grpc 1.57.0 → 1.58.0.pre1

data/src/core/ext/transport/chttp2/transport/frame_ping.cc

@@ -33,7 +33,7 @@
 #include <grpc/support/log.h>
 
 #include "src/core/ext/transport/chttp2/transport/internal.h"
-#include "src/core/lib/gprpp/time.h"
+#include "src/core/ext/transport/chttp2/transport/ping_abuse_policy.h"
 
 grpc_slice grpc_chttp2_ping_create(uint8_t ack, uint64_t opaque_8bytes) {
   grpc_slice slice = GRPC_SLICE_MALLOC(9 + 8);
@@ -94,24 +94,11 @@ grpc_error_handle grpc_chttp2_ping_parser_parse(void* parser,
       grpc_chttp2_ack_ping(t, p->opaque_8bytes);
     } else {
       if (!t->is_client) {
-        grpc_core::Timestamp now = grpc_core::Timestamp::Now();
-        grpc_core::Timestamp next_allowed_ping =
-            t->ping_recv_state.last_ping_recv_time +
-            t->ping_policy.min_recv_ping_interval_without_data;
-
-        if (t->keepalive_permit_without_calls == 0 && t->stream_map.empty()) {
-          // According to RFC1122, the interval of TCP Keep-Alive is default to
-          // no less than two hours. When there is no outstanding streams, we
-          // restrict the number of PINGS equivalent to TCP Keep-Alive.
-          next_allowed_ping = t->ping_recv_state.last_ping_recv_time +
-                              grpc_core::Duration::Hours(2);
-        }
-
-        if (next_allowed_ping > now) {
-          grpc_chttp2_add_ping_strike(t);
+        const bool transport_idle =
+            t->keepalive_permit_without_calls == 0 && t->stream_map.empty();
+        if (t->ping_abuse_policy.ReceivedOnePing(transport_idle)) {
+          grpc_chttp2_exceeded_ping_strikes(t);
         }
-
-        t->ping_recv_state.last_ping_recv_time = now;
       }
       if (t->ack_pings) {
         if (t->ping_ack_count == t->ping_ack_capacity) {

data/src/core/ext/transport/chttp2/transport/hpack_parser.cc

@@ -44,6 +44,7 @@
 #include "src/core/ext/transport/chttp2/transport/hpack_constants.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_parse_result.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_parser_table.h"
+#include "src/core/lib/channel/call_tracer.h"
 #include "src/core/lib/debug/stats.h"
 #include "src/core/lib/debug/stats_data.h"
 #include "src/core/lib/debug/trace.h"
@@ -1069,6 +1070,55 @@ Slice HPackParser::String::Take() {
   GPR_UNREACHABLE_CODE(return Slice());
 }
 
+class HPackParser::MetadataSizeEncoder {
+ public:
+  explicit MetadataSizeEncoder(std::string& summary) : summary_(summary) {}
+
+  void Encode(const Slice& key, const Slice& value) {
+    AddToSummary(key.as_string_view(), value.size());
+  }
+
+  template <typename Key, typename Value>
+  void Encode(Key, const Value& value) {
+    AddToSummary(Key::key(), EncodedSizeOfKey(Key(), value));
+  }
+
+ private:
+  void AddToSummary(absl::string_view key,
+                    size_t value_length) GPR_ATTRIBUTE_NOINLINE {
+    absl::StrAppend(&summary_, key, ":",
+                    hpack_constants::SizeForEntry(key.size(), value_length),
+                    ",");
+  }
+  std::string& summary_;
+};
+
+class HPackParser::MetadataSizesAnnotation
+    : public CallTracerAnnotationInterface::Annotation {
+ public:
+  MetadataSizesAnnotation(grpc_metadata_batch* metadata_buffer,
+                          uint64_t soft_limit, uint64_t hard_limit)
+      : CallTracerAnnotationInterface::Annotation(
+            CallTracerAnnotationInterface::AnnotationType::kMetadataSizes),
+        metadata_buffer_(metadata_buffer),
+        soft_limit_(soft_limit),
+        hard_limit_(hard_limit) {}
+
+  std::string ToString() const override {
+    std::string metadata_annotation =
+        absl::StrCat("gRPC metadata soft_limit:", soft_limit_,
+                     ",hard_limit:", hard_limit_, ",");
+    MetadataSizeEncoder encoder(metadata_annotation);
+    metadata_buffer_->Encode(&encoder);
+    return metadata_annotation;
+  }
+
+ private:
+  grpc_metadata_batch* metadata_buffer_;
+  uint64_t soft_limit_;
+  uint64_t hard_limit_;
+};
+
 // PUBLIC INTERFACE
 
 HPackParser::HPackParser() = default;
@@ -1093,7 +1143,9 @@ void HPackParser::BeginFrame(grpc_metadata_batch* metadata_buffer,
   log_info_ = log_info;
 }
 
-grpc_error_handle HPackParser::Parse(const grpc_slice& slice, bool is_last) {
+grpc_error_handle HPackParser::Parse(
+    const grpc_slice& slice, bool is_last,
+    CallTracerAnnotationInterface* call_tracer) {
   if (GPR_UNLIKELY(!unparsed_bytes_.empty())) {
     unparsed_bytes_.insert(unparsed_bytes_.end(), GRPC_SLICE_START_PTR(slice),
                            GRPC_SLICE_END_PTR(slice));
@@ -1105,20 +1157,27 @@ grpc_error_handle HPackParser::Parse(const grpc_slice& slice, bool is_last) {
     std::vector<uint8_t> buffer = std::move(unparsed_bytes_);
     return ParseInput(Input(nullptr, buffer.data(),
                             buffer.data() + buffer.size(), state_.frame_error),
-                      is_last);
+                      is_last, call_tracer);
   }
   return ParseInput(Input(slice.refcount, GRPC_SLICE_START_PTR(slice),
                           GRPC_SLICE_END_PTR(slice), state_.frame_error),
-                    is_last);
+                    is_last, call_tracer);
 }
 
-grpc_error_handle HPackParser::ParseInput(Input input, bool is_last) {
+grpc_error_handle HPackParser::ParseInput(
+    Input input, bool is_last, CallTracerAnnotationInterface* call_tracer) {
   ParseInputInner(&input);
   if (is_last && is_boundary()) {
     if (state_.metadata_early_detection.Reject(state_.frame_length)) {
       HandleMetadataSoftSizeLimitExceeded(&input);
     }
     global_stats().IncrementHttp2MetadataSize(state_.frame_length);
+    if (call_tracer != nullptr && metadata_buffer_ != nullptr) {
+      MetadataSizesAnnotation metadata_sizes_annotation(
+          metadata_buffer_, state_.metadata_early_detection.soft_limit(),
+          state_.metadata_early_detection.hard_limit());
+      call_tracer->RecordAnnotation(metadata_sizes_annotation);
+    }
     if (!state_.frame_error.connection_error() &&
         (input.eof_error() || state_.parse_state != ParseState::kTop)) {
       state_.frame_error = HpackParseResult::IncompleteHeaderAtBoundaryError();

data/src/core/ext/transport/chttp2/transport/hpack_parser.h

@@ -40,6 +40,7 @@
 #include "src/core/ext/transport/chttp2/transport/hpack_parse_result.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_parser_table.h"
 #include "src/core/lib/backoff/random_early_detection.h"
+#include "src/core/lib/channel/call_tracer.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_refcount.h"
@@ -99,7 +100,8 @@ class HPackParser {
   // Start throwing away any received headers after parsing them.
   void StopBufferingFrame() { metadata_buffer_ = nullptr; }
   // Parse one slice worth of data
-  grpc_error_handle Parse(const grpc_slice& slice, bool is_last);
+  grpc_error_handle Parse(const grpc_slice& slice, bool is_last,
+                          CallTracerAnnotationInterface* call_tracer);
   // Reset state ready for the next BeginFrame
   void FinishFrame();
 
@@ -117,6 +119,8 @@ class HPackParser {
   // Helper classes: see implementation
   class Parser;
   class Input;
+  class MetadataSizeEncoder;
+  class MetadataSizesAnnotation;
 
   // Helper to parse a string and turn it into a slice with appropriate memory
   // management characteristics
@@ -249,7 +253,8 @@ class HPackParser {
     absl::variant<const HPackTable::Memento*, Slice> key;
   };
 
-  grpc_error_handle ParseInput(Input input, bool is_last);
+  grpc_error_handle ParseInput(Input input, bool is_last,
+                               CallTracerAnnotationInterface* call_tracer);
   void ParseInputInner(Input* input);
   GPR_ATTRIBUTE_NOINLINE
   void HandleMetadataSoftSizeLimitExceeded(Input* input);

data/src/core/ext/transport/chttp2/transport/internal.h

@@ -48,6 +48,8 @@
 #include "src/core/ext/transport/chttp2/transport/hpack_encoder.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_parser.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/ping_abuse_policy.h"
+#include "src/core/ext/transport/chttp2/transport/ping_rate_policy.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channelz.h"
 #include "src/core/lib/debug/trace.h"
@@ -146,21 +148,14 @@ struct grpc_chttp2_ping_queue {
   grpc_closure_list lists[GRPC_CHTTP2_PCL_COUNT] = {};
   uint64_t inflight_id = 0;
 };
-struct grpc_chttp2_repeated_ping_policy {
-  int max_pings_without_data;
-  int max_ping_strikes;
-  grpc_core::Duration min_recv_ping_interval_without_data;
-};
+
 struct grpc_chttp2_repeated_ping_state {
   grpc_core::Timestamp last_ping_sent_time;
   int pings_before_data_required;
   absl::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
       delayed_ping_timer_handle;
 };
-struct grpc_chttp2_server_ping_recv_state {
-  grpc_core::Timestamp last_ping_recv_time;
-  int ping_strikes;
-};
+
 // deframer state for the overall http2 stream of bytes
 typedef enum {
   // prefix: one entry per http2 connection prefix byte
@@ -250,6 +245,19 @@ struct grpc_chttp2_transport : public grpc_core::KeepsGrpcInitialized {
                         grpc_endpoint* ep, bool is_client);
   ~grpc_chttp2_transport();
 
+  // Make this be able to be contained in RefCountedPtr<>
+  // Can't yet make this derive from RefCounted because we need to keep
+  // `grpc_transport base` first.
+  // TODO(ctiller): Make a transport interface.
+  void IncrementRefCount() { refs.Ref(); }
+  void Unref() {
+    if (refs.Unref()) delete this;
+  }
+  grpc_core::RefCountedPtr<grpc_chttp2_transport> Ref() {
+    IncrementRefCount();
+    return grpc_core::RefCountedPtr<grpc_chttp2_transport>(this);
+  }
+
   grpc_transport base;  // must be first
   grpc_core::RefCount refs;
   grpc_endpoint* ep;
@@ -343,8 +351,10 @@ struct grpc_chttp2_transport : public grpc_core::KeepsGrpcInitialized {
 
   /// ping queues for various ping insertion points
   grpc_chttp2_ping_queue ping_queue = grpc_chttp2_ping_queue();
-  grpc_chttp2_repeated_ping_policy ping_policy;
-  grpc_chttp2_repeated_ping_state ping_state;
+  grpc_core::Chttp2PingAbusePolicy ping_abuse_policy;
+  grpc_core::Chttp2PingRatePolicy ping_rate_policy;
+  absl::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
+      delayed_ping_timer_handle;
   uint64_t ping_ctr = 0;  // unique id for pings
   grpc_closure retry_initiate_ping_locked;
 
@@ -352,7 +362,6 @@ struct grpc_chttp2_transport : public grpc_core::KeepsGrpcInitialized {
   size_t ping_ack_count = 0;
   size_t ping_ack_capacity = 0;
   uint64_t* ping_acks = nullptr;
-  grpc_chttp2_server_ping_recv_state ping_recv_state;
 
   /// parser for headers
   grpc_core::HPackParser hpack_parser;
@@ -486,15 +495,9 @@ struct grpc_chttp2_stream {
                      const void* server_data, grpc_core::Arena* arena);
   ~grpc_chttp2_stream();
 
-  void* context;
-  grpc_chttp2_transport* t;
+  void* context = nullptr;
+  const grpc_core::RefCountedPtr<grpc_chttp2_transport> t;
   grpc_stream_refcount* refcount;
-  // Reffer is a 0-len structure, simply reffing `t` and `refcount` in its ctor
-  // before initializing the rest of the stream, to avoid cache misses. This
-  // field MUST be right after `t` and `refcount`.
-  struct Reffer {
-    explicit Reffer(grpc_chttp2_stream* s);
-  } reffer;
 
   grpc_closure destroy_stream;
   grpc_closure* destroy_stream_arg;
@@ -740,43 +743,11 @@ void grpc_chttp2_stream_ref(grpc_chttp2_stream* s);
 void grpc_chttp2_stream_unref(grpc_chttp2_stream* s);
 #endif
 
-#ifndef NDEBUG
-#define GRPC_CHTTP2_REF_TRANSPORT(t, r) \
-  grpc_chttp2_ref_transport(t, r, __FILE__, __LINE__)
-#define GRPC_CHTTP2_UNREF_TRANSPORT(t, r) \
-  grpc_chttp2_unref_transport(t, r, __FILE__, __LINE__)
-inline void grpc_chttp2_unref_transport(grpc_chttp2_transport* t,
-                                        const char* reason, const char* file,
-                                        int line) {
-  if (t->refs.Unref(grpc_core::DebugLocation(file, line), reason)) {
-    delete t;
-  }
-}
-inline void grpc_chttp2_ref_transport(grpc_chttp2_transport* t,
-                                      const char* reason, const char* file,
-                                      int line) {
-  t->refs.Ref(grpc_core::DebugLocation(file, line), reason);
-}
-#else
-#define GRPC_CHTTP2_REF_TRANSPORT(t, r) grpc_chttp2_ref_transport(t)
-#define GRPC_CHTTP2_UNREF_TRANSPORT(t, r) grpc_chttp2_unref_transport(t)
-inline void grpc_chttp2_unref_transport(grpc_chttp2_transport* t) {
-  if (t->refs.Unref()) {
-    delete t;
-  }
-}
-inline void grpc_chttp2_ref_transport(grpc_chttp2_transport* t) {
-  t->refs.Ref();
-}
-#endif
-
 void grpc_chttp2_ack_ping(grpc_chttp2_transport* t, uint64_t id);
 
-/// Add a new ping strike to ping_recv_state.ping_strikes. If
-/// ping_recv_state.ping_strikes > ping_policy.max_ping_strikes, it sends GOAWAY
-/// with error code ENHANCE_YOUR_CALM and additional debug data resembling
-/// "too_many_pings" followed by immediately closing the connection.
-void grpc_chttp2_add_ping_strike(grpc_chttp2_transport* t);
+/// Sends GOAWAY with error code ENHANCE_YOUR_CALM and additional debug data
+/// resembling "too_many_pings" followed by immediately closing the connection.
+void grpc_chttp2_exceeded_ping_strikes(grpc_chttp2_transport* t);
 
 /// Resets ping clock. Should be called when flushing window updates,
 /// initial/trailing metadata or data frames. For a server, it resets the number
@@ -810,9 +781,11 @@ void grpc_chttp2_config_default_keepalive_args(grpc_channel_args* args,
 void grpc_chttp2_config_default_keepalive_args(
     const grpc_core::ChannelArgs& channel_args, bool is_client);
 
-void grpc_chttp2_retry_initiate_ping(grpc_chttp2_transport* t);
+void grpc_chttp2_retry_initiate_ping(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t);
 
-void schedule_bdp_ping_locked(grpc_chttp2_transport* t);
+void schedule_bdp_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t);
 
 uint32_t grpc_chttp2_min_read_progress_size(grpc_chttp2_transport* t);
 

data/src/core/ext/transport/chttp2/transport/parsing.cc

@@ -47,11 +47,13 @@
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
 #include "src/core/ext/transport/chttp2/transport/http_trace.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
+#include "src/core/ext/transport/chttp2/transport/ping_rate_policy.h"
+#include "src/core/lib/channel/call_tracer.h"
 #include "src/core/lib/channel/channelz.h"
+#include "src/core/lib/channel/context.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/status_helper.h"
-#include "src/core/lib/gprpp/time.h"
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/combiner.h"
 #include "src/core/lib/iomgr/endpoint.h"
@@ -510,8 +512,7 @@ static grpc_error_handle init_data_frame_parser(grpc_chttp2_transport* t) {
   if (bdp_est) {
     if (t->bdp_ping_blocked) {
       t->bdp_ping_blocked = false;
-      GRPC_CHTTP2_REF_TRANSPORT(t, "bdp_ping");
-      schedule_bdp_ping_locked(t);
+      schedule_bdp_ping_locked(t->Ref());
     }
     bdp_est->AddIncomingBytes(t->incoming_frame_size);
   }
@@ -549,7 +550,7 @@ error_handler:
     t->incoming_stream = s;
     t->parser = grpc_chttp2_transport::Parser{
         "data", grpc_chttp2_data_parser_parse, nullptr};
-    t->ping_state.last_ping_sent_time = grpc_core::Timestamp::InfPast();
+    t->ping_rate_policy.ReceivedDataFrame();
     return absl::OkStatus();
   } else if (s != nullptr) {
     // handle stream errors by closing the stream
@@ -588,7 +589,7 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
                                  ? HPackParser::Priority::Included
                                  : HPackParser::Priority::None;
 
-  t->ping_state.last_ping_sent_time = grpc_core::Timestamp::InfPast();
+  t->ping_rate_policy.ReceivedDataFrame();
 
   // could be a new grpc_chttp2_stream or an existing grpc_chttp2_stream
   s = grpc_chttp2_parsing_lookup_stream(t, t->incoming_stream_id);
@@ -841,7 +842,7 @@ static const maybe_complete_func_type maybe_complete_funcs[] = {
 
 static void force_client_rst_stream(void* sp, grpc_error_handle /*error*/) {
   grpc_chttp2_stream* s = static_cast<grpc_chttp2_stream*>(sp);
-  grpc_chttp2_transport* t = s->t;
+  grpc_chttp2_transport* t = s->t.get();
   if (!s->write_closed) {
     grpc_chttp2_add_rst_stream_to_next_write(t, s->id, GRPC_HTTP2_NO_ERROR,
                                              &s->stats.outgoing);
@@ -857,10 +858,18 @@ grpc_error_handle grpc_chttp2_header_parser_parse(void* hpack_parser,
                                                   const grpc_slice& slice,
                                                   int is_last) {
   auto* parser = static_cast<grpc_core::HPackParser*>(hpack_parser);
+  grpc_core::CallTracerAnnotationInterface* call_tracer = nullptr;
   if (s != nullptr) {
     s->stats.incoming.header_bytes += GRPC_SLICE_LENGTH(slice);
+
+    if (s->context != nullptr) {
+      call_tracer = static_cast<grpc_core::CallTracerAnnotationInterface*>(
+          static_cast<grpc_call_context_element*>(
+              s->context)[GRPC_CONTEXT_CALL_TRACER_ANNOTATION_INTERFACE]
+              .value);
+    }
   }
-  grpc_error_handle error = parser->Parse(slice, is_last != 0);
+  grpc_error_handle error = parser->Parse(slice, is_last != 0, call_tracer);
   if (!error.ok()) {
     return error;
   }

data/src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc

@@ -0,0 +1,80 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/ext/transport/chttp2/transport/ping_abuse_policy.h"
+
+#include <algorithm>
+
+#include "absl/types/optional.h"
+
+#include <grpc/impl/channel_arg_names.h>
+
+namespace grpc_core {
+
+namespace {
+Duration g_default_min_recv_ping_interval_without_data = Duration::Minutes(5);
+int g_default_max_ping_strikes = 2;
+}  // namespace
+
+Chttp2PingAbusePolicy::Chttp2PingAbusePolicy(const ChannelArgs& args)
+    : min_recv_ping_interval_without_data_(std::max(
+          Duration::Zero(),
+          args.GetDurationFromIntMillis(
+                  GRPC_ARG_HTTP2_MIN_RECV_PING_INTERVAL_WITHOUT_DATA_MS)
+              .value_or(g_default_min_recv_ping_interval_without_data))),
+      max_ping_strikes_(
+          std::max(0, args.GetInt(GRPC_ARG_HTTP2_MAX_PING_STRIKES)
+                          .value_or(g_default_max_ping_strikes))) {}
+
+void Chttp2PingAbusePolicy::SetDefaults(const ChannelArgs& args) {
+  g_default_max_ping_strikes =
+      std::max(0, args.GetInt(GRPC_ARG_HTTP2_MAX_PING_STRIKES)
+                      .value_or(g_default_max_ping_strikes));
+  g_default_min_recv_ping_interval_without_data =
+      std::max(Duration::Zero(),
+               args.GetDurationFromIntMillis(
+                       GRPC_ARG_HTTP2_MIN_RECV_PING_INTERVAL_WITHOUT_DATA_MS)
+                   .value_or(g_default_min_recv_ping_interval_without_data));
+}
+
+bool Chttp2PingAbusePolicy::ReceivedOnePing(bool transport_idle) {
+  const Timestamp now = Timestamp::Now();
+  const Timestamp next_allowed_ping =
+      last_ping_recv_time_ + RecvPingIntervalWithoutData(transport_idle);
+  last_ping_recv_time_ = now;
+  if (next_allowed_ping <= now) return false;
+  // Received ping too soon: increment strike count.
+  ++ping_strikes_;
+  return ping_strikes_ > max_ping_strikes_ && max_ping_strikes_ != 0;
+}
+
+Duration Chttp2PingAbusePolicy::RecvPingIntervalWithoutData(
+    bool transport_idle) const {
+  if (transport_idle) {
+    // According to RFC1122, the interval of TCP Keep-Alive is default to
+    // no less than two hours. When there is no outstanding streams, we
+    // restrict the number of PINGS equivalent to TCP Keep-Alive.
+    return Duration::Hours(2);
+  }
+  return min_recv_ping_interval_without_data_;
+}
+
+void Chttp2PingAbusePolicy::ResetPingStrikes() {
+  last_ping_recv_time_ = Timestamp::InfPast();
+  ping_strikes_ = 0;
+}
+
+}  // namespace grpc_core

data/src/core/ext/transport/chttp2/transport/ping_abuse_policy.h

@@ -0,0 +1,55 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_PING_ABUSE_POLICY_H
+#define GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_PING_ABUSE_POLICY_H
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/gprpp/time.h"
+
+namespace grpc_core {
+
+class Chttp2PingAbusePolicy {
+ public:
+  explicit Chttp2PingAbusePolicy(const ChannelArgs& args);
+
+  static void SetDefaults(const ChannelArgs& args);
+
+  // Record one received ping; returns true if the connection should be closed.
+  // If transport_idle is true, we increase the allowed time between pings up to
+  // TCP keep-alive check time.
+  GRPC_MUST_USE_RESULT bool ReceivedOnePing(bool transport_idle);
+
+  // Reset the ping clock, strike count.
+  void ResetPingStrikes();
+
+  int TestOnlyMaxPingStrikes() const { return max_ping_strikes_; }
+  Duration TestOnlyMinPingIntervalWithoutData() const {
+    return min_recv_ping_interval_without_data_;
+  }
+
+ private:
+  Duration RecvPingIntervalWithoutData(bool transport_idle) const;
+
+  Timestamp last_ping_recv_time_ = Timestamp::InfPast();
+  const Duration min_recv_ping_interval_without_data_;
+  int ping_strikes_ = 0;
+  const int max_ping_strikes_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_PING_ABUSE_POLICY_H

data/src/core/ext/transport/chttp2/transport/ping_rate_policy.cc

@@ -0,0 +1,98 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/ext/transport/chttp2/transport/ping_rate_policy.h"
+
+#include <algorithm>
+#include <ostream>
+#include <utility>
+
+#include "absl/strings/str_cat.h"
+#include "absl/types/optional.h"
+
+#include <grpc/impl/channel_arg_names.h>
+
+#include "src/core/lib/gprpp/match.h"
+
+namespace grpc_core {
+
+namespace {
+int g_default_max_pings_without_data = 2;
+}  // namespace
+
+Chttp2PingRatePolicy::Chttp2PingRatePolicy(const ChannelArgs& args,
+                                           bool is_client)
+    : max_pings_without_data_(
+          is_client
+              ? std::max(0, args.GetInt(GRPC_ARG_HTTP2_MAX_PINGS_WITHOUT_DATA)
+                                .value_or(g_default_max_pings_without_data))
+              : 0) {}
+
+void Chttp2PingRatePolicy::SetDefaults(const ChannelArgs& args) {
+  g_default_max_pings_without_data =
+      std::max(0, args.GetInt(GRPC_ARG_HTTP2_MAX_PINGS_WITHOUT_DATA)
+                      .value_or(g_default_max_pings_without_data));
+}
+
+Chttp2PingRatePolicy::RequestSendPingResult
+Chttp2PingRatePolicy::RequestSendPing(Duration next_allowed_ping_interval) {
+  if (max_pings_without_data_ != 0 && pings_before_data_required_ == 0) {
+    return TooManyRecentPings{};
+  }
+  const Timestamp next_allowed_ping =
+      last_ping_sent_time_ + next_allowed_ping_interval;
+  const Timestamp now = Timestamp::Now();
+  if (next_allowed_ping > now) {
+    return TooSoon{next_allowed_ping_interval, last_ping_sent_time_,
+                   next_allowed_ping - now};
+  }
+  last_ping_sent_time_ = now;
+  if (pings_before_data_required_) --pings_before_data_required_;
+  return SendGranted{};
+}
+
+void Chttp2PingRatePolicy::ReceivedDataFrame() {
+  last_ping_sent_time_ = Timestamp::InfPast();
+}
+
+void Chttp2PingRatePolicy::ResetPingsBeforeDataRequired() {
+  pings_before_data_required_ = max_pings_without_data_;
+}
+
+std::string Chttp2PingRatePolicy::GetDebugString() const {
+  return absl::StrCat(
+      "max_pings_without_data: ", max_pings_without_data_,
+      ", pings_before_data_required: ", pings_before_data_required_,
+      ", last_ping_sent_time_: ", last_ping_sent_time_.ToString());
+}
+
+std::ostream& operator<<(std::ostream& out,
+                         const Chttp2PingRatePolicy::RequestSendPingResult& r) {
+  Match(
+      r, [&out](Chttp2PingRatePolicy::SendGranted) { out << "SendGranted"; },
+      [&out](Chttp2PingRatePolicy::TooManyRecentPings) {
+        out << "TooManyRecentPings";
+      },
+      [&out](Chttp2PingRatePolicy::TooSoon r) {
+        out << "TooSoon: next_allowed="
+            << r.next_allowed_ping_interval.ToString()
+            << " last_ping_sent_time=" << r.last_ping.ToString()
+            << " wait=" << r.wait.ToString();
+      });
+  return out;
+}
+
+}  // namespace grpc_core