Merge remote-tracking branch 'upstream/master' into pass_args_to_tsi

20 files changed, 527 insertions, 516 deletions

diff --git a/src/core/lib/security/context/security_context.cc b/src/core/lib/security/context/security_context.cc
index b2b90e86e0..36362d95bb 100644
--- a/src/core/lib/security/context/security_context.cc
+++ b/src/core/lib/security/context/security_context.cc
@@ -39,7 +39,7 @@ grpc_tracer_flag grpc_trace_auth_context_refcount =
 grpc_call_error grpc_call_set_credentials(grpc_call* call,
                                           grpc_call_credentials* creds) {
   grpc_exec_ctx exec_ctx = GRPC_EXEC_CTX_INIT;
-  grpc_client_security_context* ctx = NULL;
+  grpc_client_security_context* ctx = nullptr;
   GRPC_API_TRACE("grpc_call_set_credentials(call=%p, creds=%p)", 2,
                  (call, creds));
   if (!grpc_call_is_client(call)) {
@@ -48,7 +48,7 @@ grpc_call_error grpc_call_set_credentials(grpc_call* call,
   }
   ctx = (grpc_client_security_context*)grpc_call_context_get(
       call, GRPC_CONTEXT_SECURITY);
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     ctx = grpc_client_security_context_create();
     ctx->creds = grpc_call_credentials_ref(creds);
     grpc_call_context_set(call, GRPC_CONTEXT_SECURITY, ctx,
@@ -64,7 +64,7 @@ grpc_call_error grpc_call_set_credentials(grpc_call* call,
 grpc_auth_context* grpc_call_auth_context(grpc_call* call) {
   void* sec_ctx = grpc_call_context_get(call, GRPC_CONTEXT_SECURITY);
   GRPC_API_TRACE("grpc_call_auth_context(call=%p)", 1, (call));
-  if (sec_ctx == NULL) return NULL;
+  if (sec_ctx == nullptr) return nullptr;
   return grpc_call_is_client(call)
              ? GRPC_AUTH_CONTEXT_REF(
                    ((grpc_client_security_context*)sec_ctx)->auth_context,
@@ -91,7 +91,7 @@ void grpc_client_security_context_destroy(void* ctx) {
   grpc_client_security_context* c = (grpc_client_security_context*)ctx;
   grpc_call_credentials_unref(&exec_ctx, c->creds);
   GRPC_AUTH_CONTEXT_UNREF(c->auth_context, "client_security_context");
-  if (c->extension.instance != NULL && c->extension.destroy != NULL) {
+  if (c->extension.instance != nullptr && c->extension.destroy != nullptr) {
     c->extension.destroy(c->extension.instance);
   }
   gpr_free(ctx);
@@ -108,7 +108,7 @@ grpc_server_security_context* grpc_server_security_context_create(void) {
 void grpc_server_security_context_destroy(void* ctx) {
   grpc_server_security_context* c = (grpc_server_security_context*)ctx;
   GRPC_AUTH_CONTEXT_UNREF(c->auth_context, "server_security_context");
-  if (c->extension.instance != NULL && c->extension.destroy != NULL) {
+  if (c->extension.instance != nullptr && c->extension.destroy != nullptr) {
     c->extension.destroy(c->extension.instance);
   }
   gpr_free(ctx);
@@ -116,13 +116,13 @@ void grpc_server_security_context_destroy(void* ctx) {
 
 /* --- grpc_auth_context --- */
 
-static grpc_auth_property_iterator empty_iterator = {NULL, 0, NULL};
+static grpc_auth_property_iterator empty_iterator = {nullptr, 0, nullptr};
 
 grpc_auth_context* grpc_auth_context_create(grpc_auth_context* chained) {
   grpc_auth_context* ctx =
       (grpc_auth_context*)gpr_zalloc(sizeof(grpc_auth_context));
   gpr_ref_init(&ctx->refcount, 1);
-  if (chained != NULL) {
+  if (chained != nullptr) {
     ctx->chained = GRPC_AUTH_CONTEXT_REF(chained, "chained");
     ctx->peer_identity_property_name =
         ctx->chained->peer_identity_property_name;
@@ -134,7 +134,7 @@ grpc_auth_context* grpc_auth_context_create(grpc_auth_context* chained) {
 grpc_auth_context* grpc_auth_context_ref(grpc_auth_context* ctx,
                                          const char* file, int line,
                                          const char* reason) {
-  if (ctx == NULL) return NULL;
+  if (ctx == nullptr) return nullptr;
   if (GRPC_TRACER_ON(grpc_trace_auth_context_refcount)) {
     gpr_atm val = gpr_atm_no_barrier_load(&ctx->refcount.count);
     gpr_log(file, line, GPR_LOG_SEVERITY_DEBUG,
@@ -152,7 +152,7 @@ grpc_auth_context* grpc_auth_context_ref(grpc_auth_context* ctx) {
 #ifndef NDEBUG
 void grpc_auth_context_unref(grpc_auth_context* ctx, const char* file, int line,
                              const char* reason) {
-  if (ctx == NULL) return;
+  if (ctx == nullptr) return;
   if (GRPC_TRACER_ON(grpc_trace_auth_context_refcount)) {
     gpr_atm val = gpr_atm_no_barrier_load(&ctx->refcount.count);
     gpr_log(file, line, GPR_LOG_SEVERITY_DEBUG,
@@ -166,7 +166,7 @@ void grpc_auth_context_unref(grpc_auth_context* ctx) {
   if (gpr_unref(&ctx->refcount)) {
     size_t i;
     GRPC_AUTH_CONTEXT_UNREF(ctx->chained, "chained");
-    if (ctx->properties.array != NULL) {
+    if (ctx->properties.array != nullptr) {
       for (i = 0; i < ctx->properties.count; i++) {
         grpc_auth_property_reset(&ctx->properties.array[i]);
       }
@@ -191,9 +191,9 @@ int grpc_auth_context_set_peer_identity_property_name(grpc_auth_context* ctx,
   GRPC_API_TRACE(
       "grpc_auth_context_set_peer_identity_property_name(ctx=%p, name=%s)", 2,
       (ctx, name));
-  if (prop == NULL) {
+  if (prop == nullptr) {
     gpr_log(GPR_ERROR, "Property name %s not found in auth context.",
-            name != NULL ? name : "NULL");
+            name != nullptr ? name : "NULL");
     return 0;
   }
   ctx->peer_identity_property_name = prop->name;
@@ -202,14 +202,14 @@ int grpc_auth_context_set_peer_identity_property_name(grpc_auth_context* ctx,
 
 int grpc_auth_context_peer_is_authenticated(const grpc_auth_context* ctx) {
   GRPC_API_TRACE("grpc_auth_context_peer_is_authenticated(ctx=%p)", 1, (ctx));
-  return ctx->peer_identity_property_name == NULL ? 0 : 1;
+  return ctx->peer_identity_property_name == nullptr ? 0 : 1;
 }
 
 grpc_auth_property_iterator grpc_auth_context_property_iterator(
     const grpc_auth_context* ctx) {
   grpc_auth_property_iterator it = empty_iterator;
   GRPC_API_TRACE("grpc_auth_context_property_iterator(ctx=%p)", 1, (ctx));
-  if (ctx == NULL) return it;
+  if (ctx == nullptr) return it;
   it.ctx = ctx;
   return it;
 }
@@ -217,18 +217,18 @@ grpc_auth_property_iterator grpc_auth_context_property_iterator(
 const grpc_auth_property* grpc_auth_property_iterator_next(
     grpc_auth_property_iterator* it) {
   GRPC_API_TRACE("grpc_auth_property_iterator_next(it=%p)", 1, (it));
-  if (it == NULL || it->ctx == NULL) return NULL;
+  if (it == nullptr || it->ctx == nullptr) return nullptr;
   while (it->index == it->ctx->properties.count) {
-    if (it->ctx->chained == NULL) return NULL;
+    if (it->ctx->chained == nullptr) return nullptr;
     it->ctx = it->ctx->chained;
     it->index = 0;
   }
-  if (it->name == NULL) {
+  if (it->name == nullptr) {
     return &it->ctx->properties.array[it->index++];
   } else {
     while (it->index < it->ctx->properties.count) {
       const grpc_auth_property* prop = &it->ctx->properties.array[it->index++];
-      GPR_ASSERT(prop->name != NULL);
+      GPR_ASSERT(prop->name != nullptr);
       if (strcmp(it->name, prop->name) == 0) {
         return prop;
       }
@@ -243,7 +243,7 @@ grpc_auth_property_iterator grpc_auth_context_find_properties_by_name(
   grpc_auth_property_iterator it = empty_iterator;
   GRPC_API_TRACE("grpc_auth_context_find_properties_by_name(ctx=%p, name=%s)",
                  2, (ctx, name));
-  if (ctx == NULL || name == NULL) return empty_iterator;
+  if (ctx == nullptr || name == nullptr) return empty_iterator;
   it.ctx = ctx;
   it.name = name;
   return it;
@@ -252,7 +252,7 @@ grpc_auth_property_iterator grpc_auth_context_find_properties_by_name(
 grpc_auth_property_iterator grpc_auth_context_peer_identity(
     const grpc_auth_context* ctx) {
   GRPC_API_TRACE("grpc_auth_context_peer_identity(ctx=%p)", 1, (ctx));
-  if (ctx == NULL) return empty_iterator;
+  if (ctx == nullptr) return empty_iterator;
   return grpc_auth_context_find_properties_by_name(
       ctx, ctx->peer_identity_property_name);
 }
@@ -326,11 +326,11 @@ grpc_arg grpc_auth_context_to_arg(grpc_auth_context* p) {
 }
 
 grpc_auth_context* grpc_auth_context_from_arg(const grpc_arg* arg) {
-  if (strcmp(arg->key, GRPC_AUTH_CONTEXT_ARG) != 0) return NULL;
+  if (strcmp(arg->key, GRPC_AUTH_CONTEXT_ARG) != 0) return nullptr;
   if (arg->type != GRPC_ARG_POINTER) {
     gpr_log(GPR_ERROR, "Invalid type %d for arg %s", arg->type,
             GRPC_AUTH_CONTEXT_ARG);
-    return NULL;
+    return nullptr;
   }
   return (grpc_auth_context*)arg->value.pointer.p;
 }
@@ -338,10 +338,10 @@ grpc_auth_context* grpc_auth_context_from_arg(const grpc_arg* arg) {
 grpc_auth_context* grpc_find_auth_context_in_args(
     const grpc_channel_args* args) {
   size_t i;
-  if (args == NULL) return NULL;
+  if (args == nullptr) return nullptr;
   for (i = 0; i < args->num_args; i++) {
     grpc_auth_context* p = grpc_auth_context_from_arg(&args->args[i]);
-    if (p != NULL) return p;
+    if (p != nullptr) return p;
   }
-  return NULL;
+  return nullptr;
 }
diff --git a/src/core/lib/security/credentials/composite/composite_credentials.cc b/src/core/lib/security/credentials/composite/composite_credentials.cc
index 5eb7f9d09e..93dd721240 100644
--- a/src/core/lib/security/credentials/composite/composite_credentials.cc
+++ b/src/core/lib/security/credentials/composite/composite_credentials.cc
@@ -144,9 +144,9 @@ grpc_call_credentials* grpc_composite_call_credentials_create(
       "grpc_composite_call_credentials_create(creds1=%p, creds2=%p, "
       "reserved=%p)",
       3, (creds1, creds2, reserved));
-  GPR_ASSERT(reserved == NULL);
-  GPR_ASSERT(creds1 != NULL);
-  GPR_ASSERT(creds2 != NULL);
+  GPR_ASSERT(reserved == nullptr);
+  GPR_ASSERT(creds1 != nullptr);
+  GPR_ASSERT(creds2 != nullptr);
   c = (grpc_composite_call_credentials*)gpr_zalloc(
       sizeof(grpc_composite_call_credentials));
   c->base.type = GRPC_CALL_CREDENTIALS_TYPE_COMPOSITE;
@@ -183,19 +183,19 @@ grpc_call_credentials* grpc_credentials_contains_type(
     grpc_call_credentials** composite_creds) {
   size_t i;
   if (strcmp(creds->type, type) == 0) {
-    if (composite_creds != NULL) *composite_creds = NULL;
+    if (composite_creds != nullptr) *composite_creds = nullptr;
     return creds;
   } else if (strcmp(creds->type, GRPC_CALL_CREDENTIALS_TYPE_COMPOSITE) == 0) {
     const grpc_call_credentials_array* inner_creds_array =
         grpc_composite_call_credentials_get_credentials(creds);
     for (i = 0; i < inner_creds_array->num_creds; i++) {
       if (strcmp(type, inner_creds_array->creds_array[i]->type) == 0) {
-        if (composite_creds != NULL) *composite_creds = creds;
+        if (composite_creds != nullptr) *composite_creds = creds;
         return inner_creds_array->creds_array[i];
       }
     }
   }
-  return NULL;
+  return nullptr;
 }
 
 /* -- Composite channel credentials. -- */
@@ -217,14 +217,15 @@ static grpc_security_status composite_channel_create_security_connector(
       (grpc_composite_channel_credentials*)creds;
   grpc_security_status status = GRPC_SECURITY_ERROR;
 
-  GPR_ASSERT(c->inner_creds != NULL && c->call_creds != NULL &&
-             c->inner_creds->vtable != NULL &&
-             c->inner_creds->vtable->create_security_connector != NULL);
+  GPR_ASSERT(c->inner_creds != nullptr && c->call_creds != nullptr &&
+             c->inner_creds->vtable != nullptr &&
+             c->inner_creds->vtable->create_security_connector != nullptr);
   /* If we are passed a call_creds, create a call composite to pass it
      downstream. */
-  if (call_creds != NULL) {
+  if (call_creds != nullptr) {
     grpc_call_credentials* composite_call_creds =
-        grpc_composite_call_credentials_create(c->call_creds, call_creds, NULL);
+        grpc_composite_call_credentials_create(c->call_creds, call_creds,
+                                               nullptr);
     status = c->inner_creds->vtable->create_security_connector(
         exec_ctx, c->inner_creds, composite_call_creds, target, args, sc,
         new_args);
@@ -253,7 +254,8 @@ grpc_channel_credentials* grpc_composite_channel_credentials_create(
     void* reserved) {
   grpc_composite_channel_credentials* c =
       (grpc_composite_channel_credentials*)gpr_zalloc(sizeof(*c));
-  GPR_ASSERT(channel_creds != NULL && call_creds != NULL && reserved == NULL);
+  GPR_ASSERT(channel_creds != nullptr && call_creds != nullptr &&
+             reserved == nullptr);
   GRPC_API_TRACE(
       "grpc_composite_channel_credentials_create(channel_creds=%p, "
       "call_creds=%p, reserved=%p)",
diff --git a/src/core/lib/security/credentials/credentials.cc b/src/core/lib/security/credentials/credentials.cc
index e60d022f1b..90576e69b9 100644
--- a/src/core/lib/security/credentials/credentials.cc
+++ b/src/core/lib/security/credentials/credentials.cc
@@ -55,16 +55,16 @@ void grpc_credentials_metadata_request_destroy(
 
 grpc_channel_credentials* grpc_channel_credentials_ref(
     grpc_channel_credentials* creds) {
-  if (creds == NULL) return NULL;
+  if (creds == nullptr) return nullptr;
   gpr_ref(&creds->refcount);
   return creds;
 }
 
 void grpc_channel_credentials_unref(grpc_exec_ctx* exec_ctx,
                                     grpc_channel_credentials* creds) {
-  if (creds == NULL) return;
+  if (creds == nullptr) return;
   if (gpr_unref(&creds->refcount)) {
-    if (creds->vtable->destruct != NULL) {
+    if (creds->vtable->destruct != nullptr) {
       creds->vtable->destruct(exec_ctx, creds);
     }
     gpr_free(creds);
@@ -79,16 +79,16 @@ void grpc_channel_credentials_release(grpc_channel_credentials* creds) {
 }
 
 grpc_call_credentials* grpc_call_credentials_ref(grpc_call_credentials* creds) {
-  if (creds == NULL) return NULL;
+  if (creds == nullptr) return nullptr;
   gpr_ref(&creds->refcount);
   return creds;
 }
 
 void grpc_call_credentials_unref(grpc_exec_ctx* exec_ctx,
                                  grpc_call_credentials* creds) {
-  if (creds == NULL) return;
+  if (creds == nullptr) return;
   if (gpr_unref(&creds->refcount)) {
-    if (creds->vtable->destruct != NULL) {
+    if (creds->vtable->destruct != nullptr) {
       creds->vtable->destruct(exec_ctx, creds);
     }
     gpr_free(creds);
@@ -107,7 +107,7 @@ bool grpc_call_credentials_get_request_metadata(
     grpc_polling_entity* pollent, grpc_auth_metadata_context context,
     grpc_credentials_mdelem_array* md_array, grpc_closure* on_request_metadata,
     grpc_error** error) {
-  if (creds == NULL || creds->vtable->get_request_metadata == NULL) {
+  if (creds == nullptr || creds->vtable->get_request_metadata == nullptr) {
     return true;
   }
   return creds->vtable->get_request_metadata(
@@ -117,7 +117,8 @@ bool grpc_call_credentials_get_request_metadata(
 void grpc_call_credentials_cancel_get_request_metadata(
     grpc_exec_ctx* exec_ctx, grpc_call_credentials* creds,
     grpc_credentials_mdelem_array* md_array, grpc_error* error) {
-  if (creds == NULL || creds->vtable->cancel_get_request_metadata == NULL) {
+  if (creds == nullptr ||
+      creds->vtable->cancel_get_request_metadata == nullptr) {
     return;
   }
   creds->vtable->cancel_get_request_metadata(exec_ctx, creds, md_array, error);
@@ -127,20 +128,20 @@ grpc_security_status grpc_channel_credentials_create_security_connector(
     grpc_exec_ctx* exec_ctx, grpc_channel_credentials* channel_creds,
     const char* target, const grpc_channel_args* args,
     grpc_channel_security_connector** sc, grpc_channel_args** new_args) {
-  *new_args = NULL;
-  if (channel_creds == NULL) {
+  *new_args = nullptr;
+  if (channel_creds == nullptr) {
     return GRPC_SECURITY_ERROR;
   }
-  GPR_ASSERT(channel_creds->vtable->create_security_connector != NULL);
+  GPR_ASSERT(channel_creds->vtable->create_security_connector != nullptr);
   return channel_creds->vtable->create_security_connector(
-      exec_ctx, channel_creds, NULL, target, args, sc, new_args);
+      exec_ctx, channel_creds, nullptr, target, args, sc, new_args);
 }
 
 grpc_channel_credentials*
 grpc_channel_credentials_duplicate_without_call_credentials(
     grpc_channel_credentials* channel_creds) {
-  if (channel_creds != NULL && channel_creds->vtable != NULL &&
-      channel_creds->vtable->duplicate_without_call_credentials != NULL) {
+  if (channel_creds != nullptr && channel_creds->vtable != nullptr &&
+      channel_creds->vtable->duplicate_without_call_credentials != nullptr) {
     return channel_creds->vtable->duplicate_without_call_credentials(
         channel_creds);
   } else {
@@ -171,11 +172,11 @@ grpc_arg grpc_channel_credentials_to_arg(
 
 grpc_channel_credentials* grpc_channel_credentials_from_arg(
     const grpc_arg* arg) {
-  if (strcmp(arg->key, GRPC_ARG_CHANNEL_CREDENTIALS)) return NULL;
+  if (strcmp(arg->key, GRPC_ARG_CHANNEL_CREDENTIALS)) return nullptr;
   if (arg->type != GRPC_ARG_POINTER) {
     gpr_log(GPR_ERROR, "Invalid type %d for arg %s", arg->type,
             GRPC_ARG_CHANNEL_CREDENTIALS);
-    return NULL;
+    return nullptr;
   }
   return (grpc_channel_credentials*)arg->value.pointer.p;
 }
@@ -183,30 +184,31 @@ grpc_channel_credentials* grpc_channel_credentials_from_arg(
 grpc_channel_credentials* grpc_channel_credentials_find_in_args(
     const grpc_channel_args* args) {
   size_t i;
-  if (args == NULL) return NULL;
+  if (args == nullptr) return nullptr;
   for (i = 0; i < args->num_args; i++) {
     grpc_channel_credentials* credentials =
         grpc_channel_credentials_from_arg(&args->args[i]);
-    if (credentials != NULL) return credentials;
+    if (credentials != nullptr) return credentials;
   }
-  return NULL;
+  return nullptr;
 }
 
 grpc_server_credentials* grpc_server_credentials_ref(
     grpc_server_credentials* creds) {
-  if (creds == NULL) return NULL;
+  if (creds == nullptr) return nullptr;
   gpr_ref(&creds->refcount);
   return creds;
 }
 
 void grpc_server_credentials_unref(grpc_exec_ctx* exec_ctx,
                                    grpc_server_credentials* creds) {
-  if (creds == NULL) return;
+  if (creds == nullptr) return;
   if (gpr_unref(&creds->refcount)) {
-    if (creds->vtable->destruct != NULL) {
+    if (creds->vtable->destruct != nullptr) {
       creds->vtable->destruct(exec_ctx, creds);
     }
-    if (creds->processor.destroy != NULL && creds->processor.state != NULL) {
+    if (creds->processor.destroy != nullptr &&
+        creds->processor.state != nullptr) {
       creds->processor.destroy(creds->processor.state);
     }
     gpr_free(creds);
@@ -223,7 +225,7 @@ void grpc_server_credentials_release(grpc_server_credentials* creds) {
 grpc_security_status grpc_server_credentials_create_security_connector(
     grpc_exec_ctx* exec_ctx, grpc_server_credentials* creds,
     grpc_server_security_connector** sc) {
-  if (creds == NULL || creds->vtable->create_security_connector == NULL) {
+  if (creds == nullptr || creds->vtable->create_security_connector == nullptr) {
     gpr_log(GPR_ERROR, "Server credentials cannot create security context.");
     return GRPC_SECURITY_ERROR;
   }
@@ -237,8 +239,9 @@ void grpc_server_credentials_set_auth_metadata_processor(
       "creds=%p, "
       "processor=grpc_auth_metadata_processor { process: %p, state: %p })",
       3, (creds, (void*)(intptr_t)processor.process, processor.state));
-  if (creds == NULL) return;
-  if (creds->processor.destroy != NULL && creds->processor.state != NULL) {
+  if (creds == nullptr) return;
+  if (creds->processor.destroy != nullptr &&
+      creds->processor.state != nullptr) {
     creds->processor.destroy(creds->processor.state);
   }
   creds->processor = processor;
@@ -267,11 +270,11 @@ grpc_arg grpc_server_credentials_to_arg(grpc_server_credentials* p) {
 }
 
 grpc_server_credentials* grpc_server_credentials_from_arg(const grpc_arg* arg) {
-  if (strcmp(arg->key, GRPC_SERVER_CREDENTIALS_ARG) != 0) return NULL;
+  if (strcmp(arg->key, GRPC_SERVER_CREDENTIALS_ARG) != 0) return nullptr;
   if (arg->type != GRPC_ARG_POINTER) {
     gpr_log(GPR_ERROR, "Invalid type %d for arg %s", arg->type,
             GRPC_SERVER_CREDENTIALS_ARG);
-    return NULL;
+    return nullptr;
   }
   return (grpc_server_credentials*)arg->value.pointer.p;
 }
@@ -279,11 +282,11 @@ grpc_server_credentials* grpc_server_credentials_from_arg(const grpc_arg* arg) {
 grpc_server_credentials* grpc_find_server_credentials_in_args(
     const grpc_channel_args* args) {
   size_t i;
-  if (args == NULL) return NULL;
+  if (args == nullptr) return nullptr;
   for (i = 0; i < args->num_args; i++) {
     grpc_server_credentials* p =
         grpc_server_credentials_from_arg(&args->args[i]);
-    if (p != NULL) return p;
+    if (p != nullptr) return p;
   }
-  return NULL;
+  return nullptr;
 }
diff --git a/src/core/lib/security/credentials/fake/fake_credentials.cc b/src/core/lib/security/credentials/fake/fake_credentials.cc
index 17700f5651..a535a317ee 100644
--- a/src/core/lib/security/credentials/fake/fake_credentials.cc
+++ b/src/core/lib/security/credentials/fake/fake_credentials.cc
@@ -53,11 +53,11 @@ fake_transport_security_server_create_security_connector(
 
 static grpc_channel_credentials_vtable
     fake_transport_security_credentials_vtable = {
-        NULL, fake_transport_security_create_security_connector, NULL};
+        nullptr, fake_transport_security_create_security_connector, nullptr};
 
 static grpc_server_credentials_vtable
     fake_transport_security_server_credentials_vtable = {
-        NULL, fake_transport_security_server_create_security_connector};
+        nullptr, fake_transport_security_server_create_security_connector};
 
 grpc_channel_credentials* grpc_fake_transport_security_credentials_create(
     void) {
@@ -89,11 +89,11 @@ const char* grpc_fake_transport_get_expected_targets(
     const grpc_channel_args* args) {
   const grpc_arg* expected_target_arg =
       grpc_channel_args_find(args, GRPC_ARG_FAKE_SECURITY_EXPECTED_TARGETS);
-  if (expected_target_arg != NULL &&
+  if (expected_target_arg != nullptr &&
       expected_target_arg->type == GRPC_ARG_STRING) {
     return expected_target_arg->value.string;
   }
-  return NULL;
+  return nullptr;
 }
 
 /* -- Metadata-only test credentials. -- */
diff --git a/src/core/lib/security/credentials/google_default/credentials_generic.cc b/src/core/lib/security/credentials/google_default/credentials_generic.cc
index c2a336ff07..58ee080cf3 100644
--- a/src/core/lib/security/credentials/google_default/credentials_generic.cc
+++ b/src/core/lib/security/credentials/google_default/credentials_generic.cc
@@ -26,12 +26,12 @@
 #include "src/core/lib/support/string.h"
 
 char* grpc_get_well_known_google_credentials_file_path_impl(void) {
-  char* result = NULL;
+  char* result = nullptr;
   char* base = gpr_getenv(GRPC_GOOGLE_CREDENTIALS_PATH_ENV_VAR);
-  if (base == NULL) {
+  if (base == nullptr) {
     gpr_log(GPR_ERROR, "Could not get " GRPC_GOOGLE_CREDENTIALS_ENV_VAR
                        " environment variable.");
-    return NULL;
+    return nullptr;
   }
   gpr_asprintf(&result, "%s/%s", base, GRPC_GOOGLE_CREDENTIALS_PATH_SUFFIX);
   gpr_free(base);
diff --git a/src/core/lib/security/credentials/google_default/google_default_credentials.cc b/src/core/lib/security/credentials/google_default/google_default_credentials.cc
index 3ce19e9a05..f586c7b604 100644
--- a/src/core/lib/security/credentials/google_default/google_default_credentials.cc
+++ b/src/core/lib/security/credentials/google_default/google_default_credentials.cc
@@ -43,7 +43,7 @@
 
 /* -- Default credentials. -- */
 
-static grpc_channel_credentials* default_credentials = NULL;
+static grpc_channel_credentials* default_credentials = nullptr;
 static int compute_engine_detection_done = 0;
 static gpr_mu g_state_mu;
 static gpr_mu* g_polling_mu;
@@ -80,8 +80,8 @@ static void on_compute_engine_detection_http_response(grpc_exec_ctx* exec_ctx,
   detector->is_done = 1;
   GRPC_LOG_IF_ERROR(
       "Pollset kick",
-      grpc_pollset_kick(exec_ctx,
-                        grpc_polling_entity_pollset(&detector->pollent), NULL));
+      grpc_pollset_kick(
+          exec_ctx, grpc_polling_entity_pollset(&detector->pollent), nullptr));
   gpr_mu_unlock(g_polling_mu);
 }
 
@@ -128,7 +128,7 @@ static int is_stack_running_on_compute_engine(grpc_exec_ctx* exec_ctx) {
      called once for the lifetime of the process by the default credentials. */
   gpr_mu_lock(g_polling_mu);
   while (!detector.is_done) {
-    grpc_pollset_worker* worker = NULL;
+    grpc_pollset_worker* worker = nullptr;
     if (!GRPC_LOG_IF_ERROR(
             "pollset_work",
             grpc_pollset_work(exec_ctx,
@@ -147,7 +147,7 @@ static int is_stack_running_on_compute_engine(grpc_exec_ctx* exec_ctx) {
   grpc_pollset_shutdown(exec_ctx,
                         grpc_polling_entity_pollset(&detector.pollent),
                         &destroy_closure);
-  g_polling_mu = NULL;
+  g_polling_mu = nullptr;
   grpc_exec_ctx_flush(exec_ctx);
 
   gpr_free(grpc_polling_entity_pollset(&detector.pollent));
@@ -159,13 +159,13 @@ static int is_stack_running_on_compute_engine(grpc_exec_ctx* exec_ctx) {
 /* Takes ownership of creds_path if not NULL. */
 static grpc_error* create_default_creds_from_path(
     grpc_exec_ctx* exec_ctx, char* creds_path, grpc_call_credentials** creds) {
-  grpc_json* json = NULL;
+  grpc_json* json = nullptr;
   grpc_auth_json_key key;
   grpc_auth_refresh_token token;
-  grpc_call_credentials* result = NULL;
+  grpc_call_credentials* result = nullptr;
   grpc_slice creds_data = grpc_empty_slice();
   grpc_error* error = GRPC_ERROR_NONE;
-  if (creds_path == NULL) {
+  if (creds_path == nullptr) {
     error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("creds_path unset");
     goto end;
   }
@@ -175,7 +175,7 @@ static grpc_error* create_default_creds_from_path(
   }
   json = grpc_json_parse_string_with_len(
       (char*)GRPC_SLICE_START_PTR(creds_data), GRPC_SLICE_LENGTH(creds_data));
-  if (json == NULL) {
+  if (json == nullptr) {
     error = grpc_error_set_str(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING("Failed to parse JSON"),
         GRPC_ERROR_STR_RAW_BYTES, grpc_slice_ref_internal(creds_data));
@@ -188,7 +188,7 @@ static grpc_error* create_default_creds_from_path(
     result =
         grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
             exec_ctx, key, grpc_max_auth_token_lifetime());
-    if (result == NULL) {
+    if (result == nullptr) {
       error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
           "grpc_service_account_jwt_access_credentials_create_from_auth_json_"
           "key failed");
@@ -201,7 +201,7 @@ static grpc_error* create_default_creds_from_path(
   if (grpc_auth_refresh_token_is_valid(&token)) {
     result =
         grpc_refresh_token_credentials_create_from_auth_refresh_token(token);
-    if (result == NULL) {
+    if (result == nullptr) {
       error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
           "grpc_refresh_token_credentials_create_from_auth_refresh_token "
           "failed");
@@ -210,17 +210,17 @@ static grpc_error* create_default_creds_from_path(
   }
 
 end:
-  GPR_ASSERT((result == NULL) + (error == GRPC_ERROR_NONE) == 1);
-  if (creds_path != NULL) gpr_free(creds_path);
+  GPR_ASSERT((result == nullptr) + (error == GRPC_ERROR_NONE) == 1);
+  if (creds_path != nullptr) gpr_free(creds_path);
   grpc_slice_unref_internal(exec_ctx, creds_data);
-  if (json != NULL) grpc_json_destroy(json);
+  if (json != nullptr) grpc_json_destroy(json);
   *creds = result;
   return error;
 }
 
 grpc_channel_credentials* grpc_google_default_credentials_create(void) {
-  grpc_channel_credentials* result = NULL;
-  grpc_call_credentials* call_creds = NULL;
+  grpc_channel_credentials* result = nullptr;
+  grpc_call_credentials* call_creds = nullptr;
   grpc_error* error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
       "Failed to create Google credentials");
   grpc_error* err;
@@ -232,7 +232,7 @@ grpc_channel_credentials* grpc_google_default_credentials_create(void) {
 
   gpr_mu_lock(&g_state_mu);
 
-  if (default_credentials != NULL) {
+  if (default_credentials != nullptr) {
     result = grpc_channel_credentials_ref(default_credentials);
     goto end;
   }
@@ -257,8 +257,8 @@ grpc_channel_credentials* grpc_google_default_credentials_create(void) {
         is_stack_running_on_compute_engine(&exec_ctx);
     compute_engine_detection_done = 1;
     if (need_compute_engine_creds) {
-      call_creds = grpc_google_compute_engine_credentials_create(NULL);
-      if (call_creds == NULL) {
+      call_creds = grpc_google_compute_engine_credentials_create(nullptr);
+      if (call_creds == nullptr) {
         error = grpc_error_add_child(
             error, GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                        "Failed to get credentials from network"));
@@ -267,17 +267,17 @@ grpc_channel_credentials* grpc_google_default_credentials_create(void) {
   }
 
 end:
-  if (result == NULL) {
-    if (call_creds != NULL) {
+  if (result == nullptr) {
+    if (call_creds != nullptr) {
       /* Blend with default ssl credentials and add a global reference so that
          it
          can be cached and re-served. */
       grpc_channel_credentials* ssl_creds =
-          grpc_ssl_credentials_create(NULL, NULL, NULL);
+          grpc_ssl_credentials_create(nullptr, nullptr, nullptr);
       default_credentials = grpc_channel_credentials_ref(
           grpc_composite_channel_credentials_create(ssl_creds, call_creds,
-                                                    NULL));
-      GPR_ASSERT(default_credentials != NULL);
+                                                    nullptr));
+      GPR_ASSERT(default_credentials != nullptr);
       grpc_channel_credentials_unref(&exec_ctx, ssl_creds);
       grpc_call_credentials_unref(&exec_ctx, call_creds);
       result = default_credentials;
@@ -286,7 +286,7 @@ end:
     }
   }
   gpr_mu_unlock(&g_state_mu);
-  if (result == NULL) {
+  if (result == nullptr) {
     GRPC_LOG_IF_ERROR("grpc_google_default_credentials_create", error);
   } else {
     GRPC_ERROR_UNREF(error);
@@ -299,9 +299,9 @@ void grpc_flush_cached_google_default_credentials(void) {
   grpc_exec_ctx exec_ctx = GRPC_EXEC_CTX_INIT;
   gpr_once_init(&g_once, init_default_credentials);
   gpr_mu_lock(&g_state_mu);
-  if (default_credentials != NULL) {
+  if (default_credentials != nullptr) {
     grpc_channel_credentials_unref(&exec_ctx, default_credentials);
-    default_credentials = NULL;
+    default_credentials = nullptr;
   }
   compute_engine_detection_done = 0;
   gpr_mu_unlock(&g_state_mu);
@@ -310,10 +310,10 @@ void grpc_flush_cached_google_default_credentials(void) {
 
 /* -- Well known credentials path. -- */
 
-static grpc_well_known_credentials_path_getter creds_path_getter = NULL;
+static grpc_well_known_credentials_path_getter creds_path_getter = nullptr;
 
 char* grpc_get_well_known_google_credentials_file_path(void) {
-  if (creds_path_getter != NULL) return creds_path_getter();
+  if (creds_path_getter != nullptr) return creds_path_getter();
   return grpc_get_well_known_google_credentials_file_path_impl();
 }
 
diff --git a/src/core/lib/security/credentials/iam/iam_credentials.cc b/src/core/lib/security/credentials/iam/iam_credentials.cc
index 7410294a20..1741bf3068 100644
--- a/src/core/lib/security/credentials/iam/iam_credentials.cc
+++ b/src/core/lib/security/credentials/iam/iam_credentials.cc
@@ -61,9 +61,9 @@ grpc_call_credentials* grpc_google_iam_credentials_create(
       "grpc_iam_credentials_create(token=%s, authority_selector=%s, "
       "reserved=%p)",
       3, (token, authority_selector, reserved));
-  GPR_ASSERT(reserved == NULL);
-  GPR_ASSERT(token != NULL);
-  GPR_ASSERT(authority_selector != NULL);
+  GPR_ASSERT(reserved == nullptr);
+  GPR_ASSERT(token != nullptr);
+  GPR_ASSERT(authority_selector != nullptr);
   grpc_google_iam_credentials* c =
       (grpc_google_iam_credentials*)gpr_zalloc(sizeof(*c));
   c->base.type = GRPC_CALL_CREDENTIALS_TYPE_IAM;
diff --git a/src/core/lib/security/credentials/jwt/json_token.cc b/src/core/lib/security/credentials/jwt/json_token.cc
index e195ec7509..a152ddcaaf 100644
--- a/src/core/lib/security/credentials/jwt/json_token.cc
+++ b/src/core/lib/security/credentials/jwt/json_token.cc
@@ -52,30 +52,31 @@ gpr_timespec grpc_max_auth_token_lifetime() {
 
 /* --- Override for testing. --- */
 
-static grpc_jwt_encode_and_sign_override g_jwt_encode_and_sign_override = NULL;
+static grpc_jwt_encode_and_sign_override g_jwt_encode_and_sign_override =
+    nullptr;
 
 /* --- grpc_auth_json_key. --- */
 
 int grpc_auth_json_key_is_valid(const grpc_auth_json_key* json_key) {
-  return (json_key != NULL) &&
+  return (json_key != nullptr) &&
          strcmp(json_key->type, GRPC_AUTH_JSON_TYPE_INVALID);
 }
 
 grpc_auth_json_key grpc_auth_json_key_create_from_json(const grpc_json* json) {
   grpc_auth_json_key result;
-  BIO* bio = NULL;
+  BIO* bio = nullptr;
   const char* prop_value;
   int success = 0;
 
   memset(&result, 0, sizeof(grpc_auth_json_key));
   result.type = GRPC_AUTH_JSON_TYPE_INVALID;
-  if (json == NULL) {
+  if (json == nullptr) {
     gpr_log(GPR_ERROR, "Invalid json.");
     goto end;
   }
 
   prop_value = grpc_json_get_string_property(json, "type");
-  if (prop_value == NULL ||
+  if (prop_value == nullptr ||
       strcmp(prop_value, GRPC_AUTH_JSON_TYPE_SERVICE_ACCOUNT)) {
     goto end;
   }
@@ -90,7 +91,7 @@ grpc_auth_json_key grpc_auth_json_key_create_from_json(const grpc_json* json) {
   }
 
   prop_value = grpc_json_get_string_property(json, "private_key");
-  if (prop_value == NULL) {
+  if (prop_value == nullptr) {
     goto end;
   }
   bio = BIO_new(BIO_s_mem());
@@ -99,15 +100,16 @@ grpc_auth_json_key grpc_auth_json_key_create_from_json(const grpc_json* json) {
     gpr_log(GPR_ERROR, "Could not write into openssl BIO.");
     goto end;
   }
-  result.private_key = PEM_read_bio_RSAPrivateKey(bio, NULL, NULL, (void*)"");
-  if (result.private_key == NULL) {
+  result.private_key =
+      PEM_read_bio_RSAPrivateKey(bio, nullptr, nullptr, (void*)"");
+  if (result.private_key == nullptr) {
     gpr_log(GPR_ERROR, "Could not deserialize private key.");
     goto end;
   }
   success = 1;
 
 end:
-  if (bio != NULL) BIO_free(bio);
+  if (bio != nullptr) BIO_free(bio);
   if (!success) grpc_auth_json_key_destruct(&result);
   return result;
 }
@@ -117,29 +119,29 @@ grpc_auth_json_key grpc_auth_json_key_create_from_string(
   char* scratchpad = gpr_strdup(json_string);
   grpc_json* json = grpc_json_parse_string(scratchpad);
   grpc_auth_json_key result = grpc_auth_json_key_create_from_json(json);
-  if (json != NULL) grpc_json_destroy(json);
+  if (json != nullptr) grpc_json_destroy(json);
   gpr_free(scratchpad);
   return result;
 }
 
 void grpc_auth_json_key_destruct(grpc_auth_json_key* json_key) {
-  if (json_key == NULL) return;
+  if (json_key == nullptr) return;
   json_key->type = GRPC_AUTH_JSON_TYPE_INVALID;
-  if (json_key->client_id != NULL) {
+  if (json_key->client_id != nullptr) {
     gpr_free(json_key->client_id);
-    json_key->client_id = NULL;
+    json_key->client_id = nullptr;
   }
-  if (json_key->private_key_id != NULL) {
+  if (json_key->private_key_id != nullptr) {
     gpr_free(json_key->private_key_id);
-    json_key->private_key_id = NULL;
+    json_key->private_key_id = nullptr;
   }
-  if (json_key->client_email != NULL) {
+  if (json_key->client_email != nullptr) {
     gpr_free(json_key->client_email);
-    json_key->client_email = NULL;
+    json_key->client_email = nullptr;
   }
-  if (json_key->private_key != NULL) {
+  if (json_key->private_key != nullptr) {
     RSA_free(json_key->private_key);
-    json_key->private_key = NULL;
+    json_key->private_key = nullptr;
   }
 }
 
@@ -159,11 +161,11 @@ static grpc_json* create_child(grpc_json* brother, grpc_json* parent,
 
 static char* encoded_jwt_header(const char* key_id, const char* algorithm) {
   grpc_json* json = grpc_json_create(GRPC_JSON_OBJECT);
-  grpc_json* child = NULL;
-  char* json_str = NULL;
-  char* result = NULL;
+  grpc_json* child = nullptr;
+  char* json_str = nullptr;
+  char* result = nullptr;
 
-  child = create_child(NULL, json, "alg", algorithm, GRPC_JSON_STRING);
+  child = create_child(nullptr, json, "alg", algorithm, GRPC_JSON_STRING);
   child = create_child(child, json, "typ", GRPC_JWT_TYPE, GRPC_JSON_STRING);
   create_child(child, json, "kid", key_id, GRPC_JSON_STRING);
 
@@ -178,9 +180,9 @@ static char* encoded_jwt_claim(const grpc_auth_json_key* json_key,
                                const char* audience,
                                gpr_timespec token_lifetime, const char* scope) {
   grpc_json* json = grpc_json_create(GRPC_JSON_OBJECT);
-  grpc_json* child = NULL;
-  char* json_str = NULL;
-  char* result = NULL;
+  grpc_json* child = nullptr;
+  char* json_str = nullptr;
+  char* result = nullptr;
   gpr_timespec now = gpr_now(GPR_CLOCK_REALTIME);
   gpr_timespec expiration = gpr_time_add(now, token_lifetime);
   char now_str[GPR_LTOA_MIN_BUFSIZE];
@@ -192,9 +194,9 @@ static char* encoded_jwt_claim(const grpc_auth_json_key* json_key,
   int64_ttoa(now.tv_sec, now_str);
   int64_ttoa(expiration.tv_sec, expiration_str);
 
-  child =
-      create_child(NULL, json, "iss", json_key->client_email, GRPC_JSON_STRING);
-  if (scope != NULL) {
+  child = create_child(nullptr, json, "iss", json_key->client_email,
+                       GRPC_JSON_STRING);
+  if (scope != nullptr) {
     child = create_child(child, json, "scope", scope, GRPC_JSON_STRING);
   } else {
     /* Unscoped JWTs need a sub field. */
@@ -237,7 +239,7 @@ const EVP_MD* openssl_digest_from_algorithm(const char* algorithm) {
     return EVP_sha256();
   } else {
     gpr_log(GPR_ERROR, "Unknown algorithm %s.", algorithm);
-    return NULL;
+    return nullptr;
   }
 }
 
@@ -245,19 +247,19 @@ char* compute_and_encode_signature(const grpc_auth_json_key* json_key,
                                    const char* signature_algorithm,
                                    const char* to_sign) {
   const EVP_MD* md = openssl_digest_from_algorithm(signature_algorithm);
-  EVP_MD_CTX* md_ctx = NULL;
+  EVP_MD_CTX* md_ctx = nullptr;
   EVP_PKEY* key = EVP_PKEY_new();
   size_t sig_len = 0;
-  unsigned char* sig = NULL;
-  char* result = NULL;
-  if (md == NULL) return NULL;
+  unsigned char* sig = nullptr;
+  char* result = nullptr;
+  if (md == nullptr) return nullptr;
   md_ctx = EVP_MD_CTX_create();
-  if (md_ctx == NULL) {
+  if (md_ctx == nullptr) {
     gpr_log(GPR_ERROR, "Could not create MD_CTX");
     goto end;
   }
   EVP_PKEY_set1_RSA(key, json_key->private_key);
-  if (EVP_DigestSignInit(md_ctx, NULL, md, NULL, key) != 1) {
+  if (EVP_DigestSignInit(md_ctx, nullptr, md, nullptr, key) != 1) {
     gpr_log(GPR_ERROR, "DigestInit failed.");
     goto end;
   }
@@ -265,7 +267,7 @@ char* compute_and_encode_signature(const grpc_auth_json_key* json_key,
     gpr_log(GPR_ERROR, "DigestUpdate failed.");
     goto end;
   }
-  if (EVP_DigestSignFinal(md_ctx, NULL, &sig_len) != 1) {
+  if (EVP_DigestSignFinal(md_ctx, nullptr, &sig_len) != 1) {
     gpr_log(GPR_ERROR, "DigestFinal (get signature length) failed.");
     goto end;
   }
@@ -277,16 +279,16 @@ char* compute_and_encode_signature(const grpc_auth_json_key* json_key,
   result = grpc_base64_encode(sig, sig_len, 1, 0);
 
 end:
-  if (key != NULL) EVP_PKEY_free(key);
-  if (md_ctx != NULL) EVP_MD_CTX_destroy(md_ctx);
-  if (sig != NULL) gpr_free(sig);
+  if (key != nullptr) EVP_PKEY_free(key);
+  if (md_ctx != nullptr) EVP_MD_CTX_destroy(md_ctx);
+  if (sig != nullptr) gpr_free(sig);
   return result;
 }
 
 char* grpc_jwt_encode_and_sign(const grpc_auth_json_key* json_key,
                                const char* audience,
                                gpr_timespec token_lifetime, const char* scope) {
-  if (g_jwt_encode_and_sign_override != NULL) {
+  if (g_jwt_encode_and_sign_override != nullptr) {
     return g_jwt_encode_and_sign_override(json_key, audience, token_lifetime,
                                           scope);
   } else {
@@ -295,9 +297,9 @@ char* grpc_jwt_encode_and_sign(const grpc_auth_json_key* json_key,
         encoded_jwt_header(json_key->private_key_id, sig_algo),
         encoded_jwt_claim(json_key, audience, token_lifetime, scope));
     char* sig = compute_and_encode_signature(json_key, sig_algo, to_sign);
-    if (sig == NULL) {
+    if (sig == nullptr) {
       gpr_free(to_sign);
-      return NULL;
+      return nullptr;
     }
     return dot_concat_and_free_strings(to_sign, sig);
   }
diff --git a/src/core/lib/security/credentials/jwt/jwt_credentials.cc b/src/core/lib/security/credentials/jwt/jwt_credentials.cc
index e8baa7e053..d666e6b658 100644
--- a/src/core/lib/security/credentials/jwt/jwt_credentials.cc
+++ b/src/core/lib/security/credentials/jwt/jwt_credentials.cc
@@ -34,9 +34,9 @@ static void jwt_reset_cache(grpc_exec_ctx* exec_ctx,
                             grpc_service_account_jwt_access_credentials* c) {
   GRPC_MDELEM_UNREF(exec_ctx, c->cached.jwt_md);
   c->cached.jwt_md = GRPC_MDNULL;
-  if (c->cached.service_url != NULL) {
+  if (c->cached.service_url != nullptr) {
     gpr_free(c->cached.service_url);
-    c->cached.service_url = NULL;
+    c->cached.service_url = nullptr;
   }
   c->cached.jwt_expiration = gpr_inf_past(GPR_CLOCK_REALTIME);
 }
@@ -66,7 +66,7 @@ static bool jwt_get_request_metadata(grpc_exec_ctx* exec_ctx,
   grpc_mdelem jwt_md = GRPC_MDNULL;
   {
     gpr_mu_lock(&c->cache_mu);
-    if (c->cached.service_url != NULL &&
+    if (c->cached.service_url != nullptr &&
         strcmp(c->cached.service_url, context.service_url) == 0 &&
         !GRPC_MDISNULL(c->cached.jwt_md) &&
         (gpr_time_cmp(gpr_time_sub(c->cached.jwt_expiration,
@@ -78,13 +78,13 @@ static bool jwt_get_request_metadata(grpc_exec_ctx* exec_ctx,
   }
 
   if (GRPC_MDISNULL(jwt_md)) {
-    char* jwt = NULL;
+    char* jwt = nullptr;
     /* Generate a new jwt. */
     gpr_mu_lock(&c->cache_mu);
     jwt_reset_cache(exec_ctx, c);
     jwt = grpc_jwt_encode_and_sign(&c->key, context.service_url,
-                                   c->jwt_lifetime, NULL);
-    if (jwt != NULL) {
+                                   c->jwt_lifetime, nullptr);
+    if (jwt != nullptr) {
       char* md_value;
       gpr_asprintf(&md_value, "Bearer %s", jwt);
       gpr_free(jwt);
@@ -126,7 +126,7 @@ grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
   grpc_service_account_jwt_access_credentials* c;
   if (!grpc_auth_json_key_is_valid(&key)) {
     gpr_log(GPR_ERROR, "Invalid input for jwt credentials creation");
-    return NULL;
+    return nullptr;
   }
   c = (grpc_service_account_jwt_access_credentials*)gpr_zalloc(
       sizeof(grpc_service_account_jwt_access_credentials));
@@ -185,7 +185,7 @@ grpc_call_credentials* grpc_service_account_jwt_access_credentials_create(
             (int)token_lifetime.clock_type, reserved);
     gpr_free(clean_json);
   }
-  GPR_ASSERT(reserved == NULL);
+  GPR_ASSERT(reserved == nullptr);
   grpc_exec_ctx exec_ctx = GRPC_EXEC_CTX_INIT;
   grpc_call_credentials* creds =
       grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
diff --git a/src/core/lib/security/credentials/jwt/jwt_verifier.cc b/src/core/lib/security/credentials/jwt/jwt_verifier.cc
index 0fce5f5555..3709b83c4e 100644
--- a/src/core/lib/security/credentials/jwt/jwt_verifier.cc
+++ b/src/core/lib/security/credentials/jwt/jwt_verifier.cc
@@ -70,7 +70,7 @@ static const EVP_MD* evp_md_from_alg(const char* alg) {
   } else if (strcmp(alg, "RS512") == 0) {
     return EVP_sha512();
   } else {
-    return NULL;
+    return nullptr;
   }
 }
 
@@ -82,11 +82,11 @@ static grpc_json* parse_json_part_from_jwt(grpc_exec_ctx* exec_ctx,
   *buffer = grpc_base64_decode_with_len(exec_ctx, str, len, 1);
   if (GRPC_SLICE_IS_EMPTY(*buffer)) {
     gpr_log(GPR_ERROR, "Invalid base64.");
-    return NULL;
+    return nullptr;
   }
   json = grpc_json_parse_string_with_len((char*)GRPC_SLICE_START_PTR(*buffer),
                                          GRPC_SLICE_LENGTH(*buffer));
-  if (json == NULL) {
+  if (json == nullptr) {
     grpc_slice_unref_internal(exec_ctx, *buffer);
     gpr_log(GPR_ERROR, "JSON parsing error.");
   }
@@ -97,7 +97,7 @@ static const char* validate_string_field(const grpc_json* json,
                                          const char* key) {
   if (json->type != GRPC_JSON_STRING) {
     gpr_log(GPR_ERROR, "Invalid %s field [%s]", key, json->value);
-    return NULL;
+    return nullptr;
   }
   return json->value;
 }
@@ -109,7 +109,7 @@ static gpr_timespec validate_time_field(const grpc_json* json,
     gpr_log(GPR_ERROR, "Invalid %s field [%s]", key, json->value);
     return result;
   }
-  result.tv_sec = strtol(json->value, NULL, 10);
+  result.tv_sec = strtol(json->value, nullptr, 10);
   return result;
 }
 
@@ -134,27 +134,27 @@ static jose_header* jose_header_from_json(grpc_exec_ctx* exec_ctx,
   grpc_json* cur;
   jose_header* h = (jose_header*)gpr_zalloc(sizeof(jose_header));
   h->buffer = buffer;
-  for (cur = json->child; cur != NULL; cur = cur->next) {
+  for (cur = json->child; cur != nullptr; cur = cur->next) {
     if (strcmp(cur->key, "alg") == 0) {
       /* We only support RSA-1.5 signatures for now.
          Beware of this if we add HMAC support:
          https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
        */
       if (cur->type != GRPC_JSON_STRING || strncmp(cur->value, "RS", 2) ||
-          evp_md_from_alg(cur->value) == NULL) {
+          evp_md_from_alg(cur->value) == nullptr) {
         gpr_log(GPR_ERROR, "Invalid alg field [%s]", cur->value);
         goto error;
       }
       h->alg = cur->value;
     } else if (strcmp(cur->key, "typ") == 0) {
       h->typ = validate_string_field(cur, "typ");
-      if (h->typ == NULL) goto error;
+      if (h->typ == nullptr) goto error;
     } else if (strcmp(cur->key, "kid") == 0) {
       h->kid = validate_string_field(cur, "kid");
-      if (h->kid == NULL) goto error;
+      if (h->kid == nullptr) goto error;
     }
   }
-  if (h->alg == NULL) {
+  if (h->alg == nullptr) {
     gpr_log(GPR_ERROR, "Missing alg field.");
     goto error;
   }
@@ -165,7 +165,7 @@ static jose_header* jose_header_from_json(grpc_exec_ctx* exec_ctx,
 error:
   grpc_json_destroy(json);
   jose_header_destroy(exec_ctx, h);
-  return NULL;
+  return nullptr;
 }
 
 /* --- JWT claims. see http://tools.ietf.org/html/rfc7519#section-4.1 */
@@ -191,42 +191,42 @@ void grpc_jwt_claims_destroy(grpc_exec_ctx* exec_ctx, grpc_jwt_claims* claims) {
 }
 
 const grpc_json* grpc_jwt_claims_json(const grpc_jwt_claims* claims) {
-  if (claims == NULL) return NULL;
+  if (claims == nullptr) return nullptr;
   return claims->json;
 }
 
 const char* grpc_jwt_claims_subject(const grpc_jwt_claims* claims) {
-  if (claims == NULL) return NULL;
+  if (claims == nullptr) return nullptr;
   return claims->sub;
 }
 
 const char* grpc_jwt_claims_issuer(const grpc_jwt_claims* claims) {
-  if (claims == NULL) return NULL;
+  if (claims == nullptr) return nullptr;
   return claims->iss;
 }
 
 const char* grpc_jwt_claims_id(const grpc_jwt_claims* claims) {
-  if (claims == NULL) return NULL;
+  if (claims == nullptr) return nullptr;
   return claims->jti;
 }
 
 const char* grpc_jwt_claims_audience(const grpc_jwt_claims* claims) {
-  if (claims == NULL) return NULL;
+  if (claims == nullptr) return nullptr;
   return claims->aud;
 }
 
 gpr_timespec grpc_jwt_claims_issued_at(const grpc_jwt_claims* claims) {
-  if (claims == NULL) return gpr_inf_past(GPR_CLOCK_REALTIME);
+  if (claims == nullptr) return gpr_inf_past(GPR_CLOCK_REALTIME);
   return claims->iat;
 }
 
 gpr_timespec grpc_jwt_claims_expires_at(const grpc_jwt_claims* claims) {
-  if (claims == NULL) return gpr_inf_future(GPR_CLOCK_REALTIME);
+  if (claims == nullptr) return gpr_inf_future(GPR_CLOCK_REALTIME);
   return claims->exp;
 }
 
 gpr_timespec grpc_jwt_claims_not_before(const grpc_jwt_claims* claims) {
-  if (claims == NULL) return gpr_inf_past(GPR_CLOCK_REALTIME);
+  if (claims == nullptr) return gpr_inf_past(GPR_CLOCK_REALTIME);
   return claims->nbf;
 }
 
@@ -244,19 +244,19 @@ grpc_jwt_claims* grpc_jwt_claims_from_json(grpc_exec_ctx* exec_ctx,
   claims->exp = gpr_inf_future(GPR_CLOCK_REALTIME);
 
   /* Per the spec, all fields are optional. */
-  for (cur = json->child; cur != NULL; cur = cur->next) {
+  for (cur = json->child; cur != nullptr; cur = cur->next) {
     if (strcmp(cur->key, "sub") == 0) {
       claims->sub = validate_string_field(cur, "sub");
-      if (claims->sub == NULL) goto error;
+      if (claims->sub == nullptr) goto error;
     } else if (strcmp(cur->key, "iss") == 0) {
       claims->iss = validate_string_field(cur, "iss");
-      if (claims->iss == NULL) goto error;
+      if (claims->iss == nullptr) goto error;
     } else if (strcmp(cur->key, "aud") == 0) {
       claims->aud = validate_string_field(cur, "aud");
-      if (claims->aud == NULL) goto error;
+      if (claims->aud == nullptr) goto error;
     } else if (strcmp(cur->key, "jti") == 0) {
       claims->jti = validate_string_field(cur, "jti");
-      if (claims->jti == NULL) goto error;
+      if (claims->jti == nullptr) goto error;
     } else if (strcmp(cur->key, "iat") == 0) {
       claims->iat = validate_time_field(cur, "iat");
       if (gpr_time_cmp(claims->iat, gpr_time_0(GPR_CLOCK_REALTIME)) == 0)
@@ -275,7 +275,7 @@ grpc_jwt_claims* grpc_jwt_claims_from_json(grpc_exec_ctx* exec_ctx,
 
 error:
   grpc_jwt_claims_destroy(exec_ctx, claims);
-  return NULL;
+  return nullptr;
 }
 
 grpc_jwt_verifier_status grpc_jwt_claims_check(const grpc_jwt_claims* claims,
@@ -283,7 +283,7 @@ grpc_jwt_verifier_status grpc_jwt_claims_check(const grpc_jwt_claims* claims,
   gpr_timespec skewed_now;
   int audience_ok;
 
-  GPR_ASSERT(claims != NULL);
+  GPR_ASSERT(claims != nullptr);
 
   skewed_now =
       gpr_time_add(gpr_now(GPR_CLOCK_REALTIME), grpc_jwt_verifier_clock_skew);
@@ -301,23 +301,23 @@ grpc_jwt_verifier_status grpc_jwt_claims_check(const grpc_jwt_claims* claims,
   /* This should be probably up to the upper layer to decide but let's harcode
      the 99% use case here for email issuers, where the JWT must be self
      issued. */
-  if (grpc_jwt_issuer_email_domain(claims->iss) != NULL &&
-      claims->sub != NULL && strcmp(claims->iss, claims->sub) != 0) {
+  if (grpc_jwt_issuer_email_domain(claims->iss) != nullptr &&
+      claims->sub != nullptr && strcmp(claims->iss, claims->sub) != 0) {
     gpr_log(GPR_ERROR,
             "Email issuer (%s) cannot assert another subject (%s) than itself.",
             claims->iss, claims->sub);
     return GRPC_JWT_VERIFIER_BAD_SUBJECT;
   }
 
-  if (audience == NULL) {
-    audience_ok = claims->aud == NULL;
+  if (audience == nullptr) {
+    audience_ok = claims->aud == nullptr;
   } else {
-    audience_ok = claims->aud != NULL && strcmp(audience, claims->aud) == 0;
+    audience_ok = claims->aud != nullptr && strcmp(audience, claims->aud) == 0;
   }
   if (!audience_ok) {
     gpr_log(GPR_ERROR, "Audience mismatch: expected %s and found %s.",
-            audience == NULL ? "NULL" : audience,
-            claims->aud == NULL ? "NULL" : claims->aud);
+            audience == nullptr ? "NULL" : audience,
+            claims->aud == nullptr ? "NULL" : claims->aud);
     return GRPC_JWT_VERIFIER_BAD_AUDIENCE;
   }
   return GRPC_JWT_VERIFIER_OK;
@@ -366,8 +366,8 @@ static verifier_cb_ctx* verifier_cb_ctx_create(
 }
 
 void verifier_cb_ctx_destroy(grpc_exec_ctx* exec_ctx, verifier_cb_ctx* ctx) {
-  if (ctx->audience != NULL) gpr_free(ctx->audience);
-  if (ctx->claims != NULL) grpc_jwt_claims_destroy(exec_ctx, ctx->claims);
+  if (ctx->audience != nullptr) gpr_free(ctx->audience);
+  if (ctx->claims != nullptr) grpc_jwt_claims_destroy(exec_ctx, ctx->claims);
   grpc_slice_unref_internal(exec_ctx, ctx->signature);
   grpc_slice_unref_internal(exec_ctx, ctx->signed_data);
   jose_header_destroy(exec_ctx, ctx->header);
@@ -399,20 +399,20 @@ struct grpc_jwt_verifier {
 };
 
 static grpc_json* json_from_http(const grpc_httpcli_response* response) {
-  grpc_json* json = NULL;
+  grpc_json* json = nullptr;
 
-  if (response == NULL) {
+  if (response == nullptr) {
     gpr_log(GPR_ERROR, "HTTP response is NULL.");
-    return NULL;
+    return nullptr;
   }
   if (response->status != 200) {
     gpr_log(GPR_ERROR, "Call to http server failed with error %d.",
             response->status);
-    return NULL;
+    return nullptr;
   }
 
   json = grpc_json_parse_string_with_len(response->body, response->body_length);
-  if (json == NULL) {
+  if (json == nullptr) {
     gpr_log(GPR_ERROR, "Invalid JSON found in response.");
   }
   return json;
@@ -421,26 +421,26 @@ static grpc_json* json_from_http(const grpc_httpcli_response* response) {
 static const grpc_json* find_property_by_name(const grpc_json* json,
                                               const char* name) {
   const grpc_json* cur;
-  for (cur = json->child; cur != NULL; cur = cur->next) {
+  for (cur = json->child; cur != nullptr; cur = cur->next) {
     if (strcmp(cur->key, name) == 0) return cur;
   }
-  return NULL;
+  return nullptr;
 }
 
 static EVP_PKEY* extract_pkey_from_x509(const char* x509_str) {
-  X509* x509 = NULL;
-  EVP_PKEY* result = NULL;
+  X509* x509 = nullptr;
+  EVP_PKEY* result = nullptr;
   BIO* bio = BIO_new(BIO_s_mem());
   size_t len = strlen(x509_str);
   GPR_ASSERT(len < INT_MAX);
   BIO_write(bio, x509_str, (int)len);
-  x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
-  if (x509 == NULL) {
+  x509 = PEM_read_bio_X509(bio, nullptr, nullptr, nullptr);
+  if (x509 == nullptr) {
     gpr_log(GPR_ERROR, "Unable to parse x509 cert.");
     goto end;
   }
   result = X509_get_pubkey(x509);
-  if (result == NULL) {
+  if (result == nullptr) {
     gpr_log(GPR_ERROR, "Cannot find public key in X509 cert.");
   }
 
@@ -451,17 +451,17 @@ end:
 }
 
 static BIGNUM* bignum_from_base64(grpc_exec_ctx* exec_ctx, const char* b64) {
-  BIGNUM* result = NULL;
+  BIGNUM* result = nullptr;
   grpc_slice bin;
 
-  if (b64 == NULL) return NULL;
+  if (b64 == nullptr) return nullptr;
   bin = grpc_base64_decode(exec_ctx, b64, 1);
   if (GRPC_SLICE_IS_EMPTY(bin)) {
     gpr_log(GPR_ERROR, "Invalid base64 for big num.");
-    return NULL;
+    return nullptr;
   }
   result = BN_bin2bn(GRPC_SLICE_START_PTR(bin),
-                     TSI_SIZE_AS_SIZE(GRPC_SLICE_LENGTH(bin)), NULL);
+                     TSI_SIZE_AS_SIZE(GRPC_SLICE_LENGTH(bin)), nullptr);
   grpc_slice_unref_internal(exec_ctx, bin);
   return result;
 }
@@ -474,19 +474,19 @@ static int RSA_set0_key(RSA* r, BIGNUM* n, BIGNUM* e, BIGNUM* d) {
    * parameters MUST be non-NULL for n and e.  d may be
    * left NULL (in case only the public key is used).
    */
-  if ((r->n == NULL && n == NULL) || (r->e == NULL && e == NULL)) {
+  if ((r->n == nullptr && n == nullptr) || (r->e == nullptr && e == nullptr)) {
     return 0;
   }
 
-  if (n != NULL) {
+  if (n != nullptr) {
     BN_free(r->n);
     r->n = n;
   }
-  if (e != NULL) {
+  if (e != nullptr) {
     BN_free(r->e);
     r->e = e;
   }
-  if (d != NULL) {
+  if (d != nullptr) {
     BN_free(r->d);
     r->d = d;
   }
@@ -498,43 +498,43 @@ static int RSA_set0_key(RSA* r, BIGNUM* n, BIGNUM* e, BIGNUM* d) {
 static EVP_PKEY* pkey_from_jwk(grpc_exec_ctx* exec_ctx, const grpc_json* json,
                                const char* kty) {
   const grpc_json* key_prop;
-  RSA* rsa = NULL;
-  EVP_PKEY* result = NULL;
-  BIGNUM* tmp_n = NULL;
-  BIGNUM* tmp_e = NULL;
+  RSA* rsa = nullptr;
+  EVP_PKEY* result = nullptr;
+  BIGNUM* tmp_n = nullptr;
+  BIGNUM* tmp_e = nullptr;
 
-  GPR_ASSERT(kty != NULL && json != NULL);
+  GPR_ASSERT(kty != nullptr && json != nullptr);
   if (strcmp(kty, "RSA") != 0) {
     gpr_log(GPR_ERROR, "Unsupported key type %s.", kty);
     goto end;
   }
   rsa = RSA_new();
-  if (rsa == NULL) {
+  if (rsa == nullptr) {
     gpr_log(GPR_ERROR, "Could not create rsa key.");
     goto end;
   }
-  for (key_prop = json->child; key_prop != NULL; key_prop = key_prop->next) {
+  for (key_prop = json->child; key_prop != nullptr; key_prop = key_prop->next) {
     if (strcmp(key_prop->key, "n") == 0) {
       tmp_n =
           bignum_from_base64(exec_ctx, validate_string_field(key_prop, "n"));
-      if (tmp_n == NULL) goto end;
+      if (tmp_n == nullptr) goto end;
     } else if (strcmp(key_prop->key, "e") == 0) {
       tmp_e =
           bignum_from_base64(exec_ctx, validate_string_field(key_prop, "e"));
-      if (tmp_e == NULL) goto end;
+      if (tmp_e == nullptr) goto end;
     }
   }
-  if (tmp_e == NULL || tmp_n == NULL) {
+  if (tmp_e == nullptr || tmp_n == nullptr) {
     gpr_log(GPR_ERROR, "Missing RSA public key field.");
     goto end;
   }
-  if (!RSA_set0_key(rsa, tmp_n, tmp_e, NULL)) {
+  if (!RSA_set0_key(rsa, tmp_n, tmp_e, nullptr)) {
     gpr_log(GPR_ERROR, "Cannot set RSA key from inputs.");
     goto end;
   }
   /* RSA_set0_key takes ownership on success. */
-  tmp_n = NULL;
-  tmp_e = NULL;
+  tmp_n = nullptr;
+  tmp_e = nullptr;
   result = EVP_PKEY_new();
   EVP_PKEY_set1_RSA(result, rsa); /* uprefs rsa. */
 
@@ -554,29 +554,30 @@ static EVP_PKEY* find_verification_key(grpc_exec_ctx* exec_ctx,
   /* Try to parse the json as a JWK set:
      https://tools.ietf.org/html/rfc7517#section-5. */
   jwk_keys = find_property_by_name(json, "keys");
-  if (jwk_keys == NULL) {
+  if (jwk_keys == nullptr) {
     /* Use the google proprietary format which is:
        { <kid1>: <x5091>, <kid2>: <x5092>, ... } */
     const grpc_json* cur = find_property_by_name(json, header_kid);
-    if (cur == NULL) return NULL;
+    if (cur == nullptr) return nullptr;
     return extract_pkey_from_x509(cur->value);
   }
 
   if (jwk_keys->type != GRPC_JSON_ARRAY) {
     gpr_log(GPR_ERROR,
             "Unexpected value type of keys property in jwks key set.");
-    return NULL;
+    return nullptr;
   }
   /* Key format is specified in:
      https://tools.ietf.org/html/rfc7518#section-6. */
-  for (jkey = jwk_keys->child; jkey != NULL; jkey = jkey->next) {
+  for (jkey = jwk_keys->child; jkey != nullptr; jkey = jkey->next) {
     grpc_json* key_prop;
-    const char* alg = NULL;
-    const char* kid = NULL;
-    const char* kty = NULL;
+    const char* alg = nullptr;
+    const char* kid = nullptr;
+    const char* kty = nullptr;
 
     if (jkey->type != GRPC_JSON_OBJECT) continue;
-    for (key_prop = jkey->child; key_prop != NULL; key_prop = key_prop->next) {
+    for (key_prop = jkey->child; key_prop != nullptr;
+         key_prop = key_prop->next) {
       if (strcmp(key_prop->key, "alg") == 0 &&
           key_prop->type == GRPC_JSON_STRING) {
         alg = key_prop->value;
@@ -588,7 +589,7 @@ static EVP_PKEY* find_verification_key(grpc_exec_ctx* exec_ctx,
         kty = key_prop->value;
       }
     }
-    if (alg != NULL && kid != NULL && kty != NULL &&
+    if (alg != nullptr && kid != nullptr && kty != nullptr &&
         strcmp(kid, header_kid) == 0 && strcmp(alg, header_alg) == 0) {
       return pkey_from_jwk(exec_ctx, jkey, kty);
     }
@@ -596,7 +597,7 @@ static EVP_PKEY* find_verification_key(grpc_exec_ctx* exec_ctx,
   gpr_log(GPR_ERROR,
           "Could not find matching key in key set for kid=%s and alg=%s",
           header_kid, header_alg);
-  return NULL;
+  return nullptr;
 }
 
 static int verify_jwt_signature(EVP_PKEY* key, const char* alg,
@@ -605,12 +606,12 @@ static int verify_jwt_signature(EVP_PKEY* key, const char* alg,
   const EVP_MD* md = evp_md_from_alg(alg);
   int result = 0;
 
-  GPR_ASSERT(md != NULL); /* Checked before. */
-  if (md_ctx == NULL) {
+  GPR_ASSERT(md != nullptr); /* Checked before. */
+  if (md_ctx == nullptr) {
     gpr_log(GPR_ERROR, "Could not create EVP_MD_CTX.");
     goto end;
   }
-  if (EVP_DigestVerifyInit(md_ctx, NULL, md, NULL, key) != 1) {
+  if (EVP_DigestVerifyInit(md_ctx, nullptr, md, nullptr, key) != 1) {
     gpr_log(GPR_ERROR, "EVP_DigestVerifyInit failed.");
     goto end;
   }
@@ -635,17 +636,17 @@ static void on_keys_retrieved(grpc_exec_ctx* exec_ctx, void* user_data,
                               grpc_error* error) {
   verifier_cb_ctx* ctx = (verifier_cb_ctx*)user_data;
   grpc_json* json = json_from_http(&ctx->responses[HTTP_RESPONSE_KEYS]);
-  EVP_PKEY* verification_key = NULL;
+  EVP_PKEY* verification_key = nullptr;
   grpc_jwt_verifier_status status = GRPC_JWT_VERIFIER_GENERIC_ERROR;
-  grpc_jwt_claims* claims = NULL;
+  grpc_jwt_claims* claims = nullptr;
 
-  if (json == NULL) {
+  if (json == nullptr) {
     status = GRPC_JWT_VERIFIER_KEY_RETRIEVAL_ERROR;
     goto end;
   }
   verification_key =
       find_verification_key(exec_ctx, json, ctx->header->alg, ctx->header->kid);
-  if (verification_key == NULL) {
+  if (verification_key == nullptr) {
     gpr_log(GPR_ERROR, "Could not find verification key with kid %s.",
             ctx->header->kid);
     status = GRPC_JWT_VERIFIER_KEY_RETRIEVAL_ERROR;
@@ -662,11 +663,11 @@ static void on_keys_retrieved(grpc_exec_ctx* exec_ctx, void* user_data,
   if (status == GRPC_JWT_VERIFIER_OK) {
     /* Pass ownership. */
     claims = ctx->claims;
-    ctx->claims = NULL;
+    ctx->claims = nullptr;
   }
 
 end:
-  if (json != NULL) grpc_json_destroy(json);
+  if (json != nullptr) grpc_json_destroy(json);
   EVP_PKEY_free(verification_key);
   ctx->user_cb(exec_ctx, ctx->user_data, status, claims);
   verifier_cb_ctx_destroy(exec_ctx, ctx);
@@ -680,17 +681,17 @@ static void on_openid_config_retrieved(grpc_exec_ctx* exec_ctx, void* user_data,
   grpc_json* json = json_from_http(response);
   grpc_httpcli_request req;
   const char* jwks_uri;
-  grpc_resource_quota* resource_quota = NULL;
+  grpc_resource_quota* resource_quota = nullptr;
 
   /* TODO(jboeuf): Cache the jwks_uri in order to avoid this hop next time. */
-  if (json == NULL) goto error;
+  if (json == nullptr) goto error;
   cur = find_property_by_name(json, "jwks_uri");
-  if (cur == NULL) {
+  if (cur == nullptr) {
     gpr_log(GPR_ERROR, "Could not find jwks_uri in openid config.");
     goto error;
   }
   jwks_uri = validate_string_field(cur, "jwks_uri");
-  if (jwks_uri == NULL) goto error;
+  if (jwks_uri == nullptr) goto error;
   if (strstr(jwks_uri, "https://") != jwks_uri) {
     gpr_log(GPR_ERROR, "Invalid non https jwks_uri: %s.", jwks_uri);
     goto error;
@@ -699,7 +700,7 @@ static void on_openid_config_retrieved(grpc_exec_ctx* exec_ctx, void* user_data,
   req.handshaker = &grpc_httpcli_ssl;
   req.host = gpr_strdup(jwks_uri);
   req.http.path = (char*)strchr(jwks_uri, '/');
-  if (req.http.path == NULL) {
+  if (req.http.path == nullptr) {
     req.http.path = (char*)"";
   } else {
     *(req.host + (req.http.path - jwks_uri)) = '\0';
@@ -720,29 +721,29 @@ static void on_openid_config_retrieved(grpc_exec_ctx* exec_ctx, void* user_data,
   return;
 
 error:
-  if (json != NULL) grpc_json_destroy(json);
+  if (json != nullptr) grpc_json_destroy(json);
   ctx->user_cb(exec_ctx, ctx->user_data, GRPC_JWT_VERIFIER_KEY_RETRIEVAL_ERROR,
-               NULL);
+               nullptr);
   verifier_cb_ctx_destroy(exec_ctx, ctx);
 }
 
 static email_key_mapping* verifier_get_mapping(grpc_jwt_verifier* v,
                                                const char* email_domain) {
   size_t i;
-  if (v->mappings == NULL) return NULL;
+  if (v->mappings == nullptr) return nullptr;
   for (i = 0; i < v->num_mappings; i++) {
     if (strcmp(email_domain, v->mappings[i].email_domain) == 0) {
       return &v->mappings[i];
     }
   }
-  return NULL;
+  return nullptr;
 }
 
 static void verifier_put_mapping(grpc_jwt_verifier* v, const char* email_domain,
                                  const char* key_url_prefix) {
   email_key_mapping* mapping = verifier_get_mapping(v, email_domain);
   GPR_ASSERT(v->num_mappings < v->allocated_mappings);
-  if (mapping != NULL) {
+  if (mapping != nullptr) {
     gpr_free(mapping->key_url_prefix);
     mapping->key_url_prefix = gpr_strdup(key_url_prefix);
     return;
@@ -757,16 +758,16 @@ static void verifier_put_mapping(grpc_jwt_verifier* v, const char* email_domain,
    enough for now... */
 const char* grpc_jwt_issuer_email_domain(const char* issuer) {
   const char* at_sign = strchr(issuer, '@');
-  if (at_sign == NULL) return NULL;
+  if (at_sign == nullptr) return nullptr;
   const char* email_domain = at_sign + 1;
-  if (*email_domain == '\0') return NULL;
+  if (*email_domain == '\0') return nullptr;
   const char* dot = strrchr(email_domain, '.');
-  if (dot == NULL || dot == email_domain) return email_domain;
+  if (dot == nullptr || dot == email_domain) return email_domain;
   GPR_ASSERT(dot > email_domain);
   /* There may be a subdomain, we just want the domain. */
   dot = (const char*)gpr_memrchr((void*)email_domain, '.',
                                  (size_t)(dot - email_domain));
-  if (dot == NULL) return email_domain;
+  if (dot == nullptr) return email_domain;
   return dot + 1;
 }
 
@@ -775,21 +776,22 @@ static void retrieve_key_and_verify(grpc_exec_ctx* exec_ctx,
                                     verifier_cb_ctx* ctx) {
   const char* email_domain;
   grpc_closure* http_cb;
-  char* path_prefix = NULL;
+  char* path_prefix = nullptr;
   const char* iss;
   grpc_httpcli_request req;
-  grpc_resource_quota* resource_quota = NULL;
+  grpc_resource_quota* resource_quota = nullptr;
   memset(&req, 0, sizeof(grpc_httpcli_request));
   req.handshaker = &grpc_httpcli_ssl;
   http_response_index rsp_idx;
 
-  GPR_ASSERT(ctx != NULL && ctx->header != NULL && ctx->claims != NULL);
+  GPR_ASSERT(ctx != nullptr && ctx->header != nullptr &&
+             ctx->claims != nullptr);
   iss = ctx->claims->iss;
-  if (ctx->header->kid == NULL) {
+  if (ctx->header->kid == nullptr) {
     gpr_log(GPR_ERROR, "Missing kid in jose header.");
     goto error;
   }
-  if (iss == NULL) {
+  if (iss == nullptr) {
     gpr_log(GPR_ERROR, "Missing iss in claims.");
     goto error;
   }
@@ -800,17 +802,17 @@ static void retrieve_key_and_verify(grpc_exec_ctx* exec_ctx,
      so we will rely instead on email/url mappings if we detect such an issuer.
      Part 4, on the other hand is implemented by both google and salesforce. */
   email_domain = grpc_jwt_issuer_email_domain(iss);
-  if (email_domain != NULL) {
+  if (email_domain != nullptr) {
     email_key_mapping* mapping;
-    GPR_ASSERT(ctx->verifier != NULL);
+    GPR_ASSERT(ctx->verifier != nullptr);
     mapping = verifier_get_mapping(ctx->verifier, email_domain);
-    if (mapping == NULL) {
+    if (mapping == nullptr) {
       gpr_log(GPR_ERROR, "Missing mapping for issuer email.");
       goto error;
     }
     req.host = gpr_strdup(mapping->key_url_prefix);
     path_prefix = strchr(req.host, '/');
-    if (path_prefix == NULL) {
+    if (path_prefix == nullptr) {
       gpr_asprintf(&req.http.path, "/%s", iss);
     } else {
       *(path_prefix++) = '\0';
@@ -822,7 +824,7 @@ static void retrieve_key_and_verify(grpc_exec_ctx* exec_ctx,
   } else {
     req.host = gpr_strdup(strstr(iss, "https://") == iss ? iss + 8 : iss);
     path_prefix = strchr(req.host, '/');
-    if (path_prefix == NULL) {
+    if (path_prefix == nullptr) {
       req.http.path = gpr_strdup(GRPC_OPENID_CONFIG_URL_SUFFIX);
     } else {
       *(path_prefix++) = 0;
@@ -849,7 +851,7 @@ static void retrieve_key_and_verify(grpc_exec_ctx* exec_ctx,
 
 error:
   ctx->user_cb(exec_ctx, ctx->user_data, GRPC_JWT_VERIFIER_KEY_RETRIEVAL_ERROR,
-               NULL);
+               nullptr);
   verifier_cb_ctx_destroy(exec_ctx, ctx);
 }
 
@@ -859,33 +861,34 @@ void grpc_jwt_verifier_verify(grpc_exec_ctx* exec_ctx,
                               const char* audience,
                               grpc_jwt_verification_done_cb cb,
                               void* user_data) {
-  const char* dot = NULL;
+  const char* dot = nullptr;
   grpc_json* json;
-  jose_header* header = NULL;
-  grpc_jwt_claims* claims = NULL;
+  jose_header* header = nullptr;
+  grpc_jwt_claims* claims = nullptr;
   grpc_slice header_buffer;
   grpc_slice claims_buffer;
   grpc_slice signature;
   size_t signed_jwt_len;
   const char* cur = jwt;
 
-  GPR_ASSERT(verifier != NULL && jwt != NULL && audience != NULL && cb != NULL);
+  GPR_ASSERT(verifier != nullptr && jwt != nullptr && audience != nullptr &&
+             cb != nullptr);
   dot = strchr(cur, '.');
-  if (dot == NULL) goto error;
+  if (dot == nullptr) goto error;
   json = parse_json_part_from_jwt(exec_ctx, cur, (size_t)(dot - cur),
                                   &header_buffer);
-  if (json == NULL) goto error;
+  if (json == nullptr) goto error;
   header = jose_header_from_json(exec_ctx, json, header_buffer);
-  if (header == NULL) goto error;
+  if (header == nullptr) goto error;
 
   cur = dot + 1;
   dot = strchr(cur, '.');
-  if (dot == NULL) goto error;
+  if (dot == nullptr) goto error;
   json = parse_json_part_from_jwt(exec_ctx, cur, (size_t)(dot - cur),
                                   &claims_buffer);
-  if (json == NULL) goto error;
+  if (json == nullptr) goto error;
   claims = grpc_jwt_claims_from_json(exec_ctx, json, claims_buffer);
-  if (claims == NULL) goto error;
+  if (claims == nullptr) goto error;
 
   signed_jwt_len = (size_t)(dot - jwt);
   cur = dot + 1;
@@ -898,9 +901,9 @@ void grpc_jwt_verifier_verify(grpc_exec_ctx* exec_ctx,
   return;
 
 error:
-  if (header != NULL) jose_header_destroy(exec_ctx, header);
-  if (claims != NULL) grpc_jwt_claims_destroy(exec_ctx, claims);
-  cb(exec_ctx, user_data, GRPC_JWT_VERIFIER_BAD_FORMAT, NULL);
+  if (header != nullptr) jose_header_destroy(exec_ctx, header);
+  if (claims != nullptr) grpc_jwt_claims_destroy(exec_ctx, claims);
+  cb(exec_ctx, user_data, GRPC_JWT_VERIFIER_BAD_FORMAT, nullptr);
 }
 
 grpc_jwt_verifier* grpc_jwt_verifier_create(
@@ -917,7 +920,7 @@ grpc_jwt_verifier* grpc_jwt_verifier_create(
   verifier_put_mapping(v, GRPC_GOOGLE_SERVICE_ACCOUNTS_EMAIL_DOMAIN,
                        GRPC_GOOGLE_SERVICE_ACCOUNTS_KEY_URL_PREFIX);
   /* User-Provided mappings. */
-  if (mappings != NULL) {
+  if (mappings != nullptr) {
     size_t i;
     for (i = 0; i < num_mappings; i++) {
       verifier_put_mapping(v, mappings[i].email_domain,
@@ -929,9 +932,9 @@ grpc_jwt_verifier* grpc_jwt_verifier_create(
 
 void grpc_jwt_verifier_destroy(grpc_exec_ctx* exec_ctx, grpc_jwt_verifier* v) {
   size_t i;
-  if (v == NULL) return;
+  if (v == nullptr) return;
   grpc_httpcli_context_destroy(exec_ctx, &v->http_ctx);
-  if (v->mappings != NULL) {
+  if (v->mappings != nullptr) {
     for (i = 0; i < v->num_mappings; i++) {
       gpr_free(v->mappings[i].email_domain);
       gpr_free(v->mappings[i].key_url_prefix);
diff --git a/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc b/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc
index 2a44211228..943d23f21e 100644
--- a/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc
+++ b/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc
@@ -33,7 +33,7 @@
 
 int grpc_auth_refresh_token_is_valid(
     const grpc_auth_refresh_token* refresh_token) {
-  return (refresh_token != NULL) &&
+  return (refresh_token != nullptr) &&
          strcmp(refresh_token->type, GRPC_AUTH_JSON_TYPE_INVALID);
 }
 
@@ -45,13 +45,13 @@ grpc_auth_refresh_token grpc_auth_refresh_token_create_from_json(
 
   memset(&result, 0, sizeof(grpc_auth_refresh_token));
   result.type = GRPC_AUTH_JSON_TYPE_INVALID;
-  if (json == NULL) {
+  if (json == nullptr) {
     gpr_log(GPR_ERROR, "Invalid json.");
     goto end;
   }
 
   prop_value = grpc_json_get_string_property(json, "type");
-  if (prop_value == NULL ||
+  if (prop_value == nullptr ||
       strcmp(prop_value, GRPC_AUTH_JSON_TYPE_AUTHORIZED_USER)) {
     goto end;
   }
@@ -77,25 +77,25 @@ grpc_auth_refresh_token grpc_auth_refresh_token_create_from_string(
   grpc_json* json = grpc_json_parse_string(scratchpad);
   grpc_auth_refresh_token result =
       grpc_auth_refresh_token_create_from_json(json);
-  if (json != NULL) grpc_json_destroy(json);
+  if (json != nullptr) grpc_json_destroy(json);
   gpr_free(scratchpad);
   return result;
 }
 
 void grpc_auth_refresh_token_destruct(grpc_auth_refresh_token* refresh_token) {
-  if (refresh_token == NULL) return;
+  if (refresh_token == nullptr) return;
   refresh_token->type = GRPC_AUTH_JSON_TYPE_INVALID;
-  if (refresh_token->client_id != NULL) {
+  if (refresh_token->client_id != nullptr) {
     gpr_free(refresh_token->client_id);
-    refresh_token->client_id = NULL;
+    refresh_token->client_id = nullptr;
   }
-  if (refresh_token->client_secret != NULL) {
+  if (refresh_token->client_secret != nullptr) {
     gpr_free(refresh_token->client_secret);
-    refresh_token->client_secret = NULL;
+    refresh_token->client_secret = nullptr;
   }
-  if (refresh_token->refresh_token != NULL) {
+  if (refresh_token->refresh_token != nullptr) {
     gpr_free(refresh_token->refresh_token);
-    refresh_token->refresh_token = NULL;
+    refresh_token->refresh_token = nullptr;
   }
 }
 
@@ -118,12 +118,12 @@ grpc_credentials_status
 grpc_oauth2_token_fetcher_credentials_parse_server_response(
     grpc_exec_ctx* exec_ctx, const grpc_http_response* response,
     grpc_mdelem* token_md, grpc_millis* token_lifetime) {
-  char* null_terminated_body = NULL;
-  char* new_access_token = NULL;
+  char* null_terminated_body = nullptr;
+  char* new_access_token = nullptr;
   grpc_credentials_status status = GRPC_CREDENTIALS_OK;
-  grpc_json* json = NULL;
+  grpc_json* json = nullptr;
 
-  if (response == NULL) {
+  if (response == nullptr) {
     gpr_log(GPR_ERROR, "Received NULL response.");
     status = GRPC_CREDENTIALS_ERROR;
     goto end;
@@ -138,16 +138,16 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response(
   if (response->status != 200) {
     gpr_log(GPR_ERROR, "Call to http server ended with error %d [%s].",
             response->status,
-            null_terminated_body != NULL ? null_terminated_body : "");
+            null_terminated_body != nullptr ? null_terminated_body : "");
     status = GRPC_CREDENTIALS_ERROR;
     goto end;
   } else {
-    grpc_json* access_token = NULL;
-    grpc_json* token_type = NULL;
-    grpc_json* expires_in = NULL;
+    grpc_json* access_token = nullptr;
+    grpc_json* token_type = nullptr;
+    grpc_json* expires_in = nullptr;
     grpc_json* ptr;
     json = grpc_json_parse_string(null_terminated_body);
-    if (json == NULL) {
+    if (json == nullptr) {
       gpr_log(GPR_ERROR, "Could not parse JSON from %s", null_terminated_body);
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
@@ -166,24 +166,24 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response(
         expires_in = ptr;
       }
     }
-    if (access_token == NULL || access_token->type != GRPC_JSON_STRING) {
+    if (access_token == nullptr || access_token->type != GRPC_JSON_STRING) {
       gpr_log(GPR_ERROR, "Missing or invalid access_token in JSON.");
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
-    if (token_type == NULL || token_type->type != GRPC_JSON_STRING) {
+    if (token_type == nullptr || token_type->type != GRPC_JSON_STRING) {
       gpr_log(GPR_ERROR, "Missing or invalid token_type in JSON.");
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
-    if (expires_in == NULL || expires_in->type != GRPC_JSON_NUMBER) {
+    if (expires_in == nullptr || expires_in->type != GRPC_JSON_NUMBER) {
       gpr_log(GPR_ERROR, "Missing or invalid expires_in in JSON.");
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
     gpr_asprintf(&new_access_token, "%s %s", token_type->value,
                  access_token->value);
-    *token_lifetime = strtol(expires_in->value, NULL, 10) * GPR_MS_PER_SEC;
+    *token_lifetime = strtol(expires_in->value, nullptr, 10) * GPR_MS_PER_SEC;
     if (!GRPC_MDISNULL(*token_md)) GRPC_MDELEM_UNREF(exec_ctx, *token_md);
     *token_md = grpc_mdelem_from_slices(
         exec_ctx,
@@ -197,9 +197,9 @@ end:
     GRPC_MDELEM_UNREF(exec_ctx, *token_md);
     *token_md = GRPC_MDNULL;
   }
-  if (null_terminated_body != NULL) gpr_free(null_terminated_body);
-  if (new_access_token != NULL) gpr_free(new_access_token);
-  if (json != NULL) grpc_json_destroy(json);
+  if (null_terminated_body != nullptr) gpr_free(null_terminated_body);
+  if (new_access_token != nullptr) gpr_free(new_access_token);
+  if (json != nullptr) grpc_json_destroy(json);
   return status;
 }
 
@@ -225,10 +225,10 @@ static void on_oauth2_token_fetcher_http_response(grpc_exec_ctx* exec_ctx,
                             : 0;
   grpc_oauth2_pending_get_request_metadata* pending_request =
       c->pending_requests;
-  c->pending_requests = NULL;
+  c->pending_requests = nullptr;
   gpr_mu_unlock(&c->mu);
   // Invoke callbacks for all pending requests.
-  while (pending_request != NULL) {
+  while (pending_request != nullptr) {
     if (status == GRPC_CREDENTIALS_OK) {
       grpc_credentials_mdelem_array_add(pending_request->md_array,
                                         access_token_md);
@@ -305,13 +305,13 @@ static void oauth2_token_fetcher_cancel_get_request_metadata(
   grpc_oauth2_token_fetcher_credentials* c =
       (grpc_oauth2_token_fetcher_credentials*)creds;
   gpr_mu_lock(&c->mu);
-  grpc_oauth2_pending_get_request_metadata* prev = NULL;
+  grpc_oauth2_pending_get_request_metadata* prev = nullptr;
   grpc_oauth2_pending_get_request_metadata* pending_request =
       c->pending_requests;
-  while (pending_request != NULL) {
+  while (pending_request != nullptr) {
     if (pending_request->md_array == md_array) {
       // Remove matching pending request from the list.
-      if (prev != NULL) {
+      if (prev != nullptr) {
         prev->next = pending_request->next;
       } else {
         c->pending_requests = pending_request->next;
@@ -380,7 +380,7 @@ grpc_call_credentials* grpc_google_compute_engine_credentials_create(
           sizeof(grpc_oauth2_token_fetcher_credentials));
   GRPC_API_TRACE("grpc_compute_engine_credentials_create(reserved=%p)", 1,
                  (reserved));
-  GPR_ASSERT(reserved == NULL);
+  GPR_ASSERT(reserved == nullptr);
   init_oauth2_token_fetcher(c, compute_engine_fetch_oauth2);
   c->base.vtable = &compute_engine_vtable;
   return &c->base;
@@ -411,7 +411,7 @@ static void refresh_token_fetch_oauth2(
   grpc_http_header header = {(char*)"Content-Type",
                              (char*)"application/x-www-form-urlencoded"};
   grpc_httpcli_request request;
-  char* body = NULL;
+  char* body = nullptr;
   gpr_asprintf(&body, GRPC_REFRESH_TOKEN_POST_BODY_FORMAT_STRING,
                c->refresh_token.client_id, c->refresh_token.client_secret,
                c->refresh_token.refresh_token);
@@ -441,7 +441,7 @@ grpc_refresh_token_credentials_create_from_auth_refresh_token(
   grpc_google_refresh_token_credentials* c;
   if (!grpc_auth_refresh_token_is_valid(&refresh_token)) {
     gpr_log(GPR_ERROR, "Invalid input for refresh token credentials creation");
-    return NULL;
+    return nullptr;
   }
   c = (grpc_google_refresh_token_credentials*)gpr_zalloc(
       sizeof(grpc_google_refresh_token_credentials));
@@ -455,7 +455,7 @@ static char* create_loggable_refresh_token(grpc_auth_refresh_token* token) {
   if (strcmp(token->type, GRPC_AUTH_JSON_TYPE_INVALID) == 0) {
     return gpr_strdup("<Invalid json token>");
   }
-  char* loggable_token = NULL;
+  char* loggable_token = nullptr;
   gpr_asprintf(&loggable_token,
                "{\n type: %s\n client_id: %s\n client_secret: "
                "<redacted>\n refresh_token: <redacted>\n}",
@@ -475,7 +475,7 @@ grpc_call_credentials* grpc_google_refresh_token_credentials_create(
             loggable_token, reserved);
     gpr_free(loggable_token);
   }
-  GPR_ASSERT(reserved == NULL);
+  GPR_ASSERT(reserved == nullptr);
   return grpc_refresh_token_credentials_create_from_auth_refresh_token(token);
 }
 
@@ -517,7 +517,7 @@ grpc_call_credentials* grpc_access_token_credentials_create(
       "grpc_access_token_credentials_create(access_token=<redacted>, "
       "reserved=%p)",
       1, (reserved));
-  GPR_ASSERT(reserved == NULL);
+  GPR_ASSERT(reserved == nullptr);
   c->base.type = GRPC_CALL_CREDENTIALS_TYPE_OAUTH2;
   c->base.vtable = &access_token_vtable;
   gpr_ref_init(&c->base.refcount, 1);
diff --git a/src/core/lib/security/credentials/plugin/plugin_credentials.cc b/src/core/lib/security/credentials/plugin/plugin_credentials.cc
index e75b00c01a..b83a1b426a 100644
--- a/src/core/lib/security/credentials/plugin/plugin_credentials.cc
+++ b/src/core/lib/security/credentials/plugin/plugin_credentials.cc
@@ -38,7 +38,7 @@ static void plugin_destruct(grpc_exec_ctx* exec_ctx,
                             grpc_call_credentials* creds) {
   grpc_plugin_credentials* c = (grpc_plugin_credentials*)creds;
   gpr_mu_destroy(&c->mu);
-  if (c->plugin.state != NULL && c->plugin.destroy != NULL) {
+  if (c->plugin.state != nullptr && c->plugin.destroy != nullptr) {
     c->plugin.destroy(c->plugin.state);
   }
 }
@@ -46,12 +46,12 @@ static void plugin_destruct(grpc_exec_ctx* exec_ctx,
 static void pending_request_remove_locked(
     grpc_plugin_credentials* c,
     grpc_plugin_credentials_pending_request* pending_request) {
-  if (pending_request->prev == NULL) {
+  if (pending_request->prev == nullptr) {
     c->pending_requests = pending_request->next;
   } else {
     pending_request->prev->next = pending_request->next;
   }
-  if (pending_request->next != NULL) {
+  if (pending_request->next != nullptr) {
     pending_request->next->prev = pending_request->prev;
   }
 }
@@ -120,7 +120,7 @@ static void plugin_md_request_metadata_ready(void* request,
   /* called from application code */
   grpc_exec_ctx exec_ctx = GRPC_EXEC_CTX_INITIALIZER(
       GRPC_EXEC_CTX_FLAG_IS_FINISHED | GRPC_EXEC_CTX_FLAG_THREAD_RESOURCE_LOOP,
-      NULL, NULL);
+      nullptr, nullptr);
   grpc_plugin_credentials_pending_request* r =
       (grpc_plugin_credentials_pending_request*)request;
   if (GRPC_TRACER_ON(grpc_plugin_credentials_trace)) {
@@ -155,7 +155,7 @@ static bool plugin_get_request_metadata(grpc_exec_ctx* exec_ctx,
                                         grpc_error** error) {
   grpc_plugin_credentials* c = (grpc_plugin_credentials*)creds;
   bool retval = true;  // Synchronous return.
-  if (c->plugin.get_metadata != NULL) {
+  if (c->plugin.get_metadata != nullptr) {
     // Create pending_request object.
     grpc_plugin_credentials_pending_request* pending_request =
         (grpc_plugin_credentials_pending_request*)gpr_zalloc(
@@ -165,7 +165,7 @@ static bool plugin_get_request_metadata(grpc_exec_ctx* exec_ctx,
     pending_request->on_request_metadata = on_request_metadata;
     // Add it to the pending list.
     gpr_mu_lock(&c->mu);
-    if (c->pending_requests != NULL) {
+    if (c->pending_requests != nullptr) {
       c->pending_requests->prev = pending_request;
     }
     pending_request->next = c->pending_requests;
@@ -180,7 +180,7 @@ static bool plugin_get_request_metadata(grpc_exec_ctx* exec_ctx,
     grpc_metadata creds_md[GRPC_METADATA_CREDENTIALS_PLUGIN_SYNC_MAX];
     size_t num_creds_md = 0;
     grpc_status_code status = GRPC_STATUS_OK;
-    const char* error_details = NULL;
+    const char* error_details = nullptr;
     if (!c->plugin.get_metadata(c->plugin.state, context,
                                 plugin_md_request_metadata_ready,
                                 pending_request, creds_md, &num_creds_md,
@@ -235,7 +235,7 @@ static void plugin_cancel_get_request_metadata(
   gpr_mu_lock(&c->mu);
   for (grpc_plugin_credentials_pending_request* pending_request =
            c->pending_requests;
-       pending_request != NULL; pending_request = pending_request->next) {
+       pending_request != nullptr; pending_request = pending_request->next) {
     if (pending_request->md_array == md_array) {
       if (GRPC_TRACER_ON(grpc_plugin_credentials_trace)) {
         gpr_log(GPR_INFO, "plugin_credentials[%p]: cancelling request %p", c,
@@ -261,7 +261,7 @@ grpc_call_credentials* grpc_metadata_credentials_create_from_plugin(
   grpc_plugin_credentials* c = (grpc_plugin_credentials*)gpr_zalloc(sizeof(*c));
   GRPC_API_TRACE("grpc_metadata_credentials_create_from_plugin(reserved=%p)", 1,
                  (reserved));
-  GPR_ASSERT(reserved == NULL);
+  GPR_ASSERT(reserved == nullptr);
   c->base.type = plugin.type;
   c->base.vtable = &plugin_vtable;
   gpr_ref_init(&c->base.refcount, 1);
diff --git a/src/core/lib/security/credentials/ssl/ssl_credentials.cc b/src/core/lib/security/credentials/ssl/ssl_credentials.cc
index 79e223ddcb..39dd38cf88 100644
--- a/src/core/lib/security/credentials/ssl/ssl_credentials.cc
+++ b/src/core/lib/security/credentials/ssl/ssl_credentials.cc
@@ -33,7 +33,7 @@
 
 void grpc_tsi_ssl_pem_key_cert_pairs_destroy(tsi_ssl_pem_key_cert_pair* kp,
                                              size_t num_key_cert_pairs) {
-  if (kp == NULL) return;
+  if (kp == nullptr) return;
   for (size_t i = 0; i < num_key_cert_pairs; i++) {
     gpr_free((void*)kp[i].private_key);
     gpr_free((void*)kp[i].cert_chain);
@@ -55,7 +55,7 @@ static grpc_security_status ssl_create_security_connector(
     grpc_channel_args** new_args) {
   grpc_ssl_credentials* c = (grpc_ssl_credentials*)creds;
   grpc_security_status status = GRPC_SECURITY_OK;
-  const char* overridden_target_name = NULL;
+  const char* overridden_target_name = nullptr;
   for (size_t i = 0; args && i < args->num_args; i++) {
     grpc_arg* arg = &args->args[i];
     if (strcmp(arg->key, GRPC_SSL_TARGET_NAME_OVERRIDE_ARG) == 0 &&
@@ -77,17 +77,17 @@ static grpc_security_status ssl_create_security_connector(
 }
 
 static grpc_channel_credentials_vtable ssl_vtable = {
-    ssl_destruct, ssl_create_security_connector, NULL};
+    ssl_destruct, ssl_create_security_connector, nullptr};
 
 static void ssl_build_config(const char* pem_root_certs,
                              grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
                              grpc_ssl_config* config) {
-  if (pem_root_certs != NULL) {
+  if (pem_root_certs != nullptr) {
     config->pem_root_certs = gpr_strdup(pem_root_certs);
   }
-  if (pem_key_cert_pair != NULL) {
-    GPR_ASSERT(pem_key_cert_pair->private_key != NULL);
-    GPR_ASSERT(pem_key_cert_pair->cert_chain != NULL);
+  if (pem_key_cert_pair != nullptr) {
+    GPR_ASSERT(pem_key_cert_pair->private_key != nullptr);
+    GPR_ASSERT(pem_key_cert_pair->cert_chain != nullptr);
     config->pem_key_cert_pair = (tsi_ssl_pem_key_cert_pair*)gpr_zalloc(
         sizeof(tsi_ssl_pem_key_cert_pair));
     config->pem_key_cert_pair->cert_chain =
@@ -107,7 +107,7 @@ grpc_channel_credentials* grpc_ssl_credentials_create(
       "pem_key_cert_pair=%p, "
       "reserved=%p)",
       3, (pem_root_certs, pem_key_cert_pair, reserved));
-  GPR_ASSERT(reserved == NULL);
+  GPR_ASSERT(reserved == nullptr);
   c->base.type = GRPC_CHANNEL_CREDENTIALS_TYPE_SSL;
   c->base.vtable = &ssl_vtable;
   gpr_ref_init(&c->base.refcount, 1);
@@ -145,15 +145,15 @@ static grpc_server_credentials_vtable ssl_server_vtable = {
 tsi_ssl_pem_key_cert_pair* grpc_convert_grpc_to_tsi_cert_pairs(
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs) {
-  tsi_ssl_pem_key_cert_pair* tsi_pairs = NULL;
+  tsi_ssl_pem_key_cert_pair* tsi_pairs = nullptr;
   if (num_key_cert_pairs > 0) {
-    GPR_ASSERT(pem_key_cert_pairs != NULL);
+    GPR_ASSERT(pem_key_cert_pairs != nullptr);
     tsi_pairs = (tsi_ssl_pem_key_cert_pair*)gpr_zalloc(
         num_key_cert_pairs * sizeof(tsi_ssl_pem_key_cert_pair));
   }
   for (size_t i = 0; i < num_key_cert_pairs; i++) {
-    GPR_ASSERT(pem_key_cert_pairs[i].private_key != NULL);
-    GPR_ASSERT(pem_key_cert_pairs[i].cert_chain != NULL);
+    GPR_ASSERT(pem_key_cert_pairs[i].private_key != nullptr);
+    GPR_ASSERT(pem_key_cert_pairs[i].cert_chain != nullptr);
     tsi_pairs[i].cert_chain = gpr_strdup(pem_key_cert_pairs[i].cert_chain);
     tsi_pairs[i].private_key = gpr_strdup(pem_key_cert_pairs[i].private_key);
   }
@@ -166,7 +166,7 @@ static void ssl_build_server_config(
     grpc_ssl_client_certificate_request_type client_certificate_request,
     grpc_ssl_server_config* config) {
   config->client_certificate_request = client_certificate_request;
-  if (pem_root_certs != NULL) {
+  if (pem_root_certs != nullptr) {
     config->pem_root_certs = gpr_strdup(pem_root_certs);
   }
   config->pem_key_cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
@@ -181,18 +181,18 @@ grpc_ssl_server_certificate_config* grpc_ssl_server_certificate_config_create(
   grpc_ssl_server_certificate_config* config =
       (grpc_ssl_server_certificate_config*)gpr_zalloc(
           sizeof(grpc_ssl_server_certificate_config));
-  if (pem_root_certs != NULL) {
+  if (pem_root_certs != nullptr) {
     config->pem_root_certs = gpr_strdup(pem_root_certs);
   }
   if (num_key_cert_pairs > 0) {
-    GPR_ASSERT(pem_key_cert_pairs != NULL);
+    GPR_ASSERT(pem_key_cert_pairs != nullptr);
     config->pem_key_cert_pairs = (grpc_ssl_pem_key_cert_pair*)gpr_zalloc(
         num_key_cert_pairs * sizeof(grpc_ssl_pem_key_cert_pair));
   }
   config->num_key_cert_pairs = num_key_cert_pairs;
   for (size_t i = 0; i < num_key_cert_pairs; i++) {
-    GPR_ASSERT(pem_key_cert_pairs[i].private_key != NULL);
-    GPR_ASSERT(pem_key_cert_pairs[i].cert_chain != NULL);
+    GPR_ASSERT(pem_key_cert_pairs[i].private_key != nullptr);
+    GPR_ASSERT(pem_key_cert_pairs[i].cert_chain != nullptr);
     config->pem_key_cert_pairs[i].cert_chain =
         gpr_strdup(pem_key_cert_pairs[i].cert_chain);
     config->pem_key_cert_pairs[i].private_key =
@@ -203,7 +203,7 @@ grpc_ssl_server_certificate_config* grpc_ssl_server_certificate_config_create(
 
 void grpc_ssl_server_certificate_config_destroy(
     grpc_ssl_server_certificate_config* config) {
-  if (config == NULL) return;
+  if (config == nullptr) return;
   for (size_t i = 0; i < config->num_key_cert_pairs; i++) {
     gpr_free((void*)config->pem_key_cert_pairs[i].private_key);
     gpr_free((void*)config->pem_key_cert_pairs[i].cert_chain);
@@ -217,8 +217,8 @@ grpc_ssl_server_credentials_options*
 grpc_ssl_server_credentials_create_options_using_config(
     grpc_ssl_client_certificate_request_type client_certificate_request,
     grpc_ssl_server_certificate_config* config) {
-  grpc_ssl_server_credentials_options* options = NULL;
-  if (config == NULL) {
+  grpc_ssl_server_credentials_options* options = nullptr;
+  if (config == nullptr) {
     gpr_log(GPR_ERROR, "Certificate config must not be NULL.");
     goto done;
   }
@@ -234,9 +234,9 @@ grpc_ssl_server_credentials_options*
 grpc_ssl_server_credentials_create_options_using_config_fetcher(
     grpc_ssl_client_certificate_request_type client_certificate_request,
     grpc_ssl_server_certificate_config_callback cb, void* user_data) {
-  if (cb == NULL) {
+  if (cb == nullptr) {
     gpr_log(GPR_ERROR, "Invalid certificate config callback parameter.");
-    return NULL;
+    return nullptr;
   }
 
   grpc_ssl_server_certificate_config_fetcher* fetcher =
@@ -277,7 +277,7 @@ grpc_server_credentials* grpc_ssl_server_credentials_create_ex(
       5,
       (pem_root_certs, pem_key_cert_pairs, (unsigned long)num_key_cert_pairs,
        client_certificate_request, reserved));
-  GPR_ASSERT(reserved == NULL);
+  GPR_ASSERT(reserved == nullptr);
 
   grpc_ssl_server_certificate_config* cert_config =
       grpc_ssl_server_certificate_config_create(
@@ -291,23 +291,23 @@ grpc_server_credentials* grpc_ssl_server_credentials_create_ex(
 
 grpc_server_credentials* grpc_ssl_server_credentials_create_with_options(
     grpc_ssl_server_credentials_options* options) {
-  grpc_server_credentials* retval = NULL;
-  grpc_ssl_server_credentials* c = NULL;
+  grpc_server_credentials* retval = nullptr;
+  grpc_ssl_server_credentials* c = nullptr;
 
-  if (options == NULL) {
+  if (options == nullptr) {
     gpr_log(GPR_ERROR,
             "Invalid options trying to create SSL server credentials.");
     goto done;
   }
 
-  if (options->certificate_config == NULL &&
-      options->certificate_config_fetcher == NULL) {
+  if (options->certificate_config == nullptr &&
+      options->certificate_config_fetcher == nullptr) {
     gpr_log(GPR_ERROR,
             "SSL server credentials options must specify either "
             "certificate config or fetcher.");
     goto done;
-  } else if (options->certificate_config_fetcher != NULL &&
-             options->certificate_config_fetcher->cb == NULL) {
+  } else if (options->certificate_config_fetcher != nullptr &&
+             options->certificate_config_fetcher->cb == nullptr) {
     gpr_log(GPR_ERROR, "Certificate config fetcher callback must not be NULL.");
     goto done;
   }
@@ -318,7 +318,7 @@ grpc_server_credentials* grpc_ssl_server_credentials_create_with_options(
   gpr_ref_init(&c->base.refcount, 1);
   c->base.vtable = &ssl_server_vtable;
 
-  if (options->certificate_config_fetcher != NULL) {
+  if (options->certificate_config_fetcher != nullptr) {
     c->config.client_certificate_request = options->client_certificate_request;
     c->certificate_config_fetcher = *options->certificate_config_fetcher;
   } else {
@@ -337,7 +337,7 @@ done:
 
 void grpc_ssl_server_credentials_options_destroy(
     grpc_ssl_server_credentials_options* o) {
-  if (o == NULL) return;
+  if (o == nullptr) return;
   gpr_free(o->certificate_config_fetcher);
   grpc_ssl_server_certificate_config_destroy(o->certificate_config);
   gpr_free(o);
diff --git a/src/core/lib/security/transport/client_auth_filter.cc b/src/core/lib/security/transport/client_auth_filter.cc
index 11f5a13ccc..326f4d7773 100644
--- a/src/core/lib/security/transport/client_auth_filter.cc
+++ b/src/core/lib/security/transport/client_auth_filter.cc
@@ -67,18 +67,18 @@ typedef struct {
 
 void grpc_auth_metadata_context_reset(
     grpc_auth_metadata_context* auth_md_context) {
-  if (auth_md_context->service_url != NULL) {
+  if (auth_md_context->service_url != nullptr) {
     gpr_free((char*)auth_md_context->service_url);
-    auth_md_context->service_url = NULL;
+    auth_md_context->service_url = nullptr;
   }
-  if (auth_md_context->method_name != NULL) {
+  if (auth_md_context->method_name != nullptr) {
     gpr_free((char*)auth_md_context->method_name);
-    auth_md_context->method_name = NULL;
+    auth_md_context->method_name = nullptr;
   }
   GRPC_AUTH_CONTEXT_UNREF(
       (grpc_auth_context*)auth_md_context->channel_auth_context,
       "grpc_auth_metadata_context");
-  auth_md_context->channel_auth_context = NULL;
+  auth_md_context->channel_auth_context = nullptr;
 }
 
 static void add_error(grpc_error** combined, grpc_error* error) {
@@ -125,10 +125,10 @@ void grpc_auth_metadata_context_build(
     grpc_auth_metadata_context* auth_md_context) {
   char* service = grpc_slice_to_c_string(call_method);
   char* last_slash = strrchr(service, '/');
-  char* method_name = NULL;
-  char* service_url = NULL;
+  char* method_name = nullptr;
+  char* service_url = nullptr;
   grpc_auth_metadata_context_reset(auth_md_context);
-  if (last_slash == NULL) {
+  if (last_slash == nullptr) {
     gpr_log(GPR_ERROR, "No '/' found in fully qualified method name");
     service[0] = '\0';
     method_name = gpr_strdup("");
@@ -139,15 +139,15 @@ void grpc_auth_metadata_context_build(
     method_name = gpr_strdup(last_slash + 1);
   }
   char* host_and_port = grpc_slice_to_c_string(call_host);
-  if (url_scheme != NULL && strcmp(url_scheme, GRPC_SSL_URL_SCHEME) == 0) {
+  if (url_scheme != nullptr && strcmp(url_scheme, GRPC_SSL_URL_SCHEME) == 0) {
     /* Remove the port if it is 443. */
     char* port_delimiter = strrchr(host_and_port, ':');
-    if (port_delimiter != NULL && strcmp(port_delimiter + 1, "443") == 0) {
+    if (port_delimiter != nullptr && strcmp(port_delimiter + 1, "443") == 0) {
       *port_delimiter = '\0';
     }
   }
-  gpr_asprintf(&service_url, "%s://%s%s", url_scheme == NULL ? "" : url_scheme,
-               host_and_port, service);
+  gpr_asprintf(&service_url, "%s://%s%s",
+               url_scheme == nullptr ? "" : url_scheme, host_and_port, service);
   auth_md_context->service_url = service_url;
   auth_md_context->method_name = method_name;
   auth_md_context->channel_auth_context =
@@ -179,18 +179,18 @@ static void send_security_metadata(grpc_exec_ctx* exec_ctx,
           .value;
   grpc_call_credentials* channel_call_creds =
       chand->security_connector->request_metadata_creds;
-  int call_creds_has_md = (ctx != NULL) && (ctx->creds != NULL);
+  int call_creds_has_md = (ctx != nullptr) && (ctx->creds != nullptr);
 
-  if (channel_call_creds == NULL && !call_creds_has_md) {
+  if (channel_call_creds == nullptr && !call_creds_has_md) {
     /* Skip sending metadata altogether. */
     grpc_call_next_op(exec_ctx, elem, batch);
     return;
   }
 
-  if (channel_call_creds != NULL && call_creds_has_md) {
+  if (channel_call_creds != nullptr && call_creds_has_md) {
     calld->creds = grpc_composite_call_credentials_create(channel_call_creds,
-                                                          ctx->creds, NULL);
-    if (calld->creds == NULL) {
+                                                          ctx->creds, nullptr);
+    if (calld->creds == nullptr) {
       grpc_transport_stream_op_batch_finish_with_failure(
           exec_ctx, batch,
           grpc_error_set_int(
@@ -209,7 +209,7 @@ static void send_security_metadata(grpc_exec_ctx* exec_ctx,
       chand->security_connector->base.url_scheme, calld->host, calld->method,
       chand->auth_context, &calld->auth_md_context);
 
-  GPR_ASSERT(calld->pollent != NULL);
+  GPR_ASSERT(calld->pollent != nullptr);
 
   GRPC_CLOSURE_INIT(&calld->async_result_closure, on_credentials_metadata,
                     batch, grpc_schedule_on_exec_ctx);
@@ -278,8 +278,8 @@ static void auth_start_transport_stream_op_batch(
   channel_data* chand = (channel_data*)elem->channel_data;
 
   if (!batch->cancel_stream) {
-    GPR_ASSERT(batch->payload->context != NULL);
-    if (batch->payload->context[GRPC_CONTEXT_SECURITY].value == NULL) {
+    GPR_ASSERT(batch->payload->context != nullptr);
+    if (batch->payload->context[GRPC_CONTEXT_SECURITY].value == nullptr) {
       batch->payload->context[GRPC_CONTEXT_SECURITY].value =
           grpc_client_security_context_create();
       batch->payload->context[GRPC_CONTEXT_SECURITY].destroy =
@@ -297,7 +297,7 @@ static void auth_start_transport_stream_op_batch(
   if (batch->send_initial_metadata) {
     for (grpc_linked_mdelem* l = batch->payload->send_initial_metadata
                                      .send_initial_metadata->list.head;
-         l != NULL; l = l->next) {
+         l != nullptr; l = l->next) {
       grpc_mdelem md = l->md;
       /* Pointer comparison is OK for md_elems created from the same context.
        */
@@ -386,13 +386,13 @@ static grpc_error* init_channel_elem(grpc_exec_ctx* exec_ctx,
                                      grpc_channel_element_args* args) {
   grpc_security_connector* sc =
       grpc_security_connector_find_in_args(args->channel_args);
-  if (sc == NULL) {
+  if (sc == nullptr) {
     return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
         "Security connector missing from client auth filter args");
   }
   grpc_auth_context* auth_context =
       grpc_find_auth_context_in_args(args->channel_args);
-  if (auth_context == NULL) {
+  if (auth_context == nullptr) {
     return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
         "Auth context missing from client auth filter args");
   }
@@ -420,7 +420,7 @@ static void destroy_channel_elem(grpc_exec_ctx* exec_ctx,
   /* grab pointers to our data from the channel element */
   channel_data* chand = (channel_data*)elem->channel_data;
   grpc_channel_security_connector* sc = chand->security_connector;
-  if (sc != NULL) {
+  if (sc != nullptr) {
     GRPC_SECURITY_CONNECTOR_UNREF(exec_ctx, &sc->base, "client_auth_filter");
   }
   GRPC_AUTH_CONTEXT_UNREF(chand->auth_context, "client_auth_filter");
diff --git a/src/core/lib/security/transport/lb_targets_info.cc b/src/core/lib/security/transport/lb_targets_info.cc
index 1655e18f37..c07be35840 100644
--- a/src/core/lib/security/transport/lb_targets_info.cc
+++ b/src/core/lib/security/transport/lb_targets_info.cc
@@ -49,9 +49,9 @@ grpc_slice_hash_table* grpc_lb_targets_info_find_in_args(
     const grpc_channel_args* args) {
   const grpc_arg* targets_info_arg =
       grpc_channel_args_find(args, GRPC_ARG_LB_SECURE_NAMING_MAP);
-  if (targets_info_arg != NULL) {
+  if (targets_info_arg != nullptr) {
     GPR_ASSERT(targets_info_arg->type == GRPC_ARG_POINTER);
     return (grpc_slice_hash_table*)targets_info_arg->value.pointer.p;
   }
-  return NULL;
+  return nullptr;
 }
diff --git a/src/core/lib/security/transport/secure_endpoint.cc b/src/core/lib/security/transport/secure_endpoint.cc
index 9a29e05715..3ba987a105 100644
--- a/src/core/lib/security/transport/secure_endpoint.cc
+++ b/src/core/lib/security/transport/secure_endpoint.cc
@@ -140,7 +140,7 @@ static void call_read_cb(grpc_exec_ctx* exec_ctx, secure_endpoint* ep,
       gpr_free(data);
     }
   }
-  ep->read_buffer = NULL;
+  ep->read_buffer = nullptr;
   GRPC_CLOSURE_SCHED(exec_ctx, ep->read_cb, error);
   SECURE_ENDPOINT_UNREF(exec_ctx, ep, "read");
 }
@@ -162,7 +162,7 @@ static void on_read(grpc_exec_ctx* exec_ctx, void* user_data,
     return;
   }
 
-  if (ep->zero_copy_protector != NULL) {
+  if (ep->zero_copy_protector != nullptr) {
     // Use zero-copy grpc protector to unprotect.
     result = tsi_zero_copy_grpc_protector_unprotect(
         exec_ctx, ep->zero_copy_protector, &ep->source_buffer, ep->read_buffer);
@@ -280,7 +280,7 @@ static void endpoint_write(grpc_exec_ctx* exec_ctx, grpc_endpoint* secure_ep,
     }
   }
 
-  if (ep->zero_copy_protector != NULL) {
+  if (ep->zero_copy_protector != nullptr) {
     // Use zero-copy grpc protector to protect.
     result = tsi_zero_copy_grpc_protector_protect(
         exec_ctx, ep->zero_copy_protector, slices, &ep->output_buffer);
@@ -434,7 +434,7 @@ grpc_endpoint* grpc_secure_endpoint_create(
   ep->read_staging_buffer = GRPC_SLICE_MALLOC(STAGING_BUFFER_SIZE);
   grpc_slice_buffer_init(&ep->output_buffer);
   grpc_slice_buffer_init(&ep->source_buffer);
-  ep->read_buffer = NULL;
+  ep->read_buffer = nullptr;
   GRPC_CLOSURE_INIT(&ep->on_read, on_read, ep, grpc_schedule_on_exec_ctx);
   gpr_mu_init(&ep->protector_mu);
   gpr_ref_init(&ep->ref, 1);
diff --git a/src/core/lib/security/transport/security_connector.cc b/src/core/lib/security/transport/security_connector.cc
index b5822d7454..b996cc8cdb 100644
--- a/src/core/lib/security/transport/security_connector.cc
+++ b/src/core/lib/security/transport/security_connector.cc
@@ -60,7 +60,7 @@ static const char* installed_roots_path =
 
 /* -- Overridden default roots. -- */
 
-static grpc_ssl_roots_override_callback ssl_roots_override_cb = NULL;
+static grpc_ssl_roots_override_callback ssl_roots_override_cb = nullptr;
 
 void grpc_set_ssl_roots_override_callback(grpc_ssl_roots_override_callback cb) {
   ssl_roots_override_cb = cb;
@@ -74,11 +74,11 @@ void grpc_set_ssl_roots_override_callback(grpc_ssl_roots_override_callback cb) {
   "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384"
 
 static gpr_once cipher_suites_once = GPR_ONCE_INIT;
-static const char* cipher_suites = NULL;
+static const char* cipher_suites = nullptr;
 
 static void init_cipher_suites(void) {
   char* overridden = gpr_getenv("GRPC_SSL_CIPHER_SUITES");
-  cipher_suites = overridden != NULL ? overridden : GRPC_SSL_CIPHER_SUITES;
+  cipher_suites = overridden != nullptr ? overridden : GRPC_SSL_CIPHER_SUITES;
 }
 
 static const char* ssl_cipher_suites(void) {
@@ -92,24 +92,24 @@ static const char* ssl_cipher_suites(void) {
 const tsi_peer_property* tsi_peer_get_property_by_name(const tsi_peer* peer,
                                                        const char* name) {
   size_t i;
-  if (peer == NULL) return NULL;
+  if (peer == nullptr) return nullptr;
   for (i = 0; i < peer->property_count; i++) {
     const tsi_peer_property* property = &peer->properties[i];
-    if (name == NULL && property->name == NULL) {
+    if (name == nullptr && property->name == nullptr) {
       return property;
     }
-    if (name != NULL && property->name != NULL &&
+    if (name != nullptr && property->name != nullptr &&
         strcmp(property->name, name) == 0) {
       return property;
     }
   }
-  return NULL;
+  return nullptr;
 }
 
 void grpc_channel_security_connector_add_handshakers(
     grpc_exec_ctx* exec_ctx, grpc_channel_security_connector* connector,
     grpc_handshake_manager* handshake_mgr) {
-  if (connector != NULL) {
+  if (connector != nullptr) {
     connector->add_handshakers(exec_ctx, connector, handshake_mgr);
   }
 }
@@ -117,7 +117,7 @@ void grpc_channel_security_connector_add_handshakers(
 void grpc_server_security_connector_add_handshakers(
     grpc_exec_ctx* exec_ctx, grpc_server_security_connector* connector,
     grpc_handshake_manager* handshake_mgr) {
-  if (connector != NULL) {
+  if (connector != nullptr) {
     connector->add_handshakers(exec_ctx, connector, handshake_mgr);
   }
 }
@@ -127,7 +127,7 @@ void grpc_security_connector_check_peer(grpc_exec_ctx* exec_ctx,
                                         tsi_peer peer,
                                         grpc_auth_context** auth_context,
                                         grpc_closure* on_peer_checked) {
-  if (sc == NULL) {
+  if (sc == nullptr) {
     GRPC_CLOSURE_SCHED(exec_ctx, on_peer_checked,
                        GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                            "cannot check peer -- no security connector"));
@@ -139,7 +139,7 @@ void grpc_security_connector_check_peer(grpc_exec_ctx* exec_ctx,
 
 int grpc_security_connector_cmp(grpc_security_connector* sc,
                                 grpc_security_connector* other) {
-  if (sc == NULL || other == NULL) return GPR_ICMP(sc, other);
+  if (sc == nullptr || other == nullptr) return GPR_ICMP(sc, other);
   int c = GPR_ICMP(sc->vtable, other->vtable);
   if (c != 0) return c;
   return sc->vtable->cmp(sc, other);
@@ -147,8 +147,8 @@ int grpc_security_connector_cmp(grpc_security_connector* sc,
 
 int grpc_channel_security_connector_cmp(grpc_channel_security_connector* sc1,
                                         grpc_channel_security_connector* sc2) {
-  GPR_ASSERT(sc1->channel_creds != NULL);
-  GPR_ASSERT(sc2->channel_creds != NULL);
+  GPR_ASSERT(sc1->channel_creds != nullptr);
+  GPR_ASSERT(sc2->channel_creds != nullptr);
   int c = GPR_ICMP(sc1->channel_creds, sc2->channel_creds);
   if (c != 0) return c;
   c = GPR_ICMP(sc1->request_metadata_creds, sc2->request_metadata_creds);
@@ -163,8 +163,8 @@ int grpc_channel_security_connector_cmp(grpc_channel_security_connector* sc1,
 
 int grpc_server_security_connector_cmp(grpc_server_security_connector* sc1,
                                        grpc_server_security_connector* sc2) {
-  GPR_ASSERT(sc1->server_creds != NULL);
-  GPR_ASSERT(sc2->server_creds != NULL);
+  GPR_ASSERT(sc1->server_creds != nullptr);
+  GPR_ASSERT(sc2->server_creds != nullptr);
   int c = GPR_ICMP(sc1->server_creds, sc2->server_creds);
   if (c != 0) return c;
   return GPR_ICMP((void*)sc1->add_handshakers, (void*)sc2->add_handshakers);
@@ -174,7 +174,7 @@ bool grpc_channel_security_connector_check_call_host(
     grpc_exec_ctx* exec_ctx, grpc_channel_security_connector* sc,
     const char* host, grpc_auth_context* auth_context,
     grpc_closure* on_call_host_checked, grpc_error** error) {
-  if (sc == NULL || sc->check_call_host == NULL) {
+  if (sc == nullptr || sc->check_call_host == nullptr) {
     *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
         "cannot check call host -- no security connector");
     return true;
@@ -186,7 +186,7 @@ bool grpc_channel_security_connector_check_call_host(
 void grpc_channel_security_connector_cancel_check_call_host(
     grpc_exec_ctx* exec_ctx, grpc_channel_security_connector* sc,
     grpc_closure* on_call_host_checked, grpc_error* error) {
-  if (sc == NULL || sc->cancel_check_call_host == NULL) {
+  if (sc == nullptr || sc->cancel_check_call_host == nullptr) {
     GRPC_ERROR_UNREF(error);
     return;
   }
@@ -197,7 +197,7 @@ void grpc_channel_security_connector_cancel_check_call_host(
 grpc_security_connector* grpc_security_connector_ref(
     grpc_security_connector* sc, const char* file, int line,
     const char* reason) {
-  if (sc == NULL) return NULL;
+  if (sc == nullptr) return nullptr;
   if (GRPC_TRACER_ON(grpc_trace_security_connector_refcount)) {
     gpr_atm val = gpr_atm_no_barrier_load(&sc->refcount.count);
     gpr_log(file, line, GPR_LOG_SEVERITY_DEBUG,
@@ -218,7 +218,7 @@ void grpc_security_connector_unref(grpc_exec_ctx* exec_ctx,
                                    grpc_security_connector* sc,
                                    const char* file, int line,
                                    const char* reason) {
-  if (sc == NULL) return;
+  if (sc == nullptr) return;
   if (GRPC_TRACER_ON(grpc_trace_security_connector_refcount)) {
     gpr_atm val = gpr_atm_no_barrier_load(&sc->refcount.count);
     gpr_log(file, line, GPR_LOG_SEVERITY_DEBUG,
@@ -257,11 +257,11 @@ grpc_arg grpc_security_connector_to_arg(grpc_security_connector* sc) {
 }
 
 grpc_security_connector* grpc_security_connector_from_arg(const grpc_arg* arg) {
-  if (strcmp(arg->key, GRPC_ARG_SECURITY_CONNECTOR)) return NULL;
+  if (strcmp(arg->key, GRPC_ARG_SECURITY_CONNECTOR)) return nullptr;
   if (arg->type != GRPC_ARG_POINTER) {
     gpr_log(GPR_ERROR, "Invalid type %d for arg %s", arg->type,
             GRPC_ARG_SECURITY_CONNECTOR);
-    return NULL;
+    return nullptr;
   }
   return (grpc_security_connector*)arg->value.pointer.p;
 }
@@ -269,13 +269,13 @@ grpc_security_connector* grpc_security_connector_from_arg(const grpc_arg* arg) {
 grpc_security_connector* grpc_security_connector_find_in_args(
     const grpc_channel_args* args) {
   size_t i;
-  if (args == NULL) return NULL;
+  if (args == nullptr) return nullptr;
   for (i = 0; i < args->num_args; i++) {
     grpc_security_connector* sc =
         grpc_security_connector_from_arg(&args->args[i]);
-    if (sc != NULL) return sc;
+    if (sc != nullptr) return sc;
   }
-  return NULL;
+  return nullptr;
 }
 
 static tsi_client_certificate_request_type
@@ -328,14 +328,14 @@ static void fake_server_destroy(grpc_exec_ctx* exec_ctx,
 
 static bool fake_check_target(const char* target_type, const char* target,
                               const char* set_str) {
-  GPR_ASSERT(target_type != NULL);
-  GPR_ASSERT(target != NULL);
-  char** set = NULL;
+  GPR_ASSERT(target_type != nullptr);
+  GPR_ASSERT(target != nullptr);
+  char** set = nullptr;
   size_t set_size = 0;
   gpr_string_split(set_str, ",", &set, &set_size);
   bool found = false;
   for (size_t i = 0; i < set_size; ++i) {
-    if (set[i] != NULL && strcmp(target, set[i]) == 0) found = true;
+    if (set[i] != nullptr && strcmp(target, set[i]) == 0) found = true;
   }
   for (size_t i = 0; i < set_size; ++i) {
     gpr_free(set[i]);
@@ -347,8 +347,8 @@ static bool fake_check_target(const char* target_type, const char* target,
 static void fake_secure_name_check(const char* target,
                                    const char* expected_targets,
                                    bool is_lb_channel) {
-  if (expected_targets == NULL) return;
-  char** lbs_and_backends = NULL;
+  if (expected_targets == nullptr) return;
+  char** lbs_and_backends = nullptr;
   size_t lbs_and_backends_size = 0;
   bool success = false;
   gpr_string_split(expected_targets, ";", &lbs_and_backends,
@@ -394,18 +394,18 @@ static void fake_check_peer(grpc_exec_ctx* exec_ctx,
                             grpc_closure* on_peer_checked) {
   const char* prop_name;
   grpc_error* error = GRPC_ERROR_NONE;
-  *auth_context = NULL;
+  *auth_context = nullptr;
   if (peer.property_count != 1) {
     error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
         "Fake peers should only have 1 property.");
     goto end;
   }
   prop_name = peer.properties[0].name;
-  if (prop_name == NULL ||
+  if (prop_name == nullptr ||
       strcmp(prop_name, TSI_CERTIFICATE_TYPE_PEER_PROPERTY)) {
     char* msg;
     gpr_asprintf(&msg, "Unexpected property in fake peer: %s.",
-                 prop_name == NULL ? "<EMPTY>" : prop_name);
+                 prop_name == nullptr ? "<EMPTY>" : prop_name);
     error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
     gpr_free(msg);
     goto end;
@@ -416,7 +416,7 @@ static void fake_check_peer(grpc_exec_ctx* exec_ctx,
         "Invalid value for cert type property.");
     goto end;
   }
-  *auth_context = grpc_auth_context_create(NULL);
+  *auth_context = grpc_auth_context_create(nullptr);
   grpc_auth_context_add_cstring_property(
       *auth_context, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
       GRPC_FAKE_TRANSPORT_SECURITY_TYPE);
@@ -452,7 +452,7 @@ static int fake_channel_cmp(grpc_security_connector* sc1,
   if (c != 0) return c;
   c = strcmp(c1->target, c2->target);
   if (c != 0) return c;
-  if (c1->expected_targets == NULL || c2->expected_targets == NULL) {
+  if (c1->expected_targets == nullptr || c2->expected_targets == nullptr) {
     c = GPR_ICMP(c1->expected_targets, c2->expected_targets);
   } else {
     c = strcmp(c1->expected_targets, c2->expected_targets);
@@ -527,7 +527,7 @@ grpc_channel_security_connector* grpc_fake_channel_security_connector_create(
   c->target = gpr_strdup(target);
   const char* expected_targets = grpc_fake_transport_get_expected_targets(args);
   c->expected_targets = gpr_strdup(expected_targets);
-  c->is_lb_channel = (grpc_lb_targets_info_find_in_args(args) != NULL);
+  c->is_lb_channel = (grpc_lb_targets_info_find_in_args(args) != nullptr);
   return &c->base;
 }
 
@@ -560,11 +560,11 @@ typedef struct {
 
 static bool server_connector_has_cert_config_fetcher(
     grpc_ssl_server_security_connector* c) {
-  GPR_ASSERT(c != NULL);
+  GPR_ASSERT(c != nullptr);
   grpc_ssl_server_credentials* server_creds =
       (grpc_ssl_server_credentials*)c->base.server_creds;
-  GPR_ASSERT(server_creds != NULL);
-  return server_creds->certificate_config_fetcher.cb != NULL;
+  GPR_ASSERT(server_creds != nullptr);
+  return server_creds->certificate_config_fetcher.cb != nullptr;
 }
 
 static void ssl_channel_destroy(grpc_exec_ctx* exec_ctx,
@@ -574,9 +574,9 @@ static void ssl_channel_destroy(grpc_exec_ctx* exec_ctx,
   grpc_channel_credentials_unref(exec_ctx, c->base.channel_creds);
   grpc_call_credentials_unref(exec_ctx, c->base.request_metadata_creds);
   tsi_ssl_client_handshaker_factory_unref(c->client_handshaker_factory);
-  c->client_handshaker_factory = NULL;
-  if (c->target_name != NULL) gpr_free(c->target_name);
-  if (c->overridden_target_name != NULL) gpr_free(c->overridden_target_name);
+  c->client_handshaker_factory = nullptr;
+  if (c->target_name != nullptr) gpr_free(c->target_name);
+  if (c->overridden_target_name != nullptr) gpr_free(c->overridden_target_name);
   gpr_free(sc);
 }
 
@@ -586,7 +586,7 @@ static void ssl_server_destroy(grpc_exec_ctx* exec_ctx,
       (grpc_ssl_server_security_connector*)sc;
   grpc_server_credentials_unref(exec_ctx, c->base.server_creds);
   tsi_ssl_server_handshaker_factory_unref(c->server_handshaker_factory);
-  c->server_handshaker_factory = NULL;
+  c->server_handshaker_factory = nullptr;
   gpr_free(sc);
 }
 
@@ -596,11 +596,11 @@ static void ssl_channel_add_handshakers(grpc_exec_ctx* exec_ctx,
   grpc_ssl_channel_security_connector* c =
       (grpc_ssl_channel_security_connector*)sc;
   // Instantiate TSI handshaker.
-  tsi_handshaker* tsi_hs = NULL;
+  tsi_handshaker* tsi_hs = nullptr;
   tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
       c->client_handshaker_factory,
-      c->overridden_target_name != NULL ? c->overridden_target_name
-                                        : c->target_name,
+      c->overridden_target_name != nullptr ? c->overridden_target_name
+                                           : c->target_name,
       &tsi_hs);
   if (result != TSI_OK) {
     gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
@@ -615,7 +615,7 @@ static void ssl_channel_add_handshakers(grpc_exec_ctx* exec_ctx,
 }
 
 static const char** fill_alpn_protocol_strings(size_t* num_alpn_protocols) {
-  GPR_ASSERT(num_alpn_protocols != NULL);
+  GPR_ASSERT(num_alpn_protocols != nullptr);
   *num_alpn_protocols = grpc_chttp2_num_alpn_versions();
   const char** alpn_protocol_strings =
       (const char**)gpr_malloc(sizeof(const char*) * (*num_alpn_protocols));
@@ -632,7 +632,7 @@ static const char** fill_alpn_protocol_strings(size_t* num_alpn_protocols) {
 static bool try_replace_server_handshaker_factory(
     grpc_ssl_server_security_connector* sc,
     const grpc_ssl_server_certificate_config* config) {
-  if (config == NULL) {
+  if (config == nullptr) {
     gpr_log(GPR_ERROR,
             "Server certificate config callback returned invalid (NULL) "
             "config.");
@@ -645,7 +645,7 @@ static bool try_replace_server_handshaker_factory(
       fill_alpn_protocol_strings(&num_alpn_protocols);
   tsi_ssl_pem_key_cert_pair* cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
       config->pem_key_cert_pairs, config->num_key_cert_pairs);
-  tsi_ssl_server_handshaker_factory* new_handshaker_factory = NULL;
+  tsi_ssl_server_handshaker_factory* new_handshaker_factory = nullptr;
   grpc_ssl_server_credentials* server_creds =
       (grpc_ssl_server_credentials*)sc->base.server_creds;
   tsi_result result = tsi_create_ssl_server_handshaker_factory_ex(
@@ -672,10 +672,10 @@ static bool try_replace_server_handshaker_factory(
  * an error. Returns true if new credentials were sucessfully loaded. */
 static bool try_fetch_ssl_server_credentials(
     grpc_ssl_server_security_connector* sc) {
-  grpc_ssl_server_certificate_config* certificate_config = NULL;
+  grpc_ssl_server_certificate_config* certificate_config = nullptr;
   bool status;
 
-  GPR_ASSERT(sc != NULL);
+  GPR_ASSERT(sc != nullptr);
   if (!server_connector_has_cert_config_fetcher(sc)) return false;
 
   grpc_ssl_server_credentials* server_creds =
@@ -697,7 +697,7 @@ static bool try_fetch_ssl_server_credentials(
     status = false;
   }
 
-  if (certificate_config != NULL) {
+  if (certificate_config != nullptr) {
     grpc_ssl_server_certificate_config_destroy(certificate_config);
   }
   return status;
@@ -710,7 +710,7 @@ static void ssl_server_add_handshakers(grpc_exec_ctx* exec_ctx,
       (grpc_ssl_server_security_connector*)sc;
   // Instantiate TSI handshaker.
   try_fetch_ssl_server_credentials(c);
-  tsi_handshaker* tsi_hs = NULL;
+  tsi_handshaker* tsi_hs = nullptr;
   tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
       c->server_handshaker_factory, &tsi_hs);
   if (result != TSI_OK) {
@@ -726,10 +726,10 @@ static void ssl_server_add_handshakers(grpc_exec_ctx* exec_ctx,
 }
 
 static int ssl_host_matches_name(const tsi_peer* peer, const char* peer_name) {
-  char* allocated_name = NULL;
+  char* allocated_name = nullptr;
   int r;
 
-  if (strchr(peer_name, ':') != NULL) {
+  if (strchr(peer_name, ':') != nullptr) {
     char* ignored_port;
     gpr_split_host_port(peer_name, &allocated_name, &ignored_port);
     gpr_free(ignored_port);
@@ -743,21 +743,21 @@ static int ssl_host_matches_name(const tsi_peer* peer, const char* peer_name) {
 
 grpc_auth_context* tsi_ssl_peer_to_auth_context(const tsi_peer* peer) {
   size_t i;
-  grpc_auth_context* ctx = NULL;
-  const char* peer_identity_property_name = NULL;
+  grpc_auth_context* ctx = nullptr;
+  const char* peer_identity_property_name = nullptr;
 
   /* The caller has checked the certificate type property. */
   GPR_ASSERT(peer->property_count >= 1);
-  ctx = grpc_auth_context_create(NULL);
+  ctx = grpc_auth_context_create(nullptr);
   grpc_auth_context_add_cstring_property(
       ctx, GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME,
       GRPC_SSL_TRANSPORT_SECURITY_TYPE);
   for (i = 0; i < peer->property_count; i++) {
     const tsi_peer_property* prop = &peer->properties[i];
-    if (prop->name == NULL) continue;
+    if (prop->name == nullptr) continue;
     if (strcmp(prop->name, TSI_X509_SUBJECT_COMMON_NAME_PEER_PROPERTY) == 0) {
       /* If there is no subject alt name, have the CN as the identity. */
-      if (peer_identity_property_name == NULL) {
+      if (peer_identity_property_name == nullptr) {
         peer_identity_property_name = GRPC_X509_CN_PROPERTY_NAME;
       }
       grpc_auth_context_add_property(ctx, GRPC_X509_CN_PROPERTY_NAME,
@@ -772,7 +772,7 @@ grpc_auth_context* tsi_ssl_peer_to_auth_context(const tsi_peer* peer) {
                                      prop->value.data, prop->value.length);
     }
   }
-  if (peer_identity_property_name != NULL) {
+  if (peer_identity_property_name != nullptr) {
     GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name(
                    ctx, peer_identity_property_name) == 1);
   }
@@ -785,7 +785,7 @@ static grpc_error* ssl_check_peer(grpc_security_connector* sc,
   /* Check the ALPN. */
   const tsi_peer_property* p =
       tsi_peer_get_property_by_name(peer, TSI_SSL_ALPN_SELECTED_PROTOCOL);
-  if (p == NULL) {
+  if (p == nullptr) {
     return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
         "Cannot check peer: missing selected ALPN property.");
   }
@@ -795,7 +795,7 @@ static grpc_error* ssl_check_peer(grpc_security_connector* sc,
   }
 
   /* Check the peer name if specified. */
-  if (peer_name != NULL && !ssl_host_matches_name(peer, peer_name)) {
+  if (peer_name != nullptr && !ssl_host_matches_name(peer, peer_name)) {
     char* msg;
     gpr_asprintf(&msg, "Peer name %s is not in peer certificate", peer_name);
     grpc_error* error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
@@ -813,7 +813,7 @@ static void ssl_channel_check_peer(grpc_exec_ctx* exec_ctx,
   grpc_ssl_channel_security_connector* c =
       (grpc_ssl_channel_security_connector*)sc;
   grpc_error* error = ssl_check_peer(sc,
-                                     c->overridden_target_name != NULL
+                                     c->overridden_target_name != nullptr
                                          ? c->overridden_target_name
                                          : c->target_name,
                                      &peer, auth_context);
@@ -825,7 +825,7 @@ static void ssl_server_check_peer(grpc_exec_ctx* exec_ctx,
                                   grpc_security_connector* sc, tsi_peer peer,
                                   grpc_auth_context** auth_context,
                                   grpc_closure* on_peer_checked) {
-  grpc_error* error = ssl_check_peer(sc, NULL, &peer, auth_context);
+  grpc_error* error = ssl_check_peer(sc, nullptr, &peer, auth_context);
   tsi_peer_destruct(&peer);
   GRPC_CLOSURE_SCHED(exec_ctx, on_peer_checked, error);
 }
@@ -840,8 +840,8 @@ static int ssl_channel_cmp(grpc_security_connector* sc1,
   if (c != 0) return c;
   c = strcmp(c1->target_name, c2->target_name);
   if (c != 0) return c;
-  return (c1->overridden_target_name == NULL ||
-          c2->overridden_target_name == NULL)
+  return (c1->overridden_target_name == nullptr ||
+          c2->overridden_target_name == nullptr)
              ? GPR_ICMP(c1->overridden_target_name, c2->overridden_target_name)
              : strcmp(c1->overridden_target_name, c2->overridden_target_name);
 }
@@ -871,13 +871,13 @@ tsi_peer tsi_shallow_peer_from_ssl_auth_context(
   memset(&peer, 0, sizeof(peer));
 
   it = grpc_auth_context_property_iterator(auth_context);
-  while (grpc_auth_property_iterator_next(&it) != NULL) max_num_props++;
+  while (grpc_auth_property_iterator_next(&it) != nullptr) max_num_props++;
 
   if (max_num_props > 0) {
     peer.properties = (tsi_peer_property*)gpr_malloc(max_num_props *
                                                      sizeof(tsi_peer_property));
     it = grpc_auth_context_property_iterator(auth_context);
-    while ((prop = grpc_auth_property_iterator_next(&it)) != NULL) {
+    while ((prop = grpc_auth_property_iterator_next(&it)) != nullptr) {
       if (strcmp(prop->name, GRPC_X509_SAN_PROPERTY_NAME) == 0) {
         add_shallow_auth_property_to_peer(
             &peer, prop, TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY);
@@ -894,7 +894,7 @@ tsi_peer tsi_shallow_peer_from_ssl_auth_context(
 }
 
 void tsi_shallow_peer_destruct(tsi_peer* peer) {
-  if (peer->properties != NULL) gpr_free(peer->properties);
+  if (peer->properties != nullptr) gpr_free(peer->properties);
 }
 
 static bool ssl_channel_check_call_host(grpc_exec_ctx* exec_ctx,
@@ -911,7 +911,8 @@ static bool ssl_channel_check_call_host(grpc_exec_ctx* exec_ctx,
   /* If the target name was overridden, then the original target_name was
      'checked' transitively during the previous peer check at the end of the
      handshake. */
-  if (c->overridden_target_name != NULL && strcmp(host, c->target_name) == 0) {
+  if (c->overridden_target_name != nullptr &&
+      strcmp(host, c->target_name) == 0) {
     status = GRPC_SECURITY_OK;
   }
   if (status != GRPC_SECURITY_OK) {
@@ -941,7 +942,7 @@ static grpc_slice compute_default_pem_root_certs_once(void) {
   /* First try to load the roots from the environment. */
   char* default_root_certs_path =
       gpr_getenv(GRPC_DEFAULT_SSL_ROOTS_FILE_PATH_ENV_VAR);
-  if (default_root_certs_path != NULL) {
+  if (default_root_certs_path != nullptr) {
     GRPC_LOG_IF_ERROR("load_file",
                       grpc_load_file(default_root_certs_path, 1, &result));
     gpr_free(default_root_certs_path);
@@ -949,11 +950,11 @@ static grpc_slice compute_default_pem_root_certs_once(void) {
 
   /* Try overridden roots if needed. */
   grpc_ssl_roots_override_result ovrd_res = GRPC_SSL_ROOTS_OVERRIDE_FAIL;
-  if (GRPC_SLICE_IS_EMPTY(result) && ssl_roots_override_cb != NULL) {
-    char* pem_root_certs = NULL;
+  if (GRPC_SLICE_IS_EMPTY(result) && ssl_roots_override_cb != nullptr) {
+    char* pem_root_certs = nullptr;
     ovrd_res = ssl_roots_override_cb(&pem_root_certs);
     if (ovrd_res == GRPC_SSL_ROOTS_OVERRIDE_OK) {
-      GPR_ASSERT(pem_root_certs != NULL);
+      GPR_ASSERT(pem_root_certs != nullptr);
       result = grpc_slice_from_copied_buffer(
           pem_root_certs,
           strlen(pem_root_certs) + 1);  // NULL terminator.
@@ -986,7 +987,7 @@ const char* grpc_get_default_ssl_roots(void) {
   static gpr_once once = GPR_ONCE_INIT;
   gpr_once_init(&once, init_default_pem_root_certs);
   return GRPC_SLICE_IS_EMPTY(default_pem_root_certs)
-             ? NULL
+             ? nullptr
              : (const char*)GRPC_SLICE_START_PTR(default_pem_root_certs);
 }
 
@@ -1004,13 +1005,13 @@ grpc_security_status grpc_ssl_channel_security_connector_create(
   char* port;
   bool has_key_cert_pair;
 
-  if (config == NULL || target_name == NULL) {
+  if (config == nullptr || target_name == nullptr) {
     gpr_log(GPR_ERROR, "An ssl channel needs a config and a target name.");
     goto error;
   }
-  if (config->pem_root_certs == NULL) {
+  if (config->pem_root_certs == nullptr) {
     pem_root_certs = grpc_get_default_ssl_roots();
-    if (pem_root_certs == NULL) {
+    if (pem_root_certs == nullptr) {
       gpr_log(GPR_ERROR, "Could not get default pem root certs.");
       goto error;
     }
@@ -1032,22 +1033,22 @@ grpc_security_status grpc_ssl_channel_security_connector_create(
   c->base.add_handshakers = ssl_channel_add_handshakers;
   gpr_split_host_port(target_name, &c->target_name, &port);
   gpr_free(port);
-  if (overridden_target_name != NULL) {
+  if (overridden_target_name != nullptr) {
     c->overridden_target_name = gpr_strdup(overridden_target_name);
   }
 
-  has_key_cert_pair = config->pem_key_cert_pair != NULL &&
-                      config->pem_key_cert_pair->private_key != NULL &&
-                      config->pem_key_cert_pair->cert_chain != NULL;
+  has_key_cert_pair = config->pem_key_cert_pair != nullptr &&
+                      config->pem_key_cert_pair->private_key != nullptr &&
+                      config->pem_key_cert_pair->cert_chain != nullptr;
   result = tsi_create_ssl_client_handshaker_factory(
-      has_key_cert_pair ? config->pem_key_cert_pair : NULL, pem_root_certs,
+      has_key_cert_pair ? config->pem_key_cert_pair : nullptr, pem_root_certs,
       ssl_cipher_suites(), alpn_protocol_strings, (uint16_t)num_alpn_protocols,
       &c->client_handshaker_factory);
   if (result != TSI_OK) {
     gpr_log(GPR_ERROR, "Handshaker factory creation failed with %s.",
             tsi_result_to_string(result));
     ssl_channel_destroy(exec_ctx, &c->base.base);
-    *sc = NULL;
+    *sc = nullptr;
     goto error;
   }
   *sc = &c->base;
@@ -1081,8 +1082,8 @@ grpc_security_status grpc_ssl_server_security_connector_create(
       (grpc_ssl_server_credentials*)gsc;
   grpc_security_status retval = GRPC_SECURITY_OK;
 
-  GPR_ASSERT(server_credentials != NULL);
-  GPR_ASSERT(sc != NULL);
+  GPR_ASSERT(server_credentials != nullptr);
+  GPR_ASSERT(sc != nullptr);
 
   grpc_ssl_server_security_connector* c =
       grpc_ssl_server_security_connector_initialize(gsc);
@@ -1115,8 +1116,8 @@ grpc_security_status grpc_ssl_server_security_connector_create(
   if (retval == GRPC_SECURITY_OK) {
     *sc = &c->base;
   } else {
-    if (c != NULL) ssl_server_destroy(exec_ctx, &c->base.base);
-    if (sc != NULL) *sc = NULL;
+    if (c != nullptr) ssl_server_destroy(exec_ctx, &c->base.base);
+    if (sc != nullptr) *sc = nullptr;
   }
   return retval;
 }
diff --git a/src/core/lib/security/transport/security_handshaker.cc b/src/core/lib/security/transport/security_handshaker.cc
index 8cb29f9710..7067b70cb6 100644
--- a/src/core/lib/security/transport/security_handshaker.cc
+++ b/src/core/lib/security/transport/security_handshaker.cc
@@ -90,10 +90,10 @@ static void security_handshaker_unref(grpc_exec_ctx* exec_ctx,
     gpr_mu_destroy(&h->mu);
     tsi_handshaker_destroy(h->handshaker);
     tsi_handshaker_result_destroy(h->handshaker_result);
-    if (h->endpoint_to_destroy != NULL) {
+    if (h->endpoint_to_destroy != nullptr) {
       grpc_endpoint_destroy(exec_ctx, h->endpoint_to_destroy);
     }
-    if (h->read_buffer_to_destroy != NULL) {
+    if (h->read_buffer_to_destroy != nullptr) {
       grpc_slice_buffer_destroy_internal(exec_ctx, h->read_buffer_to_destroy);
       gpr_free(h->read_buffer_to_destroy);
     }
@@ -110,11 +110,11 @@ static void security_handshaker_unref(grpc_exec_ctx* exec_ctx,
 static void cleanup_args_for_failure_locked(grpc_exec_ctx* exec_ctx,
                                             security_handshaker* h) {
   h->endpoint_to_destroy = h->args->endpoint;
-  h->args->endpoint = NULL;
+  h->args->endpoint = nullptr;
   h->read_buffer_to_destroy = h->args->read_buffer;
-  h->args->read_buffer = NULL;
+  h->args->read_buffer = nullptr;
   grpc_channel_args_destroy(exec_ctx, h->args->args);
-  h->args->args = NULL;
+  h->args->args = nullptr;
 }
 
 // If the handshake failed or we're shutting down, clean up and invoke the
@@ -154,9 +154,9 @@ static void on_peer_checked_inner(grpc_exec_ctx* exec_ctx,
     return;
   }
   // Create zero-copy frame protector, if implemented.
-  tsi_zero_copy_grpc_protector* zero_copy_protector = NULL;
+  tsi_zero_copy_grpc_protector* zero_copy_protector = nullptr;
   tsi_result result = tsi_handshaker_result_create_zero_copy_grpc_protector(
-      exec_ctx, h->handshaker_result, NULL, &zero_copy_protector);
+      exec_ctx, h->handshaker_result, nullptr, &zero_copy_protector);
   if (result != TSI_OK && result != TSI_UNIMPLEMENTED) {
     error = grpc_set_tsi_error_result(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING(
@@ -166,10 +166,10 @@ static void on_peer_checked_inner(grpc_exec_ctx* exec_ctx,
     return;
   }
   // Create frame protector if zero-copy frame protector is NULL.
-  tsi_frame_protector* protector = NULL;
-  if (zero_copy_protector == NULL) {
+  tsi_frame_protector* protector = nullptr;
+  if (zero_copy_protector == nullptr) {
     result = tsi_handshaker_result_create_frame_protector(h->handshaker_result,
-                                                          NULL, &protector);
+                                                          nullptr, &protector);
     if (result != TSI_OK) {
       error = grpc_set_tsi_error_result(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                                             "Frame protector creation failed"),
@@ -179,7 +179,7 @@ static void on_peer_checked_inner(grpc_exec_ctx* exec_ctx,
     }
   }
   // Get unused bytes.
-  const unsigned char* unused_bytes = NULL;
+  const unsigned char* unused_bytes = nullptr;
   size_t unused_bytes_size = 0;
   result = tsi_handshaker_result_get_unused_bytes(
       h->handshaker_result, &unused_bytes, &unused_bytes_size);
@@ -192,10 +192,10 @@ static void on_peer_checked_inner(grpc_exec_ctx* exec_ctx,
     grpc_slice_unref_internal(exec_ctx, slice);
   } else {
     h->args->endpoint = grpc_secure_endpoint_create(
-        protector, zero_copy_protector, h->args->endpoint, NULL, 0);
+        protector, zero_copy_protector, h->args->endpoint, nullptr, 0);
   }
   tsi_handshaker_result_destroy(h->handshaker_result);
-  h->handshaker_result = NULL;
+  h->handshaker_result = nullptr;
   // Add auth context to channel args.
   grpc_arg auth_context_arg = grpc_auth_context_to_arg(h->auth_context);
   grpc_channel_args* tmp_args = h->args->args;
@@ -249,8 +249,8 @@ static grpc_error* on_handshake_next_done_locked(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING("Handshake failed"), result);
   }
   // Update handshaker result.
-  if (handshaker_result != NULL) {
-    GPR_ASSERT(h->handshaker_result == NULL);
+  if (handshaker_result != nullptr) {
+    GPR_ASSERT(h->handshaker_result == nullptr);
     h->handshaker_result = handshaker_result;
   }
   if (bytes_to_send_size > 0) {
@@ -261,7 +261,7 @@ static grpc_error* on_handshake_next_done_locked(
     grpc_slice_buffer_add(&h->outgoing, to_send);
     grpc_endpoint_write(exec_ctx, h->args->endpoint, &h->outgoing,
                         &h->on_handshake_data_sent_to_peer);
-  } else if (handshaker_result == NULL) {
+  } else if (handshaker_result == nullptr) {
     // There is nothing to send, but need to read from peer.
     grpc_endpoint_read(exec_ctx, h->args->endpoint, h->args->read_buffer,
                        &h->on_handshake_data_received_from_peer);
@@ -297,9 +297,9 @@ static grpc_error* do_handshaker_next_locked(
     grpc_exec_ctx* exec_ctx, security_handshaker* h,
     const unsigned char* bytes_received, size_t bytes_received_size) {
   // Invoke TSI handshaker.
-  const unsigned char* bytes_to_send = NULL;
+  const unsigned char* bytes_to_send = nullptr;
   size_t bytes_to_send_size = 0;
-  tsi_handshaker_result* handshaker_result = NULL;
+  tsi_handshaker_result* handshaker_result = nullptr;
   tsi_result result = tsi_handshaker_next(
       h->handshaker, bytes_received, bytes_received_size, &bytes_to_send,
       &bytes_to_send_size, &handshaker_result,
@@ -358,7 +358,7 @@ static void on_handshake_data_sent_to_peer(grpc_exec_ctx* exec_ctx, void* arg,
     return;
   }
   // We may be done.
-  if (h->handshaker_result == NULL) {
+  if (h->handshaker_result == nullptr) {
     grpc_endpoint_read(exec_ctx, h->args->endpoint, h->args->read_buffer,
                        &h->on_handshake_data_received_from_peer);
   } else {
@@ -531,7 +531,7 @@ grpc_handshaker* grpc_security_handshaker_create(
     grpc_security_connector* connector) {
   // If no TSI handshaker was created, return a handshaker that always fails.
   // Otherwise, return a real security handshaker.
-  if (handshaker == NULL) {
+  if (handshaker == nullptr) {
     return fail_handshaker_create();
   } else {
     return security_handshaker_create(exec_ctx, handshaker, connector);
diff --git a/src/core/lib/security/transport/server_auth_filter.cc b/src/core/lib/security/transport/server_auth_filter.cc
index e1307410d6..9cf368acd0 100644
--- a/src/core/lib/security/transport/server_auth_filter.cc
+++ b/src/core/lib/security/transport/server_auth_filter.cc
@@ -56,8 +56,8 @@ static grpc_metadata_array metadata_batch_to_md_array(
   grpc_linked_mdelem* l;
   grpc_metadata_array result;
   grpc_metadata_array_init(&result);
-  for (l = batch->list.head; l != NULL; l = l->next) {
-    grpc_metadata* usr_md = NULL;
+  for (l = batch->list.head; l != nullptr; l = l->next) {
+    grpc_metadata* usr_md = nullptr;
     grpc_mdelem md = l->md;
     grpc_slice key = GRPC_MDKEY(md);
     grpc_slice value = GRPC_MDVALUE(md);
@@ -98,7 +98,7 @@ static void on_md_processing_done_inner(grpc_exec_ctx* exec_ctx,
   call_data* calld = (call_data*)elem->call_data;
   grpc_transport_stream_op_batch* batch = calld->recv_initial_metadata_batch;
   /* TODO(jboeuf): Implement support for response_md. */
-  if (response_md != NULL && num_response_md > 0) {
+  if (response_md != nullptr && num_response_md > 0) {
     gpr_log(GPR_INFO,
             "response_md in auth metadata processing not supported for now. "
             "Ignoring...");
@@ -127,7 +127,7 @@ static void on_md_processing_done(
                        (gpr_atm)STATE_DONE)) {
     grpc_error* error = GRPC_ERROR_NONE;
     if (status != GRPC_STATUS_OK) {
-      if (error_details == NULL) {
+      if (error_details == nullptr) {
         error_details = "Authentication metadata processing failed.";
       }
       error = grpc_error_set_int(
@@ -154,7 +154,7 @@ static void cancel_call(grpc_exec_ctx* exec_ctx, void* arg, grpc_error* error) {
   if (error != GRPC_ERROR_NONE &&
       gpr_atm_full_cas(&calld->state, (gpr_atm)STATE_INIT,
                        (gpr_atm)STATE_CANCELLED)) {
-    on_md_processing_done_inner(exec_ctx, elem, NULL, 0, NULL, 0,
+    on_md_processing_done_inner(exec_ctx, elem, nullptr, 0, nullptr, 0,
                                 GRPC_ERROR_REF(error));
   }
   GRPC_CALL_STACK_UNREF(exec_ctx, calld->owning_call, "cancel_call");
@@ -167,7 +167,7 @@ static void recv_initial_metadata_ready(grpc_exec_ctx* exec_ctx, void* arg,
   call_data* calld = (call_data*)elem->call_data;
   grpc_transport_stream_op_batch* batch = calld->recv_initial_metadata_batch;
   if (error == GRPC_ERROR_NONE) {
-    if (chand->creds != NULL && chand->creds->processor.process != NULL) {
+    if (chand->creds != nullptr && chand->creds->processor.process != nullptr) {
       // We're calling out to the application, so we need to make sure
       // to drop the call combiner early if we get cancelled.
       GRPC_CALL_STACK_REF(calld->owning_call, "cancel_call");
@@ -220,7 +220,7 @@ static grpc_error* init_call_elem(grpc_exec_ctx* exec_ctx,
       grpc_server_security_context_create();
   server_ctx->auth_context = grpc_auth_context_create(chand->auth_context);
   calld->auth_context = server_ctx->auth_context;
-  if (args->context[GRPC_CONTEXT_SECURITY].value != NULL) {
+  if (args->context[GRPC_CONTEXT_SECURITY].value != nullptr) {
     args->context[GRPC_CONTEXT_SECURITY].destroy(
         args->context[GRPC_CONTEXT_SECURITY].value);
   }
@@ -243,7 +243,7 @@ static grpc_error* init_channel_elem(grpc_exec_ctx* exec_ctx,
   channel_data* chand = (channel_data*)elem->channel_data;
   grpc_auth_context* auth_context =
       grpc_find_auth_context_in_args(args->channel_args);
-  GPR_ASSERT(auth_context != NULL);
+  GPR_ASSERT(auth_context != nullptr);
   chand->auth_context =
       GRPC_AUTH_CONTEXT_REF(auth_context, "server_auth_filter");
   grpc_server_credentials* creds =
diff --git a/src/core/lib/security/util/json_util.cc b/src/core/lib/security/util/json_util.cc
index 365bd1537c..fef1a1f51d 100644
--- a/src/core/lib/security/util/json_util.cc
+++ b/src/core/lib/security/util/json_util.cc
@@ -26,12 +26,12 @@
 const char* grpc_json_get_string_property(const grpc_json* json,
                                           const char* prop_name) {
   grpc_json* child;
-  for (child = json->child; child != NULL; child = child->next) {
+  for (child = json->child; child != nullptr; child = child->next) {
     if (strcmp(child->key, prop_name) == 0) break;
   }
-  if (child == NULL || child->type != GRPC_JSON_STRING) {
+  if (child == nullptr || child->type != GRPC_JSON_STRING) {
     gpr_log(GPR_ERROR, "Invalid or missing %s property.", prop_name);
-    return NULL;
+    return nullptr;
   }
   return child->value;
 }
@@ -40,7 +40,7 @@ bool grpc_copy_json_string_property(const grpc_json* json,
                                     const char* prop_name,
                                     char** copied_value) {
   const char* prop_value = grpc_json_get_string_property(json, prop_name);
-  if (prop_value == NULL) return false;
+  if (prop_value == nullptr) return false;
   *copied_value = gpr_strdup(prop_value);
   return true;
 }