grpc 1.32.0 → 1.35.0

data/src/core/lib/security/security_connector/tls/tls_security_connector.h

@@ -23,13 +23,14 @@
 
 #include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 
 #define GRPC_TLS_TRANSPORT_SECURITY_TYPE "tls"
 
 namespace grpc_core {
 
-// TLS channel security connector.
+// Channel security connector using TLS as transport security protocol.
 class TlsChannelSecurityConnector final
     : public grpc_channel_security_connector {
  public:
@@ -37,14 +38,18 @@ class TlsChannelSecurityConnector final
   static grpc_core::RefCountedPtr<grpc_channel_security_connector>
   CreateTlsChannelSecurityConnector(
       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options> options,
       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
       const char* target_name, const char* overridden_target_name,
       tsi_ssl_session_cache* ssl_session_cache);
 
   TlsChannelSecurityConnector(
       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options> options,
       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-      const char* target_name, const char* overridden_target_name);
+      const char* target_name, const char* overridden_target_name,
+      tsi_ssl_session_cache* ssl_session_cache);
+
   ~TlsChannelSecurityConnector() override;
 
   void add_handshakers(const grpc_channel_args* args,
@@ -64,15 +69,44 @@ class TlsChannelSecurityConnector final
   void cancel_check_call_host(grpc_closure* on_call_host_checked,
                               grpc_error* error) override;
 
- private:
-  // Initialize SSL TSI client handshaker factory.
-  grpc_security_status InitializeHandshakerFactory(
-      tsi_ssl_session_cache* ssl_session_cache);
+  tsi_ssl_client_handshaker_factory* ClientHandshakerFactoryForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return client_handshaker_factory_;
+  };
 
-  // A util function to create a new client handshaker factory to replace
-  // the existing one if exists.
-  grpc_security_status ReplaceHandshakerFactory(
-      tsi_ssl_session_cache* ssl_session_cache);
+  absl::optional<absl::string_view> RootCertsForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return pem_root_certs_;
+  }
+
+  absl::optional<grpc_core::PemKeyCertPairList> KeyCertPairListForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return pem_key_cert_pair_list_;
+  }
+
+ private:
+  // A watcher that watches certificate updates from
+  // grpc_tls_certificate_distributor. It will never outlive
+  // |security_connector_|.
+  class TlsChannelCertificateWatcher : public grpc_tls_certificate_distributor::
+                                           TlsCertificatesWatcherInterface {
+   public:
+    explicit TlsChannelCertificateWatcher(
+        TlsChannelSecurityConnector* security_connector)
+        : security_connector_(security_connector) {}
+    void OnCertificatesChanged(
+        absl::optional<absl::string_view> root_certs,
+        absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) override;
+    void OnError(grpc_error* root_cert_error,
+                 grpc_error* identity_cert_error) override;
+
+   private:
+    TlsChannelSecurityConnector* security_connector_ = nullptr;
+  };
+
+  // Updates |client_handshaker_factory_| when the certificates that
+  // |certificate_watcher_| is watching get updated.
+  grpc_security_status UpdateHandshakerFactoryLocked();
 
   // gRPC-provided callback executed by application, which servers to bring the
   // control back to gRPC core.
@@ -91,29 +125,32 @@ class TlsChannelSecurityConnector final
   static void ServerAuthorizationCheckArgDestroy(
       grpc_tls_server_authorization_check_arg* arg);
 
-  // A util function to refresh SSL TSI client handshaker factory with a valid
-  // credential.
-  grpc_security_status RefreshHandshakerFactory();
-
   grpc_core::Mutex mu_;
-  grpc_closure* on_peer_checked_;
+  grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
+  grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
+      certificate_watcher_ = nullptr;
+  grpc_closure* on_peer_checked_ = nullptr;
   std::string target_name_;
   std::string overridden_target_name_;
   tsi_ssl_client_handshaker_factory* client_handshaker_factory_ = nullptr;
-  grpc_tls_server_authorization_check_arg* check_arg_;
-  grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
+  grpc_tls_server_authorization_check_arg* check_arg_ = nullptr;
+  tsi_ssl_session_cache* ssl_session_cache_ = nullptr;
+  absl::optional<absl::string_view> pem_root_certs_;
+  absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pair_list_;
 };
 
-// TLS server security connector.
+// Server security connector using TLS as transport security protocol.
 class TlsServerSecurityConnector final : public grpc_server_security_connector {
  public:
   // static factory method to create a TLS server security connector.
   static grpc_core::RefCountedPtr<grpc_server_security_connector>
   CreateTlsServerSecurityConnector(
-      grpc_core::RefCountedPtr<grpc_server_credentials> server_creds);
+      grpc_core::RefCountedPtr<grpc_server_credentials> server_creds,
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options> options);
 
-  explicit TlsServerSecurityConnector(
-      grpc_core::RefCountedPtr<grpc_server_credentials> server_creds);
+  TlsServerSecurityConnector(
+      grpc_core::RefCountedPtr<grpc_server_credentials> server_creds,
+      grpc_core::RefCountedPtr<grpc_tls_credentials_options> options);
   ~TlsServerSecurityConnector() override;
 
   void add_handshakers(const grpc_channel_args* args,
@@ -126,58 +163,65 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
 
   int cmp(const grpc_security_connector* other) const override;
 
- private:
-  // Initialize SSL TSI server handshaker factory.
-  grpc_security_status InitializeHandshakerFactory();
+  tsi_ssl_server_handshaker_factory* ServerHandshakerFactoryForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return server_handshaker_factory_;
+  };
 
-  // A util function to create a new server handshaker factory to replace the
-  // existing once if exists.
-  grpc_security_status ReplaceHandshakerFactory();
+  const absl::optional<absl::string_view>& RootCertsForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return pem_root_certs_;
+  }
 
-  // A util function to refresh SSL TSI server handshaker factory with a valid
-  // credential.
-  grpc_security_status RefreshHandshakerFactory();
+  const absl::optional<grpc_core::PemKeyCertPairList>&
+  KeyCertPairListForTesting() {
+    grpc_core::MutexLock lock(&mu_);
+    return pem_key_cert_pair_list_;
+  }
+
+ private:
+  // A watcher that watches certificate updates from
+  // grpc_tls_certificate_distributor. It will never outlive
+  // |security_connector_|.
+  class TlsServerCertificateWatcher : public grpc_tls_certificate_distributor::
+                                          TlsCertificatesWatcherInterface {
+   public:
+    explicit TlsServerCertificateWatcher(
+        TlsServerSecurityConnector* security_connector)
+        : security_connector_(security_connector) {}
+    void OnCertificatesChanged(
+        absl::optional<absl::string_view> root_certs,
+        absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) override;
+    void OnError(grpc_error* root_cert_error,
+                 grpc_error* identity_cert_error) override;
+
+   private:
+    TlsServerSecurityConnector* security_connector_ = nullptr;
+  };
+
+  // Updates |server_handshaker_factory_| when the certificates that
+  // |certificate_watcher_| is watching get updated.
+  grpc_security_status UpdateHandshakerFactoryLocked();
 
   grpc_core::Mutex mu_;
+  grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
+  grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
+      certificate_watcher_ = nullptr;
+
   tsi_ssl_server_handshaker_factory* server_handshaker_factory_ = nullptr;
-  grpc_core::RefCountedPtr<grpc_tls_key_materials_config> key_materials_config_;
+  absl::optional<absl::string_view> pem_root_certs_;
+  absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pair_list_;
 };
 
 // ---- Functions below are exposed for testing only -----------------------
-
-/** The |TlsFetchKeyMaterials| API ensures that |key_materials_config| has a
- *  non-empty pem-key-cert pair list. This is done as follows:
- *  - if |options| is equipped with a credential reload config, then this
- *    methods uses credential reloading to populate |key_materials_config|, and
- *    afterwards it populates |reload_status| with the status of this operation.
- *    In particular, any data stored in |key_materials_config| is overwritten.
- *  - if |options| has no credential reload config, then:
- *    - if |key_materials_config| already has a non-empty pem-key-cert pair
- *      list or is called by a client, then the method returns |GRPC_STATUS_OK|.
- *    - if |key_materials_config| has an empty pem-key-cert pair list and is
- *      called by a server, then the method return an error code.
- *
- *  The arguments are detailed below:
- *  - key_materials_config: a key materials config that will be populated by the
- *    method on success; the caller should not pass in nullptr. Any data held by
- *    the config will be overwritten.
- *  - options: the TLS credentials options whose credential reloading config
- *    will be used to populate |key_materials_config|.
- *  - is_server: true denotes that this method is called by a server, and
- *    false denotes that this method is called by a client.
- *  - status: the status of the credential reloading after the method
- *    returns; the caller should not pass in nullptr. **/
-grpc_status_code TlsFetchKeyMaterials(
-    const grpc_core::RefCountedPtr<grpc_tls_key_materials_config>&
-        key_materials_config,
-    const grpc_tls_credentials_options& options, bool is_server,
-    grpc_ssl_certificate_config_reload_status* status);
+namespace internal {
 
 // TlsCheckHostName checks if |peer_name| matches the identity information
 // contained in |peer|. This is AKA hostname check.
 grpc_error* TlsCheckHostName(const char* peer_name, const tsi_peer* peer);
 
+}  // namespace internal
+
 }  // namespace grpc_core
 
-#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H \
-        */
+#endif  // GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H

data/src/core/lib/security/transport/secure_endpoint.cc

@@ -443,10 +443,10 @@ static const grpc_endpoint_vtable vtable = {endpoint_read,
 grpc_endpoint* grpc_secure_endpoint_create(
     struct tsi_frame_protector* protector,
     struct tsi_zero_copy_grpc_protector* zero_copy_protector,
-    grpc_endpoint* transport, grpc_slice* leftover_slices,
+    grpc_endpoint* to_wrap, grpc_slice* leftover_slices,
     size_t leftover_nslices) {
   secure_endpoint* ep =
-      new secure_endpoint(&vtable, protector, zero_copy_protector, transport,
+      new secure_endpoint(&vtable, protector, zero_copy_protector, to_wrap,
                           leftover_slices, leftover_nslices);
   return &ep->base;
 }

data/src/core/lib/security/transport/security_handshaker.cc

@@ -241,8 +241,8 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error* error) {
       handshaker_result_, &unused_bytes, &unused_bytes_size);
   // Create secure endpoint.
   if (unused_bytes_size > 0) {
-    grpc_slice slice =
-        grpc_slice_from_copied_buffer((char*)unused_bytes, unused_bytes_size);
+    grpc_slice slice = grpc_slice_from_copied_buffer(
+        reinterpret_cast<const char*>(unused_bytes), unused_bytes_size);
     args_->endpoint = grpc_secure_endpoint_create(
         protector, zero_copy_protector, args_->endpoint, &slice, 1);
     grpc_slice_unref_internal(slice);
@@ -499,7 +499,7 @@ class FailHandshaker : public Handshaker {
   }
 
  private:
-  virtual ~FailHandshaker() = default;
+  ~FailHandshaker() override = default;
 };
 
 //

data/src/core/lib/security/transport/server_auth_filter.cc

@@ -123,8 +123,9 @@ static grpc_filtered_mdelem remove_consumed_md(void* user_data,
   for (i = 0; i < calld->num_consumed_md; i++) {
     const grpc_metadata* consumed_md = &calld->consumed_md[i];
     if (grpc_slice_eq(GRPC_MDKEY(md), consumed_md->key) &&
-        grpc_slice_eq(GRPC_MDVALUE(md), consumed_md->value))
+        grpc_slice_eq(GRPC_MDVALUE(md), consumed_md->value)) {
       return GRPC_FILTERED_REMOVE();
+    }
   }
   return GRPC_FILTERED_MDELEM(md);
 }

data/src/core/lib/security/util/json_util.h

@@ -30,6 +30,7 @@
 #define GRPC_AUTH_JSON_TYPE_INVALID "invalid"
 #define GRPC_AUTH_JSON_TYPE_SERVICE_ACCOUNT "service_account"
 #define GRPC_AUTH_JSON_TYPE_AUTHORIZED_USER "authorized_user"
+#define GRPC_AUTH_JSON_TYPE_EXTERNAL_ACCOUNT "external_account"
 
 // Gets a child property from a json node.
 const char* grpc_json_get_string_property(const grpc_core::Json& json,

data/src/core/lib/slice/slice.cc

@@ -555,8 +555,9 @@ int grpc_slice_buf_start_eq(grpc_slice a, const void* b, size_t len) {
 int grpc_slice_rchr(grpc_slice s, char c) {
   const char* b = reinterpret_cast<const char*> GRPC_SLICE_START_PTR(s);
   int i;
-  for (i = static_cast<int> GRPC_SLICE_LENGTH(s) - 1; i != -1 && b[i] != c; i--)
-    ;
+  for (i = static_cast<int> GRPC_SLICE_LENGTH(s) - 1; i != -1 && b[i] != c;
+       i--) {
+  }
   return i;
 }
 
@@ -574,10 +575,12 @@ int grpc_slice_slice(grpc_slice haystack, grpc_slice needle) {
 
   if (haystack_len == 0 || needle_len == 0) return -1;
   if (haystack_len < needle_len) return -1;
-  if (haystack_len == needle_len)
+  if (haystack_len == needle_len) {
     return grpc_slice_eq(haystack, needle) ? 0 : -1;
-  if (needle_len == 1)
+  }
+  if (needle_len == 1) {
     return grpc_slice_chr(haystack, static_cast<char>(*needle_bytes));
+  }
 
   const uint8_t* last = haystack_bytes + haystack_len - needle_len;
   for (const uint8_t* cur = haystack_bytes; cur != last; ++cur) {

data/src/core/lib/slice/slice_buffer.cc

@@ -106,8 +106,9 @@ uint8_t* grpc_slice_buffer_tiny_add(grpc_slice_buffer* sb, size_t n) {
   if (sb->count == 0) goto add_first;
   back = &sb->slices[sb->count - 1];
   if (back->refcount) goto add_new;
-  if ((back->data.inlined.length + n) > sizeof(back->data.inlined.bytes))
+  if ((back->data.inlined.length + n) > sizeof(back->data.inlined.bytes)) {
     goto add_new;
+  }
   out = back->data.inlined.bytes + back->data.inlined.length;
   back->data.inlined.length =
       static_cast<uint8_t>(back->data.inlined.length + n);

data/src/core/lib/slice/slice_intern.cc

@@ -74,8 +74,8 @@ InternedSliceRefcount::~InternedSliceRefcount() {
   InternedSliceRefcount* cur;
   for (prev_next = &shard->strs[TABLE_IDX(this->hash, shard->capacity)],
       cur = *prev_next;
-       cur != this; prev_next = &cur->bucket_next, cur = cur->bucket_next)
-    ;
+       cur != this; prev_next = &cur->bucket_next, cur = cur->bucket_next) {
+  }
   *prev_next = cur->bucket_next;
   shard->count--;
 }
@@ -273,17 +273,16 @@ grpc_core::ManagedMemorySlice::ManagedMemorySlice(const char* string)
     : grpc_core::ManagedMemorySlice::ManagedMemorySlice(string,
                                                         strlen(string)) {}
 
-grpc_core::ManagedMemorySlice::ManagedMemorySlice(const char* string,
-                                                  size_t len) {
+grpc_core::ManagedMemorySlice::ManagedMemorySlice(const char* buf, size_t len) {
   GPR_TIMER_SCOPE("grpc_slice_intern", 0);
-  const uint32_t hash = gpr_murmur_hash3(string, len, g_hash_seed);
+  const uint32_t hash = gpr_murmur_hash3(buf, len, g_hash_seed);
   const StaticMetadataSlice* static_slice =
-      MatchStaticSlice(hash, std::pair<const char*, size_t>(string, len));
+      MatchStaticSlice(hash, std::pair<const char*, size_t>(buf, len));
   if (static_slice) {
     *this = *static_slice;
   } else {
     *this = grpc_core::InternedSlice(FindOrCreateInternedSlice(
-        hash, std::pair<const char*, size_t>(string, len)));
+        hash, std::pair<const char*, size_t>(buf, len)));
   }
 }
 

data/src/core/lib/slice/slice_internal.h

@@ -176,7 +176,7 @@ namespace grpc_core {
 struct StaticSliceRefcount {
   static grpc_slice_refcount kStaticSubRefcount;
 
-  StaticSliceRefcount(uint32_t index)
+  explicit StaticSliceRefcount(uint32_t index)
       : base(&kStaticSubRefcount, grpc_slice_refcount::Type::STATIC),
         index(index) {}
 
@@ -310,7 +310,7 @@ inline bool grpc_slice_static_interned_equal(const grpc_slice& a,
 
 void grpc_slice_intern_init(void);
 void grpc_slice_intern_shutdown(void);
-void grpc_test_only_set_slice_hash_seed(uint32_t key);
+void grpc_test_only_set_slice_hash_seed(uint32_t seed);
 // if slice matches a static slice, returns the static slice
 // otherwise returns the passed in slice (without reffing it)
 // used for surface boundaries where we might receive an un-interned static

data/src/core/lib/surface/call.cc

@@ -124,7 +124,7 @@ struct parent_call {
 };
 
 struct child_call {
-  child_call(grpc_call* parent) : parent(parent) {}
+  explicit child_call(grpc_call* parent) : parent(parent) {}
   grpc_call* parent;
   /** siblings: children of the same parent form a list, and this list is
      protected under
@@ -284,7 +284,8 @@ grpc_core::TraceFlag grpc_compression_trace(false, "compression");
 #define CALL_FROM_TOP_ELEM(top_elem) \
   CALL_FROM_CALL_STACK(grpc_call_stack_from_top_element(top_elem))
 
-static void execute_batch(grpc_call* call, grpc_transport_stream_op_batch* op,
+static void execute_batch(grpc_call* call,
+                          grpc_transport_stream_op_batch* batch,
                           grpc_closure* start_batch_closure);
 
 static void cancel_with_status(grpc_call* c, grpc_status_code status,
@@ -298,8 +299,9 @@ static void post_batch_completion(batch_control* bctl);
 
 static void add_init_error(grpc_error** composite, grpc_error* new_err) {
   if (new_err == GRPC_ERROR_NONE) return;
-  if (*composite == GRPC_ERROR_NONE)
+  if (*composite == GRPC_ERROR_NONE) {
     *composite = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Call creation failed");
+  }
   *composite = grpc_error_add_child(*composite, new_err);
 }
 
@@ -308,20 +310,24 @@ void* grpc_call_arena_alloc(grpc_call* call, size_t size) {
 }
 
 static parent_call* get_or_create_parent_call(grpc_call* call) {
-  parent_call* p = (parent_call*)gpr_atm_acq_load(&call->parent_call_atm);
+  parent_call* p =
+      reinterpret_cast<parent_call*>(gpr_atm_acq_load(&call->parent_call_atm));
   if (p == nullptr) {
     p = call->arena->New<parent_call>();
-    if (!gpr_atm_rel_cas(&call->parent_call_atm, (gpr_atm) nullptr,
-                         (gpr_atm)p)) {
+    if (!gpr_atm_rel_cas(&call->parent_call_atm,
+                         reinterpret_cast<gpr_atm>(nullptr),
+                         reinterpret_cast<gpr_atm>(p))) {
       p->~parent_call();
-      p = (parent_call*)gpr_atm_acq_load(&call->parent_call_atm);
+      p = reinterpret_cast<parent_call*>(
+          gpr_atm_acq_load(&call->parent_call_atm));
     }
   }
   return p;
 }
 
 static parent_call* get_parent_call(grpc_call* call) {
-  return (parent_call*)gpr_atm_acq_load(&call->parent_call_atm);
+  return reinterpret_cast<parent_call*>(
+      gpr_atm_acq_load(&call->parent_call_atm));
 }
 
 size_t grpc_call_get_initial_size_estimate() {
@@ -412,7 +418,7 @@ grpc_error* grpc_call_create(const grpc_call_create_args* args,
                                  "without Census tracing propagation"));
     }
     if (args->propagation_mask & GRPC_PROPAGATE_CANCELLATION) {
-      call->cancellation_is_inherited = 1;
+      call->cancellation_is_inherited = true;
       if (gpr_atm_acq_load(&args->parent->received_final_op_atm)) {
         immediately_cancel = true;
       }
@@ -595,7 +601,7 @@ void grpc_call_unref(grpc_call* c) {
   }
 
   GPR_ASSERT(!c->destroy_called);
-  c->destroy_called = 1;
+  c->destroy_called = true;
   bool cancel = gpr_atm_acq_load(&c->any_ops_sent_atm) != 0 &&
                 gpr_atm_acq_load(&c->received_final_op_atm) == 0;
   if (cancel) {
@@ -647,15 +653,16 @@ static void execute_batch(grpc_call* call,
 }
 
 char* grpc_call_get_peer(grpc_call* call) {
-  char* peer_string = (char*)gpr_atm_acq_load(&call->peer_string);
+  char* peer_string =
+      reinterpret_cast<char*>(gpr_atm_acq_load(&call->peer_string));
   if (peer_string != nullptr) return gpr_strdup(peer_string);
   peer_string = grpc_channel_get_target(call->channel);
   if (peer_string != nullptr) return peer_string;
   return gpr_strdup("unknown");
 }
 
-grpc_call* grpc_call_from_top_element(grpc_call_element* elem) {
-  return CALL_FROM_TOP_ELEM(elem);
+grpc_call* grpc_call_from_top_element(grpc_call_element* surface_element) {
+  return CALL_FROM_TOP_ELEM(surface_element);
 }
 
 /*******************************************************************************
@@ -811,7 +818,7 @@ uint32_t grpc_call_test_only_get_message_flags(grpc_call* call) {
   return flags;
 }
 
-static void destroy_encodings_accepted_by_peer(void* /*p*/) { return; }
+static void destroy_encodings_accepted_by_peer(void* /*p*/) {}
 
 static void set_encodings_accepted_by_peer(grpc_call* /*call*/,
                                            grpc_mdelem mdel,
@@ -826,8 +833,8 @@ static void set_encodings_accepted_by_peer(grpc_call* /*call*/,
   accepted_user_data =
       grpc_mdelem_get_user_data(mdel, destroy_encodings_accepted_by_peer);
   if (accepted_user_data != nullptr) {
-    *encodings_accepted_by_peer =
-        static_cast<uint32_t>(((uintptr_t)accepted_user_data) - 1);
+    *encodings_accepted_by_peer = static_cast<uint32_t>(
+        reinterpret_cast<uintptr_t>(accepted_user_data) - 1);
     return;
   }
 
@@ -867,7 +874,8 @@ static void set_encodings_accepted_by_peer(grpc_call* /*call*/,
 
   grpc_mdelem_set_user_data(
       mdel, destroy_encodings_accepted_by_peer,
-      (void*)((static_cast<uintptr_t>(*encodings_accepted_by_peer)) + 1));
+      reinterpret_cast<void*>(
+          static_cast<uintptr_t>(*encodings_accepted_by_peer) + 1));
 }
 
 uint32_t grpc_call_test_only_get_encodings_accepted_by_peer(grpc_call* call) {
@@ -881,8 +889,8 @@ grpc_call_test_only_get_incoming_stream_encodings(grpc_call* call) {
   return call->incoming_stream_compression_algorithm;
 }
 
-static grpc_linked_mdelem* linked_from_md(const grpc_metadata* md) {
-  return (grpc_linked_mdelem*)&md->internal_data;
+static grpc_linked_mdelem* linked_from_md(grpc_metadata* md) {
+  return reinterpret_cast<grpc_linked_mdelem*>(&md->internal_data);
 }
 
 static grpc_metadata* get_md_elem(grpc_metadata* metadata,
@@ -905,8 +913,7 @@ static int prepare_application_metadata(grpc_call* call, int count,
   grpc_metadata_batch* batch =
       &call->metadata_batch[0 /* is_receiving */][is_trailing];
   for (i = 0; i < total_count; i++) {
-    const grpc_metadata* md =
-        get_md_elem(metadata, additional_metadata, i, count);
+    grpc_metadata* md = get_md_elem(metadata, additional_metadata, i, count);
     grpc_linked_mdelem* l = linked_from_md(md);
     GPR_ASSERT(sizeof(grpc_linked_mdelem) == sizeof(md->internal_data));
     if (!GRPC_LOG_IF_ERROR("validate_metadata",
@@ -925,8 +932,7 @@ static int prepare_application_metadata(grpc_call* call, int count,
   }
   if (i != total_count) {
     for (int j = 0; j < i; j++) {
-      const grpc_metadata* md =
-          get_md_elem(metadata, additional_metadata, j, count);
+      grpc_metadata* md = get_md_elem(metadata, additional_metadata, j, count);
       grpc_linked_mdelem* l = linked_from_md(md);
       GRPC_MDELEM_UNREF(l->md);
     }
@@ -1228,9 +1234,10 @@ static void post_batch_completion(batch_control* bctl) {
   if (bctl->completion_data.notify_tag.is_closure) {
     /* unrefs error */
     bctl->call = nullptr;
-    grpc_core::Closure::Run(DEBUG_LOCATION,
-                            (grpc_closure*)bctl->completion_data.notify_tag.tag,
-                            error);
+    grpc_core::Closure::Run(
+        DEBUG_LOCATION,
+        static_cast<grpc_closure*>(bctl->completion_data.notify_tag.tag),
+        error);
     GRPC_CALL_INTERNAL_UNREF(call, "completion");
   } else {
     /* unrefs error */
@@ -1253,7 +1260,7 @@ static void continue_receiving_slices(batch_control* bctl) {
     size_t remaining = call->receiving_stream->length() -
                        (*call->receiving_buffer)->data.raw.slice_buffer.length;
     if (remaining == 0) {
-      call->receiving_message = 0;
+      call->receiving_message = false;
       call->receiving_stream.reset();
       finish_batch_step(bctl);
       return;
@@ -1267,7 +1274,7 @@ static void continue_receiving_slices(batch_control* bctl) {
         call->receiving_stream.reset();
         grpc_byte_buffer_destroy(*call->receiving_buffer);
         *call->receiving_buffer = nullptr;
-        call->receiving_message = 0;
+        call->receiving_message = false;
         finish_batch_step(bctl);
         GRPC_ERROR_UNREF(error);
         return;
@@ -1303,7 +1310,7 @@ static void receiving_slice_ready(void* bctlp, grpc_error* error) {
     call->receiving_stream.reset();
     grpc_byte_buffer_destroy(*call->receiving_buffer);
     *call->receiving_buffer = nullptr;
-    call->receiving_message = 0;
+    call->receiving_message = false;
     finish_batch_step(bctl);
     if (release_error) {
       GRPC_ERROR_UNREF(error);
@@ -1315,7 +1322,7 @@ static void process_data_after_md(batch_control* bctl) {
   grpc_call* call = bctl->call;
   if (call->receiving_stream == nullptr) {
     *call->receiving_buffer = nullptr;
-    call->receiving_message = 0;
+    call->receiving_message = false;
     finish_batch_step(bctl);
   } else {
     call->test_only_last_message_flags = call->receiving_stream->flags();
@@ -1354,7 +1361,8 @@ static void receiving_stream_ready(void* bctlp, grpc_error* error) {
    * object with rel_cas, and will not use it after the cas. Its corresponding
    * acq_load is in receiving_initial_metadata_ready() */
   if (error != GRPC_ERROR_NONE || call->receiving_stream == nullptr ||
-      !gpr_atm_rel_cas(&call->recv_state, RECV_NONE, (gpr_atm)bctlp)) {
+      !gpr_atm_rel_cas(&call->recv_state, RECV_NONE,
+                       reinterpret_cast<gpr_atm>(bctlp))) {
     process_data_after_md(bctl);
   }
 }
@@ -1568,7 +1576,8 @@ static grpc_call_error call_start_batch(grpc_call* call, const grpc_op* ops,
                      static_cast<grpc_cq_completion*>(
                          gpr_malloc(sizeof(grpc_cq_completion))));
     } else {
-      grpc_core::Closure::Run(DEBUG_LOCATION, (grpc_closure*)notify_tag,
+      grpc_core::Closure::Run(DEBUG_LOCATION,
+                              static_cast<grpc_closure*>(notify_tag),
                               GRPC_ERROR_NONE);
     }
     error = GRPC_CALL_OK;