Skip to content

Commit bcd747d

Browse files
tdbhackstdbhacks
committed
Added system roots feature to load roots from OS trust store
Added a flag-guarded feature that allows gRPC to load TLS/SSL roots from the OS trust store. This is the Linux-specific implementation of such feature.
1 parent cb87dd9 commit bcd747d

29 files changed

Lines changed: 760 additions & 10 deletions

‎BUILD‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1499,6 +1499,8 @@ grpc_cc_library(
14991499
"src/core/lib/security/credentials/plugin/plugin_credentials.cc",
15001500
"src/core/lib/security/credentials/ssl/ssl_credentials.cc",
15011501
"src/core/lib/security/security_connector/alts_security_connector.cc",
1502+
"src/core/lib/security/security_connector/load_system_roots_fallback.cc",
1503+
"src/core/lib/security/security_connector/load_system_roots_linux.cc",
15021504
"src/core/lib/security/security_connector/local_security_connector.cc",
15031505
"src/core/lib/security/security_connector/security_connector.cc",
15041506
"src/core/lib/security/transport/client_auth_filter.cc",
@@ -1527,6 +1529,8 @@ grpc_cc_library(
15271529
"src/core/lib/security/credentials/plugin/plugin_credentials.h",
15281530
"src/core/lib/security/credentials/ssl/ssl_credentials.h",
15291531
"src/core/lib/security/security_connector/alts_security_connector.h",
1532+
"src/core/lib/security/security_connector/load_system_roots.h",
1533+
"src/core/lib/security/security_connector/load_system_roots_linux.h",
15301534
"src/core/lib/security/security_connector/local_security_connector.h",
15311535
"src/core/lib/security/security_connector/security_connector.h",
15321536
"src/core/lib/security/transport/auth_filters.h",

‎CMakeLists.txt‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -581,6 +581,7 @@ add_dependencies(buildtests_cxx generic_end2end_test)
581581
add_dependencies(buildtests_cxx golden_file_test)
582582
add_dependencies(buildtests_cxx grpc_alts_credentials_options_test)
583583
add_dependencies(buildtests_cxx grpc_cli)
584+
add_dependencies(buildtests_cxx grpc_linux_system_roots_test)
584585
add_dependencies(buildtests_cxx grpc_tool_test)
585586
add_dependencies(buildtests_cxx grpclb_api_test)
586587
add_dependencies(buildtests_cxx grpclb_end2end_test)
@@ -1129,6 +1130,8 @@ add_library(grpc
11291130
src/core/lib/security/credentials/plugin/plugin_credentials.cc
11301131
src/core/lib/security/credentials/ssl/ssl_credentials.cc
11311132
src/core/lib/security/security_connector/alts_security_connector.cc
1133+
src/core/lib/security/security_connector/load_system_roots_fallback.cc
1134+
src/core/lib/security/security_connector/load_system_roots_linux.cc
11321135
src/core/lib/security/security_connector/local_security_connector.cc
11331136
src/core/lib/security/security_connector/security_connector.cc
11341137
src/core/lib/security/transport/client_auth_filter.cc
@@ -1559,6 +1562,8 @@ add_library(grpc_cronet
15591562
src/core/lib/security/credentials/plugin/plugin_credentials.cc
15601563
src/core/lib/security/credentials/ssl/ssl_credentials.cc
15611564
src/core/lib/security/security_connector/alts_security_connector.cc
1565+
src/core/lib/security/security_connector/load_system_roots_fallback.cc
1566+
src/core/lib/security/security_connector/load_system_roots_linux.cc
15621567
src/core/lib/security/security_connector/local_security_connector.cc
15631568
src/core/lib/security/security_connector/security_connector.cc
15641569
src/core/lib/security/transport/client_auth_filter.cc
@@ -12146,6 +12151,44 @@ if (gRPC_INSTALL)
1214612151
endif()
1214712152

1214812153
endif (gRPC_BUILD_CODEGEN)
12154+
if (gRPC_BUILD_TESTS)
12155+
12156+
add_executable(grpc_linux_system_roots_test
12157+
test/core/security/linux_system_roots_test.cc
12158+
third_party/googletest/googletest/src/gtest-all.cc
12159+
third_party/googletest/googlemock/src/gmock-all.cc
12160+
)
12161+
12162+
12163+
target_include_directories(grpc_linux_system_roots_test
12164+
PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}
12165+
PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include
12166+
PRIVATE ${_gRPC_SSL_INCLUDE_DIR}
12167+
PRIVATE ${_gRPC_PROTOBUF_INCLUDE_DIR}
12168+
PRIVATE ${_gRPC_ZLIB_INCLUDE_DIR}
12169+
PRIVATE ${_gRPC_BENCHMARK_INCLUDE_DIR}
12170+
PRIVATE ${_gRPC_CARES_INCLUDE_DIR}
12171+
PRIVATE ${_gRPC_GFLAGS_INCLUDE_DIR}
12172+
PRIVATE ${_gRPC_ADDRESS_SORTING_INCLUDE_DIR}
12173+
PRIVATE ${_gRPC_NANOPB_INCLUDE_DIR}
12174+
PRIVATE third_party/googletest/googletest/include
12175+
PRIVATE third_party/googletest/googletest
12176+
PRIVATE third_party/googletest/googlemock/include
12177+
PRIVATE third_party/googletest/googlemock
12178+
PRIVATE ${_gRPC_PROTO_GENS_DIR}
12179+
)
12180+
12181+
target_link_libraries(grpc_linux_system_roots_test
12182+
${_gRPC_PROTOBUF_LIBRARIES}
12183+
${_gRPC_ALLTARGETS_LIBRARIES}
12184+
grpc_test_util
12185+
grpc
12186+
gpr_test_util
12187+
gpr
12188+
${_gRPC_GFLAGS_LIBRARIES}
12189+
)
12190+
12191+
endif (gRPC_BUILD_TESTS)
1214912192
if (gRPC_BUILD_CODEGEN)
1215012193

1215112194
add_executable(grpc_node_plugin

‎Makefile‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1170,6 +1170,7 @@ grpc_alts_credentials_options_test: $(BINDIR)/$(CONFIG)/grpc_alts_credentials_op
11701170
grpc_cli: $(BINDIR)/$(CONFIG)/grpc_cli
11711171
grpc_cpp_plugin: $(BINDIR)/$(CONFIG)/grpc_cpp_plugin
11721172
grpc_csharp_plugin: $(BINDIR)/$(CONFIG)/grpc_csharp_plugin
1173+
grpc_linux_system_roots_test: $(BINDIR)/$(CONFIG)/grpc_linux_system_roots_test
11731174
grpc_node_plugin: $(BINDIR)/$(CONFIG)/grpc_node_plugin
11741175
grpc_objective_c_plugin: $(BINDIR)/$(CONFIG)/grpc_objective_c_plugin
11751176
grpc_php_plugin: $(BINDIR)/$(CONFIG)/grpc_php_plugin
@@ -1670,6 +1671,7 @@ buildtests_cxx: privatelibs_cxx \
16701671
$(BINDIR)/$(CONFIG)/golden_file_test \
16711672
$(BINDIR)/$(CONFIG)/grpc_alts_credentials_options_test \
16721673
$(BINDIR)/$(CONFIG)/grpc_cli \
1674+
$(BINDIR)/$(CONFIG)/grpc_linux_system_roots_test \
16731675
$(BINDIR)/$(CONFIG)/grpc_tool_test \
16741676
$(BINDIR)/$(CONFIG)/grpclb_api_test \
16751677
$(BINDIR)/$(CONFIG)/grpclb_end2end_test \
@@ -1849,6 +1851,7 @@ buildtests_cxx: privatelibs_cxx \
18491851
$(BINDIR)/$(CONFIG)/golden_file_test \
18501852
$(BINDIR)/$(CONFIG)/grpc_alts_credentials_options_test \
18511853
$(BINDIR)/$(CONFIG)/grpc_cli \
1854+
$(BINDIR)/$(CONFIG)/grpc_linux_system_roots_test \
18521855
$(BINDIR)/$(CONFIG)/grpc_tool_test \
18531856
$(BINDIR)/$(CONFIG)/grpclb_api_test \
18541857
$(BINDIR)/$(CONFIG)/grpclb_end2end_test \
@@ -2316,6 +2319,8 @@ test_cxx: buildtests_cxx
23162319
$(Q) $(BINDIR)/$(CONFIG)/golden_file_test || ( echo test golden_file_test failed ; exit 1 )
23172320
$(E) "[RUN] Testing grpc_alts_credentials_options_test"
23182321
$(Q) $(BINDIR)/$(CONFIG)/grpc_alts_credentials_options_test || ( echo test grpc_alts_credentials_options_test failed ; exit 1 )
2322+
$(E) "[RUN] Testing grpc_linux_system_roots_test"
2323+
$(Q) $(BINDIR)/$(CONFIG)/grpc_linux_system_roots_test || ( echo test grpc_linux_system_roots_test failed ; exit 1 )
23192324
$(E) "[RUN] Testing grpc_tool_test"
23202325
$(Q) $(BINDIR)/$(CONFIG)/grpc_tool_test || ( echo test grpc_tool_test failed ; exit 1 )
23212326
$(E) "[RUN] Testing grpclb_api_test"
@@ -3608,6 +3613,8 @@ LIBGRPC_SRC = \
36083613
src/core/lib/security/credentials/plugin/plugin_credentials.cc \
36093614
src/core/lib/security/credentials/ssl/ssl_credentials.cc \
36103615
src/core/lib/security/security_connector/alts_security_connector.cc \
3616+
src/core/lib/security/security_connector/load_system_roots_fallback.cc \
3617+
src/core/lib/security/security_connector/load_system_roots_linux.cc \
36113618
src/core/lib/security/security_connector/local_security_connector.cc \
36123619
src/core/lib/security/security_connector/security_connector.cc \
36133620
src/core/lib/security/transport/client_auth_filter.cc \
@@ -4037,6 +4044,8 @@ LIBGRPC_CRONET_SRC = \
40374044
src/core/lib/security/credentials/plugin/plugin_credentials.cc \
40384045
src/core/lib/security/credentials/ssl/ssl_credentials.cc \
40394046
src/core/lib/security/security_connector/alts_security_connector.cc \
4047+
src/core/lib/security/security_connector/load_system_roots_fallback.cc \
4048+
src/core/lib/security/security_connector/load_system_roots_linux.cc \
40404049
src/core/lib/security/security_connector/local_security_connector.cc \
40414050
src/core/lib/security/security_connector/security_connector.cc \
40424051
src/core/lib/security/transport/client_auth_filter.cc \
@@ -17907,6 +17916,49 @@ ifneq ($(NO_DEPS),true)
1790717916
endif
1790817917

1790917918

17919+
GRPC_LINUX_SYSTEM_ROOTS_TEST_SRC = \
17920+
test/core/security/linux_system_roots_test.cc \
17921+
17922+
GRPC_LINUX_SYSTEM_ROOTS_TEST_OBJS = $(addprefix $(OBJDIR)/$(CONFIG)/, $(addsuffix .o, $(basename $(GRPC_LINUX_SYSTEM_ROOTS_TEST_SRC))))
17923+
ifeq ($(NO_SECURE),true)
17924+
17925+
# You can't build secure targets if you don't have OpenSSL.
17926+
17927+
$(BINDIR)/$(CONFIG)/grpc_linux_system_roots_test: openssl_dep_error
17928+
17929+
else
17930+
17931+
17932+
17933+
17934+
ifeq ($(NO_PROTOBUF),true)
17935+
17936+
# You can't build the protoc plugins or protobuf-enabled targets if you don't have protobuf 3.5.0+.
17937+
17938+
$(BINDIR)/$(CONFIG)/grpc_linux_system_roots_test: protobuf_dep_error
17939+
17940+
else
17941+
17942+
$(BINDIR)/$(CONFIG)/grpc_linux_system_roots_test: $(PROTOBUF_DEP) $(GRPC_LINUX_SYSTEM_ROOTS_TEST_OBJS) $(LIBDIR)/$(CONFIG)/libgrpc_test_util.a $(LIBDIR)/$(CONFIG)/libgrpc.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a
17943+
$(E) "[LD] Linking $@"
17944+
$(Q) mkdir -p `dirname $@`
17945+
$(Q) $(LDXX) $(LDFLAGS) $(GRPC_LINUX_SYSTEM_ROOTS_TEST_OBJS) $(LIBDIR)/$(CONFIG)/libgrpc_test_util.a $(LIBDIR)/$(CONFIG)/libgrpc.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a $(LDLIBSXX) $(LDLIBS_PROTOBUF) $(LDLIBS) $(LDLIBS_SECURE) $(GTEST_LIB) -o $(BINDIR)/$(CONFIG)/grpc_linux_system_roots_test
17946+
17947+
endif
17948+
17949+
endif
17950+
17951+
$(OBJDIR)/$(CONFIG)/test/core/security/linux_system_roots_test.o: $(LIBDIR)/$(CONFIG)/libgrpc_test_util.a $(LIBDIR)/$(CONFIG)/libgrpc.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a
17952+
17953+
deps_grpc_linux_system_roots_test: $(GRPC_LINUX_SYSTEM_ROOTS_TEST_OBJS:.o=.dep)
17954+
17955+
ifneq ($(NO_SECURE),true)
17956+
ifneq ($(NO_DEPS),true)
17957+
-include $(GRPC_LINUX_SYSTEM_ROOTS_TEST_OBJS:.o=.dep)
17958+
endif
17959+
endif
17960+
17961+
1791017962
GRPC_NODE_PLUGIN_SRC = \
1791117963
src/compiler/node_plugin.cc \
1791217964

@@ -24651,6 +24703,8 @@ src/core/lib/security/credentials/oauth2/oauth2_credentials.cc: $(OPENSSL_DEP)
2465124703
src/core/lib/security/credentials/plugin/plugin_credentials.cc: $(OPENSSL_DEP)
2465224704
src/core/lib/security/credentials/ssl/ssl_credentials.cc: $(OPENSSL_DEP)
2465324705
src/core/lib/security/security_connector/alts_security_connector.cc: $(OPENSSL_DEP)
24706+
src/core/lib/security/security_connector/load_system_roots_fallback.cc: $(OPENSSL_DEP)
24707+
src/core/lib/security/security_connector/load_system_roots_linux.cc: $(OPENSSL_DEP)
2465424708
src/core/lib/security/security_connector/local_security_connector.cc: $(OPENSSL_DEP)
2465524709
src/core/lib/security/security_connector/security_connector.cc: $(OPENSSL_DEP)
2465624710
src/core/lib/security/transport/client_auth_filter.cc: $(OPENSSL_DEP)

‎build.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -792,6 +792,8 @@ filegroups:
792792
- src/core/lib/security/credentials/plugin/plugin_credentials.h
793793
- src/core/lib/security/credentials/ssl/ssl_credentials.h
794794
- src/core/lib/security/security_connector/alts_security_connector.h
795+
- src/core/lib/security/security_connector/load_system_roots.h
796+
- src/core/lib/security/security_connector/load_system_roots_linux.h
795797
- src/core/lib/security/security_connector/local_security_connector.h
796798
- src/core/lib/security/security_connector/security_connector.h
797799
- src/core/lib/security/transport/auth_filters.h
@@ -819,6 +821,8 @@ filegroups:
819821
- src/core/lib/security/credentials/plugin/plugin_credentials.cc
820822
- src/core/lib/security/credentials/ssl/ssl_credentials.cc
821823
- src/core/lib/security/security_connector/alts_security_connector.cc
824+
- src/core/lib/security/security_connector/load_system_roots_fallback.cc
825+
- src/core/lib/security/security_connector/load_system_roots_linux.cc
822826
- src/core/lib/security/security_connector/local_security_connector.cc
823827
- src/core/lib/security/security_connector/security_connector.cc
824828
- src/core/lib/security/transport/client_auth_filter.cc
@@ -4698,6 +4702,17 @@ targets:
46984702
secure: false
46994703
vs_config_type: Application
47004704
vs_project_guid: '{3C813052-A49A-4662-B90A-1ADBEC7EE453}'
4705+
- name: grpc_linux_system_roots_test
4706+
gtest: true
4707+
build: test
4708+
language: c++
4709+
src:
4710+
- test/core/security/linux_system_roots_test.cc
4711+
deps:
4712+
- grpc_test_util
4713+
- grpc
4714+
- gpr_test_util
4715+
- gpr
47014716
- name: grpc_node_plugin
47024717
build: protoc
47034718
language: c++

‎config.m4‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,8 @@ if test "$PHP_GRPC" != "no"; then
280280
src/core/lib/security/credentials/plugin/plugin_credentials.cc \
281281
src/core/lib/security/credentials/ssl/ssl_credentials.cc \
282282
src/core/lib/security/security_connector/alts_security_connector.cc \
283+
src/core/lib/security/security_connector/load_system_roots_fallback.cc \
284+
src/core/lib/security/security_connector/load_system_roots_linux.cc \
283285
src/core/lib/security/security_connector/local_security_connector.cc \
284286
src/core/lib/security/security_connector/security_connector.cc \
285287
src/core/lib/security/transport/client_auth_filter.cc \

‎config.w32‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,8 @@ if (PHP_GRPC != "no") {
255255
"src\\core\\lib\\security\\credentials\\plugin\\plugin_credentials.cc " +
256256
"src\\core\\lib\\security\\credentials\\ssl\\ssl_credentials.cc " +
257257
"src\\core\\lib\\security\\security_connector\\alts_security_connector.cc " +
258+
"src\\core\\lib\\security\\security_connector\\load_system_roots_fallback.cc " +
259+
"src\\core\\lib\\security\\security_connector\\load_system_roots_linux.cc " +
258260
"src\\core\\lib\\security\\security_connector\\local_security_connector.cc " +
259261
"src\\core\\lib\\security\\security_connector\\security_connector.cc " +
260262
"src\\core\\lib\\security\\transport\\client_auth_filter.cc " +

‎gRPC-C++.podspec‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,8 @@ Pod::Spec.new do |s|
278278
'src/core/lib/security/credentials/plugin/plugin_credentials.h',
279279
'src/core/lib/security/credentials/ssl/ssl_credentials.h',
280280
'src/core/lib/security/security_connector/alts_security_connector.h',
281+
'src/core/lib/security/security_connector/load_system_roots.h',
282+
'src/core/lib/security/security_connector/load_system_roots_linux.h',
281283
'src/core/lib/security/security_connector/local_security_connector.h',
282284
'src/core/lib/security/security_connector/security_connector.h',
283285
'src/core/lib/security/transport/auth_filters.h',

‎gRPC-Core.podspec‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,8 @@ Pod::Spec.new do |s|
289289
'src/core/lib/security/credentials/plugin/plugin_credentials.h',
290290
'src/core/lib/security/credentials/ssl/ssl_credentials.h',
291291
'src/core/lib/security/security_connector/alts_security_connector.h',
292+
'src/core/lib/security/security_connector/load_system_roots.h',
293+
'src/core/lib/security/security_connector/load_system_roots_linux.h',
292294
'src/core/lib/security/security_connector/local_security_connector.h',
293295
'src/core/lib/security/security_connector/security_connector.h',
294296
'src/core/lib/security/transport/auth_filters.h',
@@ -705,6 +707,8 @@ Pod::Spec.new do |s|
705707
'src/core/lib/security/credentials/plugin/plugin_credentials.cc',
706708
'src/core/lib/security/credentials/ssl/ssl_credentials.cc',
707709
'src/core/lib/security/security_connector/alts_security_connector.cc',
710+
'src/core/lib/security/security_connector/load_system_roots_fallback.cc',
711+
'src/core/lib/security/security_connector/load_system_roots_linux.cc',
708712
'src/core/lib/security/security_connector/local_security_connector.cc',
709713
'src/core/lib/security/security_connector/security_connector.cc',
710714
'src/core/lib/security/transport/client_auth_filter.cc',
@@ -882,6 +886,8 @@ Pod::Spec.new do |s|
882886
'src/core/lib/security/credentials/plugin/plugin_credentials.h',
883887
'src/core/lib/security/credentials/ssl/ssl_credentials.h',
884888
'src/core/lib/security/security_connector/alts_security_connector.h',
889+
'src/core/lib/security/security_connector/load_system_roots.h',
890+
'src/core/lib/security/security_connector/load_system_roots_linux.h',
885891
'src/core/lib/security/security_connector/local_security_connector.h',
886892
'src/core/lib/security/security_connector/security_connector.h',
887893
'src/core/lib/security/transport/auth_filters.h',

‎grpc.gemspec‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,8 @@ Gem::Specification.new do |s|
222222
s.files += %w( src/core/lib/security/credentials/plugin/plugin_credentials.h )
223223
s.files += %w( src/core/lib/security/credentials/ssl/ssl_credentials.h )
224224
s.files += %w( src/core/lib/security/security_connector/alts_security_connector.h )
225+
s.files += %w( src/core/lib/security/security_connector/load_system_roots.h )
226+
s.files += %w( src/core/lib/security/security_connector/load_system_roots_linux.h )
225227
s.files += %w( src/core/lib/security/security_connector/local_security_connector.h )
226228
s.files += %w( src/core/lib/security/security_connector/security_connector.h )
227229
s.files += %w( src/core/lib/security/transport/auth_filters.h )
@@ -642,6 +644,8 @@ Gem::Specification.new do |s|
642644
s.files += %w( src/core/lib/security/credentials/plugin/plugin_credentials.cc )
643645
s.files += %w( src/core/lib/security/credentials/ssl/ssl_credentials.cc )
644646
s.files += %w( src/core/lib/security/security_connector/alts_security_connector.cc )
647+
s.files += %w( src/core/lib/security/security_connector/load_system_roots_fallback.cc )
648+
s.files += %w( src/core/lib/security/security_connector/load_system_roots_linux.cc )
645649
s.files += %w( src/core/lib/security/security_connector/local_security_connector.cc )
646650
s.files += %w( src/core/lib/security/security_connector/security_connector.cc )
647651
s.files += %w( src/core/lib/security/transport/client_auth_filter.cc )

‎grpc.gyp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -472,6 +472,8 @@
472472
'src/core/lib/security/credentials/plugin/plugin_credentials.cc',
473473
'src/core/lib/security/credentials/ssl/ssl_credentials.cc',
474474
'src/core/lib/security/security_connector/alts_security_connector.cc',
475+
'src/core/lib/security/security_connector/load_system_roots_fallback.cc',
476+
'src/core/lib/security/security_connector/load_system_roots_linux.cc',
475477
'src/core/lib/security/security_connector/local_security_connector.cc',
476478
'src/core/lib/security/security_connector/security_connector.cc',
477479
'src/core/lib/security/transport/client_auth_filter.cc',

0 commit comments

Comments
 (0)