grpc 1.40.0 → 1.41.0

data/src/core/lib/security/credentials/ssl/ssl_credentials.h

@@ -21,7 +21,6 @@
 #include <grpc/support/port_platform.h>
 
 #include "src/core/lib/security/credentials/credentials.h"
-
 #include "src/core/lib/security/security_connector/ssl/ssl_security_connector.h"
 
 class grpc_ssl_credentials : public grpc_channel_credentials {

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.cc

@@ -18,11 +18,12 @@
 
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
 
+#include <stdlib.h>
+#include <string.h>
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
-#include <stdlib.h>
-#include <string.h>
 
 void grpc_tls_certificate_distributor::SetKeyMaterials(
     const std::string& cert_name, absl::optional<std::string> pem_root_certs,

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h

@@ -19,12 +19,13 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/grpc_security.h>
-
 #include <utility>
 
 #include "absl/container/inlined_vector.h"
 #include "absl/types/optional.h"
+
+#include <grpc/grpc_security.h>
+
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 
@@ -125,7 +126,7 @@ struct grpc_tls_certificate_distributor
   // are being watched.
   void SetWatchStatusCallback(
       std::function<void(std::string, bool, bool)> callback) {
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(&callback_mu_);
     watch_status_callback_ = std::move(callback);
   };
 
@@ -201,13 +202,16 @@ struct grpc_tls_certificate_distributor
   // functions.
   grpc_core::Mutex callback_mu_;
   // Stores information about each watcher.
-  std::map<TlsCertificatesWatcherInterface*, WatcherInfo> watchers_;
+  std::map<TlsCertificatesWatcherInterface*, WatcherInfo> watchers_
+      ABSL_GUARDED_BY(mu_);
   // The callback to notify the caller, e.g. the Producer, that the watch status
   // is changed.
-  std::function<void(std::string, bool, bool)> watch_status_callback_;
+  std::function<void(std::string, bool, bool)> watch_status_callback_
+      ABSL_GUARDED_BY(callback_mu_);
   // Stores the names of each certificate, and their corresponding credential
   // contents as well as some additional watcher information.
-  std::map<std::string, CertificateInfo> certificate_info_map_;
+  std::map<std::string, CertificateInfo> certificate_info_map_
+      ABSL_GUARDED_BY(mu_);
 };
 
 #endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CERTIFICATE_DISTRIBUTOR_H

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc

@@ -18,10 +18,11 @@
 
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 
+#include <openssl/ssl.h>
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
-#include <openssl/ssl.h>
 
 #include "src/core/lib/gprpp/stat.h"
 #include "src/core/lib/slice/slice_internal.h"

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h

@@ -19,12 +19,13 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/grpc_security.h>
 #include <string.h>
 
 #include "absl/container/inlined_vector.h"
 #include "absl/status/statusor.h"
 
+#include <grpc/grpc_security.h>
+
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/thd.h"
@@ -108,7 +109,8 @@ class FileWatcherCertificateProvider final
   // Read the root certificates from files and update the distributor.
   absl::optional<std::string> ReadRootCertificatesFromFile(
       const std::string& root_cert_full_path);
-  // Read the root certificates from files and update the distributor.
+  // Read the private key and the certificate chain from files and update the
+  // distributor.
   absl::optional<PemKeyCertPairList> ReadIdentityKeyCertPairFromFiles(
       const std::string& private_key_path,
       const std::string& identity_certificate_path);
@@ -127,11 +129,11 @@ class FileWatcherCertificateProvider final
   grpc_core::Mutex mu_;
   // The most-recent credential data. It will be empty if the most recent read
   // attempt failed.
-  std::string root_certificate_;
-  grpc_core::PemKeyCertPairList pem_key_cert_pairs_;
+  std::string root_certificate_ ABSL_GUARDED_BY(mu_);
+  grpc_core::PemKeyCertPairList pem_key_cert_pairs_ ABSL_GUARDED_BY(mu_);
   // Stores each cert_name we get from the distributor callback and its watcher
   // information.
-  std::map<std::string, WatcherInfo> watcher_info_;
+  std::map<std::string, WatcherInfo> watcher_info_ ABSL_GUARDED_BY(mu_);
 };
 
 //  Checks if the private key matches the certificate's public key.

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -21,10 +21,10 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/grpc_security.h>
-
 #include "absl/container/inlined_vector.h"
 
+#include <grpc/grpc_security.h>
+
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"

data/src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -229,10 +229,9 @@ static void fake_check_peer(
   prop_name = peer.properties[0].name;
   if (prop_name == nullptr ||
       strcmp(prop_name, TSI_CERTIFICATE_TYPE_PEER_PROPERTY) != 0) {
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
         absl::StrCat("Unexpected property in fake peer: ",
-                     prop_name == nullptr ? "<EMPTY>" : prop_name)
-            .c_str());
+                     prop_name == nullptr ? "<EMPTY>" : prop_name));
     goto end;
   }
   if (strncmp(peer.properties[0].value.data, TSI_FAKE_CERTIFICATE_TYPE,
@@ -244,10 +243,9 @@ static void fake_check_peer(
   prop_name = peer.properties[1].name;
   if (prop_name == nullptr ||
       strcmp(prop_name, TSI_SECURITY_LEVEL_PEER_PROPERTY) != 0) {
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
         absl::StrCat("Unexpected property in fake peer: ",
-                     prop_name == nullptr ? "<EMPTY>" : prop_name)
-            .c_str());
+                     prop_name == nullptr ? "<EMPTY>" : prop_name));
     goto end;
   }
   if (strncmp(peer.properties[1].value.data, TSI_FAKE_SECURITY_LEVEL,

data/src/core/lib/security/security_connector/load_system_roots_fallback.cc

@@ -19,6 +19,7 @@
 #include <grpc/support/port_platform.h>
 
 #include <grpc/slice_buffer.h>
+
 #include "src/core/lib/security/security_connector/load_system_roots.h"
 
 #if !defined(GPR_LINUX) && !defined(GPR_ANDROID)

data/src/core/lib/security/security_connector/load_system_roots_linux.cc

@@ -18,12 +18,11 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/slice_buffer.h>
 #include "src/core/lib/security/security_connector/load_system_roots_linux.h"
 
-#if defined(GPR_LINUX) || defined(GPR_ANDROID)
+#include <grpc/slice_buffer.h>
 
-#include "src/core/lib/security/security_connector/load_system_roots.h"
+#if defined(GPR_LINUX) || defined(GPR_ANDROID)
 
 #include <dirent.h>
 #include <fcntl.h>
@@ -44,6 +43,7 @@
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/global_config.h"
 #include "src/core/lib/iomgr/load_file.h"
+#include "src/core/lib/security/security_connector/load_system_roots.h"
 
 GPR_GLOBAL_CONFIG_DEFINE_STRING(grpc_system_ssl_roots_dir, "",
                                 "Custom directory to SSL Roots");

data/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc

@@ -54,9 +54,8 @@ grpc_error_handle ssl_check_peer(
   }
   /* Check the peer name if specified. */
   if (peer_name != nullptr && !grpc_ssl_host_matches_name(peer, peer_name)) {
-    return GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("Peer name ", peer_name, " is not in peer certificate")
-            .c_str());
+    return GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("Peer name ", peer_name, " is not in peer certificate"));
   }
   *auth_context =
       grpc_ssl_peer_to_auth_context(peer, GRPC_SSL_TRANSPORT_SECURITY_TYPE);
@@ -162,10 +161,8 @@ class grpc_ssl_channel_security_connector final
             verify_options_->verify_peer_callback_userdata);
         gpr_free(peer_pem);
         if (callback_status) {
-          error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-              absl::StrFormat("Verify peer callback returned a failure (%d)",
-                              callback_status)
-                  .c_str());
+          error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrFormat(
+              "Verify peer callback returned a failure (%d)", callback_status));
         }
       }
     }

data/src/core/lib/security/security_connector/ssl/ssl_security_connector.h

@@ -23,9 +23,8 @@
 
 #include <grpc/grpc_security.h>
 
-#include "src/core/lib/security/security_connector/security_connector.h"
-
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
 

data/src/core/lib/security/security_connector/ssl_utils.cc

@@ -173,9 +173,8 @@ grpc_error_handle grpc_ssl_check_peer_name(absl::string_view peer_name,
                                            const tsi_peer* peer) {
   /* Check the peer name if specified. */
   if (!peer_name.empty() && !grpc_ssl_host_matches_name(peer, peer_name)) {
-    return GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("Peer name ", peer_name, " is not in peer certificate")
-            .c_str());
+    return GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("Peer name ", peer_name, " is not in peer certificate"));
   }
   return GRPC_ERROR_NONE;
 }

data/src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -421,27 +421,23 @@ TlsChannelSecurityConnector::ProcessServerAuthorizationCheckResult(
   grpc_error_handle error = GRPC_ERROR_NONE;
   /* Server authorization check is cancelled by caller. */
   if (arg->status == GRPC_STATUS_CANCELLED) {
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
         absl::StrCat("Server authorization check is cancelled by the caller "
                      "with error: ",
-                     arg->error_details->error_details())
-            .c_str());
+                     arg->error_details->error_details()));
   } else if (arg->status == GRPC_STATUS_OK) {
     /* Server authorization check completed successfully but returned check
      * failure. */
     if (!arg->success) {
-      error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+      error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
           absl::StrCat("Server authorization check failed with error: ",
-                       arg->error_details->error_details())
-              .c_str());
+                       arg->error_details->error_details()));
     }
     /* Server authorization check did not complete correctly. */
   } else {
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat(
-            "Server authorization check did not finish correctly with error: ",
-            arg->error_details->error_details())
-            .c_str());
+    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+        "Server authorization check did not finish correctly with error: ",
+        arg->error_details->error_details()));
   }
   return error;
 }
@@ -659,9 +655,8 @@ grpc_error_handle TlsCheckHostName(const char* peer_name,
                                    const tsi_peer* peer) {
   /* Check the peer name if specified. */
   if (peer_name != nullptr && !grpc_ssl_host_matches_name(peer, peer_name)) {
-    return GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("Peer name ", peer_name, " is not in peer certificate")
-            .c_str());
+    return GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("Peer name ", peer_name, " is not in peer certificate"));
   }
   return GRPC_ERROR_NONE;
 }

data/src/core/lib/security/transport/auth_filters.h

@@ -22,6 +22,7 @@
 #include <grpc/support/port_platform.h>
 
 #include <grpc/grpc_security.h>
+
 #include "src/core/lib/channel/channel_stack.h"
 
 extern const grpc_channel_filter grpc_client_auth_filter;

data/src/core/lib/security/transport/client_auth_filter.cc

@@ -18,8 +18,6 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/security/transport/auth_filters.h"
-
 #include <string.h>
 
 #include <string>
@@ -37,6 +35,7 @@
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
+#include "src/core/lib/security/transport/auth_filters.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
 #include "src/core/lib/surface/call.h"
@@ -339,13 +338,12 @@ static void on_host_checked(void* arg, grpc_error_handle error) {
   if (error == GRPC_ERROR_NONE) {
     send_security_metadata(elem, batch);
   } else {
-    std::string error_msg = absl::StrCat(
-        "Invalid host ", grpc_core::StringViewFromSlice(calld->host),
-        " set in :authority metadata.");
     grpc_transport_stream_op_batch_finish_with_failure(
         batch,
         grpc_error_set_int(
-            GRPC_ERROR_CREATE_FROM_COPIED_STRING(error_msg.c_str()),
+            GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+                "Invalid host ", grpc_core::StringViewFromSlice(calld->host),
+                " set in :authority metadata.")),
             GRPC_ERROR_INT_GRPC_STATUS, GRPC_STATUS_UNAUTHENTICATED),
         calld->call_combiner);
   }

data/src/core/lib/security/transport/secure_endpoint.cc

@@ -16,26 +16,23 @@
  *
  */
 
-/* With the addition of a libuv endpoint, sockaddr.h now includes uv.h when
-   using that endpoint. Because of various transitive includes in uv.h,
-   including windows.h on Windows, uv.h must be included before other system
-   headers. Therefore, sockaddr.h must always be included first */
 #include <grpc/support/port_platform.h>
 
-#include <new>
+#include "src/core/lib/security/transport/secure_endpoint.h"
 
-#include "src/core/lib/iomgr/sockaddr.h"
+#include <new>
 
 #include <grpc/slice.h>
 #include <grpc/slice_buffer.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/sync.h>
+
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/memory.h"
+#include "src/core/lib/iomgr/sockaddr.h"
 #include "src/core/lib/profiling/timers.h"
-#include "src/core/lib/security/transport/secure_endpoint.h"
 #include "src/core/lib/security/transport/tsi_error.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
@@ -416,12 +413,6 @@ static int endpoint_get_fd(grpc_endpoint* secure_ep) {
   return grpc_endpoint_get_fd(ep->wrapped_ep);
 }
 
-static grpc_resource_user* endpoint_get_resource_user(
-    grpc_endpoint* secure_ep) {
-  secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
-  return grpc_endpoint_get_resource_user(ep->wrapped_ep);
-}
-
 static bool endpoint_can_track_err(grpc_endpoint* secure_ep) {
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
   return grpc_endpoint_can_track_err(ep->wrapped_ep);
@@ -434,7 +425,6 @@ static const grpc_endpoint_vtable vtable = {endpoint_read,
                                             endpoint_delete_from_pollset_set,
                                             endpoint_shutdown,
                                             endpoint_destroy,
-                                            endpoint_get_resource_user,
                                             endpoint_get_peer,
                                             endpoint_get_local_address,
                                             endpoint_get_fd,

data/src/core/lib/security/transport/secure_endpoint.h

@@ -22,6 +22,7 @@
 #include <grpc/support/port_platform.h>
 
 #include <grpc/slice.h>
+
 #include "src/core/lib/iomgr/endpoint.h"
 
 struct tsi_frame_protector;

data/src/core/lib/security/transport/security_handshaker.cc

@@ -22,6 +22,7 @@
 
 #include <stdbool.h>
 #include <string.h>
+
 #include <limits>
 
 #include <grpc/slice_buffer.h>
@@ -31,7 +32,7 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channelz.h"
 #include "src/core/lib/channel/handshaker.h"
-#include "src/core/lib/channel/handshaker_registry.h"
+#include "src/core/lib/config/core_configuration.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/transport/secure_endpoint.h"
@@ -593,11 +594,11 @@ RefCountedPtr<Handshaker> SecurityHandshakerCreate(
   }
 }
 
-void SecurityRegisterHandshakerFactories() {
-  HandshakerRegistry::RegisterHandshakerFactory(
+void SecurityRegisterHandshakerFactories(CoreConfiguration::Builder* builder) {
+  builder->handshaker_registry()->RegisterHandshakerFactory(
       false /* at_start */, HANDSHAKER_CLIENT,
       absl::make_unique<ClientSecurityHandshakerFactory>());
-  HandshakerRegistry::RegisterHandshakerFactory(
+  builder->handshaker_registry()->RegisterHandshakerFactory(
       false /* at_start */, HANDSHAKER_SERVER,
       absl::make_unique<ServerSecurityHandshakerFactory>());
 }

data/src/core/lib/security/transport/security_handshaker.h

@@ -22,6 +22,7 @@
 #include <grpc/support/port_platform.h>
 
 #include "src/core/lib/channel/handshaker.h"
+#include "src/core/lib/config/core_configuration.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 
 namespace grpc_core {
@@ -32,7 +33,7 @@ RefCountedPtr<Handshaker> SecurityHandshakerCreate(
     const grpc_channel_args* args);
 
 /// Registers security handshaker factories.
-void SecurityRegisterHandshakerFactories();
+void SecurityRegisterHandshakerFactories(CoreConfiguration::Builder*);
 
 }  // namespace grpc_core
 

data/src/core/lib/security/util/json_util.cc

@@ -18,6 +18,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/lib/security/util/json_util.h"
+
 #include <string.h>
 
 #include "absl/strings/str_cat.h"
@@ -26,7 +28,6 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/iomgr/error.h"
-#include "src/core/lib/security/util/json_util.h"
 
 const char* grpc_json_get_string_property(const grpc_core::Json& json,
                                           const char* prop_name,
@@ -41,18 +42,15 @@ const char* grpc_json_get_string_property(const grpc_core::Json& json,
   auto it = json.object_value().find(prop_name);
   if (it == json.object_value().end()) {
     if (error != nullptr) {
-      *error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("Property ", prop_name, " not found in JSON object.")
-              .c_str());
+      *error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
+          absl::StrCat("Property ", prop_name, " not found in JSON object."));
     }
     return nullptr;
   }
   if (it->second.type() != grpc_core::Json::Type::STRING) {
     if (error != nullptr) {
-      *error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("Property ", prop_name,
-                       " n JSON object is not a string.")
-              .c_str());
+      *error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+          "Property ", prop_name, " n JSON object is not a string."));
     }
     return nullptr;
   }

data/src/core/lib/slice/percent_encoding.cc

@@ -20,28 +20,70 @@
 
 #include "src/core/lib/slice/percent_encoding.h"
 
+#include <cstdint>
+
 #include <grpc/support/log.h>
 
+#include "src/core/lib/gprpp/bitset.h"
 #include "src/core/lib/slice/slice_internal.h"
 
-const uint8_t grpc_url_percent_encoding_unreserved_bytes[256 / 8] = {
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x60, 0xff, 0x03, 0xfe, 0xff, 0xff,
-    0x87, 0xfe, 0xff, 0xff, 0x47, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
-const uint8_t grpc_compatible_percent_encoding_unreserved_bytes[256 / 8] = {
-    0x00, 0x00, 0x00, 0x00, 0xdf, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-    0xff, 0xff, 0xff, 0xff, 0x7f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
-
-static bool is_unreserved_character(uint8_t c,
-                                    const uint8_t* unreserved_bytes) {
-  return ((unreserved_bytes[c / 8] >> (c % 8)) & 1) != 0;
+#if __cplusplus > 201103l
+#define GRPC_PCTENCODE_CONSTEXPR_FN constexpr
+#define GRPC_PCTENCODE_CONSTEXPR_VALUE constexpr
+#else
+#define GRPC_PCTENCODE_CONSTEXPR_FN
+#define GRPC_PCTENCODE_CONSTEXPR_VALUE const
+#endif
+
+namespace grpc_core {
+
+namespace {
+class UrlTable : public BitSet<256> {
+ public:
+  GRPC_PCTENCODE_CONSTEXPR_FN UrlTable() {
+    for (int i = 'a'; i <= 'z'; i++) set(i);
+    for (int i = 'A'; i <= 'Z'; i++) set(i);
+    for (int i = '0'; i <= '9'; i++) set(i);
+    set('-');
+    set('_');
+    set('.');
+    set('~');
+  }
+};
+
+static GRPC_PCTENCODE_CONSTEXPR_VALUE UrlTable g_url_table;
+
+class CompatibleTable : public BitSet<256> {
+ public:
+  GRPC_PCTENCODE_CONSTEXPR_FN CompatibleTable() {
+    for (int i = 32; i <= 126; i++) {
+      if (i == '%') continue;
+      set(i);
+    }
+  }
+};
+
+static GRPC_PCTENCODE_CONSTEXPR_VALUE CompatibleTable g_compatible_table;
+
+// Map PercentEncodingType to a lookup table of legal symbols for that encoding.
+const BitSet<256>& LookupTableForPercentEncodingType(PercentEncodingType type) {
+  switch (type) {
+    case PercentEncodingType::URL:
+      return g_url_table;
+    case PercentEncodingType::Compatible:
+      return g_compatible_table;
+  }
+  // Crash if a bad PercentEncodingType was passed in.
+  GPR_UNREACHABLE_CODE(abort());
 }
+}  // namespace
 
-grpc_slice grpc_percent_encode_slice(const grpc_slice& slice,
-                                     const uint8_t* unreserved_bytes) {
+grpc_slice PercentEncodeSlice(const grpc_slice& slice,
+                              PercentEncodingType type) {
   static const uint8_t hex[] = "0123456789ABCDEF";
 
+  const BitSet<256>& lut = LookupTableForPercentEncodingType(type);
+
   // first pass: count the number of bytes needed to output this string
   size_t output_length = 0;
   const uint8_t* slice_start = GRPC_SLICE_START_PTR(slice);
@@ -49,7 +91,7 @@ grpc_slice grpc_percent_encode_slice(const grpc_slice& slice,
   const uint8_t* p;
   bool any_reserved_bytes = false;
   for (p = slice_start; p < slice_end; p++) {
-    bool unres = is_unreserved_character(*p, unreserved_bytes);
+    bool unres = lut.is_set(*p);
     output_length += unres ? 1 : 3;
     any_reserved_bytes |= !unres;
   }
@@ -61,7 +103,7 @@ grpc_slice grpc_percent_encode_slice(const grpc_slice& slice,
   grpc_slice out = GRPC_SLICE_MALLOC(output_length);
   uint8_t* q = GRPC_SLICE_START_PTR(out);
   for (p = slice_start; p < slice_end; p++) {
-    if (is_unreserved_character(*p, unreserved_bytes)) {
+    if (lut.is_set(*p)) {
       *q++ = *p;
     } else {
       *q++ = '%';
@@ -86,34 +128,33 @@ static uint8_t dehex(uint8_t c) {
   GPR_UNREACHABLE_CODE(return 255);
 }
 
-bool grpc_strict_percent_decode_slice(const grpc_slice& slice_in,
-                                      const uint8_t* unreserved_bytes,
-                                      grpc_slice* slice_out) {
+absl::optional<grpc_slice> PercentDecodeSlice(const grpc_slice& slice_in,
+                                              PercentEncodingType type) {
   const uint8_t* p = GRPC_SLICE_START_PTR(slice_in);
   const uint8_t* in_end = GRPC_SLICE_END_PTR(slice_in);
   size_t out_length = 0;
   bool any_percent_encoded_stuff = false;
+  const BitSet<256>& lut = LookupTableForPercentEncodingType(type);
   while (p != in_end) {
     if (*p == '%') {
-      if (!valid_hex(++p, in_end)) return false;
-      if (!valid_hex(++p, in_end)) return false;
+      if (!valid_hex(++p, in_end)) return {};
+      if (!valid_hex(++p, in_end)) return {};
       p++;
       out_length++;
       any_percent_encoded_stuff = true;
-    } else if (is_unreserved_character(*p, unreserved_bytes)) {
+    } else if (lut.is_set(*p)) {
       p++;
       out_length++;
     } else {
-      return false;
+      return {};
     }
   }
   if (!any_percent_encoded_stuff) {
-    *slice_out = grpc_slice_ref_internal(slice_in);
-    return true;
+    return grpc_slice_ref_internal(slice_in);
   }
   p = GRPC_SLICE_START_PTR(slice_in);
-  *slice_out = GRPC_SLICE_MALLOC(out_length);
-  uint8_t* q = GRPC_SLICE_START_PTR(*slice_out);
+  grpc_slice slice_out = GRPC_SLICE_MALLOC(out_length);
+  uint8_t* q = GRPC_SLICE_START_PTR(slice_out);
   while (p != in_end) {
     if (*p == '%') {
       *q++ = static_cast<uint8_t>(dehex(p[1]) << 4) | (dehex(p[2]));
@@ -122,11 +163,11 @@ bool grpc_strict_percent_decode_slice(const grpc_slice& slice_in,
       *q++ = *p++;
     }
   }
-  GPR_ASSERT(q == GRPC_SLICE_END_PTR(*slice_out));
-  return true;
+  GPR_ASSERT(q == GRPC_SLICE_END_PTR(slice_out));
+  return slice_out;
 }
 
-grpc_slice grpc_permissive_percent_decode_slice(const grpc_slice& slice_in) {
+grpc_slice PermissivePercentDecodeSlice(const grpc_slice& slice_in) {
   const uint8_t* p = GRPC_SLICE_START_PTR(slice_in);
   const uint8_t* in_end = GRPC_SLICE_END_PTR(slice_in);
   size_t out_length = 0;
@@ -167,3 +208,5 @@ grpc_slice grpc_permissive_percent_decode_slice(const grpc_slice& slice_in) {
   GPR_ASSERT(q == GRPC_SLICE_END_PTR(out));
   return out;
 }
+
+}  // namespace grpc_core