grpc 1.59.2 → 1.60.0.pre1

data/src/core/lib/security/credentials/composite/composite_credentials.h

@@ -55,7 +55,7 @@ class grpc_composite_channel_credentials : public grpc_channel_credentials {
 
   grpc_core::RefCountedPtr<grpc_channel_credentials>
   duplicate_without_call_credentials() override {
-    return inner_creds_;
+    return inner_creds_->duplicate_without_call_credentials();
   }
 
   grpc_core::RefCountedPtr<grpc_channel_security_connector>

data/src/core/lib/security/credentials/external/aws_external_account_credentials.cc

@@ -19,7 +19,6 @@
 
 #include <string.h>
 
-#include <initializer_list>
 #include <map>
 #include <utility>
 

data/src/core/lib/security/credentials/external/aws_request_signer.cc

@@ -17,8 +17,6 @@
 
 #include "src/core/lib/security/credentials/external/aws_request_signer.h"
 
-#include <algorithm>
-#include <initializer_list>
 #include <utility>
 #include <vector>
 

data/src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -20,8 +20,6 @@
 #include <stdint.h>
 #include <string.h>
 
-#include <algorithm>
-#include <initializer_list>
 #include <map>
 #include <memory>
 #include <utility>

data/src/core/lib/security/credentials/external/url_external_account_credentials.cc

@@ -19,7 +19,6 @@
 
 #include <string.h>
 
-#include <initializer_list>
 #include <memory>
 #include <utility>
 
@@ -174,8 +173,7 @@ void UrlExternalAccountCredentials::RetrieveSubjectToken(
     http_request_creds = RefCountedPtr<grpc_channel_credentials>(
         grpc_insecure_credentials_create());
   } else {
-    http_request_creds = RefCountedPtr<grpc_channel_credentials>(
-        CreateHttpRequestSSLCredentials());
+    http_request_creds = CreateHttpRequestSSLCredentials();
   }
   http_request_ =
       HttpRequest::Get(std::move(*url_for_request), nullptr /* channel args */,

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -35,7 +35,6 @@
 #include <grpc/impl/channel_arg_names.h>
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
-#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 #include <grpc/support/sync.h>
 

data/src/core/lib/security/credentials/iam/iam_credentials.cc

@@ -22,7 +22,6 @@
 
 #include <stdlib.h>
 
-#include <initializer_list>
 #include <memory>
 #include <utility>
 

data/src/core/lib/security/credentials/insecure/insecure_credentials.cc

@@ -22,8 +22,6 @@
 
 #include <utility>
 
-#include "absl/strings/string_view.h"
-
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h"
 

data/src/core/lib/security/credentials/jwt/jwt_credentials.h

@@ -23,7 +23,6 @@
 
 #include <stdint.h>
 
-#include <initializer_list>
 #include <string>
 
 #include "absl/status/statusor.h"

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -45,7 +45,6 @@
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 
-#include <grpc/grpc.h>
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/json.h>
@@ -66,7 +65,7 @@
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/iomgr/polling_entity.h"
 #include "src/core/lib/json/json_reader.h"
-#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/credentials.h"  // IWYU pragma: keep
 #include "src/core/lib/slice/b64.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"

data/src/core/lib/security/credentials/local/local_credentials.cc

@@ -22,8 +22,6 @@
 
 #include <utility>
 
-#include "absl/strings/string_view.h"
-
 #include <grpc/grpc.h>
 
 #include "src/core/lib/security/security_connector/local/local_security_connector.h"

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.h

@@ -22,7 +22,6 @@
 #include <grpc/support/port_platform.h>
 
 #include <atomic>
-#include <initializer_list>
 #include <string>
 #include <utility>
 

data/src/core/lib/security/credentials/plugin/plugin_credentials.cc

@@ -27,7 +27,6 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 
-#include <grpc/slice.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 

data/src/core/lib/security/credentials/ssl/ssl_credentials.cc

@@ -25,7 +25,6 @@
 #include <string>
 #include <utility>
 
-#include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
 #include <grpc/impl/channel_arg_names.h>

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.cc

@@ -18,8 +18,6 @@
 
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
 
-#include <algorithm>
-
 #include "absl/status/status.h"
 
 #include <grpc/grpc_security.h>

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc

@@ -20,6 +20,9 @@
 
 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 
+#include <memory>
+
+#include <grpc/grpc_crl_provider.h>
 #include <grpc/support/log.h>
 
 #include "src/core/lib/debug/trace.h"
@@ -35,6 +38,17 @@ grpc_tls_credentials_options* grpc_tls_credentials_options_create() {
   return new grpc_tls_credentials_options();
 }
 
+grpc_tls_credentials_options* grpc_tls_credentials_options_copy(
+    grpc_tls_credentials_options* options) {
+  GPR_ASSERT(options != nullptr);
+  return new grpc_tls_credentials_options(*options);
+}
+
+void grpc_tls_credentials_options_destroy(
+    grpc_tls_credentials_options* options) {
+  delete options;
+}
+
 void grpc_tls_credentials_options_set_cert_request_type(
     grpc_tls_credentials_options* options,
     grpc_ssl_client_certificate_request_type type) {
@@ -128,3 +142,10 @@ void grpc_tls_credentials_options_set_send_client_ca_list(
   }
   options->set_send_client_ca_list(send_client_ca_list);
 }
+
+void grpc_tls_credentials_options_set_crl_provider(
+    grpc_tls_credentials_options* options,
+    std::shared_ptr<grpc_core::experimental::CrlProvider> provider) {
+  GPR_ASSERT(options != nullptr);
+  options->set_crl_provider(provider);
+}

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -39,6 +39,7 @@
 struct grpc_tls_credentials_options
     : public grpc_core::RefCounted<grpc_tls_credentials_options> {
  public:
+  grpc_tls_credentials_options() = default;
   ~grpc_tls_credentials_options() override = default;
 
   // Getters for member fields.
@@ -61,6 +62,8 @@ struct grpc_tls_credentials_options
   const std::string& identity_cert_name() const { return identity_cert_name_; }
   const std::string& tls_session_key_log_file_path() const { return tls_session_key_log_file_path_; }
   const std::string& crl_directory() const { return crl_directory_; }
+  // Returns the CRL Provider
+  std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider() const { return crl_provider_; }
   bool send_client_ca_list() const { return send_client_ca_list_; }
 
   // Setters for member fields.
@@ -82,6 +85,7 @@ struct grpc_tls_credentials_options
   void set_tls_session_key_log_file_path(std::string tls_session_key_log_file_path) { tls_session_key_log_file_path_ = std::move(tls_session_key_log_file_path); }
   //  gRPC will enforce CRLs on all handshakes from all hashed CRL files inside of the crl_directory. If not set, an empty string will be used, which will not enable CRL checking. Only supported for OpenSSL version > 1.1.
   void set_crl_directory(std::string crl_directory) { crl_directory_ = std::move(crl_directory); }
+  void set_crl_provider(std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider) { crl_provider_ = std::move(crl_provider); }
   void set_send_client_ca_list(bool send_client_ca_list) { send_client_ca_list_ = send_client_ca_list; }
 
   bool operator==(const grpc_tls_credentials_options& other) const {
@@ -98,9 +102,27 @@ struct grpc_tls_credentials_options
       identity_cert_name_ == other.identity_cert_name_ &&
       tls_session_key_log_file_path_ == other.tls_session_key_log_file_path_ &&
       crl_directory_ == other.crl_directory_ &&
+      (crl_provider_ == other.crl_provider_) &&
       send_client_ca_list_ == other.send_client_ca_list_;
   }
 
+  grpc_tls_credentials_options(grpc_tls_credentials_options& other) :
+      cert_request_type_(other.cert_request_type_),
+      verify_server_cert_(other.verify_server_cert_),
+      min_tls_version_(other.min_tls_version_),
+      max_tls_version_(other.max_tls_version_),
+      certificate_verifier_(other.certificate_verifier_),
+      check_call_host_(other.check_call_host_),
+      certificate_provider_(other.certificate_provider_),
+      watch_root_cert_(other.watch_root_cert_),
+      root_cert_name_(other.root_cert_name_),
+      watch_identity_pair_(other.watch_identity_pair_),
+      identity_cert_name_(other.identity_cert_name_),
+      tls_session_key_log_file_path_(other.tls_session_key_log_file_path_),
+      crl_directory_(other.crl_directory_),
+      crl_provider_(other.crl_provider_),
+      send_client_ca_list_(other.send_client_ca_list_)  {}
+
  private:
   grpc_ssl_client_certificate_request_type cert_request_type_ = GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE;
   bool verify_server_cert_ = true;
@@ -115,6 +137,7 @@ struct grpc_tls_credentials_options
   std::string identity_cert_name_;
   std::string tls_session_key_log_file_path_;
   std::string crl_directory_;
+  std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider_;
   bool send_client_ca_list_ = false;
 };
 

data/src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc

@@ -0,0 +1,238 @@
+//
+//
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h"
+
+#include <limits.h>
+
+// IWYU pragma: no_include <ratio>
+#include <memory>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+// IWYU pragma: no_include <openssl/mem.h>
+#include <openssl/bio.h>
+#include <openssl/crypto.h>  // IWYU pragma: keep
+#include <openssl/pem.h>
+#include <openssl/x509.h>
+
+#include "absl/container/flat_hash_map.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_join.h"
+#include "absl/types/span.h"
+
+#include <grpc/support/log.h>
+
+#include "src/core/lib/event_engine/default_event_engine.h"
+#include "src/core/lib/gprpp/directory_reader.h"
+#include "src/core/lib/gprpp/load_file.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
+#include "src/core/lib/slice/slice.h"
+
+namespace grpc_core {
+namespace experimental {
+
+namespace {
+std::string IssuerFromCrl(X509_CRL* crl) {
+  if (crl == nullptr) {
+    return "";
+  }
+  char* buf = X509_NAME_oneline(X509_CRL_get_issuer(crl), nullptr, 0);
+  std::string ret;
+  if (buf != nullptr) {
+    ret = buf;
+  }
+  OPENSSL_free(buf);
+  return ret;
+}
+
+absl::StatusOr<std::shared_ptr<Crl>> ReadCrlFromFile(
+    const std::string& crl_path) {
+  absl::StatusOr<Slice> crl_slice = LoadFile(crl_path, false);
+  if (!crl_slice.ok()) {
+    return crl_slice.status();
+  }
+  absl::StatusOr<std::unique_ptr<Crl>> crl =
+      Crl::Parse(crl_slice->as_string_view());
+  if (!crl.ok()) {
+    return crl.status();
+  }
+  return crl;
+}
+
+}  // namespace
+
+absl::StatusOr<std::unique_ptr<Crl>> Crl::Parse(absl::string_view crl_string) {
+  if (crl_string.size() >= INT_MAX) {
+    return absl::InvalidArgumentError("crl_string cannot be of size INT_MAX");
+  }
+  BIO* crl_bio =
+      BIO_new_mem_buf(crl_string.data(), static_cast<int>(crl_string.size()));
+  // Errors on BIO
+  if (crl_bio == nullptr) {
+    return absl::InvalidArgumentError(
+        "Conversion from crl string to BIO failed.");
+  }
+  X509_CRL* crl = PEM_read_bio_X509_CRL(crl_bio, nullptr, nullptr, nullptr);
+  BIO_free(crl_bio);
+  if (crl == nullptr) {
+    return absl::InvalidArgumentError(
+        "Conversion from PEM string to X509 CRL failed.");
+  }
+  return CrlImpl::Create(crl);
+}
+
+absl::StatusOr<std::unique_ptr<CrlImpl>> CrlImpl::Create(X509_CRL* crl) {
+  std::string issuer = IssuerFromCrl(crl);
+  if (issuer.empty()) {
+    return absl::InvalidArgumentError("Issuer of crl cannot be empty");
+  }
+  return std::make_unique<CrlImpl>(crl, issuer);
+}
+
+CrlImpl::~CrlImpl() { X509_CRL_free(crl_); }
+
+absl::StatusOr<std::shared_ptr<CrlProvider>> CreateStaticCrlProvider(
+    absl::Span<const std::string> crls) {
+  absl::flat_hash_map<std::string, std::shared_ptr<Crl>> crl_map;
+  for (const auto& raw_crl : crls) {
+    absl::StatusOr<std::unique_ptr<Crl>> crl = Crl::Parse(raw_crl);
+    if (!crl.ok()) {
+      return absl::InvalidArgumentError(absl::StrCat(
+          "Parsing crl string failed with result ", crl.status().ToString()));
+    }
+    bool inserted = crl_map.emplace((*crl)->Issuer(), std::move(*crl)).second;
+    if (!inserted) {
+      gpr_log(GPR_ERROR,
+              "StaticCrlProvider received multiple CRLs with the same issuer. "
+              "The first one in the span will be used.");
+    }
+  }
+  StaticCrlProvider provider = StaticCrlProvider(std::move(crl_map));
+  return std::make_shared<StaticCrlProvider>(std::move(provider));
+}
+
+std::shared_ptr<Crl> StaticCrlProvider::GetCrl(
+    const CertificateInfo& certificate_info) {
+  auto it = crls_.find(certificate_info.Issuer());
+  if (it == crls_.end()) {
+    return nullptr;
+  }
+  return it->second;
+}
+
+absl::StatusOr<std::shared_ptr<CrlProvider>> CreateDirectoryReloaderCrlProvider(
+    absl::string_view directory, std::chrono::seconds refresh_duration,
+    std::function<void(absl::Status)> reload_error_callback) {
+  if (refresh_duration < std::chrono::seconds(60)) {
+    return absl::InvalidArgumentError("Refresh duration minimum is 60 seconds");
+  }
+  auto provider = std::make_shared<DirectoryReloaderCrlProvider>(
+      refresh_duration, reload_error_callback,
+      grpc_event_engine::experimental::GetDefaultEventEngine(),
+      MakeDirectoryReader(directory));
+  // This could be slow to do at startup, but we want to
+  // make sure it's done before the provider is used.
+  provider->UpdateAndStartTimer();
+  return provider;
+}
+
+DirectoryReloaderCrlProvider::~DirectoryReloaderCrlProvider() {
+  if (refresh_handle_.has_value()) {
+    event_engine_->Cancel(refresh_handle_.value());
+  }
+}
+
+void DirectoryReloaderCrlProvider::UpdateAndStartTimer() {
+  absl::Status status = Update();
+  if (!status.ok() && reload_error_callback_ != nullptr) {
+    reload_error_callback_(status);
+  }
+  std::weak_ptr<DirectoryReloaderCrlProvider> self = shared_from_this();
+  refresh_handle_ =
+      event_engine_->RunAfter(refresh_duration_, [self = std::move(self)]() {
+        ApplicationCallbackExecCtx callback_exec_ctx;
+        ExecCtx exec_ctx;
+        if (std::shared_ptr<DirectoryReloaderCrlProvider> valid_ptr =
+                self.lock()) {
+          valid_ptr->UpdateAndStartTimer();
+        }
+      });
+}
+
+absl::Status DirectoryReloaderCrlProvider::Update() {
+  absl::flat_hash_map<std::string, std::shared_ptr<Crl>> new_crls;
+  std::vector<std::string> files_with_errors;
+  absl::Status status = crl_directory_->ForEach([&](absl::string_view file) {
+    std::string file_path = absl::StrCat(crl_directory_->Name(), "/", file);
+    // Build a map of new_crls to update to. If all files successful, do a
+    // full swap of the map. Otherwise update in place.
+    absl::StatusOr<std::shared_ptr<Crl>> crl = ReadCrlFromFile(file_path);
+    if (!crl.ok()) {
+      files_with_errors.push_back(
+          absl::StrCat(file_path, ": ", crl.status().ToString()));
+      return;
+    }
+    // Now we have a good CRL to update in our map.
+    // It's not safe to say crl->Issuer() on the LHS and std::move(crl) on the
+    // RHS, because C++ does not guarantee which of those will be executed
+    // first.
+    std::string issuer((*crl)->Issuer());
+    new_crls[std::move(issuer)] = std::move(*crl);
+  });
+  if (!status.ok()) {
+    return status;
+  }
+  MutexLock lock(&mu_);
+  if (!files_with_errors.empty()) {
+    // Need to make sure CRLs we read successfully into new_crls are still
+    // in-place updated in crls_.
+    for (auto& kv : new_crls) {
+      std::shared_ptr<Crl>& crl = kv.second;
+      // It's not safe to say crl->Issuer() on the LHS and std::move(crl) on the
+      // RHS, because C++ does not guarantee which of those will be executed
+      // first.
+      std::string issuer(crl->Issuer());
+      crls_[std::move(issuer)] = std::move(crl);
+    }
+    return absl::UnknownError(absl::StrCat(
+        "Errors reading the following files in the CRL directory: [",
+        absl::StrJoin(files_with_errors, "; "), "]"));
+  } else {
+    crls_ = std::move(new_crls);
+  }
+  return absl::OkStatus();
+}
+
+std::shared_ptr<Crl> DirectoryReloaderCrlProvider::GetCrl(
+    const CertificateInfo& certificate_info) {
+  MutexLock lock(&mu_);
+  auto it = crls_.find(certificate_info.Issuer());
+  if (it == crls_.end()) {
+    return nullptr;
+  }
+  return it->second;
+}
+
+}  // namespace experimental
+}  // namespace grpc_core

data/src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h

@@ -0,0 +1,133 @@
+//
+//
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CRL_PROVIDER_H
+#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CRL_PROVIDER_H
+
+#include <grpc/support/port_platform.h>
+
+#include <chrono>
+#include <functional>
+#include <memory>
+#include <optional>
+#include <string>
+#include <utility>
+
+#include <openssl/crypto.h>
+
+#include "absl/base/thread_annotations.h"
+#include "absl/container/flat_hash_map.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
+
+#include <grpc/event_engine/event_engine.h>
+#include <grpc/grpc_crl_provider.h>
+
+#include "src/core/lib/gprpp/directory_reader.h"
+#include "src/core/lib/gprpp/sync.h"
+#include "src/core/lib/gprpp/time.h"
+
+namespace grpc_core {
+namespace experimental {
+
+class StaticCrlProvider : public CrlProvider {
+ public:
+  // Each element of the input vector is expected to be the raw contents of a
+  // CRL file.
+  explicit StaticCrlProvider(
+      absl::flat_hash_map<std::string, std::shared_ptr<Crl>> crls)
+      : crls_(std::move(crls)) {}
+  std::shared_ptr<Crl> GetCrl(const CertificateInfo& certificate_info) override;
+
+ private:
+  const absl::flat_hash_map<std::string, std::shared_ptr<Crl>> crls_;
+};
+
+class CrlImpl : public Crl {
+ public:
+  static absl::StatusOr<std::unique_ptr<CrlImpl>> Create(X509_CRL* crl);
+  // Takes ownership of the X509_CRL pointer.
+  CrlImpl(X509_CRL* crl, absl::string_view issuer)
+      : crl_(crl), issuer_(issuer) {}
+  ~CrlImpl() override;
+  // Returns a string view representation of the issuer pulled from the CRL.
+  absl::string_view Issuer() override { return issuer_; }
+  // The caller should not take ownership of the returned pointer.
+  X509_CRL* crl() const { return crl_; }
+
+ private:
+  X509_CRL* crl_;
+  const std::string issuer_;
+};
+
+class CertificateInfoImpl : public CertificateInfo {
+ public:
+  explicit CertificateInfoImpl(absl::string_view issuer) : issuer_(issuer) {}
+  // Returns a string representation of the issuer pulled from the
+  // certificate.
+  absl::string_view Issuer() const override { return issuer_; }
+
+ private:
+  const std::string issuer_;
+};
+
+// Defining this here lets us hide implementation details (and includes) from
+// the header in include
+class DirectoryReloaderCrlProvider
+    : public CrlProvider,
+      public std::enable_shared_from_this<DirectoryReloaderCrlProvider> {
+ public:
+  DirectoryReloaderCrlProvider(
+      std::chrono::seconds duration, std::function<void(absl::Status)> callback,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine,
+      std::shared_ptr<DirectoryReader> directory_impl)
+      : refresh_duration_(Duration::FromSecondsAsDouble(duration.count())),
+        reload_error_callback_(std::move(callback)),
+        event_engine_(std::move(event_engine)),
+        crl_directory_(std::move(directory_impl)) {}
+
+  ~DirectoryReloaderCrlProvider() override;
+  std::shared_ptr<Crl> GetCrl(const CertificateInfo& certificate_info) override;
+  // Reads the configured directory and updates the internal crls_ map, called
+  // asynchronously by event engine then schedules the timer for the next
+  // update.
+  void UpdateAndStartTimer();
+
+ private:
+  // Reads the configured directory and updates the internal crls_ map, called
+  // asynchronously by event engine.
+  absl::Status Update();
+  Duration refresh_duration_;
+  std::function<void(::absl::Status)> reload_error_callback_;
+  std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine_;
+  std::shared_ptr<DirectoryReader> crl_directory_;
+  // guards the crls_ map
+  Mutex mu_;
+  absl::flat_hash_map<::std::string, ::std::shared_ptr<Crl>> crls_
+      ABSL_GUARDED_BY(mu_);
+  absl::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
+      refresh_handle_;
+};
+
+}  // namespace experimental
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CRL_PROVIDER_H

data/src/core/lib/security/credentials/tls/tls_credentials.cc

@@ -20,10 +20,10 @@
 
 #include "src/core/lib/security/credentials/tls/tls_credentials.h"
 
+#include <memory>
 #include <string>
 #include <utility>
 
-#include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
 #include <grpc/grpc.h>
@@ -46,6 +46,14 @@ bool CredentialOptionSanityCheck(grpc_tls_credentials_options* options,
     gpr_log(GPR_ERROR, "TLS credentials options is nullptr.");
     return false;
   }
+  if (!options->crl_directory().empty() && options->crl_provider() != nullptr) {
+    gpr_log(GPR_ERROR,
+            "Setting crl_directory and crl_provider not supported. Using the "
+            "crl_provider.");
+    // TODO(gtcooke94) - Maybe return false here. Right now object lifetime of
+    // this options struct is leaky if false is returned and represents a more
+    // complex fix to handle in another PR.
+  }
   // In the following conditions, there won't be any issues, but it might
   // indicate callers are doing something wrong with the API.
   if (is_client && options->cert_request_type() !=

data/src/core/lib/security/credentials/tls/tls_utils.cc

@@ -22,6 +22,8 @@
 
 #include <stddef.h>
 
+#include <algorithm>
+
 #include "absl/strings/ascii.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"

data/src/core/lib/security/credentials/xds/xds_credentials.cc

@@ -20,7 +20,6 @@
 
 #include "src/core/lib/security/credentials/xds/xds_credentials.h"
 
-#include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
 #include <grpc/grpc_security_constants.h>