grpc 1.42.0 → 1.43.1

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -71,6 +71,8 @@ EvaluateArgs::PerChannelArgs::PerChannelArgs(grpc_auth_context* auth_context,
     dns_sans = GetAuthPropertyArray(auth_context, GRPC_PEER_DNS_PROPERTY_NAME);
     common_name =
         GetAuthPropertyValue(auth_context, GRPC_X509_CN_PROPERTY_NAME);
+    subject =
+        GetAuthPropertyValue(auth_context, GRPC_X509_SUBJECT_PROPERTY_NAME);
   }
   if (endpoint != nullptr) {
     local_address = ParseEndpointUri(grpc_endpoint_get_local_address(endpoint));
@@ -91,11 +93,10 @@ absl::string_view EvaluateArgs::GetPath() const {
 
 absl::string_view EvaluateArgs::GetHost() const {
   absl::string_view host;
-  if (metadata_ != nullptr &&
-      metadata_->legacy_index()->named.host != nullptr) {
-    grpc_linked_mdelem* elem = metadata_->legacy_index()->named.host;
-    const grpc_slice& val = GRPC_MDVALUE(elem->md);
-    host = StringViewFromSlice(val);
+  if (metadata_ != nullptr) {
+    if (auto* host_md = metadata_->get_pointer(HostMetadata())) {
+      host = host_md->as_string_view();
+    }
   }
   return host;
 }
@@ -111,20 +112,6 @@ absl::string_view EvaluateArgs::GetMethod() const {
   return method;
 }
 
-std::multimap<absl::string_view, absl::string_view> EvaluateArgs::GetHeaders()
-    const {
-  std::multimap<absl::string_view, absl::string_view> headers;
-  if (metadata_ == nullptr) {
-    return headers;
-  }
-  metadata_->ForEach([&](grpc_mdelem md) {
-    const grpc_slice& key = GRPC_MDKEY(md);
-    const grpc_slice& val = GRPC_MDVALUE(md);
-    headers.emplace(StringViewFromSlice(key), StringViewFromSlice(val));
-  });
-  return headers;
-}
-
 absl::optional<absl::string_view> EvaluateArgs::GetHeaderValue(
     absl::string_view key, std::string* concatenated_value) const {
   if (metadata_ == nullptr) {
@@ -210,4 +197,11 @@ absl::string_view EvaluateArgs::GetCommonName() const {
   return channel_args_->common_name;
 }
 
+absl::string_view EvaluateArgs::GetSubject() const {
+  if (channel_args_ == nullptr) {
+    return "";
+  }
+  return channel_args_->subject;
+}
+
 }  // namespace grpc_core

data/src/core/lib/security/authorization/evaluate_args.h

@@ -48,6 +48,7 @@ class EvaluateArgs {
     std::vector<absl::string_view> uri_sans;
     std::vector<absl::string_view> dns_sans;
     absl::string_view common_name;
+    absl::string_view subject;
     Address local_address;
     Address peer_address;
   };
@@ -58,7 +59,6 @@ class EvaluateArgs {
   absl::string_view GetPath() const;
   absl::string_view GetHost() const;
   absl::string_view GetMethod() const;
-  std::multimap<absl::string_view, absl::string_view> GetHeaders() const;
   // Returns metadata value(s) for the specified key.
   // If the key is not present in the batch, returns absl::nullopt.
   // If the key is present exactly once in the batch, returns a string_view of
@@ -80,6 +80,7 @@ class EvaluateArgs {
   std::vector<absl::string_view> GetUriSans() const;
   std::vector<absl::string_view> GetDnsSans() const;
   absl::string_view GetCommonName() const;
+  absl::string_view GetSubject() const;
 
  private:
   grpc_metadata_batch* metadata_;

data/src/core/lib/security/authorization/sdk_server_authz_filter.cc

@@ -96,11 +96,13 @@ bool SdkServerAuthzFilter::CallData::IsAuthorized(SdkServerAuthzFilter* chand) {
     gpr_log(
         GPR_DEBUG,
         "checking request: url_path=%s, transport_security_type=%s, "
-        "uri_sans=[%s], dns_sans=[%s], local_address=%s:%d, peer_address=%s:%d",
+        "uri_sans=[%s], dns_sans=[%s], subject=%s, local_address=%s:%d, "
+        "peer_address=%s:%d",
         std::string(args.GetPath()).c_str(),
         std::string(args.GetTransportSecurityType()).c_str(),
         absl::StrJoin(args.GetUriSans(), ",").c_str(),
         absl::StrJoin(args.GetDnsSans(), ",").c_str(),
+        std::string(args.GetSubject()).c_str(),
         std::string(args.GetLocalAddressString()).c_str(), args.GetLocalPort(),
         std::string(args.GetPeerAddressString()).c_str(), args.GetPeerPort());
   }

data/src/core/lib/security/credentials/external/aws_external_account_credentials.cc

@@ -166,13 +166,12 @@ void AwsExternalAccountCredentials::RetrieveRegion() {
   request.http.path = gpr_strdup(uri->path().c_str());
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRegion, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent,
+                   ResourceQuota::Default(), &request, ctx_->deadline,
+                   &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 
@@ -214,13 +213,13 @@ void AwsExternalAccountCredentials::RetrieveRoleName() {
   request.http.path = gpr_strdup(uri->path().c_str());
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRoleName, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  // TODO(ctiller): use the caller's resource quota.
+  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent,
+                   ResourceQuota::Default(), &request, ctx_->deadline,
+                   &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 
@@ -274,13 +273,13 @@ void AwsExternalAccountCredentials::RetrieveSigningKeys() {
   request.http.path = gpr_strdup(uri->path().c_str());
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveSigningKeys, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  // TODO(ctiller): use the caller's resource quota.
+  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent,
+                   ResourceQuota::Default(), &request, ctx_->deadline,
+                   &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 

data/src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -323,14 +323,13 @@ void ExternalAccountCredentials::ExchangeToken(
   body_parts.push_back(absl::StrFormat(
       "options=%s", UrlEncode(addtional_options_json.Dump()).c_str()));
   std::string body = absl::StrJoin(body_parts, "&");
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnExchangeToken, this, nullptr);
-  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                    &request, body.c_str(), body.size(), ctx_->deadline,
-                    &ctx_->closure, &ctx_->response);
+  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent,
+                    ResourceQuota::Default(), &request, body.c_str(),
+                    body.size(), ctx_->deadline, &ctx_->closure,
+                    &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 
@@ -409,14 +408,14 @@ void ExternalAccountCredentials::ImpersenateServiceAccount() {
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
   std::string scope = absl::StrJoin(scopes_, " ");
   std::string body = absl::StrFormat("scope=%s", scope);
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnImpersenateServiceAccount, this, nullptr);
-  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                    &request, body.c_str(), body.size(), ctx_->deadline,
-                    &ctx_->closure, &ctx_->response);
+  // TODO(ctiller): Use the callers resource quota.
+  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent,
+                    ResourceQuota::Default(), &request, body.c_str(),
+                    body.size(), ctx_->deadline, &ctx_->closure,
+                    &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 

data/src/core/lib/security/credentials/external/url_external_account_credentials.cc

@@ -139,13 +139,12 @@ void UrlExternalAccountCredentials::RetrieveSubjectToken(
   request.http.hdrs = headers;
   request.handshaker =
       url_.scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveSubjectToken, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent,
+                   ResourceQuota::Default(), &request, ctx_->deadline,
+                   &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -187,11 +187,9 @@ static int is_metadata_server_reachable() {
   request.host = const_cast<char*>(GRPC_COMPUTE_ENGINE_DETECTION_HOST);
   request.http.path = const_cast<char*>("/");
   grpc_httpcli_context_init(&context);
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("google_default_credentials");
   grpc_httpcli_get(
-      &context, &detector.pollent, resource_quota, &request,
-      grpc_core::ExecCtx::Get()->Now() + max_detection_delay,
+      &context, &detector.pollent, grpc_core::ResourceQuota::Default(),
+      &request, grpc_core::ExecCtx::Get()->Now() + max_detection_delay,
       GRPC_CLOSURE_CREATE(on_metadata_server_detection_http_response, &detector,
                           grpc_schedule_on_exec_ctx),
       &detector.response);
@@ -441,9 +439,9 @@ void set_gce_tenancy_checker_for_testing(grpc_gce_tenancy_checker checker) {
 }
 
 void grpc_flush_cached_google_default_credentials(void) {
-  grpc_core::ExecCtx exec_ctx;
+  ExecCtx exec_ctx;
   gpr_once_init(&g_once, init_default_credentials);
-  grpc_core::MutexLock lock(g_state_mu);
+  MutexLock lock(g_state_mu);
   g_metadata_server_available = 0;
 }
 

data/src/core/lib/security/credentials/jwt/jwt_credentials.cc

@@ -182,7 +182,7 @@ grpc_call_credentials* grpc_service_account_jwt_access_credentials_create(
 namespace grpc_core {
 
 absl::StatusOr<std::string> RemoveServiceNameFromJwtUri(absl::string_view uri) {
-  auto parsed = grpc_core::URI::Parse(uri);
+  auto parsed = URI::Parse(uri);
   if (!parsed.ok()) {
     return parsed.status();
   }

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -671,7 +671,6 @@ static void on_openid_config_retrieved(void* user_data,
   Json json = json_from_http(response);
   grpc_httpcli_request req;
   const char* jwks_uri;
-  grpc_resource_quota* resource_quota = nullptr;
   const Json* cur;
 
   /* TODO(jboeuf): Cache the jwks_uri in order to avoid this hop next time. */
@@ -700,9 +699,9 @@ static void on_openid_config_retrieved(void* user_data,
   /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
      channel. This would allow us to cancel an authentication query when under
      extreme memory pressure. */
-  resource_quota = grpc_resource_quota_create("jwt_verifier");
   grpc_httpcli_get(
-      &ctx->verifier->http_ctx, &ctx->pollent, resource_quota, &req,
+      &ctx->verifier->http_ctx, &ctx->pollent,
+      grpc_core::ResourceQuota::Default(), &req,
       grpc_core::ExecCtx::Get()->Now() + grpc_jwt_verifier_max_delay,
       GRPC_CLOSURE_CREATE(on_keys_retrieved, ctx, grpc_schedule_on_exec_ctx),
       &ctx->responses[HTTP_RESPONSE_KEYS]);
@@ -765,7 +764,6 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
   char* path_prefix = nullptr;
   const char* iss;
   grpc_httpcli_request req;
-  grpc_resource_quota* resource_quota = nullptr;
   memset(&req, 0, sizeof(grpc_httpcli_request));
   req.handshaker = &grpc_httpcli_ssl;
   http_response_index rsp_idx;
@@ -825,9 +823,9 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
   /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
      channel. This would allow us to cancel an authentication query when under
      extreme memory pressure. */
-  resource_quota = grpc_resource_quota_create("jwt_verifier");
   grpc_httpcli_get(
-      &ctx->verifier->http_ctx, &ctx->pollent, resource_quota, &req,
+      &ctx->verifier->http_ctx, &ctx->pollent,
+      grpc_core::ResourceQuota::Default(), &req,
       grpc_core::ExecCtx::Get()->Now() + grpc_jwt_verifier_max_delay, http_cb,
       &ctx->responses[rsp_idx]);
   gpr_free(req.host);

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -392,12 +392,11 @@ class grpc_compute_engine_token_fetcher_credentials
         const_cast<char*>(GRPC_COMPUTE_ENGINE_METADATA_TOKEN_PATH);
     request.http.hdr_count = 1;
     request.http.hdrs = &header;
-    /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
+    /* TODO(ctiller): Carry the memory quota in ctx and share it with the host
        channel. This would allow us to cancel an authentication query when under
        extreme memory pressure. */
-    grpc_resource_quota* resource_quota =
-        grpc_resource_quota_create("oauth2_credentials");
-    grpc_httpcli_get(http_context, pollent, resource_quota, &request, deadline,
+    grpc_httpcli_get(http_context, pollent, grpc_core::ResourceQuota::Default(),
+                     &request, deadline,
                      GRPC_CLOSURE_INIT(&http_get_cb_closure_, response_cb,
                                        metadata_req, grpc_schedule_on_exec_ctx),
                      &metadata_req->response);
@@ -451,13 +450,12 @@ void grpc_google_refresh_token_credentials::fetch_oauth2(
   request.http.hdr_count = 1;
   request.http.hdrs = &header;
   request.handshaker = &grpc_httpcli_ssl;
-  /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
+  /* TODO(ctiller): Carry the memory quota in ctx and share it with the host
      channel. This would allow us to cancel an authentication query when under
      extreme memory pressure. */
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("oauth2_credentials_refresh");
-  grpc_httpcli_post(httpcli_context, pollent, resource_quota, &request,
-                    body.c_str(), body.size(), deadline,
+  grpc_httpcli_post(httpcli_context, pollent,
+                    grpc_core::ResourceQuota::Default(), &request, body.c_str(),
+                    body.size(), deadline,
                     GRPC_CLOSURE_INIT(&http_post_cb_closure_, response_cb,
                                       metadata_req, grpc_schedule_on_exec_ctx),
                     &metadata_req->response);
@@ -582,14 +580,12 @@ class StsTokenFetcherCredentials
     request.handshaker = (sts_url_.scheme() == "https")
                              ? &grpc_httpcli_ssl
                              : &grpc_httpcli_plaintext;
-    /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
+    /* TODO(ctiller): Carry the memory quota in ctx and share it with the host
        channel. This would allow us to cancel an authentication query when under
        extreme memory pressure. */
-    grpc_resource_quota* resource_quota =
-        grpc_resource_quota_create("oauth2_credentials_refresh");
     grpc_httpcli_post(
-        http_context, pollent, resource_quota, &request, body, body_length,
-        deadline,
+        http_context, pollent, ResourceQuota::Default(), &request, body,
+        body_length, deadline,
         GRPC_CLOSURE_INIT(&http_post_cb_closure_, response_cb, metadata_req,
                           grpc_schedule_on_exec_ctx),
         &metadata_req->response);
@@ -640,14 +636,14 @@ class StsTokenFetcherCredentials
 
   URI sts_url_;
   grpc_closure http_post_cb_closure_;
-  grpc_core::UniquePtr<char> resource_;
-  grpc_core::UniquePtr<char> audience_;
-  grpc_core::UniquePtr<char> scope_;
-  grpc_core::UniquePtr<char> requested_token_type_;
-  grpc_core::UniquePtr<char> subject_token_path_;
-  grpc_core::UniquePtr<char> subject_token_type_;
-  grpc_core::UniquePtr<char> actor_token_path_;
-  grpc_core::UniquePtr<char> actor_token_type_;
+  UniquePtr<char> resource_;
+  UniquePtr<char> audience_;
+  UniquePtr<char> scope_;
+  UniquePtr<char> requested_token_type_;
+  UniquePtr<char> subject_token_path_;
+  UniquePtr<char> subject_token_type_;
+  UniquePtr<char> actor_token_path_;
+  UniquePtr<char> actor_token_type_;
 };
 
 }  // namespace

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc

@@ -31,17 +31,16 @@
 namespace grpc_core {
 
 StaticDataCertificateProvider::StaticDataCertificateProvider(
-    std::string root_certificate,
-    grpc_core::PemKeyCertPairList pem_key_cert_pairs)
+    std::string root_certificate, PemKeyCertPairList pem_key_cert_pairs)
     : distributor_(MakeRefCounted<grpc_tls_certificate_distributor>()),
       root_certificate_(std::move(root_certificate)),
       pem_key_cert_pairs_(std::move(pem_key_cert_pairs)) {
   distributor_->SetWatchStatusCallback([this](std::string cert_name,
                                               bool root_being_watched,
                                               bool identity_being_watched) {
-    grpc_core::MutexLock lock(&mu_);
+    MutexLock lock(&mu_);
     absl::optional<std::string> root_certificate;
-    absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs;
+    absl::optional<PemKeyCertPairList> pem_key_cert_pairs;
     StaticDataCertificateProvider::WatcherInfo& info = watcher_info_[cert_name];
     if (!info.root_being_watched && root_being_watched &&
         !root_certificate_.empty()) {
@@ -123,15 +122,15 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
       provider->ForceUpdate();
     }
   };
-  refresh_thread_ = grpc_core::Thread(
-      "FileWatcherCertificateProvider_refreshing_thread", thread_lambda, this);
+  refresh_thread_ = Thread("FileWatcherCertificateProvider_refreshing_thread",
+                           thread_lambda, this);
   refresh_thread_.Start();
   distributor_->SetWatchStatusCallback([this](std::string cert_name,
                                               bool root_being_watched,
                                               bool identity_being_watched) {
-    grpc_core::MutexLock lock(&mu_);
+    MutexLock lock(&mu_);
     absl::optional<std::string> root_certificate;
-    absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs;
+    absl::optional<PemKeyCertPairList> pem_key_cert_pairs;
     FileWatcherCertificateProvider::WatcherInfo& info =
         watcher_info_[cert_name];
     if (!info.root_being_watched && root_being_watched &&
@@ -180,7 +179,7 @@ FileWatcherCertificateProvider::~FileWatcherCertificateProvider() {
 
 void FileWatcherCertificateProvider::ForceUpdate() {
   absl::optional<std::string> root_certificate;
-  absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs;
+  absl::optional<PemKeyCertPairList> pem_key_cert_pairs;
   if (!root_cert_path_.empty()) {
     root_certificate = ReadRootCertificatesFromFile(root_cert_path_);
   }
@@ -188,7 +187,7 @@ void FileWatcherCertificateProvider::ForceUpdate() {
     pem_key_cert_pairs = ReadIdentityKeyCertPairFromFiles(
         private_key_path_, identity_certificate_path_);
   }
-  grpc_core::MutexLock lock(&mu_);
+  MutexLock lock(&mu_);
   const bool root_cert_changed =
       (!root_certificate.has_value() && !root_certificate_.empty()) ||
       (root_certificate.has_value() && root_certificate_ != *root_certificate);
@@ -221,7 +220,7 @@ void FileWatcherCertificateProvider::ForceUpdate() {
       const std::string& cert_name = p.first;
       const WatcherInfo& info = p.second;
       absl::optional<std::string> root_to_report;
-      absl::optional<grpc_core::PemKeyCertPairList> identity_to_report;
+      absl::optional<PemKeyCertPairList> identity_to_report;
       // Set key materials to the distributor if their contents changed.
       if (info.root_being_watched && !root_certificate_.empty() &&
           root_cert_changed) {
@@ -279,7 +278,7 @@ namespace {
 // it logs the error and returns 0.
 time_t GetModificationTime(const char* filename) {
   time_t ts = 0;
-  absl::Status status = grpc_core::GetFileModificationTime(filename, &ts);
+  absl::Status status = GetFileModificationTime(filename, &ts);
   return ts;
 }
 

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h

@@ -59,9 +59,8 @@ namespace grpc_core {
 class StaticDataCertificateProvider final
     : public grpc_tls_certificate_provider {
  public:
-  StaticDataCertificateProvider(
-      std::string root_certificate,
-      grpc_core::PemKeyCertPairList pem_key_cert_pairs);
+  StaticDataCertificateProvider(std::string root_certificate,
+                                PemKeyCertPairList pem_key_cert_pairs);
 
   ~StaticDataCertificateProvider() override;
 
@@ -76,9 +75,9 @@ class StaticDataCertificateProvider final
   };
   RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
   std::string root_certificate_;
-  grpc_core::PemKeyCertPairList pem_key_cert_pairs_;
+  PemKeyCertPairList pem_key_cert_pairs_;
   // Guards members below.
-  grpc_core::Mutex mu_;
+  Mutex mu_;
   // Stores each cert_name we get from the distributor callback and its watcher
   // information.
   std::map<std::string, WatcherInfo> watcher_info_;
@@ -122,15 +121,15 @@ class FileWatcherCertificateProvider final
   unsigned int refresh_interval_sec_ = 0;
 
   RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
-  grpc_core::Thread refresh_thread_;
+  Thread refresh_thread_;
   gpr_event shutdown_event_;
 
   // Guards members below.
-  grpc_core::Mutex mu_;
+  Mutex mu_;
   // The most-recent credential data. It will be empty if the most recent read
   // attempt failed.
   std::string root_certificate_ ABSL_GUARDED_BY(mu_);
-  grpc_core::PemKeyCertPairList pem_key_cert_pairs_ ABSL_GUARDED_BY(mu_);
+  PemKeyCertPairList pem_key_cert_pairs_ ABSL_GUARDED_BY(mu_);
   // Stores each cert_name we get from the distributor callback and its watcher
   // information.
   std::map<std::string, WatcherInfo> watcher_info_ ABSL_GUARDED_BY(mu_);