Skip to content

Commit bd82d8e

Browse files
voidzcyvoidzcy
committed
Merge branch 'master' of github.com:grpc/grpc-java into impl/xds_timeout_with_max_stream_duration
2 parents ac5e326 + b08ce41 commit bd82d8e

File tree

111 files changed

+3687
-6962
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

111 files changed

+3687
-6962
lines changed

‎alts/src/main/java/io/grpc/alts/AltsChannelBuilder.java‎

Lines changed: 7 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -17,26 +17,14 @@
1717
package io.grpc.alts;
1818

1919
import com.google.common.annotations.VisibleForTesting;
20-
import com.google.common.collect.ImmutableList;
21-
import io.grpc.CallOptions;
22-
import io.grpc.Channel;
23-
import io.grpc.ClientCall;
24-
import io.grpc.ClientInterceptor;
2520
import io.grpc.ExperimentalApi;
2621
import io.grpc.ForwardingChannelBuilder;
2722
import io.grpc.ManagedChannel;
2823
import io.grpc.ManagedChannelBuilder;
29-
import io.grpc.MethodDescriptor;
30-
import io.grpc.Status;
31-
import io.grpc.alts.internal.AltsProtocolNegotiator.ClientAltsProtocolNegotiatorFactory;
3224
import io.grpc.internal.GrpcUtil;
33-
import io.grpc.internal.ObjectPool;
34-
import io.grpc.internal.SharedResourcePool;
3525
import io.grpc.netty.InternalNettyChannelBuilder;
3626
import io.grpc.netty.InternalProtocolNegotiator.ProtocolNegotiator;
3727
import io.grpc.netty.NettyChannelBuilder;
38-
import java.util.logging.Level;
39-
import java.util.logging.Logger;
4028
import javax.annotation.Nullable;
4129

4230
/**
@@ -45,14 +33,9 @@
4533
*/
4634
@ExperimentalApi("https://github.com/grpc/grpc-java/issues/4151")
4735
public final class AltsChannelBuilder extends ForwardingChannelBuilder<AltsChannelBuilder> {
48-
49-
private static final Logger logger = Logger.getLogger(AltsChannelBuilder.class.getName());
5036
private final NettyChannelBuilder delegate;
51-
private final ImmutableList.Builder<String> targetServiceAccountsBuilder =
52-
ImmutableList.builder();
53-
private ObjectPool<Channel> handshakerChannelPool =
54-
SharedResourcePool.forResource(HandshakerServiceChannel.SHARED_HANDSHAKER_CHANNEL);
55-
private boolean enableUntrustedAlts;
37+
private final AltsChannelCredentials.Builder credentialsBuilder =
38+
new AltsChannelCredentials.Builder();
5639

5740
/** "Overrides" the static method in {@link ManagedChannelBuilder}. */
5841
public static final AltsChannelBuilder forTarget(String target) {
@@ -73,7 +56,7 @@ private AltsChannelBuilder(String target) {
7356
* service account in the handshaker result. Otherwise, the handshake fails.
7457
*/
7558
public AltsChannelBuilder addTargetServiceAccount(String targetServiceAccount) {
76-
targetServiceAccountsBuilder.add(targetServiceAccount);
59+
credentialsBuilder.addTargetServiceAccount(targetServiceAccount);
7760
return this;
7861
}
7962

@@ -82,17 +65,13 @@ public AltsChannelBuilder addTargetServiceAccount(String targetServiceAccount) {
8265
* is running on Google Cloud Platform.
8366
*/
8467
public AltsChannelBuilder enableUntrustedAltsForTesting() {
85-
enableUntrustedAlts = true;
68+
credentialsBuilder.enableUntrustedAltsForTesting();
8669
return this;
8770
}
8871

8972
/** Sets a new handshaker service address for testing. */
9073
public AltsChannelBuilder setHandshakerAddressForTesting(String handshakerAddress) {
91-
// Instead of using the default shared channel to the handshaker service, create a separate
92-
// resource to the test address.
93-
handshakerChannelPool =
94-
SharedResourcePool.forResource(
95-
HandshakerServiceChannel.getHandshakerChannelForTesting(handshakerAddress));
74+
credentialsBuilder.setHandshakerAddressForTesting(handshakerAddress);
9675
return this;
9776
}
9877

@@ -103,47 +82,16 @@ protected NettyChannelBuilder delegate() {
10382

10483
@Override
10584
public ManagedChannel build() {
106-
if (!CheckGcpEnvironment.isOnGcp()) {
107-
if (enableUntrustedAlts) {
108-
logger.log(
109-
Level.WARNING,
110-
"Untrusted ALTS mode is enabled and we cannot guarantee the trustworthiness of the "
111-
+ "ALTS handshaker service");
112-
} else {
113-
Status status =
114-
Status.INTERNAL.withDescription("ALTS is only allowed to run on Google Cloud Platform");
115-
delegate().intercept(new FailingClientInterceptor(status));
116-
}
117-
}
11885
InternalNettyChannelBuilder.setProtocolNegotiatorFactory(
11986
delegate(),
120-
new ClientAltsProtocolNegotiatorFactory(
121-
targetServiceAccountsBuilder.build(), handshakerChannelPool));
87+
credentialsBuilder.buildProtocolNegotiatorFactory());
12288

12389
return delegate().build();
12490
}
12591

12692
@VisibleForTesting
12793
@Nullable
12894
ProtocolNegotiator getProtocolNegotiatorForTest() {
129-
return new ClientAltsProtocolNegotiatorFactory(
130-
targetServiceAccountsBuilder.build(), handshakerChannelPool)
131-
.buildProtocolNegotiator();
132-
}
133-
134-
/** An implementation of {@link ClientInterceptor} that fails each call. */
135-
static final class FailingClientInterceptor implements ClientInterceptor {
136-
137-
private final Status status;
138-
139-
public FailingClientInterceptor(Status status) {
140-
this.status = status;
141-
}
142-
143-
@Override
144-
public <ReqT, RespT> ClientCall<ReqT, RespT> interceptCall(
145-
MethodDescriptor<ReqT, RespT> method, CallOptions callOptions, Channel next) {
146-
return new FailingClientCall<>(status);
147-
}
95+
return credentialsBuilder.buildProtocolNegotiatorFactory().newNegotiator();
14896
}
14997
}

‎alts/src/main/java/io/grpc/alts/AltsChannelCredentials.java‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
/*
2+
* Copyright 2020 The gRPC Authors
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package io.grpc.alts;
18+
19+
import com.google.common.collect.ImmutableList;
20+
import io.grpc.Channel;
21+
import io.grpc.ChannelCredentials;
22+
import io.grpc.ExperimentalApi;
23+
import io.grpc.Status;
24+
import io.grpc.alts.internal.AltsProtocolNegotiator.ClientAltsProtocolNegotiatorFactory;
25+
import io.grpc.internal.ObjectPool;
26+
import io.grpc.internal.SharedResourcePool;
27+
import io.grpc.netty.GrpcHttp2ConnectionHandler;
28+
import io.grpc.netty.InternalNettyChannelCredentials;
29+
import io.grpc.netty.InternalProtocolNegotiator;
30+
import io.grpc.netty.InternalProtocolNegotiator.ProtocolNegotiator;
31+
import io.netty.channel.ChannelHandler;
32+
import io.netty.channel.ChannelHandlerAdapter;
33+
import io.netty.channel.ChannelHandlerContext;
34+
import io.netty.util.AsciiString;
35+
import java.util.logging.Level;
36+
import java.util.logging.Logger;
37+
38+
/**
39+
* Provides secure and authenticated commmunication between two cloud VMs using ALTS.
40+
*/
41+
@ExperimentalApi("https://github.com/grpc/grpc-java/issues/4151")
42+
public final class AltsChannelCredentials {
43+
private static final Logger logger = Logger.getLogger(AltsChannelCredentials.class.getName());
44+
45+
private AltsChannelCredentials() {}
46+
47+
public static ChannelCredentials create() {
48+
return newBuilder().build();
49+
}
50+
51+
public static Builder newBuilder() {
52+
return new Builder();
53+
}
54+
55+
public static final class Builder {
56+
private final ImmutableList.Builder<String> targetServiceAccountsBuilder =
57+
ImmutableList.builder();
58+
private ObjectPool<Channel> handshakerChannelPool =
59+
SharedResourcePool.forResource(HandshakerServiceChannel.SHARED_HANDSHAKER_CHANNEL);
60+
private boolean enableUntrustedAlts;
61+
62+
/**
63+
* Adds an expected target service accounts. One of the added service accounts should match peer
64+
* service account in the handshaker result. Otherwise, the handshake fails.
65+
*/
66+
public Builder addTargetServiceAccount(String targetServiceAccount) {
67+
targetServiceAccountsBuilder.add(targetServiceAccount);
68+
return this;
69+
}
70+
71+
/**
72+
* Enables untrusted ALTS for testing. If this function is called, we will not check whether
73+
* ALTS is running on Google Cloud Platform.
74+
*/
75+
public Builder enableUntrustedAltsForTesting() {
76+
enableUntrustedAlts = true;
77+
return this;
78+
}
79+
80+
/** Sets a new handshaker service address for testing. */
81+
public Builder setHandshakerAddressForTesting(String handshakerAddress) {
82+
// Instead of using the default shared channel to the handshaker service, create a separate
83+
// resource to the test address.
84+
handshakerChannelPool =
85+
SharedResourcePool.forResource(
86+
HandshakerServiceChannel.getHandshakerChannelForTesting(handshakerAddress));
87+
return this;
88+
}
89+
90+
public ChannelCredentials build() {
91+
return InternalNettyChannelCredentials.create(buildProtocolNegotiatorFactory());
92+
}
93+
94+
InternalProtocolNegotiator.ClientFactory buildProtocolNegotiatorFactory() {
95+
if (!CheckGcpEnvironment.isOnGcp()) {
96+
if (enableUntrustedAlts) {
97+
logger.log(
98+
Level.WARNING,
99+
"Untrusted ALTS mode is enabled and we cannot guarantee the trustworthiness of the "
100+
+ "ALTS handshaker service");
101+
} else {
102+
Status status = Status.INTERNAL.withDescription(
103+
"ALTS is only allowed to run on Google Cloud Platform");
104+
return new FailingProtocolNegotiatorFactory(status);
105+
}
106+
}
107+
108+
return new ClientAltsProtocolNegotiatorFactory(
109+
targetServiceAccountsBuilder.build(), handshakerChannelPool);
110+
}
111+
}
112+
113+
private static final class FailingProtocolNegotiatorFactory
114+
implements InternalProtocolNegotiator.ClientFactory {
115+
private final Status status;
116+
117+
public FailingProtocolNegotiatorFactory(Status status) {
118+
this.status = status;
119+
}
120+
121+
@Override
122+
public ProtocolNegotiator newNegotiator() {
123+
return new FailingProtocolNegotiator(status);
124+
}
125+
126+
@Override
127+
public int getDefaultPort() {
128+
return 443;
129+
}
130+
}
131+
132+
private static final AsciiString SCHEME = AsciiString.of("https");
133+
134+
private static final class FailingProtocolNegotiator implements ProtocolNegotiator {
135+
private final Status status;
136+
137+
public FailingProtocolNegotiator(Status status) {
138+
this.status = status;
139+
}
140+
141+
@Override
142+
public AsciiString scheme() {
143+
return SCHEME;
144+
}
145+
146+
@Override
147+
public ChannelHandler newHandler(GrpcHttp2ConnectionHandler grpcHandler) {
148+
return new ChannelHandlerAdapter() {
149+
@Override public void handlerAdded(ChannelHandlerContext ctx) {
150+
ctx.fireExceptionCaught(status.asRuntimeException());
151+
}
152+
};
153+
}
154+
155+
@Override
156+
public void close() {}
157+
}
158+
}

‎alts/src/main/java/io/grpc/alts/CallCredentialsInterceptor.java‎

Lines changed: 0 additions & 47 deletions
This file was deleted.

0 commit comments

Comments
 (0)