grpc 1.56.2 → 1.58.0

data/src/core/lib/security/credentials/channel_creds_registry.h

@@ -21,81 +21,105 @@
 
 #include <map>
 #include <memory>
-#include <string>
 #include <type_traits>
+#include <utility>
 
 #include "absl/strings/string_view.h"
 
+#include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/validation_errors.h"
 #include "src/core/lib/json/json.h"
+#include "src/core/lib/json/json_args.h"
 
 struct grpc_channel_credentials;
 
 namespace grpc_core {
 
+class ChannelCredsConfig : public RefCounted<ChannelCredsConfig> {
+ public:
+  virtual absl::string_view type() const = 0;
+
+  virtual bool Equals(const ChannelCredsConfig& other) const = 0;
+
+  virtual Json ToJson() const = 0;
+};
+
 template <typename T = grpc_channel_credentials>
 class ChannelCredsFactory final {
  public:
   virtual ~ChannelCredsFactory() {}
-  virtual absl::string_view creds_type() const = delete;
-  virtual bool IsValidConfig(const Json& config) const = delete;
-  virtual RefCountedPtr<T> CreateChannelCreds(const Json& config) const =
-      delete;
+  virtual absl::string_view type() const = delete;
+  virtual RefCountedPtr<ChannelCredsConfig> ParseConfig(
+      const Json& config, const JsonArgs& args,
+      ValidationErrors* errors) const = delete;
+  virtual RefCountedPtr<T> CreateChannelCreds(
+      RefCountedPtr<ChannelCredsConfig> config) const = delete;
 };
 
 template <>
 class ChannelCredsFactory<grpc_channel_credentials> {
  public:
   virtual ~ChannelCredsFactory() {}
-  virtual absl::string_view creds_type() const = 0;
-  virtual bool IsValidConfig(const Json& config) const = 0;
+  virtual absl::string_view type() const = 0;
+  virtual RefCountedPtr<ChannelCredsConfig> ParseConfig(
+      const Json& config, const JsonArgs& args,
+      ValidationErrors* errors) const = 0;
   virtual RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
-      const Json& config) const = 0;
+      RefCountedPtr<ChannelCredsConfig> config) const = 0;
 };
 
 template <typename T = grpc_channel_credentials>
 class ChannelCredsRegistry {
+ private:
+  using FactoryMap =
+      std::map<absl::string_view, std::unique_ptr<ChannelCredsFactory<T>>>;
+
  public:
   static_assert(std::is_base_of<grpc_channel_credentials, T>::value,
                 "ChannelCredsRegistry must be instantiated with "
                 "grpc_channel_credentials.");
+
   class Builder {
    public:
     void RegisterChannelCredsFactory(
         std::unique_ptr<ChannelCredsFactory<T>> factory) {
-      factories_[factory->creds_type()] = std::move(factory);
+      absl::string_view type = factory->type();
+      factories_[type] = std::move(factory);
     }
     ChannelCredsRegistry Build() {
-      ChannelCredsRegistry<T> registry;
-      registry.factories_.swap(factories_);
-      return registry;
+      return ChannelCredsRegistry<T>(std::move(factories_));
     }
 
    private:
-    std::map<absl::string_view, std::unique_ptr<ChannelCredsFactory<T>>>
-        factories_;
+    FactoryMap factories_;
   };
 
-  bool IsSupported(const std::string& creds_type) const {
-    return factories_.find(creds_type) != factories_.end();
+  bool IsSupported(absl::string_view type) const {
+    return factories_.find(type) != factories_.end();
   }
 
-  bool IsValidConfig(const std::string& creds_type, const Json& config) const {
-    const auto iter = factories_.find(creds_type);
-    return iter != factories_.cend() && iter->second->IsValidConfig(config);
+  RefCountedPtr<ChannelCredsConfig> ParseConfig(
+      absl::string_view type, const Json& config, const JsonArgs& args,
+      ValidationErrors* errors) const {
+    const auto it = factories_.find(type);
+    if (it == factories_.cend()) return nullptr;
+    return it->second->ParseConfig(config, args, errors);
   }
 
-  RefCountedPtr<T> CreateChannelCreds(const std::string& creds_type,
-                                      const Json& config) const {
-    const auto iter = factories_.find(creds_type);
-    if (iter == factories_.cend()) return nullptr;
-    return iter->second->CreateChannelCreds(config);
+  RefCountedPtr<T> CreateChannelCreds(
+      RefCountedPtr<ChannelCredsConfig> config) const {
+    if (config == nullptr) return nullptr;
+    const auto it = factories_.find(config->type());
+    if (it == factories_.cend()) return nullptr;
+    return it->second->CreateChannelCreds(std::move(config));
   }
 
  private:
-  ChannelCredsRegistry() = default;
-  std::map<absl::string_view, std::unique_ptr<ChannelCredsFactory<T>>>
-      factories_;
+  explicit ChannelCredsRegistry(FactoryMap factories)
+      : factories_(std::move(factories)) {}
+
+  FactoryMap factories_;
 };
 
 }  // namespace grpc_core

data/src/core/lib/security/credentials/channel_creds_registry_init.cc

@@ -18,59 +18,219 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <map>
 #include <memory>
+#include <string>
+#include <utility>
 
 #include "absl/strings/string_view.h"
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
+#include <grpc/support/json.h>
+#include <grpc/support/time.h>
 
 #include "src/core/lib/config/core_configuration.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/time.h"
+#include "src/core/lib/gprpp/validation_errors.h"
 #include "src/core/lib/json/json.h"
+#include "src/core/lib/json/json_args.h"
+#include "src/core/lib/json/json_object_loader.h"
 #include "src/core/lib/security/credentials/channel_creds_registry.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/fake/fake_credentials.h"
 #include "src/core/lib/security/credentials/google_default/google_default_credentials.h"  // IWYU pragma: keep
+#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
+#include "src/core/lib/security/credentials/tls/tls_credentials.h"
 
 namespace grpc_core {
 
 class GoogleDefaultChannelCredsFactory : public ChannelCredsFactory<> {
  public:
-  absl::string_view creds_type() const override { return "google_default"; }
-  bool IsValidConfig(const Json& /*config*/) const override { return true; }
+  absl::string_view type() const override { return Type(); }
+  RefCountedPtr<ChannelCredsConfig> ParseConfig(
+      const Json& /*config*/, const JsonArgs& /*args*/,
+      ValidationErrors* /*errors*/) const override {
+    return MakeRefCounted<Config>();
+  }
   RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
-      const Json& /*config*/) const override {
+      RefCountedPtr<ChannelCredsConfig> /*config*/) const override {
     return RefCountedPtr<grpc_channel_credentials>(
         grpc_google_default_credentials_create(nullptr));
   }
+
+ private:
+  class Config : public ChannelCredsConfig {
+   public:
+    absl::string_view type() const override { return Type(); }
+    bool Equals(const ChannelCredsConfig&) const override { return true; }
+    Json ToJson() const override { return Json::FromObject({}); }
+  };
+
+  static absl::string_view Type() { return "google_default"; }
+};
+
+class TlsChannelCredsFactory : public ChannelCredsFactory<> {
+ public:
+  absl::string_view type() const override { return Type(); }
+
+  RefCountedPtr<ChannelCredsConfig> ParseConfig(
+      const Json& config, const JsonArgs& args,
+      ValidationErrors* errors) const override {
+    return LoadFromJson<RefCountedPtr<TlsConfig>>(config, args, errors);
+  }
+
+  RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
+      RefCountedPtr<ChannelCredsConfig> base_config) const override {
+    auto* config = static_cast<const TlsConfig*>(base_config.get());
+    auto options = MakeRefCounted<grpc_tls_credentials_options>();
+    if (!config->certificate_file().empty() ||
+        !config->ca_certificate_file().empty()) {
+      options->set_certificate_provider(
+          MakeRefCounted<FileWatcherCertificateProvider>(
+              config->private_key_file(), config->certificate_file(),
+              config->ca_certificate_file(),
+              config->refresh_interval().millis() / GPR_MS_PER_SEC));
+    }
+    options->set_watch_root_cert(!config->ca_certificate_file().empty());
+    options->set_watch_identity_pair(!config->certificate_file().empty());
+    return MakeRefCounted<TlsCredentials>(std::move(options));
+  }
+
+ private:
+  // TODO(roth): It would be nice to share most of this config with the
+  // xDS file watcher cert provider factory, but that would require
+  // adding a dependency from lib to ext.
+  class TlsConfig : public ChannelCredsConfig {
+   public:
+    absl::string_view type() const override { return Type(); }
+
+    bool Equals(const ChannelCredsConfig& other) const override {
+      auto& o = static_cast<const TlsConfig&>(other);
+      return certificate_file_ == o.certificate_file_ &&
+             private_key_file_ == o.private_key_file_ &&
+             ca_certificate_file_ == o.ca_certificate_file_ &&
+             refresh_interval_ == o.refresh_interval_;
+    }
+
+    Json ToJson() const override {
+      Json::Object obj;
+      if (!certificate_file_.empty()) {
+        obj["certificate_file"] = Json::FromString(certificate_file_);
+      }
+      if (!private_key_file_.empty()) {
+        obj["private_key_file"] = Json::FromString(private_key_file_);
+      }
+      if (!ca_certificate_file_.empty()) {
+        obj["ca_certificate_file"] = Json::FromString(ca_certificate_file_);
+      }
+      if (refresh_interval_ != kDefaultRefreshInterval) {
+        obj["refresh_interval"] =
+            Json::FromString(refresh_interval_.ToJsonString());
+      }
+      return Json::FromObject(std::move(obj));
+    }
+
+    const std::string& certificate_file() const { return certificate_file_; }
+    const std::string& private_key_file() const { return private_key_file_; }
+    const std::string& ca_certificate_file() const {
+      return ca_certificate_file_;
+    }
+    Duration refresh_interval() const { return refresh_interval_; }
+
+    static const JsonLoaderInterface* JsonLoader(const JsonArgs&) {
+      static const auto* loader =
+          JsonObjectLoader<TlsConfig>()
+              .OptionalField("certificate_file", &TlsConfig::certificate_file_)
+              .OptionalField("private_key_file", &TlsConfig::private_key_file_)
+              .OptionalField("ca_certificate_file",
+                             &TlsConfig::ca_certificate_file_)
+              .OptionalField("refresh_interval", &TlsConfig::refresh_interval_)
+              .Finish();
+      return loader;
+    }
+
+    void JsonPostLoad(const Json& json, const JsonArgs& /*args*/,
+                      ValidationErrors* errors) {
+      if ((json.object().find("certificate_file") == json.object().end()) !=
+          (json.object().find("private_key_file") == json.object().end())) {
+        errors->AddError(
+            "fields \"certificate_file\" and \"private_key_file\" must be "
+            "both set or both unset");
+      }
+    }
+
+   private:
+    static constexpr Duration kDefaultRefreshInterval = Duration::Minutes(10);
+
+    std::string certificate_file_;
+    std::string private_key_file_;
+    std::string ca_certificate_file_;
+    Duration refresh_interval_ = kDefaultRefreshInterval;
+  };
+
+  static absl::string_view Type() { return "tls"; }
 };
 
+constexpr Duration TlsChannelCredsFactory::TlsConfig::kDefaultRefreshInterval;
+
 class InsecureChannelCredsFactory : public ChannelCredsFactory<> {
  public:
-  absl::string_view creds_type() const override { return "insecure"; }
-  bool IsValidConfig(const Json& /*config*/) const override { return true; }
+  absl::string_view type() const override { return Type(); }
+  RefCountedPtr<ChannelCredsConfig> ParseConfig(
+      const Json& /*config*/, const JsonArgs& /*args*/,
+      ValidationErrors* /*errors*/) const override {
+    return MakeRefCounted<Config>();
+  }
   RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
-      const Json& /*config*/) const override {
+      RefCountedPtr<ChannelCredsConfig> /*config*/) const override {
     return RefCountedPtr<grpc_channel_credentials>(
         grpc_insecure_credentials_create());
   }
+
+ private:
+  class Config : public ChannelCredsConfig {
+   public:
+    absl::string_view type() const override { return Type(); }
+    bool Equals(const ChannelCredsConfig&) const override { return true; }
+    Json ToJson() const override { return Json::FromObject({}); }
+  };
+
+  static absl::string_view Type() { return "insecure"; }
 };
 
 class FakeChannelCredsFactory : public ChannelCredsFactory<> {
  public:
-  absl::string_view creds_type() const override { return "fake"; }
-  bool IsValidConfig(const Json& /*config*/) const override { return true; }
+  absl::string_view type() const override { return Type(); }
+  RefCountedPtr<ChannelCredsConfig> ParseConfig(
+      const Json& /*config*/, const JsonArgs& /*args*/,
+      ValidationErrors* /*errors*/) const override {
+    return MakeRefCounted<Config>();
+  }
   RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
-      const Json& /*config*/) const override {
+      RefCountedPtr<ChannelCredsConfig> /*config*/) const override {
     return RefCountedPtr<grpc_channel_credentials>(
         grpc_fake_transport_security_credentials_create());
   }
+
+ private:
+  class Config : public ChannelCredsConfig {
+   public:
+    absl::string_view type() const override { return Type(); }
+    bool Equals(const ChannelCredsConfig&) const override { return true; }
+    Json ToJson() const override { return Json::FromObject({}); }
+  };
+
+  static absl::string_view Type() { return "fake"; }
 };
 
 void RegisterChannelDefaultCreds(CoreConfiguration::Builder* builder) {
   builder->channel_creds_registry()->RegisterChannelCredsFactory(
       std::make_unique<GoogleDefaultChannelCredsFactory>());
+  builder->channel_creds_registry()->RegisterChannelCredsFactory(
+      std::make_unique<TlsChannelCredsFactory>());
   builder->channel_creds_registry()->RegisterChannelCredsFactory(
       std::make_unique<InsecureChannelCredsFactory>());
   builder->channel_creds_registry()->RegisterChannelCredsFactory(

data/src/core/lib/security/credentials/composite/composite_credentials.cc

@@ -39,7 +39,7 @@
 // grpc_composite_channel_credentials
 //
 
-grpc_core::UniqueTypeName grpc_composite_channel_credentials::type() const {
+grpc_core::UniqueTypeName grpc_composite_channel_credentials::Type() {
   static grpc_core::UniqueTypeName::Factory kFactory("Composite");
   return kFactory.Create();
 }

data/src/core/lib/security/credentials/composite/composite_credentials.h

@@ -68,7 +68,9 @@ class grpc_composite_channel_credentials : public grpc_channel_credentials {
     return inner_creds_->update_arguments(std::move(args));
   }
 
-  grpc_core::UniqueTypeName type() const override;
+  static grpc_core::UniqueTypeName Type();
+
+  grpc_core::UniqueTypeName type() const override { return Type(); }
 
   const grpc_channel_credentials* inner_creds() const {
     return inner_creds_.get();

data/src/core/lib/security/credentials/external/aws_request_signer.cc

@@ -42,15 +42,23 @@ namespace grpc_core {
 
 namespace {
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+const char kSha256[] = "SHA256";
+#endif
 const char kAlgorithm[] = "AWS4-HMAC-SHA256";
 const char kDateFormat[] = "%a, %d %b %E4Y %H:%M:%S %Z";
 const char kXAmzDateFormat[] = "%Y%m%dT%H%M%SZ";
 
 void SHA256(const std::string& str, unsigned char out[SHA256_DIGEST_LENGTH]) {
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   SHA256_CTX sha256;
   SHA256_Init(&sha256);
   SHA256_Update(&sha256, str.c_str(), str.size());
   SHA256_Final(out, &sha256);
+#else
+  EVP_Q_digest(nullptr, kSha256, nullptr, str.c_str(), str.size(), out,
+               nullptr);
+#endif
 }
 
 std::string SHA256Hex(const std::string& str) {

data/src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -29,6 +29,7 @@
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/match.h"
+#include "absl/strings/numbers.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
@@ -63,6 +64,9 @@
   "urn:ietf:params:oauth:token-type:access_token"
 #define GOOGLE_CLOUD_PLATFORM_DEFAULT_SCOPE \
   "https://www.googleapis.com/auth/cloud-platform"
+#define IMPERSONATED_CRED_DEFAULT_LIFETIME_IN_SECONDS 3600  // 1 hour
+#define IMPERSONATED_CRED_MIN_LIFETIME_IN_SECONDS 600       // 10 mins
+#define IMPERSONATED_CRED_MAX_LIFETIME_IN_SECONDS 43200     // 12 hours
 
 namespace grpc_core {
 
@@ -197,6 +201,36 @@ RefCountedPtr<ExternalAccountCredentials> ExternalAccountCredentials::Create(
       return nullptr;
     }
   }
+  it = json.object().find("service_account_impersonation");
+  options.service_account_impersonation.token_lifetime_seconds =
+      IMPERSONATED_CRED_DEFAULT_LIFETIME_IN_SECONDS;
+  if (it != json.object().end() && it->second.type() == Json::Type::kObject) {
+    auto service_acc_imp_json = it->second;
+    auto service_acc_imp_obj_it =
+        service_acc_imp_json.object().find("token_lifetime_seconds");
+    if (service_acc_imp_obj_it != service_acc_imp_json.object().end()) {
+      if (!absl::SimpleAtoi(
+              service_acc_imp_obj_it->second.string(),
+              &options.service_account_impersonation.token_lifetime_seconds)) {
+        *error = GRPC_ERROR_CREATE("token_lifetime_seconds must be a number");
+        return nullptr;
+      }
+      if (options.service_account_impersonation.token_lifetime_seconds >
+          IMPERSONATED_CRED_MAX_LIFETIME_IN_SECONDS) {
+        *error = GRPC_ERROR_CREATE(
+            absl::StrFormat("token_lifetime_seconds must be less than %ds",
+                            IMPERSONATED_CRED_MAX_LIFETIME_IN_SECONDS));
+        return nullptr;
+      }
+      if (options.service_account_impersonation.token_lifetime_seconds <
+          IMPERSONATED_CRED_MIN_LIFETIME_IN_SECONDS) {
+        *error = GRPC_ERROR_CREATE(
+            absl::StrFormat("token_lifetime_seconds must be more than %ds",
+                            IMPERSONATED_CRED_MIN_LIFETIME_IN_SECONDS));
+        return nullptr;
+      }
+    }
+  }
   RefCountedPtr<ExternalAccountCredentials> creds;
   if (options.credential_source.object().find("environment_id") !=
       options.credential_source.object().end()) {
@@ -430,8 +464,13 @@ void ExternalAccountCredentials::ImpersenateServiceAccount() {
   headers[1].key = gpr_strdup("Authorization");
   headers[1].value = gpr_strdup(str.c_str());
   request.hdrs = headers;
+  std::vector<std::string> body_members;
   std::string scope = absl::StrJoin(scopes_, " ");
-  std::string body = absl::StrFormat("scope=%s", scope);
+  body_members.push_back(absl::StrFormat("scope=%s", UrlEncode(scope).c_str()));
+  body_members.push_back(absl::StrFormat(
+      "lifetime=%ds",
+      options_.service_account_impersonation.token_lifetime_seconds));
+  std::string body = absl::StrJoin(body_members, "&");
   request.body = const_cast<char*>(body.c_str());
   request.body_length = body.size();
   grpc_http_response_destroy(&ctx_->response);

data/src/core/lib/security/credentials/external/external_account_credentials.h

@@ -19,6 +19,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <stdint.h>
+
 #include <functional>
 #include <string>
 #include <vector>
@@ -45,12 +47,16 @@ namespace grpc_core {
 class ExternalAccountCredentials
     : public grpc_oauth2_token_fetcher_credentials {
  public:
+  struct ServiceAccountImpersonation {
+    int32_t token_lifetime_seconds;
+  };
   // External account credentials json interface.
   struct Options {
     std::string type;
     std::string audience;
     std::string subject_token_type;
     std::string service_account_impersonation_url;
+    ServiceAccountImpersonation service_account_impersonation;
     std::string token_url;
     std::string token_info_url;
     Json credential_source;

data/src/core/lib/security/credentials/fake/fake_credentials.cc

@@ -36,44 +36,36 @@
 
 // -- Fake transport security credentials. --
 
-namespace {
-
-class grpc_fake_channel_credentials final : public grpc_channel_credentials {
- public:
-  grpc_core::RefCountedPtr<grpc_channel_security_connector>
-  create_security_connector(
-      grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
-      const char* target, grpc_core::ChannelArgs* args) override {
-    return grpc_fake_channel_security_connector_create(
-        this->Ref(), std::move(call_creds), target, *args);
-  }
-
-  grpc_core::UniqueTypeName type() const override {
-    static grpc_core::UniqueTypeName::Factory kFactory("Fake");
-    return kFactory.Create();
-  }
-
- private:
-  int cmp_impl(const grpc_channel_credentials* other) const override {
-    // TODO(yashykt): Check if we can do something better here
-    return grpc_core::QsortCompare(
-        static_cast<const grpc_channel_credentials*>(this), other);
-  }
-};
-
-class grpc_fake_server_credentials final : public grpc_server_credentials {
- public:
-  grpc_core::RefCountedPtr<grpc_server_security_connector>
-  create_security_connector(const grpc_core::ChannelArgs& /*args*/) override {
-    return grpc_fake_server_security_connector_create(this->Ref());
-  }
-
-  grpc_core::UniqueTypeName type() const override {
-    static grpc_core::UniqueTypeName::Factory kFactory("Fake");
-    return kFactory.Create();
-  }
-};
-}  // namespace
+grpc_core::RefCountedPtr<grpc_channel_security_connector>
+grpc_fake_channel_credentials::create_security_connector(
+    grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+    const char* target, grpc_core::ChannelArgs* args) {
+  return grpc_fake_channel_security_connector_create(
+      this->Ref(), std::move(call_creds), target, *args);
+}
+
+grpc_core::UniqueTypeName grpc_fake_channel_credentials::Type() {
+  static grpc_core::UniqueTypeName::Factory kFactory("Fake");
+  return kFactory.Create();
+}
+
+int grpc_fake_channel_credentials::cmp_impl(
+    const grpc_channel_credentials* other) const {
+  // TODO(yashykt): Check if we can do something better here
+  return grpc_core::QsortCompare(
+      static_cast<const grpc_channel_credentials*>(this), other);
+}
+
+grpc_core::RefCountedPtr<grpc_server_security_connector>
+grpc_fake_server_credentials::create_security_connector(
+    const grpc_core::ChannelArgs& /*args*/) {
+  return grpc_fake_server_security_connector_create(this->Ref());
+}
+
+grpc_core::UniqueTypeName grpc_fake_server_credentials::Type() {
+  static grpc_core::UniqueTypeName::Factory kFactory("Fake");
+  return kFactory.Create();
+}
 
 grpc_channel_credentials* grpc_fake_transport_security_credentials_create() {
   return new grpc_fake_channel_credentials();

data/src/core/lib/security/credentials/fake/fake_credentials.h

@@ -29,10 +29,13 @@
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/useful.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/unique_type_name.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/transport.h"
 
@@ -41,6 +44,31 @@
 
 // -- Fake transport security credentials. --
 
+class grpc_fake_channel_credentials final : public grpc_channel_credentials {
+ public:
+  grpc_core::RefCountedPtr<grpc_channel_security_connector>
+  create_security_connector(
+      grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+      const char* target, grpc_core::ChannelArgs* args) override;
+
+  static grpc_core::UniqueTypeName Type();
+
+  grpc_core::UniqueTypeName type() const override { return Type(); }
+
+ private:
+  int cmp_impl(const grpc_channel_credentials* other) const override;
+};
+
+class grpc_fake_server_credentials final : public grpc_server_credentials {
+ public:
+  grpc_core::RefCountedPtr<grpc_server_security_connector>
+  create_security_connector(const grpc_core::ChannelArgs& /*args*/) override;
+
+  static grpc_core::UniqueTypeName Type();
+
+  grpc_core::UniqueTypeName type() const override { return Type(); }
+};
+
 // Creates a fake transport security credentials object for testing.
 grpc_channel_credentials* grpc_fake_transport_security_credentials_create(void);
 

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -32,6 +32,7 @@
 
 #include <grpc/grpc_security.h>  // IWYU pragma: keep
 #include <grpc/grpc_security_constants.h>
+#include <grpc/impl/channel_arg_names.h>
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/json.h>