grpc 1.63.0 → 1.65.2

data/src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -16,8 +16,6 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/lib/security/security_connector/tls/tls_security_connector.h"
 
 #include <string.h>
@@ -27,15 +25,18 @@
 #include <vector>
 
 #include "absl/functional/bind_front.h"
+#include "absl/log/check.h"
+#include "absl/log/log.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security_constants.h>
 #include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 #include <grpc/support/string_util.h>
 
+#include "src/core/handshaker/security/security_handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/host_port.h"
@@ -47,7 +48,6 @@
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
-#include "src/core/lib/security/transport/security_handshaker.h"
 #include "src/core/tsi/ssl_transport_security.h"
 
 namespace grpc_core {
@@ -64,7 +64,7 @@ char* CopyCoreString(char* src, size_t length) {
 void PendingVerifierRequestInit(
     const char* target_name, tsi_peer peer,
     grpc_tls_custom_verification_check_request* request) {
-  GPR_ASSERT(request != nullptr);
+  CHECK_NE(request, nullptr);
   // The verifier holds a ref to the security connector, so it's fine to
   // directly point this to the name cached in the security connector.
   request->target_name = target_name;
@@ -176,7 +176,7 @@ void PendingVerifierRequestInit(
 
 void PendingVerifierRequestDestroy(
     grpc_tls_custom_verification_check_request* request) {
-  GPR_ASSERT(request != nullptr);
+  CHECK_NE(request, nullptr);
   if (request->peer_info.common_name != nullptr) {
     gpr_free(const_cast<char*>(request->peer_info.common_name));
   }
@@ -220,13 +220,13 @@ tsi_ssl_pem_key_cert_pair* ConvertToTsiPemKeyCertPair(
   tsi_ssl_pem_key_cert_pair* tsi_pairs = nullptr;
   size_t num_key_cert_pairs = cert_pair_list.size();
   if (num_key_cert_pairs > 0) {
-    GPR_ASSERT(cert_pair_list.data() != nullptr);
+    CHECK_NE(cert_pair_list.data(), nullptr);
     tsi_pairs = static_cast<tsi_ssl_pem_key_cert_pair*>(
         gpr_zalloc(num_key_cert_pairs * sizeof(tsi_ssl_pem_key_cert_pair)));
   }
   for (size_t i = 0; i < num_key_cert_pairs; i++) {
-    GPR_ASSERT(!cert_pair_list[i].private_key().empty());
-    GPR_ASSERT(!cert_pair_list[i].cert_chain().empty());
+    CHECK(!cert_pair_list[i].private_key().empty());
+    CHECK(!cert_pair_list[i].cert_chain().empty());
     tsi_pairs[i].cert_chain =
         gpr_strdup(cert_pair_list[i].cert_chain().c_str());
     tsi_pairs[i].private_key =
@@ -246,21 +246,18 @@ TlsChannelSecurityConnector::CreateTlsChannelSecurityConnector(
     const char* target_name, const char* overridden_target_name,
     tsi_ssl_session_cache* ssl_session_cache) {
   if (channel_creds == nullptr) {
-    gpr_log(GPR_ERROR,
-            "channel_creds is nullptr in "
-            "TlsChannelSecurityConnectorCreate()");
+    LOG(ERROR) << "channel_creds is nullptr in "
+                  "TlsChannelSecurityConnectorCreate()";
     return nullptr;
   }
   if (options == nullptr) {
-    gpr_log(GPR_ERROR,
-            "options is nullptr in "
-            "TlsChannelSecurityConnectorCreate()");
+    LOG(ERROR) << "options is nullptr in "
+                  "TlsChannelSecurityConnectorCreate()";
     return nullptr;
   }
   if (target_name == nullptr) {
-    gpr_log(GPR_ERROR,
-            "target_name is nullptr in "
-            "TlsChannelSecurityConnectorCreate()");
+    LOG(ERROR) << "target_name is nullptr in "
+                  "TlsChannelSecurityConnectorCreate()";
     return nullptr;
   }
   return MakeRefCounted<TlsChannelSecurityConnector>(
@@ -354,8 +351,8 @@ void TlsChannelSecurityConnector::add_handshakers(
         /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0, &tsi_hs);
     if (result != TSI_OK) {
-      gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
-              tsi_result_to_string(result));
+      LOG(ERROR) << "Handshaker creation failed with error "
+                 << tsi_result_to_string(result);
     }
   }
   // If tsi_hs is null, this will add a failing handshaker.
@@ -377,7 +374,7 @@ void TlsChannelSecurityConnector::check_peer(
   }
   *auth_context =
       grpc_ssl_peer_to_auth_context(&peer, GRPC_TLS_TRANSPORT_SECURITY_TYPE);
-  GPR_ASSERT(options_->certificate_verifier() != nullptr);
+  CHECK_NE(options_->certificate_verifier(), nullptr);
   auto* pending_request = new ChannelPendingVerifierRequest(
       RefAsSubclass<TlsChannelSecurityConnector>(), on_peer_checked, peer,
       target_name);
@@ -400,9 +397,8 @@ void TlsChannelSecurityConnector::cancel_check_peer(
       if (it != pending_verifier_requests_.end()) {
         pending_verifier_request = it->second->request();
       } else {
-        gpr_log(GPR_INFO,
-                "TlsChannelSecurityConnector::cancel_check_peer: no "
-                "corresponding pending request found");
+        VLOG(2) << "TlsChannelSecurityConnector::cancel_check_peer: no "
+                   "corresponding pending request found";
       }
     }
     if (pending_verifier_request != nullptr) {
@@ -436,7 +432,7 @@ ArenaPromise<absl::Status> TlsChannelSecurityConnector::CheckCallHost(
 void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
     OnCertificatesChanged(absl::optional<absl::string_view> root_certs,
                           absl::optional<PemKeyCertPairList> key_cert_pairs) {
-  GPR_ASSERT(security_connector_ != nullptr);
+  CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
   if (root_certs.has_value()) {
     security_connector_->pem_root_certs_ = root_certs;
@@ -452,7 +448,7 @@ void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
   if (root_ready && identity_ready) {
     if (security_connector_->UpdateHandshakerFactoryLocked() !=
         GRPC_SECURITY_OK) {
-      gpr_log(GPR_ERROR, "Update handshaker factory failed.");
+      LOG(ERROR) << "Update handshaker factory failed.";
     }
   }
 }
@@ -462,14 +458,12 @@ void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
 void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::OnError(
     grpc_error_handle root_cert_error, grpc_error_handle identity_cert_error) {
   if (!root_cert_error.ok()) {
-    gpr_log(GPR_ERROR,
-            "TlsChannelCertificateWatcher getting root_cert_error: %s",
-            StatusToString(root_cert_error).c_str());
+    LOG(ERROR) << "TlsChannelCertificateWatcher getting root_cert_error: "
+               << StatusToString(root_cert_error);
   }
   if (!identity_cert_error.ok()) {
-    gpr_log(GPR_ERROR,
-            "TlsChannelCertificateWatcher getting identity_cert_error: %s",
-            StatusToString(identity_cert_error).c_str());
+    LOG(ERROR) << "TlsChannelCertificateWatcher getting identity_cert_error: "
+               << StatusToString(identity_cert_error);
   }
 }
 
@@ -565,15 +559,13 @@ TlsServerSecurityConnector::CreateTlsServerSecurityConnector(
     RefCountedPtr<grpc_server_credentials> server_creds,
     RefCountedPtr<grpc_tls_credentials_options> options) {
   if (server_creds == nullptr) {
-    gpr_log(GPR_ERROR,
-            "server_creds is nullptr in "
-            "TlsServerSecurityConnectorCreate()");
+    LOG(ERROR) << "server_creds is nullptr in "
+                  "TlsServerSecurityConnectorCreate()";
     return nullptr;
   }
   if (options == nullptr) {
-    gpr_log(GPR_ERROR,
-            "options is nullptr in "
-            "TlsServerSecurityConnectorCreate()");
+    LOG(ERROR) << "options is nullptr in "
+                  "TlsServerSecurityConnectorCreate()";
     return nullptr;
   }
   return MakeRefCounted<TlsServerSecurityConnector>(std::move(server_creds),
@@ -633,8 +625,8 @@ void TlsServerSecurityConnector::add_handshakers(
         server_handshaker_factory_, /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0, &tsi_hs);
     if (result != TSI_OK) {
-      gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
-              tsi_result_to_string(result));
+      LOG(ERROR) << "Handshaker creation failed with error "
+                 << tsi_result_to_string(result);
     }
   }
   // If tsi_hs is null, this will add a failing handshaker.
@@ -679,9 +671,8 @@ void TlsServerSecurityConnector::cancel_check_peer(
       if (it != pending_verifier_requests_.end()) {
         pending_verifier_request = it->second->request();
       } else {
-        gpr_log(GPR_INFO,
-                "TlsServerSecurityConnector::cancel_check_peer: no "
-                "corresponding pending request found");
+        LOG(INFO) << "TlsServerSecurityConnector::cancel_check_peer: no "
+                     "corresponding pending request found";
       }
     }
     if (pending_verifier_request != nullptr) {
@@ -701,7 +692,7 @@ int TlsServerSecurityConnector::cmp(
 void TlsServerSecurityConnector::TlsServerCertificateWatcher::
     OnCertificatesChanged(absl::optional<absl::string_view> root_certs,
                           absl::optional<PemKeyCertPairList> key_cert_pairs) {
-  GPR_ASSERT(security_connector_ != nullptr);
+  CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
   if (root_certs.has_value()) {
     security_connector_->pem_root_certs_ = root_certs;
@@ -721,7 +712,7 @@ void TlsServerSecurityConnector::TlsServerCertificateWatcher::
       (!root_being_watched && identity_being_watched && identity_has_value)) {
     if (security_connector_->UpdateHandshakerFactoryLocked() !=
         GRPC_SECURITY_OK) {
-      gpr_log(GPR_ERROR, "Update handshaker factory failed.");
+      LOG(ERROR) << "Update handshaker factory failed.";
     }
   }
 }
@@ -731,14 +722,12 @@ void TlsServerSecurityConnector::TlsServerCertificateWatcher::
 void TlsServerSecurityConnector::TlsServerCertificateWatcher::OnError(
     grpc_error_handle root_cert_error, grpc_error_handle identity_cert_error) {
   if (!root_cert_error.ok()) {
-    gpr_log(GPR_ERROR,
-            "TlsServerCertificateWatcher getting root_cert_error: %s",
-            StatusToString(root_cert_error).c_str());
+    LOG(ERROR) << "TlsServerCertificateWatcher getting root_cert_error: "
+               << StatusToString(root_cert_error);
   }
   if (!identity_cert_error.ok()) {
-    gpr_log(GPR_ERROR,
-            "TlsServerCertificateWatcher getting identity_cert_error: %s",
-            StatusToString(identity_cert_error).c_str());
+    LOG(ERROR) << "TlsServerCertificateWatcher getting identity_cert_error: "
+               << StatusToString(identity_cert_error);
   }
 }
 
@@ -800,8 +789,8 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
     tsi_ssl_server_handshaker_factory_unref(server_handshaker_factory_);
   }
   // The identity certs on the server side shouldn't be empty.
-  GPR_ASSERT(pem_key_cert_pair_list_.has_value());
-  GPR_ASSERT(!(*pem_key_cert_pair_list_).empty());
+  CHECK(pem_key_cert_pair_list_.has_value());
+  CHECK(!(*pem_key_cert_pair_list_).empty());
   std::string pem_root_certs;
   if (pem_root_certs_.has_value()) {
     // TODO(ZhenLian): update the underlying TSI layer to use C++ types like

data/src/core/lib/security/security_connector/tls/tls_security_connector.h

@@ -19,8 +19,6 @@
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H
 #define GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_TLS_TLS_SECURITY_CONNECTOR_H
 
-#include <grpc/support/port_platform.h>
-
 #include <map>
 #include <string>
 
@@ -29,9 +27,12 @@
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
+#include <grpc/support/port_platform.h>
 
+#include "src/core/handshaker/handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/sync.h"
@@ -43,7 +44,6 @@
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
-#include "src/core/lib/transport/handshaker.h"
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"

data/src/core/lib/security/transport/auth_filters.h

@@ -19,12 +19,12 @@
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_TRANSPORT_AUTH_FILTERS_H
 #define GRPC_SRC_CORE_LIB_SECURITY_TRANSPORT_AUTH_FILTERS_H
 
-#include <grpc/support/port_platform.h>
-
 #include "absl/status/statusor.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
+#include <grpc/support/port_platform.h>
 
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
@@ -43,18 +43,18 @@ class ClientAuthFilter final : public ChannelFilter {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ClientAuthFilter> Create(const ChannelArgs& args,
-                                                 ChannelFilter::Args);
+  ClientAuthFilter(
+      RefCountedPtr<grpc_channel_security_connector> security_connector,
+      RefCountedPtr<grpc_auth_context> auth_context);
+
+  static absl::StatusOr<std::unique_ptr<ClientAuthFilter>> Create(
+      const ChannelArgs& args, ChannelFilter::Args);
 
   // Construct a promise for one call.
   ArenaPromise<ServerMetadataHandle> MakeCallPromise(
       CallArgs call_args, NextPromiseFactory next_promise_factory) override;
 
  private:
-  ClientAuthFilter(
-      RefCountedPtr<grpc_channel_security_connector> security_connector,
-      RefCountedPtr<grpc_auth_context> auth_context);
-
   ArenaPromise<absl::StatusOr<CallArgs>> GetCallCredsMetadata(
       CallArgs call_args);
 
@@ -64,9 +64,6 @@ class ClientAuthFilter final : public ChannelFilter {
 
 class ServerAuthFilter final : public ImplementChannelFilter<ServerAuthFilter> {
  private:
-  ServerAuthFilter(RefCountedPtr<grpc_server_credentials> server_credentials,
-                   RefCountedPtr<grpc_auth_context> auth_context);
-
   class RunApplicationCode {
    public:
     RunApplicationCode(ServerAuthFilter* filter, ClientMetadata& metadata);
@@ -99,8 +96,11 @@ class ServerAuthFilter final : public ImplementChannelFilter<ServerAuthFilter> {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ServerAuthFilter> Create(const ChannelArgs& args,
-                                                 ChannelFilter::Args);
+  ServerAuthFilter(RefCountedPtr<grpc_server_credentials> server_credentials,
+                   RefCountedPtr<grpc_auth_context> auth_context);
+
+  static absl::StatusOr<std::unique_ptr<ServerAuthFilter>> Create(
+      const ChannelArgs& args, ChannelFilter::Args);
 
   class Call {
    public:
@@ -115,6 +115,7 @@ class ServerAuthFilter final : public ImplementChannelFilter<ServerAuthFilter> {
     }
     static const NoInterceptor OnServerInitialMetadata;
     static const NoInterceptor OnClientToServerMessage;
+    static const NoInterceptor OnClientToServerHalfClose;
     static const NoInterceptor OnServerToClientMessage;
     static const NoInterceptor OnServerTrailingMetadata;
     static const NoInterceptor OnFinalize;

data/src/core/lib/security/transport/client_auth_filter.cc

@@ -16,8 +16,6 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include <string.h>
 
 #include <functional>
@@ -28,15 +26,16 @@
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
 #include <grpc/support/alloc.h>
+#include <grpc/support/port_platform.h>
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/channel_stack.h"
-#include "src/core/lib/channel/context.h"
 #include "src/core/lib/channel/promise_based_filter.h"
 #include "src/core/lib/channel/status_util.h"
 #include "src/core/lib/gprpp/debug_location.h"
@@ -110,8 +109,7 @@ ClientAuthFilter::ClientAuthFilter(
 
 ArenaPromise<absl::StatusOr<CallArgs>> ClientAuthFilter::GetCallCredsMetadata(
     CallArgs call_args) {
-  auto* ctx = static_cast<grpc_client_security_context*>(
-      GetContext<grpc_call_context_element>()[GRPC_CONTEXT_SECURITY].value);
+  auto* ctx = GetContext<grpc_client_security_context>();
   grpc_call_credentials* channel_call_creds =
       args_.security_connector->mutable_request_metadata_creds();
   const bool call_creds_has_md = (ctx != nullptr) && (ctx->creds != nullptr);
@@ -178,17 +176,13 @@ ArenaPromise<absl::StatusOr<CallArgs>> ClientAuthFilter::GetCallCredsMetadata(
 
 ArenaPromise<ServerMetadataHandle> ClientAuthFilter::MakeCallPromise(
     CallArgs call_args, NextPromiseFactory next_promise_factory) {
-  auto* legacy_ctx = GetContext<grpc_call_context_element>();
-  if (legacy_ctx[GRPC_CONTEXT_SECURITY].value == nullptr) {
-    legacy_ctx[GRPC_CONTEXT_SECURITY].value =
-        grpc_client_security_context_create(GetContext<Arena>(),
-                                            /*creds=*/nullptr);
-    legacy_ctx[GRPC_CONTEXT_SECURITY].destroy =
-        grpc_client_security_context_destroy;
+  auto* sec_ctx = MaybeGetContext<grpc_client_security_context>();
+  if (sec_ctx == nullptr) {
+    sec_ctx = grpc_client_security_context_create(GetContext<Arena>(),
+                                                  /*creds=*/nullptr);
+    SetContext<SecurityContext>(sec_ctx);
   }
-  static_cast<grpc_client_security_context*>(
-      legacy_ctx[GRPC_CONTEXT_SECURITY].value)
-      ->auth_context = args_.auth_context;
+  sec_ctx->auth_context = args_.auth_context;
 
   auto* host =
       call_args.client_initial_metadata->get_pointer(HttpAuthorityMetadata());
@@ -204,7 +198,7 @@ ArenaPromise<ServerMetadataHandle> ClientAuthFilter::MakeCallPromise(
       next_promise_factory);
 }
 
-absl::StatusOr<ClientAuthFilter> ClientAuthFilter::Create(
+absl::StatusOr<std::unique_ptr<ClientAuthFilter>> ClientAuthFilter::Create(
     const ChannelArgs& args, ChannelFilter::Args) {
   auto* sc = args.GetObject<grpc_security_connector>();
   if (sc == nullptr) {
@@ -216,8 +210,9 @@ absl::StatusOr<ClientAuthFilter> ClientAuthFilter::Create(
     return absl::InvalidArgumentError(
         "Auth context missing from client auth filter args");
   }
-  return ClientAuthFilter(sc->RefAsSubclass<grpc_channel_security_connector>(),
-                          auth_context->Ref());
+  return std::make_unique<ClientAuthFilter>(
+      sc->RefAsSubclass<grpc_channel_security_connector>(),
+      auth_context->Ref());
 }
 
 const grpc_channel_filter ClientAuthFilter::kFilter =

data/src/core/lib/security/transport/server_auth_filter.cc

@@ -16,8 +16,6 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include <algorithm>
 #include <atomic>
 #include <cstddef>
@@ -25,19 +23,21 @@
 #include <memory>
 #include <utility>
 
+#include "absl/log/check.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/status.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/channel_stack.h"
-#include "src/core/lib/channel/context.h"
 #include "src/core/lib/channel/promise_based_filter.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gprpp/debug_location.h"
@@ -56,7 +56,6 @@
 #include "src/core/lib/security/transport/auth_filters.h"  // IWYU pragma: keep
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"
-#include "src/core/lib/surface/call_trace.h"
 #include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/lib/transport/transport.h"
 
@@ -67,6 +66,7 @@ const grpc_channel_filter ServerAuthFilter::kFilter =
         "server-auth");
 
 const NoInterceptor ServerAuthFilter::Call::OnClientToServerMessage;
+const NoInterceptor ServerAuthFilter::Call::OnClientToServerHalfClose;
 const NoInterceptor ServerAuthFilter::Call::OnServerToClientMessage;
 const NoInterceptor ServerAuthFilter::Call::OnServerInitialMetadata;
 const NoInterceptor ServerAuthFilter::Call::OnServerTrailingMetadata;
@@ -132,7 +132,7 @@ struct ServerAuthFilter::RunApplicationCode::State {
 ServerAuthFilter::RunApplicationCode::RunApplicationCode(
     ServerAuthFilter* filter, ClientMetadata& metadata)
     : state_(GetContext<Arena>()->ManagedNew<State>(metadata)) {
-  if (grpc_call_trace.enabled()) {
+  if (GRPC_TRACE_FLAG_ENABLED(call)) {
     gpr_log(GPR_ERROR,
             "%s[server-auth]: Delegate to application: filter=%p this=%p "
             "auth_ctx=%p",
@@ -201,11 +201,7 @@ ServerAuthFilter::Call::Call(ServerAuthFilter* filter) {
       grpc_server_security_context_create(GetContext<Arena>());
   server_ctx->auth_context =
       filter->auth_context_->Ref(DEBUG_LOCATION, "server_auth_filter");
-  grpc_call_context_element& context =
-      GetContext<grpc_call_context_element>()[GRPC_CONTEXT_SECURITY];
-  if (context.value != nullptr) context.destroy(context.value);
-  context.value = server_ctx;
-  context.destroy = grpc_server_security_context_destroy;
+  SetContext<SecurityContext>(server_ctx);
 }
 
 ServerAuthFilter::ServerAuthFilter(
@@ -213,12 +209,13 @@ ServerAuthFilter::ServerAuthFilter(
     RefCountedPtr<grpc_auth_context> auth_context)
     : server_credentials_(server_credentials), auth_context_(auth_context) {}
 
-absl::StatusOr<ServerAuthFilter> ServerAuthFilter::Create(
+absl::StatusOr<std::unique_ptr<ServerAuthFilter>> ServerAuthFilter::Create(
     const ChannelArgs& args, ChannelFilter::Args) {
   auto auth_context = args.GetObjectRef<grpc_auth_context>();
-  GPR_ASSERT(auth_context != nullptr);
+  CHECK(auth_context != nullptr);
   auto creds = args.GetObjectRef<grpc_server_credentials>();
-  return ServerAuthFilter(std::move(creds), std::move(auth_context));
+  return std::make_unique<ServerAuthFilter>(std::move(creds),
+                                            std::move(auth_context));
 }
 
 }  // namespace grpc_core

data/src/core/lib/security/util/json_util.cc

@@ -16,8 +16,6 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/lib/security/util/json_util.h"
 
 #include <map>
@@ -27,6 +25,7 @@
 #include "absl/strings/str_cat.h"
 
 #include <grpc/support/json.h>
+#include <grpc/support/port_platform.h>
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/iomgr/error.h"

data/src/core/lib/security/util/json_util.h

@@ -22,7 +22,7 @@
 #include <grpc/support/port_platform.h>
 
 #include "src/core/lib/iomgr/error.h"
-#include "src/core/lib/json/json.h"
+#include "src/core/util/json/json.h"
 
 // Constants.
 #define GRPC_AUTH_JSON_TYPE_INVALID "invalid"

data/src/core/lib/slice/percent_encoding.cc

@@ -16,8 +16,6 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/lib/slice/percent_encoding.h"
 
 #include <stdlib.h>
@@ -25,7 +23,10 @@
 #include <cstdint>
 #include <utility>
 
+#include "absl/log/check.h"
+
 #include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 
 #include "src/core/lib/gprpp/bitset.h"
 
@@ -101,7 +102,7 @@ Slice PercentEncodeSlice(Slice slice, PercentEncodingType type) {
       *q++ = hex[c & 15];
     }
   }
-  GPR_ASSERT(q == out.end());
+  CHECK(q == out.end());
   return Slice(std::move(out));
 }
 

data/src/core/lib/slice/slice.cc

@@ -16,17 +16,18 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/lib/slice/slice.h"
 
 #include <string.h>
 
 #include <new>
 
+#include "absl/log/check.h"
+
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/slice/slice_internal.h"
@@ -245,11 +246,11 @@ static grpc_slice sub_no_ref(const grpc_slice& source, size_t begin,
                              size_t end) {
   grpc_slice subset;
 
-  GPR_ASSERT(end >= begin);
+  CHECK(end >= begin);
 
   if (source.refcount != nullptr) {
     // Enforce preconditions
-    GPR_ASSERT(source.data.refcounted.length >= end);
+    CHECK(source.data.refcounted.length >= end);
 
     // Build the result
     subset.refcount = source.refcount;
@@ -258,7 +259,7 @@ static grpc_slice sub_no_ref(const grpc_slice& source, size_t begin,
     subset.data.refcounted.length = end - begin;
   } else {
     // Enforce preconditions
-    GPR_ASSERT(source.data.inlined.length >= end);
+    CHECK(source.data.inlined.length >= end);
     subset.refcount = nullptr;
     subset.data.inlined.length = static_cast<uint8_t>(end - begin);
     memcpy(subset.data.inlined.bytes, source.data.inlined.bytes + begin,
@@ -297,7 +298,7 @@ grpc_slice grpc_slice_split_tail_maybe_ref_impl(grpc_slice* source,
 
   if (source->refcount == nullptr) {
     // inlined data, copy it out
-    GPR_ASSERT(source->data.inlined.length >= split);
+    CHECK(source->data.inlined.length >= split);
     tail.refcount = nullptr;
     tail.data.inlined.length =
         static_cast<uint8_t>(source->data.inlined.length - split);
@@ -312,7 +313,7 @@ grpc_slice grpc_slice_split_tail_maybe_ref_impl(grpc_slice* source,
     source->data.refcounted.length = split;
   } else {
     size_t tail_length = source->data.refcounted.length - split;
-    GPR_ASSERT(source->data.refcounted.length >= split);
+    CHECK(source->data.refcounted.length >= split);
     if (allow_inline && tail_length < sizeof(tail.data.inlined.bytes) &&
         ref_whom != GRPC_SLICE_REF_TAIL) {
       // Copy out the bytes - it'll be cheaper than refcounting
@@ -372,7 +373,7 @@ grpc_slice grpc_slice_split_head_impl(grpc_slice* source, size_t split) {
   grpc_slice head;
 
   if (source->refcount == nullptr) {
-    GPR_ASSERT(source->data.inlined.length >= split);
+    CHECK(source->data.inlined.length >= split);
 
     head.refcount = nullptr;
     head.data.inlined.length = static_cast<uint8_t>(split);
@@ -382,7 +383,7 @@ grpc_slice grpc_slice_split_head_impl(grpc_slice* source, size_t split) {
     memmove(source->data.inlined.bytes, source->data.inlined.bytes + split,
             source->data.inlined.length);
   } else if (allow_inline && split < sizeof(head.data.inlined.bytes)) {
-    GPR_ASSERT(source->data.refcounted.length >= split);
+    CHECK(source->data.refcounted.length >= split);
 
     head.refcount = nullptr;
     head.data.inlined.length = static_cast<uint8_t>(split);
@@ -390,7 +391,7 @@ grpc_slice grpc_slice_split_head_impl(grpc_slice* source, size_t split) {
     source->data.refcounted.bytes += split;
     source->data.refcounted.length -= split;
   } else {
-    GPR_ASSERT(source->data.refcounted.length >= split);
+    CHECK(source->data.refcounted.length >= split);
 
     // Build the result
     head.refcount = source->refcount;