grpc 1.81.1 → 1.83.0

data/src/core/credentials/transport/tls/grpc_tls_certificate_selector.cc

@@ -0,0 +1,172 @@
+//
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
+
+#include <openssl/bio.h>
+#include <openssl/crypto.h>
+#include <openssl/pem.h>
+#if defined(OPENSSL_IS_BORINGSSL)
+#include <openssl/bytestring.h>
+#endif
+
+#include <cstdint>
+#include <memory>
+#include <vector>
+
+#include "src/core/util/grpc_check.h"
+#include "src/core/util/match.h"
+#include "src/core/util/status_helper.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
+#if defined(OPENSSL_IS_BORINGSSL)
+
+namespace grpc_core {
+namespace {
+
+// TODO(lwge): Consider moving these into a util library.
+absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>>
+ParseCertificateChainFromDer(const std::vector<std::string>& der_cert_chain) {
+  if (der_cert_chain.empty()) {
+    return absl::InvalidArgumentError("The cert chain is empty.");
+  }
+  std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> raw_cert_chain;
+  raw_cert_chain.reserve(der_cert_chain.size());
+  for (absl::string_view cert : der_cert_chain) {
+    bssl::UniquePtr<CRYPTO_BUFFER> raw_cert(CRYPTO_BUFFER_new(
+        reinterpret_cast<const uint8_t*>(cert.data()), cert.size(),
+        /*pool=*/nullptr));
+    if (raw_cert == nullptr) {
+      return absl::InvalidArgumentError("Failed to create raw cert.");
+    }
+    raw_cert_chain.push_back(std::move(raw_cert));
+  }
+  return std::move(raw_cert_chain);
+}
+
+absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>>
+ParseCertificateChainFromPem(absl::string_view pem_cert_chain) {
+  if (pem_cert_chain.empty()) {
+    return absl::InvalidArgumentError("The cert chain is empty.");
+  }
+  std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> raw_cert_chain;
+  bssl::UniquePtr<BIO> bio(
+      BIO_new_mem_buf(pem_cert_chain.data(), pem_cert_chain.size()));
+  uint8_t* cert_data = nullptr;
+  long cert_len;
+  while (PEM_bytes_read_bio(&cert_data, &cert_len, nullptr, PEM_STRING_X509,
+                            bio.get(), nullptr, nullptr)) {
+    raw_cert_chain.push_back(bssl::UniquePtr<CRYPTO_BUFFER>(
+        CRYPTO_BUFFER_new(reinterpret_cast<const uint8_t*>(cert_data), cert_len,
+                          /*pool=*/nullptr)));
+    OPENSSL_free(cert_data);
+  }
+  if (raw_cert_chain.empty()) {
+    return absl::InvalidArgumentError("Failed to parse cert chain.");
+  }
+  return std::move(raw_cert_chain);
+}
+
+absl::StatusOr<bssl::UniquePtr<EVP_PKEY>> ParsePrivateKeyFromDer(
+    absl::string_view der_private_key) {
+  CBS cbs;
+  CBS_init(&cbs, reinterpret_cast<const uint8_t*>(der_private_key.data()),
+           der_private_key.size());
+  bssl::UniquePtr<EVP_PKEY> pkey(EVP_parse_private_key(&cbs));
+  if (pkey == nullptr || CBS_len(&cbs) != 0) {
+    return absl::InvalidArgumentError("Failed to parse private key.");
+  }
+  return std::move(pkey);
+}
+
+absl::StatusOr<bssl::UniquePtr<EVP_PKEY>> ParsePrivateKeyFromPem(
+    absl::string_view pem_private_key) {
+  GRPC_CHECK_LE(pem_private_key.size(), static_cast<size_t>(INT_MAX));
+  bssl::UniquePtr<BIO> pem(BIO_new_mem_buf(
+      pem_private_key.data(), static_cast<int>(pem_private_key.size())));
+  if (pem == nullptr) {
+    return absl::InvalidArgumentError("Failed to create pem BIO.");
+  }
+  bssl::UniquePtr<EVP_PKEY> pkey(PEM_read_bio_PrivateKey(
+      pem.get(), nullptr, nullptr, const_cast<char*>("")));
+  if (pkey == nullptr) {
+    return absl::InvalidArgumentError("Failed to read private key.");
+  }
+  return std::move(pkey);
+}
+
+// The type of the given private key string must match the parser.
+absl::Status CreatePrivateKey(
+    std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+        private_key,
+    CertificateSelector::SelectCertificateResult& result,
+    absl::AnyInvocable<
+        absl::StatusOr<bssl::UniquePtr<EVP_PKEY>>(absl::string_view)>
+        parser) {
+  return MatchMutable(
+      &private_key,
+      [&](absl::string_view* key) {
+        absl::StatusOr<bssl::UniquePtr<EVP_PKEY>> pkey = parser(*key);
+        if (!pkey.ok()) {
+          return pkey.status();
+        }
+        result.private_key = *std::move(pkey);
+        return absl::OkStatus();
+      },
+      [&](std::shared_ptr<PrivateKeySigner>* key_signer) {
+        result.private_key = std::move(*key_signer);
+        return absl::OkStatus();
+      });
+}
+
+}  // namespace
+
+absl::StatusOr<CertificateSelector::SelectCertificateResult>
+CertificateSelector::CreateSelectCertificateResult(
+    const std::vector<std::string>& der_cert_chain,
+    std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+        der_private_key) {
+  absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>> raw_cert_chain =
+      ParseCertificateChainFromDer(der_cert_chain);
+  GRPC_RETURN_IF_ERROR(raw_cert_chain.status());
+  SelectCertificateResult result;
+  result.certificate_chain = *std::move(raw_cert_chain);
+  GRPC_RETURN_IF_ERROR(
+      CreatePrivateKey(der_private_key, result, ParsePrivateKeyFromDer));
+  return std::move(result);
+}
+
+absl::StatusOr<CertificateSelector::SelectCertificateResult>
+CertificateSelector::CreateSelectCertificateResult(
+    absl::string_view pem_cert_chain,
+    std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+        pem_private_key) {
+  absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>> raw_cert_chain =
+      ParseCertificateChainFromPem(pem_cert_chain);
+  GRPC_RETURN_IF_ERROR(raw_cert_chain.status());
+  SelectCertificateResult result;
+  result.certificate_chain = *std::move(raw_cert_chain);
+  GRPC_RETURN_IF_ERROR(
+      CreatePrivateKey(pem_private_key, result, ParsePrivateKeyFromPem));
+  return std::move(result);
+}
+
+}  // namespace grpc_core
+
+#endif  // OPENSSL_IS_BORINGSSL

data/src/core/credentials/transport/tls/grpc_tls_certificate_selector.h

@@ -0,0 +1,103 @@
+//
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_GRPC_TLS_CERTIFICATE_SELECTOR_H
+#define GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_GRPC_TLS_CERTIFICATE_SELECTOR_H
+
+#include <grpc/private_key_signer.h>
+#include <openssl/bio.h>
+
+#include <memory>
+#include <string>
+#include <variant>
+#include <vector>
+
+#include "absl/functional/any_invocable.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
+namespace grpc_core {
+
+// Performs server-side certificate selection during the handshake based on the
+// SNI. Users must implement the `SelectCertificate` and `Cancel` methods.
+// The implementation must be thread-safe, as `SelectCertificate` may be called
+// for multiple TLS handshakes at the same time.
+class CertificateSelector {
+#if defined(OPENSSL_IS_BORINGSSL)
+ public:
+  struct SelectCertificateInfo {
+    std::string sni;
+  };
+
+  // TODO(lwge): This should be an opaque struct when moved to a public header.
+  struct SelectCertificateResult {
+    std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> certificate_chain;
+    std::variant<bssl::UniquePtr<EVP_PKEY>, std::shared_ptr<PrivateKeySigner>>
+        private_key;
+  };
+
+  // Returns a SelectCertificateResult given a DER-encoded certificate chain,
+  // and DER-encoded private key string or a signer.
+  static absl::StatusOr<SelectCertificateResult> CreateSelectCertificateResult(
+      const std::vector<std::string>& der_cert_chain,
+      std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+          der_private_key);
+
+  // Returns a SelectCertificateResult given a PEM-encoded certificate chain,
+  // and PEM-encoded private key string or a signer.
+  static absl::StatusOr<SelectCertificateResult> CreateSelectCertificateResult(
+      absl::string_view pem_cert_chain,
+      std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+          pem_private_key);
+
+  // Handle to be passed to `Cancel`, to enable user to clean up any resources
+  // used during an asynchronous certificate selection operation that is
+  // cancelled.
+  class AsyncCertificateSelectionHandle {
+   public:
+    virtual ~AsyncCertificateSelectionHandle() = default;
+  };
+
+  using OnSelectCertificateComplete =
+      absl::AnyInvocable<void(absl::StatusOr<SelectCertificateResult>)>;
+
+  virtual ~CertificateSelector() = default;
+
+  // Performs the cert selection based on `SelectCertificateInfo`.
+  // Since the client is not required to provide the server name in the
+  // ClientHello, the implementation should make a decision by itself on what to
+  // return.
+  // May return either synchronously or asynchronously.
+  // For synchronous returns, directly returns either the selected certificate
+  // or a failed status, and the callback will never be invoked.
+  // For asynchronous implementations, returns a handle for the asynchronous
+  // signing operation. The function argument on_complete must be called by
+  // the implementer when the async certificate selection operation is complete.
+  // on_complete must not be invoked synchronously within SelectCertificate().
+  virtual std::variant<absl::StatusOr<SelectCertificateResult>,
+                       std::shared_ptr<AsyncCertificateSelectionHandle>>
+  SelectCertificate(const SelectCertificateInfo& info,
+                    OnSelectCertificateComplete on_complete) = 0;
+
+  // Cancels the async select cert call corresponding to the handle.
+  virtual void Cancel(std::shared_ptr<AsyncCertificateSelectionHandle>) = 0;
+#endif  // OPENSSL_IS_BORINGSSL
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_GRPC_TLS_CERTIFICATE_SELECTOR_H

data/src/core/credentials/transport/tls/load_system_roots_fallback.cc

@@ -19,7 +19,8 @@
 #include <grpc/support/port_platform.h>
 
 #if !defined(GPR_LINUX) && !defined(GPR_ANDROID) && !defined(GPR_FREEBSD) && \
-    !defined(GPR_APPLE) && !defined(GPR_WINDOWS)
+    !defined(GPR_APPLE) && !defined(GPR_NETBSD) && !defined(GPR_OPENBSD) &&  \
+    !defined(GPR_WINDOWS)
 
 #include <grpc/slice.h>
 #include <grpc/slice_buffer.h>
@@ -33,4 +34,4 @@ grpc_slice LoadSystemRootCerts() { return grpc_empty_slice(); }
 }  // namespace grpc_core
 
 #endif  // !(GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE ||
-        // GPR_WINDOWS)
+        // GPR_NETBSD || GPR_OPENBSD || GPR_WINDOWS)

data/src/core/credentials/transport/tls/load_system_roots_supported.cc

@@ -23,7 +23,7 @@
 #include <vector>
 
 #if defined(GPR_LINUX) || defined(GPR_ANDROID) || defined(GPR_FREEBSD) || \
-    defined(GPR_APPLE)
+    defined(GPR_APPLE) || defined(GPR_NETBSD) || defined(GPR_OPENBSD)
 
 #include <dirent.h>
 #include <fcntl.h>
@@ -59,7 +59,13 @@ const char* kCertDirectories[] = {""};
 #elif defined(GPR_APPLE)    // endif GPR_FREEBSD
 const char* kCertFiles[] = {"/etc/ssl/cert.pem"};
 const char* kCertDirectories[] = {""};
-#endif                      // GPR_APPLE
+#elif defined(GPR_NETBSD)   // endif GPR_APPLE
+const char* kCertFiles[] = {"/etc/openssl/certs/ca-certificates.crt"};
+const char* kCertDirectories[] = {"/etc/openssl/certs"};
+#elif defined(GPR_OPENBSD)  // endif GPR_NETBSD
+const char* kCertFiles[] = {"/etc/ssl/cert.pem"};
+const char* kCertDirectories[] = {""};
+#endif                      // GPR_OPENBSD
 
 grpc_slice GetSystemRootCerts() {
   size_t num_cert_files_ = GPR_ARRAY_SIZE(kCertFiles);
@@ -163,4 +169,5 @@ grpc_slice LoadSystemRootCerts() {
 
 }  // namespace grpc_core
 
-#endif  // GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE
+#endif  // GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE ||
+        // GPR_NETNSD || GPR_OPENBSD

data/src/core/credentials/transport/tls/tls_security_connector.cc

@@ -39,6 +39,7 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/promise/promise.h"
+#include "src/core/telemetry/metrics.h"
 #include "src/core/transport/auth_context.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/util/debug_location.h"
@@ -363,11 +364,17 @@ void TlsChannelSecurityConnector::add_handshakers(
                                    ? target_name_.c_str()
                                    : overridden_target_name_.c_str();
     }
+    auto stats_plugin_group =
+        args.GetObject<GlobalStatsPluginRegistry::StatsPluginGroup>();
+    RefCountedPtr<CollectionScope> collection_scope =
+        stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
+                                      : nullptr;
     tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
         client_handshaker_factory_, server_name_indication,
         /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0,
-        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS), &tsi_hs);
+        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS),
+        std::move(collection_scope), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);
@@ -648,10 +655,15 @@ void TlsServerSecurityConnector::add_handshakers(
   MutexLock lock(&mu_);
   tsi_handshaker* tsi_hs = nullptr;
   if (server_handshaker_factory_ != nullptr) {
+    auto stats_plugin_group =
+        args.GetObject<GlobalStatsPluginRegistry::StatsPluginGroup>();
+    RefCountedPtr<CollectionScope> collection_scope =
+        stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
+                                      : nullptr;
     // Instantiate TSI handshaker.
     tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
         server_handshaker_factory_, /*network_bio_buf_size=*/0,
-        /*ssl_bio_buf_size=*/0, &tsi_hs);
+        /*ssl_bio_buf_size=*/0, std::move(collection_scope), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);

data/src/core/credentials/transport/xds/xds_credentials.cc

@@ -20,17 +20,16 @@
 
 #include <grpc/grpc_security_constants.h>
 #include <grpc/impl/channel_arg_names.h>
-#include <grpc/support/port_platform.h>
 
 #include <optional>
 
+#include "src/core/config/experiment_env_var.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_provider.h"
 #include "src/core/credentials/transport/tls/grpc_tls_credentials_options.h"
 #include "src/core/credentials/transport/tls/tls_credentials.h"
 #include "src/core/credentials/transport/tls/tls_utils.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/load_balancing/xds/xds_channel_args.h"
-#include "src/core/util/env.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/host_port.h"
 #include "src/core/util/useful.h"
@@ -40,15 +39,6 @@ namespace grpc_core {
 
 namespace {
 
-// TODO(mlumish): Remove this after 1.80
-bool UseChannelAuthorityIfNoSNIApplicable() {
-  auto value = GetEnv("GRPC_USE_CHANNEL_AUTHORITY_IF_NO_SNI_APPLICABLE");
-  if (!value.has_value()) return false;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
-}
-
 bool XdsVerifySubjectAlternativeNames(
     const char* const* subject_alternative_names,
     size_t subject_alternative_names_size,
@@ -194,7 +184,9 @@ XdsCredentials::create_security_connector(
         tls_credentials_options->set_sni_override(
             xds_certificate_provider->sni());
       } else {
-        if (!UseChannelAuthorityIfNoSNIApplicable()) {
+        // TODO(mlumish): Remove this after 1.80
+        if (!IsExperimentEnvVarEnabled(
+                "GRPC_USE_CHANNEL_AUTHORITY_IF_NO_SNI_APPLICABLE")) {
           tls_credentials_options->set_sni_override("");
         }
       }

data/src/core/ext/filters/backend_metrics/backend_metric_filter.cc

@@ -45,6 +45,7 @@
 namespace grpc_core {
 
 namespace {
+
 std::optional<std::string> MaybeSerializeBackendMetrics(
     BackendMetricProvider* provider) {
   if (provider == nullptr) return std::nullopt;
@@ -103,8 +104,13 @@ std::optional<std::string> MaybeSerializeBackendMetrics(
   size_t len;
   char* buf =
       xds_data_orca_v3_OrcaLoadReport_serialize(response, arena.ptr(), &len);
+  if (buf == nullptr) {
+    LOG_EVERY_N_SEC(ERROR, 10) << "Failed to serialize ORCA load report";
+    return std::nullopt;
+  }
   return std::string(buf, len);
 }
+
 }  // namespace
 
 const grpc_channel_filter BackendMetricFilter::kFilter =

data/src/core/ext/filters/fault_injection/fault_injection_filter.cc

@@ -17,7 +17,6 @@
 #include "src/core/ext/filters/fault_injection/fault_injection_filter.h"
 
 #include <grpc/status.h>
-#include <grpc/support/port_platform.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ -31,15 +30,12 @@
 #include "src/core/call/metadata_batch.h"
 #include "src/core/call/status_util.h"
 #include "src/core/config/core_configuration.h"
-#include "src/core/ext/filters/fault_injection/fault_injection_service_config_parser.h"
 #include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/debug/trace.h"
-#include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/promise/sleep.h"
 #include "src/core/lib/promise/try_seq.h"
 #include "src/core/lib/transport/transport.h"
-#include "src/core/service_config/service_config_call_data.h"
 #include "src/core/util/time.h"
 #include "absl/log/log.h"
 #include "absl/meta/type_traits.h"
@@ -186,24 +182,19 @@ class FaultInjectionFilter::InjectionDecision {
 absl::StatusOr<std::unique_ptr<FaultInjectionFilter>>
 FaultInjectionFilter::Create(const ChannelArgs&,
                              ChannelFilter::Args filter_args) {
-  if (IsXdsChannelFilterChainPerRouteEnabled()) {
-    if (filter_args.config() == nullptr) {
-      return absl::InternalError("no config passed to fault injection filter");
-    }
-    if (filter_args.config()->type() != Config::Type()) {
-      return absl::InternalError(
-          absl::StrCat("wrong config type passed to fault injection filter: ",
-                       filter_args.config()->type().name()));
-    }
+  if (filter_args.config() == nullptr) {
+    return absl::InternalError("no config passed to fault injection filter");
+  }
+  if (filter_args.config()->type() != Config::Type()) {
+    return absl::InternalError(
+        absl::StrCat("wrong config type passed to fault injection filter: ",
+                     filter_args.config()->type().name()));
   }
   return std::make_unique<FaultInjectionFilter>(filter_args);
 }
 
 FaultInjectionFilter::FaultInjectionFilter(ChannelFilter::Args filter_args)
-    : index_(filter_args.instance_id()),
-      service_config_parser_index_(
-          FaultInjectionServiceConfigParser::ParserIndex()),
-      config_(filter_args.config().TakeAsSubclass<const Config>()) {}
+    : config_(filter_args.config().TakeAsSubclass<const Config>()) {}
 
 // Construct a promise for one call.
 ArenaPromise<absl::Status> FaultInjectionFilter::Call::OnClientInitialMetadata(
@@ -221,75 +212,50 @@ ArenaPromise<absl::Status> FaultInjectionFilter::Call::OnClientInitialMetadata(
 FaultInjectionFilter::InjectionDecision
 FaultInjectionFilter::MakeInjectionDecision(
     const ClientMetadata& initial_metadata) {
-  if (!IsXdsChannelFilterChainPerRouteEnabled()) {
-    // Fetch the fault injection policy from the service config, based on the
-    // relative index for which policy should this CallData use.
-    auto* service_config_call_data = GetContext<ServiceConfigCallData>();
-    auto* method_params = static_cast<FaultInjectionMethodParsedConfig*>(
-        service_config_call_data->GetMethodParsedConfig(
-            service_config_parser_index_));
-    const FaultInjectionMethodParsedConfig::FaultInjectionPolicy* fi_policy =
-        nullptr;
-    if (method_params != nullptr) {
-      fi_policy = method_params->fault_injection_policy(index_);
-    }
-    // Shouldn't ever be null, but just in case, return a no-op decision.
-    if (fi_policy == nullptr) {
-      return InjectionDecision(/*max_faults=*/0,
-                               /*delay_time=*/Duration::Zero(),
-                               /*abort_request=*/std::nullopt);
-    }
-    return MakeInjectionDecision(initial_metadata, *fi_policy);
-  }
   // Shouldn't ever be null, but just in case, return a no-op decision.
   if (config_ == nullptr) {
     return InjectionDecision(/*max_faults=*/0, /*delay_time=*/Duration::Zero(),
                              /*abort_request=*/std::nullopt);
   }
-  return MakeInjectionDecision(initial_metadata, *config_);
-}
 
-template <typename T>
-FaultInjectionFilter::InjectionDecision
-FaultInjectionFilter::MakeInjectionDecision(
-    const ClientMetadata& initial_metadata, const T& config) {
-  grpc_status_code abort_code = config.abort_code;
-  uint32_t abort_percentage_numerator = config.abort_percentage_numerator;
-  uint32_t delay_percentage_numerator = config.delay_percentage_numerator;
-  Duration delay = config.delay;
+  grpc_status_code abort_code = config_->abort_code;
+  uint32_t abort_percentage_numerator = config_->abort_percentage_numerator;
+  uint32_t delay_percentage_numerator = config_->delay_percentage_numerator;
+  Duration delay = config_->delay;
 
   // Update the policy with values in initial metadata.
-  if (!config.abort_code_header.empty() ||
-      !config.abort_percentage_header.empty() || !config.delay_header.empty() ||
-      !config.delay_percentage_header.empty()) {
+  if (!config_->abort_code_header.empty() ||
+      !config_->abort_percentage_header.empty() ||
+      !config_->delay_header.empty() ||
+      !config_->delay_percentage_header.empty()) {
     std::string buffer;
-    if (!config.abort_code_header.empty() && abort_code == GRPC_STATUS_OK) {
+    if (!config_->abort_code_header.empty() && abort_code == GRPC_STATUS_OK) {
       auto value =
-          initial_metadata.GetStringValue(config.abort_code_header, &buffer);
+          initial_metadata.GetStringValue(config_->abort_code_header, &buffer);
       if (value.has_value()) {
         grpc_status_code_from_int(
             AsInt<int>(*value).value_or(GRPC_STATUS_UNKNOWN), &abort_code);
       }
     }
-    if (!config.abort_percentage_header.empty()) {
+    if (!config_->abort_percentage_header.empty()) {
       auto value = initial_metadata.GetStringValue(
-          config.abort_percentage_header, &buffer);
+          config_->abort_percentage_header, &buffer);
       if (value.has_value()) {
         abort_percentage_numerator = std::min(
             AsInt<uint32_t>(*value).value_or(-1), abort_percentage_numerator);
       }
     }
-    if (!config.delay_header.empty() && delay == Duration::Zero()) {
+    if (!config_->delay_header.empty() && delay == Duration::Zero()) {
       auto value =
-          initial_metadata.GetStringValue(config.delay_header, &buffer);
+          initial_metadata.GetStringValue(config_->delay_header, &buffer);
       if (value.has_value()) {
         delay = Duration::Milliseconds(
             std::max(AsInt<int64_t>(*value).value_or(0), int64_t{0}));
       }
     }
-    if (!config.delay_percentage_header.empty()) {
+    if (!config_->delay_percentage_header.empty()) {
       auto value = initial_metadata.GetStringValue(
-          config.delay_percentage_header, &buffer);
+          config_->delay_percentage_header, &buffer);
       if (value.has_value()) {
         delay_percentage_numerator = std::min(
             AsInt<uint32_t>(*value).value_or(-1), delay_percentage_numerator);
@@ -304,20 +270,20 @@ FaultInjectionFilter::MakeInjectionDecision(
     if (delay_request) {
       delay_request =
           UnderFraction(&delay_rand_generator_, delay_percentage_numerator,
-                        config.delay_percentage_denominator);
+                        config_->delay_percentage_denominator);
     }
     if (abort_request) {
       abort_request =
           UnderFraction(&abort_rand_generator_, abort_percentage_numerator,
-                        config.abort_percentage_denominator);
+                        config_->abort_percentage_denominator);
     }
   }
 
   return InjectionDecision(
-      config.max_faults, delay_request ? delay : Duration::Zero(),
+      config_->max_faults, delay_request ? delay : Duration::Zero(),
       abort_request ? std::optional<absl::Status>(absl::Status(
                           static_cast<absl::StatusCode>(abort_code),
-                          config.abort_message))
+                          config_->abort_message))
                     : std::nullopt);
 }
 
@@ -349,8 +315,4 @@ std::string FaultInjectionFilter::InjectionDecision::ToString() const {
 const grpc_channel_filter FaultInjectionFilter::kFilterVtable =
     MakePromiseBasedFilter<FaultInjectionFilter, FilterEndpoint::kClient>();
 
-void FaultInjectionFilterRegister(CoreConfiguration::Builder* builder) {
-  FaultInjectionServiceConfigParser::Register(builder);
-}
-
 }  // namespace grpc_core

data/src/core/ext/filters/fault_injection/fault_injection_filter.h

@@ -102,14 +102,6 @@ class FaultInjectionFilter
   InjectionDecision MakeInjectionDecision(
       const ClientMetadata& initial_metadata);
 
-  // TODO(roth): Remove this method and these data members as part of
-  // removing the xds_channel_filter_chain_per_route experiment.
-  template <typename T>
-  InjectionDecision MakeInjectionDecision(
-      const ClientMetadata& initial_metadata, const T& config);
-  size_t index_;  // The relative index of instances of the same filter.
-  const size_t service_config_parser_index_;
-
   const RefCountedPtr<const Config> config_;
 
   Mutex mu_;