Merge branch 'master' into interceptors

.bazelrc

@@ -0,0 +1,3 @@
+# load bazelrc from the legacy location
+# as recommended in https://github.com/bazelbuild/bazel/issues/6319
+import %workspace%/tools/bazel.rc

.clang_complete

@@ -14,4 +14,5 @@
 -Ithird_party/cares
 -Ithird_party/googletest/googletest/include
 -Ithird_party/googletest/googlemock/include
+-Ithird_party/nanopb
 

BUILD

@@ -131,7 +131,6 @@ GRPCXX_SRCS = [
     "src/cpp/server/create_default_thread_pool.cc",
     "src/cpp/server/dynamic_thread_pool.cc",
     "src/cpp/server/health/default_health_check_service.cc",
-    "src/cpp/server/health/health.pb.c",
     "src/cpp/server/health/health_check_service.cc",
     "src/cpp/server/health/health_check_service_server_builder_option.cc",
     "src/cpp/server/server_builder.cc",
@@ -151,7 +150,6 @@ GRPCXX_HDRS = [
     "src/cpp/common/channel_filter.h",
     "src/cpp/server/dynamic_thread_pool.h",
     "src/cpp/server/health/default_health_check_service.h",
-    "src/cpp/server/health/health.pb.h",
     "src/cpp/server/thread_pool_interface.h",
     "src/cpp/thread_manager/thread_manager.h",
 ]
@@ -1040,6 +1038,7 @@ grpc_cc_library(
         "src/core/ext/filters/client_channel/client_channel_factory.cc",
         "src/core/ext/filters/client_channel/client_channel_plugin.cc",
         "src/core/ext/filters/client_channel/connector.cc",
+        "src/core/ext/filters/client_channel/health/health_check_client.cc",
         "src/core/ext/filters/client_channel/http_connect_handshaker.cc",
         "src/core/ext/filters/client_channel/http_proxy.cc",
         "src/core/ext/filters/client_channel/lb_policy.cc",
@@ -1062,6 +1061,7 @@ grpc_cc_library(
         "src/core/ext/filters/client_channel/client_channel_channelz.h",
         "src/core/ext/filters/client_channel/client_channel_factory.h",
         "src/core/ext/filters/client_channel/connector.h",
+        "src/core/ext/filters/client_channel/health/health_check_client.h",
         "src/core/ext/filters/client_channel/http_connect_handshaker.h",
         "src/core/ext/filters/client_channel/http_proxy.h",
         "src/core/ext/filters/client_channel/lb_policy.h",
@@ -1089,6 +1089,7 @@ grpc_cc_library(
         "orphanable",
         "ref_counted",
         "ref_counted_ptr",
+        "health_proto",
     ],
 )
 
@@ -1200,6 +1201,20 @@ grpc_cc_library(
     ],
 )
 
+grpc_cc_library(
+    name = "health_proto",
+    srcs = [
+        "src/core/ext/filters/client_channel/health/health.pb.c",
+    ],
+    hdrs = [
+        "src/core/ext/filters/client_channel/health/health.pb.h",
+    ],
+    external_deps = [
+        "nanopb",
+    ],
+    language = "c++",
+)
+
 grpc_cc_library(
     name = "grpclb_proto",
     srcs = [
@@ -1566,11 +1581,14 @@ grpc_cc_library(
         "src/core/lib/security/credentials/oauth2/oauth2_credentials.cc",
         "src/core/lib/security/credentials/plugin/plugin_credentials.cc",
         "src/core/lib/security/credentials/ssl/ssl_credentials.cc",
-        "src/core/lib/security/security_connector/alts_security_connector.cc",
+        "src/core/lib/security/security_connector/alts/alts_security_connector.cc",
+        "src/core/lib/security/security_connector/fake/fake_security_connector.cc",
         "src/core/lib/security/security_connector/load_system_roots_fallback.cc",
         "src/core/lib/security/security_connector/load_system_roots_linux.cc",
-        "src/core/lib/security/security_connector/local_security_connector.cc",
+        "src/core/lib/security/security_connector/local/local_security_connector.cc",
         "src/core/lib/security/security_connector/security_connector.cc",
+        "src/core/lib/security/security_connector/ssl_utils.cc",
+        "src/core/lib/security/security_connector/ssl/ssl_security_connector.cc",
         "src/core/lib/security/transport/client_auth_filter.cc",
         "src/core/lib/security/transport/secure_endpoint.cc",
         "src/core/lib/security/transport/security_handshaker.cc",
@@ -1597,11 +1615,14 @@ grpc_cc_library(
         "src/core/lib/security/credentials/oauth2/oauth2_credentials.h",
         "src/core/lib/security/credentials/plugin/plugin_credentials.h",
         "src/core/lib/security/credentials/ssl/ssl_credentials.h",
-        "src/core/lib/security/security_connector/alts_security_connector.h",
+        "src/core/lib/security/security_connector/alts/alts_security_connector.h",
+        "src/core/lib/security/security_connector/fake/fake_security_connector.h",
         "src/core/lib/security/security_connector/load_system_roots.h",
         "src/core/lib/security/security_connector/load_system_roots_linux.h",
-        "src/core/lib/security/security_connector/local_security_connector.h",
+        "src/core/lib/security/security_connector/local/local_security_connector.h",
         "src/core/lib/security/security_connector/security_connector.h",
+        "src/core/lib/security/security_connector/ssl_utils.h",
+        "src/core/lib/security/security_connector/ssl/ssl_security_connector.h",
         "src/core/lib/security/transport/auth_filters.h",
         "src/core/lib/security/transport/secure_endpoint.h",
         "src/core/lib/security/transport/security_handshaker.h",
@@ -1987,6 +2008,7 @@ grpc_cc_library(
     deps = [
         "grpc",
         "grpc++_codegen_base",
+        "health_proto",
     ],
 )
 
@@ -1999,6 +2021,7 @@ grpc_cc_library(
     deps = [
         "grpc++_codegen_base",
         "grpc_unsecure",
+        "health_proto",
     ],
 )
 
@@ -2205,7 +2228,6 @@ grpc_cc_library(
 grpc_cc_library(
     name = "grpc_opencensus_plugin",
     srcs = [
-        "src/core/ext/filters/census/grpc_context.cc",
         "src/cpp/ext/filters/census/channel_filter.cc",
         "src/cpp/ext/filters/census/client_filter.cc",
         "src/cpp/ext/filters/census/context.cc",

CMakeLists.txt

@@ -488,7 +488,6 @@ add_dependencies(buildtests_c h2_sockpair_1byte_nosec_test)
 if(_gRPC_PLATFORM_LINUX OR _gRPC_PLATFORM_MAC OR _gRPC_PLATFORM_POSIX)
 add_dependencies(buildtests_c h2_uds_nosec_test)
 endif()
-add_dependencies(buildtests_c inproc_nosec_test)
 add_dependencies(buildtests_c alts_credentials_fuzzer_one_entry)
 add_dependencies(buildtests_c api_fuzzer_one_entry)
 add_dependencies(buildtests_c client_fuzzer_one_entry)
@@ -1171,11 +1170,14 @@ add_library(grpc
   src/core/lib/security/credentials/oauth2/oauth2_credentials.cc
   src/core/lib/security/credentials/plugin/plugin_credentials.cc
   src/core/lib/security/credentials/ssl/ssl_credentials.cc
-  src/core/lib/security/security_connector/alts_security_connector.cc
+  src/core/lib/security/security_connector/alts/alts_security_connector.cc
+  src/core/lib/security/security_connector/fake/fake_security_connector.cc
   src/core/lib/security/security_connector/load_system_roots_fallback.cc
   src/core/lib/security/security_connector/load_system_roots_linux.cc
-  src/core/lib/security/security_connector/local_security_connector.cc
+  src/core/lib/security/security_connector/local/local_security_connector.cc
   src/core/lib/security/security_connector/security_connector.cc
+  src/core/lib/security/security_connector/ssl/ssl_security_connector.cc
+  src/core/lib/security/security_connector/ssl_utils.cc
   src/core/lib/security/transport/client_auth_filter.cc
   src/core/lib/security/transport/secure_endpoint.cc
   src/core/lib/security/transport/security_handshaker.cc
@@ -1230,6 +1232,7 @@ add_library(grpc
   src/core/ext/filters/client_channel/client_channel_factory.cc
   src/core/ext/filters/client_channel/client_channel_plugin.cc
   src/core/ext/filters/client_channel/connector.cc
+  src/core/ext/filters/client_channel/health/health_check_client.cc
   src/core/ext/filters/client_channel/http_connect_handshaker.cc
   src/core/ext/filters/client_channel/http_proxy.cc
   src/core/ext/filters/client_channel/lb_policy.cc
@@ -1246,6 +1249,7 @@ add_library(grpc
   src/core/ext/filters/client_channel/subchannel_index.cc
   src/core/ext/filters/client_channel/uri_parser.cc
   src/core/ext/filters/deadline/deadline_filter.cc
+  src/core/ext/filters/client_channel/health/health.pb.c
   src/core/tsi/alts_transport_security.cc
   src/core/tsi/fake_transport_security.cc
   src/core/tsi/local_transport_security.cc
@@ -1580,6 +1584,7 @@ add_library(grpc_cronet
   src/core/ext/filters/client_channel/client_channel_factory.cc
   src/core/ext/filters/client_channel/client_channel_plugin.cc
   src/core/ext/filters/client_channel/connector.cc
+  src/core/ext/filters/client_channel/health/health_check_client.cc
   src/core/ext/filters/client_channel/http_connect_handshaker.cc
   src/core/ext/filters/client_channel/http_proxy.cc
   src/core/ext/filters/client_channel/lb_policy.cc
@@ -1596,6 +1601,10 @@ add_library(grpc_cronet
   src/core/ext/filters/client_channel/subchannel_index.cc
   src/core/ext/filters/client_channel/uri_parser.cc
   src/core/ext/filters/deadline/deadline_filter.cc
+  src/core/ext/filters/client_channel/health/health.pb.c
+  third_party/nanopb/pb_common.c
+  third_party/nanopb/pb_decode.c
+  third_party/nanopb/pb_encode.c
   src/core/lib/http/httpcli_security_connector.cc
   src/core/lib/security/context/security_context.cc
   src/core/lib/security/credentials/alts/alts_credentials.cc
@@ -1613,11 +1622,14 @@ add_library(grpc_cronet
   src/core/lib/security/credentials/oauth2/oauth2_credentials.cc
   src/core/lib/security/credentials/plugin/plugin_credentials.cc
   src/core/lib/security/credentials/ssl/ssl_credentials.cc
-  src/core/lib/security/security_connector/alts_security_connector.cc
+  src/core/lib/security/security_connector/alts/alts_security_connector.cc
+  src/core/lib/security/security_connector/fake/fake_security_connector.cc
   src/core/lib/security/security_connector/load_system_roots_fallback.cc
   src/core/lib/security/security_connector/load_system_roots_linux.cc
-  src/core/lib/security/security_connector/local_security_connector.cc
+  src/core/lib/security/security_connector/local/local_security_connector.cc
   src/core/lib/security/security_connector/security_connector.cc
+  src/core/lib/security/security_connector/ssl/ssl_security_connector.cc
+  src/core/lib/security/security_connector/ssl_utils.cc
   src/core/lib/security/transport/client_auth_filter.cc
   src/core/lib/security/transport/secure_endpoint.cc
   src/core/lib/security/transport/security_handshaker.cc
@@ -1657,9 +1669,6 @@ add_library(grpc_cronet
   src/core/tsi/alts/handshaker/altscontext.pb.c
   src/core/tsi/alts/handshaker/handshaker.pb.c
   src/core/tsi/alts/handshaker/transport_security_common.pb.c
-  third_party/nanopb/pb_common.c
-  third_party/nanopb/pb_decode.c
-  third_party/nanopb/pb_encode.c
   src/core/tsi/transport_security.cc
   src/core/ext/transport/chttp2/client/insecure/channel_create.cc
   src/core/ext/transport/chttp2/client/insecure/channel_create_posix.cc
@@ -1947,6 +1956,7 @@ add_library(grpc_test_util
   src/core/ext/filters/client_channel/client_channel_factory.cc
   src/core/ext/filters/client_channel/client_channel_plugin.cc
   src/core/ext/filters/client_channel/connector.cc
+  src/core/ext/filters/client_channel/health/health_check_client.cc
   src/core/ext/filters/client_channel/http_connect_handshaker.cc
   src/core/ext/filters/client_channel/http_proxy.cc
   src/core/ext/filters/client_channel/lb_policy.cc
@@ -1963,6 +1973,10 @@ add_library(grpc_test_util
   src/core/ext/filters/client_channel/subchannel_index.cc
   src/core/ext/filters/client_channel/uri_parser.cc
   src/core/ext/filters/deadline/deadline_filter.cc
+  src/core/ext/filters/client_channel/health/health.pb.c
+  third_party/nanopb/pb_common.c
+  third_party/nanopb/pb_decode.c
+  third_party/nanopb/pb_encode.c
   src/core/ext/transport/chttp2/transport/bin_decoder.cc
   src/core/ext/transport/chttp2/transport/bin_encoder.cc
   src/core/ext/transport/chttp2/transport/chttp2_plugin.cc
@@ -2261,6 +2275,7 @@ add_library(grpc_test_util_unsecure
   src/core/ext/filters/client_channel/client_channel_factory.cc
   src/core/ext/filters/client_channel/client_channel_plugin.cc
   src/core/ext/filters/client_channel/connector.cc
+  src/core/ext/filters/client_channel/health/health_check_client.cc
   src/core/ext/filters/client_channel/http_connect_handshaker.cc
   src/core/ext/filters/client_channel/http_proxy.cc
   src/core/ext/filters/client_channel/lb_policy.cc
@@ -2277,6 +2292,10 @@ add_library(grpc_test_util_unsecure
   src/core/ext/filters/client_channel/subchannel_index.cc
   src/core/ext/filters/client_channel/uri_parser.cc
   src/core/ext/filters/deadline/deadline_filter.cc
+  src/core/ext/filters/client_channel/health/health.pb.c
+  third_party/nanopb/pb_common.c
+  third_party/nanopb/pb_decode.c
+  third_party/nanopb/pb_encode.c
   src/core/ext/transport/chttp2/transport/bin_decoder.cc
   src/core/ext/transport/chttp2/transport/bin_encoder.cc
   src/core/ext/transport/chttp2/transport/chttp2_plugin.cc
@@ -2588,6 +2607,7 @@ add_library(grpc_unsecure
   src/core/ext/filters/client_channel/client_channel_factory.cc
   src/core/ext/filters/client_channel/client_channel_plugin.cc
   src/core/ext/filters/client_channel/connector.cc
+  src/core/ext/filters/client_channel/health/health_check_client.cc
   src/core/ext/filters/client_channel/http_connect_handshaker.cc
   src/core/ext/filters/client_channel/http_proxy.cc
   src/core/ext/filters/client_channel/lb_policy.cc
@@ -2604,6 +2624,10 @@ add_library(grpc_unsecure
   src/core/ext/filters/client_channel/subchannel_index.cc
   src/core/ext/filters/client_channel/uri_parser.cc
   src/core/ext/filters/deadline/deadline_filter.cc
+  src/core/ext/filters/client_channel/health/health.pb.c
+  third_party/nanopb/pb_common.c
+  third_party/nanopb/pb_decode.c
+  third_party/nanopb/pb_encode.c
   src/core/ext/transport/inproc/inproc_plugin.cc
   src/core/ext/transport/inproc/inproc_transport.cc
   src/core/ext/filters/client_channel/resolver/dns/c_ares/dns_resolver_ares.cc
@@ -2622,9 +2646,6 @@ add_library(grpc_unsecure
   src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_channel.cc
   src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_client_stats.cc
   src/core/ext/filters/client_channel/lb_policy/grpclb/load_balancer_api.cc
-  third_party/nanopb/pb_common.c
-  third_party/nanopb/pb_decode.c
-  third_party/nanopb/pb_encode.c
   src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/google/protobuf/duration.pb.c
   src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/google/protobuf/timestamp.pb.c
   src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/load_balancer.pb.c
@@ -2858,7 +2879,6 @@ add_library(grpc++
   src/cpp/server/create_default_thread_pool.cc
   src/cpp/server/dynamic_thread_pool.cc
   src/cpp/server/health/default_health_check_service.cc
-  src/cpp/server/health/health.pb.c
   src/cpp/server/health/health_check_service.cc
   src/cpp/server/health/health_check_service_server_builder_option.cc
   src/cpp/server/server_builder.cc
@@ -2871,6 +2891,10 @@ add_library(grpc++
   src/cpp/util/status.cc
   src/cpp/util/string_ref.cc
   src/cpp/util/time_cc.cc
+  src/core/ext/filters/client_channel/health/health.pb.c
+  third_party/nanopb/pb_common.c
+  third_party/nanopb/pb_decode.c
+  third_party/nanopb/pb_encode.c
   src/cpp/codegen/call_wrapper.cc
   src/cpp/codegen/codegen_init.cc
 )
@@ -3223,7 +3247,6 @@ add_library(grpc++_cronet
   src/cpp/server/create_default_thread_pool.cc
   src/cpp/server/dynamic_thread_pool.cc
   src/cpp/server/health/default_health_check_service.cc
-  src/cpp/server/health/health.pb.c
   src/cpp/server/health/health_check_service.cc
   src/cpp/server/health/health_check_service_server_builder_option.cc
   src/cpp/server/server_builder.cc
@@ -3236,6 +3259,10 @@ add_library(grpc++_cronet
   src/cpp/util/status.cc
   src/cpp/util/string_ref.cc
   src/cpp/util/time_cc.cc
+  src/core/ext/filters/client_channel/health/health.pb.c
+  third_party/nanopb/pb_common.c
+  third_party/nanopb/pb_decode.c
+  third_party/nanopb/pb_encode.c
   src/cpp/codegen/call_wrapper.cc
   src/cpp/codegen/codegen_init.cc
   src/core/ext/transport/chttp2/client/insecure/channel_create.cc
@@ -3427,6 +3454,7 @@ add_library(grpc++_cronet
   src/core/ext/filters/client_channel/client_channel_factory.cc
   src/core/ext/filters/client_channel/client_channel_plugin.cc
   src/core/ext/filters/client_channel/connector.cc
+  src/core/ext/filters/client_channel/health/health_check_client.cc
   src/core/ext/filters/client_channel/http_connect_handshaker.cc
   src/core/ext/filters/client_channel/http_proxy.cc
   src/core/ext/filters/client_channel/lb_policy.cc
@@ -4358,7 +4386,6 @@ add_library(grpc++_unsecure
   src/cpp/server/create_default_thread_pool.cc
   src/cpp/server/dynamic_thread_pool.cc
   src/cpp/server/health/default_health_check_service.cc
-  src/cpp/server/health/health.pb.c
   src/cpp/server/health/health_check_service.cc
   src/cpp/server/health/health_check_service_server_builder_option.cc
   src/cpp/server/server_builder.cc
@@ -4371,6 +4398,10 @@ add_library(grpc++_unsecure
   src/cpp/util/status.cc
   src/cpp/util/string_ref.cc
   src/cpp/util/time_cc.cc
+  src/core/ext/filters/client_channel/health/health.pb.c
+  third_party/nanopb/pb_common.c
+  third_party/nanopb/pb_decode.c
+  third_party/nanopb/pb_encode.c
   src/cpp/codegen/call_wrapper.cc
   src/cpp/codegen/codegen_init.cc
 )
@@ -17661,42 +17692,6 @@ endif()
 endif (gRPC_BUILD_TESTS)
 if (gRPC_BUILD_TESTS)
 
-add_executable(inproc_nosec_test
-  test/core/end2end/fixtures/inproc.cc
-)
-
-
-target_include_directories(inproc_nosec_test
-  PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}
-  PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include
-  PRIVATE ${_gRPC_SSL_INCLUDE_DIR}
-  PRIVATE ${_gRPC_PROTOBUF_INCLUDE_DIR}
-  PRIVATE ${_gRPC_ZLIB_INCLUDE_DIR}
-  PRIVATE ${_gRPC_BENCHMARK_INCLUDE_DIR}
-  PRIVATE ${_gRPC_CARES_INCLUDE_DIR}
-  PRIVATE ${_gRPC_GFLAGS_INCLUDE_DIR}
-  PRIVATE ${_gRPC_ADDRESS_SORTING_INCLUDE_DIR}
-  PRIVATE ${_gRPC_NANOPB_INCLUDE_DIR}
-)
-
-target_link_libraries(inproc_nosec_test
-  ${_gRPC_ALLTARGETS_LIBRARIES}
-  end2end_nosec_tests
-  grpc_test_util_unsecure
-  grpc_unsecure
-  gpr_test_util
-  gpr
-)
-
-  # avoid dependency on libstdc++
-  if (_gRPC_CORE_NOSTDCXX_FLAGS)
-    set_target_properties(inproc_nosec_test PROPERTIES LINKER_LANGUAGE C)
-    target_compile_options(inproc_nosec_test PRIVATE $<$<COMPILE_LANGUAGE:CXX>:${_gRPC_CORE_NOSTDCXX_FLAGS}>)
-  endif()
-
-endif (gRPC_BUILD_TESTS)
-if (gRPC_BUILD_TESTS)
-
 add_executable(resolver_component_test_unsecure
   test/cpp/naming/resolver_component_test.cc
   third_party/googletest/googletest/src/gtest-all.cc

Makefile

@@ -1344,7 +1344,6 @@ h2_sockpair_nosec_test: $(BINDIR)/$(CONFIG)/h2_sockpair_nosec_test
 h2_sockpair+trace_nosec_test: $(BINDIR)/$(CONFIG)/h2_sockpair+trace_nosec_test
 h2_sockpair_1byte_nosec_test: $(BINDIR)/$(CONFIG)/h2_sockpair_1byte_nosec_test
 h2_uds_nosec_test: $(BINDIR)/$(CONFIG)/h2_uds_nosec_test
-inproc_nosec_test: $(BINDIR)/$(CONFIG)/inproc_nosec_test
 resolver_component_test_unsecure: $(BINDIR)/$(CONFIG)/resolver_component_test_unsecure
 resolver_component_test: $(BINDIR)/$(CONFIG)/resolver_component_test
 resolver_component_tests_runner_invoker_unsecure: $(BINDIR)/$(CONFIG)/resolver_component_tests_runner_invoker_unsecure
@@ -1603,7 +1602,6 @@ buildtests_c: privatelibs_c \
   $(BINDIR)/$(CONFIG)/h2_sockpair+trace_nosec_test \
   $(BINDIR)/$(CONFIG)/h2_sockpair_1byte_nosec_test \
   $(BINDIR)/$(CONFIG)/h2_uds_nosec_test \
-  $(BINDIR)/$(CONFIG)/inproc_nosec_test \
   $(BINDIR)/$(CONFIG)/alts_credentials_fuzzer_one_entry \
   $(BINDIR)/$(CONFIG)/api_fuzzer_one_entry \
   $(BINDIR)/$(CONFIG)/client_fuzzer_one_entry \
@@ -3643,11 +3641,14 @@ LIBGRPC_SRC = \
     src/core/lib/security/credentials/oauth2/oauth2_credentials.cc \
     src/core/lib/security/credentials/plugin/plugin_credentials.cc \
     src/core/lib/security/credentials/ssl/ssl_credentials.cc \
-    src/core/lib/security/security_connector/alts_security_connector.cc \
+    src/core/lib/security/security_connector/alts/alts_security_connector.cc \
+    src/core/lib/security/security_connector/fake/fake_security_connector.cc \
     src/core/lib/security/security_connector/load_system_roots_fallback.cc \
     src/core/lib/security/security_connector/load_system_roots_linux.cc \
-    src/core/lib/security/security_connector/local_security_connector.cc \
+    src/core/lib/security/security_connector/local/local_security_connector.cc \
     src/core/lib/security/security_connector/security_connector.cc \
+    src/core/lib/security/security_connector/ssl/ssl_security_connector.cc \
+    src/core/lib/security/security_connector/ssl_utils.cc \
     src/core/lib/security/transport/client_auth_filter.cc \
     src/core/lib/security/transport/secure_endpoint.cc \
     src/core/lib/security/transport/security_handshaker.cc \
@@ -3702,6 +3703,7 @@ LIBGRPC_SRC = \
     src/core/ext/filters/client_channel/client_channel_factory.cc \
     src/core/ext/filters/client_channel/client_channel_plugin.cc \
     src/core/ext/filters/client_channel/connector.cc \
+    src/core/ext/filters/client_channel/health/health_check_client.cc \
     src/core/ext/filters/client_channel/http_connect_handshaker.cc \
     src/core/ext/filters/client_channel/http_proxy.cc \
     src/core/ext/filters/client_channel/lb_policy.cc \
@@ -3718,6 +3720,7 @@ LIBGRPC_SRC = \
     src/core/ext/filters/client_channel/subchannel_index.cc \
     src/core/ext/filters/client_channel/uri_parser.cc \
     src/core/ext/filters/deadline/deadline_filter.cc \
+    src/core/ext/filters/client_channel/health/health.pb.c \
     src/core/tsi/alts_transport_security.cc \
     src/core/tsi/fake_transport_security.cc \
     src/core/tsi/local_transport_security.cc \
@@ -4046,6 +4049,7 @@ LIBGRPC_CRONET_SRC = \
     src/core/ext/filters/client_channel/client_channel_factory.cc \
     src/core/ext/filters/client_channel/client_channel_plugin.cc \
     src/core/ext/filters/client_channel/connector.cc \
+    src/core/ext/filters/client_channel/health/health_check_client.cc \
     src/core/ext/filters/client_channel/http_connect_handshaker.cc \
     src/core/ext/filters/client_channel/http_proxy.cc \
     src/core/ext/filters/client_channel/lb_policy.cc \
@@ -4062,6 +4066,10 @@ LIBGRPC_CRONET_SRC = \
     src/core/ext/filters/client_channel/subchannel_index.cc \
     src/core/ext/filters/client_channel/uri_parser.cc \
     src/core/ext/filters/deadline/deadline_filter.cc \
+    src/core/ext/filters/client_channel/health/health.pb.c \
+    third_party/nanopb/pb_common.c \
+    third_party/nanopb/pb_decode.c \
+    third_party/nanopb/pb_encode.c \
     src/core/lib/http/httpcli_security_connector.cc \
     src/core/lib/security/context/security_context.cc \
     src/core/lib/security/credentials/alts/alts_credentials.cc \
@@ -4079,11 +4087,14 @@ LIBGRPC_CRONET_SRC = \
     src/core/lib/security/credentials/oauth2/oauth2_credentials.cc \
     src/core/lib/security/credentials/plugin/plugin_credentials.cc \
     src/core/lib/security/credentials/ssl/ssl_credentials.cc \
-    src/core/lib/security/security_connector/alts_security_connector.cc \
+    src/core/lib/security/security_connector/alts/alts_security_connector.cc \
+    src/core/lib/security/security_connector/fake/fake_security_connector.cc \
     src/core/lib/security/security_connector/load_system_roots_fallback.cc \
     src/core/lib/security/security_connector/load_system_roots_linux.cc \
-    src/core/lib/security/security_connector/local_security_connector.cc \
+    src/core/lib/security/security_connector/local/local_security_connector.cc \
     src/core/lib/security/security_connector/security_connector.cc \
+    src/core/lib/security/security_connector/ssl/ssl_security_connector.cc \
+    src/core/lib/security/security_connector/ssl_utils.cc \
     src/core/lib/security/transport/client_auth_filter.cc \
     src/core/lib/security/transport/secure_endpoint.cc \
     src/core/lib/security/transport/security_handshaker.cc \
@@ -4123,9 +4134,6 @@ LIBGRPC_CRONET_SRC = \
     src/core/tsi/alts/handshaker/altscontext.pb.c \
     src/core/tsi/alts/handshaker/handshaker.pb.c \
     src/core/tsi/alts/handshaker/transport_security_common.pb.c \
-    third_party/nanopb/pb_common.c \
-    third_party/nanopb/pb_decode.c \
-    third_party/nanopb/pb_encode.c \
     src/core/tsi/transport_security.cc \
     src/core/ext/transport/chttp2/client/insecure/channel_create.cc \
     src/core/ext/transport/chttp2/client/insecure/channel_create_posix.cc \
@@ -4406,6 +4414,7 @@ LIBGRPC_TEST_UTIL_SRC = \
     src/core/ext/filters/client_channel/client_channel_factory.cc \
     src/core/ext/filters/client_channel/client_channel_plugin.cc \
     src/core/ext/filters/client_channel/connector.cc \
+    src/core/ext/filters/client_channel/health/health_check_client.cc \
     src/core/ext/filters/client_channel/http_connect_handshaker.cc \
     src/core/ext/filters/client_channel/http_proxy.cc \
     src/core/ext/filters/client_channel/lb_policy.cc \
@@ -4422,6 +4431,10 @@ LIBGRPC_TEST_UTIL_SRC = \
     src/core/ext/filters/client_channel/subchannel_index.cc \
     src/core/ext/filters/client_channel/uri_parser.cc \
     src/core/ext/filters/deadline/deadline_filter.cc \
+    src/core/ext/filters/client_channel/health/health.pb.c \
+    third_party/nanopb/pb_common.c \
+    third_party/nanopb/pb_decode.c \
+    third_party/nanopb/pb_encode.c \
     src/core/ext/transport/chttp2/transport/bin_decoder.cc \
     src/core/ext/transport/chttp2/transport/bin_encoder.cc \
     src/core/ext/transport/chttp2/transport/chttp2_plugin.cc \
@@ -4706,6 +4719,7 @@ LIBGRPC_TEST_UTIL_UNSECURE_SRC = \
     src/core/ext/filters/client_channel/client_channel_factory.cc \
     src/core/ext/filters/client_channel/client_channel_plugin.cc \
     src/core/ext/filters/client_channel/connector.cc \
+    src/core/ext/filters/client_channel/health/health_check_client.cc \
     src/core/ext/filters/client_channel/http_connect_handshaker.cc \
     src/core/ext/filters/client_channel/http_proxy.cc \
     src/core/ext/filters/client_channel/lb_policy.cc \
@@ -4722,6 +4736,10 @@ LIBGRPC_TEST_UTIL_UNSECURE_SRC = \
     src/core/ext/filters/client_channel/subchannel_index.cc \
     src/core/ext/filters/client_channel/uri_parser.cc \
     src/core/ext/filters/deadline/deadline_filter.cc \
+    src/core/ext/filters/client_channel/health/health.pb.c \
+    third_party/nanopb/pb_common.c \
+    third_party/nanopb/pb_decode.c \
+    third_party/nanopb/pb_encode.c \
     src/core/ext/transport/chttp2/transport/bin_decoder.cc \
     src/core/ext/transport/chttp2/transport/bin_encoder.cc \
     src/core/ext/transport/chttp2/transport/chttp2_plugin.cc \
@@ -5006,6 +5024,7 @@ LIBGRPC_UNSECURE_SRC = \
     src/core/ext/filters/client_channel/client_channel_factory.cc \
     src/core/ext/filters/client_channel/client_channel_plugin.cc \
     src/core/ext/filters/client_channel/connector.cc \
+    src/core/ext/filters/client_channel/health/health_check_client.cc \
     src/core/ext/filters/client_channel/http_connect_handshaker.cc \
     src/core/ext/filters/client_channel/http_proxy.cc \
     src/core/ext/filters/client_channel/lb_policy.cc \
@@ -5022,6 +5041,10 @@ LIBGRPC_UNSECURE_SRC = \
     src/core/ext/filters/client_channel/subchannel_index.cc \
     src/core/ext/filters/client_channel/uri_parser.cc \
     src/core/ext/filters/deadline/deadline_filter.cc \
+    src/core/ext/filters/client_channel/health/health.pb.c \
+    third_party/nanopb/pb_common.c \
+    third_party/nanopb/pb_decode.c \
+    third_party/nanopb/pb_encode.c \
     src/core/ext/transport/inproc/inproc_plugin.cc \
     src/core/ext/transport/inproc/inproc_transport.cc \
     src/core/ext/filters/client_channel/resolver/dns/c_ares/dns_resolver_ares.cc \
@@ -5040,9 +5063,6 @@ LIBGRPC_UNSECURE_SRC = \
     src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_channel.cc \
     src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_client_stats.cc \
     src/core/ext/filters/client_channel/lb_policy/grpclb/load_balancer_api.cc \
-    third_party/nanopb/pb_common.c \
-    third_party/nanopb/pb_decode.c \
-    third_party/nanopb/pb_encode.c \
     src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/google/protobuf/duration.pb.c \
     src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/google/protobuf/timestamp.pb.c \
     src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/load_balancer.pb.c \
@@ -5241,7 +5261,6 @@ LIBGRPC++_SRC = \
     src/cpp/server/create_default_thread_pool.cc \
     src/cpp/server/dynamic_thread_pool.cc \
     src/cpp/server/health/default_health_check_service.cc \
-    src/cpp/server/health/health.pb.c \
     src/cpp/server/health/health_check_service.cc \
     src/cpp/server/health/health_check_service_server_builder_option.cc \
     src/cpp/server/server_builder.cc \
@@ -5254,6 +5273,10 @@ LIBGRPC++_SRC = \
     src/cpp/util/status.cc \
     src/cpp/util/string_ref.cc \
     src/cpp/util/time_cc.cc \
+    src/core/ext/filters/client_channel/health/health.pb.c \
+    third_party/nanopb/pb_common.c \
+    third_party/nanopb/pb_decode.c \
+    third_party/nanopb/pb_encode.c \
     src/cpp/codegen/call_wrapper.cc \
     src/cpp/codegen/codegen_init.cc \
 
@@ -5616,7 +5639,6 @@ LIBGRPC++_CRONET_SRC = \
     src/cpp/server/create_default_thread_pool.cc \
     src/cpp/server/dynamic_thread_pool.cc \
     src/cpp/server/health/default_health_check_service.cc \
-    src/cpp/server/health/health.pb.c \
     src/cpp/server/health/health_check_service.cc \
     src/cpp/server/health/health_check_service_server_builder_option.cc \
     src/cpp/server/server_builder.cc \
@@ -5629,6 +5651,10 @@ LIBGRPC++_CRONET_SRC = \
     src/cpp/util/status.cc \
     src/cpp/util/string_ref.cc \
     src/cpp/util/time_cc.cc \
+    src/core/ext/filters/client_channel/health/health.pb.c \
+    third_party/nanopb/pb_common.c \
+    third_party/nanopb/pb_decode.c \
+    third_party/nanopb/pb_encode.c \
     src/cpp/codegen/call_wrapper.cc \
     src/cpp/codegen/codegen_init.cc \
     src/core/ext/transport/chttp2/client/insecure/channel_create.cc \
@@ -5820,6 +5846,7 @@ LIBGRPC++_CRONET_SRC = \
     src/core/ext/filters/client_channel/client_channel_factory.cc \
     src/core/ext/filters/client_channel/client_channel_plugin.cc \
     src/core/ext/filters/client_channel/connector.cc \
+    src/core/ext/filters/client_channel/health/health_check_client.cc \
     src/core/ext/filters/client_channel/http_connect_handshaker.cc \
     src/core/ext/filters/client_channel/http_proxy.cc \
     src/core/ext/filters/client_channel/lb_policy.cc \
@@ -6718,7 +6745,6 @@ LIBGRPC++_UNSECURE_SRC = \
     src/cpp/server/create_default_thread_pool.cc \
     src/cpp/server/dynamic_thread_pool.cc \
     src/cpp/server/health/default_health_check_service.cc \
-    src/cpp/server/health/health.pb.c \
     src/cpp/server/health/health_check_service.cc \
     src/cpp/server/health/health_check_service_server_builder_option.cc \
     src/cpp/server/server_builder.cc \
@@ -6731,6 +6757,10 @@ LIBGRPC++_UNSECURE_SRC = \
     src/cpp/util/status.cc \
     src/cpp/util/string_ref.cc \
     src/cpp/util/time_cc.cc \
+    src/core/ext/filters/client_channel/health/health.pb.c \
+    third_party/nanopb/pb_common.c \
+    third_party/nanopb/pb_decode.c \
+    third_party/nanopb/pb_encode.c \
     src/cpp/codegen/call_wrapper.cc \
     src/cpp/codegen/codegen_init.cc \
 
@@ -24066,26 +24096,6 @@ ifneq ($(NO_DEPS),true)
 endif
 
 
-INPROC_NOSEC_TEST_SRC = \
-    test/core/end2end/fixtures/inproc.cc \
-
-INPROC_NOSEC_TEST_OBJS = $(addprefix $(OBJDIR)/$(CONFIG)/, $(addsuffix .o, $(basename $(INPROC_NOSEC_TEST_SRC))))
-
-
-$(BINDIR)/$(CONFIG)/inproc_nosec_test: $(INPROC_NOSEC_TEST_OBJS) $(LIBDIR)/$(CONFIG)/libend2end_nosec_tests.a $(LIBDIR)/$(CONFIG)/libgrpc_test_util_unsecure.a $(LIBDIR)/$(CONFIG)/libgrpc_unsecure.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a
-	$(E) "[LD]      Linking $@"
-	$(Q) mkdir -p `dirname $@`
-	$(Q) $(LD) $(LDFLAGS) $(INPROC_NOSEC_TEST_OBJS) $(LIBDIR)/$(CONFIG)/libend2end_nosec_tests.a $(LIBDIR)/$(CONFIG)/libgrpc_test_util_unsecure.a $(LIBDIR)/$(CONFIG)/libgrpc_unsecure.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a $(LDLIBS) -o $(BINDIR)/$(CONFIG)/inproc_nosec_test
-
-$(OBJDIR)/$(CONFIG)/test/core/end2end/fixtures/inproc.o:  $(LIBDIR)/$(CONFIG)/libend2end_nosec_tests.a $(LIBDIR)/$(CONFIG)/libgrpc_test_util_unsecure.a $(LIBDIR)/$(CONFIG)/libgrpc_unsecure.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a
-
-deps_inproc_nosec_test: $(INPROC_NOSEC_TEST_OBJS:.o=.dep)
-
-ifneq ($(NO_DEPS),true)
--include $(INPROC_NOSEC_TEST_OBJS:.o=.dep)
-endif
-
-
 RESOLVER_COMPONENT_TEST_UNSECURE_SRC = \
     test/cpp/naming/resolver_component_test.cc \
 
@@ -24916,11 +24926,14 @@ src/core/lib/security/credentials/local/local_credentials.cc: $(OPENSSL_DEP)
 src/core/lib/security/credentials/oauth2/oauth2_credentials.cc: $(OPENSSL_DEP)
 src/core/lib/security/credentials/plugin/plugin_credentials.cc: $(OPENSSL_DEP)
 src/core/lib/security/credentials/ssl/ssl_credentials.cc: $(OPENSSL_DEP)
-src/core/lib/security/security_connector/alts_security_connector.cc: $(OPENSSL_DEP)
+src/core/lib/security/security_connector/alts/alts_security_connector.cc: $(OPENSSL_DEP)
+src/core/lib/security/security_connector/fake/fake_security_connector.cc: $(OPENSSL_DEP)
 src/core/lib/security/security_connector/load_system_roots_fallback.cc: $(OPENSSL_DEP)
 src/core/lib/security/security_connector/load_system_roots_linux.cc: $(OPENSSL_DEP)
-src/core/lib/security/security_connector/local_security_connector.cc: $(OPENSSL_DEP)
+src/core/lib/security/security_connector/local/local_security_connector.cc: $(OPENSSL_DEP)
 src/core/lib/security/security_connector/security_connector.cc: $(OPENSSL_DEP)
+src/core/lib/security/security_connector/ssl/ssl_security_connector.cc: $(OPENSSL_DEP)
+src/core/lib/security/security_connector/ssl_utils.cc: $(OPENSSL_DEP)
 src/core/lib/security/transport/client_auth_filter.cc: $(OPENSSL_DEP)
 src/core/lib/security/transport/secure_endpoint.cc: $(OPENSSL_DEP)
 src/core/lib/security/transport/security_handshaker.cc: $(OPENSSL_DEP)

bazel/grpc_deps.bzl

@@ -169,12 +169,12 @@ def grpc_deps():
     if "com_github_bazelbuild_bazeltoolchains" not in native.existing_rules():
         native.http_archive(
             name = "com_github_bazelbuild_bazeltoolchains",
-            strip_prefix = "bazel-toolchains-cdea5b8675914d0a354d89f108de5d28e54e0edc",
+            strip_prefix = "bazel-toolchains-280edaa6f93623074513d2b426068de42e62ea4d",
             urls = [
-                "https://mirror.bazel.build/github.com/bazelbuild/bazel-toolchains/archive/cdea5b8675914d0a354d89f108de5d28e54e0edc.tar.gz",
-                "https://github.com/bazelbuild/bazel-toolchains/archive/cdea5b8675914d0a354d89f108de5d28e54e0edc.tar.gz",
+                "https://mirror.bazel.build/github.com/bazelbuild/bazel-toolchains/archive/280edaa6f93623074513d2b426068de42e62ea4d.tar.gz",
+                "https://github.com/bazelbuild/bazel-toolchains/archive/280edaa6f93623074513d2b426068de42e62ea4d.tar.gz",
             ],
-            sha256 = "cefb6ccf86ca592baaa029bcef04148593c0efe8f734542f10293ea58f170715",
+            sha256 = "50c9df51f80cdf9ff8f2bc27620c155526b9ba67be95e8a686f32ff8898a06e2",
         )
 
     if "io_opencensus_cpp" not in native.existing_rules():

build.yaml

@@ -572,6 +572,7 @@ filegroups:
   - src/core/ext/filters/client_channel/client_channel_channelz.h
   - src/core/ext/filters/client_channel/client_channel_factory.h
   - src/core/ext/filters/client_channel/connector.h
+  - src/core/ext/filters/client_channel/health/health_check_client.h
   - src/core/ext/filters/client_channel/http_connect_handshaker.h
   - src/core/ext/filters/client_channel/http_proxy.h
   - src/core/ext/filters/client_channel/lb_policy.h
@@ -596,6 +597,7 @@ filegroups:
   - src/core/ext/filters/client_channel/client_channel_factory.cc
   - src/core/ext/filters/client_channel/client_channel_plugin.cc
   - src/core/ext/filters/client_channel/connector.cc
+  - src/core/ext/filters/client_channel/health/health_check_client.cc
   - src/core/ext/filters/client_channel/http_connect_handshaker.cc
   - src/core/ext/filters/client_channel/http_proxy.cc
   - src/core/ext/filters/client_channel/lb_policy.cc
@@ -615,6 +617,7 @@ filegroups:
   uses:
   - grpc_base
   - grpc_deadline_filter
+  - health_proto
 - name: grpc_codegen
   public_headers:
   - include/grpc/impl/codegen/byte_buffer.h
@@ -824,11 +827,14 @@ filegroups:
   - src/core/lib/security/credentials/oauth2/oauth2_credentials.h
   - src/core/lib/security/credentials/plugin/plugin_credentials.h
   - src/core/lib/security/credentials/ssl/ssl_credentials.h
-  - src/core/lib/security/security_connector/alts_security_connector.h
+  - src/core/lib/security/security_connector/alts/alts_security_connector.h
+  - src/core/lib/security/security_connector/fake/fake_security_connector.h
   - src/core/lib/security/security_connector/load_system_roots.h
   - src/core/lib/security/security_connector/load_system_roots_linux.h
-  - src/core/lib/security/security_connector/local_security_connector.h
+  - src/core/lib/security/security_connector/local/local_security_connector.h
   - src/core/lib/security/security_connector/security_connector.h
+  - src/core/lib/security/security_connector/ssl/ssl_security_connector.h
+  - src/core/lib/security/security_connector/ssl_utils.h
   - src/core/lib/security/transport/auth_filters.h
   - src/core/lib/security/transport/secure_endpoint.h
   - src/core/lib/security/transport/security_handshaker.h
@@ -853,11 +859,14 @@ filegroups:
   - src/core/lib/security/credentials/oauth2/oauth2_credentials.cc
   - src/core/lib/security/credentials/plugin/plugin_credentials.cc
   - src/core/lib/security/credentials/ssl/ssl_credentials.cc
-  - src/core/lib/security/security_connector/alts_security_connector.cc
+  - src/core/lib/security/security_connector/alts/alts_security_connector.cc
+  - src/core/lib/security/security_connector/fake/fake_security_connector.cc
   - src/core/lib/security/security_connector/load_system_roots_fallback.cc
   - src/core/lib/security/security_connector/load_system_roots_linux.cc
-  - src/core/lib/security/security_connector/local_security_connector.cc
+  - src/core/lib/security/security_connector/local/local_security_connector.cc
   - src/core/lib/security/security_connector/security_connector.cc
+  - src/core/lib/security/security_connector/ssl/ssl_security_connector.cc
+  - src/core/lib/security/security_connector/ssl_utils.cc
   - src/core/lib/security/transport/client_auth_filter.cc
   - src/core/lib/security/transport/secure_endpoint.cc
   - src/core/lib/security/transport/security_handshaker.cc
@@ -1107,6 +1116,13 @@ filegroups:
   - src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/load_balancer.pb.c
   uses:
   - nanopb
+- name: health_proto
+  headers:
+  - src/core/ext/filters/client_channel/health/health.pb.h
+  src:
+  - src/core/ext/filters/client_channel/health/health.pb.c
+  uses:
+  - nanopb
 - name: nanopb
   src:
   - third_party/nanopb/pb_common.c
@@ -1358,7 +1374,6 @@ filegroups:
   - src/cpp/common/channel_filter.h
   - src/cpp/server/dynamic_thread_pool.h
   - src/cpp/server/health/default_health_check_service.h
-  - src/cpp/server/health/health.pb.h
   - src/cpp/server/thread_pool_interface.h
   - src/cpp/thread_manager/thread_manager.h
   src:
@@ -1382,7 +1397,6 @@ filegroups:
   - src/cpp/server/create_default_thread_pool.cc
   - src/cpp/server/dynamic_thread_pool.cc
   - src/cpp/server/health/default_health_check_service.cc
-  - src/cpp/server/health/health.pb.c
   - src/cpp/server/health/health_check_service.cc
   - src/cpp/server/health/health_check_service_server_builder_option.cc
   - src/cpp/server/server_builder.cc
@@ -1401,6 +1415,7 @@ filegroups:
   - grpc_transport_inproc_headers
   - grpc++_codegen_base
   - nanopb_headers
+  - health_proto
 - name: grpc++_config_proto
   language: c++
   public_headers:

config.m4

@@ -280,11 +280,14 @@ if test "$PHP_GRPC" != "no"; then
     src/core/lib/security/credentials/oauth2/oauth2_credentials.cc \
     src/core/lib/security/credentials/plugin/plugin_credentials.cc \
     src/core/lib/security/credentials/ssl/ssl_credentials.cc \
-    src/core/lib/security/security_connector/alts_security_connector.cc \
+    src/core/lib/security/security_connector/alts/alts_security_connector.cc \
+    src/core/lib/security/security_connector/fake/fake_security_connector.cc \
     src/core/lib/security/security_connector/load_system_roots_fallback.cc \
     src/core/lib/security/security_connector/load_system_roots_linux.cc \
-    src/core/lib/security/security_connector/local_security_connector.cc \
+    src/core/lib/security/security_connector/local/local_security_connector.cc \
     src/core/lib/security/security_connector/security_connector.cc \
+    src/core/lib/security/security_connector/ssl/ssl_security_connector.cc \
+    src/core/lib/security/security_connector/ssl_utils.cc \
     src/core/lib/security/transport/client_auth_filter.cc \
     src/core/lib/security/transport/secure_endpoint.cc \
     src/core/lib/security/transport/security_handshaker.cc \
@@ -339,6 +342,7 @@ if test "$PHP_GRPC" != "no"; then
     src/core/ext/filters/client_channel/client_channel_factory.cc \
     src/core/ext/filters/client_channel/client_channel_plugin.cc \
     src/core/ext/filters/client_channel/connector.cc \
+    src/core/ext/filters/client_channel/health/health_check_client.cc \
     src/core/ext/filters/client_channel/http_connect_handshaker.cc \
     src/core/ext/filters/client_channel/http_proxy.cc \
     src/core/ext/filters/client_channel/lb_policy.cc \
@@ -355,6 +359,7 @@ if test "$PHP_GRPC" != "no"; then
     src/core/ext/filters/client_channel/subchannel_index.cc \
     src/core/ext/filters/client_channel/uri_parser.cc \
     src/core/ext/filters/deadline/deadline_filter.cc \
+    src/core/ext/filters/client_channel/health/health.pb.c \
     src/core/tsi/alts_transport_security.cc \
     src/core/tsi/fake_transport_security.cc \
     src/core/tsi/local_transport_security.cc \
@@ -667,6 +672,7 @@ if test "$PHP_GRPC" != "no"; then
   PHP_ADD_BUILD_DIR($ext_builddir/src/boringssl)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/census)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/client_channel)
+  PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/client_channel/health)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/client_channel/lb_policy/grpclb)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/google/protobuf)
@@ -718,6 +724,10 @@ if test "$PHP_GRPC" != "no"; then
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/lib/security/credentials/plugin)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/lib/security/credentials/ssl)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/lib/security/security_connector)
+  PHP_ADD_BUILD_DIR($ext_builddir/src/core/lib/security/security_connector/alts)
+  PHP_ADD_BUILD_DIR($ext_builddir/src/core/lib/security/security_connector/fake)
+  PHP_ADD_BUILD_DIR($ext_builddir/src/core/lib/security/security_connector/local)
+  PHP_ADD_BUILD_DIR($ext_builddir/src/core/lib/security/security_connector/ssl)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/lib/security/transport)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/lib/security/util)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/lib/slice)

config.w32

@@ -255,11 +255,14 @@ if (PHP_GRPC != "no") {
     "src\\core\\lib\\security\\credentials\\oauth2\\oauth2_credentials.cc " +
     "src\\core\\lib\\security\\credentials\\plugin\\plugin_credentials.cc " +
     "src\\core\\lib\\security\\credentials\\ssl\\ssl_credentials.cc " +
-    "src\\core\\lib\\security\\security_connector\\alts_security_connector.cc " +
+    "src\\core\\lib\\security\\security_connector\\alts\\alts_security_connector.cc " +
+    "src\\core\\lib\\security\\security_connector\\fake\\fake_security_connector.cc " +
     "src\\core\\lib\\security\\security_connector\\load_system_roots_fallback.cc " +
     "src\\core\\lib\\security\\security_connector\\load_system_roots_linux.cc " +
-    "src\\core\\lib\\security\\security_connector\\local_security_connector.cc " +
+    "src\\core\\lib\\security\\security_connector\\local\\local_security_connector.cc " +
     "src\\core\\lib\\security\\security_connector\\security_connector.cc " +
+    "src\\core\\lib\\security\\security_connector\\ssl\\ssl_security_connector.cc " +
+    "src\\core\\lib\\security\\security_connector\\ssl_utils.cc " +
     "src\\core\\lib\\security\\transport\\client_auth_filter.cc " +
     "src\\core\\lib\\security\\transport\\secure_endpoint.cc " +
     "src\\core\\lib\\security\\transport\\security_handshaker.cc " +
@@ -314,6 +317,7 @@ if (PHP_GRPC != "no") {
     "src\\core\\ext\\filters\\client_channel\\client_channel_factory.cc " +
     "src\\core\\ext\\filters\\client_channel\\client_channel_plugin.cc " +
     "src\\core\\ext\\filters\\client_channel\\connector.cc " +
+    "src\\core\\ext\\filters\\client_channel\\health\\health_check_client.cc " +
     "src\\core\\ext\\filters\\client_channel\\http_connect_handshaker.cc " +
     "src\\core\\ext\\filters\\client_channel\\http_proxy.cc " +
     "src\\core\\ext\\filters\\client_channel\\lb_policy.cc " +
@@ -330,6 +334,7 @@ if (PHP_GRPC != "no") {
     "src\\core\\ext\\filters\\client_channel\\subchannel_index.cc " +
     "src\\core\\ext\\filters\\client_channel\\uri_parser.cc " +
     "src\\core\\ext\\filters\\deadline\\deadline_filter.cc " +
+    "src\\core\\ext\\filters\\client_channel\\health\\health.pb.c " +
     "src\\core\\tsi\\alts_transport_security.cc " +
     "src\\core\\tsi\\fake_transport_security.cc " +
     "src\\core\\tsi\\local_transport_security.cc " +
@@ -672,6 +677,7 @@ if (PHP_GRPC != "no") {
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\ext\\filters");
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\ext\\filters\\census");
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\ext\\filters\\client_channel");
+  FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\ext\\filters\\client_channel\\health");
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\ext\\filters\\client_channel\\lb_policy");
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\ext\\filters\\client_channel\\lb_policy\\grpclb");
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\ext\\filters\\client_channel\\lb_policy\\grpclb\\proto");
@@ -734,6 +740,10 @@ if (PHP_GRPC != "no") {
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\lib\\security\\credentials\\plugin");
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\lib\\security\\credentials\\ssl");
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\lib\\security\\security_connector");
+  FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\lib\\security\\security_connector\\alts");
+  FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\lib\\security\\security_connector\\fake");
+  FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\lib\\security\\security_connector\\local");
+  FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\lib\\security\\security_connector\\ssl");
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\lib\\security\\transport");
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\lib\\security\\util");
   FSO.CreateFolder(base_dir+"\\ext\\grpc\\src\\core\\lib\\slice");

doc/environment_variables.md

@@ -52,6 +52,7 @@ some configuration as environment variables that can be set.
     traces epoll-fd creation/close calls for epollex polling engine
   - glb - traces the grpclb load balancer
   - handshaker - traces handshaking state
+  - health_check_client - traces health checking client code
   - http - traces state in the http2 transport engine
   - http2_stream_state - traces all http2 stream state mutations.
   - http1 - traces HTTP/1.x operations performed by gRPC

examples/python/helloworld/greeter_client_with_options.py

@@ -0,0 +1,44 @@
+# Copyright 2018 gRPC authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Python implementation of the GRPC helloworld.Greeter client with channel options and call timeout parameters."""
+
+from __future__ import print_function
+
+import grpc
+
+import helloworld_pb2
+import helloworld_pb2_grpc
+
+
+def run():
+    # NOTE(gRPC Python Team): .close() is possible on a channel and should be
+    # used in circumstances in which the with statement does not fit the needs
+    # of the code.
+    #
+    # For more channel options, please see https://grpc.io/grpc/core/group__grpc__arg__keys.html
+    with grpc.insecure_channel(
+            target='localhost:50051',
+            options=[('grpc.lb_policy_name', 'pick_first'),
+                     ('grpc.enable_retries', 0), ('grpc.keepalive_timeout_ms',
+                                                  10000)]) as channel:
+        stub = helloworld_pb2_grpc.GreeterStub(channel)
+        # Timeout in seconds.
+        # Please refer gRPC Python documents for more detail. https://grpc.io/grpc/python/grpc.html
+        response = stub.SayHello(
+            helloworld_pb2.HelloRequest(name='you'), timeout=10)
+    print("Greeter client received: " + response.message)
+
+
+if __name__ == '__main__':
+    run()

gRPC-C++.podspec

@@ -176,7 +176,6 @@ Pod::Spec.new do |s|
                       'src/cpp/common/channel_filter.h',
                       'src/cpp/server/dynamic_thread_pool.h',
                       'src/cpp/server/health/default_health_check_service.h',
-                      'src/cpp/server/health/health.pb.h',
                       'src/cpp/server/thread_pool_interface.h',
                       'src/cpp/thread_manager/thread_manager.h',
                       'src/cpp/client/insecure_credentials.cc',
@@ -207,7 +206,6 @@ Pod::Spec.new do |s|
                       'src/cpp/server/create_default_thread_pool.cc',
                       'src/cpp/server/dynamic_thread_pool.cc',
                       'src/cpp/server/health/default_health_check_service.cc',
-                      'src/cpp/server/health/health.pb.c',
                       'src/cpp/server/health/health_check_service.cc',
                       'src/cpp/server/health/health_check_service_server_builder_option.cc',
                       'src/cpp/server/server_builder.cc',
@@ -288,11 +286,14 @@ Pod::Spec.new do |s|
                       'src/core/lib/security/credentials/oauth2/oauth2_credentials.h',
                       'src/core/lib/security/credentials/plugin/plugin_credentials.h',
                       'src/core/lib/security/credentials/ssl/ssl_credentials.h',
-                      'src/core/lib/security/security_connector/alts_security_connector.h',
+                      'src/core/lib/security/security_connector/alts/alts_security_connector.h',
+                      'src/core/lib/security/security_connector/fake/fake_security_connector.h',
                       'src/core/lib/security/security_connector/load_system_roots.h',
                       'src/core/lib/security/security_connector/load_system_roots_linux.h',
-                      'src/core/lib/security/security_connector/local_security_connector.h',
+                      'src/core/lib/security/security_connector/local/local_security_connector.h',
                       'src/core/lib/security/security_connector/security_connector.h',
+                      'src/core/lib/security/security_connector/ssl/ssl_security_connector.h',
+                      'src/core/lib/security/security_connector/ssl_utils.h',
                       'src/core/lib/security/transport/auth_filters.h',
                       'src/core/lib/security/transport/secure_endpoint.h',
                       'src/core/lib/security/transport/security_handshaker.h',
@@ -333,6 +334,7 @@ Pod::Spec.new do |s|
                       'src/core/ext/filters/client_channel/client_channel_channelz.h',
                       'src/core/ext/filters/client_channel/client_channel_factory.h',
                       'src/core/ext/filters/client_channel/connector.h',
+                      'src/core/ext/filters/client_channel/health/health_check_client.h',
                       'src/core/ext/filters/client_channel/http_connect_handshaker.h',
                       'src/core/ext/filters/client_channel/http_proxy.h',
                       'src/core/ext/filters/client_channel/lb_policy.h',
@@ -350,6 +352,7 @@ Pod::Spec.new do |s|
                       'src/core/ext/filters/client_channel/subchannel_index.h',
                       'src/core/ext/filters/client_channel/uri_parser.h',
                       'src/core/ext/filters/deadline/deadline_filter.h',
+                      'src/core/ext/filters/client_channel/health/health.pb.h',
                       'src/core/tsi/alts_transport_security.h',
                       'src/core/tsi/fake_transport_security.h',
                       'src/core/tsi/local_transport_security.h',
@@ -524,7 +527,6 @@ Pod::Spec.new do |s|
                               'src/cpp/common/channel_filter.h',
                               'src/cpp/server/dynamic_thread_pool.h',
                               'src/cpp/server/health/default_health_check_service.h',
-                              'src/cpp/server/health/health.pb.h',
                               'src/cpp/server/thread_pool_interface.h',
                               'src/cpp/thread_manager/thread_manager.h',
                               'src/core/lib/gpr/alloc.h',
@@ -688,7 +690,8 @@ Pod::Spec.new do |s|
                               'src/core/lib/transport/transport.h',
                               'src/core/lib/transport/transport_impl.h',
                               'src/core/lib/debug/trace.h',
-                              'src/core/ext/transport/inproc/inproc_transport.h'
+                              'src/core/ext/transport/inproc/inproc_transport.h',
+                              'src/core/ext/filters/client_channel/health/health.pb.h'
   end
 
   s.subspec 'Protobuf' do |ss|

gRPC-Core.podspec

@@ -291,11 +291,14 @@ Pod::Spec.new do |s|
                       'src/core/lib/security/credentials/oauth2/oauth2_credentials.h',
                       'src/core/lib/security/credentials/plugin/plugin_credentials.h',
                       'src/core/lib/security/credentials/ssl/ssl_credentials.h',
-                      'src/core/lib/security/security_connector/alts_security_connector.h',
+                      'src/core/lib/security/security_connector/alts/alts_security_connector.h',
+                      'src/core/lib/security/security_connector/fake/fake_security_connector.h',
                       'src/core/lib/security/security_connector/load_system_roots.h',
                       'src/core/lib/security/security_connector/load_system_roots_linux.h',
-                      'src/core/lib/security/security_connector/local_security_connector.h',
+                      'src/core/lib/security/security_connector/local/local_security_connector.h',
                       'src/core/lib/security/security_connector/security_connector.h',
+                      'src/core/lib/security/security_connector/ssl/ssl_security_connector.h',
+                      'src/core/lib/security/security_connector/ssl_utils.h',
                       'src/core/lib/security/transport/auth_filters.h',
                       'src/core/lib/security/transport/secure_endpoint.h',
                       'src/core/lib/security/transport/security_handshaker.h',
@@ -336,6 +339,7 @@ Pod::Spec.new do |s|
                       'src/core/ext/filters/client_channel/client_channel_channelz.h',
                       'src/core/ext/filters/client_channel/client_channel_factory.h',
                       'src/core/ext/filters/client_channel/connector.h',
+                      'src/core/ext/filters/client_channel/health/health_check_client.h',
                       'src/core/ext/filters/client_channel/http_connect_handshaker.h',
                       'src/core/ext/filters/client_channel/http_proxy.h',
                       'src/core/ext/filters/client_channel/lb_policy.h',
@@ -353,6 +357,7 @@ Pod::Spec.new do |s|
                       'src/core/ext/filters/client_channel/subchannel_index.h',
                       'src/core/ext/filters/client_channel/uri_parser.h',
                       'src/core/ext/filters/deadline/deadline_filter.h',
+                      'src/core/ext/filters/client_channel/health/health.pb.h',
                       'src/core/tsi/alts_transport_security.h',
                       'src/core/tsi/fake_transport_security.h',
                       'src/core/tsi/local_transport_security.h',
@@ -715,11 +720,14 @@ Pod::Spec.new do |s|
                       'src/core/lib/security/credentials/oauth2/oauth2_credentials.cc',
                       'src/core/lib/security/credentials/plugin/plugin_credentials.cc',
                       'src/core/lib/security/credentials/ssl/ssl_credentials.cc',
-                      'src/core/lib/security/security_connector/alts_security_connector.cc',
+                      'src/core/lib/security/security_connector/alts/alts_security_connector.cc',
+                      'src/core/lib/security/security_connector/fake/fake_security_connector.cc',
                       'src/core/lib/security/security_connector/load_system_roots_fallback.cc',
                       'src/core/lib/security/security_connector/load_system_roots_linux.cc',
-                      'src/core/lib/security/security_connector/local_security_connector.cc',
+                      'src/core/lib/security/security_connector/local/local_security_connector.cc',
                       'src/core/lib/security/security_connector/security_connector.cc',
+                      'src/core/lib/security/security_connector/ssl/ssl_security_connector.cc',
+                      'src/core/lib/security/security_connector/ssl_utils.cc',
                       'src/core/lib/security/transport/client_auth_filter.cc',
                       'src/core/lib/security/transport/secure_endpoint.cc',
                       'src/core/lib/security/transport/security_handshaker.cc',
@@ -771,6 +779,7 @@ Pod::Spec.new do |s|
                       'src/core/ext/filters/client_channel/client_channel_factory.cc',
                       'src/core/ext/filters/client_channel/client_channel_plugin.cc',
                       'src/core/ext/filters/client_channel/connector.cc',
+                      'src/core/ext/filters/client_channel/health/health_check_client.cc',
                       'src/core/ext/filters/client_channel/http_connect_handshaker.cc',
                       'src/core/ext/filters/client_channel/http_proxy.cc',
                       'src/core/ext/filters/client_channel/lb_policy.cc',
@@ -787,6 +796,7 @@ Pod::Spec.new do |s|
                       'src/core/ext/filters/client_channel/subchannel_index.cc',
                       'src/core/ext/filters/client_channel/uri_parser.cc',
                       'src/core/ext/filters/deadline/deadline_filter.cc',
+                      'src/core/ext/filters/client_channel/health/health.pb.c',
                       'src/core/tsi/alts_transport_security.cc',
                       'src/core/tsi/fake_transport_security.cc',
                       'src/core/tsi/local_transport_security.cc',
@@ -900,11 +910,14 @@ Pod::Spec.new do |s|
                               'src/core/lib/security/credentials/oauth2/oauth2_credentials.h',
                               'src/core/lib/security/credentials/plugin/plugin_credentials.h',
                               'src/core/lib/security/credentials/ssl/ssl_credentials.h',
-                              'src/core/lib/security/security_connector/alts_security_connector.h',
+                              'src/core/lib/security/security_connector/alts/alts_security_connector.h',
+                              'src/core/lib/security/security_connector/fake/fake_security_connector.h',
                               'src/core/lib/security/security_connector/load_system_roots.h',
                               'src/core/lib/security/security_connector/load_system_roots_linux.h',
-                              'src/core/lib/security/security_connector/local_security_connector.h',
+                              'src/core/lib/security/security_connector/local/local_security_connector.h',
                               'src/core/lib/security/security_connector/security_connector.h',
+                              'src/core/lib/security/security_connector/ssl/ssl_security_connector.h',
+                              'src/core/lib/security/security_connector/ssl_utils.h',
                               'src/core/lib/security/transport/auth_filters.h',
                               'src/core/lib/security/transport/secure_endpoint.h',
                               'src/core/lib/security/transport/security_handshaker.h',
@@ -945,6 +958,7 @@ Pod::Spec.new do |s|
                               'src/core/ext/filters/client_channel/client_channel_channelz.h',
                               'src/core/ext/filters/client_channel/client_channel_factory.h',
                               'src/core/ext/filters/client_channel/connector.h',
+                              'src/core/ext/filters/client_channel/health/health_check_client.h',
                               'src/core/ext/filters/client_channel/http_connect_handshaker.h',
                               'src/core/ext/filters/client_channel/http_proxy.h',
                               'src/core/ext/filters/client_channel/lb_policy.h',
@@ -962,6 +976,7 @@ Pod::Spec.new do |s|
                               'src/core/ext/filters/client_channel/subchannel_index.h',
                               'src/core/ext/filters/client_channel/uri_parser.h',
                               'src/core/ext/filters/deadline/deadline_filter.h',
+                              'src/core/ext/filters/client_channel/health/health.pb.h',
                               'src/core/tsi/alts_transport_security.h',
                               'src/core/tsi/fake_transport_security.h',
                               'src/core/tsi/local_transport_security.h',
@@ -1207,6 +1222,9 @@ Pod::Spec.new do |s|
                       'test/core/util/tracer_util.cc',
                       'test/core/util/trickle_endpoint.cc',
                       'test/core/util/cmdline.cc',
+                      'third_party/nanopb/pb_common.c',
+                      'third_party/nanopb/pb_decode.c',
+                      'third_party/nanopb/pb_encode.c',
                       'test/core/end2end/data/ssl_test_data.h',
                       'test/core/security/oauth2_utils.h',
                       'test/core/end2end/cq_verifier.h',
@@ -1228,6 +1246,10 @@ Pod::Spec.new do |s|
                       'test/core/util/tracer_util.h',
                       'test/core/util/trickle_endpoint.h',
                       'test/core/util/cmdline.h',
+                      'third_party/nanopb/pb.h',
+                      'third_party/nanopb/pb_common.h',
+                      'third_party/nanopb/pb_decode.h',
+                      'third_party/nanopb/pb_encode.h',
                       'test/core/end2end/end2end_tests.cc',
                       'test/core/end2end/end2end_test_utils.cc',
                       'test/core/end2end/tests/authority_not_supported.cc',

grpc.gemspec

@@ -223,11 +223,14 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/lib/security/credentials/oauth2/oauth2_credentials.h )
   s.files += %w( src/core/lib/security/credentials/plugin/plugin_credentials.h )
   s.files += %w( src/core/lib/security/credentials/ssl/ssl_credentials.h )
-  s.files += %w( src/core/lib/security/security_connector/alts_security_connector.h )
+  s.files += %w( src/core/lib/security/security_connector/alts/alts_security_connector.h )
+  s.files += %w( src/core/lib/security/security_connector/fake/fake_security_connector.h )
   s.files += %w( src/core/lib/security/security_connector/load_system_roots.h )
   s.files += %w( src/core/lib/security/security_connector/load_system_roots_linux.h )
-  s.files += %w( src/core/lib/security/security_connector/local_security_connector.h )
+  s.files += %w( src/core/lib/security/security_connector/local/local_security_connector.h )
   s.files += %w( src/core/lib/security/security_connector/security_connector.h )
+  s.files += %w( src/core/lib/security/security_connector/ssl/ssl_security_connector.h )
+  s.files += %w( src/core/lib/security/security_connector/ssl_utils.h )
   s.files += %w( src/core/lib/security/transport/auth_filters.h )
   s.files += %w( src/core/lib/security/transport/secure_endpoint.h )
   s.files += %w( src/core/lib/security/transport/security_handshaker.h )
@@ -272,6 +275,7 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/ext/filters/client_channel/client_channel_channelz.h )
   s.files += %w( src/core/ext/filters/client_channel/client_channel_factory.h )
   s.files += %w( src/core/ext/filters/client_channel/connector.h )
+  s.files += %w( src/core/ext/filters/client_channel/health/health_check_client.h )
   s.files += %w( src/core/ext/filters/client_channel/http_connect_handshaker.h )
   s.files += %w( src/core/ext/filters/client_channel/http_proxy.h )
   s.files += %w( src/core/ext/filters/client_channel/lb_policy.h )
@@ -289,6 +293,7 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/ext/filters/client_channel/subchannel_index.h )
   s.files += %w( src/core/ext/filters/client_channel/uri_parser.h )
   s.files += %w( src/core/ext/filters/deadline/deadline_filter.h )
+  s.files += %w( src/core/ext/filters/client_channel/health/health.pb.h )
   s.files += %w( src/core/tsi/alts_transport_security.h )
   s.files += %w( src/core/tsi/fake_transport_security.h )
   s.files += %w( src/core/tsi/local_transport_security.h )
@@ -651,11 +656,14 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/lib/security/credentials/oauth2/oauth2_credentials.cc )
   s.files += %w( src/core/lib/security/credentials/plugin/plugin_credentials.cc )
   s.files += %w( src/core/lib/security/credentials/ssl/ssl_credentials.cc )
-  s.files += %w( src/core/lib/security/security_connector/alts_security_connector.cc )
+  s.files += %w( src/core/lib/security/security_connector/alts/alts_security_connector.cc )
+  s.files += %w( src/core/lib/security/security_connector/fake/fake_security_connector.cc )
   s.files += %w( src/core/lib/security/security_connector/load_system_roots_fallback.cc )
   s.files += %w( src/core/lib/security/security_connector/load_system_roots_linux.cc )
-  s.files += %w( src/core/lib/security/security_connector/local_security_connector.cc )
+  s.files += %w( src/core/lib/security/security_connector/local/local_security_connector.cc )
   s.files += %w( src/core/lib/security/security_connector/security_connector.cc )
+  s.files += %w( src/core/lib/security/security_connector/ssl/ssl_security_connector.cc )
+  s.files += %w( src/core/lib/security/security_connector/ssl_utils.cc )
   s.files += %w( src/core/lib/security/transport/client_auth_filter.cc )
   s.files += %w( src/core/lib/security/transport/secure_endpoint.cc )
   s.files += %w( src/core/lib/security/transport/security_handshaker.cc )
@@ -710,6 +718,7 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/ext/filters/client_channel/client_channel_factory.cc )
   s.files += %w( src/core/ext/filters/client_channel/client_channel_plugin.cc )
   s.files += %w( src/core/ext/filters/client_channel/connector.cc )
+  s.files += %w( src/core/ext/filters/client_channel/health/health_check_client.cc )
   s.files += %w( src/core/ext/filters/client_channel/http_connect_handshaker.cc )
   s.files += %w( src/core/ext/filters/client_channel/http_proxy.cc )
   s.files += %w( src/core/ext/filters/client_channel/lb_policy.cc )
@@ -726,6 +735,7 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/ext/filters/client_channel/subchannel_index.cc )
   s.files += %w( src/core/ext/filters/client_channel/uri_parser.cc )
   s.files += %w( src/core/ext/filters/deadline/deadline_filter.cc )
+  s.files += %w( src/core/ext/filters/client_channel/health/health.pb.c )
   s.files += %w( src/core/tsi/alts_transport_security.cc )
   s.files += %w( src/core/tsi/fake_transport_security.cc )
   s.files += %w( src/core/tsi/local_transport_security.cc )

grpc.gyp

@@ -472,11 +472,14 @@
         'src/core/lib/security/credentials/oauth2/oauth2_credentials.cc',
         'src/core/lib/security/credentials/plugin/plugin_credentials.cc',
         'src/core/lib/security/credentials/ssl/ssl_credentials.cc',
-        'src/core/lib/security/security_connector/alts_security_connector.cc',
+        'src/core/lib/security/security_connector/alts/alts_security_connector.cc',
+        'src/core/lib/security/security_connector/fake/fake_security_connector.cc',
         'src/core/lib/security/security_connector/load_system_roots_fallback.cc',
         'src/core/lib/security/security_connector/load_system_roots_linux.cc',
-        'src/core/lib/security/security_connector/local_security_connector.cc',
+        'src/core/lib/security/security_connector/local/local_security_connector.cc',
         'src/core/lib/security/security_connector/security_connector.cc',
+        'src/core/lib/security/security_connector/ssl/ssl_security_connector.cc',
+        'src/core/lib/security/security_connector/ssl_utils.cc',
         'src/core/lib/security/transport/client_auth_filter.cc',
         'src/core/lib/security/transport/secure_endpoint.cc',
         'src/core/lib/security/transport/security_handshaker.cc',
@@ -531,6 +534,7 @@
         'src/core/ext/filters/client_channel/client_channel_factory.cc',
         'src/core/ext/filters/client_channel/client_channel_plugin.cc',
         'src/core/ext/filters/client_channel/connector.cc',
+        'src/core/ext/filters/client_channel/health/health_check_client.cc',
         'src/core/ext/filters/client_channel/http_connect_handshaker.cc',
         'src/core/ext/filters/client_channel/http_proxy.cc',
         'src/core/ext/filters/client_channel/lb_policy.cc',
@@ -547,6 +551,7 @@
         'src/core/ext/filters/client_channel/subchannel_index.cc',
         'src/core/ext/filters/client_channel/uri_parser.cc',
         'src/core/ext/filters/deadline/deadline_filter.cc',
+        'src/core/ext/filters/client_channel/health/health.pb.c',
         'src/core/tsi/alts_transport_security.cc',
         'src/core/tsi/fake_transport_security.cc',
         'src/core/tsi/local_transport_security.cc',
@@ -789,6 +794,7 @@
         'src/core/ext/filters/client_channel/client_channel_factory.cc',
         'src/core/ext/filters/client_channel/client_channel_plugin.cc',
         'src/core/ext/filters/client_channel/connector.cc',
+        'src/core/ext/filters/client_channel/health/health_check_client.cc',
         'src/core/ext/filters/client_channel/http_connect_handshaker.cc',
         'src/core/ext/filters/client_channel/http_proxy.cc',
         'src/core/ext/filters/client_channel/lb_policy.cc',
@@ -805,6 +811,10 @@
         'src/core/ext/filters/client_channel/subchannel_index.cc',
         'src/core/ext/filters/client_channel/uri_parser.cc',
         'src/core/ext/filters/deadline/deadline_filter.cc',
+        'src/core/ext/filters/client_channel/health/health.pb.c',
+        'third_party/nanopb/pb_common.c',
+        'third_party/nanopb/pb_decode.c',
+        'third_party/nanopb/pb_encode.c',
         'src/core/ext/transport/chttp2/transport/bin_decoder.cc',
         'src/core/ext/transport/chttp2/transport/bin_encoder.cc',
         'src/core/ext/transport/chttp2/transport/chttp2_plugin.cc',
@@ -1023,6 +1033,7 @@
         'src/core/ext/filters/client_channel/client_channel_factory.cc',
         'src/core/ext/filters/client_channel/client_channel_plugin.cc',
         'src/core/ext/filters/client_channel/connector.cc',
+        'src/core/ext/filters/client_channel/health/health_check_client.cc',
         'src/core/ext/filters/client_channel/http_connect_handshaker.cc',
         'src/core/ext/filters/client_channel/http_proxy.cc',
         'src/core/ext/filters/client_channel/lb_policy.cc',
@@ -1039,6 +1050,10 @@
         'src/core/ext/filters/client_channel/subchannel_index.cc',
         'src/core/ext/filters/client_channel/uri_parser.cc',
         'src/core/ext/filters/deadline/deadline_filter.cc',
+        'src/core/ext/filters/client_channel/health/health.pb.c',
+        'third_party/nanopb/pb_common.c',
+        'third_party/nanopb/pb_decode.c',
+        'third_party/nanopb/pb_encode.c',
         'src/core/ext/transport/chttp2/transport/bin_decoder.cc',
         'src/core/ext/transport/chttp2/transport/bin_encoder.cc',
         'src/core/ext/transport/chttp2/transport/chttp2_plugin.cc',
@@ -1269,6 +1284,7 @@
         'src/core/ext/filters/client_channel/client_channel_factory.cc',
         'src/core/ext/filters/client_channel/client_channel_plugin.cc',
         'src/core/ext/filters/client_channel/connector.cc',
+        'src/core/ext/filters/client_channel/health/health_check_client.cc',
         'src/core/ext/filters/client_channel/http_connect_handshaker.cc',
         'src/core/ext/filters/client_channel/http_proxy.cc',
         'src/core/ext/filters/client_channel/lb_policy.cc',
@@ -1285,6 +1301,10 @@
         'src/core/ext/filters/client_channel/subchannel_index.cc',
         'src/core/ext/filters/client_channel/uri_parser.cc',
         'src/core/ext/filters/deadline/deadline_filter.cc',
+        'src/core/ext/filters/client_channel/health/health.pb.c',
+        'third_party/nanopb/pb_common.c',
+        'third_party/nanopb/pb_decode.c',
+        'third_party/nanopb/pb_encode.c',
         'src/core/ext/transport/inproc/inproc_plugin.cc',
         'src/core/ext/transport/inproc/inproc_transport.cc',
         'src/core/ext/filters/client_channel/resolver/dns/c_ares/dns_resolver_ares.cc',
@@ -1303,9 +1323,6 @@
         'src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_channel.cc',
         'src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_client_stats.cc',
         'src/core/ext/filters/client_channel/lb_policy/grpclb/load_balancer_api.cc',
-        'third_party/nanopb/pb_common.c',
-        'third_party/nanopb/pb_decode.c',
-        'third_party/nanopb/pb_encode.c',
         'src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/google/protobuf/duration.pb.c',
         'src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/google/protobuf/timestamp.pb.c',
         'src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/load_balancer.pb.c',
@@ -1387,7 +1404,6 @@
         'src/cpp/server/create_default_thread_pool.cc',
         'src/cpp/server/dynamic_thread_pool.cc',
         'src/cpp/server/health/default_health_check_service.cc',
-        'src/cpp/server/health/health.pb.c',
         'src/cpp/server/health/health_check_service.cc',
         'src/cpp/server/health/health_check_service_server_builder_option.cc',
         'src/cpp/server/server_builder.cc',
@@ -1400,6 +1416,10 @@
         'src/cpp/util/status.cc',
         'src/cpp/util/string_ref.cc',
         'src/cpp/util/time_cc.cc',
+        'src/core/ext/filters/client_channel/health/health.pb.c',
+        'third_party/nanopb/pb_common.c',
+        'third_party/nanopb/pb_decode.c',
+        'third_party/nanopb/pb_encode.c',
         'src/cpp/codegen/call_wrapper.cc',
         'src/cpp/codegen/codegen_init.cc',
       ],
@@ -1537,7 +1557,6 @@
         'src/cpp/server/create_default_thread_pool.cc',
         'src/cpp/server/dynamic_thread_pool.cc',
         'src/cpp/server/health/default_health_check_service.cc',
-        'src/cpp/server/health/health.pb.c',
         'src/cpp/server/health/health_check_service.cc',
         'src/cpp/server/health/health_check_service_server_builder_option.cc',
         'src/cpp/server/server_builder.cc',
@@ -1550,6 +1569,10 @@
         'src/cpp/util/status.cc',
         'src/cpp/util/string_ref.cc',
         'src/cpp/util/time_cc.cc',
+        'src/core/ext/filters/client_channel/health/health.pb.c',
+        'third_party/nanopb/pb_common.c',
+        'third_party/nanopb/pb_decode.c',
+        'third_party/nanopb/pb_encode.c',
         'src/cpp/codegen/call_wrapper.cc',
         'src/cpp/codegen/codegen_init.cc',
       ],

include/grpc/impl/codegen/grpc_types.h

@@ -347,6 +347,9 @@ typedef struct {
 /** If set to non zero, surfaces the user agent string to the server. User
     agent is surfaced by default. */
 #define GRPC_ARG_SURFACE_USER_AGENT "grpc.surface_user_agent"
+/** If set, inhibits health checking (which may be enabled via the
+ *  service config.) */
+#define GRPC_ARG_INHIBIT_HEALTH_CHECKING "grpc.inhibit_health_checking"
 /** \} */
 
 /** Result of a grpc call. If the caller satisfies the prerequisites of a

include/grpcpp/impl/codegen/call.h

@@ -1189,7 +1189,6 @@ class CallOpSet : public CallOpSetInterface,
   }
 
   bool FinalizeResult(void** tag, bool* status) override {
-    gpr_log(GPR_ERROR, "finalizing result");
     if (done_intercepting_) {
       // We have already finished intercepting and filling in the results. This
       // round trip from the core needed to be made because interceptors were

include/grpcpp/impl/codegen/callback_common.h

@@ -32,16 +32,16 @@ namespace grpc {
 namespace internal {
 
 /// An exception-safe way of invoking a user-specified callback function
-template <class Func, class Arg>
-void CatchingCallback(Func&& func, Arg&& arg) {
+template <class Func, class... Args>
+void CatchingCallback(Func&& func, Args&&... args) {
 #if GRPC_ALLOW_EXCEPTIONS
   try {
-    func(arg);
+    func(std::forward<Args>(args)...);
   } catch (...) {
     // nothing to return or change here, just don't crash the library
   }
 #else   // GRPC_ALLOW_EXCEPTIONS
-  func(arg);
+  func(std::forward<Args>(args)...);
 #endif  // GRPC_ALLOW_EXCEPTIONS
 }
 

include/grpcpp/impl/codegen/completion_queue.h

@@ -122,8 +122,8 @@ class CompletionQueue : private GrpcLibraryCodegen {
   /// Read from the queue, blocking until an event is available or the queue is
   /// shutting down.
   ///
-  /// \param tag[out] Updated to point to the read event's tag.
-  /// \param ok[out] true if read a successful event, false otherwise.
+  /// \param tag [out] Updated to point to the read event's tag.
+  /// \param ok [out] true if read a successful event, false otherwise.
   ///
   /// Note that each tag sent to the completion queue (through RPC operations
   /// or alarms) will be delivered out of the completion queue by a call to
@@ -178,10 +178,10 @@ class CompletionQueue : private GrpcLibraryCodegen {
   /// within the \a deadline).  A \a tag points to an arbitrary location usually
   /// employed to uniquely identify an event.
   ///
-  /// \param tag[out] Upon sucess, updated to point to the event's tag.
-  /// \param ok[out] Upon sucess, true if a successful event, false otherwise
+  /// \param tag [out] Upon sucess, updated to point to the event's tag.
+  /// \param ok [out] Upon sucess, true if a successful event, false otherwise
   ///        See documentation for CompletionQueue::Next for explanation of ok
-  /// \param deadline[in] How long to block in wait for an event.
+  /// \param deadline [in] How long to block in wait for an event.
   ///
   /// \return The type of event read.
   template <typename T>
@@ -197,10 +197,11 @@ class CompletionQueue : private GrpcLibraryCodegen {
   /// within the \a deadline).  A \a tag points to an arbitrary location usually
   /// employed to uniquely identify an event.
   ///
-  /// \param F[in] Function to execute before calling AsyncNext on this queue.
-  /// \param tag[out] Upon sucess, updated to point to the event's tag.
-  /// \param ok[out] Upon sucess, true if read a regular event, false otherwise.
-  /// \param deadline[in] How long to block in wait for an event.
+  /// \param f [in] Function to execute before calling AsyncNext on this queue.
+  /// \param tag [out] Upon sucess, updated to point to the event's tag.
+  /// \param ok [out] Upon sucess, true if read a regular event, false
+  /// otherwise.
+  /// \param deadline [in] How long to block in wait for an event.
   ///
   /// \return The type of event read.
   template <typename T, typename F>
@@ -379,7 +380,7 @@ class ServerCompletionQueue : public CompletionQueue {
   ServerCompletionQueue() : polling_type_(GRPC_CQ_DEFAULT_POLLING) {}
 
  private:
-  /// \param is_frequently_polled Informs the GRPC library about whether the
+  /// \param polling_type Informs the GRPC library about whether the
   /// server completion queue would be actively polled (by calling Next() or
   /// AsyncNext()). By default all server completion queues are assumed to be
   /// frequently polled.

include/grpcpp/impl/codegen/config_protobuf.h

@@ -66,6 +66,12 @@
 #define GRPC_CUSTOM_CODEDINPUTSTREAM ::google::protobuf::io::CodedInputStream
 #endif
 
+#ifndef GRPC_CUSTOM_JSONUTIL
+#include <google/protobuf/util/json_util.h>
+#define GRPC_CUSTOM_JSONUTIL ::google::protobuf::util
+#define GRPC_CUSTOM_UTIL_STATUS ::google::protobuf::util::Status
+#endif
+
 namespace grpc {
 namespace protobuf {
 
@@ -83,6 +89,12 @@ typedef GRPC_CUSTOM_SERVICEDESCRIPTOR ServiceDescriptor;
 typedef GRPC_CUSTOM_SIMPLEDESCRIPTORDATABASE SimpleDescriptorDatabase;
 typedef GRPC_CUSTOM_SOURCELOCATION SourceLocation;
 
+namespace util {
+typedef GRPC_CUSTOM_UTIL_STATUS Status;
+}  // namespace util
+
+namespace json = GRPC_CUSTOM_JSONUTIL;
+
 namespace io {
 typedef GRPC_CUSTOM_ZEROCOPYOUTPUTSTREAM ZeroCopyOutputStream;
 typedef GRPC_CUSTOM_ZEROCOPYINPUTSTREAM ZeroCopyInputStream;

include/grpcpp/impl/codegen/server_context.h

@@ -107,7 +107,7 @@ class ServerContext {
   /// Return a \a gpr_timespec representation of the server call's deadline.
   gpr_timespec raw_deadline() const { return deadline_; }
 
-  /// Add the (\a meta_key, \a meta_value) pair to the initial metadata
+  /// Add the (\a key, \a value) pair to the initial metadata
   /// associated with a server call. These are made available at the client side
   /// by the \a grpc::ClientContext::GetServerInitialMetadata() method.
   ///
@@ -115,13 +115,13 @@ class ServerContext {
   /// to the client (which can happen explicitly, or implicitly when sending a
   /// a response message or status to the client).
   ///
-  /// \param meta_key The metadata key. If \a meta_value is binary data, it must
+  /// \param key The metadata key. If \a value is binary data, it must
   /// end in "-bin".
-  /// \param meta_value The metadata value. If its value is binary, the key name
+  /// \param value The metadata value. If its value is binary, the key name
   /// must end in "-bin".
   void AddInitialMetadata(const grpc::string& key, const grpc::string& value);
 
-  /// Add the (\a meta_key, \a meta_value) pair to the initial metadata
+  /// Add the (\a key, \a value) pair to the initial metadata
   /// associated with a server call. These are made available at the client
   /// side by the \a grpc::ClientContext::GetServerTrailingMetadata() method.
   ///
@@ -129,9 +129,9 @@ class ServerContext {
   /// metadata to the client (which happens when the call is finished and a
   /// status is sent to the client).
   ///
-  /// \param meta_key The metadata key. If \a meta_value is binary data,
+  /// \param key The metadata key. If \a value is binary data,
   /// it must end in "-bin".
-  /// \param meta_value The metadata value. If its value is binary, the key name
+  /// \param value The metadata value. If its value is binary, the key name
   /// must end in "-bin".
   void AddTrailingMetadata(const grpc::string& key, const grpc::string& value);
 
@@ -177,9 +177,9 @@ class ServerContext {
     return compression_level_;
   }
 
-  /// Set \a algorithm to be the compression algorithm used for the server call.
+  /// Set \a level to be the compression level used for the server call.
   ///
-  /// \param algorithm The compression algorithm used for the server call.
+  /// \param level The compression level used for the server call.
   void set_compression_level(grpc_compression_level level) {
     compression_level_set_ = true;
     compression_level_ = level;

package.xml

@@ -228,11 +228,14 @@
     <file baseinstalldir="/" name="src/core/lib/security/credentials/oauth2/oauth2_credentials.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/credentials/plugin/plugin_credentials.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/credentials/ssl/ssl_credentials.h" role="src" />
-    <file baseinstalldir="/" name="src/core/lib/security/security_connector/alts_security_connector.h" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/security_connector/alts/alts_security_connector.h" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/security_connector/fake/fake_security_connector.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/security_connector/load_system_roots.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/security_connector/load_system_roots_linux.h" role="src" />
-    <file baseinstalldir="/" name="src/core/lib/security/security_connector/local_security_connector.h" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/security_connector/local/local_security_connector.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/security_connector/security_connector.h" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/security_connector/ssl/ssl_security_connector.h" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/security_connector/ssl_utils.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/transport/auth_filters.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/transport/secure_endpoint.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/transport/security_handshaker.h" role="src" />
@@ -277,6 +280,7 @@
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/client_channel_channelz.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/client_channel_factory.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/connector.h" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/filters/client_channel/health/health_check_client.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/http_connect_handshaker.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/http_proxy.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/lb_policy.h" role="src" />
@@ -294,6 +298,7 @@
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/subchannel_index.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/uri_parser.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/deadline/deadline_filter.h" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/filters/client_channel/health/health.pb.h" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/alts_transport_security.h" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/fake_transport_security.h" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/local_transport_security.h" role="src" />
@@ -656,11 +661,14 @@
     <file baseinstalldir="/" name="src/core/lib/security/credentials/oauth2/oauth2_credentials.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/credentials/plugin/plugin_credentials.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/credentials/ssl/ssl_credentials.cc" role="src" />
-    <file baseinstalldir="/" name="src/core/lib/security/security_connector/alts_security_connector.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/security_connector/alts/alts_security_connector.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/security_connector/fake/fake_security_connector.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/security_connector/load_system_roots_fallback.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/security_connector/load_system_roots_linux.cc" role="src" />
-    <file baseinstalldir="/" name="src/core/lib/security/security_connector/local_security_connector.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/security_connector/local/local_security_connector.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/security_connector/security_connector.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/security_connector/ssl/ssl_security_connector.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/security_connector/ssl_utils.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/transport/client_auth_filter.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/transport/secure_endpoint.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/transport/security_handshaker.cc" role="src" />
@@ -715,6 +723,7 @@
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/client_channel_factory.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/client_channel_plugin.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/connector.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/filters/client_channel/health/health_check_client.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/http_connect_handshaker.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/http_proxy.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/lb_policy.cc" role="src" />
@@ -731,6 +740,7 @@
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/subchannel_index.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/uri_parser.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/deadline/deadline_filter.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/filters/client_channel/health/health.pb.c" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/alts_transport_security.cc" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/fake_transport_security.cc" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/local_transport_security.cc" role="src" />

src/core/ext/filters/client_channel/client_channel_channelz.cc

@@ -128,7 +128,8 @@ void SubchannelNode::PopulateConnectivityState(grpc_json* json) {
   if (subchannel_ == nullptr) {
     state = GRPC_CHANNEL_SHUTDOWN;
   } else {
-    state = grpc_subchannel_check_connectivity(subchannel_, nullptr);
+    state = grpc_subchannel_check_connectivity(
+        subchannel_, nullptr, true /* inhibit_health_checking */);
   }
   json = grpc_json_create_child(nullptr, json, "state", nullptr,
                                 GRPC_JSON_OBJECT, false);

src/cpp/server/health/health.pb.c → src/core/ext/filters/client_channel/health/health.pb.c

@@ -1,7 +1,7 @@
 /* Automatically generated nanopb constant definitions */
 /* Generated by nanopb-0.3.7-dev */
 
-#include "src/cpp/server/health/health.pb.h"
+#include "src/core/ext/filters/client_channel/health/health.pb.h"
 /* @@protoc_insertion_point(includes) */
 #if PB_PROTO_HEADER_VERSION != 30
 #error Regenerate this file with the current version of nanopb generator.

src/core/ext/filters/client_channel/health/health_check_client.cc

@@ -0,0 +1,647 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include <grpc/support/port_platform.h>
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include "src/core/ext/filters/client_channel/health/health_check_client.h"
+
+#include "pb_decode.h"
+#include "pb_encode.h"
+#include "src/core/ext/filters/client_channel/health/health.pb.h"
+#include "src/core/lib/debug/trace.h"
+#include "src/core/lib/gprpp/mutex_lock.h"
+#include "src/core/lib/slice/slice_internal.h"
+#include "src/core/lib/transport/error_utils.h"
+#include "src/core/lib/transport/status_metadata.h"
+
+#define HEALTH_CHECK_INITIAL_CONNECT_BACKOFF_SECONDS 1
+#define HEALTH_CHECK_RECONNECT_BACKOFF_MULTIPLIER 1.6
+#define HEALTH_CHECK_RECONNECT_MAX_BACKOFF_SECONDS 120
+#define HEALTH_CHECK_RECONNECT_JITTER 0.2
+
+grpc_core::TraceFlag grpc_health_check_client_trace(false,
+                                                    "health_check_client");
+
+namespace grpc_core {
+
+//
+// HealthCheckClient
+//
+
+HealthCheckClient::HealthCheckClient(
+    const char* service_name,
+    RefCountedPtr<ConnectedSubchannel> connected_subchannel,
+    grpc_pollset_set* interested_parties,
+    grpc_core::RefCountedPtr<grpc_core::channelz::SubchannelNode> channelz_node)
+    : InternallyRefCountedWithTracing<HealthCheckClient>(
+          &grpc_health_check_client_trace),
+      service_name_(service_name),
+      connected_subchannel_(std::move(connected_subchannel)),
+      interested_parties_(interested_parties),
+      channelz_node_(std::move(channelz_node)),
+      retry_backoff_(
+          BackOff::Options()
+              .set_initial_backoff(
+                  HEALTH_CHECK_INITIAL_CONNECT_BACKOFF_SECONDS * 1000)
+              .set_multiplier(HEALTH_CHECK_RECONNECT_BACKOFF_MULTIPLIER)
+              .set_jitter(HEALTH_CHECK_RECONNECT_JITTER)
+              .set_max_backoff(HEALTH_CHECK_RECONNECT_MAX_BACKOFF_SECONDS *
+                               1000)) {
+  if (grpc_health_check_client_trace.enabled()) {
+    gpr_log(GPR_INFO, "created HealthCheckClient %p", this);
+  }
+  GRPC_CLOSURE_INIT(&retry_timer_callback_, OnRetryTimer, this,
+                    grpc_schedule_on_exec_ctx);
+  gpr_mu_init(&mu_);
+  StartCall();
+}
+
+HealthCheckClient::~HealthCheckClient() {
+  if (grpc_health_check_client_trace.enabled()) {
+    gpr_log(GPR_INFO, "destroying HealthCheckClient %p", this);
+  }
+  GRPC_ERROR_UNREF(error_);
+  gpr_mu_destroy(&mu_);
+}
+
+void HealthCheckClient::NotifyOnHealthChange(grpc_connectivity_state* state,
+                                             grpc_closure* closure) {
+  MutexLock lock(&mu_);
+  GPR_ASSERT(notify_state_ == nullptr);
+  if (*state != state_) {
+    *state = state_;
+    GRPC_CLOSURE_SCHED(closure, GRPC_ERROR_REF(error_));
+    return;
+  }
+  notify_state_ = state;
+  on_health_changed_ = closure;
+}
+
+void HealthCheckClient::SetHealthStatus(grpc_connectivity_state state,
+                                        grpc_error* error) {
+  MutexLock lock(&mu_);
+  SetHealthStatusLocked(state, error);
+}
+
+void HealthCheckClient::SetHealthStatusLocked(grpc_connectivity_state state,
+                                              grpc_error* error) {
+  if (grpc_health_check_client_trace.enabled()) {
+    gpr_log(GPR_INFO, "HealthCheckClient %p: setting state=%d error=%s", this,
+            state, grpc_error_string(error));
+  }
+  if (notify_state_ != nullptr && *notify_state_ != state) {
+    *notify_state_ = state;
+    notify_state_ = nullptr;
+    GRPC_CLOSURE_SCHED(on_health_changed_, GRPC_ERROR_REF(error));
+    on_health_changed_ = nullptr;
+  }
+  state_ = state;
+  GRPC_ERROR_UNREF(error_);
+  error_ = error;
+}
+
+void HealthCheckClient::Orphan() {
+  if (grpc_health_check_client_trace.enabled()) {
+    gpr_log(GPR_INFO, "HealthCheckClient %p: shutting down", this);
+  }
+  {
+    MutexLock lock(&mu_);
+    if (on_health_changed_ != nullptr) {
+      *notify_state_ = GRPC_CHANNEL_SHUTDOWN;
+      notify_state_ = nullptr;
+      GRPC_CLOSURE_SCHED(on_health_changed_, GRPC_ERROR_NONE);
+      on_health_changed_ = nullptr;
+    }
+    shutting_down_ = true;
+    call_state_.reset();
+    if (retry_timer_callback_pending_) {
+      grpc_timer_cancel(&retry_timer_);
+    }
+  }
+  Unref(DEBUG_LOCATION, "orphan");
+}
+
+void HealthCheckClient::StartCall() {
+  MutexLock lock(&mu_);
+  StartCallLocked();
+}
+
+void HealthCheckClient::StartCallLocked() {
+  if (shutting_down_) return;
+  GPR_ASSERT(call_state_ == nullptr);
+  SetHealthStatusLocked(GRPC_CHANNEL_CONNECTING, GRPC_ERROR_NONE);
+  call_state_ = MakeOrphanable<CallState>(Ref(), interested_parties_);
+  if (grpc_health_check_client_trace.enabled()) {
+    gpr_log(GPR_INFO, "HealthCheckClient %p: created CallState %p", this,
+            call_state_.get());
+  }
+  call_state_->StartCall();
+}
+
+void HealthCheckClient::StartRetryTimer() {
+  MutexLock lock(&mu_);
+  SetHealthStatusLocked(
+      GRPC_CHANNEL_TRANSIENT_FAILURE,
+      GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "health check call failed; will retry after backoff"));
+  grpc_millis next_try = retry_backoff_.NextAttemptTime();
+  if (grpc_health_check_client_trace.enabled()) {
+    gpr_log(GPR_INFO, "HealthCheckClient %p: health check call lost...", this);
+    grpc_millis timeout = next_try - ExecCtx::Get()->Now();
+    if (timeout > 0) {
+      gpr_log(GPR_INFO,
+              "HealthCheckClient %p: ... will retry in %" PRId64 "ms.", this,
+              timeout);
+    } else {
+      gpr_log(GPR_INFO, "HealthCheckClient %p: ... retrying immediately.",
+              this);
+    }
+  }
+  // Ref for callback, tracked manually.
+  Ref(DEBUG_LOCATION, "health_retry_timer").release();
+  retry_timer_callback_pending_ = true;
+  grpc_timer_init(&retry_timer_, next_try, &retry_timer_callback_);
+}
+
+void HealthCheckClient::OnRetryTimer(void* arg, grpc_error* error) {
+  HealthCheckClient* self = static_cast<HealthCheckClient*>(arg);
+  {
+    MutexLock lock(&self->mu_);
+    self->retry_timer_callback_pending_ = false;
+    if (!self->shutting_down_ && error == GRPC_ERROR_NONE &&
+        self->call_state_ == nullptr) {
+      if (grpc_health_check_client_trace.enabled()) {
+        gpr_log(GPR_INFO, "HealthCheckClient %p: restarting health check call",
+                self);
+      }
+      self->StartCallLocked();
+    }
+  }
+  self->Unref(DEBUG_LOCATION, "health_retry_timer");
+}
+
+//
+// protobuf helpers
+//
+
+namespace {
+
+void EncodeRequest(const char* service_name,
+                   ManualConstructor<SliceBufferByteStream>* send_message) {
+  grpc_health_v1_HealthCheckRequest request_struct;
+  request_struct.has_service = true;
+  snprintf(request_struct.service, sizeof(request_struct.service), "%s",
+           service_name);
+  pb_ostream_t ostream;
+  memset(&ostream, 0, sizeof(ostream));
+  pb_encode(&ostream, grpc_health_v1_HealthCheckRequest_fields,
+            &request_struct);
+  grpc_slice request_slice = GRPC_SLICE_MALLOC(ostream.bytes_written);
+  ostream = pb_ostream_from_buffer(GRPC_SLICE_START_PTR(request_slice),
+                                   GRPC_SLICE_LENGTH(request_slice));
+  GPR_ASSERT(pb_encode(&ostream, grpc_health_v1_HealthCheckRequest_fields,
+                       &request_struct) != 0);
+  grpc_slice_buffer slice_buffer;
+  grpc_slice_buffer_init(&slice_buffer);
+  grpc_slice_buffer_add(&slice_buffer, request_slice);
+  send_message->Init(&slice_buffer, 0);
+  grpc_slice_buffer_destroy_internal(&slice_buffer);
+}
+
+// Returns true if healthy.
+// If there was an error parsing the response, sets *error and returns false.
+bool DecodeResponse(grpc_slice_buffer* slice_buffer, grpc_error** error) {
+  // If message is empty, assume unhealthy.
+  if (slice_buffer->length == 0) {
+    *error =
+        GRPC_ERROR_CREATE_FROM_STATIC_STRING("health check response was empty");
+    return false;
+  }
+  // Concatenate the slices to form a single string.
+  UniquePtr<uint8_t> recv_message_deleter;
+  uint8_t* recv_message;
+  if (slice_buffer->count == 1) {
+    recv_message = GRPC_SLICE_START_PTR(slice_buffer->slices[0]);
+  } else {
+    recv_message = static_cast<uint8_t*>(gpr_malloc(slice_buffer->length));
+    recv_message_deleter.reset(recv_message);
+    size_t offset = 0;
+    for (size_t i = 0; i < slice_buffer->count; ++i) {
+      memcpy(recv_message + offset,
+             GRPC_SLICE_START_PTR(slice_buffer->slices[i]),
+             GRPC_SLICE_LENGTH(slice_buffer->slices[i]));
+      offset += GRPC_SLICE_LENGTH(slice_buffer->slices[i]);
+    }
+  }
+  // Deserialize message.
+  grpc_health_v1_HealthCheckResponse response_struct;
+  pb_istream_t istream =
+      pb_istream_from_buffer(recv_message, slice_buffer->length);
+  if (!pb_decode(&istream, grpc_health_v1_HealthCheckResponse_fields,
+                 &response_struct)) {
+    // Can't parse message; assume unhealthy.
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "cannot parse health check response");
+    return false;
+  }
+  if (!response_struct.has_status) {
+    // Field not present; assume unhealthy.
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "status field not present in health check response");
+    return false;
+  }
+  return response_struct.status ==
+         grpc_health_v1_HealthCheckResponse_ServingStatus_SERVING;
+}
+
+}  // namespace
+
+//
+// HealthCheckClient::CallState
+//
+
+HealthCheckClient::CallState::CallState(
+    RefCountedPtr<HealthCheckClient> health_check_client,
+    grpc_pollset_set* interested_parties)
+    : InternallyRefCountedWithTracing<CallState>(
+          &grpc_health_check_client_trace),
+      health_check_client_(std::move(health_check_client)),
+      pollent_(grpc_polling_entity_create_from_pollset_set(interested_parties)),
+      arena_(gpr_arena_create(health_check_client_->connected_subchannel_
+                                  ->GetInitialCallSizeEstimate(0))) {
+  memset(&call_combiner_, 0, sizeof(call_combiner_));
+  grpc_call_combiner_init(&call_combiner_);
+  memset(context_, 0, sizeof(context_));
+  gpr_atm_rel_store(&seen_response_, static_cast<gpr_atm>(0));
+}
+
+HealthCheckClient::CallState::~CallState() {
+  if (grpc_health_check_client_trace.enabled()) {
+    gpr_log(GPR_INFO, "HealthCheckClient %p: destroying CallState %p",
+            health_check_client_.get(), this);
+  }
+  if (call_ != nullptr) GRPC_SUBCHANNEL_CALL_UNREF(call_, "call_ended");
+  // Unset the call combiner cancellation closure.  This has the
+  // effect of scheduling the previously set cancellation closure, if
+  // any, so that it can release any internal references it may be
+  // holding to the call stack. Also flush the closures on exec_ctx so that
+  // filters that schedule cancel notification closures on exec_ctx do not
+  // need to take a ref of the call stack to guarantee closure liveness.
+  grpc_call_combiner_set_notify_on_cancel(&call_combiner_, nullptr);
+  grpc_core::ExecCtx::Get()->Flush();
+  grpc_call_combiner_destroy(&call_combiner_);
+  gpr_arena_destroy(arena_);
+}
+
+void HealthCheckClient::CallState::Orphan() {
+  grpc_call_combiner_cancel(&call_combiner_, GRPC_ERROR_CANCELLED);
+  Cancel();
+}
+
+void HealthCheckClient::CallState::StartCall() {
+  ConnectedSubchannel::CallArgs args = {
+      &pollent_,
+      GRPC_MDSTR_SLASH_GRPC_DOT_HEALTH_DOT_V1_DOT_HEALTH_SLASH_WATCH,
+      gpr_now(GPR_CLOCK_MONOTONIC),  // start_time
+      GRPC_MILLIS_INF_FUTURE,        // deadline
+      arena_,
+      context_,
+      &call_combiner_,
+      0,  // parent_data_size
+  };
+  grpc_error* error =
+      health_check_client_->connected_subchannel_->CreateCall(args, &call_);
+  if (error != GRPC_ERROR_NONE) {
+    gpr_log(GPR_ERROR,
+            "HealthCheckClient %p CallState %p: error creating health "
+            "checking call on subchannel (%s); will retry",
+            health_check_client_.get(), this, grpc_error_string(error));
+    GRPC_ERROR_UNREF(error);
+    // Schedule instead of running directly, since we must not be
+    // holding health_check_client_->mu_ when CallEnded() is called.
+    Ref(DEBUG_LOCATION, "call_end_closure").release();
+    GRPC_CLOSURE_SCHED(
+        GRPC_CLOSURE_INIT(&batch_.handler_private.closure, CallEndedRetry, this,
+                          grpc_schedule_on_exec_ctx),
+        GRPC_ERROR_NONE);
+    return;
+  }
+  // Initialize payload and batch.
+  memset(&batch_, 0, sizeof(batch_));
+  batch_.payload = &payload_;
+  // on_complete callback takes ref, handled manually.
+  Ref(DEBUG_LOCATION, "on_complete").release();
+  batch_.on_complete = GRPC_CLOSURE_INIT(&on_complete_, OnComplete, this,
+                                         grpc_schedule_on_exec_ctx);
+  // Add send_initial_metadata op.
+  grpc_metadata_batch_init(&send_initial_metadata_);
+  error = grpc_metadata_batch_add_head(
+      &send_initial_metadata_, &path_metadata_storage_,
+      grpc_mdelem_from_slices(
+          GRPC_MDSTR_PATH,
+          GRPC_MDSTR_SLASH_GRPC_DOT_HEALTH_DOT_V1_DOT_HEALTH_SLASH_WATCH));
+  GPR_ASSERT(error == GRPC_ERROR_NONE);
+  payload_.send_initial_metadata.send_initial_metadata =
+      &send_initial_metadata_;
+  payload_.send_initial_metadata.send_initial_metadata_flags = 0;
+  payload_.send_initial_metadata.peer_string = nullptr;
+  batch_.send_initial_metadata = true;
+  // Add send_message op.
+  EncodeRequest(health_check_client_->service_name_, &send_message_);
+  payload_.send_message.send_message.reset(send_message_.get());
+  batch_.send_message = true;
+  // Add send_trailing_metadata op.
+  grpc_metadata_batch_init(&send_trailing_metadata_);
+  payload_.send_trailing_metadata.send_trailing_metadata =
+      &send_trailing_metadata_;
+  batch_.send_trailing_metadata = true;
+  // Add recv_initial_metadata op.
+  grpc_metadata_batch_init(&recv_initial_metadata_);
+  payload_.recv_initial_metadata.recv_initial_metadata =
+      &recv_initial_metadata_;
+  payload_.recv_initial_metadata.recv_flags = nullptr;
+  payload_.recv_initial_metadata.trailing_metadata_available = nullptr;
+  payload_.recv_initial_metadata.peer_string = nullptr;
+  // recv_initial_metadata_ready callback takes ref, handled manually.
+  Ref(DEBUG_LOCATION, "recv_initial_metadata_ready").release();
+  payload_.recv_initial_metadata.recv_initial_metadata_ready =
+      GRPC_CLOSURE_INIT(&recv_initial_metadata_ready_, RecvInitialMetadataReady,
+                        this, grpc_schedule_on_exec_ctx);
+  batch_.recv_initial_metadata = true;
+  // Add recv_message op.
+  payload_.recv_message.recv_message = &recv_message_;
+  // recv_message callback takes ref, handled manually.
+  Ref(DEBUG_LOCATION, "recv_message_ready").release();
+  payload_.recv_message.recv_message_ready = GRPC_CLOSURE_INIT(
+      &recv_message_ready_, RecvMessageReady, this, grpc_schedule_on_exec_ctx);
+  batch_.recv_message = true;
+  // Start batch.
+  StartBatch(&batch_);
+  // Initialize recv_trailing_metadata batch.
+  memset(&recv_trailing_metadata_batch_, 0,
+         sizeof(recv_trailing_metadata_batch_));
+  recv_trailing_metadata_batch_.payload = &payload_;
+  // Add recv_trailing_metadata op.
+  grpc_metadata_batch_init(&recv_trailing_metadata_);
+  payload_.recv_trailing_metadata.recv_trailing_metadata =
+      &recv_trailing_metadata_;
+  payload_.recv_trailing_metadata.collect_stats = &collect_stats_;
+  // This callback signals the end of the call, so it relies on the
+  // initial ref instead of taking a new ref.  When it's invoked, the
+  // initial ref is released.
+  payload_.recv_trailing_metadata.recv_trailing_metadata_ready =
+      GRPC_CLOSURE_INIT(&recv_trailing_metadata_ready_,
+                        RecvTrailingMetadataReady, this,
+                        grpc_schedule_on_exec_ctx);
+  recv_trailing_metadata_batch_.recv_trailing_metadata = true;
+  // Start recv_trailing_metadata batch.
+  StartBatch(&recv_trailing_metadata_batch_);
+}
+
+void HealthCheckClient::CallState::StartBatchInCallCombiner(void* arg,
+                                                            grpc_error* error) {
+  grpc_transport_stream_op_batch* batch =
+      static_cast<grpc_transport_stream_op_batch*>(arg);
+  grpc_subchannel_call* call =
+      static_cast<grpc_subchannel_call*>(batch->handler_private.extra_arg);
+  grpc_subchannel_call_process_op(call, batch);
+}
+
+void HealthCheckClient::CallState::StartBatch(
+    grpc_transport_stream_op_batch* batch) {
+  batch->handler_private.extra_arg = call_;
+  GRPC_CLOSURE_INIT(&batch->handler_private.closure, StartBatchInCallCombiner,
+                    batch, grpc_schedule_on_exec_ctx);
+  GRPC_CALL_COMBINER_START(&call_combiner_, &batch->handler_private.closure,
+                           GRPC_ERROR_NONE, "start_subchannel_batch");
+}
+
+void HealthCheckClient::CallState::OnCancelComplete(void* arg,
+                                                    grpc_error* error) {
+  HealthCheckClient::CallState* self =
+      static_cast<HealthCheckClient::CallState*>(arg);
+  GRPC_CALL_COMBINER_STOP(&self->call_combiner_, "health_cancel");
+  self->Unref(DEBUG_LOCATION, "cancel");
+}
+
+void HealthCheckClient::CallState::StartCancel(void* arg, grpc_error* error) {
+  HealthCheckClient::CallState* self =
+      static_cast<HealthCheckClient::CallState*>(arg);
+  auto* batch = grpc_make_transport_stream_op(
+      GRPC_CLOSURE_CREATE(OnCancelComplete, self, grpc_schedule_on_exec_ctx));
+  batch->cancel_stream = true;
+  batch->payload->cancel_stream.cancel_error = GRPC_ERROR_CANCELLED;
+  grpc_subchannel_call_process_op(self->call_, batch);
+}
+
+void HealthCheckClient::CallState::Cancel() {
+  if (call_ != nullptr) {
+    Ref(DEBUG_LOCATION, "cancel").release();
+    GRPC_CALL_COMBINER_START(
+        &call_combiner_,
+        GRPC_CLOSURE_CREATE(StartCancel, this, grpc_schedule_on_exec_ctx),
+        GRPC_ERROR_NONE, "health_cancel");
+  }
+}
+
+void HealthCheckClient::CallState::OnComplete(void* arg, grpc_error* error) {
+  HealthCheckClient::CallState* self =
+      static_cast<HealthCheckClient::CallState*>(arg);
+  GRPC_CALL_COMBINER_STOP(&self->call_combiner_, "on_complete");
+  grpc_metadata_batch_destroy(&self->send_initial_metadata_);
+  grpc_metadata_batch_destroy(&self->send_trailing_metadata_);
+  self->Unref(DEBUG_LOCATION, "on_complete");
+}
+
+void HealthCheckClient::CallState::RecvInitialMetadataReady(void* arg,
+                                                            grpc_error* error) {
+  HealthCheckClient::CallState* self =
+      static_cast<HealthCheckClient::CallState*>(arg);
+  GRPC_CALL_COMBINER_STOP(&self->call_combiner_, "recv_initial_metadata_ready");
+  grpc_metadata_batch_destroy(&self->recv_initial_metadata_);
+  self->Unref(DEBUG_LOCATION, "recv_initial_metadata_ready");
+}
+
+void HealthCheckClient::CallState::DoneReadingRecvMessage(grpc_error* error) {
+  recv_message_.reset();
+  if (error != GRPC_ERROR_NONE) {
+    GRPC_ERROR_UNREF(error);
+    Cancel();
+    grpc_slice_buffer_destroy_internal(&recv_message_buffer_);
+    Unref(DEBUG_LOCATION, "recv_message_ready");
+    return;
+  }
+  const bool healthy = DecodeResponse(&recv_message_buffer_, &error);
+  const grpc_connectivity_state state =
+      healthy ? GRPC_CHANNEL_READY : GRPC_CHANNEL_TRANSIENT_FAILURE;
+  if (error == GRPC_ERROR_NONE && !healthy) {
+    error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("backend unhealthy");
+  }
+  health_check_client_->SetHealthStatus(state, error);
+  gpr_atm_rel_store(&seen_response_, static_cast<gpr_atm>(1));
+  grpc_slice_buffer_destroy_internal(&recv_message_buffer_);
+  // Start another recv_message batch.
+  // This re-uses the ref we're holding.
+  // Note: Can't just reuse batch_ here, since we don't know that all
+  // callbacks from the original batch have completed yet.
+  memset(&recv_message_batch_, 0, sizeof(recv_message_batch_));
+  recv_message_batch_.payload = &payload_;
+  payload_.recv_message.recv_message = &recv_message_;
+  payload_.recv_message.recv_message_ready = GRPC_CLOSURE_INIT(
+      &recv_message_ready_, RecvMessageReady, this, grpc_schedule_on_exec_ctx);
+  recv_message_batch_.recv_message = true;
+  StartBatch(&recv_message_batch_);
+}
+
+grpc_error* HealthCheckClient::CallState::PullSliceFromRecvMessage() {
+  grpc_slice slice;
+  grpc_error* error = recv_message_->Pull(&slice);
+  if (error == GRPC_ERROR_NONE) {
+    grpc_slice_buffer_add(&recv_message_buffer_, slice);
+  }
+  return error;
+}
+
+void HealthCheckClient::CallState::ContinueReadingRecvMessage() {
+  while (recv_message_->Next(SIZE_MAX, &recv_message_ready_)) {
+    grpc_error* error = PullSliceFromRecvMessage();
+    if (error != GRPC_ERROR_NONE) {
+      DoneReadingRecvMessage(error);
+      return;
+    }
+    if (recv_message_buffer_.length == recv_message_->length()) {
+      DoneReadingRecvMessage(GRPC_ERROR_NONE);
+      break;
+    }
+  }
+}
+
+void HealthCheckClient::CallState::OnByteStreamNext(void* arg,
+                                                    grpc_error* error) {
+  HealthCheckClient::CallState* self =
+      static_cast<HealthCheckClient::CallState*>(arg);
+  if (error != GRPC_ERROR_NONE) {
+    self->DoneReadingRecvMessage(GRPC_ERROR_REF(error));
+    return;
+  }
+  error = self->PullSliceFromRecvMessage();
+  if (error != GRPC_ERROR_NONE) {
+    self->DoneReadingRecvMessage(error);
+    return;
+  }
+  if (self->recv_message_buffer_.length == self->recv_message_->length()) {
+    self->DoneReadingRecvMessage(GRPC_ERROR_NONE);
+  } else {
+    self->ContinueReadingRecvMessage();
+  }
+}
+
+void HealthCheckClient::CallState::RecvMessageReady(void* arg,
+                                                    grpc_error* error) {
+  HealthCheckClient::CallState* self =
+      static_cast<HealthCheckClient::CallState*>(arg);
+  GRPC_CALL_COMBINER_STOP(&self->call_combiner_, "recv_message_ready");
+  if (self->recv_message_ == nullptr) {
+    self->Unref(DEBUG_LOCATION, "recv_message_ready");
+    return;
+  }
+  grpc_slice_buffer_init(&self->recv_message_buffer_);
+  GRPC_CLOSURE_INIT(&self->recv_message_ready_, OnByteStreamNext, self,
+                    grpc_schedule_on_exec_ctx);
+  self->ContinueReadingRecvMessage();
+  // Ref will continue to be held until we finish draining the byte stream.
+}
+
+void HealthCheckClient::CallState::RecvTrailingMetadataReady(
+    void* arg, grpc_error* error) {
+  HealthCheckClient::CallState* self =
+      static_cast<HealthCheckClient::CallState*>(arg);
+  GRPC_CALL_COMBINER_STOP(&self->call_combiner_,
+                          "recv_trailing_metadata_ready");
+  // Get call status.
+  grpc_status_code status = GRPC_STATUS_UNKNOWN;
+  if (error != GRPC_ERROR_NONE) {
+    grpc_error_get_status(error, GRPC_MILLIS_INF_FUTURE, &status,
+                          nullptr /* slice */, nullptr /* http_error */,
+                          nullptr /* error_string */);
+  } else if (self->recv_trailing_metadata_.idx.named.grpc_status != nullptr) {
+    status = grpc_get_status_code_from_metadata(
+        self->recv_trailing_metadata_.idx.named.grpc_status->md);
+  }
+  if (grpc_health_check_client_trace.enabled()) {
+    gpr_log(GPR_INFO,
+            "HealthCheckClient %p CallState %p: health watch failed with "
+            "status %d",
+            self->health_check_client_.get(), self, status);
+  }
+  // Clean up.
+  grpc_metadata_batch_destroy(&self->recv_trailing_metadata_);
+  // For status UNIMPLEMENTED, give up and assume always healthy.
+  bool retry = true;
+  if (status == GRPC_STATUS_UNIMPLEMENTED) {
+    static const char kErrorMessage[] =
+        "health checking Watch method returned UNIMPLEMENTED; "
+        "disabling health checks but assuming server is healthy";
+    gpr_log(GPR_ERROR, kErrorMessage);
+    if (self->health_check_client_->channelz_node_ != nullptr) {
+      self->health_check_client_->channelz_node_->AddTraceEvent(
+          channelz::ChannelTrace::Error,
+          grpc_slice_from_static_string(kErrorMessage));
+    }
+    self->health_check_client_->SetHealthStatus(GRPC_CHANNEL_READY,
+                                                GRPC_ERROR_NONE);
+    retry = false;
+  }
+  self->CallEnded(retry);
+}
+
+void HealthCheckClient::CallState::CallEndedRetry(void* arg,
+                                                  grpc_error* error) {
+  HealthCheckClient::CallState* self =
+      static_cast<HealthCheckClient::CallState*>(arg);
+  self->CallEnded(true /* retry */);
+  self->Unref(DEBUG_LOCATION, "call_end_closure");
+}
+
+void HealthCheckClient::CallState::CallEnded(bool retry) {
+  // If this CallState is still in use, this call ended because of a failure,
+  // so we need to stop using it and optionally create a new one.
+  // Otherwise, we have deliberately ended this call, and no further action
+  // is required.
+  if (this == health_check_client_->call_state_.get()) {
+    health_check_client_->call_state_.reset();
+    if (retry) {
+      GPR_ASSERT(!health_check_client_->shutting_down_);
+      if (static_cast<bool>(gpr_atm_acq_load(&seen_response_))) {
+        // If the call fails after we've gotten a successful response, reset
+        // the backoff and restart the call immediately.
+        health_check_client_->retry_backoff_.Reset();
+        health_check_client_->StartCall();
+      } else {
+        // If the call failed without receiving any messages, retry later.
+        health_check_client_->StartRetryTimer();
+      }
+    }
+  }
+  Unref(DEBUG_LOCATION, "call_ended");
+}
+
+}  // namespace grpc_core

src/core/ext/filters/client_channel/health/health_check_client.h

@@ -0,0 +1,173 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef GRPC_CORE_EXT_FILTERS_CLIENT_CHANNEL_HEALTH_HEALTH_CHECK_CLIENT_H
+#define GRPC_CORE_EXT_FILTERS_CLIENT_CHANNEL_HEALTH_HEALTH_CHECK_CLIENT_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc.h>
+#include <grpc/support/atm.h>
+#include <grpc/support/sync.h>
+
+#include "src/core/ext/filters/client_channel/client_channel_channelz.h"
+#include "src/core/ext/filters/client_channel/subchannel.h"
+#include "src/core/lib/backoff/backoff.h"
+#include "src/core/lib/gpr/arena.h"
+#include "src/core/lib/gprpp/orphanable.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/call_combiner.h"
+#include "src/core/lib/iomgr/closure.h"
+#include "src/core/lib/iomgr/polling_entity.h"
+#include "src/core/lib/iomgr/timer.h"
+#include "src/core/lib/transport/byte_stream.h"
+#include "src/core/lib/transport/metadata_batch.h"
+#include "src/core/lib/transport/transport.h"
+
+namespace grpc_core {
+
+class HealthCheckClient
+    : public InternallyRefCountedWithTracing<HealthCheckClient> {
+ public:
+  HealthCheckClient(const char* service_name,
+                    RefCountedPtr<ConnectedSubchannel> connected_subchannel,
+                    grpc_pollset_set* interested_parties,
+                    RefCountedPtr<channelz::SubchannelNode> channelz_node);
+
+  ~HealthCheckClient();
+
+  // When the health state changes from *state, sets *state to the new
+  // value and schedules closure.
+  // Only one closure can be outstanding at a time.
+  void NotifyOnHealthChange(grpc_connectivity_state* state,
+                            grpc_closure* closure);
+
+  void Orphan() override;
+
+ private:
+  // Contains a call to the backend and all the data related to the call.
+  class CallState : public InternallyRefCountedWithTracing<CallState> {
+   public:
+    CallState(RefCountedPtr<HealthCheckClient> health_check_client,
+              grpc_pollset_set* interested_parties_);
+    ~CallState();
+
+    void Orphan() override;
+
+    void StartCall();
+
+   private:
+    void Cancel();
+
+    void StartBatch(grpc_transport_stream_op_batch* batch);
+    static void StartBatchInCallCombiner(void* arg, grpc_error* error);
+
+    static void CallEndedRetry(void* arg, grpc_error* error);
+    void CallEnded(bool retry);
+
+    static void OnComplete(void* arg, grpc_error* error);
+    static void RecvInitialMetadataReady(void* arg, grpc_error* error);
+    static void RecvMessageReady(void* arg, grpc_error* error);
+    static void RecvTrailingMetadataReady(void* arg, grpc_error* error);
+    static void StartCancel(void* arg, grpc_error* error);
+    static void OnCancelComplete(void* arg, grpc_error* error);
+
+    static void OnByteStreamNext(void* arg, grpc_error* error);
+    void ContinueReadingRecvMessage();
+    grpc_error* PullSliceFromRecvMessage();
+    void DoneReadingRecvMessage(grpc_error* error);
+
+    RefCountedPtr<HealthCheckClient> health_check_client_;
+    grpc_polling_entity pollent_;
+
+    gpr_arena* arena_;
+    grpc_call_combiner call_combiner_;
+    grpc_call_context_element context_[GRPC_CONTEXT_COUNT];
+
+    // The streaming call to the backend. Always non-NULL.
+    grpc_subchannel_call* call_;
+
+    grpc_transport_stream_op_batch_payload payload_;
+    grpc_transport_stream_op_batch batch_;
+    grpc_transport_stream_op_batch recv_message_batch_;
+    grpc_transport_stream_op_batch recv_trailing_metadata_batch_;
+
+    grpc_closure on_complete_;
+
+    // send_initial_metadata
+    grpc_metadata_batch send_initial_metadata_;
+    grpc_linked_mdelem path_metadata_storage_;
+
+    // send_message
+    ManualConstructor<SliceBufferByteStream> send_message_;
+
+    // send_trailing_metadata
+    grpc_metadata_batch send_trailing_metadata_;
+
+    // recv_initial_metadata
+    grpc_metadata_batch recv_initial_metadata_;
+    grpc_closure recv_initial_metadata_ready_;
+
+    // recv_message
+    OrphanablePtr<ByteStream> recv_message_;
+    grpc_closure recv_message_ready_;
+    grpc_slice_buffer recv_message_buffer_;
+    gpr_atm seen_response_;
+
+    // recv_trailing_metadata
+    grpc_metadata_batch recv_trailing_metadata_;
+    grpc_transport_stream_stats collect_stats_;
+    grpc_closure recv_trailing_metadata_ready_;
+  };
+
+  void StartCall();
+  void StartCallLocked();  // Requires holding mu_.
+
+  void StartRetryTimer();
+  static void OnRetryTimer(void* arg, grpc_error* error);
+
+  void SetHealthStatus(grpc_connectivity_state state, grpc_error* error);
+  void SetHealthStatusLocked(grpc_connectivity_state state,
+                             grpc_error* error);  // Requires holding mu_.
+
+  const char* service_name_;  // Do not own.
+  RefCountedPtr<ConnectedSubchannel> connected_subchannel_;
+  grpc_pollset_set* interested_parties_;  // Do not own.
+  RefCountedPtr<channelz::SubchannelNode> channelz_node_;
+
+  gpr_mu mu_;
+  grpc_connectivity_state state_ = GRPC_CHANNEL_CONNECTING;
+  grpc_error* error_ = GRPC_ERROR_NONE;
+  grpc_connectivity_state* notify_state_ = nullptr;
+  grpc_closure* on_health_changed_ = nullptr;
+  bool shutting_down_ = false;
+
+  // The data associated with the current health check call.  It holds a ref
+  // to this HealthCheckClient object.
+  OrphanablePtr<CallState> call_state_;
+
+  // Call retry state.
+  BackOff retry_backoff_;
+  grpc_timer retry_timer_;
+  grpc_closure retry_timer_callback_;
+  bool retry_timer_callback_pending_ = false;
+};
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_EXT_FILTERS_CLIENT_CHANNEL_HEALTH_HEALTH_CHECK_CLIENT_H */

src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.cc

@@ -1699,7 +1699,7 @@ grpc_channel_args* GrpcLb::CreateRoundRobinPolicyArgsLocked() {
   // Replace the LB addresses in the channel args that we pass down to
   // the subchannel.
   static const char* keys_to_remove[] = {GRPC_ARG_LB_ADDRESSES};
-  const grpc_arg args_to_add[] = {
+  grpc_arg args_to_add[3] = {
       grpc_lb_addresses_create_channel_arg(addresses),
       // A channel arg indicating if the target is a backend inferred from a
       // grpclb load balancer.
@@ -1708,9 +1708,15 @@ grpc_channel_args* GrpcLb::CreateRoundRobinPolicyArgsLocked() {
               GRPC_ARG_ADDRESS_IS_BACKEND_FROM_GRPCLB_LOAD_BALANCER),
           is_backend_from_grpclb_load_balancer),
   };
+  size_t num_args_to_add = 2;
+  if (is_backend_from_grpclb_load_balancer) {
+    args_to_add[2] = grpc_channel_arg_integer_create(
+        const_cast<char*>(GRPC_ARG_INHIBIT_HEALTH_CHECKING), 1);
+    ++num_args_to_add;
+  }
   grpc_channel_args* args = grpc_channel_args_copy_and_add_and_remove(
       args_, keys_to_remove, GPR_ARRAY_SIZE(keys_to_remove), args_to_add,
-      GPR_ARRAY_SIZE(args_to_add));
+      num_args_to_add);
   grpc_lb_addresses_destroy(addresses);
   return args;
 }

src/core/ext/filters/client_channel/lb_policy/pick_first/pick_first.cc

@@ -359,9 +359,14 @@ void PickFirst::UpdateLocked(const grpc_channel_args& args) {
             "Pick First %p received update with %" PRIuPTR " addresses", this,
             addresses->num_addresses);
   }
+  grpc_arg new_arg = grpc_channel_arg_integer_create(
+      const_cast<char*>(GRPC_ARG_INHIBIT_HEALTH_CHECKING), 1);
+  grpc_channel_args* new_args =
+      grpc_channel_args_copy_and_add(&args, &new_arg, 1);
   auto subchannel_list = MakeOrphanable<PickFirstSubchannelList>(
       this, &grpc_lb_pick_first_trace, addresses, combiner(),
-      client_channel_factory(), args);
+      client_channel_factory(), *new_args);
+  grpc_channel_args_destroy(new_args);
   if (subchannel_list->num_subchannels() == 0) {
     // Empty update or no valid subchannels. Unsubscribe from all current
     // subchannels and put the channel in TRANSIENT_FAILURE.

src/core/ext/filters/client_channel/lb_policy/subchannel_list.h

@@ -102,8 +102,8 @@ class SubchannelData {
   // ProcessConnectivityChangeLocked()).
   grpc_connectivity_state CheckConnectivityStateLocked(grpc_error** error) {
     GPR_ASSERT(!connectivity_notification_pending_);
-    pending_connectivity_state_unsafe_ =
-        grpc_subchannel_check_connectivity(subchannel(), error);
+    pending_connectivity_state_unsafe_ = grpc_subchannel_check_connectivity(
+        subchannel(), error, subchannel_list_->inhibit_health_checking());
     UpdateConnectedSubchannelLocked();
     return pending_connectivity_state_unsafe_;
   }
@@ -216,6 +216,7 @@ class SubchannelList
   // Accessors.
   LoadBalancingPolicy* policy() const { return policy_; }
   TraceFlag* tracer() const { return tracer_; }
+  bool inhibit_health_checking() const { return inhibit_health_checking_; }
 
   // Resets connection backoff of all subchannels.
   // TODO(roth): We will probably need to rethink this as part of moving
@@ -254,6 +255,8 @@ class SubchannelList
 
   TraceFlag* tracer_;
 
+  bool inhibit_health_checking_;
+
   grpc_combiner* combiner_;
 
   // The list of subchannels.
@@ -340,7 +343,8 @@ void SubchannelData<SubchannelListType,
   subchannel_list()->Ref(DEBUG_LOCATION, "connectivity_watch").release();
   grpc_subchannel_notify_on_state_change(
       subchannel_, subchannel_list_->policy()->interested_parties(),
-      &pending_connectivity_state_unsafe_, &connectivity_changed_closure_);
+      &pending_connectivity_state_unsafe_, &connectivity_changed_closure_,
+      subchannel_list_->inhibit_health_checking());
 }
 
 template <typename SubchannelListType, typename SubchannelDataType>
@@ -359,7 +363,8 @@ void SubchannelData<SubchannelListType,
   GPR_ASSERT(connectivity_notification_pending_);
   grpc_subchannel_notify_on_state_change(
       subchannel_, subchannel_list_->policy()->interested_parties(),
-      &pending_connectivity_state_unsafe_, &connectivity_changed_closure_);
+      &pending_connectivity_state_unsafe_, &connectivity_changed_closure_,
+      subchannel_list_->inhibit_health_checking());
 }
 
 template <typename SubchannelListType, typename SubchannelDataType>
@@ -390,8 +395,9 @@ void SubchannelData<SubchannelListType, SubchannelDataType>::
             subchannel_, reason);
   }
   GPR_ASSERT(connectivity_notification_pending_);
-  grpc_subchannel_notify_on_state_change(subchannel_, nullptr, nullptr,
-                                         &connectivity_changed_closure_);
+  grpc_subchannel_notify_on_state_change(
+      subchannel_, nullptr, nullptr, &connectivity_changed_closure_,
+      subchannel_list_->inhibit_health_checking());
 }
 
 template <typename SubchannelListType, typename SubchannelDataType>
@@ -499,8 +505,13 @@ SubchannelList<SubchannelListType, SubchannelDataType>::SubchannelList(
   subchannels_.reserve(addresses->num_addresses);
   // We need to remove the LB addresses in order to be able to compare the
   // subchannel keys of subchannels from a different batch of addresses.
+  // We also remove the inhibit-health-checking arg, since we are
+  // handling that here.
+  inhibit_health_checking_ = grpc_channel_arg_get_bool(
+      grpc_channel_args_find(&args, GRPC_ARG_INHIBIT_HEALTH_CHECKING), false);
   static const char* keys_to_remove[] = {GRPC_ARG_SUBCHANNEL_ADDRESS,
-                                         GRPC_ARG_LB_ADDRESSES};
+                                         GRPC_ARG_LB_ADDRESSES,
+                                         GRPC_ARG_INHIBIT_HEALTH_CHECKING};
   // Create a subchannel for each address.
   grpc_subchannel_args sc_args;
   for (size_t i = 0; i < addresses->num_addresses; i++) {

src/core/ext/filters/client_channel/subchannel.cc

@@ -30,6 +30,7 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/ext/filters/client_channel/client_channel.h"
+#include "src/core/ext/filters/client_channel/health/health_check_client.h"
 #include "src/core/ext/filters/client_channel/parse_address.h"
 #include "src/core/ext/filters/client_channel/proxy_mapper_registry.h"
 #include "src/core/ext/filters/client_channel/subchannel_index.h"
@@ -41,6 +42,7 @@
 #include "src/core/lib/gpr/alloc.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/manual_constructor.h"
+#include "src/core/lib/gprpp/mutex_lock.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/sockaddr_utils.h"
 #include "src/core/lib/iomgr/timer.h"
@@ -50,6 +52,7 @@
 #include "src/core/lib/surface/channel_init.h"
 #include "src/core/lib/transport/connectivity_state.h"
 #include "src/core/lib/transport/error_utils.h"
+#include "src/core/lib/transport/service_config.h"
 #include "src/core/lib/transport/status_metadata.h"
 
 #define INTERNAL_REF_BITS 16
@@ -66,6 +69,10 @@ struct state_watcher {
   grpc_closure closure;
   grpc_subchannel* subchannel;
   grpc_connectivity_state connectivity_state;
+  grpc_connectivity_state last_connectivity_state;
+  grpc_core::OrphanablePtr<grpc_core::HealthCheckClient> health_check_client;
+  grpc_closure health_check_closure;
+  grpc_connectivity_state health_state;
 };
 }  // namespace
 
@@ -78,6 +85,12 @@ typedef struct external_state_watcher {
   struct external_state_watcher* prev;
 } external_state_watcher;
 
+namespace grpc_core {
+
+class ConnectedSubchannelStateWatcher;
+
+}  // namespace grpc_core
+
 struct grpc_subchannel {
   grpc_connector* connector;
 
@@ -109,19 +122,24 @@ struct grpc_subchannel {
       being setup */
   grpc_pollset_set* pollset_set;
 
+  grpc_core::UniquePtr<char> health_check_service_name;
+
   /** mutex protecting remaining elements */
   gpr_mu mu;
 
-  /** active connection, or null; of type grpc_core::ConnectedSubchannel
-   */
+  /** active connection, or null */
   grpc_core::RefCountedPtr<grpc_core::ConnectedSubchannel> connected_subchannel;
+  grpc_core::OrphanablePtr<grpc_core::ConnectedSubchannelStateWatcher>
+      connected_subchannel_watcher;
 
   /** have we seen a disconnection? */
   bool disconnected;
   /** are we connecting */
   bool connecting;
+
   /** connectivity state tracking */
   grpc_connectivity_state_tracker state_tracker;
+  grpc_connectivity_state_tracker state_and_health_tracker;
 
   external_state_watcher root_external_state_watcher;
 
@@ -153,6 +171,171 @@ struct grpc_subchannel_call {
   grpc_millis deadline;
 };
 
+static void maybe_start_connecting_locked(grpc_subchannel* c);
+
+static const char* subchannel_connectivity_state_change_string(
+    grpc_connectivity_state state) {
+  switch (state) {
+    case GRPC_CHANNEL_IDLE:
+      return "Subchannel state change to IDLE";
+    case GRPC_CHANNEL_CONNECTING:
+      return "Subchannel state change to CONNECTING";
+    case GRPC_CHANNEL_READY:
+      return "Subchannel state change to READY";
+    case GRPC_CHANNEL_TRANSIENT_FAILURE:
+      return "Subchannel state change to TRANSIENT_FAILURE";
+    case GRPC_CHANNEL_SHUTDOWN:
+      return "Subchannel state change to SHUTDOWN";
+  }
+  GPR_UNREACHABLE_CODE(return "UNKNOWN");
+}
+
+static void set_subchannel_connectivity_state_locked(
+    grpc_subchannel* c, grpc_connectivity_state state, grpc_error* error,
+    const char* reason) {
+  if (c->channelz_subchannel != nullptr) {
+    c->channelz_subchannel->AddTraceEvent(
+        grpc_core::channelz::ChannelTrace::Severity::Info,
+        grpc_slice_from_static_string(
+            subchannel_connectivity_state_change_string(state)));
+  }
+  grpc_connectivity_state_set(&c->state_tracker, state, error, reason);
+}
+
+namespace grpc_core {
+
+class ConnectedSubchannelStateWatcher
+    : public InternallyRefCounted<ConnectedSubchannelStateWatcher> {
+ public:
+  // Must be instantiated while holding c->mu.
+  explicit ConnectedSubchannelStateWatcher(grpc_subchannel* c)
+      : subchannel_(c) {
+    // Steal subchannel ref for connecting.
+    GRPC_SUBCHANNEL_WEAK_REF(subchannel_, "state_watcher");
+    GRPC_SUBCHANNEL_WEAK_UNREF(subchannel_, "connecting");
+    // Start watching for connectivity state changes.
+    // Callback uses initial ref to this.
+    GRPC_CLOSURE_INIT(&on_connectivity_changed_, OnConnectivityChanged, this,
+                      grpc_schedule_on_exec_ctx);
+    c->connected_subchannel->NotifyOnStateChange(c->pollset_set,
+                                                 &pending_connectivity_state_,
+                                                 &on_connectivity_changed_);
+    // Start health check if needed.
+    grpc_connectivity_state health_state = GRPC_CHANNEL_READY;
+    if (c->health_check_service_name != nullptr) {
+      health_check_client_ = grpc_core::MakeOrphanable<HealthCheckClient>(
+          c->health_check_service_name.get(), c->connected_subchannel,
+          c->pollset_set, c->channelz_subchannel);
+      GRPC_CLOSURE_INIT(&on_health_changed_, OnHealthChanged, this,
+                        grpc_schedule_on_exec_ctx);
+      Ref().release();  // Ref for health callback tracked manually.
+      health_check_client_->NotifyOnHealthChange(&health_state_,
+                                                 &on_health_changed_);
+      health_state = GRPC_CHANNEL_CONNECTING;
+    }
+    // Report initial state.
+    set_subchannel_connectivity_state_locked(
+        c, GRPC_CHANNEL_READY, GRPC_ERROR_NONE, "subchannel_connected");
+    grpc_connectivity_state_set(&c->state_and_health_tracker, health_state,
+                                GRPC_ERROR_NONE, "subchannel_connected");
+  }
+
+  ~ConnectedSubchannelStateWatcher() {
+    GRPC_SUBCHANNEL_WEAK_UNREF(subchannel_, "state_watcher");
+  }
+
+  void Orphan() override { health_check_client_.reset(); }
+
+ private:
+  static void OnConnectivityChanged(void* arg, grpc_error* error) {
+    auto* self = static_cast<ConnectedSubchannelStateWatcher*>(arg);
+    grpc_subchannel* c = self->subchannel_;
+    {
+      MutexLock lock(&c->mu);
+      switch (self->pending_connectivity_state_) {
+        case GRPC_CHANNEL_TRANSIENT_FAILURE:
+        case GRPC_CHANNEL_SHUTDOWN: {
+          if (!c->disconnected && c->connected_subchannel != nullptr) {
+            if (grpc_trace_stream_refcount.enabled()) {
+              gpr_log(GPR_INFO,
+                      "Connected subchannel %p of subchannel %p has gone into "
+                      "%s. Attempting to reconnect.",
+                      c->connected_subchannel.get(), c,
+                      grpc_connectivity_state_name(
+                          self->pending_connectivity_state_));
+            }
+            c->connected_subchannel.reset();
+            c->connected_subchannel_watcher.reset();
+            self->last_connectivity_state_ = GRPC_CHANNEL_TRANSIENT_FAILURE;
+            set_subchannel_connectivity_state_locked(
+                c, GRPC_CHANNEL_TRANSIENT_FAILURE, GRPC_ERROR_REF(error),
+                "reflect_child");
+            grpc_connectivity_state_set(&c->state_and_health_tracker,
+                                        GRPC_CHANNEL_TRANSIENT_FAILURE,
+                                        GRPC_ERROR_REF(error), "reflect_child");
+            c->backoff_begun = false;
+            c->backoff->Reset();
+            maybe_start_connecting_locked(c);
+          } else {
+            self->last_connectivity_state_ = GRPC_CHANNEL_SHUTDOWN;
+          }
+          self->health_check_client_.reset();
+          break;
+        }
+        default: {
+          // In principle, this should never happen.  We should not get
+          // a callback for READY, because that was the state we started
+          // this watch from.  And a connected subchannel should never go
+          // from READY to CONNECTING or IDLE.
+          self->last_connectivity_state_ = self->pending_connectivity_state_;
+          set_subchannel_connectivity_state_locked(
+              c, self->pending_connectivity_state_, GRPC_ERROR_REF(error),
+              "reflect_child");
+          if (self->pending_connectivity_state_ != GRPC_CHANNEL_READY) {
+            grpc_connectivity_state_set(&c->state_and_health_tracker,
+                                        self->pending_connectivity_state_,
+                                        GRPC_ERROR_REF(error), "reflect_child");
+          }
+          c->connected_subchannel->NotifyOnStateChange(
+              nullptr, &self->pending_connectivity_state_,
+              &self->on_connectivity_changed_);
+          self = nullptr;  // So we don't unref below.
+        }
+      }
+    }
+    // Don't unref until we've released the lock, because this might
+    // cause the subchannel (which contains the lock) to be destroyed.
+    if (self != nullptr) self->Unref();
+  }
+
+  static void OnHealthChanged(void* arg, grpc_error* error) {
+    auto* self = static_cast<ConnectedSubchannelStateWatcher*>(arg);
+    if (self->health_state_ == GRPC_CHANNEL_SHUTDOWN) {
+      self->Unref();
+      return;
+    }
+    grpc_subchannel* c = self->subchannel_;
+    MutexLock lock(&c->mu);
+    if (self->last_connectivity_state_ == GRPC_CHANNEL_READY) {
+      grpc_connectivity_state_set(&c->state_and_health_tracker,
+                                  self->health_state_, GRPC_ERROR_REF(error),
+                                  "health_changed");
+    }
+    self->health_check_client_->NotifyOnHealthChange(&self->health_state_,
+                                                     &self->on_health_changed_);
+  }
+
+  grpc_subchannel* subchannel_;
+  grpc_closure on_connectivity_changed_;
+  grpc_connectivity_state pending_connectivity_state_ = GRPC_CHANNEL_READY;
+  grpc_connectivity_state last_connectivity_state_ = GRPC_CHANNEL_READY;
+  grpc_core::OrphanablePtr<grpc_core::HealthCheckClient> health_check_client_;
+  grpc_closure on_health_changed_;
+  grpc_connectivity_state health_state_ = GRPC_CHANNEL_CONNECTING;
+};
+
+}  // namespace grpc_core
+
 #define SUBCHANNEL_CALL_TO_CALL_STACK(call)                          \
   (grpc_call_stack*)((char*)(call) + GPR_ROUND_UP_TO_ALIGNMENT_SIZE( \
                                          sizeof(grpc_subchannel_call)))
@@ -198,8 +381,10 @@ static void subchannel_destroy(void* arg, grpc_error* error) {
     c->channelz_subchannel.reset();
   }
   gpr_free((void*)c->filters);
+  c->health_check_service_name.reset();
   grpc_channel_args_destroy(c->args);
   grpc_connectivity_state_destroy(&c->state_tracker);
+  grpc_connectivity_state_destroy(&c->state_and_health_tracker);
   grpc_connector_unref(c->connector);
   grpc_pollset_set_destroy(c->pollset_set);
   grpc_subchannel_key_destroy(c->key);
@@ -262,6 +447,7 @@ static void disconnect(grpc_subchannel* c) {
   grpc_connector_shutdown(c->connector, GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                                             "Subchannel disconnected"));
   c->connected_subchannel.reset();
+  c->connected_subchannel_watcher.reset();
   gpr_mu_unlock(&c->mu);
 }
 
@@ -337,6 +523,31 @@ static void parse_args_for_backoff_values(
       .set_max_backoff(max_backoff_ms);
 }
 
+namespace grpc_core {
+namespace {
+
+struct HealthCheckParams {
+  UniquePtr<char> service_name;
+
+  static void Parse(const grpc_json* field, HealthCheckParams* params) {
+    if (strcmp(field->key, "healthCheckConfig") == 0) {
+      if (field->type != GRPC_JSON_OBJECT) return;
+      for (grpc_json* sub_field = field->child; sub_field != nullptr;
+           sub_field = sub_field->next) {
+        if (sub_field->key == nullptr) return;
+        if (strcmp(sub_field->key, "serviceName") == 0) {
+          if (params->service_name != nullptr) return;  // Duplicate.
+          if (sub_field->type != GRPC_JSON_STRING) return;
+          params->service_name.reset(gpr_strdup(sub_field->value));
+        }
+      }
+    }
+  }
+};
+
+}  // namespace
+}  // namespace grpc_core
+
 grpc_subchannel* grpc_subchannel_create(grpc_connector* connector,
                                         const grpc_subchannel_args* args) {
   grpc_subchannel_key* key = grpc_subchannel_key_create(args);
@@ -387,12 +598,28 @@ grpc_subchannel* grpc_subchannel_create(grpc_connector* connector,
                     grpc_schedule_on_exec_ctx);
   grpc_connectivity_state_init(&c->state_tracker, GRPC_CHANNEL_IDLE,
                                "subchannel");
+  grpc_connectivity_state_init(&c->state_and_health_tracker, GRPC_CHANNEL_IDLE,
+                               "subchannel");
   grpc_core::BackOff::Options backoff_options;
   parse_args_for_backoff_values(args->args, &backoff_options,
                                 &c->min_connect_timeout_ms);
   c->backoff.Init(backoff_options);
   gpr_mu_init(&c->mu);
 
+  // Check whether we should enable health checking.
+  const char* service_config_json = grpc_channel_arg_get_string(
+      grpc_channel_args_find(c->args, GRPC_ARG_SERVICE_CONFIG));
+  if (service_config_json != nullptr) {
+    grpc_core::UniquePtr<grpc_core::ServiceConfig> service_config =
+        grpc_core::ServiceConfig::Create(service_config_json);
+    if (service_config != nullptr) {
+      grpc_core::HealthCheckParams params;
+      service_config->ParseGlobalParams(grpc_core::HealthCheckParams::Parse,
+                                        &params);
+      c->health_check_service_name = std::move(params.service_name);
+    }
+  }
+
   const grpc_arg* arg =
       grpc_channel_args_find(c->args, GRPC_ARG_ENABLE_CHANNELZ);
   bool channelz_enabled =
@@ -428,35 +655,6 @@ intptr_t grpc_subchannel_get_child_socket_uuid(grpc_subchannel* subchannel) {
   }
 }
 
-static const char* subchannel_connectivity_state_change_string(
-    grpc_connectivity_state state) {
-  switch (state) {
-    case GRPC_CHANNEL_IDLE:
-      return "Subchannel state change to IDLE";
-    case GRPC_CHANNEL_CONNECTING:
-      return "Subchannel state change to CONNECTING";
-    case GRPC_CHANNEL_READY:
-      return "Subchannel state change to READY";
-    case GRPC_CHANNEL_TRANSIENT_FAILURE:
-      return "Subchannel state change to TRANSIENT_FAILURE";
-    case GRPC_CHANNEL_SHUTDOWN:
-      return "Subchannel state change to SHUTDOWN";
-  }
-  GPR_UNREACHABLE_CODE(return "UNKNOWN");
-}
-
-static void set_subchannel_connectivity_state_locked(
-    grpc_subchannel* c, grpc_connectivity_state state, grpc_error* error,
-    const char* reason) {
-  if (c->channelz_subchannel != nullptr) {
-    c->channelz_subchannel->AddTraceEvent(
-        grpc_core::channelz::ChannelTrace::Severity::Info,
-        grpc_slice_from_static_string(
-            subchannel_connectivity_state_change_string(state)));
-  }
-  grpc_connectivity_state_set(&c->state_tracker, state, error, reason);
-}
-
 static void continue_connect_locked(grpc_subchannel* c) {
   grpc_connect_in_args args;
   args.interested_parties = c->pollset_set;
@@ -467,15 +665,19 @@ static void continue_connect_locked(grpc_subchannel* c) {
   args.channel_args = c->args;
   set_subchannel_connectivity_state_locked(c, GRPC_CHANNEL_CONNECTING,
                                            GRPC_ERROR_NONE, "connecting");
+  grpc_connectivity_state_set(&c->state_and_health_tracker,
+                              GRPC_CHANNEL_CONNECTING, GRPC_ERROR_NONE,
+                              "connecting");
   grpc_connector_connect(c->connector, &args, &c->connecting_result,
                          &c->on_connected);
 }
 
-grpc_connectivity_state grpc_subchannel_check_connectivity(grpc_subchannel* c,
-                                                           grpc_error** error) {
-  grpc_connectivity_state state;
+grpc_connectivity_state grpc_subchannel_check_connectivity(
+    grpc_subchannel* c, grpc_error** error, bool inhibit_health_checks) {
   gpr_mu_lock(&c->mu);
-  state = grpc_connectivity_state_get(&c->state_tracker, error);
+  grpc_connectivity_state_tracker* tracker =
+      inhibit_health_checks ? &c->state_tracker : &c->state_and_health_tracker;
+  grpc_connectivity_state state = grpc_connectivity_state_get(tracker, error);
   gpr_mu_unlock(&c->mu);
   return state;
 }
@@ -533,7 +735,8 @@ static void maybe_start_connecting_locked(grpc_subchannel* c) {
     /* Already connected: don't restart */
     return;
   }
-  if (!grpc_connectivity_state_has_watchers(&c->state_tracker)) {
+  if (!grpc_connectivity_state_has_watchers(&c->state_tracker) &&
+      !grpc_connectivity_state_has_watchers(&c->state_and_health_tracker)) {
     /* Nobody is interested in connecting: so don't just yet */
     return;
   }
@@ -560,16 +763,18 @@ static void maybe_start_connecting_locked(grpc_subchannel* c) {
 
 void grpc_subchannel_notify_on_state_change(
     grpc_subchannel* c, grpc_pollset_set* interested_parties,
-    grpc_connectivity_state* state, grpc_closure* notify) {
+    grpc_connectivity_state* state, grpc_closure* notify,
+    bool inhibit_health_checks) {
+  grpc_connectivity_state_tracker* tracker =
+      inhibit_health_checks ? &c->state_tracker : &c->state_and_health_tracker;
   external_state_watcher* w;
-
   if (state == nullptr) {
     gpr_mu_lock(&c->mu);
     for (w = c->root_external_state_watcher.next;
          w != &c->root_external_state_watcher; w = w->next) {
       if (w->notify == notify) {
-        grpc_connectivity_state_notify_on_state_change(&c->state_tracker,
-                                                       nullptr, &w->closure);
+        grpc_connectivity_state_notify_on_state_change(tracker, nullptr,
+                                                       &w->closure);
       }
     }
     gpr_mu_unlock(&c->mu);
@@ -588,62 +793,12 @@ void grpc_subchannel_notify_on_state_change(
     w->next = &c->root_external_state_watcher;
     w->prev = w->next->prev;
     w->next->prev = w->prev->next = w;
-    grpc_connectivity_state_notify_on_state_change(&c->state_tracker, state,
-                                                   &w->closure);
+    grpc_connectivity_state_notify_on_state_change(tracker, state, &w->closure);
     maybe_start_connecting_locked(c);
     gpr_mu_unlock(&c->mu);
   }
 }
 
-static void on_connected_subchannel_connectivity_changed(void* p,
-                                                         grpc_error* error) {
-  state_watcher* connected_subchannel_watcher = static_cast<state_watcher*>(p);
-  grpc_subchannel* c = connected_subchannel_watcher->subchannel;
-  gpr_mu* mu = &c->mu;
-
-  gpr_mu_lock(mu);
-
-  switch (connected_subchannel_watcher->connectivity_state) {
-    case GRPC_CHANNEL_TRANSIENT_FAILURE:
-    case GRPC_CHANNEL_SHUTDOWN: {
-      if (!c->disconnected && c->connected_subchannel != nullptr) {
-        if (grpc_trace_stream_refcount.enabled()) {
-          gpr_log(GPR_INFO,
-                  "Connected subchannel %p of subchannel %p has gone into %s. "
-                  "Attempting to reconnect.",
-                  c->connected_subchannel.get(), c,
-                  grpc_connectivity_state_name(
-                      connected_subchannel_watcher->connectivity_state));
-        }
-        c->connected_subchannel.reset();
-        set_subchannel_connectivity_state_locked(
-            c, GRPC_CHANNEL_TRANSIENT_FAILURE, GRPC_ERROR_REF(error),
-            "reflect_child");
-        c->backoff_begun = false;
-        c->backoff->Reset();
-        maybe_start_connecting_locked(c);
-      } else {
-        connected_subchannel_watcher->connectivity_state =
-            GRPC_CHANNEL_SHUTDOWN;
-      }
-      break;
-    }
-    default: {
-      set_subchannel_connectivity_state_locked(
-          c, connected_subchannel_watcher->connectivity_state,
-          GRPC_ERROR_REF(error), "reflect_child");
-      GRPC_SUBCHANNEL_WEAK_REF(c, "state_watcher");
-      c->connected_subchannel->NotifyOnStateChange(
-          nullptr, &connected_subchannel_watcher->connectivity_state,
-          &connected_subchannel_watcher->closure);
-      connected_subchannel_watcher = nullptr;
-    }
-  }
-  gpr_mu_unlock(mu);
-  GRPC_SUBCHANNEL_WEAK_UNREF(c, "state_watcher");
-  gpr_free(connected_subchannel_watcher);
-}
-
 static bool publish_transport_locked(grpc_subchannel* c) {
   /* construct channel stack */
   grpc_channel_stack_builder* builder = grpc_channel_stack_builder_create();
@@ -670,17 +825,7 @@ static bool publish_transport_locked(grpc_subchannel* c) {
   intptr_t socket_uuid = c->connecting_result.socket_uuid;
   memset(&c->connecting_result, 0, sizeof(c->connecting_result));
 
-  /* initialize state watcher */
-  state_watcher* connected_subchannel_watcher = static_cast<state_watcher*>(
-      gpr_zalloc(sizeof(*connected_subchannel_watcher)));
-  connected_subchannel_watcher->subchannel = c;
-  connected_subchannel_watcher->connectivity_state = GRPC_CHANNEL_READY;
-  GRPC_CLOSURE_INIT(&connected_subchannel_watcher->closure,
-                    on_connected_subchannel_connectivity_changed,
-                    connected_subchannel_watcher, grpc_schedule_on_exec_ctx);
-
   if (c->disconnected) {
-    gpr_free(connected_subchannel_watcher);
     grpc_channel_stack_destroy(stk);
     gpr_free(stk);
     return false;
@@ -692,17 +837,10 @@ static bool publish_transport_locked(grpc_subchannel* c) {
   gpr_log(GPR_INFO, "New connected subchannel at %p for subchannel %p",
           c->connected_subchannel.get(), c);
 
-  /* setup subchannel watching connected subchannel for changes; subchannel
-     ref for connecting is donated to the state watcher */
-  GRPC_SUBCHANNEL_WEAK_REF(c, "state_watcher");
-  GRPC_SUBCHANNEL_WEAK_UNREF(c, "connecting");
-  c->connected_subchannel->NotifyOnStateChange(
-      c->pollset_set, &connected_subchannel_watcher->connectivity_state,
-      &connected_subchannel_watcher->closure);
-
-  /* signal completion */
-  set_subchannel_connectivity_state_locked(c, GRPC_CHANNEL_READY,
-                                           GRPC_ERROR_NONE, "connected");
+  // Instantiate state watcher.  Will clean itself up.
+  c->connected_subchannel_watcher =
+      grpc_core::MakeOrphanable<grpc_core::ConnectedSubchannelStateWatcher>(c);
+
   return true;
 }
 
@@ -725,6 +863,12 @@ static void on_subchannel_connected(void* arg, grpc_error* error) {
                                "Connect Failed", &error, 1),
                            GRPC_ERROR_INT_GRPC_STATUS, GRPC_STATUS_UNAVAILABLE),
         "connect_failed");
+    grpc_connectivity_state_set(
+        &c->state_and_health_tracker, GRPC_CHANNEL_TRANSIENT_FAILURE,
+        grpc_error_set_int(GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
+                               "Connect Failed", &error, 1),
+                           GRPC_ERROR_INT_GRPC_STATUS, GRPC_STATUS_UNAVAILABLE),
+        "connect_failed");
 
     const char* errmsg = grpc_error_string(error);
     gpr_log(GPR_INFO, "Connect failed: %s", errmsg);
@@ -956,15 +1100,8 @@ void ConnectedSubchannel::Ping(grpc_closure* on_initiate,
 
 grpc_error* ConnectedSubchannel::CreateCall(const CallArgs& args,
                                             grpc_subchannel_call** call) {
-  size_t allocation_size =
-      GPR_ROUND_UP_TO_ALIGNMENT_SIZE(sizeof(grpc_subchannel_call));
-  if (args.parent_data_size > 0) {
-    allocation_size +=
-        GPR_ROUND_UP_TO_ALIGNMENT_SIZE(channel_stack_->call_stack_size) +
-        args.parent_data_size;
-  } else {
-    allocation_size += channel_stack_->call_stack_size;
-  }
+  const size_t allocation_size =
+      GetInitialCallSizeEstimate(args.parent_data_size);
   *call = static_cast<grpc_subchannel_call*>(
       gpr_arena_alloc(args.arena, allocation_size));
   grpc_call_stack* callstk = SUBCHANNEL_CALL_TO_CALL_STACK(*call);
@@ -994,4 +1131,18 @@ grpc_error* ConnectedSubchannel::CreateCall(const CallArgs& args,
   return GRPC_ERROR_NONE;
 }
 
+size_t ConnectedSubchannel::GetInitialCallSizeEstimate(
+    size_t parent_data_size) const {
+  size_t allocation_size =
+      GPR_ROUND_UP_TO_ALIGNMENT_SIZE(sizeof(grpc_subchannel_call));
+  if (parent_data_size > 0) {
+    allocation_size +=
+        GPR_ROUND_UP_TO_ALIGNMENT_SIZE(channel_stack_->call_stack_size) +
+        parent_data_size;
+  } else {
+    allocation_size += channel_stack_->call_stack_size;
+  }
+  return allocation_size;
+}
+
 }  // namespace grpc_core

src/core/ext/filters/client_channel/subchannel.h

@@ -103,6 +103,8 @@ class ConnectedSubchannel : public RefCountedWithTracing<ConnectedSubchannel> {
   }
   intptr_t socket_uuid() { return socket_uuid_; }
 
+  size_t GetInitialCallSizeEstimate(size_t parent_data_size) const;
+
  private:
   grpc_channel_stack* channel_stack_;
   // ref counted pointer to the channelz node in this connected subchannel's
@@ -143,13 +145,14 @@ void* grpc_connected_subchannel_call_get_parent_data(
 
 /** poll the current connectivity state of a channel */
 grpc_connectivity_state grpc_subchannel_check_connectivity(
-    grpc_subchannel* channel, grpc_error** error);
+    grpc_subchannel* channel, grpc_error** error, bool inhibit_health_checking);
 
 /** Calls notify when the connectivity state of a channel becomes different
     from *state.  Updates *state with the new state of the channel. */
 void grpc_subchannel_notify_on_state_change(
     grpc_subchannel* channel, grpc_pollset_set* interested_parties,
-    grpc_connectivity_state* state, grpc_closure* notify);
+    grpc_connectivity_state* state, grpc_closure* notify,
+    bool inhibit_health_checks);
 
 /** retrieve the grpc_core::ConnectedSubchannel - or nullptr if not connected
  * (which may happen before it initially connects or during transient failures)

src/core/ext/transport/chttp2/client/chttp2_connector.cc

@@ -163,9 +163,8 @@ static void start_handshake_locked(chttp2_connector* c) {
                        c->args.interested_parties, c->handshake_mgr);
   grpc_endpoint_add_to_pollset_set(c->endpoint, c->args.interested_parties);
   grpc_handshake_manager_do_handshake(
-      c->handshake_mgr, c->args.interested_parties, c->endpoint,
-      c->args.channel_args, c->args.deadline, nullptr /* acceptor */,
-      on_handshake_done, c);
+      c->handshake_mgr, c->endpoint, c->args.channel_args, c->args.deadline,
+      nullptr /* acceptor */, on_handshake_done, c);
   c->endpoint = nullptr;  // Endpoint handed off to handshake manager.
 }
 
@@ -213,9 +212,17 @@ static void chttp2_connector_connect(grpc_connector* con,
   GRPC_CLOSURE_INIT(&c->connected, connected, c, grpc_schedule_on_exec_ctx);
   GPR_ASSERT(!c->connecting);
   c->connecting = true;
-  grpc_tcp_client_connect(&c->connected, &c->endpoint, args->interested_parties,
-                          args->channel_args, &addr, args->deadline);
+  grpc_closure* closure = &c->connected;
+  grpc_endpoint** ep = &c->endpoint;
   gpr_mu_unlock(&c->mu);
+  // In some implementations, the closure can be flushed before
+  // grpc_tcp_client_connect and since the closure requires access to c->mu,
+  // this can result in a deadlock. Refer
+  // https://github.com/grpc/grpc/issues/16427
+  // grpc_tcp_client_connect would fill c->endpoint with proper contents and we
+  // make sure that we would still exist at that point by taking a ref.
+  grpc_tcp_client_connect(closure, ep, args->interested_parties,
+                          args->channel_args, &addr, args->deadline);
 }
 
 static const grpc_connector_vtable chttp2_connector_vtable = {

src/core/ext/transport/chttp2/server/chttp2_server.cc

@@ -39,6 +39,7 @@
 #include "src/core/lib/channel/handshaker_registry.h"
 #include "src/core/lib/iomgr/endpoint.h"
 #include "src/core/lib/iomgr/resolve_address.h"
+#include "src/core/lib/iomgr/resource_quota.h"
 #include "src/core/lib/iomgr/tcp_server.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/surface/api_trace.h"
@@ -114,9 +115,16 @@ static void on_handshake_done(void* arg, grpc_error* error) {
   server_connection_state* connection_state =
       static_cast<server_connection_state*>(args->user_data);
   gpr_mu_lock(&connection_state->svr_state->mu);
+  grpc_resource_user* resource_user = grpc_server_get_default_resource_user(
+      connection_state->svr_state->server);
   if (error != GRPC_ERROR_NONE || connection_state->svr_state->shutdown) {
     const char* error_str = grpc_error_string(error);
     gpr_log(GPR_DEBUG, "Handshaking failed: %s", error_str);
+    grpc_resource_user* resource_user = grpc_server_get_default_resource_user(
+        connection_state->svr_state->server);
+    if (resource_user != nullptr) {
+      grpc_resource_user_free(resource_user, GRPC_RESOURCE_QUOTA_CHANNEL_SIZE);
+    }
     if (error == GRPC_ERROR_NONE && args->endpoint != nullptr) {
       // We were shut down after handshaking completed successfully, so
       // destroy the endpoint here.
@@ -134,13 +142,14 @@ static void on_handshake_done(void* arg, grpc_error* error) {
     // If the handshaking succeeded but there is no endpoint, then the
     // handshaker may have handed off the connection to some external
     // code, so we can just clean up here without creating a transport.
+    // TODO(juanlishen): Do we need to free the memory to resource user?
     if (args->endpoint != nullptr) {
-      grpc_transport* transport =
-          grpc_create_chttp2_transport(args->args, args->endpoint, false);
+      grpc_transport* transport = grpc_create_chttp2_transport(
+          args->args, args->endpoint, false, resource_user);
       grpc_server_setup_transport(
           connection_state->svr_state->server, transport,
           connection_state->accepting_pollset, args->args,
-          grpc_chttp2_transport_get_socket_uuid(transport));
+          grpc_chttp2_transport_get_socket_uuid(transport), resource_user);
       // Use notify_on_receive_settings callback to enforce the
       // handshake deadline.
       connection_state->transport =
@@ -183,6 +192,20 @@ static void on_accept(void* arg, grpc_endpoint* tcp,
     gpr_free(acceptor);
     return;
   }
+  grpc_resource_user* resource_user =
+      grpc_server_get_default_resource_user(state->server);
+  if (resource_user != nullptr &&
+      !grpc_resource_user_safe_alloc(resource_user,
+                                     GRPC_RESOURCE_QUOTA_CHANNEL_SIZE)) {
+    gpr_log(
+        GPR_ERROR,
+        "Memory quota exhausted, rejecting the connection, no handshaking.");
+    gpr_mu_unlock(&state->mu);
+    grpc_endpoint_shutdown(tcp, GRPC_ERROR_NONE);
+    grpc_endpoint_destroy(tcp);
+    gpr_free(acceptor);
+    return;
+  }
   grpc_handshake_manager* handshake_mgr = grpc_handshake_manager_create();
   grpc_handshake_manager_pending_list_add(&state->pending_handshake_mgrs,
                                           handshake_mgr);
@@ -208,10 +231,10 @@ static void on_accept(void* arg, grpc_endpoint* tcp,
       grpc_core::ExecCtx::Get()->Now() +
       grpc_channel_arg_get_integer(timeout_arg,
                                    {120 * GPR_MS_PER_SEC, 1, INT_MAX});
-  grpc_handshake_manager_do_handshake(
-      connection_state->handshake_mgr, nullptr /* interested_parties */, tcp,
-      state->args, connection_state->deadline, acceptor, on_handshake_done,
-      connection_state);
+  grpc_handshake_manager_do_handshake(connection_state->handshake_mgr, tcp,
+                                      state->args, connection_state->deadline,
+                                      acceptor, on_handshake_done,
+                                      connection_state);
 }
 
 /* Server callback: start listening on our ports */

src/core/ext/transport/chttp2/transport/chttp2_transport.cc

@@ -478,7 +478,8 @@ static void init_keepalive_pings_if_enabled(grpc_chttp2_transport* t) {
 
 static void init_transport(grpc_chttp2_transport* t,
                            const grpc_channel_args* channel_args,
-                           grpc_endpoint* ep, bool is_client) {
+                           grpc_endpoint* ep, bool is_client,
+                           grpc_resource_user* resource_user) {
   GPR_ASSERT(strlen(GRPC_CHTTP2_CLIENT_CONNECT_STRING) ==
              GRPC_CHTTP2_CLIENT_CONNECT_STRLEN);
 
@@ -491,6 +492,7 @@ static void init_transport(grpc_chttp2_transport* t,
   t->endpoint_reading = 1;
   t->next_stream_id = is_client ? 1 : 2;
   t->is_client = is_client;
+  t->resource_user = resource_user;
   t->deframe_state = is_client ? GRPC_DTS_FH_0 : GRPC_DTS_CLIENT_PREFIX_0;
   t->is_first_frame = true;
   grpc_connectivity_state_init(
@@ -778,6 +780,10 @@ static void destroy_stream_locked(void* sp, grpc_error* error) {
 
   s->flow_control.Destroy();
 
+  if (t->resource_user != nullptr) {
+    grpc_resource_user_free(t->resource_user, GRPC_RESOURCE_QUOTA_CALL_SIZE);
+  }
+
   GRPC_CHTTP2_UNREF_TRANSPORT(t, "stream");
 
   GRPC_CLOSURE_SCHED(s->destroy_stream_arg, GRPC_ERROR_NONE);
@@ -816,7 +822,21 @@ grpc_chttp2_stream* grpc_chttp2_parsing_accept_stream(grpc_chttp2_transport* t,
   if (t->channel_callback.accept_stream == nullptr) {
     return nullptr;
   }
-  grpc_chttp2_stream* accepting;
+  // Don't accept the stream if memory quota doesn't allow. Note that we should
+  // simply refuse the stream here instead of canceling the stream after it's
+  // accepted since the latter will create the call which costs much memory.
+  if (t->resource_user != nullptr &&
+      !grpc_resource_user_safe_alloc(t->resource_user,
+                                     GRPC_RESOURCE_QUOTA_CALL_SIZE)) {
+    gpr_log(GPR_ERROR, "Memory exhausted, rejecting the stream.");
+    grpc_slice_buffer_add(
+        &t->qbuf,
+        grpc_chttp2_rst_stream_create(
+            id, static_cast<uint32_t>(GRPC_HTTP2_REFUSED_STREAM), nullptr));
+    grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_RST_STREAM);
+    return nullptr;
+  }
+  grpc_chttp2_stream* accepting = nullptr;
   GPR_ASSERT(t->accepting_stream == nullptr);
   t->accepting_stream = &accepting;
   t->channel_callback.accept_stream(t->channel_callback.accept_stream_user_data,
@@ -3185,10 +3205,11 @@ intptr_t grpc_chttp2_transport_get_socket_uuid(grpc_transport* transport) {
 }
 
 grpc_transport* grpc_create_chttp2_transport(
-    const grpc_channel_args* channel_args, grpc_endpoint* ep, bool is_client) {
+    const grpc_channel_args* channel_args, grpc_endpoint* ep, bool is_client,
+    grpc_resource_user* resource_user) {
   grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(
       gpr_zalloc(sizeof(grpc_chttp2_transport)));
-  init_transport(t, channel_args, ep, is_client);
+  init_transport(t, channel_args, ep, is_client, resource_user);
   return &t->base;
 }
 

src/core/ext/transport/chttp2/transport/chttp2_transport.h

@@ -32,7 +32,8 @@ extern grpc_core::DebugOnlyTraceFlag grpc_trace_chttp2_refcount;
 extern bool g_flow_control_enabled;
 
 grpc_transport* grpc_create_chttp2_transport(
-    const grpc_channel_args* channel_args, grpc_endpoint* ep, bool is_client);
+    const grpc_channel_args* channel_args, grpc_endpoint* ep, bool is_client,
+    grpc_resource_user* resource_user = nullptr);
 
 intptr_t grpc_chttp2_transport_get_socket_uuid(grpc_transport* transport);
 

src/core/ext/transport/chttp2/transport/frame_rst_stream.cc

@@ -32,7 +32,7 @@ grpc_slice grpc_chttp2_rst_stream_create(uint32_t id, uint32_t code,
                                          grpc_transport_one_way_stats* stats) {
   static const size_t frame_size = 13;
   grpc_slice slice = GRPC_SLICE_MALLOC(frame_size);
-  stats->framing_bytes += frame_size;
+  if (stats != nullptr) stats->framing_bytes += frame_size;
   uint8_t* p = GRPC_SLICE_START_PTR(slice);
 
   // Frame size.

src/core/ext/transport/chttp2/transport/internal.h

@@ -285,6 +285,8 @@ struct grpc_chttp2_transport {
   grpc_endpoint* ep;
   char* peer_string;
 
+  grpc_resource_user* resource_user;
+
   grpc_combiner* combiner;
 
   grpc_closure* notify_on_receive_settings;

src/core/lib/channel/channel_stack_builder.cc

@@ -40,6 +40,7 @@ struct grpc_channel_stack_builder {
   // various set/get-able parameters
   grpc_channel_args* args;
   grpc_transport* transport;
+  grpc_resource_user* resource_user;
   char* target;
   const char* name;
 };
@@ -157,6 +158,11 @@ void grpc_channel_stack_builder_set_channel_arguments(
   builder->args = grpc_channel_args_copy(args);
 }
 
+const grpc_channel_args* grpc_channel_stack_builder_get_channel_arguments(
+    grpc_channel_stack_builder* builder) {
+  return builder->args;
+}
+
 void grpc_channel_stack_builder_set_transport(
     grpc_channel_stack_builder* builder, grpc_transport* transport) {
   GPR_ASSERT(builder->transport == nullptr);
@@ -168,9 +174,15 @@ grpc_transport* grpc_channel_stack_builder_get_transport(
   return builder->transport;
 }
 
-const grpc_channel_args* grpc_channel_stack_builder_get_channel_arguments(
+void grpc_channel_stack_builder_set_resource_user(
+    grpc_channel_stack_builder* builder, grpc_resource_user* resource_user) {
+  GPR_ASSERT(builder->resource_user == nullptr);
+  builder->resource_user = resource_user;
+}
+
+grpc_resource_user* grpc_channel_stack_builder_get_resource_user(
     grpc_channel_stack_builder* builder) {
-  return builder->args;
+  return builder->resource_user;
 }
 
 bool grpc_channel_stack_builder_append_filter(

src/core/lib/channel/channel_stack_builder.h

@@ -54,6 +54,14 @@ void grpc_channel_stack_builder_set_transport(
 grpc_transport* grpc_channel_stack_builder_get_transport(
     grpc_channel_stack_builder* builder);
 
+/// Attach \a resource_user to the builder (does not take ownership)
+void grpc_channel_stack_builder_set_resource_user(
+    grpc_channel_stack_builder* builder, grpc_resource_user* resource_user);
+
+/// Fetch attached resource user
+grpc_resource_user* grpc_channel_stack_builder_get_resource_user(
+    grpc_channel_stack_builder* builder);
+
 /// Set channel arguments: copies args
 void grpc_channel_stack_builder_set_channel_arguments(
     grpc_channel_stack_builder* builder, const grpc_channel_args* args);

src/core/lib/channel/channelz_registry.cc

@@ -79,12 +79,13 @@ void ChannelzRegistry::MaybePerformCompactionLocked() {
   }
 }
 
-int ChannelzRegistry::FindByUuidLocked(intptr_t target_uuid) {
-  size_t left = 0;
-  size_t right = entities_.size() - 1;
+int ChannelzRegistry::FindByUuidLocked(intptr_t target_uuid,
+                                       bool direct_hit_needed) {
+  int left = 0;
+  int right = int(entities_.size() - 1);
   while (left <= right) {
-    size_t true_middle = left + (right - left) / 2;
-    size_t first_non_null = true_middle;
+    int true_middle = left + (right - left) / 2;
+    int first_non_null = true_middle;
     while (first_non_null < right && entities_[first_non_null] == nullptr) {
       first_non_null++;
     }
@@ -102,14 +103,14 @@ int ChannelzRegistry::FindByUuidLocked(intptr_t target_uuid) {
       right = true_middle - 1;
     }
   }
-  return -1;
+  return direct_hit_needed ? -1 : left;
 }
 
 void ChannelzRegistry::InternalUnregister(intptr_t uuid) {
   GPR_ASSERT(uuid >= 1);
   MutexLock lock(&mu_);
   GPR_ASSERT(uuid <= uuid_generator_);
-  int idx = FindByUuidLocked(uuid);
+  int idx = FindByUuidLocked(uuid, true);
   GPR_ASSERT(idx >= 0);
   entities_[idx] = nullptr;
   num_empty_slots_++;
@@ -121,7 +122,7 @@ BaseNode* ChannelzRegistry::InternalGet(intptr_t uuid) {
   if (uuid < 1 || uuid > uuid_generator_) {
     return nullptr;
   }
-  int idx = FindByUuidLocked(uuid);
+  int idx = FindByUuidLocked(uuid, true);
   return idx < 0 ? nullptr : entities_[idx];
 }
 
@@ -131,16 +132,13 @@ char* ChannelzRegistry::InternalGetTopChannels(intptr_t start_channel_id) {
   grpc_json* json = top_level_json;
   grpc_json* json_iterator = nullptr;
   InlinedVector<BaseNode*, 10> top_level_channels;
-  // uuids index into entities one-off (idx 0 is really uuid 1, since 0 is
-  // reserved). However, we want to support requests coming in with
-  // start_channel_id=0, which signifies "give me everything." Hence this
-  // funky looking line below.
-  size_t start_idx = start_channel_id == 0 ? 0 : start_channel_id - 1;
   bool reached_pagination_limit = false;
+  int start_idx = GPR_MAX(FindByUuidLocked(start_channel_id, false), 0);
   for (size_t i = start_idx; i < entities_.size(); ++i) {
     if (entities_[i] != nullptr &&
         entities_[i]->type() ==
-            grpc_core::channelz::BaseNode::EntityType::kTopLevelChannel) {
+            grpc_core::channelz::BaseNode::EntityType::kTopLevelChannel &&
+        entities_[i]->uuid() >= start_channel_id) {
       // check if we are over pagination limit to determine if we need to set
       // the "end" element. If we don't go through this block, we know that
       // when the loop terminates, we have <= to kPaginationLimit.
@@ -176,15 +174,13 @@ char* ChannelzRegistry::InternalGetServers(intptr_t start_server_id) {
   grpc_json* json = top_level_json;
   grpc_json* json_iterator = nullptr;
   InlinedVector<BaseNode*, 10> servers;
-  // uuids index into entities one-off (idx 0 is really uuid 1, since 0 is
-  // reserved). However, we want to support requests coming in with
-  // start_server_id=0, which signifies "give me everything."
-  size_t start_idx = start_server_id == 0 ? 0 : start_server_id - 1;
   bool reached_pagination_limit = false;
+  int start_idx = GPR_MAX(FindByUuidLocked(start_server_id, false), 0);
   for (size_t i = start_idx; i < entities_.size(); ++i) {
     if (entities_[i] != nullptr &&
         entities_[i]->type() ==
-            grpc_core::channelz::BaseNode::EntityType::kServer) {
+            grpc_core::channelz::BaseNode::EntityType::kServer &&
+        entities_[i]->uuid() >= start_server_id) {
       // check if we are over pagination limit to determine if we need to set
       // the "end" element. If we don't go through this block, we know that
       // when the loop terminates, we have <= to kPaginationLimit.

src/core/lib/channel/channelz_registry.h

@@ -92,7 +92,9 @@ class ChannelzRegistry {
   void MaybePerformCompactionLocked();
 
   // Performs binary search on entities_ to find the index with that uuid.
-  int FindByUuidLocked(intptr_t uuid);
+  // If direct_hit_needed, then will return -1 in case of absence.
+  // Else, will return idx of the first uuid higher than the target.
+  int FindByUuidLocked(intptr_t uuid, bool direct_hit_needed);
 
   // protects members
   gpr_mu mu_;

src/core/lib/channel/handshaker.cc

@@ -292,17 +292,18 @@ static void on_timeout(void* arg, grpc_error* error) {
   grpc_handshake_manager_unref(mgr);
 }
 
-void grpc_handshake_manager_do_handshake(
-    grpc_handshake_manager* mgr, grpc_pollset_set* interested_parties,
-    grpc_endpoint* endpoint, const grpc_channel_args* channel_args,
-    grpc_millis deadline, grpc_tcp_server_acceptor* acceptor,
-    grpc_iomgr_cb_func on_handshake_done, void* user_data) {
+void grpc_handshake_manager_do_handshake(grpc_handshake_manager* mgr,
+                                         grpc_endpoint* endpoint,
+                                         const grpc_channel_args* channel_args,
+                                         grpc_millis deadline,
+                                         grpc_tcp_server_acceptor* acceptor,
+                                         grpc_iomgr_cb_func on_handshake_done,
+                                         void* user_data) {
   gpr_mu_lock(&mgr->mu);
   GPR_ASSERT(mgr->index == 0);
   GPR_ASSERT(!mgr->shutdown);
   // Construct handshaker args.  These will be passed through all
   // handshakers and eventually be freed by the on_handshake_done callback.
-  mgr->args.interested_parties = interested_parties;
   mgr->args.endpoint = endpoint;
   mgr->args.args = grpc_channel_args_copy(channel_args);
   mgr->args.user_data = user_data;

src/core/lib/channel/handshaker.h

@@ -56,7 +56,6 @@ typedef struct grpc_handshaker grpc_handshaker;
 /// For the on_handshake_done callback, all members are input arguments,
 /// which the callback takes ownership of.
 typedef struct {
-  grpc_pollset_set* interested_parties;
   grpc_endpoint* endpoint;
   grpc_channel_args* args;
   grpc_slice_buffer* read_buffer;
@@ -132,8 +131,6 @@ void grpc_handshake_manager_shutdown(grpc_handshake_manager* mgr,
                                      grpc_error* why);
 
 /// Invokes handshakers in the order they were added.
-/// \a interested_parties may be non-nullptr to provide a pollset_set that
-/// may be used during handshaking. Ownership is not taken.
 /// Takes ownership of \a endpoint, and then passes that ownership to
 /// the \a on_handshake_done callback.
 /// Does NOT take ownership of \a channel_args.  Instead, makes a copy before
@@ -145,11 +142,13 @@ void grpc_handshake_manager_shutdown(grpc_handshake_manager* mgr,
 /// GRPC_ERROR_NONE, then handshaking failed and the handshaker has done
 /// the necessary clean-up.  Otherwise, the callback takes ownership of
 /// the arguments.
-void grpc_handshake_manager_do_handshake(
-    grpc_handshake_manager* mgr, grpc_pollset_set* interested_parties,
-    grpc_endpoint* endpoint, const grpc_channel_args* channel_args,
-    grpc_millis deadline, grpc_tcp_server_acceptor* acceptor,
-    grpc_iomgr_cb_func on_handshake_done, void* user_data);
+void grpc_handshake_manager_do_handshake(grpc_handshake_manager* mgr,
+                                         grpc_endpoint* endpoint,
+                                         const grpc_channel_args* channel_args,
+                                         grpc_millis deadline,
+                                         grpc_tcp_server_acceptor* acceptor,
+                                         grpc_iomgr_cb_func on_handshake_done,
+                                         void* user_data);
 
 /// Add \a mgr to the server side list of all pending handshake managers, the
 /// list starts with \a *head.

src/core/lib/http/httpcli_security_connector.cc

@@ -30,6 +30,7 @@
 #include "src/core/lib/channel/handshaker_registry.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/iomgr/pollset.h"
+#include "src/core/lib/security/security_connector/ssl_utils.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/tsi/ssl_transport_security.h"
@@ -194,9 +195,8 @@ static void ssl_handshake(void* arg, grpc_endpoint* tcp, const char* host,
   grpc_handshakers_add(HANDSHAKER_CLIENT, &args,
                        nullptr /* interested_parties */, c->handshake_mgr);
   grpc_handshake_manager_do_handshake(
-      c->handshake_mgr, nullptr /* interested_parties */, tcp,
-      nullptr /* channel_args */, deadline, nullptr /* acceptor */,
-      on_handshake_done, c /* user_data */);
+      c->handshake_mgr, tcp, nullptr /* channel_args */, deadline,
+      nullptr /* acceptor */, on_handshake_done, c /* user_data */);
   GRPC_SECURITY_CONNECTOR_UNREF(&sc->base, "httpcli");
 }
 

src/core/lib/iomgr/resource_quota.cc

@@ -90,7 +90,8 @@ struct grpc_resource_user {
   grpc_closure_list on_allocated;
   /* True if we are currently trying to allocate from the quota, false if not */
   bool allocating;
-  /* How many bytes of allocations are outstanding */
+  /* The amount of memory (in bytes) that has been requested from this user
+   * asynchronously but hasn't been granted yet. */
   int64_t outstanding_allocations;
   /* True if we are currently trying to add ourselves to the non-free quota
      list, false otherwise */
@@ -135,6 +136,9 @@ struct grpc_resource_quota {
   int64_t size;
   /* Amount of free memory in the resource quota */
   int64_t free_pool;
+  /* Used size of memory in the resource quota. Updated as soon as the resource
+   * users start to allocate or free the memory. */
+  gpr_atm used;
 
   gpr_atm last_size;
 
@@ -371,6 +375,7 @@ static bool rq_reclaim_from_per_user_free_pool(
   while ((resource_user = rulist_pop_head(resource_quota,
                                           GRPC_RULIST_NON_EMPTY_FREE_POOL))) {
     gpr_mu_lock(&resource_user->mu);
+    resource_user->added_to_free_pool = false;
     if (resource_user->free_pool > 0) {
       int64_t amt = resource_user->free_pool;
       resource_user->free_pool = 0;
@@ -386,6 +391,13 @@ static bool rq_reclaim_from_per_user_free_pool(
       gpr_mu_unlock(&resource_user->mu);
       return true;
     } else {
+      if (grpc_resource_quota_trace.enabled()) {
+        gpr_log(GPR_INFO,
+                "RQ %s %s: failed to reclaim_from_per_user_free_pool; "
+                "free_pool = %" PRId64 "; rq_free_pool = %" PRId64,
+                resource_quota->name, resource_user->name,
+                resource_user->free_pool, resource_quota->free_pool);
+      }
       gpr_mu_unlock(&resource_user->mu);
     }
   }
@@ -622,6 +634,7 @@ grpc_resource_quota* grpc_resource_quota_create(const char* name) {
   resource_quota->combiner = grpc_combiner_create();
   resource_quota->free_pool = INT64_MAX;
   resource_quota->size = INT64_MAX;
+  resource_quota->used = 0;
   gpr_atm_no_barrier_store(&resource_quota->last_size, GPR_ATM_MAX);
   gpr_mu_init(&resource_quota->thread_count_mu);
   resource_quota->max_threads = INT_MAX;
@@ -712,7 +725,7 @@ size_t grpc_resource_quota_peek_size(grpc_resource_quota* resource_quota) {
  */
 
 grpc_resource_quota* grpc_resource_quota_from_channel_args(
-    const grpc_channel_args* channel_args) {
+    const grpc_channel_args* channel_args, bool create) {
   for (size_t i = 0; i < channel_args->num_args; i++) {
     if (0 == strcmp(channel_args->args[i].key, GRPC_ARG_RESOURCE_QUOTA)) {
       if (channel_args->args[i].type == GRPC_ARG_POINTER) {
@@ -724,7 +737,7 @@ grpc_resource_quota* grpc_resource_quota_from_channel_args(
       }
     }
   }
-  return grpc_resource_quota_create(nullptr);
+  return create ? grpc_resource_quota_create(nullptr) : nullptr;
 }
 
 static void* rq_copy(void* rq) {
@@ -863,33 +876,68 @@ void grpc_resource_user_free_threads(grpc_resource_user* resource_user,
   gpr_mu_unlock(&resource_user->resource_quota->thread_count_mu);
 }
 
-void grpc_resource_user_alloc(grpc_resource_user* resource_user, size_t size,
-                              grpc_closure* optional_on_done) {
-  gpr_mu_lock(&resource_user->mu);
+static void resource_user_alloc_locked(grpc_resource_user* resource_user,
+                                       size_t size,
+                                       grpc_closure* optional_on_done) {
   ru_ref_by(resource_user, static_cast<gpr_atm>(size));
   resource_user->free_pool -= static_cast<int64_t>(size);
-  resource_user->outstanding_allocations += static_cast<int64_t>(size);
   if (grpc_resource_quota_trace.enabled()) {
     gpr_log(GPR_INFO, "RQ %s %s: alloc %" PRIdPTR "; free_pool -> %" PRId64,
             resource_user->resource_quota->name, resource_user->name, size,
             resource_user->free_pool);
   }
   if (resource_user->free_pool < 0) {
-    grpc_closure_list_append(&resource_user->on_allocated, optional_on_done,
-                             GRPC_ERROR_NONE);
+    if (optional_on_done != nullptr) {
+      resource_user->outstanding_allocations += static_cast<int64_t>(size);
+      grpc_closure_list_append(&resource_user->on_allocated, optional_on_done,
+                               GRPC_ERROR_NONE);
+    }
     if (!resource_user->allocating) {
       resource_user->allocating = true;
       GRPC_CLOSURE_SCHED(&resource_user->allocate_closure, GRPC_ERROR_NONE);
     }
   } else {
-    resource_user->outstanding_allocations -= static_cast<int64_t>(size);
     GRPC_CLOSURE_SCHED(optional_on_done, GRPC_ERROR_NONE);
   }
+}
+
+bool grpc_resource_user_safe_alloc(grpc_resource_user* resource_user,
+                                   size_t size) {
+  if (gpr_atm_no_barrier_load(&resource_user->shutdown)) return false;
+  gpr_mu_lock(&resource_user->mu);
+  grpc_resource_quota* resource_quota = resource_user->resource_quota;
+  bool cas_success;
+  do {
+    gpr_atm used = gpr_atm_no_barrier_load(&resource_quota->used);
+    gpr_atm new_used = used + size;
+    if (static_cast<size_t>(new_used) >
+        grpc_resource_quota_peek_size(resource_quota)) {
+      gpr_mu_unlock(&resource_user->mu);
+      return false;
+    }
+    cas_success = gpr_atm_full_cas(&resource_quota->used, used, new_used);
+  } while (!cas_success);
+  resource_user_alloc_locked(resource_user, size, nullptr);
+  gpr_mu_unlock(&resource_user->mu);
+  return true;
+}
+
+void grpc_resource_user_alloc(grpc_resource_user* resource_user, size_t size,
+                              grpc_closure* optional_on_done) {
+  // TODO(juanlishen): Maybe return immediately if shutting down. Deferring this
+  // because some tests become flaky after the change.
+  gpr_mu_lock(&resource_user->mu);
+  grpc_resource_quota* resource_quota = resource_user->resource_quota;
+  gpr_atm_no_barrier_fetch_add(&resource_quota->used, size);
+  resource_user_alloc_locked(resource_user, size, optional_on_done);
   gpr_mu_unlock(&resource_user->mu);
 }
 
 void grpc_resource_user_free(grpc_resource_user* resource_user, size_t size) {
   gpr_mu_lock(&resource_user->mu);
+  grpc_resource_quota* resource_quota = resource_user->resource_quota;
+  gpr_atm prior = gpr_atm_no_barrier_fetch_add(&resource_quota->used, -size);
+  GPR_ASSERT(prior >= static_cast<long>(size));
   bool was_zero_or_negative = resource_user->free_pool <= 0;
   resource_user->free_pool += static_cast<int64_t>(size);
   if (grpc_resource_quota_trace.enabled()) {
@@ -940,6 +988,12 @@ void grpc_resource_user_slice_allocator_init(
 void grpc_resource_user_alloc_slices(
     grpc_resource_user_slice_allocator* slice_allocator, size_t length,
     size_t count, grpc_slice_buffer* dest) {
+  if (gpr_atm_no_barrier_load(&slice_allocator->resource_user->shutdown)) {
+    GRPC_CLOSURE_SCHED(
+        &slice_allocator->on_allocated,
+        GRPC_ERROR_CREATE_FROM_STATIC_STRING("Resource user shutdown"));
+    return;
+  }
   slice_allocator->length = length;
   slice_allocator->count = count;
   slice_allocator->dest = dest;

src/core/lib/iomgr/resource_quota.h

@@ -65,11 +65,16 @@
 
 extern grpc_core::TraceFlag grpc_resource_quota_trace;
 
+// TODO(juanlishen): This is a hack. We need to do real accounting instead of
+// hard coding.
+constexpr size_t GRPC_RESOURCE_QUOTA_CALL_SIZE = 15 * 1024;
+constexpr size_t GRPC_RESOURCE_QUOTA_CHANNEL_SIZE = 50 * 1024;
+
 grpc_resource_quota* grpc_resource_quota_ref_internal(
     grpc_resource_quota* resource_quota);
 void grpc_resource_quota_unref_internal(grpc_resource_quota* resource_quota);
 grpc_resource_quota* grpc_resource_quota_from_channel_args(
-    const grpc_channel_args* channel_args);
+    const grpc_channel_args* channel_args, bool create = true);
 
 /* Return a number indicating current memory pressure:
    0.0 ==> no memory usage
@@ -109,11 +114,21 @@ bool grpc_resource_user_allocate_threads(grpc_resource_user* resource_user,
 void grpc_resource_user_free_threads(grpc_resource_user* resource_user,
                                      int thread_count);
 
-/* Allocate from the resource user (and its quota).
-   If optional_on_done is NULL, then allocate immediately. This may push the
-   quota over-limit, at which point reclamation will kick in.
-   If optional_on_done is non-NULL, it will be scheduled when the allocation has
-   been granted by the quota. */
+/* Allocates from the resource user 'size' worth of memory if this won't exceed
+ * the resource quota's total size. Returns whether the allocation is done
+ * successfully. If allocated successfully, the memory should be freed by the
+ * caller eventually. */
+bool grpc_resource_user_safe_alloc(grpc_resource_user* resource_user,
+                                   size_t size);
+/* Allocates from the resource user 'size' worth of memory.
+ * If optional_on_done is NULL, then allocate immediately. This may push the
+ * quota over-limit, at which point reclamation will kick in. The caller is
+ * always responsible to free the memory eventually.
+ * If optional_on_done is non-NULL, it will be scheduled without error when the
+ * allocation has been granted by the quota, and the caller is responsible to
+ * free the memory eventually. Or it may be scheduled with an error, in which
+ * case the caller fails to allocate the memory and shouldn't free the memory.
+ */
 void grpc_resource_user_alloc(grpc_resource_user* resource_user, size_t size,
                               grpc_closure* optional_on_done);
 /* Release memory back to the quota */

src/core/lib/iomgr/tcp_client_custom.cc

@@ -81,9 +81,8 @@ static void on_alarm(void* acp, grpc_error* error) {
   }
 }
 
-static void custom_connect_callback(grpc_custom_socket* socket,
-                                    grpc_error* error) {
-  grpc_core::ExecCtx exec_ctx;
+static void custom_connect_callback_internal(grpc_custom_socket* socket,
+                                             grpc_error* error) {
   grpc_custom_tcp_connect* connect = socket->connector;
   int done;
   grpc_closure* closure = connect->closure;
@@ -100,6 +99,18 @@ static void custom_connect_callback(grpc_custom_socket* socket,
   GRPC_CLOSURE_SCHED(closure, error);
 }
 
+static void custom_connect_callback(grpc_custom_socket* socket,
+                                    grpc_error* error) {
+  if (grpc_core::ExecCtx::Get() == nullptr) {
+    /* If we are being run on a thread which does not have an exec_ctx created
+     * yet, we should create one. */
+    grpc_core::ExecCtx exec_ctx;
+    custom_connect_callback_internal(socket, error);
+  } else {
+    custom_connect_callback_internal(socket, error);
+  }
+}
+
 static void tcp_connect(grpc_closure* closure, grpc_endpoint** ep,
                         grpc_pollset_set* interested_parties,
                         const grpc_channel_args* channel_args,

src/core/lib/security/credentials/alts/alts_credentials.cc

@@ -28,7 +28,7 @@
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
-#include "src/core/lib/security/security_connector/alts_security_connector.h"
+#include "src/core/lib/security/security_connector/alts/alts_security_connector.h"
 
 #define GRPC_CREDENTIALS_TYPE_ALTS "Alts"
 #define GRPC_ALTS_HANDSHAKER_SERVICE_URL "metadata.google.internal:8080"

src/core/lib/security/credentials/fake/fake_credentials.cc

@@ -29,6 +29,7 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/iomgr/executor.h"
+#include "src/core/lib/security/security_connector/fake/fake_security_connector.h"
 
 /* -- Fake transport security credentials. -- */
 

src/core/lib/security/credentials/local/local_credentials.cc

@@ -25,7 +25,7 @@
 #include <grpc/support/log.h>
 
 #include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/security/security_connector/local_security_connector.h"
+#include "src/core/lib/security/security_connector/local/local_security_connector.h"
 
 #define GRPC_CREDENTIALS_TYPE_LOCAL "Local"
 

src/core/lib/security/credentials/ssl/ssl_credentials.h

@@ -22,6 +22,8 @@
 
 #include "src/core/lib/security/credentials/credentials.h"
 
+#include "src/core/lib/security/security_connector/ssl/ssl_security_connector.h"
+
 typedef struct {
   grpc_channel_credentials base;
   grpc_ssl_config config;

src/core/lib/security/security_connector/alts_security_connector.cc → src/core/lib/security/security_connector/alts/alts_security_connector.cc

@@ -18,7 +18,7 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/security/security_connector/alts_security_connector.h"
+#include "src/core/lib/security/security_connector/alts/alts_security_connector.h"
 
 #include <stdbool.h>
 #include <string.h>
@@ -33,6 +33,7 @@
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/tsi/alts/handshaker/alts_tsi_handshaker.h"
+#include "src/core/tsi/transport_security.h"
 
 typedef struct {
   grpc_channel_security_connector base;

src/core/lib/security/security_connector/alts_security_connector.h → src/core/lib/security/security_connector/alts/alts_security_connector.h

@@ -16,8 +16,8 @@
  *
  */
 
-#ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_ALTS_SECURITY_CONNECTOR_H
-#define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_ALTS_SECURITY_CONNECTOR_H
+#ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_ALTS_ALTS_SECURITY_CONNECTOR_H
+#define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_ALTS_ALTS_SECURITY_CONNECTOR_H
 
 #include <grpc/support/port_platform.h>
 
@@ -65,5 +65,5 @@ grpc_security_status grpc_alts_auth_context_from_tsi_peer(
 }  // namespace internal
 }  // namespace grpc_core
 
-#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_ALTS_SECURITY_CONNECTOR_H \
+#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_ALTS_ALTS_SECURITY_CONNECTOR_H \
         */

src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -0,0 +1,310 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/security_connector/fake/fake_security_connector.h"
+
+#include <stdbool.h>
+
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
+#include "src/core/ext/transport/chttp2/alpn/alpn.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/channel/handshaker.h"
+#include "src/core/lib/gpr/host_port.h"
+#include "src/core/lib/gpr/string.h"
+#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/fake/fake_credentials.h"
+#include "src/core/lib/security/transport/security_handshaker.h"
+#include "src/core/lib/security/transport/target_authority_table.h"
+#include "src/core/tsi/fake_transport_security.h"
+
+typedef struct {
+  grpc_channel_security_connector base;
+  char* target;
+  char* expected_targets;
+  bool is_lb_channel;
+  char* target_name_override;
+} grpc_fake_channel_security_connector;
+
+static void fake_channel_destroy(grpc_security_connector* sc) {
+  grpc_fake_channel_security_connector* c =
+      reinterpret_cast<grpc_fake_channel_security_connector*>(sc);
+  grpc_call_credentials_unref(c->base.request_metadata_creds);
+  gpr_free(c->target);
+  gpr_free(c->expected_targets);
+  gpr_free(c->target_name_override);
+  gpr_free(c);
+}
+
+static void fake_server_destroy(grpc_security_connector* sc) { gpr_free(sc); }
+
+static bool fake_check_target(const char* target_type, const char* target,
+                              const char* set_str) {
+  GPR_ASSERT(target_type != nullptr);
+  GPR_ASSERT(target != nullptr);
+  char** set = nullptr;
+  size_t set_size = 0;
+  gpr_string_split(set_str, ",", &set, &set_size);
+  bool found = false;
+  for (size_t i = 0; i < set_size; ++i) {
+    if (set[i] != nullptr && strcmp(target, set[i]) == 0) found = true;
+  }
+  for (size_t i = 0; i < set_size; ++i) {
+    gpr_free(set[i]);
+  }
+  gpr_free(set);
+  return found;
+}
+
+static void fake_secure_name_check(const char* target,
+                                   const char* expected_targets,
+                                   bool is_lb_channel) {
+  if (expected_targets == nullptr) return;
+  char** lbs_and_backends = nullptr;
+  size_t lbs_and_backends_size = 0;
+  bool success = false;
+  gpr_string_split(expected_targets, ";", &lbs_and_backends,
+                   &lbs_and_backends_size);
+  if (lbs_and_backends_size > 2 || lbs_and_backends_size == 0) {
+    gpr_log(GPR_ERROR, "Invalid expected targets arg value: '%s'",
+            expected_targets);
+    goto done;
+  }
+  if (is_lb_channel) {
+    if (lbs_and_backends_size != 2) {
+      gpr_log(GPR_ERROR,
+              "Invalid expected targets arg value: '%s'. Expectations for LB "
+              "channels must be of the form 'be1,be2,be3,...;lb1,lb2,...",
+              expected_targets);
+      goto done;
+    }
+    if (!fake_check_target("LB", target, lbs_and_backends[1])) {
+      gpr_log(GPR_ERROR, "LB target '%s' not found in expected set '%s'",
+              target, lbs_and_backends[1]);
+      goto done;
+    }
+    success = true;
+  } else {
+    if (!fake_check_target("Backend", target, lbs_and_backends[0])) {
+      gpr_log(GPR_ERROR, "Backend target '%s' not found in expected set '%s'",
+              target, lbs_and_backends[0]);
+      goto done;
+    }
+    success = true;
+  }
+done:
+  for (size_t i = 0; i < lbs_and_backends_size; ++i) {
+    gpr_free(lbs_and_backends[i]);
+  }
+  gpr_free(lbs_and_backends);
+  if (!success) abort();
+}
+
+static void fake_check_peer(grpc_security_connector* sc, tsi_peer peer,
+                            grpc_auth_context** auth_context,
+                            grpc_closure* on_peer_checked) {
+  const char* prop_name;
+  grpc_error* error = GRPC_ERROR_NONE;
+  *auth_context = nullptr;
+  if (peer.property_count != 1) {
+    error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "Fake peers should only have 1 property.");
+    goto end;
+  }
+  prop_name = peer.properties[0].name;
+  if (prop_name == nullptr ||
+      strcmp(prop_name, TSI_CERTIFICATE_TYPE_PEER_PROPERTY)) {
+    char* msg;
+    gpr_asprintf(&msg, "Unexpected property in fake peer: %s.",
+                 prop_name == nullptr ? "<EMPTY>" : prop_name);
+    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
+    gpr_free(msg);
+    goto end;
+  }
+  if (strncmp(peer.properties[0].value.data, TSI_FAKE_CERTIFICATE_TYPE,
+              peer.properties[0].value.length)) {
+    error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "Invalid value for cert type property.");
+    goto end;
+  }
+  *auth_context = grpc_auth_context_create(nullptr);
+  grpc_auth_context_add_cstring_property(
+      *auth_context, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
+      GRPC_FAKE_TRANSPORT_SECURITY_TYPE);
+end:
+  GRPC_CLOSURE_SCHED(on_peer_checked, error);
+  tsi_peer_destruct(&peer);
+}
+
+static void fake_channel_check_peer(grpc_security_connector* sc, tsi_peer peer,
+                                    grpc_auth_context** auth_context,
+                                    grpc_closure* on_peer_checked) {
+  fake_check_peer(sc, peer, auth_context, on_peer_checked);
+  grpc_fake_channel_security_connector* c =
+      reinterpret_cast<grpc_fake_channel_security_connector*>(sc);
+  fake_secure_name_check(c->target, c->expected_targets, c->is_lb_channel);
+}
+
+static void fake_server_check_peer(grpc_security_connector* sc, tsi_peer peer,
+                                   grpc_auth_context** auth_context,
+                                   grpc_closure* on_peer_checked) {
+  fake_check_peer(sc, peer, auth_context, on_peer_checked);
+}
+
+static int fake_channel_cmp(grpc_security_connector* sc1,
+                            grpc_security_connector* sc2) {
+  grpc_fake_channel_security_connector* c1 =
+      reinterpret_cast<grpc_fake_channel_security_connector*>(sc1);
+  grpc_fake_channel_security_connector* c2 =
+      reinterpret_cast<grpc_fake_channel_security_connector*>(sc2);
+  int c = grpc_channel_security_connector_cmp(&c1->base, &c2->base);
+  if (c != 0) return c;
+  c = strcmp(c1->target, c2->target);
+  if (c != 0) return c;
+  if (c1->expected_targets == nullptr || c2->expected_targets == nullptr) {
+    c = GPR_ICMP(c1->expected_targets, c2->expected_targets);
+  } else {
+    c = strcmp(c1->expected_targets, c2->expected_targets);
+  }
+  if (c != 0) return c;
+  return GPR_ICMP(c1->is_lb_channel, c2->is_lb_channel);
+}
+
+static int fake_server_cmp(grpc_security_connector* sc1,
+                           grpc_security_connector* sc2) {
+  return grpc_server_security_connector_cmp(
+      reinterpret_cast<grpc_server_security_connector*>(sc1),
+      reinterpret_cast<grpc_server_security_connector*>(sc2));
+}
+
+static bool fake_channel_check_call_host(grpc_channel_security_connector* sc,
+                                         const char* host,
+                                         grpc_auth_context* auth_context,
+                                         grpc_closure* on_call_host_checked,
+                                         grpc_error** error) {
+  grpc_fake_channel_security_connector* c =
+      reinterpret_cast<grpc_fake_channel_security_connector*>(sc);
+  char* authority_hostname = nullptr;
+  char* authority_ignored_port = nullptr;
+  char* target_hostname = nullptr;
+  char* target_ignored_port = nullptr;
+  gpr_split_host_port(host, &authority_hostname, &authority_ignored_port);
+  gpr_split_host_port(c->target, &target_hostname, &target_ignored_port);
+  if (c->target_name_override != nullptr) {
+    char* fake_security_target_name_override_hostname = nullptr;
+    char* fake_security_target_name_override_ignored_port = nullptr;
+    gpr_split_host_port(c->target_name_override,
+                        &fake_security_target_name_override_hostname,
+                        &fake_security_target_name_override_ignored_port);
+    if (strcmp(authority_hostname,
+               fake_security_target_name_override_hostname) != 0) {
+      gpr_log(GPR_ERROR,
+              "Authority (host) '%s' != Fake Security Target override '%s'",
+              host, fake_security_target_name_override_hostname);
+      abort();
+    }
+    gpr_free(fake_security_target_name_override_hostname);
+    gpr_free(fake_security_target_name_override_ignored_port);
+  } else if (strcmp(authority_hostname, target_hostname) != 0) {
+    gpr_log(GPR_ERROR, "Authority (host) '%s' != Target '%s'",
+            authority_hostname, target_hostname);
+    abort();
+  }
+  gpr_free(authority_hostname);
+  gpr_free(authority_ignored_port);
+  gpr_free(target_hostname);
+  gpr_free(target_ignored_port);
+  return true;
+}
+
+static void fake_channel_cancel_check_call_host(
+    grpc_channel_security_connector* sc, grpc_closure* on_call_host_checked,
+    grpc_error* error) {
+  GRPC_ERROR_UNREF(error);
+}
+
+static void fake_channel_add_handshakers(
+    grpc_channel_security_connector* sc, grpc_pollset_set* interested_parties,
+    grpc_handshake_manager* handshake_mgr) {
+  grpc_handshake_manager_add(
+      handshake_mgr,
+      grpc_security_handshaker_create(
+          tsi_create_fake_handshaker(true /* is_client */), &sc->base));
+}
+
+static void fake_server_add_handshakers(grpc_server_security_connector* sc,
+                                        grpc_pollset_set* interested_parties,
+                                        grpc_handshake_manager* handshake_mgr) {
+  grpc_handshake_manager_add(
+      handshake_mgr,
+      grpc_security_handshaker_create(
+          tsi_create_fake_handshaker(false /* is_client */), &sc->base));
+}
+
+static grpc_security_connector_vtable fake_channel_vtable = {
+    fake_channel_destroy, fake_channel_check_peer, fake_channel_cmp};
+
+static grpc_security_connector_vtable fake_server_vtable = {
+    fake_server_destroy, fake_server_check_peer, fake_server_cmp};
+
+grpc_channel_security_connector* grpc_fake_channel_security_connector_create(
+    grpc_channel_credentials* channel_creds,
+    grpc_call_credentials* request_metadata_creds, const char* target,
+    const grpc_channel_args* args) {
+  grpc_fake_channel_security_connector* c =
+      static_cast<grpc_fake_channel_security_connector*>(
+          gpr_zalloc(sizeof(*c)));
+  gpr_ref_init(&c->base.base.refcount, 1);
+  c->base.base.url_scheme = GRPC_FAKE_SECURITY_URL_SCHEME;
+  c->base.base.vtable = &fake_channel_vtable;
+  c->base.channel_creds = channel_creds;
+  c->base.request_metadata_creds =
+      grpc_call_credentials_ref(request_metadata_creds);
+  c->base.check_call_host = fake_channel_check_call_host;
+  c->base.cancel_check_call_host = fake_channel_cancel_check_call_host;
+  c->base.add_handshakers = fake_channel_add_handshakers;
+  c->target = gpr_strdup(target);
+  const char* expected_targets = grpc_fake_transport_get_expected_targets(args);
+  c->expected_targets = gpr_strdup(expected_targets);
+  c->is_lb_channel = grpc_core::FindTargetAuthorityTableInArgs(args) != nullptr;
+  const grpc_arg* target_name_override_arg =
+      grpc_channel_args_find(args, GRPC_SSL_TARGET_NAME_OVERRIDE_ARG);
+  if (target_name_override_arg != nullptr) {
+    c->target_name_override =
+        gpr_strdup(grpc_channel_arg_get_string(target_name_override_arg));
+  }
+  return &c->base;
+}
+
+grpc_server_security_connector* grpc_fake_server_security_connector_create(
+    grpc_server_credentials* server_creds) {
+  grpc_server_security_connector* c =
+      static_cast<grpc_server_security_connector*>(
+          gpr_zalloc(sizeof(grpc_server_security_connector)));
+  gpr_ref_init(&c->base.refcount, 1);
+  c->base.vtable = &fake_server_vtable;
+  c->base.url_scheme = GRPC_FAKE_SECURITY_URL_SCHEME;
+  c->server_creds = server_creds;
+  c->add_handshakers = fake_server_add_handshakers;
+  return c;
+}

src/core/lib/security/security_connector/fake/fake_security_connector.h

@@ -0,0 +1,42 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_FAKE_FAKE_SECURITY_CONNECTOR_H
+#define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_FAKE_FAKE_SECURITY_CONNECTOR_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/channel/handshaker.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
+
+#define GRPC_FAKE_SECURITY_URL_SCHEME "http+fake_security"
+
+/* Creates a fake connector that emulates real channel security.  */
+grpc_channel_security_connector* grpc_fake_channel_security_connector_create(
+    grpc_channel_credentials* channel_creds,
+    grpc_call_credentials* request_metadata_creds, const char* target,
+    const grpc_channel_args* args);
+
+/* Creates a fake connector that emulates real server security.  */
+grpc_server_security_connector* grpc_fake_server_security_connector_create(
+    grpc_server_credentials* server_creds);
+
+#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_FAKE_FAKE_SECURITY_CONNECTOR_H \
+        */

src/core/lib/security/security_connector/local_security_connector.cc → src/core/lib/security/security_connector/local/local_security_connector.cc

@@ -18,7 +18,7 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/security/security_connector/local_security_connector.h"
+#include "src/core/lib/security/security_connector/local/local_security_connector.h"
 
 #include <stdbool.h>
 #include <string.h>

src/core/lib/security/security_connector/local_security_connector.h → src/core/lib/security/security_connector/local/local_security_connector.h

@@ -16,8 +16,8 @@
  *
  */
 
-#ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOCAL_SECURITY_CONNECTOR_H
-#define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOCAL_SECURITY_CONNECTOR_H
+#ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOCAL_LOCAL_SECURITY_CONNECTOR_H
+#define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOCAL_LOCAL_SECURITY_CONNECTOR_H
 
 #include <grpc/support/port_platform.h>
 
@@ -54,5 +54,5 @@ grpc_security_status grpc_local_channel_security_connector_create(
 grpc_security_status grpc_local_server_security_connector_create(
     grpc_server_credentials* server_creds, grpc_server_security_connector** sc);
 
-#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOCAL_SECURITY_CONNECTOR_H \
+#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOCAL_LOCAL_SECURITY_CONNECTOR_H \
         */

src/core/lib/security/security_connector/security_connector.cc

@@ -20,8 +20,6 @@
 
 #include "src/core/lib/security/security_connector/security_connector.h"
 
-#include <stdbool.h>
-
 #include <grpc/slice_buffer.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -36,88 +34,12 @@
 #include "src/core/lib/iomgr/load_file.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
-#include "src/core/lib/security/credentials/fake/fake_credentials.h"
-#include "src/core/lib/security/credentials/ssl/ssl_credentials.h"
 #include "src/core/lib/security/security_connector/load_system_roots.h"
-#include "src/core/lib/security/transport/secure_endpoint.h"
 #include "src/core/lib/security/transport/security_handshaker.h"
-#include "src/core/lib/security/transport/target_authority_table.h"
-#include "src/core/tsi/fake_transport_security.h"
-#include "src/core/tsi/ssl_transport_security.h"
 
 grpc_core::DebugOnlyTraceFlag grpc_trace_security_connector_refcount(
     false, "security_connector_refcount");
 
-/* -- Constants. -- */
-
-#ifndef INSTALL_PREFIX
-static const char* installed_roots_path = "/usr/share/grpc/roots.pem";
-#else
-static const char* installed_roots_path =
-    INSTALL_PREFIX "/share/grpc/roots.pem";
-#endif
-
-/** Environment variable used as a flag to enable/disable loading system root
-    certificates from the OS trust store. */
-#ifndef GRPC_NOT_USE_SYSTEM_SSL_ROOTS_ENV_VAR
-#define GRPC_NOT_USE_SYSTEM_SSL_ROOTS_ENV_VAR "GRPC_NOT_USE_SYSTEM_SSL_ROOTS"
-#endif
-
-#ifndef TSI_OPENSSL_ALPN_SUPPORT
-#define TSI_OPENSSL_ALPN_SUPPORT 1
-#endif
-
-/* -- Overridden default roots. -- */
-
-static grpc_ssl_roots_override_callback ssl_roots_override_cb = nullptr;
-
-void grpc_set_ssl_roots_override_callback(grpc_ssl_roots_override_callback cb) {
-  ssl_roots_override_cb = cb;
-}
-
-/* -- Cipher suites. -- */
-
-/* Defines the cipher suites that we accept by default. All these cipher suites
-   are compliant with HTTP2. */
-#define GRPC_SSL_CIPHER_SUITES     \
-  "ECDHE-ECDSA-AES128-GCM-SHA256:" \
-  "ECDHE-ECDSA-AES256-GCM-SHA384:" \
-  "ECDHE-RSA-AES128-GCM-SHA256:"   \
-  "ECDHE-RSA-AES256-GCM-SHA384"
-
-static gpr_once cipher_suites_once = GPR_ONCE_INIT;
-static const char* cipher_suites = nullptr;
-
-static void init_cipher_suites(void) {
-  char* overridden = gpr_getenv("GRPC_SSL_CIPHER_SUITES");
-  cipher_suites = overridden != nullptr ? overridden : GRPC_SSL_CIPHER_SUITES;
-}
-
-static const char* ssl_cipher_suites(void) {
-  gpr_once_init(&cipher_suites_once, init_cipher_suites);
-  return cipher_suites;
-}
-
-/* -- Common methods. -- */
-
-/* Returns the first property with that name. */
-const tsi_peer_property* tsi_peer_get_property_by_name(const tsi_peer* peer,
-                                                       const char* name) {
-  size_t i;
-  if (peer == nullptr) return nullptr;
-  for (i = 0; i < peer->property_count; i++) {
-    const tsi_peer_property* property = &peer->properties[i];
-    if (name == nullptr && property->name == nullptr) {
-      return property;
-    }
-    if (name != nullptr && property->name != nullptr &&
-        strcmp(property->name, name) == 0) {
-      return property;
-    }
-  }
-  return nullptr;
-}
-
 void grpc_channel_security_connector_add_handshakers(
     grpc_channel_security_connector* connector,
     grpc_pollset_set* interested_parties,
@@ -288,965 +210,3 @@ grpc_security_connector* grpc_security_connector_find_in_args(
   }
   return nullptr;
 }
-
-static tsi_client_certificate_request_type
-get_tsi_client_certificate_request_type(
-    grpc_ssl_client_certificate_request_type grpc_request_type) {
-  switch (grpc_request_type) {
-    case GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE:
-      return TSI_DONT_REQUEST_CLIENT_CERTIFICATE;
-
-    case GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY:
-      return TSI_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY;
-
-    case GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY:
-      return TSI_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY;
-
-    case GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY:
-      return TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY;
-
-    case GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY:
-      return TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY;
-
-    default:
-      return TSI_DONT_REQUEST_CLIENT_CERTIFICATE;
-  }
-}
-
-/* -- Fake implementation. -- */
-
-typedef struct {
-  grpc_channel_security_connector base;
-  char* target;
-  char* expected_targets;
-  bool is_lb_channel;
-  char* target_name_override;
-} grpc_fake_channel_security_connector;
-
-static void fake_channel_destroy(grpc_security_connector* sc) {
-  grpc_fake_channel_security_connector* c =
-      reinterpret_cast<grpc_fake_channel_security_connector*>(sc);
-  grpc_call_credentials_unref(c->base.request_metadata_creds);
-  gpr_free(c->target);
-  gpr_free(c->expected_targets);
-  gpr_free(c->target_name_override);
-  gpr_free(c);
-}
-
-static void fake_server_destroy(grpc_security_connector* sc) { gpr_free(sc); }
-
-static bool fake_check_target(const char* target_type, const char* target,
-                              const char* set_str) {
-  GPR_ASSERT(target_type != nullptr);
-  GPR_ASSERT(target != nullptr);
-  char** set = nullptr;
-  size_t set_size = 0;
-  gpr_string_split(set_str, ",", &set, &set_size);
-  bool found = false;
-  for (size_t i = 0; i < set_size; ++i) {
-    if (set[i] != nullptr && strcmp(target, set[i]) == 0) found = true;
-  }
-  for (size_t i = 0; i < set_size; ++i) {
-    gpr_free(set[i]);
-  }
-  gpr_free(set);
-  return found;
-}
-
-static void fake_secure_name_check(const char* target,
-                                   const char* expected_targets,
-                                   bool is_lb_channel) {
-  if (expected_targets == nullptr) return;
-  char** lbs_and_backends = nullptr;
-  size_t lbs_and_backends_size = 0;
-  bool success = false;
-  gpr_string_split(expected_targets, ";", &lbs_and_backends,
-                   &lbs_and_backends_size);
-  if (lbs_and_backends_size > 2 || lbs_and_backends_size == 0) {
-    gpr_log(GPR_ERROR, "Invalid expected targets arg value: '%s'",
-            expected_targets);
-    goto done;
-  }
-  if (is_lb_channel) {
-    if (lbs_and_backends_size != 2) {
-      gpr_log(GPR_ERROR,
-              "Invalid expected targets arg value: '%s'. Expectations for LB "
-              "channels must be of the form 'be1,be2,be3,...;lb1,lb2,...",
-              expected_targets);
-      goto done;
-    }
-    if (!fake_check_target("LB", target, lbs_and_backends[1])) {
-      gpr_log(GPR_ERROR, "LB target '%s' not found in expected set '%s'",
-              target, lbs_and_backends[1]);
-      goto done;
-    }
-    success = true;
-  } else {
-    if (!fake_check_target("Backend", target, lbs_and_backends[0])) {
-      gpr_log(GPR_ERROR, "Backend target '%s' not found in expected set '%s'",
-              target, lbs_and_backends[0]);
-      goto done;
-    }
-    success = true;
-  }
-done:
-  for (size_t i = 0; i < lbs_and_backends_size; ++i) {
-    gpr_free(lbs_and_backends[i]);
-  }
-  gpr_free(lbs_and_backends);
-  if (!success) abort();
-}
-
-static void fake_check_peer(grpc_security_connector* sc, tsi_peer peer,
-                            grpc_auth_context** auth_context,
-                            grpc_closure* on_peer_checked) {
-  const char* prop_name;
-  grpc_error* error = GRPC_ERROR_NONE;
-  *auth_context = nullptr;
-  if (peer.property_count != 1) {
-    error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "Fake peers should only have 1 property.");
-    goto end;
-  }
-  prop_name = peer.properties[0].name;
-  if (prop_name == nullptr ||
-      strcmp(prop_name, TSI_CERTIFICATE_TYPE_PEER_PROPERTY)) {
-    char* msg;
-    gpr_asprintf(&msg, "Unexpected property in fake peer: %s.",
-                 prop_name == nullptr ? "<EMPTY>" : prop_name);
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
-    gpr_free(msg);
-    goto end;
-  }
-  if (strncmp(peer.properties[0].value.data, TSI_FAKE_CERTIFICATE_TYPE,
-              peer.properties[0].value.length)) {
-    error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "Invalid value for cert type property.");
-    goto end;
-  }
-  *auth_context = grpc_auth_context_create(nullptr);
-  grpc_auth_context_add_cstring_property(
-      *auth_context, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
-      GRPC_FAKE_TRANSPORT_SECURITY_TYPE);
-end:
-  GRPC_CLOSURE_SCHED(on_peer_checked, error);
-  tsi_peer_destruct(&peer);
-}
-
-static void fake_channel_check_peer(grpc_security_connector* sc, tsi_peer peer,
-                                    grpc_auth_context** auth_context,
-                                    grpc_closure* on_peer_checked) {
-  fake_check_peer(sc, peer, auth_context, on_peer_checked);
-  grpc_fake_channel_security_connector* c =
-      reinterpret_cast<grpc_fake_channel_security_connector*>(sc);
-  fake_secure_name_check(c->target, c->expected_targets, c->is_lb_channel);
-}
-
-static void fake_server_check_peer(grpc_security_connector* sc, tsi_peer peer,
-                                   grpc_auth_context** auth_context,
-                                   grpc_closure* on_peer_checked) {
-  fake_check_peer(sc, peer, auth_context, on_peer_checked);
-}
-
-static int fake_channel_cmp(grpc_security_connector* sc1,
-                            grpc_security_connector* sc2) {
-  grpc_fake_channel_security_connector* c1 =
-      reinterpret_cast<grpc_fake_channel_security_connector*>(sc1);
-  grpc_fake_channel_security_connector* c2 =
-      reinterpret_cast<grpc_fake_channel_security_connector*>(sc2);
-  int c = grpc_channel_security_connector_cmp(&c1->base, &c2->base);
-  if (c != 0) return c;
-  c = strcmp(c1->target, c2->target);
-  if (c != 0) return c;
-  if (c1->expected_targets == nullptr || c2->expected_targets == nullptr) {
-    c = GPR_ICMP(c1->expected_targets, c2->expected_targets);
-  } else {
-    c = strcmp(c1->expected_targets, c2->expected_targets);
-  }
-  if (c != 0) return c;
-  return GPR_ICMP(c1->is_lb_channel, c2->is_lb_channel);
-}
-
-static int fake_server_cmp(grpc_security_connector* sc1,
-                           grpc_security_connector* sc2) {
-  return grpc_server_security_connector_cmp(
-      reinterpret_cast<grpc_server_security_connector*>(sc1),
-      reinterpret_cast<grpc_server_security_connector*>(sc2));
-}
-
-static bool fake_channel_check_call_host(grpc_channel_security_connector* sc,
-                                         const char* host,
-                                         grpc_auth_context* auth_context,
-                                         grpc_closure* on_call_host_checked,
-                                         grpc_error** error) {
-  grpc_fake_channel_security_connector* c =
-      reinterpret_cast<grpc_fake_channel_security_connector*>(sc);
-  char* authority_hostname = nullptr;
-  char* authority_ignored_port = nullptr;
-  char* target_hostname = nullptr;
-  char* target_ignored_port = nullptr;
-  gpr_split_host_port(host, &authority_hostname, &authority_ignored_port);
-  gpr_split_host_port(c->target, &target_hostname, &target_ignored_port);
-  if (c->target_name_override != nullptr) {
-    char* fake_security_target_name_override_hostname = nullptr;
-    char* fake_security_target_name_override_ignored_port = nullptr;
-    gpr_split_host_port(c->target_name_override,
-                        &fake_security_target_name_override_hostname,
-                        &fake_security_target_name_override_ignored_port);
-    if (strcmp(authority_hostname,
-               fake_security_target_name_override_hostname) != 0) {
-      gpr_log(GPR_ERROR,
-              "Authority (host) '%s' != Fake Security Target override '%s'",
-              host, fake_security_target_name_override_hostname);
-      abort();
-    }
-    gpr_free(fake_security_target_name_override_hostname);
-    gpr_free(fake_security_target_name_override_ignored_port);
-  } else if (strcmp(authority_hostname, target_hostname) != 0) {
-    gpr_log(GPR_ERROR, "Authority (host) '%s' != Target '%s'",
-            authority_hostname, target_hostname);
-    abort();
-  }
-  gpr_free(authority_hostname);
-  gpr_free(authority_ignored_port);
-  gpr_free(target_hostname);
-  gpr_free(target_ignored_port);
-  return true;
-}
-
-static void fake_channel_cancel_check_call_host(
-    grpc_channel_security_connector* sc, grpc_closure* on_call_host_checked,
-    grpc_error* error) {
-  GRPC_ERROR_UNREF(error);
-}
-
-static void fake_channel_add_handshakers(
-    grpc_channel_security_connector* sc, grpc_pollset_set* interested_parties,
-    grpc_handshake_manager* handshake_mgr) {
-  grpc_handshake_manager_add(
-      handshake_mgr,
-      grpc_security_handshaker_create(
-          tsi_create_fake_handshaker(true /* is_client */), &sc->base));
-}
-
-static void fake_server_add_handshakers(grpc_server_security_connector* sc,
-                                        grpc_pollset_set* interested_parties,
-                                        grpc_handshake_manager* handshake_mgr) {
-  grpc_handshake_manager_add(
-      handshake_mgr,
-      grpc_security_handshaker_create(
-          tsi_create_fake_handshaker(false /* is_client */), &sc->base));
-}
-
-static grpc_security_connector_vtable fake_channel_vtable = {
-    fake_channel_destroy, fake_channel_check_peer, fake_channel_cmp};
-
-static grpc_security_connector_vtable fake_server_vtable = {
-    fake_server_destroy, fake_server_check_peer, fake_server_cmp};
-
-grpc_channel_security_connector* grpc_fake_channel_security_connector_create(
-    grpc_channel_credentials* channel_creds,
-    grpc_call_credentials* request_metadata_creds, const char* target,
-    const grpc_channel_args* args) {
-  grpc_fake_channel_security_connector* c =
-      static_cast<grpc_fake_channel_security_connector*>(
-          gpr_zalloc(sizeof(*c)));
-  gpr_ref_init(&c->base.base.refcount, 1);
-  c->base.base.url_scheme = GRPC_FAKE_SECURITY_URL_SCHEME;
-  c->base.base.vtable = &fake_channel_vtable;
-  c->base.channel_creds = channel_creds;
-  c->base.request_metadata_creds =
-      grpc_call_credentials_ref(request_metadata_creds);
-  c->base.check_call_host = fake_channel_check_call_host;
-  c->base.cancel_check_call_host = fake_channel_cancel_check_call_host;
-  c->base.add_handshakers = fake_channel_add_handshakers;
-  c->target = gpr_strdup(target);
-  const char* expected_targets = grpc_fake_transport_get_expected_targets(args);
-  c->expected_targets = gpr_strdup(expected_targets);
-  c->is_lb_channel = grpc_core::FindTargetAuthorityTableInArgs(args) != nullptr;
-  const grpc_arg* target_name_override_arg =
-      grpc_channel_args_find(args, GRPC_SSL_TARGET_NAME_OVERRIDE_ARG);
-  if (target_name_override_arg != nullptr) {
-    c->target_name_override =
-        gpr_strdup(grpc_channel_arg_get_string(target_name_override_arg));
-  }
-  return &c->base;
-}
-
-grpc_server_security_connector* grpc_fake_server_security_connector_create(
-    grpc_server_credentials* server_creds) {
-  grpc_server_security_connector* c =
-      static_cast<grpc_server_security_connector*>(
-          gpr_zalloc(sizeof(grpc_server_security_connector)));
-  gpr_ref_init(&c->base.refcount, 1);
-  c->base.vtable = &fake_server_vtable;
-  c->base.url_scheme = GRPC_FAKE_SECURITY_URL_SCHEME;
-  c->server_creds = server_creds;
-  c->add_handshakers = fake_server_add_handshakers;
-  return c;
-}
-
-/* --- Ssl implementation. --- */
-
-grpc_ssl_session_cache* grpc_ssl_session_cache_create_lru(size_t capacity) {
-  tsi_ssl_session_cache* cache = tsi_ssl_session_cache_create_lru(capacity);
-  return reinterpret_cast<grpc_ssl_session_cache*>(cache);
-}
-
-void grpc_ssl_session_cache_destroy(grpc_ssl_session_cache* cache) {
-  tsi_ssl_session_cache* tsi_cache =
-      reinterpret_cast<tsi_ssl_session_cache*>(cache);
-  tsi_ssl_session_cache_unref(tsi_cache);
-}
-
-static void* grpc_ssl_session_cache_arg_copy(void* p) {
-  tsi_ssl_session_cache* tsi_cache =
-      reinterpret_cast<tsi_ssl_session_cache*>(p);
-  // destroy call below will unref the pointer.
-  tsi_ssl_session_cache_ref(tsi_cache);
-  return p;
-}
-
-static void grpc_ssl_session_cache_arg_destroy(void* p) {
-  tsi_ssl_session_cache* tsi_cache =
-      reinterpret_cast<tsi_ssl_session_cache*>(p);
-  tsi_ssl_session_cache_unref(tsi_cache);
-}
-
-static int grpc_ssl_session_cache_arg_cmp(void* p, void* q) {
-  return GPR_ICMP(p, q);
-}
-
-grpc_arg grpc_ssl_session_cache_create_channel_arg(
-    grpc_ssl_session_cache* cache) {
-  static const grpc_arg_pointer_vtable vtable = {
-      grpc_ssl_session_cache_arg_copy,
-      grpc_ssl_session_cache_arg_destroy,
-      grpc_ssl_session_cache_arg_cmp,
-  };
-  return grpc_channel_arg_pointer_create(
-      const_cast<char*>(GRPC_SSL_SESSION_CACHE_ARG), cache, &vtable);
-}
-
-typedef struct {
-  grpc_channel_security_connector base;
-  tsi_ssl_client_handshaker_factory* client_handshaker_factory;
-  char* target_name;
-  char* overridden_target_name;
-  const verify_peer_options* verify_options;
-} grpc_ssl_channel_security_connector;
-
-typedef struct {
-  grpc_server_security_connector base;
-  tsi_ssl_server_handshaker_factory* server_handshaker_factory;
-} grpc_ssl_server_security_connector;
-
-static bool server_connector_has_cert_config_fetcher(
-    grpc_ssl_server_security_connector* c) {
-  GPR_ASSERT(c != nullptr);
-  grpc_ssl_server_credentials* server_creds =
-      reinterpret_cast<grpc_ssl_server_credentials*>(c->base.server_creds);
-  GPR_ASSERT(server_creds != nullptr);
-  return server_creds->certificate_config_fetcher.cb != nullptr;
-}
-
-static void ssl_channel_destroy(grpc_security_connector* sc) {
-  grpc_ssl_channel_security_connector* c =
-      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc);
-  grpc_channel_credentials_unref(c->base.channel_creds);
-  grpc_call_credentials_unref(c->base.request_metadata_creds);
-  tsi_ssl_client_handshaker_factory_unref(c->client_handshaker_factory);
-  c->client_handshaker_factory = nullptr;
-  if (c->target_name != nullptr) gpr_free(c->target_name);
-  if (c->overridden_target_name != nullptr) gpr_free(c->overridden_target_name);
-  gpr_free(sc);
-}
-
-static void ssl_server_destroy(grpc_security_connector* sc) {
-  grpc_ssl_server_security_connector* c =
-      reinterpret_cast<grpc_ssl_server_security_connector*>(sc);
-  grpc_server_credentials_unref(c->base.server_creds);
-  tsi_ssl_server_handshaker_factory_unref(c->server_handshaker_factory);
-  c->server_handshaker_factory = nullptr;
-  gpr_free(sc);
-}
-
-static void ssl_channel_add_handshakers(grpc_channel_security_connector* sc,
-                                        grpc_pollset_set* interested_parties,
-                                        grpc_handshake_manager* handshake_mgr) {
-  grpc_ssl_channel_security_connector* c =
-      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc);
-  // Instantiate TSI handshaker.
-  tsi_handshaker* tsi_hs = nullptr;
-  tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
-      c->client_handshaker_factory,
-      c->overridden_target_name != nullptr ? c->overridden_target_name
-                                           : c->target_name,
-      &tsi_hs);
-  if (result != TSI_OK) {
-    gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
-            tsi_result_to_string(result));
-    return;
-  }
-  // Create handshakers.
-  grpc_handshake_manager_add(
-      handshake_mgr, grpc_security_handshaker_create(tsi_hs, &sc->base));
-}
-
-static const char** fill_alpn_protocol_strings(size_t* num_alpn_protocols) {
-  GPR_ASSERT(num_alpn_protocols != nullptr);
-  *num_alpn_protocols = grpc_chttp2_num_alpn_versions();
-  const char** alpn_protocol_strings = static_cast<const char**>(
-      gpr_malloc(sizeof(const char*) * (*num_alpn_protocols)));
-  for (size_t i = 0; i < *num_alpn_protocols; i++) {
-    alpn_protocol_strings[i] = grpc_chttp2_get_alpn_version_index(i);
-  }
-  return alpn_protocol_strings;
-}
-
-/* Attempts to replace the server_handshaker_factory with a new factory using
- * the provided grpc_ssl_server_certificate_config. Should new factory creation
- * fail, the existing factory will not be replaced. Returns true on success (new
- * factory created). */
-static bool try_replace_server_handshaker_factory(
-    grpc_ssl_server_security_connector* sc,
-    const grpc_ssl_server_certificate_config* config) {
-  if (config == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Server certificate config callback returned invalid (NULL) "
-            "config.");
-    return false;
-  }
-  gpr_log(GPR_DEBUG, "Using new server certificate config (%p).", config);
-
-  size_t num_alpn_protocols = 0;
-  const char** alpn_protocol_strings =
-      fill_alpn_protocol_strings(&num_alpn_protocols);
-  tsi_ssl_pem_key_cert_pair* cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
-      config->pem_key_cert_pairs, config->num_key_cert_pairs);
-  tsi_ssl_server_handshaker_factory* new_handshaker_factory = nullptr;
-  grpc_ssl_server_credentials* server_creds =
-      reinterpret_cast<grpc_ssl_server_credentials*>(sc->base.server_creds);
-  tsi_result result = tsi_create_ssl_server_handshaker_factory_ex(
-      cert_pairs, config->num_key_cert_pairs, config->pem_root_certs,
-      get_tsi_client_certificate_request_type(
-          server_creds->config.client_certificate_request),
-      ssl_cipher_suites(), alpn_protocol_strings,
-      static_cast<uint16_t>(num_alpn_protocols), &new_handshaker_factory);
-  gpr_free(cert_pairs);
-  gpr_free((void*)alpn_protocol_strings);
-
-  if (result != TSI_OK) {
-    gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
-            tsi_result_to_string(result));
-    return false;
-  }
-  tsi_ssl_server_handshaker_factory_unref(sc->server_handshaker_factory);
-  sc->server_handshaker_factory = new_handshaker_factory;
-  return true;
-}
-
-/* Attempts to fetch the server certificate config if a callback is available.
- * Current certificate config will continue to be used if the callback returns
- * an error. Returns true if new credentials were sucessfully loaded. */
-static bool try_fetch_ssl_server_credentials(
-    grpc_ssl_server_security_connector* sc) {
-  grpc_ssl_server_certificate_config* certificate_config = nullptr;
-  bool status;
-
-  GPR_ASSERT(sc != nullptr);
-  if (!server_connector_has_cert_config_fetcher(sc)) return false;
-
-  grpc_ssl_server_credentials* server_creds =
-      reinterpret_cast<grpc_ssl_server_credentials*>(sc->base.server_creds);
-  grpc_ssl_certificate_config_reload_status cb_result =
-      server_creds->certificate_config_fetcher.cb(
-          server_creds->certificate_config_fetcher.user_data,
-          &certificate_config);
-  if (cb_result == GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_UNCHANGED) {
-    gpr_log(GPR_DEBUG, "No change in SSL server credentials.");
-    status = false;
-  } else if (cb_result == GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_NEW) {
-    status = try_replace_server_handshaker_factory(sc, certificate_config);
-  } else {
-    // Log error, continue using previously-loaded credentials.
-    gpr_log(GPR_ERROR,
-            "Failed fetching new server credentials, continuing to "
-            "use previously-loaded credentials.");
-    status = false;
-  }
-
-  if (certificate_config != nullptr) {
-    grpc_ssl_server_certificate_config_destroy(certificate_config);
-  }
-  return status;
-}
-
-static void ssl_server_add_handshakers(grpc_server_security_connector* sc,
-                                       grpc_pollset_set* interested_parties,
-                                       grpc_handshake_manager* handshake_mgr) {
-  grpc_ssl_server_security_connector* c =
-      reinterpret_cast<grpc_ssl_server_security_connector*>(sc);
-  // Instantiate TSI handshaker.
-  try_fetch_ssl_server_credentials(c);
-  tsi_handshaker* tsi_hs = nullptr;
-  tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
-      c->server_handshaker_factory, &tsi_hs);
-  if (result != TSI_OK) {
-    gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
-            tsi_result_to_string(result));
-    return;
-  }
-  // Create handshakers.
-  grpc_handshake_manager_add(
-      handshake_mgr, grpc_security_handshaker_create(tsi_hs, &sc->base));
-}
-
-int grpc_ssl_host_matches_name(const tsi_peer* peer, const char* peer_name) {
-  char* allocated_name = nullptr;
-  int r;
-
-  char* ignored_port;
-  gpr_split_host_port(peer_name, &allocated_name, &ignored_port);
-  gpr_free(ignored_port);
-  peer_name = allocated_name;
-  if (!peer_name) return 0;
-
-  // IPv6 zone-id should not be included in comparisons.
-  char* const zone_id = strchr(allocated_name, '%');
-  if (zone_id != nullptr) *zone_id = '\0';
-
-  r = tsi_ssl_peer_matches_name(peer, peer_name);
-  gpr_free(allocated_name);
-  return r;
-}
-
-grpc_auth_context* grpc_ssl_peer_to_auth_context(const tsi_peer* peer) {
-  size_t i;
-  grpc_auth_context* ctx = nullptr;
-  const char* peer_identity_property_name = nullptr;
-
-  /* The caller has checked the certificate type property. */
-  GPR_ASSERT(peer->property_count >= 1);
-  ctx = grpc_auth_context_create(nullptr);
-  grpc_auth_context_add_cstring_property(
-      ctx, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
-      GRPC_SSL_TRANSPORT_SECURITY_TYPE);
-  for (i = 0; i < peer->property_count; i++) {
-    const tsi_peer_property* prop = &peer->properties[i];
-    if (prop->name == nullptr) continue;
-    if (strcmp(prop->name, TSI_X509_SUBJECT_COMMON_NAME_PEER_PROPERTY) == 0) {
-      /* If there is no subject alt name, have the CN as the identity. */
-      if (peer_identity_property_name == nullptr) {
-        peer_identity_property_name = GRPC_X509_CN_PROPERTY_NAME;
-      }
-      grpc_auth_context_add_property(ctx, GRPC_X509_CN_PROPERTY_NAME,
-                                     prop->value.data, prop->value.length);
-    } else if (strcmp(prop->name,
-                      TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY) == 0) {
-      peer_identity_property_name = GRPC_X509_SAN_PROPERTY_NAME;
-      grpc_auth_context_add_property(ctx, GRPC_X509_SAN_PROPERTY_NAME,
-                                     prop->value.data, prop->value.length);
-    } else if (strcmp(prop->name, TSI_X509_PEM_CERT_PROPERTY) == 0) {
-      grpc_auth_context_add_property(ctx, GRPC_X509_PEM_CERT_PROPERTY_NAME,
-                                     prop->value.data, prop->value.length);
-    } else if (strcmp(prop->name, TSI_SSL_SESSION_REUSED_PEER_PROPERTY) == 0) {
-      grpc_auth_context_add_property(ctx, GRPC_SSL_SESSION_REUSED_PROPERTY,
-                                     prop->value.data, prop->value.length);
-    }
-  }
-  if (peer_identity_property_name != nullptr) {
-    GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name(
-                   ctx, peer_identity_property_name) == 1);
-  }
-  return ctx;
-}
-
-static grpc_error* ssl_check_peer(grpc_security_connector* sc,
-                                  const char* peer_name, const tsi_peer* peer,
-                                  grpc_auth_context** auth_context) {
-#if TSI_OPENSSL_ALPN_SUPPORT
-  /* Check the ALPN if ALPN is supported. */
-  const tsi_peer_property* p =
-      tsi_peer_get_property_by_name(peer, TSI_SSL_ALPN_SELECTED_PROTOCOL);
-  if (p == nullptr) {
-    return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "Cannot check peer: missing selected ALPN property.");
-  }
-  if (!grpc_chttp2_is_alpn_version_supported(p->value.data, p->value.length)) {
-    return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "Cannot check peer: invalid ALPN value.");
-  }
-#endif /* TSI_OPENSSL_ALPN_SUPPORT */
-  /* Check the peer name if specified. */
-  if (peer_name != nullptr && !grpc_ssl_host_matches_name(peer, peer_name)) {
-    char* msg;
-    gpr_asprintf(&msg, "Peer name %s is not in peer certificate", peer_name);
-    grpc_error* error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
-    gpr_free(msg);
-    return error;
-  }
-  *auth_context = grpc_ssl_peer_to_auth_context(peer);
-  return GRPC_ERROR_NONE;
-}
-
-static void ssl_channel_check_peer(grpc_security_connector* sc, tsi_peer peer,
-                                   grpc_auth_context** auth_context,
-                                   grpc_closure* on_peer_checked) {
-  grpc_ssl_channel_security_connector* c =
-      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc);
-  const char* target_name = c->overridden_target_name != nullptr
-                                ? c->overridden_target_name
-                                : c->target_name;
-  grpc_error* error = ssl_check_peer(sc, target_name, &peer, auth_context);
-  if (error == GRPC_ERROR_NONE &&
-      c->verify_options->verify_peer_callback != nullptr) {
-    const tsi_peer_property* p =
-        tsi_peer_get_property_by_name(&peer, TSI_X509_PEM_CERT_PROPERTY);
-    if (p == nullptr) {
-      error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-          "Cannot check peer: missing pem cert property.");
-    } else {
-      char* peer_pem = static_cast<char*>(gpr_malloc(p->value.length + 1));
-      memcpy(peer_pem, p->value.data, p->value.length);
-      peer_pem[p->value.length] = '\0';
-      int callback_status = c->verify_options->verify_peer_callback(
-          target_name, peer_pem,
-          c->verify_options->verify_peer_callback_userdata);
-      gpr_free(peer_pem);
-      if (callback_status) {
-        char* msg;
-        gpr_asprintf(&msg, "Verify peer callback returned a failure (%d)",
-                     callback_status);
-        error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
-        gpr_free(msg);
-      }
-    }
-  }
-  GRPC_CLOSURE_SCHED(on_peer_checked, error);
-  tsi_peer_destruct(&peer);
-}
-
-static void ssl_server_check_peer(grpc_security_connector* sc, tsi_peer peer,
-                                  grpc_auth_context** auth_context,
-                                  grpc_closure* on_peer_checked) {
-  grpc_error* error = ssl_check_peer(sc, nullptr, &peer, auth_context);
-  tsi_peer_destruct(&peer);
-  GRPC_CLOSURE_SCHED(on_peer_checked, error);
-}
-
-static int ssl_channel_cmp(grpc_security_connector* sc1,
-                           grpc_security_connector* sc2) {
-  grpc_ssl_channel_security_connector* c1 =
-      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc1);
-  grpc_ssl_channel_security_connector* c2 =
-      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc2);
-  int c = grpc_channel_security_connector_cmp(&c1->base, &c2->base);
-  if (c != 0) return c;
-  c = strcmp(c1->target_name, c2->target_name);
-  if (c != 0) return c;
-  return (c1->overridden_target_name == nullptr ||
-          c2->overridden_target_name == nullptr)
-             ? GPR_ICMP(c1->overridden_target_name, c2->overridden_target_name)
-             : strcmp(c1->overridden_target_name, c2->overridden_target_name);
-}
-
-static int ssl_server_cmp(grpc_security_connector* sc1,
-                          grpc_security_connector* sc2) {
-  return grpc_server_security_connector_cmp(
-      reinterpret_cast<grpc_server_security_connector*>(sc1),
-      reinterpret_cast<grpc_server_security_connector*>(sc2));
-}
-
-static void add_shallow_auth_property_to_peer(tsi_peer* peer,
-                                              const grpc_auth_property* prop,
-                                              const char* tsi_prop_name) {
-  tsi_peer_property* tsi_prop = &peer->properties[peer->property_count++];
-  tsi_prop->name = const_cast<char*>(tsi_prop_name);
-  tsi_prop->value.data = prop->value;
-  tsi_prop->value.length = prop->value_length;
-}
-
-tsi_peer grpc_shallow_peer_from_ssl_auth_context(
-    const grpc_auth_context* auth_context) {
-  size_t max_num_props = 0;
-  grpc_auth_property_iterator it;
-  const grpc_auth_property* prop;
-  tsi_peer peer;
-  memset(&peer, 0, sizeof(peer));
-
-  it = grpc_auth_context_property_iterator(auth_context);
-  while (grpc_auth_property_iterator_next(&it) != nullptr) max_num_props++;
-
-  if (max_num_props > 0) {
-    peer.properties = static_cast<tsi_peer_property*>(
-        gpr_malloc(max_num_props * sizeof(tsi_peer_property)));
-    it = grpc_auth_context_property_iterator(auth_context);
-    while ((prop = grpc_auth_property_iterator_next(&it)) != nullptr) {
-      if (strcmp(prop->name, GRPC_X509_SAN_PROPERTY_NAME) == 0) {
-        add_shallow_auth_property_to_peer(
-            &peer, prop, TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY);
-      } else if (strcmp(prop->name, GRPC_X509_CN_PROPERTY_NAME) == 0) {
-        add_shallow_auth_property_to_peer(
-            &peer, prop, TSI_X509_SUBJECT_COMMON_NAME_PEER_PROPERTY);
-      } else if (strcmp(prop->name, GRPC_X509_PEM_CERT_PROPERTY_NAME) == 0) {
-        add_shallow_auth_property_to_peer(&peer, prop,
-                                          TSI_X509_PEM_CERT_PROPERTY);
-      }
-    }
-  }
-  return peer;
-}
-
-void grpc_shallow_peer_destruct(tsi_peer* peer) {
-  if (peer->properties != nullptr) gpr_free(peer->properties);
-}
-
-static bool ssl_channel_check_call_host(grpc_channel_security_connector* sc,
-                                        const char* host,
-                                        grpc_auth_context* auth_context,
-                                        grpc_closure* on_call_host_checked,
-                                        grpc_error** error) {
-  grpc_ssl_channel_security_connector* c =
-      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc);
-  grpc_security_status status = GRPC_SECURITY_ERROR;
-  tsi_peer peer = grpc_shallow_peer_from_ssl_auth_context(auth_context);
-  if (grpc_ssl_host_matches_name(&peer, host)) status = GRPC_SECURITY_OK;
-  /* If the target name was overridden, then the original target_name was
-     'checked' transitively during the previous peer check at the end of the
-     handshake. */
-  if (c->overridden_target_name != nullptr &&
-      strcmp(host, c->target_name) == 0) {
-    status = GRPC_SECURITY_OK;
-  }
-  if (status != GRPC_SECURITY_OK) {
-    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "call host does not match SSL server name");
-  }
-  grpc_shallow_peer_destruct(&peer);
-  return true;
-}
-
-static void ssl_channel_cancel_check_call_host(
-    grpc_channel_security_connector* sc, grpc_closure* on_call_host_checked,
-    grpc_error* error) {
-  GRPC_ERROR_UNREF(error);
-}
-
-static grpc_security_connector_vtable ssl_channel_vtable = {
-    ssl_channel_destroy, ssl_channel_check_peer, ssl_channel_cmp};
-
-static grpc_security_connector_vtable ssl_server_vtable = {
-    ssl_server_destroy, ssl_server_check_peer, ssl_server_cmp};
-
-grpc_security_status grpc_ssl_channel_security_connector_create(
-    grpc_channel_credentials* channel_creds,
-    grpc_call_credentials* request_metadata_creds,
-    const grpc_ssl_config* config, const char* target_name,
-    const char* overridden_target_name,
-    tsi_ssl_session_cache* ssl_session_cache,
-    grpc_channel_security_connector** sc) {
-  tsi_result result = TSI_OK;
-  grpc_ssl_channel_security_connector* c;
-  char* port;
-  bool has_key_cert_pair;
-  tsi_ssl_client_handshaker_options options;
-  memset(&options, 0, sizeof(options));
-  options.alpn_protocols =
-      fill_alpn_protocol_strings(&options.num_alpn_protocols);
-
-  if (config == nullptr || target_name == nullptr) {
-    gpr_log(GPR_ERROR, "An ssl channel needs a config and a target name.");
-    goto error;
-  }
-  if (config->pem_root_certs == nullptr) {
-    // Use default root certificates.
-    options.pem_root_certs = grpc_core::DefaultSslRootStore::GetPemRootCerts();
-    options.root_store = grpc_core::DefaultSslRootStore::GetRootStore();
-    if (options.pem_root_certs == nullptr) {
-      gpr_log(GPR_ERROR, "Could not get default pem root certs.");
-      goto error;
-    }
-  } else {
-    options.pem_root_certs = config->pem_root_certs;
-  }
-  c = static_cast<grpc_ssl_channel_security_connector*>(
-      gpr_zalloc(sizeof(grpc_ssl_channel_security_connector)));
-
-  gpr_ref_init(&c->base.base.refcount, 1);
-  c->base.base.vtable = &ssl_channel_vtable;
-  c->base.base.url_scheme = GRPC_SSL_URL_SCHEME;
-  c->base.channel_creds = grpc_channel_credentials_ref(channel_creds);
-  c->base.request_metadata_creds =
-      grpc_call_credentials_ref(request_metadata_creds);
-  c->base.check_call_host = ssl_channel_check_call_host;
-  c->base.cancel_check_call_host = ssl_channel_cancel_check_call_host;
-  c->base.add_handshakers = ssl_channel_add_handshakers;
-  gpr_split_host_port(target_name, &c->target_name, &port);
-  gpr_free(port);
-  if (overridden_target_name != nullptr) {
-    c->overridden_target_name = gpr_strdup(overridden_target_name);
-  }
-  c->verify_options = &config->verify_options;
-
-  has_key_cert_pair = config->pem_key_cert_pair != nullptr &&
-                      config->pem_key_cert_pair->private_key != nullptr &&
-                      config->pem_key_cert_pair->cert_chain != nullptr;
-  if (has_key_cert_pair) {
-    options.pem_key_cert_pair = config->pem_key_cert_pair;
-  }
-  options.cipher_suites = ssl_cipher_suites();
-  options.session_cache = ssl_session_cache;
-  result = tsi_create_ssl_client_handshaker_factory_with_options(
-      &options, &c->client_handshaker_factory);
-  if (result != TSI_OK) {
-    gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
-            tsi_result_to_string(result));
-    ssl_channel_destroy(&c->base.base);
-    *sc = nullptr;
-    goto error;
-  }
-  *sc = &c->base;
-  gpr_free((void*)options.alpn_protocols);
-  return GRPC_SECURITY_OK;
-
-error:
-  gpr_free((void*)options.alpn_protocols);
-  return GRPC_SECURITY_ERROR;
-}
-
-static grpc_ssl_server_security_connector*
-grpc_ssl_server_security_connector_initialize(
-    grpc_server_credentials* server_creds) {
-  grpc_ssl_server_security_connector* c =
-      static_cast<grpc_ssl_server_security_connector*>(
-          gpr_zalloc(sizeof(grpc_ssl_server_security_connector)));
-  gpr_ref_init(&c->base.base.refcount, 1);
-  c->base.base.url_scheme = GRPC_SSL_URL_SCHEME;
-  c->base.base.vtable = &ssl_server_vtable;
-  c->base.add_handshakers = ssl_server_add_handshakers;
-  c->base.server_creds = grpc_server_credentials_ref(server_creds);
-  return c;
-}
-
-grpc_security_status grpc_ssl_server_security_connector_create(
-    grpc_server_credentials* gsc, grpc_server_security_connector** sc) {
-  tsi_result result = TSI_OK;
-  grpc_ssl_server_credentials* server_credentials =
-      reinterpret_cast<grpc_ssl_server_credentials*>(gsc);
-  grpc_security_status retval = GRPC_SECURITY_OK;
-
-  GPR_ASSERT(server_credentials != nullptr);
-  GPR_ASSERT(sc != nullptr);
-
-  grpc_ssl_server_security_connector* c =
-      grpc_ssl_server_security_connector_initialize(gsc);
-  if (server_connector_has_cert_config_fetcher(c)) {
-    // Load initial credentials from certificate_config_fetcher:
-    if (!try_fetch_ssl_server_credentials(c)) {
-      gpr_log(GPR_ERROR, "Failed loading SSL server credentials from fetcher.");
-      retval = GRPC_SECURITY_ERROR;
-    }
-  } else {
-    size_t num_alpn_protocols = 0;
-    const char** alpn_protocol_strings =
-        fill_alpn_protocol_strings(&num_alpn_protocols);
-    result = tsi_create_ssl_server_handshaker_factory_ex(
-        server_credentials->config.pem_key_cert_pairs,
-        server_credentials->config.num_key_cert_pairs,
-        server_credentials->config.pem_root_certs,
-        get_tsi_client_certificate_request_type(
-            server_credentials->config.client_certificate_request),
-        ssl_cipher_suites(), alpn_protocol_strings,
-        static_cast<uint16_t>(num_alpn_protocols),
-        &c->server_handshaker_factory);
-    gpr_free((void*)alpn_protocol_strings);
-    if (result != TSI_OK) {
-      gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
-              tsi_result_to_string(result));
-      retval = GRPC_SECURITY_ERROR;
-    }
-  }
-
-  if (retval == GRPC_SECURITY_OK) {
-    *sc = &c->base;
-  } else {
-    if (c != nullptr) ssl_server_destroy(&c->base.base);
-    if (sc != nullptr) *sc = nullptr;
-  }
-  return retval;
-}
-
-namespace grpc_core {
-
-tsi_ssl_root_certs_store* DefaultSslRootStore::default_root_store_;
-grpc_slice DefaultSslRootStore::default_pem_root_certs_;
-
-const tsi_ssl_root_certs_store* DefaultSslRootStore::GetRootStore() {
-  InitRootStore();
-  return default_root_store_;
-}
-
-const char* DefaultSslRootStore::GetPemRootCerts() {
-  InitRootStore();
-  return GRPC_SLICE_IS_EMPTY(default_pem_root_certs_)
-             ? nullptr
-             : reinterpret_cast<const char*>
-                   GRPC_SLICE_START_PTR(default_pem_root_certs_);
-}
-
-grpc_slice DefaultSslRootStore::ComputePemRootCerts() {
-  grpc_slice result = grpc_empty_slice();
-  char* not_use_system_roots_env_value =
-      gpr_getenv(GRPC_NOT_USE_SYSTEM_SSL_ROOTS_ENV_VAR);
-  const bool not_use_system_roots = gpr_is_true(not_use_system_roots_env_value);
-  gpr_free(not_use_system_roots_env_value);
-  // First try to load the roots from the environment.
-  char* default_root_certs_path =
-      gpr_getenv(GRPC_DEFAULT_SSL_ROOTS_FILE_PATH_ENV_VAR);
-  if (default_root_certs_path != nullptr) {
-    GRPC_LOG_IF_ERROR("load_file",
-                      grpc_load_file(default_root_certs_path, 1, &result));
-    gpr_free(default_root_certs_path);
-  }
-  // Try overridden roots if needed.
-  grpc_ssl_roots_override_result ovrd_res = GRPC_SSL_ROOTS_OVERRIDE_FAIL;
-  if (GRPC_SLICE_IS_EMPTY(result) && ssl_roots_override_cb != nullptr) {
-    char* pem_root_certs = nullptr;
-    ovrd_res = ssl_roots_override_cb(&pem_root_certs);
-    if (ovrd_res == GRPC_SSL_ROOTS_OVERRIDE_OK) {
-      GPR_ASSERT(pem_root_certs != nullptr);
-      result = grpc_slice_from_copied_buffer(
-          pem_root_certs,
-          strlen(pem_root_certs) + 1);  // nullptr terminator.
-    }
-    gpr_free(pem_root_certs);
-  }
-  // Try loading roots from OS trust store if flag is enabled.
-  if (GRPC_SLICE_IS_EMPTY(result) && !not_use_system_roots) {
-    result = LoadSystemRootCerts();
-  }
-  // Fallback to roots manually shipped with gRPC.
-  if (GRPC_SLICE_IS_EMPTY(result) &&
-      ovrd_res != GRPC_SSL_ROOTS_OVERRIDE_FAIL_PERMANENTLY) {
-    GRPC_LOG_IF_ERROR("load_file",
-                      grpc_load_file(installed_roots_path, 1, &result));
-  }
-  return result;
-}
-
-void DefaultSslRootStore::InitRootStore() {
-  static gpr_once once = GPR_ONCE_INIT;
-  gpr_once_init(&once, DefaultSslRootStore::InitRootStoreOnce);
-}
-
-void DefaultSslRootStore::InitRootStoreOnce() {
-  default_pem_root_certs_ = ComputePemRootCerts();
-  if (!GRPC_SLICE_IS_EMPTY(default_pem_root_certs_)) {
-    default_root_store_ =
-        tsi_ssl_root_certs_store_create(reinterpret_cast<const char*>(
-            GRPC_SLICE_START_PTR(default_pem_root_certs_)));
-  }
-}
-
-}  // namespace grpc_core

src/core/lib/security/security_connector/security_connector.h

@@ -38,11 +38,6 @@ extern grpc_core::DebugOnlyTraceFlag grpc_trace_security_connector_refcount;
 
 typedef enum { GRPC_SECURITY_OK = 0, GRPC_SECURITY_ERROR } grpc_security_status;
 
-/* --- URL schemes. --- */
-
-#define GRPC_SSL_URL_SCHEME "https"
-#define GRPC_FAKE_SECURITY_URL_SCHEME "http+fake_security"
-
 /* --- security_connector object. ---
 
     A security connector object represents away to configure the underlying
@@ -179,112 +174,4 @@ void grpc_server_security_connector_add_handshakers(
     grpc_server_security_connector* sc, grpc_pollset_set* interested_parties,
     grpc_handshake_manager* handshake_mgr);
 
-/* --- Creation security connectors. --- */
-
-/* For TESTING ONLY!
-   Creates a fake connector that emulates real channel security.  */
-grpc_channel_security_connector* grpc_fake_channel_security_connector_create(
-    grpc_channel_credentials* channel_creds,
-    grpc_call_credentials* request_metadata_creds, const char* target,
-    const grpc_channel_args* args);
-
-/* For TESTING ONLY!
-   Creates a fake connector that emulates real server security.  */
-grpc_server_security_connector* grpc_fake_server_security_connector_create(
-    grpc_server_credentials* server_creds);
-
-/* Config for ssl clients. */
-
-typedef struct {
-  tsi_ssl_pem_key_cert_pair* pem_key_cert_pair;
-  char* pem_root_certs;
-  verify_peer_options verify_options;
-} grpc_ssl_config;
-
-/* Creates an SSL channel_security_connector.
-   - request_metadata_creds is the credentials object which metadata
-     will be sent with each request. This parameter can be NULL.
-   - config is the SSL config to be used for the SSL channel establishment.
-   - is_client should be 0 for a server or a non-0 value for a client.
-   - secure_peer_name is the secure peer name that should be checked in
-     grpc_channel_security_connector_check_peer. This parameter may be NULL in
-     which case the peer name will not be checked. Note that if this parameter
-     is not NULL, then, pem_root_certs should not be NULL either.
-   - sc is a pointer on the connector to be created.
-  This function returns GRPC_SECURITY_OK in case of success or a
-  specific error code otherwise.
-*/
-grpc_security_status grpc_ssl_channel_security_connector_create(
-    grpc_channel_credentials* channel_creds,
-    grpc_call_credentials* request_metadata_creds,
-    const grpc_ssl_config* config, const char* target_name,
-    const char* overridden_target_name,
-    tsi_ssl_session_cache* ssl_session_cache,
-    grpc_channel_security_connector** sc);
-
-/* Config for ssl servers. */
-typedef struct {
-  tsi_ssl_pem_key_cert_pair* pem_key_cert_pairs;
-  size_t num_key_cert_pairs;
-  char* pem_root_certs;
-  grpc_ssl_client_certificate_request_type client_certificate_request;
-} grpc_ssl_server_config;
-
-/* Creates an SSL server_security_connector.
-   - config is the SSL config to be used for the SSL channel establishment.
-   - sc is a pointer on the connector to be created.
-  This function returns GRPC_SECURITY_OK in case of success or a
-  specific error code otherwise.
-*/
-grpc_security_status grpc_ssl_server_security_connector_create(
-    grpc_server_credentials* server_credentials,
-    grpc_server_security_connector** sc);
-
-/* Util. */
-const tsi_peer_property* tsi_peer_get_property_by_name(const tsi_peer* peer,
-                                                       const char* name);
-
-/* Exposed for testing only. */
-grpc_auth_context* grpc_ssl_peer_to_auth_context(const tsi_peer* peer);
-tsi_peer grpc_shallow_peer_from_ssl_auth_context(
-    const grpc_auth_context* auth_context);
-void grpc_shallow_peer_destruct(tsi_peer* peer);
-int grpc_ssl_host_matches_name(const tsi_peer* peer, const char* peer_name);
-
-/* --- Default SSL Root Store. --- */
-namespace grpc_core {
-
-// The class implements default SSL root store.
-class DefaultSslRootStore {
- public:
-  // Gets the default SSL root store. Returns nullptr if not found.
-  static const tsi_ssl_root_certs_store* GetRootStore();
-
-  // Gets the default PEM root certificate.
-  static const char* GetPemRootCerts();
-
- protected:
-  // Returns default PEM root certificates in nullptr terminated grpc_slice.
-  // This function is protected instead of private, so that it can be tested.
-  static grpc_slice ComputePemRootCerts();
-
- private:
-  // Construct me not!
-  DefaultSslRootStore();
-
-  // Initialization of default SSL root store.
-  static void InitRootStore();
-
-  // One-time initialization of default SSL root store.
-  static void InitRootStoreOnce();
-
-  // SSL root store in tsi_ssl_root_certs_store object.
-  static tsi_ssl_root_certs_store* default_root_store_;
-
-  // Default PEM root certificates.
-  static grpc_slice default_pem_root_certs_;
-};
-
-}  // namespace grpc_core
-
 #endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SECURITY_CONNECTOR_H */

src/core/lib/security/security_connector/ssl/ssl_security_connector.cc

@@ -0,0 +1,474 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/security_connector/ssl/ssl_security_connector.h"
+
+#include <stdbool.h>
+
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
+#include "src/core/ext/transport/chttp2/alpn/alpn.h"
+#include "src/core/lib/channel/handshaker.h"
+#include "src/core/lib/gpr/host_port.h"
+#include "src/core/lib/gpr/string.h"
+#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/ssl/ssl_credentials.h"
+#include "src/core/lib/security/security_connector/load_system_roots.h"
+#include "src/core/lib/security/security_connector/ssl_utils.h"
+#include "src/core/lib/security/transport/security_handshaker.h"
+#include "src/core/tsi/ssl_transport_security.h"
+#include "src/core/tsi/transport_security.h"
+
+typedef struct {
+  grpc_channel_security_connector base;
+  tsi_ssl_client_handshaker_factory* client_handshaker_factory;
+  char* target_name;
+  char* overridden_target_name;
+  const verify_peer_options* verify_options;
+} grpc_ssl_channel_security_connector;
+
+typedef struct {
+  grpc_server_security_connector base;
+  tsi_ssl_server_handshaker_factory* server_handshaker_factory;
+} grpc_ssl_server_security_connector;
+
+static bool server_connector_has_cert_config_fetcher(
+    grpc_ssl_server_security_connector* c) {
+  GPR_ASSERT(c != nullptr);
+  grpc_ssl_server_credentials* server_creds =
+      reinterpret_cast<grpc_ssl_server_credentials*>(c->base.server_creds);
+  GPR_ASSERT(server_creds != nullptr);
+  return server_creds->certificate_config_fetcher.cb != nullptr;
+}
+
+static void ssl_channel_destroy(grpc_security_connector* sc) {
+  grpc_ssl_channel_security_connector* c =
+      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc);
+  grpc_channel_credentials_unref(c->base.channel_creds);
+  grpc_call_credentials_unref(c->base.request_metadata_creds);
+  tsi_ssl_client_handshaker_factory_unref(c->client_handshaker_factory);
+  c->client_handshaker_factory = nullptr;
+  if (c->target_name != nullptr) gpr_free(c->target_name);
+  if (c->overridden_target_name != nullptr) gpr_free(c->overridden_target_name);
+  gpr_free(sc);
+}
+
+static void ssl_server_destroy(grpc_security_connector* sc) {
+  grpc_ssl_server_security_connector* c =
+      reinterpret_cast<grpc_ssl_server_security_connector*>(sc);
+  grpc_server_credentials_unref(c->base.server_creds);
+  tsi_ssl_server_handshaker_factory_unref(c->server_handshaker_factory);
+  c->server_handshaker_factory = nullptr;
+  gpr_free(sc);
+}
+
+static void ssl_channel_add_handshakers(grpc_channel_security_connector* sc,
+                                        grpc_pollset_set* interested_parties,
+                                        grpc_handshake_manager* handshake_mgr) {
+  grpc_ssl_channel_security_connector* c =
+      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc);
+  // Instantiate TSI handshaker.
+  tsi_handshaker* tsi_hs = nullptr;
+  tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
+      c->client_handshaker_factory,
+      c->overridden_target_name != nullptr ? c->overridden_target_name
+                                           : c->target_name,
+      &tsi_hs);
+  if (result != TSI_OK) {
+    gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
+            tsi_result_to_string(result));
+    return;
+  }
+  // Create handshakers.
+  grpc_handshake_manager_add(
+      handshake_mgr, grpc_security_handshaker_create(tsi_hs, &sc->base));
+}
+
+/* Attempts to replace the server_handshaker_factory with a new factory using
+ * the provided grpc_ssl_server_certificate_config. Should new factory creation
+ * fail, the existing factory will not be replaced. Returns true on success (new
+ * factory created). */
+static bool try_replace_server_handshaker_factory(
+    grpc_ssl_server_security_connector* sc,
+    const grpc_ssl_server_certificate_config* config) {
+  if (config == nullptr) {
+    gpr_log(GPR_ERROR,
+            "Server certificate config callback returned invalid (NULL) "
+            "config.");
+    return false;
+  }
+  gpr_log(GPR_DEBUG, "Using new server certificate config (%p).", config);
+
+  size_t num_alpn_protocols = 0;
+  const char** alpn_protocol_strings =
+      grpc_fill_alpn_protocol_strings(&num_alpn_protocols);
+  tsi_ssl_pem_key_cert_pair* cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
+      config->pem_key_cert_pairs, config->num_key_cert_pairs);
+  tsi_ssl_server_handshaker_factory* new_handshaker_factory = nullptr;
+  grpc_ssl_server_credentials* server_creds =
+      reinterpret_cast<grpc_ssl_server_credentials*>(sc->base.server_creds);
+  tsi_result result = tsi_create_ssl_server_handshaker_factory_ex(
+      cert_pairs, config->num_key_cert_pairs, config->pem_root_certs,
+      grpc_get_tsi_client_certificate_request_type(
+          server_creds->config.client_certificate_request),
+      grpc_get_ssl_cipher_suites(), alpn_protocol_strings,
+      static_cast<uint16_t>(num_alpn_protocols), &new_handshaker_factory);
+  gpr_free(cert_pairs);
+  gpr_free((void*)alpn_protocol_strings);
+
+  if (result != TSI_OK) {
+    gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
+            tsi_result_to_string(result));
+    return false;
+  }
+  tsi_ssl_server_handshaker_factory_unref(sc->server_handshaker_factory);
+  sc->server_handshaker_factory = new_handshaker_factory;
+  return true;
+}
+
+/* Attempts to fetch the server certificate config if a callback is available.
+ * Current certificate config will continue to be used if the callback returns
+ * an error. Returns true if new credentials were sucessfully loaded. */
+static bool try_fetch_ssl_server_credentials(
+    grpc_ssl_server_security_connector* sc) {
+  grpc_ssl_server_certificate_config* certificate_config = nullptr;
+  bool status;
+
+  GPR_ASSERT(sc != nullptr);
+  if (!server_connector_has_cert_config_fetcher(sc)) return false;
+
+  grpc_ssl_server_credentials* server_creds =
+      reinterpret_cast<grpc_ssl_server_credentials*>(sc->base.server_creds);
+  grpc_ssl_certificate_config_reload_status cb_result =
+      server_creds->certificate_config_fetcher.cb(
+          server_creds->certificate_config_fetcher.user_data,
+          &certificate_config);
+  if (cb_result == GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_UNCHANGED) {
+    gpr_log(GPR_DEBUG, "No change in SSL server credentials.");
+    status = false;
+  } else if (cb_result == GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_NEW) {
+    status = try_replace_server_handshaker_factory(sc, certificate_config);
+  } else {
+    // Log error, continue using previously-loaded credentials.
+    gpr_log(GPR_ERROR,
+            "Failed fetching new server credentials, continuing to "
+            "use previously-loaded credentials.");
+    status = false;
+  }
+
+  if (certificate_config != nullptr) {
+    grpc_ssl_server_certificate_config_destroy(certificate_config);
+  }
+  return status;
+}
+
+static void ssl_server_add_handshakers(grpc_server_security_connector* sc,
+                                       grpc_pollset_set* interested_parties,
+                                       grpc_handshake_manager* handshake_mgr) {
+  grpc_ssl_server_security_connector* c =
+      reinterpret_cast<grpc_ssl_server_security_connector*>(sc);
+  // Instantiate TSI handshaker.
+  try_fetch_ssl_server_credentials(c);
+  tsi_handshaker* tsi_hs = nullptr;
+  tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
+      c->server_handshaker_factory, &tsi_hs);
+  if (result != TSI_OK) {
+    gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
+            tsi_result_to_string(result));
+    return;
+  }
+  // Create handshakers.
+  grpc_handshake_manager_add(
+      handshake_mgr, grpc_security_handshaker_create(tsi_hs, &sc->base));
+}
+
+static grpc_error* ssl_check_peer(grpc_security_connector* sc,
+                                  const char* peer_name, const tsi_peer* peer,
+                                  grpc_auth_context** auth_context) {
+#if TSI_OPENSSL_ALPN_SUPPORT
+  /* Check the ALPN if ALPN is supported. */
+  const tsi_peer_property* p =
+      tsi_peer_get_property_by_name(peer, TSI_SSL_ALPN_SELECTED_PROTOCOL);
+  if (p == nullptr) {
+    return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "Cannot check peer: missing selected ALPN property.");
+  }
+  if (!grpc_chttp2_is_alpn_version_supported(p->value.data, p->value.length)) {
+    return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "Cannot check peer: invalid ALPN value.");
+  }
+#endif /* TSI_OPENSSL_ALPN_SUPPORT */
+  /* Check the peer name if specified. */
+  if (peer_name != nullptr && !grpc_ssl_host_matches_name(peer, peer_name)) {
+    char* msg;
+    gpr_asprintf(&msg, "Peer name %s is not in peer certificate", peer_name);
+    grpc_error* error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
+    gpr_free(msg);
+    return error;
+  }
+  *auth_context = grpc_ssl_peer_to_auth_context(peer);
+  return GRPC_ERROR_NONE;
+}
+
+static void ssl_channel_check_peer(grpc_security_connector* sc, tsi_peer peer,
+                                   grpc_auth_context** auth_context,
+                                   grpc_closure* on_peer_checked) {
+  grpc_ssl_channel_security_connector* c =
+      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc);
+  const char* target_name = c->overridden_target_name != nullptr
+                                ? c->overridden_target_name
+                                : c->target_name;
+  grpc_error* error = ssl_check_peer(sc, target_name, &peer, auth_context);
+  if (error == GRPC_ERROR_NONE &&
+      c->verify_options->verify_peer_callback != nullptr) {
+    const tsi_peer_property* p =
+        tsi_peer_get_property_by_name(&peer, TSI_X509_PEM_CERT_PROPERTY);
+    if (p == nullptr) {
+      error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "Cannot check peer: missing pem cert property.");
+    } else {
+      char* peer_pem = static_cast<char*>(gpr_malloc(p->value.length + 1));
+      memcpy(peer_pem, p->value.data, p->value.length);
+      peer_pem[p->value.length] = '\0';
+      int callback_status = c->verify_options->verify_peer_callback(
+          target_name, peer_pem,
+          c->verify_options->verify_peer_callback_userdata);
+      gpr_free(peer_pem);
+      if (callback_status) {
+        char* msg;
+        gpr_asprintf(&msg, "Verify peer callback returned a failure (%d)",
+                     callback_status);
+        error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
+        gpr_free(msg);
+      }
+    }
+  }
+  GRPC_CLOSURE_SCHED(on_peer_checked, error);
+  tsi_peer_destruct(&peer);
+}
+
+static void ssl_server_check_peer(grpc_security_connector* sc, tsi_peer peer,
+                                  grpc_auth_context** auth_context,
+                                  grpc_closure* on_peer_checked) {
+  grpc_error* error = ssl_check_peer(sc, nullptr, &peer, auth_context);
+  tsi_peer_destruct(&peer);
+  GRPC_CLOSURE_SCHED(on_peer_checked, error);
+}
+
+static int ssl_channel_cmp(grpc_security_connector* sc1,
+                           grpc_security_connector* sc2) {
+  grpc_ssl_channel_security_connector* c1 =
+      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc1);
+  grpc_ssl_channel_security_connector* c2 =
+      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc2);
+  int c = grpc_channel_security_connector_cmp(&c1->base, &c2->base);
+  if (c != 0) return c;
+  c = strcmp(c1->target_name, c2->target_name);
+  if (c != 0) return c;
+  return (c1->overridden_target_name == nullptr ||
+          c2->overridden_target_name == nullptr)
+             ? GPR_ICMP(c1->overridden_target_name, c2->overridden_target_name)
+             : strcmp(c1->overridden_target_name, c2->overridden_target_name);
+}
+
+static int ssl_server_cmp(grpc_security_connector* sc1,
+                          grpc_security_connector* sc2) {
+  return grpc_server_security_connector_cmp(
+      reinterpret_cast<grpc_server_security_connector*>(sc1),
+      reinterpret_cast<grpc_server_security_connector*>(sc2));
+}
+
+static bool ssl_channel_check_call_host(grpc_channel_security_connector* sc,
+                                        const char* host,
+                                        grpc_auth_context* auth_context,
+                                        grpc_closure* on_call_host_checked,
+                                        grpc_error** error) {
+  grpc_ssl_channel_security_connector* c =
+      reinterpret_cast<grpc_ssl_channel_security_connector*>(sc);
+  grpc_security_status status = GRPC_SECURITY_ERROR;
+  tsi_peer peer = grpc_shallow_peer_from_ssl_auth_context(auth_context);
+  if (grpc_ssl_host_matches_name(&peer, host)) status = GRPC_SECURITY_OK;
+  /* If the target name was overridden, then the original target_name was
+     'checked' transitively during the previous peer check at the end of the
+     handshake. */
+  if (c->overridden_target_name != nullptr &&
+      strcmp(host, c->target_name) == 0) {
+    status = GRPC_SECURITY_OK;
+  }
+  if (status != GRPC_SECURITY_OK) {
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "call host does not match SSL server name");
+  }
+  grpc_shallow_peer_destruct(&peer);
+  return true;
+}
+
+static void ssl_channel_cancel_check_call_host(
+    grpc_channel_security_connector* sc, grpc_closure* on_call_host_checked,
+    grpc_error* error) {
+  GRPC_ERROR_UNREF(error);
+}
+
+static grpc_security_connector_vtable ssl_channel_vtable = {
+    ssl_channel_destroy, ssl_channel_check_peer, ssl_channel_cmp};
+
+static grpc_security_connector_vtable ssl_server_vtable = {
+    ssl_server_destroy, ssl_server_check_peer, ssl_server_cmp};
+
+grpc_security_status grpc_ssl_channel_security_connector_create(
+    grpc_channel_credentials* channel_creds,
+    grpc_call_credentials* request_metadata_creds,
+    const grpc_ssl_config* config, const char* target_name,
+    const char* overridden_target_name,
+    tsi_ssl_session_cache* ssl_session_cache,
+    grpc_channel_security_connector** sc) {
+  tsi_result result = TSI_OK;
+  grpc_ssl_channel_security_connector* c;
+  char* port;
+  bool has_key_cert_pair;
+  tsi_ssl_client_handshaker_options options;
+  memset(&options, 0, sizeof(options));
+  options.alpn_protocols =
+      grpc_fill_alpn_protocol_strings(&options.num_alpn_protocols);
+
+  if (config == nullptr || target_name == nullptr) {
+    gpr_log(GPR_ERROR, "An ssl channel needs a config and a target name.");
+    goto error;
+  }
+  if (config->pem_root_certs == nullptr) {
+    // Use default root certificates.
+    options.pem_root_certs = grpc_core::DefaultSslRootStore::GetPemRootCerts();
+    options.root_store = grpc_core::DefaultSslRootStore::GetRootStore();
+    if (options.pem_root_certs == nullptr) {
+      gpr_log(GPR_ERROR, "Could not get default pem root certs.");
+      goto error;
+    }
+  } else {
+    options.pem_root_certs = config->pem_root_certs;
+  }
+  c = static_cast<grpc_ssl_channel_security_connector*>(
+      gpr_zalloc(sizeof(grpc_ssl_channel_security_connector)));
+
+  gpr_ref_init(&c->base.base.refcount, 1);
+  c->base.base.vtable = &ssl_channel_vtable;
+  c->base.base.url_scheme = GRPC_SSL_URL_SCHEME;
+  c->base.channel_creds = grpc_channel_credentials_ref(channel_creds);
+  c->base.request_metadata_creds =
+      grpc_call_credentials_ref(request_metadata_creds);
+  c->base.check_call_host = ssl_channel_check_call_host;
+  c->base.cancel_check_call_host = ssl_channel_cancel_check_call_host;
+  c->base.add_handshakers = ssl_channel_add_handshakers;
+  gpr_split_host_port(target_name, &c->target_name, &port);
+  gpr_free(port);
+  if (overridden_target_name != nullptr) {
+    c->overridden_target_name = gpr_strdup(overridden_target_name);
+  }
+  c->verify_options = &config->verify_options;
+
+  has_key_cert_pair = config->pem_key_cert_pair != nullptr &&
+                      config->pem_key_cert_pair->private_key != nullptr &&
+                      config->pem_key_cert_pair->cert_chain != nullptr;
+  if (has_key_cert_pair) {
+    options.pem_key_cert_pair = config->pem_key_cert_pair;
+  }
+  options.cipher_suites = grpc_get_ssl_cipher_suites();
+  options.session_cache = ssl_session_cache;
+  result = tsi_create_ssl_client_handshaker_factory_with_options(
+      &options, &c->client_handshaker_factory);
+  if (result != TSI_OK) {
+    gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
+            tsi_result_to_string(result));
+    ssl_channel_destroy(&c->base.base);
+    *sc = nullptr;
+    goto error;
+  }
+  *sc = &c->base;
+  gpr_free((void*)options.alpn_protocols);
+  return GRPC_SECURITY_OK;
+
+error:
+  gpr_free((void*)options.alpn_protocols);
+  return GRPC_SECURITY_ERROR;
+}
+
+static grpc_ssl_server_security_connector*
+grpc_ssl_server_security_connector_initialize(
+    grpc_server_credentials* server_creds) {
+  grpc_ssl_server_security_connector* c =
+      static_cast<grpc_ssl_server_security_connector*>(
+          gpr_zalloc(sizeof(grpc_ssl_server_security_connector)));
+  gpr_ref_init(&c->base.base.refcount, 1);
+  c->base.base.url_scheme = GRPC_SSL_URL_SCHEME;
+  c->base.base.vtable = &ssl_server_vtable;
+  c->base.add_handshakers = ssl_server_add_handshakers;
+  c->base.server_creds = grpc_server_credentials_ref(server_creds);
+  return c;
+}
+
+grpc_security_status grpc_ssl_server_security_connector_create(
+    grpc_server_credentials* gsc, grpc_server_security_connector** sc) {
+  tsi_result result = TSI_OK;
+  grpc_ssl_server_credentials* server_credentials =
+      reinterpret_cast<grpc_ssl_server_credentials*>(gsc);
+  grpc_security_status retval = GRPC_SECURITY_OK;
+
+  GPR_ASSERT(server_credentials != nullptr);
+  GPR_ASSERT(sc != nullptr);
+
+  grpc_ssl_server_security_connector* c =
+      grpc_ssl_server_security_connector_initialize(gsc);
+  if (server_connector_has_cert_config_fetcher(c)) {
+    // Load initial credentials from certificate_config_fetcher:
+    if (!try_fetch_ssl_server_credentials(c)) {
+      gpr_log(GPR_ERROR, "Failed loading SSL server credentials from fetcher.");
+      retval = GRPC_SECURITY_ERROR;
+    }
+  } else {
+    size_t num_alpn_protocols = 0;
+    const char** alpn_protocol_strings =
+        grpc_fill_alpn_protocol_strings(&num_alpn_protocols);
+    result = tsi_create_ssl_server_handshaker_factory_ex(
+        server_credentials->config.pem_key_cert_pairs,
+        server_credentials->config.num_key_cert_pairs,
+        server_credentials->config.pem_root_certs,
+        grpc_get_tsi_client_certificate_request_type(
+            server_credentials->config.client_certificate_request),
+        grpc_get_ssl_cipher_suites(), alpn_protocol_strings,
+        static_cast<uint16_t>(num_alpn_protocols),
+        &c->server_handshaker_factory);
+    gpr_free((void*)alpn_protocol_strings);
+    if (result != TSI_OK) {
+      gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
+              tsi_result_to_string(result));
+      retval = GRPC_SECURITY_ERROR;
+    }
+  }
+
+  if (retval == GRPC_SECURITY_OK) {
+    *sc = &c->base;
+  } else {
+    if (c != nullptr) ssl_server_destroy(&c->base.base);
+    if (sc != nullptr) *sc = nullptr;
+  }
+  return retval;
+}

src/core/lib/security/security_connector/ssl/ssl_security_connector.h

@@ -0,0 +1,77 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_SSL_SECURITY_CONNECTOR_H
+#define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_SSL_SECURITY_CONNECTOR_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/security/security_connector/security_connector.h"
+
+#include "src/core/tsi/ssl_transport_security.h"
+#include "src/core/tsi/transport_security_interface.h"
+
+typedef struct {
+  tsi_ssl_pem_key_cert_pair* pem_key_cert_pair;
+  char* pem_root_certs;
+  verify_peer_options verify_options;
+} grpc_ssl_config;
+
+/* Creates an SSL channel_security_connector.
+   - request_metadata_creds is the credentials object which metadata
+     will be sent with each request. This parameter can be NULL.
+   - config is the SSL config to be used for the SSL channel establishment.
+   - is_client should be 0 for a server or a non-0 value for a client.
+   - secure_peer_name is the secure peer name that should be checked in
+     grpc_channel_security_connector_check_peer. This parameter may be NULL in
+     which case the peer name will not be checked. Note that if this parameter
+     is not NULL, then, pem_root_certs should not be NULL either.
+   - sc is a pointer on the connector to be created.
+  This function returns GRPC_SECURITY_OK in case of success or a
+  specific error code otherwise.
+*/
+grpc_security_status grpc_ssl_channel_security_connector_create(
+    grpc_channel_credentials* channel_creds,
+    grpc_call_credentials* request_metadata_creds,
+    const grpc_ssl_config* config, const char* target_name,
+    const char* overridden_target_name,
+    tsi_ssl_session_cache* ssl_session_cache,
+    grpc_channel_security_connector** sc);
+
+/* Config for ssl servers. */
+typedef struct {
+  tsi_ssl_pem_key_cert_pair* pem_key_cert_pairs;
+  size_t num_key_cert_pairs;
+  char* pem_root_certs;
+  grpc_ssl_client_certificate_request_type client_certificate_request;
+} grpc_ssl_server_config;
+
+/* Creates an SSL server_security_connector.
+   - config is the SSL config to be used for the SSL channel establishment.
+   - sc is a pointer on the connector to be created.
+  This function returns GRPC_SECURITY_OK in case of success or a
+  specific error code otherwise.
+*/
+grpc_security_status grpc_ssl_server_security_connector_create(
+    grpc_server_credentials* server_credentials,
+    grpc_server_security_connector** sc);
+
+#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_SSL_SECURITY_CONNECTOR_H \
+        */

src/core/lib/security/security_connector/ssl_utils.cc

@@ -0,0 +1,345 @@
+/*
+ *
+ * Copyright 2015 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/security_connector/ssl_utils.h"
+
+#include <grpc/slice_buffer.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
+#include "src/core/ext/transport/chttp2/alpn/alpn.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/gpr/env.h"
+#include "src/core/lib/gpr/host_port.h"
+#include "src/core/lib/gpr/string.h"
+#include "src/core/lib/iomgr/load_file.h"
+#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/security/security_connector/load_system_roots.h"
+#include "src/core/tsi/ssl_transport_security.h"
+
+/* -- Constants. -- */
+
+#ifndef INSTALL_PREFIX
+static const char* installed_roots_path = "/usr/share/grpc/roots.pem";
+#else
+static const char* installed_roots_path =
+    INSTALL_PREFIX "/share/grpc/roots.pem";
+#endif
+
+/** Environment variable used as a flag to enable/disable loading system root
+    certificates from the OS trust store. */
+#ifndef GRPC_NOT_USE_SYSTEM_SSL_ROOTS_ENV_VAR
+#define GRPC_NOT_USE_SYSTEM_SSL_ROOTS_ENV_VAR "GRPC_NOT_USE_SYSTEM_SSL_ROOTS"
+#endif
+
+#ifndef TSI_OPENSSL_ALPN_SUPPORT
+#define TSI_OPENSSL_ALPN_SUPPORT 1
+#endif
+
+/* -- Overridden default roots. -- */
+
+static grpc_ssl_roots_override_callback ssl_roots_override_cb = nullptr;
+
+void grpc_set_ssl_roots_override_callback(grpc_ssl_roots_override_callback cb) {
+  ssl_roots_override_cb = cb;
+}
+
+/* -- Cipher suites. -- */
+
+/* Defines the cipher suites that we accept by default. All these cipher suites
+   are compliant with HTTP2. */
+#define GRPC_SSL_CIPHER_SUITES     \
+  "ECDHE-ECDSA-AES128-GCM-SHA256:" \
+  "ECDHE-ECDSA-AES256-GCM-SHA384:" \
+  "ECDHE-RSA-AES128-GCM-SHA256:"   \
+  "ECDHE-RSA-AES256-GCM-SHA384"
+
+static gpr_once cipher_suites_once = GPR_ONCE_INIT;
+static const char* cipher_suites = nullptr;
+
+static void init_cipher_suites(void) {
+  char* overridden = gpr_getenv("GRPC_SSL_CIPHER_SUITES");
+  cipher_suites = overridden != nullptr ? overridden : GRPC_SSL_CIPHER_SUITES;
+}
+
+/* --- Util --- */
+
+const char* grpc_get_ssl_cipher_suites(void) {
+  gpr_once_init(&cipher_suites_once, init_cipher_suites);
+  return cipher_suites;
+}
+
+tsi_client_certificate_request_type
+grpc_get_tsi_client_certificate_request_type(
+    grpc_ssl_client_certificate_request_type grpc_request_type) {
+  switch (grpc_request_type) {
+    case GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE:
+      return TSI_DONT_REQUEST_CLIENT_CERTIFICATE;
+
+    case GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY:
+      return TSI_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY;
+
+    case GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY:
+      return TSI_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY;
+
+    case GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY:
+      return TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY;
+
+    case GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY:
+      return TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY;
+
+    default:
+      return TSI_DONT_REQUEST_CLIENT_CERTIFICATE;
+  }
+}
+
+const char** grpc_fill_alpn_protocol_strings(size_t* num_alpn_protocols) {
+  GPR_ASSERT(num_alpn_protocols != nullptr);
+  *num_alpn_protocols = grpc_chttp2_num_alpn_versions();
+  const char** alpn_protocol_strings = static_cast<const char**>(
+      gpr_malloc(sizeof(const char*) * (*num_alpn_protocols)));
+  for (size_t i = 0; i < *num_alpn_protocols; i++) {
+    alpn_protocol_strings[i] = grpc_chttp2_get_alpn_version_index(i);
+  }
+  return alpn_protocol_strings;
+}
+
+int grpc_ssl_host_matches_name(const tsi_peer* peer, const char* peer_name) {
+  char* allocated_name = nullptr;
+  int r;
+
+  char* ignored_port;
+  gpr_split_host_port(peer_name, &allocated_name, &ignored_port);
+  gpr_free(ignored_port);
+  peer_name = allocated_name;
+  if (!peer_name) return 0;
+
+  // IPv6 zone-id should not be included in comparisons.
+  char* const zone_id = strchr(allocated_name, '%');
+  if (zone_id != nullptr) *zone_id = '\0';
+
+  r = tsi_ssl_peer_matches_name(peer, peer_name);
+  gpr_free(allocated_name);
+  return r;
+}
+
+grpc_auth_context* grpc_ssl_peer_to_auth_context(const tsi_peer* peer) {
+  size_t i;
+  grpc_auth_context* ctx = nullptr;
+  const char* peer_identity_property_name = nullptr;
+
+  /* The caller has checked the certificate type property. */
+  GPR_ASSERT(peer->property_count >= 1);
+  ctx = grpc_auth_context_create(nullptr);
+  grpc_auth_context_add_cstring_property(
+      ctx, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
+      GRPC_SSL_TRANSPORT_SECURITY_TYPE);
+  for (i = 0; i < peer->property_count; i++) {
+    const tsi_peer_property* prop = &peer->properties[i];
+    if (prop->name == nullptr) continue;
+    if (strcmp(prop->name, TSI_X509_SUBJECT_COMMON_NAME_PEER_PROPERTY) == 0) {
+      /* If there is no subject alt name, have the CN as the identity. */
+      if (peer_identity_property_name == nullptr) {
+        peer_identity_property_name = GRPC_X509_CN_PROPERTY_NAME;
+      }
+      grpc_auth_context_add_property(ctx, GRPC_X509_CN_PROPERTY_NAME,
+                                     prop->value.data, prop->value.length);
+    } else if (strcmp(prop->name,
+                      TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY) == 0) {
+      peer_identity_property_name = GRPC_X509_SAN_PROPERTY_NAME;
+      grpc_auth_context_add_property(ctx, GRPC_X509_SAN_PROPERTY_NAME,
+                                     prop->value.data, prop->value.length);
+    } else if (strcmp(prop->name, TSI_X509_PEM_CERT_PROPERTY) == 0) {
+      grpc_auth_context_add_property(ctx, GRPC_X509_PEM_CERT_PROPERTY_NAME,
+                                     prop->value.data, prop->value.length);
+    } else if (strcmp(prop->name, TSI_SSL_SESSION_REUSED_PEER_PROPERTY) == 0) {
+      grpc_auth_context_add_property(ctx, GRPC_SSL_SESSION_REUSED_PROPERTY,
+                                     prop->value.data, prop->value.length);
+    }
+  }
+  if (peer_identity_property_name != nullptr) {
+    GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name(
+                   ctx, peer_identity_property_name) == 1);
+  }
+  return ctx;
+}
+
+static void add_shallow_auth_property_to_peer(tsi_peer* peer,
+                                              const grpc_auth_property* prop,
+                                              const char* tsi_prop_name) {
+  tsi_peer_property* tsi_prop = &peer->properties[peer->property_count++];
+  tsi_prop->name = const_cast<char*>(tsi_prop_name);
+  tsi_prop->value.data = prop->value;
+  tsi_prop->value.length = prop->value_length;
+}
+
+tsi_peer grpc_shallow_peer_from_ssl_auth_context(
+    const grpc_auth_context* auth_context) {
+  size_t max_num_props = 0;
+  grpc_auth_property_iterator it;
+  const grpc_auth_property* prop;
+  tsi_peer peer;
+  memset(&peer, 0, sizeof(peer));
+
+  it = grpc_auth_context_property_iterator(auth_context);
+  while (grpc_auth_property_iterator_next(&it) != nullptr) max_num_props++;
+
+  if (max_num_props > 0) {
+    peer.properties = static_cast<tsi_peer_property*>(
+        gpr_malloc(max_num_props * sizeof(tsi_peer_property)));
+    it = grpc_auth_context_property_iterator(auth_context);
+    while ((prop = grpc_auth_property_iterator_next(&it)) != nullptr) {
+      if (strcmp(prop->name, GRPC_X509_SAN_PROPERTY_NAME) == 0) {
+        add_shallow_auth_property_to_peer(
+            &peer, prop, TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY);
+      } else if (strcmp(prop->name, GRPC_X509_CN_PROPERTY_NAME) == 0) {
+        add_shallow_auth_property_to_peer(
+            &peer, prop, TSI_X509_SUBJECT_COMMON_NAME_PEER_PROPERTY);
+      } else if (strcmp(prop->name, GRPC_X509_PEM_CERT_PROPERTY_NAME) == 0) {
+        add_shallow_auth_property_to_peer(&peer, prop,
+                                          TSI_X509_PEM_CERT_PROPERTY);
+      }
+    }
+  }
+  return peer;
+}
+
+void grpc_shallow_peer_destruct(tsi_peer* peer) {
+  if (peer->properties != nullptr) gpr_free(peer->properties);
+}
+
+/* --- Ssl cache implementation. --- */
+
+grpc_ssl_session_cache* grpc_ssl_session_cache_create_lru(size_t capacity) {
+  tsi_ssl_session_cache* cache = tsi_ssl_session_cache_create_lru(capacity);
+  return reinterpret_cast<grpc_ssl_session_cache*>(cache);
+}
+
+void grpc_ssl_session_cache_destroy(grpc_ssl_session_cache* cache) {
+  tsi_ssl_session_cache* tsi_cache =
+      reinterpret_cast<tsi_ssl_session_cache*>(cache);
+  tsi_ssl_session_cache_unref(tsi_cache);
+}
+
+static void* grpc_ssl_session_cache_arg_copy(void* p) {
+  tsi_ssl_session_cache* tsi_cache =
+      reinterpret_cast<tsi_ssl_session_cache*>(p);
+  // destroy call below will unref the pointer.
+  tsi_ssl_session_cache_ref(tsi_cache);
+  return p;
+}
+
+static void grpc_ssl_session_cache_arg_destroy(void* p) {
+  tsi_ssl_session_cache* tsi_cache =
+      reinterpret_cast<tsi_ssl_session_cache*>(p);
+  tsi_ssl_session_cache_unref(tsi_cache);
+}
+
+static int grpc_ssl_session_cache_arg_cmp(void* p, void* q) {
+  return GPR_ICMP(p, q);
+}
+
+grpc_arg grpc_ssl_session_cache_create_channel_arg(
+    grpc_ssl_session_cache* cache) {
+  static const grpc_arg_pointer_vtable vtable = {
+      grpc_ssl_session_cache_arg_copy,
+      grpc_ssl_session_cache_arg_destroy,
+      grpc_ssl_session_cache_arg_cmp,
+  };
+  return grpc_channel_arg_pointer_create(
+      const_cast<char*>(GRPC_SSL_SESSION_CACHE_ARG), cache, &vtable);
+}
+
+/* --- Default SSL root store implementation. --- */
+
+namespace grpc_core {
+
+tsi_ssl_root_certs_store* DefaultSslRootStore::default_root_store_;
+grpc_slice DefaultSslRootStore::default_pem_root_certs_;
+
+const tsi_ssl_root_certs_store* DefaultSslRootStore::GetRootStore() {
+  InitRootStore();
+  return default_root_store_;
+}
+
+const char* DefaultSslRootStore::GetPemRootCerts() {
+  InitRootStore();
+  return GRPC_SLICE_IS_EMPTY(default_pem_root_certs_)
+             ? nullptr
+             : reinterpret_cast<const char*>
+                   GRPC_SLICE_START_PTR(default_pem_root_certs_);
+}
+
+grpc_slice DefaultSslRootStore::ComputePemRootCerts() {
+  grpc_slice result = grpc_empty_slice();
+  char* not_use_system_roots_env_value =
+      gpr_getenv(GRPC_NOT_USE_SYSTEM_SSL_ROOTS_ENV_VAR);
+  const bool not_use_system_roots = gpr_is_true(not_use_system_roots_env_value);
+  gpr_free(not_use_system_roots_env_value);
+  // First try to load the roots from the environment.
+  char* default_root_certs_path =
+      gpr_getenv(GRPC_DEFAULT_SSL_ROOTS_FILE_PATH_ENV_VAR);
+  if (default_root_certs_path != nullptr) {
+    GRPC_LOG_IF_ERROR("load_file",
+                      grpc_load_file(default_root_certs_path, 1, &result));
+    gpr_free(default_root_certs_path);
+  }
+  // Try overridden roots if needed.
+  grpc_ssl_roots_override_result ovrd_res = GRPC_SSL_ROOTS_OVERRIDE_FAIL;
+  if (GRPC_SLICE_IS_EMPTY(result) && ssl_roots_override_cb != nullptr) {
+    char* pem_root_certs = nullptr;
+    ovrd_res = ssl_roots_override_cb(&pem_root_certs);
+    if (ovrd_res == GRPC_SSL_ROOTS_OVERRIDE_OK) {
+      GPR_ASSERT(pem_root_certs != nullptr);
+      result = grpc_slice_from_copied_buffer(
+          pem_root_certs,
+          strlen(pem_root_certs) + 1);  // nullptr terminator.
+    }
+    gpr_free(pem_root_certs);
+  }
+  // Try loading roots from OS trust store if flag is enabled.
+  if (GRPC_SLICE_IS_EMPTY(result) && !not_use_system_roots) {
+    result = LoadSystemRootCerts();
+  }
+  // Fallback to roots manually shipped with gRPC.
+  if (GRPC_SLICE_IS_EMPTY(result) &&
+      ovrd_res != GRPC_SSL_ROOTS_OVERRIDE_FAIL_PERMANENTLY) {
+    GRPC_LOG_IF_ERROR("load_file",
+                      grpc_load_file(installed_roots_path, 1, &result));
+  }
+  return result;
+}
+
+void DefaultSslRootStore::InitRootStore() {
+  static gpr_once once = GPR_ONCE_INIT;
+  gpr_once_init(&once, DefaultSslRootStore::InitRootStoreOnce);
+}
+
+void DefaultSslRootStore::InitRootStoreOnce() {
+  default_pem_root_certs_ = ComputePemRootCerts();
+  if (!GRPC_SLICE_IS_EMPTY(default_pem_root_certs_)) {
+    default_root_store_ =
+        tsi_ssl_root_certs_store_create(reinterpret_cast<const char*>(
+            GRPC_SLICE_START_PTR(default_pem_root_certs_)));
+  }
+}
+
+}  // namespace grpc_core

src/core/lib/security/security_connector/ssl_utils.h

@@ -0,0 +1,93 @@
+/*
+ *
+ * Copyright 2015 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_UTILS_H
+#define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_UTILS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <stdbool.h>
+
+#include <grpc/grpc_security.h>
+#include <grpc/slice_buffer.h>
+
+#include "src/core/tsi/ssl_transport_security.h"
+#include "src/core/tsi/transport_security_interface.h"
+
+/* --- Util. --- */
+
+/* --- URL schemes. --- */
+#define GRPC_SSL_URL_SCHEME "https"
+
+/* Return HTTP2-compliant cipher suites that gRPC accepts by default. */
+const char* grpc_get_ssl_cipher_suites(void);
+
+/* Map from grpc_ssl_client_certificate_request_type to
+ * tsi_client_certificate_request_type. */
+tsi_client_certificate_request_type
+grpc_get_tsi_client_certificate_request_type(
+    grpc_ssl_client_certificate_request_type grpc_request_type);
+
+/* Return an array of strings containing alpn protocols. */
+const char** grpc_fill_alpn_protocol_strings(size_t* num_alpn_protocols);
+
+/* Exposed for testing only. */
+grpc_auth_context* grpc_ssl_peer_to_auth_context(const tsi_peer* peer);
+tsi_peer grpc_shallow_peer_from_ssl_auth_context(
+    const grpc_auth_context* auth_context);
+void grpc_shallow_peer_destruct(tsi_peer* peer);
+int grpc_ssl_host_matches_name(const tsi_peer* peer, const char* peer_name);
+
+/* --- Default SSL Root Store. --- */
+namespace grpc_core {
+
+// The class implements default SSL root store.
+class DefaultSslRootStore {
+ public:
+  // Gets the default SSL root store. Returns nullptr if not found.
+  static const tsi_ssl_root_certs_store* GetRootStore();
+
+  // Gets the default PEM root certificate.
+  static const char* GetPemRootCerts();
+
+ protected:
+  // Returns default PEM root certificates in nullptr terminated grpc_slice.
+  // This function is protected instead of private, so that it can be tested.
+  static grpc_slice ComputePemRootCerts();
+
+ private:
+  // Construct me not!
+  DefaultSslRootStore();
+
+  // Initialization of default SSL root store.
+  static void InitRootStore();
+
+  // One-time initialization of default SSL root store.
+  static void InitRootStoreOnce();
+
+  // SSL root store in tsi_ssl_root_certs_store object.
+  static tsi_ssl_root_certs_store* default_root_store_;
+
+  // Default PEM root certificates.
+  static grpc_slice default_pem_root_certs_;
+};
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_UTILS_H \
+        */

src/core/lib/security/transport/client_auth_filter.cc

@@ -32,6 +32,7 @@
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
+#include "src/core/lib/security/security_connector/ssl_utils.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
 #include "src/core/lib/surface/call.h"

src/core/lib/surface/channel.cc

@@ -39,6 +39,7 @@
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/iomgr.h"
+#include "src/core/lib/iomgr/resource_quota.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/surface/call.h"
@@ -63,6 +64,7 @@ struct grpc_channel {
   grpc_compression_options compression_options;
 
   gpr_atm call_size_estimate;
+  grpc_resource_user* resource_user;
 
   gpr_mu registered_call_mu;
   registered_call* registered_calls;
@@ -82,6 +84,8 @@ grpc_channel* grpc_channel_create_with_builder(
   char* target = gpr_strdup(grpc_channel_stack_builder_get_target(builder));
   grpc_channel_args* args = grpc_channel_args_copy(
       grpc_channel_stack_builder_get_channel_arguments(builder));
+  grpc_resource_user* resource_user =
+      grpc_channel_stack_builder_get_resource_user(builder);
   grpc_channel* channel;
   if (channel_stack_type == GRPC_SERVER_CHANNEL) {
     GRPC_STATS_INC_SERVER_CHANNELS_CREATED();
@@ -101,6 +105,7 @@ grpc_channel* grpc_channel_create_with_builder(
   }
 
   channel->target = target;
+  channel->resource_user = resource_user;
   channel->is_client = grpc_channel_stack_type_is_client(channel_stack_type);
   bool channelz_enabled = GRPC_ENABLE_CHANNELZ_DEFAULT;
   size_t channel_tracer_max_memory = 0;  // default to off
@@ -217,7 +222,8 @@ grpc_core::channelz::ChannelNode* grpc_channel_get_channelz_node(
 grpc_channel* grpc_channel_create(const char* target,
                                   const grpc_channel_args* input_args,
                                   grpc_channel_stack_type channel_stack_type,
-                                  grpc_transport* optional_transport) {
+                                  grpc_transport* optional_transport,
+                                  grpc_resource_user* resource_user) {
   grpc_channel_stack_builder* builder = grpc_channel_stack_builder_create();
   const grpc_core::UniquePtr<char> default_authority =
       get_default_authority(input_args);
@@ -227,11 +233,17 @@ grpc_channel* grpc_channel_create(const char* target,
   grpc_channel_args_destroy(args);
   grpc_channel_stack_builder_set_target(builder, target);
   grpc_channel_stack_builder_set_transport(builder, optional_transport);
+  grpc_channel_stack_builder_set_resource_user(builder, resource_user);
   if (!grpc_channel_init_create_stack(builder, channel_stack_type)) {
     grpc_channel_stack_builder_destroy(builder);
+    if (resource_user != nullptr) {
+      grpc_resource_user_free(resource_user, GRPC_RESOURCE_QUOTA_CHANNEL_SIZE);
+    }
     return nullptr;
   }
-  return grpc_channel_create_with_builder(builder, channel_stack_type);
+  grpc_channel* channel =
+      grpc_channel_create_with_builder(builder, channel_stack_type);
+  return channel;
 }
 
 size_t grpc_channel_get_call_size_estimate(grpc_channel* channel) {
@@ -441,6 +453,10 @@ static void destroy_channel(void* arg, grpc_error* error) {
     GRPC_MDELEM_UNREF(rc->authority);
     gpr_free(rc);
   }
+  if (channel->resource_user != nullptr) {
+    grpc_resource_user_free(channel->resource_user,
+                            GRPC_RESOURCE_QUOTA_CHANNEL_SIZE);
+  }
   gpr_mu_destroy(&channel->registered_call_mu);
   gpr_free(channel->target);
   gpr_free(channel);

src/core/lib/surface/channel.h

@@ -29,7 +29,8 @@
 grpc_channel* grpc_channel_create(const char* target,
                                   const grpc_channel_args* args,
                                   grpc_channel_stack_type channel_stack_type,
-                                  grpc_transport* optional_transport);
+                                  grpc_transport* optional_transport,
+                                  grpc_resource_user* resource_user = nullptr);
 
 grpc_channel* grpc_channel_create_with_builder(
     grpc_channel_stack_builder* builder,

src/core/lib/surface/server.cc

@@ -189,6 +189,8 @@ typedef struct {
 struct grpc_server {
   grpc_channel_args* channel_args;
 
+  grpc_resource_user* default_resource_user;
+
   grpc_completion_queue** cqs;
   grpc_pollset** pollsets;
   size_t cq_count;
@@ -1024,6 +1026,15 @@ grpc_server* grpc_server_create(const grpc_channel_args* args, void* reserved) {
         grpc_slice_from_static_string("Server created"));
   }
 
+  if (args != nullptr) {
+    grpc_resource_quota* resource_quota =
+        grpc_resource_quota_from_channel_args(args, false /* create */);
+    if (resource_quota != nullptr) {
+      server->default_resource_user =
+          grpc_resource_user_create(resource_quota, "default");
+    }
+  }
+
   return server;
 }
 
@@ -1122,7 +1133,8 @@ void grpc_server_get_pollsets(grpc_server* server, grpc_pollset*** pollsets,
 void grpc_server_setup_transport(grpc_server* s, grpc_transport* transport,
                                  grpc_pollset* accepting_pollset,
                                  const grpc_channel_args* args,
-                                 intptr_t socket_uuid) {
+                                 intptr_t socket_uuid,
+                                 grpc_resource_user* resource_user) {
   size_t num_registered_methods;
   size_t alloc;
   registered_method* rm;
@@ -1135,7 +1147,8 @@ void grpc_server_setup_transport(grpc_server* s, grpc_transport* transport,
   uint32_t max_probes = 0;
   grpc_transport_op* op = nullptr;
 
-  channel = grpc_channel_create(nullptr, args, GRPC_SERVER_CHANNEL, transport);
+  channel = grpc_channel_create(nullptr, args, GRPC_SERVER_CHANNEL, transport,
+                                resource_user);
   chand = static_cast<channel_data*>(
       grpc_channel_stack_element(grpc_channel_get_channel_stack(channel), 0)
           ->channel_data);
@@ -1330,6 +1343,13 @@ void grpc_server_shutdown_and_notify(grpc_server* server,
 
   channel_broadcaster_shutdown(&broadcaster, true /* send_goaway */,
                                GRPC_ERROR_NONE);
+
+  if (server->default_resource_user != nullptr) {
+    grpc_resource_quota_unref(
+        grpc_resource_user_quota(server->default_resource_user));
+    grpc_resource_user_shutdown(server->default_resource_user);
+    grpc_resource_user_unref(server->default_resource_user);
+  }
 }
 
 void grpc_server_cancel_all_calls(grpc_server* server) {
@@ -1546,6 +1566,10 @@ const grpc_channel_args* grpc_server_get_channel_args(grpc_server* server) {
   return server->channel_args;
 }
 
+grpc_resource_user* grpc_server_get_default_resource_user(grpc_server* server) {
+  return server->default_resource_user;
+}
+
 int grpc_server_has_open_connections(grpc_server* server) {
   int r;
   gpr_mu_lock(&server->mu_global);

src/core/lib/surface/server.h

@@ -47,7 +47,8 @@ void grpc_server_add_listener(grpc_server* server, void* listener,
 void grpc_server_setup_transport(grpc_server* server, grpc_transport* transport,
                                  grpc_pollset* accepting_pollset,
                                  const grpc_channel_args* args,
-                                 intptr_t socket_uuid);
+                                 intptr_t socket_uuid,
+                                 grpc_resource_user* resource_user = nullptr);
 
 /* fills in the uuids of all sockets used for connections on this server */
 void grpc_server_populate_server_sockets(
@@ -63,6 +64,8 @@ grpc_core::channelz::ServerNode* grpc_server_get_channelz_node(
 
 const grpc_channel_args* grpc_server_get_channel_args(grpc_server* server);
 
+grpc_resource_user* grpc_server_get_default_resource_user(grpc_server* server);
+
 int grpc_server_has_open_connections(grpc_server* server);
 
 /* Do not call this before grpc_server_start. Returns the pollsets and the

src/core/lib/transport/static_metadata.cc

@@ -63,51 +63,53 @@ static uint8_t g_bytes[] = {
     115, 115, 97,  103, 101, 95,  98,  121, 116, 101, 115, 47,  103, 114, 112,
     99,  46,  108, 98,  46,  118, 49,  46,  76,  111, 97,  100, 66,  97,  108,
     97,  110, 99,  101, 114, 47,  66,  97,  108, 97,  110, 99,  101, 76,  111,
-    97,  100, 100, 101, 102, 108, 97,  116, 101, 103, 122, 105, 112, 115, 116,
-    114, 101, 97,  109, 47,  103, 122, 105, 112, 71,  69,  84,  80,  79,  83,
-    84,  47,  47,  105, 110, 100, 101, 120, 46,  104, 116, 109, 108, 104, 116,
-    116, 112, 104, 116, 116, 112, 115, 50,  48,  48,  50,  48,  52,  50,  48,
-    54,  51,  48,  52,  52,  48,  48,  52,  48,  52,  53,  48,  48,  97,  99,
-    99,  101, 112, 116, 45,  99,  104, 97,  114, 115, 101, 116, 103, 122, 105,
-    112, 44,  32,  100, 101, 102, 108, 97,  116, 101, 97,  99,  99,  101, 112,
-    116, 45,  108, 97,  110, 103, 117, 97,  103, 101, 97,  99,  99,  101, 112,
-    116, 45,  114, 97,  110, 103, 101, 115, 97,  99,  99,  101, 112, 116, 97,
-    99,  99,  101, 115, 115, 45,  99,  111, 110, 116, 114, 111, 108, 45,  97,
-    108, 108, 111, 119, 45,  111, 114, 105, 103, 105, 110, 97,  103, 101, 97,
-    108, 108, 111, 119, 97,  117, 116, 104, 111, 114, 105, 122, 97,  116, 105,
-    111, 110, 99,  97,  99,  104, 101, 45,  99,  111, 110, 116, 114, 111, 108,
-    99,  111, 110, 116, 101, 110, 116, 45,  100, 105, 115, 112, 111, 115, 105,
-    116, 105, 111, 110, 99,  111, 110, 116, 101, 110, 116, 45,  108, 97,  110,
-    103, 117, 97,  103, 101, 99,  111, 110, 116, 101, 110, 116, 45,  108, 101,
-    110, 103, 116, 104, 99,  111, 110, 116, 101, 110, 116, 45,  108, 111, 99,
-    97,  116, 105, 111, 110, 99,  111, 110, 116, 101, 110, 116, 45,  114, 97,
-    110, 103, 101, 99,  111, 111, 107, 105, 101, 100, 97,  116, 101, 101, 116,
-    97,  103, 101, 120, 112, 101, 99,  116, 101, 120, 112, 105, 114, 101, 115,
-    102, 114, 111, 109, 105, 102, 45,  109, 97,  116, 99,  104, 105, 102, 45,
-    109, 111, 100, 105, 102, 105, 101, 100, 45,  115, 105, 110, 99,  101, 105,
-    102, 45,  110, 111, 110, 101, 45,  109, 97,  116, 99,  104, 105, 102, 45,
-    114, 97,  110, 103, 101, 105, 102, 45,  117, 110, 109, 111, 100, 105, 102,
-    105, 101, 100, 45,  115, 105, 110, 99,  101, 108, 97,  115, 116, 45,  109,
-    111, 100, 105, 102, 105, 101, 100, 108, 105, 110, 107, 108, 111, 99,  97,
-    116, 105, 111, 110, 109, 97,  120, 45,  102, 111, 114, 119, 97,  114, 100,
-    115, 112, 114, 111, 120, 121, 45,  97,  117, 116, 104, 101, 110, 116, 105,
-    99,  97,  116, 101, 112, 114, 111, 120, 121, 45,  97,  117, 116, 104, 111,
-    114, 105, 122, 97,  116, 105, 111, 110, 114, 97,  110, 103, 101, 114, 101,
-    102, 101, 114, 101, 114, 114, 101, 102, 114, 101, 115, 104, 114, 101, 116,
-    114, 121, 45,  97,  102, 116, 101, 114, 115, 101, 114, 118, 101, 114, 115,
-    101, 116, 45,  99,  111, 111, 107, 105, 101, 115, 116, 114, 105, 99,  116,
-    45,  116, 114, 97,  110, 115, 112, 111, 114, 116, 45,  115, 101, 99,  117,
-    114, 105, 116, 121, 116, 114, 97,  110, 115, 102, 101, 114, 45,  101, 110,
-    99,  111, 100, 105, 110, 103, 118, 97,  114, 121, 118, 105, 97,  119, 119,
-    119, 45,  97,  117, 116, 104, 101, 110, 116, 105, 99,  97,  116, 101, 48,
-    105, 100, 101, 110, 116, 105, 116, 121, 116, 114, 97,  105, 108, 101, 114,
-    115, 97,  112, 112, 108, 105, 99,  97,  116, 105, 111, 110, 47,  103, 114,
-    112, 99,  103, 114, 112, 99,  80,  85,  84,  108, 98,  45,  99,  111, 115,
-    116, 45,  98,  105, 110, 105, 100, 101, 110, 116, 105, 116, 121, 44,  100,
-    101, 102, 108, 97,  116, 101, 105, 100, 101, 110, 116, 105, 116, 121, 44,
-    103, 122, 105, 112, 100, 101, 102, 108, 97,  116, 101, 44,  103, 122, 105,
-    112, 105, 100, 101, 110, 116, 105, 116, 121, 44,  100, 101, 102, 108, 97,
-    116, 101, 44,  103, 122, 105, 112};
+    97,  100, 47,  103, 114, 112, 99,  46,  104, 101, 97,  108, 116, 104, 46,
+    118, 49,  46,  72,  101, 97,  108, 116, 104, 47,  87,  97,  116, 99,  104,
+    100, 101, 102, 108, 97,  116, 101, 103, 122, 105, 112, 115, 116, 114, 101,
+    97,  109, 47,  103, 122, 105, 112, 71,  69,  84,  80,  79,  83,  84,  47,
+    47,  105, 110, 100, 101, 120, 46,  104, 116, 109, 108, 104, 116, 116, 112,
+    104, 116, 116, 112, 115, 50,  48,  48,  50,  48,  52,  50,  48,  54,  51,
+    48,  52,  52,  48,  48,  52,  48,  52,  53,  48,  48,  97,  99,  99,  101,
+    112, 116, 45,  99,  104, 97,  114, 115, 101, 116, 103, 122, 105, 112, 44,
+    32,  100, 101, 102, 108, 97,  116, 101, 97,  99,  99,  101, 112, 116, 45,
+    108, 97,  110, 103, 117, 97,  103, 101, 97,  99,  99,  101, 112, 116, 45,
+    114, 97,  110, 103, 101, 115, 97,  99,  99,  101, 112, 116, 97,  99,  99,
+    101, 115, 115, 45,  99,  111, 110, 116, 114, 111, 108, 45,  97,  108, 108,
+    111, 119, 45,  111, 114, 105, 103, 105, 110, 97,  103, 101, 97,  108, 108,
+    111, 119, 97,  117, 116, 104, 111, 114, 105, 122, 97,  116, 105, 111, 110,
+    99,  97,  99,  104, 101, 45,  99,  111, 110, 116, 114, 111, 108, 99,  111,
+    110, 116, 101, 110, 116, 45,  100, 105, 115, 112, 111, 115, 105, 116, 105,
+    111, 110, 99,  111, 110, 116, 101, 110, 116, 45,  108, 97,  110, 103, 117,
+    97,  103, 101, 99,  111, 110, 116, 101, 110, 116, 45,  108, 101, 110, 103,
+    116, 104, 99,  111, 110, 116, 101, 110, 116, 45,  108, 111, 99,  97,  116,
+    105, 111, 110, 99,  111, 110, 116, 101, 110, 116, 45,  114, 97,  110, 103,
+    101, 99,  111, 111, 107, 105, 101, 100, 97,  116, 101, 101, 116, 97,  103,
+    101, 120, 112, 101, 99,  116, 101, 120, 112, 105, 114, 101, 115, 102, 114,
+    111, 109, 105, 102, 45,  109, 97,  116, 99,  104, 105, 102, 45,  109, 111,
+    100, 105, 102, 105, 101, 100, 45,  115, 105, 110, 99,  101, 105, 102, 45,
+    110, 111, 110, 101, 45,  109, 97,  116, 99,  104, 105, 102, 45,  114, 97,
+    110, 103, 101, 105, 102, 45,  117, 110, 109, 111, 100, 105, 102, 105, 101,
+    100, 45,  115, 105, 110, 99,  101, 108, 97,  115, 116, 45,  109, 111, 100,
+    105, 102, 105, 101, 100, 108, 105, 110, 107, 108, 111, 99,  97,  116, 105,
+    111, 110, 109, 97,  120, 45,  102, 111, 114, 119, 97,  114, 100, 115, 112,
+    114, 111, 120, 121, 45,  97,  117, 116, 104, 101, 110, 116, 105, 99,  97,
+    116, 101, 112, 114, 111, 120, 121, 45,  97,  117, 116, 104, 111, 114, 105,
+    122, 97,  116, 105, 111, 110, 114, 97,  110, 103, 101, 114, 101, 102, 101,
+    114, 101, 114, 114, 101, 102, 114, 101, 115, 104, 114, 101, 116, 114, 121,
+    45,  97,  102, 116, 101, 114, 115, 101, 114, 118, 101, 114, 115, 101, 116,
+    45,  99,  111, 111, 107, 105, 101, 115, 116, 114, 105, 99,  116, 45,  116,
+    114, 97,  110, 115, 112, 111, 114, 116, 45,  115, 101, 99,  117, 114, 105,
+    116, 121, 116, 114, 97,  110, 115, 102, 101, 114, 45,  101, 110, 99,  111,
+    100, 105, 110, 103, 118, 97,  114, 121, 118, 105, 97,  119, 119, 119, 45,
+    97,  117, 116, 104, 101, 110, 116, 105, 99,  97,  116, 101, 48,  105, 100,
+    101, 110, 116, 105, 116, 121, 116, 114, 97,  105, 108, 101, 114, 115, 97,
+    112, 112, 108, 105, 99,  97,  116, 105, 111, 110, 47,  103, 114, 112, 99,
+    103, 114, 112, 99,  80,  85,  84,  108, 98,  45,  99,  111, 115, 116, 45,
+    98,  105, 110, 105, 100, 101, 110, 116, 105, 116, 121, 44,  100, 101, 102,
+    108, 97,  116, 101, 105, 100, 101, 110, 116, 105, 116, 121, 44,  103, 122,
+    105, 112, 100, 101, 102, 108, 97,  116, 101, 44,  103, 122, 105, 112, 105,
+    100, 101, 110, 116, 105, 116, 121, 44,  100, 101, 102, 108, 97,  116, 101,
+    44,  103, 122, 105, 112};
 
 static void static_ref(void* unused) {}
 static void static_unref(void* unused) {}
@@ -224,6 +226,7 @@ grpc_slice_refcount grpc_static_metadata_refcounts[GRPC_STATIC_MDSTR_COUNT] = {
     {&grpc_static_metadata_vtable, &static_sub_refcnt},
     {&grpc_static_metadata_vtable, &static_sub_refcnt},
     {&grpc_static_metadata_vtable, &static_sub_refcnt},
+    {&grpc_static_metadata_vtable, &static_sub_refcnt},
 };
 
 const grpc_slice grpc_static_slice_table[GRPC_STATIC_MDSTR_COUNT] = {
@@ -262,76 +265,77 @@ const grpc_slice grpc_static_slice_table[GRPC_STATIC_MDSTR_COUNT] = {
     {&grpc_static_metadata_refcounts[32], {{g_bytes + 385, 30}}},
     {&grpc_static_metadata_refcounts[33], {{g_bytes + 415, 31}}},
     {&grpc_static_metadata_refcounts[34], {{g_bytes + 446, 36}}},
-    {&grpc_static_metadata_refcounts[35], {{g_bytes + 482, 7}}},
-    {&grpc_static_metadata_refcounts[36], {{g_bytes + 489, 4}}},
-    {&grpc_static_metadata_refcounts[37], {{g_bytes + 493, 11}}},
-    {&grpc_static_metadata_refcounts[38], {{g_bytes + 504, 3}}},
-    {&grpc_static_metadata_refcounts[39], {{g_bytes + 507, 4}}},
-    {&grpc_static_metadata_refcounts[40], {{g_bytes + 511, 1}}},
-    {&grpc_static_metadata_refcounts[41], {{g_bytes + 512, 11}}},
-    {&grpc_static_metadata_refcounts[42], {{g_bytes + 523, 4}}},
-    {&grpc_static_metadata_refcounts[43], {{g_bytes + 527, 5}}},
-    {&grpc_static_metadata_refcounts[44], {{g_bytes + 532, 3}}},
-    {&grpc_static_metadata_refcounts[45], {{g_bytes + 535, 3}}},
-    {&grpc_static_metadata_refcounts[46], {{g_bytes + 538, 3}}},
-    {&grpc_static_metadata_refcounts[47], {{g_bytes + 541, 3}}},
-    {&grpc_static_metadata_refcounts[48], {{g_bytes + 544, 3}}},
-    {&grpc_static_metadata_refcounts[49], {{g_bytes + 547, 3}}},
-    {&grpc_static_metadata_refcounts[50], {{g_bytes + 550, 3}}},
-    {&grpc_static_metadata_refcounts[51], {{g_bytes + 553, 14}}},
-    {&grpc_static_metadata_refcounts[52], {{g_bytes + 567, 13}}},
-    {&grpc_static_metadata_refcounts[53], {{g_bytes + 580, 15}}},
-    {&grpc_static_metadata_refcounts[54], {{g_bytes + 595, 13}}},
-    {&grpc_static_metadata_refcounts[55], {{g_bytes + 608, 6}}},
-    {&grpc_static_metadata_refcounts[56], {{g_bytes + 614, 27}}},
-    {&grpc_static_metadata_refcounts[57], {{g_bytes + 641, 3}}},
-    {&grpc_static_metadata_refcounts[58], {{g_bytes + 644, 5}}},
-    {&grpc_static_metadata_refcounts[59], {{g_bytes + 649, 13}}},
-    {&grpc_static_metadata_refcounts[60], {{g_bytes + 662, 13}}},
-    {&grpc_static_metadata_refcounts[61], {{g_bytes + 675, 19}}},
-    {&grpc_static_metadata_refcounts[62], {{g_bytes + 694, 16}}},
-    {&grpc_static_metadata_refcounts[63], {{g_bytes + 710, 14}}},
-    {&grpc_static_metadata_refcounts[64], {{g_bytes + 724, 16}}},
-    {&grpc_static_metadata_refcounts[65], {{g_bytes + 740, 13}}},
-    {&grpc_static_metadata_refcounts[66], {{g_bytes + 753, 6}}},
-    {&grpc_static_metadata_refcounts[67], {{g_bytes + 759, 4}}},
-    {&grpc_static_metadata_refcounts[68], {{g_bytes + 763, 4}}},
-    {&grpc_static_metadata_refcounts[69], {{g_bytes + 767, 6}}},
-    {&grpc_static_metadata_refcounts[70], {{g_bytes + 773, 7}}},
-    {&grpc_static_metadata_refcounts[71], {{g_bytes + 780, 4}}},
-    {&grpc_static_metadata_refcounts[72], {{g_bytes + 784, 8}}},
-    {&grpc_static_metadata_refcounts[73], {{g_bytes + 792, 17}}},
-    {&grpc_static_metadata_refcounts[74], {{g_bytes + 809, 13}}},
-    {&grpc_static_metadata_refcounts[75], {{g_bytes + 822, 8}}},
-    {&grpc_static_metadata_refcounts[76], {{g_bytes + 830, 19}}},
-    {&grpc_static_metadata_refcounts[77], {{g_bytes + 849, 13}}},
-    {&grpc_static_metadata_refcounts[78], {{g_bytes + 862, 4}}},
-    {&grpc_static_metadata_refcounts[79], {{g_bytes + 866, 8}}},
-    {&grpc_static_metadata_refcounts[80], {{g_bytes + 874, 12}}},
-    {&grpc_static_metadata_refcounts[81], {{g_bytes + 886, 18}}},
-    {&grpc_static_metadata_refcounts[82], {{g_bytes + 904, 19}}},
-    {&grpc_static_metadata_refcounts[83], {{g_bytes + 923, 5}}},
-    {&grpc_static_metadata_refcounts[84], {{g_bytes + 928, 7}}},
-    {&grpc_static_metadata_refcounts[85], {{g_bytes + 935, 7}}},
-    {&grpc_static_metadata_refcounts[86], {{g_bytes + 942, 11}}},
-    {&grpc_static_metadata_refcounts[87], {{g_bytes + 953, 6}}},
-    {&grpc_static_metadata_refcounts[88], {{g_bytes + 959, 10}}},
-    {&grpc_static_metadata_refcounts[89], {{g_bytes + 969, 25}}},
-    {&grpc_static_metadata_refcounts[90], {{g_bytes + 994, 17}}},
-    {&grpc_static_metadata_refcounts[91], {{g_bytes + 1011, 4}}},
-    {&grpc_static_metadata_refcounts[92], {{g_bytes + 1015, 3}}},
-    {&grpc_static_metadata_refcounts[93], {{g_bytes + 1018, 16}}},
-    {&grpc_static_metadata_refcounts[94], {{g_bytes + 1034, 1}}},
-    {&grpc_static_metadata_refcounts[95], {{g_bytes + 1035, 8}}},
-    {&grpc_static_metadata_refcounts[96], {{g_bytes + 1043, 8}}},
-    {&grpc_static_metadata_refcounts[97], {{g_bytes + 1051, 16}}},
-    {&grpc_static_metadata_refcounts[98], {{g_bytes + 1067, 4}}},
-    {&grpc_static_metadata_refcounts[99], {{g_bytes + 1071, 3}}},
-    {&grpc_static_metadata_refcounts[100], {{g_bytes + 1074, 11}}},
-    {&grpc_static_metadata_refcounts[101], {{g_bytes + 1085, 16}}},
-    {&grpc_static_metadata_refcounts[102], {{g_bytes + 1101, 13}}},
-    {&grpc_static_metadata_refcounts[103], {{g_bytes + 1114, 12}}},
-    {&grpc_static_metadata_refcounts[104], {{g_bytes + 1126, 21}}},
+    {&grpc_static_metadata_refcounts[35], {{g_bytes + 482, 28}}},
+    {&grpc_static_metadata_refcounts[36], {{g_bytes + 510, 7}}},
+    {&grpc_static_metadata_refcounts[37], {{g_bytes + 517, 4}}},
+    {&grpc_static_metadata_refcounts[38], {{g_bytes + 521, 11}}},
+    {&grpc_static_metadata_refcounts[39], {{g_bytes + 532, 3}}},
+    {&grpc_static_metadata_refcounts[40], {{g_bytes + 535, 4}}},
+    {&grpc_static_metadata_refcounts[41], {{g_bytes + 539, 1}}},
+    {&grpc_static_metadata_refcounts[42], {{g_bytes + 540, 11}}},
+    {&grpc_static_metadata_refcounts[43], {{g_bytes + 551, 4}}},
+    {&grpc_static_metadata_refcounts[44], {{g_bytes + 555, 5}}},
+    {&grpc_static_metadata_refcounts[45], {{g_bytes + 560, 3}}},
+    {&grpc_static_metadata_refcounts[46], {{g_bytes + 563, 3}}},
+    {&grpc_static_metadata_refcounts[47], {{g_bytes + 566, 3}}},
+    {&grpc_static_metadata_refcounts[48], {{g_bytes + 569, 3}}},
+    {&grpc_static_metadata_refcounts[49], {{g_bytes + 572, 3}}},
+    {&grpc_static_metadata_refcounts[50], {{g_bytes + 575, 3}}},
+    {&grpc_static_metadata_refcounts[51], {{g_bytes + 578, 3}}},
+    {&grpc_static_metadata_refcounts[52], {{g_bytes + 581, 14}}},
+    {&grpc_static_metadata_refcounts[53], {{g_bytes + 595, 13}}},
+    {&grpc_static_metadata_refcounts[54], {{g_bytes + 608, 15}}},
+    {&grpc_static_metadata_refcounts[55], {{g_bytes + 623, 13}}},
+    {&grpc_static_metadata_refcounts[56], {{g_bytes + 636, 6}}},
+    {&grpc_static_metadata_refcounts[57], {{g_bytes + 642, 27}}},
+    {&grpc_static_metadata_refcounts[58], {{g_bytes + 669, 3}}},
+    {&grpc_static_metadata_refcounts[59], {{g_bytes + 672, 5}}},
+    {&grpc_static_metadata_refcounts[60], {{g_bytes + 677, 13}}},
+    {&grpc_static_metadata_refcounts[61], {{g_bytes + 690, 13}}},
+    {&grpc_static_metadata_refcounts[62], {{g_bytes + 703, 19}}},
+    {&grpc_static_metadata_refcounts[63], {{g_bytes + 722, 16}}},
+    {&grpc_static_metadata_refcounts[64], {{g_bytes + 738, 14}}},
+    {&grpc_static_metadata_refcounts[65], {{g_bytes + 752, 16}}},
+    {&grpc_static_metadata_refcounts[66], {{g_bytes + 768, 13}}},
+    {&grpc_static_metadata_refcounts[67], {{g_bytes + 781, 6}}},
+    {&grpc_static_metadata_refcounts[68], {{g_bytes + 787, 4}}},
+    {&grpc_static_metadata_refcounts[69], {{g_bytes + 791, 4}}},
+    {&grpc_static_metadata_refcounts[70], {{g_bytes + 795, 6}}},
+    {&grpc_static_metadata_refcounts[71], {{g_bytes + 801, 7}}},
+    {&grpc_static_metadata_refcounts[72], {{g_bytes + 808, 4}}},
+    {&grpc_static_metadata_refcounts[73], {{g_bytes + 812, 8}}},
+    {&grpc_static_metadata_refcounts[74], {{g_bytes + 820, 17}}},
+    {&grpc_static_metadata_refcounts[75], {{g_bytes + 837, 13}}},
+    {&grpc_static_metadata_refcounts[76], {{g_bytes + 850, 8}}},
+    {&grpc_static_metadata_refcounts[77], {{g_bytes + 858, 19}}},
+    {&grpc_static_metadata_refcounts[78], {{g_bytes + 877, 13}}},
+    {&grpc_static_metadata_refcounts[79], {{g_bytes + 890, 4}}},
+    {&grpc_static_metadata_refcounts[80], {{g_bytes + 894, 8}}},
+    {&grpc_static_metadata_refcounts[81], {{g_bytes + 902, 12}}},
+    {&grpc_static_metadata_refcounts[82], {{g_bytes + 914, 18}}},
+    {&grpc_static_metadata_refcounts[83], {{g_bytes + 932, 19}}},
+    {&grpc_static_metadata_refcounts[84], {{g_bytes + 951, 5}}},
+    {&grpc_static_metadata_refcounts[85], {{g_bytes + 956, 7}}},
+    {&grpc_static_metadata_refcounts[86], {{g_bytes + 963, 7}}},
+    {&grpc_static_metadata_refcounts[87], {{g_bytes + 970, 11}}},
+    {&grpc_static_metadata_refcounts[88], {{g_bytes + 981, 6}}},
+    {&grpc_static_metadata_refcounts[89], {{g_bytes + 987, 10}}},
+    {&grpc_static_metadata_refcounts[90], {{g_bytes + 997, 25}}},
+    {&grpc_static_metadata_refcounts[91], {{g_bytes + 1022, 17}}},
+    {&grpc_static_metadata_refcounts[92], {{g_bytes + 1039, 4}}},
+    {&grpc_static_metadata_refcounts[93], {{g_bytes + 1043, 3}}},
+    {&grpc_static_metadata_refcounts[94], {{g_bytes + 1046, 16}}},
+    {&grpc_static_metadata_refcounts[95], {{g_bytes + 1062, 1}}},
+    {&grpc_static_metadata_refcounts[96], {{g_bytes + 1063, 8}}},
+    {&grpc_static_metadata_refcounts[97], {{g_bytes + 1071, 8}}},
+    {&grpc_static_metadata_refcounts[98], {{g_bytes + 1079, 16}}},
+    {&grpc_static_metadata_refcounts[99], {{g_bytes + 1095, 4}}},
+    {&grpc_static_metadata_refcounts[100], {{g_bytes + 1099, 3}}},
+    {&grpc_static_metadata_refcounts[101], {{g_bytes + 1102, 11}}},
+    {&grpc_static_metadata_refcounts[102], {{g_bytes + 1113, 16}}},
+    {&grpc_static_metadata_refcounts[103], {{g_bytes + 1129, 13}}},
+    {&grpc_static_metadata_refcounts[104], {{g_bytes + 1142, 12}}},
+    {&grpc_static_metadata_refcounts[105], {{g_bytes + 1154, 21}}},
 };
 
 uintptr_t grpc_static_mdelem_user_data[GRPC_STATIC_MDELEM_COUNT] = {
@@ -341,17 +345,17 @@ uintptr_t grpc_static_mdelem_user_data[GRPC_STATIC_MDELEM_COUNT] = {
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 4, 4, 6, 6, 8, 8, 2, 4, 4};
 
 static const int8_t elems_r[] = {
-    15, 9,   -8, 0,  2,  -44, -78, 17, 0,   6,   -8,  0,   0,  0,  6,
-    -5, -10, 0,  0,  -2, -3,  -4,  0,  0,   0,   0,   0,   0,  0,  0,
-    0,  0,   0,  0,  0,  0,   0,   0,  0,   0,   0,   0,   0,  0,  0,
-    0,  0,   0,  0,  0,  0,   -63, 0,  -46, -68, -69, -53, 0,  31, 30,
-    29, 29,  28, 27, 26, 25,  24,  23, 22,  21,  20,  19,  18, 17, 18,
-    17, 16,  15, 14, 13, 12,  11,  10, 9,   8,   7,   6,   5,  4,  3,
-    2,  3,   3,  2,  6,  0,   0,   0,  0,   0,   0,   -5,  0};
+    16, 11,  -8, 0,  3,  -42, -81, -43, 0,  6,   -8,  0,   0,   0,  -7,
+    -3, -10, 0,  0,  0,  -1,  -2,  0,   0,  0,   0,   0,   0,   0,  0,
+    0,  0,   0,  0,  0,  0,   0,   0,   0,  0,   0,   0,   0,   0,  0,
+    0,  0,   0,  0,  0,  0,   0,   -63, 0,  -47, -68, -69, -70, 0,  33,
+    33, 32,  31, 30, 29, 28,  27,  26,  25, 24,  23,  22,  21,  20, 20,
+    19, 18,  17, 16, 15, 14,  13,  12,  11, 10,  9,   8,   7,   6,  5,
+    4,  4,   4,  3,  10, 9,   0,   0,   0,  0,   0,   0,   -3,  0};
 static uint32_t elems_phash(uint32_t i) {
-  i -= 40;
-  uint32_t x = i % 103;
-  uint32_t y = i / 103;
+  i -= 41;
+  uint32_t x = i % 104;
+  uint32_t y = i / 104;
   uint32_t h = x;
   if (y < GPR_ARRAY_SIZE(elems_r)) {
     uint32_t delta = (uint32_t)elems_r[y];
@@ -361,29 +365,29 @@ static uint32_t elems_phash(uint32_t i) {
 }
 
 static const uint16_t elem_keys[] = {
-    254,  255,  256,  257,  258,  259,  260,  1085, 1086, 143,   144,  1709,
-    462,  463,  1604, 40,   41,   761,  1716, 980,  981,  1611,  621,  1499,
-    760,  2024, 2129, 2234, 5384, 5699, 5804, 6014, 6119, 6224,  1732, 6329,
-    6434, 6539, 6644, 6749, 6854, 6959, 7064, 7169, 7274, 7379,  7484, 7589,
-    5909, 5594, 7694, 7799, 7904, 8009, 8114, 8219, 8324, 8429,  8534, 8639,
-    8744, 8849, 8954, 9059, 9164, 9269, 9374, 1145, 518,  9479,  204,  9584,
-    9689, 1151, 1152, 1153, 1154, 1775, 9794, 1040, 1670, 10529, 0,    0,
-    1782, 829,  0,    0,    0,    0,    344,  1567, 0,    0,     0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,     0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,     0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,     0,    0,
-    0};
+    257,  258,  259,  260,  261,  262,  263,  1096, 1097, 1513, 1725, 145,
+    146,  467,  468,  1619, 41,   42,   1733, 990,  991,  767,  768,  1627,
+    627,  837,  2043, 2149, 2255, 5541, 5859, 5965, 6071, 6177, 1749, 6283,
+    6389, 6495, 6601, 6707, 6813, 6919, 7025, 7131, 7237, 7343, 7449, 7555,
+    7661, 5753, 7767, 7873, 7979, 8085, 8191, 8297, 8403, 8509, 8615, 8721,
+    8827, 8933, 9039, 9145, 9251, 9357, 9463, 1156, 9569, 523,  9675, 9781,
+    206,  1162, 1163, 1164, 1165, 1792, 1582, 1050, 9887, 9993, 1686, 10735,
+    1799, 0,    0,    0,    0,    0,    347,  0,    0,    0,    0,    0,
+    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
+    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
+    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
+    0,    0,    0,    0};
 static const uint8_t elem_idxs[] = {
-    7,  8,  9,   10,  11, 12, 13,  77,  79,  1,   2,  71, 5,  6,  25, 3,
-    4,  63, 84,  66,  65, 73, 67,  30,  62,  57,  37, 74, 14, 17, 18, 20,
-    21, 22, 15,  23,  24, 26, 27,  28,  29,  31,  32, 33, 34, 35, 36, 38,
-    19, 16, 39,  40,  41, 42, 43,  44,  45,  46,  47, 48, 49, 50, 51, 52,
-    53, 54, 55,  76,  69, 56, 70,  58,  59,  78,  80, 81, 82, 83, 60, 64,
-    72, 75, 255, 255, 85, 61, 255, 255, 255, 255, 0,  68};
+    7,  8,  9,  10, 11, 12,  13,  77,  79,  30,  71, 1,  2,  5,  6,  25,
+    3,  4,  84, 66, 65, 62,  63,  73,  67,  61,  57, 37, 74, 14, 17, 18,
+    19, 20, 15, 21, 22, 23,  24,  26,  27,  28,  29, 31, 32, 33, 34, 35,
+    36, 16, 38, 39, 40, 41,  42,  43,  44,  45,  46, 47, 48, 49, 50, 51,
+    52, 53, 54, 76, 55, 69,  56,  58,  70,  78,  80, 81, 82, 83, 68, 64,
+    59, 60, 72, 75, 85, 255, 255, 255, 255, 255, 0};
 
 grpc_mdelem grpc_static_mdelem_for_static_strings(int a, int b) {
   if (a == -1 || b == -1) return GRPC_MDNULL;
-  uint32_t k = (uint32_t)(a * 105 + b);
+  uint32_t k = (uint32_t)(a * 106 + b);
   uint32_t h = elems_phash(k);
   return h < GPR_ARRAY_SIZE(elem_keys) && elem_keys[h] == k &&
                  elem_idxs[h] != 255
@@ -396,175 +400,175 @@ grpc_mdelem_data grpc_static_mdelem_table[GRPC_STATIC_MDELEM_COUNT] = {
     {{&grpc_static_metadata_refcounts[3], {{g_bytes + 19, 10}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
     {{&grpc_static_metadata_refcounts[1], {{g_bytes + 5, 7}}},
-     {&grpc_static_metadata_refcounts[38], {{g_bytes + 504, 3}}}},
+     {&grpc_static_metadata_refcounts[39], {{g_bytes + 532, 3}}}},
     {{&grpc_static_metadata_refcounts[1], {{g_bytes + 5, 7}}},
-     {&grpc_static_metadata_refcounts[39], {{g_bytes + 507, 4}}}},
+     {&grpc_static_metadata_refcounts[40], {{g_bytes + 535, 4}}}},
     {{&grpc_static_metadata_refcounts[0], {{g_bytes + 0, 5}}},
-     {&grpc_static_metadata_refcounts[40], {{g_bytes + 511, 1}}}},
+     {&grpc_static_metadata_refcounts[41], {{g_bytes + 539, 1}}}},
     {{&grpc_static_metadata_refcounts[0], {{g_bytes + 0, 5}}},
-     {&grpc_static_metadata_refcounts[41], {{g_bytes + 512, 11}}}},
+     {&grpc_static_metadata_refcounts[42], {{g_bytes + 540, 11}}}},
     {{&grpc_static_metadata_refcounts[4], {{g_bytes + 29, 7}}},
-     {&grpc_static_metadata_refcounts[42], {{g_bytes + 523, 4}}}},
+     {&grpc_static_metadata_refcounts[43], {{g_bytes + 551, 4}}}},
     {{&grpc_static_metadata_refcounts[4], {{g_bytes + 29, 7}}},
-     {&grpc_static_metadata_refcounts[43], {{g_bytes + 527, 5}}}},
+     {&grpc_static_metadata_refcounts[44], {{g_bytes + 555, 5}}}},
     {{&grpc_static_metadata_refcounts[2], {{g_bytes + 12, 7}}},
-     {&grpc_static_metadata_refcounts[44], {{g_bytes + 532, 3}}}},
+     {&grpc_static_metadata_refcounts[45], {{g_bytes + 560, 3}}}},
     {{&grpc_static_metadata_refcounts[2], {{g_bytes + 12, 7}}},
-     {&grpc_static_metadata_refcounts[45], {{g_bytes + 535, 3}}}},
+     {&grpc_static_metadata_refcounts[46], {{g_bytes + 563, 3}}}},
     {{&grpc_static_metadata_refcounts[2], {{g_bytes + 12, 7}}},
-     {&grpc_static_metadata_refcounts[46], {{g_bytes + 538, 3}}}},
+     {&grpc_static_metadata_refcounts[47], {{g_bytes + 566, 3}}}},
     {{&grpc_static_metadata_refcounts[2], {{g_bytes + 12, 7}}},
-     {&grpc_static_metadata_refcounts[47], {{g_bytes + 541, 3}}}},
+     {&grpc_static_metadata_refcounts[48], {{g_bytes + 569, 3}}}},
     {{&grpc_static_metadata_refcounts[2], {{g_bytes + 12, 7}}},
-     {&grpc_static_metadata_refcounts[48], {{g_bytes + 544, 3}}}},
+     {&grpc_static_metadata_refcounts[49], {{g_bytes + 572, 3}}}},
     {{&grpc_static_metadata_refcounts[2], {{g_bytes + 12, 7}}},
-     {&grpc_static_metadata_refcounts[49], {{g_bytes + 547, 3}}}},
+     {&grpc_static_metadata_refcounts[50], {{g_bytes + 575, 3}}}},
     {{&grpc_static_metadata_refcounts[2], {{g_bytes + 12, 7}}},
-     {&grpc_static_metadata_refcounts[50], {{g_bytes + 550, 3}}}},
-    {{&grpc_static_metadata_refcounts[51], {{g_bytes + 553, 14}}},
+     {&grpc_static_metadata_refcounts[51], {{g_bytes + 578, 3}}}},
+    {{&grpc_static_metadata_refcounts[52], {{g_bytes + 581, 14}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
     {{&grpc_static_metadata_refcounts[16], {{g_bytes + 186, 15}}},
-     {&grpc_static_metadata_refcounts[52], {{g_bytes + 567, 13}}}},
-    {{&grpc_static_metadata_refcounts[53], {{g_bytes + 580, 15}}},
+     {&grpc_static_metadata_refcounts[53], {{g_bytes + 595, 13}}}},
+    {{&grpc_static_metadata_refcounts[54], {{g_bytes + 608, 15}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[54], {{g_bytes + 595, 13}}},
+    {{&grpc_static_metadata_refcounts[55], {{g_bytes + 623, 13}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[55], {{g_bytes + 608, 6}}},
+    {{&grpc_static_metadata_refcounts[56], {{g_bytes + 636, 6}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[56], {{g_bytes + 614, 27}}},
+    {{&grpc_static_metadata_refcounts[57], {{g_bytes + 642, 27}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[57], {{g_bytes + 641, 3}}},
+    {{&grpc_static_metadata_refcounts[58], {{g_bytes + 669, 3}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[58], {{g_bytes + 644, 5}}},
+    {{&grpc_static_metadata_refcounts[59], {{g_bytes + 672, 5}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[59], {{g_bytes + 649, 13}}},
+    {{&grpc_static_metadata_refcounts[60], {{g_bytes + 677, 13}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[60], {{g_bytes + 662, 13}}},
+    {{&grpc_static_metadata_refcounts[61], {{g_bytes + 690, 13}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[61], {{g_bytes + 675, 19}}},
+    {{&grpc_static_metadata_refcounts[62], {{g_bytes + 703, 19}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
     {{&grpc_static_metadata_refcounts[15], {{g_bytes + 170, 16}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[62], {{g_bytes + 694, 16}}},
+    {{&grpc_static_metadata_refcounts[63], {{g_bytes + 722, 16}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[63], {{g_bytes + 710, 14}}},
+    {{&grpc_static_metadata_refcounts[64], {{g_bytes + 738, 14}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[64], {{g_bytes + 724, 16}}},
+    {{&grpc_static_metadata_refcounts[65], {{g_bytes + 752, 16}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[65], {{g_bytes + 740, 13}}},
+    {{&grpc_static_metadata_refcounts[66], {{g_bytes + 768, 13}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
     {{&grpc_static_metadata_refcounts[14], {{g_bytes + 158, 12}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[66], {{g_bytes + 753, 6}}},
+    {{&grpc_static_metadata_refcounts[67], {{g_bytes + 781, 6}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[67], {{g_bytes + 759, 4}}},
+    {{&grpc_static_metadata_refcounts[68], {{g_bytes + 787, 4}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[68], {{g_bytes + 763, 4}}},
+    {{&grpc_static_metadata_refcounts[69], {{g_bytes + 791, 4}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[69], {{g_bytes + 767, 6}}},
+    {{&grpc_static_metadata_refcounts[70], {{g_bytes + 795, 6}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[70], {{g_bytes + 773, 7}}},
+    {{&grpc_static_metadata_refcounts[71], {{g_bytes + 801, 7}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[71], {{g_bytes + 780, 4}}},
+    {{&grpc_static_metadata_refcounts[72], {{g_bytes + 808, 4}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
     {{&grpc_static_metadata_refcounts[20], {{g_bytes + 278, 4}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[72], {{g_bytes + 784, 8}}},
+    {{&grpc_static_metadata_refcounts[73], {{g_bytes + 812, 8}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[73], {{g_bytes + 792, 17}}},
+    {{&grpc_static_metadata_refcounts[74], {{g_bytes + 820, 17}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[74], {{g_bytes + 809, 13}}},
+    {{&grpc_static_metadata_refcounts[75], {{g_bytes + 837, 13}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[75], {{g_bytes + 822, 8}}},
+    {{&grpc_static_metadata_refcounts[76], {{g_bytes + 850, 8}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[76], {{g_bytes + 830, 19}}},
+    {{&grpc_static_metadata_refcounts[77], {{g_bytes + 858, 19}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[77], {{g_bytes + 849, 13}}},
+    {{&grpc_static_metadata_refcounts[78], {{g_bytes + 877, 13}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[78], {{g_bytes + 862, 4}}},
+    {{&grpc_static_metadata_refcounts[79], {{g_bytes + 890, 4}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[79], {{g_bytes + 866, 8}}},
+    {{&grpc_static_metadata_refcounts[80], {{g_bytes + 894, 8}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[80], {{g_bytes + 874, 12}}},
+    {{&grpc_static_metadata_refcounts[81], {{g_bytes + 902, 12}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[81], {{g_bytes + 886, 18}}},
+    {{&grpc_static_metadata_refcounts[82], {{g_bytes + 914, 18}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[82], {{g_bytes + 904, 19}}},
+    {{&grpc_static_metadata_refcounts[83], {{g_bytes + 932, 19}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[83], {{g_bytes + 923, 5}}},
+    {{&grpc_static_metadata_refcounts[84], {{g_bytes + 951, 5}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[84], {{g_bytes + 928, 7}}},
+    {{&grpc_static_metadata_refcounts[85], {{g_bytes + 956, 7}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[85], {{g_bytes + 935, 7}}},
+    {{&grpc_static_metadata_refcounts[86], {{g_bytes + 963, 7}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[86], {{g_bytes + 942, 11}}},
+    {{&grpc_static_metadata_refcounts[87], {{g_bytes + 970, 11}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[87], {{g_bytes + 953, 6}}},
+    {{&grpc_static_metadata_refcounts[88], {{g_bytes + 981, 6}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[88], {{g_bytes + 959, 10}}},
+    {{&grpc_static_metadata_refcounts[89], {{g_bytes + 987, 10}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[89], {{g_bytes + 969, 25}}},
+    {{&grpc_static_metadata_refcounts[90], {{g_bytes + 997, 25}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[90], {{g_bytes + 994, 17}}},
+    {{&grpc_static_metadata_refcounts[91], {{g_bytes + 1022, 17}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
     {{&grpc_static_metadata_refcounts[19], {{g_bytes + 268, 10}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[91], {{g_bytes + 1011, 4}}},
+    {{&grpc_static_metadata_refcounts[92], {{g_bytes + 1039, 4}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[92], {{g_bytes + 1015, 3}}},
+    {{&grpc_static_metadata_refcounts[93], {{g_bytes + 1043, 3}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[93], {{g_bytes + 1018, 16}}},
+    {{&grpc_static_metadata_refcounts[94], {{g_bytes + 1046, 16}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
     {{&grpc_static_metadata_refcounts[7], {{g_bytes + 50, 11}}},
-     {&grpc_static_metadata_refcounts[94], {{g_bytes + 1034, 1}}}},
+     {&grpc_static_metadata_refcounts[95], {{g_bytes + 1062, 1}}}},
     {{&grpc_static_metadata_refcounts[7], {{g_bytes + 50, 11}}},
      {&grpc_static_metadata_refcounts[25], {{g_bytes + 350, 1}}}},
     {{&grpc_static_metadata_refcounts[7], {{g_bytes + 50, 11}}},
      {&grpc_static_metadata_refcounts[26], {{g_bytes + 351, 1}}}},
     {{&grpc_static_metadata_refcounts[9], {{g_bytes + 77, 13}}},
-     {&grpc_static_metadata_refcounts[95], {{g_bytes + 1035, 8}}}},
+     {&grpc_static_metadata_refcounts[96], {{g_bytes + 1063, 8}}}},
     {{&grpc_static_metadata_refcounts[9], {{g_bytes + 77, 13}}},
-     {&grpc_static_metadata_refcounts[36], {{g_bytes + 489, 4}}}},
+     {&grpc_static_metadata_refcounts[37], {{g_bytes + 517, 4}}}},
     {{&grpc_static_metadata_refcounts[9], {{g_bytes + 77, 13}}},
-     {&grpc_static_metadata_refcounts[35], {{g_bytes + 482, 7}}}},
+     {&grpc_static_metadata_refcounts[36], {{g_bytes + 510, 7}}}},
     {{&grpc_static_metadata_refcounts[5], {{g_bytes + 36, 2}}},
-     {&grpc_static_metadata_refcounts[96], {{g_bytes + 1043, 8}}}},
+     {&grpc_static_metadata_refcounts[97], {{g_bytes + 1071, 8}}}},
     {{&grpc_static_metadata_refcounts[14], {{g_bytes + 158, 12}}},
-     {&grpc_static_metadata_refcounts[97], {{g_bytes + 1051, 16}}}},
+     {&grpc_static_metadata_refcounts[98], {{g_bytes + 1079, 16}}}},
     {{&grpc_static_metadata_refcounts[4], {{g_bytes + 29, 7}}},
-     {&grpc_static_metadata_refcounts[98], {{g_bytes + 1067, 4}}}},
+     {&grpc_static_metadata_refcounts[99], {{g_bytes + 1095, 4}}}},
     {{&grpc_static_metadata_refcounts[1], {{g_bytes + 5, 7}}},
-     {&grpc_static_metadata_refcounts[99], {{g_bytes + 1071, 3}}}},
+     {&grpc_static_metadata_refcounts[100], {{g_bytes + 1099, 3}}}},
     {{&grpc_static_metadata_refcounts[16], {{g_bytes + 186, 15}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
     {{&grpc_static_metadata_refcounts[15], {{g_bytes + 170, 16}}},
-     {&grpc_static_metadata_refcounts[95], {{g_bytes + 1035, 8}}}},
+     {&grpc_static_metadata_refcounts[96], {{g_bytes + 1063, 8}}}},
     {{&grpc_static_metadata_refcounts[15], {{g_bytes + 170, 16}}},
-     {&grpc_static_metadata_refcounts[36], {{g_bytes + 489, 4}}}},
+     {&grpc_static_metadata_refcounts[37], {{g_bytes + 517, 4}}}},
     {{&grpc_static_metadata_refcounts[21], {{g_bytes + 282, 8}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
-    {{&grpc_static_metadata_refcounts[100], {{g_bytes + 1074, 11}}},
+    {{&grpc_static_metadata_refcounts[101], {{g_bytes + 1102, 11}}},
      {&grpc_static_metadata_refcounts[29], {{g_bytes + 354, 0}}}},
     {{&grpc_static_metadata_refcounts[10], {{g_bytes + 90, 20}}},
-     {&grpc_static_metadata_refcounts[95], {{g_bytes + 1035, 8}}}},
+     {&grpc_static_metadata_refcounts[96], {{g_bytes + 1063, 8}}}},
     {{&grpc_static_metadata_refcounts[10], {{g_bytes + 90, 20}}},
-     {&grpc_static_metadata_refcounts[35], {{g_bytes + 482, 7}}}},
+     {&grpc_static_metadata_refcounts[36], {{g_bytes + 510, 7}}}},
     {{&grpc_static_metadata_refcounts[10], {{g_bytes + 90, 20}}},
-     {&grpc_static_metadata_refcounts[101], {{g_bytes + 1085, 16}}}},
+     {&grpc_static_metadata_refcounts[102], {{g_bytes + 1113, 16}}}},
     {{&grpc_static_metadata_refcounts[10], {{g_bytes + 90, 20}}},
-     {&grpc_static_metadata_refcounts[36], {{g_bytes + 489, 4}}}},
+     {&grpc_static_metadata_refcounts[37], {{g_bytes + 517, 4}}}},
     {{&grpc_static_metadata_refcounts[10], {{g_bytes + 90, 20}}},
-     {&grpc_static_metadata_refcounts[102], {{g_bytes + 1101, 13}}}},
+     {&grpc_static_metadata_refcounts[103], {{g_bytes + 1129, 13}}}},
     {{&grpc_static_metadata_refcounts[10], {{g_bytes + 90, 20}}},
-     {&grpc_static_metadata_refcounts[103], {{g_bytes + 1114, 12}}}},
+     {&grpc_static_metadata_refcounts[104], {{g_bytes + 1142, 12}}}},
     {{&grpc_static_metadata_refcounts[10], {{g_bytes + 90, 20}}},
-     {&grpc_static_metadata_refcounts[104], {{g_bytes + 1126, 21}}}},
+     {&grpc_static_metadata_refcounts[105], {{g_bytes + 1154, 21}}}},
     {{&grpc_static_metadata_refcounts[16], {{g_bytes + 186, 15}}},
-     {&grpc_static_metadata_refcounts[95], {{g_bytes + 1035, 8}}}},
+     {&grpc_static_metadata_refcounts[96], {{g_bytes + 1063, 8}}}},
     {{&grpc_static_metadata_refcounts[16], {{g_bytes + 186, 15}}},
-     {&grpc_static_metadata_refcounts[36], {{g_bytes + 489, 4}}}},
+     {&grpc_static_metadata_refcounts[37], {{g_bytes + 517, 4}}}},
     {{&grpc_static_metadata_refcounts[16], {{g_bytes + 186, 15}}},
-     {&grpc_static_metadata_refcounts[102], {{g_bytes + 1101, 13}}}},
+     {&grpc_static_metadata_refcounts[103], {{g_bytes + 1129, 13}}}},
 };
 const uint8_t grpc_static_accept_encoding_metadata[8] = {0,  76, 77, 78,
                                                          79, 80, 81, 82};

src/core/lib/transport/static_metadata.h

@@ -31,7 +31,7 @@
 
 #include "src/core/lib/transport/metadata.h"
 
-#define GRPC_STATIC_MDSTR_COUNT 105
+#define GRPC_STATIC_MDSTR_COUNT 106
 extern const grpc_slice grpc_static_slice_table[GRPC_STATIC_MDSTR_COUNT];
 /* ":path" */
 #define GRPC_MDSTR_PATH (grpc_static_slice_table[0])
@@ -107,147 +107,150 @@ extern const grpc_slice grpc_static_slice_table[GRPC_STATIC_MDSTR_COUNT];
 /* "/grpc.lb.v1.LoadBalancer/BalanceLoad" */
 #define GRPC_MDSTR_SLASH_GRPC_DOT_LB_DOT_V1_DOT_LOADBALANCER_SLASH_BALANCELOAD \
   (grpc_static_slice_table[34])
+/* "/grpc.health.v1.Health/Watch" */
+#define GRPC_MDSTR_SLASH_GRPC_DOT_HEALTH_DOT_V1_DOT_HEALTH_SLASH_WATCH \
+  (grpc_static_slice_table[35])
 /* "deflate" */
-#define GRPC_MDSTR_DEFLATE (grpc_static_slice_table[35])
+#define GRPC_MDSTR_DEFLATE (grpc_static_slice_table[36])
 /* "gzip" */
-#define GRPC_MDSTR_GZIP (grpc_static_slice_table[36])
+#define GRPC_MDSTR_GZIP (grpc_static_slice_table[37])
 /* "stream/gzip" */
-#define GRPC_MDSTR_STREAM_SLASH_GZIP (grpc_static_slice_table[37])
+#define GRPC_MDSTR_STREAM_SLASH_GZIP (grpc_static_slice_table[38])
 /* "GET" */
-#define GRPC_MDSTR_GET (grpc_static_slice_table[38])
+#define GRPC_MDSTR_GET (grpc_static_slice_table[39])
 /* "POST" */
-#define GRPC_MDSTR_POST (grpc_static_slice_table[39])
+#define GRPC_MDSTR_POST (grpc_static_slice_table[40])
 /* "/" */
-#define GRPC_MDSTR_SLASH (grpc_static_slice_table[40])
+#define GRPC_MDSTR_SLASH (grpc_static_slice_table[41])
 /* "/index.html" */
-#define GRPC_MDSTR_SLASH_INDEX_DOT_HTML (grpc_static_slice_table[41])
+#define GRPC_MDSTR_SLASH_INDEX_DOT_HTML (grpc_static_slice_table[42])
 /* "http" */
-#define GRPC_MDSTR_HTTP (grpc_static_slice_table[42])
+#define GRPC_MDSTR_HTTP (grpc_static_slice_table[43])
 /* "https" */
-#define GRPC_MDSTR_HTTPS (grpc_static_slice_table[43])
+#define GRPC_MDSTR_HTTPS (grpc_static_slice_table[44])
 /* "200" */
-#define GRPC_MDSTR_200 (grpc_static_slice_table[44])
+#define GRPC_MDSTR_200 (grpc_static_slice_table[45])
 /* "204" */
-#define GRPC_MDSTR_204 (grpc_static_slice_table[45])
+#define GRPC_MDSTR_204 (grpc_static_slice_table[46])
 /* "206" */
-#define GRPC_MDSTR_206 (grpc_static_slice_table[46])
+#define GRPC_MDSTR_206 (grpc_static_slice_table[47])
 /* "304" */
-#define GRPC_MDSTR_304 (grpc_static_slice_table[47])
+#define GRPC_MDSTR_304 (grpc_static_slice_table[48])
 /* "400" */
-#define GRPC_MDSTR_400 (grpc_static_slice_table[48])
+#define GRPC_MDSTR_400 (grpc_static_slice_table[49])
 /* "404" */
-#define GRPC_MDSTR_404 (grpc_static_slice_table[49])
+#define GRPC_MDSTR_404 (grpc_static_slice_table[50])
 /* "500" */
-#define GRPC_MDSTR_500 (grpc_static_slice_table[50])
+#define GRPC_MDSTR_500 (grpc_static_slice_table[51])
 /* "accept-charset" */
-#define GRPC_MDSTR_ACCEPT_CHARSET (grpc_static_slice_table[51])
+#define GRPC_MDSTR_ACCEPT_CHARSET (grpc_static_slice_table[52])
 /* "gzip, deflate" */
-#define GRPC_MDSTR_GZIP_COMMA_DEFLATE (grpc_static_slice_table[52])
+#define GRPC_MDSTR_GZIP_COMMA_DEFLATE (grpc_static_slice_table[53])
 /* "accept-language" */
-#define GRPC_MDSTR_ACCEPT_LANGUAGE (grpc_static_slice_table[53])
+#define GRPC_MDSTR_ACCEPT_LANGUAGE (grpc_static_slice_table[54])
 /* "accept-ranges" */
-#define GRPC_MDSTR_ACCEPT_RANGES (grpc_static_slice_table[54])
+#define GRPC_MDSTR_ACCEPT_RANGES (grpc_static_slice_table[55])
 /* "accept" */
-#define GRPC_MDSTR_ACCEPT (grpc_static_slice_table[55])
+#define GRPC_MDSTR_ACCEPT (grpc_static_slice_table[56])
 /* "access-control-allow-origin" */
-#define GRPC_MDSTR_ACCESS_CONTROL_ALLOW_ORIGIN (grpc_static_slice_table[56])
+#define GRPC_MDSTR_ACCESS_CONTROL_ALLOW_ORIGIN (grpc_static_slice_table[57])
 /* "age" */
-#define GRPC_MDSTR_AGE (grpc_static_slice_table[57])
+#define GRPC_MDSTR_AGE (grpc_static_slice_table[58])
 /* "allow" */
-#define GRPC_MDSTR_ALLOW (grpc_static_slice_table[58])
+#define GRPC_MDSTR_ALLOW (grpc_static_slice_table[59])
 /* "authorization" */
-#define GRPC_MDSTR_AUTHORIZATION (grpc_static_slice_table[59])
+#define GRPC_MDSTR_AUTHORIZATION (grpc_static_slice_table[60])
 /* "cache-control" */
-#define GRPC_MDSTR_CACHE_CONTROL (grpc_static_slice_table[60])
+#define GRPC_MDSTR_CACHE_CONTROL (grpc_static_slice_table[61])
 /* "content-disposition" */
-#define GRPC_MDSTR_CONTENT_DISPOSITION (grpc_static_slice_table[61])
+#define GRPC_MDSTR_CONTENT_DISPOSITION (grpc_static_slice_table[62])
 /* "content-language" */
-#define GRPC_MDSTR_CONTENT_LANGUAGE (grpc_static_slice_table[62])
+#define GRPC_MDSTR_CONTENT_LANGUAGE (grpc_static_slice_table[63])
 /* "content-length" */
-#define GRPC_MDSTR_CONTENT_LENGTH (grpc_static_slice_table[63])
+#define GRPC_MDSTR_CONTENT_LENGTH (grpc_static_slice_table[64])
 /* "content-location" */
-#define GRPC_MDSTR_CONTENT_LOCATION (grpc_static_slice_table[64])
+#define GRPC_MDSTR_CONTENT_LOCATION (grpc_static_slice_table[65])
 /* "content-range" */
-#define GRPC_MDSTR_CONTENT_RANGE (grpc_static_slice_table[65])
+#define GRPC_MDSTR_CONTENT_RANGE (grpc_static_slice_table[66])
 /* "cookie" */
-#define GRPC_MDSTR_COOKIE (grpc_static_slice_table[66])
+#define GRPC_MDSTR_COOKIE (grpc_static_slice_table[67])
 /* "date" */
-#define GRPC_MDSTR_DATE (grpc_static_slice_table[67])
+#define GRPC_MDSTR_DATE (grpc_static_slice_table[68])
 /* "etag" */
-#define GRPC_MDSTR_ETAG (grpc_static_slice_table[68])
+#define GRPC_MDSTR_ETAG (grpc_static_slice_table[69])
 /* "expect" */
-#define GRPC_MDSTR_EXPECT (grpc_static_slice_table[69])
+#define GRPC_MDSTR_EXPECT (grpc_static_slice_table[70])
 /* "expires" */
-#define GRPC_MDSTR_EXPIRES (grpc_static_slice_table[70])
+#define GRPC_MDSTR_EXPIRES (grpc_static_slice_table[71])
 /* "from" */
-#define GRPC_MDSTR_FROM (grpc_static_slice_table[71])
+#define GRPC_MDSTR_FROM (grpc_static_slice_table[72])
 /* "if-match" */
-#define GRPC_MDSTR_IF_MATCH (grpc_static_slice_table[72])
+#define GRPC_MDSTR_IF_MATCH (grpc_static_slice_table[73])
 /* "if-modified-since" */
-#define GRPC_MDSTR_IF_MODIFIED_SINCE (grpc_static_slice_table[73])
+#define GRPC_MDSTR_IF_MODIFIED_SINCE (grpc_static_slice_table[74])
 /* "if-none-match" */
-#define GRPC_MDSTR_IF_NONE_MATCH (grpc_static_slice_table[74])
+#define GRPC_MDSTR_IF_NONE_MATCH (grpc_static_slice_table[75])
 /* "if-range" */
-#define GRPC_MDSTR_IF_RANGE (grpc_static_slice_table[75])
+#define GRPC_MDSTR_IF_RANGE (grpc_static_slice_table[76])
 /* "if-unmodified-since" */
-#define GRPC_MDSTR_IF_UNMODIFIED_SINCE (grpc_static_slice_table[76])
+#define GRPC_MDSTR_IF_UNMODIFIED_SINCE (grpc_static_slice_table[77])
 /* "last-modified" */
-#define GRPC_MDSTR_LAST_MODIFIED (grpc_static_slice_table[77])
+#define GRPC_MDSTR_LAST_MODIFIED (grpc_static_slice_table[78])
 /* "link" */
-#define GRPC_MDSTR_LINK (grpc_static_slice_table[78])
+#define GRPC_MDSTR_LINK (grpc_static_slice_table[79])
 /* "location" */
-#define GRPC_MDSTR_LOCATION (grpc_static_slice_table[79])
+#define GRPC_MDSTR_LOCATION (grpc_static_slice_table[80])
 /* "max-forwards" */
-#define GRPC_MDSTR_MAX_FORWARDS (grpc_static_slice_table[80])
+#define GRPC_MDSTR_MAX_FORWARDS (grpc_static_slice_table[81])
 /* "proxy-authenticate" */
-#define GRPC_MDSTR_PROXY_AUTHENTICATE (grpc_static_slice_table[81])
+#define GRPC_MDSTR_PROXY_AUTHENTICATE (grpc_static_slice_table[82])
 /* "proxy-authorization" */
-#define GRPC_MDSTR_PROXY_AUTHORIZATION (grpc_static_slice_table[82])
+#define GRPC_MDSTR_PROXY_AUTHORIZATION (grpc_static_slice_table[83])
 /* "range" */
-#define GRPC_MDSTR_RANGE (grpc_static_slice_table[83])
+#define GRPC_MDSTR_RANGE (grpc_static_slice_table[84])
 /* "referer" */
-#define GRPC_MDSTR_REFERER (grpc_static_slice_table[84])
+#define GRPC_MDSTR_REFERER (grpc_static_slice_table[85])
 /* "refresh" */
-#define GRPC_MDSTR_REFRESH (grpc_static_slice_table[85])
+#define GRPC_MDSTR_REFRESH (grpc_static_slice_table[86])
 /* "retry-after" */
-#define GRPC_MDSTR_RETRY_AFTER (grpc_static_slice_table[86])
+#define GRPC_MDSTR_RETRY_AFTER (grpc_static_slice_table[87])
 /* "server" */
-#define GRPC_MDSTR_SERVER (grpc_static_slice_table[87])
+#define GRPC_MDSTR_SERVER (grpc_static_slice_table[88])
 /* "set-cookie" */
-#define GRPC_MDSTR_SET_COOKIE (grpc_static_slice_table[88])
+#define GRPC_MDSTR_SET_COOKIE (grpc_static_slice_table[89])
 /* "strict-transport-security" */
-#define GRPC_MDSTR_STRICT_TRANSPORT_SECURITY (grpc_static_slice_table[89])
+#define GRPC_MDSTR_STRICT_TRANSPORT_SECURITY (grpc_static_slice_table[90])
 /* "transfer-encoding" */
-#define GRPC_MDSTR_TRANSFER_ENCODING (grpc_static_slice_table[90])
+#define GRPC_MDSTR_TRANSFER_ENCODING (grpc_static_slice_table[91])
 /* "vary" */
-#define GRPC_MDSTR_VARY (grpc_static_slice_table[91])
+#define GRPC_MDSTR_VARY (grpc_static_slice_table[92])
 /* "via" */
-#define GRPC_MDSTR_VIA (grpc_static_slice_table[92])
+#define GRPC_MDSTR_VIA (grpc_static_slice_table[93])
 /* "www-authenticate" */
-#define GRPC_MDSTR_WWW_AUTHENTICATE (grpc_static_slice_table[93])
+#define GRPC_MDSTR_WWW_AUTHENTICATE (grpc_static_slice_table[94])
 /* "0" */
-#define GRPC_MDSTR_0 (grpc_static_slice_table[94])
+#define GRPC_MDSTR_0 (grpc_static_slice_table[95])
 /* "identity" */
-#define GRPC_MDSTR_IDENTITY (grpc_static_slice_table[95])
+#define GRPC_MDSTR_IDENTITY (grpc_static_slice_table[96])
 /* "trailers" */
-#define GRPC_MDSTR_TRAILERS (grpc_static_slice_table[96])
+#define GRPC_MDSTR_TRAILERS (grpc_static_slice_table[97])
 /* "application/grpc" */
-#define GRPC_MDSTR_APPLICATION_SLASH_GRPC (grpc_static_slice_table[97])
+#define GRPC_MDSTR_APPLICATION_SLASH_GRPC (grpc_static_slice_table[98])
 /* "grpc" */
-#define GRPC_MDSTR_GRPC (grpc_static_slice_table[98])
+#define GRPC_MDSTR_GRPC (grpc_static_slice_table[99])
 /* "PUT" */
-#define GRPC_MDSTR_PUT (grpc_static_slice_table[99])
+#define GRPC_MDSTR_PUT (grpc_static_slice_table[100])
 /* "lb-cost-bin" */
-#define GRPC_MDSTR_LB_COST_BIN (grpc_static_slice_table[100])
+#define GRPC_MDSTR_LB_COST_BIN (grpc_static_slice_table[101])
 /* "identity,deflate" */
-#define GRPC_MDSTR_IDENTITY_COMMA_DEFLATE (grpc_static_slice_table[101])
+#define GRPC_MDSTR_IDENTITY_COMMA_DEFLATE (grpc_static_slice_table[102])
 /* "identity,gzip" */
-#define GRPC_MDSTR_IDENTITY_COMMA_GZIP (grpc_static_slice_table[102])
+#define GRPC_MDSTR_IDENTITY_COMMA_GZIP (grpc_static_slice_table[103])
 /* "deflate,gzip" */
-#define GRPC_MDSTR_DEFLATE_COMMA_GZIP (grpc_static_slice_table[103])
+#define GRPC_MDSTR_DEFLATE_COMMA_GZIP (grpc_static_slice_table[104])
 /* "identity,deflate,gzip" */
 #define GRPC_MDSTR_IDENTITY_COMMA_DEFLATE_COMMA_GZIP \
-  (grpc_static_slice_table[104])
+  (grpc_static_slice_table[105])
 
 extern const grpc_slice_refcount_vtable grpc_static_metadata_vtable;
 extern grpc_slice_refcount

src/core/tsi/transport_security.cc

@@ -338,3 +338,20 @@ tsi_result tsi_construct_peer(size_t property_count, tsi_peer* peer) {
   }
   return TSI_OK;
 }
+
+const tsi_peer_property* tsi_peer_get_property_by_name(const tsi_peer* peer,
+                                                       const char* name) {
+  size_t i;
+  if (peer == nullptr) return nullptr;
+  for (i = 0; i < peer->property_count; i++) {
+    const tsi_peer_property* property = &peer->properties[i];
+    if (name == nullptr && property->name == nullptr) {
+      return property;
+    }
+    if (name != nullptr && property->name != nullptr &&
+        strcmp(property->name, name) == 0) {
+      return property;
+    }
+  }
+  return nullptr;
+}

src/core/tsi/transport_security.h

@@ -122,7 +122,8 @@ tsi_result tsi_construct_allocated_string_peer_property(
     const char* name, size_t value_length, tsi_peer_property* property);
 tsi_result tsi_construct_string_peer_property_from_cstring(
     const char* name, const char* value, tsi_peer_property* property);
-
+const tsi_peer_property* tsi_peer_get_property_by_name(const tsi_peer* peer,
+                                                       const char* name);
 /* Utils. */
 char* tsi_strdup(const char* src); /* Sadly, no strdup in C89. */
 

src/cpp/common/completion_queue_cc.cc

@@ -64,7 +64,6 @@ CompletionQueue::NextStatus CompletionQueue::AsyncNextInternal(
         *ok = ev.success != 0;
         *tag = cq_tag;
         if (cq_tag->FinalizeResult(tag, ok)) {
-          gpr_log(GPR_ERROR, "alright got tag %p", *tag);
           return GOT_EVENT;
         }
         break;

src/cpp/server/channelz/channelz_service.cc

@@ -20,9 +20,6 @@
 
 #include "src/cpp/server/channelz/channelz_service.h"
 
-#include <google/protobuf/text_format.h>
-#include <google/protobuf/util/json_util.h>
-
 #include <grpc/grpc.h>
 #include <grpc/support/alloc.h>
 
@@ -33,13 +30,14 @@ Status ChannelzService::GetTopChannels(
     channelz::v1::GetTopChannelsResponse* response) {
   char* json_str = grpc_channelz_get_top_channels(request->start_channel_id());
   if (json_str == nullptr) {
-    return Status(INTERNAL, "grpc_channelz_get_top_channels returned null");
+    return Status(StatusCode::INTERNAL,
+                  "grpc_channelz_get_top_channels returned null");
   }
-  google::protobuf::util::Status s =
-      google::protobuf::util::JsonStringToMessage(json_str, response);
+  grpc::protobuf::util::Status s =
+      grpc::protobuf::json::JsonStringToMessage(json_str, response);
   gpr_free(json_str);
-  if (s != google::protobuf::util::Status::OK) {
-    return Status(INTERNAL, s.ToString());
+  if (!s.ok()) {
+    return Status(StatusCode::INTERNAL, s.ToString());
   }
   return Status::OK;
 }
@@ -49,13 +47,14 @@ Status ChannelzService::GetServers(
     channelz::v1::GetServersResponse* response) {
   char* json_str = grpc_channelz_get_servers(request->start_server_id());
   if (json_str == nullptr) {
-    return Status(INTERNAL, "grpc_channelz_get_servers returned null");
+    return Status(StatusCode::INTERNAL,
+                  "grpc_channelz_get_servers returned null");
   }
-  google::protobuf::util::Status s =
-      google::protobuf::util::JsonStringToMessage(json_str, response);
+  grpc::protobuf::util::Status s =
+      grpc::protobuf::json::JsonStringToMessage(json_str, response);
   gpr_free(json_str);
-  if (s != google::protobuf::util::Status::OK) {
-    return Status(INTERNAL, s.ToString());
+  if (!s.ok()) {
+    return Status(StatusCode::INTERNAL, s.ToString());
   }
   return Status::OK;
 }
@@ -66,13 +65,14 @@ Status ChannelzService::GetServerSockets(
   char* json_str = grpc_channelz_get_server_sockets(request->server_id(),
                                                     request->start_socket_id());
   if (json_str == nullptr) {
-    return Status(INTERNAL, "grpc_channelz_get_server_sockets returned null");
+    return Status(StatusCode::INTERNAL,
+                  "grpc_channelz_get_server_sockets returned null");
   }
-  google::protobuf::util::Status s =
-      google::protobuf::util::JsonStringToMessage(json_str, response);
+  grpc::protobuf::util::Status s =
+      grpc::protobuf::json::JsonStringToMessage(json_str, response);
   gpr_free(json_str);
-  if (s != google::protobuf::util::Status::OK) {
-    return Status(INTERNAL, s.ToString());
+  if (!s.ok()) {
+    return Status(StatusCode::INTERNAL, s.ToString());
   }
   return Status::OK;
 }
@@ -82,13 +82,13 @@ Status ChannelzService::GetChannel(
     channelz::v1::GetChannelResponse* response) {
   char* json_str = grpc_channelz_get_channel(request->channel_id());
   if (json_str == nullptr) {
-    return Status(NOT_FOUND, "No object found for that ChannelId");
+    return Status(StatusCode::NOT_FOUND, "No object found for that ChannelId");
   }
-  google::protobuf::util::Status s =
-      google::protobuf::util::JsonStringToMessage(json_str, response);
+  grpc::protobuf::util::Status s =
+      grpc::protobuf::json::JsonStringToMessage(json_str, response);
   gpr_free(json_str);
-  if (s != google::protobuf::util::Status::OK) {
-    return Status(INTERNAL, s.ToString());
+  if (!s.ok()) {
+    return Status(StatusCode::INTERNAL, s.ToString());
   }
   return Status::OK;
 }
@@ -98,13 +98,14 @@ Status ChannelzService::GetSubchannel(
     channelz::v1::GetSubchannelResponse* response) {
   char* json_str = grpc_channelz_get_subchannel(request->subchannel_id());
   if (json_str == nullptr) {
-    return Status(NOT_FOUND, "No object found for that SubchannelId");
+    return Status(StatusCode::NOT_FOUND,
+                  "No object found for that SubchannelId");
   }
-  google::protobuf::util::Status s =
-      google::protobuf::util::JsonStringToMessage(json_str, response);
+  grpc::protobuf::util::Status s =
+      grpc::protobuf::json::JsonStringToMessage(json_str, response);
   gpr_free(json_str);
-  if (s != google::protobuf::util::Status::OK) {
-    return Status(INTERNAL, s.ToString());
+  if (!s.ok()) {
+    return Status(StatusCode::INTERNAL, s.ToString());
   }
   return Status::OK;
 }
@@ -114,13 +115,13 @@ Status ChannelzService::GetSocket(ServerContext* unused,
                                   channelz::v1::GetSocketResponse* response) {
   char* json_str = grpc_channelz_get_socket(request->socket_id());
   if (json_str == nullptr) {
-    return Status(NOT_FOUND, "No object found for that SocketId");
+    return Status(StatusCode::NOT_FOUND, "No object found for that SocketId");
   }
-  google::protobuf::util::Status s =
-      google::protobuf::util::JsonStringToMessage(json_str, response);
+  grpc::protobuf::util::Status s =
+      grpc::protobuf::json::JsonStringToMessage(json_str, response);
   gpr_free(json_str);
-  if (s != google::protobuf::util::Status::OK) {
-    return Status(INTERNAL, s.ToString());
+  if (!s.ok()) {
+    return Status(StatusCode::INTERNAL, s.ToString());
   }
   return Status::OK;
 }

src/cpp/server/health/default_health_check_service.cc

@@ -26,8 +26,8 @@
 
 #include "pb_decode.h"
 #include "pb_encode.h"
+#include "src/core/ext/filters/client_channel/health/health.pb.h"
 #include "src/cpp/server/health/default_health_check_service.h"
-#include "src/cpp/server/health/health.pb.h"
 
 namespace grpc {
 
@@ -78,12 +78,12 @@ void DefaultHealthCheckService::RegisterCallHandler(
 
 void DefaultHealthCheckService::UnregisterCallHandler(
     const grpc::string& service_name,
-    std::shared_ptr<HealthCheckServiceImpl::CallHandler> handler) {
+    const std::shared_ptr<HealthCheckServiceImpl::CallHandler>& handler) {
   std::unique_lock<std::mutex> lock(mu_);
   auto it = services_map_.find(service_name);
   if (it == services_map_.end()) return;
   ServiceData& service_data = it->second;
-  service_data.RemoveCallHandler(std::move(handler));
+  service_data.RemoveCallHandler(handler);
   if (service_data.Unused()) {
     services_map_.erase(it);
   }
@@ -115,7 +115,7 @@ void DefaultHealthCheckService::ServiceData::AddCallHandler(
 }
 
 void DefaultHealthCheckService::ServiceData::RemoveCallHandler(
-    std::shared_ptr<HealthCheckServiceImpl::CallHandler> handler) {
+    const std::shared_ptr<HealthCheckServiceImpl::CallHandler>& handler) {
   call_handlers_.erase(handler);
 }
 
@@ -184,16 +184,13 @@ bool DefaultHealthCheckService::HealthCheckServiceImpl::DecodeRequest(
   std::vector<Slice> slices;
   if (!request.Dump(&slices).ok()) return false;
   uint8_t* request_bytes = nullptr;
-  bool request_bytes_owned = false;
   size_t request_size = 0;
   grpc_health_v1_HealthCheckRequest request_struct;
-  if (slices.empty()) {
-    request_struct.has_service = false;
-  } else if (slices.size() == 1) {
+  request_struct.has_service = false;
+  if (slices.size() == 1) {
     request_bytes = const_cast<uint8_t*>(slices[0].begin());
     request_size = slices[0].size();
-  } else {
-    request_bytes_owned = true;
+  } else if (slices.size() > 1) {
     request_bytes = static_cast<uint8_t*>(gpr_malloc(request.Length()));
     uint8_t* copy_to = request_bytes;
     for (size_t i = 0; i < slices.size(); i++) {
@@ -201,15 +198,13 @@ bool DefaultHealthCheckService::HealthCheckServiceImpl::DecodeRequest(
       copy_to += slices[i].size();
     }
   }
-  if (request_bytes != nullptr) {
-    pb_istream_t istream = pb_istream_from_buffer(request_bytes, request_size);
-    bool decode_status = pb_decode(
-        &istream, grpc_health_v1_HealthCheckRequest_fields, &request_struct);
-    if (request_bytes_owned) {
-      gpr_free(request_bytes);
-    }
-    if (!decode_status) return false;
+  pb_istream_t istream = pb_istream_from_buffer(request_bytes, request_size);
+  bool decode_status = pb_decode(
+      &istream, grpc_health_v1_HealthCheckRequest_fields, &request_struct);
+  if (slices.size() > 1) {
+    gpr_free(request_bytes);
   }
+  if (!decode_status) return false;
   *service_name = request_struct.has_service ? request_struct.service : "";
   return true;
 }
@@ -318,6 +313,7 @@ void DefaultHealthCheckService::HealthCheckServiceImpl::CheckCallHandler::
     gpr_log(GPR_DEBUG, "[HCS %p] Health check call finished for handler %p",
             service_, this);
   }
+  self.reset();  // To appease clang-tidy.
 }
 
 //
@@ -442,7 +438,7 @@ void DefaultHealthCheckService::HealthCheckServiceImpl::WatchCallHandler::
     SendFinish(std::shared_ptr<CallHandler> self, const Status& status) {
   if (finish_called_) return;
   std::unique_lock<std::mutex> cq_lock(service_->cq_shutdown_mu_);
-  if (!service_->shutdown_) return;
+  if (service_->shutdown_) return;
   SendFinishLocked(std::move(self), status);
 }
 
@@ -464,6 +460,7 @@ void DefaultHealthCheckService::HealthCheckServiceImpl::WatchCallHandler::
             "handler: %p).",
             service_, service_name_.c_str(), this);
   }
+  self.reset();  // To appease clang-tidy.
 }
 
 // TODO(roth): This method currently assumes that there will be only one
@@ -473,9 +470,10 @@ void DefaultHealthCheckService::HealthCheckServiceImpl::WatchCallHandler::
     OnDoneNotified(std::shared_ptr<CallHandler> self, bool ok) {
   GPR_ASSERT(ok);
   gpr_log(GPR_DEBUG,
-          "[HCS %p] Healt watch call is notified done (handler: %p, "
+          "[HCS %p] Health watch call is notified done (handler: %p, "
           "is_cancelled: %d).",
           service_, this, static_cast<int>(ctx_.IsCancelled()));
+  database_->UnregisterCallHandler(service_name_, self);
   SendFinish(std::move(self), Status::CANCELLED);
 }
 

src/cpp/server/health/default_health_check_service.h

@@ -252,7 +252,7 @@ class DefaultHealthCheckService final : public HealthCheckServiceInterface {
     void AddCallHandler(
         std::shared_ptr<HealthCheckServiceImpl::CallHandler> handler);
     void RemoveCallHandler(
-        std::shared_ptr<HealthCheckServiceImpl::CallHandler> handler);
+        const std::shared_ptr<HealthCheckServiceImpl::CallHandler>& handler);
     bool Unused() const {
       return call_handlers_.empty() && status_ == NOT_FOUND;
     }
@@ -269,7 +269,7 @@ class DefaultHealthCheckService final : public HealthCheckServiceInterface {
 
   void UnregisterCallHandler(
       const grpc::string& service_name,
-      std::shared_ptr<HealthCheckServiceImpl::CallHandler> handler);
+      const std::shared_ptr<HealthCheckServiceImpl::CallHandler>& handler);
 
   mutable std::mutex mu_;
   std::map<grpc::string, ServiceData> services_map_;  // Guarded by mu_.

src/cpp/server/server_context.cc

@@ -40,8 +40,10 @@ namespace grpc {
 class ServerContext::CompletionOp final : public internal::CallOpSetInterface {
  public:
   // initial refs: one in the server context, one in the cq
-  CompletionOp()
-      : has_tag_(false),
+  // must ref the call before calling constructor and after deleting this
+  CompletionOp(internal::Call* call)
+      : call_(*call),
+        has_tag_(false),
         tag_(nullptr),
         refs_(2),
         finalized_(false),
@@ -55,6 +57,21 @@ class ServerContext::CompletionOp final : public internal::CallOpSetInterface {
   }
 
   void FillOps(internal::Call* call) override;
+
+  // This should always be arena allocated in the call, so override delete.
+  // But this class is not trivially destructible, so must actually call delete
+  // before allowing the arena to be freed
+  static void operator delete(void* ptr, std::size_t size) {
+    assert(size == sizeof(CompletionOp));
+  }
+
+  // This operator should never be called as the memory should be freed as part
+  // of the arena destruction. It only exists to provide a matching operator
+  // delete to the operator new so that some compilers will not complain (see
+  // https://github.com/grpc/grpc/issues/11301) Note at the time of adding this
+  // there are no tests catching the compiler warning.
+  static void operator delete(void*, void*) { assert(0); }
+
   bool FinalizeResult(void** tag, bool* status) override;
 
   bool CheckCancelled(CompletionQueue* cq) {
@@ -92,7 +109,9 @@ class ServerContext::CompletionOp final : public internal::CallOpSetInterface {
       std::unique_lock<std::mutex> lock(mu_);
       if (--refs_ == 0) {
         lock.unlock();
+        grpc_call* call = call_.call();
         delete this;
+        grpc_call_unref(call);
       }
       return;
     }
@@ -108,6 +127,7 @@ class ServerContext::CompletionOp final : public internal::CallOpSetInterface {
     return finalized_ ? (cancelled_ != 0) : false;
   }
 
+  internal::Call call_;
   bool has_tag_;
   void* tag_;
   std::mutex mu_;
@@ -115,7 +135,6 @@ class ServerContext::CompletionOp final : public internal::CallOpSetInterface {
   bool finalized_;
   int cancelled_;
   bool done_intercepting_;
-  internal::Call call_;
   internal::InterceptorBatchMethodsImpl interceptor_methods_;
 };
 
@@ -123,7 +142,9 @@ void ServerContext::CompletionOp::Unref() {
   std::unique_lock<std::mutex> lock(mu_);
   if (--refs_ == 0) {
     lock.unlock();
+    grpc_call* call = call_.call();
     delete this;
+    grpc_call_unref(call);
   }
 }
 
@@ -133,7 +154,6 @@ void ServerContext::CompletionOp::FillOps(internal::Call* call) {
   ops.data.recv_close_on_server.cancelled = &cancelled_;
   ops.flags = 0;
   ops.reserved = nullptr;
-  call_ = *call;
   interceptor_methods_.SetCall(&call_);
   interceptor_methods_.SetReverse();
   interceptor_methods_.SetCallOpSetInterface(this);
@@ -153,7 +173,9 @@ bool ServerContext::CompletionOp::FinalizeResult(void** tag, bool* status) {
     }
     if (--refs_ == 0) {
       lock.unlock();
+      grpc_call* call = call_.call();
       delete this;
+      grpc_call_unref(call);
     }
     return ret;
   }
@@ -175,7 +197,9 @@ bool ServerContext::CompletionOp::FinalizeResult(void** tag, bool* status) {
     lock.lock();
     if (--refs_ == 0) {
       lock.unlock();
+      grpc_call* call = call_.call();
       delete this;
+      grpc_call_unref(call);
     }
     return ret;
   }
@@ -226,7 +250,10 @@ void ServerContext::BeginCompletionOp(internal::Call* call) {
   if (rpc_info_) {
     rpc_info_->Ref();
   }
-  completion_op_ = new CompletionOp();
+  grpc_call_ref(call->call());
+  completion_op_ =
+      new (grpc_call_arena_alloc(call->call(), sizeof(CompletionOp)))
+          CompletionOp(call);
   if (has_notify_when_done_tag_) {
     completion_op_->set_tag(async_notify_when_done_tag_);
   }

src/python/grpcio/grpc_core_dependencies.py

@@ -254,11 +254,14 @@ CORE_SOURCE_FILES = [
     'src/core/lib/security/credentials/oauth2/oauth2_credentials.cc',
     'src/core/lib/security/credentials/plugin/plugin_credentials.cc',
     'src/core/lib/security/credentials/ssl/ssl_credentials.cc',
-    'src/core/lib/security/security_connector/alts_security_connector.cc',
+    'src/core/lib/security/security_connector/alts/alts_security_connector.cc',
+    'src/core/lib/security/security_connector/fake/fake_security_connector.cc',
     'src/core/lib/security/security_connector/load_system_roots_fallback.cc',
     'src/core/lib/security/security_connector/load_system_roots_linux.cc',
-    'src/core/lib/security/security_connector/local_security_connector.cc',
+    'src/core/lib/security/security_connector/local/local_security_connector.cc',
     'src/core/lib/security/security_connector/security_connector.cc',
+    'src/core/lib/security/security_connector/ssl/ssl_security_connector.cc',
+    'src/core/lib/security/security_connector/ssl_utils.cc',
     'src/core/lib/security/transport/client_auth_filter.cc',
     'src/core/lib/security/transport/secure_endpoint.cc',
     'src/core/lib/security/transport/security_handshaker.cc',
@@ -313,6 +316,7 @@ CORE_SOURCE_FILES = [
     'src/core/ext/filters/client_channel/client_channel_factory.cc',
     'src/core/ext/filters/client_channel/client_channel_plugin.cc',
     'src/core/ext/filters/client_channel/connector.cc',
+    'src/core/ext/filters/client_channel/health/health_check_client.cc',
     'src/core/ext/filters/client_channel/http_connect_handshaker.cc',
     'src/core/ext/filters/client_channel/http_proxy.cc',
     'src/core/ext/filters/client_channel/lb_policy.cc',
@@ -329,6 +333,7 @@ CORE_SOURCE_FILES = [
     'src/core/ext/filters/client_channel/subchannel_index.cc',
     'src/core/ext/filters/client_channel/uri_parser.cc',
     'src/core/ext/filters/deadline/deadline_filter.cc',
+    'src/core/ext/filters/client_channel/health/health.pb.c',
     'src/core/tsi/alts_transport_security.cc',
     'src/core/tsi/fake_transport_security.cc',
     'src/core/tsi/local_transport_security.cc',

templates/tools/dockerfile/apt_get_python_27.include

@@ -0,0 +1,3 @@
+# Install Python 2.7
+RUN apt-get update && apt-get install -y python2.7 python-all-dev
+RUN curl https://bootstrap.pypa.io/get-pip.py | python2.7

templates/tools/dockerfile/debian_testing_repo.include

@@ -0,0 +1,3 @@
+# Add Debian 'testing' repository
+RUN echo 'deb http://ftp.de.debian.org/debian testing main' >> /etc/apt/sources.list
+RUN echo 'APT::Default-Release "stable";' | tee -a /etc/apt/apt.conf.d/00local

templates/tools/dockerfile/java_build_interop.sh.include

@@ -25,3 +25,11 @@ cp -r /var/local/jenkins/service_account $HOME || true
 cd /var/local/git/grpc-java
 
 ./gradlew :grpc-interop-testing:installDist -PskipCodegen=true
+
+# enable extra java logging
+mkdir -p /var/local/grpc_java_logging
+echo "handlers = java.util.logging.ConsoleHandler
+java.util.logging.ConsoleHandler.level = ALL
+.level = FINE
+io.grpc.netty.NettyClientHandler = ALL
+io.grpc.netty.NettyServerHandler = ALL" > /var/local/grpc_java_logging/logconf.txt

templates/tools/dockerfile/python_stretch.include

@@ -0,0 +1,9 @@
+FROM debian:stretch
+  
+<%include file="./apt_get_basic.include"/>
+<%include file="./gcp_api_libraries.include"/>
+<%include file="./apt_get_python_27.include"/>
+<%include file="./debian_testing_repo.include"/>
+<%include file="./run_tests_addons.include"/>
+# Define the default command.
+CMD ["bash"]

templates/tools/dockerfile/test/python_stretch_2.7_x64/Dockerfile.template

@@ -0,0 +1,17 @@
+%YAML 1.2
+--- |
+  # Copyright 2018 The gRPC Authors
+  #
+  # Licensed under the Apache License, Version 2.0 (the "License");
+  # you may not use this file except in compliance with the License.
+  # You may obtain a copy of the License at
+  #
+  #     http://www.apache.org/licenses/LICENSE-2.0
+  #
+  # Unless required by applicable law or agreed to in writing, software
+  # distributed under the License is distributed on an "AS IS" BASIS,
+  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  # See the License for the specific language governing permissions and
+  # limitations under the License.
+
+  <%include file="../../python_stretch.include"/>

templates/tools/dockerfile/test/python_pyenv_x64/Dockerfile.template → templates/tools/dockerfile/test/python_stretch_3.5_x64/Dockerfile.template

@@ -1,6 +1,6 @@
 %YAML 1.2
 --- |
-  # Copyright 2016 gRPC authors.
+  # Copyright 2018 The gRPC Authors
   #
   # Licensed under the Apache License, Version 2.0 (the "License");
   # you may not use this file except in compliance with the License.
@@ -13,17 +13,8 @@
   # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   # See the License for the specific language governing permissions and
   # limitations under the License.
-  
-  FROM debian:stretch
-  
-  <%include file="../../apt_get_basic.include"/>
-  <%include file="../../gcp_api_libraries.include"/>
-  <%include file="../../python_deps.include"/>
-  <%include file="../../apt_get_pyenv.include"/>
-  # Install pip and virtualenv for Python 3.5
-  RUN curl https://bootstrap.pypa.io/get-pip.py | python3.5
-  RUN python3.5 -m pip install virtualenv
 
-  <%include file="../../run_tests_addons.include"/>
-  # Define the default command.
-  CMD ["bash"]
+  <%include file="../../python_stretch.include"/>
+
+  RUN apt-get update && apt-get install -y python3.5 python3-all-dev
+  RUN curl https://bootstrap.pypa.io/get-pip.py | python3.5

templates/tools/dockerfile/test/python_stretch_3.6_x64/Dockerfile.template

@@ -0,0 +1,20 @@
+%YAML 1.2
+--- |
+  # Copyright 2018 The gRPC Authors
+  #
+  # Licensed under the Apache License, Version 2.0 (the "License");
+  # you may not use this file except in compliance with the License.
+  # You may obtain a copy of the License at
+  #
+  #     http://www.apache.org/licenses/LICENSE-2.0
+  #
+  # Unless required by applicable law or agreed to in writing, software
+  # distributed under the License is distributed on an "AS IS" BASIS,
+  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  # See the License for the specific language governing permissions and
+  # limitations under the License.
+
+  <%include file="../../python_stretch.include"/>
+
+  RUN apt-get update && apt-get -t testing install -y python3.6 python3-all-dev
+  RUN curl https://bootstrap.pypa.io/get-pip.py | python3.6

templates/tools/dockerfile/test/python_stretch_3.7_x64/Dockerfile.template

@@ -0,0 +1,20 @@
+%YAML 1.2
+--- |
+  # Copyright 2018 The gRPC Authors
+  #
+  # Licensed under the Apache License, Version 2.0 (the "License");
+  # you may not use this file except in compliance with the License.
+  # You may obtain a copy of the License at
+  #
+  #     http://www.apache.org/licenses/LICENSE-2.0
+  #
+  # Unless required by applicable law or agreed to in writing, software
+  # distributed under the License is distributed on an "AS IS" BASIS,
+  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  # See the License for the specific language governing permissions and
+  # limitations under the License.
+
+  <%include file="../../python_stretch.include"/>
+
+  RUN apt-get update && apt-get -t testing install -y python3.7 python3-all-dev
+  RUN curl https://bootstrap.pypa.io/get-pip.py | python3.7

templates/tools/run_tests/generated/lb_interop_test_scenarios.json.template

@@ -0,0 +1,6 @@
+%YAML 1.2
+--- |
+  <%!
+  import json
+  %>
+  ${json.dumps(lb_interop_test_scenarios, indent=4, sort_keys=True)}

test/core/channel/channelz_test.cc

@@ -85,6 +85,19 @@ void ValidateJsonArraySize(grpc_json* json, const char* key,
   EXPECT_EQ(count, expected_size);
 }
 
+std::vector<intptr_t> GetUuidListFromArray(grpc_json* arr) {
+  EXPECT_EQ(arr->type, GRPC_JSON_ARRAY);
+  std::vector<intptr_t> uuids;
+  for (grpc_json* child = arr->child; child != nullptr; child = child->next) {
+    grpc_json* it = GetJsonChild(child, "ref");
+    EXPECT_NE(it, nullptr);
+    it = GetJsonChild(it, "channelId");
+    EXPECT_NE(it, nullptr);
+    uuids.push_back(atoi(it->value));
+  }
+  return uuids;
+}
+
 void ValidateGetTopChannels(size_t expected_channels) {
   char* json_str = ChannelzRegistry::GetTopChannels(0);
   grpc::testing::ValidateGetTopChannelsResponseProtoJsonTranslation(json_str);
@@ -226,19 +239,7 @@ void ChannelzSleep(int64_t sleep_us) {
 
 }  // anonymous namespace
 
-class ChannelzChannelTest : public ::testing::TestWithParam<size_t> {
- protected:
-  // ensure we always have a fresh registry for tests.
-  void SetUp() override {
-    ChannelzRegistry::Shutdown();
-    ChannelzRegistry::Init();
-  }
-
-  void TearDown() override {
-    ChannelzRegistry::Shutdown();
-    ChannelzRegistry::Init();
-  }
-};
+class ChannelzChannelTest : public ::testing::TestWithParam<size_t> {};
 
 TEST_P(ChannelzChannelTest, BasicChannel) {
   grpc_core::ExecCtx exec_ctx;
@@ -307,25 +308,39 @@ TEST_P(ChannelzChannelTest, LastCallStartedMillis) {
   EXPECT_NE(millis1, millis4);
 }
 
-TEST(ChannelzGetTopChannelsTest, BasicGetTopChannelsTest) {
+class ChannelzRegistryBasedTest : public ::testing::TestWithParam<size_t> {
+ protected:
+  // ensure we always have a fresh registry for tests.
+  void SetUp() override {
+    ChannelzRegistry::Shutdown();
+    ChannelzRegistry::Init();
+  }
+
+  void TearDown() override {
+    ChannelzRegistry::Shutdown();
+    ChannelzRegistry::Init();
+  }
+};
+
+TEST_F(ChannelzRegistryBasedTest, BasicGetTopChannelsTest) {
   grpc_core::ExecCtx exec_ctx;
   ChannelFixture channel;
   ValidateGetTopChannels(1);
 }
 
-TEST(ChannelzGetTopChannelsTest, NoChannelsTest) {
+TEST_F(ChannelzRegistryBasedTest, NoChannelsTest) {
   grpc_core::ExecCtx exec_ctx;
   ValidateGetTopChannels(0);
 }
 
-TEST(ChannelzGetTopChannelsTest, ManyChannelsTest) {
+TEST_F(ChannelzRegistryBasedTest, ManyChannelsTest) {
   grpc_core::ExecCtx exec_ctx;
   ChannelFixture channels[10];
   (void)channels;  // suppress unused variable error
   ValidateGetTopChannels(10);
 }
 
-TEST(ChannelzGetTopChannelsTest, GetTopChannelsPagination) {
+TEST_F(ChannelzRegistryBasedTest, GetTopChannelsPagination) {
   grpc_core::ExecCtx exec_ctx;
   // this is over the pagination limit.
   ChannelFixture channels[150];
@@ -351,7 +366,116 @@ TEST(ChannelzGetTopChannelsTest, GetTopChannelsPagination) {
   gpr_free(json_str);
 }
 
-TEST(ChannelzGetTopChannelsTest, InternalChannelTest) {
+TEST_F(ChannelzRegistryBasedTest, GetTopChannelsUuidCheck) {
+  const intptr_t kNumChannels = 50;
+  grpc_core::ExecCtx exec_ctx;
+  ChannelFixture channels[kNumChannels];
+  (void)channels;  // suppress unused variable error
+  char* json_str = ChannelzRegistry::GetTopChannels(0);
+  grpc_json* parsed_json = grpc_json_parse_string(json_str);
+  ValidateJsonArraySize(parsed_json, "channel", kNumChannels);
+  grpc_json* json_channels = GetJsonChild(parsed_json, "channel");
+  std::vector<intptr_t> uuids = GetUuidListFromArray(json_channels);
+  for (int i = 0; i < kNumChannels; ++i) {
+    EXPECT_EQ(i + 1, uuids[i]);
+  }
+  grpc_json_destroy(parsed_json);
+  gpr_free(json_str);
+}
+
+TEST_F(ChannelzRegistryBasedTest, GetTopChannelsMiddleUuidCheck) {
+  const intptr_t kNumChannels = 50;
+  const intptr_t kMidQuery = 40;
+  grpc_core::ExecCtx exec_ctx;
+  ChannelFixture channels[kNumChannels];
+  (void)channels;  // suppress unused variable error
+  // only query for the end of the channels
+  char* json_str = ChannelzRegistry::GetTopChannels(kMidQuery);
+  grpc_json* parsed_json = grpc_json_parse_string(json_str);
+  ValidateJsonArraySize(parsed_json, "channel", kNumChannels - kMidQuery + 1);
+  grpc_json* json_channels = GetJsonChild(parsed_json, "channel");
+  std::vector<intptr_t> uuids = GetUuidListFromArray(json_channels);
+  for (size_t i = 0; i < uuids.size(); ++i) {
+    EXPECT_EQ(static_cast<intptr_t>(kMidQuery + i), uuids[i]);
+  }
+  grpc_json_destroy(parsed_json);
+  gpr_free(json_str);
+}
+
+TEST_F(ChannelzRegistryBasedTest, GetTopChannelsNoHitUuid) {
+  grpc_core::ExecCtx exec_ctx;
+  ChannelFixture pre_channels[40];  // will take uuid[1, 40]
+  (void)pre_channels;               // suppress unused variable error
+  ServerFixture servers[10];        // will take uuid[41, 50]
+  (void)servers;                    // suppress unused variable error
+  ChannelFixture channels[10];      // will take uuid[51, 60]
+  (void)channels;                   // suppress unused variable error
+  // query in the middle of the server channels
+  char* json_str = ChannelzRegistry::GetTopChannels(45);
+  grpc_json* parsed_json = grpc_json_parse_string(json_str);
+  ValidateJsonArraySize(parsed_json, "channel", 10);
+  grpc_json* json_channels = GetJsonChild(parsed_json, "channel");
+  std::vector<intptr_t> uuids = GetUuidListFromArray(json_channels);
+  for (size_t i = 0; i < uuids.size(); ++i) {
+    EXPECT_EQ(static_cast<intptr_t>(51 + i), uuids[i]);
+  }
+  grpc_json_destroy(parsed_json);
+  gpr_free(json_str);
+}
+
+TEST_F(ChannelzRegistryBasedTest, GetTopChannelsMoreGaps) {
+  grpc_core::ExecCtx exec_ctx;
+  ChannelFixture channel_with_uuid1;
+  { ServerFixture channel_with_uuid2; }
+  ChannelFixture channel_with_uuid3;
+  { ServerFixture server_with_uuid4; }
+  ChannelFixture channel_with_uuid5;
+  // Current state of list: [1, NULL, 3, NULL, 5]
+  char* json_str = ChannelzRegistry::GetTopChannels(2);
+  grpc_json* parsed_json = grpc_json_parse_string(json_str);
+  ValidateJsonArraySize(parsed_json, "channel", 2);
+  grpc_json* json_channels = GetJsonChild(parsed_json, "channel");
+  std::vector<intptr_t> uuids = GetUuidListFromArray(json_channels);
+  EXPECT_EQ(static_cast<intptr_t>(3), uuids[0]);
+  EXPECT_EQ(static_cast<intptr_t>(5), uuids[1]);
+  grpc_json_destroy(parsed_json);
+  gpr_free(json_str);
+  json_str = ChannelzRegistry::GetTopChannels(4);
+  parsed_json = grpc_json_parse_string(json_str);
+  ValidateJsonArraySize(parsed_json, "channel", 1);
+  json_channels = GetJsonChild(parsed_json, "channel");
+  uuids = GetUuidListFromArray(json_channels);
+  EXPECT_EQ(static_cast<intptr_t>(5), uuids[0]);
+  grpc_json_destroy(parsed_json);
+  gpr_free(json_str);
+}
+
+TEST_F(ChannelzRegistryBasedTest, GetTopChannelsUuidAfterCompaction) {
+  const intptr_t kLoopIterations = 50;
+  grpc_core::ExecCtx exec_ctx;
+  std::vector<UniquePtr<ChannelFixture>> even_channels;
+  {
+    // these will delete and unregister themselves after this block.
+    std::vector<UniquePtr<ChannelFixture>> odd_channels;
+    for (int i = 0; i < kLoopIterations; i++) {
+      odd_channels.push_back(MakeUnique<ChannelFixture>());
+      even_channels.push_back(MakeUnique<ChannelFixture>());
+    }
+  }
+  char* json_str = ChannelzRegistry::GetTopChannels(0);
+  grpc_json* parsed_json = grpc_json_parse_string(json_str);
+  ValidateJsonArraySize(parsed_json, "channel", kLoopIterations);
+  grpc_json* json_channels = GetJsonChild(parsed_json, "channel");
+  std::vector<intptr_t> uuids = GetUuidListFromArray(json_channels);
+  for (int i = 0; i < kLoopIterations; ++i) {
+    // only the even uuids will still be present.
+    EXPECT_EQ((i + 1) * 2, uuids[i]);
+  }
+  grpc_json_destroy(parsed_json);
+  gpr_free(json_str);
+}
+
+TEST_F(ChannelzRegistryBasedTest, InternalChannelTest) {
   grpc_core::ExecCtx exec_ctx;
   ChannelFixture channels[10];
   (void)channels;  // suppress unused variable error
@@ -369,9 +493,7 @@ TEST(ChannelzGetTopChannelsTest, InternalChannelTest) {
   grpc_channel_destroy(internal_channel);
 }
 
-class ChannelzServerTest : public ::testing::TestWithParam<size_t> {};
-
-TEST_P(ChannelzServerTest, BasicServerAPIFunctionality) {
+TEST(ChannelzServerTest, BasicServerAPIFunctionality) {
   grpc_core::ExecCtx exec_ctx;
   ServerFixture server(10);
   ServerNode* channelz_server = grpc_server_get_channelz_node(server.server());
@@ -388,18 +510,18 @@ TEST_P(ChannelzServerTest, BasicServerAPIFunctionality) {
   ValidateServer(channelz_server, {3, 3, 3});
 }
 
-TEST(ChannelzGetServersTest, BasicGetServersTest) {
+TEST_F(ChannelzRegistryBasedTest, BasicGetServersTest) {
   grpc_core::ExecCtx exec_ctx;
   ServerFixture server;
   ValidateGetServers(1);
 }
 
-TEST(ChannelzGetServersTest, NoServersTest) {
+TEST_F(ChannelzRegistryBasedTest, NoServersTest) {
   grpc_core::ExecCtx exec_ctx;
   ValidateGetServers(0);
 }
 
-TEST(ChannelzGetServersTest, ManyServersTest) {
+TEST_F(ChannelzRegistryBasedTest, ManyServersTest) {
   grpc_core::ExecCtx exec_ctx;
   ServerFixture servers[10];
   (void)servers;  // suppress unused variable error
@@ -409,9 +531,6 @@ TEST(ChannelzGetServersTest, ManyServersTest) {
 INSTANTIATE_TEST_CASE_P(ChannelzChannelTestSweep, ChannelzChannelTest,
                         ::testing::Values(0, 8, 64, 1024, 1024 * 1024));
 
-INSTANTIATE_TEST_CASE_P(ChannelzServerTestSweep, ChannelzServerTest,
-                        ::testing::Values(0, 8, 64, 1024, 1024 * 1024));
-
 }  // namespace testing
 }  // namespace channelz
 }  // namespace grpc_core

test/core/end2end/BUILD

@@ -18,7 +18,7 @@ licenses(["notice"])  # Apache v2
 
 grpc_package(name = "test/core/end2end")
 
-load(":generate_tests.bzl", "grpc_end2end_tests")
+load(":generate_tests.bzl", "grpc_end2end_tests", "grpc_end2end_nosec_tests")
 
 grpc_cc_library(
     name = "cq_verifier",
@@ -46,7 +46,6 @@ grpc_cc_library(
     visibility = ["//test:__subpackages__"],
 )
 
-
 grpc_cc_library(
     name = "http_proxy",
     srcs = ["fixtures/http_proxy_fixture.cc"],
@@ -128,7 +127,7 @@ grpc_cc_test(
     srcs = ["inproc_callback_test.cc"],
     language = "C++",
     deps = [
-        ':end2end_tests',
+        ":end2end_tests",
         "//:gpr",
         "//:grpc",
         "//test/core/util:gpr_test_util",
@@ -177,6 +176,8 @@ grpc_cc_test(
 
 grpc_end2end_tests()
 
+grpc_end2end_nosec_tests()
+
 grpc_cc_test(
     name = "h2_ssl_session_reuse_test",
     srcs = ["h2_ssl_session_reuse_test.cc"],
@@ -185,11 +186,11 @@ grpc_cc_test(
     ],
     language = "C++",
     deps = [
-        ':end2end_tests',
-        '//:gpr',
-        '//:grpc',
-        '//:tsi',
-        '//test/core/util:gpr_test_util',
-        '//test/core/util:grpc_test_util',
+        ":end2end_tests",
+        "//:gpr",
+        "//:grpc",
+        "//:tsi",
+        "//test/core/util:gpr_test_util",
+        "//test/core/util:grpc_test_util",
     ],
 )

test/core/end2end/fuzzers/hpack.dictionary

@@ -34,6 +34,7 @@
 "\x1Egrpc.max_request_message_bytes"
 "\x1Fgrpc.max_response_message_bytes"
 "$/grpc.lb.v1.LoadBalancer/BalanceLoad"
+"\x1C/grpc.health.v1.Health/Watch"
 "\x07deflate"
 "\x04gzip"
 "\x0Bstream/gzip"

test/core/end2end/gen_build_yaml.py

@@ -41,7 +41,7 @@ local_fixture_options = default_secure_fixture_options._replace(
 fd_unsecure_fixture_options = default_unsecure_fixture_options._replace(
     dns_resolver=False, fullstack=False, platforms=['linux', 'mac', 'posix'],
     exclude_iomgrs=['uv'], client_channel=False)
-inproc_fixture_options = default_unsecure_fixture_options._replace(
+inproc_fixture_options = default_secure_fixture_options._replace(
     dns_resolver=False, fullstack=False, name_resolution=False,
     supports_compression=False, is_inproc=True, is_http2=False,
     supports_write_buffering=False, client_channel=False)

test/core/end2end/generate_tests.bzl

@@ -92,6 +92,7 @@ END2END_FIXTURES = {
         _platforms = ["linux", "mac", "posix"],
     ),
     "inproc": _fixture_options(
+        secure = True,
         fullstack = False,
         dns_resolver = False,
         name_resolution = False,
@@ -102,6 +103,55 @@ END2END_FIXTURES = {
     ),
 }
 
+# maps fixture name to whether it requires the security library
+END2END_NOSEC_FIXTURES = {
+    "h2_compress": _fixture_options(secure = False),
+    "h2_census": _fixture_options(secure = False),
+    # TODO(juanlishen): This is disabled for now, but should be considered to re-enable once we have
+    # decided how the load reporting service should be enabled.
+    #'h2_load_reporting': _fixture_options(),
+    "h2_fakesec": _fixture_options(),
+    "h2_fd": _fixture_options(
+        dns_resolver = False,
+        fullstack = False,
+        client_channel = False,
+        secure = False,
+        _platforms = ["linux", "mac", "posix"],
+    ),
+    "h2_full": _fixture_options(secure = False),
+    "h2_full+pipe": _fixture_options(secure = False, _platforms = ["linux"]),
+    "h2_full+trace": _fixture_options(secure = False, tracing = True),
+    "h2_full+workarounds": _fixture_options(secure = False),
+    "h2_http_proxy": _fixture_options(secure = False, supports_proxy_auth = True),
+    "h2_proxy": _fixture_options(secure = False, includes_proxy = True),
+    "h2_sockpair_1byte": _fixture_options(
+        fullstack = False,
+        dns_resolver = False,
+        client_channel = False,
+        secure = False,
+    ),
+    "h2_sockpair": _fixture_options(
+        fullstack = False,
+        dns_resolver = False,
+        client_channel = False,
+        secure = False,
+    ),
+    "h2_sockpair+trace": _fixture_options(
+        fullstack = False,
+        dns_resolver = False,
+        tracing = True,
+        secure = False,
+        client_channel = False,
+    ),
+    "h2_ssl": _fixture_options(secure = False),
+    "h2_ssl_proxy": _fixture_options(includes_proxy = True, secure = False),
+    "h2_uds": _fixture_options(
+        dns_resolver = False,
+        _platforms = ["linux", "mac", "posix"],
+        secure = False,
+    ),
+}
+
 def _test_options(
         needs_fullstack = False,
         needs_dns = False,
@@ -357,3 +407,57 @@ def grpc_end2end_tests():
                         poller,
                     ],
                 )
+
+def grpc_end2end_nosec_tests():
+    grpc_cc_library(
+        name = "end2end_nosec_tests",
+        srcs = ["end2end_nosec_tests.cc", "end2end_test_utils.cc"] + [
+            "tests/%s.cc" % t
+            for t in sorted(END2END_TESTS.keys())
+            if not END2END_TESTS[t].secure
+        ],
+        hdrs = [
+            "tests/cancel_test_helpers.h",
+            "end2end_tests.h",
+        ],
+        language = "C++",
+        deps = [
+            ":cq_verifier",
+            ":ssl_test_data",
+            ":http_proxy",
+            ":proxy",
+        ],
+    )
+
+    for f, fopt in END2END_NOSEC_FIXTURES.items():
+        if fopt.secure:
+            continue
+        grpc_cc_binary(
+            name = "%s_nosec_test" % f,
+            srcs = ["fixtures/%s.cc" % f],
+            language = "C++",
+            deps = [
+                ":end2end_nosec_tests",
+                "//test/core/util:grpc_test_util_unsecure",
+                "//:grpc_unsecure",
+                "//test/core/util:gpr_test_util",
+                "//:gpr",
+            ],
+        )
+        for t, topt in END2END_TESTS.items():
+            #print(_compatible(fopt, topt), f, t, fopt, topt)
+            if not _compatible(fopt, topt):
+                continue
+            if topt.secure:
+                continue
+            for poller in POLLERS:
+                native.sh_test(
+                    name = "%s_nosec_test@%s@poller=%s" % (f, t, poller),
+                    data = [":%s_nosec_test" % f],
+                    srcs = ["end2end_test.sh"],
+                    args = [
+                        "$(location %s_nosec_test)" % f,
+                        t,
+                        poller,
+                    ],
+                )

test/core/iomgr/tcp_client_uv_test.cc

@@ -129,6 +129,7 @@ void test_succeeds(void) {
   uv_close((uv_handle_t*)svr_handle, close_cb);
 
   gpr_mu_unlock(g_mu);
+  grpc_core::ExecCtx::Get()->Flush();
 }
 
 void test_fails(void) {
@@ -178,6 +179,7 @@ void test_fails(void) {
   }
 
   gpr_mu_unlock(g_mu);
+  grpc_core::ExecCtx::Get()->Flush();
 }
 
 static void destroy_pollset(void* p, grpc_error* error) {
@@ -186,21 +188,22 @@ static void destroy_pollset(void* p, grpc_error* error) {
 
 int main(int argc, char** argv) {
   grpc_closure destroyed;
-  grpc_core::ExecCtx exec_ctx;
   grpc_test_init(argc, argv);
   grpc_init();
-  g_pollset = static_cast<grpc_pollset*>(gpr_malloc(grpc_pollset_size()));
-  grpc_pollset_init(g_pollset, &g_mu);
-
-  test_succeeds();
-  gpr_log(GPR_ERROR, "End of first test");
-  test_fails();
-  GRPC_CLOSURE_INIT(&destroyed, destroy_pollset, g_pollset,
-                    grpc_schedule_on_exec_ctx);
-  grpc_pollset_shutdown(g_pollset, &destroyed);
-
+  {
+    grpc_core::ExecCtx exec_ctx;
+    g_pollset = static_cast<grpc_pollset*>(gpr_malloc(grpc_pollset_size()));
+    grpc_pollset_init(g_pollset, &g_mu);
+
+    test_succeeds();
+    gpr_log(GPR_ERROR, "End of first test");
+    test_fails();
+    GRPC_CLOSURE_INIT(&destroyed, destroy_pollset, g_pollset,
+                      grpc_schedule_on_exec_ctx);
+    grpc_pollset_shutdown(g_pollset, &destroyed);
+    gpr_free(g_pollset);
+  }
   grpc_shutdown();
-  gpr_free(g_pollset);
   return 0;
 }
 

test/core/iomgr/tcp_server_uv_test.cc

@@ -119,6 +119,7 @@ static void test_no_op(void) {
   grpc_tcp_server* s;
   GPR_ASSERT(GRPC_ERROR_NONE == grpc_tcp_server_create(NULL, NULL, &s));
   grpc_tcp_server_unref(s);
+  grpc_core::ExecCtx::Get()->Flush();
 }
 
 static void test_no_op_with_start(void) {
@@ -128,6 +129,7 @@ static void test_no_op_with_start(void) {
   LOG_TEST("test_no_op_with_start");
   grpc_tcp_server_start(s, NULL, 0, on_connect, NULL);
   grpc_tcp_server_unref(s);
+  grpc_core::ExecCtx::Get()->Flush();
 }
 
 static void test_no_op_with_port(void) {
@@ -147,6 +149,7 @@ static void test_no_op_with_port(void) {
              port > 0);
 
   grpc_tcp_server_unref(s);
+  grpc_core::ExecCtx::Get()->Flush();
 }
 
 static void test_no_op_with_port_and_start(void) {
@@ -168,6 +171,7 @@ static void test_no_op_with_port_and_start(void) {
   grpc_tcp_server_start(s, NULL, 0, on_connect, NULL);
 
   grpc_tcp_server_unref(s);
+  grpc_core::ExecCtx::Get()->Flush();
 }
 
 static void connect_cb(uv_connect_t* req, int status) {
@@ -273,7 +277,7 @@ static void test_connect(unsigned n) {
   GPR_ASSERT(weak_ref.server != NULL);
 
   grpc_tcp_server_unref(s);
-
+  grpc_core::ExecCtx::Get()->Flush();
   /* Weak ref lost. */
   GPR_ASSERT(weak_ref.server == NULL);
 }
@@ -284,25 +288,27 @@ static void destroy_pollset(void* p, grpc_error* error) {
 
 int main(int argc, char** argv) {
   grpc_closure destroyed;
-  grpc_core::ExecCtx exec_ctx;
   grpc_test_init(argc, argv);
   grpc_init();
-  g_pollset = static_cast<grpc_pollset*>(gpr_malloc(grpc_pollset_size()));
-  grpc_pollset_init(g_pollset, &g_mu);
-
-  test_no_op();
-  test_no_op_with_start();
-  test_no_op_with_port();
-  test_no_op_with_port_and_start();
-  test_connect(1);
-  test_connect(10);
-
-  GRPC_CLOSURE_INIT(&destroyed, destroy_pollset, g_pollset,
-                    grpc_schedule_on_exec_ctx);
-  grpc_pollset_shutdown(g_pollset, &destroyed);
-
+  {
+    grpc_core::ExecCtx exec_ctx;
+    g_pollset = static_cast<grpc_pollset*>(gpr_malloc(grpc_pollset_size()));
+    grpc_pollset_init(g_pollset, &g_mu);
+
+    test_no_op();
+    test_no_op_with_start();
+    test_no_op_with_port();
+    test_no_op_with_port_and_start();
+    test_connect(1);
+    test_connect(10);
+
+    GRPC_CLOSURE_INIT(&destroyed, destroy_pollset, g_pollset,
+                      grpc_schedule_on_exec_ctx);
+    grpc_pollset_shutdown(g_pollset, &destroyed);
+
+    gpr_free(g_pollset);
+  }
   grpc_shutdown();
-  gpr_free(g_pollset);
   return 0;
 }
 

test/core/security/alts_security_connector_test.cc

@@ -24,7 +24,7 @@
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 
-#include "src/core/lib/security/security_connector/alts_security_connector.h"
+#include "src/core/lib/security/security_connector/alts/alts_security_connector.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/tsi/alts/handshaker/alts_tsi_handshaker.h"
 #include "src/core/tsi/transport_security.h"