grpc 1.83.1 → 1.84.0

data/src/core/credentials/transport/ssl/ssl_credentials.cc

@@ -50,19 +50,18 @@
 //
 
 grpc_ssl_credentials::grpc_ssl_credentials(
-    const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
+    std::string pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
     const grpc_ssl_verify_peer_options* verify_options) {
-  build_config(pem_root_certs, pem_key_cert_pair, verify_options);
+  build_config(std::move(pem_root_certs), pem_key_cert_pair, verify_options);
   // Use default (e.g. OS) root certificates if the user did not pass any root
   // certificates.
-  if (config_.pem_root_certs == nullptr) {
-    const char* pem_root_certs =
+  if (config_.pem_root_certs.empty()) {
+    absl::string_view pem_root_certs =
         grpc_core::DefaultSslRootStore::GetPemRootCerts();
-    if (pem_root_certs == nullptr) {
+    if (pem_root_certs.empty()) {
       LOG(ERROR) << "Could not get default pem root certs.";
     } else {
-      char* default_roots = gpr_strdup(pem_root_certs);
-      config_.pem_root_certs = default_roots;
+      config_.pem_root_certs = std::string(pem_root_certs);
       root_store_ = grpc_core::DefaultSslRootStore::GetRootStore();
     }
   } else {
@@ -75,7 +74,6 @@ grpc_ssl_credentials::grpc_ssl_credentials(
 }
 
 grpc_ssl_credentials::~grpc_ssl_credentials() {
-  gpr_free(config_.pem_root_certs);
   if (config_.verify_options.verify_peer_destruct != nullptr) {
     config_.verify_options.verify_peer_destruct(
         config_.verify_options.verify_peer_callback_userdata);
@@ -87,7 +85,7 @@ grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_ssl_credentials::create_security_connector(
     grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
     const char* target, grpc_core::ChannelArgs* args) {
-  if (config_.pem_root_certs == nullptr) {
+  if (config_.pem_root_certs.empty()) {
     LOG(ERROR) << "No root certs in config. Client-side security connector "
                   "must have root certs.";
     return nullptr;
@@ -146,14 +144,14 @@ grpc_core::UniqueTypeName grpc_ssl_credentials::Type() {
 }
 
 void grpc_ssl_credentials::build_config(
-    const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
+    std::string pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
     const grpc_ssl_verify_peer_options* verify_options) {
-  config_.pem_root_certs = gpr_strdup(pem_root_certs);
+  config_.pem_root_certs = std::move(pem_root_certs);
   if (pem_key_cert_pair != nullptr) {
     GRPC_CHECK_NE(pem_key_cert_pair->private_key, nullptr);
     GRPC_CHECK_NE(pem_key_cert_pair->cert_chain, nullptr);
-    config_.pem_key_cert_pair.cert_chain = pem_key_cert_pair->cert_chain;
-    config_.pem_key_cert_pair.private_key = pem_key_cert_pair->private_key;
+    config_.pem_key_cert_pair = grpc_core::PemKeyCertPair(
+        pem_key_cert_pair->private_key, pem_key_cert_pair->cert_chain);
   }
   if (verify_options != nullptr) {
     memcpy(&config_.verify_options, verify_options,
@@ -175,7 +173,7 @@ void grpc_ssl_credentials::set_max_tls_version(
 }
 
 grpc_security_status grpc_ssl_credentials::InitializeClientHandshakerFactory(
-    const grpc_ssl_config* config, const char* pem_root_certs,
+    const grpc_ssl_config* config, std::string pem_root_certs,
     const tsi_ssl_root_certs_store* root_store,
     tsi_ssl_session_cache* ssl_session_cache,
     tsi_ssl_client_handshaker_factory** handshaker_factory) {
@@ -186,15 +184,16 @@ grpc_security_status grpc_ssl_credentials::InitializeClientHandshakerFactory(
   }
 
   bool has_key_cert_pair =
-      !grpc_core::IsPrivateKeyEmpty(config->pem_key_cert_pair.private_key) &&
-      !config->pem_key_cert_pair.cert_chain.empty();
+      !grpc_core::IsPrivateKeyEmpty(config->pem_key_cert_pair.private_key()) &&
+      !config->pem_key_cert_pair.cert_chain().empty();
   tsi_ssl_client_handshaker_options options;
-  if (pem_root_certs == nullptr) {
+  if (pem_root_certs.empty()) {
     LOG(ERROR) << "Handshaker factory creation failed. pem_root_certs cannot "
-                  "be nullptr";
+                  "be empty";
     return GRPC_SECURITY_ERROR;
   }
-  options.root_cert_info = std::make_shared<tsi::RootCertInfo>(pem_root_certs);
+  options.root_cert_info =
+      std::make_shared<tsi::RootCertInfo>(std::move(pem_root_certs));
   options.root_store = root_store;
   options.alpn_protocols =
       grpc_fill_alpn_protocol_strings(&options.num_alpn_protocols);
@@ -229,6 +228,7 @@ grpc_channel_credentials* grpc_ssl_credentials_create(
       << ")";
   GRPC_CHECK_EQ(reserved, nullptr);
 
+  if (pem_root_certs == nullptr) pem_root_certs = "";
   return new grpc_ssl_credentials(
       pem_root_certs, pem_key_cert_pair,
       reinterpret_cast<const grpc_ssl_verify_peer_options*>(verify_options));
@@ -244,6 +244,7 @@ grpc_channel_credentials* grpc_ssl_credentials_create_ex(
       << ")";
   GRPC_CHECK_EQ(reserved, nullptr);
 
+  if (pem_root_certs == nullptr) pem_root_certs = "";
   return new grpc_ssl_credentials(pem_root_certs, pem_key_cert_pair,
                                   verify_options);
 }
@@ -253,9 +254,11 @@ grpc_channel_credentials* grpc_ssl_credentials_create_ex(
 //
 
 struct grpc_ssl_server_credentials_options {
-  grpc_ssl_client_certificate_request_type client_certificate_request;
-  grpc_ssl_server_certificate_config* certificate_config;
-  grpc_ssl_server_certificate_config_fetcher* certificate_config_fetcher;
+  grpc_ssl_client_certificate_request_type client_certificate_request =
+      GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE;
+  std::unique_ptr<grpc_ssl_server_certificate_config> certificate_config;
+  std::unique_ptr<grpc_ssl_server_certificate_config_fetcher>
+      certificate_config_fetcher;
 };
 
 grpc_ssl_server_credentials::grpc_ssl_server_credentials(
@@ -271,9 +274,6 @@ grpc_ssl_server_credentials::grpc_ssl_server_credentials(
   }
 }
 
-grpc_ssl_server_credentials::~grpc_ssl_server_credentials() {
-  gpr_free(config_.pem_root_certs);
-}
 grpc_core::RefCountedPtr<grpc_server_security_connector>
 grpc_ssl_server_credentials::create_security_connector(
     const grpc_core::ChannelArgs& args) {
@@ -285,29 +285,29 @@ grpc_core::UniqueTypeName grpc_ssl_server_credentials::Type() {
   return kFactory.Create();
 }
 
-std::vector<tsi_ssl_pem_key_cert_pair> grpc_convert_grpc_to_tsi_cert_pairs(
+grpc_core::PemKeyCertPairList grpc_convert_grpc_to_key_cert_pairs(
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs) {
-  std::vector<tsi_ssl_pem_key_cert_pair> tsi_pairs;
+  grpc_core::PemKeyCertPairList key_cert_pairs;
   if (num_key_cert_pairs > 0) {
     GRPC_CHECK_NE(pem_key_cert_pairs, nullptr);
   }
   for (size_t i = 0; i < num_key_cert_pairs; i++) {
     GRPC_CHECK_NE(pem_key_cert_pairs[i].private_key, nullptr);
     GRPC_CHECK_NE(pem_key_cert_pairs[i].cert_chain, nullptr);
-    tsi_pairs.emplace_back(pem_key_cert_pairs[i].private_key,
-                           pem_key_cert_pairs[i].cert_chain);
+    key_cert_pairs.emplace_back(pem_key_cert_pairs[i].private_key,
+                                pem_key_cert_pairs[i].cert_chain);
   }
-  return tsi_pairs;
+  return key_cert_pairs;
 }
 
 void grpc_ssl_server_credentials::build_config(
-    const char* pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
+    std::string pem_root_certs, grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs,
     grpc_ssl_client_certificate_request_type client_certificate_request) {
   config_.client_certificate_request = client_certificate_request;
-  config_.pem_root_certs = gpr_strdup(pem_root_certs);
-  config_.pem_key_cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
+  config_.pem_root_certs = std::move(pem_root_certs);
+  config_.pem_key_cert_pairs = grpc_convert_grpc_to_key_cert_pairs(
       pem_key_cert_pairs, num_key_cert_pairs);
 }
 
@@ -326,9 +326,8 @@ grpc_ssl_server_certificate_config* grpc_ssl_server_certificate_config_create(
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs) {
   grpc_ssl_server_certificate_config* config =
-      static_cast<grpc_ssl_server_certificate_config*>(
-          gpr_zalloc(sizeof(grpc_ssl_server_certificate_config)));
-  config->pem_root_certs = gpr_strdup(pem_root_certs);
+      new grpc_ssl_server_certificate_config;
+  if (pem_root_certs != nullptr) config->pem_root_certs = pem_root_certs;
   if (num_key_cert_pairs > 0) {
     GRPC_CHECK_NE(pem_key_cert_pairs, nullptr);
     config->pem_key_cert_pairs = static_cast<grpc_ssl_pem_key_cert_pair*>(
@@ -346,32 +345,31 @@ grpc_ssl_server_certificate_config* grpc_ssl_server_certificate_config_create(
   return config;
 }
 
+grpc_ssl_server_certificate_config::~grpc_ssl_server_certificate_config() {
+  for (size_t i = 0; i < num_key_cert_pairs; i++) {
+    gpr_free(const_cast<char*>(pem_key_cert_pairs[i].private_key));
+    gpr_free(const_cast<char*>(pem_key_cert_pairs[i].cert_chain));
+  }
+  gpr_free(pem_key_cert_pairs);
+}
+
 void grpc_ssl_server_certificate_config_destroy(
     grpc_ssl_server_certificate_config* config) {
-  if (config == nullptr) return;
-  for (size_t i = 0; i < config->num_key_cert_pairs; i++) {
-    gpr_free(const_cast<char*>(config->pem_key_cert_pairs[i].private_key));
-    gpr_free(const_cast<char*>(config->pem_key_cert_pairs[i].cert_chain));
-  }
-  gpr_free(config->pem_key_cert_pairs);
-  gpr_free(config->pem_root_certs);
-  gpr_free(config);
+  delete config;
 }
 
 grpc_ssl_server_credentials_options*
 grpc_ssl_server_credentials_create_options_using_config(
     grpc_ssl_client_certificate_request_type client_certificate_request,
     grpc_ssl_server_certificate_config* config) {
-  grpc_ssl_server_credentials_options* options = nullptr;
   if (config == nullptr) {
     LOG(ERROR) << "Certificate config must not be NULL.";
-    goto done;
+    return nullptr;
   }
-  options = static_cast<grpc_ssl_server_credentials_options*>(
-      gpr_zalloc(sizeof(grpc_ssl_server_credentials_options)));
+  grpc_ssl_server_credentials_options* options =
+      new grpc_ssl_server_credentials_options;
   options->client_certificate_request = client_certificate_request;
-  options->certificate_config = config;
-done:
+  options->certificate_config.reset(config);
   return options;
 }
 
@@ -384,17 +382,13 @@ grpc_ssl_server_credentials_create_options_using_config_fetcher(
     return nullptr;
   }
 
-  grpc_ssl_server_certificate_config_fetcher* fetcher =
-      static_cast<grpc_ssl_server_certificate_config_fetcher*>(
-          gpr_zalloc(sizeof(grpc_ssl_server_certificate_config_fetcher)));
-  fetcher->cb = cb;
-  fetcher->user_data = user_data;
-
   grpc_ssl_server_credentials_options* options =
-      static_cast<grpc_ssl_server_credentials_options*>(
-          gpr_zalloc(sizeof(grpc_ssl_server_credentials_options)));
+      new grpc_ssl_server_credentials_options;
   options->client_certificate_request = client_certificate_request;
-  options->certificate_config_fetcher = fetcher;
+  options->certificate_config_fetcher =
+      std::make_unique<grpc_ssl_server_certificate_config_fetcher>();
+  options->certificate_config_fetcher->cb = cb;
+  options->certificate_config_fetcher->user_data = user_data;
 
   return options;
 }
@@ -435,37 +429,30 @@ grpc_server_credentials* grpc_ssl_server_credentials_create_ex(
 
 grpc_server_credentials* grpc_ssl_server_credentials_create_with_options(
     grpc_ssl_server_credentials_options* options) {
-  grpc_server_credentials* retval = nullptr;
+  std::unique_ptr<grpc_ssl_server_credentials_options> options_owner(options);
 
   if (options == nullptr) {
     LOG(ERROR) << "Invalid options trying to create SSL server credentials.";
-    goto done;
+    return nullptr;
   }
 
   if (options->certificate_config == nullptr &&
       options->certificate_config_fetcher == nullptr) {
     LOG(ERROR) << "SSL server credentials options must specify either "
                   "certificate config or fetcher.";
-    goto done;
+    return nullptr;
   } else if (options->certificate_config_fetcher != nullptr &&
              options->certificate_config_fetcher->cb == nullptr) {
     LOG(ERROR) << "Certificate config fetcher callback must not be NULL.";
-    goto done;
+    return nullptr;
   }
 
-  retval = new grpc_ssl_server_credentials(*options);
-
-done:
-  grpc_ssl_server_credentials_options_destroy(options);
-  return retval;
+  return new grpc_ssl_server_credentials(*options);
 }
 
 void grpc_ssl_server_credentials_options_destroy(
     grpc_ssl_server_credentials_options* o) {
-  if (o == nullptr) return;
-  gpr_free(o->certificate_config_fetcher);
-  grpc_ssl_server_certificate_config_destroy(o->certificate_config);
-  gpr_free(o);
+  delete o;
 }
 
 namespace {

data/src/core/credentials/transport/ssl/ssl_credentials.h

@@ -37,7 +37,7 @@
 
 class grpc_ssl_credentials : public grpc_channel_credentials {
  public:
-  grpc_ssl_credentials(const char* pem_root_certs,
+  grpc_ssl_credentials(std::string pem_root_certs,
                        grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
                        const grpc_ssl_verify_peer_options* verify_options);
 
@@ -64,7 +64,7 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
         static_cast<const grpc_channel_credentials*>(this), other);
   }
 
-  void build_config(const char* pem_root_certs,
+  void build_config(std::string pem_root_certs,
                     grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
                     const grpc_ssl_verify_peer_options* verify_options);
 
@@ -74,7 +74,7 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
   // that there is a session cache. If a session cache is used, a new handshaker
   // factory will be created and used that contains that session cache.
   grpc_security_status InitializeClientHandshakerFactory(
-      const grpc_ssl_config* config, const char* pem_root_certs,
+      const grpc_ssl_config* config, std::string pem_root_certs,
       const tsi_ssl_root_certs_store* root_store,
       tsi_ssl_session_cache* ssl_session_cache,
       tsi_ssl_client_handshaker_factory** handshaker_factory);
@@ -88,19 +88,20 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
 struct grpc_ssl_server_certificate_config {
   grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs = nullptr;
   size_t num_key_cert_pairs = 0;
-  char* pem_root_certs = nullptr;
+  std::string pem_root_certs;
+
+  ~grpc_ssl_server_certificate_config();
 };
 
 struct grpc_ssl_server_certificate_config_fetcher {
   grpc_ssl_server_certificate_config_callback cb = nullptr;
-  void* user_data;
+  void* user_data = nullptr;
 };
 
 class grpc_ssl_server_credentials final : public grpc_server_credentials {
  public:
   explicit grpc_ssl_server_credentials(
       const grpc_ssl_server_credentials_options& options);
-  ~grpc_ssl_server_credentials() override;
 
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_core::ChannelArgs& /* args */) override;
@@ -129,7 +130,7 @@ class grpc_ssl_server_credentials final : public grpc_server_credentials {
 
  private:
   void build_config(
-      const char* pem_root_certs,
+      std::string pem_root_certs,
       grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs, size_t num_key_cert_pairs,
       grpc_ssl_client_certificate_request_type client_certificate_request);
 
@@ -137,7 +138,7 @@ class grpc_ssl_server_credentials final : public grpc_server_credentials {
   grpc_ssl_server_certificate_config_fetcher certificate_config_fetcher_;
 };
 
-std::vector<tsi_ssl_pem_key_cert_pair> grpc_convert_grpc_to_tsi_cert_pairs(
+grpc_core::PemKeyCertPairList grpc_convert_grpc_to_key_cert_pairs(
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs);
 

data/src/core/credentials/transport/ssl/ssl_security_connector.cc

@@ -26,6 +26,7 @@
 #include <string>
 #include <utility>
 
+#include "src/core/client_channel/client_channel_args.h"
 #include "src/core/credentials/transport/ssl/ssl_credentials.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/credentials/transport/transport_credentials.h"
@@ -109,6 +110,10 @@ class grpc_ssl_channel_security_connector final
     grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope =
         stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
                                       : nullptr;
+    std::string backend_service(
+        args.GetString(GRPC_ARG_BACKEND_SERVICE).value_or(""));
+    std::string locality(args.GetString(GRPC_ARG_LB_LOCALITY).value_or(""));
+    std::string target(args.GetString(GRPC_ARG_SERVER_URI).value_or(""));
     tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
         client_handshaker_factory_,
         overridden_target_name_.empty() ? target_name_.c_str()
@@ -116,7 +121,8 @@ class grpc_ssl_channel_security_connector final
         /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0,
         args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS),
-        std::move(collection_scope), &tsi_hs);
+        std::move(collection_scope), std::move(target), std::move(locality),
+        std::move(backend_service), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);
@@ -246,9 +252,9 @@ class grpc_ssl_server_security_connector
             grpc_fill_alpn_protocol_strings(&num_alpn_protocols);
       }
       tsi_ssl_server_handshaker_options options;
-      options.pem_key_cert_pairs =
+      options.key_cert_pairs_or_selector =
           server_credentials->config().pem_key_cert_pairs;
-      if (server_credentials->config().pem_root_certs != nullptr) {
+      if (!server_credentials->config().pem_root_certs.empty()) {
         options.root_cert_info = std::make_shared<tsi::RootCertInfo>(
             server_credentials->config().pem_root_certs);
       }
@@ -367,11 +373,11 @@ class grpc_ssl_server_security_connector
     tsi_ssl_server_handshaker_factory* new_handshaker_factory = nullptr;
     const grpc_ssl_server_credentials* server_creds =
         static_cast<const grpc_ssl_server_credentials*>(this->server_creds());
-    GRPC_DCHECK_NE(config->pem_root_certs, nullptr);
+    GRPC_DCHECK(!config->pem_root_certs.empty());
     tsi_ssl_server_handshaker_options options;
-    options.pem_key_cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
+    options.key_cert_pairs_or_selector = grpc_convert_grpc_to_key_cert_pairs(
         config->pem_key_cert_pairs, config->num_key_cert_pairs);
-    if (config->pem_root_certs != nullptr) {
+    if (!config->pem_root_certs.empty()) {
       options.root_cert_info =
           std::make_shared<tsi::RootCertInfo>(config->pem_root_certs);
     }

data/src/core/credentials/transport/ssl/ssl_security_connector.h

@@ -32,8 +32,8 @@
 #include "src/core/util/ref_counted_ptr.h"
 
 struct grpc_ssl_config {
-  tsi_ssl_pem_key_cert_pair pem_key_cert_pair;
-  char* pem_root_certs;
+  grpc_core::PemKeyCertPair pem_key_cert_pair;
+  std::string pem_root_certs;
   verify_peer_options verify_options;
   grpc_tls_version min_tls_version = grpc_tls_version::TLS1_2;
   grpc_tls_version max_tls_version = grpc_tls_version::TLS1_3;
@@ -62,8 +62,8 @@ grpc_ssl_channel_security_connector_create(
 
 // Config for ssl servers.
 struct grpc_ssl_server_config {
-  std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pairs;
-  char* pem_root_certs = nullptr;
+  grpc_core::PemKeyCertPairList pem_key_cert_pairs;
+  std::string pem_root_certs;
   grpc_ssl_client_certificate_request_type client_certificate_request =
       GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE;
   grpc_tls_version min_tls_version = grpc_tls_version::TLS1_2;

data/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.cc

@@ -20,6 +20,7 @@
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>
 
+#include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/util/grpc_check.h"
 #include "absl/status/status.h"
@@ -30,8 +31,9 @@ bool grpc_tls_certificate_distributor::CertificateInfo::AreRootsEmpty() {
 
 void grpc_tls_certificate_distributor::SetKeyMaterials(
     const std::string& cert_name, std::shared_ptr<tsi::RootCertInfo> roots,
-    std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs) {
-  GRPC_CHECK(roots != nullptr || pem_key_cert_pairs.has_value());
+    std::optional<grpc_core::KeyCertPairsOrSelector>
+        key_cert_pairs_or_selector) {
+  GRPC_CHECK(roots != nullptr || key_cert_pairs_or_selector.has_value());
   grpc_core::MutexLock lock(&mu_);
   auto& cert_info = certificate_info_map_[cert_name];
   if (roots != nullptr) {
@@ -42,23 +44,26 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
       const auto watcher_it = watchers_.find(watcher_ptr);
       GRPC_CHECK(watcher_it != watchers_.end());
       GRPC_CHECK(watcher_it->second.root_cert_name.has_value());
-      std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs_to_report;
-      if (pem_key_cert_pairs.has_value() &&
+      std::optional<grpc_core::KeyCertPairsOrSelector>
+          key_cert_pairs_or_selector_to_report;
+      if (key_cert_pairs_or_selector.has_value() &&
           watcher_it->second.identity_cert_name == cert_name) {
-        pem_key_cert_pairs_to_report = pem_key_cert_pairs;
+        key_cert_pairs_or_selector_to_report = key_cert_pairs_or_selector;
       } else if (watcher_it->second.identity_cert_name.has_value()) {
         auto& identity_cert_info =
             certificate_info_map_[*watcher_it->second.identity_cert_name];
-        if (!identity_cert_info.pem_key_cert_pairs.empty()) {
-          pem_key_cert_pairs_to_report = identity_cert_info.pem_key_cert_pairs;
+        if (!grpc_core::IsKeyCertPairsOrSelectorEmpty(
+                identity_cert_info.key_cert_pairs_or_selector)) {
+          key_cert_pairs_or_selector_to_report =
+              identity_cert_info.key_cert_pairs_or_selector;
         }
       }
       watcher_ptr->OnCertificatesChanged(
-          roots, std::move(pem_key_cert_pairs_to_report));
+          roots, std::move(key_cert_pairs_or_selector_to_report));
     }
     cert_info.roots = roots;
   }
-  if (pem_key_cert_pairs.has_value()) {
+  if (key_cert_pairs_or_selector.has_value()) {
     // Successful credential updates will clear any pre-existing error.
     cert_info.SetIdentityError(absl::OkStatus());
     for (const auto watcher_ptr : cert_info.identity_cert_watchers) {
@@ -79,9 +84,10 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
         }
       }
       watcher_ptr->OnCertificatesChanged(std::move(roots_to_report),
-                                         pem_key_cert_pairs);
+                                         key_cert_pairs_or_selector);
     }
-    cert_info.pem_key_cert_pairs = std::move(*pem_key_cert_pairs);
+    cert_info.key_cert_pairs_or_selector =
+        std::move(*key_cert_pairs_or_selector);
   }
 }
 
@@ -97,7 +103,8 @@ bool grpc_tls_certificate_distributor::HasKeyCertPairs(
   grpc_core::MutexLock lock(&mu_);
   const auto it = certificate_info_map_.find(identity_cert_name);
   return it != certificate_info_map_.end() &&
-         !it->second.pem_key_cert_pairs.empty();
+         !grpc_core::IsKeyCertPairsOrSelectorEmpty(
+             it->second.key_cert_pairs_or_selector);
 };
 
 void grpc_tls_certificate_distributor::SetErrorForCert(
@@ -190,7 +197,8 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
     watchers_[watcher_ptr] = {std::move(watcher), root_cert_name,
                               identity_cert_name};
     std::shared_ptr<tsi::RootCertInfo> updated_roots;
-    std::optional<grpc_core::PemKeyCertPairList> updated_identity_pairs;
+    std::optional<grpc_core::KeyCertPairsOrSelector>
+        updated_key_cert_pairs_or_selector;
     grpc_error_handle root_error;
     grpc_error_handle identity_error;
     if (root_cert_name.has_value()) {
@@ -213,8 +221,10 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
       cert_info.identity_cert_watchers.insert(watcher_ptr);
       identity_error = cert_info.identity_cert_error;
       // Empty credentials will be treated as no updates.
-      if (!cert_info.pem_key_cert_pairs.empty()) {
-        updated_identity_pairs = cert_info.pem_key_cert_pairs;
+      if (!grpc_core::IsKeyCertPairsOrSelectorEmpty(
+              cert_info.key_cert_pairs_or_selector)) {
+        updated_key_cert_pairs_or_selector =
+            cert_info.key_cert_pairs_or_selector;
       }
     }
     // Notify this watcher if the certs it is watching already had some
@@ -222,9 +232,10 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
     // occurred while trying to fetch the latest cert, but the updated_*_certs
     // should always be valid. So we will send the updates regardless of
     // *_cert_error.
-    if (updated_roots != nullptr || updated_identity_pairs.has_value()) {
-      watcher_ptr->OnCertificatesChanged(updated_roots,
-                                         std::move(updated_identity_pairs));
+    if (updated_roots != nullptr ||
+        updated_key_cert_pairs_or_selector.has_value()) {
+      watcher_ptr->OnCertificatesChanged(
+          updated_roots, std::move(updated_key_cert_pairs_or_selector));
     }
     // Notify this watcher if the certs it is watching already had some
     // errors.

data/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h

@@ -62,7 +62,8 @@ struct grpc_tls_certificate_distributor
     // pairs.
     virtual void OnCertificatesChanged(
         std::shared_ptr<tsi::RootCertInfo> roots,
-        std::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) = 0;
+        std::optional<grpc_core::KeyCertPairsOrSelector>
+            key_cert_pairs_or_selector) = 0;
 
     // Handles an error that occurs while attempting to fetch certificate data.
     // Note that if a watcher sees an error, it simply means the Provider is
@@ -88,9 +89,10 @@ struct grpc_tls_certificate_distributor
   // @param roots The content of the roots, either the pem root certificates or
   // the SpiffeBundleMap.
   // @param pem_key_cert_pairs The content of identity key-cert pairs.
-  void SetKeyMaterials(
-      const std::string& cert_name, std::shared_ptr<tsi::RootCertInfo> roots,
-      std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs);
+  void SetKeyMaterials(const std::string& cert_name,
+                       std::shared_ptr<tsi::RootCertInfo> roots,
+                       std::optional<grpc_core::KeyCertPairsOrSelector>
+                           key_cert_pairs_or_selector);
 
   bool HasRootCerts(const std::string& root_cert_name);
 
@@ -177,8 +179,9 @@ struct grpc_tls_certificate_distributor
   struct CertificateInfo {
     // The contents of the root certificates.
     std::shared_ptr<tsi::RootCertInfo> roots;
-    // The contents of the identity key-certificate pairs.
-    grpc_core::PemKeyCertPairList pem_key_cert_pairs;
+    // The contents of the identity key-certificate pairs or a certificate
+    // selector.
+    grpc_core::KeyCertPairsOrSelector key_cert_pairs_or_selector;
     // TODO(gtcooke94) Swap to using absl::StatusOr<>
     // https://github.com/grpc/grpc/pull/39708/files#r2144014200 The root cert
     // reloading error propagated by the caller.