grpc 1.47.0 → 1.53.0

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -16,13 +16,21 @@
 
 #include "src/core/lib/security/authorization/evaluate_args.h"
 
+#include <string.h>
+
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/match.h"
 #include "absl/strings/numbers.h"
 
+#include <grpc/grpc_security_constants.h>
+#include <grpc/support/log.h>
+
 #include "src/core/lib/address_utils/parse_address.h"
-#include "src/core/lib/address_utils/sockaddr_utils.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/security/credentials/tls/tls_utils.h"
-#include "src/core/lib/slice/slice_internal.h"
+#include "src/core/lib/slice/slice.h"
+#include "src/core/lib/uri/uri_parser.h"
 
 namespace grpc_core {
 
@@ -48,13 +56,14 @@ EvaluateArgs::PerChannelArgs::Address ParseEndpointUri(
             std::string(port_view).c_str());
   }
   address.address_str = std::string(host_view);
-  grpc_error_handle error = grpc_string_to_sockaddr(
-      &address.address, address.address_str.c_str(), address.port);
-  if (error != GRPC_ERROR_NONE) {
-    gpr_log(GPR_DEBUG, "Address %s is not IPv4/IPv6. Error: %s",
-            address.address_str.c_str(), grpc_error_std_string(error).c_str());
+  auto resolved_address = StringToSockaddr(uri->path());
+  if (!resolved_address.ok()) {
+    gpr_log(GPR_DEBUG, "Address \"%s\" is not IPv4/IPv6. Error: %s",
+            uri->path().c_str(), resolved_address.status().ToString().c_str());
+    memset(&address.address, 0, sizeof(address.address));
+  } else {
+    address.address = *resolved_address;
   }
-  GRPC_ERROR_UNREF(error);
   return address;
 }
 

data/src/core/lib/security/authorization/evaluate_args.h

@@ -12,18 +12,21 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
-#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
+#ifndef GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
+#define GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
 
 #include <grpc/support/port_platform.h>
 
-#include <map>
+#include <string>
+#include <vector>
 
+#include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
+#include <grpc/grpc_security.h>
+
 #include "src/core/lib/iomgr/endpoint.h"
-#include "src/core/lib/iomgr/resolve_address.h"
-#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/iomgr/resolved_address.h"
 #include "src/core/lib/transport/metadata_batch.h"
 
 namespace grpc_core {
@@ -89,4 +92,4 @@ class EvaluateArgs {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
+#endif  // GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H

data/src/core/lib/security/authorization/grpc_authorization_engine.cc

@@ -16,6 +16,10 @@
 
 #include "src/core/lib/security/authorization/grpc_authorization_engine.h"
 
+#include <algorithm>
+#include <map>
+#include <utility>
+
 namespace grpc_core {
 
 GrpcAuthorizationEngine::GrpcAuthorizationEngine(Rbac policy)
@@ -23,7 +27,7 @@ GrpcAuthorizationEngine::GrpcAuthorizationEngine(Rbac policy)
   for (auto& sub_policy : policy.policies) {
     Policy policy;
     policy.name = sub_policy.first;
-    policy.matcher = absl::make_unique<PolicyAuthorizationMatcher>(
+    policy.matcher = std::make_unique<PolicyAuthorizationMatcher>(
         std::move(sub_policy.second));
     policies_.push_back(std::move(policy));
   }

data/src/core/lib/security/authorization/grpc_authorization_engine.h

@@ -12,12 +12,19 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_AUTHORIZATION_ENGINE_H
-#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_AUTHORIZATION_ENGINE_H
+#ifndef GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_AUTHORIZATION_ENGINE_H
+#define GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_AUTHORIZATION_ENGINE_H
 
 #include <grpc/support/port_platform.h>
 
+#include <stddef.h>
+
+#include <memory>
+#include <string>
+#include <vector>
+
 #include "src/core/lib/security/authorization/authorization_engine.h"
+#include "src/core/lib/security/authorization/evaluate_args.h"
 #include "src/core/lib/security/authorization/matchers.h"
 #include "src/core/lib/security/authorization/rbac_policy.h"
 
@@ -59,4 +66,4 @@ class GrpcAuthorizationEngine : public AuthorizationEngine {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_AUTHORIZATION_ENGINE_H
+#endif  // GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_AUTHORIZATION_ENGINE_H

data/src/core/lib/security/authorization/grpc_server_authz_filter.cc

@@ -16,10 +16,22 @@
 
 #include "src/core/lib/security/authorization/grpc_server_authz_filter.h"
 
+#include <functional>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "absl/status/status.h"
 #include "absl/strings/str_join.h"
+#include "absl/strings/string_view.h"
+
+#include <grpc/support/log.h>
 
+#include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/debug/trace.h"
 #include "src/core/lib/promise/promise.h"
+#include "src/core/lib/security/authorization/authorization_engine.h"
 #include "src/core/lib/security/authorization/evaluate_args.h"
 #include "src/core/lib/transport/transport.h"
 
@@ -35,7 +47,7 @@ GrpcServerAuthzFilter::GrpcServerAuthzFilter(
       provider_(std::move(provider)) {}
 
 absl::StatusOr<GrpcServerAuthzFilter> GrpcServerAuthzFilter::Create(
-    ChannelArgs args, ChannelFilter::Args) {
+    const ChannelArgs& args, ChannelFilter::Args) {
   auto* auth_context = args.GetObject<grpc_auth_context>();
   auto* provider = args.GetObject<grpc_authorization_policy_provider>();
   if (provider == nullptr) {
@@ -96,8 +108,9 @@ bool GrpcServerAuthzFilter::IsAuthorized(
 ArenaPromise<ServerMetadataHandle> GrpcServerAuthzFilter::MakeCallPromise(
     CallArgs call_args, NextPromiseFactory next_promise_factory) {
   if (!IsAuthorized(call_args.client_initial_metadata)) {
-    return ArenaPromise<ServerMetadataHandle>(Immediate(ServerMetadataHandle(
-        absl::PermissionDeniedError("Unauthorized RPC request rejected."))));
+    return ArenaPromise<ServerMetadataHandle>(
+        Immediate(ServerMetadataFromStatus(absl::PermissionDeniedError(
+            "Unauthorized RPC request rejected."))));
   }
   return next_promise_factory(std::move(call_args));
 }

data/src/core/lib/security/authorization/grpc_server_authz_filter.h

@@ -12,14 +12,25 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_SERVER_AUTHZ_FILTER_H
-#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_SERVER_AUTHZ_FILTER_H
+#ifndef GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_SERVER_AUTHZ_FILTER_H
+#define GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_SERVER_AUTHZ_FILTER_H
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/channel/channel_stack.h"
+#include "absl/status/statusor.h"
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/endpoint.h"
+#include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/authorization/authorization_policy_provider.h"
+#include "src/core/lib/security/authorization/evaluate_args.h"
+#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/transport/transport.h"
 
 namespace grpc_core {
 
@@ -27,7 +38,7 @@ class GrpcServerAuthzFilter final : public ChannelFilter {
  public:
   static const grpc_channel_filter kFilterVtable;
 
-  static absl::StatusOr<GrpcServerAuthzFilter> Create(ChannelArgs args,
+  static absl::StatusOr<GrpcServerAuthzFilter> Create(const ChannelArgs& args,
                                                       ChannelFilter::Args);
 
   ArenaPromise<ServerMetadataHandle> MakeCallPromise(
@@ -47,4 +58,4 @@ class GrpcServerAuthzFilter final : public ChannelFilter {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_SERVER_AUTHZ_FILTER_H
+#endif  // GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_SERVER_AUTHZ_FILTER_H

data/src/core/lib/security/authorization/matchers.cc

@@ -16,7 +16,17 @@
 
 #include "src/core/lib/security/authorization/matchers.h"
 
+#include <string.h>
+
+#include <algorithm>
+#include <string>
+
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
 #include <grpc/grpc_security_constants.h>
+#include <grpc/support/log.h>
 
 #include "src/core/lib/address_utils/parse_address.h"
 #include "src/core/lib/address_utils/sockaddr_utils.h"
@@ -28,38 +38,40 @@ std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
   switch (permission.type) {
     case Rbac::Permission::RuleType::kAnd: {
       std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
+      matchers.reserve(permission.permissions.size());
       for (const auto& rule : permission.permissions) {
         matchers.push_back(AuthorizationMatcher::Create(std::move(*rule)));
       }
-      return absl::make_unique<AndAuthorizationMatcher>(std::move(matchers));
+      return std::make_unique<AndAuthorizationMatcher>(std::move(matchers));
     }
     case Rbac::Permission::RuleType::kOr: {
       std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
+      matchers.reserve(permission.permissions.size());
       for (const auto& rule : permission.permissions) {
         matchers.push_back(AuthorizationMatcher::Create(std::move(*rule)));
       }
-      return absl::make_unique<OrAuthorizationMatcher>(std::move(matchers));
+      return std::make_unique<OrAuthorizationMatcher>(std::move(matchers));
     }
     case Rbac::Permission::RuleType::kNot:
-      return absl::make_unique<NotAuthorizationMatcher>(
+      return std::make_unique<NotAuthorizationMatcher>(
           AuthorizationMatcher::Create(std::move(*permission.permissions[0])));
     case Rbac::Permission::RuleType::kAny:
-      return absl::make_unique<AlwaysAuthorizationMatcher>();
+      return std::make_unique<AlwaysAuthorizationMatcher>();
     case Rbac::Permission::RuleType::kHeader:
-      return absl::make_unique<HeaderAuthorizationMatcher>(
+      return std::make_unique<HeaderAuthorizationMatcher>(
           std::move(permission.header_matcher));
     case Rbac::Permission::RuleType::kPath:
-      return absl::make_unique<PathAuthorizationMatcher>(
+      return std::make_unique<PathAuthorizationMatcher>(
           std::move(permission.string_matcher));
     case Rbac::Permission::RuleType::kDestIp:
-      return absl::make_unique<IpAuthorizationMatcher>(
+      return std::make_unique<IpAuthorizationMatcher>(
           IpAuthorizationMatcher::Type::kDestIp, std::move(permission.ip));
     case Rbac::Permission::RuleType::kDestPort:
-      return absl::make_unique<PortAuthorizationMatcher>(permission.port);
+      return std::make_unique<PortAuthorizationMatcher>(permission.port);
     case Rbac::Permission::RuleType::kMetadata:
-      return absl::make_unique<MetadataAuthorizationMatcher>(permission.invert);
+      return std::make_unique<MetadataAuthorizationMatcher>(permission.invert);
     case Rbac::Permission::RuleType::kReqServerName:
-      return absl::make_unique<ReqServerNameAuthorizationMatcher>(
+      return std::make_unique<ReqServerNameAuthorizationMatcher>(
           std::move(permission.string_matcher));
   }
   return nullptr;
@@ -70,44 +82,46 @@ std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
   switch (principal.type) {
     case Rbac::Principal::RuleType::kAnd: {
       std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
+      matchers.reserve(principal.principals.size());
       for (const auto& id : principal.principals) {
         matchers.push_back(AuthorizationMatcher::Create(std::move(*id)));
       }
-      return absl::make_unique<AndAuthorizationMatcher>(std::move(matchers));
+      return std::make_unique<AndAuthorizationMatcher>(std::move(matchers));
     }
     case Rbac::Principal::RuleType::kOr: {
       std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
+      matchers.reserve(principal.principals.size());
       for (const auto& id : principal.principals) {
         matchers.push_back(AuthorizationMatcher::Create(std::move(*id)));
       }
-      return absl::make_unique<OrAuthorizationMatcher>(std::move(matchers));
+      return std::make_unique<OrAuthorizationMatcher>(std::move(matchers));
     }
     case Rbac::Principal::RuleType::kNot:
-      return absl::make_unique<NotAuthorizationMatcher>(
+      return std::make_unique<NotAuthorizationMatcher>(
           AuthorizationMatcher::Create(std::move(*principal.principals[0])));
     case Rbac::Principal::RuleType::kAny:
-      return absl::make_unique<AlwaysAuthorizationMatcher>();
+      return std::make_unique<AlwaysAuthorizationMatcher>();
     case Rbac::Principal::RuleType::kPrincipalName:
-      return absl::make_unique<AuthenticatedAuthorizationMatcher>(
+      return std::make_unique<AuthenticatedAuthorizationMatcher>(
           std::move(principal.string_matcher));
     case Rbac::Principal::RuleType::kSourceIp:
-      return absl::make_unique<IpAuthorizationMatcher>(
+      return std::make_unique<IpAuthorizationMatcher>(
           IpAuthorizationMatcher::Type::kSourceIp, std::move(principal.ip));
     case Rbac::Principal::RuleType::kDirectRemoteIp:
-      return absl::make_unique<IpAuthorizationMatcher>(
+      return std::make_unique<IpAuthorizationMatcher>(
           IpAuthorizationMatcher::Type::kDirectRemoteIp,
           std::move(principal.ip));
     case Rbac::Principal::RuleType::kRemoteIp:
-      return absl::make_unique<IpAuthorizationMatcher>(
+      return std::make_unique<IpAuthorizationMatcher>(
           IpAuthorizationMatcher::Type::kRemoteIp, std::move(principal.ip));
     case Rbac::Principal::RuleType::kHeader:
-      return absl::make_unique<HeaderAuthorizationMatcher>(
+      return std::make_unique<HeaderAuthorizationMatcher>(
           std::move(principal.header_matcher));
     case Rbac::Principal::RuleType::kPath:
-      return absl::make_unique<PathAuthorizationMatcher>(
+      return std::make_unique<PathAuthorizationMatcher>(
           std::move(principal.string_matcher.value()));
     case Rbac::Principal::RuleType::kMetadata:
-      return absl::make_unique<MetadataAuthorizationMatcher>(principal.invert);
+      return std::make_unique<MetadataAuthorizationMatcher>(principal.invert);
   }
   return nullptr;
 }
@@ -142,16 +156,16 @@ bool HeaderAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
 
 IpAuthorizationMatcher::IpAuthorizationMatcher(Type type, Rbac::CidrRange range)
     : type_(type), prefix_len_(range.prefix_len) {
-  grpc_error_handle error =
-      grpc_string_to_sockaddr(&subnet_address_, range.address_prefix.c_str(),
-                              /*port does not matter here*/ 0);
-  if (error == GRPC_ERROR_NONE) {
-    grpc_sockaddr_mask_bits(&subnet_address_, prefix_len_);
-  } else {
-    gpr_log(GPR_DEBUG, "CidrRange address %s is not IPv4/IPv6. Error: %s",
-            range.address_prefix.c_str(), grpc_error_std_string(error).c_str());
+  auto address =
+      StringToSockaddr(range.address_prefix, 0);  // Port does not matter here.
+  if (!address.ok()) {
+    gpr_log(GPR_DEBUG, "CidrRange address \"%s\" is not IPv4/IPv6. Error: %s",
+            range.address_prefix.c_str(), address.status().ToString().c_str());
+    memset(&subnet_address_, 0, sizeof(subnet_address_));
+    return;
   }
-  GRPC_ERROR_UNREF(error);
+  subnet_address_ = *address;
+  grpc_sockaddr_mask_bits(&subnet_address_, prefix_len_);
 }
 
 bool IpAuthorizationMatcher::Matches(const EvaluateArgs& args) const {

data/src/core/lib/security/authorization/matchers.h

@@ -12,13 +12,20 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H
-#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H
+#ifndef GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H
+#define GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H
 
 #include <grpc/support/port_platform.h>
 
+#include <stdint.h>
+
 #include <memory>
+#include <utility>
+#include <vector>
+
+#include "absl/types/optional.h"
 
+#include "src/core/lib/iomgr/resolved_address.h"
 #include "src/core/lib/matchers/matchers.h"
 #include "src/core/lib/security/authorization/evaluate_args.h"
 #include "src/core/lib/security/authorization/rbac_policy.h"
@@ -208,4 +215,4 @@ class PolicyAuthorizationMatcher : public AuthorizationMatcher {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H
+#endif  // GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H

data/src/core/lib/security/authorization/rbac_policy.cc

@@ -16,6 +16,10 @@
 
 #include "src/core/lib/security/authorization/rbac_policy.h"
 
+#include <algorithm>
+#include <initializer_list>
+#include <utility>
+
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 
@@ -95,7 +99,7 @@ Rbac::Permission Rbac::Permission::MakeNotPermission(Permission permission) {
   Permission not_permission;
   not_permission.type = Permission::RuleType::kNot;
   not_permission.permissions.push_back(
-      absl::make_unique<Rbac::Permission>(std::move(permission)));
+      std::make_unique<Rbac::Permission>(std::move(permission)));
   return not_permission;
 }
 
@@ -267,7 +271,7 @@ Rbac::Principal Rbac::Principal::MakeNotPrincipal(Principal principal) {
   Principal not_principal;
   not_principal.type = Principal::RuleType::kNot;
   not_principal.principals.push_back(
-      absl::make_unique<Rbac::Principal>(std::move(principal)));
+      std::make_unique<Rbac::Principal>(std::move(principal)));
   return not_principal;
 }
 

data/src/core/lib/security/authorization/rbac_policy.h

@@ -12,12 +12,19 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H
-#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H
+#ifndef GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H
+#define GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H
 
 #include <grpc/support/port_platform.h>
 
+#include <stdint.h>
+
+#include <map>
 #include <memory>
+#include <string>
+#include <vector>
+
+#include "absl/types/optional.h"
 
 #include "src/core/lib/matchers/matchers.h"
 
@@ -168,4 +175,4 @@ struct Rbac {
 
 }  // namespace grpc_core
 
-#endif /* GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H */
+#endif  // GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H

data/src/core/{ext/xds → lib/security/certificate_provider}/certificate_provider_factory.h

@@ -16,14 +16,19 @@
 //
 //
 
-#ifndef GRPC_CORE_EXT_XDS_CERTIFICATE_PROVIDER_FACTORY_H
-#define GRPC_CORE_EXT_XDS_CERTIFICATE_PROVIDER_FACTORY_H
+#ifndef GRPC_SRC_CORE_LIB_SECURITY_CERTIFICATE_PROVIDER_CERTIFICATE_PROVIDER_FACTORY_H
+#define GRPC_SRC_CORE_LIB_SECURITY_CERTIFICATE_PROVIDER_CERTIFICATE_PROVIDER_FACTORY_H
 
 #include <grpc/support/port_platform.h>
 
+#include <string>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/json/json.h"
-#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
 
 namespace grpc_core {
 
@@ -58,4 +63,4 @@ class CertificateProviderFactory {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_CORE_EXT_XDS_CERTIFICATE_PROVIDER_FACTORY_H
+#endif  // GRPC_SRC_CORE_LIB_SECURITY_CERTIFICATE_PROVIDER_CERTIFICATE_PROVIDER_FACTORY_H

data/src/core/lib/security/certificate_provider/certificate_provider_registry.cc

@@ -0,0 +1,60 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/certificate_provider/certificate_provider_registry.h"
+
+#include <string.h>
+
+#include <algorithm>
+#include <utility>
+#include <vector>
+
+#include <grpc/support/log.h>
+
+namespace grpc_core {
+
+void CertificateProviderRegistry::Builder::RegisterCertificateProviderFactory(
+    std::unique_ptr<CertificateProviderFactory> factory) {
+  gpr_log(GPR_DEBUG, "registering certificate provider factory for \"%s\"",
+          factory->name());
+  for (size_t i = 0; i < factories_.size(); ++i) {
+    GPR_ASSERT(strcmp(factories_[i]->name(), factory->name()) != 0);
+  }
+  factories_.push_back(std::move(factory));
+}
+
+CertificateProviderRegistry CertificateProviderRegistry::Builder::Build() {
+  CertificateProviderRegistry r;
+  r.factories_ = std::move(factories_);
+  return r;
+}
+
+CertificateProviderFactory*
+CertificateProviderRegistry::LookupCertificateProviderFactory(
+    absl::string_view name) const {
+  for (size_t i = 0; i < factories_.size(); ++i) {
+    if (name == factories_[i]->name()) {
+      return factories_[i].get();
+    }
+  }
+  return nullptr;
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/certificate_provider/certificate_provider_registry.h

@@ -0,0 +1,70 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_SRC_CORE_LIB_SECURITY_CERTIFICATE_PROVIDER_CERTIFICATE_PROVIDER_REGISTRY_H
+#define GRPC_SRC_CORE_LIB_SECURITY_CERTIFICATE_PROVIDER_CERTIFICATE_PROVIDER_REGISTRY_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+#include <vector>
+
+#include "absl/strings/string_view.h"
+
+#include "src/core/lib/security/certificate_provider/certificate_provider_factory.h"
+
+namespace grpc_core {
+
+// Global registry for all the certificate provider plugins.
+class CertificateProviderRegistry {
+ public:
+  class Builder {
+   public:
+    // Register a provider with the registry. Can only be called after calling
+    // InitRegistry(). The key of the factory is extracted from factory
+    // parameter with method CertificateProviderFactory::name. If the same key
+    // is registered twice, an exception is raised.
+    void RegisterCertificateProviderFactory(
+        std::unique_ptr<CertificateProviderFactory> factory);
+
+    CertificateProviderRegistry Build();
+
+   private:
+    std::vector<std::unique_ptr<CertificateProviderFactory>> factories_;
+  };
+
+  CertificateProviderRegistry(const CertificateProviderRegistry&) = delete;
+  CertificateProviderRegistry& operator=(const CertificateProviderRegistry&) =
+      delete;
+  CertificateProviderRegistry(CertificateProviderRegistry&&) = default;
+  CertificateProviderRegistry& operator=(CertificateProviderRegistry&&) =
+      default;
+
+  // Returns the factory for the plugin keyed by name.
+  CertificateProviderFactory* LookupCertificateProviderFactory(
+      absl::string_view name) const;
+
+ private:
+  CertificateProviderRegistry() = default;
+
+  std::vector<std::unique_ptr<CertificateProviderFactory>> factories_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_LIB_SECURITY_CERTIFICATE_PROVIDER_CERTIFICATE_PROVIDER_REGISTRY_H