grpc 1.40.0 → 1.41.0.pre2

data/src/core/lib/json/json_util.h

@@ -46,14 +46,13 @@ inline bool ExtractJsonNumber(const Json& json, const std::string& field_name,
                               ErrorVectorType* error_list) {
   static_assert(std::is_integral<NumericType>::value, "Integral required");
   if (json.type() != Json::Type::NUMBER) {
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("field:", field_name, " error:type should be NUMBER")
-            .c_str()));
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("field:", field_name, " error:type should be NUMBER")));
     return false;
   }
   if (!absl::SimpleAtoi(json.string_value(), output)) {
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("field:", field_name, " error:failed to parse.").c_str()));
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("field:", field_name, " error:failed to parse.")));
     return false;
   }
   return true;
@@ -70,9 +69,8 @@ inline bool ExtractJsonBool(const Json& json, const std::string& field_name,
       *output = false;
       return true;
     default:
-      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("field:", field_name, " error:type should be BOOLEAN")
-              .c_str()));
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+          absl::StrCat("field:", field_name, " error:type should be BOOLEAN")));
       return false;
   }
 }
@@ -83,9 +81,8 @@ inline bool ExtractJsonString(const Json& json, const std::string& field_name,
                               ErrorVectorType* error_list) {
   if (json.type() != Json::Type::STRING) {
     *output = "";
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("field:", field_name, " error:type should be STRING")
-            .c_str()));
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("field:", field_name, " error:type should be STRING")));
     return false;
   }
   *output = json.string_value();
@@ -98,9 +95,8 @@ inline bool ExtractJsonArray(const Json& json, const std::string& field_name,
                              ErrorVectorType* error_list) {
   if (json.type() != Json::Type::ARRAY) {
     *output = nullptr;
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("field:", field_name, " error:type should be ARRAY")
-            .c_str()));
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("field:", field_name, " error:type should be ARRAY")));
     return false;
   }
   *output = &json.array_value();
@@ -113,9 +109,8 @@ inline bool ExtractJsonObject(const Json& json, const std::string& field_name,
                               ErrorVectorType* error_list) {
   if (json.type() != Json::Type::OBJECT) {
     *output = nullptr;
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("field:", field_name, " error:type should be OBJECT")
-            .c_str()));
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("field:", field_name, " error:type should be OBJECT")));
     return false;
   }
   *output = &json.object_value();
@@ -162,9 +157,8 @@ inline bool ParseJsonObjectField(const Json::Object& object,
   auto it = object.find(field_name);
   if (it == object.end()) {
     if (required) {
-      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("field:", field_name, " error:does not exist.")
-              .c_str()));
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+          absl::StrCat("field:", field_name, " error:does not exist.")));
     }
     return false;
   }
@@ -181,19 +175,17 @@ inline bool ParseJsonObjectFieldAsDuration(const Json::Object& object,
   auto it = object.find(field_name);
   if (it == object.end()) {
     if (required) {
-      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("field:", field_name, " error:does not exist.")
-              .c_str()));
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+          absl::StrCat("field:", field_name, " error:does not exist.")));
     }
     return false;
   }
   if (!ParseDurationFromJson(it->second, output)) {
     *output = GRPC_MILLIS_INF_PAST;
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
         absl::StrCat("field:", field_name,
                      " error:type should be STRING of the form given by "
-                     "google.proto.Duration.")
-            .c_str()));
+                     "google.proto.Duration.")));
     return false;
   }
   return true;

data/src/core/lib/matchers/matchers.h

@@ -23,7 +23,6 @@
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
-
 #include "re2/re2.h"
 
 namespace grpc_core {

data/src/core/lib/profiling/basic_timers.cc

@@ -22,15 +22,17 @@
 
 #ifdef GRPC_BASIC_PROFILER
 
-#include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
-#include <grpc/support/sync.h>
-#include <grpc/support/time.h>
 #include <inttypes.h>
 #include <pthread.h>
 #include <stdio.h>
 #include <string.h>
 
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/sync.h>
+#include <grpc/support/time.h>
+
+#include "src/core/lib/gpr/tls.h"
 #include "src/core/lib/gprpp/global_config.h"
 #include "src/core/lib/profiling/timers.h"
 
@@ -61,7 +63,7 @@ typedef struct gpr_timer_log_list {
   gpr_timer_log* tail;
 } gpr_timer_log_list;
 
-static __thread gpr_timer_log* g_thread_log;
+static GPR_THREAD_LOCAL(gpr_timer_log*) g_thread_log;
 static gpr_once g_once_init = GPR_ONCE_INIT;
 static FILE* output_file;
 static const char* output_filename_or_null = NULL;
@@ -71,7 +73,7 @@ static gpr_timer_log_list g_in_progress_logs;
 static gpr_timer_log_list g_done_logs;
 static int g_shutdown;
 static pthread_t g_writing_thread;
-static __thread int g_thread_id;
+static GPR_THREAD_LOCAL(int) g_thread_id;
 static int g_next_thread_id;
 static int g_writing_enabled = 1;
 

data/src/core/lib/profiling/stap_timers.cc

@@ -20,9 +20,9 @@
 
 #ifdef GRPC_STAP_PROFILER
 
-#include "src/core/lib/profiling/timers.h"
-
 #include <sys/sdt.h>
+
+#include "src/core/lib/profiling/timers.h"
 /* Generated from src/core/profiling/stap_probes.d */
 #include "src/core/lib/profiling/stap_probes.h"
 

data/src/core/lib/security/authorization/authorization_policy_provider.h

@@ -23,10 +23,11 @@
 struct grpc_authorization_policy_provider
     : public grpc_core::DualRefCounted<grpc_authorization_policy_provider> {
  public:
-  virtual grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine>
-  allow_engine() const = 0;
-  virtual grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine> deny_engine()
-      const = 0;
+  struct AuthorizationEngines {
+    grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine> allow_engine;
+    grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine> deny_engine;
+  };
+  virtual AuthorizationEngines engines() const = 0;
 };
 
 #endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_POLICY_PROVIDER_H

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -16,6 +16,8 @@
 
 #include "src/core/lib/security/authorization/evaluate_args.h"
 
+#include "absl/strings/numbers.h"
+
 #include "src/core/lib/address_utils/parse_address.h"
 #include "src/core/lib/address_utils/sockaddr_utils.h"
 #include "src/core/lib/gprpp/host_port.h"

data/src/core/lib/security/authorization/sdk_server_authz_filter.cc

@@ -0,0 +1,159 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/sdk_server_authz_filter.h"
+
+#include "src/core/lib/security/authorization/evaluate_args.h"
+#include "src/core/lib/transport/transport.h"
+
+namespace grpc_core {
+
+TraceFlag grpc_sdk_authz_trace(false, "sdk_authz");
+
+SdkServerAuthzFilter::SdkServerAuthzFilter(
+    RefCountedPtr<grpc_auth_context> auth_context, grpc_endpoint* endpoint,
+    RefCountedPtr<grpc_authorization_policy_provider> provider)
+    : auth_context_(std::move(auth_context)),
+      per_channel_evaluate_args_(auth_context_.get(), endpoint),
+      provider_(std::move(provider)) {}
+
+grpc_error_handle SdkServerAuthzFilter::Init(grpc_channel_element* elem,
+                                             grpc_channel_element_args* args) {
+  GPR_ASSERT(!args->is_last);
+  grpc_auth_context* auth_context =
+      grpc_find_auth_context_in_args(args->channel_args);
+  grpc_authorization_policy_provider* provider =
+      grpc_channel_args_find_pointer<grpc_authorization_policy_provider>(
+          args->channel_args, GRPC_ARG_AUTHORIZATION_POLICY_PROVIDER);
+  if (provider == nullptr) {
+    return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "Failed to get authorization provider.");
+  }
+  // grpc_endpoint isn't needed because the current SDK authorization policy
+  // does not support any rules that requires looking for source or destination
+  // addresses.
+  new (elem->channel_data) SdkServerAuthzFilter(
+      auth_context != nullptr ? auth_context->Ref() : nullptr,
+      /*endpoint=*/nullptr, provider->Ref());
+  return GRPC_ERROR_NONE;
+}
+
+void SdkServerAuthzFilter::Destroy(grpc_channel_element* elem) {
+  auto* chand = static_cast<SdkServerAuthzFilter*>(elem->channel_data);
+  chand->~SdkServerAuthzFilter();
+}
+
+SdkServerAuthzFilter::CallData::CallData(grpc_call_element* elem) {
+  GRPC_CLOSURE_INIT(&recv_initial_metadata_ready_, RecvInitialMetadataReady,
+                    elem, grpc_schedule_on_exec_ctx);
+}
+
+void SdkServerAuthzFilter::CallData::StartTransportStreamOpBatch(
+    grpc_call_element* elem, grpc_transport_stream_op_batch* batch) {
+  auto* calld = static_cast<CallData*>(elem->call_data);
+  if (batch->recv_initial_metadata) {
+    // Inject our callback.
+    calld->recv_initial_metadata_batch_ =
+        batch->payload->recv_initial_metadata.recv_initial_metadata;
+    calld->original_recv_initial_metadata_ready_ =
+        batch->payload->recv_initial_metadata.recv_initial_metadata_ready;
+    batch->payload->recv_initial_metadata.recv_initial_metadata_ready =
+        &calld->recv_initial_metadata_ready_;
+  }
+  grpc_call_next_op(elem, batch);
+}
+
+grpc_error_handle SdkServerAuthzFilter::CallData::Init(
+    grpc_call_element* elem, const grpc_call_element_args*) {
+  new (elem->call_data) CallData(elem);
+  return GRPC_ERROR_NONE;
+}
+
+void SdkServerAuthzFilter::CallData::Destroy(
+    grpc_call_element* elem, const grpc_call_final_info* /*final_info*/,
+    grpc_closure* /*ignored*/) {
+  CallData* calld = static_cast<CallData*>(elem->call_data);
+  calld->~CallData();
+}
+
+bool SdkServerAuthzFilter::CallData::IsAuthorized(SdkServerAuthzFilter* chand) {
+  EvaluateArgs args(recv_initial_metadata_batch_,
+                    &chand->per_channel_evaluate_args_);
+  grpc_authorization_policy_provider::AuthorizationEngines engines =
+      chand->provider_->engines();
+  if (engines.deny_engine != nullptr) {
+    AuthorizationEngine::Decision decision =
+        engines.deny_engine->Evaluate(args);
+    if (decision.type == AuthorizationEngine::Decision::Type::kDeny) {
+      if (GRPC_TRACE_FLAG_ENABLED(grpc_sdk_authz_trace)) {
+        gpr_log(GPR_INFO, "chand=%p calld=%p: request denied by policy %s.",
+                chand, this, decision.matching_policy_name.c_str());
+      }
+      return false;
+    }
+  }
+  if (engines.allow_engine != nullptr) {
+    AuthorizationEngine::Decision decision =
+        engines.allow_engine->Evaluate(args);
+    if (decision.type == AuthorizationEngine::Decision::Type::kAllow) {
+      if (GRPC_TRACE_FLAG_ENABLED(grpc_sdk_authz_trace)) {
+        gpr_log(GPR_INFO, "chand=%p calld=%p: request allowed by policy %s.",
+                chand, this, decision.matching_policy_name.c_str());
+      }
+      return true;
+    }
+  }
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_sdk_authz_trace)) {
+    gpr_log(GPR_INFO,
+            "chand=%p calld=%p: request denied, no matching policy found.",
+            chand, this);
+  }
+  return false;
+}
+
+void SdkServerAuthzFilter::CallData::RecvInitialMetadataReady(
+    void* arg, grpc_error_handle error) {
+  grpc_call_element* elem = static_cast<grpc_call_element*>(arg);
+  auto* chand = static_cast<SdkServerAuthzFilter*>(elem->channel_data);
+  auto* calld = static_cast<CallData*>(elem->call_data);
+  if (error == GRPC_ERROR_NONE) {
+    if (!calld->IsAuthorized(chand)) {
+      error = grpc_error_set_int(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+                                     "Unauthorized RPC request rejected."),
+                                 GRPC_ERROR_INT_GRPC_STATUS,
+                                 GRPC_STATUS_PERMISSION_DENIED);
+    }
+  } else {
+    GRPC_ERROR_REF(error);
+  }
+  Closure::Run(DEBUG_LOCATION, calld->original_recv_initial_metadata_ready_,
+               error);
+}
+
+const grpc_channel_filter SdkServerAuthzFilter::kFilterVtable = {
+    SdkServerAuthzFilter::CallData::StartTransportStreamOpBatch,
+    grpc_channel_next_op,
+    sizeof(SdkServerAuthzFilter::CallData),
+    SdkServerAuthzFilter::CallData::Init,
+    grpc_call_stack_ignore_set_pollset_or_pollset_set,
+    SdkServerAuthzFilter::CallData::Destroy,
+    sizeof(SdkServerAuthzFilter),
+    SdkServerAuthzFilter::Init,
+    SdkServerAuthzFilter::Destroy,
+    grpc_channel_next_get_info,
+    "sdk-server-authz"};
+
+}  // namespace grpc_core

data/src/core/lib/security/authorization/sdk_server_authz_filter.h

@@ -0,0 +1,67 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_SDK_SERVER_AUTHZ_FILTER_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_SDK_SERVER_AUTHZ_FILTER_H
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/channel/channel_stack.h"
+#include "src/core/lib/security/authorization/authorization_policy_provider.h"
+
+namespace grpc_core {
+
+class SdkServerAuthzFilter {
+ public:
+  static const grpc_channel_filter kFilterVtable;
+
+ private:
+  class CallData {
+   public:
+    static void StartTransportStreamOpBatch(
+        grpc_call_element* elem, grpc_transport_stream_op_batch* batch);
+    static grpc_error_handle Init(grpc_call_element* elem,
+                                  const grpc_call_element_args*);
+    static void Destroy(grpc_call_element* elem,
+                        const grpc_call_final_info* /*final_info*/,
+                        grpc_closure* /*ignored*/);
+
+   private:
+    explicit CallData(grpc_call_element* elem);
+
+    bool IsAuthorized(SdkServerAuthzFilter* chand);
+
+    static void RecvInitialMetadataReady(void* arg, grpc_error_handle error);
+
+    grpc_metadata_batch* recv_initial_metadata_batch_;
+    grpc_closure* original_recv_initial_metadata_ready_;
+    grpc_closure recv_initial_metadata_ready_;
+  };
+
+  SdkServerAuthzFilter(
+      RefCountedPtr<grpc_auth_context> auth_context, grpc_endpoint* endpoint,
+      RefCountedPtr<grpc_authorization_policy_provider> provider);
+
+  static grpc_error_handle Init(grpc_channel_element* elem,
+                                grpc_channel_element_args* args);
+  static void Destroy(grpc_channel_element* elem);
+
+  RefCountedPtr<grpc_auth_context> auth_context_;
+  EvaluateArgs::PerChannelArgs per_channel_evaluate_args_;
+  RefCountedPtr<grpc_authorization_policy_provider> provider_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_SDK_SERVER_AUTHZ_FILTER_H

data/src/core/lib/security/context/security_context.cc

@@ -18,22 +18,23 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/lib/security/context/security_context.h"
+
 #include <string.h>
 
+#include <grpc/grpc_security.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/arena.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/surface/call.h"
 
-#include <grpc/grpc_security.h>
-#include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
-
 grpc_core::DebugOnlyTraceFlag grpc_trace_auth_context_refcount(
     false, "auth_context_refcount");
 

data/src/core/lib/security/credentials/alts/check_gcp_environment_linux.cc

@@ -20,12 +20,12 @@
 
 #ifdef GPR_LINUX
 
-#include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
+#include <string.h>
 
 #include <grpc/support/alloc.h>
 #include <grpc/support/sync.h>
 
-#include <string.h>
+#include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
 
 #define GRPC_ALTS_EXPECT_NAME_GOOGLE "Google"
 #define GRPC_ALTS_EXPECT_NAME_GCE "Google Compute Engine"

data/src/core/lib/security/credentials/alts/check_gcp_environment_no_op.cc

@@ -20,10 +20,10 @@
 
 #if !defined(GPR_LINUX) && !defined(GPR_WINDOWS)
 
-#include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
-
 #include <grpc/support/log.h>
 
+#include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
+
 bool grpc_alts_is_running_on_gcp() {
   gpr_log(GPR_INFO,
           "ALTS: Platforms other than Linux and Windows are not supported");

data/src/core/lib/security/credentials/alts/check_gcp_environment_windows.cc

@@ -20,8 +20,6 @@
 
 #ifdef GPR_WINDOWS
 
-#include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
-
 #include <shellapi.h>
 #include <stdio.h>
 #include <tchar.h>
@@ -31,6 +29,8 @@
 #include <grpc/support/log.h>
 #include <grpc/support/sync.h>
 
+#include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
+
 namespace grpc_core {
 namespace internal {
 

data/src/core/lib/security/credentials/composite/composite_credentials.cc

@@ -26,14 +26,15 @@
 
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_join.h"
-#include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/iomgr/polling_entity.h"
-#include "src/core/lib/surface/api_trace.h"
 
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/polling_entity.h"
+#include "src/core/lib/surface/api_trace.h"
+
 /* -- Composite call credentials. -- */
 
 static void composite_call_metadata_cb(void* arg, grpc_error_handle error);

data/src/core/lib/security/credentials/credentials.cc

@@ -23,6 +23,12 @@
 #include <stdio.h>
 #include <string.h>
 
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+#include <grpc/support/sync.h>
+#include <grpc/support/time.h>
+
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/http/httpcli.h"
@@ -31,12 +37,6 @@
 #include "src/core/lib/json/json.h"
 #include "src/core/lib/surface/api_trace.h"
 
-#include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
-#include <grpc/support/sync.h>
-#include <grpc/support/time.h>
-
 /* -- Common. -- */
 
 void grpc_channel_credentials_release(grpc_channel_credentials* creds) {

data/src/core/lib/security/credentials/credentials.h

@@ -28,13 +28,13 @@
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/sync.h>
-#include "src/core/lib/transport/metadata_batch.h"
 
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/http/httpcli.h"
 #include "src/core/lib/http/parser.h"
 #include "src/core/lib/iomgr/polling_entity.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
+#include "src/core/lib/transport/metadata_batch.h"
 
 struct grpc_http_response;
 

data/src/core/lib/security/credentials/credentials_metadata.cc

@@ -18,12 +18,11 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/security/credentials/credentials.h"
+#include <string.h>
 
 #include <grpc/support/alloc.h>
 
-#include <string.h>
-
+#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/slice/slice_internal.h"
 
 static void mdelem_list_ensure_capacity(grpc_credentials_mdelem_array* list,