grpc 1.81.1 → 1.83.0

data/src/core/xds/grpc/xds_common_types_parser.cc

@@ -22,9 +22,13 @@
 
 #include <algorithm>
 #include <map>
+#include <optional>
+#include <string>
 #include <utility>
 
+#include "envoy/config/common/mutation_rules/v3/mutation_rules.upb.h"
 #include "envoy/config/core/v3/address.upb.h"
+#include "envoy/config/core/v3/base.upb.h"
 #include "envoy/extensions/transport_sockets/tls/v3/common.upb.h"
 #include "envoy/extensions/transport_sockets/tls/v3/tls.upb.h"
 #include "envoy/type/matcher/v3/regex.upb.h"
@@ -36,10 +40,11 @@
 #include "src/core/lib/address_utils/parse_address.h"
 #include "src/core/lib/surface/validate_metadata.h"
 #include "src/core/util/down_cast.h"
-#include "src/core/util/env.h"
 #include "src/core/util/json/json_reader.h"
 #include "src/core/util/upb_utils.h"
+#include "src/core/util/validation_errors.h"
 #include "src/core/xds/grpc/xds_bootstrap_grpc.h"
+#include "src/core/xds/grpc/xds_common_types.h"
 #include "src/core/xds/xds_client/xds_client.h"
 #include "upb/base/status.hpp"
 #include "upb/json/encode.h"
@@ -48,9 +53,12 @@
 #include "xds/type/v3/typed_struct.upb.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/escaping.h"
+#include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
+#include "absl/strings/string_view.h"
 
 namespace grpc_core {
 
@@ -611,30 +619,36 @@ std::optional<XdsExtension> ExtractXdsExtension(
 }
 
 //
-// ParseXdsGrpcService()
+// ParseXdsHeader()
 //
 
 namespace {
 
-absl::string_view GetHeaderValue(upb_StringView upb_value,
-                                 absl::string_view field_name, bool validate,
-                                 ValidationErrors* errors) {
+std::optional<std::string> GetHeaderValue(upb_StringView upb_value,
+                                          bool is_binary,
+                                          absl::string_view field_name,
+                                          ValidationErrors* errors) {
   absl::string_view value = UpbStringToAbsl(upb_value);
-  if (!value.empty()) {
-    ValidationErrors::ScopedField field(errors, field_name);
-    if (value.size() > 16384) errors->AddError("longer than 16384 bytes");
-    if (validate) {
-      ValidateMetadataResult result =
-          ValidateNonBinaryHeaderValueIsLegal(value);
-      if (result != ValidateMetadataResult::kOk) {
-        errors->AddError(ValidateMetadataResultToString(result));
-      }
+  if (value.empty()) return std::nullopt;
+  ValidationErrors::ScopedField field(errors, field_name);
+  if (value.size() > 16384) errors->AddError("longer than 16384 bytes");
+  if (is_binary) {
+    std::string decoded_value;
+    if (!absl::Base64Unescape(value, &decoded_value)) {
+      errors->AddError("invalid base64");
     }
+    return decoded_value;
   }
-  return value;
+  ValidateMetadataResult result = ValidateNonBinaryHeaderValueIsLegal(value);
+  if (result != ValidateMetadataResult::kOk) {
+    errors->AddError(ValidateMetadataResultToString(result));
+  }
+  return std::string(value);
 }
 
-std::pair<std::string, std::string> ParseHeader(
+}  // namespace
+
+std::pair<std::string, std::string> ParseXdsHeader(
     const envoy_config_core_v3_HeaderValue* header_value,
     ValidationErrors* errors) {
   // key
@@ -653,61 +667,60 @@ std::pair<std::string, std::string> ParseHeader(
       }
     }
   }
-  // value or raw_value
-  absl::string_view value;
-  if (absl::EndsWith(key, "-bin")) {
-    value =
-        GetHeaderValue(envoy_config_core_v3_HeaderValue_raw_value(header_value),
-                       ".raw_value", /*validate=*/false, errors);
-    if (value.empty()) {
-      value =
-          GetHeaderValue(envoy_config_core_v3_HeaderValue_value(header_value),
-                         ".value", /*validate=*/true, errors);
-      if (value.empty()) {
-        errors->AddError("either value or raw_value must be set");
-      }
-    }
-  } else {
-    // Key does not end in "-bin".
+  // Per gRFC A102, when reading HeaderValue protos, we prioritize reading
+  // the raw_value field for both binary and non-binary headers across xDS and
+  // side-streams. If raw_value is unset, we fall back to using the value field
+  // for backward compatibility.
+  bool is_binary = absl::EndsWith(key, "-bin");
+  std::optional<std::string> value =
+      GetHeaderValue(envoy_config_core_v3_HeaderValue_raw_value(header_value),
+                     is_binary, ".raw_value", errors);
+  if (!value.has_value()) {
     value = GetHeaderValue(envoy_config_core_v3_HeaderValue_value(header_value),
-                           ".value", /*validate=*/true, errors);
-    if (value.empty()) {
-      ValidationErrors::ScopedField field(errors, ".value");
-      errors->AddError("field not set");
+                           is_binary, ".value", errors);
+    if (!value.has_value()) {
+      errors->AddError("either value or raw_value must be set");
     }
   }
-  return {std::string(key), std::string(value)};
+  return {std::string(key), value.has_value() ? std::move(*value) : ""};
 }
 
-}  // namespace
+//
+// ParseXdsGrpcService()
+//
 
-XdsGrpcService ParseXdsGrpcService(
+GrpcXdsServerTarget ParseXdsGrpcService(
     const XdsResourceType::DecodeContext& context,
     const envoy_config_core_v3_GrpcService* grpc_service,
     ValidationErrors* errors) {
   if (grpc_service == nullptr) {
     errors->AddError("field not set");
-    return {};
+    return GrpcXdsServerTarget(/*server_uri=*/"",
+                               /*channel_creds_config=*/nullptr,
+                               /*call_creds_configs=*/{});
   }
-  XdsGrpcService xds_grpc_service;
   // timeout
-  if (auto* timeout = envoy_config_core_v3_GrpcService_timeout(grpc_service);
-      timeout != nullptr) {
+  Duration timeout = Duration::Zero();
+  if (auto* timeout_proto =
+          envoy_config_core_v3_GrpcService_timeout(grpc_service);
+      timeout_proto != nullptr) {
     ValidationErrors::ScopedField field(errors, ".timeout");
-    xds_grpc_service.timeout = ParseDuration(timeout, errors);
-    if (xds_grpc_service.timeout <= Duration::Zero()) {
+    timeout = ParseDuration(timeout_proto, errors);
+    if (timeout <= Duration::Zero()) {
       errors->AddError("duration must be positive");
     }
   }
   // initial_metadata
+  std::vector<std::pair<std::string, std::string>> initial_metadata;
   size_t initial_metadata_size;
-  auto* initial_metadata = envoy_config_core_v3_GrpcService_initial_metadata(
-      grpc_service, &initial_metadata_size);
+  auto* initial_metadata_proto =
+      envoy_config_core_v3_GrpcService_initial_metadata(grpc_service,
+                                                        &initial_metadata_size);
   for (size_t i = 0; i < initial_metadata_size; ++i) {
     ValidationErrors::ScopedField field(
         errors, absl::StrCat(".initial_metadata[", i, "]"));
-    xds_grpc_service.initial_metadata.push_back(
-        ParseHeader(initial_metadata[i], errors));
+    initial_metadata.push_back(
+        ParseXdsHeader(initial_metadata_proto[i], errors));
   }
   // google_grpc
   ValidationErrors::ScopedField field(errors, ".google_grpc");
@@ -715,103 +728,103 @@ XdsGrpcService ParseXdsGrpcService(
       envoy_config_core_v3_GrpcService_google_grpc(grpc_service);
   if (google_grpc == nullptr) {
     errors->AddError("field not set");
-  } else {
-    // target_uri
-    std::string target_uri = UpbStringToStdString(
-        envoy_config_core_v3_GrpcService_GoogleGrpc_target_uri(google_grpc));
-    if (!CoreConfiguration::Get().resolver_registry().IsValidTarget(
-            target_uri)) {
-      ValidationErrors::ScopedField field(errors, ".target_uri");
-      errors->AddError("invalid target URI");
-    }
-    // credentials
-    RefCountedPtr<const ChannelCredsConfig> channel_creds_config;
-    std::vector<RefCountedPtr<const CallCredsConfig>> call_creds_configs;
-    if (DownCast<const GrpcXdsServer&>(context.server).TrustedXdsServer()) {
-      // Trusted xDS server.  Use credentials from the GoogleGrpc proto.
-      // First, look at channel creds.
-      {
-        ValidationErrors::ScopedField field(errors,
-                                            ".channel_credentials_plugin");
-        size_t size;
-        const auto* const* channel_creds_plugin =
-            envoy_config_core_v3_GrpcService_GoogleGrpc_channel_credentials_plugin(
-                google_grpc, &size);
-        if (size == 0) {
-          errors->AddError("field not set");
-        } else {
-          const auto& registry =
-              CoreConfiguration::Get().channel_creds_registry();
-          const auto& certificate_providers =
-              DownCast<const GrpcXdsBootstrap&>(context.client->bootstrap())
-                  .certificate_providers();
-          for (size_t i = 0; i < size; ++i) {
-            ValidationErrors::ScopedField field(errors,
-                                                absl::StrCat("[", i, "]"));
-            absl::string_view type = UpbStringToAbsl(
-                google_protobuf_Any_type_url(channel_creds_plugin[i]));
-            if (!StripTypePrefix(type, errors)) continue;
-            if (!registry.IsProtoSupported(type)) continue;
-            ValidationErrors::ScopedField field2(errors, ".value");
-            absl::string_view serialized_config = UpbStringToAbsl(
-                google_protobuf_Any_value(channel_creds_plugin[i]));
-            channel_creds_config = registry.ParseProto(
-                type, serialized_config, certificate_providers, errors);
-            break;
-          }
-          if (channel_creds_config == nullptr) {
-            errors->AddError("no supported channel credentials type found");
-          }
-        }
-      }
-      // Now look at call creds.
-      {
-        ValidationErrors::ScopedField field(errors, ".call_credentials_plugin");
-        size_t size;
-        const auto* const* call_creds_plugin =
-            envoy_config_core_v3_GrpcService_GoogleGrpc_call_credentials_plugin(
-                google_grpc, &size);
-        const auto& registry = CoreConfiguration::Get().call_creds_registry();
+    return GrpcXdsServerTarget(/*server_uri=*/"",
+                               /*channel_creds_config=*/nullptr,
+                               /*call_creds_configs=*/{});
+  }
+  // target_uri
+  std::string target_uri = UpbStringToStdString(
+      envoy_config_core_v3_GrpcService_GoogleGrpc_target_uri(google_grpc));
+  if (!CoreConfiguration::Get().resolver_registry().IsValidTarget(target_uri)) {
+    ValidationErrors::ScopedField field(errors, ".target_uri");
+    errors->AddError("invalid target URI");
+  }
+  // credentials
+  RefCountedPtr<const ChannelCredsConfig> channel_creds_config;
+  std::vector<RefCountedPtr<const CallCredsConfig>> call_creds_configs;
+  if (DownCast<const GrpcXdsServer&>(context.server).TrustedXdsServer()) {
+    // Trusted xDS server.  Use credentials from the GoogleGrpc proto.
+    // First, look at channel creds.
+    {
+      ValidationErrors::ScopedField field(errors,
+                                          ".channel_credentials_plugin");
+      size_t size;
+      const auto* const* channel_creds_plugin =
+          envoy_config_core_v3_GrpcService_GoogleGrpc_channel_credentials_plugin(
+              google_grpc, &size);
+      if (size == 0) {
+        errors->AddError("field not set");
+      } else {
+        const auto& registry =
+            CoreConfiguration::Get().channel_creds_registry();
+        const auto& certificate_providers =
+            DownCast<const GrpcXdsBootstrap&>(context.client->bootstrap())
+                .certificate_providers();
         for (size_t i = 0; i < size; ++i) {
           ValidationErrors::ScopedField field(errors,
                                               absl::StrCat("[", i, "]"));
           absl::string_view type = UpbStringToAbsl(
-              google_protobuf_Any_type_url(call_creds_plugin[i]));
+              google_protobuf_Any_type_url(channel_creds_plugin[i]));
           if (!StripTypePrefix(type, errors)) continue;
           if (!registry.IsProtoSupported(type)) continue;
           ValidationErrors::ScopedField field2(errors, ".value");
-          absl::string_view serialized_config =
-              UpbStringToAbsl(google_protobuf_Any_value(call_creds_plugin[i]));
-          call_creds_configs.push_back(
-              registry.ParseProto(type, serialized_config, errors));
+          absl::string_view serialized_config = UpbStringToAbsl(
+              google_protobuf_Any_value(channel_creds_plugin[i]));
+          channel_creds_config = registry.ParseProto(
+              type, serialized_config, certificate_providers, errors);
+          break;
+        }
+        if (channel_creds_config == nullptr) {
+          errors->AddError("no supported channel credentials type found");
         }
       }
-    } else {
-      // Not a trusted xDS server.  Do lookup in bootstrap.
-      const auto& bootstrap =
-          DownCast<const GrpcXdsBootstrap&>(context.client->bootstrap());
-      auto& allowed_grpc_services = bootstrap.allowed_grpc_services();
-      auto it = allowed_grpc_services.find(target_uri);
-      if (it == allowed_grpc_services.end()) {
-        ValidationErrors::ScopedField field(errors, ".target_uri");
-        errors->AddError(
-            "service not present in \"allowed_grpc_services\" "
-            "in bootstrap config");
-      } else {
-        channel_creds_config = it->second.channel_creds_config;
-        call_creds_configs = it->second.call_creds_configs;
+    }
+    // Now look at call creds.
+    {
+      ValidationErrors::ScopedField field(errors, ".call_credentials_plugin");
+      size_t size;
+      const auto* const* call_creds_plugin =
+          envoy_config_core_v3_GrpcService_GoogleGrpc_call_credentials_plugin(
+              google_grpc, &size);
+      const auto& registry = CoreConfiguration::Get().call_creds_registry();
+      for (size_t i = 0; i < size; ++i) {
+        ValidationErrors::ScopedField field(errors, absl::StrCat("[", i, "]"));
+        absl::string_view type =
+            UpbStringToAbsl(google_protobuf_Any_type_url(call_creds_plugin[i]));
+        if (!StripTypePrefix(type, errors)) continue;
+        if (!registry.IsProtoSupported(type)) continue;
+        ValidationErrors::ScopedField field2(errors, ".value");
+        absl::string_view serialized_config =
+            UpbStringToAbsl(google_protobuf_Any_value(call_creds_plugin[i]));
+        call_creds_configs.push_back(
+            registry.ParseProto(type, serialized_config, errors));
       }
     }
-    xds_grpc_service.server_target = std::make_unique<GrpcXdsServerTarget>(
-        target_uri, std::move(channel_creds_config),
-        std::move(call_creds_configs));
+  } else {
+    // Not a trusted xDS server.  Do lookup in bootstrap.
+    const auto& bootstrap =
+        DownCast<const GrpcXdsBootstrap&>(context.client->bootstrap());
+    auto& allowed_grpc_services = bootstrap.allowed_grpc_services();
+    auto it = allowed_grpc_services.find(target_uri);
+    if (it == allowed_grpc_services.end()) {
+      ValidationErrors::ScopedField field(errors, ".target_uri");
+      errors->AddError(
+          "service not present in \"allowed_grpc_services\" "
+          "in bootstrap config");
+    } else {
+      channel_creds_config = it->second.channel_creds_config;
+      call_creds_configs = it->second.call_creds_configs;
+    }
   }
-  return xds_grpc_service;
+  return GrpcXdsServerTarget(target_uri, std::move(channel_creds_config),
+                             std::move(call_creds_configs),
+                             std::move(initial_metadata), timeout);
 }
 
 //
 // ParseHeaderMutationRules()
 //
+
 namespace {
 
 std::unique_ptr<RE2> ParseRegexMatcher(
@@ -839,13 +852,15 @@ HeaderMutationRules ParseHeaderMutationRules(
     return {};
   }
   HeaderMutationRules header_mutation_rules_config;
-  header_mutation_rules_config.disallow_all =
+  header_mutation_rules_config.disallow_all = ParseBoolValue(
       envoy_config_common_mutation_rules_v3_HeaderMutationRules_disallow_all(
-          header_mutation_rules);
-  header_mutation_rules_config.disallow_is_error =
+          header_mutation_rules));
+  const google_protobuf_BoolValue* disallow_is_error_proto =
       envoy_config_common_mutation_rules_v3_HeaderMutationRules_disallow_is_error(
           header_mutation_rules);
-  const auto* disallow_expression_proto =
+  header_mutation_rules_config.disallow_is_error =
+      ParseBoolValue(disallow_is_error_proto);
+  const envoy_type_matcher_v3_RegexMatcher* disallow_expression_proto =
       envoy_config_common_mutation_rules_v3_HeaderMutationRules_disallow_expression(
           header_mutation_rules);
   if (disallow_expression_proto != nullptr) {
@@ -854,7 +869,7 @@ HeaderMutationRules ParseHeaderMutationRules(
     header_mutation_rules_config.disallow_expression =
         ParseRegexMatcher(disallow_expression_proto, errors);
   }
-  const auto* allow_expression_proto =
+  const envoy_type_matcher_v3_RegexMatcher* allow_expression_proto =
       envoy_config_common_mutation_rules_v3_HeaderMutationRules_allow_expression(
           header_mutation_rules);
   if (allow_expression_proto != nullptr) {
@@ -866,4 +881,60 @@ HeaderMutationRules ParseHeaderMutationRules(
   return header_mutation_rules_config;
 }
 
+//
+// ParseXdsHeaderValueOption()
+//
+
+namespace {
+
+XdsHeaderValueOption::AppendAction ParseXdsHeaderValueOptionAppendAction(
+    int32_t header_value_option_append_action, ValidationErrors* errors) {
+  switch (header_value_option_append_action) {
+    case envoy_config_core_v3_HeaderValueOption_APPEND_IF_EXISTS_OR_ADD:
+      return XdsHeaderValueOption::AppendAction::kAppendIfExistsOrAdd;
+    case envoy_config_core_v3_HeaderValueOption_ADD_IF_ABSENT:
+      return XdsHeaderValueOption::AppendAction::kAddIfAbsent;
+    case envoy_config_core_v3_HeaderValueOption_OVERWRITE_IF_EXISTS_OR_ADD:
+      return XdsHeaderValueOption::AppendAction::kOverwriteIfExistsOrAdd;
+    case envoy_config_core_v3_HeaderValueOption_OVERWRITE_IF_EXISTS:
+      return XdsHeaderValueOption::AppendAction::kOverwriteIfExists;
+    default:
+      errors->AddError("unsupported append action");
+      return XdsHeaderValueOption::AppendAction::kAppendIfExistsOrAdd;
+  }
+}
+
+}  // namespace
+
+XdsHeaderValueOption ParseXdsHeaderValueOption(
+    const envoy_config_core_v3_HeaderValueOption* header_value_option_config,
+    ValidationErrors* errors) {
+  if (header_value_option_config == nullptr) {
+    errors->AddError("field is not present");
+    return {};
+  }
+  XdsHeaderValueOption header_value_option;
+  // parse header
+  {
+    ValidationErrors::ScopedField field(errors, ".header");
+    if (const auto* header = envoy_config_core_v3_HeaderValueOption_header(
+            header_value_option_config);
+        header != nullptr) {
+      header_value_option.header = ParseXdsHeader(header, errors);
+    } else {
+      errors->AddError("field not set");
+    }
+  }
+  // parse header_append_action
+  {
+    ValidationErrors::ScopedField field(errors, ".append_action");
+    int32_t header_append_action =
+        envoy_config_core_v3_HeaderValueOption_append_action(
+            header_value_option_config);
+    header_value_option.append_action =
+        ParseXdsHeaderValueOptionAppendAction(header_append_action, errors);
+  }
+  return header_value_option;
+}
+
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_common_types_parser.h

@@ -17,6 +17,7 @@
 #ifndef GRPC_SRC_CORE_XDS_GRPC_XDS_COMMON_TYPES_PARSER_H
 #define GRPC_SRC_CORE_XDS_GRPC_XDS_COMMON_TYPES_PARSER_H
 
+#include <cstdint>
 #include <optional>
 
 #include "envoy/config/common/mutation_rules/v3/mutation_rules.upb.h"
@@ -34,6 +35,7 @@
 #include "src/core/util/time.h"
 #include "src/core/util/validation_errors.h"
 #include "src/core/xds/grpc/xds_common_types.h"
+#include "src/core/xds/grpc/xds_server_grpc.h"
 #include "src/core/xds/xds_client/xds_resource_type.h"
 #include "xds/type/matcher/v3/string.upb.h"
 
@@ -90,7 +92,7 @@ std::optional<XdsExtension> ExtractXdsExtension(
     const XdsResourceType::DecodeContext& context,
     const google_protobuf_Any* any, ValidationErrors* errors);
 
-XdsGrpcService ParseXdsGrpcService(
+GrpcXdsServerTarget ParseXdsGrpcService(
     const XdsResourceType::DecodeContext& context,
     const envoy_config_core_v3_GrpcService* grpc_service,
     ValidationErrors* errors);
@@ -100,6 +102,21 @@ HeaderMutationRules ParseHeaderMutationRules(
         header_mutation_rules,
     ValidationErrors* errors);
 
+XdsHeaderValueOption ParseXdsHeaderValueOption(
+    const envoy_config_core_v3_HeaderValueOption* header_value_option_config,
+    ValidationErrors* errors);
+
+// TODO(roth): We would ideally like to use a Slice for the header value, but
+// Slice isn't copyable, which makes it problematic to store here. The down-side
+// of this approach is that we need to make a copy when we apply the header
+// value to each RPC rather than just taking a new ref to the slice. Consider
+// solving this problem by adding a new RefCountedSlice class to represent an
+// immutable, ref-counted slice that can be turned into a Slice and thus added
+// to RPC metadata without a copy.
+std::pair<std::string, std::string> ParseXdsHeader(
+    const envoy_config_core_v3_HeaderValue* header_value,
+    ValidationErrors* errors);
+
 }  // namespace grpc_core
 
 #endif  // GRPC_SRC_CORE_XDS_GRPC_XDS_COMMON_TYPES_PARSER_H

data/src/core/xds/grpc/xds_endpoint_parser.cc

@@ -34,6 +34,7 @@
 #include "envoy/config/endpoint/v3/endpoint_components.upb.h"
 #include "envoy/type/v3/percent.upb.h"
 #include "google/protobuf/wrappers.upb.h"
+#include "src/core/config/experiment_env_var.h"
 #include "src/core/lib/address_utils/parse_address.h"
 #include "src/core/lib/address_utils/sockaddr_utils.h"
 #include "src/core/lib/channel/channel_args.h"
@@ -41,11 +42,9 @@
 #include "src/core/lib/iomgr/resolved_address.h"
 #include "src/core/load_balancing/ring_hash/ring_hash.h"
 #include "src/core/util/down_cast.h"
-#include "src/core/util/env.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/json/json_args.h"
 #include "src/core/util/json/json_object_loader.h"
-#include "src/core/util/string.h"
 #include "src/core/util/upb_utils.h"
 #include "src/core/util/validation_errors.h"
 #include "src/core/xds/grpc/xds_cluster_parser.h"
@@ -66,23 +65,11 @@ namespace grpc_core {
 
 namespace {
 
-// TODO(roth): Remove this after 1.67 is released.
-bool XdsDualstackEndpointsEnabled() {
-  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_DUALSTACK_ENDPOINTS");
-  if (!value.has_value()) return true;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
-}
-
 // TODO(roth): Flip the default to false once this proves stable, then
 // remove it entirely at some point in the future.
 bool XdsEndpointHashKeyBackwardCompatEnabled() {
-  auto value = GetEnv("GRPC_XDS_ENDPOINT_HASH_KEY_BACKWARD_COMPAT");
-  if (!value.has_value()) return true;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
+  return IsExperimentEnvVarEnabled("GRPC_XDS_ENDPOINT_HASH_KEY_BACKWARD_COMPAT",
+                                   /*default_value=*/true);
 }
 
 void MaybeLogClusterLoadAssignment(
@@ -170,7 +157,9 @@ std::optional<EndpointAddresses> EndpointAddressesParse(
           envoy_config_endpoint_v3_Endpoint_address(endpoint), errors);
       if (address.has_value()) addresses.push_back(*address);
     }
-    if (XdsDualstackEndpointsEnabled()) {
+    // TODO(roth): Remove this after 1.67 is released.
+    if (IsExperimentEnvVarEnabled("GRPC_EXPERIMENTAL_XDS_DUALSTACK_ENDPOINTS",
+                                  /*default_value=*/true)) {
       size_t size;
       auto* additional_addresses =
           envoy_config_endpoint_v3_Endpoint_additional_addresses(endpoint,
@@ -367,7 +356,7 @@ absl::StatusOr<std::shared_ptr<const XdsEndpointResource>> EdsResourceParse(
           LocalityParse(context, endpoints[i], &address_set, &errors);
       if (parsed_locality.has_value()) {
         GRPC_CHECK_NE(parsed_locality->locality.lb_weight, 0u);
-        // Make sure prorities is big enough. Note that they might not
+        // Make sure priorities is big enough. Note that they might not
         // arrive in priority order.
         if (eds_resource->priorities.size() < parsed_locality->priority + 1) {
           eds_resource->priorities.resize(parsed_locality->priority + 1);

data/src/core/xds/grpc/xds_http_composite_filter.cc

@@ -279,24 +279,40 @@ RefCountedPtr<const FilterConfig> XdsHttpCompositeFilter::ParseOverrideConfig(
   return config;
 }
 
-void XdsHttpCompositeFilter::UpdateBlackboard(
-    const FilterConfig& config, const Blackboard* old_blackboard,
-    Blackboard* new_blackboard) const {
-  auto& composite_config = DownCast<const CompositeFilter::Config&>(config);
-  if (composite_config.matcher == nullptr) return;
-  composite_config.matcher->ForEachAction(
-      [&](const XdsMatcher::Action& action) {
-        if (action.type() != CompositeFilter::ExecuteFilterAction::Type()) {
-          return;
-        }
-        const auto& execute_filter_action =
-            DownCast<const CompositeFilter::ExecuteFilterAction&>(action);
-        for (const auto& [filter_impl, filter_config] :
-             execute_filter_action.filter_chain()) {
-          filter_impl->UpdateBlackboard(*filter_config, old_blackboard,
-                                        new_blackboard);
-        }
-      });
+RefCountedPtr<const FilterConfig> XdsHttpCompositeFilter::MergeConfigs(
+    RefCountedPtr<const FilterConfig> top_level_config,
+    RefCountedPtr<const FilterConfig> virtual_host_override_config,
+    RefCountedPtr<const FilterConfig> route_override_config,
+    RefCountedPtr<const FilterConfig> cluster_weight_override_config,
+    Blackboard& blackboard) const {
+  // Get the config to use via our base class.
+  auto config_to_use = XdsHttpFilterImpl::MergeConfigs(
+      std::move(top_level_config), std::move(virtual_host_override_config),
+      std::move(route_override_config),
+      std::move(cluster_weight_override_config), blackboard);
+  auto& composite_config =
+      DownCast<const CompositeFilter::Config&>(*config_to_use);
+  if (composite_config.matcher == nullptr) return config_to_use;
+  // Make a copy of the config and populate its merged_config_map.
+  auto new_config = MakeRefCounted<CompositeFilter::Config>();
+  new_config->matcher = composite_config.matcher;
+  new_config->matcher->ForEachAction([&](const XdsMatcher::Action& action) {
+    if (action.type() != CompositeFilter::ExecuteFilterAction::Type()) {
+      return;
+    }
+    const auto& execute_filter_action =
+        DownCast<const CompositeFilter::ExecuteFilterAction&>(action);
+    auto& merged_configs = new_config->merged_config_map[&action];
+    GRPC_CHECK(merged_configs.empty());
+    for (const auto& [filter_impl, filter_config] :
+         execute_filter_action.filter_chain()) {
+      merged_configs.push_back(filter_impl->MergeConfigs(
+          filter_config, /*virtual_host_override_config=*/nullptr,
+          /*route_override_config=*/nullptr,
+          /*cluster_weight_override_config=*/nullptr, blackboard));
+    }
+  });
+  return new_config;
 }
 
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_http_composite_filter.h

@@ -72,9 +72,12 @@ class XdsHttpCompositeFilter final : public XdsHttpFilterImpl {
       absl::string_view instance_name,
       const XdsResourceType::DecodeContext& context,
       const XdsExtension& extension, ValidationErrors* errors) const override;
-  void UpdateBlackboard(const FilterConfig& config,
-                        const Blackboard* old_blackboard,
-                        Blackboard* new_blackboard) const override;
+  RefCountedPtr<const FilterConfig> MergeConfigs(
+      RefCountedPtr<const FilterConfig> top_level_config,
+      RefCountedPtr<const FilterConfig> virtual_host_override_config,
+      RefCountedPtr<const FilterConfig> route_override_config,
+      RefCountedPtr<const FilterConfig> cluster_weight_override_config,
+      Blackboard& blackboard) const override;
   bool IsSupportedOnClients() const override { return true; }
   bool IsSupportedOnServers() const override { return false; }
 };