grpc 1.31.1 → 1.35.0.pre1

data/src/core/ext/{filters/client_channel/xds → xds}/xds_bootstrap.cc

@@ -16,7 +16,7 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/ext/filters/client_channel/xds/xds_bootstrap.h"
+#include "src/core/ext/xds/xds_bootstrap.h"
 
 #include <vector>
 
@@ -28,13 +28,59 @@
 #include "absl/strings/str_join.h"
 #include "absl/strings/string_view.h"
 
+#include "src/core/ext/xds/certificate_provider_registry.h"
+#include "src/core/ext/xds/xds_api.h"
 #include "src/core/lib/gpr/env.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/iomgr/load_file.h"
+#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/fake/fake_credentials.h"
 #include "src/core/lib/slice/slice_internal.h"
 
 namespace grpc_core {
 
+//
+// XdsChannelCredsRegistry
+//
+
+bool XdsChannelCredsRegistry::IsSupported(const std::string& creds_type) {
+  return creds_type == "google_default" || creds_type == "insecure" ||
+         creds_type == "fake";
+}
+
+bool XdsChannelCredsRegistry::IsValidConfig(const std::string& creds_type,
+                                            const Json& config) {
+  // Currently, none of the creds types actually take a config, but we
+  // ignore whatever might be specified in the bootstrap file for
+  // forward compatibility reasons.
+  return true;
+}
+
+RefCountedPtr<grpc_channel_credentials>
+XdsChannelCredsRegistry::MakeChannelCreds(const std::string& creds_type,
+                                          const Json& config) {
+  if (creds_type == "google_default") {
+    return grpc_google_default_credentials_create(nullptr);
+  } else if (creds_type == "insecure") {
+    return grpc_insecure_credentials_create();
+  } else if (creds_type == "fake") {
+    return grpc_fake_transport_security_credentials_create();
+  }
+  return nullptr;
+}
+
+//
+// XdsBootstrap::XdsServer
+//
+
+bool XdsBootstrap::XdsServer::ShouldUseV3() const {
+  return server_features.find("xds_v3") != server_features.end();
+}
+
+//
+// XdsBootstrap
+//
+
 namespace {
 
 std::string BootstrapString(const XdsBootstrap& bootstrap) {
@@ -55,17 +101,34 @@ std::string BootstrapString(const XdsBootstrap& bootstrap) {
         bootstrap.node()->locality_region, bootstrap.node()->locality_zone,
         bootstrap.node()->locality_subzone, bootstrap.node()->metadata.Dump()));
   }
-  parts.push_back(
-      absl::StrFormat("servers=[\n"
-                      "  {\n"
-                      "    uri=\"%s\",\n"
-                      "    creds=[\n",
-                      bootstrap.server().server_uri));
-  for (const auto& creds : bootstrap.server().channel_creds) {
-    parts.push_back(absl::StrFormat("      {type=\"%s\", config=%s},\n",
-                                    creds.type, creds.config.Dump()));
-  }
-  parts.push_back("    ]\n  }\n]");
+  parts.push_back(absl::StrFormat(
+      "servers=[\n"
+      "  {\n"
+      "    uri=\"%s\",\n"
+      "    creds_type=%s,\n",
+      bootstrap.server().server_uri, bootstrap.server().channel_creds_type));
+  if (bootstrap.server().channel_creds_config.type() != Json::Type::JSON_NULL) {
+    parts.push_back(
+        absl::StrFormat("    creds_config=%s,",
+                        bootstrap.server().channel_creds_config.Dump()));
+  }
+  if (!bootstrap.server().server_features.empty()) {
+    parts.push_back(absl::StrCat(
+        "    server_features=[",
+        absl::StrJoin(bootstrap.server().server_features, ", "), "],\n"));
+  }
+  parts.push_back("  }\n],\n");
+  parts.push_back("certificate_providers={\n");
+  for (const auto& entry : bootstrap.certificate_providers()) {
+    parts.push_back(
+        absl::StrFormat("  %s={\n"
+                        "    plugin_name=%s\n"
+                        "    config=%s\n"
+                        "  },\n",
+                        entry.first, entry.second.plugin_name,
+                        entry.second.config->ToString()));
+  }
+  parts.push_back("}");
   return absl::StrJoin(parts, "");
 }
 
@@ -142,6 +205,18 @@ XdsBootstrap::XdsBootstrap(Json json, grpc_error** error) {
       if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
     }
   }
+  if (XdsSecurityEnabled()) {
+    it = json.mutable_object()->find("certificate_providers");
+    if (it != json.mutable_object()->end()) {
+      if (it->second.type() != Json::Type::OBJECT) {
+        error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+            "\"certificate_providers\" field is not an object"));
+      } else {
+        grpc_error* parse_error = ParseCertificateProviders(&it->second);
+        if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
+      }
+    }
+  }
   *error = GRPC_ERROR_CREATE_FROM_VECTOR("errors parsing xds bootstrap file",
                                          &error_list);
 }
@@ -177,12 +252,23 @@ grpc_error* XdsBootstrap::ParseXdsServer(Json* json, size_t idx) {
     server.server_uri = std::move(*it->second.mutable_string_value());
   }
   it = json->mutable_object()->find("channel_creds");
+  if (it == json->mutable_object()->end()) {
+    error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "\"channel_creds\" field not present"));
+  } else if (it->second.type() != Json::Type::ARRAY) {
+    error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "\"channel_creds\" field is not an array"));
+  } else {
+    grpc_error* parse_error = ParseChannelCredsArray(&it->second, &server);
+    if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
+  }
+  it = json->mutable_object()->find("server_features");
   if (it != json->mutable_object()->end()) {
     if (it->second.type() != Json::Type::ARRAY) {
       error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-          "\"channel_creds\" field is not an array"));
+          "\"server_features\" field is not an array"));
     } else {
-      grpc_error* parse_error = ParseChannelCredsArray(&it->second, &server);
+      grpc_error* parse_error = ParseServerFeaturesArray(&it->second, &server);
       if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
     }
   }
@@ -210,6 +296,10 @@ grpc_error* XdsBootstrap::ParseChannelCredsArray(Json* json,
       if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
     }
   }
+  if (server->channel_creds_type.empty()) {
+    error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "no known creds type found in \"channel_creds\""));
+  }
   return GRPC_ERROR_CREATE_FROM_VECTOR("errors parsing \"channel_creds\" array",
                                        &error_list);
 }
@@ -217,7 +307,7 @@ grpc_error* XdsBootstrap::ParseChannelCredsArray(Json* json,
 grpc_error* XdsBootstrap::ParseChannelCreds(Json* json, size_t idx,
                                             XdsServer* server) {
   std::vector<grpc_error*> error_list;
-  ChannelCreds channel_creds;
+  std::string type;
   auto it = json->mutable_object()->find("type");
   if (it == json->mutable_object()->end()) {
     error_list.push_back(
@@ -226,19 +316,28 @@ grpc_error* XdsBootstrap::ParseChannelCreds(Json* json, size_t idx,
     error_list.push_back(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING("\"type\" field is not a string"));
   } else {
-    channel_creds.type = std::move(*it->second.mutable_string_value());
+    type = std::move(*it->second.mutable_string_value());
   }
+  Json config;
   it = json->mutable_object()->find("config");
   if (it != json->mutable_object()->end()) {
     if (it->second.type() != Json::Type::OBJECT) {
       error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
           "\"config\" field is not an object"));
     } else {
-      channel_creds.config = std::move(it->second);
+      config = std::move(it->second);
     }
   }
-  if (!channel_creds.type.empty()) {
-    server->channel_creds.emplace_back(std::move(channel_creds));
+  // Select the first channel creds type that we support.
+  if (server->channel_creds_type.empty() &&
+      XdsChannelCredsRegistry::IsSupported(type)) {
+    if (!XdsChannelCredsRegistry::IsValidConfig(type, config)) {
+      error_list.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrCat("invalid config for channel creds type \"", type, "\"")
+              .c_str()));
+    }
+    server->channel_creds_type = std::move(type);
+    server->channel_creds_config = std::move(config);
   }
   // Can't use GRPC_ERROR_CREATE_FROM_VECTOR() here, because the error
   // string is not static in this case.
@@ -251,6 +350,28 @@ grpc_error* XdsBootstrap::ParseChannelCreds(Json* json, size_t idx,
   return error;
 }
 
+grpc_error* XdsBootstrap::ParseServerFeaturesArray(Json* json,
+                                                   XdsServer* server) {
+  std::vector<grpc_error*> error_list;
+  for (size_t i = 0; i < json->mutable_array()->size(); ++i) {
+    Json& child = json->mutable_array()->at(i);
+    if (child.type() == Json::Type::STRING &&
+        child.string_value() == "xds_v3") {
+      // TODO(roth): Remove env var check once we do interop testing and
+      // are sure that the v3 code actually works.
+      grpc_core::UniquePtr<char> enable_str(
+          gpr_getenv("GRPC_XDS_EXPERIMENTAL_V3_SUPPORT"));
+      bool enabled = false;
+      if (gpr_parse_bool_value(enable_str.get(), &enabled) && enabled) {
+        server->server_features.insert(
+            std::move(*child.mutable_string_value()));
+      }
+    }
+  }
+  return GRPC_ERROR_CREATE_FROM_VECTOR(
+      "errors parsing \"server_features\" array", &error_list);
+}
+
 grpc_error* XdsBootstrap::ParseNode(Json* json) {
   std::vector<grpc_error*> error_list;
   node_ = absl::make_unique<Node>();
@@ -328,4 +449,72 @@ grpc_error* XdsBootstrap::ParseLocality(Json* json) {
                                        &error_list);
 }
 
+grpc_error* XdsBootstrap::ParseCertificateProviders(Json* json) {
+  std::vector<grpc_error*> error_list;
+  for (auto& certificate_provider : *(json->mutable_object())) {
+    if (certificate_provider.second.type() != Json::Type::OBJECT) {
+      error_list.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrCat("element \"", certificate_provider.first,
+                       "\" is not an object")
+              .c_str()));
+    } else {
+      grpc_error* parse_error = ParseCertificateProvider(
+          certificate_provider.first, &certificate_provider.second);
+      if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
+    }
+  }
+  return GRPC_ERROR_CREATE_FROM_VECTOR(
+      "errors parsing \"certificate_providers\" object", &error_list);
+}
+
+grpc_error* XdsBootstrap::ParseCertificateProvider(
+    const std::string& instance_name, Json* certificate_provider_json) {
+  std::vector<grpc_error*> error_list;
+  auto it = certificate_provider_json->mutable_object()->find("plugin_name");
+  if (it == certificate_provider_json->mutable_object()->end()) {
+    error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "\"plugin_name\" field not present"));
+  } else if (it->second.type() != Json::Type::STRING) {
+    error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "\"plugin_name\" field is not a string"));
+  } else {
+    std::string plugin_name = std::move(*(it->second.mutable_string_value()));
+    CertificateProviderFactory* factory =
+        CertificateProviderRegistry::LookupCertificateProviderFactory(
+            plugin_name);
+    if (factory != nullptr) {
+      RefCountedPtr<CertificateProviderFactory::Config> config;
+      it = certificate_provider_json->mutable_object()->find("config");
+      if (it != certificate_provider_json->mutable_object()->end()) {
+        if (it->second.type() != Json::Type::OBJECT) {
+          error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+              "\"config\" field is not an object"));
+        } else {
+          grpc_error* parse_error = GRPC_ERROR_NONE;
+          config = factory->CreateCertificateProviderConfig(it->second,
+                                                            &parse_error);
+          if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
+        }
+      } else {
+        // "config" is an optional field, so create an empty JSON object.
+        grpc_error* parse_error = GRPC_ERROR_NONE;
+        config = factory->CreateCertificateProviderConfig(Json::Object(),
+                                                          &parse_error);
+        if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
+      }
+      certificate_providers_.insert(
+          {instance_name, {std::move(plugin_name), std::move(config)}});
+    }
+  }
+  // Can't use GRPC_ERROR_CREATE_FROM_VECTOR() here, because the error
+  // string is not static in this case.
+  if (error_list.empty()) return GRPC_ERROR_NONE;
+  grpc_error* error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+      absl::StrCat("errors parsing element \"", instance_name, "\"").c_str());
+  for (size_t i = 0; i < error_list.size(); ++i) {
+    error = grpc_error_add_child(error, error_list[i]);
+  }
+  return error;
+}
+
 }  // namespace grpc_core

data/src/core/ext/{filters/client_channel/xds → xds}/xds_bootstrap.h

@@ -14,28 +14,39 @@
 // limitations under the License.
 //
 
-#ifndef GRPC_CORE_EXT_FILTERS_CLIENT_CHANNEL_XDS_XDS_BOOTSTRAP_H
-#define GRPC_CORE_EXT_FILTERS_CLIENT_CHANNEL_XDS_XDS_BOOTSTRAP_H
+#ifndef GRPC_CORE_EXT_XDS_XDS_BOOTSTRAP_H
+#define GRPC_CORE_EXT_XDS_XDS_BOOTSTRAP_H
 
 #include <grpc/support/port_platform.h>
 
 #include <memory>
+#include <set>
 #include <string>
 #include <vector>
 
 #include "absl/container/inlined_vector.h"
 
-#include <grpc/impl/codegen/slice.h>
+#include <grpc/slice.h>
 
-#include "src/core/lib/gprpp/map.h"
+#include "src/core/ext/xds/certificate_provider_store.h"
 #include "src/core/lib/gprpp/memory.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/json/json.h"
+#include "src/core/lib/security/credentials/credentials.h"
 
 namespace grpc_core {
 
 class XdsClient;
 
+class XdsChannelCredsRegistry {
+ public:
+  static bool IsSupported(const std::string& creds_type);
+  static bool IsValidConfig(const std::string& creds_type, const Json& config);
+  static RefCountedPtr<grpc_channel_credentials> MakeChannelCreds(
+      const std::string& creds_type, const Json& config);
+};
+
 class XdsBootstrap {
  public:
   struct Node {
@@ -47,14 +58,13 @@ class XdsBootstrap {
     Json metadata;
   };
 
-  struct ChannelCreds {
-    std::string type;
-    Json config;
-  };
-
   struct XdsServer {
     std::string server_uri;
-    absl::InlinedVector<ChannelCreds, 1> channel_creds;
+    std::string channel_creds_type;
+    Json channel_creds_config;
+    std::set<std::string> server_features;
+
+    bool ShouldUseV3() const;
   };
 
   // If *error is not GRPC_ERROR_NONE after returning, then there was an
@@ -71,18 +81,28 @@ class XdsBootstrap {
   const XdsServer& server() const { return servers_[0]; }
   const Node* node() const { return node_.get(); }
 
+  const CertificateProviderStore::PluginDefinitionMap& certificate_providers()
+      const {
+    return certificate_providers_;
+  }
+
  private:
   grpc_error* ParseXdsServerList(Json* json);
   grpc_error* ParseXdsServer(Json* json, size_t idx);
   grpc_error* ParseChannelCredsArray(Json* json, XdsServer* server);
   grpc_error* ParseChannelCreds(Json* json, size_t idx, XdsServer* server);
+  grpc_error* ParseServerFeaturesArray(Json* json, XdsServer* server);
   grpc_error* ParseNode(Json* json);
   grpc_error* ParseLocality(Json* json);
+  grpc_error* ParseCertificateProviders(Json* json);
+  grpc_error* ParseCertificateProvider(const std::string& instance_name,
+                                       Json* certificate_provider_json);
 
   absl::InlinedVector<XdsServer, 1> servers_;
   std::unique_ptr<Node> node_;
+  CertificateProviderStore::PluginDefinitionMap certificate_providers_;
 };
 
 }  // namespace grpc_core
 
-#endif /* GRPC_CORE_EXT_FILTERS_CLIENT_CHANNEL_XDS_XDS_BOOTSTRAP_H */
+#endif /* GRPC_CORE_EXT_XDS_XDS_BOOTSTRAP_H */

data/src/core/ext/xds/xds_certificate_provider.cc

@@ -0,0 +1,299 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/ext/xds/xds_certificate_provider.h"
+
+#include "absl/functional/bind_front.h"
+#include "absl/strings/str_cat.h"
+
+#include "src/core/lib/gpr/useful.h"
+
+namespace grpc_core {
+
+namespace {
+
+class RootCertificatesWatcher
+    : public grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface {
+ public:
+  // Takes a ref to \a parent instead of a raw pointer since the watcher is
+  // owned by the root certificate distributor and not by \a parent. Note that
+  // presently, the watcher is immediately deleted when
+  // CancelTlsCertificatesWatch() is called, but that can potentially change in
+  // the future.
+  explicit RootCertificatesWatcher(
+      RefCountedPtr<grpc_tls_certificate_distributor> parent)
+      : parent_(std::move(parent)) {}
+
+  void OnCertificatesChanged(absl::optional<absl::string_view> root_certs,
+                             absl::optional<PemKeyCertPairList>
+                             /* key_cert_pairs */) override {
+    if (root_certs.has_value()) {
+      parent_->SetKeyMaterials("", std::string(root_certs.value()),
+                               absl::nullopt);
+    }
+  }
+
+  void OnError(grpc_error* root_cert_error,
+               grpc_error* identity_cert_error) override {
+    if (root_cert_error != GRPC_ERROR_NONE) {
+      parent_->SetErrorForCert("", root_cert_error /* pass the ref */,
+                               absl::nullopt);
+    }
+    GRPC_ERROR_UNREF(identity_cert_error);
+  }
+
+ private:
+  RefCountedPtr<grpc_tls_certificate_distributor> parent_;
+};
+
+class IdentityCertificatesWatcher
+    : public grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface {
+ public:
+  // Takes a ref to \a parent instead of a raw pointer since the watcher is
+  // owned by the root certificate distributor and not by \a parent. Note that
+  // presently, the watcher is immediately deleted when
+  // CancelTlsCertificatesWatch() is called, but that can potentially change in
+  // the future.
+  explicit IdentityCertificatesWatcher(
+      RefCountedPtr<grpc_tls_certificate_distributor> parent)
+      : parent_(std::move(parent)) {}
+
+  void OnCertificatesChanged(
+      absl::optional<absl::string_view> /* root_certs */,
+      absl::optional<PemKeyCertPairList> key_cert_pairs) override {
+    if (key_cert_pairs.has_value()) {
+      parent_->SetKeyMaterials("", absl::nullopt, key_cert_pairs);
+    }
+  }
+
+  void OnError(grpc_error* root_cert_error,
+               grpc_error* identity_cert_error) override {
+    if (identity_cert_error != GRPC_ERROR_NONE) {
+      parent_->SetErrorForCert("", absl::nullopt,
+                               identity_cert_error /* pass the ref */);
+    }
+    GRPC_ERROR_UNREF(root_cert_error);
+  }
+
+ private:
+  RefCountedPtr<grpc_tls_certificate_distributor> parent_;
+};
+
+}  // namespace
+
+XdsCertificateProvider::XdsCertificateProvider(
+    absl::string_view root_cert_name,
+    RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor,
+    absl::string_view identity_cert_name,
+    RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor,
+    std::vector<XdsApi::StringMatcher> san_matchers)
+    : root_cert_name_(root_cert_name),
+      identity_cert_name_(identity_cert_name),
+      root_cert_distributor_(std::move(root_cert_distributor)),
+      identity_cert_distributor_(std::move(identity_cert_distributor)),
+      san_matchers_(std::move(san_matchers)),
+      distributor_(MakeRefCounted<grpc_tls_certificate_distributor>()) {
+  distributor_->SetWatchStatusCallback(
+      absl::bind_front(&XdsCertificateProvider::WatchStatusCallback, this));
+}
+
+XdsCertificateProvider::~XdsCertificateProvider() {
+  distributor_->SetWatchStatusCallback(nullptr);
+}
+
+void XdsCertificateProvider::UpdateRootCertNameAndDistributor(
+    absl::string_view root_cert_name,
+    RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor) {
+  MutexLock lock(&mu_);
+  if (root_cert_name_ == root_cert_name &&
+      root_cert_distributor_ == root_cert_distributor) {
+    return;
+  }
+  root_cert_name_ = std::string(root_cert_name);
+  if (watching_root_certs_) {
+    // The root certificates are being watched. Swap out the watcher.
+    if (root_cert_distributor_ != nullptr) {
+      root_cert_distributor_->CancelTlsCertificatesWatch(root_cert_watcher_);
+    }
+    if (root_cert_distributor != nullptr) {
+      UpdateRootCertWatcher(root_cert_distributor.get());
+    } else {
+      root_cert_watcher_ = nullptr;
+      distributor_->SetErrorForCert(
+          "",
+          GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+              "No certificate provider available for root certificates"),
+          absl::nullopt);
+    }
+  }
+  // Swap out the root certificate distributor
+  root_cert_distributor_ = std::move(root_cert_distributor);
+}
+
+void XdsCertificateProvider::UpdateIdentityCertNameAndDistributor(
+    absl::string_view identity_cert_name,
+    RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor) {
+  MutexLock lock(&mu_);
+  if (identity_cert_name_ == identity_cert_name &&
+      identity_cert_distributor_ == identity_cert_distributor) {
+    return;
+  }
+  identity_cert_name_ = std::string(identity_cert_name);
+  if (watching_identity_certs_) {
+    // The identity certificates are being watched. Swap out the watcher.
+    if (identity_cert_distributor_ != nullptr) {
+      identity_cert_distributor_->CancelTlsCertificatesWatch(
+          identity_cert_watcher_);
+    }
+    if (identity_cert_distributor != nullptr) {
+      UpdateIdentityCertWatcher(identity_cert_distributor.get());
+    } else {
+      identity_cert_watcher_ = nullptr;
+      distributor_->SetErrorForCert(
+          "", absl::nullopt,
+          GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+              "No certificate provider available for identity certificates"));
+    }
+  }
+  // Swap out the identity certificate distributor
+  identity_cert_distributor_ = std::move(identity_cert_distributor);
+}
+
+void XdsCertificateProvider::UpdateSubjectAlternativeNameMatchers(
+    std::vector<XdsApi::StringMatcher> matchers) {
+  MutexLock lock(&san_matchers_mu_);
+  san_matchers_ = std::move(matchers);
+}
+
+void XdsCertificateProvider::WatchStatusCallback(std::string cert_name,
+                                                 bool root_being_watched,
+                                                 bool identity_being_watched) {
+  // We aren't specially handling the case where root_cert_distributor is same
+  // as identity_cert_distributor. Always using two separate watchers
+  // irrespective of the fact results in a straightforward design, and using a
+  // single watcher does not seem to provide any benefit other than cutting down
+  // on the number of callbacks.
+  MutexLock lock(&mu_);
+  if (!cert_name.empty()) {
+    grpc_error* error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("Illegal certificate name: \'", cert_name,
+                     "\'. Should be empty.")
+            .c_str());
+    distributor_->SetErrorForCert(cert_name, GRPC_ERROR_REF(error),
+                                  GRPC_ERROR_REF(error));
+    GRPC_ERROR_UNREF(error);
+    return;
+  }
+  if (root_being_watched && !watching_root_certs_) {
+    // We need to start watching root certs.
+    watching_root_certs_ = true;
+    if (root_cert_distributor_ == nullptr) {
+      distributor_->SetErrorForCert(
+          "",
+          GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+              "No certificate provider available for root certificates"),
+          absl::nullopt);
+    } else {
+      UpdateRootCertWatcher(root_cert_distributor_.get());
+    }
+  } else if (!root_being_watched && watching_root_certs_) {
+    // We need to cancel root certs watch.
+    watching_root_certs_ = false;
+    if (root_cert_distributor_ != nullptr) {
+      root_cert_distributor_->CancelTlsCertificatesWatch(root_cert_watcher_);
+      root_cert_watcher_ = nullptr;
+    }
+    GPR_ASSERT(root_cert_watcher_ == nullptr);
+  }
+  if (identity_being_watched && !watching_identity_certs_) {
+    watching_identity_certs_ = true;
+    if (identity_cert_distributor_ == nullptr) {
+      distributor_->SetErrorForCert(
+          "", absl::nullopt,
+          GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+              "No certificate provider available for identity certificates"));
+    } else {
+      UpdateIdentityCertWatcher(identity_cert_distributor_.get());
+    }
+  } else if (!identity_being_watched && watching_identity_certs_) {
+    watching_identity_certs_ = false;
+    if (identity_cert_distributor_ != nullptr) {
+      identity_cert_distributor_->CancelTlsCertificatesWatch(
+          identity_cert_watcher_);
+      identity_cert_watcher_ = nullptr;
+    }
+    GPR_ASSERT(identity_cert_watcher_ == nullptr);
+  }
+}
+
+void XdsCertificateProvider::UpdateRootCertWatcher(
+    grpc_tls_certificate_distributor* root_cert_distributor) {
+  auto watcher = absl::make_unique<RootCertificatesWatcher>(distributor());
+  root_cert_watcher_ = watcher.get();
+  root_cert_distributor->WatchTlsCertificates(std::move(watcher),
+                                              root_cert_name_, absl::nullopt);
+}
+
+void XdsCertificateProvider::UpdateIdentityCertWatcher(
+    grpc_tls_certificate_distributor* identity_cert_distributor) {
+  auto watcher = absl::make_unique<IdentityCertificatesWatcher>(distributor());
+  identity_cert_watcher_ = watcher.get();
+  identity_cert_distributor->WatchTlsCertificates(
+      std::move(watcher), absl::nullopt, identity_cert_name_);
+}
+
+namespace {
+
+void* XdsCertificateProviderArgCopy(void* p) {
+  XdsCertificateProvider* xds_certificate_provider =
+      static_cast<XdsCertificateProvider*>(p);
+  return xds_certificate_provider->Ref().release();
+}
+
+void XdsCertificateProviderArgDestroy(void* p) {
+  XdsCertificateProvider* xds_certificate_provider =
+      static_cast<XdsCertificateProvider*>(p);
+  xds_certificate_provider->Unref();
+}
+
+int XdsCertificateProviderArgCmp(void* p, void* q) { return GPR_ICMP(p, q); }
+
+const grpc_arg_pointer_vtable kChannelArgVtable = {
+    XdsCertificateProviderArgCopy, XdsCertificateProviderArgDestroy,
+    XdsCertificateProviderArgCmp};
+
+}  // namespace
+
+grpc_arg XdsCertificateProvider::MakeChannelArg() const {
+  return grpc_channel_arg_pointer_create(
+      const_cast<char*>(GRPC_ARG_XDS_CERTIFICATE_PROVIDER),
+      const_cast<XdsCertificateProvider*>(this), &kChannelArgVtable);
+}
+
+RefCountedPtr<XdsCertificateProvider>
+XdsCertificateProvider::GetFromChannelArgs(const grpc_channel_args* args) {
+  XdsCertificateProvider* xds_certificate_provider =
+      grpc_channel_args_find_pointer<XdsCertificateProvider>(
+          args, GRPC_ARG_XDS_CERTIFICATE_PROVIDER);
+  return xds_certificate_provider != nullptr ? xds_certificate_provider->Ref()
+                                             : nullptr;
+}
+
+}  // namespace grpc_core