grpc 1.28.0 → 1.31.0.pre2

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc

@@ -29,10 +29,28 @@
 
 /** -- gRPC TLS key materials config API implementation. -- **/
 void grpc_tls_key_materials_config::set_key_materials(
-    grpc_core::UniquePtr<char> pem_root_certs,
-    PemKeyCertPairList pem_key_cert_pair_list) {
-  pem_key_cert_pair_list_ = std::move(pem_key_cert_pair_list);
-  pem_root_certs_ = std::move(pem_root_certs);
+    const char* pem_root_certs,
+    const grpc_ssl_pem_key_cert_pair** pem_key_cert_pairs,
+    size_t num_key_cert_pairs) {
+  this->set_pem_root_certs(pem_root_certs);
+  grpc_tls_key_materials_config::PemKeyCertPairList cert_pair_list;
+  for (size_t i = 0; i < num_key_cert_pairs; i++) {
+    auto current_pair = static_cast<grpc_ssl_pem_key_cert_pair*>(
+        gpr_zalloc(sizeof(grpc_ssl_pem_key_cert_pair)));
+    current_pair->cert_chain = gpr_strdup(pem_key_cert_pairs[i]->cert_chain);
+    current_pair->private_key = gpr_strdup(pem_key_cert_pairs[i]->private_key);
+    cert_pair_list.emplace_back(grpc_core::PemKeyCertPair(current_pair));
+  }
+  pem_key_cert_pair_list_ = std::move(cert_pair_list);
+}
+
+void grpc_tls_key_materials_config::set_key_materials(
+    const char* pem_root_certs,
+    const PemKeyCertPairList& pem_key_cert_pair_list) {
+  this->set_pem_root_certs(pem_root_certs);
+  grpc_tls_key_materials_config::PemKeyCertPairList dup_list(
+      pem_key_cert_pair_list);
+  pem_key_cert_pair_list_ = std::move(dup_list);
 }
 
 /** -- gRPC TLS credential reload config API implementation. -- **/
@@ -165,15 +183,7 @@ int grpc_tls_key_materials_config_set_key_materials(
             "grpc_tls_key_materials_config_set_key_materials()");
     return 0;
   }
-  grpc_core::UniquePtr<char> pem_root(const_cast<char*>(root_certs));
-  grpc_tls_key_materials_config::PemKeyCertPairList cert_pair_list;
-  for (size_t i = 0; i < num; i++) {
-    grpc_core::PemKeyCertPair key_cert_pair(
-        const_cast<grpc_ssl_pem_key_cert_pair*>(key_cert_pairs[i]));
-    cert_pair_list.emplace_back(std::move(key_cert_pair));
-  }
-  config->set_key_materials(std::move(pem_root), std::move(cert_pair_list));
-  gpr_free(key_cert_pairs);
+  config->set_key_materials(root_certs, key_cert_pairs, num);
   return 1;
 }
 

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -23,16 +23,29 @@
 
 #include <grpc/grpc_security.h>
 
-#include "src/core/lib/gprpp/inlined_vector.h"
+#include "absl/container/inlined_vector.h"
+
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 
+struct grpc_tls_error_details
+    : public grpc_core::RefCounted<grpc_tls_error_details> {
+ public:
+  grpc_tls_error_details() : error_details_("") {}
+  void set_error_details(const char* err_details) {
+    error_details_ = err_details;
+  }
+  const std::string& error_details() { return error_details_; }
+
+ private:
+  std::string error_details_;
+};
+
 /** TLS key materials config. **/
 struct grpc_tls_key_materials_config
     : public grpc_core::RefCounted<grpc_tls_key_materials_config> {
  public:
-  typedef grpc_core::InlinedVector<grpc_core::PemKeyCertPair, 1>
-      PemKeyCertPairList;
+  typedef absl::InlinedVector<grpc_core::PemKeyCertPair, 1> PemKeyCertPairList;
 
   /** Getters for member fields. **/
   const char* pem_root_certs() const { return pem_root_certs_.get(); }
@@ -42,14 +55,28 @@ struct grpc_tls_key_materials_config
   int version() const { return version_; }
 
   /** Setters for member fields. **/
+  // TODO(ZhenLian): Remove this function
   void set_pem_root_certs(grpc_core::UniquePtr<char> pem_root_certs) {
     pem_root_certs_ = std::move(pem_root_certs);
   }
+  // The ownerships of |pem_root_certs| remain with the caller.
+  void set_pem_root_certs(const char* pem_root_certs) {
+    // make a copy of pem_root_certs.
+    grpc_core::UniquePtr<char> pem_root_ptr(gpr_strdup(pem_root_certs));
+    pem_root_certs_ = std::move(pem_root_ptr);
+  }
   void add_pem_key_cert_pair(grpc_core::PemKeyCertPair pem_key_cert_pair) {
     pem_key_cert_pair_list_.push_back(pem_key_cert_pair);
   }
-  void set_key_materials(grpc_core::UniquePtr<char> pem_root_certs,
-                         PemKeyCertPairList pem_key_cert_pair_list);
+  // The ownerships of |pem_root_certs| and |pem_key_cert_pairs| remain with the
+  // caller.
+  void set_key_materials(const char* pem_root_certs,
+                         const grpc_ssl_pem_key_cert_pair** pem_key_cert_pairs,
+                         size_t num_key_cert_pairs);
+  // The ownerships of |pem_root_certs| and |pem_key_cert_pair_list| remain with
+  // the caller.
+  void set_key_materials(const char* pem_root_certs,
+                         const PemKeyCertPairList& pem_key_cert_pair_list);
   void set_version(int version) { version_ = version; }
 
  private:
@@ -79,8 +106,8 @@ struct grpc_tls_credential_reload_config
       gpr_log(GPR_ERROR, "schedule API is nullptr");
       if (arg != nullptr) {
         arg->status = GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_FAIL;
-        arg->error_details =
-            gpr_strdup("schedule API in credential reload config is nullptr");
+        arg->error_details->set_error_details(
+            "schedule API in credential reload config is nullptr");
       }
       return 1;
     }
@@ -94,8 +121,8 @@ struct grpc_tls_credential_reload_config
       gpr_log(GPR_ERROR, "cancel API is nullptr.");
       if (arg != nullptr) {
         arg->status = GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_FAIL;
-        arg->error_details =
-            gpr_strdup("cancel API in credential reload config is nullptr");
+        arg->error_details->set_error_details(
+            "cancel API in credential reload config is nullptr");
       }
       return;
     }
@@ -155,7 +182,7 @@ struct grpc_tls_server_authorization_check_config
       gpr_log(GPR_ERROR, "schedule API is nullptr");
       if (arg != nullptr) {
         arg->status = GRPC_STATUS_NOT_FOUND;
-        arg->error_details = gpr_strdup(
+        arg->error_details->set_error_details(
             "schedule API in server authorization check config is nullptr");
       }
       return 1;
@@ -171,7 +198,7 @@ struct grpc_tls_server_authorization_check_config
       gpr_log(GPR_ERROR, "cancel API is nullptr.");
       if (arg != nullptr) {
         arg->status = GRPC_STATUS_NOT_FOUND;
-        arg->error_details = gpr_strdup(
+        arg->error_details->set_error_details(
             "schedule API in server authorization check config is nullptr");
       }
       return;
@@ -237,6 +264,8 @@ struct grpc_tls_credentials_options
   grpc_tls_server_verification_option server_verification_option() const {
     return server_verification_option_;
   }
+  grpc_tls_version min_tls_version() const { return min_tls_version_; }
+  grpc_tls_version max_tls_version() const { return max_tls_version_; }
   grpc_tls_key_materials_config* key_materials_config() const {
     return key_materials_config_.get();
   }
@@ -257,6 +286,12 @@ struct grpc_tls_credentials_options
       const grpc_tls_server_verification_option server_verification_option) {
     server_verification_option_ = server_verification_option;
   }
+  void set_min_tls_version(grpc_tls_version min_tls_version) {
+    min_tls_version_ = min_tls_version;
+  }
+  void set_max_tls_version(grpc_tls_version max_tls_version) {
+    max_tls_version_ = max_tls_version;
+  }
   void set_key_materials_config(
       grpc_core::RefCountedPtr<grpc_tls_key_materials_config> config) {
     key_materials_config_ = std::move(config);
@@ -275,6 +310,8 @@ struct grpc_tls_credentials_options
   grpc_ssl_client_certificate_request_type cert_request_type_;
   grpc_tls_server_verification_option server_verification_option_ =
       GRPC_TLS_SERVER_VERIFICATION;
+  grpc_tls_version min_tls_version_ = grpc_tls_version::TLS1_2;
+  grpc_tls_version max_tls_version_ = grpc_tls_version::TLS1_3;
   grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
   grpc_core::RefCountedPtr<grpc_tls_credential_reload_config>
       credential_reload_config_;

data/src/core/lib/security/security_connector/alts/alts_security_connector.cc

@@ -82,10 +82,17 @@ class grpc_alts_channel_security_connector final
     tsi_handshaker* handshaker = nullptr;
     const grpc_alts_credentials* creds =
         static_cast<const grpc_alts_credentials*>(channel_creds());
-    GPR_ASSERT(alts_tsi_handshaker_create(creds->options(), target_name_,
-                                          creds->handshaker_service_url(), true,
-                                          interested_parties,
-                                          &handshaker) == TSI_OK);
+    size_t user_specified_max_frame_size = 0;
+    const grpc_arg* arg =
+        grpc_channel_args_find(args, GRPC_ARG_TSI_MAX_FRAME_SIZE);
+    if (arg != nullptr && arg->type == GRPC_ARG_INTEGER) {
+      user_specified_max_frame_size = grpc_channel_arg_get_integer(
+          arg, {0, 0, std::numeric_limits<int>::max()});
+    }
+    GPR_ASSERT(alts_tsi_handshaker_create(
+                   creds->options(), target_name_,
+                   creds->handshaker_service_url(), true, interested_parties,
+                   &handshaker, user_specified_max_frame_size) == TSI_OK);
     handshake_manager->Add(
         grpc_core::SecurityHandshakerCreate(handshaker, this, args));
   }
@@ -104,7 +111,7 @@ class grpc_alts_channel_security_connector final
     return strcmp(target_name_, other->target_name_);
   }
 
-  bool check_call_host(grpc_core::StringView host,
+  bool check_call_host(absl::string_view host,
                        grpc_auth_context* /*auth_context*/,
                        grpc_closure* /*on_call_host_checked*/,
                        grpc_error** error) override {
@@ -140,9 +147,17 @@ class grpc_alts_server_security_connector final
     tsi_handshaker* handshaker = nullptr;
     const grpc_alts_server_credentials* creds =
         static_cast<const grpc_alts_server_credentials*>(server_creds());
+    size_t user_specified_max_frame_size = 0;
+    const grpc_arg* arg =
+        grpc_channel_args_find(args, GRPC_ARG_TSI_MAX_FRAME_SIZE);
+    if (arg != nullptr && arg->type == GRPC_ARG_INTEGER) {
+      user_specified_max_frame_size = grpc_channel_arg_get_integer(
+          arg, {0, 0, std::numeric_limits<int>::max()});
+    }
     GPR_ASSERT(alts_tsi_handshaker_create(
                    creds->options(), nullptr, creds->handshaker_service_url(),
-                   false, interested_parties, &handshaker) == TSI_OK);
+                   false, interested_parties, &handshaker,
+                   user_specified_max_frame_size) == TSI_OK);
     handshake_manager->Add(
         grpc_core::SecurityHandshakerCreate(handshaker, this, args));
   }

data/src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -22,6 +22,8 @@
 
 #include <stdbool.h>
 
+#include "absl/strings/str_cat.h"
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
@@ -103,20 +105,20 @@ class grpc_fake_channel_security_connector final
         tsi_create_fake_handshaker(/*is_client=*/true), this, args));
   }
 
-  bool check_call_host(grpc_core::StringView host,
+  bool check_call_host(absl::string_view host,
                        grpc_auth_context* /*auth_context*/,
                        grpc_closure* /*on_call_host_checked*/,
                        grpc_error** /*error*/) override {
-    grpc_core::StringView authority_hostname;
-    grpc_core::StringView authority_ignored_port;
-    grpc_core::StringView target_hostname;
-    grpc_core::StringView target_ignored_port;
+    absl::string_view authority_hostname;
+    absl::string_view authority_ignored_port;
+    absl::string_view target_hostname;
+    absl::string_view target_ignored_port;
     grpc_core::SplitHostPort(host, &authority_hostname,
                              &authority_ignored_port);
     grpc_core::SplitHostPort(target_, &target_hostname, &target_ignored_port);
     if (target_name_override_ != nullptr) {
-      grpc_core::StringView fake_security_target_name_override_hostname;
-      grpc_core::StringView fake_security_target_name_override_ignored_port;
+      absl::string_view fake_security_target_name_override_hostname;
+      absl::string_view fake_security_target_name_override_ignored_port;
       grpc_core::SplitHostPort(
           target_name_override_, &fake_security_target_name_override_hostname,
           &fake_security_target_name_override_ignored_port);
@@ -227,11 +229,10 @@ static void fake_check_peer(
   prop_name = peer.properties[0].name;
   if (prop_name == nullptr ||
       strcmp(prop_name, TSI_CERTIFICATE_TYPE_PEER_PROPERTY)) {
-    char* msg;
-    gpr_asprintf(&msg, "Unexpected property in fake peer: %s.",
-                 prop_name == nullptr ? "<EMPTY>" : prop_name);
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
-    gpr_free(msg);
+    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("Unexpected property in fake peer: ",
+                     prop_name == nullptr ? "<EMPTY>" : prop_name)
+            .c_str());
     goto end;
   }
   if (strncmp(peer.properties[0].value.data, TSI_FAKE_CERTIFICATE_TYPE,
@@ -243,11 +244,10 @@ static void fake_check_peer(
   prop_name = peer.properties[1].name;
   if (prop_name == nullptr ||
       strcmp(prop_name, TSI_SECURITY_LEVEL_PEER_PROPERTY) != 0) {
-    char* msg;
-    gpr_asprintf(&msg, "Unexpected property in fake peer: %s.",
-                 prop_name == nullptr ? "<EMPTY>" : prop_name);
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
-    gpr_free(msg);
+    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("Unexpected property in fake peer: ",
+                     prop_name == nullptr ? "<EMPTY>" : prop_name)
+            .c_str());
     goto end;
   }
   if (strncmp(peer.properties[1].value.data, TSI_FAKE_SECURITY_LEVEL,

data/src/core/lib/security/security_connector/load_system_roots_linux.cc

@@ -34,6 +34,8 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#include "absl/container/inlined_vector.h"
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
@@ -41,7 +43,6 @@
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/global_config.h"
-#include "src/core/lib/gprpp/inlined_vector.h"
 #include "src/core/lib/iomgr/load_file.h"
 
 GPR_GLOBAL_CONFIG_DEFINE_STRING(grpc_system_ssl_roots_dir, "",
@@ -100,7 +101,7 @@ grpc_slice CreateRootCertsBundle(const char* certs_directory) {
     char path[MAXPATHLEN];
     off_t size;
   };
-  InlinedVector<FileData, 2> roots_filenames;
+  absl::InlinedVector<FileData, 2> roots_filenames;
   size_t total_bundle_size = 0;
   struct dirent* directory_entry;
   while ((directory_entry = readdir(ca_directory)) != nullptr) {

data/src/core/lib/security/security_connector/local/local_security_connector.cc

@@ -181,7 +181,7 @@ class grpc_local_channel_security_connector final
                      creds->connect_type());
   }
 
-  bool check_call_host(grpc_core::StringView host,
+  bool check_call_host(absl::string_view host,
                        grpc_auth_context* /*auth_context*/,
                        grpc_closure* /*on_call_host_checked*/,
                        grpc_error** error) override {

data/src/core/lib/security/security_connector/security_connector.cc

@@ -46,6 +46,8 @@ grpc_server_security_connector::grpc_server_security_connector(
     : grpc_security_connector(url_scheme),
       server_creds_(std::move(server_creds)) {}
 
+grpc_server_security_connector::~grpc_server_security_connector() = default;
+
 grpc_channel_security_connector::grpc_channel_security_connector(
     const char* url_scheme,
     grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,

data/src/core/lib/security/security_connector/security_connector.h

@@ -98,7 +98,7 @@ class grpc_channel_security_connector : public grpc_security_connector {
   /// Returns true if completed synchronously, in which case \a error will
   /// be set to indicate the result.  Otherwise, \a on_call_host_checked
   /// will be invoked when complete.
-  virtual bool check_call_host(grpc_core::StringView host,
+  virtual bool check_call_host(absl::string_view host,
                                grpc_auth_context* auth_context,
                                grpc_closure* on_call_host_checked,
                                grpc_error** error) = 0;
@@ -151,7 +151,7 @@ class grpc_server_security_connector : public grpc_security_connector {
   grpc_server_security_connector(
       const char* url_scheme,
       grpc_core::RefCountedPtr<grpc_server_credentials> server_creds);
-  ~grpc_server_security_connector() override = default;
+  ~grpc_server_security_connector() override;
 
   virtual void add_handshakers(const grpc_channel_args* args,
                                grpc_pollset_set* interested_parties,

data/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc

@@ -22,15 +22,19 @@
 
 #include <stdbool.h>
 
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_format.h"
+#include "absl/strings/string_view.h"
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
 
 #include "src/core/ext/transport/chttp2/alpn/alpn.h"
 #include "src/core/lib/channel/handshaker.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/ssl/ssl_credentials.h"
@@ -50,11 +54,9 @@ grpc_error* ssl_check_peer(
   }
   /* Check the peer name if specified. */
   if (peer_name != nullptr && !grpc_ssl_host_matches_name(peer, peer_name)) {
-    char* msg;
-    gpr_asprintf(&msg, "Peer name %s is not in peer certificate", peer_name);
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
-    gpr_free(msg);
-    return error;
+    return GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("Peer name ", peer_name, " is not in peer certificate")
+            .c_str());
   }
   *auth_context =
       grpc_ssl_peer_to_auth_context(peer, GRPC_SSL_TRANSPORT_SECURITY_TYPE);
@@ -72,14 +74,13 @@ class grpc_ssl_channel_security_connector final
       : grpc_channel_security_connector(GRPC_SSL_URL_SCHEME,
                                         std::move(channel_creds),
                                         std::move(request_metadata_creds)),
-        overridden_target_name_(overridden_target_name == nullptr
-                                    ? nullptr
-                                    : gpr_strdup(overridden_target_name)),
+        overridden_target_name_(
+            overridden_target_name == nullptr ? "" : overridden_target_name),
         verify_options_(&config->verify_options) {
-    grpc_core::StringView host;
-    grpc_core::StringView port;
+    absl::string_view host;
+    absl::string_view port;
     grpc_core::SplitHostPort(target_name, &host, &port);
-    target_name_ = grpc_core::StringViewToCString(host);
+    target_name_ = std::string(host);
   }
 
   ~grpc_ssl_channel_security_connector() override {
@@ -105,6 +106,8 @@ class grpc_ssl_channel_security_connector final
     }
     options.cipher_suites = grpc_get_ssl_cipher_suites();
     options.session_cache = ssl_session_cache;
+    options.min_tls_version = grpc_get_tsi_tls_version(config->min_tls_version);
+    options.max_tls_version = grpc_get_tsi_tls_version(config->max_tls_version);
     const tsi_result result =
         tsi_create_ssl_client_handshaker_factory_with_options(
             &options, &client_handshaker_factory_);
@@ -124,8 +127,8 @@ class grpc_ssl_channel_security_connector final
     tsi_handshaker* tsi_hs = nullptr;
     tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
         client_handshaker_factory_,
-        overridden_target_name_ != nullptr ? overridden_target_name_.get()
-                                           : target_name_.get(),
+        overridden_target_name_.empty() ? target_name_.c_str()
+                                        : overridden_target_name_.c_str(),
         &tsi_hs);
     if (result != TSI_OK) {
       gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
@@ -139,9 +142,9 @@ class grpc_ssl_channel_security_connector final
   void check_peer(tsi_peer peer, grpc_endpoint* /*ep*/,
                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override {
-    const char* target_name = overridden_target_name_ != nullptr
-                                  ? overridden_target_name_.get()
-                                  : target_name_.get();
+    const char* target_name = overridden_target_name_.empty()
+                                  ? target_name_.c_str()
+                                  : overridden_target_name_.c_str();
     grpc_error* error = ssl_check_peer(target_name, &peer, auth_context);
     if (error == GRPC_ERROR_NONE &&
         verify_options_->verify_peer_callback != nullptr) {
@@ -159,11 +162,10 @@ class grpc_ssl_channel_security_connector final
             verify_options_->verify_peer_callback_userdata);
         gpr_free(peer_pem);
         if (callback_status) {
-          char* msg;
-          gpr_asprintf(&msg, "Verify peer callback returned a failure (%d)",
-                       callback_status);
-          error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
-          gpr_free(msg);
+          error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+              absl::StrFormat("Verify peer callback returned a failure (%d)",
+                              callback_status)
+                  .c_str());
         }
       }
     }
@@ -176,23 +178,17 @@ class grpc_ssl_channel_security_connector final
         reinterpret_cast<const grpc_ssl_channel_security_connector*>(other_sc);
     int c = channel_security_connector_cmp(other);
     if (c != 0) return c;
-    c = strcmp(target_name_.get(), other->target_name_.get());
+    c = target_name_.compare(other->target_name_);
     if (c != 0) return c;
-    return (overridden_target_name_ == nullptr ||
-            other->overridden_target_name_ == nullptr)
-               ? GPR_ICMP(overridden_target_name_.get(),
-                          other->overridden_target_name_.get())
-               : strcmp(overridden_target_name_.get(),
-                        other->overridden_target_name_.get());
+    return overridden_target_name_.compare(other->overridden_target_name_);
   }
 
-  bool check_call_host(grpc_core::StringView host,
-                       grpc_auth_context* auth_context,
+  bool check_call_host(absl::string_view host, grpc_auth_context* auth_context,
                        grpc_closure* /*on_call_host_checked*/,
                        grpc_error** error) override {
-    return grpc_ssl_check_call_host(host, target_name_.get(),
-                                    overridden_target_name_.get(), auth_context,
-                                    error);
+    return grpc_ssl_check_call_host(host, target_name_.c_str(),
+                                    overridden_target_name_.c_str(),
+                                    auth_context, error);
   }
 
   void cancel_check_call_host(grpc_closure* /*on_call_host_checked*/,
@@ -202,8 +198,8 @@ class grpc_ssl_channel_security_connector final
 
  private:
   tsi_ssl_client_handshaker_factory* client_handshaker_factory_;
-  grpc_core::UniquePtr<char> target_name_;
-  grpc_core::UniquePtr<char> overridden_target_name_;
+  std::string target_name_;
+  std::string overridden_target_name_;
   const verify_peer_options* verify_options_;
 };
 
@@ -255,6 +251,10 @@ class grpc_ssl_server_security_connector
       options.cipher_suites = grpc_get_ssl_cipher_suites();
       options.alpn_protocols = alpn_protocol_strings;
       options.num_alpn_protocols = static_cast<uint16_t>(num_alpn_protocols);
+      options.min_tls_version = grpc_get_tsi_tls_version(
+          server_credentials->config().min_tls_version);
+      options.max_tls_version = grpc_get_tsi_tls_version(
+          server_credentials->config().max_tls_version);
       const tsi_result result =
           tsi_create_ssl_server_handshaker_factory_with_options(
               &options, &server_handshaker_factory_);
@@ -307,6 +307,7 @@ class grpc_ssl_server_security_connector
     bool status;
     if (!has_cert_config_fetcher()) return false;
 
+    grpc_core::MutexLock lock(&mu_);
     grpc_ssl_server_credentials* server_creds =
         static_cast<grpc_ssl_server_credentials*>(this->mutable_server_creds());
     grpc_ssl_certificate_config_reload_status cb_result =
@@ -386,6 +387,7 @@ class grpc_ssl_server_security_connector
     server_handshaker_factory_ = new_factory;
   }
 
+  grpc_core::Mutex mu_;
   tsi_ssl_server_handshaker_factory* server_handshaker_factory_ = nullptr;
 };
 }  // namespace