grpc 1.72.0 → 1.74.0.pre2

data/src/core/util/uri.cc

@@ -103,6 +103,29 @@ bool IsAuthorityChar(char c) {
   return false;
 }
 
+// Returns true for any character in user_info, as defined in:
+// https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.1
+bool IsUserInfoChar(char c) {
+  if (IsUnreservedChar(c)) return true;
+  if (IsSubDelimChar(c)) return true;
+  if (c == ':') return true;
+  return false;
+}
+
+// Returns true for any character in host_port, as defined in:
+// https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
+bool IsHostPortChar(char c) {
+  if (IsUnreservedChar(c)) return true;
+  if (IsSubDelimChar(c)) return true;
+  switch (c) {
+    case ':':
+    case '[':
+    case ']':
+      return true;
+  }
+  return false;
+}
+
 // Returns true for any character in pchar, as defined in:
 // https://datatracker.ietf.org/doc/html/rfc3986#section-3.3
 bool IsPChar(char c) {
@@ -204,6 +227,13 @@ std::string URI::PercentDecode(absl::string_view str) {
   return out;
 }
 
+std::string URI::authority() const {
+  if (!user_info_.empty()) {
+    return absl::StrCat(user_info_, "@", host_port_);
+  }
+  return host_port_;
+}
+
 absl::StatusOr<URI> URI::Parse(absl::string_view uri_text) {
   absl::string_view remaining = uri_text;
   // parse scheme
@@ -225,10 +255,23 @@ absl::StatusOr<URI> URI::Parse(absl::string_view uri_text) {
   }
   remaining.remove_prefix(offset + 1);
   // parse authority
-  std::string authority;
+  std::string user_info;
+  std::string host_port;
   if (absl::ConsumePrefix(&remaining, "//")) {
     offset = remaining.find_first_of("/?#");
-    authority = PercentDecode(remaining.substr(0, offset));
+    absl::string_view encoded_authority = remaining.substr(0, offset);
+    // parse user_info and host_port
+    absl::string_view encoded_user_info;
+    absl::string_view encoded_host_port;
+    size_t at_pos = encoded_authority.rfind('@');
+    if (at_pos == absl::string_view::npos) {
+      encoded_host_port = encoded_authority;
+    } else {
+      encoded_user_info = encoded_authority.substr(0, at_pos);
+      encoded_host_port = encoded_authority.substr(at_pos + 1);
+    }
+    user_info = PercentDecode(encoded_user_info);
+    host_port = PercentDecode(encoded_host_port);
     if (offset == remaining.npos) {
       remaining = "";
     } else {
@@ -279,29 +322,38 @@ absl::StatusOr<URI> URI::Parse(absl::string_view uri_text) {
     }
     fragment = PercentDecode(remaining);
   }
-  return URI(std::move(scheme), std::move(authority), std::move(path),
-             std::move(query_param_pairs), std::move(fragment));
+  return URI(std::move(scheme), std::move(user_info), std::move(host_port),
+             std::move(path), std::move(query_param_pairs),
+             std::move(fragment));
 }
 
-absl::StatusOr<URI> URI::Create(std::string scheme, std::string authority,
-                                std::string path,
+absl::StatusOr<URI> URI::Create(std::string scheme, std::string user_info,
+                                std::string host_port, std::string path,
                                 std::vector<QueryParam> query_parameter_pairs,
                                 std::string fragment) {
-  if (!authority.empty() && !path.empty() && path[0] != '/') {
+  if (!host_port.empty() && !path.empty() && path[0] != '/') {
     return absl::InvalidArgumentError(
-        "if authority is present, path must start with a '/'");
+        "if host_port is present, path must start with a '/'");
   }
-  return URI(std::move(scheme), std::move(authority), std::move(path),
-             std::move(query_parameter_pairs), std::move(fragment));
+  if (!user_info.empty() && host_port.empty()) {
+    return absl::InvalidArgumentError(
+        "if user_info is present, host_port must be present");
+  }
+  return URI(std::move(scheme), std::move(user_info), std::move(host_port),
+             std::move(path), std::move(query_parameter_pairs),
+             std::move(fragment));
 }
 
-URI::URI(std::string scheme, std::string authority, std::string path,
-         std::vector<QueryParam> query_parameter_pairs, std::string fragment)
+URI::URI(std::string scheme, std::string user_info, std::string host_port,
+         std::string path, std::vector<QueryParam> query_parameter_pairs,
+         std::string fragment)
     : scheme_(std::move(scheme)),
-      authority_(std::move(authority)),
+      user_info_(std::move(user_info)),
+      host_port_(std::move(host_port)),
       path_(std::move(path)),
       query_parameter_pairs_(std::move(query_parameter_pairs)),
       fragment_(std::move(fragment)) {
+  absl::AsciiStrToLower(&scheme_);
   for (const auto& kv : query_parameter_pairs_) {
     query_parameter_map_[kv.key] = kv.value;
   }
@@ -309,7 +361,8 @@ URI::URI(std::string scheme, std::string authority, std::string path,
 
 URI::URI(const URI& other)
     : scheme_(other.scheme_),
-      authority_(other.authority_),
+      user_info_(other.user_info_),
+      host_port_(other.host_port_),
       path_(other.path_),
       query_parameter_pairs_(other.query_parameter_pairs_),
       fragment_(other.fragment_) {
@@ -323,7 +376,8 @@ URI& URI::operator=(const URI& other) {
     return *this;
   }
   scheme_ = other.scheme_;
-  authority_ = other.authority_;
+  user_info_ = other.user_info_;
+  host_port_ = other.host_port_;
   path_ = other.path_;
   query_parameter_pairs_ = other.query_parameter_pairs_;
   fragment_ = other.fragment_;
@@ -350,9 +404,14 @@ std::string URI::ToString() const {
   std::vector<std::string> parts = {PercentEncode(scheme_, IsSchemeChar), ":"};
   // If path starts with '//' we need to encode the authority to ensure that
   // we can round-trip the URI through a parse/encode/parse loop.
-  if (!authority_.empty() || absl::StartsWith(path_, "//")) {
+  if (!user_info_.empty() || !host_port_.empty() ||
+      absl::StartsWith(path_, "//")) {
     parts.emplace_back("//");
-    parts.emplace_back(PercentEncode(authority_, IsAuthorityChar));
+    if (!user_info_.empty()) {
+      parts.emplace_back(PercentEncode(user_info_, IsUserInfoChar));
+      parts.emplace_back("@");
+    }
+    parts.emplace_back(PercentEncode(host_port_, IsHostPortChar));
   }
   parts.emplace_back(EncodedPathAndQueryParams());
   if (!fragment_.empty()) {

data/src/core/util/uri.h

@@ -48,8 +48,9 @@ class URI {
   static absl::StatusOr<URI> Parse(absl::string_view uri_text);
   // Creates a URI from components. Returns an InvalidArgumentError on failure.
   static absl::StatusOr<URI> Create(
-      std::string scheme, std::string authority, std::string path,
-      std::vector<QueryParam> query_parameter_pairs, std::string fragment);
+      std::string scheme, std::string user_info, std::string host_port,
+      std::string path, std::vector<QueryParam> query_parameter_pairs,
+      std::string fragment);
 
   URI() = default;
 
@@ -66,7 +67,9 @@ class URI {
   static std::string PercentDecode(absl::string_view str);
 
   const std::string& scheme() const { return scheme_; }
-  const std::string& authority() const { return authority_; }
+  std::string authority() const;
+  const std::string& user_info() const { return user_info_; }
+  const std::string& host_port() const { return host_port_; }
   const std::string& path() const { return path_; }
   // Stores the *last* value appearing for each repeated key in the query
   // string. If you need to capture repeated query parameters, use
@@ -90,18 +93,20 @@ class URI {
   std::string EncodedPathAndQueryParams() const;
 
   bool operator==(const URI& other) const {
-    return scheme_ == other.scheme_ && authority_ == other.authority_ &&
-           path_ == other.path_ &&
+    return scheme_ == other.scheme_ && user_info_ == other.user_info_ &&
+           host_port_ == other.host_port_ && path_ == other.path_ &&
            query_parameter_pairs_ == other.query_parameter_pairs_ &&
            fragment_ == other.fragment_;
   }
 
  private:
-  URI(std::string scheme, std::string authority, std::string path,
-      std::vector<QueryParam> query_parameter_pairs, std::string fragment);
+  URI(std::string scheme, std::string user_info, std::string host_port,
+      std::string path, std::vector<QueryParam> query_parameter_pairs,
+      std::string fragment);
 
   std::string scheme_;
-  std::string authority_;
+  std::string user_info_;
+  std::string host_port_;
   std::string path_;
   std::map<absl::string_view, absl::string_view> query_parameter_map_;
   std::vector<QueryParam> query_parameter_pairs_;

data/src/core/util/useful.h

@@ -19,6 +19,7 @@
 
 #include <cstddef>
 #include <limits>
+#include <type_traits>
 #include <variant>
 
 #include "absl/log/check.h"
@@ -114,8 +115,58 @@ inline T SaturatingAdd(T a, T b) {
   return a + b;
 }
 
-inline uint32_t MixHash32(uint32_t a, uint32_t b) {
-  return absl::rotl(a, 2u) ^ b;
+template <
+    typename T,
+    std::enable_if_t<std::is_integral_v<T> && std::is_unsigned_v<T>, int> = 0>
+inline T SaturatingMul(T a, T b) {
+  if (a == 0 || b == 0) return 0;
+  if (b > std::numeric_limits<T>::max() / a) {
+    return std::numeric_limits<T>::max();
+  }
+  return a * b;
+}
+
+template <
+    typename T,
+    std::enable_if_t<std::is_integral_v<T> && std::is_signed_v<T>, int> = 0>
+inline T SaturatingMul(T a, T b) {
+  if (a == 0 || b == 0) return 0;
+  if (a == std::numeric_limits<T>::min()) {
+    // negation is ub
+    if (b == -1) return std::numeric_limits<T>::max();
+    if (b == 1) return std::numeric_limits<T>::min();
+    if (b > 1) return std::numeric_limits<T>::min();
+    return std::numeric_limits<T>::max();
+  }
+  if (b == std::numeric_limits<T>::min()) {
+    if (a == -1) return std::numeric_limits<T>::max();
+    if (a == 1) return std::numeric_limits<T>::min();
+    if (a > 1) return std::numeric_limits<T>::min();
+    return std::numeric_limits<T>::max();
+  }
+  if (a > 0 && b > 0) {
+    // both positive
+    if (a > std::numeric_limits<T>::max() / b) {
+      return std::numeric_limits<T>::max();
+    }
+  } else if (a < 0 && b < 0) {
+    // both negative
+    if (a < std::numeric_limits<T>::max() / b) {
+      return std::numeric_limits<T>::max();
+    }
+  } else {
+    // one positive, one negative
+    if (a > 0) {
+      if (b < std::numeric_limits<T>::min() / a) {
+        return std::numeric_limits<T>::min();
+      }
+    } else {
+      if (a < std::numeric_limits<T>::min() / b) {
+        return std::numeric_limits<T>::min();
+      }
+    }
+  }
+  return a * b;
 }
 
 inline uint32_t RoundUpToPowerOf2(uint32_t v) {

data/src/core/util/wait_for_single_owner.cc

@@ -0,0 +1,31 @@
+// Copyright 2025 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/core/util/wait_for_single_owner.h"
+
+#include "src/core/util/no_destruct.h"
+
+namespace grpc_core {
+
+NoDestruct<absl::AnyInvocable<void()>> cb_{nullptr};
+
+void SetWaitForSingleOwnerStalledCallback(absl::AnyInvocable<void()> cb) {
+  *cb_ = std::move(cb);
+}
+
+void WaitForSingleOwnerStalled() {
+  if (*cb_ != nullptr) (*cb_)();
+}
+
+}  // namespace grpc_core

data/src/core/util/wait_for_single_owner.h

@@ -17,12 +17,23 @@
 
 #include <memory>
 
+#include "absl/functional/any_invocable.h"
 #include "absl/log/log.h"
 #include "src/core/util/crash.h"
 #include "src/core/util/time.h"
 
 namespace grpc_core {
 
+constexpr Duration kWaitForSingleOwnerStallCheckFrequency =
+    Duration::Seconds(10);
+
+// Provide a function that WaitForSingleOwner will call when it appears to have
+// stalled.
+void SetWaitForSingleOwnerStalledCallback(absl::AnyInvocable<void()> cb);
+
+// INTERNAL: Call the stall callback.
+void WaitForSingleOwnerStalled();
+
 // Waits until the use_count of the shared_ptr has reached 1 and returns,
 // destroying the object.
 //
@@ -41,8 +52,21 @@ void WaitForSingleOwner(std::shared_ptr<T> obj) {
 template <typename T>
 void WaitForSingleOwnerWithTimeout(std::shared_ptr<T> obj, Duration timeout) {
   auto start = Timestamp::Now();
+  size_t last_check_period = 0;
+  bool reported_stall = false;
   while (obj.use_count() > 1) {
     auto elapsed = Timestamp::Now() - start;
+    if (size_t current_check_period =
+            elapsed.seconds() /
+            kWaitForSingleOwnerStallCheckFrequency.seconds();
+        current_check_period > last_check_period) {
+      ++last_check_period;
+      if (!reported_stall) {
+        LOG(INFO) << "Investigating stall...";
+        WaitForSingleOwnerStalled();
+        reported_stall = true;
+      }
+    }
     auto remaining = timeout - elapsed;
     if (remaining < Duration::Zero()) {
       Crash("Timed out waiting for a single shared_ptr owner");

data/src/core/xds/grpc/xds_bootstrap_grpc.cc

@@ -84,6 +84,8 @@ const JsonLoaderInterface* GrpcXdsBootstrap::GrpcAuthority::JsonLoader(
               "client_listener_resource_name_template",
               &GrpcAuthority::client_listener_resource_name_template_)
           .OptionalField("xds_servers", &GrpcAuthority::servers_)
+          .OptionalField("fallback_on_reachability_only",
+                         &GrpcAuthority::fallback_on_reachability_only_)
           .Finish();
   return loader;
 }

data/src/core/xds/grpc/xds_bootstrap_grpc.h

@@ -85,6 +85,10 @@ class GrpcXdsBootstrap final : public XdsBootstrap {
       return servers;
     }
 
+    bool FallbackOnReachabilityOnly() const override {
+      return fallback_on_reachability_only_;
+    }
+
     const std::string& client_listener_resource_name_template() const {
       return client_listener_resource_name_template_;
     }
@@ -94,6 +98,7 @@ class GrpcXdsBootstrap final : public XdsBootstrap {
    private:
     std::vector<GrpcXdsServer> servers_;
     std::string client_listener_resource_name_template_;
+    bool fallback_on_reachability_only_;
   };
 
   // Creates bootstrap object from json_string.

data/src/core/xds/grpc/xds_client_grpc.cc

@@ -251,6 +251,8 @@ absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
   std::optional<absl::string_view> bootstrap_config = args.GetString(
       GRPC_ARG_TEST_ONLY_DO_NOT_USE_IN_PROD_XDS_BOOTSTRAP_CONFIG);
   if (bootstrap_config.has_value()) {
+    GRPC_TRACE_LOG(xds_client, INFO)
+        << "xDS bootstrap contents: " << *bootstrap_config;
     auto bootstrap = GrpcXdsBootstrap::Create(*bootstrap_config);
     if (!bootstrap.ok()) return bootstrap.status();
     grpc_channel_args* xds_channel_args = args.GetPointer<grpc_channel_args>(
@@ -261,7 +263,8 @@ absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
         MakeRefCounted<GrpcXdsTransportFactory>(channel_args),
         GetStatsPluginGroupForKeyAndChannelArgs(key, args));
   }
-  // Otherwise, use the global instance.
+  // Otherwise, check the global map to see if the XdsClient instance
+  // for this key already exists.
   MutexLock lock(g_mu);
   auto it = g_xds_client_map->find(key);
   if (it != g_xds_client_map->end()) {
@@ -270,7 +273,8 @@ absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
       return xds_client.TakeAsSubclass<GrpcXdsClient>();
     }
   }
-  // Find bootstrap contents.
+  // It doesn't exist, so we'll create it.
+  // First, find bootstrap contents.
   auto bootstrap_contents = GetBootstrapContents(g_fallback_bootstrap_config);
   if (!bootstrap_contents.ok()) return bootstrap_contents.status();
   GRPC_TRACE_LOG(xds_client, INFO)

data/src/core/xds/grpc/xds_common_types_parser.cc

@@ -33,7 +33,6 @@
 #include "envoy/extensions/transport_sockets/tls/v3/common.upb.h"
 #include "envoy/extensions/transport_sockets/tls/v3/tls.upb.h"
 #include "envoy/type/matcher/v3/regex.upb.h"
-#include "envoy/type/matcher/v3/string.upb.h"
 #include "google/protobuf/any.upb.h"
 #include "google/protobuf/struct.upb.h"
 #include "google/protobuf/struct.upbdefs.h"
@@ -48,6 +47,7 @@
 #include "upb/base/status.hpp"
 #include "upb/json/encode.h"
 #include "upb/mem/arena.h"
+#include "xds/type/matcher/v3/regex.upb.h"
 #include "xds/type/v3/typed_struct.upb.h"
 
 namespace grpc_core {
@@ -108,19 +108,145 @@ std::optional<grpc_resolved_address> ParseXdsAddress(
 }
 
 //
-// CommonTlsContextParse()
+// StringMatcherParse()
 //
 
 namespace {
 
-bool XdsSystemRootCertsEnabled() {
-  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_SYSTEM_ROOT_CERTS");
-  if (!value.has_value()) return false;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
+class StringMatcherProtoAccessor {
+ public:
+  virtual ~StringMatcherProtoAccessor() = default;
+
+  virtual bool IsPresent() const = 0;
+  virtual bool HasExact() const = 0;
+  virtual upb_StringView GetExact() const = 0;
+  virtual bool HasPrefix() const = 0;
+  virtual upb_StringView GetPrefix() const = 0;
+  virtual bool HasSuffix() const = 0;
+  virtual upb_StringView GetSuffix() const = 0;
+  virtual bool HasContains() const = 0;
+  virtual upb_StringView GetContains() const = 0;
+  virtual bool HasSafeRegex() const = 0;
+  virtual upb_StringView GetSafeRegex() const = 0;
+  virtual bool IgnoreCase() const = 0;
+};
+
+#define GRPC_STRING_MATCHER_PROTO_ACCESSOR_CLASS(prefix)                    \
+  class ProtoAccessor final : public StringMatcherProtoAccessor {           \
+   public:                                                                  \
+    explicit ProtoAccessor(                                                 \
+        const prefix##_type_matcher_v3_StringMatcher* proto)                \
+        : proto_(proto) {}                                                  \
+                                                                            \
+    bool IsPresent() const override { return proto_ != nullptr; }           \
+    bool HasExact() const override {                                        \
+      return prefix##_type_matcher_v3_StringMatcher_has_exact(proto_);      \
+    }                                                                       \
+    upb_StringView GetExact() const override {                              \
+      return prefix##_type_matcher_v3_StringMatcher_exact(proto_);          \
+    }                                                                       \
+    bool HasPrefix() const override {                                       \
+      return prefix##_type_matcher_v3_StringMatcher_has_prefix(proto_);     \
+    }                                                                       \
+    upb_StringView GetPrefix() const override {                             \
+      return prefix##_type_matcher_v3_StringMatcher_prefix(proto_);         \
+    }                                                                       \
+    bool HasSuffix() const override {                                       \
+      return prefix##_type_matcher_v3_StringMatcher_has_suffix(proto_);     \
+    }                                                                       \
+    upb_StringView GetSuffix() const override {                             \
+      return prefix##_type_matcher_v3_StringMatcher_suffix(proto_);         \
+    }                                                                       \
+    bool HasContains() const override {                                     \
+      return prefix##_type_matcher_v3_StringMatcher_has_contains(proto_);   \
+    }                                                                       \
+    upb_StringView GetContains() const override {                           \
+      return prefix##_type_matcher_v3_StringMatcher_contains(proto_);       \
+    }                                                                       \
+    bool HasSafeRegex() const override {                                    \
+      return prefix##_type_matcher_v3_StringMatcher_has_safe_regex(proto_); \
+    }                                                                       \
+    upb_StringView GetSafeRegex() const override {                          \
+      auto* regex_matcher =                                                 \
+          prefix##_type_matcher_v3_StringMatcher_safe_regex(proto_);        \
+      return prefix##_type_matcher_v3_RegexMatcher_regex(regex_matcher);    \
+    }                                                                       \
+    bool IgnoreCase() const override {                                      \
+      return prefix##_type_matcher_v3_StringMatcher_ignore_case(proto_);    \
+    }                                                                       \
+                                                                            \
+   private:                                                                 \
+    const prefix##_type_matcher_v3_StringMatcher* proto_;                   \
+  };
+
+StringMatcher StringMatcherParseInternal(
+    const StringMatcherProtoAccessor& proto, ValidationErrors* errors) {
+  if (!proto.IsPresent()) {
+    errors->AddError("field not present");
+    return StringMatcher();
+  }
+  StringMatcher::Type type;
+  std::string matcher;
+  if (proto.HasExact()) {
+    type = StringMatcher::Type::kExact;
+    matcher = UpbStringToStdString(proto.GetExact());
+  } else if (proto.HasPrefix()) {
+    type = StringMatcher::Type::kPrefix;
+    matcher = UpbStringToStdString(proto.GetPrefix());
+  } else if (proto.HasSuffix()) {
+    type = StringMatcher::Type::kSuffix;
+    matcher = UpbStringToStdString(proto.GetSuffix());
+  } else if (proto.HasContains()) {
+    type = StringMatcher::Type::kContains;
+    matcher = UpbStringToStdString(proto.GetContains());
+  } else if (proto.HasSafeRegex()) {
+    type = StringMatcher::Type::kSafeRegex;
+    matcher = UpbStringToStdString(proto.GetSafeRegex());
+  } else {
+    errors->AddError("invalid string matcher");
+    return StringMatcher();
+  }
+  const bool ignore_case = proto.IgnoreCase();
+  absl::StatusOr<StringMatcher> string_matcher =
+      StringMatcher::Create(type, matcher,
+                            /*case_sensitive=*/!ignore_case);
+  if (!string_matcher.ok()) {
+    errors->AddError(string_matcher.status().message());
+    return StringMatcher();
+  }
+  if (type == StringMatcher::Type::kSafeRegex && ignore_case) {
+    ValidationErrors::ScopedField field(errors, ".ignore_case");
+    errors->AddError("not supported for regex matcher");
+  }
+  return std::move(*string_matcher);
+}
+
+}  // namespace
+
+StringMatcher StringMatcherParse(
+    const XdsResourceType::DecodeContext& /*context*/,
+    const envoy_type_matcher_v3_StringMatcher* matcher_proto,
+    ValidationErrors* errors) {
+  GRPC_STRING_MATCHER_PROTO_ACCESSOR_CLASS(envoy);
+  ProtoAccessor proto_accessor(matcher_proto);
+  return StringMatcherParseInternal(proto_accessor, errors);
+}
+
+StringMatcher StringMatcherParse(
+    const XdsResourceType::DecodeContext& /*context*/,
+    const xds_type_matcher_v3_StringMatcher* matcher_proto,
+    ValidationErrors* errors) {
+  GRPC_STRING_MATCHER_PROTO_ACCESSOR_CLASS(xds);
+  ProtoAccessor proto_accessor(matcher_proto);
+  return StringMatcherParseInternal(proto_accessor, errors);
 }
 
+//
+// CommonTlsContextParse()
+//
+
+namespace {
+
 // CertificateProviderInstance is deprecated but we are still supporting it for
 // backward compatibility reasons. Note that we still parse the data into the
 // same CertificateProviderPluginInstance struct since the fields are the same.
@@ -190,56 +316,10 @@ CertificateValidationContextParse(
   for (size_t i = 0; i < len; ++i) {
     ValidationErrors::ScopedField field(
         errors, absl::StrCat(".match_subject_alt_names[", i, "]"));
-    StringMatcher::Type type;
-    std::string matcher;
-    if (envoy_type_matcher_v3_StringMatcher_has_exact(
-            subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kExact;
-      matcher = UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_exact(
-          subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_prefix(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kPrefix;
-      matcher = UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_prefix(
-          subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_suffix(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kSuffix;
-      matcher = UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_suffix(
-          subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_contains(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kContains;
-      matcher =
-          UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_contains(
-              subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_safe_regex(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kSafeRegex;
-      auto* regex_matcher = envoy_type_matcher_v3_StringMatcher_safe_regex(
-          subject_alt_names_matchers[i]);
-      matcher = UpbStringToStdString(
-          envoy_type_matcher_v3_RegexMatcher_regex(regex_matcher));
-    } else {
-      errors->AddError("invalid StringMatcher specified");
-      continue;
-    }
-    bool ignore_case = envoy_type_matcher_v3_StringMatcher_ignore_case(
-        subject_alt_names_matchers[i]);
-    absl::StatusOr<StringMatcher> string_matcher =
-        StringMatcher::Create(type, matcher,
-                              /*case_sensitive=*/!ignore_case);
-    if (!string_matcher.ok()) {
-      errors->AddError(string_matcher.status().message());
-      continue;
-    }
-    if (type == StringMatcher::Type::kSafeRegex && ignore_case) {
-      ValidationErrors::ScopedField field(errors, ".ignore_case");
-      errors->AddError("not supported for regex matcher");
-      continue;
-    }
+    auto string_matcher =
+        StringMatcherParse(context, subject_alt_names_matchers[i], errors);
     certificate_validation_context.match_subject_alt_names.push_back(
-        std::move(string_matcher.value()));
+        std::move(string_matcher));
   }
   auto* ca_certificate_provider_instance =
       envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_ca_certificate_provider_instance(
@@ -250,7 +330,7 @@ CertificateValidationContextParse(
     certificate_validation_context.ca_certs =
         CertificateProviderPluginInstanceParse(
             context, ca_certificate_provider_instance, errors);
-  } else if (XdsSystemRootCertsEnabled()) {
+  } else {
     auto* system_root_certs =
         envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_system_root_certs(
             certificate_validation_context_proto);