grpc 1.32.0 → 1.36.0

data/src/core/lib/json/json_reader.cc

@@ -413,8 +413,9 @@ JsonReader::Status JsonReader::Run() {
 
           /* This is the \\ case. */
           case State::GRPC_JSON_STATE_STRING_ESCAPE:
-            if (unicode_high_surrogate_ != 0)
+            if (unicode_high_surrogate_ != 0) {
               return Status::GRPC_JSON_PARSE_ERROR;
+            }
             StringAddChar('\\');
             if (escaped_string_was_key_) {
               state_ = State::GRPC_JSON_STATE_OBJECT_KEY_STRING;
@@ -593,14 +594,16 @@ JsonReader::Status JsonReader::Run() {
                  */
                 if ((unicode_char_ & 0xfc00) == 0xd800) {
                   /* high surrogate utf-16 */
-                  if (unicode_high_surrogate_ != 0)
+                  if (unicode_high_surrogate_ != 0) {
                     return Status::GRPC_JSON_PARSE_ERROR;
+                  }
                   unicode_high_surrogate_ = unicode_char_;
                 } else if ((unicode_char_ & 0xfc00) == 0xdc00) {
                   /* low surrogate utf-16 */
                   uint32_t utf32;
-                  if (unicode_high_surrogate_ == 0)
+                  if (unicode_high_surrogate_ == 0) {
                     return Status::GRPC_JSON_PARSE_ERROR;
+                  }
                   utf32 = 0x10000;
                   utf32 += static_cast<uint32_t>(
                       (unicode_high_surrogate_ - 0xd800) * 0x400);
@@ -609,8 +612,9 @@ JsonReader::Status JsonReader::Run() {
                   unicode_high_surrogate_ = 0;
                 } else {
                   /* anything else */
-                  if (unicode_high_surrogate_ != 0)
+                  if (unicode_high_surrogate_ != 0) {
                     return Status::GRPC_JSON_PARSE_ERROR;
+                  }
                   StringAddUtf32(unicode_char_);
                 }
                 if (escaped_string_was_key_) {

data/src/core/lib/json/json_util.cc

@@ -0,0 +1,58 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/json/json_util.h"
+
+#include <grpc/support/string_util.h>
+
+#include "src/core/lib/gpr/string.h"
+
+namespace grpc_core {
+
+bool ParseDurationFromJson(const Json& field, grpc_millis* duration) {
+  if (field.type() != Json::Type::STRING) return false;
+  size_t len = field.string_value().size();
+  if (field.string_value()[len - 1] != 's') return false;
+  grpc_core::UniquePtr<char> buf(gpr_strdup(field.string_value().c_str()));
+  *(buf.get() + len - 1) = '\0';  // Remove trailing 's'.
+  char* decimal_point = strchr(buf.get(), '.');
+  int nanos = 0;
+  if (decimal_point != nullptr) {
+    *decimal_point = '\0';
+    nanos = gpr_parse_nonnegative_int(decimal_point + 1);
+    if (nanos == -1) {
+      return false;
+    }
+    int num_digits = static_cast<int>(strlen(decimal_point + 1));
+    if (num_digits > 9) {  // We don't accept greater precision than nanos.
+      return false;
+    }
+    for (int i = 0; i < (9 - num_digits); ++i) {
+      nanos *= 10;
+    }
+  }
+  int seconds =
+      decimal_point == buf.get() ? 0 : gpr_parse_nonnegative_int(buf.get());
+  if (seconds == -1) return false;
+  *duration = seconds * GPR_MS_PER_SEC + nanos / GPR_NS_PER_MS;
+  return true;
+}
+
+}  // namespace grpc_core

data/src/core/lib/json/json_util.h

@@ -0,0 +1,204 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_JSON_JSON_UTIL_H
+#define GRPC_CORE_LIB_JSON_JSON_UTIL_H
+
+#include <grpc/support/port_platform.h>
+
+#include "absl/strings/numbers.h"
+#include "absl/strings/str_cat.h"
+
+#include "src/core/lib/iomgr/exec_ctx.h"
+#include "src/core/lib/json/json.h"
+
+namespace grpc_core {
+
+// Parses a JSON field of the form generated for a google.proto.Duration
+// proto message, as per:
+//   https://developers.google.com/protocol-buffers/docs/proto3#json
+// Returns true on success, false otherwise.
+bool ParseDurationFromJson(const Json& field, grpc_millis* duration);
+
+//
+// Helper functions for extracting types from JSON.
+// Return true on success, false otherwise. If an error is encountered during
+// parsing, a descriptive error is appended to \a error_list.
+//
+template <typename NumericType, typename ErrorVectorType>
+inline bool ExtractJsonNumber(const Json& json, const std::string& field_name,
+                              NumericType* output,
+                              ErrorVectorType* error_list) {
+  static_assert(std::is_integral<NumericType>::value, "Integral required");
+  if (json.type() != Json::Type::NUMBER) {
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name, " error:type should be NUMBER")
+            .c_str()));
+    return false;
+  }
+  if (!absl::SimpleAtoi(json.string_value(), output)) {
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name, " error:failed to parse.").c_str()));
+    return false;
+  }
+  return true;
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonBool(const Json& json, const std::string& field_name,
+                            bool* output, ErrorVectorType* error_list) {
+  switch (json.type()) {
+    case Json::Type::JSON_TRUE:
+      *output = true;
+      return true;
+    case Json::Type::JSON_FALSE:
+      *output = false;
+      return true;
+    default:
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrCat("field:", field_name, " error:type should be BOOLEAN")
+              .c_str()));
+      return false;
+  }
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonString(const Json& json, const std::string& field_name,
+                              std::string* output,
+                              ErrorVectorType* error_list) {
+  if (json.type() != Json::Type::STRING) {
+    *output = "";
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name, " error:type should be STRING")
+            .c_str()));
+    return false;
+  }
+  *output = json.string_value();
+  return true;
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonArray(const Json& json, const std::string& field_name,
+                             const Json::Array** output,
+                             ErrorVectorType* error_list) {
+  if (json.type() != Json::Type::ARRAY) {
+    *output = nullptr;
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name, " error:type should be ARRAY")
+            .c_str()));
+    return false;
+  }
+  *output = &json.array_value();
+  return true;
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonObject(const Json& json, const std::string& field_name,
+                              const Json::Object** output,
+                              ErrorVectorType* error_list) {
+  if (json.type() != Json::Type::OBJECT) {
+    *output = nullptr;
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name, " error:type should be OBJECT")
+            .c_str()));
+    return false;
+  }
+  *output = &json.object_value();
+  return true;
+}
+
+template <typename NumericType, typename ErrorVectorType>
+inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+                            NumericType* output, ErrorVectorType* error_list) {
+  return ExtractJsonNumber(json, field_name, output, error_list);
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+                            bool* output, ErrorVectorType* error_list) {
+  return ExtractJsonBool(json, field_name, output, error_list);
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+                            std::string* output, ErrorVectorType* error_list) {
+  return ExtractJsonString(json, field_name, output, error_list);
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+                            const Json::Array** output,
+                            ErrorVectorType* error_list) {
+  return ExtractJsonArray(json, field_name, output, error_list);
+}
+
+template <typename ErrorVectorType>
+inline bool ExtractJsonType(const Json& json, const std::string& field_name,
+                            const Json::Object** output,
+                            ErrorVectorType* error_list) {
+  return ExtractJsonObject(json, field_name, output, error_list);
+}
+
+template <typename T, typename ErrorVectorType>
+inline bool ParseJsonObjectField(const Json::Object& object,
+                                 const std::string& field_name, T* output,
+                                 ErrorVectorType* error_list,
+                                 bool required = true) {
+  auto it = object.find(field_name);
+  if (it == object.end()) {
+    if (required) {
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrCat("field:", field_name, " error:does not exist.")
+              .c_str()));
+    }
+    return false;
+  }
+  auto& child_object_json = it->second;
+  return ExtractJsonType(child_object_json, field_name, output, error_list);
+}
+
+template <typename ErrorVectorType>
+inline bool ParseJsonObjectFieldAsDuration(const Json::Object& object,
+                                           const std::string& field_name,
+                                           grpc_millis* output,
+                                           ErrorVectorType* error_list,
+                                           bool required = true) {
+  auto it = object.find(field_name);
+  if (it == object.end()) {
+    if (required) {
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrCat("field:", field_name, " error:does not exist.")
+              .c_str()));
+    }
+    return false;
+  }
+  if (!ParseDurationFromJson(it->second, output)) {
+    *output = GRPC_MILLIS_INF_PAST;
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("field:", field_name,
+                     " error:type should be STRING of the form given by "
+                     "google.proto.Duration.")
+            .c_str()));
+    return false;
+  }
+  return true;
+}
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_JSON_JSON_UTIL_H

data/src/core/lib/json/json_writer.cc

@@ -207,8 +207,9 @@ void JsonWriter::EscapeString(const std::string& string) {
        * Any other range is technically reserved for future usage, so if we
        * don't want the software to break in the future, we have to allow
        * anything else. The first non-unicode character is 0x110000. */
-      if (((utf32 >= 0xd800) && (utf32 <= 0xdfff)) || (utf32 >= 0x110000))
+      if (((utf32 >= 0xd800) && (utf32 <= 0xdfff)) || (utf32 >= 0x110000)) {
         break;
+      }
       if (utf32 >= 0x10000) {
         /* If utf32 contains a character that is above 0xffff, it needs to be
          * broken down into a utf-16 surrogate pair. A surrogate pair is first

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -87,14 +87,12 @@ int EvaluateArgs::GetLocalPort() const {
   if (endpoint_ == nullptr) {
     return 0;
   }
-  grpc_uri* uri = grpc_uri_parse(
-      std::string(grpc_endpoint_get_local_address(endpoint_)).c_str(), true);
+  absl::StatusOr<URI> uri =
+      URI::Parse(grpc_endpoint_get_local_address(endpoint_));
   grpc_resolved_address resolved_addr;
-  if (uri == nullptr || !grpc_parse_uri(uri, &resolved_addr)) {
-    grpc_uri_destroy(uri);
+  if (!uri.ok() || !grpc_parse_uri(*uri, &resolved_addr)) {
     return 0;
   }
-  grpc_uri_destroy(uri);
   return grpc_sockaddr_get_port(&resolved_addr);
 }
 
@@ -113,14 +111,11 @@ int EvaluateArgs::GetPeerPort() const {
   if (endpoint_ == nullptr) {
     return 0;
   }
-  grpc_uri* uri = grpc_uri_parse(
-      std::string(grpc_endpoint_get_peer(endpoint_)).c_str(), true);
+  absl::StatusOr<URI> uri = URI::Parse(grpc_endpoint_get_peer(endpoint_));
   grpc_resolved_address resolved_addr;
-  if (uri == nullptr || !grpc_parse_uri(uri, &resolved_addr)) {
-    grpc_uri_destroy(uri);
+  if (!uri.ok() || !grpc_parse_uri(*uri, &resolved_addr)) {
     return 0;
   }
-  grpc_uri_destroy(uri);
   return grpc_sockaddr_get_port(&resolved_addr);
 }
 

data/src/core/lib/security/authorization/evaluate_args.h

@@ -46,7 +46,7 @@ class EvaluateArgs {
   absl::string_view GetSpiffeId() const;
   absl::string_view GetCertServerName() const;
 
-  // TODO: Add a getter function for source.principal
+  // TODO(unknown): Add a getter function for source.principal
 
  private:
   grpc_metadata_batch* metadata_;

data/src/core/lib/security/authorization/matchers.cc

@@ -0,0 +1,339 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/matchers.h"
+
+#include "absl/memory/memory.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_format.h"
+#include "absl/strings/str_join.h"
+#include "absl/strings/str_split.h"
+
+namespace grpc_core {
+
+//
+// StringMatcher
+//
+
+absl::StatusOr<StringMatcher> StringMatcher::Create(Type type,
+                                                    const std::string& matcher,
+                                                    bool case_sensitive) {
+  if (type == Type::SAFE_REGEX) {
+    RE2::Options options;
+    options.set_case_sensitive(case_sensitive);
+    auto regex_matcher = absl::make_unique<RE2>(matcher, options);
+    if (!regex_matcher->ok()) {
+      return absl::InvalidArgumentError(
+          "Invalid regex string specified in matcher.");
+    }
+    return StringMatcher(std::move(regex_matcher), case_sensitive);
+  } else {
+    return StringMatcher(type, matcher, case_sensitive);
+  }
+}
+
+StringMatcher::StringMatcher(Type type, const std::string& matcher,
+                             bool case_sensitive)
+    : type_(type), string_matcher_(matcher), case_sensitive_(case_sensitive) {}
+
+StringMatcher::StringMatcher(std::unique_ptr<RE2> regex_matcher,
+                             bool case_sensitive)
+    : type_(Type::SAFE_REGEX),
+      regex_matcher_(std::move(regex_matcher)),
+      case_sensitive_(case_sensitive) {}
+
+StringMatcher::StringMatcher(const StringMatcher& other)
+    : type_(other.type_), case_sensitive_(other.case_sensitive_) {
+  if (type_ == Type::SAFE_REGEX) {
+    RE2::Options options;
+    options.set_case_sensitive(other.case_sensitive_);
+    regex_matcher_ =
+        absl::make_unique<RE2>(other.regex_matcher_->pattern(), options);
+  } else {
+    string_matcher_ = other.string_matcher_;
+  }
+}
+
+StringMatcher& StringMatcher::operator=(const StringMatcher& other) {
+  type_ = other.type_;
+  if (type_ == Type::SAFE_REGEX) {
+    RE2::Options options;
+    options.set_case_sensitive(other.case_sensitive_);
+    regex_matcher_ =
+        absl::make_unique<RE2>(other.regex_matcher_->pattern(), options);
+  } else {
+    string_matcher_ = other.string_matcher_;
+  }
+  case_sensitive_ = other.case_sensitive_;
+  return *this;
+}
+
+StringMatcher::StringMatcher(StringMatcher&& other) noexcept
+    : type_(other.type_), case_sensitive_(other.case_sensitive_) {
+  if (type_ == Type::SAFE_REGEX) {
+    regex_matcher_ = std::move(other.regex_matcher_);
+  } else {
+    string_matcher_ = std::move(other.string_matcher_);
+  }
+}
+
+StringMatcher& StringMatcher::operator=(StringMatcher&& other) noexcept {
+  type_ = other.type_;
+  if (type_ == Type::SAFE_REGEX) {
+    regex_matcher_ = std::move(other.regex_matcher_);
+  } else {
+    string_matcher_ = std::move(other.string_matcher_);
+  }
+  case_sensitive_ = other.case_sensitive_;
+  return *this;
+}
+
+bool StringMatcher::operator==(const StringMatcher& other) const {
+  if (type_ != other.type_ || case_sensitive_ != other.case_sensitive_) {
+    return false;
+  }
+  if (type_ == Type::SAFE_REGEX) {
+    return regex_matcher_->pattern() == other.regex_matcher_->pattern();
+  } else {
+    return string_matcher_ == other.string_matcher_;
+  }
+}
+
+bool StringMatcher::Match(absl::string_view value) const {
+  switch (type_) {
+    case Type::EXACT:
+      return case_sensitive_ ? value == string_matcher_
+                             : absl::EqualsIgnoreCase(value, string_matcher_);
+    case StringMatcher::Type::PREFIX:
+      return case_sensitive_
+                 ? absl::StartsWith(value, string_matcher_)
+                 : absl::StartsWithIgnoreCase(value, string_matcher_);
+    case StringMatcher::Type::SUFFIX:
+      return case_sensitive_ ? absl::EndsWith(value, string_matcher_)
+                             : absl::EndsWithIgnoreCase(value, string_matcher_);
+    case StringMatcher::Type::CONTAINS:
+      return case_sensitive_
+                 ? absl::StrContains(value, string_matcher_)
+                 : absl::StrContains(absl::AsciiStrToLower(value),
+                                     absl::AsciiStrToLower(string_matcher_));
+    case StringMatcher::Type::SAFE_REGEX:
+      return RE2::FullMatch(std::string(value), *regex_matcher_);
+    default:
+      return false;
+  }
+}
+
+std::string StringMatcher::ToString() const {
+  switch (type_) {
+    case Type::EXACT:
+      return absl::StrFormat("StringMatcher{exact=%s%s}", string_matcher_,
+                             case_sensitive_ ? "" : ", case_sensitive=false");
+    case Type::PREFIX:
+      return absl::StrFormat("StringMatcher{prefix=%s%s}", string_matcher_,
+                             case_sensitive_ ? "" : ", case_sensitive=false");
+    case Type::SUFFIX:
+      return absl::StrFormat("StringMatcher{suffix=%s%s}", string_matcher_,
+                             case_sensitive_ ? "" : ", case_sensitive=false");
+    case Type::CONTAINS:
+      return absl::StrFormat("StringMatcher{contains=%s%s}", string_matcher_,
+                             case_sensitive_ ? "" : ", case_sensitive=false");
+    case Type::SAFE_REGEX:
+      return absl::StrFormat("StringMatcher{safe_regex=%s%s}",
+                             regex_matcher_->pattern(),
+                             case_sensitive_ ? "" : ", case_sensitive=false");
+    default:
+      return "";
+  }
+}
+
+//
+// HeaderMatcher
+//
+
+absl::StatusOr<HeaderMatcher> HeaderMatcher::Create(
+    const std::string& name, Type type, const std::string& matcher,
+    int64_t range_start, int64_t range_end, bool present_match,
+    bool invert_match) {
+  if (static_cast<int>(type) < 5) {
+    // Only for EXACT, PREFIX, SUFFIX, SAFE_REGEX and CONTAINS.
+    absl::StatusOr<StringMatcher> string_matcher =
+        StringMatcher::Create(static_cast<StringMatcher::Type>(type), matcher,
+                              /*case_sensitive=*/true);
+    if (!string_matcher.ok()) {
+      return string_matcher.status();
+    }
+    return HeaderMatcher(name, type, std::move(string_matcher.value()),
+                         invert_match);
+  } else if (type == Type::RANGE) {
+    if (range_start > range_end) {
+      return absl::InvalidArgumentError(
+          "Invalid range specifier specified: end cannot be smaller than "
+          "start.");
+    }
+    return HeaderMatcher(name, range_start, range_end, invert_match);
+  } else {
+    return HeaderMatcher(name, present_match, invert_match);
+  }
+}
+
+HeaderMatcher::HeaderMatcher(const std::string& name, Type type,
+                             StringMatcher string_matcher, bool invert_match)
+    : name_(name),
+      type_(type),
+      matcher_(std::move(string_matcher)),
+      invert_match_(invert_match) {}
+
+HeaderMatcher::HeaderMatcher(const std::string& name, int64_t range_start,
+                             int64_t range_end, bool invert_match)
+    : name_(name),
+      type_(Type::RANGE),
+      range_start_(range_start),
+      range_end_(range_end),
+      invert_match_(invert_match) {}
+
+HeaderMatcher::HeaderMatcher(const std::string& name, bool present_match,
+                             bool invert_match)
+    : name_(name),
+      type_(Type::PRESENT),
+      present_match_(present_match),
+      invert_match_(invert_match) {}
+
+HeaderMatcher::HeaderMatcher(const HeaderMatcher& other)
+    : name_(other.name_),
+      type_(other.type_),
+      invert_match_(other.invert_match_) {
+  switch (type_) {
+    case Type::RANGE:
+      range_start_ = other.range_start_;
+      range_end_ = other.range_end_;
+      break;
+    case Type::PRESENT:
+      present_match_ = other.present_match_;
+      break;
+    default:
+      matcher_ = other.matcher_;
+  }
+}
+
+HeaderMatcher& HeaderMatcher::operator=(const HeaderMatcher& other) {
+  name_ = other.name_;
+  type_ = other.type_;
+  invert_match_ = other.invert_match_;
+  switch (type_) {
+    case Type::RANGE:
+      range_start_ = other.range_start_;
+      range_end_ = other.range_end_;
+      break;
+    case Type::PRESENT:
+      present_match_ = other.present_match_;
+      break;
+    default:
+      matcher_ = other.matcher_;
+  }
+  return *this;
+}
+
+HeaderMatcher::HeaderMatcher(HeaderMatcher&& other) noexcept
+    : name_(std::move(other.name_)),
+      type_(other.type_),
+      invert_match_(other.invert_match_) {
+  switch (type_) {
+    case Type::RANGE:
+      range_start_ = other.range_start_;
+      range_end_ = other.range_end_;
+      break;
+    case Type::PRESENT:
+      present_match_ = other.present_match_;
+      break;
+    default:
+      matcher_ = std::move(other.matcher_);
+  }
+}
+
+HeaderMatcher& HeaderMatcher::operator=(HeaderMatcher&& other) noexcept {
+  name_ = std::move(other.name_);
+  type_ = other.type_;
+  invert_match_ = other.invert_match_;
+  switch (type_) {
+    case Type::RANGE:
+      range_start_ = other.range_start_;
+      range_end_ = other.range_end_;
+      break;
+    case Type::PRESENT:
+      present_match_ = other.present_match_;
+      break;
+    default:
+      matcher_ = std::move(other.matcher_);
+  }
+  return *this;
+}
+
+bool HeaderMatcher::operator==(const HeaderMatcher& other) const {
+  if (name_ != other.name_) return false;
+  if (type_ != other.type_) return false;
+  if (invert_match_ != other.invert_match_) return false;
+  switch (type_) {
+    case Type::RANGE:
+      return range_start_ == other.range_start_ &&
+             range_end_ == other.range_end_;
+    case Type::PRESENT:
+      return present_match_ == other.present_match_;
+    default:
+      return matcher_ == other.matcher_;
+  }
+}
+
+bool HeaderMatcher::Match(
+    const absl::optional<absl::string_view>& value) const {
+  bool match;
+  if (type_ == Type::PRESENT) {
+    match = value.has_value() == present_match_;
+  } else if (!value.has_value()) {
+    // All other types fail to match if field is not present.
+    match = false;
+  } else if (type_ == Type::RANGE) {
+    int64_t int_value;
+    match = absl::SimpleAtoi(value.value(), &int_value) &&
+            int_value >= range_start_ && int_value < range_end_;
+  } else {
+    match = matcher_.Match(value.value());
+  }
+  return match != invert_match_;
+}
+
+std::string HeaderMatcher::ToString() const {
+  switch (type_) {
+    case Type::RANGE:
+      return absl::StrFormat("HeaderMatcher{%s %srange=[%d, %d]}", name_,
+                             invert_match_ ? "not " : "", range_start_,
+                             range_end_);
+    case Type::PRESENT:
+      return absl::StrFormat("HeaderMatcher{%s %spresent=%s}", name_,
+                             invert_match_ ? "not " : "",
+                             present_match_ ? "true" : "false");
+    case Type::EXACT:
+    case Type::PREFIX:
+    case Type::SUFFIX:
+    case Type::SAFE_REGEX:
+    case Type::CONTAINS:
+      return absl::StrFormat("HeaderMatcher{%s %s%s}", name_,
+                             invert_match_ ? "not " : "", matcher_.ToString());
+    default:
+      return "";
+  }
+}
+
+}  // namespace grpc_core