grpc 1.84.0 → 1.85.0.pre1

data/src/core/filter/ext_proc/ext_proc_filter.h

@@ -17,16 +17,20 @@
 #ifndef GRPC_SRC_CORE_FILTER_EXT_PROC_EXT_PROC_FILTER_H
 #define GRPC_SRC_CORE_FILTER_EXT_PROC_EXT_PROC_FILTER_H
 
+#include <grpc/event_engine/event_engine.h>
+
 #include <memory>
 #include <optional>
 #include <string>
 #include <variant>
 #include <vector>
 
+#include "src/core/call/call_spine.h"
 #include "src/core/filter/ext_proc/ext_proc_messages.h"
 #include "src/core/filter/filter_args.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/telemetry/instrument.h"
 #include "src/core/util/matchers.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/unique_type_name.h"
@@ -34,12 +38,30 @@
 #include "src/core/xds/grpc/xds_common_types.h"
 #include "src/core/xds/grpc/xds_server_grpc.h"
 #include "src/core/xds/xds_client/xds_transport.h"
+#include "absl/strings/string_view.h"
 
 namespace grpc_core {
 
 class ExtProcFilter final : public V3InterceptorToV2Bridge<ExtProcFilter> {
  public:
-  class ExtProcChannel;
+  class ExtProcChannel final : public Blackboard::Entry {
+   public:
+    static UniqueTypeName Type() {
+      return GRPC_UNIQUE_TYPE_NAME_HERE("ext_proc_channel");
+    }
+    ExtProcChannel(GrpcXdsServerTarget server,
+                   RefCountedPtr<XdsTransportFactory::XdsTransport> transport);
+    ~ExtProcChannel() override;
+    const GrpcXdsServerTarget& server() const { return server_; }
+
+    RefCountedPtr<XdsTransportFactory::XdsTransport> transport() const {
+      return transport_;
+    }
+
+   private:
+    GrpcXdsServerTarget server_;
+    RefCountedPtr<XdsTransportFactory::XdsTransport> transport_;
+  };
 
   using ProcessingMode = ExtProcProcessingMode;
 
@@ -117,37 +139,48 @@ class ExtProcFilter final : public V3InterceptorToV2Bridge<ExtProcFilter> {
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
   ExtProcFilter(const ChannelArgs& args, RefCountedPtr<const Config> config);
+  ~ExtProcFilter() override;
 
-  RefCountedPtr<const Config> config() const { return config_; }
-  RefCountedPtr<ExtProcChannel> channel() const { return config_->channel(); }
+ private:
+  class ExtProcCall;
 
-  class ExtProcChannel final : public Blackboard::Entry {
+  class TelemetryDomain final : public InstrumentDomain<TelemetryDomain> {
    public:
-    static UniqueTypeName Type() {
-      return GRPC_UNIQUE_TYPE_NAME_HERE("ext_proc_channel");
-    }
-    ExtProcChannel(std::shared_ptr<const XdsBootstrap::XdsServerTarget> server,
-                   RefCountedPtr<XdsTransportFactory> transport_factory);
-    ~ExtProcChannel() override;
-    std::shared_ptr<const XdsBootstrap::XdsServerTarget> server() const {
-      return server_;
-    }
+    using Backend = HighContentionBackend;
+    static constexpr absl::string_view kName = "client_ext_proc";
+    GRPC_INSTRUMENT_DOMAIN_LABELS("target");
+
+    static DoubleHistogramHandle<ExponentialDoubleHistogramShape>
+        kClientHeadersDuration;
+    static DoubleHistogramHandle<ExponentialDoubleHistogramShape>
+        kClientHalfCloseDuration;
+    static DoubleHistogramHandle<ExponentialDoubleHistogramShape>
+        kServerHeadersDuration;
+    static DoubleHistogramHandle<ExponentialDoubleHistogramShape>
+        kServerTrailersDuration;
+  };
 
-    RefCountedPtr<XdsTransportFactory::XdsTransport> transport() const {
-      return transport_;
-    }
+  RefCountedPtr<ExtProcChannel> channel() const { return config_->channel(); }
 
-   private:
-    std::shared_ptr<const XdsBootstrap::XdsServerTarget> server_;
-    RefCountedPtr<XdsTransportFactory::XdsTransport> transport_;
-  };
+  void RecordClientHeadersDuration(double duration_seconds) const;
+  void RecordClientHalfCloseDuration(double duration_seconds) const;
+  void RecordServerHeadersDuration(double duration_seconds) const;
+  void RecordServerTrailersDuration(double duration_seconds) const;
 
- private:
-  void Orphaned() override {}
+  void Orphaned() override {
+    GRPC_TRACE_LOG(ext_proc_filter, INFO)
+        << "ExtProcFilter " << this << " Orphaned()";
+    event_engine_.reset();
+    config_.reset();
+    telemetry_storage_.reset();
+  }
 
   void InterceptCall(UnstartedCallHandler unstarted_call_handler) override;
 
   RefCountedPtr<const Config> config_;
+  std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine_;
+  Slice default_authority_;
+  InstrumentStorageRefPtr<TelemetryDomain> telemetry_storage_;
 };
 
 }  // namespace grpc_core

data/src/core/filter/ext_proc/ext_proc_messages.cc

@@ -16,7 +16,13 @@
 
 #include "src/core/filter/ext_proc/ext_proc_messages.h"
 
+#include <grpc/grpc_security_constants.h>
 #include <grpc/status.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+#include <openssl/x509.h>
 
 #include <cstddef>
 #include <cstdint>
@@ -31,6 +37,7 @@
 #include "google/protobuf/struct.upb.h"
 #include "src/core/call/metadata_batch.h"
 #include "src/core/call/status_util.h"
+#include "src/core/credentials/transport/tls/tls_utils.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/util/matchers.h"
 #include "src/core/util/string.h"
@@ -41,8 +48,10 @@
 #include "upb/mem/arena.h"
 #include "upb/mem/arena.hpp"
 #include "absl/functional/function_ref.h"
+#include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/escaping.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 
@@ -150,6 +159,7 @@ absl::StatusOr<ExtProcResponse::BodyMutation> ParseExtProcBodyMutation(
       envoy_service_ext_proc_v3_StreamedBodyResponse_end_of_stream(
           streamed_response);
   bool end_of_stream_without_message =
+      end_of_stream &&
       envoy_service_ext_proc_v3_StreamedBodyResponse_end_of_stream_without_message(
           streamed_response);
   return ExtProcResponse::BodyMutation{
@@ -260,7 +270,7 @@ absl::StatusOr<ExtProcResponse> ExtProcResponse::Parse(
           envoy_service_ext_proc_v3_ImmediateResponse_headers(
               immediate_response));
       if (!header_mutation.ok()) return header_mutation.status();
-      immediate_response_value.header_mutation = std::move(*header_mutation);
+      immediate_response_value.mutation = std::move(*header_mutation);
       auto grpc_status =
           envoy_service_ext_proc_v3_ImmediateResponse_grpc_status(
               immediate_response);
@@ -320,12 +330,19 @@ class UpbHeaderMapEncoder {
         disallowed_headers_(disallowed_headers) {}
 
   void Encode(const Slice& key, const Slice& value) {
-    Append(key.as_string_view(), value.as_string_view());
+    // The slices are owned by the metadata batch, which outlives serialization
+    // of the request, so their contents do not need to be copied.
+    Append(key.as_string_view(), StdStringToUpbString(value.as_string_view()));
   }
 
   template <typename Which>
   void Encode(Which, const typename Which::ValueType& value) {
-    Append(Which::key(), Which::Encode(value).as_string_view());
+    // Which::Encode() returns a temporary Slice, and for inlined slices the
+    // bytes live inside that temporary, so they must be copied onto the arena:
+    // the upb message only retains a pointer to them, and the request is
+    // serialized long after this returns.
+    Append(Which::key(), CopyStdStringToUpbString(
+                             Which::Encode(value).as_string_view(), arena_));
   }
 
  private:
@@ -349,18 +366,17 @@ class UpbHeaderMapEncoder {
   }
 
   ABSL_ATTRIBUTE_NOINLINE void Append(absl::string_view key,
-                                      absl::string_view value) {
+                                      upb_StringView value) {
     if (!ShouldForwardHeader(key)) {
       return;
     }
     auto* value_msg =
         envoy_config_core_v3_HeaderMap_add_headers(header_map_, arena_);
-    envoy_config_core_v3_HeaderValue_set_key(
-        value_msg, upb_StringView_FromDataAndSize(key.data(), key.size()));
+    envoy_config_core_v3_HeaderValue_set_key(value_msg,
+                                             StdStringToUpbString(key));
     // Per gRFC A102, when writing, we always set the raw_value field and never
     // the value field.
-    envoy_config_core_v3_HeaderValue_set_raw_value(
-        value_msg, upb_StringView_FromDataAndSize(value.data(), value.size()));
+    envoy_config_core_v3_HeaderValue_set_raw_value(value_msg, value);
   }
 
   envoy_config_core_v3_HeaderMap* header_map_;
@@ -410,11 +426,11 @@ void SetExtProcRequestBody(
       envoy_service_ext_proc_v3_HttpBody_new(arena);
   envoy_service_ext_proc_v3_HttpBody_set_body(body, buf);
   if (end_of_stream) {
-    envoy_service_ext_proc_v3_HttpBody_set_end_of_stream(body, end_of_stream);
-  }
-  if (end_of_stream_without_message) {
-    envoy_service_ext_proc_v3_HttpBody_set_end_of_stream_without_message(body,
-                                                                         true);
+    envoy_service_ext_proc_v3_HttpBody_set_end_of_stream(body, true);
+    if (end_of_stream_without_message) {
+      envoy_service_ext_proc_v3_HttpBody_set_end_of_stream_without_message(
+          body, true);
+    }
   }
   envoy_service_ext_proc_v3_ProcessingRequest_set_request_body(request, body);
 }
@@ -443,10 +459,7 @@ void SetExtProcAttributes(
   if (attributes == nullptr) return;
   constexpr absl::string_view kAttributeKey = "envoy.filters.http.ext_proc";
   envoy_service_ext_proc_v3_ProcessingRequest_attributes_set(
-      request,
-      upb_StringView_FromDataAndSize(kAttributeKey.data(),
-                                     kAttributeKey.size()),
-      attributes, arena);
+      request, StdStringToUpbString(kAttributeKey), attributes, arena);
 }
 
 void SetExtProcProtocolConfig(
@@ -519,10 +532,9 @@ class UpbStructHeadersEncoder {
                                       absl::string_view value) {
     ::google_protobuf_Value* val_msg = ::google_protobuf_Value_new(arena_);
     ::google_protobuf_Value_set_string_value(
-        val_msg, upb_StringView_FromDataAndSize(value.data(), value.size()));
+        val_msg, CopyStdStringToUpbString(value, arena_));
     ::google_protobuf_Struct_fields_set(
-        struct_msg_, upb_StringView_FromDataAndSize(key.data(), key.size()),
-        val_msg, arena_);
+        struct_msg_, CopyStdStringToUpbString(key, arena_), val_msg, arena_);
   }
 
   ::google_protobuf_Struct* struct_msg_;
@@ -531,54 +543,81 @@ class UpbStructHeadersEncoder {
 
 }  // namespace
 
+//
+// ComputeSha256PeerCertificateDigest()
+//
+
+std::string ComputeSha256PeerCertificateDigest(
+    grpc_auth_context* auth_context) {
+  if (auth_context == nullptr) return "";
+  absl::string_view pem_cert =
+      GetAuthPropertyValue(auth_context, GRPC_X509_PEM_CERT_PROPERTY_NAME);
+  if (pem_cert.empty()) return "";
+  BIO* bio =
+      BIO_new_mem_buf(pem_cert.data(), static_cast<int>(pem_cert.size()));
+  if (bio == nullptr) return "";
+  X509* cert = PEM_read_bio_X509(bio, /*x=*/nullptr, /*cb=*/nullptr,
+                                 /*u=*/nullptr);
+  BIO_free(bio);
+  if (cert == nullptr) {
+    // Avoid leaving the parse failure on the OpenSSL error queue, since that
+    // would affect unrelated operations on this thread.
+    ERR_clear_error();
+    LOG(ERROR) << "ext_proc: failed to parse peer certificate";
+    return "";
+  }
+  unsigned char digest[EVP_MAX_MD_SIZE];
+  unsigned int digest_length = 0;
+  const bool ok = X509_digest(cert, EVP_sha256(), digest, &digest_length) == 1;
+  X509_free(cert);
+  if (!ok) {
+    // Avoid leaving the failure on the OpenSSL error queue, since that would
+    // affect unrelated operations on this thread.
+    ERR_clear_error();
+    LOG(ERROR) << "ext_proc: failed to compute peer certificate digest";
+    return "";
+  }
+  return absl::BytesToHexString(
+      absl::string_view(reinterpret_cast<const char*>(digest), digest_length));
+}
+
 //
 // CreateExtProcAttributesProtoStruct()
 //
 
-// TODO(rishesh): Support CEL attributes from A103 (except
-// xds.cluster_metadata.filter_metadata) when adding support for ext_proc on
-// the server side. See
-// https://github.com/grpc/proposal/blob/master/A103-xds-composite-filter.md#cel-attributes
 ::google_protobuf_Struct* CreateExtProcAttributesProtoStruct(
     upb_Arena* arena, const std::vector<std::string>& attributes,
-    const grpc_metadata_batch& metadata) {
+    const EvaluateArgs& args, absl::string_view default_authority,
+    absl::string_view sha256_peer_certificate_digest) {
   if (attributes.empty()) return nullptr;
   ::google_protobuf_Struct* struct_msg = ::google_protobuf_Struct_new(arena);
   auto add_field = [&](absl::string_view name, absl::string_view value) {
     ::google_protobuf_Value* val_msg = ::google_protobuf_Value_new(arena);
     ::google_protobuf_Value_set_string_value(
-        val_msg, upb_StringView_FromDataAndSize(value.data(), value.size()));
+        val_msg, CopyStdStringToUpbString(value, arena));
     ::google_protobuf_Struct_fields_set(
-        struct_msg, upb_StringView_FromDataAndSize(name.data(), name.size()),
-        val_msg, arena);
+        struct_msg, CopyStdStringToUpbString(name, arena), val_msg, arena);
   };
   for (const auto& attr : attributes) {
     if (attr == "request.path" || attr == "request.url_path") {
-      if (const Slice* path = metadata.get_pointer(HttpPathMetadata())) {
-        add_field(attr, path->as_string_view());
-      }
+      absl::string_view path = args.GetPath();
+      if (!path.empty()) add_field(attr, path);
     } else if (attr == "request.host") {
-      if (const Slice* auth = metadata.get_pointer(HttpAuthorityMetadata())) {
-        add_field(attr, auth->as_string_view());
-      } else if (const Slice* host = metadata.get_pointer(HostMetadata())) {
-        add_field(attr, host->as_string_view());
-      }
+      absl::string_view host = args.GetAuthority();
+      if (host.empty()) host = default_authority;
+      if (!host.empty()) add_field(attr, host);
     } else if (attr == "request.method") {
-      if (auto* method = metadata.get_pointer(HttpMethodMetadata())) {
-        add_field(attr, HttpMethodMetadata::Encode(*method).as_string_view());
-      } else {
-        add_field(attr, "POST");
-      }
+      absl::string_view method = args.GetMethod();
+      add_field(attr, method.empty() ? "POST" : method);
     } else if (attr == "request.headers") {
       ::google_protobuf_Struct* headers_struct =
           ::google_protobuf_Struct_new(arena);
       UpbStructHeadersEncoder encoder(headers_struct, arena);
-      metadata.Encode(&encoder);
+      args.EncodeHeaders(&encoder);
       ::google_protobuf_Value* val_msg = ::google_protobuf_Value_new(arena);
       ::google_protobuf_Value_set_struct_value(val_msg, headers_struct);
       ::google_protobuf_Struct_fields_set(
-          struct_msg, upb_StringView_FromDataAndSize(attr.data(), attr.size()),
-          val_msg, arena);
+          struct_msg, CopyStdStringToUpbString(attr, arena), val_msg, arena);
     } else if (attr == "request.referer" || attr == "request.useragent" ||
                attr == "request.id") {
       absl::string_view key;
@@ -591,10 +630,29 @@ class UpbStructHeadersEncoder {
       }
       std::string backing_str;
       std::optional<absl::string_view> val =
-          metadata.GetStringValue(key, &backing_str);
+          args.GetHeaderValue(key, &backing_str);
       if (val.has_value()) add_field(attr, *val);
     } else if (attr == "request.query") {
       add_field(attr, "");
+    } else if (attr == "source.port") {
+      if (args.GetPeerPort() > 0) {
+        ::google_protobuf_Value* val_msg = ::google_protobuf_Value_new(arena);
+        ::google_protobuf_Value_set_number_value(val_msg, args.GetPeerPort());
+        ::google_protobuf_Struct_fields_set(
+            struct_msg, CopyStdStringToUpbString(attr, arena), val_msg, arena);
+      }
+    } else {
+      absl::string_view val;
+      if (attr == "source.address") {
+        val = args.GetPeerAddressString();
+      } else if (attr == "connection.requested_server_name") {
+        val = args.GetRequestedServerName();
+      } else if (attr == "connection.tls_version") {
+        val = args.GetTlsVersion();
+      } else if (attr == "connection.sha256_peer_certificate_digest") {
+        val = sha256_peer_certificate_digest;
+      }
+      if (!val.empty()) add_field(attr, val);
     }
   }
   return struct_msg;
@@ -664,9 +722,8 @@ absl::StatusOr<std::string> CreateExtProcClientBodyRequest(
   return CreateRequestAndSerialize(
       arena, attributes, observability_mode, processing_mode,
       [&](envoy_service_ext_proc_v3_ProcessingRequest* request) {
-        SetExtProcRequestBody(
-            arena, upb_StringView_FromDataAndSize(body.data(), body.size()),
-            end_of_stream, end_of_stream_without_message, request);
+        SetExtProcRequestBody(arena, StdStringToUpbString(body), end_of_stream,
+                              end_of_stream_without_message, request);
       });
 }
 
@@ -677,9 +734,7 @@ absl::StatusOr<std::string> CreateExtProcServerBodyRequest(
   return CreateRequestAndSerialize(
       arena, attributes, observability_mode, processing_mode,
       [&](envoy_service_ext_proc_v3_ProcessingRequest* request) {
-        SetExtProcResponseBody(
-            arena, upb_StringView_FromDataAndSize(body.data(), body.size()),
-            request);
+        SetExtProcResponseBody(arena, StdStringToUpbString(body), request);
       });
 }
 

data/src/core/filter/ext_proc/ext_proc_messages.h

@@ -17,6 +17,7 @@
 #ifndef GRPC_SRC_CORE_FILTER_EXT_PROC_EXT_PROC_MESSAGES_H
 #define GRPC_SRC_CORE_FILTER_EXT_PROC_EXT_PROC_MESSAGES_H
 
+#include <grpc/grpc_security.h>
 #include <grpc/status.h>
 
 #include <optional>
@@ -25,6 +26,7 @@
 #include <vector>
 
 #include "google/protobuf/struct.upb.h"
+#include "src/core/call/evaluate_args.h"
 #include "src/core/call/metadata_batch.h"
 #include "src/core/util/matchers.h"
 #include "src/core/xds/grpc/xds_common_types.h"
@@ -45,8 +47,8 @@ namespace grpc_core {
 // send_response_body), it always operates in GRPC mode (deframed gRPC messages
 // sent one at a time).
 struct ExtProcProcessingMode {
-  bool send_request_headers = false;
-  bool send_response_headers = false;
+  bool send_request_headers = true;
+  bool send_response_headers = true;
   bool send_response_trailers = false;
   bool send_request_body = false;
   bool send_response_body = false;
@@ -137,8 +139,9 @@ absl::StatusOr<std::string> CreateExtProcServerHeadersRequest(
 //  processing modes as per gRFC A93).
 //  - end_of_stream: If true, indicates that this body chunk is the last message
 //  on the stream.
-//  - end_of_stream_without_message: If true, indicates end of stream with an
-//  empty body chunk.
+//  - end_of_stream_without_message: If end_of_stream is true and this is true,
+//  indicates end of stream without a message (e.g. half-close). Ignored if
+//  end_of_stream is false.
 absl::StatusOr<std::string> CreateExtProcClientBodyRequest(
     upb_Arena* arena, absl::string_view body,
     ::google_protobuf_Struct* attributes, bool observability_mode,
@@ -193,6 +196,21 @@ absl::StatusOr<std::string> CreateExtProcServerTrailersRequest(
     ::google_protobuf_Struct* attributes, bool observability_mode,
     std::optional<ExtProcProcessingMode> processing_mode);
 
+// Computes the value of the "connection.sha256_peer_certificate_digest"
+// attribute (see gRFC A103): the hex-encoded SHA-256 digest of the peer's
+// leaf certificate, which is obtained from \a auth_context. Returns an empty
+// string if there is no peer certificate or if it cannot be parsed.
+//
+// Note that this requires parsing and hashing the peer certificate, so
+// callers must invoke this at most once per connection, and only if the
+// ext_proc config actually requests the attribute.
+//
+// TODO(rishesh): Computing this in the ext_proc filter is sub-optimal, because
+// we will wind up computing it once for each filter chain. We should
+// eventually fix that by creating a common connection context object, and this
+// should be storable as one of the elements of that context.
+std::string ComputeSha256PeerCertificateDigest(grpc_auth_context* auth_context);
+
 // Creates a protobuf Struct message (::google_protobuf_Struct*) containing
 // connection and request metadata attributes requested by the external
 // processor configuration.
@@ -201,16 +219,25 @@ absl::StatusOr<std::string> CreateExtProcServerTrailersRequest(
 //  - arena: The upb arena used for allocating the Struct message and its
 //  fields.
 //  - requested_attributes: A list of attribute names (e.g., "request.path",
-//  "request.method", "request.host") to extract and populate.
-//  - metadata: The gRPC metadata batch from which attribute values (like
-//  authority, method, path, or headers) are extracted.
+//  "request.method", "request.host", "source.address", "source.port",
+//  "connection.requested_server_name", "connection.tls_version",
+//  "connection.sha256_peer_certificate_digest") to extract and populate.
+//  - args: Provides the request metadata (authority, method, path, headers)
+//  and, on the server side, the connection-level attributes (peer IP/port,
+//  TLS security properties).
+//  - default_authority: Default authority fallback for request.host.
+//  - sha256_peer_certificate_digest: The value for the
+//  "connection.sha256_peer_certificate_digest" attribute, as returned by
+//  ComputeSha256PeerCertificateDigest(). Empty if the attribute is not
+//  requested or unavailable.
 //
 // Returns:
 //  A pointer to the newly created ::google_protobuf_Struct message on the
 //  arena, or nullptr if no requested attributes were matched or populated.
 ::google_protobuf_Struct* CreateExtProcAttributesProtoStruct(
     upb_Arena* arena, const std::vector<std::string>& requested_attributes,
-    const grpc_metadata_batch& metadata);
+    const EvaluateArgs& args, absl::string_view default_authority,
+    absl::string_view sha256_peer_certificate_digest = "");
 
 // Represents the parsed response from an external processor, corresponding to
 // envoy.service.ext_proc.v3.ProcessingResponse in gRFC A93.
@@ -260,7 +287,7 @@ struct ExtProcResponse {
     // error message to return with.
     std::string details;
     // Headers to set in the response.
-    HeaderMutation header_mutation;
+    HeaderMutation mutation;
   };
 
   // The variant representing the actual response content.

data/src/core/handshaker/handshaker.cc

@@ -76,7 +76,7 @@ HandshakeManager::HandshakeManager()
                                                      : nullptr) {}
 
 void HandshakeManager::Add(RefCountedPtr<Handshaker> handshaker) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   GRPC_TRACE_LOG(handshaker, INFO)
       << "handshake_manager " << this << ": adding handshaker "
       << std::string(handshaker->name()) << " [" << handshaker.get()
@@ -94,7 +94,7 @@ void HandshakeManager::DoHandshake(
   // return from this function, and on_handshake_done might release the
   // last ref to this object.
   auto self = Ref();
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   GRPC_CHECK_EQ(index_, 0u);
   on_handshake_done_ = std::move(on_handshake_done);
   // Construct handshaker args.  These will be passed through all
@@ -133,7 +133,7 @@ void HandshakeManager::DoHandshake(
 }
 
 void HandshakeManager::Shutdown(absl::Status error) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!is_shutdown_) {
     GRPC_CHANNELZ_LOG(args_.trace_node) << "Shutdown called: " << error;
     is_shutdown_ = true;
@@ -197,7 +197,7 @@ void HandshakeManager::CallNextHandshakerLocked(absl::Status error) {
   }
   ++index_;
   handshaker->DoHandshake(&args_, [self = Ref()](absl::Status error) mutable {
-    MutexLock lock(&self->mu_);
+    MutexLock lock(self->mu_);
     self->CallNextHandshakerLocked(std::move(error));
   });
 }

data/src/core/handshaker/http_connect/http_connect_client_handshaker.cc

@@ -174,7 +174,7 @@ void HttpConnectClientHandshaker::OnReadDoneScheduler(void* arg,
 void HttpConnectClientHandshaker::OnReadDone(absl::Status error) {
   bool done;
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     done = OnReadDoneLocked(std::move(error));
   }
   if (done) Unref();
@@ -249,7 +249,7 @@ bool HttpConnectClientHandshaker::OnReadDoneLocked(absl::Status error) {
 //
 
 void HttpConnectClientHandshaker::Shutdown(absl::Status /*error*/) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (on_handshake_done_ != nullptr) args_->endpoint.reset();
 }
 
@@ -291,7 +291,7 @@ void HttpConnectClientHandshaker::DoHandshake(
     }
   }
   // Save state in the handshaker object.
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   args_ = args;
   on_handshake_done_ = std::move(on_handshake_done);
   // Log connection via proxy.

data/src/core/handshaker/security/pipelined_secure_endpoint.cc

@@ -639,7 +639,7 @@ class PipelinedSecureEndpoint final : public EventEngine::Endpoint {
       tsi_result result;
       frame_protector_.TraceOp("Write", data->c_slice_buffer());
       {
-        grpc_core::MutexLock lock(frame_protector_.write_mu());
+        grpc_core::MutexLock lock(*frame_protector_.write_mu());
         result = frame_protector_.Protect(data->c_slice_buffer(),
                                           args.max_frame_size());
       }
@@ -677,9 +677,9 @@ class PipelinedSecureEndpoint final : public EventEngine::Endpoint {
 
     void Shutdown() {
       std::unique_ptr<EventEngine::Endpoint> wrapped_ep;
-      grpc_core::MutexLock write_lock(frame_protector_.write_mu());
-      grpc_core::MutexLock read_lock(frame_protector_.read_mu());
-      grpc_core::MutexLock shutdown_read_lock(&shutdown_read_mu_);
+      grpc_core::MutexLock write_lock(*frame_protector_.write_mu());
+      grpc_core::MutexLock read_lock(*frame_protector_.read_mu());
+      grpc_core::MutexLock shutdown_read_lock(shutdown_read_mu_);
       wrapped_ep = std::move(wrapped_ep_);
       frame_protector_.Shutdown();
     }
@@ -735,7 +735,7 @@ class PipelinedSecureEndpoint final : public EventEngine::Endpoint {
         if (read_finished_immediately) {
           lock.Release();
           {
-            grpc_core::MutexLock lock(&impl->read_queue_mu_);
+            grpc_core::MutexLock lock(impl->read_queue_mu_);
             impl->frame_protector_.TraceOp(
                 "ReadImm",
                 impl->staging_protected_data_buffer_->c_slice_buffer());
@@ -754,7 +754,7 @@ class PipelinedSecureEndpoint final : public EventEngine::Endpoint {
         ABSL_LOCKS_EXCLUDED(impl->read_queue_mu_) {
       if (status.ok()) {
         {
-          grpc_core::MutexLock lock(&impl->read_queue_mu_);
+          grpc_core::MutexLock lock(impl->read_queue_mu_);
           impl->frame_protector_.TraceOp(
               "Read", impl->staging_protected_data_buffer_->c_slice_buffer());
           impl->MoveStagingIntoProtectedBuffer();
@@ -816,7 +816,7 @@ class PipelinedSecureEndpoint final : public EventEngine::Endpoint {
       if (read_finished_immediately) {
         shutdown_read_lock.Release();
         {
-          grpc_core::MutexLock read_queue_lock(&read_queue_mu_);
+          grpc_core::MutexLock read_queue_lock(read_queue_mu_);
           frame_protector_.TraceOp(
               "ReadImm", staging_protected_data_buffer_->c_slice_buffer());
           MoveStagingIntoProtectedBuffer();
@@ -829,7 +829,7 @@ class PipelinedSecureEndpoint final : public EventEngine::Endpoint {
           // If there was an error, the read will fail asynchronously;
           // otherwise, the unprotected data is now in the transport read's
           // buffer and we can return true.
-          grpc_core::MutexLock read_queue_lock(&read_queue_mu_);
+          grpc_core::MutexLock read_queue_lock(read_queue_mu_);
           return unprotecting_.ok();
         }
       }
@@ -1004,7 +1004,7 @@ class PipelinedSecureEndpoint final : public EventEngine::Endpoint {
         lock.Release();
         bool should_unprotect = false;
         {
-          grpc_core::MutexLock lock(&impl->read_queue_mu_);
+          grpc_core::MutexLock lock(impl->read_queue_mu_);
           impl->frame_protector_.TraceOp(
               "ReadImm",
               impl->staging_protected_data_buffer_->c_slice_buffer());
@@ -1027,7 +1027,7 @@ class PipelinedSecureEndpoint final : public EventEngine::Endpoint {
         ABSL_LOCKS_EXCLUDED(impl->read_queue_mu_) {
       bool should_unprotect = false;
       {
-        grpc_core::MutexLock lock(&impl->read_queue_mu_);
+        grpc_core::MutexLock lock(impl->read_queue_mu_);
         should_unprotect = impl->ShouldContinueUnprotect();
         if (!status.ok()) {
           // We rely on ContinueUnprotect to fail the read if the