grpc 1.40.0 → 1.46.3

data/src/core/lib/security/credentials/tls/tls_credentials.h

@@ -38,9 +38,13 @@ class TlsCredentials final : public grpc_channel_credentials {
       const char* target_name, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
+  const char* type() const override { return "Tls"; }
+
   grpc_tls_credentials_options* options() const { return options_.get(); }
 
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override;
+
   grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
 };
 
@@ -53,6 +57,8 @@ class TlsServerCredentials final : public grpc_server_credentials {
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_channel_args* /* args */) override;
 
+  const char* type() const override { return "Tls"; }
+
   grpc_tls_credentials_options* options() const { return options_.get(); }
 
  private:

data/src/core/lib/security/credentials/xds/xds_credentials.cc

@@ -29,8 +29,6 @@
 
 namespace grpc_core {
 
-const char kCredentialsTypeXds[] = "Xds";
-
 namespace {
 
 bool XdsVerifySubjectAlternativeNames(
@@ -61,46 +59,53 @@ bool XdsVerifySubjectAlternativeNames(
   return false;
 }
 
-class ServerAuthCheck {
- public:
-  ServerAuthCheck(
-      RefCountedPtr<XdsCertificateProvider> xds_certificate_provider,
-      std::string cluster_name)
-      : xds_certificate_provider_(std::move(xds_certificate_provider)),
-        cluster_name_(std::move(cluster_name)) {}
-
-  static int Schedule(void* config_user_data,
-                      grpc_tls_server_authorization_check_arg* arg) {
-    return static_cast<ServerAuthCheck*>(config_user_data)->ScheduleImpl(arg);
-  }
+}  // namespace
 
-  static void Destroy(void* config_user_data) {
-    delete static_cast<ServerAuthCheck*>(config_user_data);
-  }
+//
+// XdsCertificateVerifier
+//
 
- private:
-  int ScheduleImpl(grpc_tls_server_authorization_check_arg* arg) {
-    if (XdsVerifySubjectAlternativeNames(
-            arg->subject_alternative_names, arg->subject_alternative_names_size,
-            xds_certificate_provider_->GetSanMatchers(cluster_name_))) {
-      arg->success = 1;
-      arg->status = GRPC_STATUS_OK;
-    } else {
-      arg->success = 0;
-      arg->status = GRPC_STATUS_UNAUTHENTICATED;
-      if (arg->error_details) {
-        arg->error_details->set_error_details(
-            "SANs from certificate did not match SANs from xDS control plane");
-      }
-    }
-    return 0; /* synchronous check */
+XdsCertificateVerifier::XdsCertificateVerifier(
+    RefCountedPtr<XdsCertificateProvider> xds_certificate_provider,
+    std::string cluster_name)
+    : xds_certificate_provider_(std::move(xds_certificate_provider)),
+      cluster_name_(std::move(cluster_name)) {}
+
+bool XdsCertificateVerifier::Verify(
+    grpc_tls_custom_verification_check_request* request,
+    std::function<void(absl::Status)>, absl::Status* sync_status) {
+  GPR_ASSERT(request != nullptr);
+  if (!XdsVerifySubjectAlternativeNames(
+          request->peer_info.san_names.uri_names,
+          request->peer_info.san_names.uri_names_size,
+          xds_certificate_provider_->GetSanMatchers(cluster_name_)) &&
+      !XdsVerifySubjectAlternativeNames(
+          request->peer_info.san_names.ip_names,
+          request->peer_info.san_names.ip_names_size,
+          xds_certificate_provider_->GetSanMatchers(cluster_name_)) &&
+      !XdsVerifySubjectAlternativeNames(
+          request->peer_info.san_names.dns_names,
+          request->peer_info.san_names.dns_names_size,
+          xds_certificate_provider_->GetSanMatchers(cluster_name_))) {
+    *sync_status = absl::Status(
+        absl::StatusCode::kUnauthenticated,
+        "SANs from certificate did not match SANs from xDS control plane");
   }
+  return true; /* synchronous check */
+}
 
-  RefCountedPtr<XdsCertificateProvider> xds_certificate_provider_;
-  std::string cluster_name_;
-};
+void XdsCertificateVerifier::Cancel(
+    grpc_tls_custom_verification_check_request*) {}
 
-}  // namespace
+int XdsCertificateVerifier::CompareImpl(
+    const grpc_tls_certificate_verifier* other) const {
+  auto* o = static_cast<const XdsCertificateVerifier*>(other);
+  int r = QsortCompare(xds_certificate_provider_, o->xds_certificate_provider_);
+  if (r != 0) return r;
+  return cluster_name_.compare(o->cluster_name_);
+}
+
+const char* XdsCertificateVerifier::type() const { return "Xds"; }
 
 bool TestOnlyXdsVerifySubjectAlternativeNames(
     const char* const* subject_alternative_names,
@@ -161,27 +166,11 @@ XdsCredentials::create_security_connector(
         tls_credentials_options->set_watch_identity_pair(true);
         tls_credentials_options->set_identity_cert_name(cluster_name);
       }
-      tls_credentials_options->set_server_verification_option(
-          GRPC_TLS_SKIP_HOSTNAME_VERIFICATION);
-      auto* server_auth_check = new ServerAuthCheck(xds_certificate_provider,
-                                                    std::move(cluster_name));
-      tls_credentials_options->set_server_authorization_check_config(
-          MakeRefCounted<grpc_tls_server_authorization_check_config>(
-              server_auth_check, ServerAuthCheck::Schedule, nullptr,
-              ServerAuthCheck::Destroy));
-      // TODO(yashkt): Creating a new TlsCreds object each time we create a
-      // security connector means that the security connector's cmp() method
-      // returns unequal for each instance, which means that every time an LB
-      // policy updates, all the subchannels will be recreated.  This is
-      // going to lead to a lot of connection churn.  Instead, we should
-      // either (a) change the TLS security connector's cmp() method to be
-      // smarter somehow, so that it compares unequal only when the
-      // tls_credentials_options have changed, or (b) cache the TlsCreds
-      // objects in the XdsCredentials object so that we can reuse the
-      // same one when creating new security connectors, swapping out the
-      // TlsCreds object only when the tls_credentials_options change.
-      // Option (a) would probably be better, although it may require some
-      // structural changes to the security connector API.
+      tls_credentials_options->set_verify_server_cert(true);
+      tls_credentials_options->set_certificate_verifier(
+          MakeRefCounted<XdsCertificateVerifier>(xds_certificate_provider,
+                                                 std::move(cluster_name)));
+      tls_credentials_options->set_check_call_host(false);
       auto tls_credentials =
           MakeRefCounted<TlsCredentials>(std::move(tls_credentials_options));
       return tls_credentials->create_security_connector(
@@ -193,6 +182,8 @@ XdsCredentials::create_security_connector(
       std::move(call_creds), target_name, temp_args.args, new_args);
 }
 
+const char* XdsCredentials::Type() { return "Xds"; }
+
 //
 // XdsServerCredentials
 //
@@ -229,6 +220,8 @@ XdsServerCredentials::create_security_connector(const grpc_channel_args* args) {
   return fallback_credentials_->create_security_connector(args);
 }
 
+const char* XdsServerCredentials::Type() { return "Xds"; }
+
 }  // namespace grpc_core
 
 grpc_channel_credentials* grpc_xds_credentials_create(

data/src/core/lib/security/credentials/xds/xds_credentials.h

@@ -23,25 +23,53 @@
 
 #include <grpc/grpc_security.h>
 
-#include "src/core/ext/xds/xds_api.h"
+#include "src/core/ext/xds/xds_certificate_provider.h"
+#include "src/core/lib/matchers/matchers.h"
 #include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h"
 
 namespace grpc_core {
 
-extern const char kCredentialsTypeXds[];
+class XdsCertificateVerifier : public grpc_tls_certificate_verifier {
+ public:
+  XdsCertificateVerifier(
+      RefCountedPtr<XdsCertificateProvider> xds_certificate_provider,
+      std::string cluster_name);
+
+  bool Verify(grpc_tls_custom_verification_check_request* request,
+              std::function<void(absl::Status)>,
+              absl::Status* sync_status) override;
+  void Cancel(grpc_tls_custom_verification_check_request*) override;
+
+  const char* type() const override;
+
+ private:
+  int CompareImpl(const grpc_tls_certificate_verifier* other) const override;
+
+  RefCountedPtr<XdsCertificateProvider> xds_certificate_provider_;
+  std::string cluster_name_;
+};
 
 class XdsCredentials final : public grpc_channel_credentials {
  public:
   explicit XdsCredentials(
       RefCountedPtr<grpc_channel_credentials> fallback_credentials)
-      : grpc_channel_credentials(kCredentialsTypeXds),
-        fallback_credentials_(std::move(fallback_credentials)) {}
+      : fallback_credentials_(std::move(fallback_credentials)) {}
 
   RefCountedPtr<grpc_channel_security_connector> create_security_connector(
       RefCountedPtr<grpc_call_credentials> call_creds, const char* target_name,
       const grpc_channel_args* args, grpc_channel_args** new_args) override;
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    auto* o = static_cast<const XdsCredentials*>(other);
+    return fallback_credentials_->cmp(o->fallback_credentials_.get());
+  }
+
   RefCountedPtr<grpc_channel_credentials> fallback_credentials_;
 };
 
@@ -49,12 +77,15 @@ class XdsServerCredentials final : public grpc_server_credentials {
  public:
   explicit XdsServerCredentials(
       RefCountedPtr<grpc_server_credentials> fallback_credentials)
-      : grpc_server_credentials(kCredentialsTypeXds),
-        fallback_credentials_(std::move(fallback_credentials)) {}
+      : fallback_credentials_(std::move(fallback_credentials)) {}
 
   RefCountedPtr<grpc_server_security_connector> create_security_connector(
       const grpc_channel_args* /* args */) override;
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
  private:
   RefCountedPtr<grpc_server_credentials> fallback_credentials_;
 };

data/src/core/lib/security/security_connector/alts/alts_security_connector.cc

@@ -29,6 +29,7 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/credentials/alts/alts_credentials.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
 #include "src/core/lib/slice/slice_internal.h"
@@ -69,7 +70,7 @@ class grpc_alts_channel_security_connector final
       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
       const char* target_name)
-      : grpc_channel_security_connector(GRPC_ALTS_URL_SCHEME,
+      : grpc_channel_security_connector(GRPC_SSL_URL_SCHEME,
                                         std::move(channel_creds),
                                         std::move(request_metadata_creds)),
         target_name_(gpr_strdup(target_name)) {}
@@ -116,20 +117,13 @@ class grpc_alts_channel_security_connector final
     return strcmp(target_name_, other->target_name_);
   }
 
-  bool check_call_host(absl::string_view host,
-                       grpc_auth_context* /*auth_context*/,
-                       grpc_closure* /*on_call_host_checked*/,
-                       grpc_error_handle* error) override {
+  grpc_core::ArenaPromise<absl::Status> CheckCallHost(
+      absl::string_view host, grpc_auth_context*) override {
     if (host.empty() || host != target_name_) {
-      *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-          "ALTS call host does not match target name");
+      return grpc_core::Immediate(absl::UnauthenticatedError(
+          "ALTS call host does not match target name"));
     }
-    return true;
-  }
-
-  void cancel_check_call_host(grpc_closure* /*on_call_host_checked*/,
-                              grpc_error_handle error) override {
-    GRPC_ERROR_UNREF(error);
+    return grpc_core::ImmediateOkStatus();
   }
 
  private:
@@ -141,7 +135,7 @@ class grpc_alts_server_security_connector final
  public:
   explicit grpc_alts_server_security_connector(
       grpc_core::RefCountedPtr<grpc_server_credentials> server_creds)
-      : grpc_server_security_connector(GRPC_ALTS_URL_SCHEME,
+      : grpc_server_security_connector(GRPC_SSL_URL_SCHEME,
                                        std::move(server_creds)) {}
 
   ~grpc_alts_server_security_connector() override = default;
@@ -187,8 +181,8 @@ class grpc_alts_server_security_connector final
 
 namespace grpc_core {
 namespace internal {
-grpc_core::RefCountedPtr<grpc_auth_context>
-grpc_alts_auth_context_from_tsi_peer(const tsi_peer* peer) {
+RefCountedPtr<grpc_auth_context> grpc_alts_auth_context_from_tsi_peer(
+    const tsi_peer* peer) {
   if (peer == nullptr) {
     gpr_log(GPR_ERROR,
             "Invalid arguments to grpc_alts_auth_context_from_tsi_peer()");
@@ -243,7 +237,7 @@ grpc_alts_auth_context_from_tsi_peer(const tsi_peer* peer) {
     return nullptr;
   }
   /* Create auth context. */
-  auto ctx = grpc_core::MakeRefCounted<grpc_auth_context>(nullptr);
+  auto ctx = MakeRefCounted<grpc_auth_context>(nullptr);
   grpc_auth_context_add_cstring_property(
       ctx.get(), GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
       GRPC_ALTS_TRANSPORT_SECURITY_TYPE);

data/src/core/lib/security/security_connector/alts/alts_security_connector.h

@@ -23,9 +23,9 @@
 
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/alts/grpc_alts_credentials_options.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
 
 #define GRPC_ALTS_TRANSPORT_SECURITY_TYPE "alts"
-#define GRPC_ALTS_URL_SCHEME "https"
 
 /**
  * This method creates an ALTS channel security connector.
@@ -66,8 +66,8 @@ namespace grpc_core {
 namespace internal {
 
 /* Exposed only for testing. */
-grpc_core::RefCountedPtr<grpc_auth_context>
-grpc_alts_auth_context_from_tsi_peer(const tsi_peer* peer);
+RefCountedPtr<grpc_auth_context> grpc_alts_auth_context_from_tsi_peer(
+    const tsi_peer* peer);
 
 }  // namespace internal
 }  // namespace grpc_core

data/src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -29,13 +29,12 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.h"
-#include "src/core/ext/transport/chttp2/alpn/alpn.h"
-#include "src/core/ext/xds/xds_channel_args.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/handshaker.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/fake/fake_credentials.h"
@@ -92,12 +91,12 @@ class grpc_fake_channel_security_connector final
     c = strcmp(target_, other->target_);
     if (c != 0) return c;
     if (expected_targets_ == nullptr || other->expected_targets_ == nullptr) {
-      c = GPR_ICMP(expected_targets_, other->expected_targets_);
+      c = grpc_core::QsortCompare(expected_targets_, other->expected_targets_);
     } else {
       c = strcmp(expected_targets_, other->expected_targets_);
     }
     if (c != 0) return c;
-    return GPR_ICMP(is_lb_channel_, other->is_lb_channel_);
+    return grpc_core::QsortCompare(is_lb_channel_, other->is_lb_channel_);
   }
 
   void add_handshakers(const grpc_channel_args* args,
@@ -107,10 +106,8 @@ class grpc_fake_channel_security_connector final
         tsi_create_fake_handshaker(/*is_client=*/true), this, args));
   }
 
-  bool check_call_host(absl::string_view host,
-                       grpc_auth_context* /*auth_context*/,
-                       grpc_closure* /*on_call_host_checked*/,
-                       grpc_error_handle* /*error*/) override {
+  grpc_core::ArenaPromise<absl::Status> CheckCallHost(
+      absl::string_view host, grpc_auth_context*) override {
     absl::string_view authority_hostname;
     absl::string_view authority_ignored_port;
     absl::string_view target_hostname;
@@ -136,12 +133,7 @@ class grpc_fake_channel_security_connector final
               target_);
       abort();
     }
-    return true;
-  }
-
-  void cancel_check_call_host(grpc_closure* /*on_call_host_checked*/,
-                              grpc_error_handle error) override {
-    GRPC_ERROR_UNREF(error);
+    return grpc_core::ImmediateOkStatus();
   }
 
   char* target() const { return target_; }
@@ -214,10 +206,9 @@ class grpc_fake_channel_security_connector final
   char* target_name_override_;
 };
 
-static void fake_check_peer(
-    grpc_security_connector* /*sc*/, tsi_peer peer,
-    grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
-    grpc_closure* on_peer_checked) {
+void fake_check_peer(grpc_security_connector* /*sc*/, tsi_peer peer,
+                     grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
+                     grpc_closure* on_peer_checked) {
   const char* prop_name;
   grpc_error_handle error = GRPC_ERROR_NONE;
   *auth_context = nullptr;
@@ -229,10 +220,9 @@ static void fake_check_peer(
   prop_name = peer.properties[0].name;
   if (prop_name == nullptr ||
       strcmp(prop_name, TSI_CERTIFICATE_TYPE_PEER_PROPERTY) != 0) {
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
         absl::StrCat("Unexpected property in fake peer: ",
-                     prop_name == nullptr ? "<EMPTY>" : prop_name)
-            .c_str());
+                     prop_name == nullptr ? "<EMPTY>" : prop_name));
     goto end;
   }
   if (strncmp(peer.properties[0].value.data, TSI_FAKE_CERTIFICATE_TYPE,
@@ -244,10 +234,9 @@ static void fake_check_peer(
   prop_name = peer.properties[1].name;
   if (prop_name == nullptr ||
       strcmp(prop_name, TSI_SECURITY_LEVEL_PEER_PROPERTY) != 0) {
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
         absl::StrCat("Unexpected property in fake peer: ",
-                     prop_name == nullptr ? "<EMPTY>" : prop_name)
-            .c_str());
+                     prop_name == nullptr ? "<EMPTY>" : prop_name));
     goto end;
   }
   if (strncmp(peer.properties[1].value.data, TSI_FAKE_SECURITY_LEVEL,

data/src/core/lib/security/security_connector/fake/fake_security_connector.h

@@ -27,8 +27,6 @@
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 
-#define GRPC_FAKE_SECURITY_URL_SCHEME "http+fake_security"
-
 /* Creates a fake connector that emulates real channel security.  */
 grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_fake_channel_security_connector_create(

data/src/core/lib/security/security_connector/insecure/insecure_security_connector.cc

@@ -21,6 +21,7 @@
 #include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h"
 
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
 #include "src/core/tsi/local_transport_security.h"
 
@@ -48,18 +49,9 @@ RefCountedPtr<grpc_auth_context> TestOnlyMakeInsecureAuthContext() {
   return MakeAuthContext();
 }
 
-// check_call_host and cancel_check_call_host are no-ops since we want to
-// provide an insecure channel.
-bool InsecureChannelSecurityConnector::check_call_host(
-    absl::string_view /*host*/, grpc_auth_context* /*auth_context*/,
-    grpc_closure* /*on_call_host_checked*/, grpc_error_handle* error) {
-  *error = GRPC_ERROR_NONE;
-  return true;
-}
-
-void InsecureChannelSecurityConnector::cancel_check_call_host(
-    grpc_closure* /*on_call_host_checked*/, grpc_error_handle error) {
-  GRPC_ERROR_UNREF(error);
+ArenaPromise<absl::Status> InsecureChannelSecurityConnector::CheckCallHost(
+    absl::string_view, grpc_auth_context*) {
+  return ImmediateOkStatus();
 }
 
 // add_handshakers should have been a no-op but we need to add a minimalist
@@ -70,8 +62,7 @@ void InsecureChannelSecurityConnector::add_handshakers(
     HandshakeManager* handshake_manager) {
   tsi_handshaker* handshaker = nullptr;
   // Re-use local_tsi_handshaker_create as a minimalist handshaker.
-  GPR_ASSERT(tsi_local_handshaker_create(true /* is_client */, &handshaker) ==
-             TSI_OK);
+  GPR_ASSERT(tsi_local_handshaker_create(&handshaker) == TSI_OK);
   handshake_manager->Add(SecurityHandshakerCreate(handshaker, this, args));
 }
 
@@ -95,17 +86,16 @@ int InsecureChannelSecurityConnector::cmp(
 // created with the security level of TSI_SECURITY_NONE.
 void InsecureServerSecurityConnector::add_handshakers(
     const grpc_channel_args* args, grpc_pollset_set* /* interested_parties */,
-    grpc_core::HandshakeManager* handshake_manager) {
+    HandshakeManager* handshake_manager) {
   tsi_handshaker* handshaker = nullptr;
   // Re-use local_tsi_handshaker_create as a minimalist handshaker.
-  GPR_ASSERT(tsi_local_handshaker_create(false /* is_client */, &handshaker) ==
-             TSI_OK);
+  GPR_ASSERT(tsi_local_handshaker_create(&handshaker) == TSI_OK);
   handshake_manager->Add(SecurityHandshakerCreate(handshaker, this, args));
 }
 
 void InsecureServerSecurityConnector::check_peer(
     tsi_peer peer, grpc_endpoint* /*ep*/,
-    grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
+    RefCountedPtr<grpc_auth_context>* auth_context,
     grpc_closure* on_peer_checked) {
   *auth_context = MakeAuthContext();
   tsi_peer_destruct(&peer);

data/src/core/lib/security/security_connector/insecure/insecure_security_connector.h

@@ -39,25 +39,20 @@ class InsecureChannelSecurityConnector
     : public grpc_channel_security_connector {
  public:
   InsecureChannelSecurityConnector(
-      grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
-      grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds)
-      : grpc_channel_security_connector(/* url_scheme */ nullptr,
-                                        std::move(channel_creds),
+      RefCountedPtr<grpc_channel_credentials> channel_creds,
+      RefCountedPtr<grpc_call_credentials> request_metadata_creds)
+      : grpc_channel_security_connector("", std::move(channel_creds),
                                         std::move(request_metadata_creds)) {}
 
-  bool check_call_host(absl::string_view host, grpc_auth_context* auth_context,
-                       grpc_closure* on_call_host_checked,
-                       grpc_error_handle* error) override;
-
-  void cancel_check_call_host(grpc_closure* on_call_host_checked,
-                              grpc_error_handle error) override;
+  ArenaPromise<absl::Status> CheckCallHost(
+      absl::string_view host, grpc_auth_context* auth_context) override;
 
   void add_handshakers(const grpc_channel_args* args,
                        grpc_pollset_set* /* interested_parties */,
-                       grpc_core::HandshakeManager* handshake_manager) override;
+                       HandshakeManager* handshake_manager) override;
 
   void check_peer(tsi_peer peer, grpc_endpoint* ep,
-                  grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
+                  RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 
   void cancel_check_peer(grpc_closure* /*on_peer_checked*/,
@@ -71,16 +66,16 @@ class InsecureChannelSecurityConnector
 class InsecureServerSecurityConnector : public grpc_server_security_connector {
  public:
   explicit InsecureServerSecurityConnector(
-      grpc_core::RefCountedPtr<grpc_server_credentials> server_creds)
-      : grpc_server_security_connector(nullptr /* url_scheme */,
+      RefCountedPtr<grpc_server_credentials> server_creds)
+      : grpc_server_security_connector("" /* url_scheme */,
                                        std::move(server_creds)) {}
 
   void add_handshakers(const grpc_channel_args* args,
                        grpc_pollset_set* /* interested_parties */,
-                       grpc_core::HandshakeManager* handshake_manager) override;
+                       HandshakeManager* handshake_manager) override;
 
   void check_peer(tsi_peer peer, grpc_endpoint* ep,
-                  grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
+                  RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 
   void cancel_check_peer(grpc_closure* /*on_peer_checked*/,

data/src/core/lib/security/security_connector/load_system_roots_fallback.cc

@@ -19,6 +19,7 @@
 #include <grpc/support/port_platform.h>
 
 #include <grpc/slice_buffer.h>
+
 #include "src/core/lib/security/security_connector/load_system_roots.h"
 
 #if !defined(GPR_LINUX) && !defined(GPR_ANDROID)

data/src/core/lib/security/security_connector/load_system_roots_linux.cc

@@ -18,12 +18,11 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/slice_buffer.h>
 #include "src/core/lib/security/security_connector/load_system_roots_linux.h"
 
-#if defined(GPR_LINUX) || defined(GPR_ANDROID)
+#include <grpc/slice_buffer.h>
 
-#include "src/core/lib/security/security_connector/load_system_roots.h"
+#if defined(GPR_LINUX) || defined(GPR_ANDROID)
 
 #include <dirent.h>
 #include <fcntl.h>
@@ -44,6 +43,7 @@
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/global_config.h"
 #include "src/core/lib/iomgr/load_file.h"
+#include "src/core/lib/security/security_connector/load_system_roots.h"
 
 GPR_GLOBAL_CONFIG_DEFINE_STRING(grpc_system_ssl_roots_dir, "",
                                 "Custom directory to SSL Roots");
@@ -145,8 +145,7 @@ grpc_slice CreateRootCertsBundle(const char* certs_directory) {
 grpc_slice LoadSystemRootCerts() {
   grpc_slice result = grpc_empty_slice();
   // Prioritize user-specified custom directory if flag is set.
-  grpc_core::UniquePtr<char> custom_dir =
-      GPR_GLOBAL_CONFIG_GET(grpc_system_ssl_roots_dir);
+  UniquePtr<char> custom_dir = GPR_GLOBAL_CONFIG_GET(grpc_system_ssl_roots_dir);
   if (strlen(custom_dir.get()) > 0) {
     result = CreateRootCertsBundle(custom_dir.get());
   }