grpc 1.83.1 → 1.84.0

data/src/core/tsi/ssl_transport_security.h

@@ -63,9 +63,6 @@
 
 namespace tsi {
 using RootCertInfo = std::variant<std::string, grpc_core::SpiffeBundleMap>;
-
-using PrivateKey =
-    std::variant<std::string, std::shared_ptr<grpc_core::PrivateKeySigner>>;
 }  // namespace tsi
 
 // --- tsi_ssl_root_certs_store object ---
@@ -74,10 +71,10 @@ using PrivateKey =
 // context.
 typedef struct tsi_ssl_root_certs_store tsi_ssl_root_certs_store;
 
-// Given a NULL-terminated string containing the PEM encoding of the root
-// certificates, creates a tsi_ssl_root_certs_store object.
+// Given a string containing the PEM encoding of the root certificates,
+// creates a tsi_ssl_root_certs_store object.
 tsi_ssl_root_certs_store* tsi_ssl_root_certs_store_create(
-    const char* pem_roots);
+    absl::string_view pem_roots);
 
 // Destroys the tsi_ssl_root_certs_store object.
 void tsi_ssl_root_certs_store_destroy(tsi_ssl_root_certs_store* self);
@@ -119,19 +116,54 @@ typedef struct tsi_ssl_client_handshaker_factory
     tsi_ssl_client_handshaker_factory;
 
 // Object that holds a private key / certificate chain pair in PEM format.
-struct tsi_ssl_pem_key_cert_pair {
-  // private_key is either the string containing the PEM encoding of
-  // the client's private key or an implementation of PrivateKeySigner.
-  tsi::PrivateKey private_key;
-
-  // cert_chain is the string containing the PEM encoding of
-  // the client's certificate chain.
-  std::string cert_chain;
-
-  tsi_ssl_pem_key_cert_pair() = default;
-  tsi_ssl_pem_key_cert_pair(tsi::PrivateKey pk, std::string cert_chain_pem)
-      : private_key(std::move(pk)), cert_chain(std::move(cert_chain_pem)) {}
+namespace grpc_core {
+
+using PrivateKey = std::variant<std::string, std::shared_ptr<PrivateKeySigner>>;
+
+class PemKeyCertPair {
+ public:
+  PemKeyCertPair() = default;
+  PemKeyCertPair(PrivateKey private_key, absl::string_view cert_chain)
+      : private_key_(std::move(private_key)), cert_chain_(cert_chain) {}
+
+  // Movable.
+  PemKeyCertPair(PemKeyCertPair&& other) noexcept {
+    private_key_ = std::move(other.private_key_);
+    cert_chain_ = std::move(other.cert_chain_);
+  }
+  PemKeyCertPair& operator=(PemKeyCertPair&& other) noexcept {
+    private_key_ = std::move(other.private_key_);
+    cert_chain_ = std::move(other.cert_chain_);
+    return *this;
+  }
+
+  // Copyable.
+  PemKeyCertPair(const PemKeyCertPair& other)
+      : private_key_(other.private_key()), cert_chain_(other.cert_chain()) {}
+  PemKeyCertPair& operator=(const PemKeyCertPair& other) {
+    private_key_ = other.private_key();
+    cert_chain_ = other.cert_chain();
+    return *this;
+  }
+
+  bool operator==(const PemKeyCertPair& other) const {
+    return this->private_key() == other.private_key() &&
+           this->cert_chain() == other.cert_chain();
+  }
+
+  const PrivateKey& private_key() const { return private_key_; }
+  const std::string& cert_chain() const { return cert_chain_; }
+
+ private:
+  PrivateKey private_key_;
+  std::string cert_chain_;
 };
+
+using PemKeyCertPairList = std::vector<PemKeyCertPair>;
+using KeyCertPairsOrSelector =
+    std::variant<PemKeyCertPairList, std::shared_ptr<CertificateSelector>>;
+
+}  // namespace grpc_core
 // TO BE DEPRECATED.
 // Creates a client handshaker factory.
 // - pem_key_cert_pair is a pointer to the object containing client's private
@@ -154,7 +186,7 @@ struct tsi_ssl_pem_key_cert_pair {
 // - This method returns TSI_OK on success or TSI_INVALID_PARAMETER in the case
 //   where a parameter is invalid.
 tsi_result tsi_create_ssl_client_handshaker_factory(
-    const tsi_ssl_pem_key_cert_pair* pem_key_cert_pair,
+    const grpc_core::PemKeyCertPair* pem_key_cert_pair,
     const char* pem_root_certs, const char* cipher_suites,
     const char** alpn_protocols, uint16_t num_alpn_protocols,
     tsi_ssl_client_handshaker_factory** factory);
@@ -163,7 +195,7 @@ struct tsi_ssl_client_handshaker_options {
   // pem_key_cert_pair is a pointer to the object containing client's private
   // key and certificate chain. This parameter can be NULL if the client does
   // not have such a key/cert pair.
-  const tsi_ssl_pem_key_cert_pair* pem_key_cert_pair;
+  const grpc_core::PemKeyCertPair* pem_key_cert_pair;
   // root_store is a pointer to the ssl_root_certs_store object. If root_store
   // is not nullptr and SSL implementation permits, root_store will be used as
   // root certificates. Otherwise, pem_roots_cert will be used to load server
@@ -263,6 +295,7 @@ tsi_result tsi_ssl_client_handshaker_factory_create_handshaker(
     size_t ssl_bio_buf_size,
     std::optional<std::string> alpn_preferred_protocol_list,
     grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope,
+    std::string target, std::string locality, std::string backend_service,
     tsi_handshaker** handshaker);
 
 // Increments reference count of the client handshaker factory.
@@ -282,14 +315,10 @@ void tsi_ssl_client_handshaker_factory_unref(
 typedef struct tsi_ssl_server_handshaker_factory
     tsi_ssl_server_handshaker_factory;
 
-typedef std::variant<std::vector<tsi_ssl_pem_key_cert_pair>,
-                     std::shared_ptr<grpc_core::CertificateSelector>>
-    tsi_ssl_key_cert_pairs;
-
 // TO BE DEPRECATED.
 // Creates a server handshaker factory.
-// - pem_key_cert_pairs is an array private key / certificate chains of the
-//   server.
+// - key_cert_pairs_or_selector is an array private key / certificate chains of
+//   the server.
 // - pem_root_certs is the NULL-terminated string containing the PEM encoding
 //   of the client root certificates. This parameter may be NULL if the server
 //   does not want the client to be authenticated with SSL.
@@ -308,7 +337,7 @@ typedef std::variant<std::vector<tsi_ssl_pem_key_cert_pair>,
 // - This method returns TSI_OK on success or TSI_INVALID_PARAMETER in the case
 //   where a parameter is invalid.
 tsi_result tsi_create_ssl_server_handshaker_factory(
-    tsi_ssl_key_cert_pairs pem_key_cert_pairs,
+    grpc_core::KeyCertPairsOrSelector key_cert_pairs_or_selector,
     const char* pem_client_root_certs, int force_client_auth,
     const char* cipher_suites, const char** alpn_protocols,
     uint16_t num_alpn_protocols, tsi_ssl_server_handshaker_factory** factory);
@@ -321,17 +350,18 @@ tsi_result tsi_create_ssl_server_handshaker_factory(
 //   authenticate with an SSL cert. Note that this option is ignored if
 //   pem_client_root_certs is NULL or pem_client_roots_certs_size is 0
 tsi_result tsi_create_ssl_server_handshaker_factory_ex(
-    tsi_ssl_key_cert_pairs pem_key_cert, const char* pem_client_root_certs,
+    grpc_core::KeyCertPairsOrSelector key_cert_pairs_or_selector,
+    const char* pem_client_root_certs,
     tsi_client_certificate_request_type client_certificate_request,
     const char* cipher_suites, const char** alpn_protocols,
     uint16_t num_alpn_protocols, tsi_ssl_server_handshaker_factory** factory);
 
 struct tsi_ssl_server_handshaker_options {
-  // pem_key_cert_pairs is an array private key / certificate chains of the
-  // server, or a certificate selector. The array of key / certificate chains is
-  // to support SNI. The certificate selector will be in charge of this. So they
-  // are mutually exclusive.
-  tsi_ssl_key_cert_pairs pem_key_cert_pairs;
+  // key_cert_pairs_or_selector is an array of pem private key / certificate
+  // chains of the server, or a certificate selector. The array of key /
+  // certificate chains is to support SNI. The certificate selector will be in
+  // charge of this. So they are mutually exclusive.
+  grpc_core::KeyCertPairsOrSelector key_cert_pairs_or_selector;
   // client_certificate_request, if set to non-zero will force the client to
   // authenticate with an SSL cert. Note that this option is ignored if
   // root_cert_info is NULL

data/src/core/tsi/tls_telemetry.cc

@@ -0,0 +1,31 @@
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/core/tsi/tls_telemetry.h"
+
+#include "src/core/telemetry/instrument.h"
+
+namespace grpc_core {
+
+TlsClientHandshakeTelemetryDomain::CounterHandle
+    TlsClientHandshakeTelemetryDomain::kHandshakes = RegisterCounter(
+        "grpc.client.tls.handshakes",
+        "Total number of client-side TLS handshakes", "{handshake}");
+
+TlsServerHandshakeTelemetryDomain::CounterHandle
+    TlsServerHandshakeTelemetryDomain::kHandshakes = RegisterCounter(
+        "grpc.server.tls.handshakes",
+        "Total number of server-side TLS handshakes", "{handshake}");
+
+}  // namespace grpc_core

data/src/core/tsi/tls_telemetry.h

@@ -0,0 +1,47 @@
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_TSI_TLS_TELEMETRY_H
+#define GRPC_SRC_CORE_TSI_TLS_TELEMETRY_H
+
+#include "src/core/telemetry/instrument.h"
+
+namespace grpc_core {
+
+class TlsClientHandshakeTelemetryDomain final
+    : public InstrumentDomain<TlsClientHandshakeTelemetryDomain> {
+ public:
+  GRPC_INSTRUMENT_DOMAIN_LABELS("grpc.tls.handshake.result", "grpc.target",
+                                "grpc.tls.handshake.resumed",
+                                "grpc.lb.locality", "grpc.lb.backend_service");
+  using Backend = LowContentionBackend;
+  static constexpr absl::string_view kName = "tls_client_security_handshaker";
+
+  static CounterHandle kHandshakes;
+};
+
+class TlsServerHandshakeTelemetryDomain final
+    : public InstrumentDomain<TlsServerHandshakeTelemetryDomain> {
+ public:
+  GRPC_INSTRUMENT_DOMAIN_LABELS("grpc.tls.handshake.result",
+                                "grpc.tls.handshake.resumed");
+  using Backend = LowContentionBackend;
+  static constexpr absl::string_view kName = "tls_server_security_handshaker";
+
+  static CounterHandle kHandshakes;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_TSI_TLS_TELEMETRY_H

data/src/core/tsi/transport_security.cc

@@ -232,10 +232,10 @@ tsi_result tsi_handshaker_next(
                             handshaker_result, cb, user_data, error);
 }
 
-void tsi_handshaker_shutdown(tsi_handshaker* self) {
+void tsi_handshaker_shutdown(tsi_handshaker* self, bool peer_closed) {
   if (self == nullptr || self->vtable == nullptr) return;
   if (self->vtable->shutdown != nullptr) {
-    self->vtable->shutdown(self);
+    self->vtable->shutdown(self, peer_closed);
   }
   self->handshake_shutdown = true;
 }

data/src/core/tsi/transport_security.h

@@ -80,7 +80,7 @@ struct tsi_handshaker_vtable {
                      tsi_handshaker_result** handshaker_result,
                      tsi_handshaker_on_next_done_cb cb, void* user_data,
                      std::string* error);
-  void (*shutdown)(tsi_handshaker* self);
+  void (*shutdown)(tsi_handshaker* self, bool peer_closed);
 };
 struct tsi_handshaker {
   tsi_handshaker() = default;

data/src/core/tsi/transport_security_interface.h

@@ -505,7 +505,7 @@ tsi_result tsi_handshaker_next(tsi_handshaker* self,
 // This method will be invoked when TSI handshake should be terminated before
 // being finished in order to free any resources being used.
 //
-void tsi_handshaker_shutdown(tsi_handshaker* self);
+void tsi_handshaker_shutdown(tsi_handshaker* self, bool peer_closed = false);
 
 // This method releases the tsi_handshaker object. After this method is called,
 // no other method can be called on the object.

data/src/core/{resolver/dns/native/dns_resolver.h → util/address_sorting_init.cc}

@@ -1,4 +1,6 @@
-// Copyright 2022 The gRPC Authors
+//
+//
+// Copyright 2026 gRPC authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -11,14 +13,25 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-#ifndef GRPC_SRC_CORE_RESOLVER_DNS_NATIVE_DNS_RESOLVER_H
-#define GRPC_SRC_CORE_RESOLVER_DNS_NATIVE_DNS_RESOLVER_H
-#include <grpc/support/port_platform.h>
+//
+//
+
+#include "src/core/util/address_sorting_init.h"
+
+#include <address_sorting/address_sorting.h>
 
-#include "src/core/config/core_configuration.h"
+#include "absl/base/call_once.h"
 
 namespace grpc_core {
-void RegisterNativeDnsResolver(CoreConfiguration::Builder* builder);
-}  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_RESOLVER_DNS_NATIVE_DNS_RESOLVER_H
+namespace {
+
+absl::once_flag init_flag;
+
+}  // namespace
+
+void AddressSortingInitOnce() {
+  absl::call_once(init_flag, []() { address_sorting_init(); });
+}
+
+}  // namespace grpc_core

data/src/core/{resolver/dns/c_ares/grpc_ares_wrapper_posix.cc → util/address_sorting_init.h}

@@ -1,6 +1,6 @@
 //
 //
-// Copyright 2016 gRPC authors.
+// Copyright 2026 gRPC authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,14 +16,13 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
+#ifndef GRPC_SRC_CORE_UTIL_ADDRESS_SORTING_INIT_H
+#define GRPC_SRC_CORE_UTIL_ADDRESS_SORTING_INIT_H
 
-#include "src/core/lib/iomgr/port.h"
-#if GRPC_ARES == 1 && defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
+namespace grpc_core {
 
-#include "src/core/lib/iomgr/socket_utils_posix.h"
-#include "src/core/resolver/dns/c_ares/grpc_ares_wrapper.h"
+void AddressSortingInitOnce();
 
-bool grpc_ares_query_ipv6() { return grpc_ipv6_loopback_available(); }
+}  // namespace grpc_core
 
-#endif  // GRPC_ARES == 1 && defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
+#endif  // GRPC_SRC_CORE_UTIL_ADDRESS_SORTING_INIT_H

data/src/core/util/http_client/httpcli.cc

@@ -41,7 +41,6 @@
 #include "src/core/lib/iomgr/endpoint.h"
 #include "src/core/lib/iomgr/iomgr_internal.h"
 #include "src/core/lib/iomgr/pollset_set.h"
-#include "src/core/lib/iomgr/resolve_address.h"
 #include "src/core/lib/resource_quota/api.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/error_utils.h"
@@ -176,15 +175,10 @@ HttpRequest::HttpRequest(
       pollent_(pollent),
       pollset_set_(grpc_pollset_set_create()),
       test_only_generate_response_(std::move(test_only_generate_response)),
-      use_event_engine_dns_resolver_(IsEventEngineDnsNonClientChannelEnabled()),
-      resolver_(!use_event_engine_dns_resolver_ ? GetDNSResolver() : nullptr),
       ee_resolver_(
-          use_event_engine_dns_resolver_
-              ? ChannelArgs::FromC(channel_args_)
-                    .GetObjectRef<EventEngine>()
-                    ->GetDNSResolver(
-                        EventEngine::DNSResolver::ResolverOptions())
-              : absl::InternalError("EventEngine DNS is not enabled")) {
+          ChannelArgs::FromC(channel_args_)
+              .GetObjectRef<EventEngine>()
+              ->GetDNSResolver(EventEngine::DNSResolver::ResolverOptions())) {
   grpc_http_parser_init(&parser_, GRPC_HTTP_RESPONSE, response);
   grpc_slice_buffer_init(&incoming_);
   grpc_slice_buffer_init(&outgoing_);
@@ -219,38 +213,19 @@ void HttpRequest::Start() {
   if (test_only_generate_response_.has_value()) {
     if (test_only_generate_response_.value()()) return;
   }
-  if (use_event_engine_dns_resolver_ && !ee_resolver_.ok()) {
+  if (!ee_resolver_.ok()) {
     Finish(ee_resolver_.status());
     return;
   }
   Ref().release();  // ref held by pending DNS resolution
-  if (use_event_engine_dns_resolver_) {
-    (*ee_resolver_)
-        ->LookupHostname(
-            [this](absl::StatusOr<std::vector<EventEngine::ResolvedAddress>>
-                       addresses_or) {
-              ExecCtx exec_ctx;
-              OnResolved(addresses_or);
-            },
-            uri_.authority(), uri_.scheme());
-  } else {
-    dns_request_handle_ = resolver_->LookupHostname(
-        [this](absl::StatusOr<std::vector<grpc_resolved_address>> addresses) {
-          if (addresses.ok()) {
-            std::vector<EventEngine::ResolvedAddress> ee_addresses;
-            for (const auto& addr : *addresses) {
-              ee_addresses.push_back(
-                  grpc_event_engine::experimental::CreateResolvedAddress(addr));
-            }
-            OnResolved(ee_addresses);
-          } else {
-            OnResolved(addresses.status());
-          }
-        },
-        uri_.authority(), uri_.scheme(), kDefaultDNSRequestTimeout,
-        pollset_set_,
-        /*name_server=*/"");
-  }
+  (*ee_resolver_)
+      ->LookupHostname(
+          [this](absl::StatusOr<std::vector<EventEngine::ResolvedAddress>>
+                     addresses_or) {
+            ExecCtx exec_ctx;
+            OnResolved(addresses_or);
+          },
+          uri_.authority(), uri_.scheme());
 }
 
 void HttpRequest::Orphan() {
@@ -259,16 +234,8 @@ void HttpRequest::Orphan() {
     GRPC_CHECK(!cancelled_);
     cancelled_ = true;
     // cancel potentially pending DNS resolution.
-    if (use_event_engine_dns_resolver_) {
-      if (*ee_resolver_ != nullptr) {
-        ee_resolver_->reset();
-      }
-    } else {
-      if (dns_request_handle_.has_value() &&
-          resolver_->Cancel(dns_request_handle_.value())) {
-        Finish(GRPC_ERROR_CREATE("cancelled during DNS resolution"));
-        Unref();
-      }
+    if (*ee_resolver_ != nullptr) {
+      ee_resolver_->reset();
     }
     if (handshake_mgr_ != nullptr) {
       // Shutdown will cancel any ongoing tcp connect.
@@ -410,17 +377,13 @@ void HttpRequest::OnResolved(
     absl::StatusOr<std::vector<EventEngine::ResolvedAddress>> addresses_or) {
   RefCountedPtr<HttpRequest> unreffer(this);
   MutexLock lock(&mu_);
-  if (use_event_engine_dns_resolver_) {
-    ee_resolver_->reset();
-  } else {
-    dns_request_handle_.reset();
-  }
+  ee_resolver_->reset();
   if (cancelled_) {
     Finish(GRPC_ERROR_CREATE("cancelled during DNS resolution"));
     return;
   }
   if (!addresses_or.ok()) {
-    Finish(absl_status_to_grpc_error(addresses_or.status()));
+    Finish(addresses_or.status());
     return;
   }
   addresses_ = std::move(*addresses_or);

data/src/core/util/http_client/httpcli.h

@@ -39,7 +39,6 @@
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/iomgr/iomgr_internal.h"
 #include "src/core/lib/iomgr/polling_entity.h"
-#include "src/core/lib/iomgr/resolve_address.h"
 #include "src/core/lib/resource_quota/resource_quota.h"
 #include "src/core/util/debug_location.h"
 #include "src/core/util/http_client/parser.h"
@@ -266,12 +265,6 @@ class HttpRequest : public InternallyRefCounted<HttpRequest> {
   grpc_slice_buffer incoming_ ABSL_GUARDED_BY(mu_);
   grpc_slice_buffer outgoing_ ABSL_GUARDED_BY(mu_);
   grpc_error_handle overall_error_ ABSL_GUARDED_BY(mu_) = absl::OkStatus();
-  // TODO(yijiem): remove these once event_engine_dns_non_client_channel
-  // experiment is fully enabled.
-  bool use_event_engine_dns_resolver_;
-  std::shared_ptr<DNSResolver> resolver_;
-  std::optional<DNSResolver::TaskHandle> dns_request_handle_
-      ABSL_GUARDED_BY(mu_) = DNSResolver::kNullHandle;
   absl::StatusOr<std::unique_ptr<
       grpc_event_engine::experimental::EventEngine::DNSResolver>>
       ee_resolver_;

data/src/core/util/http_client/httpcli_security_connector.cc

@@ -74,12 +74,12 @@ class grpc_httpcli_ssl_channel_security_connector final
     }
   }
 
-  tsi_result InitHandshakerFactory(const char* pem_root_certs,
+  tsi_result InitHandshakerFactory(absl::string_view pem_root_certs,
                                    const tsi_ssl_root_certs_store* root_store) {
     tsi_ssl_client_handshaker_options options;
-    if (pem_root_certs != nullptr) {
+    if (!pem_root_certs.empty()) {
       options.root_cert_info =
-          std::make_shared<tsi::RootCertInfo>(pem_root_certs);
+          std::make_shared<tsi::RootCertInfo>(std::string(pem_root_certs));
     }
     options.root_store = root_store;
     return tsi_create_ssl_client_handshaker_factory_with_options(
@@ -95,7 +95,8 @@ class grpc_httpcli_ssl_channel_security_connector final
           handshaker_factory_, secure_peer_name_, /*network_bio_buf_size=*/0,
           /*ssl_bio_buf_size=*/0,
           args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS),
-          /*collection_scope=*/nullptr, &handshaker);
+          /*collection_scope=*/nullptr, /*target=*/secure_peer_name_,
+          /*locality=*/"", /*backend_service=*/"", &handshaker);
       if (result != TSI_OK) {
         LOG(ERROR) << "Handshaker creation failed with error "
                    << tsi_result_to_string(result);
@@ -139,6 +140,10 @@ class grpc_httpcli_ssl_channel_security_connector final
     return ImmediateOkStatus();
   }
 
+  UniqueTypeName type() const override {
+    return GRPC_UNIQUE_TYPE_NAME_HERE("httpcli_ssl");
+  }
+
   const char* secure_peer_name() const { return secure_peer_name_; }
 
  private:
@@ -148,9 +153,9 @@ class grpc_httpcli_ssl_channel_security_connector final
 
 RefCountedPtr<grpc_channel_security_connector>
 httpcli_ssl_channel_security_connector_create(
-    const char* pem_root_certs, const tsi_ssl_root_certs_store* root_store,
-    const char* secure_peer_name) {
-  if (secure_peer_name != nullptr && pem_root_certs == nullptr) {
+    absl::string_view pem_root_certs,
+    const tsi_ssl_root_certs_store* root_store, const char* secure_peer_name) {
+  if (secure_peer_name != nullptr && pem_root_certs.empty()) {
     LOG(ERROR) << "Cannot assert a secure peer name without a trust root.";
     return nullptr;
   }
@@ -171,7 +176,7 @@ class HttpRequestSSLCredentials : public grpc_channel_credentials {
   RefCountedPtr<grpc_channel_security_connector> create_security_connector(
       RefCountedPtr<grpc_call_credentials> /*call_creds*/, const char* target,
       ChannelArgs* args) override {
-    const char* pem_root_certs = DefaultSslRootStore::GetPemRootCerts();
+    absl::string_view pem_root_certs = DefaultSslRootStore::GetPemRootCerts();
     const tsi_ssl_root_certs_store* root_store =
         DefaultSslRootStore::GetRootStore();
     if (root_store == nullptr) {

data/src/core/util/linux/cpu.cc

@@ -48,7 +48,7 @@ static void init_num_cpus() {
 #endif
   // This must be signed. sysconf returns -1 when the number cannot be
   // determined
-  ncpus = static_cast<int>(sysconf(_SC_NPROCESSORS_CONF));
+  ncpus = static_cast<int>(sysconf(_SC_NPROCESSORS_ONLN));
   if (ncpus < 1) {
     LOG(ERROR) << "Cannot determine number of CPUs: assuming 1";
     ncpus = 1;

data/src/core/util/load_file.cc

@@ -28,13 +28,11 @@
 
 namespace grpc_core {
 
-// Loads the content of a file into a slice. add_null_terminator will add a NULL
-// terminator if true.
+// Loads the content of a file into a slice.
 // This API is NOT thread-safe and requires proper synchronization when used by
 // multiple threads, especially when they can happen to be reading from the same
 // file.
-absl::StatusOr<Slice> LoadFile(const std::string& filename,
-                               bool add_null_terminator) {
+absl::StatusOr<Slice> LoadFile(const std::string& filename) {
   unsigned char* contents = nullptr;
   long contents_size = 0;
   FILE* file;
@@ -66,8 +64,7 @@ absl::StatusOr<Slice> LoadFile(const std::string& filename,
         absl::StrCat("Failed to load file: ", filename,
                      " due to error(fseek): ", StrError(errno)));
   }
-  contents = static_cast<unsigned char*>(
-      gpr_malloc(contents_size + (add_null_terminator ? 1 : 0)));
+  contents = static_cast<unsigned char*>(gpr_malloc(contents_size));
   bytes_read = fread(contents, 1, contents_size, file);
   static_assert(LONG_MAX <= SIZE_MAX,
                 "size_t max should be more than long max");
@@ -77,9 +74,6 @@ absl::StatusOr<Slice> LoadFile(const std::string& filename,
         absl::StrCat("Failed to load file: ", filename,
                      " due to error(fread): ", StrError(errno)));
   }
-  if (add_null_terminator) {
-    contents[contents_size++] = 0;
-  }
   return Slice(
       grpc_slice_new(contents, static_cast<size_t>(contents_size), gpr_free));
 }

data/src/core/util/load_file.h

@@ -24,10 +24,9 @@
 
 namespace grpc_core {
 
-// Loads the content of a file into a slice. add_null_terminator will add a NULL
-// terminator if true.
-absl::StatusOr<Slice> LoadFile(const std::string& filename,
-                               bool add_null_terminator);
+// Loads the content of a file into a slice.
+absl::StatusOr<Slice> LoadFile(const std::string& filename);
+
 }  // namespace grpc_core
 
 #endif  // GRPC_SRC_CORE_UTIL_LOAD_FILE_H

data/src/core/util/matchers.h

@@ -49,7 +49,11 @@ class StringMatcher {
   StringMatcher& operator=(const StringMatcher& other);
   StringMatcher(StringMatcher&& other) noexcept;
   StringMatcher& operator=(StringMatcher&& other) noexcept;
+
   bool operator==(const StringMatcher& other) const;
+  bool operator!=(const StringMatcher& other) const {
+    return !(*this == other);
+  }
 
   bool Match(absl::string_view value) const;
 
@@ -120,7 +124,11 @@ class HeaderMatcher {
   HeaderMatcher& operator=(const HeaderMatcher& other);
   HeaderMatcher(HeaderMatcher&& other) noexcept;
   HeaderMatcher& operator=(HeaderMatcher&& other) noexcept;
+
   bool operator==(const HeaderMatcher& other) const;
+  bool operator!=(const HeaderMatcher& other) const {
+    return !(*this == other);
+  }
 
   const std::string& name() const { return name_; }
 

data/src/core/util/posix/cpu.cc

@@ -36,7 +36,7 @@ static long ncpus = 0;
 static pthread_key_t thread_id_key;
 
 static void init_ncpus() {
-  ncpus = sysconf(_SC_NPROCESSORS_CONF);
+  ncpus = sysconf(_SC_NPROCESSORS_ONLN);
   if (ncpus < 1 || ncpus > INT32_MAX) {
     LOG(ERROR) << "Cannot determine number of CPUs: assuming 1";
     ncpus = 1;