grpc 1.50.0-x86_64-linux → 1.51.0-x86_64-linux

data/src/core/ext/xds/xds_common_types.cc

@@ -19,6 +19,7 @@
 #include "src/core/ext/xds/xds_common_types.h"
 
 #include <stddef.h>
+#include <stdint.h>
 
 #include <algorithm>
 #include <map>
@@ -34,23 +35,47 @@
 #include "envoy/type/matcher/v3/regex.upb.h"
 #include "envoy/type/matcher/v3/string.upb.h"
 #include "google/protobuf/any.upb.h"
+#include "google/protobuf/struct.upb.h"
+#include "google/protobuf/struct.upbdefs.h"
 #include "google/protobuf/wrappers.upb.h"
-#include "upb/upb.h"
+#include "upb/arena.h"
+#include "upb/json_encode.h"
+#include "upb/status.h"
+#include "upb/upb.hpp"
 #include "xds/type/v3/typed_struct.upb.h"
 
-#include "src/core/ext/xds/certificate_provider_store.h"
 #include "src/core/ext/xds/upb_utils.h"
 #include "src/core/ext/xds/xds_bootstrap_grpc.h"
 #include "src/core/ext/xds/xds_client.h"
 
 namespace grpc_core {
 
+//
+// ParseDuration()
+//
+
+Duration ParseDuration(const google_protobuf_Duration* proto_duration,
+                       ValidationErrors* errors) {
+  int64_t seconds = google_protobuf_Duration_seconds(proto_duration);
+  if (seconds < 0 || seconds > 315576000000) {
+    ValidationErrors::ScopedField field(errors, ".seconds");
+    errors->AddError("value must be in the range [0, 315576000000]");
+  }
+  int32_t nanos = google_protobuf_Duration_nanos(proto_duration);
+  if (nanos < 0 || nanos > 999999999) {
+    ValidationErrors::ScopedField field(errors, ".nanos");
+    errors->AddError("value must be in the range [0, 999999999]");
+  }
+  return Duration::FromSecondsAndNanoseconds(seconds, nanos);
+}
+
 //
 // CommonTlsContext::CertificateValidationContext
 //
 
 std::string CommonTlsContext::CertificateValidationContext::ToString() const {
   std::vector<std::string> contents;
+  contents.reserve(match_subject_alt_names.size());
   for (const auto& match : match_subject_alt_names) {
     contents.push_back(match.ToString());
   }
@@ -114,68 +139,70 @@ namespace {
 // same CertificateProviderPluginInstance struct since the fields are the same.
 // TODO(yashykt): Remove this once we stop supporting the old way of fetching
 // certificate provider instances.
-absl::StatusOr<CommonTlsContext::CertificateProviderPluginInstance>
+CommonTlsContext::CertificateProviderPluginInstance
 CertificateProviderInstanceParse(
     const XdsResourceType::DecodeContext& context,
     const envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CertificateProviderInstance*
-        certificate_provider_instance_proto) {
-  CommonTlsContext::CertificateProviderPluginInstance
-      certificate_provider_plugin_instance = {
-          UpbStringToStdString(
-              envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CertificateProviderInstance_instance_name(
-                  certificate_provider_instance_proto)),
-          UpbStringToStdString(
-              envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CertificateProviderInstance_certificate_name(
-                  certificate_provider_instance_proto))};
+        certificate_provider_instance_proto,
+    ValidationErrors* errors) {
+  CommonTlsContext::CertificateProviderPluginInstance cert_provider;
+  cert_provider.instance_name = UpbStringToStdString(
+      envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CertificateProviderInstance_instance_name(
+          certificate_provider_instance_proto));
   const auto& bootstrap =
       static_cast<const GrpcXdsBootstrap&>(context.client->bootstrap());
-  if (bootstrap.certificate_providers().find(
-          certificate_provider_plugin_instance.instance_name) ==
+  if (bootstrap.certificate_providers().find(cert_provider.instance_name) ==
       bootstrap.certificate_providers().end()) {
-    return absl::InvalidArgumentError(
-        absl::StrCat("Unrecognized certificate provider instance name: ",
-                     certificate_provider_plugin_instance.instance_name));
+    ValidationErrors::ScopedField field(errors, ".instance_name");
+    errors->AddError(
+        absl::StrCat("unrecognized certificate provider instance name: ",
+                     cert_provider.instance_name));
   }
-  return certificate_provider_plugin_instance;
+  cert_provider.certificate_name = UpbStringToStdString(
+      envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CertificateProviderInstance_certificate_name(
+          certificate_provider_instance_proto));
+  return cert_provider;
 }
 
-absl::StatusOr<CommonTlsContext::CertificateProviderPluginInstance>
+CommonTlsContext::CertificateProviderPluginInstance
 CertificateProviderPluginInstanceParse(
     const XdsResourceType::DecodeContext& context,
     const envoy_extensions_transport_sockets_tls_v3_CertificateProviderPluginInstance*
-        certificate_provider_plugin_instance_proto) {
-  CommonTlsContext::CertificateProviderPluginInstance
-      certificate_provider_plugin_instance = {
-          UpbStringToStdString(
-              envoy_extensions_transport_sockets_tls_v3_CertificateProviderPluginInstance_instance_name(
-                  certificate_provider_plugin_instance_proto)),
-          UpbStringToStdString(
-              envoy_extensions_transport_sockets_tls_v3_CertificateProviderPluginInstance_certificate_name(
-                  certificate_provider_plugin_instance_proto))};
+        certificate_provider_plugin_instance_proto,
+    ValidationErrors* errors) {
+  CommonTlsContext::CertificateProviderPluginInstance cert_provider;
+  cert_provider.instance_name = UpbStringToStdString(
+      envoy_extensions_transport_sockets_tls_v3_CertificateProviderPluginInstance_instance_name(
+          certificate_provider_plugin_instance_proto));
   const auto& bootstrap =
       static_cast<const GrpcXdsBootstrap&>(context.client->bootstrap());
-  if (bootstrap.certificate_providers().find(
-          certificate_provider_plugin_instance.instance_name) ==
+  if (bootstrap.certificate_providers().find(cert_provider.instance_name) ==
       bootstrap.certificate_providers().end()) {
-    return absl::InvalidArgumentError(
-        absl::StrCat("Unrecognized certificate provider instance name: ",
-                     certificate_provider_plugin_instance.instance_name));
+    ValidationErrors::ScopedField field(errors, ".instance_name");
+    errors->AddError(
+        absl::StrCat("unrecognized certificate provider instance name: ",
+                     cert_provider.instance_name));
   }
-  return certificate_provider_plugin_instance;
+  cert_provider.certificate_name = UpbStringToStdString(
+      envoy_extensions_transport_sockets_tls_v3_CertificateProviderPluginInstance_certificate_name(
+          certificate_provider_plugin_instance_proto));
+  return cert_provider;
 }
 
-absl::StatusOr<CommonTlsContext::CertificateValidationContext>
+CommonTlsContext::CertificateValidationContext
 CertificateValidationContextParse(
     const XdsResourceType::DecodeContext& context,
     const envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext*
-        certificate_validation_context_proto) {
-  std::vector<std::string> errors;
+        certificate_validation_context_proto,
+    ValidationErrors* errors) {
   CommonTlsContext::CertificateValidationContext certificate_validation_context;
   size_t len = 0;
   auto* subject_alt_names_matchers =
       envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_match_subject_alt_names(
           certificate_validation_context_proto, &len);
   for (size_t i = 0; i < len; ++i) {
+    ValidationErrors::ScopedField field(
+        errors, absl::StrCat(".match_subject_alt_names[", i, "]"));
     StringMatcher::Type type;
     std::string matcher;
     if (envoy_type_matcher_v3_StringMatcher_has_exact(
@@ -207,7 +234,7 @@ CertificateValidationContextParse(
       matcher = UpbStringToStdString(
           envoy_type_matcher_v3_RegexMatcher_regex(regex_matcher));
     } else {
-      errors.push_back("Invalid StringMatcher specified");
+      errors->AddError("invalid StringMatcher specified");
       continue;
     }
     bool ignore_case = envoy_type_matcher_v3_StringMatcher_ignore_case(
@@ -216,13 +243,12 @@ CertificateValidationContextParse(
         StringMatcher::Create(type, matcher,
                               /*case_sensitive=*/!ignore_case);
     if (!string_matcher.ok()) {
-      errors.push_back(
-          absl::StrCat("string matcher: ", string_matcher.status().message()));
+      errors->AddError(string_matcher.status().message());
       continue;
     }
     if (type == StringMatcher::Type::kSafeRegex && ignore_case) {
-      errors.push_back(
-          "StringMatcher: ignore_case has no effect for SAFE_REGEX.");
+      ValidationErrors::ScopedField field(errors, ".ignore_case");
+      errors->AddError("not supported for regex matcher");
       continue;
     }
     certificate_validation_context.match_subject_alt_names.push_back(
@@ -232,58 +258,51 @@ CertificateValidationContextParse(
       envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_ca_certificate_provider_instance(
           certificate_validation_context_proto);
   if (ca_certificate_provider_instance != nullptr) {
-    auto certificate_provider_instance = CertificateProviderPluginInstanceParse(
-        context, ca_certificate_provider_instance);
-    if (!certificate_provider_instance.ok()) {
-      errors.emplace_back(certificate_provider_instance.status().message());
-    } else {
-      certificate_validation_context.ca_certificate_provider_instance =
-          std::move(*certificate_provider_instance);
-    }
+    ValidationErrors::ScopedField field(errors,
+                                        ".ca_certificate_provider_instance");
+    certificate_validation_context.ca_certificate_provider_instance =
+        CertificateProviderPluginInstanceParse(
+            context, ca_certificate_provider_instance, errors);
   }
   if (envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_verify_certificate_spki(
           certificate_validation_context_proto, nullptr) != nullptr) {
-    errors.push_back(
-        "CertificateValidationContext: verify_certificate_spki unsupported");
+    ValidationErrors::ScopedField field(errors, ".verify_certificate_spki");
+    errors->AddError("feature unsupported");
   }
   if (envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_verify_certificate_hash(
           certificate_validation_context_proto, nullptr) != nullptr) {
-    errors.push_back(
-        "CertificateValidationContext: verify_certificate_hash unsupported");
+    ValidationErrors::ScopedField field(errors, ".verify_certificate_hash");
+    errors->AddError("feature unsupported");
   }
   auto* require_signed_certificate_timestamp =
       envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_require_signed_certificate_timestamp(
           certificate_validation_context_proto);
   if (require_signed_certificate_timestamp != nullptr &&
       google_protobuf_BoolValue_value(require_signed_certificate_timestamp)) {
-    errors.push_back(
-        "CertificateValidationContext: "
-        "require_signed_certificate_timestamp unsupported");
+    ValidationErrors::ScopedField field(
+        errors, ".require_signed_certificate_timestamp");
+    errors->AddError("feature unsupported");
   }
   if (envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_has_crl(
           certificate_validation_context_proto)) {
-    errors.push_back("CertificateValidationContext: crl unsupported");
+    ValidationErrors::ScopedField field(errors, ".crl");
+    errors->AddError("feature unsupported");
   }
   if (envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_has_custom_validator_config(
           certificate_validation_context_proto)) {
-    errors.push_back(
-        "CertificateValidationContext: custom_validator_config unsupported");
-  }
-  if (!errors.empty()) {
-    return absl::InvalidArgumentError(
-        absl::StrCat("Errors parsing CertificateValidationContext: ",
-                     absl::StrJoin(errors, "; ")));
+    ValidationErrors::ScopedField field(errors, ".custom_validator_config");
+    errors->AddError("feature unsupported");
   }
   return certificate_validation_context;
 }
 
 }  // namespace
 
-absl::StatusOr<CommonTlsContext> CommonTlsContext::Parse(
+CommonTlsContext CommonTlsContext::Parse(
     const XdsResourceType::DecodeContext& context,
     const envoy_extensions_transport_sockets_tls_v3_CommonTlsContext*
-        common_tls_context_proto) {
-  std::vector<std::string> errors;
+        common_tls_context_proto,
+    ValidationErrors* errors) {
   CommonTlsContext common_tls_context;
   // The validation context is derived from the oneof in
   // 'validation_context_type'. 'validation_context_sds_secret_config' is not
@@ -292,18 +311,16 @@ absl::StatusOr<CommonTlsContext> CommonTlsContext::Parse(
       envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_combined_validation_context(
           common_tls_context_proto);
   if (combined_validation_context != nullptr) {
+    ValidationErrors::ScopedField field(errors, ".combined_validation_context");
     auto* default_validation_context =
         envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CombinedCertificateValidationContext_default_validation_context(
             combined_validation_context);
     if (default_validation_context != nullptr) {
-      auto certificate_validation_context = CertificateValidationContextParse(
-          context, default_validation_context);
-      if (!certificate_validation_context.ok()) {
-        errors.emplace_back(certificate_validation_context.status().message());
-      } else {
-        common_tls_context.certificate_validation_context =
-            std::move(*certificate_validation_context);
-      }
+      ValidationErrors::ScopedField field(errors,
+                                          ".default_validation_context");
+      common_tls_context.certificate_validation_context =
+          CertificateValidationContextParse(context, default_validation_context,
+                                            errors);
     }
     // If after parsing default_validation_context,
     // common_tls_context->certificate_validation_context.ca_certificate_provider_instance
@@ -312,55 +329,44 @@ absl::StatusOr<CommonTlsContext> CommonTlsContext::Parse(
     // 'combined_validation_context'. Note that this way of fetching root
     // certificates is deprecated and will be removed in the future.
     // TODO(yashykt): Remove this once it's no longer needed.
-    auto* validation_context_certificate_provider_instance =
+    const auto* validation_context_certificate_provider_instance =
         envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_CombinedCertificateValidationContext_validation_context_certificate_provider_instance(
             combined_validation_context);
     if (common_tls_context.certificate_validation_context
             .ca_certificate_provider_instance.Empty() &&
         validation_context_certificate_provider_instance != nullptr) {
-      auto certificate_provider_instance = CertificateProviderInstanceParse(
-          context, validation_context_certificate_provider_instance);
-      if (!certificate_provider_instance.ok()) {
-        errors.emplace_back(certificate_provider_instance.status().message());
-      } else {
-        common_tls_context.certificate_validation_context
-            .ca_certificate_provider_instance =
-            std::move(*certificate_provider_instance);
-      }
+      ValidationErrors::ScopedField field(
+          errors, ".validation_context_certificate_provider_instance");
+      common_tls_context.certificate_validation_context
+          .ca_certificate_provider_instance = CertificateProviderInstanceParse(
+          context, validation_context_certificate_provider_instance, errors);
     }
   } else {
     auto* validation_context =
         envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_validation_context(
             common_tls_context_proto);
     if (validation_context != nullptr) {
-      auto certificate_validation_context =
-          CertificateValidationContextParse(context, validation_context);
-      if (!certificate_validation_context.ok()) {
-        errors.emplace_back(certificate_validation_context.status().message());
-      } else {
-        common_tls_context.certificate_validation_context =
-            std::move(*certificate_validation_context);
-      }
+      ValidationErrors::ScopedField field(errors, ".validation_context");
+      common_tls_context.certificate_validation_context =
+          CertificateValidationContextParse(context, validation_context,
+                                            errors);
     } else if (
         envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_has_validation_context_sds_secret_config(
             common_tls_context_proto)) {
-      errors.push_back("validation_context_sds_secret_config unsupported");
+      ValidationErrors::ScopedField field(
+          errors, ".validation_context_sds_secret_config");
+      errors->AddError("feature unsupported");
     }
   }
   auto* tls_certificate_provider_instance =
       envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_tls_certificate_provider_instance(
           common_tls_context_proto);
   if (tls_certificate_provider_instance != nullptr) {
-    auto certificate_provider_plugin_instance =
+    ValidationErrors::ScopedField field(errors,
+                                        ".tls_certificate_provider_instance");
+    common_tls_context.tls_certificate_provider_instance =
         CertificateProviderPluginInstanceParse(
-            context, tls_certificate_provider_instance);
-    if (!certificate_provider_plugin_instance.ok()) {
-      errors.emplace_back(
-          certificate_provider_plugin_instance.status().message());
-    } else {
-      common_tls_context.tls_certificate_provider_instance =
-          std::move(*certificate_provider_plugin_instance);
-    }
+            context, tls_certificate_provider_instance, errors);
   } else {
     // Fall back onto 'tls_certificate_certificate_provider_instance'. Note that
     // this way of fetching identity certificates is deprecated and will be
@@ -370,65 +376,126 @@ absl::StatusOr<CommonTlsContext> CommonTlsContext::Parse(
         envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_tls_certificate_certificate_provider_instance(
             common_tls_context_proto);
     if (tls_certificate_certificate_provider_instance != nullptr) {
-      auto certificate_provider_instance = CertificateProviderInstanceParse(
-          context, tls_certificate_certificate_provider_instance);
-      if (!certificate_provider_instance.ok()) {
-        errors.emplace_back(certificate_provider_instance.status().message());
-      } else {
-        common_tls_context.tls_certificate_provider_instance =
-            std::move(*certificate_provider_instance);
-      }
+      ValidationErrors::ScopedField field(
+          errors, ".tls_certificate_certificate_provider_instance");
+      common_tls_context.tls_certificate_provider_instance =
+          CertificateProviderInstanceParse(
+              context, tls_certificate_certificate_provider_instance, errors);
     } else {
       if (envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_has_tls_certificates(
               common_tls_context_proto)) {
-        errors.push_back("tls_certificates unsupported");
+        ValidationErrors::ScopedField field(errors, ".tls_certificates");
+        errors->AddError("feature unsupported");
       }
       if (envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_has_tls_certificate_sds_secret_configs(
               common_tls_context_proto)) {
-        errors.push_back("tls_certificate_sds_secret_configs unsupported");
+        ValidationErrors::ScopedField field(
+            errors, ".tls_certificate_sds_secret_configs");
+        errors->AddError("feature unsupported");
       }
     }
   }
   if (envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_has_tls_params(
           common_tls_context_proto)) {
-    errors.push_back("tls_params unsupported");
+    ValidationErrors::ScopedField field(errors, ".tls_params");
+    errors->AddError("feature unsupported");
   }
   if (envoy_extensions_transport_sockets_tls_v3_CommonTlsContext_has_custom_handshaker(
           common_tls_context_proto)) {
-    errors.push_back("custom_handshaker unsupported");
+    ValidationErrors::ScopedField field(errors, ".custom_handshaker");
+    errors->AddError("feature unsupported");
   }
-  if (!errors.empty()) {
+  return common_tls_context;
+}
+
+//
+// ExtractXdsExtension
+//
+
+namespace {
+
+absl::StatusOr<Json> ParseProtobufStructToJson(
+    const XdsResourceType::DecodeContext& context,
+    const google_protobuf_Struct* resource) {
+  upb::Status status;
+  const auto* msg_def = google_protobuf_Struct_getmsgdef(context.symtab);
+  size_t json_size = upb_JsonEncode(resource, msg_def, context.symtab, 0,
+                                    nullptr, 0, status.ptr());
+  if (json_size == static_cast<size_t>(-1)) {
     return absl::InvalidArgumentError(
-        absl::StrCat("Errors parsing CommonTlsContext: [",
-                     absl::StrJoin(errors, "; "), "]"));
+        absl::StrCat("error encoding google::Protobuf::Struct as JSON: ",
+                     upb_Status_ErrorMessage(status.ptr())));
   }
-  return common_tls_context;
+  void* buf = upb_Arena_Malloc(context.arena, json_size + 1);
+  upb_JsonEncode(resource, msg_def, context.symtab, 0,
+                 reinterpret_cast<char*>(buf), json_size + 1, status.ptr());
+  auto json = Json::Parse(reinterpret_cast<char*>(buf));
+  if (!json.ok()) {
+    // This should never happen.
+    return absl::InternalError(
+        absl::StrCat("error parsing JSON form of google::Protobuf::Struct "
+                     "produced by upb library: ",
+                     json.status().ToString()));
+  }
+  return std::move(*json);
 }
 
-absl::StatusOr<ExtractExtensionTypeNameResult> ExtractExtensionTypeName(
+}  // namespace
+
+absl::optional<XdsExtension> ExtractXdsExtension(
     const XdsResourceType::DecodeContext& context,
-    const google_protobuf_Any* any) {
-  ExtractExtensionTypeNameResult result;
-  result.type = UpbStringToAbsl(google_protobuf_Any_type_url(any));
-  if (result.type == "type.googleapis.com/xds.type.v3.TypedStruct" ||
-      result.type == "type.googleapis.com/udpa.type.v1.TypedStruct") {
-    upb_StringView any_value = google_protobuf_Any_value(any);
-    result.typed_struct = xds_type_v3_TypedStruct_parse(
-        any_value.data, any_value.size, context.arena);
-    if (result.typed_struct == nullptr) {
-      return absl::InvalidArgumentError(
-          "could not parse TypedStruct from extension");
-    }
-    result.type =
-        UpbStringToAbsl(xds_type_v3_TypedStruct_type_url(result.typed_struct));
+    const google_protobuf_Any* any, ValidationErrors* errors) {
+  if (any == nullptr) {
+    errors->AddError("field not present");
+    return absl::nullopt;
   }
-  size_t pos = result.type.rfind('/');
-  if (pos == absl::string_view::npos || pos == result.type.size() - 1) {
-    return absl::InvalidArgumentError(
-        absl::StrCat("Invalid type_url ", result.type));
+  XdsExtension extension;
+  auto strip_type_prefix = [&]() {
+    ValidationErrors::ScopedField field(errors, ".type_url");
+    if (extension.type.empty()) {
+      errors->AddError("field not present");
+      return;
+    }
+    size_t pos = extension.type.rfind('/');
+    if (pos == absl::string_view::npos || pos == extension.type.size() - 1) {
+      errors->AddError(absl::StrCat("invalid value \"", extension.type, "\""));
+    } else {
+      extension.type = extension.type.substr(pos + 1);
+    }
+  };
+  extension.type = UpbStringToAbsl(google_protobuf_Any_type_url(any));
+  strip_type_prefix();
+  extension.validation_fields.emplace_back(
+      errors, absl::StrCat(".value[", extension.type, "]"));
+  absl::string_view any_value = UpbStringToAbsl(google_protobuf_Any_value(any));
+  if (extension.type == "xds.type.v3.TypedStruct" ||
+      extension.type == "udpa.type.v1.TypedStruct") {
+    const auto* typed_struct = xds_type_v3_TypedStruct_parse(
+        any_value.data(), any_value.size(), context.arena);
+    if (typed_struct == nullptr) {
+      errors->AddError("could not parse");
+      return absl::nullopt;
+    }
+    extension.type =
+        UpbStringToAbsl(xds_type_v3_TypedStruct_type_url(typed_struct));
+    strip_type_prefix();
+    extension.validation_fields.emplace_back(
+        errors, absl::StrCat(".value[", extension.type, "]"));
+    auto* protobuf_struct = xds_type_v3_TypedStruct_value(typed_struct);
+    if (protobuf_struct == nullptr) {
+      extension.value = Json::Object();  // Default to empty object.
+    } else {
+      auto json = ParseProtobufStructToJson(context, protobuf_struct);
+      if (!json.ok()) {
+        errors->AddError(json.status().message());
+        return absl::nullopt;
+      }
+      extension.value = std::move(*json);
+    }
+  } else {
+    extension.value = any_value;
   }
-  result.type = result.type.substr(pos + 1);
-  return result;
+  return std::move(extension);
 }
 
 }  // namespace grpc_core

data/src/core/ext/xds/xds_common_types.h

@@ -22,24 +22,23 @@
 #include <string>
 #include <vector>
 
-#include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
+#include "absl/types/variant.h"
 #include "envoy/extensions/transport_sockets/tls/v3/tls.upb.h"
 #include "google/protobuf/any.upb.h"
 #include "google/protobuf/duration.upb.h"
-#include "xds/type/v3/typed_struct.upb.h"
 
 #include "src/core/ext/xds/xds_resource_type.h"
 #include "src/core/lib/gprpp/time.h"
+#include "src/core/lib/gprpp/validation_errors.h"
+#include "src/core/lib/json/json.h"
 #include "src/core/lib/matchers/matchers.h"
 
 namespace grpc_core {
 
-inline Duration ParseDuration(const google_protobuf_Duration* proto_duration) {
-  return Duration::FromSecondsAndNanoseconds(
-      google_protobuf_Duration_seconds(proto_duration),
-      google_protobuf_Duration_nanos(proto_duration));
-}
+Duration ParseDuration(const google_protobuf_Duration* proto_duration,
+                       ValidationErrors* errors);
 
 struct CommonTlsContext {
   struct CertificateProviderPluginInstance {
@@ -82,20 +81,27 @@ struct CommonTlsContext {
   std::string ToString() const;
   bool Empty() const;
 
-  static absl::StatusOr<CommonTlsContext> Parse(
+  static CommonTlsContext Parse(
       const XdsResourceType::DecodeContext& context,
       const envoy_extensions_transport_sockets_tls_v3_CommonTlsContext*
-          common_tls_context_proto);
+          common_tls_context_proto,
+      ValidationErrors* errors);
 };
 
-struct ExtractExtensionTypeNameResult {
+struct XdsExtension {
+  // The type, either from the top level or from inside the TypedStruct.
   absl::string_view type;
-  xds_type_v3_TypedStruct* typed_struct = nullptr;
+  // A Json object for a TypedStruct, or the serialized config otherwise.
+  absl::variant<absl::string_view /*serialized_value*/, Json /*typed_struct*/>
+      value;
+  // Validation fields that need to stay in scope until we're done
+  // processing the extension.
+  std::vector<ValidationErrors::ScopedField> validation_fields;
 };
 
-absl::StatusOr<ExtractExtensionTypeNameResult> ExtractExtensionTypeName(
+absl::optional<XdsExtension> ExtractXdsExtension(
     const XdsResourceType::DecodeContext& context,
-    const google_protobuf_Any* any);
+    const google_protobuf_Any* any, ValidationErrors* errors);
 
 }  // namespace grpc_core