grpc 1.30.0 → 1.46.3

data/src/core/lib/security/credentials/tls/tls_utils.cc

@@ -0,0 +1,123 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/tls/tls_utils.h"
+
+#include "absl/strings/ascii.h"
+#include "absl/strings/match.h"
+#include "absl/strings/str_cat.h"
+
+namespace grpc_core {
+
+// Based on
+// https://github.com/grpc/grpc-java/blob/ca12e7a339add0ef48202fb72434b9dc0df41756/xds/src/main/java/io/grpc/xds/internal/sds/trust/SdsX509TrustManager.java#L62
+bool VerifySubjectAlternativeName(absl::string_view subject_alternative_name,
+                                  const std::string& matcher) {
+  if (subject_alternative_name.empty() ||
+      absl::StartsWith(subject_alternative_name, ".")) {
+    // Illegal pattern/domain name
+    return false;
+  }
+  if (matcher.empty() || absl::StartsWith(matcher, ".")) {
+    // Illegal domain name
+    return false;
+  }
+  // Normalize \a subject_alternative_name and \a matcher by turning them into
+  // absolute domain names if they are not yet absolute. This is needed because
+  // server certificates do not normally contain absolute names or patterns, but
+  // they should be treated as absolute. At the same time, any
+  // subject_alternative_name presented to this method should also be treated as
+  // absolute for the purposes of matching to the server certificate.
+  std::string normalized_san =
+      absl::EndsWith(subject_alternative_name, ".")
+          ? std::string(subject_alternative_name)
+          : absl::StrCat(subject_alternative_name, ".");
+  std::string normalized_matcher =
+      absl::EndsWith(matcher, ".") ? matcher : absl::StrCat(matcher, ".");
+  absl::AsciiStrToLower(&normalized_san);
+  absl::AsciiStrToLower(&normalized_matcher);
+  if (!absl::StrContains(normalized_san, "*")) {
+    return normalized_san == normalized_matcher;
+  }
+  // WILDCARD PATTERN RULES:
+  // 1. Asterisk (*) is only permitted in the left-most domain name label and
+  //    must be the only character in that label (i.e., must match the whole
+  //    left-most label). For example, *.example.com is permitted, while
+  //    *a.example.com, a*.example.com, a*b.example.com, a.*.example.com are
+  //    not permitted.
+  // 2. Asterisk (*) cannot match across domain name labels.
+  //    For example, *.example.com matches test.example.com but does not match
+  //    sub.test.example.com.
+  // 3. Wildcard patterns for single-label domain names are not permitted.
+  if (!absl::StartsWith(normalized_san, "*.")) {
+    // Asterisk (*) is only permitted in the left-most domain name label and
+    // must be the only character in that label
+    return false;
+  }
+  if (normalized_san == "*.") {
+    // Wildcard pattern for single-label domain name -- not permitted.
+    return false;
+  }
+  absl::string_view suffix = absl::string_view(normalized_san).substr(1);
+  if (absl::StrContains(suffix, "*")) {
+    // Asterisk (*) is not permitted in the suffix
+    return false;
+  }
+  if (!absl::EndsWith(normalized_matcher, suffix)) return false;
+  int suffix_start_index = normalized_matcher.length() - suffix.length();
+  // Asterisk matching across domain labels is not permitted.
+  return suffix_start_index <= 0 /* should not happen */ ||
+         normalized_matcher.find_last_of('.', suffix_start_index - 1) ==
+             std::string::npos;
+}
+
+absl::string_view GetAuthPropertyValue(grpc_auth_context* context,
+                                       const char* property_name) {
+  grpc_auth_property_iterator it =
+      grpc_auth_context_find_properties_by_name(context, property_name);
+  const grpc_auth_property* prop = grpc_auth_property_iterator_next(&it);
+  if (prop == nullptr) {
+    gpr_log(GPR_DEBUG, "No value found for %s property.", property_name);
+    return "";
+  }
+  if (grpc_auth_property_iterator_next(&it) != nullptr) {
+    gpr_log(GPR_DEBUG, "Multiple values found for %s property.", property_name);
+    return "";
+  }
+  return absl::string_view(prop->value, prop->value_length);
+}
+
+std::vector<absl::string_view> GetAuthPropertyArray(grpc_auth_context* context,
+                                                    const char* property_name) {
+  std::vector<absl::string_view> values;
+  grpc_auth_property_iterator it =
+      grpc_auth_context_find_properties_by_name(context, property_name);
+  const grpc_auth_property* prop = grpc_auth_property_iterator_next(&it);
+  while (prop != nullptr) {
+    values.emplace_back(prop->value, prop->value_length);
+    prop = grpc_auth_property_iterator_next(&it);
+  }
+  if (values.empty()) {
+    gpr_log(GPR_DEBUG, "No value found for %s property.", property_name);
+  }
+  return values;
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/credentials/tls/tls_utils.h

@@ -0,0 +1,51 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_TLS_UTILS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_TLS_UTILS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <string>
+#include <vector>
+
+#include "absl/strings/string_view.h"
+
+#include "src/core/lib/security/context/security_context.h"
+
+namespace grpc_core {
+
+// Matches \a subject_alternative_name with \a matcher. Returns true if there
+// is a match, false otherwise.
+bool VerifySubjectAlternativeName(absl::string_view subject_alternative_name,
+                                  const std::string& matcher);
+
+// Returns value for the specified property_name from auth context. Here the
+// property is expected to have a single value. Returns empty if multiple values
+// are found.
+absl::string_view GetAuthPropertyValue(grpc_auth_context* context,
+                                       const char* property_name);
+
+// Returns values for the specified property_name from auth context. Here the
+// property can have any number of values.
+std::vector<absl::string_view> GetAuthPropertyArray(grpc_auth_context* context,
+                                                    const char* property_name);
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_TLS_UTILS_H

data/src/core/lib/security/credentials/xds/xds_credentials.cc

@@ -0,0 +1,237 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/xds/xds_credentials.h"
+
+#include "src/core/ext/filters/client_channel/lb_policy/xds/xds_channel_args.h"
+#include "src/core/ext/xds/xds_certificate_provider.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
+#include "src/core/lib/security/credentials/tls/tls_credentials.h"
+#include "src/core/lib/security/credentials/tls/tls_utils.h"
+#include "src/core/lib/uri/uri_parser.h"
+
+namespace grpc_core {
+
+namespace {
+
+bool XdsVerifySubjectAlternativeNames(
+    const char* const* subject_alternative_names,
+    size_t subject_alternative_names_size,
+    const std::vector<StringMatcher>& matchers) {
+  if (matchers.empty()) return true;
+  for (size_t i = 0; i < subject_alternative_names_size; ++i) {
+    for (const auto& matcher : matchers) {
+      if (matcher.type() == StringMatcher::Type::kExact) {
+        // For Exact match, use DNS rules for verifying SANs
+        // TODO(zhenlian): Right now, the SSL layer does not save the type of
+        // the SAN, so we are doing a DNS style verification for all SANs when
+        // the type is EXACT. When we expose the SAN type, change this to only
+        // do this verification when the SAN type is DNS and match type is
+        // kExact. For all other cases, we should use matcher.Match().
+        if (VerifySubjectAlternativeName(subject_alternative_names[i],
+                                         matcher.string_matcher())) {
+          return true;
+        }
+      } else {
+        if (matcher.Match(subject_alternative_names[i])) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+
+}  // namespace
+
+//
+// XdsCertificateVerifier
+//
+
+XdsCertificateVerifier::XdsCertificateVerifier(
+    RefCountedPtr<XdsCertificateProvider> xds_certificate_provider,
+    std::string cluster_name)
+    : xds_certificate_provider_(std::move(xds_certificate_provider)),
+      cluster_name_(std::move(cluster_name)) {}
+
+bool XdsCertificateVerifier::Verify(
+    grpc_tls_custom_verification_check_request* request,
+    std::function<void(absl::Status)>, absl::Status* sync_status) {
+  GPR_ASSERT(request != nullptr);
+  if (!XdsVerifySubjectAlternativeNames(
+          request->peer_info.san_names.uri_names,
+          request->peer_info.san_names.uri_names_size,
+          xds_certificate_provider_->GetSanMatchers(cluster_name_)) &&
+      !XdsVerifySubjectAlternativeNames(
+          request->peer_info.san_names.ip_names,
+          request->peer_info.san_names.ip_names_size,
+          xds_certificate_provider_->GetSanMatchers(cluster_name_)) &&
+      !XdsVerifySubjectAlternativeNames(
+          request->peer_info.san_names.dns_names,
+          request->peer_info.san_names.dns_names_size,
+          xds_certificate_provider_->GetSanMatchers(cluster_name_))) {
+    *sync_status = absl::Status(
+        absl::StatusCode::kUnauthenticated,
+        "SANs from certificate did not match SANs from xDS control plane");
+  }
+  return true; /* synchronous check */
+}
+
+void XdsCertificateVerifier::Cancel(
+    grpc_tls_custom_verification_check_request*) {}
+
+int XdsCertificateVerifier::CompareImpl(
+    const grpc_tls_certificate_verifier* other) const {
+  auto* o = static_cast<const XdsCertificateVerifier*>(other);
+  int r = QsortCompare(xds_certificate_provider_, o->xds_certificate_provider_);
+  if (r != 0) return r;
+  return cluster_name_.compare(o->cluster_name_);
+}
+
+const char* XdsCertificateVerifier::type() const { return "Xds"; }
+
+bool TestOnlyXdsVerifySubjectAlternativeNames(
+    const char* const* subject_alternative_names,
+    size_t subject_alternative_names_size,
+    const std::vector<StringMatcher>& matchers) {
+  return XdsVerifySubjectAlternativeNames(
+      subject_alternative_names, subject_alternative_names_size, matchers);
+}
+
+//
+// XdsCredentials
+//
+
+RefCountedPtr<grpc_channel_security_connector>
+XdsCredentials::create_security_connector(
+    RefCountedPtr<grpc_call_credentials> call_creds, const char* target_name,
+    const grpc_channel_args* args, grpc_channel_args** new_args) {
+  struct ChannelArgsDeleter {
+    const grpc_channel_args* args;
+    bool owned;
+    ~ChannelArgsDeleter() {
+      if (owned) grpc_channel_args_destroy(args);
+    }
+  };
+  ChannelArgsDeleter temp_args{args, false};
+  // TODO(yashykt): This arg will no longer need to be added after b/173119596
+  // is fixed.
+  grpc_arg override_arg = grpc_channel_arg_string_create(
+      const_cast<char*>(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG),
+      const_cast<char*>(target_name));
+  const char* override_arg_name = GRPC_SSL_TARGET_NAME_OVERRIDE_ARG;
+  if (grpc_channel_args_find(args, override_arg_name) == nullptr) {
+    temp_args.args = grpc_channel_args_copy_and_add_and_remove(
+        args, &override_arg_name, 1, &override_arg, 1);
+    temp_args.owned = true;
+  }
+  RefCountedPtr<grpc_channel_security_connector> security_connector;
+  auto xds_certificate_provider =
+      XdsCertificateProvider::GetFromChannelArgs(args);
+  if (xds_certificate_provider != nullptr) {
+    std::string cluster_name =
+        grpc_channel_args_find_string(args, GRPC_ARG_XDS_CLUSTER_NAME);
+    GPR_ASSERT(cluster_name.data() != nullptr);
+    const bool watch_root =
+        xds_certificate_provider->ProvidesRootCerts(cluster_name);
+    const bool watch_identity =
+        xds_certificate_provider->ProvidesIdentityCerts(cluster_name);
+    if (watch_root || watch_identity) {
+      auto tls_credentials_options =
+          MakeRefCounted<grpc_tls_credentials_options>();
+      tls_credentials_options->set_certificate_provider(
+          xds_certificate_provider);
+      if (watch_root) {
+        tls_credentials_options->set_watch_root_cert(true);
+        tls_credentials_options->set_root_cert_name(cluster_name);
+      }
+      if (watch_identity) {
+        tls_credentials_options->set_watch_identity_pair(true);
+        tls_credentials_options->set_identity_cert_name(cluster_name);
+      }
+      tls_credentials_options->set_verify_server_cert(true);
+      tls_credentials_options->set_certificate_verifier(
+          MakeRefCounted<XdsCertificateVerifier>(xds_certificate_provider,
+                                                 std::move(cluster_name)));
+      tls_credentials_options->set_check_call_host(false);
+      auto tls_credentials =
+          MakeRefCounted<TlsCredentials>(std::move(tls_credentials_options));
+      return tls_credentials->create_security_connector(
+          std::move(call_creds), target_name, temp_args.args, new_args);
+    }
+  }
+  GPR_ASSERT(fallback_credentials_ != nullptr);
+  return fallback_credentials_->create_security_connector(
+      std::move(call_creds), target_name, temp_args.args, new_args);
+}
+
+const char* XdsCredentials::Type() { return "Xds"; }
+
+//
+// XdsServerCredentials
+//
+
+RefCountedPtr<grpc_server_security_connector>
+XdsServerCredentials::create_security_connector(const grpc_channel_args* args) {
+  auto xds_certificate_provider =
+      XdsCertificateProvider::GetFromChannelArgs(args);
+  // Identity certs are a must for TLS.
+  if (xds_certificate_provider != nullptr &&
+      xds_certificate_provider->ProvidesIdentityCerts("")) {
+    auto tls_credentials_options =
+        MakeRefCounted<grpc_tls_credentials_options>();
+    tls_credentials_options->set_watch_identity_pair(true);
+    tls_credentials_options->set_certificate_provider(xds_certificate_provider);
+    if (xds_certificate_provider->ProvidesRootCerts("")) {
+      tls_credentials_options->set_watch_root_cert(true);
+      if (xds_certificate_provider->GetRequireClientCertificate("")) {
+        tls_credentials_options->set_cert_request_type(
+            GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY);
+      } else {
+        tls_credentials_options->set_cert_request_type(
+            GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY);
+      }
+    } else {
+      // Do not request client certificate if there is no way to verify.
+      tls_credentials_options->set_cert_request_type(
+          GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE);
+    }
+    auto tls_credentials = MakeRefCounted<TlsServerCredentials>(
+        std::move(tls_credentials_options));
+    return tls_credentials->create_security_connector(args);
+  }
+  return fallback_credentials_->create_security_connector(args);
+}
+
+const char* XdsServerCredentials::Type() { return "Xds"; }
+
+}  // namespace grpc_core
+
+grpc_channel_credentials* grpc_xds_credentials_create(
+    grpc_channel_credentials* fallback_credentials) {
+  GPR_ASSERT(fallback_credentials != nullptr);
+  return new grpc_core::XdsCredentials(fallback_credentials->Ref());
+}
+
+grpc_server_credentials* grpc_xds_server_credentials_create(
+    grpc_server_credentials* fallback_credentials) {
+  GPR_ASSERT(fallback_credentials != nullptr);
+  return new grpc_core::XdsServerCredentials(fallback_credentials->Ref());
+}

data/src/core/lib/security/credentials/xds/xds_credentials.h

@@ -0,0 +1,100 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_XDS_XDS_CREDENTIALS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_XDS_XDS_CREDENTIALS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/ext/xds/xds_certificate_provider.h"
+#include "src/core/lib/matchers/matchers.h"
+#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h"
+
+namespace grpc_core {
+
+class XdsCertificateVerifier : public grpc_tls_certificate_verifier {
+ public:
+  XdsCertificateVerifier(
+      RefCountedPtr<XdsCertificateProvider> xds_certificate_provider,
+      std::string cluster_name);
+
+  bool Verify(grpc_tls_custom_verification_check_request* request,
+              std::function<void(absl::Status)>,
+              absl::Status* sync_status) override;
+  void Cancel(grpc_tls_custom_verification_check_request*) override;
+
+  const char* type() const override;
+
+ private:
+  int CompareImpl(const grpc_tls_certificate_verifier* other) const override;
+
+  RefCountedPtr<XdsCertificateProvider> xds_certificate_provider_;
+  std::string cluster_name_;
+};
+
+class XdsCredentials final : public grpc_channel_credentials {
+ public:
+  explicit XdsCredentials(
+      RefCountedPtr<grpc_channel_credentials> fallback_credentials)
+      : fallback_credentials_(std::move(fallback_credentials)) {}
+
+  RefCountedPtr<grpc_channel_security_connector> create_security_connector(
+      RefCountedPtr<grpc_call_credentials> call_creds, const char* target_name,
+      const grpc_channel_args* args, grpc_channel_args** new_args) override;
+
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
+ private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    auto* o = static_cast<const XdsCredentials*>(other);
+    return fallback_credentials_->cmp(o->fallback_credentials_.get());
+  }
+
+  RefCountedPtr<grpc_channel_credentials> fallback_credentials_;
+};
+
+class XdsServerCredentials final : public grpc_server_credentials {
+ public:
+  explicit XdsServerCredentials(
+      RefCountedPtr<grpc_server_credentials> fallback_credentials)
+      : fallback_credentials_(std::move(fallback_credentials)) {}
+
+  RefCountedPtr<grpc_server_security_connector> create_security_connector(
+      const grpc_channel_args* /* args */) override;
+
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
+ private:
+  RefCountedPtr<grpc_server_credentials> fallback_credentials_;
+};
+
+bool TestOnlyXdsVerifySubjectAlternativeNames(
+    const char* const* subject_alternative_names,
+    size_t subject_alternative_names_size,
+    const std::vector<StringMatcher>& matchers);
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_XDS_XDS_CREDENTIALS_H */

data/src/core/lib/security/security_connector/alts/alts_security_connector.cc

@@ -29,6 +29,7 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/credentials/alts/alts_credentials.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
 #include "src/core/lib/slice/slice_internal.h"
@@ -54,7 +55,7 @@ void alts_check_peer(tsi_peer peer,
   *auth_context =
       grpc_core::internal::grpc_alts_auth_context_from_tsi_peer(&peer);
   tsi_peer_destruct(&peer);
-  grpc_error* error =
+  grpc_error_handle error =
       *auth_context != nullptr
           ? GRPC_ERROR_NONE
           : GRPC_ERROR_CREATE_FROM_STATIC_STRING(
@@ -69,7 +70,7 @@ class grpc_alts_channel_security_connector final
       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
       const char* target_name)
-      : grpc_channel_security_connector(GRPC_ALTS_URL_SCHEME,
+      : grpc_channel_security_connector(GRPC_SSL_URL_SCHEME,
                                         std::move(channel_creds),
                                         std::move(request_metadata_creds)),
         target_name_(gpr_strdup(target_name)) {}
@@ -103,6 +104,11 @@ class grpc_alts_channel_security_connector final
     alts_check_peer(peer, auth_context, on_peer_checked);
   }
 
+  void cancel_check_peer(grpc_closure* /*on_peer_checked*/,
+                         grpc_error_handle error) override {
+    GRPC_ERROR_UNREF(error);
+  }
+
   int cmp(const grpc_security_connector* other_sc) const override {
     auto* other =
         reinterpret_cast<const grpc_alts_channel_security_connector*>(other_sc);
@@ -111,20 +117,13 @@ class grpc_alts_channel_security_connector final
     return strcmp(target_name_, other->target_name_);
   }
 
-  bool check_call_host(absl::string_view host,
-                       grpc_auth_context* /*auth_context*/,
-                       grpc_closure* /*on_call_host_checked*/,
-                       grpc_error** error) override {
+  grpc_core::ArenaPromise<absl::Status> CheckCallHost(
+      absl::string_view host, grpc_auth_context*) override {
     if (host.empty() || host != target_name_) {
-      *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-          "ALTS call host does not match target name");
+      return grpc_core::Immediate(absl::UnauthenticatedError(
+          "ALTS call host does not match target name"));
     }
-    return true;
-  }
-
-  void cancel_check_call_host(grpc_closure* /*on_call_host_checked*/,
-                              grpc_error* error) override {
-    GRPC_ERROR_UNREF(error);
+    return grpc_core::ImmediateOkStatus();
   }
 
  private:
@@ -134,9 +133,9 @@ class grpc_alts_channel_security_connector final
 class grpc_alts_server_security_connector final
     : public grpc_server_security_connector {
  public:
-  grpc_alts_server_security_connector(
+  explicit grpc_alts_server_security_connector(
       grpc_core::RefCountedPtr<grpc_server_credentials> server_creds)
-      : grpc_server_security_connector(GRPC_ALTS_URL_SCHEME,
+      : grpc_server_security_connector(GRPC_SSL_URL_SCHEME,
                                        std::move(server_creds)) {}
 
   ~grpc_alts_server_security_connector() override = default;
@@ -168,6 +167,11 @@ class grpc_alts_server_security_connector final
     alts_check_peer(peer, auth_context, on_peer_checked);
   }
 
+  void cancel_check_peer(grpc_closure* /*on_peer_checked*/,
+                         grpc_error_handle error) override {
+    GRPC_ERROR_UNREF(error);
+  }
+
   int cmp(const grpc_security_connector* other) const override {
     return server_security_connector_cmp(
         static_cast<const grpc_server_security_connector*>(other));
@@ -177,8 +181,8 @@ class grpc_alts_server_security_connector final
 
 namespace grpc_core {
 namespace internal {
-grpc_core::RefCountedPtr<grpc_auth_context>
-grpc_alts_auth_context_from_tsi_peer(const tsi_peer* peer) {
+RefCountedPtr<grpc_auth_context> grpc_alts_auth_context_from_tsi_peer(
+    const tsi_peer* peer) {
   if (peer == nullptr) {
     gpr_log(GPR_ERROR,
             "Invalid arguments to grpc_alts_auth_context_from_tsi_peer()");
@@ -233,7 +237,7 @@ grpc_alts_auth_context_from_tsi_peer(const tsi_peer* peer) {
     return nullptr;
   }
   /* Create auth context. */
-  auto ctx = grpc_core::MakeRefCounted<grpc_auth_context>(nullptr);
+  auto ctx = MakeRefCounted<grpc_auth_context>(nullptr);
   grpc_auth_context_add_cstring_property(
       ctx.get(), GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
       GRPC_ALTS_TRANSPORT_SECURITY_TYPE);

data/src/core/lib/security/security_connector/alts/alts_security_connector.h

@@ -23,9 +23,9 @@
 
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/alts/grpc_alts_credentials_options.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
 
 #define GRPC_ALTS_TRANSPORT_SECURITY_TYPE "alts"
-#define GRPC_ALTS_URL_SCHEME "https"
 
 /**
  * This method creates an ALTS channel security connector.
@@ -66,8 +66,8 @@ namespace grpc_core {
 namespace internal {
 
 /* Exposed only for testing. */
-grpc_core::RefCountedPtr<grpc_auth_context>
-grpc_alts_auth_context_from_tsi_peer(const tsi_peer* peer);
+RefCountedPtr<grpc_auth_context> grpc_alts_auth_context_from_tsi_peer(
+    const tsi_peer* peer);
 
 }  // namespace internal
 }  // namespace grpc_core