grpc 1.44.0.pre2 → 1.45.0

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.h

@@ -25,6 +25,8 @@
 
 #include <grpc/grpc_security.h>
 
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/http/httpcli.h"
 #include "src/core/lib/json/json.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/uri/uri_parser.h"
@@ -58,32 +60,43 @@ grpc_auth_refresh_token grpc_auth_refresh_token_create_from_json(
 /// Destructs the object.
 void grpc_auth_refresh_token_destruct(grpc_auth_refresh_token* refresh_token);
 
-// -- Oauth2 Token Fetcher credentials --
-//
-//  This object is a base for credentials that need to acquire an oauth2 token
-//  from an http service.
+// -- Credentials Metadata Request. --
+
+struct grpc_credentials_metadata_request {
+  explicit grpc_credentials_metadata_request(
+      grpc_core::RefCountedPtr<grpc_call_credentials> creds)
+      : creds(std::move(creds)) {}
+  ~grpc_credentials_metadata_request() {
+    grpc_http_response_destroy(&response);
+  }
+
+  grpc_core::RefCountedPtr<grpc_call_credentials> creds;
+  grpc_http_response response;
+};
 
-struct grpc_oauth2_pending_get_request_metadata {
-  grpc_core::CredentialsMetadataArray* md_array;
-  grpc_closure* on_request_metadata;
+struct grpc_oauth2_pending_get_request_metadata
+    : public grpc_core::RefCounted<grpc_oauth2_pending_get_request_metadata> {
+  std::atomic<bool> done{false};
+  grpc_core::Waker waker;
   grpc_polling_entity* pollent;
+  grpc_core::ClientInitialMetadata md;
   struct grpc_oauth2_pending_get_request_metadata* next;
+  absl::StatusOr<grpc_core::ClientInitialMetadata> result;
 };
 
+// -- Oauth2 Token Fetcher credentials --
+//
+//  This object is a base for credentials that need to acquire an oauth2 token
+//  from an http service.
+
 class grpc_oauth2_token_fetcher_credentials : public grpc_call_credentials {
  public:
   grpc_oauth2_token_fetcher_credentials();
   ~grpc_oauth2_token_fetcher_credentials() override;
 
-  bool get_request_metadata(grpc_polling_entity* pollent,
-                            grpc_auth_metadata_context context,
-                            grpc_core::CredentialsMetadataArray* md_array,
-                            grpc_closure* on_request_metadata,
-                            grpc_error_handle* error) override;
-
-  void cancel_get_request_metadata(
-      grpc_core::CredentialsMetadataArray* md_array,
-      grpc_error_handle error) override;
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+  GetRequestMetadata(grpc_core::ClientInitialMetadata initial_metadata,
+                     const GetRequestMetadataArgs* args) override;
 
   void on_http_response(grpc_credentials_metadata_request* r,
                         grpc_error_handle error);
@@ -92,9 +105,15 @@ class grpc_oauth2_token_fetcher_credentials : public grpc_call_credentials {
  protected:
   virtual void fetch_oauth2(grpc_credentials_metadata_request* req,
                             grpc_polling_entity* pollent, grpc_iomgr_cb_func cb,
-                            grpc_millis deadline) = 0;
+                            grpc_core::Timestamp deadline) = 0;
 
  private:
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_call_credentials*>(this), other);
+  }
+
   gpr_mu mu_;
   absl::optional<grpc_core::Slice> access_token_value_;
   gpr_timespec token_expiration_;
@@ -120,11 +139,12 @@ class grpc_google_refresh_token_credentials final
  protected:
   void fetch_oauth2(grpc_credentials_metadata_request* req,
                     grpc_polling_entity* pollent, grpc_iomgr_cb_func cb,
-                    grpc_millis deadline) override;
+                    grpc_core::Timestamp deadline) override;
 
  private:
   grpc_auth_refresh_token refresh_token_;
   grpc_closure http_post_cb_closure_;
+  grpc_core::OrphanablePtr<grpc_core::HttpRequest> http_request_;
 };
 
 // Access token credentials.
@@ -132,19 +152,19 @@ class grpc_access_token_credentials final : public grpc_call_credentials {
  public:
   explicit grpc_access_token_credentials(const char* access_token);
 
-  bool get_request_metadata(grpc_polling_entity* pollent,
-                            grpc_auth_metadata_context context,
-                            grpc_core::CredentialsMetadataArray* md_array,
-                            grpc_closure* on_request_metadata,
-                            grpc_error_handle* error) override;
-
-  void cancel_get_request_metadata(
-      grpc_core::CredentialsMetadataArray* md_array,
-      grpc_error_handle error) override;
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+  GetRequestMetadata(grpc_core::ClientInitialMetadata initial_metadata,
+                     const GetRequestMetadataArgs* args) override;
 
   std::string debug_string() override;
 
  private:
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_call_credentials*>(this), other);
+  }
+
   const grpc_core::Slice access_token_value_;
 };
 
@@ -158,7 +178,8 @@ grpc_refresh_token_credentials_create_from_auth_refresh_token(
 grpc_credentials_status
 grpc_oauth2_token_fetcher_credentials_parse_server_response(
     const struct grpc_http_response* response,
-    absl::optional<grpc_core::Slice>* token_value, grpc_millis* token_lifetime);
+    absl::optional<grpc_core::Slice>* token_value,
+    grpc_core::Duration* token_lifetime);
 
 namespace grpc_core {
 // Exposed for testing only. This function validates the options, ensuring that

data/src/core/lib/security/credentials/plugin/plugin_credentials.cc

@@ -22,6 +22,8 @@
 
 #include <string.h>
 
+#include <atomic>
+
 #include "absl/strings/str_cat.h"
 
 #include <grpc/grpc.h>
@@ -30,6 +32,8 @@
 #include <grpc/support/sync.h>
 
 #include "src/core/lib/gprpp/memory.h"
+#include "src/core/lib/promise/promise.h"
+#include "src/core/lib/security/credentials/plugin/plugin_credentials.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
 #include "src/core/lib/surface/api_trace.h"
@@ -38,7 +42,6 @@
 grpc_core::TraceFlag grpc_plugin_credentials_trace(false, "plugin_credentials");
 
 grpc_plugin_credentials::~grpc_plugin_credentials() {
-  gpr_mu_destroy(&mu_);
   if (plugin_.state != nullptr && plugin_.destroy != nullptr) {
     plugin_.destroy(plugin_.state);
   }
@@ -57,38 +60,12 @@ std::string grpc_plugin_credentials::debug_string() {
   return debug_str;
 }
 
-void grpc_plugin_credentials::pending_request_remove_locked(
-    pending_request* pending_request) {
-  if (pending_request->prev == nullptr) {
-    pending_requests_ = pending_request->next;
-  } else {
-    pending_request->prev->next = pending_request->next;
-  }
-  if (pending_request->next != nullptr) {
-    pending_request->next->prev = pending_request->prev;
-  }
-}
-
-// Checks if the request has been cancelled.
-// If not, removes it from the pending list, so that it cannot be
-// cancelled out from under us.
-// When this returns, r->cancelled indicates whether the request was
-// cancelled before completion.
-void grpc_plugin_credentials::pending_request_complete(pending_request* r) {
-  GPR_DEBUG_ASSERT(r->creds == this);
-  gpr_mu_lock(&mu_);
-  if (!r->cancelled) pending_request_remove_locked(r);
-  gpr_mu_unlock(&mu_);
-  // Ref to credentials not needed anymore.
-  Unref();
-}
-
-static grpc_error_handle process_plugin_result(
-    grpc_plugin_credentials::pending_request* r, const grpc_metadata* md,
-    size_t num_md, grpc_status_code status, const char* error_details) {
-  grpc_error_handle error = GRPC_ERROR_NONE;
+absl::StatusOr<grpc_core::ClientInitialMetadata>
+grpc_plugin_credentials::PendingRequest::ProcessPluginResult(
+    const grpc_metadata* md, size_t num_md, grpc_status_code status,
+    const char* error_details) {
   if (status != GRPC_STATUS_OK) {
-    error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+    return absl::UnavailableError(absl::StrCat(
         "Getting metadata from plugin failed with error: ", error_details));
   } else {
     bool seen_illegal_header = false;
@@ -107,154 +84,120 @@ static grpc_error_handle process_plugin_result(
       }
     }
     if (seen_illegal_header) {
-      error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Illegal metadata");
+      return absl::UnavailableError("Illegal metadata");
     } else {
+      absl::Status error;
       for (size_t i = 0; i < num_md; ++i) {
-        r->md_array->emplace_back(
-            grpc_core::Slice(grpc_slice_ref_internal(md[i].key)),
-            grpc_core::Slice(grpc_slice_ref_internal(md[i].value)));
+        md_->Append(
+            grpc_core::StringViewFromSlice(md[i].key),
+            grpc_core::Slice(grpc_slice_ref_internal(md[i].value)),
+            [&error](absl::string_view message, const grpc_core::Slice&) {
+              error = absl::UnavailableError(message);
+            });
       }
+      if (!error.ok()) return std::move(error);
+      return grpc_core::ClientInitialMetadata(std::move(md_));
     }
   }
-  return error;
 }
 
-static void plugin_md_request_metadata_ready(void* request,
-                                             const grpc_metadata* md,
-                                             size_t num_md,
-                                             grpc_status_code status,
-                                             const char* error_details) {
+grpc_core::Poll<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+grpc_plugin_credentials::PendingRequest::PollAsyncResult() {
+  if (!ready_.load(std::memory_order_acquire)) {
+    return grpc_core::Pending{};
+  }
+  return ProcessPluginResult(metadata_.data(), metadata_.size(), status_,
+                             error_details_.c_str());
+}
+
+void grpc_plugin_credentials::PendingRequest::RequestMetadataReady(
+    void* request, const grpc_metadata* md, size_t num_md,
+    grpc_status_code status, const char* error_details) {
   /* called from application code */
   grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
   grpc_core::ExecCtx exec_ctx(GRPC_EXEC_CTX_FLAG_IS_FINISHED |
                               GRPC_EXEC_CTX_FLAG_THREAD_RESOURCE_LOOP);
-  grpc_plugin_credentials::pending_request* r =
-      static_cast<grpc_plugin_credentials::pending_request*>(request);
+  grpc_core::RefCountedPtr<grpc_plugin_credentials::PendingRequest> r(
+      static_cast<grpc_plugin_credentials::PendingRequest*>(request));
   if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
     gpr_log(GPR_INFO,
             "plugin_credentials[%p]: request %p: plugin returned "
             "asynchronously",
-            r->creds, r);
+            r->creds(), r.get());
   }
-  // Remove request from pending list if not previously cancelled.
-  r->creds->pending_request_complete(r);
-  // If it has not been cancelled, process it.
-  if (!r->cancelled) {
-    grpc_error_handle error =
-        process_plugin_result(r, md, num_md, status, error_details);
-    grpc_core::ExecCtx::Run(DEBUG_LOCATION, r->on_request_metadata, error);
-  } else if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-    gpr_log(GPR_INFO,
-            "plugin_credentials[%p]: request %p: plugin was previously "
-            "cancelled",
-            r->creds, r);
+  for (size_t i = 0; i < num_md; ++i) {
+    grpc_metadata p;
+    p.key = grpc_slice_ref_internal(md[i].key);
+    p.value = grpc_slice_ref_internal(md[i].value);
+    r->metadata_.push_back(p);
   }
-  gpr_free(r);
+  r->error_details_ = error_details == nullptr ? "" : error_details;
+  r->status_ = status;
+  r->ready_.store(true, std::memory_order_release);
+  r->waker_.Wakeup();
 }
 
-bool grpc_plugin_credentials::get_request_metadata(
-    grpc_polling_entity* /*pollent*/, grpc_auth_metadata_context context,
-    grpc_core::CredentialsMetadataArray* md_array,
-    grpc_closure* on_request_metadata, grpc_error_handle* error) {
-  bool retval = true;  // Synchronous return.
-  if (plugin_.get_metadata != nullptr) {
-    // Create pending_request object.
-    pending_request* request = grpc_core::Zalloc<pending_request>();
-    request->creds = this;
-    request->md_array = md_array;
-    request->on_request_metadata = on_request_metadata;
-    // Add it to the pending list.
-    gpr_mu_lock(&mu_);
-    if (pending_requests_ != nullptr) {
-      pending_requests_->prev = request;
-    }
-    request->next = pending_requests_;
-    pending_requests_ = request;
-    gpr_mu_unlock(&mu_);
-    // Invoke the plugin.  The callback holds a ref to us.
-    if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-      gpr_log(GPR_INFO, "plugin_credentials[%p]: request %p: invoking plugin",
-              this, request);
-    }
-    Ref().release();
-    grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX];
-    size_t num_creds_md = 0;
-    grpc_status_code status = GRPC_STATUS_OK;
-    const char* error_details = nullptr;
-    if (!plugin_.get_metadata(
-            plugin_.state, context, plugin_md_request_metadata_ready, request,
-            creds_md, &num_creds_md, &status, &error_details)) {
-      if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-        gpr_log(GPR_INFO,
-                "plugin_credentials[%p]: request %p: plugin will return "
-                "asynchronously",
-                this, request);
-      }
-      return false;  // Asynchronous return.
-    }
-    // Returned synchronously.
-    // Remove request from pending list if not previously cancelled.
-    request->creds->pending_request_complete(request);
-    // If the request was cancelled, the error will have been returned
-    // asynchronously by plugin_cancel_get_request_metadata(), so return
-    // false.  Otherwise, process the result.
-    if (request->cancelled) {
-      if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-        gpr_log(GPR_INFO,
-                "plugin_credentials[%p]: request %p was cancelled, error "
-                "will be returned asynchronously",
-                this, request);
-      }
-      retval = false;
-    } else {
-      if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-        gpr_log(GPR_INFO,
-                "plugin_credentials[%p]: request %p: plugin returned "
-                "synchronously",
-                this, request);
-      }
-      *error = process_plugin_result(request, creds_md, num_creds_md, status,
-                                     error_details);
-    }
-    // Clean up.
-    for (size_t i = 0; i < num_creds_md; ++i) {
-      grpc_slice_unref_internal(creds_md[i].key);
-      grpc_slice_unref_internal(creds_md[i].value);
-    }
-    gpr_free(const_cast<char*>(error_details));
-    gpr_free(request);
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+grpc_plugin_credentials::GetRequestMetadata(
+    grpc_core::ClientInitialMetadata initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs* args) {
+  if (plugin_.get_metadata == nullptr) {
+    return grpc_core::Immediate(std::move(initial_metadata));
   }
-  return retval;
-}
 
-void grpc_plugin_credentials::cancel_get_request_metadata(
-    grpc_core::CredentialsMetadataArray* md_array, grpc_error_handle error) {
-  gpr_mu_lock(&mu_);
-  for (pending_request* pending_request = pending_requests_;
-       pending_request != nullptr; pending_request = pending_request->next) {
-    if (pending_request->md_array == md_array) {
-      if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
-        gpr_log(GPR_INFO, "plugin_credentials[%p]: cancelling request %p", this,
-                pending_request);
-      }
-      pending_request->cancelled = true;
-      grpc_core::ExecCtx::Run(DEBUG_LOCATION,
-                              pending_request->on_request_metadata,
-                              GRPC_ERROR_REF(error));
-      pending_request_remove_locked(pending_request);
-      break;
+  // Create pending_request object.
+  auto request = grpc_core::MakeRefCounted<PendingRequest>(
+      Ref(), std::move(initial_metadata), args);
+  // Invoke the plugin.  The callback holds a ref to us.
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
+    gpr_log(GPR_INFO, "plugin_credentials[%p]: request %p: invoking plugin",
+            this, request.get());
+  }
+  grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX];
+  size_t num_creds_md = 0;
+  grpc_status_code status = GRPC_STATUS_OK;
+  const char* error_details = nullptr;
+  // Add an extra ref to the request object for the async callback.
+  // If the request completes synchronously, we'll drop this later.
+  // If the request completes asynchronously, it will own a ref to the request
+  // object (which we release from our ownership below).
+  auto child_request = request->Ref();
+  if (!plugin_.get_metadata(plugin_.state, request->context(),
+                            PendingRequest::RequestMetadataReady,
+                            child_request.get(), creds_md, &num_creds_md,
+                            &status, &error_details)) {
+    child_request.release();
+    if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
+      gpr_log(GPR_INFO,
+              "plugin_credentials[%p]: request %p: plugin will return "
+              "asynchronously",
+              this, request.get());
     }
+    return [request] { return request->PollAsyncResult(); };
+  }
+  // Synchronous return.
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_plugin_credentials_trace)) {
+    gpr_log(GPR_INFO,
+            "plugin_credentials[%p]: request %p: plugin returned "
+            "synchronously",
+            this, request.get());
+  }
+  auto result = request->ProcessPluginResult(creds_md, num_creds_md, status,
+                                             error_details);
+  // Clean up.
+  for (size_t i = 0; i < num_creds_md; ++i) {
+    grpc_slice_unref_internal(creds_md[i].key);
+    grpc_slice_unref_internal(creds_md[i].value);
   }
-  gpr_mu_unlock(&mu_);
-  GRPC_ERROR_UNREF(error);
+  gpr_free(const_cast<char*>(error_details));
+
+  return grpc_core::Immediate(std::move(result));
 }
 
 grpc_plugin_credentials::grpc_plugin_credentials(
     grpc_metadata_credentials_plugin plugin,
     grpc_security_level min_security_level)
-    : grpc_call_credentials(plugin.type, min_security_level), plugin_(plugin) {
-  gpr_mu_init(&mu_);
-}
+    : grpc_call_credentials(plugin.type, min_security_level), plugin_(plugin) {}
 
 grpc_call_credentials* grpc_metadata_credentials_create_from_plugin(
     grpc_metadata_credentials_plugin plugin,

data/src/core/lib/security/credentials/plugin/plugin_credentials.h

@@ -21,6 +21,7 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/lib/security/credentials/call_creds_util.h"
 #include "src/core/lib/security/credentials/credentials.h"
 
 extern grpc_core::TraceFlag grpc_plugin_credentials_trace;
@@ -30,44 +31,69 @@ extern grpc_core::TraceFlag grpc_plugin_credentials_trace;
 // -Wmismatched-tags.
 struct grpc_plugin_credentials final : public grpc_call_credentials {
  public:
-  struct pending_request {
-    bool cancelled;
-    struct grpc_plugin_credentials* creds;
-    grpc_core::CredentialsMetadataArray* md_array;
-    grpc_closure* on_request_metadata;
-    struct pending_request* prev;
-    struct pending_request* next;
-  };
-
   explicit grpc_plugin_credentials(grpc_metadata_credentials_plugin plugin,
                                    grpc_security_level min_security_level);
   ~grpc_plugin_credentials() override;
 
-  bool get_request_metadata(grpc_polling_entity* pollent,
-                            grpc_auth_metadata_context context,
-                            grpc_core::CredentialsMetadataArray* md_array,
-                            grpc_closure* on_request_metadata,
-                            grpc_error_handle* error) override;
-
-  void cancel_get_request_metadata(
-      grpc_core::CredentialsMetadataArray* md_array,
-      grpc_error_handle error) override;
-
-  // Checks if the request has been cancelled.
-  // If not, removes it from the pending list, so that it cannot be
-  // cancelled out from under us.
-  // When this returns, r->cancelled indicates whether the request was
-  // cancelled before completion.
-  void pending_request_complete(pending_request* r);
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+  GetRequestMetadata(grpc_core::ClientInitialMetadata initial_metadata,
+                     const GetRequestMetadataArgs* args) override;
 
   std::string debug_string() override;
 
  private:
-  void pending_request_remove_locked(pending_request* pending_request);
+  class PendingRequest : public grpc_core::RefCounted<PendingRequest> {
+   public:
+    PendingRequest(grpc_core::RefCountedPtr<grpc_plugin_credentials> creds,
+                   grpc_core::ClientInitialMetadata initial_metadata,
+                   const grpc_call_credentials::GetRequestMetadataArgs* args)
+        : call_creds_(std::move(creds)),
+          context_(
+              grpc_core::MakePluginAuthMetadataContext(initial_metadata, args)),
+          md_(std::move(initial_metadata)) {}
+
+    ~PendingRequest() override {
+      grpc_auth_metadata_context_reset(&context_);
+      for (size_t i = 0; i < metadata_.size(); i++) {
+        grpc_slice_unref_internal(metadata_[i].key);
+        grpc_slice_unref_internal(metadata_[i].value);
+      }
+    }
+
+    absl::StatusOr<grpc_core::ClientInitialMetadata> ProcessPluginResult(
+        const grpc_metadata* md, size_t num_md, grpc_status_code status,
+        const char* error_details);
+
+    grpc_core::Poll<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+    PollAsyncResult();
+
+    static void RequestMetadataReady(void* request, const grpc_metadata* md,
+                                     size_t num_md, grpc_status_code status,
+                                     const char* error_details);
+
+    grpc_auth_metadata_context context() const { return context_; }
+    grpc_plugin_credentials* creds() const { return call_creds_.get(); }
+
+   private:
+    std::atomic<bool> ready_{false};
+    grpc_core::Waker waker_{
+        grpc_core::Activity::current()->MakeNonOwningWaker()};
+    grpc_core::RefCountedPtr<grpc_plugin_credentials> call_creds_;
+    grpc_auth_metadata_context context_;
+    grpc_core::ClientInitialMetadata md_;
+    // final status
+    absl::InlinedVector<grpc_metadata, 2> metadata_;
+    std::string error_details_;
+    grpc_status_code status_;
+  };
+
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_call_credentials*>(this), other);
+  }
 
   grpc_metadata_credentials_plugin plugin_;
-  gpr_mu mu_;
-  pending_request* pending_requests_ = nullptr;
 };
 
 #endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_PLUGIN_PLUGIN_CREDENTIALS_H */

data/src/core/lib/security/credentials/ssl/ssl_credentials.h

@@ -43,6 +43,12 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
   void set_max_tls_version(grpc_tls_version max_tls_version);
 
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_channel_credentials*>(this), other);
+  }
+
   void build_config(const char* pem_root_certs,
                     grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
                     const grpc_ssl_verify_peer_options* verify_options);
@@ -102,7 +108,4 @@ tsi_ssl_pem_key_cert_pair* grpc_convert_grpc_to_tsi_cert_pairs(
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs);
 
-void grpc_tsi_ssl_pem_key_cert_pairs_destroy(tsi_ssl_pem_key_cert_pair* kp,
-                                             size_t num_key_cert_pairs);
-
 #endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_SSL_SSL_CREDENTIALS_H */

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc

@@ -102,3 +102,22 @@ void grpc_tls_credentials_options_set_check_call_host(
   GPR_ASSERT(options != nullptr);
   options->set_check_call_host(check_call_host);
 }
+
+void grpc_tls_credentials_options_set_tls_session_key_log_file_path(
+    grpc_tls_credentials_options* options, const char* path) {
+  if (!tsi_tls_session_key_logging_supported() || options == nullptr) {
+    return;
+  }
+  GRPC_API_TRACE(
+      "grpc_tls_credentials_options_set_tls_session_key_log_config(options=%p)",
+      1, (options));
+  // Tls session key logging is assumed to be enabled if the specified log
+  // file is non-empty.
+  if (path != nullptr) {
+    gpr_log(GPR_INFO,
+            "Enabling TLS session key logging with keys stored at: %s", path);
+  } else {
+    gpr_log(GPR_INFO, "Disabling TLS session key logging");
+  }
+  options->set_tls_session_key_log_file_path(path != nullptr ? path : "");
+}

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -38,7 +38,6 @@ struct grpc_tls_credentials_options
     : public grpc_core::RefCounted<grpc_tls_credentials_options> {
  public:
   ~grpc_tls_credentials_options() override = default;
-
   // Getters for member fields.
   grpc_ssl_client_certificate_request_type cert_request_type() const {
     return cert_request_type_;
@@ -60,6 +59,10 @@ struct grpc_tls_credentials_options
   const std::string& root_cert_name() { return root_cert_name_; }
   bool watch_identity_pair() { return watch_identity_pair_; }
   const std::string& identity_cert_name() { return identity_cert_name_; }
+  // Returns the previously set tls session key log file path.
+  const std::string& tls_session_key_log_file_path() {
+    return tls_session_key_log_file_path_;
+  }
   const std::string& crl_directory() { return crl_directory_; }
 
   // Setters for member fields.
@@ -112,6 +115,11 @@ struct grpc_tls_credentials_options
   void set_identity_cert_name(std::string identity_cert_name) {
     identity_cert_name_ = std::move(identity_cert_name);
   }
+  // Sets the tls session key log file path.
+  void set_tls_session_key_log_file_path(
+      std::string tls_session_key_log_file_path) {
+    tls_session_key_log_file_path_ = std::move(tls_session_key_log_file_path);
+  }
 
   // gRPC will enforce CRLs on all handshakes from all hashed CRL files inside
   // of the crl_directory. If not set, an empty string will be used, which will
@@ -131,6 +139,7 @@ struct grpc_tls_credentials_options
   std::string root_cert_name_;
   bool watch_identity_pair_ = false;
   std::string identity_cert_name_;
+  std::string tls_session_key_log_file_path_;
   std::string crl_directory_;
 };
 

data/src/core/lib/security/credentials/tls/tls_credentials.h

@@ -41,6 +41,12 @@ class TlsCredentials final : public grpc_channel_credentials {
   grpc_tls_credentials_options* options() const { return options_.get(); }
 
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_channel_credentials*>(this), other);
+  }
+
   grpc_core::RefCountedPtr<grpc_tls_credentials_options> options_;
 };
 

data/src/core/lib/security/credentials/xds/xds_credentials.h

@@ -42,6 +42,11 @@ class XdsCredentials final : public grpc_channel_credentials {
       const grpc_channel_args* args, grpc_channel_args** new_args) override;
 
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    auto* o = static_cast<const XdsCredentials*>(other);
+    return fallback_credentials_->cmp(o->fallback_credentials_.get());
+  }
+
   RefCountedPtr<grpc_channel_credentials> fallback_credentials_;
 };