grpc 1.41.1 → 1.44.0.pre2

data/src/core/lib/security/security_connector/tls/tls_security_connector.h

@@ -21,13 +21,13 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "absl/status/status.h"
+
 #include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 
-#define GRPC_TLS_TRANSPORT_SECURITY_TYPE "tls"
-
 namespace grpc_core {
 
 // Channel security connector using TLS as transport security protocol.
@@ -60,11 +60,8 @@ class TlsChannelSecurityConnector final
                   RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 
-  void cancel_check_peer(grpc_closure* /*on_peer_checked*/,
-                         grpc_error_handle error) override {
-    // TODO(ZhenLian): call verifier->cancel() once the verifier is ready.
-    GRPC_ERROR_UNREF(error);
-  }
+  void cancel_check_peer(grpc_closure* on_peer_checked,
+                         grpc_error_handle error) override;
 
   int cmp(const grpc_security_connector* other_sc) const override;
 
@@ -110,43 +107,51 @@ class TlsChannelSecurityConnector final
     TlsChannelSecurityConnector* security_connector_ = nullptr;
   };
 
-  // Updates |client_handshaker_factory_| when the certificates that
-  // |certificate_watcher_| is watching get updated.
-  grpc_security_status UpdateHandshakerFactoryLocked()
-      ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
+  // Use "new" to create a new instance, and no need to delete it later, since
+  // it will be self-destroyed in |OnVerifyDone|.
+  class ChannelPendingVerifierRequest {
+   public:
+    ChannelPendingVerifierRequest(
+        RefCountedPtr<TlsChannelSecurityConnector> security_connector,
+        grpc_closure* on_peer_checked, tsi_peer peer, const char* target_name);
 
-  // gRPC-provided callback executed by application, which servers to bring the
-  // control back to gRPC core.
-  static void ServerAuthorizationCheckDone(
-      grpc_tls_server_authorization_check_arg* arg);
+    ~ChannelPendingVerifierRequest();
 
-  // A util function to process server authorization check result.
-  static grpc_error_handle ProcessServerAuthorizationCheckResult(
-      grpc_tls_server_authorization_check_arg* arg);
+    void Start();
 
-  // A util function to create a server authorization check arg instance.
-  static grpc_tls_server_authorization_check_arg*
-  ServerAuthorizationCheckArgCreate(void* user_data);
+    grpc_tls_custom_verification_check_request* request() { return &request_; }
 
-  // A util function to destroy a server authorization check arg instance.
-  static void ServerAuthorizationCheckArgDestroy(
-      grpc_tls_server_authorization_check_arg* arg);
+   private:
+    void OnVerifyDone(bool run_callback_inline, absl::Status status);
+    // The request will keep a reference of the security connector to make sure
+    // it won't be destroyed while the request is still ongoing.
+    RefCountedPtr<TlsChannelSecurityConnector> security_connector_;
+    grpc_tls_custom_verification_check_request request_;
+    grpc_closure* on_peer_checked_;
+  };
 
+  // Updates |client_handshaker_factory_| when the certificates that
+  // |certificate_watcher_| is watching get updated.
+  grpc_security_status UpdateHandshakerFactoryLocked()
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
+
+  Mutex mu_;
+  // We need a separate mutex for |pending_verifier_requests_|, otherwise there
+  // would be deadlock errors.
+  Mutex verifier_request_map_mu_;
   RefCountedPtr<grpc_tls_credentials_options> options_;
   grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
       certificate_watcher_ = nullptr;
-  grpc_closure* on_peer_checked_ = nullptr;
   std::string target_name_;
   std::string overridden_target_name_;
-  grpc_tls_server_authorization_check_arg* check_arg_ = nullptr;
-
-  Mutex mu_;
   tsi_ssl_client_handshaker_factory* client_handshaker_factory_
       ABSL_GUARDED_BY(mu_) = nullptr;
   tsi_ssl_session_cache* ssl_session_cache_ ABSL_GUARDED_BY(mu_) = nullptr;
   absl::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
   absl::optional<PemKeyCertPairList> pem_key_cert_pair_list_
       ABSL_GUARDED_BY(mu_);
+  std::map<grpc_closure* /*on_peer_checked*/, ChannelPendingVerifierRequest*>
+      pending_verifier_requests_ ABSL_GUARDED_BY(verifier_request_map_mu_);
 };
 
 // Server security connector using TLS as transport security protocol.
@@ -172,10 +177,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
                   grpc_closure* on_peer_checked) override;
 
   void cancel_check_peer(grpc_closure* /*on_peer_checked*/,
-                         grpc_error_handle error) override {
-    // TODO(ZhenLian): call verifier->cancel() once the verifier is ready.
-    GRPC_ERROR_UNREF(error);
-  }
+                         grpc_error_handle error) override;
 
   int cmp(const grpc_security_connector* other) const override;
 
@@ -207,6 +209,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
     void OnCertificatesChanged(
         absl::optional<absl::string_view> root_certs,
         absl::optional<PemKeyCertPairList> key_cert_pairs) override;
+
     void OnError(grpc_error_handle root_cert_error,
                  grpc_error_handle identity_cert_error) override;
 
@@ -214,32 +217,50 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
     TlsServerSecurityConnector* security_connector_ = nullptr;
   };
 
+  // Use "new" to create a new instance, and no need to delete it later, since
+  // it will be self-destroyed in |OnVerifyDone|.
+  class ServerPendingVerifierRequest {
+   public:
+    ServerPendingVerifierRequest(
+        RefCountedPtr<TlsServerSecurityConnector> security_connector,
+        grpc_closure* on_peer_checked, tsi_peer peer);
+
+    ~ServerPendingVerifierRequest();
+
+    void Start();
+
+    grpc_tls_custom_verification_check_request* request() { return &request_; }
+
+   private:
+    void OnVerifyDone(bool run_callback_inline, absl::Status status);
+    // The request will keep a reference of the security connector to make sure
+    // it won't be destroyed while the request is still ongoing.
+    RefCountedPtr<TlsServerSecurityConnector> security_connector_;
+    grpc_tls_custom_verification_check_request request_;
+    grpc_closure* on_peer_checked_;
+  };
+
   // Updates |server_handshaker_factory_| when the certificates that
   // |certificate_watcher_| is watching get updated.
   grpc_security_status UpdateHandshakerFactoryLocked()
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
 
+  Mutex mu_;
+  // We need a separate mutex for |pending_verifier_requests_|, otherwise there
+  // would be deadlock errors.
+  Mutex verifier_request_map_mu_;
   RefCountedPtr<grpc_tls_credentials_options> options_;
   grpc_tls_certificate_distributor::TlsCertificatesWatcherInterface*
       certificate_watcher_ = nullptr;
-
-  Mutex mu_;
   tsi_ssl_server_handshaker_factory* server_handshaker_factory_
       ABSL_GUARDED_BY(mu_) = nullptr;
   absl::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
   absl::optional<PemKeyCertPairList> pem_key_cert_pair_list_
       ABSL_GUARDED_BY(mu_);
+  std::map<grpc_closure* /*on_peer_checked*/, ServerPendingVerifierRequest*>
+      pending_verifier_requests_ ABSL_GUARDED_BY(verifier_request_map_mu_);
 };
 
-// ---- Functions below are exposed for testing only -----------------------
-namespace internal {
-
-// TlsCheckHostName checks if |peer_name| matches the identity information
-// contained in |peer|. This is AKA hostname check.
-grpc_error_handle TlsCheckHostName(const char* peer_name, const tsi_peer* peer);
-
-}  // namespace internal
-
 }  // namespace grpc_core
 
 #endif  // GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H

data/src/core/lib/security/transport/auth_filters.h

@@ -33,4 +33,11 @@ void grpc_auth_metadata_context_build(
     const grpc_slice& call_method, grpc_auth_context* auth_context,
     grpc_auth_metadata_context* auth_md_context);
 
+// Exposed for testing purposes only.
+// Check if the channel's security level is higher or equal to
+// that of call credentials to make a decision whether the transfer
+// of call credentials should be allowed or not.
+bool grpc_check_security_level(grpc_security_level channel_level,
+                               grpc_security_level call_cred_level);
+
 #endif /* GRPC_CORE_LIB_SECURITY_TRANSPORT_AUTH_FILTERS_H */

data/src/core/lib/security/transport/client_auth_filter.cc

@@ -30,16 +30,15 @@
 
 #include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/gpr/string.h"
+#include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/profiling/timers.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
-#include "src/core/lib/security/security_connector/ssl_utils.h"
 #include "src/core/lib/security/transport/auth_filters.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
 #include "src/core/lib/surface/call.h"
-#include "src/core/lib/transport/static_metadata.h"
 
 #define MAX_CREDENTIALS_METADATA_COUNT 4
 
@@ -65,6 +64,9 @@ struct channel_data {
 struct call_data {
   call_data(grpc_call_element* elem, const grpc_call_element_args& args)
       : owning_call(args.call_stack), call_combiner(args.call_combiner) {
+    host.Init();
+    method.Init();
+    md_array.Init();
     channel_data* chand = static_cast<channel_data*>(elem->channel_data);
     GPR_ASSERT(args.context != nullptr);
     if (args.context[GRPC_CONTEXT_SECURITY].value == nullptr) {
@@ -87,25 +89,24 @@ struct call_data {
   // fields will be accessed after calling dtor, and msan correctly complains
   // that the memory is not initialized.
   void destroy() {
-    grpc_credentials_mdelem_array_destroy(&md_array);
+    md_array.Destroy();
     creds.reset();
-    grpc_slice_unref_internal(host);
-    grpc_slice_unref_internal(method);
     grpc_auth_metadata_context_reset(&auth_md_context);
+    host.Destroy();
+    method.Destroy();
   }
 
   grpc_call_stack* owning_call;
   grpc_core::CallCombiner* call_combiner;
   grpc_core::RefCountedPtr<grpc_call_credentials> creds;
-  grpc_slice host = grpc_empty_slice();
-  grpc_slice method = grpc_empty_slice();
+  grpc_core::ManualConstructor<grpc_core::Slice> host;
+  grpc_core::ManualConstructor<grpc_core::Slice> method;
   /* pollset{_set} bound to this call; if we need to make external
      network requests, they should be done under a pollset added to this
      pollset_set so that work can progress when this call wants work to progress
   */
   grpc_polling_entity* pollent = nullptr;
-  grpc_credentials_mdelem_array md_array;
-  grpc_linked_mdelem md_links[MAX_CREDENTIALS_METADATA_COUNT] = {};
+  grpc_core::ManualConstructor<grpc_core::CredentialsMetadataArray> md_array;
   grpc_auth_metadata_context auth_md_context =
       grpc_auth_metadata_context();  // Zero-initialize the C struct.
   grpc_closure async_result_closure;
@@ -163,17 +164,20 @@ static void on_credentials_metadata(void* arg, grpc_error_handle input_error) {
   grpc_auth_metadata_context_reset(&calld->auth_md_context);
   grpc_error_handle error = GRPC_ERROR_REF(input_error);
   if (error == GRPC_ERROR_NONE) {
-    GPR_ASSERT(calld->md_array.size <= MAX_CREDENTIALS_METADATA_COUNT);
+    GPR_ASSERT(calld->md_array->size() <= MAX_CREDENTIALS_METADATA_COUNT);
     GPR_ASSERT(batch->send_initial_metadata);
     grpc_metadata_batch* mdb =
         batch->payload->send_initial_metadata.send_initial_metadata;
-    for (size_t i = 0; i < calld->md_array.size; ++i) {
-      add_error(&error, grpc_metadata_batch_add_tail(
-                            mdb, &calld->md_links[i],
-                            GRPC_MDELEM_REF(calld->md_array.md[i])));
+    for (const auto& md : *calld->md_array) {
+      mdb->Append(
+          md.first.as_string_view(), md.second.Ref(),
+          [&](absl::string_view error_message, const grpc_core::Slice& value) {
+            add_error(&error, GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+                                  "on_credentials_metadata: ", error_message,
+                                  ": ", md.first.as_string_view(), ": ",
+                                  value.as_string_view())));
+          });
     }
-  }
-  if (error == GRPC_ERROR_NONE) {
     grpc_call_next_op(elem, batch);
   } else {
     error = grpc_error_set_int(error, GRPC_ERROR_INT_GRPC_STATUS,
@@ -228,12 +232,27 @@ static void cancel_get_request_metadata(void* arg, grpc_error_handle error) {
   grpc_call_element* elem = static_cast<grpc_call_element*>(arg);
   call_data* calld = static_cast<call_data*>(elem->call_data);
   if (error != GRPC_ERROR_NONE) {
-    calld->creds->cancel_get_request_metadata(&calld->md_array,
+    calld->creds->cancel_get_request_metadata(&*calld->md_array,
                                               GRPC_ERROR_REF(error));
   }
   GRPC_CALL_STACK_UNREF(calld->owning_call, "cancel_get_request_metadata");
 }
 
+static grpc_security_level convert_security_level_string_to_enum(
+    const char* security_level) {
+  if (strcmp(security_level, "TSI_INTEGRITY_ONLY") == 0) {
+    return GRPC_INTEGRITY_ONLY;
+  } else if (strcmp(security_level, "TSI_PRIVACY_AND_INTEGRITY") == 0) {
+    return GRPC_PRIVACY_AND_INTEGRITY;
+  }
+  return GRPC_SECURITY_NONE;
+}
+
+bool grpc_check_security_level(grpc_security_level channel_level,
+                               grpc_security_level call_cred_level) {
+  return static_cast<int>(channel_level) >= static_cast<int>(call_cred_level);
+}
+
 static void send_security_metadata(grpc_call_element* elem,
                                    grpc_transport_stream_op_batch* batch) {
   call_data* calld = static_cast<call_data*>(elem->call_data);
@@ -289,7 +308,7 @@ static void send_security_metadata(grpc_call_element* elem,
   grpc_security_level call_cred_security_level =
       calld->creds->min_security_level();
   int is_security_level_ok = grpc_check_security_level(
-      grpc_tsi_security_level_string_to_enum(prop->value),
+      convert_security_level_string_to_enum(prop->value),
       call_cred_security_level);
   if (!is_security_level_ok) {
     grpc_transport_stream_op_batch_finish_with_failure(
@@ -304,8 +323,9 @@ static void send_security_metadata(grpc_call_element* elem,
   }
 
   grpc_auth_metadata_context_build(
-      chand->security_connector->url_scheme(), calld->host, calld->method,
-      chand->auth_context.get(), &calld->auth_md_context);
+      chand->security_connector->url_scheme(), calld->host->c_slice(),
+      calld->method->c_slice(), chand->auth_context.get(),
+      &calld->auth_md_context);
 
   GPR_ASSERT(calld->pollent != nullptr);
   GRPC_CALL_STACK_REF(calld->owning_call, "get_request_metadata");
@@ -313,7 +333,7 @@ static void send_security_metadata(grpc_call_element* elem,
                     batch, grpc_schedule_on_exec_ctx);
   grpc_error_handle error = GRPC_ERROR_NONE;
   if (calld->creds->get_request_metadata(
-          calld->pollent, calld->auth_md_context, &calld->md_array,
+          calld->pollent, calld->auth_md_context, &*calld->md_array,
           &calld->async_result_closure, &error)) {
     // Synchronous return; invoke on_credentials_metadata() directly.
     on_credentials_metadata(batch, error);
@@ -340,11 +360,11 @@ static void on_host_checked(void* arg, grpc_error_handle error) {
   } else {
     grpc_transport_stream_op_batch_finish_with_failure(
         batch,
-        grpc_error_set_int(
-            GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
-                "Invalid host ", grpc_core::StringViewFromSlice(calld->host),
-                " set in :authority metadata.")),
-            GRPC_ERROR_INT_GRPC_STATUS, GRPC_STATUS_UNAUTHENTICATED),
+        grpc_error_set_int(GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+                               "Invalid host ", calld->host->as_string_view(),
+                               " set in :authority metadata.")),
+                           GRPC_ERROR_INT_GRPC_STATUS,
+                           GRPC_STATUS_UNAUTHENTICATED),
         calld->call_combiner);
   }
   GRPC_CALL_STACK_UNREF(calld->owning_call, "check_call_host");
@@ -372,18 +392,18 @@ static void client_auth_start_transport_stream_op_batch(
   if (batch->send_initial_metadata) {
     grpc_metadata_batch* metadata =
         batch->payload->send_initial_metadata.send_initial_metadata;
-    if (metadata->idx.named.path != nullptr) {
-      calld->method =
-          grpc_slice_ref_internal(GRPC_MDVALUE(metadata->idx.named.path->md));
+    if (metadata->get_pointer(grpc_core::HttpPathMetadata()) != nullptr) {
+      *calld->method =
+          metadata->get_pointer(grpc_core::HttpPathMetadata())->Ref();
     }
-    if (metadata->idx.named.authority != nullptr) {
-      calld->host = grpc_slice_ref_internal(
-          GRPC_MDVALUE(metadata->idx.named.authority->md));
+    if (metadata->get_pointer(grpc_core::HttpAuthorityMetadata()) != nullptr) {
+      *calld->host =
+          metadata->get_pointer(grpc_core::HttpAuthorityMetadata())->Ref();
       batch->handler_private.extra_arg = elem;
       GRPC_CALL_STACK_REF(calld->owning_call, "check_call_host");
       GRPC_CLOSURE_INIT(&calld->async_result_closure, on_host_checked, batch,
                         grpc_schedule_on_exec_ctx);
-      absl::string_view call_host(grpc_core::StringViewFromSlice(calld->host));
+      absl::string_view call_host = calld->host->as_string_view();
       grpc_error_handle error = GRPC_ERROR_NONE;
       if (chand->security_connector->check_call_host(
               call_host, chand->auth_context.get(),

data/src/core/lib/security/transport/security_handshaker.cc

@@ -116,13 +116,10 @@ SecurityHandshaker::SecurityHandshaker(tsi_handshaker* handshaker,
       connector_(connector->Ref(DEBUG_LOCATION, "handshake")),
       handshake_buffer_size_(GRPC_INITIAL_HANDSHAKE_BUFFER_SIZE),
       handshake_buffer_(
-          static_cast<uint8_t*>(gpr_malloc(handshake_buffer_size_))) {
-  const grpc_arg* arg =
-      grpc_channel_args_find(args, GRPC_ARG_TSI_MAX_FRAME_SIZE);
-  if (arg != nullptr && arg->type == GRPC_ARG_INTEGER) {
-    max_frame_size_ = grpc_channel_arg_get_integer(
-        arg, {0, 0, std::numeric_limits<int>::max()});
-  }
+          static_cast<uint8_t*>(gpr_malloc(handshake_buffer_size_))),
+      max_frame_size_(grpc_channel_args_find_integer(
+          args, GRPC_ARG_TSI_MAX_FRAME_SIZE,
+          {0, 0, std::numeric_limits<int>::max()})) {
   grpc_slice_buffer_init(&outgoing_);
   GRPC_CLOSURE_INIT(&on_peer_checked_, &SecurityHandshaker::OnPeerCheckedFn,
                     this, grpc_schedule_on_exec_ctx);
@@ -232,49 +229,83 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
     HandshakeFailedLocked(error);
     return;
   }
-  // Create zero-copy frame protector, if implemented.
-  tsi_zero_copy_grpc_protector* zero_copy_protector = nullptr;
-  tsi_result result = tsi_handshaker_result_create_zero_copy_grpc_protector(
-      handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
-      &zero_copy_protector);
-  if (result != TSI_OK && result != TSI_UNIMPLEMENTED) {
-    error = grpc_set_tsi_error_result(
+  // Get unused bytes.
+  const unsigned char* unused_bytes = nullptr;
+  size_t unused_bytes_size = 0;
+  tsi_result result = tsi_handshaker_result_get_unused_bytes(
+      handshaker_result_, &unused_bytes, &unused_bytes_size);
+  if (result != TSI_OK) {
+    HandshakeFailedLocked(grpc_set_tsi_error_result(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-            "Zero-copy frame protector creation failed"),
-        result);
-    HandshakeFailedLocked(error);
+            "TSI handshaker result does not provide unused bytes"),
+        result));
+    return;
+  }
+  // Check whether we need to wrap the endpoint.
+  tsi_frame_protector_type frame_protector_type;
+  result = tsi_handshaker_result_get_frame_protector_type(
+      handshaker_result_, &frame_protector_type);
+  if (result != TSI_OK) {
+    HandshakeFailedLocked(grpc_set_tsi_error_result(
+        GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+            "TSI handshaker result does not implement "
+            "get_frame_protector_type"),
+        result));
     return;
   }
-  // Create frame protector if zero-copy frame protector is NULL.
+  tsi_zero_copy_grpc_protector* zero_copy_protector = nullptr;
   tsi_frame_protector* protector = nullptr;
-  if (zero_copy_protector == nullptr) {
-    result = tsi_handshaker_result_create_frame_protector(
-        handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
-        &protector);
-    if (result != TSI_OK) {
-      error = grpc_set_tsi_error_result(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-                                            "Frame protector creation failed"),
-                                        result);
-      HandshakeFailedLocked(error);
-      return;
-    }
+  switch (frame_protector_type) {
+    case TSI_FRAME_PROTECTOR_ZERO_COPY:
+      ABSL_FALLTHROUGH_INTENDED;
+    case TSI_FRAME_PROTECTOR_NORMAL_OR_ZERO_COPY:
+      // Create zero-copy frame protector.
+      result = tsi_handshaker_result_create_zero_copy_grpc_protector(
+          handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
+          &zero_copy_protector);
+      if (result != TSI_OK) {
+        HandshakeFailedLocked(grpc_set_tsi_error_result(
+            GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+                "Zero-copy frame protector creation failed"),
+            result));
+        return;
+      }
+      break;
+    case TSI_FRAME_PROTECTOR_NORMAL:
+      // Create normal frame protector.
+      result = tsi_handshaker_result_create_frame_protector(
+          handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
+          &protector);
+      if (result != TSI_OK) {
+        HandshakeFailedLocked(
+            grpc_set_tsi_error_result(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+                                          "Frame protector creation failed"),
+                                      result));
+        return;
+      }
+      break;
+    case TSI_FRAME_PROTECTOR_NONE:
+      break;
   }
-  // Get unused bytes.
-  const unsigned char* unused_bytes = nullptr;
-  size_t unused_bytes_size = 0;
-  result = tsi_handshaker_result_get_unused_bytes(
-      handshaker_result_, &unused_bytes, &unused_bytes_size);
-  // Create secure endpoint.
-  if (unused_bytes_size > 0) {
+  // If we have a frame protector, create a secure endpoint.
+  if (zero_copy_protector != nullptr || protector != nullptr) {
+    if (unused_bytes_size > 0) {
+      grpc_slice slice = grpc_slice_from_copied_buffer(
+          reinterpret_cast<const char*>(unused_bytes), unused_bytes_size);
+      args_->endpoint = grpc_secure_endpoint_create(
+          protector, zero_copy_protector, args_->endpoint, &slice, 1);
+      grpc_slice_unref_internal(slice);
+    } else {
+      args_->endpoint = grpc_secure_endpoint_create(
+          protector, zero_copy_protector, args_->endpoint, nullptr, 0);
+    }
+  } else if (unused_bytes_size > 0) {
+    // Not wrapping the endpoint, so just pass along unused bytes.
     grpc_slice slice = grpc_slice_from_copied_buffer(
         reinterpret_cast<const char*>(unused_bytes), unused_bytes_size);
-    args_->endpoint = grpc_secure_endpoint_create(
-        protector, zero_copy_protector, args_->endpoint, &slice, 1);
-    grpc_slice_unref_internal(slice);
-  } else {
-    args_->endpoint = grpc_secure_endpoint_create(
-        protector, zero_copy_protector, args_->endpoint, nullptr, 0);
+    grpc_slice_buffer_add(args_->read_buffer, slice);
   }
+  // Done with handshaker result.
   tsi_handshaker_result_destroy(handshaker_result_);
   handshaker_result_ = nullptr;
   // Add auth context to channel args.
@@ -409,7 +440,7 @@ grpc_error_handle SecurityHandshaker::DoHandshakerNextLocked(
 void SecurityHandshaker::OnHandshakeDataReceivedFromPeerFnScheduler(
     void* arg, grpc_error_handle error) {
   SecurityHandshaker* h = static_cast<SecurityHandshaker*>(arg);
-  grpc_core::ExecCtx::Run(
+  ExecCtx::Run(
       DEBUG_LOCATION,
       GRPC_CLOSURE_INIT(&h->on_handshake_data_received_from_peer_,
                         &SecurityHandshaker::OnHandshakeDataReceivedFromPeerFn,
@@ -430,7 +461,6 @@ void SecurityHandshaker::OnHandshakeDataReceivedFromPeerFn(
   size_t bytes_received_size = h->MoveReadBufferIntoHandshakeBuffer();
   // Call TSI handshaker.
   error = h->DoHandshakerNextLocked(h->handshake_buffer_, bytes_received_size);
-
   if (error != GRPC_ERROR_NONE) {
     h->HandshakeFailedLocked(error);
   } else {
@@ -443,7 +473,7 @@ void SecurityHandshaker::OnHandshakeDataReceivedFromPeerFn(
 void SecurityHandshaker::OnHandshakeDataSentToPeerFnScheduler(
     void* arg, grpc_error_handle error) {
   SecurityHandshaker* h = static_cast<SecurityHandshaker*>(arg);
-  grpc_core::ExecCtx::Run(
+  ExecCtx::Run(
       DEBUG_LOCATION,
       GRPC_CLOSURE_INIT(&h->on_handshake_data_sent_to_peer_,
                         &SecurityHandshaker::OnHandshakeDataSentToPeerFn, h,

data/src/core/lib/security/transport/server_auth_filter.cc

@@ -86,51 +86,55 @@ struct call_data {
   grpc_error_handle recv_trailing_metadata_error;
   bool seen_recv_trailing_metadata_ready = false;
   grpc_metadata_array md;
-  const grpc_metadata* consumed_md;
-  size_t num_consumed_md;
   grpc_closure cancel_closure;
   gpr_atm state = STATE_INIT;  // async_state
 };
 
+class ArrayEncoder {
+ public:
+  explicit ArrayEncoder(grpc_metadata_array* result) : result_(result) {}
+
+  void Encode(const grpc_core::Slice& key, const grpc_core::Slice& value) {
+    Append(key.Ref(), value.Ref());
+  }
+
+  template <typename Which>
+  void Encode(Which, const typename Which::ValueType& value) {
+    Append(grpc_core::Slice(
+               grpc_core::StaticSlice::FromStaticString(Which::key())),
+           grpc_core::Slice(Which::Encode(value)));
+  }
+
+  void Encode(grpc_core::HttpMethodMetadata,
+              const typename grpc_core::HttpMethodMetadata::ValueType&) {}
+
+ private:
+  void Append(grpc_core::Slice key, grpc_core::Slice value) {
+    if (result_->count == result_->capacity) {
+      result_->capacity =
+          std::max(result_->capacity + 8, result_->capacity * 2);
+      result_->metadata = static_cast<grpc_metadata*>(gpr_realloc(
+          result_->metadata, result_->capacity * sizeof(grpc_metadata)));
+    }
+    auto* usr_md = &result_->metadata[result_->count++];
+    usr_md->key = key.TakeCSlice();
+    usr_md->value = value.TakeCSlice();
+  }
+
+  grpc_metadata_array* result_;
+};
+
 }  // namespace
 
 static grpc_metadata_array metadata_batch_to_md_array(
     const grpc_metadata_batch* batch) {
-  grpc_linked_mdelem* l;
   grpc_metadata_array result;
   grpc_metadata_array_init(&result);
-  for (l = batch->list.head; l != nullptr; l = l->next) {
-    grpc_metadata* usr_md = nullptr;
-    grpc_mdelem md = l->md;
-    grpc_slice key = GRPC_MDKEY(md);
-    grpc_slice value = GRPC_MDVALUE(md);
-    if (result.count == result.capacity) {
-      result.capacity = GPR_MAX(result.capacity + 8, result.capacity * 2);
-      result.metadata = static_cast<grpc_metadata*>(gpr_realloc(
-          result.metadata, result.capacity * sizeof(grpc_metadata)));
-    }
-    usr_md = &result.metadata[result.count++];
-    usr_md->key = grpc_slice_ref_internal(key);
-    usr_md->value = grpc_slice_ref_internal(value);
-  }
+  ArrayEncoder encoder(&result);
+  batch->Encode(&encoder);
   return result;
 }
 
-static grpc_filtered_mdelem remove_consumed_md(void* user_data,
-                                               grpc_mdelem md) {
-  grpc_call_element* elem = static_cast<grpc_call_element*>(user_data);
-  call_data* calld = static_cast<call_data*>(elem->call_data);
-  size_t i;
-  for (i = 0; i < calld->num_consumed_md; i++) {
-    const grpc_metadata* consumed_md = &calld->consumed_md[i];
-    if (grpc_slice_eq(GRPC_MDKEY(md), consumed_md->key) &&
-        grpc_slice_eq(GRPC_MDVALUE(md), consumed_md->value)) {
-      return GRPC_FILTERED_REMOVE();
-    }
-  }
-  return GRPC_FILTERED_MDELEM(md);
-}
-
 static void on_md_processing_done_inner(grpc_call_element* elem,
                                         const grpc_metadata* consumed_md,
                                         size_t num_consumed_md,
@@ -146,11 +150,10 @@ static void on_md_processing_done_inner(grpc_call_element* elem,
             "Ignoring...");
   }
   if (error == GRPC_ERROR_NONE) {
-    calld->consumed_md = consumed_md;
-    calld->num_consumed_md = num_consumed_md;
-    error = grpc_metadata_batch_filter(
-        batch->payload->recv_initial_metadata.recv_initial_metadata,
-        remove_consumed_md, elem, "Response metadata filtering error");
+    for (size_t i = 0; i < num_consumed_md; i++) {
+      batch->payload->recv_initial_metadata.recv_initial_metadata->Remove(
+          grpc_core::StringViewFromSlice(consumed_md[i].key));
+    }
   }
   calld->recv_initial_metadata_error = GRPC_ERROR_REF(error);
   grpc_closure* closure = calld->original_recv_initial_metadata_ready;

data/src/core/lib/security/transport/tsi_error.cc

@@ -22,9 +22,7 @@
 
 grpc_error_handle grpc_set_tsi_error_result(grpc_error_handle error,
                                             tsi_result result) {
-  return grpc_error_set_int(
-      grpc_error_set_str(
-          error, GRPC_ERROR_STR_TSI_ERROR,
-          grpc_slice_from_static_string(tsi_result_to_string(result))),
-      GRPC_ERROR_INT_TSI_CODE, result);
+  return grpc_error_set_int(grpc_error_set_str(error, GRPC_ERROR_STR_TSI_ERROR,
+                                               tsi_result_to_string(result)),
+                            GRPC_ERROR_INT_TSI_CODE, result);
 }