grpc 1.54.3 → 1.59.2

data/src/core/lib/transport/transport.h

@@ -211,6 +211,9 @@ struct CallArgs {
   // This should be moved around and only destroyed when the transport is
   // satisfied that the metadata has passed any flow control measures it has.
   ClientInitialMetadataOutstandingToken client_initial_metadata_outstanding;
+  // Latch that will ultimately contain the polling entity for the call.
+  // TODO(ctiller): remove once event engine lands
+  Latch<grpc_polling_entity>* polling_entity;
   // Initial metadata from the server to the client.
   // Set once when it's available.
   // During promise setup filters can substitute their own latch for this
@@ -492,6 +495,12 @@ struct grpc_transport_stream_op_batch_payload {
     // Error contract: the transport that gets this op must cause cancel_error
     //                 to be unref'ed after processing it
     grpc_error_handle cancel_error;
+    // If true the transport should endeavor to delay sending the cancellation
+    // notification for some small amount of time, in order to foil certain
+    // exploits.
+    // This should be set for cancellations that result from malformed client
+    // initial metadata.
+    bool tarpit = false;
   } cancel_stream;
 
   // Indexes correspond to grpc_context_index enum values
@@ -505,7 +514,6 @@ typedef struct grpc_transport_op {
   /// connectivity monitoring - set connectivity_state to NULL to unsubscribe
   grpc_core::OrphanablePtr<grpc_core::ConnectivityStateWatcherInterface>
       start_connectivity_watch;
-  grpc_connectivity_state start_connectivity_watch_state = GRPC_CHANNEL_IDLE;
   grpc_core::ConnectivityStateWatcherInterface* stop_connectivity_watch =
       nullptr;
   /// should the transport be disconnected
@@ -516,19 +524,11 @@ typedef struct grpc_transport_op {
   /// Error contract: the transport that gets this op must cause
   ///                goaway_error to be unref'ed after processing it
   grpc_error_handle goaway_error;
-  /// set the callback for accepting new streams;
-  /// this is a permanent callback, unlike the other one-shot closures.
-  /// If true, the callback is set to set_accept_stream_fn, with its
-  /// user_data argument set to set_accept_stream_user_data
-  bool set_accept_stream = false;
   void (*set_accept_stream_fn)(void* user_data, grpc_transport* transport,
                                const void* server_data) = nullptr;
+  void (*set_registered_method_matcher_fn)(
+      void* user_data, grpc_core::ServerMetadata* metadata) = nullptr;
   void* set_accept_stream_user_data = nullptr;
-  /// set the callback for accepting new streams based upon promises;
-  /// this is a permanent callback, unlike the other one-shot closures.
-  /// If true, the callback is set to set_make_promise_fn, with its
-  /// user_data argument set to set_make_promise_data
-  bool set_make_promise = false;
   void (*set_make_promise_fn)(void* user_data, grpc_transport* transport,
                               const void* server_data) = nullptr;
   void* set_make_promise_user_data = nullptr;
@@ -544,9 +544,28 @@ typedef struct grpc_transport_op {
     /// Called when the ping ack is received
     grpc_closure* on_ack = nullptr;
   } send_ping;
+  grpc_connectivity_state start_connectivity_watch_state = GRPC_CHANNEL_IDLE;
   // If true, will reset the channel's connection backoff.
   bool reset_connect_backoff = false;
 
+  /// set the callback for accepting new streams;
+  /// this is a permanent callback, unlike the other one-shot closures.
+  /// If true, the callback is set to set_accept_stream_fn, with its
+  /// user_data argument set to set_accept_stream_user_data.
+  /// `set_registered_method_matcher_fn` is also set with its user_data argument
+  /// set to set_accept_stream_user_data. The transport should invoke
+  /// `set_registered_method_matcher_fn` after initial metadata is received but
+  /// before recv_initial_metadata_ready callback is invoked. If the transport
+  /// detects an error in the stream, invoking
+  /// `set_registered_method_matcher_fn` can be skipped.
+  bool set_accept_stream = false;
+
+  /// set the callback for accepting new streams based upon promises;
+  /// this is a permanent callback, unlike the other one-shot closures.
+  /// If true, the callback is set to set_make_promise_fn, with its
+  /// user_data argument set to set_make_promise_data
+  bool set_make_promise = false;
+
   //**************************************************************************
   // remaining fields are initialized and used at the discretion of the
   // transport implementation

data/src/core/plugin_registry/grpc_plugin_registry.cc

@@ -50,9 +50,8 @@ extern void RegisterServiceConfigChannelArgFilter(
 extern void RegisterExtraFilters(CoreConfiguration::Builder* builder);
 extern void RegisterResourceQuota(CoreConfiguration::Builder* builder);
 extern void FaultInjectionFilterRegister(CoreConfiguration::Builder* builder);
+extern void RegisterDnsResolver(CoreConfiguration::Builder* builder);
 extern void RegisterBackendMetricFilter(CoreConfiguration::Builder* builder);
-extern void RegisterNativeDnsResolver(CoreConfiguration::Builder* builder);
-extern void RegisterAresDnsResolver(CoreConfiguration::Builder* builder);
 extern void RegisterSockaddrResolver(CoreConfiguration::Builder* builder);
 extern void RegisterFakeResolver(CoreConfiguration::Builder* builder);
 extern void RegisterPriorityLbPolicy(CoreConfiguration::Builder* builder);
@@ -63,7 +62,6 @@ extern void RegisterPickFirstLbPolicy(CoreConfiguration::Builder* builder);
 extern void RegisterRoundRobinLbPolicy(CoreConfiguration::Builder* builder);
 extern void RegisterWeightedRoundRobinLbPolicy(
     CoreConfiguration::Builder* builder);
-extern void RegisterRingHashLbPolicy(CoreConfiguration::Builder* builder);
 extern void RegisterHttpProxyMapper(CoreConfiguration::Builder* builder);
 #ifndef GRPC_NO_RLS
 extern void RegisterRlsLbPolicy(CoreConfiguration::Builder* builder);
@@ -86,7 +84,6 @@ void BuildCoreConfiguration(CoreConfiguration::Builder* builder) {
   RegisterPickFirstLbPolicy(builder);
   RegisterRoundRobinLbPolicy(builder);
   RegisterWeightedRoundRobinLbPolicy(builder);
-  RegisterRingHashLbPolicy(builder);
   BuildClientChannelConfiguration(builder);
   SecurityRegisterHandshakerFactories(builder);
   RegisterClientAuthorityFilter(builder);
@@ -98,8 +95,7 @@ void BuildCoreConfiguration(CoreConfiguration::Builder* builder) {
   RegisterServiceConfigChannelArgFilter(builder);
   RegisterResourceQuota(builder);
   FaultInjectionFilterRegister(builder);
-  RegisterAresDnsResolver(builder);
-  RegisterNativeDnsResolver(builder);
+  RegisterDnsResolver(builder);
   RegisterSockaddrResolver(builder);
   RegisterFakeResolver(builder);
   RegisterHttpProxyMapper(builder);

data/src/core/plugin_registry/grpc_plugin_registry_extra.cc

@@ -39,6 +39,7 @@ extern void RegisterXdsClusterResolverLbPolicy(
 extern void RegisterXdsOverrideHostLbPolicy(
     CoreConfiguration::Builder* builder);
 extern void RegisterXdsWrrLocalityLbPolicy(CoreConfiguration::Builder* builder);
+extern void RegisterRingHashLbPolicy(CoreConfiguration::Builder* builder);
 extern void RegisterFileWatcherCertificateProvider(
     CoreConfiguration::Builder* builder);
 #endif
@@ -60,6 +61,7 @@ void RegisterExtraFilters(CoreConfiguration::Builder* builder) {
   RegisterXdsClusterResolverLbPolicy(builder);
   RegisterXdsOverrideHostLbPolicy(builder);
   RegisterXdsWrrLocalityLbPolicy(builder);
+  RegisterRingHashLbPolicy(builder);
   RegisterFileWatcherCertificateProvider(builder);
 #endif
 }

data/src/core/tsi/alts/crypt/aes_gcm.cc

@@ -35,7 +35,12 @@ constexpr size_t kKdfCounterLen = 6;
 constexpr size_t kKdfCounterOffset = 2;
 constexpr size_t kRekeyAeadKeyLen = kAes128GcmKeyLength;
 
-// Struct for additional data required if rekeying is enabled.
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+const char kEvpMacAlgorithm[] = "HMAC";
+char kEvpDigest[] = "SHA-256";
+#endif
+
+/* Struct for additional data required if rekeying is enabled. */
 struct gsec_aes_gcm_aead_rekey_data {
   uint8_t kdf_counter[kKdfCounterLen];
   uint8_t nonce_mask[kAesGcmNonceLength];
@@ -196,7 +201,7 @@ static grpc_status_code aes_gcm_derive_aead_key(uint8_t* dst,
     return GRPC_STATUS_INTERNAL;
   }
   HMAC_CTX_cleanup(&hmac);
-#else
+#elif OPENSSL_VERSION_NUMBER < 0x30000000L
   HMAC_CTX* hmac = HMAC_CTX_new();
   if (hmac == nullptr) {
     return GRPC_STATUS_INTERNAL;
@@ -208,6 +213,26 @@ static grpc_status_code aes_gcm_derive_aead_key(uint8_t* dst,
     return GRPC_STATUS_INTERNAL;
   }
   HMAC_CTX_free(hmac);
+#else
+  EVP_MAC* mac = EVP_MAC_fetch(nullptr, kEvpMacAlgorithm, nullptr);
+  EVP_MAC_CTX* ctx = EVP_MAC_CTX_new(mac);
+  if (ctx == nullptr) {
+    return GRPC_STATUS_INTERNAL;
+  }
+  OSSL_PARAM params[2];
+  params[0] = OSSL_PARAM_construct_utf8_string("digest", kEvpDigest, 0);
+  params[1] = OSSL_PARAM_construct_end();
+
+  if (!EVP_MAC_init(ctx, kdf_key, kKdfKeyLen, params) ||
+      !EVP_MAC_update(ctx, kdf_counter, kKdfCounterLen) ||
+      !EVP_MAC_update(ctx, &ctr, 1) ||
+      !EVP_MAC_final(ctx, buf, nullptr, EVP_MAX_MD_SIZE)) {
+    EVP_MAC_CTX_free(ctx);
+    EVP_MAC_free(mac);
+    return GRPC_STATUS_INTERNAL;
+  }
+  EVP_MAC_CTX_free(ctx);
+  EVP_MAC_free(mac);
 #endif
   memcpy(dst, buf, kRekeyAeadKeyLen);
   return GRPC_STATUS_OK;

data/src/core/tsi/alts/zero_copy_frame_protector/alts_grpc_record_protocol_common.cc

@@ -124,9 +124,8 @@ tsi_result alts_grpc_record_protocol_init(alts_grpc_record_protocol* rp,
 tsi_result alts_grpc_record_protocol_protect(
     alts_grpc_record_protocol* self, grpc_slice_buffer* unprotected_slices,
     grpc_slice_buffer* protected_slices) {
-  if (grpc_core::ExecCtx::Get() == nullptr || self == nullptr ||
-      self->vtable == nullptr || unprotected_slices == nullptr ||
-      protected_slices == nullptr) {
+  if (self == nullptr || self->vtable == nullptr ||
+      unprotected_slices == nullptr || protected_slices == nullptr) {
     return TSI_INVALID_ARGUMENT;
   }
   if (self->vtable->protect == nullptr) {
@@ -138,9 +137,8 @@ tsi_result alts_grpc_record_protocol_protect(
 tsi_result alts_grpc_record_protocol_unprotect(
     alts_grpc_record_protocol* self, grpc_slice_buffer* protected_slices,
     grpc_slice_buffer* unprotected_slices) {
-  if (grpc_core::ExecCtx::Get() == nullptr || self == nullptr ||
-      self->vtable == nullptr || protected_slices == nullptr ||
-      unprotected_slices == nullptr) {
+  if (self == nullptr || self->vtable == nullptr ||
+      protected_slices == nullptr || unprotected_slices == nullptr) {
     return TSI_INVALID_ARGUMENT;
   }
   if (self->vtable->unprotect == nullptr) {

data/src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.cc

@@ -263,8 +263,7 @@ tsi_result alts_zero_copy_grpc_protector_create(
     bool is_integrity_only, bool enable_extra_copy,
     size_t* max_protected_frame_size,
     tsi_zero_copy_grpc_protector** protector) {
-  if (grpc_core::ExecCtx::Get() == nullptr || key == nullptr ||
-      protector == nullptr) {
+  if (key == nullptr || protector == nullptr) {
     gpr_log(
         GPR_ERROR,
         "Invalid nullptr arguments to alts_zero_copy_grpc_protector create.");

data/src/core/tsi/ssl_transport_security.cc

@@ -65,6 +65,7 @@
 
 // --- Constants. ---
 
+#define TSI_SSL_MAX_BIO_WRITE_ATTEMPTS 100
 #define TSI_SSL_MAX_PROTECTED_FRAME_SIZE_UPPER_BOUND 16384
 #define TSI_SSL_MAX_PROTECTED_FRAME_SIZE_LOWER_BOUND 1024
 #define TSI_SSL_HANDSHAKER_OUTGOING_BUFFER_INITIAL_SIZE 1024
@@ -148,6 +149,9 @@ static int g_ssl_ex_verified_root_cert_index = -1;
 #if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_NO_ENGINE)
 static const char kSslEnginePrefix[] = "engine:";
 #endif
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+static const int kSslEcCurveNames[] = {NID_X9_62_prime256v1};
+#endif
 
 #if OPENSSL_VERSION_NUMBER < 0x10100000
 static gpr_mu* g_openssl_mutexes = nullptr;
@@ -788,6 +792,7 @@ static tsi_result populate_ssl_context(
     return TSI_INVALID_ARGUMENT;
   }
   {
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
     EC_KEY* ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
     if (!SSL_CTX_set_tmp_ecdh(context, ecdh)) {
       gpr_log(GPR_ERROR, "Could not set ephemeral ECDH key.");
@@ -796,6 +801,13 @@ static tsi_result populate_ssl_context(
     }
     SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
     EC_KEY_free(ecdh);
+#else
+    if (!SSL_CTX_set1_groups(context, kSslEcCurveNames, 1)) {
+      gpr_log(GPR_ERROR, "Could not set ephemeral ECDH key.");
+      return TSI_INTERNAL_ERROR;
+    }
+    SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
+#endif
   }
   return TSI_OK;
 }
@@ -1538,15 +1550,35 @@ static tsi_result ssl_handshaker_next(tsi_handshaker* self,
   // If there are received bytes, process them first.
   tsi_ssl_handshaker* impl = reinterpret_cast<tsi_ssl_handshaker*>(self);
   tsi_result status = TSI_OK;
-  size_t bytes_consumed = received_bytes_size;
   size_t bytes_written = 0;
   if (received_bytes_size > 0) {
-    status = ssl_handshaker_process_bytes_from_peer(impl, received_bytes,
-                                                    &bytes_consumed, error);
-    while (status == TSI_DRAIN_BUFFER) {
-      status = ssl_handshaker_write_output_buffer(self, &bytes_written, error);
-      if (status != TSI_OK) return status;
-      status = ssl_handshaker_do_handshake(impl, error);
+    unsigned char* remaining_bytes_to_write_to_openssl =
+        const_cast<unsigned char*>(received_bytes);
+    size_t remaining_bytes_to_write_to_openssl_size = received_bytes_size;
+    size_t number_bio_write_attempts = 0;
+    while (remaining_bytes_to_write_to_openssl_size > 0 &&
+           (status == TSI_OK || status == TSI_INCOMPLETE_DATA) &&
+           number_bio_write_attempts < TSI_SSL_MAX_BIO_WRITE_ATTEMPTS) {
+      ++number_bio_write_attempts;
+      // Try to write all of the remaining bytes to the BIO.
+      size_t bytes_written_to_openssl =
+          remaining_bytes_to_write_to_openssl_size;
+      status = ssl_handshaker_process_bytes_from_peer(
+          impl, remaining_bytes_to_write_to_openssl, &bytes_written_to_openssl,
+          error);
+      // As long as the BIO is full, drive the SSL handshake to consume bytes
+      // from the BIO. If the SSL handshake returns any bytes, write them to the
+      // peer.
+      while (status == TSI_DRAIN_BUFFER) {
+        status =
+            ssl_handshaker_write_output_buffer(self, &bytes_written, error);
+        if (status != TSI_OK) return status;
+        status = ssl_handshaker_do_handshake(impl, error);
+      }
+      // Move the pointer to the first byte not yet successfully written to the
+      // BIO.
+      remaining_bytes_to_write_to_openssl_size -= bytes_written_to_openssl;
+      remaining_bytes_to_write_to_openssl += bytes_written_to_openssl;
     }
   }
   if (status != TSI_OK) return status;
@@ -1730,6 +1762,13 @@ void tsi_ssl_client_handshaker_factory_unref(
   tsi_ssl_handshaker_factory_unref(&factory->base);
 }
 
+tsi_ssl_client_handshaker_factory* tsi_ssl_client_handshaker_factory_ref(
+    tsi_ssl_client_handshaker_factory* client_factory) {
+  if (client_factory == nullptr) return nullptr;
+  return reinterpret_cast<tsi_ssl_client_handshaker_factory*>(
+      tsi_ssl_handshaker_factory_ref(&client_factory->base));
+}
+
 static void tsi_ssl_client_handshaker_factory_destroy(
     tsi_ssl_handshaker_factory* factory) {
   if (factory == nullptr) return;
@@ -2202,12 +2241,15 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
         STACK_OF(X509_NAME)* root_names = nullptr;
         result = ssl_ctx_load_verification_certs(
             impl->ssl_contexts[i], options->pem_client_root_certs,
-            strlen(options->pem_client_root_certs), &root_names);
+            strlen(options->pem_client_root_certs),
+            options->send_client_ca_list ? &root_names : nullptr);
         if (result != TSI_OK) {
           gpr_log(GPR_ERROR, "Invalid verification certs.");
           break;
         }
-        SSL_CTX_set_client_CA_list(impl->ssl_contexts[i], root_names);
+        if (options->send_client_ca_list) {
+          SSL_CTX_set_client_CA_list(impl->ssl_contexts[i], root_names);
+        }
       }
       switch (options->client_certificate_request) {
         case TSI_DONT_REQUEST_CLIENT_CERTIFICATE:

data/src/core/tsi/ssl_transport_security.h

@@ -223,6 +223,10 @@ tsi_result tsi_ssl_client_handshaker_factory_create_handshaker(
     const char* server_name_indication, size_t network_bio_buf_size,
     size_t ssl_bio_buf_size, tsi_handshaker** handshaker);
 
+// Increments reference count of the client handshaker factory.
+tsi_ssl_client_handshaker_factory* tsi_ssl_client_handshaker_factory_ref(
+    tsi_ssl_client_handshaker_factory* client_factory);
+
 // Decrements reference count of the handshaker factory. Handshaker factory will
 // be destroyed once no references exist.
 void tsi_ssl_client_handshaker_factory_unref(
@@ -325,6 +329,17 @@ struct tsi_ssl_server_handshaker_options {
   // crl checking. Only OpenSSL version > 1.1 is supported for CRL checking
   const char* crl_directory;
 
+  // If true, the SSL server sends a list of CA names to the client in the
+  // ServerHello. This list of CA names is extracted from the server's trust
+  // bundle, and the client may use this lint as a hint to decide which
+  // certificate it should send to the server.
+  //
+  // WARNING: This is an extremely dangerous option. If the server's trust
+  // bundle is sufficiently large, then setting this bit to true will result in
+  // the server being unable to generate a ServerHello, and hence the server
+  // will be unusable.
+  bool send_client_ca_list;
+
   tsi_ssl_server_handshaker_options()
       : pem_key_cert_pairs(nullptr),
         num_key_cert_pairs(0),
@@ -338,7 +353,8 @@ struct tsi_ssl_server_handshaker_options {
         min_tls_version(tsi_tls_version::TSI_TLS1_2),
         max_tls_version(tsi_tls_version::TSI_TLS1_3),
         key_logger(nullptr),
-        crl_directory(nullptr) {}
+        crl_directory(nullptr),
+        send_client_ca_list(true) {}
 };
 
 // Creates a server handshaker factory.

data/src/ruby/bin/math_pb.rb

@@ -1,28 +1,34 @@
+# frozen_string_literal: true
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
 # source: math.proto
 
 require 'google/protobuf'
 
-Google::Protobuf::DescriptorPool.generated_pool.build do
-  add_file("math.proto", :syntax => :proto3) do
-    add_message "math.DivArgs" do
-      optional :dividend, :int64, 1
-      optional :divisor, :int64, 2
-    end
-    add_message "math.DivReply" do
-      optional :quotient, :int64, 1
-      optional :remainder, :int64, 2
-    end
-    add_message "math.FibArgs" do
-      optional :limit, :int64, 1
-    end
-    add_message "math.Num" do
-      optional :num, :int64, 1
-    end
-    add_message "math.FibReply" do
-      optional :count, :int64, 1
+
+descriptor_data = "\n\nmath.proto\x12\x04math\",\n\x07\x44ivArgs\x12\x10\n\x08\x64ividend\x18\x01 \x01(\x03\x12\x0f\n\x07\x64ivisor\x18\x02 \x01(\x03\"/\n\x08\x44ivReply\x12\x10\n\x08quotient\x18\x01 \x01(\x03\x12\x11\n\tremainder\x18\x02 \x01(\x03\"\x18\n\x07\x46ibArgs\x12\r\n\x05limit\x18\x01 \x01(\x03\"\x12\n\x03Num\x12\x0b\n\x03num\x18\x01 \x01(\x03\"\x19\n\x08\x46ibReply\x12\r\n\x05\x63ount\x18\x01 \x01(\x03\x32\xa4\x01\n\x04Math\x12&\n\x03\x44iv\x12\r.math.DivArgs\x1a\x0e.math.DivReply\"\x00\x12.\n\x07\x44ivMany\x12\r.math.DivArgs\x1a\x0e.math.DivReply\"\x00(\x01\x30\x01\x12#\n\x03\x46ib\x12\r.math.FibArgs\x1a\t.math.Num\"\x00\x30\x01\x12\x1f\n\x03Sum\x12\t.math.Num\x1a\t.math.Num\"\x00(\x01\x62\x06proto3"
+
+pool = Google::Protobuf::DescriptorPool.generated_pool
+
+begin
+  pool.add_serialized_file(descriptor_data)
+rescue TypeError => e
+  # Compatibility code: will be removed in the next major version.
+  require 'google/protobuf/descriptor_pb'
+  parsed = Google::Protobuf::FileDescriptorProto.decode(descriptor_data)
+  parsed.clear_dependency
+  serialized = parsed.class.encode(parsed)
+  file = pool.add_serialized_file(serialized)
+  warn "Warning: Protobuf detected an import path issue while loading generated file #{__FILE__}"
+  imports = [
+  ]
+  imports.each do |type_name, expected_filename|
+    import_file = pool.lookup(type_name).file_descriptor
+    if import_file.name != expected_filename
+      warn "- #{file.name} imports #{expected_filename}, but that import was loaded as #{import_file.name}"
     end
   end
+  warn "Each proto file must use a consistent fully-qualified name."
+  warn "This will become an error in the next major version."
 end
 
 module Math

data/src/ruby/ext/grpc/extconf.rb

@@ -34,24 +34,23 @@ def env_unset?(name)
   ENV[name].nil? || ENV[name].size == 0
 end
 
-def rbconfig_set?(name)
-  RbConfig::CONFIG[name] && RbConfig::CONFIG[name].size > 0
+def inherit_env_or_rbconfig(name)
+  ENV[name] = inherit_rbconfig(name) if env_unset?(name)
 end
 
 def inherit_rbconfig(name)
-  ENV[name] = RbConfig::CONFIG[name] if env_unset?(name) && rbconfig_set?(name)
+  ENV[name] = RbConfig::CONFIG[name] || ''
 end
 
 def env_append(name, string)
-  ENV[name] ||= ''
   ENV[name] += ' ' + string
 end
 
-inherit_rbconfig 'AR'
-inherit_rbconfig 'CC'
-inherit_rbconfig 'CXX'
-inherit_rbconfig 'RANLIB'
-inherit_rbconfig 'STRIP'
+inherit_env_or_rbconfig 'AR'
+inherit_env_or_rbconfig 'CC'
+inherit_env_or_rbconfig 'CXX'
+inherit_env_or_rbconfig 'RANLIB'
+inherit_env_or_rbconfig 'STRIP'
 inherit_rbconfig 'CPPFLAGS'
 inherit_rbconfig 'LDFLAGS'
 
@@ -89,11 +88,15 @@ env_append 'CPPFLAGS', '-DGRPC_XDS_USER_AGENT_NAME_SUFFIX="\"RUBY\""'
 
 require_relative '../../lib/grpc/version'
 env_append 'CPPFLAGS', '-DGRPC_XDS_USER_AGENT_VERSION_SUFFIX="\"' + GRPC::VERSION + '\""'
+env_append 'CPPFLAGS', '-DGRPC_POSIX_FORK_ALLOW_PTHREAD_ATFORK=1'
 
 output_dir = File.expand_path(RbConfig::CONFIG['topdir'])
 grpc_lib_dir = File.join(output_dir, 'libs', grpc_config)
 ENV['BUILDDIR'] = output_dir
 
+strip_tool = RbConfig::CONFIG['STRIP']
+strip_tool += ' -x' if apple_toolchain
+
 unless windows
   puts 'Building internal gRPC into ' + grpc_lib_dir
   nproc = 4
@@ -108,6 +111,17 @@ unless windows
   puts "Building grpc native library: #{cmd}"
   system(cmd)
   exit 1 unless $? == 0
+
+  if grpc_config == 'opt'
+    rm_obj_cmd = "rm -rf #{File.join(output_dir, 'objs')}"
+    puts "Removing grpc object files: #{rm_obj_cmd}"
+    system(rm_obj_cmd)
+    exit 1 unless $? == 0
+    strip_cmd = "#{strip_tool} #{grpc_lib_dir}/*.a"
+    puts "Stripping grpc native library: #{strip_cmd}"
+    system(strip_cmd)
+    exit 1 unless $? == 0
+  end
 end
 
 $CFLAGS << ' -DGRPC_RUBY_WINDOWS_UCRT' if windows_ucrt
@@ -142,7 +156,10 @@ end
 
 ext_export_file = File.join(grpc_root, 'src', 'ruby', 'ext', 'grpc', ext_export_filename())
 $LDFLAGS << ' -Wl,--version-script="' + ext_export_file + '.gcc"' if linux
-$LDFLAGS << ' -Wl,-exported_symbols_list,"' + ext_export_file + '.clang"' if apple_toolchain
+if apple_toolchain
+  $LDFLAGS << ' -weak_framework CoreFoundation'
+  $LDFLAGS << ' -Wl,-exported_symbols_list,"' + ext_export_file + '.clang"'
+end
 
 $LDFLAGS << ' ' + File.join(grpc_lib_dir, 'libgrpc.a') unless windows
 if grpc_config == 'gcov'
@@ -170,23 +187,6 @@ output = File.join('grpc', 'grpc_c')
 puts 'Generating Makefile for ' + output
 create_makefile(output)
 
-strip_tool = RbConfig::CONFIG['STRIP']
-strip_tool += ' -x' if apple_toolchain
-
-if grpc_config == 'opt'
-  File.open('Makefile.new', 'w') do |o|
-    o.puts 'hijack: all strip'
-    o.puts
-    File.foreach('Makefile') do |i|
-      o.puts i
-    end
-    o.puts
-    o.puts 'strip: $(DLLIB)'
-    o.puts "\t$(ECHO) Stripping $(DLLIB)"
-    o.puts "\t$(Q) #{strip_tool} $(DLLIB)"
-  end
-  File.rename('Makefile.new', 'Makefile')
-end
 if ENV['GRPC_RUBY_TEST_ONLY_WORKAROUND_MAKE_INSTALL_BUG']
   # Note: this env var setting is intended to work around a problem observed
   # with the ginstall command on grpc's macos automated test infrastructure,

data/src/ruby/ext/grpc/rb_call.c

@@ -801,6 +801,56 @@ static VALUE grpc_run_batch_stack_build_result(run_batch_stack* st) {
   return result;
 }
 
+struct call_run_batch_args {
+  grpc_rb_call* call;
+  unsigned write_flag;
+  VALUE ops_hash;
+  run_batch_stack* st;
+};
+
+static VALUE grpc_rb_call_run_batch_try(VALUE value_args) {
+  grpc_rb_fork_unsafe_begin();
+  struct call_run_batch_args* args = (struct call_run_batch_args*)value_args;
+  void* tag = (void*)&args->st;
+
+  grpc_event ev;
+  grpc_call_error err;
+
+  args->st = gpr_malloc(sizeof(run_batch_stack));
+  grpc_run_batch_stack_init(args->st, args->write_flag);
+  grpc_run_batch_stack_fill_ops(args->st, args->ops_hash);
+
+  /* call grpc_call_start_batch, then wait for it to complete using
+   * pluck_event */
+  err = grpc_call_start_batch(args->call->wrapped, args->st->ops,
+                              args->st->op_num, tag, NULL);
+  if (err != GRPC_CALL_OK) {
+    rb_raise(grpc_rb_eCallError,
+             "grpc_call_start_batch failed with %s (code=%d)",
+             grpc_call_error_detail_of(err), err);
+  }
+  ev = rb_completion_queue_pluck(args->call->queue, tag,
+                                 gpr_inf_future(GPR_CLOCK_REALTIME), NULL);
+  if (!ev.success) {
+    rb_raise(grpc_rb_eCallError, "call#run_batch failed somehow");
+  }
+  /* Build and return the BatchResult struct result,
+     if there is an error, it's reflected in the status */
+  return grpc_run_batch_stack_build_result(args->st);
+}
+
+static VALUE grpc_rb_call_run_batch_ensure(VALUE value_args) {
+  grpc_rb_fork_unsafe_end();
+  struct call_run_batch_args* args = (struct call_run_batch_args*)value_args;
+
+  if (args->st) {
+    grpc_run_batch_stack_cleanup(args->st);
+    gpr_free(args->st);
+  }
+
+  return Qnil;
+}
+
 /* call-seq:
    ops = {
      GRPC::Core::CallOps::SEND_INITIAL_METADATA => <op_value>,
@@ -819,56 +869,29 @@ static VALUE grpc_run_batch_stack_build_result(run_batch_stack* st) {
    Only one operation of each type can be active at once in any given
    batch */
 static VALUE grpc_rb_call_run_batch(VALUE self, VALUE ops_hash) {
-  run_batch_stack* st = NULL;
-  grpc_rb_call* call = NULL;
-  grpc_event ev;
-  grpc_call_error err;
-  VALUE result = Qnil;
-  VALUE rb_write_flag = rb_ivar_get(self, id_write_flag);
-  unsigned write_flag = 0;
-  void* tag = (void*)&st;
-
   grpc_ruby_fork_guard();
   if (RTYPEDDATA_DATA(self) == NULL) {
     rb_raise(grpc_rb_eCallError, "Cannot run batch on closed call");
-    return Qnil;
   }
+
+  grpc_rb_call* call = NULL;
   TypedData_Get_Struct(self, grpc_rb_call, &grpc_call_data_type, call);
 
   /* Validate the ops args, adding them to a ruby array */
   if (TYPE(ops_hash) != T_HASH) {
     rb_raise(rb_eTypeError, "call#run_batch: ops hash should be a hash");
-    return Qnil;
   }
-  if (rb_write_flag != Qnil) {
-    write_flag = NUM2UINT(rb_write_flag);
-  }
-  st = gpr_malloc(sizeof(run_batch_stack));
-  grpc_run_batch_stack_init(st, write_flag);
-  grpc_run_batch_stack_fill_ops(st, ops_hash);
 
-  /* call grpc_call_start_batch, then wait for it to complete using
-   * pluck_event */
-  err = grpc_call_start_batch(call->wrapped, st->ops, st->op_num, tag, NULL);
-  if (err != GRPC_CALL_OK) {
-    grpc_run_batch_stack_cleanup(st);
-    gpr_free(st);
-    rb_raise(grpc_rb_eCallError,
-             "grpc_call_start_batch failed with %s (code=%d)",
-             grpc_call_error_detail_of(err), err);
-    return Qnil;
-  }
-  ev = rb_completion_queue_pluck(call->queue, tag,
-                                 gpr_inf_future(GPR_CLOCK_REALTIME), NULL);
-  if (!ev.success) {
-    rb_raise(grpc_rb_eCallError, "call#run_batch failed somehow");
-  }
-  /* Build and return the BatchResult struct result,
-     if there is an error, it's reflected in the status */
-  result = grpc_run_batch_stack_build_result(st);
-  grpc_run_batch_stack_cleanup(st);
-  gpr_free(st);
-  return result;
+  VALUE rb_write_flag = rb_ivar_get(self, id_write_flag);
+
+  struct call_run_batch_args args = {
+      .call = call,
+      .write_flag = rb_write_flag == Qnil ? 0 : NUM2UINT(rb_write_flag),
+      .ops_hash = ops_hash,
+      .st = NULL};
+
+  return rb_ensure(grpc_rb_call_run_batch_try, (VALUE)&args,
+                   grpc_rb_call_run_batch_ensure, (VALUE)&args);
 }
 
 static void Init_grpc_write_flags() {

data/src/ruby/ext/grpc/rb_call_credentials.c

@@ -193,7 +193,6 @@ static void grpc_rb_call_credentials_free_internal(void* p) {
 /* Destroys the credentials instances. */
 static void grpc_rb_call_credentials_free(void* p) {
   grpc_rb_call_credentials_free_internal(p);
-  grpc_ruby_shutdown();
 }
 
 /* Protects the mark object from GC */