grpc 1.62.0 → 1.63.0

data/src/core/lib/promise/context.h

@@ -36,7 +36,7 @@ struct ContextType;
 
 // Some contexts can be subclassed. If the subclass is set as that context
 // then GetContext<Base>() will return the base, and GetContext<Derived>() will
-// down_cast to the derived type.
+// DownCast to the derived type.
 // Specializations of this type should be created for each derived type, and
 // should have a single using statement Base pointing to the derived base class.
 // Example:
@@ -84,7 +84,7 @@ class Context<T, absl::void_t<typename ContextSubclass<T>::Base>>
  public:
   using Context<typename ContextSubclass<T>::Base>::Context;
   static T* get() {
-    return down_cast<T*>(Context<typename ContextSubclass<T>::Base>::get());
+    return DownCast<T*>(Context<typename ContextSubclass<T>::Base>::get());
   }
 };
 

data/src/core/lib/promise/party.cc

@@ -37,6 +37,11 @@ grpc_core::DebugOnlyTraceFlag grpc_trace_party_state(false, "party_state");
 
 namespace grpc_core {
 
+namespace {
+// TODO(ctiller): Once all activities are parties we can remove this.
+thread_local Party** g_current_party_run_next = nullptr;
+}  // namespace
+
 ///////////////////////////////////////////////////////////////////////////////
 // PartySyncUsingAtomics
 
@@ -177,7 +182,6 @@ Party::~Party() {}
 
 void Party::CancelRemainingParticipants() {
   ScopedActivity activity(this);
-  promise_detail::Context<Arena> arena_ctx(arena_);
   for (size_t i = 0; i < party_detail::kMaxParticipants; i++) {
     if (auto* p =
             participants_[i].exchange(nullptr, std::memory_order_acquire)) {
@@ -210,11 +214,38 @@ void Party::ForceImmediateRepoll(WakeupMask mask) {
 }
 
 void Party::RunLocked() {
+  // If there is a party running, then we don't run it immediately
+  // but instead add it to the end of the list of parties to run.
+  // This enables a fairly straightforward batching of work from a
+  // call to a transport (or back again).
+  if (g_current_party_run_next != nullptr) {
+    if (*g_current_party_run_next == nullptr) {
+      *g_current_party_run_next = this;
+    } else {
+      // But if there's already a party queued, we're better off asking event
+      // engine to run it so we can spread load.
+      event_engine()->Run([this]() {
+        ApplicationCallbackExecCtx app_exec_ctx;
+        ExecCtx exec_ctx;
+        RunLocked();
+      });
+    }
+    return;
+  }
   auto body = [this]() {
-    if (RunParty()) {
+    GPR_DEBUG_ASSERT(g_current_party_run_next == nullptr);
+    Party* run_next = nullptr;
+    g_current_party_run_next = &run_next;
+    const bool done = RunParty();
+    GPR_DEBUG_ASSERT(g_current_party_run_next == &run_next);
+    g_current_party_run_next = nullptr;
+    if (done) {
       ScopedActivity activity(this);
       PartyOver();
     }
+    if (run_next != nullptr) {
+      run_next->RunLocked();
+    }
   };
 #ifdef GRPC_MAXIMIZE_THREADYNESS
   Thread thd(
@@ -233,7 +264,6 @@ void Party::RunLocked() {
 
 bool Party::RunParty() {
   ScopedActivity activity(this);
-  promise_detail::Context<Arena> arena_ctx(arena_);
   return sync_.RunParty([this](int i) { return RunOneParticipant(i); });
 }
 

data/src/core/lib/promise/party.h

@@ -41,7 +41,6 @@
 #include "src/core/lib/promise/detail/promise_factory.h"
 #include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/trace.h"
-#include "src/core/lib/resource_quota/arena.h"
 
 // Two implementations of party synchronization are provided: one using a single
 // atomic, the other using a mutex and a set of state variables.
@@ -130,7 +129,10 @@ class PartySyncUsingAtomics {
         if (poll_one_participant(i)) {
           const uint64_t allocated_bit = (1u << i << kAllocatedShift);
           prev_state &= ~allocated_bit;
-          state_.fetch_and(~allocated_bit, std::memory_order_release);
+          uint64_t finished_prev_state =
+              state_.fetch_and(~allocated_bit, std::memory_order_release);
+          LogStateChange("Run:ParticipantComplete", finished_prev_state,
+                         finished_prev_state & ~allocated_bit);
         }
       }
       // Try to CAS the state we expected to have (with no wakeups or adds)
@@ -208,7 +210,8 @@ class PartySyncUsingAtomics {
 
     // Now we need to wake up the party.
     state = state_.fetch_or(wakeup_mask | kLocked, std::memory_order_release);
-    LogStateChange("AddParticipantsAndRef:Wakeup", state, state | kLocked);
+    LogStateChange("AddParticipantsAndRef:Wakeup", state,
+                   state | wakeup_mask | kLocked);
 
     // If the party was already locked, we're done.
     return ((state & kLocked) == 0);
@@ -229,7 +232,7 @@ class PartySyncUsingAtomics {
   void LogStateChange(const char* op, uint64_t prev_state, uint64_t new_state,
                       DebugLocation loc = {}) {
     if (grpc_trace_party_state.enabled()) {
-      gpr_log(loc.file(), loc.line(), GPR_LOG_SEVERITY_DEBUG,
+      gpr_log(loc.file(), loc.line(), GPR_LOG_SEVERITY_INFO,
               "Party %p %30s: %016" PRIx64 " -> %016" PRIx64, this, op,
               prev_state, new_state);
     }
@@ -404,8 +407,6 @@ class Party : public Activity, private Wakeable {
     return RefCountedPtr<Party>(this);
   }
 
-  Arena* arena() const { return arena_; }
-
   // Return a promise that resolves to Empty{} when the current party poll is
   // complete.
   // This is useful for implementing batching and the like: we can hold some
@@ -438,8 +439,7 @@ class Party : public Activity, private Wakeable {
   };
 
  protected:
-  explicit Party(Arena* arena, size_t initial_refs)
-      : sync_(initial_refs), arena_(arena) {}
+  explicit Party(size_t initial_refs) : sync_(initial_refs) {}
   ~Party() override;
 
   // Main run loop. Must be locked.
@@ -491,13 +491,13 @@ class Party : public Activity, private Wakeable {
       auto p = promise_();
       if (auto* r = p.value_if_ready()) {
         on_complete_(std::move(*r));
-        GetContext<Arena>()->DeletePooled(this);
+        delete this;
         return true;
       }
       return false;
     }
 
-    void Destroy() override { GetContext<Arena>()->DeletePooled(this); }
+    void Destroy() override { delete this; }
 
    private:
     union {
@@ -626,7 +626,6 @@ class Party : public Activity, private Wakeable {
 #error No synchronization method defined
 #endif
 
-  Arena* const arena_;
   uint8_t currently_polling_ = kNotPolling;
   // All current participants, using a tagged format.
   // If the lower bit is unset, then this is a Participant*.
@@ -646,9 +645,8 @@ void Party::BulkSpawner::Spawn(absl::string_view name, Factory promise_factory,
     gpr_log(GPR_DEBUG, "%s[bulk_spawn] On %p queue %s",
             party_->DebugTag().c_str(), this, std::string(name).c_str());
   }
-  participants_[num_participants_++] =
-      party_->arena_->NewPooled<ParticipantImpl<Factory, OnComplete>>(
-          name, std::move(promise_factory), std::move(on_complete));
+  participants_[num_participants_++] = new ParticipantImpl<Factory, OnComplete>(
+      name, std::move(promise_factory), std::move(on_complete));
 }
 
 template <typename Factory, typename OnComplete>

data/src/core/lib/promise/sleep.cc

@@ -20,7 +20,7 @@
 
 #include <grpc/event_engine/event_engine.h>
 
-#include "src/core/lib/event_engine/default_event_engine.h"  // IWYU pragma: keep
+#include "src/core/lib/event_engine/event_engine_context.h"  // IWYU pragma: keep
 #include "src/core/lib/gprpp/time.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/promise/activity.h"

data/src/core/lib/promise/status_flag.h

@@ -176,6 +176,14 @@ class ValueOrFailure {
     return value_ == other.value_;
   }
 
+  bool operator!=(const ValueOrFailure& other) const {
+    return value_ != other.value_;
+  }
+
+  bool operator==(const T& other) const { return value_ == other; }
+
+  bool operator!=(const T& other) const { return value_ != other; }
+
  private:
   absl::optional<T> value_;
 };

data/src/core/lib/resource_quota/arena.h

@@ -173,6 +173,8 @@ class Arena {
     }
   }
 
+  // Allocates T from the arena.
+  // The caller is responsible for calling p->~T(), but should NOT delete.
   // TODO(roth): We currently assume that all callers need alignment of 16
   // bytes, which may be wrong in some cases. When we have time, we should
   // change this to instead use the alignment of the type being allocated by
@@ -185,6 +187,7 @@ class Arena {
   }
 
   // Like New, but has the arena call p->~T() at arena destruction time.
+  // The caller should NOT delete.
   template <typename T, typename... Args>
   T* ManagedNew(Args&&... args) {
     auto* p = New<ManagedNewImpl<T>>(std::forward<Args>(args)...);

data/src/core/lib/resource_quota/connection_quota.cc

@@ -0,0 +1,71 @@
+// Copyright 2024 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/resource_quota/connection_quota.h"
+
+#include <atomic>
+#include <cstdint>
+
+#include <grpc/support/log.h>
+
+namespace grpc_core {
+
+ConnectionQuota::ConnectionQuota() = default;
+
+void ConnectionQuota::SetMaxIncomingConnections(int max_incoming_connections) {
+  // The maximum can only be configured once.
+  GPR_ASSERT(max_incoming_connections < INT_MAX);
+  GPR_ASSERT(max_incoming_connections_.exchange(max_incoming_connections,
+                                                std::memory_order_release) ==
+             INT_MAX);
+}
+
+// Returns true if the incoming connection is allowed to be accepted on the
+// server.
+bool ConnectionQuota::AllowIncomingConnection(MemoryQuotaRefPtr mem_quota,
+                                              absl::string_view /*peer*/) {
+  if (mem_quota->IsMemoryPressureHigh()) {
+    return false;
+  }
+
+  if (max_incoming_connections_.load(std::memory_order_relaxed) == INT_MAX) {
+    return true;
+  }
+
+  int curr_active_connections =
+      active_incoming_connections_.load(std::memory_order_acquire);
+  do {
+    if (curr_active_connections >=
+        max_incoming_connections_.load(std::memory_order_relaxed)) {
+      return false;
+    }
+  } while (!active_incoming_connections_.compare_exchange_weak(
+      curr_active_connections, curr_active_connections + 1,
+      std::memory_order_acq_rel, std::memory_order_relaxed));
+  return true;
+}
+
+// Mark connections as closed.
+void ConnectionQuota::ReleaseConnections(int num_connections) {
+  if (max_incoming_connections_.load(std::memory_order_relaxed) == INT_MAX) {
+    return;
+  }
+  GPR_ASSERT(active_incoming_connections_.fetch_sub(
+                 num_connections, std::memory_order_acq_rel) >=
+             num_connections);
+}
+
+}  // namespace grpc_core

data/src/core/lib/resource_quota/connection_quota.h

@@ -0,0 +1,61 @@
+// Copyright 2024 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_LIB_RESOURCE_QUOTA_CONNECTION_QUOTA_H
+#define GRPC_SRC_CORE_LIB_RESOURCE_QUOTA_CONNECTION_QUOTA_H
+
+#include <grpc/support/port_platform.h>
+
+#include <cstddef>
+#include <limits>
+
+#include "absl/base/thread_annotations.h"
+
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/sync.h"
+#include "src/core/lib/resource_quota/memory_quota.h"
+
+namespace grpc_core {
+
+// Tracks the amount of threads in a resource quota.
+class ConnectionQuota : public RefCounted<ConnectionQuota> {
+ public:
+  ConnectionQuota();
+  ~ConnectionQuota() override = default;
+
+  ConnectionQuota(const ConnectionQuota&) = delete;
+  ConnectionQuota& operator=(const ConnectionQuota&) = delete;
+
+  // Set the maximum number of allowed incoming connections on the server.
+  void SetMaxIncomingConnections(int max_incoming_connections);
+
+  // Returns true if the incoming connection is allowed to be accepted on the
+  // server.
+  bool AllowIncomingConnection(MemoryQuotaRefPtr mem_quota,
+                               absl::string_view peer);
+
+  // Mark connections as closed.
+  void ReleaseConnections(int num_connections);
+
+ private:
+  std::atomic<int> active_incoming_connections_{0};
+  std::atomic<int> max_incoming_connections_{std::numeric_limits<int>::max()};
+};
+
+using ConnectionQuotaRefPtr = RefCountedPtr<ConnectionQuota>;
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_LIB_RESOURCE_QUOTA_CONNECTION_QUOTA_H

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -30,6 +30,7 @@
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/security/credentials/tls/tls_utils.h"
 #include "src/core/lib/slice/slice.h"
+#include "src/core/lib/transport/endpoint_info_handshaker.h"
 #include "src/core/lib/uri/uri_parser.h"
 
 namespace grpc_core {
@@ -70,7 +71,7 @@ EvaluateArgs::PerChannelArgs::Address ParseEndpointUri(
 }  // namespace
 
 EvaluateArgs::PerChannelArgs::PerChannelArgs(grpc_auth_context* auth_context,
-                                             grpc_endpoint* endpoint) {
+                                             const ChannelArgs& args) {
   if (auth_context != nullptr) {
     transport_security_type = GetAuthPropertyValue(
         auth_context, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME);
@@ -83,10 +84,10 @@ EvaluateArgs::PerChannelArgs::PerChannelArgs(grpc_auth_context* auth_context,
     subject =
         GetAuthPropertyValue(auth_context, GRPC_X509_SUBJECT_PROPERTY_NAME);
   }
-  if (endpoint != nullptr) {
-    local_address = ParseEndpointUri(grpc_endpoint_get_local_address(endpoint));
-    peer_address = ParseEndpointUri(grpc_endpoint_get_peer(endpoint));
-  }
+  local_address = ParseEndpointUri(
+      args.GetString(GRPC_ARG_ENDPOINT_LOCAL_ADDRESS).value_or(""));
+  peer_address = ParseEndpointUri(
+      args.GetString(GRPC_ARG_ENDPOINT_PEER_ADDRESS).value_or(""));
 }
 
 absl::string_view EvaluateArgs::GetPath() const {

data/src/core/lib/security/authorization/evaluate_args.h

@@ -25,13 +25,13 @@
 
 #include <grpc/grpc_security.h>
 
-#include "src/core/lib/iomgr/endpoint.h"
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/resolved_address.h"
 #include "src/core/lib/transport/metadata_batch.h"
 
 namespace grpc_core {
 
-class EvaluateArgs {
+class EvaluateArgs final {
  public:
   // Caller is responsible for ensuring auth_context outlives PerChannelArgs
   // struct.
@@ -44,7 +44,7 @@ class EvaluateArgs {
       int port = 0;
     };
 
-    PerChannelArgs(grpc_auth_context* auth_context, grpc_endpoint* endpoint);
+    PerChannelArgs(grpc_auth_context* auth_context, const ChannelArgs& args);
 
     absl::string_view transport_security_type;
     absl::string_view spiffe_id;

data/src/core/lib/security/authorization/grpc_server_authz_filter.cc

@@ -46,10 +46,10 @@ const NoInterceptor GrpcServerAuthzFilter::Call::OnServerToClientMessage;
 const NoInterceptor GrpcServerAuthzFilter::Call::OnFinalize;
 
 GrpcServerAuthzFilter::GrpcServerAuthzFilter(
-    RefCountedPtr<grpc_auth_context> auth_context, grpc_endpoint* endpoint,
+    RefCountedPtr<grpc_auth_context> auth_context, const ChannelArgs& args,
     RefCountedPtr<grpc_authorization_policy_provider> provider)
     : auth_context_(std::move(auth_context)),
-      per_channel_evaluate_args_(auth_context_.get(), endpoint),
+      per_channel_evaluate_args_(auth_context_.get(), args),
       provider_(std::move(provider)) {}
 
 absl::StatusOr<GrpcServerAuthzFilter> GrpcServerAuthzFilter::Create(
@@ -59,12 +59,9 @@ absl::StatusOr<GrpcServerAuthzFilter> GrpcServerAuthzFilter::Create(
   if (provider == nullptr) {
     return absl::InvalidArgumentError("Failed to get authorization provider.");
   }
-  // grpc_endpoint isn't needed because the current gRPC authorization policy
-  // does not support any rules that requires looking for source or destination
-  // addresses.
   return GrpcServerAuthzFilter(
-      auth_context != nullptr ? auth_context->Ref() : nullptr,
-      /*endpoint=*/nullptr, provider->Ref());
+      auth_context != nullptr ? auth_context->Ref() : nullptr, args,
+      provider->Ref());
 }
 
 bool GrpcServerAuthzFilter::IsAuthorized(ClientMetadata& initial_metadata) {

data/src/core/lib/security/authorization/grpc_server_authz_filter.h

@@ -25,7 +25,6 @@
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/iomgr/endpoint.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/authorization/authorization_policy_provider.h"
 #include "src/core/lib/security/authorization/evaluate_args.h"
@@ -55,7 +54,7 @@ class GrpcServerAuthzFilter final
 
  private:
   GrpcServerAuthzFilter(
-      RefCountedPtr<grpc_auth_context> auth_context, grpc_endpoint* endpoint,
+      RefCountedPtr<grpc_auth_context> auth_context, const ChannelArgs& args,
       RefCountedPtr<grpc_authorization_policy_provider> provider);
 
   bool IsAuthorized(ClientMetadata& initial_metadata);

data/src/core/lib/security/credentials/jwt/json_token.cc

@@ -33,18 +33,19 @@
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/escaping.h"
 
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/json.h>
 #include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
 #include <grpc/support/time.h>
 
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/json/json_reader.h"
 #include "src/core/lib/json/json_writer.h"
 #include "src/core/lib/security/util/json_util.h"
-#include "src/core/lib/slice/b64.h"
 
 using grpc_core::Json;
 
@@ -180,7 +181,7 @@ static char* encoded_jwt_header(const char* key_id, const char* algorithm) {
       {"kid", Json::FromString(key_id)},
   });
   std::string json_str = grpc_core::JsonDump(json);
-  return grpc_base64_encode(json_str.c_str(), json_str.size(), 1, 0);
+  return gpr_strdup(absl::WebSafeBase64Escape(json_str).c_str());
 }
 
 static char* encoded_jwt_claim(const grpc_auth_json_key* json_key,
@@ -208,7 +209,7 @@ static char* encoded_jwt_claim(const grpc_auth_json_key* json_key,
 
   std::string json_str =
       grpc_core::JsonDump(Json::FromObject(std::move(object)));
-  return grpc_base64_encode(json_str.c_str(), json_str.size(), 1, 0);
+  return gpr_strdup(absl::WebSafeBase64Escape(json_str).c_str());
 }
 
 static char* dot_concat_and_free_strings(char* str1, char* str2) {
@@ -280,7 +281,10 @@ char* compute_and_encode_signature(const grpc_auth_json_key* json_key,
     gpr_log(GPR_ERROR, "DigestFinal (signature compute) failed.");
     goto end;
   }
-  result = grpc_base64_encode(sig, sig_len, 1, 0);
+  result =
+      gpr_strdup(absl::WebSafeBase64Escape(
+                     absl::string_view(reinterpret_cast<char*>(sig), sig_len))
+                     .c_str());
 
 end:
 #if OPENSSL_VERSION_NUMBER < 0x30000000L

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -43,6 +43,7 @@
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/escaping.h"
 #include "absl/strings/string_view.h"
 
 #include <grpc/slice.h>
@@ -66,7 +67,6 @@
 #include "src/core/lib/iomgr/polling_entity.h"
 #include "src/core/lib/json/json_reader.h"
 #include "src/core/lib/security/credentials/credentials.h"  // IWYU pragma: keep
-#include "src/core/lib/slice/b64.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/uri/uri_parser.h"
@@ -111,14 +111,12 @@ static const EVP_MD* evp_md_from_alg(const char* alg) {
 }
 
 static Json parse_json_part_from_jwt(const char* str, size_t len) {
-  grpc_slice slice = grpc_base64_decode_with_len(str, len, 1);
-  if (GRPC_SLICE_IS_EMPTY(slice)) {
+  std::string string;
+  if (!absl::WebSafeBase64Unescape(absl::string_view(str, len), &string)) {
     gpr_log(GPR_ERROR, "Invalid base64.");
     return Json();  // JSON null
   }
-  absl::string_view string = grpc_core::StringViewFromSlice(slice);
   auto json = grpc_core::JsonParse(string);
-  grpc_core::CSliceUnref(slice);
   if (!json.ok()) {
     gpr_log(GPR_ERROR, "JSON parse error: %s",
             json.status().ToString().c_str());
@@ -480,19 +478,14 @@ end:
 }
 
 static BIGNUM* bignum_from_base64(const char* b64) {
-  BIGNUM* result = nullptr;
-  grpc_slice bin;
-
   if (b64 == nullptr) return nullptr;
-  bin = grpc_base64_decode(b64, 1);
-  if (GRPC_SLICE_IS_EMPTY(bin)) {
+  std::string string;
+  if (!absl::WebSafeBase64Unescape(b64, &string)) {
     gpr_log(GPR_ERROR, "Invalid base64 for big num.");
     return nullptr;
   }
-  result = BN_bin2bn(GRPC_SLICE_START_PTR(bin),
-                     TSI_SIZE_AS_SIZE(GRPC_SLICE_LENGTH(bin)), nullptr);
-  grpc_core::CSliceUnref(bin);
-  return result;
+  return BN_bin2bn(reinterpret_cast<const uint8_t*>(string.data()),
+                   TSI_SIZE_AS_SIZE(string.size()), nullptr);
 }
 
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
@@ -931,6 +924,7 @@ void grpc_jwt_verifier_verify(grpc_jwt_verifier* verifier,
   size_t signed_jwt_len;
   const char* cur = jwt;
   Json json;
+  std::string signature_str;
 
   GPR_ASSERT(verifier != nullptr && jwt != nullptr && audience != nullptr &&
              cb != nullptr);
@@ -951,8 +945,9 @@ void grpc_jwt_verifier_verify(grpc_jwt_verifier* verifier,
 
   signed_jwt_len = static_cast<size_t>(dot - jwt);
   cur = dot + 1;
-  signature = grpc_base64_decode(cur, 1);
-  if (GRPC_SLICE_IS_EMPTY(signature)) goto error;
+
+  if (!absl::WebSafeBase64Unescape(cur, &signature_str)) goto error;
+  signature = grpc_slice_from_cpp_string(std::move(signature_str));
   retrieve_key_and_verify(
       verifier_cb_ctx_create(verifier, pollset, header, claims, audience,
                              signature, jwt, signed_jwt_len, user_data, cb));

data/src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc

@@ -53,15 +53,22 @@ namespace grpc_core {
 namespace experimental {
 
 namespace {
-std::string IssuerFromCrl(X509_CRL* crl) {
+// TODO(gtcooke94) Move ssl_transport_security_utils to it's own BUILD target
+// and add this to it.
+absl::StatusOr<std::string> IssuerFromCrl(X509_CRL* crl) {
   if (crl == nullptr) {
-    return "";
+    return absl::InvalidArgumentError("crl cannot be null");
   }
-  char* buf = X509_NAME_oneline(X509_CRL_get_issuer(crl), nullptr, 0);
-  std::string ret;
-  if (buf != nullptr) {
-    ret = buf;
+  X509_NAME* issuer = X509_CRL_get_issuer(crl);
+  if (issuer == nullptr) {
+    return absl::InvalidArgumentError("crl cannot have null issuer");
   }
+  unsigned char* buf = nullptr;
+  int len = i2d_X509_NAME(issuer, &buf);
+  if (len < 0 || buf == nullptr) {
+    return absl::InvalidArgumentError("crl cannot have null issuer");
+  }
+  std::string ret(reinterpret_cast<char const*>(buf), len);
   OPENSSL_free(buf);
   return ret;
 }
@@ -103,11 +110,11 @@ absl::StatusOr<std::unique_ptr<Crl>> Crl::Parse(absl::string_view crl_string) {
 }
 
 absl::StatusOr<std::unique_ptr<CrlImpl>> CrlImpl::Create(X509_CRL* crl) {
-  std::string issuer = IssuerFromCrl(crl);
-  if (issuer.empty()) {
-    return absl::InvalidArgumentError("Issuer of crl cannot be empty");
+  absl::StatusOr<std::string> issuer = IssuerFromCrl(crl);
+  if (!issuer.ok()) {
+    return issuer.status();
   }
-  return std::make_unique<CrlImpl>(crl, issuer);
+  return std::make_unique<CrlImpl>(crl, *issuer);
 }
 
 CrlImpl::~CrlImpl() { X509_CRL_free(crl_); }

data/src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h

@@ -79,13 +79,17 @@ class CrlImpl : public Crl {
 
 class CertificateInfoImpl : public CertificateInfo {
  public:
-  explicit CertificateInfoImpl(absl::string_view issuer) : issuer_(issuer) {}
-  // Returns a string representation of the issuer pulled from the
-  // certificate.
+  explicit CertificateInfoImpl(absl::string_view issuer,
+                               absl::string_view authority_key_identifier = "")
+      : issuer_(issuer), authority_key_identifier_(authority_key_identifier) {}
   absl::string_view Issuer() const override { return issuer_; }
+  absl::string_view AuthorityKeyIdentifier() const override {
+    return authority_key_identifier_;
+  }
 
  private:
   const std::string issuer_;
+  const std::string authority_key_identifier_;
 };
 
 // Defining this here lets us hide implementation details (and includes) from

data/src/core/lib/security/security_connector/load_system_roots.h

@@ -25,6 +25,9 @@
 
 namespace grpc_core {
 
+// TODO(matthewstevenson88): Update LoadSystemRootCerts to use Slice
+// instead of grpc_slice.
+
 // Returns a slice containing roots from the OS trust store
 grpc_slice LoadSystemRootCerts();