mirror of
https://github.com/cloudflare/cloudflared.git
synced 2025-05-12 20:36:34 +00:00

This adds a new verifier interface that can be attached to ingress.Rule. This would act as a middleware layer that gets executed at the start of proxy.ProxyHTTP. A jwt validator implementation for this verifier is also provided. The validator downloads the public key from the access teams endpoint and uses it to verify the JWT sent to cloudflared with the audtag (clientID) information provided in the config.
177 lines
5.6 KiB
Go
177 lines
5.6 KiB
Go
/*
|
|
*
|
|
* Copyright 2017 gRPC authors.
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*
|
|
*/
|
|
|
|
package grpc
|
|
|
|
import (
|
|
"strings"
|
|
"sync"
|
|
|
|
"google.golang.org/grpc/balancer"
|
|
"google.golang.org/grpc/credentials"
|
|
"google.golang.org/grpc/internal/channelz"
|
|
"google.golang.org/grpc/internal/grpcsync"
|
|
"google.golang.org/grpc/internal/pretty"
|
|
"google.golang.org/grpc/resolver"
|
|
"google.golang.org/grpc/serviceconfig"
|
|
)
|
|
|
|
// ccResolverWrapper is a wrapper on top of cc for resolvers.
|
|
// It implements resolver.ClientConn interface.
|
|
type ccResolverWrapper struct {
|
|
cc *ClientConn
|
|
resolverMu sync.Mutex
|
|
resolver resolver.Resolver
|
|
done *grpcsync.Event
|
|
curState resolver.State
|
|
|
|
incomingMu sync.Mutex // Synchronizes all the incoming calls.
|
|
}
|
|
|
|
// newCCResolverWrapper uses the resolver.Builder to build a Resolver and
|
|
// returns a ccResolverWrapper object which wraps the newly built resolver.
|
|
func newCCResolverWrapper(cc *ClientConn, rb resolver.Builder) (*ccResolverWrapper, error) {
|
|
ccr := &ccResolverWrapper{
|
|
cc: cc,
|
|
done: grpcsync.NewEvent(),
|
|
}
|
|
|
|
var credsClone credentials.TransportCredentials
|
|
if creds := cc.dopts.copts.TransportCredentials; creds != nil {
|
|
credsClone = creds.Clone()
|
|
}
|
|
rbo := resolver.BuildOptions{
|
|
DisableServiceConfig: cc.dopts.disableServiceConfig,
|
|
DialCreds: credsClone,
|
|
CredsBundle: cc.dopts.copts.CredsBundle,
|
|
Dialer: cc.dopts.copts.Dialer,
|
|
}
|
|
|
|
var err error
|
|
// We need to hold the lock here while we assign to the ccr.resolver field
|
|
// to guard against a data race caused by the following code path,
|
|
// rb.Build-->ccr.ReportError-->ccr.poll-->ccr.resolveNow, would end up
|
|
// accessing ccr.resolver which is being assigned here.
|
|
ccr.resolverMu.Lock()
|
|
defer ccr.resolverMu.Unlock()
|
|
ccr.resolver, err = rb.Build(cc.parsedTarget, ccr, rbo)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return ccr, nil
|
|
}
|
|
|
|
func (ccr *ccResolverWrapper) resolveNow(o resolver.ResolveNowOptions) {
|
|
ccr.resolverMu.Lock()
|
|
if !ccr.done.HasFired() {
|
|
ccr.resolver.ResolveNow(o)
|
|
}
|
|
ccr.resolverMu.Unlock()
|
|
}
|
|
|
|
func (ccr *ccResolverWrapper) close() {
|
|
ccr.resolverMu.Lock()
|
|
ccr.resolver.Close()
|
|
ccr.done.Fire()
|
|
ccr.resolverMu.Unlock()
|
|
}
|
|
|
|
func (ccr *ccResolverWrapper) UpdateState(s resolver.State) error {
|
|
ccr.incomingMu.Lock()
|
|
defer ccr.incomingMu.Unlock()
|
|
if ccr.done.HasFired() {
|
|
return nil
|
|
}
|
|
ccr.addChannelzTraceEvent(s)
|
|
ccr.curState = s
|
|
if err := ccr.cc.updateResolverState(ccr.curState, nil); err == balancer.ErrBadResolverState {
|
|
return balancer.ErrBadResolverState
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (ccr *ccResolverWrapper) ReportError(err error) {
|
|
ccr.incomingMu.Lock()
|
|
defer ccr.incomingMu.Unlock()
|
|
if ccr.done.HasFired() {
|
|
return
|
|
}
|
|
channelz.Warningf(logger, ccr.cc.channelzID, "ccResolverWrapper: reporting error to cc: %v", err)
|
|
ccr.cc.updateResolverState(resolver.State{}, err)
|
|
}
|
|
|
|
// NewAddress is called by the resolver implementation to send addresses to gRPC.
|
|
func (ccr *ccResolverWrapper) NewAddress(addrs []resolver.Address) {
|
|
ccr.incomingMu.Lock()
|
|
defer ccr.incomingMu.Unlock()
|
|
if ccr.done.HasFired() {
|
|
return
|
|
}
|
|
ccr.addChannelzTraceEvent(resolver.State{Addresses: addrs, ServiceConfig: ccr.curState.ServiceConfig})
|
|
ccr.curState.Addresses = addrs
|
|
ccr.cc.updateResolverState(ccr.curState, nil)
|
|
}
|
|
|
|
// NewServiceConfig is called by the resolver implementation to send service
|
|
// configs to gRPC.
|
|
func (ccr *ccResolverWrapper) NewServiceConfig(sc string) {
|
|
ccr.incomingMu.Lock()
|
|
defer ccr.incomingMu.Unlock()
|
|
if ccr.done.HasFired() {
|
|
return
|
|
}
|
|
channelz.Infof(logger, ccr.cc.channelzID, "ccResolverWrapper: got new service config: %s", sc)
|
|
if ccr.cc.dopts.disableServiceConfig {
|
|
channelz.Info(logger, ccr.cc.channelzID, "Service config lookups disabled; ignoring config")
|
|
return
|
|
}
|
|
scpr := parseServiceConfig(sc)
|
|
if scpr.Err != nil {
|
|
channelz.Warningf(logger, ccr.cc.channelzID, "ccResolverWrapper: error parsing service config: %v", scpr.Err)
|
|
return
|
|
}
|
|
ccr.addChannelzTraceEvent(resolver.State{Addresses: ccr.curState.Addresses, ServiceConfig: scpr})
|
|
ccr.curState.ServiceConfig = scpr
|
|
ccr.cc.updateResolverState(ccr.curState, nil)
|
|
}
|
|
|
|
func (ccr *ccResolverWrapper) ParseServiceConfig(scJSON string) *serviceconfig.ParseResult {
|
|
return parseServiceConfig(scJSON)
|
|
}
|
|
|
|
func (ccr *ccResolverWrapper) addChannelzTraceEvent(s resolver.State) {
|
|
var updates []string
|
|
var oldSC, newSC *ServiceConfig
|
|
var oldOK, newOK bool
|
|
if ccr.curState.ServiceConfig != nil {
|
|
oldSC, oldOK = ccr.curState.ServiceConfig.Config.(*ServiceConfig)
|
|
}
|
|
if s.ServiceConfig != nil {
|
|
newSC, newOK = s.ServiceConfig.Config.(*ServiceConfig)
|
|
}
|
|
if oldOK != newOK || (oldOK && newOK && oldSC.rawJSONString != newSC.rawJSONString) {
|
|
updates = append(updates, "service config updated")
|
|
}
|
|
if len(ccr.curState.Addresses) > 0 && len(s.Addresses) == 0 {
|
|
updates = append(updates, "resolver returned an empty address list")
|
|
} else if len(ccr.curState.Addresses) == 0 && len(s.Addresses) > 0 {
|
|
updates = append(updates, "resolver returned new addresses")
|
|
}
|
|
channelz.Infof(logger, ccr.cc.channelzID, "Resolver state updated: %s (%v)", pretty.ToJSON(s), strings.Join(updates, "; "))
|
|
}
|