grpc 1.43.1 → 1.46.2

data/src/core/lib/security/credentials/plugin/plugin_credentials.cc

@@ -22,6 +22,8 @@
 
 #include <string.h>
 
+#include <atomic>
+
 #include "absl/strings/str_cat.h"
 
 #include <grpc/grpc.h>
@@ -30,6 +32,8 @@
 #include <grpc/support/sync.h>
 
 #include "src/core/lib/gprpp/memory.h"
+#include "src/core/lib/promise/promise.h"
+#include "src/core/lib/security/credentials/plugin/plugin_credentials.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
 #include "src/core/lib/surface/api_trace.h"
@@ -38,7 +42,6 @@
 grpc_core::TraceFlag grpc_plugin_credentials_trace(false, "plugin_credentials");
 
 grpc_plugin_credentials::~grpc_plugin_credentials() {
-  gpr_mu_destroy(&mu_);
   if (plugin_.state != nullptr && plugin_.destroy != nullptr) {
     plugin_.destroy(plugin_.state);
   }
@@ -57,38 +60,14 @@ std::string grpc_plugin_credentials::debug_string() {
   return debug_str;
 }
 
-void grpc_plugin_credentials::pending_request_remove_locked(
-    pending_request* pending_request) {
-  if (pending_request->prev == nullptr) {
-    pending_requests_ = pending_request->next;
-  } else {
-    pending_request->prev->next = pending_request->next;
-  }
-  if (pending_request->next != nullptr) {
-    pending_request->next->prev = pending_request->prev;
-  }
-}
-
-// Checks if the request has been cancelled.
-// If not, removes it from the pending list, so that it cannot be
-// cancelled out from under us.
-// When this returns, r->cancelled indicates whether the request was
-// cancelled before completion.
-void grpc_plugin_credentials::pending_request_complete(pending_request* r) {
-  GPR_DEBUG_ASSERT(r->creds == this);
-  gpr_mu_lock(&mu_);
-  if (!r->cancelled) pending_request_remove_locked(r);
-  gpr_mu_unlock(&mu_);
-  // Ref to credentials not needed anymore.
-  Unref();
-}
+const char* grpc_plugin_credentials::type() const { return "Plugin"; }
 
-static grpc_error_handle process_plugin_result(
-    grpc_plugin_credentials::pending_request* r, const grpc_metadata* md,
-    size_t num_md, grpc_status_code status, const char* error_details) {
-  grpc_error_handle error = GRPC_ERROR_NONE;
+absl::StatusOr<grpc_core::ClientMetadataHandle>
+grpc_plugin_credentials::PendingRequest::ProcessPluginResult(
+    const grpc_metadata* md, size_t num_md, grpc_status_code status,
+    const char* error_details) {
   if (status != GRPC_STATUS_OK) {
-    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+    return absl::UnavailableError(absl::StrCat(
         "Getting metadata from plugin failed with error: ", error_details));
   } else {
     bool seen_illegal_header = false;
@@ -107,155 +86,120 @@ static grpc_error_handle process_plugin_result(
       }
     }
     if (seen_illegal_header) {
-      error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Illegal metadata");
+      return absl::UnavailableError("Illegal metadata");
     } else {
+      absl::Status error;
       for (size_t i = 0; i < num_md; ++i) {
-        grpc_mdelem mdelem =
-            grpc_mdelem_create(md[i].key, md[i].value, nullptr);
-        grpc_credentials_mdelem_array_add(r->md_array, mdelem);
-        GRPC_MDELEM_UNREF(mdelem);
+        md_->Append(
+            grpc_core::StringViewFromSlice(md[i].key),
+            grpc_core::Slice(grpc_slice_ref_internal(md[i].value)),
+            [&error](absl::string_view message, const grpc_core::Slice&) {
+              error = absl::UnavailableError(message);
+            });
       }
+      if (!error.ok()) return std::move(error);
+      return grpc_core::ClientMetadataHandle(std::move(md_));
     }
   }
-  return error;
 }
 
-static void plugin_md_request_metadata_ready(void* request,
-                                             const grpc_metadata* md,
-                                             size_t num_md,
-                                             grpc_status_code status,
-                                             const char* error_details) {
+grpc_core::Poll<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+grpc_plugin_credentials::PendingRequest::PollAsyncResult() {
+  if (!ready_.load(std::memory_order_acquire)) {
+    return grpc_core::Pending{};
+  }
+  return ProcessPluginResult(metadata_.data(), metadata_.size(), status_,
+                             error_details_.c_str());
+}
+
+void grpc_plugin_credentials::PendingRequest::RequestMetadataReady(
+    void* request, const grpc_metadata* md, size_t num_md,
+    grpc_status_code status, const char* error_details) {
   /* called from application code */
   grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
   grpc_core::ExecCtx exec_ctx(GRPC_EXEC_CTX_FLAG_IS_FINISHED |
                               GRPC_EXEC_CTX_FLAG_THREAD_RESOURCE_LOOP);
-  grpc_plugin_credentials::pending_request* r =
-      static_cast<grpc_plugin_credentials::pending_request*>(request);
+  grpc_core::RefCountedPtr<grpc_plugin_credentials::PendingRequest> r(
+      static_cast<grpc_plugin_credentials::PendingRequest*>(request));
   if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
     gpr_log(GPR_INFO,
             "plugin_credentials[%p]: request %p: plugin returned "
             "asynchronously",
-            r->creds, r);
+            r->creds(), r.get());
   }
-  // Remove request from pending list if not previously cancelled.
-  r->creds->pending_request_complete(r);
-  // If it has not been cancelled, process it.
-  if (!r->cancelled) {
-    grpc_error_handle error =
-        process_plugin_result(r, md, num_md, status, error_details);
-    grpc_core::ExecCtx::Run(DEBUG_LOCATION, r->on_request_metadata, error);
-  } else if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-    gpr_log(GPR_INFO,
-            "plugin_credentials[%p]: request %p: plugin was previously "
-            "cancelled",
-            r->creds, r);
+  for (size_t i = 0; i < num_md; ++i) {
+    grpc_metadata p;
+    p.key = grpc_slice_ref_internal(md[i].key);
+    p.value = grpc_slice_ref_internal(md[i].value);
+    r->metadata_.push_back(p);
   }
-  gpr_free(r);
+  r->error_details_ = error_details == nullptr ? "" : error_details;
+  r->status_ = status;
+  r->ready_.store(true, std::memory_order_release);
+  r->waker_.Wakeup();
 }
 
-bool grpc_plugin_credentials::get_request_metadata(
-    grpc_polling_entity* /*pollent*/, grpc_auth_metadata_context context,
-    grpc_credentials_mdelem_array* md_array, grpc_closure* on_request_metadata,
-    grpc_error_handle* error) {
-  bool retval = true;  // Synchronous return.
-  if (plugin_.get_metadata != nullptr) {
-    // Create pending_request object.
-    pending_request* request = grpc_core::Zalloc<pending_request>();
-    request->creds = this;
-    request->md_array = md_array;
-    request->on_request_metadata = on_request_metadata;
-    // Add it to the pending list.
-    gpr_mu_lock(&mu_);
-    if (pending_requests_ != nullptr) {
-      pending_requests_->prev = request;
-    }
-    request->next = pending_requests_;
-    pending_requests_ = request;
-    gpr_mu_unlock(&mu_);
-    // Invoke the plugin.  The callback holds a ref to us.
-    if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-      gpr_log(GPR_INFO, "plugin_credentials[%p]: request %p: invoking plugin",
-              this, request);
-    }
-    Ref().release();
-    grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX];
-    size_t num_creds_md = 0;
-    grpc_status_code status = GRPC_STATUS_OK;
-    const char* error_details = nullptr;
-    if (!plugin_.get_metadata(
-            plugin_.state, context, plugin_md_request_metadata_ready, request,
-            creds_md, &num_creds_md, &status, &error_details)) {
-      if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-        gpr_log(GPR_INFO,
-                "plugin_credentials[%p]: request %p: plugin will return "
-                "asynchronously",
-                this, request);
-      }
-      return false;  // Asynchronous return.
-    }
-    // Returned synchronously.
-    // Remove request from pending list if not previously cancelled.
-    request->creds->pending_request_complete(request);
-    // If the request was cancelled, the error will have been returned
-    // asynchronously by plugin_cancel_get_request_metadata(), so return
-    // false.  Otherwise, process the result.
-    if (request->cancelled) {
-      if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-        gpr_log(GPR_INFO,
-                "plugin_credentials[%p]: request %p was cancelled, error "
-                "will be returned asynchronously",
-                this, request);
-      }
-      retval = false;
-    } else {
-      if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-        gpr_log(GPR_INFO,
-                "plugin_credentials[%p]: request %p: plugin returned "
-                "synchronously",
-                this, request);
-      }
-      *error = process_plugin_result(request, creds_md, num_creds_md, status,
-                                     error_details);
-    }
-    // Clean up.
-    for (size_t i = 0; i < num_creds_md; ++i) {
-      grpc_slice_unref_internal(creds_md[i].key);
-      grpc_slice_unref_internal(creds_md[i].value);
-    }
-    gpr_free(const_cast<char*>(error_details));
-    gpr_free(request);
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+grpc_plugin_credentials::GetRequestMetadata(
+    grpc_core::ClientMetadataHandle initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs* args) {
+  if (plugin_.get_metadata == nullptr) {
+    return grpc_core::Immediate(std::move(initial_metadata));
   }
-  return retval;
-}
 
-void grpc_plugin_credentials::cancel_get_request_metadata(
-    grpc_credentials_mdelem_array* md_array, grpc_error_handle error) {
-  gpr_mu_lock(&mu_);
-  for (pending_request* pending_request = pending_requests_;
-       pending_request != nullptr; pending_request = pending_request->next) {
-    if (pending_request->md_array == md_array) {
-      if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-        gpr_log(GPR_INFO, "plugin_credentials[%p]: cancelling request %p", this,
-                pending_request);
-      }
-      pending_request->cancelled = true;
-      grpc_core::ExecCtx::Run(DEBUG_LOCATION,
-                              pending_request->on_request_metadata,
-                              GRPC_ERROR_REF(error));
-      pending_request_remove_locked(pending_request);
-      break;
+  // Create pending_request object.
+  auto request = grpc_core::MakeRefCounted<PendingRequest>(
+      Ref(), std::move(initial_metadata), args);
+  // Invoke the plugin.  The callback holds a ref to us.
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
+    gpr_log(GPR_INFO, "plugin_credentials[%p]: request %p: invoking plugin",
+            this, request.get());
+  }
+  grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX];
+  size_t num_creds_md = 0;
+  grpc_status_code status = GRPC_STATUS_OK;
+  const char* error_details = nullptr;
+  // Add an extra ref to the request object for the async callback.
+  // If the request completes synchronously, we'll drop this later.
+  // If the request completes asynchronously, it will own a ref to the request
+  // object (which we release from our ownership below).
+  auto child_request = request->Ref();
+  if (!plugin_.get_metadata(plugin_.state, request->context(),
+                            PendingRequest::RequestMetadataReady,
+                            child_request.get(), creds_md, &num_creds_md,
+                            &status, &error_details)) {
+    child_request.release();
+    if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
+      gpr_log(GPR_INFO,
+              "plugin_credentials[%p]: request %p: plugin will return "
+              "asynchronously",
+              this, request.get());
     }
+    return [request] { return request->PollAsyncResult(); };
+  }
+  // Synchronous return.
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
+    gpr_log(GPR_INFO,
+            "plugin_credentials[%p]: request %p: plugin returned "
+            "synchronously",
+            this, request.get());
+  }
+  auto result = request->ProcessPluginResult(creds_md, num_creds_md, status,
+                                             error_details);
+  // Clean up.
+  for (size_t i = 0; i < num_creds_md; ++i) {
+    grpc_slice_unref_internal(creds_md[i].key);
+    grpc_slice_unref_internal(creds_md[i].value);
   }
-  gpr_mu_unlock(&mu_);
-  GRPC_ERROR_UNREF(error);
+  gpr_free(const_cast<char*>(error_details));
+
+  return grpc_core::Immediate(std::move(result));
 }
 
 grpc_plugin_credentials::grpc_plugin_credentials(
     grpc_metadata_credentials_plugin plugin,
     grpc_security_level min_security_level)
-    : grpc_call_credentials(plugin.type, min_security_level), plugin_(plugin) {
-  gpr_mu_init(&mu_);
-}
+    : grpc_call_credentials(min_security_level), plugin_(plugin) {}
 
 grpc_call_credentials* grpc_metadata_credentials_create_from_plugin(
     grpc_metadata_credentials_plugin plugin,

data/src/core/lib/security/credentials/plugin/plugin_credentials.h

@@ -21,6 +21,7 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/lib/security/credentials/call_creds_util.h"
 #include "src/core/lib/security/credentials/credentials.h"
 
 extern grpc_core::TraceFlag grpc_plugin_credentials_trace;
@@ -30,43 +31,71 @@ extern grpc_core::TraceFlag grpc_plugin_credentials_trace;
 // -Wmismatched-tags.
 struct grpc_plugin_credentials final : public grpc_call_credentials {
  public:
-  struct pending_request {
-    bool cancelled;
-    struct grpc_plugin_credentials* creds;
-    grpc_credentials_mdelem_array* md_array;
-    grpc_closure* on_request_metadata;
-    struct pending_request* prev;
-    struct pending_request* next;
-  };
-
   explicit grpc_plugin_credentials(grpc_metadata_credentials_plugin plugin,
                                    grpc_security_level min_security_level);
   ~grpc_plugin_credentials() override;
 
-  bool get_request_metadata(grpc_polling_entity* pollent,
-                            grpc_auth_metadata_context context,
-                            grpc_credentials_mdelem_array* md_array,
-                            grpc_closure* on_request_metadata,
-                            grpc_error_handle* error) override;
-
-  void cancel_get_request_metadata(grpc_credentials_mdelem_array* md_array,
-                                   grpc_error_handle error) override;
-
-  // Checks if the request has been cancelled.
-  // If not, removes it from the pending list, so that it cannot be
-  // cancelled out from under us.
-  // When this returns, r->cancelled indicates whether the request was
-  // cancelled before completion.
-  void pending_request_complete(pending_request* r);
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
+                     const GetRequestMetadataArgs* args) override;
 
   std::string debug_string() override;
 
+  const char* type() const override;
+
  private:
-  void pending_request_remove_locked(pending_request* pending_request);
+  class PendingRequest : public grpc_core::RefCounted<PendingRequest> {
+   public:
+    PendingRequest(grpc_core::RefCountedPtr<grpc_plugin_credentials> creds,
+                   grpc_core::ClientMetadataHandle initial_metadata,
+                   const grpc_call_credentials::GetRequestMetadataArgs* args)
+        : call_creds_(std::move(creds)),
+          context_(
+              grpc_core::MakePluginAuthMetadataContext(initial_metadata, args)),
+          md_(std::move(initial_metadata)) {}
+
+    ~PendingRequest() override {
+      grpc_auth_metadata_context_reset(&context_);
+      for (size_t i = 0; i < metadata_.size(); i++) {
+        grpc_slice_unref_internal(metadata_[i].key);
+        grpc_slice_unref_internal(metadata_[i].value);
+      }
+    }
+
+    absl::StatusOr<grpc_core::ClientMetadataHandle> ProcessPluginResult(
+        const grpc_metadata* md, size_t num_md, grpc_status_code status,
+        const char* error_details);
+
+    grpc_core::Poll<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+    PollAsyncResult();
+
+    static void RequestMetadataReady(void* request, const grpc_metadata* md,
+                                     size_t num_md, grpc_status_code status,
+                                     const char* error_details);
+
+    grpc_auth_metadata_context context() const { return context_; }
+    grpc_plugin_credentials* creds() const { return call_creds_.get(); }
+
+   private:
+    std::atomic<bool> ready_{false};
+    grpc_core::Waker waker_{
+        grpc_core::Activity::current()->MakeNonOwningWaker()};
+    grpc_core::RefCountedPtr<grpc_plugin_credentials> call_creds_;
+    grpc_auth_metadata_context context_;
+    grpc_core::ClientMetadataHandle md_;
+    // final status
+    absl::InlinedVector<grpc_metadata, 2> metadata_;
+    std::string error_details_;
+    grpc_status_code status_;
+  };
+
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_call_credentials*>(this), other);
+  }
 
   grpc_metadata_credentials_plugin plugin_;
-  gpr_mu mu_;
-  pending_request* pending_requests_ = nullptr;
 };
 
 #endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_PLUGIN_PLUGIN_CREDENTIALS_H */

data/src/core/lib/security/credentials/ssl/ssl_credentials.cc

@@ -27,6 +27,7 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/security/security_connector/ssl_utils.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/tsi/ssl_transport_security.h"
 
@@ -34,20 +35,9 @@
 // SSL Channel Credentials.
 //
 
-void grpc_tsi_ssl_pem_key_cert_pairs_destroy(tsi_ssl_pem_key_cert_pair* kp,
-                                             size_t num_key_cert_pairs) {
-  if (kp == nullptr) return;
-  for (size_t i = 0; i < num_key_cert_pairs; i++) {
-    gpr_free(const_cast<char*>(kp[i].private_key));
-    gpr_free(const_cast<char*>(kp[i].cert_chain));
-  }
-  gpr_free(kp);
-}
-
 grpc_ssl_credentials::grpc_ssl_credentials(
     const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
-    const grpc_ssl_verify_peer_options* verify_options)
-    : grpc_channel_credentials(GRPC_CHANNEL_CREDENTIALS_TYPE_SSL) {
+    const grpc_ssl_verify_peer_options* verify_options) {
   build_config(pem_root_certs, pem_key_cert_pair, verify_options);
 }
 
@@ -92,6 +82,8 @@ grpc_ssl_credentials::create_security_connector(
   return sc;
 }
 
+const char* grpc_ssl_credentials::Type() { return "Ssl"; }
+
 void grpc_ssl_credentials::build_config(
     const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
     const grpc_ssl_verify_peer_options* verify_options) {
@@ -171,8 +163,7 @@ struct grpc_ssl_server_credentials_options {
 };
 
 grpc_ssl_server_credentials::grpc_ssl_server_credentials(
-    const grpc_ssl_server_credentials_options& options)
-    : grpc_server_credentials(GRPC_CHANNEL_CREDENTIALS_TYPE_SSL) {
+    const grpc_ssl_server_credentials_options& options) {
   if (options.certificate_config_fetcher != nullptr) {
     config_.client_certificate_request = options.client_certificate_request;
     certificate_config_fetcher_ = *options.certificate_config_fetcher;
@@ -195,6 +186,8 @@ grpc_ssl_server_credentials::create_security_connector(
   return grpc_ssl_server_security_connector_create(this->Ref());
 }
 
+const char* grpc_ssl_server_credentials::Type() { return "Ssl"; }
+
 tsi_ssl_pem_key_cert_pair* grpc_convert_grpc_to_tsi_cert_pairs(
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs) {

data/src/core/lib/security/credentials/ssl/ssl_credentials.h

@@ -37,12 +37,22 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
       const char* target, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
   // TODO(mattstev): Plumb to wrapped languages. Until then, setting the TLS
   // version should be done for testing purposes only.
   void set_min_tls_version(grpc_tls_version min_tls_version);
   void set_max_tls_version(grpc_tls_version max_tls_version);
 
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_channel_credentials*>(this), other);
+  }
+
   void build_config(const char* pem_root_certs,
                     grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
                     const grpc_ssl_verify_peer_options* verify_options);
@@ -70,6 +80,10 @@ class grpc_ssl_server_credentials final : public grpc_server_credentials {
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_channel_args* /* args */) override;
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
   bool has_cert_config_fetcher() const {
     return certificate_config_fetcher_.cb != nullptr;
   }
@@ -102,7 +116,4 @@ tsi_ssl_pem_key_cert_pair* grpc_convert_grpc_to_tsi_cert_pairs(
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs);
 
-void grpc_tsi_ssl_pem_key_cert_pairs_destroy(tsi_ssl_pem_key_cert_pair* kp,
-                                             size_t num_key_cert_pairs);
-
 #endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_SSL_SSL_CREDENTIALS_H */

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h

@@ -26,6 +26,7 @@
 
 #include <grpc/grpc_security.h>
 
+#include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/thd.h"
@@ -50,6 +51,36 @@ struct grpc_tls_certificate_provider
 
   virtual grpc_core::RefCountedPtr<grpc_tls_certificate_distributor>
   distributor() const = 0;
+
+  // Compares this grpc_tls_certificate_provider object with \a other.
+  // If this method returns 0, it means that gRPC can treat the two certificate
+  // providers as effectively the same. This method is used to compare
+  // `grpc_tls_certificate_provider` objects when they are present in
+  // channel_args. One important usage of this is when channel args are used in
+  // SubchannelKey, which leads to a useful property that allows subchannels to
+  // be reused when two different `grpc_tls_certificate_provider` objects are
+  // used but they compare as equal (assuming other channel args match).
+  int Compare(const grpc_tls_certificate_provider* other) const {
+    GPR_ASSERT(other != nullptr);
+    // Intentionally uses grpc_core::QsortCompare instead of strcmp as a safety
+    // against different grpc_tls_certificate_provider types using the same
+    // name.
+    int r = grpc_core::QsortCompare(type(), other->type());
+    if (r != 0) return r;
+    return CompareImpl(other);
+  }
+
+  // The pointer value \a type is used to uniquely identify a creds
+  // implementation for down-casting purposes. Every provider implementation
+  // should use a unique string instance, which should be returned by all
+  // instances of that provider implementation.
+  virtual const char* type() const = 0;
+
+ private:
+  // Implementation for `Compare` method intended to be overridden by
+  // subclasses. Only invoked if `type()` and `other->type()` point to the same
+  // string.
+  virtual int CompareImpl(const grpc_tls_certificate_provider* other) const = 0;
 };
 
 namespace grpc_core {
@@ -68,11 +99,20 @@ class StaticDataCertificateProvider final
     return distributor_;
   }
 
+  const char* type() const override { return "StaticData"; }
+
  private:
   struct WatcherInfo {
     bool root_being_watched = false;
     bool identity_being_watched = false;
   };
+
+  int CompareImpl(const grpc_tls_certificate_provider* other) const override {
+    // TODO(yashykt): Maybe do something better here.
+    return QsortCompare(static_cast<const grpc_tls_certificate_provider*>(this),
+                        other);
+  }
+
   RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
   std::string root_certificate_;
   PemKeyCertPairList pem_key_cert_pairs_;
@@ -98,11 +138,20 @@ class FileWatcherCertificateProvider final
     return distributor_;
   }
 
+  const char* type() const override { return "FileWatcher"; }
+
  private:
   struct WatcherInfo {
     bool root_being_watched = false;
     bool identity_being_watched = false;
   };
+
+  int CompareImpl(const grpc_tls_certificate_provider* other) const override {
+    // TODO(yashykt): Maybe do something better here.
+    return QsortCompare(static_cast<const grpc_tls_certificate_provider*>(this),
+                        other);
+  }
+
   // Force an update from the file system regardless of the interval.
   void ForceUpdate();
   // Read the root certificates from files and update the distributor.

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.cc

@@ -30,6 +30,10 @@
 
 namespace grpc_core {
 
+//
+// ExternalCertificateVerifier
+//
+
 bool ExternalCertificateVerifier::Verify(
     grpc_tls_custom_verification_check_request* request,
     std::function<void(absl::Status)> callback, absl::Status* sync_status) {
@@ -80,6 +84,10 @@ void ExternalCertificateVerifier::OnVerifyDone(
   }
 }
 
+//
+// HostNameCertificateVerifier
+//
+
 bool HostNameCertificateVerifier::Verify(
     grpc_tls_custom_verification_check_request* request,
     std::function<void(absl::Status)>, absl::Status* sync_status) {