1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
// Copyright 2021 gRPC authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include <grpc/support/port_platform.h>
#include "src/core/lib/security/authorization/grpc_server_authz_filter.h"
#include <functional>
#include <memory>
#include <string>
#include <utility>
#include "absl/status/status.h"
#include "absl/strings/str_join.h"
#include <grpc/support/log.h>
#include "src/core/lib/channel/channel_stack.h"
#include "src/core/lib/channel/promise_based_filter.h"
#include "src/core/lib/debug/trace.h"
#include "src/core/lib/promise/promise.h"
#include "src/core/lib/security/authorization/authorization_engine.h"
#include "src/core/lib/security/authorization/evaluate_args.h"
#include "src/core/lib/transport/metadata_batch.h"
#include "src/core/lib/transport/transport.h"
namespace grpc_core {
TraceFlag grpc_authz_trace(false, "grpc_authz_api");
const NoInterceptor GrpcServerAuthzFilter::Call::OnServerInitialMetadata;
const NoInterceptor GrpcServerAuthzFilter::Call::OnServerTrailingMetadata;
const NoInterceptor GrpcServerAuthzFilter::Call::OnClientToServerMessage;
const NoInterceptor GrpcServerAuthzFilter::Call::OnServerToClientMessage;
const NoInterceptor GrpcServerAuthzFilter::Call::OnFinalize;
GrpcServerAuthzFilter::GrpcServerAuthzFilter(
RefCountedPtr<grpc_auth_context> auth_context, grpc_endpoint* endpoint,
RefCountedPtr<grpc_authorization_policy_provider> provider)
: auth_context_(std::move(auth_context)),
per_channel_evaluate_args_(auth_context_.get(), endpoint),
provider_(std::move(provider)) {}
absl::StatusOr<GrpcServerAuthzFilter> GrpcServerAuthzFilter::Create(
const ChannelArgs& args, ChannelFilter::Args) {
auto* auth_context = args.GetObject<grpc_auth_context>();
auto* provider = args.GetObject<grpc_authorization_policy_provider>();
if (provider == nullptr) {
return absl::InvalidArgumentError("Failed to get authorization provider.");
}
// grpc_endpoint isn't needed because the current gRPC authorization policy
// does not support any rules that requires looking for source or destination
// addresses.
return GrpcServerAuthzFilter(
auth_context != nullptr ? auth_context->Ref() : nullptr,
/*endpoint=*/nullptr, provider->Ref());
}
bool GrpcServerAuthzFilter::IsAuthorized(ClientMetadata& initial_metadata) {
EvaluateArgs args(&initial_metadata, &per_channel_evaluate_args_);
if (GRPC_TRACE_FLAG_ENABLED(grpc_authz_trace)) {
gpr_log(GPR_DEBUG,
"checking request: url_path=%s, transport_security_type=%s, "
"uri_sans=[%s], dns_sans=[%s], subject=%s",
std::string(args.GetPath()).c_str(),
std::string(args.GetTransportSecurityType()).c_str(),
absl::StrJoin(args.GetUriSans(), ",").c_str(),
absl::StrJoin(args.GetDnsSans(), ",").c_str(),
std::string(args.GetSubject()).c_str());
}
grpc_authorization_policy_provider::AuthorizationEngines engines =
provider_->engines();
if (engines.deny_engine != nullptr) {
AuthorizationEngine::Decision decision =
engines.deny_engine->Evaluate(args);
if (decision.type == AuthorizationEngine::Decision::Type::kDeny) {
if (GRPC_TRACE_FLAG_ENABLED(grpc_authz_trace)) {
gpr_log(GPR_INFO, "chand=%p: request denied by policy %s.", this,
decision.matching_policy_name.c_str());
}
return false;
}
}
if (engines.allow_engine != nullptr) {
AuthorizationEngine::Decision decision =
engines.allow_engine->Evaluate(args);
if (decision.type == AuthorizationEngine::Decision::Type::kAllow) {
if (GRPC_TRACE_FLAG_ENABLED(grpc_authz_trace)) {
gpr_log(GPR_DEBUG, "chand=%p: request allowed by policy %s.", this,
decision.matching_policy_name.c_str());
}
return true;
}
}
if (GRPC_TRACE_FLAG_ENABLED(grpc_authz_trace)) {
gpr_log(GPR_INFO, "chand=%p: request denied, no matching policy found.",
this);
}
return false;
}
absl::Status GrpcServerAuthzFilter::Call::OnClientInitialMetadata(
ClientMetadata& md, GrpcServerAuthzFilter* filter) {
if (!filter->IsAuthorized(md)) {
return absl::PermissionDeniedError("Unauthorized RPC request rejected.");
}
return absl::OkStatus();
}
const grpc_channel_filter GrpcServerAuthzFilter::kFilter =
MakePromiseBasedFilter<GrpcServerAuthzFilter, FilterEndpoint::kServer>(
"grpc-server-authz");
} // namespace grpc_core
|
