Merge remote-tracking branch 'upstream/master'

26 files changed, 552 insertions, 276 deletions

diff --git a/.gitignore b/.gitignore
index 3cae07ed12..bf57027c94 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,6 @@ gens
 libs
 objs
 *.pyc
+
+# cache for run_tests.py
+.run_tests_cache
diff --git a/Makefile b/Makefile
index 85201c0eb6..87f6719bd7 100644
--- a/Makefile
+++ b/Makefile
@@ -495,18 +495,20 @@ run_dep_checks:
 	$(ZLIB_CHECK_CMD) || true
 
 libs/$(CONFIG)/zlib/libz.a:
-	(cd third_party/zlib ; CC="$(CC)" CFLAGS="-fPIC -fvisibility=hidden $(CPPFLAGS_$(CONFIG))" ./configure --static)
-	$(MAKE) -C third_party/zlib clean
-	$(MAKE) -C third_party/zlib
-	mkdir -p libs/$(CONFIG)/zlib
-	cp third_party/zlib/libz.a libs/$(CONFIG)/zlib
+	$(E) "[MAKE]    Building zlib"
+	$(Q)(cd third_party/zlib ; CC="$(CC)" CFLAGS="-fPIC -fvisibility=hidden $(CPPFLAGS_$(CONFIG))" ./configure --static)
+	$(Q)$(MAKE) -C third_party/zlib clean
+	$(Q)$(MAKE) -C third_party/zlib
+	$(Q)mkdir -p libs/$(CONFIG)/zlib
+	$(Q)cp third_party/zlib/libz.a libs/$(CONFIG)/zlib
 
 libs/$(CONFIG)/openssl/libssl.a:
-	(cd third_party/openssl ; CC="$(CC) -fPIC -fvisibility=hidden $(CPPFLAGS_$(CONFIG)) $(OPENSSL_CFLAGS_$(CONFIG))" ./config $(OPENSSL_CONFIG_$(CONFIG)))
-	$(MAKE) -C third_party/openssl clean
-	$(MAKE) -C third_party/openssl build_crypto build_ssl
-	mkdir -p libs/$(CONFIG)/openssl
-	cp third_party/openssl/libssl.a third_party/openssl/libcrypto.a libs/$(CONFIG)/openssl
+	$(E) "[MAKE]    Building openssl"
+	$(Q)(cd third_party/openssl ; CC="$(CC) -fPIC -fvisibility=hidden $(CPPFLAGS_$(CONFIG)) $(OPENSSL_CFLAGS_$(CONFIG))" ./config $(OPENSSL_CONFIG_$(CONFIG)))
+	$(Q)$(MAKE) -C third_party/openssl clean
+	$(Q)$(MAKE) -C third_party/openssl build_crypto build_ssl
+	$(Q)mkdir -p libs/$(CONFIG)/openssl
+	$(Q)cp third_party/openssl/libssl.a third_party/openssl/libcrypto.a libs/$(CONFIG)/openssl
 
 static: static_c static_cxx
 
@@ -1347,6 +1349,101 @@ endif
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+src/core/security/auth.c: $(OPENSSL_DEP)
+src/core/security/base64.c: $(OPENSSL_DEP)
+src/core/security/credentials.c: $(OPENSSL_DEP)
+src/core/security/factories.c: $(OPENSSL_DEP)
+src/core/security/google_root_certs.c: $(OPENSSL_DEP)
+src/core/security/json_token.c: $(OPENSSL_DEP)
+src/core/security/secure_endpoint.c: $(OPENSSL_DEP)
+src/core/security/secure_transport_setup.c: $(OPENSSL_DEP)
+src/core/security/security_context.c: $(OPENSSL_DEP)
+src/core/security/server_secure_chttp2.c: $(OPENSSL_DEP)
+src/core/tsi/fake_transport_security.c: $(OPENSSL_DEP)
+src/core/tsi/ssl_transport_security.c: $(OPENSSL_DEP)
+src/core/tsi/transport_security.c: $(OPENSSL_DEP)
+src/core/channel/call_op_string.c: $(OPENSSL_DEP)
+src/core/channel/census_filter.c: $(OPENSSL_DEP)
+src/core/channel/channel_args.c: $(OPENSSL_DEP)
+src/core/channel/channel_stack.c: $(OPENSSL_DEP)
+src/core/channel/child_channel.c: $(OPENSSL_DEP)
+src/core/channel/client_channel.c: $(OPENSSL_DEP)
+src/core/channel/client_setup.c: $(OPENSSL_DEP)
+src/core/channel/connected_channel.c: $(OPENSSL_DEP)
+src/core/channel/http_client_filter.c: $(OPENSSL_DEP)
+src/core/channel/http_filter.c: $(OPENSSL_DEP)
+src/core/channel/http_server_filter.c: $(OPENSSL_DEP)
+src/core/channel/metadata_buffer.c: $(OPENSSL_DEP)
+src/core/channel/noop_filter.c: $(OPENSSL_DEP)
+src/core/compression/algorithm.c: $(OPENSSL_DEP)
+src/core/compression/message_compress.c: $(OPENSSL_DEP)
+src/core/httpcli/format_request.c: $(OPENSSL_DEP)
+src/core/httpcli/httpcli.c: $(OPENSSL_DEP)
+src/core/httpcli/httpcli_security_context.c: $(OPENSSL_DEP)
+src/core/httpcli/parser.c: $(OPENSSL_DEP)
+src/core/iomgr/alarm.c: $(OPENSSL_DEP)
+src/core/iomgr/alarm_heap.c: $(OPENSSL_DEP)
+src/core/iomgr/endpoint.c: $(OPENSSL_DEP)
+src/core/iomgr/endpoint_pair_posix.c: $(OPENSSL_DEP)
+src/core/iomgr/fd_posix.c: $(OPENSSL_DEP)
+src/core/iomgr/iomgr.c: $(OPENSSL_DEP)
+src/core/iomgr/iomgr_posix.c: $(OPENSSL_DEP)
+src/core/iomgr/pollset_multipoller_with_poll_posix.c: $(OPENSSL_DEP)
+src/core/iomgr/pollset_posix.c: $(OPENSSL_DEP)
+src/core/iomgr/resolve_address_posix.c: $(OPENSSL_DEP)
+src/core/iomgr/sockaddr_utils.c: $(OPENSSL_DEP)
+src/core/iomgr/socket_utils_common_posix.c: $(OPENSSL_DEP)
+src/core/iomgr/socket_utils_linux.c: $(OPENSSL_DEP)
+src/core/iomgr/socket_utils_posix.c: $(OPENSSL_DEP)
+src/core/iomgr/tcp_client_posix.c: $(OPENSSL_DEP)
+src/core/iomgr/tcp_posix.c: $(OPENSSL_DEP)
+src/core/iomgr/tcp_server_posix.c: $(OPENSSL_DEP)
+src/core/iomgr/time_averaged_stats.c: $(OPENSSL_DEP)
+src/core/statistics/census_init.c: $(OPENSSL_DEP)
+src/core/statistics/census_log.c: $(OPENSSL_DEP)
+src/core/statistics/census_rpc_stats.c: $(OPENSSL_DEP)
+src/core/statistics/census_tracing.c: $(OPENSSL_DEP)
+src/core/statistics/hash_table.c: $(OPENSSL_DEP)
+src/core/statistics/window_stats.c: $(OPENSSL_DEP)
+src/core/surface/byte_buffer.c: $(OPENSSL_DEP)
+src/core/surface/byte_buffer_reader.c: $(OPENSSL_DEP)
+src/core/surface/call.c: $(OPENSSL_DEP)
+src/core/surface/channel.c: $(OPENSSL_DEP)
+src/core/surface/channel_create.c: $(OPENSSL_DEP)
+src/core/surface/client.c: $(OPENSSL_DEP)
+src/core/surface/completion_queue.c: $(OPENSSL_DEP)
+src/core/surface/event_string.c: $(OPENSSL_DEP)
+src/core/surface/init.c: $(OPENSSL_DEP)
+src/core/surface/lame_client.c: $(OPENSSL_DEP)
+src/core/surface/secure_channel_create.c: $(OPENSSL_DEP)
+src/core/surface/secure_server_create.c: $(OPENSSL_DEP)
+src/core/surface/server.c: $(OPENSSL_DEP)
+src/core/surface/server_chttp2.c: $(OPENSSL_DEP)
+src/core/surface/server_create.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/alpn.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/bin_encoder.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/frame_data.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/frame_goaway.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/frame_ping.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/frame_rst_stream.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/frame_settings.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/frame_window_update.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/hpack_parser.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/hpack_table.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/huffsyms.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/status_conversion.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/stream_encoder.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/stream_map.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/timeout_encoding.c: $(OPENSSL_DEP)
+src/core/transport/chttp2/varint.c: $(OPENSSL_DEP)
+src/core/transport/chttp2_transport.c: $(OPENSSL_DEP)
+src/core/transport/metadata.c: $(OPENSSL_DEP)
+src/core/transport/stream_op.c: $(OPENSSL_DEP)
+src/core/transport/transport.c: $(OPENSSL_DEP)
+third_party/cJSON/cJSON.c: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libgrpc.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBGRPC_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
@@ -1693,6 +1790,10 @@ libs/$(CONFIG)/libgpr_test_util.a: openssl_dep_error
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+test/core/util/test_config.c: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libgpr_test_util.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBGPR_TEST_UTIL_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
@@ -1737,6 +1838,21 @@ libs/$(CONFIG)/libgrpc_test_util.a: openssl_dep_error
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+test/core/end2end/cq_verifier.c: $(OPENSSL_DEP)
+test/core/end2end/data/test_root_cert.c: $(OPENSSL_DEP)
+test/core/end2end/data/prod_roots_certs.c: $(OPENSSL_DEP)
+test/core/end2end/data/server1_cert.c: $(OPENSSL_DEP)
+test/core/end2end/data/server1_key.c: $(OPENSSL_DEP)
+test/core/iomgr/endpoint_tests.c: $(OPENSSL_DEP)
+test/core/statistics/census_log_tests.c: $(OPENSSL_DEP)
+test/core/transport/transport_end2end_tests.c: $(OPENSSL_DEP)
+test/core/util/grpc_profiler.c: $(OPENSSL_DEP)
+test/core/util/port_posix.c: $(OPENSSL_DEP)
+test/core/util/parse_hexstring.c: $(OPENSSL_DEP)
+test/core/util/slice_splitter.c: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libgrpc_test_util.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBGRPC_TEST_UTIL_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
@@ -1825,6 +1941,29 @@ endif
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+src/cpp/client/channel.cc: $(OPENSSL_DEP)
+src/cpp/client/channel_arguments.cc: $(OPENSSL_DEP)
+src/cpp/client/client_context.cc: $(OPENSSL_DEP)
+src/cpp/client/create_channel.cc: $(OPENSSL_DEP)
+src/cpp/client/credentials.cc: $(OPENSSL_DEP)
+src/cpp/client/internal_stub.cc: $(OPENSSL_DEP)
+src/cpp/proto/proto_utils.cc: $(OPENSSL_DEP)
+src/cpp/common/rpc_method.cc: $(OPENSSL_DEP)
+src/cpp/server/async_server.cc: $(OPENSSL_DEP)
+src/cpp/server/async_server_context.cc: $(OPENSSL_DEP)
+src/cpp/server/completion_queue.cc: $(OPENSSL_DEP)
+src/cpp/server/server_builder.cc: $(OPENSSL_DEP)
+src/cpp/server/server_context_impl.cc: $(OPENSSL_DEP)
+src/cpp/server/server.cc: $(OPENSSL_DEP)
+src/cpp/server/server_rpc_handler.cc: $(OPENSSL_DEP)
+src/cpp/server/server_credentials.cc: $(OPENSSL_DEP)
+src/cpp/server/thread_pool.cc: $(OPENSSL_DEP)
+src/cpp/stream/stream_context.cc: $(OPENSSL_DEP)
+src/cpp/util/status.cc: $(OPENSSL_DEP)
+src/cpp/util/time.cc: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libgrpc++.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBGRPC++_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
@@ -1897,6 +2036,14 @@ libs/$(CONFIG)/libgrpc++_test_util.a: openssl_dep_error
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+test/cpp/util/messages.proto: $(OPENSSL_DEP)
+test/cpp/util/echo.proto: $(OPENSSL_DEP)
+test/cpp/util/echo_duplicate.proto: $(OPENSSL_DEP)
+test/cpp/util/create_test_channel.cc: $(OPENSSL_DEP)
+test/cpp/end2end/async_test_server.cc: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libgrpc++_test_util.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBGRPC++_TEST_UTIL_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
@@ -1934,6 +2081,10 @@ libs/$(CONFIG)/libend2end_fixture_chttp2_fake_security.a: openssl_dep_error
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+test/core/end2end/fixtures/chttp2_fake_security.c: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libend2end_fixture_chttp2_fake_security.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBEND2END_FIXTURE_CHTTP2_FAKE_SECURITY_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
@@ -1967,6 +2118,10 @@ libs/$(CONFIG)/libend2end_fixture_chttp2_fullstack.a: openssl_dep_error
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+test/core/end2end/fixtures/chttp2_fullstack.c: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libend2end_fixture_chttp2_fullstack.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBEND2END_FIXTURE_CHTTP2_FULLSTACK_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
@@ -2000,6 +2155,10 @@ libs/$(CONFIG)/libend2end_fixture_chttp2_simple_ssl_fullstack.a: openssl_dep_err
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+test/core/end2end/fixtures/chttp2_simple_ssl_fullstack.c: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libend2end_fixture_chttp2_simple_ssl_fullstack.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBEND2END_FIXTURE_CHTTP2_SIMPLE_SSL_FULLSTACK_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
@@ -2033,6 +2192,10 @@ libs/$(CONFIG)/libend2end_fixture_chttp2_simple_ssl_with_oauth2_fullstack.a: ope
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+test/core/end2end/fixtures/chttp2_simple_ssl_with_oauth2_fullstack.c: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libend2end_fixture_chttp2_simple_ssl_with_oauth2_fullstack.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBEND2END_FIXTURE_CHTTP2_SIMPLE_SSL_WITH_OAUTH2_FULLSTACK_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
@@ -2066,6 +2229,10 @@ libs/$(CONFIG)/libend2end_fixture_chttp2_socket_pair.a: openssl_dep_error
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+test/core/end2end/fixtures/chttp2_socket_pair.c: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libend2end_fixture_chttp2_socket_pair.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBEND2END_FIXTURE_CHTTP2_SOCKET_PAIR_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
@@ -2099,6 +2266,10 @@ libs/$(CONFIG)/libend2end_fixture_chttp2_socket_pair_one_byte_at_a_time.a: opens
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+test/core/end2end/fixtures/chttp2_socket_pair_one_byte_at_a_time.c: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libend2end_fixture_chttp2_socket_pair_one_byte_at_a_time.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBEND2END_FIXTURE_CHTTP2_SOCKET_PAIR_ONE_BYTE_AT_A_TIME_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
@@ -2597,6 +2768,13 @@ libs/$(CONFIG)/libend2end_certs.a: openssl_dep_error
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+test/core/end2end/data/test_root_cert.c: $(OPENSSL_DEP)
+test/core/end2end/data/prod_roots_certs.c: $(OPENSSL_DEP)
+test/core/end2end/data/server1_cert.c: $(OPENSSL_DEP)
+test/core/end2end/data/server1_key.c: $(OPENSSL_DEP)
+endif
+
 libs/$(CONFIG)/libend2end_certs.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIBEND2END_CERTS_OBJS)
 	$(E) "[AR]      Creating $@"
 	$(Q) mkdir -p `dirname $@`
diff --git a/src/compiler/cpp_generator.cc b/src/compiler/cpp_generator.cc
index 94e56d73a6..29bd3560f3 100644
--- a/src/compiler/cpp_generator.cc
+++ b/src/compiler/cpp_generator.cc
@@ -31,6 +31,9 @@
  *
  */
 
+#include <string>
+#include <map>
+
 #include "src/compiler/cpp_generator.h"
 
 #include "src/compiler/cpp_generator_helpers.h"
@@ -92,8 +95,8 @@ bool HasBidiStreaming(const google::protobuf::FileDescriptor* file) {
 }
 }  // namespace
 
-string GetHeaderIncludes(const google::protobuf::FileDescriptor* file) {
-  string temp =
+std::string GetHeaderIncludes(const google::protobuf::FileDescriptor* file) {
+  std::string temp =
       "#include \"grpc++/impl/internal_stub.h\"\n"
       "#include \"grpc++/status.h\"\n"
       "\n"
@@ -121,7 +124,7 @@ string GetHeaderIncludes(const google::protobuf::FileDescriptor* file) {
   return temp;
 }
 
-string GetSourceIncludes() {
+std::string GetSourceIncludes() {
   return "#include \"grpc++/channel_interface.h\"\n"
          "#include \"grpc++/impl/rpc_method.h\"\n"
          "#include \"grpc++/impl/rpc_service_method.h\"\n"
@@ -130,7 +133,7 @@ string GetSourceIncludes() {
 
 void PrintHeaderClientMethod(google::protobuf::io::Printer* printer,
                              const google::protobuf::MethodDescriptor* method,
-                             map<string, string>* vars) {
+                             std::map<std::string, std::string>* vars) {
   (*vars)["Method"] = method->name();
   (*vars)["Request"] =
       grpc_cpp_generator::ClassName(method->input_type(), true);
@@ -159,7 +162,7 @@ void PrintHeaderClientMethod(google::protobuf::io::Printer* printer,
 
 void PrintHeaderServerMethod(google::protobuf::io::Printer* printer,
                              const google::protobuf::MethodDescriptor* method,
-                             map<string, string>* vars) {
+                             std::map<std::string, std::string>* vars) {
   (*vars)["Method"] = method->name();
   (*vars)["Request"] =
       grpc_cpp_generator::ClassName(method->input_type(), true);
@@ -193,7 +196,7 @@ void PrintHeaderServerMethod(google::protobuf::io::Printer* printer,
 
 void PrintHeaderService(google::protobuf::io::Printer* printer,
                         const google::protobuf::ServiceDescriptor* service,
-                        map<string, string>* vars) {
+                        std::map<std::string, std::string>* vars) {
   (*vars)["Service"] = service->name();
 
   printer->Print(*vars,
@@ -238,11 +241,11 @@ void PrintHeaderService(google::protobuf::io::Printer* printer,
   printer->Print("};\n");
 }
 
-string GetHeaderServices(const google::protobuf::FileDescriptor* file) {
-  string output;
+std::string GetHeaderServices(const google::protobuf::FileDescriptor* file) {
+  std::string output;
   google::protobuf::io::StringOutputStream output_stream(&output);
   google::protobuf::io::Printer printer(&output_stream, '$');
-  map<string, string> vars;
+  std::map<std::string, std::string> vars;
 
   for (int i = 0; i < file->service_count(); ++i) {
     PrintHeaderService(&printer, file->service(i), &vars);
@@ -253,7 +256,7 @@ string GetHeaderServices(const google::protobuf::FileDescriptor* file) {
 
 void PrintSourceClientMethod(google::protobuf::io::Printer* printer,
                              const google::protobuf::MethodDescriptor* method,
-                             map<string, string>* vars) {
+                             std::map<std::string, std::string>* vars) {
   (*vars)["Method"] = method->name();
   (*vars)["Request"] =
       grpc_cpp_generator::ClassName(method->input_type(), true);
@@ -311,7 +314,7 @@ void PrintSourceClientMethod(google::protobuf::io::Printer* printer,
 
 void PrintSourceServerMethod(google::protobuf::io::Printer* printer,
                              const google::protobuf::MethodDescriptor* method,
-                             map<string, string>* vars) {
+                             std::map<std::string, std::string>* vars) {
   (*vars)["Method"] = method->name();
   (*vars)["Request"] =
       grpc_cpp_generator::ClassName(method->input_type(), true);
@@ -361,7 +364,7 @@ void PrintSourceServerMethod(google::protobuf::io::Printer* printer,
 
 void PrintSourceService(google::protobuf::io::Printer* printer,
                         const google::protobuf::ServiceDescriptor* service,
-                        map<string, string>* vars) {
+                        std::map<std::string, std::string>* vars) {
   (*vars)["Service"] = service->name();
   printer->Print(
       *vars,
@@ -455,11 +458,11 @@ void PrintSourceService(google::protobuf::io::Printer* printer,
   printer->Print("}\n\n");
 }
 
-string GetSourceServices(const google::protobuf::FileDescriptor* file) {
-  string output;
+std::string GetSourceServices(const google::protobuf::FileDescriptor* file) {
+  std::string output;
   google::protobuf::io::StringOutputStream output_stream(&output);
   google::protobuf::io::Printer printer(&output_stream, '$');
-  map<string, string> vars;
+  std::map<std::string, std::string> vars;
   // Package string is empty or ends with a dot. It is used to fully qualify
   // method names.
   vars["Package"] = file->package();
diff --git a/src/compiler/cpp_generator.h b/src/compiler/cpp_generator.h
index 8bd785f13e..1a74211b71 100644
--- a/src/compiler/cpp_generator.h
+++ b/src/compiler/cpp_generator.h
@@ -42,21 +42,19 @@ class FileDescriptor;
 }  // namespace protobuf
 }  // namespace google
 
-using namespace std;
-
 namespace grpc_cpp_generator {
 
 // Return the includes needed for generated header file.
-string GetHeaderIncludes(const google::protobuf::FileDescriptor* file);
+std::string GetHeaderIncludes(const google::protobuf::FileDescriptor* file);
 
 // Return the includes needed for generated source file.
-string GetSourceIncludes();
+std::string GetSourceIncludes();
 
 // Return the services for generated header file.
-string GetHeaderServices(const google::protobuf::FileDescriptor* file);
+std::string GetHeaderServices(const google::protobuf::FileDescriptor* file);
 
 // Return the services for generated source file.
-string GetSourceServices(const google::protobuf::FileDescriptor* file);
+std::string GetSourceServices(const google::protobuf::FileDescriptor* file);
 
 }  // namespace grpc_cpp_generator
 
diff --git a/src/compiler/cpp_generator_helpers.h b/src/compiler/cpp_generator_helpers.h
index ba251faf29..1ad3cb2db3 100644
--- a/src/compiler/cpp_generator_helpers.h
+++ b/src/compiler/cpp_generator_helpers.h
@@ -39,14 +39,12 @@
 #include <google/protobuf/descriptor.h>
 #include <google/protobuf/descriptor.pb.h>
 
-using namespace std;
-
 namespace grpc_cpp_generator {
 
-inline bool StripSuffix(string* filename, const string& suffix) {
+inline bool StripSuffix(std::string* filename, const std::string& suffix) {
   if (filename->length() >= suffix.length()) {
     size_t suffix_pos = filename->length() - suffix.length();
-    if (filename->compare(suffix_pos, string::npos, suffix) == 0) {
+    if (filename->compare(suffix_pos, std::string::npos, suffix) == 0) {
       filename->resize(filename->size() - suffix.size());
       return true;
     }
@@ -55,19 +53,20 @@ inline bool StripSuffix(string* filename, const string& suffix) {
   return false;
 }
 
-inline string StripProto(string filename) {
+inline std::string StripProto(std::string filename) {
   if (!StripSuffix(&filename, ".protodevel")) {
     StripSuffix(&filename, ".proto");
   }
   return filename;
 }
 
-inline string StringReplace(string str, const string& from, const string& to) {
+inline std::string StringReplace(std::string str, const std::string& from,
+                                 const std::string& to) {
   size_t pos = 0;
 
   for (;;) {
     pos = str.find(from, pos);
-    if (pos == string::npos) {
+    if (pos == std::string::npos) {
       break;
     }
     str.replace(pos, from.length(), to);
@@ -77,23 +76,23 @@ inline string StringReplace(string str, const string& from, const string& to) {
   return str;
 }
 
-inline string DotsToColons(const string& name) {
+inline std::string DotsToColons(const std::string& name) {
   return StringReplace(name, ".", "::");
 }
 
-inline string DotsToUnderscores(const string& name) {
+inline std::string DotsToUnderscores(const std::string& name) {
   return StringReplace(name, ".", "_");
 }
 
-inline string ClassName(const google::protobuf::Descriptor* descriptor,
-                        bool qualified) {
+inline std::string ClassName(const google::protobuf::Descriptor* descriptor,
+                             bool qualified) {
   // Find "outer", the descriptor of the top-level message in which
   // "descriptor" is embedded.
   const google::protobuf::Descriptor* outer = descriptor;
   while (outer->containing_type() != NULL) outer = outer->containing_type();
 
-  const string& outer_name = outer->full_name();
-  string inner_name = descriptor->full_name().substr(outer_name.size());
+  const std::string& outer_name = outer->full_name();
+  std::string inner_name = descriptor->full_name().substr(outer_name.size());
 
   if (qualified) {
     return "::" + DotsToColons(outer_name) + DotsToUnderscores(inner_name);
diff --git a/src/compiler/cpp_plugin.cc b/src/compiler/cpp_plugin.cc
index 17836b1612..e43278529d 100644
--- a/src/compiler/cpp_plugin.cc
+++ b/src/compiler/cpp_plugin.cc
@@ -35,6 +35,8 @@
 //
 
 #include <memory>
+#include <string>
+
 #include "src/compiler/cpp_generator.h"
 #include "src/compiler/cpp_generator_helpers.h"
 #include <google/protobuf/descriptor.h>
@@ -50,9 +52,9 @@ class CppGrpcGenerator : public google::protobuf::compiler::CodeGenerator {
   virtual ~CppGrpcGenerator() {}
 
   virtual bool Generate(const google::protobuf::FileDescriptor* file,
-                        const string& parameter,
+                        const std::string& parameter,
                         google::protobuf::compiler::GeneratorContext* context,
-                        string* error) const {
+                        std::string* error) const {
     if (file->options().cc_generic_services()) {
       *error =
           "cpp grpc proto compiler plugin does not work with generic "
@@ -61,7 +63,7 @@ class CppGrpcGenerator : public google::protobuf::compiler::CodeGenerator {
       return false;
     }
 
-    string file_name = grpc_cpp_generator::StripProto(file->name());
+    std::string file_name = grpc_cpp_generator::StripProto(file->name());
 
     // Generate .pb.h
     Insert(context, file_name + ".pb.h", "includes",
@@ -80,8 +82,8 @@ class CppGrpcGenerator : public google::protobuf::compiler::CodeGenerator {
  private:
   // Insert the given code into the given file at the given insertion point.
   void Insert(google::protobuf::compiler::GeneratorContext* context,
-              const string& filename, const string& insertion_point,
-              const string& code) const {
+              const std::string& filename, const std::string& insertion_point,
+              const std::string& code) const {
     std::unique_ptr<google::protobuf::io::ZeroCopyOutputStream> output(
         context->OpenForInsert(filename, insertion_point));
     google::protobuf::io::CodedOutputStream coded_out(output.get());
diff --git a/src/compiler/ruby_generator.cc b/src/compiler/ruby_generator.cc
index fae8858ff7..393f8f3b59 100644
--- a/src/compiler/ruby_generator.cc
+++ b/src/compiler/ruby_generator.cc
@@ -32,6 +32,7 @@
  */
 
 #include <cctype>
+#include <string>
 #include <map>
 #include <vector>
 
@@ -56,17 +57,17 @@ namespace grpc_ruby_generator {
 namespace {
 
 // Prints out the method using the ruby gRPC DSL.
-void PrintMethod(const MethodDescriptor* method, const string& package,
+void PrintMethod(const MethodDescriptor* method, const std::string& package,
                  Printer* out) {
-  string input_type = RubyTypeOf(method->input_type()->name(), package);
+  std::string input_type = RubyTypeOf(method->input_type()->name(), package);
   if (method->client_streaming()) {
     input_type = "stream(" + input_type + ")";
   }
-  string output_type = RubyTypeOf(method->output_type()->name(), package);
+  std::string output_type = RubyTypeOf(method->output_type()->name(), package);
   if (method->server_streaming()) {
     output_type = "stream(" + output_type + ")";
   }
-  map<string, string> method_vars = ListToDict({
+  std::map<std::string, std::string> method_vars = ListToDict({
       "mth.name", method->name(), "input.type", input_type, "output.type",
       output_type,
   });
@@ -74,22 +75,22 @@ void PrintMethod(const MethodDescriptor* method, const string& package,
 }
 
 // Prints out the service using the ruby gRPC DSL.
-void PrintService(const ServiceDescriptor* service, const string& package,
+void PrintService(const ServiceDescriptor* service, const std::string& package,
                   Printer* out) {
   if (service->method_count() == 0) {
     return;
   }
 
   // Begin the service module
-  map<string, string> module_vars = ListToDict({
+  std::map<std::string, std::string> module_vars = ListToDict({
       "module.name", CapitalizeFirst(service->name()),
   });
   out->Print(module_vars, "module $module.name$\n");
   out->Indent();
 
   // TODO(temiola): add documentation
-  string doc = "TODO: add proto service documentation here";
-  map<string, string> template_vars = ListToDict({
+  std::string doc = "TODO: add proto service documentation here";
+  std::map<std::string, std::string> template_vars = ListToDict({
       "Documentation", doc,
   });
   out->Print("\n");
@@ -103,7 +104,7 @@ void PrintService(const ServiceDescriptor* service, const string& package,
   out->Print("\n");
   out->Print("self.marshal_class_method = :encode\n");
   out->Print("self.unmarshal_class_method = :decode\n");
-  map<string, string> pkg_vars = ListToDict({
+  std::map<std::string, std::string> pkg_vars = ListToDict({
       "service.name", service->name(), "pkg.name", package,
   });
   out->Print(pkg_vars, "self.service_name = '$pkg.name$.$service.name$'\n");
@@ -124,8 +125,8 @@ void PrintService(const ServiceDescriptor* service, const string& package,
 
 }  // namespace
 
-string GetServices(const FileDescriptor* file) {
-  string output;
+std::string GetServices(const FileDescriptor* file) {
+  std::string output;
   StringOutputStream output_stream(&output);
   Printer out(&output_stream, '$');
 
@@ -136,7 +137,7 @@ string GetServices(const FileDescriptor* file) {
   }
 
   // Write out a file header.
-  map<string, string> header_comment_vars = ListToDict({
+  std::map<std::string, std::string> header_comment_vars = ListToDict({
       "file.name", file->name(), "file.package", file->package(),
   });
   out.Print("# Generated by the protocol buffer compiler.  DO NOT EDIT!\n");
@@ -148,16 +149,16 @@ string GetServices(const FileDescriptor* file) {
   // Write out require statemment to import the separately generated file
   // that defines the messages used by the service. This is generated by the
   // main ruby plugin.
-  map<string, string> dep_vars = ListToDict({
+  std::map<std::string, std::string> dep_vars = ListToDict({
       "dep.name", MessagesRequireName(file),
   });
   out.Print(dep_vars, "require '$dep.name$'\n");
 
   // Write out services within the modules
   out.Print("\n");
-  vector<string> modules = Split(file->package(), '.');
+  std::vector<std::string> modules = Split(file->package(), '.');
   for (size_t i = 0; i < modules.size(); ++i) {
-    map<string, string> module_vars = ListToDict({
+    std::map<std::string, std::string> module_vars = ListToDict({
         "module.name", CapitalizeFirst(modules[i]),
     });
     out.Print(module_vars, "module $module.name$\n");
diff --git a/src/compiler/ruby_generator.h b/src/compiler/ruby_generator.h
index 4f13f1a33b..0306536d08 100644
--- a/src/compiler/ruby_generator.h
+++ b/src/compiler/ruby_generator.h
@@ -36,8 +36,6 @@
 
 #include <string>
 
-using namespace std;
-
 namespace google {
 namespace protobuf {
 class FileDescriptor;
@@ -46,7 +44,7 @@ class FileDescriptor;
 
 namespace grpc_ruby_generator {
 
-string GetServices(const google::protobuf::FileDescriptor* file);
+std::string GetServices(const google::protobuf::FileDescriptor* file);
 
 }  // namespace grpc_ruby_generator
 
diff --git a/src/compiler/ruby_generator_helpers-inl.h b/src/compiler/ruby_generator_helpers-inl.h
index 8263e353b2..7b973ed9eb 100644
--- a/src/compiler/ruby_generator_helpers-inl.h
+++ b/src/compiler/ruby_generator_helpers-inl.h
@@ -42,7 +42,7 @@
 namespace grpc_ruby_generator {
 
 inline bool ServicesFilename(const google::protobuf::FileDescriptor* file,
-                             string* file_name_or_error) {
+                             std::string* file_name_or_error) {
   // Get output file name.
   static const unsigned proto_suffix_length = 6;  // length of ".proto"
   if (file->name().size() > proto_suffix_length &&
@@ -57,7 +57,7 @@ inline bool ServicesFilename(const google::protobuf::FileDescriptor* file,
   }
 }
 
-inline string MessagesRequireName(
+inline std::string MessagesRequireName(
     const google::protobuf::FileDescriptor* file) {
   return Replace(file->name(), ".proto", "");
 }
diff --git a/src/compiler/ruby_generator_map-inl.h b/src/compiler/ruby_generator_map-inl.h
index fa86fbb956..a49650a2f7 100644
--- a/src/compiler/ruby_generator_map-inl.h
+++ b/src/compiler/ruby_generator_map-inl.h
@@ -48,17 +48,18 @@ namespace grpc_ruby_generator {
 
 // Converts an initializer list of the form { key0, value0, key1, value1, ... }
 // into a map of key* to value*. Is merely a readability helper for later code.
-inline map<string, string> ListToDict(const initializer_list<string>& values) {
+inline std::map<std::string, std::string> ListToDict(
+    const initializer_list<std::string>& values) {
   if (values.size() % 2 != 0) {
     // MOE: insert     std::cerr << "Not every 'key' has a value in `values`."
     // << std::endl;
   }
-  map<string, string> value_map;
+  std::map<std::string, std::string> value_map;
   auto value_iter = values.begin();
   for (unsigned i = 0; i < values.size() / 2; ++i) {
-    string key = *value_iter;
+    std::string key = *value_iter;
     ++value_iter;
-    string value = *value_iter;
+    std::string value = *value_iter;
     value_map[key] = value;
     ++value_iter;
   }
diff --git a/src/compiler/ruby_generator_string-inl.h b/src/compiler/ruby_generator_string-inl.h
index 44e17a202a..a253f78d49 100644
--- a/src/compiler/ruby_generator_string-inl.h
+++ b/src/compiler/ruby_generator_string-inl.h
@@ -45,10 +45,10 @@ using std::transform;
 namespace grpc_ruby_generator {
 
 // Split splits a string using char into elems.
-inline vector<string>& Split(const string& s, char delim,
-                             vector<string>* elems) {
-  stringstream ss(s);
-  string item;
+inline std::vector<std::string>& Split(const std::string& s, char delim,
+                                       std::vector<std::string>* elems) {
+  std::stringstream ss(s);
+  std::string item;
   while (getline(ss, item, delim)) {
     elems->push_back(item);
   }
@@ -56,16 +56,17 @@ inline vector<string>& Split(const string& s, char delim,
 }
 
 // Split splits a string using char, returning the result in a vector.
-inline vector<string> Split(const string& s, char delim) {
-  vector<string> elems;
+inline std::vector<std::string> Split(const std::string& s, char delim) {
+  std::vector<std::string> elems;
   Split(s, delim, &elems);
   return elems;
 }
 
 // Replace replaces from with to in s.
-inline string Replace(string s, const string& from, const string& to) {
+inline std::string Replace(std::string s, const std::string& from,
+                           const std::string& to) {
   size_t start_pos = s.find(from);
-  if (start_pos == string::npos) {
+  if (start_pos == std::string::npos) {
     return s;
   }
   s.replace(start_pos, from.length(), to);
@@ -73,10 +74,10 @@ inline string Replace(string s, const string& from, const string& to) {
 }
 
 // ReplaceAll replaces all instances of search with replace in s.
-inline string ReplaceAll(string s, const string& search,
-                         const string& replace) {
+inline std::string ReplaceAll(std::string s, const std::string& search,
+                              const std::string& replace) {
   size_t pos = 0;
-  while ((pos = s.find(search, pos)) != string::npos) {
+  while ((pos = s.find(search, pos)) != std::string::npos) {
     s.replace(pos, search.length(), replace);
     pos += replace.length();
   }
@@ -84,9 +85,10 @@ inline string ReplaceAll(string s, const string& search,
 }
 
 // ReplacePrefix replaces from with to in s if search is a prefix of s.
-inline bool ReplacePrefix(string* s, const string& from, const string& to) {
+inline bool ReplacePrefix(std::string* s, const std::string& from,
+                          const std::string& to) {
   size_t start_pos = s->find(from);
-  if (start_pos == string::npos || start_pos != 0) {
+  if (start_pos == std::string::npos || start_pos != 0) {
     return false;
   }
   s->replace(start_pos, from.length(), to);
@@ -94,7 +96,7 @@ inline bool ReplacePrefix(string* s, const string& from, const string& to) {
 }
 
 // CapitalizeFirst capitalizes the first char in a string.
-inline string CapitalizeFirst(string s) {
+inline std::string CapitalizeFirst(std::string s) {
   if (s.empty()) {
     return s;
   }
@@ -103,14 +105,15 @@ inline string CapitalizeFirst(string s) {
 }
 
 // RubyTypeOf updates a proto type to the required ruby equivalent.
-inline string RubyTypeOf(const string& a_type, const string& package) {
-  string res(a_type);
+inline std::string RubyTypeOf(const std::string& a_type,
+                              const std::string& package) {
+  std::string res(a_type);
   ReplacePrefix(&res, package, "");  // remove the leading package if present
   ReplacePrefix(&res, ".", "");      // remove the leading . (no package)
-  if (res.find('.') == string::npos) {
+  if (res.find('.') == std::string::npos) {
     return res;
   } else {
-    vector<string> prefixes_and_type = Split(res, '.');
+    std::vector<std::string> prefixes_and_type = Split(res, '.');
     for (unsigned int i = 0; i < prefixes_and_type.size(); ++i) {
       if (i != 0) {
         res += "::";  // switch '.' to the ruby module delim
diff --git a/src/compiler/ruby_plugin.cc b/src/compiler/ruby_plugin.cc
index c1748cfaeb..86c0e11e1c 100644
--- a/src/compiler/ruby_plugin.cc
+++ b/src/compiler/ruby_plugin.cc
@@ -37,6 +37,7 @@
 // and net/proto2/compiler/public/plugin.h for more information on plugins.
 
 #include <memory>
+#include <string>
 
 #include "src/compiler/ruby_generator.h"
 #include "src/compiler/ruby_generator_helpers-inl.h"
@@ -52,16 +53,16 @@ class RubyGrpcGenerator : public google::protobuf::compiler::CodeGenerator {
   ~RubyGrpcGenerator() override {}
 
   bool Generate(const google::protobuf::FileDescriptor* file,
-                const string& parameter,
+                const std::string& parameter,
                 google::protobuf::compiler::GeneratorContext* context,
-                string* error) const override {
-    string code = grpc_ruby_generator::GetServices(file);
+                std::string* error) const override {
+    std::string code = grpc_ruby_generator::GetServices(file);
     if (code.size() == 0) {
       return true;  // don't generate a file if there are no services
     }
 
     // Get output file name.
-    string file_name;
+    std::string file_name;
     if (!grpc_ruby_generator::ServicesFilename(file, &file_name)) {
       return false;
     }
diff --git a/src/core/security/secure_endpoint.c b/src/core/security/secure_endpoint.c
index 7f0fdf73c9..e73767c1aa 100644
--- a/src/core/security/secure_endpoint.c
+++ b/src/core/security/secure_endpoint.c
@@ -126,8 +126,8 @@ static void on_read(void *user_data, gpr_slice *slices, size_t nslices,
     size_t message_size = GPR_SLICE_LENGTH(encrypted);
 
     while (message_size > 0 || keep_looping) {
-      gpr_uint32 unprotected_buffer_size_written = end - cur;
-      gpr_uint32 processed_message_size = message_size;
+      size_t unprotected_buffer_size_written = end - cur;
+      size_t processed_message_size = message_size;
       gpr_mu_lock(&ep->protector_mu);
       result = tsi_frame_protector_unprotect(ep->protector, message_bytes,
                                              &processed_message_size, cur,
@@ -245,8 +245,8 @@ static grpc_endpoint_write_status endpoint_write(grpc_endpoint *secure_ep,
     gpr_uint8 *message_bytes = GPR_SLICE_START_PTR(plain);
     size_t message_size = GPR_SLICE_LENGTH(plain);
     while (message_size > 0) {
-      gpr_uint32 protected_buffer_size_to_send = end - cur;
-      gpr_uint32 processed_message_size = message_size;
+      size_t protected_buffer_size_to_send = end - cur;
+      size_t processed_message_size = message_size;
       gpr_mu_lock(&ep->protector_mu);
       result = tsi_frame_protector_protect(ep->protector, message_bytes,
                                            &processed_message_size, cur,
@@ -268,9 +268,9 @@ static grpc_endpoint_write_status endpoint_write(grpc_endpoint *secure_ep,
     if (result != TSI_OK) break;
   }
   if (result == TSI_OK) {
-    gpr_uint32 still_pending_size;
+    size_t still_pending_size;
     do {
-      gpr_uint32 protected_buffer_size_to_send = end - cur;
+      size_t protected_buffer_size_to_send = end - cur;
       gpr_mu_lock(&ep->protector_mu);
       result = tsi_frame_protector_protect_flush(ep->protector, cur,
                                                  &protected_buffer_size_to_send,
diff --git a/src/core/security/secure_transport_setup.c b/src/core/security/secure_transport_setup.c
index 3df91ed8e7..50a6987fbf 100644
--- a/src/core/security/secure_transport_setup.c
+++ b/src/core/security/secure_transport_setup.c
@@ -131,7 +131,7 @@ static void send_handshake_bytes_to_peer(grpc_secure_transport_setup *s) {
   grpc_endpoint_write_status write_status;
 
   do {
-    uint32_t to_send_size = s->handshake_buffer_size - offset;
+    size_t to_send_size = s->handshake_buffer_size - offset;
     result = tsi_handshaker_get_bytes_to_send_to_peer(
         s->handshaker, s->handshake_buffer + offset, &to_send_size);
     offset += to_send_size;
@@ -174,7 +174,7 @@ static void on_handshake_data_received_from_peer(
     void *setup, gpr_slice *slices, size_t nslices,
     grpc_endpoint_cb_status error) {
   grpc_secure_transport_setup *s = setup;
-  uint32_t consumed_slice_size = 0;
+  size_t consumed_slice_size = 0;
   tsi_result result = TSI_OK;
   size_t i;
   size_t num_left_overs;
diff --git a/src/core/security/security_context.c b/src/core/security/security_context.c
index fc722f2d82..421b81fd36 100644
--- a/src/core/security/security_context.c
+++ b/src/core/security/security_context.c
@@ -411,9 +411,9 @@ grpc_security_status grpc_ssl_server_security_context_create(
   c->base.vtable = &ssl_server_vtable;
   result = tsi_create_ssl_server_handshaker_factory(
       (const unsigned char **)&config->pem_private_key,
-      (const gpr_uint32 *)&config->pem_private_key_size,
+      &config->pem_private_key_size,
       (const unsigned char **)&config->pem_cert_chain,
-      (const gpr_uint32 *)&config->pem_cert_chain_size, 1,
+      &config->pem_cert_chain_size, 1,
       config->pem_root_certs, config->pem_root_certs_size,
       GRPC_SSL_CIPHER_SUITES, alpn_protocol_strings,
       alpn_protocol_string_lengths, num_alpn_protocols, &c->handshaker_factory);
diff --git a/src/core/tsi/fake_transport_security.c b/src/core/tsi/fake_transport_security.c
index 63d0e1f788..446329215f 100644
--- a/src/core/tsi/fake_transport_security.c
+++ b/src/core/tsi/fake_transport_security.c
@@ -37,6 +37,7 @@
 #include <string.h>
 
 #include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 #include "src/core/tsi/transport_security.h"
 
 /* --- Constants. ---*/
@@ -52,9 +53,9 @@
    the data encoded in little endian on 4 bytes.  */
 typedef struct {
   unsigned char* data;
-  uint32_t size;
-  uint32_t allocated_size;
-  uint32_t offset;
+  size_t size;
+  size_t allocated_size;
+  size_t offset;
   int needs_draining;
 } tsi_fake_frame;
 
@@ -80,7 +81,7 @@ typedef struct {
   tsi_frame_protector base;
   tsi_fake_frame protect_frame;
   tsi_fake_frame unprotect_frame;
-  uint32_t max_frame_size;
+  size_t max_frame_size;
 } tsi_fake_frame_protector;
 
 /* --- Utils. ---*/
@@ -110,12 +111,12 @@ static tsi_result tsi_fake_handshake_message_from_string(
   return TSI_DATA_CORRUPTED;
 }
 
-static uint32_t load32_little_endian(const unsigned char* buf) {
-  return ((uint32_t)(buf[0]) | (uint32_t)(buf[1] << 8) |
-          (uint32_t)(buf[2] << 16) | (uint32_t)(buf[3] << 24));
+static gpr_uint32 load32_little_endian(const unsigned char* buf) {
+  return ((gpr_uint32)(buf[0]) | (gpr_uint32)(buf[1] << 8) |
+          (gpr_uint32)(buf[2] << 16) | (gpr_uint32)(buf[3] << 24));
 }
 
-static void store32_little_endian(uint32_t value, unsigned char* buf) {
+static void store32_little_endian(gpr_uint32 value, unsigned char* buf) {
   buf[3] = (unsigned char)(value >> 24) & 0xFF;
   buf[2] = (unsigned char)(value >> 16) & 0xFF;
   buf[1] = (unsigned char)(value >> 8) & 0xFF;
@@ -149,10 +150,10 @@ static int tsi_fake_frame_ensure_size(tsi_fake_frame* frame) {
 
 /* This method should not be called if frame->needs_framing is not 0.  */
 static tsi_result fill_frame_from_bytes(const unsigned char* incoming_bytes,
-                                        uint32_t* incoming_bytes_size,
+                                        size_t* incoming_bytes_size,
                                         tsi_fake_frame* frame) {
-  uint32_t available_size = *incoming_bytes_size;
-  uint32_t to_read_size = 0;
+  size_t available_size = *incoming_bytes_size;
+  size_t to_read_size = 0;
   const unsigned char* bytes_cursor = incoming_bytes;
 
   if (frame->needs_draining) return TSI_INTERNAL_ERROR;
@@ -197,9 +198,9 @@ static tsi_result fill_frame_from_bytes(const unsigned char* incoming_bytes,
 
 /* This method should not be called if frame->needs_framing is 0.  */
 static tsi_result drain_frame_to_bytes(unsigned char* outgoing_bytes,
-                                       uint32_t* outgoing_bytes_size,
+                                       size_t* outgoing_bytes_size,
                                        tsi_fake_frame* frame) {
-  uint32_t to_write_size = frame->size - frame->offset;
+  size_t to_write_size = frame->size - frame->offset;
   if (!frame->needs_draining) return TSI_INTERNAL_ERROR;
   if (*outgoing_bytes_size < to_write_size) {
     memcpy(outgoing_bytes, frame->data + frame->offset, *outgoing_bytes_size);
@@ -212,7 +213,7 @@ static tsi_result drain_frame_to_bytes(unsigned char* outgoing_bytes,
   return TSI_OK;
 }
 
-static tsi_result bytes_to_frame(unsigned char* bytes, uint32_t bytes_size,
+static tsi_result bytes_to_frame(unsigned char* bytes, size_t bytes_size,
                                  tsi_fake_frame* frame) {
   frame->offset = 0;
   frame->size = bytes_size + TSI_FAKE_FRAME_HEADER_SIZE;
@@ -231,15 +232,15 @@ static void tsi_fake_frame_destruct(tsi_fake_frame* frame) {
 
 static tsi_result fake_protector_protect(
     tsi_frame_protector* self, const unsigned char* unprotected_bytes,
-    uint32_t* unprotected_bytes_size, unsigned char* protected_output_frames,
-    uint32_t* protected_output_frames_size) {
+    size_t* unprotected_bytes_size, unsigned char* protected_output_frames,
+    size_t* protected_output_frames_size) {
   tsi_result result = TSI_OK;
   tsi_fake_frame_protector* impl = (tsi_fake_frame_protector*)self;
   unsigned char frame_header[TSI_FAKE_FRAME_HEADER_SIZE];
   tsi_fake_frame* frame = &impl->protect_frame;
-  uint32_t saved_output_size = *protected_output_frames_size;
-  uint32_t drained_size = 0;
-  uint32_t* num_bytes_written = protected_output_frames_size;
+  size_t saved_output_size = *protected_output_frames_size;
+  size_t drained_size = 0;
+  size_t* num_bytes_written = protected_output_frames_size;
   *num_bytes_written = 0;
 
   /* Try to drain first. */
@@ -262,7 +263,7 @@ static tsi_result fake_protector_protect(
   if (frame->needs_draining) return TSI_INTERNAL_ERROR;
   if (frame->size == 0) {
     /* New frame, create a header. */
-    uint32_t written_in_frame_size = 0;
+    size_t written_in_frame_size = 0;
     store32_little_endian(impl->max_frame_size, frame_header);
     written_in_frame_size = TSI_FAKE_FRAME_HEADER_SIZE;
     result = fill_frame_from_bytes(frame_header, &written_in_frame_size, frame);
@@ -291,7 +292,7 @@ static tsi_result fake_protector_protect(
 
 static tsi_result fake_protector_protect_flush(
     tsi_frame_protector* self, unsigned char* protected_output_frames,
-    uint32_t* protected_output_frames_size, uint32_t* still_pending_size) {
+    size_t* protected_output_frames_size, size_t* still_pending_size) {
   tsi_result result = TSI_OK;
   tsi_fake_frame_protector* impl = (tsi_fake_frame_protector*)self;
   tsi_fake_frame* frame = &impl->protect_frame;
@@ -311,14 +312,14 @@ static tsi_result fake_protector_protect_flush(
 
 static tsi_result fake_protector_unprotect(
     tsi_frame_protector* self, const unsigned char* protected_frames_bytes,
-    uint32_t* protected_frames_bytes_size, unsigned char* unprotected_bytes,
-    uint32_t* unprotected_bytes_size) {
+    size_t* protected_frames_bytes_size, unsigned char* unprotected_bytes,
+    size_t* unprotected_bytes_size) {
   tsi_result result = TSI_OK;
   tsi_fake_frame_protector* impl = (tsi_fake_frame_protector*)self;
   tsi_fake_frame* frame = &impl->unprotect_frame;
-  uint32_t saved_output_size = *unprotected_bytes_size;
-  uint32_t drained_size = 0;
-  uint32_t* num_bytes_written = unprotected_bytes_size;
+  size_t saved_output_size = *unprotected_bytes_size;
+  size_t drained_size = 0;
+  size_t* num_bytes_written = unprotected_bytes_size;
   *num_bytes_written = 0;
 
   /* Try to drain first. */
@@ -373,7 +374,7 @@ static const tsi_frame_protector_vtable frame_protector_vtable = {
 /* --- tsi_handshaker methods implementation. ---*/
 
 static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
-    tsi_handshaker* self, unsigned char* bytes, uint32_t* bytes_size) {
+    tsi_handshaker* self, unsigned char* bytes, size_t* bytes_size) {
   tsi_fake_handshaker* impl = (tsi_fake_handshaker*)self;
   tsi_result result = TSI_OK;
   if (impl->needs_incoming_message || impl->result == TSI_OK) {
@@ -408,7 +409,7 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
 }
 
 static tsi_result fake_handshaker_process_bytes_from_peer(
-    tsi_handshaker* self, const unsigned char* bytes, uint32_t* bytes_size) {
+    tsi_handshaker* self, const unsigned char* bytes, size_t* bytes_size) {
   tsi_result result = TSI_OK;
   tsi_fake_handshaker* impl = (tsi_fake_handshaker*)self;
   int expected_msg = impl->next_message_to_send - 1;
@@ -463,7 +464,7 @@ static tsi_result fake_handshaker_extract_peer(tsi_handshaker* self,
 }
 
 static tsi_result fake_handshaker_create_frame_protector(
-    tsi_handshaker* self, uint32_t* max_protected_frame_size,
+    tsi_handshaker* self, size_t* max_protected_frame_size,
     tsi_frame_protector** protector) {
   *protector = tsi_create_fake_protector(max_protected_frame_size);
   if (*protector == NULL) return TSI_OUT_OF_RESOURCES;
@@ -500,7 +501,7 @@ tsi_handshaker* tsi_create_fake_handshaker(int is_client) {
 }
 
 tsi_frame_protector* tsi_create_fake_protector(
-    uint32_t* max_protected_frame_size) {
+    size_t* max_protected_frame_size) {
   tsi_fake_frame_protector* impl = calloc(1, sizeof(tsi_fake_frame_protector));
   if (impl == NULL) return NULL;
   impl->max_frame_size = (max_protected_frame_size == NULL)
diff --git a/src/core/tsi/fake_transport_security.h b/src/core/tsi/fake_transport_security.h
index a62fe81c09..9e3480adfa 100644
--- a/src/core/tsi/fake_transport_security.h
+++ b/src/core/tsi/fake_transport_security.h
@@ -52,7 +52,7 @@ tsi_handshaker* tsi_create_fake_handshaker(int is_client);
 
 /* Creates a protector directly without going through the handshake phase. */
 tsi_frame_protector* tsi_create_fake_protector(
-    uint32_t* max_protected_frame_size);
+    size_t* max_protected_frame_size);
 
 #ifdef __cplusplus
 }
diff --git a/src/core/tsi/ssl_transport_security.c b/src/core/tsi/ssl_transport_security.c
index c98071a937..02af080a31 100644
--- a/src/core/tsi/ssl_transport_security.c
+++ b/src/core/tsi/ssl_transport_security.c
@@ -76,9 +76,9 @@ typedef struct {
      associated with the contexts at the same index.  */
   SSL_CTX** ssl_contexts;
   tsi_peer* ssl_context_x509_subject_names;
-  uint32_t ssl_context_count;
+  size_t ssl_context_count;
   unsigned char* alpn_protocol_list;
-  uint32_t alpn_protocol_list_length;
+  size_t alpn_protocol_list_length;
 } tsi_ssl_server_handshaker_factory;
 
 typedef struct {
@@ -95,8 +95,8 @@ typedef struct {
   BIO* into_ssl;
   BIO* from_ssl;
   unsigned char* buffer;
-  uint32_t buffer_size;
-  uint32_t buffer_offset;
+  size_t buffer_size;
+  size_t buffer_offset;
 } tsi_ssl_frame_protector;
 
 /* --- Library Initialization. ---*/
@@ -159,7 +159,7 @@ static void ssl_info_callback(const SSL* ssl, int where, int ret) {
 
 /* Gets the subject CN from an X509 cert. */
 static tsi_result ssl_get_x509_common_name(X509* cert, unsigned char** utf8,
-                                           uint32_t* utf8_size) {
+                                           size_t* utf8_size) {
   int common_name_index = -1;
   X509_NAME_ENTRY* common_name_entry = NULL;
   ASN1_STRING* common_name_asn1 = NULL;
@@ -200,7 +200,7 @@ static tsi_result ssl_get_x509_common_name(X509* cert, unsigned char** utf8,
 static tsi_result peer_property_from_x509_common_name(
     X509* cert, tsi_peer_property* property) {
   unsigned char* common_name;
-  uint32_t common_name_size;
+  size_t common_name_size;
   tsi_result result =
       ssl_get_x509_common_name(cert, &common_name, &common_name_size);
   if (result != TSI_OK) return result;
@@ -266,7 +266,7 @@ static tsi_result peer_property_from_x509_subject_alt_names(
 static tsi_result peer_from_x509(X509* cert, int include_certificate_type,
                                  tsi_peer* peer) {
   /* TODO(jboeuf): Maybe add more properties. */
-  uint32_t property_count = include_certificate_type ? 3 : 2;
+  size_t property_count = include_certificate_type ? 3 : 2;
   tsi_result result = tsi_construct_peer(property_count, peer);
   if (result != TSI_OK) return result;
   do {
@@ -299,7 +299,7 @@ static void log_ssl_error_stack(void) {
 
 /* Performs an SSL_read and handle errors. */
 static tsi_result do_ssl_read(SSL* ssl, unsigned char* unprotected_bytes,
-                              uint32_t* unprotected_bytes_size) {
+                              size_t* unprotected_bytes_size) {
   int read_from_ssl = SSL_read(ssl, unprotected_bytes, *unprotected_bytes_size);
   if (read_from_ssl == 0) {
     gpr_log(GPR_ERROR, "SSL_read returned 0 unexpectedly.");
@@ -333,7 +333,7 @@ static tsi_result do_ssl_read(SSL* ssl, unsigned char* unprotected_bytes,
 
 /* Performs an SSL_write and handle errors. */
 static tsi_result do_ssl_write(SSL* ssl, unsigned char* unprotected_bytes,
-                               uint32_t unprotected_bytes_size) {
+                               size_t unprotected_bytes_size) {
   int ssl_write_result =
       SSL_write(ssl, unprotected_bytes, unprotected_bytes_size);
   if (ssl_write_result < 0) {
@@ -354,7 +354,7 @@ static tsi_result do_ssl_write(SSL* ssl, unsigned char* unprotected_bytes,
 /* Loads an in-memory PEM certificate chain into the SSL context. */
 static tsi_result ssl_ctx_use_certificate_chain(
     SSL_CTX* context, const unsigned char* pem_cert_chain,
-    uint32_t pem_cert_chain_size) {
+    size_t pem_cert_chain_size) {
   tsi_result result = TSI_OK;
   X509* certificate = NULL;
   BIO* pem = BIO_new_mem_buf((void*)pem_cert_chain, pem_cert_chain_size);
@@ -395,7 +395,7 @@ static tsi_result ssl_ctx_use_certificate_chain(
 /* Loads an in-memory PEM private key into the SSL context. */
 static tsi_result ssl_ctx_use_private_key(SSL_CTX* context,
                                           const unsigned char* pem_key,
-                                          uint32_t pem_key_size) {
+                                          size_t pem_key_size) {
   tsi_result result = TSI_OK;
   EVP_PKEY* private_key = NULL;
   BIO* pem = BIO_new_mem_buf((void*)pem_key, pem_key_size);
@@ -419,10 +419,10 @@ static tsi_result ssl_ctx_use_private_key(SSL_CTX* context,
 /* Loads in-memory PEM verification certs into the SSL context and optionally
    returns the verification cert names (root_names can be NULL). */
 static tsi_result ssl_ctx_load_verification_certs(
-    SSL_CTX* context, const unsigned char* pem_roots, uint32_t pem_roots_size,
+    SSL_CTX* context, const unsigned char* pem_roots, size_t pem_roots_size,
     STACK_OF(X509_NAME) * *root_names) {
   tsi_result result = TSI_OK;
-  uint32_t num_roots = 0;
+  size_t num_roots = 0;
   X509* root = NULL;
   X509_NAME* root_name = NULL;
   BIO* pem = BIO_new_mem_buf((void*)pem_roots, pem_roots_size);
@@ -485,8 +485,8 @@ static tsi_result ssl_ctx_load_verification_certs(
    cipher list and the ephemeral ECDH key. */
 static tsi_result populate_ssl_context(
     SSL_CTX* context, const unsigned char* pem_private_key,
-    uint32_t pem_private_key_size, const unsigned char* pem_certificate_chain,
-    uint32_t pem_certificate_chain_size, const char* cipher_list) {
+    size_t pem_private_key_size, const unsigned char* pem_certificate_chain,
+    size_t pem_certificate_chain_size, const char* cipher_list) {
   tsi_result result = TSI_OK;
   if (pem_certificate_chain != NULL) {
     result = ssl_ctx_use_certificate_chain(context, pem_certificate_chain,
@@ -522,7 +522,7 @@ static tsi_result populate_ssl_context(
 
 /* Extracts the CN and the SANs from an X509 cert as a peer object. */
 static tsi_result extract_x509_subject_names_from_pem_cert(
-    const unsigned char* pem_cert, uint32_t pem_cert_size, tsi_peer* peer) {
+    const unsigned char* pem_cert, size_t pem_cert_size, tsi_peer* peer) {
   tsi_result result = TSI_OK;
   X509* cert = NULL;
   BIO* pem = BIO_new_mem_buf((void*)pem_cert, pem_cert_size);
@@ -544,7 +544,7 @@ static tsi_result extract_x509_subject_names_from_pem_cert(
 static tsi_result build_alpn_protocol_name_list(
     const unsigned char** alpn_protocols,
     const unsigned char* alpn_protocols_lengths, uint16_t num_alpn_protocols,
-    unsigned char** protocol_name_list, uint32_t* protocol_name_list_length) {
+    unsigned char** protocol_name_list, size_t* protocol_name_list_length) {
   uint16_t i;
   unsigned char* current;
   *protocol_name_list = NULL;
@@ -575,15 +575,15 @@ static tsi_result build_alpn_protocol_name_list(
 
 static tsi_result ssl_protector_protect(
     tsi_frame_protector* self, const unsigned char* unprotected_bytes,
-    uint32_t* unprotected_bytes_size, unsigned char* protected_output_frames,
-    uint32_t* protected_output_frames_size) {
+    size_t* unprotected_bytes_size, unsigned char* protected_output_frames,
+    size_t* protected_output_frames_size) {
   tsi_ssl_frame_protector* impl = (tsi_ssl_frame_protector*)self;
   int read_from_ssl;
-  uint32_t available;
+  size_t available;
   tsi_result result = TSI_OK;
 
   /* First see if we have some pending data in the SSL BIO. */
-  uint32_t pending_in_ssl = BIO_ctrl_pending(impl->from_ssl);
+  size_t pending_in_ssl = BIO_ctrl_pending(impl->from_ssl);
   if (pending_in_ssl > 0) {
     *unprotected_bytes_size = 0;
     read_from_ssl = BIO_read(impl->from_ssl, protected_output_frames,
@@ -627,7 +627,7 @@ static tsi_result ssl_protector_protect(
 
 static tsi_result ssl_protector_protect_flush(
     tsi_frame_protector* self, unsigned char* protected_output_frames,
-    uint32_t* protected_output_frames_size, uint32_t* still_pending_size) {
+    size_t* protected_output_frames_size, size_t* still_pending_size) {
   tsi_result result = TSI_OK;
   tsi_ssl_frame_protector* impl = (tsi_ssl_frame_protector*)self;
   int read_from_ssl = 0;
@@ -654,12 +654,12 @@ static tsi_result ssl_protector_protect_flush(
 
 static tsi_result ssl_protector_unprotect(
     tsi_frame_protector* self, const unsigned char* protected_frames_bytes,
-    uint32_t* protected_frames_bytes_size, unsigned char* unprotected_bytes,
-    uint32_t* unprotected_bytes_size) {
+    size_t* protected_frames_bytes_size, unsigned char* unprotected_bytes,
+    size_t* unprotected_bytes_size) {
   tsi_result result = TSI_OK;
   int written_into_ssl = 0;
-  uint32_t output_bytes_size = *unprotected_bytes_size;
-  uint32_t output_bytes_offset = 0;
+  size_t output_bytes_size = *unprotected_bytes_size;
+  size_t output_bytes_offset = 0;
   tsi_ssl_frame_protector* impl = (tsi_ssl_frame_protector*)self;
 
   /* First, try to read remaining data from ssl. */
@@ -708,7 +708,7 @@ static const tsi_frame_protector_vtable frame_protector_vtable = {
 /* --- tsi_handshaker methods implementation. ---*/
 
 static tsi_result ssl_handshaker_get_bytes_to_send_to_peer(
-    tsi_handshaker* self, unsigned char* bytes, uint32_t* bytes_size) {
+    tsi_handshaker* self, unsigned char* bytes, size_t* bytes_size) {
   tsi_ssl_handshaker* impl = (tsi_ssl_handshaker*)self;
   int bytes_read_from_ssl = 0;
   if (bytes == NULL || bytes_size == NULL || *bytes_size == 0 ||
@@ -725,7 +725,7 @@ static tsi_result ssl_handshaker_get_bytes_to_send_to_peer(
       return TSI_OK;
     }
   }
-  *bytes_size = (uint32_t)bytes_read_from_ssl;
+  *bytes_size = (size_t)bytes_read_from_ssl;
   return BIO_ctrl_pending(impl->from_ssl) == 0 ? TSI_OK : TSI_INCOMPLETE_DATA;
 }
 
@@ -739,7 +739,7 @@ static tsi_result ssl_handshaker_get_result(tsi_handshaker* self) {
 }
 
 static tsi_result ssl_handshaker_process_bytes_from_peer(
-    tsi_handshaker* self, const unsigned char* bytes, uint32_t* bytes_size) {
+    tsi_handshaker* self, const unsigned char* bytes, size_t* bytes_size) {
   tsi_ssl_handshaker* impl = (tsi_ssl_handshaker*)self;
   int bytes_written_into_ssl_size = 0;
   if (bytes == NULL || bytes_size == 0 || *bytes_size > INT_MAX) {
@@ -796,7 +796,7 @@ static tsi_result ssl_handshaker_extract_peer(tsi_handshaker* self,
   }
   SSL_get0_alpn_selected(impl->ssl, &alpn_selected, &alpn_selected_len);
   if (alpn_selected != NULL) {
-    uint32_t i;
+    size_t i;
     tsi_peer_property* new_properties =
         calloc(1, sizeof(tsi_peer_property) * (peer->property_count + 1));
     if (new_properties == NULL) return TSI_OUT_OF_RESOURCES;
@@ -818,9 +818,9 @@ static tsi_result ssl_handshaker_extract_peer(tsi_handshaker* self,
 }
 
 static tsi_result ssl_handshaker_create_frame_protector(
-    tsi_handshaker* self, uint32_t* max_output_protected_frame_size,
+    tsi_handshaker* self, size_t* max_output_protected_frame_size,
     tsi_frame_protector** protector) {
-  uint32_t actual_max_output_protected_frame_size =
+  size_t actual_max_output_protected_frame_size =
       TSI_SSL_MAX_PROTECTED_FRAME_SIZE_UPPER_BOUND;
   tsi_ssl_handshaker* impl = (tsi_ssl_handshaker*)self;
   tsi_ssl_frame_protector* protector_impl =
@@ -993,7 +993,7 @@ static void ssl_server_handshaker_factory_destroy(
     tsi_ssl_handshaker_factory* self) {
   tsi_ssl_server_handshaker_factory* impl =
       (tsi_ssl_server_handshaker_factory*)self;
-  uint32_t i;
+  size_t i;
   for (i = 0; i < impl->ssl_context_count; i++) {
     if (impl->ssl_contexts[i] != NULL) {
       SSL_CTX_free(impl->ssl_contexts[i]);
@@ -1008,7 +1008,7 @@ static void ssl_server_handshaker_factory_destroy(
   free(impl);
 }
 
-static int does_entry_match_name(const char* entry, uint32_t entry_length,
+static int does_entry_match_name(const char* entry, size_t entry_length,
                                  const char* name) {
   const char* name_subdomain = NULL;
   if (entry_length == 0) return 0;
@@ -1035,7 +1035,7 @@ static int ssl_server_handshaker_factory_servername_callback(SSL* ssl, int* ap,
                                                              void* arg) {
   tsi_ssl_server_handshaker_factory* impl =
       (tsi_ssl_server_handshaker_factory*)arg;
-  uint32_t i = 0;
+  size_t i = 0;
   const char* servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
   if (servername == NULL || strlen(servername) == 0) {
     return SSL_TLSEXT_ERR_NOACK;
@@ -1080,9 +1080,9 @@ static int server_handshaker_factory_alpn_callback(
 /* --- tsi_ssl_handshaker_factory constructors. --- */
 
 tsi_result tsi_create_ssl_client_handshaker_factory(
-    const unsigned char* pem_private_key, uint32_t pem_private_key_size,
-    const unsigned char* pem_cert_chain, uint32_t pem_cert_chain_size,
-    const unsigned char* pem_root_certs, uint32_t pem_root_certs_size,
+    const unsigned char* pem_private_key, size_t pem_private_key_size,
+    const unsigned char* pem_cert_chain, size_t pem_cert_chain_size,
+    const unsigned char* pem_root_certs, size_t pem_root_certs_size,
     const char* cipher_list, const unsigned char** alpn_protocols,
     const unsigned char* alpn_protocols_lengths, uint16_t num_alpn_protocols,
     tsi_ssl_handshaker_factory** factory) {
@@ -1115,7 +1115,7 @@ tsi_result tsi_create_ssl_client_handshaker_factory(
 
     if (num_alpn_protocols != 0) {
       unsigned char* alpn_protocol_list = NULL;
-      uint32_t alpn_protocol_list_length = 0;
+      size_t alpn_protocol_list_length = 0;
       int ssl_failed;
       result = build_alpn_protocol_name_list(
           alpn_protocols, alpn_protocols_lengths, num_alpn_protocols,
@@ -1157,17 +1157,17 @@ tsi_result tsi_create_ssl_client_handshaker_factory(
 
 tsi_result tsi_create_ssl_server_handshaker_factory(
     const unsigned char** pem_private_keys,
-    const uint32_t* pem_private_keys_sizes,
+    const size_t* pem_private_keys_sizes,
     const unsigned char** pem_cert_chains,
-    const uint32_t* pem_cert_chains_sizes, uint32_t key_cert_pair_count,
+    const size_t* pem_cert_chains_sizes, size_t key_cert_pair_count,
     const unsigned char* pem_client_root_certs,
-    uint32_t pem_client_root_certs_size, const char* cipher_list,
+    size_t pem_client_root_certs_size, const char* cipher_list,
     const unsigned char** alpn_protocols,
     const unsigned char* alpn_protocols_lengths, uint16_t num_alpn_protocols,
     tsi_ssl_handshaker_factory** factory) {
   tsi_ssl_server_handshaker_factory* impl = NULL;
   tsi_result result = TSI_OK;
-  uint32_t i = 0;
+  size_t i = 0;
 
   gpr_once_init(&init_openssl_once, init_openssl);
 
@@ -1255,7 +1255,7 @@ tsi_result tsi_create_ssl_server_handshaker_factory(
 /* --- tsi_ssl utils. --- */
 
 int tsi_ssl_peer_matches_name(const tsi_peer* peer, const char* name) {
-  uint32_t i = 0;
+  size_t i = 0;
   const tsi_peer_property* property = tsi_peer_get_property_by_name(
       peer, TSI_X509_SUBJECT_COMMON_NAME_PEER_PROPERTY);
   if (property == NULL || property->type != TSI_PEER_PROPERTY_TYPE_STRING) {
diff --git a/src/core/tsi/ssl_transport_security.h b/src/core/tsi/ssl_transport_security.h
index de2b1df7bf..9c839b9d3a 100644
--- a/src/core/tsi/ssl_transport_security.h
+++ b/src/core/tsi/ssl_transport_security.h
@@ -89,9 +89,9 @@ typedef struct tsi_ssl_handshaker_factory tsi_ssl_handshaker_factory;
    - This method returns TSI_OK on success or TSI_INVALID_PARAMETER in the case
      where a parameter is invalid.  */
 tsi_result tsi_create_ssl_client_handshaker_factory(
-    const unsigned char* pem_private_key, uint32_t pem_private_key_size,
-    const unsigned char* pem_cert_chain, uint32_t pem_cert_chain_size,
-    const unsigned char* pem_root_certs, uint32_t pem_root_certs_size,
+    const unsigned char* pem_private_key, size_t pem_private_key_size,
+    const unsigned char* pem_cert_chain, size_t pem_cert_chain_size,
+    const unsigned char* pem_root_certs, size_t pem_root_certs_size,
     const char* cipher_suites, const unsigned char** alpn_protocols,
     const unsigned char* alpn_protocols_lengths, uint16_t num_alpn_protocols,
     tsi_ssl_handshaker_factory** factory);
@@ -132,11 +132,11 @@ tsi_result tsi_create_ssl_client_handshaker_factory(
      where a parameter is invalid.  */
 tsi_result tsi_create_ssl_server_handshaker_factory(
     const unsigned char** pem_private_keys,
-    const uint32_t* pem_private_keys_sizes,
+    const size_t* pem_private_keys_sizes,
     const unsigned char** pem_cert_chains,
-    const uint32_t* pem_cert_chains_sizes, uint32_t key_cert_pair_count,
+    const size_t* pem_cert_chains_sizes, size_t key_cert_pair_count,
     const unsigned char* pem_client_root_certs,
-    uint32_t pem_client_root_certs_size, const char* cipher_suites,
+    size_t pem_client_root_certs_size, const char* cipher_suites,
     const unsigned char** alpn_protocols,
     const unsigned char* alpn_protocols_lengths, uint16_t num_alpn_protocols,
     tsi_ssl_handshaker_factory** factory);
diff --git a/src/core/tsi/transport_security.c b/src/core/tsi/transport_security.c
index 5a42f03f5f..fcf03eeb95 100644
--- a/src/core/tsi/transport_security.c
+++ b/src/core/tsi/transport_security.c
@@ -40,7 +40,7 @@
 
 char* tsi_strdup(const char* src) {
   char* dst;
-  uint32_t len;
+  size_t len;
   if (!src) return NULL;
   len = strlen(src) + 1;
   dst = malloc(len);
@@ -90,9 +90,9 @@ const char* tsi_result_to_string(tsi_result result) {
 
 tsi_result tsi_frame_protector_protect(tsi_frame_protector* self,
                                        const unsigned char* unprotected_bytes,
-                                       uint32_t* unprotected_bytes_size,
+                                       size_t* unprotected_bytes_size,
                                        unsigned char* protected_output_frames,
-                                       uint32_t* protected_output_frames_size) {
+                                       size_t* protected_output_frames_size) {
   if (self == NULL || unprotected_bytes == NULL ||
       unprotected_bytes_size == NULL || protected_output_frames == NULL ||
       protected_output_frames_size == NULL) {
@@ -105,7 +105,7 @@ tsi_result tsi_frame_protector_protect(tsi_frame_protector* self,
 
 tsi_result tsi_frame_protector_protect_flush(
     tsi_frame_protector* self, unsigned char* protected_output_frames,
-    uint32_t* protected_output_frames_size, uint32_t* still_pending_size) {
+    size_t* protected_output_frames_size, size_t* still_pending_size) {
   if (self == NULL || protected_output_frames == NULL ||
       protected_output_frames == NULL || still_pending_size == NULL) {
     return TSI_INVALID_ARGUMENT;
@@ -117,8 +117,8 @@ tsi_result tsi_frame_protector_protect_flush(
 
 tsi_result tsi_frame_protector_unprotect(
     tsi_frame_protector* self, const unsigned char* protected_frames_bytes,
-    uint32_t* protected_frames_bytes_size, unsigned char* unprotected_bytes,
-    uint32_t* unprotected_bytes_size) {
+    size_t* protected_frames_bytes_size, unsigned char* unprotected_bytes,
+    size_t* unprotected_bytes_size) {
   if (self == NULL || protected_frames_bytes == NULL ||
       protected_frames_bytes_size == NULL || unprotected_bytes == NULL ||
       unprotected_bytes_size == NULL) {
@@ -140,7 +140,7 @@ void tsi_frame_protector_destroy(tsi_frame_protector* self) {
 
 tsi_result tsi_handshaker_get_bytes_to_send_to_peer(tsi_handshaker* self,
                                                     unsigned char* bytes,
-                                                    uint32_t* bytes_size) {
+                                                    size_t* bytes_size) {
   if (self == NULL) return TSI_INVALID_ARGUMENT;
   if (self->frame_protector_created) return TSI_FAILED_PRECONDITION;
   return self->vtable->get_bytes_to_send_to_peer(self, bytes, bytes_size);
@@ -148,7 +148,7 @@ tsi_result tsi_handshaker_get_bytes_to_send_to_peer(tsi_handshaker* self,
 
 tsi_result tsi_handshaker_process_bytes_from_peer(tsi_handshaker* self,
                                                   const unsigned char* bytes,
-                                                  uint32_t* bytes_size) {
+                                                  size_t* bytes_size) {
   if (self == NULL) return TSI_INVALID_ARGUMENT;
   if (self->frame_protector_created) return TSI_FAILED_PRECONDITION;
   return self->vtable->process_bytes_from_peer(self, bytes, bytes_size);
@@ -171,7 +171,7 @@ tsi_result tsi_handshaker_extract_peer(tsi_handshaker* self, tsi_peer* peer) {
 }
 
 tsi_result tsi_handshaker_create_frame_protector(
-    tsi_handshaker* self, uint32_t* max_protected_frame_size,
+    tsi_handshaker* self, size_t* max_protected_frame_size,
     tsi_frame_protector** protector) {
   tsi_result result;
   if (self == NULL || protector == NULL) return TSI_INVALID_ARGUMENT;
@@ -196,7 +196,7 @@ void tsi_handshaker_destroy(tsi_handshaker* self) {
 
 const tsi_peer_property* tsi_peer_get_property_by_name(const tsi_peer* self,
                                                        const char* name) {
-  uint32_t i;
+  size_t i;
   if (self == NULL) return NULL;
   for (i = 0; i < self->property_count; i++) {
     const tsi_peer_property* property = &self->properties[i];
@@ -218,8 +218,8 @@ tsi_peer_property tsi_init_peer_property(void) {
 }
 
 static void tsi_peer_destroy_list_property(tsi_peer_property* children,
-                                           uint32_t child_count) {
-  uint32_t i;
+                                           size_t child_count) {
+  size_t i;
   for (i = 0; i < child_count; i++) {
     tsi_peer_property_destruct(&children[i]);
   }
@@ -292,7 +292,7 @@ tsi_result tsi_construct_real_peer_property(const char* name, double value,
 }
 
 tsi_result tsi_construct_allocated_string_peer_property(
-    const char* name, uint32_t value_length, tsi_peer_property* property) {
+    const char* name, size_t value_length, tsi_peer_property* property) {
   *property = tsi_init_peer_property();
   property->type = TSI_PEER_PROPERTY_TYPE_STRING;
   if (name != NULL) {
@@ -318,7 +318,7 @@ tsi_result tsi_construct_string_peer_property_from_cstring(
 
 tsi_result tsi_construct_string_peer_property(const char* name,
                                               const char* value,
-                                              uint32_t value_length,
+                                              size_t value_length,
                                               tsi_peer_property* property) {
   tsi_result result = tsi_construct_allocated_string_peer_property(
       name, value_length, property);
@@ -330,7 +330,7 @@ tsi_result tsi_construct_string_peer_property(const char* name,
 }
 
 tsi_result tsi_construct_list_peer_property(const char* name,
-                                            uint32_t child_count,
+                                            size_t child_count,
                                             tsi_peer_property* property) {
   *property = tsi_init_peer_property();
   property->type = TSI_PEER_PROPERTY_TYPE_LIST;
@@ -350,7 +350,7 @@ tsi_result tsi_construct_list_peer_property(const char* name,
   return TSI_OK;
 }
 
-tsi_result tsi_construct_peer(uint32_t property_count, tsi_peer* peer) {
+tsi_result tsi_construct_peer(size_t property_count, tsi_peer* peer) {
   memset(peer, 0, sizeof(tsi_peer));
   if (property_count > 0) {
     peer->properties = calloc(property_count, sizeof(tsi_peer_property));
diff --git a/src/core/tsi/transport_security.h b/src/core/tsi/transport_security.h
index 9a20fa83a5..3a6ed5290b 100644
--- a/src/core/tsi/transport_security.h
+++ b/src/core/tsi/transport_security.h
@@ -45,18 +45,18 @@ extern "C" {
 typedef struct {
   tsi_result (*protect)(tsi_frame_protector* self,
                         const unsigned char* unprotected_bytes,
-                        uint32_t* unprotected_bytes_size,
+                        size_t* unprotected_bytes_size,
                         unsigned char* protected_output_frames,
-                        uint32_t* protected_output_frames_size);
+                        size_t* protected_output_frames_size);
   tsi_result (*protect_flush)(tsi_frame_protector* self,
                               unsigned char* protected_output_frames,
-                              uint32_t* protected_output_frames_size,
-                              uint32_t* still_pending_size);
+                              size_t* protected_output_frames_size,
+                              size_t* still_pending_size);
   tsi_result (*unprotect)(tsi_frame_protector* self,
                           const unsigned char* protected_frames_bytes,
-                          uint32_t* protected_frames_bytes_size,
+                          size_t* protected_frames_bytes_size,
                           unsigned char* unprotected_bytes,
-                          uint32_t* unprotected_bytes_size);
+                          size_t* unprotected_bytes_size);
   void (*destroy)(tsi_frame_protector* self);
 } tsi_frame_protector_vtable;
 
@@ -69,14 +69,14 @@ struct tsi_frame_protector {
 typedef struct {
   tsi_result (*get_bytes_to_send_to_peer)(tsi_handshaker* self,
                                           unsigned char* bytes,
-                                          uint32_t* bytes_size);
+                                          size_t* bytes_size);
   tsi_result (*process_bytes_from_peer)(tsi_handshaker* self,
                                         const unsigned char* bytes,
-                                        uint32_t* bytes_size);
+                                        size_t* bytes_size);
   tsi_result (*get_result)(tsi_handshaker* self);
   tsi_result (*extract_peer)(tsi_handshaker* self, tsi_peer* peer);
   tsi_result (*create_frame_protector)(tsi_handshaker* self,
-                                       uint32_t* max_protected_frame_size,
+                                       size_t* max_protected_frame_size,
                                        tsi_frame_protector** protector);
   void (*destroy)(tsi_handshaker* self);
 } tsi_handshaker_vtable;
@@ -87,7 +87,7 @@ struct tsi_handshaker {
 };
 
 /* Peer and property construction/destruction functions. */
-tsi_result tsi_construct_peer(uint32_t property_count, tsi_peer* peer);
+tsi_result tsi_construct_peer(size_t property_count, tsi_peer* peer);
 tsi_peer_property tsi_init_peer_property(void);
 void tsi_peer_property_destruct(tsi_peer_property* property);
 tsi_result tsi_construct_signed_integer_peer_property(
@@ -98,14 +98,14 @@ tsi_result tsi_construct_real_peer_property(const char* name, double value,
                                             tsi_peer_property* property);
 tsi_result tsi_construct_string_peer_property(const char* name,
                                               const char* value,
-                                              uint32_t value_length,
+                                              size_t value_length,
                                               tsi_peer_property* property);
 tsi_result tsi_construct_allocated_string_peer_property(
-    const char* name, uint32_t value_length, tsi_peer_property* property);
+    const char* name, size_t value_length, tsi_peer_property* property);
 tsi_result tsi_construct_string_peer_property_from_cstring(
     const char* name, const char* value, tsi_peer_property* property);
 tsi_result tsi_construct_list_peer_property(const char* name,
-                                            uint32_t child_count,
+                                            size_t child_count,
                                             tsi_peer_property* property);
 
 /* Utils. */
diff --git a/src/core/tsi/transport_security_interface.h b/src/core/tsi/transport_security_interface.h
index 76746a4b20..d180e90799 100644
--- a/src/core/tsi/transport_security_interface.h
+++ b/src/core/tsi/transport_security_interface.h
@@ -35,6 +35,7 @@
 #define __TRANSPORT_SECURITY_INTERFACE_H_
 
 #include <stdint.h>
+#include <stdlib.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -89,11 +90,11 @@ typedef struct tsi_frame_protector tsi_frame_protector;
 
    ------------------------------------------------------------------------
    unsigned char protected_buffer[4096];
-   uint32_t protected_buffer_size = sizeof(protected_buffer);
+   size_t protected_buffer_size = sizeof(protected_buffer);
    tsi_result result = TSI_OK;
    while (message_size > 0) {
-     uint32_t protected_buffer_size_to_send = protected_buffer_size;
-     uint32_t processed_message_size = message_size;
+     size_t protected_buffer_size_to_send = protected_buffer_size;
+     size_t processed_message_size = message_size;
      result = tsi_frame_protector_protect(protector,
                                           message_bytes,
                                           &processed_message_size,
@@ -106,7 +107,7 @@ typedef struct tsi_frame_protector tsi_frame_protector;
 
      // Don't forget to flush.
      if (message_size == 0) {
-       uint32_t still_pending_size;
+       size_t still_pending_size;
        do {
          protected_buffer_size_to_send = protected_buffer_size;
          result = tsi_frame_protector_protect_flush(
@@ -122,9 +123,9 @@ typedef struct tsi_frame_protector tsi_frame_protector;
    ------------------------------------------------------------------------  */
 tsi_result tsi_frame_protector_protect(tsi_frame_protector* self,
                                        const unsigned char* unprotected_bytes,
-                                       uint32_t* unprotected_bytes_size,
+                                       size_t* unprotected_bytes_size,
                                        unsigned char* protected_output_frames,
-                                       uint32_t* protected_output_frames_size);
+                                       size_t* protected_output_frames_size);
 
 /* Indicates that we need to flush the bytes buffered in the protector and get
    the resulting frame.
@@ -136,7 +137,7 @@ tsi_result tsi_frame_protector_protect(tsi_frame_protector* self,
      that still need to be flushed from the protector.*/
 tsi_result tsi_frame_protector_protect_flush(
     tsi_frame_protector* self, unsigned char* protected_output_frames,
-    uint32_t* protected_output_frames_size, uint32_t* still_pending_size);
+    size_t* protected_output_frames_size, size_t* still_pending_size);
 
 /* Outputs unprotected bytes.
    - protected_frames_bytes is an input only parameter and points to the
@@ -160,8 +161,8 @@ tsi_result tsi_frame_protector_protect_flush(
      protected_frames_size will be set to 0.  */
 tsi_result tsi_frame_protector_unprotect(
     tsi_frame_protector* self, const unsigned char* protected_frames_bytes,
-    uint32_t* protected_frames_bytes_size, unsigned char* unprotected_bytes,
-    uint32_t* unprotected_bytes_size);
+    size_t* protected_frames_bytes_size, unsigned char* unprotected_bytes,
+    size_t* unprotected_bytes_size);
 
 /* Destroys the tsi_frame_protector object.  */
 void tsi_frame_protector_destroy(tsi_frame_protector* self);
@@ -194,18 +195,18 @@ typedef struct tsi_peer_property {
     double real;
     struct {
       char* data;
-      uint32_t length;
+      size_t length;
     } string;
     struct {
       struct tsi_peer_property* children;
-      uint32_t child_count;
+      size_t child_count;
     } list;
   } value;
 } tsi_peer_property;
 
 typedef struct {
   tsi_peer_property* properties;
-  uint32_t property_count;
+  size_t property_count;
 } tsi_peer;
 
 /* Gets the first property with the specified name. Iteration over the
@@ -227,12 +228,12 @@ void tsi_peer_destruct(tsi_peer* self);
    ------------------------------------------------------------------------
    tsi_result result = TSI_OK;
    unsigned char buf[4096];
-   uint32_t buf_offset;
-   uint32_t buf_size;
+   size_t buf_offset;
+   size_t buf_size;
    while (1) {
      // See if we need to send some bytes to the peer.
      do {
-       uint32_t buf_size_to_send = sizeof(buf);
+       size_t buf_size_to_send = sizeof(buf);
        result = tsi_handshaker_get_bytes_to_send_to_peer(handshaker, buf,
                                                          &buf_size_to_send);
        if (buf_size_to_send > 0) send_bytes_to_peer(buf, buf_size_to_send);
@@ -250,7 +251,7 @@ void tsi_peer_destruct(tsi_peer* self);
        // Process the bytes from the peer. We have to be careful as these bytes
        // may contain non-handshake data (protected data). If this is the case,
        // we will exit from the loop with buf_size > 0.
-       uint32_t consumed_by_handshaker = buf_size;
+       size_t consumed_by_handshaker = buf_size;
        result = tsi_handshaker_process_bytes_from_peer(
            handshaker, buf, &consumed_by_handshaker);
        buf_size -= consumed_by_handshaker;
@@ -300,7 +301,7 @@ typedef struct tsi_handshaker tsi_handshaker;
    error in the handshake, another specific error code is returned.  */
 tsi_result tsi_handshaker_get_bytes_to_send_to_peer(tsi_handshaker* self,
                                                     unsigned char* bytes,
-                                                    uint32_t* bytes_size);
+                                                    size_t* bytes_size);
 
 /* Processes bytes received from the peer.
    - bytes is the buffer containing the data.
@@ -313,7 +314,7 @@ tsi_result tsi_handshaker_get_bytes_to_send_to_peer(tsi_handshaker* self,
    returned.  */
 tsi_result tsi_handshaker_process_bytes_from_peer(tsi_handshaker* self,
                                                   const unsigned char* bytes,
-                                                  uint32_t* bytes_size);
+                                                  size_t* bytes_size);
 
 /* Gets the result of the handshaker.
    Returns TSI_OK if the hanshake completed successfully and there has been no
@@ -349,7 +350,7 @@ tsi_result tsi_handshaker_extract_peer(tsi_handshaker* self, tsi_peer* peer);
    the handshaker is not in a fatal error state.
    The caller is responsible for destroying the protector.  */
 tsi_result tsi_handshaker_create_frame_protector(
-    tsi_handshaker* self, uint32_t* max_output_protected_frame_size,
+    tsi_handshaker* self, size_t* max_output_protected_frame_size,
     tsi_frame_protector** protector);
 
 /* This method releases the tsi_handshaker object. After this method is called,
diff --git a/templates/Makefile.template b/templates/Makefile.template
index 25bc4069a1..9a49935e49 100644
--- a/templates/Makefile.template
+++ b/templates/Makefile.template
@@ -318,18 +318,20 @@ run_dep_checks:
 	$(ZLIB_CHECK_CMD) || true
 
 libs/$(CONFIG)/zlib/libz.a:
-	(cd third_party/zlib ; CC="$(CC)" CFLAGS="-fPIC -fvisibility=hidden $(CPPFLAGS_$(CONFIG))" ./configure --static)
-	$(MAKE) -C third_party/zlib clean
-	$(MAKE) -C third_party/zlib
-	mkdir -p libs/$(CONFIG)/zlib
-	cp third_party/zlib/libz.a libs/$(CONFIG)/zlib
+	$(E) "[MAKE]    Building zlib"
+	$(Q)(cd third_party/zlib ; CC="$(CC)" CFLAGS="-fPIC -fvisibility=hidden $(CPPFLAGS_$(CONFIG))" ./configure --static)
+	$(Q)$(MAKE) -C third_party/zlib clean
+	$(Q)$(MAKE) -C third_party/zlib
+	$(Q)mkdir -p libs/$(CONFIG)/zlib
+	$(Q)cp third_party/zlib/libz.a libs/$(CONFIG)/zlib
 
 libs/$(CONFIG)/openssl/libssl.a:
-	(cd third_party/openssl ; CC="$(CC) -fPIC -fvisibility=hidden $(CPPFLAGS_$(CONFIG)) $(OPENSSL_CFLAGS_$(CONFIG))" ./config $(OPENSSL_CONFIG_$(CONFIG)))
-	$(MAKE) -C third_party/openssl clean
-	$(MAKE) -C third_party/openssl build_crypto build_ssl
-	mkdir -p libs/$(CONFIG)/openssl
-	cp third_party/openssl/libssl.a third_party/openssl/libcrypto.a libs/$(CONFIG)/openssl
+	$(E) "[MAKE]    Building openssl"
+	$(Q)(cd third_party/openssl ; CC="$(CC) -fPIC -fvisibility=hidden $(CPPFLAGS_$(CONFIG)) $(OPENSSL_CFLAGS_$(CONFIG))" ./config $(OPENSSL_CONFIG_$(CONFIG)))
+	$(Q)$(MAKE) -C third_party/openssl clean
+	$(Q)$(MAKE) -C third_party/openssl build_crypto build_ssl
+	$(Q)mkdir -p libs/$(CONFIG)/openssl
+	$(Q)cp third_party/openssl/libssl.a third_party/openssl/libcrypto.a libs/$(CONFIG)/openssl
 
 static: static_c static_cxx
 
@@ -658,6 +660,12 @@ endif
 
 else
 
+ifneq ($(OPENSSL_DEP),)
+% for src in lib.src:
+${src}: $(OPENSSL_DEP)
+% endfor
+endif
+
 libs/$(CONFIG)/lib${lib.name}.a: $(ZLIB_DEP) $(OPENSSL_DEP) $(LIB${lib.name.upper()}_OBJS)
 % else:
 libs/$(CONFIG)/lib${lib.name}.a: $(ZLIB_DEP) $(LIB${lib.name.upper()}_OBJS)
diff --git a/test/core/security/secure_endpoint_test.c b/test/core/security/secure_endpoint_test.c
index 2e23b6a2cd..0db15d48b4 100644
--- a/test/core/security/secure_endpoint_test.c
+++ b/test/core/security/secure_endpoint_test.c
@@ -61,7 +61,7 @@ static grpc_endpoint_test_fixture secure_endpoint_create_fixture_tcp_socketpair(
   } else {
     int i;
     tsi_result result;
-    gpr_uint32 still_pending_size;
+    size_t still_pending_size;
     size_t total_buffer_size = 8192;
     size_t buffer_size = total_buffer_size;
     gpr_uint8 *encrypted_buffer = gpr_malloc(buffer_size);
@@ -72,8 +72,8 @@ static grpc_endpoint_test_fixture secure_endpoint_create_fixture_tcp_socketpair(
       gpr_uint8 *message_bytes = GPR_SLICE_START_PTR(plain);
       size_t message_size = GPR_SLICE_LENGTH(plain);
       while (message_size > 0) {
-        gpr_uint32 protected_buffer_size_to_send = buffer_size;
-        gpr_uint32 processed_message_size = message_size;
+        size_t protected_buffer_size_to_send = buffer_size;
+        size_t processed_message_size = message_size;
         result = tsi_frame_protector_protect(
             fake_write_protector, message_bytes, &processed_message_size, cur,
             &protected_buffer_size_to_send);
@@ -88,7 +88,7 @@ static grpc_endpoint_test_fixture secure_endpoint_create_fixture_tcp_socketpair(
       gpr_slice_unref(plain);
     }
     do {
-      gpr_uint32 protected_buffer_size_to_send = buffer_size;
+      size_t protected_buffer_size_to_send = buffer_size;
       result = tsi_frame_protector_protect_flush(fake_write_protector, cur,
                                                  &protected_buffer_size_to_send,
                                                  &still_pending_size);
diff --git a/tools/run_tests/jobset.py b/tools/run_tests/jobset.py
index bb1c862f1a..7a6d979ba3 100755
--- a/tools/run_tests/jobset.py
+++ b/tools/run_tests/jobset.py
@@ -1,6 +1,8 @@
 """Run a group of subprocesses and then finish."""
 
+import hashlib
 import multiprocessing
+import os
 import random
 import subprocess
 import sys
@@ -75,30 +77,43 @@ def message(tag, message, explanatory_text=None, do_newline=False):
   sys.stdout.flush()
 
 
+def which(filename):
+  if '/' in filename:
+    return filename
+  for path in os.environ['PATH'].split(os.pathsep):
+    if os.path.exists(os.path.join(path, filename)):
+      return os.path.join(path, filename)
+  raise Exception('%s not found' % filename)
+
+
 class Job(object):
   """Manages one job."""
 
-  def __init__(self, cmdline, newline_on_success):
-    self._cmdline = ' '.join(cmdline)
+  def __init__(self, cmdline, bin_hash, newline_on_success):
+    self._cmdline = cmdline
+    self._bin_hash = bin_hash
     self._tempfile = tempfile.TemporaryFile()
     self._process = subprocess.Popen(args=cmdline,
                                      stderr=subprocess.STDOUT,
                                      stdout=self._tempfile)
     self._state = _RUNNING
     self._newline_on_success = newline_on_success
-    message('START', self._cmdline)
+    message('START', ' '.join(self._cmdline))
 
-  def state(self):
+  def state(self, update_cache):
     """Poll current state of the job. Prints messages at completion."""
     if self._state == _RUNNING and self._process.poll() is not None:
       if self._process.returncode != 0:
         self._state = _FAILURE
         self._tempfile.seek(0)
         stdout = self._tempfile.read()
-        message('FAILED', '%s [ret=%d]' % (self._cmdline, self._process.returncode), stdout)
+        message('FAILED', '%s [ret=%d]' % (
+            ' '.join(self._cmdline), self._process.returncode), stdout)
       else:
         self._state = _SUCCESS
-        message('PASSED', '%s' % self._cmdline, do_newline=self._newline_on_success)
+        message('PASSED', '%s' % ' '.join(self._cmdline),
+                do_newline=self._newline_on_success)
+        update_cache.finished(self._cmdline, self._bin_hash)
     return self._state
 
   def kill(self):
@@ -110,7 +125,7 @@ class Job(object):
 class Jobset(object):
   """Manages one run of jobs."""
 
-  def __init__(self, check_cancelled, maxjobs, newline_on_success):
+  def __init__(self, check_cancelled, maxjobs, newline_on_success, cache):
     self._running = set()
     self._check_cancelled = check_cancelled
     self._cancelled = False
@@ -118,6 +133,7 @@ class Jobset(object):
     self._completed = 0
     self._maxjobs = maxjobs
     self._newline_on_success = newline_on_success
+    self._cache = cache
 
   def start(self, cmdline):
     """Start a job. Return True on success, False on failure."""
@@ -125,7 +141,10 @@ class Jobset(object):
       if self.cancelled(): return False
       self.reap()
     if self.cancelled(): return False
-    self._running.add(Job(cmdline, self._newline_on_success))
+    with open(which(cmdline[0])) as f:
+      bin_hash = hashlib.sha1(f.read()).hexdigest()
+    if self._cache.should_run(cmdline, bin_hash):
+      self._running.add(Job(cmdline, bin_hash, self._newline_on_success))
     return True
 
   def reap(self):
@@ -133,7 +152,7 @@ class Jobset(object):
     while self._running:
       dead = set()
       for job in self._running:
-        st = job.state()
+        st = job.state(self._cache)
         if st == _RUNNING: continue
         if st == _FAILURE: self._failures += 1
         dead.add(job)
@@ -165,13 +184,24 @@ def _never_cancelled():
   return False
 
 
+# cache class that caches nothing
+class NoCache(object):
+  def should_run(self, cmdline, bin_hash):
+    return True
+
+  def finished(self, cmdline, bin_hash):
+    pass
+
+
 def run(cmdlines,
         check_cancelled=_never_cancelled,
         maxjobs=None,
-        newline_on_success=False):
+        newline_on_success=False,
+        cache=None):
   js = Jobset(check_cancelled,
               maxjobs if maxjobs is not None else _DEFAULT_MAX_JOBS,
-              newline_on_success)
+              newline_on_success,
+              cache if cache is not None else NoCache())
   for cmdline in shuffle_iteratable(cmdlines):
     if not js.start(cmdline):
       break
diff --git a/tools/run_tests/run_tests.py b/tools/run_tests/run_tests.py
index aa3245d830..e8c121456a 100755
--- a/tools/run_tests/run_tests.py
+++ b/tools/run_tests/run_tests.py
@@ -5,14 +5,18 @@ import argparse
 import glob
 import itertools
 import multiprocessing
+import os
 import sys
 import time
 
 import jobset
+import simplejson
 import watch_dirs
 
+
 # SimpleConfig: just compile with CONFIG=config, and run the binary to test
 class SimpleConfig(object):
+
   def __init__(self, config):
     self.build_config = config
     self.maxjobs = 32 * multiprocessing.cpu_count()
@@ -23,6 +27,7 @@ class SimpleConfig(object):
 
 # ValgrindConfig: compile with some CONFIG=config, but use valgrind to run
 class ValgrindConfig(object):
+
   def __init__(self, config, tool):
     self.build_config = config
     self.tool = tool
@@ -34,15 +39,15 @@ class ValgrindConfig(object):
 
 # different configurations we can run under
 _CONFIGS = {
-  'dbg': SimpleConfig('dbg'),
-  'opt': SimpleConfig('opt'),
-  'tsan': SimpleConfig('tsan'),
-  'msan': SimpleConfig('msan'),
-  'asan': SimpleConfig('asan'),
-  'gcov': SimpleConfig('gcov'),
-  'memcheck': ValgrindConfig('valgrind', 'memcheck'),
-  'helgrind': ValgrindConfig('dbg', 'helgrind')
-  }
+    'dbg': SimpleConfig('dbg'),
+    'opt': SimpleConfig('opt'),
+    'tsan': SimpleConfig('tsan'),
+    'msan': SimpleConfig('msan'),
+    'asan': SimpleConfig('asan'),
+    'gcov': SimpleConfig('gcov'),
+    'memcheck': ValgrindConfig('valgrind', 'memcheck'),
+    'helgrind': ValgrindConfig('dbg', 'helgrind')
+    }
 
 
 _DEFAULT = ['dbg', 'opt']
@@ -85,7 +90,41 @@ runs_per_test = args.runs_per_test
 forever = args.forever
 
 
-def _build_and_run(check_cancelled, newline_on_success, forever=False):
+class TestCache(object):
+  """Cache for running tests."""
+
+  def __init__(self):
+    self._last_successful_run = {}
+
+  def should_run(self, cmdline, bin_hash):
+    cmdline = ' '.join(cmdline)
+    if cmdline not in self._last_successful_run:
+      return True
+    if self._last_successful_run[cmdline] != bin_hash:
+      return True
+    return False
+
+  def finished(self, cmdline, bin_hash):
+    self._last_successful_run[' '.join(cmdline)] = bin_hash
+
+  def dump(self):
+    return [{'cmdline': k, 'hash': v}
+            for k, v in self._last_successful_run.iteritems()]
+
+  def parse(self, exdump):
+    self._last_successful_run = dict((o['cmdline'], o['hash']) for o in exdump)
+
+  def save(self):
+    with open('.run_tests_cache', 'w') as f:
+      f.write(simplejson.dumps(self.dump()))
+
+  def maybe_load(self):
+    if os.path.exists('.run_tests_cache'):
+      with open('.run_tests_cache') as f:
+        self.parse(simplejson.loads(f.read()))
+
+
+def _build_and_run(check_cancelled, newline_on_success, cache):
   """Do one pass of building & running tests."""
   # build latest, sharing cpu between the various makes
   if not jobset.run(
@@ -107,14 +146,22 @@ def _build_and_run(check_cancelled, newline_on_success, forever=False):
                   glob.glob('bins/%s/%s_test' % (
                       config.build_config, filt)),
                   runs_per_test)))),
-              check_cancelled,
-              newline_on_success=newline_on_success,
-              maxjobs=min(c.maxjobs for c in run_configs)):
+      check_cancelled,
+      newline_on_success=newline_on_success,
+      maxjobs=min(c.maxjobs for c in run_configs),
+      cache=cache):
     return 2
 
   return 0
 
 
+test_cache = (None if runs_per_test != 1
+              or 'gcov' in build_configs
+              or 'valgrind' in build_configs
+              else TestCache())
+if test_cache:
+  test_cache.maybe_load()
+
 if forever:
   success = True
   while True:
@@ -122,9 +169,9 @@ if forever:
     initial_time = dw.most_recent_change()
     have_files_changed = lambda: dw.most_recent_change() != initial_time
     previous_success = success
-    success = _build_and_run(have_files_changed,
+    success = _build_and_run(check_cancelled=have_files_changed,
                              newline_on_success=False,
-                             forever=True) == 0
+                             cache=test_cache) == 0
     if not previous_success and success:
       jobset.message('SUCCESS',
                      'All tests are now passing properly',
@@ -133,10 +180,12 @@ if forever:
     while not have_files_changed():
       time.sleep(1)
 else:
-  result = _build_and_run(lambda: False,
-                          newline_on_success=args.newline_on_success)
+  result = _build_and_run(check_cancelled=lambda: False,
+                          newline_on_success=args.newline_on_success,
+                          cache=test_cache)
   if result == 0:
     jobset.message('SUCCESS', 'All tests passed', do_newline=True)
   else:
     jobset.message('FAILED', 'Some tests failed', do_newline=True)
+  test_cache.save()
   sys.exit(result)