1/*
2 *
3 * Copyright 2015 gRPC authors.
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 */
18
19#ifndef GRPCPP_SECURITY_SERVER_CREDENTIALS_H
20#define GRPCPP_SECURITY_SERVER_CREDENTIALS_H
21
22#include <memory>
23#include <vector>
24
25#include <grpc/grpc_security_constants.h>
26#include <grpcpp/security/auth_metadata_processor.h>
27#include <grpcpp/security/tls_credentials_options.h>
28#include <grpcpp/support/config.h>
29
30struct grpc_server;
31
32namespace grpc {
33
34class Server;
35class ServerCredentials;
36class SecureServerCredentials;
37/// Options to create ServerCredentials with SSL
38struct SslServerCredentialsOptions {
39 /// \warning Deprecated
40 SslServerCredentialsOptions()
41 : force_client_auth(false),
42 client_certificate_request(GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE) {}
43 explicit SslServerCredentialsOptions(
44 grpc_ssl_client_certificate_request_type request_type)
45 : force_client_auth(false), client_certificate_request(request_type) {}
46
47 struct PemKeyCertPair {
48 std::string private_key;
49 std::string cert_chain;
50 };
51 std::string pem_root_certs;
52 std::vector<PemKeyCertPair> pem_key_cert_pairs;
53 /// \warning Deprecated
54 bool force_client_auth;
55
56 /// If both \a force_client_auth and \a client_certificate_request
57 /// fields are set, \a force_client_auth takes effect, i.e.
58 /// \a REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY
59 /// will be enforced.
60 grpc_ssl_client_certificate_request_type client_certificate_request;
61};
62
63/// Builds Xds ServerCredentials given fallback credentials
64std::shared_ptr<ServerCredentials> XdsServerCredentials(
65 const std::shared_ptr<ServerCredentials>& fallback_credentials);
66
67/// Wrapper around \a grpc_server_credentials, a way to authenticate a server.
68class ServerCredentials : private grpc::GrpcLibraryCodegen {
69 public:
70 ServerCredentials();
71 ~ServerCredentials() override;
72
73 /// This method is not thread-safe and has to be called before the server is
74 /// started. The last call to this function wins.
75 virtual void SetAuthMetadataProcessor(
76 const std::shared_ptr<grpc::AuthMetadataProcessor>& processor) = 0;
77
78 private:
79 friend class Server;
80
81 // We need this friend declaration for access to Insecure() and
82 // AsSecureServerCredentials(). When these two functions are no longer
83 // necessary, this friend declaration can be removed too.
84 friend std::shared_ptr<ServerCredentials> grpc::XdsServerCredentials(
85 const std::shared_ptr<ServerCredentials>& fallback_credentials);
86
87 /// Tries to bind \a server to the given \a addr (eg, localhost:1234,
88 /// 192.168.1.1:31416, [::1]:27182, etc.)
89 ///
90 /// \return bound port number on success, 0 on failure.
91 // TODO(dgq): the "port" part seems to be a misnomer.
92 virtual int AddPortToServer(const std::string& addr, grpc_server* server) = 0;
93
94 // TODO(yashykt): This is a hack since InsecureServerCredentials() cannot use
95 // grpc_insecure_server_credentials_create() and should be removed after
96 // insecure builds are removed from gRPC.
97 virtual bool IsInsecure() const { return false; }
98
99 // TODO(yashkt): This is a hack that should be removed once we remove insecure
100 // builds and the indirect method of adding ports to a server.
101 virtual SecureServerCredentials* AsSecureServerCredentials() {
102 return nullptr;
103 }
104};
105
106/// Builds SSL ServerCredentials given SSL specific options
107std::shared_ptr<ServerCredentials> SslServerCredentials(
108 const grpc::SslServerCredentialsOptions& options);
109
110std::shared_ptr<ServerCredentials> InsecureServerCredentials();
111
112namespace experimental {
113
114/// Options to create ServerCredentials with ALTS
115struct AltsServerCredentialsOptions {
116 /// Add fields if needed.
117};
118
119/// Builds ALTS ServerCredentials given ALTS specific options
120std::shared_ptr<ServerCredentials> AltsServerCredentials(
121 const AltsServerCredentialsOptions& options);
122
123/// Builds Local ServerCredentials.
124std::shared_ptr<ServerCredentials> AltsServerCredentials(
125 const AltsServerCredentialsOptions& options);
126
127std::shared_ptr<ServerCredentials> LocalServerCredentials(
128 grpc_local_connect_type type);
129
130/// Builds TLS ServerCredentials given TLS options.
131std::shared_ptr<ServerCredentials> TlsServerCredentials(
132 const experimental::TlsServerCredentialsOptions& options);
133
134} // namespace experimental
135} // namespace grpc
136
137#endif // GRPCPP_SECURITY_SERVER_CREDENTIALS_H
138

source code of include/grpcpp/security/server_credentials.h