grpc 1.70.1 → 1.72.0

data/src/core/{lib/security/transport → filter/auth}/client_auth_filter.cc

@@ -31,23 +31,24 @@
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "src/core/call/metadata_batch.h"
+#include "src/core/call/security_context.h"
+#include "src/core/call/status_util.h"
+#include "src/core/credentials/call/call_credentials.h"
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/filter/auth/auth_filters.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/channel/promise_based_filter.h"
-#include "src/core/lib/channel/status_util.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/promise/seq.h"
 #include "src/core/lib/promise/try_seq.h"
 #include "src/core/lib/resource_quota/arena.h"
-#include "src/core/lib/security/context/security_context.h"
-#include "src/core/lib/security/credentials/credentials.h"
-#include "src/core/lib/security/security_connector/security_connector.h"
-#include "src/core/lib/security/transport/auth_filters.h"
-#include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/lib/transport/transport.h"
+#include "src/core/transport/auth_context.h"
 #include "src/core/util/debug_location.h"
 #include "src/core/util/ref_counted_ptr.h"
 
@@ -100,13 +101,103 @@ bool grpc_check_security_level(grpc_security_level channel_level,
 
 namespace grpc_core {
 
+// ClientAuthFilter
+
 ClientAuthFilter::ClientAuthFilter(
     RefCountedPtr<grpc_channel_security_connector> security_connector,
     RefCountedPtr<grpc_auth_context> auth_context)
     : args_{std::move(security_connector), std::move(auth_context)} {}
 
-ArenaPromise<absl::StatusOr<CallArgs>> ClientAuthFilter::GetCallCredsMetadata(
-    CallArgs call_args) {
+absl::StatusOr<RefCountedPtr<grpc_call_credentials>>
+ClientAuthFilter::GetCallCreds() {
+  auto* ctx = GetContext<grpc_client_security_context>();
+  grpc_call_credentials* channel_call_creds =
+      args_.security_connector->mutable_request_metadata_creds();
+  const bool call_creds_has_md = (ctx != nullptr) && (ctx->creds != nullptr);
+
+  if (channel_call_creds == nullptr && !call_creds_has_md) {
+    // Skip sending metadata altogether.
+    return nullptr;
+  }
+
+  RefCountedPtr<grpc_call_credentials> creds;
+  if (channel_call_creds != nullptr && call_creds_has_md) {
+    creds = RefCountedPtr<grpc_call_credentials>(
+        grpc_composite_call_credentials_create(channel_call_creds,
+                                               ctx->creds.get(), nullptr));
+    if (creds == nullptr) {
+      return absl::UnauthenticatedError(
+          "Incompatible credentials set on channel and call.");
+    }
+  } else if (call_creds_has_md) {
+    creds = ctx->creds->Ref();
+  } else {
+    creds = channel_call_creds->Ref();
+  }
+
+  // Check security level of call credential and channel, and do not send
+  // metadata if the check fails.
+  grpc_auth_property_iterator it = grpc_auth_context_find_properties_by_name(
+      args_.auth_context.get(), GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME);
+  const grpc_auth_property* prop = grpc_auth_property_iterator_next(&it);
+  if (prop == nullptr) {
+    return absl::UnauthenticatedError(
+        "Established channel does not have an auth "
+        "property representing a security level.");
+  }
+  const grpc_security_level call_cred_security_level =
+      creds->min_security_level();
+  const bool is_security_level_ok = grpc_check_security_level(
+      convert_security_level_string_to_enum(prop->value),
+      call_cred_security_level);
+  if (!is_security_level_ok) {
+    return absl::UnauthenticatedError(
+        "Established channel does not have a sufficient security level to "
+        "transfer call credential.");
+  }
+
+  return std::move(creds);
+}
+
+void ClientAuthFilter::InstallContext() {
+  auto* sec_ctx = MaybeGetContext<grpc_client_security_context>();
+  if (sec_ctx == nullptr) {
+    sec_ctx = grpc_client_security_context_create(GetContext<Arena>(),
+                                                  /*creds=*/nullptr);
+    SetContext<SecurityContext>(sec_ctx);
+  }
+  sec_ctx->auth_context = args_.auth_context;
+}
+
+absl::StatusOr<std::unique_ptr<ClientAuthFilter>> ClientAuthFilter::Create(
+    const ChannelArgs& args, ChannelFilter::Args) {
+  auto* sc = args.GetObject<grpc_security_connector>();
+  if (sc == nullptr) {
+    return absl::InvalidArgumentError(
+        "Security connector missing from client auth filter args");
+  }
+  auto* auth_context = args.GetObject<grpc_auth_context>();
+  if (auth_context == nullptr) {
+    return absl::InvalidArgumentError(
+        "Auth context missing from client auth filter args");
+  }
+  return std::make_unique<ClientAuthFilter>(
+      sc->RefAsSubclass<grpc_channel_security_connector>(),
+      auth_context->Ref());
+}
+
+const grpc_channel_filter ClientAuthFilter::kFilter =
+    MakePromiseBasedFilter<ClientAuthFilter, FilterEndpoint::kClient>();
+
+// LegacyClientAuthFilter
+
+LegacyClientAuthFilter::LegacyClientAuthFilter(
+    RefCountedPtr<grpc_channel_security_connector> security_connector,
+    RefCountedPtr<grpc_auth_context> auth_context)
+    : args_{std::move(security_connector), std::move(auth_context)} {}
+
+ArenaPromise<absl::StatusOr<CallArgs>>
+LegacyClientAuthFilter::GetCallCredsMetadata(CallArgs call_args) {
   auto* ctx = GetContext<grpc_client_security_context>();
   grpc_call_credentials* channel_call_creds =
       args_.security_connector->mutable_request_metadata_creds();
@@ -172,7 +263,7 @@ ArenaPromise<absl::StatusOr<CallArgs>> ClientAuthFilter::GetCallCredsMetadata(
       });
 }
 
-ArenaPromise<ServerMetadataHandle> ClientAuthFilter::MakeCallPromise(
+ArenaPromise<ServerMetadataHandle> LegacyClientAuthFilter::MakeCallPromise(
     CallArgs call_args, NextPromiseFactory next_promise_factory) {
   auto* sec_ctx = MaybeGetContext<grpc_client_security_context>();
   if (sec_ctx == nullptr) {
@@ -196,8 +287,8 @@ ArenaPromise<ServerMetadataHandle> ClientAuthFilter::MakeCallPromise(
       next_promise_factory);
 }
 
-absl::StatusOr<std::unique_ptr<ClientAuthFilter>> ClientAuthFilter::Create(
-    const ChannelArgs& args, ChannelFilter::Args) {
+absl::StatusOr<std::unique_ptr<ClientAuthFilter>>
+LegacyClientAuthFilter::Create(const ChannelArgs& args, ChannelFilter::Args) {
   auto* sc = args.GetObject<grpc_security_connector>();
   if (sc == nullptr) {
     return absl::InvalidArgumentError(
@@ -213,7 +304,7 @@ absl::StatusOr<std::unique_ptr<ClientAuthFilter>> ClientAuthFilter::Create(
       auth_context->Ref());
 }
 
-const grpc_channel_filter ClientAuthFilter::kFilter =
+const grpc_channel_filter LegacyClientAuthFilter::kFilter =
     MakePromiseBasedFilter<ClientAuthFilter, FilterEndpoint::kClient>();
 
 }  // namespace grpc_core

data/src/core/{lib/security/transport → filter/auth}/server_auth_filter.cc

@@ -34,6 +34,10 @@
 #include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "src/core/call/metadata_batch.h"
+#include "src/core/call/security_context.h"
+#include "src/core/credentials/transport/transport_credentials.h"
+#include "src/core/filter/auth/auth_filters.h"  // IWYU pragma: keep
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/channel_stack.h"
@@ -47,13 +51,10 @@
 #include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/try_seq.h"
 #include "src/core/lib/resource_quota/arena.h"
-#include "src/core/lib/security/context/security_context.h"
-#include "src/core/lib/security/credentials/credentials.h"
-#include "src/core/lib/security/transport/auth_filters.h"  // IWYU pragma: keep
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"
-#include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/lib/transport/transport.h"
+#include "src/core/transport/auth_context.h"
 #include "src/core/util/debug_location.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/status_helper.h"
@@ -63,13 +64,6 @@ namespace grpc_core {
 const grpc_channel_filter ServerAuthFilter::kFilter =
     MakePromiseBasedFilter<ServerAuthFilter, FilterEndpoint::kServer>();
 
-const NoInterceptor ServerAuthFilter::Call::OnClientToServerMessage;
-const NoInterceptor ServerAuthFilter::Call::OnClientToServerHalfClose;
-const NoInterceptor ServerAuthFilter::Call::OnServerToClientMessage;
-const NoInterceptor ServerAuthFilter::Call::OnServerInitialMetadata;
-const NoInterceptor ServerAuthFilter::Call::OnServerTrailingMetadata;
-const NoInterceptor ServerAuthFilter::Call::OnFinalize;
-
 namespace {
 
 class ArrayEncoder {
@@ -151,7 +145,6 @@ void ServerAuthFilter::RunApplicationCode::OnMdProcessingDone(
     void* user_data, const grpc_metadata* consumed_md, size_t num_consumed_md,
     const grpc_metadata* response_md, size_t num_response_md,
     grpc_status_code status, const char* error_details) {
-  ApplicationCallbackExecCtx callback_exec_ctx;
   ExecCtx exec_ctx;
 
   auto* state = static_cast<State*>(user_data);

data/src/core/filter/blackboard.cc

@@ -20,14 +20,14 @@ namespace grpc_core {
 
 RefCountedPtr<Blackboard::Entry> Blackboard::Get(UniqueTypeName type,
                                                  const std::string& key) const {
-  auto it = map_.find(std::make_pair(type, key));
+  auto it = map_.find(std::pair(type, key));
   if (it == map_.end()) return nullptr;
   return it->second;
 }
 
 void Blackboard::Set(UniqueTypeName type, const std::string& key,
                      RefCountedPtr<Entry> entry) {
-  map_[std::make_pair(type, key)] = std::move(entry);
+  map_[std::pair(type, key)] = std::move(entry);
 }
 
 }  // namespace grpc_core

data/src/core/filter/filter_args.h

@@ -51,7 +51,7 @@ class FilterArgs {
 
   ABSL_DEPRECATED("Direct access to channel stack is deprecated")
   grpc_channel_stack* channel_stack() const {
-    return absl::get<ChannelStackBased>(impl_).channel_stack;
+    return std::get<ChannelStackBased>(impl_).channel_stack;
   }
 
   // Get the instance id of this filter.
@@ -100,7 +100,7 @@ class FilterArgs {
     size_t instance_id;
   };
 
-  using Impl = absl::variant<ChannelStackBased, V3Based>;
+  using Impl = std::variant<ChannelStackBased, V3Based>;
   Impl impl_;
 
   const Blackboard* old_blackboard_ = nullptr;

data/src/core/handshaker/handshaker.cc

@@ -53,7 +53,6 @@ void Handshaker::InvokeOnHandshakeDone(
     absl::Status status) {
   args->event_engine->Run([on_handshake_done = std::move(on_handshake_done),
                            status = std::move(status)]() mutable {
-    ApplicationCallbackExecCtx callback_exec_ctx;
     ExecCtx exec_ctx;
     on_handshake_done(std::move(status));
     // Destroy callback while ExecCtx is still in scope.
@@ -109,20 +108,11 @@ void HandshakeManager::DoHandshake(
       acceptor->pending_data != nullptr) {
     grpc_slice_buffer_swap(args_.read_buffer.c_slice_buffer(),
                            &(acceptor->pending_data->data.raw.slice_buffer));
-    // TODO(vigneshbabu): For connections accepted through event engine
-    // listeners, the ownership of the byte buffer received is transferred to
-    // this callback and it is thus this callback's duty to delete it.
-    // Make this hack default once event engine is rolled out.
-    if (grpc_event_engine::experimental::grpc_is_event_engine_endpoint(
-            args_.endpoint.get())) {
-      grpc_byte_buffer_destroy(acceptor->pending_data);
-    }
   }
   // Start deadline timer, which owns a ref.
   const Duration time_to_deadline = deadline - Timestamp::Now();
   deadline_timer_handle_ =
       args_.event_engine->RunAfter(time_to_deadline, [self = Ref()]() mutable {
-        ApplicationCallbackExecCtx callback_exec_ctx;
         ExecCtx exec_ctx;
         self->Shutdown(GRPC_ERROR_CREATE("Handshake timed out"));
         // HandshakeManager deletion might require an active ExecCtx.
@@ -175,7 +165,6 @@ void HandshakeManager::CallNextHandshakerLocked(absl::Status error) {
     if (!error.ok()) result = std::move(error);
     args_.event_engine->Run([on_handshake_done = std::move(on_handshake_done_),
                              result = std::move(result)]() mutable {
-      ApplicationCallbackExecCtx callback_exec_ctx;
       ExecCtx exec_ctx;
       on_handshake_done(std::move(result));
       // Destroy callback while ExecCtx is still in scope.

data/src/core/handshaker/http_connect/http_connect_handshaker.cc

@@ -26,6 +26,7 @@
 #include <string.h>
 
 #include <memory>
+#include <optional>
 #include <string>
 #include <utility>
 
@@ -34,7 +35,6 @@
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "src/core/config/core_configuration.h"
 #include "src/core/handshaker/handshaker.h"
 #include "src/core/handshaker/handshaker_factory.h"
@@ -130,7 +130,6 @@ void HttpConnectHandshaker::OnWriteDoneScheduler(void* arg,
   auto* handshaker = static_cast<HttpConnectHandshaker*>(arg);
   handshaker->args_->event_engine->Run(
       [handshaker, error = std::move(error)]() mutable {
-        ApplicationCallbackExecCtx callback_exec_ctx;
         ExecCtx exec_ctx;
         handshaker->OnWriteDone(std::move(error));
       });
@@ -166,7 +165,6 @@ void HttpConnectHandshaker::OnReadDoneScheduler(void* arg,
   auto* handshaker = static_cast<HttpConnectHandshaker*>(arg);
   handshaker->args_->event_engine->Run(
       [handshaker, error = std::move(error)]() mutable {
-        ApplicationCallbackExecCtx callback_exec_ctx;
         ExecCtx exec_ctx;
         handshaker->OnReadDone(std::move(error));
       });
@@ -260,14 +258,14 @@ void HttpConnectHandshaker::DoHandshake(
     absl::AnyInvocable<void(absl::Status)> on_handshake_done) {
   // Check for HTTP CONNECT channel arg.
   // If not found, invoke on_handshake_done without doing anything.
-  absl::optional<absl::string_view> server_name =
+  std::optional<absl::string_view> server_name =
       args->args.GetString(GRPC_ARG_HTTP_CONNECT_SERVER);
   if (!server_name.has_value()) {
     InvokeOnHandshakeDone(args, std::move(on_handshake_done), absl::OkStatus());
     return;
   }
   // Get headers from channel args.
-  absl::optional<absl::string_view> arg_header_string =
+  std::optional<absl::string_view> arg_header_string =
       args->args.GetString(GRPC_ARG_HTTP_CONNECT_HEADERS);
   grpc_http_header* headers = nullptr;
   size_t num_headers = 0;

data/src/core/handshaker/http_connect/http_proxy_mapper.cc

@@ -25,6 +25,7 @@
 #include <string.h>
 
 #include <memory>
+#include <optional>
 #include <string>
 #include <utility>
 
@@ -40,7 +41,6 @@
 #include "absl/strings/str_split.h"
 #include "absl/strings/string_view.h"
 #include "absl/strings/strip.h"
-#include "absl/types/optional.h"
 #include "src/core/handshaker/http_connect/http_connect_handshaker.h"
 #include "src/core/lib/address_utils/parse_address.h"
 #include "src/core/lib/address_utils/sockaddr_utils.h"
@@ -82,9 +82,9 @@ bool ExactMatchOrSubdomain(absl::string_view host_name,
 
 // Parses the list of host names, addresses or subnet masks and returns true if
 // the target address or host matches any value.
-bool AddressIncluded(
-    const absl::optional<grpc_resolved_address>& target_address,
-    absl::string_view host_name, absl::string_view addresses_and_subnets) {
+bool AddressIncluded(const std::optional<grpc_resolved_address>& target_address,
+                     absl::string_view host_name,
+                     absl::string_view addresses_and_subnets) {
   for (absl::string_view entry :
        absl::StrSplit(addresses_and_subnets, ',', absl::SkipEmpty())) {
     absl::string_view sanitized_entry = absl::StripAsciiWhitespace(entry);
@@ -103,8 +103,8 @@ bool AddressIncluded(
 /// credentials if present in the 'http_proxy' env var, otherwise leaves it
 /// unchanged.
 ///
-absl::optional<std::string> GetHttpProxyServer(
-    const ChannelArgs& args, absl::optional<std::string>* user_cred) {
+std::optional<std::string> GetHttpProxyServer(
+    const ChannelArgs& args, std::optional<std::string>* user_cred) {
   CHECK_NE(user_cred, nullptr);
   absl::StatusOr<URI> uri;
   // We check the following places to determine the HTTP proxy to use, stopping
@@ -115,23 +115,22 @@ absl::optional<std::string> GetHttpProxyServer(
   // 4. http_proxy environment variable
   // If none of the above are set, then no HTTP proxy will be used.
   //
-  absl::optional<std::string> uri_str =
-      args.GetOwnedString(GRPC_ARG_HTTP_PROXY);
+  std::optional<std::string> uri_str = args.GetOwnedString(GRPC_ARG_HTTP_PROXY);
   if (!uri_str.has_value()) uri_str = GetEnv("grpc_proxy");
   if (!uri_str.has_value()) uri_str = GetEnv("https_proxy");
   if (!uri_str.has_value()) uri_str = GetEnv("http_proxy");
-  if (!uri_str.has_value()) return absl::nullopt;
+  if (!uri_str.has_value()) return std::nullopt;
   // an empty value means "don't use proxy"
-  if (uri_str->empty()) return absl::nullopt;
+  if (uri_str->empty()) return std::nullopt;
   uri = URI::Parse(*uri_str);
   if (!uri.ok() || uri->authority().empty()) {
     LOG(ERROR) << "cannot parse value of 'http_proxy' env var. Error: "
                << uri.status();
-    return absl::nullopt;
+    return std::nullopt;
   }
   if (uri->scheme() != "http") {
     LOG(ERROR) << "'" << uri->scheme() << "' scheme not supported in proxy URI";
-    return absl::nullopt;
+    return std::nullopt;
   }
   // Split on '@' to separate user credentials from host
   char** authority_strs = nullptr;
@@ -139,7 +138,7 @@ absl::optional<std::string> GetHttpProxyServer(
   gpr_string_split(uri->authority().c_str(), "@", &authority_strs,
                    &authority_nstrs);
   CHECK_NE(authority_nstrs, 0u);  // should have at least 1 string
-  absl::optional<std::string> proxy_name;
+  std::optional<std::string> proxy_name;
   if (authority_nstrs == 1) {
     // User cred not present in authority
     proxy_name = authority_strs[0];
@@ -150,7 +149,7 @@ absl::optional<std::string> GetHttpProxyServer(
     VLOG(2) << "userinfo found in proxy URI";
   } else {
     // Bad authority
-    proxy_name = absl::nullopt;
+    proxy_name = std::nullopt;
   }
   for (size_t i = 0; i < authority_nstrs; i++) {
     gpr_free(authority_strs[i]);
@@ -170,7 +169,7 @@ std::string MaybeAddDefaultPort(absl::string_view target) {
   return std::string(target);
 }
 
-absl::optional<std::string> GetChannelArgOrEnvVarValue(
+std::optional<std::string> GetChannelArgOrEnvVarValue(
     const ChannelArgs& args, absl::string_view channel_arg,
     const char* env_var) {
   auto arg_value = args.GetOwnedString(channel_arg);
@@ -180,31 +179,31 @@ absl::optional<std::string> GetChannelArgOrEnvVarValue(
   return GetEnv(env_var);
 }
 
-absl::optional<grpc_resolved_address> GetAddressProxyServer(
+std::optional<grpc_resolved_address> GetAddressProxyServer(
     const ChannelArgs& args) {
   auto address_value = GetChannelArgOrEnvVarValue(
       args, GRPC_ARG_ADDRESS_HTTP_PROXY, HttpProxyMapper::kAddressProxyEnvVar);
   if (!address_value.has_value()) {
-    return absl::nullopt;
+    return std::nullopt;
   }
   auto address = StringToSockaddr(*address_value);
   if (!address.ok()) {
     LOG(ERROR) << "cannot parse value of '"
                << std::string(HttpProxyMapper::kAddressProxyEnvVar)
                << "' env var. Error: " << address.status().ToString();
-    return absl::nullopt;
+    return std::nullopt;
   }
   return *address;
 }
 
 }  // namespace
 
-absl::optional<std::string> HttpProxyMapper::MapName(
+std::optional<std::string> HttpProxyMapper::MapName(
     absl::string_view server_uri, ChannelArgs* args) {
   if (!args->GetBool(GRPC_ARG_ENABLE_HTTP_PROXY).value_or(true)) {
-    return absl::nullopt;
+    return std::nullopt;
   }
-  absl::optional<std::string> user_cred;
+  std::optional<std::string> user_cred;
   auto name_to_resolve = GetHttpProxyServer(*args, &user_cred);
   if (!name_to_resolve.has_value()) return name_to_resolve;
   absl::StatusOr<URI> uri = URI::Parse(server_uri);
@@ -212,15 +211,15 @@ absl::optional<std::string> HttpProxyMapper::MapName(
     LOG(ERROR) << "'http_proxy' environment variable set, but cannot "
                   "parse server URI '"
                << server_uri << "' -- not using proxy. Error: " << uri.status();
-    return absl::nullopt;
+    return std::nullopt;
   }
   if (uri->scheme() == "unix") {
     VLOG(2) << "not using proxy for Unix domain socket '" << server_uri << "'";
-    return absl::nullopt;
+    return std::nullopt;
   }
   if (uri->scheme() == "vsock") {
     VLOG(2) << "not using proxy for VSock '" << server_uri << "'";
-    return absl::nullopt;
+    return std::nullopt;
   }
   // Prefer using 'no_grpc_proxy'. Fallback on 'no_proxy' if it is not set.
   auto no_proxy_str = GetEnv("no_grpc_proxy");
@@ -238,12 +237,12 @@ absl::optional<std::string> HttpProxyMapper::MapName(
     } else {
       auto address = StringToSockaddr(server_host, 0);
       if (AddressIncluded(address.ok()
-                              ? absl::optional<grpc_resolved_address>(*address)
-                              : absl::nullopt,
+                              ? std::optional<grpc_resolved_address>(*address)
+                              : std::nullopt,
                           server_host, *no_proxy_str)) {
         VLOG(2) << "not using proxy for host in no_proxy list '" << server_uri
                 << "'";
-        return absl::nullopt;
+        return std::nullopt;
       }
     }
   }
@@ -259,30 +258,30 @@ absl::optional<std::string> HttpProxyMapper::MapName(
   return name_to_resolve;
 }
 
-absl::optional<grpc_resolved_address> HttpProxyMapper::MapAddress(
+std::optional<grpc_resolved_address> HttpProxyMapper::MapAddress(
     const grpc_resolved_address& address, ChannelArgs* args) {
   auto proxy_address = GetAddressProxyServer(*args);
   if (!proxy_address.has_value()) {
-    return absl::nullopt;
+    return std::nullopt;
   }
   auto address_string = grpc_sockaddr_to_string(&address, true);
   if (!address_string.ok()) {
     LOG(ERROR) << "Unable to convert address to string: "
                << address_string.status();
-    return absl::nullopt;
+    return std::nullopt;
   }
   std::string host_name, port;
   if (!SplitHostPort(*address_string, &host_name, &port)) {
     LOG(ERROR) << "Address " << *address_string
                << " cannot be split in host and port";
-    return absl::nullopt;
+    return std::nullopt;
   }
   auto enabled_addresses = GetChannelArgOrEnvVarValue(
       *args, GRPC_ARG_ADDRESS_HTTP_PROXY_ENABLED_ADDRESSES,
       kAddressProxyEnabledAddressesEnvVar);
   if (!enabled_addresses.has_value() ||
       !AddressIncluded(address, host_name, *enabled_addresses)) {
-    return absl::nullopt;
+    return std::nullopt;
   }
   *args = args->Set(GRPC_ARG_HTTP_CONNECT_SERVER, *address_string);
   return proxy_address;

data/src/core/handshaker/http_connect/http_proxy_mapper.h

@@ -21,10 +21,10 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <optional>
 #include <string>
 
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "src/core/config/core_configuration.h"
 #include "src/core/handshaker/proxy_mapper.h"
 #include "src/core/lib/channel/channel_args.h"
@@ -38,10 +38,10 @@ class HttpProxyMapper final : public ProxyMapperInterface {
   static constexpr char const* kAddressProxyEnabledAddressesEnvVar =
       "GRPC_ADDRESS_HTTP_PROXY_ENABLED_ADDRESSES";
 
-  absl::optional<std::string> MapName(absl::string_view server_uri,
-                                      ChannelArgs* args) override;
+  std::optional<std::string> MapName(absl::string_view server_uri,
+                                     ChannelArgs* args) override;
 
-  absl::optional<grpc_resolved_address> MapAddress(
+  std::optional<grpc_resolved_address> MapAddress(
       const grpc_resolved_address& address, ChannelArgs* args) override;
 };
 

data/src/core/handshaker/http_connect/xds_http_proxy_mapper.cc

@@ -17,10 +17,10 @@
 #include "src/core/handshaker/http_connect/xds_http_proxy_mapper.h"
 
 #include <memory>
+#include <optional>
 #include <string>
 
 #include "absl/log/log.h"
-#include "absl/types/optional.h"
 #include "src/core/handshaker/http_connect/http_connect_handshaker.h"
 #include "src/core/lib/address_utils/parse_address.h"
 #include "src/core/lib/address_utils/sockaddr_utils.h"
@@ -29,21 +29,21 @@
 
 namespace grpc_core {
 
-absl::optional<grpc_resolved_address> XdsHttpProxyMapper::MapAddress(
+std::optional<grpc_resolved_address> XdsHttpProxyMapper::MapAddress(
     const grpc_resolved_address& endpoint_address, ChannelArgs* args) {
   auto proxy_address_str = args->GetString(GRPC_ARG_XDS_HTTP_PROXY);
-  if (!proxy_address_str.has_value()) return absl::nullopt;
+  if (!proxy_address_str.has_value()) return std::nullopt;
   auto proxy_address = StringToSockaddr(*proxy_address_str);
   if (!proxy_address.ok()) {
     LOG(ERROR) << "error parsing address \"" << *proxy_address_str
                << "\": " << proxy_address.status();
-    return absl::nullopt;
+    return std::nullopt;
   }
   auto endpoint_address_str = grpc_sockaddr_to_string(&endpoint_address, true);
   if (!endpoint_address_str.ok()) {
     LOG(ERROR) << "error converting address to string: "
                << endpoint_address_str.status();
-    return absl::nullopt;
+    return std::nullopt;
   }
   *args = args->Set(GRPC_ARG_HTTP_CONNECT_SERVER, *endpoint_address_str);
   return *proxy_address;

data/src/core/handshaker/http_connect/xds_http_proxy_mapper.h

@@ -17,10 +17,10 @@
 #ifndef GRPC_SRC_CORE_HANDSHAKER_HTTP_CONNECT_XDS_HTTP_PROXY_MAPPER_H
 #define GRPC_SRC_CORE_HANDSHAKER_HTTP_CONNECT_XDS_HTTP_PROXY_MAPPER_H
 
+#include <optional>
 #include <string>
 
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "src/core/config/core_configuration.h"
 #include "src/core/handshaker/proxy_mapper.h"
 #include "src/core/lib/channel/channel_args.h"
@@ -30,12 +30,12 @@ namespace grpc_core {
 
 class XdsHttpProxyMapper final : public ProxyMapperInterface {
  public:
-  absl::optional<std::string> MapName(absl::string_view /*server_uri*/,
-                                      ChannelArgs* /*args*/) override {
-    return absl::nullopt;
+  std::optional<std::string> MapName(absl::string_view /*server_uri*/,
+                                     ChannelArgs* /*args*/) override {
+    return std::nullopt;
   }
 
-  absl::optional<grpc_resolved_address> MapAddress(
+  std::optional<grpc_resolved_address> MapAddress(
       const grpc_resolved_address& address, ChannelArgs* args) override;
 };
 

data/src/core/handshaker/proxy_mapper.h

@@ -21,10 +21,10 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <optional>
 #include <string>
 
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/resolved_address.h"
 
@@ -37,13 +37,13 @@ class ProxyMapperInterface {
   /// Determines the proxy name to resolve for \a server_uri.
   /// If no proxy is needed, returns nullopt.
   /// Otherwise, updates \a args and returns the name to resolve.
-  virtual absl::optional<std::string> MapName(absl::string_view server_uri,
-                                              ChannelArgs* args) = 0;
+  virtual std::optional<std::string> MapName(absl::string_view server_uri,
+                                             ChannelArgs* args) = 0;
 
   /// Determines the proxy address to use to contact \a address.
   /// If no proxy is needed, returns nullopt.
   /// Otherwise, updates \a args, and returns a new address.
-  virtual absl::optional<grpc_resolved_address> MapAddress(
+  virtual std::optional<grpc_resolved_address> MapAddress(
       const grpc_resolved_address& address, ChannelArgs* args) = 0;
 };