grpc 1.41.0 → 1.43.1

data/src/core/lib/security/authorization/authorization_policy_provider_vtable.cc

@@ -33,7 +33,7 @@ void ProviderArgDestroy(void* p) {
   provider->Unref();
 }
 
-int ProviderArgCmp(void* p, void* q) { return GPR_ICMP(p, q); }
+int ProviderArgCmp(void* p, void* q) { return grpc_core::QsortCompare(p, q); }
 
 }  // namespace
 

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -71,6 +71,8 @@ EvaluateArgs::PerChannelArgs::PerChannelArgs(grpc_auth_context* auth_context,
     dns_sans = GetAuthPropertyArray(auth_context, GRPC_PEER_DNS_PROPERTY_NAME);
     common_name =
         GetAuthPropertyValue(auth_context, GRPC_X509_CN_PROPERTY_NAME);
+    subject =
+        GetAuthPropertyValue(auth_context, GRPC_X509_SUBJECT_PROPERTY_NAME);
   }
   if (endpoint != nullptr) {
     local_address = ParseEndpointUri(grpc_endpoint_get_local_address(endpoint));
@@ -80,8 +82,9 @@ EvaluateArgs::PerChannelArgs::PerChannelArgs(grpc_auth_context* auth_context,
 
 absl::string_view EvaluateArgs::GetPath() const {
   absl::string_view path;
-  if (metadata_ != nullptr && metadata_->idx.named.path != nullptr) {
-    grpc_linked_mdelem* elem = metadata_->idx.named.path;
+  if (metadata_ != nullptr &&
+      metadata_->legacy_index()->named.path != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->legacy_index()->named.path;
     const grpc_slice& val = GRPC_MDVALUE(elem->md);
     path = StringViewFromSlice(val);
   }
@@ -90,45 +93,31 @@ absl::string_view EvaluateArgs::GetPath() const {
 
 absl::string_view EvaluateArgs::GetHost() const {
   absl::string_view host;
-  if (metadata_ != nullptr && metadata_->idx.named.host != nullptr) {
-    grpc_linked_mdelem* elem = metadata_->idx.named.host;
-    const grpc_slice& val = GRPC_MDVALUE(elem->md);
-    host = StringViewFromSlice(val);
+  if (metadata_ != nullptr) {
+    if (auto* host_md = metadata_->get_pointer(HostMetadata())) {
+      host = host_md->as_string_view();
+    }
   }
   return host;
 }
 
 absl::string_view EvaluateArgs::GetMethod() const {
   absl::string_view method;
-  if (metadata_ != nullptr && metadata_->idx.named.method != nullptr) {
-    grpc_linked_mdelem* elem = metadata_->idx.named.method;
+  if (metadata_ != nullptr &&
+      metadata_->legacy_index()->named.method != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->legacy_index()->named.method;
     const grpc_slice& val = GRPC_MDVALUE(elem->md);
     method = StringViewFromSlice(val);
   }
   return method;
 }
 
-std::multimap<absl::string_view, absl::string_view> EvaluateArgs::GetHeaders()
-    const {
-  std::multimap<absl::string_view, absl::string_view> headers;
-  if (metadata_ == nullptr) {
-    return headers;
-  }
-  for (grpc_linked_mdelem* elem = metadata_->list.head; elem != nullptr;
-       elem = elem->next) {
-    const grpc_slice& key = GRPC_MDKEY(elem->md);
-    const grpc_slice& val = GRPC_MDVALUE(elem->md);
-    headers.emplace(StringViewFromSlice(key), StringViewFromSlice(val));
-  }
-  return headers;
-}
-
 absl::optional<absl::string_view> EvaluateArgs::GetHeaderValue(
     absl::string_view key, std::string* concatenated_value) const {
   if (metadata_ == nullptr) {
     return absl::nullopt;
   }
-  return grpc_metadata_batch_get_value(metadata_, key, concatenated_value);
+  return metadata_->GetValue(key, concatenated_value);
 }
 
 grpc_resolved_address EvaluateArgs::GetLocalAddress() const {
@@ -208,4 +197,11 @@ absl::string_view EvaluateArgs::GetCommonName() const {
   return channel_args_->common_name;
 }
 
+absl::string_view EvaluateArgs::GetSubject() const {
+  if (channel_args_ == nullptr) {
+    return "";
+  }
+  return channel_args_->subject;
+}
+
 }  // namespace grpc_core

data/src/core/lib/security/authorization/evaluate_args.h

@@ -48,6 +48,7 @@ class EvaluateArgs {
     std::vector<absl::string_view> uri_sans;
     std::vector<absl::string_view> dns_sans;
     absl::string_view common_name;
+    absl::string_view subject;
     Address local_address;
     Address peer_address;
   };
@@ -58,7 +59,6 @@ class EvaluateArgs {
   absl::string_view GetPath() const;
   absl::string_view GetHost() const;
   absl::string_view GetMethod() const;
-  std::multimap<absl::string_view, absl::string_view> GetHeaders() const;
   // Returns metadata value(s) for the specified key.
   // If the key is not present in the batch, returns absl::nullopt.
   // If the key is present exactly once in the batch, returns a string_view of
@@ -80,6 +80,7 @@ class EvaluateArgs {
   std::vector<absl::string_view> GetUriSans() const;
   std::vector<absl::string_view> GetDnsSans() const;
   absl::string_view GetCommonName() const;
+  absl::string_view GetSubject() const;
 
  private:
   grpc_metadata_batch* metadata_;

data/src/core/lib/security/authorization/sdk_server_authz_filter.cc

@@ -92,6 +92,20 @@ void SdkServerAuthzFilter::CallData::Destroy(
 bool SdkServerAuthzFilter::CallData::IsAuthorized(SdkServerAuthzFilter* chand) {
   EvaluateArgs args(recv_initial_metadata_batch_,
                     &chand->per_channel_evaluate_args_);
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_sdk_authz_trace)) {
+    gpr_log(
+        GPR_DEBUG,
+        "checking request: url_path=%s, transport_security_type=%s, "
+        "uri_sans=[%s], dns_sans=[%s], subject=%s, local_address=%s:%d, "
+        "peer_address=%s:%d",
+        std::string(args.GetPath()).c_str(),
+        std::string(args.GetTransportSecurityType()).c_str(),
+        absl::StrJoin(args.GetUriSans(), ",").c_str(),
+        absl::StrJoin(args.GetDnsSans(), ",").c_str(),
+        std::string(args.GetSubject()).c_str(),
+        std::string(args.GetLocalAddressString()).c_str(), args.GetLocalPort(),
+        std::string(args.GetPeerAddressString()).c_str(), args.GetPeerPort());
+  }
   grpc_authorization_policy_provider::AuthorizationEngines engines =
       chand->provider_->engines();
   if (engines.deny_engine != nullptr) {
@@ -137,7 +151,7 @@ void SdkServerAuthzFilter::CallData::RecvInitialMetadataReady(
                                  GRPC_STATUS_PERMISSION_DENIED);
     }
   } else {
-    GRPC_ERROR_REF(error);
+    (void)GRPC_ERROR_REF(error);
   }
   Closure::Run(DEBUG_LOCATION, calld->original_recv_initial_metadata_ready_,
                error);

data/src/core/lib/security/context/security_context.cc

@@ -223,7 +223,7 @@ grpc_auth_property_iterator grpc_auth_context_peer_identity(
 void grpc_auth_context::ensure_capacity() {
   if (properties_.count == properties_.capacity) {
     properties_.capacity =
-        GPR_MAX(properties_.capacity + 8, properties_.capacity * 2);
+        std::max(properties_.capacity + 8, properties_.capacity * 2);
     properties_.array = static_cast<grpc_auth_property*>(gpr_realloc(
         properties_.array, properties_.capacity * sizeof(grpc_auth_property)));
   }
@@ -289,7 +289,9 @@ static void* auth_context_pointer_arg_copy(void* p) {
              : ctx->Ref(DEBUG_LOCATION, "auth_context_pointer_arg").release();
 }
 
-static int auth_context_pointer_cmp(void* a, void* b) { return GPR_ICMP(a, b); }
+static int auth_context_pointer_cmp(void* a, void* b) {
+  return grpc_core::QsortCompare(a, b);
+}
 
 static const grpc_arg_pointer_vtable auth_context_pointer_vtable = {
     auth_context_pointer_arg_copy, auth_context_pointer_arg_destroy,

data/src/core/lib/security/credentials/composite/composite_credentials.cc

@@ -147,7 +147,7 @@ void grpc_composite_call_credentials::push_to_inner(
   auto composite_creds =
       static_cast<grpc_composite_call_credentials*>(creds.get());
   for (size_t i = 0; i < composite_creds->inner().size(); ++i) {
-    inner_.push_back(std::move(composite_creds->inner_[i]));
+    inner_.push_back(composite_creds->inner_[i]);
   }
 }
 

data/src/core/lib/security/credentials/credentials.cc

@@ -59,7 +59,9 @@ static void* credentials_pointer_arg_copy(void* p) {
   return static_cast<grpc_channel_credentials*>(p)->Ref().release();
 }
 
-static int credentials_pointer_cmp(void* a, void* b) { return GPR_ICMP(a, b); }
+static int credentials_pointer_cmp(void* a, void* b) {
+  return grpc_core::QsortCompare(a, b);
+}
 
 static const grpc_arg_pointer_vtable credentials_pointer_vtable = {
     credentials_pointer_arg_copy, credentials_pointer_arg_destroy,
@@ -127,7 +129,7 @@ static void* server_credentials_pointer_arg_copy(void* p) {
 }
 
 static int server_credentials_pointer_cmp(void* a, void* b) {
-  return GPR_ICMP(a, b);
+  return grpc_core::QsortCompare(a, b);
 }
 
 static const grpc_arg_pointer_vtable cred_ptr_vtable = {

data/src/core/lib/security/credentials/credentials.h

@@ -93,7 +93,7 @@ void grpc_override_well_known_credentials_path_getter(
 
 /* --- grpc_channel_credentials. --- */
 
-#define GRPC_ARG_CHANNEL_CREDENTIALS "grpc.channel_credentials"
+#define GRPC_ARG_CHANNEL_CREDENTIALS "grpc.internal.channel_credentials"
 
 // This type is forward declared as a C struct and we cannot define it as a
 // class. Otherwise, compiler will complain about type mismatch due to
@@ -137,6 +137,11 @@ struct grpc_channel_credentials
   const char* type_;
 };
 
+// TODO(roth): Once we eliminate insecure builds, find a better way to
+// plumb credentials so that it doesn't need to flow through channel
+// args.  For example, we'll want to expose it to LB policies by adding
+// methods on the helper API.
+
 /* Util to encapsulate the channel credentials in a channel arg. */
 grpc_arg grpc_channel_credentials_to_arg(grpc_channel_credentials* credentials);
 

data/src/core/lib/security/credentials/external/aws_external_account_credentials.cc

@@ -166,13 +166,12 @@ void AwsExternalAccountCredentials::RetrieveRegion() {
   request.http.path = gpr_strdup(uri->path().c_str());
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRegion, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent,
+                   ResourceQuota::Default(), &request, ctx_->deadline,
+                   &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 
@@ -214,13 +213,13 @@ void AwsExternalAccountCredentials::RetrieveRoleName() {
   request.http.path = gpr_strdup(uri->path().c_str());
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRoleName, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  // TODO(ctiller): use the caller's resource quota.
+  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent,
+                   ResourceQuota::Default(), &request, ctx_->deadline,
+                   &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 
@@ -274,13 +273,13 @@ void AwsExternalAccountCredentials::RetrieveSigningKeys() {
   request.http.path = gpr_strdup(uri->path().c_str());
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveSigningKeys, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  // TODO(ctiller): use the caller's resource quota.
+  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent,
+                   ResourceQuota::Default(), &request, ctx_->deadline,
+                   &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 

data/src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -17,9 +17,11 @@
 
 #include "src/core/lib/security/credentials/external/external_account_credentials.h"
 
+#include "absl/strings/match.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/str_split.h"
+#include "absl/strings/strip.h"
 #include "absl/time/clock.h"
 #include "absl/time/time.h"
 
@@ -59,6 +61,23 @@ std::string UrlEncode(const absl::string_view& s) {
   return result;
 }
 
+// Expression to match:
+// //iam.googleapis.com/locations/[^/]+/workforcePools/[^/]+/providers/.+
+bool MatchWorkforcePoolAudience(absl::string_view audience) {
+  // Match "//iam.googleapis.com/locations/"
+  if (!absl::ConsumePrefix(&audience, "//iam.googleapis.com")) return false;
+  if (!absl::ConsumePrefix(&audience, "/locations/")) return false;
+  // Match "[^/]+/workforcePools/"
+  std::pair<absl::string_view, absl::string_view> workforce_pools_split_result =
+      absl::StrSplit(audience, absl::MaxSplits("/workforcePools/", 1));
+  if (absl::StrContains(workforce_pools_split_result.first, '/')) return false;
+  // Match "[^/]+/providers/.+"
+  std::pair<absl::string_view, absl::string_view> providers_split_result =
+      absl::StrSplit(workforce_pools_split_result.second,
+                     absl::MaxSplits("/providers/", 1));
+  return !absl::StrContains(providers_split_result.first, '/');
+}
+
 }  // namespace
 
 RefCountedPtr<ExternalAccountCredentials> ExternalAccountCredentials::Create(
@@ -151,6 +170,17 @@ RefCountedPtr<ExternalAccountCredentials> ExternalAccountCredentials::Create(
   if (it != json.object_value().end()) {
     options.client_secret = it->second.string_value();
   }
+  it = json.object_value().find("workforce_pool_user_project");
+  if (it != json.object_value().end()) {
+    if (MatchWorkforcePoolAudience(options.audience)) {
+      options.workforce_pool_user_project = it->second.string_value();
+    } else {
+      *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "workforce_pool_user_project should not be set for non-workforce "
+          "pool credentials");
+      return nullptr;
+    }
+  }
   RefCountedPtr<ExternalAccountCredentials> creds;
   if (options.credential_source.object_value().find("environment_id") !=
       options.credential_source.object_value().end()) {
@@ -267,34 +297,39 @@ void ExternalAccountCredentials::ExchangeToken(
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
   std::vector<std::string> body_parts;
-  body_parts.push_back(absl::StrFormat("%s=%s", "audience",
-                                       UrlEncode(options_.audience).c_str()));
+  body_parts.push_back(
+      absl::StrFormat("audience=%s", UrlEncode(options_.audience).c_str()));
   body_parts.push_back(absl::StrFormat(
-      "%s=%s", "grant_type",
+      "grant_type=%s",
       UrlEncode(EXTERNAL_ACCOUNT_CREDENTIALS_GRANT_TYPE).c_str()));
   body_parts.push_back(absl::StrFormat(
-      "%s=%s", "requested_token_type",
+      "requested_token_type=%s",
       UrlEncode(EXTERNAL_ACCOUNT_CREDENTIALS_REQUESTED_TOKEN_TYPE).c_str()));
+  body_parts.push_back(absl::StrFormat(
+      "subject_token_type=%s", UrlEncode(options_.subject_token_type).c_str()));
   body_parts.push_back(
-      absl::StrFormat("%s=%s", "subject_token_type",
-                      UrlEncode(options_.subject_token_type).c_str()));
-  body_parts.push_back(absl::StrFormat("%s=%s", "subject_token",
-                                       UrlEncode(subject_token).c_str()));
+      absl::StrFormat("subject_token=%s", UrlEncode(subject_token).c_str()));
   std::string scope = GOOGLE_CLOUD_PLATFORM_DEFAULT_SCOPE;
   if (options_.service_account_impersonation_url.empty()) {
     scope = absl::StrJoin(scopes_, " ");
   }
-  body_parts.push_back(
-      absl::StrFormat("%s=%s", "scope", UrlEncode(scope).c_str()));
+  body_parts.push_back(absl::StrFormat("scope=%s", UrlEncode(scope).c_str()));
+  Json::Object addtional_options_json_object;
+  if (options_.client_id.empty() && options_.client_secret.empty()) {
+    addtional_options_json_object["userProject"] =
+        options_.workforce_pool_user_project;
+  }
+  Json addtional_options_json(std::move(addtional_options_json_object));
+  body_parts.push_back(absl::StrFormat(
+      "options=%s", UrlEncode(addtional_options_json.Dump()).c_str()));
   std::string body = absl::StrJoin(body_parts, "&");
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnExchangeToken, this, nullptr);
-  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                    &request, body.c_str(), body.size(), ctx_->deadline,
-                    &ctx_->closure, &ctx_->response);
+  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent,
+                    ResourceQuota::Default(), &request, body.c_str(),
+                    body.size(), ctx_->deadline, &ctx_->closure,
+                    &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 
@@ -372,15 +407,15 @@ void ExternalAccountCredentials::ImpersenateServiceAccount() {
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
   std::string scope = absl::StrJoin(scopes_, " ");
-  std::string body = absl::StrFormat("%s=%s", "scope", scope);
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
+  std::string body = absl::StrFormat("scope=%s", scope);
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnImpersenateServiceAccount, this, nullptr);
-  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                    &request, body.c_str(), body.size(), ctx_->deadline,
-                    &ctx_->closure, &ctx_->response);
+  // TODO(ctiller): Use the callers resource quota.
+  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent,
+                    ResourceQuota::Default(), &request, body.c_str(),
+                    body.size(), ctx_->deadline, &ctx_->closure,
+                    &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 

data/src/core/lib/security/credentials/external/external_account_credentials.h

@@ -46,6 +46,7 @@ class ExternalAccountCredentials
     std::string quota_project_id;
     std::string client_id;
     std::string client_secret;
+    std::string workforce_pool_user_project;
   };
 
   static RefCountedPtr<ExternalAccountCredentials> Create(

data/src/core/lib/security/credentials/external/url_external_account_credentials.cc

@@ -139,13 +139,12 @@ void UrlExternalAccountCredentials::RetrieveSubjectToken(
   request.http.hdrs = headers;
   request.handshaker =
       url_.scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveSubjectToken, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent,
+                   ResourceQuota::Default(), &request, ctx_->deadline,
+                   &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -187,11 +187,9 @@ static int is_metadata_server_reachable() {
   request.host = const_cast<char*>(GRPC_COMPUTE_ENGINE_DETECTION_HOST);
   request.http.path = const_cast<char*>("/");
   grpc_httpcli_context_init(&context);
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("google_default_credentials");
   grpc_httpcli_get(
-      &context, &detector.pollent, resource_quota, &request,
-      grpc_core::ExecCtx::Get()->Now() + max_detection_delay,
+      &context, &detector.pollent, grpc_core::ResourceQuota::Default(),
+      &request, grpc_core::ExecCtx::Get()->Now() + max_detection_delay,
       GRPC_CLOSURE_CREATE(on_metadata_server_detection_http_response, &detector,
                           grpc_schedule_on_exec_ctx),
       &detector.response);
@@ -290,7 +288,7 @@ static grpc_error_handle create_default_creds_from_path(
   if (json.type() != Json::Type::OBJECT) {
     error = grpc_error_set_str(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING("Failed to parse JSON"),
-        GRPC_ERROR_STR_RAW_BYTES, grpc_slice_ref_internal(creds_data));
+        GRPC_ERROR_STR_RAW_BYTES, grpc_core::StringViewFromSlice(creds_data));
     goto end;
   }
 
@@ -441,9 +439,9 @@ void set_gce_tenancy_checker_for_testing(grpc_gce_tenancy_checker checker) {
 }
 
 void grpc_flush_cached_google_default_credentials(void) {
-  grpc_core::ExecCtx exec_ctx;
+  ExecCtx exec_ctx;
   gpr_once_init(&g_once, init_default_credentials);
-  grpc_core::MutexLock lock(g_state_mu);
+  MutexLock lock(g_state_mu);
   g_metadata_server_available = 0;
 }
 

data/src/core/lib/security/credentials/jwt/jwt_credentials.cc

@@ -182,7 +182,7 @@ grpc_call_credentials* grpc_service_account_jwt_access_credentials_create(
 namespace grpc_core {
 
 absl::StatusOr<std::string> RemoveServiceNameFromJwtUri(absl::string_view uri) {
-  auto parsed = grpc_core::URI::Parse(uri);
+  auto parsed = URI::Parse(uri);
   if (!parsed.ok()) {
     return parsed.status();
   }

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -134,7 +134,7 @@ static void jose_header_destroy(jose_header* h) {
 static jose_header* jose_header_from_json(Json json) {
   const char* alg_value;
   Json::Object::const_iterator it;
-  jose_header* h = static_cast<jose_header*>(gpr_zalloc(sizeof(jose_header)));
+  jose_header* h = grpc_core::Zalloc<jose_header>();
   if (json.type() != Json::Type::OBJECT) {
     gpr_log(GPR_ERROR, "JSON value is not an object");
     goto error;
@@ -238,8 +238,7 @@ gpr_timespec grpc_jwt_claims_not_before(const grpc_jwt_claims* claims) {
 }
 
 grpc_jwt_claims* grpc_jwt_claims_from_json(Json json) {
-  grpc_jwt_claims* claims =
-      static_cast<grpc_jwt_claims*>(gpr_zalloc(sizeof(grpc_jwt_claims)));
+  grpc_jwt_claims* claims = grpc_core::Zalloc<grpc_jwt_claims>();
   claims->json.Init(std::move(json));
   claims->iat = gpr_inf_past(GPR_CLOCK_REALTIME);
   claims->nbf = gpr_inf_past(GPR_CLOCK_REALTIME);
@@ -356,8 +355,7 @@ static verifier_cb_ctx* verifier_cb_ctx_create(
     grpc_jwt_verification_done_cb cb) {
   grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
   grpc_core::ExecCtx exec_ctx;
-  verifier_cb_ctx* ctx =
-      static_cast<verifier_cb_ctx*>(gpr_zalloc(sizeof(verifier_cb_ctx)));
+  verifier_cb_ctx* ctx = new verifier_cb_ctx();
   ctx->verifier = verifier;
   ctx->pollent = grpc_polling_entity_create_from_pollset(pollset);
   ctx->header = header;
@@ -367,7 +365,6 @@ static verifier_cb_ctx* verifier_cb_ctx_create(
   ctx->signed_data = grpc_slice_from_copied_buffer(signed_jwt, signed_jwt_len);
   ctx->user_data = user_data;
   ctx->user_cb = cb;
-
   return ctx;
 }
 
@@ -381,7 +378,7 @@ void verifier_cb_ctx_destroy(verifier_cb_ctx* ctx) {
     grpc_http_response_destroy(&ctx->responses[i]);
   }
   /* TODO: see what to do with claims... */
-  gpr_free(ctx);
+  delete ctx;
 }
 
 /* --- grpc_jwt_verifier object. --- */
@@ -674,7 +671,6 @@ static void on_openid_config_retrieved(void* user_data,
   Json json = json_from_http(response);
   grpc_httpcli_request req;
   const char* jwks_uri;
-  grpc_resource_quota* resource_quota = nullptr;
   const Json* cur;
 
   /* TODO(jboeuf): Cache the jwks_uri in order to avoid this hop next time. */
@@ -703,9 +699,9 @@ static void on_openid_config_retrieved(void* user_data,
   /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
      channel. This would allow us to cancel an authentication query when under
      extreme memory pressure. */
-  resource_quota = grpc_resource_quota_create("jwt_verifier");
   grpc_httpcli_get(
-      &ctx->verifier->http_ctx, &ctx->pollent, resource_quota, &req,
+      &ctx->verifier->http_ctx, &ctx->pollent,
+      grpc_core::ResourceQuota::Default(), &req,
       grpc_core::ExecCtx::Get()->Now() + grpc_jwt_verifier_max_delay,
       GRPC_CLOSURE_CREATE(on_keys_retrieved, ctx, grpc_schedule_on_exec_ctx),
       &ctx->responses[HTTP_RESPONSE_KEYS]);
@@ -768,7 +764,6 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
   char* path_prefix = nullptr;
   const char* iss;
   grpc_httpcli_request req;
-  grpc_resource_quota* resource_quota = nullptr;
   memset(&req, 0, sizeof(grpc_httpcli_request));
   req.handshaker = &grpc_httpcli_ssl;
   http_response_index rsp_idx;
@@ -828,9 +823,9 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
   /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
      channel. This would allow us to cancel an authentication query when under
      extreme memory pressure. */
-  resource_quota = grpc_resource_quota_create("jwt_verifier");
   grpc_httpcli_get(
-      &ctx->verifier->http_ctx, &ctx->pollent, resource_quota, &req,
+      &ctx->verifier->http_ctx, &ctx->pollent,
+      grpc_core::ResourceQuota::Default(), &req,
       grpc_core::ExecCtx::Get()->Now() + grpc_jwt_verifier_max_delay, http_cb,
       &ctx->responses[rsp_idx]);
   gpr_free(req.host);
@@ -890,8 +885,7 @@ error:
 grpc_jwt_verifier* grpc_jwt_verifier_create(
     const grpc_jwt_verifier_email_domain_key_url_mapping* mappings,
     size_t num_mappings) {
-  grpc_jwt_verifier* v =
-      static_cast<grpc_jwt_verifier*>(gpr_zalloc(sizeof(grpc_jwt_verifier)));
+  grpc_jwt_verifier* v = grpc_core::Zalloc<grpc_jwt_verifier>();
   grpc_httpcli_context_init(&v->http_ctx);
 
   /* We know at least of one mapping. */

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -392,12 +392,11 @@ class grpc_compute_engine_token_fetcher_credentials
         const_cast<char*>(GRPC_COMPUTE_ENGINE_METADATA_TOKEN_PATH);
     request.http.hdr_count = 1;
     request.http.hdrs = &header;
-    /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
+    /* TODO(ctiller): Carry the memory quota in ctx and share it with the host
        channel. This would allow us to cancel an authentication query when under
        extreme memory pressure. */
-    grpc_resource_quota* resource_quota =
-        grpc_resource_quota_create("oauth2_credentials");
-    grpc_httpcli_get(http_context, pollent, resource_quota, &request, deadline,
+    grpc_httpcli_get(http_context, pollent, grpc_core::ResourceQuota::Default(),
+                     &request, deadline,
                      GRPC_CLOSURE_INIT(&http_get_cb_closure_, response_cb,
                                        metadata_req, grpc_schedule_on_exec_ctx),
                      &metadata_req->response);
@@ -451,13 +450,12 @@ void grpc_google_refresh_token_credentials::fetch_oauth2(
   request.http.hdr_count = 1;
   request.http.hdrs = &header;
   request.handshaker = &grpc_httpcli_ssl;
-  /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
+  /* TODO(ctiller): Carry the memory quota in ctx and share it with the host
      channel. This would allow us to cancel an authentication query when under
      extreme memory pressure. */
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("oauth2_credentials_refresh");
-  grpc_httpcli_post(httpcli_context, pollent, resource_quota, &request,
-                    body.c_str(), body.size(), deadline,
+  grpc_httpcli_post(httpcli_context, pollent,
+                    grpc_core::ResourceQuota::Default(), &request, body.c_str(),
+                    body.size(), deadline,
                     GRPC_CLOSURE_INIT(&http_post_cb_closure_, response_cb,
                                       metadata_req, grpc_schedule_on_exec_ctx),
                     &metadata_req->response);
@@ -582,14 +580,12 @@ class StsTokenFetcherCredentials
     request.handshaker = (sts_url_.scheme() == "https")
                              ? &grpc_httpcli_ssl
                              : &grpc_httpcli_plaintext;
-    /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
+    /* TODO(ctiller): Carry the memory quota in ctx and share it with the host
        channel. This would allow us to cancel an authentication query when under
        extreme memory pressure. */
-    grpc_resource_quota* resource_quota =
-        grpc_resource_quota_create("oauth2_credentials_refresh");
     grpc_httpcli_post(
-        http_context, pollent, resource_quota, &request, body, body_length,
-        deadline,
+        http_context, pollent, ResourceQuota::Default(), &request, body,
+        body_length, deadline,
         GRPC_CLOSURE_INIT(&http_post_cb_closure_, response_cb, metadata_req,
                           grpc_schedule_on_exec_ctx),
         &metadata_req->response);
@@ -640,14 +636,14 @@ class StsTokenFetcherCredentials
 
   URI sts_url_;
   grpc_closure http_post_cb_closure_;
-  grpc_core::UniquePtr<char> resource_;
-  grpc_core::UniquePtr<char> audience_;
-  grpc_core::UniquePtr<char> scope_;
-  grpc_core::UniquePtr<char> requested_token_type_;
-  grpc_core::UniquePtr<char> subject_token_path_;
-  grpc_core::UniquePtr<char> subject_token_type_;
-  grpc_core::UniquePtr<char> actor_token_path_;
-  grpc_core::UniquePtr<char> actor_token_type_;
+  UniquePtr<char> resource_;
+  UniquePtr<char> audience_;
+  UniquePtr<char> scope_;
+  UniquePtr<char> requested_token_type_;
+  UniquePtr<char> subject_token_path_;
+  UniquePtr<char> subject_token_type_;
+  UniquePtr<char> actor_token_path_;
+  UniquePtr<char> actor_token_type_;
 };
 
 }  // namespace