grpc 1.41.0 → 1.43.1

data/src/core/lib/security/security_connector/tls/tls_security_connector.h

@@ -21,13 +21,13 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "absl/status/status.h"
+
 #include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 
-#define GRPC_TLS_TRANSPORT_SECURITY_TYPE "tls"
-
 namespace grpc_core {
 
 // Channel security connector using TLS as transport security protocol.
@@ -60,11 +60,8 @@ class TlsChannelSecurityConnector final
                   RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 
-  void cancel_check_peer(grpc_closure* /*on_peer_checked*/,
-                         grpc_error_handle error) override {
-    // TODO(ZhenLian): call verifier->cancel() once the verifier is ready.
-    GRPC_ERROR_UNREF(error);
-  }
+  void cancel_check_peer(grpc_closure* on_peer_checked,
+                         grpc_error_handle error) override;
 
   int cmp(const grpc_security_connector* other_sc) const override;
 
@@ -110,43 +107,51 @@ class TlsChannelSecurityConnector final
     TlsChannelSecurityConnector* security_connector_ = nullptr;
   };
 
-  // Updates |client_handshaker_factory_| when the certificates that
-  // |certificate_watcher_| is watching get updated.
-  grpc_security_status UpdateHandshakerFactoryLocked()
-      ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
+  // Use "new" to create a new instance, and no need to delete it later, since
+  // it will be self-destroyed in |OnVerifyDone|.
+  class ChannelPendingVerifierRequest {
+   public:
+    ChannelPendingVerifierRequest(
+        RefCountedPtr<TlsChannelSecurityConnector> security_connector,
+        grpc_closure* on_peer_checked, tsi_peer peer, const char* target_name);
 
-  // gRPC-provided callback executed by application, which servers to bring the
-  // control back to gRPC core.
-  static void ServerAuthorizationCheckDone(
-      grpc_tls_server_authorization_check_arg* arg);
+    ~ChannelPendingVerifierRequest();
 
-  // A util function to process server authorization check result.
-  static grpc_error_handle ProcessServerAuthorizationCheckResult(
-      grpc_tls_server_authorization_check_arg* arg);
+    void Start();
 
-  // A util function to create a server authorization check arg instance.
-  static grpc_tls_server_authorization_check_arg*
-  ServerAuthorizationCheckArgCreate(void* user_data);
+    grpc_tls_custom_verification_check_request* request() { return &request_; }
 
-  // A util function to destroy a server authorization check arg instance.
-  static void ServerAuthorizationCheckArgDestroy(
-      grpc_tls_server_authorization_check_arg* arg);
+   private:
+    void OnVerifyDone(bool run_callback_inline, absl::Status status);
+    // The request will keep a reference of the security connector to make sure
+    // it won't be destroyed while the request is still ongoing.
+    RefCountedPtr<TlsChannelSecurityConnector> security_connector_;
+    grpc_tls_custom_verification_check_request request_;
+    grpc_closure* on_peer_checked_;
+  };
 
+  // Updates |client_handshaker_factory_| when the certificates that
+  // |certificate_watcher_| is watching get updated.
+  grpc_security_status UpdateHandshakerFactoryLocked()
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
+
+  Mutex mu_;
+  // We need a separate mutex for |pending_verifier_requests_|, otherwise there
+  // would be deadlock errors.
+  Mutex verifier_request_map_mu_;
   RefCountedPtr<grpc_tls_credentials_options> options_;
   grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
       certificate_watcher_ = nullptr;
-  grpc_closure* on_peer_checked_ = nullptr;
   std::string target_name_;
   std::string overridden_target_name_;
-  grpc_tls_server_authorization_check_arg* check_arg_ = nullptr;
-
-  Mutex mu_;
   tsi_ssl_client_handshaker_factory* client_handshaker_factory_
       ABSL_GUARDED_BY(mu_) = nullptr;
   tsi_ssl_session_cache* ssl_session_cache_ ABSL_GUARDED_BY(mu_) = nullptr;
   absl::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
   absl::optional<PemKeyCertPairList> pem_key_cert_pair_list_
       ABSL_GUARDED_BY(mu_);
+  std::map<grpc_closure* /*on_peer_checked*/, ChannelPendingVerifierRequest*>
+      pending_verifier_requests_ ABSL_GUARDED_BY(verifier_request_map_mu_);
 };
 
 // Server security connector using TLS as transport security protocol.
@@ -172,10 +177,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
                   grpc_closure* on_peer_checked) override;
 
   void cancel_check_peer(grpc_closure* /*on_peer_checked*/,
-                         grpc_error_handle error) override {
-    // TODO(ZhenLian): call verifier->cancel() once the verifier is ready.
-    GRPC_ERROR_UNREF(error);
-  }
+                         grpc_error_handle error) override;
 
   int cmp(const grpc_security_connector* other) const override;
 
@@ -207,6 +209,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
     void OnCertificatesChanged(
         absl::optional<absl::string_view> root_certs,
         absl::optional<PemKeyCertPairList> key_cert_pairs) override;
+
     void OnError(grpc_error_handle root_cert_error,
                  grpc_error_handle identity_cert_error) override;
 
@@ -214,32 +217,50 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
     TlsServerSecurityConnector* security_connector_ = nullptr;
   };
 
+  // Use "new" to create a new instance, and no need to delete it later, since
+  // it will be self-destroyed in |OnVerifyDone|.
+  class ServerPendingVerifierRequest {
+   public:
+    ServerPendingVerifierRequest(
+        RefCountedPtr<TlsServerSecurityConnector> security_connector,
+        grpc_closure* on_peer_checked, tsi_peer peer);
+
+    ~ServerPendingVerifierRequest();
+
+    void Start();
+
+    grpc_tls_custom_verification_check_request* request() { return &request_; }
+
+   private:
+    void OnVerifyDone(bool run_callback_inline, absl::Status status);
+    // The request will keep a reference of the security connector to make sure
+    // it won't be destroyed while the request is still ongoing.
+    RefCountedPtr<TlsServerSecurityConnector> security_connector_;
+    grpc_tls_custom_verification_check_request request_;
+    grpc_closure* on_peer_checked_;
+  };
+
   // Updates |server_handshaker_factory_| when the certificates that
   // |certificate_watcher_| is watching get updated.
   grpc_security_status UpdateHandshakerFactoryLocked()
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
 
+  Mutex mu_;
+  // We need a separate mutex for |pending_verifier_requests_|, otherwise there
+  // would be deadlock errors.
+  Mutex verifier_request_map_mu_;
   RefCountedPtr<grpc_tls_credentials_options> options_;
   grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
       certificate_watcher_ = nullptr;
-
-  Mutex mu_;
   tsi_ssl_server_handshaker_factory* server_handshaker_factory_
       ABSL_GUARDED_BY(mu_) = nullptr;
   absl::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
   absl::optional<PemKeyCertPairList> pem_key_cert_pair_list_
       ABSL_GUARDED_BY(mu_);
+  std::map<grpc_closure* /*on_peer_checked*/, ServerPendingVerifierRequest*>
+      pending_verifier_requests_ ABSL_GUARDED_BY(verifier_request_map_mu_);
 };
 
-// ---- Functions below are exposed for testing only -----------------------
-namespace internal {
-
-// TlsCheckHostName checks if |peer_name| matches the identity information
-// contained in |peer|. This is AKA hostname check.
-grpc_error_handle TlsCheckHostName(const char* peer_name, const tsi_peer* peer);
-
-}  // namespace internal
-
 }  // namespace grpc_core
 
 #endif  // GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H

data/src/core/lib/security/transport/client_auth_filter.cc

@@ -372,13 +372,13 @@ static void client_auth_start_transport_stream_op_batch(
   if (batch->send_initial_metadata) {
     grpc_metadata_batch* metadata =
         batch->payload->send_initial_metadata.send_initial_metadata;
-    if (metadata->idx.named.path != nullptr) {
-      calld->method =
-          grpc_slice_ref_internal(GRPC_MDVALUE(metadata->idx.named.path->md));
+    if (metadata->legacy_index()->named.path != nullptr) {
+      calld->method = grpc_slice_ref_internal(
+          GRPC_MDVALUE(metadata->legacy_index()->named.path->md));
     }
-    if (metadata->idx.named.authority != nullptr) {
+    if (metadata->legacy_index()->named.authority != nullptr) {
       calld->host = grpc_slice_ref_internal(
-          GRPC_MDVALUE(metadata->idx.named.authority->md));
+          GRPC_MDVALUE(metadata->legacy_index()->named.authority->md));
       batch->handler_private.extra_arg = elem;
       GRPC_CALL_STACK_REF(calld->owning_call, "check_call_host");
       GRPC_CLOSURE_INIT(&calld->async_result_closure, on_host_checked, batch,

data/src/core/lib/security/transport/security_handshaker.cc

@@ -116,13 +116,10 @@ SecurityHandshaker::SecurityHandshaker(tsi_handshaker* handshaker,
       connector_(connector->Ref(DEBUG_LOCATION, "handshake")),
       handshake_buffer_size_(GRPC_INITIAL_HANDSHAKE_BUFFER_SIZE),
       handshake_buffer_(
-          static_cast<uint8_t*>(gpr_malloc(handshake_buffer_size_))) {
-  const grpc_arg* arg =
-      grpc_channel_args_find(args, GRPC_ARG_TSI_MAX_FRAME_SIZE);
-  if (arg != nullptr && arg->type == GRPC_ARG_INTEGER) {
-    max_frame_size_ = grpc_channel_arg_get_integer(
-        arg, {0, 0, std::numeric_limits<int>::max()});
-  }
+          static_cast<uint8_t*>(gpr_malloc(handshake_buffer_size_))),
+      max_frame_size_(grpc_channel_args_find_integer(
+          args, GRPC_ARG_TSI_MAX_FRAME_SIZE,
+          {0, 0, std::numeric_limits<int>::max()})) {
   grpc_slice_buffer_init(&outgoing_);
   GRPC_CLOSURE_INIT(&on_peer_checked_, &SecurityHandshaker::OnPeerCheckedFn,
                     this, grpc_schedule_on_exec_ctx);
@@ -232,49 +229,83 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
     HandshakeFailedLocked(error);
     return;
   }
-  // Create zero-copy frame protector, if implemented.
-  tsi_zero_copy_grpc_protector* zero_copy_protector = nullptr;
-  tsi_result result = tsi_handshaker_result_create_zero_copy_grpc_protector(
-      handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
-      &zero_copy_protector);
-  if (result != TSI_OK && result != TSI_UNIMPLEMENTED) {
-    error = grpc_set_tsi_error_result(
+  // Get unused bytes.
+  const unsigned char* unused_bytes = nullptr;
+  size_t unused_bytes_size = 0;
+  tsi_result result = tsi_handshaker_result_get_unused_bytes(
+      handshaker_result_, &unused_bytes, &unused_bytes_size);
+  if (result != TSI_OK) {
+    HandshakeFailedLocked(grpc_set_tsi_error_result(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-            "Zero-copy frame protector creation failed"),
-        result);
-    HandshakeFailedLocked(error);
+            "TSI handshaker result does not provide unused bytes"),
+        result));
+    return;
+  }
+  // Check whether we need to wrap the endpoint.
+  tsi_frame_protector_type frame_protector_type;
+  result = tsi_handshaker_result_get_frame_protector_type(
+      handshaker_result_, &frame_protector_type);
+  if (result != TSI_OK) {
+    HandshakeFailedLocked(grpc_set_tsi_error_result(
+        GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+            "TSI handshaker result does not implement "
+            "get_frame_protector_type"),
+        result));
     return;
   }
-  // Create frame protector if zero-copy frame protector is NULL.
+  tsi_zero_copy_grpc_protector* zero_copy_protector = nullptr;
   tsi_frame_protector* protector = nullptr;
-  if (zero_copy_protector == nullptr) {
-    result = tsi_handshaker_result_create_frame_protector(
-        handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
-        &protector);
-    if (result != TSI_OK) {
-      error = grpc_set_tsi_error_result(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-                                            "Frame protector creation failed"),
-                                        result);
-      HandshakeFailedLocked(error);
-      return;
-    }
+  switch (frame_protector_type) {
+    case TSI_FRAME_PROTECTOR_ZERO_COPY:
+      ABSL_FALLTHROUGH_INTENDED;
+    case TSI_FRAME_PROTECTOR_NORMAL_OR_ZERO_COPY:
+      // Create zero-copy frame protector.
+      result = tsi_handshaker_result_create_zero_copy_grpc_protector(
+          handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
+          &zero_copy_protector);
+      if (result != TSI_OK) {
+        HandshakeFailedLocked(grpc_set_tsi_error_result(
+            GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+                "Zero-copy frame protector creation failed"),
+            result));
+        return;
+      }
+      break;
+    case TSI_FRAME_PROTECTOR_NORMAL:
+      // Create normal frame protector.
+      result = tsi_handshaker_result_create_frame_protector(
+          handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
+          &protector);
+      if (result != TSI_OK) {
+        HandshakeFailedLocked(
+            grpc_set_tsi_error_result(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+                                          "Frame protector creation failed"),
+                                      result));
+        return;
+      }
+      break;
+    case TSI_FRAME_PROTECTOR_NONE:
+      break;
   }
-  // Get unused bytes.
-  const unsigned char* unused_bytes = nullptr;
-  size_t unused_bytes_size = 0;
-  result = tsi_handshaker_result_get_unused_bytes(
-      handshaker_result_, &unused_bytes, &unused_bytes_size);
-  // Create secure endpoint.
-  if (unused_bytes_size > 0) {
+  // If we have a frame protector, create a secure endpoint.
+  if (zero_copy_protector != nullptr || protector != nullptr) {
+    if (unused_bytes_size > 0) {
+      grpc_slice slice = grpc_slice_from_copied_buffer(
+          reinterpret_cast<const char*>(unused_bytes), unused_bytes_size);
+      args_->endpoint = grpc_secure_endpoint_create(
+          protector, zero_copy_protector, args_->endpoint, &slice, 1);
+      grpc_slice_unref_internal(slice);
+    } else {
+      args_->endpoint = grpc_secure_endpoint_create(
+          protector, zero_copy_protector, args_->endpoint, nullptr, 0);
+    }
+  } else if (unused_bytes_size > 0) {
+    // Not wrapping the endpoint, so just pass along unused bytes.
     grpc_slice slice = grpc_slice_from_copied_buffer(
         reinterpret_cast<const char*>(unused_bytes), unused_bytes_size);
-    args_->endpoint = grpc_secure_endpoint_create(
-        protector, zero_copy_protector, args_->endpoint, &slice, 1);
-    grpc_slice_unref_internal(slice);
-  } else {
-    args_->endpoint = grpc_secure_endpoint_create(
-        protector, zero_copy_protector, args_->endpoint, nullptr, 0);
+    grpc_slice_buffer_add(args_->read_buffer, slice);
   }
+  // Done with handshaker result.
   tsi_handshaker_result_destroy(handshaker_result_);
   handshaker_result_ = nullptr;
   // Add auth context to channel args.
@@ -409,7 +440,7 @@ grpc_error_handle SecurityHandshaker::DoHandshakerNextLocked(
 void SecurityHandshaker::OnHandshakeDataReceivedFromPeerFnScheduler(
     void* arg, grpc_error_handle error) {
   SecurityHandshaker* h = static_cast<SecurityHandshaker*>(arg);
-  grpc_core::ExecCtx::Run(
+  ExecCtx::Run(
       DEBUG_LOCATION,
       GRPC_CLOSURE_INIT(&h->on_handshake_data_received_from_peer_,
                         &SecurityHandshaker::OnHandshakeDataReceivedFromPeerFn,
@@ -430,7 +461,6 @@ void SecurityHandshaker::OnHandshakeDataReceivedFromPeerFn(
   size_t bytes_received_size = h->MoveReadBufferIntoHandshakeBuffer();
   // Call TSI handshaker.
   error = h->DoHandshakerNextLocked(h->handshake_buffer_, bytes_received_size);
-
   if (error != GRPC_ERROR_NONE) {
     h->HandshakeFailedLocked(error);
   } else {
@@ -443,7 +473,7 @@ void SecurityHandshaker::OnHandshakeDataReceivedFromPeerFn(
 void SecurityHandshaker::OnHandshakeDataSentToPeerFnScheduler(
     void* arg, grpc_error_handle error) {
   SecurityHandshaker* h = static_cast<SecurityHandshaker*>(arg);
-  grpc_core::ExecCtx::Run(
+  ExecCtx::Run(
       DEBUG_LOCATION,
       GRPC_CLOSURE_INIT(&h->on_handshake_data_sent_to_peer_,
                         &SecurityHandshaker::OnHandshakeDataSentToPeerFn, h,

data/src/core/lib/security/transport/server_auth_filter.cc

@@ -96,23 +96,21 @@ struct call_data {
 
 static grpc_metadata_array metadata_batch_to_md_array(
     const grpc_metadata_batch* batch) {
-  grpc_linked_mdelem* l;
   grpc_metadata_array result;
   grpc_metadata_array_init(&result);
-  for (l = batch->list.head; l != nullptr; l = l->next) {
+  batch->ForEach([&](grpc_mdelem md) {
     grpc_metadata* usr_md = nullptr;
-    grpc_mdelem md = l->md;
     grpc_slice key = GRPC_MDKEY(md);
     grpc_slice value = GRPC_MDVALUE(md);
     if (result.count == result.capacity) {
-      result.capacity = GPR_MAX(result.capacity + 8, result.capacity * 2);
+      result.capacity = std::max(result.capacity + 8, result.capacity * 2);
       result.metadata = static_cast<grpc_metadata*>(gpr_realloc(
           result.metadata, result.capacity * sizeof(grpc_metadata)));
     }
     usr_md = &result.metadata[result.count++];
     usr_md->key = grpc_slice_ref_internal(key);
     usr_md->value = grpc_slice_ref_internal(value);
-  }
+  });
   return result;
 }
 

data/src/core/lib/security/transport/tsi_error.cc

@@ -22,9 +22,7 @@
 
 grpc_error_handle grpc_set_tsi_error_result(grpc_error_handle error,
                                             tsi_result result) {
-  return grpc_error_set_int(
-      grpc_error_set_str(
-          error, GRPC_ERROR_STR_TSI_ERROR,
-          grpc_slice_from_static_string(tsi_result_to_string(result))),
-      GRPC_ERROR_INT_TSI_CODE, result);
+  return grpc_error_set_int(grpc_error_set_str(error, GRPC_ERROR_STR_TSI_ERROR,
+                                               tsi_result_to_string(result)),
+                            GRPC_ERROR_INT_TSI_CODE, result);
 }

data/src/core/lib/slice/percent_encoding.cc

@@ -51,7 +51,7 @@ class UrlTable : public BitSet<256> {
   }
 };
 
-static GRPC_PCTENCODE_CONSTEXPR_VALUE UrlTable g_url_table;
+GRPC_PCTENCODE_CONSTEXPR_VALUE UrlTable g_url_table;
 
 class CompatibleTable : public BitSet<256> {
  public:
@@ -63,7 +63,7 @@ class CompatibleTable : public BitSet<256> {
   }
 };
 
-static GRPC_PCTENCODE_CONSTEXPR_VALUE CompatibleTable g_compatible_table;
+GRPC_PCTENCODE_CONSTEXPR_VALUE CompatibleTable g_compatible_table;
 
 // Map PercentEncodingType to a lookup table of legal symbols for that encoding.
 const BitSet<256>& LookupTableForPercentEncodingType(PercentEncodingType type) {
@@ -78,135 +78,79 @@ const BitSet<256>& LookupTableForPercentEncodingType(PercentEncodingType type) {
 }
 }  // namespace
 
-grpc_slice PercentEncodeSlice(const grpc_slice& slice,
-                              PercentEncodingType type) {
+Slice PercentEncodeSlice(Slice slice, PercentEncodingType type) {
   static const uint8_t hex[] = "0123456789ABCDEF";
 
   const BitSet<256>& lut = LookupTableForPercentEncodingType(type);
 
   // first pass: count the number of bytes needed to output this string
   size_t output_length = 0;
-  const uint8_t* slice_start = GRPC_SLICE_START_PTR(slice);
-  const uint8_t* slice_end = GRPC_SLICE_END_PTR(slice);
-  const uint8_t* p;
   bool any_reserved_bytes = false;
-  for (p = slice_start; p < slice_end; p++) {
-    bool unres = lut.is_set(*p);
+  for (uint8_t c : slice) {
+    bool unres = lut.is_set(c);
     output_length += unres ? 1 : 3;
     any_reserved_bytes |= !unres;
   }
   // no unreserved bytes: return the string unmodified
   if (!any_reserved_bytes) {
-    return grpc_slice_ref_internal(slice);
+    return slice;
   }
   // second pass: actually encode
-  grpc_slice out = GRPC_SLICE_MALLOC(output_length);
-  uint8_t* q = GRPC_SLICE_START_PTR(out);
-  for (p = slice_start; p < slice_end; p++) {
-    if (lut.is_set(*p)) {
-      *q++ = *p;
+  auto out = MutableSlice::CreateUninitialized(output_length);
+  uint8_t* q = out.begin();
+  for (uint8_t c : slice) {
+    if (lut.is_set(c)) {
+      *q++ = c;
     } else {
       *q++ = '%';
-      *q++ = hex[*p >> 4];
-      *q++ = hex[*p & 15];
+      *q++ = hex[c >> 4];
+      *q++ = hex[c & 15];
     }
   }
-  GPR_ASSERT(q == GRPC_SLICE_END_PTR(out));
-  return out;
+  GPR_ASSERT(q == out.end());
+  return Slice(std::move(out));
 }
 
-static bool valid_hex(const uint8_t* p, const uint8_t* end) {
+static bool ValidHex(const uint8_t* p, const uint8_t* end) {
   if (p >= end) return false;
   return (*p >= '0' && *p <= '9') || (*p >= 'a' && *p <= 'f') ||
          (*p >= 'A' && *p <= 'F');
 }
 
-static uint8_t dehex(uint8_t c) {
+static uint8_t DeHex(uint8_t c) {
   if (c >= '0' && c <= '9') return static_cast<uint8_t>(c - '0');
   if (c >= 'A' && c <= 'F') return static_cast<uint8_t>(c - 'A' + 10);
   if (c >= 'a' && c <= 'f') return static_cast<uint8_t>(c - 'a' + 10);
   GPR_UNREACHABLE_CODE(return 255);
 }
 
-absl::optional<grpc_slice> PercentDecodeSlice(const grpc_slice& slice_in,
-                                              PercentEncodingType type) {
-  const uint8_t* p = GRPC_SLICE_START_PTR(slice_in);
-  const uint8_t* in_end = GRPC_SLICE_END_PTR(slice_in);
-  size_t out_length = 0;
+Slice PermissivePercentDecodeSlice(Slice slice_in) {
   bool any_percent_encoded_stuff = false;
-  const BitSet<256>& lut = LookupTableForPercentEncodingType(type);
-  while (p != in_end) {
-    if (*p == '%') {
-      if (!valid_hex(++p, in_end)) return {};
-      if (!valid_hex(++p, in_end)) return {};
-      p++;
-      out_length++;
+  for (uint8_t c : slice_in) {
+    if (c == '%') {
       any_percent_encoded_stuff = true;
-    } else if (lut.is_set(*p)) {
-      p++;
-      out_length++;
-    } else {
-      return {};
-    }
-  }
-  if (!any_percent_encoded_stuff) {
-    return grpc_slice_ref_internal(slice_in);
-  }
-  p = GRPC_SLICE_START_PTR(slice_in);
-  grpc_slice slice_out = GRPC_SLICE_MALLOC(out_length);
-  uint8_t* q = GRPC_SLICE_START_PTR(slice_out);
-  while (p != in_end) {
-    if (*p == '%') {
-      *q++ = static_cast<uint8_t>(dehex(p[1]) << 4) | (dehex(p[2]));
-      p += 3;
-    } else {
-      *q++ = *p++;
+      break;
     }
   }
-  GPR_ASSERT(q == GRPC_SLICE_END_PTR(slice_out));
-  return slice_out;
-}
+  if (!any_percent_encoded_stuff) return slice_in;
 
-grpc_slice PermissivePercentDecodeSlice(const grpc_slice& slice_in) {
-  const uint8_t* p = GRPC_SLICE_START_PTR(slice_in);
-  const uint8_t* in_end = GRPC_SLICE_END_PTR(slice_in);
-  size_t out_length = 0;
-  bool any_percent_encoded_stuff = false;
-  while (p != in_end) {
-    if (*p == '%') {
-      if (!valid_hex(p + 1, in_end) || !valid_hex(p + 2, in_end)) {
-        p++;
-        out_length++;
-      } else {
-        p += 3;
-        out_length++;
-        any_percent_encoded_stuff = true;
-      }
-    } else {
-      p++;
-      out_length++;
-    }
-  }
-  if (!any_percent_encoded_stuff) {
-    return grpc_slice_ref_internal(slice_in);
-  }
-  p = GRPC_SLICE_START_PTR(slice_in);
-  grpc_slice out = GRPC_SLICE_MALLOC(out_length);
-  uint8_t* q = GRPC_SLICE_START_PTR(out);
-  while (p != in_end) {
+  MutableSlice out = slice_in.TakeMutable();
+  uint8_t* q = out.begin();
+  const uint8_t* p = out.begin();
+  const uint8_t* end = out.end();
+  while (p != end) {
     if (*p == '%') {
-      if (!valid_hex(p + 1, in_end) || !valid_hex(p + 2, in_end)) {
+      if (!ValidHex(p + 1, end) || !ValidHex(p + 2, end)) {
         *q++ = *p++;
       } else {
-        *q++ = static_cast<uint8_t>(dehex(p[1]) << 4) | (dehex(p[2]));
+        *q++ = static_cast<uint8_t>(DeHex(p[1]) << 4) | (DeHex(p[2]));
         p += 3;
       }
     } else {
       *q++ = *p++;
     }
   }
-  GPR_ASSERT(q == GRPC_SLICE_END_PTR(out));
-  return out;
+  return Slice(out.TakeSubSlice(0, q - out.begin()));
 }
 
 }  // namespace grpc_core

data/src/core/lib/slice/percent_encoding.h

@@ -34,32 +34,26 @@
 
 #include <grpc/slice.h>
 
+#include "src/core/lib/slice/slice.h"
+
 namespace grpc_core {
 
 enum class PercentEncodingType {
   // Flags [A-Za-z0-9-_.~] as unreserved bytes for the percent encoding routines
   URL,
   // Flags ascii7 non-control characters excluding '%' as unreserved bytes for
-  // the
-  // percent encoding routines
+  // the percent encoding routines
   Compatible
 };
 
 // Percent-encode a slice, returning the new slice (this cannot fail):
 // unreserved_bytes is a bitfield indicating which bytes are considered
 // unreserved and thus do not need percent encoding
-grpc_slice PercentEncodeSlice(const grpc_slice& slice,
-                              PercentEncodingType type);
-// Percent-decode a slice, strictly.
-// If the input is legal (contains no unreserved bytes, and legal % encodings),
-// returns the decoded slice.
-// If the input is not legal, returns {}.
-absl::optional<grpc_slice> PercentDecodeSlice(const grpc_slice& slice_in,
-                                              PercentEncodingType type);
+Slice PercentEncodeSlice(Slice slice, PercentEncodingType type);
 // Percent-decode a slice, permissively.
 // If a % triplet can not be decoded, pass it through verbatim.
 // This cannot fail.
-grpc_slice PermissivePercentDecodeSlice(const grpc_slice& slice_in);
+Slice PermissivePercentDecodeSlice(Slice slice_in);
 
 }  // namespace grpc_core