grpc 1.71.0 → 1.72.0

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.h

@@ -22,8 +22,8 @@
 #include <grpc/grpc.h>
 #include <grpc/support/port_platform.h>
 
+#include "src/core/credentials/transport/alts/grpc_alts_credentials_options.h"
 #include "src/core/lib/iomgr/pollset_set.h"
-#include "src/core/lib/security/credentials/alts/grpc_alts_credentials_options.h"
 #include "src/core/tsi/alts/handshaker/alts_handshaker_client.h"
 #include "src/core/tsi/transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"

data/src/core/tsi/ssl_transport_security.cc

@@ -60,7 +60,7 @@
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
-#include "src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h"
+#include "src/core/credentials/transport/tls/grpc_tls_crl_provider.h"
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/ssl/session_cache/ssl_session_cache.h"
 #include "src/core/tsi/ssl_transport_security_utils.h"

data/src/core/util/check_class_size.h

@@ -0,0 +1,48 @@
+//
+//
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_SRC_CORE_UTIL_CHECK_CLASS_SIZE_H
+#define GRPC_SRC_CORE_UTIL_CHECK_CLASS_SIZE_H
+
+#include <grpc/support/port_platform.h>
+
+#if defined(__has_feature)
+#if __has_feature(memory_sanitizer)
+#define GRPC_MSAN_ENABLED 1
+#else
+#define GRPC_MSAN_ENABLED 0
+#endif
+#else
+#ifdef MEMORY_SANITIZER
+#define GRPC_MSAN_ENABLED 1
+#else
+#define GRPC_MSAN_ENABLED 0
+#endif
+#endif
+
+#if defined(GPR_LINUX) && !defined(NDEBUG) && !defined(GRPC_ASAN_ENABLED) && \
+    !defined(GRPC_MSAN_ENABLED)
+// Since class size varies based on platform and compiler, we limit our
+// guardrail to only one platform.
+#define GRPC_CHECK_CLASS_SIZE(class_name, class_size) \
+  static_assert(sizeof(class_name) <= (class_size), "Class size too large");
+#else
+#define GRPC_CHECK_CLASS_SIZE(class_name, class_size)
+#endif
+
+#endif  // GRPC_SRC_CORE_UTIL_CHECK_CLASS_SIZE_H

data/src/core/util/gcp_metadata_query.cc

@@ -33,8 +33,8 @@
 #include "absl/status/statusor.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/lib/debug/trace.h"
-#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/status_helper.h"
 #include "src/core/util/time.h"

data/src/core/util/http_client/httpcli.cc

@@ -32,6 +32,8 @@
 #include "absl/status/status.h"
 #include "absl/strings/str_format.h"
 #include "src/core/config/core_configuration.h"
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/handshaker/handshaker.h"
 #include "src/core/handshaker/handshaker_registry.h"
 #include "src/core/handshaker/tcp_connect/tcp_connect_handshaker.h"
@@ -44,8 +46,6 @@
 #include "src/core/lib/iomgr/pollset_set.h"
 #include "src/core/lib/iomgr/resolve_address.h"
 #include "src/core/lib/resource_quota/api.h"
-#include "src/core/lib/security/credentials/credentials.h"
-#include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/error_utils.h"
 #include "src/core/util/http_client/format_request.h"
@@ -282,7 +282,7 @@ void HttpRequest::AppendError(grpc_error_handle error) {
     overall_error_ = GRPC_ERROR_CREATE("Failed HTTP/1 client request");
   }
   auto addr_text = ResolvedAddressToURI(addresses_[next_address_ - 1]);
-  if (addr_text.ok()) error = AddMessagePrefix(*addr_text, std::move(error));
+  if (addr_text.ok()) error = AddMessagePrefix(*addr_text, error);
   overall_error_ = grpc_error_add_child(overall_error_, std::move(error));
 }
 

data/src/core/util/http_client/httpcli_security_connector.cc

@@ -32,6 +32,9 @@
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/credentials/transport/tls/ssl_utils.h"
+#include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/handshaker/handshaker.h"
 #include "src/core/handshaker/security/security_handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
@@ -42,9 +45,6 @@
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/promise/promise.h"
-#include "src/core/lib/security/credentials/credentials.h"
-#include "src/core/lib/security/security_connector/security_connector.h"
-#include "src/core/lib/security/security_connector/ssl_utils.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
 #include "src/core/util/debug_location.h"

data/src/core/util/load_file.cc

@@ -24,6 +24,7 @@
 #include "absl/cleanup/cleanup.h"
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
+#include "src/core/util/strerror.h"
 
 namespace grpc_core {
 
@@ -35,10 +36,9 @@ namespace grpc_core {
 absl::StatusOr<Slice> LoadFile(const std::string& filename,
                                bool add_null_terminator) {
   unsigned char* contents = nullptr;
-  size_t contents_size = 0;
+  long contents_size = 0;
   FILE* file;
   size_t bytes_read = 0;
-  absl::Status error = absl::OkStatus();
   auto sock_cleanup = absl::MakeCleanup([&file]() -> void {
     if (file != nullptr) {
       fclose(file);
@@ -47,29 +47,41 @@ absl::StatusOr<Slice> LoadFile(const std::string& filename,
 
   file = fopen(filename.c_str(), "rb");
   if (file == nullptr) {
-    error = absl::InternalError(
+    return absl::InternalError(
         absl::StrCat("Failed to load file: ", filename,
-                     " due to error(fdopen): ", strerror(errno)));
-    return error;
+                     " due to error(fdopen): ", StrError(errno)));
+  }
+  if (fseek(file, 0, SEEK_END) < 0) {
+    return absl::InternalError(
+        absl::StrCat("Failed to load file: ", filename,
+                     " due to error(fseek): ", StrError(errno)));
+  }
+  if ((contents_size = static_cast<size_t>(ftell(file))) < 0) {
+    return absl::InternalError(
+        absl::StrCat("Failed to load file: ", filename,
+                     " due to error(ftell): ", StrError(errno)));
+  }
+  if (fseek(file, 0, SEEK_SET) < 0) {
+    return absl::InternalError(
+        absl::StrCat("Failed to load file: ", filename,
+                     " due to error(fseek): ", StrError(errno)));
   }
-  fseek(file, 0, SEEK_END);
-  // Converting to size_t on the assumption that it will not fail.
-  contents_size = static_cast<size_t>(ftell(file));
-  fseek(file, 0, SEEK_SET);
   contents = static_cast<unsigned char*>(
       gpr_malloc(contents_size + (add_null_terminator ? 1 : 0)));
   bytes_read = fread(contents, 1, contents_size, file);
-  if (bytes_read < contents_size) {
+  static_assert(LONG_MAX <= SIZE_MAX,
+                "size_t max should be more than long max");
+  if (bytes_read < static_cast<size_t>(contents_size)) {
     gpr_free(contents);
-    error = absl::InternalError(
+    return absl::InternalError(
         absl::StrCat("Failed to load file: ", filename,
-                     " due to error(fread): ", strerror(errno)));
-    return error;
+                     " due to error(fread): ", StrError(errno)));
   }
   if (add_null_terminator) {
     contents[contents_size++] = 0;
   }
-  return Slice(grpc_slice_new(contents, contents_size, gpr_free));
+  return Slice(
+      grpc_slice_new(contents, static_cast<size_t>(contents_size), gpr_free));
 }
 
 }  // namespace grpc_core

data/src/core/util/status_helper.cc

@@ -18,7 +18,7 @@
 
 #include "src/core/util/status_helper.h"
 
-#include <grpc/support/port_platform.h>
+#include <grpc/status.h>
 #include <string.h>
 
 #include <utility>
@@ -33,8 +33,11 @@
 #include "absl/time/clock.h"
 #include "google/protobuf/any.upb.h"
 #include "google/rpc/status.upb.h"
+#include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/slice/percent_encoding.h"
 #include "src/core/lib/slice/slice.h"
+#include "src/core/lib/transport/status_conversion.h"
+#include "src/core/util/time.h"
 #include "upb/base/string_view.h"
 #include "upb/mem/arena.hpp"
 
@@ -57,18 +60,12 @@ const absl::string_view kChildrenPropertyUrl = TYPE_URL(TYPE_CHILDREN_TAG);
 
 const char* GetStatusIntPropertyUrl(StatusIntProperty key) {
   switch (key) {
-    case StatusIntProperty::kFileLine:
-      return TYPE_URL(TYPE_INT_TAG "file_line");
     case StatusIntProperty::kStreamId:
       return TYPE_URL(TYPE_INT_TAG "stream_id");
     case StatusIntProperty::kRpcStatus:
       return TYPE_URL(TYPE_INT_TAG "grpc_status");
     case StatusIntProperty::kHttp2Error:
       return TYPE_URL(TYPE_INT_TAG "http2_error");
-    case StatusIntProperty::kFd:
-      return TYPE_URL(TYPE_INT_TAG "fd");
-    case StatusIntProperty::kOccurredDuringWrite:
-      return TYPE_URL(TYPE_INT_TAG "occurred_during_write");
     case StatusIntProperty::ChannelConnectivityState:
       return TYPE_URL(TYPE_INT_TAG "channel_connectivity_state");
     case StatusIntProperty::kLbPolicyDrop:
@@ -79,24 +76,12 @@ const char* GetStatusIntPropertyUrl(StatusIntProperty key) {
 
 const char* GetStatusStrPropertyUrl(StatusStrProperty key) {
   switch (key) {
-    case StatusStrProperty::kDescription:
-      return TYPE_URL(TYPE_STR_TAG "description");
-    case StatusStrProperty::kFile:
-      return TYPE_URL(TYPE_STR_TAG "file");
     case StatusStrProperty::kGrpcMessage:
       return TYPE_URL(TYPE_STR_TAG "grpc_message");
   }
   GPR_UNREACHABLE_CODE(return "unknown");
 }
 
-const char* GetStatusTimePropertyUrl(StatusTimeProperty key) {
-  switch (key) {
-    case StatusTimeProperty::kCreated:
-      return TYPE_URL(TYPE_TIME_TAG "created_time");
-  }
-  GPR_UNREACHABLE_CODE(return "unknown");
-}
-
 void EncodeUInt32ToBytes(uint32_t v, char* buf) {
   buf[0] = v & 0xFF;
   buf[1] = (v >> 8) & 0xFF;
@@ -133,16 +118,9 @@ std::vector<absl::Status> ParseChildren(absl::Cord children) {
 }  // namespace
 
 absl::Status StatusCreate(absl::StatusCode code, absl::string_view msg,
-                          const DebugLocation& location,
+                          const DebugLocation& /*location*/,
                           std::vector<absl::Status> children) {
   absl::Status s(code, msg);
-  if (location.file() != nullptr) {
-    StatusSetStr(&s, StatusStrProperty::kFile, location.file());
-  }
-  if (location.line() != -1) {
-    StatusSetInt(&s, StatusIntProperty::kFileLine, location.line());
-  }
-  StatusSetTime(&s, StatusTimeProperty::kCreated, absl::Now());
   for (const absl::Status& child : children) {
     if (!child.ok()) {
       StatusAddChild(&s, child);
@@ -151,13 +129,35 @@ absl::Status StatusCreate(absl::StatusCode code, absl::string_view msg,
   return s;
 }
 
+namespace {
+
+absl::Status ReplaceStatusCode(const absl::Status& status,
+                               absl::StatusCode code) {
+  absl::Status new_status(code, status.message());
+  status.ForEachPayload(
+      [&](absl::string_view type_url, const absl::Cord& payload) {
+        new_status.SetPayload(type_url, payload);
+      });
+  return new_status;
+}
+
+}  // namespace
+
 void StatusSetInt(absl::Status* status, StatusIntProperty key, intptr_t value) {
+  if (IsErrorFlattenEnabled() && key == StatusIntProperty::kRpcStatus) {
+    // When setting the RPC status, just replace the top-level status code.
+    *status = ReplaceStatusCode(*status, static_cast<absl::StatusCode>(value));
+    return;
+  }
   status->SetPayload(GetStatusIntPropertyUrl(key),
                      absl::Cord(std::to_string(value)));
 }
 
 std::optional<intptr_t> StatusGetInt(const absl::Status& status,
                                      StatusIntProperty key) {
+  if (IsErrorFlattenEnabled() && key == StatusIntProperty::kRpcStatus) {
+    return static_cast<intptr_t>(status.code());
+  }
   auto p = status.GetPayload(GetStatusIntPropertyUrl(key));
   if (p.has_value()) {
     auto sv = p->TryFlat();
@@ -175,13 +175,39 @@ std::optional<intptr_t> StatusGetInt(const absl::Status& status,
   return {};
 }
 
+namespace {
+
+absl::Status ReplaceStatusMessage(const absl::Status& status,
+                                  absl::string_view message) {
+  absl::Status new_status(status.code(), message);
+  status.ForEachPayload(
+      [&](absl::string_view type_url, const absl::Cord& payload) {
+        new_status.SetPayload(type_url, payload);
+      });
+  return new_status;
+}
+
+}  // namespace
+
 void StatusSetStr(absl::Status* status, StatusStrProperty key,
                   absl::string_view value) {
+  if (IsErrorFlattenEnabled() && key == StatusStrProperty::kGrpcMessage) {
+    if (!status->ok()) {
+      *status = ReplaceStatusMessage(
+          *status, status->message().empty()
+                       ? value
+                       : absl::StrCat(value, " (", status->message(), ")"));
+    }
+    return;
+  }
   status->SetPayload(GetStatusStrPropertyUrl(key), absl::Cord(value));
 }
 
 std::optional<std::string> StatusGetStr(const absl::Status& status,
                                         StatusStrProperty key) {
+  if (IsErrorFlattenEnabled() && key == StatusStrProperty::kGrpcMessage) {
+    return std::string(status.message());
+  }
   auto p = status.GetPayload(GetStatusStrPropertyUrl(key));
   if (p.has_value()) {
     return std::string(*p);
@@ -189,35 +215,37 @@ std::optional<std::string> StatusGetStr(const absl::Status& status,
   return {};
 }
 
-void StatusSetTime(absl::Status* status, StatusTimeProperty key,
-                   absl::Time time) {
-  std::string time_str =
-      absl::FormatTime(absl::RFC3339_full, time, absl::UTCTimeZone());
-  status->SetPayload(GetStatusTimePropertyUrl(key),
-                     absl::Cord(std::move(time_str)));
-}
-
-std::optional<absl::Time> StatusGetTime(const absl::Status& status,
-                                        StatusTimeProperty key) {
-  auto p = status.GetPayload(GetStatusTimePropertyUrl(key));
-  if (p.has_value()) {
-    auto sv = p->TryFlat();
-    absl::Time time;
-    if (sv.has_value()) {
-      if (absl::ParseTime(absl::RFC3339_full, sv.value(), &time, nullptr)) {
-        return time;
-      }
-    } else {
-      std::string s = std::string(*p);
-      if (absl::ParseTime(absl::RFC3339_full, s, &time, nullptr)) {
-        return time;
-      }
+void StatusAddChild(absl::Status* status, absl::Status child) {
+  if (IsErrorFlattenEnabled()) {
+    // If the child is OK, there's nothing to do.
+    if (child.ok()) return;
+    // If the parent is OK, replace it with the child.
+    if (status->ok()) {
+      *status = std::move(child);
+      return;
     }
+    // Parent and child are both non-OK, so we need to merge.
+    absl::Status new_status(
+        // Prefer any other code over UNKNOWN.
+        status->code() == absl::StatusCode::kUnknown ? child.code()
+                                                     : status->code(),
+        absl::StrCat(status->message(), " (", child.message(), ")"));
+    // TODO(roth): Remove this once we eliminate all status attributes.
+    status->ForEachPayload(
+        [&](absl::string_view type_url, const absl::Cord& payload) {
+          new_status.SetPayload(type_url, payload);
+        });
+    child.ForEachPayload(
+        [&](absl::string_view type_url, const absl::Cord& payload) {
+          // If the original error already has the attribute, don't overwrite
+          // it.
+          if (!new_status.GetPayload(type_url).has_value()) {
+            new_status.SetPayload(type_url, payload);
+          }
+        });
+    *status = std::move(new_status);
+    return;
   }
-  return {};
-}
-
-void StatusAddChild(absl::Status* status, absl::Status child) {
   upb::Arena arena;
   // Serialize msg to buf
   google_rpc_Status* msg = internal::StatusToProto(child, arena.ptr());
@@ -311,15 +339,10 @@ std::string StatusToString(const absl::Status& status) {
                      : absl::StrCat(head, " {", absl::StrJoin(kvs, ", "), "}");
 }
 
-absl::Status AddMessagePrefix(absl::string_view prefix, absl::Status status) {
-  absl::Status new_status(status.code(),
-                          absl::StrCat(prefix, ": ", status.message()));
-  // TODO(roth): Remove this once we eliminate all status attributes.
-  status.ForEachPayload(
-      [&](absl::string_view type_url, const absl::Cord& payload) {
-        new_status.SetPayload(type_url, payload);
-      });
-  return new_status;
+absl::Status AddMessagePrefix(absl::string_view prefix,
+                              const absl::Status& status) {
+  return ReplaceStatusMessage(status,
+                              absl::StrCat(prefix, ": ", status.message()));
 }
 
 namespace internal {

data/src/core/util/status_helper.h

@@ -46,42 +46,32 @@ namespace grpc_core {
 
 /// This enum should have the same value of grpc_error_ints
 enum class StatusIntProperty {
-  /// __LINE__ from the call site creating the error
-  kFileLine,
   /// stream identifier: for errors that are associated with an individual
   /// wire stream
+  // TODO(tjagtap): Remove this when the PH2 migration is done.
   kStreamId,
   /// grpc status code representing this error
-  // TODO(veblush): Remove this after grpc_error is replaced with absl::Status
+  // TODO(roth): Remove this after error_flatten experiment is removed.
   kRpcStatus,
   /// http2 error code associated with the error (see the HTTP2 RFC)
+  // TODO(tjagtap): Remove this as part of creating a new HTTP/2 error type.
   kHttp2Error,
-  /// File descriptor associated with this error
-  kFd,
-  /// chttp2: did the error occur while a write was in progress
-  kOccurredDuringWrite,
   /// channel connectivity state associated with the error
+  // TODO(roth): Remove this when the promise migration is done.
   ChannelConnectivityState,
   /// LB policy drop
+  // TODO(roth): Replace this with something else, possibly a call
+  // context element.
   kLbPolicyDrop,
 };
 
 /// This enum should have the same value of grpc_error_strs
+// TODO(roth): Remove this after error_flatten experiment is removed.
 enum class StatusStrProperty {
-  /// top-level textual description of this error
-  kDescription,
-  /// source file in which this error occurred
-  kFile,
   /// peer that we were trying to communicate when this error occurred
   kGrpcMessage,
 };
 
-/// This enum should have the same value of grpc_error_times
-enum class StatusTimeProperty {
-  /// timestamp of error creation
-  kCreated,
-};
-
 /// Creates a status with given additional information
 absl::Status StatusCreate(absl::StatusCode code, absl::string_view msg,
                           const DebugLocation& location,
@@ -103,14 +93,6 @@ void StatusSetStr(absl::Status* status, StatusStrProperty key,
 GRPC_MUST_USE_RESULT std::optional<std::string> StatusGetStr(
     const absl::Status& status, StatusStrProperty key);
 
-/// Sets the time property to the status
-void StatusSetTime(absl::Status* status, StatusTimeProperty key,
-                   absl::Time time);
-
-/// Gets the time property from the status
-GRPC_MUST_USE_RESULT std::optional<absl::Time> StatusGetTime(
-    const absl::Status& status, StatusTimeProperty key);
-
 /// Adds a child status to status
 void StatusAddChild(absl::Status* status, absl::Status child);
 
@@ -126,7 +108,8 @@ GRPC_MUST_USE_RESULT std::vector<absl::Status> StatusGetChildren(
 GRPC_MUST_USE_RESULT std::string StatusToString(const absl::Status& status);
 
 /// Adds prefix to the message of status.
-absl::Status AddMessagePrefix(absl::string_view prefix, absl::Status status);
+absl::Status AddMessagePrefix(absl::string_view prefix,
+                              const absl::Status& status);
 
 namespace internal {
 

data/src/core/xds/grpc/certificate_provider_store.cc

@@ -24,7 +24,7 @@
 #include "absl/log/log.h"
 #include "absl/strings/str_cat.h"
 #include "src/core/config/core_configuration.h"
-#include "src/core/lib/security/certificate_provider/certificate_provider_registry.h"
+#include "src/core/credentials/transport/tls/certificate_provider_registry.h"
 
 namespace grpc_core {
 

data/src/core/xds/grpc/certificate_provider_store.h

@@ -28,9 +28,9 @@
 
 #include "absl/base/thread_annotations.h"
 #include "absl/strings/string_view.h"
-#include "src/core/lib/security/certificate_provider/certificate_provider_factory.h"
-#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
-#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
+#include "src/core/credentials/transport/tls/certificate_provider_factory.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_provider.h"
 #include "src/core/util/json/json.h"
 #include "src/core/util/json/json_args.h"
 #include "src/core/util/json/json_object_loader.h"

data/src/core/xds/grpc/file_watcher_certificate_provider_factory.cc

@@ -29,7 +29,7 @@
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "src/core/config/core_configuration.h"
-#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_provider.h"
 #include "src/core/util/down_cast.h"
 
 namespace grpc_core {
@@ -55,11 +55,11 @@ std::string FileWatcherCertificateProviderFactory::Config::ToString() const {
     parts.push_back(
         absl::StrFormat("certificate_file=\"%s\", ", identity_cert_file_));
   }
-  if (!identity_cert_file_.empty()) {
+  if (!private_key_file_.empty()) {
     parts.push_back(
         absl::StrFormat("private_key_file=\"%s\", ", private_key_file_));
   }
-  if (!identity_cert_file_.empty()) {
+  if (!root_cert_file_.empty()) {
     parts.push_back(
         absl::StrFormat("ca_certificate_file=\"%s\", ", root_cert_file_));
   }

data/src/core/xds/grpc/file_watcher_certificate_provider_factory.h

@@ -25,7 +25,7 @@
 #include <string>
 
 #include "absl/strings/string_view.h"
-#include "src/core/lib/security/certificate_provider/certificate_provider_factory.h"
+#include "src/core/credentials/transport/tls/certificate_provider_factory.h"
 #include "src/core/util/json/json.h"
 #include "src/core/util/json/json_args.h"
 #include "src/core/util/json/json_object_loader.h"

data/src/core/xds/grpc/xds_bootstrap_grpc.cc

@@ -179,8 +179,12 @@ std::string GrpcXdsBootstrap::ToString() const {
                         node_->locality_zone(), node_->locality_sub_zone(),
                         JsonDump(Json::FromObject(node_->metadata()))));
   }
-  parts.push_back(
-      absl::StrFormat("servers=[\n%s\n],\n", JsonDump(servers_[0].ToJson())));
+  std::vector<std::string> server_strings;
+  for (auto& server : servers_) {
+    server_strings.emplace_back(server.Key());
+  }
+  parts.push_back(absl::StrFormat("    servers=[\n%s\n],\n",
+                                  absl::StrJoin(server_strings, ",\n")));
   if (!client_default_listener_resource_name_template_.empty()) {
     parts.push_back(absl::StrFormat(
         "client_default_listener_resource_name_template=\"%s\",\n",
@@ -197,14 +201,13 @@ std::string GrpcXdsBootstrap::ToString() const {
     parts.push_back(
         absl::StrFormat("    client_listener_resource_name_template=\"%s\",\n",
                         authority.client_listener_resource_name_template()));
-    std::vector<std::string> server_jsons;
+    std::vector<std::string> server_strings;
     for (const XdsServer* server : authority.servers()) {
-      server_jsons.emplace_back(
-          JsonDump(DownCast<const GrpcXdsServer*>(server)->ToJson()));
+      server_strings.emplace_back(server->Key());
     }
-    if (!server_jsons.empty()) {
+    if (!server_strings.empty()) {
       parts.push_back(absl::StrFormat("    servers=[\n%s\n],\n",
-                                      absl::StrJoin(server_jsons, ",\n")));
+                                      absl::StrJoin(server_strings, ",\n")));
     }
     parts.push_back("      },\n");
   }

data/src/core/xds/grpc/xds_certificate_provider.cc

@@ -25,9 +25,9 @@
 
 #include "absl/functional/bind_front.h"
 #include "absl/log/check.h"
+#include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/error.h"
-#include "src/core/lib/security/security_connector/ssl_utils.h"
 
 namespace grpc_core {
 

data/src/core/xds/grpc/xds_certificate_provider.h

@@ -30,8 +30,8 @@
 
 #include "absl/base/thread_annotations.h"
 #include "absl/strings/string_view.h"
-#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
-#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_provider.h"
 #include "src/core/util/matchers.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/sync.h"