grpc 1.75.0 → 1.78.1

data/src/core/credentials/transport/tls/grpc_tls_crl_provider.cc

@@ -33,6 +33,11 @@
 #include <openssl/pem.h>
 #include <openssl/x509.h>
 
+#include "src/core/lib/event_engine/default_event_engine.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
+#include "src/core/lib/slice/slice.h"
+#include "src/core/util/directory_reader.h"
+#include "src/core/util/load_file.h"
 #include "absl/container/flat_hash_map.h"
 #include "absl/log/log.h"
 #include "absl/status/status.h"
@@ -40,11 +45,6 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_join.h"
 #include "absl/types/span.h"
-#include "src/core/lib/event_engine/default_event_engine.h"
-#include "src/core/lib/iomgr/exec_ctx.h"
-#include "src/core/lib/slice/slice.h"
-#include "src/core/util/directory_reader.h"
-#include "src/core/util/load_file.h"
 
 namespace grpc_core {
 namespace experimental {

data/src/core/credentials/transport/tls/grpc_tls_crl_provider.h

@@ -31,14 +31,14 @@
 #include <string>
 #include <utility>
 
+#include "src/core/util/directory_reader.h"
+#include "src/core/util/sync.h"
+#include "src/core/util/time.h"
 #include "absl/base/thread_annotations.h"
 #include "absl/container/flat_hash_map.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
-#include "src/core/util/directory_reader.h"
-#include "src/core/util/sync.h"
-#include "src/core/util/time.h"
 
 namespace grpc_core {
 namespace experimental {

data/src/core/credentials/transport/tls/load_system_roots_supported.cc

@@ -33,13 +33,13 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
-#include "absl/log/log.h"
 #include "src/core/config/config_vars.h"
 #include "src/core/credentials/transport/tls/load_system_roots.h"
 #include "src/core/credentials/transport/tls/load_system_roots_supported.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/util/load_file.h"
 #include "src/core/util/useful.h"
+#include "absl/log/log.h"
 
 namespace grpc_core {
 namespace {

data/src/core/credentials/transport/tls/spiffe_utils.cc

@@ -22,20 +22,21 @@
 
 #include <string>
 
-#include "absl/strings/match.h"
-#include "absl/strings/str_cat.h"
-#include "absl/strings/str_format.h"
-#include "absl/strings/str_split.h"
 #include "src/core/tsi/ssl_transport_security_utils.h"
 #include "src/core/util/json/json_object_loader.h"
 #include "src/core/util/json/json_reader.h"
 #include "src/core/util/load_file.h"
 #include "src/core/util/status_helper.h"
+#include "absl/strings/match.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_format.h"
+#include "absl/strings/str_split.h"
 
 namespace grpc_core {
 namespace {
 constexpr absl::string_view kAllowedUse = "x509-svid";
-constexpr absl::string_view kAllowedKty = "RSA";
+constexpr absl::string_view kRsaKty = "RSA";
+constexpr absl::string_view kEcKty = "EC";
 constexpr absl::string_view kCertificatePrefix =
     "-----BEGIN CERTIFICATE-----\n";
 constexpr absl::string_view kCertificateSuffix = "\n-----END CERTIFICATE-----";
@@ -192,9 +193,10 @@ void SpiffeBundleKey::JsonPostLoad(const Json& json, const JsonArgs& args,
       LoadJsonObjectField<std::string>(json.object(), args, "kty", errors);
   {
     ValidationErrors::ScopedField field(errors, ".kty");
-    if (kty.has_value() && *kty != kAllowedKty) {
-      errors->AddError(absl::StrFormat("value must be \"%s\", got \"%s\"",
-                                       kAllowedKty, *kty));
+    if (kty.has_value() && *kty != kRsaKty && *kty != kEcKty) {
+      errors->AddError(
+          absl::StrFormat("value must be one of \"%s\", \"%s\", got \"%s\"",
+                          kEcKty, kRsaKty, *kty));
     }
   }
   auto x5c = LoadJsonObjectField<std::vector<std::string>>(json.object(), args,

data/src/core/credentials/transport/tls/spiffe_utils.h

@@ -24,10 +24,10 @@
 
 #include <string>
 
-#include "absl/status/statusor.h"
-#include "absl/strings/string_view.h"
 #include "src/core/util/json/json.h"
 #include "src/core/util/json/json_object_loader.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
 
 namespace grpc_core {
 

data/src/core/credentials/transport/tls/ssl_utils.cc

@@ -33,11 +33,6 @@
 #include <utility>
 #include <vector>
 
-#include "absl/log/check.h"
-#include "absl/log/log.h"
-#include "absl/strings/match.h"
-#include "absl/strings/str_cat.h"
-#include "absl/strings/str_split.h"
 #include "src/core/config/config_vars.h"
 #include "src/core/credentials/transport/tls/load_system_roots.h"
 #include "src/core/ext/transport/chttp2/alpn/alpn.h"
@@ -45,10 +40,15 @@
 #include "src/core/transport/auth_context.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security.h"
+#include "src/core/util/grpc_check.h"
 #include "src/core/util/host_port.h"
 #include "src/core/util/load_file.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/useful.h"
+#include "absl/log/log.h"
+#include "absl/strings/match.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_split.h"
 
 // -- Constants. --
 
@@ -190,7 +190,7 @@ absl::Status SslCheckCallHost(absl::string_view host,
 }  // namespace grpc_core
 
 const char** grpc_fill_alpn_protocol_strings(size_t* num_alpn_protocols) {
-  CHECK_NE(num_alpn_protocols, nullptr);
+  GRPC_CHECK_NE(num_alpn_protocols, nullptr);
   *num_alpn_protocols = grpc_chttp2_num_alpn_versions();
   const char** alpn_protocol_strings = static_cast<const char**>(
       gpr_malloc(sizeof(const char*) * (*num_alpn_protocols)));
@@ -202,7 +202,7 @@ const char** grpc_fill_alpn_protocol_strings(size_t* num_alpn_protocols) {
 
 const char** ParseAlpnStringIntoArray(absl::string_view preferred_protocols_raw,
                                       size_t* num_alpn_protocols) {
-  CHECK_NE(num_alpn_protocols, nullptr);
+  GRPC_CHECK_NE(num_alpn_protocols, nullptr);
   std::vector<std::string> preferred_protocols;
   preferred_protocols =
       absl::StrSplit(preferred_protocols_raw, ',', absl::SkipWhitespace());
@@ -271,7 +271,7 @@ grpc_core::RefCountedPtr<grpc_auth_context> grpc_ssl_peer_to_auth_context(
   const char* peer_identity_property_name = nullptr;
 
   // The caller has checked the certificate type property.
-  CHECK_GE(peer->property_count, 1u);
+  GRPC_CHECK_GE(peer->property_count, 1u);
   grpc_core::RefCountedPtr<grpc_auth_context> ctx =
       grpc_core::MakeRefCounted<grpc_auth_context>(nullptr);
   grpc_auth_context_add_cstring_property(
@@ -338,14 +338,14 @@ grpc_core::RefCountedPtr<grpc_auth_context> grpc_ssl_peer_to_auth_context(
     }
   }
   if (peer_identity_property_name != nullptr) {
-    CHECK(grpc_auth_context_set_peer_identity_property_name(
-              ctx.get(), peer_identity_property_name) == 1);
+    GRPC_CHECK(grpc_auth_context_set_peer_identity_property_name(
+                   ctx.get(), peer_identity_property_name) == 1);
   }
   // A valid SPIFFE certificate can only have exact one URI SAN field.
   if (has_spiffe_id) {
     if (uri_count == 1) {
-      CHECK_GT(spiffe_length, 0u);
-      CHECK_NE(spiffe_data, nullptr);
+      GRPC_CHECK_GT(spiffe_length, 0u);
+      GRPC_CHECK_NE(spiffe_data, nullptr);
       grpc_auth_context_add_property(ctx.get(),
                                      GRPC_PEER_SPIFFE_ID_PROPERTY_NAME,
                                      spiffe_data, spiffe_length);
@@ -600,13 +600,18 @@ grpc_slice DefaultSslRootStore::ComputePemRootCerts() {
       result = std::move(*slice);
     }
   }
+  // Try loading roots from OS trust store if preferred over callback.
+  if (result.empty() &&
+      ConfigVars::Get().UseSystemRootsOverLanguageCallback()) {
+    result = Slice(LoadSystemRootCerts());
+  }
   // Try overridden roots if needed.
   grpc_ssl_roots_override_result ovrd_res = GRPC_SSL_ROOTS_OVERRIDE_FAIL;
   if (result.empty() && ssl_roots_override_cb != nullptr) {
     char* pem_root_certs = nullptr;
     ovrd_res = ssl_roots_override_cb(&pem_root_certs);
     if (ovrd_res == GRPC_SSL_ROOTS_OVERRIDE_OK) {
-      CHECK_NE(pem_root_certs, nullptr);
+      GRPC_CHECK_NE(pem_root_certs, nullptr);
       result = Slice::FromCopiedBuffer(
           pem_root_certs,
           strlen(pem_root_certs) + 1);  // nullptr terminator.

data/src/core/credentials/transport/tls/ssl_utils.h

@@ -31,8 +31,6 @@
 #include <utility>
 #include <vector>
 
-#include "absl/status/status.h"
-#include "absl/strings/string_view.h"
 #include "src/core/credentials/transport/security_connector.h"
 #include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/lib/iomgr/error.h"
@@ -40,6 +38,8 @@
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
 #include "src/core/util/ref_counted_ptr.h"
+#include "absl/status/status.h"
+#include "absl/strings/string_view.h"
 
 // --- Util ---
 

data/src/core/credentials/transport/tls/tls_credentials.cc

@@ -28,13 +28,13 @@
 #include <string>
 #include <utility>
 
-#include "absl/log/log.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_verifier.h"
 #include "src/core/credentials/transport/tls/grpc_tls_credentials_options.h"
 #include "src/core/credentials/transport/tls/tls_security_connector.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/tsi/ssl/session_cache/ssl_session_cache.h"
 #include "src/core/util/useful.h"
+#include "absl/log/log.h"
 
 namespace {
 
@@ -154,7 +154,7 @@ grpc_core::UniqueTypeName TlsServerCredentials::Type() {
 grpc_channel_credentials* grpc_tls_credentials_create(
     grpc_tls_credentials_options* options) {
   if (!CredentialOptionSanityCheck(options, true /* is_client */)) {
-    LOG(ERROR) << "TLS credentials options sanity check failed.";
+    VLOG(1) << "TLS credentials options sanity check failed.";
     return nullptr;
   }
   return new TlsCredentials(
@@ -164,7 +164,7 @@ grpc_channel_credentials* grpc_tls_credentials_create(
 grpc_server_credentials* grpc_tls_server_credentials_create(
     grpc_tls_credentials_options* options) {
   if (!CredentialOptionSanityCheck(options, false /* is_client */)) {
-    LOG(ERROR) << "TLS server credentials options sanity check failed.";
+    VLOG(1) << "TLS server credentials options sanity check failed.";
     return nullptr;
   }
   return new TlsServerCredentials(

data/src/core/credentials/transport/tls/tls_security_connector.cc

@@ -29,11 +29,6 @@
 #include <utility>
 #include <vector>
 
-#include "absl/functional/bind_front.h"
-#include "absl/log/check.h"
-#include "absl/log/log.h"
-#include "absl/strings/str_cat.h"
-#include "absl/strings/string_view.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_verifier.h"
 #include "src/core/credentials/transport/tls/grpc_tls_credentials_options.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
@@ -45,8 +40,13 @@
 #include "src/core/transport/auth_context.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/util/debug_location.h"
+#include "src/core/util/grpc_check.h"
 #include "src/core/util/host_port.h"
 #include "src/core/util/status_helper.h"
+#include "absl/functional/bind_front.h"
+#include "absl/log/log.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 
 namespace grpc_core {
 
@@ -62,7 +62,7 @@ char* CopyCoreString(char* src, size_t length) {
 void PendingVerifierRequestInit(
     const char* target_name, tsi_peer peer,
     grpc_tls_custom_verification_check_request* request) {
-  CHECK_NE(request, nullptr);
+  GRPC_CHECK_NE(request, nullptr);
   // The verifier holds a ref to the security connector, so it's fine to
   // directly point this to the name cached in the security connector.
   request->target_name = target_name;
@@ -174,7 +174,7 @@ void PendingVerifierRequestInit(
 
 void PendingVerifierRequestDestroy(
     grpc_tls_custom_verification_check_request* request) {
-  CHECK_NE(request, nullptr);
+  GRPC_CHECK_NE(request, nullptr);
   if (request->peer_info.common_name != nullptr) {
     gpr_free(const_cast<char*>(request->peer_info.common_name));
   }
@@ -218,13 +218,13 @@ tsi_ssl_pem_key_cert_pair* ConvertToTsiPemKeyCertPair(
   tsi_ssl_pem_key_cert_pair* tsi_pairs = nullptr;
   size_t num_key_cert_pairs = cert_pair_list.size();
   if (num_key_cert_pairs > 0) {
-    CHECK_NE(cert_pair_list.data(), nullptr);
+    GRPC_CHECK_NE(cert_pair_list.data(), nullptr);
     tsi_pairs = static_cast<tsi_ssl_pem_key_cert_pair*>(
         gpr_zalloc(num_key_cert_pairs * sizeof(tsi_ssl_pem_key_cert_pair)));
   }
   for (size_t i = 0; i < num_key_cert_pairs; i++) {
-    CHECK(!cert_pair_list[i].private_key().empty());
-    CHECK(!cert_pair_list[i].cert_chain().empty());
+    GRPC_CHECK(!cert_pair_list[i].private_key().empty());
+    GRPC_CHECK(!cert_pair_list[i].cert_chain().empty());
     tsi_pairs[i].cert_chain =
         gpr_strdup(cert_pair_list[i].cert_chain().c_str());
     tsi_pairs[i].private_key =
@@ -373,7 +373,7 @@ void TlsChannelSecurityConnector::check_peer(
   }
   *auth_context =
       grpc_ssl_peer_to_auth_context(&peer, GRPC_TLS_TRANSPORT_SECURITY_TYPE);
-  CHECK_NE(options_->certificate_verifier(), nullptr);
+  GRPC_CHECK_NE(options_->certificate_verifier(), nullptr);
   auto* pending_request = new ChannelPendingVerifierRequest(
       RefAsSubclass<TlsChannelSecurityConnector>(), on_peer_checked, peer,
       target_name);
@@ -431,7 +431,7 @@ ArenaPromise<absl::Status> TlsChannelSecurityConnector::CheckCallHost(
 void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
     OnCertificatesChanged(std::shared_ptr<RootCertInfo> root_certs,
                           std::optional<PemKeyCertPairList> key_cert_pairs) {
-  CHECK_NE(security_connector_, nullptr);
+  GRPC_CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
   if (root_certs != nullptr) {
     security_connector_->root_cert_info_ = std::move(root_certs);
@@ -683,7 +683,7 @@ int TlsServerSecurityConnector::cmp(
 void TlsServerSecurityConnector::TlsServerCertificateWatcher::
     OnCertificatesChanged(std::shared_ptr<RootCertInfo> roots,
                           std::optional<PemKeyCertPairList> key_cert_pairs) {
-  CHECK_NE(security_connector_, nullptr);
+  GRPC_CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
   if (roots != nullptr) {
     security_connector_->root_cert_info_ = std::move(roots);
@@ -780,8 +780,8 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
     tsi_ssl_server_handshaker_factory_unref(server_handshaker_factory_);
   }
   // The identity certs on the server side shouldn't be empty.
-  CHECK(pem_key_cert_pair_list_.has_value());
-  CHECK(!(*pem_key_cert_pair_list_).empty());
+  GRPC_CHECK(pem_key_cert_pair_list_.has_value());
+  GRPC_CHECK(!(*pem_key_cert_pair_list_).empty());
   tsi_ssl_pem_key_cert_pair* pem_key_cert_pairs = nullptr;
   pem_key_cert_pairs = ConvertToTsiPemKeyCertPair(*pem_key_cert_pair_list_);
   size_t num_key_cert_pairs = (*pem_key_cert_pair_list_).size();

data/src/core/credentials/transport/tls/tls_security_connector.h

@@ -28,9 +28,6 @@
 #include <optional>
 #include <string>
 
-#include "absl/base/thread_annotations.h"
-#include "absl/status/status.h"
-#include "absl/strings/string_view.h"
 #include "src/core/credentials/transport/security_connector.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
@@ -46,6 +43,9 @@
 #include "src/core/tsi/transport_security_interface.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/sync.h"
+#include "absl/base/thread_annotations.h"
+#include "absl/status/status.h"
+#include "absl/strings/string_view.h"
 
 using TlsSessionKeyLogger = tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger;
 

data/src/core/credentials/transport/transport_credentials.cc

@@ -20,12 +20,12 @@
 #include <stdint.h>
 #include <string.h>
 
-#include "absl/log/check.h"
-#include "absl/log/log.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
+#include "src/core/util/grpc_check.h"
 #include "src/core/util/useful.h"
+#include "absl/log/log.h"
 
 // -- Common. --
 
@@ -110,7 +110,7 @@ void grpc_server_credentials::set_auth_metadata_processor(
 
 void grpc_server_credentials_set_auth_metadata_processor(
     grpc_server_credentials* creds, grpc_auth_metadata_processor processor) {
-  DCHECK_NE(creds, nullptr);
+  GRPC_DCHECK_NE(creds, nullptr);
   creds->set_auth_metadata_processor(processor);
 }
 

data/src/core/credentials/transport/transport_credentials.h

@@ -28,9 +28,6 @@
 #include <utility>
 #include <vector>
 
-#include "absl/log/check.h"
-#include "absl/status/statusor.h"
-#include "absl/strings/string_view.h"
 #include "src/core/credentials/call/call_credentials.h"
 #include "src/core/credentials/transport/security_connector.h"
 #include "src/core/lib/channel/channel_args.h"
@@ -38,9 +35,12 @@
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/util/crash.h"
+#include "src/core/util/grpc_check.h"
 #include "src/core/util/ref_counted.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/unique_type_name.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
 
 // --- Constants. ---
 
@@ -96,7 +96,7 @@ struct grpc_channel_credentials
   // two different `grpc_channel_credentials` objects are used but they compare
   // as equal (assuming other channel args match).
   int cmp(const grpc_channel_credentials* other) const {
-    CHECK_NE(other, nullptr);
+    GRPC_CHECK_NE(other, nullptr);
     int r = type().Compare(other->type());
     if (r != 0) return r;
     return cmp_impl(other);

data/src/core/credentials/transport/xds/xds_credentials.cc

@@ -24,13 +24,13 @@
 
 #include <optional>
 
-#include "absl/log/check.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_provider.h"
 #include "src/core/credentials/transport/tls/grpc_tls_credentials_options.h"
 #include "src/core/credentials/transport/tls/tls_credentials.h"
 #include "src/core/credentials/transport/tls/tls_utils.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/load_balancing/xds/xds_channel_args.h"
+#include "src/core/util/grpc_check.h"
 #include "src/core/util/useful.h"
 #include "src/core/xds/grpc/xds_certificate_provider.h"
 
@@ -79,7 +79,7 @@ XdsCertificateVerifier::XdsCertificateVerifier(
 bool XdsCertificateVerifier::Verify(
     grpc_tls_custom_verification_check_request* request,
     std::function<void(absl::Status)>, absl::Status* sync_status) {
-  CHECK_NE(request, nullptr);
+  GRPC_CHECK_NE(request, nullptr);
   if (!XdsVerifySubjectAlternativeNames(
           request->peer_info.san_names.uri_names,
           request->peer_info.san_names.uri_names_size,
@@ -166,7 +166,7 @@ XdsCredentials::create_security_connector(
                                                         target_name, args);
     }
   }
-  CHECK(fallback_credentials_ != nullptr);
+  GRPC_CHECK(fallback_credentials_ != nullptr);
   return fallback_credentials_->create_security_connector(std::move(call_creds),
                                                           target_name, args);
 }
@@ -217,12 +217,12 @@ UniqueTypeName XdsServerCredentials::Type() {
 
 grpc_channel_credentials* grpc_xds_credentials_create(
     grpc_channel_credentials* fallback_credentials) {
-  CHECK_NE(fallback_credentials, nullptr);
+  GRPC_CHECK_NE(fallback_credentials, nullptr);
   return new grpc_core::XdsCredentials(fallback_credentials->Ref());
 }
 
 grpc_server_credentials* grpc_xds_server_credentials_create(
     grpc_server_credentials* fallback_credentials) {
-  CHECK_NE(fallback_credentials, nullptr);
+  GRPC_CHECK_NE(fallback_credentials, nullptr);
   return new grpc_core::XdsServerCredentials(fallback_credentials->Ref());
 }

data/src/core/credentials/transport/xds/xds_credentials.h

@@ -30,7 +30,6 @@
 #include <utility>
 #include <vector>
 
-#include "absl/status/status.h"
 #include "src/core/credentials/transport/security_connector.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_verifier.h"
 #include "src/core/credentials/transport/transport_credentials.h"
@@ -39,6 +38,7 @@
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/unique_type_name.h"
 #include "src/core/xds/grpc/xds_certificate_provider.h"
+#include "absl/status/status.h"
 
 namespace grpc_core {
 

data/src/core/ext/filters/backend_metrics/backend_metric_filter.cc

@@ -24,8 +24,6 @@
 #include <memory>
 #include <utility>
 
-#include "absl/log/log.h"
-#include "absl/strings/string_view.h"
 #include "src/core/call/metadata_batch.h"
 #include "src/core/config/core_configuration.h"
 #include "src/core/lib/channel/channel_stack.h"
@@ -41,6 +39,8 @@
 #include "upb/base/string_view.h"
 #include "upb/mem/arena.hpp"
 #include "xds/data/orca/v3/orca_load_report.upb.h"
+#include "absl/log/log.h"
+#include "absl/strings/string_view.h"
 
 namespace grpc_core {
 

data/src/core/ext/filters/backend_metrics/backend_metric_filter.h

@@ -20,13 +20,13 @@
 #include <optional>
 #include <string>
 
-#include "absl/status/statusor.h"
 #include "src/core/ext/filters/backend_metrics/backend_metric_provider.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/transport/transport.h"
+#include "absl/status/statusor.h"
 
 namespace grpc_core {
 
@@ -48,6 +48,9 @@ class BackendMetricFilter : public ImplementChannelFilter<BackendMetricFilter> {
     static inline const NoInterceptor OnClientToServerHalfClose;
     static inline const NoInterceptor OnServerToClientMessage;
     static inline const NoInterceptor OnFinalize;
+    channelz::PropertyList ChannelzProperties() {
+      return channelz::PropertyList();
+    }
   };
 };
 

data/src/core/ext/filters/channel_idle/legacy_channel_idle_filter.cc

@@ -24,10 +24,6 @@
 #include <optional>
 #include <utility>
 
-#include "absl/base/thread_annotations.h"
-#include "absl/meta/type_traits.h"
-#include "absl/random/random.h"
-#include "absl/status/statusor.h"
 #include "src/core/call/metadata_batch.h"
 #include "src/core/config/core_configuration.h"
 #include "src/core/ext/transport/chttp2/transport/http2_status.h"
@@ -53,6 +49,10 @@
 #include "src/core/util/shared_bit_gen.h"
 #include "src/core/util/status_helper.h"
 #include "src/core/util/sync.h"
+#include "absl/base/thread_annotations.h"
+#include "absl/meta/type_traits.h"
+#include "absl/random/random.h"
+#include "absl/status/statusor.h"
 
 namespace grpc_core {
 
@@ -304,8 +304,10 @@ void RegisterLegacyChannelIdleFilters(CoreConfiguration::Builder* builder) {
       .If([](const ChannelArgs& channel_args) {
         return GetClientIdleTimeout(channel_args) != Duration::Infinity();
       });
+
   builder->channel_init()
       ->RegisterV2Filter<LegacyMaxAgeFilter>(GRPC_SERVER_CHANNEL)
+      .FloatToTop()
       .ExcludeFromMinimalStack()
       .If([](const ChannelArgs& channel_args) {
         return LegacyMaxAgeFilter::Config::FromChannelArgs(channel_args)

data/src/core/ext/filters/channel_idle/legacy_channel_idle_filter.h

@@ -20,8 +20,6 @@
 
 #include <memory>
 
-#include "absl/status/status.h"
-#include "absl/status/statusor.h"
 #include "src/core/ext/filters/channel_idle/idle_filter_state.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
@@ -35,6 +33,8 @@
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/single_set_ptr.h"
 #include "src/core/util/time.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
 
 namespace grpc_core {
 

data/src/core/ext/filters/fault_injection/fault_injection_filter.cc

@@ -28,13 +28,6 @@
 #include <type_traits>
 #include <utility>
 
-#include "absl/log/log.h"
-#include "absl/meta/type_traits.h"
-#include "absl/status/status.h"
-#include "absl/status/statusor.h"
-#include "absl/strings/numbers.h"
-#include "absl/strings/str_cat.h"
-#include "absl/strings/string_view.h"
 #include "src/core/call/metadata_batch.h"
 #include "src/core/call/status_util.h"
 #include "src/core/config/core_configuration.h"
@@ -47,6 +40,13 @@
 #include "src/core/lib/transport/transport.h"
 #include "src/core/service_config/service_config_call_data.h"
 #include "src/core/util/time.h"
+#include "absl/log/log.h"
+#include "absl/meta/type_traits.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/numbers.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 
 namespace grpc_core {
 

data/src/core/ext/filters/fault_injection/fault_injection_filter.h

@@ -22,15 +22,15 @@
 
 #include <memory>
 
-#include "absl/base/thread_annotations.h"
-#include "absl/random/random.h"
-#include "absl/status/statusor.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/util/sync.h"
+#include "absl/base/thread_annotations.h"
+#include "absl/random/random.h"
+#include "absl/status/statusor.h"
 
 namespace grpc_core {
 
@@ -61,6 +61,9 @@ class FaultInjectionFilter
     static inline const NoInterceptor OnClientToServerHalfClose;
     static inline const NoInterceptor OnServerToClientMessage;
     static inline const NoInterceptor OnFinalize;
+    channelz::PropertyList ChannelzProperties() {
+      return channelz::PropertyList();
+    }
   };
 
  private: