grpc 1.74.1 → 1.75.0.pre1

data/src/core/credentials/transport/tls/tls_security_connector.cc

@@ -312,7 +312,7 @@ TlsChannelSecurityConnector::TlsChannelSecurityConnector(
   // hence no need to register the watcher.
   bool use_default_roots = !options_->watch_root_cert();
   if (use_default_roots && !options_->watch_identity_pair()) {
-    watcher_ptr->OnCertificatesChanged(std::nullopt, std::nullopt);
+    watcher_ptr->OnCertificatesChanged(nullptr, std::nullopt);
   } else {
     distributor->WatchTlsCertificates(std::move(watcher_ptr),
                                       watched_root_cert_name,
@@ -429,18 +429,18 @@ ArenaPromise<absl::Status> TlsChannelSecurityConnector::CheckCallHost(
 }
 
 void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
-    OnCertificatesChanged(std::optional<absl::string_view> root_certs,
+    OnCertificatesChanged(std::shared_ptr<RootCertInfo> root_certs,
                           std::optional<PemKeyCertPairList> key_cert_pairs) {
   CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
-  if (root_certs.has_value()) {
-    security_connector_->pem_root_certs_ = root_certs;
+  if (root_certs != nullptr) {
+    security_connector_->root_cert_info_ = std::move(root_certs);
   }
   if (key_cert_pairs.has_value()) {
     security_connector_->pem_key_cert_pair_list_ = std::move(key_cert_pairs);
   }
   const bool root_ready = !security_connector_->options_->watch_root_cert() ||
-                          security_connector_->pem_root_certs_.has_value();
+                          security_connector_->root_cert_info_ != nullptr;
   const bool identity_ready =
       !security_connector_->options_->watch_identity_pair() ||
       security_connector_->pem_key_cert_pair_list_.has_value();
@@ -525,21 +525,13 @@ TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
   if (client_handshaker_factory_ != nullptr) {
     tsi_ssl_client_handshaker_factory_unref(client_handshaker_factory_);
   }
-  std::string pem_root_certs;
-  if (pem_root_certs_.has_value()) {
-    // TODO(ZhenLian): update the underlying TSI layer to use C++ types like
-    // std::string and absl::string_view to avoid making another copy here.
-    pem_root_certs = std::string(*pem_root_certs_);
-  }
   tsi_ssl_pem_key_cert_pair* pem_key_cert_pair = nullptr;
   if (pem_key_cert_pair_list_.has_value()) {
     pem_key_cert_pair = ConvertToTsiPemKeyCertPair(*pem_key_cert_pair_list_);
   }
   bool use_default_roots = !options_->watch_root_cert();
   grpc_security_status status = grpc_ssl_tsi_client_handshaker_factory_init(
-      pem_key_cert_pair,
-      pem_root_certs.empty() || use_default_roots ? nullptr
-                                                  : pem_root_certs.c_str(),
+      pem_key_cert_pair, use_default_roots ? nullptr : root_cert_info_,
       skip_server_certificate_verification,
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()), ssl_session_cache_,
@@ -689,18 +681,18 @@ int TlsServerSecurityConnector::cmp(
 }
 
 void TlsServerSecurityConnector::TlsServerCertificateWatcher::
-    OnCertificatesChanged(std::optional<absl::string_view> root_certs,
+    OnCertificatesChanged(std::shared_ptr<RootCertInfo> roots,
                           std::optional<PemKeyCertPairList> key_cert_pairs) {
   CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
-  if (root_certs.has_value()) {
-    security_connector_->pem_root_certs_ = root_certs;
+  if (roots != nullptr) {
+    security_connector_->root_cert_info_ = std::move(roots);
   }
   if (key_cert_pairs.has_value()) {
     security_connector_->pem_key_cert_pair_list_ = std::move(key_cert_pairs);
   }
   bool root_being_watched = security_connector_->options_->watch_root_cert();
-  bool root_has_value = security_connector_->pem_root_certs_.has_value();
+  bool root_has_value = security_connector_->root_cert_info_ != nullptr;
   bool identity_being_watched =
       security_connector_->options_->watch_identity_pair();
   bool identity_has_value =
@@ -790,18 +782,11 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
   // The identity certs on the server side shouldn't be empty.
   CHECK(pem_key_cert_pair_list_.has_value());
   CHECK(!(*pem_key_cert_pair_list_).empty());
-  std::string pem_root_certs;
-  if (pem_root_certs_.has_value()) {
-    // TODO(ZhenLian): update the underlying TSI layer to use C++ types like
-    // std::string and absl::string_view to avoid making another copy here.
-    pem_root_certs = std::string(*pem_root_certs_);
-  }
   tsi_ssl_pem_key_cert_pair* pem_key_cert_pairs = nullptr;
   pem_key_cert_pairs = ConvertToTsiPemKeyCertPair(*pem_key_cert_pair_list_);
   size_t num_key_cert_pairs = (*pem_key_cert_pair_list_).size();
   grpc_security_status status = grpc_ssl_tsi_server_handshaker_factory_init(
-      pem_key_cert_pairs, num_key_cert_pairs,
-      pem_root_certs.empty() ? nullptr : pem_root_certs.c_str(),
+      pem_key_cert_pairs, num_key_cert_pairs, root_cert_info_,
       options_->cert_request_type(),
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()),

data/src/core/credentials/transport/tls/tls_security_connector.h

@@ -94,14 +94,14 @@ class TlsChannelSecurityConnector final
     return client_handshaker_factory_;
   };
 
-  std::optional<absl::string_view> RootCertsForTesting() {
+  std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
     MutexLock lock(&mu_);
-    return pem_root_certs_;
+    return pem_key_cert_pair_list_;
   }
 
-  std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
+  std::shared_ptr<RootCertInfo> RootCertInfoForTesting() {
     MutexLock lock(&mu_);
-    return pem_key_cert_pair_list_;
+    return root_cert_info_;
   }
 
  private:
@@ -115,7 +115,7 @@ class TlsChannelSecurityConnector final
         TlsChannelSecurityConnector* security_connector)
         : security_connector_(security_connector) {}
     void OnCertificatesChanged(
-        std::optional<absl::string_view> root_certs,
+        std::shared_ptr<RootCertInfo> root_certs,
         std::optional<PemKeyCertPairList> key_cert_pairs) override;
     void OnError(grpc_error_handle root_cert_error,
                  grpc_error_handle identity_cert_error) override;
@@ -165,9 +165,9 @@ class TlsChannelSecurityConnector final
       ABSL_GUARDED_BY(mu_) = nullptr;
   tsi_ssl_session_cache* ssl_session_cache_ ABSL_GUARDED_BY(mu_) = nullptr;
   RefCountedPtr<TlsSessionKeyLogger> tls_session_key_logger_;
-  std::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
   std::optional<PemKeyCertPairList> pem_key_cert_pair_list_
       ABSL_GUARDED_BY(mu_);
+  std::shared_ptr<RootCertInfo> root_cert_info_ ABSL_GUARDED_BY(mu_);
   std::map<grpc_closure* /*on_peer_checked*/, ChannelPendingVerifierRequest*>
       pending_verifier_requests_ ABSL_GUARDED_BY(verifier_request_map_mu_);
 };
@@ -204,14 +204,14 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
     return server_handshaker_factory_;
   };
 
-  std::optional<absl::string_view> RootCertsForTesting() {
+  std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
     MutexLock lock(&mu_);
-    return pem_root_certs_;
+    return pem_key_cert_pair_list_;
   }
 
-  std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
+  std::shared_ptr<RootCertInfo> RootCertInfoForTesting() {
     MutexLock lock(&mu_);
-    return pem_key_cert_pair_list_;
+    return root_cert_info_;
   }
 
  private:
@@ -225,7 +225,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
         TlsServerSecurityConnector* security_connector)
         : security_connector_(security_connector) {}
     void OnCertificatesChanged(
-        std::optional<absl::string_view> root_certs,
+        std::shared_ptr<RootCertInfo> roots,
         std::optional<PemKeyCertPairList> key_cert_pairs) override;
 
     void OnError(grpc_error_handle root_cert_error,
@@ -272,9 +272,9 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
       certificate_watcher_ = nullptr;
   tsi_ssl_server_handshaker_factory* server_handshaker_factory_
       ABSL_GUARDED_BY(mu_) = nullptr;
-  std::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
   std::optional<PemKeyCertPairList> pem_key_cert_pair_list_
       ABSL_GUARDED_BY(mu_);
+  std::shared_ptr<RootCertInfo> root_cert_info_ ABSL_GUARDED_BY(mu_);
   RefCountedPtr<TlsSessionKeyLogger> tls_session_key_logger_;
   std::map<grpc_closure* /*on_peer_checked*/, ServerPendingVerifierRequest*>
       pending_verifier_requests_ ABSL_GUARDED_BY(verifier_request_map_mu_);

data/src/core/ext/filters/backend_metrics/backend_metric_filter.cc

@@ -116,8 +116,7 @@ BackendMetricFilter::Create(const ChannelArgs&, ChannelFilter::Args) {
 }
 
 void BackendMetricFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "BackendMetricFilter::Call::OnServerTrailingMetadata");
+  GRPC_LATENT_SEE_SCOPE("BackendMetricFilter::Call::OnServerTrailingMetadata");
   if (md.get(GrpcCallWasCancelled()).value_or(false)) return;
   auto* ctx = MaybeGetContext<BackendMetricProvider>();
   if (ctx == nullptr) {

data/src/core/ext/filters/http/client/http_client_filter.cc

@@ -107,8 +107,7 @@ Slice UserAgentFromArgs(const ChannelArgs& args,
 
 void HttpClientFilter::Call::OnClientInitialMetadata(ClientMetadata& md,
                                                      HttpClientFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpClientFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpClientFilter::Call::OnClientInitialMetadata");
   if (filter->test_only_use_put_requests_) {
     md.Set(HttpMethodMetadata(), HttpMethodMetadata::kPut);
   } else {
@@ -122,15 +121,13 @@ void HttpClientFilter::Call::OnClientInitialMetadata(ClientMetadata& md,
 
 absl::Status HttpClientFilter::Call::OnServerInitialMetadata(
     ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpClientFilter::Call::OnServerInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpClientFilter::Call::OnServerInitialMetadata");
   return CheckServerMetadata(&md);
 }
 
 absl::Status HttpClientFilter::Call::OnServerTrailingMetadata(
     ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpClientFilter::Call::OnServerTrailingMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpClientFilter::Call::OnServerTrailingMetadata");
   return CheckServerMetadata(&md);
 }
 

data/src/core/ext/filters/http/client_authority_filter.cc

@@ -51,8 +51,7 @@ ClientAuthorityFilter::Create(const ChannelArgs& args, ChannelFilter::Args) {
 
 void ClientAuthorityFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, ClientAuthorityFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ClientAuthorityFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("ClientAuthorityFilter::Call::OnClientInitialMetadata");
   // If no authority is set, set the default authority.
   if (md.get_pointer(HttpAuthorityMetadata()) == nullptr) {
     md.Set(HttpAuthorityMetadata(), filter->default_authority_.Ref());

data/src/core/ext/filters/http/message_compress/compression_filter.cc

@@ -229,7 +229,7 @@ ChannelCompression::DecompressArgs ChannelCompression::HandleIncomingMetadata(
 
 void ClientCompressionFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, ClientCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientCompressionFilter::Call::OnClientInitialMetadata");
   compression_algorithm_ =
       filter->compression_engine_.HandleOutgoingMetadata(md);
@@ -238,7 +238,7 @@ void ClientCompressionFilter::Call::OnClientInitialMetadata(
 
 MessageHandle ClientCompressionFilter::Call::OnClientToServerMessage(
     MessageHandle message, ClientCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientCompressionFilter::Call::OnClientToServerMessage");
   return filter->compression_engine_.CompressMessage(
       std::move(message), compression_algorithm_, call_tracer_);
@@ -246,7 +246,7 @@ MessageHandle ClientCompressionFilter::Call::OnClientToServerMessage(
 
 void ClientCompressionFilter::Call::OnServerInitialMetadata(
     ServerMetadata& md, ClientCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientCompressionFilter::Call::OnServerInitialMetadata");
   decompress_args_ = filter->compression_engine_.HandleIncomingMetadata(md);
 }
@@ -254,7 +254,7 @@ void ClientCompressionFilter::Call::OnServerInitialMetadata(
 absl::StatusOr<MessageHandle>
 ClientCompressionFilter::Call::OnServerToClientMessage(
     MessageHandle message, ClientCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientCompressionFilter::Call::OnServerToClientMessage");
   return filter->compression_engine_.DecompressMessage(
       /*is_client=*/true, std::move(message), decompress_args_, call_tracer_);
@@ -262,7 +262,7 @@ ClientCompressionFilter::Call::OnServerToClientMessage(
 
 void ServerCompressionFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, ServerCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerCompressionFilter::Call::OnClientInitialMetadata");
   decompress_args_ = filter->compression_engine_.HandleIncomingMetadata(md);
 }
@@ -270,7 +270,7 @@ void ServerCompressionFilter::Call::OnClientInitialMetadata(
 absl::StatusOr<MessageHandle>
 ServerCompressionFilter::Call::OnClientToServerMessage(
     MessageHandle message, ServerCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerCompressionFilter::Call::OnClientToServerMessage");
   return filter->compression_engine_.DecompressMessage(
       /*is_client=*/false, std::move(message), decompress_args_,
@@ -279,7 +279,7 @@ ServerCompressionFilter::Call::OnClientToServerMessage(
 
 void ServerCompressionFilter::Call::OnServerInitialMetadata(
     ServerMetadata& md, ServerCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerCompressionFilter::Call::OnServerInitialMetadata");
   compression_algorithm_ =
       filter->compression_engine_.HandleOutgoingMetadata(md);
@@ -287,7 +287,7 @@ void ServerCompressionFilter::Call::OnServerInitialMetadata(
 
 MessageHandle ServerCompressionFilter::Call::OnServerToClientMessage(
     MessageHandle message, ServerCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerCompressionFilter::Call::OnServerToClientMessage");
   return filter->compression_engine_.CompressMessage(
       std::move(message), compression_algorithm_,

data/src/core/ext/filters/http/server/http_server_filter.cc

@@ -71,8 +71,7 @@ ServerMetadataHandle MalformedRequest(absl::string_view explanation) {
 
 ServerMetadataHandle HttpServerFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, HttpServerFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpServerFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpServerFilter::Call::OnClientInitialMetadata");
   auto method = md.get(HttpMethodMetadata());
   if (method.has_value()) {
     switch (*method) {
@@ -135,8 +134,7 @@ ServerMetadataHandle HttpServerFilter::Call::OnClientInitialMetadata(
 }
 
 void HttpServerFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpServerFilter::Call::OnServerInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpServerFilter::Call::OnServerInitialMetadata");
   GRPC_TRACE_LOG(call, INFO)
       << GetContext<Activity>()->DebugTag() << "[http-server] Write metadata";
   FilterOutgoingMetadata(&md);
@@ -145,8 +143,7 @@ void HttpServerFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
 }
 
 void HttpServerFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpServerFilter::Call::OnServerTrailingMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpServerFilter::Call::OnServerTrailingMetadata");
   FilterOutgoingMetadata(&md);
 }
 

data/src/core/ext/filters/message_size/message_size_filter.cc

@@ -187,7 +187,7 @@ void ClientMessageSizeFilter::Call::OnClientInitialMetadata(
 
 ServerMetadataHandle ServerMessageSizeFilter::Call::OnClientToServerMessage(
     const Message& message, ServerMessageSizeFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerMessageSizeFilter::Call::OnClientToServerMessage");
   return CheckPayload(message, filter->parsed_config_.max_recv_size(),
                       /*is_client=*/false, false);
@@ -195,7 +195,7 @@ ServerMetadataHandle ServerMessageSizeFilter::Call::OnClientToServerMessage(
 
 ServerMetadataHandle ServerMessageSizeFilter::Call::OnServerToClientMessage(
     const Message& message, ServerMessageSizeFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerMessageSizeFilter::Call::OnServerToClientMessage");
   return CheckPayload(message, filter->parsed_config_.max_send_size(),
                       /*is_client=*/false, true);
@@ -203,7 +203,7 @@ ServerMetadataHandle ServerMessageSizeFilter::Call::OnServerToClientMessage(
 
 ServerMetadataHandle ClientMessageSizeFilter::Call::OnClientToServerMessage(
     const Message& message) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientMessageSizeFilter::Call::OnClientToServerMessage");
   return CheckPayload(message, limits_.max_send_size(), /*is_client=*/true,
                       true);
@@ -211,7 +211,7 @@ ServerMetadataHandle ClientMessageSizeFilter::Call::OnClientToServerMessage(
 
 ServerMetadataHandle ClientMessageSizeFilter::Call::OnServerToClientMessage(
     const Message& message) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientMessageSizeFilter::Call::OnServerToClientMessage");
   return CheckPayload(message, limits_.max_recv_size(), /*is_client=*/true,
                       false);

data/src/core/ext/filters/rbac/rbac_filter.cc

@@ -43,7 +43,7 @@ namespace grpc_core {
 
 absl::Status RbacFilter::Call::OnClientInitialMetadata(ClientMetadata& md,
                                                        RbacFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE("RbacFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("RbacFilter::Call::OnClientInitialMetadata");
   // Fetch and apply the rbac policy from the service config.
   auto* service_config_call_data = GetContext<ServiceConfigCallData>();
   auto* method_params = static_cast<RbacMethodParsedConfig*>(

data/src/core/ext/filters/stateful_session/stateful_session_filter.cc

@@ -213,8 +213,7 @@ bool IsConfiguredPath(absl::string_view configured_path,
 
 void StatefulSessionFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, StatefulSessionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "StatefulSessionFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("StatefulSessionFilter::Call::OnClientInitialMetadata");
   // Get config.
   auto* service_config_call_data = GetContext<ServiceConfigCallData>();
   CHECK_NE(service_config_call_data, nullptr);
@@ -254,8 +253,7 @@ void StatefulSessionFilter::Call::OnClientInitialMetadata(
 }
 
 void StatefulSessionFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "StatefulSessionFilter::Call::OnServerInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("StatefulSessionFilter::Call::OnServerInitialMetadata");
   if (!perform_filtering_) return;
   // Add cookie to server initial metadata if needed.
   MaybeUpdateServerInitialMetadata(cookie_config_, cluster_changed_,
@@ -264,7 +262,7 @@ void StatefulSessionFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
 }
 
 void StatefulSessionFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "StatefulSessionFilter::Call::OnServerTrailingMetadata");
   if (!perform_filtering_) return;
   // If we got a Trailers-Only response, then add the

data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc

@@ -69,6 +69,7 @@
 #include "src/core/ext/transport/chttp2/transport/frame_security.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_encoder.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings_manager.h"
 #include "src/core/ext/transport/chttp2/transport/http2_stats_collector.h"
 #include "src/core/ext/transport/chttp2/transport/http2_status.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
@@ -1136,7 +1137,7 @@ static const char* begin_writing_desc(bool partial) {
 static void write_action_begin_locked(
     grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
     grpc_error_handle /*error_ignored*/) {
-  GRPC_LATENT_SEE_INNER_SCOPE("write_action_begin_locked");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("write_action_begin_locked");
   CHECK(t->write_state != GRPC_CHTTP2_WRITE_STATE_IDLE);
   grpc_chttp2_begin_write_result r;
   if (!t->closed_with_error.ok()) {
@@ -2896,7 +2897,7 @@ static void read_action(grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
 static void read_action_parse_loop_locked(
     grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
     grpc_error_handle error) {
-  GRPC_LATENT_SEE_INNER_SCOPE("read_action_parse_loop_locked");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("read_action_parse_loop_locked");
   if (t->closed_with_error.ok()) {
     grpc_error_handle errors[3] = {error, absl::OkStatus(), absl::OkStatus()};
     size_t requests_started = 0;

data/src/core/ext/transport/chttp2/transport/flow_control.cc

@@ -34,6 +34,7 @@
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings_manager.h"
 #include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/util/useful.h"

data/src/core/ext/transport/chttp2/transport/flow_control.h

@@ -34,6 +34,7 @@
 #include "absl/strings/string_view.h"
 #include "src/core/channelz/property_list.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings_manager.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/lib/transport/bdp_estimator.h"

data/src/core/ext/transport/chttp2/transport/frame.cc

@@ -24,20 +24,69 @@
 #include "absl/log/check.h"
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_buffer.h"
 #include "src/core/util/crash.h"
 
+// TODO(tjagtap) TODO(akshitpatel): [PH2][P3] : Write micro benchmarks for
+// framing code
+
 using grpc_core::http2::Http2ErrorCode;
 using grpc_core::http2::Http2Status;
 using grpc_core::http2::ValueOrHttp2Status;
 
 namespace grpc_core {
 
+///////////////////////////////////////////////////////////////////////////////
+// Settings Frame Validations
+
+bool IsUnknownSetting(const uint16_t setting_id) {
+  // RFC9113 : An endpoint that receives a SETTINGS frame with any unknown
+  // or unsupported identifier MUST ignore that setting.
+  return setting_id < Http2Settings::kHeaderTableSizeWireId ||
+         setting_id > Http2Settings::kGrpcAllowSecurityFrameWireId ||
+         (setting_id > Http2Settings::kMaxHeaderListSizeWireId &&
+          setting_id < Http2Settings::kGrpcAllowTrueBinaryMetadataWireId);
+}
+
+Http2Status ValidateSettingsValues(
+    std::vector<Http2SettingsFrame::Setting>& list) {
+  for (const auto& setting : list) {
+    if (GPR_UNLIKELY(setting.id == Http2Settings::kInitialWindowSizeWireId &&
+                     setting.value > RFC9113::kMaxSize31Bit)) {
+      LOG(ERROR)
+          << "ValidateSettingsValues Invalid "
+             "Setting:{setting.id:kInitialWindowSizeWireId, setting.value: "
+          << setting.value << "}";
+      return Http2Status::Http2ConnectionError(
+          Http2ErrorCode::kFlowControlError,
+          absl::StrCat(RFC9113::kIncorrectWindowSizeSetting,
+                       "Invalid Setting:{setting.id:kInitialWindowSizeWireId, "
+                       "setting.value: ",
+                       setting.value));
+    } else if (GPR_UNLIKELY(setting.id == Http2Settings::kMaxFrameSizeWireId &&
+                            (setting.value < RFC9113::kMinimumFrameSize ||
+                             setting.value > RFC9113::kMaximumFrameSize))) {
+      LOG(ERROR) << "ValidateSettingsValues Invalid "
+                    "Setting:{setting.id:kMaxFrameSizeWireId, setting.value: "
+                 << setting.value << "}";
+      return Http2Status::Http2ConnectionError(
+          Http2ErrorCode::kProtocolError,
+          absl::StrCat(RFC9113::kIncorrectFrameSizeSetting,
+                       "Invalid Setting:{setting.id:kMaxFrameSizeWireId, "
+                       "setting.value: ",
+                       setting.value));
+    }
+  }
+  DVLOG(2) << "Http2Transport ValidateSettingsValues Valid";
+  return Http2Status::Ok();
+}
+
 namespace {
 
-// TODO(tjagtap) TODO(akshitpatel): [PH2][P3] : Write micro benchmarks for
-// framing code
+///////////////////////////////////////////////////////////////////////////////
+// HTTP2 Framing Code
 
 // HTTP2 Frame Types
 enum class FrameType : uint8_t {
@@ -431,7 +480,8 @@ ValueOrHttp2Status<Http2Frame> ParseSettingsFrame(const Http2FrameHeader& hdr,
           Http2ErrorCode::kFrameSizeError,
           absl::StrCat(RFC9113::kSettingsLength0, hdr.ToString()));
     }
-    return ValueOrHttp2Status<Http2Frame>(Http2SettingsFrame{true, {}});
+    return ValueOrHttp2Status<Http2Frame>(
+        Http2SettingsFrame{/*ack=*/true, /*settings=*/{}});
   }
 
   if (GPR_UNLIKELY(payload.Length() % 6 != 0)) {
@@ -440,13 +490,18 @@ ValueOrHttp2Status<Http2Frame> ParseSettingsFrame(const Http2FrameHeader& hdr,
         absl::StrCat(RFC9113::kSettingsLength6x, hdr.ToString()));
   }
 
-  Http2SettingsFrame frame{false, {}};
+  Http2SettingsFrame frame{/*ack=*/false, /*settings=*/{}};
   while (payload.Length() != 0) {
     uint8_t buffer[6];
     payload.MoveFirstNBytesIntoBuffer(6, buffer);
+    uint16_t setting_id = Read2b(buffer);
+    uint32_t setting_value = Read4b(buffer + 2);
+    if (GPR_UNLIKELY(IsUnknownSetting(setting_id))) {
+      continue;
+    }
     frame.settings.push_back({
-        Read2b(buffer),
-        Read4b(buffer + 2),
+        setting_id,
+        setting_value,
     });
   }
   return ValueOrHttp2Status<Http2Frame>(std::move(frame));
@@ -578,6 +633,7 @@ std::string Http2FrameTypeString(FrameType frame_type) {
   }
   return absl::StrCat("UNKNOWN(", static_cast<uint8_t>(frame_type), ")");
 }
+
 }  // namespace
 
 std::string Http2FrameHeader::ToString() const {
@@ -642,6 +698,9 @@ http2::Http2ErrorCode Http2ErrorCodeFromRstFrameErrorCode(uint32_t error_code) {
   return static_cast<http2::Http2ErrorCode>(error_code);
 }
 
+///////////////////////////////////////////////////////////////////////////////
+// GRPC Header
+
 GrpcMessageHeader ExtractGrpcHeader(SliceBuffer& payload) {
   CHECK_GE(payload.Length(), kGrpcHeaderSizeInBytes);
   uint8_t buffer[kGrpcHeaderSizeInBytes];
@@ -659,4 +718,28 @@ void AppendGrpcHeaderToSliceBuffer(SliceBuffer& payload, const uint8_t flags,
   Write4b(length, frame_hdr + 1);
 }
 
+Http2Status ValidateFrameHeader(const uint32_t max_frame_size_setting,
+                                const bool incoming_header_in_progress,
+                                const uint32_t incoming_header_stream_id,
+                                Http2FrameHeader& current_frame_header) {
+  if (GPR_UNLIKELY(current_frame_header.length > max_frame_size_setting)) {
+    return Http2Status::Http2ConnectionError(
+        Http2ErrorCode::kFrameSizeError,
+        absl::StrCat(RFC9113::kFrameSizeLargerThanMaxFrameSizeSetting,
+                     ", Current Size = ", current_frame_header.length,
+                     ", Max Size = ", max_frame_size_setting));
+  }
+  if (GPR_UNLIKELY(
+          incoming_header_in_progress &&
+          (current_frame_header.type !=
+               static_cast<uint8_t>(FrameType::kContinuation) ||
+           current_frame_header.stream_id != incoming_header_stream_id))) {
+    return Http2Status::Http2ConnectionError(
+        Http2ErrorCode::kProtocolError,
+        std::string(RFC9113::kAssemblerContiguousSequenceError));
+  }
+  // TODO(tjagtap) : [PH2][P2]:Consider validating MAX_CONCURRENT_STREAMS here
+  return Http2Status::Ok();
+}
+
 }  // namespace grpc_core