grpc 1.73.0 → 1.74.0

data/src/core/util/wait_for_single_owner.cc

@@ -0,0 +1,31 @@
+// Copyright 2025 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/core/util/wait_for_single_owner.h"
+
+#include "src/core/util/no_destruct.h"
+
+namespace grpc_core {
+
+NoDestruct<absl::AnyInvocable<void()>> cb_{nullptr};
+
+void SetWaitForSingleOwnerStalledCallback(absl::AnyInvocable<void()> cb) {
+  *cb_ = std::move(cb);
+}
+
+void WaitForSingleOwnerStalled() {
+  if (*cb_ != nullptr) (*cb_)();
+}
+
+}  // namespace grpc_core

data/src/core/util/wait_for_single_owner.h

@@ -17,12 +17,23 @@
 
 #include <memory>
 
+#include "absl/functional/any_invocable.h"
 #include "absl/log/log.h"
 #include "src/core/util/crash.h"
 #include "src/core/util/time.h"
 
 namespace grpc_core {
 
+constexpr Duration kWaitForSingleOwnerStallCheckFrequency =
+    Duration::Seconds(10);
+
+// Provide a function that WaitForSingleOwner will call when it appears to have
+// stalled.
+void SetWaitForSingleOwnerStalledCallback(absl::AnyInvocable<void()> cb);
+
+// INTERNAL: Call the stall callback.
+void WaitForSingleOwnerStalled();
+
 // Waits until the use_count of the shared_ptr has reached 1 and returns,
 // destroying the object.
 //
@@ -41,8 +52,21 @@ void WaitForSingleOwner(std::shared_ptr<T> obj) {
 template <typename T>
 void WaitForSingleOwnerWithTimeout(std::shared_ptr<T> obj, Duration timeout) {
   auto start = Timestamp::Now();
+  size_t last_check_period = 0;
+  bool reported_stall = false;
   while (obj.use_count() > 1) {
     auto elapsed = Timestamp::Now() - start;
+    if (size_t current_check_period =
+            elapsed.seconds() /
+            kWaitForSingleOwnerStallCheckFrequency.seconds();
+        current_check_period > last_check_period) {
+      ++last_check_period;
+      if (!reported_stall) {
+        LOG(INFO) << "Investigating stall...";
+        WaitForSingleOwnerStalled();
+        reported_stall = true;
+      }
+    }
     auto remaining = timeout - elapsed;
     if (remaining < Duration::Zero()) {
       Crash("Timed out waiting for a single shared_ptr owner");

data/src/core/xds/grpc/xds_bootstrap_grpc.cc

@@ -84,6 +84,8 @@ const JsonLoaderInterface* GrpcXdsBootstrap::GrpcAuthority::JsonLoader(
               "client_listener_resource_name_template",
               &GrpcAuthority::client_listener_resource_name_template_)
           .OptionalField("xds_servers", &GrpcAuthority::servers_)
+          .OptionalField("fallback_on_reachability_only",
+                         &GrpcAuthority::fallback_on_reachability_only_)
           .Finish();
   return loader;
 }

data/src/core/xds/grpc/xds_bootstrap_grpc.h

@@ -85,6 +85,10 @@ class GrpcXdsBootstrap final : public XdsBootstrap {
       return servers;
     }
 
+    bool FallbackOnReachabilityOnly() const override {
+      return fallback_on_reachability_only_;
+    }
+
     const std::string& client_listener_resource_name_template() const {
       return client_listener_resource_name_template_;
     }
@@ -94,6 +98,7 @@ class GrpcXdsBootstrap final : public XdsBootstrap {
    private:
     std::vector<GrpcXdsServer> servers_;
     std::string client_listener_resource_name_template_;
+    bool fallback_on_reachability_only_;
   };
 
   // Creates bootstrap object from json_string.

data/src/core/xds/grpc/xds_client_grpc.cc

@@ -251,6 +251,8 @@ absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
   std::optional<absl::string_view> bootstrap_config = args.GetString(
       GRPC_ARG_TEST_ONLY_DO_NOT_USE_IN_PROD_XDS_BOOTSTRAP_CONFIG);
   if (bootstrap_config.has_value()) {
+    GRPC_TRACE_LOG(xds_client, INFO)
+        << "xDS bootstrap contents: " << *bootstrap_config;
     auto bootstrap = GrpcXdsBootstrap::Create(*bootstrap_config);
     if (!bootstrap.ok()) return bootstrap.status();
     grpc_channel_args* xds_channel_args = args.GetPointer<grpc_channel_args>(
@@ -261,7 +263,8 @@ absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
         MakeRefCounted<GrpcXdsTransportFactory>(channel_args),
         GetStatsPluginGroupForKeyAndChannelArgs(key, args));
   }
-  // Otherwise, use the global instance.
+  // Otherwise, check the global map to see if the XdsClient instance
+  // for this key already exists.
   MutexLock lock(g_mu);
   auto it = g_xds_client_map->find(key);
   if (it != g_xds_client_map->end()) {
@@ -270,7 +273,8 @@ absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
       return xds_client.TakeAsSubclass<GrpcXdsClient>();
     }
   }
-  // Find bootstrap contents.
+  // It doesn't exist, so we'll create it.
+  // First, find bootstrap contents.
   auto bootstrap_contents = GetBootstrapContents(g_fallback_bootstrap_config);
   if (!bootstrap_contents.ok()) return bootstrap_contents.status();
   GRPC_TRACE_LOG(xds_client, INFO)

data/src/core/xds/grpc/xds_common_types_parser.cc

@@ -33,7 +33,6 @@
 #include "envoy/extensions/transport_sockets/tls/v3/common.upb.h"
 #include "envoy/extensions/transport_sockets/tls/v3/tls.upb.h"
 #include "envoy/type/matcher/v3/regex.upb.h"
-#include "envoy/type/matcher/v3/string.upb.h"
 #include "google/protobuf/any.upb.h"
 #include "google/protobuf/struct.upb.h"
 #include "google/protobuf/struct.upbdefs.h"
@@ -48,6 +47,7 @@
 #include "upb/base/status.hpp"
 #include "upb/json/encode.h"
 #include "upb/mem/arena.h"
+#include "xds/type/matcher/v3/regex.upb.h"
 #include "xds/type/v3/typed_struct.upb.h"
 
 namespace grpc_core {
@@ -107,6 +107,140 @@ std::optional<grpc_resolved_address> ParseXdsAddress(
   return *addr;
 }
 
+//
+// StringMatcherParse()
+//
+
+namespace {
+
+class StringMatcherProtoAccessor {
+ public:
+  virtual ~StringMatcherProtoAccessor() = default;
+
+  virtual bool IsPresent() const = 0;
+  virtual bool HasExact() const = 0;
+  virtual upb_StringView GetExact() const = 0;
+  virtual bool HasPrefix() const = 0;
+  virtual upb_StringView GetPrefix() const = 0;
+  virtual bool HasSuffix() const = 0;
+  virtual upb_StringView GetSuffix() const = 0;
+  virtual bool HasContains() const = 0;
+  virtual upb_StringView GetContains() const = 0;
+  virtual bool HasSafeRegex() const = 0;
+  virtual upb_StringView GetSafeRegex() const = 0;
+  virtual bool IgnoreCase() const = 0;
+};
+
+#define GRPC_STRING_MATCHER_PROTO_ACCESSOR_CLASS(prefix)                    \
+  class ProtoAccessor final : public StringMatcherProtoAccessor {           \
+   public:                                                                  \
+    explicit ProtoAccessor(                                                 \
+        const prefix##_type_matcher_v3_StringMatcher* proto)                \
+        : proto_(proto) {}                                                  \
+                                                                            \
+    bool IsPresent() const override { return proto_ != nullptr; }           \
+    bool HasExact() const override {                                        \
+      return prefix##_type_matcher_v3_StringMatcher_has_exact(proto_);      \
+    }                                                                       \
+    upb_StringView GetExact() const override {                              \
+      return prefix##_type_matcher_v3_StringMatcher_exact(proto_);          \
+    }                                                                       \
+    bool HasPrefix() const override {                                       \
+      return prefix##_type_matcher_v3_StringMatcher_has_prefix(proto_);     \
+    }                                                                       \
+    upb_StringView GetPrefix() const override {                             \
+      return prefix##_type_matcher_v3_StringMatcher_prefix(proto_);         \
+    }                                                                       \
+    bool HasSuffix() const override {                                       \
+      return prefix##_type_matcher_v3_StringMatcher_has_suffix(proto_);     \
+    }                                                                       \
+    upb_StringView GetSuffix() const override {                             \
+      return prefix##_type_matcher_v3_StringMatcher_suffix(proto_);         \
+    }                                                                       \
+    bool HasContains() const override {                                     \
+      return prefix##_type_matcher_v3_StringMatcher_has_contains(proto_);   \
+    }                                                                       \
+    upb_StringView GetContains() const override {                           \
+      return prefix##_type_matcher_v3_StringMatcher_contains(proto_);       \
+    }                                                                       \
+    bool HasSafeRegex() const override {                                    \
+      return prefix##_type_matcher_v3_StringMatcher_has_safe_regex(proto_); \
+    }                                                                       \
+    upb_StringView GetSafeRegex() const override {                          \
+      auto* regex_matcher =                                                 \
+          prefix##_type_matcher_v3_StringMatcher_safe_regex(proto_);        \
+      return prefix##_type_matcher_v3_RegexMatcher_regex(regex_matcher);    \
+    }                                                                       \
+    bool IgnoreCase() const override {                                      \
+      return prefix##_type_matcher_v3_StringMatcher_ignore_case(proto_);    \
+    }                                                                       \
+                                                                            \
+   private:                                                                 \
+    const prefix##_type_matcher_v3_StringMatcher* proto_;                   \
+  };
+
+StringMatcher StringMatcherParseInternal(
+    const StringMatcherProtoAccessor& proto, ValidationErrors* errors) {
+  if (!proto.IsPresent()) {
+    errors->AddError("field not present");
+    return StringMatcher();
+  }
+  StringMatcher::Type type;
+  std::string matcher;
+  if (proto.HasExact()) {
+    type = StringMatcher::Type::kExact;
+    matcher = UpbStringToStdString(proto.GetExact());
+  } else if (proto.HasPrefix()) {
+    type = StringMatcher::Type::kPrefix;
+    matcher = UpbStringToStdString(proto.GetPrefix());
+  } else if (proto.HasSuffix()) {
+    type = StringMatcher::Type::kSuffix;
+    matcher = UpbStringToStdString(proto.GetSuffix());
+  } else if (proto.HasContains()) {
+    type = StringMatcher::Type::kContains;
+    matcher = UpbStringToStdString(proto.GetContains());
+  } else if (proto.HasSafeRegex()) {
+    type = StringMatcher::Type::kSafeRegex;
+    matcher = UpbStringToStdString(proto.GetSafeRegex());
+  } else {
+    errors->AddError("invalid string matcher");
+    return StringMatcher();
+  }
+  const bool ignore_case = proto.IgnoreCase();
+  absl::StatusOr<StringMatcher> string_matcher =
+      StringMatcher::Create(type, matcher,
+                            /*case_sensitive=*/!ignore_case);
+  if (!string_matcher.ok()) {
+    errors->AddError(string_matcher.status().message());
+    return StringMatcher();
+  }
+  if (type == StringMatcher::Type::kSafeRegex && ignore_case) {
+    ValidationErrors::ScopedField field(errors, ".ignore_case");
+    errors->AddError("not supported for regex matcher");
+  }
+  return std::move(*string_matcher);
+}
+
+}  // namespace
+
+StringMatcher StringMatcherParse(
+    const XdsResourceType::DecodeContext& /*context*/,
+    const envoy_type_matcher_v3_StringMatcher* matcher_proto,
+    ValidationErrors* errors) {
+  GRPC_STRING_MATCHER_PROTO_ACCESSOR_CLASS(envoy);
+  ProtoAccessor proto_accessor(matcher_proto);
+  return StringMatcherParseInternal(proto_accessor, errors);
+}
+
+StringMatcher StringMatcherParse(
+    const XdsResourceType::DecodeContext& /*context*/,
+    const xds_type_matcher_v3_StringMatcher* matcher_proto,
+    ValidationErrors* errors) {
+  GRPC_STRING_MATCHER_PROTO_ACCESSOR_CLASS(xds);
+  ProtoAccessor proto_accessor(matcher_proto);
+  return StringMatcherParseInternal(proto_accessor, errors);
+}
+
 //
 // CommonTlsContextParse()
 //
@@ -182,56 +316,10 @@ CertificateValidationContextParse(
   for (size_t i = 0; i < len; ++i) {
     ValidationErrors::ScopedField field(
         errors, absl::StrCat(".match_subject_alt_names[", i, "]"));
-    StringMatcher::Type type;
-    std::string matcher;
-    if (envoy_type_matcher_v3_StringMatcher_has_exact(
-            subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kExact;
-      matcher = UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_exact(
-          subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_prefix(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kPrefix;
-      matcher = UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_prefix(
-          subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_suffix(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kSuffix;
-      matcher = UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_suffix(
-          subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_contains(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kContains;
-      matcher =
-          UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_contains(
-              subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_safe_regex(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kSafeRegex;
-      auto* regex_matcher = envoy_type_matcher_v3_StringMatcher_safe_regex(
-          subject_alt_names_matchers[i]);
-      matcher = UpbStringToStdString(
-          envoy_type_matcher_v3_RegexMatcher_regex(regex_matcher));
-    } else {
-      errors->AddError("invalid StringMatcher specified");
-      continue;
-    }
-    bool ignore_case = envoy_type_matcher_v3_StringMatcher_ignore_case(
-        subject_alt_names_matchers[i]);
-    absl::StatusOr<StringMatcher> string_matcher =
-        StringMatcher::Create(type, matcher,
-                              /*case_sensitive=*/!ignore_case);
-    if (!string_matcher.ok()) {
-      errors->AddError(string_matcher.status().message());
-      continue;
-    }
-    if (type == StringMatcher::Type::kSafeRegex && ignore_case) {
-      ValidationErrors::ScopedField field(errors, ".ignore_case");
-      errors->AddError("not supported for regex matcher");
-      continue;
-    }
+    auto string_matcher =
+        StringMatcherParse(context, subject_alt_names_matchers[i], errors);
     certificate_validation_context.match_subject_alt_names.push_back(
-        std::move(string_matcher.value()));
+        std::move(string_matcher));
   }
   auto* ca_certificate_provider_instance =
       envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_ca_certificate_provider_instance(

data/src/core/xds/grpc/xds_common_types_parser.h

@@ -21,15 +21,18 @@
 
 #include "envoy/config/core/v3/base.upb.h"
 #include "envoy/extensions/transport_sockets/tls/v3/tls.upb.h"
+#include "envoy/type/matcher/v3/string.upb.h"
 #include "google/protobuf/any.upb.h"
 #include "google/protobuf/duration.upb.h"
 #include "google/protobuf/struct.upb.h"
 #include "google/protobuf/wrappers.upb.h"
 #include "src/core/lib/iomgr/resolved_address.h"
+#include "src/core/util/matchers.h"
 #include "src/core/util/time.h"
 #include "src/core/util/validation_errors.h"
 #include "src/core/xds/grpc/xds_common_types.h"
 #include "src/core/xds/xds_client/xds_resource_type.h"
+#include "xds/type/matcher/v3/string.upb.h"
 
 namespace grpc_core {
 
@@ -58,6 +61,15 @@ inline std::optional<uint32_t> ParseUInt32Value(
 std::optional<grpc_resolved_address> ParseXdsAddress(
     const envoy_config_core_v3_Address* address, ValidationErrors* errors);
 
+StringMatcher StringMatcherParse(
+    const XdsResourceType::DecodeContext& context,
+    const envoy_type_matcher_v3_StringMatcher* matcher_proto,
+    ValidationErrors* errors);
+StringMatcher StringMatcherParse(
+    const XdsResourceType::DecodeContext& context,
+    const xds_type_matcher_v3_StringMatcher* matcher_proto,
+    ValidationErrors* errors);
+
 CommonTlsContext CommonTlsContextParse(
     const XdsResourceType::DecodeContext& context,
     const envoy_extensions_transport_sockets_tls_v3_CommonTlsContext*

data/src/core/xds/grpc/xds_http_filter.h

@@ -24,6 +24,7 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 #include "src/core/call/interception_chain.h"
+#include "src/core/filter/blackboard.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/util/json/json.h"
@@ -119,6 +120,12 @@ class XdsHttpFilterImpl {
   virtual absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
       const FilterConfig& hcm_filter_config) const = 0;
 
+  // Adds state to new_blackboard if needed for the specified filter
+  // config.  Copies existing state from old_blackboard as appropriate.
+  virtual void UpdateBlackboard(const FilterConfig& /*hcm_filter_config*/,
+                                const Blackboard* /*old_blackboard*/,
+                                Blackboard* /*new_blackboard*/) const {}
+
   // Returns true if the filter is supported on clients; false otherwise
   virtual bool IsSupportedOnClients() const = 0;
 

data/src/core/xds/grpc/xds_http_gcp_authn_filter.cc

@@ -138,4 +138,26 @@ XdsHttpGcpAuthnFilter::GenerateServiceConfig(
                                 JsonDump(hcm_filter_config.config)};
 }
 
+void XdsHttpGcpAuthnFilter::UpdateBlackboard(
+    const FilterConfig& hcm_filter_config, const Blackboard* old_blackboard,
+    Blackboard* new_blackboard) const {
+  ValidationErrors errors;
+  auto config = LoadFromJson<GcpAuthenticationParsedConfig::Config>(
+      hcm_filter_config.config, JsonArgs(), &errors);
+  CHECK(errors.ok()) << errors.message("filter config validation failed");
+  RefCountedPtr<GcpAuthenticationFilter::CallCredentialsCache> cache;
+  if (old_blackboard != nullptr) {
+    cache = old_blackboard->Get<GcpAuthenticationFilter::CallCredentialsCache>(
+        config.filter_instance_name);
+  }
+  if (cache != nullptr) {
+    cache->SetMaxSize(config.cache_size);
+  } else {
+    cache = MakeRefCounted<GcpAuthenticationFilter::CallCredentialsCache>(
+        config.cache_size);
+  }
+  CHECK_NE(new_blackboard, nullptr);
+  new_blackboard->Set(config.filter_instance_name, std::move(cache));
+}
+
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_http_gcp_authn_filter.h

@@ -52,6 +52,9 @@ class XdsHttpGcpAuthnFilter final : public XdsHttpFilterImpl {
       const FilterConfig* filter_config_override) const override;
   absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
       const FilterConfig& hcm_filter_config) const override;
+  void UpdateBlackboard(const FilterConfig& hcm_filter_config,
+                        const Blackboard* old_blackboard,
+                        Blackboard* new_blackboard) const override;
   bool IsSupportedOnClients() const override { return true; }
   bool IsSupportedOnServers() const override { return false; }
 };

data/src/core/xds/grpc/xds_route_config_parser.cc

@@ -237,7 +237,8 @@ std::optional<StringMatcher> RoutePathMatchParse(
   return std::move(*string_matcher);
 }
 
-void RouteHeaderMatchersParse(const envoy_config_route_v3_RouteMatch* match,
+void RouteHeaderMatchersParse(const XdsResourceType::DecodeContext& context,
+                              const envoy_config_route_v3_RouteMatch* match,
                               XdsRouteConfigResource::Route* route,
                               ValidationErrors* errors) {
   size_t size;
@@ -250,6 +251,18 @@ void RouteHeaderMatchersParse(const envoy_config_route_v3_RouteMatch* match,
     CHECK_NE(header, nullptr);
     const std::string name =
         UpbStringToStdString(envoy_config_route_v3_HeaderMatcher_name(header));
+    const bool invert_match =
+        envoy_config_route_v3_HeaderMatcher_invert_match(header);
+    if (envoy_config_route_v3_HeaderMatcher_has_string_match(header)) {
+      ValidationErrors::ScopedField field(errors, ".string_match");
+      auto string_matcher = StringMatcherParse(
+          context, envoy_config_route_v3_HeaderMatcher_string_match(header),
+          errors);
+      route->matchers.header_matchers.emplace_back(
+          HeaderMatcher::CreateFromStringMatcher(
+              name, std::move(string_matcher), invert_match));
+      continue;
+    }
     HeaderMatcher::Type type;
     std::string match_string;
     int64_t range_start = 0;
@@ -290,46 +303,10 @@ void RouteHeaderMatchersParse(const envoy_config_route_v3_RouteMatch* match,
     } else if (envoy_config_route_v3_HeaderMatcher_has_present_match(header)) {
       type = HeaderMatcher::Type::kPresent;
       present_match = envoy_config_route_v3_HeaderMatcher_present_match(header);
-    } else if (envoy_config_route_v3_HeaderMatcher_has_string_match(header)) {
-      ValidationErrors::ScopedField field(errors, ".string_match");
-      const auto* matcher =
-          envoy_config_route_v3_HeaderMatcher_string_match(header);
-      CHECK_NE(matcher, nullptr);
-      if (envoy_type_matcher_v3_StringMatcher_has_exact(matcher)) {
-        type = HeaderMatcher::Type::kExact;
-        match_string = UpbStringToStdString(
-            envoy_type_matcher_v3_StringMatcher_exact(matcher));
-      } else if (envoy_type_matcher_v3_StringMatcher_has_prefix(matcher)) {
-        type = HeaderMatcher::Type::kPrefix;
-        match_string = UpbStringToStdString(
-            envoy_type_matcher_v3_StringMatcher_prefix(matcher));
-      } else if (envoy_type_matcher_v3_StringMatcher_has_suffix(matcher)) {
-        type = HeaderMatcher::Type::kSuffix;
-        match_string = UpbStringToStdString(
-            envoy_type_matcher_v3_StringMatcher_suffix(matcher));
-      } else if (envoy_type_matcher_v3_StringMatcher_has_contains(matcher)) {
-        type = HeaderMatcher::Type::kContains;
-        match_string = UpbStringToStdString(
-            envoy_type_matcher_v3_StringMatcher_contains(matcher));
-      } else if (envoy_type_matcher_v3_StringMatcher_has_safe_regex(matcher)) {
-        type = HeaderMatcher::Type::kSafeRegex;
-        const auto* regex_matcher =
-            envoy_type_matcher_v3_StringMatcher_safe_regex(matcher);
-        CHECK_NE(regex_matcher, nullptr);
-        match_string = UpbStringToStdString(
-            envoy_type_matcher_v3_RegexMatcher_regex(regex_matcher));
-      } else {
-        errors->AddError("invalid string matcher");
-        continue;
-      }
-      case_sensitive =
-          !envoy_type_matcher_v3_StringMatcher_ignore_case(matcher);
     } else {
       errors->AddError("invalid header matcher");
       continue;
     }
-    bool invert_match =
-        envoy_config_route_v3_HeaderMatcher_invert_match(header);
     absl::StatusOr<HeaderMatcher> header_matcher =
         HeaderMatcher::Create(name, type, match_string, range_start, range_end,
                               present_match, invert_match, case_sensitive);
@@ -746,7 +723,7 @@ std::optional<XdsRouteConfigResource::Route> ParseRoute(
     auto path_matcher = RoutePathMatchParse(match, errors);
     if (!path_matcher.has_value()) return std::nullopt;
     route.matchers.path_matcher = std::move(*path_matcher);
-    RouteHeaderMatchersParse(match, &route, errors);
+    RouteHeaderMatchersParse(context, match, &route, errors);
     RouteRuntimeFractionParse(match, &route, errors);
   }
   // Parse route action.

data/src/core/xds/grpc/xds_server_grpc.cc

@@ -27,6 +27,7 @@
 #include "absl/strings/string_view.h"
 #include "src/core/config/core_configuration.h"
 #include "src/core/util/down_cast.h"
+#include "src/core/util/env.h"
 #include "src/core/util/json/json_reader.h"
 #include "src/core/util/json/json_writer.h"
 
@@ -82,29 +83,40 @@ const JsonLoaderInterface* GrpcXdsServer::JsonLoader(const JsonArgs&) {
 
 namespace {
 
-struct ChannelCreds {
+struct ChannelOrCallCreds {
   std::string type;
   Json::Object config;
 
   static const JsonLoaderInterface* JsonLoader(const JsonArgs&) {
     static const auto* loader =
-        JsonObjectLoader<ChannelCreds>()
-            .Field("type", &ChannelCreds::type)
-            .OptionalField("config", &ChannelCreds::config)
+        JsonObjectLoader<ChannelOrCallCreds>()
+            .Field("type", &ChannelOrCallCreds::type)
+            .OptionalField("config", &ChannelOrCallCreds::config)
             .Finish();
     return loader;
   }
 };
 
+// TODO(roth): Remove this guard once we have reports from OSS Istio
+// users that this works properly.
+bool XdsBootstrapCallCredsEnabled() {
+  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS");
+  if (!value.has_value()) return false;
+  bool parsed_value;
+  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
+  return parse_succeeded && parsed_value;
+}
+
 }  // namespace
 
 void GrpcXdsServer::JsonPostLoad(const Json& json, const JsonArgs& args,
                                  ValidationErrors* errors) {
+  // Parse "channel_creds".
   RefCountedPtr<ChannelCredsConfig> channel_creds_config;
   {
-    // Parse "channel_creds".
-    auto channel_creds_list = LoadJsonObjectField<std::vector<ChannelCreds>>(
-        json.object(), args, "channel_creds", errors);
+    auto channel_creds_list =
+        LoadJsonObjectField<std::vector<ChannelOrCallCreds>>(
+            json.object(), args, "channel_creds", errors);
     if (channel_creds_list.has_value()) {
       ValidationErrors::ScopedField field(errors, ".channel_creds");
       for (size_t i = 0; i < channel_creds_list->size(); ++i) {
@@ -128,6 +140,26 @@ void GrpcXdsServer::JsonPostLoad(const Json& json, const JsonArgs& args,
       }
     }
   }
+  // Parse "call_creds".
+  std::vector<RefCountedPtr<CallCredsConfig>> call_creds_configs;
+  if (XdsBootstrapCallCredsEnabled()) {
+    auto call_creds_list = LoadJsonObjectField<std::vector<ChannelOrCallCreds>>(
+        json.object(), args, "call_creds", errors);
+    if (call_creds_list.has_value()) {
+      ValidationErrors::ScopedField field(errors, ".call_creds");
+      for (size_t i = 0; i < call_creds_list->size(); ++i) {
+        ValidationErrors::ScopedField field(errors, absl::StrCat("[", i, "]"));
+        auto& creds = (*call_creds_list)[i];
+        if (CoreConfiguration::Get().call_creds_registry().IsSupported(
+                creds.type)) {
+          ValidationErrors::ScopedField field(errors, ".config");
+          call_creds_configs.push_back(
+              CoreConfiguration::Get().call_creds_registry().ParseConfig(
+                  creds.type, Json::FromObject(creds.config), args, errors));
+        }
+      }
+    }
+  }
   // Parse "server_features".
   {
     ValidationErrors::ScopedField field(errors, ".server_features");
@@ -155,7 +187,8 @@ void GrpcXdsServer::JsonPostLoad(const Json& json, const JsonArgs& args,
                                       json.object(), args, "server_uri", errors)
                                       .value_or("");
   server_target_ = std::make_shared<GrpcXdsServerTarget>(
-      std::move(server_uri_target), std::move(channel_creds_config));
+      std::move(server_uri_target), std::move(channel_creds_config),
+      std::move(call_creds_configs));
 }
 
 std::string GrpcXdsServer::Key() const {
@@ -175,9 +208,14 @@ std::string GrpcXdsServerTarget::Key() const {
   parts.push_back("{");
   parts.push_back(absl::StrCat("server_uri=", server_uri_));
   if (channel_creds_config_ != nullptr) {
-    parts.push_back(absl::StrCat("creds_type=", channel_creds_config_->type()));
     parts.push_back(
-        absl::StrCat("creds_config=", channel_creds_config_->ToString()));
+        absl::StrCat("channel_creds={type=", channel_creds_config_->type(),
+                     ", config=", channel_creds_config_->ToString(), "}"));
+  }
+  for (const auto& call_creds_config : call_creds_configs_) {
+    parts.push_back(absl::StrCat("call_creds={type=", call_creds_config->type(),
+                                 ", config=", call_creds_config->ToString(),
+                                 "}"));
   }
   parts.push_back("}");
   return absl::StrJoin(parts, ",");
@@ -185,9 +223,21 @@ std::string GrpcXdsServerTarget::Key() const {
 
 bool GrpcXdsServerTarget::Equals(const XdsServerTarget& other) const {
   const auto& o = DownCast<const GrpcXdsServerTarget&>(other);
-  return (server_uri_ == o.server_uri_ &&
-          channel_creds_config_->type() == o.channel_creds_config_->type() &&
-          channel_creds_config_->Equals(*o.channel_creds_config_));
+  if (server_uri_ != o.server_uri_) return false;
+  if (channel_creds_config_->type() != o.channel_creds_config_->type() ||
+      !channel_creds_config_->Equals(*o.channel_creds_config_)) {
+    return false;
+  }
+  if (call_creds_configs_.size() != o.call_creds_configs_.size()) {
+    return false;
+  }
+  for (size_t i = 0; i < call_creds_configs_.size(); ++i) {
+    if (call_creds_configs_[i]->type() != o.call_creds_configs_[i]->type() ||
+        !call_creds_configs_[i]->Equals(*o.call_creds_configs_[i])) {
+      return false;
+    }
+  }
+  return true;
 }
 
 }  // namespace grpc_core