1 //
2 //
3 // Copyright 2015 gRPC authors.
4 //
5 // Licensed under the Apache License, Version 2.0 (the "License");
6 // you may not use this file except in compliance with the License.
7 // You may obtain a copy of the License at
8 //
9 // http://www.apache.org/licenses/LICENSE-2.0
10 //
11 // Unless required by applicable law or agreed to in writing, software
12 // distributed under the License is distributed on an "AS IS" BASIS,
13 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 // See the License for the specific language governing permissions and
15 // limitations under the License.
16 //
17 //
18
19 #include <stdio.h>
20 #include <string.h>
21
22 #include <functional>
23 #include <memory>
24 #include <string>
25
26 #include "absl/functional/any_invocable.h"
27 #include "absl/types/optional.h"
28 #include "gtest/gtest.h"
29
30 #include <grpc/grpc.h>
31 #include <grpc/grpc_security.h>
32 #include <grpc/grpc_security_constants.h>
33 #include <grpc/impl/channel_arg_names.h>
34 #include <grpc/impl/propagation_bits.h>
35 #include <grpc/slice.h>
36 #include <grpc/status.h>
37 #include <grpc/support/alloc.h>
38 #include <grpc/support/log.h>
39 #include <grpc/support/time.h>
40
41 #include "src/core/lib/channel/channel_args.h"
42 #include "src/core/lib/config/config_vars.h"
43 #include "src/core/lib/gpr/tmpfile.h"
44 #include "test/core/end2end/cq_verifier.h"
45 #include "test/core/end2end/data/ssl_test_data.h"
46 #include "test/core/end2end/end2end_tests.h"
47 #include "test/core/end2end/fixtures/secure_fixture.h"
48 #include "test/core/util/test_config.h"
49
50 static std::string test_server1_key_id;
51
52 namespace grpc {
53 namespace testing {
54
process_auth_failure(void * state,grpc_auth_context *,const grpc_metadata *,size_t,grpc_process_auth_metadata_done_cb cb,void * user_data)55 static void process_auth_failure(void* state, grpc_auth_context* /*ctx*/,
56 const grpc_metadata* /*md*/,
57 size_t /*md_count*/,
58 grpc_process_auth_metadata_done_cb cb,
59 void* user_data) {
60 GPR_ASSERT(state == nullptr);
61 cb(user_data, nullptr, 0, nullptr, 0, GRPC_STATUS_UNAUTHENTICATED, nullptr);
62 }
63
64 typedef enum { NONE, SELF_SIGNED, SIGNED, BAD_CERT_PAIR } certtype;
65
66 class TestFixture : public SecureFixture {
67 public:
TestFixture(grpc_ssl_client_certificate_request_type request_type,certtype cert_type)68 TestFixture(grpc_ssl_client_certificate_request_type request_type,
69 certtype cert_type)
70 : request_type_(request_type), cert_type_(cert_type) {}
71
MakeFactory(grpc_ssl_client_certificate_request_type request_type,certtype cert_type)72 static auto MakeFactory(grpc_ssl_client_certificate_request_type request_type,
73 certtype cert_type) {
74 return [request_type, cert_type](const grpc_core::ChannelArgs&,
75 const grpc_core::ChannelArgs&) {
76 return std::make_unique<TestFixture>(request_type, cert_type);
77 };
78 }
79
80 private:
MutateClientArgs(grpc_core::ChannelArgs args)81 grpc_core::ChannelArgs MutateClientArgs(
82 grpc_core::ChannelArgs args) override {
83 return args.Set(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG, "foo.test.google.fr");
84 }
85
MakeServerCreds(const grpc_core::ChannelArgs & args)86 grpc_server_credentials* MakeServerCreds(
87 const grpc_core::ChannelArgs& args) override {
88 grpc_ssl_pem_key_cert_pair pem_cert_key_pair;
89 if (!test_server1_key_id.empty()) {
90 pem_cert_key_pair.private_key = test_server1_key_id.c_str();
91 pem_cert_key_pair.cert_chain = test_server1_cert;
92 } else {
93 pem_cert_key_pair.private_key = test_server1_key;
94 pem_cert_key_pair.cert_chain = test_server1_cert;
95 }
96 grpc_server_credentials* ssl_creds = grpc_ssl_server_credentials_create_ex(
97 test_root_cert, &pem_cert_key_pair, 1, request_type_, nullptr);
98 if (args.Contains(FAIL_AUTH_CHECK_SERVER_ARG_NAME)) {
99 grpc_auth_metadata_processor processor = {process_auth_failure, nullptr,
100 nullptr};
101 grpc_server_credentials_set_auth_metadata_processor(ssl_creds, processor);
102 }
103 return ssl_creds;
104 }
105
MakeClientCreds(const grpc_core::ChannelArgs &)106 grpc_channel_credentials* MakeClientCreds(
107 const grpc_core::ChannelArgs&) override {
108 grpc_ssl_pem_key_cert_pair self_signed_client_key_cert_pair = {
109 test_self_signed_client_key, test_self_signed_client_cert};
110 grpc_ssl_pem_key_cert_pair signed_client_key_cert_pair = {
111 test_signed_client_key, test_signed_client_cert};
112 grpc_ssl_pem_key_cert_pair bad_client_key_cert_pair = {
113 test_self_signed_client_key, test_signed_client_cert};
114 grpc_ssl_pem_key_cert_pair* key_cert_pair = nullptr;
115 switch (cert_type_) {
116 case SELF_SIGNED:
117 key_cert_pair = &self_signed_client_key_cert_pair;
118 break;
119 case SIGNED:
120 key_cert_pair = &signed_client_key_cert_pair;
121 break;
122 case BAD_CERT_PAIR:
123 key_cert_pair = &bad_client_key_cert_pair;
124 break;
125 default:
126 break;
127 }
128 return grpc_ssl_credentials_create(test_root_cert, key_cert_pair, nullptr,
129 nullptr);
130 }
131
132 grpc_ssl_client_certificate_request_type request_type_;
133 certtype cert_type_;
134 };
135
136 #define TEST_NAME(enum_name, cert_type, result) \
137 "chttp2/ssl_" #enum_name "_" #cert_type "_" #result "_"
138
139 typedef enum { SUCCESS, FAIL } test_result;
140
141 #define SSL_TEST(request_type, cert_type, result) \
142 { \
143 {TEST_NAME(request_type, cert_type, result), \
144 FEATURE_MASK_SUPPORTS_PER_CALL_CREDENTIALS | \
145 FEATURE_MASK_SUPPORTS_CLIENT_CHANNEL, \
146 "foo.test.google.fr", TestFixture::MakeFactory(request_type, cert_type)}, \
147 result \
148 }
149
150 // All test configurations
151 struct CoreTestConfigWrapper {
152 grpc_core::CoreTestConfiguration config;
153 test_result result;
154 };
155
156 static CoreTestConfigWrapper configs[] = {
157 SSL_TEST(GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE, NONE, SUCCESS),
158 SSL_TEST(GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE, SELF_SIGNED, SUCCESS),
159 SSL_TEST(GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE, SIGNED, SUCCESS),
160 SSL_TEST(GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE, BAD_CERT_PAIR, FAIL),
161
162 SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY, NONE,
163 SUCCESS),
164 SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY, SELF_SIGNED,
165 SUCCESS),
166 SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY, SIGNED,
167 SUCCESS),
168 SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY, BAD_CERT_PAIR,
169 FAIL),
170
171 SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY, NONE, SUCCESS),
172 SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY, SELF_SIGNED, FAIL),
173 SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY, SIGNED, SUCCESS),
174 SSL_TEST(GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY, BAD_CERT_PAIR,
175 FAIL),
176
177 SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY,
178 NONE, FAIL),
179 SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY,
180 SELF_SIGNED, SUCCESS),
181 SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY,
182 SIGNED, SUCCESS),
183 SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY,
184 BAD_CERT_PAIR, FAIL),
185
186 SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY, NONE,
187 FAIL),
188 SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY,
189 SELF_SIGNED, FAIL),
190 SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY, SIGNED,
191 SUCCESS),
192 SSL_TEST(GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY,
193 BAD_CERT_PAIR, FAIL),
194 };
195
simple_request_body(grpc_core::CoreTestFixture * f,test_result expected_result)196 static void simple_request_body(grpc_core::CoreTestFixture* f,
197 test_result expected_result) {
198 grpc_call* c;
199 gpr_timespec deadline = grpc_timeout_seconds_to_deadline(5);
200 grpc_completion_queue* cq = grpc_completion_queue_create_for_next(nullptr);
201 grpc_core::CqVerifier cqv(cq);
202 grpc_op ops[6];
203 grpc_op* op;
204 grpc_call_error error;
205
206 grpc_channel* client = f->MakeClient(grpc_core::ChannelArgs(), cq);
207 absl::AnyInvocable<void(grpc_server*)> pre_start_server = [](grpc_server*) {};
208 grpc_server* server =
209 f->MakeServer(grpc_core::ChannelArgs(), cq, pre_start_server);
210
211 grpc_slice host = grpc_slice_from_static_string("foo.test.google.fr:1234");
212 c = grpc_channel_create_call(client, nullptr, GRPC_PROPAGATE_DEFAULTS, cq,
213 grpc_slice_from_static_string("/foo"), &host,
214 deadline, nullptr);
215 GPR_ASSERT(c);
216
217 memset(ops, 0, sizeof(ops));
218 op = ops;
219 op->op = GRPC_OP_SEND_INITIAL_METADATA;
220 op->data.send_initial_metadata.count = 0;
221 op->flags = GRPC_INITIAL_METADATA_WAIT_FOR_READY;
222 op->reserved = nullptr;
223 op++;
224 error = grpc_call_start_batch(c, ops, static_cast<size_t>(op - ops),
225 grpc_core::CqVerifier::tag(1), nullptr);
226 GPR_ASSERT(GRPC_CALL_OK == error);
227
228 cqv.Expect(grpc_core::CqVerifier::tag(1), expected_result == SUCCESS);
229 cqv.Verify();
230
231 grpc_call_unref(c);
232 grpc_channel_destroy(client);
233 grpc_server_shutdown_and_notify(server, cq, nullptr);
234 cqv.Expect(nullptr, true);
235 cqv.Verify();
236 grpc_server_destroy(server);
237 grpc_completion_queue_shutdown(cq);
238 GPR_ASSERT(grpc_completion_queue_next(cq, gpr_inf_future(GPR_CLOCK_REALTIME),
239 nullptr)
240 .type == GRPC_QUEUE_SHUTDOWN);
241 grpc_completion_queue_destroy(cq);
242 }
243
244 class H2SslCertTest : public ::testing::TestWithParam<CoreTestConfigWrapper> {
245 protected:
H2SslCertTest()246 H2SslCertTest() {
247 gpr_log(GPR_INFO, "SSL_CERT_tests/%s", GetParam().config.name);
248 }
SetUp()249 void SetUp() override {
250 fixture_ = GetParam().config.create_fixture(grpc_core::ChannelArgs(),
251 grpc_core::ChannelArgs());
252 }
TearDown()253 void TearDown() override { fixture_.reset(); }
254
255 std::unique_ptr<grpc_core::CoreTestFixture> fixture_;
256 };
257
TEST_P(H2SslCertTest,SimpleRequestBody)258 TEST_P(H2SslCertTest, SimpleRequestBody) {
259 simple_request_body(fixture_.get(), GetParam().result);
260 }
261
262 // TODO(b/283304471) SimpleRequestBodyUseEngineTest was failing on OpenSSL3.0
263 // and 1.1.1 and removed. Investigate and rewrite a better test.
264
265 INSTANTIATE_TEST_SUITE_P(H2SslCert, H2SslCertTest,
266 ::testing::ValuesIn(configs));
267
268 } // namespace testing
269 } // namespace grpc
270
main(int argc,char ** argv)271 int main(int argc, char** argv) {
272 FILE* roots_file;
273 size_t roots_size = strlen(test_root_cert);
274 char* roots_filename;
275
276 grpc::testing::TestEnvironment env(&argc, argv);
277 // Set the SSL roots env var.
278 roots_file =
279 gpr_tmpfile("chttp2_simple_ssl_cert_fullstack_test", &roots_filename);
280 GPR_ASSERT(roots_filename != nullptr);
281 GPR_ASSERT(roots_file != nullptr);
282 GPR_ASSERT(fwrite(test_root_cert, 1, roots_size, roots_file) == roots_size);
283 fclose(roots_file);
284 grpc_core::ConfigVars::Overrides config_overrides;
285 config_overrides.default_ssl_roots_file_path = roots_filename;
286 grpc_core::ConfigVars::SetOverrides(config_overrides);
287
288 grpc_init();
289 ::testing::InitGoogleTest(&argc, argv);
290 int ret = RUN_ALL_TESTS();
291 grpc_shutdown();
292
293 // Cleanup.
294 remove(roots_filename);
295 gpr_free(roots_filename);
296
297 return ret;
298 }
299