grpc 1.54.3 → 1.59.2

data/src/core/lib/security/credentials/fake/fake_credentials.cc

@@ -36,44 +36,36 @@
 
 // -- Fake transport security credentials. --
 
-namespace {
-
-class grpc_fake_channel_credentials final : public grpc_channel_credentials {
- public:
-  grpc_core::RefCountedPtr<grpc_channel_security_connector>
-  create_security_connector(
-      grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
-      const char* target, grpc_core::ChannelArgs* args) override {
-    return grpc_fake_channel_security_connector_create(
-        this->Ref(), std::move(call_creds), target, *args);
-  }
-
-  grpc_core::UniqueTypeName type() const override {
-    static grpc_core::UniqueTypeName::Factory kFactory("Fake");
-    return kFactory.Create();
-  }
-
- private:
-  int cmp_impl(const grpc_channel_credentials* other) const override {
-    // TODO(yashykt): Check if we can do something better here
-    return grpc_core::QsortCompare(
-        static_cast<const grpc_channel_credentials*>(this), other);
-  }
-};
-
-class grpc_fake_server_credentials final : public grpc_server_credentials {
- public:
-  grpc_core::RefCountedPtr<grpc_server_security_connector>
-  create_security_connector(const grpc_core::ChannelArgs& /*args*/) override {
-    return grpc_fake_server_security_connector_create(this->Ref());
-  }
-
-  grpc_core::UniqueTypeName type() const override {
-    static grpc_core::UniqueTypeName::Factory kFactory("Fake");
-    return kFactory.Create();
-  }
-};
-}  // namespace
+grpc_core::RefCountedPtr<grpc_channel_security_connector>
+grpc_fake_channel_credentials::create_security_connector(
+    grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+    const char* target, grpc_core::ChannelArgs* args) {
+  return grpc_fake_channel_security_connector_create(
+      this->Ref(), std::move(call_creds), target, *args);
+}
+
+grpc_core::UniqueTypeName grpc_fake_channel_credentials::Type() {
+  static grpc_core::UniqueTypeName::Factory kFactory("Fake");
+  return kFactory.Create();
+}
+
+int grpc_fake_channel_credentials::cmp_impl(
+    const grpc_channel_credentials* other) const {
+  // TODO(yashykt): Check if we can do something better here
+  return grpc_core::QsortCompare(
+      static_cast<const grpc_channel_credentials*>(this), other);
+}
+
+grpc_core::RefCountedPtr<grpc_server_security_connector>
+grpc_fake_server_credentials::create_security_connector(
+    const grpc_core::ChannelArgs& /*args*/) {
+  return grpc_fake_server_security_connector_create(this->Ref());
+}
+
+grpc_core::UniqueTypeName grpc_fake_server_credentials::Type() {
+  static grpc_core::UniqueTypeName::Factory kFactory("Fake");
+  return kFactory.Create();
+}
 
 grpc_channel_credentials* grpc_fake_transport_security_credentials_create() {
   return new grpc_fake_channel_credentials();

data/src/core/lib/security/credentials/fake/fake_credentials.h

@@ -29,10 +29,13 @@
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/useful.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/unique_type_name.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/transport.h"
 
@@ -41,6 +44,31 @@
 
 // -- Fake transport security credentials. --
 
+class grpc_fake_channel_credentials final : public grpc_channel_credentials {
+ public:
+  grpc_core::RefCountedPtr<grpc_channel_security_connector>
+  create_security_connector(
+      grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+      const char* target, grpc_core::ChannelArgs* args) override;
+
+  static grpc_core::UniqueTypeName Type();
+
+  grpc_core::UniqueTypeName type() const override { return Type(); }
+
+ private:
+  int cmp_impl(const grpc_channel_credentials* other) const override;
+};
+
+class grpc_fake_server_credentials final : public grpc_server_credentials {
+ public:
+  grpc_core::RefCountedPtr<grpc_server_security_connector>
+  create_security_connector(const grpc_core::ChannelArgs& /*args*/) override;
+
+  static grpc_core::UniqueTypeName Type();
+
+  grpc_core::UniqueTypeName type() const override { return Type(); }
+};
+
 // Creates a fake transport security credentials object for testing.
 grpc_channel_credentials* grpc_fake_transport_security_credentials_create(void);
 

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -32,8 +32,10 @@
 
 #include <grpc/grpc_security.h>  // IWYU pragma: keep
 #include <grpc/grpc_security_constants.h>
+#include <grpc/impl/channel_arg_names.h>
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
+#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 #include <grpc/support/sync.h>
 
@@ -57,6 +59,7 @@
 #include "src/core/lib/iomgr/polling_entity.h"
 #include "src/core/lib/iomgr/pollset.h"
 #include "src/core/lib/json/json.h"
+#include "src/core/lib/json/json_reader.h"
 #include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/external/external_account_credentials.h"
@@ -268,14 +271,15 @@ static grpc_error_handle create_default_creds_from_path(
   error = grpc_load_file(creds_path.c_str(), 0, &creds_data);
   if (!error.ok()) goto end;
   {
-    auto json_or = Json::Parse(grpc_core::StringViewFromSlice(creds_data));
+    auto json_or =
+        grpc_core::JsonParse(grpc_core::StringViewFromSlice(creds_data));
     if (!json_or.ok()) {
       error = absl_status_to_grpc_error(json_or.status());
       goto end;
     }
     json = std::move(*json_or);
   }
-  if (json.type() != Json::Type::OBJECT) {
+  if (json.type() != Json::Type::kObject) {
     error = grpc_error_set_str(GRPC_ERROR_CREATE("Failed to parse JSON"),
                                grpc_core::StatusStrProperty::kRawBytes,
                                grpc_core::StringViewFromSlice(creds_data));

data/src/core/lib/security/credentials/jwt/json_token.cc

@@ -36,10 +36,13 @@
 
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
+#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 #include <grpc/support/time.h>
 
 #include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/json/json_reader.h"
+#include "src/core/lib/json/json_writer.h"
 #include "src/core/lib/security/util/json_util.h"
 #include "src/core/lib/slice/b64.h"
 
@@ -80,7 +83,7 @@ grpc_auth_json_key grpc_auth_json_key_create_from_json(const Json& json) {
 
   memset(&result, 0, sizeof(grpc_auth_json_key));
   result.type = GRPC_AUTH_JSON_TYPE_INVALID;
-  if (json.type() == Json::Type::JSON_NULL) {
+  if (json.type() == Json::Type::kNull) {
     gpr_log(GPR_ERROR, "Invalid json.");
     goto end;
   }
@@ -112,8 +115,12 @@ grpc_auth_json_key grpc_auth_json_key_create_from_json(const Json& json) {
     gpr_log(GPR_ERROR, "Could not write into openssl BIO.");
     goto end;
   }
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   result.private_key =
       PEM_read_bio_RSAPrivateKey(bio, nullptr, nullptr, const_cast<char*>(""));
+#else
+  result.private_key = PEM_read_bio_PrivateKey(bio, nullptr, nullptr, nullptr);
+#endif
   if (result.private_key == nullptr) {
     gpr_log(GPR_ERROR, "Could not deserialize private key.");
     goto end;
@@ -129,7 +136,7 @@ end:
 grpc_auth_json_key grpc_auth_json_key_create_from_string(
     const char* json_string) {
   Json json;
-  auto json_or = Json::Parse(json_string);
+  auto json_or = grpc_core::JsonParse(json_string);
   if (!json_or.ok()) {
     gpr_log(GPR_ERROR, "JSON key parsing error: %s",
             json_or.status().ToString().c_str());
@@ -155,7 +162,11 @@ void grpc_auth_json_key_destruct(grpc_auth_json_key* json_key) {
     json_key->client_email = nullptr;
   }
   if (json_key->private_key != nullptr) {
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
     RSA_free(json_key->private_key);
+#else
+    EVP_PKEY_free(json_key->private_key);
+#endif
     json_key->private_key = nullptr;
   }
 }
@@ -163,12 +174,12 @@ void grpc_auth_json_key_destruct(grpc_auth_json_key* json_key) {
 // --- jwt encoding and signature. ---
 
 static char* encoded_jwt_header(const char* key_id, const char* algorithm) {
-  Json json = Json::Object{
-      {"alg", algorithm},
-      {"typ", GRPC_JWT_TYPE},
-      {"kid", key_id},
-  };
-  std::string json_str = json.Dump();
+  Json json = Json::FromObject({
+      {"alg", Json::FromString(algorithm)},
+      {"typ", Json::FromString(GRPC_JWT_TYPE)},
+      {"kid", Json::FromString(key_id)},
+  });
+  std::string json_str = grpc_core::JsonDump(json);
   return grpc_base64_encode(json_str.c_str(), json_str.size(), 1, 0);
 }
 
@@ -183,20 +194,20 @@ static char* encoded_jwt_claim(const grpc_auth_json_key* json_key,
   }
 
   Json::Object object = {
-      {"iss", json_key->client_email},
-      {"aud", audience},
-      {"iat", now.tv_sec},
-      {"exp", expiration.tv_sec},
+      {"iss", Json::FromString(json_key->client_email)},
+      {"aud", Json::FromString(audience)},
+      {"iat", Json::FromNumber(now.tv_sec)},
+      {"exp", Json::FromNumber(expiration.tv_sec)},
   };
   if (scope != nullptr) {
-    object["scope"] = scope;
+    object["scope"] = Json::FromString(scope);
   } else {
     // Unscoped JWTs need a sub field.
-    object["sub"] = json_key->client_email;
+    object["sub"] = Json::FromString(json_key->client_email);
   }
 
-  Json json(object);
-  std::string json_str = json.Dump();
+  std::string json_str =
+      grpc_core::JsonDump(Json::FromObject(std::move(object)));
   return grpc_base64_encode(json_str.c_str(), json_str.size(), 1, 0);
 }
 
@@ -234,7 +245,9 @@ char* compute_and_encode_signature(const grpc_auth_json_key* json_key,
                                    const char* to_sign) {
   const EVP_MD* md = openssl_digest_from_algorithm(signature_algorithm);
   EVP_MD_CTX* md_ctx = nullptr;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   EVP_PKEY* key = EVP_PKEY_new();
+#endif
   size_t sig_len = 0;
   unsigned char* sig = nullptr;
   char* result = nullptr;
@@ -244,8 +257,13 @@ char* compute_and_encode_signature(const grpc_auth_json_key* json_key,
     gpr_log(GPR_ERROR, "Could not create MD_CTX");
     goto end;
   }
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   EVP_PKEY_set1_RSA(key, json_key->private_key);
   if (EVP_DigestSignInit(md_ctx, nullptr, md, nullptr, key) != 1) {
+#else
+  if (EVP_DigestSignInit(md_ctx, nullptr, md, nullptr, json_key->private_key) !=
+      1) {
+#endif
     gpr_log(GPR_ERROR, "DigestInit failed.");
     goto end;
   }
@@ -265,7 +283,9 @@ char* compute_and_encode_signature(const grpc_auth_json_key* json_key,
   result = grpc_base64_encode(sig, sig_len, 1, 0);
 
 end:
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   if (key != nullptr) EVP_PKEY_free(key);
+#endif
   if (md_ctx != nullptr) EVP_MD_CTX_destroy(md_ctx);
   if (sig != nullptr) gpr_free(sig);
   return result;

data/src/core/lib/security/credentials/jwt/json_token.h

@@ -38,7 +38,11 @@ struct grpc_auth_json_key {
   char* private_key_id;
   char* client_id;
   char* client_email;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   RSA* private_key;
+#else
+  EVP_PKEY* private_key;
+#endif
 };
 // Returns 1 if the object is valid, 0 otherwise.
 int grpc_auth_json_key_is_valid(const grpc_auth_json_key* json_key);

data/src/core/lib/security/credentials/jwt/jwt_credentials.cc

@@ -1,5 +1,4 @@
 //
-//
 // Copyright 2016 gRPC authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
@@ -31,6 +30,7 @@
 #include "absl/strings/str_cat.h"
 
 #include <grpc/support/alloc.h>
+#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 #include <grpc/support/sync.h>
@@ -39,6 +39,8 @@
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/json/json.h"
+#include "src/core/lib/json/json_reader.h"
+#include "src/core/lib/json/json_writer.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/credentials/call_creds_util.h"
 #include "src/core/lib/surface/api_trace.h"
@@ -139,12 +141,15 @@ grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
 }
 
 static char* redact_private_key(const char* json_key) {
-  auto json = Json::Parse(json_key);
-  if (!json.ok() || json->type() != Json::Type::OBJECT) {
+  auto json = grpc_core::JsonParse(json_key);
+  if (!json.ok() || json->type() != Json::Type::kObject) {
     return gpr_strdup("<Json failed to parse.>");
   }
-  (*json->mutable_object())["private_key"] = "<redacted>";
-  return gpr_strdup(json->Dump(/*indent=*/2).c_str());
+  Json::Object object = json->object();
+  object["private_key"] = Json::FromString("<redacted>");
+  return gpr_strdup(
+      grpc_core::JsonDump(Json::FromObject(std::move(object)), /*indent=*/2)
+          .c_str());
 }
 
 grpc_call_credentials* grpc_service_account_jwt_access_credentials_create(

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -37,6 +37,9 @@
 #include <openssl/pem.h>
 #include <openssl/rsa.h>
 #include <openssl/x509.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/param_build.h>
+#endif
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
@@ -45,6 +48,7 @@
 #include <grpc/grpc.h>
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
+#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 #include <grpc/support/time.h>
@@ -61,6 +65,7 @@
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/iomgr/polling_entity.h"
+#include "src/core/lib/json/json_reader.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/slice/b64.h"
 #include "src/core/lib/slice/slice.h"
@@ -113,7 +118,7 @@ static Json parse_json_part_from_jwt(const char* str, size_t len) {
     return Json();  // JSON null
   }
   absl::string_view string = grpc_core::StringViewFromSlice(slice);
-  auto json = Json::Parse(string);
+  auto json = grpc_core::JsonParse(string);
   grpc_core::CSliceUnref(slice);
   if (!json.ok()) {
     gpr_log(GPR_ERROR, "JSON parse error: %s",
@@ -124,20 +129,20 @@ static Json parse_json_part_from_jwt(const char* str, size_t len) {
 }
 
 static const char* validate_string_field(const Json& json, const char* key) {
-  if (json.type() != Json::Type::STRING) {
+  if (json.type() != Json::Type::kString) {
     gpr_log(GPR_ERROR, "Invalid %s field", key);
     return nullptr;
   }
-  return json.string_value().c_str();
+  return json.string().c_str();
 }
 
 static gpr_timespec validate_time_field(const Json& json, const char* key) {
   gpr_timespec result = gpr_time_0(GPR_CLOCK_REALTIME);
-  if (json.type() != Json::Type::NUMBER) {
+  if (json.type() != Json::Type::kNumber) {
     gpr_log(GPR_ERROR, "Invalid %s field", key);
     return result;
   }
-  result.tv_sec = strtol(json.string_value().c_str(), nullptr, 10);
+  result.tv_sec = strtol(json.string().c_str(), nullptr, 10);
   return result;
 }
 
@@ -159,13 +164,13 @@ static jose_header* jose_header_from_json(Json json) {
   const char* alg_value;
   Json::Object::const_iterator it;
   jose_header* h = grpc_core::Zalloc<jose_header>();
-  if (json.type() != Json::Type::OBJECT) {
+  if (json.type() != Json::Type::kObject) {
     gpr_log(GPR_ERROR, "JSON value is not an object");
     goto error;
   }
   // Check alg field.
-  it = json.object_value().find("alg");
-  if (it == json.object_value().end()) {
+  it = json.object().find("alg");
+  if (it == json.object().end()) {
     gpr_log(GPR_ERROR, "Missing alg field.");
     goto error;
   }
@@ -173,8 +178,8 @@ static jose_header* jose_header_from_json(Json json) {
   // Beware of this if we add HMAC support:
   // https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
   //
-  alg_value = it->second.string_value().c_str();
-  if (it->second.type() != Json::Type::STRING ||
+  alg_value = it->second.string().c_str();
+  if (it->second.type() != Json::Type::kString ||
       strncmp(alg_value, "RS", 2) != 0 ||
       evp_md_from_alg(alg_value) == nullptr) {
     gpr_log(GPR_ERROR, "Invalid alg field");
@@ -182,14 +187,14 @@ static jose_header* jose_header_from_json(Json json) {
   }
   h->alg = alg_value;
   // Check typ field.
-  it = json.object_value().find("typ");
-  if (it != json.object_value().end()) {
+  it = json.object().find("typ");
+  if (it != json.object().end()) {
     h->typ = validate_string_field(it->second, "typ");
     if (h->typ == nullptr) goto error;
   }
   // Check kid field.
-  it = json.object_value().find("kid");
-  if (it != json.object_value().end()) {
+  it = json.object().find("kid");
+  if (it != json.object().end()) {
     h->kid = validate_string_field(it->second, "kid");
     if (h->kid == nullptr) goto error;
   }
@@ -269,7 +274,7 @@ grpc_jwt_claims* grpc_jwt_claims_from_json(Json json) {
   claims->exp = gpr_inf_future(GPR_CLOCK_REALTIME);
 
   // Per the spec, all fields are optional.
-  for (const auto& p : claims->json->object_value()) {
+  for (const auto& p : claims->json->object()) {
     if (p.first == "sub") {
       claims->sub = validate_string_field(p.second, "sub");
       if (claims->sub == nullptr) goto error;
@@ -435,8 +440,8 @@ static Json json_from_http(const grpc_http_response* response) {
             response->status);
     return Json();  // JSON null
   }
-  auto json =
-      Json::Parse(absl::string_view(response->body, response->body_length));
+  auto json = grpc_core::JsonParse(
+      absl::string_view(response->body, response->body_length));
   if (!json.ok()) {
     gpr_log(GPR_ERROR, "Invalid JSON found in response.");
     return Json();  // JSON null
@@ -445,8 +450,8 @@ static Json json_from_http(const grpc_http_response* response) {
 }
 
 static const Json* find_property_by_name(const Json& json, const char* name) {
-  auto it = json.object_value().find(name);
-  if (it == json.object_value().end()) {
+  auto it = json.object().find(name);
+  if (it == json.object().end()) {
     return nullptr;
   }
   return &it->second;
@@ -521,37 +526,46 @@ static int RSA_set0_key(RSA* r, BIGNUM* n, BIGNUM* e, BIGNUM* d) {
 #endif  // OPENSSL_VERSION_NUMBER < 0x10100000L
 
 static EVP_PKEY* pkey_from_jwk(const Json& json, const char* kty) {
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   RSA* rsa = nullptr;
+#else
+  EVP_PKEY_CTX* ctx = nullptr;
+  OSSL_PARAM* params = NULL;
+  OSSL_PARAM_BLD* bld = OSSL_PARAM_BLD_new();
+#endif
   EVP_PKEY* result = nullptr;
   BIGNUM* tmp_n = nullptr;
   BIGNUM* tmp_e = nullptr;
   Json::Object::const_iterator it;
 
-  GPR_ASSERT(json.type() == Json::Type::OBJECT);
+  GPR_ASSERT(json.type() == Json::Type::kObject);
   GPR_ASSERT(kty != nullptr);
   if (strcmp(kty, "RSA") != 0) {
     gpr_log(GPR_ERROR, "Unsupported key type %s.", kty);
     goto end;
   }
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   rsa = RSA_new();
   if (rsa == nullptr) {
     gpr_log(GPR_ERROR, "Could not create rsa key.");
     goto end;
   }
-  it = json.object_value().find("n");
-  if (it == json.object_value().end()) {
+#endif
+  it = json.object().find("n");
+  if (it == json.object().end()) {
     gpr_log(GPR_ERROR, "Missing RSA public key field.");
     goto end;
   }
   tmp_n = bignum_from_base64(validate_string_field(it->second, "n"));
   if (tmp_n == nullptr) goto end;
-  it = json.object_value().find("e");
-  if (it == json.object_value().end()) {
+  it = json.object().find("e");
+  if (it == json.object().end()) {
     gpr_log(GPR_ERROR, "Missing RSA public key field.");
     goto end;
   }
   tmp_e = bignum_from_base64(validate_string_field(it->second, "e"));
   if (tmp_e == nullptr) goto end;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   if (!RSA_set0_key(rsa, tmp_n, tmp_e, nullptr)) {
     gpr_log(GPR_ERROR, "Cannot set RSA key from inputs.");
     goto end;
@@ -561,9 +575,38 @@ static EVP_PKEY* pkey_from_jwk(const Json& json, const char* kty) {
   tmp_e = nullptr;
   result = EVP_PKEY_new();
   EVP_PKEY_set1_RSA(result, rsa);  // uprefs rsa.
+#else
+
+  if (!OSSL_PARAM_BLD_push_BN(bld, "n", tmp_n) ||
+      !OSSL_PARAM_BLD_push_BN(bld, "e", tmp_e) ||
+      (params = OSSL_PARAM_BLD_to_param(bld)) == NULL) {
+    gpr_log(GPR_ERROR, "Could not create OSSL_PARAM");
+    goto end;
+  }
+
+  ctx = EVP_PKEY_CTX_new_from_name(nullptr, "RSA", nullptr);
+  if (ctx == nullptr) {
+    gpr_log(GPR_ERROR, "Could not create rsa key.");
+    goto end;
+  }
+  if (EVP_PKEY_fromdata_init(ctx) <= 0) {
+    gpr_log(GPR_ERROR, "Could not create rsa key.");
+    goto end;
+  }
+  if (EVP_PKEY_fromdata(ctx, &result, EVP_PKEY_KEYPAIR, params) <= 0) {
+    gpr_log(GPR_ERROR, "Cannot set RSA key from inputs.");
+    goto end;
+  }
+#endif
 
 end:
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   RSA_free(rsa);
+#else
+  EVP_PKEY_CTX_free(ctx);
+  OSSL_PARAM_free(params);
+  OSSL_PARAM_BLD_free(bld);
+#endif
   BN_free(tmp_n);
   BN_free(tmp_e);
   return result;
@@ -579,30 +622,30 @@ static EVP_PKEY* find_verification_key(const Json& json, const char* header_alg,
     // { <kid1>: <x5091>, <kid2>: <x5092>, ... }
     const Json* cur = find_property_by_name(json, header_kid);
     if (cur == nullptr) return nullptr;
-    return extract_pkey_from_x509(cur->string_value().c_str());
+    return extract_pkey_from_x509(cur->string().c_str());
   }
-  if (jwt_keys->type() != Json::Type::ARRAY) {
+  if (jwt_keys->type() != Json::Type::kArray) {
     gpr_log(GPR_ERROR,
             "Unexpected value type of keys property in jwks key set.");
     return nullptr;
   }
   // Key format is specified in:
   // https://tools.ietf.org/html/rfc7518#section-6.
-  for (const Json& jkey : jwt_keys->array_value()) {
-    if (jkey.type() != Json::Type::OBJECT) continue;
+  for (const Json& jkey : jwt_keys->array()) {
+    if (jkey.type() != Json::Type::kObject) continue;
     const char* alg = nullptr;
-    auto it = jkey.object_value().find("alg");
-    if (it != jkey.object_value().end()) {
+    auto it = jkey.object().find("alg");
+    if (it != jkey.object().end()) {
       alg = validate_string_field(it->second, "alg");
     }
     const char* kid = nullptr;
-    it = jkey.object_value().find("kid");
-    if (it != jkey.object_value().end()) {
+    it = jkey.object().find("kid");
+    if (it != jkey.object().end()) {
       kid = validate_string_field(it->second, "kid");
     }
     const char* kty = nullptr;
-    it = jkey.object_value().find("kty");
-    if (it != jkey.object_value().end()) {
+    it = jkey.object().find("kty");
+    if (it != jkey.object().end()) {
       kty = validate_string_field(it->second, "kty");
     }
     if (alg != nullptr && kid != nullptr && kty != nullptr &&
@@ -640,6 +683,7 @@ static int verify_jwt_signature(EVP_PKEY* key, const char* alg,
   if (EVP_DigestVerifyFinal(md_ctx, GRPC_SLICE_START_PTR(signature),
                             GRPC_SLICE_LENGTH(signature)) != 1) {
     gpr_log(GPR_ERROR, "JWT signature verification failed.");
+
     goto end;
   }
   result = 1;
@@ -656,7 +700,7 @@ static void on_keys_retrieved(void* user_data, grpc_error_handle /*error*/) {
   grpc_jwt_verifier_status status = GRPC_JWT_VERIFIER_GENERIC_ERROR;
   grpc_jwt_claims* claims = nullptr;
 
-  if (json.type() == Json::Type::JSON_NULL) {
+  if (json.type() == Json::Type::kNull) {
     status = GRPC_JWT_VERIFIER_KEY_RETRIEVAL_ERROR;
     goto end;
   }
@@ -702,7 +746,7 @@ static void on_openid_config_retrieved(void* user_data,
   char* path;
 
   // TODO(jboeuf): Cache the jwks_uri in order to avoid this hop next time.
-  if (json.type() == Json::Type::JSON_NULL) goto error;
+  if (json.type() == Json::Type::kNull) goto error;
   cur = find_property_by_name(json, "jwks_uri");
   if (cur == nullptr) {
     gpr_log(GPR_ERROR, "Could not find jwks_uri in openid config.");
@@ -894,7 +938,7 @@ void grpc_jwt_verifier_verify(grpc_jwt_verifier* verifier,
   dot = strchr(cur, '.');
   if (dot == nullptr) goto error;
   json = parse_json_part_from_jwt(cur, static_cast<size_t>(dot - cur));
-  if (json.type() == Json::Type::JSON_NULL) goto error;
+  if (json.type() == Json::Type::kNull) goto error;
   header = jose_header_from_json(std::move(json));
   if (header == nullptr) goto error;
 
@@ -902,7 +946,7 @@ void grpc_jwt_verifier_verify(grpc_jwt_verifier* verifier,
   dot = strchr(cur, '.');
   if (dot == nullptr) goto error;
   json = parse_json_part_from_jwt(cur, static_cast<size_t>(dot - cur));
-  if (json.type() == Json::Type::JSON_NULL) goto error;
+  if (json.type() == Json::Type::kNull) goto error;
   claims = grpc_jwt_claims_from_json(std::move(json));
   if (claims == nullptr) goto error;