Merge remote-tracking branch 'upstream/master' into gpr_test_util_to_grpc_test_util

23 files changed, 435 insertions, 343 deletions

diff --git a/test/core/bad_client/bad_client.cc b/test/core/bad_client/bad_client.cc
index 4f5d2a2862..ae1e42a4e0 100644
--- a/test/core/bad_client/bad_client.cc
+++ b/test/core/bad_client/bad_client.cc
@@ -66,7 +66,7 @@ static void server_setup_transport(void* ts, grpc_transport* transport) {
   thd_args* a = static_cast<thd_args*>(ts);
   grpc_core::ExecCtx exec_ctx;
   grpc_server_setup_transport(a->server, transport, nullptr,
-                              grpc_server_get_channel_args(a->server), 0);
+                              grpc_server_get_channel_args(a->server), nullptr);
 }
 
 /* Sets the read_done event */
diff --git a/test/core/client_channel/resolvers/dns_resolver_connectivity_test.cc b/test/core/client_channel/resolvers/dns_resolver_connectivity_test.cc
index 76769b2b64..0cf549d01d 100644
--- a/test/core/client_channel/resolvers/dns_resolver_connectivity_test.cc
+++ b/test/core/client_channel/resolvers/dns_resolver_connectivity_test.cc
@@ -21,10 +21,10 @@
 #include <grpc/grpc.h>
 #include <grpc/support/alloc.h>
 
-#include "src/core/ext/filters/client_channel/lb_policy_factory.h"
 #include "src/core/ext/filters/client_channel/resolver.h"
 #include "src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper.h"
 #include "src/core/ext/filters/client_channel/resolver_registry.h"
+#include "src/core/ext/filters/client_channel/server_address.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/combiner.h"
 #include "src/core/lib/iomgr/resolve_address.h"
@@ -63,8 +63,9 @@ static grpc_address_resolver_vtable test_resolver = {my_resolve_address,
 static grpc_ares_request* my_dns_lookup_ares_locked(
     const char* dns_server, const char* addr, const char* default_port,
     grpc_pollset_set* interested_parties, grpc_closure* on_done,
-    grpc_lb_addresses** lb_addrs, bool check_grpclb, char** service_config_json,
-    int query_timeout_ms, grpc_combiner* combiner) {
+    grpc_core::UniquePtr<grpc_core::ServerAddressList>* addresses,
+    bool check_grpclb, char** service_config_json, int query_timeout_ms,
+    grpc_combiner* combiner) {
   gpr_mu_lock(&g_mu);
   GPR_ASSERT(0 == strcmp("test", addr));
   grpc_error* error = GRPC_ERROR_NONE;
@@ -74,9 +75,11 @@ static grpc_ares_request* my_dns_lookup_ares_locked(
     error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Forced Failure");
   } else {
     gpr_mu_unlock(&g_mu);
-    *lb_addrs = grpc_lb_addresses_create(1, nullptr);
-    grpc_lb_addresses_set_address(*lb_addrs, 0, nullptr, 0, false, nullptr,
-                                  nullptr);
+    *addresses = grpc_core::MakeUnique<grpc_core::ServerAddressList>();
+    grpc_resolved_address dummy_resolved_address;
+    memset(&dummy_resolved_address, 0, sizeof(dummy_resolved_address));
+    dummy_resolved_address.len = 123;
+    (*addresses)->emplace_back(dummy_resolved_address, nullptr);
   }
   GRPC_CLOSURE_SCHED(on_done, error);
   return nullptr;
diff --git a/test/core/client_channel/resolvers/dns_resolver_cooldown_test.cc b/test/core/client_channel/resolvers/dns_resolver_cooldown_test.cc
index cdbe33dbe7..16210b8164 100644
--- a/test/core/client_channel/resolvers/dns_resolver_cooldown_test.cc
+++ b/test/core/client_channel/resolvers/dns_resolver_cooldown_test.cc
@@ -22,6 +22,7 @@
 
 #include "src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper.h"
 #include "src/core/ext/filters/client_channel/resolver_registry.h"
+#include "src/core/ext/filters/client_channel/server_address.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/iomgr/combiner.h"
@@ -40,8 +41,9 @@ static grpc_combiner* g_combiner;
 static grpc_ares_request* (*g_default_dns_lookup_ares_locked)(
     const char* dns_server, const char* name, const char* default_port,
     grpc_pollset_set* interested_parties, grpc_closure* on_done,
-    grpc_lb_addresses** addrs, bool check_grpclb, char** service_config_json,
-    int query_timeout_ms, grpc_combiner* combiner);
+    grpc_core::UniquePtr<grpc_core::ServerAddressList>* addresses,
+    bool check_grpclb, char** service_config_json, int query_timeout_ms,
+    grpc_combiner* combiner);
 
 // Counter incremented by test_resolve_address_impl indicating the number of
 // times a system-level resolution has happened.
@@ -90,11 +92,12 @@ static grpc_address_resolver_vtable test_resolver = {
 static grpc_ares_request* test_dns_lookup_ares_locked(
     const char* dns_server, const char* name, const char* default_port,
     grpc_pollset_set* interested_parties, grpc_closure* on_done,
-    grpc_lb_addresses** addrs, bool check_grpclb, char** service_config_json,
-    int query_timeout_ms, grpc_combiner* combiner) {
+    grpc_core::UniquePtr<grpc_core::ServerAddressList>* addresses,
+    bool check_grpclb, char** service_config_json, int query_timeout_ms,
+    grpc_combiner* combiner) {
   grpc_ares_request* result = g_default_dns_lookup_ares_locked(
-      dns_server, name, default_port, g_iomgr_args.pollset_set, on_done, addrs,
-      check_grpclb, service_config_json, query_timeout_ms, combiner);
+      dns_server, name, default_port, g_iomgr_args.pollset_set, on_done,
+      addresses, check_grpclb, service_config_json, query_timeout_ms, combiner);
   ++g_resolution_count;
   static grpc_millis last_resolution_time = 0;
   if (last_resolution_time == 0) {
diff --git a/test/core/client_channel/resolvers/fake_resolver_test.cc b/test/core/client_channel/resolvers/fake_resolver_test.cc
index 6362b95e50..3b06fe063a 100644
--- a/test/core/client_channel/resolvers/fake_resolver_test.cc
+++ b/test/core/client_channel/resolvers/fake_resolver_test.cc
@@ -22,10 +22,10 @@
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
-#include "src/core/ext/filters/client_channel/lb_policy_factory.h"
 #include "src/core/ext/filters/client_channel/parse_address.h"
 #include "src/core/ext/filters/client_channel/resolver/fake/fake_resolver.h"
 #include "src/core/ext/filters/client_channel/resolver_registry.h"
+#include "src/core/ext/filters/client_channel/server_address.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/combiner.h"
@@ -63,12 +63,14 @@ void on_resolution_cb(void* arg, grpc_error* error) {
   // We only check the addresses channel arg because that's the only one
   // explicitly set by the test via
   // FakeResolverResponseGenerator::SetResponse().
-  const grpc_lb_addresses* actual_lb_addresses =
-      grpc_lb_addresses_find_channel_arg(res->resolver_result);
-  const grpc_lb_addresses* expected_lb_addresses =
-      grpc_lb_addresses_find_channel_arg(res->expected_resolver_result);
-  GPR_ASSERT(
-      grpc_lb_addresses_cmp(actual_lb_addresses, expected_lb_addresses) == 0);
+  const grpc_core::ServerAddressList* actual_addresses =
+      grpc_core::FindServerAddressListChannelArg(res->resolver_result);
+  const grpc_core::ServerAddressList* expected_addresses =
+      grpc_core::FindServerAddressListChannelArg(res->expected_resolver_result);
+  GPR_ASSERT(actual_addresses->size() == expected_addresses->size());
+  for (size_t i = 0; i < expected_addresses->size(); ++i) {
+    GPR_ASSERT((*actual_addresses)[i] == (*expected_addresses)[i]);
+  }
   grpc_channel_args_destroy(res->resolver_result);
   grpc_channel_args_destroy(res->expected_resolver_result);
   gpr_event_set(&res->ev, (void*)1);
@@ -80,27 +82,35 @@ static grpc_channel_args* create_new_resolver_result() {
   const size_t num_addresses = 2;
   char* uri_string;
   char* balancer_name;
-  // Create grpc_lb_addresses.
-  grpc_lb_addresses* addresses =
-      grpc_lb_addresses_create(num_addresses, nullptr);
+  // Create address list.
+  grpc_core::ServerAddressList addresses;
   for (size_t i = 0; i < num_addresses; ++i) {
     gpr_asprintf(&uri_string, "ipv4:127.0.0.1:100%" PRIuPTR,
                  test_counter * num_addresses + i);
     grpc_uri* uri = grpc_uri_parse(uri_string, true);
     gpr_asprintf(&balancer_name, "balancer%" PRIuPTR,
                  test_counter * num_addresses + i);
-    grpc_lb_addresses_set_address_from_uri(
-        addresses, i, uri, bool(num_addresses % 2), balancer_name, nullptr);
+    grpc_resolved_address address;
+    GPR_ASSERT(grpc_parse_uri(uri, &address));
+    grpc_core::InlinedVector<grpc_arg, 2> args_to_add;
+    const bool is_balancer = num_addresses % 2;
+    if (is_balancer) {
+      args_to_add.emplace_back(grpc_channel_arg_integer_create(
+          const_cast<char*>(GRPC_ARG_ADDRESS_IS_BALANCER), 1));
+      args_to_add.emplace_back(grpc_channel_arg_string_create(
+          const_cast<char*>(GRPC_ARG_ADDRESS_BALANCER_NAME), balancer_name));
+    }
+    grpc_channel_args* args = grpc_channel_args_copy_and_add(
+        nullptr, args_to_add.data(), args_to_add.size());
+    addresses.emplace_back(address.addr, address.len, args);
     gpr_free(balancer_name);
     grpc_uri_destroy(uri);
     gpr_free(uri_string);
   }
-  // Convert grpc_lb_addresses to grpc_channel_args.
-  const grpc_arg addresses_arg =
-      grpc_lb_addresses_create_channel_arg(addresses);
+  // Embed the address list in channel args.
+  const grpc_arg addresses_arg = CreateServerAddressListChannelArg(&addresses);
   grpc_channel_args* results =
       grpc_channel_args_copy_and_add(nullptr, &addresses_arg, 1);
-  grpc_lb_addresses_destroy(addresses);
   ++test_counter;
   return results;
 }
diff --git a/test/core/end2end/fixtures/h2_sockpair+trace.cc b/test/core/end2end/fixtures/h2_sockpair+trace.cc
index 4f393b22d0..45f78b5964 100644
--- a/test/core/end2end/fixtures/h2_sockpair+trace.cc
+++ b/test/core/end2end/fixtures/h2_sockpair+trace.cc
@@ -53,7 +53,7 @@ static void server_setup_transport(void* ts, grpc_transport* transport) {
   grpc_endpoint_pair* sfd = static_cast<grpc_endpoint_pair*>(f->fixture_data);
   grpc_endpoint_add_to_pollset(sfd->server, grpc_cq_pollset(f->cq));
   grpc_server_setup_transport(f->server, transport, nullptr,
-                              grpc_server_get_channel_args(f->server), 0);
+                              grpc_server_get_channel_args(f->server), nullptr);
 }
 
 typedef struct {
diff --git a/test/core/end2end/fixtures/h2_sockpair.cc b/test/core/end2end/fixtures/h2_sockpair.cc
index 1627fe0eb4..77bce7ebb3 100644
--- a/test/core/end2end/fixtures/h2_sockpair.cc
+++ b/test/core/end2end/fixtures/h2_sockpair.cc
@@ -47,7 +47,7 @@ static void server_setup_transport(void* ts, grpc_transport* transport) {
   grpc_endpoint_pair* sfd = static_cast<grpc_endpoint_pair*>(f->fixture_data);
   grpc_endpoint_add_to_pollset(sfd->server, grpc_cq_pollset(f->cq));
   grpc_server_setup_transport(f->server, transport, nullptr,
-                              grpc_server_get_channel_args(f->server), 0);
+                              grpc_server_get_channel_args(f->server), nullptr);
 }
 
 typedef struct {
diff --git a/test/core/end2end/fixtures/h2_sockpair_1byte.cc b/test/core/end2end/fixtures/h2_sockpair_1byte.cc
index 8f1024b774..ac37841dc4 100644
--- a/test/core/end2end/fixtures/h2_sockpair_1byte.cc
+++ b/test/core/end2end/fixtures/h2_sockpair_1byte.cc
@@ -47,7 +47,7 @@ static void server_setup_transport(void* ts, grpc_transport* transport) {
   grpc_endpoint_pair* sfd = static_cast<grpc_endpoint_pair*>(f->fixture_data);
   grpc_endpoint_add_to_pollset(sfd->server, grpc_cq_pollset(f->cq));
   grpc_server_setup_transport(f->server, transport, nullptr,
-                              grpc_server_get_channel_args(f->server), 0);
+                              grpc_server_get_channel_args(f->server), nullptr);
 }
 
 typedef struct {
diff --git a/test/core/end2end/fuzzers/api_fuzzer.cc b/test/core/end2end/fuzzers/api_fuzzer.cc
index 9b6eddee6e..a0b8290475 100644
--- a/test/core/end2end/fuzzers/api_fuzzer.cc
+++ b/test/core/end2end/fuzzers/api_fuzzer.cc
@@ -24,8 +24,8 @@
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
-#include "src/core/ext/filters/client_channel/lb_policy_factory.h"
 #include "src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper.h"
+#include "src/core/ext/filters/client_channel/server_address.h"
 #include "src/core/ext/transport/chttp2/transport/chttp2_transport.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/env.h"
@@ -325,7 +325,7 @@ typedef struct addr_req {
   char* addr;
   grpc_closure* on_done;
   grpc_resolved_addresses** addrs;
-  grpc_lb_addresses** lb_addrs;
+  grpc_core::UniquePtr<grpc_core::ServerAddressList>* addresses;
 } addr_req;
 
 static void finish_resolve(void* arg, grpc_error* error) {
@@ -340,11 +340,12 @@ static void finish_resolve(void* arg, grpc_error* error) {
           gpr_malloc(sizeof(*addrs->addrs)));
       addrs->addrs[0].len = 0;
       *r->addrs = addrs;
-    } else if (r->lb_addrs != nullptr) {
-      grpc_lb_addresses* lb_addrs = grpc_lb_addresses_create(1, nullptr);
-      grpc_lb_addresses_set_address(lb_addrs, 0, nullptr, 0, false, nullptr,
-                                    nullptr);
-      *r->lb_addrs = lb_addrs;
+    } else if (r->addresses != nullptr) {
+      *r->addresses = grpc_core::MakeUnique<grpc_core::ServerAddressList>();
+      grpc_resolved_address dummy_resolved_address;
+      memset(&dummy_resolved_address, 0, sizeof(dummy_resolved_address));
+      dummy_resolved_address.len = 0;
+      (*r->addresses)->emplace_back(dummy_resolved_address, nullptr);
     }
     GRPC_CLOSURE_SCHED(r->on_done, GRPC_ERROR_NONE);
   } else {
@@ -354,18 +355,17 @@ static void finish_resolve(void* arg, grpc_error* error) {
   }
 
   gpr_free(r->addr);
-  gpr_free(r);
+  grpc_core::Delete(r);
 }
 
 void my_resolve_address(const char* addr, const char* default_port,
                         grpc_pollset_set* interested_parties,
                         grpc_closure* on_done,
-                        grpc_resolved_addresses** addresses) {
-  addr_req* r = static_cast<addr_req*>(gpr_malloc(sizeof(*r)));
+                        grpc_resolved_addresses** addrs) {
+  addr_req* r = grpc_core::New<addr_req>();
   r->addr = gpr_strdup(addr);
   r->on_done = on_done;
-  r->addrs = addresses;
-  r->lb_addrs = nullptr;
+  r->addrs = addrs;
   grpc_timer_init(
       &r->timer, GPR_MS_PER_SEC + grpc_core::ExecCtx::Get()->Now(),
       GRPC_CLOSURE_CREATE(finish_resolve, r, grpc_schedule_on_exec_ctx));
@@ -377,13 +377,14 @@ static grpc_address_resolver_vtable fuzzer_resolver = {my_resolve_address,
 grpc_ares_request* my_dns_lookup_ares_locked(
     const char* dns_server, const char* addr, const char* default_port,
     grpc_pollset_set* interested_parties, grpc_closure* on_done,
-    grpc_lb_addresses** lb_addrs, bool check_grpclb, char** service_config_json,
-    int query_timeout, grpc_combiner* combiner) {
+    grpc_core::UniquePtr<grpc_core::ServerAddressList>* addresses,
+    bool check_grpclb, char** service_config_json, int query_timeout,
+    grpc_combiner* combiner) {
   addr_req* r = static_cast<addr_req*>(gpr_malloc(sizeof(*r)));
   r->addr = gpr_strdup(addr);
   r->on_done = on_done;
   r->addrs = nullptr;
-  r->lb_addrs = lb_addrs;
+  r->addresses = addresses;
   grpc_timer_init(
       &r->timer, GPR_MS_PER_SEC + grpc_core::ExecCtx::Get()->Now(),
       GRPC_CLOSURE_CREATE(finish_resolve, r, grpc_schedule_on_exec_ctx));
@@ -420,7 +421,7 @@ static void do_connect(void* arg, grpc_error* error) {
 
     grpc_transport* transport =
         grpc_create_chttp2_transport(nullptr, server, false);
-    grpc_server_setup_transport(g_server, transport, nullptr, nullptr, 0);
+    grpc_server_setup_transport(g_server, transport, nullptr, nullptr, nullptr);
     grpc_chttp2_transport_start_reading(transport, nullptr, nullptr);
 
     GRPC_CLOSURE_SCHED(fc->closure, GRPC_ERROR_NONE);
diff --git a/test/core/end2end/fuzzers/server_fuzzer.cc b/test/core/end2end/fuzzers/server_fuzzer.cc
index bd686215dd..d370dc7de8 100644
--- a/test/core/end2end/fuzzers/server_fuzzer.cc
+++ b/test/core/end2end/fuzzers/server_fuzzer.cc
@@ -62,7 +62,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
     grpc_server_start(server);
     grpc_transport* transport =
         grpc_create_chttp2_transport(nullptr, mock_endpoint, false);
-    grpc_server_setup_transport(server, transport, nullptr, nullptr, 0);
+    grpc_server_setup_transport(server, transport, nullptr, nullptr, nullptr);
     grpc_chttp2_transport_start_reading(transport, nullptr, nullptr);
 
     grpc_call* call1 = nullptr;
diff --git a/test/core/end2end/goaway_server_test.cc b/test/core/end2end/goaway_server_test.cc
index 66e8ca5161..7e3b418cd9 100644
--- a/test/core/end2end/goaway_server_test.cc
+++ b/test/core/end2end/goaway_server_test.cc
@@ -28,8 +28,8 @@
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 #include <string.h>
-#include "src/core/ext/filters/client_channel/lb_policy_factory.h"
 #include "src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper.h"
+#include "src/core/ext/filters/client_channel/server_address.h"
 #include "src/core/lib/iomgr/resolve_address.h"
 #include "src/core/lib/iomgr/sockaddr.h"
 #include "test/core/end2end/cq_verifier.h"
@@ -47,8 +47,9 @@ static int g_resolve_port = -1;
 static grpc_ares_request* (*iomgr_dns_lookup_ares_locked)(
     const char* dns_server, const char* addr, const char* default_port,
     grpc_pollset_set* interested_parties, grpc_closure* on_done,
-    grpc_lb_addresses** addresses, bool check_grpclb,
-    char** service_config_json, int query_timeout_ms, grpc_combiner* combiner);
+    grpc_core::UniquePtr<grpc_core::ServerAddressList>* addresses,
+    bool check_grpclb, char** service_config_json, int query_timeout_ms,
+    grpc_combiner* combiner);
 
 static void (*iomgr_cancel_ares_request_locked)(grpc_ares_request* request);
 
@@ -103,11 +104,12 @@ static grpc_address_resolver_vtable test_resolver = {
 static grpc_ares_request* my_dns_lookup_ares_locked(
     const char* dns_server, const char* addr, const char* default_port,
     grpc_pollset_set* interested_parties, grpc_closure* on_done,
-    grpc_lb_addresses** lb_addrs, bool check_grpclb, char** service_config_json,
-    int query_timeout_ms, grpc_combiner* combiner) {
+    grpc_core::UniquePtr<grpc_core::ServerAddressList>* addresses,
+    bool check_grpclb, char** service_config_json, int query_timeout_ms,
+    grpc_combiner* combiner) {
   if (0 != strcmp(addr, "test")) {
     return iomgr_dns_lookup_ares_locked(
-        dns_server, addr, default_port, interested_parties, on_done, lb_addrs,
+        dns_server, addr, default_port, interested_parties, on_done, addresses,
         check_grpclb, service_config_json, query_timeout_ms, combiner);
   }
 
@@ -117,15 +119,12 @@ static grpc_ares_request* my_dns_lookup_ares_locked(
     gpr_mu_unlock(&g_mu);
     error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Forced Failure");
   } else {
-    *lb_addrs = grpc_lb_addresses_create(1, nullptr);
-    grpc_sockaddr_in* sa =
-        static_cast<grpc_sockaddr_in*>(gpr_zalloc(sizeof(grpc_sockaddr_in)));
-    sa->sin_family = GRPC_AF_INET;
-    sa->sin_addr.s_addr = 0x100007f;
-    sa->sin_port = grpc_htons(static_cast<uint16_t>(g_resolve_port));
-    grpc_lb_addresses_set_address(*lb_addrs, 0, sa, sizeof(*sa), false, nullptr,
-                                  nullptr);
-    gpr_free(sa);
+    *addresses = grpc_core::MakeUnique<grpc_core::ServerAddressList>();
+    grpc_sockaddr_in sa;
+    sa.sin_family = GRPC_AF_INET;
+    sa.sin_addr.s_addr = 0x100007f;
+    sa.sin_port = grpc_htons(static_cast<uint16_t>(g_resolve_port));
+    (*addresses)->emplace_back(&sa, sizeof(sa), nullptr);
     gpr_mu_unlock(&g_mu);
   }
   GRPC_CLOSURE_SCHED(on_done, error);
diff --git a/test/core/end2end/no_server_test.cc b/test/core/end2end/no_server_test.cc
index 5dda748f5a..c289e719ee 100644
--- a/test/core/end2end/no_server_test.cc
+++ b/test/core/end2end/no_server_test.cc
@@ -23,6 +23,7 @@
 #include <grpc/support/log.h>
 
 #include "src/core/ext/filters/client_channel/resolver/fake/fake_resolver.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
 #include "test/core/end2end/cq_verifier.h"
 #include "test/core/util/test_config.h"
 
diff --git a/test/core/end2end/tests/channelz.cc b/test/core/end2end/tests/channelz.cc
index 922783aa0d..169190eec0 100644
--- a/test/core/end2end/tests/channelz.cc
+++ b/test/core/end2end/tests/channelz.cc
@@ -259,8 +259,8 @@ static void test_channelz(grpc_end2end_test_config config) {
   GPR_ASSERT(nullptr == strstr(json, "\"severity\":\"CT_INFO\""));
   gpr_free(json);
 
-  json = channelz_server->RenderServerSockets(0);
-  GPR_ASSERT(nullptr != strstr(json, "\"socketRef\":"));
+  json = channelz_server->RenderServerSockets(0, 100);
+  GPR_ASSERT(nullptr != strstr(json, "\"end\":true"));
   gpr_free(json);
 
   end_test(&f);
diff --git a/test/core/iomgr/resolve_address_posix_test.cc b/test/core/iomgr/resolve_address_posix_test.cc
index ceeb70a108..5785c73e22 100644
--- a/test/core/iomgr/resolve_address_posix_test.cc
+++ b/test/core/iomgr/resolve_address_posix_test.cc
@@ -27,6 +27,8 @@
 #include <grpc/support/sync.h>
 #include <grpc/support/time.h>
 
+#include "src/core/lib/gpr/env.h"
+#include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/thd.h"
 #include "src/core/lib/iomgr/executor.h"
@@ -163,8 +165,15 @@ int main(int argc, char** argv) {
 
   {
     grpc_core::ExecCtx exec_ctx;
-    test_unix_socket();
-    test_unix_socket_path_name_too_long();
+    char* resolver_env = gpr_getenv("GRPC_DNS_RESOLVER");
+    // c-ares resolver doesn't support UDS (ability for native DNS resolver
+    // to handle this is only expected to be used by servers, which
+    // unconditionally use the native DNS resolver).
+    if (resolver_env == nullptr || gpr_stricmp(resolver_env, "native") == 0) {
+      test_unix_socket();
+      test_unix_socket_path_name_too_long();
+    }
+    gpr_free(resolver_env);
   }
 
   grpc_shutdown();
diff --git a/test/core/security/alts_security_connector_test.cc b/test/core/security/alts_security_connector_test.cc
index 9378236338..bcba340821 100644
--- a/test/core/security/alts_security_connector_test.cc
+++ b/test/core/security/alts_security_connector_test.cc
@@ -33,40 +33,34 @@ using grpc_core::internal::grpc_alts_auth_context_from_tsi_peer;
 
 /* This file contains unit tests of grpc_alts_auth_context_from_tsi_peer(). */
 static void test_invalid_input_failure() {
-  tsi_peer peer;
-  grpc_auth_context* ctx;
-  GPR_ASSERT(grpc_alts_auth_context_from_tsi_peer(nullptr, &ctx) ==
-             GRPC_SECURITY_ERROR);
-  GPR_ASSERT(grpc_alts_auth_context_from_tsi_peer(&peer, nullptr) ==
-             GRPC_SECURITY_ERROR);
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_alts_auth_context_from_tsi_peer(nullptr);
+  GPR_ASSERT(ctx == nullptr);
 }
 
 static void test_empty_certificate_type_failure() {
   tsi_peer peer;
-  grpc_auth_context* ctx = nullptr;
   GPR_ASSERT(tsi_construct_peer(0, &peer) == TSI_OK);
-  GPR_ASSERT(grpc_alts_auth_context_from_tsi_peer(&peer, &ctx) ==
-             GRPC_SECURITY_ERROR);
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_alts_auth_context_from_tsi_peer(&peer);
   GPR_ASSERT(ctx == nullptr);
   tsi_peer_destruct(&peer);
 }
 
 static void test_empty_peer_property_failure() {
   tsi_peer peer;
-  grpc_auth_context* ctx;
   GPR_ASSERT(tsi_construct_peer(1, &peer) == TSI_OK);
   GPR_ASSERT(tsi_construct_string_peer_property_from_cstring(
                  TSI_CERTIFICATE_TYPE_PEER_PROPERTY, TSI_ALTS_CERTIFICATE_TYPE,
                  &peer.properties[0]) == TSI_OK);
-  GPR_ASSERT(grpc_alts_auth_context_from_tsi_peer(&peer, &ctx) ==
-             GRPC_SECURITY_ERROR);
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_alts_auth_context_from_tsi_peer(&peer);
   GPR_ASSERT(ctx == nullptr);
   tsi_peer_destruct(&peer);
 }
 
 static void test_missing_rpc_protocol_versions_property_failure() {
   tsi_peer peer;
-  grpc_auth_context* ctx;
   GPR_ASSERT(tsi_construct_peer(kTsiAltsNumOfPeerProperties, &peer) == TSI_OK);
   GPR_ASSERT(tsi_construct_string_peer_property_from_cstring(
                  TSI_CERTIFICATE_TYPE_PEER_PROPERTY, TSI_ALTS_CERTIFICATE_TYPE,
@@ -74,23 +68,22 @@ static void test_missing_rpc_protocol_versions_property_failure() {
   GPR_ASSERT(tsi_construct_string_peer_property_from_cstring(
                  TSI_ALTS_SERVICE_ACCOUNT_PEER_PROPERTY, "alice",
                  &peer.properties[1]) == TSI_OK);
-  GPR_ASSERT(grpc_alts_auth_context_from_tsi_peer(&peer, &ctx) ==
-             GRPC_SECURITY_ERROR);
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_alts_auth_context_from_tsi_peer(&peer);
   GPR_ASSERT(ctx == nullptr);
   tsi_peer_destruct(&peer);
 }
 
 static void test_unknown_peer_property_failure() {
   tsi_peer peer;
-  grpc_auth_context* ctx;
   GPR_ASSERT(tsi_construct_peer(kTsiAltsNumOfPeerProperties, &peer) == TSI_OK);
   GPR_ASSERT(tsi_construct_string_peer_property_from_cstring(
                  TSI_CERTIFICATE_TYPE_PEER_PROPERTY, TSI_ALTS_CERTIFICATE_TYPE,
                  &peer.properties[0]) == TSI_OK);
   GPR_ASSERT(tsi_construct_string_peer_property_from_cstring(
                  "unknown", "alice", &peer.properties[1]) == TSI_OK);
-  GPR_ASSERT(grpc_alts_auth_context_from_tsi_peer(&peer, &ctx) ==
-             GRPC_SECURITY_ERROR);
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_alts_auth_context_from_tsi_peer(&peer);
   GPR_ASSERT(ctx == nullptr);
   tsi_peer_destruct(&peer);
 }
@@ -119,7 +112,6 @@ static bool test_identity(const grpc_auth_context* ctx,
 
 static void test_alts_peer_to_auth_context_success() {
   tsi_peer peer;
-  grpc_auth_context* ctx;
   GPR_ASSERT(tsi_construct_peer(kTsiAltsNumOfPeerProperties, &peer) == TSI_OK);
   GPR_ASSERT(tsi_construct_string_peer_property_from_cstring(
                  TSI_CERTIFICATE_TYPE_PEER_PROPERTY, TSI_ALTS_CERTIFICATE_TYPE,
@@ -144,11 +136,12 @@ static void test_alts_peer_to_auth_context_success() {
                      GRPC_SLICE_START_PTR(serialized_peer_versions)),
                  GRPC_SLICE_LENGTH(serialized_peer_versions),
                  &peer.properties[2]) == TSI_OK);
-  GPR_ASSERT(grpc_alts_auth_context_from_tsi_peer(&peer, &ctx) ==
-             GRPC_SECURITY_OK);
-  GPR_ASSERT(
-      test_identity(ctx, TSI_ALTS_SERVICE_ACCOUNT_PEER_PROPERTY, "alice"));
-  GRPC_AUTH_CONTEXT_UNREF(ctx, "test");
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_alts_auth_context_from_tsi_peer(&peer);
+  GPR_ASSERT(ctx != nullptr);
+  GPR_ASSERT(test_identity(ctx.get(), TSI_ALTS_SERVICE_ACCOUNT_PEER_PROPERTY,
+                           "alice"));
+  ctx.reset(DEBUG_LOCATION, "test");
   grpc_slice_unref(serialized_peer_versions);
   tsi_peer_destruct(&peer);
 }
diff --git a/test/core/security/auth_context_test.cc b/test/core/security/auth_context_test.cc
index 9a39afb800..e7e0cb2ed9 100644
--- a/test/core/security/auth_context_test.cc
+++ b/test/core/security/auth_context_test.cc
@@ -19,114 +19,122 @@
 #include <string.h>
 
 #include "src/core/lib/gpr/string.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "test/core/util/test_config.h"
 
 #include <grpc/support/log.h>
 
 static void test_empty_context(void) {
-  grpc_auth_context* ctx = grpc_auth_context_create(nullptr);
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_core::MakeRefCounted<grpc_auth_context>(nullptr);
   grpc_auth_property_iterator it;
 
   gpr_log(GPR_INFO, "test_empty_context");
   GPR_ASSERT(ctx != nullptr);
-  GPR_ASSERT(grpc_auth_context_peer_identity_property_name(ctx) == nullptr);
-  it = grpc_auth_context_peer_identity(ctx);
+  GPR_ASSERT(grpc_auth_context_peer_identity_property_name(ctx.get()) ==
+             nullptr);
+  it = grpc_auth_context_peer_identity(ctx.get());
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) == nullptr);
-  it = grpc_auth_context_property_iterator(ctx);
+  it = grpc_auth_context_property_iterator(ctx.get());
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) == nullptr);
-  it = grpc_auth_context_find_properties_by_name(ctx, "foo");
+  it = grpc_auth_context_find_properties_by_name(ctx.get(), "foo");
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) == nullptr);
-  GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name(ctx, "bar") ==
-             0);
-  GPR_ASSERT(grpc_auth_context_peer_identity_property_name(ctx) == nullptr);
-  GRPC_AUTH_CONTEXT_UNREF(ctx, "test");
+  GPR_ASSERT(
+      grpc_auth_context_set_peer_identity_property_name(ctx.get(), "bar") == 0);
+  GPR_ASSERT(grpc_auth_context_peer_identity_property_name(ctx.get()) ==
+             nullptr);
+  ctx.reset(DEBUG_LOCATION, "test");
 }
 
 static void test_simple_context(void) {
-  grpc_auth_context* ctx = grpc_auth_context_create(nullptr);
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_core::MakeRefCounted<grpc_auth_context>(nullptr);
   grpc_auth_property_iterator it;
   size_t i;
 
   gpr_log(GPR_INFO, "test_simple_context");
   GPR_ASSERT(ctx != nullptr);
-  grpc_auth_context_add_cstring_property(ctx, "name", "chapi");
-  grpc_auth_context_add_cstring_property(ctx, "name", "chapo");
-  grpc_auth_context_add_cstring_property(ctx, "foo", "bar");
-  GPR_ASSERT(ctx->properties.count == 3);
-  GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name(ctx, "name") ==
-             1);
-
-  GPR_ASSERT(
-      strcmp(grpc_auth_context_peer_identity_property_name(ctx), "name") == 0);
-  it = grpc_auth_context_property_iterator(ctx);
-  for (i = 0; i < ctx->properties.count; i++) {
+  grpc_auth_context_add_cstring_property(ctx.get(), "name", "chapi");
+  grpc_auth_context_add_cstring_property(ctx.get(), "name", "chapo");
+  grpc_auth_context_add_cstring_property(ctx.get(), "foo", "bar");
+  GPR_ASSERT(ctx->properties().count == 3);
+  GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name(ctx.get(),
+                                                               "name") == 1);
+
+  GPR_ASSERT(strcmp(grpc_auth_context_peer_identity_property_name(ctx.get()),
+                    "name") == 0);
+  it = grpc_auth_context_property_iterator(ctx.get());
+  for (i = 0; i < ctx->properties().count; i++) {
     const grpc_auth_property* p = grpc_auth_property_iterator_next(&it);
-    GPR_ASSERT(p == &ctx->properties.array[i]);
+    GPR_ASSERT(p == &ctx->properties().array[i]);
   }
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) == nullptr);
 
-  it = grpc_auth_context_find_properties_by_name(ctx, "foo");
+  it = grpc_auth_context_find_properties_by_name(ctx.get(), "foo");
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) ==
-             &ctx->properties.array[2]);
+             &ctx->properties().array[2]);
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) == nullptr);
 
-  it = grpc_auth_context_peer_identity(ctx);
+  it = grpc_auth_context_peer_identity(ctx.get());
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) ==
-             &ctx->properties.array[0]);
+             &ctx->properties().array[0]);
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) ==
-             &ctx->properties.array[1]);
+             &ctx->properties().array[1]);
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) == nullptr);
 
-  GRPC_AUTH_CONTEXT_UNREF(ctx, "test");
+  ctx.reset(DEBUG_LOCATION, "test");
 }
 
 static void test_chained_context(void) {
-  grpc_auth_context* chained = grpc_auth_context_create(nullptr);
-  grpc_auth_context* ctx = grpc_auth_context_create(chained);
+  grpc_core::RefCountedPtr<grpc_auth_context> chained =
+      grpc_core::MakeRefCounted<grpc_auth_context>(nullptr);
+  grpc_auth_context* chained_ptr = chained.get();
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_core::MakeRefCounted<grpc_auth_context>(std::move(chained));
+
   grpc_auth_property_iterator it;
   size_t i;
 
   gpr_log(GPR_INFO, "test_chained_context");
-  GRPC_AUTH_CONTEXT_UNREF(chained, "chained");
-  grpc_auth_context_add_cstring_property(chained, "name", "padapo");
-  grpc_auth_context_add_cstring_property(chained, "foo", "baz");
-  grpc_auth_context_add_cstring_property(ctx, "name", "chapi");
-  grpc_auth_context_add_cstring_property(ctx, "name", "chap0");
-  grpc_auth_context_add_cstring_property(ctx, "foo", "bar");
-  GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name(ctx, "name") ==
-             1);
-
-  GPR_ASSERT(
-      strcmp(grpc_auth_context_peer_identity_property_name(ctx), "name") == 0);
-  it = grpc_auth_context_property_iterator(ctx);
-  for (i = 0; i < ctx->properties.count; i++) {
+  grpc_auth_context_add_cstring_property(chained_ptr, "name", "padapo");
+  grpc_auth_context_add_cstring_property(chained_ptr, "foo", "baz");
+  grpc_auth_context_add_cstring_property(ctx.get(), "name", "chapi");
+  grpc_auth_context_add_cstring_property(ctx.get(), "name", "chap0");
+  grpc_auth_context_add_cstring_property(ctx.get(), "foo", "bar");
+  GPR_ASSERT(grpc_auth_context_set_peer_identity_property_name(ctx.get(),
+                                                               "name") == 1);
+
+  GPR_ASSERT(strcmp(grpc_auth_context_peer_identity_property_name(ctx.get()),
+                    "name") == 0);
+  it = grpc_auth_context_property_iterator(ctx.get());
+  for (i = 0; i < ctx->properties().count; i++) {
     const grpc_auth_property* p = grpc_auth_property_iterator_next(&it);
-    GPR_ASSERT(p == &ctx->properties.array[i]);
+    GPR_ASSERT(p == &ctx->properties().array[i]);
   }
-  for (i = 0; i < chained->properties.count; i++) {
+  for (i = 0; i < chained_ptr->properties().count; i++) {
     const grpc_auth_property* p = grpc_auth_property_iterator_next(&it);
-    GPR_ASSERT(p == &chained->properties.array[i]);
+    GPR_ASSERT(p == &chained_ptr->properties().array[i]);
   }
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) == nullptr);
 
-  it = grpc_auth_context_find_properties_by_name(ctx, "foo");
+  it = grpc_auth_context_find_properties_by_name(ctx.get(), "foo");
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) ==
-             &ctx->properties.array[2]);
+             &ctx->properties().array[2]);
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) ==
-             &chained->properties.array[1]);
+             &chained_ptr->properties().array[1]);
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) == nullptr);
 
-  it = grpc_auth_context_peer_identity(ctx);
+  it = grpc_auth_context_peer_identity(ctx.get());
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) ==
-             &ctx->properties.array[0]);
+             &ctx->properties().array[0]);
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) ==
-             &ctx->properties.array[1]);
+             &ctx->properties().array[1]);
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) ==
-             &chained->properties.array[0]);
+             &chained_ptr->properties().array[0]);
   GPR_ASSERT(grpc_auth_property_iterator_next(&it) == nullptr);
 
-  GRPC_AUTH_CONTEXT_UNREF(ctx, "test");
+  ctx.reset(DEBUG_LOCATION, "test");
 }
 
 int main(int argc, char** argv) {
diff --git a/test/core/security/credentials_test.cc b/test/core/security/credentials_test.cc
index b3e3c3c741..b3a8161786 100644
--- a/test/core/security/credentials_test.cc
+++ b/test/core/security/credentials_test.cc
@@ -46,19 +46,6 @@
 using grpc_core::internal::grpc_flush_cached_google_default_credentials;
 using grpc_core::internal::set_gce_tenancy_checker_for_testing;
 
-/* -- Mock channel credentials. -- */
-
-static grpc_channel_credentials* grpc_mock_channel_credentials_create(
-    const grpc_channel_credentials_vtable* vtable) {
-  grpc_channel_credentials* c =
-      static_cast<grpc_channel_credentials*>(gpr_malloc(sizeof(*c)));
-  memset(c, 0, sizeof(*c));
-  c->type = "mock";
-  c->vtable = vtable;
-  gpr_ref_init(&c->refcount, 1);
-  return c;
-}
-
 /* -- Constants. -- */
 
 static const char test_google_iam_authorization_token[] = "blahblahblhahb";
@@ -377,9 +364,9 @@ static void run_request_metadata_test(grpc_call_credentials* creds,
                                       grpc_auth_metadata_context auth_md_ctx,
                                       request_metadata_state* state) {
   grpc_error* error = GRPC_ERROR_NONE;
-  if (grpc_call_credentials_get_request_metadata(
-          creds, &state->pollent, auth_md_ctx, &state->md_array,
-          &state->on_request_metadata, &error)) {
+  if (creds->get_request_metadata(&state->pollent, auth_md_ctx,
+                                  &state->md_array, &state->on_request_metadata,
+                                  &error)) {
     // Synchronous result.  Invoke the callback directly.
     check_request_metadata(state, error);
     GRPC_ERROR_UNREF(error);
@@ -400,7 +387,7 @@ static void test_google_iam_creds(void) {
   grpc_auth_metadata_context auth_md_ctx = {test_service_url, test_method,
                                             nullptr, nullptr};
   run_request_metadata_test(creds, auth_md_ctx, state);
-  grpc_call_credentials_unref(creds);
+  creds->Unref();
 }
 
 static void test_access_token_creds(void) {
@@ -412,28 +399,36 @@ static void test_access_token_creds(void) {
       grpc_access_token_credentials_create("blah", nullptr);
   grpc_auth_metadata_context auth_md_ctx = {test_service_url, test_method,
                                             nullptr, nullptr};
-  GPR_ASSERT(strcmp(creds->type, GRPC_CALL_CREDENTIALS_TYPE_OAUTH2) == 0);
+  GPR_ASSERT(strcmp(creds->type(), GRPC_CALL_CREDENTIALS_TYPE_OAUTH2) == 0);
   run_request_metadata_test(creds, auth_md_ctx, state);
-  grpc_call_credentials_unref(creds);
+  creds->Unref();
 }
 
-static grpc_security_status check_channel_oauth2_create_security_connector(
-    grpc_channel_credentials* c, grpc_call_credentials* call_creds,
-    const char* target, const grpc_channel_args* args,
-    grpc_channel_security_connector** sc, grpc_channel_args** new_args) {
-  GPR_ASSERT(strcmp(c->type, "mock") == 0);
-  GPR_ASSERT(call_creds != nullptr);
-  GPR_ASSERT(strcmp(call_creds->type, GRPC_CALL_CREDENTIALS_TYPE_OAUTH2) == 0);
-  return GRPC_SECURITY_OK;
-}
+namespace {
+class check_channel_oauth2 final : public grpc_channel_credentials {
+ public:
+  check_channel_oauth2() : grpc_channel_credentials("mock") {}
+  ~check_channel_oauth2() override = default;
+
+  grpc_core::RefCountedPtr<grpc_channel_security_connector>
+  create_security_connector(
+      grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+      const char* target, const grpc_channel_args* args,
+      grpc_channel_args** new_args) override {
+    GPR_ASSERT(strcmp(type(), "mock") == 0);
+    GPR_ASSERT(call_creds != nullptr);
+    GPR_ASSERT(strcmp(call_creds->type(), GRPC_CALL_CREDENTIALS_TYPE_OAUTH2) ==
+               0);
+    return nullptr;
+  }
+};
+}  // namespace
 
 static void test_channel_oauth2_composite_creds(void) {
   grpc_core::ExecCtx exec_ctx;
   grpc_channel_args* new_args;
-  grpc_channel_credentials_vtable vtable = {
-      nullptr, check_channel_oauth2_create_security_connector, nullptr};
   grpc_channel_credentials* channel_creds =
-      grpc_mock_channel_credentials_create(&vtable);
+      grpc_core::New<check_channel_oauth2>();
   grpc_call_credentials* oauth2_creds =
       grpc_access_token_credentials_create("blah", nullptr);
   grpc_channel_credentials* channel_oauth2_creds =
@@ -441,9 +436,8 @@ static void test_channel_oauth2_composite_creds(void) {
                                                 nullptr);
   grpc_channel_credentials_release(channel_creds);
   grpc_call_credentials_release(oauth2_creds);
-  GPR_ASSERT(grpc_channel_credentials_create_security_connector(
-                 channel_oauth2_creds, nullptr, nullptr, nullptr, &new_args) ==
-             GRPC_SECURITY_OK);
+  channel_oauth2_creds->create_security_connector(nullptr, nullptr, nullptr,
+                                                  &new_args);
   grpc_channel_credentials_release(channel_oauth2_creds);
 }
 
@@ -467,47 +461,54 @@ static void test_oauth2_google_iam_composite_creds(void) {
   grpc_call_credentials* composite_creds =
       grpc_composite_call_credentials_create(oauth2_creds, google_iam_creds,
                                              nullptr);
-  grpc_call_credentials_unref(oauth2_creds);
-  grpc_call_credentials_unref(google_iam_creds);
-  GPR_ASSERT(
-      strcmp(composite_creds->type, GRPC_CALL_CREDENTIALS_TYPE_COMPOSITE) == 0);
-  const grpc_call_credentials_array* creds_array =
-      grpc_composite_call_credentials_get_credentials(composite_creds);
-  GPR_ASSERT(creds_array->num_creds == 2);
-  GPR_ASSERT(strcmp(creds_array->creds_array[0]->type,
+  oauth2_creds->Unref();
+  google_iam_creds->Unref();
+  GPR_ASSERT(strcmp(composite_creds->type(),
+                    GRPC_CALL_CREDENTIALS_TYPE_COMPOSITE) == 0);
+  const grpc_call_credentials_array& creds_array =
+      static_cast<const grpc_composite_call_credentials*>(composite_creds)
+          ->inner();
+  GPR_ASSERT(creds_array.size() == 2);
+  GPR_ASSERT(strcmp(creds_array.get(0)->type(),
                     GRPC_CALL_CREDENTIALS_TYPE_OAUTH2) == 0);
-  GPR_ASSERT(strcmp(creds_array->creds_array[1]->type,
-                    GRPC_CALL_CREDENTIALS_TYPE_IAM) == 0);
+  GPR_ASSERT(
+      strcmp(creds_array.get(1)->type(), GRPC_CALL_CREDENTIALS_TYPE_IAM) == 0);
   run_request_metadata_test(composite_creds, auth_md_ctx, state);
-  grpc_call_credentials_unref(composite_creds);
+  composite_creds->Unref();
 }
 
-static grpc_security_status
-check_channel_oauth2_google_iam_create_security_connector(
-    grpc_channel_credentials* c, grpc_call_credentials* call_creds,
-    const char* target, const grpc_channel_args* args,
-    grpc_channel_security_connector** sc, grpc_channel_args** new_args) {
-  const grpc_call_credentials_array* creds_array;
-  GPR_ASSERT(strcmp(c->type, "mock") == 0);
-  GPR_ASSERT(call_creds != nullptr);
-  GPR_ASSERT(strcmp(call_creds->type, GRPC_CALL_CREDENTIALS_TYPE_COMPOSITE) ==
-             0);
-  creds_array = grpc_composite_call_credentials_get_credentials(call_creds);
-  GPR_ASSERT(strcmp(creds_array->creds_array[0]->type,
-                    GRPC_CALL_CREDENTIALS_TYPE_OAUTH2) == 0);
-  GPR_ASSERT(strcmp(creds_array->creds_array[1]->type,
-                    GRPC_CALL_CREDENTIALS_TYPE_IAM) == 0);
-  return GRPC_SECURITY_OK;
-}
+namespace {
+class check_channel_oauth2_google_iam final : public grpc_channel_credentials {
+ public:
+  check_channel_oauth2_google_iam() : grpc_channel_credentials("mock") {}
+  ~check_channel_oauth2_google_iam() override = default;
+
+  grpc_core::RefCountedPtr<grpc_channel_security_connector>
+  create_security_connector(
+      grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
+      const char* target, const grpc_channel_args* args,
+      grpc_channel_args** new_args) override {
+    GPR_ASSERT(strcmp(type(), "mock") == 0);
+    GPR_ASSERT(call_creds != nullptr);
+    GPR_ASSERT(
+        strcmp(call_creds->type(), GRPC_CALL_CREDENTIALS_TYPE_COMPOSITE) == 0);
+    const grpc_call_credentials_array& creds_array =
+        static_cast<const grpc_composite_call_credentials*>(call_creds.get())
+            ->inner();
+    GPR_ASSERT(strcmp(creds_array.get(0)->type(),
+                      GRPC_CALL_CREDENTIALS_TYPE_OAUTH2) == 0);
+    GPR_ASSERT(strcmp(creds_array.get(1)->type(),
+                      GRPC_CALL_CREDENTIALS_TYPE_IAM) == 0);
+    return nullptr;
+  }
+};
+}  // namespace
 
 static void test_channel_oauth2_google_iam_composite_creds(void) {
   grpc_core::ExecCtx exec_ctx;
   grpc_channel_args* new_args;
-  grpc_channel_credentials_vtable vtable = {
-      nullptr, check_channel_oauth2_google_iam_create_security_connector,
-      nullptr};
   grpc_channel_credentials* channel_creds =
-      grpc_mock_channel_credentials_create(&vtable);
+      grpc_core::New<check_channel_oauth2_google_iam>();
   grpc_call_credentials* oauth2_creds =
       grpc_access_token_credentials_create("blah", nullptr);
   grpc_channel_credentials* channel_oauth2_creds =
@@ -524,9 +525,8 @@ static void test_channel_oauth2_google_iam_composite_creds(void) {
   grpc_channel_credentials_release(channel_oauth2_creds);
   grpc_call_credentials_release(google_iam_creds);
 
-  GPR_ASSERT(grpc_channel_credentials_create_security_connector(
-                 channel_oauth2_iam_creds, nullptr, nullptr, nullptr,
-                 &new_args) == GRPC_SECURITY_OK);
+  channel_oauth2_iam_creds->create_security_connector(nullptr, nullptr, nullptr,
+                                                      &new_args);
 
   grpc_channel_credentials_release(channel_oauth2_iam_creds);
 }
@@ -578,7 +578,7 @@ static int httpcli_get_should_not_be_called(const grpc_httpcli_request* request,
   return 1;
 }
 
-static void test_compute_engine_creds_success(void) {
+static void test_compute_engine_creds_success() {
   grpc_core::ExecCtx exec_ctx;
   expected_md emd[] = {
       {"authorization", "Bearer ya29.AHES6ZRN3-HlhAPya30GnW_bHSb_"}};
@@ -603,7 +603,7 @@ static void test_compute_engine_creds_success(void) {
   run_request_metadata_test(creds, auth_md_ctx, state);
   grpc_core::ExecCtx::Get()->Flush();
 
-  grpc_call_credentials_unref(creds);
+  creds->Unref();
   grpc_httpcli_set_override(nullptr, nullptr);
 }
 
@@ -620,7 +620,7 @@ static void test_compute_engine_creds_failure(void) {
   grpc_httpcli_set_override(compute_engine_httpcli_get_failure_override,
                             httpcli_post_should_not_be_called);
   run_request_metadata_test(creds, auth_md_ctx, state);
-  grpc_call_credentials_unref(creds);
+  creds->Unref();
   grpc_httpcli_set_override(nullptr, nullptr);
 }
 
@@ -692,7 +692,7 @@ static void test_refresh_token_creds_success(void) {
   run_request_metadata_test(creds, auth_md_ctx, state);
   grpc_core::ExecCtx::Get()->Flush();
 
-  grpc_call_credentials_unref(creds);
+  creds->Unref();
   grpc_httpcli_set_override(nullptr, nullptr);
 }
 
@@ -709,7 +709,7 @@ static void test_refresh_token_creds_failure(void) {
   grpc_httpcli_set_override(httpcli_get_should_not_be_called,
                             refresh_token_httpcli_post_failure);
   run_request_metadata_test(creds, auth_md_ctx, state);
-  grpc_call_credentials_unref(creds);
+  creds->Unref();
   grpc_httpcli_set_override(nullptr, nullptr);
 }
 
@@ -762,7 +762,7 @@ static char* encode_and_sign_jwt_should_not_be_called(
 static grpc_service_account_jwt_access_credentials* creds_as_jwt(
     grpc_call_credentials* creds) {
   GPR_ASSERT(creds != nullptr);
-  GPR_ASSERT(strcmp(creds->type, GRPC_CALL_CREDENTIALS_TYPE_JWT) == 0);
+  GPR_ASSERT(strcmp(creds->type(), GRPC_CALL_CREDENTIALS_TYPE_JWT) == 0);
   return reinterpret_cast<grpc_service_account_jwt_access_credentials*>(creds);
 }
 
@@ -773,7 +773,7 @@ static void test_jwt_creds_lifetime(void) {
   grpc_call_credentials* jwt_creds =
       grpc_service_account_jwt_access_credentials_create(
           json_key_string, grpc_max_auth_token_lifetime(), nullptr);
-  GPR_ASSERT(gpr_time_cmp(creds_as_jwt(jwt_creds)->jwt_lifetime,
+  GPR_ASSERT(gpr_time_cmp(creds_as_jwt(jwt_creds)->jwt_lifetime(),
                           grpc_max_auth_token_lifetime()) == 0);
   grpc_call_credentials_release(jwt_creds);
 
@@ -782,8 +782,8 @@ static void test_jwt_creds_lifetime(void) {
   GPR_ASSERT(gpr_time_cmp(grpc_max_auth_token_lifetime(), token_lifetime) > 0);
   jwt_creds = grpc_service_account_jwt_access_credentials_create(
       json_key_string, token_lifetime, nullptr);
-  GPR_ASSERT(
-      gpr_time_cmp(creds_as_jwt(jwt_creds)->jwt_lifetime, token_lifetime) == 0);
+  GPR_ASSERT(gpr_time_cmp(creds_as_jwt(jwt_creds)->jwt_lifetime(),
+                          token_lifetime) == 0);
   grpc_call_credentials_release(jwt_creds);
 
   // Cropped lifetime.
@@ -791,7 +791,7 @@ static void test_jwt_creds_lifetime(void) {
   token_lifetime = gpr_time_add(grpc_max_auth_token_lifetime(), add_to_max);
   jwt_creds = grpc_service_account_jwt_access_credentials_create(
       json_key_string, token_lifetime, nullptr);
-  GPR_ASSERT(gpr_time_cmp(creds_as_jwt(jwt_creds)->jwt_lifetime,
+  GPR_ASSERT(gpr_time_cmp(creds_as_jwt(jwt_creds)->jwt_lifetime(),
                           grpc_max_auth_token_lifetime()) == 0);
   grpc_call_credentials_release(jwt_creds);
 
@@ -834,7 +834,7 @@ static void test_jwt_creds_success(void) {
   run_request_metadata_test(creds, auth_md_ctx, state);
   grpc_core::ExecCtx::Get()->Flush();
 
-  grpc_call_credentials_unref(creds);
+  creds->Unref();
   gpr_free(json_key_string);
   gpr_free(expected_md_value);
   grpc_jwt_encode_and_sign_set_override(nullptr);
@@ -856,7 +856,7 @@ static void test_jwt_creds_signing_failure(void) {
   run_request_metadata_test(creds, auth_md_ctx, state);
 
   gpr_free(json_key_string);
-  grpc_call_credentials_unref(creds);
+  creds->Unref();
   grpc_jwt_encode_and_sign_set_override(nullptr);
 }
 
@@ -875,8 +875,6 @@ static void set_google_default_creds_env_var_with_file_contents(
 
 static void test_google_default_creds_auth_key(void) {
   grpc_core::ExecCtx exec_ctx;
-  grpc_service_account_jwt_access_credentials* jwt;
-  grpc_google_default_channel_credentials* default_creds;
   grpc_composite_channel_credentials* creds;
   char* json_key = test_json_key_str();
   grpc_flush_cached_google_default_credentials();
@@ -885,40 +883,58 @@ static void test_google_default_creds_auth_key(void) {
   gpr_free(json_key);
   creds = reinterpret_cast<grpc_composite_channel_credentials*>(
       grpc_google_default_credentials_create());
-  default_creds = reinterpret_cast<grpc_google_default_channel_credentials*>(
-      creds->inner_creds);
-  GPR_ASSERT(default_creds->ssl_creds != nullptr);
-  jwt = reinterpret_cast<grpc_service_account_jwt_access_credentials*>(
-      creds->call_creds);
+  auto* default_creds =
+      reinterpret_cast<const grpc_google_default_channel_credentials*>(
+          creds->inner_creds());
+  GPR_ASSERT(default_creds->ssl_creds() != nullptr);
+  auto* jwt =
+      reinterpret_cast<const grpc_service_account_jwt_access_credentials*>(
+          creds->call_creds());
   GPR_ASSERT(
-      strcmp(jwt->key.client_id,
+      strcmp(jwt->key().client_id,
              "777-abaslkan11hlb6nmim3bpspl31ud.apps.googleusercontent.com") ==
       0);
-  grpc_channel_credentials_unref(&creds->base);
+  creds->Unref();
   gpr_setenv(GRPC_GOOGLE_CREDENTIALS_ENV_VAR, ""); /* Reset. */
 }
 
 static void test_google_default_creds_refresh_token(void) {
   grpc_core::ExecCtx exec_ctx;
-  grpc_google_refresh_token_credentials* refresh;
-  grpc_google_default_channel_credentials* default_creds;
   grpc_composite_channel_credentials* creds;
   grpc_flush_cached_google_default_credentials();
   set_google_default_creds_env_var_with_file_contents(
       "refresh_token_google_default_creds", test_refresh_token_str);
   creds = reinterpret_cast<grpc_composite_channel_credentials*>(
       grpc_google_default_credentials_create());
-  default_creds = reinterpret_cast<grpc_google_default_channel_credentials*>(
-      creds->inner_creds);
-  GPR_ASSERT(default_creds->ssl_creds != nullptr);
-  refresh = reinterpret_cast<grpc_google_refresh_token_credentials*>(
-      creds->call_creds);
-  GPR_ASSERT(strcmp(refresh->refresh_token.client_id,
+  auto* default_creds =
+      reinterpret_cast<const grpc_google_default_channel_credentials*>(
+          creds->inner_creds());
+  GPR_ASSERT(default_creds->ssl_creds() != nullptr);
+  auto* refresh =
+      reinterpret_cast<const grpc_google_refresh_token_credentials*>(
+          creds->call_creds());
+  GPR_ASSERT(strcmp(refresh->refresh_token().client_id,
                     "32555999999.apps.googleusercontent.com") == 0);
-  grpc_channel_credentials_unref(&creds->base);
+  creds->Unref();
   gpr_setenv(GRPC_GOOGLE_CREDENTIALS_ENV_VAR, ""); /* Reset. */
 }
 
+static int default_creds_metadata_server_detection_httpcli_get_success_override(
+    const grpc_httpcli_request* request, grpc_millis deadline,
+    grpc_closure* on_done, grpc_httpcli_response* response) {
+  *response = http_response(200, "");
+  grpc_http_header* headers =
+      static_cast<grpc_http_header*>(gpr_malloc(sizeof(*headers) * 1));
+  headers[0].key = gpr_strdup("Metadata-Flavor");
+  headers[0].value = gpr_strdup("Google");
+  response->hdr_count = 1;
+  response->hdrs = headers;
+  GPR_ASSERT(strcmp(request->http.path, "/") == 0);
+  GPR_ASSERT(strcmp(request->host, "metadata.google.internal") == 0);
+  GRPC_CLOSURE_SCHED(on_done, GRPC_ERROR_NONE);
+  return 1;
+}
+
 static char* null_well_known_creds_path_getter(void) { return nullptr; }
 
 static bool test_gce_tenancy_checker(void) {
@@ -949,40 +965,87 @@ static void test_google_default_creds_gce(void) {
 
   /* Verify that the default creds actually embeds a GCE creds. */
   GPR_ASSERT(creds != nullptr);
-  GPR_ASSERT(creds->call_creds != nullptr);
+  GPR_ASSERT(creds->call_creds() != nullptr);
   grpc_httpcli_set_override(compute_engine_httpcli_get_success_override,
                             httpcli_post_should_not_be_called);
-  run_request_metadata_test(creds->call_creds, auth_md_ctx, state);
+  run_request_metadata_test(creds->mutable_call_creds(), auth_md_ctx, state);
   grpc_core::ExecCtx::Get()->Flush();
 
   GPR_ASSERT(g_test_gce_tenancy_checker_called == true);
 
   /* Cleanup. */
-  grpc_channel_credentials_unref(&creds->base);
+  creds->Unref();
   grpc_httpcli_set_override(nullptr, nullptr);
   grpc_override_well_known_credentials_path_getter(nullptr);
 }
 
-static void test_no_google_default_creds(void) {
+static void test_google_default_creds_non_gce(void) {
+  grpc_core::ExecCtx exec_ctx;
+  expected_md emd[] = {
+      {"authorization", "Bearer ya29.AHES6ZRN3-HlhAPya30GnW_bHSb_"}};
+  request_metadata_state* state =
+      make_request_metadata_state(GRPC_ERROR_NONE, emd, GPR_ARRAY_SIZE(emd));
+  grpc_auth_metadata_context auth_md_ctx = {test_service_url, test_method,
+                                            nullptr, nullptr};
   grpc_flush_cached_google_default_credentials();
   gpr_setenv(GRPC_GOOGLE_CREDENTIALS_ENV_VAR, ""); /* Reset. */
   grpc_override_well_known_credentials_path_getter(
       null_well_known_creds_path_getter);
-
   set_gce_tenancy_checker_for_testing(test_gce_tenancy_checker);
   g_test_gce_tenancy_checker_called = false;
   g_test_is_on_gce = false;
+  /* Simulate a successful detection of metadata server. */
+  grpc_httpcli_set_override(
+      default_creds_metadata_server_detection_httpcli_get_success_override,
+      httpcli_post_should_not_be_called);
+  grpc_composite_channel_credentials* creds =
+      reinterpret_cast<grpc_composite_channel_credentials*>(
+          grpc_google_default_credentials_create());
+  /* Verify that the default creds actually embeds a GCE creds. */
+  GPR_ASSERT(creds != nullptr);
+  GPR_ASSERT(creds->call_creds() != nullptr);
+  grpc_httpcli_set_override(compute_engine_httpcli_get_success_override,
+                            httpcli_post_should_not_be_called);
+  run_request_metadata_test(creds->mutable_call_creds(), auth_md_ctx, state);
+  grpc_core::ExecCtx::Get()->Flush();
+  GPR_ASSERT(g_test_gce_tenancy_checker_called == true);
+  /* Cleanup. */
+  creds->Unref();
+  grpc_httpcli_set_override(nullptr, nullptr);
+  grpc_override_well_known_credentials_path_getter(nullptr);
+}
+
+static int default_creds_gce_detection_httpcli_get_failure_override(
+    const grpc_httpcli_request* request, grpc_millis deadline,
+    grpc_closure* on_done, grpc_httpcli_response* response) {
+  /* No magic header. */
+  GPR_ASSERT(strcmp(request->http.path, "/") == 0);
+  GPR_ASSERT(strcmp(request->host, "metadata.google.internal") == 0);
+  *response = http_response(200, "");
+  GRPC_CLOSURE_SCHED(on_done, GRPC_ERROR_NONE);
+  return 1;
+}
 
+static void test_no_google_default_creds(void) {
+  grpc_flush_cached_google_default_credentials();
+  gpr_setenv(GRPC_GOOGLE_CREDENTIALS_ENV_VAR, ""); /* Reset. */
+  grpc_override_well_known_credentials_path_getter(
+      null_well_known_creds_path_getter);
+  set_gce_tenancy_checker_for_testing(test_gce_tenancy_checker);
+  g_test_gce_tenancy_checker_called = false;
+  g_test_is_on_gce = false;
+  grpc_httpcli_set_override(
+      default_creds_gce_detection_httpcli_get_failure_override,
+      httpcli_post_should_not_be_called);
   /* Simulate a successful detection of GCE. */
   GPR_ASSERT(grpc_google_default_credentials_create() == nullptr);
-
-  /* Try a second one. GCE detection should not occur anymore. */
+  /* Try a second one. GCE detection should occur again. */
   g_test_gce_tenancy_checker_called = false;
   GPR_ASSERT(grpc_google_default_credentials_create() == nullptr);
-  GPR_ASSERT(g_test_gce_tenancy_checker_called == false);
-
+  GPR_ASSERT(g_test_gce_tenancy_checker_called == true);
   /* Cleanup. */
   grpc_override_well_known_credentials_path_getter(nullptr);
+  grpc_httpcli_set_override(nullptr, nullptr);
 }
 
 typedef enum {
@@ -1058,7 +1121,7 @@ static void test_metadata_plugin_success(void) {
   GPR_ASSERT(state == PLUGIN_INITIAL_STATE);
   run_request_metadata_test(creds, auth_md_ctx, md_state);
   GPR_ASSERT(state == PLUGIN_GET_METADATA_CALLED_STATE);
-  grpc_call_credentials_unref(creds);
+  creds->Unref();
 
   GPR_ASSERT(state == PLUGIN_DESTROY_CALLED_STATE);
 }
@@ -1086,7 +1149,7 @@ static void test_metadata_plugin_failure(void) {
   GPR_ASSERT(state == PLUGIN_INITIAL_STATE);
   run_request_metadata_test(creds, auth_md_ctx, md_state);
   GPR_ASSERT(state == PLUGIN_GET_METADATA_CALLED_STATE);
-  grpc_call_credentials_unref(creds);
+  creds->Unref();
 
   GPR_ASSERT(state == PLUGIN_DESTROY_CALLED_STATE);
 }
@@ -1113,25 +1176,23 @@ static void test_channel_creds_duplicate_without_call_creds(void) {
   grpc_channel_credentials* channel_creds =
       grpc_fake_transport_security_credentials_create();
 
-  grpc_channel_credentials* dup =
-      grpc_channel_credentials_duplicate_without_call_credentials(
-          channel_creds);
+  grpc_core::RefCountedPtr<grpc_channel_credentials> dup =
+      channel_creds->duplicate_without_call_credentials();
   GPR_ASSERT(dup == channel_creds);
-  grpc_channel_credentials_unref(dup);
+  dup.reset();
 
   grpc_call_credentials* call_creds =
       grpc_access_token_credentials_create("blah", nullptr);
   grpc_channel_credentials* composite_creds =
       grpc_composite_channel_credentials_create(channel_creds, call_creds,
                                                 nullptr);
-  grpc_call_credentials_unref(call_creds);
-  dup = grpc_channel_credentials_duplicate_without_call_credentials(
-      composite_creds);
+  call_creds->Unref();
+  dup = composite_creds->duplicate_without_call_credentials();
   GPR_ASSERT(dup == channel_creds);
-  grpc_channel_credentials_unref(dup);
+  dup.reset();
 
-  grpc_channel_credentials_unref(channel_creds);
-  grpc_channel_credentials_unref(composite_creds);
+  channel_creds->Unref();
+  composite_creds->Unref();
 }
 
 typedef struct {
@@ -1233,6 +1294,7 @@ int main(int argc, char** argv) {
   test_google_default_creds_auth_key();
   test_google_default_creds_refresh_token();
   test_google_default_creds_gce();
+  test_google_default_creds_non_gce();
   test_no_google_default_creds();
   test_metadata_plugin_success();
   test_metadata_plugin_failure();
diff --git a/test/core/security/oauth2_utils.cc b/test/core/security/oauth2_utils.cc
index 469129a6d0..c9e205ab74 100644
--- a/test/core/security/oauth2_utils.cc
+++ b/test/core/security/oauth2_utils.cc
@@ -86,9 +86,8 @@ char* grpc_test_fetch_oauth2_token_with_credentials(
                     grpc_schedule_on_exec_ctx);
 
   grpc_error* error = GRPC_ERROR_NONE;
-  if (grpc_call_credentials_get_request_metadata(creds, &request.pops, null_ctx,
-                                                 &request.md_array,
-                                                 &request.closure, &error)) {
+  if (creds->get_request_metadata(&request.pops, null_ctx, &request.md_array,
+                                  &request.closure, &error)) {
     // Synchronous result; invoke callback directly.
     on_oauth2_response(&request, error);
     GRPC_ERROR_UNREF(error);
diff --git a/test/core/security/print_google_default_creds_token.cc b/test/core/security/print_google_default_creds_token.cc
index 4d251391ff..398c58c6e1 100644
--- a/test/core/security/print_google_default_creds_token.cc
+++ b/test/core/security/print_google_default_creds_token.cc
@@ -96,11 +96,10 @@ int main(int argc, char** argv) {
                     grpc_schedule_on_exec_ctx);
 
   error = GRPC_ERROR_NONE;
-  if (grpc_call_credentials_get_request_metadata(
-          (reinterpret_cast<grpc_composite_channel_credentials*>(creds))
-              ->call_creds,
-          &sync.pops, context, &sync.md_array, &sync.on_request_metadata,
-          &error)) {
+  if (reinterpret_cast<grpc_composite_channel_credentials*>(creds)
+          ->mutable_call_creds()
+          ->get_request_metadata(&sync.pops, context, &sync.md_array,
+                                 &sync.on_request_metadata, &error)) {
     // Synchronous response.  Invoke callback directly.
     on_metadata_response(&sync, error);
     GRPC_ERROR_UNREF(error);
diff --git a/test/core/security/security_connector_test.cc b/test/core/security/security_connector_test.cc
index e82a8627d4..2a31763c73 100644
--- a/test/core/security/security_connector_test.cc
+++ b/test/core/security/security_connector_test.cc
@@ -27,6 +27,7 @@
 #include "src/core/lib/gpr/env.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gpr/tmpfile.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
@@ -83,22 +84,22 @@ static int check_ssl_peer_equivalence(const tsi_peer* original,
 static void test_unauthenticated_ssl_peer(void) {
   tsi_peer peer;
   tsi_peer rpeer;
-  grpc_auth_context* ctx;
   GPR_ASSERT(tsi_construct_peer(1, &peer) == TSI_OK);
   GPR_ASSERT(tsi_construct_string_peer_property_from_cstring(
                  TSI_CERTIFICATE_TYPE_PEER_PROPERTY, TSI_X509_CERTIFICATE_TYPE,
                  &peer.properties[0]) == TSI_OK);
-  ctx = grpc_ssl_peer_to_auth_context(&peer);
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_ssl_peer_to_auth_context(&peer);
   GPR_ASSERT(ctx != nullptr);
-  GPR_ASSERT(!grpc_auth_context_peer_is_authenticated(ctx));
-  GPR_ASSERT(check_transport_security_type(ctx));
+  GPR_ASSERT(!grpc_auth_context_peer_is_authenticated(ctx.get()));
+  GPR_ASSERT(check_transport_security_type(ctx.get()));
 
-  rpeer = grpc_shallow_peer_from_ssl_auth_context(ctx);
+  rpeer = grpc_shallow_peer_from_ssl_auth_context(ctx.get());
   GPR_ASSERT(check_ssl_peer_equivalence(&peer, &rpeer));
 
   grpc_shallow_peer_destruct(&rpeer);
   tsi_peer_destruct(&peer);
-  GRPC_AUTH_CONTEXT_UNREF(ctx, "test");
+  ctx.reset(DEBUG_LOCATION, "test");
 }
 
 static int check_identity(const grpc_auth_context* ctx,
@@ -175,7 +176,6 @@ static int check_x509_pem_cert(const grpc_auth_context* ctx,
 static void test_cn_only_ssl_peer_to_auth_context(void) {
   tsi_peer peer;
   tsi_peer rpeer;
-  grpc_auth_context* ctx;
   const char* expected_cn = "cn1";
   const char* expected_pem_cert = "pem_cert1";
   GPR_ASSERT(tsi_construct_peer(3, &peer) == TSI_OK);
@@ -188,26 +188,27 @@ static void test_cn_only_ssl_peer_to_auth_context(void) {
   GPR_ASSERT(tsi_construct_string_peer_property_from_cstring(
                  TSI_X509_PEM_CERT_PROPERTY, expected_pem_cert,
                  &peer.properties[2]) == TSI_OK);
-  ctx = grpc_ssl_peer_to_auth_context(&peer);
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_ssl_peer_to_auth_context(&peer);
   GPR_ASSERT(ctx != nullptr);
-  GPR_ASSERT(grpc_auth_context_peer_is_authenticated(ctx));
-  GPR_ASSERT(check_identity(ctx, GRPC_X509_CN_PROPERTY_NAME, &expected_cn, 1));
-  GPR_ASSERT(check_transport_security_type(ctx));
-  GPR_ASSERT(check_x509_cn(ctx, expected_cn));
-  GPR_ASSERT(check_x509_pem_cert(ctx, expected_pem_cert));
+  GPR_ASSERT(grpc_auth_context_peer_is_authenticated(ctx.get()));
+  GPR_ASSERT(
+      check_identity(ctx.get(), GRPC_X509_CN_PROPERTY_NAME, &expected_cn, 1));
+  GPR_ASSERT(check_transport_security_type(ctx.get()));
+  GPR_ASSERT(check_x509_cn(ctx.get(), expected_cn));
+  GPR_ASSERT(check_x509_pem_cert(ctx.get(), expected_pem_cert));
 
-  rpeer = grpc_shallow_peer_from_ssl_auth_context(ctx);
+  rpeer = grpc_shallow_peer_from_ssl_auth_context(ctx.get());
   GPR_ASSERT(check_ssl_peer_equivalence(&peer, &rpeer));
 
   grpc_shallow_peer_destruct(&rpeer);
   tsi_peer_destruct(&peer);
-  GRPC_AUTH_CONTEXT_UNREF(ctx, "test");
+  ctx.reset(DEBUG_LOCATION, "test");
 }
 
 static void test_cn_and_one_san_ssl_peer_to_auth_context(void) {
   tsi_peer peer;
   tsi_peer rpeer;
-  grpc_auth_context* ctx;
   const char* expected_cn = "cn1";
   const char* expected_san = "san1";
   const char* expected_pem_cert = "pem_cert1";
@@ -224,27 +225,28 @@ static void test_cn_and_one_san_ssl_peer_to_auth_context(void) {
   GPR_ASSERT(tsi_construct_string_peer_property_from_cstring(
                  TSI_X509_PEM_CERT_PROPERTY, expected_pem_cert,
                  &peer.properties[3]) == TSI_OK);
-  ctx = grpc_ssl_peer_to_auth_context(&peer);
+
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_ssl_peer_to_auth_context(&peer);
   GPR_ASSERT(ctx != nullptr);
-  GPR_ASSERT(grpc_auth_context_peer_is_authenticated(ctx));
+  GPR_ASSERT(grpc_auth_context_peer_is_authenticated(ctx.get()));
   GPR_ASSERT(
-      check_identity(ctx, GRPC_X509_SAN_PROPERTY_NAME, &expected_san, 1));
-  GPR_ASSERT(check_transport_security_type(ctx));
-  GPR_ASSERT(check_x509_cn(ctx, expected_cn));
-  GPR_ASSERT(check_x509_pem_cert(ctx, expected_pem_cert));
+      check_identity(ctx.get(), GRPC_X509_SAN_PROPERTY_NAME, &expected_san, 1));
+  GPR_ASSERT(check_transport_security_type(ctx.get()));
+  GPR_ASSERT(check_x509_cn(ctx.get(), expected_cn));
+  GPR_ASSERT(check_x509_pem_cert(ctx.get(), expected_pem_cert));
 
-  rpeer = grpc_shallow_peer_from_ssl_auth_context(ctx);
+  rpeer = grpc_shallow_peer_from_ssl_auth_context(ctx.get());
   GPR_ASSERT(check_ssl_peer_equivalence(&peer, &rpeer));
 
   grpc_shallow_peer_destruct(&rpeer);
   tsi_peer_destruct(&peer);
-  GRPC_AUTH_CONTEXT_UNREF(ctx, "test");
+  ctx.reset(DEBUG_LOCATION, "test");
 }
 
 static void test_cn_and_multiple_sans_ssl_peer_to_auth_context(void) {
   tsi_peer peer;
   tsi_peer rpeer;
-  grpc_auth_context* ctx;
   const char* expected_cn = "cn1";
   const char* expected_sans[] = {"san1", "san2", "san3"};
   const char* expected_pem_cert = "pem_cert1";
@@ -265,28 +267,28 @@ static void test_cn_and_multiple_sans_ssl_peer_to_auth_context(void) {
                    TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY,
                    expected_sans[i], &peer.properties[3 + i]) == TSI_OK);
   }
-  ctx = grpc_ssl_peer_to_auth_context(&peer);
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_ssl_peer_to_auth_context(&peer);
   GPR_ASSERT(ctx != nullptr);
-  GPR_ASSERT(grpc_auth_context_peer_is_authenticated(ctx));
-  GPR_ASSERT(check_identity(ctx, GRPC_X509_SAN_PROPERTY_NAME, expected_sans,
-                            GPR_ARRAY_SIZE(expected_sans)));
-  GPR_ASSERT(check_transport_security_type(ctx));
-  GPR_ASSERT(check_x509_cn(ctx, expected_cn));
-  GPR_ASSERT(check_x509_pem_cert(ctx, expected_pem_cert));
-
-  rpeer = grpc_shallow_peer_from_ssl_auth_context(ctx);
+  GPR_ASSERT(grpc_auth_context_peer_is_authenticated(ctx.get()));
+  GPR_ASSERT(check_identity(ctx.get(), GRPC_X509_SAN_PROPERTY_NAME,
+                            expected_sans, GPR_ARRAY_SIZE(expected_sans)));
+  GPR_ASSERT(check_transport_security_type(ctx.get()));
+  GPR_ASSERT(check_x509_cn(ctx.get(), expected_cn));
+  GPR_ASSERT(check_x509_pem_cert(ctx.get(), expected_pem_cert));
+
+  rpeer = grpc_shallow_peer_from_ssl_auth_context(ctx.get());
   GPR_ASSERT(check_ssl_peer_equivalence(&peer, &rpeer));
 
   grpc_shallow_peer_destruct(&rpeer);
   tsi_peer_destruct(&peer);
-  GRPC_AUTH_CONTEXT_UNREF(ctx, "test");
+  ctx.reset(DEBUG_LOCATION, "test");
 }
 
 static void test_cn_and_multiple_sans_and_others_ssl_peer_to_auth_context(
     void) {
   tsi_peer peer;
   tsi_peer rpeer;
-  grpc_auth_context* ctx;
   const char* expected_cn = "cn1";
   const char* expected_pem_cert = "pem_cert1";
   const char* expected_sans[] = {"san1", "san2", "san3"};
@@ -311,21 +313,22 @@ static void test_cn_and_multiple_sans_and_others_ssl_peer_to_auth_context(
                    TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY,
                    expected_sans[i], &peer.properties[5 + i]) == TSI_OK);
   }
-  ctx = grpc_ssl_peer_to_auth_context(&peer);
+  grpc_core::RefCountedPtr<grpc_auth_context> ctx =
+      grpc_ssl_peer_to_auth_context(&peer);
   GPR_ASSERT(ctx != nullptr);
-  GPR_ASSERT(grpc_auth_context_peer_is_authenticated(ctx));
-  GPR_ASSERT(check_identity(ctx, GRPC_X509_SAN_PROPERTY_NAME, expected_sans,
-                            GPR_ARRAY_SIZE(expected_sans)));
-  GPR_ASSERT(check_transport_security_type(ctx));
-  GPR_ASSERT(check_x509_cn(ctx, expected_cn));
-  GPR_ASSERT(check_x509_pem_cert(ctx, expected_pem_cert));
-
-  rpeer = grpc_shallow_peer_from_ssl_auth_context(ctx);
+  GPR_ASSERT(grpc_auth_context_peer_is_authenticated(ctx.get()));
+  GPR_ASSERT(check_identity(ctx.get(), GRPC_X509_SAN_PROPERTY_NAME,
+                            expected_sans, GPR_ARRAY_SIZE(expected_sans)));
+  GPR_ASSERT(check_transport_security_type(ctx.get()));
+  GPR_ASSERT(check_x509_cn(ctx.get(), expected_cn));
+  GPR_ASSERT(check_x509_pem_cert(ctx.get(), expected_pem_cert));
+
+  rpeer = grpc_shallow_peer_from_ssl_auth_context(ctx.get());
   GPR_ASSERT(check_ssl_peer_equivalence(&peer, &rpeer));
 
   grpc_shallow_peer_destruct(&rpeer);
   tsi_peer_destruct(&peer);
-  GRPC_AUTH_CONTEXT_UNREF(ctx, "test");
+  ctx.reset(DEBUG_LOCATION, "test");
 }
 
 static const char* roots_for_override_api = "roots for override api";
diff --git a/test/core/security/ssl_server_fuzzer.cc b/test/core/security/ssl_server_fuzzer.cc
index d2bbb7c1c2..c9380126dd 100644
--- a/test/core/security/ssl_server_fuzzer.cc
+++ b/test/core/security/ssl_server_fuzzer.cc
@@ -82,16 +82,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
         ca_cert, &pem_key_cert_pair, 1, 0, nullptr);
 
     // Create security connector
-    grpc_server_security_connector* sc = nullptr;
-    grpc_security_status status =
-        grpc_server_credentials_create_security_connector(creds, &sc);
-    GPR_ASSERT(status == GRPC_SECURITY_OK);
+    grpc_core::RefCountedPtr<grpc_server_security_connector> sc =
+        creds->create_security_connector();
+    GPR_ASSERT(sc != nullptr);
     grpc_millis deadline = GPR_MS_PER_SEC + grpc_core::ExecCtx::Get()->Now();
 
     struct handshake_state state;
     state.done_callback_called = false;
     grpc_handshake_manager* handshake_mgr = grpc_handshake_manager_create();
-    grpc_server_security_connector_add_handshakers(sc, nullptr, handshake_mgr);
+    sc->add_handshakers(nullptr, handshake_mgr);
     grpc_handshake_manager_do_handshake(
         handshake_mgr, mock_endpoint, nullptr /* channel_args */, deadline,
         nullptr /* acceptor */, on_handshake_done, &state);
@@ -110,7 +109,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
     GPR_ASSERT(state.done_callback_called);
 
     grpc_handshake_manager_destroy(handshake_mgr);
-    GRPC_SECURITY_CONNECTOR_UNREF(&sc->base, "test");
+    sc.reset(DEBUG_LOCATION, "test");
     grpc_server_credentials_release(creds);
     grpc_slice_unref(cert_slice);
     grpc_slice_unref(key_slice);
diff --git a/test/core/surface/secure_channel_create_test.cc b/test/core/surface/secure_channel_create_test.cc
index 5610d1ec4a..e9bb815f6e 100644
--- a/test/core/surface/secure_channel_create_test.cc
+++ b/test/core/surface/secure_channel_create_test.cc
@@ -39,7 +39,7 @@ void test_unknown_scheme_target(void) {
   GPR_ASSERT(0 == strcmp(elem->filter->name, "lame-client"));
   grpc_core::ExecCtx exec_ctx;
   GRPC_CHANNEL_INTERNAL_UNREF(chan, "test");
-  grpc_channel_credentials_unref(creds);
+  creds->Unref();
 }
 
 void test_security_connector_already_in_arg(void) {
diff --git a/test/core/util/memory_counters.cc b/test/core/util/memory_counters.cc
index 4960fe0757..d0da05d9b4 100644
--- a/test/core/util/memory_counters.cc
+++ b/test/core/util/memory_counters.cc
@@ -22,6 +22,7 @@
 #include <grpc/support/alloc.h>
 #include <grpc/support/sync.h>
 
+#include "src/core/lib/gpr/alloc.h"
 #include "test/core/util/memory_counters.h"
 
 static struct grpc_memory_counters g_memory_counters;
@@ -42,19 +43,18 @@ static void guard_free(void* vptr);
 #endif
 
 static void* guard_malloc(size_t size) {
-  size_t* ptr;
   if (!size) return nullptr;
   NO_BARRIER_FETCH_ADD(&g_memory_counters.total_size_absolute, (gpr_atm)size);
   NO_BARRIER_FETCH_ADD(&g_memory_counters.total_size_relative, (gpr_atm)size);
   NO_BARRIER_FETCH_ADD(&g_memory_counters.total_allocs_absolute, (gpr_atm)1);
   NO_BARRIER_FETCH_ADD(&g_memory_counters.total_allocs_relative, (gpr_atm)1);
-  ptr = static_cast<size_t*>(g_old_allocs.malloc_fn(size + sizeof(size)));
-  *ptr++ = size;
-  return ptr;
+  void* ptr = g_old_allocs.malloc_fn(
+      GPR_ROUND_UP_TO_ALIGNMENT_SIZE(sizeof(size)) + size);
+  *static_cast<size_t*>(ptr) = size;
+  return static_cast<char*>(ptr) + GPR_ROUND_UP_TO_ALIGNMENT_SIZE(sizeof(size));
 }
 
 static void* guard_realloc(void* vptr, size_t size) {
-  size_t* ptr = static_cast<size_t*>(vptr);
   if (vptr == nullptr) {
     return guard_malloc(size);
   }
@@ -62,21 +62,25 @@ static void* guard_realloc(void* vptr, size_t size) {
     guard_free(vptr);
     return nullptr;
   }
-  --ptr;
+  void* ptr =
+      static_cast<char*>(vptr) - GPR_ROUND_UP_TO_ALIGNMENT_SIZE(sizeof(size));
   NO_BARRIER_FETCH_ADD(&g_memory_counters.total_size_absolute, (gpr_atm)size);
-  NO_BARRIER_FETCH_ADD(&g_memory_counters.total_size_relative, -(gpr_atm)*ptr);
+  NO_BARRIER_FETCH_ADD(&g_memory_counters.total_size_relative,
+                       -*static_cast<gpr_atm*>(ptr));
   NO_BARRIER_FETCH_ADD(&g_memory_counters.total_size_relative, (gpr_atm)size);
   NO_BARRIER_FETCH_ADD(&g_memory_counters.total_allocs_absolute, (gpr_atm)1);
-  ptr = static_cast<size_t*>(g_old_allocs.realloc_fn(ptr, size + sizeof(size)));
-  *ptr++ = size;
-  return ptr;
+  ptr = g_old_allocs.realloc_fn(
+      ptr, GPR_ROUND_UP_TO_ALIGNMENT_SIZE(sizeof(size)) + size);
+  *static_cast<size_t*>(ptr) = size;
+  return static_cast<char*>(ptr) + GPR_ROUND_UP_TO_ALIGNMENT_SIZE(sizeof(size));
 }
 
 static void guard_free(void* vptr) {
-  size_t* ptr = static_cast<size_t*>(vptr);
-  if (!vptr) return;
-  --ptr;
-  NO_BARRIER_FETCH_ADD(&g_memory_counters.total_size_relative, -(gpr_atm)*ptr);
+  if (vptr == nullptr) return;
+  void* ptr =
+      static_cast<char*>(vptr) - GPR_ROUND_UP_TO_ALIGNMENT_SIZE(sizeof(size_t));
+  NO_BARRIER_FETCH_ADD(&g_memory_counters.total_size_relative,
+                       -*static_cast<gpr_atm*>(ptr));
   NO_BARRIER_FETCH_ADD(&g_memory_counters.total_allocs_relative, -(gpr_atm)1);
   g_old_allocs.free_fn(ptr);
 }
diff --git a/test/core/util/ubsan_suppressions.txt b/test/core/util/ubsan_suppressions.txt
index 63898ea3b1..8ed7d4d7fb 100644
--- a/test/core/util/ubsan_suppressions.txt
+++ b/test/core/util/ubsan_suppressions.txt
@@ -25,7 +25,6 @@ alignment:absl::little_endian::Store64
 alignment:absl::little_endian::Load64
 float-divide-by-zero:grpc::testing::postprocess_scenario_result
 enum:grpc_op_string
-nonnull-attribute:grpc_lb_addresses_copy
 signed-integer-overflow:chrono
 enum:grpc_http2_error_to_grpc_status
-enum:grpc_chttp2_cancel_stream
\ No newline at end of file
+enum:grpc_chttp2_cancel_stream