grpc 1.7.3 → 1.8.0

data/src/core/lib/security/transport/security_connector.h

@@ -29,10 +29,12 @@
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
 
-#ifndef NDEBUG
-extern grpc_tracer_flag grpc_trace_security_connector_refcount;
+#ifdef __cplusplus
+extern "C" {
 #endif
 
+extern grpc_core::DebugOnlyTraceFlag grpc_trace_security_connector_refcount;
+
 /* --- status enum. --- */
 
 typedef enum { GRPC_SECURITY_OK = 0, GRPC_SECURITY_ERROR } grpc_security_status;
@@ -52,21 +54,17 @@ typedef struct grpc_security_connector grpc_security_connector;
 #define GRPC_ARG_SECURITY_CONNECTOR "grpc.security_connector"
 
 typedef struct {
-  void (*destroy)(grpc_exec_ctx *exec_ctx, grpc_security_connector *sc);
-  void (*check_peer)(grpc_exec_ctx *exec_ctx, grpc_security_connector *sc,
-                     tsi_peer peer, grpc_auth_context **auth_context,
-                     grpc_closure *on_peer_checked);
+  void (*destroy)(grpc_exec_ctx* exec_ctx, grpc_security_connector* sc);
+  void (*check_peer)(grpc_exec_ctx* exec_ctx, grpc_security_connector* sc,
+                     tsi_peer peer, grpc_auth_context** auth_context,
+                     grpc_closure* on_peer_checked);
+  int (*cmp)(grpc_security_connector* sc, grpc_security_connector* other);
 } grpc_security_connector_vtable;
 
-typedef struct grpc_security_connector_handshake_list {
-  void *handshake;
-  struct grpc_security_connector_handshake_list *next;
-} grpc_security_connector_handshake_list;
-
 struct grpc_security_connector {
-  const grpc_security_connector_vtable *vtable;
+  const grpc_security_connector_vtable* vtable;
   gpr_refcount refcount;
-  const char *url_scheme;
+  const char* url_scheme;
 };
 
 /* Refcounting. */
@@ -75,122 +73,137 @@ struct grpc_security_connector {
   grpc_security_connector_ref((p), __FILE__, __LINE__, (r))
 #define GRPC_SECURITY_CONNECTOR_UNREF(exec_ctx, p, r) \
   grpc_security_connector_unref((exec_ctx), (p), __FILE__, __LINE__, (r))
-grpc_security_connector *grpc_security_connector_ref(
-    grpc_security_connector *policy, const char *file, int line,
-    const char *reason);
-void grpc_security_connector_unref(grpc_exec_ctx *exec_ctx,
-                                   grpc_security_connector *policy,
-                                   const char *file, int line,
-                                   const char *reason);
+grpc_security_connector* grpc_security_connector_ref(
+    grpc_security_connector* policy, const char* file, int line,
+    const char* reason);
+void grpc_security_connector_unref(grpc_exec_ctx* exec_ctx,
+                                   grpc_security_connector* policy,
+                                   const char* file, int line,
+                                   const char* reason);
 #else
 #define GRPC_SECURITY_CONNECTOR_REF(p, r) grpc_security_connector_ref((p))
 #define GRPC_SECURITY_CONNECTOR_UNREF(exec_ctx, p, r) \
   grpc_security_connector_unref((exec_ctx), (p))
-grpc_security_connector *grpc_security_connector_ref(
-    grpc_security_connector *policy);
-void grpc_security_connector_unref(grpc_exec_ctx *exec_ctx,
-                                   grpc_security_connector *policy);
+grpc_security_connector* grpc_security_connector_ref(
+    grpc_security_connector* policy);
+void grpc_security_connector_unref(grpc_exec_ctx* exec_ctx,
+                                   grpc_security_connector* policy);
 #endif
 
 /* Check the peer. Callee takes ownership of the peer object.
    When done, sets *auth_context and invokes on_peer_checked. */
-void grpc_security_connector_check_peer(grpc_exec_ctx *exec_ctx,
-                                        grpc_security_connector *sc,
+void grpc_security_connector_check_peer(grpc_exec_ctx* exec_ctx,
+                                        grpc_security_connector* sc,
                                         tsi_peer peer,
-                                        grpc_auth_context **auth_context,
-                                        grpc_closure *on_peer_checked);
+                                        grpc_auth_context** auth_context,
+                                        grpc_closure* on_peer_checked);
+
+/* Compares two security connectors. */
+int grpc_security_connector_cmp(grpc_security_connector* sc,
+                                grpc_security_connector* other);
 
 /* Util to encapsulate the connector in a channel arg. */
-grpc_arg grpc_security_connector_to_arg(grpc_security_connector *sc);
+grpc_arg grpc_security_connector_to_arg(grpc_security_connector* sc);
 
 /* Util to get the connector from a channel arg. */
-grpc_security_connector *grpc_security_connector_from_arg(const grpc_arg *arg);
+grpc_security_connector* grpc_security_connector_from_arg(const grpc_arg* arg);
 
 /* Util to find the connector from channel args. */
-grpc_security_connector *grpc_security_connector_find_in_args(
-    const grpc_channel_args *args);
+grpc_security_connector* grpc_security_connector_find_in_args(
+    const grpc_channel_args* args);
 
 /* --- channel_security_connector object. ---
 
-    A channel security connector object represents away to configure the
+    A channel security connector object represents a way to configure the
     underlying transport security mechanism on the client side.  */
 
 typedef struct grpc_channel_security_connector grpc_channel_security_connector;
 
 struct grpc_channel_security_connector {
   grpc_security_connector base;
-  grpc_call_credentials *request_metadata_creds;
-  bool (*check_call_host)(grpc_exec_ctx *exec_ctx,
-                          grpc_channel_security_connector *sc, const char *host,
-                          grpc_auth_context *auth_context,
-                          grpc_closure *on_call_host_checked,
-                          grpc_error **error);
-  void (*cancel_check_call_host)(grpc_exec_ctx *exec_ctx,
-                                 grpc_channel_security_connector *sc,
-                                 grpc_closure *on_call_host_checked,
-                                 grpc_error *error);
-  void (*add_handshakers)(grpc_exec_ctx *exec_ctx,
-                          grpc_channel_security_connector *sc,
-                          grpc_handshake_manager *handshake_mgr);
+  grpc_channel_credentials* channel_creds;
+  grpc_call_credentials* request_metadata_creds;
+  bool (*check_call_host)(grpc_exec_ctx* exec_ctx,
+                          grpc_channel_security_connector* sc, const char* host,
+                          grpc_auth_context* auth_context,
+                          grpc_closure* on_call_host_checked,
+                          grpc_error** error);
+  void (*cancel_check_call_host)(grpc_exec_ctx* exec_ctx,
+                                 grpc_channel_security_connector* sc,
+                                 grpc_closure* on_call_host_checked,
+                                 grpc_error* error);
+  void (*add_handshakers)(grpc_exec_ctx* exec_ctx,
+                          grpc_channel_security_connector* sc,
+                          grpc_handshake_manager* handshake_mgr);
 };
 
+/// A helper function for use in grpc_security_connector_cmp() implementations.
+int grpc_channel_security_connector_cmp(grpc_channel_security_connector* sc1,
+                                        grpc_channel_security_connector* sc2);
+
 /// Checks that the host that will be set for a call is acceptable.
 /// Returns true if completed synchronously, in which case \a error will
 /// be set to indicate the result.  Otherwise, \a on_call_host_checked
 /// will be invoked when complete.
 bool grpc_channel_security_connector_check_call_host(
-    grpc_exec_ctx *exec_ctx, grpc_channel_security_connector *sc,
-    const char *host, grpc_auth_context *auth_context,
-    grpc_closure *on_call_host_checked, grpc_error **error);
+    grpc_exec_ctx* exec_ctx, grpc_channel_security_connector* sc,
+    const char* host, grpc_auth_context* auth_context,
+    grpc_closure* on_call_host_checked, grpc_error** error);
 
 /// Cancels a pending asychronous call to
 /// grpc_channel_security_connector_check_call_host() with
 /// \a on_call_host_checked as its callback.
 void grpc_channel_security_connector_cancel_check_call_host(
-    grpc_exec_ctx *exec_ctx, grpc_channel_security_connector *sc,
-    grpc_closure *on_call_host_checked, grpc_error *error);
+    grpc_exec_ctx* exec_ctx, grpc_channel_security_connector* sc,
+    grpc_closure* on_call_host_checked, grpc_error* error);
 
 /* Registers handshakers with \a handshake_mgr. */
 void grpc_channel_security_connector_add_handshakers(
-    grpc_exec_ctx *exec_ctx, grpc_channel_security_connector *connector,
-    grpc_handshake_manager *handshake_mgr);
+    grpc_exec_ctx* exec_ctx, grpc_channel_security_connector* connector,
+    grpc_handshake_manager* handshake_mgr);
 
 /* --- server_security_connector object. ---
 
-    A server security connector object represents away to configure the
+    A server security connector object represents a way to configure the
     underlying transport security mechanism on the server side.  */
 
 typedef struct grpc_server_security_connector grpc_server_security_connector;
 
 struct grpc_server_security_connector {
   grpc_security_connector base;
-  void (*add_handshakers)(grpc_exec_ctx *exec_ctx,
-                          grpc_server_security_connector *sc,
-                          grpc_handshake_manager *handshake_mgr);
+  grpc_server_credentials* server_creds;
+  void (*add_handshakers)(grpc_exec_ctx* exec_ctx,
+                          grpc_server_security_connector* sc,
+                          grpc_handshake_manager* handshake_mgr);
 };
 
+/// A helper function for use in grpc_security_connector_cmp() implementations.
+int grpc_server_security_connector_cmp(grpc_server_security_connector* sc1,
+                                       grpc_server_security_connector* sc2);
+
 void grpc_server_security_connector_add_handshakers(
-    grpc_exec_ctx *exec_ctx, grpc_server_security_connector *sc,
-    grpc_handshake_manager *handshake_mgr);
+    grpc_exec_ctx* exec_ctx, grpc_server_security_connector* sc,
+    grpc_handshake_manager* handshake_mgr);
 
 /* --- Creation security connectors. --- */
 
 /* For TESTING ONLY!
    Creates a fake connector that emulates real channel security.  */
-grpc_channel_security_connector *grpc_fake_channel_security_connector_create(
-    grpc_call_credentials *request_metadata_creds, const char *target,
-    const grpc_channel_args *args);
+grpc_channel_security_connector* grpc_fake_channel_security_connector_create(
+    grpc_channel_credentials* channel_creds,
+    grpc_call_credentials* request_metadata_creds, const char* target,
+    const grpc_channel_args* args);
 
 /* For TESTING ONLY!
    Creates a fake connector that emulates real server security.  */
-grpc_server_security_connector *grpc_fake_server_security_connector_create(
-    void);
+grpc_server_security_connector* grpc_fake_server_security_connector_create(
+    grpc_server_credentials* server_creds);
 
 /* Config for ssl clients. */
 
 typedef struct {
-  tsi_ssl_pem_key_cert_pair pem_key_cert_pair;
-  char *pem_root_certs;
+  tsi_ssl_pem_key_cert_pair* pem_key_cert_pair;
+  char* pem_root_certs;
 } grpc_ssl_config;
 
 /* Creates an SSL channel_security_connector.
@@ -207,21 +220,22 @@ typedef struct {
   specific error code otherwise.
 */
 grpc_security_status grpc_ssl_channel_security_connector_create(
-    grpc_exec_ctx *exec_ctx, grpc_call_credentials *request_metadata_creds,
-    const grpc_ssl_config *config, const char *target_name,
-    const char *overridden_target_name, grpc_channel_security_connector **sc);
+    grpc_exec_ctx* exec_ctx, grpc_channel_credentials* channel_creds,
+    grpc_call_credentials* request_metadata_creds,
+    const grpc_ssl_config* config, const char* target_name,
+    const char* overridden_target_name, grpc_channel_security_connector** sc);
 
 /* Gets the default ssl roots. Returns NULL if not found. */
-const char *grpc_get_default_ssl_roots(void);
+const char* grpc_get_default_ssl_roots(void);
 
 /* Exposed for TESTING ONLY!. */
 grpc_slice grpc_get_default_ssl_roots_for_testing(void);
 
 /* Config for ssl servers. */
 typedef struct {
-  tsi_ssl_pem_key_cert_pair *pem_key_cert_pairs;
+  tsi_ssl_pem_key_cert_pair* pem_key_cert_pairs;
   size_t num_key_cert_pairs;
-  char *pem_root_certs;
+  char* pem_root_certs;
   grpc_ssl_client_certificate_request_type client_certificate_request;
 } grpc_ssl_server_config;
 
@@ -232,17 +246,21 @@ typedef struct {
   specific error code otherwise.
 */
 grpc_security_status grpc_ssl_server_security_connector_create(
-    grpc_exec_ctx *exec_ctx, const grpc_ssl_server_config *config,
-    grpc_server_security_connector **sc);
+    grpc_exec_ctx* exec_ctx, grpc_server_credentials* server_credentials,
+    grpc_server_security_connector** sc);
 
 /* Util. */
-const tsi_peer_property *tsi_peer_get_property_by_name(const tsi_peer *peer,
-                                                       const char *name);
+const tsi_peer_property* tsi_peer_get_property_by_name(const tsi_peer* peer,
+                                                       const char* name);
 
 /* Exposed for testing only. */
-grpc_auth_context *tsi_ssl_peer_to_auth_context(const tsi_peer *peer);
+grpc_auth_context* tsi_ssl_peer_to_auth_context(const tsi_peer* peer);
 tsi_peer tsi_shallow_peer_from_ssl_auth_context(
-    const grpc_auth_context *auth_context);
-void tsi_shallow_peer_destruct(tsi_peer *peer);
+    const grpc_auth_context* auth_context);
+void tsi_shallow_peer_destruct(tsi_peer* peer);
+
+#ifdef __cplusplus
+}
+#endif
 
 #endif /* GRPC_CORE_LIB_SECURITY_TRANSPORT_SECURITY_CONNECTOR_H */

data/src/core/lib/security/transport/{security_handshaker.c → security_handshaker.cc}

@@ -40,41 +40,60 @@ typedef struct {
   grpc_handshaker base;
 
   // State set at creation time.
-  tsi_handshaker *handshaker;
-  grpc_security_connector *connector;
+  tsi_handshaker* handshaker;
+  grpc_security_connector* connector;
 
   gpr_mu mu;
   gpr_refcount refs;
 
   bool shutdown;
   // Endpoint and read buffer to destroy after a shutdown.
-  grpc_endpoint *endpoint_to_destroy;
-  grpc_slice_buffer *read_buffer_to_destroy;
+  grpc_endpoint* endpoint_to_destroy;
+  grpc_slice_buffer* read_buffer_to_destroy;
 
   // State saved while performing the handshake.
-  grpc_handshaker_args *args;
-  grpc_closure *on_handshake_done;
+  grpc_handshaker_args* args;
+  grpc_closure* on_handshake_done;
 
-  unsigned char *handshake_buffer;
+  unsigned char* handshake_buffer;
   size_t handshake_buffer_size;
   grpc_slice_buffer outgoing;
   grpc_closure on_handshake_data_sent_to_peer;
   grpc_closure on_handshake_data_received_from_peer;
   grpc_closure on_peer_checked;
-  grpc_auth_context *auth_context;
-  tsi_handshaker_result *handshaker_result;
+  grpc_auth_context* auth_context;
+  tsi_handshaker_result* handshaker_result;
 } security_handshaker;
 
-static void security_handshaker_unref(grpc_exec_ctx *exec_ctx,
-                                      security_handshaker *h) {
+static size_t move_read_buffer_into_handshake_buffer(grpc_exec_ctx* exec_ctx,
+                                                     security_handshaker* h) {
+  size_t bytes_in_read_buffer = h->args->read_buffer->length;
+  if (h->handshake_buffer_size < bytes_in_read_buffer) {
+    h->handshake_buffer =
+        (uint8_t*)gpr_realloc(h->handshake_buffer, bytes_in_read_buffer);
+    h->handshake_buffer_size = bytes_in_read_buffer;
+  }
+  size_t offset = 0;
+  while (h->args->read_buffer->count > 0) {
+    grpc_slice next_slice = grpc_slice_buffer_take_first(h->args->read_buffer);
+    memcpy(h->handshake_buffer + offset, GRPC_SLICE_START_PTR(next_slice),
+           GRPC_SLICE_LENGTH(next_slice));
+    offset += GRPC_SLICE_LENGTH(next_slice);
+    grpc_slice_unref_internal(exec_ctx, next_slice);
+  }
+  return bytes_in_read_buffer;
+}
+
+static void security_handshaker_unref(grpc_exec_ctx* exec_ctx,
+                                      security_handshaker* h) {
   if (gpr_unref(&h->refs)) {
     gpr_mu_destroy(&h->mu);
     tsi_handshaker_destroy(h->handshaker);
     tsi_handshaker_result_destroy(h->handshaker_result);
-    if (h->endpoint_to_destroy != NULL) {
+    if (h->endpoint_to_destroy != nullptr) {
       grpc_endpoint_destroy(exec_ctx, h->endpoint_to_destroy);
     }
-    if (h->read_buffer_to_destroy != NULL) {
+    if (h->read_buffer_to_destroy != nullptr) {
       grpc_slice_buffer_destroy_internal(exec_ctx, h->read_buffer_to_destroy);
       gpr_free(h->read_buffer_to_destroy);
     }
@@ -88,27 +107,27 @@ static void security_handshaker_unref(grpc_exec_ctx *exec_ctx,
 
 // Set args fields to NULL, saving the endpoint and read buffer for
 // later destruction.
-static void cleanup_args_for_failure_locked(grpc_exec_ctx *exec_ctx,
-                                            security_handshaker *h) {
+static void cleanup_args_for_failure_locked(grpc_exec_ctx* exec_ctx,
+                                            security_handshaker* h) {
   h->endpoint_to_destroy = h->args->endpoint;
-  h->args->endpoint = NULL;
+  h->args->endpoint = nullptr;
   h->read_buffer_to_destroy = h->args->read_buffer;
-  h->args->read_buffer = NULL;
+  h->args->read_buffer = nullptr;
   grpc_channel_args_destroy(exec_ctx, h->args->args);
-  h->args->args = NULL;
+  h->args->args = nullptr;
 }
 
 // If the handshake failed or we're shutting down, clean up and invoke the
 // callback with the error.
-static void security_handshake_failed_locked(grpc_exec_ctx *exec_ctx,
-                                             security_handshaker *h,
-                                             grpc_error *error) {
+static void security_handshake_failed_locked(grpc_exec_ctx* exec_ctx,
+                                             security_handshaker* h,
+                                             grpc_error* error) {
   if (error == GRPC_ERROR_NONE) {
     // If we were shut down after the handshake succeeded but before an
     // endpoint callback was invoked, we need to generate our own error.
     error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Handshaker shutdown");
   }
-  const char *msg = grpc_error_string(error);
+  const char* msg = grpc_error_string(error);
   gpr_log(GPR_DEBUG, "Security handshake failed: %s", msg);
 
   if (!h->shutdown) {
@@ -128,16 +147,16 @@ static void security_handshake_failed_locked(grpc_exec_ctx *exec_ctx,
   GRPC_CLOSURE_SCHED(exec_ctx, h->on_handshake_done, error);
 }
 
-static void on_peer_checked_inner(grpc_exec_ctx *exec_ctx,
-                                  security_handshaker *h, grpc_error *error) {
+static void on_peer_checked_inner(grpc_exec_ctx* exec_ctx,
+                                  security_handshaker* h, grpc_error* error) {
   if (error != GRPC_ERROR_NONE || h->shutdown) {
     security_handshake_failed_locked(exec_ctx, h, GRPC_ERROR_REF(error));
     return;
   }
   // Create zero-copy frame protector, if implemented.
-  tsi_zero_copy_grpc_protector *zero_copy_protector = NULL;
+  tsi_zero_copy_grpc_protector* zero_copy_protector = nullptr;
   tsi_result result = tsi_handshaker_result_create_zero_copy_grpc_protector(
-      exec_ctx, h->handshaker_result, NULL, &zero_copy_protector);
+      exec_ctx, h->handshaker_result, nullptr, &zero_copy_protector);
   if (result != TSI_OK && result != TSI_UNIMPLEMENTED) {
     error = grpc_set_tsi_error_result(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING(
@@ -147,10 +166,10 @@ static void on_peer_checked_inner(grpc_exec_ctx *exec_ctx,
     return;
   }
   // Create frame protector if zero-copy frame protector is NULL.
-  tsi_frame_protector *protector = NULL;
-  if (zero_copy_protector == NULL) {
+  tsi_frame_protector* protector = nullptr;
+  if (zero_copy_protector == nullptr) {
     result = tsi_handshaker_result_create_frame_protector(h->handshaker_result,
-                                                          NULL, &protector);
+                                                          nullptr, &protector);
     if (result != TSI_OK) {
       error = grpc_set_tsi_error_result(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                                             "Frame protector creation failed"),
@@ -160,28 +179,26 @@ static void on_peer_checked_inner(grpc_exec_ctx *exec_ctx,
     }
   }
   // Get unused bytes.
-  const unsigned char *unused_bytes = NULL;
+  const unsigned char* unused_bytes = nullptr;
   size_t unused_bytes_size = 0;
   result = tsi_handshaker_result_get_unused_bytes(
       h->handshaker_result, &unused_bytes, &unused_bytes_size);
   // Create secure endpoint.
   if (unused_bytes_size > 0) {
     grpc_slice slice =
-        grpc_slice_from_copied_buffer((char *)unused_bytes, unused_bytes_size);
+        grpc_slice_from_copied_buffer((char*)unused_bytes, unused_bytes_size);
     h->args->endpoint = grpc_secure_endpoint_create(
         protector, zero_copy_protector, h->args->endpoint, &slice, 1);
     grpc_slice_unref_internal(exec_ctx, slice);
   } else {
     h->args->endpoint = grpc_secure_endpoint_create(
-        protector, zero_copy_protector, h->args->endpoint, NULL, 0);
+        protector, zero_copy_protector, h->args->endpoint, nullptr, 0);
   }
   tsi_handshaker_result_destroy(h->handshaker_result);
-  h->handshaker_result = NULL;
-  // Clear out the read buffer before it gets passed to the transport.
-  grpc_slice_buffer_reset_and_unref_internal(exec_ctx, h->args->read_buffer);
+  h->handshaker_result = nullptr;
   // Add auth context to channel args.
   grpc_arg auth_context_arg = grpc_auth_context_to_arg(h->auth_context);
-  grpc_channel_args *tmp_args = h->args->args;
+  grpc_channel_args* tmp_args = h->args->args;
   h->args->args =
       grpc_channel_args_copy_and_add(tmp_args, &auth_context_arg, 1);
   grpc_channel_args_destroy(exec_ctx, tmp_args);
@@ -192,17 +209,17 @@ static void on_peer_checked_inner(grpc_exec_ctx *exec_ctx,
   h->shutdown = true;
 }
 
-static void on_peer_checked(grpc_exec_ctx *exec_ctx, void *arg,
-                            grpc_error *error) {
-  security_handshaker *h = (security_handshaker *)arg;
+static void on_peer_checked(grpc_exec_ctx* exec_ctx, void* arg,
+                            grpc_error* error) {
+  security_handshaker* h = (security_handshaker*)arg;
   gpr_mu_lock(&h->mu);
   on_peer_checked_inner(exec_ctx, h, error);
   gpr_mu_unlock(&h->mu);
   security_handshaker_unref(exec_ctx, h);
 }
 
-static grpc_error *check_peer_locked(grpc_exec_ctx *exec_ctx,
-                                     security_handshaker *h) {
+static grpc_error* check_peer_locked(grpc_exec_ctx* exec_ctx,
+                                     security_handshaker* h) {
   tsi_peer peer;
   tsi_result result =
       tsi_handshaker_result_extract_peer(h->handshaker_result, &peer);
@@ -215,11 +232,11 @@ static grpc_error *check_peer_locked(grpc_exec_ctx *exec_ctx,
   return GRPC_ERROR_NONE;
 }
 
-static grpc_error *on_handshake_next_done_locked(
-    grpc_exec_ctx *exec_ctx, security_handshaker *h, tsi_result result,
-    const unsigned char *bytes_to_send, size_t bytes_to_send_size,
-    tsi_handshaker_result *handshaker_result) {
-  grpc_error *error = GRPC_ERROR_NONE;
+static grpc_error* on_handshake_next_done_locked(
+    grpc_exec_ctx* exec_ctx, security_handshaker* h, tsi_result result,
+    const unsigned char* bytes_to_send, size_t bytes_to_send_size,
+    tsi_handshaker_result* handshaker_result) {
+  grpc_error* error = GRPC_ERROR_NONE;
   // Read more if we need to.
   if (result == TSI_INCOMPLETE_DATA) {
     GPR_ASSERT(bytes_to_send_size == 0);
@@ -232,19 +249,19 @@ static grpc_error *on_handshake_next_done_locked(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING("Handshake failed"), result);
   }
   // Update handshaker result.
-  if (handshaker_result != NULL) {
-    GPR_ASSERT(h->handshaker_result == NULL);
+  if (handshaker_result != nullptr) {
+    GPR_ASSERT(h->handshaker_result == nullptr);
     h->handshaker_result = handshaker_result;
   }
   if (bytes_to_send_size > 0) {
     // Send data to peer, if needed.
     grpc_slice to_send = grpc_slice_from_copied_buffer(
-        (const char *)bytes_to_send, bytes_to_send_size);
+        (const char*)bytes_to_send, bytes_to_send_size);
     grpc_slice_buffer_reset_and_unref_internal(exec_ctx, &h->outgoing);
     grpc_slice_buffer_add(&h->outgoing, to_send);
     grpc_endpoint_write(exec_ctx, h->args->endpoint, &h->outgoing,
                         &h->on_handshake_data_sent_to_peer);
-  } else if (handshaker_result == NULL) {
+  } else if (handshaker_result == nullptr) {
     // There is nothing to send, but need to read from peer.
     grpc_endpoint_read(exec_ctx, h->args->endpoint, h->args->read_buffer,
                        &h->on_handshake_data_received_from_peer);
@@ -256,14 +273,14 @@ static grpc_error *on_handshake_next_done_locked(
 }
 
 static void on_handshake_next_done_grpc_wrapper(
-    tsi_result result, void *user_data, const unsigned char *bytes_to_send,
-    size_t bytes_to_send_size, tsi_handshaker_result *handshaker_result) {
-  security_handshaker *h = (security_handshaker *)user_data;
+    tsi_result result, void* user_data, const unsigned char* bytes_to_send,
+    size_t bytes_to_send_size, tsi_handshaker_result* handshaker_result) {
+  security_handshaker* h = (security_handshaker*)user_data;
   // This callback will be invoked by TSI in a non-grpc thread, so it's
   // safe to create our own exec_ctx here.
   grpc_exec_ctx exec_ctx = GRPC_EXEC_CTX_INIT;
   gpr_mu_lock(&h->mu);
-  grpc_error *error =
+  grpc_error* error =
       on_handshake_next_done_locked(&exec_ctx, h, result, bytes_to_send,
                                     bytes_to_send_size, handshaker_result);
   if (error != GRPC_ERROR_NONE) {
@@ -276,13 +293,13 @@ static void on_handshake_next_done_grpc_wrapper(
   grpc_exec_ctx_finish(&exec_ctx);
 }
 
-static grpc_error *do_handshaker_next_locked(
-    grpc_exec_ctx *exec_ctx, security_handshaker *h,
-    const unsigned char *bytes_received, size_t bytes_received_size) {
+static grpc_error* do_handshaker_next_locked(
+    grpc_exec_ctx* exec_ctx, security_handshaker* h,
+    const unsigned char* bytes_received, size_t bytes_received_size) {
   // Invoke TSI handshaker.
-  const unsigned char *bytes_to_send = NULL;
+  const unsigned char* bytes_to_send = nullptr;
   size_t bytes_to_send_size = 0;
-  tsi_handshaker_result *handshaker_result = NULL;
+  tsi_handshaker_result* handshaker_result = nullptr;
   tsi_result result = tsi_handshaker_next(
       h->handshaker, bytes_received, bytes_received_size, &bytes_to_send,
       &bytes_to_send_size, &handshaker_result,
@@ -298,36 +315,22 @@ static grpc_error *do_handshaker_next_locked(
                                        bytes_to_send_size, handshaker_result);
 }
 
-static void on_handshake_data_received_from_peer(grpc_exec_ctx *exec_ctx,
-                                                 void *arg, grpc_error *error) {
-  security_handshaker *h = (security_handshaker *)arg;
+static void on_handshake_data_received_from_peer(grpc_exec_ctx* exec_ctx,
+                                                 void* arg, grpc_error* error) {
+  security_handshaker* h = (security_handshaker*)arg;
   gpr_mu_lock(&h->mu);
   if (error != GRPC_ERROR_NONE || h->shutdown) {
     security_handshake_failed_locked(
-        exec_ctx, h, GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
-                         "Handshake read failed", &error, 1));
+        exec_ctx, h,
+        GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
+            "Handshake read failed", &error, 1));
     gpr_mu_unlock(&h->mu);
     security_handshaker_unref(exec_ctx, h);
     return;
   }
   // Copy all slices received.
-  size_t i;
-  size_t bytes_received_size = 0;
-  for (i = 0; i < h->args->read_buffer->count; i++) {
-    bytes_received_size += GRPC_SLICE_LENGTH(h->args->read_buffer->slices[i]);
-  }
-  if (bytes_received_size > h->handshake_buffer_size) {
-    h->handshake_buffer =
-        (uint8_t *)gpr_realloc(h->handshake_buffer, bytes_received_size);
-    h->handshake_buffer_size = bytes_received_size;
-  }
-  size_t offset = 0;
-  for (i = 0; i < h->args->read_buffer->count; i++) {
-    size_t slice_size = GPR_SLICE_LENGTH(h->args->read_buffer->slices[i]);
-    memcpy(h->handshake_buffer + offset,
-           GRPC_SLICE_START_PTR(h->args->read_buffer->slices[i]), slice_size);
-    offset += slice_size;
-  }
+  size_t bytes_received_size =
+      move_read_buffer_into_handshake_buffer(exec_ctx, h);
   // Call TSI handshaker.
   error = do_handshaker_next_locked(exec_ctx, h, h->handshake_buffer,
                                     bytes_received_size);
@@ -341,20 +344,21 @@ static void on_handshake_data_received_from_peer(grpc_exec_ctx *exec_ctx,
   }
 }
 
-static void on_handshake_data_sent_to_peer(grpc_exec_ctx *exec_ctx, void *arg,
-                                           grpc_error *error) {
-  security_handshaker *h = (security_handshaker *)arg;
+static void on_handshake_data_sent_to_peer(grpc_exec_ctx* exec_ctx, void* arg,
+                                           grpc_error* error) {
+  security_handshaker* h = (security_handshaker*)arg;
   gpr_mu_lock(&h->mu);
   if (error != GRPC_ERROR_NONE || h->shutdown) {
     security_handshake_failed_locked(
-        exec_ctx, h, GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
-                         "Handshake write failed", &error, 1));
+        exec_ctx, h,
+        GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
+            "Handshake write failed", &error, 1));
     gpr_mu_unlock(&h->mu);
     security_handshaker_unref(exec_ctx, h);
     return;
   }
   // We may be done.
-  if (h->handshaker_result == NULL) {
+  if (h->handshaker_result == nullptr) {
     grpc_endpoint_read(exec_ctx, h->args->endpoint, h->args->read_buffer,
                        &h->on_handshake_data_received_from_peer);
   } else {
@@ -373,16 +377,16 @@ static void on_handshake_data_sent_to_peer(grpc_exec_ctx *exec_ctx, void *arg,
 // public handshaker API
 //
 
-static void security_handshaker_destroy(grpc_exec_ctx *exec_ctx,
-                                        grpc_handshaker *handshaker) {
-  security_handshaker *h = (security_handshaker *)handshaker;
+static void security_handshaker_destroy(grpc_exec_ctx* exec_ctx,
+                                        grpc_handshaker* handshaker) {
+  security_handshaker* h = (security_handshaker*)handshaker;
   security_handshaker_unref(exec_ctx, h);
 }
 
-static void security_handshaker_shutdown(grpc_exec_ctx *exec_ctx,
-                                         grpc_handshaker *handshaker,
-                                         grpc_error *why) {
-  security_handshaker *h = (security_handshaker *)handshaker;
+static void security_handshaker_shutdown(grpc_exec_ctx* exec_ctx,
+                                         grpc_handshaker* handshaker,
+                                         grpc_error* why) {
+  security_handshaker* h = (security_handshaker*)handshaker;
   gpr_mu_lock(&h->mu);
   if (!h->shutdown) {
     h->shutdown = true;
@@ -393,17 +397,20 @@ static void security_handshaker_shutdown(grpc_exec_ctx *exec_ctx,
   GRPC_ERROR_UNREF(why);
 }
 
-static void security_handshaker_do_handshake(grpc_exec_ctx *exec_ctx,
-                                             grpc_handshaker *handshaker,
-                                             grpc_tcp_server_acceptor *acceptor,
-                                             grpc_closure *on_handshake_done,
-                                             grpc_handshaker_args *args) {
-  security_handshaker *h = (security_handshaker *)handshaker;
+static void security_handshaker_do_handshake(grpc_exec_ctx* exec_ctx,
+                                             grpc_handshaker* handshaker,
+                                             grpc_tcp_server_acceptor* acceptor,
+                                             grpc_closure* on_handshake_done,
+                                             grpc_handshaker_args* args) {
+  security_handshaker* h = (security_handshaker*)handshaker;
   gpr_mu_lock(&h->mu);
   h->args = args;
   h->on_handshake_done = on_handshake_done;
   gpr_ref(&h->refs);
-  grpc_error *error = do_handshaker_next_locked(exec_ctx, h, NULL, 0);
+  size_t bytes_received_size =
+      move_read_buffer_into_handshake_buffer(exec_ctx, h);
+  grpc_error* error = do_handshaker_next_locked(
+      exec_ctx, h, h->handshake_buffer, bytes_received_size);
   if (error != GRPC_ERROR_NONE) {
     security_handshake_failed_locked(exec_ctx, h, error);
     gpr_mu_unlock(&h->mu);
@@ -417,18 +424,18 @@ static const grpc_handshaker_vtable security_handshaker_vtable = {
     security_handshaker_destroy, security_handshaker_shutdown,
     security_handshaker_do_handshake};
 
-static grpc_handshaker *security_handshaker_create(
-    grpc_exec_ctx *exec_ctx, tsi_handshaker *handshaker,
-    grpc_security_connector *connector) {
-  security_handshaker *h =
-      (security_handshaker *)gpr_zalloc(sizeof(security_handshaker));
+static grpc_handshaker* security_handshaker_create(
+    grpc_exec_ctx* exec_ctx, tsi_handshaker* handshaker,
+    grpc_security_connector* connector) {
+  security_handshaker* h =
+      (security_handshaker*)gpr_zalloc(sizeof(security_handshaker));
   grpc_handshaker_init(&security_handshaker_vtable, &h->base);
   h->handshaker = handshaker;
   h->connector = GRPC_SECURITY_CONNECTOR_REF(connector, "handshake");
   gpr_mu_init(&h->mu);
   gpr_ref_init(&h->refs, 1);
   h->handshake_buffer_size = GRPC_INITIAL_HANDSHAKE_BUFFER_SIZE;
-  h->handshake_buffer = (uint8_t *)gpr_malloc(h->handshake_buffer_size);
+  h->handshake_buffer = (uint8_t*)gpr_malloc(h->handshake_buffer_size);
   GRPC_CLOSURE_INIT(&h->on_handshake_data_sent_to_peer,
                     on_handshake_data_sent_to_peer, h,
                     grpc_schedule_on_exec_ctx);
@@ -445,22 +452,22 @@ static grpc_handshaker *security_handshaker_create(
 // fail_handshaker
 //
 
-static void fail_handshaker_destroy(grpc_exec_ctx *exec_ctx,
-                                    grpc_handshaker *handshaker) {
+static void fail_handshaker_destroy(grpc_exec_ctx* exec_ctx,
+                                    grpc_handshaker* handshaker) {
   gpr_free(handshaker);
 }
 
-static void fail_handshaker_shutdown(grpc_exec_ctx *exec_ctx,
-                                     grpc_handshaker *handshaker,
-                                     grpc_error *why) {
+static void fail_handshaker_shutdown(grpc_exec_ctx* exec_ctx,
+                                     grpc_handshaker* handshaker,
+                                     grpc_error* why) {
   GRPC_ERROR_UNREF(why);
 }
 
-static void fail_handshaker_do_handshake(grpc_exec_ctx *exec_ctx,
-                                         grpc_handshaker *handshaker,
-                                         grpc_tcp_server_acceptor *acceptor,
-                                         grpc_closure *on_handshake_done,
-                                         grpc_handshaker_args *args) {
+static void fail_handshaker_do_handshake(grpc_exec_ctx* exec_ctx,
+                                         grpc_handshaker* handshaker,
+                                         grpc_tcp_server_acceptor* acceptor,
+                                         grpc_closure* on_handshake_done,
+                                         grpc_handshaker_args* args) {
   GRPC_CLOSURE_SCHED(exec_ctx, on_handshake_done,
                      GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                          "Failed to create security handshaker"));
@@ -470,8 +477,8 @@ static const grpc_handshaker_vtable fail_handshaker_vtable = {
     fail_handshaker_destroy, fail_handshaker_shutdown,
     fail_handshaker_do_handshake};
 
-static grpc_handshaker *fail_handshaker_create() {
-  grpc_handshaker *h = (grpc_handshaker *)gpr_malloc(sizeof(*h));
+static grpc_handshaker* fail_handshaker_create() {
+  grpc_handshaker* h = (grpc_handshaker*)gpr_malloc(sizeof(*h));
   grpc_handshaker_init(&fail_handshaker_vtable, h);
   return h;
 }
@@ -481,27 +488,27 @@ static grpc_handshaker *fail_handshaker_create() {
 //
 
 static void client_handshaker_factory_add_handshakers(
-    grpc_exec_ctx *exec_ctx, grpc_handshaker_factory *handshaker_factory,
-    const grpc_channel_args *args, grpc_handshake_manager *handshake_mgr) {
-  grpc_channel_security_connector *security_connector =
-      (grpc_channel_security_connector *)grpc_security_connector_find_in_args(
+    grpc_exec_ctx* exec_ctx, grpc_handshaker_factory* handshaker_factory,
+    const grpc_channel_args* args, grpc_handshake_manager* handshake_mgr) {
+  grpc_channel_security_connector* security_connector =
+      (grpc_channel_security_connector*)grpc_security_connector_find_in_args(
           args);
   grpc_channel_security_connector_add_handshakers(exec_ctx, security_connector,
                                                   handshake_mgr);
 }
 
 static void server_handshaker_factory_add_handshakers(
-    grpc_exec_ctx *exec_ctx, grpc_handshaker_factory *hf,
-    const grpc_channel_args *args, grpc_handshake_manager *handshake_mgr) {
-  grpc_server_security_connector *security_connector =
-      (grpc_server_security_connector *)grpc_security_connector_find_in_args(
+    grpc_exec_ctx* exec_ctx, grpc_handshaker_factory* hf,
+    const grpc_channel_args* args, grpc_handshake_manager* handshake_mgr) {
+  grpc_server_security_connector* security_connector =
+      (grpc_server_security_connector*)grpc_security_connector_find_in_args(
           args);
   grpc_server_security_connector_add_handshakers(exec_ctx, security_connector,
                                                  handshake_mgr);
 }
 
 static void handshaker_factory_destroy(
-    grpc_exec_ctx *exec_ctx, grpc_handshaker_factory *handshaker_factory) {}
+    grpc_exec_ctx* exec_ctx, grpc_handshaker_factory* handshaker_factory) {}
 
 static const grpc_handshaker_factory_vtable client_handshaker_factory_vtable = {
     client_handshaker_factory_add_handshakers, handshaker_factory_destroy};
@@ -519,12 +526,12 @@ static grpc_handshaker_factory server_handshaker_factory = {
 // exported functions
 //
 
-grpc_handshaker *grpc_security_handshaker_create(
-    grpc_exec_ctx *exec_ctx, tsi_handshaker *handshaker,
-    grpc_security_connector *connector) {
+grpc_handshaker* grpc_security_handshaker_create(
+    grpc_exec_ctx* exec_ctx, tsi_handshaker* handshaker,
+    grpc_security_connector* connector) {
   // If no TSI handshaker was created, return a handshaker that always fails.
   // Otherwise, return a real security handshaker.
-  if (handshaker == NULL) {
+  if (handshaker == nullptr) {
     return fail_handshaker_create();
   } else {
     return security_handshaker_create(exec_ctx, handshaker, connector);