grpc 1.80.0 → 1.81.0

data/include/grpc/context_types.h

@@ -0,0 +1,28 @@
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CONTEXT_TYPES_H
+#define GRPC_CONTEXT_TYPES_H
+
+#include <string>
+
+namespace grpc_core {
+
+struct TelemetryLabel {
+  std::string value;
+};
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CONTEXT_TYPES_H */

data/include/grpc/credentials.h

@@ -1257,6 +1257,17 @@ GRPCAPI void grpc_tls_credentials_options_set_check_call_host(
 GRPCAPI void grpc_tls_credentials_options_set_tls_session_key_log_file_path(
     grpc_tls_credentials_options* options, const char* path);
 
+/**
+ * EXPERIMENTAL API - Subject to change
+ *
+ * Sets the list of key exchange groups (TLS curves) that will be negotiated
+ * during the TLS handshake, in order of preference. If not set, a default list
+ * will be used.
+ */
+GRPCAPI void grpc_tls_credentials_options_set_key_exchange_groups(
+    grpc_tls_credentials_options* options,
+    const grpc_tls_key_exchange_group* groups, size_t num_groups);
+
 #ifdef __cplusplus
 }
 #endif

data/include/grpc/grpc_security_constants.h

@@ -145,6 +145,18 @@ typedef enum { UDS = 0, LOCAL_TCP } grpc_local_connect_type;
 /** The TLS versions that are supported by the SSL stack. **/
 typedef enum { TLS1_2, TLS1_3 } grpc_tls_version;
 
+/** TLS key exchange groups. */
+typedef enum {
+  /** Unspecified key exchange group. */
+  GRPC_TLS_GROUP_UNSPECIFIED,
+  /** secp256r1 ECDH key exchange. */
+  GRPC_TLS_GROUP_SECP256R1,
+  /** X25519 ECDH key exchange. */
+  GRPC_TLS_GROUP_X25519,
+  /** X25519_MLKEM768 hybrid key exchange. Post-quantum cryptography. */
+  GRPC_TLS_GROUP_X25519_MLKEM768,
+} grpc_tls_key_exchange_group;
+
 #ifdef __cplusplus
 }
 #endif

data/include/grpc/module.modulemap

@@ -6,6 +6,7 @@ header "byte_buffer.h"
   header "byte_buffer_reader.h"
   header "census.h"
   header "compression.h"
+  header "context_types.h"
   header "create_channel_from_endpoint.h"
   header "credentials.h"
   header "credentials_cpp.h"

data/src/core/call/call_spine.h

@@ -84,10 +84,14 @@ class CallSpine final : public Party, public channelz::DataSource {
   }
 
   auto PullServerInitialMetadata() {
+    GRPC_TRACE_LOG(call_state, INFO)
+        << "[CallSpine " << this << "]: PullServerInitialMetadata()";
     return call_filters().PullServerInitialMetadata();
   }
 
   auto PullServerTrailingMetadata() {
+    GRPC_TRACE_LOG(call_state, INFO)
+        << "[CallSpine " << this << "]: PullServerTrailingMetadata()";
     return Map(
         call_filters().PullServerTrailingMetadata(),
         [this](ServerMetadataHandle result) {
@@ -97,35 +101,54 @@ class CallSpine final : public Party, public channelz::DataSource {
   }
 
   auto PushClientToServerMessage(MessageHandle message) {
+    GRPC_TRACE_LOG(call_state, INFO)
+        << "[CallSpine " << this
+        << "]: PushClientToServerMessage(): " << message->DebugString();
     return call_filters().PushClientToServerMessage(std::move(message));
   }
 
   auto PullClientToServerMessage() {
+    GRPC_TRACE_LOG(call_state, INFO)
+        << "[CallSpine " << this << "]: PullClientToServerMessage()";
     return call_filters().PullClientToServerMessage();
   }
 
   auto PushServerToClientMessage(MessageHandle message) {
+    GRPC_TRACE_LOG(call_state, INFO)
+        << "[CallSpine " << this
+        << "]: PushServerToClientMessage(): " << message->DebugString();
     return call_filters().PushServerToClientMessage(std::move(message));
   }
 
   auto PullServerToClientMessage() {
+    GRPC_TRACE_LOG(call_state, INFO)
+        << "[CallSpine " << this << "]: PullServerToClientMessage()";
     return call_filters().PullServerToClientMessage();
   }
 
   void PushServerTrailingMetadata(ServerMetadataHandle md) {
     GRPC_TRACE_LOG(call_state, INFO)
-        << "[call_state] PushServerTrailingMetadata: " << this << " "
-        << md->DebugString();
+        << "[CallSpine " << this
+        << "]: PushServerTrailingMetadata(): " << md->DebugString();
     call_filters().PushServerTrailingMetadata(std::move(md));
   }
 
-  void FinishSends() { call_filters().FinishClientToServerSends(); }
+  void FinishSends() {
+    GRPC_TRACE_LOG(call_state, INFO)
+        << "[CallSpine " << this << "]: FinishSends()";
+    call_filters().FinishClientToServerSends();
+  }
 
   auto PullClientInitialMetadata() {
+    GRPC_TRACE_LOG(call_state, INFO)
+        << "[CallSpine " << this << "]: PullClientInitialMetadata()";
     return call_filters().PullClientInitialMetadata();
   }
 
   StatusFlag PushServerInitialMetadata(ServerMetadataHandle md) {
+    GRPC_TRACE_LOG(call_state, INFO)
+        << "[CallSpine " << this
+        << "]: PushServerInitialMetadata(): " << md->DebugString();
     return call_filters().PushServerInitialMetadata(std::move(md));
   }
 
@@ -153,7 +176,7 @@ class CallSpine final : public Party, public channelz::DataSource {
   void CancelIfFailed(const StatusType& r) {
     if (!IsStatusOk(r)) {
       GRPC_TRACE_LOG(call_state, INFO)
-          << "[call_state] spine " << this << " fails: " << r;
+          << "[CallSpine " << this << "]: fails: " << r;
       Cancel();
     }
   }
@@ -320,6 +343,7 @@ class CallSpine final : public Party, public channelz::DataSource {
           return p->Ref();
         }()),
         call_filters_(std::move(client_initial_metadata)) {
+    GRPC_TRACE_LOG(call_state, INFO) << "[CallSpine " << this << "]: created";
     SourceConstructed();
   }
 
@@ -676,8 +700,7 @@ auto MessagesFrom(CallHalf* h) {
   return Wrapper{h};
 }
 
-// Forward a call from `call_handler` to `call_initiator` (with initial metadata
-// `client_initial_metadata`)
+// Forward a call from `call_handler` to `call_initiator`.
 // `on_server_trailing_metadata_from_initiator` is a callback that will be
 // called with the server trailing metadata received by the initiator, and can
 // be used to mutate that metadata if desired.

data/src/core/call/client_call.cc

@@ -442,14 +442,14 @@ void ClientCall::OnReceivedStatus(ServerMetadataHandle server_trailing_metadata,
   const auto status = server_trailing_metadata->get(GrpcStatusMetadata())
                           .value_or(GRPC_STATUS_UNKNOWN);
   *out_status = status;
+  Slice message_slice;
   if (!IsErrorFlattenEnabled() || status != GRPC_STATUS_OK) {
-    Slice message_slice;
     if (Slice* message =
             server_trailing_metadata->get_pointer(GrpcMessageMetadata())) {
       message_slice = message->Ref();
     }
-    *out_status_details = message_slice.TakeCSlice();
   }
+  *out_status_details = message_slice.TakeCSlice();
   if (out_error_string != nullptr) {
     if (status != GRPC_STATUS_OK) {
       *out_error_string =

data/src/core/call/client_call.h

@@ -56,6 +56,8 @@ class ClientCall final
     : public Call,
       public DualRefCounted<ClientCall, NonPolymorphicRefCount,
                             UnrefCallDestroy> {
+  friend class VirtualChannel;
+
  public:
   ClientCall(grpc_call* parent_call, uint32_t propagation_mask,
              grpc_completion_queue* cq, Slice path,
@@ -71,6 +73,10 @@ class ClientCall final
   }
   grpc_call_error StartBatch(const grpc_op* ops, size_t nops, void* notify_tag,
                              bool is_notify_tag_closure) override;
+  void FailBatchImmediately(void* notify_tag, bool is_notify_tag_closure,
+                            grpc_error_handle error) override {
+    EndOpImmediately(cq_, notify_tag, is_notify_tag_closure, std::move(error));
+  }
 
   void ExternalRef() override { Ref().release(); }
   void ExternalUnref() override { Unref(); }

data/src/core/call/interception_chain.h

@@ -88,13 +88,21 @@ class HijackedCall final {
 // *Interceptor* in the call chain (without having been processed by any
 // intervening filters) -- note that this is commonly not useful (not enough
 // guarantees), and so it's usually better to Hijack and examine the metadata.
+//
+// TODO(roth, ctiller): Change this API such that it always deals with
+// the client initial metadata after it has been processed by any
+// preceding filters.  We don't actually have any use-case for seeing
+// the unprocessed initial metadata and deciding to do a PassThrough(),
+// and its presence in this API is confusing.
 
 class Interceptor : public UnstartedCallDestination {
  public:
   using UnstartedCallDestination::UnstartedCallDestination;
 
   void StartCall(UnstartedCallHandler unstarted_call_handler) final {
-    unstarted_call_handler.AddCallStack(filter_stack_);
+    if (filter_stack_ != nullptr) {
+      unstarted_call_handler.AddCallStack(filter_stack_);
+    }
     InterceptCall(std::move(unstarted_call_handler));
   }
 
@@ -137,6 +145,9 @@ class Interceptor : public UnstartedCallDestination {
  private:
   friend class InterceptionChainBuilder;
 
+  template <typename Derived>
+  friend class V3InterceptorToV2Bridge;
+
   RefCountedPtr<UnstartedCallDestination> wrapped_destination_;
   RefCountedPtr<CallFilters::Stack> filter_stack_;
 };

data/src/core/call/metadata_batch.h

@@ -1004,6 +1004,7 @@ struct Value<Which, absl::enable_if_t<Which::kRepeatable == false &&
   void LogTo(LogFn log_fn) const {
     LogKeyValueTo(Which::key(), value, Which::DisplayValue, log_fn);
   }
+  using Trait = Which;
   using StorageType = typename Which::ValueType;
   GPR_NO_UNIQUE_ADDRESS StorageType value;
 };
@@ -1032,6 +1033,7 @@ struct Value<Which, absl::enable_if_t<Which::kRepeatable == false &&
   void LogTo(LogFn log_fn) const {
     LogKeyValueTo(Which::DebugKey(), value, Which::DisplayValue, log_fn);
   }
+  using Trait = Which;
   using StorageType = typename Which::ValueType;
   GPR_NO_UNIQUE_ADDRESS StorageType value;
 };
@@ -1069,6 +1071,7 @@ struct Value<Which, absl::enable_if_t<Which::kRepeatable == true &&
       LogKeyValueTo(Which::key(), v, Which::Encode, log_fn);
     }
   }
+  using Trait = Which;
   using StorageType = absl::InlinedVector<typename Which::ValueType, 1>;
   StorageType value;
 };
@@ -1104,6 +1107,7 @@ struct Value<Which, absl::enable_if_t<Which::kRepeatable == true &&
       LogKeyValueTo(Which::DebugKey(), v, Which::DisplayValue, log_fn);
     }
   }
+  using Trait = Which;
   using StorageType = absl::InlinedVector<typename Which::ValueType, 1>;
   StorageType value;
 };
@@ -1439,10 +1443,32 @@ class MetadataMap {
     }
   }
 
+  template <typename T, typename Enable = void>
+  struct IsColonPrefixed {
+    static bool Check() { return false; }
+  };
+
+  template <typename T>
+  struct IsColonPrefixed<T, absl::void_t<decltype(T::key())>> {
+    static bool Check() {
+      auto k = T::key();
+      return !k.empty() && k[0] == ':';
+    }
+  };
+
   // Like Encode, but also visit the non-encodable fields.
   template <typename Encoder>
   void ForEach(Encoder* encoder) const {
-    table_.ForEach(metadata_detail::ForEachWrapper<Encoder>{encoder});
+    table_.ForEach([encoder](const auto& which) {
+      if (IsColonPrefixed<typename std::decay_t<decltype(which)>>::Check()) {
+        which.VisitWith(encoder);
+      }
+    });
+    table_.ForEach([encoder](const auto& which) {
+      if (!IsColonPrefixed<typename std::decay_t<decltype(which)>>::Check()) {
+        which.VisitWith(encoder);
+      }
+    });
     for (const auto& unk : unknown_) {
       encoder->Encode(unk.first, unk.second);
     }
@@ -1451,7 +1477,16 @@ class MetadataMap {
   // Similar to Encode, but targeted at logging: for each metadatum,
   // call f(key, value) as absl::string_views.
   void Log(metadata_detail::LogFn log_fn) const {
-    table_.ForEach(metadata_detail::LogWrapper{log_fn});
+    table_.ForEach([log_fn](const auto& which) {
+      if (IsColonPrefixed<typename std::decay_t<decltype(which)>>::Check()) {
+        which.LogTo(log_fn);
+      }
+    });
+    table_.ForEach([log_fn](const auto& which) {
+      if (!IsColonPrefixed<typename std::decay_t<decltype(which)>>::Check()) {
+        which.LogTo(log_fn);
+      }
+    });
     for (const auto& unk : unknown_) {
       log_fn(unk.first.as_string_view(), unk.second.as_string_view());
     }

data/src/core/call/server_call.h

@@ -91,6 +91,10 @@ class ServerCall final : public Call, public DualRefCounted<ServerCall> {
   }
   grpc_call_error StartBatch(const grpc_op* ops, size_t nops, void* notify_tag,
                              bool is_notify_tag_closure) override;
+  void FailBatchImmediately(void* notify_tag, bool is_notify_tag_closure,
+                            grpc_error_handle error) override {
+    EndOpImmediately(cq_, notify_tag, is_notify_tag_closure, std::move(error));
+  }
 
   void ExternalRef() override { Ref().release(); }
   void ExternalUnref() override { Unref(); }

data/src/core/client_channel/client_channel.cc

@@ -838,7 +838,8 @@ void ClientChannel::AddConnectivityWatcher(
 
 void ClientChannel::RemoveConnectivityWatcher(
     AsyncConnectivityStateWatcherInterface* watcher) {
-  auto self = RefAsSubclass<ClientChannel>();  // Held by callback.
+  WeakRefCountedPtr<ClientChannel> self =
+      WeakRefAsSubclass<ClientChannel>();  // Held by callback.
   work_serializer_->Run(
       [self, watcher]() ABSL_EXCLUSIVE_LOCKS_REQUIRED(*self->work_serializer_) {
         self->state_tracker_.RemoveWatcher(watcher);

data/src/core/client_channel/client_channel_filter.cc

@@ -563,7 +563,7 @@ class ClientChannelFilter::SubchannelWrapper final
       GRPC_TRACE_LOG(client_channel, INFO)
           << "chand=" << parent_->chand_
           << ": connectivity change for subchannel wrapper " << parent_.get()
-          << "hopping into work_serializer";
+          << "; hopping into work_serializer";
       auto self = RefAsSubclass<WatcherWrapper>();
       parent_->chand_->work_serializer_->Run(
           [self, state, status]() ABSL_EXCLUSIVE_LOCKS_REQUIRED(
@@ -576,7 +576,7 @@ class ClientChannelFilter::SubchannelWrapper final
       GRPC_TRACE_LOG(client_channel, INFO)
           << "chand=" << parent_->chand_
           << ": keepalive update for subchannel wrapper " << parent_.get()
-          << "hopping into work_serializer";
+          << "; hopping into work_serializer";
       auto self = RefAsSubclass<WatcherWrapper>();
       parent_->chand_->work_serializer_->Run(
           [self, new_keepalive_time]() ABSL_EXCLUSIVE_LOCKS_REQUIRED(

data/src/core/credentials/transport/tls/grpc_tls_credentials_options.cc

@@ -164,3 +164,11 @@ GRPCAPI void grpc_tls_credentials_options_set_sni_override(
   GRPC_CHECK_NE(options, nullptr);
   options->set_sni_override(sni_override);
 }
+
+void grpc_tls_credentials_options_set_key_exchange_groups(
+    grpc_tls_credentials_options* options,
+    const grpc_tls_key_exchange_group* groups, size_t num_groups) {
+  GRPC_CHECK_NE(options, nullptr);
+  options->set_key_exchange_groups(
+      std::vector<grpc_tls_key_exchange_group>(groups, groups + num_groups));
+}

data/src/core/credentials/transport/tls/grpc_tls_credentials_options.h

@@ -23,6 +23,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <vector>
+
 #include "absl/container/inlined_vector.h"
 
 #include <grpc/credentials.h>
@@ -70,6 +72,7 @@ struct grpc_tls_credentials_options
     return nullptr;
   }
   const std::optional<std::string>& sni_override() const { return sni_override_; }
+  std::vector<grpc_tls_key_exchange_group> key_exchange_groups() const { return key_exchange_groups_; }
 
   // Setters for member fields.
   void set_cert_request_type(grpc_ssl_client_certificate_request_type cert_request_type) { cert_request_type_ = cert_request_type; }
@@ -91,6 +94,7 @@ struct grpc_tls_credentials_options
   void set_root_certificate_provider(grpc_core::RefCountedPtr<grpc_tls_certificate_provider> root_certificate_provider) { root_certificate_provider_ = std::move(root_certificate_provider); }
   // If set to nullopt, do not override. If set to empty string, disable sending SNI. Otherwise, override SNI
   void set_sni_override(std::optional<std::string> sni_override) { sni_override_ = std::move(sni_override); }
+  void set_key_exchange_groups(std::vector<grpc_tls_key_exchange_group> key_exchange_groups) { key_exchange_groups_ = std::move(key_exchange_groups); }
 
   bool operator==(const grpc_tls_credentials_options& other) const {
     return cert_request_type_ == other.cert_request_type_ &&
@@ -107,7 +111,8 @@ struct grpc_tls_credentials_options
       send_client_ca_list_ == other.send_client_ca_list_ &&
       (identity_certificate_provider_ == other.identity_certificate_provider_ || (identity_certificate_provider_ != nullptr && other.identity_certificate_provider_ != nullptr && identity_certificate_provider_->Compare(other.identity_certificate_provider_.get()) == 0)) &&
       (root_certificate_provider_ == other.root_certificate_provider_ || (root_certificate_provider_ != nullptr && other.root_certificate_provider_ != nullptr && root_certificate_provider_->Compare(other.root_certificate_provider_.get()) == 0)) &&
-      sni_override_ == other.sni_override_;
+      sni_override_ == other.sni_override_ &&
+      key_exchange_groups_ == other.key_exchange_groups_;
   }
 
   grpc_tls_credentials_options(grpc_tls_credentials_options& other) :
@@ -125,7 +130,8 @@ struct grpc_tls_credentials_options
       send_client_ca_list_(other.send_client_ca_list_),
       identity_certificate_provider_(other.identity_certificate_provider_),
       root_certificate_provider_(other.root_certificate_provider_),
-      sni_override_(other.sni_override_)  {}
+      sni_override_(other.sni_override_),
+      key_exchange_groups_(other.key_exchange_groups_)  {}
 
  private:
   grpc_ssl_client_certificate_request_type cert_request_type_ = GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE;
@@ -143,6 +149,7 @@ struct grpc_tls_credentials_options
   grpc_core::RefCountedPtr<grpc_tls_certificate_provider> identity_certificate_provider_;
   grpc_core::RefCountedPtr<grpc_tls_certificate_provider> root_certificate_provider_;
   std::optional<std::string> sni_override_;
+  std::vector<grpc_tls_key_exchange_group> key_exchange_groups_;
 };
 
 #endif  // GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H

data/src/core/credentials/transport/tls/ssl_utils.cc

@@ -425,6 +425,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory,
     std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider,
+    const std::vector<grpc_tls_key_exchange_group>& key_exchange_groups,
     tsi_ssl_client_handshaker_factory** handshaker_factory) {
   const char* root_certs = nullptr;
   const tsi_ssl_root_certs_store* root_store = nullptr;
@@ -464,6 +465,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
   options.max_tls_version = max_tls_version;
   options.crl_directory = crl_directory;
   options.crl_provider = std::move(crl_provider);
+  options.key_exchange_groups = key_exchange_groups;
   const tsi_result result =
       tsi_create_ssl_client_handshaker_factory_with_options(&options,
                                                             handshaker_factory);
@@ -484,6 +486,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory, bool send_client_ca_list,
     std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider,
+    const std::vector<grpc_tls_key_exchange_group>& key_exchange_groups,
     tsi_ssl_server_handshaker_factory** handshaker_factory) {
   size_t num_alpn_protocols = 0;
   const char** alpn_protocol_strings =
@@ -502,6 +505,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
   options.crl_provider = std::move(crl_provider);
   options.send_client_ca_list = send_client_ca_list;
   options.root_cert_info = std::move(root_cert_info);
+  options.key_exchange_groups = key_exchange_groups;
   const tsi_result result =
       tsi_create_ssl_server_handshaker_factory_with_options(&options,
                                                             handshaker_factory);

data/src/core/credentials/transport/tls/ssl_utils.h

@@ -41,6 +41,7 @@
 #include "src/core/tsi/transport_security_interface.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 
 // --- Util ---
@@ -94,6 +95,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory,
     std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider,
+    const std::vector<grpc_tls_key_exchange_group>& key_exchange_groups,
     tsi_ssl_client_handshaker_factory** handshaker_factory);
 
 grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
@@ -104,6 +106,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory, bool send_client_ca_list,
     std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider,
+    const std::vector<grpc_tls_key_exchange_group>& key_exchange_groups,
     tsi_ssl_server_handshaker_factory** handshaker_factory);
 
 // Exposed for testing only.

data/src/core/credentials/transport/tls/tls_security_connector.cc

@@ -559,7 +559,8 @@ TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()), ssl_session_cache_,
       tls_session_key_logger_.get(), options_->crl_directory().c_str(),
-      options_->crl_provider(), &client_handshaker_factory_);
+      options_->crl_provider(), options_->key_exchange_groups(),
+      &client_handshaker_factory_);
 }
 
 // -------------------server security connector-------------------
@@ -828,7 +829,7 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
       grpc_get_tsi_tls_version(options_->max_tls_version()),
       tls_session_key_logger_.get(), options_->crl_directory().c_str(),
       options_->send_client_ca_list(), options_->crl_provider(),
-      &server_handshaker_factory_);
+      options_->key_exchange_groups(), &server_handshaker_factory_);
 }
 
 }  // namespace grpc_core

data/src/core/ext/filters/http/client_authority_filter.cc

@@ -77,6 +77,10 @@ void RegisterClientAuthorityFilter(CoreConfiguration::Builder* builder) {
       ->RegisterFilter<ClientAuthorityFilter>(GRPC_CLIENT_DIRECT_CHANNEL)
       .If(NeedsClientAuthorityFilter)
       .Before<ClientAuthFilter>();
+  builder->channel_init()
+      ->RegisterFilter<ClientAuthorityFilter>(GRPC_CLIENT_VIRTUAL_CHANNEL)
+      .If(NeedsClientAuthorityFilter)
+      .Before<ClientAuthFilter>();
 }
 
 }  // namespace grpc_core

data/src/core/ext/filters/http/http_filters_plugin.cc

@@ -65,5 +65,11 @@ void RegisterHttpFilters(CoreConfiguration::Builder* builder) {
       ->RegisterFilter<HttpServerFilter>(GRPC_SERVER_CHANNEL)
       .If(IsBuildingHttpLikeTransport)
       .After<ServerMessageSizeFilter>();
+  builder->channel_init()
+      ->RegisterFilter<HttpClientFilter>(GRPC_CLIENT_VIRTUAL_CHANNEL)
+      .If(IsBuildingHttpLikeTransport);
+  builder->channel_init()
+      ->RegisterFilter<HttpServerFilter>(GRPC_SERVER_VIRTUAL_CHANNEL)
+      .If(IsBuildingHttpLikeTransport);
 }
 }  // namespace grpc_core

data/src/core/ext/transport/chttp2/server/chttp2_server.cc

@@ -231,7 +231,7 @@ void NewChttp2ServerListener::ActiveConnection::HandshakingState::
                                      std::move((*result)->endpoint), false)
             ->Ref();
     grpc_error_handle channel_init_err =
-        connection_->listener_state_->SetupTransport(
+        connection_->listener_state_->server()->SetupTransport(
             transport.get(), accepting_pollset_, (*result)->args);
     if (channel_init_err.ok()) {
       // Use notify_on_receive_settings callback to enforce the

data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc

@@ -140,6 +140,8 @@ using grpc_core::Json;
 
 #define GRPC_ARG_HTTP2_PING_ON_RST_STREAM_PERCENT \
   "grpc.http2.ping_on_rst_stream_percent"
+#define GRPC_ARG_HTTP2_MAX_DEALLOCATING_STREAMS \
+  "grpc.http2.max_deallocating_streams"
 
 static grpc_core::Duration g_default_client_keepalive_time =
     grpc_core::Duration::Infinity();
@@ -552,6 +554,11 @@ static void read_channel_args(grpc_chttp2_transport* t,
   t->max_concurrent_streams_reject_on_client =
       channel_args.GetBool(GRPC_ARG_MAX_CONCURRENT_STREAMS_REJECT_ON_CLIENT)
           .value_or(false);
+
+  t->max_deallocating_streams =
+      channel_args.GetInt(GRPC_ARG_HTTP2_MAX_DEALLOCATING_STREAMS)
+          .value_or(grpc_core::IsH2MaxDeallocatingStreamsHeadroomEnabled() ? 100
+                                                                           : 0);
 }
 
 static void init_keepalive_pings_if_enabled_locked(

data/src/core/ext/transport/chttp2/transport/frame.cc

@@ -725,7 +725,7 @@ SerializeReturn Serialize(absl::Span<Http2Frame> frames, SliceBuffer& out) {
 }
 
 http2::ValueOrHttp2Status<Http2Frame> ParseFramePayload(
-    const Http2FrameHeader& hdr, SliceBuffer payload) {
+    const Http2FrameHeader& hdr, SliceBuffer&& payload) {
   GRPC_CHECK(payload.Length() == hdr.length);
 
   switch (static_cast<FrameType>(hdr.type)) {

data/src/core/ext/transport/chttp2/transport/frame.h

@@ -236,7 +236,7 @@ struct SerializeReturn {
 // Http2UnknownFrame.
 // It is expected that hdr.length == payload.Length().
 http2::ValueOrHttp2Status<Http2Frame> ParseFramePayload(
-    const Http2FrameHeader& hdr, SliceBuffer payload);
+    const Http2FrameHeader& hdr, SliceBuffer&& payload);
 
 // Serialize frame and append to out, leaves frames in an unknown state (may
 // move things out of frames)

data/src/core/ext/transport/chttp2/transport/frame_security.cc

@@ -25,6 +25,7 @@
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_buffer.h"
 #include "src/core/lib/transport/transport_framing_endpoint_extension.h"
+#include "src/core/util/grpc_check.h"
 #include "absl/status/status.h"
 
 absl::Status grpc_chttp2_security_frame_parser_parse(void* parser,
@@ -59,6 +60,7 @@ absl::Status grpc_chttp2_security_frame_parser_begin_frame(
 void grpc_chttp2_security_frame_create(grpc_slice_buffer* payload,
                                        uint32_t length,
                                        grpc_slice_buffer* frame) {
+  GRPC_CHECK_EQ(payload->length, length);
   grpc_slice hdr;
   uint8_t* p;
   static const size_t header_size = 9;
@@ -76,5 +78,5 @@ void grpc_chttp2_security_frame_create(grpc_slice_buffer* payload,
   *p++ = 0;
 
   grpc_slice_buffer_add(frame, hdr);
-  grpc_slice_buffer_move_first_no_ref(payload, payload->length, frame);
+  grpc_slice_buffer_move_first_no_ref(payload, length, frame);
 }