grpc 1.50.0-x86_64-linux → 1.51.0-x86_64-linux

data/src/core/lib/security/transport/secure_endpoint.cc

@@ -27,6 +27,7 @@
 #include <memory>
 
 #include "absl/base/thread_annotations.h"
+#include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
@@ -54,8 +55,7 @@
 #include "src/core/lib/resource_quota/resource_quota.h"
 #include "src/core/lib/resource_quota/trace.h"
 #include "src/core/lib/security/transport/tsi_error.h"
-#include "src/core/lib/slice/slice_internal.h"
-#include "src/core/lib/slice/slice_refcount.h"
+#include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
 #include "src/core/tsi/transport_security_grpc.h"
 #include "src/core/tsi/transport_security_interface.h"
@@ -82,7 +82,7 @@ struct secure_endpoint {
     grpc_slice_buffer_init(&leftover_bytes);
     for (size_t i = 0; i < leftover_nslices; i++) {
       grpc_slice_buffer_add(&leftover_bytes,
-                            grpc_slice_ref_internal(leftover_slices[i]));
+                            grpc_core::CSliceRef(leftover_slices[i]));
     }
     grpc_slice_buffer_init(&output_buffer);
     memory_owner =
@@ -110,12 +110,12 @@ struct secure_endpoint {
     grpc_endpoint_destroy(wrapped_ep);
     tsi_frame_protector_destroy(protector);
     tsi_zero_copy_grpc_protector_destroy(zero_copy_protector);
-    grpc_slice_buffer_destroy_internal(&source_buffer);
-    grpc_slice_buffer_destroy_internal(&leftover_bytes);
-    grpc_slice_unref_internal(read_staging_buffer);
-    grpc_slice_unref_internal(write_staging_buffer);
-    grpc_slice_buffer_destroy_internal(&output_buffer);
-    grpc_slice_buffer_destroy_internal(&protector_staging_buffer);
+    grpc_slice_buffer_destroy(&source_buffer);
+    grpc_slice_buffer_destroy(&leftover_bytes);
+    grpc_core::CSliceUnref(read_staging_buffer);
+    grpc_core::CSliceUnref(write_staging_buffer);
+    grpc_slice_buffer_destroy(&output_buffer);
+    grpc_slice_buffer_destroy(&protector_staging_buffer);
     gpr_mu_destroy(&protector_mu);
   }
 
@@ -216,8 +216,8 @@ static void maybe_post_reclaimer(secure_endpoint* ep) {
             ep->write_staging_buffer = grpc_empty_slice();
             ep->write_mu.Unlock();
 
-            grpc_slice_unref_internal(temp_read_slice);
-            grpc_slice_unref_internal(temp_write_slice);
+            grpc_core::CSliceUnref(temp_read_slice);
+            grpc_core::CSliceUnref(temp_write_slice);
             ep->has_posted_reclaimer.exchange(false, std::memory_order_relaxed);
           }
           SECURE_ENDPOINT_UNREF(ep, "benign_reclaimer");
@@ -261,10 +261,10 @@ static void on_read(void* user_data, grpc_error_handle error) {
     uint8_t* cur = GRPC_SLICE_START_PTR(ep->read_staging_buffer);
     uint8_t* end = GRPC_SLICE_END_PTR(ep->read_staging_buffer);
 
-    if (!GRPC_ERROR_IS_NONE(error)) {
-      grpc_slice_buffer_reset_and_unref_internal(ep->read_buffer);
-      call_read_cb(ep, GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
-                           "Secure read failed", &error, 1));
+    if (!error.ok()) {
+      grpc_slice_buffer_reset_and_unref(ep->read_buffer);
+      call_read_cb(
+          ep, GRPC_ERROR_CREATE_REFERENCING("Secure read failed", &error, 1));
       return;
     }
 
@@ -338,17 +338,16 @@ static void on_read(void* user_data, grpc_error_handle error) {
 
   /* TODO(yangg) experiment with moving this block after read_cb to see if it
      helps latency */
-  grpc_slice_buffer_reset_and_unref_internal(&ep->source_buffer);
+  grpc_slice_buffer_reset_and_unref(&ep->source_buffer);
 
   if (result != TSI_OK) {
-    grpc_slice_buffer_reset_and_unref_internal(ep->read_buffer);
-    call_read_cb(
-        ep, grpc_set_tsi_error_result(
-                GRPC_ERROR_CREATE_FROM_STATIC_STRING("Unwrap failed"), result));
+    grpc_slice_buffer_reset_and_unref(ep->read_buffer);
+    call_read_cb(ep, grpc_set_tsi_error_result(
+                         GRPC_ERROR_CREATE("Unwrap failed"), result));
     return;
   }
 
-  call_read_cb(ep, GRPC_ERROR_NONE);
+  call_read_cb(ep, absl::OkStatus());
 }
 
 static void endpoint_read(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
@@ -357,13 +356,13 @@ static void endpoint_read(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
   ep->read_cb = cb;
   ep->read_buffer = slices;
-  grpc_slice_buffer_reset_and_unref_internal(ep->read_buffer);
+  grpc_slice_buffer_reset_and_unref(ep->read_buffer);
 
   SECURE_ENDPOINT_REF(ep, "read");
   if (ep->leftover_bytes.count) {
     grpc_slice_buffer_swap(&ep->leftover_bytes, &ep->source_buffer);
     GPR_ASSERT(ep->leftover_bytes.count == 0);
-    on_read(ep, GRPC_ERROR_NONE);
+    on_read(ep, absl::OkStatus());
     return;
   }
 
@@ -393,7 +392,7 @@ static void endpoint_write(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
     uint8_t* cur = GRPC_SLICE_START_PTR(ep->write_staging_buffer);
     uint8_t* end = GRPC_SLICE_END_PTR(ep->write_staging_buffer);
 
-    grpc_slice_buffer_reset_and_unref_internal(&ep->output_buffer);
+    grpc_slice_buffer_reset_and_unref(&ep->output_buffer);
 
     if (GRPC_TRACE_FLAG_ENABLED(grpc_trace_secure_endpoint)) {
       for (i = 0; i < slices->count; i++) {
@@ -424,7 +423,7 @@ static void endpoint_write(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
         result = tsi_zero_copy_grpc_protector_protect(
             ep->zero_copy_protector, slices, &ep->output_buffer);
       }
-      grpc_slice_buffer_reset_and_unref_internal(&ep->protector_staging_buffer);
+      grpc_slice_buffer_reset_and_unref(&ep->protector_staging_buffer);
     } else {
       // Use frame protector to protect.
       for (i = 0; i < slices->count; i++) {
@@ -483,11 +482,10 @@ static void endpoint_write(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
 
   if (result != TSI_OK) {
     /* TODO(yangg) do different things according to the error type? */
-    grpc_slice_buffer_reset_and_unref_internal(&ep->output_buffer);
+    grpc_slice_buffer_reset_and_unref(&ep->output_buffer);
     grpc_core::ExecCtx::Run(
         DEBUG_LOCATION, cb,
-        grpc_set_tsi_error_result(
-            GRPC_ERROR_CREATE_FROM_STATIC_STRING("Wrap failed"), result));
+        grpc_set_tsi_error_result(GRPC_ERROR_CREATE("Wrap failed"), result));
     return;
   }
 

data/src/core/lib/security/transport/security_handshaker.cc

@@ -29,7 +29,7 @@
 #include <string>
 
 #include "absl/base/attributes.h"
-#include "absl/memory/memory.h"
+#include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
@@ -46,6 +46,7 @@
 #include "src/core/lib/config/core_configuration.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/status_helper.h"
 #include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/gprpp/unique_type_name.h"
 #include "src/core/lib/iomgr/closure.h"
@@ -57,8 +58,8 @@
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/transport/secure_endpoint.h"
 #include "src/core/lib/security/transport/tsi_error.h"
+#include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"
-#include "src/core/lib/slice/slice_refcount.h"
 #include "src/core/lib/transport/handshaker.h"
 #include "src/core/lib/transport/handshaker_factory.h"
 #include "src/core/lib/transport/handshaker_registry.h"
@@ -156,11 +157,11 @@ SecurityHandshaker::~SecurityHandshaker() {
     grpc_endpoint_destroy(endpoint_to_destroy_);
   }
   if (read_buffer_to_destroy_ != nullptr) {
-    grpc_slice_buffer_destroy_internal(read_buffer_to_destroy_);
+    grpc_slice_buffer_destroy(read_buffer_to_destroy_);
     gpr_free(read_buffer_to_destroy_);
   }
   gpr_free(handshake_buffer_);
-  grpc_slice_buffer_destroy_internal(&outgoing_);
+  grpc_slice_buffer_destroy(&outgoing_);
   auth_context_.reset(DEBUG_LOCATION, "handshake");
   connector_.reset(DEBUG_LOCATION, "handshake");
 }
@@ -196,20 +197,20 @@ void SecurityHandshaker::CleanupArgsForFailureLocked() {
 // If the handshake failed or we're shutting down, clean up and invoke the
 // callback with the error.
 void SecurityHandshaker::HandshakeFailedLocked(grpc_error_handle error) {
-  if (GRPC_ERROR_IS_NONE(error)) {
+  if (error.ok()) {
     // If we were shut down after the handshake succeeded but before an
     // endpoint callback was invoked, we need to generate our own error.
-    error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Handshaker shutdown");
+    error = GRPC_ERROR_CREATE("Handshaker shutdown");
   }
   gpr_log(GPR_DEBUG, "Security handshake failed: %s",
-          grpc_error_std_string(error).c_str());
+          StatusToString(error).c_str());
   if (!is_shutdown_) {
     tsi_handshaker_shutdown(handshaker_);
     // TODO(ctiller): It is currently necessary to shutdown endpoints
     // before destroying them, even if we know that there are no
     // pending read/write callbacks.  This should be fixed, at which
     // point this can be removed.
-    grpc_endpoint_shutdown(args_->endpoint, GRPC_ERROR_REF(error));
+    grpc_endpoint_shutdown(args_->endpoint, error);
     // Not shutting down, so the write failed.  Clean up before
     // invoking the callback.
     CleanupArgsForFailureLocked();
@@ -248,7 +249,7 @@ MakeChannelzSecurityFromAuthContext(grpc_auth_context* auth_context) {
 
 void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
   MutexLock lock(&mu_);
-  if (!GRPC_ERROR_IS_NONE(error) || is_shutdown_) {
+  if (!error.ok() || is_shutdown_) {
     HandshakeFailedLocked(error);
     return;
   }
@@ -259,7 +260,7 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
       handshaker_result_, &unused_bytes, &unused_bytes_size);
   if (result != TSI_OK) {
     HandshakeFailedLocked(grpc_set_tsi_error_result(
-        GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        GRPC_ERROR_CREATE(
             "TSI handshaker result does not provide unused bytes"),
         result));
     return;
@@ -270,9 +271,8 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
       handshaker_result_, &frame_protector_type);
   if (result != TSI_OK) {
     HandshakeFailedLocked(grpc_set_tsi_error_result(
-        GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-            "TSI handshaker result does not implement "
-            "get_frame_protector_type"),
+        GRPC_ERROR_CREATE("TSI handshaker result does not implement "
+                          "get_frame_protector_type"),
         result));
     return;
   }
@@ -288,8 +288,7 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
           &zero_copy_protector);
       if (result != TSI_OK) {
         HandshakeFailedLocked(grpc_set_tsi_error_result(
-            GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-                "Zero-copy frame protector creation failed"),
+            GRPC_ERROR_CREATE("Zero-copy frame protector creation failed"),
             result));
         return;
       }
@@ -300,10 +299,8 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
           handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
           &protector);
       if (result != TSI_OK) {
-        HandshakeFailedLocked(
-            grpc_set_tsi_error_result(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-                                          "Frame protector creation failed"),
-                                      result));
+        HandshakeFailedLocked(grpc_set_tsi_error_result(
+            GRPC_ERROR_CREATE("Frame protector creation failed"), result));
         return;
       }
       break;
@@ -320,7 +317,7 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
       args_->endpoint = grpc_secure_endpoint_create(
           protector, zero_copy_protector, args_->endpoint, &slice,
           args_->args.ToC().get(), 1);
-      grpc_slice_unref_internal(slice);
+      CSliceUnref(slice);
     } else {
       args_->endpoint = grpc_secure_endpoint_create(
           protector, zero_copy_protector, args_->endpoint, nullptr,
@@ -342,7 +339,7 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
         MakeChannelzSecurityFromAuthContext(auth_context_.get()));
   }
   // Invoke callback.
-  ExecCtx::Run(DEBUG_LOCATION, on_handshake_done_, GRPC_ERROR_NONE);
+  ExecCtx::Run(DEBUG_LOCATION, on_handshake_done_, absl::OkStatus());
   // Set shutdown to true so that subsequent calls to
   // security_handshaker_shutdown() do nothing.
   is_shutdown_ = true;
@@ -350,7 +347,7 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
 
 void SecurityHandshaker::OnPeerCheckedFn(void* arg, grpc_error_handle error) {
   RefCountedPtr<SecurityHandshaker>(static_cast<SecurityHandshaker*>(arg))
-      ->OnPeerCheckedInner(GRPC_ERROR_REF(error));
+      ->OnPeerCheckedInner(error);
 }
 
 grpc_error_handle SecurityHandshaker::CheckPeerLocked() {
@@ -359,20 +356,20 @@ grpc_error_handle SecurityHandshaker::CheckPeerLocked() {
       tsi_handshaker_result_extract_peer(handshaker_result_, &peer);
   if (result != TSI_OK) {
     return grpc_set_tsi_error_result(
-        GRPC_ERROR_CREATE_FROM_STATIC_STRING("Peer extraction failed"), result);
+        GRPC_ERROR_CREATE("Peer extraction failed"), result);
   }
   connector_->check_peer(peer, args_->endpoint, args_->args, &auth_context_,
                          &on_peer_checked_);
-  return GRPC_ERROR_NONE;
+  return absl::OkStatus();
 }
 
 grpc_error_handle SecurityHandshaker::OnHandshakeNextDoneLocked(
     tsi_result result, const unsigned char* bytes_to_send,
     size_t bytes_to_send_size, tsi_handshaker_result* handshaker_result) {
-  grpc_error_handle error = GRPC_ERROR_NONE;
+  grpc_error_handle error;
   // Handshaker was shutdown.
   if (is_shutdown_) {
-    return GRPC_ERROR_CREATE_FROM_STATIC_STRING("Handshaker shutdown");
+    return GRPC_ERROR_CREATE("Handshaker shutdown");
   }
   // Read more if we need to.
   if (result == TSI_INCOMPLETE_DATA) {
@@ -393,7 +390,7 @@ grpc_error_handle SecurityHandshaker::OnHandshakeNextDoneLocked(
       connector_type = security_connector->type().name();
     }
     return grpc_set_tsi_error_result(
-        GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+        GRPC_ERROR_CREATE(absl::StrCat(
             connector_type, " handshake failed",
             (tsi_handshake_error_.empty() ? "" : ": "), tsi_handshake_error_)),
         result);
@@ -407,7 +404,7 @@ grpc_error_handle SecurityHandshaker::OnHandshakeNextDoneLocked(
     // Send data to peer, if needed.
     grpc_slice to_send = grpc_slice_from_copied_buffer(
         reinterpret_cast<const char*>(bytes_to_send), bytes_to_send_size);
-    grpc_slice_buffer_reset_and_unref_internal(&outgoing_);
+    grpc_slice_buffer_reset_and_unref(&outgoing_);
     grpc_slice_buffer_add(&outgoing_, to_send);
     grpc_endpoint_write(
         args_->endpoint, &outgoing_,
@@ -440,7 +437,7 @@ void SecurityHandshaker::OnHandshakeNextDoneGrpcWrapper(
   MutexLock lock(&h->mu_);
   grpc_error_handle error = h->OnHandshakeNextDoneLocked(
       result, bytes_to_send, bytes_to_send_size, handshaker_result);
-  if (!GRPC_ERROR_IS_NONE(error)) {
+  if (!error.ok()) {
     h->HandshakeFailedLocked(error);
   } else {
     h.release();  // Avoid unref
@@ -460,7 +457,7 @@ grpc_error_handle SecurityHandshaker::DoHandshakerNextLocked(
   if (result == TSI_ASYNC) {
     // Handshaker operating asynchronously. Nothing else to do here;
     // callback will be invoked in a TSI thread.
-    return GRPC_ERROR_NONE;
+    return absl::OkStatus();
   }
   // Handshaker returned synchronously. Invoke callback directly in
   // this thread with our existing exec_ctx.
@@ -478,23 +475,23 @@ void SecurityHandshaker::OnHandshakeDataReceivedFromPeerFnScheduler(
       GRPC_CLOSURE_INIT(&h->on_handshake_data_received_from_peer_,
                         &SecurityHandshaker::OnHandshakeDataReceivedFromPeerFn,
                         h, grpc_schedule_on_exec_ctx),
-      GRPC_ERROR_REF(error));
+      error);
 }
 
 void SecurityHandshaker::OnHandshakeDataReceivedFromPeerFn(
     void* arg, grpc_error_handle error) {
   RefCountedPtr<SecurityHandshaker> h(static_cast<SecurityHandshaker*>(arg));
   MutexLock lock(&h->mu_);
-  if (!GRPC_ERROR_IS_NONE(error) || h->is_shutdown_) {
-    h->HandshakeFailedLocked(GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
-        "Handshake read failed", &error, 1));
+  if (!error.ok() || h->is_shutdown_) {
+    h->HandshakeFailedLocked(
+        GRPC_ERROR_CREATE_REFERENCING("Handshake read failed", &error, 1));
     return;
   }
   // Copy all slices received.
   size_t bytes_received_size = h->MoveReadBufferIntoHandshakeBuffer();
   // Call TSI handshaker.
   error = h->DoHandshakerNextLocked(h->handshake_buffer_, bytes_received_size);
-  if (!GRPC_ERROR_IS_NONE(error)) {
+  if (!error.ok()) {
     h->HandshakeFailedLocked(error);
   } else {
     h.release();  // Avoid unref
@@ -511,16 +508,16 @@ void SecurityHandshaker::OnHandshakeDataSentToPeerFnScheduler(
       GRPC_CLOSURE_INIT(&h->on_handshake_data_sent_to_peer_,
                         &SecurityHandshaker::OnHandshakeDataSentToPeerFn, h,
                         grpc_schedule_on_exec_ctx),
-      GRPC_ERROR_REF(error));
+      error);
 }
 
 void SecurityHandshaker::OnHandshakeDataSentToPeerFn(void* arg,
                                                      grpc_error_handle error) {
   RefCountedPtr<SecurityHandshaker> h(static_cast<SecurityHandshaker*>(arg));
   MutexLock lock(&h->mu_);
-  if (!GRPC_ERROR_IS_NONE(error) || h->is_shutdown_) {
-    h->HandshakeFailedLocked(GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
-        "Handshake write failed", &error, 1));
+  if (!error.ok() || h->is_shutdown_) {
+    h->HandshakeFailedLocked(
+        GRPC_ERROR_CREATE_REFERENCING("Handshake write failed", &error, 1));
     return;
   }
   // We may be done.
@@ -534,7 +531,7 @@ void SecurityHandshaker::OnHandshakeDataSentToPeerFn(void* arg,
         /*urgent=*/true, /*min_progress_size=*/1);
   } else {
     error = h->CheckPeerLocked();
-    if (!GRPC_ERROR_IS_NONE(error)) {
+    if (!error.ok()) {
       h->HandshakeFailedLocked(error);
       return;
     }
@@ -550,12 +547,11 @@ void SecurityHandshaker::Shutdown(grpc_error_handle why) {
   MutexLock lock(&mu_);
   if (!is_shutdown_) {
     is_shutdown_ = true;
-    connector_->cancel_check_peer(&on_peer_checked_, GRPC_ERROR_REF(why));
+    connector_->cancel_check_peer(&on_peer_checked_, why);
     tsi_handshaker_shutdown(handshaker_);
-    grpc_endpoint_shutdown(args_->endpoint, GRPC_ERROR_REF(why));
+    grpc_endpoint_shutdown(args_->endpoint, why);
     CleanupArgsForFailureLocked();
   }
-  GRPC_ERROR_UNREF(why);
 }
 
 void SecurityHandshaker::DoHandshake(grpc_tcp_server_acceptor* /*acceptor*/,
@@ -568,7 +564,7 @@ void SecurityHandshaker::DoHandshake(grpc_tcp_server_acceptor* /*acceptor*/,
   size_t bytes_received_size = MoveReadBufferIntoHandshakeBuffer();
   grpc_error_handle error =
       DoHandshakerNextLocked(handshake_buffer_, bytes_received_size);
-  if (!GRPC_ERROR_IS_NONE(error)) {
+  if (!error.ok()) {
     HandshakeFailedLocked(error);
   } else {
     ref.release();  // Avoid unref
@@ -582,17 +578,17 @@ void SecurityHandshaker::DoHandshake(grpc_tcp_server_acceptor* /*acceptor*/,
 class FailHandshaker : public Handshaker {
  public:
   const char* name() const override { return "security_fail"; }
-  void Shutdown(grpc_error_handle why) override { GRPC_ERROR_UNREF(why); }
+  void Shutdown(grpc_error_handle /*why*/) override {}
   void DoHandshake(grpc_tcp_server_acceptor* /*acceptor*/,
                    grpc_closure* on_handshake_done,
                    HandshakerArgs* args) override {
-    grpc_error_handle error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "Failed to create security handshaker");
-    grpc_endpoint_shutdown(args->endpoint, GRPC_ERROR_REF(error));
+    grpc_error_handle error =
+        GRPC_ERROR_CREATE("Failed to create security handshaker");
+    grpc_endpoint_shutdown(args->endpoint, error);
     grpc_endpoint_destroy(args->endpoint);
     args->endpoint = nullptr;
     args->args = ChannelArgs();
-    grpc_slice_buffer_destroy_internal(args->read_buffer);
+    grpc_slice_buffer_destroy(args->read_buffer);
     gpr_free(args->read_buffer);
     args->read_buffer = nullptr;
     ExecCtx::Run(DEBUG_LOCATION, on_handshake_done, error);
@@ -618,6 +614,9 @@ class ClientSecurityHandshakerFactory : public HandshakerFactory {
                                           handshake_mgr);
     }
   }
+  HandshakerPriority Priority() override {
+    return HandshakerPriority::kSecurityHandshakers;
+  }
   ~ClientSecurityHandshakerFactory() override = default;
 };
 
@@ -632,6 +631,9 @@ class ServerSecurityHandshakerFactory : public HandshakerFactory {
                                           handshake_mgr);
     }
   }
+  HandshakerPriority Priority() override {
+    return HandshakerPriority::kSecurityHandshakers;
+  }
   ~ServerSecurityHandshakerFactory() override = default;
 };
 
@@ -655,11 +657,9 @@ RefCountedPtr<Handshaker> SecurityHandshakerCreate(
 
 void SecurityRegisterHandshakerFactories(CoreConfiguration::Builder* builder) {
   builder->handshaker_registry()->RegisterHandshakerFactory(
-      false /* at_start */, HANDSHAKER_CLIENT,
-      absl::make_unique<ClientSecurityHandshakerFactory>());
+      HANDSHAKER_CLIENT, std::make_unique<ClientSecurityHandshakerFactory>());
   builder->handshaker_registry()->RegisterHandshakerFactory(
-      false /* at_start */, HANDSHAKER_SERVER,
-      absl::make_unique<ServerSecurityHandshakerFactory>());
+      HANDSHAKER_SERVER, std::make_unique<ServerSecurityHandshakerFactory>());
 }
 
 }  // namespace grpc_core

data/src/core/lib/security/transport/server_auth_filter.cc

@@ -23,6 +23,8 @@
 #include <algorithm>
 #include <new>
 
+#include "absl/status/status.h"
+
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/impl/codegen/grpc_types.h>
@@ -37,6 +39,7 @@
 #include "src/core/lib/channel/context.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/status_helper.h"
 #include "src/core/lib/iomgr/call_combiner.h"
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/error.h"
@@ -46,7 +49,6 @@
 #include "src/core/lib/security/transport/auth_filters.h"  // IWYU pragma: keep
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"
-#include "src/core/lib/slice/slice_refcount.h"
 #include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/lib/transport/transport.h"
 
@@ -95,14 +97,14 @@ struct call_data {
         grpc_server_security_context_destroy;
   }
 
-  ~call_data() { GRPC_ERROR_UNREF(recv_initial_metadata_error); }
+  ~call_data() {}
 
   grpc_core::CallCombiner* call_combiner;
   grpc_call_stack* owning_call;
   grpc_transport_stream_op_batch* recv_initial_metadata_batch;
   grpc_closure* original_recv_initial_metadata_ready;
   grpc_closure recv_initial_metadata_ready;
-  grpc_error_handle recv_initial_metadata_error = GRPC_ERROR_NONE;
+  grpc_error_handle recv_initial_metadata_error;
   grpc_closure recv_trailing_metadata_ready;
   grpc_closure* original_recv_trailing_metadata_ready;
   grpc_error_handle recv_trailing_metadata_error;
@@ -171,13 +173,13 @@ static void on_md_processing_done_inner(grpc_call_element* elem,
             "response_md in auth metadata processing not supported for now. "
             "Ignoring...");
   }
-  if (GRPC_ERROR_IS_NONE(error)) {
+  if (error.ok()) {
     for (size_t i = 0; i < num_consumed_md; i++) {
       batch->payload->recv_initial_metadata.recv_initial_metadata->Remove(
           grpc_core::StringViewFromSlice(consumed_md[i].key));
     }
   }
-  calld->recv_initial_metadata_error = GRPC_ERROR_REF(error);
+  calld->recv_initial_metadata_error = error;
   grpc_closure* closure = calld->original_recv_initial_metadata_ready;
   calld->original_recv_initial_metadata_ready = nullptr;
   if (calld->seen_recv_trailing_metadata_ready) {
@@ -201,22 +203,22 @@ static void on_md_processing_done(
   // If the call was not cancelled while we were in flight, process the result.
   if (gpr_atm_full_cas(&calld->state, static_cast<gpr_atm>(STATE_INIT),
                        static_cast<gpr_atm>(STATE_DONE))) {
-    grpc_error_handle error = GRPC_ERROR_NONE;
+    grpc_error_handle error;
     if (status != GRPC_STATUS_OK) {
       if (error_details == nullptr) {
         error_details = "Authentication metadata processing failed.";
       }
-      error = grpc_error_set_int(
-          GRPC_ERROR_CREATE_FROM_COPIED_STRING(error_details),
-          GRPC_ERROR_INT_GRPC_STATUS, status);
+      error =
+          grpc_error_set_int(GRPC_ERROR_CREATE(error_details),
+                             grpc_core::StatusIntProperty::kRpcStatus, status);
     }
     on_md_processing_done_inner(elem, consumed_md, num_consumed_md, response_md,
                                 num_response_md, error);
   }
   // Clean up.
   for (size_t i = 0; i < calld->md.count; i++) {
-    grpc_slice_unref_internal(calld->md.metadata[i].key);
-    grpc_slice_unref_internal(calld->md.metadata[i].value);
+    grpc_core::CSliceUnref(calld->md.metadata[i].key);
+    grpc_core::CSliceUnref(calld->md.metadata[i].value);
   }
   grpc_metadata_array_destroy(&calld->md);
   GRPC_CALL_STACK_UNREF(calld->owning_call, "server_auth_metadata");
@@ -226,11 +228,10 @@ static void cancel_call(void* arg, grpc_error_handle error) {
   grpc_call_element* elem = static_cast<grpc_call_element*>(arg);
   call_data* calld = static_cast<call_data*>(elem->call_data);
   // If the result was not already processed, invoke the callback now.
-  if (!GRPC_ERROR_IS_NONE(error) &&
+  if (!error.ok() &&
       gpr_atm_full_cas(&calld->state, static_cast<gpr_atm>(STATE_INIT),
                        static_cast<gpr_atm>(STATE_CANCELLED))) {
-    on_md_processing_done_inner(elem, nullptr, 0, nullptr, 0,
-                                GRPC_ERROR_REF(error));
+    on_md_processing_done_inner(elem, nullptr, 0, nullptr, 0, error);
   }
   GRPC_CALL_STACK_UNREF(calld->owning_call, "cancel_call");
 }
@@ -240,7 +241,7 @@ static void recv_initial_metadata_ready(void* arg, grpc_error_handle error) {
   channel_data* chand = static_cast<channel_data*>(elem->channel_data);
   call_data* calld = static_cast<call_data*>(elem->call_data);
   grpc_transport_stream_op_batch* batch = calld->recv_initial_metadata_batch;
-  if (GRPC_ERROR_IS_NONE(error)) {
+  if (error.ok()) {
     if (chand->creds != nullptr &&
         chand->creds->auth_metadata_processor().process != nullptr) {
       // We're calling out to the application, so we need to make sure
@@ -269,7 +270,7 @@ static void recv_initial_metadata_ready(void* arg, grpc_error_handle error) {
                              calld->recv_trailing_metadata_error,
                              "continue recv_trailing_metadata_ready");
   }
-  grpc_core::Closure::Run(DEBUG_LOCATION, closure, GRPC_ERROR_REF(error));
+  grpc_core::Closure::Run(DEBUG_LOCATION, closure, error);
 }
 
 static void recv_trailing_metadata_ready(void* user_data,
@@ -277,15 +278,14 @@ static void recv_trailing_metadata_ready(void* user_data,
   grpc_call_element* elem = static_cast<grpc_call_element*>(user_data);
   call_data* calld = static_cast<call_data*>(elem->call_data);
   if (calld->original_recv_initial_metadata_ready != nullptr) {
-    calld->recv_trailing_metadata_error = GRPC_ERROR_REF(err);
+    calld->recv_trailing_metadata_error = err;
     calld->seen_recv_trailing_metadata_ready = true;
     GRPC_CALL_COMBINER_STOP(calld->call_combiner,
                             "deferring recv_trailing_metadata_ready until "
                             "after recv_initial_metadata_ready");
     return;
   }
-  err = grpc_error_add_child(
-      GRPC_ERROR_REF(err), GRPC_ERROR_REF(calld->recv_initial_metadata_error));
+  err = grpc_error_add_child(err, calld->recv_initial_metadata_error);
   grpc_core::Closure::Run(DEBUG_LOCATION,
                           calld->original_recv_trailing_metadata_ready, err);
 }
@@ -314,7 +314,7 @@ static void server_auth_start_transport_stream_op_batch(
 static grpc_error_handle server_auth_init_call_elem(
     grpc_call_element* elem, const grpc_call_element_args* args) {
   new (elem->call_data) call_data(elem, *args);
-  return GRPC_ERROR_NONE;
+  return absl::OkStatus();
 }
 
 /* Destructor for call_data */
@@ -335,7 +335,7 @@ static grpc_error_handle server_auth_init_channel_elem(
   grpc_server_credentials* creds =
       grpc_find_server_credentials_in_args(args->channel_args);
   new (elem->channel_data) channel_data(auth_context, creds);
-  return GRPC_ERROR_NONE;
+  return absl::OkStatus();
 }
 
 /* Destructor for channel data */

data/src/core/lib/security/transport/tsi_error.cc

@@ -20,9 +20,12 @@
 
 #include "src/core/lib/security/transport/tsi_error.h"
 
+#include "src/core/lib/gprpp/status_helper.h"
+
 grpc_error_handle grpc_set_tsi_error_result(grpc_error_handle error,
                                             tsi_result result) {
-  return grpc_error_set_int(grpc_error_set_str(error, GRPC_ERROR_STR_TSI_ERROR,
-                                               tsi_result_to_string(result)),
-                            GRPC_ERROR_INT_TSI_CODE, result);
+  return grpc_error_set_int(
+      grpc_error_set_str(error, grpc_core::StatusStrProperty::kTsiError,
+                         tsi_result_to_string(result)),
+      grpc_core::StatusIntProperty::kTsiCode, result);
 }