onkarkundargi | 72cfd36 | 2020-02-27 12:34:37 +0530 | [diff] [blame^] | 1 | /* |
| 2 | * |
| 3 | * Copyright 2014 gRPC authors. |
| 4 | * |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | * |
| 17 | */ |
| 18 | |
| 19 | // Package credentials implements various credentials supported by gRPC library, |
| 20 | // which encapsulate all the state needed by a client to authenticate with a |
| 21 | // server and make various assertions, e.g., about the client's identity, role, |
| 22 | // or whether it is authorized to make a particular call. |
| 23 | package credentials // import "google.golang.org/grpc/credentials" |
| 24 | |
| 25 | import ( |
| 26 | "context" |
| 27 | "errors" |
| 28 | "net" |
| 29 | |
| 30 | "github.com/golang/protobuf/proto" |
| 31 | "google.golang.org/grpc/internal" |
| 32 | ) |
| 33 | |
| 34 | // PerRPCCredentials defines the common interface for the credentials which need to |
| 35 | // attach security information to every RPC (e.g., oauth2). |
| 36 | type PerRPCCredentials interface { |
| 37 | // GetRequestMetadata gets the current request metadata, refreshing |
| 38 | // tokens if required. This should be called by the transport layer on |
| 39 | // each request, and the data should be populated in headers or other |
| 40 | // context. If a status code is returned, it will be used as the status |
| 41 | // for the RPC. uri is the URI of the entry point for the request. |
| 42 | // When supported by the underlying implementation, ctx can be used for |
| 43 | // timeout and cancellation. Additionally, RequestInfo data will be |
| 44 | // available via ctx to this call. |
| 45 | // TODO(zhaoq): Define the set of the qualified keys instead of leaving |
| 46 | // it as an arbitrary string. |
| 47 | GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) |
| 48 | // RequireTransportSecurity indicates whether the credentials requires |
| 49 | // transport security. |
| 50 | RequireTransportSecurity() bool |
| 51 | } |
| 52 | |
| 53 | // ProtocolInfo provides information regarding the gRPC wire protocol version, |
| 54 | // security protocol, security protocol version in use, server name, etc. |
| 55 | type ProtocolInfo struct { |
| 56 | // ProtocolVersion is the gRPC wire protocol version. |
| 57 | ProtocolVersion string |
| 58 | // SecurityProtocol is the security protocol in use. |
| 59 | SecurityProtocol string |
| 60 | // SecurityVersion is the security protocol version. |
| 61 | SecurityVersion string |
| 62 | // ServerName is the user-configured server name. |
| 63 | ServerName string |
| 64 | } |
| 65 | |
| 66 | // AuthInfo defines the common interface for the auth information the users are interested in. |
| 67 | type AuthInfo interface { |
| 68 | AuthType() string |
| 69 | } |
| 70 | |
| 71 | // ErrConnDispatched indicates that rawConn has been dispatched out of gRPC |
| 72 | // and the caller should not close rawConn. |
| 73 | var ErrConnDispatched = errors.New("credentials: rawConn is dispatched out of gRPC") |
| 74 | |
| 75 | // TransportCredentials defines the common interface for all the live gRPC wire |
| 76 | // protocols and supported transport security protocols (e.g., TLS, SSL). |
| 77 | type TransportCredentials interface { |
| 78 | // ClientHandshake does the authentication handshake specified by the corresponding |
| 79 | // authentication protocol on rawConn for clients. It returns the authenticated |
| 80 | // connection and the corresponding auth information about the connection. |
| 81 | // Implementations must use the provided context to implement timely cancellation. |
| 82 | // gRPC will try to reconnect if the error returned is a temporary error |
| 83 | // (io.EOF, context.DeadlineExceeded or err.Temporary() == true). |
| 84 | // If the returned error is a wrapper error, implementations should make sure that |
| 85 | // the error implements Temporary() to have the correct retry behaviors. |
| 86 | // |
| 87 | // If the returned net.Conn is closed, it MUST close the net.Conn provided. |
| 88 | ClientHandshake(context.Context, string, net.Conn) (net.Conn, AuthInfo, error) |
| 89 | // ServerHandshake does the authentication handshake for servers. It returns |
| 90 | // the authenticated connection and the corresponding auth information about |
| 91 | // the connection. |
| 92 | // |
| 93 | // If the returned net.Conn is closed, it MUST close the net.Conn provided. |
| 94 | ServerHandshake(net.Conn) (net.Conn, AuthInfo, error) |
| 95 | // Info provides the ProtocolInfo of this TransportCredentials. |
| 96 | Info() ProtocolInfo |
| 97 | // Clone makes a copy of this TransportCredentials. |
| 98 | Clone() TransportCredentials |
| 99 | // OverrideServerName overrides the server name used to verify the hostname on the returned certificates from the server. |
| 100 | // gRPC internals also use it to override the virtual hosting name if it is set. |
| 101 | // It must be called before dialing. Currently, this is only used by grpclb. |
| 102 | OverrideServerName(string) error |
| 103 | } |
| 104 | |
| 105 | // Bundle is a combination of TransportCredentials and PerRPCCredentials. |
| 106 | // |
| 107 | // It also contains a mode switching method, so it can be used as a combination |
| 108 | // of different credential policies. |
| 109 | // |
| 110 | // Bundle cannot be used together with individual TransportCredentials. |
| 111 | // PerRPCCredentials from Bundle will be appended to other PerRPCCredentials. |
| 112 | // |
| 113 | // This API is experimental. |
| 114 | type Bundle interface { |
| 115 | TransportCredentials() TransportCredentials |
| 116 | PerRPCCredentials() PerRPCCredentials |
| 117 | // NewWithMode should make a copy of Bundle, and switch mode. Modifying the |
| 118 | // existing Bundle may cause races. |
| 119 | // |
| 120 | // NewWithMode returns nil if the requested mode is not supported. |
| 121 | NewWithMode(mode string) (Bundle, error) |
| 122 | } |
| 123 | |
| 124 | // RequestInfo contains request data attached to the context passed to GetRequestMetadata calls. |
| 125 | // |
| 126 | // This API is experimental. |
| 127 | type RequestInfo struct { |
| 128 | // The method passed to Invoke or NewStream for this RPC. (For proto methods, this has the format "/some.Service/Method") |
| 129 | Method string |
| 130 | } |
| 131 | |
| 132 | // requestInfoKey is a struct to be used as the key when attaching a RequestInfo to a context object. |
| 133 | type requestInfoKey struct{} |
| 134 | |
| 135 | // RequestInfoFromContext extracts the RequestInfo from the context if it exists. |
| 136 | // |
| 137 | // This API is experimental. |
| 138 | func RequestInfoFromContext(ctx context.Context) (ri RequestInfo, ok bool) { |
| 139 | ri, ok = ctx.Value(requestInfoKey{}).(RequestInfo) |
| 140 | return |
| 141 | } |
| 142 | |
| 143 | func init() { |
| 144 | internal.NewRequestInfoContext = func(ctx context.Context, ri RequestInfo) context.Context { |
| 145 | return context.WithValue(ctx, requestInfoKey{}, ri) |
| 146 | } |
| 147 | } |
| 148 | |
| 149 | // ChannelzSecurityInfo defines the interface that security protocols should implement |
| 150 | // in order to provide security info to channelz. |
| 151 | // |
| 152 | // This API is experimental. |
| 153 | type ChannelzSecurityInfo interface { |
| 154 | GetSecurityValue() ChannelzSecurityValue |
| 155 | } |
| 156 | |
| 157 | // ChannelzSecurityValue defines the interface that GetSecurityValue() return value |
| 158 | // should satisfy. This interface should only be satisfied by *TLSChannelzSecurityValue |
| 159 | // and *OtherChannelzSecurityValue. |
| 160 | // |
| 161 | // This API is experimental. |
| 162 | type ChannelzSecurityValue interface { |
| 163 | isChannelzSecurityValue() |
| 164 | } |
| 165 | |
| 166 | // OtherChannelzSecurityValue defines the struct that non-TLS protocol should return |
| 167 | // from GetSecurityValue(), which contains protocol specific security info. Note |
| 168 | // the Value field will be sent to users of channelz requesting channel info, and |
| 169 | // thus sensitive info should better be avoided. |
| 170 | // |
| 171 | // This API is experimental. |
| 172 | type OtherChannelzSecurityValue struct { |
| 173 | ChannelzSecurityValue |
| 174 | Name string |
| 175 | Value proto.Message |
| 176 | } |