grpc 1.45.0 → 1.46.2

data/src/core/lib/security/credentials/iam/iam_credentials.cc

@@ -31,9 +31,9 @@
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/surface/api_trace.h"
 
-grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
 grpc_google_iam_credentials::GetRequestMetadata(
-    grpc_core::ClientInitialMetadata initial_metadata,
+    grpc_core::ClientMetadataHandle initial_metadata,
     const grpc_call_credentials::GetRequestMetadataArgs*) {
   if (token_.has_value()) {
     initial_metadata->Append(
@@ -48,8 +48,7 @@ grpc_google_iam_credentials::GetRequestMetadata(
 
 grpc_google_iam_credentials::grpc_google_iam_credentials(
     const char* token, const char* authority_selector)
-    : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_IAM),
-      token_(token == nullptr ? absl::optional<grpc_core::Slice>()
+    : token_(token == nullptr ? absl::optional<grpc_core::Slice>()
                               : grpc_core::Slice::FromCopiedString(token)),
       authority_selector_(
           grpc_core::Slice::FromCopiedString(authority_selector)),
@@ -57,6 +56,8 @@ grpc_google_iam_credentials::grpc_google_iam_credentials(
           "GoogleIAMCredentials{Token:%s,AuthoritySelector:%s}",
           token != nullptr ? "present" : "absent", authority_selector)) {}
 
+const char* grpc_google_iam_credentials::Type() { return "Iam"; }
+
 grpc_call_credentials* grpc_google_iam_credentials_create(
     const char* token, const char* authority_selector, void* reserved) {
   grpc_core::ExecCtx exec_ctx;

data/src/core/lib/security/credentials/iam/iam_credentials.h

@@ -30,12 +30,16 @@ class grpc_google_iam_credentials : public grpc_call_credentials {
   grpc_google_iam_credentials(const char* token,
                               const char* authority_selector);
 
-  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
-  GetRequestMetadata(grpc_core::ClientInitialMetadata initial_metadata,
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
                      const GetRequestMetadataArgs* args) override;
 
   std::string debug_string() override { return debug_string_; }
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
  private:
   int cmp_impl(const grpc_call_credentials* other) const override {
     // TODO(yashykt): Check if we can do something better here

data/src/core/lib/security/credentials/insecure/insecure_credentials.cc

@@ -18,44 +18,37 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/insecure/insecure_credentials.h"
+
 #include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h"
 
 namespace grpc_core {
-namespace {
 
-class InsecureCredentials final : public grpc_channel_credentials {
- public:
-  InsecureCredentials()
-      : grpc_channel_credentials(GRPC_CREDENTIALS_TYPE_INSECURE) {}
+RefCountedPtr<grpc_channel_security_connector>
+InsecureCredentials::create_security_connector(
+    RefCountedPtr<grpc_call_credentials> request_metadata_creds,
+    const char* /* target_name */, const grpc_channel_args* /* args */,
+    grpc_channel_args** /* new_args */) {
+  return MakeRefCounted<InsecureChannelSecurityConnector>(
+      Ref(), std::move(request_metadata_creds));
+}
 
-  RefCountedPtr<grpc_channel_security_connector> create_security_connector(
-      RefCountedPtr<grpc_call_credentials> call_creds,
-      const char* /* target_name */, const grpc_channel_args* /* args */,
-      grpc_channel_args** /* new_args */) override {
-    return MakeRefCounted<InsecureChannelSecurityConnector>(
-        Ref(), std::move(call_creds));
-  }
+const char* InsecureCredentials::Type() { return "Insecure"; }
 
- private:
-  int cmp_impl(const grpc_channel_credentials* /* other */) const override {
-    // All insecure credentials objects should compare equal.
-    return 0;
-  }
-};
+int InsecureCredentials::cmp_impl(
+    const grpc_channel_credentials* /* other */) const {
+  // All insecure credentials objects should compare equal.
+  return 0;
+}
 
-class InsecureServerCredentials final : public grpc_server_credentials {
- public:
-  InsecureServerCredentials()
-      : grpc_server_credentials(GRPC_CREDENTIALS_TYPE_INSECURE) {}
+RefCountedPtr<grpc_server_security_connector>
+InsecureServerCredentials::create_security_connector(
+    const grpc_channel_args* /* args */) {
+  return MakeRefCounted<InsecureServerSecurityConnector>(Ref());
+}
 
-  RefCountedPtr<grpc_server_security_connector> create_security_connector(
-      const grpc_channel_args* /* args */) override {
-    return MakeRefCounted<InsecureServerSecurityConnector>(Ref());
-  }
-};
+const char* InsecureServerCredentials::Type() { return "Insecure"; }
 
-}  // namespace
 }  // namespace grpc_core
 
 grpc_channel_credentials* grpc_insecure_credentials_create() {

data/src/core/lib/security/credentials/insecure/insecure_credentials.h

@@ -0,0 +1,57 @@
+//
+//
+// Copyright 2022 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/security/credentials/credentials.h"
+
+namespace grpc_core {
+
+class InsecureCredentials final : public grpc_channel_credentials {
+ public:
+  RefCountedPtr<grpc_channel_security_connector> create_security_connector(
+      RefCountedPtr<grpc_call_credentials> request_metadata_creds,
+      const char* /* target_name */, const grpc_channel_args* /* args */,
+      grpc_channel_args** /* new_args */) override;
+
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
+ private:
+  int cmp_impl(const grpc_channel_credentials* other) const override;
+};
+
+class InsecureServerCredentials final : public grpc_server_credentials {
+ public:
+  RefCountedPtr<grpc_server_security_connector> create_security_connector(
+      const grpc_channel_args* /* args */) override;
+
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H

data/src/core/lib/security/credentials/jwt/jwt_credentials.cc

@@ -49,9 +49,9 @@ grpc_service_account_jwt_access_credentials::
   gpr_mu_destroy(&cache_mu_);
 }
 
-grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
 grpc_service_account_jwt_access_credentials::GetRequestMetadata(
-    grpc_core::ClientInitialMetadata initial_metadata,
+    grpc_core::ClientMetadataHandle initial_metadata,
     const grpc_call_credentials::GetRequestMetadataArgs* args) {
   gpr_timespec refresh_threshold = gpr_time_from_seconds(
       GRPC_SECURE_TOKEN_REFRESH_THRESHOLD_SECS, GPR_TIMESPAN);
@@ -106,7 +106,7 @@ grpc_service_account_jwt_access_credentials::GetRequestMetadata(
 grpc_service_account_jwt_access_credentials::
     grpc_service_account_jwt_access_credentials(grpc_auth_json_key key,
                                                 gpr_timespec token_lifetime)
-    : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_JWT), key_(key) {
+    : key_(key) {
   gpr_timespec max_token_lifetime = grpc_max_auth_token_lifetime();
   if (gpr_time_cmp(token_lifetime, max_token_lifetime) > 0) {
     gpr_log(GPR_INFO,
@@ -118,6 +118,10 @@ grpc_service_account_jwt_access_credentials::
   gpr_mu_init(&cache_mu_);
 }
 
+const char* grpc_service_account_jwt_access_credentials::Type() {
+  return "Jwt";
+}
+
 grpc_core::RefCountedPtr<grpc_call_credentials>
 grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
     grpc_auth_json_key key, gpr_timespec token_lifetime) {

data/src/core/lib/security/credentials/jwt/jwt_credentials.h

@@ -38,8 +38,8 @@ class grpc_service_account_jwt_access_credentials
                                               gpr_timespec token_lifetime);
   ~grpc_service_account_jwt_access_credentials() override;
 
-  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
-  GetRequestMetadata(grpc_core::ClientInitialMetadata initial_metadata,
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
                      const GetRequestMetadataArgs* args) override;
 
   const gpr_timespec& jwt_lifetime() const { return jwt_lifetime_; }
@@ -52,6 +52,10 @@ class grpc_service_account_jwt_access_credentials
             static_cast<int64_t>(gpr_timespec_to_micros(jwt_lifetime_)))));
   };
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
  private:
   int cmp_impl(const grpc_call_credentials* other) const override {
     // TODO(yashykt): Check if we can do something better here

data/src/core/lib/security/credentials/local/local_credentials.cc

@@ -27,8 +27,6 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/security/security_connector/local/local_security_connector.h"
 
-#define GRPC_CREDENTIALS_TYPE_LOCAL "Local"
-
 grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_local_credentials::create_security_connector(
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
@@ -38,16 +36,19 @@ grpc_local_credentials::create_security_connector(
       this->Ref(), std::move(request_metadata_creds), args, target_name);
 }
 
+const char* grpc_local_credentials::type() const { return "Local"; }
+
 grpc_core::RefCountedPtr<grpc_server_security_connector>
 grpc_local_server_credentials::create_security_connector(
     const grpc_channel_args* /* args */) {
   return grpc_local_server_security_connector_create(this->Ref());
 }
 
+const char* grpc_local_server_credentials::type() const { return "Local"; }
+
 grpc_local_credentials::grpc_local_credentials(
     grpc_local_connect_type connect_type)
-    : grpc_channel_credentials(GRPC_CREDENTIALS_TYPE_LOCAL),
-      connect_type_(connect_type) {}
+    : connect_type_(connect_type) {}
 
 grpc_channel_credentials* grpc_local_credentials_create(
     grpc_local_connect_type connect_type) {
@@ -56,8 +57,7 @@ grpc_channel_credentials* grpc_local_credentials_create(
 
 grpc_local_server_credentials::grpc_local_server_credentials(
     grpc_local_connect_type connect_type)
-    : grpc_server_credentials(GRPC_CREDENTIALS_TYPE_LOCAL),
-      connect_type_(connect_type) {}
+    : connect_type_(connect_type) {}
 
 grpc_server_credentials* grpc_local_server_credentials_create(
     grpc_local_connect_type connect_type) {

data/src/core/lib/security/credentials/local/local_credentials.h

@@ -37,6 +37,8 @@ class grpc_local_credentials final : public grpc_channel_credentials {
       const char* target_name, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
+  const char* type() const override;
+
   grpc_local_connect_type connect_type() const { return connect_type_; }
 
  private:
@@ -58,6 +60,8 @@ class grpc_local_server_credentials final : public grpc_server_credentials {
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_channel_args* /* args */) override;
 
+  const char* type() const override;
+
   grpc_local_connect_type connect_type() const { return connect_type_; }
 
  private:

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -281,9 +281,9 @@ void grpc_oauth2_token_fetcher_credentials::on_http_response(
   delete r;
 }
 
-grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
 grpc_oauth2_token_fetcher_credentials::GetRequestMetadata(
-    grpc_core::ClientInitialMetadata initial_metadata,
+    grpc_core::ClientMetadataHandle initial_metadata,
     const grpc_call_credentials::GetRequestMetadataArgs*) {
   // Check if we can use the cached token.
   absl::optional<grpc_core::Slice> cached_access_token_value;
@@ -328,7 +328,7 @@ grpc_oauth2_token_fetcher_credentials::GetRequestMetadata(
   }
   return
       [pending_request]()
-          -> grpc_core::Poll<absl::StatusOr<grpc_core::ClientInitialMetadata>> {
+          -> grpc_core::Poll<absl::StatusOr<grpc_core::ClientMetadataHandle>> {
         if (!pending_request->done.load(std::memory_order_acquire)) {
           return grpc_core::Pending{};
         }
@@ -337,8 +337,7 @@ grpc_oauth2_token_fetcher_credentials::GetRequestMetadata(
 }
 
 grpc_oauth2_token_fetcher_credentials::grpc_oauth2_token_fetcher_credentials()
-    : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_OAUTH2),
-      token_expiration_(gpr_inf_past(GPR_CLOCK_MONOTONIC)),
+    : token_expiration_(gpr_inf_past(GPR_CLOCK_MONOTONIC)),
       pollent_(grpc_polling_entity_create_from_pollset_set(
           grpc_pollset_set_create())) {
   gpr_mu_init(&mu_);
@@ -348,6 +347,10 @@ std::string grpc_oauth2_token_fetcher_credentials::debug_string() {
   return "OAuth2TokenFetcherCredentials";
 }
 
+const char* grpc_oauth2_token_fetcher_credentials::type() const {
+  return "Oauth2";
+}
+
 //
 //  Google Compute Engine credentials.
 //
@@ -473,6 +476,10 @@ std::string grpc_google_refresh_token_credentials::debug_string() {
                          grpc_oauth2_token_fetcher_credentials::debug_string());
 }
 
+const char* grpc_google_refresh_token_credentials::type() const {
+  return "GoogleRefreshToken";
+}
+
 static std::string create_loggable_refresh_token(
     grpc_auth_refresh_token* token) {
   if (strcmp(token->type, GRPC_AUTH_JSON_TYPE_INVALID) == 0) {
@@ -696,9 +703,9 @@ grpc_call_credentials* grpc_sts_credentials_create(
 // Oauth2 Access Token credentials.
 //
 
-grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
 grpc_access_token_credentials::GetRequestMetadata(
-    grpc_core::ClientInitialMetadata initial_metadata,
+    grpc_core::ClientMetadataHandle initial_metadata,
     const grpc_call_credentials::GetRequestMetadataArgs*) {
   initial_metadata->Append(
       GRPC_AUTHORIZATION_METADATA_KEY, access_token_value_.Ref(),
@@ -706,10 +713,11 @@ grpc_access_token_credentials::GetRequestMetadata(
   return grpc_core::Immediate(std::move(initial_metadata));
 }
 
+const char* grpc_access_token_credentials::Type() { return "AccessToken"; }
+
 grpc_access_token_credentials::grpc_access_token_credentials(
     const char* access_token)
-    : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_OAUTH2),
-      access_token_value_(grpc_core::Slice::FromCopiedString(
+    : access_token_value_(grpc_core::Slice::FromCopiedString(
           absl::StrCat("Bearer ", access_token))) {}
 
 std::string grpc_access_token_credentials::debug_string() {

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.h

@@ -79,9 +79,9 @@ struct grpc_oauth2_pending_get_request_metadata
   std::atomic<bool> done{false};
   grpc_core::Waker waker;
   grpc_polling_entity* pollent;
-  grpc_core::ClientInitialMetadata md;
+  grpc_core::ClientMetadataHandle md;
   struct grpc_oauth2_pending_get_request_metadata* next;
-  absl::StatusOr<grpc_core::ClientInitialMetadata> result;
+  absl::StatusOr<grpc_core::ClientMetadataHandle> result;
 };
 
 // -- Oauth2 Token Fetcher credentials --
@@ -94,14 +94,16 @@ class grpc_oauth2_token_fetcher_credentials : public grpc_call_credentials {
   grpc_oauth2_token_fetcher_credentials();
   ~grpc_oauth2_token_fetcher_credentials() override;
 
-  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
-  GetRequestMetadata(grpc_core::ClientInitialMetadata initial_metadata,
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
                      const GetRequestMetadataArgs* args) override;
 
   void on_http_response(grpc_credentials_metadata_request* r,
                         grpc_error_handle error);
   std::string debug_string() override;
 
+  const char* type() const override;
+
  protected:
   virtual void fetch_oauth2(grpc_credentials_metadata_request* req,
                             grpc_polling_entity* pollent, grpc_iomgr_cb_func cb,
@@ -136,6 +138,8 @@ class grpc_google_refresh_token_credentials final
 
   std::string debug_string() override;
 
+  const char* type() const override;
+
  protected:
   void fetch_oauth2(grpc_credentials_metadata_request* req,
                     grpc_polling_entity* pollent, grpc_iomgr_cb_func cb,
@@ -152,12 +156,16 @@ class grpc_access_token_credentials final : public grpc_call_credentials {
  public:
   explicit grpc_access_token_credentials(const char* access_token);
 
-  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
-  GetRequestMetadata(grpc_core::ClientInitialMetadata initial_metadata,
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
                      const GetRequestMetadataArgs* args) override;
 
   std::string debug_string() override;
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
  private:
   int cmp_impl(const grpc_call_credentials* other) const override {
     // TODO(yashykt): Check if we can do something better here

data/src/core/lib/security/credentials/plugin/plugin_credentials.cc

@@ -60,7 +60,9 @@ std::string grpc_plugin_credentials::debug_string() {
   return debug_str;
 }
 
-absl::StatusOr<grpc_core::ClientInitialMetadata>
+const char* grpc_plugin_credentials::type() const { return "Plugin"; }
+
+absl::StatusOr<grpc_core::ClientMetadataHandle>
 grpc_plugin_credentials::PendingRequest::ProcessPluginResult(
     const grpc_metadata* md, size_t num_md, grpc_status_code status,
     const char* error_details) {
@@ -96,12 +98,12 @@ grpc_plugin_credentials::PendingRequest::ProcessPluginResult(
             });
       }
       if (!error.ok()) return std::move(error);
-      return grpc_core::ClientInitialMetadata(std::move(md_));
+      return grpc_core::ClientMetadataHandle(std::move(md_));
     }
   }
 }
 
-grpc_core::Poll<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+grpc_core::Poll<absl::StatusOr<grpc_core::ClientMetadataHandle>>
 grpc_plugin_credentials::PendingRequest::PollAsyncResult() {
   if (!ready_.load(std::memory_order_acquire)) {
     return grpc_core::Pending{};
@@ -137,9 +139,9 @@ void grpc_plugin_credentials::PendingRequest::RequestMetadataReady(
   r->waker_.Wakeup();
 }
 
-grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
 grpc_plugin_credentials::GetRequestMetadata(
-    grpc_core::ClientInitialMetadata initial_metadata,
+    grpc_core::ClientMetadataHandle initial_metadata,
     const grpc_call_credentials::GetRequestMetadataArgs* args) {
   if (plugin_.get_metadata == nullptr) {
     return grpc_core::Immediate(std::move(initial_metadata));
@@ -197,7 +199,7 @@ grpc_plugin_credentials::GetRequestMetadata(
 grpc_plugin_credentials::grpc_plugin_credentials(
     grpc_metadata_credentials_plugin plugin,
     grpc_security_level min_security_level)
-    : grpc_call_credentials(plugin.type, min_security_level), plugin_(plugin) {}
+    : grpc_call_credentials(min_security_level), plugin_(plugin) {}
 
 grpc_call_credentials* grpc_metadata_credentials_create_from_plugin(
     grpc_metadata_credentials_plugin plugin,

data/src/core/lib/security/credentials/plugin/plugin_credentials.h

@@ -35,17 +35,19 @@ struct grpc_plugin_credentials final : public grpc_call_credentials {
                                    grpc_security_level min_security_level);
   ~grpc_plugin_credentials() override;
 
-  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
-  GetRequestMetadata(grpc_core::ClientInitialMetadata initial_metadata,
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
                      const GetRequestMetadataArgs* args) override;
 
   std::string debug_string() override;
 
+  const char* type() const override;
+
  private:
   class PendingRequest : public grpc_core::RefCounted<PendingRequest> {
    public:
     PendingRequest(grpc_core::RefCountedPtr<grpc_plugin_credentials> creds,
-                   grpc_core::ClientInitialMetadata initial_metadata,
+                   grpc_core::ClientMetadataHandle initial_metadata,
                    const grpc_call_credentials::GetRequestMetadataArgs* args)
         : call_creds_(std::move(creds)),
           context_(
@@ -60,11 +62,11 @@ struct grpc_plugin_credentials final : public grpc_call_credentials {
       }
     }
 
-    absl::StatusOr<grpc_core::ClientInitialMetadata> ProcessPluginResult(
+    absl::StatusOr<grpc_core::ClientMetadataHandle> ProcessPluginResult(
         const grpc_metadata* md, size_t num_md, grpc_status_code status,
         const char* error_details);
 
-    grpc_core::Poll<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+    grpc_core::Poll<absl::StatusOr<grpc_core::ClientMetadataHandle>>
     PollAsyncResult();
 
     static void RequestMetadataReady(void* request, const grpc_metadata* md,
@@ -80,7 +82,7 @@ struct grpc_plugin_credentials final : public grpc_call_credentials {
         grpc_core::Activity::current()->MakeNonOwningWaker()};
     grpc_core::RefCountedPtr<grpc_plugin_credentials> call_creds_;
     grpc_auth_metadata_context context_;
-    grpc_core::ClientInitialMetadata md_;
+    grpc_core::ClientMetadataHandle md_;
     // final status
     absl::InlinedVector<grpc_metadata, 2> metadata_;
     std::string error_details_;

data/src/core/lib/security/credentials/ssl/ssl_credentials.cc

@@ -37,8 +37,7 @@
 
 grpc_ssl_credentials::grpc_ssl_credentials(
     const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
-    const grpc_ssl_verify_peer_options* verify_options)
-    : grpc_channel_credentials(GRPC_CHANNEL_CREDENTIALS_TYPE_SSL) {
+    const grpc_ssl_verify_peer_options* verify_options) {
   build_config(pem_root_certs, pem_key_cert_pair, verify_options);
 }
 
@@ -83,6 +82,8 @@ grpc_ssl_credentials::create_security_connector(
   return sc;
 }
 
+const char* grpc_ssl_credentials::Type() { return "Ssl"; }
+
 void grpc_ssl_credentials::build_config(
     const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
     const grpc_ssl_verify_peer_options* verify_options) {
@@ -162,8 +163,7 @@ struct grpc_ssl_server_credentials_options {
 };
 
 grpc_ssl_server_credentials::grpc_ssl_server_credentials(
-    const grpc_ssl_server_credentials_options& options)
-    : grpc_server_credentials(GRPC_CHANNEL_CREDENTIALS_TYPE_SSL) {
+    const grpc_ssl_server_credentials_options& options) {
   if (options.certificate_config_fetcher != nullptr) {
     config_.client_certificate_request = options.client_certificate_request;
     certificate_config_fetcher_ = *options.certificate_config_fetcher;
@@ -186,6 +186,8 @@ grpc_ssl_server_credentials::create_security_connector(
   return grpc_ssl_server_security_connector_create(this->Ref());
 }
 
+const char* grpc_ssl_server_credentials::Type() { return "Ssl"; }
+
 tsi_ssl_pem_key_cert_pair* grpc_convert_grpc_to_tsi_cert_pairs(
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs) {

data/src/core/lib/security/credentials/ssl/ssl_credentials.h

@@ -37,6 +37,10 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
       const char* target, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
   // TODO(mattstev): Plumb to wrapped languages. Until then, setting the TLS
   // version should be done for testing purposes only.
   void set_min_tls_version(grpc_tls_version min_tls_version);
@@ -76,6 +80,10 @@ class grpc_ssl_server_credentials final : public grpc_server_credentials {
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_channel_args* /* args */) override;
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
   bool has_cert_config_fetcher() const {
     return certificate_config_fetcher_.cb != nullptr;
   }

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h

@@ -26,6 +26,7 @@
 
 #include <grpc/grpc_security.h>
 
+#include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/thd.h"
@@ -50,6 +51,36 @@ struct grpc_tls_certificate_provider
 
   virtual grpc_core::RefCountedPtr<grpc_tls_certificate_distributor>
   distributor() const = 0;
+
+  // Compares this grpc_tls_certificate_provider object with \a other.
+  // If this method returns 0, it means that gRPC can treat the two certificate
+  // providers as effectively the same. This method is used to compare
+  // `grpc_tls_certificate_provider` objects when they are present in
+  // channel_args. One important usage of this is when channel args are used in
+  // SubchannelKey, which leads to a useful property that allows subchannels to
+  // be reused when two different `grpc_tls_certificate_provider` objects are
+  // used but they compare as equal (assuming other channel args match).
+  int Compare(const grpc_tls_certificate_provider* other) const {
+    GPR_ASSERT(other != nullptr);
+    // Intentionally uses grpc_core::QsortCompare instead of strcmp as a safety
+    // against different grpc_tls_certificate_provider types using the same
+    // name.
+    int r = grpc_core::QsortCompare(type(), other->type());
+    if (r != 0) return r;
+    return CompareImpl(other);
+  }
+
+  // The pointer value \a type is used to uniquely identify a creds
+  // implementation for down-casting purposes. Every provider implementation
+  // should use a unique string instance, which should be returned by all
+  // instances of that provider implementation.
+  virtual const char* type() const = 0;
+
+ private:
+  // Implementation for `Compare` method intended to be overridden by
+  // subclasses. Only invoked if `type()` and `other->type()` point to the same
+  // string.
+  virtual int CompareImpl(const grpc_tls_certificate_provider* other) const = 0;
 };
 
 namespace grpc_core {
@@ -68,11 +99,20 @@ class StaticDataCertificateProvider final
     return distributor_;
   }
 
+  const char* type() const override { return "StaticData"; }
+
  private:
   struct WatcherInfo {
     bool root_being_watched = false;
     bool identity_being_watched = false;
   };
+
+  int CompareImpl(const grpc_tls_certificate_provider* other) const override {
+    // TODO(yashykt): Maybe do something better here.
+    return QsortCompare(static_cast<const grpc_tls_certificate_provider*>(this),
+                        other);
+  }
+
   RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
   std::string root_certificate_;
   PemKeyCertPairList pem_key_cert_pairs_;
@@ -98,11 +138,20 @@ class FileWatcherCertificateProvider final
     return distributor_;
   }
 
+  const char* type() const override { return "FileWatcher"; }
+
  private:
   struct WatcherInfo {
     bool root_being_watched = false;
     bool identity_being_watched = false;
   };
+
+  int CompareImpl(const grpc_tls_certificate_provider* other) const override {
+    // TODO(yashykt): Maybe do something better here.
+    return QsortCompare(static_cast<const grpc_tls_certificate_provider*>(this),
+                        other);
+  }
+
   // Force an update from the file system regardless of the interval.
   void ForceUpdate();
   // Read the root certificates from files and update the distributor.