grpc_slice status_details = grpc_slice_from_static_string("xyz");
278 op->data.send_status_from_server.status_details = &status_details;
279 op->flags = 0;
280 op->reserved = nullptr;
281 op++;
282 error = grpc_call_start_batch(s, ops, static_cast<size_t>(op - ops), tag(103),
283 nullptr);
284 GPR_ASSERT(GRPC_CALL_OK == error);
285
286 CQ_EXPECT_COMPLETION(cqv, tag(103), 1);
287 CQ_EXPECT_COMPLETION(cqv, tag(1), 1);
288 cq_verify(cqv);
289
290 GPR_ASSERT(status == GRPC_STATUS_OK);
291 GPR_ASSERT(0 == grpc_slice_str_cmp(details, "xyz"));
292 GPR_ASSERT(0 == grpc_slice_str_cmp(call_details.method, "/foo"));
293 GPR_ASSERT(was_cancelled == 0);
294 GPR_ASSERT(byte_buffer_eq_string(request_payload_recv, "hello world"));
295 GPR_ASSERT(byte_buffer_eq_string(response_payload_recv, "hello you"));
296
297 switch (mode) {
298 case NONE:
299 GPR_ASSERT(contains_metadata(&request_metadata_recv,
300 GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
301 iam_token));
302 GPR_ASSERT(contains_metadata(&request_metadata_recv,
303 GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
304 iam_selector));
305 break;
306 case OVERRIDE:
307 GPR_ASSERT(contains_metadata(&request_metadata_recv,
308 GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
309 overridden_iam_token));
310 GPR_ASSERT(contains_metadata(&request_metadata_recv,
311 GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
312 overridden_iam_selector));
313 break;
314 case DESTROY:
315 GPR_ASSERT(!contains_metadata(&request_metadata_recv,
316 GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
317 iam_token));
318 GPR_ASSERT(!contains_metadata(&request_metadata_recv,
319 GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
320 iam_selector));
321 GPR_ASSERT(!contains_metadata(&request_metadata_recv,
322 GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY,
323 overridden_iam_token));
324 GPR_ASSERT(!contains_metadata(&request_metadata_recv,
325 GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY,
326 overridden_iam_selector));
327 break;
328 }
329
330 grpc_slice_unref(details);
331 grpc_metadata_array_destroy(&initial_metadata_recv);
332 grpc_metadata_array_destroy(&trailing_metadata_recv);
333 grpc_metadata_array_destroy(&request_metadata_recv);
334 grpc_call_details_destroy(&call_details);
335
336 grpc_call_unref(c);
337 grpc_call_unref(s);
338
339 cq_verifier_destroy(cqv);
340
341 grpc_byte_buffer_destroy(request_payload);
342 grpc_byte_buffer_destroy(response_payload);
343 grpc_byte_buffer_destroy(request_payload_recv);
344 grpc_byte_buffer_destroy(response_payload_recv);
345
346 end_test(&f);
347 config.tear_down_data(&f);
348 }
349
test_request_response_with_payload_and_call_creds(grpc_end2end_test_config config)350 static void test_request_response_with_payload_and_call_creds(
351 grpc_end2end_test_config config) {
352 request_response_with_payload_and_call_creds(
353 "test_request_response_with_payload_and_call_creds", config, NONE);
354 }
355
test_request_response_with_payload_and_overridden_call_creds(grpc_end2end_test_config config)356 static void test_request_response_with_payload_and_overridden_call_creds(
357 grpc_end2end_test_config config) {
358 request_response_with_payload_and_call_creds(
359 "test_request_response_with_payload_and_overridden_call_creds", config,
360 OVERRIDE);
361 }
362
test_request_response_with_payload_and_deleted_call_creds(grpc_end2end_test_config config)363 static void test_request_response_with_payload_and_deleted_call_creds(
364 grpc_end2end_test_config config) {
365 request_response_with_payload_and_call_creds(
366 "test_request_response_with_payload_and_deleted_call_creds", config,
367 DESTROY);
368 }
369
test_request_with_server_rejecting_client_creds(grpc_end2end_test_config config)370 static void test_request_with_server_rejecting_client_creds(
371 grpc_end2end_test_config config) {
372 grpc_op ops[6];
373 grpc_op* op;
374 grpc_call* c;
375 grpc_end2end_test_fixture f;
376 gpr_timespec deadline = five_seconds_from_now();
377 cq_verifier* cqv;
378 grpc_metadata_array initial_metadata_recv;
379 grpc_metadata_array trailing_metadata_recv;
380 grpc_metadata_array request_metadata_recv;
381 grpc_call_details call_details;
382 grpc_status_code status;
383 grpc_call_error error;
384 grpc_slice details;
385 grpc_byte_buffer* response_payload_recv = nullptr;
386 grpc_slice request_payload_slice =
387 grpc_slice_from_copied_string("hello world");
388 grpc_byte_buffer* request_payload =
389 grpc_raw_byte_buffer_create(&request_payload_slice, 1);
390 grpc_call_credentials* creds;
391
392 f = begin_test(config, "test_request_with_server_rejecting_client_creds", 1);
393 cqv = cq_verifier_create(f.cq);
394
395 c = grpc_channel_create_call(f.client, nullptr, GRPC_PROPAGATE_DEFAULTS, f.cq,
396 grpc_slice_from_static_string("/foo"), nullptr,
397 deadline, nullptr);
398 GPR_ASSERT(c);
399
400 creds = grpc_google_iam_credentials_create(iam_token, iam_selector, nullptr);
401 GPR_ASSERT(creds != nullptr);
402 GPR_ASSERT(grpc_call_set_credentials(c, creds) == GRPC_CALL_OK);
403 grpc_call_credentials_release(creds);
404
405 grpc_metadata_array_init(&initial_metadata_recv);
406 grpc_metadata_array_init(&trailing_metadata_recv);
407 grpc_metadata_array_init(&request_metadata_recv);
408 grpc_call_details_init(&call_details);
409
410 memset(ops, 0, sizeof(ops));
411 op = ops;
412 op->op = GRPC_OP_RECV_STATUS_ON_CLIENT;
413 op->data.recv_status_on_client.trailing_metadata = &trailing_metadata_recv;
414 op->data.recv_status_on_client.status = &status;
415 op->data.recv_status_on_client.status_details = &details;
416 op->flags = 0;
417 op->reserved = nullptr;
418 op++;
419 op->op = GRPC_OP_SEND_INITIAL_METADATA;
420 op->data.send_initial_metadata.count = 0;
421 op->flags = 0;
422 op->reserved = nullptr;
423 op++;
424 op->op = GRPC_OP_SEND_MESSAGE;
425 op->data.send_message.send_message = request_payload;
426 op->flags = 0;
427 op->reserved = nullptr;
428 op++;
429 op->op = GRPC_OP_SEND_CLOSE_FROM_CLIENT;
430 op->flags = 0;
431 op->reserved = nullptr;
432 op++;
433 op->op = GRPC_OP_RECV_INITIAL_METADATA;
434 op->data.recv_initial_metadata.recv_initial_metadata = &initial_metadata_recv;
435 op->flags = 0;
436 op->reserved = nullptr;
437 op++;
438 op->op = GRPC_OP_RECV_MESSAGE;
439 op->data.recv_message.recv_message = &response_payload_recv;
440 op->flags = 0;
441 op->reserved = nullptr;
442 op++;
443 error = grpc_call_start_batch(c, ops, static_cast<size_t>(op - ops), tag(1),
444 nullptr);
445 GPR_ASSERT(error == GRPC_CALL_OK);
446
447 CQ_EXPECT_COMPLETION(cqv, tag(1), 1);
448 cq_verify(cqv);
449
450 GPR_ASSERT(status == GRPC_STATUS_UNAUTHENTICATED);
451
452 grpc_metadata_array_destroy(&initial_metadata_recv);
453 grpc_metadata_array_destroy(&trailing_metadata_recv);
454 grpc_metadata_array_destroy(&request_metadata_recv);
455 grpc_call_details_destroy(&call_details);
456
457 grpc_byte_buffer_destroy(request_payload);
458 grpc_byte_buffer_destroy(response_payload_recv);
459 grpc_slice_unref(details);
460
461 grpc_call_unref(c);
462
463 cq_verifier_destroy(cqv);
464 end_test(&f);
465 config.tear_down_data(&f);
466 }
467
call_creds(grpc_end2end_test_config config)468 void call_creds(grpc_end2end_test_config config) {
469 if (config.feature_mask & FEATURE_MASK_SUPPORTS_PER_CALL_CREDENTIALS) {
470 test_request_response_with_payload_and_call_creds(config);
471 test_request_response_with_payload_and_overridden_call_creds(config);
472 test_request_response_with_payload_and_deleted_call_creds(config);
473 test_request_with_server_rejecting_client_creds(config);
474 }
475 }
476
call_creds_pre_init(void)477 void call_creds_pre_init(void) {}
478