grpc 1.66.0 → 1.67.0.pre1

data/src/core/xds/grpc/xds_http_gcp_authn_filter.cc

@@ -0,0 +1,142 @@
+//
+// Copyright 2024 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/xds/grpc/xds_http_gcp_authn_filter.h"
+
+#include <string>
+#include <utility>
+
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/variant.h"
+#include "envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.upb.h"
+#include "envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.upbdefs.h"
+
+#include <grpc/support/json.h>
+
+#include "src/core/ext/filters/gcp_authentication/gcp_authentication_filter.h"
+#include "src/core/ext/filters/gcp_authentication/gcp_authentication_service_config_parser.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/gprpp/validation_errors.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/json/json_writer.h"
+#include "src/core/xds/grpc/xds_common_types.h"
+#include "src/core/xds/grpc/xds_common_types_parser.h"
+#include "src/core/xds/grpc/xds_http_filter.h"
+
+namespace grpc_core {
+
+absl::string_view XdsHttpGcpAuthnFilter::ConfigProtoName() const {
+  return "envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig";
+}
+
+absl::string_view XdsHttpGcpAuthnFilter::OverrideConfigProtoName() const {
+  return "";
+}
+
+void XdsHttpGcpAuthnFilter::PopulateSymtab(upb_DefPool* symtab) const {
+  envoy_extensions_filters_http_gcp_authn_v3_GcpAuthnFilterConfig_getmsgdef(
+      symtab);
+}
+
+namespace {
+
+Json::Object ValidateFilterConfig(
+    absl::string_view instance_name,
+    const envoy_extensions_filters_http_gcp_authn_v3_GcpAuthnFilterConfig*
+        gcp_auth,
+    ValidationErrors* errors) {
+  Json::Object config = {
+      {"filter_instance_name", Json::FromString(std::string(instance_name))}};
+  const auto* cache_config =
+      envoy_extensions_filters_http_gcp_authn_v3_GcpAuthnFilterConfig_cache_config(
+          gcp_auth);
+  if (cache_config == nullptr) return config;
+  uint64_t cache_size =
+      ParseUInt64Value(
+          envoy_extensions_filters_http_gcp_authn_v3_TokenCacheConfig_cache_size(
+              cache_config))
+          .value_or(10);
+  if (cache_size == 0 || cache_size >= INT64_MAX) {
+    ValidationErrors::ScopedField field(errors, ".cache_config.cache_size");
+    errors->AddError("must be in the range (0, INT64_MAX)");
+  }
+  config["cache_size"] = Json::FromNumber(cache_size);
+  return config;
+}
+
+}  // namespace
+
+absl::optional<XdsHttpFilterImpl::FilterConfig>
+XdsHttpGcpAuthnFilter::GenerateFilterConfig(
+    absl::string_view instance_name,
+    const XdsResourceType::DecodeContext& context, XdsExtension extension,
+    ValidationErrors* errors) const {
+  absl::string_view* serialized_filter_config =
+      absl::get_if<absl::string_view>(&extension.value);
+  if (serialized_filter_config == nullptr) {
+    errors->AddError("could not parse GCP auth filter config");
+    return absl::nullopt;
+  }
+  auto* gcp_auth =
+      envoy_extensions_filters_http_gcp_authn_v3_GcpAuthnFilterConfig_parse(
+          serialized_filter_config->data(), serialized_filter_config->size(),
+          context.arena);
+  if (gcp_auth == nullptr) {
+    errors->AddError("could not parse GCP auth filter config");
+    return absl::nullopt;
+  }
+  return FilterConfig{ConfigProtoName(), Json::FromObject(ValidateFilterConfig(
+                                             instance_name, gcp_auth, errors))};
+}
+
+absl::optional<XdsHttpFilterImpl::FilterConfig>
+XdsHttpGcpAuthnFilter::GenerateFilterConfigOverride(
+    absl::string_view /*instance_name*/,
+    const XdsResourceType::DecodeContext& /*context*/,
+    XdsExtension /*extension*/, ValidationErrors* errors) const {
+  errors->AddError("GCP auth filter does not support config override");
+  return absl::nullopt;
+}
+
+void XdsHttpGcpAuthnFilter::AddFilter(InterceptionChainBuilder& builder) const {
+  builder.Add<GcpAuthenticationFilter>();
+}
+
+const grpc_channel_filter* XdsHttpGcpAuthnFilter::channel_filter() const {
+  return &GcpAuthenticationFilter::kFilter;
+}
+
+ChannelArgs XdsHttpGcpAuthnFilter::ModifyChannelArgs(
+    const ChannelArgs& args) const {
+  return args.Set(GRPC_ARG_PARSE_GCP_AUTHENTICATION_METHOD_CONFIG, 1);
+}
+
+absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
+XdsHttpGcpAuthnFilter::GenerateMethodConfig(
+    const FilterConfig& /*hcm_filter_config*/,
+    const FilterConfig* /*filter_config_override*/) const {
+  return ServiceConfigJsonEntry{"", ""};
+}
+
+absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
+XdsHttpGcpAuthnFilter::GenerateServiceConfig(
+    const FilterConfig& hcm_filter_config) const {
+  return ServiceConfigJsonEntry{"gcp_authentication",
+                                JsonDump(hcm_filter_config.config)};
+}
+
+}  // namespace grpc_core

data/src/core/xds/grpc/xds_http_gcp_authn_filter.h

@@ -0,0 +1,61 @@
+//
+// Copyright 2024 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_XDS_GRPC_XDS_HTTP_GCP_AUTHN_FILTER_H
+#define GRPC_SRC_CORE_XDS_GRPC_XDS_HTTP_GCP_AUTHN_FILTER_H
+
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
+#include "upb/reflection/def.h"
+
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/channel/channel_fwd.h"
+#include "src/core/lib/gprpp/validation_errors.h"
+#include "src/core/xds/grpc/xds_common_types.h"
+#include "src/core/xds/grpc/xds_http_filter.h"
+#include "src/core/xds/xds_client/xds_resource_type.h"
+
+namespace grpc_core {
+
+class XdsHttpGcpAuthnFilter final : public XdsHttpFilterImpl {
+ public:
+  absl::string_view ConfigProtoName() const override;
+  absl::string_view OverrideConfigProtoName() const override;
+  void PopulateSymtab(upb_DefPool* symtab) const override;
+  absl::optional<FilterConfig> GenerateFilterConfig(
+      absl::string_view instance_name,
+      const XdsResourceType::DecodeContext& context, XdsExtension extension,
+      ValidationErrors* errors) const override;
+  absl::optional<FilterConfig> GenerateFilterConfigOverride(
+      absl::string_view instance_name,
+      const XdsResourceType::DecodeContext& context, XdsExtension extension,
+      ValidationErrors* errors) const override;
+  void AddFilter(InterceptionChainBuilder& builder) const override;
+  const grpc_channel_filter* channel_filter() const override;
+  ChannelArgs ModifyChannelArgs(const ChannelArgs& args) const override;
+  absl::StatusOr<ServiceConfigJsonEntry> GenerateMethodConfig(
+      const FilterConfig& hcm_filter_config,
+      const FilterConfig* filter_config_override) const override;
+  absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
+      const FilterConfig& hcm_filter_config) const override;
+  bool IsSupportedOnClients() const override { return true; }
+  bool IsSupportedOnServers() const override { return false; }
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_XDS_GRPC_XDS_HTTP_GCP_AUTHN_FILTER_H

data/src/core/xds/grpc/xds_http_rbac_filter.cc

@@ -53,6 +53,7 @@
 #include "src/core/util/upb_utils.h"
 #include "src/core/xds/grpc/xds_audit_logger_registry.h"
 #include "src/core/xds/grpc/xds_bootstrap_grpc.h"
+#include "src/core/xds/grpc/xds_common_types_parser.h"
 #include "src/core/xds/xds_client/xds_client.h"
 
 namespace grpc_core {
@@ -190,11 +191,10 @@ Json ParseCidrRangeToJson(const envoy_config_core_v3_CidrRange* range) {
   json.emplace("addressPrefix",
                Json::FromString(UpbStringToStdString(
                    envoy_config_core_v3_CidrRange_address_prefix(range))));
-  const auto* prefix_len = envoy_config_core_v3_CidrRange_prefix_len(range);
-  if (prefix_len != nullptr) {
-    json.emplace(
-        "prefixLen",
-        Json::FromNumber(google_protobuf_UInt32Value_value(prefix_len)));
+  auto prefix_len =
+      ParseUInt32Value(envoy_config_core_v3_CidrRange_prefix_len(range));
+  if (prefix_len.has_value()) {
+    json.emplace("prefixLen", Json::FromNumber(*prefix_len));
   }
   return Json::FromObject(std::move(json));
 }
@@ -515,6 +515,7 @@ void XdsHttpRbacFilter::PopulateSymtab(upb_DefPool* symtab) const {
 
 absl::optional<XdsHttpFilterImpl::FilterConfig>
 XdsHttpRbacFilter::GenerateFilterConfig(
+    absl::string_view /*instance_name*/,
     const XdsResourceType::DecodeContext& context, XdsExtension extension,
     ValidationErrors* errors) const {
   absl::string_view* serialized_filter_config =
@@ -536,6 +537,7 @@ XdsHttpRbacFilter::GenerateFilterConfig(
 
 absl::optional<XdsHttpFilterImpl::FilterConfig>
 XdsHttpRbacFilter::GenerateFilterConfigOverride(
+    absl::string_view /*instance_name*/,
     const XdsResourceType::DecodeContext& context, XdsExtension extension,
     ValidationErrors* errors) const {
   absl::string_view* serialized_filter_config =
@@ -578,7 +580,7 @@ ChannelArgs XdsHttpRbacFilter::ModifyChannelArgs(
 }
 
 absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
-XdsHttpRbacFilter::GenerateServiceConfig(
+XdsHttpRbacFilter::GenerateMethodConfig(
     const FilterConfig& hcm_filter_config,
     const FilterConfig* filter_config_override) const {
   const Json& policy_json = filter_config_override != nullptr
@@ -588,4 +590,10 @@ XdsHttpRbacFilter::GenerateServiceConfig(
   return ServiceConfigJsonEntry{"rbacPolicy", JsonDump(policy_json)};
 }
 
+absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
+XdsHttpRbacFilter::GenerateServiceConfig(
+    const FilterConfig& /*hcm_filter_config*/) const {
+  return ServiceConfigJsonEntry{"", ""};
+}
+
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_http_rbac_filter.h

@@ -39,17 +39,21 @@ class XdsHttpRbacFilter final : public XdsHttpFilterImpl {
   absl::string_view OverrideConfigProtoName() const override;
   void PopulateSymtab(upb_DefPool* symtab) const override;
   absl::optional<FilterConfig> GenerateFilterConfig(
+      absl::string_view /*instance_name*/,
       const XdsResourceType::DecodeContext& context, XdsExtension extension,
       ValidationErrors* errors) const override;
   absl::optional<FilterConfig> GenerateFilterConfigOverride(
+      absl::string_view /*instance_name*/,
       const XdsResourceType::DecodeContext& context, XdsExtension extension,
       ValidationErrors* errors) const override;
   void AddFilter(InterceptionChainBuilder& builder) const override;
   const grpc_channel_filter* channel_filter() const override;
   ChannelArgs ModifyChannelArgs(const ChannelArgs& args) const override;
-  absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
+  absl::StatusOr<ServiceConfigJsonEntry> GenerateMethodConfig(
       const FilterConfig& hcm_filter_config,
       const FilterConfig* filter_config_override) const override;
+  absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
+      const FilterConfig& hcm_filter_config) const override;
   bool IsSupportedOnClients() const override { return false; }
   bool IsSupportedOnServers() const override { return true; }
 };

data/src/core/xds/grpc/xds_http_stateful_session_filter.cc

@@ -141,6 +141,7 @@ Json::Object ValidateStatefulSession(
 
 absl::optional<XdsHttpFilterImpl::FilterConfig>
 XdsHttpStatefulSessionFilter::GenerateFilterConfig(
+    absl::string_view /*instance_name*/,
     const XdsResourceType::DecodeContext& context, XdsExtension extension,
     ValidationErrors* errors) const {
   absl::string_view* serialized_filter_config =
@@ -164,6 +165,7 @@ XdsHttpStatefulSessionFilter::GenerateFilterConfig(
 
 absl::optional<XdsHttpFilterImpl::FilterConfig>
 XdsHttpStatefulSessionFilter::GenerateFilterConfigOverride(
+    absl::string_view /*instance_name*/,
     const XdsResourceType::DecodeContext& context, XdsExtension extension,
     ValidationErrors* errors) const {
   absl::string_view* serialized_filter_config =
@@ -211,7 +213,7 @@ ChannelArgs XdsHttpStatefulSessionFilter::ModifyChannelArgs(
 }
 
 absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
-XdsHttpStatefulSessionFilter::GenerateServiceConfig(
+XdsHttpStatefulSessionFilter::GenerateMethodConfig(
     const FilterConfig& hcm_filter_config,
     const FilterConfig* filter_config_override) const {
   const Json& config = filter_config_override != nullptr
@@ -220,4 +222,10 @@ XdsHttpStatefulSessionFilter::GenerateServiceConfig(
   return ServiceConfigJsonEntry{"stateful_session", JsonDump(config)};
 }
 
+absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
+XdsHttpStatefulSessionFilter::GenerateServiceConfig(
+    const FilterConfig& /*hcm_filter_config*/) const {
+  return ServiceConfigJsonEntry{"", ""};
+}
+
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_http_stateful_session_filter.h

@@ -39,17 +39,21 @@ class XdsHttpStatefulSessionFilter final : public XdsHttpFilterImpl {
   absl::string_view OverrideConfigProtoName() const override;
   void PopulateSymtab(upb_DefPool* symtab) const override;
   absl::optional<FilterConfig> GenerateFilterConfig(
+      absl::string_view /*instance_name*/,
       const XdsResourceType::DecodeContext& context, XdsExtension extension,
       ValidationErrors* errors) const override;
   absl::optional<FilterConfig> GenerateFilterConfigOverride(
+      absl::string_view /*instance_name*/,
       const XdsResourceType::DecodeContext& context, XdsExtension extension,
       ValidationErrors* errors) const override;
   void AddFilter(InterceptionChainBuilder& builder) const override;
   const grpc_channel_filter* channel_filter() const override;
   ChannelArgs ModifyChannelArgs(const ChannelArgs& args) const override;
-  absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
+  absl::StatusOr<ServiceConfigJsonEntry> GenerateMethodConfig(
       const FilterConfig& hcm_filter_config,
       const FilterConfig* filter_config_override) const override;
+  absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
+      const FilterConfig& hcm_filter_config) const override;
   bool IsSupportedOnClients() const override { return true; }
   bool IsSupportedOnServers() const override { return false; }
 };

data/src/core/xds/grpc/xds_lb_policy_registry.cc

@@ -173,23 +173,21 @@ class RingHashLbPolicyConfigFactory final
       ValidationErrors::ScopedField field(errors, ".hash_function");
       errors->AddError("unsupported value (must be XX_HASH)");
     }
-    uint64_t max_ring_size = 8388608;
-    const auto* uint64_value =
-        envoy_extensions_load_balancing_policies_ring_hash_v3_RingHash_maximum_ring_size(
-            resource);
-    if (uint64_value != nullptr) {
-      max_ring_size = google_protobuf_UInt64Value_value(uint64_value);
-      if (max_ring_size == 0 || max_ring_size > 8388608) {
-        ValidationErrors::ScopedField field(errors, ".maximum_ring_size");
-        errors->AddError("value must be in the range [1, 8388608]");
-      }
+    uint64_t max_ring_size =
+        ParseUInt64Value(
+            envoy_extensions_load_balancing_policies_ring_hash_v3_RingHash_maximum_ring_size(
+                resource))
+            .value_or(8388608);
+    if (max_ring_size == 0 || max_ring_size > 8388608) {
+      ValidationErrors::ScopedField field(errors, ".maximum_ring_size");
+      errors->AddError("value must be in the range [1, 8388608]");
     }
-    uint64_t min_ring_size = 1024;
-    uint64_value =
-        envoy_extensions_load_balancing_policies_ring_hash_v3_RingHash_minimum_ring_size(
-            resource);
-    if (uint64_value != nullptr) {
-      min_ring_size = google_protobuf_UInt64Value_value(uint64_value);
+    uint64_t min_ring_size =
+        ParseUInt64Value(
+            envoy_extensions_load_balancing_policies_ring_hash_v3_RingHash_minimum_ring_size(
+                resource))
+            .value_or(1024);
+    {
       ValidationErrors::ScopedField field(errors, ".minimum_ring_size");
       if (min_ring_size == 0 || min_ring_size > 8388608) {
         errors->AddError("value must be in the range [1, 8388608]");

data/src/core/xds/grpc/xds_listener_parser.cc

@@ -268,8 +268,8 @@ XdsListenerResource::HttpConnectionManager HttpConnectionManagerParse(
           continue;
         }
         absl::optional<XdsHttpFilterImpl::FilterConfig> filter_config =
-            filter_impl->GenerateFilterConfig(context, std::move(*extension),
-                                              errors);
+            filter_impl->GenerateFilterConfig(name, context,
+                                              std::move(*extension), errors);
         if (filter_config.has_value()) {
           http_connection_manager.http_filters.emplace_back(
               XdsListenerResource::HttpConnectionManager::HttpFilter{
@@ -478,11 +478,11 @@ absl::optional<XdsListenerResource::FilterChainMap::CidrRange> CidrRangeParse(
   }
   cidr_range.address = *address;
   cidr_range.prefix_len = 0;
-  auto* prefix_len_proto =
-      envoy_config_core_v3_CidrRange_prefix_len(cidr_range_proto);
-  if (prefix_len_proto != nullptr) {
+  auto value = ParseUInt32Value(
+      envoy_config_core_v3_CidrRange_prefix_len(cidr_range_proto));
+  if (value.has_value()) {
     cidr_range.prefix_len = std::min(
-        google_protobuf_UInt32Value_value(prefix_len_proto),
+        *value,
         (reinterpret_cast<const grpc_sockaddr*>(cidr_range.address.addr))
                     ->sa_family == GRPC_AF_INET
             ? uint32_t{32}
@@ -499,12 +499,11 @@ absl::optional<FilterChain::FilterChainMatch> FilterChainMatchParse(
   FilterChain::FilterChainMatch filter_chain_match;
   const size_t original_error_size = errors->size();
   // destination_port
-  auto* destination_port =
+  auto destination_port = ParseUInt32Value(
       envoy_config_listener_v3_FilterChainMatch_destination_port(
-          filter_chain_match_proto);
-  if (destination_port != nullptr) {
-    filter_chain_match.destination_port =
-        google_protobuf_UInt32Value_value(destination_port);
+          filter_chain_match_proto));
+  if (destination_port.has_value()) {
+    filter_chain_match.destination_port = *destination_port;
   }
   // prefix_ranges
   size_t size = 0;

data/src/core/xds/grpc/xds_metadata.cc

@@ -0,0 +1,62 @@
+//
+// Copyright 2024 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/xds/grpc/xds_metadata.h"
+
+#include <algorithm>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "absl/log/check.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_join.h"
+#include "absl/strings/string_view.h"
+
+namespace grpc_core {
+
+void XdsMetadataMap::Insert(absl::string_view key,
+                            std::unique_ptr<XdsMetadataValue> value) {
+  CHECK(value != nullptr);
+  CHECK(map_.emplace(key, std::move(value)).second) << "duplicate key: " << key;
+}
+
+const XdsMetadataValue* XdsMetadataMap::Find(absl::string_view key) const {
+  auto it = map_.find(key);
+  if (it == map_.end()) return nullptr;
+  return it->second.get();
+}
+
+bool XdsMetadataMap::operator==(const XdsMetadataMap& other) const {
+  if (map_.size() != other.map_.size()) return false;
+  for (const auto& p : map_) {
+    auto it = other.map_.find(p.first);
+    if (it == other.map_.end()) return false;
+    if (*p.second != *it->second) return false;
+  }
+  return true;
+}
+
+std::string XdsMetadataMap::ToString() const {
+  std::vector<std::string> entries;
+  for (const auto& p : map_) {
+    entries.push_back(absl::StrCat(p.first, "=", p.second->ToString()));
+  }
+  std::sort(entries.begin(), entries.end());
+  return absl::StrCat("{", absl::StrJoin(entries, ", "), "}");
+}
+
+}  // namespace grpc_core

data/src/core/xds/grpc/xds_metadata.h

@@ -0,0 +1,127 @@
+//
+// Copyright 2024 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_XDS_GRPC_XDS_METADATA_H
+#define GRPC_SRC_CORE_XDS_GRPC_XDS_METADATA_H
+
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "absl/container/flat_hash_map.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+
+#include "src/core/lib/gprpp/down_cast.h"
+#include "src/core/lib/gprpp/validation_errors.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/json/json_writer.h"
+
+namespace grpc_core {
+
+// Interface for metadata value types.
+class XdsMetadataValue {
+ public:
+  virtual ~XdsMetadataValue() = default;
+
+  // The proto message name.
+  virtual absl::string_view type() const = 0;
+
+  bool operator==(const XdsMetadataValue& other) const {
+    return type() == other.type() && Equals(other);
+  }
+  bool operator!=(const XdsMetadataValue& other) const {
+    return !(*this == other);
+  }
+
+  virtual std::string ToString() const = 0;
+
+ private:
+  // Called only if the type() methods return the same thing.
+  virtual bool Equals(const XdsMetadataValue& other) const = 0;
+};
+
+// Metadata map.
+class XdsMetadataMap {
+ public:
+  void Insert(absl::string_view key, std::unique_ptr<XdsMetadataValue> value);
+
+  const XdsMetadataValue* Find(absl::string_view key) const;
+
+  bool empty() const { return map_.empty(); }
+  size_t size() const { return map_.size(); }
+
+  bool operator==(const XdsMetadataMap& other) const;
+
+  std::string ToString() const;
+
+ private:
+  absl::flat_hash_map<std::string, std::unique_ptr<XdsMetadataValue>> map_;
+};
+
+// Concrete metadata value type for google.protobuf.Struct.
+class XdsStructMetadataValue : public XdsMetadataValue {
+ public:
+  explicit XdsStructMetadataValue(Json json) : json_(std::move(json)) {}
+
+  static absl::string_view Type() { return "google.protobuf.Struct"; }
+
+  absl::string_view type() const override { return Type(); }
+
+  const Json& json() const { return json_; }
+
+  std::string ToString() const override {
+    return absl::StrCat(type(), "{", JsonDump(json_), "}");
+  }
+
+ private:
+  bool Equals(const XdsMetadataValue& other) const override {
+    return json_ == DownCast<const XdsStructMetadataValue&>(other).json_;
+  }
+
+  Json json_;
+};
+
+// Concrete metadata value type for GCP Authn filter Audience.
+class XdsGcpAuthnAudienceMetadataValue : public XdsMetadataValue {
+ public:
+  explicit XdsGcpAuthnAudienceMetadataValue(absl::string_view url)
+      : url_(url) {}
+
+  static absl::string_view Type() {
+    return "envoy.extensions.filters.http.gcp_authn.v3.Audience";
+  }
+
+  absl::string_view type() const override { return Type(); }
+
+  const std::string& url() const { return url_; }
+
+  std::string ToString() const override {
+    return absl::StrCat(type(), "{url=\"", url_, "\"}");
+  }
+
+ private:
+  bool Equals(const XdsMetadataValue& other) const override {
+    return url_ ==
+           DownCast<const XdsGcpAuthnAudienceMetadataValue&>(other).url_;
+  }
+
+  std::string url_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_XDS_GRPC_XDS_METADATA_H