grpc 1.72.0 → 1.74.0.pre2

data/src/core/credentials/transport/alts/alts_security_connector.cc

@@ -102,10 +102,11 @@ class grpc_alts_channel_security_connector final
         static_cast<const grpc_alts_credentials*>(channel_creds());
     const size_t user_specified_max_frame_size =
         std::max(0, args.GetInt(GRPC_ARG_TSI_MAX_FRAME_SIZE).value_or(0));
-    CHECK(alts_tsi_handshaker_create(creds->options(), target_name_,
-                                     creds->handshaker_service_url(), true,
-                                     interested_parties, &handshaker,
-                                     user_specified_max_frame_size) == TSI_OK);
+    CHECK(alts_tsi_handshaker_create(
+              creds->options(), target_name_, creds->handshaker_service_url(),
+              true, interested_parties, &handshaker,
+              user_specified_max_frame_size,
+              args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS)) == TSI_OK);
     handshake_manager->Add(
         grpc_core::SecurityHandshakerCreate(handshaker, this, args));
   }
@@ -155,10 +156,10 @@ class grpc_alts_server_security_connector final
         static_cast<const grpc_alts_server_credentials*>(server_creds());
     size_t user_specified_max_frame_size =
         std::max(0, args.GetInt(GRPC_ARG_TSI_MAX_FRAME_SIZE).value_or(0));
-    CHECK(alts_tsi_handshaker_create(creds->options(), nullptr,
-                                     creds->handshaker_service_url(), false,
-                                     interested_parties, &handshaker,
-                                     user_specified_max_frame_size) == TSI_OK);
+    CHECK(alts_tsi_handshaker_create(
+              creds->options(), nullptr, creds->handshaker_service_url(), false,
+              interested_parties, &handshaker, user_specified_max_frame_size,
+              args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS)) == TSI_OK);
     handshake_manager->Add(
         grpc_core::SecurityHandshakerCreate(handshaker, this, args));
   }

data/src/core/credentials/transport/channel_creds_registry_init.cc

@@ -57,7 +57,7 @@ class GoogleDefaultChannelCredsFactory : public ChannelCredsFactory<> {
   RefCountedPtr<grpc_channel_credentials> CreateChannelCreds(
       RefCountedPtr<ChannelCredsConfig> /*config*/) const override {
     return RefCountedPtr<grpc_channel_credentials>(
-        grpc_google_default_credentials_create(nullptr));
+        grpc_google_default_credentials_create(nullptr, nullptr));
   }
 
  private:

data/src/core/credentials/transport/google_default/google_default_credentials.cc

@@ -42,6 +42,7 @@
 #include "src/core/credentials/call/jwt/json_token.h"
 #include "src/core/credentials/call/jwt/jwt_credentials.h"
 #include "src/core/credentials/call/oauth2/oauth2_credentials.h"
+#include "src/core/credentials/transport/alts/alts_security_connector.h"
 #include "src/core/credentials/transport/alts/check_gcp_environment.h"
 #include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/lib/channel/channel_args.h"
@@ -217,9 +218,9 @@ static int is_metadata_server_reachable() {
   detector.is_done = 0;
   detector.success = 0;
   memset(&request, 0, sizeof(grpc_http_request));
-  auto uri =
-      grpc_core::URI::Create("http", GRPC_COMPUTE_ENGINE_DETECTION_HOST, "/",
-                             {} /* query params */, "" /* fragment */);
+  auto uri = grpc_core::URI::Create("http", /*user_info=*/"",
+                                    GRPC_COMPUTE_ENGINE_DETECTION_HOST, "/",
+                                    {} /* query params */, "" /* fragment */);
   CHECK(uri.ok());  // params are hardcoded
   auto http_request = grpc_core::HttpRequest::Get(
       std::move(*uri), nullptr /* channel args */, &detector.pollent, &request,
@@ -338,6 +339,65 @@ static bool metadata_server_available() {
   return static_cast<bool>(g_metadata_server_available);
 }
 
+// A grpc_call_credentials implementation that uses two
+// underlying credentials: one for TLS and one for ALTS.
+// The implementation will pick the right credentials based on the auth
+// context's GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME property.
+class GoogleDefaultCallCredentialsWrapper : public grpc_call_credentials {
+ public:
+  GoogleDefaultCallCredentialsWrapper(
+      grpc_core::RefCountedPtr<grpc_call_credentials> tls_credentials,
+      grpc_core::RefCountedPtr<grpc_call_credentials> alts_credentials)
+      : tls_credentials_(std::move(tls_credentials)),
+        alts_credentials_(std::move(alts_credentials)) {};
+
+  void Orphaned() override {
+    tls_credentials_.reset();
+    alts_credentials_.reset();
+  }
+
+  static grpc_core::UniqueTypeName Type() {
+    static grpc_core::UniqueTypeName::Factory kFactory("Dual");
+    return kFactory.Create();
+  }
+
+  grpc_core::UniqueTypeName type() const override { return Type(); }
+
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
+                     const GetRequestMetadataArgs* args) override {
+    bool use_alts = false;
+    if (args != nullptr) {
+      auto auth_context = args->auth_context;
+      if (auth_context != nullptr &&
+          grpc_auth_context_peer_is_authenticated(auth_context.get()) == 1) {
+        // This channel is authenticated.
+        grpc_auth_property_iterator property_it =
+            grpc_auth_context_find_properties_by_name(
+                auth_context.get(), GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME);
+        const grpc_auth_property* property =
+            grpc_auth_property_iterator_next(&property_it);
+        use_alts =
+            property != nullptr &&
+            strcmp(property->value, GRPC_ALTS_TRANSPORT_SECURITY_TYPE) == 0;
+      }
+    }
+    return (use_alts ? alts_credentials_ : tls_credentials_)
+        ->GetRequestMetadata(std::move(initial_metadata), args);
+  }
+
+ private:
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    return QsortCompare(static_cast<const grpc_call_credentials*>(this), other);
+  }
+  std::string debug_string() override {
+    return "GoogleDefaultCallCredentialsWrapper";
+  }
+
+  grpc_core::RefCountedPtr<grpc_call_credentials> tls_credentials_;
+  grpc_core::RefCountedPtr<grpc_call_credentials> alts_credentials_;
+};
+
 static grpc_core::RefCountedPtr<grpc_call_credentials> make_default_call_creds(
     grpc_error_handle* error) {
   grpc_core::RefCountedPtr<grpc_call_credentials> call_creds;
@@ -373,14 +433,16 @@ static grpc_core::RefCountedPtr<grpc_call_credentials> make_default_call_creds(
 }
 
 grpc_channel_credentials* grpc_google_default_credentials_create(
-    grpc_call_credentials* call_credentials) {
+    grpc_call_credentials* call_creds_for_tls,
+    grpc_call_credentials* call_creds_for_alts) {
   grpc_channel_credentials* result = nullptr;
-  grpc_core::RefCountedPtr<grpc_call_credentials> call_creds(call_credentials);
+  grpc_core::RefCountedPtr<grpc_call_credentials> call_creds(
+      call_creds_for_tls);
   grpc_error_handle error;
   grpc_core::ExecCtx exec_ctx;
 
   GRPC_TRACE_LOG(api, INFO)
-      << "grpc_google_default_credentials_create(" << call_credentials << ")";
+      << "grpc_google_default_credentials_create(" << call_creds_for_tls << ")";
 
   if (call_creds == nullptr) {
     call_creds = make_default_call_creds(&error);
@@ -400,6 +462,13 @@ grpc_channel_credentials* grpc_google_default_credentials_create(
         grpc_core::MakeRefCounted<grpc_google_default_channel_credentials>(
             grpc_core::RefCountedPtr<grpc_channel_credentials>(alts_creds),
             grpc_core::RefCountedPtr<grpc_channel_credentials>(ssl_creds));
+    if (call_creds_for_alts != nullptr) {
+      grpc_core::RefCountedPtr<grpc_call_credentials> alts_call_creds(
+          call_creds_for_alts);
+      call_creds =
+          grpc_core::MakeRefCounted<GoogleDefaultCallCredentialsWrapper>(
+              std::move(call_creds), std::move(alts_call_creds));
+    }
     result = grpc_composite_channel_credentials_create(
         creds.get(), call_creds.get(), nullptr);
     CHECK_NE(result, nullptr);
@@ -412,7 +481,6 @@ grpc_channel_credentials* grpc_google_default_credentials_create(
 
 namespace grpc_core {
 namespace internal {
-
 void set_gce_tenancy_checker_for_testing(grpc_gce_tenancy_checker checker) {
   g_gce_tenancy_checker = checker;
 }

data/src/core/credentials/transport/ssl/ssl_credentials.cc

@@ -58,7 +58,6 @@ grpc_ssl_credentials::grpc_ssl_credentials(
       root_store_ = grpc_core::DefaultSslRootStore::GetRootStore();
     }
   } else {
-    config_.pem_root_certs = config_.pem_root_certs;
     root_store_ = nullptr;
   }
 
@@ -278,8 +277,8 @@ grpc_ssl_server_credentials::~grpc_ssl_server_credentials() {
 }
 grpc_core::RefCountedPtr<grpc_server_security_connector>
 grpc_ssl_server_credentials::create_security_connector(
-    const grpc_core::ChannelArgs& /* args */) {
-  return grpc_ssl_server_security_connector_create(this->Ref());
+    const grpc_core::ChannelArgs& args) {
+  return grpc_ssl_server_security_connector_create(this->Ref(), args);
 }
 
 grpc_core::UniqueTypeName grpc_ssl_server_credentials::Type() {

data/src/core/credentials/transport/ssl/ssl_security_connector.cc

@@ -108,7 +108,8 @@ class grpc_ssl_channel_security_connector final
         overridden_target_name_.empty() ? target_name_.c_str()
                                         : overridden_target_name_.c_str(),
         /*network_bio_buf_size=*/0,
-        /*ssl_bio_buf_size=*/0, &tsi_hs);
+        /*ssl_bio_buf_size=*/0,
+        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);
@@ -198,7 +199,24 @@ class grpc_ssl_server_security_connector
     return server_handshaker_factory_;
   }
 
-  grpc_security_status InitializeHandshakerFactory() {
+  // Helper method to initialize the handshaker factory for all handshaker on
+  // the server side.
+  // - alpn_preferred_protocol_raw_list: an optional string that represents the
+  // comma-separated ordered list of preferred protocols for alpn negotiation on
+  // this server.
+  //
+  // For the server handshaker, override the preferred protocols given
+  // by the channel args on the handshaker factory creation. Do this for all
+  // handshake that a server may produce because it is unlikely that a server
+  // handshaker would change protocol list per handshake.
+  //
+  // OpenSSL's provided method to override the selection of the handshaker
+  // protocols for alpn is only available per context base which makes it
+  // thread-unsafe. The introduction of a lock in the server callback may make
+  // the alternative thread-safe, however it will introduce too much contention
+  // which in turn will affect performance.
+  grpc_security_status InitializeHandshakerFactory(
+      std::optional<std::string> alpn_preferred_protocol_raw_list) {
     if (has_cert_config_fetcher()) {
       // Load initial credentials from certificate_config_fetcher:
       if (!try_fetch_ssl_server_credentials()) {
@@ -209,8 +227,17 @@ class grpc_ssl_server_security_connector
       auto* server_credentials =
           static_cast<const grpc_ssl_server_credentials*>(server_creds());
       size_t num_alpn_protocols = 0;
-      const char** alpn_protocol_strings =
-          grpc_fill_alpn_protocol_strings(&num_alpn_protocols);
+      const char** alpn_protocol_strings = nullptr;
+      if (alpn_preferred_protocol_raw_list.has_value()) {
+#if TSI_OPENSSL_ALPN_SUPPORT
+        alpn_protocol_strings = ParseAlpnStringIntoArray(
+            alpn_preferred_protocol_raw_list.value(), &num_alpn_protocols);
+#endif  // TSI_OPENSSL_ALPN_SUPPORT
+      }
+      if (alpn_protocol_strings == nullptr) {
+        alpn_protocol_strings =
+            grpc_fill_alpn_protocol_strings(&num_alpn_protocols);
+      }
       tsi_ssl_server_handshaker_options options;
       options.pem_key_cert_pairs =
           server_credentials->config().pem_key_cert_pairs;
@@ -277,9 +304,10 @@ class grpc_ssl_server_security_connector
   }
 
  private:
-  // Attempts to fetch the server certificate config if a callback is available.
-  // Current certificate config will continue to be used if the callback returns
-  // an error. Returns true if new credentials were successfully loaded.
+  // Attempts to fetch the server certificate config if a callback is
+  // available. Current certificate config will continue to be used if the
+  // callback returns an error. Returns true if new credentials were
+  // successfully loaded.
   bool try_fetch_ssl_server_credentials() {
     grpc_ssl_server_certificate_config* certificate_config = nullptr;
     bool status;
@@ -307,8 +335,8 @@ class grpc_ssl_server_security_connector
     return status;
   }
 
-  // Attempts to replace the server_handshaker_factory with a new factory using
-  // the provided grpc_ssl_server_certificate_config. Should new factory
+  // Attempts to replace the server_handshaker_factory with a new factory
+  // using the provided grpc_ssl_server_certificate_config. Should new factory
   // creation fail, the existing factory will not be replaced. Returns true on
   // success (new factory created).
   bool try_replace_server_handshaker_factory(
@@ -390,12 +418,14 @@ grpc_ssl_channel_security_connector_create(
 
 grpc_core::RefCountedPtr<grpc_server_security_connector>
 grpc_ssl_server_security_connector_create(
-    grpc_core::RefCountedPtr<grpc_server_credentials> server_credentials) {
+    grpc_core::RefCountedPtr<grpc_server_credentials> server_credentials,
+    const grpc_core::ChannelArgs& args) {
   CHECK(server_credentials != nullptr);
   grpc_core::RefCountedPtr<grpc_ssl_server_security_connector> c =
       grpc_core::MakeRefCounted<grpc_ssl_server_security_connector>(
           std::move(server_credentials));
-  const grpc_security_status retval = c->InitializeHandshakerFactory();
+  const grpc_security_status retval = c->InitializeHandshakerFactory(
+      args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS));
   if (retval != GRPC_SECURITY_OK) {
     return nullptr;
   }

data/src/core/credentials/transport/ssl/ssl_security_connector.h

@@ -76,6 +76,7 @@ struct grpc_ssl_server_config {
 //
 grpc_core::RefCountedPtr<grpc_server_security_connector>
 grpc_ssl_server_security_connector_create(
-    grpc_core::RefCountedPtr<grpc_server_credentials> server_credentials);
+    grpc_core::RefCountedPtr<grpc_server_credentials> server_credentials,
+    const grpc_core::ChannelArgs& args);
 
 #endif  // GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_SSL_SSL_SECURITY_CONNECTOR_H

data/src/core/credentials/transport/tls/load_system_roots_supported.cc

@@ -131,6 +131,7 @@ grpc_slice CreateRootCertsBundle(const char* certs_directory) {
       } else {
         LOG(ERROR) << "failed to read file: " << roots_filenames[i].path;
       }
+      close(file_descriptor);
     }
   }
   bundle_slice = grpc_slice_new(bundle_string, bytes_read, gpr_free);

data/src/core/credentials/transport/tls/ssl_utils.cc

@@ -200,6 +200,24 @@ const char** grpc_fill_alpn_protocol_strings(size_t* num_alpn_protocols) {
   return alpn_protocol_strings;
 }
 
+const char** ParseAlpnStringIntoArray(absl::string_view preferred_protocols_raw,
+                                      size_t* num_alpn_protocols) {
+  CHECK_NE(num_alpn_protocols, nullptr);
+  std::vector<std::string> preferred_protocols;
+  preferred_protocols =
+      absl::StrSplit(preferred_protocols_raw, ',', absl::SkipWhitespace());
+  *num_alpn_protocols = preferred_protocols.size();
+  const char** alpn_protocol_strings = nullptr;
+  if (*num_alpn_protocols != 0) {
+    alpn_protocol_strings = static_cast<const char**>(
+        gpr_malloc(sizeof(const char*) * (*num_alpn_protocols)));
+    for (size_t i = 0; i < *num_alpn_protocols; i++) {
+      alpn_protocol_strings[i] = gpr_strdup(preferred_protocols[i].c_str());
+    }
+  }
+  return alpn_protocol_strings;
+}
+
 int grpc_ssl_host_matches_name(const tsi_peer* peer,
                                absl::string_view peer_name) {
   absl::string_view allocated_name;

data/src/core/credentials/transport/tls/ssl_utils.h

@@ -77,6 +77,11 @@ tsi_tls_version grpc_get_tsi_tls_version(grpc_tls_version tls_version);
 // Return an array of strings containing alpn protocols.
 const char** grpc_fill_alpn_protocol_strings(size_t* num_alpn_protocols);
 
+// Parse a list of comma-separated protocol names into a const char** struct
+// that can be injected into the handshaker factory options.
+const char** ParseAlpnStringIntoArray(absl::string_view preferred_protocols,
+                                      size_t* num_alpn_protocols);
+
 // Initialize TSI SSL server/client handshaker factory.
 grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
     tsi_ssl_pem_key_cert_pair* key_cert_pair, const char* pem_root_certs,

data/src/core/credentials/transport/tls/tls_security_connector.cc

@@ -347,7 +347,8 @@ void TlsChannelSecurityConnector::add_handshakers(
         overridden_target_name_.empty() ? target_name_.c_str()
                                         : overridden_target_name_.c_str(),
         /*network_bio_buf_size=*/0,
-        /*ssl_bio_buf_size=*/0, &tsi_hs);
+        /*ssl_bio_buf_size=*/0,
+        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);

data/src/core/credentials/transport/xds/xds_credentials.cc

@@ -134,9 +134,6 @@ RefCountedPtr<grpc_channel_security_connector>
 XdsCredentials::create_security_connector(
     RefCountedPtr<grpc_call_credentials> call_creds, const char* target_name,
     ChannelArgs* args) {
-  // TODO(yashykt): This arg will no longer need to be added after b/173119596
-  // is fixed.
-  *args = args->SetIfUnset(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG, target_name);
   RefCountedPtr<grpc_channel_security_connector> security_connector;
   auto xds_certificate_provider = args->GetObjectRef<XdsCertificateProvider>();
   if (xds_certificate_provider != nullptr) {

data/src/core/ext/filters/channel_idle/legacy_channel_idle_filter.cc

@@ -50,6 +50,7 @@
 #include "src/core/util/no_destruct.h"
 #include "src/core/util/orphanable.h"
 #include "src/core/util/per_cpu.h"
+#include "src/core/util/shared_bit_gen.h"
 #include "src/core/util/status_helper.h"
 #include "src/core/util/sync.h"
 
@@ -107,9 +108,11 @@ struct LegacyMaxAgeFilter::Config {
         return absl::Uniform(bit_gen, min, max);
       }
     };
-    static NoDestruct<PerCpu<BitGen>> bit_gen(PerCpuOptions().SetMaxShards(8));
-    const double multiplier = bit_gen->this_cpu().MakeUniformDouble(
-        1.0 - kMaxConnectionAgeJitter, 1.0 + kMaxConnectionAgeJitter);
+    const double multiplier = []() {
+      SharedBitGen g;
+      return absl::Uniform(g, 1.0 - kMaxConnectionAgeJitter,
+                           1.0 + kMaxConnectionAgeJitter);
+    }();
     // GRPC_MILLIS_INF_FUTURE - 0.5 converts the value to float, so that result
     // will not be cast to int implicitly before the comparison.
     return Config{args_max_age * multiplier, args_max_idle * multiplier,

data/src/core/ext/filters/gcp_authentication/gcp_authentication_filter.cc

@@ -167,14 +167,14 @@ GcpAuthenticationFilter::Create(const ChannelArgs& args,
     return absl::InvalidArgumentError(
         "gcp_auth: xds config not found in channel args");
   }
-  // Get existing cache or create new one.
-  auto cache = filter_args.GetOrCreateState<CallCredentialsCache>(
-      filter_config->filter_instance_name, [&]() {
-        return MakeRefCounted<CallCredentialsCache>(filter_config->cache_size);
-      });
-  // Make sure size is updated, in case we're reusing a pre-existing
-  // cache but it has the wrong size.
-  cache->SetMaxSize(filter_config->cache_size);
+  // Get cache from blackboard.  This must have been populated
+  // previously by the XdsConfigSelector.
+  auto cache = filter_args.GetState<CallCredentialsCache>(
+      filter_config->filter_instance_name);
+  if (cache == nullptr) {
+    return absl::InvalidArgumentError(
+        "gcp_auth: cache object not found in filter state");
+  }
   // Instantiate filter.
   return std::unique_ptr<GcpAuthenticationFilter>(
       new GcpAuthenticationFilter(std::move(service_config), filter_config,

data/src/core/ext/filters/gcp_authentication/gcp_authentication_filter.h

@@ -42,6 +42,22 @@ namespace grpc_core {
 class GcpAuthenticationFilter
     : public ImplementChannelFilter<GcpAuthenticationFilter> {
  public:
+  class CallCredentialsCache : public Blackboard::Entry {
+   public:
+    explicit CallCredentialsCache(size_t max_size) : cache_(max_size) {}
+
+    static UniqueTypeName Type();
+
+    void SetMaxSize(size_t max_size);
+
+    RefCountedPtr<grpc_call_credentials> Get(const std::string& audience);
+
+   private:
+    Mutex mu_;
+    LruCache<std::string /*audience*/, RefCountedPtr<grpc_call_credentials>>
+        cache_ ABSL_GUARDED_BY(&mu_);
+  };
+
   static const grpc_channel_filter kFilter;
 
   static absl::string_view TypeName() { return "gcp_authentication_filter"; }
@@ -62,22 +78,6 @@ class GcpAuthenticationFilter
   };
 
  private:
-  class CallCredentialsCache : public Blackboard::Entry {
-   public:
-    explicit CallCredentialsCache(size_t max_size) : cache_(max_size) {}
-
-    static UniqueTypeName Type();
-
-    void SetMaxSize(size_t max_size);
-
-    RefCountedPtr<grpc_call_credentials> Get(const std::string& audience);
-
-   private:
-    Mutex mu_;
-    LruCache<std::string /*audience*/, RefCountedPtr<grpc_call_credentials>>
-        cache_ ABSL_GUARDED_BY(&mu_);
-  };
-
   GcpAuthenticationFilter(
       RefCountedPtr<ServiceConfig> service_config,
       const GcpAuthenticationParsedConfig::Config* filter_config,

data/src/core/ext/filters/http/client_authority_filter.cc

@@ -73,13 +73,11 @@ void RegisterClientAuthorityFilter(CoreConfiguration::Builder* builder) {
   builder->channel_init()
       ->RegisterFilter<ClientAuthorityFilter>(GRPC_CLIENT_SUBCHANNEL)
       .If(NeedsClientAuthorityFilter)
-      .Before<ClientAuthFilter>()
-      .Before<LegacyClientAuthFilter>();
+      .Before<ClientAuthFilter>();
   builder->channel_init()
       ->RegisterFilter<ClientAuthorityFilter>(GRPC_CLIENT_DIRECT_CHANNEL)
       .If(NeedsClientAuthorityFilter)
-      .Before<ClientAuthFilter>()
-      .Before<LegacyClientAuthFilter>();
+      .Before<ClientAuthFilter>();
 }
 
 }  // namespace grpc_core

data/src/core/ext/filters/http/message_compress/compression_filter.h

@@ -24,11 +24,13 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include <cstddef>
 #include <optional>
 
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 #include "src/core/call/metadata_batch.h"
+#include "src/core/channelz/property_list.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
@@ -91,6 +93,17 @@ class ChannelCompression {
       bool is_client, MessageHandle message, DecompressArgs args,
       CallTracerInterface* call_tracer) const;
 
+  channelz::PropertyList ChannelzProperties() const {
+    return channelz::PropertyList()
+        .Set("max_recv_size", max_recv_size_)
+        .Set("default_compression_algorithm",
+             CompressionAlgorithmAsString(default_compression_algorithm_))
+        .Set("enabled_compression_algorithms",
+             enabled_compression_algorithms_.ToString())
+        .Set("enable_compression", enable_compression_)
+        .Set("enable_decompression", enable_decompression_);
+  }
+
  private:
   // Max receive message length, if set.
   std::optional<uint32_t> max_recv_size_;
@@ -106,7 +119,8 @@ class ChannelCompression {
 };
 
 class ClientCompressionFilter final
-    : public ImplementChannelFilter<ClientCompressionFilter> {
+    : public ImplementChannelFilter<ClientCompressionFilter>,
+      public channelz::DataSource {
  public:
   static const grpc_channel_filter kFilter;
 
@@ -116,7 +130,16 @@ class ClientCompressionFilter final
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
   explicit ClientCompressionFilter(const ChannelArgs& args)
-      : compression_engine_(args) {}
+      : channelz::DataSource(args.GetObjectRef<channelz::BaseNode>()),
+        compression_engine_(args) {
+    SourceConstructed();
+  }
+  ~ClientCompressionFilter() override { SourceDestructing(); }
+
+  void AddData(channelz::DataSink sink) override {
+    sink.AddData("clientCompressionFilter",
+                 compression_engine_.ChannelzProperties());
+  }
 
   // Construct a promise for one call.
   class Call {
@@ -148,7 +171,8 @@ class ClientCompressionFilter final
 };
 
 class ServerCompressionFilter final
-    : public ImplementChannelFilter<ServerCompressionFilter> {
+    : public ImplementChannelFilter<ServerCompressionFilter>,
+      public channelz::DataSource {
  public:
   static const grpc_channel_filter kFilter;
 
@@ -158,7 +182,16 @@ class ServerCompressionFilter final
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
   explicit ServerCompressionFilter(const ChannelArgs& args)
-      : compression_engine_(args) {}
+      : channelz::DataSource(args.GetObjectRef<channelz::BaseNode>()),
+        compression_engine_(args) {
+    SourceConstructed();
+  }
+  ~ServerCompressionFilter() override { SourceDestructing(); }
+
+  void AddData(channelz::DataSink sink) override {
+    sink.AddData("serverCompressionFilter",
+                 compression_engine_.ChannelzProperties());
+  }
 
   // Construct a promise for one call.
   class Call {

data/src/core/ext/filters/http/server/http_server_filter.cc

@@ -153,7 +153,7 @@ void HttpServerFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
 absl::StatusOr<std::unique_ptr<HttpServerFilter>> HttpServerFilter::Create(
     const ChannelArgs& args, ChannelFilter::Args) {
   return std::make_unique<HttpServerFilter>(
-      args.GetBool(GRPC_ARG_SURFACE_USER_AGENT).value_or(true),
+      args, args.GetBool(GRPC_ARG_SURFACE_USER_AGENT).value_or(true),
       args.GetBool(
               GRPC_ARG_DO_NOT_USE_UNLESS_YOU_HAVE_PERMISSION_FROM_GRPC_TEAM_ALLOW_BROKEN_PUT_REQUESTS)
           .value_or(false));

data/src/core/ext/filters/http/server/http_server_filter.h

@@ -22,16 +22,16 @@
 #include <grpc/support/port_platform.h>
 
 #include "absl/status/statusor.h"
+#include "src/core/channelz/property_list.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
-#include "src/core/lib/promise/arena_promise.h"
-#include "src/core/lib/transport/transport.h"
 
 namespace grpc_core {
 
 // Processes metadata on the server side for HTTP2 transports
-class HttpServerFilter : public ImplementChannelFilter<HttpServerFilter> {
+class HttpServerFilter final : public ImplementChannelFilter<HttpServerFilter>,
+                               public channelz::DataSource {
  public:
   static const grpc_channel_filter kFilter;
 
@@ -40,9 +40,21 @@ class HttpServerFilter : public ImplementChannelFilter<HttpServerFilter> {
   static absl::StatusOr<std::unique_ptr<HttpServerFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
-  HttpServerFilter(bool surface_user_agent, bool allow_put_requests)
-      : surface_user_agent_(surface_user_agent),
-        allow_put_requests_(allow_put_requests) {}
+  HttpServerFilter(const ChannelArgs& args, bool surface_user_agent,
+                   bool allow_put_requests)
+      : channelz::DataSource(args.GetObjectRef<channelz::BaseNode>()),
+        surface_user_agent_(surface_user_agent),
+        allow_put_requests_(allow_put_requests) {
+    SourceConstructed();
+  }
+  ~HttpServerFilter() override { SourceDestructing(); }
+
+  void AddData(channelz::DataSink sink) override {
+    sink.AddData("httpServerFilter",
+                 channelz::PropertyList()
+                     .Set("surface_user_agent", surface_user_agent_)
+                     .Set("allow_put_requests", allow_put_requests_));
+  }
 
   class Call {
    public: