grpc 1.73.0 → 1.75.0

data/src/core/util/wait_for_single_owner.h

@@ -17,12 +17,23 @@
 
 #include <memory>
 
+#include "absl/functional/any_invocable.h"
 #include "absl/log/log.h"
 #include "src/core/util/crash.h"
 #include "src/core/util/time.h"
 
 namespace grpc_core {
 
+constexpr Duration kWaitForSingleOwnerStallCheckFrequency =
+    Duration::Seconds(10);
+
+// Provide a function that WaitForSingleOwner will call when it appears to have
+// stalled.
+void SetWaitForSingleOwnerStalledCallback(absl::AnyInvocable<void()> cb);
+
+// INTERNAL: Call the stall callback.
+void WaitForSingleOwnerStalled();
+
 // Waits until the use_count of the shared_ptr has reached 1 and returns,
 // destroying the object.
 //
@@ -41,8 +52,21 @@ void WaitForSingleOwner(std::shared_ptr<T> obj) {
 template <typename T>
 void WaitForSingleOwnerWithTimeout(std::shared_ptr<T> obj, Duration timeout) {
   auto start = Timestamp::Now();
+  size_t last_check_period = 0;
+  bool reported_stall = false;
   while (obj.use_count() > 1) {
     auto elapsed = Timestamp::Now() - start;
+    if (size_t current_check_period =
+            elapsed.seconds() /
+            kWaitForSingleOwnerStallCheckFrequency.seconds();
+        current_check_period > last_check_period) {
+      ++last_check_period;
+      if (!reported_stall) {
+        LOG(INFO) << "Investigating stall...";
+        WaitForSingleOwnerStalled();
+        reported_stall = true;
+      }
+    }
     auto remaining = timeout - elapsed;
     if (remaining < Duration::Zero()) {
       Crash("Timed out waiting for a single shared_ptr owner");

data/src/core/util/windows/directory_reader.cc

@@ -23,6 +23,7 @@
 #include <sys/stat.h>
 #include <windows.h>
 
+#include <memory>
 #include <string>
 #include <vector>
 

data/src/core/util/windows/thd.cc

@@ -175,8 +175,6 @@ Thread::Thread(const char* /* thd_name */, void (*thd_body)(void* arg),
 
 }  // namespace grpc_core
 
-gpr_thd_id gpr_thd_currentid(void) {
-  return reinterpret_cast<gpr_thd_id>(g_thd_info);
-}
+gpr_thd_id gpr_thd_currentid(void) { return GetCurrentThreadId(); }
 
 #endif  // GPR_WINDOWS

data/src/core/util/work_serializer.cc

@@ -187,7 +187,7 @@ void WorkSerializer::WorkSerializerImpl::Run(
 
 // Implementation of EventEngine::Closure::Run - our actual work loop
 void WorkSerializer::WorkSerializerImpl::Run() {
-  GRPC_LATENT_SEE_PARENT_SCOPE("WorkSerializer::Run");
+  GRPC_LATENT_SEE_SCOPE("WorkSerializer::Run");
   flow_.End();
   // TODO(ctiller): remove these when we can deprecate ExecCtx
   ExecCtx exec_ctx;

data/src/core/xds/grpc/file_watcher_certificate_provider_factory.cc

@@ -31,6 +31,7 @@
 #include "src/core/config/core_configuration.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_provider.h"
 #include "src/core/util/down_cast.h"
+#include "src/core/util/env.h"
 
 namespace grpc_core {
 
@@ -38,6 +39,14 @@ namespace {
 
 constexpr absl::string_view kFileWatcherPlugin = "file_watcher";
 
+bool SpiffeBundleMapEnabled() {
+  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_MTLS_SPIFFE");
+  if (!value.has_value()) return false;
+  bool parsed_value;
+  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
+  return parse_succeeded && parsed_value;
+}
+
 }  // namespace
 
 //
@@ -63,6 +72,10 @@ std::string FileWatcherCertificateProviderFactory::Config::ToString() const {
     parts.push_back(
         absl::StrFormat("ca_certificate_file=\"%s\", ", root_cert_file_));
   }
+  if (!spiffe_bundle_map_file_.empty()) {
+    parts.push_back(absl::StrFormat("spiffe_bundle_map_file=\"%s\", ",
+                                    spiffe_bundle_map_file_));
+  }
   parts.push_back(
       absl::StrFormat("refresh_interval=%ldms}", refresh_interval_.millis()));
   return absl::StrJoin(parts, "");
@@ -75,6 +88,8 @@ FileWatcherCertificateProviderFactory::Config::JsonLoader(const JsonArgs&) {
           .OptionalField("certificate_file", &Config::identity_cert_file_)
           .OptionalField("private_key_file", &Config::private_key_file_)
           .OptionalField("ca_certificate_file", &Config::root_cert_file_)
+          .OptionalField("spiffe_bundle_map_file",
+                         &Config::spiffe_bundle_map_file_)
           .OptionalField("refresh_interval", &Config::refresh_interval_)
           .Finish();
   return loader;
@@ -88,11 +103,22 @@ void FileWatcherCertificateProviderFactory::Config::JsonPostLoad(
         "fields \"certificate_file\" and \"private_key_file\" must be both set "
         "or both unset");
   }
-  if ((json.object().find("certificate_file") == json.object().end()) &&
-      (json.object().find("ca_certificate_file") == json.object().end())) {
-    errors->AddError(
-        "at least one of \"certificate_file\" and \"ca_certificate_file\" must "
-        "be specified");
+  if (SpiffeBundleMapEnabled()) {
+    if (json.object().find("certificate_file") == json.object().end() &&
+        json.object().find("ca_certificate_file") == json.object().end() &&
+        json.object().find("spiffe_bundle_map_file") == json.object().end()) {
+      errors->AddError(
+          "at least one of \"certificate_file\", \"ca_certificate_file\", and "
+          "\"spiffe_bundle_map_file\" must be specified");
+    }
+  } else {
+    spiffe_bundle_map_file_ = "";
+    if ((json.object().find("certificate_file") == json.object().end()) &&
+        (json.object().find("ca_certificate_file") == json.object().end())) {
+      errors->AddError(
+          "at least one of \"certificate_file\" and \"ca_certificate_file\" "
+          "must be specified");
+    }
   }
 }
 
@@ -124,6 +150,7 @@ FileWatcherCertificateProviderFactory::CreateCertificateProvider(
       file_watcher_config->private_key_file(),
       file_watcher_config->identity_cert_file(),
       file_watcher_config->root_cert_file(),
+      file_watcher_config->spiffe_bundle_map_file(),
       file_watcher_config->refresh_interval().millis() / GPR_MS_PER_SEC);
 }
 

data/src/core/xds/grpc/file_watcher_certificate_provider_factory.h

@@ -52,6 +52,10 @@ class FileWatcherCertificateProviderFactory final
 
     const std::string& root_cert_file() const { return root_cert_file_; }
 
+    const std::string& spiffe_bundle_map_file() const {
+      return spiffe_bundle_map_file_;
+    }
+
     Duration refresh_interval() const { return refresh_interval_; }
 
     static const JsonLoaderInterface* JsonLoader(const JsonArgs& args);
@@ -62,6 +66,7 @@ class FileWatcherCertificateProviderFactory final
     std::string identity_cert_file_;
     std::string private_key_file_;
     std::string root_cert_file_;
+    std::string spiffe_bundle_map_file_;
     Duration refresh_interval_ = Duration::Minutes(10);
   };
 

data/src/core/xds/grpc/xds_bootstrap_grpc.cc

@@ -84,6 +84,8 @@ const JsonLoaderInterface* GrpcXdsBootstrap::GrpcAuthority::JsonLoader(
               "client_listener_resource_name_template",
               &GrpcAuthority::client_listener_resource_name_template_)
           .OptionalField("xds_servers", &GrpcAuthority::servers_)
+          .OptionalField("fallback_on_reachability_only",
+                         &GrpcAuthority::fallback_on_reachability_only_)
           .Finish();
   return loader;
 }

data/src/core/xds/grpc/xds_bootstrap_grpc.h

@@ -85,6 +85,10 @@ class GrpcXdsBootstrap final : public XdsBootstrap {
       return servers;
     }
 
+    bool FallbackOnReachabilityOnly() const override {
+      return fallback_on_reachability_only_;
+    }
+
     const std::string& client_listener_resource_name_template() const {
       return client_listener_resource_name_template_;
     }
@@ -94,6 +98,7 @@ class GrpcXdsBootstrap final : public XdsBootstrap {
    private:
     std::vector<GrpcXdsServer> servers_;
     std::string client_listener_resource_name_template_;
+    bool fallback_on_reachability_only_;
   };
 
   // Creates bootstrap object from json_string.

data/src/core/xds/grpc/xds_certificate_provider.cc

@@ -45,12 +45,11 @@ class RootCertificatesWatcher final
       RefCountedPtr<grpc_tls_certificate_distributor> parent)
       : parent_(std::move(parent)) {}
 
-  void OnCertificatesChanged(std::optional<absl::string_view> root_certs,
+  void OnCertificatesChanged(std::shared_ptr<RootCertInfo> roots,
                              std::optional<PemKeyCertPairList>
                              /* key_cert_pairs */) override {
-    if (root_certs.has_value()) {
-      parent_->SetKeyMaterials("", std::string(root_certs.value()),
-                               std::nullopt);
+    if (roots != nullptr) {
+      parent_->SetKeyMaterials("", roots, std::nullopt);
     }
   }
 
@@ -79,10 +78,10 @@ class IdentityCertificatesWatcher final
       : parent_(std::move(parent)) {}
 
   void OnCertificatesChanged(
-      std::optional<absl::string_view> /* root_certs */,
+      std::shared_ptr<RootCertInfo> /* root_certs */,
       std::optional<PemKeyCertPairList> key_cert_pairs) override {
     if (key_cert_pairs.has_value()) {
-      parent_->SetKeyMaterials("", std::nullopt, key_cert_pairs);
+      parent_->SetKeyMaterials("", nullptr, key_cert_pairs);
     }
   }
 

data/src/core/xds/grpc/xds_client_grpc.cc

@@ -251,6 +251,8 @@ absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
   std::optional<absl::string_view> bootstrap_config = args.GetString(
       GRPC_ARG_TEST_ONLY_DO_NOT_USE_IN_PROD_XDS_BOOTSTRAP_CONFIG);
   if (bootstrap_config.has_value()) {
+    GRPC_TRACE_LOG(xds_client, INFO)
+        << "xDS bootstrap contents: " << *bootstrap_config;
     auto bootstrap = GrpcXdsBootstrap::Create(*bootstrap_config);
     if (!bootstrap.ok()) return bootstrap.status();
     grpc_channel_args* xds_channel_args = args.GetPointer<grpc_channel_args>(
@@ -261,7 +263,8 @@ absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
         MakeRefCounted<GrpcXdsTransportFactory>(channel_args),
         GetStatsPluginGroupForKeyAndChannelArgs(key, args));
   }
-  // Otherwise, use the global instance.
+  // Otherwise, check the global map to see if the XdsClient instance
+  // for this key already exists.
   MutexLock lock(g_mu);
   auto it = g_xds_client_map->find(key);
   if (it != g_xds_client_map->end()) {
@@ -270,7 +273,8 @@ absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
       return xds_client.TakeAsSubclass<GrpcXdsClient>();
     }
   }
-  // Find bootstrap contents.
+  // It doesn't exist, so we'll create it.
+  // First, find bootstrap contents.
   auto bootstrap_contents = GetBootstrapContents(g_fallback_bootstrap_config);
   if (!bootstrap_contents.ok()) return bootstrap_contents.status();
   GRPC_TRACE_LOG(xds_client, INFO)

data/src/core/xds/grpc/xds_common_types_parser.cc

@@ -33,7 +33,6 @@
 #include "envoy/extensions/transport_sockets/tls/v3/common.upb.h"
 #include "envoy/extensions/transport_sockets/tls/v3/tls.upb.h"
 #include "envoy/type/matcher/v3/regex.upb.h"
-#include "envoy/type/matcher/v3/string.upb.h"
 #include "google/protobuf/any.upb.h"
 #include "google/protobuf/struct.upb.h"
 #include "google/protobuf/struct.upbdefs.h"
@@ -48,6 +47,7 @@
 #include "upb/base/status.hpp"
 #include "upb/json/encode.h"
 #include "upb/mem/arena.h"
+#include "xds/type/matcher/v3/regex.upb.h"
 #include "xds/type/v3/typed_struct.upb.h"
 
 namespace grpc_core {
@@ -107,6 +107,140 @@ std::optional<grpc_resolved_address> ParseXdsAddress(
   return *addr;
 }
 
+//
+// StringMatcherParse()
+//
+
+namespace {
+
+class StringMatcherProtoAccessor {
+ public:
+  virtual ~StringMatcherProtoAccessor() = default;
+
+  virtual bool IsPresent() const = 0;
+  virtual bool HasExact() const = 0;
+  virtual upb_StringView GetExact() const = 0;
+  virtual bool HasPrefix() const = 0;
+  virtual upb_StringView GetPrefix() const = 0;
+  virtual bool HasSuffix() const = 0;
+  virtual upb_StringView GetSuffix() const = 0;
+  virtual bool HasContains() const = 0;
+  virtual upb_StringView GetContains() const = 0;
+  virtual bool HasSafeRegex() const = 0;
+  virtual upb_StringView GetSafeRegex() const = 0;
+  virtual bool IgnoreCase() const = 0;
+};
+
+#define GRPC_STRING_MATCHER_PROTO_ACCESSOR_CLASS(prefix)                    \
+  class ProtoAccessor final : public StringMatcherProtoAccessor {           \
+   public:                                                                  \
+    explicit ProtoAccessor(                                                 \
+        const prefix##_type_matcher_v3_StringMatcher* proto)                \
+        : proto_(proto) {}                                                  \
+                                                                            \
+    bool IsPresent() const override { return proto_ != nullptr; }           \
+    bool HasExact() const override {                                        \
+      return prefix##_type_matcher_v3_StringMatcher_has_exact(proto_);      \
+    }                                                                       \
+    upb_StringView GetExact() const override {                              \
+      return prefix##_type_matcher_v3_StringMatcher_exact(proto_);          \
+    }                                                                       \
+    bool HasPrefix() const override {                                       \
+      return prefix##_type_matcher_v3_StringMatcher_has_prefix(proto_);     \
+    }                                                                       \
+    upb_StringView GetPrefix() const override {                             \
+      return prefix##_type_matcher_v3_StringMatcher_prefix(proto_);         \
+    }                                                                       \
+    bool HasSuffix() const override {                                       \
+      return prefix##_type_matcher_v3_StringMatcher_has_suffix(proto_);     \
+    }                                                                       \
+    upb_StringView GetSuffix() const override {                             \
+      return prefix##_type_matcher_v3_StringMatcher_suffix(proto_);         \
+    }                                                                       \
+    bool HasContains() const override {                                     \
+      return prefix##_type_matcher_v3_StringMatcher_has_contains(proto_);   \
+    }                                                                       \
+    upb_StringView GetContains() const override {                           \
+      return prefix##_type_matcher_v3_StringMatcher_contains(proto_);       \
+    }                                                                       \
+    bool HasSafeRegex() const override {                                    \
+      return prefix##_type_matcher_v3_StringMatcher_has_safe_regex(proto_); \
+    }                                                                       \
+    upb_StringView GetSafeRegex() const override {                          \
+      auto* regex_matcher =                                                 \
+          prefix##_type_matcher_v3_StringMatcher_safe_regex(proto_);        \
+      return prefix##_type_matcher_v3_RegexMatcher_regex(regex_matcher);    \
+    }                                                                       \
+    bool IgnoreCase() const override {                                      \
+      return prefix##_type_matcher_v3_StringMatcher_ignore_case(proto_);    \
+    }                                                                       \
+                                                                            \
+   private:                                                                 \
+    const prefix##_type_matcher_v3_StringMatcher* proto_;                   \
+  };
+
+StringMatcher StringMatcherParseInternal(
+    const StringMatcherProtoAccessor& proto, ValidationErrors* errors) {
+  if (!proto.IsPresent()) {
+    errors->AddError("field not present");
+    return StringMatcher();
+  }
+  StringMatcher::Type type;
+  std::string matcher;
+  if (proto.HasExact()) {
+    type = StringMatcher::Type::kExact;
+    matcher = UpbStringToStdString(proto.GetExact());
+  } else if (proto.HasPrefix()) {
+    type = StringMatcher::Type::kPrefix;
+    matcher = UpbStringToStdString(proto.GetPrefix());
+  } else if (proto.HasSuffix()) {
+    type = StringMatcher::Type::kSuffix;
+    matcher = UpbStringToStdString(proto.GetSuffix());
+  } else if (proto.HasContains()) {
+    type = StringMatcher::Type::kContains;
+    matcher = UpbStringToStdString(proto.GetContains());
+  } else if (proto.HasSafeRegex()) {
+    type = StringMatcher::Type::kSafeRegex;
+    matcher = UpbStringToStdString(proto.GetSafeRegex());
+  } else {
+    errors->AddError("invalid string matcher");
+    return StringMatcher();
+  }
+  const bool ignore_case = proto.IgnoreCase();
+  absl::StatusOr<StringMatcher> string_matcher =
+      StringMatcher::Create(type, matcher,
+                            /*case_sensitive=*/!ignore_case);
+  if (!string_matcher.ok()) {
+    errors->AddError(string_matcher.status().message());
+    return StringMatcher();
+  }
+  if (type == StringMatcher::Type::kSafeRegex && ignore_case) {
+    ValidationErrors::ScopedField field(errors, ".ignore_case");
+    errors->AddError("not supported for regex matcher");
+  }
+  return std::move(*string_matcher);
+}
+
+}  // namespace
+
+StringMatcher StringMatcherParse(
+    const XdsResourceType::DecodeContext& /*context*/,
+    const envoy_type_matcher_v3_StringMatcher* matcher_proto,
+    ValidationErrors* errors) {
+  GRPC_STRING_MATCHER_PROTO_ACCESSOR_CLASS(envoy);
+  ProtoAccessor proto_accessor(matcher_proto);
+  return StringMatcherParseInternal(proto_accessor, errors);
+}
+
+StringMatcher StringMatcherParse(
+    const XdsResourceType::DecodeContext& /*context*/,
+    const xds_type_matcher_v3_StringMatcher* matcher_proto,
+    ValidationErrors* errors) {
+  GRPC_STRING_MATCHER_PROTO_ACCESSOR_CLASS(xds);
+  ProtoAccessor proto_accessor(matcher_proto);
+  return StringMatcherParseInternal(proto_accessor, errors);
+}
+
 //
 // CommonTlsContextParse()
 //
@@ -182,56 +316,10 @@ CertificateValidationContextParse(
   for (size_t i = 0; i < len; ++i) {
     ValidationErrors::ScopedField field(
         errors, absl::StrCat(".match_subject_alt_names[", i, "]"));
-    StringMatcher::Type type;
-    std::string matcher;
-    if (envoy_type_matcher_v3_StringMatcher_has_exact(
-            subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kExact;
-      matcher = UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_exact(
-          subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_prefix(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kPrefix;
-      matcher = UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_prefix(
-          subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_suffix(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kSuffix;
-      matcher = UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_suffix(
-          subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_contains(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kContains;
-      matcher =
-          UpbStringToStdString(envoy_type_matcher_v3_StringMatcher_contains(
-              subject_alt_names_matchers[i]));
-    } else if (envoy_type_matcher_v3_StringMatcher_has_safe_regex(
-                   subject_alt_names_matchers[i])) {
-      type = StringMatcher::Type::kSafeRegex;
-      auto* regex_matcher = envoy_type_matcher_v3_StringMatcher_safe_regex(
-          subject_alt_names_matchers[i]);
-      matcher = UpbStringToStdString(
-          envoy_type_matcher_v3_RegexMatcher_regex(regex_matcher));
-    } else {
-      errors->AddError("invalid StringMatcher specified");
-      continue;
-    }
-    bool ignore_case = envoy_type_matcher_v3_StringMatcher_ignore_case(
-        subject_alt_names_matchers[i]);
-    absl::StatusOr<StringMatcher> string_matcher =
-        StringMatcher::Create(type, matcher,
-                              /*case_sensitive=*/!ignore_case);
-    if (!string_matcher.ok()) {
-      errors->AddError(string_matcher.status().message());
-      continue;
-    }
-    if (type == StringMatcher::Type::kSafeRegex && ignore_case) {
-      ValidationErrors::ScopedField field(errors, ".ignore_case");
-      errors->AddError("not supported for regex matcher");
-      continue;
-    }
+    auto string_matcher =
+        StringMatcherParse(context, subject_alt_names_matchers[i], errors);
     certificate_validation_context.match_subject_alt_names.push_back(
-        std::move(string_matcher.value()));
+        std::move(string_matcher));
   }
   auto* ca_certificate_provider_instance =
       envoy_extensions_transport_sockets_tls_v3_CertificateValidationContext_ca_certificate_provider_instance(

data/src/core/xds/grpc/xds_common_types_parser.h

@@ -21,15 +21,18 @@
 
 #include "envoy/config/core/v3/base.upb.h"
 #include "envoy/extensions/transport_sockets/tls/v3/tls.upb.h"
+#include "envoy/type/matcher/v3/string.upb.h"
 #include "google/protobuf/any.upb.h"
 #include "google/protobuf/duration.upb.h"
 #include "google/protobuf/struct.upb.h"
 #include "google/protobuf/wrappers.upb.h"
 #include "src/core/lib/iomgr/resolved_address.h"
+#include "src/core/util/matchers.h"
 #include "src/core/util/time.h"
 #include "src/core/util/validation_errors.h"
 #include "src/core/xds/grpc/xds_common_types.h"
 #include "src/core/xds/xds_client/xds_resource_type.h"
+#include "xds/type/matcher/v3/string.upb.h"
 
 namespace grpc_core {
 
@@ -58,6 +61,15 @@ inline std::optional<uint32_t> ParseUInt32Value(
 std::optional<grpc_resolved_address> ParseXdsAddress(
     const envoy_config_core_v3_Address* address, ValidationErrors* errors);
 
+StringMatcher StringMatcherParse(
+    const XdsResourceType::DecodeContext& context,
+    const envoy_type_matcher_v3_StringMatcher* matcher_proto,
+    ValidationErrors* errors);
+StringMatcher StringMatcherParse(
+    const XdsResourceType::DecodeContext& context,
+    const xds_type_matcher_v3_StringMatcher* matcher_proto,
+    ValidationErrors* errors);
+
 CommonTlsContext CommonTlsContextParse(
     const XdsResourceType::DecodeContext& context,
     const envoy_extensions_transport_sockets_tls_v3_CommonTlsContext*

data/src/core/xds/grpc/xds_http_filter.h

@@ -24,6 +24,7 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 #include "src/core/call/interception_chain.h"
+#include "src/core/filter/blackboard.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/util/json/json.h"
@@ -119,6 +120,12 @@ class XdsHttpFilterImpl {
   virtual absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
       const FilterConfig& hcm_filter_config) const = 0;
 
+  // Adds state to new_blackboard if needed for the specified filter
+  // config.  Copies existing state from old_blackboard as appropriate.
+  virtual void UpdateBlackboard(const FilterConfig& /*hcm_filter_config*/,
+                                const Blackboard* /*old_blackboard*/,
+                                Blackboard* /*new_blackboard*/) const {}
+
   // Returns true if the filter is supported on clients; false otherwise
   virtual bool IsSupportedOnClients() const = 0;
 

data/src/core/xds/grpc/xds_http_gcp_authn_filter.cc

@@ -138,4 +138,26 @@ XdsHttpGcpAuthnFilter::GenerateServiceConfig(
                                 JsonDump(hcm_filter_config.config)};
 }
 
+void XdsHttpGcpAuthnFilter::UpdateBlackboard(
+    const FilterConfig& hcm_filter_config, const Blackboard* old_blackboard,
+    Blackboard* new_blackboard) const {
+  ValidationErrors errors;
+  auto config = LoadFromJson<GcpAuthenticationParsedConfig::Config>(
+      hcm_filter_config.config, JsonArgs(), &errors);
+  CHECK(errors.ok()) << errors.message("filter config validation failed");
+  RefCountedPtr<GcpAuthenticationFilter::CallCredentialsCache> cache;
+  if (old_blackboard != nullptr) {
+    cache = old_blackboard->Get<GcpAuthenticationFilter::CallCredentialsCache>(
+        config.filter_instance_name);
+  }
+  if (cache != nullptr) {
+    cache->SetMaxSize(config.cache_size);
+  } else {
+    cache = MakeRefCounted<GcpAuthenticationFilter::CallCredentialsCache>(
+        config.cache_size);
+  }
+  CHECK_NE(new_blackboard, nullptr);
+  new_blackboard->Set(config.filter_instance_name, std::move(cache));
+}
+
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_http_gcp_authn_filter.h

@@ -52,6 +52,9 @@ class XdsHttpGcpAuthnFilter final : public XdsHttpFilterImpl {
       const FilterConfig* filter_config_override) const override;
   absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
       const FilterConfig& hcm_filter_config) const override;
+  void UpdateBlackboard(const FilterConfig& hcm_filter_config,
+                        const Blackboard* old_blackboard,
+                        Blackboard* new_blackboard) const override;
   bool IsSupportedOnClients() const override { return true; }
   bool IsSupportedOnServers() const override { return false; }
 };

data/src/core/xds/grpc/xds_route_config_parser.cc

@@ -237,7 +237,8 @@ std::optional<StringMatcher> RoutePathMatchParse(
   return std::move(*string_matcher);
 }
 
-void RouteHeaderMatchersParse(const envoy_config_route_v3_RouteMatch* match,
+void RouteHeaderMatchersParse(const XdsResourceType::DecodeContext& context,
+                              const envoy_config_route_v3_RouteMatch* match,
                               XdsRouteConfigResource::Route* route,
                               ValidationErrors* errors) {
   size_t size;
@@ -250,6 +251,18 @@ void RouteHeaderMatchersParse(const envoy_config_route_v3_RouteMatch* match,
     CHECK_NE(header, nullptr);
     const std::string name =
         UpbStringToStdString(envoy_config_route_v3_HeaderMatcher_name(header));
+    const bool invert_match =
+        envoy_config_route_v3_HeaderMatcher_invert_match(header);
+    if (envoy_config_route_v3_HeaderMatcher_has_string_match(header)) {
+      ValidationErrors::ScopedField field(errors, ".string_match");
+      auto string_matcher = StringMatcherParse(
+          context, envoy_config_route_v3_HeaderMatcher_string_match(header),
+          errors);
+      route->matchers.header_matchers.emplace_back(
+          HeaderMatcher::CreateFromStringMatcher(
+              name, std::move(string_matcher), invert_match));
+      continue;
+    }
     HeaderMatcher::Type type;
     std::string match_string;
     int64_t range_start = 0;
@@ -290,46 +303,10 @@ void RouteHeaderMatchersParse(const envoy_config_route_v3_RouteMatch* match,
     } else if (envoy_config_route_v3_HeaderMatcher_has_present_match(header)) {
       type = HeaderMatcher::Type::kPresent;
       present_match = envoy_config_route_v3_HeaderMatcher_present_match(header);
-    } else if (envoy_config_route_v3_HeaderMatcher_has_string_match(header)) {
-      ValidationErrors::ScopedField field(errors, ".string_match");
-      const auto* matcher =
-          envoy_config_route_v3_HeaderMatcher_string_match(header);
-      CHECK_NE(matcher, nullptr);
-      if (envoy_type_matcher_v3_StringMatcher_has_exact(matcher)) {
-        type = HeaderMatcher::Type::kExact;
-        match_string = UpbStringToStdString(
-            envoy_type_matcher_v3_StringMatcher_exact(matcher));
-      } else if (envoy_type_matcher_v3_StringMatcher_has_prefix(matcher)) {
-        type = HeaderMatcher::Type::kPrefix;
-        match_string = UpbStringToStdString(
-            envoy_type_matcher_v3_StringMatcher_prefix(matcher));
-      } else if (envoy_type_matcher_v3_StringMatcher_has_suffix(matcher)) {
-        type = HeaderMatcher::Type::kSuffix;
-        match_string = UpbStringToStdString(
-            envoy_type_matcher_v3_StringMatcher_suffix(matcher));
-      } else if (envoy_type_matcher_v3_StringMatcher_has_contains(matcher)) {
-        type = HeaderMatcher::Type::kContains;
-        match_string = UpbStringToStdString(
-            envoy_type_matcher_v3_StringMatcher_contains(matcher));
-      } else if (envoy_type_matcher_v3_StringMatcher_has_safe_regex(matcher)) {
-        type = HeaderMatcher::Type::kSafeRegex;
-        const auto* regex_matcher =
-            envoy_type_matcher_v3_StringMatcher_safe_regex(matcher);
-        CHECK_NE(regex_matcher, nullptr);
-        match_string = UpbStringToStdString(
-            envoy_type_matcher_v3_RegexMatcher_regex(regex_matcher));
-      } else {
-        errors->AddError("invalid string matcher");
-        continue;
-      }
-      case_sensitive =
-          !envoy_type_matcher_v3_StringMatcher_ignore_case(matcher);
     } else {
       errors->AddError("invalid header matcher");
       continue;
     }
-    bool invert_match =
-        envoy_config_route_v3_HeaderMatcher_invert_match(header);
     absl::StatusOr<HeaderMatcher> header_matcher =
         HeaderMatcher::Create(name, type, match_string, range_start, range_end,
                               present_match, invert_match, case_sensitive);
@@ -746,7 +723,7 @@ std::optional<XdsRouteConfigResource::Route> ParseRoute(
     auto path_matcher = RoutePathMatchParse(match, errors);
     if (!path_matcher.has_value()) return std::nullopt;
     route.matchers.path_matcher = std::move(*path_matcher);
-    RouteHeaderMatchersParse(match, &route, errors);
+    RouteHeaderMatchersParse(context, match, &route, errors);
     RouteRuntimeFractionParse(match, &route, errors);
   }
   // Parse route action.