grpc 1.84.0 → 1.85.0.pre1

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.h

@@ -25,12 +25,12 @@
 #include <optional>
 #include <string>
 
+#include "grpc/gcp/altscontext.upb.h"
+#include "grpc/gcp/handshaker.upb.h"
 #include "src/core/credentials/transport/alts/grpc_alts_credentials_options.h"
 #include "src/core/lib/iomgr/pollset_set.h"
 #include "src/core/tsi/transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
-#include "src/proto/grpc/gcp/altscontext.upb.h"
-#include "src/proto/grpc/gcp/handshaker.upb.h"
 
 #define TSI_ALTS_SERVICE_ACCOUNT_PEER_PROPERTY "service_account"
 #define TSI_ALTS_CERTIFICATE_TYPE "ALTS"

data/src/core/tsi/alts/handshaker/alts_tsi_utils.h

@@ -23,8 +23,8 @@
 #include <grpc/grpc.h>
 #include <grpc/support/port_platform.h>
 
+#include "grpc/gcp/handshaker.upb.h"
 #include "src/core/tsi/transport_security_interface.h"
-#include "src/proto/grpc/gcp/handshaker.upb.h"
 
 ///
 /// This method converts grpc_status_code code to the corresponding tsi_result

data/src/core/tsi/alts/handshaker/transport_security_common_api.h

@@ -24,8 +24,8 @@
 #include <grpc/support/alloc.h>
 #include <grpc/support/port_platform.h>
 
+#include "grpc/gcp/transport_security_common.upb.h"
 #include "src/core/util/crash.h"
-#include "src/proto/grpc/gcp/transport_security_common.upb.h"
 
 // C struct corresponding to protobuf message RpcProtocolVersions.Version
 typedef struct _grpc_gcp_RpcProtocolVersions_Version {

data/src/core/tsi/ssl/key_logging/ssl_key_logging.cc

@@ -62,11 +62,11 @@ TlsSessionKeyLoggerCache::TlsSessionKeyLogger::TlsSessionKeyLogger(
 
 TlsSessionKeyLoggerCache::TlsSessionKeyLogger::~TlsSessionKeyLogger() {
   {
-    grpc_core::MutexLock lock(&lock_);
+    grpc_core::MutexLock lock(lock_);
     if (fd_ != nullptr) fclose(fd_);
   }
   {
-    grpc_core::MutexLock lock(g_tls_session_key_log_cache_mu);
+    grpc_core::MutexLock lock(*g_tls_session_key_log_cache_mu);
     auto it = cache_->tls_session_key_logger_map_.find(
         tls_session_key_log_file_path_);
     if (it != cache_->tls_session_key_logger_map_.end() && it->second == this) {
@@ -77,7 +77,7 @@ TlsSessionKeyLoggerCache::TlsSessionKeyLogger::~TlsSessionKeyLogger() {
 
 void TlsSessionKeyLoggerCache::TlsSessionKeyLogger::LogSessionKeys(
     SSL_CTX* /* ssl_context */, const std::string& session_keys_info) {
-  grpc_core::MutexLock lock(&lock_);
+  grpc_core::MutexLock lock(lock_);
   if (fd_ == nullptr || session_keys_info.empty()) return;
   // Append to key log file under lock
   bool err =
@@ -101,7 +101,7 @@ TlsSessionKeyLoggerCache::TlsSessionKeyLoggerCache()
 }
 
 TlsSessionKeyLoggerCache::~TlsSessionKeyLoggerCache() {
-  grpc_core::MutexLock lock(g_tls_session_key_log_cache_mu);
+  grpc_core::MutexLock lock(*g_tls_session_key_log_cache_mu);
   g_cache_instance = nullptr;
 }
 
@@ -113,7 +113,7 @@ grpc_core::RefCountedPtr<TlsSessionKeyLogger> TlsSessionKeyLoggerCache::Get(
     return nullptr;
   }
   {
-    grpc_core::MutexLock lock(g_tls_session_key_log_cache_mu);
+    grpc_core::MutexLock lock(*g_tls_session_key_log_cache_mu);
     grpc_core::RefCountedPtr<TlsSessionKeyLoggerCache> cache;
     if (g_cache_instance == nullptr) {
       // This will automatically set g_cache_instance.

data/src/core/tsi/ssl/session_cache/ssl_session_cache.cc

@@ -78,7 +78,7 @@ SslSessionLRUCache::~SslSessionLRUCache() {
 }
 
 size_t SslSessionLRUCache::Size() {
-  grpc_core::MutexLock lock(&lock_);
+  grpc_core::MutexLock lock(lock_);
   return use_order_list_size_;
 }
 
@@ -101,7 +101,7 @@ void SslSessionLRUCache::Put(const char* key, SslSessionPtr session) {
     LOG(ERROR) << "Attempted to put null SSL session in session cache.";
     return;
   }
-  grpc_core::MutexLock lock(&lock_);
+  grpc_core::MutexLock lock(lock_);
   Node* node = FindLocked(key);
   if (node != nullptr) {
     node->SetSession(std::move(session));
@@ -123,7 +123,7 @@ void SslSessionLRUCache::Put(const char* key, SslSessionPtr session) {
 }
 
 SslSessionPtr SslSessionLRUCache::Get(const char* key) {
-  grpc_core::MutexLock lock(&lock_);
+  grpc_core::MutexLock lock(lock_);
   // Key is only used for lookups.
   Node* node = FindLocked(key);
   if (node == nullptr) {

data/src/core/tsi/ssl_transport_security.cc

@@ -49,7 +49,9 @@
 #include <grpc/support/thd_id.h>
 #include <openssl/bio.h>
 #include <openssl/crypto.h>  // For OPENSSL_free
+#if !defined(OPENSSL_NO_ENGINE)
 #include <openssl/engine.h>
+#endif
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 #include <openssl/tls1.h>
@@ -582,7 +584,7 @@ void TlsOffloadSignDoneCallback(
   std::optional<HandshakerNextArgs> next_args;
   tsi_result result = TSI_INTERNAL_ERROR;
   {
-    grpc_core::MutexLock lock(&handshaker->mu);
+    grpc_core::MutexLock lock(handshaker->mu);
     if (handshaker->is_shutdown) return;
     handshaker->signed_bytes = std::move(signed_data);
     handshaker->signing_handle.reset();
@@ -796,7 +798,7 @@ void OnSelectCertificateDone(
   tsi_result next_result;
   std::optional<HandshakerNextArgs> next_args;
   {
-    grpc_core::MutexLock lock(&handshaker->mu);
+    grpc_core::MutexLock lock(handshaker->mu);
     if (handshaker->is_shutdown) return;
     if (!result.ok()) {
       VLOG(2) << "SelectCertificate failed " << result.status();
@@ -1021,9 +1023,7 @@ static int looks_like_ip_address(absl::string_view name) {
 static tsi_result ssl_get_x509_common_name(X509* cert, unsigned char** utf8,
                                            size_t* utf8_size) {
   int common_name_index = -1;
-  X509_NAME_ENTRY* common_name_entry = nullptr;
-  ASN1_STRING* common_name_asn1 = nullptr;
-  X509_NAME* subject_name = X509_get_subject_name(cert);
+  auto* subject_name = X509_get_subject_name(cert);
   int utf8_returned_size = 0;
   if (subject_name == nullptr) {
     VLOG(2) << "Could not get subject name from certificate.";
@@ -1035,12 +1035,13 @@ static tsi_result ssl_get_x509_common_name(X509* cert, unsigned char** utf8,
     VLOG(2) << "Could not get common name of subject from certificate.";
     return TSI_NOT_FOUND;
   }
-  common_name_entry = X509_NAME_get_entry(subject_name, common_name_index);
+  auto* common_name_entry =
+      X509_NAME_get_entry(subject_name, common_name_index);
   if (common_name_entry == nullptr) {
     LOG(ERROR) << "Could not get common name entry from certificate.";
     return TSI_INTERNAL_ERROR;
   }
-  common_name_asn1 = X509_NAME_ENTRY_get_data(common_name_entry);
+  auto* common_name_asn1 = X509_NAME_ENTRY_get_data(common_name_entry);
   if (common_name_asn1 == nullptr) {
     LOG(ERROR) << "Could not get common name entry asn1 from certificate.";
     return TSI_INTERNAL_ERROR;
@@ -1081,7 +1082,7 @@ static tsi_result peer_property_from_x509_common_name(
 static tsi_result peer_property_from_x509_subject(X509* cert,
                                                   tsi_peer_property* property,
                                                   bool is_verified_root_cert) {
-  X509_NAME* subject_name = X509_get_subject_name(cert);
+  auto* subject_name = X509_get_subject_name(cert);
   if (subject_name == nullptr) {
     GRPC_TRACE_LOG(tsi, INFO) << "Could not get subject name from certificate.";
     return TSI_NOT_FOUND;
@@ -1177,17 +1178,30 @@ static tsi_result add_subject_alt_names_properties_to_peer(
       char ntop_buf[INET6_ADDRSTRLEN];
       int af;
 
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+      if (ASN1_STRING_length(subject_alt_name->d.iPAddress) == 4) {
+        af = AF_INET;
+      } else if (ASN1_STRING_length(subject_alt_name->d.iPAddress) == 16) {
+        af = AF_INET6;
+#else
       if (subject_alt_name->d.iPAddress->length == 4) {
         af = AF_INET;
       } else if (subject_alt_name->d.iPAddress->length == 16) {
         af = AF_INET6;
+#endif
       } else {
         LOG(ERROR) << "SAN IP Address contained invalid IP";
         result = TSI_INTERNAL_ERROR;
         break;
       }
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+      const char* name =
+          inet_ntop(af, ASN1_STRING_get0_data(subject_alt_name->d.iPAddress),
+                    ntop_buf, INET6_ADDRSTRLEN);
+#else
       const char* name = inet_ntop(af, subject_alt_name->d.iPAddress->data,
                                    ntop_buf, INET6_ADDRSTRLEN);
+#endif
       if (name == nullptr) {
         LOG(ERROR) << "Could not get IP string from asn1 octet.";
         result = TSI_INTERNAL_ERROR;
@@ -1472,13 +1486,13 @@ static tsi_result x509_store_load_certs(X509_STORE* cert_store,
       break;  // We're at the end of stream.
     }
     if (root_names != nullptr) {
-      root_name = X509_get_subject_name(root);
-      if (root_name == nullptr) {
+      auto* root_subject = X509_get_subject_name(root);
+      if (root_subject == nullptr) {
         LOG(ERROR) << "Could not get name from root certificate.";
         result = TSI_INVALID_ARGUMENT;
         break;
       }
-      root_name = X509_NAME_dup(root_name);
+      root_name = X509_NAME_dup(const_cast<X509_NAME*>(root_subject));
       if (root_name == nullptr) {
         result = TSI_OUT_OF_RESOURCES;
         break;
@@ -2278,6 +2292,9 @@ static tsi_result ssl_handshaker_result_extract_peer(
   // the peer's certificate is not present in the stack
   STACK_OF(X509)* peer_chain = SSL_get_peer_cert_chain(impl->ssl);
 
+  const char* server_name =
+      SSL_get_servername(impl->ssl, TLSEXT_NAMETYPE_host_name);
+  const char* tls_version = SSL_get_version(impl->ssl);
   X509* verified_root_cert = static_cast<X509*>(
       SSL_get_ex_data(impl->ssl, g_ssl_ex_verified_root_cert_index));
   // 1 is for session reused property.
@@ -2285,6 +2302,8 @@ static tsi_result ssl_handshaker_result_extract_peer(
   if (alpn_selected != nullptr) new_property_count++;
   if (peer_chain != nullptr) new_property_count++;
   if (verified_root_cert != nullptr) new_property_count++;
+  if (server_name != nullptr) new_property_count++;
+  if (tls_version != nullptr) new_property_count++;
 #if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER >= 0x30000000L
   int nid = SSL_get_negotiated_group(impl->ssl);
   const char* negotiated_group_name =
@@ -2327,6 +2346,20 @@ static tsi_result ssl_handshaker_result_extract_peer(
   if (result != TSI_OK) return result;
   peer->property_count++;
 
+  if (server_name != nullptr) {
+    result = tsi_construct_string_peer_property_from_cstring(
+        TSI_SSL_REQUESTED_SERVER_NAME_PEER_PROPERTY, server_name,
+        &peer->properties[peer->property_count]);
+    if (result != TSI_OK) return result;
+    peer->property_count++;
+  }
+  if (tls_version != nullptr) {
+    result = tsi_construct_string_peer_property_from_cstring(
+        TSI_SSL_TLS_VERSION_PEER_PROPERTY, tls_version,
+        &peer->properties[peer->property_count]);
+    if (result != TSI_OK) return result;
+    peer->property_count++;
+  }
   if (verified_root_cert != nullptr) {
     result = peer_property_from_x509_subject(
         verified_root_cert, &peer->properties[peer->property_count], true);
@@ -2778,7 +2811,7 @@ static tsi_result ssl_handshaker_next(
     return TSI_INVALID_ARGUMENT;
   }
   tsi_ssl_handshaker* impl = static_cast<tsi_ssl_handshaker*>(self);
-  grpc_core::MutexLock lock(&impl->mu);
+  grpc_core::MutexLock lock(impl->mu);
   if (impl->is_shutdown) {
     if (error != nullptr) *error = "Handshaker shutdown";
     return TSI_HANDSHAKE_SHUTDOWN;
@@ -2817,7 +2850,7 @@ static void ssl_handshaker_shutdown(tsi_handshaker* self, bool peer_closed) {
   std::optional<HandshakerNextArgs> next_args;
 #endif  // defined(OPENSSL_IS_BORINGSSL)
   {
-    grpc_core::MutexLock lock(&impl->mu);
+    grpc_core::MutexLock lock(impl->mu);
     // Should never happen, if so something is very wrong
     if (impl->ssl == nullptr) return;
     impl->is_shutdown = true;

data/src/core/tsi/ssl_transport_security.h

@@ -23,6 +23,7 @@
 #include <grpc/grpc_security_constants.h>
 #include <grpc/private_key_signer.h>
 #include <grpc/support/port_platform.h>
+#include <openssl/opensslv.h>
 #include <openssl/x509.h>
 
 #include <cstdint>
@@ -40,6 +41,10 @@
 #include "src/core/util/ref_counted_ptr.h"
 #include "absl/strings/string_view.h"
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#error "OpenSSL versions older than 1.1.0 are no longer supported."
+#endif
+
 // Value for the TSI_CERTIFICATE_TYPE_PEER_PROPERTY property for X509 certs.
 #define TSI_X509_CERTIFICATE_TYPE "X509"
 
@@ -60,6 +65,8 @@
   "x509_verified_root_cert_subject"
 #define TSI_SSL_NEGOTIATED_KEY_EXCHANGE_GROUP \
   "ssl_negotiated_key_exchange_group"
+#define TSI_SSL_REQUESTED_SERVER_NAME_PEER_PROPERTY "ssl_requested_server_name"
+#define TSI_SSL_TLS_VERSION_PEER_PROPERTY "ssl_tls_version"
 
 namespace tsi {
 using RootCertInfo = std::variant<std::string, grpc_core::SpiffeBundleMap>;

data/src/core/tsi/ssl_transport_security_utils.cc

@@ -282,11 +282,11 @@ bool VerifyCrlCertIssuerNamesMatch(X509_CRL* crl, X509* cert) {
   if (cert == nullptr || crl == nullptr) {
     return false;
   }
-  X509_NAME* cert_issuer_name = X509_get_issuer_name(cert);
+  auto* cert_issuer_name = X509_get_issuer_name(cert);
   if (cert_issuer_name == nullptr) {
     return false;
   }
-  X509_NAME* crl_issuer_name = X509_CRL_get_issuer(crl);
+  auto* crl_issuer_name = X509_CRL_get_issuer(crl);
   if (crl_issuer_name == nullptr) {
     return false;
   }
@@ -317,9 +317,9 @@ absl::StatusOr<std::string> IssuerFromCert(X509* cert) {
   if (cert == nullptr) {
     return absl::InvalidArgumentError("cert cannot be null");
   }
-  X509_NAME* issuer = X509_get_issuer_name(cert);
+  auto* issuer = X509_get_issuer_name(cert);
   unsigned char* buf = nullptr;
-  int len = i2d_X509_NAME(issuer, &buf);
+  int len = i2d_X509_NAME(const_cast<X509_NAME*>(issuer), &buf);
   if (len < 0 || buf == nullptr) {
     return absl::InvalidArgumentError("could not read issuer name from cert");
   }
@@ -339,7 +339,8 @@ absl::StatusOr<std::string> AkidFromCertificate(X509* cert) {
     if (X509_get_ext_by_NID(cert, NID_authority_key_identifier, j) != -1) {
       return absl::InvalidArgumentError("Could not get AKID from certificate.");
     }
-    akid = X509_EXTENSION_get_data(X509_get_ext(cert, j));
+    akid = const_cast<ASN1_OCTET_STRING*>(
+        X509_EXTENSION_get_data(X509_get_ext(cert, j)));
   } else {
     return absl::InvalidArgumentError("Could not get AKID from certificate.");
   }
@@ -364,7 +365,8 @@ absl::StatusOr<std::string> AkidFromCrl(X509_CRL* crl) {
     if (X509_CRL_get_ext_by_NID(crl, NID_authority_key_identifier, j) != -1) {
       return absl::InvalidArgumentError("Could not get AKID from crl.");
     }
-    akid = X509_EXTENSION_get_data(X509_CRL_get_ext(crl, j));
+    akid = const_cast<ASN1_OCTET_STRING*>(
+        X509_EXTENSION_get_data(X509_CRL_get_ext(crl, j)));
   } else {
     return absl::InvalidArgumentError("Could not get AKID from crl.");
   }
@@ -467,6 +469,14 @@ absl::StatusOr<absl::string_view> ConvertKeyExchangeGroupToString(
       return absl::InvalidArgumentError(
           "X25519_MLKEM768 is not supported in this OpenSSL version with "
           "SSL_CTX_set1_groups_list.");
+#endif
+    case GRPC_TLS_GROUP_MLKEM1024:
+#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER >= 0x30500000L
+      return "MLKEM1024";
+#else
+      return absl::InvalidArgumentError(
+          "MLKEM1024 is not supported in this OpenSSL version with "
+          "SSL_CTX_set1_groups_list.");
 #endif
     case GRPC_TLS_GROUP_UNSPECIFIED:
       return absl::InvalidArgumentError("Unspecified key exchange group.");

data/src/core/util/event_log.cc

@@ -33,7 +33,7 @@ EventLog::~EventLog() {
 
 void EventLog::BeginCollection() {
   for (auto& fragment : fragments_) {
-    MutexLock lock(&fragment.mu);
+    MutexLock lock(fragment.mu);
     fragment.entries.clear();
   }
   collection_begin_ = gpr_get_cycle_counter();
@@ -47,7 +47,7 @@ std::vector<EventLog::Entry> EventLog::EndCollection(
   g_instance_.store(nullptr, std::memory_order_release);
   std::vector<Entry> result;
   for (auto& fragment : fragments_) {
-    MutexLock lock(&fragment.mu);
+    MutexLock lock(fragment.mu);
     for (const auto& entry : fragment.entries) {
       if (std::find(wanted_events.begin(), wanted_events.end(), entry.event) !=
           wanted_events.end()) {
@@ -64,7 +64,7 @@ std::vector<EventLog::Entry> EventLog::EndCollection(
 
 void EventLog::AppendInternal(absl::string_view event, int64_t delta) {
   auto& fragment = fragments_.this_cpu();
-  MutexLock lock(&fragment.mu);
+  MutexLock lock(fragment.mu);
   fragment.entries.push_back({gpr_get_cycle_counter(), event, delta});
 }
 

data/src/core/util/http_client/httpcli.cc

@@ -209,7 +209,7 @@ HttpRequest::~HttpRequest() {
 }
 
 void HttpRequest::Start() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (test_only_generate_response_.has_value()) {
     if (test_only_generate_response_.value()()) return;
   }
@@ -230,7 +230,7 @@ void HttpRequest::Start() {
 
 void HttpRequest::Orphan() {
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     GRPC_CHECK(!cancelled_);
     cancelled_ = true;
     // cancel potentially pending DNS resolution.
@@ -285,7 +285,7 @@ void HttpRequest::OnReadInternal(grpc_error_handle error) {
 void HttpRequest::ContinueDoneWriteAfterScheduleOnExecCtx(
     void* arg, grpc_error_handle error) {
   RefCountedPtr<HttpRequest> req(static_cast<HttpRequest*>(arg));
-  MutexLock lock(&req->mu_);
+  MutexLock lock(req->mu_);
   if (error.ok() && !req->cancelled_) {
     req->OnWritten();
   } else {
@@ -310,7 +310,7 @@ void HttpRequest::OnHandshakeDone(absl::StatusOr<HandshakerArgs*> result) {
     // do things like calling Orphan on the request
     g_test_only_on_handshake_done_intercept(this);
   }
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!result.ok()) {
     handshake_mgr_.reset();
     NextAddress(result.status());
@@ -376,7 +376,7 @@ void HttpRequest::NextAddress(grpc_error_handle error) {
 void HttpRequest::OnResolved(
     absl::StatusOr<std::vector<EventEngine::ResolvedAddress>> addresses_or) {
   RefCountedPtr<HttpRequest> unreffer(this);
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   ee_resolver_->reset();
   if (cancelled_) {
     Finish(GRPC_ERROR_CREATE("cancelled during DNS resolution"));

data/src/core/util/http_client/httpcli.h

@@ -204,7 +204,7 @@ class HttpRequest : public InternallyRefCounted<HttpRequest> {
   static void ContinueOnReadAfterScheduleOnExecCtx(void* user_data,
                                                    grpc_error_handle error) {
     RefCountedPtr<HttpRequest> req(static_cast<HttpRequest*>(user_data));
-    MutexLock lock(&req->mu_);
+    MutexLock lock(req->mu_);
     req->OnReadInternal(error);
   }
 

data/src/core/util/json/json_object_loader.cc

@@ -46,6 +46,13 @@ void LoadString::LoadInto(const std::string& value, void* dst,
   *static_cast<std::string*>(dst) = value;
 }
 
+bool LoadRefCountedString::IsNumber() const { return false; }
+
+void LoadRefCountedString::LoadInto(const std::string& value, void* dst,
+                                    ValidationErrors*) const {
+  *static_cast<RefCountedStringValue*>(dst) = RefCountedStringValue(value);
+}
+
 bool LoadDuration::IsNumber() const { return false; }
 
 void LoadDuration::LoadInto(const std::string& value, void* dst,

data/src/core/util/json/json_object_loader.h

@@ -15,8 +15,6 @@
 #ifndef GRPC_SRC_CORE_UTIL_JSON_JSON_OBJECT_LOADER_H
 #define GRPC_SRC_CORE_UTIL_JSON_JSON_OBJECT_LOADER_H
 
-#include <grpc/support/port_platform.h>
-
 #include <cstdint>
 #include <cstring>
 #include <map>
@@ -29,6 +27,7 @@
 #include "src/core/util/json/json_args.h"
 #include "src/core/util/no_destruct.h"
 #include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/ref_counted_string.h"
 #include "src/core/util/time.h"
 #include "src/core/util/validation_errors.h"
 #include "absl/meta/type_traits.h"
@@ -115,6 +114,17 @@ class LoadString : public LoadScalar {
                 ValidationErrors* errors) const override;
 };
 
+// Load a ref-counted string.
+class LoadRefCountedString : public LoadScalar {
+ protected:
+  ~LoadRefCountedString() = default;
+
+ private:
+  bool IsNumber() const override;
+  void LoadInto(const std::string& value, void* dst,
+                ValidationErrors* errors) const override;
+};
+
 // Load a Duration.
 class LoadDuration : public LoadScalar {
  protected:
@@ -293,6 +303,11 @@ class AutoLoader<std::string> final : public LoadString {
   ~AutoLoader() = default;
 };
 template <>
+class AutoLoader<RefCountedStringValue> final : public LoadRefCountedString {
+ private:
+  ~AutoLoader() = default;
+};
+template <>
 class AutoLoader<Duration> final : public LoadDuration {
  private:
   ~AutoLoader() = default;