grpc 1.62.0 → 1.65.1

data/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc

@@ -16,8 +16,6 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/lib/security/security_connector/ssl/ssl_security_connector.h"
 
 #include <stdint.h>
@@ -26,14 +24,18 @@
 #include <string>
 #include <utility>
 
+#include "absl/log/check.h"
+#include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/string_view.h"
 
 #include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 
+#include "src/core/handshaker/handshaker.h"
+#include "src/core/handshaker/security/security_handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/host_port.h"
@@ -50,8 +52,6 @@
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/ssl/ssl_credentials.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
-#include "src/core/lib/security/transport/security_handshaker.h"
-#include "src/core/lib/transport/handshaker.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
@@ -112,8 +112,8 @@ class grpc_ssl_channel_security_connector final
         /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0, &tsi_hs);
     if (result != TSI_OK) {
-      gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
-              tsi_result_to_string(result));
+      LOG(ERROR) << "Handshaker creation failed with error "
+                 << tsi_result_to_string(result);
       return;
     }
     // Create handshakers.
@@ -204,8 +204,7 @@ class grpc_ssl_server_security_connector
     if (has_cert_config_fetcher()) {
       // Load initial credentials from certificate_config_fetcher:
       if (!try_fetch_ssl_server_credentials()) {
-        gpr_log(GPR_ERROR,
-                "Failed loading SSL server credentials from fetcher.");
+        LOG(ERROR) << "Failed loading SSL server credentials from fetcher.";
         return GRPC_SECURITY_ERROR;
       }
     } else {
@@ -236,8 +235,8 @@ class grpc_ssl_server_security_connector
               &options, &server_handshaker_factory_);
       gpr_free(alpn_protocol_strings);
       if (result != TSI_OK) {
-        gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
-                tsi_result_to_string(result));
+        LOG(ERROR) << "Handshaker factory creation failed with "
+                   << tsi_result_to_string(result);
         return GRPC_SECURITY_ERROR;
       }
     }
@@ -254,8 +253,8 @@ class grpc_ssl_server_security_connector
         server_handshaker_factory_, /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0, &tsi_hs);
     if (result != TSI_OK) {
-      gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
-              tsi_result_to_string(result));
+      LOG(ERROR) << "Handshaker creation failed with error "
+                 << tsi_result_to_string(result);
       return;
     }
     // Create handshakers.
@@ -299,9 +298,8 @@ class grpc_ssl_server_security_connector
       status = try_replace_server_handshaker_factory(certificate_config);
     } else {
       // Log error, continue using previously-loaded credentials.
-      gpr_log(GPR_ERROR,
-              "Failed fetching new server credentials, continuing to "
-              "use previously-loaded credentials.");
+      LOG(ERROR) << "Failed fetching new server credentials, continuing to "
+                    "use previously-loaded credentials.";
       status = false;
     }
 
@@ -318,12 +316,12 @@ class grpc_ssl_server_security_connector
   bool try_replace_server_handshaker_factory(
       const grpc_ssl_server_certificate_config* config) {
     if (config == nullptr) {
-      gpr_log(GPR_ERROR,
-              "Server certificate config callback returned invalid (NULL) "
-              "config.");
+      LOG(ERROR)
+          << "Server certificate config callback returned invalid (NULL) "
+             "config.";
       return false;
     }
-    gpr_log(GPR_DEBUG, "Using new server certificate config (%p).", config);
+    VLOG(2) << "Using new server certificate config (" << config << ").";
 
     size_t num_alpn_protocols = 0;
     const char** alpn_protocol_strings =
@@ -331,7 +329,7 @@ class grpc_ssl_server_security_connector
     tsi_ssl_server_handshaker_factory* new_handshaker_factory = nullptr;
     const grpc_ssl_server_credentials* server_creds =
         static_cast<const grpc_ssl_server_credentials*>(this->server_creds());
-    GPR_DEBUG_ASSERT(config->pem_root_certs != nullptr);
+    DCHECK_NE(config->pem_root_certs, nullptr);
     tsi_ssl_server_handshaker_options options;
     options.pem_key_cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
         config->pem_key_cert_pairs, config->num_key_cert_pairs);
@@ -351,8 +349,8 @@ class grpc_ssl_server_security_connector
     gpr_free(alpn_protocol_strings);
 
     if (result != TSI_OK) {
-      gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
-              tsi_result_to_string(result));
+      LOG(ERROR) << "Handshaker factory creation failed with "
+                 << tsi_result_to_string(result);
       return false;
     }
     set_server_handshaker_factory(new_handshaker_factory);
@@ -380,7 +378,7 @@ grpc_ssl_channel_security_connector_create(
     const char* overridden_target_name,
     tsi_ssl_client_handshaker_factory* client_factory) {
   if (config == nullptr || target_name == nullptr) {
-    gpr_log(GPR_ERROR, "An ssl channel needs a config and a target name.");
+    LOG(ERROR) << "An ssl channel needs a config and a target name.";
     return nullptr;
   }
 
@@ -395,7 +393,7 @@ grpc_ssl_channel_security_connector_create(
 grpc_core::RefCountedPtr<grpc_server_security_connector>
 grpc_ssl_server_security_connector_create(
     grpc_core::RefCountedPtr<grpc_server_credentials> server_credentials) {
-  GPR_ASSERT(server_credentials != nullptr);
+  CHECK(server_credentials != nullptr);
   grpc_core::RefCountedPtr<grpc_ssl_server_security_connector> c =
       grpc_core::MakeRefCounted<grpc_ssl_server_security_connector>(
           std::move(server_credentials));

data/src/core/lib/security/security_connector/ssl/ssl_security_connector.h

@@ -18,13 +18,13 @@
 
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_SSL_SECURITY_CONNECTOR_H
 #define GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_SSL_SECURITY_CONNECTOR_H
-#include <grpc/support/port_platform.h>
-
 #include <stddef.h>
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
+#include <grpc/support/port_platform.h>
 
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/security_connector/security_connector.h"

data/src/core/lib/security/security_connector/ssl_utils.cc

@@ -16,8 +16,6 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 
 #include <stdint.h>
@@ -27,22 +25,24 @@
 #include <utility>
 #include <vector>
 
+#include "absl/log/check.h"
+#include "absl/log/log.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_split.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_crl_provider.h>
 #include <grpc/impl/channel_arg_names.h>
 #include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 #include <grpc/support/string_util.h>
 #include <grpc/support/sync.h>
 
 #include "src/core/ext/transport/chttp2/alpn/alpn.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/config/config_vars.h"
-#include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/gprpp/load_file.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
@@ -50,6 +50,7 @@
 #include "src/core/lib/security/security_connector/load_system_roots.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security.h"
+#include "src/core/util/useful.h"
 
 // -- Constants. --
 
@@ -122,7 +123,7 @@ tsi_tls_version grpc_get_tsi_tls_version(grpc_tls_version tls_version) {
     case grpc_tls_version::TLS1_3:
       return tsi_tls_version::TSI_TLS1_3;
     default:
-      gpr_log(GPR_INFO, "Falling back to TLS 1.2.");
+      LOG(INFO) << "Falling back to TLS 1.2.";
       return tsi_tls_version::TSI_TLS1_2;
   }
 }
@@ -179,7 +180,7 @@ absl::Status SslCheckCallHost(absl::string_view host,
     status = GRPC_SECURITY_OK;
   }
   if (status != GRPC_SECURITY_OK) {
-    gpr_log(GPR_ERROR, "call host does not match SSL server name");
+    LOG(ERROR) << "call host does not match SSL server name";
     grpc_shallow_peer_destruct(&peer);
     return absl::UnauthenticatedError(
         "call host does not match SSL server name");
@@ -191,7 +192,7 @@ absl::Status SslCheckCallHost(absl::string_view host,
 }  // namespace grpc_core
 
 const char** grpc_fill_alpn_protocol_strings(size_t* num_alpn_protocols) {
-  GPR_ASSERT(num_alpn_protocols != nullptr);
+  CHECK_NE(num_alpn_protocols, nullptr);
   *num_alpn_protocols = grpc_chttp2_num_alpn_versions();
   const char** alpn_protocol_strings = static_cast<const char**>(
       gpr_malloc(sizeof(const char*) * (*num_alpn_protocols)));
@@ -231,16 +232,16 @@ static bool IsSpiffeId(absl::string_view uri) {
     return false;
   };
   if (uri.size() > 2048) {
-    gpr_log(GPR_INFO, "Invalid SPIFFE ID: ID longer than 2048 bytes.");
+    LOG(INFO) << "Invalid SPIFFE ID: ID longer than 2048 bytes.";
     return false;
   }
   std::vector<absl::string_view> splits = absl::StrSplit(uri, '/');
   if (splits.size() < 4 || splits[3].empty()) {
-    gpr_log(GPR_INFO, "Invalid SPIFFE ID: workload id is empty.");
+    LOG(INFO) << "Invalid SPIFFE ID: workload id is empty.";
     return false;
   }
   if (splits[2].size() > 255) {
-    gpr_log(GPR_INFO, "Invalid SPIFFE ID: domain longer than 255 characters.");
+    LOG(INFO) << "Invalid SPIFFE ID: domain longer than 255 characters.";
     return false;
   }
   return true;
@@ -252,7 +253,7 @@ grpc_core::RefCountedPtr<grpc_auth_context> grpc_ssl_peer_to_auth_context(
   const char* peer_identity_property_name = nullptr;
 
   // The caller has checked the certificate type property.
-  GPR_ASSERT(peer->property_count >= 1);
+  CHECK_GE(peer->property_count, 1u);
   grpc_core::RefCountedPtr<grpc_auth_context> ctx =
       grpc_core::MakeRefCounted<grpc_auth_context>(nullptr);
   grpc_auth_context_add_cstring_property(
@@ -319,19 +320,19 @@ grpc_core::RefCountedPtr<grpc_auth_context> grpc_ssl_peer_to_auth_context(
     }
   }
   if (peer_identity_property_name != nullptr) {
-    GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name(
-                   ctx.get(), peer_identity_property_name) == 1);
+    CHECK(grpc_auth_context_set_peer_identity_property_name(
+              ctx.get(), peer_identity_property_name) == 1);
   }
   // A valid SPIFFE certificate can only have exact one URI SAN field.
   if (has_spiffe_id) {
     if (uri_count == 1) {
-      GPR_ASSERT(spiffe_length > 0);
-      GPR_ASSERT(spiffe_data != nullptr);
+      CHECK_GT(spiffe_length, 0u);
+      CHECK_NE(spiffe_data, nullptr);
       grpc_auth_context_add_property(ctx.get(),
                                      GRPC_PEER_SPIFFE_ID_PROPERTY_NAME,
                                      spiffe_data, spiffe_length);
     } else {
-      gpr_log(GPR_INFO, "Invalid SPIFFE ID: multiple URI SANs.");
+      LOG(INFO) << "Invalid SPIFFE ID: multiple URI SANs.";
     }
   }
   return ctx;
@@ -418,13 +419,12 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
   const char* root_certs;
   const tsi_ssl_root_certs_store* root_store;
   if (pem_root_certs == nullptr && !skip_server_certificate_verification) {
-    gpr_log(GPR_INFO,
-            "No root certificates specified; use ones stored in system default "
-            "locations instead");
+    LOG(INFO) << "No root certificates specified; use ones stored in system "
+                 "default locations instead";
     // Use default root certificates.
     root_certs = grpc_core::DefaultSslRootStore::GetPemRootCerts();
     if (root_certs == nullptr) {
-      gpr_log(GPR_ERROR, "Could not get default pem root certs.");
+      LOG(ERROR) << "Could not get default pem root certs.";
       return GRPC_SECURITY_ERROR;
     }
     root_store = grpc_core::DefaultSslRootStore::GetRootStore();
@@ -457,8 +457,8 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
                                                             handshaker_factory);
   gpr_free(options.alpn_protocols);
   if (result != TSI_OK) {
-    gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
-            tsi_result_to_string(result));
+    LOG(ERROR) << "Handshaker factory creation failed with "
+               << tsi_result_to_string(result);
     return GRPC_SECURITY_ERROR;
   }
   return GRPC_SECURITY_OK;
@@ -496,8 +496,8 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
                                                             handshaker_factory);
   gpr_free(alpn_protocol_strings);
   if (result != TSI_OK) {
-    gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
-            tsi_result_to_string(result));
+    LOG(ERROR) << "Handshaker factory creation failed with "
+               << tsi_result_to_string(result);
     return GRPC_SECURITY_ERROR;
   }
   return GRPC_SECURITY_OK;
@@ -574,9 +574,8 @@ grpc_slice DefaultSslRootStore::ComputePemRootCerts() {
     auto slice =
         LoadFile(default_root_certs_path, /*add_null_terminator=*/true);
     if (!slice.ok()) {
-      gpr_log(GPR_ERROR, "error loading file %s: %s",
-              default_root_certs_path.c_str(),
-              slice.status().ToString().c_str());
+      LOG(ERROR) << "error loading file " << default_root_certs_path << ": "
+                 << slice.status();
     } else {
       result = std::move(*slice);
     }
@@ -587,7 +586,7 @@ grpc_slice DefaultSslRootStore::ComputePemRootCerts() {
     char* pem_root_certs = nullptr;
     ovrd_res = ssl_roots_override_cb(&pem_root_certs);
     if (ovrd_res == GRPC_SSL_ROOTS_OVERRIDE_OK) {
-      GPR_ASSERT(pem_root_certs != nullptr);
+      CHECK_NE(pem_root_certs, nullptr);
       result = Slice::FromCopiedBuffer(
           pem_root_certs,
           strlen(pem_root_certs) + 1);  // nullptr terminator.
@@ -602,8 +601,8 @@ grpc_slice DefaultSslRootStore::ComputePemRootCerts() {
   if (result.empty() && ovrd_res != GRPC_SSL_ROOTS_OVERRIDE_FAIL_PERMANENTLY) {
     auto slice = LoadFile(installed_roots_path, /*add_null_terminator=*/true);
     if (!slice.ok()) {
-      gpr_log(GPR_ERROR, "error loading file %s: %s", installed_roots_path,
-              slice.status().ToString().c_str());
+      LOG(ERROR) << "error loading file " << installed_roots_path << ": "
+                 << slice.status();
     } else {
       result = std::move(*slice);
     }

data/src/core/lib/security/security_connector/ssl_utils.h

@@ -19,8 +19,6 @@
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_UTILS_H
 #define GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_UTILS_H
 
-#include <grpc/support/port_platform.h>
-
 #include <stddef.h>
 
 #include <memory>
@@ -35,6 +33,7 @@
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
 #include <grpc/slice.h>
+#include <grpc/support/port_platform.h>
 
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/error.h"

data/src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -16,8 +16,6 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/lib/security/security_connector/tls/tls_security_connector.h"
 
 #include <string.h>
@@ -27,15 +25,18 @@
 #include <vector>
 
 #include "absl/functional/bind_front.h"
+#include "absl/log/check.h"
+#include "absl/log/log.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security_constants.h>
 #include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 #include <grpc/support/string_util.h>
 
+#include "src/core/handshaker/security/security_handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/host_port.h"
@@ -47,7 +48,6 @@
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
-#include "src/core/lib/security/transport/security_handshaker.h"
 #include "src/core/tsi/ssl_transport_security.h"
 
 namespace grpc_core {
@@ -64,7 +64,7 @@ char* CopyCoreString(char* src, size_t length) {
 void PendingVerifierRequestInit(
     const char* target_name, tsi_peer peer,
     grpc_tls_custom_verification_check_request* request) {
-  GPR_ASSERT(request != nullptr);
+  CHECK_NE(request, nullptr);
   // The verifier holds a ref to the security connector, so it's fine to
   // directly point this to the name cached in the security connector.
   request->target_name = target_name;
@@ -176,7 +176,7 @@ void PendingVerifierRequestInit(
 
 void PendingVerifierRequestDestroy(
     grpc_tls_custom_verification_check_request* request) {
-  GPR_ASSERT(request != nullptr);
+  CHECK_NE(request, nullptr);
   if (request->peer_info.common_name != nullptr) {
     gpr_free(const_cast<char*>(request->peer_info.common_name));
   }
@@ -220,13 +220,13 @@ tsi_ssl_pem_key_cert_pair* ConvertToTsiPemKeyCertPair(
   tsi_ssl_pem_key_cert_pair* tsi_pairs = nullptr;
   size_t num_key_cert_pairs = cert_pair_list.size();
   if (num_key_cert_pairs > 0) {
-    GPR_ASSERT(cert_pair_list.data() != nullptr);
+    CHECK_NE(cert_pair_list.data(), nullptr);
     tsi_pairs = static_cast<tsi_ssl_pem_key_cert_pair*>(
         gpr_zalloc(num_key_cert_pairs * sizeof(tsi_ssl_pem_key_cert_pair)));
   }
   for (size_t i = 0; i < num_key_cert_pairs; i++) {
-    GPR_ASSERT(!cert_pair_list[i].private_key().empty());
-    GPR_ASSERT(!cert_pair_list[i].cert_chain().empty());
+    CHECK(!cert_pair_list[i].private_key().empty());
+    CHECK(!cert_pair_list[i].cert_chain().empty());
     tsi_pairs[i].cert_chain =
         gpr_strdup(cert_pair_list[i].cert_chain().c_str());
     tsi_pairs[i].private_key =
@@ -246,21 +246,18 @@ TlsChannelSecurityConnector::CreateTlsChannelSecurityConnector(
     const char* target_name, const char* overridden_target_name,
     tsi_ssl_session_cache* ssl_session_cache) {
   if (channel_creds == nullptr) {
-    gpr_log(GPR_ERROR,
-            "channel_creds is nullptr in "
-            "TlsChannelSecurityConnectorCreate()");
+    LOG(ERROR) << "channel_creds is nullptr in "
+                  "TlsChannelSecurityConnectorCreate()";
     return nullptr;
   }
   if (options == nullptr) {
-    gpr_log(GPR_ERROR,
-            "options is nullptr in "
-            "TlsChannelSecurityConnectorCreate()");
+    LOG(ERROR) << "options is nullptr in "
+                  "TlsChannelSecurityConnectorCreate()";
     return nullptr;
   }
   if (target_name == nullptr) {
-    gpr_log(GPR_ERROR,
-            "target_name is nullptr in "
-            "TlsChannelSecurityConnectorCreate()");
+    LOG(ERROR) << "target_name is nullptr in "
+                  "TlsChannelSecurityConnectorCreate()";
     return nullptr;
   }
   return MakeRefCounted<TlsChannelSecurityConnector>(
@@ -354,8 +351,8 @@ void TlsChannelSecurityConnector::add_handshakers(
         /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0, &tsi_hs);
     if (result != TSI_OK) {
-      gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
-              tsi_result_to_string(result));
+      LOG(ERROR) << "Handshaker creation failed with error "
+                 << tsi_result_to_string(result);
     }
   }
   // If tsi_hs is null, this will add a failing handshaker.
@@ -377,7 +374,7 @@ void TlsChannelSecurityConnector::check_peer(
   }
   *auth_context =
       grpc_ssl_peer_to_auth_context(&peer, GRPC_TLS_TRANSPORT_SECURITY_TYPE);
-  GPR_ASSERT(options_->certificate_verifier() != nullptr);
+  CHECK_NE(options_->certificate_verifier(), nullptr);
   auto* pending_request = new ChannelPendingVerifierRequest(
       RefAsSubclass<TlsChannelSecurityConnector>(), on_peer_checked, peer,
       target_name);
@@ -400,9 +397,8 @@ void TlsChannelSecurityConnector::cancel_check_peer(
       if (it != pending_verifier_requests_.end()) {
         pending_verifier_request = it->second->request();
       } else {
-        gpr_log(GPR_INFO,
-                "TlsChannelSecurityConnector::cancel_check_peer: no "
-                "corresponding pending request found");
+        VLOG(2) << "TlsChannelSecurityConnector::cancel_check_peer: no "
+                   "corresponding pending request found";
       }
     }
     if (pending_verifier_request != nullptr) {
@@ -436,7 +432,7 @@ ArenaPromise<absl::Status> TlsChannelSecurityConnector::CheckCallHost(
 void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
     OnCertificatesChanged(absl::optional<absl::string_view> root_certs,
                           absl::optional<PemKeyCertPairList> key_cert_pairs) {
-  GPR_ASSERT(security_connector_ != nullptr);
+  CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
   if (root_certs.has_value()) {
     security_connector_->pem_root_certs_ = root_certs;
@@ -452,7 +448,7 @@ void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
   if (root_ready && identity_ready) {
     if (security_connector_->UpdateHandshakerFactoryLocked() !=
         GRPC_SECURITY_OK) {
-      gpr_log(GPR_ERROR, "Update handshaker factory failed.");
+      LOG(ERROR) << "Update handshaker factory failed.";
     }
   }
 }
@@ -462,14 +458,12 @@ void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
 void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::OnError(
     grpc_error_handle root_cert_error, grpc_error_handle identity_cert_error) {
   if (!root_cert_error.ok()) {
-    gpr_log(GPR_ERROR,
-            "TlsChannelCertificateWatcher getting root_cert_error: %s",
-            StatusToString(root_cert_error).c_str());
+    LOG(ERROR) << "TlsChannelCertificateWatcher getting root_cert_error: "
+               << StatusToString(root_cert_error);
   }
   if (!identity_cert_error.ok()) {
-    gpr_log(GPR_ERROR,
-            "TlsChannelCertificateWatcher getting identity_cert_error: %s",
-            StatusToString(identity_cert_error).c_str());
+    LOG(ERROR) << "TlsChannelCertificateWatcher getting identity_cert_error: "
+               << StatusToString(identity_cert_error);
   }
 }
 
@@ -565,15 +559,13 @@ TlsServerSecurityConnector::CreateTlsServerSecurityConnector(
     RefCountedPtr<grpc_server_credentials> server_creds,
     RefCountedPtr<grpc_tls_credentials_options> options) {
   if (server_creds == nullptr) {
-    gpr_log(GPR_ERROR,
-            "server_creds is nullptr in "
-            "TlsServerSecurityConnectorCreate()");
+    LOG(ERROR) << "server_creds is nullptr in "
+                  "TlsServerSecurityConnectorCreate()";
     return nullptr;
   }
   if (options == nullptr) {
-    gpr_log(GPR_ERROR,
-            "options is nullptr in "
-            "TlsServerSecurityConnectorCreate()");
+    LOG(ERROR) << "options is nullptr in "
+                  "TlsServerSecurityConnectorCreate()";
     return nullptr;
   }
   return MakeRefCounted<TlsServerSecurityConnector>(std::move(server_creds),
@@ -633,8 +625,8 @@ void TlsServerSecurityConnector::add_handshakers(
         server_handshaker_factory_, /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0, &tsi_hs);
     if (result != TSI_OK) {
-      gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
-              tsi_result_to_string(result));
+      LOG(ERROR) << "Handshaker creation failed with error "
+                 << tsi_result_to_string(result);
     }
   }
   // If tsi_hs is null, this will add a failing handshaker.
@@ -679,9 +671,8 @@ void TlsServerSecurityConnector::cancel_check_peer(
       if (it != pending_verifier_requests_.end()) {
         pending_verifier_request = it->second->request();
       } else {
-        gpr_log(GPR_INFO,
-                "TlsServerSecurityConnector::cancel_check_peer: no "
-                "corresponding pending request found");
+        LOG(INFO) << "TlsServerSecurityConnector::cancel_check_peer: no "
+                     "corresponding pending request found";
       }
     }
     if (pending_verifier_request != nullptr) {
@@ -701,7 +692,7 @@ int TlsServerSecurityConnector::cmp(
 void TlsServerSecurityConnector::TlsServerCertificateWatcher::
     OnCertificatesChanged(absl::optional<absl::string_view> root_certs,
                           absl::optional<PemKeyCertPairList> key_cert_pairs) {
-  GPR_ASSERT(security_connector_ != nullptr);
+  CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
   if (root_certs.has_value()) {
     security_connector_->pem_root_certs_ = root_certs;
@@ -721,7 +712,7 @@ void TlsServerSecurityConnector::TlsServerCertificateWatcher::
       (!root_being_watched && identity_being_watched && identity_has_value)) {
     if (security_connector_->UpdateHandshakerFactoryLocked() !=
         GRPC_SECURITY_OK) {
-      gpr_log(GPR_ERROR, "Update handshaker factory failed.");
+      LOG(ERROR) << "Update handshaker factory failed.";
     }
   }
 }
@@ -731,14 +722,12 @@ void TlsServerSecurityConnector::TlsServerCertificateWatcher::
 void TlsServerSecurityConnector::TlsServerCertificateWatcher::OnError(
     grpc_error_handle root_cert_error, grpc_error_handle identity_cert_error) {
   if (!root_cert_error.ok()) {
-    gpr_log(GPR_ERROR,
-            "TlsServerCertificateWatcher getting root_cert_error: %s",
-            StatusToString(root_cert_error).c_str());
+    LOG(ERROR) << "TlsServerCertificateWatcher getting root_cert_error: "
+               << StatusToString(root_cert_error);
   }
   if (!identity_cert_error.ok()) {
-    gpr_log(GPR_ERROR,
-            "TlsServerCertificateWatcher getting identity_cert_error: %s",
-            StatusToString(identity_cert_error).c_str());
+    LOG(ERROR) << "TlsServerCertificateWatcher getting identity_cert_error: "
+               << StatusToString(identity_cert_error);
   }
 }
 
@@ -800,8 +789,8 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
     tsi_ssl_server_handshaker_factory_unref(server_handshaker_factory_);
   }
   // The identity certs on the server side shouldn't be empty.
-  GPR_ASSERT(pem_key_cert_pair_list_.has_value());
-  GPR_ASSERT(!(*pem_key_cert_pair_list_).empty());
+  CHECK(pem_key_cert_pair_list_.has_value());
+  CHECK(!(*pem_key_cert_pair_list_).empty());
   std::string pem_root_certs;
   if (pem_root_certs_.has_value()) {
     // TODO(ZhenLian): update the underlying TSI layer to use C++ types like

data/src/core/lib/security/security_connector/tls/tls_security_connector.h

@@ -19,8 +19,6 @@
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H
 #define GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H
 
-#include <grpc/support/port_platform.h>
-
 #include <map>
 #include <string>
 
@@ -29,9 +27,12 @@
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
+#include <grpc/support/port_platform.h>
 
+#include "src/core/handshaker/handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/sync.h"
@@ -43,7 +44,6 @@
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
-#include "src/core/lib/transport/handshaker.h"
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"