grpc 1.31.1 → 1.32.0.pre1

data/src/core/lib/iomgr/iomgr.h

@@ -45,16 +45,6 @@ void grpc_iomgr_shutdown_background_closure();
  */
 bool grpc_iomgr_run_in_background();
 
-/* Returns true if polling engine is non-polling, false otherwise.
- * Currently only 'none' is non-polling.
- */
-bool grpc_iomgr_non_polling();
-
-/* Mark the polling engine as non-polling. For internal use only.
- * Currently only 'none' is non-polling.
- */
-void grpc_iomgr_mark_non_polling_internal();
-
 /** Returns true if the caller is a worker thread for any background poller. */
 bool grpc_iomgr_is_any_background_poller_thread();
 

data/src/core/{ext/filters/client_channel → lib/iomgr}/parse_address.cc

@@ -18,8 +18,8 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/ext/filters/client_channel/parse_address.h"
 #include "src/core/lib/iomgr/grpc_if_nametoindex.h"
+#include "src/core/lib/iomgr/parse_address.h"
 #include "src/core/lib/iomgr/sockaddr.h"
 #include "src/core/lib/iomgr/socket_utils.h"
 

data/src/core/{ext/filters/client_channel → lib/iomgr}/parse_address.h

@@ -16,8 +16,8 @@
  *
  */
 
-#ifndef GRPC_CORE_EXT_FILTERS_CLIENT_CHANNEL_PARSE_ADDRESS_H
-#define GRPC_CORE_EXT_FILTERS_CLIENT_CHANNEL_PARSE_ADDRESS_H
+#ifndef GRPC_CORE_LIB_IOMGR_PARSE_ADDRESS_H
+#define GRPC_CORE_LIB_IOMGR_PARSE_ADDRESS_H
 
 #include <grpc/support/port_platform.h>
 
@@ -50,4 +50,4 @@ bool grpc_parse_ipv6_hostport(const char* hostport, grpc_resolved_address* addr,
 /* Converts named or numeric port to a uint16 suitable for use in a sockaddr. */
 uint16_t grpc_strhtons(const char* port);
 
-#endif /* GRPC_CORE_EXT_FILTERS_CLIENT_CHANNEL_PARSE_ADDRESS_H */
+#endif /* GRPC_CORE_LIB_IOMGR_PARSE_ADDRESS_H */

data/src/core/lib/iomgr/sockaddr_utils.cc

@@ -198,7 +198,8 @@ std::string grpc_sockaddr_to_string(const grpc_resolved_address* resolved_addr,
   return out;
 }
 
-void grpc_string_to_sockaddr(grpc_resolved_address* out, char* addr, int port) {
+void grpc_string_to_sockaddr(grpc_resolved_address* out, const char* addr,
+                             int port) {
   memset(out, 0, sizeof(grpc_resolved_address));
   grpc_sockaddr_in6* addr6 = (grpc_sockaddr_in6*)out->addr;
   grpc_sockaddr_in* addr4 = (grpc_sockaddr_in*)out->addr;

data/src/core/lib/iomgr/sockaddr_utils.h

@@ -66,7 +66,8 @@ int grpc_sockaddr_set_port(const grpc_resolved_address* addr, int port);
 std::string grpc_sockaddr_to_string(const grpc_resolved_address* addr,
                                     bool normalize);
 
-void grpc_string_to_sockaddr(grpc_resolved_address* out, char* addr, int port);
+void grpc_string_to_sockaddr(grpc_resolved_address* out, const char* addr,
+                             int port);
 
 /* Returns the URI string corresponding to \a addr */
 std::string grpc_sockaddr_to_uri(const grpc_resolved_address* addr);

data/src/core/lib/iomgr/tcp_custom.cc

@@ -32,6 +32,7 @@
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/iomgr_custom.h"
 #include "src/core/lib/iomgr/resource_quota.h"
+#include "src/core/lib/iomgr/sockaddr_utils.h"
 #include "src/core/lib/iomgr/tcp_client.h"
 #include "src/core/lib/iomgr/tcp_custom.h"
 #include "src/core/lib/iomgr/tcp_server.h"
@@ -57,24 +58,24 @@ struct custom_tcp_endpoint {
   gpr_refcount refcount;
   grpc_custom_socket* socket;
 
-  grpc_closure* read_cb;
-  grpc_closure* write_cb;
+  grpc_closure* read_cb = nullptr;
+  grpc_closure* write_cb = nullptr;
 
-  grpc_slice_buffer* read_slices;
-  grpc_slice_buffer* write_slices;
+  grpc_slice_buffer* read_slices = nullptr;
+  grpc_slice_buffer* write_slices = nullptr;
 
   grpc_resource_user* resource_user;
   grpc_resource_user_slice_allocator slice_allocator;
 
   bool shutting_down;
 
-  char* peer_string;
+  std::string peer_string;
+  std::string local_address;
 };
 static void tcp_free(grpc_custom_socket* s) {
   custom_tcp_endpoint* tcp = (custom_tcp_endpoint*)s->endpoint;
   grpc_resource_user_unref(tcp->resource_user);
-  gpr_free(tcp->peer_string);
-  gpr_free(tcp);
+  delete tcp;
   s->refs--;
   if (s->refs == 0) {
     grpc_custom_socket_vtable->destroy(s);
@@ -132,7 +133,8 @@ static void call_read_cb(custom_tcp_endpoint* tcp, grpc_error* error) {
     for (i = 0; i < tcp->read_slices->count; i++) {
       char* dump = grpc_dump_slice(tcp->read_slices->slices[i],
                                    GPR_DUMP_HEX | GPR_DUMP_ASCII);
-      gpr_log(GPR_INFO, "READ %p (peer=%s): %s", tcp, tcp->peer_string, dump);
+      gpr_log(GPR_INFO, "READ %p (peer=%s): %s", tcp, tcp->peer_string.c_str(),
+              dump);
       gpr_free(dump);
     }
   }
@@ -233,8 +235,8 @@ static void endpoint_write(grpc_endpoint* ep, grpc_slice_buffer* write_slices,
     for (j = 0; j < write_slices->count; j++) {
       char* data = grpc_dump_slice(write_slices->slices[j],
                                    GPR_DUMP_HEX | GPR_DUMP_ASCII);
-      gpr_log(GPR_INFO, "WRITE %p (peer=%s): %s", tcp->socket, tcp->peer_string,
-              data);
+      gpr_log(GPR_INFO, "WRITE %p (peer=%s): %s", tcp->socket,
+              tcp->peer_string.c_str(), data);
       gpr_free(data);
     }
   }
@@ -317,9 +319,14 @@ static void endpoint_destroy(grpc_endpoint* ep) {
   grpc_custom_socket_vtable->close(tcp->socket, custom_close_callback);
 }
 
-static char* endpoint_get_peer(grpc_endpoint* ep) {
+static absl::string_view endpoint_get_peer(grpc_endpoint* ep) {
   custom_tcp_endpoint* tcp = (custom_tcp_endpoint*)ep;
-  return gpr_strdup(tcp->peer_string);
+  return tcp->peer_string;
+}
+
+static absl::string_view endpoint_get_local_address(grpc_endpoint* ep) {
+  custom_tcp_endpoint* tcp = (custom_tcp_endpoint*)ep;
+  return tcp->local_address;
 }
 
 static grpc_resource_user* endpoint_get_resource_user(grpc_endpoint* ep) {
@@ -340,27 +347,36 @@ static grpc_endpoint_vtable vtable = {endpoint_read,
                                       endpoint_destroy,
                                       endpoint_get_resource_user,
                                       endpoint_get_peer,
+                                      endpoint_get_local_address,
                                       endpoint_get_fd,
                                       endpoint_can_track_err};
 
 grpc_endpoint* custom_tcp_endpoint_create(grpc_custom_socket* socket,
                                           grpc_resource_quota* resource_quota,
                                           const char* peer_string) {
-  custom_tcp_endpoint* tcp =
-      (custom_tcp_endpoint*)gpr_malloc(sizeof(custom_tcp_endpoint));
+  custom_tcp_endpoint* tcp = new custom_tcp_endpoint;
   grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
   grpc_core::ExecCtx exec_ctx;
 
   if (GRPC_TRACE_FLAG_ENABLED(grpc_tcp_trace)) {
     gpr_log(GPR_INFO, "Creating TCP endpoint %p", socket);
   }
-  memset(tcp, 0, sizeof(custom_tcp_endpoint));
   socket->refs++;
   socket->endpoint = (grpc_endpoint*)tcp;
   tcp->socket = socket;
   tcp->base.vtable = &vtable;
   gpr_ref_init(&tcp->refcount, 1);
-  tcp->peer_string = gpr_strdup(peer_string);
+  tcp->peer_string = peer_string;
+  grpc_resolved_address resolved_local_addr;
+  resolved_local_addr.len = sizeof(resolved_local_addr.addr);
+  if (grpc_custom_socket_vtable->getsockname(
+          socket, reinterpret_cast<sockaddr*>(resolved_local_addr.addr),
+          reinterpret_cast<int*>(&resolved_local_addr.len)) !=
+      GRPC_ERROR_NONE) {
+    tcp->local_address = "";
+  } else {
+    tcp->local_address = grpc_sockaddr_to_uri(&resolved_local_addr);
+  }
   tcp->shutting_down = false;
   tcp->resource_user = grpc_resource_user_create(resource_quota, peer_string);
   grpc_resource_user_slice_allocator_init(

data/src/core/lib/iomgr/tcp_posix.cc

@@ -54,6 +54,7 @@
 #include "src/core/lib/iomgr/buffer_list.h"
 #include "src/core/lib/iomgr/ev_posix.h"
 #include "src/core/lib/iomgr/executor.h"
+#include "src/core/lib/iomgr/sockaddr_utils.h"
 #include "src/core/lib/iomgr/socket_utils_posix.h"
 #include "src/core/lib/profiling/timers.h"
 #include "src/core/lib/slice/slice_internal.h"
@@ -351,6 +352,8 @@ using grpc_core::TcpZerocopySendRecord;
 
 namespace {
 struct grpc_tcp {
+  grpc_tcp(int max_sends, size_t send_bytes_threshold)
+      : tcp_zerocopy_send_ctx(max_sends, send_bytes_threshold) {}
   grpc_endpoint base;
   grpc_fd* em_fd;
   int fd;
@@ -385,7 +388,8 @@ struct grpc_tcp {
   grpc_closure write_done_closure;
   grpc_closure error_closure;
 
-  char* peer_string;
+  std::string peer_string;
+  std::string local_address;
 
   grpc_resource_user* resource_user;
   grpc_resource_user_slice_allocator slice_allocator;
@@ -605,7 +609,7 @@ static grpc_error* tcp_annotate_error(grpc_error* src_error, grpc_tcp* tcp) {
            * choose to retry. */
           GRPC_ERROR_INT_GRPC_STATUS, GRPC_STATUS_UNAVAILABLE),
       GRPC_ERROR_STR_TARGET_ADDRESS,
-      grpc_slice_from_copied_string(tcp->peer_string));
+      grpc_slice_from_copied_string(tcp->peer_string.c_str()));
 }
 
 static void tcp_handle_read(void* arg /* grpc_tcp */, grpc_error* error);
@@ -623,7 +627,6 @@ static void tcp_free(grpc_tcp* tcp) {
                  "tcp_unref_orphan");
   grpc_slice_buffer_destroy_internal(&tcp->last_read_buffer);
   grpc_resource_user_unref(tcp->resource_user);
-  gpr_free(tcp->peer_string);
   /* The lock is not really necessary here, since all refs have been released */
   gpr_mu_lock(&tcp->tb_mu);
   grpc_core::TracedBuffer::Shutdown(
@@ -632,8 +635,7 @@ static void tcp_free(grpc_tcp* tcp) {
   gpr_mu_unlock(&tcp->tb_mu);
   tcp->outgoing_buffer_arg = nullptr;
   gpr_mu_destroy(&tcp->tb_mu);
-  tcp->tcp_zerocopy_send_ctx.~TcpZerocopySendCtx();
-  gpr_free(tcp);
+  delete tcp;
 }
 
 #ifndef NDEBUG
@@ -680,7 +682,8 @@ static void call_read_cb(grpc_tcp* tcp, grpc_error* error) {
     gpr_log(GPR_INFO, "TCP:%p call_cb %p %p:%p", tcp, cb, cb->cb, cb->cb_arg);
     size_t i;
     const char* str = grpc_error_string(error);
-    gpr_log(GPR_INFO, "READ %p (peer=%s) error=%s", tcp, tcp->peer_string, str);
+    gpr_log(GPR_INFO, "READ %p (peer=%s) error=%s", tcp,
+            tcp->peer_string.c_str(), str);
 
     if (gpr_should_log(GPR_LOG_SEVERITY_DEBUG)) {
       for (i = 0; i < tcp->incoming_buffer->count; i++) {
@@ -1563,7 +1566,7 @@ static void tcp_write(grpc_endpoint* ep, grpc_slice_buffer* buf,
     size_t i;
 
     for (i = 0; i < buf->count; i++) {
-      gpr_log(GPR_INFO, "WRITE %p (peer=%s)", tcp, tcp->peer_string);
+      gpr_log(GPR_INFO, "WRITE %p (peer=%s)", tcp, tcp->peer_string.c_str());
       if (gpr_should_log(GPR_LOG_SEVERITY_DEBUG)) {
         char* data =
             grpc_dump_slice(buf->slices[i], GPR_DUMP_HEX | GPR_DUMP_ASCII);
@@ -1637,9 +1640,14 @@ static void tcp_delete_from_pollset_set(grpc_endpoint* ep,
   grpc_pollset_set_del_fd(pollset_set, tcp->em_fd);
 }
 
-static char* tcp_get_peer(grpc_endpoint* ep) {
+static absl::string_view tcp_get_peer(grpc_endpoint* ep) {
   grpc_tcp* tcp = reinterpret_cast<grpc_tcp*>(ep);
-  return gpr_strdup(tcp->peer_string);
+  return tcp->peer_string;
+}
+
+static absl::string_view tcp_get_local_address(grpc_endpoint* ep) {
+  grpc_tcp* tcp = reinterpret_cast<grpc_tcp*>(ep);
+  return tcp->local_address;
 }
 
 static int tcp_get_fd(grpc_endpoint* ep) {
@@ -1677,6 +1685,7 @@ static const grpc_endpoint_vtable vtable = {tcp_read,
                                             tcp_destroy,
                                             tcp_get_resource_user,
                                             tcp_get_peer,
+                                            tcp_get_local_address,
                                             tcp_get_fd,
                                             tcp_can_track_err};
 
@@ -1745,10 +1754,21 @@ grpc_endpoint* grpc_tcp_create(grpc_fd* em_fd,
   tcp_read_chunk_size = GPR_CLAMP(tcp_read_chunk_size, tcp_min_read_chunk_size,
                                   tcp_max_read_chunk_size);
 
-  grpc_tcp* tcp = static_cast<grpc_tcp*>(gpr_malloc(sizeof(grpc_tcp)));
+  grpc_tcp* tcp = new grpc_tcp(tcp_tx_zerocopy_max_simult_sends,
+                               tcp_tx_zerocopy_send_bytes_thresh);
   tcp->base.vtable = &vtable;
-  tcp->peer_string = gpr_strdup(peer_string);
+  tcp->peer_string = peer_string;
   tcp->fd = grpc_fd_wrapped_fd(em_fd);
+  grpc_resolved_address resolved_local_addr;
+  memset(&resolved_local_addr, 0, sizeof(resolved_local_addr));
+  resolved_local_addr.len = sizeof(resolved_local_addr.addr);
+  if (getsockname(tcp->fd,
+                  reinterpret_cast<sockaddr*>(resolved_local_addr.addr),
+                  &resolved_local_addr.len) < 0) {
+    tcp->local_address = "";
+  } else {
+    tcp->local_address = grpc_sockaddr_to_uri(&resolved_local_addr);
+  }
   tcp->read_cb = nullptr;
   tcp->write_cb = nullptr;
   tcp->current_zerocopy_send = nullptr;
@@ -1765,8 +1785,6 @@ grpc_endpoint* grpc_tcp_create(grpc_fd* em_fd,
   tcp->socket_ts_enabled = false;
   tcp->ts_capable = true;
   tcp->outgoing_buffer_arg = nullptr;
-  new (&tcp->tcp_zerocopy_send_ctx) TcpZerocopySendCtx(
-      tcp_tx_zerocopy_max_simult_sends, tcp_tx_zerocopy_send_bytes_thresh);
   if (tcp_tx_zerocopy_enabled && !tcp->tcp_zerocopy_send_ctx.memory_limited()) {
 #ifdef GRPC_LINUX_ERRQUEUE
     const int enable = 1;

data/src/core/lib/iomgr/tcp_windows.cc

@@ -125,17 +125,17 @@ typedef struct grpc_tcp {
   int shutting_down;
   grpc_error* shutdown_error;
 
-  char* peer_string;
+  std::string peer_string;
+  std::string local_address;
 } grpc_tcp;
 
 static void tcp_free(grpc_tcp* tcp) {
   grpc_winsocket_destroy(tcp->socket);
   gpr_mu_destroy(&tcp->mu);
-  gpr_free(tcp->peer_string);
   grpc_slice_buffer_destroy_internal(&tcp->last_read_buffer);
   grpc_resource_user_unref(tcp->resource_user);
   if (tcp->shutting_down) GRPC_ERROR_UNREF(tcp->shutdown_error);
-  gpr_free(tcp);
+  delete tcp;
 }
 
 #ifndef NDEBUG
@@ -213,8 +213,8 @@ static void on_read(void* tcpp, grpc_error* error) {
           for (i = 0; i < tcp->read_slices->count; i++) {
             char* dump = grpc_dump_slice(tcp->read_slices->slices[i],
                                          GPR_DUMP_HEX | GPR_DUMP_ASCII);
-            gpr_log(GPR_INFO, "READ %p (peer=%s): %s", tcp, tcp->peer_string,
-                    dump);
+            gpr_log(GPR_INFO, "READ %p (peer=%s): %s", tcp,
+                    tcp->peer_string.c_str(), dump);
             gpr_free(dump);
           }
         }
@@ -361,7 +361,8 @@ static void win_write(grpc_endpoint* ep, grpc_slice_buffer* slices,
     for (i = 0; i < slices->count; i++) {
       char* data =
           grpc_dump_slice(slices->slices[i], GPR_DUMP_HEX | GPR_DUMP_ASCII);
-      gpr_log(GPR_INFO, "WRITE %p (peer=%s): %s", tcp, tcp->peer_string, data);
+      gpr_log(GPR_INFO, "WRITE %p (peer=%s): %s", tcp, tcp->peer_string.c_str(),
+              data);
       gpr_free(data);
     }
   }
@@ -475,9 +476,14 @@ static void win_destroy(grpc_endpoint* ep) {
   TCP_UNREF(tcp, "destroy");
 }
 
-static char* win_get_peer(grpc_endpoint* ep) {
+static absl::string_view win_get_peer(grpc_endpoint* ep) {
   grpc_tcp* tcp = (grpc_tcp*)ep;
-  return gpr_strdup(tcp->peer_string);
+  return tcp->peer_string;
+}
+
+static absl::string_view win_get_local_address(grpc_endpoint* ep) {
+  grpc_tcp* tcp = (grpc_tcp*)ep;
+  return tcp->local_address;
 }
 
 static grpc_resource_user* win_get_resource_user(grpc_endpoint* ep) {
@@ -498,6 +504,7 @@ static grpc_endpoint_vtable vtable = {win_read,
                                       win_destroy,
                                       win_get_resource_user,
                                       win_get_peer,
+                                      win_get_local_address,
                                       win_get_fd,
                                       win_can_track_err};
 
@@ -514,7 +521,7 @@ grpc_endpoint* grpc_tcp_create(grpc_winsocket* socket,
       }
     }
   }
-  grpc_tcp* tcp = (grpc_tcp*)gpr_malloc(sizeof(grpc_tcp));
+  grpc_tcp* tcp = new grpc_tcp;
   memset(tcp, 0, sizeof(grpc_tcp));
   tcp->base.vtable = &vtable;
   tcp->socket = socket;
@@ -522,7 +529,16 @@ grpc_endpoint* grpc_tcp_create(grpc_winsocket* socket,
   gpr_ref_init(&tcp->refcount, 1);
   GRPC_CLOSURE_INIT(&tcp->on_read, on_read, tcp, grpc_schedule_on_exec_ctx);
   GRPC_CLOSURE_INIT(&tcp->on_write, on_write, tcp, grpc_schedule_on_exec_ctx);
-  tcp->peer_string = gpr_strdup(peer_string);
+  grpc_resolved_address resolved_local_addr;
+  resolved_local_addr.len = sizeof(resolved_local_addr.addr);
+  if (getsockname(tcp->socket->socket,
+                  reinterpret_cast<sockaddr*>(resolved_local_addr.addr),
+                  &resolved_local_addr.len) < 0) {
+    tcp->local_address = "";
+  } else {
+    tcp->local_address = grpc_sockaddr_to_uri(&resolved_local_addr);
+  }
+  tcp->peer_string = peer_string;
   grpc_slice_buffer_init(&tcp->last_read_buffer);
   tcp->resource_user = grpc_resource_user_create(resource_quota, peer_string);
   grpc_resource_quota_unref_internal(resource_quota);

data/src/core/lib/security/authorization/authorization_engine.cc

@@ -0,0 +1,177 @@
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "absl/memory/memory.h"
+
+#include "src/core/lib/security/authorization/authorization_engine.h"
+
+namespace grpc_core {
+
+namespace {
+
+// Symbols for traversing Envoy Attributes
+constexpr char kUrlPath[] = "url_path";
+constexpr char kHost[] = "host";
+constexpr char kMethod[] = "method";
+constexpr char kHeaders[] = "headers";
+constexpr char kSourceAddress[] = "source_address";
+constexpr char kSourcePort[] = "source_port";
+constexpr char kDestinationAddress[] = "destination_address";
+constexpr char kDestinationPort[] = "destination_port";
+constexpr char kSpiffeId[] = "spiffe_id";
+constexpr char kCertServerName[] = "cert_server_name";
+
+}  // namespace
+
+std::unique_ptr<AuthorizationEngine>
+AuthorizationEngine::CreateAuthorizationEngine(
+    const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies) {
+  if (rbac_policies.empty() || rbac_policies.size() > 2) {
+    gpr_log(GPR_ERROR,
+            "Invalid rbac policies vector. Must contain either one or two rbac "
+            "policies.");
+    return nullptr;
+  } else if (rbac_policies.size() == 2 &&
+             (envoy_config_rbac_v3_RBAC_action(rbac_policies[0]) != kDeny ||
+              envoy_config_rbac_v3_RBAC_action(rbac_policies[1]) != kAllow)) {
+    gpr_log(GPR_ERROR,
+            "Invalid rbac policies vector. Must contain one deny \
+                         policy and one allow policy, in that order.");
+    return nullptr;
+  } else {
+    return absl::make_unique<AuthorizationEngine>(rbac_policies);
+  }
+}
+
+AuthorizationEngine::AuthorizationEngine(
+    const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies) {
+  for (const auto& rbac_policy : rbac_policies) {
+    // Extract array of policies and store their condition fields in either
+    // allow_if_matched_ or deny_if_matched_, depending on the policy action.
+    upb::Arena temp_arena;
+    size_t policy_num = UPB_MAP_BEGIN;
+    const envoy_config_rbac_v3_RBAC_PoliciesEntry* policy_entry;
+    while ((policy_entry = envoy_config_rbac_v3_RBAC_policies_next(
+                rbac_policy, &policy_num)) != nullptr) {
+      const upb_strview policy_name_strview =
+          envoy_config_rbac_v3_RBAC_PoliciesEntry_key(policy_entry);
+      const std::string policy_name(policy_name_strview.data,
+                                    policy_name_strview.size);
+      const envoy_config_rbac_v3_Policy* policy =
+          envoy_config_rbac_v3_RBAC_PoliciesEntry_value(policy_entry);
+      const google_api_expr_v1alpha1_Expr* condition =
+          envoy_config_rbac_v3_Policy_condition(policy);
+      // Parse condition to make a pointer tied to the lifetime of arena_.
+      size_t serial_len;
+      const char* serialized = google_api_expr_v1alpha1_Expr_serialize(
+          condition, temp_arena.ptr(), &serial_len);
+      const google_api_expr_v1alpha1_Expr* parsed_condition =
+          google_api_expr_v1alpha1_Expr_parse(serialized, serial_len,
+                                              arena_.ptr());
+      if (envoy_config_rbac_v3_RBAC_action(rbac_policy) == kAllow) {
+        allow_if_matched_.insert(std::make_pair(policy_name, parsed_condition));
+      } else {
+        deny_if_matched_.insert(std::make_pair(policy_name, parsed_condition));
+      }
+    }
+  }
+}
+
+std::unique_ptr<mock_cel::Activation> AuthorizationEngine::CreateActivation(
+    const EvaluateArgs& args) {
+  std::unique_ptr<mock_cel::Activation> activation;
+  for (const auto& elem : envoy_attributes_) {
+    if (elem == kUrlPath) {
+      absl::string_view url_path(args.GetPath());
+      if (!url_path.empty()) {
+        activation->InsertValue(kUrlPath,
+                                mock_cel::CelValue::CreateStringView(url_path));
+      }
+    } else if (elem == kHost) {
+      absl::string_view host(args.GetHost());
+      if (!host.empty()) {
+        activation->InsertValue(kHost,
+                                mock_cel::CelValue::CreateStringView(host));
+      }
+    } else if (elem == kMethod) {
+      absl::string_view method(args.GetMethod());
+      if (!method.empty()) {
+        activation->InsertValue(kMethod,
+                                mock_cel::CelValue::CreateStringView(method));
+      }
+    } else if (elem == kHeaders) {
+      std::multimap<absl::string_view, absl::string_view> headers =
+          args.GetHeaders();
+      std::vector<std::pair<mock_cel::CelValue, mock_cel::CelValue>>
+          header_items;
+      for (const auto& header_key : header_keys_) {
+        auto header_item = headers.find(header_key);
+        if (header_item != headers.end()) {
+          header_items.push_back(
+              std::pair<mock_cel::CelValue, mock_cel::CelValue>(
+                  mock_cel::CelValue::CreateStringView(header_key),
+                  mock_cel::CelValue::CreateStringView(header_item->second)));
+        }
+      }
+      headers_ = mock_cel::ContainerBackedMapImpl::Create(
+          absl::Span<std::pair<mock_cel::CelValue, mock_cel::CelValue>>(
+              header_items));
+      activation->InsertValue(kHeaders,
+                              mock_cel::CelValue::CreateMap(headers_.get()));
+    } else if (elem == kSourceAddress) {
+      absl::string_view source_address(args.GetPeerAddress());
+      if (!source_address.empty()) {
+        activation->InsertValue(
+            kSourceAddress,
+            mock_cel::CelValue::CreateStringView(source_address));
+      }
+    } else if (elem == kSourcePort) {
+      activation->InsertValue(
+          kSourcePort, mock_cel::CelValue::CreateInt64(args.GetPeerPort()));
+    } else if (elem == kDestinationAddress) {
+      absl::string_view destination_address(args.GetLocalAddress());
+      if (!destination_address.empty()) {
+        activation->InsertValue(
+            kDestinationAddress,
+            mock_cel::CelValue::CreateStringView(destination_address));
+      }
+    } else if (elem == kDestinationPort) {
+      activation->InsertValue(kDestinationPort, mock_cel::CelValue::CreateInt64(
+                                                    args.GetLocalPort()));
+    } else if (elem == kSpiffeId) {
+      absl::string_view spiffe_id(args.GetSpiffeId());
+      if (!spiffe_id.empty()) {
+        activation->InsertValue(
+            kSpiffeId, mock_cel::CelValue::CreateStringView(spiffe_id));
+      }
+    } else if (elem == kCertServerName) {
+      absl::string_view cert_server_name(args.GetCertServerName());
+      if (!cert_server_name.empty()) {
+        activation->InsertValue(
+            kCertServerName,
+            mock_cel::CelValue::CreateStringView(cert_server_name));
+      }
+    } else {
+      gpr_log(GPR_ERROR,
+              "Error: Authorization engine does not support evaluating "
+              "attribute %s.",
+              elem.c_str());
+    }
+  }
+  return activation;
+}
+
+}  // namespace grpc_core