Merge branch 'master' of https://github.com/grpc/grpc into channelz

32 files changed, 368 insertions, 457 deletions

diff --git a/test/core/bad_ssl/bad_ssl_test.cc b/test/core/bad_ssl/bad_ssl_test.cc
index e2ea7540ef..73d251eff4 100644
--- a/test/core/bad_ssl/bad_ssl_test.cc
+++ b/test/core/bad_ssl/bad_ssl_test.cc
@@ -37,7 +37,7 @@ static void* tag(intptr_t t) { return (void*)t; }
 
 static void run_test(const char* target, size_t nops) {
   grpc_channel_credentials* ssl_creds =
-      grpc_ssl_credentials_create(nullptr, nullptr, nullptr);
+      grpc_ssl_credentials_create(nullptr, nullptr, nullptr, nullptr);
   grpc_channel* channel;
   grpc_call* c;
 
diff --git a/test/core/channel/BUILD b/test/core/channel/BUILD
index 81c4353129..da419f00cf 100644
--- a/test/core/channel/BUILD
+++ b/test/core/channel/BUILD
@@ -122,6 +122,7 @@ grpc_cc_test(
     language = "C++",
     deps = [
         "//:grpc",
+        "//test/core/util:gpr_test_util",
     ],
     external_deps = [
         "gtest",
diff --git a/test/core/end2end/fixtures/h2_oauth2.cc b/test/core/end2end/fixtures/h2_oauth2.cc
index d44aafd50a..37397d6450 100644
--- a/test/core/end2end/fixtures/h2_oauth2.cc
+++ b/test/core/end2end/fixtures/h2_oauth2.cc
@@ -146,7 +146,7 @@ static void chttp2_init_client_simple_ssl_with_oauth2_secure_fullstack(
     grpc_end2end_test_fixture* f, grpc_channel_args* client_args) {
   grpc_core::ExecCtx exec_ctx;
   grpc_channel_credentials* ssl_creds =
-      grpc_ssl_credentials_create(test_root_cert, nullptr, nullptr);
+      grpc_ssl_credentials_create(test_root_cert, nullptr, nullptr, nullptr);
   grpc_call_credentials* oauth2_creds = grpc_md_only_test_credentials_create(
       "authorization", oauth2_md, true /* is_async */);
   grpc_channel_credentials* ssl_oauth2_creds =
diff --git a/test/core/end2end/fixtures/h2_ssl.cc b/test/core/end2end/fixtures/h2_ssl.cc
index 999cd4cdfb..4d6c815716 100644
--- a/test/core/end2end/fixtures/h2_ssl.cc
+++ b/test/core/end2end/fixtures/h2_ssl.cc
@@ -101,7 +101,7 @@ void chttp2_tear_down_secure_fullstack(grpc_end2end_test_fixture* f) {
 static void chttp2_init_client_simple_ssl_secure_fullstack(
     grpc_end2end_test_fixture* f, grpc_channel_args* client_args) {
   grpc_channel_credentials* ssl_creds =
-      grpc_ssl_credentials_create(nullptr, nullptr, nullptr);
+      grpc_ssl_credentials_create(nullptr, nullptr, nullptr, nullptr);
   grpc_arg ssl_name_override = {
       GRPC_ARG_STRING,
       const_cast<char*>(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG),
diff --git a/test/core/end2end/fixtures/h2_ssl_proxy.cc b/test/core/end2end/fixtures/h2_ssl_proxy.cc
index 9ab50c6217..09cbf974b6 100644
--- a/test/core/end2end/fixtures/h2_ssl_proxy.cc
+++ b/test/core/end2end/fixtures/h2_ssl_proxy.cc
@@ -55,7 +55,7 @@ static grpc_channel* create_proxy_client(const char* target,
                                          grpc_channel_args* client_args) {
   grpc_channel* channel;
   grpc_channel_credentials* ssl_creds =
-      grpc_ssl_credentials_create(nullptr, nullptr, nullptr);
+      grpc_ssl_credentials_create(nullptr, nullptr, nullptr, nullptr);
   grpc_arg ssl_name_override = {
       GRPC_ARG_STRING,
       const_cast<char*>(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG),
@@ -138,7 +138,7 @@ void chttp2_tear_down_secure_fullstack(grpc_end2end_test_fixture* f) {
 static void chttp2_init_client_simple_ssl_secure_fullstack(
     grpc_end2end_test_fixture* f, grpc_channel_args* client_args) {
   grpc_channel_credentials* ssl_creds =
-      grpc_ssl_credentials_create(nullptr, nullptr, nullptr);
+      grpc_ssl_credentials_create(nullptr, nullptr, nullptr, nullptr);
   grpc_arg ssl_name_override = {
       GRPC_ARG_STRING,
       const_cast<char*>(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG),
diff --git a/test/core/end2end/fuzzers/api_fuzzer.cc b/test/core/end2end/fuzzers/api_fuzzer.cc
index d0d82ea43b..eacfd4a8c3 100644
--- a/test/core/end2end/fuzzers/api_fuzzer.cc
+++ b/test/core/end2end/fuzzers/api_fuzzer.cc
@@ -222,7 +222,7 @@ static grpc_channel_credentials* read_ssl_channel_creds(input_stream* inp) {
   grpc_channel_credentials* creds = grpc_ssl_credentials_create(
       root_certs,
       private_key != nullptr && certs != nullptr ? &key_cert_pair : nullptr,
-      nullptr);
+      nullptr, nullptr);
   cred_artifact_ctx_finish(&ctx);
   return creds;
 }
diff --git a/test/core/end2end/h2_ssl_cert_test.cc b/test/core/end2end/h2_ssl_cert_test.cc
index 9ed6f23798..2c5ee3b156 100644
--- a/test/core/end2end/h2_ssl_cert_test.cc
+++ b/test/core/end2end/h2_ssl_cert_test.cc
@@ -169,8 +169,8 @@ typedef enum { NONE, SELF_SIGNED, SIGNED, BAD_CERT_PAIR } certtype;
       default:                                                               \
         break;                                                               \
     }                                                                        \
-    ssl_creds =                                                              \
-        grpc_ssl_credentials_create(test_root_cert, key_cert_pair, NULL);    \
+    ssl_creds = grpc_ssl_credentials_create(test_root_cert, key_cert_pair,   \
+                                            NULL, NULL);                     \
     grpc_arg ssl_name_override = {                                           \
         GRPC_ARG_STRING,                                                     \
         const_cast<char*>(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG),                \
diff --git a/test/core/end2end/h2_ssl_session_reuse_test.cc b/test/core/end2end/h2_ssl_session_reuse_test.cc
index d5984be93f..b2f398625a 100644
--- a/test/core/end2end/h2_ssl_session_reuse_test.cc
+++ b/test/core/end2end/h2_ssl_session_reuse_test.cc
@@ -66,7 +66,7 @@ grpc_channel* client_create(char* server_addr, grpc_ssl_session_cache* cache) {
   grpc_ssl_pem_key_cert_pair signed_client_key_cert_pair = {
       test_signed_client_key, test_signed_client_cert};
   grpc_channel_credentials* client_creds = grpc_ssl_credentials_create(
-      test_root_cert, &signed_client_key_cert_pair, nullptr);
+      test_root_cert, &signed_client_key_cert_pair, nullptr, nullptr);
 
   grpc_arg args[] = {
       grpc_channel_arg_string_create(
diff --git a/test/core/gprpp/inlined_vector_test.cc b/test/core/gprpp/inlined_vector_test.cc
index ae34947718..41f4338f8a 100644
--- a/test/core/gprpp/inlined_vector_test.cc
+++ b/test/core/gprpp/inlined_vector_test.cc
@@ -27,10 +27,12 @@ namespace testing {
 TEST(InlinedVectorTest, CreateAndIterate) {
   const int kNumElements = 9;
   InlinedVector<int, 2> v;
+  EXPECT_TRUE(v.empty());
   for (int i = 0; i < kNumElements; ++i) {
     v.push_back(i);
   }
   EXPECT_EQ(static_cast<size_t>(kNumElements), v.size());
+  EXPECT_FALSE(v.empty());
   for (int i = 0; i < kNumElements; ++i) {
     EXPECT_EQ(i, v[i]);
     EXPECT_EQ(i, &v[i] - &v[0]);  // Ensure contiguous allocation.
diff --git a/test/core/handshake/BUILD b/test/core/handshake/BUILD
index a3276b9343..712cd59197 100644
--- a/test/core/handshake/BUILD
+++ b/test/core/handshake/BUILD
@@ -82,3 +82,21 @@ grpc_cc_test(
         "//test/core/util:grpc_test_util",
     ],
 )
+
+grpc_cc_test(
+    name = "handshake_verify_peer_options",
+    srcs = ["verify_peer_options.cc"],
+    language = "C++",
+    data = [
+        "//src/core/tsi/test_creds:ca.pem",
+        "//src/core/tsi/test_creds:server1.key",
+        "//src/core/tsi/test_creds:server1.pem",
+    ],
+    deps = [
+        "//:gpr",
+        "//:grpc",
+        "//test/core/util:gpr_test_util",
+        "//test/core/util:grpc_test_util",
+    ],
+)
+
diff --git a/test/core/handshake/client_ssl.cc b/test/core/handshake/client_ssl.cc
index 8ac763ac4b..467df6e229 100644
--- a/test/core/handshake/client_ssl.cc
+++ b/test/core/handshake/client_ssl.cc
@@ -251,8 +251,8 @@ static bool client_ssl_test(char* server_alpn_preferred) {
       reinterpret_cast<const char*> GRPC_SLICE_START_PTR(key_slice);
   pem_key_cert_pair.cert_chain =
       reinterpret_cast<const char*> GRPC_SLICE_START_PTR(cert_slice);
-  grpc_channel_credentials* ssl_creds =
-      grpc_ssl_credentials_create(ca_cert, &pem_key_cert_pair, nullptr);
+  grpc_channel_credentials* ssl_creds = grpc_ssl_credentials_create(
+      ca_cert, &pem_key_cert_pair, nullptr, nullptr);
 
   // Establish a channel pointing at the TLS server. Since the gRPC runtime is
   // lazy, this won't necessarily establish a connection yet.
diff --git a/test/core/handshake/verify_peer_options.cc b/test/core/handshake/verify_peer_options.cc
new file mode 100644
index 0000000000..86c524b4a5
--- /dev/null
+++ b/test/core/handshake/verify_peer_options.cc
@@ -0,0 +1,275 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include "src/core/lib/iomgr/port.h"
+
+// This test won't work except with posix sockets enabled
+#ifdef GRPC_POSIX_SOCKET
+
+#include <arpa/inet.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
+#include "src/core/lib/gprpp/thd.h"
+#include "src/core/lib/iomgr/load_file.h"
+#include "test/core/util/port.h"
+#include "test/core/util/test_config.h"
+
+#define SSL_CERT_PATH "src/core/tsi/test_creds/server1.pem"
+#define SSL_KEY_PATH "src/core/tsi/test_creds/server1.key"
+#define SSL_CA_PATH "src/core/tsi/test_creds/ca.pem"
+
+// Simple gRPC server. This listens until client_handshake_complete occurs.
+static gpr_event client_handshake_complete;
+
+static void server_thread(void* arg) {
+  const int port = *static_cast<int*>(arg);
+
+  // Load key pair and establish server SSL credentials.
+  grpc_ssl_pem_key_cert_pair pem_key_cert_pair;
+  grpc_slice ca_slice, cert_slice, key_slice;
+  GPR_ASSERT(GRPC_LOG_IF_ERROR("load_file",
+                               grpc_load_file(SSL_CA_PATH, 1, &ca_slice)));
+  GPR_ASSERT(GRPC_LOG_IF_ERROR("load_file",
+                               grpc_load_file(SSL_CERT_PATH, 1, &cert_slice)));
+  GPR_ASSERT(GRPC_LOG_IF_ERROR("load_file",
+                               grpc_load_file(SSL_KEY_PATH, 1, &key_slice)));
+  const char* ca_cert =
+      reinterpret_cast<const char*> GRPC_SLICE_START_PTR(ca_slice);
+  pem_key_cert_pair.private_key =
+      reinterpret_cast<const char*> GRPC_SLICE_START_PTR(key_slice);
+  pem_key_cert_pair.cert_chain =
+      reinterpret_cast<const char*> GRPC_SLICE_START_PTR(cert_slice);
+  grpc_server_credentials* ssl_creds = grpc_ssl_server_credentials_create(
+      ca_cert, &pem_key_cert_pair, 1, 0, nullptr);
+
+  // Start server listening on local port.
+  char* addr;
+  gpr_asprintf(&addr, "127.0.0.1:%d", port);
+  grpc_server* server = grpc_server_create(nullptr, nullptr);
+  GPR_ASSERT(grpc_server_add_secure_http2_port(server, addr, ssl_creds));
+  free(addr);
+
+  grpc_completion_queue* cq = grpc_completion_queue_create_for_next(nullptr);
+
+  grpc_server_register_completion_queue(server, cq, nullptr);
+  grpc_server_start(server);
+
+  // Wait a bounded number of time until client_handshake_complete is set,
+  // sleeping between polls. The total time spent (deadline * retries)
+  // should be strictly greater than the client retry limit so that the
+  // client will always timeout first.
+  int retries = 60;
+  while (!gpr_event_get(&client_handshake_complete) && retries-- > 0) {
+    const gpr_timespec cq_deadline = grpc_timeout_seconds_to_deadline(1);
+    grpc_event ev = grpc_completion_queue_next(cq, cq_deadline, nullptr);
+    GPR_ASSERT(ev.type == GRPC_QUEUE_TIMEOUT);
+  }
+
+  gpr_log(GPR_INFO, "Shutting down server");
+  grpc_server_shutdown_and_notify(server, cq, nullptr);
+  grpc_server_cancel_all_calls(server);
+  grpc_completion_queue_shutdown(cq);
+
+  const gpr_timespec cq_deadline = grpc_timeout_seconds_to_deadline(60);
+  grpc_event ev = grpc_completion_queue_next(cq, cq_deadline, nullptr);
+  GPR_ASSERT(ev.type == GRPC_OP_COMPLETE);
+
+  grpc_server_destroy(server);
+  grpc_completion_queue_destroy(cq);
+  grpc_server_credentials_release(ssl_creds);
+  grpc_slice_unref(cert_slice);
+  grpc_slice_unref(key_slice);
+  grpc_slice_unref(ca_slice);
+}
+
+// This test launches a minimal TLS grpc server on a separate thread and then
+// establishes a TLS handshake via the core library to the server. The client
+// uses the supplied verify options.
+static bool verify_peer_options_test(verify_peer_options* verify_options) {
+  bool success = true;
+
+  grpc_init();
+  int port = grpc_pick_unused_port_or_die();
+  gpr_event_init(&client_handshake_complete);
+
+  // Launch the gRPC server thread.
+  bool ok;
+  grpc_core::Thread thd("grpc_client_ssl_test", server_thread, &port, &ok);
+  GPR_ASSERT(ok);
+  thd.Start();
+
+  // Load key pair and establish client SSL credentials.
+  grpc_ssl_pem_key_cert_pair pem_key_cert_pair;
+  grpc_slice ca_slice, cert_slice, key_slice;
+  GPR_ASSERT(GRPC_LOG_IF_ERROR("load_file",
+                               grpc_load_file(SSL_CA_PATH, 1, &ca_slice)));
+  GPR_ASSERT(GRPC_LOG_IF_ERROR("load_file",
+                               grpc_load_file(SSL_CERT_PATH, 1, &cert_slice)));
+  GPR_ASSERT(GRPC_LOG_IF_ERROR("load_file",
+                               grpc_load_file(SSL_KEY_PATH, 1, &key_slice)));
+  const char* ca_cert =
+      reinterpret_cast<const char*> GRPC_SLICE_START_PTR(ca_slice);
+  pem_key_cert_pair.private_key =
+      reinterpret_cast<const char*> GRPC_SLICE_START_PTR(key_slice);
+  pem_key_cert_pair.cert_chain =
+      reinterpret_cast<const char*> GRPC_SLICE_START_PTR(cert_slice);
+  grpc_channel_credentials* ssl_creds = grpc_ssl_credentials_create(
+      ca_cert, &pem_key_cert_pair, verify_options, nullptr);
+
+  // Establish a channel pointing at the TLS server. Since the gRPC runtime is
+  // lazy, this won't necessarily establish a connection yet.
+  char* target;
+  gpr_asprintf(&target, "127.0.0.1:%d", port);
+  grpc_arg ssl_name_override = {
+      GRPC_ARG_STRING,
+      const_cast<char*>(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG),
+      {const_cast<char*>("foo.test.google.fr")}};
+  grpc_channel_args grpc_args;
+  grpc_args.num_args = 1;
+  grpc_args.args = &ssl_name_override;
+  grpc_channel* channel =
+      grpc_secure_channel_create(ssl_creds, target, &grpc_args, nullptr);
+  GPR_ASSERT(channel);
+  gpr_free(target);
+
+  // Initially the channel will be idle, the
+  // grpc_channel_check_connectivity_state triggers an attempt to connect.
+  GPR_ASSERT(grpc_channel_check_connectivity_state(
+                 channel, 1 /* try_to_connect */) == GRPC_CHANNEL_IDLE);
+
+  // Wait a bounded number of times for the channel to be ready. When the
+  // channel is ready, the initial TLS handshake will have successfully
+  // completed. The total time spent on the client side (retries * deadline)
+  // should be greater than the server side time limit.
+  int retries = 10;
+  grpc_connectivity_state state = GRPC_CHANNEL_IDLE;
+  grpc_completion_queue* cq = grpc_completion_queue_create_for_next(nullptr);
+
+  while (state != GRPC_CHANNEL_READY && retries-- > 0) {
+    grpc_channel_watch_connectivity_state(
+        channel, state, grpc_timeout_seconds_to_deadline(3), cq, nullptr);
+    gpr_timespec cq_deadline = grpc_timeout_seconds_to_deadline(5);
+    grpc_event ev = grpc_completion_queue_next(cq, cq_deadline, nullptr);
+    GPR_ASSERT(ev.type == GRPC_OP_COMPLETE);
+    state =
+        grpc_channel_check_connectivity_state(channel, 0 /* try_to_connect */);
+  }
+  grpc_completion_queue_destroy(cq);
+  if (retries < 0) {
+    success = false;
+  }
+
+  grpc_channel_destroy(channel);
+  grpc_channel_credentials_release(ssl_creds);
+  grpc_slice_unref(cert_slice);
+  grpc_slice_unref(key_slice);
+  grpc_slice_unref(ca_slice);
+
+  // Now that the client is completely cleaned up, trigger the server to
+  // shutdown
+  gpr_event_set(&client_handshake_complete, &client_handshake_complete);
+  // Wait for the server to completely shutdown
+  thd.Join();
+
+  grpc_shutdown();
+
+  return success;
+}
+
+static int callback_return_value = 0;
+static char callback_target_host[4096];
+static char callback_target_pem[4096];
+static void* callback_userdata = nullptr;
+static void* destruct_userdata = nullptr;
+
+static int verify_callback(const char* target_host, const char* target_pem,
+                           void* userdata) {
+  if (target_host != nullptr) {
+    snprintf(callback_target_host, sizeof(callback_target_host), "%s",
+             target_host);
+  } else {
+    callback_target_host[0] = '\0';
+  }
+  if (target_pem != nullptr) {
+    snprintf(callback_target_pem, sizeof(callback_target_pem), "%s",
+             target_pem);
+  } else {
+    callback_target_pem[0] = '\0';
+  }
+  callback_userdata = userdata;
+  return callback_return_value;
+}
+
+static void verify_destruct(void* userdata) { destruct_userdata = userdata; }
+
+int main(int argc, char* argv[]) {
+  int userdata = 42;
+  verify_peer_options verify_options;
+
+  // Load the server's cert so that we can assert it gets passed to the callback
+  grpc_slice cert_slice;
+  GPR_ASSERT(GRPC_LOG_IF_ERROR("load_file",
+                               grpc_load_file(SSL_CERT_PATH, 1, &cert_slice)));
+  const char* server_cert =
+      reinterpret_cast<const char*> GRPC_SLICE_START_PTR(cert_slice);
+
+  // Running with all-null values should have no effect
+  verify_options.verify_peer_callback = nullptr;
+  verify_options.verify_peer_callback_userdata = nullptr;
+  verify_options.verify_peer_destruct = nullptr;
+  GPR_ASSERT(verify_peer_options_test(&verify_options));
+  GPR_ASSERT(strlen(callback_target_host) == 0);
+  GPR_ASSERT(strlen(callback_target_pem) == 0);
+  GPR_ASSERT(callback_userdata == nullptr);
+  GPR_ASSERT(destruct_userdata == nullptr);
+
+  // Running with the callbacks and verify we get the expected values
+  verify_options.verify_peer_callback = verify_callback;
+  verify_options.verify_peer_callback_userdata = static_cast<void*>(&userdata);
+  verify_options.verify_peer_destruct = verify_destruct;
+  GPR_ASSERT(verify_peer_options_test(&verify_options));
+  GPR_ASSERT(strcmp(callback_target_host, "foo.test.google.fr") == 0);
+  GPR_ASSERT(strcmp(callback_target_pem, server_cert) == 0);
+  GPR_ASSERT(callback_userdata == static_cast<void*>(&userdata));
+  GPR_ASSERT(destruct_userdata == static_cast<void*>(&userdata));
+
+  // If the callback returns non-zero, initializing the channel should fail.
+  callback_return_value = 1;
+  GPR_ASSERT(!verify_peer_options_test(&verify_options));
+
+  grpc_slice_unref(cert_slice);
+
+  return 0;
+}
+
+#else /* GRPC_POSIX_SOCKET */
+
+int main(int argc, char** argv) { return 1; }
+
+#endif /* GRPC_POSIX_SOCKET */
diff --git a/test/core/security/BUILD b/test/core/security/BUILD
index 70bcc8c9c3..12aa84d93b 100644
--- a/test/core/security/BUILD
+++ b/test/core/security/BUILD
@@ -183,6 +183,7 @@ grpc_cc_test(
         "//:gpr",
         "//:gpr_base",
         "//:grpc",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -195,6 +196,7 @@ grpc_cc_test(
         "//:gpr",
         "//:gpr_base",
         "//:grpc",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -206,6 +208,7 @@ grpc_cc_test(
         "//:alts_util",
         "//:gpr",
         "//:grpc",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -220,5 +223,6 @@ grpc_cc_test(
         "//:grpc_secure",
         "//:tsi", 
         "//:tsi_interface",
+        "//test/core/util:gpr_test_util",
     ],
 )
diff --git a/test/core/statistics/census_log_tests.h b/test/core/statistics/census_log_tests.h
deleted file mode 100644
index ed808636e3..0000000000
--- a/test/core/statistics/census_log_tests.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- *
- * Copyright 2015 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#ifndef GRPC_TEST_CORE_STATISTICS_CENSUS_LOG_TESTS_H
-#define GRPC_TEST_CORE_STATISTICS_CENSUS_LOG_TESTS_H
-
-void test_invalid_record_size();
-void test_end_write_with_different_size();
-void test_read_pending_record();
-void test_read_beyond_pending_record();
-void test_detached_while_reading();
-void test_fill_log_no_fragmentation();
-void test_fill_circular_log_no_fragmentation();
-void test_fill_log_with_straddling_records();
-void test_fill_circular_log_with_straddling_records();
-void test_multiple_writers_circular_log();
-void test_multiple_writers();
-void test_performance();
-void test_small_log();
-
-#endif /* GRPC_TEST_CORE_STATISTICS_CENSUS_LOG_TESTS_H */
diff --git a/test/core/statistics/census_stub_test.cc b/test/core/statistics/census_stub_test.cc
deleted file mode 100644
index 507ae0a9fa..0000000000
--- a/test/core/statistics/census_stub_test.cc
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- *
- * Copyright 2015 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-
-#include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
-#include "src/core/ext/census/census_interface.h"
-#include "src/core/ext/census/census_rpc_stats.h"
-#include "test/core/util/test_config.h"
-
-/* Tests census noop stubs in a simulated rpc flow */
-void test_census_stubs(void) {
-  census_op_id op_id;
-  census_rpc_stats* stats = census_rpc_stats_create_empty();
-  census_aggregated_rpc_stats data_map = {0, NULL};
-
-  /* Initializes census library at server start up time. */
-  census_init();
-  /* Starts tracing at the beginning of a rpc. */
-  op_id = census_tracing_start_op();
-  /* Appends custom annotations on a trace object. */
-  census_tracing_print(op_id, "annotation foo");
-  census_tracing_print(op_id, "annotation bar");
-  /* Appends method tag on the trace object. */
-  census_add_method_tag(op_id, "service_foo/method.bar");
-  /* Either record client side stats or server side stats associated with the
-     op_id. Here for testing purpose, we record both. */
-  census_record_rpc_client_stats(op_id, stats);
-  census_record_rpc_server_stats(op_id, stats);
-  /* Ends a tracing. */
-  census_tracing_end_op(op_id);
-  /* In process stats queries. */
-  census_get_server_stats(&data_map);
-  census_aggregated_rpc_stats_set_empty(&data_map);
-  census_get_client_stats(&data_map);
-  census_aggregated_rpc_stats_set_empty(&data_map);
-  gpr_free(stats);
-  census_shutdown();
-}
-
-int main(int argc, char** argv) {
-  grpc_test_init(argc, argv);
-  test_census_stubs();
-  return 0;
-}
diff --git a/test/core/statistics/multiple_writers_circular_buffer_test.cc b/test/core/statistics/multiple_writers_circular_buffer_test.cc
deleted file mode 100644
index 6d3411289e..0000000000
--- a/test/core/statistics/multiple_writers_circular_buffer_test.cc
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- *
- * Copyright 2015 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#include "test/core/statistics/census_log_tests.h"
-
-#include <stdlib.h>
-
-#include <grpc/support/time.h>
-#include "test/core/util/test_config.h"
-
-int main(int argc, char** argv) {
-  grpc_test_init(argc, argv);
-  srand(gpr_now(GPR_CLOCK_REALTIME).tv_nsec);
-  test_multiple_writers_circular_log();
-  return 0;
-}
diff --git a/test/core/statistics/multiple_writers_test.cc b/test/core/statistics/multiple_writers_test.cc
deleted file mode 100644
index 47410ab105..0000000000
--- a/test/core/statistics/multiple_writers_test.cc
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- *
- * Copyright 2015 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#include "test/core/statistics/census_log_tests.h"
-
-#include <stdlib.h>
-
-#include <grpc/support/time.h>
-#include "test/core/util/test_config.h"
-
-int main(int argc, char** argv) {
-  grpc_test_init(argc, argv);
-  srand(gpr_now(GPR_CLOCK_REALTIME).tv_nsec);
-  test_multiple_writers();
-  return 0;
-}
diff --git a/test/core/statistics/performance_test.cc b/test/core/statistics/performance_test.cc
deleted file mode 100644
index 9d4fd6ef90..0000000000
--- a/test/core/statistics/performance_test.cc
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- *
- * Copyright 2015 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#include "test/core/statistics/census_log_tests.h"
-
-#include <stdlib.h>
-
-#include <grpc/support/time.h>
-#include "test/core/util/test_config.h"
-
-int main(int argc, char** argv) {
-  grpc_test_init(argc, argv);
-  srand(gpr_now(GPR_CLOCK_REALTIME).tv_nsec);
-  test_performance();
-  return 0;
-}
diff --git a/test/core/statistics/quick_test.cc b/test/core/statistics/quick_test.cc
deleted file mode 100644
index 91ecdde818..0000000000
--- a/test/core/statistics/quick_test.cc
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- *
- * Copyright 2015 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#include "test/core/statistics/census_log_tests.h"
-
-#include <stdlib.h>
-
-#include <grpc/support/time.h>
-#include "test/core/util/test_config.h"
-
-int main(int argc, char** argv) {
-  grpc_test_init(argc, argv);
-  srand(gpr_now(GPR_CLOCK_REALTIME).tv_nsec);
-  test_invalid_record_size();
-  test_end_write_with_different_size();
-  test_read_pending_record();
-  test_read_beyond_pending_record();
-  test_detached_while_reading();
-  test_fill_log_no_fragmentation();
-  test_fill_circular_log_no_fragmentation();
-  test_fill_log_with_straddling_records();
-  test_fill_circular_log_with_straddling_records();
-  return 0;
-}
diff --git a/test/core/statistics/rpc_stats_test.cc b/test/core/statistics/rpc_stats_test.cc
deleted file mode 100644
index a2a648e2ad..0000000000
--- a/test/core/statistics/rpc_stats_test.cc
+++ /dev/null
@@ -1,183 +0,0 @@
-/*
- *
- * Copyright 2015 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#include <string.h>
-
-#include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
-#include <grpc/support/port_platform.h>
-#include <grpc/support/string.h>
-#include <grpc/support/time.h>
-
-#include "src/core/ext/census/census_interface.h"
-#include "src/core/ext/census/census_rpc_stats.h"
-#include "src/core/ext/census/census_tracing.h"
-#include "test/core/util/test_config.h"
-
-/* Ensure all possible state transitions are called without causing problem */
-static void test_init_shutdown(void) {
-  census_stats_store_init();
-  census_stats_store_init();
-  census_stats_store_shutdown();
-  census_stats_store_shutdown();
-  census_stats_store_init();
-}
-
-static void test_create_and_destroy(void) {
-  census_rpc_stats* stats = NULL;
-  census_aggregated_rpc_stats agg_stats = {0, NULL};
-
-  stats = census_rpc_stats_create_empty();
-  GPR_ASSERT(stats != NULL);
-  GPR_ASSERT(stats->cnt == 0 && stats->rpc_error_cnt == 0 &&
-             stats->app_error_cnt == 0 && stats->elapsed_time_ms == 0.0 &&
-             stats->api_request_bytes == 0 && stats->wire_request_bytes == 0 &&
-             stats->api_response_bytes == 0 && stats->wire_response_bytes == 0);
-  gpr_free(stats);
-
-  census_aggregated_rpc_stats_set_empty(&agg_stats);
-  GPR_ASSERT(agg_stats.num_entries == 0);
-  GPR_ASSERT(agg_stats.stats == NULL);
-  agg_stats.num_entries = 1;
-  agg_stats.stats = (census_per_method_rpc_stats*)gpr_malloc(
-      sizeof(census_per_method_rpc_stats));
-  agg_stats.stats[0].method = gpr_strdup("foo");
-  census_aggregated_rpc_stats_set_empty(&agg_stats);
-  GPR_ASSERT(agg_stats.num_entries == 0);
-  GPR_ASSERT(agg_stats.stats == NULL);
-}
-
-#define ASSERT_NEAR(a, b) \
-  GPR_ASSERT((a - b) * (a - b) < 1e-24 * (a + b) * (a + b))
-
-static void test_record_and_get_stats(void) {
-  census_rpc_stats stats = {1, 2, 3, 4, 5.1, 6.2, 7.3, 8.4};
-  census_op_id id;
-  census_aggregated_rpc_stats agg_stats = {0, NULL};
-
-  /* Record client stats twice with the same op_id. */
-  census_init();
-  id = census_tracing_start_op();
-  census_add_method_tag(id, "m1");
-  census_record_rpc_client_stats(id, &stats);
-  census_record_rpc_client_stats(id, &stats);
-  census_tracing_end_op(id);
-  /* Server stats expect to be empty */
-  census_get_server_stats(&agg_stats);
-  GPR_ASSERT(agg_stats.num_entries == 0);
-  GPR_ASSERT(agg_stats.stats == NULL);
-  /* Client stats expect to have one entry */
-  census_get_client_stats(&agg_stats);
-  GPR_ASSERT(agg_stats.num_entries == 1);
-  GPR_ASSERT(agg_stats.stats != NULL);
-  GPR_ASSERT(strcmp(agg_stats.stats[0].method, "m1") == 0);
-  GPR_ASSERT(agg_stats.stats[0].minute_stats.cnt == 2 &&
-             agg_stats.stats[0].hour_stats.cnt == 2 &&
-             agg_stats.stats[0].total_stats.cnt == 2);
-  ASSERT_NEAR(agg_stats.stats[0].minute_stats.wire_response_bytes, 16.8);
-  ASSERT_NEAR(agg_stats.stats[0].hour_stats.wire_response_bytes, 16.8);
-  ASSERT_NEAR(agg_stats.stats[0].total_stats.wire_response_bytes, 16.8);
-  /* Get stats again, results should be the same. */
-  census_get_client_stats(&agg_stats);
-  GPR_ASSERT(agg_stats.num_entries == 1);
-  census_aggregated_rpc_stats_set_empty(&agg_stats);
-  census_shutdown();
-
-  /* Record both server (once) and client (twice) stats with different op_ids.
-   */
-  census_init();
-  id = census_tracing_start_op();
-  census_add_method_tag(id, "m2");
-  census_record_rpc_client_stats(id, &stats);
-  census_tracing_end_op(id);
-  id = census_tracing_start_op();
-  census_add_method_tag(id, "m3");
-  census_record_rpc_server_stats(id, &stats);
-  census_tracing_end_op(id);
-  id = census_tracing_start_op();
-  census_add_method_tag(id, "m4");
-  census_record_rpc_client_stats(id, &stats);
-  census_tracing_end_op(id);
-  /* Check server stats */
-  census_get_server_stats(&agg_stats);
-  GPR_ASSERT(agg_stats.num_entries == 1);
-  GPR_ASSERT(strcmp(agg_stats.stats[0].method, "m3") == 0);
-  GPR_ASSERT(agg_stats.stats[0].minute_stats.app_error_cnt == 3 &&
-             agg_stats.stats[0].hour_stats.app_error_cnt == 3 &&
-             agg_stats.stats[0].total_stats.app_error_cnt == 3);
-  census_aggregated_rpc_stats_set_empty(&agg_stats);
-  /* Check client stats */
-  census_get_client_stats(&agg_stats);
-  GPR_ASSERT(agg_stats.num_entries == 2);
-  GPR_ASSERT(agg_stats.stats != NULL);
-  GPR_ASSERT((strcmp(agg_stats.stats[0].method, "m2") == 0 &&
-              strcmp(agg_stats.stats[1].method, "m4") == 0) ||
-             (strcmp(agg_stats.stats[0].method, "m4") == 0 &&
-              strcmp(agg_stats.stats[1].method, "m2") == 0));
-  GPR_ASSERT(agg_stats.stats[0].minute_stats.cnt == 1 &&
-             agg_stats.stats[1].minute_stats.cnt == 1);
-  census_aggregated_rpc_stats_set_empty(&agg_stats);
-  census_shutdown();
-}
-
-static void test_record_stats_on_unknown_op_id(void) {
-  census_op_id unknown_id = {0xDEAD, 0xBEEF};
-  census_rpc_stats stats = {1, 2, 3, 4, 5.1, 6.2, 7.3, 8.4};
-  census_aggregated_rpc_stats agg_stats = {0, NULL};
-
-  census_init();
-  /* Tests that recording stats against unknown id is noop. */
-  census_record_rpc_client_stats(unknown_id, &stats);
-  census_record_rpc_server_stats(unknown_id, &stats);
-  census_get_server_stats(&agg_stats);
-  GPR_ASSERT(agg_stats.num_entries == 0);
-  GPR_ASSERT(agg_stats.stats == NULL);
-  census_get_client_stats(&agg_stats);
-  GPR_ASSERT(agg_stats.num_entries == 0);
-  GPR_ASSERT(agg_stats.stats == NULL);
-  census_aggregated_rpc_stats_set_empty(&agg_stats);
-  census_shutdown();
-}
-
-/* Test that record stats is noop when trace store is uninitialized. */
-static void test_record_stats_with_trace_store_uninitialized(void) {
-  census_rpc_stats stats = {1, 2, 3, 4, 5.1, 6.2, 7.3, 8.4};
-  census_op_id id = {0, 0};
-  census_aggregated_rpc_stats agg_stats = {0, NULL};
-
-  census_init();
-  id = census_tracing_start_op();
-  census_add_method_tag(id, "m");
-  census_tracing_end_op(id);
-  /* shuts down trace store only. */
-  census_tracing_shutdown();
-  census_record_rpc_client_stats(id, &stats);
-  census_get_client_stats(&agg_stats);
-  GPR_ASSERT(agg_stats.num_entries == 0);
-  census_stats_store_shutdown();
-}
-
-int main(int argc, char** argv) {
-  grpc_test_init(argc, argv);
-  test_init_shutdown();
-  test_create_and_destroy();
-  test_record_and_get_stats();
-  test_record_stats_on_unknown_op_id();
-  test_record_stats_with_trace_store_uninitialized();
-  return 0;
-}
diff --git a/test/core/statistics/small_log_test.cc b/test/core/statistics/small_log_test.cc
deleted file mode 100644
index fb8dfc9988..0000000000
--- a/test/core/statistics/small_log_test.cc
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- *
- * Copyright 2015 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#include "test/core/statistics/census_log_tests.h"
-
-#include <stdlib.h>
-
-#include <grpc/support/time.h>
-#include "test/core/util/test_config.h"
-
-int main(int argc, char** argv) {
-  grpc_test_init(argc, argv);
-  srand(gpr_now(GPR_CLOCK_REALTIME).tv_nsec);
-  test_small_log();
-  return 0;
-}
diff --git a/test/core/surface/num_external_connectivity_watchers_test.cc b/test/core/surface/num_external_connectivity_watchers_test.cc
index 467deeeaec..7b7a0b6dfc 100644
--- a/test/core/surface/num_external_connectivity_watchers_test.cc
+++ b/test/core/surface/num_external_connectivity_watchers_test.cc
@@ -168,7 +168,7 @@ static const test_fixture insecure_test = {
 
 static grpc_channel* secure_test_create_channel(const char* addr) {
   grpc_channel_credentials* ssl_creds =
-      grpc_ssl_credentials_create(test_root_cert, nullptr, nullptr);
+      grpc_ssl_credentials_create(test_root_cert, nullptr, nullptr, nullptr);
   grpc_arg ssl_name_override = {
       GRPC_ARG_STRING,
       const_cast<char*>(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG),
diff --git a/test/core/surface/sequential_connectivity_test.cc b/test/core/surface/sequential_connectivity_test.cc
index 9aba4c499e..10562b3be9 100644
--- a/test/core/surface/sequential_connectivity_test.cc
+++ b/test/core/surface/sequential_connectivity_test.cc
@@ -144,7 +144,7 @@ static void secure_test_add_port(grpc_server* server, const char* addr) {
 
 static grpc_channel* secure_test_create_channel(const char* addr) {
   grpc_channel_credentials* ssl_creds =
-      grpc_ssl_credentials_create(test_root_cert, nullptr, nullptr);
+      grpc_ssl_credentials_create(test_root_cert, nullptr, nullptr, nullptr);
   grpc_arg ssl_name_override = {
       GRPC_ARG_STRING,
       const_cast<char*>(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG),
diff --git a/test/core/transport/BUILD b/test/core/transport/BUILD
index 84fb3a1421..7ca1c1d943 100644
--- a/test/core/transport/BUILD
+++ b/test/core/transport/BUILD
@@ -129,6 +129,7 @@ grpc_cc_test(
     language = "C++",
     deps = [
         "//:grpc",
+        "//test/core/util:gpr_test_util",
     ],
     external_deps = [
         "gtest",
diff --git a/test/core/tsi/alts/crypt/BUILD b/test/core/tsi/alts/crypt/BUILD
index cf9dbca316..abe1e83656 100644
--- a/test/core/tsi/alts/crypt/BUILD
+++ b/test/core/tsi/alts/crypt/BUILD
@@ -27,6 +27,7 @@ grpc_cc_test(
         "//:alts_frame_protector",
         "//:gpr",
         "//:grpc",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
diff --git a/test/core/tsi/alts/frame_protector/BUILD b/test/core/tsi/alts/frame_protector/BUILD
index dd1966b379..6ff3015f4d 100644
--- a/test/core/tsi/alts/frame_protector/BUILD
+++ b/test/core/tsi/alts/frame_protector/BUILD
@@ -27,6 +27,7 @@ grpc_cc_test(
         "//:gpr",
         "//:grpc",
         "//test/core/tsi/alts/crypt:alts_crypt_test_util",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -39,6 +40,7 @@ grpc_cc_test(
         "//:gpr",
         "//:grpc",
         "//test/core/tsi/alts/crypt:alts_crypt_test_util",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -54,6 +56,7 @@ grpc_cc_test(
         "//:tsi_interface",
         "//test/core/tsi/alts/crypt:alts_crypt_test_util",
         "//test/core/tsi:transport_security_test_lib",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -67,5 +70,6 @@ grpc_cc_test(
         "//:gpr_base",
         "//:grpc",
         "//test/core/tsi/alts/crypt:alts_crypt_test_util",
+        "//test/core/util:gpr_test_util",
     ],
 )
diff --git a/test/core/tsi/alts/handshaker/BUILD b/test/core/tsi/alts/handshaker/BUILD
index 809742744c..3f1a681c1a 100644
--- a/test/core/tsi/alts/handshaker/BUILD
+++ b/test/core/tsi/alts/handshaker/BUILD
@@ -37,6 +37,7 @@ grpc_cc_test(
         "//:tsi",
         "//:tsi_interface",
         "//:grpc",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -47,6 +48,7 @@ grpc_cc_test(
     deps = [
         ":alts_handshaker_service_api_test_lib",
         "//:grpc",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -60,6 +62,7 @@ grpc_cc_test(
         "//:gpr_base",
         "//:grpc",
         "//:tsi",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -71,6 +74,7 @@ grpc_cc_test(
         ":alts_handshaker_service_api_test_lib",
         "//:grpc",
         "//:tsi",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -81,6 +85,7 @@ grpc_cc_test(
     deps = [
         "//:alts_util",
         "//:grpc",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
diff --git a/test/core/tsi/alts/zero_copy_frame_protector/BUILD b/test/core/tsi/alts/zero_copy_frame_protector/BUILD
index 2b41dae043..a3b797327e 100644
--- a/test/core/tsi/alts/zero_copy_frame_protector/BUILD
+++ b/test/core/tsi/alts/zero_copy_frame_protector/BUILD
@@ -28,6 +28,7 @@ grpc_cc_test(
         "//:grpc",
         "//:grpc_base_c",
         "//test/core/tsi/alts/crypt:alts_crypt_test_util",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -40,6 +41,7 @@ grpc_cc_test(
         "//:gpr",
         "//:grpc",
         "//test/core/tsi/alts/crypt:alts_crypt_test_util",
+        "//test/core/util:gpr_test_util",
     ],
 )
 
@@ -53,5 +55,6 @@ grpc_cc_test(
         "//:grpc",
         "//:grpc_base_c",
         "//test/core/tsi/alts/crypt:alts_crypt_test_util",
+        "//test/core/util:gpr_test_util",
     ],
 )
diff --git a/test/core/util/BUILD b/test/core/util/BUILD
index f52570cde5..5492dcfa79 100644
--- a/test/core/util/BUILD
+++ b/test/core/util/BUILD
@@ -32,6 +32,11 @@ grpc_cc_library(
         "test_config.h",
     ],
     deps = ["//:gpr"],
+    data = [
+        "lsan_suppressions.txt",
+        "tsan_suppressions.txt",
+        "ubsan_suppressions.txt",
+    ],
 )
 
 grpc_cc_library(
diff --git a/test/core/util/lsan_suppressions.txt b/test/core/util/lsan_suppressions.txt
new file mode 100644
index 0000000000..204ddbef5e
--- /dev/null
+++ b/test/core/util/lsan_suppressions.txt
@@ -0,0 +1,6 @@
+# this is busted in BoringSSL
+leak:CRYPTO_set_thread_local
+leak:err_get_state
+leak:ERR_add_error_dataf
+leak:err_add_error_vdata
+leak:RAND_bytes_with_additional_data
diff --git a/test/core/util/tsan_suppressions.txt b/test/core/util/tsan_suppressions.txt
new file mode 100644
index 0000000000..e0c7907228
--- /dev/null
+++ b/test/core/util/tsan_suppressions.txt
@@ -0,0 +1,13 @@
+# OPENSSL_cleanse does racy access to a global
+race:OPENSSL_cleanse
+race:cleanse_ctr
+# these are legitimate races in OpenSSL, and it appears those folks are looking at it
+# https://www.mail-archive.com/openssl-dev@openssl.org/msg09019.html
+race:ssleay_rand_add
+race:ssleay_rand_bytes
+race:__sleep_for
+# protobuf has an idempotent write race in ByteSize/GetCachedSize
+# https://github.com/google/protobuf/issues/2169
+race:ByteSize
+race:ByteSizeLong
+race:GetCachedSize
diff --git a/test/core/util/ubsan_suppressions.txt b/test/core/util/ubsan_suppressions.txt
new file mode 100644
index 0000000000..2268adc169
--- /dev/null
+++ b/test/core/util/ubsan_suppressions.txt
@@ -0,0 +1,17 @@
+# boringssl stuff
+nonnull-attribute:bn_wexpand
+nonnull-attribute:CBB_add_bytes
+nonnull-attribute:rsa_blinding_get
+nonnull-attribute:ssl_copy_key_material
+alignment:CRYPTO_cbc128_encrypt
+alignment:CRYPTO_gcm128_encrypt
+alignment:poly1305_block_copy
+nonnull-attribute:google::protobuf::*
+alignment:google::protobuf::*
+nonnull-attribute:_tr_stored_block
+# The following 5 suppressors should be removed as part of C++ cleanup
+enum:client_fuzzer_one_entry
+enum:message_compress_test
+enum:transport_security_test
+enum:algorithm_test
+alignment:transport_security_test