grpc 1.83.1 → 1.84.0

data/src/core/xds/grpc/xds_tls_context.cc

@@ -0,0 +1,117 @@
+//
+// Copyright 2018 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/xds/grpc/xds_tls_context.h"
+
+#include <string>
+#include <variant>
+
+#include "src/core/util/match.h"
+#include "src/core/util/string.h"
+
+namespace grpc_core {
+
+//
+// CommonTlsContext::CertificateProviderPluginInstance
+//
+
+std::string CommonTlsContext::CertificateProviderPluginInstance::ToString()
+    const {
+  std::string result = "{";
+  bool is_first = true;
+  if (!instance_name.empty()) {
+    StrAppend(result, "instance_name=");
+    StrAppend(result, instance_name);
+    is_first = false;
+  }
+  if (!certificate_name.empty()) {
+    if (!is_first) StrAppend(result, ", ");
+    StrAppend(result, "certificate_name=");
+    StrAppend(result, certificate_name);
+  }
+  StrAppend(result, "}");
+  return result;
+}
+
+bool CommonTlsContext::CertificateProviderPluginInstance::Empty() const {
+  return instance_name.empty() && certificate_name.empty();
+}
+
+//
+// CommonTlsContext::CertificateValidationContext
+//
+
+std::string CommonTlsContext::CertificateValidationContext::ToString() const {
+  std::string result = "{";
+  bool is_first = true;
+  Match(
+      ca_certs, [](const std::monostate&) {},
+      [&](const CertificateProviderPluginInstance& cert_provider) {
+        StrAppend(result, "ca_certs=cert_provider");
+        StrAppend(result, cert_provider.ToString());
+        is_first = false;
+      },
+      [&](const SystemRootCerts&) {
+        StrAppend(result, "ca_certs=system_root_certs{}");
+        is_first = false;
+      });
+  if (!match_subject_alt_names.empty()) {
+    if (!is_first) StrAppend(result, ", ");
+    StrAppend(result, "match_subject_alt_names=[");
+    bool is_first_san = true;
+    for (const auto& match : match_subject_alt_names) {
+      if (!is_first_san) StrAppend(result, ", ");
+      StrAppend(result, match.ToString());
+      is_first_san = false;
+    }
+    StrAppend(result, "]");
+  }
+  StrAppend(result, "}");
+  return result;
+}
+
+bool CommonTlsContext::CertificateValidationContext::Empty() const {
+  return std::holds_alternative<std::monostate>(ca_certs) &&
+         match_subject_alt_names.empty();
+}
+
+//
+// CommonTlsContext
+//
+
+std::string CommonTlsContext::ToString() const {
+  std::string result = "{";
+  bool is_first = true;
+  if (!tls_certificate_provider_instance.Empty()) {
+    StrAppend(result, "tls_certificate_provider_instance=");
+    StrAppend(result, tls_certificate_provider_instance.ToString());
+    is_first = false;
+  }
+  if (!certificate_validation_context.Empty()) {
+    if (!is_first) StrAppend(result, ", ");
+    StrAppend(result, "certificate_validation_context=");
+    StrAppend(result, certificate_validation_context.ToString());
+  }
+  StrAppend(result, "}");
+  return result;
+}
+
+bool CommonTlsContext::Empty() const {
+  return tls_certificate_provider_instance.Empty() &&
+         certificate_validation_context.Empty();
+}
+
+}  // namespace grpc_core

data/src/core/xds/grpc/xds_tls_context.h

@@ -0,0 +1,76 @@
+//
+// Copyright 2018 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_XDS_GRPC_XDS_TLS_CONTEXT_H
+#define GRPC_SRC_CORE_XDS_GRPC_XDS_TLS_CONTEXT_H
+
+#include <string>
+#include <variant>
+#include <vector>
+
+#include "src/core/util/matchers.h"
+
+namespace grpc_core {
+
+struct CommonTlsContext {
+  struct CertificateProviderPluginInstance {
+    std::string instance_name;
+    std::string certificate_name;
+
+    bool operator==(const CertificateProviderPluginInstance& other) const {
+      return instance_name == other.instance_name &&
+             certificate_name == other.certificate_name;
+    }
+
+    std::string ToString() const;
+    bool Empty() const;
+  };
+
+  struct CertificateValidationContext {
+    struct SystemRootCerts {
+      bool operator==(const SystemRootCerts&) const { return true; }
+    };
+    std::variant<std::monostate, CertificateProviderPluginInstance,
+                 SystemRootCerts>
+        ca_certs;
+    std::vector<StringMatcher> match_subject_alt_names;
+
+    bool operator==(const CertificateValidationContext& other) const {
+      return ca_certs == other.ca_certs &&
+             match_subject_alt_names == other.match_subject_alt_names;
+    }
+
+    std::string ToString() const;
+    bool Empty() const;
+  };
+
+  CertificateValidationContext certificate_validation_context;
+  CertificateProviderPluginInstance tls_certificate_provider_instance;
+
+  bool operator==(const CommonTlsContext& other) const {
+    return certificate_validation_context ==
+               other.certificate_validation_context &&
+           tls_certificate_provider_instance ==
+               other.tls_certificate_provider_instance;
+  }
+
+  std::string ToString() const;
+  bool Empty() const;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_XDS_GRPC_XDS_TLS_CONTEXT_H

data/src/core/xds/grpc/xds_tls_context_parser.cc

@@ -0,0 +1,275 @@
+//
+// Copyright 2018 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/xds/grpc/xds_tls_context_parser.h"
+
+#include <utility>
+#include <variant>
+
+#include "envoy/extensions/transport_sockets/tls/v3/common.upb.h"
+#include "envoy/extensions/transport_sockets/tls/v3/tls.upb.h"
+#include "src/core/util/down_cast.h"
+#include "src/core/util/upb_utils.h"
+#include "src/core/util/validation_errors.h"
+#include "src/core/xds/grpc/xds_bootstrap_grpc.h"
+#include "src/core/xds/grpc/xds_common_types.h"
+#include "src/core/xds/grpc/xds_common_types_parser.h"
+#include "src/core/xds/xds_client/xds_client.h"
+#include "absl/strings/str_cat.h"
+
+namespace grpc_core {
+
+namespace {
+
+// CertificateProviderInstance is deprecated but we are still supporting it for
+// backward compatibility reasons. Note that we still parse the data into the
+// same CertificateProviderPluginInstance struct since the fields are the same.
+// TODO(yashykt): Remove this once we stop supporting the old way of fetching
+// certificate provider instances.
+CommonTlsContext::CertificateProviderPluginInstance
+CertificateProviderInstanceParse(
+    const XdsResourceType::DecodeContext& context,
+    const envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CertificateProviderInstance*
+        certificate_provider_instance_proto,
+    ValidationErrors* errors) {
+  CommonTlsContext::CertificateProviderPluginInstance cert_provider;
+  cert_provider.instance_name = UpbStringToStdString(
+      envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CertificateProviderInstance_instance_name(
+          certificate_provider_instance_proto));
+  const auto& bootstrap =
+      DownCast<const GrpcXdsBootstrap&>(context.client->bootstrap());
+  if (bootstrap.certificate_providers().find(cert_provider.instance_name) ==
+      bootstrap.certificate_providers().end()) {
+    ValidationErrors::ScopedField field(errors, ".instance_name");
+    errors->AddError(
+        absl::StrCat("unrecognized certificate provider instance name: ",
+                     cert_provider.instance_name));
+  }
+  cert_provider.certificate_name = UpbStringToStdString(
+      envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CertificateProviderInstance_certificate_name(
+          certificate_provider_instance_proto));
+  return cert_provider;
+}
+
+CommonTlsContext::CertificateProviderPluginInstance
+CertificateProviderPluginInstanceParse(
+    const XdsResourceType::DecodeContext& context,
+    const envoy_extensions_transport_sockets_tls_v3_CertificateProviderPluginInstance*
+        certificate_provider_plugin_instance_proto,
+    ValidationErrors* errors) {
+  CommonTlsContext::CertificateProviderPluginInstance cert_provider;
+  cert_provider.instance_name = UpbStringToStdString(
+      envoy_extensions_transport_sockets_tls_v3_CertificateProviderPluginInstance_instance_name(
+          certificate_provider_plugin_instance_proto));
+  const auto& bootstrap =
+      DownCast<const GrpcXdsBootstrap&>(context.client->bootstrap());
+  if (bootstrap.certificate_providers().find(cert_provider.instance_name) ==
+      bootstrap.certificate_providers().end()) {
+    ValidationErrors::ScopedField field(errors, ".instance_name");
+    errors->AddError(
+        absl::StrCat("unrecognized certificate provider instance name: ",
+                     cert_provider.instance_name));
+  }
+  cert_provider.certificate_name = UpbStringToStdString(
+      envoy_extensions_transport_sockets_tls_v3_CertificateProviderPluginInstance_certificate_name(
+          certificate_provider_plugin_instance_proto));
+  return cert_provider;
+}
+
+CommonTlsContext::CertificateValidationContext
+CertificateValidationContextParse(
+    const XdsResourceType::DecodeContext& context,
+    const envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext*
+        certificate_validation_context_proto,
+    ValidationErrors* errors) {
+  CommonTlsContext::CertificateValidationContext certificate_validation_context;
+  size_t len = 0;
+  auto* subject_alt_names_matchers =
+      envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_match_subject_alt_names(
+          certificate_validation_context_proto, &len);
+  for (size_t i = 0; i < len; ++i) {
+    ValidationErrors::ScopedField field(
+        errors, absl::StrCat(".match_subject_alt_names[", i, "]"));
+    auto string_matcher =
+        StringMatcherParse(context, subject_alt_names_matchers[i], errors);
+    certificate_validation_context.match_subject_alt_names.push_back(
+        std::move(string_matcher));
+  }
+  auto* ca_certificate_provider_instance =
+      envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_ca_certificate_provider_instance(
+          certificate_validation_context_proto);
+  if (ca_certificate_provider_instance != nullptr) {
+    ValidationErrors::ScopedField field(errors,
+                                        ".ca_certificate_provider_instance");
+    certificate_validation_context.ca_certs =
+        CertificateProviderPluginInstanceParse(
+            context, ca_certificate_provider_instance, errors);
+  } else {
+    auto* system_root_certs =
+        envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_system_root_certs(
+            certificate_validation_context_proto);
+    if (system_root_certs != nullptr) {
+      certificate_validation_context.ca_certs =
+          CommonTlsContext::CertificateValidationContext::SystemRootCerts();
+    }
+  }
+  if (envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_verify_certificate_spki(
+          certificate_validation_context_proto, nullptr) != nullptr) {
+    ValidationErrors::ScopedField field(errors, ".verify_certificate_spki");
+    errors->AddError("feature unsupported");
+  }
+  if (envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_verify_certificate_hash(
+          certificate_validation_context_proto, nullptr) != nullptr) {
+    ValidationErrors::ScopedField field(errors, ".verify_certificate_hash");
+    errors->AddError("feature unsupported");
+  }
+  if (ParseBoolValue(
+          envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_require_signed_certificate_timestamp(
+              certificate_validation_context_proto))) {
+    ValidationErrors::ScopedField field(
+        errors, ".require_signed_certificate_timestamp");
+    errors->AddError("feature unsupported");
+  }
+  if (envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_has_crl(
+          certificate_validation_context_proto)) {
+    ValidationErrors::ScopedField field(errors, ".crl");
+    errors->AddError("feature unsupported");
+  }
+  if (envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_has_custom_validator_config(
+          certificate_validation_context_proto)) {
+    ValidationErrors::ScopedField field(errors, ".custom_validator_config");
+    errors->AddError("feature unsupported");
+  }
+  return certificate_validation_context;
+}
+
+}  // namespace
+
+CommonTlsContext CommonTlsContextParse(
+    const XdsResourceType::DecodeContext& context,
+    const envoy_extensions_transport_sockets_tls_v3_CommonTlsContext*
+        common_tls_context_proto,
+    ValidationErrors* errors) {
+  CommonTlsContext common_tls_context;
+  // The validation context is derived from the oneof in
+  // 'validation_context_type'. 'validation_context_sds_secret_config' is not
+  // supported.
+  auto* combined_validation_context =
+      envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_combined_validation_context(
+          common_tls_context_proto);
+  if (combined_validation_context != nullptr) {
+    ValidationErrors::ScopedField field(errors, ".combined_validation_context");
+    auto* default_validation_context =
+        envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CombinedCertificateValidationContext_default_validation_context(
+            combined_validation_context);
+    if (default_validation_context != nullptr) {
+      ValidationErrors::ScopedField field(errors,
+                                          ".default_validation_context");
+      common_tls_context.certificate_validation_context =
+          CertificateValidationContextParse(context, default_validation_context,
+                                            errors);
+    }
+    // If after parsing default_validation_context,
+    // common_tls_context->certificate_validation_context.ca_certs does not
+    // contain a cert provider, fall back onto
+    // 'validation_context_certificate_provider_instance' inside
+    // 'combined_validation_context'. Note that this way of fetching root
+    // certificates is deprecated and will be removed in the future.
+    // TODO(yashykt): Remove this once it's no longer needed.
+    if (!std::holds_alternative<
+            CommonTlsContext::CertificateProviderPluginInstance>(
+            common_tls_context.certificate_validation_context.ca_certs)) {
+      const auto* validation_context_certificate_provider_instance =
+          envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CombinedCertificateValidationContext_validation_context_certificate_provider_instance(
+              combined_validation_context);
+      if (validation_context_certificate_provider_instance != nullptr) {
+        ValidationErrors::ScopedField field(
+            errors, ".validation_context_certificate_provider_instance");
+        common_tls_context.certificate_validation_context.ca_certs =
+            CertificateProviderInstanceParse(
+                context, validation_context_certificate_provider_instance,
+                errors);
+      }
+    }
+  } else if (
+      auto* validation_context =
+          envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_validation_context(
+              common_tls_context_proto);
+      validation_context != nullptr) {
+    ValidationErrors::ScopedField field(errors, ".validation_context");
+    common_tls_context.certificate_validation_context =
+        CertificateValidationContextParse(context, validation_context, errors);
+  } else if (
+      envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_has_validation_context_sds_secret_config(
+          common_tls_context_proto)) {
+    ValidationErrors::ScopedField field(
+        errors, ".validation_context_sds_secret_config");
+    errors->AddError("feature unsupported");
+  }
+  auto* tls_certificate_provider_instance =
+      envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_tls_certificate_provider_instance(
+          common_tls_context_proto);
+  if (tls_certificate_provider_instance != nullptr) {
+    ValidationErrors::ScopedField field(errors,
+                                        ".tls_certificate_provider_instance");
+    common_tls_context.tls_certificate_provider_instance =
+        CertificateProviderPluginInstanceParse(
+            context, tls_certificate_provider_instance, errors);
+  } else {
+    // Fall back onto 'tls_certificate_certificate_provider_instance'. Note that
+    // this way of fetching identity certificates is deprecated and will be
+    // removed in the future.
+    // TODO(yashykt): Remove this once it's no longer needed.
+    auto* tls_certificate_certificate_provider_instance =
+        envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_tls_certificate_certificate_provider_instance(
+            common_tls_context_proto);
+    if (tls_certificate_certificate_provider_instance != nullptr) {
+      ValidationErrors::ScopedField field(
+          errors, ".tls_certificate_certificate_provider_instance");
+      common_tls_context.tls_certificate_provider_instance =
+          CertificateProviderInstanceParse(
+              context, tls_certificate_certificate_provider_instance, errors);
+    } else {
+      size_t size;
+      envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_tls_certificates(
+          common_tls_context_proto, &size);
+      if (size != 0) {
+        ValidationErrors::ScopedField field(errors, ".tls_certificates");
+        errors->AddError("feature unsupported");
+      }
+      envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_tls_certificate_sds_secret_configs(
+          common_tls_context_proto, &size);
+      if (size != 0) {
+        ValidationErrors::ScopedField field(
+            errors, ".tls_certificate_sds_secret_configs");
+        errors->AddError("feature unsupported");
+      }
+    }
+  }
+  if (envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_has_tls_params(
+          common_tls_context_proto)) {
+    ValidationErrors::ScopedField field(errors, ".tls_params");
+    errors->AddError("feature unsupported");
+  }
+  if (envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_has_custom_handshaker(
+          common_tls_context_proto)) {
+    ValidationErrors::ScopedField field(errors, ".custom_handshaker");
+    errors->AddError("feature unsupported");
+  }
+  return common_tls_context;
+}
+
+}  // namespace grpc_core

data/src/core/xds/grpc/xds_tls_context_parser.h

@@ -0,0 +1,35 @@
+//
+// Copyright 2018 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_XDS_GRPC_XDS_TLS_CONTEXT_PARSER_H
+#define GRPC_SRC_CORE_XDS_GRPC_XDS_TLS_CONTEXT_PARSER_H
+
+#include "envoy/extensions/transport_sockets/tls/v3/tls.upb.h"
+#include "src/core/util/validation_errors.h"
+#include "src/core/xds/grpc/xds_tls_context.h"
+#include "src/core/xds/xds_client/xds_resource_type.h"
+
+namespace grpc_core {
+
+CommonTlsContext CommonTlsContextParse(
+    const XdsResourceType::DecodeContext& context,
+    const envoy_extensions_transport_sockets_tls_v3_CommonTlsContext*
+        common_tls_context_proto,
+    ValidationErrors* errors);
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_XDS_GRPC_XDS_TLS_CONTEXT_PARSER_H

data/src/core/xds/grpc/xds_transport_grpc.cc

@@ -78,6 +78,7 @@ GrpcXdsTransportFactory::GrpcXdsTransport::GrpcStreamingCall::GrpcStreamingCall(
     WeakRefCountedPtr<GrpcXdsTransportFactory> factory, Channel* channel,
     const char* method,
     std::unique_ptr<StreamingCall::EventHandler> event_handler,
+    grpc_call_credentials* call_creds,
     const std::vector<std::pair<std::string, std::string>>& initial_metadata,
     Duration timeout)
     : factory_(std::move(factory)), event_handler_(std::move(event_handler)) {
@@ -91,6 +92,8 @@ GrpcXdsTransportFactory::GrpcXdsTransport::GrpcStreamingCall::GrpcStreamingCall(
       /*authority=*/std::nullopt, deadline,
       /*registered_method=*/true, /*arena_init_function=*/std::nullopt);
   GRPC_CHECK_NE(call_, nullptr);
+  // Set call creds, if any.
+  if (call_creds != nullptr) grpc_call_set_credentials(call_, call_creds);
   // Init data associated with the call.
   grpc_metadata_array_init(&initial_metadata_recv_);
   grpc_metadata_array_init(&trailing_metadata_recv_);
@@ -141,10 +144,10 @@ GrpcXdsTransportFactory::GrpcXdsTransport::GrpcStreamingCall::GrpcStreamingCall(
   op->flags = 0;
   op->reserved = nullptr;
   ++op;
-  // This callback signals the end of the call, so it relies on the initial
-  // ref instead of a new ref. When it's invoked, it's the initial ref that is
-  // unreffed.
-  GRPC_CLOSURE_INIT(&on_status_received_, OnStatusReceived, this, nullptr);
+  // Ref will be released in the callback.
+  GRPC_CLOSURE_INIT(&on_status_received_, OnStatusReceived,
+                    this->Ref(DEBUG_LOCATION, "OnStatusReceived").release(),
+                    nullptr);
   call_error = grpc_call_start_batch_and_execute(
       call_, ops, static_cast<size_t>(op - ops), &on_status_received_);
   GRPC_CHECK_EQ(call_error, GRPC_CALL_OK);
@@ -172,8 +175,7 @@ void GrpcXdsTransportFactory::GrpcXdsTransport::GrpcStreamingCall::Orphan() {
   // Otherwise, we are here because xds_client has to orphan a failed call,
   // in which case the following cancellation will be a no-op.
   grpc_call_cancel_internal(call_);
-  // Note that the initial ref is held by OnStatusReceived(), so the
-  // corresponding unref happens there instead of here.
+  Unref(DEBUG_LOCATION, "Orphan");
 }
 
 void GrpcXdsTransportFactory::GrpcXdsTransport::GrpcStreamingCall::SendMessage(
@@ -301,22 +303,6 @@ RefCountedPtr<Channel> CreateXdsChannel(
   RefCountedPtr<grpc_channel_credentials> channel_creds =
       CoreConfiguration::Get().channel_creds_registry().CreateChannelCreds(
           server.channel_creds_config(), certificate_provider_store);
-  RefCountedPtr<grpc_call_credentials> call_creds;
-  for (const auto& call_creds_config : server.call_creds_configs()) {
-    RefCountedPtr<grpc_call_credentials> creds =
-        CoreConfiguration::Get().call_creds_registry().CreateCallCreds(
-            call_creds_config);
-    if (call_creds == nullptr) {
-      call_creds = std::move(creds);
-    } else {
-      call_creds = MakeRefCounted<grpc_composite_call_credentials>(
-          std::move(call_creds), std::move(creds));
-    }
-  }
-  if (call_creds != nullptr) {
-    channel_creds = MakeRefCounted<grpc_composite_channel_credentials>(
-        std::move(channel_creds), std::move(call_creds));
-  }
   return RefCountedPtr<Channel>(Channel::FromC(grpc_channel_create(
       server.server_uri().c_str(), channel_creds.get(), args.ToC().get())));
 }
@@ -330,14 +316,27 @@ std::string GetChannelKey(const GrpcXdsServerInterface& server) {
         ", channel_creds={type=", server.channel_creds_config()->type(),
         ", config=", server.channel_creds_config()->ToString(), "}");
   }
-  for (const auto& call_creds_config : server.call_creds_configs()) {
-    absl::StrAppend(&result, ", call_creds={type=", call_creds_config->type(),
-                    ", config=", call_creds_config->ToString(), "}");
-  }
   absl::StrAppend(&result, "}");
   return result;
 }
 
+RefCountedPtr<grpc_call_credentials> GetCallCredsForTransport(
+    const GrpcXdsServerInterface& server) {
+  RefCountedPtr<grpc_call_credentials> call_creds;
+  for (const auto& call_creds_config : server.call_creds_configs()) {
+    RefCountedPtr<grpc_call_credentials> creds =
+        CoreConfiguration::Get().call_creds_registry().CreateCallCreds(
+            call_creds_config);
+    if (call_creds == nullptr) {
+      call_creds = std::move(creds);
+    } else {
+      call_creds = MakeRefCounted<grpc_composite_call_credentials>(
+          std::move(call_creds), std::move(creds));
+    }
+  }
+  return call_creds;
+}
+
 }  // namespace
 
 class GrpcXdsTransportFactory::SharedChannel final
@@ -367,19 +366,19 @@ class GrpcXdsTransportFactory::SharedChannel final
 
 GrpcXdsTransportFactory::GrpcXdsTransport::GrpcXdsTransport(
     WeakRefCountedPtr<GrpcXdsTransportFactory> factory,
-    RefCountedPtr<SharedChannel> channel,
-    const XdsBootstrap::XdsServerTarget& server, absl::Status* status)
+    RefCountedPtr<SharedChannel> channel, const GrpcXdsServerInterface& server,
+    absl::Status* status)
     : XdsTransport(GRPC_TRACE_FLAG_ENABLED(xds_client_refcount)
                        ? "GrpcXdsTransport"
                        : nullptr),
       factory_(std::move(factory)),
       key_(server.Key()),
-      channel_(std::move(channel)) {
+      channel_(std::move(channel)),
+      call_creds_(GetCallCredsForTransport(server)),
+      initial_metadata_(server.initial_metadata()),
+      timeout_(server.timeout()) {
   GRPC_TRACE_LOG(xds_client, INFO)
       << "[GrpcXdsTransport " << this << "] created";
-  const auto& grpc_server = DownCast<const GrpcXdsServerInterface&>(server);
-  initial_metadata_ = grpc_server.initial_metadata();
-  timeout_ = grpc_server.timeout();
   if (channel_->channel()->IsLame()) {
     *status = absl::UnavailableError("xds client has a lame channel");
   }
@@ -443,7 +442,8 @@ GrpcXdsTransportFactory::GrpcXdsTransport::CreateStreamingCall(
     std::unique_ptr<StreamingCall::EventHandler> event_handler) {
   return MakeOrphanable<GrpcStreamingCall>(
       factory_.WeakRef(DEBUG_LOCATION, "StreamingCall"), channel_->channel(),
-      method, std::move(event_handler), initial_metadata_, timeout_);
+      method, std::move(event_handler), call_creds_.get(), initial_metadata_,
+      timeout_);
 }
 
 void GrpcXdsTransportFactory::GrpcXdsTransport::ResetBackoff() {
@@ -500,20 +500,23 @@ GrpcXdsTransportFactory::GetTransport(
     auto channel_it = channels_.find(channel_key);
     RefCountedPtr<SharedChannel> channel;
     if (channel_it != channels_.end()) {
-      channel = channel_it->second->Ref();
-    } else {
+      GRPC_TRACE_LOG(xds_client, INFO) << "[GrpcXdsTransportFactory " << this
+                                       << "] found cached SharedChannel";
+      channel = channel_it->second->RefIfNonZero();
+    }
+    if (channel == nullptr) {
       RefCountedPtr<Channel> raw_channel =
           CreateXdsChannel(args_, *certificate_provider_store_, grpc_server);
       GRPC_CHECK(raw_channel != nullptr);
       channel = MakeRefCounted<SharedChannel>(
           channel_key, std::move(raw_channel),
           WeakRefAsSubclass<GrpcXdsTransportFactory>());
-      channels_.emplace(channel_key, channel.get());
+      channels_[channel_key] = channel.get();
     }
     transport = MakeRefCounted<GrpcXdsTransport>(
         WeakRefAsSubclass<GrpcXdsTransportFactory>(), std::move(channel),
-        server, status);
-    transports_.emplace(std::move(key), transport.get());
+        grpc_server, status);
+    transports_[std::move(key)] = transport.get();
   }
   return transport;
 }