grpc 1.42.0 → 1.46.3

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc

@@ -29,61 +29,6 @@
 
 #include "src/core/lib/surface/api_trace.h"
 
-/** -- gRPC TLS server authorization check API implementation. -- **/
-grpc_tls_server_authorization_check_config::
-    grpc_tls_server_authorization_check_config(
-        const void* config_user_data,
-        int (*schedule)(void* config_user_data,
-                        grpc_tls_server_authorization_check_arg* arg),
-        void (*cancel)(void* config_user_data,
-                       grpc_tls_server_authorization_check_arg* arg),
-        void (*destruct)(void* config_user_data))
-    : config_user_data_(const_cast<void*>(config_user_data)),
-      schedule_(schedule),
-      cancel_(cancel),
-      destruct_(destruct) {}
-
-grpc_tls_server_authorization_check_config::
-    ~grpc_tls_server_authorization_check_config() {
-  if (destruct_ != nullptr) {
-    destruct_(config_user_data_);
-  }
-}
-
-int grpc_tls_server_authorization_check_config::Schedule(
-    grpc_tls_server_authorization_check_arg* arg) const {
-  if (schedule_ == nullptr) {
-    gpr_log(GPR_ERROR, "schedule API is nullptr");
-    if (arg != nullptr) {
-      arg->status = GRPC_STATUS_NOT_FOUND;
-      arg->error_details->set_error_details(
-          "schedule API in server authorization check config is nullptr");
-    }
-    return 1;
-  }
-  if (arg != nullptr && context_ != nullptr) {
-    arg->config = const_cast<grpc_tls_server_authorization_check_config*>(this);
-  }
-  return schedule_(config_user_data_, arg);
-}
-
-void grpc_tls_server_authorization_check_config::Cancel(
-    grpc_tls_server_authorization_check_arg* arg) const {
-  if (cancel_ == nullptr) {
-    gpr_log(GPR_ERROR, "cancel API is nullptr.");
-    if (arg != nullptr) {
-      arg->status = GRPC_STATUS_NOT_FOUND;
-      arg->error_details->set_error_details(
-          "schedule API in server authorization check config is nullptr");
-    }
-    return;
-  }
-  if (arg != nullptr) {
-    arg->config = const_cast<grpc_tls_server_authorization_check_config*>(this);
-  }
-  cancel_(config_user_data_, arg);
-}
-
 /** -- Wrapper APIs declared in grpc_security.h -- **/
 
 grpc_tls_credentials_options* grpc_tls_credentials_options_create() {
@@ -98,11 +43,10 @@ void grpc_tls_credentials_options_set_cert_request_type(
   options->set_cert_request_type(type);
 }
 
-void grpc_tls_credentials_options_set_server_verification_option(
-    grpc_tls_credentials_options* options,
-    grpc_tls_server_verification_option server_verification_option) {
+void grpc_tls_credentials_options_set_verify_server_cert(
+    grpc_tls_credentials_options* options, int verify_server_cert) {
   GPR_ASSERT(options != nullptr);
-  options->set_server_verification_option(server_verification_option);
+  options->set_verify_server_cert(verify_server_cert);
 }
 
 void grpc_tls_credentials_options_set_certificate_provider(
@@ -139,39 +83,41 @@ void grpc_tls_credentials_options_set_identity_cert_name(
   options->set_identity_cert_name(identity_cert_name);
 }
 
-void grpc_tls_credentials_options_set_server_authorization_check_config(
+void grpc_tls_credentials_options_set_certificate_verifier(
     grpc_tls_credentials_options* options,
-    grpc_tls_server_authorization_check_config* config) {
+    grpc_tls_certificate_verifier* verifier) {
   GPR_ASSERT(options != nullptr);
-  GPR_ASSERT(config != nullptr);
-  grpc_core::ExecCtx exec_ctx;
-  options->set_server_authorization_check_config(config->Ref());
+  GPR_ASSERT(verifier != nullptr);
+  options->set_certificate_verifier(verifier->Ref());
 }
 
-grpc_tls_server_authorization_check_config*
-grpc_tls_server_authorization_check_config_create(
-    const void* config_user_data,
-    int (*schedule)(void* config_user_data,
-                    grpc_tls_server_authorization_check_arg* arg),
-    void (*cancel)(void* config_user_data,
-                   grpc_tls_server_authorization_check_arg* arg),
-    void (*destruct)(void* config_user_data)) {
-  if (schedule == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Schedule API is nullptr in creating TLS server authorization "
-            "check config.");
-    return nullptr;
-  }
-  grpc_core::ExecCtx exec_ctx;
-  return new grpc_tls_server_authorization_check_config(
-      config_user_data, schedule, cancel, destruct);
+void grpc_tls_credentials_options_set_crl_directory(
+    grpc_tls_credentials_options* options, const char* crl_directory) {
+  GPR_ASSERT(options != nullptr);
+  options->set_crl_directory(crl_directory);
+}
+
+void grpc_tls_credentials_options_set_check_call_host(
+    grpc_tls_credentials_options* options, int check_call_host) {
+  GPR_ASSERT(options != nullptr);
+  options->set_check_call_host(check_call_host);
 }
 
-void grpc_tls_server_authorization_check_config_release(
-    grpc_tls_server_authorization_check_config* config) {
+void grpc_tls_credentials_options_set_tls_session_key_log_file_path(
+    grpc_tls_credentials_options* options, const char* path) {
+  if (!tsi_tls_session_key_logging_supported() || options == nullptr) {
+    return;
+  }
   GRPC_API_TRACE(
-      "grpc_tls_server_authorization_check_config_release(config=%p)", 1,
-      (config));
-  grpc_core::ExecCtx exec_ctx;
-  if (config != nullptr) config->Unref();
+      "grpc_tls_credentials_options_set_tls_session_key_log_config(options=%p)",
+      1, (options));
+  // Tls session key logging is assumed to be enabled if the specified log
+  // file is non-empty.
+  if (path != nullptr) {
+    gpr_log(GPR_INFO,
+            "Enabling TLS session key logging with keys stored at: %s", path);
+  } else {
+    gpr_log(GPR_INFO, "Disabling TLS session key logging");
+  }
+  options->set_tls_session_key_log_file_path(path != nullptr ? path : "");
 }

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -1,20 +1,22 @@
-/*
- *
- * Copyright 2018 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
+//
+//
+// Copyright 2018 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+// Generated by tools/codegen/core/gen_grpc_tls_credentials_options.py
 
 #ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H
 #define GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H
@@ -28,73 +30,9 @@
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 
-struct grpc_tls_error_details
-    : public grpc_core::RefCounted<grpc_tls_error_details> {
- public:
-  grpc_tls_error_details() : error_details_("") {}
-  void set_error_details(const char* err_details) {
-    error_details_ = err_details;
-  }
-  const std::string& error_details() { return error_details_; }
-
- private:
-  std::string error_details_;
-};
-
-/** TLS server authorization check config. **/
-struct grpc_tls_server_authorization_check_config
-    : public grpc_core::RefCounted<grpc_tls_server_authorization_check_config> {
- public:
-  grpc_tls_server_authorization_check_config(
-      const void* config_user_data,
-      int (*schedule)(void* config_user_data,
-                      grpc_tls_server_authorization_check_arg* arg),
-      void (*cancel)(void* config_user_data,
-                     grpc_tls_server_authorization_check_arg* arg),
-      void (*destruct)(void* config_user_data));
-  ~grpc_tls_server_authorization_check_config() override;
-
-  void* context() const { return context_; }
-
-  void set_context(void* context) { context_ = context; }
-
-  int Schedule(grpc_tls_server_authorization_check_arg* arg) const;
-
-  void Cancel(grpc_tls_server_authorization_check_arg* arg) const;
-
- private:
-  /** This is a pointer to the wrapped language implementation of
-   * grpc_tls_server_authorization_check_config. It is necessary to implement
-   * the C schedule and cancel functions, given the schedule or cancel function
-   * in a wrapped language. **/
-  void* context_ = nullptr;
-  /** config-specific, read-only user data that works for all channels created
-     with a Credential using the config. */
-  void* config_user_data_;
-
-  /** callback function for invoking server authorization check. The
-     implementation of this method has to be non-blocking, but can be performed
-     synchronously or asynchronously.
-     If processing occurs synchronously, it populates \a arg->result, \a
-     arg->status, and \a arg->error_details, and returns zero.
-     If processing occurs asynchronously, it returns a non-zero value.
-     Application then invokes \a arg->cb when processing is completed. Note that
-     \a arg->cb cannot be invoked before \a schedule() returns.
-  */
-  int (*schedule_)(void* config_user_data,
-                   grpc_tls_server_authorization_check_arg* arg);
-
-  /** callback function for canceling a server authorization check request. */
-  void (*cancel_)(void* config_user_data,
-                  grpc_tls_server_authorization_check_arg* arg);
-
-  /** callback function for cleaning up any data associated with server
-     authorization check config. */
-  void (*destruct_)(void* config_user_data);
-};
-
 // Contains configurable options specified by callers to configure their certain
 // security features supported in TLS.
 // TODO(ZhenLian): consider making this not ref-counted.
@@ -104,90 +42,76 @@ struct grpc_tls_credentials_options
   ~grpc_tls_credentials_options() override = default;
 
   // Getters for member fields.
-  grpc_ssl_client_certificate_request_type cert_request_type() const {
-    return cert_request_type_;
-  }
-  grpc_tls_server_verification_option server_verification_option() const {
-    return server_verification_option_;
-  }
+  grpc_ssl_client_certificate_request_type cert_request_type() const { return cert_request_type_; }
+  bool verify_server_cert() const { return verify_server_cert_; }
   grpc_tls_version min_tls_version() const { return min_tls_version_; }
   grpc_tls_version max_tls_version() const { return max_tls_version_; }
-  grpc_tls_server_authorization_check_config*
-  server_authorization_check_config() const {
-    return server_authorization_check_config_.get();
+  grpc_tls_certificate_verifier* certificate_verifier() {
+    return certificate_verifier_.get();
   }
-  // Returns the distributor from provider_ if it is set, nullptr otherwise.
+  bool check_call_host() const { return check_call_host_; }
+  // Returns the distributor from certificate_provider_ if it is set, nullptr otherwise.
   grpc_tls_certificate_distributor* certificate_distributor() {
-    if (provider_ != nullptr) return provider_->distributor().get();
+    if (certificate_provider_ != nullptr) { return certificate_provider_->distributor().get(); }
     return nullptr;
   }
-  bool watch_root_cert() { return watch_root_cert_; }
-  const std::string& root_cert_name() { return root_cert_name_; }
-  bool watch_identity_pair() { return watch_identity_pair_; }
-  const std::string& identity_cert_name() { return identity_cert_name_; }
+  bool watch_root_cert() const { return watch_root_cert_; }
+  const std::string& root_cert_name() const { return root_cert_name_; }
+  bool watch_identity_pair() const { return watch_identity_pair_; }
+  const std::string& identity_cert_name() const { return identity_cert_name_; }
+  const std::string& tls_session_key_log_file_path() const { return tls_session_key_log_file_path_; }
+  const std::string& crl_directory() const { return crl_directory_; }
 
   // Setters for member fields.
-  void set_cert_request_type(
-      const grpc_ssl_client_certificate_request_type type) {
-    cert_request_type_ = type;
-  }
-  void set_server_verification_option(
-      const grpc_tls_server_verification_option server_verification_option) {
-    server_verification_option_ = server_verification_option;
-  }
-  void set_min_tls_version(grpc_tls_version min_tls_version) {
-    min_tls_version_ = min_tls_version;
-  }
-  void set_max_tls_version(grpc_tls_version max_tls_version) {
-    max_tls_version_ = max_tls_version;
-  }
-  void set_server_authorization_check_config(
-      grpc_core::RefCountedPtr<grpc_tls_server_authorization_check_config>
-          config) {
-    server_authorization_check_config_ = std::move(config);
-  }
-  // Sets the provider in the options.
-  void set_certificate_provider(
-      grpc_core::RefCountedPtr<grpc_tls_certificate_provider> provider) {
-    provider_ = std::move(provider);
-  }
-  // If need to watch the updates of root certificates with name
-  // |root_cert_name|. The default value is false. If used in tls_credentials,
-  // it should always be set to true unless the root certificates are not
-  // needed.
-  void set_watch_root_cert(bool watch) { watch_root_cert_ = watch; }
-  // Sets the name of root certificates being watched, if |set_watch_root_cert|
-  // is called. If not set, an empty string will be used as the name.
-  void set_root_cert_name(std::string root_cert_name) {
-    root_cert_name_ = std::move(root_cert_name);
-  }
-  // If need to watch the updates of identity certificates with name
-  // |identity_cert_name|.
-  // The default value is false.
-  // If used in tls_credentials, it should always be set to true
-  // unless the identity key-cert pairs are not needed.
-  void set_watch_identity_pair(bool watch) { watch_identity_pair_ = watch; }
-  // Sets the name of identity key-cert pairs being watched, if
-  // |set_watch_identity_pair| is called. If not set, an empty string will
-  // be used as the name.
-  void set_identity_cert_name(std::string identity_cert_name) {
-    identity_cert_name_ = std::move(identity_cert_name);
+  void set_cert_request_type(grpc_ssl_client_certificate_request_type cert_request_type) { cert_request_type_ = cert_request_type; }
+  void set_verify_server_cert(bool verify_server_cert) { verify_server_cert_ = verify_server_cert; }
+  void set_min_tls_version(grpc_tls_version min_tls_version) { min_tls_version_ = min_tls_version; }
+  void set_max_tls_version(grpc_tls_version max_tls_version) { max_tls_version_ = max_tls_version; }
+  void set_certificate_verifier(grpc_core::RefCountedPtr<grpc_tls_certificate_verifier> certificate_verifier) { certificate_verifier_ = std::move(certificate_verifier); }
+  void set_check_call_host(bool check_call_host) { check_call_host_ = check_call_host; }
+  void set_certificate_provider(grpc_core::RefCountedPtr<grpc_tls_certificate_provider> certificate_provider) { certificate_provider_ = std::move(certificate_provider); }
+  // If need to watch the updates of root certificates with name |root_cert_name|. The default value is false. If used in tls_credentials, it should always be set to true unless the root certificates are not needed.
+  void set_watch_root_cert(bool watch_root_cert) { watch_root_cert_ = watch_root_cert; }
+  // Sets the name of root certificates being watched, if |set_watch_root_cert| is called. If not set, an empty string will be used as the name.
+  void set_root_cert_name(std::string root_cert_name) { root_cert_name_ = std::move(root_cert_name); }
+  // If need to watch the updates of identity certificates with name |identity_cert_name|. The default value is false. If used in tls_credentials, it should always be set to true unless the identity key-cert pairs are not needed.
+  void set_watch_identity_pair(bool watch_identity_pair) { watch_identity_pair_ = watch_identity_pair; }
+  // Sets the name of identity key-cert pairs being watched, if |set_watch_identity_pair| is called. If not set, an empty string will be used as the name.
+  void set_identity_cert_name(std::string identity_cert_name) { identity_cert_name_ = std::move(identity_cert_name); }
+  void set_tls_session_key_log_file_path(std::string tls_session_key_log_file_path) { tls_session_key_log_file_path_ = std::move(tls_session_key_log_file_path); }
+  //  gRPC will enforce CRLs on all handshakes from all hashed CRL files inside of the crl_directory. If not set, an empty string will be used, which will not enable CRL checking. Only supported for OpenSSL version > 1.1.
+  void set_crl_directory(std::string crl_directory) { crl_directory_ = std::move(crl_directory); }
+
+  bool operator==(const grpc_tls_credentials_options& other) const {
+    return cert_request_type_ == other.cert_request_type_ &&
+      verify_server_cert_ == other.verify_server_cert_ &&
+      min_tls_version_ == other.min_tls_version_ &&
+      max_tls_version_ == other.max_tls_version_ &&
+      (certificate_verifier_ == other.certificate_verifier_ || (certificate_verifier_ != nullptr && other.certificate_verifier_ != nullptr && certificate_verifier_->Compare(other.certificate_verifier_.get()) == 0)) &&
+      check_call_host_ == other.check_call_host_ &&
+      (certificate_provider_ == other.certificate_provider_ || (certificate_provider_ != nullptr && other.certificate_provider_ != nullptr && certificate_provider_->Compare(other.certificate_provider_.get()) == 0)) &&
+      watch_root_cert_ == other.watch_root_cert_ &&
+      root_cert_name_ == other.root_cert_name_ &&
+      watch_identity_pair_ == other.watch_identity_pair_ &&
+      identity_cert_name_ == other.identity_cert_name_ &&
+      tls_session_key_log_file_path_ == other.tls_session_key_log_file_path_ &&
+      crl_directory_ == other.crl_directory_;
   }
 
  private:
-  grpc_ssl_client_certificate_request_type cert_request_type_ =
-      GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE;
-  grpc_tls_server_verification_option server_verification_option_ =
-      GRPC_TLS_SERVER_VERIFICATION;
+  grpc_ssl_client_certificate_request_type cert_request_type_ = GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE;
+  bool verify_server_cert_ = true;
   grpc_tls_version min_tls_version_ = grpc_tls_version::TLS1_2;
   grpc_tls_version max_tls_version_ = grpc_tls_version::TLS1_3;
-  grpc_core::RefCountedPtr<grpc_tls_server_authorization_check_config>
-      server_authorization_check_config_;
-  grpc_core::RefCountedPtr<grpc_tls_certificate_provider> provider_;
+  grpc_core::RefCountedPtr<grpc_tls_certificate_verifier> certificate_verifier_;
+  bool check_call_host_ = true;
+  grpc_core::RefCountedPtr<grpc_tls_certificate_provider> certificate_provider_;
   bool watch_root_cert_ = false;
   std::string root_cert_name_;
   bool watch_identity_pair_ = false;
   std::string identity_cert_name_;
+  std::string tls_session_key_log_file_path_;
+  std::string crl_directory_;
 };
 
 #endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H

data/src/core/lib/security/credentials/tls/tls_credentials.cc

@@ -28,29 +28,38 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h"
 #include "src/core/lib/security/security_connector/tls/tls_security_connector.h"
 
-#define GRPC_CREDENTIALS_TYPE_TLS "Tls"
-
 namespace {
 
-bool CredentialOptionSanityCheck(const grpc_tls_credentials_options* options,
+bool CredentialOptionSanityCheck(grpc_tls_credentials_options* options,
                                  bool is_client) {
   if (options == nullptr) {
     gpr_log(GPR_ERROR, "TLS credentials options is nullptr.");
     return false;
   }
-  // TODO(ZhenLian): remove this when it is also supported on server side.
-  if (!is_client && options->server_authorization_check_config() != nullptr) {
-    gpr_log(GPR_INFO,
-            "Server's credentials options should not contain server "
-            "authorization check config.");
+  // In the following conditions, there won't be any issues, but it might
+  // indicate callers are doing something wrong with the API.
+  if (is_client && options->cert_request_type() !=
+                       GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE) {
+    gpr_log(GPR_ERROR,
+            "Client's credentials options should not set cert_request_type.");
   }
-  if (options->server_verification_option() != GRPC_TLS_SERVER_VERIFICATION &&
-      options->server_authorization_check_config() == nullptr) {
+  if (!is_client && !options->verify_server_cert()) {
     gpr_log(GPR_ERROR,
-            "Should provider custom verifications if bypassing default ones.");
-    return false;
+            "Server's credentials options should not set verify_server_cert.");
+  }
+  // In the following conditions, there could be severe security issues.
+  if (is_client && options->certificate_verifier() == nullptr) {
+    // If no verifier is specified on the client side, use the hostname verifier
+    // as default. Users who want to bypass all the verifier check should
+    // implement an external verifier instead.
+    gpr_log(GPR_INFO,
+            "No verifier specified on the client side. Using default hostname "
+            "verifier");
+    options->set_certificate_verifier(
+        grpc_core::MakeRefCounted<grpc_core::HostNameCertificateVerifier>());
   }
   return true;
 }
@@ -59,8 +68,7 @@ bool CredentialOptionSanityCheck(const grpc_tls_credentials_options* options,
 
 TlsCredentials::TlsCredentials(
     grpc_core::RefCountedPtr<grpc_tls_credentials_options> options)
-    : grpc_channel_credentials(GRPC_CREDENTIALS_TYPE_TLS),
-      options_(std::move(options)) {}
+    : options_(std::move(options)) {}
 
 TlsCredentials::~TlsCredentials() {}
 
@@ -98,10 +106,16 @@ TlsCredentials::create_security_connector(
   return sc;
 }
 
+int TlsCredentials::cmp_impl(const grpc_channel_credentials* other) const {
+  const TlsCredentials* o = static_cast<const TlsCredentials*>(other);
+  if (*options_ == *o->options_) return 0;
+  return grpc_core::QsortCompare(
+      static_cast<const grpc_channel_credentials*>(this), other);
+}
+
 TlsServerCredentials::TlsServerCredentials(
     grpc_core::RefCountedPtr<grpc_tls_credentials_options> options)
-    : grpc_server_credentials(GRPC_CREDENTIALS_TYPE_TLS),
-      options_(std::move(options)) {}
+    : options_(std::move(options)) {}
 
 TlsServerCredentials::~TlsServerCredentials() {}
 

data/src/core/lib/security/credentials/tls/tls_credentials.h

@@ -38,9 +38,13 @@ class TlsCredentials final : public grpc_channel_credentials {
       const char* target_name, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
+  const char* type() const override { return "Tls"; }
+
   grpc_tls_credentials_options* options() const { return options_.get(); }
 
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override;
+
   grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
 };
 
@@ -53,6 +57,8 @@ class TlsServerCredentials final : public grpc_server_credentials {
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_channel_args* /* args */) override;
 
+  const char* type() const override { return "Tls"; }
+
   grpc_tls_credentials_options* options() const { return options_.get(); }
 
  private:

data/src/core/lib/security/credentials/xds/xds_credentials.cc

@@ -29,8 +29,6 @@
 
 namespace grpc_core {
 
-const char kCredentialsTypeXds[] = "Xds";
-
 namespace {
 
 bool XdsVerifySubjectAlternativeNames(
@@ -61,46 +59,53 @@ bool XdsVerifySubjectAlternativeNames(
   return false;
 }
 
-class ServerAuthCheck {
- public:
-  ServerAuthCheck(
-      RefCountedPtr<XdsCertificateProvider> xds_certificate_provider,
-      std::string cluster_name)
-      : xds_certificate_provider_(std::move(xds_certificate_provider)),
-        cluster_name_(std::move(cluster_name)) {}
-
-  static int Schedule(void* config_user_data,
-                      grpc_tls_server_authorization_check_arg* arg) {
-    return static_cast<ServerAuthCheck*>(config_user_data)->ScheduleImpl(arg);
-  }
+}  // namespace
 
-  static void Destroy(void* config_user_data) {
-    delete static_cast<ServerAuthCheck*>(config_user_data);
-  }
+//
+// XdsCertificateVerifier
+//
 
- private:
-  int ScheduleImpl(grpc_tls_server_authorization_check_arg* arg) {
-    if (XdsVerifySubjectAlternativeNames(
-            arg->subject_alternative_names, arg->subject_alternative_names_size,
-            xds_certificate_provider_->GetSanMatchers(cluster_name_))) {
-      arg->success = 1;
-      arg->status = GRPC_STATUS_OK;
-    } else {
-      arg->success = 0;
-      arg->status = GRPC_STATUS_UNAUTHENTICATED;
-      if (arg->error_details) {
-        arg->error_details->set_error_details(
-            "SANs from certificate did not match SANs from xDS control plane");
-      }
-    }
-    return 0; /* synchronous check */
+XdsCertificateVerifier::XdsCertificateVerifier(
+    RefCountedPtr<XdsCertificateProvider> xds_certificate_provider,
+    std::string cluster_name)
+    : xds_certificate_provider_(std::move(xds_certificate_provider)),
+      cluster_name_(std::move(cluster_name)) {}
+
+bool XdsCertificateVerifier::Verify(
+    grpc_tls_custom_verification_check_request* request,
+    std::function<void(absl::Status)>, absl::Status* sync_status) {
+  GPR_ASSERT(request != nullptr);
+  if (!XdsVerifySubjectAlternativeNames(
+          request->peer_info.san_names.uri_names,
+          request->peer_info.san_names.uri_names_size,
+          xds_certificate_provider_->GetSanMatchers(cluster_name_)) &&
+      !XdsVerifySubjectAlternativeNames(
+          request->peer_info.san_names.ip_names,
+          request->peer_info.san_names.ip_names_size,
+          xds_certificate_provider_->GetSanMatchers(cluster_name_)) &&
+      !XdsVerifySubjectAlternativeNames(
+          request->peer_info.san_names.dns_names,
+          request->peer_info.san_names.dns_names_size,
+          xds_certificate_provider_->GetSanMatchers(cluster_name_))) {
+    *sync_status = absl::Status(
+        absl::StatusCode::kUnauthenticated,
+        "SANs from certificate did not match SANs from xDS control plane");
   }
+  return true; /* synchronous check */
+}
 
-  RefCountedPtr<XdsCertificateProvider> xds_certificate_provider_;
-  std::string cluster_name_;
-};
+void XdsCertificateVerifier::Cancel(
+    grpc_tls_custom_verification_check_request*) {}
 
-}  // namespace
+int XdsCertificateVerifier::CompareImpl(
+    const grpc_tls_certificate_verifier* other) const {
+  auto* o = static_cast<const XdsCertificateVerifier*>(other);
+  int r = QsortCompare(xds_certificate_provider_, o->xds_certificate_provider_);
+  if (r != 0) return r;
+  return cluster_name_.compare(o->cluster_name_);
+}
+
+const char* XdsCertificateVerifier::type() const { return "Xds"; }
 
 bool TestOnlyXdsVerifySubjectAlternativeNames(
     const char* const* subject_alternative_names,
@@ -161,27 +166,11 @@ XdsCredentials::create_security_connector(
         tls_credentials_options->set_watch_identity_pair(true);
         tls_credentials_options->set_identity_cert_name(cluster_name);
       }
-      tls_credentials_options->set_server_verification_option(
-          GRPC_TLS_SKIP_HOSTNAME_VERIFICATION);
-      auto* server_auth_check = new ServerAuthCheck(xds_certificate_provider,
-                                                    std::move(cluster_name));
-      tls_credentials_options->set_server_authorization_check_config(
-          MakeRefCounted<grpc_tls_server_authorization_check_config>(
-              server_auth_check, ServerAuthCheck::Schedule, nullptr,
-              ServerAuthCheck::Destroy));
-      // TODO(yashkt): Creating a new TlsCreds object each time we create a
-      // security connector means that the security connector's cmp() method
-      // returns unequal for each instance, which means that every time an LB
-      // policy updates, all the subchannels will be recreated.  This is
-      // going to lead to a lot of connection churn.  Instead, we should
-      // either (a) change the TLS security connector's cmp() method to be
-      // smarter somehow, so that it compares unequal only when the
-      // tls_credentials_options have changed, or (b) cache the TlsCreds
-      // objects in the XdsCredentials object so that we can reuse the
-      // same one when creating new security connectors, swapping out the
-      // TlsCreds object only when the tls_credentials_options change.
-      // Option (a) would probably be better, although it may require some
-      // structural changes to the security connector API.
+      tls_credentials_options->set_verify_server_cert(true);
+      tls_credentials_options->set_certificate_verifier(
+          MakeRefCounted<XdsCertificateVerifier>(xds_certificate_provider,
+                                                 std::move(cluster_name)));
+      tls_credentials_options->set_check_call_host(false);
       auto tls_credentials =
           MakeRefCounted<TlsCredentials>(std::move(tls_credentials_options));
       return tls_credentials->create_security_connector(
@@ -193,6 +182,8 @@ XdsCredentials::create_security_connector(
       std::move(call_creds), target_name, temp_args.args, new_args);
 }
 
+const char* XdsCredentials::Type() { return "Xds"; }
+
 //
 // XdsServerCredentials
 //
@@ -229,6 +220,8 @@ XdsServerCredentials::create_security_connector(const grpc_channel_args* args) {
   return fallback_credentials_->create_security_connector(args);
 }
 
+const char* XdsServerCredentials::Type() { return "Xds"; }
+
 }  // namespace grpc_core
 
 grpc_channel_credentials* grpc_xds_credentials_create(