grpc 1.43.1 → 1.46.2

data/src/core/lib/security/credentials/insecure/insecure_credentials.cc

@@ -18,45 +18,44 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/grpc_security.h>
+#include "src/core/lib/security/credentials/insecure/insecure_credentials.h"
 
-#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h"
 
 namespace grpc_core {
-namespace {
 
-constexpr char kCredentialsTypeInsecure[] = "insecure";
+RefCountedPtr<grpc_channel_security_connector>
+InsecureCredentials::create_security_connector(
+    RefCountedPtr<grpc_call_credentials> request_metadata_creds,
+    const char* /* target_name */, const grpc_channel_args* /* args */,
+    grpc_channel_args** /* new_args */) {
+  return MakeRefCounted<InsecureChannelSecurityConnector>(
+      Ref(), std::move(request_metadata_creds));
+}
 
-class InsecureCredentials final : public grpc_channel_credentials {
- public:
-  InsecureCredentials() : grpc_channel_credentials(kCredentialsTypeInsecure) {}
+const char* InsecureCredentials::Type() { return "Insecure"; }
 
-  RefCountedPtr<grpc_channel_security_connector> create_security_connector(
-      RefCountedPtr<grpc_call_credentials> call_creds,
-      const char* /* target_name */, const grpc_channel_args* /* args */,
-      grpc_channel_args** /* new_args */) override {
-    return MakeRefCounted<InsecureChannelSecurityConnector>(
-        Ref(), std::move(call_creds));
-  }
-};
+int InsecureCredentials::cmp_impl(
+    const grpc_channel_credentials* /* other */) const {
+  // All insecure credentials objects should compare equal.
+  return 0;
+}
 
-class InsecureServerCredentials final : public grpc_server_credentials {
- public:
-  InsecureServerCredentials()
-      : grpc_server_credentials(kCredentialsTypeInsecure) {}
+RefCountedPtr<grpc_server_security_connector>
+InsecureServerCredentials::create_security_connector(
+    const grpc_channel_args* /* args */) {
+  return MakeRefCounted<InsecureServerSecurityConnector>(Ref());
+}
 
-  RefCountedPtr<grpc_server_security_connector> create_security_connector(
-      const grpc_channel_args* /* args */) override {
-    return MakeRefCounted<InsecureServerSecurityConnector>(Ref());
-  }
-};
+const char* InsecureServerCredentials::Type() { return "Insecure"; }
 
-}  // namespace
 }  // namespace grpc_core
 
 grpc_channel_credentials* grpc_insecure_credentials_create() {
-  return new grpc_core::InsecureCredentials();
+  // Create a singleton object for InsecureCredentials so that channels to the
+  // same target with InsecureCredentials can reuse the subchannels.
+  static auto* creds = new grpc_core::InsecureCredentials();
+  return creds->Ref().release();
 }
 
 grpc_server_credentials* grpc_insecure_server_credentials_create() {

data/src/core/lib/security/credentials/insecure/insecure_credentials.h

@@ -0,0 +1,57 @@
+//
+//
+// Copyright 2022 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/security/credentials/credentials.h"
+
+namespace grpc_core {
+
+class InsecureCredentials final : public grpc_channel_credentials {
+ public:
+  RefCountedPtr<grpc_channel_security_connector> create_security_connector(
+      RefCountedPtr<grpc_call_credentials> request_metadata_creds,
+      const char* /* target_name */, const grpc_channel_args* /* args */,
+      grpc_channel_args** /* new_args */) override;
+
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
+ private:
+  int cmp_impl(const grpc_channel_credentials* other) const override;
+};
+
+class InsecureServerCredentials final : public grpc_server_credentials {
+ public:
+  RefCountedPtr<grpc_server_security_connector> create_security_connector(
+      const grpc_channel_args* /* args */) override;
+
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H

data/src/core/lib/security/credentials/jwt/json_token.cc

@@ -22,6 +22,10 @@
 
 #include <string.h>
 
+#include <openssl/bio.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -33,12 +37,6 @@
 #include "src/core/lib/security/util/json_util.h"
 #include "src/core/lib/slice/b64.h"
 
-extern "C" {
-#include <openssl/bio.h>
-#include <openssl/evp.h>
-#include <openssl/pem.h>
-}
-
 using grpc_core::Json;
 
 /* --- Constants. --- */

data/src/core/lib/security/credentials/jwt/jwt_credentials.cc

@@ -34,6 +34,8 @@
 
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/promise/promise.h"
+#include "src/core/lib/security/credentials/call_creds_util.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/transport/error_utils.h"
@@ -41,87 +43,70 @@
 
 using grpc_core::Json;
 
-void grpc_service_account_jwt_access_credentials::reset_cache() {
-  GRPC_MDELEM_UNREF(cached_.jwt_md);
-  cached_.jwt_md = GRPC_MDNULL;
-  cached_.service_url.clear();
-  cached_.jwt_expiration = gpr_inf_past(GPR_CLOCK_REALTIME);
-}
-
 grpc_service_account_jwt_access_credentials::
     ~grpc_service_account_jwt_access_credentials() {
   grpc_auth_json_key_destruct(&key_);
-  reset_cache();
   gpr_mu_destroy(&cache_mu_);
 }
 
-bool grpc_service_account_jwt_access_credentials::get_request_metadata(
-    grpc_polling_entity* /*pollent*/, grpc_auth_metadata_context context,
-    grpc_credentials_mdelem_array* md_array,
-    grpc_closure* /*on_request_metadata*/, grpc_error_handle* error) {
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+grpc_service_account_jwt_access_credentials::GetRequestMetadata(
+    grpc_core::ClientMetadataHandle initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs* args) {
   gpr_timespec refresh_threshold = gpr_time_from_seconds(
       GRPC_SECURE_TOKEN_REFRESH_THRESHOLD_SECS, GPR_TIMESPAN);
 
   // Remove service name from service_url to follow the audience format
   // dictated in https://google.aip.dev/auth/4111.
-  absl::StatusOr<std::string> uri =
-      grpc_core::RemoveServiceNameFromJwtUri(context.service_url);
+  absl::StatusOr<std::string> uri = grpc_core::RemoveServiceNameFromJwtUri(
+      grpc_core::MakeJwtServiceUrl(initial_metadata, args));
   if (!uri.ok()) {
-    *error = absl_status_to_grpc_error(uri.status());
-    return true;
+    return grpc_core::Immediate(uri.status());
   }
-  /* See if we can return a cached jwt. */
-  grpc_mdelem jwt_md = GRPC_MDNULL;
+  // See if we can return a cached jwt.
+  absl::optional<grpc_core::Slice> jwt_value;
   {
     gpr_mu_lock(&cache_mu_);
-    if (!cached_.service_url.empty() && cached_.service_url == *uri &&
-        !GRPC_MDISNULL(cached_.jwt_md) &&
+    if (cached_.has_value() && cached_->service_url == *uri &&
         (gpr_time_cmp(
-             gpr_time_sub(cached_.jwt_expiration, gpr_now(GPR_CLOCK_REALTIME)),
+             gpr_time_sub(cached_->jwt_expiration, gpr_now(GPR_CLOCK_REALTIME)),
              refresh_threshold) > 0)) {
-      jwt_md = GRPC_MDELEM_REF(cached_.jwt_md);
+      jwt_value = cached_->jwt_value.Ref();
     }
     gpr_mu_unlock(&cache_mu_);
   }
 
-  if (GRPC_MDISNULL(jwt_md)) {
+  if (!jwt_value.has_value()) {
     char* jwt = nullptr;
-    /* Generate a new jwt. */
+    // Generate a new jwt.
     gpr_mu_lock(&cache_mu_);
-    reset_cache();
+    cached_.reset();
     jwt = grpc_jwt_encode_and_sign(&key_, uri->c_str(), jwt_lifetime_, nullptr);
     if (jwt != nullptr) {
       std::string md_value = absl::StrCat("Bearer ", jwt);
       gpr_free(jwt);
-      cached_.jwt_expiration =
-          gpr_time_add(gpr_now(GPR_CLOCK_REALTIME), jwt_lifetime_);
-      cached_.service_url = std::move(*uri);
-      cached_.jwt_md = grpc_mdelem_from_slices(
-          grpc_slice_from_static_string(GRPC_AUTHORIZATION_METADATA_KEY),
-          grpc_slice_from_cpp_string(std::move(md_value)));
-      jwt_md = GRPC_MDELEM_REF(cached_.jwt_md);
+      jwt_value = grpc_core::Slice::FromCopiedString(md_value);
+      cached_ = {jwt_value->Ref(), std::move(*uri),
+                 gpr_time_add(gpr_now(GPR_CLOCK_REALTIME), jwt_lifetime_)};
     }
     gpr_mu_unlock(&cache_mu_);
   }
 
-  if (!GRPC_MDISNULL(jwt_md)) {
-    grpc_credentials_mdelem_array_add(md_array, jwt_md);
-    GRPC_MDELEM_UNREF(jwt_md);
-  } else {
-    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Could not generate JWT.");
+  if (!jwt_value.has_value()) {
+    return grpc_core::Immediate(
+        absl::UnauthenticatedError("Could not generate JWT."));
   }
-  return true;
-}
 
-void grpc_service_account_jwt_access_credentials::cancel_get_request_metadata(
-    grpc_credentials_mdelem_array* /*md_array*/, grpc_error_handle error) {
-  GRPC_ERROR_UNREF(error);
+  initial_metadata->Append(
+      GRPC_AUTHORIZATION_METADATA_KEY, std::move(*jwt_value),
+      [](absl::string_view, const grpc_core::Slice&) { abort(); });
+  return grpc_core::Immediate(std::move(initial_metadata));
 }
 
 grpc_service_account_jwt_access_credentials::
     grpc_service_account_jwt_access_credentials(grpc_auth_json_key key,
                                                 gpr_timespec token_lifetime)
-    : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_JWT), key_(key) {
+    : key_(key) {
   gpr_timespec max_token_lifetime = grpc_max_auth_token_lifetime();
   if (gpr_time_cmp(token_lifetime, max_token_lifetime) > 0) {
     gpr_log(GPR_INFO,
@@ -131,7 +116,10 @@ grpc_service_account_jwt_access_credentials::
   }
   jwt_lifetime_ = token_lifetime;
   gpr_mu_init(&cache_mu_);
-  reset_cache();
+}
+
+const char* grpc_service_account_jwt_access_credentials::Type() {
+  return "Jwt";
 }
 
 grpc_core::RefCountedPtr<grpc_call_credentials>

data/src/core/lib/security/credentials/jwt/jwt_credentials.h

@@ -38,14 +38,9 @@ class grpc_service_account_jwt_access_credentials
                                               gpr_timespec token_lifetime);
   ~grpc_service_account_jwt_access_credentials() override;
 
-  bool get_request_metadata(grpc_polling_entity* pollent,
-                            grpc_auth_metadata_context context,
-                            grpc_credentials_mdelem_array* md_array,
-                            grpc_closure* on_request_metadata,
-                            grpc_error_handle* error) override;
-
-  void cancel_get_request_metadata(grpc_credentials_mdelem_array* md_array,
-                                   grpc_error_handle error) override;
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
+                     const GetRequestMetadataArgs* args) override;
 
   const gpr_timespec& jwt_lifetime() const { return jwt_lifetime_; }
   const grpc_auth_json_key& key() const { return key_; }
@@ -57,17 +52,26 @@ class grpc_service_account_jwt_access_credentials
             static_cast<int64_t>(gpr_timespec_to_micros(jwt_lifetime_)))));
   };
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
  private:
-  void reset_cache();
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_call_credentials*>(this), other);
+  }
 
   // Have a simple cache for now with just 1 entry. We could have a map based on
   // the service_url for a more sophisticated one.
   gpr_mu cache_mu_;
-  struct {
-    grpc_mdelem jwt_md = GRPC_MDNULL;
+  struct Cache {
+    grpc_core::Slice jwt_value;
     std::string service_url;
     gpr_timespec jwt_expiration;
-  } cached_;
+  };
+  absl::optional<Cache> cached_;
 
   grpc_auth_json_key key_;
   gpr_timespec jwt_lifetime_;

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -23,20 +23,19 @@
 #include <limits.h>
 #include <string.h>
 
+#include <openssl/bn.h>
+#include <openssl/pem.h>
+#include <openssl/rsa.h>
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 #include <grpc/support/sync.h>
 
-extern "C" {
-#include <openssl/bn.h>
-#include <openssl/pem.h>
-#include <openssl/rsa.h>
-}
-
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/manual_constructor.h"
 #include "src/core/lib/http/httpcli.h"
+#include "src/core/lib/http/httpcli_ssl_credentials.h"
 #include "src/core/lib/iomgr/polling_entity.h"
 #include "src/core/lib/slice/b64.h"
 #include "src/core/lib/slice/slice_internal.h"
@@ -346,6 +345,7 @@ struct verifier_cb_ctx {
   void* user_data;
   grpc_jwt_verification_done_cb user_cb;
   grpc_http_response responses[HTTP_RESPONSE_COUNT];
+  grpc_core::OrphanablePtr<grpc_core::HttpRequest> http_request;
 };
 /* Takes ownership of the header, claims and signature. */
 static verifier_cb_ctx* verifier_cb_ctx_create(
@@ -387,7 +387,8 @@ void verifier_cb_ctx_destroy(verifier_cb_ctx* ctx) {
 gpr_timespec grpc_jwt_verifier_clock_skew = {60, 0, GPR_TIMESPAN};
 
 /* Max delay defaults to one minute. */
-grpc_millis grpc_jwt_verifier_max_delay = 60 * GPR_MS_PER_SEC;
+grpc_core::Duration grpc_jwt_verifier_max_delay =
+    grpc_core::Duration::Minutes(1);
 
 struct email_key_mapping {
   char* email_domain;
@@ -397,10 +398,9 @@ struct grpc_jwt_verifier {
   email_key_mapping* mappings;
   size_t num_mappings; /* Should be very few, linear search ok. */
   size_t allocated_mappings;
-  grpc_httpcli_context http_ctx;
 };
 
-static Json json_from_http(const grpc_httpcli_response* response) {
+static Json json_from_http(const grpc_http_response* response) {
   if (response == nullptr) {
     gpr_log(GPR_ERROR, "HTTP response is NULL.");
     return Json();  // JSON null
@@ -669,9 +669,13 @@ static void on_openid_config_retrieved(void* user_data,
   verifier_cb_ctx* ctx = static_cast<verifier_cb_ctx*>(user_data);
   const grpc_http_response* response = &ctx->responses[HTTP_RESPONSE_OPENID];
   Json json = json_from_http(response);
-  grpc_httpcli_request req;
+  grpc_http_request req;
+  memset(&req, 0, sizeof(grpc_http_request));
   const char* jwks_uri;
   const Json* cur;
+  absl::StatusOr<grpc_core::URI> uri;
+  char* host;
+  char* path;
 
   /* TODO(jboeuf): Cache the jwks_uri in order to avoid this hop next time. */
   if (json.type() == Json::Type::JSON_NULL) goto error;
@@ -687,25 +691,30 @@ static void on_openid_config_retrieved(void* user_data,
     goto error;
   }
   jwks_uri += 8;
-  req.handshaker = &grpc_httpcli_ssl;
-  req.host = gpr_strdup(jwks_uri);
-  req.http.path = const_cast<char*>(strchr(jwks_uri, '/'));
-  if (req.http.path == nullptr) {
-    req.http.path = const_cast<char*>("");
+  host = gpr_strdup(jwks_uri);
+  path = const_cast<char*>(strchr(jwks_uri, '/'));
+  if (path == nullptr) {
+    path = const_cast<char*>("");
   } else {
-    *(req.host + (req.http.path - jwks_uri)) = '\0';
+    *(host + (path - jwks_uri)) = '\0';
   }
 
   /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
      channel. This would allow us to cancel an authentication query when under
      extreme memory pressure. */
-  grpc_httpcli_get(
-      &ctx->verifier->http_ctx, &ctx->pollent,
-      grpc_core::ResourceQuota::Default(), &req,
+  uri = grpc_core::URI::Create("https", host, path, {} /* query params /*/,
+                               "" /* fragment */);
+  if (!uri.ok()) {
+    goto error;
+  }
+  ctx->http_request = grpc_core::HttpRequest::Get(
+      std::move(*uri), nullptr /* channel args */, &ctx->pollent, &req,
       grpc_core::ExecCtx::Get()->Now() + grpc_jwt_verifier_max_delay,
       GRPC_CLOSURE_CREATE(on_keys_retrieved, ctx, grpc_schedule_on_exec_ctx),
-      &ctx->responses[HTTP_RESPONSE_KEYS]);
-  gpr_free(req.host);
+      &ctx->responses[HTTP_RESPONSE_KEYS],
+      grpc_core::CreateHttpRequestSSLCredentials());
+  ctx->http_request->Start();
+  gpr_free(host);
   return;
 
 error:
@@ -763,10 +772,12 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
   grpc_closure* http_cb;
   char* path_prefix = nullptr;
   const char* iss;
-  grpc_httpcli_request req;
-  memset(&req, 0, sizeof(grpc_httpcli_request));
-  req.handshaker = &grpc_httpcli_ssl;
+  grpc_http_request req;
+  memset(&req, 0, sizeof(grpc_http_request));
   http_response_index rsp_idx;
+  char* host;
+  char* path;
+  absl::StatusOr<grpc_core::URI> uri;
 
   GPR_ASSERT(ctx != nullptr && ctx->header != nullptr &&
              ctx->claims != nullptr);
@@ -794,26 +805,25 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
       gpr_log(GPR_ERROR, "Missing mapping for issuer email.");
       goto error;
     }
-    req.host = gpr_strdup(mapping->key_url_prefix);
-    path_prefix = strchr(req.host, '/');
+    host = gpr_strdup(mapping->key_url_prefix);
+    path_prefix = strchr(host, '/');
     if (path_prefix == nullptr) {
-      gpr_asprintf(&req.http.path, "/%s", iss);
+      gpr_asprintf(&path, "/%s", iss);
     } else {
       *(path_prefix++) = '\0';
-      gpr_asprintf(&req.http.path, "/%s/%s", path_prefix, iss);
+      gpr_asprintf(&path, "/%s/%s", path_prefix, iss);
     }
     http_cb =
         GRPC_CLOSURE_CREATE(on_keys_retrieved, ctx, grpc_schedule_on_exec_ctx);
     rsp_idx = HTTP_RESPONSE_KEYS;
   } else {
-    req.host = gpr_strdup(strstr(iss, "https://") == iss ? iss + 8 : iss);
-    path_prefix = strchr(req.host, '/');
+    host = gpr_strdup(strstr(iss, "https://") == iss ? iss + 8 : iss);
+    path_prefix = strchr(host, '/');
     if (path_prefix == nullptr) {
-      req.http.path = gpr_strdup(GRPC_OPENID_CONFIG_URL_SUFFIX);
+      path = gpr_strdup(GRPC_OPENID_CONFIG_URL_SUFFIX);
     } else {
       *(path_prefix++) = 0;
-      gpr_asprintf(&req.http.path, "/%s%s", path_prefix,
-                   GRPC_OPENID_CONFIG_URL_SUFFIX);
+      gpr_asprintf(&path, "/%s%s", path_prefix, GRPC_OPENID_CONFIG_URL_SUFFIX);
     }
     http_cb = GRPC_CLOSURE_CREATE(on_openid_config_retrieved, ctx,
                                   grpc_schedule_on_exec_ctx);
@@ -823,13 +833,18 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
   /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
      channel. This would allow us to cancel an authentication query when under
      extreme memory pressure. */
-  grpc_httpcli_get(
-      &ctx->verifier->http_ctx, &ctx->pollent,
-      grpc_core::ResourceQuota::Default(), &req,
+  uri = grpc_core::URI::Create("https", host, path, {} /* query params */,
+                               "" /* fragment */);
+  if (!uri.ok()) {
+    goto error;
+  }
+  ctx->http_request = grpc_core::HttpRequest::Get(
+      std::move(*uri), nullptr /* channel args */, &ctx->pollent, &req,
       grpc_core::ExecCtx::Get()->Now() + grpc_jwt_verifier_max_delay, http_cb,
-      &ctx->responses[rsp_idx]);
-  gpr_free(req.host);
-  gpr_free(req.http.path);
+      &ctx->responses[rsp_idx], grpc_core::CreateHttpRequestSSLCredentials());
+  ctx->http_request->Start();
+  gpr_free(host);
+  gpr_free(path);
   return;
 
 error:
@@ -886,7 +901,6 @@ grpc_jwt_verifier* grpc_jwt_verifier_create(
     const grpc_jwt_verifier_email_domain_key_url_mapping* mappings,
     size_t num_mappings) {
   grpc_jwt_verifier* v = grpc_core::Zalloc<grpc_jwt_verifier>();
-  grpc_httpcli_context_init(&v->http_ctx);
 
   /* We know at least of one mapping. */
   v->allocated_mappings = 1 + num_mappings;
@@ -908,7 +922,6 @@ grpc_jwt_verifier* grpc_jwt_verifier_create(
 void grpc_jwt_verifier_destroy(grpc_jwt_verifier* v) {
   size_t i;
   if (v == nullptr) return;
-  grpc_httpcli_context_destroy(&v->http_ctx);
   if (v->mappings != nullptr) {
     for (i = 0; i < v->num_mappings; i++) {
       gpr_free(v->mappings[i].email_domain);

data/src/core/lib/security/credentials/jwt/jwt_verifier.h

@@ -82,7 +82,7 @@ struct grpc_jwt_verifier_email_domain_key_url_mapping {
 };
 /* Globals to control the verifier. Not thread-safe. */
 extern gpr_timespec grpc_jwt_verifier_clock_skew;
-extern grpc_millis grpc_jwt_verifier_max_delay;
+extern grpc_core::Duration grpc_jwt_verifier_max_delay;
 
 /* The verifier can be created with some custom mappings to help with key
    discovery in the case where the issuer is an email address.

data/src/core/lib/security/credentials/local/local_credentials.cc

@@ -27,8 +27,6 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/security/security_connector/local/local_security_connector.h"
 
-#define GRPC_CREDENTIALS_TYPE_LOCAL "Local"
-
 grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_local_credentials::create_security_connector(
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
@@ -38,16 +36,19 @@ grpc_local_credentials::create_security_connector(
       this->Ref(), std::move(request_metadata_creds), args, target_name);
 }
 
+const char* grpc_local_credentials::type() const { return "Local"; }
+
 grpc_core::RefCountedPtr<grpc_server_security_connector>
 grpc_local_server_credentials::create_security_connector(
     const grpc_channel_args* /* args */) {
   return grpc_local_server_security_connector_create(this->Ref());
 }
 
+const char* grpc_local_server_credentials::type() const { return "Local"; }
+
 grpc_local_credentials::grpc_local_credentials(
     grpc_local_connect_type connect_type)
-    : grpc_channel_credentials(GRPC_CREDENTIALS_TYPE_LOCAL),
-      connect_type_(connect_type) {}
+    : connect_type_(connect_type) {}
 
 grpc_channel_credentials* grpc_local_credentials_create(
     grpc_local_connect_type connect_type) {
@@ -56,8 +57,7 @@ grpc_channel_credentials* grpc_local_credentials_create(
 
 grpc_local_server_credentials::grpc_local_server_credentials(
     grpc_local_connect_type connect_type)
-    : grpc_server_credentials(GRPC_CREDENTIALS_TYPE_LOCAL),
-      connect_type_(connect_type) {}
+    : connect_type_(connect_type) {}
 
 grpc_server_credentials* grpc_local_server_credentials_create(
     grpc_local_connect_type connect_type) {

data/src/core/lib/security/credentials/local/local_credentials.h

@@ -37,9 +37,17 @@ class grpc_local_credentials final : public grpc_channel_credentials {
       const char* target_name, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
+  const char* type() const override;
+
   grpc_local_connect_type connect_type() const { return connect_type_; }
 
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_channel_credentials*>(this), other);
+  }
+
   grpc_local_connect_type connect_type_;
 };
 
@@ -52,6 +60,8 @@ class grpc_local_server_credentials final : public grpc_server_credentials {
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_channel_args* /* args */) override;
 
+  const char* type() const override;
+
   grpc_local_connect_type connect_type() const { return connect_type_; }
 
  private: