@@ -26,7 +26,7 @@ import (
2626 "errors"
2727 "fmt"
2828 "strings"
29- "sync "
29+ "unsafe "
3030
3131 "google.golang.org/grpc/attributes"
3232 "google.golang.org/grpc/credentials/tls/certprovider"
@@ -66,59 +66,38 @@ func (hi *HandshakeInfo) Equal(other *HandshakeInfo) bool {
6666}
6767
6868// SetHandshakeInfo returns a copy of addr in which the Attributes field is
69- // updated with hInfo .
70- func SetHandshakeInfo (addr resolver.Address , hInfo * HandshakeInfo ) resolver.Address {
71- addr .Attributes = addr .Attributes .WithValue (handshakeAttrKey {}, hInfo )
69+ // updated with hiPtr .
70+ func SetHandshakeInfo (addr resolver.Address , hiPtr * unsafe. Pointer ) resolver.Address {
71+ addr .Attributes = addr .Attributes .WithValue (handshakeAttrKey {}, hiPtr )
7272 return addr
7373}
7474
75- // GetHandshakeInfo returns a pointer to the HandshakeInfo stored in attr.
76- func GetHandshakeInfo (attr * attributes.Attributes ) * HandshakeInfo {
75+ // GetHandshakeInfo returns a pointer to the * HandshakeInfo stored in attr.
76+ func GetHandshakeInfo (attr * attributes.Attributes ) * unsafe. Pointer {
7777 v := attr .Value (handshakeAttrKey {})
78- hi , _ := v .(* HandshakeInfo )
78+ hi , _ := v .(* unsafe. Pointer )
7979 return hi
8080}
8181
8282// HandshakeInfo wraps all the security configuration required by client and
8383// server handshake methods in xds credentials. The xDS implementation will be
8484// responsible for populating these fields.
85- //
86- // Safe for concurrent access.
8785type HandshakeInfo struct {
88- mu sync.Mutex
86+ // All fields written at init time and read only after that, so no
87+ // synchronization needed.
8988 rootProvider certprovider.Provider
9089 identityProvider certprovider.Provider
9190 sanMatchers []matcher.StringMatcher // Only on the client side.
9291 requireClientCert bool // Only on server side.
9392}
9493
95- // SetRootCertProvider updates the root certificate provider.
96- func (hi * HandshakeInfo ) SetRootCertProvider (root certprovider.Provider ) {
97- hi .mu .Lock ()
98- hi .rootProvider = root
99- hi .mu .Unlock ()
100- }
101-
102- // SetIdentityCertProvider updates the identity certificate provider.
103- func (hi * HandshakeInfo ) SetIdentityCertProvider (identity certprovider.Provider ) {
104- hi .mu .Lock ()
105- hi .identityProvider = identity
106- hi .mu .Unlock ()
107- }
108-
109- // SetSANMatchers updates the list of SAN matchers.
110- func (hi * HandshakeInfo ) SetSANMatchers (sanMatchers []matcher.StringMatcher ) {
111- hi .mu .Lock ()
112- hi .sanMatchers = sanMatchers
113- hi .mu .Unlock ()
114- }
115-
116- // SetRequireClientCert updates whether a client cert is required during the
117- // ServerHandshake(). A value of true indicates that we are performing mTLS.
118- func (hi * HandshakeInfo ) SetRequireClientCert (require bool ) {
119- hi .mu .Lock ()
120- hi .requireClientCert = require
121- hi .mu .Unlock ()
94+ func NewHandshakeInfo (rootProvider certprovider.Provider , identityProvider certprovider.Provider , sanMatchers []matcher.StringMatcher , requireClientCert bool ) * HandshakeInfo {
95+ return & HandshakeInfo {
96+ rootProvider : rootProvider ,
97+ identityProvider : identityProvider ,
98+ sanMatchers : sanMatchers ,
99+ requireClientCert : requireClientCert ,
100+ }
122101}
123102
124103// UseFallbackCreds returns true when fallback credentials are to be used based
@@ -127,24 +106,18 @@ func (hi *HandshakeInfo) UseFallbackCreds() bool {
127106 if hi == nil {
128107 return true
129108 }
130-
131- hi .mu .Lock ()
132- defer hi .mu .Unlock ()
133109 return hi .identityProvider == nil && hi .rootProvider == nil
134110}
135111
136112// GetSANMatchersForTesting returns the SAN matchers stored in HandshakeInfo.
137113// To be used only for testing purposes.
138114func (hi * HandshakeInfo ) GetSANMatchersForTesting () []matcher.StringMatcher {
139- hi .mu .Lock ()
140- defer hi .mu .Unlock ()
141115 return append ([]matcher.StringMatcher {}, hi .sanMatchers ... )
142116}
143117
144118// ClientSideTLSConfig constructs a tls.Config to be used in a client-side
145119// handshake based on the contents of the HandshakeInfo.
146120func (hi * HandshakeInfo ) ClientSideTLSConfig (ctx context.Context ) (* tls.Config , error ) {
147- hi .mu .Lock ()
148121 // On the client side, rootProvider is mandatory. IdentityProvider is
149122 // optional based on whether the client is doing TLS or mTLS.
150123 if hi .rootProvider == nil {
@@ -153,7 +126,6 @@ func (hi *HandshakeInfo) ClientSideTLSConfig(ctx context.Context) (*tls.Config,
153126 // Since the call to KeyMaterial() can block, we read the providers under
154127 // the lock but call the actual function after releasing the lock.
155128 rootProv , idProv := hi .rootProvider , hi .identityProvider
156- hi .mu .Unlock ()
157129
158130 // InsecureSkipVerify needs to be set to true because we need to perform
159131 // custom verification to check the SAN on the received certificate.
@@ -188,7 +160,6 @@ func (hi *HandshakeInfo) ServerSideTLSConfig(ctx context.Context) (*tls.Config,
188160 ClientAuth : tls .NoClientCert ,
189161 NextProtos : []string {"h2" },
190162 }
191- hi .mu .Lock ()
192163 // On the server side, identityProvider is mandatory. RootProvider is
193164 // optional based on whether the server is doing TLS or mTLS.
194165 if hi .identityProvider == nil {
@@ -200,7 +171,6 @@ func (hi *HandshakeInfo) ServerSideTLSConfig(ctx context.Context) (*tls.Config,
200171 if hi .requireClientCert {
201172 cfg .ClientAuth = tls .RequireAndVerifyClientCert
202173 }
203- hi .mu .Unlock ()
204174
205175 // identityProvider is mandatory on the server side.
206176 km , err := idProv .KeyMaterial (ctx )
@@ -225,8 +195,6 @@ func (hi *HandshakeInfo) ServerSideTLSConfig(ctx context.Context) (*tls.Config,
225195// If the list of SAN matchers in the HandshakeInfo is empty, this function
226196// returns true for all input certificates.
227197func (hi * HandshakeInfo ) MatchingSANExists (cert * x509.Certificate ) bool {
228- hi .mu .Lock ()
229- defer hi .mu .Unlock ()
230198 if len (hi .sanMatchers ) == 0 {
231199 return true
232200 }
@@ -325,9 +293,3 @@ func dnsMatch(host, san string) bool {
325293 hostPrefix := strings .TrimSuffix (host , san [1 :])
326294 return ! strings .Contains (hostPrefix , "." )
327295}
328-
329- // NewHandshakeInfo returns a new instance of HandshakeInfo with the given root
330- // and identity certificate providers.
331- func NewHandshakeInfo (root , identity certprovider.Provider ) * HandshakeInfo {
332- return & HandshakeInfo {rootProvider : root , identityProvider : identity }
333- }
0 commit comments