Plumb peer cert through to ThriftConnContext

Summary: Snapshot the peer certificate and negotiated protocol into `PeerSecurityInfo` when the fizz handshake completes and carry it to `ThriftConnContext`, so it survives a StopTLS downgrade that leaves the transport unable to report either.

Reviewed By: robertroeser

Differential Revision: D116839723

fbshipit-source-id: 0b99cd44589187990d20ceb91cd3c41f0d299d0d

Author: Ankit Kumar

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/bench/tcp/TcpServer.cpp

@@ -141,7 +141,9 @@ class TcpConnectionFactory {
 
   TcpConnection getConnection(
       folly::AsyncTransport::UniquePtr socket,
-      const folly::SocketAddress& /*clientAddr*/) {
+      const folly::SocketAddress& /*clientAddr*/,
+      const std::shared_ptr<const connection::PeerSecurityInfo>&
+      /*peerSecurity*/) {
     return build_(std::move(socket));
   }
 

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/connection/ConnectionFactory.h

@@ -17,11 +17,13 @@
 #pragma once
 
 #include <functional>
+#include <memory>
 #include <type_traits>
 #include <utility>
 
 #include <folly/SocketAddress.h>
 #include <folly/io/async/AsyncTransport.h>
+#include <thrift/lib/cpp2/fast_thrift/connection/common/Messages.h>
 
 namespace apache::thrift::fast_thrift::connection {
 
@@ -52,25 +54,30 @@ concept Connection = requires(C& c, std::function<void()> cb) {
 };
 
 /**
- * ConnectionFactory — anything that, given a ready transport and the peer
- * address observed when the socket was accepted, produces a Connection. The
- * returned type is up to the factory; the connection layer doesn't care, as
- * long as it satisfies the Connection concept.
+ * ConnectionFactory — anything that, given a ready transport plus what was
+ * observed about the peer when the socket was accepted and secured, produces a
+ * Connection. The returned type is up to the factory; the connection layer
+ * doesn't care, as long as it satisfies the Connection concept.
  *
- * clientAddr is passed rather than re-derived from the transport: the
- * transport can no longer report a peer once that peer has gone away.
+ * clientAddr and peerSecurity are passed rather than re-derived from the
+ * transport because the transport can no longer report either: the peer
+ * address is gone once the peer is, and a StopTLS downgrade replaces the
+ * secured transport with a plaintext one. peerSecurity is null on a connection
+ * that negotiated no security.
  */
 template <typename F>
 concept ConnectionFactory =
     requires(
         F& f,
         folly::AsyncTransport::UniquePtr socket,
-        const folly::SocketAddress& clientAddr) {
-      { f.getConnection(std::move(socket), clientAddr) };
+        const folly::SocketAddress& clientAddr,
+        const std::shared_ptr<const PeerSecurityInfo>& peerSecurity) {
+      { f.getConnection(std::move(socket), clientAddr, peerSecurity) };
     } &&
     Connection<std::decay_t<decltype(std::declval<F&>().getConnection(
         std::declval<folly::AsyncTransport::UniquePtr>(),
-        std::declval<const folly::SocketAddress&>()))>>;
+        std::declval<const folly::SocketAddress&>(),
+        std::declval<const std::shared_ptr<const PeerSecurityInfo>&>()))>>;
 
 /**
  * The connection type produced by a given factory.
@@ -79,6 +86,7 @@ template <ConnectionFactory F>
 using FactoryConnectionType =
     std::decay_t<decltype(std::declval<F&>().getConnection(
         std::declval<folly::AsyncTransport::UniquePtr>(),
-        std::declval<const folly::SocketAddress&>()))>;
+        std::declval<const folly::SocketAddress&>(),
+        std::declval<const std::shared_ptr<const PeerSecurityInfo>&>()))>;
 
 } // namespace apache::thrift::fast_thrift::connection

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/connection/common/Messages.h

@@ -16,11 +16,28 @@
 
 #pragma once
 
+#include <memory>
+#include <string>
+
 #include <folly/SocketAddress.h>
 #include <folly/io/async/AsyncTransport.h>
 
 namespace apache::thrift::fast_thrift::connection {
 
+// What the peer proved about itself during the security handshake.
+//
+// Captured once, when it is negotiated, and carried alongside the transport
+// rather than re-read from it later: a StopTLS downgrade replaces the
+// transport with a plaintext one that can report neither. Null on a connection
+// that negotiated no security.
+//
+// Held behind a shared_ptr so the messages carrying it stay inside the
+// pipeline's inline-message budget; the allocation is once per handshake.
+struct PeerSecurityInfo {
+  std::shared_ptr<const folly::AsyncTransportCertificate> peerCertificate;
+  std::string securityProtocol;
+};
+
 // Single message type that flows through the acceptance pipeline. Each
 // accepted socket enters the pipeline as one ConnectionMessage at the head;
 // each handler may upgrade the transport in-place (e.g. plain AsyncSocket →
@@ -30,6 +47,7 @@ namespace apache::thrift::fast_thrift::connection {
 struct ConnectionMessage {
   folly::AsyncTransport::UniquePtr transport;
   folly::SocketAddress clientAddr;
+  std::shared_ptr<const PeerSecurityInfo> peerSecurity;
 };
 
 } // namespace apache::thrift::fast_thrift::connection

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/connection/endpoint/ConnectionListener.h

@@ -137,6 +137,7 @@ class ConnectionListener : public folly::DelayedDestruction,
     ConnectionMessage msg{
         .transport = std::move(transport),
         .clientAddr = clientAddr,
+        .peerSecurity = nullptr,
     };
     auto result =
         pipeline_->fireRead(channel_pipeline::erase_and_box(std::move(msg)));

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/connection/handler/ConnectionBuilderHandler.h

@@ -55,8 +55,8 @@ class ConnectionBuilderHandler {
   channel_pipeline::Result onRead(
       Context& ctx, channel_pipeline::TypeErasedBox&& msg) noexcept {
     auto ready = msg.take<ConnectionMessage>();
-    auto conn =
-        factory_.getConnection(std::move(ready.transport), ready.clientAddr);
+    auto conn = factory_.getConnection(
+        std::move(ready.transport), ready.clientAddr, ready.peerSecurity);
     return ctx.fireRead(channel_pipeline::erase_and_box(std::move(conn)));
   }
 

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/connection/handler/ConnectionTLSHandler.h

@@ -146,9 +146,12 @@ class ConnectionTLSHandler {
         this,
         [](void* self,
            folly::AsyncTransport::UniquePtr transport,
-           folly::SocketAddress clientAddr) noexcept {
+           folly::SocketAddress clientAddr,
+           std::shared_ptr<const PeerSecurityInfo> peerSecurity) noexcept {
           return static_cast<ConnectionTLSHandler*>(self)->onResolved(
-              std::move(transport), std::move(clientAddr));
+              std::move(transport),
+              std::move(clientAddr),
+              std::move(peerSecurity));
         },
         [](void* self, folly::exception_wrapper&& e) noexcept {
           static_cast<ConnectionTLSHandler*>(self)->onInnerException(
@@ -181,6 +184,7 @@ class ConnectionTLSHandler {
         .clientAddr = std::move(incoming.clientAddr),
         .tlsParams = nullptr,
         .extension = nullptr,
+        .peerSecurity = nullptr,
     };
     return tail_.submit(std::move(request));
   }
@@ -217,13 +221,15 @@ class ConnectionTLSHandler {
   // here and is fired onto the outer pipeline as a ConnectionMessage.
   channel_pipeline::Result onResolved(
       folly::AsyncTransport::UniquePtr transport,
-      folly::SocketAddress clientAddr) noexcept {
+      folly::SocketAddress clientAddr,
+      std::shared_ptr<const PeerSecurityInfo> peerSecurity) noexcept {
     if (FOLLY_UNLIKELY(!outerCtx_)) {
       return channel_pipeline::Result::Success;
     }
     ConnectionMessage out{
         .transport = std::move(transport),
         .clientAddr = std::move(clientAddr),
+        .peerSecurity = std::move(peerSecurity),
     };
     return outerCtx_->fireRead(channel_pipeline::erase_and_box(std::move(out)));
   }

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/connection/security/bench/TLSPipelineBench.cpp

@@ -214,6 +214,7 @@ struct Harness {
       conn::ConnectionMessage msg{
           .transport = folly::AsyncTransport::UniquePtr(serverSock.release()),
           .clientAddr = folly::SocketAddress{"127.0.0.1", 0},
+          .peerSecurity = nullptr,
       };
       (void)pipeline->fireRead(channel_pipeline::erase_and_box(std::move(msg)));
 

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/connection/security/common/Messages.h

@@ -20,6 +20,7 @@
 
 #include <folly/SocketAddress.h>
 #include <folly/io/async/AsyncTransport.h>
+#include <thrift/lib/cpp2/fast_thrift/connection/common/Messages.h>
 #include <thrift/lib/cpp2/fast_thrift/security/FizzServerContextBuilder.h>
 #include <thrift/lib/cpp2/security/extensions/ThriftParametersServerExtension.h>
 
@@ -41,21 +42,28 @@ namespace apache::thrift::fast_thrift::connection::security {
 //
 // `extension` is null until the fizz handshake completes, then read by
 // StopTLSV1Handler to decide whether to downgrade.
+//
+// `peerSecurity` is null until the handshake completes, and every stage after
+// it must carry it forward: it is the only surviving record of what the peer
+// proved once StopTLS has swapped the fizz transport for a plaintext one.
 struct TLSRequestMessage {
   folly::AsyncTransport::UniquePtr transport;
   folly::SocketAddress clientAddr;
   std::shared_ptr<const apache::thrift::fast_thrift::security::TLSParams>
       tlsParams;
   std::shared_ptr<apache::thrift::ThriftParametersServerExtension> extension;
+  std::shared_ptr<const PeerSecurityInfo> peerSecurity;
 };
 
 // Inbound (read/return path). TLSFinalizer collapses a resolved
 // TLSRequestMessage down to this at the head; the stages pass it through
 // untouched to the tail adapter, which hands the resolved transport off.
-// Carries only what handoff needs — no negotiation state.
+// Carries only what handoff needs — the negotiated peer identity, but no
+// negotiation state.
 struct TLSResponseMessage {
   folly::AsyncTransport::UniquePtr transport;
   folly::SocketAddress clientAddr;
+  std::shared_ptr<const PeerSecurityInfo> peerSecurity;
 };
 
 } // namespace apache::thrift::fast_thrift::connection::security

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/connection/security/handler/FizzHandshakeHandler.h

@@ -194,11 +194,18 @@ class FizzHandshakeHandler {
     if (FOLLY_UNLIKELY(!ctx_)) {
       return;
     }
+    // Snapshot what the peer proved while the fizz session is still the
+    // transport: a StopTLS downgrade downstream leaves nothing to read it from.
+    auto peerSecurity =
+        std::make_shared<const PeerSecurityInfo>(PeerSecurityInfo{
+            .peerCertificate = fizzServer->getState().clientCert(),
+            .securityProtocol = fizzServer->getSecurityProtocol()});
     TLSRequestMessage upgraded{
         .transport = folly::AsyncTransport::UniquePtr(fizzServer.release()),
         .clientAddr = clientAddr,
         .tlsParams = std::move(tlsParams),
         .extension = std::move(extension),
+        .peerSecurity = std::move(peerSecurity),
     };
     auto result =
         ctx_->fireWrite(channel_pipeline::erase_and_box(std::move(upgraded)));

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/connection/security/handler/StopTLSV1Handler.h

@@ -122,15 +122,19 @@ class StopTLSV1Handler {
     auto stopTLSTimeout = incoming.tlsParams
         ? incoming.tlsParams->handshakeTimeout
         : std::nullopt;
+    // The downgrade hands back a plaintext transport that can no longer report
+    // the peer, so the handshake's record of it has to ride the callback.
+    auto peerSecurity = std::move(incoming.peerSecurity);
 
     util::StopTLSHelper::UniquePtr helper(new util::StopTLSHelper(
         std::move(fizzServer),
         stopTLSTimeout,
         [this](util::StopTLSHelper* h) noexcept { inFlight_.erase(h); },
-        [this, clientAddr, extension](
+        [this, clientAddr, extension, peerSecurity](
             folly::AsyncTransport::UniquePtr plaintext,
             const folly::exception_wrapper& ex) noexcept {
-          onStopTLSComplete(std::move(plaintext), ex, clientAddr, extension);
+          onStopTLSComplete(
+              std::move(plaintext), ex, clientAddr, extension, peerSecurity);
         }));
     auto* raw = helper.get();
     inFlight_.emplace(raw, std::move(helper));
@@ -177,7 +181,8 @@ class StopTLSV1Handler {
       const folly::exception_wrapper& ex,
       const folly::SocketAddress& clientAddr,
       std::shared_ptr<apache::thrift::ThriftParametersServerExtension>
-          extension) noexcept {
+          extension,
+      std::shared_ptr<const PeerSecurityInfo> peerSecurity) noexcept {
     if (ex || !plaintext) {
       XLOG(DBG3) << "StopTLS V1 failed for " << clientAddr.describe() << ": "
                  << (ex ? ex.what().toStdString() : std::string("null"));
@@ -191,6 +196,7 @@ class StopTLSV1Handler {
         .clientAddr = clientAddr,
         .tlsParams = nullptr,
         .extension = std::move(extension),
+        .peerSecurity = std::move(peerSecurity),
     };
     auto result =
         ctx_->fireWrite(channel_pipeline::erase_and_box(std::move(downgraded)));