grpc 1.7.3 → 1.8.0

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.h

@@ -22,57 +22,61 @@
 #include "src/core/lib/json/json.h"
 #include "src/core/lib/security/credentials/credentials.h"
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 // auth_refresh_token parsing.
 typedef struct {
-  const char *type;
-  char *client_id;
-  char *client_secret;
-  char *refresh_token;
+  const char* type;
+  char* client_id;
+  char* client_secret;
+  char* refresh_token;
 } grpc_auth_refresh_token;
 
 /// Returns 1 if the object is valid, 0 otherwise.
 int grpc_auth_refresh_token_is_valid(
-    const grpc_auth_refresh_token *refresh_token);
+    const grpc_auth_refresh_token* refresh_token);
 
 /// Creates a refresh token object from string. Returns an invalid object if a
 /// parsing error has been encountered.
 grpc_auth_refresh_token grpc_auth_refresh_token_create_from_string(
-    const char *json_string);
+    const char* json_string);
 
 /// Creates a refresh token object from parsed json. Returns an invalid object
 /// if a parsing error has been encountered.
 grpc_auth_refresh_token grpc_auth_refresh_token_create_from_json(
-    const grpc_json *json);
+    const grpc_json* json);
 
 /// Destructs the object.
-void grpc_auth_refresh_token_destruct(grpc_auth_refresh_token *refresh_token);
+void grpc_auth_refresh_token_destruct(grpc_auth_refresh_token* refresh_token);
 
 // -- Oauth2 Token Fetcher credentials --
 //
 //  This object is a base for credentials that need to acquire an oauth2 token
 //  from an http service.
 
-typedef void (*grpc_fetch_oauth2_func)(grpc_exec_ctx *exec_ctx,
-                                       grpc_credentials_metadata_request *req,
-                                       grpc_httpcli_context *http_context,
-                                       grpc_polling_entity *pollent,
+typedef void (*grpc_fetch_oauth2_func)(grpc_exec_ctx* exec_ctx,
+                                       grpc_credentials_metadata_request* req,
+                                       grpc_httpcli_context* http_context,
+                                       grpc_polling_entity* pollent,
                                        grpc_iomgr_cb_func cb,
-                                       gpr_timespec deadline);
+                                       grpc_millis deadline);
 
 typedef struct grpc_oauth2_pending_get_request_metadata {
-  grpc_credentials_mdelem_array *md_array;
-  grpc_closure *on_request_metadata;
-  grpc_polling_entity *pollent;
-  struct grpc_oauth2_pending_get_request_metadata *next;
+  grpc_credentials_mdelem_array* md_array;
+  grpc_closure* on_request_metadata;
+  grpc_polling_entity* pollent;
+  struct grpc_oauth2_pending_get_request_metadata* next;
 } grpc_oauth2_pending_get_request_metadata;
 
 typedef struct {
   grpc_call_credentials base;
   gpr_mu mu;
   grpc_mdelem access_token_md;
-  gpr_timespec token_expiration;
+  grpc_millis token_expiration;
   bool token_fetch_pending;
-  grpc_oauth2_pending_get_request_metadata *pending_requests;
+  grpc_oauth2_pending_get_request_metadata* pending_requests;
   grpc_httpcli_context httpcli_context;
   grpc_fetch_oauth2_func fetch_func;
   grpc_polling_entity pollent;
@@ -92,14 +96,18 @@ typedef struct {
 
 // Private constructor for refresh token credentials from an already parsed
 // refresh token. Takes ownership of the refresh token.
-grpc_call_credentials *
+grpc_call_credentials*
 grpc_refresh_token_credentials_create_from_auth_refresh_token(
     grpc_auth_refresh_token token);
 
 // Exposed for testing only.
 grpc_credentials_status
 grpc_oauth2_token_fetcher_credentials_parse_server_response(
-    grpc_exec_ctx *exec_ctx, const struct grpc_http_response *response,
-    grpc_mdelem *token_md, gpr_timespec *token_lifetime);
+    grpc_exec_ctx* exec_ctx, const struct grpc_http_response* response,
+    grpc_mdelem* token_md, grpc_millis* token_lifetime);
+
+#ifdef __cplusplus
+}
+#endif
 
 #endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_OAUTH2_OAUTH2_CREDENTIALS_H */

data/src/core/lib/security/credentials/plugin/{plugin_credentials.c → plugin_credentials.cc}

@@ -31,27 +31,26 @@
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/surface/validate_metadata.h"
 
-grpc_tracer_flag grpc_plugin_credentials_trace =
-    GRPC_TRACER_INITIALIZER(false, "plugin_credentials");
+grpc_core::TraceFlag grpc_plugin_credentials_trace(false, "plugin_credentials");
 
-static void plugin_destruct(grpc_exec_ctx *exec_ctx,
-                            grpc_call_credentials *creds) {
-  grpc_plugin_credentials *c = (grpc_plugin_credentials *)creds;
+static void plugin_destruct(grpc_exec_ctx* exec_ctx,
+                            grpc_call_credentials* creds) {
+  grpc_plugin_credentials* c = (grpc_plugin_credentials*)creds;
   gpr_mu_destroy(&c->mu);
-  if (c->plugin.state != NULL && c->plugin.destroy != NULL) {
+  if (c->plugin.state != nullptr && c->plugin.destroy != nullptr) {
     c->plugin.destroy(c->plugin.state);
   }
 }
 
 static void pending_request_remove_locked(
-    grpc_plugin_credentials *c,
-    grpc_plugin_credentials_pending_request *pending_request) {
-  if (pending_request->prev == NULL) {
+    grpc_plugin_credentials* c,
+    grpc_plugin_credentials_pending_request* pending_request) {
+  if (pending_request->prev == nullptr) {
     c->pending_requests = pending_request->next;
   } else {
     pending_request->prev->next = pending_request->next;
   }
-  if (pending_request->next != NULL) {
+  if (pending_request->next != nullptr) {
     pending_request->next->prev = pending_request->prev;
   }
 }
@@ -62,7 +61,7 @@ static void pending_request_remove_locked(
 // When this returns, r->cancelled indicates whether the request was
 // cancelled before completion.
 static void pending_request_complete(
-    grpc_exec_ctx *exec_ctx, grpc_plugin_credentials_pending_request *r) {
+    grpc_exec_ctx* exec_ctx, grpc_plugin_credentials_pending_request* r) {
   gpr_mu_lock(&r->creds->mu);
   if (!r->cancelled) pending_request_remove_locked(r->creds, r);
   gpr_mu_unlock(&r->creds->mu);
@@ -70,13 +69,13 @@ static void pending_request_complete(
   grpc_call_credentials_unref(exec_ctx, &r->creds->base);
 }
 
-static grpc_error *process_plugin_result(
-    grpc_exec_ctx *exec_ctx, grpc_plugin_credentials_pending_request *r,
-    const grpc_metadata *md, size_t num_md, grpc_status_code status,
-    const char *error_details) {
-  grpc_error *error = GRPC_ERROR_NONE;
+static grpc_error* process_plugin_result(
+    grpc_exec_ctx* exec_ctx, grpc_plugin_credentials_pending_request* r,
+    const grpc_metadata* md, size_t num_md, grpc_status_code status,
+    const char* error_details) {
+  grpc_error* error = GRPC_ERROR_NONE;
   if (status != GRPC_STATUS_OK) {
-    char *msg;
+    char* msg;
     gpr_asprintf(&msg, "Getting metadata from plugin failed with error: %s",
                  error_details);
     error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
@@ -112,18 +111,18 @@ static grpc_error *process_plugin_result(
   return error;
 }
 
-static void plugin_md_request_metadata_ready(void *request,
-                                             const grpc_metadata *md,
+static void plugin_md_request_metadata_ready(void* request,
+                                             const grpc_metadata* md,
                                              size_t num_md,
                                              grpc_status_code status,
-                                             const char *error_details) {
+                                             const char* error_details) {
   /* called from application code */
   grpc_exec_ctx exec_ctx = GRPC_EXEC_CTX_INITIALIZER(
       GRPC_EXEC_CTX_FLAG_IS_FINISHED | GRPC_EXEC_CTX_FLAG_THREAD_RESOURCE_LOOP,
-      NULL, NULL);
-  grpc_plugin_credentials_pending_request *r =
-      (grpc_plugin_credentials_pending_request *)request;
-  if (GRPC_TRACER_ON(grpc_plugin_credentials_trace)) {
+      nullptr, nullptr);
+  grpc_plugin_credentials_pending_request* r =
+      (grpc_plugin_credentials_pending_request*)request;
+  if (grpc_plugin_credentials_trace.enabled()) {
     gpr_log(GPR_INFO,
             "plugin_credentials[%p]: request %p: plugin returned "
             "asynchronously",
@@ -133,10 +132,10 @@ static void plugin_md_request_metadata_ready(void *request,
   pending_request_complete(&exec_ctx, r);
   // If it has not been cancelled, process it.
   if (!r->cancelled) {
-    grpc_error *error =
+    grpc_error* error =
         process_plugin_result(&exec_ctx, r, md, num_md, status, error_details);
     GRPC_CLOSURE_SCHED(&exec_ctx, r->on_request_metadata, error);
-  } else if (GRPC_TRACER_ON(grpc_plugin_credentials_trace)) {
+  } else if (grpc_plugin_credentials_trace.enabled()) {
     gpr_log(GPR_INFO,
             "plugin_credentials[%p]: request %p: plugin was previously "
             "cancelled",
@@ -146,33 +145,33 @@ static void plugin_md_request_metadata_ready(void *request,
   grpc_exec_ctx_finish(&exec_ctx);
 }
 
-static bool plugin_get_request_metadata(grpc_exec_ctx *exec_ctx,
-                                        grpc_call_credentials *creds,
-                                        grpc_polling_entity *pollent,
+static bool plugin_get_request_metadata(grpc_exec_ctx* exec_ctx,
+                                        grpc_call_credentials* creds,
+                                        grpc_polling_entity* pollent,
                                         grpc_auth_metadata_context context,
-                                        grpc_credentials_mdelem_array *md_array,
-                                        grpc_closure *on_request_metadata,
-                                        grpc_error **error) {
-  grpc_plugin_credentials *c = (grpc_plugin_credentials *)creds;
+                                        grpc_credentials_mdelem_array* md_array,
+                                        grpc_closure* on_request_metadata,
+                                        grpc_error** error) {
+  grpc_plugin_credentials* c = (grpc_plugin_credentials*)creds;
   bool retval = true;  // Synchronous return.
-  if (c->plugin.get_metadata != NULL) {
+  if (c->plugin.get_metadata != nullptr) {
     // Create pending_request object.
-    grpc_plugin_credentials_pending_request *pending_request =
-        (grpc_plugin_credentials_pending_request *)gpr_zalloc(
+    grpc_plugin_credentials_pending_request* pending_request =
+        (grpc_plugin_credentials_pending_request*)gpr_zalloc(
             sizeof(*pending_request));
     pending_request->creds = c;
     pending_request->md_array = md_array;
     pending_request->on_request_metadata = on_request_metadata;
     // Add it to the pending list.
     gpr_mu_lock(&c->mu);
-    if (c->pending_requests != NULL) {
+    if (c->pending_requests != nullptr) {
       c->pending_requests->prev = pending_request;
     }
     pending_request->next = c->pending_requests;
     c->pending_requests = pending_request;
     gpr_mu_unlock(&c->mu);
     // Invoke the plugin.  The callback holds a ref to us.
-    if (GRPC_TRACER_ON(grpc_plugin_credentials_trace)) {
+    if (grpc_plugin_credentials_trace.enabled()) {
       gpr_log(GPR_INFO, "plugin_credentials[%p]: request %p: invoking plugin",
               c, pending_request);
     }
@@ -180,12 +179,12 @@ static bool plugin_get_request_metadata(grpc_exec_ctx *exec_ctx,
     grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX];
     size_t num_creds_md = 0;
     grpc_status_code status = GRPC_STATUS_OK;
-    const char *error_details = NULL;
+    const char* error_details = nullptr;
     if (!c->plugin.get_metadata(c->plugin.state, context,
                                 plugin_md_request_metadata_ready,
                                 pending_request, creds_md, &num_creds_md,
                                 &status, &error_details)) {
-      if (GRPC_TRACER_ON(grpc_plugin_credentials_trace)) {
+      if (grpc_plugin_credentials_trace.enabled()) {
         gpr_log(GPR_INFO,
                 "plugin_credentials[%p]: request %p: plugin will return "
                 "asynchronously",
@@ -200,7 +199,7 @@ static bool plugin_get_request_metadata(grpc_exec_ctx *exec_ctx,
     // asynchronously by plugin_cancel_get_request_metadata(), so return
     // false.  Otherwise, process the result.
     if (pending_request->cancelled) {
-      if (GRPC_TRACER_ON(grpc_plugin_credentials_trace)) {
+      if (grpc_plugin_credentials_trace.enabled()) {
         gpr_log(GPR_INFO,
                 "plugin_credentials[%p]: request %p was cancelled, error "
                 "will be returned asynchronously",
@@ -208,7 +207,7 @@ static bool plugin_get_request_metadata(grpc_exec_ctx *exec_ctx,
       }
       retval = false;
     } else {
-      if (GRPC_TRACER_ON(grpc_plugin_credentials_trace)) {
+      if (grpc_plugin_credentials_trace.enabled()) {
         gpr_log(GPR_INFO,
                 "plugin_credentials[%p]: request %p: plugin returned "
                 "synchronously",
@@ -222,22 +221,22 @@ static bool plugin_get_request_metadata(grpc_exec_ctx *exec_ctx,
       grpc_slice_unref_internal(exec_ctx, creds_md[i].key);
       grpc_slice_unref_internal(exec_ctx, creds_md[i].value);
     }
-    gpr_free((void *)error_details);
+    gpr_free((void*)error_details);
     gpr_free(pending_request);
   }
   return retval;
 }
 
 static void plugin_cancel_get_request_metadata(
-    grpc_exec_ctx *exec_ctx, grpc_call_credentials *creds,
-    grpc_credentials_mdelem_array *md_array, grpc_error *error) {
-  grpc_plugin_credentials *c = (grpc_plugin_credentials *)creds;
+    grpc_exec_ctx* exec_ctx, grpc_call_credentials* creds,
+    grpc_credentials_mdelem_array* md_array, grpc_error* error) {
+  grpc_plugin_credentials* c = (grpc_plugin_credentials*)creds;
   gpr_mu_lock(&c->mu);
-  for (grpc_plugin_credentials_pending_request *pending_request =
+  for (grpc_plugin_credentials_pending_request* pending_request =
            c->pending_requests;
-       pending_request != NULL; pending_request = pending_request->next) {
+       pending_request != nullptr; pending_request = pending_request->next) {
     if (pending_request->md_array == md_array) {
-      if (GRPC_TRACER_ON(grpc_plugin_credentials_trace)) {
+      if (grpc_plugin_credentials_trace.enabled()) {
         gpr_log(GPR_INFO, "plugin_credentials[%p]: cancelling request %p", c,
                 pending_request);
       }
@@ -256,12 +255,12 @@ static grpc_call_credentials_vtable plugin_vtable = {
     plugin_destruct, plugin_get_request_metadata,
     plugin_cancel_get_request_metadata};
 
-grpc_call_credentials *grpc_metadata_credentials_create_from_plugin(
-    grpc_metadata_credentials_plugin plugin, void *reserved) {
-  grpc_plugin_credentials *c = gpr_zalloc(sizeof(*c));
+grpc_call_credentials* grpc_metadata_credentials_create_from_plugin(
+    grpc_metadata_credentials_plugin plugin, void* reserved) {
+  grpc_plugin_credentials* c = (grpc_plugin_credentials*)gpr_zalloc(sizeof(*c));
   GRPC_API_TRACE("grpc_metadata_credentials_create_from_plugin(reserved=%p)", 1,
                  (reserved));
-  GPR_ASSERT(reserved == NULL);
+  GPR_ASSERT(reserved == nullptr);
   c->base.type = plugin.type;
   c->base.vtable = &plugin_vtable;
   gpr_ref_init(&c->base.refcount, 1);

data/src/core/lib/security/credentials/plugin/plugin_credentials.h

@@ -21,24 +21,24 @@
 
 #include "src/core/lib/security/credentials/credentials.h"
 
-extern grpc_tracer_flag grpc_plugin_credentials_trace;
+extern grpc_core::TraceFlag grpc_plugin_credentials_trace;
 
 struct grpc_plugin_credentials;
 
 typedef struct grpc_plugin_credentials_pending_request {
   bool cancelled;
-  struct grpc_plugin_credentials *creds;
-  grpc_credentials_mdelem_array *md_array;
-  grpc_closure *on_request_metadata;
-  struct grpc_plugin_credentials_pending_request *prev;
-  struct grpc_plugin_credentials_pending_request *next;
+  struct grpc_plugin_credentials* creds;
+  grpc_credentials_mdelem_array* md_array;
+  grpc_closure* on_request_metadata;
+  struct grpc_plugin_credentials_pending_request* prev;
+  struct grpc_plugin_credentials_pending_request* next;
 } grpc_plugin_credentials_pending_request;
 
 typedef struct grpc_plugin_credentials {
   grpc_call_credentials base;
   grpc_metadata_credentials_plugin plugin;
   gpr_mu mu;
-  grpc_plugin_credentials_pending_request *pending_requests;
+  grpc_plugin_credentials_pending_request* pending_requests;
 } grpc_plugin_credentials;
 
 #endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_PLUGIN_PLUGIN_CREDENTIALS_H */

data/src/core/lib/security/credentials/ssl/ssl_credentials.cc

@@ -0,0 +1,344 @@
+/*
+ *
+ * Copyright 2016 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include "src/core/lib/security/credentials/ssl/ssl_credentials.h"
+
+#include <string.h>
+
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/surface/api_trace.h"
+
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
+//
+// SSL Channel Credentials.
+//
+
+void grpc_tsi_ssl_pem_key_cert_pairs_destroy(tsi_ssl_pem_key_cert_pair* kp,
+                                             size_t num_key_cert_pairs) {
+  if (kp == nullptr) return;
+  for (size_t i = 0; i < num_key_cert_pairs; i++) {
+    gpr_free((void*)kp[i].private_key);
+    gpr_free((void*)kp[i].cert_chain);
+  }
+  gpr_free(kp);
+}
+
+static void ssl_destruct(grpc_exec_ctx* exec_ctx,
+                         grpc_channel_credentials* creds) {
+  grpc_ssl_credentials* c = (grpc_ssl_credentials*)creds;
+  gpr_free(c->config.pem_root_certs);
+  grpc_tsi_ssl_pem_key_cert_pairs_destroy(c->config.pem_key_cert_pair, 1);
+}
+
+static grpc_security_status ssl_create_security_connector(
+    grpc_exec_ctx* exec_ctx, grpc_channel_credentials* creds,
+    grpc_call_credentials* call_creds, const char* target,
+    const grpc_channel_args* args, grpc_channel_security_connector** sc,
+    grpc_channel_args** new_args) {
+  grpc_ssl_credentials* c = (grpc_ssl_credentials*)creds;
+  grpc_security_status status = GRPC_SECURITY_OK;
+  const char* overridden_target_name = nullptr;
+  for (size_t i = 0; args && i < args->num_args; i++) {
+    grpc_arg* arg = &args->args[i];
+    if (strcmp(arg->key, GRPC_SSL_TARGET_NAME_OVERRIDE_ARG) == 0 &&
+        arg->type == GRPC_ARG_STRING) {
+      overridden_target_name = arg->value.string;
+      break;
+    }
+  }
+  status = grpc_ssl_channel_security_connector_create(
+      exec_ctx, creds, call_creds, &c->config, target, overridden_target_name,
+      sc);
+  if (status != GRPC_SECURITY_OK) {
+    return status;
+  }
+  grpc_arg new_arg = grpc_channel_arg_string_create(
+      (char*)GRPC_ARG_HTTP2_SCHEME, (char*)"https");
+  *new_args = grpc_channel_args_copy_and_add(args, &new_arg, 1);
+  return status;
+}
+
+static grpc_channel_credentials_vtable ssl_vtable = {
+    ssl_destruct, ssl_create_security_connector, nullptr};
+
+static void ssl_build_config(const char* pem_root_certs,
+                             grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
+                             grpc_ssl_config* config) {
+  if (pem_root_certs != nullptr) {
+    config->pem_root_certs = gpr_strdup(pem_root_certs);
+  }
+  if (pem_key_cert_pair != nullptr) {
+    GPR_ASSERT(pem_key_cert_pair->private_key != nullptr);
+    GPR_ASSERT(pem_key_cert_pair->cert_chain != nullptr);
+    config->pem_key_cert_pair = (tsi_ssl_pem_key_cert_pair*)gpr_zalloc(
+        sizeof(tsi_ssl_pem_key_cert_pair));
+    config->pem_key_cert_pair->cert_chain =
+        gpr_strdup(pem_key_cert_pair->cert_chain);
+    config->pem_key_cert_pair->private_key =
+        gpr_strdup(pem_key_cert_pair->private_key);
+  }
+}
+
+grpc_channel_credentials* grpc_ssl_credentials_create(
+    const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
+    void* reserved) {
+  grpc_ssl_credentials* c =
+      (grpc_ssl_credentials*)gpr_zalloc(sizeof(grpc_ssl_credentials));
+  GRPC_API_TRACE(
+      "grpc_ssl_credentials_create(pem_root_certs=%s, "
+      "pem_key_cert_pair=%p, "
+      "reserved=%p)",
+      3, (pem_root_certs, pem_key_cert_pair, reserved));
+  GPR_ASSERT(reserved == nullptr);
+  c->base.type = GRPC_CHANNEL_CREDENTIALS_TYPE_SSL;
+  c->base.vtable = &ssl_vtable;
+  gpr_ref_init(&c->base.refcount, 1);
+  ssl_build_config(pem_root_certs, pem_key_cert_pair, &c->config);
+  return &c->base;
+}
+
+//
+// SSL Server Credentials.
+//
+
+struct grpc_ssl_server_credentials_options {
+  grpc_ssl_client_certificate_request_type client_certificate_request;
+  grpc_ssl_server_certificate_config* certificate_config;
+  grpc_ssl_server_certificate_config_fetcher* certificate_config_fetcher;
+};
+
+static void ssl_server_destruct(grpc_exec_ctx* exec_ctx,
+                                grpc_server_credentials* creds) {
+  grpc_ssl_server_credentials* c = (grpc_ssl_server_credentials*)creds;
+  grpc_tsi_ssl_pem_key_cert_pairs_destroy(c->config.pem_key_cert_pairs,
+                                          c->config.num_key_cert_pairs);
+  gpr_free(c->config.pem_root_certs);
+}
+
+static grpc_security_status ssl_server_create_security_connector(
+    grpc_exec_ctx* exec_ctx, grpc_server_credentials* creds,
+    grpc_server_security_connector** sc) {
+  return grpc_ssl_server_security_connector_create(exec_ctx, creds, sc);
+}
+
+static grpc_server_credentials_vtable ssl_server_vtable = {
+    ssl_server_destruct, ssl_server_create_security_connector};
+
+tsi_ssl_pem_key_cert_pair* grpc_convert_grpc_to_tsi_cert_pairs(
+    const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
+    size_t num_key_cert_pairs) {
+  tsi_ssl_pem_key_cert_pair* tsi_pairs = nullptr;
+  if (num_key_cert_pairs > 0) {
+    GPR_ASSERT(pem_key_cert_pairs != nullptr);
+    tsi_pairs = (tsi_ssl_pem_key_cert_pair*)gpr_zalloc(
+        num_key_cert_pairs * sizeof(tsi_ssl_pem_key_cert_pair));
+  }
+  for (size_t i = 0; i < num_key_cert_pairs; i++) {
+    GPR_ASSERT(pem_key_cert_pairs[i].private_key != nullptr);
+    GPR_ASSERT(pem_key_cert_pairs[i].cert_chain != nullptr);
+    tsi_pairs[i].cert_chain = gpr_strdup(pem_key_cert_pairs[i].cert_chain);
+    tsi_pairs[i].private_key = gpr_strdup(pem_key_cert_pairs[i].private_key);
+  }
+  return tsi_pairs;
+}
+
+static void ssl_build_server_config(
+    const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
+    size_t num_key_cert_pairs,
+    grpc_ssl_client_certificate_request_type client_certificate_request,
+    grpc_ssl_server_config* config) {
+  config->client_certificate_request = client_certificate_request;
+  if (pem_root_certs != nullptr) {
+    config->pem_root_certs = gpr_strdup(pem_root_certs);
+  }
+  config->pem_key_cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
+      pem_key_cert_pairs, num_key_cert_pairs);
+  config->num_key_cert_pairs = num_key_cert_pairs;
+}
+
+grpc_ssl_server_certificate_config* grpc_ssl_server_certificate_config_create(
+    const char* pem_root_certs,
+    const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
+    size_t num_key_cert_pairs) {
+  grpc_ssl_server_certificate_config* config =
+      (grpc_ssl_server_certificate_config*)gpr_zalloc(
+          sizeof(grpc_ssl_server_certificate_config));
+  if (pem_root_certs != nullptr) {
+    config->pem_root_certs = gpr_strdup(pem_root_certs);
+  }
+  if (num_key_cert_pairs > 0) {
+    GPR_ASSERT(pem_key_cert_pairs != nullptr);
+    config->pem_key_cert_pairs = (grpc_ssl_pem_key_cert_pair*)gpr_zalloc(
+        num_key_cert_pairs * sizeof(grpc_ssl_pem_key_cert_pair));
+  }
+  config->num_key_cert_pairs = num_key_cert_pairs;
+  for (size_t i = 0; i < num_key_cert_pairs; i++) {
+    GPR_ASSERT(pem_key_cert_pairs[i].private_key != nullptr);
+    GPR_ASSERT(pem_key_cert_pairs[i].cert_chain != nullptr);
+    config->pem_key_cert_pairs[i].cert_chain =
+        gpr_strdup(pem_key_cert_pairs[i].cert_chain);
+    config->pem_key_cert_pairs[i].private_key =
+        gpr_strdup(pem_key_cert_pairs[i].private_key);
+  }
+  return config;
+}
+
+void grpc_ssl_server_certificate_config_destroy(
+    grpc_ssl_server_certificate_config* config) {
+  if (config == nullptr) return;
+  for (size_t i = 0; i < config->num_key_cert_pairs; i++) {
+    gpr_free((void*)config->pem_key_cert_pairs[i].private_key);
+    gpr_free((void*)config->pem_key_cert_pairs[i].cert_chain);
+  }
+  gpr_free(config->pem_key_cert_pairs);
+  gpr_free(config->pem_root_certs);
+  gpr_free(config);
+}
+
+grpc_ssl_server_credentials_options*
+grpc_ssl_server_credentials_create_options_using_config(
+    grpc_ssl_client_certificate_request_type client_certificate_request,
+    grpc_ssl_server_certificate_config* config) {
+  grpc_ssl_server_credentials_options* options = nullptr;
+  if (config == nullptr) {
+    gpr_log(GPR_ERROR, "Certificate config must not be NULL.");
+    goto done;
+  }
+  options = (grpc_ssl_server_credentials_options*)gpr_zalloc(
+      sizeof(grpc_ssl_server_credentials_options));
+  options->client_certificate_request = client_certificate_request;
+  options->certificate_config = config;
+done:
+  return options;
+}
+
+grpc_ssl_server_credentials_options*
+grpc_ssl_server_credentials_create_options_using_config_fetcher(
+    grpc_ssl_client_certificate_request_type client_certificate_request,
+    grpc_ssl_server_certificate_config_callback cb, void* user_data) {
+  if (cb == nullptr) {
+    gpr_log(GPR_ERROR, "Invalid certificate config callback parameter.");
+    return nullptr;
+  }
+
+  grpc_ssl_server_certificate_config_fetcher* fetcher =
+      (grpc_ssl_server_certificate_config_fetcher*)gpr_zalloc(
+          sizeof(grpc_ssl_server_certificate_config_fetcher));
+  fetcher->cb = cb;
+  fetcher->user_data = user_data;
+
+  grpc_ssl_server_credentials_options* options =
+      (grpc_ssl_server_credentials_options*)gpr_zalloc(
+          sizeof(grpc_ssl_server_credentials_options));
+  options->client_certificate_request = client_certificate_request;
+  options->certificate_config_fetcher = fetcher;
+
+  return options;
+}
+
+grpc_server_credentials* grpc_ssl_server_credentials_create(
+    const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
+    size_t num_key_cert_pairs, int force_client_auth, void* reserved) {
+  return grpc_ssl_server_credentials_create_ex(
+      pem_root_certs, pem_key_cert_pairs, num_key_cert_pairs,
+      force_client_auth
+          ? GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY
+          : GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE,
+      reserved);
+}
+
+grpc_server_credentials* grpc_ssl_server_credentials_create_ex(
+    const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
+    size_t num_key_cert_pairs,
+    grpc_ssl_client_certificate_request_type client_certificate_request,
+    void* reserved) {
+  GRPC_API_TRACE(
+      "grpc_ssl_server_credentials_create_ex("
+      "pem_root_certs=%s, pem_key_cert_pairs=%p, num_key_cert_pairs=%lu, "
+      "client_certificate_request=%d, reserved=%p)",
+      5,
+      (pem_root_certs, pem_key_cert_pairs, (unsigned long)num_key_cert_pairs,
+       client_certificate_request, reserved));
+  GPR_ASSERT(reserved == nullptr);
+
+  grpc_ssl_server_certificate_config* cert_config =
+      grpc_ssl_server_certificate_config_create(
+          pem_root_certs, pem_key_cert_pairs, num_key_cert_pairs);
+  grpc_ssl_server_credentials_options* options =
+      grpc_ssl_server_credentials_create_options_using_config(
+          client_certificate_request, cert_config);
+
+  return grpc_ssl_server_credentials_create_with_options(options);
+}
+
+grpc_server_credentials* grpc_ssl_server_credentials_create_with_options(
+    grpc_ssl_server_credentials_options* options) {
+  grpc_server_credentials* retval = nullptr;
+  grpc_ssl_server_credentials* c = nullptr;
+
+  if (options == nullptr) {
+    gpr_log(GPR_ERROR,
+            "Invalid options trying to create SSL server credentials.");
+    goto done;
+  }
+
+  if (options->certificate_config == nullptr &&
+      options->certificate_config_fetcher == nullptr) {
+    gpr_log(GPR_ERROR,
+            "SSL server credentials options must specify either "
+            "certificate config or fetcher.");
+    goto done;
+  } else if (options->certificate_config_fetcher != nullptr &&
+             options->certificate_config_fetcher->cb == nullptr) {
+    gpr_log(GPR_ERROR, "Certificate config fetcher callback must not be NULL.");
+    goto done;
+  }
+
+  c = (grpc_ssl_server_credentials*)gpr_zalloc(
+      sizeof(grpc_ssl_server_credentials));
+  c->base.type = GRPC_CHANNEL_CREDENTIALS_TYPE_SSL;
+  gpr_ref_init(&c->base.refcount, 1);
+  c->base.vtable = &ssl_server_vtable;
+
+  if (options->certificate_config_fetcher != nullptr) {
+    c->config.client_certificate_request = options->client_certificate_request;
+    c->certificate_config_fetcher = *options->certificate_config_fetcher;
+  } else {
+    ssl_build_server_config(options->certificate_config->pem_root_certs,
+                            options->certificate_config->pem_key_cert_pairs,
+                            options->certificate_config->num_key_cert_pairs,
+                            options->client_certificate_request, &c->config);
+  }
+
+  retval = &c->base;
+
+done:
+  grpc_ssl_server_credentials_options_destroy(options);
+  return retval;
+}
+
+void grpc_ssl_server_credentials_options_destroy(
+    grpc_ssl_server_credentials_options* o) {
+  if (o == nullptr) return;
+  gpr_free(o->certificate_config_fetcher);
+  grpc_ssl_server_certificate_config_destroy(o->certificate_config);
+  gpr_free(o);
+}