grpc 1.81.1 → 1.85.0

data/src/core/credentials/call/token_fetcher/token_fetcher_credentials.cc

@@ -21,6 +21,7 @@
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/event_engine/default_event_engine.h"
 #include "src/core/lib/iomgr/pollset_set.h"
+#include "src/core/lib/promise/cancel_callback.h"
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
@@ -49,7 +50,7 @@ TokenFetcherCredentials::Token::Token(Slice token, Timestamp expiration)
       expiration_(expiration - kTokenExpirationAdjustmentDuration) {}
 
 void TokenFetcherCredentials::Token::AddTokenToClientInitialMetadata(
-    ClientMetadata& metadata) const {
+    ClientMetadata& metadata) {
   metadata.Append(GRPC_AUTHORIZATION_METADATA_KEY, token_.Ref(),
                   [](absl::string_view, const Slice&) { abort(); });
 }
@@ -93,7 +94,7 @@ void TokenFetcherCredentials::FetchState::BackoffTimer::Orphan() {
 }
 
 void TokenFetcherCredentials::FetchState::BackoffTimer::OnTimer() {
-  MutexLock lock(&fetch_state_->creds_->mu_);
+  MutexLock lock(fetch_state_->creds_->mu_);
   if (!timer_handle_.has_value()) return;
   timer_handle_.reset();
   GRPC_TRACE_LOG(token_fetcher_credentials, INFO)
@@ -155,7 +156,7 @@ void TokenFetcherCredentials::FetchState::StartFetchAttempt() {
 
 void TokenFetcherCredentials::FetchState::TokenFetchComplete(
     absl::StatusOr<RefCountedPtr<Token>> token) {
-  MutexLock lock(&creds_->mu_);
+  MutexLock lock(creds_->mu_);
   // If we were shut down, clean up.
   if (std::holds_alternative<Shutdown>(state_)) {
     if (token.ok()) token = absl::CancelledError("credentials shutdown");
@@ -192,9 +193,6 @@ void TokenFetcherCredentials::FetchState::ResumeQueuedCalls(
     queued_call->result = token;
     queued_call->done.store(true, std::memory_order_release);
     queued_call->waker.Wakeup();
-    grpc_polling_entity_del_from_pollset_set(
-        queued_call->pollent,
-        grpc_polling_entity_pollset_set(&creds_->pollent_));
   }
   queued_calls_.clear();
 }
@@ -204,9 +202,6 @@ TokenFetcherCredentials::FetchState::QueueCall(
     ClientMetadataHandle initial_metadata) {
   auto queued_call = MakeRefCounted<QueuedCall>();
   queued_call->waker = GetContext<Activity>()->MakeNonOwningWaker();
-  queued_call->pollent = GetContext<grpc_polling_entity>();
-  grpc_polling_entity_add_to_pollset_set(
-      queued_call->pollent, grpc_polling_entity_pollset_set(&creds_->pollent_));
   queued_call->md = std::move(initial_metadata);
   queued_calls_.insert(queued_call);
   // If backoff has expired since the last attempt, trigger a new one.
@@ -237,7 +232,7 @@ TokenFetcherCredentials::~TokenFetcherCredentials() {
 }
 
 void TokenFetcherCredentials::Orphaned() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   fetch_state_.reset();
 }
 
@@ -246,7 +241,7 @@ TokenFetcherCredentials::GetRequestMetadata(
     ClientMetadataHandle initial_metadata, const GetRequestMetadataArgs*) {
   RefCountedPtr<QueuedCall> queued_call;
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     // If we don't have a cached token or the token is within the
     // refresh duration, start a new fetch if there isn't a pending one.
     if ((token_ == nullptr || (token_->ExpirationTime() - Timestamp::Now()) <=
@@ -281,25 +276,39 @@ TokenFetcherCredentials::GetRequestMetadata(
         << " no cached token; queuing call";
     queued_call = fetch_state_->QueueCall(std::move(initial_metadata));
   }
-  return [this, queued_call = std::move(queued_call)]()
-             -> Poll<absl::StatusOr<ClientMetadataHandle>> {
-    if (!queued_call->done.load(std::memory_order_acquire)) {
-      return Pending{};
-    }
-    if (!queued_call->result.ok()) {
-      GRPC_TRACE_LOG(token_fetcher_credentials, INFO)
-          << "[TokenFetcherCredentials " << this
-          << "]: " << GetContext<Activity>()->DebugTag()
-          << " token fetch failed; failing call";
-      return queued_call->result.status();
-    }
-    GRPC_TRACE_LOG(token_fetcher_credentials, INFO)
-        << "[TokenFetcherCredentials " << this
-        << "]: " << GetContext<Activity>()->DebugTag()
-        << " token fetch complete; resuming call";
-    (*queued_call->result)->AddTokenToClientInitialMetadata(*queued_call->md);
-    return std::move(queued_call->md);
-  };
+  grpc_polling_entity_add_to_pollset_set(
+      GetContext<grpc_polling_entity>(),
+      grpc_polling_entity_pollset_set(&pollent_));
+  return OnCancel(
+      [self = WeakRefAsSubclass<TokenFetcherCredentials>(),
+       queued_call = std::move(
+           queued_call)]() -> Poll<absl::StatusOr<ClientMetadataHandle>> {
+        if (!queued_call->done.load(std::memory_order_acquire)) {
+          return Pending{};
+        }
+        grpc_polling_entity_del_from_pollset_set(
+            GetContext<grpc_polling_entity>(),
+            grpc_polling_entity_pollset_set(&self->pollent_));
+        if (!queued_call->result.ok()) {
+          GRPC_TRACE_LOG(token_fetcher_credentials, INFO)
+              << "[TokenFetcherCredentials " << self.get()
+              << "]: " << GetContext<Activity>()->DebugTag()
+              << " token fetch failed; failing call";
+          return queued_call->result.status();
+        }
+        GRPC_TRACE_LOG(token_fetcher_credentials, INFO)
+            << "[TokenFetcherCredentials " << self.get()
+            << "]: " << GetContext<Activity>()->DebugTag()
+            << " token fetch complete; resuming call";
+        (*queued_call->result)
+            ->AddTokenToClientInitialMetadata(*queued_call->md);
+        return std::move(queued_call->md);
+      },
+      [self = WeakRefAsSubclass<TokenFetcherCredentials>(),
+       pollent = GetContext<grpc_polling_entity>()]() {
+        grpc_polling_entity_del_from_pollset_set(
+            pollent, grpc_polling_entity_pollset_set(&self->pollent_));
+      });
 }
 
 //
@@ -307,13 +316,13 @@ TokenFetcherCredentials::GetRequestMetadata(
 //
 
 HttpTokenFetcherCredentials::HttpFetchRequest::HttpFetchRequest(
-    HttpTokenFetcherCredentials* creds, Timestamp deadline,
-    absl::AnyInvocable<void(absl::StatusOr<grpc_http_response>)> on_done)
-    : on_done_(std::move(on_done)) {
+    WeakRefCountedPtr<HttpTokenFetcherCredentials> creds, Timestamp deadline,
+    absl::AnyInvocable<void(absl::StatusOr<RefCountedPtr<Token>>)> on_done)
+    : creds_(std::move(creds)), on_done_(std::move(on_done)) {
   GRPC_CLOSURE_INIT(&on_http_response_, OnHttpResponse, this, nullptr);
   Ref().release();  // Ref held by HTTP request callback.
-  http_request_ = creds->StartHttpRequest(creds->pollent(), deadline,
-                                          &response_, &on_http_response_);
+  http_request_ = creds_->StartHttpRequest(creds_->pollent(), deadline,
+                                           &response_, &on_http_response_);
 }
 
 void HttpTokenFetcherCredentials::HttpFetchRequest::Orphan() {
@@ -332,6 +341,7 @@ void HttpTokenFetcherCredentials::HttpFetchRequest::OnHttpResponse(
     self->on_done_(absl::UnavailableError(StatusToString(error)));
     return;
   }
+  // Check HTTP status code.
   if (self->response_.status != 200) {
     grpc_status_code status_code =
         grpc_http2_status_to_grpc_status(self->response_.status);
@@ -344,7 +354,18 @@ void HttpTokenFetcherCredentials::HttpFetchRequest::OnHttpResponse(
                                   self->response_.status)));
     return;
   }
-  self->on_done_(self->response_);
+  // Extract token and return result.
+  auto token = self->creds_->ExtractToken(self->response_);
+  self->on_done_(std::move(token));
+}
+
+OrphanablePtr<TokenFetcherCredentials::FetchRequest>
+HttpTokenFetcherCredentials::FetchToken(
+    Timestamp deadline,
+    absl::AnyInvocable<void(absl::StatusOr<RefCountedPtr<Token>>)> on_done) {
+  return MakeOrphanable<HttpFetchRequest>(
+      WeakRefAsSubclass<HttpTokenFetcherCredentials>(), deadline,
+      std::move(on_done));
 }
 
 }  // namespace grpc_core

data/src/core/credentials/call/token_fetcher/token_fetcher_credentials.h

@@ -55,7 +55,11 @@ class TokenFetcherCredentials : public grpc_call_credentials {
     Timestamp ExpirationTime() const { return expiration_; }
 
     // Adds the token to the call's client initial metadata.
-    void AddTokenToClientInitialMetadata(ClientMetadata& metadata) const;
+    virtual void AddTokenToClientInitialMetadata(ClientMetadata& metadata);
+
+   protected:
+    // Returns the token's value.
+    const Slice& token() const { return token_; }
 
    private:
     Slice token_;
@@ -66,6 +70,8 @@ class TokenFetcherCredentials : public grpc_call_credentials {
 
   void Orphaned() override;
 
+  // TODO(roth): Change internal code to not override this method and then
+  // change it to 'final'.
   ArenaPromise<absl::StatusOr<ClientMetadataHandle>> GetRequestMetadata(
       ClientMetadataHandle initial_metadata,
       const GetRequestMetadataArgs* args) override;
@@ -96,7 +102,6 @@ class TokenFetcherCredentials : public grpc_call_credentials {
   struct QueuedCall : public RefCounted<QueuedCall> {
     std::atomic<bool> done{false};
     Waker waker;
-    grpc_polling_entity* pollent;
     ClientMetadataHandle md;
     absl::StatusOr<RefCountedPtr<Token>> result;
   };
@@ -177,32 +182,46 @@ class TokenFetcherCredentials : public grpc_call_credentials {
 };
 
 // A base class for fetching tokens via an HTTP request.
+// Subclasses must implement StartHttpRequest() and ExtractToken().
 class HttpTokenFetcherCredentials : public TokenFetcherCredentials {
  public:
+  // Starts an HTTP request.
   virtual OrphanablePtr<HttpRequest> StartHttpRequest(
       grpc_polling_entity* pollent, Timestamp deadline,
       grpc_http_response* response, grpc_closure* on_complete) = 0;
 
- protected:
+  // Extracts a token from the HTTP response.
+  // This will be called only if the HTTP status code was 200 (OK).
+  virtual absl::StatusOr<RefCountedPtr<Token>> ExtractToken(
+      const grpc_http_response& response) = 0;
+
+ private:
   // State held for a pending HTTP request.
   class HttpFetchRequest : public TokenFetcherCredentials::FetchRequest {
    public:
-    // The given callback should assume the http response status has already
-    // been checked and handle the token parsing.
     HttpFetchRequest(
-        HttpTokenFetcherCredentials* creds, Timestamp deadline,
-        absl::AnyInvocable<void(absl::StatusOr<grpc_http_response>)> on_done);
+        WeakRefCountedPtr<HttpTokenFetcherCredentials> creds,
+        Timestamp deadline,
+        absl::AnyInvocable<void(absl::StatusOr<RefCountedPtr<Token>>)> on_done);
+
     ~HttpFetchRequest() override { grpc_http_response_destroy(&response_); }
 
     void Orphan() override;
 
    private:
     static void OnHttpResponse(void* arg, grpc_error_handle error);
-    OrphanablePtr<HttpRequest> http_request_;
+
+    WeakRefCountedPtr<HttpTokenFetcherCredentials> creds_;
+    absl::AnyInvocable<void(absl::StatusOr<RefCountedPtr<Token>>)> on_done_;
     grpc_closure on_http_response_;
+    OrphanablePtr<HttpRequest> http_request_;
     grpc_http_response response_;
-    absl::AnyInvocable<void(absl::StatusOr<grpc_http_response>)> on_done_;
   };
+
+  OrphanablePtr<FetchRequest> FetchToken(
+      Timestamp deadline,
+      absl::AnyInvocable<void(absl::StatusOr<RefCountedPtr<Token>>)> on_done)
+      final;
 };
 
 }  // namespace grpc_core

data/src/core/credentials/transport/google_default/google_default_credentials.cc

@@ -266,14 +266,13 @@ static grpc_error_handle create_default_creds_from_path(
   if (creds_path.empty()) {
     return GRPC_ERROR_CREATE("creds_path unset");
   }
-  auto creds_data =
-      grpc_core::LoadFile(creds_path, /*add_null_terminator=*/false);
+  auto creds_data = grpc_core::LoadFile(creds_path);
   if (!creds_data.ok()) {
-    return absl_status_to_grpc_error(creds_data.status());
+    return creds_data.status();
   }
   auto json = grpc_core::JsonParse(creds_data->as_string_view());
   if (!json.ok()) {
-    return absl_status_to_grpc_error(json.status());
+    return json.status();
   }
   if (json->type() != Json::Type::kObject) {
     return GRPC_ERROR_CREATE(absl::StrCat("Failed to parse JSON \"",
@@ -315,7 +314,7 @@ static grpc_error_handle create_default_creds_from_path(
 
 static void update_tenancy() {
   gpr_once_init(&g_once, init_default_credentials);
-  grpc_core::MutexLock lock(g_state_mu);
+  grpc_core::MutexLock lock(*g_state_mu);
 
   // Try a platform-provided hint for GCE.
   if (!g_metadata_server_available) {
@@ -330,7 +329,7 @@ static void update_tenancy() {
 }
 
 static bool metadata_server_available() {
-  grpc_core::MutexLock lock(g_state_mu);
+  grpc_core::MutexLock lock(*g_state_mu);
   return static_cast<bool>(g_metadata_server_available);
 }
 
@@ -532,7 +531,7 @@ void set_gce_tenancy_checker_for_testing(grpc_gce_tenancy_checker checker) {
 void grpc_flush_cached_google_default_credentials(void) {
   ExecCtx exec_ctx;
   gpr_once_init(&g_once, init_default_credentials);
-  MutexLock lock(g_state_mu);
+  MutexLock lock(*g_state_mu);
   g_metadata_server_available = 0;
 }
 

data/src/core/credentials/transport/insecure/insecure_security_connector.h

@@ -45,7 +45,7 @@ namespace grpc_core {
 extern const char kInsecureTransportSecurityType[];
 
 // Exposed for testing purposes only.
-// Create an auth context which is necessary to pass the santiy check in
+// Create an auth context which is necessary to pass the sanity check in
 // client_auth_filter that verifies if the peer's auth context is obtained
 // during handshakes.
 RefCountedPtr<grpc_auth_context> TestOnlyMakeInsecureAuthContext();

data/src/core/credentials/transport/local/local_security_connector.cc

@@ -155,7 +155,7 @@ void local_check_peer(tsi_peer peer, grpc_endpoint* ep,
       &peer.properties[peer.property_count]);
   if (result != TSI_OK) return;
   peer.property_count++;
-  // Create an auth context which is necessary to pass the santiy check in
+  // Create an auth context which is necessary to pass the sanity check in
   // {client, server}_auth_filter that verifies if the peer's auth context is
   // obtained during handshakes. The auth context is only checked for its
   // existence and not actually used.

data/src/core/credentials/transport/ssl/ssl_credentials.cc

@@ -50,19 +50,18 @@
 //
 
 grpc_ssl_credentials::grpc_ssl_credentials(
-    const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
+    std::string pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
     const grpc_ssl_verify_peer_options* verify_options) {
-  build_config(pem_root_certs, pem_key_cert_pair, verify_options);
+  build_config(std::move(pem_root_certs), pem_key_cert_pair, verify_options);
   // Use default (e.g. OS) root certificates if the user did not pass any root
   // certificates.
-  if (config_.pem_root_certs == nullptr) {
-    const char* pem_root_certs =
+  if (config_.pem_root_certs.empty()) {
+    absl::string_view pem_root_certs =
         grpc_core::DefaultSslRootStore::GetPemRootCerts();
-    if (pem_root_certs == nullptr) {
+    if (pem_root_certs.empty()) {
       LOG(ERROR) << "Could not get default pem root certs.";
     } else {
-      char* default_roots = gpr_strdup(pem_root_certs);
-      config_.pem_root_certs = default_roots;
+      config_.pem_root_certs = std::string(pem_root_certs);
       root_store_ = grpc_core::DefaultSslRootStore::GetRootStore();
     }
   } else {
@@ -75,7 +74,6 @@ grpc_ssl_credentials::grpc_ssl_credentials(
 }
 
 grpc_ssl_credentials::~grpc_ssl_credentials() {
-  gpr_free(config_.pem_root_certs);
   if (config_.verify_options.verify_peer_destruct != nullptr) {
     config_.verify_options.verify_peer_destruct(
         config_.verify_options.verify_peer_callback_userdata);
@@ -87,7 +85,7 @@ grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_ssl_credentials::create_security_connector(
     grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
     const char* target, grpc_core::ChannelArgs* args) {
-  if (config_.pem_root_certs == nullptr) {
+  if (config_.pem_root_certs.empty()) {
     LOG(ERROR) << "No root certs in config. Client-side security connector "
                   "must have root certs.";
     return nullptr;
@@ -146,14 +144,14 @@ grpc_core::UniqueTypeName grpc_ssl_credentials::Type() {
 }
 
 void grpc_ssl_credentials::build_config(
-    const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
+    std::string pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
     const grpc_ssl_verify_peer_options* verify_options) {
-  config_.pem_root_certs = gpr_strdup(pem_root_certs);
+  config_.pem_root_certs = std::move(pem_root_certs);
   if (pem_key_cert_pair != nullptr) {
     GRPC_CHECK_NE(pem_key_cert_pair->private_key, nullptr);
     GRPC_CHECK_NE(pem_key_cert_pair->cert_chain, nullptr);
-    config_.pem_key_cert_pair.cert_chain = pem_key_cert_pair->cert_chain;
-    config_.pem_key_cert_pair.private_key = pem_key_cert_pair->private_key;
+    config_.pem_key_cert_pair = grpc_core::PemKeyCertPair(
+        pem_key_cert_pair->private_key, pem_key_cert_pair->cert_chain);
   }
   if (verify_options != nullptr) {
     memcpy(&config_.verify_options, verify_options,
@@ -175,7 +173,7 @@ void grpc_ssl_credentials::set_max_tls_version(
 }
 
 grpc_security_status grpc_ssl_credentials::InitializeClientHandshakerFactory(
-    const grpc_ssl_config* config, const char* pem_root_certs,
+    const grpc_ssl_config* config, std::string pem_root_certs,
     const tsi_ssl_root_certs_store* root_store,
     tsi_ssl_session_cache* ssl_session_cache,
     tsi_ssl_client_handshaker_factory** handshaker_factory) {
@@ -186,15 +184,16 @@ grpc_security_status grpc_ssl_credentials::InitializeClientHandshakerFactory(
   }
 
   bool has_key_cert_pair =
-      !grpc_core::IsPrivateKeyEmpty(config->pem_key_cert_pair.private_key) &&
-      !config->pem_key_cert_pair.cert_chain.empty();
+      !grpc_core::IsPrivateKeyEmpty(config->pem_key_cert_pair.private_key()) &&
+      !config->pem_key_cert_pair.cert_chain().empty();
   tsi_ssl_client_handshaker_options options;
-  if (pem_root_certs == nullptr) {
+  if (pem_root_certs.empty()) {
     LOG(ERROR) << "Handshaker factory creation failed. pem_root_certs cannot "
-                  "be nullptr";
+                  "be empty";
     return GRPC_SECURITY_ERROR;
   }
-  options.root_cert_info = std::make_shared<tsi::RootCertInfo>(pem_root_certs);
+  options.root_cert_info =
+      std::make_shared<tsi::RootCertInfo>(std::move(pem_root_certs));
   options.root_store = root_store;
   options.alpn_protocols =
       grpc_fill_alpn_protocol_strings(&options.num_alpn_protocols);
@@ -229,6 +228,7 @@ grpc_channel_credentials* grpc_ssl_credentials_create(
       << ")";
   GRPC_CHECK_EQ(reserved, nullptr);
 
+  if (pem_root_certs == nullptr) pem_root_certs = "";
   return new grpc_ssl_credentials(
       pem_root_certs, pem_key_cert_pair,
       reinterpret_cast<const grpc_ssl_verify_peer_options*>(verify_options));
@@ -244,6 +244,7 @@ grpc_channel_credentials* grpc_ssl_credentials_create_ex(
       << ")";
   GRPC_CHECK_EQ(reserved, nullptr);
 
+  if (pem_root_certs == nullptr) pem_root_certs = "";
   return new grpc_ssl_credentials(pem_root_certs, pem_key_cert_pair,
                                   verify_options);
 }
@@ -253,9 +254,11 @@ grpc_channel_credentials* grpc_ssl_credentials_create_ex(
 //
 
 struct grpc_ssl_server_credentials_options {
-  grpc_ssl_client_certificate_request_type client_certificate_request;
-  grpc_ssl_server_certificate_config* certificate_config;
-  grpc_ssl_server_certificate_config_fetcher* certificate_config_fetcher;
+  grpc_ssl_client_certificate_request_type client_certificate_request =
+      GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE;
+  std::unique_ptr<grpc_ssl_server_certificate_config> certificate_config;
+  std::unique_ptr<grpc_ssl_server_certificate_config_fetcher>
+      certificate_config_fetcher;
 };
 
 grpc_ssl_server_credentials::grpc_ssl_server_credentials(
@@ -271,9 +274,6 @@ grpc_ssl_server_credentials::grpc_ssl_server_credentials(
   }
 }
 
-grpc_ssl_server_credentials::~grpc_ssl_server_credentials() {
-  gpr_free(config_.pem_root_certs);
-}
 grpc_core::RefCountedPtr<grpc_server_security_connector>
 grpc_ssl_server_credentials::create_security_connector(
     const grpc_core::ChannelArgs& args) {
@@ -285,29 +285,29 @@ grpc_core::UniqueTypeName grpc_ssl_server_credentials::Type() {
   return kFactory.Create();
 }
 
-std::vector<tsi_ssl_pem_key_cert_pair> grpc_convert_grpc_to_tsi_cert_pairs(
+grpc_core::PemKeyCertPairList grpc_convert_grpc_to_key_cert_pairs(
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs) {
-  std::vector<tsi_ssl_pem_key_cert_pair> tsi_pairs;
+  grpc_core::PemKeyCertPairList key_cert_pairs;
   if (num_key_cert_pairs > 0) {
     GRPC_CHECK_NE(pem_key_cert_pairs, nullptr);
   }
   for (size_t i = 0; i < num_key_cert_pairs; i++) {
     GRPC_CHECK_NE(pem_key_cert_pairs[i].private_key, nullptr);
     GRPC_CHECK_NE(pem_key_cert_pairs[i].cert_chain, nullptr);
-    tsi_pairs.emplace_back(pem_key_cert_pairs[i].private_key,
-                           pem_key_cert_pairs[i].cert_chain);
+    key_cert_pairs.emplace_back(pem_key_cert_pairs[i].private_key,
+                                pem_key_cert_pairs[i].cert_chain);
   }
-  return tsi_pairs;
+  return key_cert_pairs;
 }
 
 void grpc_ssl_server_credentials::build_config(
-    const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
+    std::string pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs,
     grpc_ssl_client_certificate_request_type client_certificate_request) {
   config_.client_certificate_request = client_certificate_request;
-  config_.pem_root_certs = gpr_strdup(pem_root_certs);
-  config_.pem_key_cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
+  config_.pem_root_certs = std::move(pem_root_certs);
+  config_.pem_key_cert_pairs = grpc_convert_grpc_to_key_cert_pairs(
       pem_key_cert_pairs, num_key_cert_pairs);
 }
 
@@ -326,9 +326,8 @@ grpc_ssl_server_certificate_config* grpc_ssl_server_certificate_config_create(
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs) {
   grpc_ssl_server_certificate_config* config =
-      static_cast<grpc_ssl_server_certificate_config*>(
-          gpr_zalloc(sizeof(grpc_ssl_server_certificate_config)));
-  config->pem_root_certs = gpr_strdup(pem_root_certs);
+      new grpc_ssl_server_certificate_config;
+  if (pem_root_certs != nullptr) config->pem_root_certs = pem_root_certs;
   if (num_key_cert_pairs > 0) {
     GRPC_CHECK_NE(pem_key_cert_pairs, nullptr);
     config->pem_key_cert_pairs = static_cast<grpc_ssl_pem_key_cert_pair*>(
@@ -346,32 +345,31 @@ grpc_ssl_server_certificate_config* grpc_ssl_server_certificate_config_create(
   return config;
 }
 
+grpc_ssl_server_certificate_config::~grpc_ssl_server_certificate_config() {
+  for (size_t i = 0; i < num_key_cert_pairs; i++) {
+    gpr_free(const_cast<char*>(pem_key_cert_pairs[i].private_key));
+    gpr_free(const_cast<char*>(pem_key_cert_pairs[i].cert_chain));
+  }
+  gpr_free(pem_key_cert_pairs);
+}
+
 void grpc_ssl_server_certificate_config_destroy(
     grpc_ssl_server_certificate_config* config) {
-  if (config == nullptr) return;
-  for (size_t i = 0; i < config->num_key_cert_pairs; i++) {
-    gpr_free(const_cast<char*>(config->pem_key_cert_pairs[i].private_key));
-    gpr_free(const_cast<char*>(config->pem_key_cert_pairs[i].cert_chain));
-  }
-  gpr_free(config->pem_key_cert_pairs);
-  gpr_free(config->pem_root_certs);
-  gpr_free(config);
+  delete config;
 }
 
 grpc_ssl_server_credentials_options*
 grpc_ssl_server_credentials_create_options_using_config(
     grpc_ssl_client_certificate_request_type client_certificate_request,
     grpc_ssl_server_certificate_config* config) {
-  grpc_ssl_server_credentials_options* options = nullptr;
   if (config == nullptr) {
     LOG(ERROR) << "Certificate config must not be NULL.";
-    goto done;
+    return nullptr;
   }
-  options = static_cast<grpc_ssl_server_credentials_options*>(
-      gpr_zalloc(sizeof(grpc_ssl_server_credentials_options)));
+  grpc_ssl_server_credentials_options* options =
+      new grpc_ssl_server_credentials_options;
   options->client_certificate_request = client_certificate_request;
-  options->certificate_config = config;
-done:
+  options->certificate_config.reset(config);
   return options;
 }
 
@@ -384,17 +382,13 @@ grpc_ssl_server_credentials_create_options_using_config_fetcher(
     return nullptr;
   }
 
-  grpc_ssl_server_certificate_config_fetcher* fetcher =
-      static_cast<grpc_ssl_server_certificate_config_fetcher*>(
-          gpr_zalloc(sizeof(grpc_ssl_server_certificate_config_fetcher)));
-  fetcher->cb = cb;
-  fetcher->user_data = user_data;
-
   grpc_ssl_server_credentials_options* options =
-      static_cast<grpc_ssl_server_credentials_options*>(
-          gpr_zalloc(sizeof(grpc_ssl_server_credentials_options)));
+      new grpc_ssl_server_credentials_options;
   options->client_certificate_request = client_certificate_request;
-  options->certificate_config_fetcher = fetcher;
+  options->certificate_config_fetcher =
+      std::make_unique<grpc_ssl_server_certificate_config_fetcher>();
+  options->certificate_config_fetcher->cb = cb;
+  options->certificate_config_fetcher->user_data = user_data;
 
   return options;
 }
@@ -435,37 +429,30 @@ grpc_server_credentials* grpc_ssl_server_credentials_create_ex(
 
 grpc_server_credentials* grpc_ssl_server_credentials_create_with_options(
     grpc_ssl_server_credentials_options* options) {
-  grpc_server_credentials* retval = nullptr;
+  std::unique_ptr<grpc_ssl_server_credentials_options> options_owner(options);
 
   if (options == nullptr) {
     LOG(ERROR) << "Invalid options trying to create SSL server credentials.";
-    goto done;
+    return nullptr;
   }
 
   if (options->certificate_config == nullptr &&
       options->certificate_config_fetcher == nullptr) {
     LOG(ERROR) << "SSL server credentials options must specify either "
                   "certificate config or fetcher.";
-    goto done;
+    return nullptr;
   } else if (options->certificate_config_fetcher != nullptr &&
              options->certificate_config_fetcher->cb == nullptr) {
     LOG(ERROR) << "Certificate config fetcher callback must not be NULL.";
-    goto done;
+    return nullptr;
   }
 
-  retval = new grpc_ssl_server_credentials(*options);
-
-done:
-  grpc_ssl_server_credentials_options_destroy(options);
-  return retval;
+  return new grpc_ssl_server_credentials(*options);
 }
 
 void grpc_ssl_server_credentials_options_destroy(
     grpc_ssl_server_credentials_options* o) {
-  if (o == nullptr) return;
-  gpr_free(o->certificate_config_fetcher);
-  grpc_ssl_server_certificate_config_destroy(o->certificate_config);
-  gpr_free(o);
+  delete o;
 }
 
 namespace {