grpc 1.30.2 → 1.35.0

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc

@@ -27,49 +27,7 @@
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
-/** -- gRPC TLS key materials config API implementation. -- **/
-void grpc_tls_key_materials_config::set_key_materials(
-    const char* pem_root_certs,
-    const grpc_ssl_pem_key_cert_pair** pem_key_cert_pairs,
-    size_t num_key_cert_pairs) {
-  this->set_pem_root_certs(pem_root_certs);
-  grpc_tls_key_materials_config::PemKeyCertPairList cert_pair_list;
-  for (size_t i = 0; i < num_key_cert_pairs; i++) {
-    auto current_pair = static_cast<grpc_ssl_pem_key_cert_pair*>(
-        gpr_zalloc(sizeof(grpc_ssl_pem_key_cert_pair)));
-    current_pair->cert_chain = gpr_strdup(pem_key_cert_pairs[i]->cert_chain);
-    current_pair->private_key = gpr_strdup(pem_key_cert_pairs[i]->private_key);
-    cert_pair_list.emplace_back(grpc_core::PemKeyCertPair(current_pair));
-  }
-  pem_key_cert_pair_list_ = std::move(cert_pair_list);
-}
-
-void grpc_tls_key_materials_config::set_key_materials(
-    const char* pem_root_certs,
-    const PemKeyCertPairList& pem_key_cert_pair_list) {
-  this->set_pem_root_certs(pem_root_certs);
-  grpc_tls_key_materials_config::PemKeyCertPairList dup_list(
-      pem_key_cert_pair_list);
-  pem_key_cert_pair_list_ = std::move(dup_list);
-}
-
-/** -- gRPC TLS credential reload config API implementation. -- **/
-grpc_tls_credential_reload_config::grpc_tls_credential_reload_config(
-    const void* config_user_data,
-    int (*schedule)(void* config_user_data,
-                    grpc_tls_credential_reload_arg* arg),
-    void (*cancel)(void* config_user_data, grpc_tls_credential_reload_arg* arg),
-    void (*destruct)(void* config_user_data))
-    : config_user_data_(const_cast<void*>(config_user_data)),
-      schedule_(schedule),
-      cancel_(cancel),
-      destruct_(destruct) {}
-
-grpc_tls_credential_reload_config::~grpc_tls_credential_reload_config() {
-  if (destruct_ != nullptr) {
-    destruct_((void*)config_user_data_);
-  }
-}
+#include "src/core/lib/surface/api_trace.h"
 
 /** -- gRPC TLS server authorization check API implementation. -- **/
 grpc_tls_server_authorization_check_config::
@@ -88,142 +46,103 @@ grpc_tls_server_authorization_check_config::
 grpc_tls_server_authorization_check_config::
     ~grpc_tls_server_authorization_check_config() {
   if (destruct_ != nullptr) {
-    destruct_((void*)config_user_data_);
+    destruct_(config_user_data_);
   }
 }
 
+int grpc_tls_server_authorization_check_config::Schedule(
+    grpc_tls_server_authorization_check_arg* arg) const {
+  if (schedule_ == nullptr) {
+    gpr_log(GPR_ERROR, "schedule API is nullptr");
+    if (arg != nullptr) {
+      arg->status = GRPC_STATUS_NOT_FOUND;
+      arg->error_details->set_error_details(
+          "schedule API in server authorization check config is nullptr");
+    }
+    return 1;
+  }
+  if (arg != nullptr && context_ != nullptr) {
+    arg->config = const_cast<grpc_tls_server_authorization_check_config*>(this);
+  }
+  return schedule_(config_user_data_, arg);
+}
+
+void grpc_tls_server_authorization_check_config::Cancel(
+    grpc_tls_server_authorization_check_arg* arg) const {
+  if (cancel_ == nullptr) {
+    gpr_log(GPR_ERROR, "cancel API is nullptr.");
+    if (arg != nullptr) {
+      arg->status = GRPC_STATUS_NOT_FOUND;
+      arg->error_details->set_error_details(
+          "schedule API in server authorization check config is nullptr");
+    }
+    return;
+  }
+  if (arg != nullptr) {
+    arg->config = const_cast<grpc_tls_server_authorization_check_config*>(this);
+  }
+  cancel_(config_user_data_, arg);
+}
+
 /** -- Wrapper APIs declared in grpc_security.h -- **/
+
 grpc_tls_credentials_options* grpc_tls_credentials_options_create() {
   return new grpc_tls_credentials_options();
 }
 
-int grpc_tls_credentials_options_set_cert_request_type(
+void grpc_tls_credentials_options_set_cert_request_type(
     grpc_tls_credentials_options* options,
     grpc_ssl_client_certificate_request_type type) {
-  if (options == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid nullptr arguments to "
-            "grpc_tls_credentials_options_set_cert_request_type()");
-    return 0;
-  }
+  GPR_ASSERT(options != nullptr);
   options->set_cert_request_type(type);
-  return 1;
 }
 
-int grpc_tls_credentials_options_set_server_verification_option(
+void grpc_tls_credentials_options_set_server_verification_option(
     grpc_tls_credentials_options* options,
     grpc_tls_server_verification_option server_verification_option) {
-  if (options == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid nullptr arguments to "
-            "grpc_tls_credentials_options_set_server_verification_option()");
-    return 0;
-  }
-  if (server_verification_option != GRPC_TLS_SERVER_VERIFICATION &&
-      options->server_authorization_check_config() == nullptr) {
-    gpr_log(GPR_ERROR,
-            "server_authorization_check_config needs to be specified when"
-            "server_verification_option is not GRPC_TLS_SERVER_VERIFICATION");
-    return 0;
-  }
+  GPR_ASSERT(options != nullptr);
   options->set_server_verification_option(server_verification_option);
-  return 1;
 }
 
-int grpc_tls_credentials_options_set_key_materials_config(
+void grpc_tls_credentials_options_set_certificate_provider(
     grpc_tls_credentials_options* options,
-    grpc_tls_key_materials_config* config) {
-  if (options == nullptr || config == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid nullptr arguments to "
-            "grpc_tls_credentials_options_set_key_materials_config()");
-    return 0;
-  }
-  options->set_key_materials_config(config->Ref());
-  return 1;
+    grpc_tls_certificate_provider* provider) {
+  GPR_ASSERT(options != nullptr);
+  GPR_ASSERT(provider != nullptr);
+  options->set_certificate_provider(
+      provider->Ref(DEBUG_LOCATION, "set_certificate_provider"));
 }
 
-int grpc_tls_credentials_options_set_credential_reload_config(
-    grpc_tls_credentials_options* options,
-    grpc_tls_credential_reload_config* config) {
-  if (options == nullptr || config == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid nullptr arguments to "
-            "grpc_tls_credentials_options_set_credential_reload_config()");
-    return 0;
-  }
-  options->set_credential_reload_config(config->Ref());
-  return 1;
+void grpc_tls_credentials_options_watch_root_certs(
+    grpc_tls_credentials_options* options) {
+  GPR_ASSERT(options != nullptr);
+  options->set_watch_root_cert(true);
 }
 
-int grpc_tls_credentials_options_set_server_authorization_check_config(
-    grpc_tls_credentials_options* options,
-    grpc_tls_server_authorization_check_config* config) {
-  if (options == nullptr || config == nullptr) {
-    gpr_log(
-        GPR_ERROR,
-        "Invalid nullptr arguments to "
-        "grpc_tls_credentials_options_set_server_authorization_check_config()");
-    return 0;
-  }
-  options->set_server_authorization_check_config(config->Ref());
-  return 1;
+void grpc_tls_credentials_options_set_root_cert_name(
+    grpc_tls_credentials_options* options, const char* root_cert_name) {
+  GPR_ASSERT(options != nullptr);
+  options->set_root_cert_name(root_cert_name);
 }
 
-grpc_tls_key_materials_config* grpc_tls_key_materials_config_create() {
-  return new grpc_tls_key_materials_config();
+void grpc_tls_credentials_options_watch_identity_key_cert_pairs(
+    grpc_tls_credentials_options* options) {
+  GPR_ASSERT(options != nullptr);
+  options->set_watch_identity_pair(true);
 }
 
-int grpc_tls_key_materials_config_set_key_materials(
-    grpc_tls_key_materials_config* config, const char* root_certs,
-    const grpc_ssl_pem_key_cert_pair** key_cert_pairs, size_t num) {
-  if (config == nullptr || key_cert_pairs == nullptr || num == 0) {
-    gpr_log(GPR_ERROR,
-            "Invalid arguments to "
-            "grpc_tls_key_materials_config_set_key_materials()");
-    return 0;
-  }
-  config->set_key_materials(root_certs, key_cert_pairs, num);
-  return 1;
+void grpc_tls_credentials_options_set_identity_cert_name(
+    grpc_tls_credentials_options* options, const char* identity_cert_name) {
+  GPR_ASSERT(options != nullptr);
+  options->set_identity_cert_name(identity_cert_name);
 }
 
-int grpc_tls_key_materials_config_set_version(
-    grpc_tls_key_materials_config* config, int version) {
-  if (config == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid arguments to "
-            "grpc_tls_key_materials_config_set_version()");
-    return 0;
-  }
-  config->set_version(version);
-  return 1;
-}
-
-int grpc_tls_key_materials_config_get_version(
-    grpc_tls_key_materials_config* config) {
-  if (config == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid arguments to "
-            "grpc_tls_key_materials_config_get_version()");
-    return -1;
-  }
-  return config->version();
-}
-
-grpc_tls_credential_reload_config* grpc_tls_credential_reload_config_create(
-    const void* config_user_data,
-    int (*schedule)(void* config_user_data,
-                    grpc_tls_credential_reload_arg* arg),
-    void (*cancel)(void* config_user_data, grpc_tls_credential_reload_arg* arg),
-    void (*destruct)(void* config_user_data)) {
-  if (schedule == nullptr) {
-    gpr_log(
-        GPR_ERROR,
-        "Schedule API is nullptr in creating TLS credential reload config.");
-    return nullptr;
-  }
-  return new grpc_tls_credential_reload_config(config_user_data, schedule,
-                                               cancel, destruct);
+void grpc_tls_credentials_options_set_server_authorization_check_config(
+    grpc_tls_credentials_options* options,
+    grpc_tls_server_authorization_check_config* config) {
+  GPR_ASSERT(options != nullptr);
+  GPR_ASSERT(config != nullptr);
+  options->set_server_authorization_check_config(config->Ref());
 }
 
 grpc_tls_server_authorization_check_config*
@@ -243,3 +162,12 @@ grpc_tls_server_authorization_check_config_create(
   return new grpc_tls_server_authorization_check_config(
       config_user_data, schedule, cancel, destruct);
 }
+
+void grpc_tls_server_authorization_check_config_release(
+    grpc_tls_server_authorization_check_config* config) {
+  GRPC_API_TRACE(
+      "grpc_tls_server_authorization_check_config_release(config=%p)", 1,
+      (config));
+  grpc_core::ExecCtx exec_ctx;
+  if (config != nullptr) config->Unref();
+}

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -26,6 +26,8 @@
 #include "absl/container/inlined_vector.h"
 
 #include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 
 struct grpc_tls_error_details
@@ -41,126 +43,6 @@ struct grpc_tls_error_details
   std::string error_details_;
 };
 
-/** TLS key materials config. **/
-struct grpc_tls_key_materials_config
-    : public grpc_core::RefCounted<grpc_tls_key_materials_config> {
- public:
-  typedef absl::InlinedVector<grpc_core::PemKeyCertPair, 1> PemKeyCertPairList;
-
-  /** Getters for member fields. **/
-  const char* pem_root_certs() const { return pem_root_certs_.get(); }
-  const PemKeyCertPairList& pem_key_cert_pair_list() const {
-    return pem_key_cert_pair_list_;
-  }
-  int version() const { return version_; }
-
-  /** Setters for member fields. **/
-  // TODO(ZhenLian): Remove this function
-  void set_pem_root_certs(grpc_core::UniquePtr<char> pem_root_certs) {
-    pem_root_certs_ = std::move(pem_root_certs);
-  }
-  // The ownerships of |pem_root_certs| remain with the caller.
-  void set_pem_root_certs(const char* pem_root_certs) {
-    // make a copy of pem_root_certs.
-    grpc_core::UniquePtr<char> pem_root_ptr(gpr_strdup(pem_root_certs));
-    pem_root_certs_ = std::move(pem_root_ptr);
-  }
-  void add_pem_key_cert_pair(grpc_core::PemKeyCertPair pem_key_cert_pair) {
-    pem_key_cert_pair_list_.push_back(pem_key_cert_pair);
-  }
-  // The ownerships of |pem_root_certs| and |pem_key_cert_pairs| remain with the
-  // caller.
-  void set_key_materials(const char* pem_root_certs,
-                         const grpc_ssl_pem_key_cert_pair** pem_key_cert_pairs,
-                         size_t num_key_cert_pairs);
-  // The ownerships of |pem_root_certs| and |pem_key_cert_pair_list| remain with
-  // the caller.
-  void set_key_materials(const char* pem_root_certs,
-                         const PemKeyCertPairList& pem_key_cert_pair_list);
-  void set_version(int version) { version_ = version; }
-
- private:
-  int version_ = 0;
-  PemKeyCertPairList pem_key_cert_pair_list_;
-  grpc_core::UniquePtr<char> pem_root_certs_;
-};
-
-/** TLS credential reload config. **/
-struct grpc_tls_credential_reload_config
-    : public grpc_core::RefCounted<grpc_tls_credential_reload_config> {
- public:
-  grpc_tls_credential_reload_config(
-      const void* config_user_data,
-      int (*schedule)(void* config_user_data,
-                      grpc_tls_credential_reload_arg* arg),
-      void (*cancel)(void* config_user_data,
-                     grpc_tls_credential_reload_arg* arg),
-      void (*destruct)(void* config_user_data));
-  ~grpc_tls_credential_reload_config();
-
-  void* context() const { return context_; }
-  void set_context(void* context) { context_ = context; }
-
-  int Schedule(grpc_tls_credential_reload_arg* arg) const {
-    if (schedule_ == nullptr) {
-      gpr_log(GPR_ERROR, "schedule API is nullptr");
-      if (arg != nullptr) {
-        arg->status = GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_FAIL;
-        arg->error_details->set_error_details(
-            "schedule API in credential reload config is nullptr");
-      }
-      return 1;
-    }
-    if (arg != nullptr) {
-      arg->config = const_cast<grpc_tls_credential_reload_config*>(this);
-    }
-    return schedule_(config_user_data_, arg);
-  }
-  void Cancel(grpc_tls_credential_reload_arg* arg) const {
-    if (cancel_ == nullptr) {
-      gpr_log(GPR_ERROR, "cancel API is nullptr.");
-      if (arg != nullptr) {
-        arg->status = GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_FAIL;
-        arg->error_details->set_error_details(
-            "cancel API in credential reload config is nullptr");
-      }
-      return;
-    }
-    if (arg != nullptr) {
-      arg->config = const_cast<grpc_tls_credential_reload_config*>(this);
-    }
-    cancel_(config_user_data_, arg);
-  }
-
- private:
-  /** This is a pointer to the wrapped language implementation of
-   * grpc_tls_credential_reload_config. It is necessary to implement the C
-   * schedule and cancel functions, given the schedule or cancel function in a
-   * wrapped language. **/
-  void* context_ = nullptr;
-  /** config-specific, read-only user data that works for all channels created
-     with a credential using the config. */
-  void* config_user_data_;
-  /** callback function for invoking credential reload API. The implementation
-     of this method has to be non-blocking, but can be performed synchronously
-     or asynchronously.
-     If processing occurs synchronously, it populates \a arg->key_materials, \a
-     arg->status, and \a arg->error_details and returns zero.
-     If processing occurs asynchronously, it returns a non-zero value.
-     Application then invokes \a arg->cb when processing is completed. Note that
-     \a arg->cb cannot be invoked before \a schedule returns.
-  */
-  int (*schedule_)(void* config_user_data, grpc_tls_credential_reload_arg* arg);
-  /** callback function for cancelling a credential reload request scheduled via
-     an asynchronous \a schedule. \a arg is used to pinpoint an exact reloading
-     request to be cancelled, and the operation may not have any effect if the
-     request has already been processed. */
-  void (*cancel_)(void* config_user_data, grpc_tls_credential_reload_arg* arg);
-  /** callback function for cleaning up any data associated with credential
-     reload config. */
-  void (*destruct_)(void* config_user_data);
-};
-
 /** TLS server authorization check config. **/
 struct grpc_tls_server_authorization_check_config
     : public grpc_core::RefCounted<grpc_tls_server_authorization_check_config> {
@@ -172,43 +54,15 @@ struct grpc_tls_server_authorization_check_config
       void (*cancel)(void* config_user_data,
                      grpc_tls_server_authorization_check_arg* arg),
       void (*destruct)(void* config_user_data));
-  ~grpc_tls_server_authorization_check_config();
+  ~grpc_tls_server_authorization_check_config() override;
 
   void* context() const { return context_; }
+
   void set_context(void* context) { context_ = context; }
 
-  int Schedule(grpc_tls_server_authorization_check_arg* arg) const {
-    if (schedule_ == nullptr) {
-      gpr_log(GPR_ERROR, "schedule API is nullptr");
-      if (arg != nullptr) {
-        arg->status = GRPC_STATUS_NOT_FOUND;
-        arg->error_details->set_error_details(
-            "schedule API in server authorization check config is nullptr");
-      }
-      return 1;
-    }
-    if (arg != nullptr && context_ != nullptr) {
-      arg->config =
-          const_cast<grpc_tls_server_authorization_check_config*>(this);
-    }
-    return schedule_(config_user_data_, arg);
-  }
-  void Cancel(grpc_tls_server_authorization_check_arg* arg) const {
-    if (cancel_ == nullptr) {
-      gpr_log(GPR_ERROR, "cancel API is nullptr.");
-      if (arg != nullptr) {
-        arg->status = GRPC_STATUS_NOT_FOUND;
-        arg->error_details->set_error_details(
-            "schedule API in server authorization check config is nullptr");
-      }
-      return;
-    }
-    if (arg != nullptr) {
-      arg->config =
-          const_cast<grpc_tls_server_authorization_check_config*>(this);
-    }
-    cancel_(config_user_data_, arg);
-  }
+  int Schedule(grpc_tls_server_authorization_check_arg* arg) const;
+
+  void Cancel(grpc_tls_server_authorization_check_arg* arg) const;
 
  private:
   /** This is a pointer to the wrapped language implementation of
@@ -241,41 +95,38 @@ struct grpc_tls_server_authorization_check_config
   void (*destruct_)(void* config_user_data);
 };
 
-/* TLS credentials options. */
+// Contains configurable options specified by callers to configure their certain
+// security features supported in TLS.
+// TODO(ZhenLian): consider making this not ref-counted.
 struct grpc_tls_credentials_options
     : public grpc_core::RefCounted<grpc_tls_credentials_options> {
  public:
-  ~grpc_tls_credentials_options() {
-    if (key_materials_config_.get() != nullptr) {
-      key_materials_config_.get()->Unref();
-    }
-    if (credential_reload_config_.get() != nullptr) {
-      credential_reload_config_.get()->Unref();
-    }
-    if (server_authorization_check_config_.get() != nullptr) {
-      server_authorization_check_config_.get()->Unref();
-    }
-  }
+  ~grpc_tls_credentials_options() override = default;
 
-  /* Getters for member fields. */
+  // Getters for member fields.
   grpc_ssl_client_certificate_request_type cert_request_type() const {
     return cert_request_type_;
   }
   grpc_tls_server_verification_option server_verification_option() const {
     return server_verification_option_;
   }
-  grpc_tls_key_materials_config* key_materials_config() const {
-    return key_materials_config_.get();
-  }
-  grpc_tls_credential_reload_config* credential_reload_config() const {
-    return credential_reload_config_.get();
-  }
+  grpc_tls_version min_tls_version() const { return min_tls_version_; }
+  grpc_tls_version max_tls_version() const { return max_tls_version_; }
   grpc_tls_server_authorization_check_config*
   server_authorization_check_config() const {
     return server_authorization_check_config_.get();
   }
+  // Returns the distributor from provider_ if it is set, nullptr otherwise.
+  grpc_tls_certificate_distributor* certificate_distributor() {
+    if (provider_ != nullptr) return provider_->distributor().get();
+    return nullptr;
+  }
+  bool watch_root_cert() { return watch_root_cert_; }
+  const std::string& root_cert_name() { return root_cert_name_; }
+  bool watch_identity_pair() { return watch_identity_pair_; }
+  const std::string& identity_cert_name() { return identity_cert_name_; }
 
-  /* Setters for member fields. */
+  // Setters for member fields.
   void set_cert_request_type(
       const grpc_ssl_client_certificate_request_type type) {
     cert_request_type_ = type;
@@ -284,30 +135,59 @@ struct grpc_tls_credentials_options
       const grpc_tls_server_verification_option server_verification_option) {
     server_verification_option_ = server_verification_option;
   }
-  void set_key_materials_config(
-      grpc_core::RefCountedPtr<grpc_tls_key_materials_config> config) {
-    key_materials_config_ = std::move(config);
+  void set_min_tls_version(grpc_tls_version min_tls_version) {
+    min_tls_version_ = min_tls_version;
   }
-  void set_credential_reload_config(
-      grpc_core::RefCountedPtr<grpc_tls_credential_reload_config> config) {
-    credential_reload_config_ = std::move(config);
+  void set_max_tls_version(grpc_tls_version max_tls_version) {
+    max_tls_version_ = max_tls_version;
   }
   void set_server_authorization_check_config(
       grpc_core::RefCountedPtr<grpc_tls_server_authorization_check_config>
           config) {
     server_authorization_check_config_ = std::move(config);
   }
+  // Sets the provider in the options.
+  void set_certificate_provider(
+      grpc_core::RefCountedPtr<grpc_tls_certificate_provider> provider) {
+    provider_ = std::move(provider);
+  }
+  // If need to watch the updates of root certificates with name
+  // |root_cert_name|. The default value is false. If used in tls_credentials,
+  // it should always be set to true unless the root certificates are not
+  // needed.
+  void set_watch_root_cert(bool watch) { watch_root_cert_ = watch; }
+  // Sets the name of root certificates being watched, if |set_watch_root_cert|
+  // is called. If not set, an empty string will be used as the name.
+  void set_root_cert_name(std::string root_cert_name) {
+    root_cert_name_ = std::move(root_cert_name);
+  }
+  // If need to watch the updates of identity certificates with name
+  // |identity_cert_name|.
+  // The default value is false.
+  // If used in tls_credentials, it should always be set to true
+  // unless the identity key-cert pairs are not needed.
+  void set_watch_identity_pair(bool watch) { watch_identity_pair_ = watch; }
+  // Sets the name of identity key-cert pairs being watched, if
+  // |set_watch_identity_pair| is called. If not set, an empty string will
+  // be used as the name.
+  void set_identity_cert_name(std::string identity_cert_name) {
+    identity_cert_name_ = std::move(identity_cert_name);
+  }
 
  private:
-  grpc_ssl_client_certificate_request_type cert_request_type_;
+  grpc_ssl_client_certificate_request_type cert_request_type_ =
+      GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE;
   grpc_tls_server_verification_option server_verification_option_ =
       GRPC_TLS_SERVER_VERIFICATION;
-  grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
-  grpc_core::RefCountedPtr<grpc_tls_credential_reload_config>
-      credential_reload_config_;
+  grpc_tls_version min_tls_version_ = grpc_tls_version::TLS1_2;
+  grpc_tls_version max_tls_version_ = grpc_tls_version::TLS1_3;
   grpc_core::RefCountedPtr<grpc_tls_server_authorization_check_config>
       server_authorization_check_config_;
+  grpc_core::RefCountedPtr<grpc_tls_certificate_provider> provider_;
+  bool watch_root_cert_ = false;
+  std::string root_cert_name_;
+  bool watch_identity_pair_ = false;
+  std::string identity_cert_name_;
 };
 
-#endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H \
-        */
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H

data/src/core/lib/security/credentials/tls/tls_credentials.cc

@@ -40,18 +40,18 @@ bool CredentialOptionSanityCheck(const grpc_tls_credentials_options* options,
     gpr_log(GPR_ERROR, "TLS credentials options is nullptr.");
     return false;
   }
-  if (options->key_materials_config() == nullptr &&
-      options->credential_reload_config() == nullptr) {
-    gpr_log(GPR_ERROR,
-            "TLS credentials options must specify either key materials or "
-            "credential reload config.");
-    return false;
-  }
+  // TODO(ZhenLian): remove this when it is also supported on server side.
   if (!is_client && options->server_authorization_check_config() != nullptr) {
     gpr_log(GPR_INFO,
             "Server's credentials options should not contain server "
             "authorization check config.");
   }
+  if (options->server_verification_option() != GRPC_TLS_SERVER_VERIFICATION &&
+      options->server_authorization_check_config() == nullptr) {
+    gpr_log(GPR_ERROR,
+            "Should provider custom verifications if bypassing default ones.");
+    return false;
+  }
   return true;
 }
 
@@ -85,14 +85,16 @@ TlsCredentials::create_security_connector(
   }
   grpc_core::RefCountedPtr<grpc_channel_security_connector> sc =
       grpc_core::TlsChannelSecurityConnector::CreateTlsChannelSecurityConnector(
-          this->Ref(), std::move(call_creds), target_name,
+          this->Ref(), options_, std::move(call_creds), target_name,
           overridden_target_name, ssl_session_cache);
   if (sc == nullptr) {
     return nullptr;
   }
-  grpc_arg new_arg = grpc_channel_arg_string_create(
-      (char*)GRPC_ARG_HTTP2_SCHEME, (char*)"https");
-  *new_args = grpc_channel_args_copy_and_add(args, &new_arg, 1);
+  if (args != nullptr) {
+    grpc_arg new_arg = grpc_channel_arg_string_create(
+        const_cast<char*>(GRPC_ARG_HTTP2_SCHEME), const_cast<char*>("https"));
+    *new_args = grpc_channel_args_copy_and_add(args, &new_arg, 1);
+  }
   return sc;
 }
 
@@ -106,9 +108,11 @@ TlsServerCredentials::~TlsServerCredentials() {}
 grpc_core::RefCountedPtr<grpc_server_security_connector>
 TlsServerCredentials::create_security_connector() {
   return grpc_core::TlsServerSecurityConnector::
-      CreateTlsServerSecurityConnector(this->Ref());
+      CreateTlsServerSecurityConnector(this->Ref(), options_);
 }
 
+/** -- Wrapper APIs declared in grpc_security.h -- **/
+
 grpc_channel_credentials* grpc_tls_credentials_create(
     grpc_tls_credentials_options* options) {
   if (!CredentialOptionSanityCheck(options, true /* is_client */)) {

data/src/core/lib/security/credentials/tls/tls_credentials.h

@@ -38,7 +38,7 @@ class TlsCredentials final : public grpc_channel_credentials {
       const char* target_name, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
-  const grpc_tls_credentials_options& options() const { return *options_; }
+  grpc_tls_credentials_options* options() const { return options_.get(); }
 
  private:
   grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
@@ -53,7 +53,7 @@ class TlsServerCredentials final : public grpc_server_credentials {
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector() override;
 
-  const grpc_tls_credentials_options& options() const { return *options_; }
+  grpc_tls_credentials_options* options() const { return options_.get(); }
 
  private:
   grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;