Add support for gRPC authenticated communications

Also, make a few namespace corrections and some minor refactoring.

Change-Id: Iedcaf6b43cb7576bc11dfefe980abd190c838831


[ROCm/rdc commit: 47fdfa4c7e]

projects/rdc/client/src/rdc_client.cc

@@ -28,6 +28,7 @@ THE SOFTWARE.
 
 #include "rdc/rdc_client_main.h"
 #include "rdc/rdc_client.h"
+#include "rdc/rdc_client_utils.h"
 #include "common/rdc_utils.h"
 #include "rdc/rdc_exception.h"
 #include "rdc.grpc.pb.h"  // NOLINT
@@ -552,6 +553,11 @@ rdc_status_string(rdc_status_t status, const char **status_string) {
         "RDC_STATUS_UNKNOWN_ERROR An unknown RDC error occurred.";
       break;
 
+    case RDC_STATUS_CLIENT_ERR_SSL:
+      *status_string =
+          "An error occurred when executing SSL authentication operations.";
+      break;
+
     default:
       *status_string = "RDC_RSMI_STATUS_UNKNOWN_ERROR An "
           "unknown error occurred";

projects/rdc/client/src/rdc_client_main.cc

@@ -29,10 +29,29 @@ THE SOFTWARE.
 #include "rdc.grpc.pb.h"  // NOLINT
 #include "rdc/rdc_client_main.h"
 #include "rdc/rdc_client.h"
+#include "common/rdc_utils.h"
 
 namespace amd {
 namespace rdc {
 
+#ifdef USE_PINNED_CERTS
+// Pinned certificates
+static const char *kDefaultRDCServerCertPinPath =
+                                             "/etc/rdc/server/rdc_server.crt";
+static const char *kDefaultRDCClientKeyPinPath =
+                                     "/etc/rdc/client/private/rdc_client.key";
+static const char *kDefaultRDCClientCertPinPath =
+                                             "/etc/rdc/client/rdc_client.crt";
+#endif  // USE_PINNED_CERTS
+
+// PKI certificates
+static const char * kDefaultRDCClientCertKeyPkiPath =
+                                "/etc/rdc/client/private/rdc_client_cert.key";
+static const char * kDefaultRDCClientCertPemPkiPath =
+                                  "/etc/rdc/client/certs/rdc_client_cert.pem";
+static const char * kDefaultRDCClientCACertPemPkiPath =
+                                       "/etc/rdc/client/certs/rdc_cacert.pem";
+
 RDCChannel::RDCChannel(std::string server_ip, std::string server_port,
             bool secure) : server_ip_(server_ip), server_port_(server_port),
                                                     secure_channel_(secure) {}
@@ -40,17 +59,111 @@ RDCChannel::RDCChannel(std::string server_ip, std::string server_port,
 RDCChannel::~RDCChannel() {
 }
 
+#ifdef USE_PINNED_CERTS
+static int ConstructSSLOptsPin(grpc::SslCredentialsOptions *ssl_opts) {
+  assert(ssl_opts != nullptr);
+  if (ssl_opts == nullptr) {
+    return -EINVAL;
+  }
+
+  // Ensure the required paths exists before going forward
+  // TODO(cfreehil): override these defaults with values read from config
+  // file
+  if (!amd::rdc::FileExists(kDefaultRDCClientKeyPinPath) ||
+      !amd::rdc::FileExists(kDefaultRDCServerCertPinPath) ||
+      !amd::rdc::FileExists(kDefaultRDCClientCertPinPath)) {
+    return -ENOENT;
+  }
+
+  std::string cli_key;
+  std::string ser_crt;
+  std::string cli_crt;
+  int ret;
+  ret = amd::rdc::ReadFile(kDefaultRDCClientKeyPinPath, &cli_key);
+  if (ret) {
+    return ret;
+  }
+  ret = amd::rdc::ReadFile(kDefaultRDCServerCertPinPath, &ser_crt);
+  if (ret) {
+    return ret;
+  }
+  ret = amd::rdc::ReadFile(kDefaultRDCClientCertPinPath, &cli_crt);
+  if (ret) {
+    return ret;
+  }
+
+  ssl_opts->pem_root_certs = ser_crt;
+  ssl_opts->pem_private_key = cli_key;
+  ssl_opts->pem_cert_chain = cli_crt;
+
+  return 0;
+}
+#endif  // USE_PINNED_CERTS
+
+static int ConstructSSLOptsPKI(grpc::SslCredentialsOptions *ssl_opts) {
+  assert(ssl_opts != nullptr);
+  if (ssl_opts == nullptr) {
+    return -EINVAL;
+  }
+
+  // Ensure the required paths exists before going forward
+  // TODO(cfreehil): override these defaults with values read from config
+  // file
+  if (!amd::rdc::FileExists(kDefaultRDCClientCertKeyPkiPath) ||
+      !amd::rdc::FileExists(kDefaultRDCClientCertPemPkiPath) ||
+      !amd::rdc::FileExists(kDefaultRDCClientCACertPemPkiPath)) {
+    return -ENOENT;
+  }
+
+  std::string pem_root_certs;
+  std::string pem_private_key;
+  std::string pem_cert_chain;
+  int ret;
+  ret = amd::rdc::ReadFile(kDefaultRDCClientCACertPemPkiPath, &pem_root_certs);
+  if (ret) {
+    return ret;
+  }
+  ret = amd::rdc::ReadFile(kDefaultRDCClientCertKeyPkiPath, &pem_private_key);
+  if (ret) {
+    return ret;
+  }
+  ret = amd::rdc::ReadFile(kDefaultRDCClientCertPemPkiPath, &pem_cert_chain);
+  if (ret) {
+    return ret;
+  }
+
+  ssl_opts->pem_root_certs = pem_root_certs;
+  ssl_opts->pem_private_key = pem_private_key;
+  ssl_opts->pem_cert_chain = pem_cert_chain;
+
+  return 0;
+}
+
 rdc_status_t
 RDCChannel::Initialize(void) {
   assert(!server_port_.empty());
   assert(!server_ip_.empty());
 
+  int ret;
   std::string addr_str = server_ip() + ":";
   addr_str += server_port();
 
   if (secure_channel_) {
-    // Not yet supported
-    return RDC_STATUS_GRPC_UNIMPLEMENTED;
+    grpc::SslCredentialsOptions ssl_opts;
+
+#ifdef USE_PINNED_CERTS
+    ret = ConstructSSLOptsPin(&ssl_opts);
+#else
+    ret = ConstructSSLOptsPKI(&ssl_opts);
+#endif
+    if (ret) {
+      std::cerr << "Failed to process OpenSSL keys and certificates." <<
+                                                                    std::endl;
+      return RDC_STATUS_CLIENT_ERR_SSL;
+    }
+
+    channel_creds_ = grpc::SslCredentials(ssl_opts);
+    channel_ = grpc::CreateChannel(addr_str, channel_creds_);
   } else {
     channel_ = ::grpc::CreateChannel(addr_str,
                                           grpc::InsecureChannelCredentials());

projects/rdc/client/src/rdc_client_utils.cc

@@ -0,0 +1,40 @@
+/*
+Copyright (c) 2020 - present Advanced Micro Devices, Inc. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+#include "rdc/rdc_client.h"
+#include "rdc.grpc.pb.h"  // NOLINT
+#include "rdc/rdc_client_utils.h"
+
+namespace amd {
+namespace rdc {
+
+rdc_status_t GrpcErrorToRdcError(grpc::StatusCode grpc_err) {
+  uint32_t grpc_err_int = static_cast<uint32_t>(grpc_err);
+  uint32_t rdc_grpc_base_int =
+              static_cast<uint32_t>(RDC_STATUS_GRPC_ERR_FIRST);
+  uint32_t rdc_err_int = grpc_err_int + rdc_grpc_base_int;
+
+  return static_cast<rdc_status_t>(rdc_err_int);
+}
+
+}  // namespace rdc
+}  // namespace amd