Skip to content

Commit c8d4ea9

Browse files
ravi-signalravi-signal
committed
Make GrpcAllowListInterceptor dynamically configurable
1 parent f17a393 commit c8d4ea9

6 files changed

Lines changed: 50 additions & 36 deletions

File tree

‎service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerConfiguration.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
import org.whispersystems.textsecuregcm.configuration.DirectoryV2Configuration;
3232
import org.whispersystems.textsecuregcm.configuration.DynamoDbClientFactory;
3333
import org.whispersystems.textsecuregcm.configuration.DynamoDbTables;
34-
import org.whispersystems.textsecuregcm.configuration.GrpcAllowListConfiguration;
34+
import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicGrpcAllowListConfiguration;
3535
import org.whispersystems.textsecuregcm.configuration.ExternalRequestFilterConfiguration;
3636
import org.whispersystems.textsecuregcm.configuration.FaultTolerantRedisClientFactory;
3737
import org.whispersystems.textsecuregcm.configuration.FaultTolerantRedisClusterFactory;
@@ -352,7 +352,7 @@ public class WhisperServerConfiguration extends Configuration {
352352
@NotNull
353353
@Valid
354354
@JsonProperty
355-
private GrpcAllowListConfiguration grpcAllowList = new GrpcAllowListConfiguration();
355+
private DynamicGrpcAllowListConfiguration grpcAllowList = new DynamicGrpcAllowListConfiguration();
356356

357357
@Valid
358358
@NotNull
@@ -595,7 +595,7 @@ public GrpcConfiguration getGrpc() {
595595
return grpc;
596596
}
597597

598-
public GrpcAllowListConfiguration getGrpcAllowList() {
598+
public DynamicGrpcAllowListConfiguration getGrpcAllowList() {
599599
return grpcAllowList;
600600
}
601601

‎service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -882,8 +882,7 @@ public void run(WhisperServerConfiguration config, Environment environment) thro
882882

883883
final ErrorMappingInterceptor errorMappingInterceptor = new ErrorMappingInterceptor();
884884
final ErrorConformanceInterceptor errorConformanceInterceptor = new ErrorConformanceInterceptor();
885-
final GrpcAllowListInterceptor grpcAllowListInterceptor =
886-
new GrpcAllowListInterceptor(config.getGrpcAllowList().enableAll(), config.getGrpcAllowList().enabledServices(), config.getGrpcAllowList().enabledMethods());
885+
final GrpcAllowListInterceptor grpcAllowListInterceptor = new GrpcAllowListInterceptor(dynamicConfigurationManager);
887886
final RequestAttributesInterceptor requestAttributesInterceptor = new RequestAttributesInterceptor();
888887

889888
final ValidatingInterceptor validatingInterceptor = new ValidatingInterceptor();

‎service/src/main/java/org/whispersystems/textsecuregcm/configuration/dynamic/DynamicConfiguration.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,10 @@ public class DynamicConfiguration {
7272
@Valid
7373
private DynamicCarrierDataLookupConfiguration carrierDataLookup = new DynamicCarrierDataLookupConfiguration();
7474

75+
@JsonProperty
76+
@Valid
77+
private DynamicGrpcAllowListConfiguration grpcAllowList = new DynamicGrpcAllowListConfiguration();
78+
7579
public Optional<DynamicExperimentEnrollmentConfiguration> getExperimentEnrollmentConfiguration(
7680
final String experimentName) {
7781
return Optional.ofNullable(experiments.get(experimentName));
@@ -129,4 +133,8 @@ public DynamicBackupConfiguration getBackupConfiguration() {
129133
public DynamicCarrierDataLookupConfiguration getCarrierDataLookupConfiguration() {
130134
return carrierDataLookup;
131135
}
136+
137+
public DynamicGrpcAllowListConfiguration getGrpcAllowList() {
138+
return grpcAllowList;
139+
}
132140
}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/GrpcAllowListConfiguration.java renamed to service/src/main/java/org/whispersystems/textsecuregcm/configuration/dynamic/DynamicGrpcAllowListConfiguration.java

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@
22
* Copyright 2026 Signal Messenger, LLC
33
* SPDX-License-Identifier: AGPL-3.0-only
44
*/
5-
package org.whispersystems.textsecuregcm.configuration;
5+
package org.whispersystems.textsecuregcm.configuration.dynamic;
66

77
import java.util.Collections;
88
import java.util.List;
9+
import java.util.Set;
910

1011
/// Configure which gRPC methods are enabled
1112
///
@@ -16,22 +17,22 @@
1617
/// @param enabledMethods A list of fully qualified method names of RPCs that should be enabled. For example,
1718
/// `org.signal.chat.account.AccountsAnonymous/LookupUsernameHash` would enable the
1819
/// `LookupUsernameHash` RPC method
19-
public record GrpcAllowListConfiguration(
20+
public record DynamicGrpcAllowListConfiguration(
2021
boolean enableAll,
21-
List<String> enabledServices,
22-
List<String> enabledMethods) {
22+
Set<String> enabledServices,
23+
Set<String> enabledMethods) {
2324

24-
public GrpcAllowListConfiguration {
25+
public DynamicGrpcAllowListConfiguration {
2526
if (enabledServices == null) {
26-
enabledServices = Collections.emptyList();
27+
enabledServices = Collections.emptySet();
2728
}
2829
if (enabledMethods == null) {
29-
enabledMethods = Collections.emptyList();
30+
enabledMethods = Collections.emptySet();
3031
}
3132
}
3233

33-
public GrpcAllowListConfiguration() {
34+
public DynamicGrpcAllowListConfiguration() {
3435
// By default, no GRPC methods are accessible
35-
this(false, Collections.emptyList(), Collections.emptyList());
36+
this(false, Collections.emptySet(), Collections.emptySet());
3637
}
3738
}

‎service/src/main/java/org/whispersystems/textsecuregcm/grpc/GrpcAllowListInterceptor.java‎

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -10,31 +10,28 @@
1010
import io.grpc.ServerCallHandler;
1111
import io.grpc.ServerInterceptor;
1212
import io.grpc.Status;
13-
import java.util.HashSet;
14-
import java.util.List;
15-
import java.util.Set;
13+
import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicGrpcAllowListConfiguration;
14+
import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicConfiguration;
15+
import org.whispersystems.textsecuregcm.storage.DynamicConfigurationManager;
1616

1717
public class GrpcAllowListInterceptor implements ServerInterceptor {
1818

19-
private final boolean enableAll;
20-
private final Set<String> enabledServices;
21-
private final Set<String> enabledMethods;
19+
private final DynamicConfigurationManager<DynamicConfiguration> dynamicConfigurationManager;
2220

2321

2422
public GrpcAllowListInterceptor(
25-
final boolean enableAll,
26-
final List<String> enabledServices,
27-
final List<String> enabledMethods) {
28-
this.enableAll = enableAll;
29-
this.enabledServices = new HashSet<>(enabledServices);
30-
this.enabledMethods = new HashSet<>(enabledMethods);
23+
final DynamicConfigurationManager<DynamicConfiguration> dynamicConfigurationManager) {
24+
this.dynamicConfigurationManager = dynamicConfigurationManager;
3125
}
3226

3327
@Override
3428
public <ReqT, RespT> ServerCall.Listener<ReqT> interceptCall(final ServerCall<ReqT, RespT> serverCall,
3529
final Metadata metadata, final ServerCallHandler<ReqT, RespT> next) {
30+
final DynamicGrpcAllowListConfiguration allowList = this.dynamicConfigurationManager.getConfiguration().getGrpcAllowList();
3631
final MethodDescriptor<ReqT, RespT> methodDescriptor = serverCall.getMethodDescriptor();
37-
if (!enableAll && !enabledServices.contains(methodDescriptor.getServiceName()) && !enabledMethods.contains(methodDescriptor.getFullMethodName())) {
32+
if (!allowList.enableAll() &&
33+
!allowList.enabledServices().contains(methodDescriptor.getServiceName()) &&
34+
!allowList.enabledMethods().contains(methodDescriptor.getFullMethodName())) {
3835
return ServerInterceptorUtil.closeWithStatus(serverCall, Status.UNIMPLEMENTED);
3936
}
4037
return next.startCall(serverCall, metadata);

‎service/src/test/java/org/whispersystems/textsecuregcm/grpc/GrpcAllowListInterceptorTest.java‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
package org.whispersystems.textsecuregcm.grpc;
66

77
import static org.assertj.core.api.Assertions.assertThat;
8+
import static org.mockito.Mockito.mock;
9+
import static org.mockito.Mockito.when;
810

911
import com.google.protobuf.ByteString;
1012
import io.grpc.ManagedChannel;
@@ -14,14 +16,18 @@
1416
import io.grpc.inprocess.InProcessServerBuilder;
1517
import java.io.IOException;
1618
import java.util.Collections;
17-
import java.util.List;
19+
import java.util.Set;
1820
import java.util.concurrent.TimeUnit;
1921
import org.junit.jupiter.api.AfterEach;
2022
import org.junit.jupiter.api.BeforeEach;
2123
import org.junit.jupiter.api.Test;
2224
import org.signal.chat.rpc.EchoRequest;
2325
import org.signal.chat.rpc.EchoResponse;
2426
import org.signal.chat.rpc.EchoServiceGrpc;
27+
import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicConfiguration;
28+
import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicGrpcAllowListConfiguration;
29+
import org.whispersystems.textsecuregcm.tests.util.FakeDynamicConfigurationManager;
30+
2531

2632
class GrpcAllowListInterceptorTest {
2733
private Server server;
@@ -45,23 +51,23 @@ void tearDown() throws Exception {
4551
@Test
4652
public void disableAll() throws Exception {
4753
final EchoServiceGrpc.EchoServiceBlockingStub client =
48-
setup(false, Collections.emptyList(), Collections.emptyList());
54+
setup(false, Collections.emptySet(), Collections.emptySet());
4955
GrpcTestUtils.assertStatusException(Status.UNIMPLEMENTED, () ->
5056
client.echo(EchoRequest.newBuilder().setPayload(ByteString.empty()).build()));
5157
}
5258

5359
@Test
5460
public void enableAll() throws Exception {
5561
final EchoServiceGrpc.EchoServiceBlockingStub client =
56-
setup(true, Collections.emptyList(), Collections.emptyList());
62+
setup(true, Collections.emptySet(), Collections.emptySet());
5763
final EchoResponse echo = client.echo(EchoRequest.newBuilder().setPayload(ByteString.empty()).build());
5864
assertThat(echo.getPayload()).isEqualTo(ByteString.empty());
5965
}
6066

6167
@Test
6268
public void enableByMethod() throws Exception {
6369
final EchoServiceGrpc.EchoServiceBlockingStub client =
64-
setup(false, Collections.emptyList(), List.of("org.signal.chat.rpc.EchoService/echo"));
70+
setup(false, Collections.emptySet(), Set.of("org.signal.chat.rpc.EchoService/echo"));
6571

6672
final EchoResponse echo = client.echo(EchoRequest.newBuilder().setPayload(ByteString.empty()).build());
6773
assertThat(echo.getPayload()).isEqualTo(ByteString.empty());
@@ -73,7 +79,7 @@ public void enableByMethod() throws Exception {
7379
@Test
7480
public void enableByService() throws Exception {
7581
final EchoServiceGrpc.EchoServiceBlockingStub client =
76-
setup(false, List.of("org.signal.chat.rpc.EchoService"), Collections.emptyList());
82+
setup(false, Set.of("org.signal.chat.rpc.EchoService"), Collections.emptySet());
7783

7884
final EchoResponse echo = client.echo(EchoRequest.newBuilder().setPayload(ByteString.empty()).build());
7985
assertThat(echo.getPayload()).isEqualTo(ByteString.empty());
@@ -85,24 +91,27 @@ public void enableByService() throws Exception {
8591
@Test
8692
public void enableByServiceWrongService() throws Exception {
8793
final EchoServiceGrpc.EchoServiceBlockingStub client =
88-
setup(false, List.of("org.signal.chat.rpc.NotEchoService"), Collections.emptyList());
94+
setup(false, Set.of("org.signal.chat.rpc.NotEchoService"), Collections.emptySet());
8995

9096
GrpcTestUtils.assertStatusException(Status.UNIMPLEMENTED, () ->
9197
client.echo(EchoRequest.newBuilder().setPayload(ByteString.empty()).build()));
9298
}
9399

94100
private EchoServiceGrpc.EchoServiceBlockingStub setup(
95101
boolean enableAll,
96-
List<String> enabledServices,
97-
List<String> enabledMethods)
102+
Set<String> enabledServices,
103+
Set<String> enabledMethods)
98104
throws IOException {
99105
if (server != null) {
100106
server.shutdownNow();
101107
}
108+
final DynamicConfiguration configuration = mock(DynamicConfiguration.class);
109+
when(configuration.getGrpcAllowList())
110+
.thenReturn(new DynamicGrpcAllowListConfiguration(enableAll, enabledServices, enabledMethods));
102111
server = InProcessServerBuilder.forName("GrpcAllowListInterceptorTest")
103112
.directExecutor()
104113
.addService(new EchoServiceImpl())
105-
.intercept(new GrpcAllowListInterceptor(enableAll, enabledServices, enabledMethods))
114+
.intercept(new GrpcAllowListInterceptor(new FakeDynamicConfigurationManager<>(configuration)))
106115
.build()
107116
.start();
108117

0 commit comments

Comments
 (0)