grpc 1.39.0 → 1.41.0

data/src/core/lib/iomgr/work_serializer.cc

@@ -45,7 +45,7 @@ class WorkSerializer::WorkSerializerImpl : public Orphanable {
 
   // An initial size of 1 keeps track of whether the work serializer has been
   // orphaned.
-  Atomic<size_t> size_{1};
+  std::atomic<size_t> size_{1};
   MultiProducerSingleConsumerQueue queue_;
 };
 
@@ -55,7 +55,7 @@ void WorkSerializer::WorkSerializerImpl::Run(
     gpr_log(GPR_INFO, "WorkSerializer::Run() %p Scheduling callback [%s:%d]",
             this, location.file(), location.line());
   }
-  const size_t prev_size = size_.FetchAdd(1);
+  const size_t prev_size = size_.fetch_add(1);
   // The work serializer should not have been orphaned.
   GPR_DEBUG_ASSERT(prev_size > 0);
   if (prev_size == 1) {
@@ -83,7 +83,7 @@ void WorkSerializer::WorkSerializerImpl::Orphan() {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_work_serializer_trace)) {
     gpr_log(GPR_INFO, "WorkSerializer::Orphan() %p", this);
   }
-  size_t prev_size = size_.FetchSub(1);
+  size_t prev_size = size_.fetch_sub(1);
   if (prev_size == 1) {
     if (GRPC_TRACE_FLAG_ENABLED(grpc_work_serializer_trace)) {
       gpr_log(GPR_INFO, "  Destroying");
@@ -101,7 +101,7 @@ void WorkSerializer::WorkSerializerImpl::DrainQueue() {
     if (GRPC_TRACE_FLAG_ENABLED(grpc_work_serializer_trace)) {
       gpr_log(GPR_INFO, "WorkSerializer::DrainQueue() %p", this);
     }
-    size_t prev_size = size_.FetchSub(1);
+    size_t prev_size = size_.fetch_sub(1);
     GPR_DEBUG_ASSERT(prev_size >= 1);
     // It is possible that while draining the queue, one of the callbacks ended
     // up orphaning the work serializer. In that case, delete the object.

data/src/core/lib/iomgr/work_serializer.h

@@ -18,12 +18,12 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <atomic>
 #include <functional>
 
 #include "absl/synchronization/mutex.h"
 
 #include "src/core/lib/debug/trace.h"
-#include "src/core/lib/gprpp/atomic.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/mpscq.h"
 #include "src/core/lib/gprpp/orphanable.h"

data/src/core/lib/json/json_reader.cc

@@ -180,10 +180,9 @@ Json* JsonReader::CreateAndLinkValue() {
         if (errors_.size() == GRPC_JSON_MAX_ERRORS) {
           truncated_errors_ = true;
         } else {
-          errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          errors_.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
               absl::StrFormat("duplicate key \"%s\" at index %" PRIuPTR, key_,
-                              CurrentIndex())
-                  .c_str()));
+                              CurrentIndex())));
         }
       }
       value = &(*parent->mutable_object())[std::move(key_)];
@@ -201,10 +200,9 @@ bool JsonReader::StartContainer(Json::Type type) {
     if (errors_.size() == GRPC_JSON_MAX_ERRORS) {
       truncated_errors_ = true;
     } else {
-      errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+      errors_.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
           absl::StrFormat("exceeded max stack depth (%d) at index %" PRIuPTR,
-                          GRPC_JSON_MAX_DEPTH, CurrentIndex())
-              .c_str()));
+                          GRPC_JSON_MAX_DEPTH, CurrentIndex())));
     }
     return false;
   }
@@ -279,10 +277,8 @@ JsonReader::Status JsonReader::Run() {
       case GRPC_JSON_READ_CHAR_EOF:
         if (IsComplete()) {
           return Status::GRPC_JSON_DONE;
-        } else {
-          return Status::GRPC_JSON_PARSE_ERROR;
         }
-        break;
+        return Status::GRPC_JSON_PARSE_ERROR;
 
       /* Processing whitespaces. */
       case ' ':
@@ -341,14 +337,12 @@ JsonReader::Status JsonReader::Run() {
             } else if (c == '}' &&
                        stack_.back()->type() != Json::Type::OBJECT) {
               return Status::GRPC_JSON_PARSE_ERROR;
-              return Status::GRPC_JSON_PARSE_ERROR;
             } else if (c == ']' && stack_.back()->type() != Json::Type::ARRAY) {
               return Status::GRPC_JSON_PARSE_ERROR;
             }
             if (!SetNumber()) return Status::GRPC_JSON_PARSE_ERROR;
             state_ = State::GRPC_JSON_STATE_VALUE_END;
-            /* The missing break here is intentional. */
-            /* fallthrough */
+            ABSL_FALLTHROUGH_INTENDED;
 
           case State::GRPC_JSON_STATE_VALUE_END:
           case State::GRPC_JSON_STATE_OBJECT_KEY_BEGIN:
@@ -830,14 +824,11 @@ grpc_error_handle JsonReader::Parse(absl::string_view input, Json* output) {
         "errors and try again to see additional errors"));
   }
   if (status == Status::GRPC_JSON_INTERNAL_ERROR) {
-    reader.errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("internal error in JSON parser at index ",
-                     reader.CurrentIndex())
-            .c_str()));
+    reader.errors_.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+        "internal error in JSON parser at index ", reader.CurrentIndex())));
   } else if (status == Status::GRPC_JSON_PARSE_ERROR) {
-    reader.errors_.push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("JSON parse error at index ", reader.CurrentIndex())
-            .c_str()));
+    reader.errors_.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("JSON parse error at index ", reader.CurrentIndex())));
   }
   if (!reader.errors_.empty()) {
     return GRPC_ERROR_CREATE_FROM_VECTOR("JSON parsing failed",

data/src/core/lib/json/json_util.h

@@ -46,14 +46,13 @@ inline bool ExtractJsonNumber(const Json& json, const std::string& field_name,
                               ErrorVectorType* error_list) {
   static_assert(std::is_integral<NumericType>::value, "Integral required");
   if (json.type() != Json::Type::NUMBER) {
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("field:", field_name, " error:type should be NUMBER")
-            .c_str()));
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("field:", field_name, " error:type should be NUMBER")));
     return false;
   }
   if (!absl::SimpleAtoi(json.string_value(), output)) {
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("field:", field_name, " error:failed to parse.").c_str()));
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("field:", field_name, " error:failed to parse.")));
     return false;
   }
   return true;
@@ -70,9 +69,8 @@ inline bool ExtractJsonBool(const Json& json, const std::string& field_name,
       *output = false;
       return true;
     default:
-      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("field:", field_name, " error:type should be BOOLEAN")
-              .c_str()));
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+          absl::StrCat("field:", field_name, " error:type should be BOOLEAN")));
       return false;
   }
 }
@@ -83,9 +81,8 @@ inline bool ExtractJsonString(const Json& json, const std::string& field_name,
                               ErrorVectorType* error_list) {
   if (json.type() != Json::Type::STRING) {
     *output = "";
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("field:", field_name, " error:type should be STRING")
-            .c_str()));
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("field:", field_name, " error:type should be STRING")));
     return false;
   }
   *output = json.string_value();
@@ -98,9 +95,8 @@ inline bool ExtractJsonArray(const Json& json, const std::string& field_name,
                              ErrorVectorType* error_list) {
   if (json.type() != Json::Type::ARRAY) {
     *output = nullptr;
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("field:", field_name, " error:type should be ARRAY")
-            .c_str()));
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("field:", field_name, " error:type should be ARRAY")));
     return false;
   }
   *output = &json.array_value();
@@ -113,9 +109,8 @@ inline bool ExtractJsonObject(const Json& json, const std::string& field_name,
                               ErrorVectorType* error_list) {
   if (json.type() != Json::Type::OBJECT) {
     *output = nullptr;
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("field:", field_name, " error:type should be OBJECT")
-            .c_str()));
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("field:", field_name, " error:type should be OBJECT")));
     return false;
   }
   *output = &json.object_value();
@@ -162,9 +157,8 @@ inline bool ParseJsonObjectField(const Json::Object& object,
   auto it = object.find(field_name);
   if (it == object.end()) {
     if (required) {
-      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("field:", field_name, " error:does not exist.")
-              .c_str()));
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+          absl::StrCat("field:", field_name, " error:does not exist.")));
     }
     return false;
   }
@@ -181,19 +175,17 @@ inline bool ParseJsonObjectFieldAsDuration(const Json::Object& object,
   auto it = object.find(field_name);
   if (it == object.end()) {
     if (required) {
-      error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-          absl::StrCat("field:", field_name, " error:does not exist.")
-              .c_str()));
+      error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+          absl::StrCat("field:", field_name, " error:does not exist.")));
     }
     return false;
   }
   if (!ParseDurationFromJson(it->second, output)) {
     *output = GRPC_MILLIS_INF_PAST;
-    error_list->push_back(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+    error_list->push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
         absl::StrCat("field:", field_name,
                      " error:type should be STRING of the form given by "
-                     "google.proto.Duration.")
-            .c_str()));
+                     "google.proto.Duration.")));
     return false;
   }
   return true;

data/src/core/lib/matchers/matchers.cc

@@ -32,14 +32,12 @@ absl::StatusOr<StringMatcher> StringMatcher::Create(Type type,
                                                     absl::string_view matcher,
                                                     bool case_sensitive) {
   if (type == Type::kSafeRegex) {
-    RE2::Options options;
-    options.set_case_sensitive(case_sensitive);
-    auto regex_matcher = absl::make_unique<RE2>(std::string(matcher), options);
+    auto regex_matcher = absl::make_unique<RE2>(std::string(matcher));
     if (!regex_matcher->ok()) {
       return absl::InvalidArgumentError(
           "Invalid regex string specified in matcher.");
     }
-    return StringMatcher(std::move(regex_matcher), case_sensitive);
+    return StringMatcher(std::move(regex_matcher));
   } else {
     return StringMatcher(type, matcher, case_sensitive);
   }
@@ -49,19 +47,13 @@ StringMatcher::StringMatcher(Type type, absl::string_view matcher,
                              bool case_sensitive)
     : type_(type), string_matcher_(matcher), case_sensitive_(case_sensitive) {}
 
-StringMatcher::StringMatcher(std::unique_ptr<RE2> regex_matcher,
-                             bool case_sensitive)
-    : type_(Type::kSafeRegex),
-      regex_matcher_(std::move(regex_matcher)),
-      case_sensitive_(case_sensitive) {}
+StringMatcher::StringMatcher(std::unique_ptr<RE2> regex_matcher)
+    : type_(Type::kSafeRegex), regex_matcher_(std::move(regex_matcher)) {}
 
 StringMatcher::StringMatcher(const StringMatcher& other)
     : type_(other.type_), case_sensitive_(other.case_sensitive_) {
   if (type_ == Type::kSafeRegex) {
-    RE2::Options options;
-    options.set_case_sensitive(other.case_sensitive_);
-    regex_matcher_ =
-        absl::make_unique<RE2>(other.regex_matcher_->pattern(), options);
+    regex_matcher_ = absl::make_unique<RE2>(other.regex_matcher_->pattern());
   } else {
     string_matcher_ = other.string_matcher_;
   }
@@ -70,10 +62,7 @@ StringMatcher::StringMatcher(const StringMatcher& other)
 StringMatcher& StringMatcher::operator=(const StringMatcher& other) {
   type_ = other.type_;
   if (type_ == Type::kSafeRegex) {
-    RE2::Options options;
-    options.set_case_sensitive(other.case_sensitive_);
-    regex_matcher_ =
-        absl::make_unique<RE2>(other.regex_matcher_->pattern(), options);
+    regex_matcher_ = absl::make_unique<RE2>(other.regex_matcher_->pattern());
   } else {
     string_matcher_ = other.string_matcher_;
   }
@@ -151,9 +140,8 @@ std::string StringMatcher::ToString() const {
       return absl::StrFormat("StringMatcher{contains=%s%s}", string_matcher_,
                              case_sensitive_ ? "" : ", case_sensitive=false");
     case Type::kSafeRegex:
-      return absl::StrFormat("StringMatcher{safe_regex=%s%s}",
-                             regex_matcher_->pattern(),
-                             case_sensitive_ ? "" : ", case_sensitive=false");
+      return absl::StrFormat("StringMatcher{safe_regex=%s}",
+                             regex_matcher_->pattern());
     default:
       return "";
   }

data/src/core/lib/matchers/matchers.h

@@ -23,7 +23,6 @@
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
-
 #include "re2/re2.h"
 
 namespace grpc_core {
@@ -39,6 +38,7 @@ class StringMatcher {
   };
 
   // Creates StringMatcher instance. Returns error status on failure.
+  // Note: case_sensitive is ignored for type kSafeRegex.
   static absl::StatusOr<StringMatcher> Create(Type type,
                                               absl::string_view matcher,
                                               bool case_sensitive = true);
@@ -66,7 +66,7 @@ class StringMatcher {
 
  private:
   StringMatcher(Type type, absl::string_view matcher, bool case_sensitive);
-  StringMatcher(std::unique_ptr<RE2> regex_matcher, bool case_sensitive);
+  explicit StringMatcher(std::unique_ptr<RE2> regex_matcher);
 
   Type type_ = Type::kExact;
   std::string string_matcher_;

data/src/core/lib/profiling/basic_timers.cc

@@ -22,15 +22,17 @@
 
 #ifdef GRPC_BASIC_PROFILER
 
-#include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
-#include <grpc/support/sync.h>
-#include <grpc/support/time.h>
 #include <inttypes.h>
 #include <pthread.h>
 #include <stdio.h>
 #include <string.h>
 
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/sync.h>
+#include <grpc/support/time.h>
+
+#include "src/core/lib/gpr/tls.h"
 #include "src/core/lib/gprpp/global_config.h"
 #include "src/core/lib/profiling/timers.h"
 
@@ -61,7 +63,7 @@ typedef struct gpr_timer_log_list {
   gpr_timer_log* tail;
 } gpr_timer_log_list;
 
-static __thread gpr_timer_log* g_thread_log;
+static GPR_THREAD_LOCAL(gpr_timer_log*) g_thread_log;
 static gpr_once g_once_init = GPR_ONCE_INIT;
 static FILE* output_file;
 static const char* output_filename_or_null = NULL;
@@ -71,7 +73,7 @@ static gpr_timer_log_list g_in_progress_logs;
 static gpr_timer_log_list g_done_logs;
 static int g_shutdown;
 static pthread_t g_writing_thread;
-static __thread int g_thread_id;
+static GPR_THREAD_LOCAL(int) g_thread_id;
 static int g_next_thread_id;
 static int g_writing_enabled = 1;
 

data/src/core/lib/profiling/stap_timers.cc

@@ -20,9 +20,9 @@
 
 #ifdef GRPC_STAP_PROFILER
 
-#include "src/core/lib/profiling/timers.h"
-
 #include <sys/sdt.h>
+
+#include "src/core/lib/profiling/timers.h"
 /* Generated from src/core/profiling/stap_probes.d */
 #include "src/core/lib/profiling/stap_probes.h"
 

data/src/core/lib/security/authorization/authorization_policy_provider.h

@@ -23,10 +23,11 @@
 struct grpc_authorization_policy_provider
     : public grpc_core::DualRefCounted<grpc_authorization_policy_provider> {
  public:
-  virtual grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine>
-  allow_engine() const = 0;
-  virtual grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine> deny_engine()
-      const = 0;
+  struct AuthorizationEngines {
+    grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine> allow_engine;
+    grpc_core::RefCountedPtr<grpc_core::AuthorizationEngine> deny_engine;
+  };
+  virtual AuthorizationEngines engines() const = 0;
 };
 
 #endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_POLICY_PROVIDER_H

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -16,6 +16,8 @@
 
 #include "src/core/lib/security/authorization/evaluate_args.h"
 
+#include "absl/strings/numbers.h"
+
 #include "src/core/lib/address_utils/parse_address.h"
 #include "src/core/lib/address_utils/sockaddr_utils.h"
 #include "src/core/lib/gprpp/host_port.h"

data/src/core/lib/security/authorization/sdk_server_authz_filter.cc

@@ -0,0 +1,159 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/sdk_server_authz_filter.h"
+
+#include "src/core/lib/security/authorization/evaluate_args.h"
+#include "src/core/lib/transport/transport.h"
+
+namespace grpc_core {
+
+TraceFlag grpc_sdk_authz_trace(false, "sdk_authz");
+
+SdkServerAuthzFilter::SdkServerAuthzFilter(
+    RefCountedPtr<grpc_auth_context> auth_context, grpc_endpoint* endpoint,
+    RefCountedPtr<grpc_authorization_policy_provider> provider)
+    : auth_context_(std::move(auth_context)),
+      per_channel_evaluate_args_(auth_context_.get(), endpoint),
+      provider_(std::move(provider)) {}
+
+grpc_error_handle SdkServerAuthzFilter::Init(grpc_channel_element* elem,
+                                             grpc_channel_element_args* args) {
+  GPR_ASSERT(!args->is_last);
+  grpc_auth_context* auth_context =
+      grpc_find_auth_context_in_args(args->channel_args);
+  grpc_authorization_policy_provider* provider =
+      grpc_channel_args_find_pointer<grpc_authorization_policy_provider>(
+          args->channel_args, GRPC_ARG_AUTHORIZATION_POLICY_PROVIDER);
+  if (provider == nullptr) {
+    return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "Failed to get authorization provider.");
+  }
+  // grpc_endpoint isn't needed because the current SDK authorization policy
+  // does not support any rules that requires looking for source or destination
+  // addresses.
+  new (elem->channel_data) SdkServerAuthzFilter(
+      auth_context != nullptr ? auth_context->Ref() : nullptr,
+      /*endpoint=*/nullptr, provider->Ref());
+  return GRPC_ERROR_NONE;
+}
+
+void SdkServerAuthzFilter::Destroy(grpc_channel_element* elem) {
+  auto* chand = static_cast<SdkServerAuthzFilter*>(elem->channel_data);
+  chand->~SdkServerAuthzFilter();
+}
+
+SdkServerAuthzFilter::CallData::CallData(grpc_call_element* elem) {
+  GRPC_CLOSURE_INIT(&recv_initial_metadata_ready_, RecvInitialMetadataReady,
+                    elem, grpc_schedule_on_exec_ctx);
+}
+
+void SdkServerAuthzFilter::CallData::StartTransportStreamOpBatch(
+    grpc_call_element* elem, grpc_transport_stream_op_batch* batch) {
+  auto* calld = static_cast<CallData*>(elem->call_data);
+  if (batch->recv_initial_metadata) {
+    // Inject our callback.
+    calld->recv_initial_metadata_batch_ =
+        batch->payload->recv_initial_metadata.recv_initial_metadata;
+    calld->original_recv_initial_metadata_ready_ =
+        batch->payload->recv_initial_metadata.recv_initial_metadata_ready;
+    batch->payload->recv_initial_metadata.recv_initial_metadata_ready =
+        &calld->recv_initial_metadata_ready_;
+  }
+  grpc_call_next_op(elem, batch);
+}
+
+grpc_error_handle SdkServerAuthzFilter::CallData::Init(
+    grpc_call_element* elem, const grpc_call_element_args*) {
+  new (elem->call_data) CallData(elem);
+  return GRPC_ERROR_NONE;
+}
+
+void SdkServerAuthzFilter::CallData::Destroy(
+    grpc_call_element* elem, const grpc_call_final_info* /*final_info*/,
+    grpc_closure* /*ignored*/) {
+  CallData* calld = static_cast<CallData*>(elem->call_data);
+  calld->~CallData();
+}
+
+bool SdkServerAuthzFilter::CallData::IsAuthorized(SdkServerAuthzFilter* chand) {
+  EvaluateArgs args(recv_initial_metadata_batch_,
+                    &chand->per_channel_evaluate_args_);
+  grpc_authorization_policy_provider::AuthorizationEngines engines =
+      chand->provider_->engines();
+  if (engines.deny_engine != nullptr) {
+    AuthorizationEngine::Decision decision =
+        engines.deny_engine->Evaluate(args);
+    if (decision.type == AuthorizationEngine::Decision::Type::kDeny) {
+      if (GRPC_TRACE_FLAG_ENABLED(grpc_sdk_authz_trace)) {
+        gpr_log(GPR_INFO, "chand=%p calld=%p: request denied by policy %s.",
+                chand, this, decision.matching_policy_name.c_str());
+      }
+      return false;
+    }
+  }
+  if (engines.allow_engine != nullptr) {
+    AuthorizationEngine::Decision decision =
+        engines.allow_engine->Evaluate(args);
+    if (decision.type == AuthorizationEngine::Decision::Type::kAllow) {
+      if (GRPC_TRACE_FLAG_ENABLED(grpc_sdk_authz_trace)) {
+        gpr_log(GPR_INFO, "chand=%p calld=%p: request allowed by policy %s.",
+                chand, this, decision.matching_policy_name.c_str());
+      }
+      return true;
+    }
+  }
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_sdk_authz_trace)) {
+    gpr_log(GPR_INFO,
+            "chand=%p calld=%p: request denied, no matching policy found.",
+            chand, this);
+  }
+  return false;
+}
+
+void SdkServerAuthzFilter::CallData::RecvInitialMetadataReady(
+    void* arg, grpc_error_handle error) {
+  grpc_call_element* elem = static_cast<grpc_call_element*>(arg);
+  auto* chand = static_cast<SdkServerAuthzFilter*>(elem->channel_data);
+  auto* calld = static_cast<CallData*>(elem->call_data);
+  if (error == GRPC_ERROR_NONE) {
+    if (!calld->IsAuthorized(chand)) {
+      error = grpc_error_set_int(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+                                     "Unauthorized RPC request rejected."),
+                                 GRPC_ERROR_INT_GRPC_STATUS,
+                                 GRPC_STATUS_PERMISSION_DENIED);
+    }
+  } else {
+    GRPC_ERROR_REF(error);
+  }
+  Closure::Run(DEBUG_LOCATION, calld->original_recv_initial_metadata_ready_,
+               error);
+}
+
+const grpc_channel_filter SdkServerAuthzFilter::kFilterVtable = {
+    SdkServerAuthzFilter::CallData::StartTransportStreamOpBatch,
+    grpc_channel_next_op,
+    sizeof(SdkServerAuthzFilter::CallData),
+    SdkServerAuthzFilter::CallData::Init,
+    grpc_call_stack_ignore_set_pollset_or_pollset_set,
+    SdkServerAuthzFilter::CallData::Destroy,
+    sizeof(SdkServerAuthzFilter),
+    SdkServerAuthzFilter::Init,
+    SdkServerAuthzFilter::Destroy,
+    grpc_channel_next_get_info,
+    "sdk-server-authz"};
+
+}  // namespace grpc_core

data/src/core/lib/security/authorization/sdk_server_authz_filter.h

@@ -0,0 +1,67 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_SDK_SERVER_AUTHZ_FILTER_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_SDK_SERVER_AUTHZ_FILTER_H
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/channel/channel_stack.h"
+#include "src/core/lib/security/authorization/authorization_policy_provider.h"
+
+namespace grpc_core {
+
+class SdkServerAuthzFilter {
+ public:
+  static const grpc_channel_filter kFilterVtable;
+
+ private:
+  class CallData {
+   public:
+    static void StartTransportStreamOpBatch(
+        grpc_call_element* elem, grpc_transport_stream_op_batch* batch);
+    static grpc_error_handle Init(grpc_call_element* elem,
+                                  const grpc_call_element_args*);
+    static void Destroy(grpc_call_element* elem,
+                        const grpc_call_final_info* /*final_info*/,
+                        grpc_closure* /*ignored*/);
+
+   private:
+    explicit CallData(grpc_call_element* elem);
+
+    bool IsAuthorized(SdkServerAuthzFilter* chand);
+
+    static void RecvInitialMetadataReady(void* arg, grpc_error_handle error);
+
+    grpc_metadata_batch* recv_initial_metadata_batch_;
+    grpc_closure* original_recv_initial_metadata_ready_;
+    grpc_closure recv_initial_metadata_ready_;
+  };
+
+  SdkServerAuthzFilter(
+      RefCountedPtr<grpc_auth_context> auth_context, grpc_endpoint* endpoint,
+      RefCountedPtr<grpc_authorization_policy_provider> provider);
+
+  static grpc_error_handle Init(grpc_channel_element* elem,
+                                grpc_channel_element_args* args);
+  static void Destroy(grpc_channel_element* elem);
+
+  RefCountedPtr<grpc_auth_context> auth_context_;
+  EvaluateArgs::PerChannelArgs per_channel_evaluate_args_;
+  RefCountedPtr<grpc_authorization_policy_provider> provider_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_SDK_SERVER_AUTHZ_FILTER_H

data/src/core/lib/security/context/security_context.cc

@@ -18,22 +18,23 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/lib/security/context/security_context.h"
+
 #include <string.h>
 
+#include <grpc/grpc_security.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/arena.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/surface/call.h"
 
-#include <grpc/grpc_security.h>
-#include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
-
 grpc_core::DebugOnlyTraceFlag grpc_trace_auth_context_refcount(
     false, "auth_context_refcount");
 

data/src/core/lib/security/credentials/alts/check_gcp_environment_linux.cc

@@ -20,12 +20,12 @@
 
 #ifdef GPR_LINUX
 
-#include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
+#include <string.h>
 
 #include <grpc/support/alloc.h>
 #include <grpc/support/sync.h>
 
-#include <string.h>
+#include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
 
 #define GRPC_ALTS_EXPECT_NAME_GOOGLE "Google"
 #define GRPC_ALTS_EXPECT_NAME_GCE "Google Compute Engine"