grpc 1.48.0 → 1.50.0

data/src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -23,13 +23,16 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include <string>
 #include <utility>
 
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
 
 #include <grpc/grpc_security_constants.h>
+#include <grpc/impl/codegen/grpc_types.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
@@ -47,7 +50,6 @@
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/promise/arena_promise.h"
-#include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
@@ -64,33 +66,22 @@ class grpc_fake_channel_security_connector final
   grpc_fake_channel_security_connector(
       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-      const char* target, const grpc_channel_args* args)
+      const char* target, const grpc_core::ChannelArgs& args)
       : grpc_channel_security_connector(GRPC_FAKE_SECURITY_URL_SCHEME,
                                         std::move(channel_creds),
                                         std::move(request_metadata_creds)),
         target_(gpr_strdup(target)),
         expected_targets_(
-            gpr_strdup(grpc_fake_transport_get_expected_targets(args))),
-        is_lb_channel_(grpc_channel_args_find(
-                           args, GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER) !=
-                       nullptr) {
-    const grpc_arg* target_name_override_arg =
-        grpc_channel_args_find(args, GRPC_SSL_TARGET_NAME_OVERRIDE_ARG);
-    if (target_name_override_arg != nullptr) {
-      target_name_override_ =
-          gpr_strdup(grpc_channel_arg_get_string(target_name_override_arg));
-    } else {
-      target_name_override_ = nullptr;
-    }
-  }
+            args.GetOwnedString(GRPC_ARG_FAKE_SECURITY_EXPECTED_TARGETS)),
+        is_lb_channel_(args.GetBool(GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER)
+                           .value_or(false)),
+        target_name_override_(
+            args.GetOwnedString(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG)) {}
 
-  ~grpc_fake_channel_security_connector() override {
-    gpr_free(target_);
-    gpr_free(expected_targets_);
-    if (target_name_override_ != nullptr) gpr_free(target_name_override_);
-  }
+  ~grpc_fake_channel_security_connector() override { gpr_free(target_); }
 
   void check_peer(tsi_peer peer, grpc_endpoint* ep,
+                  const grpc_core::ChannelArgs& /*args*/,
                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 
@@ -106,16 +97,12 @@ class grpc_fake_channel_security_connector final
     if (c != 0) return c;
     c = strcmp(target_, other->target_);
     if (c != 0) return c;
-    if (expected_targets_ == nullptr || other->expected_targets_ == nullptr) {
-      c = grpc_core::QsortCompare(expected_targets_, other->expected_targets_);
-    } else {
-      c = strcmp(expected_targets_, other->expected_targets_);
-    }
+    c = grpc_core::QsortCompare(expected_targets_, other->expected_targets_);
     if (c != 0) return c;
     return grpc_core::QsortCompare(is_lb_channel_, other->is_lb_channel_);
   }
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const grpc_core::ChannelArgs& args,
                        grpc_pollset_set* /*interested_parties*/,
                        grpc_core::HandshakeManager* handshake_mgr) override {
     handshake_mgr->Add(grpc_core::SecurityHandshakerCreate(
@@ -131,11 +118,12 @@ class grpc_fake_channel_security_connector final
     grpc_core::SplitHostPort(host, &authority_hostname,
                              &authority_ignored_port);
     grpc_core::SplitHostPort(target_, &target_hostname, &target_ignored_port);
-    if (target_name_override_ != nullptr) {
+    if (target_name_override_.has_value()) {
       absl::string_view fake_security_target_name_override_hostname;
       absl::string_view fake_security_target_name_override_ignored_port;
       grpc_core::SplitHostPort(
-          target_name_override_, &fake_security_target_name_override_hostname,
+          target_name_override_->c_str(),
+          &fake_security_target_name_override_hostname,
           &fake_security_target_name_override_ignored_port);
       if (authority_hostname != fake_security_target_name_override_hostname) {
         gpr_log(GPR_ERROR,
@@ -153,9 +141,7 @@ class grpc_fake_channel_security_connector final
   }
 
   char* target() const { return target_; }
-  char* expected_targets() const { return expected_targets_; }
   bool is_lb_channel() const { return is_lb_channel_; }
-  char* target_name_override() const { return target_name_override_; }
 
  private:
   bool fake_check_target(const char* target, const char* set_str) const {
@@ -175,15 +161,15 @@ class grpc_fake_channel_security_connector final
   }
 
   void fake_secure_name_check() const {
-    if (expected_targets_ == nullptr) return;
+    if (!expected_targets_.has_value()) return;
     char** lbs_and_backends = nullptr;
     size_t lbs_and_backends_size = 0;
     bool success = false;
-    gpr_string_split(expected_targets_, ";", &lbs_and_backends,
+    gpr_string_split(expected_targets_->c_str(), ";", &lbs_and_backends,
                      &lbs_and_backends_size);
     if (lbs_and_backends_size > 2 || lbs_and_backends_size == 0) {
       gpr_log(GPR_ERROR, "Invalid expected targets arg value: '%s'",
-              expected_targets_);
+              expected_targets_->c_str());
       goto done;
     }
     if (is_lb_channel_) {
@@ -191,7 +177,7 @@ class grpc_fake_channel_security_connector final
         gpr_log(GPR_ERROR,
                 "Invalid expected targets arg value: '%s'. Expectations for LB "
                 "channels must be of the form 'be1,be2,be3,...;lb1,lb2,...",
-                expected_targets_);
+                expected_targets_->c_str());
         goto done;
       }
       if (!fake_check_target(target_, lbs_and_backends[1])) {
@@ -217,9 +203,9 @@ class grpc_fake_channel_security_connector final
   }
 
   char* target_;
-  char* expected_targets_;
+  absl::optional<std::string> expected_targets_;
   bool is_lb_channel_;
-  char* target_name_override_;
+  absl::optional<std::string> target_name_override_;
 };
 
 void fake_check_peer(grpc_security_connector* /*sc*/, tsi_peer peer,
@@ -276,6 +262,7 @@ end:
 
 void grpc_fake_channel_security_connector::check_peer(
     tsi_peer peer, grpc_endpoint* /*ep*/,
+    const grpc_core::ChannelArgs& /*args*/,
     grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
     grpc_closure* on_peer_checked) {
   fake_check_peer(this, peer, auth_context, on_peer_checked);
@@ -292,6 +279,7 @@ class grpc_fake_server_security_connector
   ~grpc_fake_server_security_connector() override = default;
 
   void check_peer(tsi_peer peer, grpc_endpoint* /*ep*/,
+                  const grpc_core::ChannelArgs& /*args*/,
                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override {
     fake_check_peer(this, peer, auth_context, on_peer_checked);
@@ -302,7 +290,7 @@ class grpc_fake_server_security_connector
     GRPC_ERROR_UNREF(error);
   }
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const grpc_core::ChannelArgs& args,
                        grpc_pollset_set* /*interested_parties*/,
                        grpc_core::HandshakeManager* handshake_mgr) override {
     handshake_mgr->Add(grpc_core::SecurityHandshakerCreate(
@@ -320,7 +308,7 @@ grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_fake_channel_security_connector_create(
     grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-    const char* target, const grpc_channel_args* args) {
+    const char* target, const grpc_core::ChannelArgs& args) {
   return grpc_core::MakeRefCounted<grpc_fake_channel_security_connector>(
       std::move(channel_creds), std::move(request_metadata_creds), target,
       args);

data/src/core/lib/security/security_connector/fake/fake_security_connector.h

@@ -22,8 +22,8 @@
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
-#include <grpc/impl/codegen/grpc_types.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 
@@ -32,7 +32,7 @@ grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_fake_channel_security_connector_create(
     grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-    const char* target, const grpc_channel_args* args);
+    const char* target, const grpc_core::ChannelArgs& args);
 
 /* Creates a fake connector that emulates real server security.  */
 grpc_core::RefCountedPtr<grpc_server_security_connector>

data/src/core/lib/security/security_connector/insecure/insecure_security_connector.cc

@@ -25,10 +25,10 @@
 #include <grpc/grpc_security_constants.h>
 #include <grpc/support/log.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
-#include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
@@ -67,7 +67,7 @@ ArenaPromise<absl::Status> InsecureChannelSecurityConnector::CheckCallHost(
 // security handshaker so that check_peer is invoked and an auth_context is
 // created with the security level of TSI_SECURITY_NONE.
 void InsecureChannelSecurityConnector::add_handshakers(
-    const grpc_channel_args* args, grpc_pollset_set* /* interested_parties */,
+    const ChannelArgs& args, grpc_pollset_set* /* interested_parties */,
     HandshakeManager* handshake_manager) {
   tsi_handshaker* handshaker = nullptr;
   // Re-use local_tsi_handshaker_create as a minimalist handshaker.
@@ -76,7 +76,7 @@ void InsecureChannelSecurityConnector::add_handshakers(
 }
 
 void InsecureChannelSecurityConnector::check_peer(
-    tsi_peer peer, grpc_endpoint* /*ep*/,
+    tsi_peer peer, grpc_endpoint* /*ep*/, const ChannelArgs& /*args*/,
     RefCountedPtr<grpc_auth_context>* auth_context,
     grpc_closure* on_peer_checked) {
   *auth_context = MakeAuthContext();
@@ -94,7 +94,7 @@ int InsecureChannelSecurityConnector::cmp(
 // security handshaker so that check_peer is invoked and an auth_context is
 // created with the security level of TSI_SECURITY_NONE.
 void InsecureServerSecurityConnector::add_handshakers(
-    const grpc_channel_args* args, grpc_pollset_set* /* interested_parties */,
+    const ChannelArgs& args, grpc_pollset_set* /* interested_parties */,
     HandshakeManager* handshake_manager) {
   tsi_handshaker* handshaker = nullptr;
   // Re-use local_tsi_handshaker_create as a minimalist handshaker.
@@ -103,7 +103,7 @@ void InsecureServerSecurityConnector::add_handshakers(
 }
 
 void InsecureServerSecurityConnector::check_peer(
-    tsi_peer peer, grpc_endpoint* /*ep*/,
+    tsi_peer peer, grpc_endpoint* /*ep*/, const ChannelArgs& /*args*/,
     RefCountedPtr<grpc_auth_context>* auth_context,
     grpc_closure* on_peer_checked) {
   *auth_context = MakeAuthContext();

data/src/core/lib/security/security_connector/insecure/insecure_security_connector.h

@@ -18,6 +18,7 @@
 
 #ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_INSECURE_INSECURE_SECURITY_CONNECTOR_H
 #define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_INSECURE_INSECURE_SECURITY_CONNECTOR_H
+
 #include <grpc/support/port_platform.h>
 
 #include <utility>
@@ -27,8 +28,8 @@
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
-#include <grpc/impl/codegen/grpc_types.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/endpoint.h"
@@ -62,11 +63,11 @@ class InsecureChannelSecurityConnector
   ArenaPromise<absl::Status> CheckCallHost(
       absl::string_view host, grpc_auth_context* auth_context) override;
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const ChannelArgs& args,
                        grpc_pollset_set* /* interested_parties */,
                        HandshakeManager* handshake_manager) override;
 
-  void check_peer(tsi_peer peer, grpc_endpoint* ep,
+  void check_peer(tsi_peer peer, grpc_endpoint* ep, const ChannelArgs& /*args*/,
                   RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 
@@ -85,11 +86,11 @@ class InsecureServerSecurityConnector : public grpc_server_security_connector {
       : grpc_server_security_connector("" /* url_scheme */,
                                        std::move(server_creds)) {}
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const ChannelArgs& args,
                        grpc_pollset_set* /* interested_parties */,
                        HandshakeManager* handshake_manager) override;
 
-  void check_peer(tsi_peer peer, grpc_endpoint* ep,
+  void check_peer(tsi_peer peer, grpc_endpoint* ep, const ChannelArgs& /*args*/,
                   RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 

data/src/core/lib/security/security_connector/local/local_security_connector.cc

@@ -27,7 +27,9 @@
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/match.h"
 #include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security_constants.h>
@@ -51,7 +53,6 @@
 #include "src/core/lib/iomgr/socket_utils.h"
 #include "src/core/lib/iomgr/unix_sockets_posix.h"
 #include "src/core/lib/promise/arena_promise.h"
-#include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
@@ -178,7 +179,8 @@ class grpc_local_channel_security_connector final
   ~grpc_local_channel_security_connector() override { gpr_free(target_name_); }
 
   void add_handshakers(
-      const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
+      const grpc_core::ChannelArgs& args,
+      grpc_pollset_set* /*interested_parties*/,
       grpc_core::HandshakeManager* handshake_manager) override {
     tsi_handshaker* handshaker = nullptr;
     GPR_ASSERT(tsi_local_handshaker_create(&handshaker) == TSI_OK);
@@ -196,6 +198,7 @@ class grpc_local_channel_security_connector final
   }
 
   void check_peer(tsi_peer peer, grpc_endpoint* ep,
+                  const grpc_core::ChannelArgs& /*args*/,
                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override {
     grpc_local_credentials* creds =
@@ -233,7 +236,8 @@ class grpc_local_server_security_connector final
   ~grpc_local_server_security_connector() override = default;
 
   void add_handshakers(
-      const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
+      const grpc_core::ChannelArgs& args,
+      grpc_pollset_set* /*interested_parties*/,
       grpc_core::HandshakeManager* handshake_manager) override {
     tsi_handshaker* handshaker = nullptr;
     GPR_ASSERT(tsi_local_handshaker_create(&handshaker) == TSI_OK);
@@ -242,6 +246,7 @@ class grpc_local_server_security_connector final
   }
 
   void check_peer(tsi_peer peer, grpc_endpoint* ep,
+                  const grpc_core::ChannelArgs& /*args*/,
                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override {
     grpc_local_server_credentials* creds =
@@ -266,7 +271,7 @@ grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_local_channel_security_connector_create(
     grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-    const grpc_channel_args* args, const char* target_name) {
+    const grpc_core::ChannelArgs& args, const char* target_name) {
   if (channel_creds == nullptr || target_name == nullptr) {
     gpr_log(
         GPR_ERROR,
@@ -277,14 +282,11 @@ grpc_local_channel_security_connector_create(
   // will be done during check_peer procedure.
   grpc_local_credentials* creds =
       static_cast<grpc_local_credentials*>(channel_creds.get());
-  const grpc_arg* server_uri_arg =
-      grpc_channel_args_find(args, GRPC_ARG_SERVER_URI);
-  const char* server_uri_str = grpc_channel_arg_get_string(server_uri_arg);
+  absl::string_view server_uri_str =
+      args.GetString(GRPC_ARG_SERVER_URI).value_or("");
   if (creds->connect_type() == UDS &&
-      strncmp(GRPC_UDS_URI_PATTERN, server_uri_str,
-              strlen(GRPC_UDS_URI_PATTERN)) != 0 &&
-      strncmp(GRPC_ABSTRACT_UDS_URI_PATTERN, server_uri_str,
-              strlen(GRPC_ABSTRACT_UDS_URI_PATTERN)) != 0) {
+      !absl::StartsWith(server_uri_str, GRPC_UDS_URI_PATTERN) &&
+      !absl::StartsWith(server_uri_str, GRPC_ABSTRACT_UDS_URI_PATTERN)) {
     gpr_log(GPR_ERROR,
             "Invalid UDS target name to "
             "grpc_local_channel_security_connector_create()");

data/src/core/lib/security/security_connector/local/local_security_connector.h

@@ -22,8 +22,8 @@
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
-#include <grpc/impl/codegen/grpc_types.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 
@@ -44,7 +44,7 @@ grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_local_channel_security_connector_create(
     grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-    const grpc_channel_args* args, const char* target_name);
+    const grpc_core::ChannelArgs& args, const char* target_name);
 
 /**
  * This method creates a local server security connector.

data/src/core/lib/security/security_connector/security_connector.h

@@ -30,6 +30,7 @@
 #include <grpc/grpc_security.h>
 #include <grpc/impl/codegen/grpc_types.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
@@ -73,9 +74,10 @@ class grpc_security_connector
   }
 
   // Checks the peer. Callee takes ownership of the peer object.
+  // The channel args represent the args after the handshaking is performed.
   // When done, sets *auth_context and invokes on_peer_checked.
   virtual void check_peer(
-      tsi_peer peer, grpc_endpoint* ep,
+      tsi_peer peer, grpc_endpoint* ep, const grpc_core::ChannelArgs& args,
       grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
       grpc_closure* on_peer_checked) = 0;
 
@@ -128,7 +130,7 @@ class grpc_channel_security_connector : public grpc_security_connector {
       absl::string_view host, grpc_auth_context* auth_context) = 0;
 
   /// Registers handshakers with \a handshake_mgr.
-  virtual void add_handshakers(const grpc_channel_args* args,
+  virtual void add_handshakers(const grpc_core::ChannelArgs& args,
                                grpc_pollset_set* interested_parties,
                                grpc_core::HandshakeManager* handshake_mgr) = 0;
 
@@ -174,7 +176,7 @@ class grpc_server_security_connector : public grpc_security_connector {
       absl::string_view url_scheme,
       grpc_core::RefCountedPtr<grpc_server_credentials> server_creds);
 
-  virtual void add_handshakers(const grpc_channel_args* args,
+  virtual void add_handshakers(const grpc_core::ChannelArgs& args,
                                grpc_pollset_set* interested_parties,
                                grpc_core::HandshakeManager* handshake_mgr) = 0;
 

data/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc

@@ -31,10 +31,10 @@
 #include "absl/strings/str_format.h"
 #include "absl/strings/string_view.h"
 
-#include <grpc/impl/codegen/grpc_types.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
@@ -45,7 +45,6 @@
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/promise/arena_promise.h"
-#include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
@@ -132,7 +131,7 @@ class grpc_ssl_channel_security_connector final
     return GRPC_SECURITY_OK;
   }
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const grpc_core::ChannelArgs& args,
                        grpc_pollset_set* /*interested_parties*/,
                        grpc_core::HandshakeManager* handshake_mgr) override {
     // Instantiate TSI handshaker.
@@ -153,6 +152,7 @@ class grpc_ssl_channel_security_connector final
   }
 
   void check_peer(tsi_peer peer, grpc_endpoint* /*ep*/,
+                  const grpc_core::ChannelArgs& /*args*/,
                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override {
     const char* target_name = overridden_target_name_.empty()
@@ -278,7 +278,7 @@ class grpc_ssl_server_security_connector
     return GRPC_SECURITY_OK;
   }
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const grpc_core::ChannelArgs& args,
                        grpc_pollset_set* /*interested_parties*/,
                        grpc_core::HandshakeManager* handshake_mgr) override {
     // Instantiate TSI handshaker.
@@ -297,6 +297,7 @@ class grpc_ssl_server_security_connector
   }
 
   void check_peer(tsi_peer peer, grpc_endpoint* /*ep*/,
+                  const grpc_core::ChannelArgs& /*args*/,
                   grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override {
     grpc_error_handle error = ssl_check_peer(nullptr, &peer, auth_context);

data/src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -38,10 +38,10 @@
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
-#include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
@@ -330,7 +330,7 @@ TlsChannelSecurityConnector::~TlsChannelSecurityConnector() {
 }
 
 void TlsChannelSecurityConnector::add_handshakers(
-    const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
+    const ChannelArgs& args, grpc_pollset_set* /*interested_parties*/,
     HandshakeManager* handshake_mgr) {
   MutexLock lock(&mu_);
   tsi_handshaker* tsi_hs = nullptr;
@@ -352,7 +352,7 @@ void TlsChannelSecurityConnector::add_handshakers(
 }
 
 void TlsChannelSecurityConnector::check_peer(
-    tsi_peer peer, grpc_endpoint* /*ep*/,
+    tsi_peer peer, grpc_endpoint* /*ep*/, const ChannelArgs& /*args*/,
     RefCountedPtr<grpc_auth_context>* auth_context,
     grpc_closure* on_peer_checked) {
   const char* target_name = overridden_target_name_.empty()
@@ -620,7 +620,7 @@ TlsServerSecurityConnector::~TlsServerSecurityConnector() {
 }
 
 void TlsServerSecurityConnector::add_handshakers(
-    const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
+    const ChannelArgs& args, grpc_pollset_set* /*interested_parties*/,
     HandshakeManager* handshake_mgr) {
   MutexLock lock(&mu_);
   tsi_handshaker* tsi_hs = nullptr;
@@ -639,7 +639,7 @@ void TlsServerSecurityConnector::add_handshakers(
 }
 
 void TlsServerSecurityConnector::check_peer(
-    tsi_peer peer, grpc_endpoint* /*ep*/,
+    tsi_peer peer, grpc_endpoint* /*ep*/, const ChannelArgs& /*args*/,
     RefCountedPtr<grpc_auth_context>* auth_context,
     grpc_closure* on_peer_checked) {
   grpc_error_handle error = grpc_ssl_check_alpn(&peer);

data/src/core/lib/security/security_connector/tls/tls_security_connector.h

@@ -31,8 +31,8 @@
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
-#include <grpc/impl/codegen/grpc_types.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/iomgr/closure.h"
@@ -74,11 +74,11 @@ class TlsChannelSecurityConnector final
 
   ~TlsChannelSecurityConnector() override;
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const ChannelArgs& args,
                        grpc_pollset_set* interested_parties,
                        HandshakeManager* handshake_mgr) override;
 
-  void check_peer(tsi_peer peer, grpc_endpoint* ep,
+  void check_peer(tsi_peer peer, grpc_endpoint* ep, const ChannelArgs& /*args*/,
                   RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 
@@ -187,11 +187,11 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
       RefCountedPtr<grpc_tls_credentials_options> options);
   ~TlsServerSecurityConnector() override;
 
-  void add_handshakers(const grpc_channel_args* args,
+  void add_handshakers(const ChannelArgs& args,
                        grpc_pollset_set* interested_parties,
                        HandshakeManager* handshake_mgr) override;
 
-  void check_peer(tsi_peer peer, grpc_endpoint* ep,
+  void check_peer(tsi_peer peer, grpc_endpoint* ep, const ChannelArgs& /*args*/,
                   RefCountedPtr<grpc_auth_context>* auth_context,
                   grpc_closure* on_peer_checked) override;
 

data/src/core/lib/security/transport/auth_filters.h

@@ -45,7 +45,7 @@ class ClientAuthFilter final : public ChannelFilter {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ClientAuthFilter> Create(ChannelArgs args,
+  static absl::StatusOr<ClientAuthFilter> Create(const ChannelArgs& args,
                                                  ChannelFilter::Args);
 
   // Construct a promise for one call.

data/src/core/lib/security/transport/client_auth_filter.cc

@@ -21,7 +21,7 @@
 #include <string.h>
 
 #include <functional>
-#include <type_traits>
+#include <type_traits>  // IWYU pragma: keep
 #include <utility>
 
 #include "absl/status/status.h"
@@ -37,12 +37,14 @@
 #include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/channel/context.h"
 #include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/channel/status_util.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/promise/context.h"
-#include "src/core/lib/promise/poll.h"
+#include "src/core/lib/promise/detail/basic_seq.h"
 #include "src/core/lib/promise/promise.h"
+#include "src/core/lib/promise/seq.h"
 #include "src/core/lib/promise/try_seq.h"
 #include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/security/context/security_context.h"
@@ -158,7 +160,15 @@ ArenaPromise<absl::StatusOr<CallArgs>> ClientAuthFilter::GetCallCredsMetadata(
 
   auto client_initial_metadata = std::move(call_args.client_initial_metadata);
   return TrySeq(
-      creds->GetRequestMetadata(std::move(client_initial_metadata), &args_),
+      Seq(creds->GetRequestMetadata(std::move(client_initial_metadata), &args_),
+          [](absl::StatusOr<ClientMetadataHandle> new_metadata) mutable {
+            if (!new_metadata.ok()) {
+              return absl::StatusOr<ClientMetadataHandle>(
+                  MaybeRewriteIllegalStatusCode(new_metadata.status(),
+                                                "call credentials"));
+            }
+            return new_metadata;
+          }),
       [call_args =
            std::move(call_args)](ClientMetadataHandle new_metadata) mutable {
         call_args.client_initial_metadata = std::move(new_metadata);
@@ -192,8 +202,8 @@ ArenaPromise<ServerMetadataHandle> ClientAuthFilter::MakeCallPromise(
                 next_promise_factory);
 }
 
-absl::StatusOr<ClientAuthFilter> ClientAuthFilter::Create(ChannelArgs args,
-                                                          ChannelFilter::Args) {
+absl::StatusOr<ClientAuthFilter> ClientAuthFilter::Create(
+    const ChannelArgs& args, ChannelFilter::Args) {
   auto* sc = args.GetObject<grpc_security_connector>();
   if (sc == nullptr) {
     return absl::InvalidArgumentError(

data/src/core/lib/security/transport/secure_endpoint.cc

@@ -49,8 +49,6 @@
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/iomgr/iomgr_fwd.h"
-#include "src/core/lib/iomgr/pollset.h"
-#include "src/core/lib/profiling/timers.h"
 #include "src/core/lib/resource_quota/api.h"
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/lib/resource_quota/resource_quota.h"
@@ -386,8 +384,6 @@ static void flush_write_staging_buffer(secure_endpoint* ep, uint8_t** cur,
 
 static void endpoint_write(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
                            grpc_closure* cb, void* arg, int max_frame_size) {
-  GPR_TIMER_SCOPE("secure_endpoint.endpoint_write", 0);
-
   unsigned i;
   tsi_result result = TSI_OK;
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);