grpc 1.41.0.pre2 → 1.42.0

data/src/core/lib/json/json_util.h

@@ -40,10 +40,10 @@ bool ParseDurationFromJson(const Json& field, grpc_millis* duration);
 // Return true on success, false otherwise. If an error is encountered during
 // parsing, a descriptive error is appended to \a error_list.
 //
-template <typename NumericType, typename ErrorVectorType>
-inline bool ExtractJsonNumber(const Json& json, const std::string& field_name,
-                              NumericType* output,
-                              ErrorVectorType* error_list) {
+template <typename NumericType>
+bool ExtractJsonNumber(const Json& json, absl::string_view field_name,
+                       NumericType* output,
+                       std::vector<grpc_error_handle>* error_list) {
   static_assert(std::is_integral<NumericType>::value, "Integral required");
   if (json.type() != Json::Type::NUMBER) {
     error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
@@ -58,27 +58,14 @@ inline bool ExtractJsonNumber(const Json& json, const std::string& field_name,
   return true;
 }
 
-template <typename ErrorVectorType>
-inline bool ExtractJsonBool(const Json& json, const std::string& field_name,
-                            bool* output, ErrorVectorType* error_list) {
-  switch (json.type()) {
-    case Json::Type::JSON_TRUE:
-      *output = true;
-      return true;
-    case Json::Type::JSON_FALSE:
-      *output = false;
-      return true;
-    default:
-      error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
-          absl::StrCat("field:", field_name, " error:type should be BOOLEAN")));
-      return false;
-  }
-}
+bool ExtractJsonBool(const Json& json, absl::string_view field_name,
+                     bool* output, std::vector<grpc_error_handle>* error_list);
 
-template <typename ErrorVectorType>
-inline bool ExtractJsonString(const Json& json, const std::string& field_name,
-                              std::string* output,
-                              ErrorVectorType* error_list) {
+// OutputType can be std::string or absl::string_view.
+template <typename OutputType>
+bool ExtractJsonString(const Json& json, absl::string_view field_name,
+                       OutputType* output,
+                       std::vector<grpc_error_handle>* error_list) {
   if (json.type() != Json::Type::STRING) {
     *output = "";
     error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
@@ -89,72 +76,61 @@ inline bool ExtractJsonString(const Json& json, const std::string& field_name,
   return true;
 }
 
-template <typename ErrorVectorType>
-inline bool ExtractJsonArray(const Json& json, const std::string& field_name,
-                             const Json::Array** output,
-                             ErrorVectorType* error_list) {
-  if (json.type() != Json::Type::ARRAY) {
-    *output = nullptr;
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
-        absl::StrCat("field:", field_name, " error:type should be ARRAY")));
-    return false;
-  }
-  *output = &json.array_value();
-  return true;
-}
+bool ExtractJsonArray(const Json& json, absl::string_view field_name,
+                      const Json::Array** output,
+                      std::vector<grpc_error_handle>* error_list);
 
-template <typename ErrorVectorType>
-inline bool ExtractJsonObject(const Json& json, const std::string& field_name,
-                              const Json::Object** output,
-                              ErrorVectorType* error_list) {
-  if (json.type() != Json::Type::OBJECT) {
-    *output = nullptr;
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
-        absl::StrCat("field:", field_name, " error:type should be OBJECT")));
-    return false;
-  }
-  *output = &json.object_value();
-  return true;
-}
+bool ExtractJsonObject(const Json& json, absl::string_view field_name,
+                       const Json::Object** output,
+                       std::vector<grpc_error_handle>* error_list);
 
-template <typename NumericType, typename ErrorVectorType>
-inline bool ExtractJsonType(const Json& json, const std::string& field_name,
-                            NumericType* output, ErrorVectorType* error_list) {
+// Wrappers for automatically choosing one of the above functions based
+// on output parameter type.
+template <typename NumericType>
+inline bool ExtractJsonType(const Json& json, absl::string_view field_name,
+                            NumericType* output,
+                            std::vector<grpc_error_handle>* error_list) {
   return ExtractJsonNumber(json, field_name, output, error_list);
 }
-
-template <typename ErrorVectorType>
-inline bool ExtractJsonType(const Json& json, const std::string& field_name,
-                            bool* output, ErrorVectorType* error_list) {
+inline bool ExtractJsonType(const Json& json, absl::string_view field_name,
+                            bool* output,
+                            std::vector<grpc_error_handle>* error_list) {
   return ExtractJsonBool(json, field_name, output, error_list);
 }
-
-template <typename ErrorVectorType>
-inline bool ExtractJsonType(const Json& json, const std::string& field_name,
-                            std::string* output, ErrorVectorType* error_list) {
+inline bool ExtractJsonType(const Json& json, absl::string_view field_name,
+                            std::string* output,
+                            std::vector<grpc_error_handle>* error_list) {
   return ExtractJsonString(json, field_name, output, error_list);
 }
-
-template <typename ErrorVectorType>
-inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+inline bool ExtractJsonType(const Json& json, absl::string_view field_name,
+                            absl::string_view* output,
+                            std::vector<grpc_error_handle>* error_list) {
+  return ExtractJsonString(json, field_name, output, error_list);
+}
+inline bool ExtractJsonType(const Json& json, absl::string_view field_name,
                             const Json::Array** output,
-                            ErrorVectorType* error_list) {
+                            std::vector<grpc_error_handle>* error_list) {
   return ExtractJsonArray(json, field_name, output, error_list);
 }
-
-template <typename ErrorVectorType>
-inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+inline bool ExtractJsonType(const Json& json, absl::string_view field_name,
                             const Json::Object** output,
-                            ErrorVectorType* error_list) {
+                            std::vector<grpc_error_handle>* error_list) {
   return ExtractJsonObject(json, field_name, output, error_list);
 }
 
-template <typename T, typename ErrorVectorType>
-inline bool ParseJsonObjectField(const Json::Object& object,
-                                 const std::string& field_name, T* output,
-                                 ErrorVectorType* error_list,
-                                 bool required = true) {
-  auto it = object.find(field_name);
+// Extracts a field from a JSON object, automatically selecting the type
+// of parsing based on the output parameter type.
+// If the field is not present, returns false, and if required is true,
+// adds an error to error_list.
+// Upon any other error, adds an error to error_list and returns false.
+template <typename T>
+bool ParseJsonObjectField(const Json::Object& object,
+                          absl::string_view field_name, T* output,
+                          std::vector<grpc_error_handle>* error_list,
+                          bool required = true) {
+  // TODO(roth): Once we can use C++14 heterogenous lookups, stop
+  // creating a std::string here.
+  auto it = object.find(std::string(field_name));
   if (it == object.end()) {
     if (required) {
       error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
@@ -166,30 +142,12 @@ inline bool ParseJsonObjectField(const Json::Object& object,
   return ExtractJsonType(child_object_json, field_name, output, error_list);
 }
 
-template <typename ErrorVectorType>
-inline bool ParseJsonObjectFieldAsDuration(const Json::Object& object,
-                                           const std::string& field_name,
-                                           grpc_millis* output,
-                                           ErrorVectorType* error_list,
-                                           bool required = true) {
-  auto it = object.find(field_name);
-  if (it == object.end()) {
-    if (required) {
-      error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
-          absl::StrCat("field:", field_name, " error:does not exist.")));
-    }
-    return false;
-  }
-  if (!ParseDurationFromJson(it->second, output)) {
-    *output = GRPC_MILLIS_INF_PAST;
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
-        absl::StrCat("field:", field_name,
-                     " error:type should be STRING of the form given by "
-                     "google.proto.Duration.")));
-    return false;
-  }
-  return true;
-}
+// Alternative to ParseJsonObjectField() for duration-value fields.
+bool ParseJsonObjectFieldAsDuration(const Json::Object& object,
+                                    absl::string_view field_name,
+                                    grpc_millis* output,
+                                    std::vector<grpc_error_handle>* error_list,
+                                    bool required = true);
 
 }  // namespace grpc_core
 

data/src/core/lib/json/json_writer.cc

@@ -23,9 +23,6 @@
 
 #include "absl/strings/string_view.h"
 
-#include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
-
 #include "src/core/lib/json/json.h"
 
 namespace grpc_core {

data/src/core/lib/security/authorization/authorization_policy_provider.h

@@ -27,7 +27,7 @@ struct grpc_authorization_policy_provider
     grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine> allow_engine;
     grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine> deny_engine;
   };
-  virtual AuthorizationEngines engines() const = 0;
+  virtual AuthorizationEngines engines() = 0;
 };
 
 #endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_POLICY_PROVIDER_H

data/src/core/lib/security/authorization/authorization_policy_provider_vtable.cc

@@ -33,7 +33,7 @@ void ProviderArgDestroy(void* p) {
   provider->Unref();
 }
 
-int ProviderArgCmp(void* p, void* q) { return GPR_ICMP(p, q); }
+int ProviderArgCmp(void* p, void* q) { return grpc_core::QsortCompare(p, q); }
 
 }  // namespace
 

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -80,8 +80,9 @@ EvaluateArgs::PerChannelArgs::PerChannelArgs(grpc_auth_context* auth_context,
 
 absl::string_view EvaluateArgs::GetPath() const {
   absl::string_view path;
-  if (metadata_ != nullptr && metadata_->idx.named.path != nullptr) {
-    grpc_linked_mdelem* elem = metadata_->idx.named.path;
+  if (metadata_ != nullptr &&
+      metadata_->legacy_index()->named.path != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->legacy_index()->named.path;
     const grpc_slice& val = GRPC_MDVALUE(elem->md);
     path = StringViewFromSlice(val);
   }
@@ -90,8 +91,9 @@ absl::string_view EvaluateArgs::GetPath() const {
 
 absl::string_view EvaluateArgs::GetHost() const {
   absl::string_view host;
-  if (metadata_ != nullptr && metadata_->idx.named.host != nullptr) {
-    grpc_linked_mdelem* elem = metadata_->idx.named.host;
+  if (metadata_ != nullptr &&
+      metadata_->legacy_index()->named.host != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->legacy_index()->named.host;
     const grpc_slice& val = GRPC_MDVALUE(elem->md);
     host = StringViewFromSlice(val);
   }
@@ -100,8 +102,9 @@ absl::string_view EvaluateArgs::GetHost() const {
 
 absl::string_view EvaluateArgs::GetMethod() const {
   absl::string_view method;
-  if (metadata_ != nullptr && metadata_->idx.named.method != nullptr) {
-    grpc_linked_mdelem* elem = metadata_->idx.named.method;
+  if (metadata_ != nullptr &&
+      metadata_->legacy_index()->named.method != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->legacy_index()->named.method;
     const grpc_slice& val = GRPC_MDVALUE(elem->md);
     method = StringViewFromSlice(val);
   }
@@ -114,12 +117,11 @@ std::multimap<absl::string_view, absl::string_view> EvaluateArgs::GetHeaders()
   if (metadata_ == nullptr) {
     return headers;
   }
-  for (grpc_linked_mdelem* elem = metadata_->list.head; elem != nullptr;
-       elem = elem->next) {
-    const grpc_slice& key = GRPC_MDKEY(elem->md);
-    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+  metadata_->ForEach([&](grpc_mdelem md) {
+    const grpc_slice& key = GRPC_MDKEY(md);
+    const grpc_slice& val = GRPC_MDVALUE(md);
     headers.emplace(StringViewFromSlice(key), StringViewFromSlice(val));
-  }
+  });
   return headers;
 }
 
@@ -128,7 +130,7 @@ absl::optional<absl::string_view> EvaluateArgs::GetHeaderValue(
   if (metadata_ == nullptr) {
     return absl::nullopt;
   }
-  return grpc_metadata_batch_get_value(metadata_, key, concatenated_value);
+  return metadata_->GetValue(key, concatenated_value);
 }
 
 grpc_resolved_address EvaluateArgs::GetLocalAddress() const {

data/src/core/lib/security/authorization/sdk_server_authz_filter.cc

@@ -92,6 +92,18 @@ void SdkServerAuthzFilter::CallData::Destroy(
 bool SdkServerAuthzFilter::CallData::IsAuthorized(SdkServerAuthzFilter* chand) {
   EvaluateArgs args(recv_initial_metadata_batch_,
                     &chand->per_channel_evaluate_args_);
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_sdk_authz_trace)) {
+    gpr_log(
+        GPR_DEBUG,
+        "checking request: url_path=%s, transport_security_type=%s, "
+        "uri_sans=[%s], dns_sans=[%s], local_address=%s:%d, peer_address=%s:%d",
+        std::string(args.GetPath()).c_str(),
+        std::string(args.GetTransportSecurityType()).c_str(),
+        absl::StrJoin(args.GetUriSans(), ",").c_str(),
+        absl::StrJoin(args.GetDnsSans(), ",").c_str(),
+        std::string(args.GetLocalAddressString()).c_str(), args.GetLocalPort(),
+        std::string(args.GetPeerAddressString()).c_str(), args.GetPeerPort());
+  }
   grpc_authorization_policy_provider::AuthorizationEngines engines =
       chand->provider_->engines();
   if (engines.deny_engine != nullptr) {
@@ -137,7 +149,7 @@ void SdkServerAuthzFilter::CallData::RecvInitialMetadataReady(
                                  GRPC_STATUS_PERMISSION_DENIED);
     }
   } else {
-    GRPC_ERROR_REF(error);
+    (void)GRPC_ERROR_REF(error);
   }
   Closure::Run(DEBUG_LOCATION, calld->original_recv_initial_metadata_ready_,
                error);

data/src/core/lib/security/context/security_context.cc

@@ -223,7 +223,7 @@ grpc_auth_property_iterator grpc_auth_context_peer_identity(
 void grpc_auth_context::ensure_capacity() {
   if (properties_.count == properties_.capacity) {
     properties_.capacity =
-        GPR_MAX(properties_.capacity + 8, properties_.capacity * 2);
+        std::max(properties_.capacity + 8, properties_.capacity * 2);
     properties_.array = static_cast<grpc_auth_property*>(gpr_realloc(
         properties_.array, properties_.capacity * sizeof(grpc_auth_property)));
   }
@@ -289,7 +289,9 @@ static void* auth_context_pointer_arg_copy(void* p) {
              : ctx->Ref(DEBUG_LOCATION, "auth_context_pointer_arg").release();
 }
 
-static int auth_context_pointer_cmp(void* a, void* b) { return GPR_ICMP(a, b); }
+static int auth_context_pointer_cmp(void* a, void* b) {
+  return grpc_core::QsortCompare(a, b);
+}
 
 static const grpc_arg_pointer_vtable auth_context_pointer_vtable = {
     auth_context_pointer_arg_copy, auth_context_pointer_arg_destroy,

data/src/core/lib/security/credentials/composite/composite_credentials.cc

@@ -147,7 +147,7 @@ void grpc_composite_call_credentials::push_to_inner(
   auto composite_creds =
       static_cast<grpc_composite_call_credentials*>(creds.get());
   for (size_t i = 0; i < composite_creds->inner().size(); ++i) {
-    inner_.push_back(std::move(composite_creds->inner_[i]));
+    inner_.push_back(composite_creds->inner_[i]);
   }
 }
 

data/src/core/lib/security/credentials/credentials.cc

@@ -59,7 +59,9 @@ static void* credentials_pointer_arg_copy(void* p) {
   return static_cast<grpc_channel_credentials*>(p)->Ref().release();
 }
 
-static int credentials_pointer_cmp(void* a, void* b) { return GPR_ICMP(a, b); }
+static int credentials_pointer_cmp(void* a, void* b) {
+  return grpc_core::QsortCompare(a, b);
+}
 
 static const grpc_arg_pointer_vtable credentials_pointer_vtable = {
     credentials_pointer_arg_copy, credentials_pointer_arg_destroy,
@@ -127,7 +129,7 @@ static void* server_credentials_pointer_arg_copy(void* p) {
 }
 
 static int server_credentials_pointer_cmp(void* a, void* b) {
-  return GPR_ICMP(a, b);
+  return grpc_core::QsortCompare(a, b);
 }
 
 static const grpc_arg_pointer_vtable cred_ptr_vtable = {

data/src/core/lib/security/credentials/credentials.h

@@ -93,7 +93,7 @@ void grpc_override_well_known_credentials_path_getter(
 
 /* --- grpc_channel_credentials. --- */
 
-#define GRPC_ARG_CHANNEL_CREDENTIALS "grpc.channel_credentials"
+#define GRPC_ARG_CHANNEL_CREDENTIALS "grpc.internal.channel_credentials"
 
 // This type is forward declared as a C struct and we cannot define it as a
 // class. Otherwise, compiler will complain about type mismatch due to
@@ -137,6 +137,11 @@ struct grpc_channel_credentials
   const char* type_;
 };
 
+// TODO(roth): Once we eliminate insecure builds, find a better way to
+// plumb credentials so that it doesn't need to flow through channel
+// args.  For example, we'll want to expose it to LB policies by adding
+// methods on the helper API.
+
 /* Util to encapsulate the channel credentials in a channel arg. */
 grpc_arg grpc_channel_credentials_to_arg(grpc_channel_credentials* credentials);
 

data/src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -17,9 +17,11 @@
 
 #include "src/core/lib/security/credentials/external/external_account_credentials.h"
 
+#include "absl/strings/match.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/str_split.h"
+#include "absl/strings/strip.h"
 #include "absl/time/clock.h"
 #include "absl/time/time.h"
 
@@ -59,6 +61,23 @@ std::string UrlEncode(const absl::string_view& s) {
   return result;
 }
 
+// Expression to match:
+// //iam.googleapis.com/locations/[^/]+/workforcePools/[^/]+/providers/.+
+bool MatchWorkforcePoolAudience(absl::string_view audience) {
+  // Match "//iam.googleapis.com/locations/"
+  if (!absl::ConsumePrefix(&audience, "//iam.googleapis.com")) return false;
+  if (!absl::ConsumePrefix(&audience, "/locations/")) return false;
+  // Match "[^/]+/workforcePools/"
+  std::pair<absl::string_view, absl::string_view> workforce_pools_split_result =
+      absl::StrSplit(audience, absl::MaxSplits("/workforcePools/", 1));
+  if (absl::StrContains(workforce_pools_split_result.first, '/')) return false;
+  // Match "[^/]+/providers/.+"
+  std::pair<absl::string_view, absl::string_view> providers_split_result =
+      absl::StrSplit(workforce_pools_split_result.second,
+                     absl::MaxSplits("/providers/", 1));
+  return !absl::StrContains(providers_split_result.first, '/');
+}
+
 }  // namespace
 
 RefCountedPtr<ExternalAccountCredentials> ExternalAccountCredentials::Create(
@@ -151,6 +170,17 @@ RefCountedPtr<ExternalAccountCredentials> ExternalAccountCredentials::Create(
   if (it != json.object_value().end()) {
     options.client_secret = it->second.string_value();
   }
+  it = json.object_value().find("workforce_pool_user_project");
+  if (it != json.object_value().end()) {
+    if (MatchWorkforcePoolAudience(options.audience)) {
+      options.workforce_pool_user_project = it->second.string_value();
+    } else {
+      *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "workforce_pool_user_project should not be set for non-workforce "
+          "pool credentials");
+      return nullptr;
+    }
+  }
   RefCountedPtr<ExternalAccountCredentials> creds;
   if (options.credential_source.object_value().find("environment_id") !=
       options.credential_source.object_value().end()) {
@@ -267,25 +297,31 @@ void ExternalAccountCredentials::ExchangeToken(
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
   std::vector<std::string> body_parts;
-  body_parts.push_back(absl::StrFormat("%s=%s", "audience",
-                                       UrlEncode(options_.audience).c_str()));
+  body_parts.push_back(
+      absl::StrFormat("audience=%s", UrlEncode(options_.audience).c_str()));
   body_parts.push_back(absl::StrFormat(
-      "%s=%s", "grant_type",
+      "grant_type=%s",
       UrlEncode(EXTERNAL_ACCOUNT_CREDENTIALS_GRANT_TYPE).c_str()));
   body_parts.push_back(absl::StrFormat(
-      "%s=%s", "requested_token_type",
+      "requested_token_type=%s",
       UrlEncode(EXTERNAL_ACCOUNT_CREDENTIALS_REQUESTED_TOKEN_TYPE).c_str()));
+  body_parts.push_back(absl::StrFormat(
+      "subject_token_type=%s", UrlEncode(options_.subject_token_type).c_str()));
   body_parts.push_back(
-      absl::StrFormat("%s=%s", "subject_token_type",
-                      UrlEncode(options_.subject_token_type).c_str()));
-  body_parts.push_back(absl::StrFormat("%s=%s", "subject_token",
-                                       UrlEncode(subject_token).c_str()));
+      absl::StrFormat("subject_token=%s", UrlEncode(subject_token).c_str()));
   std::string scope = GOOGLE_CLOUD_PLATFORM_DEFAULT_SCOPE;
   if (options_.service_account_impersonation_url.empty()) {
     scope = absl::StrJoin(scopes_, " ");
   }
-  body_parts.push_back(
-      absl::StrFormat("%s=%s", "scope", UrlEncode(scope).c_str()));
+  body_parts.push_back(absl::StrFormat("scope=%s", UrlEncode(scope).c_str()));
+  Json::Object addtional_options_json_object;
+  if (options_.client_id.empty() && options_.client_secret.empty()) {
+    addtional_options_json_object["userProject"] =
+        options_.workforce_pool_user_project;
+  }
+  Json addtional_options_json(std::move(addtional_options_json_object));
+  body_parts.push_back(absl::StrFormat(
+      "options=%s", UrlEncode(addtional_options_json.Dump()).c_str()));
   std::string body = absl::StrJoin(body_parts, "&");
   grpc_resource_quota* resource_quota =
       grpc_resource_quota_create("external_account_credentials");
@@ -372,7 +408,7 @@ void ExternalAccountCredentials::ImpersenateServiceAccount() {
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
   std::string scope = absl::StrJoin(scopes_, " ");
-  std::string body = absl::StrFormat("%s=%s", "scope", scope);
+  std::string body = absl::StrFormat("scope=%s", scope);
   grpc_resource_quota* resource_quota =
       grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);

data/src/core/lib/security/credentials/external/external_account_credentials.h

@@ -46,6 +46,7 @@ class ExternalAccountCredentials
     std::string quota_project_id;
     std::string client_id;
     std::string client_secret;
+    std::string workforce_pool_user_project;
   };
 
   static RefCountedPtr<ExternalAccountCredentials> Create(

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -290,7 +290,7 @@ static grpc_error_handle create_default_creds_from_path(
   if (json.type() != Json::Type::OBJECT) {
     error = grpc_error_set_str(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING("Failed to parse JSON"),
-        GRPC_ERROR_STR_RAW_BYTES, grpc_slice_ref_internal(creds_data));
+        GRPC_ERROR_STR_RAW_BYTES, grpc_core::StringViewFromSlice(creds_data));
     goto end;
   }
 

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -134,7 +134,7 @@ static void jose_header_destroy(jose_header* h) {
 static jose_header* jose_header_from_json(Json json) {
   const char* alg_value;
   Json::Object::const_iterator it;
-  jose_header* h = static_cast<jose_header*>(gpr_zalloc(sizeof(jose_header)));
+  jose_header* h = grpc_core::Zalloc<jose_header>();
   if (json.type() != Json::Type::OBJECT) {
     gpr_log(GPR_ERROR, "JSON value is not an object");
     goto error;
@@ -238,8 +238,7 @@ gpr_timespec grpc_jwt_claims_not_before(const grpc_jwt_claims* claims) {
 }
 
 grpc_jwt_claims* grpc_jwt_claims_from_json(Json json) {
-  grpc_jwt_claims* claims =
-      static_cast<grpc_jwt_claims*>(gpr_zalloc(sizeof(grpc_jwt_claims)));
+  grpc_jwt_claims* claims = grpc_core::Zalloc<grpc_jwt_claims>();
   claims->json.Init(std::move(json));
   claims->iat = gpr_inf_past(GPR_CLOCK_REALTIME);
   claims->nbf = gpr_inf_past(GPR_CLOCK_REALTIME);
@@ -356,8 +355,7 @@ static verifier_cb_ctx* verifier_cb_ctx_create(
     grpc_jwt_verification_done_cb cb) {
   grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
   grpc_core::ExecCtx exec_ctx;
-  verifier_cb_ctx* ctx =
-      static_cast<verifier_cb_ctx*>(gpr_zalloc(sizeof(verifier_cb_ctx)));
+  verifier_cb_ctx* ctx = new verifier_cb_ctx();
   ctx->verifier = verifier;
   ctx->pollent = grpc_polling_entity_create_from_pollset(pollset);
   ctx->header = header;
@@ -367,7 +365,6 @@ static verifier_cb_ctx* verifier_cb_ctx_create(
   ctx->signed_data = grpc_slice_from_copied_buffer(signed_jwt, signed_jwt_len);
   ctx->user_data = user_data;
   ctx->user_cb = cb;
-
   return ctx;
 }
 
@@ -381,7 +378,7 @@ void verifier_cb_ctx_destroy(verifier_cb_ctx* ctx) {
     grpc_http_response_destroy(&ctx->responses[i]);
   }
   /* TODO: see what to do with claims... */
-  gpr_free(ctx);
+  delete ctx;
 }
 
 /* --- grpc_jwt_verifier object. --- */
@@ -890,8 +887,7 @@ error:
 grpc_jwt_verifier* grpc_jwt_verifier_create(
     const grpc_jwt_verifier_email_domain_key_url_mapping* mappings,
     size_t num_mappings) {
-  grpc_jwt_verifier* v =
-      static_cast<grpc_jwt_verifier*>(gpr_zalloc(sizeof(grpc_jwt_verifier)));
+  grpc_jwt_verifier* v = grpc_core::Zalloc<grpc_jwt_verifier>();
   grpc_httpcli_context_init(&v->http_ctx);
 
   /* We know at least of one mapping. */

data/src/core/lib/security/credentials/plugin/plugin_credentials.cc

@@ -29,6 +29,7 @@
 #include <grpc/support/log.h>
 #include <grpc/support/sync.h>
 
+#include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
 #include "src/core/lib/surface/api_trace.h"
@@ -159,8 +160,7 @@ bool grpc_plugin_credentials::get_request_metadata(
   bool retval = true;  // Synchronous return.
   if (plugin_.get_metadata != nullptr) {
     // Create pending_request object.
-    pending_request* request =
-        static_cast<pending_request*>(gpr_zalloc(sizeof(*request)));
+    pending_request* request = grpc_core::Zalloc<pending_request>();
     request->creds = this;
     request->md_array = md_array;
     request->on_request_metadata = on_request_metadata;

data/src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -92,12 +92,12 @@ class grpc_fake_channel_security_connector final
     c = strcmp(target_, other->target_);
     if (c != 0) return c;
     if (expected_targets_ == nullptr || other->expected_targets_ == nullptr) {
-      c = GPR_ICMP(expected_targets_, other->expected_targets_);
+      c = grpc_core::QsortCompare(expected_targets_, other->expected_targets_);
     } else {
       c = strcmp(expected_targets_, other->expected_targets_);
     }
     if (c != 0) return c;
-    return GPR_ICMP(is_lb_channel_, other->is_lb_channel_);
+    return grpc_core::QsortCompare(is_lb_channel_, other->is_lb_channel_);
   }
 
   void add_handshakers(const grpc_channel_args* args,

data/src/core/lib/security/security_connector/security_connector.cc

@@ -60,7 +60,9 @@ grpc_channel_security_connector::~grpc_channel_security_connector() {}
 
 int grpc_security_connector_cmp(const grpc_security_connector* sc,
                                 const grpc_security_connector* other) {
-  if (sc == nullptr || other == nullptr) return GPR_ICMP(sc, other);
+  if (sc == nullptr || other == nullptr) {
+    return grpc_core::QsortCompare(sc, other);
+  }
   return sc->cmp(other);
 }
 
@@ -70,9 +72,10 @@ int grpc_channel_security_connector::channel_security_connector_cmp(
       static_cast<const grpc_channel_security_connector*>(other);
   GPR_ASSERT(channel_creds() != nullptr);
   GPR_ASSERT(other_sc->channel_creds() != nullptr);
-  int c = GPR_ICMP(channel_creds(), other_sc->channel_creds());
+  int c = grpc_core::QsortCompare(channel_creds(), other_sc->channel_creds());
   if (c != 0) return c;
-  return GPR_ICMP(request_metadata_creds(), other_sc->request_metadata_creds());
+  return grpc_core::QsortCompare(request_metadata_creds(),
+                                 other_sc->request_metadata_creds());
 }
 
 int grpc_server_security_connector::server_security_connector_cmp(
@@ -81,15 +84,17 @@ int grpc_server_security_connector::server_security_connector_cmp(
       static_cast<const grpc_server_security_connector*>(other);
   GPR_ASSERT(server_creds() != nullptr);
   GPR_ASSERT(other_sc->server_creds() != nullptr);
-  return GPR_ICMP(server_creds(), other_sc->server_creds());
+  return grpc_core::QsortCompare(server_creds(), other_sc->server_creds());
 }
 
 static void connector_arg_destroy(void* p) {
+  if (p == nullptr) return;
   static_cast<grpc_security_connector*>(p)->Unref(DEBUG_LOCATION,
                                                   "connector_arg_destroy");
 }
 
 static void* connector_arg_copy(void* p) {
+  if (p == nullptr) return nullptr;
   return static_cast<grpc_security_connector*>(p)
       ->Ref(DEBUG_LOCATION, "connector_arg_copy")
       .release();