grpc 1.55.0 → 1.58.0

data/src/core/lib/security/credentials/jwt/json_token.cc

@@ -36,6 +36,7 @@
 
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
+#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 #include <grpc/support/time.h>
 
@@ -114,8 +115,12 @@ grpc_auth_json_key grpc_auth_json_key_create_from_json(const Json& json) {
     gpr_log(GPR_ERROR, "Could not write into openssl BIO.");
     goto end;
   }
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   result.private_key =
       PEM_read_bio_RSAPrivateKey(bio, nullptr, nullptr, const_cast<char*>(""));
+#else
+  result.private_key = PEM_read_bio_PrivateKey(bio, nullptr, nullptr, nullptr);
+#endif
   if (result.private_key == nullptr) {
     gpr_log(GPR_ERROR, "Could not deserialize private key.");
     goto end;
@@ -157,7 +162,11 @@ void grpc_auth_json_key_destruct(grpc_auth_json_key* json_key) {
     json_key->client_email = nullptr;
   }
   if (json_key->private_key != nullptr) {
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
     RSA_free(json_key->private_key);
+#else
+    EVP_PKEY_free(json_key->private_key);
+#endif
     json_key->private_key = nullptr;
   }
 }
@@ -165,12 +174,12 @@ void grpc_auth_json_key_destruct(grpc_auth_json_key* json_key) {
 // --- jwt encoding and signature. ---
 
 static char* encoded_jwt_header(const char* key_id, const char* algorithm) {
-  Json json = Json::Object{
-      {"alg", algorithm},
-      {"typ", GRPC_JWT_TYPE},
-      {"kid", key_id},
-  };
-  std::string json_str = JsonDump(json);
+  Json json = Json::FromObject({
+      {"alg", Json::FromString(algorithm)},
+      {"typ", Json::FromString(GRPC_JWT_TYPE)},
+      {"kid", Json::FromString(key_id)},
+  });
+  std::string json_str = grpc_core::JsonDump(json);
   return grpc_base64_encode(json_str.c_str(), json_str.size(), 1, 0);
 }
 
@@ -185,20 +194,20 @@ static char* encoded_jwt_claim(const grpc_auth_json_key* json_key,
   }
 
   Json::Object object = {
-      {"iss", json_key->client_email},
-      {"aud", audience},
-      {"iat", now.tv_sec},
-      {"exp", expiration.tv_sec},
+      {"iss", Json::FromString(json_key->client_email)},
+      {"aud", Json::FromString(audience)},
+      {"iat", Json::FromNumber(now.tv_sec)},
+      {"exp", Json::FromNumber(expiration.tv_sec)},
   };
   if (scope != nullptr) {
-    object["scope"] = scope;
+    object["scope"] = Json::FromString(scope);
   } else {
     // Unscoped JWTs need a sub field.
-    object["sub"] = json_key->client_email;
+    object["sub"] = Json::FromString(json_key->client_email);
   }
 
-  Json json(object);
-  std::string json_str = JsonDump(json);
+  std::string json_str =
+      grpc_core::JsonDump(Json::FromObject(std::move(object)));
   return grpc_base64_encode(json_str.c_str(), json_str.size(), 1, 0);
 }
 
@@ -236,7 +245,9 @@ char* compute_and_encode_signature(const grpc_auth_json_key* json_key,
                                    const char* to_sign) {
   const EVP_MD* md = openssl_digest_from_algorithm(signature_algorithm);
   EVP_MD_CTX* md_ctx = nullptr;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   EVP_PKEY* key = EVP_PKEY_new();
+#endif
   size_t sig_len = 0;
   unsigned char* sig = nullptr;
   char* result = nullptr;
@@ -246,8 +257,13 @@ char* compute_and_encode_signature(const grpc_auth_json_key* json_key,
     gpr_log(GPR_ERROR, "Could not create MD_CTX");
     goto end;
   }
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   EVP_PKEY_set1_RSA(key, json_key->private_key);
   if (EVP_DigestSignInit(md_ctx, nullptr, md, nullptr, key) != 1) {
+#else
+  if (EVP_DigestSignInit(md_ctx, nullptr, md, nullptr, json_key->private_key) !=
+      1) {
+#endif
     gpr_log(GPR_ERROR, "DigestInit failed.");
     goto end;
   }
@@ -267,7 +283,9 @@ char* compute_and_encode_signature(const grpc_auth_json_key* json_key,
   result = grpc_base64_encode(sig, sig_len, 1, 0);
 
 end:
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   if (key != nullptr) EVP_PKEY_free(key);
+#endif
   if (md_ctx != nullptr) EVP_MD_CTX_destroy(md_ctx);
   if (sig != nullptr) gpr_free(sig);
   return result;

data/src/core/lib/security/credentials/jwt/json_token.h

@@ -38,7 +38,11 @@ struct grpc_auth_json_key {
   char* private_key_id;
   char* client_id;
   char* client_email;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   RSA* private_key;
+#else
+  EVP_PKEY* private_key;
+#endif
 };
 // Returns 1 if the object is valid, 0 otherwise.
 int grpc_auth_json_key_is_valid(const grpc_auth_json_key* json_key);

data/src/core/lib/security/credentials/jwt/jwt_credentials.cc

@@ -30,6 +30,7 @@
 #include "absl/strings/str_cat.h"
 
 #include <grpc/support/alloc.h>
+#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 #include <grpc/support/sync.h>
@@ -145,9 +146,10 @@ static char* redact_private_key(const char* json_key) {
     return gpr_strdup("<Json failed to parse.>");
   }
   Json::Object object = json->object();
-  object["private_key"] = "<redacted>";
+  object["private_key"] = Json::FromString("<redacted>");
   return gpr_strdup(
-      grpc_core::JsonDump(Json(std::move(object)), /*indent=*/2).c_str());
+      grpc_core::JsonDump(Json::FromObject(std::move(object)), /*indent=*/2)
+          .c_str());
 }
 
 grpc_call_credentials* grpc_service_account_jwt_access_credentials_create(

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -37,6 +37,9 @@
 #include <openssl/pem.h>
 #include <openssl/rsa.h>
 #include <openssl/x509.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/param_build.h>
+#endif
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
@@ -45,6 +48,7 @@
 #include <grpc/grpc.h>
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
+#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 #include <grpc/support/time.h>
@@ -522,7 +526,13 @@ static int RSA_set0_key(RSA* r, BIGNUM* n, BIGNUM* e, BIGNUM* d) {
 #endif  // OPENSSL_VERSION_NUMBER < 0x10100000L
 
 static EVP_PKEY* pkey_from_jwk(const Json& json, const char* kty) {
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   RSA* rsa = nullptr;
+#else
+  EVP_PKEY_CTX* ctx = nullptr;
+  OSSL_PARAM* params = NULL;
+  OSSL_PARAM_BLD* bld = OSSL_PARAM_BLD_new();
+#endif
   EVP_PKEY* result = nullptr;
   BIGNUM* tmp_n = nullptr;
   BIGNUM* tmp_e = nullptr;
@@ -534,11 +544,13 @@ static EVP_PKEY* pkey_from_jwk(const Json& json, const char* kty) {
     gpr_log(GPR_ERROR, "Unsupported key type %s.", kty);
     goto end;
   }
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   rsa = RSA_new();
   if (rsa == nullptr) {
     gpr_log(GPR_ERROR, "Could not create rsa key.");
     goto end;
   }
+#endif
   it = json.object().find("n");
   if (it == json.object().end()) {
     gpr_log(GPR_ERROR, "Missing RSA public key field.");
@@ -553,6 +565,7 @@ static EVP_PKEY* pkey_from_jwk(const Json& json, const char* kty) {
   }
   tmp_e = bignum_from_base64(validate_string_field(it->second, "e"));
   if (tmp_e == nullptr) goto end;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   if (!RSA_set0_key(rsa, tmp_n, tmp_e, nullptr)) {
     gpr_log(GPR_ERROR, "Cannot set RSA key from inputs.");
     goto end;
@@ -562,9 +575,38 @@ static EVP_PKEY* pkey_from_jwk(const Json& json, const char* kty) {
   tmp_e = nullptr;
   result = EVP_PKEY_new();
   EVP_PKEY_set1_RSA(result, rsa);  // uprefs rsa.
+#else
+
+  if (!OSSL_PARAM_BLD_push_BN(bld, "n", tmp_n) ||
+      !OSSL_PARAM_BLD_push_BN(bld, "e", tmp_e) ||
+      (params = OSSL_PARAM_BLD_to_param(bld)) == NULL) {
+    gpr_log(GPR_ERROR, "Could not create OSSL_PARAM");
+    goto end;
+  }
+
+  ctx = EVP_PKEY_CTX_new_from_name(nullptr, "RSA", nullptr);
+  if (ctx == nullptr) {
+    gpr_log(GPR_ERROR, "Could not create rsa key.");
+    goto end;
+  }
+  if (EVP_PKEY_fromdata_init(ctx) <= 0) {
+    gpr_log(GPR_ERROR, "Could not create rsa key.");
+    goto end;
+  }
+  if (EVP_PKEY_fromdata(ctx, &result, EVP_PKEY_KEYPAIR, params) <= 0) {
+    gpr_log(GPR_ERROR, "Cannot set RSA key from inputs.");
+    goto end;
+  }
+#endif
 
 end:
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   RSA_free(rsa);
+#else
+  EVP_PKEY_CTX_free(ctx);
+  OSSL_PARAM_free(params);
+  OSSL_PARAM_BLD_free(bld);
+#endif
   BN_free(tmp_n);
   BN_free(tmp_e);
   return result;
@@ -641,6 +683,7 @@ static int verify_jwt_signature(EVP_PKEY* key, const char* alg,
   if (EVP_DigestVerifyFinal(md_ctx, GRPC_SLICE_START_PTR(signature),
                             GRPC_SLICE_LENGTH(signature)) != 1) {
     gpr_log(GPR_ERROR, "JWT signature verification failed.");
+
     goto end;
   }
   result = 1;

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -39,6 +39,7 @@
 #include <grpc/grpc_security.h>
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
+#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 #include <grpc/support/time.h>

data/src/core/lib/security/credentials/ssl/ssl_credentials.cc

@@ -28,6 +28,7 @@
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
+#include <grpc/impl/channel_arg_names.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc

@@ -437,7 +437,11 @@ absl::StatusOr<bool> PrivateKeyAndCertificateMatch(
     return absl::InvalidArgumentError(
         "Conversion from PEM string to EVP_PKEY failed.");
   }
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   bool result = EVP_PKEY_cmp(private_evp_pkey, public_evp_pkey) == 1;
+#else
+  bool result = EVP_PKEY_eq(private_evp_pkey, public_evp_pkey) == 1;
+#endif
   EVP_PKEY_free(private_evp_pkey);
   EVP_PKEY_free(public_evp_pkey);
   return result;

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc

@@ -120,3 +120,11 @@ void grpc_tls_credentials_options_set_tls_session_key_log_file_path(
   }
   options->set_tls_session_key_log_file_path(path != nullptr ? path : "");
 }
+
+void grpc_tls_credentials_options_set_send_client_ca_list(
+    grpc_tls_credentials_options* options, bool send_client_ca_list) {
+  if (options == nullptr) {
+    return;
+  }
+  options->set_send_client_ca_list(send_client_ca_list);
+}

data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -61,6 +61,7 @@ struct grpc_tls_credentials_options
   const std::string& identity_cert_name() const { return identity_cert_name_; }
   const std::string& tls_session_key_log_file_path() const { return tls_session_key_log_file_path_; }
   const std::string& crl_directory() const { return crl_directory_; }
+  bool send_client_ca_list() const { return send_client_ca_list_; }
 
   // Setters for member fields.
   void set_cert_request_type(grpc_ssl_client_certificate_request_type cert_request_type) { cert_request_type_ = cert_request_type; }
@@ -81,6 +82,7 @@ struct grpc_tls_credentials_options
   void set_tls_session_key_log_file_path(std::string tls_session_key_log_file_path) { tls_session_key_log_file_path_ = std::move(tls_session_key_log_file_path); }
   //  gRPC will enforce CRLs on all handshakes from all hashed CRL files inside of the crl_directory. If not set, an empty string will be used, which will not enable CRL checking. Only supported for OpenSSL version > 1.1.
   void set_crl_directory(std::string crl_directory) { crl_directory_ = std::move(crl_directory); }
+  void set_send_client_ca_list(bool send_client_ca_list) { send_client_ca_list_ = send_client_ca_list; }
 
   bool operator==(const grpc_tls_credentials_options& other) const {
     return cert_request_type_ == other.cert_request_type_ &&
@@ -95,7 +97,8 @@ struct grpc_tls_credentials_options
       watch_identity_pair_ == other.watch_identity_pair_ &&
       identity_cert_name_ == other.identity_cert_name_ &&
       tls_session_key_log_file_path_ == other.tls_session_key_log_file_path_ &&
-      crl_directory_ == other.crl_directory_;
+      crl_directory_ == other.crl_directory_ &&
+      send_client_ca_list_ == other.send_client_ca_list_;
   }
 
  private:
@@ -112,6 +115,7 @@ struct grpc_tls_credentials_options
   std::string identity_cert_name_;
   std::string tls_session_key_log_file_path_;
   std::string crl_directory_;
+  bool send_client_ca_list_ = false;
 };
 
 #endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H

data/src/core/lib/security/credentials/tls/tls_credentials.cc

@@ -28,6 +28,7 @@
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security_constants.h>
+#include <grpc/impl/channel_arg_names.h>
 #include <grpc/support/log.h>
 
 #include "src/core/lib/channel/channel_args.h"
@@ -98,7 +99,7 @@ TlsCredentials::create_security_connector(
   return sc;
 }
 
-grpc_core::UniqueTypeName TlsCredentials::type() const {
+grpc_core::UniqueTypeName TlsCredentials::Type() {
   static grpc_core::UniqueTypeName::Factory kFactory("Tls");
   return kFactory.Create();
 }

data/src/core/lib/security/credentials/tls/tls_credentials.h

@@ -41,7 +41,9 @@ class TlsCredentials final : public grpc_channel_credentials {
       grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
       const char* target_name, grpc_core::ChannelArgs* args) override;
 
-  grpc_core::UniqueTypeName type() const override;
+  static grpc_core::UniqueTypeName Type();
+
+  grpc_core::UniqueTypeName type() const override { return Type(); }
 
   grpc_tls_credentials_options* options() const { return options_.get(); }
 

data/src/core/lib/security/credentials/xds/xds_credentials.cc

@@ -24,6 +24,7 @@
 #include "absl/types/optional.h"
 
 #include <grpc/grpc_security_constants.h>
+#include <grpc/impl/channel_arg_names.h>
 #include <grpc/support/log.h>
 
 #include "src/core/ext/filters/client_channel/lb_policy/xds/xds_channel_args.h"

data/src/core/lib/security/security_connector/alts/alts_security_connector.cc

@@ -31,6 +31,7 @@
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security_constants.h>
+#include <grpc/impl/channel_arg_names.h>
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -130,11 +131,7 @@ class grpc_alts_channel_security_connector final
   }
 
   grpc_core::ArenaPromise<absl::Status> CheckCallHost(
-      absl::string_view host, grpc_auth_context*) override {
-    if (host.empty() || host != target_name_) {
-      return grpc_core::Immediate(absl::UnauthenticatedError(
-          "ALTS call host does not match target name"));
-    }
+      absl::string_view, grpc_auth_context*) override {
     return grpc_core::ImmediateOkStatus();
   }
 

data/src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -34,6 +34,7 @@
 #include "absl/types/optional.h"
 
 #include <grpc/grpc_security_constants.h>
+#include <grpc/impl/channel_arg_names.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>

data/src/core/lib/security/security_connector/ssl_utils.cc

@@ -30,6 +30,7 @@
 #include "absl/strings/str_split.h"
 
 #include <grpc/grpc.h>
+#include <grpc/impl/channel_arg_names.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
@@ -465,7 +466,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
     grpc_ssl_client_certificate_request_type client_certificate_request,
     tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
-    const char* crl_directory,
+    const char* crl_directory, bool send_client_ca_list,
     tsi_ssl_server_handshaker_factory** handshaker_factory) {
   size_t num_alpn_protocols = 0;
   const char** alpn_protocol_strings =
@@ -483,6 +484,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
   options.max_tls_version = max_tls_version;
   options.key_logger = tls_session_key_logger;
   options.crl_directory = crl_directory;
+  options.send_client_ca_list = send_client_ca_list;
   const tsi_result result =
       tsi_create_ssl_server_handshaker_factory_with_options(&options,
                                                             handshaker_factory);

data/src/core/lib/security/security_connector/ssl_utils.h

@@ -93,7 +93,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
     grpc_ssl_client_certificate_request_type client_certificate_request,
     tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
-    const char* crl_directory,
+    const char* crl_directory, bool send_client_ca_list,
     tsi_ssl_server_handshaker_factory** handshaker_factory);
 
 // Free the memory occupied by key cert pairs.

data/src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -830,7 +830,7 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()),
       tls_session_key_logger_.get(), options_->crl_directory().c_str(),
-      &server_handshaker_factory_);
+      options_->send_client_ca_list(), &server_handshaker_factory_);
   // Free memory.
   grpc_tsi_ssl_pem_key_cert_pairs_destroy(pem_key_cert_pairs,
                                           num_key_cert_pairs);

data/src/core/lib/security/transport/client_auth_filter.cc

@@ -18,6 +18,7 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <stdint.h>
 #include <string.h>
 
 #include <functional>
@@ -43,7 +44,6 @@
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/promise/context.h"
-#include "src/core/lib/promise/detail/basic_seq.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/promise/seq.h"
 #include "src/core/lib/promise/try_seq.h"
@@ -196,10 +196,13 @@ ArenaPromise<ServerMetadataHandle> ClientAuthFilter::MakeCallPromise(
   if (host == nullptr) {
     return next_promise_factory(std::move(call_args));
   }
-  return TrySeq(args_.security_connector->CheckCallHost(
-                    host->as_string_view(), args_.auth_context.get()),
-                GetCallCredsMetadata(std::move(call_args)),
-                next_promise_factory);
+  return TrySeq(
+      args_.security_connector->CheckCallHost(host->as_string_view(),
+                                              args_.auth_context.get()),
+      [this, call_args = std::move(call_args)]() mutable {
+        return GetCallCredsMetadata(std::move(call_args));
+      },
+      next_promise_factory);
 }
 
 absl::StatusOr<ClientAuthFilter> ClientAuthFilter::Create(

data/src/core/lib/security/transport/security_handshaker.cc

@@ -36,6 +36,7 @@
 
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
+#include <grpc/impl/channel_arg_names.h>
 #include <grpc/slice.h>
 #include <grpc/slice_buffer.h>
 #include <grpc/support/alloc.h>

data/src/core/lib/security/transport/server_auth_filter.cc

@@ -18,6 +18,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <stdint.h>
+
 #include <algorithm>
 #include <atomic>
 #include <cstddef>

data/src/core/lib/security/util/json_util.cc

@@ -26,6 +26,7 @@
 
 #include "absl/strings/str_cat.h"
 
+#include <grpc/support/json.h>
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/iomgr/error.h"

data/src/core/lib/service_config/service_config_call_data.h

@@ -21,14 +21,14 @@
 
 #include <stddef.h>
 
-#include <map>
 #include <memory>
 #include <utility>
 
-#include "absl/strings/string_view.h"
-
+#include "src/core/lib/channel/context.h"
+#include "src/core/lib/gprpp/chunked_vector.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/unique_type_name.h"
+#include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/service_config/service_config.h"
 #include "src/core/lib/service_config/service_config_parser.h"
 
@@ -38,43 +38,77 @@ namespace grpc_core {
 /// A pointer to this object is stored in the call_context
 /// GRPC_CONTEXT_SERVICE_CONFIG_CALL_DATA element, so that filters can
 /// easily access method and global parameters for the call.
+///
+/// Must be accessed when holding the call combiner (legacy filter) or from
+/// inside the activity (promise-based filter).
 class ServiceConfigCallData {
  public:
-  using CallAttributes = std::map<UniqueTypeName, absl::string_view>;
+  class CallAttributeInterface {
+   public:
+    virtual ~CallAttributeInterface() = default;
+    virtual UniqueTypeName type() const = 0;
+  };
+
+  ServiceConfigCallData(Arena* arena, grpc_call_context_element* call_context)
+      : call_attributes_(arena) {
+    call_context[GRPC_CONTEXT_SERVICE_CONFIG_CALL_DATA].value = this;
+    call_context[GRPC_CONTEXT_SERVICE_CONFIG_CALL_DATA].destroy = Destroy;
+  }
 
-  ServiceConfigCallData() : method_configs_(nullptr) {}
+  virtual ~ServiceConfigCallData() = default;
 
-  ServiceConfigCallData(
+  void SetServiceConfig(
       RefCountedPtr<ServiceConfig> service_config,
-      const ServiceConfigParser::ParsedConfigVector* method_configs,
-      CallAttributes call_attributes)
-      : service_config_(std::move(service_config)),
-        method_configs_(method_configs),
-        call_attributes_(std::move(call_attributes)) {}
+      const ServiceConfigParser::ParsedConfigVector* method_configs) {
+    service_config_ = std::move(service_config);
+    method_configs_ = method_configs;
+  }
 
   ServiceConfig* service_config() { return service_config_.get(); }
 
   ServiceConfigParser::ParsedConfig* GetMethodParsedConfig(size_t index) const {
-    return method_configs_ != nullptr ? (*method_configs_)[index].get()
-                                      : nullptr;
+    if (method_configs_ == nullptr) return nullptr;
+    return (*method_configs_)[index].get();
   }
 
   ServiceConfigParser::ParsedConfig* GetGlobalParsedConfig(size_t index) const {
+    if (service_config_ == nullptr) return nullptr;
     return service_config_->GetGlobalParsedConfig(index);
   }
 
-  const CallAttributes& call_attributes() const { return call_attributes_; }
+  void SetCallAttribute(CallAttributeInterface* value) {
+    // Overwrite existing entry if we already have one for this type.
+    for (CallAttributeInterface*& attribute : call_attributes_) {
+      if (value->type() == attribute->type()) {
+        attribute = value;
+        return;
+      }
+    }
+    // Otherwise, add a new entry.
+    call_attributes_.EmplaceBack(value);
+  }
+
+  template <typename A>
+  A* GetCallAttribute() const {
+    return static_cast<A*>(GetCallAttribute(A::TypeName()));
+  }
 
-  // Must be called when holding the call combiner (legacy filter) or from
-  // inside the activity (promise-based filter).
-  void SetCallAttribute(UniqueTypeName name, absl::string_view value) {
-    call_attributes_[name] = value;
+  CallAttributeInterface* GetCallAttribute(UniqueTypeName type) const {
+    for (CallAttributeInterface* attribute : call_attributes_) {
+      if (attribute->type() == type) return attribute;
+    }
+    return nullptr;
   }
 
  private:
+  static void Destroy(void* ptr) {
+    auto* self = static_cast<ServiceConfigCallData*>(ptr);
+    self->~ServiceConfigCallData();
+  }
+
   RefCountedPtr<ServiceConfig> service_config_;
-  const ServiceConfigParser::ParsedConfigVector* method_configs_;
-  CallAttributes call_attributes_;
+  const ServiceConfigParser::ParsedConfigVector* method_configs_ = nullptr;
+  ChunkedVector<CallAttributeInterface*, 4> call_attributes_;
 };
 
 }  // namespace grpc_core

data/src/core/lib/service_config/service_config_impl.cc

@@ -121,7 +121,8 @@ RefCountedPtr<ServiceConfig> ServiceConfigImpl::Create(
     service_config->parsed_method_config_vectors_storage_.reserve(
         method_configs->size());
     for (size_t i = 0; i < method_configs->size(); ++i) {
-      const Json::Object& method_config_json = (*method_configs)[i];
+      const Json method_config_json =
+          Json::FromObject(std::move((*method_configs)[i]));
       ValidationErrors::ScopedField field(
           errors, absl::StrCat(".methodConfig[", i, "]"));
       // Have each parser read this method config.

data/src/core/lib/slice/slice.h

@@ -342,6 +342,22 @@ class GPR_MSVC_EMPTY_BASE_CLASS_WORKAROUND Slice
     return Slice(TakeCSlice());
   }
 
+  // As per TakeOwned, but if the slice is refcounted and there are other refs
+  // then it will copy instead of ref-counting, to ensure the returned slice is
+  // not shared.
+  Slice TakeUniquelyOwned() {
+    if (c_slice().refcount == nullptr) {
+      return Slice(c_slice());
+    }
+    if (c_slice().refcount == grpc_slice_refcount::NoopRefcount()) {
+      return Slice(grpc_slice_copy(c_slice()));
+    }
+    if (c_slice().refcount->IsUnique()) {
+      return Slice(TakeCSlice());
+    }
+    return Slice(grpc_slice_copy(c_slice()));
+  }
+
   // AsOwned returns an owned slice but does not mutate the current slice,
   // meaning that it may add a reference to the underlying slice.
   Slice AsOwned() const {