grpc 1.59.2 → 1.60.0.pre1

data/src/core/tsi/alts/frame_protector/alts_frame_protector.cc

@@ -24,12 +24,13 @@
 #include <stdlib.h>
 
 #include <algorithm>
+#include <memory>
+
+#include "absl/types/span.h"
 
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 
-#include "src/core/lib/gpr/useful.h"
-#include "src/core/lib/gprpp/crash.h"
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/tsi/alts/crypt/gsec.h"
 #include "src/core/tsi/alts/frame_protector/alts_crypter.h"
@@ -337,15 +338,18 @@ static grpc_status_code create_alts_crypters(const uint8_t* key,
   grpc_status_code status;
   gsec_aead_crypter* aead_crypter_seal = nullptr;
   gsec_aead_crypter* aead_crypter_unseal = nullptr;
-  status = gsec_aes_gcm_aead_crypter_create(key, key_size, kAesGcmNonceLength,
-                                            kAesGcmTagLength, is_rekey,
-                                            &aead_crypter_seal, error_details);
+  status = gsec_aes_gcm_aead_crypter_create(
+      std::make_unique<grpc_core::GsecKey>(absl::MakeConstSpan(key, key_size),
+                                           is_rekey),
+      kAesGcmNonceLength, kAesGcmTagLength, &aead_crypter_seal, error_details);
   if (status != GRPC_STATUS_OK) {
     return status;
   }
   status = gsec_aes_gcm_aead_crypter_create(
-      key, key_size, kAesGcmNonceLength, kAesGcmTagLength, is_rekey,
-      &aead_crypter_unseal, error_details);
+      std::make_unique<grpc_core::GsecKey>(absl::MakeConstSpan(key, key_size),
+                                           is_rekey),
+      kAesGcmNonceLength, kAesGcmTagLength, &aead_crypter_unseal,
+      error_details);
   if (status != GRPC_STATUS_OK) {
     return status;
   }

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc

@@ -33,17 +33,13 @@
 #include <grpc/support/sync.h>
 #include <grpc/support/thd_id.h>
 
-#include "src/core/lib/gprpp/crash.h"
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/sync.h"
-#include "src/core/lib/gprpp/thd.h"
 #include "src/core/lib/iomgr/closure.h"
-#include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/surface/channel.h"
 #include "src/core/tsi/alts/frame_protector/alts_frame_protector.h"
 #include "src/core/tsi/alts/handshaker/alts_handshaker_client.h"
 #include "src/core/tsi/alts/handshaker/alts_shared_resource.h"
-#include "src/core/tsi/alts/handshaker/alts_tsi_utils.h"
 #include "src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.h"
 
 // Main struct for ALTS TSI handshaker.
@@ -193,8 +189,10 @@ static tsi_result handshaker_result_create_zero_copy_grpc_protector(
           "protector equals %zu",
           *max_output_protected_frame_size);
   tsi_result ok = alts_zero_copy_grpc_protector_create(
-      reinterpret_cast<const uint8_t*>(result->key_data),
-      kAltsAes128GcmRekeyKeyLength, /*is_rekey=*/true, result->is_client,
+      grpc_core::GsecKeyFactory({reinterpret_cast<uint8_t*>(result->key_data),
+                                 kAltsAes128GcmRekeyKeyLength},
+                                /*is_rekey=*/true),
+      result->is_client,
       /*is_integrity_only=*/false, /*enable_extra_copy=*/false,
       max_output_protected_frame_size, protector);
   if (ok != TSI_OK) {

data/src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.cc

@@ -22,13 +22,12 @@
 
 #include <string.h>
 
+#include <memory>
+#include <utility>
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 
-#include "src/core/lib/gpr/useful.h"
-#include "src/core/lib/gprpp/crash.h"
-#include "src/core/lib/iomgr/exec_ctx.h"
-#include "src/core/lib/slice/slice_internal.h"
 #include "src/core/tsi/alts/crypt/gsec.h"
 #include "src/core/tsi/alts/zero_copy_frame_protector/alts_grpc_integrity_only_record_protocol.h"
 #include "src/core/tsi/alts/zero_copy_frame_protector/alts_grpc_privacy_integrity_record_protocol.h"
@@ -110,7 +109,7 @@ static bool read_frame_size(const grpc_slice_buffer* sb,
 /// for protect or unprotect.
 ///
 static tsi_result create_alts_grpc_record_protocol(
-    const uint8_t* key, size_t key_size, bool is_rekey, bool is_client,
+    std::unique_ptr<grpc_core::GsecKeyInterface> key, bool is_client,
     bool is_integrity_only, bool is_protect, bool enable_extra_copy,
     alts_grpc_record_protocol** record_protocol) {
   if (key == nullptr || record_protocol == nullptr) {
@@ -119,9 +118,10 @@ static tsi_result create_alts_grpc_record_protocol(
   grpc_status_code status;
   gsec_aead_crypter* crypter = nullptr;
   char* error_details = nullptr;
-  status = gsec_aes_gcm_aead_crypter_create(key, key_size, kAesGcmNonceLength,
-                                            kAesGcmTagLength, is_rekey,
-                                            &crypter, &error_details);
+  bool is_rekey = key->IsRekey();
+  status = gsec_aes_gcm_aead_crypter_create(std::move(key), kAesGcmNonceLength,
+                                            kAesGcmTagLength, &crypter,
+                                            &error_details);
   if (status != GRPC_STATUS_OK) {
     gpr_log(GPR_ERROR, "Failed to create AEAD crypter, %s", error_details);
     gpr_free(error_details);
@@ -259,11 +259,11 @@ static const tsi_zero_copy_grpc_protector_vtable
         alts_zero_copy_grpc_protector_max_frame_size};
 
 tsi_result alts_zero_copy_grpc_protector_create(
-    const uint8_t* key, size_t key_size, bool is_rekey, bool is_client,
+    const grpc_core::GsecKeyFactoryInterface& key_factory, bool is_client,
     bool is_integrity_only, bool enable_extra_copy,
     size_t* max_protected_frame_size,
     tsi_zero_copy_grpc_protector** protector) {
-  if (key == nullptr || protector == nullptr) {
+  if (protector == nullptr) {
     gpr_log(
         GPR_ERROR,
         "Invalid nullptr arguments to alts_zero_copy_grpc_protector create.");
@@ -275,11 +275,11 @@ tsi_result alts_zero_copy_grpc_protector_create(
           gpr_zalloc(sizeof(alts_zero_copy_grpc_protector)));
   // Creates alts_grpc_record_protocol objects.
   tsi_result status = create_alts_grpc_record_protocol(
-      key, key_size, is_rekey, is_client, is_integrity_only,
+      key_factory.Create(), is_client, is_integrity_only,
       /*is_protect=*/true, enable_extra_copy, &impl->record_protocol);
   if (status == TSI_OK) {
     status = create_alts_grpc_record_protocol(
-        key, key_size, is_rekey, is_client, is_integrity_only,
+        key_factory.Create(), is_client, is_integrity_only,
         /*is_protect=*/false, enable_extra_copy, &impl->unrecord_protocol);
     if (status == TSI_OK) {
       // Sets maximum frame size.

data/src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.h

@@ -23,33 +23,34 @@
 
 #include <stdbool.h>
 
-#include "src/core/tsi/transport_security_grpc.h"
+#include "src/core/tsi/alts/crypt/gsec.h"
+#include "src/core/tsi/transport_security_interface.h"
 
-///
-/// This method creates an ALTS zero-copy grpc protector.
-///
-///- key: a symmetric key used to seal/unseal frames.
-///- key_size: the size of symmetric key.
-///- is_rekey: use rekeying AEAD crypter.
-///- is_client: a flag indicating if the protector will be used at client or
-///  server side.
-///- is_integrity_only: a flag indicating if the protector instance will be
-///  used for integrity-only or privacy-integrity mode.
-///- enable_extra_copy: a flag indicating if the protector instance does one
-///  extra memory copy during the protect operation for integrity_only mode.
-///  For the unprotect operation, it is still zero-copy. If application intends
-///  to modify the data buffer after the protect operation, we can turn on this
-///  mode to avoid integrity check failure.
-///- max_protected_frame_size: an in/out parameter indicating max frame size
-///  to be used by the protector. If it is nullptr, the default frame size will
-///  be used. Otherwise, the provided frame size will be adjusted (if not
-///  falling into a valid frame range) and used.
-///- protector: a pointer to the zero-copy protector returned from the method.
-///
-/// This method returns TSI_OK on success or a specific error code otherwise.
-///
+//
+// This method creates an ALTS zero-copy grpc protector.
+//
+//- key_factory: a key factory that creates keys to seal/unseal frames.
+//  it self-contains the information such as key length and whether rekey is
+//  supported.
+//- is_client: a flag indicating if the protector will be used at client or
+//  server side.
+//- is_integrity_only: a flag indicating if the protector instance will be
+//  used for integrity-only or privacy-integrity mode.
+//- enable_extra_copy: a flag indicating if the protector instance does one
+//  extra memory copy during the protect operation for integrity_only mode.
+//  For the unprotect operation, it is still zero-copy. If application intends
+//  to modify the data buffer after the protect operation, we can turn on this
+//  mode to avoid integrity check failure.
+//- max_protected_frame_size: an in/out parameter indicating max frame size
+//  to be used by the protector. If it is nullptr, the default frame size will
+//  be used. Otherwise, the provided frame size will be adjusted (if not
+//  falling into a valid frame range) and used.
+//- protector: a pointer to the zero-copy protector returned from the method.
+//
+// This method returns TSI_OK on success or a specific error code otherwise.
+//
 tsi_result alts_zero_copy_grpc_protector_create(
-    const uint8_t* key, size_t key_size, bool is_rekey, bool is_client,
+    const grpc_core::GsecKeyFactoryInterface& key_factory, bool is_client,
     bool is_integrity_only, bool enable_extra_copy,
     size_t* max_protected_frame_size, tsi_zero_copy_grpc_protector** protector);
 

data/src/core/tsi/ssl/session_cache/ssl_session_cache.cc

@@ -62,7 +62,11 @@ class SslSessionLRUCache::Node {
 };
 
 SslSessionLRUCache::SslSessionLRUCache(size_t capacity) : capacity_(capacity) {
-  GPR_ASSERT(capacity > 0);
+  if (capacity == 0) {
+    gpr_log(
+        GPR_ERROR,
+        "SslSessionLRUCache capacity is zero. SSL sessions cannot be resumed.");
+  }
 }
 
 SslSessionLRUCache::~SslSessionLRUCache() {
@@ -94,6 +98,10 @@ SslSessionLRUCache::Node* SslSessionLRUCache::FindLocked(
 }
 
 void SslSessionLRUCache::Put(const char* key, SslSessionPtr session) {
+  if (session == nullptr) {
+    gpr_log(GPR_ERROR, "Attempted to put null SSL session in session cache.");
+    return;
+  }
   grpc_core::MutexLock lock(&lock_);
   Node* node = FindLocked(key);
   if (node != nullptr) {

data/src/core/tsi/ssl_transport_security.cc

@@ -33,6 +33,7 @@
 #include <sys/socket.h>
 #endif
 
+#include <memory>
 #include <string>
 
 #include <openssl/bio.h>
@@ -48,6 +49,7 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/grpc_crl_provider.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -57,6 +59,7 @@
 
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/crash.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h"
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/ssl/session_cache/ssl_session_cache.h"
 #include "src/core/tsi/ssl_transport_security_utils.h"
@@ -144,6 +147,7 @@ struct tsi_ssl_frame_protector {
 
 static gpr_once g_init_openssl_once = GPR_ONCE_INIT;
 static int g_ssl_ctx_ex_factory_index = -1;
+static int g_ssl_ctx_ex_crl_provider_index = -1;
 static const unsigned char kSslSessionIdContext[] = {'g', 'r', 'p', 'c'};
 static int g_ssl_ex_verified_root_cert_index = -1;
 #if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_NO_ENGINE)
@@ -199,6 +203,10 @@ static void init_openssl(void) {
       SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
   GPR_ASSERT(g_ssl_ctx_ex_factory_index != -1);
 
+  g_ssl_ctx_ex_crl_provider_index =
+      SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
+  GPR_ASSERT(g_ssl_ctx_ex_crl_provider_index != -1);
+
   g_ssl_ex_verified_root_cert_index =
       SSL_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
   GPR_ASSERT(g_ssl_ex_verified_root_cert_index != -1);
@@ -876,9 +884,9 @@ static tsi_result build_alpn_protocol_name_list(
 static int verify_cb(int ok, X509_STORE_CTX* ctx) {
   int cert_error = X509_STORE_CTX_get_error(ctx);
   if (cert_error == X509_V_ERR_UNABLE_TO_GET_CRL) {
-    gpr_log(
-        GPR_INFO,
-        "Certificate verification failed to get CRL files. Ignoring error.");
+    gpr_log(GPR_INFO,
+            "Certificate verification failed to find relevant CRL file. "
+            "Ignoring error.");
     return 1;
   }
   if (cert_error != 0) {
@@ -940,8 +948,16 @@ static int RootCertExtractCallback(int preverify_ok, X509_STORE_CTX* ctx) {
     return preverify_ok;
   }
 
-  SSL* ssl = static_cast<SSL*>(
-      X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()));
+  ERR_clear_error();
+  int ssl_index = SSL_get_ex_data_X509_STORE_CTX_idx();
+  if (ssl_index < 0) {
+    char err_str[256];
+    ERR_error_string_n(ERR_get_error(), err_str, sizeof(err_str));
+    gpr_log(GPR_ERROR,
+            "error getting the SSL index from the X509_STORE_CTX: %s", err_str);
+    return preverify_ok;
+  }
+  SSL* ssl = static_cast<SSL*>(X509_STORE_CTX_get_ex_data(ctx, ssl_index));
   if (ssl == nullptr) {
     return preverify_ok;
   }
@@ -953,6 +969,69 @@ static int RootCertExtractCallback(int preverify_ok, X509_STORE_CTX* ctx) {
   return preverify_ok;
 }
 
+// X509_STORE_set_get_crl() sets the function to get the crl for a given
+// certificate x. When found, the crl must be assigned to *crl. This function
+// must return 0 on failure and 1 on success. If no function to get the issuer
+// is provided, the internal default function will be used instead.
+static int GetCrlFromProvider(X509_STORE_CTX* ctx, X509_CRL** crl_out,
+                              X509* cert) {
+  ERR_clear_error();
+  int ssl_index = SSL_get_ex_data_X509_STORE_CTX_idx();
+  if (ssl_index < 0) {
+    char err_str[256];
+    ERR_error_string_n(ERR_get_error(), err_str, sizeof(err_str));
+    gpr_log(GPR_ERROR,
+            "error getting the SSL index from the X509_STORE_CTX while looking "
+            "up Crl: %s",
+            err_str);
+    return 0;
+  }
+  SSL* ssl = static_cast<SSL*>(X509_STORE_CTX_get_ex_data(ctx, ssl_index));
+  if (ssl == nullptr) {
+    gpr_log(GPR_ERROR,
+            "error while fetching from CrlProvider. SSL object is null");
+    return 0;
+  }
+  SSL_CTX* ssl_ctx = SSL_get_SSL_CTX(ssl);
+  auto* provider = static_cast<grpc_core::experimental::CrlProvider*>(
+      SSL_CTX_get_ex_data(ssl_ctx, g_ssl_ctx_ex_crl_provider_index));
+
+  char* buf = X509_NAME_oneline(X509_get_issuer_name(cert), nullptr, 0);
+  if (buf == nullptr) {
+    gpr_log(GPR_ERROR, "Certificate has null issuer, cannot do CRL lookup");
+    return 0;
+  }
+  grpc_core::experimental::CertificateInfoImpl cert_impl(buf);
+  std::shared_ptr<grpc_core::experimental::Crl> internal_crl =
+      provider->GetCrl(cert_impl);
+  OPENSSL_free(buf);
+  // There wasn't a CRL found in the provider. Returning 0 will end up causing
+  // OpenSSL to return X509_V_ERR_UNABLE_TO_GET_CRL. We then catch that error
+  // and behave how we want for a missing CRL.
+  // It is important to treat missing CRLs and empty CRLs differently.
+  if (internal_crl == nullptr) {
+    return 0;
+  }
+  X509_CRL* crl =
+      std::static_pointer_cast<grpc_core::experimental::CrlImpl>(internal_crl)
+          ->crl();
+
+  X509_CRL* copy = X509_CRL_dup(crl);
+  *crl_out = copy;
+  return 1;
+}
+
+// When using CRL Providers, this function used to override the default
+// `check_crl` function in OpenSSL using `X509_STORE_set_check_crl`.
+// CrlProviders put the onus on the users to provide the CRLs that they want to
+// provide, and because we override default CRL fetching behavior, we can expect
+// some of these verification checks to fails for custom CRL providers as well.
+// Thus, we need a passthrough to indicate to OpenSSL that we've provided a CRL
+// and we are good with it.
+static int CheckCrlPassthrough(X509_STORE_CTX* /*ctx*/, X509_CRL* /*crl*/) {
+  return 1;
+}
+
 // Sets the min and max TLS version of |ssl_context| to |min_tls_version| and
 // |max_tls_version|, respectively. Calling this method is a no-op when using
 // OpenSSL versions < 1.1.
@@ -1673,7 +1752,10 @@ static tsi_result create_tsi_ssl_handshaker(SSL_CTX* ctx, int is_client,
   if (is_client) {
     int ssl_result;
     SSL_set_connect_state(ssl);
-    if (server_name_indication != nullptr) {
+    // Skip if the SNI looks like an IP address because IP addressed are not
+    // allowed as host names.
+    if (server_name_indication != nullptr &&
+        !looks_like_ip_address(server_name_indication)) {
       if (!SSL_set_tlsext_host_name(ssl, server_name_indication)) {
         gpr_log(GPR_ERROR, "Invalid server name indication %s.",
                 server_name_indication);
@@ -1982,7 +2064,8 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
 
   if (factory == nullptr) return TSI_INVALID_ARGUMENT;
   *factory = nullptr;
-  if (options->pem_root_certs == nullptr && options->root_store == nullptr) {
+  if (options->pem_root_certs == nullptr && options->root_store == nullptr &&
+      !options->skip_server_certificate_verification) {
     return TSI_INVALID_ARGUMENT;
   }
 
@@ -2044,7 +2127,9 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
       SSL_CTX_set_cert_store(ssl_context, options->root_store->store);
     }
 #endif
-    if (OPENSSL_VERSION_NUMBER < 0x10100000 || options->root_store == nullptr) {
+    if (OPENSSL_VERSION_NUMBER < 0x10100000 ||
+        (options->root_store == nullptr &&
+         options->pem_root_certs != nullptr)) {
       result = ssl_ctx_load_verification_certs(
           ssl_context, options->pem_root_certs, strlen(options->pem_root_certs),
           nullptr);
@@ -2088,10 +2173,18 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
   }
 
 #if OPENSSL_VERSION_NUMBER >= 0x10100000
-  if (options->crl_directory != nullptr &&
-      strcmp(options->crl_directory, "") != 0) {
-    gpr_log(GPR_INFO, "enabling client CRL checking with path: %s",
-            options->crl_directory);
+  if (options->crl_provider != nullptr) {
+    SSL_CTX_set_ex_data(impl->ssl_context, g_ssl_ctx_ex_crl_provider_index,
+                        options->crl_provider.get());
+    X509_STORE* cert_store = SSL_CTX_get_cert_store(impl->ssl_context);
+    X509_STORE_set_get_crl(cert_store, GetCrlFromProvider);
+    X509_STORE_set_check_crl(cert_store, CheckCrlPassthrough);
+    X509_STORE_set_verify_cb(cert_store, verify_cb);
+    X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
+    X509_VERIFY_PARAM_set_flags(
+        param, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
+  } else if (options->crl_directory != nullptr &&
+             strcmp(options->crl_directory, "") != 0) {
     X509_STORE* cert_store = SSL_CTX_get_cert_store(ssl_context);
     X509_STORE_set_verify_cb(cert_store, verify_cb);
     if (!X509_STORE_load_locations(cert_store, nullptr,
@@ -2101,7 +2194,6 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
       X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
       X509_VERIFY_PARAM_set_flags(
           param, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
-      gpr_log(GPR_INFO, "enabled client side CRL checking.");
     }
   }
 #endif
@@ -2276,10 +2368,19 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
       }
 
 #if OPENSSL_VERSION_NUMBER >= 0x10100000
-      if (options->crl_directory != nullptr &&
-          strcmp(options->crl_directory, "") != 0) {
-        gpr_log(GPR_INFO, "enabling server CRL checking with path %s",
-                options->crl_directory);
+      if (options->crl_provider != nullptr) {
+        SSL_CTX_set_ex_data(impl->ssl_contexts[i],
+                            g_ssl_ctx_ex_crl_provider_index,
+                            options->crl_provider.get());
+        X509_STORE* cert_store = SSL_CTX_get_cert_store(impl->ssl_contexts[i]);
+        X509_STORE_set_get_crl(cert_store, GetCrlFromProvider);
+        X509_STORE_set_check_crl(cert_store, CheckCrlPassthrough);
+        X509_STORE_set_verify_cb(cert_store, verify_cb);
+        X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
+        X509_VERIFY_PARAM_set_flags(
+            param, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
+      } else if (options->crl_directory != nullptr &&
+                 strcmp(options->crl_directory, "") != 0) {
         X509_STORE* cert_store = SSL_CTX_get_cert_store(impl->ssl_contexts[i]);
         X509_STORE_set_verify_cb(cert_store, verify_cb);
         if (!X509_STORE_load_locations(cert_store, nullptr,
@@ -2289,7 +2390,6 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
           X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
           X509_VERIFY_PARAM_set_flags(
               param, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
-          gpr_log(GPR_INFO, "enabled server CRL checking.");
         }
       }
 #endif

data/src/core/tsi/ssl_transport_security.h

@@ -21,10 +21,13 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <memory>
+
 #include <openssl/x509.h>
 
 #include "absl/strings/string_view.h"
 
+#include <grpc/grpc_crl_provider.h>
 #include <grpc/grpc_security_constants.h>
 
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
@@ -179,9 +182,17 @@ struct tsi_ssl_client_handshaker_options {
   // The directory where all hashed CRL files enforced by the handshaker are
   // located. If the directory is invalid, CRL checking will fail open and just
   // log. An empty directory will not enable crl checking. Only OpenSSL version
-  // > 1.1 is supported for CRL checking
+  // >= 1.1 is supported for CRL checking. Cannot be used in conjunction with
+  // `crl_provider`.
   const char* crl_directory;
 
+  // A provider of CRLs. If set, when doing handshakes the `CrlProvider`'s
+  // `GetCrl` function will be called to find CRLs when checking certificates
+  // for revocation. Cannot be used in conjunction with `crl_directory`.
+  // This provider is created and owned by the user and passed in through
+  // options as a shared_ptr.
+  std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider;
+
   tsi_ssl_client_handshaker_options()
       : pem_key_cert_pair(nullptr),
         pem_root_certs(nullptr),
@@ -329,6 +340,13 @@ struct tsi_ssl_server_handshaker_options {
   // crl checking. Only OpenSSL version > 1.1 is supported for CRL checking
   const char* crl_directory;
 
+  // A provider of CRLs. If set, when doing handshakes the `CrlProvider`'s
+  // `GetCrl` function will be called to find CRLs when checking certificates
+  // for revocation. Cannot be used in conjunction with `crl_directory`.
+  // This provider is created and owned by the user and passed in through
+  // options as a shared_ptr.
+  std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider;
+
   // If true, the SSL server sends a list of CA names to the client in the
   // ServerHello. This list of CA names is extracted from the server's trust
   // bundle, and the client may use this lint as a hint to decide which

data/src/ruby/bin/math_pb.rb

@@ -11,7 +11,7 @@ pool = Google::Protobuf::DescriptorPool.generated_pool
 
 begin
   pool.add_serialized_file(descriptor_data)
-rescue TypeError => e
+rescue TypeError
   # Compatibility code: will be removed in the next major version.
   require 'google/protobuf/descriptor_pb'
   parsed = Google::Protobuf::FileDescriptorProto.decode(descriptor_data)

data/src/ruby/ext/grpc/extconf.rb

@@ -14,6 +14,7 @@
 
 require 'etc'
 require 'mkmf'
+require_relative '../../lib/grpc/version.rb'
 
 windows = RUBY_PLATFORM =~ /mingw|mswin/
 windows_ucrt = RUBY_PLATFORM =~ /(mingw|mswin).*ucrt/
@@ -30,6 +31,27 @@ grpc_config = ENV['GRPC_CONFIG'] || 'opt'
 
 ENV['MACOSX_DEPLOYMENT_TARGET'] = '10.10'
 
+def debug_symbols_output_dir
+  d = ENV['GRPC_RUBY_DEBUG_SYMBOLS_OUTPUT_DIR']
+  return nil if d.nil? or d.size == 0
+  d
+end
+
+def maybe_remove_strip_all_linker_flag(flags)
+  if debug_symbols_output_dir
+    # Hack to prevent automatic stripping during shared library linking.
+    # rake-compiler-dock sets the -s LDFLAG when building rubies for
+    # cross compilation, and this -s flag propagates into RbConfig. Stripping
+    # during the link is problematic because it prevents us from saving
+    # debug symbols. We want to first link our shared library, then save
+    # debug symbols, and only after that strip.
+    flags = flags.split(' ')
+    flags = flags.reject {|flag| flag == '-s'}
+    flags = flags.join(' ')
+  end
+  flags
+end
+
 def env_unset?(name)
   ENV[name].nil? || ENV[name].size == 0
 end
@@ -38,21 +60,27 @@ def inherit_env_or_rbconfig(name)
   ENV[name] = inherit_rbconfig(name) if env_unset?(name)
 end
 
-def inherit_rbconfig(name)
-  ENV[name] = RbConfig::CONFIG[name] || ''
+def inherit_rbconfig(name, linker_flag: false)
+  value = RbConfig::CONFIG[name] || ''
+  if linker_flag
+    value = maybe_remove_strip_all_linker_flag(value)
+  end
+  p "extconf.rb setting ENV[#{name}] = #{value}"
+  ENV[name] = value
 end
 
 def env_append(name, string)
   ENV[name] += ' ' + string
 end
 
+# build grpc C-core
 inherit_env_or_rbconfig 'AR'
 inherit_env_or_rbconfig 'CC'
 inherit_env_or_rbconfig 'CXX'
 inherit_env_or_rbconfig 'RANLIB'
 inherit_env_or_rbconfig 'STRIP'
 inherit_rbconfig 'CPPFLAGS'
-inherit_rbconfig 'LDFLAGS'
+inherit_rbconfig('LDFLAGS', linker_flag: true)
 
 ENV['LD'] = ENV['CC'] if env_unset?('LD')
 ENV['LDXX'] = ENV['CXX'] if env_unset?('LDXX')
@@ -111,21 +139,15 @@ unless windows
   puts "Building grpc native library: #{cmd}"
   system(cmd)
   exit 1 unless $? == 0
-
-  if grpc_config == 'opt'
-    rm_obj_cmd = "rm -rf #{File.join(output_dir, 'objs')}"
-    puts "Removing grpc object files: #{rm_obj_cmd}"
-    system(rm_obj_cmd)
-    exit 1 unless $? == 0
-    strip_cmd = "#{strip_tool} #{grpc_lib_dir}/*.a"
-    puts "Stripping grpc native library: #{strip_cmd}"
-    system(strip_cmd)
-    exit 1 unless $? == 0
-  end
 end
 
+# C-core built, generate Makefile for ruby extension
+$LDFLAGS = maybe_remove_strip_all_linker_flag($LDFLAGS)
+$DLDFLAGS = maybe_remove_strip_all_linker_flag($DLDFLAGS)
+
 $CFLAGS << ' -DGRPC_RUBY_WINDOWS_UCRT' if windows_ucrt
 $CFLAGS << ' -I' + File.join(grpc_root, 'include')
+$CFLAGS << ' -g'
 
 def have_ruby_abi_version()
   return true if RUBY_ENGINE == 'truffleruby'
@@ -168,7 +190,7 @@ if grpc_config == 'gcov'
 end
 
 if grpc_config == 'dbg'
-  $CFLAGS << ' -O0 -ggdb3'
+  $CFLAGS << ' -O0'
 end
 
 $LDFLAGS << ' -Wl,-wrap,memcpy' if linux
@@ -184,9 +206,49 @@ $CFLAGS << ' -Wextra '
 $CFLAGS << ' -pedantic '
 
 output = File.join('grpc', 'grpc_c')
+puts "extconf.rb $LDFLAGS: #{$LDFLAGS}"
+puts "extconf.rb $DLDFLAGS: #{$DLDFLAGS}"
+puts "extconf.rb $CFLAGS: #{$CFLAGS}"
 puts 'Generating Makefile for ' + output
 create_makefile(output)
 
+ruby_major_minor = /(\d+\.\d+)/.match(RUBY_VERSION).to_s
+debug_symbols = "grpc-#{GRPC::VERSION}-#{RUBY_PLATFORM}-ruby-#{ruby_major_minor}.dbg"
+
+File.open('Makefile.new', 'w') do |o|
+  o.puts 'hijack_remove_unused_artifacts: all remove_unused_artifacts'
+  o.puts
+  o.write(File.read('Makefile'))
+  o.puts
+  o.puts 'remove_unused_artifacts: $(DLLIB)'
+  # Now that the extension library has been linked, we can remove unused artifacts
+  # that take up a lot of disk space.
+  rm_obj_cmd = "rm -rf #{File.join(output_dir, 'objs')}"
+  o.puts "\t$(ECHO) Removing unused object artifacts: #{rm_obj_cmd}"
+  o.puts "\t$(Q) #{rm_obj_cmd}"
+  rm_grpc_core_libs = "rm -f #{grpc_lib_dir}/*.a"
+  o.puts "\t$(ECHO) Removing unused grpc core libraries: #{rm_grpc_core_libs}"
+  o.puts "\t$(Q) #{rm_grpc_core_libs}"
+end
+File.rename('Makefile.new', 'Makefile')
+
+if grpc_config == 'opt'
+  File.open('Makefile.new', 'w') do |o|
+    o.puts 'hijack: all strip'
+    o.puts
+    o.write(File.read('Makefile'))
+    o.puts
+    o.puts 'strip: $(DLLIB)'
+    if debug_symbols_output_dir
+      o.puts "\t$(ECHO) Saving debug symbols in #{debug_symbols_output_dir}/#{debug_symbols}"
+      o.puts "\t$(Q) objcopy --only-keep-debug $(DLLIB) #{debug_symbols_output_dir}/#{debug_symbols}"
+    end
+    o.puts "\t$(ECHO) Stripping $(DLLIB)"
+    o.puts "\t$(Q) #{strip_tool} $(DLLIB)"
+  end
+  File.rename('Makefile.new', 'Makefile')
+end
+
 if ENV['GRPC_RUBY_TEST_ONLY_WORKAROUND_MAKE_INSTALL_BUG']
   # Note: this env var setting is intended to work around a problem observed
   # with the ginstall command on grpc's macos automated test infrastructure,