1 // 2 // 3 // Copyright 2018 gRPC authors. 4 // 5 // Licensed under the Apache License, Version 2.0 (the "License"); 6 // you may not use this file except in compliance with the License. 7 // You may obtain a copy of the License at 8 // 9 // http://www.apache.org/licenses/LICENSE-2.0 10 // 11 // Unless required by applicable law or agreed to in writing, software 12 // distributed under the License is distributed on an "AS IS" BASIS, 13 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 // See the License for the specific language governing permissions and 15 // limitations under the License. 16 // 17 // 18 19 // Generated by tools/codegen/core/gen_grpc_tls_credentials_options.py 20 21 #ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H 22 #define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H 23 24 #include <grpc/support/port_platform.h> 25 26 #include "absl/container/inlined_vector.h" 27 28 #include <grpc/grpc_security.h> 29 30 #include "src/core/lib/gprpp/ref_counted.h" 31 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h" 32 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h" 33 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h" 34 #include "src/core/lib/security/security_connector/ssl_utils.h" 35 36 // Contains configurable options specified by callers to configure their certain 37 // security features supported in TLS. 38 // TODO(ZhenLian): consider making this not ref-counted. 39 struct grpc_tls_credentials_options 40 : public grpc_core::RefCounted<grpc_tls_credentials_options> { 41 public: 42 ~grpc_tls_credentials_options() override = default; 43 44 // Getters for member fields. cert_request_typegrpc_tls_credentials_options45 grpc_ssl_client_certificate_request_type cert_request_type() const { return cert_request_type_; } verify_server_certgrpc_tls_credentials_options46 bool verify_server_cert() const { return verify_server_cert_; } min_tls_versiongrpc_tls_credentials_options47 grpc_tls_version min_tls_version() const { return min_tls_version_; } max_tls_versiongrpc_tls_credentials_options48 grpc_tls_version max_tls_version() const { return max_tls_version_; } certificate_verifiergrpc_tls_credentials_options49 grpc_tls_certificate_verifier* certificate_verifier() { 50 return certificate_verifier_.get(); 51 } check_call_hostgrpc_tls_credentials_options52 bool check_call_host() const { return check_call_host_; } 53 // Returns the distributor from certificate_provider_ if it is set, nullptr otherwise. certificate_distributorgrpc_tls_credentials_options54 grpc_tls_certificate_distributor* certificate_distributor() { 55 if (certificate_provider_ != nullptr) { return certificate_provider_->distributor().get(); } 56 return nullptr; 57 } watch_root_certgrpc_tls_credentials_options58 bool watch_root_cert() const { return watch_root_cert_; } root_cert_namegrpc_tls_credentials_options59 const std::string& root_cert_name() const { return root_cert_name_; } watch_identity_pairgrpc_tls_credentials_options60 bool watch_identity_pair() const { return watch_identity_pair_; } identity_cert_namegrpc_tls_credentials_options61 const std::string& identity_cert_name() const { return identity_cert_name_; } tls_session_key_log_file_pathgrpc_tls_credentials_options62 const std::string& tls_session_key_log_file_path() const { return tls_session_key_log_file_path_; } crl_directorygrpc_tls_credentials_options63 const std::string& crl_directory() const { return crl_directory_; } send_client_ca_listgrpc_tls_credentials_options64 bool send_client_ca_list() const { return send_client_ca_list_; } 65 66 // Setters for member fields. set_cert_request_typegrpc_tls_credentials_options67 void set_cert_request_type(grpc_ssl_client_certificate_request_type cert_request_type) { cert_request_type_ = cert_request_type; } set_verify_server_certgrpc_tls_credentials_options68 void set_verify_server_cert(bool verify_server_cert) { verify_server_cert_ = verify_server_cert; } set_min_tls_versiongrpc_tls_credentials_options69 void set_min_tls_version(grpc_tls_version min_tls_version) { min_tls_version_ = min_tls_version; } set_max_tls_versiongrpc_tls_credentials_options70 void set_max_tls_version(grpc_tls_version max_tls_version) { max_tls_version_ = max_tls_version; } set_certificate_verifiergrpc_tls_credentials_options71 void set_certificate_verifier(grpc_core::RefCountedPtr<grpc_tls_certificate_verifier> certificate_verifier) { certificate_verifier_ = std::move(certificate_verifier); } set_check_call_hostgrpc_tls_credentials_options72 void set_check_call_host(bool check_call_host) { check_call_host_ = check_call_host; } set_certificate_providergrpc_tls_credentials_options73 void set_certificate_provider(grpc_core::RefCountedPtr<grpc_tls_certificate_provider> certificate_provider) { certificate_provider_ = std::move(certificate_provider); } 74 // If need to watch the updates of root certificates with name |root_cert_name|. The default value is false. If used in tls_credentials, it should always be set to true unless the root certificates are not needed. set_watch_root_certgrpc_tls_credentials_options75 void set_watch_root_cert(bool watch_root_cert) { watch_root_cert_ = watch_root_cert; } 76 // Sets the name of root certificates being watched, if |set_watch_root_cert| is called. If not set, an empty string will be used as the name. set_root_cert_namegrpc_tls_credentials_options77 void set_root_cert_name(std::string root_cert_name) { root_cert_name_ = std::move(root_cert_name); } 78 // If need to watch the updates of identity certificates with name |identity_cert_name|. The default value is false. If used in tls_credentials, it should always be set to true unless the identity key-cert pairs are not needed. set_watch_identity_pairgrpc_tls_credentials_options79 void set_watch_identity_pair(bool watch_identity_pair) { watch_identity_pair_ = watch_identity_pair; } 80 // Sets the name of identity key-cert pairs being watched, if |set_watch_identity_pair| is called. If not set, an empty string will be used as the name. set_identity_cert_namegrpc_tls_credentials_options81 void set_identity_cert_name(std::string identity_cert_name) { identity_cert_name_ = std::move(identity_cert_name); } set_tls_session_key_log_file_pathgrpc_tls_credentials_options82 void set_tls_session_key_log_file_path(std::string tls_session_key_log_file_path) { tls_session_key_log_file_path_ = std::move(tls_session_key_log_file_path); } 83 // gRPC will enforce CRLs on all handshakes from all hashed CRL files inside of the crl_directory. If not set, an empty string will be used, which will not enable CRL checking. Only supported for OpenSSL version > 1.1. set_crl_directorygrpc_tls_credentials_options84 void set_crl_directory(std::string crl_directory) { crl_directory_ = std::move(crl_directory); } set_send_client_ca_listgrpc_tls_credentials_options85 void set_send_client_ca_list(bool send_client_ca_list) { send_client_ca_list_ = send_client_ca_list; } 86 87 bool operator==(const grpc_tls_credentials_options& other) const { 88 return cert_request_type_ == other.cert_request_type_ && 89 verify_server_cert_ == other.verify_server_cert_ && 90 min_tls_version_ == other.min_tls_version_ && 91 max_tls_version_ == other.max_tls_version_ && 92 (certificate_verifier_ == other.certificate_verifier_ || (certificate_verifier_ != nullptr && other.certificate_verifier_ != nullptr && certificate_verifier_->Compare(other.certificate_verifier_.get()) == 0)) && 93 check_call_host_ == other.check_call_host_ && 94 (certificate_provider_ == other.certificate_provider_ || (certificate_provider_ != nullptr && other.certificate_provider_ != nullptr && certificate_provider_->Compare(other.certificate_provider_.get()) == 0)) && 95 watch_root_cert_ == other.watch_root_cert_ && 96 root_cert_name_ == other.root_cert_name_ && 97 watch_identity_pair_ == other.watch_identity_pair_ && 98 identity_cert_name_ == other.identity_cert_name_ && 99 tls_session_key_log_file_path_ == other.tls_session_key_log_file_path_ && 100 crl_directory_ == other.crl_directory_ && 101 send_client_ca_list_ == other.send_client_ca_list_; 102 } 103 104 private: 105 grpc_ssl_client_certificate_request_type cert_request_type_ = GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE; 106 bool verify_server_cert_ = true; 107 grpc_tls_version min_tls_version_ = grpc_tls_version::TLS1_2; 108 grpc_tls_version max_tls_version_ = grpc_tls_version::TLS1_3; 109 grpc_core::RefCountedPtr<grpc_tls_certificate_verifier> certificate_verifier_; 110 bool check_call_host_ = true; 111 grpc_core::RefCountedPtr<grpc_tls_certificate_provider> certificate_provider_; 112 bool watch_root_cert_ = false; 113 std::string root_cert_name_; 114 bool watch_identity_pair_ = false; 115 std::string identity_cert_name_; 116 std::string tls_session_key_log_file_path_; 117 std::string crl_directory_; 118 bool send_client_ca_list_ = false; 119 }; 120 121 #endif // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H 122