grpc 1.31.0.pre2 → 1.34.0

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h

@@ -0,0 +1,218 @@
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_DISTRIBUTOR_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_DISTRIBUTOR_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include <utility>
+
+#include "absl/container/inlined_vector.h"
+#include "absl/types/optional.h"
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/security/security_connector/ssl_utils.h"
+
+struct grpc_tls_identity_pairs {
+  grpc_core::PemKeyCertPairList pem_key_cert_pairs;
+};
+
+// TLS certificate distributor.
+struct grpc_tls_certificate_distributor
+    : public grpc_core::RefCounted<grpc_tls_certificate_distributor> {
+ public:
+  // Interface for watching TLS certificates update.
+  class TlsCertificatesWatcherInterface {
+   public:
+    virtual ~TlsCertificatesWatcherInterface() = default;
+
+    // Handles the delivery of the updated root and identity certificates.
+    // An absl::nullopt value indicates no corresponding contents for
+    // root_certs or key_cert_pairs. Note that we will send updates of the
+    // latest contents for both root and identity certificates, even when only
+    // one side of it got updated.
+    //
+    // @param root_certs the contents of the reloaded root certs.
+    // @param key_cert_pairs the contents of the reloaded identity key-cert
+    // pairs.
+    virtual void OnCertificatesChanged(
+        absl::optional<absl::string_view> root_certs,
+        absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) = 0;
+
+    // Handles an error that occurs while attempting to fetch certificate data.
+    // Note that if a watcher sees an error, it simply means the Provider is
+    // having problems renewing new data. If the watcher has previously received
+    // several OnCertificatesChanged, all the data received from that function
+    // is valid.
+    // In that case, watcher might simply log the error. If the watcher hasn't
+    // received any OnCertificatesChanged before the error occurs, no valid
+    // data is available yet, and the watcher should either fail or "waiting"
+    // for the valid data in a non-blocking way.
+    //
+    // @param root_cert_error the error occurred while reloading root
+    // certificates.
+    // @param identity_cert_error the error occurred while reloading identity
+    // certificates.
+    virtual void OnError(grpc_error* root_cert_error,
+                         grpc_error* identity_cert_error) = 0;
+  };
+
+  // Sets the key materials based on their certificate name. Note that we are
+  // not doing any copies for pem_root_certs and pem_key_cert_pairs. For
+  // pem_root_certs, the original string contents need to outlive the
+  // distributor; for pem_key_cert_pairs, internally it is taking two
+  // unique_ptr(s) to the credential string, so the ownership is actually
+  // transferred.
+  //
+  // @param cert_name The name of the certificates being updated.
+  // @param pem_root_certs The content of root certificates.
+  // @param pem_key_cert_pairs The content of identity key-cert pairs.
+  void SetKeyMaterials(
+      const std::string& cert_name, absl::optional<std::string> pem_root_certs,
+      absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs);
+
+  bool HasRootCerts(const std::string& root_cert_name);
+
+  bool HasKeyCertPairs(const std::string& identity_cert_name);
+
+  // Propagates the error that the caller (e.g. Producer) encounters to all the
+  // watchers watching a particular certificate name.
+  //
+  // @param cert_name The watching cert name of the watchers that the caller
+  // wants to notify when encountering error.
+  // @param root_cert_error The error that the caller encounters when reloading
+  // root certs.
+  // @param identity_cert_error The error that the caller encounters when
+  // reloading identity certs.
+  void SetErrorForCert(const std::string& cert_name,
+                       absl::optional<grpc_error*> root_cert_error,
+                       absl::optional<grpc_error*> identity_cert_error);
+
+  // Propagates the error that the caller (e.g. Producer) encounters to all
+  // watchers.
+  //
+  // @param error The error that the caller encounters.
+  void SetError(grpc_error* error);
+
+  // Sets the TLS certificate watch status callback function. The
+  // grpc_tls_certificate_distributor will invoke this callback when a new
+  // certificate name is watched by a newly registered watcher, or when a
+  // certificate name is no longer watched by any watchers.
+  // Note that when the callback shows a cert is no longer being watched, the
+  // distributor will delete the corresponding certificate data from its cache,
+  // and clear the corresponding error, if there is any. This means that if the
+  // callback subsequently says the same cert is now being watched again, the
+  // provider must re-provide the credentials or re-invoke the errors to the
+  // distributor, to indicate a successful or failed reloading.
+  // @param callback The callback function being set by the caller, e.g the
+  // Producer. Note that this callback will be invoked for each certificate
+  // name.
+  //
+  // For the parameters in the callback function:
+  // string_value The name of the certificates being watched.
+  // bool_value_1 If the root certificates with the specific name are being
+  // watched. bool_value_2 If the identity certificates with the specific name
+  // are being watched.
+  void SetWatchStatusCallback(
+      std::function<void(std::string, bool, bool)> callback) {
+    grpc_core::MutexLock lock(&mu_);
+    watch_status_callback_ = std::move(callback);
+  };
+
+  // Registers a watcher. The caller may keep a raw pointer to the watcher,
+  // which may be used only for cancellation. (Because the caller does not own
+  // the watcher, the pointer must not be used for any other purpose.) At least
+  // one of root_cert_name and identity_cert_name must be specified.
+  //
+  // @param watcher The watcher being registered.
+  // @param root_cert_name The name of the root certificates that will be
+  // watched. If set to absl::nullopt, the root certificates won't be watched.
+  // @param identity_cert_name The name of the identity certificates that will
+  // be watched. If set to absl::nullopt, the identity certificates won't be
+  // watched.
+  void WatchTlsCertificates(
+      std::unique_ptr<TlsCertificatesWatcherInterface> watcher,
+      absl::optional<std::string> root_cert_name,
+      absl::optional<std::string> identity_cert_name);
+
+  // Cancels a watcher.
+  //
+  // @param watcher The watcher being cancelled.
+  void CancelTlsCertificatesWatch(TlsCertificatesWatcherInterface* watcher);
+
+ private:
+  // Contains the information about each watcher.
+  struct WatcherInfo {
+    std::unique_ptr<TlsCertificatesWatcherInterface> watcher;
+    absl::optional<std::string> root_cert_name;
+    absl::optional<std::string> identity_cert_name;
+  };
+  // CertificateInfo contains the credential contents and some additional
+  // watcher information.
+  // Note that having errors doesn't indicate the corresponding credentials are
+  // invalid. For example, if root_cert_error != nullptr but pem_root_certs has
+  // value, it simply means an error occurs while trying to fetch the latest
+  // root certs, while pem_root_certs still contains the valid old data.
+  struct CertificateInfo {
+    // The contents of the root certificates.
+    std::string pem_root_certs;
+    // The contents of the identity key-certificate pairs.
+    grpc_core::PemKeyCertPairList pem_key_cert_pairs;
+    // The root cert reloading error propagated by the caller.
+    grpc_error* root_cert_error = GRPC_ERROR_NONE;
+    // The identity cert reloading error propagated by the caller.
+    grpc_error* identity_cert_error = GRPC_ERROR_NONE;
+    // The set of watchers watching root certificates.
+    // This is mainly used for quickly looking up the affected watchers while
+    // performing a credential reloading.
+    std::set<TlsCertificatesWatcherInterface*> root_cert_watchers;
+    // The set of watchers watching identity certificates. This is mainly used
+    // for quickly looking up the affected watchers while performing a
+    // credential reloading.
+    std::set<TlsCertificatesWatcherInterface*> identity_cert_watchers;
+
+    ~CertificateInfo() {
+      GRPC_ERROR_UNREF(root_cert_error);
+      GRPC_ERROR_UNREF(identity_cert_error);
+    }
+    void SetRootError(grpc_error* error) {
+      GRPC_ERROR_UNREF(root_cert_error);
+      root_cert_error = error;
+    }
+    void SetIdentityError(grpc_error* error) {
+      GRPC_ERROR_UNREF(identity_cert_error);
+      identity_cert_error = error;
+    }
+  };
+
+  grpc_core::Mutex mu_;
+  // We need a dedicated mutex for watch_status_callback_ for allowing
+  // callers(e.g. Producer) to directly set key materials in the callback
+  // functions.
+  grpc_core::Mutex callback_mu_;
+  // Stores information about each watcher.
+  std::map<TlsCertificatesWatcherInterface*, WatcherInfo> watchers_;
+  // The callback to notify the caller, e.g. the Producer, that the watch status
+  // is changed.
+  std::function<void(std::string, bool, bool)> watch_status_callback_;
+  // Stores the names of each certificate, and their corresponding credential
+  // contents as well as some additional watcher information.
+  std::map<std::string, CertificateInfo> certificate_info_map_;
+};
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_DISTRIBUTOR_H

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc

@@ -0,0 +1,78 @@
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
+
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
+#include "src/core/lib/surface/api_trace.h"
+
+namespace grpc_core {
+
+StaticDataCertificateProvider::StaticDataCertificateProvider(
+    std::string root_certificate,
+    grpc_core::PemKeyCertPairList pem_key_cert_pairs)
+    : distributor_(MakeRefCounted<grpc_tls_certificate_distributor>()),
+      root_certificate_(std::move(root_certificate)),
+      pem_key_cert_pairs_(std::move(pem_key_cert_pairs)) {
+  distributor_->SetWatchStatusCallback([this](std::string cert_name,
+                                              bool root_being_watched,
+                                              bool identity_being_watched) {
+    if (!root_being_watched && !identity_being_watched) return;
+    absl::optional<std::string> root_certificate;
+    absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs;
+    if (root_being_watched) {
+      root_certificate = root_certificate_;
+    }
+    if (identity_being_watched) {
+      pem_key_cert_pairs = pem_key_cert_pairs_;
+    }
+    distributor_->SetKeyMaterials(cert_name, std::move(root_certificate),
+                                  std::move(pem_key_cert_pairs));
+  });
+}
+
+}  // namespace grpc_core
+
+/** -- Wrapper APIs declared in grpc_security.h -- **/
+
+grpc_tls_certificate_provider* grpc_tls_certificate_provider_static_data_create(
+    const char* root_certificate, grpc_tls_identity_pairs* pem_key_cert_pairs) {
+  GPR_ASSERT(root_certificate != nullptr || pem_key_cert_pairs != nullptr);
+  grpc_core::PemKeyCertPairList identity_pairs_core;
+  if (pem_key_cert_pairs != nullptr) {
+    identity_pairs_core = std::move(pem_key_cert_pairs->pem_key_cert_pairs);
+    delete pem_key_cert_pairs;
+  }
+  std::string root_cert_core;
+  if (root_certificate != nullptr) {
+    root_cert_core = root_certificate;
+  }
+  return new grpc_core::StaticDataCertificateProvider(
+      std::move(root_cert_core), std::move(identity_pairs_core));
+}
+
+void grpc_tls_certificate_provider_release(
+    grpc_tls_certificate_provider* provider) {
+  GRPC_API_TRACE("grpc_tls_certificate_provider_release(provider=%p)", 1,
+                 (provider));
+  grpc_core::ExecCtx exec_ctx;
+  if (provider != nullptr) provider->Unref();
+}

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h

@@ -0,0 +1,74 @@
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_PROVIDER_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_PROVIDER_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+#include <string.h>
+
+#include "absl/container/inlined_vector.h"
+
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/pollset_set.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
+#include "src/core/lib/security/security_connector/ssl_utils.h"
+
+// Interface for a grpc_tls_certificate_provider that handles the process to
+// fetch credentials and validation contexts. Implementations are free to rely
+// on local or remote sources to fetch the latest secrets, and free to share any
+// state among different instances as they deem fit.
+//
+// On creation, grpc_tls_certificate_provider creates a
+// grpc_tls_certificate_distributor object. When the credentials and validation
+// contexts become valid or changed, a grpc_tls_certificate_provider should
+// notify its distributor so as to propagate the update to the watchers.
+struct grpc_tls_certificate_provider
+    : public grpc_core::RefCounted<grpc_tls_certificate_provider> {
+ public:
+  virtual grpc_pollset_set* interested_parties() const { return nullptr; }
+
+  virtual grpc_core::RefCountedPtr<grpc_tls_certificate_distributor>
+  distributor() const = 0;
+};
+
+namespace grpc_core {
+
+// A basic provider class that will get credentials from string during
+// initialization.
+class StaticDataCertificateProvider final
+    : public grpc_tls_certificate_provider {
+ public:
+  StaticDataCertificateProvider(
+      std::string root_certificate,
+      grpc_core::PemKeyCertPairList pem_key_cert_pairs);
+
+  RefCountedPtr<grpc_tls_certificate_distributor> distributor() const override {
+    return distributor_;
+  }
+
+ private:
+  RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
+  std::string root_certificate_;
+  grpc_core::PemKeyCertPairList pem_key_cert_pairs_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_PROVIDER_H

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc

@@ -27,49 +27,7 @@
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
-/** -- gRPC TLS key materials config API implementation. -- **/
-void grpc_tls_key_materials_config::set_key_materials(
-    const char* pem_root_certs,
-    const grpc_ssl_pem_key_cert_pair** pem_key_cert_pairs,
-    size_t num_key_cert_pairs) {
-  this->set_pem_root_certs(pem_root_certs);
-  grpc_tls_key_materials_config::PemKeyCertPairList cert_pair_list;
-  for (size_t i = 0; i < num_key_cert_pairs; i++) {
-    auto current_pair = static_cast<grpc_ssl_pem_key_cert_pair*>(
-        gpr_zalloc(sizeof(grpc_ssl_pem_key_cert_pair)));
-    current_pair->cert_chain = gpr_strdup(pem_key_cert_pairs[i]->cert_chain);
-    current_pair->private_key = gpr_strdup(pem_key_cert_pairs[i]->private_key);
-    cert_pair_list.emplace_back(grpc_core::PemKeyCertPair(current_pair));
-  }
-  pem_key_cert_pair_list_ = std::move(cert_pair_list);
-}
-
-void grpc_tls_key_materials_config::set_key_materials(
-    const char* pem_root_certs,
-    const PemKeyCertPairList& pem_key_cert_pair_list) {
-  this->set_pem_root_certs(pem_root_certs);
-  grpc_tls_key_materials_config::PemKeyCertPairList dup_list(
-      pem_key_cert_pair_list);
-  pem_key_cert_pair_list_ = std::move(dup_list);
-}
-
-/** -- gRPC TLS credential reload config API implementation. -- **/
-grpc_tls_credential_reload_config::grpc_tls_credential_reload_config(
-    const void* config_user_data,
-    int (*schedule)(void* config_user_data,
-                    grpc_tls_credential_reload_arg* arg),
-    void (*cancel)(void* config_user_data, grpc_tls_credential_reload_arg* arg),
-    void (*destruct)(void* config_user_data))
-    : config_user_data_(const_cast<void*>(config_user_data)),
-      schedule_(schedule),
-      cancel_(cancel),
-      destruct_(destruct) {}
-
-grpc_tls_credential_reload_config::~grpc_tls_credential_reload_config() {
-  if (destruct_ != nullptr) {
-    destruct_((void*)config_user_data_);
-  }
-}
+#include "src/core/lib/surface/api_trace.h"
 
 /** -- gRPC TLS server authorization check API implementation. -- **/
 grpc_tls_server_authorization_check_config::
@@ -92,138 +50,99 @@ grpc_tls_server_authorization_check_config::
   }
 }
 
+int grpc_tls_server_authorization_check_config::Schedule(
+    grpc_tls_server_authorization_check_arg* arg) const {
+  if (schedule_ == nullptr) {
+    gpr_log(GPR_ERROR, "schedule API is nullptr");
+    if (arg != nullptr) {
+      arg->status = GRPC_STATUS_NOT_FOUND;
+      arg->error_details->set_error_details(
+          "schedule API in server authorization check config is nullptr");
+    }
+    return 1;
+  }
+  if (arg != nullptr && context_ != nullptr) {
+    arg->config = const_cast<grpc_tls_server_authorization_check_config*>(this);
+  }
+  return schedule_(config_user_data_, arg);
+}
+
+void grpc_tls_server_authorization_check_config::Cancel(
+    grpc_tls_server_authorization_check_arg* arg) const {
+  if (cancel_ == nullptr) {
+    gpr_log(GPR_ERROR, "cancel API is nullptr.");
+    if (arg != nullptr) {
+      arg->status = GRPC_STATUS_NOT_FOUND;
+      arg->error_details->set_error_details(
+          "schedule API in server authorization check config is nullptr");
+    }
+    return;
+  }
+  if (arg != nullptr) {
+    arg->config = const_cast<grpc_tls_server_authorization_check_config*>(this);
+  }
+  cancel_(config_user_data_, arg);
+}
+
 /** -- Wrapper APIs declared in grpc_security.h -- **/
+
 grpc_tls_credentials_options* grpc_tls_credentials_options_create() {
   return new grpc_tls_credentials_options();
 }
 
-int grpc_tls_credentials_options_set_cert_request_type(
+void grpc_tls_credentials_options_set_cert_request_type(
     grpc_tls_credentials_options* options,
     grpc_ssl_client_certificate_request_type type) {
-  if (options == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid nullptr arguments to "
-            "grpc_tls_credentials_options_set_cert_request_type()");
-    return 0;
-  }
+  GPR_ASSERT(options != nullptr);
   options->set_cert_request_type(type);
-  return 1;
 }
 
-int grpc_tls_credentials_options_set_server_verification_option(
+void grpc_tls_credentials_options_set_server_verification_option(
     grpc_tls_credentials_options* options,
     grpc_tls_server_verification_option server_verification_option) {
-  if (options == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid nullptr arguments to "
-            "grpc_tls_credentials_options_set_server_verification_option()");
-    return 0;
-  }
-  if (server_verification_option != GRPC_TLS_SERVER_VERIFICATION &&
-      options->server_authorization_check_config() == nullptr) {
-    gpr_log(GPR_ERROR,
-            "server_authorization_check_config needs to be specified when"
-            "server_verification_option is not GRPC_TLS_SERVER_VERIFICATION");
-    return 0;
-  }
+  GPR_ASSERT(options != nullptr);
   options->set_server_verification_option(server_verification_option);
-  return 1;
-}
-
-int grpc_tls_credentials_options_set_key_materials_config(
-    grpc_tls_credentials_options* options,
-    grpc_tls_key_materials_config* config) {
-  if (options == nullptr || config == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid nullptr arguments to "
-            "grpc_tls_credentials_options_set_key_materials_config()");
-    return 0;
-  }
-  options->set_key_materials_config(config->Ref());
-  return 1;
 }
 
-int grpc_tls_credentials_options_set_credential_reload_config(
+void grpc_tls_credentials_options_set_certificate_provider(
     grpc_tls_credentials_options* options,
-    grpc_tls_credential_reload_config* config) {
-  if (options == nullptr || config == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid nullptr arguments to "
-            "grpc_tls_credentials_options_set_credential_reload_config()");
-    return 0;
-  }
-  options->set_credential_reload_config(config->Ref());
-  return 1;
+    grpc_tls_certificate_provider* provider) {
+  GPR_ASSERT(options != nullptr);
+  GPR_ASSERT(provider != nullptr);
+  options->set_certificate_provider(
+      provider->Ref(DEBUG_LOCATION, "set_certificate_provider"));
 }
 
-int grpc_tls_credentials_options_set_server_authorization_check_config(
-    grpc_tls_credentials_options* options,
-    grpc_tls_server_authorization_check_config* config) {
-  if (options == nullptr || config == nullptr) {
-    gpr_log(
-        GPR_ERROR,
-        "Invalid nullptr arguments to "
-        "grpc_tls_credentials_options_set_server_authorization_check_config()");
-    return 0;
-  }
-  options->set_server_authorization_check_config(config->Ref());
-  return 1;
+void grpc_tls_credentials_options_watch_root_certs(
+    grpc_tls_credentials_options* options) {
+  GPR_ASSERT(options != nullptr);
+  options->set_watch_root_cert(true);
 }
 
-grpc_tls_key_materials_config* grpc_tls_key_materials_config_create() {
-  return new grpc_tls_key_materials_config();
+void grpc_tls_credentials_options_set_root_cert_name(
+    grpc_tls_credentials_options* options, const char* root_cert_name) {
+  GPR_ASSERT(options != nullptr);
+  options->set_root_cert_name(root_cert_name);
 }
 
-int grpc_tls_key_materials_config_set_key_materials(
-    grpc_tls_key_materials_config* config, const char* root_certs,
-    const grpc_ssl_pem_key_cert_pair** key_cert_pairs, size_t num) {
-  if (config == nullptr || key_cert_pairs == nullptr || num == 0) {
-    gpr_log(GPR_ERROR,
-            "Invalid arguments to "
-            "grpc_tls_key_materials_config_set_key_materials()");
-    return 0;
-  }
-  config->set_key_materials(root_certs, key_cert_pairs, num);
-  return 1;
-}
-
-int grpc_tls_key_materials_config_set_version(
-    grpc_tls_key_materials_config* config, int version) {
-  if (config == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid arguments to "
-            "grpc_tls_key_materials_config_set_version()");
-    return 0;
-  }
-  config->set_version(version);
-  return 1;
+void grpc_tls_credentials_options_watch_identity_key_cert_pairs(
+    grpc_tls_credentials_options* options) {
+  GPR_ASSERT(options != nullptr);
+  options->set_watch_identity_pair(true);
 }
 
-int grpc_tls_key_materials_config_get_version(
-    grpc_tls_key_materials_config* config) {
-  if (config == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid arguments to "
-            "grpc_tls_key_materials_config_get_version()");
-    return -1;
-  }
-  return config->version();
+void grpc_tls_credentials_options_set_identity_cert_name(
+    grpc_tls_credentials_options* options, const char* identity_cert_name) {
+  GPR_ASSERT(options != nullptr);
+  options->set_identity_cert_name(identity_cert_name);
 }
 
-grpc_tls_credential_reload_config* grpc_tls_credential_reload_config_create(
-    const void* config_user_data,
-    int (*schedule)(void* config_user_data,
-                    grpc_tls_credential_reload_arg* arg),
-    void (*cancel)(void* config_user_data, grpc_tls_credential_reload_arg* arg),
-    void (*destruct)(void* config_user_data)) {
-  if (schedule == nullptr) {
-    gpr_log(
-        GPR_ERROR,
-        "Schedule API is nullptr in creating TLS credential reload config.");
-    return nullptr;
-  }
-  return new grpc_tls_credential_reload_config(config_user_data, schedule,
-                                               cancel, destruct);
+void grpc_tls_credentials_options_set_server_authorization_check_config(
+    grpc_tls_credentials_options* options,
+    grpc_tls_server_authorization_check_config* config) {
+  GPR_ASSERT(options != nullptr);
+  GPR_ASSERT(config != nullptr);
+  options->set_server_authorization_check_config(config->Ref());
 }
 
 grpc_tls_server_authorization_check_config*
@@ -243,3 +162,12 @@ grpc_tls_server_authorization_check_config_create(
   return new grpc_tls_server_authorization_check_config(
       config_user_data, schedule, cancel, destruct);
 }
+
+void grpc_tls_server_authorization_check_config_release(
+    grpc_tls_server_authorization_check_config* config) {
+  GRPC_API_TRACE(
+      "grpc_tls_server_authorization_check_config_release(config=%p)", 1,
+      (config));
+  grpc_core::ExecCtx exec_ctx;
+  if (config != nullptr) config->Unref();
+}