grpc 1.47.0-x86_64-linux → 1.49.0.pre1-x86_64-linux

data/src/core/lib/security/security_connector/alts/alts_security_connector.cc

@@ -20,19 +20,39 @@
 
 #include "src/core/lib/security/security_connector/alts/alts_security_connector.h"
 
-#include <stdbool.h>
 #include <string.h>
 
+#include <algorithm>
+#include <utility>
+
+#include "absl/status/status.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
+
 #include <grpc/grpc.h>
+#include <grpc/grpc_security_constants.h>
+#include <grpc/impl/codegen/grpc_types.h>
+#include <grpc/slice.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/closure.h"
+#include "src/core/lib/iomgr/endpoint.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
+#include "src/core/lib/iomgr/iomgr_fwd.h"
+#include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/promise/promise.h"
+#include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/alts/alts_credentials.h"
+#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
-#include "src/core/lib/slice/slice_internal.h"
+#include "src/core/lib/slice/slice_refcount.h"
+#include "src/core/lib/transport/handshaker.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/tsi/alts/handshaker/alts_tsi_handshaker.h"
 #include "src/core/tsi/transport_security.h"
@@ -78,18 +98,13 @@ class grpc_alts_channel_security_connector final
   ~grpc_alts_channel_security_connector() override { gpr_free(target_name_); }
 
   void add_handshakers(
-      const grpc_channel_args* args, grpc_pollset_set* interested_parties,
+      const grpc_core::ChannelArgs& args, grpc_pollset_set* interested_parties,
       grpc_core::HandshakeManager* handshake_manager) override {
     tsi_handshaker* handshaker = nullptr;
     const grpc_alts_credentials* creds =
         static_cast<const grpc_alts_credentials*>(channel_creds());
-    size_t user_specified_max_frame_size = 0;
-    const grpc_arg* arg =
-        grpc_channel_args_find(args, GRPC_ARG_TSI_MAX_FRAME_SIZE);
-    if (arg != nullptr && arg->type == GRPC_ARG_INTEGER) {
-      user_specified_max_frame_size = grpc_channel_arg_get_integer(
-          arg, {0, 0, std::numeric_limits<int>::max()});
-    }
+    const size_t user_specified_max_frame_size =
+        std::max(0, args.GetInt(GRPC_ARG_TSI_MAX_FRAME_SIZE).value_or(0));
     GPR_ASSERT(alts_tsi_handshaker_create(
                    creds->options(), target_name_,
                    creds->handshaker_service_url(), true, interested_parties,
@@ -99,6 +114,7 @@ class grpc_alts_channel_security_connector final
   }
 
   void check_peer(tsi_peer peer, grpc_endpoint* /*ep*/,
+                  const grpc_core::ChannelArgs& /*args*/,
                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override {
     alts_check_peer(peer, auth_context, on_peer_checked);
@@ -141,18 +157,13 @@ class grpc_alts_server_security_connector final
   ~grpc_alts_server_security_connector() override = default;
 
   void add_handshakers(
-      const grpc_channel_args* args, grpc_pollset_set* interested_parties,
+      const grpc_core::ChannelArgs& args, grpc_pollset_set* interested_parties,
       grpc_core::HandshakeManager* handshake_manager) override {
     tsi_handshaker* handshaker = nullptr;
     const grpc_alts_server_credentials* creds =
         static_cast<const grpc_alts_server_credentials*>(server_creds());
-    size_t user_specified_max_frame_size = 0;
-    const grpc_arg* arg =
-        grpc_channel_args_find(args, GRPC_ARG_TSI_MAX_FRAME_SIZE);
-    if (arg != nullptr && arg->type == GRPC_ARG_INTEGER) {
-      user_specified_max_frame_size = grpc_channel_arg_get_integer(
-          arg, {0, 0, std::numeric_limits<int>::max()});
-    }
+    size_t user_specified_max_frame_size =
+        std::max(0, args.GetInt(GRPC_ARG_TSI_MAX_FRAME_SIZE).value_or(0));
     GPR_ASSERT(alts_tsi_handshaker_create(
                    creds->options(), nullptr, creds->handshaker_service_url(),
                    false, interested_parties, &handshaker,
@@ -162,6 +173,7 @@ class grpc_alts_server_security_connector final
   }
 
   void check_peer(tsi_peer peer, grpc_endpoint* /*ep*/,
+                  const grpc_core::ChannelArgs& /*args*/,
                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override {
     alts_check_peer(peer, auth_context, on_peer_checked);

data/src/core/lib/security/security_connector/alts/alts_security_connector.h

@@ -18,12 +18,15 @@
 
 #ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_ALTS_ALTS_SECURITY_CONNECTOR_H
 #define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_ALTS_ALTS_SECURITY_CONNECTOR_H
-
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/security/context/security_context.h"
-#include "src/core/lib/security/credentials/alts/grpc_alts_credentials_options.h"
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
+#include "src/core/tsi/alts/handshaker/transport_security_common_api.h"
+#include "src/core/tsi/transport_security_interface.h"
 
 #define GRPC_ALTS_TRANSPORT_SECURITY_TYPE "alts"
 

data/src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -20,10 +20,19 @@
 
 #include "src/core/lib/security/security_connector/fake/fake_security_connector.h"
 
-#include <stdbool.h>
+#include <stdlib.h>
+#include <string.h>
 
+#include <string>
+#include <utility>
+
+#include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
 
+#include <grpc/grpc_security_constants.h>
+#include <grpc/impl/codegen/grpc_types.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
@@ -31,8 +40,16 @@
 #include "src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/string.h"
+#include "src/core/lib/gpr/useful.h"
+#include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/closure.h"
+#include "src/core/lib/iomgr/endpoint.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
+#include "src/core/lib/iomgr/iomgr_fwd.h"
+#include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
@@ -40,6 +57,7 @@
 #include "src/core/lib/security/transport/security_handshaker.h"
 #include "src/core/lib/transport/handshaker.h"
 #include "src/core/tsi/fake_transport_security.h"
+#include "src/core/tsi/transport_security_interface.h"
 
 namespace {
 class grpc_fake_channel_security_connector final
@@ -48,33 +66,22 @@ class grpc_fake_channel_security_connector final
   grpc_fake_channel_security_connector(
       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-      const char* target, const grpc_channel_args* args)
+      const char* target, const grpc_core::ChannelArgs& args)
       : grpc_channel_security_connector(GRPC_FAKE_SECURITY_URL_SCHEME,
                                         std::move(channel_creds),
                                         std::move(request_metadata_creds)),
         target_(gpr_strdup(target)),
         expected_targets_(
-            gpr_strdup(grpc_fake_transport_get_expected_targets(args))),
-        is_lb_channel_(grpc_channel_args_find(
-                           args, GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER) !=
-                       nullptr) {
-    const grpc_arg* target_name_override_arg =
-        grpc_channel_args_find(args, GRPC_SSL_TARGET_NAME_OVERRIDE_ARG);
-    if (target_name_override_arg != nullptr) {
-      target_name_override_ =
-          gpr_strdup(grpc_channel_arg_get_string(target_name_override_arg));
-    } else {
-      target_name_override_ = nullptr;
-    }
-  }
+            args.GetOwnedString(GRPC_ARG_FAKE_SECURITY_EXPECTED_TARGETS)),
+        is_lb_channel_(args.GetBool(GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER)
+                           .value_or(false)),
+        target_name_override_(
+            args.GetOwnedString(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG)) {}
 
-  ~grpc_fake_channel_security_connector() override {
-    gpr_free(target_);
-    gpr_free(expected_targets_);
-    if (target_name_override_ != nullptr) gpr_free(target_name_override_);
-  }
+  ~grpc_fake_channel_security_connector() override { gpr_free(target_); }
 
   void check_peer(tsi_peer peer, grpc_endpoint* ep,
+                  const grpc_core::ChannelArgs& /*args*/,
                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 
@@ -90,16 +97,12 @@ class grpc_fake_channel_security_connector final
     if (c != 0) return c;
     c = strcmp(target_, other->target_);
     if (c != 0) return c;
-    if (expected_targets_ == nullptr || other->expected_targets_ == nullptr) {
-      c = grpc_core::QsortCompare(expected_targets_, other->expected_targets_);
-    } else {
-      c = strcmp(expected_targets_, other->expected_targets_);
-    }
+    c = grpc_core::QsortCompare(expected_targets_, other->expected_targets_);
     if (c != 0) return c;
     return grpc_core::QsortCompare(is_lb_channel_, other->is_lb_channel_);
   }
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const grpc_core::ChannelArgs& args,
                        grpc_pollset_set* /*interested_parties*/,
                        grpc_core::HandshakeManager* handshake_mgr) override {
     handshake_mgr->Add(grpc_core::SecurityHandshakerCreate(
@@ -115,11 +118,12 @@ class grpc_fake_channel_security_connector final
     grpc_core::SplitHostPort(host, &authority_hostname,
                              &authority_ignored_port);
     grpc_core::SplitHostPort(target_, &target_hostname, &target_ignored_port);
-    if (target_name_override_ != nullptr) {
+    if (target_name_override_.has_value()) {
       absl::string_view fake_security_target_name_override_hostname;
       absl::string_view fake_security_target_name_override_ignored_port;
       grpc_core::SplitHostPort(
-          target_name_override_, &fake_security_target_name_override_hostname,
+          target_name_override_->c_str(),
+          &fake_security_target_name_override_hostname,
           &fake_security_target_name_override_ignored_port);
       if (authority_hostname != fake_security_target_name_override_hostname) {
         gpr_log(GPR_ERROR,
@@ -137,9 +141,7 @@ class grpc_fake_channel_security_connector final
   }
 
   char* target() const { return target_; }
-  char* expected_targets() const { return expected_targets_; }
   bool is_lb_channel() const { return is_lb_channel_; }
-  char* target_name_override() const { return target_name_override_; }
 
  private:
   bool fake_check_target(const char* target, const char* set_str) const {
@@ -159,15 +161,15 @@ class grpc_fake_channel_security_connector final
   }
 
   void fake_secure_name_check() const {
-    if (expected_targets_ == nullptr) return;
+    if (!expected_targets_.has_value()) return;
     char** lbs_and_backends = nullptr;
     size_t lbs_and_backends_size = 0;
     bool success = false;
-    gpr_string_split(expected_targets_, ";", &lbs_and_backends,
+    gpr_string_split(expected_targets_->c_str(), ";", &lbs_and_backends,
                      &lbs_and_backends_size);
     if (lbs_and_backends_size > 2 || lbs_and_backends_size == 0) {
       gpr_log(GPR_ERROR, "Invalid expected targets arg value: '%s'",
-              expected_targets_);
+              expected_targets_->c_str());
       goto done;
     }
     if (is_lb_channel_) {
@@ -175,7 +177,7 @@ class grpc_fake_channel_security_connector final
         gpr_log(GPR_ERROR,
                 "Invalid expected targets arg value: '%s'. Expectations for LB "
                 "channels must be of the form 'be1,be2,be3,...;lb1,lb2,...",
-                expected_targets_);
+                expected_targets_->c_str());
         goto done;
       }
       if (!fake_check_target(target_, lbs_and_backends[1])) {
@@ -201,9 +203,9 @@ class grpc_fake_channel_security_connector final
   }
 
   char* target_;
-  char* expected_targets_;
+  absl::optional<std::string> expected_targets_;
   bool is_lb_channel_;
-  char* target_name_override_;
+  absl::optional<std::string> target_name_override_;
 };
 
 void fake_check_peer(grpc_security_connector* /*sc*/, tsi_peer peer,
@@ -260,6 +262,7 @@ end:
 
 void grpc_fake_channel_security_connector::check_peer(
     tsi_peer peer, grpc_endpoint* /*ep*/,
+    const grpc_core::ChannelArgs& /*args*/,
     grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
     grpc_closure* on_peer_checked) {
   fake_check_peer(this, peer, auth_context, on_peer_checked);
@@ -276,6 +279,7 @@ class grpc_fake_server_security_connector
   ~grpc_fake_server_security_connector() override = default;
 
   void check_peer(tsi_peer peer, grpc_endpoint* /*ep*/,
+                  const grpc_core::ChannelArgs& /*args*/,
                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override {
     fake_check_peer(this, peer, auth_context, on_peer_checked);
@@ -286,7 +290,7 @@ class grpc_fake_server_security_connector
     GRPC_ERROR_UNREF(error);
   }
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const grpc_core::ChannelArgs& args,
                        grpc_pollset_set* /*interested_parties*/,
                        grpc_core::HandshakeManager* handshake_mgr) override {
     handshake_mgr->Add(grpc_core::SecurityHandshakerCreate(
@@ -304,7 +308,7 @@ grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_fake_channel_security_connector_create(
     grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-    const char* target, const grpc_channel_args* args) {
+    const char* target, const grpc_core::ChannelArgs& args) {
   return grpc_core::MakeRefCounted<grpc_fake_channel_security_connector>(
       std::move(channel_creds), std::move(request_metadata_creds), target,
       args);

data/src/core/lib/security/security_connector/fake/fake_security_connector.h

@@ -18,21 +18,21 @@
 
 #ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_FAKE_FAKE_SECURITY_CONNECTOR_H
 #define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_FAKE_FAKE_SECURITY_CONNECTOR_H
-
 #include <grpc/support/port_platform.h>
 
+#include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
-#include "src/core/lib/transport/handshaker.h"
 
 /* Creates a fake connector that emulates real channel security.  */
 grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_fake_channel_security_connector_create(
     grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-    const char* target, const grpc_channel_args* args);
+    const char* target, const grpc_core::ChannelArgs& args);
 
 /* Creates a fake connector that emulates real server security.  */
 grpc_core::RefCountedPtr<grpc_server_security_connector>

data/src/core/lib/security/security_connector/insecure/insecure_security_connector.cc

@@ -20,8 +20,17 @@
 
 #include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h"
 
+#include <string.h>
+
+#include <grpc/grpc_security_constants.h>
+#include <grpc/support/log.h>
+
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/promise/promise.h"
+#include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
 #include "src/core/tsi/local_transport_security.h"
 
@@ -58,7 +67,7 @@ ArenaPromise<absl::Status> InsecureChannelSecurityConnector::CheckCallHost(
 // security handshaker so that check_peer is invoked and an auth_context is
 // created with the security level of TSI_SECURITY_NONE.
 void InsecureChannelSecurityConnector::add_handshakers(
-    const grpc_channel_args* args, grpc_pollset_set* /* interested_parties */,
+    const ChannelArgs& args, grpc_pollset_set* /* interested_parties */,
     HandshakeManager* handshake_manager) {
   tsi_handshaker* handshaker = nullptr;
   // Re-use local_tsi_handshaker_create as a minimalist handshaker.
@@ -67,7 +76,7 @@ void InsecureChannelSecurityConnector::add_handshakers(
 }
 
 void InsecureChannelSecurityConnector::check_peer(
-    tsi_peer peer, grpc_endpoint* /*ep*/,
+    tsi_peer peer, grpc_endpoint* /*ep*/, const ChannelArgs& /*args*/,
     RefCountedPtr<grpc_auth_context>* auth_context,
     grpc_closure* on_peer_checked) {
   *auth_context = MakeAuthContext();
@@ -85,7 +94,7 @@ int InsecureChannelSecurityConnector::cmp(
 // security handshaker so that check_peer is invoked and an auth_context is
 // created with the security level of TSI_SECURITY_NONE.
 void InsecureServerSecurityConnector::add_handshakers(
-    const grpc_channel_args* args, grpc_pollset_set* /* interested_parties */,
+    const ChannelArgs& args, grpc_pollset_set* /* interested_parties */,
     HandshakeManager* handshake_manager) {
   tsi_handshaker* handshaker = nullptr;
   // Re-use local_tsi_handshaker_create as a minimalist handshaker.
@@ -94,7 +103,7 @@ void InsecureServerSecurityConnector::add_handshakers(
 }
 
 void InsecureServerSecurityConnector::check_peer(
-    tsi_peer peer, grpc_endpoint* /*ep*/,
+    tsi_peer peer, grpc_endpoint* /*ep*/, const ChannelArgs& /*args*/,
     RefCountedPtr<grpc_auth_context>* auth_context,
     grpc_closure* on_peer_checked) {
   *auth_context = MakeAuthContext();

data/src/core/lib/security/security_connector/insecure/insecure_security_connector.h

@@ -21,9 +21,25 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/security/context/security_context.h"
+#include <utility>
+
+#include "absl/status/status.h"
+#include "absl/strings/string_view.h"
+
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/closure.h"
+#include "src/core/lib/iomgr/endpoint.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/iomgr/iomgr_fwd.h"
+#include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
+#include "src/core/lib/transport/handshaker.h"
+#include "src/core/tsi/transport_security_interface.h"
 
 namespace grpc_core {
 
@@ -47,11 +63,11 @@ class InsecureChannelSecurityConnector
   ArenaPromise<absl::Status> CheckCallHost(
       absl::string_view host, grpc_auth_context* auth_context) override;
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const ChannelArgs& args,
                        grpc_pollset_set* /* interested_parties */,
                        HandshakeManager* handshake_manager) override;
 
-  void check_peer(tsi_peer peer, grpc_endpoint* ep,
+  void check_peer(tsi_peer peer, grpc_endpoint* ep, const ChannelArgs& /*args*/,
                   RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 
@@ -70,11 +86,11 @@ class InsecureServerSecurityConnector : public grpc_server_security_connector {
       : grpc_server_security_connector("" /* url_scheme */,
                                        std::move(server_creds)) {}
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const ChannelArgs& args,
                        grpc_pollset_set* /* interested_parties */,
                        HandshakeManager* handshake_manager) override;
 
-  void check_peer(tsi_peer peer, grpc_endpoint* ep,
+  void check_peer(tsi_peer peer, grpc_endpoint* ep, const ChannelArgs& /*args*/,
                   RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 

data/src/core/lib/security/security_connector/load_system_roots_fallback.cc

@@ -18,16 +18,18 @@
 
 #include <grpc/support/port_platform.h>
 
+#if !defined(GPR_LINUX) && !defined(GPR_ANDROID) && !defined(GPR_FREEBSD) && \
+    !defined(GPR_APPLE)
+
+#include <grpc/slice.h>
 #include <grpc/slice_buffer.h>
 
 #include "src/core/lib/security/security_connector/load_system_roots.h"
 
-#if !defined(GPR_LINUX) && !defined(GPR_ANDROID)
-
 namespace grpc_core {
 
 grpc_slice LoadSystemRootCerts() { return grpc_empty_slice(); }
 
 }  // namespace grpc_core
 
-#endif /* !(GPR_LINUX || GPR_ANDROID) */
+#endif /* !(GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE) */

data/src/core/lib/security/security_connector/{load_system_roots_linux.cc → load_system_roots_supported.cc}

@@ -18,32 +18,31 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/security/security_connector/load_system_roots_linux.h"
+#include <algorithm>
+#include <memory>
+#include <vector>
 
-#include <grpc/slice_buffer.h>
-
-#if defined(GPR_LINUX) || defined(GPR_ANDROID)
+#if defined(GPR_LINUX) || defined(GPR_ANDROID) || defined(GPR_FREEBSD) || \
+    defined(GPR_APPLE)
 
 #include <dirent.h>
 #include <fcntl.h>
-#include <stdbool.h>
+#include <stdio.h>
 #include <string.h>
 #include <sys/param.h>
 #include <sys/stat.h>
-#include <sys/types.h>
 #include <unistd.h>
 
-#include "absl/container/inlined_vector.h"
-
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
 
-#include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/global_config.h"
+#include "src/core/lib/gprpp/memory.h"
+#include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/load_file.h"
 #include "src/core/lib/security/security_connector/load_system_roots.h"
+#include "src/core/lib/security/security_connector/load_system_roots_supported.h"
 
 GPR_GLOBAL_CONFIG_DEFINE_STRING(grpc_system_ssl_roots_dir, "",
                                 "Custom directory to SSL Roots");
@@ -51,21 +50,30 @@ GPR_GLOBAL_CONFIG_DEFINE_STRING(grpc_system_ssl_roots_dir, "",
 namespace grpc_core {
 namespace {
 
-const char* kLinuxCertFiles[] = {
+#if defined(GPR_LINUX) || defined(GPR_ANDROID)
+const char* kCertFiles[] = {
     "/etc/ssl/certs/ca-certificates.crt", "/etc/pki/tls/certs/ca-bundle.crt",
     "/etc/ssl/ca-bundle.pem", "/etc/pki/tls/cacert.pem",
     "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"};
-const char* kLinuxCertDirectories[] = {
+const char* kCertDirectories[] = {
     "/etc/ssl/certs", "/system/etc/security/cacerts", "/usr/local/share/certs",
     "/etc/pki/tls/certs", "/etc/openssl/certs"};
+#elif defined(GPR_FREEBSD)  // endif GPR_LINUX || GPR_ANDROID
+const char* kCertFiles[] = {"/etc/ssl/cert.pem",
+                            "/usr/local/share/certs/ca-root-nss.crt"};
+const char* kCertDirectories[] = {""};
+#elif defined(GPR_APPLE)    // endif GPR_FREEBSD
+const char* kCertFiles[] = {"/etc/ssl/cert.pem"};
+const char* kCertDirectories[] = {""};
+#endif                      // GPR_APPLE
 
 grpc_slice GetSystemRootCerts() {
   grpc_slice valid_bundle_slice = grpc_empty_slice();
-  size_t num_cert_files_ = GPR_ARRAY_SIZE(kLinuxCertFiles);
+  size_t num_cert_files_ = GPR_ARRAY_SIZE(kCertFiles);
   for (size_t i = 0; i < num_cert_files_; i++) {
     grpc_error_handle error =
-        grpc_load_file(kLinuxCertFiles[i], 1, &valid_bundle_slice);
-    if (error == GRPC_ERROR_NONE) {
+        grpc_load_file(kCertFiles[i], 1, &valid_bundle_slice);
+    if (GRPC_ERROR_IS_NONE(error)) {
       return valid_bundle_slice;
     } else {
       GRPC_ERROR_UNREF(error);
@@ -101,7 +109,7 @@ grpc_slice CreateRootCertsBundle(const char* certs_directory) {
     char path[MAXPATHLEN];
     off_t size;
   };
-  absl::InlinedVector<FileData, 2> roots_filenames;
+  std::vector<FileData> roots_filenames;
   size_t total_bundle_size = 0;
   struct dirent* directory_entry;
   while ((directory_entry = readdir(ca_directory)) != nullptr) {
@@ -155,8 +163,8 @@ grpc_slice LoadSystemRootCerts() {
     result = GetSystemRootCerts();
   }
   if (GRPC_SLICE_IS_EMPTY(result)) {
-    for (size_t i = 0; i < GPR_ARRAY_SIZE(kLinuxCertDirectories); i++) {
-      result = CreateRootCertsBundle(kLinuxCertDirectories[i]);
+    for (size_t i = 0; i < GPR_ARRAY_SIZE(kCertDirectories); i++) {
+      result = CreateRootCertsBundle(kCertDirectories[i]);
       if (!GRPC_SLICE_IS_EMPTY(result)) {
         break;
       }
@@ -167,4 +175,4 @@ grpc_slice LoadSystemRootCerts() {
 
 }  // namespace grpc_core
 
-#endif /* GPR_LINUX || GPR_ANDROID */
+#endif /* GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE */

data/src/core/lib/security/security_connector/{load_system_roots_linux.h → load_system_roots_supported.h}

@@ -16,14 +16,14 @@
  *
  */
 
-#ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOAD_SYSTEM_ROOTS_LINUX_H
-#define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOAD_SYSTEM_ROOTS_LINUX_H
+#ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOAD_SYSTEM_ROOTS_SUPPORTED_H
+#define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOAD_SYSTEM_ROOTS_SUPPORTED_H
 
 #include <grpc/support/port_platform.h>
 
 #include <grpc/slice.h>
 
-#ifdef GPR_LINUX
+#if defined(GPR_LINUX) || defined(GPR_FREEBSD) || defined(GPR_APPLE)
 
 namespace grpc_core {
 
@@ -41,6 +41,6 @@ void GetAbsoluteFilePath(const char* valid_file_dir,
 
 }  // namespace grpc_core
 
-#endif /* GPR_LINUX */
-#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOAD_SYSTEM_ROOTS_LINUX_H \
+#endif /* GPR_LINUX || GPR_FREEBSD || GPR_APPLE  */
+#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOAD_SYSTEM_ROOTS_SUPPORTED_H \
         */