Skip to content

Commit 479c0a3

Browse files
rocksporerockspore
committed
address comment
1 parent ba4aee1 commit 479c0a3

File tree

4 files changed

+349
-1
lines changed

4 files changed

+349
-1
lines changed

‎src/core/credentials/transport/alts/grpc_alts_credentials_options.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,6 @@ typedef struct grpc_alts_credentials_server_options {
9292
grpc_alts_credentials_options* grpc_alts_credentials_options_copy(
9393
const grpc_alts_credentials_options* options);
9494

95-
// Caller must ensure the token_fetcher outlives the credentials options.
9695
void grpc_alts_credentials_client_options_set_token_fetcher(
9796
grpc_alts_credentials_options* options,
9897
std::shared_ptr<grpc::alts::TokenFetcher> token_fetcher);

‎src/core/tsi/alts/handshaker/proto/altscontext.proto‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
// Copyright 2018 gRPC authors.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
import "transport_security_common.proto";
18+
19+
package grpc.gcp;
20+
21+
option java_package = "io.grpc.alts.internal";
22+
23+
message AltsContext {
24+
// The application protocol negotiated for this connection.
25+
string application_protocol = 1;
26+
27+
// The record protocol negotiated for this connection.
28+
string record_protocol = 2;
29+
30+
// The security level of the created secure channel.
31+
SecurityLevel security_level = 3;
32+
33+
// The peer service account.
34+
string peer_service_account = 4;
35+
36+
// The local service account.
37+
string local_service_account = 5;
38+
39+
// The RPC protocol versions supported by the peer.
40+
RpcProtocolVersions peer_rpc_versions = 6;
41+
42+
// Additional attributes of the peer.
43+
map<string, string> peer_attributes = 7;
44+
}

‎src/core/tsi/alts/handshaker/proto/handshaker.proto‎

Lines changed: 254 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,254 @@
1+
// Copyright 2018 gRPC authors.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
import "transport_security_common.proto";
18+
19+
package grpc.gcp;
20+
21+
option java_package = "io.grpc.alts.internal";
22+
23+
enum HandshakeProtocol {
24+
// Default value.
25+
HANDSHAKE_PROTOCOL_UNSPECIFIED = 0;
26+
27+
// TLS handshake protocol.
28+
TLS = 1;
29+
30+
// Application Layer Transport Security handshake protocol.
31+
ALTS = 2;
32+
}
33+
34+
enum NetworkProtocol {
35+
NETWORK_PROTOCOL_UNSPECIFIED = 0;
36+
TCP = 1;
37+
UDP = 2;
38+
}
39+
40+
message Endpoint {
41+
// IP address. It should contain an IPv4 or IPv6 string literal, e.g.
42+
// "192.168.0.1" or "2001:db8::1".
43+
string ip_address = 1;
44+
45+
// Port number.
46+
int32 port = 2;
47+
48+
// Network protocol (e.g., TCP, UDP) associated with this endpoint.
49+
NetworkProtocol protocol = 3;
50+
}
51+
52+
message Identity {
53+
oneof identity_oneof {
54+
// Service account of a connection endpoint.
55+
string service_account = 1;
56+
57+
// Hostname of a connection endpoint.
58+
string hostname = 2;
59+
}
60+
61+
// Additional attributes of the identity.
62+
map<string, string> attributes = 3;
63+
}
64+
65+
message StartClientHandshakeReq {
66+
// Handshake security protocol requested by the client.
67+
HandshakeProtocol handshake_security_protocol = 1;
68+
69+
// The application protocols supported by the client, e.g., "h2" (for http2),
70+
// "grpc".
71+
repeated string application_protocols = 2;
72+
73+
// The record protocols supported by the client, e.g.,
74+
// "ALTSRP_GCM_AES128".
75+
repeated string record_protocols = 3;
76+
77+
// (Optional) Describes which server identities are acceptable by the client.
78+
// If target identities are provided and none of them matches the peer
79+
// identity of the server, handshake will fail.
80+
repeated Identity target_identities = 4;
81+
82+
// (Optional) Application may specify a local identity. Otherwise, the
83+
// handshaker chooses a default local identity.
84+
Identity local_identity = 5;
85+
86+
// (Optional) Local endpoint information of the connection to the server,
87+
// such as local IP address, port number, and network protocol.
88+
Endpoint local_endpoint = 6;
89+
90+
// (Optional) Endpoint information of the remote server, such as IP address,
91+
// port number, and network protocol.
92+
Endpoint remote_endpoint = 7;
93+
94+
// (Optional) If target name is provided, a secure naming check is performed
95+
// to verify that the peer authenticated identity is indeed authorized to run
96+
// the target name.
97+
string target_name = 8;
98+
99+
// (Optional) RPC protocol versions supported by the client.
100+
RpcProtocolVersions rpc_versions = 9;
101+
102+
// (Optional) Maximum frame size supported by the client.
103+
uint32 max_frame_size = 10;
104+
105+
// (Optional) Internal use only.
106+
string access_token = 11 [(datapol.semantic_type) = ST_ACCOUNT_CREDENTIAL];
107+
108+
// (Optional) Ordered transport protocol preferences supported by the client.
109+
TransportProtocolPreferences transport_protocol_preferences = 12;
110+
}
111+
112+
message ServerHandshakeParameters {
113+
// The record protocols supported by the server, e.g.,
114+
// "ALTSRP_GCM_AES128".
115+
repeated string record_protocols = 1;
116+
117+
// (Optional) A list of local identities supported by the server, if
118+
// specified. Otherwise, the handshaker chooses a default local identity.
119+
repeated Identity local_identities = 2;
120+
121+
// Internal use only.
122+
string token = 3 [features.field_presence = EXPLICIT];
123+
}
124+
125+
message StartServerHandshakeReq {
126+
// The application protocols supported by the server, e.g., "h2" (for http2),
127+
// "grpc".
128+
repeated string application_protocols = 1;
129+
130+
// Handshake parameters (record protocols and local identities supported by
131+
// the server) mapped by the handshake protocol. Each handshake security
132+
// protocol (e.g., TLS or ALTS) has its own set of record protocols and local
133+
// identities. Since protobuf does not support enum as key to the map, the key
134+
// to handshake_parameters is the integer value of HandshakeProtocol enum.
135+
map<int32, ServerHandshakeParameters> handshake_parameters = 2;
136+
137+
// Bytes in out_frames returned from the peer's HandshakerResp. It is possible
138+
// that the peer's out_frames are split into multiple HandshakeReq messages.
139+
bytes in_bytes = 3;
140+
141+
// (Optional) Local endpoint information of the connection to the client,
142+
// such as local IP address, port number, and network protocol.
143+
Endpoint local_endpoint = 4;
144+
145+
// (Optional) Endpoint information of the remote client, such as IP address,
146+
// port number, and network protocol.
147+
Endpoint remote_endpoint = 5;
148+
149+
// (Optional) RPC protocol versions supported by the server.
150+
RpcProtocolVersions rpc_versions = 6;
151+
152+
// (Optional) Maximum frame size supported by the server.
153+
uint32 max_frame_size = 7;
154+
155+
// (Optional) Transport protocol preferences supported by the server.
156+
TransportProtocolPreferences transport_protocol_preferences = 8;
157+
}
158+
159+
message NextHandshakeMessageReq {
160+
// Bytes in out_frames returned from the peer's HandshakerResp. It is possible
161+
// that the peer's out_frames are split into multiple NextHandshakerMessageReq
162+
// messages.
163+
bytes in_bytes = 1;
164+
165+
// Number of milliseconds between when the application send the last handshake
166+
// message to the peer and when the application received the current handshake
167+
// message (in the in_bytes field) from the peer.
168+
uint32 network_latency_ms = 2;
169+
}
170+
171+
message HandshakerReq {
172+
oneof req_oneof {
173+
// The start client handshake request message.
174+
StartClientHandshakeReq client_start = 1;
175+
176+
// The start server handshake request message.
177+
StartServerHandshakeReq server_start = 2;
178+
179+
// The next handshake request message.
180+
NextHandshakeMessageReq next = 3;
181+
}
182+
}
183+
184+
message HandshakerResult {
185+
// The application protocol negotiated for this connection.
186+
string application_protocol = 1;
187+
188+
// The record protocol negotiated for this connection.
189+
string record_protocol = 2;
190+
191+
// Cryptographic key data. The key data may be more than the key length
192+
// required for the record protocol, thus the client of the handshaker
193+
// service needs to truncate the key data into the right key length.
194+
bytes key_data = 3;
195+
196+
// The authenticated identity of the peer.
197+
Identity peer_identity = 4;
198+
199+
// The local identity used in the handshake.
200+
Identity local_identity = 5;
201+
202+
// Indicate whether the handshaker service client should keep the channel
203+
// between the handshaker service open, e.g., in order to handle
204+
// post-handshake messages in the future.
205+
bool keep_channel_open = 6;
206+
207+
// The RPC protocol versions supported by the peer.
208+
RpcProtocolVersions peer_rpc_versions = 7;
209+
210+
// The maximum frame size of the peer.
211+
uint32 max_frame_size = 8;
212+
213+
// (Optional) The transport protocol negotiated for this connection.
214+
NegotiatedTransportProtocol transport_protocol = 9;
215+
}
216+
217+
message HandshakerStatus {
218+
// The status code. This could be the gRPC status code.
219+
uint32 code = 1;
220+
221+
// The status details.
222+
string details = 2;
223+
}
224+
225+
message HandshakerResp {
226+
// Frames to be given to the peer for the NextHandshakeMessageReq. May be
227+
// empty if no out_frames have to be sent to the peer or if in_bytes in the
228+
// HandshakerReq are incomplete. All the non-empty out frames must be sent to
229+
// the peer even if the handshaker status is not OK as these frames may
230+
// contain the alert frames.
231+
bytes out_frames = 1;
232+
233+
// Number of bytes in the in_bytes consumed by the handshaker. It is possible
234+
// that part of in_bytes in HandshakerReq was unrelated to the handshake
235+
// process.
236+
uint32 bytes_consumed = 2;
237+
238+
// This is set iff the handshake was successful. out_frames may still be set
239+
// to frames that needs to be forwarded to the peer.
240+
HandshakerResult result = 3;
241+
242+
// Status of the handshaker.
243+
HandshakerStatus status = 4;
244+
}
245+
246+
service HandshakerService {
247+
// Handshaker service accepts a stream of handshaker request, returning a
248+
// stream of handshaker response. Client is expected to send exactly one
249+
// message with either client_start or server_start followed by one or more
250+
// messages with next. Each time client sends a request, the handshaker
251+
// service expects to respond. Client does not have to wait for service's
252+
// response before sending next request.
253+
rpc DoHandshake(stream HandshakerReq) returns (stream HandshakerResp) {}
254+
}

‎src/core/tsi/alts/handshaker/proto/transport_security_common.proto‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Copyright 2018 gRPC authors.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package grpc.gcp;
18+
19+
option java_package = "io.grpc.alts.internal";
20+
21+
// The security level of the created channel. The list is sorted in increasing
22+
// level of security. This order must always be maintained.
23+
enum SecurityLevel {
24+
SECURITY_NONE = 0;
25+
INTEGRITY_ONLY = 1;
26+
INTEGRITY_AND_PRIVACY = 2;
27+
}
28+
29+
// Max and min supported RPC protocol versions.
30+
message RpcProtocolVersions {
31+
// RPC version contains a major version and a minor version.
32+
message Version {
33+
uint32 major = 1;
34+
uint32 minor = 2;
35+
}
36+
// Maximum supported RPC version.
37+
Version max_rpc_version = 1;
38+
// Minimum supported RPC version.
39+
Version min_rpc_version = 2;
40+
}
41+
42+
// The ordered list of protocols that the client wishes to use, or the set
43+
// that the server supports.
44+
message TransportProtocolPreferences {
45+
repeated string transport_protocol = 1;
46+
}
47+
48+
// The negotiated transport protocol.
49+
message NegotiatedTransportProtocol {
50+
string transport_protocol = 1;
51+
}

0 commit comments

Comments
 (0)