grpc 1.81.1 → 1.85.0

data/src/core/ext/transport/chttp2/server/chttp2_server.cc

@@ -30,11 +30,13 @@
 #include <string.h>
 
 #include <algorithm>
+#include <cstdint>
 #include <map>
 #include <memory>
 #include <optional>
 #include <string>
 #include <utility>
+#include <variant>
 #include <vector>
 
 #include "src/core/channelz/channelz.h"
@@ -43,6 +45,7 @@
 #include "src/core/credentials/transport/security_connector.h"
 #include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/ext/transport/chttp2/transport/chttp2_transport.h"
+#include "src/core/ext/transport/chttp2/transport/http2_server_transport.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
 #include "src/core/ext/transport/chttp2/transport/legacy_frame.h"
 #include "src/core/handshaker/handshaker.h"
@@ -62,16 +65,17 @@
 #include "src/core/lib/iomgr/event_engine_shims/endpoint.h"
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/iomgr/pollset_set.h"
-#include "src/core/lib/iomgr/resolve_address.h"
-#include "src/core/lib/iomgr/resolved_address.h"
 #include "src/core/lib/iomgr/tcp_server.h"
 #include "src/core/lib/iomgr/unix_sockets_posix.h"
 #include "src/core/lib/iomgr/vsock.h"
 #include "src/core/lib/resource_quota/connection_quota.h"
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/lib/resource_quota/resource_quota.h"
+#include "src/core/lib/surface/channel_create.h"
 #include "src/core/lib/transport/error_utils.h"
+#include "src/core/lib/transport/promise_endpoint.h"
 #include "src/core/lib/transport/transport.h"
+#include "src/core/mitigation_engine/mitigation_engine.h"
 #include "src/core/server/server.h"
 #include "src/core/util/debug_location.h"
 #include "src/core/util/grpc_check.h"
@@ -226,41 +230,97 @@ void NewChttp2ServerListener::ActiveConnection::HandshakingState::
   // code, so we can just clean up here without creating a transport.
   if (!connection_->shutdown_ && result.ok() &&
       (*result)->endpoint != nullptr) {
-    RefCountedPtr<Transport> transport =
-        grpc_create_chttp2_transport((*result)->args,
-                                     std::move((*result)->endpoint), false)
-            ->Ref();
-    grpc_error_handle channel_init_err =
-        connection_->listener_state_->server()->SetupTransport(
-            transport.get(), accepting_pollset_, (*result)->args);
-    if (channel_init_err.ok()) {
-      // Use notify_on_receive_settings callback to enforce the
-      // handshake deadline.
-      connection_->state_ =
-          DownCast<grpc_chttp2_transport*>(transport.get())->Ref();
-      grpc_closure* on_close = &connection_->on_close_;
-      // Refs held by OnClose()
-      connection_->Ref().release();
-      grpc_chttp2_transport_start_reading(
-          transport.get(), (*result)->read_buffer.c_slice_buffer(),
-          [self = Ref()](absl::StatusOr<uint32_t>) {
-            self->OnReceiveSettings();
-          },
-          nullptr, on_close);
-      timer_handle_ = connection_->listener_state_->event_engine()->RunAfter(
-          deadline_ - Timestamp::Now(), [self = Ref()]() mutable {
-            // HandshakingState deletion might require an active ExecCtx.
-            ExecCtx exec_ctx;
-            auto* self_ptr = self.get();
-            self_ptr->connection_->work_serializer_.Run(
-                [self = std::move(self)]() { self->OnTimeoutLocked(); },
-                DEBUG_LOCATION);
-          });
+    const bool is_callv3 =
+        (*result)->args.GetBool(GRPC_ARG_USE_V3_STACK).value_or(false);
+
+    if (!is_callv3) {
+      RefCountedPtr<Transport> transport =
+          grpc_create_chttp2_transport((*result)->args,
+                                       std::move((*result)->endpoint), false)
+              ->Ref();
+      grpc_error_handle channel_init_err =
+          connection_->listener_state_->server()->SetupTransport(
+              transport.get(), accepting_pollset_, (*result)->args);
+      if (channel_init_err.ok()) {
+        // Use notify_on_receive_settings callback to enforce the
+        // handshake deadline.
+        connection_->state_ =
+            DownCast<grpc_chttp2_transport*>(transport.get())->Ref();
+        grpc_closure* on_close = &connection_->on_close_;
+        // Refs held by OnClose()
+        connection_->Ref().release();
+        grpc_chttp2_transport_start_reading(
+            transport.get(), (*result)->read_buffer.c_slice_buffer(),
+            [self = Ref()](absl::StatusOr<uint32_t>) {
+              self->OnReceiveSettings();
+            },
+            nullptr, on_close);
+        timer_handle_ = connection_->listener_state_->event_engine()->RunAfter(
+            deadline_ - Timestamp::Now(), [self = Ref()]() mutable {
+              // HandshakingState deletion might require an active ExecCtx.
+              ExecCtx exec_ctx;
+              auto* self_ptr = self.get();
+              self_ptr->connection_->work_serializer_.Run(
+                  [self = std::move(self)]() { self->OnTimeoutLocked(); },
+                  DEBUG_LOCATION);
+            });
+      } else {
+        // Failed to create channel from transport. Clean up.
+        LOG(ERROR) << "Failed to create channel: "
+                   << StatusToString(channel_init_err);
+        transport->Orphan();
+      }
     } else {
-      // Failed to create channel from transport. Clean up.
-      LOG(ERROR) << "Failed to create channel: "
-                 << StatusToString(channel_init_err);
-      transport->Orphan();
+      std::unique_ptr<EventEngine::Endpoint> event_engine_endpoint =
+          grpc_event_engine::experimental::
+              grpc_take_wrapped_event_engine_endpoint(
+                  (*result)->endpoint.release());
+      if (GPR_UNLIKELY(event_engine_endpoint == nullptr)) {
+        LOG(ERROR) << "Failed to take endpoint.";
+      } else {
+        PromiseEndpoint promise_endpoint(std::move(event_engine_endpoint),
+                                         std::move((*result)->read_buffer));
+        std::shared_ptr<EventEngine> event_engine_ptr =
+            (*result)->args.GetObjectRef<EventEngine>();
+        // TODO(akshitpatel) : [PH2][P4] : Consider making on_close_
+        // absl::AnyInvocable.
+        grpc_closure* on_close = &connection_->on_close_;
+        // Refs held by OnClose()
+        connection_->Ref().release();
+        // Use notify_on_receive_settings callback to enforce the
+        // handshake deadline.
+        auto* ph2_transport = new http2::Http2ServerTransport(
+            std::move(promise_endpoint), (*result)->args,
+            std::move(event_engine_ptr),
+            [self = Ref()](absl::StatusOr<uint32_t>) {
+              self->OnReceiveSettings();
+            },
+            on_close);
+        // SetupTransport will spawn the initial transport promises.
+        grpc_error_handle channel_init_err =
+            connection_->listener_state_->server()->SetupTransport(
+                ph2_transport, accepting_pollset_, (*result)->args);
+        if (GPR_LIKELY(channel_init_err.ok())) {
+          ph2_transport->Ref().release();
+          connection_->state_ =
+              RefCountedPtr<http2::Http2ServerTransport>(ph2_transport);
+          timer_handle_ =
+              connection_->listener_state_->event_engine()->RunAfter(
+                  deadline_ - Timestamp::Now(), [self = Ref()]() mutable {
+                    // HandshakingState deletion might require an active
+                    // ExecCtx.
+                    ExecCtx exec_ctx;
+                    auto* self_ptr = self.get();
+                    self_ptr->connection_->work_serializer_.Run(
+                        [self = std::move(self)]() { self->OnTimeoutLocked(); },
+                        DEBUG_LOCATION);
+                  });
+        } else {
+          LOG(ERROR) << "Failed to create channel: "
+                     << StatusToString(channel_init_err);
+          ph2_transport->Orphan();
+        }
+      }
     }
   }
   // Since the handshake manager is done, the connection no longer needs to
@@ -269,6 +329,8 @@ void NewChttp2ServerListener::ActiveConnection::HandshakingState::
   connection_->listener_state_->OnHandshakeDone(connection_.get());
   // Clean up if we don't have a transport
   if (!std::holds_alternative<RefCountedPtr<grpc_chttp2_transport>>(
+          connection_->state_) &&
+      !std::holds_alternative<RefCountedPtr<http2::Http2ServerTransport>>(
           connection_->state_)) {
     connection_->listener_state_->connection_quota()->ReleaseConnections(1);
     connection_->listener_state_->RemoveLogicalConnection(connection_.get());
@@ -373,6 +435,17 @@ void NewChttp2ServerListener::ActiveConnection::SendGoAwayImplLocked() {
                 static_cast<intptr_t>(Http2ErrorCode::kNoError));
             transport->PerformOp(op);
           }
+        },
+        [](const RefCountedPtr<http2::Http2ServerTransport>& transport) {
+          // Send a GOAWAY if the transport exists
+          if (transport != nullptr) {
+            grpc_transport_op* op = grpc_make_transport_op(nullptr);
+            // We send a non-ok status here to send the status message in the
+            // GOAWAY frame.
+            op->goaway_error =
+                absl::UnavailableError("Server is stopping to serve requests.");
+            transport->PerformOp(op);
+          }
         });
   }
 }
@@ -397,6 +470,15 @@ void NewChttp2ServerListener::ActiveConnection::
               "Drain grace time expired. Closing connection immediately.");
           transport->PerformOp(op);
         }
+      },
+      [](const RefCountedPtr<http2::Http2ServerTransport>& transport) {
+        // Disconnect immediately if the transport exists
+        if (transport != nullptr) {
+          grpc_transport_op* op = grpc_make_transport_op(nullptr);
+          op->disconnect_with_error = absl::UnavailableError(
+              "Drain grace time expired. Closing connection immediately.");
+          transport->PerformOp(op);
+        }
       });
 }
 
@@ -426,7 +508,7 @@ grpc_error_handle NewChttp2ServerListener::Create(
     // number.
     listener->resolved_address_ = iomgr_addr;
     {
-      MutexLock lock(&listener->mu_);
+      MutexLock lock(listener->mu_);
       listener->add_port_on_start_ = true;
     }
   } else {
@@ -501,7 +583,7 @@ void NewChttp2ServerListener::Start() {
   bool should_add_port = false;
   grpc_tcp_server* tcp_server = nullptr;
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     if (!shutdown_) {
       should_add_port = std::exchange(add_port_on_start_, false);
       // Hold a ref while we start the server
@@ -530,7 +612,7 @@ void NewChttp2ServerListener::Start() {
 }
 
 void NewChttp2ServerListener::SetOnDestroyDone(grpc_closure* on_destroy_done) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   on_destroy_done_ = on_destroy_done;
 }
 
@@ -546,11 +628,22 @@ void NewChttp2ServerListener::OnAccept(
   NewChttp2ServerListener* self = static_cast<NewChttp2ServerListener*>(arg);
   OrphanablePtr<grpc_endpoint> endpoint(tcp);
   AcceptorPtr acceptor(server_acceptor);
+  absl::string_view peer = grpc_endpoint_get_peer(endpoint.get());
   if (!self->listener_state_->connection_quota()->AllowIncomingConnection(
-          self->listener_state_->memory_quota(),
-          grpc_endpoint_get_peer(endpoint.get()))) {
+          self->listener_state_->memory_quota(), peer)) {
     return;
   }
+  RefCountedPtr<MitigationEngine> mitigation_engine = self->mitigation_engine();
+  if (mitigation_engine != nullptr) {
+    auto action = mitigation_engine->EvaluateIncomingConnection(
+        MitigationEngine::EvaluateArgs(peer, endpoint.get()));
+    if (action == MitigationEngine::Action::kCloseConnection) {
+      LOG_EVERY_N_SEC(INFO, 60)
+          << "Mitigation engine rejected connection from " << peer;
+      self->listener_state_->connection_quota()->ReleaseConnections(1);
+      return;
+    }
+  }
   {
     // The ref for the tcp_server need to be taken in the critical region
     // after having made sure that the listener has not been Orphaned, so as
@@ -559,7 +652,7 @@ void NewChttp2ServerListener::OnAccept(
     // tcp_server but this ref is given away when the listener is orphaned
     // (shutdown). A connection needs the tcp_server to outlast the handshake
     // since the acceptor needs it.
-    MutexLock lock(&self->mu_);
+    MutexLock lock(self->mu_);
     if (self->shutdown_) {
       self->listener_state_->connection_quota()->ReleaseConnections(1);
       return;
@@ -598,7 +691,7 @@ void NewChttp2ServerListener::TcpServerShutdownComplete(
 void NewChttp2ServerListener::Orphan() {
   grpc_tcp_server* tcp_server;
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     shutdown_ = true;
     tcp_server = tcp_server_;
   }
@@ -615,8 +708,12 @@ absl::StatusOr<int> Chttp2ServerAddPort(Server* server, const char* addr,
   if (addr == nullptr) {
     return GRPC_ERROR_CREATE("Invalid address: addr cannot be a nullptr.");
   }
+
+  ChannelArgs updated_args =
+      args.Set(GRPC_ARG_USE_V3_STACK, http2::ShouldEnablePh2Server());
   if (strncmp(addr, "external:", 9) == 0) {
-    auto r = NewChttp2ServerListener::CreateWithAcceptor(server, addr, args);
+    auto r =
+        NewChttp2ServerListener::CreateWithAcceptor(server, addr, updated_args);
     if (!r.ok()) return r;
     return -1;
   }
@@ -646,26 +743,12 @@ absl::StatusOr<int> Chttp2ServerAddPort(Server* server, const char* addr,
       resolved = grpc_resolve_vsock_address(parsed_addr_unprefixed);
       GRPC_RETURN_IF_ERROR(resolved.status());
     } else {
-      if (IsEventEngineDnsNonClientChannelEnabled() &&
-          !grpc_event_engine::experimental::
-              EventEngineExperimentDisabledForPython()) {
-        absl::StatusOr<std::unique_ptr<EventEngine::DNSResolver>> ee_resolver =
-            args.GetObjectRef<EventEngine>()->GetDNSResolver(
-                EventEngine::DNSResolver::ResolverOptions());
-        GRPC_RETURN_IF_ERROR(ee_resolver.status());
-        results = grpc_event_engine::experimental::LookupHostnameBlocking(
-            ee_resolver->get(), parsed_addr, "https");
-      } else {
-        // TODO(yijiem): Remove this after event_engine_dns_non_client_channel
-        // is fully enabled.
-        absl::StatusOr<std::vector<grpc_resolved_address>> iomgr_results =
-            GetDNSResolver()->LookupHostnameBlocking(parsed_addr, "https");
-        GRPC_RETURN_IF_ERROR(iomgr_results.status());
-        for (const auto& addr : *iomgr_results) {
-          results->push_back(
-              grpc_event_engine::experimental::CreateResolvedAddress(addr));
-        }
-      }
+      absl::StatusOr<std::unique_ptr<EventEngine::DNSResolver>> ee_resolver =
+          args.GetObjectRef<EventEngine>()->GetDNSResolver(
+              EventEngine::DNSResolver::ResolverOptions());
+      GRPC_RETURN_IF_ERROR(ee_resolver.status());
+      results = grpc_event_engine::experimental::LookupHostnameBlocking(
+          ee_resolver->get(), parsed_addr, "https");
     }
     if (resolved.ok()) {
       for (const auto& addr : *resolved) {
@@ -683,7 +766,8 @@ absl::StatusOr<int> Chttp2ServerAddPort(Server* server, const char* addr,
         grpc_event_engine::experimental::ResolvedAddressSetPort(addr, port_num);
       }
       int port_temp = -1;
-      error = NewChttp2ServerListener::Create(server, addr, args, &port_temp);
+      error = NewChttp2ServerListener::Create(server, addr, updated_args,
+                                              &port_temp);
       if (!error.ok()) {
         error_list.push_back(error);
       } else {
@@ -718,17 +802,22 @@ absl::StatusOr<int> Chttp2ServerAddPort(Server* server, const char* addr,
 
 namespace experimental {
 
+void PassiveListenerImpl::Init(RefCountedPtr<Server> server,
+                               NewChttp2ServerListener* listener) {
+  MutexLock lock(mu_);
+  server_ = std::move(server);
+  listener_ = listener;
+}
+
 absl::Status PassiveListenerImpl::AcceptConnectedEndpoint(
     std::unique_ptr<EventEngine::Endpoint> endpoint) {
-  GRPC_CHECK_NE(server_.get(), nullptr);
   RefCountedPtr<NewChttp2ServerListener> new_listener;
   {
-    MutexLock lock(&mu_);
-    auto* new_listener_ptr = std::get_if<NewChttp2ServerListener*>(&listener_);
-    if (new_listener_ptr != nullptr && *new_listener_ptr != nullptr) {
-      new_listener = (*new_listener_ptr)
-                         ->RefIfNonZero()
-                         .TakeAsSubclass<NewChttp2ServerListener>();
+    MutexLock lock(mu_);
+    GRPC_CHECK_NE(server_.get(), nullptr);
+    if (listener_ != nullptr) {
+      new_listener =
+          listener_->RefIfNonZero().TakeAsSubclass<NewChttp2ServerListener>();
     }
   }
   if (new_listener == nullptr) {
@@ -740,9 +829,13 @@ absl::Status PassiveListenerImpl::AcceptConnectedEndpoint(
 }
 
 absl::Status PassiveListenerImpl::AcceptConnectedFd(int fd) {
-  GRPC_CHECK_NE(server_.get(), nullptr);
   ExecCtx exec_ctx;
-  auto& args = server_->channel_args();
+  ChannelArgs args;
+  {
+    MutexLock lock(mu_);
+    GRPC_CHECK_NE(server_.get(), nullptr);
+    args = server_->channel_args();
+  }
   auto* supports_fd = QueryExtension<EventEngineSupportsFdExtension>(
       args.GetObjectRef<EventEngine>().get());
   if (supports_fd == nullptr) {
@@ -759,8 +852,8 @@ absl::Status PassiveListenerImpl::AcceptConnectedFd(int fd) {
 }
 
 void PassiveListenerImpl::ListenerDestroyed() {
-  MutexLock lock(&mu_);
-  listener_ = static_cast<Chttp2ServerListener*>(nullptr);
+  MutexLock lock(mu_);
+  listener_ = nullptr;
 }
 
 }  // namespace experimental
@@ -778,7 +871,10 @@ void grpc_server_add_channel_from_fd(grpc_server* server, int fd,
   grpc_core::ExecCtx exec_ctx;
   grpc_core::Server* core_server = grpc_core::Server::FromC(server);
 
-  grpc_core::ChannelArgs server_args = core_server->channel_args();
+  const bool is_callv3 = grpc_core::http2::ShouldEnablePh2Server();
+  grpc_core::ChannelArgs server_args =
+      core_server->channel_args().Set(GRPC_ARG_USE_V3_STACK, is_callv3);
+
   std::string name = absl::StrCat("fd:", fd);
   auto memory_quota =
       server_args.GetObject<grpc_core::ResourceQuota>()->memory_quota();
@@ -791,18 +887,46 @@ void grpc_server_add_channel_from_fd(grpc_server* server, int fd,
   for (grpc_pollset* pollset : core_server->pollsets()) {
     grpc_endpoint_add_to_pollset(server_endpoint.get(), pollset);
   }
-  grpc_core::Transport* transport = grpc_create_chttp2_transport(
-      server_args, std::move(server_endpoint), false  // is_client
-  );
-  grpc_error_handle error =
-      core_server->SetupTransport(transport, nullptr, server_args);
-  if (error.ok()) {
-    grpc_chttp2_transport_start_reading(transport, nullptr, nullptr, nullptr,
-                                        nullptr);
+
+  if (!is_callv3) {
+    grpc_core::Transport* transport = grpc_create_chttp2_transport(
+        server_args, std::move(server_endpoint), false  // is_client
+    );
+    grpc_error_handle error =
+        core_server->SetupTransport(transport, nullptr, server_args);
+    if (error.ok()) {
+      grpc_chttp2_transport_start_reading(transport, nullptr, nullptr, nullptr,
+                                          nullptr);
+    } else {
+      LOG(ERROR) << "Failed to create channel: "
+                 << grpc_core::StatusToString(error);
+      transport->Orphan();
+    }
   } else {
-    LOG(ERROR) << "Failed to create channel: "
-               << grpc_core::StatusToString(error);
-    transport->Orphan();
+    std::unique_ptr<grpc_event_engine::experimental::EventEngine::Endpoint>
+        event_engine_endpoint = grpc_event_engine::experimental::
+            grpc_take_wrapped_event_engine_endpoint(server_endpoint.release());
+    if (event_engine_endpoint != nullptr) {
+      grpc_core::PromiseEndpoint promise_endpoint(
+          std::move(event_engine_endpoint), grpc_core::SliceBuffer());
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine_ptr = server_args.GetObjectRef<grpc_core::EventEngine>();
+      grpc_core::Transport* transport =
+          new grpc_core::http2::Http2ServerTransport(
+              std::move(promise_endpoint), server_args,
+              std::move(event_engine_ptr), [](absl::StatusOr<uint32_t>) {},
+              /*on_close_callback=*/nullptr);
+      grpc_error_handle error =
+          core_server->SetupTransport(transport, nullptr, server_args);
+      // SetupTransport will spawn the initial transport promises.
+      if (!error.ok()) {
+        LOG(ERROR) << "Failed to create channel: "
+                   << grpc_core::StatusToString(error);
+        transport->Orphan();
+      }
+    } else {
+      LOG(ERROR) << "Failed to take endpoint.";
+    }
   }
 }
 
@@ -836,11 +960,12 @@ absl::Status grpc_server_add_passive_listener(
   }
   auto args = server->channel_args()
                   .SetObject(credentials->Ref())
-                  .SetObject(std::move(sc));
-  passive_listener->listener_ =
+                  .SetObject(std::move(sc))
+                  .Set(GRPC_ARG_USE_V3_STACK,
+                       grpc_core::http2::ShouldEnablePh2Server());
+  passive_listener->Init(
+      server->Ref(),
       grpc_core::NewChttp2ServerListener::CreateForPassiveListener(
-          server, args, passive_listener);
-
-  passive_listener->server_ = server->Ref();
+          server, args, passive_listener));
   return absl::OkStatus();
 }

data/src/core/ext/transport/chttp2/server/chttp2_server.h

@@ -26,11 +26,14 @@
 
 #include <functional>
 
+#include "src/core/ext/transport/chttp2/transport/http2_server_transport.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
 #include "src/core/handshaker/handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/error.h"
+#include "src/core/mitigation_engine/mitigation_engine.h"
 #include "src/core/server/server.h"
+#include "src/core/util/ref_counted_ptr.h"
 
 namespace grpc_core {
 
@@ -43,8 +46,6 @@ struct AcceptorDeleter {
   }
 };
 
-class Chttp2ServerListener;
-
 namespace testing {
 class Chttp2ServerListenerTestPeer;
 class ActiveConnectionTestPeer;
@@ -131,7 +132,8 @@ class NewChttp2ServerListener : public Server::ListenerInterface {
     // Set by HandshakingState before the handshaking begins and set to a valid
     // transport when handshaking is done successfully.
     std::variant<OrphanablePtr<HandshakingState>,
-                 RefCountedPtr<grpc_chttp2_transport>>
+                 RefCountedPtr<grpc_chttp2_transport>,
+                 RefCountedPtr<http2::Http2ServerTransport>>
         state_;
     grpc_closure on_close_;
     bool shutdown_ = false;
@@ -204,6 +206,11 @@ class NewChttp2ServerListener : public Server::ListenerInterface {
         .GetObject<grpc_event_engine::experimental::EventEngine>();
   }
 
+  RefCountedPtr<MitigationEngine> mitigation_engine() const {
+    auto* provider = args_.GetObject<MitigationEngineProvider>();
+    return provider != nullptr ? provider->GetEngine() : nullptr;
+  }
+
   grpc_tcp_server* tcp_server_ = nullptr;
   grpc_resolved_address resolved_address_;
   RefCountedPtr<Server::ListenerState> listener_state_;
@@ -230,6 +237,9 @@ namespace experimental {
 // details.
 class PassiveListenerImpl final : public PassiveListener {
  public:
+  // Called by grpc_server_add_passive_listener().
+  void Init(RefCountedPtr<Server> server, NewChttp2ServerListener* listener);
+
   absl::Status AcceptConnectedEndpoint(
       std::unique_ptr<grpc_event_engine::experimental::EventEngine::Endpoint>
           endpoint) override ABSL_LOCKS_EXCLUDED(mu_);
@@ -240,17 +250,10 @@ class PassiveListenerImpl final : public PassiveListener {
   void ListenerDestroyed() ABSL_LOCKS_EXCLUDED(mu_);
 
  private:
-  // note: the grpc_core::Server redundant namespace qualification is
-  // required for older gcc versions.
-  friend absl::Status(::grpc_server_add_passive_listener)(
-      grpc_core::Server* server, grpc_server_credentials* credentials,
-      std::shared_ptr<grpc_core::experimental::PassiveListenerImpl>
-          passive_listener);
-
   Mutex mu_;
   // Data members will be populated when initialized.
-  RefCountedPtr<Server> server_;
-  std::variant<Chttp2ServerListener*, NewChttp2ServerListener*> listener_;
+  RefCountedPtr<Server> server_ ABSL_GUARDED_BY(mu_);
+  NewChttp2ServerListener* listener_ ABSL_GUARDED_BY(mu_) = nullptr;
 };
 
 }  // namespace experimental