grpc 1.80.0 → 1.81.0

data/src/core/xds/grpc/xds_http_rbac_filter.cc

@@ -216,12 +216,16 @@ Json ParseMetadataMatcherToJson(
 }
 
 Json ParsePermissionToJson(const envoy_config_rbac_v3_Permission* permission,
-                           ValidationErrors* errors) {
+                           size_t depth, ValidationErrors* errors) {
+  if (depth > 16) {
+    errors->AddError("exceeded max recursion depth");
+    return Json();
+  }
   Json::Object permission_json;
   // Helper function to parse Permission::Set to JSON. Used by `and_rules` and
   // `or_rules`.
   auto parse_permission_set_to_json =
-      [errors](const envoy_config_rbac_v3_Permission_Set* set) -> Json {
+      [&](const envoy_config_rbac_v3_Permission_Set* set) -> Json {
     Json::Array rules_json;
     size_t size;
     const envoy_config_rbac_v3_Permission* const* rules =
@@ -229,7 +233,7 @@ Json ParsePermissionToJson(const envoy_config_rbac_v3_Permission* permission,
     for (size_t i = 0; i < size; ++i) {
       ValidationErrors::ScopedField field(errors,
                                           absl::StrCat(".rules[", i, "]"));
-      Json permission_json = ParsePermissionToJson(rules[i], errors);
+      Json permission_json = ParsePermissionToJson(rules[i], depth + 1, errors);
       rules_json.emplace_back(std::move(permission_json));
     }
     return Json::FromObject(
@@ -276,7 +280,8 @@ Json ParsePermissionToJson(const envoy_config_rbac_v3_Permission* permission,
   } else if (envoy_config_rbac_v3_Permission_has_not_rule(permission)) {
     ValidationErrors::ScopedField field(errors, ".not_rule");
     Json not_rule_json = ParsePermissionToJson(
-        envoy_config_rbac_v3_Permission_not_rule(permission), errors);
+        envoy_config_rbac_v3_Permission_not_rule(permission), depth + 1,
+        errors);
     permission_json.emplace("notRule", std::move(not_rule_json));
   } else if (envoy_config_rbac_v3_Permission_has_requested_server_name(
                  permission)) {
@@ -293,12 +298,16 @@ Json ParsePermissionToJson(const envoy_config_rbac_v3_Permission* permission,
 }
 
 Json ParsePrincipalToJson(const envoy_config_rbac_v3_Principal* principal,
-                          ValidationErrors* errors) {
+                          size_t depth, ValidationErrors* errors) {
+  if (depth > 16) {
+    errors->AddError("exceeded max recursion depth");
+    return Json();
+  }
   Json::Object principal_json;
   // Helper function to parse Principal::Set to JSON. Used by `and_ids` and
   // `or_ids`.
   auto parse_principal_set_to_json =
-      [errors](const envoy_config_rbac_v3_Principal_Set* set) -> Json {
+      [&](const envoy_config_rbac_v3_Principal_Set* set) -> Json {
     Json::Array ids_json;
     size_t size;
     const envoy_config_rbac_v3_Principal* const* ids =
@@ -306,7 +315,7 @@ Json ParsePrincipalToJson(const envoy_config_rbac_v3_Principal* principal,
     for (size_t i = 0; i < size; ++i) {
       ValidationErrors::ScopedField field(errors,
                                           absl::StrCat(".ids[", i, "]"));
-      Json principal_json = ParsePrincipalToJson(ids[i], errors);
+      Json principal_json = ParsePrincipalToJson(ids[i], depth + 1, errors);
       ids_json.emplace_back(std::move(principal_json));
     }
     return Json::FromObject({{"ids", Json::FromArray(std::move(ids_json))}});
@@ -368,7 +377,7 @@ Json ParsePrincipalToJson(const envoy_config_rbac_v3_Principal* principal,
   } else if (envoy_config_rbac_v3_Principal_has_not_id(principal)) {
     ValidationErrors::ScopedField field(errors, ".not_id");
     Json not_id_json = ParsePrincipalToJson(
-        envoy_config_rbac_v3_Principal_not_id(principal), errors);
+        envoy_config_rbac_v3_Principal_not_id(principal), depth + 1, errors);
     principal_json.emplace("notId", std::move(not_id_json));
   } else {
     errors->AddError("invalid rule");
@@ -386,7 +395,8 @@ Json ParsePolicyToJson(const envoy_config_rbac_v3_Policy* policy,
   for (size_t i = 0; i < size; ++i) {
     ValidationErrors::ScopedField field(errors,
                                         absl::StrCat(".permissions[", i, "]"));
-    Json permission_json = ParsePermissionToJson(permissions[i], errors);
+    Json permission_json =
+        ParsePermissionToJson(permissions[i], /*depth=*/0, errors);
     permissions_json.emplace_back(std::move(permission_json));
   }
   policy_json.emplace("permissions",
@@ -397,7 +407,8 @@ Json ParsePolicyToJson(const envoy_config_rbac_v3_Policy* policy,
   for (size_t i = 0; i < size; ++i) {
     ValidationErrors::ScopedField field(errors,
                                         absl::StrCat(".principals[", i, "]"));
-    Json principal_json = ParsePrincipalToJson(principals[i], errors);
+    Json principal_json =
+        ParsePrincipalToJson(principals[i], /*depth=*/0, errors);
     principals_json.emplace_back(std::move(principal_json));
   }
   policy_json.emplace("principals",

data/src/core/xds/grpc/xds_listener.cc

@@ -18,9 +18,7 @@
 
 #include "src/core/lib/address_utils/sockaddr_utils.h"
 #include "src/core/util/match.h"
-#include "absl/strings/str_cat.h"
-#include "absl/strings/str_format.h"
-#include "absl/strings/str_join.h"
+#include "src/core/util/string.h"
 
 namespace grpc_core {
 
@@ -29,27 +27,31 @@ namespace grpc_core {
 //
 
 std::string XdsListenerResource::HttpConnectionManager::ToString() const {
-  std::vector<std::string> contents;
-  contents.push_back(Match(
+  std::string result = "{";
+  Match(
       route_config,
-      [](const std::string& rds_name) {
-        return absl::StrCat("rds_name=", rds_name);
+      [&](const std::string& rds_name) {
+        StrAppend(result, "rds_name=");
+        StrAppend(result, rds_name);
       },
-      [](const std::shared_ptr<const XdsRouteConfigResource>& route_config) {
-        return absl::StrCat("route_config=", route_config->ToString());
-      }));
-  contents.push_back(absl::StrCat("http_max_stream_duration=",
-                                  http_max_stream_duration.ToString()));
+      [&](const std::shared_ptr<const XdsRouteConfigResource>& route_config) {
+        StrAppend(result, "route_config=");
+        StrAppend(result, route_config->ToString());
+      });
+  StrAppend(result, ", http_max_stream_duration=");
+  StrAppend(result, http_max_stream_duration.ToString());
   if (!http_filters.empty()) {
-    std::vector<std::string> filter_strings;
-    filter_strings.reserve(http_filters.size());
+    StrAppend(result, ", http_filters=[");
+    bool is_first = true;
     for (const auto& http_filter : http_filters) {
-      filter_strings.push_back(http_filter.ToString());
+      if (!is_first) StrAppend(result, ", ");
+      StrAppend(result, http_filter.ToString());
+      is_first = false;
     }
-    contents.push_back(absl::StrCat("http_filters=[",
-                                    absl::StrJoin(filter_strings, ", "), "]"));
+    StrAppend(result, "]");
   }
-  return absl::StrCat("{", absl::StrJoin(contents, ", "), "}");
+  StrAppend(result, "}");
+  return result;
 }
 
 //
@@ -58,10 +60,17 @@ std::string XdsListenerResource::HttpConnectionManager::ToString() const {
 
 std::string XdsListenerResource::HttpConnectionManager::HttpFilter::ToString()
     const {
-  return absl::StrCat(
-      "{name=", name, ", config_proto_type=", config_proto_type,
-      ", config=", JsonDump(config), ", filter_config=",
-      filter_config == nullptr ? "null" : filter_config->ToString(), "}");
+  std::string result = "{name=";
+  StrAppend(result, name);
+  StrAppend(result, ", config_proto_type=");
+  StrAppend(result, config_proto_type);
+  StrAppend(result, ", config=");
+  StrAppend(result, JsonDump(config));
+  StrAppend(result, ", filter_config=");
+  StrAppend(result,
+            filter_config == nullptr ? "null" : filter_config->ToString());
+  StrAppend(result, "}");
+  return result;
 }
 
 //
@@ -69,9 +78,11 @@ std::string XdsListenerResource::HttpConnectionManager::HttpFilter::ToString()
 //
 
 std::string XdsListenerResource::DownstreamTlsContext::ToString() const {
-  return absl::StrFormat("common_tls_context=%s, require_client_certificate=%s",
-                         common_tls_context.ToString(),
-                         require_client_certificate ? "true" : "false");
+  std::string result = "{common_tls_context=";
+  StrAppend(result, common_tls_context.ToString());
+  StrAppend(result, ", require_client_certificate=");
+  StrAppend(result, require_client_certificate ? "true}" : "false}");
+  return result;
 }
 
 bool XdsListenerResource::DownstreamTlsContext::Empty() const {
@@ -83,9 +94,12 @@ bool XdsListenerResource::DownstreamTlsContext::Empty() const {
 //
 
 std::string XdsListenerResource::FilterChainData::ToString() const {
-  return absl::StrCat(
-      "{downstream_tls_context=", downstream_tls_context.ToString(),
-      " http_connection_manager=", http_connection_manager.ToString(), "}");
+  std::string result = "{downstream_tls_context=";
+  StrAppend(result, downstream_tls_context.ToString());
+  StrAppend(result, " http_connection_manager=");
+  StrAppend(result, http_connection_manager.ToString());
+  StrAppend(result, "}");
+  return result;
 }
 
 //
@@ -93,11 +107,14 @@ std::string XdsListenerResource::FilterChainData::ToString() const {
 //
 
 std::string XdsListenerResource::FilterChainMap::CidrRange::ToString() const {
+  std::string result = "{address_prefix=";
   auto addr_str = grpc_sockaddr_to_string(&address, false);
-  return absl::StrCat(
-      "{address_prefix=",
-      addr_str.ok() ? addr_str.value() : addr_str.status().ToString(),
-      ", prefix_len=", prefix_len, "}");
+  StrAppend(result,
+            addr_str.ok() ? addr_str.value() : addr_str.status().ToString());
+  StrAppend(result, ", prefix_len=");
+  StrAppend(result, std::to_string(prefix_len));
+  StrAppend(result, "}");
+  return result;
 }
 
 //
@@ -105,41 +122,57 @@ std::string XdsListenerResource::FilterChainMap::CidrRange::ToString() const {
 //
 
 std::string XdsListenerResource::FilterChainMap::ToString() const {
-  std::vector<std::string> contents;
+  std::string result = "{";
+  bool is_first = true;
   for (const auto& destination_ip : destination_ip_vector) {
     for (int source_type = 0; source_type < 3; ++source_type) {
       for (const auto& source_ip :
            destination_ip.source_types_array[source_type]) {
         for (const auto& [port, filter_chain] : source_ip.ports_map) {
-          std::vector<std::string> match_contents;
+          if (!is_first) StrAppend(result, ", ");
+          StrAppend(result, "{filter_chain_match={");
+          bool match_is_first = true;
           if (destination_ip.prefix_range.has_value()) {
-            match_contents.push_back(
-                absl::StrCat("prefix_ranges={",
-                             destination_ip.prefix_range->ToString(), "}"));
+            StrAppend(result, "prefix_ranges={");
+            StrAppend(result, destination_ip.prefix_range->ToString());
+            StrAppend(result, "}");
+            match_is_first = false;
           }
           if (static_cast<ConnectionSourceType>(source_type) ==
               ConnectionSourceType::kSameIpOrLoopback) {
-            match_contents.push_back("source_type=SAME_IP_OR_LOOPBACK");
+            if (!match_is_first) StrAppend(result, ", ");
+            StrAppend(result, "source_type=SAME_IP_OR_LOOPBACK");
+            match_is_first = false;
           } else if (static_cast<ConnectionSourceType>(source_type) ==
                      ConnectionSourceType::kExternal) {
-            match_contents.push_back("source_type=EXTERNAL");
+            if (!match_is_first) StrAppend(result, ", ");
+            StrAppend(result, "source_type=EXTERNAL");
+            match_is_first = false;
           }
           if (source_ip.prefix_range.has_value()) {
-            match_contents.push_back(
-                absl::StrCat("source_prefix_ranges={",
-                             source_ip.prefix_range->ToString(), "}"));
+            if (!match_is_first) StrAppend(result, ", ");
+            StrAppend(result, "source_prefix_ranges={");
+            StrAppend(result, source_ip.prefix_range->ToString());
+            StrAppend(result, "}");
+            match_is_first = false;
           }
           if (port != 0) {
-            match_contents.push_back(absl::StrCat("source_ports={", port, "}"));
+            if (!match_is_first) StrAppend(result, ", ");
+            StrAppend(result, "source_ports={");
+            StrAppend(result, std::to_string(port));
+            StrAppend(result, "}");
+            match_is_first = false;
           }
-          contents.push_back(absl::StrCat(
-              "{filter_chain_match={", absl::StrJoin(match_contents, ", "),
-              "}, filter_chain=", filter_chain.data->ToString(), "}"));
+          StrAppend(result, "}, filter_chain=");
+          StrAppend(result, filter_chain.data->ToString());
+          StrAppend(result, "}");
+          is_first = false;
         }
       }
     }
   }
-  return absl::StrCat("{", absl::StrJoin(contents, ", "), "}");
+  StrAppend(result, "}");
+  return result;
 }
 
 //
@@ -147,15 +180,16 @@ std::string XdsListenerResource::FilterChainMap::ToString() const {
 //
 
 std::string XdsListenerResource::TcpListener::ToString() const {
-  std::vector<std::string> contents;
-  contents.push_back(absl::StrCat("address=", address));
-  contents.push_back(
-      absl::StrCat("filter_chain_map=", filter_chain_map.ToString()));
+  std::string result = "{address=";
+  StrAppend(result, address);
+  StrAppend(result, ", filter_chain_map=");
+  StrAppend(result, filter_chain_map.ToString());
   if (default_filter_chain.has_value()) {
-    contents.push_back(absl::StrCat("default_filter_chain=",
-                                    default_filter_chain->ToString()));
+    StrAppend(result, ", default_filter_chain=");
+    StrAppend(result, default_filter_chain->ToString());
   }
-  return absl::StrCat("{", absl::StrJoin(contents, ", "), "}");
+  StrAppend(result, "}");
+  return result;
 }
 
 //
@@ -163,14 +197,19 @@ std::string XdsListenerResource::TcpListener::ToString() const {
 //
 
 std::string XdsListenerResource::ToString() const {
-  return Match(
+  std::string result = "{";
+  Match(
       listener,
-      [](const HttpConnectionManager& hcm) {
-        return absl::StrCat("{http_connection_manager=", hcm.ToString(), "}");
+      [&](const HttpConnectionManager& hcm) {
+        StrAppend(result, "http_connection_manager=");
+        StrAppend(result, hcm.ToString());
       },
-      [](const TcpListener& tcp) {
-        return absl::StrCat("{tcp_listener=", tcp.ToString(), "}");
+      [&](const TcpListener& tcp) {
+        StrAppend(result, "tcp_listener=");
+        StrAppend(result, tcp.ToString());
       });
+  StrAppend(result, "}");
+  return result;
 }
 
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_listener_parser.cc

@@ -44,6 +44,7 @@
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/host_port.h"
 #include "src/core/util/match.h"
+#include "src/core/util/string.h"
 #include "src/core/util/upb_utils.h"
 #include "src/core/util/validation_errors.h"
 #include "src/core/xds/grpc/xds_common_types.h"
@@ -55,8 +56,6 @@
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
-#include "absl/strings/str_format.h"
-#include "absl/strings/str_join.h"
 
 namespace grpc_core {
 
@@ -82,53 +81,92 @@ struct FilterChain {
 };
 
 std::string FilterChain::FilterChainMatch::ToString() const {
-  std::vector<std::string> contents;
+  std::string result = "{";
+  bool is_first = true;
   if (destination_port != 0) {
-    contents.push_back(absl::StrCat("destination_port=", destination_port));
+    StrAppend(result, "destination_port=");
+    StrAppend(result, std::to_string(destination_port));
+    is_first = false;
   }
   if (!prefix_ranges.empty()) {
-    std::vector<std::string> prefix_ranges_content;
-    prefix_ranges_content.reserve(prefix_ranges.size());
+    if (!is_first) StrAppend(result, ", ");
+    StrAppend(result, "prefix_ranges={");
+    bool first_range = true;
     for (const auto& range : prefix_ranges) {
-      prefix_ranges_content.push_back(range.ToString());
+      if (!first_range) StrAppend(result, ", ");
+      StrAppend(result, range.ToString());
+      first_range = false;
     }
-    contents.push_back(absl::StrCat(
-        "prefix_ranges={", absl::StrJoin(prefix_ranges_content, ", "), "}"));
+    StrAppend(result, "}");
+    is_first = false;
   }
   if (source_type == XdsListenerResource::FilterChainMap::ConnectionSourceType::
                          kSameIpOrLoopback) {
-    contents.push_back("source_type=SAME_IP_OR_LOOPBACK");
+    if (!is_first) StrAppend(result, ", ");
+    StrAppend(result, "source_type=SAME_IP_OR_LOOPBACK");
+    is_first = false;
   } else if (source_type == XdsListenerResource::FilterChainMap::
                                 ConnectionSourceType::kExternal) {
-    contents.push_back("source_type=EXTERNAL");
+    if (!is_first) StrAppend(result, ", ");
+    StrAppend(result, "source_type=EXTERNAL");
+    is_first = false;
   }
   if (!source_prefix_ranges.empty()) {
-    std::vector<std::string> source_prefix_ranges_content;
-    source_prefix_ranges_content.reserve(source_prefix_ranges.size());
+    if (!is_first) StrAppend(result, ", ");
+    StrAppend(result, "source_prefix_ranges={");
+    bool first_range = true;
     for (const auto& range : source_prefix_ranges) {
-      source_prefix_ranges_content.push_back(range.ToString());
+      if (!first_range) StrAppend(result, ", ");
+      StrAppend(result, range.ToString());
+      first_range = false;
     }
-    contents.push_back(
-        absl::StrCat("source_prefix_ranges={",
-                     absl::StrJoin(source_prefix_ranges_content, ", "), "}"));
+    StrAppend(result, "}");
+    is_first = false;
   }
   if (!source_ports.empty()) {
-    contents.push_back(
-        absl::StrCat("source_ports={", absl::StrJoin(source_ports, ", "), "}"));
+    if (!is_first) StrAppend(result, ", ");
+    StrAppend(result, "source_ports={");
+    bool first_port = true;
+    for (uint32_t port : source_ports) {
+      if (!first_port) StrAppend(result, ", ");
+      StrAppend(result, std::to_string(port));
+      first_port = false;
+    }
+    StrAppend(result, "}");
+    is_first = false;
   }
   if (!server_names.empty()) {
-    contents.push_back(
-        absl::StrCat("server_names={", absl::StrJoin(server_names, ", "), "}"));
+    if (!is_first) StrAppend(result, ", ");
+    StrAppend(result, "server_names={");
+    bool first_name = true;
+    for (const auto& name : server_names) {
+      if (!first_name) StrAppend(result, ", ");
+      StrAppend(result, name);
+      first_name = false;
+    }
+    StrAppend(result, "}");
+    is_first = false;
   }
   if (!transport_protocol.empty()) {
-    contents.push_back(absl::StrCat("transport_protocol=", transport_protocol));
+    if (!is_first) StrAppend(result, ", ");
+    StrAppend(result, "transport_protocol=");
+    StrAppend(result, transport_protocol);
+    is_first = false;
   }
   if (!application_protocols.empty()) {
-    contents.push_back(absl::StrCat("application_protocols={",
-                                    absl::StrJoin(application_protocols, ", "),
-                                    "}"));
+    if (!is_first) StrAppend(result, ", ");
+    StrAppend(result, "application_protocols={");
+    bool first_protocol = true;
+    for (const auto& protocol : application_protocols) {
+      if (!first_protocol) StrAppend(result, ", ");
+      StrAppend(result, protocol);
+      first_protocol = false;
+    }
+    StrAppend(result, "}");
+    is_first = false;
   }
-  return absl::StrCat("{", absl::StrJoin(contents, ", "), "}");
+  StrAppend(result, "}");
+  return result;
 }
 
 void MaybeLogHttpConnectionManager(