grpc 1.46.2-x86_64-linux → 1.48.0.pre1-x86_64-linux

data/src/core/lib/security/credentials/external/aws_external_account_credentials.h

@@ -19,6 +19,16 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <functional>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "src/core/lib/gprpp/orphanable.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/http/httpcli.h"
+#include "src/core/lib/http/parser.h"
+#include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/security/credentials/external/aws_request_signer.h"
 #include "src/core/lib/security/credentials/external/external_account_credentials.h"
 
@@ -43,6 +53,10 @@ class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
   static void OnRetrieveRegion(void* arg, grpc_error_handle error);
   void OnRetrieveRegionInternal(grpc_error_handle error);
 
+  void RetrieveImdsV2SessionToken();
+  static void OnRetrieveImdsV2SessionToken(void* arg, grpc_error_handle error);
+  void OnRetrieveImdsV2SessionTokenInternal(grpc_error_handle error);
+
   void RetrieveRoleName();
   static void OnRetrieveRoleName(void* arg, grpc_error_handle error);
   void OnRetrieveRoleNameInternal(grpc_error_handle error);
@@ -55,6 +69,8 @@ class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
   void FinishRetrieveSubjectToken(std::string subject_token,
                                   grpc_error_handle error);
 
+  void AddMetadataRequestHeaders(grpc_http_request* request);
+
   std::string audience_;
   OrphanablePtr<HttpRequest> http_request_;
 
@@ -62,6 +78,7 @@ class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
   std::string region_url_;
   std::string url_;
   std::string regional_cred_verification_url_;
+  std::string imdsv2_session_token_url_;
 
   // Information required by request signer
   std::string region_;
@@ -69,6 +86,7 @@ class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
   std::string access_key_id_;
   std::string secret_access_key_;
   std::string token_;
+  std::string imdsv2_session_token_;
 
   std::unique_ptr<AwsRequestSigner> signer_;
   std::string cred_verification_url_;

data/src/core/lib/security/credentials/external/aws_request_signer.cc

@@ -17,14 +17,23 @@
 
 #include "src/core/lib/security/credentials/external/aws_request_signer.h"
 
+#include <algorithm>
+#include <utility>
+#include <vector>
+
+#include <openssl/crypto.h>
+#include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/sha.h>
 
+#include "absl/status/statusor.h"
 #include "absl/strings/ascii.h"
 #include "absl/strings/escaping.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/str_split.h"
+#include "absl/strings/string_view.h"
 #include "absl/time/clock.h"
 #include "absl/time/time.h"
 

data/src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -13,10 +13,20 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
+
 #include <grpc/support/port_platform.h>
 
 #include "src/core/lib/security/credentials/external/external_account_credentials.h"
 
+#include <string.h>
+
+#include <algorithm>
+#include <map>
+#include <memory>
+#include <utility>
+
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
@@ -25,13 +35,21 @@
 #include "absl/time/clock.h"
 #include "absl/time/time.h"
 
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
 #include "src/core/lib/http/httpcli_ssl_credentials.h"
 #include "src/core/lib/http/parser.h"
+#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/external/aws_external_account_credentials.h"
 #include "src/core/lib/security/credentials/external/file_external_account_credentials.h"
 #include "src/core/lib/security/credentials/external/url_external_account_credentials.h"
 #include "src/core/lib/security/util/json_util.h"
 #include "src/core/lib/slice/b64.h"
+#include "src/core/lib/uri/uri_parser.h"
 
 #define EXTERNAL_ACCOUNT_CREDENTIALS_GRANT_TYPE \
   "urn:ietf:params:oauth:grant-type:token-exchange"
@@ -84,7 +102,7 @@ bool MatchWorkforcePoolAudience(absl::string_view audience) {
 RefCountedPtr<ExternalAccountCredentials> ExternalAccountCredentials::Create(
     const Json& json, std::vector<std::string> scopes,
     grpc_error_handle* error) {
-  GPR_ASSERT(*error == GRPC_ERROR_NONE);
+  GPR_ASSERT(GRPC_ERROR_IS_NONE(*error));
   Options options;
   options.type = GRPC_AUTH_JSON_TYPE_INVALID;
   if (json.type() != Json::Type::OBJECT) {
@@ -200,7 +218,7 @@ RefCountedPtr<ExternalAccountCredentials> ExternalAccountCredentials::Create(
         "Invalid options credential source to create "
         "ExternalAccountCredentials.");
   }
-  if (*error == GRPC_ERROR_NONE) {
+  if (GRPC_ERROR_IS_NONE(*error)) {
     return creds;
   } else {
     return nullptr;
@@ -252,7 +270,7 @@ void ExternalAccountCredentials::fetch_oauth2(
 
 void ExternalAccountCredentials::OnRetrieveSubjectTokenInternal(
     absl::string_view subject_token, grpc_error_handle error) {
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     FinishTokenFetch(error);
   } else {
     ExchangeToken(subject_token);
@@ -352,7 +370,7 @@ void ExternalAccountCredentials::OnExchangeToken(void* arg,
 void ExternalAccountCredentials::OnExchangeTokenInternal(
     grpc_error_handle error) {
   http_request_.reset();
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     FinishTokenFetch(error);
   } else {
     if (options_.service_account_impersonation_url.empty()) {
@@ -379,7 +397,7 @@ void ExternalAccountCredentials::ImpersenateServiceAccount() {
   absl::string_view response_body(ctx_->response.body,
                                   ctx_->response.body_length);
   Json json = Json::Parse(response_body, &error);
-  if (error != GRPC_ERROR_NONE || json.type() != Json::Type::OBJECT) {
+  if (!GRPC_ERROR_IS_NONE(error) || json.type() != Json::Type::OBJECT) {
     FinishTokenFetch(GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
         "Invalid token exchange response.", &error, 1));
     GRPC_ERROR_UNREF(error);
@@ -446,14 +464,14 @@ void ExternalAccountCredentials::OnImpersenateServiceAccount(
 void ExternalAccountCredentials::OnImpersenateServiceAccountInternal(
     grpc_error_handle error) {
   http_request_.reset();
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     FinishTokenFetch(error);
     return;
   }
   absl::string_view response_body(ctx_->response.body,
                                   ctx_->response.body_length);
   Json json = Json::Parse(response_body, &error);
-  if (error != GRPC_ERROR_NONE || json.type() != Json::Type::OBJECT) {
+  if (!GRPC_ERROR_IS_NONE(error) || json.type() != Json::Type::OBJECT) {
     FinishTokenFetch(GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
         "Invalid service account impersonation response.", &error, 1));
     GRPC_ERROR_UNREF(error);
@@ -522,7 +540,7 @@ grpc_call_credentials* grpc_external_account_credentials_create(
     const char* json_string, const char* scopes_string) {
   grpc_error_handle error = GRPC_ERROR_NONE;
   grpc_core::Json json = grpc_core::Json::Parse(json_string, &error);
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     gpr_log(GPR_ERROR,
             "External account credentials creation failed. Error: %s.",
             grpc_error_std_string(error).c_str());
@@ -533,7 +551,7 @@ grpc_call_credentials* grpc_external_account_credentials_create(
   auto creds = grpc_core::ExternalAccountCredentials::Create(
                    json, std::move(scopes), &error)
                    .release();
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     gpr_log(GPR_ERROR,
             "External account credentials creation failed. Error: %s.",
             grpc_error_std_string(error).c_str());

data/src/core/lib/security/credentials/external/external_account_credentials.h

@@ -19,9 +19,20 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <functional>
 #include <string>
 #include <vector>
 
+#include "absl/strings/string_view.h"
+
+#include "src/core/lib/gprpp/orphanable.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/time.h"
+#include "src/core/lib/http/httpcli.h"
+#include "src/core/lib/http/parser.h"
+#include "src/core/lib/iomgr/closure.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/iomgr/polling_entity.h"
 #include "src/core/lib/json/json.h"
 #include "src/core/lib/security/credentials/oauth2/oauth2_credentials.h"
 

data/src/core/lib/security/credentials/external/file_external_account_credentials.cc

@@ -17,10 +17,17 @@
 
 #include "src/core/lib/security/credentials/external/file_external_account_credentials.h"
 
-#include <fstream>
+#include <map>
+#include <utility>
+
+#include "absl/strings/string_view.h"
+
+#include <grpc/slice.h>
 
 #include "src/core/lib/iomgr/load_file.h"
+#include "src/core/lib/json/json.h"
 #include "src/core/lib/slice/slice_internal.h"
+#include "src/core/lib/slice/slice_refcount.h"
 
 namespace grpc_core {
 
@@ -30,7 +37,7 @@ FileExternalAccountCredentials::Create(Options options,
                                        grpc_error_handle* error) {
   auto creds = MakeRefCounted<FileExternalAccountCredentials>(
       std::move(options), std::move(scopes), error);
-  if (*error == GRPC_ERROR_NONE) {
+  if (GRPC_ERROR_IS_NONE(*error)) {
     return creds;
   } else {
     return nullptr;
@@ -101,14 +108,15 @@ void FileExternalAccountCredentials::RetrieveSubjectToken(
   // request because it may have changed since the last request.
   grpc_error_handle error =
       grpc_load_file(file_.c_str(), 0, &content_slice.slice);
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     cb("", error);
     return;
   }
   absl::string_view content = StringViewFromSlice(content_slice.slice);
   if (format_type_ == "json") {
     Json content_json = Json::Parse(content, &error);
-    if (error != GRPC_ERROR_NONE || content_json.type() != Json::Type::OBJECT) {
+    if (!GRPC_ERROR_IS_NONE(error) ||
+        content_json.type() != Json::Type::OBJECT) {
       cb("", GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                  "The content of the file is not a valid json object."));
       GRPC_ERROR_UNREF(error);

data/src/core/lib/security/credentials/external/file_external_account_credentials.h

@@ -19,6 +19,12 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <functional>
+#include <string>
+#include <vector>
+
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/security/credentials/external/external_account_credentials.h"
 
 namespace grpc_core {

data/src/core/lib/security/credentials/external/url_external_account_credentials.cc

@@ -17,11 +17,29 @@
 
 #include "src/core/lib/security/credentials/external/url_external_account_credentials.h"
 
+#include <string.h>
+
+#include <memory>
+#include <utility>
+
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_split.h"
+#include "absl/strings/string_view.h"
+
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
 
 #include "src/core/lib/http/httpcli_ssl_credentials.h"
+#include "src/core/lib/http/parser.h"
+#include "src/core/lib/iomgr/closure.h"
+#include "src/core/lib/json/json.h"
+#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/transport/error_utils.h"
 
 namespace grpc_core {
@@ -32,7 +50,7 @@ UrlExternalAccountCredentials::Create(Options options,
                                       grpc_error_handle* error) {
   auto creds = MakeRefCounted<UrlExternalAccountCredentials>(
       std::move(options), std::move(scopes), error);
-  if (*error == GRPC_ERROR_NONE) {
+  if (GRPC_ERROR_IS_NONE(*error)) {
     return creds;
   } else {
     return nullptr;
@@ -177,7 +195,7 @@ void UrlExternalAccountCredentials::OnRetrieveSubjectToken(
 void UrlExternalAccountCredentials::OnRetrieveSubjectTokenInternal(
     grpc_error_handle error) {
   http_request_.reset();
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     FinishRetrieveSubjectToken("", error);
     return;
   }
@@ -186,7 +204,7 @@ void UrlExternalAccountCredentials::OnRetrieveSubjectTokenInternal(
   if (format_type_ == "json") {
     grpc_error_handle error = GRPC_ERROR_NONE;
     Json response_json = Json::Parse(response_body, &error);
-    if (error != GRPC_ERROR_NONE ||
+    if (!GRPC_ERROR_IS_NONE(error) ||
         response_json.type() != Json::Type::OBJECT) {
       FinishRetrieveSubjectToken(
           "", GRPC_ERROR_CREATE_FROM_STATIC_STRING(
@@ -220,7 +238,7 @@ void UrlExternalAccountCredentials::FinishRetrieveSubjectToken(
   auto cb = cb_;
   cb_ = nullptr;
   // Invoke the callback.
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     cb("", error);
   } else {
     cb(subject_token, GRPC_ERROR_NONE);

data/src/core/lib/security/credentials/external/url_external_account_credentials.h

@@ -19,7 +19,17 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <functional>
+#include <map>
+#include <string>
+#include <vector>
+
+#include "src/core/lib/gprpp/orphanable.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/http/httpcli.h"
+#include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/security/credentials/external/external_account_credentials.h"
+#include "src/core/lib/uri/uri_parser.h"
 
 namespace grpc_core {
 

data/src/core/lib/security/credentials/fake/fake_credentials.cc

@@ -20,21 +20,24 @@
 
 #include "src/core/lib/security/credentials/fake/fake_credentials.h"
 
-#include <string.h>
+#include <stdlib.h>
 
-#include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
+#include <utility>
+
+#include "absl/strings/string_view.h"
 
 #include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/gpr/string.h"
-#include "src/core/lib/iomgr/executor.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/security_connector/fake/fake_security_connector.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
+#include "src/core/lib/transport/metadata_batch.h"
 
 /* -- Fake transport security credentials. -- */
 
 namespace {
+
 class grpc_fake_channel_credentials final : public grpc_channel_credentials {
  public:
   grpc_core::RefCountedPtr<grpc_channel_security_connector>
@@ -46,7 +49,10 @@ class grpc_fake_channel_credentials final : public grpc_channel_credentials {
         this->Ref(), std::move(call_creds), target, args);
   }
 
-  const char* type() const override { return "Fake"; }
+  grpc_core::UniqueTypeName type() const override {
+    static grpc_core::UniqueTypeName::Factory kFactory("Fake");
+    return kFactory.Create();
+  }
 
  private:
   int cmp_impl(const grpc_channel_credentials* other) const override {
@@ -63,7 +69,10 @@ class grpc_fake_server_credentials final : public grpc_server_credentials {
     return grpc_fake_server_security_connector_create(this->Ref());
   }
 
-  const char* type() const override { return "Fake"; }
+  grpc_core::UniqueTypeName type() const override {
+    static grpc_core::UniqueTypeName::Factory kFactory("Fake");
+    return kFactory.Create();
+  }
 };
 }  // namespace
 
@@ -101,7 +110,10 @@ grpc_md_only_test_credentials::GetRequestMetadata(
   return grpc_core::Immediate(std::move(initial_metadata));
 }
 
-const char* grpc_md_only_test_credentials::Type() { return "MdOnlyTest"; }
+grpc_core::UniqueTypeName grpc_md_only_test_credentials::Type() {
+  static grpc_core::UniqueTypeName::Factory kFactory("MdOnlyTest");
+  return kFactory.Create();
+}
 
 grpc_call_credentials* grpc_md_only_test_credentials_create(
     const char* md_key, const char* md_value) {

data/src/core/lib/security/credentials/fake/fake_credentials.h

@@ -21,9 +21,21 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <string.h>
+#include <string>
 
+#include "absl/status/statusor.h"
+
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/grpc_security_constants.h>
+#include <grpc/impl/codegen/grpc_types.h>
+
+#include "src/core/lib/gpr/useful.h"
+#include "src/core/lib/gprpp/unique_type_name.h"
+#include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/slice/slice.h"
+#include "src/core/lib/transport/transport.h"
 
 #define GRPC_ARG_FAKE_SECURITY_EXPECTED_TARGETS \
   "grpc.fake_security.expected_targets"
@@ -70,9 +82,9 @@ class grpc_md_only_test_credentials : public grpc_call_credentials {
 
   std::string debug_string() override { return "MD only Test Credentials"; }
 
-  static const char* Type();
+  static grpc_core::UniqueTypeName Type();
 
-  const char* type() const override { return Type(); }
+  grpc_core::UniqueTypeName type() const override { return Type(); }
 
  private:
   int cmp_impl(const grpc_call_credentials* other) const override {

data/src/core/lib/security/credentials/google_default/credentials_generic.cc

@@ -26,6 +26,7 @@
 #include <grpc/support/log.h>
 
 #include "src/core/lib/gpr/env.h"
+#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/google_default/google_default_credentials.h"
 
 std::string grpc_get_well_known_google_credentials_file_path_impl(void) {

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -22,9 +22,18 @@
 
 #include <string.h>
 
+#include <map>
+#include <memory>
+#include <string>
+
+#include "absl/status/statusor.h"
 #include "absl/strings/match.h"
+#include "absl/strings/string_view.h"
 #include "absl/strings/strip.h"
 
+#include <grpc/grpc_security.h>  // IWYU pragma: keep
+#include <grpc/grpc_security_constants.h>
+#include <grpc/slice.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/sync.h>
@@ -32,23 +41,31 @@
 #include "src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.h"
 #include "src/core/ext/filters/client_channel/lb_policy/xds/xds_channel_args.h"
 #include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gpr/env.h"
-#include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/sync.h"
+#include "src/core/lib/gprpp/time.h"
 #include "src/core/lib/http/httpcli.h"
 #include "src/core/lib/http/parser.h"
+#include "src/core/lib/iomgr/closure.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/iomgr/load_file.h"
 #include "src/core/lib/iomgr/polling_entity.h"
-#include "src/core/lib/security/credentials/alts/alts_credentials.h"
+#include "src/core/lib/iomgr/pollset.h"
+#include "src/core/lib/json/json.h"
 #include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/external/external_account_credentials.h"
+#include "src/core/lib/security/credentials/jwt/json_token.h"
 #include "src/core/lib/security/credentials/jwt/jwt_credentials.h"
 #include "src/core/lib/security/credentials/oauth2/oauth2_credentials.h"
 #include "src/core/lib/slice/slice_internal.h"
-#include "src/core/lib/slice/slice_string_helpers.h"
+#include "src/core/lib/slice/slice_refcount.h"
 #include "src/core/lib/surface/api_trace.h"
+#include "src/core/lib/uri/uri_parser.h"
 
 using grpc_core::Json;
 
@@ -83,6 +100,22 @@ struct metadata_server_detector {
   int success;
   grpc_http_response response;
 };
+
+namespace {
+
+bool IsXdsNonCfeCluster(const char* xds_cluster) {
+  if (xds_cluster == nullptr) return false;
+  if (absl::StartsWith(xds_cluster, "google_cfe_")) return false;
+  if (!absl::StartsWith(xds_cluster, "xdstp:")) return true;
+  auto uri = grpc_core::URI::Parse(xds_cluster);
+  if (!uri.ok()) return true;  // Shouldn't happen, but assume ALTS.
+  return uri->authority() != "traffic-director-c2p.xds.googleapis.com" ||
+         !absl::StartsWith(uri->path(),
+                           "/envoy.config.cluster.v3.Cluster/google_cfe_");
+}
+
+}  // namespace
+
 grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_google_default_channel_credentials::create_security_connector(
     grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
@@ -94,8 +127,7 @@ grpc_google_default_channel_credentials::create_security_connector(
       args, GRPC_ARG_ADDRESS_IS_BACKEND_FROM_GRPCLB_LOAD_BALANCER, false);
   const char* xds_cluster =
       grpc_channel_args_find_string(args, GRPC_ARG_XDS_CLUSTER_NAME);
-  const bool is_xds_non_cfe_cluster =
-      xds_cluster != nullptr && !absl::StartsWith(xds_cluster, "google_cfe_");
+  const bool is_xds_non_cfe_cluster = IsXdsNonCfeCluster(xds_cluster);
   const bool use_alts = is_grpclb_load_balancer ||
                         is_backend_from_grpclb_load_balancer ||
                         is_xds_non_cfe_cluster;
@@ -125,28 +157,23 @@ grpc_google_default_channel_credentials::create_security_connector(
   return sc;
 }
 
-grpc_channel_args* grpc_google_default_channel_credentials::update_arguments(
-    grpc_channel_args* args) {
-  grpc_channel_args* updated = args;
-  if (grpc_channel_args_find(args, GRPC_ARG_DNS_ENABLE_SRV_QUERIES) ==
-      nullptr) {
-    grpc_arg new_srv_arg = grpc_channel_arg_integer_create(
-        const_cast<char*>(GRPC_ARG_DNS_ENABLE_SRV_QUERIES), true);
-    updated = grpc_channel_args_copy_and_add(args, &new_srv_arg, 1);
-    grpc_channel_args_destroy(args);
-  }
-  return updated;
+grpc_core::ChannelArgs
+grpc_google_default_channel_credentials::update_arguments(
+    grpc_core::ChannelArgs args) {
+  return args.SetIfUnset(GRPC_ARG_DNS_ENABLE_SRV_QUERIES, true);
 }
 
-const char* grpc_google_default_channel_credentials::type() const {
-  return "GoogleDefault";
+grpc_core::UniqueTypeName grpc_google_default_channel_credentials::type()
+    const {
+  static grpc_core::UniqueTypeName::Factory kFactory("GoogleDefault");
+  return kFactory.Create();
 }
 
 static void on_metadata_server_detection_http_response(
     void* user_data, grpc_error_handle error) {
   metadata_server_detector* detector =
       static_cast<metadata_server_detector*>(user_data);
-  if (error == GRPC_ERROR_NONE && detector->response.status == 200 &&
+  if (GRPC_ERROR_IS_NONE(error) && detector->response.status == 200 &&
       detector->response.hdr_count > 0) {
     /* Internet providers can return a generic response to all requests, so
        it is necessary to check that metadata header is present also. */
@@ -289,9 +316,9 @@ static grpc_error_handle create_default_creds_from_path(
     goto end;
   }
   error = grpc_load_file(creds_path.c_str(), 0, &creds_data);
-  if (error != GRPC_ERROR_NONE) goto end;
+  if (!GRPC_ERROR_IS_NONE(error)) goto end;
   json = Json::Parse(grpc_core::StringViewFromSlice(creds_data), &error);
-  if (error != GRPC_ERROR_NONE) goto end;
+  if (!GRPC_ERROR_IS_NONE(error)) goto end;
   if (json.type() != Json::Type::OBJECT) {
     error = grpc_error_set_str(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING("Failed to parse JSON"),
@@ -335,7 +362,7 @@ static grpc_error_handle create_default_creds_from_path(
   result = grpc_core::ExternalAccountCredentials::Create(json, {}, &error);
 
 end:
-  GPR_ASSERT((result == nullptr) + (error == GRPC_ERROR_NONE) == 1);
+  GPR_ASSERT((result == nullptr) + (GRPC_ERROR_IS_NONE(error)) == 1);
   grpc_slice_unref_internal(creds_data);
   *creds = result;
   return error;
@@ -372,14 +399,14 @@ static grpc_core::RefCountedPtr<grpc_call_credentials> make_default_call_creds(
   if (path_from_env != nullptr) {
     err = create_default_creds_from_path(path_from_env, &call_creds);
     gpr_free(path_from_env);
-    if (err == GRPC_ERROR_NONE) return call_creds;
+    if (GRPC_ERROR_IS_NONE(err)) return call_creds;
     *error = grpc_error_add_child(*error, err);
   }
 
   /* Then the well-known file. */
   err = create_default_creds_from_path(
       grpc_get_well_known_google_credentials_file_path(), &call_creds);
-  if (err == GRPC_ERROR_NONE) return call_creds;
+  if (GRPC_ERROR_IS_NONE(err)) return call_creds;
   *error = grpc_error_add_child(*error, err);
 
   update_tenancy();

data/src/core/lib/security/credentials/google_default/google_default_credentials.h

@@ -18,11 +18,20 @@
 
 #ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_GOOGLE_DEFAULT_GOOGLE_DEFAULT_CREDENTIALS_H
 #define GRPC_CORE_LIB_SECURITY_CREDENTIALS_GOOGLE_DEFAULT_GOOGLE_DEFAULT_CREDENTIALS_H
-
 #include <grpc/support/port_platform.h>
 
+#include <utility>
+
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/impl/codegen/grpc_types.h>
+
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/unique_type_name.h"
 #include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
 
 #define GRPC_GOOGLE_CLOUD_SDK_CONFIG_DIRECTORY "gcloud"
 #define GRPC_GOOGLE_WELL_KNOWN_CREDENTIALS_FILE \
@@ -56,9 +65,9 @@ class grpc_google_default_channel_credentials
       const char* target, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
-  grpc_channel_args* update_arguments(grpc_channel_args* args) override;
+  grpc_core::ChannelArgs update_arguments(grpc_core::ChannelArgs args) override;
 
-  const char* type() const override;
+  grpc_core::UniqueTypeName type() const override;
 
   const grpc_channel_credentials* alts_creds() const {
     return alts_creds_.get();