grpc 1.18.0 → 1.22.0

data/src/core/lib/security/credentials/ssl/ssl_credentials.cc

@@ -46,7 +46,7 @@ void grpc_tsi_ssl_pem_key_cert_pairs_destroy(tsi_ssl_pem_key_cert_pair* kp,
 
 grpc_ssl_credentials::grpc_ssl_credentials(
     const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
-    const verify_peer_options* verify_options)
+    const grpc_ssl_verify_peer_options* verify_options)
     : grpc_channel_credentials(GRPC_CHANNEL_CREDENTIALS_TYPE_SSL) {
   build_config(pem_root_certs, pem_key_cert_pair, verify_options);
 }
@@ -94,7 +94,7 @@ grpc_ssl_credentials::create_security_connector(
 
 void grpc_ssl_credentials::build_config(
     const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
-    const verify_peer_options* verify_options) {
+    const grpc_ssl_verify_peer_options* verify_options) {
   config_.pem_root_certs = gpr_strdup(pem_root_certs);
   if (pem_key_cert_pair != nullptr) {
     GPR_ASSERT(pem_key_cert_pair->private_key != nullptr);
@@ -117,6 +117,8 @@ void grpc_ssl_credentials::build_config(
   }
 }
 
+/* Deprecated in favor of grpc_ssl_credentials_create_ex. Will be removed
+ * once all of its call sites are migrated to grpc_ssl_credentials_create_ex. */
 grpc_channel_credentials* grpc_ssl_credentials_create(
     const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
     const verify_peer_options* verify_options, void* reserved) {
@@ -128,6 +130,22 @@ grpc_channel_credentials* grpc_ssl_credentials_create(
       4, (pem_root_certs, pem_key_cert_pair, verify_options, reserved));
   GPR_ASSERT(reserved == nullptr);
 
+  return grpc_core::New<grpc_ssl_credentials>(
+      pem_root_certs, pem_key_cert_pair,
+      reinterpret_cast<const grpc_ssl_verify_peer_options*>(verify_options));
+}
+
+grpc_channel_credentials* grpc_ssl_credentials_create_ex(
+    const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
+    const grpc_ssl_verify_peer_options* verify_options, void* reserved) {
+  GRPC_API_TRACE(
+      "grpc_ssl_credentials_create(pem_root_certs=%s, "
+      "pem_key_cert_pair=%p, "
+      "verify_options=%p, "
+      "reserved=%p)",
+      4, (pem_root_certs, pem_key_cert_pair, verify_options, reserved));
+  GPR_ASSERT(reserved == nullptr);
+
   return grpc_core::New<grpc_ssl_credentials>(pem_root_certs, pem_key_cert_pair,
                                               verify_options);
 }

data/src/core/lib/security/credentials/ssl/ssl_credentials.h

@@ -28,7 +28,7 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
  public:
   grpc_ssl_credentials(const char* pem_root_certs,
                        grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
-                       const verify_peer_options* verify_options);
+                       const grpc_ssl_verify_peer_options* verify_options);
 
   ~grpc_ssl_credentials() override;
 
@@ -41,7 +41,7 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
  private:
   void build_config(const char* pem_root_certs,
                     grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
-                    const verify_peer_options* verify_options);
+                    const grpc_ssl_verify_peer_options* verify_options);
 
   grpc_ssl_config config_;
 };

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc

@@ -0,0 +1,192 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
+/** -- gRPC TLS key materials config API implementation. -- **/
+void grpc_tls_key_materials_config::set_key_materials(
+    grpc_core::UniquePtr<char> pem_root_certs,
+    PemKeyCertPairList pem_key_cert_pair_list) {
+  pem_key_cert_pair_list_ = std::move(pem_key_cert_pair_list);
+  pem_root_certs_ = std::move(pem_root_certs);
+}
+
+/** -- gRPC TLS credential reload config API implementation. -- **/
+grpc_tls_credential_reload_config::grpc_tls_credential_reload_config(
+    const void* config_user_data,
+    int (*schedule)(void* config_user_data,
+                    grpc_tls_credential_reload_arg* arg),
+    void (*cancel)(void* config_user_data, grpc_tls_credential_reload_arg* arg),
+    void (*destruct)(void* config_user_data))
+    : config_user_data_(const_cast<void*>(config_user_data)),
+      schedule_(schedule),
+      cancel_(cancel),
+      destruct_(destruct) {}
+
+grpc_tls_credential_reload_config::~grpc_tls_credential_reload_config() {
+  if (destruct_ != nullptr) {
+    destruct_((void*)config_user_data_);
+  }
+}
+
+/** -- gRPC TLS server authorization check API implementation. -- **/
+grpc_tls_server_authorization_check_config::
+    grpc_tls_server_authorization_check_config(
+        const void* config_user_data,
+        int (*schedule)(void* config_user_data,
+                        grpc_tls_server_authorization_check_arg* arg),
+        void (*cancel)(void* config_user_data,
+                       grpc_tls_server_authorization_check_arg* arg),
+        void (*destruct)(void* config_user_data))
+    : config_user_data_(const_cast<void*>(config_user_data)),
+      schedule_(schedule),
+      cancel_(cancel),
+      destruct_(destruct) {}
+
+grpc_tls_server_authorization_check_config::
+    ~grpc_tls_server_authorization_check_config() {
+  if (destruct_ != nullptr) {
+    destruct_((void*)config_user_data_);
+  }
+}
+
+/** -- Wrapper APIs declared in grpc_security.h -- **/
+grpc_tls_credentials_options* grpc_tls_credentials_options_create() {
+  return grpc_core::New<grpc_tls_credentials_options>();
+}
+
+int grpc_tls_credentials_options_set_cert_request_type(
+    grpc_tls_credentials_options* options,
+    grpc_ssl_client_certificate_request_type type) {
+  if (options == nullptr) {
+    gpr_log(GPR_ERROR,
+            "Invalid nullptr arguments to "
+            "grpc_tls_credentials_options_set_cert_request_type()");
+    return 0;
+  }
+  options->set_cert_request_type(type);
+  return 1;
+}
+
+int grpc_tls_credentials_options_set_key_materials_config(
+    grpc_tls_credentials_options* options,
+    grpc_tls_key_materials_config* config) {
+  if (options == nullptr || config == nullptr) {
+    gpr_log(GPR_ERROR,
+            "Invalid nullptr arguments to "
+            "grpc_tls_credentials_options_set_key_materials_config()");
+    return 0;
+  }
+  options->set_key_materials_config(config->Ref());
+  return 1;
+}
+
+int grpc_tls_credentials_options_set_credential_reload_config(
+    grpc_tls_credentials_options* options,
+    grpc_tls_credential_reload_config* config) {
+  if (options == nullptr || config == nullptr) {
+    gpr_log(GPR_ERROR,
+            "Invalid nullptr arguments to "
+            "grpc_tls_credentials_options_set_credential_reload_config()");
+    return 0;
+  }
+  options->set_credential_reload_config(config->Ref());
+  return 1;
+}
+
+int grpc_tls_credentials_options_set_server_authorization_check_config(
+    grpc_tls_credentials_options* options,
+    grpc_tls_server_authorization_check_config* config) {
+  if (options == nullptr || config == nullptr) {
+    gpr_log(
+        GPR_ERROR,
+        "Invalid nullptr arguments to "
+        "grpc_tls_credentials_options_set_server_authorization_check_config()");
+    return 0;
+  }
+  options->set_server_authorization_check_config(config->Ref());
+  return 1;
+}
+
+grpc_tls_key_materials_config* grpc_tls_key_materials_config_create() {
+  return grpc_core::New<grpc_tls_key_materials_config>();
+}
+
+int grpc_tls_key_materials_config_set_key_materials(
+    grpc_tls_key_materials_config* config, const char* root_certs,
+    const grpc_ssl_pem_key_cert_pair** key_cert_pairs, size_t num) {
+  if (config == nullptr || key_cert_pairs == nullptr || num == 0) {
+    gpr_log(GPR_ERROR,
+            "Invalid arguments to "
+            "grpc_tls_key_materials_config_set_key_materials()");
+    return 0;
+  }
+  grpc_core::UniquePtr<char> pem_root(const_cast<char*>(root_certs));
+  grpc_tls_key_materials_config::PemKeyCertPairList cert_pair_list;
+  for (size_t i = 0; i < num; i++) {
+    grpc_core::PemKeyCertPair key_cert_pair(
+        const_cast<grpc_ssl_pem_key_cert_pair*>(key_cert_pairs[i]));
+    cert_pair_list.emplace_back(std::move(key_cert_pair));
+  }
+  config->set_key_materials(std::move(pem_root), std::move(cert_pair_list));
+  gpr_free(key_cert_pairs);
+  return 1;
+}
+
+grpc_tls_credential_reload_config* grpc_tls_credential_reload_config_create(
+    const void* config_user_data,
+    int (*schedule)(void* config_user_data,
+                    grpc_tls_credential_reload_arg* arg),
+    void (*cancel)(void* config_user_data, grpc_tls_credential_reload_arg* arg),
+    void (*destruct)(void* config_user_data)) {
+  if (schedule == nullptr) {
+    gpr_log(
+        GPR_ERROR,
+        "Schedule API is nullptr in creating TLS credential reload config.");
+    return nullptr;
+  }
+  return grpc_core::New<grpc_tls_credential_reload_config>(
+      config_user_data, schedule, cancel, destruct);
+}
+
+grpc_tls_server_authorization_check_config*
+grpc_tls_server_authorization_check_config_create(
+    const void* config_user_data,
+    int (*schedule)(void* config_user_data,
+                    grpc_tls_server_authorization_check_arg* arg),
+    void (*cancel)(void* config_user_data,
+                   grpc_tls_server_authorization_check_arg* arg),
+    void (*destruct)(void* config_user_data)) {
+  if (schedule == nullptr) {
+    gpr_log(GPR_ERROR,
+            "Schedule API is nullptr in creating TLS server authorization "
+            "check config.");
+    return nullptr;
+  }
+  return grpc_core::New<grpc_tls_server_authorization_check_config>(
+      config_user_data, schedule, cancel, destruct);
+}

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -0,0 +1,210 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/gprpp/inlined_vector.h"
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/security/security_connector/ssl_utils.h"
+
+/** TLS key materials config. **/
+struct grpc_tls_key_materials_config
+    : public grpc_core::RefCounted<grpc_tls_key_materials_config> {
+ public:
+  typedef grpc_core::InlinedVector<grpc_core::PemKeyCertPair, 1>
+      PemKeyCertPairList;
+
+  /** Getters for member fields. **/
+  const char* pem_root_certs() const { return pem_root_certs_.get(); }
+  const PemKeyCertPairList& pem_key_cert_pair_list() const {
+    return pem_key_cert_pair_list_;
+  }
+
+  /** Setters for member fields. **/
+  void set_key_materials(grpc_core::UniquePtr<char> pem_root_certs,
+                         PemKeyCertPairList pem_key_cert_pair_list);
+
+ private:
+  PemKeyCertPairList pem_key_cert_pair_list_;
+  grpc_core::UniquePtr<char> pem_root_certs_;
+};
+
+/** TLS credential reload config. **/
+struct grpc_tls_credential_reload_config
+    : public grpc_core::RefCounted<grpc_tls_credential_reload_config> {
+ public:
+  grpc_tls_credential_reload_config(
+      const void* config_user_data,
+      int (*schedule)(void* config_user_data,
+                      grpc_tls_credential_reload_arg* arg),
+      void (*cancel)(void* config_user_data,
+                     grpc_tls_credential_reload_arg* arg),
+      void (*destruct)(void* config_user_data));
+  ~grpc_tls_credential_reload_config();
+
+  int Schedule(grpc_tls_credential_reload_arg* arg) const {
+    return schedule_(config_user_data_, arg);
+  }
+  void Cancel(grpc_tls_credential_reload_arg* arg) const {
+    if (cancel_ == nullptr) {
+      gpr_log(GPR_ERROR, "cancel API is nullptr.");
+      return;
+    }
+    cancel_(config_user_data_, arg);
+  }
+
+ private:
+  /** config-specific, read-only user data that works for all channels created
+     with a credential using the config. */
+  void* config_user_data_;
+  /** callback function for invoking credential reload API. The implementation
+     of this method has to be non-blocking, but can be performed synchronously
+     or asynchronously.
+     If processing occurs synchronously, it populates \a arg->key_materials, \a
+     arg->status, and \a arg->error_details and returns zero.
+     If processing occurs asynchronously, it returns a non-zero value.
+     Application then invokes \a arg->cb when processing is completed. Note that
+     \a arg->cb cannot be invoked before \a schedule returns.
+  */
+  int (*schedule_)(void* config_user_data, grpc_tls_credential_reload_arg* arg);
+  /** callback function for cancelling a credential reload request scheduled via
+     an asynchronous \a schedule. \a arg is used to pinpoint an exact reloading
+     request to be cancelled, and the operation may not have any effect if the
+     request has already been processed. */
+  void (*cancel_)(void* config_user_data, grpc_tls_credential_reload_arg* arg);
+  /** callback function for cleaning up any data associated with credential
+     reload config. */
+  void (*destruct_)(void* config_user_data);
+};
+
+/** TLS server authorization check config. **/
+struct grpc_tls_server_authorization_check_config
+    : public grpc_core::RefCounted<grpc_tls_server_authorization_check_config> {
+ public:
+  grpc_tls_server_authorization_check_config(
+      const void* config_user_data,
+      int (*schedule)(void* config_user_data,
+                      grpc_tls_server_authorization_check_arg* arg),
+      void (*cancel)(void* config_user_data,
+                     grpc_tls_server_authorization_check_arg* arg),
+      void (*destruct)(void* config_user_data));
+  ~grpc_tls_server_authorization_check_config();
+
+  int Schedule(grpc_tls_server_authorization_check_arg* arg) const {
+    return schedule_(config_user_data_, arg);
+  }
+  void Cancel(grpc_tls_server_authorization_check_arg* arg) const {
+    if (cancel_ == nullptr) {
+      gpr_log(GPR_ERROR, "cancel API is nullptr.");
+      return;
+    }
+    cancel_(config_user_data_, arg);
+  }
+
+ private:
+  /** config-specific, read-only user data that works for all channels created
+     with a Credential using the config. */
+  void* config_user_data_;
+
+  /** callback function for invoking server authorization check. The
+     implementation of this method has to be non-blocking, but can be performed
+     synchronously or asynchronously.
+     If processing occurs synchronously, it populates \a arg->result, \a
+     arg->status, and \a arg->error_details, and returns zero.
+     If processing occurs asynchronously, it returns a non-zero value.
+     Application then invokes \a arg->cb when processing is completed. Note that
+     \a arg->cb cannot be invoked before \a schedule() returns.
+  */
+  int (*schedule_)(void* config_user_data,
+                   grpc_tls_server_authorization_check_arg* arg);
+
+  /** callback function for canceling a server authorization check request. */
+  void (*cancel_)(void* config_user_data,
+                  grpc_tls_server_authorization_check_arg* arg);
+
+  /** callback function for cleaning up any data associated with server
+     authorization check config. */
+  void (*destruct_)(void* config_user_data);
+};
+
+/* TLS credentials options. */
+struct grpc_tls_credentials_options
+    : public grpc_core::RefCounted<grpc_tls_credentials_options> {
+ public:
+  ~grpc_tls_credentials_options() {
+    if (key_materials_config_.get() != nullptr) {
+      key_materials_config_.get()->Unref();
+    }
+    if (credential_reload_config_.get() != nullptr) {
+      credential_reload_config_.get()->Unref();
+    }
+    if (server_authorization_check_config_.get() != nullptr) {
+      server_authorization_check_config_.get()->Unref();
+    }
+  }
+
+  /* Getters for member fields. */
+  grpc_ssl_client_certificate_request_type cert_request_type() const {
+    return cert_request_type_;
+  }
+  grpc_tls_key_materials_config* key_materials_config() const {
+    return key_materials_config_.get();
+  }
+  grpc_tls_credential_reload_config* credential_reload_config() const {
+    return credential_reload_config_.get();
+  }
+  grpc_tls_server_authorization_check_config*
+  server_authorization_check_config() const {
+    return server_authorization_check_config_.get();
+  }
+
+  /* Setters for member fields. */
+  void set_cert_request_type(
+      const grpc_ssl_client_certificate_request_type type) {
+    cert_request_type_ = type;
+  }
+  void set_key_materials_config(
+      grpc_core::RefCountedPtr<grpc_tls_key_materials_config> config) {
+    key_materials_config_ = std::move(config);
+  }
+  void set_credential_reload_config(
+      grpc_core::RefCountedPtr<grpc_tls_credential_reload_config> config) {
+    credential_reload_config_ = std::move(config);
+  }
+  void set_server_authorization_check_config(
+      grpc_core::RefCountedPtr<grpc_tls_server_authorization_check_config>
+          config) {
+    server_authorization_check_config_ = std::move(config);
+  }
+
+ private:
+  grpc_ssl_client_certificate_request_type cert_request_type_;
+  grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
+  grpc_core::RefCountedPtr<grpc_tls_credential_reload_config>
+      credential_reload_config_;
+  grpc_core::RefCountedPtr<grpc_tls_server_authorization_check_config>
+      server_authorization_check_config_;
+};
+
+#endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H \
+        */

data/src/core/lib/security/credentials/tls/spiffe_credentials.cc

@@ -0,0 +1,129 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/tls/spiffe_credentials.h"
+
+#include <cstring>
+
+#include <grpc/grpc.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/security/security_connector/tls/spiffe_security_connector.h"
+
+#define GRPC_CREDENTIALS_TYPE_SPIFFE "Spiffe"
+
+namespace {
+
+bool CredentialOptionSanityCheck(const grpc_tls_credentials_options* options,
+                                 bool is_client) {
+  if (options == nullptr) {
+    gpr_log(GPR_ERROR, "SPIFFE TLS credentials options is nullptr.");
+    return false;
+  }
+  if (options->key_materials_config() == nullptr &&
+      options->credential_reload_config() == nullptr) {
+    gpr_log(
+        GPR_ERROR,
+        "SPIFFE TLS credentials options must specify either key materials or "
+        "credential reload config.");
+    return false;
+  }
+  if (!is_client && options->server_authorization_check_config() != nullptr) {
+    gpr_log(GPR_INFO,
+            "Server's credentials options should not contain server "
+            "authorization check config.");
+  }
+  return true;
+}
+
+}  // namespace
+
+SpiffeCredentials::SpiffeCredentials(
+    grpc_core::RefCountedPtr<grpc_tls_credentials_options> options)
+    : grpc_channel_credentials(GRPC_CREDENTIALS_TYPE_SPIFFE),
+      options_(std::move(options)) {}
+
+SpiffeCredentials::~SpiffeCredentials() {}
+
+grpc_core::RefCountedPtr<grpc_channel_security_connector>
+SpiffeCredentials::create_security_connector(
+    grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+    const char* target_name, const grpc_channel_args* args,
+    grpc_channel_args** new_args) {
+  const char* overridden_target_name = nullptr;
+  tsi_ssl_session_cache* ssl_session_cache = nullptr;
+  for (size_t i = 0; args != nullptr && i < args->num_args; i++) {
+    grpc_arg* arg = &args->args[i];
+    if (strcmp(arg->key, GRPC_SSL_TARGET_NAME_OVERRIDE_ARG) == 0 &&
+        arg->type == GRPC_ARG_STRING) {
+      overridden_target_name = arg->value.string;
+    }
+    if (strcmp(arg->key, GRPC_SSL_SESSION_CACHE_ARG) == 0 &&
+        arg->type == GRPC_ARG_POINTER) {
+      ssl_session_cache =
+          static_cast<tsi_ssl_session_cache*>(arg->value.pointer.p);
+    }
+  }
+  grpc_core::RefCountedPtr<grpc_channel_security_connector> sc =
+      SpiffeChannelSecurityConnector::CreateSpiffeChannelSecurityConnector(
+          this->Ref(), std::move(call_creds), target_name,
+          overridden_target_name, ssl_session_cache);
+  if (sc == nullptr) {
+    return nullptr;
+  }
+  grpc_arg new_arg = grpc_channel_arg_string_create(
+      (char*)GRPC_ARG_HTTP2_SCHEME, (char*)"https");
+  *new_args = grpc_channel_args_copy_and_add(args, &new_arg, 1);
+  return sc;
+}
+
+SpiffeServerCredentials::SpiffeServerCredentials(
+    grpc_core::RefCountedPtr<grpc_tls_credentials_options> options)
+    : grpc_server_credentials(GRPC_CREDENTIALS_TYPE_SPIFFE),
+      options_(std::move(options)) {}
+
+SpiffeServerCredentials::~SpiffeServerCredentials() {}
+
+grpc_core::RefCountedPtr<grpc_server_security_connector>
+SpiffeServerCredentials::create_security_connector() {
+  return SpiffeServerSecurityConnector::CreateSpiffeServerSecurityConnector(
+      this->Ref());
+}
+
+grpc_channel_credentials* grpc_tls_spiffe_credentials_create(
+    grpc_tls_credentials_options* options) {
+  if (!CredentialOptionSanityCheck(options, true /* is_client */)) {
+    return nullptr;
+  }
+  return grpc_core::New<SpiffeCredentials>(
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options>(options));
+}
+
+grpc_server_credentials* grpc_tls_spiffe_server_credentials_create(
+    grpc_tls_credentials_options* options) {
+  if (!CredentialOptionSanityCheck(options, false /* is_client */)) {
+    return nullptr;
+  }
+  return grpc_core::New<SpiffeServerCredentials>(
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options>(options));
+}

data/src/core/lib/security/credentials/tls/spiffe_credentials.h

@@ -0,0 +1,62 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_SPIFFE_CREDENTIALS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_SPIFFE_CREDENTIALS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
+
+class SpiffeCredentials final : public grpc_channel_credentials {
+ public:
+  explicit SpiffeCredentials(
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options> options);
+  ~SpiffeCredentials() override;
+
+  grpc_core::RefCountedPtr<grpc_channel_security_connector>
+  create_security_connector(
+      grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+      const char* target_name, const grpc_channel_args* args,
+      grpc_channel_args** new_args) override;
+
+  const grpc_tls_credentials_options& options() const { return *options_; }
+
+ private:
+  grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
+};
+
+class SpiffeServerCredentials final : public grpc_server_credentials {
+ public:
+  explicit SpiffeServerCredentials(
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options> options);
+  ~SpiffeServerCredentials() override;
+
+  grpc_core::RefCountedPtr<grpc_server_security_connector>
+  create_security_connector() override;
+
+  const grpc_tls_credentials_options& options() const { return *options_; }
+
+ private:
+  grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
+};
+
+#endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_SPIFFE_CREDENTIALS_H */