grpc 1.44.0.pre2 → 1.46.3

data/src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -29,13 +29,12 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.h"
-#include "src/core/ext/transport/chttp2/alpn/alpn.h"
-#include "src/core/ext/xds/xds_channel_args.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/handshaker.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/fake/fake_credentials.h"
@@ -107,10 +106,8 @@ class grpc_fake_channel_security_connector final
         tsi_create_fake_handshaker(/*is_client=*/true), this, args));
   }
 
-  bool check_call_host(absl::string_view host,
-                       grpc_auth_context* /*auth_context*/,
-                       grpc_closure* /*on_call_host_checked*/,
-                       grpc_error_handle* /*error*/) override {
+  grpc_core::ArenaPromise<absl::Status> CheckCallHost(
+      absl::string_view host, grpc_auth_context*) override {
     absl::string_view authority_hostname;
     absl::string_view authority_ignored_port;
     absl::string_view target_hostname;
@@ -136,12 +133,7 @@ class grpc_fake_channel_security_connector final
               target_);
       abort();
     }
-    return true;
-  }
-
-  void cancel_check_call_host(grpc_closure* /*on_call_host_checked*/,
-                              grpc_error_handle error) override {
-    GRPC_ERROR_UNREF(error);
+    return grpc_core::ImmediateOkStatus();
   }
 
   char* target() const { return target_; }

data/src/core/lib/security/security_connector/fake/fake_security_connector.h

@@ -27,8 +27,6 @@
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 
-#define GRPC_FAKE_SECURITY_URL_SCHEME "http+fake_security"
-
 /* Creates a fake connector that emulates real channel security.  */
 grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_fake_channel_security_connector_create(

data/src/core/lib/security/security_connector/insecure/insecure_security_connector.cc

@@ -21,6 +21,7 @@
 #include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h"
 
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
 #include "src/core/tsi/local_transport_security.h"
 
@@ -48,18 +49,9 @@ RefCountedPtr<grpc_auth_context> TestOnlyMakeInsecureAuthContext() {
   return MakeAuthContext();
 }
 
-// check_call_host and cancel_check_call_host are no-ops since we want to
-// provide an insecure channel.
-bool InsecureChannelSecurityConnector::check_call_host(
-    absl::string_view /*host*/, grpc_auth_context* /*auth_context*/,
-    grpc_closure* /*on_call_host_checked*/, grpc_error_handle* error) {
-  *error = GRPC_ERROR_NONE;
-  return true;
-}
-
-void InsecureChannelSecurityConnector::cancel_check_call_host(
-    grpc_closure* /*on_call_host_checked*/, grpc_error_handle error) {
-  GRPC_ERROR_UNREF(error);
+ArenaPromise<absl::Status> InsecureChannelSecurityConnector::CheckCallHost(
+    absl::string_view, grpc_auth_context*) {
+  return ImmediateOkStatus();
 }
 
 // add_handshakers should have been a no-op but we need to add a minimalist
@@ -70,8 +62,7 @@ void InsecureChannelSecurityConnector::add_handshakers(
     HandshakeManager* handshake_manager) {
   tsi_handshaker* handshaker = nullptr;
   // Re-use local_tsi_handshaker_create as a minimalist handshaker.
-  GPR_ASSERT(tsi_local_handshaker_create(true /* is_client */, &handshaker) ==
-             TSI_OK);
+  GPR_ASSERT(tsi_local_handshaker_create(&handshaker) == TSI_OK);
   handshake_manager->Add(SecurityHandshakerCreate(handshaker, this, args));
 }
 
@@ -98,8 +89,7 @@ void InsecureServerSecurityConnector::add_handshakers(
     HandshakeManager* handshake_manager) {
   tsi_handshaker* handshaker = nullptr;
   // Re-use local_tsi_handshaker_create as a minimalist handshaker.
-  GPR_ASSERT(tsi_local_handshaker_create(false /* is_client */, &handshaker) ==
-             TSI_OK);
+  GPR_ASSERT(tsi_local_handshaker_create(&handshaker) == TSI_OK);
   handshake_manager->Add(SecurityHandshakerCreate(handshaker, this, args));
 }
 

data/src/core/lib/security/security_connector/insecure/insecure_security_connector.h

@@ -41,16 +41,11 @@ class InsecureChannelSecurityConnector
   InsecureChannelSecurityConnector(
       RefCountedPtr<grpc_channel_credentials> channel_creds,
       RefCountedPtr<grpc_call_credentials> request_metadata_creds)
-      : grpc_channel_security_connector(/* url_scheme */ nullptr,
-                                        std::move(channel_creds),
+      : grpc_channel_security_connector("", std::move(channel_creds),
                                         std::move(request_metadata_creds)) {}
 
-  bool check_call_host(absl::string_view host, grpc_auth_context* auth_context,
-                       grpc_closure* on_call_host_checked,
-                       grpc_error_handle* error) override;
-
-  void cancel_check_call_host(grpc_closure* on_call_host_checked,
-                              grpc_error_handle error) override;
+  ArenaPromise<absl::Status> CheckCallHost(
+      absl::string_view host, grpc_auth_context* auth_context) override;
 
   void add_handshakers(const grpc_channel_args* args,
                        grpc_pollset_set* /* interested_parties */,
@@ -72,7 +67,7 @@ class InsecureServerSecurityConnector : public grpc_server_security_connector {
  public:
   explicit InsecureServerSecurityConnector(
       RefCountedPtr<grpc_server_credentials> server_creds)
-      : grpc_server_security_connector(nullptr /* url_scheme */,
+      : grpc_server_security_connector("" /* url_scheme */,
                                        std::move(server_creds)) {}
 
   void add_handshakers(const grpc_channel_args* args,

data/src/core/lib/security/security_connector/local/local_security_connector.cc

@@ -38,6 +38,7 @@
 #include "src/core/lib/iomgr/sockaddr.h"
 #include "src/core/lib/iomgr/socket_utils.h"
 #include "src/core/lib/iomgr/unix_sockets_posix.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/credentials/local/local_credentials.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
 #include "src/core/lib/uri/uri_parser.h"
@@ -151,7 +152,7 @@ class grpc_local_channel_security_connector final
       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
       const char* target_name)
-      : grpc_channel_security_connector(nullptr, std::move(channel_creds),
+      : grpc_channel_security_connector({}, std::move(channel_creds),
                                         std::move(request_metadata_creds)),
         target_name_(gpr_strdup(target_name)) {}
 
@@ -161,8 +162,7 @@ class grpc_local_channel_security_connector final
       const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
       grpc_core::HandshakeManager* handshake_manager) override {
     tsi_handshaker* handshaker = nullptr;
-    GPR_ASSERT(tsi_local_handshaker_create(true /* is_client */, &handshaker) ==
-               TSI_OK);
+    GPR_ASSERT(tsi_local_handshaker_create(&handshaker) == TSI_OK);
     handshake_manager->Add(
         grpc_core::SecurityHandshakerCreate(handshaker, this, args));
   }
@@ -190,20 +190,13 @@ class grpc_local_channel_security_connector final
     GRPC_ERROR_UNREF(error);
   }
 
-  bool check_call_host(absl::string_view host,
-                       grpc_auth_context* /*auth_context*/,
-                       grpc_closure* /*on_call_host_checked*/,
-                       grpc_error_handle* error) override {
+  grpc_core::ArenaPromise<absl::Status> CheckCallHost(
+      absl::string_view host, grpc_auth_context*) override {
     if (host.empty() || host != target_name_) {
-      *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-          "local call host does not match target name");
+      return grpc_core::Immediate(absl::UnauthenticatedError(
+          "local call host does not match target name"));
     }
-    return true;
-  }
-
-  void cancel_check_call_host(grpc_closure* /*on_call_host_checked*/,
-                              grpc_error_handle error) override {
-    GRPC_ERROR_UNREF(error);
+    return grpc_core::ImmediateOkStatus();
   }
 
   const char* target_name() const { return target_name_; }
@@ -217,15 +210,14 @@ class grpc_local_server_security_connector final
  public:
   explicit grpc_local_server_security_connector(
       grpc_core::RefCountedPtr<grpc_server_credentials> server_creds)
-      : grpc_server_security_connector(nullptr, std::move(server_creds)) {}
+      : grpc_server_security_connector({}, std::move(server_creds)) {}
   ~grpc_local_server_security_connector() override = default;
 
   void add_handshakers(
       const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
       grpc_core::HandshakeManager* handshake_manager) override {
     tsi_handshaker* handshaker = nullptr;
-    GPR_ASSERT(tsi_local_handshaker_create(false /* is_client */,
-                                           &handshaker) == TSI_OK);
+    GPR_ASSERT(tsi_local_handshaker_create(&handshaker) == TSI_OK);
     handshake_manager->Add(
         grpc_core::SecurityHandshakerCreate(handshaker, this, args));
   }

data/src/core/lib/security/security_connector/security_connector.cc

@@ -37,7 +37,7 @@ grpc_core::DebugOnlyTraceFlag grpc_trace_security_connector_refcount(
     false, "security_connector_refcount");
 
 grpc_server_security_connector::grpc_server_security_connector(
-    const char* url_scheme,
+    absl::string_view url_scheme,
     grpc_core::RefCountedPtr<grpc_server_credentials> server_creds)
     : grpc_security_connector(url_scheme),
       server_creds_(std::move(server_creds)) {}
@@ -45,7 +45,7 @@ grpc_server_security_connector::grpc_server_security_connector(
 grpc_server_security_connector::~grpc_server_security_connector() = default;
 
 grpc_channel_security_connector::grpc_channel_security_connector(
-    const char* url_scheme,
+    absl::string_view url_scheme,
     grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds)
     : grpc_security_connector(url_scheme),
@@ -54,21 +54,13 @@ grpc_channel_security_connector::grpc_channel_security_connector(
 
 grpc_channel_security_connector::~grpc_channel_security_connector() {}
 
-int grpc_security_connector_cmp(const grpc_security_connector* sc,
-                                const grpc_security_connector* other) {
-  if (sc == nullptr || other == nullptr) {
-    return grpc_core::QsortCompare(sc, other);
-  }
-  return sc->cmp(other);
-}
-
 int grpc_channel_security_connector::channel_security_connector_cmp(
     const grpc_channel_security_connector* other) const {
   const grpc_channel_security_connector* other_sc =
       static_cast<const grpc_channel_security_connector*>(other);
   GPR_ASSERT(channel_creds() != nullptr);
   GPR_ASSERT(other_sc->channel_creds() != nullptr);
-  int c = grpc_core::QsortCompare(channel_creds(), other_sc->channel_creds());
+  int c = channel_creds()->cmp(other_sc->channel_creds());
   if (c != 0) return c;
   return grpc_core::QsortCompare(request_metadata_creds(),
                                  other_sc->request_metadata_creds());

data/src/core/lib/security/security_connector/security_connector.h

@@ -30,6 +30,7 @@
 #include "src/core/lib/iomgr/endpoint.h"
 #include "src/core/lib/iomgr/pollset.h"
 #include "src/core/lib/iomgr/tcp_server.h"
+#include "src/core/lib/promise/arena_promise.h"
 #include "src/core/tsi/transport_security_interface.h"
 
 extern grpc_core::DebugOnlyTraceFlag grpc_trace_security_connector_refcount;
@@ -51,7 +52,7 @@ typedef enum { GRPC_SECURITY_OK = 0, GRPC_SECURITY_ERROR } grpc_security_status;
 class grpc_security_connector
     : public grpc_core::RefCounted<grpc_security_connector> {
  public:
-  explicit grpc_security_connector(const char* url_scheme)
+  explicit grpc_security_connector(absl::string_view url_scheme)
       : grpc_core::RefCounted<grpc_security_connector>(
             GRPC_TRACE_FLAG_ENABLED(grpc_trace_security_connector_refcount)
                 ? "security_connector_refcount"
@@ -59,6 +60,10 @@ class grpc_security_connector
         url_scheme_(url_scheme) {}
   ~grpc_security_connector() override = default;
 
+  static absl::string_view ChannelArgName() {
+    return GRPC_ARG_SECURITY_CONNECTOR;
+  }
+
   // Checks the peer. Callee takes ownership of the peer object.
   // When done, sets *auth_context and invokes on_peer_checked.
   virtual void check_peer(
@@ -74,10 +79,15 @@ class grpc_security_connector
   /* Compares two security connectors. */
   virtual int cmp(const grpc_security_connector* other) const = 0;
 
-  const char* url_scheme() const { return url_scheme_; }
+  static int ChannelArgsCompare(const grpc_security_connector* a,
+                                const grpc_security_connector* b) {
+    return a->cmp(b);
+  }
+
+  absl::string_view url_scheme() const { return url_scheme_; }
 
  private:
-  const char* url_scheme_;
+  absl::string_view url_scheme_;
 };
 
 /* Util to encapsulate the connector in a channel arg. */
@@ -98,26 +108,16 @@ grpc_security_connector* grpc_security_connector_find_in_args(
 class grpc_channel_security_connector : public grpc_security_connector {
  public:
   grpc_channel_security_connector(
-      const char* url_scheme,
+      absl::string_view url_scheme,
       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
-      grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds
-      /*,
-      grpc_channel_args* channel_args = nullptr*/);
+      grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds);
   ~grpc_channel_security_connector() override;
 
   /// Checks that the host that will be set for a call is acceptable.
-  /// Returns true if completed synchronously, in which case \a error will
-  /// be set to indicate the result.  Otherwise, \a on_call_host_checked
-  /// will be invoked when complete.
-  virtual bool check_call_host(absl::string_view host,
-                               grpc_auth_context* auth_context,
-                               grpc_closure* on_call_host_checked,
-                               grpc_error_handle* error) = 0;
-  /// Cancels a pending asynchronous call to
-  /// grpc_channel_security_connector_check_call_host() with
-  /// \a on_call_host_checked as its callback.
-  virtual void cancel_check_call_host(grpc_closure* on_call_host_checked,
-                                      grpc_error_handle error) = 0;
+  /// Returns ok if the host is acceptable, otherwise returns an error.
+  virtual grpc_core::ArenaPromise<absl::Status> CheckCallHost(
+      absl::string_view host, grpc_auth_context* auth_context) = 0;
+
   /// Registers handshakers with \a handshake_mgr.
   virtual void add_handshakers(const grpc_channel_args* args,
                                grpc_pollset_set* interested_parties,
@@ -160,7 +160,7 @@ class grpc_channel_security_connector : public grpc_security_connector {
 class grpc_server_security_connector : public grpc_security_connector {
  public:
   grpc_server_security_connector(
-      const char* url_scheme,
+      absl::string_view url_scheme,
       grpc_core::RefCountedPtr<grpc_server_credentials> server_creds);
   ~grpc_server_security_connector() override;
 

data/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc

@@ -35,6 +35,7 @@
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/sync.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/ssl/ssl_credentials.h"
@@ -128,7 +129,8 @@ class grpc_ssl_channel_security_connector final
         client_handshaker_factory_,
         overridden_target_name_.empty() ? target_name_.c_str()
                                         : overridden_target_name_.c_str(),
-        &tsi_hs);
+        /*network_bio_buf_size=*/0,
+        /*ssl_bio_buf_size=*/0, &tsi_hs);
     if (result != TSI_OK) {
       gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
               tsi_result_to_string(result));
@@ -185,17 +187,11 @@ class grpc_ssl_channel_security_connector final
     return overridden_target_name_.compare(other->overridden_target_name_);
   }
 
-  bool check_call_host(absl::string_view host, grpc_auth_context* auth_context,
-                       grpc_closure* /*on_call_host_checked*/,
-                       grpc_error_handle* error) override {
-    return grpc_ssl_check_call_host(host, target_name_.c_str(),
-                                    overridden_target_name_.c_str(),
-                                    auth_context, error);
-  }
-
-  void cancel_check_call_host(grpc_closure* /*on_call_host_checked*/,
-                              grpc_error_handle error) override {
-    GRPC_ERROR_UNREF(error);
+  grpc_core::ArenaPromise<absl::Status> CheckCallHost(
+      absl::string_view host, grpc_auth_context* auth_context) override {
+    return grpc_core::Immediate(
+        SslCheckCallHost(host, target_name_.c_str(),
+                         overridden_target_name_.c_str(), auth_context));
   }
 
  private:
@@ -277,7 +273,8 @@ class grpc_ssl_server_security_connector
     try_fetch_ssl_server_credentials();
     tsi_handshaker* tsi_hs = nullptr;
     tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
-        server_handshaker_factory_, &tsi_hs);
+        server_handshaker_factory_, /*network_bio_buf_size=*/0,
+        /*ssl_bio_buf_size=*/0, &tsi_hs);
     if (result != TSI_OK) {
       gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
               tsi_result_to_string(result));

data/src/core/lib/security/security_connector/ssl_utils.cc

@@ -165,11 +165,12 @@ void grpc_tsi_ssl_pem_key_cert_pairs_destroy(tsi_ssl_pem_key_cert_pair* kp,
   gpr_free(kp);
 }
 
-bool grpc_ssl_check_call_host(absl::string_view host,
+namespace grpc_core {
+
+absl::Status SslCheckCallHost(absl::string_view host,
                               absl::string_view target_name,
                               absl::string_view overridden_target_name,
-                              grpc_auth_context* auth_context,
-                              grpc_error_handle* error) {
+                              grpc_auth_context* auth_context) {
   grpc_security_status status = GRPC_SECURITY_ERROR;
   tsi_peer peer = grpc_shallow_peer_from_ssl_auth_context(auth_context);
   if (grpc_ssl_host_matches_name(&peer, host)) status = GRPC_SECURITY_OK;
@@ -180,14 +181,17 @@ bool grpc_ssl_check_call_host(absl::string_view host,
     status = GRPC_SECURITY_OK;
   }
   if (status != GRPC_SECURITY_OK) {
-    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "call host does not match SSL server name");
     gpr_log(GPR_ERROR, "call host does not match SSL server name");
+    grpc_shallow_peer_destruct(&peer);
+    return absl::UnauthenticatedError(
+        "call host does not match SSL server name");
   }
   grpc_shallow_peer_destruct(&peer);
-  return true;
+  return absl::OkStatus();
 }
 
+}  // namespace grpc_core
+
 const char** grpc_fill_alpn_protocol_strings(size_t* num_alpn_protocols) {
   GPR_ASSERT(num_alpn_protocols != nullptr);
   *num_alpn_protocols = grpc_chttp2_num_alpn_versions();
@@ -233,7 +237,7 @@ static bool IsSpiffeId(absl::string_view uri) {
     return false;
   }
   std::vector<absl::string_view> splits = absl::StrSplit(uri, '/');
-  if (splits.size() < 4 || splits[3] == "") {
+  if (splits.size() < 4 || splits[3].empty()) {
     gpr_log(GPR_INFO, "Invalid SPIFFE ID: workload id is empty.");
     return false;
   }
@@ -409,6 +413,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
     tsi_ssl_pem_key_cert_pair* pem_key_cert_pair, const char* pem_root_certs,
     bool skip_server_certificate_verification, tsi_tls_version min_tls_version,
     tsi_tls_version max_tls_version, tsi_ssl_session_cache* ssl_session_cache,
+    tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory,
     tsi_ssl_client_handshaker_factory** handshaker_factory) {
   const char* root_certs;
@@ -442,6 +447,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
   }
   options.cipher_suites = grpc_get_ssl_cipher_suites();
   options.session_cache = ssl_session_cache;
+  options.key_logger = tls_session_key_logger;
   options.skip_server_certificate_verification =
       skip_server_certificate_verification;
   options.min_tls_version = min_tls_version;
@@ -464,6 +470,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
     const char* pem_root_certs,
     grpc_ssl_client_certificate_request_type client_certificate_request,
     tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
+    tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory,
     tsi_ssl_server_handshaker_factory** handshaker_factory) {
   size_t num_alpn_protocols = 0;
@@ -480,6 +487,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
   options.num_alpn_protocols = static_cast<uint16_t>(num_alpn_protocols);
   options.min_tls_version = min_tls_version;
   options.max_tls_version = max_tls_version;
+  options.key_logger = tls_session_key_logger;
   options.crl_directory = crl_directory;
   const tsi_result result =
       tsi_create_ssl_server_handshaker_factory_with_options(&options,

data/src/core/lib/security/security_connector/ssl_utils.h

@@ -51,12 +51,15 @@ int grpc_ssl_cmp_target_name(absl::string_view target_name,
                              absl::string_view other_target_name,
                              absl::string_view overridden_target_name,
                              absl::string_view other_overridden_target_name);
+
+namespace grpc_core {
 /* Check the host that will be set for a call is acceptable.*/
-bool grpc_ssl_check_call_host(absl::string_view host,
+absl::Status SslCheckCallHost(absl::string_view host,
                               absl::string_view target_name,
                               absl::string_view overridden_target_name,
-                              grpc_auth_context* auth_context,
-                              grpc_error_handle* error);
+                              grpc_auth_context* auth_context);
+}  // namespace grpc_core
+
 /* Return HTTP2-compliant cipher suites that gRPC accepts by default. */
 const char* grpc_get_ssl_cipher_suites(void);
 
@@ -77,6 +80,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
     tsi_ssl_pem_key_cert_pair* key_cert_pair, const char* pem_root_certs,
     bool skip_server_certificate_verification, tsi_tls_version min_tls_version,
     tsi_tls_version max_tls_version, tsi_ssl_session_cache* ssl_session_cache,
+    tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory,
     tsi_ssl_client_handshaker_factory** handshaker_factory);
 
@@ -85,6 +89,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
     const char* pem_root_certs,
     grpc_ssl_client_certificate_request_type client_certificate_request,
     tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
+    tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory,
     tsi_ssl_server_handshaker_factory** handshaker_factory);
 

data/src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -34,6 +34,7 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/gprpp/host_port.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/credentials/tls/tls_credentials.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
@@ -262,6 +263,12 @@ TlsChannelSecurityConnector::TlsChannelSecurityConnector(
       overridden_target_name_(
           overridden_target_name == nullptr ? "" : overridden_target_name),
       ssl_session_cache_(ssl_session_cache) {
+  const std::string& tls_session_key_log_file_path =
+      options_->tls_session_key_log_file_path();
+  if (!tls_session_key_log_file_path.empty()) {
+    tls_session_key_logger_ =
+        tsi::TlsSessionKeyLoggerCache::Get(tls_session_key_log_file_path);
+  }
   if (ssl_session_cache_ != nullptr) {
     tsi_ssl_session_cache_ref(ssl_session_cache_);
   }
@@ -325,7 +332,8 @@ void TlsChannelSecurityConnector::add_handshakers(
         client_handshaker_factory_,
         overridden_target_name_.empty() ? target_name_.c_str()
                                         : overridden_target_name_.c_str(),
-        &tsi_hs);
+        /*network_bio_buf_size=*/0,
+        /*ssl_bio_buf_size=*/0, &tsi_hs);
     if (result != TSI_OK) {
       gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
               tsi_result_to_string(result));
@@ -402,20 +410,14 @@ int TlsChannelSecurityConnector::cmp(
   return 0;
 }
 
-bool TlsChannelSecurityConnector::check_call_host(
-    absl::string_view host, grpc_auth_context* auth_context,
-    grpc_closure* /*on_call_host_checked*/, grpc_error_handle* error) {
+ArenaPromise<absl::Status> TlsChannelSecurityConnector::CheckCallHost(
+    absl::string_view host, grpc_auth_context* auth_context) {
   if (options_->check_call_host()) {
-    return grpc_ssl_check_call_host(host, target_name_.c_str(),
-                                    overridden_target_name_.c_str(),
-                                    auth_context, error);
+    return Immediate(SslCheckCallHost(host, target_name_.c_str(),
+                                      overridden_target_name_.c_str(),
+                                      auth_context));
   }
-  return true;
-}
-
-void TlsChannelSecurityConnector::cancel_check_call_host(
-    grpc_closure* /*on_call_host_checked*/, grpc_error_handle error) {
-  GRPC_ERROR_UNREF(error);
+  return ImmediateOkStatus();
 }
 
 void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
@@ -537,7 +539,8 @@ TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
       skip_server_certificate_verification,
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()), ssl_session_cache_,
-      options_->crl_directory().c_str(), &client_handshaker_factory_);
+      tls_session_key_logger_.get(), options_->crl_directory().c_str(),
+      &client_handshaker_factory_);
   /* Free memory. */
   if (pem_key_cert_pair != nullptr) {
     grpc_tsi_ssl_pem_key_cert_pairs_destroy(pem_key_cert_pair, 1);
@@ -572,6 +575,12 @@ TlsServerSecurityConnector::TlsServerSecurityConnector(
     : grpc_server_security_connector(GRPC_SSL_URL_SCHEME,
                                      std::move(server_creds)),
       options_(std::move(options)) {
+  const std::string& tls_session_key_log_file_path =
+      options_->tls_session_key_log_file_path();
+  if (!tls_session_key_log_file_path.empty()) {
+    tls_session_key_logger_ =
+        tsi::TlsSessionKeyLoggerCache::Get(tls_session_key_log_file_path);
+  }
   // Create a watcher.
   auto watcher_ptr = absl::make_unique<TlsServerCertificateWatcher>(this);
   certificate_watcher_ = watcher_ptr.get();
@@ -610,7 +619,8 @@ void TlsServerSecurityConnector::add_handshakers(
   if (server_handshaker_factory_ != nullptr) {
     // Instantiate TSI handshaker.
     tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
-        server_handshaker_factory_, &tsi_hs);
+        server_handshaker_factory_, /*network_bio_buf_size=*/0,
+        /*ssl_bio_buf_size=*/0, &tsi_hs);
     if (result != TSI_OK) {
       gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
               tsi_result_to_string(result));
@@ -805,7 +815,8 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
       options_->cert_request_type(),
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()),
-      options_->crl_directory().c_str(), &server_handshaker_factory_);
+      tls_session_key_logger_.get(), options_->crl_directory().c_str(),
+      &server_handshaker_factory_);
   /* Free memory. */
   grpc_tsi_ssl_pem_key_cert_pairs_destroy(pem_key_cert_pairs,
                                           num_key_cert_pairs);

data/src/core/lib/security/security_connector/tls/tls_security_connector.h

@@ -28,6 +28,8 @@
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 
+using TlsSessionKeyLogger = tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger;
+
 namespace grpc_core {
 
 // Channel security connector using TLS as transport security protocol.
@@ -65,12 +67,8 @@ class TlsChannelSecurityConnector final
 
   int cmp(const grpc_security_connector* other_sc) const override;
 
-  bool check_call_host(absl::string_view host, grpc_auth_context* auth_context,
-                       grpc_closure* on_call_host_checked,
-                       grpc_error_handle* error) override;
-
-  void cancel_check_call_host(grpc_closure* on_call_host_checked,
-                              grpc_error_handle error) override;
+  ArenaPromise<absl::Status> CheckCallHost(
+      absl::string_view host, grpc_auth_context* auth_context) override;
 
   tsi_ssl_client_handshaker_factory* ClientHandshakerFactoryForTesting() {
     MutexLock lock(&mu_);
@@ -147,6 +145,7 @@ class TlsChannelSecurityConnector final
   tsi_ssl_client_handshaker_factory* client_handshaker_factory_
       ABSL_GUARDED_BY(mu_) = nullptr;
   tsi_ssl_session_cache* ssl_session_cache_ ABSL_GUARDED_BY(mu_) = nullptr;
+  RefCountedPtr<TlsSessionKeyLogger> tls_session_key_logger_;
   absl::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
   absl::optional<PemKeyCertPairList> pem_key_cert_pair_list_
       ABSL_GUARDED_BY(mu_);
@@ -257,6 +256,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
   absl::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
   absl::optional<PemKeyCertPairList> pem_key_cert_pair_list_
       ABSL_GUARDED_BY(mu_);
+  RefCountedPtr<TlsSessionKeyLogger> tls_session_key_logger_;
   std::map<grpc_closure* /*on_peer_checked*/, ServerPendingVerifierRequest*>
       pending_verifier_requests_ ABSL_GUARDED_BY(verifier_request_map_mu_);
 };