snapshot of https://github.com/grpc/grpc-go.git (master, 2026-09-15; blobs > 131072B omitted)

internal/credentials/spiffe/spiffe.go

@@ -0,0 +1,107 @@
+/*
+ *
+ * Copyright 2025 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package spiffe defines APIs for working with SPIFFE Bundle Maps.
+//
+// All APIs in this package are experimental.
+package spiffe
+
+import (
+	"crypto/x509"
+	"encoding/json"
+	"fmt"
+
+	"github.com/spiffe/go-spiffe/v2/bundle/spiffebundle"
+	"github.com/spiffe/go-spiffe/v2/spiffeid"
+)
+
+type partialParsedSPIFFEBundleMap struct {
+	Bundles map[string]json.RawMessage `json:"trust_domains"`
+}
+
+// BundleMapFromBytes parses bytes into a SPIFFE Bundle Map. See the
+// SPIFFE Bundle Map spec for more detail -
+// https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Trust_Domain_and_Bundle.md#4-spiffe-bundle-format
+// If duplicate keys are encountered in the JSON parsing, Go's default unmarshal
+// behavior occurs which causes the last processed entry to be the entry in the
+// parsed map.
+func BundleMapFromBytes(bundleMapBytes []byte) (map[string]*spiffebundle.Bundle, error) {
+	var result partialParsedSPIFFEBundleMap
+	if err := json.Unmarshal(bundleMapBytes, &result); err != nil {
+		return nil, err
+	}
+	if result.Bundles == nil {
+		return nil, fmt.Errorf("spiffe: BundleMapFromBytes() no bundles parsed from spiffe bundle map bytes")
+	}
+	bundleMap := map[string]*spiffebundle.Bundle{}
+	for td, jsonBundle := range result.Bundles {
+		trustDomain, err := spiffeid.TrustDomainFromString(td)
+		if err != nil {
+			return nil, fmt.Errorf("spiffe: BundleMapFromBytes() invalid trust domain %q found when parsing SPIFFE Bundle Map: %v", td, err)
+		}
+		bundle, err := spiffebundle.Parse(trustDomain, jsonBundle)
+		if err != nil {
+			return nil, fmt.Errorf("spiffe: BundleMapFromBytes() failed to parse bundle for trust domain %q: %v", td, err)
+		}
+		bundleMap[td] = bundle
+	}
+	return bundleMap, nil
+}
+
+// GetRootsFromSPIFFEBundleMap returns the root trust certificates from the
+// SPIFFE bundle map for the given trust domain from the leaf certificate.
+func GetRootsFromSPIFFEBundleMap(bundleMap map[string]*spiffebundle.Bundle, leafCert *x509.Certificate) (*x509.CertPool, error) {
+	// 1. Upon receiving a peer certificate, verify that it is a well-formed SPIFFE
+	//    leaf certificate.  In particular, it must have a single URI SAN containing
+	//    a well-formed SPIFFE ID ([SPIFFE ID format]).
+	spiffeID, err := idFromCert(leafCert)
+	if err != nil {
+		return nil, fmt.Errorf("spiffe: could not get spiffe ID from peer leaf cert but verification with spiffe trust map was configured: %v", err)
+	}
+
+	// 2. Use the trust domain in the peer certificate's SPIFFE ID to lookup
+	//    the SPIFFE trust bundle. If the trust domain is not contained in the
+	//    configured trust map, reject the certificate.
+	spiffeBundle, ok := bundleMap[spiffeID.TrustDomain().Name()]
+	if !ok {
+		return nil, fmt.Errorf("spiffe: no bundle found for peer certificates trust domain %q but verification with a SPIFFE trust map was configured", spiffeID.TrustDomain().Name())
+	}
+	roots := spiffeBundle.X509Authorities()
+	rootPool := x509.NewCertPool()
+	for _, root := range roots {
+		rootPool.AddCert(root)
+	}
+	return rootPool, nil
+}
+
+// idFromCert parses the SPIFFE ID from the x509.Certificate. If the certificate
+// does not have a valid SPIFFE ID, returns an error.
+func idFromCert(cert *x509.Certificate) (*spiffeid.ID, error) {
+	if cert == nil {
+		return nil, fmt.Errorf("input cert is nil")
+	}
+	// A valid SPIFFE Certificate should have exactly one URI.
+	if len(cert.URIs) != 1 {
+		return nil, fmt.Errorf("input cert has %v URIs but should have 1", len(cert.URIs))
+	}
+	id, err := spiffeid.FromURI(cert.URIs[0])
+	if err != nil {
+		return nil, fmt.Errorf("invalid spiffeid: %v", err)
+	}
+	return &id, nil
+}

internal/credentials/spiffe/spiffe_test.go

@@ -0,0 +1,246 @@
+/*
+ *
+ * Copyright 2025 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package spiffe
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"io"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+
+	"google.golang.org/grpc/testdata"
+)
+
+const wantURI = "spiffe://foo.bar.com/client/workload/1"
+
+func loadFileBytes(t *testing.T, filePath string) []byte {
+	bytes, err := os.ReadFile(filePath)
+	if err != nil {
+		t.Fatalf("Error reading file: %v", err)
+	}
+	return bytes
+}
+
+func TestKnownSPIFFEBundle(t *testing.T) {
+	spiffeBundleFile := testdata.Path("spiffe/spiffebundle.json")
+	spiffeBundleBytes := loadFileBytes(t, spiffeBundleFile)
+	bundles, err := BundleMapFromBytes(spiffeBundleBytes)
+	if err != nil {
+		t.Fatalf("BundleMapFromBytes(%v) error during parsing: %v", spiffeBundleFile, err)
+	}
+	const wantBundleSize = 2
+	if len(bundles) != wantBundleSize {
+		t.Fatalf("BundleMapFromBytes(%v) did not parse correct bundle length. got %v want %v", spiffeBundleFile, len(bundles), wantBundleSize)
+	}
+	if bundles["example.com"] == nil {
+		t.Fatalf("BundleMapFromBytes(%v) got no bundle for example.com", spiffeBundleFile)
+	}
+	if bundles["test.example.com"] == nil {
+		t.Fatalf("BundleMapFromBytes(%v) got no bundle for test.example.com", spiffeBundleFile)
+	}
+
+	wantExampleComCert := loadX509Cert(t, testdata.Path("spiffe/spiffe_cert.pem"))
+	wantTestExampleComCert := loadX509Cert(t, testdata.Path("spiffe/server1_spiffe.pem"))
+	if !bundles["example.com"].X509Authorities()[0].Equal(wantExampleComCert) {
+		t.Errorf("BundleMapFromBytes(%v) parsed wrong cert for example.com.", spiffeBundleFile)
+	}
+	if !bundles["test.example.com"].X509Authorities()[0].Equal(wantTestExampleComCert) {
+		t.Errorf("BundleMapFromBytes(%v) parsed wrong cert for test.example.com", spiffeBundleFile)
+	}
+
+}
+
+func loadX509Cert(t *testing.T, filePath string) *x509.Certificate {
+	t.Helper()
+	certFile, _ := os.Open(filePath)
+	certRaw, _ := io.ReadAll(certFile)
+	block, _ := pem.Decode([]byte(certRaw))
+	if block == nil {
+		t.Fatalf("pem.Decode(%v) = nil. Want a value.", certRaw)
+	}
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		t.Fatalf("x509.ParseCertificate(%v) failed %v", block.Bytes, err.Error())
+	}
+	return cert
+}
+
+func TestSPIFFEBundleMapFailures(t *testing.T) {
+	filePaths := []string{
+		testdata.Path("spiffe/spiffebundle_corrupted_cert.json"),
+		testdata.Path("spiffe/spiffebundle_malformed.json"),
+		testdata.Path("spiffe/spiffebundle_wrong_kid.json"),
+		testdata.Path("spiffe/spiffebundle_wrong_kty.json"),
+		testdata.Path("spiffe/spiffebundle_wrong_multi_certs.json"),
+		testdata.Path("spiffe/spiffebundle_wrong_root.json"),
+		testdata.Path("spiffe/spiffebundle_wrong_seq_type.json"),
+		testdata.Path("spiffe/spiffebundle_invalid_trustdomain.json"),
+		testdata.Path("spiffe/spiffebundle_empty_string_key.json"),
+		testdata.Path("spiffe/spiffebundle_empty_keys.json"),
+	}
+	for _, path := range filePaths {
+		t.Run(path, func(t *testing.T) {
+			bundleBytes := loadFileBytes(t, path)
+			if _, err := BundleMapFromBytes(bundleBytes); err == nil {
+				t.Fatalf("BundleMapFromBytes(%v) did not fail but should have", path)
+			}
+		})
+	}
+}
+
+func TestSPIFFEBundleMapX509Failures(t *testing.T) {
+	// SPIFFE Bundles only support a use of x509-svid and jwt-svid. If a
+	// use other than this is specified, the parser does not fail, it
+	// just doesn't add an x509 authority or jwt authority to the bundle
+	filePath := testdata.Path("spiffe/spiffebundle_wrong_use.json")
+	bundleBytes := loadFileBytes(t, filePath)
+	bundle, err := BundleMapFromBytes(bundleBytes)
+	if err != nil {
+		t.Fatalf("BundleMapFromBytes(%v) failed with error: %v", filePath, err)
+	}
+	if len(bundle["example.com"].X509Authorities()) != 0 {
+		t.Fatalf("BundleMapFromBytes(%v) did not have empty bundle but should have", filePath)
+	}
+}
+
+func TestGetRootsFromSPIFFEBundleMapSuccess(t *testing.T) {
+	bundleMapFile := testdata.Path("spiffe/spiffebundle_match_client_spiffe.json")
+	bundleBytes := loadFileBytes(t, bundleMapFile)
+	bundle, err := BundleMapFromBytes(bundleBytes)
+	if err != nil {
+		t.Fatalf("BundleMapFromBytes(%v) failed with error: %v", bundleMapFile, err)
+	}
+
+	cert := loadX509Cert(t, testdata.Path("spiffe/client_spiffe.pem"))
+	gotRoots, err := GetRootsFromSPIFFEBundleMap(bundle, cert)
+	if err != nil {
+		t.Fatalf("GetRootsFromSPIFFEBundleMap() failed with err %v", err)
+	}
+	wantRoot := loadX509Cert(t, testdata.Path("spiffe/spiffe_cert.pem"))
+	wantRoots := x509.NewCertPool()
+	wantRoots.AddCert(wantRoot)
+	if !gotRoots.Equal(wantRoots) {
+		t.Fatalf("GetRootsFromSPIFFEBundleMap() got %v want %v", gotRoots, wantRoots)
+	}
+}
+
+func TestGetRootsFromSPIFFEBundleMapFailures(t *testing.T) {
+	bundleMapFile := testdata.Path("spiffe/spiffebundle.json")
+	bundleBytes := loadFileBytes(t, bundleMapFile)
+	bundle, err := BundleMapFromBytes(bundleBytes)
+	certWithTwoURIs := loadX509Cert(t, testdata.Path("spiffe/client_spiffe.pem"))
+	certWithTwoURIs.URIs = append(certWithTwoURIs.URIs, certWithTwoURIs.URIs[0])
+	certWithNoURIs := loadX509Cert(t, testdata.Path("spiffe/client_spiffe.pem"))
+	certWithNoURIs.URIs = nil
+	if err != nil {
+		t.Fatalf("BundleMapFromBytes(%v) failed with error: %v", bundleMapFile, err)
+	}
+	tests := []struct {
+		name          string
+		bundleMapFile string
+		leafCert      *x509.Certificate
+		wantErr       string
+	}{
+		{
+			name:     "no bundle for peer cert spiffeID",
+			leafCert: loadX509Cert(t, testdata.Path("spiffe/client_spiffe.pem")),
+			wantErr:  "no bundle found for peer certificates",
+		},
+		{
+			name:     "cert has invalid SPIFFE id",
+			leafCert: loadX509Cert(t, testdata.Path("ca.pem")),
+			wantErr:  "could not get spiffe ID from peer leaf cert",
+		},
+		{
+			name:     "nil cert",
+			leafCert: nil,
+			wantErr:  "input cert is nil",
+		},
+		{
+			name:     "cert has multiple URIs",
+			leafCert: certWithTwoURIs,
+			wantErr:  "input cert has 2 URIs but should have 1",
+		},
+		{
+			name:     "cert has no URIs",
+			leafCert: certWithNoURIs,
+			wantErr:  "input cert has 0 URIs but should have 1",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err = GetRootsFromSPIFFEBundleMap(bundle, tc.leafCert)
+			if err == nil {
+				t.Fatalf("GetRootsFromSPIFFEBundleMap() got no error but want error containing %v.", tc.wantErr)
+			}
+			if !strings.Contains(err.Error(), tc.wantErr) {
+				t.Fatalf("GetRootsFromSPIFFEBundleMap() got error: %v. want error to contain %v", err, tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestIDFromCert(t *testing.T) {
+	cert := loadX509Cert(t, testdata.Path("x509/spiffe_cert.pem"))
+	uri, err := idFromCert(cert)
+	if err != nil {
+		t.Fatalf("idFromCert() failed with err: %v", err)
+	}
+	if uri != nil && uri.String() != wantURI {
+		t.Fatalf("ID not expected, got %s, want %s", uri.String(), wantURI)
+	}
+}
+
+func TestIDFromCertFileFailures(t *testing.T) {
+	certWithNoURIs := loadX509Cert(t, testdata.Path("spiffe/client_spiffe.pem"))
+	certWithNoURIs.URIs = nil
+	certWithInvalidSPIFFEID := loadX509Cert(t, testdata.Path("spiffe/client_spiffe.pem"))
+	certWithInvalidSPIFFEID.URIs = []*url.URL{{Path: "non-spiffe.bad"}}
+	tests := []struct {
+		name string
+		cert *x509.Certificate
+	}{
+		{
+			name: "certificate with multiple URIs",
+			cert: loadX509Cert(t, testdata.Path("x509/multiple_uri_cert.pem")),
+		},
+		{
+			name: "certificate with invalidSPIFFE ID",
+			cert: certWithInvalidSPIFFEID,
+		},
+		{
+			name: "nil cert",
+			cert: nil,
+		},
+		{
+			name: "cert with no URIs",
+			cert: certWithNoURIs,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if _, err := idFromCert(tt.cert); err == nil {
+				t.Fatalf("idFromCert() succeeded but want error")
+			}
+		})
+	}
+}