grpc 1.46.3-x86_64-linux → 1.48.0-x86_64-linux

data/src/core/lib/resource_quota/memory_quota.cc

@@ -16,8 +16,18 @@
 
 #include "src/core/lib/resource_quota/memory_quota.h"
 
+#include <inttypes.h>
+
+#include <algorithm>
 #include <atomic>
+#include <tuple>
+#include <type_traits>
+
+#include "absl/status/status.h"
+#include "absl/strings/str_cat.h"
+#include "absl/utility/utility.h"
 
+#include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/mpscq.h"
 #include "src/core/lib/promise/exec_ctx_wakeup_scheduler.h"
@@ -25,7 +35,6 @@
 #include "src/core/lib/promise/map.h"
 #include "src/core/lib/promise/race.h"
 #include "src/core/lib/promise/seq.h"
-#include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/lib/resource_quota/trace.h"
 
 namespace grpc_core {
@@ -156,7 +165,7 @@ GrpcMemoryAllocatorImpl::GrpcMemoryAllocatorImpl(
 GrpcMemoryAllocatorImpl::~GrpcMemoryAllocatorImpl() {
   GPR_ASSERT(free_bytes_.load(std::memory_order_acquire) +
                  sizeof(GrpcMemoryAllocatorImpl) ==
-             taken_bytes_);
+             taken_bytes_.load(std::memory_order_relaxed));
   memory_quota_->Return(taken_bytes_);
 }
 
@@ -165,7 +174,7 @@ void GrpcMemoryAllocatorImpl::Shutdown() {
   OrphanablePtr<ReclaimerQueue::Handle>
       reclamation_handles[kNumReclamationPasses];
   {
-    MutexLock lock(&memory_quota_mu_);
+    MutexLock lock(&reclaimer_mu_);
     GPR_ASSERT(!shutdown_);
     shutdown_ = true;
     memory_quota = memory_quota_;
@@ -183,7 +192,9 @@ size_t GrpcMemoryAllocatorImpl::Reserve(MemoryRequest request) {
   while (true) {
     // Attempt to reserve memory from our pool.
     auto reservation = TryReserve(request);
-    if (reservation.has_value()) return *reservation;
+    if (reservation.has_value()) {
+      return *reservation;
+    }
     // If that failed, grab more from the quota and retry.
     Replenish();
   }
@@ -196,16 +207,11 @@ absl::optional<size_t> GrpcMemoryAllocatorImpl::TryReserve(
   // Scale the request down according to memory pressure if we have that
   // flexibility.
   if (scaled_size_over_min != 0) {
-    double pressure;
-    size_t max_recommended_allocation_size;
-    {
-      MutexLock lock(&memory_quota_mu_);
-      const auto pressure_and_max_recommended_allocation_size =
-          memory_quota_->InstantaneousPressureAndMaxRecommendedAllocationSize();
-      pressure = pressure_and_max_recommended_allocation_size.first;
-      max_recommended_allocation_size =
-          pressure_and_max_recommended_allocation_size.second;
-    }
+    const auto pressure_and_max_recommended_allocation_size =
+        memory_quota_->InstantaneousPressureAndMaxRecommendedAllocationSize();
+    double pressure = pressure_and_max_recommended_allocation_size.first;
+    size_t max_recommended_allocation_size =
+        pressure_and_max_recommended_allocation_size.second;
     // Reduce allocation size proportional to the pressure > 80% usage.
     if (pressure > 0.8) {
       scaled_size_over_min =
@@ -241,30 +247,47 @@ absl::optional<size_t> GrpcMemoryAllocatorImpl::TryReserve(
   }
 }
 
+void GrpcMemoryAllocatorImpl::MaybeDonateBack() {
+  size_t free = free_bytes_.load(std::memory_order_relaxed);
+  const size_t kReduceToSize = kMaxQuotaBufferSize / 2;
+  while (true) {
+    if (free <= kReduceToSize) return;
+    size_t ret = free - kReduceToSize;
+    if (free_bytes_.compare_exchange_weak(free, kReduceToSize,
+                                          std::memory_order_acq_rel,
+                                          std::memory_order_acquire)) {
+      if (GRPC_TRACE_FLAG_ENABLED(grpc_resource_quota_trace)) {
+        gpr_log(GPR_INFO, "[%p|%s] Early return %" PRIdPTR " bytes", this,
+                name_.c_str(), ret);
+      }
+      GPR_ASSERT(taken_bytes_.fetch_sub(ret, std::memory_order_relaxed) >= ret);
+      memory_quota_->Return(ret);
+      return;
+    }
+  }
+}
+
 void GrpcMemoryAllocatorImpl::Replenish() {
-  MutexLock lock(&memory_quota_mu_);
-  GPR_ASSERT(!shutdown_);
   // Attempt a fairly low rate exponential growth request size, bounded between
   // some reasonable limits declared at top of file.
-  auto amount = Clamp(taken_bytes_ / 3, kMinReplenishBytes, kMaxReplenishBytes);
+  auto amount = Clamp(taken_bytes_.load(std::memory_order_relaxed) / 3,
+                      kMinReplenishBytes, kMaxReplenishBytes);
   // Take the requested amount from the quota.
   memory_quota_->Take(amount);
   // Record that we've taken it.
-  taken_bytes_ += amount;
+  taken_bytes_.fetch_add(amount, std::memory_order_relaxed);
   // Add the taken amount to the free pool.
   free_bytes_.fetch_add(amount, std::memory_order_acq_rel);
   // See if we can add ourselves as a reclaimer.
-  MaybeRegisterReclaimerLocked();
+  MaybeRegisterReclaimer();
 }
 
 void GrpcMemoryAllocatorImpl::MaybeRegisterReclaimer() {
-  MutexLock lock(&memory_quota_mu_);
-  MaybeRegisterReclaimerLocked();
-}
-
-void GrpcMemoryAllocatorImpl::MaybeRegisterReclaimerLocked() {
   // If the reclaimer is already registered, then there's nothing to do.
-  if (registered_reclaimer_) return;
+  if (registered_reclaimer_.exchange(true, std::memory_order_relaxed)) {
+    return;
+  }
+  MutexLock lock(&reclaimer_mu_);
   if (shutdown_) return;
   // Grab references to the things we'll need
   auto self = shared_from_this();
@@ -275,49 +298,17 @@ void GrpcMemoryAllocatorImpl::MaybeRegisterReclaimerLocked() {
     auto self = self_weak.lock();
     if (self == nullptr) return;
     auto* p = static_cast<GrpcMemoryAllocatorImpl*>(self.get());
-    MutexLock lock(&p->memory_quota_mu_);
-    p->registered_reclaimer_ = false;
+    p->registered_reclaimer_.store(false, std::memory_order_relaxed);
     // Figure out how many bytes we can return to the quota.
     size_t return_bytes = p->free_bytes_.exchange(0, std::memory_order_acq_rel);
     if (return_bytes == 0) return;
     // Subtract that from our outstanding balance.
-    p->taken_bytes_ -= return_bytes;
+    p->taken_bytes_.fetch_sub(return_bytes);
     // And return them to the quota.
     p->memory_quota_->Return(return_bytes);
   });
 }
 
-void GrpcMemoryAllocatorImpl::Rebind(
-    std::shared_ptr<BasicMemoryQuota> memory_quota) {
-  MutexLock lock(&memory_quota_mu_);
-  GPR_ASSERT(!shutdown_);
-  if (memory_quota_ == memory_quota) return;
-  // Return memory to the original memory quota.
-  memory_quota_->Return(taken_bytes_);
-  // Reassign any queued reclaimers
-  for (size_t i = 0; i < kNumReclamationPasses; i++) {
-    if (reclamation_handles_[i] != nullptr) {
-      reclamation_handles_[i]->Requeue(memory_quota->reclaimer_queue(i));
-    }
-  }
-  // Switch to the new memory quota, leaving the old one in memory_quota so that
-  // when we unref it, we are outside of lock.
-  memory_quota_.swap(memory_quota);
-  // Drop our freed memory down to zero, to avoid needing to ask the new
-  // quota for memory we're not currently using.
-  taken_bytes_ -= free_bytes_.exchange(0, std::memory_order_acq_rel);
-  // And let the new quota know how much we're already using.
-  memory_quota_->Take(taken_bytes_);
-}
-
-//
-// MemoryOwner
-//
-
-void MemoryOwner::Rebind(MemoryQuota* quota) {
-  impl()->Rebind(quota->memory_quota_);
-}
-
 //
 // BasicMemoryQuota
 //
@@ -376,8 +367,12 @@ void BasicMemoryQuota::Start() {
           std::tuple<const char*, RefCountedPtr<ReclaimerQueue::Handle>> arg) {
         auto reclaimer = std::move(std::get<1>(arg));
         if (GRPC_TRACE_FLAG_ENABLED(grpc_resource_quota_trace)) {
-          gpr_log(GPR_INFO, "RQ: %s perform %s reclamation",
-                  self->name_.c_str(), std::get<0>(arg));
+          double free = std::max(intptr_t(0), self->free_bytes_.load());
+          size_t quota_size = self->quota_size_.load();
+          gpr_log(GPR_INFO,
+                  "RQ: %s perform %s reclamation. Available free bytes: %f, "
+                  "total quota_size: %zu",
+                  self->name_.c_str(), std::get<0>(arg), free, quota_size);
         }
         // One of the reclaimer queues gave us a way to get back memory.
         // Call the reclaimer with a token that contains enough to wake us
@@ -436,7 +431,12 @@ void BasicMemoryQuota::FinishReclamation(uint64_t token, Waker waker) {
                                                    std::memory_order_relaxed,
                                                    std::memory_order_relaxed)) {
     if (GRPC_TRACE_FLAG_ENABLED(grpc_resource_quota_trace)) {
-      gpr_log(GPR_INFO, "RQ: %s reclamation complete", name_.c_str());
+      double free = std::max(intptr_t(0), free_bytes_.load());
+      size_t quota_size = quota_size_.load();
+      gpr_log(GPR_INFO,
+              "RQ: %s reclamation complete. Available free bytes: %f, "
+              "total quota_size: %zu",
+              name_.c_str(), free, quota_size);
     }
     waker.Wakeup();
   }

data/src/core/lib/resource_quota/memory_quota.h

@@ -17,18 +17,25 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <algorithm>
+#include <stdint.h>
+
 #include <atomic>
 #include <cstddef>
 #include <limits>
 #include <memory>
-#include <queue>
-#include <vector>
+#include <string>
+#include <utility>
+
+#include "absl/base/thread_annotations.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
 
 #include <grpc/event_engine/memory_allocator.h>
-#include <grpc/slice.h>
+#include <grpc/event_engine/memory_request.h>
+#include <grpc/support/log.h>
 
 #include "src/core/lib/gprpp/orphanable.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/promise/activity.h"
 #include "src/core/lib/promise/poll.h"
@@ -73,6 +80,7 @@ enum class ReclamationPass {
   kDestructive = 3,
 };
 static constexpr size_t kNumReclamationPasses = 4;
+static constexpr size_t kMaxQuotaBufferSize = 1024 * 1024;
 
 // For each reclamation function run we construct a ReclamationSweep.
 // When this object is finally destroyed (it may be moved several times first),
@@ -280,11 +288,6 @@ class GrpcMemoryAllocatorImpl final : public EventEngineMemoryAllocatorImpl {
       std::shared_ptr<BasicMemoryQuota> memory_quota, std::string name);
   ~GrpcMemoryAllocatorImpl() override;
 
-  // Rebind - Swaps the underlying quota for this allocator, taking care to
-  // make sure memory allocated is moved to allocations against the new quota.
-  void Rebind(std::shared_ptr<BasicMemoryQuota> memory_quota)
-      ABSL_LOCKS_EXCLUDED(memory_quota_mu_);
-
   // Reserve bytes from the quota.
   // If we enter overcommit, reclamation will begin concurrently.
   // Returns the number of bytes reserved.
@@ -295,14 +298,19 @@ class GrpcMemoryAllocatorImpl final : public EventEngineMemoryAllocatorImpl {
     // Add the released memory to our free bytes counter... if this increases
     // from  0 to non-zero, then we have more to do, otherwise, we're actually
     // done.
-    if (free_bytes_.fetch_add(n, std::memory_order_release) != 0) return;
+    size_t prev_free = free_bytes_.fetch_add(n, std::memory_order_release);
+    if (prev_free + n > kMaxQuotaBufferSize) {
+      // Try to immediately return some free'ed memory back to the total quota.
+      MaybeDonateBack();
+    }
+    if (prev_free != 0) return;
     MaybeRegisterReclaimer();
   }
 
   // Post a reclamation function.
   template <typename F>
   void PostReclaimer(ReclamationPass pass, F fn) {
-    MutexLock lock(&memory_quota_mu_);
+    MutexLock lock(&reclaimer_mu_);
     GPR_ASSERT(!shutdown_);
     InsertReclaimer(static_cast<size_t>(pass), std::move(fn));
   }
@@ -312,7 +320,6 @@ class GrpcMemoryAllocatorImpl final : public EventEngineMemoryAllocatorImpl {
 
   // Read the instantaneous memory pressure
   double InstantaneousPressure() const {
-    MutexLock lock(&memory_quota_mu_);
     return memory_quota_->InstantaneousPressureAndMaxRecommendedAllocationSize()
         .first;
   }
@@ -323,41 +330,42 @@ class GrpcMemoryAllocatorImpl final : public EventEngineMemoryAllocatorImpl {
  private:
   // Primitive reservation function.
   absl::optional<size_t> TryReserve(MemoryRequest request) GRPC_MUST_USE_RESULT;
+  // This function may be invoked during a memory release operation. If the
+  // total free_bytes in this allocator/local cache exceeds
+  // kMaxQuotaBufferSize / 2, donate the excess free_bytes in this cache back
+  // to the total quota immediately. This helps prevent free bytes in any
+  // particular allocator from growing too large.
+  void MaybeDonateBack();
   // Replenish bytes from the quota, without blocking, possibly entering
   // overcommit.
-  void Replenish() ABSL_LOCKS_EXCLUDED(memory_quota_mu_);
+  void Replenish();
   // If we have not already, register a reclamation function against the quota
   // to sweep any free memory back to that quota.
-  void MaybeRegisterReclaimer() ABSL_LOCKS_EXCLUDED(memory_quota_mu_);
-  void MaybeRegisterReclaimerLocked()
-      ABSL_EXCLUSIVE_LOCKS_REQUIRED(memory_quota_mu_);
+  void MaybeRegisterReclaimer() ABSL_LOCKS_EXCLUDED(reclaimer_mu_);
   template <typename F>
   void InsertReclaimer(size_t pass, F fn)
-      ABSL_EXCLUSIVE_LOCKS_REQUIRED(memory_quota_mu_) {
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(reclaimer_mu_) {
     reclamation_handles_[pass] =
         memory_quota_->reclaimer_queue(pass)->Insert(std::move(fn));
   }
 
+  // Backing resource quota.
+  const std::shared_ptr<BasicMemoryQuota> memory_quota_;
   // Amount of memory this allocator has cached for its own use: to avoid quota
   // contention, each MemoryAllocator can keep some memory in addition to what
   // it is immediately using, and the quota can pull it back under memory
   // pressure.
   std::atomic<size_t> free_bytes_{0};
-  // Mutex guarding the backing resource quota.
-  mutable Mutex memory_quota_mu_;
-  // Backing resource quota.
-  std::shared_ptr<BasicMemoryQuota> memory_quota_
-      ABSL_GUARDED_BY(memory_quota_mu_);
   // Amount of memory taken from the quota by this allocator.
-  size_t taken_bytes_ ABSL_GUARDED_BY(memory_quota_mu_) =
-      sizeof(GrpcMemoryAllocatorImpl);
-  bool shutdown_ ABSL_GUARDED_BY(memory_quota_mu_) = false;
-  bool registered_reclaimer_ ABSL_GUARDED_BY(memory_quota_mu_) = false;
+  std::atomic<size_t> taken_bytes_{sizeof(GrpcMemoryAllocatorImpl)};
+  std::atomic<bool> registered_reclaimer_{false};
+  Mutex reclaimer_mu_;
+  bool shutdown_ ABSL_GUARDED_BY(reclaimer_mu_) = false;
   // Indices into the various reclaimer queues, used so that we can cancel
   // reclamation should we shutdown or get rebound.
   OrphanablePtr<ReclaimerQueue::Handle>
       reclamation_handles_[kNumReclamationPasses] ABSL_GUARDED_BY(
-          memory_quota_mu_);
+          reclaimer_mu_);
   // Name of this allocator.
   std::string name_;
 };
@@ -383,9 +391,6 @@ class MemoryOwner final : public MemoryAllocator {
     impl()->PostReclaimer(pass, std::move(fn));
   }
 
-  // Rebind to a different quota.
-  void Rebind(MemoryQuota* quota);
-
   // Instantaneous memory pressure in the underlying quota.
   double InstantaneousPressure() const {
     return impl()->InstantaneousPressure();

data/src/core/lib/resource_quota/resource_quota.h

@@ -17,16 +17,24 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <string>
+#include <utility>
+
+#include "absl/strings/string_view.h"
+
 #include <grpc/impl/codegen/grpc_types.h>
 
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/cpp_impl_of.h"
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/lib/resource_quota/thread_quota.h"
 
 namespace grpc_core {
 
 class ResourceQuota;
+
 using ResourceQuotaRefPtr = RefCountedPtr<ResourceQuota>;
 
 class ResourceQuota : public RefCounted<ResourceQuota>,

data/src/core/lib/resource_quota/thread_quota.cc

@@ -16,6 +16,8 @@
 
 #include "src/core/lib/resource_quota/thread_quota.h"
 
+#include <grpc/support/log.h>
+
 namespace grpc_core {
 
 ThreadQuota::ThreadQuota() = default;

data/src/core/lib/resource_quota/thread_quota.h

@@ -18,8 +18,12 @@
 #include <grpc/support/port_platform.h>
 
 #include <cstddef>
+#include <limits>
+
+#include "absl/base/thread_annotations.h"
 
 #include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/sync.h"
 
 namespace grpc_core {

data/src/core/lib/security/authorization/authorization_policy_provider.h

@@ -17,7 +17,14 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "absl/strings/string_view.h"
+
+#include <grpc/grpc_security.h>
+#include <grpc/impl/codegen/grpc_types.h>
+
+#include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/dual_ref_counted.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/authorization/authorization_engine.h"
 
 struct grpc_authorization_policy_provider

data/src/core/lib/security/authorization/authorization_policy_provider_vtable.cc

@@ -15,7 +15,11 @@
 #include <grpc/support/port_platform.h>
 
 #include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/impl/codegen/grpc_types.h>
 
+#include "src/core/lib/gpr/useful.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/authorization/authorization_policy_provider.h"
 
 namespace {

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -16,13 +16,19 @@
 
 #include "src/core/lib/security/authorization/evaluate_args.h"
 
+#include "absl/status/statusor.h"
+#include "absl/strings/match.h"
 #include "absl/strings/numbers.h"
 
+#include <grpc/grpc_security_constants.h>
+#include <grpc/support/log.h>
+
 #include "src/core/lib/address_utils/parse_address.h"
-#include "src/core/lib/address_utils/sockaddr_utils.h"
 #include "src/core/lib/gprpp/host_port.h"
+#include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/security/credentials/tls/tls_utils.h"
-#include "src/core/lib/slice/slice_internal.h"
+#include "src/core/lib/slice/slice.h"
+#include "src/core/lib/uri/uri_parser.h"
 
 namespace grpc_core {
 
@@ -50,7 +56,7 @@ EvaluateArgs::PerChannelArgs::Address ParseEndpointUri(
   address.address_str = std::string(host_view);
   grpc_error_handle error = grpc_string_to_sockaddr(
       &address.address, address.address_str.c_str(), address.port);
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     gpr_log(GPR_DEBUG, "Address %s is not IPv4/IPv6. Error: %s",
             address.address_str.c_str(), grpc_error_std_string(error).c_str());
   }

data/src/core/lib/security/authorization/evaluate_args.h

@@ -17,13 +17,16 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <map>
+#include <string>
+#include <vector>
 
+#include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
+#include <grpc/grpc_security.h>
+
 #include "src/core/lib/iomgr/endpoint.h"
-#include "src/core/lib/iomgr/resolve_address.h"
-#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/iomgr/resolved_address.h"
 #include "src/core/lib/transport/metadata_batch.h"
 
 namespace grpc_core {

data/src/core/lib/security/authorization/grpc_authorization_engine.cc

@@ -16,6 +16,12 @@
 
 #include "src/core/lib/security/authorization/grpc_authorization_engine.h"
 
+#include <algorithm>
+#include <map>
+#include <utility>
+
+#include "absl/memory/memory.h"
+
 namespace grpc_core {
 
 GrpcAuthorizationEngine::GrpcAuthorizationEngine(Rbac policy)

data/src/core/lib/security/authorization/grpc_authorization_engine.h

@@ -17,7 +17,14 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <stddef.h>
+
+#include <memory>
+#include <string>
+#include <vector>
+
 #include "src/core/lib/security/authorization/authorization_engine.h"
+#include "src/core/lib/security/authorization/evaluate_args.h"
 #include "src/core/lib/security/authorization/matchers.h"
 #include "src/core/lib/security/authorization/rbac_policy.h"
 

data/src/core/lib/security/authorization/grpc_server_authz_filter.cc

@@ -16,7 +16,22 @@
 
 #include "src/core/lib/security/authorization/grpc_server_authz_filter.h"
 
+#include <functional>
+#include <string>
+#include <utility>
+
+#include "absl/status/status.h"
+#include "absl/strings/str_join.h"
+#include "absl/strings/string_view.h"
+
+#include <grpc/support/log.h>
+
+#include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/debug/trace.h"
+#include "src/core/lib/promise/poll.h"
+#include "src/core/lib/promise/promise.h"
+#include "src/core/lib/security/authorization/authorization_engine.h"
 #include "src/core/lib/security/authorization/evaluate_args.h"
 #include "src/core/lib/transport/transport.h"
 

data/src/core/lib/security/authorization/grpc_server_authz_filter.h

@@ -17,9 +17,20 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/channel/channel_stack.h"
+#include "absl/status/statusor.h"
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/endpoint.h"
+#include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/authorization/authorization_policy_provider.h"
+#include "src/core/lib/security/authorization/evaluate_args.h"
+#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/transport/transport.h"
 
 namespace grpc_core {
 

data/src/core/lib/security/authorization/matchers.cc

@@ -16,10 +16,18 @@
 
 #include "src/core/lib/security/authorization/matchers.h"
 
+#include <algorithm>
+#include <string>
+
+#include "absl/memory/memory.h"
+#include "absl/strings/string_view.h"
+
 #include <grpc/grpc_security_constants.h>
+#include <grpc/support/log.h>
 
 #include "src/core/lib/address_utils/parse_address.h"
 #include "src/core/lib/address_utils/sockaddr_utils.h"
+#include "src/core/lib/iomgr/error.h"
 
 namespace grpc_core {
 
@@ -145,7 +153,7 @@ IpAuthorizationMatcher::IpAuthorizationMatcher(Type type, Rbac::CidrRange range)
   grpc_error_handle error =
       grpc_string_to_sockaddr(&subnet_address_, range.address_prefix.c_str(),
                               /*port does not matter here*/ 0);
-  if (error == GRPC_ERROR_NONE) {
+  if (GRPC_ERROR_IS_NONE(error)) {
     grpc_sockaddr_mask_bits(&subnet_address_, prefix_len_);
   } else {
     gpr_log(GPR_DEBUG, "CidrRange address %s is not IPv4/IPv6. Error: %s",

data/src/core/lib/security/authorization/matchers.h

@@ -17,8 +17,15 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <stdint.h>
+
 #include <memory>
+#include <utility>
+#include <vector>
+
+#include "absl/types/optional.h"
 
+#include "src/core/lib/iomgr/resolved_address.h"
 #include "src/core/lib/matchers/matchers.h"
 #include "src/core/lib/security/authorization/evaluate_args.h"
 #include "src/core/lib/security/authorization/rbac_policy.h"

data/src/core/lib/security/authorization/rbac_policy.cc

@@ -16,6 +16,11 @@
 
 #include "src/core/lib/security/authorization/rbac_policy.h"
 
+#include <algorithm>
+#include <type_traits>
+#include <utility>
+
+#include "absl/memory/memory.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 

data/src/core/lib/security/authorization/rbac_policy.h

@@ -17,7 +17,14 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <stdint.h>
+
+#include <map>
 #include <memory>
+#include <string>
+#include <vector>
+
+#include "absl/types/optional.h"
 
 #include "src/core/lib/matchers/matchers.h"
 

data/src/core/lib/security/context/security_context.cc

@@ -22,16 +22,19 @@
 
 #include <string.h>
 
+#include <algorithm>
+
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/gpr/string.h"
-#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/channel/context.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/resource_quota/arena.h"
+#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/surface/call.h"