grpc 1.30.2 → 1.35.0

data/src/core/lib/security/security_connector/tls/tls_security_connector.h

@@ -23,13 +23,14 @@
 
 #include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 
 #define GRPC_TLS_TRANSPORT_SECURITY_TYPE "tls"
 
 namespace grpc_core {
 
-// TLS channel security connector.
+// Channel security connector using TLS as transport security protocol.
 class TlsChannelSecurityConnector final
     : public grpc_channel_security_connector {
  public:
@@ -37,14 +38,18 @@ class TlsChannelSecurityConnector final
   static grpc_core::RefCountedPtr<grpc_channel_security_connector>
   CreateTlsChannelSecurityConnector(
       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options> options,
       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
       const char* target_name, const char* overridden_target_name,
       tsi_ssl_session_cache* ssl_session_cache);
 
   TlsChannelSecurityConnector(
       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options> options,
       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-      const char* target_name, const char* overridden_target_name);
+      const char* target_name, const char* overridden_target_name,
+      tsi_ssl_session_cache* ssl_session_cache);
+
   ~TlsChannelSecurityConnector() override;
 
   void add_handshakers(const grpc_channel_args* args,
@@ -64,15 +69,44 @@ class TlsChannelSecurityConnector final
   void cancel_check_call_host(grpc_closure* on_call_host_checked,
                               grpc_error* error) override;
 
- private:
-  // Initialize SSL TSI client handshaker factory.
-  grpc_security_status InitializeHandshakerFactory(
-      tsi_ssl_session_cache* ssl_session_cache);
+  tsi_ssl_client_handshaker_factory* ClientHandshakerFactoryForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return client_handshaker_factory_;
+  };
 
-  // A util function to create a new client handshaker factory to replace
-  // the existing one if exists.
-  grpc_security_status ReplaceHandshakerFactory(
-      tsi_ssl_session_cache* ssl_session_cache);
+  absl::optional<absl::string_view> RootCertsForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return pem_root_certs_;
+  }
+
+  absl::optional<grpc_core::PemKeyCertPairList> KeyCertPairListForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return pem_key_cert_pair_list_;
+  }
+
+ private:
+  // A watcher that watches certificate updates from
+  // grpc_tls_certificate_distributor. It will never outlive
+  // |security_connector_|.
+  class TlsChannelCertificateWatcher : public grpc_tls_certificate_distributor::
+                                           TlsCertificatesWatcherInterface {
+   public:
+    explicit TlsChannelCertificateWatcher(
+        TlsChannelSecurityConnector* security_connector)
+        : security_connector_(security_connector) {}
+    void OnCertificatesChanged(
+        absl::optional<absl::string_view> root_certs,
+        absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) override;
+    void OnError(grpc_error* root_cert_error,
+                 grpc_error* identity_cert_error) override;
+
+   private:
+    TlsChannelSecurityConnector* security_connector_ = nullptr;
+  };
+
+  // Updates |client_handshaker_factory_| when the certificates that
+  // |certificate_watcher_| is watching get updated.
+  grpc_security_status UpdateHandshakerFactoryLocked();
 
   // gRPC-provided callback executed by application, which servers to bring the
   // control back to gRPC core.
@@ -91,29 +125,32 @@ class TlsChannelSecurityConnector final
   static void ServerAuthorizationCheckArgDestroy(
       grpc_tls_server_authorization_check_arg* arg);
 
-  // A util function to refresh SSL TSI client handshaker factory with a valid
-  // credential.
-  grpc_security_status RefreshHandshakerFactory();
-
   grpc_core::Mutex mu_;
-  grpc_closure* on_peer_checked_;
+  grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
+  grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
+      certificate_watcher_ = nullptr;
+  grpc_closure* on_peer_checked_ = nullptr;
   std::string target_name_;
   std::string overridden_target_name_;
   tsi_ssl_client_handshaker_factory* client_handshaker_factory_ = nullptr;
-  grpc_tls_server_authorization_check_arg* check_arg_;
-  grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
+  grpc_tls_server_authorization_check_arg* check_arg_ = nullptr;
+  tsi_ssl_session_cache* ssl_session_cache_ = nullptr;
+  absl::optional<absl::string_view> pem_root_certs_;
+  absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pair_list_;
 };
 
-// TLS server security connector.
+// Server security connector using TLS as transport security protocol.
 class TlsServerSecurityConnector final : public grpc_server_security_connector {
  public:
   // static factory method to create a TLS server security connector.
   static grpc_core::RefCountedPtr<grpc_server_security_connector>
   CreateTlsServerSecurityConnector(
-      grpc_core::RefCountedPtr<grpc_server_credentials> server_creds);
+      grpc_core::RefCountedPtr<grpc_server_credentials> server_creds,
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options> options);
 
-  explicit TlsServerSecurityConnector(
-      grpc_core::RefCountedPtr<grpc_server_credentials> server_creds);
+  TlsServerSecurityConnector(
+      grpc_core::RefCountedPtr<grpc_server_credentials> server_creds,
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options> options);
   ~TlsServerSecurityConnector() override;
 
   void add_handshakers(const grpc_channel_args* args,
@@ -126,58 +163,65 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
 
   int cmp(const grpc_security_connector* other) const override;
 
- private:
-  // Initialize SSL TSI server handshaker factory.
-  grpc_security_status InitializeHandshakerFactory();
+  tsi_ssl_server_handshaker_factory* ServerHandshakerFactoryForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return server_handshaker_factory_;
+  };
 
-  // A util function to create a new server handshaker factory to replace the
-  // existing once if exists.
-  grpc_security_status ReplaceHandshakerFactory();
+  const absl::optional<absl::string_view>& RootCertsForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return pem_root_certs_;
+  }
 
-  // A util function to refresh SSL TSI server handshaker factory with a valid
-  // credential.
-  grpc_security_status RefreshHandshakerFactory();
+  const absl::optional<grpc_core::PemKeyCertPairList>&
+  KeyCertPairListForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return pem_key_cert_pair_list_;
+  }
+
+ private:
+  // A watcher that watches certificate updates from
+  // grpc_tls_certificate_distributor. It will never outlive
+  // |security_connector_|.
+  class TlsServerCertificateWatcher : public grpc_tls_certificate_distributor::
+                                          TlsCertificatesWatcherInterface {
+   public:
+    explicit TlsServerCertificateWatcher(
+        TlsServerSecurityConnector* security_connector)
+        : security_connector_(security_connector) {}
+    void OnCertificatesChanged(
+        absl::optional<absl::string_view> root_certs,
+        absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) override;
+    void OnError(grpc_error* root_cert_error,
+                 grpc_error* identity_cert_error) override;
+
+   private:
+    TlsServerSecurityConnector* security_connector_ = nullptr;
+  };
+
+  // Updates |server_handshaker_factory_| when the certificates that
+  // |certificate_watcher_| is watching get updated.
+  grpc_security_status UpdateHandshakerFactoryLocked();
 
   grpc_core::Mutex mu_;
+  grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
+  grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
+      certificate_watcher_ = nullptr;
+
   tsi_ssl_server_handshaker_factory* server_handshaker_factory_ = nullptr;
-  grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
+  absl::optional<absl::string_view> pem_root_certs_;
+  absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pair_list_;
 };
 
 // ---- Functions below are exposed for testing only -----------------------
-
-/** The |TlsFetchKeyMaterials| API ensures that |key_materials_config| has a
- *  non-empty pem-key-cert pair list. This is done as follows:
- *  - if |options| is equipped with a credential reload config, then this
- *    methods uses credential reloading to populate |key_materials_config|, and
- *    afterwards it populates |reload_status| with the status of this operation.
- *    In particular, any data stored in |key_materials_config| is overwritten.
- *  - if |options| has no credential reload config, then:
- *    - if |key_materials_config| already has a non-empty pem-key-cert pair
- *      list or is called by a client, then the method returns |GRPC_STATUS_OK|.
- *    - if |key_materials_config| has an empty pem-key-cert pair list and is
- *      called by a server, then the method return an error code.
- *
- *  The arguments are detailed below:
- *  - key_materials_config: a key materials config that will be populated by the
- *    method on success; the caller should not pass in nullptr. Any data held by
- *    the config will be overwritten.
- *  - options: the TLS credentials options whose credential reloading config
- *    will be used to populate |key_materials_config|.
- *  - is_server: true denotes that this method is called by a server, and
- *    false denotes that this method is called by a client.
- *  - status: the status of the credential reloading after the method
- *    returns; the caller should not pass in nullptr. **/
-grpc_status_code TlsFetchKeyMaterials(
-    const grpc_core::RefCountedPtr<grpc_tls_key_materials_config>&
-        key_materials_config,
-    const grpc_tls_credentials_options& options, bool is_server,
-    grpc_ssl_certificate_config_reload_status* status);
+namespace internal {
 
 // TlsCheckHostName checks if |peer_name| matches the identity information
 // contained in |peer|. This is AKA hostname check.
 grpc_error* TlsCheckHostName(const char* peer_name, const tsi_peer* peer);
 
+}  // namespace internal
+
 }  // namespace grpc_core
 
-#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H \
-        */
+#endif  // GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H

data/src/core/lib/security/transport/client_auth_filter.cc

@@ -22,6 +22,10 @@
 
 #include <string.h>
 
+#include <string>
+
+#include "absl/strings/str_cat.h"
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
@@ -331,18 +335,15 @@ static void on_host_checked(void* arg, grpc_error* error) {
   if (error == GRPC_ERROR_NONE) {
     send_security_metadata(elem, batch);
   } else {
-    char* error_msg;
-    char* host = grpc_slice_to_c_string(calld->host);
-    gpr_asprintf(&error_msg, "Invalid host %s set in :authority metadata.",
-                 host);
-    gpr_free(host);
+    std::string error_msg = absl::StrCat(
+        "Invalid host ", grpc_core::StringViewFromSlice(calld->host),
+        " set in :authority metadata.");
     grpc_transport_stream_op_batch_finish_with_failure(
         batch,
-        grpc_error_set_int(GRPC_ERROR_CREATE_FROM_COPIED_STRING(error_msg),
-                           GRPC_ERROR_INT_GRPC_STATUS,
-                           GRPC_STATUS_UNAUTHENTICATED),
+        grpc_error_set_int(
+            GRPC_ERROR_CREATE_FROM_COPIED_STRING(error_msg.c_str()),
+            GRPC_ERROR_INT_GRPC_STATUS, GRPC_STATUS_UNAUTHENTICATED),
         calld->call_combiner);
-    gpr_free(error_msg);
   }
   GRPC_CALL_STACK_UNREF(calld->owning_call, "check_call_host");
 }

data/src/core/lib/security/transport/secure_endpoint.cc

@@ -401,11 +401,16 @@ static void endpoint_delete_from_pollset_set(grpc_endpoint* secure_ep,
   grpc_endpoint_delete_from_pollset_set(ep->wrapped_ep, pollset_set);
 }
 
-static char* endpoint_get_peer(grpc_endpoint* secure_ep) {
+static absl::string_view endpoint_get_peer(grpc_endpoint* secure_ep) {
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
   return grpc_endpoint_get_peer(ep->wrapped_ep);
 }
 
+static absl::string_view endpoint_get_local_address(grpc_endpoint* secure_ep) {
+  secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
+  return grpc_endpoint_get_local_address(ep->wrapped_ep);
+}
+
 static int endpoint_get_fd(grpc_endpoint* secure_ep) {
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
   return grpc_endpoint_get_fd(ep->wrapped_ep);
@@ -431,16 +436,17 @@ static const grpc_endpoint_vtable vtable = {endpoint_read,
                                             endpoint_destroy,
                                             endpoint_get_resource_user,
                                             endpoint_get_peer,
+                                            endpoint_get_local_address,
                                             endpoint_get_fd,
                                             endpoint_can_track_err};
 
 grpc_endpoint* grpc_secure_endpoint_create(
     struct tsi_frame_protector* protector,
     struct tsi_zero_copy_grpc_protector* zero_copy_protector,
-    grpc_endpoint* transport, grpc_slice* leftover_slices,
+    grpc_endpoint* to_wrap, grpc_slice* leftover_slices,
     size_t leftover_nslices) {
   secure_endpoint* ep =
-      new secure_endpoint(&vtable, protector, zero_copy_protector, transport,
+      new secure_endpoint(&vtable, protector, zero_copy_protector, to_wrap,
                           leftover_slices, leftover_nslices);
   return &ep->base;
 }

data/src/core/lib/security/transport/security_handshaker.cc

@@ -241,8 +241,8 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error* error) {
       handshaker_result_, &unused_bytes, &unused_bytes_size);
   // Create secure endpoint.
   if (unused_bytes_size > 0) {
-    grpc_slice slice =
-        grpc_slice_from_copied_buffer((char*)unused_bytes, unused_bytes_size);
+    grpc_slice slice = grpc_slice_from_copied_buffer(
+        reinterpret_cast<const char*>(unused_bytes), unused_bytes_size);
     args_->endpoint = grpc_secure_endpoint_create(
         protector, zero_copy_protector, args_->endpoint, &slice, 1);
     grpc_slice_unref_internal(slice);
@@ -499,7 +499,7 @@ class FailHandshaker : public Handshaker {
   }
 
  private:
-  virtual ~FailHandshaker() = default;
+  ~FailHandshaker() override = default;
 };
 
 //

data/src/core/lib/security/transport/server_auth_filter.cc

@@ -123,8 +123,9 @@ static grpc_filtered_mdelem remove_consumed_md(void* user_data,
   for (i = 0; i < calld->num_consumed_md; i++) {
     const grpc_metadata* consumed_md = &calld->consumed_md[i];
     if (grpc_slice_eq(GRPC_MDKEY(md), consumed_md->key) &&
-        grpc_slice_eq(GRPC_MDVALUE(md), consumed_md->value))
+        grpc_slice_eq(GRPC_MDVALUE(md), consumed_md->value)) {
       return GRPC_FILTERED_REMOVE();
+    }
   }
   return GRPC_FILTERED_MDELEM(md);
 }

data/src/core/lib/security/util/json_util.cc

@@ -18,14 +18,16 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/iomgr/error.h"
-#include "src/core/lib/security/util/json_util.h"
-
 #include <string.h>
 
+#include "absl/strings/str_cat.h"
+
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/security/util/json_util.h"
+
 const char* grpc_json_get_string_property(const grpc_core::Json& json,
                                           const char* prop_name,
                                           grpc_error** error) {
@@ -39,21 +41,18 @@ const char* grpc_json_get_string_property(const grpc_core::Json& json,
   auto it = json.object_value().find(prop_name);
   if (it == json.object_value().end()) {
     if (error != nullptr) {
-      char* error_msg;
-      gpr_asprintf(&error_msg, "Property %s not found in JSON object.",
-                   prop_name);
-      *error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(error_msg);
-      gpr_free(error_msg);
+      *error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrCat("Property ", prop_name, " not found in JSON object.")
+              .c_str());
     }
     return nullptr;
   }
   if (it->second.type() != grpc_core::Json::Type::STRING) {
     if (error != nullptr) {
-      char* error_msg;
-      gpr_asprintf(&error_msg, "Property %s in JSON object is not a string.",
-                   prop_name);
-      *error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(error_msg);
-      gpr_free(error_msg);
+      *error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrCat("Property ", prop_name,
+                       " n JSON object is not a string.")
+              .c_str());
     }
     return nullptr;
   }

data/src/core/lib/security/util/json_util.h

@@ -30,6 +30,7 @@
 #define GRPC_AUTH_JSON_TYPE_INVALID "invalid"
 #define GRPC_AUTH_JSON_TYPE_SERVICE_ACCOUNT "service_account"
 #define GRPC_AUTH_JSON_TYPE_AUTHORIZED_USER "authorized_user"
+#define GRPC_AUTH_JSON_TYPE_EXTERNAL_ACCOUNT "external_account"
 
 // Gets a child property from a json node.
 const char* grpc_json_get_string_property(const grpc_core::Json& json,

data/src/core/lib/slice/slice.cc

@@ -156,7 +156,7 @@ class NewWithLenSliceRefcount {
 /** grpc_slice_from_moved_(string|buffer) ref count .*/
 class MovedStringSliceRefCount {
  public:
-  MovedStringSliceRefCount(grpc_core::UniquePtr<char>&& str)
+  explicit MovedStringSliceRefCount(grpc_core::UniquePtr<char>&& str)
       : base_(grpc_slice_refcount::Type::REGULAR, &refs_, Destroy, this,
               &base_),
         str_(std::move(str)) {}
@@ -173,6 +173,26 @@ class MovedStringSliceRefCount {
   grpc_core::UniquePtr<char> str_;
 };
 
+// grpc_slice_from_cpp_string() ref count.
+class MovedCppStringSliceRefCount {
+ public:
+  explicit MovedCppStringSliceRefCount(std::string&& str)
+      : base_(grpc_slice_refcount::Type::REGULAR, &refs_, Destroy, this,
+              &base_),
+        str_(std::move(str)) {}
+
+  grpc_slice_refcount* base_refcount() { return &base_; }
+
+ private:
+  static void Destroy(void* arg) {
+    delete static_cast<MovedCppStringSliceRefCount*>(arg);
+  }
+
+  grpc_slice_refcount base_;
+  grpc_core::RefCount refs_;
+  std::string str_;
+};
+
 }  // namespace grpc_core
 
 grpc_slice grpc_slice_new_with_len(void* p, size_t len,
@@ -232,6 +252,23 @@ grpc_slice grpc_slice_from_moved_string(grpc_core::UniquePtr<char> p) {
   return grpc_slice_from_moved_buffer(std::move(p), len);
 }
 
+grpc_slice grpc_slice_from_cpp_string(std::string str) {
+  grpc_slice slice;
+  if (str.size() <= sizeof(slice.data.inlined.bytes)) {
+    slice.refcount = nullptr;
+    slice.data.inlined.length = str.size();
+    memcpy(GRPC_SLICE_START_PTR(slice), str.data(), str.size());
+  } else {
+    slice.data.refcounted.bytes =
+        reinterpret_cast<uint8_t*>(const_cast<char*>(str.data()));
+    slice.data.refcounted.length = str.size();
+    slice.refcount =
+        (new grpc_core::MovedCppStringSliceRefCount(std::move(str)))
+            ->base_refcount();
+  }
+  return slice;
+}
+
 namespace {
 
 class MallocRefCount {
@@ -518,8 +555,9 @@ int grpc_slice_buf_start_eq(grpc_slice a, const void* b, size_t len) {
 int grpc_slice_rchr(grpc_slice s, char c) {
   const char* b = reinterpret_cast<const char*> GRPC_SLICE_START_PTR(s);
   int i;
-  for (i = static_cast<int> GRPC_SLICE_LENGTH(s) - 1; i != -1 && b[i] != c; i--)
-    ;
+  for (i = static_cast<int> GRPC_SLICE_LENGTH(s) - 1; i != -1 && b[i] != c;
+       i--) {
+  }
   return i;
 }
 
@@ -537,10 +575,12 @@ int grpc_slice_slice(grpc_slice haystack, grpc_slice needle) {
 
   if (haystack_len == 0 || needle_len == 0) return -1;
   if (haystack_len < needle_len) return -1;
-  if (haystack_len == needle_len)
+  if (haystack_len == needle_len) {
     return grpc_slice_eq(haystack, needle) ? 0 : -1;
-  if (needle_len == 1)
+  }
+  if (needle_len == 1) {
     return grpc_slice_chr(haystack, static_cast<char>(*needle_bytes));
+  }
 
   const uint8_t* last = haystack_bytes + haystack_len - needle_len;
   for (const uint8_t* cur = haystack_bytes; cur != last; ++cur) {

data/src/core/lib/slice/slice_buffer.cc

@@ -106,8 +106,9 @@ uint8_t* grpc_slice_buffer_tiny_add(grpc_slice_buffer* sb, size_t n) {
   if (sb->count == 0) goto add_first;
   back = &sb->slices[sb->count - 1];
   if (back->refcount) goto add_new;
-  if ((back->data.inlined.length + n) > sizeof(back->data.inlined.bytes))
+  if ((back->data.inlined.length + n) > sizeof(back->data.inlined.bytes)) {
     goto add_new;
+  }
   out = back->data.inlined.bytes + back->data.inlined.length;
   back->data.inlined.length =
       static_cast<uint8_t>(back->data.inlined.length + n);

data/src/core/lib/slice/slice_intern.cc

@@ -74,8 +74,8 @@ InternedSliceRefcount::~InternedSliceRefcount() {
   InternedSliceRefcount* cur;
   for (prev_next = &shard->strs[TABLE_IDX(this->hash, shard->capacity)],
       cur = *prev_next;
-       cur != this; prev_next = &cur->bucket_next, cur = cur->bucket_next)
-    ;
+       cur != this; prev_next = &cur->bucket_next, cur = cur->bucket_next) {
+  }
   *prev_next = cur->bucket_next;
   shard->count--;
 }
@@ -273,17 +273,16 @@ grpc_core::ManagedMemorySlice::ManagedMemorySlice(const char* string)
     : grpc_core::ManagedMemorySlice::ManagedMemorySlice(string,
                                                         strlen(string)) {}
 
-grpc_core::ManagedMemorySlice::ManagedMemorySlice(const char* string,
-                                                  size_t len) {
+grpc_core::ManagedMemorySlice::ManagedMemorySlice(const char* buf, size_t len) {
   GPR_TIMER_SCOPE("grpc_slice_intern", 0);
-  const uint32_t hash = gpr_murmur_hash3(string, len, g_hash_seed);
+  const uint32_t hash = gpr_murmur_hash3(buf, len, g_hash_seed);
   const StaticMetadataSlice* static_slice =
-      MatchStaticSlice(hash, std::pair<const char*, size_t>(string, len));
+      MatchStaticSlice(hash, std::pair<const char*, size_t>(buf, len));
   if (static_slice) {
     *this = *static_slice;
   } else {
     *this = grpc_core::InternedSlice(FindOrCreateInternedSlice(
-        hash, std::pair<const char*, size_t>(string, len)));
+        hash, std::pair<const char*, size_t>(buf, len)));
   }
 }
 

data/src/core/lib/slice/slice_internal.h

@@ -176,7 +176,7 @@ namespace grpc_core {
 struct StaticSliceRefcount {
   static grpc_slice_refcount kStaticSubRefcount;
 
-  StaticSliceRefcount(uint32_t index)
+  explicit StaticSliceRefcount(uint32_t index)
       : base(&kStaticSubRefcount, grpc_slice_refcount::Type::STATIC),
         index(index) {}
 
@@ -310,7 +310,7 @@ inline bool grpc_slice_static_interned_equal(const grpc_slice& a,
 
 void grpc_slice_intern_init(void);
 void grpc_slice_intern_shutdown(void);
-void grpc_test_only_set_slice_hash_seed(uint32_t key);
+void grpc_test_only_set_slice_hash_seed(uint32_t seed);
 // if slice matches a static slice, returns the static slice
 // otherwise returns the passed in slice (without reffing it)
 // used for surface boundaries where we might receive an un-interned static
@@ -338,6 +338,7 @@ inline uint32_t grpc_slice_hash_internal(const grpc_slice& s) {
 grpc_slice grpc_slice_from_moved_buffer(grpc_core::UniquePtr<char> p,
                                         size_t len);
 grpc_slice grpc_slice_from_moved_string(grpc_core::UniquePtr<char> p);
+grpc_slice grpc_slice_from_cpp_string(std::string str);
 
 // Returns the memory used by this slice, not counting the slice structure
 // itself. This means that inlined and slices from static strings will return