grpc 1.39.0 → 1.41.0

data/src/core/lib/security/credentials/jwt/jwt_verifier.h

@@ -21,12 +21,12 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/iomgr/pollset.h"
-#include "src/core/lib/json/json.h"
-
 #include <grpc/slice.h>
 #include <grpc/support/time.h>
 
+#include "src/core/lib/iomgr/pollset.h"
+#include "src/core/lib/json/json.h"
+
 /* --- Constants. --- */
 
 #define GRPC_OPENID_CONFIG_URL_SUFFIX "/.well-known/openid-configuration"

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -18,7 +18,6 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/json/json.h"
 #include "src/core/lib/security/credentials/oauth2/oauth2_credentials.h"
 
 #include <string.h>
@@ -39,6 +38,7 @@
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/load_file.h"
+#include "src/core/lib/json/json.h"
 #include "src/core/lib/security/util/json_util.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/surface/api_trace.h"
@@ -401,7 +401,6 @@ class grpc_compute_engine_token_fetcher_credentials
                      GRPC_CLOSURE_INIT(&http_get_cb_closure_, response_cb,
                                        metadata_req, grpc_schedule_on_exec_ctx),
                      &metadata_req->response);
-    grpc_resource_quota_unref_internal(resource_quota);
   }
 
   std::string debug_string() override {
@@ -462,7 +461,6 @@ void grpc_google_refresh_token_credentials::fetch_oauth2(
                     GRPC_CLOSURE_INIT(&http_post_cb_closure_, response_cb,
                                       metadata_req, grpc_schedule_on_exec_ctx),
                     &metadata_req->response);
-  grpc_resource_quota_unref_internal(resource_quota);
 }
 
 grpc_google_refresh_token_credentials::grpc_google_refresh_token_credentials(
@@ -595,7 +593,6 @@ class StsTokenFetcherCredentials
         GRPC_CLOSURE_INIT(&http_post_cb_closure_, response_cb, metadata_req,
                           grpc_schedule_on_exec_ctx),
         &metadata_req->response);
-    grpc_resource_quota_unref_internal(resource_quota);
     gpr_free(body);
   }
 
@@ -663,10 +660,9 @@ absl::StatusOr<URI> ValidateStsCredentialsOptions(
                      ? ""
                      : options->token_exchange_service_uri);
   if (!sts_url.ok()) {
-    error_list.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+    error_list.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
         absl::StrFormat("Invalid or missing STS endpoint URL. Error: %s",
-                        sts_url.status().ToString())
-            .c_str()));
+                        sts_url.status().ToString())));
   } else if (sts_url->scheme() != "https" && sts_url->scheme() != "http") {
     error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
         "Invalid URI scheme, must be https to http."));

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.h

@@ -24,6 +24,7 @@
 #include <string>
 
 #include <grpc/grpc_security.h>
+
 #include "src/core/lib/json/json.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/uri/uri_parser.h"

data/src/core/lib/security/credentials/plugin/plugin_credentials.cc

@@ -87,10 +87,8 @@ static grpc_error_handle process_plugin_result(
     size_t num_md, grpc_status_code status, const char* error_details) {
   grpc_error_handle error = GRPC_ERROR_NONE;
   if (status != GRPC_STATUS_OK) {
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("Getting metadata from plugin failed with error: ",
-                     error_details)
-            .c_str());
+    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+        "Getting metadata from plugin failed with error: ", error_details));
   } else {
     bool seen_illegal_header = false;
     for (size_t i = 0; i < num_md; ++i) {

data/src/core/lib/security/credentials/ssl/ssl_credentials.cc

@@ -22,14 +22,14 @@
 
 #include <string.h>
 
-#include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/surface/api_trace.h"
-#include "src/core/tsi/ssl_transport_security.h"
-
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/surface/api_trace.h"
+#include "src/core/tsi/ssl_transport_security.h"
+
 //
 // SSL Channel Credentials.
 //

data/src/core/lib/security/credentials/ssl/ssl_credentials.h

@@ -21,7 +21,6 @@
 #include <grpc/support/port_platform.h>
 
 #include "src/core/lib/security/credentials/credentials.h"
-
 #include "src/core/lib/security/security_connector/ssl/ssl_security_connector.h"
 
 class grpc_ssl_credentials : public grpc_channel_credentials {

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.cc

@@ -18,11 +18,12 @@
 
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
 
+#include <stdlib.h>
+#include <string.h>
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
-#include <stdlib.h>
-#include <string.h>
 
 void grpc_tls_certificate_distributor::SetKeyMaterials(
     const std::string& cert_name, absl::optional<std::string> pem_root_certs,

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h

@@ -19,12 +19,13 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/grpc_security.h>
-
 #include <utility>
 
 #include "absl/container/inlined_vector.h"
 #include "absl/types/optional.h"
+
+#include <grpc/grpc_security.h>
+
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 
@@ -125,7 +126,7 @@ struct grpc_tls_certificate_distributor
   // are being watched.
   void SetWatchStatusCallback(
       std::function<void(std::string, bool, bool)> callback) {
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(&callback_mu_);
     watch_status_callback_ = std::move(callback);
   };
 
@@ -201,13 +202,16 @@ struct grpc_tls_certificate_distributor
   // functions.
   grpc_core::Mutex callback_mu_;
   // Stores information about each watcher.
-  std::map<TlsCertificatesWatcherInterface*, WatcherInfo> watchers_;
+  std::map<TlsCertificatesWatcherInterface*, WatcherInfo> watchers_
+      ABSL_GUARDED_BY(mu_);
   // The callback to notify the caller, e.g. the Producer, that the watch status
   // is changed.
-  std::function<void(std::string, bool, bool)> watch_status_callback_;
+  std::function<void(std::string, bool, bool)> watch_status_callback_
+      ABSL_GUARDED_BY(callback_mu_);
   // Stores the names of each certificate, and their corresponding credential
   // contents as well as some additional watcher information.
-  std::map<std::string, CertificateInfo> certificate_info_map_;
+  std::map<std::string, CertificateInfo> certificate_info_map_
+      ABSL_GUARDED_BY(mu_);
 };
 
 #endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_DISTRIBUTOR_H

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc

@@ -18,6 +18,8 @@
 
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 
+#include <openssl/ssl.h>
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
@@ -364,6 +366,54 @@ FileWatcherCertificateProvider::ReadIdentityKeyCertPairFromFiles(
   return absl::nullopt;
 }
 
+absl::StatusOr<bool> PrivateKeyAndCertificateMatch(
+    absl::string_view private_key, absl::string_view cert_chain) {
+  if (private_key.empty()) {
+    return absl::InvalidArgumentError("Private key string is empty.");
+  }
+  if (cert_chain.empty()) {
+    return absl::InvalidArgumentError("Certificate string is empty.");
+  }
+  BIO* cert_bio = BIO_new_mem_buf(cert_chain.data(), cert_chain.size());
+  if (cert_bio == nullptr) {
+    return absl::InvalidArgumentError(
+        "Conversion from certificate string to BIO failed.");
+  }
+  // Reads the first cert from the cert_chain which is expected to be the leaf
+  // cert
+  X509* x509 = PEM_read_bio_X509(cert_bio, nullptr, nullptr, nullptr);
+  BIO_free(cert_bio);
+  if (x509 == nullptr) {
+    return absl::InvalidArgumentError(
+        "Conversion from PEM string to X509 failed.");
+  }
+  EVP_PKEY* public_evp_pkey = X509_get_pubkey(x509);
+  X509_free(x509);
+  if (public_evp_pkey == nullptr) {
+    return absl::InvalidArgumentError(
+        "Extraction of public key from x.509 certificate failed.");
+  }
+  BIO* private_key_bio =
+      BIO_new_mem_buf(private_key.data(), private_key.size());
+  if (private_key_bio == nullptr) {
+    EVP_PKEY_free(public_evp_pkey);
+    return absl::InvalidArgumentError(
+        "Conversion from private key string to BIO failed.");
+  }
+  EVP_PKEY* private_evp_pkey =
+      PEM_read_bio_PrivateKey(private_key_bio, nullptr, nullptr, nullptr);
+  BIO_free(private_key_bio);
+  if (private_evp_pkey == nullptr) {
+    EVP_PKEY_free(public_evp_pkey);
+    return absl::InvalidArgumentError(
+        "Conversion from PEM string to EVP_PKEY failed.");
+  }
+  bool result = EVP_PKEY_cmp(private_evp_pkey, public_evp_pkey) == 1;
+  EVP_PKEY_free(private_evp_pkey);
+  EVP_PKEY_free(public_evp_pkey);
+  return result;
+}
+
 }  // namespace grpc_core
 
 /** -- Wrapper APIs declared in grpc_security.h -- **/

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h

@@ -19,10 +19,12 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/grpc_security.h>
 #include <string.h>
 
 #include "absl/container/inlined_vector.h"
+#include "absl/status/statusor.h"
+
+#include <grpc/grpc_security.h>
 
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
@@ -107,7 +109,8 @@ class FileWatcherCertificateProvider final
   // Read the root certificates from files and update the distributor.
   absl::optional<std::string> ReadRootCertificatesFromFile(
       const std::string& root_cert_full_path);
-  // Read the root certificates from files and update the distributor.
+  // Read the private key and the certificate chain from files and update the
+  // distributor.
   absl::optional<PemKeyCertPairList> ReadIdentityKeyCertPairFromFiles(
       const std::string& private_key_path,
       const std::string& identity_certificate_path);
@@ -126,13 +129,19 @@ class FileWatcherCertificateProvider final
   grpc_core::Mutex mu_;
   // The most-recent credential data. It will be empty if the most recent read
   // attempt failed.
-  std::string root_certificate_;
-  grpc_core::PemKeyCertPairList pem_key_cert_pairs_;
+  std::string root_certificate_ ABSL_GUARDED_BY(mu_);
+  grpc_core::PemKeyCertPairList pem_key_cert_pairs_ ABSL_GUARDED_BY(mu_);
   // Stores each cert_name we get from the distributor callback and its watcher
   // information.
-  std::map<std::string, WatcherInfo> watcher_info_;
+  std::map<std::string, WatcherInfo> watcher_info_ ABSL_GUARDED_BY(mu_);
 };
 
+//  Checks if the private key matches the certificate's public key.
+//  Returns a not-OK status on failure, or a bool indicating
+//  whether the key/cert pair matches.
+absl::StatusOr<bool> PrivateKeyAndCertificateMatch(
+    absl::string_view private_key, absl::string_view cert_chain);
+
 }  // namespace grpc_core
 
 #endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_PROVIDER_H

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -21,10 +21,10 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/grpc_security.h>
-
 #include "absl/container/inlined_vector.h"
 
+#include <grpc/grpc_security.h>
+
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"

data/src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -229,10 +229,9 @@ static void fake_check_peer(
   prop_name = peer.properties[0].name;
   if (prop_name == nullptr ||
       strcmp(prop_name, TSI_CERTIFICATE_TYPE_PEER_PROPERTY) != 0) {
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
         absl::StrCat("Unexpected property in fake peer: ",
-                     prop_name == nullptr ? "<EMPTY>" : prop_name)
-            .c_str());
+                     prop_name == nullptr ? "<EMPTY>" : prop_name));
     goto end;
   }
   if (strncmp(peer.properties[0].value.data, TSI_FAKE_CERTIFICATE_TYPE,
@@ -244,10 +243,9 @@ static void fake_check_peer(
   prop_name = peer.properties[1].name;
   if (prop_name == nullptr ||
       strcmp(prop_name, TSI_SECURITY_LEVEL_PEER_PROPERTY) != 0) {
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
         absl::StrCat("Unexpected property in fake peer: ",
-                     prop_name == nullptr ? "<EMPTY>" : prop_name)
-            .c_str());
+                     prop_name == nullptr ? "<EMPTY>" : prop_name));
     goto end;
   }
   if (strncmp(peer.properties[1].value.data, TSI_FAKE_SECURITY_LEVEL,

data/src/core/lib/security/security_connector/load_system_roots_fallback.cc

@@ -19,6 +19,7 @@
 #include <grpc/support/port_platform.h>
 
 #include <grpc/slice_buffer.h>
+
 #include "src/core/lib/security/security_connector/load_system_roots.h"
 
 #if !defined(GPR_LINUX) && !defined(GPR_ANDROID)

data/src/core/lib/security/security_connector/load_system_roots_linux.cc

@@ -18,12 +18,11 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/slice_buffer.h>
 #include "src/core/lib/security/security_connector/load_system_roots_linux.h"
 
-#if defined(GPR_LINUX) || defined(GPR_ANDROID)
+#include <grpc/slice_buffer.h>
 
-#include "src/core/lib/security/security_connector/load_system_roots.h"
+#if defined(GPR_LINUX) || defined(GPR_ANDROID)
 
 #include <dirent.h>
 #include <fcntl.h>
@@ -44,6 +43,7 @@
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/global_config.h"
 #include "src/core/lib/iomgr/load_file.h"
+#include "src/core/lib/security/security_connector/load_system_roots.h"
 
 GPR_GLOBAL_CONFIG_DEFINE_STRING(grpc_system_ssl_roots_dir, "",
                                 "Custom directory to SSL Roots");

data/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc

@@ -54,9 +54,8 @@ grpc_error_handle ssl_check_peer(
   }
   /* Check the peer name if specified. */
   if (peer_name != nullptr && !grpc_ssl_host_matches_name(peer, peer_name)) {
-    return GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("Peer name ", peer_name, " is not in peer certificate")
-            .c_str());
+    return GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("Peer name ", peer_name, " is not in peer certificate"));
   }
   *auth_context =
       grpc_ssl_peer_to_auth_context(peer, GRPC_SSL_TRANSPORT_SECURITY_TYPE);
@@ -162,10 +161,8 @@ class grpc_ssl_channel_security_connector final
             verify_options_->verify_peer_callback_userdata);
         gpr_free(peer_pem);
         if (callback_status) {
-          error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-              absl::StrFormat("Verify peer callback returned a failure (%d)",
-                              callback_status)
-                  .c_str());
+          error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrFormat(
+              "Verify peer callback returned a failure (%d)", callback_status));
         }
       }
     }

data/src/core/lib/security/security_connector/ssl/ssl_security_connector.h

@@ -23,9 +23,8 @@
 
 #include <grpc/grpc_security.h>
 
-#include "src/core/lib/security/security_connector/security_connector.h"
-
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
 

data/src/core/lib/security/security_connector/ssl_utils.cc

@@ -173,9 +173,8 @@ grpc_error_handle grpc_ssl_check_peer_name(absl::string_view peer_name,
                                            const tsi_peer* peer) {
   /* Check the peer name if specified. */
   if (!peer_name.empty() && !grpc_ssl_host_matches_name(peer, peer_name)) {
-    return GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("Peer name ", peer_name, " is not in peer certificate")
-            .c_str());
+    return GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("Peer name ", peer_name, " is not in peer certificate"));
   }
   return GRPC_ERROR_NONE;
 }

data/src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -172,9 +172,9 @@ void TlsChannelSecurityConnector::add_handshakers(
     const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
     HandshakeManager* handshake_mgr) {
   MutexLock lock(&mu_);
+  tsi_handshaker* tsi_hs = nullptr;
   if (client_handshaker_factory_ != nullptr) {
     // Instantiate TSI handshaker.
-    tsi_handshaker* tsi_hs = nullptr;
     tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
         client_handshaker_factory_,
         overridden_target_name_.empty() ? target_name_.c_str()
@@ -183,16 +183,10 @@ void TlsChannelSecurityConnector::add_handshakers(
     if (result != TSI_OK) {
       gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
               tsi_result_to_string(result));
-      return;
     }
-    // Create handshakers.
-    handshake_mgr->Add(SecurityHandshakerCreate(tsi_hs, this, args));
-    return;
   }
-  // TODO(ZhenLian): Implement the logic(delegation to
-  // BlockOnInitialCredentialHandshaker) when certificates are not ready.
-  gpr_log(GPR_ERROR, "%s not supported yet.",
-          "Client BlockOnInitialCredentialHandshaker");
+  // If tsi_hs is null, this will add a failing handshaker.
+  handshake_mgr->Add(SecurityHandshakerCreate(tsi_hs, this, args));
 }
 
 void TlsChannelSecurityConnector::check_peer(
@@ -427,27 +421,23 @@ TlsChannelSecurityConnector::ProcessServerAuthorizationCheckResult(
   grpc_error_handle error = GRPC_ERROR_NONE;
   /* Server authorization check is cancelled by caller. */
   if (arg->status == GRPC_STATUS_CANCELLED) {
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
         absl::StrCat("Server authorization check is cancelled by the caller "
                      "with error: ",
-                     arg->error_details->error_details())
-            .c_str());
+                     arg->error_details->error_details()));
   } else if (arg->status == GRPC_STATUS_OK) {
     /* Server authorization check completed successfully but returned check
      * failure. */
     if (!arg->success) {
-      error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+      error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
           absl::StrCat("Server authorization check failed with error: ",
-                       arg->error_details->error_details())
-              .c_str());
+                       arg->error_details->error_details()));
     }
     /* Server authorization check did not complete correctly. */
   } else {
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat(
-            "Server authorization check did not finish correctly with error: ",
-            arg->error_details->error_details())
-            .c_str());
+    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+        "Server authorization check did not finish correctly with error: ",
+        arg->error_details->error_details()));
   }
   return error;
 }
@@ -549,24 +539,18 @@ void TlsServerSecurityConnector::add_handshakers(
     const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
     HandshakeManager* handshake_mgr) {
   MutexLock lock(&mu_);
+  tsi_handshaker* tsi_hs = nullptr;
   if (server_handshaker_factory_ != nullptr) {
     // Instantiate TSI handshaker.
-    tsi_handshaker* tsi_hs = nullptr;
     tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
         server_handshaker_factory_, &tsi_hs);
     if (result != TSI_OK) {
       gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
               tsi_result_to_string(result));
-      return;
     }
-    // Create handshakers.
-    handshake_mgr->Add(SecurityHandshakerCreate(tsi_hs, this, args));
-    return;
   }
-  // TODO(ZhenLian): Implement the logic(delegation to
-  // BlockOnInitialCredentialHandshaker) when certificates are not ready.
-  gpr_log(GPR_ERROR, "%s not supported yet.",
-          "Server BlockOnInitialCredentialHandshaker");
+  // If tsi_hs is null, this will add a failing handshaker.
+  handshake_mgr->Add(SecurityHandshakerCreate(tsi_hs, this, args));
 }
 
 void TlsServerSecurityConnector::check_peer(
@@ -671,9 +655,8 @@ grpc_error_handle TlsCheckHostName(const char* peer_name,
                                    const tsi_peer* peer) {
   /* Check the peer name if specified. */
   if (peer_name != nullptr && !grpc_ssl_host_matches_name(peer, peer_name)) {
-    return GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("Peer name ", peer_name, " is not in peer certificate")
-            .c_str());
+    return GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("Peer name ", peer_name, " is not in peer certificate"));
   }
   return GRPC_ERROR_NONE;
 }

data/src/core/lib/security/transport/auth_filters.h

@@ -22,6 +22,7 @@
 #include <grpc/support/port_platform.h>
 
 #include <grpc/grpc_security.h>
+
 #include "src/core/lib/channel/channel_stack.h"
 
 extern const grpc_channel_filter grpc_client_auth_filter;

data/src/core/lib/security/transport/client_auth_filter.cc

@@ -18,8 +18,6 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/security/transport/auth_filters.h"
-
 #include <string.h>
 
 #include <string>
@@ -37,6 +35,7 @@
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
+#include "src/core/lib/security/transport/auth_filters.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
 #include "src/core/lib/surface/call.h"
@@ -339,13 +338,12 @@ static void on_host_checked(void* arg, grpc_error_handle error) {
   if (error == GRPC_ERROR_NONE) {
     send_security_metadata(elem, batch);
   } else {
-    std::string error_msg = absl::StrCat(
-        "Invalid host ", grpc_core::StringViewFromSlice(calld->host),
-        " set in :authority metadata.");
     grpc_transport_stream_op_batch_finish_with_failure(
         batch,
         grpc_error_set_int(
-            GRPC_ERROR_CREATE_FROM_COPIED_STRING(error_msg.c_str()),
+            GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+                "Invalid host ", grpc_core::StringViewFromSlice(calld->host),
+                " set in :authority metadata.")),
             GRPC_ERROR_INT_GRPC_STATUS, GRPC_STATUS_UNAUTHENTICATED),
         calld->call_combiner);
   }

data/src/core/lib/security/transport/secure_endpoint.cc

@@ -16,26 +16,23 @@
  *
  */
 
-/* With the addition of a libuv endpoint, sockaddr.h now includes uv.h when
-   using that endpoint. Because of various transitive includes in uv.h,
-   including windows.h on Windows, uv.h must be included before other system
-   headers. Therefore, sockaddr.h must always be included first */
 #include <grpc/support/port_platform.h>
 
-#include <new>
+#include "src/core/lib/security/transport/secure_endpoint.h"
 
-#include "src/core/lib/iomgr/sockaddr.h"
+#include <new>
 
 #include <grpc/slice.h>
 #include <grpc/slice_buffer.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/sync.h>
+
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/memory.h"
+#include "src/core/lib/iomgr/sockaddr.h"
 #include "src/core/lib/profiling/timers.h"
-#include "src/core/lib/security/transport/secure_endpoint.h"
 #include "src/core/lib/security/transport/tsi_error.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
@@ -416,12 +413,6 @@ static int endpoint_get_fd(grpc_endpoint* secure_ep) {
   return grpc_endpoint_get_fd(ep->wrapped_ep);
 }
 
-static grpc_resource_user* endpoint_get_resource_user(
-    grpc_endpoint* secure_ep) {
-  secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
-  return grpc_endpoint_get_resource_user(ep->wrapped_ep);
-}
-
 static bool endpoint_can_track_err(grpc_endpoint* secure_ep) {
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
   return grpc_endpoint_can_track_err(ep->wrapped_ep);
@@ -434,7 +425,6 @@ static const grpc_endpoint_vtable vtable = {endpoint_read,
                                             endpoint_delete_from_pollset_set,
                                             endpoint_shutdown,
                                             endpoint_destroy,
-                                            endpoint_get_resource_user,
                                             endpoint_get_peer,
                                             endpoint_get_local_address,
                                             endpoint_get_fd,

data/src/core/lib/security/transport/secure_endpoint.h

@@ -22,6 +22,7 @@
 #include <grpc/support/port_platform.h>
 
 #include <grpc/slice.h>
+
 #include "src/core/lib/iomgr/endpoint.h"
 
 struct tsi_frame_protector;