grpc 1.42.0 → 1.45.0

data/src/core/lib/resource_quota/trace.h

@@ -0,0 +1,24 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_RESOURCE_QUOTA_TRACE_H
+#define GRPC_CORE_LIB_RESOURCE_QUOTA_TRACE_H
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/debug/trace.h"
+
+extern grpc_core::TraceFlag grpc_resource_quota_trace;
+
+#endif  // GRPC_CORE_LIB_RESOURCE_QUOTA_TRACE_H

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -22,7 +22,7 @@
 #include "src/core/lib/address_utils/sockaddr_utils.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/security/credentials/tls/tls_utils.h"
-#include "src/core/lib/slice/slice_utils.h"
+#include "src/core/lib/slice/slice_internal.h"
 
 namespace grpc_core {
 
@@ -71,6 +71,8 @@ EvaluateArgs::PerChannelArgs::PerChannelArgs(grpc_auth_context* auth_context,
     dns_sans = GetAuthPropertyArray(auth_context, GRPC_PEER_DNS_PROPERTY_NAME);
     common_name =
         GetAuthPropertyValue(auth_context, GRPC_X509_CN_PROPERTY_NAME);
+    subject =
+        GetAuthPropertyValue(auth_context, GRPC_X509_SUBJECT_PROPERTY_NAME);
   }
   if (endpoint != nullptr) {
     local_address = ParseEndpointUri(grpc_endpoint_get_local_address(endpoint));
@@ -79,50 +81,33 @@ EvaluateArgs::PerChannelArgs::PerChannelArgs(grpc_auth_context* auth_context,
 }
 
 absl::string_view EvaluateArgs::GetPath() const {
-  absl::string_view path;
-  if (metadata_ != nullptr &&
-      metadata_->legacy_index()->named.path != nullptr) {
-    grpc_linked_mdelem* elem = metadata_->legacy_index()->named.path;
-    const grpc_slice& val = GRPC_MDVALUE(elem->md);
-    path = StringViewFromSlice(val);
+  if (metadata_ != nullptr) {
+    const auto* path = metadata_->get_pointer(HttpPathMetadata());
+    if (path != nullptr) {
+      return path->as_string_view();
+    }
   }
-  return path;
+  return absl::string_view();
 }
 
-absl::string_view EvaluateArgs::GetHost() const {
-  absl::string_view host;
-  if (metadata_ != nullptr &&
-      metadata_->legacy_index()->named.host != nullptr) {
-    grpc_linked_mdelem* elem = metadata_->legacy_index()->named.host;
-    const grpc_slice& val = GRPC_MDVALUE(elem->md);
-    host = StringViewFromSlice(val);
+absl::string_view EvaluateArgs::GetAuthority() const {
+  absl::string_view authority;
+  if (metadata_ != nullptr) {
+    if (auto* authority_md = metadata_->get_pointer(HttpAuthorityMetadata())) {
+      authority = authority_md->as_string_view();
+    }
   }
-  return host;
+  return authority;
 }
 
 absl::string_view EvaluateArgs::GetMethod() const {
-  absl::string_view method;
-  if (metadata_ != nullptr &&
-      metadata_->legacy_index()->named.method != nullptr) {
-    grpc_linked_mdelem* elem = metadata_->legacy_index()->named.method;
-    const grpc_slice& val = GRPC_MDVALUE(elem->md);
-    method = StringViewFromSlice(val);
+  if (metadata_ != nullptr) {
+    auto method_md = metadata_->get(HttpMethodMetadata());
+    if (method_md.has_value()) {
+      return HttpMethodMetadata::Encode(*method_md).as_string_view();
+    }
   }
-  return method;
-}
-
-std::multimap<absl::string_view, absl::string_view> EvaluateArgs::GetHeaders()
-    const {
-  std::multimap<absl::string_view, absl::string_view> headers;
-  if (metadata_ == nullptr) {
-    return headers;
-  }
-  metadata_->ForEach([&](grpc_mdelem md) {
-    const grpc_slice& key = GRPC_MDKEY(md);
-    const grpc_slice& val = GRPC_MDVALUE(md);
-    headers.emplace(StringViewFromSlice(key), StringViewFromSlice(val));
-  });
-  return headers;
+  return absl::string_view();
 }
 
 absl::optional<absl::string_view> EvaluateArgs::GetHeaderValue(
@@ -130,7 +115,14 @@ absl::optional<absl::string_view> EvaluateArgs::GetHeaderValue(
   if (metadata_ == nullptr) {
     return absl::nullopt;
   }
-  return metadata_->GetValue(key, concatenated_value);
+  if (absl::EqualsIgnoreCase(key, "te")) {
+    return absl::nullopt;
+  }
+  if (absl::EqualsIgnoreCase(key, "host")) {
+    // Maps legacy host header to :authority.
+    return GetAuthority();
+  }
+  return metadata_->GetStringValue(key, concatenated_value);
 }
 
 grpc_resolved_address EvaluateArgs::GetLocalAddress() const {
@@ -210,4 +202,11 @@ absl::string_view EvaluateArgs::GetCommonName() const {
   return channel_args_->common_name;
 }
 
+absl::string_view EvaluateArgs::GetSubject() const {
+  if (channel_args_ == nullptr) {
+    return "";
+  }
+  return channel_args_->subject;
+}
+
 }  // namespace grpc_core

data/src/core/lib/security/authorization/evaluate_args.h

@@ -48,6 +48,7 @@ class EvaluateArgs {
     std::vector<absl::string_view> uri_sans;
     std::vector<absl::string_view> dns_sans;
     absl::string_view common_name;
+    absl::string_view subject;
     Address local_address;
     Address peer_address;
   };
@@ -56,9 +57,8 @@ class EvaluateArgs {
       : metadata_(metadata), channel_args_(channel_args) {}
 
   absl::string_view GetPath() const;
-  absl::string_view GetHost() const;
+  absl::string_view GetAuthority() const;
   absl::string_view GetMethod() const;
-  std::multimap<absl::string_view, absl::string_view> GetHeaders() const;
   // Returns metadata value(s) for the specified key.
   // If the key is not present in the batch, returns absl::nullopt.
   // If the key is present exactly once in the batch, returns a string_view of
@@ -80,6 +80,7 @@ class EvaluateArgs {
   std::vector<absl::string_view> GetUriSans() const;
   std::vector<absl::string_view> GetDnsSans() const;
   absl::string_view GetCommonName() const;
+  absl::string_view GetSubject() const;
 
  private:
   grpc_metadata_batch* metadata_;

data/src/core/lib/security/authorization/grpc_authorization_engine.cc

@@ -0,0 +1,60 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/grpc_authorization_engine.h"
+
+namespace grpc_core {
+
+GrpcAuthorizationEngine::GrpcAuthorizationEngine(Rbac policy)
+    : action_(policy.action) {
+  for (auto& sub_policy : policy.policies) {
+    Policy policy;
+    policy.name = sub_policy.first;
+    policy.matcher = absl::make_unique<PolicyAuthorizationMatcher>(
+        std::move(sub_policy.second));
+    policies_.push_back(std::move(policy));
+  }
+}
+
+GrpcAuthorizationEngine::GrpcAuthorizationEngine(
+    GrpcAuthorizationEngine&& other) noexcept
+    : action_(other.action_), policies_(std::move(other.policies_)) {}
+
+GrpcAuthorizationEngine& GrpcAuthorizationEngine::operator=(
+    GrpcAuthorizationEngine&& other) noexcept {
+  action_ = other.action_;
+  policies_ = std::move(other.policies_);
+  return *this;
+}
+
+AuthorizationEngine::Decision GrpcAuthorizationEngine::Evaluate(
+    const EvaluateArgs& args) const {
+  Decision decision;
+  bool matches = false;
+  for (const auto& policy : policies_) {
+    if (policy.matcher->Matches(args)) {
+      matches = true;
+      decision.matching_policy_name = policy.name;
+      break;
+    }
+  }
+  decision.type = (matches == (action_ == Rbac::Action::kAllow))
+                      ? Decision::Type::kAllow
+                      : Decision::Type::kDeny;
+  return decision;
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/authorization/grpc_authorization_engine.h

@@ -0,0 +1,62 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_AUTHORIZATION_ENGINE_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_AUTHORIZATION_ENGINE_H
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/authorization_engine.h"
+#include "src/core/lib/security/authorization/matchers.h"
+#include "src/core/lib/security/authorization/rbac_policy.h"
+
+namespace grpc_core {
+
+// GrpcAuthorizationEngine can be either an Allow engine or Deny engine. This
+// engine makes authorization decisions to Allow or Deny incoming RPC request
+// based on permission and principal configs in the provided RBAC policy and the
+// engine type. This engine ignores condition field in RBAC config. It is the
+// caller's responsibility to provide RBAC policies that are compatible with
+// this engine.
+class GrpcAuthorizationEngine : public AuthorizationEngine {
+ public:
+  // Builds GrpcAuthorizationEngine without any policies.
+  explicit GrpcAuthorizationEngine(Rbac::Action action) : action_(action) {}
+  // Builds GrpcAuthorizationEngine with allow/deny RBAC policy.
+  explicit GrpcAuthorizationEngine(Rbac policy);
+
+  GrpcAuthorizationEngine(GrpcAuthorizationEngine&& other) noexcept;
+  GrpcAuthorizationEngine& operator=(GrpcAuthorizationEngine&& other) noexcept;
+
+  Rbac::Action action() const { return action_; }
+
+  // Required only for testing purpose.
+  size_t num_policies() const { return policies_.size(); }
+
+  // Evaluates incoming request against RBAC policy and makes a decision to
+  // whether allow/deny this request.
+  Decision Evaluate(const EvaluateArgs& args) const override;
+
+ private:
+  struct Policy {
+    std::string name;
+    std::unique_ptr<AuthorizationMatcher> matcher;
+  };
+  Rbac::Action action_;
+  std::vector<Policy> policies_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_AUTHORIZATION_ENGINE_H

data/src/core/lib/security/authorization/grpc_server_authz_filter.cc

@@ -0,0 +1,109 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/grpc_server_authz_filter.h"
+
+#include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/security/authorization/evaluate_args.h"
+#include "src/core/lib/transport/transport.h"
+
+namespace grpc_core {
+
+TraceFlag grpc_authz_trace(false, "grpc_authz_api");
+
+GrpcServerAuthzFilter::GrpcServerAuthzFilter(
+    RefCountedPtr<grpc_auth_context> auth_context, grpc_endpoint* endpoint,
+    RefCountedPtr<grpc_authorization_policy_provider> provider)
+    : auth_context_(std::move(auth_context)),
+      per_channel_evaluate_args_(auth_context_.get(), endpoint),
+      provider_(std::move(provider)) {}
+
+absl::StatusOr<GrpcServerAuthzFilter> GrpcServerAuthzFilter::Create(
+    const grpc_channel_args* args, ChannelFilter::Args) {
+  grpc_auth_context* auth_context = grpc_find_auth_context_in_args(args);
+  grpc_authorization_policy_provider* provider =
+      grpc_channel_args_find_pointer<grpc_authorization_policy_provider>(
+          args, GRPC_ARG_AUTHORIZATION_POLICY_PROVIDER);
+  if (provider == nullptr) {
+    return absl::InvalidArgumentError("Failed to get authorization provider.");
+  }
+  // grpc_endpoint isn't needed because the current gRPC authorization policy
+  // does not support any rules that requires looking for source or destination
+  // addresses.
+  return GrpcServerAuthzFilter(
+      auth_context != nullptr ? auth_context->Ref() : nullptr,
+      /*endpoint=*/nullptr, provider->Ref());
+}
+
+bool GrpcServerAuthzFilter::IsAuthorized(
+    const ClientInitialMetadata& initial_metadata) {
+  EvaluateArgs args(initial_metadata.get(), &per_channel_evaluate_args_);
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_authz_trace)) {
+    gpr_log(GPR_DEBUG,
+            "checking request: url_path=%s, transport_security_type=%s, "
+            "uri_sans=[%s], dns_sans=[%s], subject=%s",
+            std::string(args.GetPath()).c_str(),
+            std::string(args.GetTransportSecurityType()).c_str(),
+            absl::StrJoin(args.GetUriSans(), ",").c_str(),
+            absl::StrJoin(args.GetDnsSans(), ",").c_str(),
+            std::string(args.GetSubject()).c_str());
+  }
+  grpc_authorization_policy_provider::AuthorizationEngines engines =
+      provider_->engines();
+  if (engines.deny_engine != nullptr) {
+    AuthorizationEngine::Decision decision =
+        engines.deny_engine->Evaluate(args);
+    if (decision.type == AuthorizationEngine::Decision::Type::kDeny) {
+      if (GRPC_TRACE_FLAG_ENABLED(grpc_authz_trace)) {
+        gpr_log(GPR_INFO, "chand=%p: request denied by policy %s.", this,
+                decision.matching_policy_name.c_str());
+      }
+      return false;
+    }
+  }
+  if (engines.allow_engine != nullptr) {
+    AuthorizationEngine::Decision decision =
+        engines.allow_engine->Evaluate(args);
+    if (decision.type == AuthorizationEngine::Decision::Type::kAllow) {
+      if (GRPC_TRACE_FLAG_ENABLED(grpc_authz_trace)) {
+        gpr_log(GPR_DEBUG, "chand=%p: request allowed by policy %s.", this,
+                decision.matching_policy_name.c_str());
+      }
+      return true;
+    }
+  }
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_authz_trace)) {
+    gpr_log(GPR_INFO, "chand=%p: request denied, no matching policy found.",
+            this);
+  }
+  return false;
+}
+
+ArenaPromise<TrailingMetadata> GrpcServerAuthzFilter::MakeCallPromise(
+    ClientInitialMetadata initial_metadata,
+    NextPromiseFactory next_promise_factory) {
+  if (!IsAuthorized(initial_metadata)) {
+    return ArenaPromise<TrailingMetadata>(Immediate(TrailingMetadata(
+        absl::PermissionDeniedError("Unauthorized RPC request rejected."))));
+  }
+  return next_promise_factory(std::move(initial_metadata));
+}
+
+const grpc_channel_filter GrpcServerAuthzFilter::kFilterVtable =
+    MakePromiseBasedFilter<GrpcServerAuthzFilter, FilterEndpoint::kServer>(
+        "grpc-server-authz");
+
+}  // namespace grpc_core

data/src/core/lib/security/authorization/grpc_server_authz_filter.h

@@ -0,0 +1,51 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_SERVER_AUTHZ_FILTER_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_SERVER_AUTHZ_FILTER_H
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/channel/channel_stack.h"
+#include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/security/authorization/authorization_policy_provider.h"
+
+namespace grpc_core {
+
+class GrpcServerAuthzFilter final : public ChannelFilter {
+ public:
+  static const grpc_channel_filter kFilterVtable;
+
+  static absl::StatusOr<GrpcServerAuthzFilter> Create(
+      const grpc_channel_args* args, ChannelFilter::Args);
+
+  ArenaPromise<TrailingMetadata> MakeCallPromise(
+      ClientInitialMetadata initial_metadata,
+      NextPromiseFactory next_promise_factory) override;
+
+ private:
+  GrpcServerAuthzFilter(
+      RefCountedPtr<grpc_auth_context> auth_context, grpc_endpoint* endpoint,
+      RefCountedPtr<grpc_authorization_policy_provider> provider);
+
+  bool IsAuthorized(const ClientInitialMetadata& initial_metadata);
+
+  RefCountedPtr<grpc_auth_context> auth_context_;
+  EvaluateArgs::PerChannelArgs per_channel_evaluate_args_;
+  RefCountedPtr<grpc_authorization_policy_provider> provider_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_GRPC_SERVER_AUTHZ_FILTER_H

data/src/core/lib/security/authorization/matchers.cc

@@ -0,0 +1,227 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/matchers.h"
+
+#include <grpc/grpc_security_constants.h>
+
+#include "src/core/lib/address_utils/parse_address.h"
+#include "src/core/lib/address_utils/sockaddr_utils.h"
+
+namespace grpc_core {
+
+std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
+    Rbac::Permission permission) {
+  switch (permission.type) {
+    case Rbac::Permission::RuleType::kAnd: {
+      std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
+      for (const auto& rule : permission.permissions) {
+        matchers.push_back(AuthorizationMatcher::Create(std::move(*rule)));
+      }
+      return absl::make_unique<AndAuthorizationMatcher>(std::move(matchers));
+    }
+    case Rbac::Permission::RuleType::kOr: {
+      std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
+      for (const auto& rule : permission.permissions) {
+        matchers.push_back(AuthorizationMatcher::Create(std::move(*rule)));
+      }
+      return absl::make_unique<OrAuthorizationMatcher>(std::move(matchers));
+    }
+    case Rbac::Permission::RuleType::kNot:
+      return absl::make_unique<NotAuthorizationMatcher>(
+          AuthorizationMatcher::Create(std::move(*permission.permissions[0])));
+    case Rbac::Permission::RuleType::kAny:
+      return absl::make_unique<AlwaysAuthorizationMatcher>();
+    case Rbac::Permission::RuleType::kHeader:
+      return absl::make_unique<HeaderAuthorizationMatcher>(
+          std::move(permission.header_matcher));
+    case Rbac::Permission::RuleType::kPath:
+      return absl::make_unique<PathAuthorizationMatcher>(
+          std::move(permission.string_matcher));
+    case Rbac::Permission::RuleType::kDestIp:
+      return absl::make_unique<IpAuthorizationMatcher>(
+          IpAuthorizationMatcher::Type::kDestIp, std::move(permission.ip));
+    case Rbac::Permission::RuleType::kDestPort:
+      return absl::make_unique<PortAuthorizationMatcher>(permission.port);
+    case Rbac::Permission::RuleType::kMetadata:
+      return absl::make_unique<MetadataAuthorizationMatcher>(permission.invert);
+    case Rbac::Permission::RuleType::kReqServerName:
+      return absl::make_unique<ReqServerNameAuthorizationMatcher>(
+          std::move(permission.string_matcher));
+  }
+  return nullptr;
+}
+
+std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
+    Rbac::Principal principal) {
+  switch (principal.type) {
+    case Rbac::Principal::RuleType::kAnd: {
+      std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
+      for (const auto& id : principal.principals) {
+        matchers.push_back(AuthorizationMatcher::Create(std::move(*id)));
+      }
+      return absl::make_unique<AndAuthorizationMatcher>(std::move(matchers));
+    }
+    case Rbac::Principal::RuleType::kOr: {
+      std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
+      for (const auto& id : principal.principals) {
+        matchers.push_back(AuthorizationMatcher::Create(std::move(*id)));
+      }
+      return absl::make_unique<OrAuthorizationMatcher>(std::move(matchers));
+    }
+    case Rbac::Principal::RuleType::kNot:
+      return absl::make_unique<NotAuthorizationMatcher>(
+          AuthorizationMatcher::Create(std::move(*principal.principals[0])));
+    case Rbac::Principal::RuleType::kAny:
+      return absl::make_unique<AlwaysAuthorizationMatcher>();
+    case Rbac::Principal::RuleType::kPrincipalName:
+      return absl::make_unique<AuthenticatedAuthorizationMatcher>(
+          std::move(principal.string_matcher));
+    case Rbac::Principal::RuleType::kSourceIp:
+      return absl::make_unique<IpAuthorizationMatcher>(
+          IpAuthorizationMatcher::Type::kSourceIp, std::move(principal.ip));
+    case Rbac::Principal::RuleType::kDirectRemoteIp:
+      return absl::make_unique<IpAuthorizationMatcher>(
+          IpAuthorizationMatcher::Type::kDirectRemoteIp,
+          std::move(principal.ip));
+    case Rbac::Principal::RuleType::kRemoteIp:
+      return absl::make_unique<IpAuthorizationMatcher>(
+          IpAuthorizationMatcher::Type::kRemoteIp, std::move(principal.ip));
+    case Rbac::Principal::RuleType::kHeader:
+      return absl::make_unique<HeaderAuthorizationMatcher>(
+          std::move(principal.header_matcher));
+    case Rbac::Principal::RuleType::kPath:
+      return absl::make_unique<PathAuthorizationMatcher>(
+          std::move(principal.string_matcher.value()));
+    case Rbac::Principal::RuleType::kMetadata:
+      return absl::make_unique<MetadataAuthorizationMatcher>(principal.invert);
+  }
+  return nullptr;
+}
+
+bool AndAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
+  for (const auto& matcher : matchers_) {
+    if (!matcher->Matches(args)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+bool OrAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
+  for (const auto& matcher : matchers_) {
+    if (matcher->Matches(args)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+bool NotAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
+  return !matcher_->Matches(args);
+}
+
+bool HeaderAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
+  std::string concatenated_value;
+  return matcher_.Match(
+      args.GetHeaderValue(matcher_.name(), &concatenated_value));
+}
+
+IpAuthorizationMatcher::IpAuthorizationMatcher(Type type, Rbac::CidrRange range)
+    : type_(type), prefix_len_(range.prefix_len) {
+  grpc_error_handle error =
+      grpc_string_to_sockaddr(&subnet_address_, range.address_prefix.c_str(),
+                              /*port does not matter here*/ 0);
+  if (error == GRPC_ERROR_NONE) {
+    grpc_sockaddr_mask_bits(&subnet_address_, prefix_len_);
+  } else {
+    gpr_log(GPR_DEBUG, "CidrRange address %s is not IPv4/IPv6. Error: %s",
+            range.address_prefix.c_str(), grpc_error_std_string(error).c_str());
+  }
+  GRPC_ERROR_UNREF(error);
+}
+
+bool IpAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
+  grpc_resolved_address address;
+  switch (type_) {
+    case Type::kDestIp: {
+      address = args.GetLocalAddress();
+      break;
+    }
+    case Type::kSourceIp:
+    case Type::kDirectRemoteIp:
+    case Type::kRemoteIp: {
+      address = args.GetPeerAddress();
+      break;
+    }
+    default:
+      return false;
+  }
+  return grpc_sockaddr_match_subnet(&address, &subnet_address_, prefix_len_);
+}
+
+bool PortAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
+  return port_ == args.GetLocalPort();
+}
+
+bool AuthenticatedAuthorizationMatcher::Matches(
+    const EvaluateArgs& args) const {
+  if (args.GetTransportSecurityType() != GRPC_SSL_TRANSPORT_SECURITY_TYPE &&
+      args.GetTransportSecurityType() != GRPC_TLS_TRANSPORT_SECURITY_TYPE) {
+    // Connection is not authenticated.
+    return false;
+  }
+  if (!matcher_.has_value()) {
+    // Allows any authenticated user.
+    return true;
+  }
+  std::vector<absl::string_view> uri_sans = args.GetUriSans();
+  if (!uri_sans.empty()) {
+    for (const auto& uri : uri_sans) {
+      if (matcher_->Match(uri)) {
+        return true;
+      }
+    }
+  }
+  std::vector<absl::string_view> dns_sans = args.GetDnsSans();
+  if (!dns_sans.empty()) {
+    for (const auto& dns : dns_sans) {
+      if (matcher_->Match(dns)) {
+        return true;
+      }
+    }
+  }
+  return matcher_->Match(args.GetSubject());
+}
+
+bool ReqServerNameAuthorizationMatcher::Matches(const EvaluateArgs&) const {
+  // Currently we only support matching against an empty string.
+  return matcher_.Match("");
+}
+
+bool PathAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
+  absl::string_view path = args.GetPath();
+  if (!path.empty()) {
+    return matcher_.Match(path);
+  }
+  return false;
+}
+
+bool PolicyAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
+  return permissions_->Matches(args) && principals_->Matches(args);
+}
+
+}  // namespace grpc_core