Conversation
Add a protected helper on CallCredentials so that implementations can check whether the transport's security level meets the minimum level they require before transferring credentials, as described in gRFC L62. Use it in GoogleAuthLibraryCallCredentials, which previously compared against PRIVACY_AND_INTEGRITY for exact equality. The behavior is unchanged, since PRIVACY_AND_INTEGRITY is the highest security level. Supersedes grpc#6616, which was approved but went stale.
Drop the newly added CallCredentialsTest in favor of extending the pre-existing GoogleAuthLibraryCallCredentialsTest, which already exercises the helper through the real code path. It covered PRIVACY_AND_INTEGRITY and INTEGRITY; add the remaining NONE case.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
protected statichelper onCallCredentials.GoogleAuthLibraryCallCredentialsis updated to use it. Behavior there is unchanged: it previously compared againstPRIVACY_AND_INTEGRITYfor exact equality, which is equivalent to a>=comparison sincePRIVACY_AND_INTEGRITYis the highest security level.This revives #6616, which was reviewed and approved but went stale because the CLA was never signed. Credit for the original change goes to @yihuazhang. Relative to that PR:
protectedrather thanpublic, per @ejona86's last review comment;GoogleAuthLibraryCallCredentialsTestalready covered thePRIVACY_AND_INTEGRITYandINTEGRITYlevels, so a case forNONEis added to complete coverage of the changed line;xdsFileBasedPluginCredentialchange is dropped, as agreed in the original review.