grpc 1.42.0 → 1.45.0

data/src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -23,6 +23,7 @@
 #include <stdbool.h>
 #include <string.h>
 
+#include "absl/functional/bind_front.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 
@@ -33,7 +34,7 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/gprpp/host_port.h"
-#include "src/core/lib/security/credentials/ssl/ssl_credentials.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/credentials/tls/tls_credentials.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
@@ -46,6 +47,155 @@ namespace grpc_core {
 
 namespace {
 
+char* CopyCoreString(char* src, size_t length) {
+  char* target = static_cast<char*>(gpr_malloc(length + 1));
+  memcpy(target, src, length);
+  target[length] = '\0';
+  return target;
+}
+
+void PendingVerifierRequestInit(
+    const char* target_name, tsi_peer peer,
+    grpc_tls_custom_verification_check_request* request) {
+  GPR_ASSERT(request != nullptr);
+  // The verifier holds a ref to the security connector, so it's fine to
+  // directly point this to the name cached in the security connector.
+  request->target_name = target_name;
+  // TODO(ZhenLian): avoid the copy when the underlying core implementation used
+  // the null-terminating string.
+  bool has_common_name = false;
+  bool has_peer_cert = false;
+  bool has_peer_cert_full_chain = false;
+  std::vector<char*> uri_names;
+  std::vector<char*> dns_names;
+  std::vector<char*> email_names;
+  std::vector<char*> ip_names;
+  for (size_t i = 0; i < peer.property_count; ++i) {
+    const tsi_peer_property* prop = &peer.properties[i];
+    if (prop->name == nullptr) continue;
+    if (strcmp(prop->name, TSI_X509_SUBJECT_COMMON_NAME_PEER_PROPERTY) == 0) {
+      request->peer_info.common_name =
+          CopyCoreString(prop->value.data, prop->value.length);
+      has_common_name = true;
+    } else if (strcmp(prop->name, TSI_X509_PEM_CERT_PROPERTY) == 0) {
+      request->peer_info.peer_cert =
+          CopyCoreString(prop->value.data, prop->value.length);
+      has_peer_cert = true;
+    } else if (strcmp(prop->name, TSI_X509_PEM_CERT_CHAIN_PROPERTY) == 0) {
+      request->peer_info.peer_cert_full_chain =
+          CopyCoreString(prop->value.data, prop->value.length);
+      has_peer_cert_full_chain = true;
+    } else if (strcmp(prop->name, TSI_X509_URI_PEER_PROPERTY) == 0) {
+      char* uri = CopyCoreString(prop->value.data, prop->value.length);
+      uri_names.emplace_back(uri);
+    } else if (strcmp(prop->name, TSI_X509_DNS_PEER_PROPERTY) == 0) {
+      char* dns = CopyCoreString(prop->value.data, prop->value.length);
+      dns_names.emplace_back(dns);
+    } else if (strcmp(prop->name, TSI_X509_EMAIL_PEER_PROPERTY) == 0) {
+      char* email = CopyCoreString(prop->value.data, prop->value.length);
+      email_names.emplace_back(email);
+    } else if (strcmp(prop->name, TSI_X509_IP_PEER_PROPERTY) == 0) {
+      char* ip = CopyCoreString(prop->value.data, prop->value.length);
+      ip_names.emplace_back(ip);
+    }
+  }
+  if (!has_common_name) {
+    request->peer_info.common_name = nullptr;
+  }
+  if (!has_peer_cert) {
+    request->peer_info.peer_cert = nullptr;
+  }
+  if (!has_peer_cert_full_chain) {
+    request->peer_info.peer_cert_full_chain = nullptr;
+  }
+  request->peer_info.san_names.uri_names_size = uri_names.size();
+  if (!uri_names.empty()) {
+    request->peer_info.san_names.uri_names =
+        new char*[request->peer_info.san_names.uri_names_size];
+    for (size_t i = 0; i < request->peer_info.san_names.uri_names_size; ++i) {
+      // We directly point the char* string stored in vector to the |request|.
+      // That string will be released when the |request| is destroyed.
+      request->peer_info.san_names.uri_names[i] = uri_names[i];
+    }
+  } else {
+    request->peer_info.san_names.uri_names = nullptr;
+  }
+  request->peer_info.san_names.dns_names_size = dns_names.size();
+  if (!dns_names.empty()) {
+    request->peer_info.san_names.dns_names =
+        new char*[request->peer_info.san_names.dns_names_size];
+    for (size_t i = 0; i < request->peer_info.san_names.dns_names_size; ++i) {
+      // We directly point the char* string stored in vector to the |request|.
+      // That string will be released when the |request| is destroyed.
+      request->peer_info.san_names.dns_names[i] = dns_names[i];
+    }
+  } else {
+    request->peer_info.san_names.dns_names = nullptr;
+  }
+  request->peer_info.san_names.email_names_size = email_names.size();
+  if (!email_names.empty()) {
+    request->peer_info.san_names.email_names =
+        new char*[request->peer_info.san_names.email_names_size];
+    for (size_t i = 0; i < request->peer_info.san_names.email_names_size; ++i) {
+      // We directly point the char* string stored in vector to the |request|.
+      // That string will be released when the |request| is destroyed.
+      request->peer_info.san_names.email_names[i] = email_names[i];
+    }
+  } else {
+    request->peer_info.san_names.email_names = nullptr;
+  }
+  request->peer_info.san_names.ip_names_size = ip_names.size();
+  if (!ip_names.empty()) {
+    request->peer_info.san_names.ip_names =
+        new char*[request->peer_info.san_names.ip_names_size];
+    for (size_t i = 0; i < request->peer_info.san_names.ip_names_size; ++i) {
+      // We directly point the char* string stored in vector to the |request|.
+      // That string will be released when the |request| is destroyed.
+      request->peer_info.san_names.ip_names[i] = ip_names[i];
+    }
+  } else {
+    request->peer_info.san_names.ip_names = nullptr;
+  }
+}
+
+void PendingVerifierRequestDestroy(
+    grpc_tls_custom_verification_check_request* request) {
+  GPR_ASSERT(request != nullptr);
+  if (request->peer_info.common_name != nullptr) {
+    gpr_free(const_cast<char*>(request->peer_info.common_name));
+  }
+  if (request->peer_info.san_names.uri_names_size > 0) {
+    for (size_t i = 0; i < request->peer_info.san_names.uri_names_size; ++i) {
+      gpr_free(request->peer_info.san_names.uri_names[i]);
+    }
+    delete[] request->peer_info.san_names.uri_names;
+  }
+  if (request->peer_info.san_names.dns_names_size > 0) {
+    for (size_t i = 0; i < request->peer_info.san_names.dns_names_size; ++i) {
+      gpr_free(request->peer_info.san_names.dns_names[i]);
+    }
+    delete[] request->peer_info.san_names.dns_names;
+  }
+  if (request->peer_info.san_names.email_names_size > 0) {
+    for (size_t i = 0; i < request->peer_info.san_names.email_names_size; ++i) {
+      gpr_free(request->peer_info.san_names.email_names[i]);
+    }
+    delete[] request->peer_info.san_names.email_names;
+  }
+  if (request->peer_info.san_names.ip_names_size > 0) {
+    for (size_t i = 0; i < request->peer_info.san_names.ip_names_size; ++i) {
+      gpr_free(request->peer_info.san_names.ip_names[i]);
+    }
+    delete[] request->peer_info.san_names.ip_names;
+  }
+  if (request->peer_info.peer_cert != nullptr) {
+    gpr_free(const_cast<char*>(request->peer_info.peer_cert));
+  }
+  if (request->peer_info.peer_cert_full_chain != nullptr) {
+    gpr_free(const_cast<char*>(request->peer_info.peer_cert_full_chain));
+  }
+}
+
 tsi_ssl_pem_key_cert_pair* ConvertToTsiPemKeyCertPair(
     const PemKeyCertPairList& cert_pair_list) {
   tsi_ssl_pem_key_cert_pair* tsi_pairs = nullptr;
@@ -113,10 +263,15 @@ TlsChannelSecurityConnector::TlsChannelSecurityConnector(
       overridden_target_name_(
           overridden_target_name == nullptr ? "" : overridden_target_name),
       ssl_session_cache_(ssl_session_cache) {
+  const std::string& tls_session_key_log_file_path =
+      options_->tls_session_key_log_file_path();
+  if (!tls_session_key_log_file_path.empty()) {
+    tls_session_key_logger_ =
+        tsi::TlsSessionKeyLoggerCache::Get(tls_session_key_log_file_path);
+  }
   if (ssl_session_cache_ != nullptr) {
     tsi_ssl_session_cache_ref(ssl_session_cache_);
   }
-  check_arg_ = ServerAuthorizationCheckArgCreate(this);
   absl::string_view host;
   absl::string_view port;
   SplitHostPort(target_name, &host, &port);
@@ -164,9 +319,6 @@ TlsChannelSecurityConnector::~TlsChannelSecurityConnector() {
   if (client_handshaker_factory_ != nullptr) {
     tsi_ssl_client_handshaker_factory_unref(client_handshaker_factory_);
   }
-  if (check_arg_ != nullptr) {
-    ServerAuthorizationCheckArgDestroy(check_arg_);
-  }
 }
 
 void TlsChannelSecurityConnector::add_handshakers(
@@ -205,126 +357,66 @@ void TlsChannelSecurityConnector::check_peer(
   }
   *auth_context =
       grpc_ssl_peer_to_auth_context(&peer, GRPC_TLS_TRANSPORT_SECURITY_TYPE);
-  if (options_->server_verification_option() == GRPC_TLS_SERVER_VERIFICATION) {
-    /* Do the default host name check if specifying the target name. */
-    error = internal::TlsCheckHostName(target_name, &peer);
-    if (error != GRPC_ERROR_NONE) {
-      ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
-      tsi_peer_destruct(&peer);
-      return;
-    }
+  GPR_ASSERT(options_->certificate_verifier() != nullptr);
+  auto* pending_request = new ChannelPendingVerifierRequest(
+      Ref(), on_peer_checked, peer, target_name);
+  {
+    MutexLock lock(&verifier_request_map_mu_);
+    pending_verifier_requests_.emplace(on_peer_checked, pending_request);
+  }
+  pending_request->Start();
+}
+
+void TlsChannelSecurityConnector::cancel_check_peer(
+    grpc_closure* on_peer_checked, grpc_error_handle error) {
+  if (error != GRPC_ERROR_NONE) {
+    gpr_log(GPR_ERROR,
+            "TlsChannelSecurityConnector::cancel_check_peer error: %s",
+            grpc_error_std_string(error).c_str());
+    GRPC_ERROR_UNREF(error);
+    return;
   }
-  /* Do the custom server authorization check, if specified by the user. */
-  const grpc_tls_server_authorization_check_config* config =
-      options_->server_authorization_check_config();
-  /* If server authorization config is not null, use it to perform
-   * server authorization check. */
-  if (config != nullptr) {
-    const tsi_peer_property* p =
-        tsi_peer_get_property_by_name(&peer, TSI_X509_PEM_CERT_PROPERTY);
-    if (p == nullptr) {
-      error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-          "Cannot check peer: missing pem cert property.");
-    } else {
-      char* peer_pem = static_cast<char*>(gpr_zalloc(p->value.length + 1));
-      memcpy(peer_pem, p->value.data, p->value.length);
-      GPR_ASSERT(check_arg_ != nullptr);
-      check_arg_->peer_cert = check_arg_->peer_cert == nullptr
-                                  ? gpr_strdup(peer_pem)
-                                  : check_arg_->peer_cert;
-      check_arg_->target_name = check_arg_->target_name == nullptr
-                                    ? gpr_strdup(target_name)
-                                    : check_arg_->target_name;
-      on_peer_checked_ = on_peer_checked;
-      gpr_free(peer_pem);
-      const tsi_peer_property* chain = tsi_peer_get_property_by_name(
-          &peer, TSI_X509_PEM_CERT_CHAIN_PROPERTY);
-      if (chain != nullptr) {
-        char* peer_pem_chain =
-            static_cast<char*>(gpr_zalloc(chain->value.length + 1));
-        memcpy(peer_pem_chain, chain->value.data, chain->value.length);
-        check_arg_->peer_cert_full_chain =
-            check_arg_->peer_cert_full_chain == nullptr
-                ? gpr_strdup(peer_pem_chain)
-                : check_arg_->peer_cert_full_chain;
-        gpr_free(peer_pem_chain);
-      }
-      // TODO(zhenlian) - This should be cleaned up as part of the custom
-      // verification changes. Fill in the subject alternative names
-      std::vector<char*> subject_alternative_names;
-      for (size_t i = 0; i < peer.property_count; i++) {
-        const tsi_peer_property* prop = &peer.properties[i];
-        if (strcmp(prop->name,
-                   TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY) == 0) {
-          char* san = new char[prop->value.length + 1];
-          memcpy(san, prop->value.data, prop->value.length);
-          san[prop->value.length] = '\0';
-          subject_alternative_names.emplace_back(san);
-        }
-      }
-      if (check_arg_->subject_alternative_names != nullptr) {
-        for (size_t i = 0; i < check_arg_->subject_alternative_names_size;
-             ++i) {
-          delete[] check_arg_->subject_alternative_names[i];
-        }
-        delete[] check_arg_->subject_alternative_names;
-      }
-      check_arg_->subject_alternative_names_size =
-          subject_alternative_names.size();
-      if (subject_alternative_names.empty()) {
-        check_arg_->subject_alternative_names = nullptr;
+  auto* verifier = options_->certificate_verifier();
+  if (verifier != nullptr) {
+    grpc_tls_custom_verification_check_request* pending_verifier_request =
+        nullptr;
+    {
+      MutexLock lock(&verifier_request_map_mu_);
+      auto it = pending_verifier_requests_.find(on_peer_checked);
+      if (it != pending_verifier_requests_.end()) {
+        pending_verifier_request = it->second->request();
       } else {
-        check_arg_->subject_alternative_names =
-            new char*[check_arg_->subject_alternative_names_size];
-        for (size_t i = 0; i < check_arg_->subject_alternative_names_size;
-             ++i) {
-          check_arg_->subject_alternative_names[i] =
-              subject_alternative_names[i];
-        }
-      }
-      int callback_status = config->Schedule(check_arg_);
-      /* Server authorization check is handled asynchronously. */
-      if (callback_status) {
-        tsi_peer_destruct(&peer);
-        return;
+        gpr_log(GPR_INFO,
+                "TlsChannelSecurityConnector::cancel_check_peer: no "
+                "corresponding pending request found");
       }
-      /* Server authorization check is handled synchronously. */
-      error = ProcessServerAuthorizationCheckResult(check_arg_);
+    }
+    if (pending_verifier_request != nullptr) {
+      verifier->Cancel(pending_verifier_request);
     }
   }
-  ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
-  tsi_peer_destruct(&peer);
 }
 
 int TlsChannelSecurityConnector::cmp(
     const grpc_security_connector* other_sc) const {
   auto* other = reinterpret_cast<const TlsChannelSecurityConnector*>(other_sc);
   int c = channel_security_connector_cmp(other);
-  if (c != 0) {
-    return c;
-  }
-  return grpc_ssl_cmp_target_name(
+  if (c != 0) return c;
+  c = grpc_ssl_cmp_target_name(
       target_name_.c_str(), other->target_name_.c_str(),
       overridden_target_name_.c_str(), other->overridden_target_name_.c_str());
+  if (c != 0) return c;
+  return 0;
 }
 
-bool TlsChannelSecurityConnector::check_call_host(
-    absl::string_view host, grpc_auth_context* auth_context,
-    grpc_closure* /*on_call_host_checked*/, grpc_error_handle* error) {
-  if (options_->server_verification_option() ==
-          GRPC_TLS_SKIP_HOSTNAME_VERIFICATION ||
-      options_->server_verification_option() ==
-          GRPC_TLS_SKIP_ALL_SERVER_VERIFICATION) {
-    return true;
+ArenaPromise<absl::Status> TlsChannelSecurityConnector::CheckCallHost(
+    absl::string_view host, grpc_auth_context* auth_context) {
+  if (options_->check_call_host()) {
+    return Immediate(SslCheckCallHost(host, target_name_.c_str(),
+                                      overridden_target_name_.c_str(),
+                                      auth_context));
   }
-  return grpc_ssl_check_call_host(host, target_name_.c_str(),
-                                  overridden_target_name_.c_str(), auth_context,
-                                  error);
-}
-
-void TlsChannelSecurityConnector::cancel_check_call_host(
-    grpc_closure* /*on_call_host_checked*/, grpc_error_handle error) {
-  GRPC_ERROR_UNREF(error);
+  return ImmediateOkStatus();
 }
 
 void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
@@ -369,13 +461,61 @@ void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::OnError(
   GRPC_ERROR_UNREF(identity_cert_error);
 }
 
+TlsChannelSecurityConnector::ChannelPendingVerifierRequest::
+    ChannelPendingVerifierRequest(
+        RefCountedPtr<TlsChannelSecurityConnector> security_connector,
+        grpc_closure* on_peer_checked, tsi_peer peer, const char* target_name)
+    : security_connector_(std::move(security_connector)),
+      on_peer_checked_(on_peer_checked) {
+  PendingVerifierRequestInit(target_name, peer, &request_);
+  tsi_peer_destruct(&peer);
+}
+
+TlsChannelSecurityConnector::ChannelPendingVerifierRequest::
+    ~ChannelPendingVerifierRequest() {
+  PendingVerifierRequestDestroy(&request_);
+}
+
+void TlsChannelSecurityConnector::ChannelPendingVerifierRequest::Start() {
+  absl::Status sync_status;
+  grpc_tls_certificate_verifier* verifier =
+      security_connector_->options_->certificate_verifier();
+  bool is_done = verifier->Verify(
+      &request_,
+      absl::bind_front(&ChannelPendingVerifierRequest::OnVerifyDone, this,
+                       true),
+      &sync_status);
+  if (is_done) {
+    OnVerifyDone(false, sync_status);
+  }
+}
+
+void TlsChannelSecurityConnector::ChannelPendingVerifierRequest::OnVerifyDone(
+    bool run_callback_inline, absl::Status status) {
+  {
+    MutexLock lock(&security_connector_->verifier_request_map_mu_);
+    security_connector_->pending_verifier_requests_.erase(on_peer_checked_);
+  }
+  grpc_error_handle error = GRPC_ERROR_NONE;
+  if (!status.ok()) {
+    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("Custom verification check failed with error: ",
+                     status.ToString())
+            .c_str());
+  }
+  if (run_callback_inline) {
+    Closure::Run(DEBUG_LOCATION, on_peer_checked_, error);
+  } else {
+    ExecCtx::Run(DEBUG_LOCATION, on_peer_checked_, error);
+  }
+  delete this;
+}
+
 // TODO(ZhenLian): implement the logic to signal waiting handshakers once
 // BlockOnInitialCredentialHandshaker is implemented.
 grpc_security_status
 TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
-  bool skip_server_certificate_verification =
-      options_->server_verification_option() ==
-      GRPC_TLS_SKIP_ALL_SERVER_VERIFICATION;
+  bool skip_server_certificate_verification = !options_->verify_server_cert();
   /* Free the client handshaker factory if exists. */
   if (client_handshaker_factory_ != nullptr) {
     tsi_ssl_client_handshaker_factory_unref(client_handshaker_factory_);
@@ -398,6 +538,7 @@ TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
       skip_server_certificate_verification,
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()), ssl_session_cache_,
+      tls_session_key_logger_.get(), options_->crl_directory().c_str(),
       &client_handshaker_factory_);
   /* Free memory. */
   if (pem_key_cert_pair != nullptr) {
@@ -406,79 +547,6 @@ TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
   return status;
 }
 
-void TlsChannelSecurityConnector::ServerAuthorizationCheckDone(
-    grpc_tls_server_authorization_check_arg* arg) {
-  GPR_ASSERT(arg != nullptr);
-  ExecCtx exec_ctx;
-  grpc_error_handle error = ProcessServerAuthorizationCheckResult(arg);
-  TlsChannelSecurityConnector* connector =
-      static_cast<TlsChannelSecurityConnector*>(arg->cb_user_data);
-  ExecCtx::Run(DEBUG_LOCATION, connector->on_peer_checked_, error);
-}
-
-grpc_error_handle
-TlsChannelSecurityConnector::ProcessServerAuthorizationCheckResult(
-    grpc_tls_server_authorization_check_arg* arg) {
-  grpc_error_handle error = GRPC_ERROR_NONE;
-  /* Server authorization check is cancelled by caller. */
-  if (arg->status == GRPC_STATUS_CANCELLED) {
-    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
-        absl::StrCat("Server authorization check is cancelled by the caller "
-                     "with error: ",
-                     arg->error_details->error_details()));
-  } else if (arg->status == GRPC_STATUS_OK) {
-    /* Server authorization check completed successfully but returned check
-     * failure. */
-    if (!arg->success) {
-      error = GRPC_ERROR_CREATE_FROM_CPP_STRING(
-          absl::StrCat("Server authorization check failed with error: ",
-                       arg->error_details->error_details()));
-    }
-    /* Server authorization check did not complete correctly. */
-  } else {
-    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
-        "Server authorization check did not finish correctly with error: ",
-        arg->error_details->error_details()));
-  }
-  return error;
-}
-
-grpc_tls_server_authorization_check_arg*
-TlsChannelSecurityConnector::ServerAuthorizationCheckArgCreate(
-    void* user_data) {
-  grpc_tls_server_authorization_check_arg* arg =
-      new grpc_tls_server_authorization_check_arg();
-  arg->target_name = nullptr;
-  arg->peer_cert = nullptr;
-  arg->peer_cert_full_chain = nullptr;
-  arg->subject_alternative_names = nullptr;
-  arg->subject_alternative_names_size = 0;
-  arg->error_details = new grpc_tls_error_details();
-  arg->cb = ServerAuthorizationCheckDone;
-  arg->cb_user_data = user_data;
-  arg->status = GRPC_STATUS_OK;
-  return arg;
-}
-
-void TlsChannelSecurityConnector::ServerAuthorizationCheckArgDestroy(
-    grpc_tls_server_authorization_check_arg* arg) {
-  if (arg == nullptr) {
-    return;
-  }
-  gpr_free(const_cast<char*>(arg->target_name));
-  gpr_free(const_cast<char*>(arg->peer_cert));
-  gpr_free(const_cast<char*>(arg->peer_cert_full_chain));
-  for (size_t i = 0; i < arg->subject_alternative_names_size; ++i) {
-    delete[] arg->subject_alternative_names[i];
-  }
-  delete[] arg->subject_alternative_names;
-  delete arg->error_details;
-  if (arg->destroy_context != nullptr) {
-    arg->destroy_context(arg->context);
-  }
-  delete arg;
-}
-
 // -------------------server security connector-------------------
 RefCountedPtr<grpc_server_security_connector>
 TlsServerSecurityConnector::CreateTlsServerSecurityConnector(
@@ -506,6 +574,12 @@ TlsServerSecurityConnector::TlsServerSecurityConnector(
     : grpc_server_security_connector(GRPC_SSL_URL_SCHEME,
                                      std::move(server_creds)),
       options_(std::move(options)) {
+  const std::string& tls_session_key_log_file_path =
+      options_->tls_session_key_log_file_path();
+  if (!tls_session_key_log_file_path.empty()) {
+    tls_session_key_logger_ =
+        tsi::TlsSessionKeyLoggerCache::Get(tls_session_key_log_file_path);
+  }
   // Create a watcher.
   auto watcher_ptr = absl::make_unique<TlsServerCertificateWatcher>(this);
   certificate_watcher_ = watcher_ptr.get();
@@ -559,16 +633,63 @@ void TlsServerSecurityConnector::check_peer(
     RefCountedPtr<grpc_auth_context>* auth_context,
     grpc_closure* on_peer_checked) {
   grpc_error_handle error = grpc_ssl_check_alpn(&peer);
+  if (error != GRPC_ERROR_NONE) {
+    ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
+    tsi_peer_destruct(&peer);
+    return;
+  }
   *auth_context =
       grpc_ssl_peer_to_auth_context(&peer, GRPC_TLS_TRANSPORT_SECURITY_TYPE);
-  tsi_peer_destruct(&peer);
-  ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
+  if (options_->certificate_verifier() != nullptr) {
+    auto* pending_request =
+        new ServerPendingVerifierRequest(Ref(), on_peer_checked, peer);
+    {
+      MutexLock lock(&verifier_request_map_mu_);
+      pending_verifier_requests_.emplace(on_peer_checked, pending_request);
+    }
+    pending_request->Start();
+  } else {
+    tsi_peer_destruct(&peer);
+    ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
+  }
+}
+
+void TlsServerSecurityConnector::cancel_check_peer(
+    grpc_closure* on_peer_checked, grpc_error_handle error) {
+  if (error != GRPC_ERROR_NONE) {
+    gpr_log(GPR_ERROR,
+            "TlsServerSecurityConnector::cancel_check_peer error: %s",
+            grpc_error_std_string(error).c_str());
+    GRPC_ERROR_UNREF(error);
+    return;
+  }
+  auto* verifier = options_->certificate_verifier();
+  if (verifier != nullptr) {
+    grpc_tls_custom_verification_check_request* pending_verifier_request =
+        nullptr;
+    {
+      MutexLock lock(&verifier_request_map_mu_);
+      auto it = pending_verifier_requests_.find(on_peer_checked);
+      if (it != pending_verifier_requests_.end()) {
+        pending_verifier_request = it->second->request();
+      } else {
+        gpr_log(GPR_INFO,
+                "TlsServerSecurityConnector::cancel_check_peer: no "
+                "corresponding pending request found");
+      }
+    }
+    if (pending_verifier_request != nullptr) {
+      verifier->Cancel(pending_verifier_request);
+    }
+  }
 }
 
 int TlsServerSecurityConnector::cmp(
-    const grpc_security_connector* other) const {
-  return server_security_connector_cmp(
-      static_cast<const grpc_server_security_connector*>(other));
+    const grpc_security_connector* other_sc) const {
+  auto* other = reinterpret_cast<const TlsServerSecurityConnector*>(other_sc);
+  int c = server_security_connector_cmp(other);
+  if (c != 0) return c;
+  return 0;
 }
 
 void TlsServerSecurityConnector::TlsServerCertificateWatcher::
@@ -617,6 +738,55 @@ void TlsServerSecurityConnector::TlsServerCertificateWatcher::OnError(
   GRPC_ERROR_UNREF(identity_cert_error);
 }
 
+TlsServerSecurityConnector::ServerPendingVerifierRequest::
+    ServerPendingVerifierRequest(
+        RefCountedPtr<TlsServerSecurityConnector> security_connector,
+        grpc_closure* on_peer_checked, tsi_peer peer)
+    : security_connector_(std::move(security_connector)),
+      on_peer_checked_(on_peer_checked) {
+  PendingVerifierRequestInit(nullptr, peer, &request_);
+  tsi_peer_destruct(&peer);
+}
+
+TlsServerSecurityConnector::ServerPendingVerifierRequest::
+    ~ServerPendingVerifierRequest() {
+  PendingVerifierRequestDestroy(&request_);
+}
+
+void TlsServerSecurityConnector::ServerPendingVerifierRequest::Start() {
+  absl::Status sync_status;
+  grpc_tls_certificate_verifier* verifier =
+      security_connector_->options_->certificate_verifier();
+  bool is_done = verifier->Verify(
+      &request_,
+      absl::bind_front(&ServerPendingVerifierRequest::OnVerifyDone, this, true),
+      &sync_status);
+  if (is_done) {
+    OnVerifyDone(false, sync_status);
+  }
+}
+
+void TlsServerSecurityConnector::ServerPendingVerifierRequest::OnVerifyDone(
+    bool run_callback_inline, absl::Status status) {
+  {
+    MutexLock lock(&security_connector_->verifier_request_map_mu_);
+    security_connector_->pending_verifier_requests_.erase(on_peer_checked_);
+  }
+  grpc_error_handle error = GRPC_ERROR_NONE;
+  if (!status.ok()) {
+    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("Custom verification check failed with error: ",
+                     status.ToString())
+            .c_str());
+  }
+  if (run_callback_inline) {
+    Closure::Run(DEBUG_LOCATION, on_peer_checked_, error);
+  } else {
+    ExecCtx::Run(DEBUG_LOCATION, on_peer_checked_, error);
+  }
+  delete this;
+}
+
 // TODO(ZhenLian): implement the logic to signal waiting handshakers once
 // BlockOnInitialCredentialHandshaker is implemented.
 grpc_security_status
@@ -643,6 +813,7 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
       options_->cert_request_type(),
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()),
+      tls_session_key_logger_.get(), options_->crl_directory().c_str(),
       &server_handshaker_factory_);
   /* Free memory. */
   grpc_tsi_ssl_pem_key_cert_pairs_destroy(pem_key_cert_pairs,
@@ -650,18 +821,4 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
   return status;
 }
 
-namespace internal {
-
-grpc_error_handle TlsCheckHostName(const char* peer_name,
-                                   const tsi_peer* peer) {
-  /* Check the peer name if specified. */
-  if (peer_name != nullptr && !grpc_ssl_host_matches_name(peer, peer_name)) {
-    return GRPC_ERROR_CREATE_FROM_CPP_STRING(
-        absl::StrCat("Peer name ", peer_name, " is not in peer certificate"));
-  }
-  return GRPC_ERROR_NONE;
-}
-
-}  // namespace internal
-
 }  // namespace grpc_core