grpc 1.31.0.pre1 → 1.33.0.pre1

data/src/core/lib/security/authorization/mock_cel/statusor.h

@@ -0,0 +1,50 @@
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_STATUSOR_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_STATUSOR_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+
+#include "absl/status/status.h"
+
+namespace grpc_core {
+namespace mock_cel {
+
+// This is a temporary stub implementation of CEL APIs.
+// Once gRPC imports the CEL library, this file will be removed.
+
+template <typename T>
+class ABSL_MUST_USE_RESULT StatusOr;
+
+template <typename T>
+class StatusOr {
+ public:
+  StatusOr() = default;
+
+  StatusOr(const T& value) {}
+
+  StatusOr(const absl::Status& status) {}
+
+  StatusOr(absl::Status&& status) {}
+
+  bool ok() const { return true; }
+};
+
+}  // namespace mock_cel
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_STATUSOR_H

data/src/core/lib/security/certificate_provider.h

@@ -0,0 +1,60 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CERTIFICATE_PROVIDER_H
+#define GRPC_CORE_LIB_SECURITY_CERTIFICATE_PROVIDER_H
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/pollset_set.h"
+
+// TODO(yashkt): After https://github.com/grpc/grpc/pull/23572, remove this
+// forward declaration and include the header for the distributor instead.
+struct grpc_tls_certificate_distributor;
+
+// Interface for a grpc_tls_certificate_provider that handles the process to
+// fetch credentials and validation contexts. Implementations are free to rely
+// on local or remote sources to fetch the latest secrets, and free to share any
+// state among different instances as they deem fit.
+//
+// On creation, grpc_tls_certificate_provider creates a
+// grpc_tls_certificate_distributor object. When the credentials and validation
+// contexts become valid or changed, a grpc_tls_certificate_provider should
+// notify its distributor so as to propagate the update to the watchers.
+struct grpc_tls_certificate_provider
+    : public grpc_core::RefCounted<grpc_tls_certificate_provider> {
+ public:
+  grpc_tls_certificate_provider()
+      : interested_parties_(grpc_pollset_set_create()) {}
+
+  virtual ~grpc_tls_certificate_provider() {
+    grpc_pollset_set_destroy(interested_parties_);
+  }
+
+  grpc_pollset_set* interested_parties() const { return interested_parties_; }
+
+  virtual grpc_core::RefCountedPtr<grpc_tls_certificate_distributor>
+  distributor() const = 0;
+
+ private:
+  grpc_pollset_set* interested_parties_;
+};
+
+#endif  // GRPC_CORE_LIB_SECURITY_CERTIFICATE_PROVIDER_H

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -49,6 +49,8 @@ using grpc_core::Json;
 /* -- Constants. -- */
 
 #define GRPC_COMPUTE_ENGINE_DETECTION_HOST "metadata.google.internal."
+#define GRPC_GOOGLE_CREDENTIAL_CREATION_ERROR \
+  "Failed to create Google credentials"
 
 /* -- Default credentials. -- */
 
@@ -57,7 +59,6 @@ using grpc_core::Json;
  * means the detection is done via network test that is unreliable and the
  * unreliable result should not be referred by successive calls. */
 static int g_metadata_server_available = 0;
-static int g_is_on_gce = 0;
 static gpr_mu g_state_mu;
 /* Protect a metadata_server_detector instance that can be modified by more than
  * one gRPC threads */
@@ -89,7 +90,7 @@ grpc_google_default_channel_credentials::create_security_connector(
   bool use_alts =
       is_grpclb_load_balancer || is_backend_from_grpclb_load_balancer;
   /* Return failure if ALTS is selected but not running on GCE. */
-  if (use_alts && !g_is_on_gce) {
+  if (use_alts && alts_creds_ == nullptr) {
     gpr_log(GPR_ERROR, "ALTS is selected, but not running on GCE.");
     return nullptr;
   }
@@ -273,59 +274,78 @@ end:
   return error;
 }
 
-grpc_channel_credentials* grpc_google_default_credentials_create() {
-  grpc_channel_credentials* result = nullptr;
-  grpc_core::RefCountedPtr<grpc_call_credentials> call_creds;
-  grpc_error* error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-      "Failed to create Google credentials");
-  grpc_error* err;
-  grpc_core::ExecCtx exec_ctx;
+static void update_tenancy() {
+  gpr_once_init(&g_once, init_default_credentials);
+  grpc_core::MutexLock lock(&g_state_mu);
 
-  GRPC_API_TRACE("grpc_google_default_credentials_create(void)", 0, ());
+  /* Try a platform-provided hint for GCE. */
+  if (!g_metadata_server_available) {
+    g_metadata_server_available = g_gce_tenancy_checker();
+  }
+  /* TODO: Add a platform-provided hint for GAE. */
 
-  gpr_once_init(&g_once, init_default_credentials);
+  /* Do a network test for metadata server. */
+  if (!g_metadata_server_available) {
+    g_metadata_server_available = is_metadata_server_reachable();
+  }
+}
+
+static bool metadata_server_available() {
+  grpc_core::MutexLock lock(&g_state_mu);
+  return static_cast<bool>(g_metadata_server_available);
+}
+
+static grpc_core::RefCountedPtr<grpc_call_credentials> make_default_call_creds(
+    grpc_error** error) {
+  grpc_core::RefCountedPtr<grpc_call_credentials> call_creds;
+  grpc_error* err;
 
   /* First, try the environment variable. */
   char* path_from_env = gpr_getenv(GRPC_GOOGLE_CREDENTIALS_ENV_VAR);
   if (path_from_env != nullptr) {
     err = create_default_creds_from_path(path_from_env, &call_creds);
     gpr_free(path_from_env);
-    if (err == GRPC_ERROR_NONE) goto end;
-    error = grpc_error_add_child(error, err);
+    if (err == GRPC_ERROR_NONE) return call_creds;
+    *error = grpc_error_add_child(*error, err);
   }
 
   /* Then the well-known file. */
   err = create_default_creds_from_path(
       grpc_get_well_known_google_credentials_file_path(), &call_creds);
-  if (err == GRPC_ERROR_NONE) goto end;
-  error = grpc_error_add_child(error, err);
+  if (err == GRPC_ERROR_NONE) return call_creds;
+  *error = grpc_error_add_child(*error, err);
 
-  gpr_mu_lock(&g_state_mu);
+  update_tenancy();
 
-  /* Try a platform-provided hint for GCE. */
-  if (!g_metadata_server_available) {
-    g_is_on_gce = g_gce_tenancy_checker();
-    g_metadata_server_available = g_is_on_gce;
-  }
-  /* TODO: Add a platform-provided hint for GAE. */
-
-  /* Do a network test for metadata server. */
-  if (!g_metadata_server_available) {
-    g_metadata_server_available = is_metadata_server_reachable();
-  }
-  gpr_mu_unlock(&g_state_mu);
-
-  if (g_metadata_server_available) {
+  if (metadata_server_available()) {
     call_creds = grpc_core::RefCountedPtr<grpc_call_credentials>(
         grpc_google_compute_engine_credentials_create(nullptr));
     if (call_creds == nullptr) {
-      error = grpc_error_add_child(
-          error, GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-                     "Failed to get credentials from network"));
+      *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          GRPC_GOOGLE_CREDENTIAL_CREATION_ERROR);
+      *error = grpc_error_add_child(
+          *error, GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+                      "Failed to get credentials from network"));
     }
   }
 
-end:
+  return call_creds;
+}
+
+grpc_channel_credentials* grpc_google_default_credentials_create(
+    grpc_call_credentials* call_credentials) {
+  grpc_channel_credentials* result = nullptr;
+  grpc_core::RefCountedPtr<grpc_call_credentials> call_creds(call_credentials);
+  grpc_error* error = nullptr;
+  grpc_core::ExecCtx exec_ctx;
+
+  GRPC_API_TRACE("grpc_google_default_credentials_create(%p)", 1,
+                 (call_credentials));
+
+  if (call_creds == nullptr) {
+    call_creds = make_default_call_creds(&error);
+  }
+
   if (call_creds != nullptr) {
     /* Create google default credentials. */
     grpc_channel_credentials* ssl_creds =
@@ -338,10 +358,8 @@ end:
     grpc_alts_credentials_options_destroy(options);
     auto creds =
         grpc_core::MakeRefCounted<grpc_google_default_channel_credentials>(
-            alts_creds != nullptr ? alts_creds->Ref() : nullptr,
-            ssl_creds != nullptr ? ssl_creds->Ref() : nullptr);
-    if (ssl_creds) ssl_creds->Unref();
-    if (alts_creds) alts_creds->Unref();
+            grpc_core::RefCountedPtr<grpc_channel_credentials>(alts_creds),
+            grpc_core::RefCountedPtr<grpc_channel_credentials>(ssl_creds));
     result = grpc_composite_channel_credentials_create(
         creds.get(), call_creds.get(), nullptr);
     GPR_ASSERT(result != nullptr);

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.cc

@@ -0,0 +1,321 @@
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
+
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+#include <stdlib.h>
+#include <string.h>
+
+void grpc_tls_certificate_distributor::SetKeyMaterials(
+    const std::string& cert_name, absl::optional<std::string> pem_root_certs,
+    absl::optional<PemKeyCertPairList> pem_key_cert_pairs) {
+  GPR_ASSERT(pem_root_certs.has_value() || pem_key_cert_pairs.has_value());
+  grpc_core::MutexLock lock(&mu_);
+  auto& cert_info = certificate_info_map_[cert_name];
+  if (pem_root_certs.has_value()) {
+    // Successful credential updates will clear any pre-existing error.
+    cert_info.SetRootError(GRPC_ERROR_NONE);
+    for (auto* watcher_ptr : cert_info.root_cert_watchers) {
+      GPR_ASSERT(watcher_ptr != nullptr);
+      const auto watcher_it = watchers_.find(watcher_ptr);
+      GPR_ASSERT(watcher_it != watchers_.end());
+      GPR_ASSERT(watcher_it->second.root_cert_name.has_value());
+      absl::optional<PemKeyCertPairList> pem_key_cert_pairs_to_report;
+      if (pem_key_cert_pairs.has_value() &&
+          watcher_it->second.identity_cert_name == cert_name) {
+        pem_key_cert_pairs_to_report = pem_key_cert_pairs;
+      } else if (watcher_it->second.identity_cert_name.has_value()) {
+        auto& identity_cert_info =
+            certificate_info_map_[*watcher_it->second.identity_cert_name];
+        pem_key_cert_pairs_to_report = identity_cert_info.pem_key_cert_pairs;
+      }
+      watcher_ptr->OnCertificatesChanged(
+          pem_root_certs, std::move(pem_key_cert_pairs_to_report));
+    }
+    cert_info.pem_root_certs = std::move(*pem_root_certs);
+  }
+  if (pem_key_cert_pairs.has_value()) {
+    // Successful credential updates will clear any pre-existing error.
+    cert_info.SetIdentityError(GRPC_ERROR_NONE);
+    for (const auto watcher_ptr : cert_info.identity_cert_watchers) {
+      GPR_ASSERT(watcher_ptr != nullptr);
+      const auto watcher_it = watchers_.find(watcher_ptr);
+      GPR_ASSERT(watcher_it != watchers_.end());
+      GPR_ASSERT(watcher_it->second.identity_cert_name.has_value());
+      absl::optional<absl::string_view> pem_root_certs_to_report;
+      if (pem_root_certs.has_value() &&
+          watcher_it->second.root_cert_name == cert_name) {
+        // In this case, We've already sent the credential updates at the time
+        // when checking pem_root_certs, so we will skip here.
+        continue;
+      } else if (watcher_it->second.root_cert_name.has_value()) {
+        auto& root_cert_info =
+            certificate_info_map_[*watcher_it->second.root_cert_name];
+        pem_root_certs_to_report = root_cert_info.pem_root_certs;
+      }
+      watcher_ptr->OnCertificatesChanged(pem_root_certs_to_report,
+                                         pem_key_cert_pairs);
+    }
+    cert_info.pem_key_cert_pairs = std::move(*pem_key_cert_pairs);
+  }
+}
+
+bool grpc_tls_certificate_distributor::HasRootCerts(
+    const std::string& root_cert_name) {
+  grpc_core::MutexLock lock(&mu_);
+  const auto it = certificate_info_map_.find(root_cert_name);
+  return it != certificate_info_map_.end() &&
+         !it->second.pem_root_certs.empty();
+};
+
+bool grpc_tls_certificate_distributor::HasKeyCertPairs(
+    const std::string& identity_cert_name) {
+  grpc_core::MutexLock lock(&mu_);
+  const auto it = certificate_info_map_.find(identity_cert_name);
+  return it != certificate_info_map_.end() &&
+         !it->second.pem_key_cert_pairs.empty();
+};
+
+void grpc_tls_certificate_distributor::SetErrorForCert(
+    const std::string& cert_name, absl::optional<grpc_error*> root_cert_error,
+    absl::optional<grpc_error*> identity_cert_error) {
+  GPR_ASSERT(root_cert_error.has_value() || identity_cert_error.has_value());
+  grpc_core::MutexLock lock(&mu_);
+  CertificateInfo& cert_info = certificate_info_map_[cert_name];
+  if (root_cert_error.has_value()) {
+    for (auto* watcher_ptr : cert_info.root_cert_watchers) {
+      GPR_ASSERT(watcher_ptr != nullptr);
+      const auto watcher_it = watchers_.find(watcher_ptr);
+      GPR_ASSERT(watcher_it != watchers_.end());
+      // identity_cert_error_to_report is the error of the identity cert this
+      // watcher is watching, if there is any.
+      grpc_error* identity_cert_error_to_report = GRPC_ERROR_NONE;
+      if (identity_cert_error.has_value() &&
+          watcher_it->second.identity_cert_name == cert_name) {
+        identity_cert_error_to_report = *identity_cert_error;
+      } else if (watcher_it->second.identity_cert_name.has_value()) {
+        auto& identity_cert_info =
+            certificate_info_map_[*watcher_it->second.identity_cert_name];
+        identity_cert_error_to_report = identity_cert_info.identity_cert_error;
+      }
+      watcher_ptr->OnError(GRPC_ERROR_REF(*root_cert_error),
+                           GRPC_ERROR_REF(identity_cert_error_to_report));
+    }
+    cert_info.SetRootError(*root_cert_error);
+  }
+  if (identity_cert_error.has_value()) {
+    for (auto* watcher_ptr : cert_info.identity_cert_watchers) {
+      GPR_ASSERT(watcher_ptr != nullptr);
+      const auto watcher_it = watchers_.find(watcher_ptr);
+      GPR_ASSERT(watcher_it != watchers_.end());
+      // root_cert_error_to_report is the error of the root cert this watcher is
+      // watching, if there is any.
+      grpc_error* root_cert_error_to_report = GRPC_ERROR_NONE;
+      if (root_cert_error.has_value() &&
+          watcher_it->second.root_cert_name == cert_name) {
+        // In this case, We've already sent the error updates at the time when
+        // checking root_cert_error, so we will skip here.
+        continue;
+      } else if (watcher_it->second.root_cert_name.has_value()) {
+        auto& root_cert_info =
+            certificate_info_map_[*watcher_it->second.root_cert_name];
+        root_cert_error_to_report = root_cert_info.root_cert_error;
+      }
+      watcher_ptr->OnError(GRPC_ERROR_REF(root_cert_error_to_report),
+                           GRPC_ERROR_REF(*identity_cert_error));
+    }
+    cert_info.SetIdentityError(*identity_cert_error);
+  }
+};
+
+void grpc_tls_certificate_distributor::SetError(grpc_error* error) {
+  GPR_ASSERT(error != GRPC_ERROR_NONE);
+  grpc_core::MutexLock lock(&mu_);
+  for (const auto& watcher : watchers_) {
+    const auto watcher_ptr = watcher.first;
+    GPR_ASSERT(watcher_ptr != nullptr);
+    const auto& watcher_info = watcher.second;
+    watcher_ptr->OnError(
+        watcher_info.root_cert_name.has_value() ? GRPC_ERROR_REF(error)
+                                                : GRPC_ERROR_NONE,
+        watcher_info.identity_cert_name.has_value() ? GRPC_ERROR_REF(error)
+                                                    : GRPC_ERROR_NONE);
+  }
+  for (auto& cert_info_entry : certificate_info_map_) {
+    auto& cert_info = cert_info_entry.second;
+    cert_info.SetRootError(GRPC_ERROR_REF(error));
+    cert_info.SetIdentityError(GRPC_ERROR_REF(error));
+  }
+  GRPC_ERROR_UNREF(error);
+};
+
+void grpc_tls_certificate_distributor::WatchTlsCertificates(
+    std::unique_ptr<TlsCertificatesWatcherInterface> watcher,
+    absl::optional<std::string> root_cert_name,
+    absl::optional<std::string> identity_cert_name) {
+  bool start_watching_root_cert = false;
+  bool already_watching_identity_for_root_cert = false;
+  bool start_watching_identity_cert = false;
+  bool already_watching_root_for_identity_cert = false;
+  GPR_ASSERT(root_cert_name.has_value() || identity_cert_name.has_value());
+  TlsCertificatesWatcherInterface* watcher_ptr = watcher.get();
+  GPR_ASSERT(watcher_ptr != nullptr);
+  // Update watchers_ and certificate_info_map_.
+  {
+    grpc_core::MutexLock lock(&mu_);
+    const auto watcher_it = watchers_.find(watcher_ptr);
+    // The caller needs to cancel the watcher first if it wants to re-register
+    // the watcher.
+    GPR_ASSERT(watcher_it == watchers_.end());
+    watchers_[watcher_ptr] = {std::move(watcher), root_cert_name,
+                              identity_cert_name};
+    absl::optional<absl::string_view> updated_root_certs;
+    absl::optional<PemKeyCertPairList> updated_identity_pairs;
+    grpc_error* root_error = GRPC_ERROR_NONE;
+    grpc_error* identity_error = GRPC_ERROR_NONE;
+    if (root_cert_name.has_value()) {
+      CertificateInfo& cert_info = certificate_info_map_[*root_cert_name];
+      start_watching_root_cert = cert_info.root_cert_watchers.empty();
+      already_watching_identity_for_root_cert =
+          !cert_info.identity_cert_watchers.empty();
+      cert_info.root_cert_watchers.insert(watcher_ptr);
+      root_error = GRPC_ERROR_REF(cert_info.root_cert_error);
+      // Empty credentials will be treated as no updates.
+      if (!cert_info.pem_root_certs.empty()) {
+        updated_root_certs = cert_info.pem_root_certs;
+      }
+    }
+    if (identity_cert_name.has_value()) {
+      CertificateInfo& cert_info = certificate_info_map_[*identity_cert_name];
+      start_watching_identity_cert = cert_info.identity_cert_watchers.empty();
+      already_watching_root_for_identity_cert =
+          !cert_info.root_cert_watchers.empty();
+      cert_info.identity_cert_watchers.insert(watcher_ptr);
+      identity_error = GRPC_ERROR_REF(cert_info.identity_cert_error);
+      // Empty credentials will be treated as no updates.
+      if (!cert_info.pem_key_cert_pairs.empty()) {
+        updated_identity_pairs = cert_info.pem_key_cert_pairs;
+      }
+    }
+    // Notify this watcher if the certs it is watching already had some
+    // contents. Note that an *_cert_error in cert_info only indicates error
+    // occurred while trying to fetch the latest cert, but the updated_*_certs
+    // should always be valid. So we will send the updates regardless of
+    // *_cert_error.
+    if (updated_root_certs.has_value() || updated_identity_pairs.has_value()) {
+      watcher_ptr->OnCertificatesChanged(updated_root_certs,
+                                         std::move(updated_identity_pairs));
+    }
+    // Notify this watcher if the certs it is watching already had some errors.
+    if (root_error != GRPC_ERROR_NONE || identity_error != GRPC_ERROR_NONE) {
+      watcher_ptr->OnError(GRPC_ERROR_REF(root_error),
+                           GRPC_ERROR_REF(identity_error));
+    }
+    GRPC_ERROR_UNREF(root_error);
+    GRPC_ERROR_UNREF(identity_error);
+  }
+  // Invoke watch status callback if needed.
+  {
+    grpc_core::MutexLock lock(&callback_mu_);
+    if (watch_status_callback_ != nullptr) {
+      if (root_cert_name == identity_cert_name &&
+          (start_watching_root_cert || start_watching_identity_cert)) {
+        watch_status_callback_(*root_cert_name, start_watching_root_cert,
+                               start_watching_identity_cert);
+      } else {
+        if (start_watching_root_cert) {
+          watch_status_callback_(*root_cert_name, true,
+                                 already_watching_identity_for_root_cert);
+        }
+        if (start_watching_identity_cert) {
+          watch_status_callback_(*identity_cert_name,
+                                 already_watching_root_for_identity_cert, true);
+        }
+      }
+    }
+  }
+};
+
+void grpc_tls_certificate_distributor::CancelTlsCertificatesWatch(
+    TlsCertificatesWatcherInterface* watcher) {
+  absl::optional<std::string> root_cert_name;
+  absl::optional<std::string> identity_cert_name;
+  bool stop_watching_root_cert = false;
+  bool already_watching_identity_for_root_cert = false;
+  bool stop_watching_identity_cert = false;
+  bool already_watching_root_for_identity_cert = false;
+  // Update watchers_ and certificate_info_map_.
+  {
+    grpc_core::MutexLock lock(&mu_);
+    auto it = watchers_.find(watcher);
+    if (it == watchers_.end()) return;
+    WatcherInfo& watcher_info = it->second;
+    root_cert_name = std::move(watcher_info.root_cert_name);
+    identity_cert_name = std::move(watcher_info.identity_cert_name);
+    watchers_.erase(it);
+    if (root_cert_name.has_value()) {
+      auto it = certificate_info_map_.find(*root_cert_name);
+      GPR_ASSERT(it != certificate_info_map_.end());
+      CertificateInfo& cert_info = it->second;
+      cert_info.root_cert_watchers.erase(watcher);
+      stop_watching_root_cert = cert_info.root_cert_watchers.empty();
+      already_watching_identity_for_root_cert =
+          !cert_info.identity_cert_watchers.empty();
+      if (stop_watching_root_cert && !already_watching_identity_for_root_cert) {
+        certificate_info_map_.erase(it);
+      }
+    }
+    if (identity_cert_name.has_value()) {
+      auto it = certificate_info_map_.find(*identity_cert_name);
+      GPR_ASSERT(it != certificate_info_map_.end());
+      CertificateInfo& cert_info = it->second;
+      cert_info.identity_cert_watchers.erase(watcher);
+      stop_watching_identity_cert = cert_info.identity_cert_watchers.empty();
+      already_watching_root_for_identity_cert =
+          !cert_info.root_cert_watchers.empty();
+      if (stop_watching_identity_cert &&
+          !already_watching_root_for_identity_cert) {
+        certificate_info_map_.erase(it);
+      }
+    }
+  }
+  // Invoke watch status callback if needed.
+  {
+    grpc_core::MutexLock lock(&callback_mu_);
+    if (watch_status_callback_ != nullptr) {
+      if (root_cert_name == identity_cert_name &&
+          (stop_watching_root_cert || stop_watching_identity_cert)) {
+        watch_status_callback_(*root_cert_name, !stop_watching_root_cert,
+                               !stop_watching_identity_cert);
+      } else {
+        if (stop_watching_root_cert) {
+          watch_status_callback_(*root_cert_name, false,
+                                 already_watching_identity_for_root_cert);
+        }
+        if (stop_watching_identity_cert) {
+          watch_status_callback_(*identity_cert_name,
+                                 already_watching_root_for_identity_cert,
+                                 false);
+        }
+      }
+    }
+  }
+};