grpc 1.62.0 → 1.69.0

data/src/core/ext/filters/channel_idle/legacy_channel_idle_filter.h

@@ -15,33 +15,38 @@
 #ifndef GRPC_SRC_CORE_EXT_FILTERS_CHANNEL_IDLE_LEGACY_CHANNEL_IDLE_FILTER_H
 #define GRPC_SRC_CORE_EXT_FILTERS_CHANNEL_IDLE_LEGACY_CHANNEL_IDLE_FILTER_H
 
+#include <grpc/impl/connectivity_state.h>
 #include <grpc/support/port_platform.h>
 
 #include <memory>
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
-
-#include <grpc/impl/connectivity_state.h>
-
 #include "src/core/ext/filters/channel_idle/idle_filter_state.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/channel/promise_based_filter.h"
-#include "src/core/lib/gprpp/orphanable.h"
-#include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/gprpp/single_set_ptr.h"
-#include "src/core/lib/gprpp/time.h"
 #include "src/core/lib/promise/activity.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/transport/connectivity_state.h"
 #include "src/core/lib/transport/transport.h"
+#include "src/core/util/orphanable.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/single_set_ptr.h"
+#include "src/core/util/time.h"
 
 namespace grpc_core {
 
+Duration GetClientIdleTimeout(const ChannelArgs& args);
+
 class LegacyChannelIdleFilter : public ChannelFilter {
  public:
+  LegacyChannelIdleFilter(grpc_channel_stack* channel_stack,
+                          Duration client_idle_timeout)
+      : channel_stack_(channel_stack),
+        client_idle_timeout_(client_idle_timeout) {}
+
   ~LegacyChannelIdleFilter() override = default;
 
   LegacyChannelIdleFilter(const LegacyChannelIdleFilter&) = delete;
@@ -59,15 +64,10 @@ class LegacyChannelIdleFilter : public ChannelFilter {
   using SingleSetActivityPtr =
       SingleSetPtr<Activity, typename ActivityPtr::deleter_type>;
 
-  LegacyChannelIdleFilter(grpc_channel_stack* channel_stack,
-                          Duration client_idle_timeout)
-      : channel_stack_(channel_stack),
-        client_idle_timeout_(client_idle_timeout) {}
-
   grpc_channel_stack* channel_stack() { return channel_stack_; };
 
   virtual void Shutdown();
-  void CloseChannel();
+  void CloseChannel(absl::string_view reason);
 
   void IncreaseCallCount();
   void DecreaseCallCount();
@@ -94,10 +94,11 @@ class LegacyClientIdleFilter final : public LegacyChannelIdleFilter {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<LegacyClientIdleFilter> Create(
+  static absl::string_view TypeName() { return "client_idle"; }
+
+  static absl::StatusOr<std::unique_ptr<LegacyClientIdleFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
- private:
   using LegacyChannelIdleFilter::LegacyChannelIdleFilter;
 };
 
@@ -106,9 +107,14 @@ class LegacyMaxAgeFilter final : public LegacyChannelIdleFilter {
   static const grpc_channel_filter kFilter;
   struct Config;
 
-  static absl::StatusOr<LegacyMaxAgeFilter> Create(
+  static absl::string_view TypeName() { return "max_age"; }
+
+  static absl::StatusOr<std::unique_ptr<LegacyMaxAgeFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
+  LegacyMaxAgeFilter(grpc_channel_stack* channel_stack,
+                     const Config& max_age_config);
+
   void PostInit() override;
 
  private:
@@ -128,9 +134,6 @@ class LegacyMaxAgeFilter final : public LegacyChannelIdleFilter {
     LegacyMaxAgeFilter* filter_;
   };
 
-  LegacyMaxAgeFilter(grpc_channel_stack* channel_stack,
-                     const Config& max_age_config);
-
   void Shutdown() override;
 
   SingleSetActivityPtr max_age_activity_;

data/src/core/ext/filters/fault_injection/fault_injection_filter.cc

@@ -14,10 +14,10 @@
 // limitations under the License.
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/ext/filters/fault_injection/fault_injection_filter.h"
 
+#include <grpc/status.h>
+#include <grpc/support/port_platform.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ -27,36 +27,33 @@
 #include <type_traits>
 #include <utility>
 
+#include "absl/log/log.h"
 #include "absl/meta/type_traits.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/numbers.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
-
-#include <grpc/status.h>
-#include <grpc/support/log.h>
-
+#include "src/core/config/core_configuration.h"
 #include "src/core/ext/filters/fault_injection/fault_injection_service_config_parser.h"
 #include "src/core/lib/channel/channel_stack.h"
-#include "src/core/lib/channel/context.h"
 #include "src/core/lib/channel/status_util.h"
-#include "src/core/lib/config/core_configuration.h"
 #include "src/core/lib/debug/trace.h"
-#include "src/core/lib/gprpp/time.h"
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/promise/sleep.h"
 #include "src/core/lib/promise/try_seq.h"
 #include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/service_config/service_config_call_data.h"
+#include "src/core/util/time.h"
 
 namespace grpc_core {
 
-TraceFlag grpc_fault_injection_filter_trace(false, "fault_injection_filter");
 const NoInterceptor FaultInjectionFilter::Call::OnServerInitialMetadata;
 const NoInterceptor FaultInjectionFilter::Call::OnServerTrailingMetadata;
 const NoInterceptor FaultInjectionFilter::Call::OnClientToServerMessage;
+const NoInterceptor FaultInjectionFilter::Call::OnClientToServerHalfClose;
 const NoInterceptor FaultInjectionFilter::Call::OnServerToClientMessage;
 const NoInterceptor FaultInjectionFilter::Call::OnFinalize;
 
@@ -135,27 +132,24 @@ class FaultInjectionFilter::InjectionDecision {
   FaultHandle active_fault_{false};
 };
 
-absl::StatusOr<FaultInjectionFilter> FaultInjectionFilter::Create(
-    const ChannelArgs&, ChannelFilter::Args filter_args) {
-  return FaultInjectionFilter(filter_args);
+absl::StatusOr<std::unique_ptr<FaultInjectionFilter>>
+FaultInjectionFilter::Create(const ChannelArgs&,
+                             ChannelFilter::Args filter_args) {
+  return std::make_unique<FaultInjectionFilter>(filter_args);
 }
 
 FaultInjectionFilter::FaultInjectionFilter(ChannelFilter::Args filter_args)
-    : index_(grpc_channel_stack_filter_instance_number(
-          filter_args.channel_stack(),
-          filter_args.uninitialized_channel_element())),
+    : index_(filter_args.instance_id()),
       service_config_parser_index_(
-          FaultInjectionServiceConfigParser::ParserIndex()),
-      mu_(new Mutex) {}
+          FaultInjectionServiceConfigParser::ParserIndex()) {}
 
 // Construct a promise for one call.
 ArenaPromise<absl::Status> FaultInjectionFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, FaultInjectionFilter* filter) {
   auto decision = filter->MakeInjectionDecision(md);
-  if (GRPC_TRACE_FLAG_ENABLED(grpc_fault_injection_filter_trace)) {
-    gpr_log(GPR_INFO, "chand=%p: Fault injection triggered %s", this,
-            decision.ToString().c_str());
-  }
+  GRPC_TRACE_LOG(fault_injection_filter, INFO)
+      << "chand=" << this << ": Fault injection triggered "
+      << decision.ToString();
   auto delay = decision.DelayUntil();
   return TrySeq(Sleep(delay), [decision = std::move(decision)]() {
     return decision.MaybeAbort();
@@ -167,10 +161,7 @@ FaultInjectionFilter::MakeInjectionDecision(
     const ClientMetadata& initial_metadata) {
   // Fetch the fault injection policy from the service config, based on the
   // relative index for which policy should this CallData use.
-  auto* service_config_call_data = static_cast<ServiceConfigCallData*>(
-      GetContext<
-          grpc_call_context_element>()[GRPC_CONTEXT_SERVICE_CONFIG_CALL_DATA]
-          .value);
+  auto* service_config_call_data = GetContext<ServiceConfigCallData>();
   auto* method_params = static_cast<FaultInjectionMethodParsedConfig*>(
       service_config_call_data->GetMethodParsedConfig(
           service_config_parser_index_));
@@ -180,6 +171,12 @@ FaultInjectionFilter::MakeInjectionDecision(
     fi_policy = method_params->fault_injection_policy(index_);
   }
 
+  // Shouldn't ever be null, but just in case, return a no-op decision.
+  if (fi_policy == nullptr) {
+    return InjectionDecision(/*max_faults=*/0, /*delay_time=*/Duration::Zero(),
+                             /*abort_request=*/absl::nullopt);
+  }
+
   grpc_status_code abort_code = fi_policy->abort_code;
   uint32_t abort_percentage_numerator = fi_policy->abort_percentage_numerator;
   uint32_t delay_percentage_numerator = fi_policy->delay_percentage_numerator;
@@ -228,7 +225,7 @@ FaultInjectionFilter::MakeInjectionDecision(
   bool delay_request = delay != Duration::Zero();
   bool abort_request = abort_code != GRPC_STATUS_OK;
   if (delay_request || abort_request) {
-    MutexLock lock(mu_.get());
+    MutexLock lock(&mu_);
     if (delay_request) {
       delay_request =
           UnderFraction(&delay_rand_generator_, delay_percentage_numerator,
@@ -275,8 +272,7 @@ std::string FaultInjectionFilter::InjectionDecision::ToString() const {
 }
 
 const grpc_channel_filter FaultInjectionFilter::kFilter =
-    MakePromiseBasedFilter<FaultInjectionFilter, FilterEndpoint::kClient>(
-        "fault_injection_filter");
+    MakePromiseBasedFilter<FaultInjectionFilter, FilterEndpoint::kClient>();
 
 void FaultInjectionFilterRegister(CoreConfiguration::Builder* builder) {
   FaultInjectionServiceConfigParser::Register(builder);

data/src/core/ext/filters/fault_injection/fault_injection_filter.h

@@ -18,7 +18,6 @@
 #define GRPC_SRC_CORE_EXT_FILTERS_FAULT_INJECTION_FAULT_INJECTION_FILTER_H
 
 #include <grpc/support/port_platform.h>
-
 #include <stddef.h>
 
 #include <memory>
@@ -26,13 +25,12 @@
 #include "absl/base/thread_annotations.h"
 #include "absl/random/random.h"
 #include "absl/status/statusor.h"
-
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
-#include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/transport/transport.h"
+#include "src/core/util/sync.h"
 
 namespace grpc_core {
 
@@ -45,9 +43,13 @@ class FaultInjectionFilter
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<FaultInjectionFilter> Create(
+  static absl::string_view TypeName() { return "fault_injection_filter"; }
+
+  static absl::StatusOr<std::unique_ptr<FaultInjectionFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
+  explicit FaultInjectionFilter(ChannelFilter::Args filter_args);
+
   // Construct a promise for one call.
   class Call {
    public:
@@ -56,13 +58,12 @@ class FaultInjectionFilter
     static const NoInterceptor OnServerInitialMetadata;
     static const NoInterceptor OnServerTrailingMetadata;
     static const NoInterceptor OnClientToServerMessage;
+    static const NoInterceptor OnClientToServerHalfClose;
     static const NoInterceptor OnServerToClientMessage;
     static const NoInterceptor OnFinalize;
   };
 
  private:
-  explicit FaultInjectionFilter(ChannelFilter::Args filter_args);
-
   class InjectionDecision;
   InjectionDecision MakeInjectionDecision(
       const ClientMetadata& initial_metadata);
@@ -70,7 +71,7 @@ class FaultInjectionFilter
   // The relative index of instances of the same filter.
   size_t index_;
   const size_t service_config_parser_index_;
-  std::unique_ptr<Mutex> mu_;
+  Mutex mu_;
   absl::InsecureBitGen abort_rand_generator_ ABSL_GUARDED_BY(mu_);
   absl::InsecureBitGen delay_rand_generator_ ABSL_GUARDED_BY(mu_);
 };

data/src/core/ext/filters/fault_injection/fault_injection_service_config_parser.cc

@@ -14,14 +14,13 @@
 // limitations under the License.
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/ext/filters/fault_injection/fault_injection_service_config_parser.h"
 
+#include <grpc/support/port_platform.h>
+
 #include <vector>
 
 #include "absl/types/optional.h"
-
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/status_util.h"
 

data/src/core/ext/filters/fault_injection/fault_injection_service_config_parser.h

@@ -17,8 +17,8 @@
 #ifndef GRPC_SRC_CORE_EXT_FILTERS_FAULT_INJECTION_FAULT_INJECTION_SERVICE_CONFIG_PARSER_H
 #define GRPC_SRC_CORE_EXT_FILTERS_FAULT_INJECTION_FAULT_INJECTION_SERVICE_CONFIG_PARSER_H
 
+#include <grpc/status.h>
 #include <grpc/support/port_platform.h>
-
 #include <stddef.h>
 #include <stdint.h>
 
@@ -28,17 +28,14 @@
 #include <vector>
 
 #include "absl/strings/string_view.h"
-
-#include <grpc/status.h>
-
+#include "src/core/config/core_configuration.h"
 #include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/config/core_configuration.h"
-#include "src/core/lib/gprpp/time.h"
-#include "src/core/lib/gprpp/validation_errors.h"
-#include "src/core/lib/json/json.h"
-#include "src/core/lib/json/json_args.h"
-#include "src/core/lib/json/json_object_loader.h"
 #include "src/core/service_config/service_config_parser.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/json/json_args.h"
+#include "src/core/util/json/json_object_loader.h"
+#include "src/core/util/time.h"
+#include "src/core/util/validation_errors.h"
 
 // Channel arg key for enabling parsing fault injection via method config.
 #define GRPC_ARG_PARSE_FAULT_INJECTION_METHOD_CONFIG \

data/src/core/ext/filters/gcp_authentication/gcp_authentication_filter.cc

@@ -0,0 +1,205 @@
+//
+// Copyright 2024 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/ext/filters/gcp_authentication/gcp_authentication_filter.h"
+
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "absl/log/check.h"
+#include "absl/strings/str_cat.h"
+#include "src/core/config/core_configuration.h"
+#include "src/core/ext/filters/gcp_authentication/gcp_authentication_service_config_parser.h"
+#include "src/core/lib/channel/channel_stack.h"
+#include "src/core/lib/promise/context.h"
+#include "src/core/lib/resource_quota/arena.h"
+#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/security/credentials/gcp_service_account_identity/gcp_service_account_identity_credentials.h"
+#include "src/core/lib/transport/transport.h"
+#include "src/core/resolver/xds/xds_resolver_attributes.h"
+#include "src/core/service_config/service_config.h"
+#include "src/core/service_config/service_config_call_data.h"
+
+namespace grpc_core {
+
+//
+// GcpAuthenticationFilter::Call
+//
+
+const NoInterceptor GcpAuthenticationFilter::Call::OnClientToServerMessage;
+const NoInterceptor GcpAuthenticationFilter::Call::OnClientToServerHalfClose;
+const NoInterceptor GcpAuthenticationFilter::Call::OnServerInitialMetadata;
+const NoInterceptor GcpAuthenticationFilter::Call::OnServerToClientMessage;
+const NoInterceptor GcpAuthenticationFilter::Call::OnServerTrailingMetadata;
+const NoInterceptor GcpAuthenticationFilter::Call::OnFinalize;
+
+absl::Status GcpAuthenticationFilter::Call::OnClientInitialMetadata(
+    ClientMetadata& /*md*/, GcpAuthenticationFilter* filter) {
+  // Get the cluster name chosen for this RPC.
+  auto* service_config_call_data = GetContext<ServiceConfigCallData>();
+  auto cluster_attribute =
+      service_config_call_data->GetCallAttribute<XdsClusterAttribute>();
+  if (cluster_attribute == nullptr) {
+    // Can't happen, but be defensive.
+    return absl::InternalError(
+        "GCP authentication filter: call has no xDS cluster attribute");
+  }
+  absl::string_view cluster_name = cluster_attribute->cluster();
+  if (!absl::ConsumePrefix(&cluster_name, "cluster:")) {
+    return absl::OkStatus();  // Cluster specifier plugin.
+  }
+  // Look up the CDS resource for the cluster.
+  auto it = filter->xds_config_->clusters.find(cluster_name);
+  if (it == filter->xds_config_->clusters.end()) {
+    // Can't happen, but be defensive.
+    return absl::InternalError(
+        absl::StrCat("GCP authentication filter: xDS cluster ", cluster_name,
+                     " not found in XdsConfig"));
+  }
+  if (!it->second.ok()) {
+    // Cluster resource had an error, so fail the call.
+    // Note: For wait_for_ready calls, this does the wrong thing by
+    // failing the call instead of queuing it, but there's no easy
+    // way to queue the call here until we get a valid CDS resource,
+    // because once that happens, a new instance of this filter will be
+    // swapped in for subsequent calls, but *this* call is already tied
+    // to this filter instance, which will never see the update.
+    return absl::UnavailableError(
+        absl::StrCat("GCP authentication filter: CDS resource unavailable for ",
+                     cluster_name));
+  }
+  if (it->second->cluster == nullptr) {
+    // Can't happen, but be defensive.
+    return absl::InternalError(absl::StrCat(
+        "GCP authentication filter: CDS resource not present for cluster ",
+        cluster_name));
+  }
+  auto& metadata_map = it->second->cluster->metadata;
+  const XdsMetadataValue* metadata_value =
+      metadata_map.Find(filter->filter_config_->filter_instance_name);
+  // If no audience in the cluster, then no need to add call creds.
+  if (metadata_value == nullptr) return absl::OkStatus();
+  // If the entry is present but the wrong type, fail the RPC.
+  if (metadata_value->type() != XdsGcpAuthnAudienceMetadataValue::Type()) {
+    return absl::UnavailableError(absl::StrCat(
+        "GCP authentication filter: audience metadata in wrong format for "
+        "cluster ",
+        cluster_name));
+  }
+  // Get the call creds instance.
+  auto creds = filter->cache_->Get(
+      DownCast<const XdsGcpAuthnAudienceMetadataValue*>(metadata_value)->url());
+  // Add the call creds instance to the call.
+  auto* arena = GetContext<Arena>();
+  auto* security_ctx = DownCast<grpc_client_security_context*>(
+      arena->GetContext<SecurityContext>());
+  if (security_ctx == nullptr) {
+    security_ctx = arena->New<grpc_client_security_context>(std::move(creds));
+    arena->SetContext<SecurityContext>(security_ctx);
+  } else {
+    security_ctx->creds = std::move(creds);
+  }
+  return absl::OkStatus();
+}
+
+//
+// GcpAuthenticationFilter::CallCredentialsCache
+//
+
+UniqueTypeName GcpAuthenticationFilter::CallCredentialsCache::Type() {
+  static UniqueTypeName::Factory factory("gcp_auth_call_creds_cache");
+  return factory.Create();
+}
+
+void GcpAuthenticationFilter::CallCredentialsCache::SetMaxSize(
+    size_t max_size) {
+  MutexLock lock(&mu_);
+  cache_.SetMaxSize(max_size);
+}
+
+RefCountedPtr<grpc_call_credentials>
+GcpAuthenticationFilter::CallCredentialsCache::Get(
+    const std::string& audience) {
+  MutexLock lock(&mu_);
+  return cache_.GetOrInsert(audience, [](const std::string& audience) {
+    return MakeRefCounted<GcpServiceAccountIdentityCallCredentials>(audience);
+  });
+}
+
+//
+// GcpAuthenticationFilter
+//
+
+const grpc_channel_filter GcpAuthenticationFilter::kFilter =
+    MakePromiseBasedFilter<GcpAuthenticationFilter, FilterEndpoint::kClient,
+                           0>();
+
+absl::StatusOr<std::unique_ptr<GcpAuthenticationFilter>>
+GcpAuthenticationFilter::Create(const ChannelArgs& args,
+                                ChannelFilter::Args filter_args) {
+  // Get filter config.
+  auto service_config = args.GetObjectRef<ServiceConfig>();
+  if (service_config == nullptr) {
+    return absl::InvalidArgumentError(
+        "gcp_auth: no service config in channel args");
+  }
+  auto* config = static_cast<const GcpAuthenticationParsedConfig*>(
+      service_config->GetGlobalParsedConfig(
+          GcpAuthenticationServiceConfigParser::ParserIndex()));
+  if (config == nullptr) {
+    return absl::InvalidArgumentError("gcp_auth: parsed config not found");
+  }
+  auto* filter_config = config->GetConfig(filter_args.instance_id());
+  if (filter_config == nullptr) {
+    return absl::InvalidArgumentError(
+        "gcp_auth: filter instance ID not found in filter config");
+  }
+  // Get XdsConfig so that we can look up CDS resources.
+  auto xds_config = args.GetObjectRef<XdsConfig>();
+  if (xds_config == nullptr) {
+    return absl::InvalidArgumentError(
+        "gcp_auth: xds config not found in channel args");
+  }
+  // Get existing cache or create new one.
+  auto cache = filter_args.GetOrCreateState<CallCredentialsCache>(
+      filter_config->filter_instance_name, [&]() {
+        return MakeRefCounted<CallCredentialsCache>(filter_config->cache_size);
+      });
+  // Make sure size is updated, in case we're reusing a pre-existing
+  // cache but it has the wrong size.
+  cache->SetMaxSize(filter_config->cache_size);
+  // Instantiate filter.
+  return std::unique_ptr<GcpAuthenticationFilter>(
+      new GcpAuthenticationFilter(std::move(service_config), filter_config,
+                                  std::move(xds_config), std::move(cache)));
+}
+
+GcpAuthenticationFilter::GcpAuthenticationFilter(
+    RefCountedPtr<ServiceConfig> service_config,
+    const GcpAuthenticationParsedConfig::Config* filter_config,
+    RefCountedPtr<const XdsConfig> xds_config,
+    RefCountedPtr<CallCredentialsCache> cache)
+    : service_config_(std::move(service_config)),
+      filter_config_(filter_config),
+      xds_config_(std::move(xds_config)),
+      cache_(std::move(cache)) {}
+
+void GcpAuthenticationFilterRegister(CoreConfiguration::Builder* builder) {
+  GcpAuthenticationServiceConfigParser::Register(builder);
+}
+
+}  // namespace grpc_core

data/src/core/ext/filters/gcp_authentication/gcp_authentication_filter.h

@@ -0,0 +1,97 @@
+//
+// Copyright 2024 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_EXT_FILTERS_GCP_AUTHENTICATION_GCP_AUTHENTICATION_FILTER_H
+#define GRPC_SRC_CORE_EXT_FILTERS_GCP_AUTHENTICATION_GCP_AUTHENTICATION_FILTER_H
+
+#include <memory>
+#include <string>
+
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "src/core/ext/filters/gcp_authentication/gcp_authentication_service_config_parser.h"
+#include "src/core/filter/blackboard.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/channel/channel_fwd.h"
+#include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/transport/transport.h"
+#include "src/core/resolver/xds/xds_config.h"
+#include "src/core/util/lru_cache.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/sync.h"
+
+namespace grpc_core {
+
+// xDS GCP Authentication filter.
+// https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/gcp_authn_filter
+class GcpAuthenticationFilter
+    : public ImplementChannelFilter<GcpAuthenticationFilter> {
+ public:
+  static const grpc_channel_filter kFilter;
+
+  static absl::string_view TypeName() { return "gcp_authentication_filter"; }
+
+  static absl::StatusOr<std::unique_ptr<GcpAuthenticationFilter>> Create(
+      const ChannelArgs& args, ChannelFilter::Args filter_args);
+
+  class Call {
+   public:
+    absl::Status OnClientInitialMetadata(ClientMetadata& /*md*/,
+                                         GcpAuthenticationFilter* filter);
+    static const NoInterceptor OnClientToServerMessage;
+    static const NoInterceptor OnClientToServerHalfClose;
+    static const NoInterceptor OnServerInitialMetadata;
+    static const NoInterceptor OnServerToClientMessage;
+    static const NoInterceptor OnServerTrailingMetadata;
+    static const NoInterceptor OnFinalize;
+  };
+
+ private:
+  class CallCredentialsCache : public Blackboard::Entry {
+   public:
+    explicit CallCredentialsCache(size_t max_size) : cache_(max_size) {}
+
+    static UniqueTypeName Type();
+
+    void SetMaxSize(size_t max_size);
+
+    RefCountedPtr<grpc_call_credentials> Get(const std::string& audience);
+
+   private:
+    Mutex mu_;
+    LruCache<std::string /*audience*/, RefCountedPtr<grpc_call_credentials>>
+        cache_ ABSL_GUARDED_BY(&mu_);
+  };
+
+  GcpAuthenticationFilter(
+      RefCountedPtr<ServiceConfig> service_config,
+      const GcpAuthenticationParsedConfig::Config* filter_config,
+      RefCountedPtr<const XdsConfig> xds_config,
+      RefCountedPtr<CallCredentialsCache> cache);
+
+  // TODO(roth): Consider having the channel stack hold this ref so that
+  // individual filters don't need to.
+  const RefCountedPtr<ServiceConfig> service_config_;
+  const GcpAuthenticationParsedConfig::Config* filter_config_;
+  const RefCountedPtr<const XdsConfig> xds_config_;
+  const RefCountedPtr<CallCredentialsCache> cache_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_EXT_FILTERS_GCP_AUTHENTICATION_GCP_AUTHENTICATION_FILTER_H