grpc 1.39.0.pre1 → 1.41.0.pre2

data/src/core/ext/xds/xds_api.h

@@ -27,26 +27,21 @@
 
 #include "absl/container/inlined_vector.h"
 #include "absl/types/optional.h"
+#include "envoy/admin/v3/config_dump.upb.h"
 #include "re2/re2.h"
-
 #include "upb/def.hpp"
 
 #include <grpc/slice_buffer.h>
 
-#include "envoy/admin/v3/config_dump.upb.h"
 #include "src/core/ext/filters/client_channel/server_address.h"
 #include "src/core/ext/xds/xds_bootstrap.h"
 #include "src/core/ext/xds/xds_client_stats.h"
 #include "src/core/ext/xds/xds_http_filters.h"
+#include "src/core/lib/channel/status_util.h"
 #include "src/core/lib/matchers/matchers.h"
 
 namespace grpc_core {
 
-// TODO(yashykt): Check to see if xDS security is enabled. This will be
-// removed once this feature is fully integration-tested and enabled by
-// default.
-bool XdsSecurityEnabled();
-
 class XdsClient;
 
 class XdsApi {
@@ -109,10 +104,34 @@ class XdsApi {
       bool operator==(const HashPolicy& other) const;
       std::string ToString() const;
     };
-
     Matchers matchers;
     std::vector<HashPolicy> hash_policies;
 
+    struct RetryPolicy {
+      internal::StatusCodeSet retry_on;
+      uint32_t num_retries;
+
+      struct RetryBackOff {
+        Duration base_interval;
+        Duration max_interval;
+
+        bool operator==(const RetryBackOff& other) const {
+          return base_interval == other.base_interval &&
+                 max_interval == other.max_interval;
+        }
+        std::string ToString() const;
+      };
+      RetryBackOff retry_back_off;
+
+      bool operator==(const RetryPolicy& other) const {
+        return (retry_on == other.retry_on &&
+                num_retries == other.num_retries &&
+                retry_back_off == other.retry_back_off);
+      }
+      std::string ToString() const;
+    };
+    absl::optional<RetryPolicy> retry_policy;
+
     // Action for this route.
     // TODO(roth): When we can use absl::variant<>, consider using that
     // here, to enforce the fact that only one of the two fields can be set.
@@ -139,6 +158,7 @@ class XdsApi {
 
     bool operator==(const Route& other) const {
       return matchers == other.matchers && cluster_name == other.cluster_name &&
+             retry_policy == other.retry_policy &&
              weighted_clusters == other.weighted_clusters &&
              max_stream_duration == other.max_stream_duration &&
              typed_per_filter_config == other.typed_per_filter_config;
@@ -168,22 +188,11 @@ class XdsApi {
   };
 
   struct CommonTlsContext {
-    struct CertificateValidationContext {
-      std::vector<StringMatcher> match_subject_alt_names;
-
-      bool operator==(const CertificateValidationContext& other) const {
-        return match_subject_alt_names == other.match_subject_alt_names;
-      }
-
-      std::string ToString() const;
-      bool Empty() const;
-    };
-
-    struct CertificateProviderInstance {
+    struct CertificateProviderPluginInstance {
       std::string instance_name;
       std::string certificate_name;
 
-      bool operator==(const CertificateProviderInstance& other) const {
+      bool operator==(const CertificateProviderPluginInstance& other) const {
         return instance_name == other.instance_name &&
                certificate_name == other.certificate_name;
       }
@@ -192,28 +201,28 @@ class XdsApi {
       bool Empty() const;
     };
 
-    struct CombinedCertificateValidationContext {
-      CertificateValidationContext default_validation_context;
-      CertificateProviderInstance
-          validation_context_certificate_provider_instance;
+    struct CertificateValidationContext {
+      CertificateProviderPluginInstance ca_certificate_provider_instance;
+      std::vector<StringMatcher> match_subject_alt_names;
 
-      bool operator==(const CombinedCertificateValidationContext& other) const {
-        return default_validation_context == other.default_validation_context &&
-               validation_context_certificate_provider_instance ==
-                   other.validation_context_certificate_provider_instance;
+      bool operator==(const CertificateValidationContext& other) const {
+        return ca_certificate_provider_instance ==
+                   other.ca_certificate_provider_instance &&
+               match_subject_alt_names == other.match_subject_alt_names;
       }
 
       std::string ToString() const;
       bool Empty() const;
     };
 
-    CertificateProviderInstance tls_certificate_certificate_provider_instance;
-    CombinedCertificateValidationContext combined_validation_context;
+    CertificateValidationContext certificate_validation_context;
+    CertificateProviderPluginInstance tls_certificate_provider_instance;
 
     bool operator==(const CommonTlsContext& other) const {
-      return tls_certificate_certificate_provider_instance ==
-                 other.tls_certificate_certificate_provider_instance &&
-             combined_validation_context == other.combined_validation_context;
+      return certificate_validation_context ==
+                 other.certificate_validation_context &&
+             tls_certificate_provider_instance ==
+                 other.tls_certificate_provider_instance;
     }
 
     std::string ToString() const;
@@ -628,7 +637,8 @@ class XdsApi {
     std::set<std::string> resource_names_failed;
   };
 
-  XdsApi(XdsClient* client, TraceFlag* tracer, const XdsBootstrap::Node* node);
+  XdsApi(XdsClient* client, TraceFlag* tracer, const XdsBootstrap::Node* node,
+         const CertificateProviderStore::PluginDefinitionMap* map);
 
   // Creates an ADS request.
   // Takes ownership of \a error.
@@ -669,6 +679,8 @@ class XdsApi {
   XdsClient* client_;
   TraceFlag* tracer_;
   const XdsBootstrap::Node* node_;  // Do not own.
+  const CertificateProviderStore::PluginDefinitionMap*
+      certificate_provider_definition_map_;  // Do not own.
   upb::SymbolTable symtab_;
   const std::string build_version_;
   const std::string user_agent_name_;

data/src/core/ext/xds/xds_bootstrap.cc

@@ -18,11 +18,11 @@
 
 #include "src/core/ext/xds/xds_bootstrap.h"
 
-#include <vector>
-
 #include <errno.h>
 #include <stdlib.h>
 
+#include <vector>
+
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
@@ -132,16 +132,14 @@ XdsBootstrap::XdsBootstrap(Json json, grpc_error_handle* error) {
           std::move(*it->second.mutable_string_value());
     }
   }
-  if (XdsSecurityEnabled()) {
-    it = json.mutable_object()->find("certificate_providers");
-    if (it != json.mutable_object()->end()) {
-      if (it->second.type() != Json::Type::OBJECT) {
-        error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-            "\"certificate_providers\" field is not an object"));
-      } else {
-        grpc_error_handle parse_error = ParseCertificateProviders(&it->second);
-        if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
-      }
+  it = json.mutable_object()->find("certificate_providers");
+  if (it != json.mutable_object()->end()) {
+    if (it->second.type() != Json::Type::OBJECT) {
+      error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "\"certificate_providers\" field is not an object"));
+    } else {
+      grpc_error_handle parse_error = ParseCertificateProviders(&it->second);
+      if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
     }
   }
   *error = GRPC_ERROR_CREATE_FROM_VECTOR("errors parsing xds bootstrap file",
@@ -153,8 +151,8 @@ grpc_error_handle XdsBootstrap::ParseXdsServerList(Json* json) {
   for (size_t i = 0; i < json->mutable_array()->size(); ++i) {
     Json& child = json->mutable_array()->at(i);
     if (child.type() != Json::Type::OBJECT) {
-      error_list.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("array element ", i, " is not an object").c_str()));
+      error_list.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+          absl::StrCat("array element ", i, " is not an object")));
     } else {
       grpc_error_handle parse_error = ParseXdsServer(&child, i);
       if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
@@ -201,15 +199,8 @@ grpc_error_handle XdsBootstrap::ParseXdsServer(Json* json, size_t idx) {
       if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
     }
   }
-  // Can't use GRPC_ERROR_CREATE_FROM_VECTOR() here, because the error
-  // string is not static in this case.
-  if (error_list.empty()) return GRPC_ERROR_NONE;
-  grpc_error_handle error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-      absl::StrCat("errors parsing index ", idx).c_str());
-  for (size_t i = 0; i < error_list.size(); ++i) {
-    error = grpc_error_add_child(error, error_list[i]);
-  }
-  return error;
+  return GRPC_ERROR_CREATE_FROM_VECTOR_AND_CPP_STRING(
+      absl::StrCat("errors parsing index ", idx), &error_list);
 }
 
 grpc_error_handle XdsBootstrap::ParseChannelCredsArray(Json* json,
@@ -218,8 +209,8 @@ grpc_error_handle XdsBootstrap::ParseChannelCredsArray(Json* json,
   for (size_t i = 0; i < json->mutable_array()->size(); ++i) {
     Json& child = json->mutable_array()->at(i);
     if (child.type() != Json::Type::OBJECT) {
-      error_list.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("array element ", i, " is not an object").c_str()));
+      error_list.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+          absl::StrCat("array element ", i, " is not an object")));
     } else {
       grpc_error_handle parse_error = ParseChannelCreds(&child, i, server);
       if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
@@ -261,22 +252,14 @@ grpc_error_handle XdsBootstrap::ParseChannelCreds(Json* json, size_t idx,
   if (server->channel_creds_type.empty() &&
       XdsChannelCredsRegistry::IsSupported(type)) {
     if (!XdsChannelCredsRegistry::IsValidConfig(type, config)) {
-      error_list.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("invalid config for channel creds type \"", type, "\"")
-              .c_str()));
+      error_list.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+          "invalid config for channel creds type \"", type, "\"")));
     }
     server->channel_creds_type = std::move(type);
     server->channel_creds_config = std::move(config);
   }
-  // Can't use GRPC_ERROR_CREATE_FROM_VECTOR() here, because the error
-  // string is not static in this case.
-  if (error_list.empty()) return GRPC_ERROR_NONE;
-  grpc_error_handle error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-      absl::StrCat("errors parsing index ", idx).c_str());
-  for (size_t i = 0; i < error_list.size(); ++i) {
-    error = grpc_error_add_child(error, error_list[i]);
-  }
-  return error;
+  return GRPC_ERROR_CREATE_FROM_VECTOR_AND_CPP_STRING(
+      absl::StrCat("errors parsing index ", idx), &error_list);
 }
 
 grpc_error_handle XdsBootstrap::ParseServerFeaturesArray(Json* json,
@@ -374,10 +357,8 @@ grpc_error_handle XdsBootstrap::ParseCertificateProviders(Json* json) {
   std::vector<grpc_error_handle> error_list;
   for (auto& certificate_provider : *(json->mutable_object())) {
     if (certificate_provider.second.type() != Json::Type::OBJECT) {
-      error_list.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("element \"", certificate_provider.first,
-                       "\" is not an object")
-              .c_str()));
+      error_list.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+          "element \"", certificate_provider.first, "\" is not an object")));
     } else {
       grpc_error_handle parse_error = ParseCertificateProvider(
           certificate_provider.first, &certificate_provider.second);
@@ -403,7 +384,10 @@ grpc_error_handle XdsBootstrap::ParseCertificateProvider(
     CertificateProviderFactory* factory =
         CertificateProviderRegistry::LookupCertificateProviderFactory(
             plugin_name);
-    if (factory != nullptr) {
+    if (factory == nullptr) {
+      error_list.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+          absl::StrCat("Unrecognized plugin name: ", plugin_name)));
+    } else {
       RefCountedPtr<CertificateProviderFactory::Config> config;
       it = certificate_provider_json->mutable_object()->find("config");
       if (it != certificate_provider_json->mutable_object()->end()) {
@@ -427,15 +411,9 @@ grpc_error_handle XdsBootstrap::ParseCertificateProvider(
           {instance_name, {std::move(plugin_name), std::move(config)}});
     }
   }
-  // Can't use GRPC_ERROR_CREATE_FROM_VECTOR() here, because the error
-  // string is not static in this case.
-  if (error_list.empty()) return GRPC_ERROR_NONE;
-  grpc_error_handle error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-      absl::StrCat("errors parsing element \"", instance_name, "\"").c_str());
-  for (size_t i = 0; i < error_list.size(); ++i) {
-    error = grpc_error_add_child(error, error_list[i]);
-  }
-  return error;
+  return GRPC_ERROR_CREATE_FROM_VECTOR_AND_CPP_STRING(
+      absl::StrCat("errors parsing element \"", instance_name, "\""),
+      &error_list);
 }
 
 std::string XdsBootstrap::ToString() const {

data/src/core/ext/xds/xds_client.cc

@@ -16,6 +16,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/ext/xds/xds_client.h"
+
 #include <inttypes.h>
 #include <limits.h>
 #include <string.h>
@@ -35,7 +37,6 @@
 #include "src/core/ext/xds/xds_api.h"
 #include "src/core/ext/xds/xds_bootstrap.h"
 #include "src/core/ext/xds/xds_channel_args.h"
-#include "src/core/ext/xds/xds_client.h"
 #include "src/core/ext/xds/xds_client_stats.h"
 #include "src/core/ext/xds/xds_http_filters.h"
 #include "src/core/lib/address_utils/sockaddr_utils.h"
@@ -193,11 +194,10 @@ class XdsClient::ChannelState::AdsCallState
         ABSL_EXCLUSIVE_LOCKS_REQUIRED(&XdsClient::mu_) {
       if (error == GRPC_ERROR_NONE && timer_pending_) {
         timer_pending_ = false;
-        grpc_error_handle watcher_error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-            absl::StrFormat(
+        grpc_error_handle watcher_error =
+            GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrFormat(
                 "timeout obtaining resource {type=%s name=%s} from xds server",
-                type_url_, name_)
-                .c_str());
+                type_url_, name_));
         watcher_error = grpc_error_set_int(
             watcher_error, GRPC_ERROR_INT_GRPC_STATUS, GRPC_STATUS_UNAVAILABLE);
         if (GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace)) {
@@ -263,18 +263,26 @@ class XdsClient::ChannelState::AdsCallState
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(&XdsClient::mu_);
 
   void AcceptLdsUpdateLocked(std::string version, grpc_millis update_time,
-                             XdsApi::LdsUpdateMap lds_update_map)
+                             XdsApi::LdsUpdateMap lds_update_map,
+                             const std::set<std::string>& resource_names_failed)
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(&XdsClient::mu_);
   void AcceptRdsUpdateLocked(std::string version, grpc_millis update_time,
                              XdsApi::RdsUpdateMap rds_update_map)
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(&XdsClient::mu_);
   void AcceptCdsUpdateLocked(std::string version, grpc_millis update_time,
-                             XdsApi::CdsUpdateMap cds_update_map)
+                             XdsApi::CdsUpdateMap cds_update_map,
+                             const std::set<std::string>& resource_names_failed)
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(&XdsClient::mu_);
   void AcceptEdsUpdateLocked(std::string version, grpc_millis update_time,
                              XdsApi::EdsUpdateMap eds_update_map)
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(&XdsClient::mu_);
 
+  template <typename StateMap>
+  void RejectAdsUpdateLocked(grpc_millis update_time,
+                             const XdsApi::AdsParseResult& result,
+                             StateMap* state_map)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&XdsClient::mu_);
+
   static void OnRequestSent(void* arg, grpc_error_handle error);
   void OnRequestSentLocked(grpc_error_handle error)
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(&XdsClient::mu_);
@@ -898,7 +906,8 @@ XdsApi::ResourceMetadata CreateResourceMetadataAcked(
 
 void XdsClient::ChannelState::AdsCallState::AcceptLdsUpdateLocked(
     std::string version, grpc_millis update_time,
-    XdsApi::LdsUpdateMap lds_update_map) {
+    XdsApi::LdsUpdateMap lds_update_map,
+    const std::set<std::string>& resource_names_failed) {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace)) {
     gpr_log(GPR_INFO,
             "[xds_client %p] LDS update received containing %" PRIuPTR
@@ -942,6 +951,21 @@ void XdsClient::ChannelState::AdsCallState::AcceptLdsUpdateLocked(
       p.first->OnListenerChanged(*listener_state.update);
     }
   }
+  // For invalid resources in the update, if they are already in the
+  // cache, pretend that they are present in the update, so that we
+  // don't incorrectly consider them deleted below.
+  for (const std::string& listener_name : resource_names_failed) {
+    auto it = xds_client()->listener_map_.find(listener_name);
+    if (it != xds_client()->listener_map_.end()) {
+      auto& resource = it->second.update;
+      if (!resource.has_value()) continue;
+      lds_update_map[listener_name];
+      if (!resource->http_connection_manager.route_config_name.empty()) {
+        rds_resource_names_seen.insert(
+            resource->http_connection_manager.route_config_name);
+      }
+    }
+  }
   // For any subscribed resource that is not present in the update,
   // remove it from the cache and notify watchers that it does not exist.
   for (const auto& p : lds_state.subscribed_resources) {
@@ -1024,7 +1048,8 @@ void XdsClient::ChannelState::AdsCallState::AcceptRdsUpdateLocked(
 
 void XdsClient::ChannelState::AdsCallState::AcceptCdsUpdateLocked(
     std::string version, grpc_millis update_time,
-    XdsApi::CdsUpdateMap cds_update_map) {
+    XdsApi::CdsUpdateMap cds_update_map,
+    const std::set<std::string>& resource_names_failed) {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace)) {
     gpr_log(GPR_INFO,
             "[xds_client %p] CDS update received containing %" PRIuPTR
@@ -1066,6 +1091,20 @@ void XdsClient::ChannelState::AdsCallState::AcceptCdsUpdateLocked(
       p.first->OnClusterChanged(cluster_state.update.value());
     }
   }
+  // For invalid resources in the update, if they are already in the
+  // cache, pretend that they are present in the update, so that we
+  // don't incorrectly consider them deleted below.
+  for (const std::string& cluster_name : resource_names_failed) {
+    auto it = xds_client()->cluster_map_.find(cluster_name);
+    if (it != xds_client()->cluster_map_.end()) {
+      auto& resource = it->second.update;
+      if (!resource.has_value()) continue;
+      cds_update_map[cluster_name];
+      eds_resource_names_seen.insert(resource->eds_service_name.empty()
+                                         ? cluster_name
+                                         : resource->eds_service_name);
+    }
+  }
   // For any subscribed resource that is not present in the update,
   // remove it from the cache and notify watchers that it does not exist.
   for (const auto& p : cds_state.subscribed_resources) {
@@ -1145,6 +1184,47 @@ void XdsClient::ChannelState::AdsCallState::AcceptEdsUpdateLocked(
   }
 }
 
+namespace {
+
+// Update resource_metadata for NACK.
+void UpdateResourceMetadataNacked(const std::string& version,
+                                  const std::string& details,
+                                  grpc_millis update_time,
+                                  XdsApi::ResourceMetadata* resource_metadata) {
+  resource_metadata->client_status = XdsApi::ResourceMetadata::NACKED;
+  resource_metadata->failed_version = version;
+  resource_metadata->failed_details = details;
+  resource_metadata->failed_update_time = update_time;
+}
+
+}  // namespace
+
+template <typename StateMap>
+void XdsClient::ChannelState::AdsCallState::RejectAdsUpdateLocked(
+    grpc_millis update_time, const XdsApi::AdsParseResult& result,
+    StateMap* state_map) {
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace)) {
+    gpr_log(GPR_INFO,
+            "[xds_client %p] %s update NACKed containing %" PRIuPTR
+            " invalid resources",
+            xds_client(), result.type_url.c_str(),
+            result.resource_names_failed.size());
+  }
+  std::string details = grpc_error_std_string(result.parse_error);
+  for (auto& name : result.resource_names_failed) {
+    auto it = state_map->find(name);
+    if (it == state_map->end()) continue;
+    auto& state = it->second;
+    // Notify watchers of error.
+    for (const auto& p : state.watchers) {
+      p.first->OnError(GRPC_ERROR_REF(result.parse_error));
+    }
+    // Update resource metadata for CSDS.
+    UpdateResourceMetadataNacked(result.version, details, update_time,
+                                 &state.meta);
+  }
+}
+
 void XdsClient::ChannelState::AdsCallState::OnRequestSent(
     void* arg, grpc_error_handle error) {
   AdsCallState* ads_calld = static_cast<AdsCallState*>(arg);
@@ -1221,40 +1301,57 @@ bool XdsClient::ChannelState::AdsCallState::OnResponseReceivedLocked() {
     // Update nonce.
     auto& state = state_map_[result.type_url];
     state.nonce = std::move(result.nonce);
-    // NACK or ACK the response.
+    // If we got an error, we'll NACK the update.
     if (result.parse_error != GRPC_ERROR_NONE) {
-      xds_client()->UpdateResourceMetadataWithFailedParseResultLocked(
-          update_time, result);
-      GRPC_ERROR_UNREF(state.error);
-      state.error = result.parse_error;
-      // NACK unacceptable update.
       gpr_log(GPR_ERROR,
               "[xds_client %p] ADS response invalid for resource type %s "
               "version %s, will NACK: nonce=%s error=%s",
               xds_client(), result.type_url.c_str(), result.version.c_str(),
               state.nonce.c_str(),
               grpc_error_std_string(result.parse_error).c_str());
-      SendMessageLocked(result.type_url);
-    } else {
-      seen_response_ = true;
-      // Accept the ADS response according to the type_url.
+      result.parse_error =
+          grpc_error_set_int(result.parse_error, GRPC_ERROR_INT_GRPC_STATUS,
+                             GRPC_STATUS_UNAVAILABLE);
+      GRPC_ERROR_UNREF(state.error);
+      state.error = result.parse_error;
       if (result.type_url == XdsApi::kLdsTypeUrl) {
-        AcceptLdsUpdateLocked(result.version, update_time,
-                              std::move(result.lds_update_map));
+        RejectAdsUpdateLocked(update_time, result,
+                              &xds_client()->listener_map_);
       } else if (result.type_url == XdsApi::kRdsTypeUrl) {
-        AcceptRdsUpdateLocked(result.version, update_time,
-                              std::move(result.rds_update_map));
+        RejectAdsUpdateLocked(update_time, result,
+                              &xds_client()->route_config_map_);
       } else if (result.type_url == XdsApi::kCdsTypeUrl) {
-        AcceptCdsUpdateLocked(result.version, update_time,
-                              std::move(result.cds_update_map));
+        RejectAdsUpdateLocked(update_time, result, &xds_client()->cluster_map_);
       } else if (result.type_url == XdsApi::kEdsTypeUrl) {
-        AcceptEdsUpdateLocked(result.version, update_time,
-                              std::move(result.eds_update_map));
+        RejectAdsUpdateLocked(update_time, result,
+                              &xds_client()->endpoint_map_);
       }
+    }
+    // Process any valid resources.
+    bool have_valid_resources = false;
+    if (result.type_url == XdsApi::kLdsTypeUrl) {
+      have_valid_resources = !result.lds_update_map.empty();
+      AcceptLdsUpdateLocked(result.version, update_time,
+                            std::move(result.lds_update_map),
+                            result.resource_names_failed);
+    } else if (result.type_url == XdsApi::kRdsTypeUrl) {
+      have_valid_resources = !result.rds_update_map.empty();
+      AcceptRdsUpdateLocked(result.version, update_time,
+                            std::move(result.rds_update_map));
+    } else if (result.type_url == XdsApi::kCdsTypeUrl) {
+      have_valid_resources = !result.cds_update_map.empty();
+      AcceptCdsUpdateLocked(result.version, update_time,
+                            std::move(result.cds_update_map),
+                            result.resource_names_failed);
+    } else if (result.type_url == XdsApi::kEdsTypeUrl) {
+      have_valid_resources = !result.eds_update_map.empty();
+      AcceptEdsUpdateLocked(result.version, update_time,
+                            std::move(result.eds_update_map));
+    }
+    if (have_valid_resources) {
+      seen_response_ = true;
       xds_client()->resource_version_map_[result.type_url] =
           std::move(result.version);
-      // ACK the update.
-      SendMessageLocked(result.type_url);
       // Start load reporting if needed.
       auto& lrs_call = chand()->lrs_calld_;
       if (lrs_call != nullptr) {
@@ -1262,6 +1359,8 @@ bool XdsClient::ChannelState::AdsCallState::OnResponseReceivedLocked() {
         if (lrs_calld != nullptr) lrs_calld->MaybeStartReportingLocked();
       }
     }
+    // Send ACK or NACK.
+    SendMessageLocked(result.type_url);
   }
   if (xds_client()->shutting_down_) return true;
   // Keep listening for updates.
@@ -1803,7 +1902,8 @@ XdsClient::XdsClient(std::unique_ptr<XdsBootstrap> bootstrap,
       interested_parties_(grpc_pollset_set_create()),
       certificate_provider_store_(MakeOrphanable<CertificateProviderStore>(
           bootstrap_->certificate_providers())),
-      api_(this, &grpc_xds_client_trace, bootstrap_->node()) {
+      api_(this, &grpc_xds_client_trace, bootstrap_->node(),
+           &bootstrap_->certificate_providers()) {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_xds_client_trace)) {
     gpr_log(GPR_INFO, "[xds_client %p] creating xds client", this);
   }
@@ -2252,44 +2352,6 @@ XdsApi::ClusterLoadReportMap XdsClient::BuildLoadReportSnapshotLocked(
   return snapshot_map;
 }
 
-void XdsClient::UpdateResourceMetadataWithFailedParseResultLocked(
-    grpc_millis update_time, const XdsApi::AdsParseResult& result) {
-  // ADS update is rejected and the resource names in the failed update is
-  // available.
-  std::string details = grpc_error_std_string(result.parse_error);
-  for (auto& name : result.resource_names_failed) {
-    XdsApi::ResourceMetadata* resource_metadata = nullptr;
-    if (result.type_url == XdsApi::kLdsTypeUrl) {
-      auto it = listener_map_.find(name);
-      if (it != listener_map_.end()) {
-        resource_metadata = &it->second.meta;
-      }
-    } else if (result.type_url == XdsApi::kRdsTypeUrl) {
-      auto it = route_config_map_.find(name);
-      if (route_config_map_.find(name) != route_config_map_.end()) {
-        resource_metadata = &it->second.meta;
-      }
-    } else if (result.type_url == XdsApi::kCdsTypeUrl) {
-      auto it = cluster_map_.find(name);
-      if (cluster_map_.find(name) != cluster_map_.end()) {
-        resource_metadata = &it->second.meta;
-      }
-    } else if (result.type_url == XdsApi::kEdsTypeUrl) {
-      auto it = endpoint_map_.find(name);
-      if (endpoint_map_.find(name) != endpoint_map_.end()) {
-        resource_metadata = &it->second.meta;
-      }
-    }
-    if (resource_metadata == nullptr) {
-      return;
-    }
-    resource_metadata->client_status = XdsApi::ResourceMetadata::NACKED;
-    resource_metadata->failed_version = result.version;
-    resource_metadata->failed_details = details;
-    resource_metadata->failed_update_time = update_time;
-  }
-}
-
 std::string XdsClient::DumpClientConfigBinary() {
   MutexLock lock(&mu_);
   XdsApi::ResourceTypeMetadataMap resource_type_metadata_map;

data/src/core/ext/xds/xds_client.h

@@ -324,10 +324,6 @@ class XdsClient : public DualRefCounted<XdsClient> {
       bool send_all_clusters, const std::set<std::string>& clusters)
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
 
-  void UpdateResourceMetadataWithFailedParseResultLocked(
-      grpc_millis update_time, const XdsApi::AdsParseResult& result)
-      ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
-
   std::unique_ptr<XdsBootstrap> bootstrap_;
   grpc_channel_args* args_;
   const grpc_millis request_timeout_;