Update grpc to 1.43.2 DTCC-864

ref:50a492c335cda70f458797cf945e49fe739c2715

17 files changed, 353 insertions, 376 deletions

diff --git a/contrib/libs/grpc/src/cpp/common/.yandex_meta/licenses.list.txt b/contrib/libs/grpc/src/cpp/common/.yandex_meta/licenses.list.txt
index ed4a3efa9f..b042e4af0c 100644
--- a/contrib/libs/grpc/src/cpp/common/.yandex_meta/licenses.list.txt
+++ b/contrib/libs/grpc/src/cpp/common/.yandex_meta/licenses.list.txt
@@ -39,8 +39,12 @@
 
 
 ====================COPYRIGHT====================
+ * Copyright 2019 gRPC authors.
+
+
+====================COPYRIGHT====================
  * Copyright 2020 gRPC authors.
 
 
 ====================COPYRIGHT====================
-# Copyright 2019 gRPC authors.
+// Copyright 2021 gRPC authors.
diff --git a/contrib/libs/grpc/src/cpp/common/alarm.cc b/contrib/libs/grpc/src/cpp/common/alarm.cc
index ac1b747b49..a367b53d3a 100644
--- a/contrib/libs/grpc/src/cpp/common/alarm.cc
+++ b/contrib/libs/grpc/src/cpp/common/alarm.cc
@@ -15,23 +15,22 @@
  *
  */
 
-#include <grpcpp/alarm.h>
+#include <grpc/support/port_platform.h>
 
 #include <memory>
 
 #include <grpc/support/log.h>
-#include <grpc/support/port_platform.h>
+#include <grpcpp/alarm.h>
 #include <grpcpp/completion_queue.h>
 #include <grpcpp/impl/grpc_library.h>
 #include <grpcpp/support/time.h>
+
+#include "src/core/lib/debug/trace.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/iomgr/executor.h"
 #include "src/core/lib/iomgr/timer.h"
 #include "src/core/lib/surface/completion_queue.h"
 
-#include <grpc/support/log.h>
-#include "src/core/lib/debug/trace.h"
-
 namespace grpc {
 
 namespace internal {
@@ -56,7 +55,7 @@ class AlarmImpl : public ::grpc::internal::CompletionQueueTag {
     GPR_ASSERT(grpc_cq_begin_op(cq_, this));
     GRPC_CLOSURE_INIT(
         &on_alarm_,
-        [](void* arg, grpc_error* error) {
+        [](void* arg, grpc_error_handle error) {
           // queue the op on the completion queue
           AlarmImpl* alarm = static_cast<AlarmImpl*>(arg);
           alarm->Ref();
@@ -82,10 +81,10 @@ class AlarmImpl : public ::grpc::internal::CompletionQueueTag {
     Ref();
     GRPC_CLOSURE_INIT(
         &on_alarm_,
-        [](void* arg, grpc_error* error) {
+        [](void* arg, grpc_error_handle error) {
           grpc_core::Executor::Run(
               GRPC_CLOSURE_CREATE(
-                  [](void* arg, grpc_error* error) {
+                  [](void* arg, grpc_error_handle error) {
                     AlarmImpl* alarm = static_cast<AlarmImpl*>(arg);
                     alarm->callback_(error == GRPC_ERROR_NONE);
                     alarm->Unref();
diff --git a/contrib/libs/grpc/src/cpp/common/auth_property_iterator.cc b/contrib/libs/grpc/src/cpp/common/auth_property_iterator.cc
index 0f380b0950..1334ea9966 100644
--- a/contrib/libs/grpc/src/cpp/common/auth_property_iterator.cc
+++ b/contrib/libs/grpc/src/cpp/common/auth_property_iterator.cc
@@ -16,9 +16,8 @@
  *
  */
 
-#include <grpcpp/security/auth_context.h>
-
 #include <grpc/grpc_security.h>
+#include <grpcpp/security/auth_context.h>
 
 namespace grpc {
 
diff --git a/contrib/libs/grpc/src/cpp/common/channel_arguments.cc b/contrib/libs/grpc/src/cpp/common/channel_arguments.cc
index 5a5dd91b5e..4950a800bb 100644
--- a/contrib/libs/grpc/src/cpp/common/channel_arguments.cc
+++ b/contrib/libs/grpc/src/cpp/common/channel_arguments.cc
@@ -15,14 +15,14 @@
  * limitations under the License.
  *
  */
-#include <grpcpp/support/channel_arguments.h>
-
 #include <sstream>
 
 #include <grpc/impl/codegen/grpc_types.h>
 #include <grpc/support/log.h>
 #include <grpcpp/grpcpp.h>
 #include <grpcpp/resource_quota.h>
+#include <grpcpp/support/channel_arguments.h>
+
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/iomgr/socket_mutator.h"
@@ -66,9 +66,9 @@ ChannelArguments::ChannelArguments(const ChannelArguments& other)
 }
 
 ChannelArguments::~ChannelArguments() {
-  grpc_core::ExecCtx exec_ctx;
   for (auto& arg : args_) {
     if (arg.type == GRPC_ARG_POINTER) {
+      grpc_core::ExecCtx exec_ctx;
       arg.value.pointer.vtable->destroy(arg.value.pointer.p);
     }
   }
diff --git a/contrib/libs/grpc/src/cpp/common/channel_filter.cc b/contrib/libs/grpc/src/cpp/common/channel_filter.cc
index ab56d6073f..373aebf61b 100644
--- a/contrib/libs/grpc/src/cpp/common/channel_filter.cc
+++ b/contrib/libs/grpc/src/cpp/common/channel_filter.cc
@@ -16,13 +16,16 @@
  *
  */
 
-#include <string.h>
-
-#include "src/core/lib/channel/channel_stack.h"
 #include "src/cpp/common/channel_filter.h"
 
+#include <string.h>
+
 #include <grpcpp/impl/codegen/slice.h>
 
+#include "src/core/lib/channel/channel_stack.h"
+#include "src/core/lib/channel/channel_stack_builder.h"
+#include "src/core/lib/config/core_configuration.h"
+
 namespace grpc {
 
 // MetadataBatch
@@ -32,8 +35,7 @@ grpc_linked_mdelem* MetadataBatch::AddMetadata(const string& key,
   grpc_linked_mdelem* storage = new grpc_linked_mdelem;
   storage->md = grpc_mdelem_from_slices(SliceFromCopiedString(key),
                                         SliceFromCopiedString(value));
-  GRPC_LOG_IF_ERROR("MetadataBatch::AddMetadata",
-                    grpc_metadata_batch_link_head(batch_, storage));
+  GRPC_LOG_IF_ERROR("MetadataBatch::AddMetadata", batch_->LinkHead(storage));
   return storage;
 }
 
@@ -61,38 +63,30 @@ void CallData::SetPollsetOrPollsetSet(grpc_call_element* elem,
   grpc_call_stack_ignore_set_pollset_or_pollset_set(elem, pollent);
 }
 
-// internal code used by RegisterChannelFilter()
-
 namespace internal {
 
-// Note: Implicitly initialized to nullptr due to static lifetime.
-std::vector<FilterRecord>* channel_filters;
-
-namespace {
-
-bool MaybeAddFilter(grpc_channel_stack_builder* builder, void* arg) {
-  const FilterRecord& filter = *static_cast<FilterRecord*>(arg);
-  if (filter.include_filter) {
-    const grpc_channel_args* args =
-        grpc_channel_stack_builder_get_channel_arguments(builder);
-    if (!filter.include_filter(*args)) return true;
-  }
-  return grpc_channel_stack_builder_prepend_filter(builder, &filter.filter,
-                                                   nullptr, nullptr);
+void RegisterChannelFilter(
+    grpc_channel_stack_type stack_type, int priority,
+    std::function<bool(const grpc_channel_args&)> include_filter,
+    const grpc_channel_filter* filter) {
+  auto maybe_add_filter = [include_filter,
+                           filter](grpc_channel_stack_builder* builder) {
+    if (include_filter != nullptr) {
+      const grpc_channel_args* args =
+          grpc_channel_stack_builder_get_channel_arguments(builder);
+      if (!include_filter(*args)) return true;
+    }
+    return grpc_channel_stack_builder_prepend_filter(builder, filter, nullptr,
+                                                     nullptr);
+  };
+  grpc_core::CoreConfiguration::RegisterBuilder(
+      [stack_type, priority,
+       maybe_add_filter](grpc_core::CoreConfiguration::Builder* builder) {
+        builder->channel_init()->RegisterStage(stack_type, priority,
+                                               maybe_add_filter);
+      });
 }
 
-}  // namespace
-
-void ChannelFilterPluginInit() {
-  for (size_t i = 0; i < channel_filters->size(); ++i) {
-    FilterRecord& filter = (*channel_filters)[i];
-    grpc_channel_init_register_stage(filter.stack_type, filter.priority,
-                                     MaybeAddFilter, &filter);
-  }
-}
-
-void ChannelFilterPluginShutdown() {}
-
 }  // namespace internal
 
 }  // namespace grpc
diff --git a/contrib/libs/grpc/src/cpp/common/channel_filter.h b/contrib/libs/grpc/src/cpp/common/channel_filter.h
index b16f06bddc..5364895e84 100644
--- a/contrib/libs/grpc/src/cpp/common/channel_filter.h
+++ b/contrib/libs/grpc/src/cpp/common/channel_filter.h
@@ -19,13 +19,13 @@
 #ifndef GRPCXX_CHANNEL_FILTER_H
 #define GRPCXX_CHANNEL_FILTER_H
 
+#include <functional>
+#include <vector>
+
 #include <grpc/grpc.h>
 #include <grpc/support/alloc.h>
 #include <grpcpp/impl/codegen/config.h>
 
-#include <functional>
-#include <vector>
-
 #include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/surface/channel_init.h"
 #include "src/core/lib/transport/metadata_batch.h"
@@ -56,48 +56,6 @@ class MetadataBatch {
   /// lifetime of the gRPC call.
   grpc_linked_mdelem* AddMetadata(const string& key, const string& value);
 
-  class const_iterator : public std::iterator<std::bidirectional_iterator_tag,
-                                              const grpc_mdelem> {
-   public:
-    const grpc_mdelem& operator*() const { return elem_->md; }
-    grpc_mdelem operator->() const { return elem_->md; }
-
-    const_iterator& operator++() {
-      elem_ = elem_->next;
-      return *this;
-    }
-    const_iterator operator++(int) {
-      const_iterator tmp(*this);
-      operator++();
-      return tmp;
-    }
-    const_iterator& operator--() {
-      elem_ = elem_->prev;
-      return *this;
-    }
-    const_iterator operator--(int) {
-      const_iterator tmp(*this);
-      operator--();
-      return tmp;
-    }
-
-    bool operator==(const const_iterator& other) const {
-      return elem_ == other.elem_;
-    }
-    bool operator!=(const const_iterator& other) const {
-      return elem_ != other.elem_;
-    }
-
-   private:
-    friend class MetadataBatch;
-    explicit const_iterator(grpc_linked_mdelem* elem) : elem_(elem) {}
-
-    grpc_linked_mdelem* elem_;
-  };
-
-  const_iterator begin() const { return const_iterator(batch_->list.head); }
-  const_iterator end() const { return const_iterator(nullptr); }
-
  private:
   grpc_metadata_batch* batch_;  // Not owned.
 };
@@ -113,7 +71,7 @@ class TransportOp {
   grpc_transport_op* op() const { return op_; }
 
   // TODO(roth): Add a C++ wrapper for grpc_error?
-  grpc_error* disconnect_with_error() const {
+  grpc_error_handle disconnect_with_error() const {
     return op_->disconnect_with_error;
   }
   bool send_goaway() const { return op_->goaway_error != GRPC_ERROR_NONE; }
@@ -236,8 +194,8 @@ class ChannelData {
   // TODO(roth): Come up with a more C++-like API for the channel element.
 
   /// Initializes the channel data.
-  virtual grpc_error* Init(grpc_channel_element* /*elem*/,
-                           grpc_channel_element_args* /*args*/) {
+  virtual grpc_error_handle Init(grpc_channel_element* /*elem*/,
+                                 grpc_channel_element_args* /*args*/) {
     return GRPC_ERROR_NONE;
   }
 
@@ -259,8 +217,8 @@ class CallData {
   // TODO(roth): Come up with a more C++-like API for the call element.
 
   /// Initializes the call data.
-  virtual grpc_error* Init(grpc_call_element* /*elem*/,
-                           const grpc_call_element_args* /*args*/) {
+  virtual grpc_error_handle Init(grpc_call_element* /*elem*/,
+                                 const grpc_call_element_args* /*args*/) {
     return GRPC_ERROR_NONE;
   }
 
@@ -288,8 +246,8 @@ class ChannelFilter final {
  public:
   static const size_t channel_data_size = sizeof(ChannelDataType);
 
-  static grpc_error* InitChannelElement(grpc_channel_element* elem,
-                                        grpc_channel_element_args* args) {
+  static grpc_error_handle InitChannelElement(grpc_channel_element* elem,
+                                              grpc_channel_element_args* args) {
     // Construct the object in the already-allocated memory.
     ChannelDataType* channel_data = new (elem->channel_data) ChannelDataType();
     return channel_data->Init(elem, args);
@@ -319,8 +277,8 @@ class ChannelFilter final {
 
   static const size_t call_data_size = sizeof(CallDataType);
 
-  static grpc_error* InitCallElement(grpc_call_element* elem,
-                                     const grpc_call_element_args* args) {
+  static grpc_error_handle InitCallElement(grpc_call_element* elem,
+                                           const grpc_call_element_args* args) {
     // Construct the object in the already-allocated memory.
     CallDataType* call_data = new (elem->call_data) CallDataType();
     return call_data->Init(elem, args);
@@ -348,16 +306,10 @@ class ChannelFilter final {
   }
 };
 
-struct FilterRecord {
-  grpc_channel_stack_type stack_type;
-  int priority;
-  std::function<bool(const grpc_channel_args&)> include_filter;
-  grpc_channel_filter filter;
-};
-extern std::vector<FilterRecord>* channel_filters;
-
-void ChannelFilterPluginInit();
-void ChannelFilterPluginShutdown();
+void RegisterChannelFilter(
+    grpc_channel_stack_type stack_type, int priority,
+    std::function<bool(const grpc_channel_args&)> include_filter,
+    const grpc_channel_filter* filter);
 
 }  // namespace internal
 
@@ -375,26 +327,21 @@ template <typename ChannelDataType, typename CallDataType>
 void RegisterChannelFilter(
     const char* name, grpc_channel_stack_type stack_type, int priority,
     std::function<bool(const grpc_channel_args&)> include_filter) {
-  // If we haven't been called before, initialize channel_filters and
-  // call grpc_register_plugin().
-  if (internal::channel_filters == nullptr) {
-    grpc_register_plugin(internal::ChannelFilterPluginInit,
-                         internal::ChannelFilterPluginShutdown);
-    internal::channel_filters = new std::vector<internal::FilterRecord>();
-  }
-  // Add an entry to channel_filters. The filter will be added when the
-  // C-core initialization code calls ChannelFilterPluginInit().
-  typedef internal::ChannelFilter<ChannelDataType, CallDataType> FilterType;
-  internal::FilterRecord filter_record = {
-      stack_type,
-      priority,
-      include_filter,
-      {FilterType::StartTransportStreamOpBatch, FilterType::StartTransportOp,
-       FilterType::call_data_size, FilterType::InitCallElement,
-       FilterType::SetPollsetOrPollsetSet, FilterType::DestroyCallElement,
-       FilterType::channel_data_size, FilterType::InitChannelElement,
-       FilterType::DestroyChannelElement, FilterType::GetChannelInfo, name}};
-  internal::channel_filters->push_back(filter_record);
+  using FilterType = internal::ChannelFilter<ChannelDataType, CallDataType>;
+  static const grpc_channel_filter filter = {
+      FilterType::StartTransportStreamOpBatch,
+      FilterType::StartTransportOp,
+      FilterType::call_data_size,
+      FilterType::InitCallElement,
+      FilterType::SetPollsetOrPollsetSet,
+      FilterType::DestroyCallElement,
+      FilterType::channel_data_size,
+      FilterType::InitChannelElement,
+      FilterType::DestroyChannelElement,
+      FilterType::GetChannelInfo,
+      name};
+  grpc::internal::RegisterChannelFilter(stack_type, priority,
+                                        std::move(include_filter), &filter);
 }
 
 }  // namespace grpc
diff --git a/contrib/libs/grpc/src/cpp/common/completion_queue_cc.cc b/contrib/libs/grpc/src/cpp/common/completion_queue_cc.cc
index 6774559074..f4834214d0 100644
--- a/contrib/libs/grpc/src/cpp/common/completion_queue_cc.cc
+++ b/contrib/libs/grpc/src/cpp/common/completion_queue_cc.cc
@@ -15,13 +15,12 @@
  *
  */
 
-#include <grpcpp/completion_queue.h>
-
 #include <memory>
 
 #include <grpc/grpc.h>
 #include <grpc/support/cpu.h>
 #include <grpc/support/log.h>
+#include <grpcpp/completion_queue.h>
 #include <grpcpp/impl/grpc_library.h>
 #include <grpcpp/support/time.h>
 
@@ -53,7 +52,8 @@ struct CallbackAlternativeCQ {
     refs++;
     if (refs == 1) {
       cq = new CompletionQueue;
-      int num_nexting_threads = GPR_CLAMP(gpr_cpu_num_cores() / 2, 2, 16);
+      int num_nexting_threads =
+          grpc_core::Clamp(gpr_cpu_num_cores() / 2, 2u, 16u);
       nexting_threads = new std::vector<grpc_core::Thread>;
       for (int i = 0; i < num_nexting_threads; i++) {
         nexting_threads->emplace_back(
@@ -89,8 +89,7 @@ struct CallbackAlternativeCQ {
                 // hold any application locks before executing the callback,
                 // and cannot be entered recursively.
                 auto* functor =
-                    static_cast<grpc_experimental_completion_queue_functor*>(
-                        ev.tag);
+                    static_cast<grpc_completion_queue_functor*>(ev.tag);
                 functor->functor_run(functor, ev.success);
               }
             },
diff --git a/contrib/libs/grpc/src/cpp/common/core_codegen.cc b/contrib/libs/grpc/src/cpp/common/core_codegen.cc
index 75383ed511..da964f6662 100644
--- a/contrib/libs/grpc/src/cpp/common/core_codegen.cc
+++ b/contrib/libs/grpc/src/cpp/common/core_codegen.cc
@@ -16,7 +16,7 @@
  *
  */
 
-#include <grpcpp/impl/codegen/core_codegen.h>
+#include <grpc/support/port_platform.h>
 
 #include <stdlib.h>
 
@@ -27,8 +27,8 @@
 #include <grpc/slice_buffer.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
-#include <grpc/support/port_platform.h>
 #include <grpc/support/sync.h>
+#include <grpcpp/impl/codegen/core_codegen.h>
 #include <grpcpp/support/config.h>
 
 #include "src/core/lib/profiling/timers.h"
@@ -118,6 +118,10 @@ grpc_call_error CoreCodegen::grpc_call_cancel_with_status(
     void* reserved) {
   return ::grpc_call_cancel_with_status(call, status, description, reserved);
 }
+
+int CoreCodegen::grpc_call_failed_before_recv_message(const grpc_call* c) {
+  return ::grpc_call_failed_before_recv_message(c);
+}
 void CoreCodegen::grpc_call_ref(grpc_call* call) { ::grpc_call_ref(call); }
 void CoreCodegen::grpc_call_unref(grpc_call* call) { ::grpc_call_unref(call); }
 void* CoreCodegen::grpc_call_arena_alloc(grpc_call* call, size_t length) {
diff --git a/contrib/libs/grpc/src/cpp/common/secure_channel_arguments.cc b/contrib/libs/grpc/src/cpp/common/secure_channel_arguments.cc
index 844bc627ab..c9b1d4ab3b 100644
--- a/contrib/libs/grpc/src/cpp/common/secure_channel_arguments.cc
+++ b/contrib/libs/grpc/src/cpp/common/secure_channel_arguments.cc
@@ -16,9 +16,9 @@
  *
  */
 
+#include <grpc/grpc_security.h>
 #include <grpcpp/support/channel_arguments.h>
 
-#include <grpc/grpc_security.h>
 #include "src/core/lib/channel/channel_args.h"
 
 namespace grpc {
diff --git a/contrib/libs/grpc/src/cpp/common/secure_create_auth_context.cc b/contrib/libs/grpc/src/cpp/common/secure_create_auth_context.cc
index 908c46629e..6633374b65 100644
--- a/contrib/libs/grpc/src/cpp/common/secure_create_auth_context.cc
+++ b/contrib/libs/grpc/src/cpp/common/secure_create_auth_context.cc
@@ -20,6 +20,7 @@
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpcpp/security/auth_context.h>
+
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/cpp/common/secure_auth_context.h"
 
diff --git a/contrib/libs/grpc/src/cpp/common/tls_certificate_provider.cc b/contrib/libs/grpc/src/cpp/common/tls_certificate_provider.cc
index 8e99b571a1..073abae7d5 100644
--- a/contrib/libs/grpc/src/cpp/common/tls_certificate_provider.cc
+++ b/contrib/libs/grpc/src/cpp/common/tls_certificate_provider.cc
@@ -14,12 +14,12 @@
 // limitations under the License.
 //
 
+#include "y_absl/container/inlined_vector.h"
+
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpcpp/security/tls_certificate_provider.h>
 
-#include "y_absl/container/inlined_vector.h"
-
 namespace grpc {
 namespace experimental {
 
diff --git a/contrib/libs/grpc/src/cpp/common/tls_certificate_verifier.cc b/contrib/libs/grpc/src/cpp/common/tls_certificate_verifier.cc
new file mode 100644
index 0000000000..7e51934e01
--- /dev/null
+++ b/contrib/libs/grpc/src/cpp/common/tls_certificate_verifier.cc
@@ -0,0 +1,244 @@
+//
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "y_absl/container/inlined_vector.h"
+#include "y_absl/status/status.h"
+
+#include <grpc/grpc_security.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/string_util.h>
+#include <grpcpp/security/tls_certificate_verifier.h>
+
+namespace grpc {
+namespace experimental {
+
+static internal::GrpcLibraryInitializer g_gli_initializer;
+
+TlsCustomVerificationCheckRequest::TlsCustomVerificationCheckRequest(
+    grpc_tls_custom_verification_check_request* request)
+    : c_request_(request) {
+  GPR_ASSERT(c_request_ != nullptr);
+}
+
+grpc::string_ref TlsCustomVerificationCheckRequest::target_name() const {
+  return c_request_->target_name != nullptr ? c_request_->target_name : "";
+}
+
+grpc::string_ref TlsCustomVerificationCheckRequest::peer_cert() const {
+  return c_request_->peer_info.peer_cert != nullptr
+             ? c_request_->peer_info.peer_cert
+             : "";
+}
+
+grpc::string_ref TlsCustomVerificationCheckRequest::peer_cert_full_chain()
+    const {
+  return c_request_->peer_info.peer_cert_full_chain != nullptr
+             ? c_request_->peer_info.peer_cert_full_chain
+             : "";
+}
+
+grpc::string_ref TlsCustomVerificationCheckRequest::common_name() const {
+  return c_request_->peer_info.common_name != nullptr
+             ? c_request_->peer_info.common_name
+             : "";
+}
+
+std::vector<grpc::string_ref> TlsCustomVerificationCheckRequest::uri_names()
+    const {
+  std::vector<grpc::string_ref> uri_names;
+  for (size_t i = 0; i < c_request_->peer_info.san_names.uri_names_size; ++i) {
+    uri_names.emplace_back(c_request_->peer_info.san_names.uri_names[i]);
+  }
+  return uri_names;
+}
+
+std::vector<grpc::string_ref> TlsCustomVerificationCheckRequest::dns_names()
+    const {
+  std::vector<grpc::string_ref> dns_names;
+  for (size_t i = 0; i < c_request_->peer_info.san_names.dns_names_size; ++i) {
+    dns_names.emplace_back(c_request_->peer_info.san_names.dns_names[i]);
+  }
+  return dns_names;
+}
+
+std::vector<grpc::string_ref> TlsCustomVerificationCheckRequest::email_names()
+    const {
+  std::vector<grpc::string_ref> email_names;
+  for (size_t i = 0; i < c_request_->peer_info.san_names.email_names_size;
+       ++i) {
+    email_names.emplace_back(c_request_->peer_info.san_names.email_names[i]);
+  }
+  return email_names;
+}
+
+std::vector<grpc::string_ref> TlsCustomVerificationCheckRequest::ip_names()
+    const {
+  std::vector<grpc::string_ref> ip_names;
+  for (size_t i = 0; i < c_request_->peer_info.san_names.ip_names_size; ++i) {
+    ip_names.emplace_back(c_request_->peer_info.san_names.ip_names[i]);
+  }
+  return ip_names;
+}
+
+CertificateVerifier::CertificateVerifier(grpc_tls_certificate_verifier* v)
+    : verifier_(v) {
+  g_gli_initializer.summon();
+}
+
+CertificateVerifier::~CertificateVerifier() {
+  grpc_tls_certificate_verifier_release(verifier_);
+}
+
+bool CertificateVerifier::Verify(TlsCustomVerificationCheckRequest* request,
+                                 std::function<void(grpc::Status)> callback,
+                                 grpc::Status* sync_status) {
+  GPR_ASSERT(request != nullptr);
+  GPR_ASSERT(request->c_request() != nullptr);
+  {
+    internal::MutexLock lock(&mu_);
+    request_map_.emplace(request->c_request(), std::move(callback));
+  }
+  grpc_status_code status_code = GRPC_STATUS_OK;
+  char* error_details = nullptr;
+  bool is_done = grpc_tls_certificate_verifier_verify(
+      verifier_, request->c_request(), &AsyncCheckDone, this, &status_code,
+      &error_details);
+  if (is_done) {
+    if (status_code != GRPC_STATUS_OK) {
+      *sync_status = grpc::Status(static_cast<grpc::StatusCode>(status_code),
+                                  error_details);
+    }
+    internal::MutexLock lock(&mu_);
+    request_map_.erase(request->c_request());
+  }
+  gpr_free(error_details);
+  return is_done;
+}
+
+void CertificateVerifier::Cancel(TlsCustomVerificationCheckRequest* request) {
+  GPR_ASSERT(request != nullptr);
+  GPR_ASSERT(request->c_request() != nullptr);
+  grpc_tls_certificate_verifier_cancel(verifier_, request->c_request());
+}
+
+void CertificateVerifier::AsyncCheckDone(
+    grpc_tls_custom_verification_check_request* request, void* callback_arg,
+    grpc_status_code status, const char* error_details) {
+  auto* self = static_cast<CertificateVerifier*>(callback_arg);
+  std::function<void(grpc::Status)> callback;
+  {
+    internal::MutexLock lock(&self->mu_);
+    auto it = self->request_map_.find(request);
+    if (it != self->request_map_.end()) {
+      callback = std::move(it->second);
+      self->request_map_.erase(it);
+    }
+  }
+  if (callback != nullptr) {
+    grpc::Status return_status;
+    if (status != GRPC_STATUS_OK) {
+      return_status =
+          grpc::Status(static_cast<grpc::StatusCode>(status), error_details);
+    }
+    callback(return_status);
+  }
+}
+
+ExternalCertificateVerifier::ExternalCertificateVerifier() {
+  base_ = new grpc_tls_certificate_verifier_external();
+  base_->user_data = this;
+  base_->verify = VerifyInCoreExternalVerifier;
+  base_->cancel = CancelInCoreExternalVerifier;
+  base_->destruct = DestructInCoreExternalVerifier;
+}
+
+ExternalCertificateVerifier::~ExternalCertificateVerifier() { delete base_; }
+
+int ExternalCertificateVerifier::VerifyInCoreExternalVerifier(
+    void* user_data, grpc_tls_custom_verification_check_request* request,
+    grpc_tls_on_custom_verification_check_done_cb callback, void* callback_arg,
+    grpc_status_code* sync_status, char** sync_error_details) {
+  auto* self = static_cast<ExternalCertificateVerifier*>(user_data);
+  TlsCustomVerificationCheckRequest* cpp_request = nullptr;
+  {
+    internal::MutexLock lock(&self->mu_);
+    auto pair = self->request_map_.emplace(
+        request, AsyncRequestState(callback, callback_arg, request));
+    GPR_ASSERT(pair.second);
+    cpp_request = &pair.first->second.cpp_request;
+  }
+  grpc::Status sync_current_verifier_status;
+  bool is_done = self->Verify(
+      cpp_request,
+      [self, request](grpc::Status status) {
+        grpc_tls_on_custom_verification_check_done_cb callback = nullptr;
+        void* callback_arg = nullptr;
+        {
+          internal::MutexLock lock(&self->mu_);
+          auto it = self->request_map_.find(request);
+          if (it != self->request_map_.end()) {
+            callback = it->second.callback;
+            callback_arg = it->second.callback_arg;
+            self->request_map_.erase(it);
+          }
+        }
+        if (callback != nullptr) {
+          callback(request, callback_arg,
+                   static_cast<grpc_status_code>(status.error_code()),
+                   status.error_message().c_str());
+        }
+      },
+      &sync_current_verifier_status);
+  if (is_done) {
+    if (!sync_current_verifier_status.ok()) {
+      *sync_status = static_cast<grpc_status_code>(
+          sync_current_verifier_status.error_code());
+      *sync_error_details =
+          gpr_strdup(sync_current_verifier_status.error_message().c_str());
+    }
+    internal::MutexLock lock(&self->mu_);
+    self->request_map_.erase(request);
+  }
+  return is_done;
+}
+
+void ExternalCertificateVerifier::CancelInCoreExternalVerifier(
+    void* user_data, grpc_tls_custom_verification_check_request* request) {
+  auto* self = static_cast<ExternalCertificateVerifier*>(user_data);
+  TlsCustomVerificationCheckRequest* cpp_request = nullptr;
+  {
+    internal::MutexLock lock(&self->mu_);
+    auto it = self->request_map_.find(request);
+    if (it != self->request_map_.end()) {
+      cpp_request = &it->second.cpp_request;
+    }
+  }
+  if (cpp_request != nullptr) {
+    self->Cancel(cpp_request);
+  }
+}
+
+void ExternalCertificateVerifier::DestructInCoreExternalVerifier(
+    void* user_data) {
+  auto* self = static_cast<ExternalCertificateVerifier*>(user_data);
+  delete self;
+}
+
+HostNameCertificateVerifier::HostNameCertificateVerifier()
+    : CertificateVerifier(grpc_tls_certificate_verifier_host_name_create()) {}
+
+}  // namespace experimental
+}  // namespace grpc
diff --git a/contrib/libs/grpc/src/cpp/common/tls_credentials_options.cc b/contrib/libs/grpc/src/cpp/common/tls_credentials_options.cc
index d612bd062e..e669f600b5 100644
--- a/contrib/libs/grpc/src/cpp/common/tls_credentials_options.cc
+++ b/contrib/libs/grpc/src/cpp/common/tls_credentials_options.cc
@@ -16,114 +16,15 @@
  *
  */
 
+#include "y_absl/container/inlined_vector.h"
+
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpcpp/security/tls_credentials_options.h>
 
-#include "y_absl/container/inlined_vector.h"
-#include "src/cpp/common/tls_credentials_options_util.h"
-
 namespace grpc {
 namespace experimental {
 
-/** gRPC TLS server authorization check arg API implementation **/
-TlsServerAuthorizationCheckArg::TlsServerAuthorizationCheckArg(
-    grpc_tls_server_authorization_check_arg* arg)
-    : c_arg_(arg) {
-  GPR_ASSERT(c_arg_ != nullptr);
-  if (c_arg_->context != nullptr) {
-    gpr_log(GPR_ERROR, "c_arg context has already been set");
-  }
-  c_arg_->context = static_cast<void*>(this);
-  c_arg_->destroy_context = &TlsServerAuthorizationCheckArgDestroyContext;
-}
-
-TlsServerAuthorizationCheckArg::~TlsServerAuthorizationCheckArg() {}
-
-void* TlsServerAuthorizationCheckArg::cb_user_data() const {
-  return c_arg_->cb_user_data;
-}
-
-int TlsServerAuthorizationCheckArg::success() const { return c_arg_->success; }
-
-TString TlsServerAuthorizationCheckArg::target_name() const {
-  TString cpp_target_name(c_arg_->target_name);
-  return cpp_target_name;
-}
-
-TString TlsServerAuthorizationCheckArg::peer_cert() const {
-  TString cpp_peer_cert(c_arg_->peer_cert);
-  return cpp_peer_cert;
-}
-
-TString TlsServerAuthorizationCheckArg::peer_cert_full_chain() const {
-  TString cpp_peer_cert_full_chain(c_arg_->peer_cert_full_chain);
-  return cpp_peer_cert_full_chain;
-}
-
-grpc_status_code TlsServerAuthorizationCheckArg::status() const {
-  return c_arg_->status;
-}
-
-TString TlsServerAuthorizationCheckArg::error_details() const {
-  return c_arg_->error_details->error_details();
-}
-
-void TlsServerAuthorizationCheckArg::set_cb_user_data(void* cb_user_data) {
-  c_arg_->cb_user_data = cb_user_data;
-}
-
-void TlsServerAuthorizationCheckArg::set_success(int success) {
-  c_arg_->success = success;
-}
-
-void TlsServerAuthorizationCheckArg::set_target_name(
-    const TString& target_name) {
-  c_arg_->target_name = gpr_strdup(target_name.c_str());
-}
-
-void TlsServerAuthorizationCheckArg::set_peer_cert(
-    const TString& peer_cert) {
-  c_arg_->peer_cert = gpr_strdup(peer_cert.c_str());
-}
-
-void TlsServerAuthorizationCheckArg::set_peer_cert_full_chain(
-    const TString& peer_cert_full_chain) {
-  c_arg_->peer_cert_full_chain = gpr_strdup(peer_cert_full_chain.c_str());
-}
-
-void TlsServerAuthorizationCheckArg::set_status(grpc_status_code status) {
-  c_arg_->status = status;
-}
-
-void TlsServerAuthorizationCheckArg::set_error_details(
-    const TString& error_details) {
-  c_arg_->error_details->set_error_details(error_details.c_str());
-}
-
-void TlsServerAuthorizationCheckArg::OnServerAuthorizationCheckDoneCallback() {
-  if (c_arg_->cb == nullptr) {
-    gpr_log(GPR_ERROR, "server authorizaton check arg callback API is nullptr");
-    return;
-  }
-  c_arg_->cb(c_arg_);
-}
-
-TlsServerAuthorizationCheckConfig::TlsServerAuthorizationCheckConfig(
-    std::shared_ptr<TlsServerAuthorizationCheckInterface>
-        server_authorization_check_interface)
-    : server_authorization_check_interface_(
-          std::move(server_authorization_check_interface)) {
-  c_config_ = grpc_tls_server_authorization_check_config_create(
-      nullptr, &TlsServerAuthorizationCheckConfigCSchedule,
-      &TlsServerAuthorizationCheckConfigCCancel, nullptr);
-  c_config_->set_context(static_cast<void*>(this));
-}
-
-TlsServerAuthorizationCheckConfig::~TlsServerAuthorizationCheckConfig() {
-  grpc_tls_server_authorization_check_config_release(c_config_);
-}
-
 TlsCredentialsOptions::TlsCredentialsOptions() {
   c_credentials_options_ = grpc_tls_credentials_options_create();
 }
@@ -158,22 +59,27 @@ void TlsCredentialsOptions::set_identity_cert_name(
       c_credentials_options_, identity_cert_name.c_str());
 }
 
-void TlsChannelCredentialsOptions::set_server_verification_option(
-    grpc_tls_server_verification_option server_verification_option) {
+void TlsCredentialsOptions::set_certificate_verifier(
+    std::shared_ptr<CertificateVerifier> certificate_verifier) {
+  certificate_verifier_ = std::move(certificate_verifier);
+  if (certificate_verifier_ != nullptr) {
+    grpc_tls_credentials_options_set_certificate_verifier(
+        c_credentials_options_, certificate_verifier_->c_verifier());
+  }
+}
+
+void TlsCredentialsOptions::set_check_call_host(bool check_call_host) {
   grpc_tls_credentials_options* options = c_credentials_options();
   GPR_ASSERT(options != nullptr);
-  grpc_tls_credentials_options_set_server_verification_option(
-      options, server_verification_option);
+  grpc_tls_credentials_options_set_check_call_host(options, check_call_host);
 }
 
-void TlsChannelCredentialsOptions::set_server_authorization_check_config(
-    std::shared_ptr<TlsServerAuthorizationCheckConfig> config) {
+void TlsChannelCredentialsOptions::set_verify_server_certs(
+    bool verify_server_certs) {
   grpc_tls_credentials_options* options = c_credentials_options();
   GPR_ASSERT(options != nullptr);
-  if (config != nullptr) {
-    grpc_tls_credentials_options_set_server_authorization_check_config(
-        options, config->c_config());
-  }
+  grpc_tls_credentials_options_set_verify_server_cert(options,
+                                                      verify_server_certs);
 }
 
 void TlsServerCredentialsOptions::set_cert_request_type(
diff --git a/contrib/libs/grpc/src/cpp/common/tls_credentials_options_util.cc b/contrib/libs/grpc/src/cpp/common/tls_credentials_options_util.cc
deleted file mode 100644
index 920f897bd7..0000000000
--- a/contrib/libs/grpc/src/cpp/common/tls_credentials_options_util.cc
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- *
- * Copyright 2019 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#include "y_absl/container/inlined_vector.h"
-
-#include <grpcpp/security/tls_credentials_options.h>
-
-#include "src/cpp/common/tls_credentials_options_util.h"
-
-namespace grpc {
-namespace experimental {
-
-/** The C schedule and cancel functions for the server authorization check
- * config. They populate a C server authorization check arg with the result
- * of a C++ server authorization check schedule/cancel API. **/
-int TlsServerAuthorizationCheckConfigCSchedule(
-    void* /*config_user_data*/, grpc_tls_server_authorization_check_arg* arg) {
-  if (arg == nullptr || arg->config == nullptr ||
-      arg->config->context() == nullptr) {
-    gpr_log(GPR_ERROR,
-            "server authorization check arg was not properly initialized");
-    return 1;
-  }
-  TlsServerAuthorizationCheckConfig* cpp_config =
-      static_cast<TlsServerAuthorizationCheckConfig*>(arg->config->context());
-  TlsServerAuthorizationCheckArg* cpp_arg =
-      new TlsServerAuthorizationCheckArg(arg);
-  int schedule_result = cpp_config->Schedule(cpp_arg);
-  return schedule_result;
-}
-
-void TlsServerAuthorizationCheckConfigCCancel(
-    void* /*config_user_data*/, grpc_tls_server_authorization_check_arg* arg) {
-  if (arg == nullptr || arg->config == nullptr ||
-      arg->config->context() == nullptr) {
-    gpr_log(GPR_ERROR,
-            "server authorization check arg was not properly initialized");
-    return;
-  }
-  if (arg->context == nullptr) {
-    gpr_log(GPR_ERROR,
-            "server authorization check arg schedule has already completed");
-    return;
-  }
-  TlsServerAuthorizationCheckConfig* cpp_config =
-      static_cast<TlsServerAuthorizationCheckConfig*>(arg->config->context());
-  TlsServerAuthorizationCheckArg* cpp_arg =
-      static_cast<TlsServerAuthorizationCheckArg*>(arg->context);
-  cpp_config->Cancel(cpp_arg);
-}
-
-void TlsServerAuthorizationCheckArgDestroyContext(void* context) {
-  if (context != nullptr) {
-    TlsServerAuthorizationCheckArg* cpp_arg =
-        static_cast<TlsServerAuthorizationCheckArg*>(context);
-    delete cpp_arg;
-  }
-}
-
-}  // namespace experimental
-}  // namespace grpc
diff --git a/contrib/libs/grpc/src/cpp/common/tls_credentials_options_util.h b/contrib/libs/grpc/src/cpp/common/tls_credentials_options_util.h
deleted file mode 100644
index d6247219fb..0000000000
--- a/contrib/libs/grpc/src/cpp/common/tls_credentials_options_util.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- *
- * Copyright 2019 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#ifndef GRPC_INTERNAL_CPP_COMMON_TLS_CREDENTIALS_OPTIONS_UTIL_H
-#define GRPC_INTERNAL_CPP_COMMON_TLS_CREDENTIALS_OPTIONS_UTIL_H
-
-#include <grpc/grpc_security.h>
-#include <grpcpp/security/tls_credentials_options.h>
-
-#include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
-
-namespace grpc {
-namespace experimental {
-
-/** The following 2 functions convert the user-provided schedule or cancel
- *  functions into C style schedule or cancel functions. These are internal
- *  functions, not meant to be accessed by the user. **/
-int TlsServerAuthorizationCheckConfigCSchedule(
-    void* config_user_data, grpc_tls_server_authorization_check_arg* arg);
-
-void TlsServerAuthorizationCheckConfigCCancel(
-    void* config_user_data, grpc_tls_server_authorization_check_arg* arg);
-
-void TlsServerAuthorizationCheckArgDestroyContext(void* context);
-
-}  //  namespace experimental
-}  // namespace grpc
-
-#endif  // GRPC_INTERNAL_CPP_COMMON_TLS_CREDENTIALS_OPTIONS_UTIL_H
diff --git a/contrib/libs/grpc/src/cpp/common/validate_service_config.cc b/contrib/libs/grpc/src/cpp/common/validate_service_config.cc
index f63cfbc68c..fa0c393792 100644
--- a/contrib/libs/grpc/src/cpp/common/validate_service_config.cc
+++ b/contrib/libs/grpc/src/cpp/common/validate_service_config.cc
@@ -19,18 +19,18 @@
 #include <grpc/grpc.h>
 #include <grpcpp/support/validate_service_config.h>
 
-#include "src/core/ext/filters/client_channel/service_config.h"
+#include "src/core/ext/service_config/service_config.h"
 
 namespace grpc {
 namespace experimental {
 TString ValidateServiceConfigJSON(const TString& service_config_json) {
   grpc_init();
-  grpc_error* error = GRPC_ERROR_NONE;
+  grpc_error_handle error = GRPC_ERROR_NONE;
   grpc_core::ServiceConfig::Create(/*args=*/nullptr,
                                    service_config_json.c_str(), &error);
   TString return_value;
   if (error != GRPC_ERROR_NONE) {
-    return_value = grpc_error_string(error);
+    return_value = grpc_error_std_string(error);
     GRPC_ERROR_UNREF(error);
   }
   grpc_shutdown();
diff --git a/contrib/libs/grpc/src/cpp/common/version_cc.cc b/contrib/libs/grpc/src/cpp/common/version_cc.cc
index cb9895b58f..8054bda78b 100644
--- a/contrib/libs/grpc/src/cpp/common/version_cc.cc
+++ b/contrib/libs/grpc/src/cpp/common/version_cc.cc
@@ -22,5 +22,5 @@
 #include <grpcpp/grpcpp.h>
 
 namespace grpc {
-TString Version() { return "1.37.1"; }
+TString Version() { return "1.43.2"; }
 }  // namespace grpc