grpc 1.78.1 → 1.80.0

data/src/core/xds/grpc/xds_http_gcp_authn_filter.cc

@@ -79,12 +79,11 @@ Json::Object ValidateFilterConfig(
 
 }  // namespace
 
-std::optional<XdsHttpFilterImpl::FilterConfig>
-XdsHttpGcpAuthnFilter::GenerateFilterConfig(
+std::optional<Json> XdsHttpGcpAuthnFilter::GenerateFilterConfig(
     absl::string_view instance_name,
-    const XdsResourceType::DecodeContext& context, XdsExtension extension,
-    ValidationErrors* errors) const {
-  absl::string_view* serialized_filter_config =
+    const XdsResourceType::DecodeContext& context,
+    const XdsExtension& extension, ValidationErrors* errors) const {
+  const absl::string_view* serialized_filter_config =
       std::get_if<absl::string_view>(&extension.value);
   if (serialized_filter_config == nullptr) {
     errors->AddError("could not parse GCP auth filter config");
@@ -98,25 +97,26 @@ XdsHttpGcpAuthnFilter::GenerateFilterConfig(
     errors->AddError("could not parse GCP auth filter config");
     return std::nullopt;
   }
-  return FilterConfig{ConfigProtoName(), Json::FromObject(ValidateFilterConfig(
-                                             instance_name, gcp_auth, errors))};
+  return Json::FromObject(
+      ValidateFilterConfig(instance_name, gcp_auth, errors));
 }
 
-std::optional<XdsHttpFilterImpl::FilterConfig>
-XdsHttpGcpAuthnFilter::GenerateFilterConfigOverride(
+std::optional<Json> XdsHttpGcpAuthnFilter::GenerateFilterConfigOverride(
     absl::string_view /*instance_name*/,
     const XdsResourceType::DecodeContext& /*context*/,
-    XdsExtension /*extension*/, ValidationErrors* errors) const {
+    const XdsExtension& /*extension*/, ValidationErrors* errors) const {
   errors->AddError("GCP auth filter does not support config override");
   return std::nullopt;
 }
 
-void XdsHttpGcpAuthnFilter::AddFilter(InterceptionChainBuilder& builder) const {
-  builder.Add<GcpAuthenticationFilter>(nullptr);
+const grpc_channel_filter* XdsHttpGcpAuthnFilter::channel_filter() const {
+  return &GcpAuthenticationFilter::kFilterVtable;
 }
 
-const grpc_channel_filter* XdsHttpGcpAuthnFilter::channel_filter() const {
-  return &GcpAuthenticationFilter::kFilter;
+void XdsHttpGcpAuthnFilter::AddFilter(
+    FilterChainBuilder& builder,
+    RefCountedPtr<const FilterConfig> config) const {
+  builder.AddFilter<GcpAuthenticationFilter>(std::move(config));
 }
 
 ChannelArgs XdsHttpGcpAuthnFilter::ModifyChannelArgs(
@@ -126,24 +126,24 @@ ChannelArgs XdsHttpGcpAuthnFilter::ModifyChannelArgs(
 
 absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
 XdsHttpGcpAuthnFilter::GenerateMethodConfig(
-    const FilterConfig& /*hcm_filter_config*/,
-    const FilterConfig* /*filter_config_override*/) const {
+    const Json& /*hcm_filter_config*/,
+    const Json* /*filter_config_override*/) const {
   return ServiceConfigJsonEntry{"", ""};
 }
 
 absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
 XdsHttpGcpAuthnFilter::GenerateServiceConfig(
-    const FilterConfig& hcm_filter_config) const {
+    const Json& hcm_filter_config) const {
   return ServiceConfigJsonEntry{"gcp_authentication",
-                                JsonDump(hcm_filter_config.config)};
+                                JsonDump(hcm_filter_config)};
 }
 
-void XdsHttpGcpAuthnFilter::UpdateBlackboard(
-    const FilterConfig& hcm_filter_config, const Blackboard* old_blackboard,
-    Blackboard* new_blackboard) const {
+void XdsHttpGcpAuthnFilter::UpdateBlackboard(const Json& hcm_filter_config,
+                                             const Blackboard* old_blackboard,
+                                             Blackboard* new_blackboard) const {
   ValidationErrors errors;
   auto config = LoadFromJson<GcpAuthenticationParsedConfig::Config>(
-      hcm_filter_config.config, JsonArgs(), &errors);
+      hcm_filter_config, JsonArgs(), &errors);
   CHECK(errors.ok()) << errors.message("filter config validation failed");
   RefCountedPtr<GcpAuthenticationFilter::CallCredentialsCache> cache;
   if (old_blackboard != nullptr) {
@@ -160,4 +160,70 @@ void XdsHttpGcpAuthnFilter::UpdateBlackboard(
   new_blackboard->Set(config.filter_instance_name, std::move(cache));
 }
 
+void XdsHttpGcpAuthnFilter::UpdateBlackboard(const FilterConfig& config,
+                                             const Blackboard* old_blackboard,
+                                             Blackboard* new_blackboard) const {
+  const auto& filter_config =
+      DownCast<const GcpAuthenticationFilter::Config&>(config);
+  ValidationErrors errors;
+  RefCountedPtr<GcpAuthenticationFilter::CallCredentialsCache> cache;
+  if (old_blackboard != nullptr) {
+    cache = old_blackboard->Get<GcpAuthenticationFilter::CallCredentialsCache>(
+        filter_config.instance_name);
+  }
+  if (cache != nullptr) {
+    cache->SetMaxSize(filter_config.cache_size);
+  } else {
+    cache = MakeRefCounted<GcpAuthenticationFilter::CallCredentialsCache>(
+        filter_config.cache_size);
+  }
+  CHECK_NE(new_blackboard, nullptr);
+  new_blackboard->Set(filter_config.instance_name, std::move(cache));
+}
+
+RefCountedPtr<const FilterConfig> XdsHttpGcpAuthnFilter::ParseTopLevelConfig(
+    absl::string_view instance_name,
+    const XdsResourceType::DecodeContext& context,
+    const XdsExtension& extension, ValidationErrors* errors) const {
+  const absl::string_view* serialized_filter_config =
+      std::get_if<absl::string_view>(&extension.value);
+  if (serialized_filter_config == nullptr) {
+    errors->AddError("could not parse GCP auth filter config");
+    return nullptr;
+  }
+  auto* gcp_auth =
+      envoy_extensions_filters_http_gcp_authn_v3_GcpAuthnFilterConfig_parse(
+          serialized_filter_config->data(), serialized_filter_config->size(),
+          context.arena);
+  if (gcp_auth == nullptr) {
+    errors->AddError("could not parse GCP auth filter config");
+    return nullptr;
+  }
+  auto config = MakeRefCounted<GcpAuthenticationFilter::Config>();
+  config->instance_name = std::string(instance_name);
+  const auto* cache_config =
+      envoy_extensions_filters_http_gcp_authn_v3_GcpAuthnFilterConfig_cache_config(
+          gcp_auth);
+  if (cache_config == nullptr) return config;
+  uint64_t cache_size =
+      ParseUInt64Value(
+          envoy_extensions_filters_http_gcp_authn_v3_TokenCacheConfig_cache_size(
+              cache_config))
+          .value_or(10);
+  if (cache_size == 0) {
+    ValidationErrors::ScopedField field(errors, ".cache_config.cache_size");
+    errors->AddError("must be greater than 0");
+  }
+  config->cache_size = cache_size;
+  return config;
+}
+
+RefCountedPtr<const FilterConfig> XdsHttpGcpAuthnFilter::ParseOverrideConfig(
+    absl::string_view /*instance_name*/,
+    const XdsResourceType::DecodeContext& /*context*/,
+    const XdsExtension& /*extension*/, ValidationErrors* errors) const {
+  errors->AddError("GCP auth filter does not support config override");
+  return nullptr;
+}
+
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_http_gcp_authn_filter.h

@@ -36,23 +36,34 @@ class XdsHttpGcpAuthnFilter final : public XdsHttpFilterImpl {
   absl::string_view ConfigProtoName() const override;
   absl::string_view OverrideConfigProtoName() const override;
   void PopulateSymtab(upb_DefPool* symtab) const override;
-  std::optional<FilterConfig> GenerateFilterConfig(
+  std::optional<Json> GenerateFilterConfig(
       absl::string_view instance_name,
-      const XdsResourceType::DecodeContext& context, XdsExtension extension,
-      ValidationErrors* errors) const override;
-  std::optional<FilterConfig> GenerateFilterConfigOverride(
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
+  std::optional<Json> GenerateFilterConfigOverride(
       absl::string_view instance_name,
-      const XdsResourceType::DecodeContext& context, XdsExtension extension,
-      ValidationErrors* errors) const override;
-  void AddFilter(InterceptionChainBuilder& builder) const override;
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
   const grpc_channel_filter* channel_filter() const override;
   ChannelArgs ModifyChannelArgs(const ChannelArgs& args) const override;
   absl::StatusOr<ServiceConfigJsonEntry> GenerateMethodConfig(
-      const FilterConfig& hcm_filter_config,
-      const FilterConfig* filter_config_override) const override;
+      const Json& hcm_filter_config,
+      const Json* filter_config_override) const override;
   absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
-      const FilterConfig& hcm_filter_config) const override;
-  void UpdateBlackboard(const FilterConfig& hcm_filter_config,
+      const Json& hcm_filter_config) const override;
+  void AddFilter(FilterChainBuilder& builder,
+                 RefCountedPtr<const FilterConfig> config) const override;
+  RefCountedPtr<const FilterConfig> ParseTopLevelConfig(
+      absl::string_view instance_name,
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
+  RefCountedPtr<const FilterConfig> ParseOverrideConfig(
+      absl::string_view instance_name,
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
+  void UpdateBlackboard(const Json& config, const Blackboard* old_blackboard,
+                        Blackboard* new_blackboard) const override;
+  void UpdateBlackboard(const FilterConfig& config,
                         const Blackboard* old_blackboard,
                         Blackboard* new_blackboard) const override;
   bool IsSupportedOnClients() const override { return true; }

data/src/core/xds/grpc/xds_http_rbac_filter.cc

@@ -516,12 +516,11 @@ void XdsHttpRbacFilter::PopulateSymtab(upb_DefPool* symtab) const {
   envoy_extensions_filters_http_rbac_v3_RBAC_getmsgdef(symtab);
 }
 
-std::optional<XdsHttpFilterImpl::FilterConfig>
-XdsHttpRbacFilter::GenerateFilterConfig(
+std::optional<Json> XdsHttpRbacFilter::GenerateFilterConfig(
     absl::string_view /*instance_name*/,
-    const XdsResourceType::DecodeContext& context, XdsExtension extension,
-    ValidationErrors* errors) const {
-  absl::string_view* serialized_filter_config =
+    const XdsResourceType::DecodeContext& context,
+    const XdsExtension& extension, ValidationErrors* errors) const {
+  const absl::string_view* serialized_filter_config =
       std::get_if<absl::string_view>(&extension.value);
   if (serialized_filter_config == nullptr) {
     errors->AddError("could not parse HTTP RBAC filter config");
@@ -534,16 +533,14 @@ XdsHttpRbacFilter::GenerateFilterConfig(
     errors->AddError("could not parse HTTP RBAC filter config");
     return std::nullopt;
   }
-  return FilterConfig{ConfigProtoName(),
-                      ParseHttpRbacToJson(context, rbac, errors)};
+  return ParseHttpRbacToJson(context, rbac, errors);
 }
 
-std::optional<XdsHttpFilterImpl::FilterConfig>
-XdsHttpRbacFilter::GenerateFilterConfigOverride(
+std::optional<Json> XdsHttpRbacFilter::GenerateFilterConfigOverride(
     absl::string_view /*instance_name*/,
-    const XdsResourceType::DecodeContext& context, XdsExtension extension,
-    ValidationErrors* errors) const {
-  absl::string_view* serialized_filter_config =
+    const XdsResourceType::DecodeContext& context,
+    const XdsExtension& extension, ValidationErrors* errors) const {
+  const absl::string_view* serialized_filter_config =
       std::get_if<absl::string_view>(&extension.value);
   if (serialized_filter_config == nullptr) {
     errors->AddError("could not parse RBACPerRoute");
@@ -566,11 +563,13 @@ XdsHttpRbacFilter::GenerateFilterConfigOverride(
     ValidationErrors::ScopedField field(errors, ".rbac");
     rbac_json = ParseHttpRbacToJson(context, rbac, errors);
   }
-  return FilterConfig{OverrideConfigProtoName(), std::move(rbac_json)};
+  return rbac_json;
 }
 
-void XdsHttpRbacFilter::AddFilter(InterceptionChainBuilder& builder) const {
-  builder.Add<RbacFilter>(nullptr);
+void XdsHttpRbacFilter::AddFilter(
+    FilterChainBuilder& builder,
+    RefCountedPtr<const FilterConfig> config) const {
+  builder.AddFilter<RbacFilter>(std::move(config));
 }
 
 const grpc_channel_filter* XdsHttpRbacFilter::channel_filter() const {
@@ -584,19 +583,36 @@ ChannelArgs XdsHttpRbacFilter::ModifyChannelArgs(
 
 absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
 XdsHttpRbacFilter::GenerateMethodConfig(
-    const FilterConfig& hcm_filter_config,
-    const FilterConfig* filter_config_override) const {
+    const Json& hcm_filter_config, const Json* filter_config_override) const {
   const Json& policy_json = filter_config_override != nullptr
-                                ? filter_config_override->config
-                                : hcm_filter_config.config;
+                                ? *filter_config_override
+                                : hcm_filter_config;
   // The policy JSON may be empty and that's allowed.
   return ServiceConfigJsonEntry{"rbacPolicy", JsonDump(policy_json)};
 }
 
 absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
 XdsHttpRbacFilter::GenerateServiceConfig(
-    const FilterConfig& /*hcm_filter_config*/) const {
+    const Json& /*hcm_filter_config*/) const {
   return ServiceConfigJsonEntry{"", ""};
 }
 
+RefCountedPtr<const FilterConfig> XdsHttpRbacFilter::ParseTopLevelConfig(
+    absl::string_view /*instance_name*/,
+    const XdsResourceType::DecodeContext& /*context*/,
+    const XdsExtension& /*extension*/, ValidationErrors* /*errors*/) const {
+  // TODO(roth): Implement this as part of migrating the server side to
+  // the new approach for passing xDS HTTP filter configs.
+  return nullptr;
+}
+
+RefCountedPtr<const FilterConfig> XdsHttpRbacFilter::ParseOverrideConfig(
+    absl::string_view /*instance_name*/,
+    const XdsResourceType::DecodeContext& /*context*/,
+    const XdsExtension& /*extension*/, ValidationErrors* /*errors*/) const {
+  // TODO(roth): Implement this as part of migrating the server side to
+  // the new approach for passing xDS HTTP filter configs.
+  return nullptr;
+}
+
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_http_rbac_filter.h

@@ -38,22 +38,31 @@ class XdsHttpRbacFilter final : public XdsHttpFilterImpl {
   absl::string_view ConfigProtoName() const override;
   absl::string_view OverrideConfigProtoName() const override;
   void PopulateSymtab(upb_DefPool* symtab) const override;
-  std::optional<FilterConfig> GenerateFilterConfig(
+  std::optional<Json> GenerateFilterConfig(
       absl::string_view /*instance_name*/,
-      const XdsResourceType::DecodeContext& context, XdsExtension extension,
-      ValidationErrors* errors) const override;
-  std::optional<FilterConfig> GenerateFilterConfigOverride(
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
+  std::optional<Json> GenerateFilterConfigOverride(
       absl::string_view /*instance_name*/,
-      const XdsResourceType::DecodeContext& context, XdsExtension extension,
-      ValidationErrors* errors) const override;
-  void AddFilter(InterceptionChainBuilder& builder) const override;
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
   const grpc_channel_filter* channel_filter() const override;
   ChannelArgs ModifyChannelArgs(const ChannelArgs& args) const override;
   absl::StatusOr<ServiceConfigJsonEntry> GenerateMethodConfig(
-      const FilterConfig& hcm_filter_config,
-      const FilterConfig* filter_config_override) const override;
+      const Json& hcm_filter_config,
+      const Json* filter_config_override) const override;
   absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
-      const FilterConfig& hcm_filter_config) const override;
+      const Json& hcm_filter_config) const override;
+  void AddFilter(FilterChainBuilder& builder,
+                 RefCountedPtr<const FilterConfig> config) const override;
+  RefCountedPtr<const FilterConfig> ParseTopLevelConfig(
+      absl::string_view instance_name,
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
+  RefCountedPtr<const FilterConfig> ParseOverrideConfig(
+      absl::string_view instance_name,
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
   bool IsSupportedOnClients() const override { return false; }
   bool IsSupportedOnServers() const override { return true; }
 };

data/src/core/xds/grpc/xds_http_stateful_session_filter.cc

@@ -138,12 +138,11 @@ Json::Object ValidateStatefulSession(
 
 }  // namespace
 
-std::optional<XdsHttpFilterImpl::FilterConfig>
-XdsHttpStatefulSessionFilter::GenerateFilterConfig(
+std::optional<Json> XdsHttpStatefulSessionFilter::GenerateFilterConfig(
     absl::string_view /*instance_name*/,
-    const XdsResourceType::DecodeContext& context, XdsExtension extension,
-    ValidationErrors* errors) const {
-  absl::string_view* serialized_filter_config =
+    const XdsResourceType::DecodeContext& context,
+    const XdsExtension& extension, ValidationErrors* errors) const {
+  const absl::string_view* serialized_filter_config =
       std::get_if<absl::string_view>(&extension.value);
   if (serialized_filter_config == nullptr) {
     errors->AddError("could not parse stateful session filter config");
@@ -157,17 +156,15 @@ XdsHttpStatefulSessionFilter::GenerateFilterConfig(
     errors->AddError("could not parse stateful session filter config");
     return std::nullopt;
   }
-  return FilterConfig{ConfigProtoName(),
-                      Json::FromObject(ValidateStatefulSession(
-                          context, stateful_session, errors))};
+  return Json::FromObject(
+      ValidateStatefulSession(context, stateful_session, errors));
 }
 
-std::optional<XdsHttpFilterImpl::FilterConfig>
-XdsHttpStatefulSessionFilter::GenerateFilterConfigOverride(
+std::optional<Json> XdsHttpStatefulSessionFilter::GenerateFilterConfigOverride(
     absl::string_view /*instance_name*/,
-    const XdsResourceType::DecodeContext& context, XdsExtension extension,
-    ValidationErrors* errors) const {
-  absl::string_view* serialized_filter_config =
+    const XdsResourceType::DecodeContext& context,
+    const XdsExtension& extension, ValidationErrors* errors) const {
+  const absl::string_view* serialized_filter_config =
       std::get_if<absl::string_view>(&extension.value);
   if (serialized_filter_config == nullptr) {
     errors->AddError("could not parse stateful session filter override config");
@@ -192,18 +189,18 @@ XdsHttpStatefulSessionFilter::GenerateFilterConfigOverride(
       config = ValidateStatefulSession(context, stateful_session, errors);
     }
   }
-  return FilterConfig{OverrideConfigProtoName(),
-                      Json::FromObject(std::move(config))};
-}
-
-void XdsHttpStatefulSessionFilter::AddFilter(
-    InterceptionChainBuilder& builder) const {
-  builder.Add<StatefulSessionFilter>(nullptr);
+  return Json::FromObject(std::move(config));
 }
 
 const grpc_channel_filter* XdsHttpStatefulSessionFilter::channel_filter()
     const {
-  return &StatefulSessionFilter::kFilter;
+  return &StatefulSessionFilter::kFilterVtable;
+}
+
+void XdsHttpStatefulSessionFilter::AddFilter(
+    FilterChainBuilder& builder,
+    RefCountedPtr<const FilterConfig> config) const {
+  builder.AddFilter<StatefulSessionFilter>(std::move(config));
 }
 
 ChannelArgs XdsHttpStatefulSessionFilter::ModifyChannelArgs(
@@ -213,18 +210,138 @@ ChannelArgs XdsHttpStatefulSessionFilter::ModifyChannelArgs(
 
 absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
 XdsHttpStatefulSessionFilter::GenerateMethodConfig(
-    const FilterConfig& hcm_filter_config,
-    const FilterConfig* filter_config_override) const {
+    const Json& hcm_filter_config, const Json* filter_config_override) const {
   const Json& config = filter_config_override != nullptr
-                           ? filter_config_override->config
-                           : hcm_filter_config.config;
+                           ? *filter_config_override
+                           : hcm_filter_config;
   return ServiceConfigJsonEntry{"stateful_session", JsonDump(config)};
 }
 
 absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
 XdsHttpStatefulSessionFilter::GenerateServiceConfig(
-    const FilterConfig& /*hcm_filter_config*/) const {
+    const Json& /*hcm_filter_config*/) const {
   return ServiceConfigJsonEntry{"", ""};
 }
 
+namespace {
+
+RefCountedPtr<StatefulSessionFilter::Config> ParseStatefulSession(
+    const XdsResourceType::DecodeContext& context,
+    const envoy_extensions_filters_http_stateful_session_v3_StatefulSession*
+        stateful_session,
+    ValidationErrors* errors) {
+  auto config = MakeRefCounted<StatefulSessionFilter::Config>();
+  ValidationErrors::ScopedField field(errors, ".session_state");
+  const auto* session_state =
+      envoy_extensions_filters_http_stateful_session_v3_StatefulSession_session_state(
+          stateful_session);
+  if (session_state == nullptr) return config;
+  ValidationErrors::ScopedField field2(errors, ".typed_config");
+  const auto* typed_config =
+      envoy_config_core_v3_TypedExtensionConfig_typed_config(session_state);
+  auto extension = ExtractXdsExtension(context, typed_config, errors);
+  if (!extension.has_value()) return config;
+  if (extension->type !=
+      "envoy.extensions.http.stateful_session.cookie.v3"
+      ".CookieBasedSessionState") {
+    errors->AddError("unsupported session state type");
+    return config;
+  }
+  const absl::string_view* serialized_session_state =
+      std::get_if<absl::string_view>(&extension->value);
+  if (serialized_session_state == nullptr) {
+    errors->AddError("could not parse session state config");
+    return config;
+  }
+  auto* cookie_state =
+      envoy_extensions_http_stateful_session_cookie_v3_CookieBasedSessionState_parse(
+          serialized_session_state->data(), serialized_session_state->size(),
+          context.arena);
+  if (cookie_state == nullptr) {
+    errors->AddError("could not parse session state config");
+    return config;
+  }
+  ValidationErrors::ScopedField field3(errors, ".cookie");
+  const auto* cookie =
+      envoy_extensions_http_stateful_session_cookie_v3_CookieBasedSessionState_cookie(
+          cookie_state);
+  if (cookie == nullptr) {
+    errors->AddError("field not present");
+    return config;
+  }
+  // name
+  config->cookie_name =
+      UpbStringToStdString(envoy_type_http_v3_Cookie_name(cookie));
+  if (config->cookie_name.empty()) {
+    ValidationErrors::ScopedField field(errors, ".name");
+    errors->AddError("field not present");
+  }
+  // ttl
+  if (const auto* duration = envoy_type_http_v3_Cookie_ttl(cookie);
+      duration != nullptr) {
+    ValidationErrors::ScopedField field(errors, ".ttl");
+    config->ttl = ParseDuration(duration, errors);
+  }
+  // path
+  config->path = UpbStringToStdString(envoy_type_http_v3_Cookie_path(cookie));
+  return config;
+}
+
+}  // namespace
+
+RefCountedPtr<const FilterConfig>
+XdsHttpStatefulSessionFilter::ParseTopLevelConfig(
+    absl::string_view /*instance_name*/,
+    const XdsResourceType::DecodeContext& context,
+    const XdsExtension& extension, ValidationErrors* errors) const {
+  const absl::string_view* serialized_filter_config =
+      std::get_if<absl::string_view>(&extension.value);
+  if (serialized_filter_config == nullptr) {
+    errors->AddError("could not parse stateful session filter config");
+    return nullptr;
+  }
+  auto* stateful_session =
+      envoy_extensions_filters_http_stateful_session_v3_StatefulSession_parse(
+          serialized_filter_config->data(), serialized_filter_config->size(),
+          context.arena);
+  if (stateful_session == nullptr) {
+    errors->AddError("could not parse stateful session filter config");
+    return nullptr;
+  }
+  return ParseStatefulSession(context, stateful_session, errors);
+}
+
+RefCountedPtr<const FilterConfig>
+XdsHttpStatefulSessionFilter::ParseOverrideConfig(
+    absl::string_view /*instance_name*/,
+    const XdsResourceType::DecodeContext& context,
+    const XdsExtension& extension, ValidationErrors* errors) const {
+  const absl::string_view* serialized_filter_config =
+      std::get_if<absl::string_view>(&extension.value);
+  if (serialized_filter_config == nullptr) {
+    errors->AddError("could not parse stateful session filter override config");
+    return nullptr;
+  }
+  auto* stateful_session_per_route =
+      envoy_extensions_filters_http_stateful_session_v3_StatefulSessionPerRoute_parse(
+          serialized_filter_config->data(), serialized_filter_config->size(),
+          context.arena);
+  if (stateful_session_per_route == nullptr) {
+    errors->AddError("could not parse stateful session filter override config");
+    return nullptr;
+  }
+  if (!envoy_extensions_filters_http_stateful_session_v3_StatefulSessionPerRoute_disabled(
+          stateful_session_per_route)) {
+    ValidationErrors::ScopedField field(errors, ".stateful_session");
+    const auto* stateful_session =
+        envoy_extensions_filters_http_stateful_session_v3_StatefulSessionPerRoute_stateful_session(
+            stateful_session_per_route);
+    if (stateful_session != nullptr) {
+      return ParseStatefulSession(context, stateful_session, errors);
+    }
+  }
+  // Return an empty config.  This is used to disable the filter.
+  return MakeRefCounted<StatefulSessionFilter::Config>();
+}
+
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_http_stateful_session_filter.h

@@ -38,22 +38,31 @@ class XdsHttpStatefulSessionFilter final : public XdsHttpFilterImpl {
   absl::string_view ConfigProtoName() const override;
   absl::string_view OverrideConfigProtoName() const override;
   void PopulateSymtab(upb_DefPool* symtab) const override;
-  std::optional<FilterConfig> GenerateFilterConfig(
+  std::optional<Json> GenerateFilterConfig(
       absl::string_view /*instance_name*/,
-      const XdsResourceType::DecodeContext& context, XdsExtension extension,
-      ValidationErrors* errors) const override;
-  std::optional<FilterConfig> GenerateFilterConfigOverride(
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
+  std::optional<Json> GenerateFilterConfigOverride(
       absl::string_view /*instance_name*/,
-      const XdsResourceType::DecodeContext& context, XdsExtension extension,
-      ValidationErrors* errors) const override;
-  void AddFilter(InterceptionChainBuilder& builder) const override;
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
   const grpc_channel_filter* channel_filter() const override;
   ChannelArgs ModifyChannelArgs(const ChannelArgs& args) const override;
   absl::StatusOr<ServiceConfigJsonEntry> GenerateMethodConfig(
-      const FilterConfig& hcm_filter_config,
-      const FilterConfig* filter_config_override) const override;
+      const Json& hcm_filter_config,
+      const Json* filter_config_override) const override;
   absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
-      const FilterConfig& hcm_filter_config) const override;
+      const Json& hcm_filter_config) const override;
+  void AddFilter(FilterChainBuilder& builder,
+                 RefCountedPtr<const FilterConfig> config) const override;
+  RefCountedPtr<const FilterConfig> ParseTopLevelConfig(
+      absl::string_view instance_name,
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
+  RefCountedPtr<const FilterConfig> ParseOverrideConfig(
+      absl::string_view instance_name,
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
   bool IsSupportedOnClients() const override { return true; }
   bool IsSupportedOnServers() const override { return false; }
 };

data/src/core/xds/grpc/xds_listener.cc

@@ -58,7 +58,10 @@ std::string XdsListenerResource::HttpConnectionManager::ToString() const {
 
 std::string XdsListenerResource::HttpConnectionManager::HttpFilter::ToString()
     const {
-  return absl::StrCat("{name=", name, ", config=", config.ToString(), "}");
+  return absl::StrCat(
+      "{name=", name, ", config_proto_type=", config_proto_type,
+      ", config=", JsonDump(config), ", filter_config=",
+      filter_config == nullptr ? "null" : filter_config->ToString(), "}");
 }
 
 //

data/src/core/xds/grpc/xds_listener.h

@@ -29,6 +29,7 @@
 #include <variant>
 #include <vector>
 
+#include "src/core/filter/filter_args.h"
 #include "src/core/lib/iomgr/resolved_address.h"
 #include "src/core/util/time.h"
 #include "src/core/xds/grpc/xds_common_types.h"
@@ -51,10 +52,17 @@ struct XdsListenerResource : public XdsResourceType::ResourceData {
 
     struct HttpFilter {
       std::string name;
-      XdsHttpFilterImpl::FilterConfig config;
+      absl::string_view config_proto_type;
+      Json config;
+      RefCountedPtr<const FilterConfig> filter_config;
 
       bool operator==(const HttpFilter& other) const {
-        return name == other.name && config == other.config;
+        if (name != other.name) return false;
+        if (config_proto_type != other.config_proto_type) return false;
+        if (config != other.config) return false;
+        if (filter_config == nullptr) return other.filter_config == nullptr;
+        if (other.filter_config == nullptr) return false;
+        return *filter_config == *other.filter_config;
       }
 
       std::string ToString() const;