grpc 1.54.2 → 1.56.0.pre3

data/src/core/ext/filters/http/message_compress/compression_filter.cc

@@ -49,7 +49,7 @@
 #include "src/core/lib/promise/latch.h"
 #include "src/core/lib/promise/pipe.h"
 #include "src/core/lib/promise/poll.h"
-#include "src/core/lib/promise/race.h"
+#include "src/core/lib/promise/prioritized_race.h"
 #include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/slice/slice_buffer.h"
 #include "src/core/lib/surface/call.h"
@@ -111,7 +111,7 @@ CompressionFilter::CompressionFilter(const ChannelArgs& args)
 MessageHandle CompressionFilter::CompressMessage(
     MessageHandle message, grpc_compression_algorithm algorithm) const {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_compression_trace)) {
-    gpr_log(GPR_ERROR, "CompressMessage: len=%" PRIdPTR " alg=%d flags=%d",
+    gpr_log(GPR_INFO, "CompressMessage: len=%" PRIdPTR " alg=%d flags=%d",
             message->payload()->Length(), algorithm, message->flags());
   }
   auto* call_context = GetContext<grpc_call_context_element>();
@@ -169,7 +169,7 @@ MessageHandle CompressionFilter::CompressMessage(
 absl::StatusOr<MessageHandle> CompressionFilter::DecompressMessage(
     MessageHandle message, DecompressArgs args) const {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_compression_trace)) {
-    gpr_log(GPR_ERROR, "DecompressMessage: len=%" PRIdPTR " max=%d alg=%d",
+    gpr_log(GPR_INFO, "DecompressMessage: len=%" PRIdPTR " max=%d alg=%d",
             message->payload()->Length(),
             args.max_recv_message_length.value_or(-1), args.algorithm);
   }
@@ -273,8 +273,8 @@ ArenaPromise<ServerMetadataHandle> ClientCompressionFilter::MakeCallPromise(
         return std::move(*r);
       });
   // Run the next filter, and race it with getting an error from decompression.
-  return Race(decompress_err->Wait(),
-              next_promise_factory(std::move(call_args)));
+  return PrioritizedRace(decompress_err->Wait(),
+                         next_promise_factory(std::move(call_args)));
 }
 
 ArenaPromise<ServerMetadataHandle> ServerCompressionFilter::MakeCallPromise(
@@ -316,8 +316,8 @@ ArenaPromise<ServerMetadataHandle> ServerCompressionFilter::MakeCallPromise(
         return CompressMessage(std::move(message), *compression_algorithm);
       });
   // Run the next filter, and race it with getting an error from decompression.
-  return Race(decompress_err->Wait(),
-              next_promise_factory(std::move(call_args)));
+  return PrioritizedRace(decompress_err->Wait(),
+                         next_promise_factory(std::move(call_args)));
 }
 
 }  // namespace grpc_core

data/src/core/ext/filters/rbac/rbac_service_config_parser.cc

@@ -20,21 +20,29 @@
 
 #include <cstdint>
 #include <map>
+#include <memory>
 #include <string>
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/str_cat.h"
 #include "absl/types/optional.h"
 
+#include <grpc/grpc_audit_logging.h>
+
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/json/json_args.h"
 #include "src/core/lib/json/json_object_loader.h"
 #include "src/core/lib/matchers/matchers.h"
+#include "src/core/lib/security/authorization/audit_logging.h"
 
 namespace grpc_core {
 
 namespace {
 
+using experimental::AuditLoggerFactory;
+using experimental::AuditLoggerRegistry;
+
 // RbacConfig: one or more RbacPolicy structs
 struct RbacConfig {
   // RbacPolicy: optional Rules
@@ -179,20 +187,40 @@ struct RbacConfig {
         static const JsonLoaderInterface* JsonLoader(const JsonArgs&);
       };
 
+      // AuditLogger: the name of logger and its config in json
+      struct AuditLogger {
+        std::string name;
+        Json::Object config;
+
+        AuditLogger() = default;
+        AuditLogger(const AuditLogger&) = delete;
+        AuditLogger& operator=(const AuditLogger&) = delete;
+        AuditLogger(AuditLogger&&) = default;
+        AuditLogger& operator=(AuditLogger&&) = default;
+
+        static const JsonLoaderInterface* JsonLoader(const JsonArgs&);
+        void JsonPostLoad(const Json&, const JsonArgs&,
+                          ValidationErrors* errors);
+      };
+
       int action;
       std::map<std::string, Policy> policies;
+      // Defaults to kNone since its json field is optional.
+      Rbac::AuditCondition audit_condition = Rbac::AuditCondition::kNone;
+      std::vector<std::unique_ptr<AuditLoggerFactory::Config>> logger_configs;
 
-      Rules() = default;
+      Rules() {}
       Rules(const Rules&) = delete;
       Rules& operator=(const Rules&) = delete;
       Rules(Rules&&) = default;
       Rules& operator=(Rules&&) = default;
 
-      Rbac TakeAsRbac();
+      Rbac TakeAsRbac(std::string name);
       static const JsonLoaderInterface* JsonLoader(const JsonArgs&);
       void JsonPostLoad(const Json&, const JsonArgs&, ValidationErrors* errors);
     };
 
+    std::string name;
     absl::optional<Rules> rules;
 
     Rbac TakeAsRbac();
@@ -219,10 +247,10 @@ RbacConfig::RbacPolicy::Rules::Policy::CidrRange::JsonLoader(const JsonArgs&) {
 void RbacConfig::RbacPolicy::Rules::Policy::CidrRange::JsonPostLoad(
     const Json& json, const JsonArgs& args, ValidationErrors* errors) {
   auto address_prefix = LoadJsonObjectField<std::string>(
-      json.object_value(), args, "addressPrefix", errors);
-  auto prefix_len = LoadJsonObjectField<uint32_t>(json.object_value(), args,
-                                                  "prefixLen", errors,
-                                                  /*required=*/false);
+      json.object(), args, "addressPrefix", errors);
+  auto prefix_len =
+      LoadJsonObjectField<uint32_t>(json.object(), args, "prefixLen", errors,
+                                    /*required=*/false);
   cidr_range =
       Rbac::CidrRange(address_prefix.value_or(""), prefix_len.value_or(0));
 }
@@ -269,13 +297,13 @@ RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonLoader(
 void RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonPostLoad(
     const Json& json, const JsonArgs& args, ValidationErrors* errors) {
   const size_t original_error_size = errors->size();
-  std::string name = LoadJsonObjectField<std::string>(json.object_value(), args,
-                                                      "name", errors)
-                         .value_or("");
-  bool invert_match = LoadJsonObjectField<bool>(json.object_value(), args,
-                                                "invertMatch", errors,
-                                                /*required=*/false)
-                          .value_or(false);
+  std::string name =
+      LoadJsonObjectField<std::string>(json.object(), args, "name", errors)
+          .value_or("");
+  bool invert_match =
+      LoadJsonObjectField<bool>(json.object(), args, "invertMatch", errors,
+                                /*required=*/false)
+          .value_or(false);
   auto set_header_matcher = [&](absl::StatusOr<HeaderMatcher> header_matcher) {
     if (header_matcher.ok()) {
       matcher = *header_matcher;
@@ -285,7 +313,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonPostLoad(
   };
   auto check_match = [&](absl::string_view field_name,
                          HeaderMatcher::Type type) {
-    auto match = LoadJsonObjectField<std::string>(json.object_value(), args,
+    auto match = LoadJsonObjectField<std::string>(json.object(), args,
                                                   field_name, errors,
                                                   /*required=*/false);
     if (match.has_value()) {
@@ -301,9 +329,9 @@ void RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonPostLoad(
       check_match("containsMatch", HeaderMatcher::Type::kContains)) {
     return;
   }
-  auto present_match = LoadJsonObjectField<bool>(json.object_value(), args,
-                                                 "presentMatch", errors,
-                                                 /*required=*/false);
+  auto present_match =
+      LoadJsonObjectField<bool>(json.object(), args, "presentMatch", errors,
+                                /*required=*/false);
   if (present_match.has_value()) {
     set_header_matcher(
         HeaderMatcher::Create(name, HeaderMatcher::Type::kPresent, "", 0, 0,
@@ -311,7 +339,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonPostLoad(
     return;
   }
   auto regex_match = LoadJsonObjectField<SafeRegexMatch>(
-      json.object_value(), args, "safeRegexMatch", errors,
+      json.object(), args, "safeRegexMatch", errors,
       /*required=*/false);
   if (regex_match.has_value()) {
     set_header_matcher(
@@ -319,9 +347,9 @@ void RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonPostLoad(
                               regex_match->regex, 0, 0, false, invert_match));
     return;
   }
-  auto range_match = LoadJsonObjectField<RangeMatch>(json.object_value(), args,
-                                                     "rangeMatch", errors,
-                                                     /*required=*/false);
+  auto range_match =
+      LoadJsonObjectField<RangeMatch>(json.object(), args, "rangeMatch", errors,
+                                      /*required=*/false);
   if (range_match.has_value()) {
     set_header_matcher(HeaderMatcher::Create(name, HeaderMatcher::Type::kRange,
                                              "", range_match->start,
@@ -349,7 +377,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::StringMatch::JsonPostLoad(
     const Json& json, const JsonArgs& args, ValidationErrors* errors) {
   const size_t original_error_size = errors->size();
   bool ignore_case =
-      LoadJsonObjectField<bool>(json.object_value(), args, "ignoreCase", errors,
+      LoadJsonObjectField<bool>(json.object(), args, "ignoreCase", errors,
                                 /*required=*/false)
           .value_or(false);
   auto set_string_matcher = [&](absl::StatusOr<StringMatcher> string_matcher) {
@@ -361,7 +389,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::StringMatch::JsonPostLoad(
   };
   auto check_match = [&](absl::string_view field_name,
                          StringMatcher::Type type) {
-    auto match = LoadJsonObjectField<std::string>(json.object_value(), args,
+    auto match = LoadJsonObjectField<std::string>(json.object(), args,
                                                   field_name, errors,
                                                   /*required=*/false);
     if (match.has_value()) {
@@ -376,9 +404,9 @@ void RbacConfig::RbacPolicy::Rules::Policy::StringMatch::JsonPostLoad(
       check_match("contains", StringMatcher::Type::kContains)) {
     return;
   }
-  auto regex_match = LoadJsonObjectField<SafeRegexMatch>(
-      json.object_value(), args, "safeRegex", errors,
-      /*required=*/false);
+  auto regex_match = LoadJsonObjectField<SafeRegexMatch>(json.object(), args,
+                                                         "safeRegex", errors,
+                                                         /*required=*/false);
   if (regex_match.has_value()) {
     set_string_matcher(StringMatcher::Create(StringMatcher::Type::kSafeRegex,
                                              regex_match->regex, ignore_case));
@@ -450,32 +478,32 @@ RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonLoader(const JsonArgs&) {
 void RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonPostLoad(
     const Json& json, const JsonArgs& args, ValidationErrors* errors) {
   const size_t original_error_size = errors->size();
-  auto any = LoadJsonObjectField<bool>(json.object_value(), args, "any", errors,
+  auto any = LoadJsonObjectField<bool>(json.object(), args, "any", errors,
                                        /*required=*/false);
   if (any.has_value()) {
     permission = std::make_unique<Rbac::Permission>(
         Rbac::Permission::MakeAnyPermission());
     return;
   }
-  auto header = LoadJsonObjectField<HeaderMatch>(json.object_value(), args,
-                                                 "header", errors,
-                                                 /*required=*/false);
+  auto header =
+      LoadJsonObjectField<HeaderMatch>(json.object(), args, "header", errors,
+                                       /*required=*/false);
   if (header.has_value()) {
     permission = std::make_unique<Rbac::Permission>(
         Rbac::Permission::MakeHeaderPermission(std::move(header->matcher)));
     return;
   }
-  auto url_path = LoadJsonObjectField<PathMatch>(json.object_value(), args,
-                                                 "urlPath", errors,
-                                                 /*required=*/false);
+  auto url_path =
+      LoadJsonObjectField<PathMatch>(json.object(), args, "urlPath", errors,
+                                     /*required=*/false);
   if (url_path.has_value()) {
     permission = std::make_unique<Rbac::Permission>(
         Rbac::Permission::MakePathPermission(url_path->path.matcher));
     return;
   }
-  auto destination_ip = LoadJsonObjectField<CidrRange>(
-      json.object_value(), args, "destinationIp", errors,
-      /*required=*/false);
+  auto destination_ip = LoadJsonObjectField<CidrRange>(json.object(), args,
+                                                       "destinationIp", errors,
+                                                       /*required=*/false);
   if (destination_ip.has_value()) {
     permission = std::make_unique<Rbac::Permission>(
         Rbac::Permission::MakeDestIpPermission(
@@ -483,23 +511,23 @@ void RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonPostLoad(
     return;
   }
   auto destination_port = LoadJsonObjectField<uint32_t>(
-      json.object_value(), args, "destinationPort", errors,
+      json.object(), args, "destinationPort", errors,
       /*required=*/false);
   if (destination_port.has_value()) {
     permission = std::make_unique<Rbac::Permission>(
         Rbac::Permission::MakeDestPortPermission(*destination_port));
     return;
   }
-  auto metadata = LoadJsonObjectField<Metadata>(json.object_value(), args,
-                                                "metadata", errors,
-                                                /*required=*/false);
+  auto metadata =
+      LoadJsonObjectField<Metadata>(json.object(), args, "metadata", errors,
+                                    /*required=*/false);
   if (metadata.has_value()) {
     permission = std::make_unique<Rbac::Permission>(
         Rbac::Permission::MakeMetadataPermission(metadata->invert));
     return;
   }
   auto requested_server_name = LoadJsonObjectField<StringMatch>(
-      json.object_value(), args, "requestedServerName", errors,
+      json.object(), args, "requestedServerName", errors,
       /*required=*/false);
   if (requested_server_name.has_value()) {
     permission = std::make_unique<Rbac::Permission>(
@@ -507,7 +535,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonPostLoad(
             std::move(requested_server_name->matcher)));
     return;
   }
-  auto rules = LoadJsonObjectField<PermissionList>(json.object_value(), args,
+  auto rules = LoadJsonObjectField<PermissionList>(json.object(), args,
                                                    "andRules", errors,
                                                    /*required=*/false);
   if (rules.has_value()) {
@@ -516,8 +544,8 @@ void RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonPostLoad(
             MakeRbacPermissionList(std::move(rules->rules))));
     return;
   }
-  rules = LoadJsonObjectField<PermissionList>(json.object_value(), args,
-                                              "orRules", errors,
+  rules = LoadJsonObjectField<PermissionList>(json.object(), args, "orRules",
+                                              errors,
                                               /*required=*/false);
   if (rules.has_value()) {
     permission =
@@ -525,9 +553,9 @@ void RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonPostLoad(
             MakeRbacPermissionList(std::move(rules->rules))));
     return;
   }
-  auto not_rule = LoadJsonObjectField<Permission>(json.object_value(), args,
-                                                  "notRule", errors,
-                                                  /*required=*/false);
+  auto not_rule =
+      LoadJsonObjectField<Permission>(json.object(), args, "notRule", errors,
+                                      /*required=*/false);
   if (not_rule.has_value()) {
     permission = std::make_unique<Rbac::Permission>(
         Rbac::Permission::MakeNotPermission(std::move(*not_rule->permission)));
@@ -590,7 +618,7 @@ RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonLoader(const JsonArgs&) {
 void RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonPostLoad(
     const Json& json, const JsonArgs& args, ValidationErrors* errors) {
   const size_t original_error_size = errors->size();
-  auto any = LoadJsonObjectField<bool>(json.object_value(), args, "any", errors,
+  auto any = LoadJsonObjectField<bool>(json.object(), args, "any", errors,
                                        /*required=*/false);
   if (any.has_value()) {
     principal =
@@ -598,7 +626,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonPostLoad(
     return;
   }
   auto authenticated = LoadJsonObjectField<Authenticated>(
-      json.object_value(), args, "authenticated", errors,
+      json.object(), args, "authenticated", errors,
       /*required=*/false);
   if (authenticated.has_value()) {
     if (authenticated->principal_name.has_value()) {
@@ -612,16 +640,16 @@ void RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonPostLoad(
     }
     return;
   }
-  auto cidr_range = LoadJsonObjectField<CidrRange>(json.object_value(), args,
-                                                   "sourceIp", errors,
-                                                   /*required=*/false);
+  auto cidr_range =
+      LoadJsonObjectField<CidrRange>(json.object(), args, "sourceIp", errors,
+                                     /*required=*/false);
   if (cidr_range.has_value()) {
     principal = std::make_unique<Rbac::Principal>(
         Rbac::Principal::MakeSourceIpPrincipal(
             std::move(cidr_range->cidr_range)));
     return;
   }
-  cidr_range = LoadJsonObjectField<CidrRange>(json.object_value(), args,
+  cidr_range = LoadJsonObjectField<CidrRange>(json.object(), args,
                                               "directRemoteIp", errors,
                                               /*required=*/false);
   if (cidr_range.has_value()) {
@@ -630,50 +658,49 @@ void RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonPostLoad(
             std::move(cidr_range->cidr_range)));
     return;
   }
-  cidr_range = LoadJsonObjectField<CidrRange>(json.object_value(), args,
-                                              "remoteIp", errors,
-                                              /*required=*/false);
+  cidr_range =
+      LoadJsonObjectField<CidrRange>(json.object(), args, "remoteIp", errors,
+                                     /*required=*/false);
   if (cidr_range.has_value()) {
     principal = std::make_unique<Rbac::Principal>(
         Rbac::Principal::MakeRemoteIpPrincipal(
             std::move(cidr_range->cidr_range)));
     return;
   }
-  auto header = LoadJsonObjectField<HeaderMatch>(json.object_value(), args,
-                                                 "header", errors,
-                                                 /*required=*/false);
+  auto header =
+      LoadJsonObjectField<HeaderMatch>(json.object(), args, "header", errors,
+                                       /*required=*/false);
   if (header.has_value()) {
     principal = std::make_unique<Rbac::Principal>(
         Rbac::Principal::MakeHeaderPrincipal(std::move(header->matcher)));
     return;
   }
-  auto url_path = LoadJsonObjectField<PathMatch>(json.object_value(), args,
-                                                 "urlPath", errors,
-                                                 /*required=*/false);
+  auto url_path =
+      LoadJsonObjectField<PathMatch>(json.object(), args, "urlPath", errors,
+                                     /*required=*/false);
   if (url_path.has_value()) {
     principal = std::make_unique<Rbac::Principal>(
         Rbac::Principal::MakePathPrincipal(std::move(url_path->path.matcher)));
     return;
   }
-  auto metadata = LoadJsonObjectField<Metadata>(json.object_value(), args,
-                                                "metadata", errors,
-                                                /*required=*/false);
+  auto metadata =
+      LoadJsonObjectField<Metadata>(json.object(), args, "metadata", errors,
+                                    /*required=*/false);
   if (metadata.has_value()) {
     principal = std::make_unique<Rbac::Principal>(
         Rbac::Principal::MakeMetadataPrincipal(metadata->invert));
     return;
   }
-  auto ids = LoadJsonObjectField<PrincipalList>(json.object_value(), args,
-                                                "andIds", errors,
-                                                /*required=*/false);
+  auto ids =
+      LoadJsonObjectField<PrincipalList>(json.object(), args, "andIds", errors,
+                                         /*required=*/false);
   if (ids.has_value()) {
     principal =
         std::make_unique<Rbac::Principal>(Rbac::Principal::MakeAndPrincipal(
             MakeRbacPrincipalList(std::move(ids->ids))));
     return;
   }
-  ids = LoadJsonObjectField<PrincipalList>(json.object_value(), args, "orIds",
-                                           errors,
+  ids = LoadJsonObjectField<PrincipalList>(json.object(), args, "orIds", errors,
                                            /*required=*/false);
   if (ids.has_value()) {
     principal =
@@ -682,7 +709,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonPostLoad(
     return;
   }
   auto not_rule =
-      LoadJsonObjectField<Principal>(json.object_value(), args, "notId", errors,
+      LoadJsonObjectField<Principal>(json.object(), args, "notId", errors,
                                      /*required=*/false);
   if (not_rule.has_value()) {
     principal = std::make_unique<Rbac::Principal>(
@@ -716,21 +743,51 @@ const JsonLoaderInterface* RbacConfig::RbacPolicy::Rules::Policy::JsonLoader(
   return loader;
 }
 
+//
+// RbacConfig::RbacPolicy::Rules::AuditLogger
+//
+
+const JsonLoaderInterface*
+RbacConfig::RbacPolicy::Rules::AuditLogger::JsonLoader(const JsonArgs&) {
+  // All fields handled in JsonPostLoad().
+  static const auto* loader = JsonObjectLoader<AuditLogger>().Finish();
+  return loader;
+}
+
+void RbacConfig::RbacPolicy::Rules::AuditLogger::JsonPostLoad(
+    const Json& json, const JsonArgs& args, ValidationErrors* errors) {
+  // Should have exactly one field as the logger name.
+  if (json.object().size() != 1) {
+    errors->AddError("audit logger should have exactly one field");
+    return;
+  }
+  name = json.object().begin()->first;
+  auto config_or =
+      LoadJsonObjectField<Json::Object>(json.object(), args, name, errors);
+  if (config_or.has_value()) {
+    config = std::move(*config_or);
+  }
+}
+
 //
 // RbacConfig::RbacPolicy::Rules
 //
 
-Rbac RbacConfig::RbacPolicy::Rules::TakeAsRbac() {
+Rbac RbacConfig::RbacPolicy::Rules::TakeAsRbac(std::string name) {
   Rbac rbac;
+  rbac.name = std::move(name);
   rbac.action = static_cast<Rbac::Action>(action);
+  rbac.audit_condition = audit_condition;
   for (auto& p : policies) {
     rbac.policies.emplace(p.first, p.second.TakeAsRbacPolicy());
   }
+  rbac.logger_configs = std::move(logger_configs);
   return rbac;
 }
 
 const JsonLoaderInterface* RbacConfig::RbacPolicy::Rules::JsonLoader(
     const JsonArgs&) {
+  // Audit logger configs handled in post load.
   static const auto* loader = JsonObjectLoader<Rules>()
                                   .Field("action", &Rules::action)
                                   .OptionalField("policies", &Rules::policies)
@@ -738,7 +795,8 @@ const JsonLoaderInterface* RbacConfig::RbacPolicy::Rules::JsonLoader(
   return loader;
 }
 
-void RbacConfig::RbacPolicy::Rules::JsonPostLoad(const Json&, const JsonArgs&,
+void RbacConfig::RbacPolicy::Rules::JsonPostLoad(const Json& json,
+                                                 const JsonArgs& args,
                                                  ValidationErrors* errors) {
   // Validate action field.
   auto rbac_action = static_cast<Rbac::Action>(action);
@@ -747,6 +805,40 @@ void RbacConfig::RbacPolicy::Rules::JsonPostLoad(const Json&, const JsonArgs&,
     ValidationErrors::ScopedField field(errors, ".action");
     errors->AddError("unknown action");
   }
+  // Parse and validate audit_condition field.
+  auto condition = LoadJsonObjectField<int>(json.object(), args,
+                                            "audit_condition", errors, false);
+  if (condition.has_value()) {
+    switch (*condition) {
+      case static_cast<int>(Rbac::AuditCondition::kNone):
+      case static_cast<int>(Rbac::AuditCondition::kOnAllow):
+      case static_cast<int>(Rbac::AuditCondition::kOnDeny):
+      case static_cast<int>(Rbac::AuditCondition::kOnDenyAndAllow):
+        audit_condition = static_cast<Rbac::AuditCondition>(*condition);
+        break;
+      default: {
+        ValidationErrors::ScopedField field(errors, ".audit_condition");
+        errors->AddError("unknown audit condition");
+      }
+    }
+  }
+  // Parse and validate audit logger configs.
+  auto configs = LoadJsonObjectField<std::vector<AuditLogger>>(
+      json.object(), args, "audit_loggers", errors, false);
+  if (configs.has_value()) {
+    for (size_t i = 0; i < configs->size(); ++i) {
+      auto& logger = (*configs)[i];
+      auto config = AuditLoggerRegistry::ParseConfig(
+          logger.name, Json::FromObject(std::move(logger.config)));
+      if (!config.ok()) {
+        ValidationErrors::ScopedField field(
+            errors, absl::StrCat(".audit_loggers[", i, "]"));
+        errors->AddError(config.status().message());
+        continue;
+      }
+      logger_configs.push_back(std::move(*config));
+    }
+  }
 }
 
 //
@@ -757,14 +849,15 @@ Rbac RbacConfig::RbacPolicy::TakeAsRbac() {
   if (!rules.has_value()) {
     // No enforcing to be applied. An empty deny policy with an empty map
     // is equivalent to no enforcing.
-    return Rbac(Rbac::Action::kDeny, {});
+    return Rbac(std::move(name), Rbac::Action::kDeny, {});
   }
-  return rules->TakeAsRbac();
+  return rules->TakeAsRbac(std::move(name));
 }
 
 const JsonLoaderInterface* RbacConfig::RbacPolicy::JsonLoader(const JsonArgs&) {
   static const auto* loader = JsonObjectLoader<RbacPolicy>()
                                   .OptionalField("rules", &RbacPolicy::rules)
+                                  .Field("filter_name", &RbacPolicy::name)
                                   .Finish();
   return loader;
 }

data/src/core/ext/filters/server_config_selector/server_config_selector_filter.cc

@@ -38,6 +38,7 @@
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/resource_quota/arena.h"
+#include "src/core/lib/service_config/service_config.h"
 #include "src/core/lib/service_config/service_config_call_data.h"
 #include "src/core/lib/transport/transport.h"
 
@@ -139,14 +140,11 @@ ArenaPromise<ServerMetadataHandle> ServerConfigSelectorFilter::MakeCallPromise(
         absl::UnavailableError(StatusToString(call_config.status()))));
     return std::move(r);
   }
-  auto& ctx = GetContext<
-      grpc_call_context_element>()[GRPC_CONTEXT_SERVICE_CONFIG_CALL_DATA];
-  ctx.value = GetContext<Arena>()->New<ServiceConfigCallData>(
-      std::move(call_config->service_config), call_config->method_configs,
-      ServiceConfigCallData::CallAttributes{});
-  ctx.destroy = [](void* p) {
-    static_cast<ServiceConfigCallData*>(p)->~ServiceConfigCallData();
-  };
+  auto* service_config_call_data =
+      GetContext<Arena>()->New<ServiceConfigCallData>(
+          GetContext<Arena>(), GetContext<grpc_call_context_element>());
+  service_config_call_data->SetServiceConfig(
+      std::move(call_config->service_config), call_config->method_configs);
   return next_promise_factory(std::move(call_args));
 }
 

data/src/core/ext/filters/stateful_session/stateful_session_filter.cc

@@ -59,7 +59,7 @@ namespace grpc_core {
 
 TraceFlag grpc_stateful_session_filter_trace(false, "stateful_session_filter");
 
-UniqueTypeName XdsOverrideHostTypeName() {
+UniqueTypeName XdsOverrideHostAttribute::TypeName() {
   static UniqueTypeName::Factory kFactory("xds_override_host");
   return kFactory.Create();
 }
@@ -160,8 +160,8 @@ ArenaPromise<ServerMetadataHandle> StatefulSessionFilter::MakeCallPromise(
     }
     // We have a valid cookie, so add the call attribute to be used by the
     // xds_override_host LB policy.
-    service_config_call_data->SetCallAttribute(XdsOverrideHostTypeName(),
-                                               *cookie_value);
+    service_config_call_data->SetCallAttribute(
+        GetContext<Arena>()->New<XdsOverrideHostAttribute>(*cookie_value));
   }
   // Intercept server initial metadata.
   call_args.server_initial_metadata->InterceptAndMap(

data/src/core/ext/filters/stateful_session/stateful_session_filter.h

@@ -30,11 +30,26 @@
 #include "src/core/lib/channel/promise_based_filter.h"
 #include "src/core/lib/gprpp/unique_type_name.h"
 #include "src/core/lib/promise/arena_promise.h"
+#include "src/core/lib/service_config/service_config_call_data.h"
 #include "src/core/lib/transport/transport.h"
 
 namespace grpc_core {
 
-UniqueTypeName XdsOverrideHostTypeName();
+class XdsOverrideHostAttribute
+    : public ServiceConfigCallData::CallAttributeInterface {
+ public:
+  static UniqueTypeName TypeName();
+
+  explicit XdsOverrideHostAttribute(absl::string_view host_name)
+      : host_name_(host_name) {}
+
+  absl::string_view host_name() const { return host_name_; }
+
+ private:
+  UniqueTypeName type() const override { return TypeName(); }
+
+  absl::string_view host_name_;
+};
 
 // A filter to provide cookie-based stateful session affinity.
 class StatefulSessionFilter : public ChannelFilter {