grpc 1.37.0 → 1.45.0

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.cc

@@ -18,11 +18,12 @@
 
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
 
+#include <stdlib.h>
+#include <string.h>
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
-#include <stdlib.h>
-#include <string.h>
 
 void grpc_tls_certificate_distributor::SetKeyMaterials(
     const std::string& cert_name, absl::optional<std::string> pem_root_certs,
@@ -100,8 +101,9 @@ bool grpc_tls_certificate_distributor::HasKeyCertPairs(
 };
 
 void grpc_tls_certificate_distributor::SetErrorForCert(
-    const std::string& cert_name, absl::optional<grpc_error*> root_cert_error,
-    absl::optional<grpc_error*> identity_cert_error) {
+    const std::string& cert_name,
+    absl::optional<grpc_error_handle> root_cert_error,
+    absl::optional<grpc_error_handle> identity_cert_error) {
   GPR_ASSERT(root_cert_error.has_value() || identity_cert_error.has_value());
   grpc_core::MutexLock lock(&mu_);
   CertificateInfo& cert_info = certificate_info_map_[cert_name];
@@ -112,7 +114,7 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
       GPR_ASSERT(watcher_it != watchers_.end());
       // identity_cert_error_to_report is the error of the identity cert this
       // watcher is watching, if there is any.
-      grpc_error* identity_cert_error_to_report = GRPC_ERROR_NONE;
+      grpc_error_handle identity_cert_error_to_report = GRPC_ERROR_NONE;
       if (identity_cert_error.has_value() &&
           watcher_it->second.identity_cert_name == cert_name) {
         identity_cert_error_to_report = *identity_cert_error;
@@ -133,7 +135,7 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
       GPR_ASSERT(watcher_it != watchers_.end());
       // root_cert_error_to_report is the error of the root cert this watcher is
       // watching, if there is any.
-      grpc_error* root_cert_error_to_report = GRPC_ERROR_NONE;
+      grpc_error_handle root_cert_error_to_report = GRPC_ERROR_NONE;
       if (root_cert_error.has_value() &&
           watcher_it->second.root_cert_name == cert_name) {
         // In this case, We've already sent the error updates at the time when
@@ -151,7 +153,7 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
   }
 };
 
-void grpc_tls_certificate_distributor::SetError(grpc_error* error) {
+void grpc_tls_certificate_distributor::SetError(grpc_error_handle error) {
   GPR_ASSERT(error != GRPC_ERROR_NONE);
   grpc_core::MutexLock lock(&mu_);
   for (const auto& watcher : watchers_) {
@@ -194,8 +196,8 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
                               identity_cert_name};
     absl::optional<absl::string_view> updated_root_certs;
     absl::optional<grpc_core::PemKeyCertPairList> updated_identity_pairs;
-    grpc_error* root_error = GRPC_ERROR_NONE;
-    grpc_error* identity_error = GRPC_ERROR_NONE;
+    grpc_error_handle root_error = GRPC_ERROR_NONE;
+    grpc_error_handle identity_error = GRPC_ERROR_NONE;
     if (root_cert_name.has_value()) {
       CertificateInfo& cert_info = certificate_info_map_[*root_cert_name];
       start_watching_root_cert = cert_info.root_cert_watchers.empty();

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h

@@ -19,12 +19,13 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/grpc_security.h>
-
 #include <utility>
 
 #include "absl/container/inlined_vector.h"
 #include "absl/types/optional.h"
+
+#include <grpc/grpc_security.h>
+
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 
@@ -68,8 +69,8 @@ struct grpc_tls_certificate_distributor
     // certificates.
     // @param identity_cert_error the error occurred while reloading identity
     // certificates.
-    virtual void OnError(grpc_error* root_cert_error,
-                         grpc_error* identity_cert_error) = 0;
+    virtual void OnError(grpc_error_handle root_cert_error,
+                         grpc_error_handle identity_cert_error) = 0;
   };
 
   // Sets the key materials based on their certificate name.
@@ -95,14 +96,14 @@ struct grpc_tls_certificate_distributor
   // @param identity_cert_error The error that the caller encounters when
   // reloading identity certs.
   void SetErrorForCert(const std::string& cert_name,
-                       absl::optional<grpc_error*> root_cert_error,
-                       absl::optional<grpc_error*> identity_cert_error);
+                       absl::optional<grpc_error_handle> root_cert_error,
+                       absl::optional<grpc_error_handle> identity_cert_error);
 
   // Propagates the error that the caller (e.g. Producer) encounters to all
   // watchers.
   //
   // @param error The error that the caller encounters.
-  void SetError(grpc_error* error);
+  void SetError(grpc_error_handle error);
 
   // Sets the TLS certificate watch status callback function. The
   // grpc_tls_certificate_distributor will invoke this callback when a new
@@ -125,7 +126,7 @@ struct grpc_tls_certificate_distributor
   // are being watched.
   void SetWatchStatusCallback(
       std::function<void(std::string, bool, bool)> callback) {
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(&callback_mu_);
     watch_status_callback_ = std::move(callback);
   };
 
@@ -169,9 +170,9 @@ struct grpc_tls_certificate_distributor
     // The contents of the identity key-certificate pairs.
     grpc_core::PemKeyCertPairList pem_key_cert_pairs;
     // The root cert reloading error propagated by the caller.
-    grpc_error* root_cert_error = GRPC_ERROR_NONE;
+    grpc_error_handle root_cert_error = GRPC_ERROR_NONE;
     // The identity cert reloading error propagated by the caller.
-    grpc_error* identity_cert_error = GRPC_ERROR_NONE;
+    grpc_error_handle identity_cert_error = GRPC_ERROR_NONE;
     // The set of watchers watching root certificates.
     // This is mainly used for quickly looking up the affected watchers while
     // performing a credential reloading.
@@ -185,11 +186,11 @@ struct grpc_tls_certificate_distributor
       GRPC_ERROR_UNREF(root_cert_error);
       GRPC_ERROR_UNREF(identity_cert_error);
     }
-    void SetRootError(grpc_error* error) {
+    void SetRootError(grpc_error_handle error) {
       GRPC_ERROR_UNREF(root_cert_error);
       root_cert_error = error;
     }
-    void SetIdentityError(grpc_error* error) {
+    void SetIdentityError(grpc_error_handle error) {
       GRPC_ERROR_UNREF(identity_cert_error);
       identity_cert_error = error;
     }
@@ -201,13 +202,16 @@ struct grpc_tls_certificate_distributor
   // functions.
   grpc_core::Mutex callback_mu_;
   // Stores information about each watcher.
-  std::map<TlsCertificatesWatcherInterface*, WatcherInfo> watchers_;
+  std::map<TlsCertificatesWatcherInterface*, WatcherInfo> watchers_
+      ABSL_GUARDED_BY(mu_);
   // The callback to notify the caller, e.g. the Producer, that the watch status
   // is changed.
-  std::function<void(std::string, bool, bool)> watch_status_callback_;
+  std::function<void(std::string, bool, bool)> watch_status_callback_
+      ABSL_GUARDED_BY(callback_mu_);
   // Stores the names of each certificate, and their corresponding credential
   // contents as well as some additional watcher information.
-  std::map<std::string, CertificateInfo> certificate_info_map_;
+  std::map<std::string, CertificateInfo> certificate_info_map_
+      ABSL_GUARDED_BY(mu_);
 };
 
 #endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_DISTRIBUTOR_H

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc

@@ -18,6 +18,8 @@
 
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 
+#include <openssl/ssl.h>
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
@@ -29,17 +31,16 @@
 namespace grpc_core {
 
 StaticDataCertificateProvider::StaticDataCertificateProvider(
-    std::string root_certificate,
-    grpc_core::PemKeyCertPairList pem_key_cert_pairs)
+    std::string root_certificate, PemKeyCertPairList pem_key_cert_pairs)
     : distributor_(MakeRefCounted<grpc_tls_certificate_distributor>()),
       root_certificate_(std::move(root_certificate)),
       pem_key_cert_pairs_(std::move(pem_key_cert_pairs)) {
   distributor_->SetWatchStatusCallback([this](std::string cert_name,
                                               bool root_being_watched,
                                               bool identity_being_watched) {
-    grpc_core::MutexLock lock(&mu_);
+    MutexLock lock(&mu_);
     absl::optional<std::string> root_certificate;
-    absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs;
+    absl::optional<PemKeyCertPairList> pem_key_cert_pairs;
     StaticDataCertificateProvider::WatcherInfo& info = watcher_info_[cert_name];
     if (!info.root_being_watched && root_being_watched &&
         !root_certificate_.empty()) {
@@ -60,8 +61,8 @@ StaticDataCertificateProvider::StaticDataCertificateProvider(
       distributor_->SetKeyMaterials(cert_name, std::move(root_certificate),
                                     std::move(pem_key_cert_pairs));
     }
-    grpc_error* root_cert_error = GRPC_ERROR_NONE;
-    grpc_error* identity_cert_error = GRPC_ERROR_NONE;
+    grpc_error_handle root_cert_error = GRPC_ERROR_NONE;
+    grpc_error_handle identity_cert_error = GRPC_ERROR_NONE;
     if (root_being_watched && !root_has_update) {
       root_cert_error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
           "Unable to get latest root certificates.");
@@ -121,15 +122,15 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
       provider->ForceUpdate();
     }
   };
-  refresh_thread_ = grpc_core::Thread(
-      "FileWatcherCertificateProvider_refreshing_thread", thread_lambda, this);
+  refresh_thread_ = Thread("FileWatcherCertificateProvider_refreshing_thread",
+                           thread_lambda, this);
   refresh_thread_.Start();
   distributor_->SetWatchStatusCallback([this](std::string cert_name,
                                               bool root_being_watched,
                                               bool identity_being_watched) {
-    grpc_core::MutexLock lock(&mu_);
+    MutexLock lock(&mu_);
     absl::optional<std::string> root_certificate;
-    absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs;
+    absl::optional<PemKeyCertPairList> pem_key_cert_pairs;
     FileWatcherCertificateProvider::WatcherInfo& info =
         watcher_info_[cert_name];
     if (!info.root_being_watched && root_being_watched &&
@@ -150,8 +151,8 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
       distributor_->SetKeyMaterials(cert_name, root_certificate,
                                     pem_key_cert_pairs);
     }
-    grpc_error* root_cert_error = GRPC_ERROR_NONE;
-    grpc_error* identity_cert_error = GRPC_ERROR_NONE;
+    grpc_error_handle root_cert_error = GRPC_ERROR_NONE;
+    grpc_error_handle identity_cert_error = GRPC_ERROR_NONE;
     if (root_being_watched && !root_certificate.has_value()) {
       root_cert_error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
           "Unable to get latest root certificates.");
@@ -178,7 +179,7 @@ FileWatcherCertificateProvider::~FileWatcherCertificateProvider() {
 
 void FileWatcherCertificateProvider::ForceUpdate() {
   absl::optional<std::string> root_certificate;
-  absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs;
+  absl::optional<PemKeyCertPairList> pem_key_cert_pairs;
   if (!root_cert_path_.empty()) {
     root_certificate = ReadRootCertificatesFromFile(root_cert_path_);
   }
@@ -186,7 +187,7 @@ void FileWatcherCertificateProvider::ForceUpdate() {
     pem_key_cert_pairs = ReadIdentityKeyCertPairFromFiles(
         private_key_path_, identity_certificate_path_);
   }
-  grpc_core::MutexLock lock(&mu_);
+  MutexLock lock(&mu_);
   const bool root_cert_changed =
       (!root_certificate.has_value() && !root_certificate_.empty()) ||
       (root_certificate.has_value() && root_certificate_ != *root_certificate);
@@ -210,15 +211,16 @@ void FileWatcherCertificateProvider::ForceUpdate() {
   }
   if (root_cert_changed || identity_cert_changed) {
     ExecCtx exec_ctx;
-    grpc_error* root_cert_error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+    grpc_error_handle root_cert_error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
         "Unable to get latest root certificates.");
-    grpc_error* identity_cert_error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "Unable to get latest identity certificates.");
+    grpc_error_handle identity_cert_error =
+        GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+            "Unable to get latest identity certificates.");
     for (const auto& p : watcher_info_) {
       const std::string& cert_name = p.first;
       const WatcherInfo& info = p.second;
       absl::optional<std::string> root_to_report;
-      absl::optional<grpc_core::PemKeyCertPairList> identity_to_report;
+      absl::optional<PemKeyCertPairList> identity_to_report;
       // Set key materials to the distributor if their contents changed.
       if (info.root_being_watched && !root_certificate_.empty() &&
           root_cert_changed) {
@@ -256,11 +258,12 @@ FileWatcherCertificateProvider::ReadRootCertificatesFromFile(
     const std::string& root_cert_full_path) {
   // Read the root file.
   grpc_slice root_slice = grpc_empty_slice();
-  grpc_error* root_error =
+  grpc_error_handle root_error =
       grpc_load_file(root_cert_full_path.c_str(), 0, &root_slice);
   if (root_error != GRPC_ERROR_NONE) {
     gpr_log(GPR_ERROR, "Reading file %s failed: %s",
-            root_cert_full_path.c_str(), grpc_error_string(root_error));
+            root_cert_full_path.c_str(),
+            grpc_error_std_string(root_error).c_str());
     GRPC_ERROR_UNREF(root_error);
     return absl::nullopt;
   }
@@ -275,7 +278,7 @@ namespace {
 // it logs the error and returns 0.
 time_t GetModificationTime(const char* filename) {
   time_t ts = 0;
-  absl::Status status = grpc_core::GetFileModificationTime(filename, &ts);
+  absl::Status status = GetFileModificationTime(filename, &ts);
   return ts;
 }
 
@@ -314,19 +317,21 @@ FileWatcherCertificateProvider::ReadIdentityKeyCertPairFromFiles(
     }
     // Read the identity files.
     SliceWrapper key_slice, cert_slice;
-    grpc_error* key_error =
+    grpc_error_handle key_error =
         grpc_load_file(private_key_path.c_str(), 0, &key_slice.slice);
     if (key_error != GRPC_ERROR_NONE) {
       gpr_log(GPR_ERROR, "Reading file %s failed: %s. Start retrying...",
-              private_key_path.c_str(), grpc_error_string(key_error));
+              private_key_path.c_str(),
+              grpc_error_std_string(key_error).c_str());
       GRPC_ERROR_UNREF(key_error);
       continue;
     }
-    grpc_error* cert_error =
+    grpc_error_handle cert_error =
         grpc_load_file(identity_certificate_path.c_str(), 0, &cert_slice.slice);
     if (cert_error != GRPC_ERROR_NONE) {
       gpr_log(GPR_ERROR, "Reading file %s failed: %s. Start retrying...",
-              identity_certificate_path.c_str(), grpc_error_string(cert_error));
+              identity_certificate_path.c_str(),
+              grpc_error_std_string(cert_error).c_str());
       GRPC_ERROR_UNREF(cert_error);
       continue;
     }
@@ -360,6 +365,54 @@ FileWatcherCertificateProvider::ReadIdentityKeyCertPairFromFiles(
   return absl::nullopt;
 }
 
+absl::StatusOr<bool> PrivateKeyAndCertificateMatch(
+    absl::string_view private_key, absl::string_view cert_chain) {
+  if (private_key.empty()) {
+    return absl::InvalidArgumentError("Private key string is empty.");
+  }
+  if (cert_chain.empty()) {
+    return absl::InvalidArgumentError("Certificate string is empty.");
+  }
+  BIO* cert_bio = BIO_new_mem_buf(cert_chain.data(), cert_chain.size());
+  if (cert_bio == nullptr) {
+    return absl::InvalidArgumentError(
+        "Conversion from certificate string to BIO failed.");
+  }
+  // Reads the first cert from the cert_chain which is expected to be the leaf
+  // cert
+  X509* x509 = PEM_read_bio_X509(cert_bio, nullptr, nullptr, nullptr);
+  BIO_free(cert_bio);
+  if (x509 == nullptr) {
+    return absl::InvalidArgumentError(
+        "Conversion from PEM string to X509 failed.");
+  }
+  EVP_PKEY* public_evp_pkey = X509_get_pubkey(x509);
+  X509_free(x509);
+  if (public_evp_pkey == nullptr) {
+    return absl::InvalidArgumentError(
+        "Extraction of public key from x.509 certificate failed.");
+  }
+  BIO* private_key_bio =
+      BIO_new_mem_buf(private_key.data(), private_key.size());
+  if (private_key_bio == nullptr) {
+    EVP_PKEY_free(public_evp_pkey);
+    return absl::InvalidArgumentError(
+        "Conversion from private key string to BIO failed.");
+  }
+  EVP_PKEY* private_evp_pkey =
+      PEM_read_bio_PrivateKey(private_key_bio, nullptr, nullptr, nullptr);
+  BIO_free(private_key_bio);
+  if (private_evp_pkey == nullptr) {
+    EVP_PKEY_free(public_evp_pkey);
+    return absl::InvalidArgumentError(
+        "Conversion from PEM string to EVP_PKEY failed.");
+  }
+  bool result = EVP_PKEY_cmp(private_evp_pkey, public_evp_pkey) == 1;
+  EVP_PKEY_free(private_evp_pkey);
+  EVP_PKEY_free(public_evp_pkey);
+  return result;
+}
+
 }  // namespace grpc_core
 
 /** -- Wrapper APIs declared in grpc_security.h -- **/
@@ -367,6 +420,7 @@ FileWatcherCertificateProvider::ReadIdentityKeyCertPairFromFiles(
 grpc_tls_certificate_provider* grpc_tls_certificate_provider_static_data_create(
     const char* root_certificate, grpc_tls_identity_pairs* pem_key_cert_pairs) {
   GPR_ASSERT(root_certificate != nullptr || pem_key_cert_pairs != nullptr);
+  grpc_core::ExecCtx exec_ctx;
   grpc_core::PemKeyCertPairList identity_pairs_core;
   if (pem_key_cert_pairs != nullptr) {
     identity_pairs_core = std::move(pem_key_cert_pairs->pem_key_cert_pairs);
@@ -384,6 +438,7 @@ grpc_tls_certificate_provider*
 grpc_tls_certificate_provider_file_watcher_create(
     const char* private_key_path, const char* identity_certificate_path,
     const char* root_cert_path, unsigned int refresh_interval_sec) {
+  grpc_core::ExecCtx exec_ctx;
   return new grpc_core::FileWatcherCertificateProvider(
       private_key_path == nullptr ? "" : private_key_path,
       identity_certificate_path == nullptr ? "" : identity_certificate_path,

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h

@@ -19,10 +19,12 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/grpc_security.h>
 #include <string.h>
 
 #include "absl/container/inlined_vector.h"
+#include "absl/status/statusor.h"
+
+#include <grpc/grpc_security.h>
 
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
@@ -57,9 +59,8 @@ namespace grpc_core {
 class StaticDataCertificateProvider final
     : public grpc_tls_certificate_provider {
  public:
-  StaticDataCertificateProvider(
-      std::string root_certificate,
-      grpc_core::PemKeyCertPairList pem_key_cert_pairs);
+  StaticDataCertificateProvider(std::string root_certificate,
+                                PemKeyCertPairList pem_key_cert_pairs);
 
   ~StaticDataCertificateProvider() override;
 
@@ -74,9 +75,9 @@ class StaticDataCertificateProvider final
   };
   RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
   std::string root_certificate_;
-  grpc_core::PemKeyCertPairList pem_key_cert_pairs_;
+  PemKeyCertPairList pem_key_cert_pairs_;
   // Guards members below.
-  grpc_core::Mutex mu_;
+  Mutex mu_;
   // Stores each cert_name we get from the distributor callback and its watcher
   // information.
   std::map<std::string, WatcherInfo> watcher_info_;
@@ -107,7 +108,8 @@ class FileWatcherCertificateProvider final
   // Read the root certificates from files and update the distributor.
   absl::optional<std::string> ReadRootCertificatesFromFile(
       const std::string& root_cert_full_path);
-  // Read the root certificates from files and update the distributor.
+  // Read the private key and the certificate chain from files and update the
+  // distributor.
   absl::optional<PemKeyCertPairList> ReadIdentityKeyCertPairFromFiles(
       const std::string& private_key_path,
       const std::string& identity_certificate_path);
@@ -119,20 +121,26 @@ class FileWatcherCertificateProvider final
   unsigned int refresh_interval_sec_ = 0;
 
   RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
-  grpc_core::Thread refresh_thread_;
+  Thread refresh_thread_;
   gpr_event shutdown_event_;
 
   // Guards members below.
-  grpc_core::Mutex mu_;
+  Mutex mu_;
   // The most-recent credential data. It will be empty if the most recent read
   // attempt failed.
-  std::string root_certificate_;
-  grpc_core::PemKeyCertPairList pem_key_cert_pairs_;
+  std::string root_certificate_ ABSL_GUARDED_BY(mu_);
+  PemKeyCertPairList pem_key_cert_pairs_ ABSL_GUARDED_BY(mu_);
   // Stores each cert_name we get from the distributor callback and its watcher
   // information.
-  std::map<std::string, WatcherInfo> watcher_info_;
+  std::map<std::string, WatcherInfo> watcher_info_ ABSL_GUARDED_BY(mu_);
 };
 
+//  Checks if the private key matches the certificate's public key.
+//  Returns a not-OK status on failure, or a bool indicating
+//  whether the key/cert pair matches.
+absl::StatusOr<bool> PrivateKeyAndCertificateMatch(
+    absl::string_view private_key, absl::string_view cert_chain);
+
 }  // namespace grpc_core
 
 #endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_PROVIDER_H

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.cc

@@ -0,0 +1,201 @@
+//
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h"
+
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
+#include "src/core/lib/gprpp/host_port.h"
+#include "src/core/lib/gprpp/stat.h"
+#include "src/core/lib/security/credentials/tls/tls_utils.h"
+#include "src/core/lib/slice/slice_internal.h"
+#include "src/core/lib/surface/api_trace.h"
+
+namespace grpc_core {
+
+bool ExternalCertificateVerifier::Verify(
+    grpc_tls_custom_verification_check_request* request,
+    std::function<void(absl::Status)> callback, absl::Status* sync_status) {
+  {
+    MutexLock lock(&mu_);
+    request_map_.emplace(request, std::move(callback));
+  }
+  // Invoke the caller-specified verification logic embedded in
+  // external_verifier_.
+  grpc_status_code status_code = GRPC_STATUS_OK;
+  char* error_details = nullptr;
+  bool is_done = external_verifier_->verify(external_verifier_->user_data,
+                                            request, &OnVerifyDone, this,
+                                            &status_code, &error_details);
+  if (is_done) {
+    if (status_code != GRPC_STATUS_OK) {
+      *sync_status = absl::Status(static_cast<absl::StatusCode>(status_code),
+                                  error_details);
+    }
+    MutexLock lock(&mu_);
+    request_map_.erase(request);
+  }
+  gpr_free(error_details);
+  return is_done;
+}
+
+void ExternalCertificateVerifier::OnVerifyDone(
+    grpc_tls_custom_verification_check_request* request, void* callback_arg,
+    grpc_status_code status, const char* error_details) {
+  ExecCtx exec_ctx;
+  auto* self = static_cast<ExternalCertificateVerifier*>(callback_arg);
+  std::function<void(absl::Status)> callback;
+  {
+    MutexLock lock(&self->mu_);
+    auto it = self->request_map_.find(request);
+    if (it != self->request_map_.end()) {
+      callback = std::move(it->second);
+      self->request_map_.erase(it);
+    }
+  }
+  if (callback != nullptr) {
+    absl::Status return_status = absl::OkStatus();
+    if (status != GRPC_STATUS_OK) {
+      return_status =
+          absl::Status(static_cast<absl::StatusCode>(status), error_details);
+    }
+    callback(return_status);
+  }
+}
+
+bool HostNameCertificateVerifier::Verify(
+    grpc_tls_custom_verification_check_request* request,
+    std::function<void(absl::Status)>, absl::Status* sync_status) {
+  GPR_ASSERT(request != nullptr);
+  // Extract the target name, and remove its port.
+  const char* target_name = request->target_name;
+  if (target_name == nullptr) {
+    *sync_status = absl::Status(absl::StatusCode::kUnauthenticated,
+                                "Target name is not specified.");
+    return true;  // synchronous check
+  }
+  absl::string_view target_host;
+  absl::string_view ignored_port;
+  SplitHostPort(target_name, &target_host, &ignored_port);
+  if (target_host.empty()) {
+    *sync_status = absl::Status(absl::StatusCode::kUnauthenticated,
+                                "Failed to split hostname and port.");
+    return true;  // synchronous check
+  }
+  // IPv6 zone-id should not be included in comparisons.
+  const size_t zone_id = target_host.find('%');
+  if (zone_id != absl::string_view::npos) {
+    target_host.remove_suffix(target_host.size() - zone_id);
+  }
+  // Perform the hostname check.
+  // First check the DNS field. We allow prefix or suffix wildcard matching.
+  char** dns_names = request->peer_info.san_names.dns_names;
+  size_t dns_names_size = request->peer_info.san_names.dns_names_size;
+  if (dns_names != nullptr && dns_names_size > 0) {
+    for (size_t i = 0; i < dns_names_size; ++i) {
+      const char* dns_name = dns_names[i];
+      // We are using the target name sent from the client as a matcher to match
+      // against identity name on the peer cert.
+      if (VerifySubjectAlternativeName(dns_name, std::string(target_host))) {
+        return true;  // synchronous check
+      }
+    }
+  }
+  // Then check the IP address. We only allow exact matching.
+  char** ip_names = request->peer_info.san_names.ip_names;
+  size_t ip_names_size = request->peer_info.san_names.ip_names_size;
+  if (ip_names != nullptr && ip_names_size > 0) {
+    for (size_t i = 0; i < ip_names_size; ++i) {
+      const char* ip_name = ip_names[i];
+      if (target_host == ip_name) {
+        return true;  // synchronous check
+      }
+    }
+  }
+  // If there's no SAN, try the CN.
+  if (dns_names_size == 0) {
+    const char* common_name = request->peer_info.common_name;
+    // We are using the target name sent from the client as a matcher to match
+    // against identity name on the peer cert.
+    if (VerifySubjectAlternativeName(common_name, std::string(target_host))) {
+      return true;  // synchronous check
+    }
+  }
+  *sync_status = absl::Status(absl::StatusCode::kUnauthenticated,
+                              "Hostname Verification Check failed.");
+  return true;  // synchronous check
+}
+
+}  // namespace grpc_core
+
+//
+// Wrapper APIs declared in grpc_security.h
+//
+
+int grpc_tls_certificate_verifier_verify(
+    grpc_tls_certificate_verifier* verifier,
+    grpc_tls_custom_verification_check_request* request,
+    grpc_tls_on_custom_verification_check_done_cb callback, void* callback_arg,
+    grpc_status_code* sync_status, char** sync_error_details) {
+  grpc_core::ExecCtx exec_ctx;
+  std::function<void(absl::Status)> async_cb =
+      [callback, request, callback_arg](absl::Status async_status) {
+        callback(request, callback_arg,
+                 static_cast<grpc_status_code>(async_status.code()),
+                 std::string(async_status.message()).c_str());
+      };
+  absl::Status sync_status_cpp;
+  bool is_done = verifier->Verify(request, async_cb, &sync_status_cpp);
+  if (is_done) {
+    if (!sync_status_cpp.ok()) {
+      *sync_status = static_cast<grpc_status_code>(sync_status_cpp.code());
+      *sync_error_details =
+          gpr_strdup(std::string(sync_status_cpp.message()).c_str());
+    }
+  }
+  return is_done;
+}
+
+void grpc_tls_certificate_verifier_cancel(
+    grpc_tls_certificate_verifier* verifier,
+    grpc_tls_custom_verification_check_request* request) {
+  grpc_core::ExecCtx exec_ctx;
+  verifier->Cancel(request);
+}
+
+grpc_tls_certificate_verifier* grpc_tls_certificate_verifier_external_create(
+    grpc_tls_certificate_verifier_external* external_verifier) {
+  grpc_core::ExecCtx exec_ctx;
+  return new grpc_core::ExternalCertificateVerifier(external_verifier);
+}
+
+grpc_tls_certificate_verifier*
+grpc_tls_certificate_verifier_host_name_create() {
+  grpc_core::ExecCtx exec_ctx;
+  return new grpc_core::HostNameCertificateVerifier();
+}
+
+void grpc_tls_certificate_verifier_release(
+    grpc_tls_certificate_verifier* verifier) {
+  GRPC_API_TRACE("grpc_tls_certificate_verifier_release(verifier=%p)", 1,
+                 (verifier));
+  grpc_core::ExecCtx exec_ctx;
+  if (verifier != nullptr) verifier->Unref();
+}