grpc 1.81.1 → 1.85.0

data/src/core/lib/security/authorization/matchers.h

@@ -23,8 +23,8 @@
 #include <utility>
 #include <vector>
 
+#include "src/core/call/evaluate_args.h"
 #include "src/core/lib/iomgr/resolved_address.h"
-#include "src/core/lib/security/authorization/evaluate_args.h"
 #include "src/core/lib/security/authorization/rbac_policy.h"
 #include "src/core/util/matchers.h"
 
@@ -42,12 +42,12 @@ class AuthorizationMatcher {
   // Creates an instance of a matcher based off the rules defined in Permission
   // config.
   static std::unique_ptr<AuthorizationMatcher> Create(
-      Rbac::Permission permission);
+      const Rbac::Permission& permission);
 
   // Creates an instance of a matcher based off the rules defined in Principal
   // config.
   static std::unique_ptr<AuthorizationMatcher> Create(
-      Rbac::Principal principal);
+      const Rbac::Principal& principal);
 };
 
 class AlwaysAuthorizationMatcher : public AuthorizationMatcher {
@@ -113,8 +113,8 @@ class MetadataAuthorizationMatcher : public AuthorizationMatcher {
 // Perform a match against HTTP headers.
 class HeaderAuthorizationMatcher : public AuthorizationMatcher {
  public:
-  explicit HeaderAuthorizationMatcher(HeaderMatcher matcher)
-      : matcher_(std::move(matcher)) {}
+  explicit HeaderAuthorizationMatcher(const HeaderMatcher& matcher)
+      : matcher_(matcher) {}
 
   bool Matches(const EvaluateArgs& args) const override;
 
@@ -132,7 +132,7 @@ class IpAuthorizationMatcher : public AuthorizationMatcher {
     kRemoteIp,
   };
 
-  IpAuthorizationMatcher(Type type, Rbac::CidrRange range);
+  IpAuthorizationMatcher(Type type, const Rbac::CidrRange& range);
 
   bool Matches(const EvaluateArgs& args) const override;
 
@@ -158,8 +158,9 @@ class PortAuthorizationMatcher : public AuthorizationMatcher {
 // or DNS SAN in that order, otherwise uses subject field.
 class AuthenticatedAuthorizationMatcher : public AuthorizationMatcher {
  public:
-  explicit AuthenticatedAuthorizationMatcher(std::optional<StringMatcher> auth)
-      : matcher_(std::move(auth)) {}
+  explicit AuthenticatedAuthorizationMatcher(
+      const std::optional<StringMatcher>& auth)
+      : matcher_(auth) {}
 
   bool Matches(const EvaluateArgs& args) const override;
 
@@ -172,8 +173,8 @@ class AuthenticatedAuthorizationMatcher : public AuthorizationMatcher {
 class ReqServerNameAuthorizationMatcher : public AuthorizationMatcher {
  public:
   explicit ReqServerNameAuthorizationMatcher(
-      StringMatcher requested_server_name)
-      : matcher_(std::move(requested_server_name)) {}
+      const StringMatcher& requested_server_name)
+      : matcher_(requested_server_name) {}
 
   bool Matches(const EvaluateArgs&) const override;
 
@@ -184,8 +185,8 @@ class ReqServerNameAuthorizationMatcher : public AuthorizationMatcher {
 // Perform a match against the path header of HTTP request.
 class PathAuthorizationMatcher : public AuthorizationMatcher {
  public:
-  explicit PathAuthorizationMatcher(StringMatcher path)
-      : matcher_(std::move(path)) {}
+  explicit PathAuthorizationMatcher(const StringMatcher& path)
+      : matcher_(path) {}
 
   bool Matches(const EvaluateArgs& args) const override;
 
@@ -198,11 +199,9 @@ class PathAuthorizationMatcher : public AuthorizationMatcher {
 // of its permissions and a match in one of its principals.
 class PolicyAuthorizationMatcher : public AuthorizationMatcher {
  public:
-  explicit PolicyAuthorizationMatcher(Rbac::Policy policy)
-      : permissions_(
-            AuthorizationMatcher::Create(std::move(policy.permissions))),
-        principals_(
-            AuthorizationMatcher::Create(std::move(policy.principals))) {}
+  explicit PolicyAuthorizationMatcher(const Rbac::Policy& policy)
+      : permissions_(AuthorizationMatcher::Create(policy.permissions)),
+        principals_(AuthorizationMatcher::Create(policy.principals)) {}
 
   bool Matches(const EvaluateArgs& args) const override;
 

data/src/core/lib/security/authorization/rbac_policy.cc

@@ -14,10 +14,9 @@
 
 #include "src/core/lib/security/authorization/rbac_policy.h"
 
-#include <grpc/support/port_platform.h>
-
 #include <utility>
 
+#include "src/core/util/string.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/string_view.h"
@@ -51,36 +50,71 @@ Rbac& Rbac::operator=(Rbac&& other) noexcept {
   return *this;
 }
 
-std::string Rbac::ToString() const {
-  std::vector<std::string> contents;
-  absl::string_view condition_str;
+bool Rbac::operator==(const Rbac& other) const {
+  if (name != other.name) return false;
+  if (action != other.action) return false;
+  if (policies != other.policies) return false;
+  if (audit_condition != other.audit_condition) return false;
+  if (logger_configs.size() != other.logger_configs.size()) return false;
+  for (size_t i = 0; i < logger_configs.size(); ++i) {
+    if (logger_configs[i] == nullptr) {
+      if (other.logger_configs[i] != nullptr) return false;
+      continue;
+    }
+    if (other.logger_configs[i] == nullptr) return false;
+    if (logger_configs[i]->name() != other.logger_configs[i]->name() ||
+        logger_configs[i]->ToString() != other.logger_configs[i]->ToString()) {
+      return false;
+    }
+  }
+  return true;
+}
+
+namespace {
+
+absl::string_view AuditConditionString(Rbac::AuditCondition audit_condition) {
   switch (audit_condition) {
     case Rbac::AuditCondition::kNone:
-      condition_str = "None";
-      break;
-    case AuditCondition::kOnDeny:
-      condition_str = "OnDeny";
-      break;
-    case AuditCondition::kOnAllow:
-      condition_str = "OnAllow";
-      break;
-    case AuditCondition::kOnDenyAndAllow:
-      condition_str = "OnDenyAndAllow";
-      break;
+      return "None";
+    case Rbac::AuditCondition::kOnDeny:
+      return "OnDeny";
+    case Rbac::AuditCondition::kOnAllow:
+      return "OnAllow";
+    case Rbac::AuditCondition::kOnDenyAndAllow:
+      return "OnDenyAndAllow";
   }
-  contents.push_back(absl::StrFormat(
-      "Rbac name=%s action=%s audit_condition=%s{", name,
-      action == Rbac::Action::kAllow ? "Allow" : "Deny", condition_str));
-  for (const auto& p : policies) {
-    contents.push_back(absl::StrFormat("{\n  policy_name=%s\n%s\n}", p.first,
-                                       p.second.ToString()));
+  return "<UNKNOWN>";
+}
+
+}  // namespace
+
+std::string Rbac::ToString() const {
+  std::string str = "Rbac{name=";
+  StrAppend(str, name);
+  StrAppend(str, ", action=");
+  StrAppend(str, action == Rbac::Action::kAllow ? "Allow" : "Deny");
+  StrAppend(str, ", audit_condition=");
+  StrAppend(str, AuditConditionString(audit_condition));
+  StrAppend(str, ", policies={");
+  bool is_first = true;
+  for (const auto& [name, policy] : policies) {
+    if (!is_first) StrAppend(str, ", ");
+    StrAppend(str, name);
+    StrAppend(str, "=");
+    StrAppend(str, policy.ToString());
+    is_first = false;
   }
+  StrAppend(str, "}, audit_loggers={");
+  is_first = true;
   for (const auto& config : logger_configs) {
-    contents.push_back(absl::StrFormat("{\n  audit_logger=%s\n%s\n}",
-                                       config->name(), config->ToString()));
+    if (!is_first) StrAppend(str, ", ");
+    StrAppend(str, config->name());
+    StrAppend(str, "=");
+    StrAppend(str, config->ToString());
+    is_first = false;
   }
-  contents.push_back("}");
-  return absl::StrJoin(contents, "\n");
+  StrAppend(str, "}}");
+  return str;
 }
 
 //
@@ -100,6 +134,11 @@ Rbac::CidrRange& Rbac::CidrRange::operator=(Rbac::CidrRange&& other) noexcept {
   return *this;
 }
 
+bool Rbac::CidrRange::operator==(const Rbac::CidrRange& other) const {
+  return address_prefix == other.address_prefix &&
+         prefix_len == other.prefix_len;
+}
+
 std::string Rbac::CidrRange::ToString() const {
   return absl::StrFormat("CidrRange{address_prefix=%s,prefix_len=%d}",
                          address_prefix, prefix_len);
@@ -125,11 +164,11 @@ Rbac::Permission Rbac::Permission::MakeOrPermission(
   return permission;
 }
 
-Rbac::Permission Rbac::Permission::MakeNotPermission(Permission permission) {
+Rbac::Permission Rbac::Permission::MakeNotPermission(
+    std::unique_ptr<Permission> permission) {
   Permission not_permission;
   not_permission.type = Permission::RuleType::kNot;
-  not_permission.permissions.push_back(
-      std::make_unique<Rbac::Permission>(std::move(permission)));
+  not_permission.permissions.push_back(std::move(permission));
   return not_permission;
 }
 
@@ -237,6 +276,25 @@ Rbac::Permission& Rbac::Permission::operator=(
   return *this;
 }
 
+bool Rbac::Permission::operator==(const Rbac::Permission& other) const {
+  if (type != other.type) return false;
+  if (header_matcher != other.header_matcher) return false;
+  if (string_matcher != other.string_matcher) return false;
+  if (ip != other.ip) return false;
+  if (port != other.port) return false;
+  if (invert != other.invert) return false;
+  if (permissions.size() != other.permissions.size()) return false;
+  for (size_t i = 0; i < permissions.size(); ++i) {
+    if (permissions[i] == nullptr) {
+      if (other.permissions[i] != nullptr) return false;
+    } else {
+      if (other.permissions[i] == nullptr) return false;
+      if (*permissions[i] != *other.permissions[i]) return false;
+    }
+  }
+  return true;
+}
+
 std::string Rbac::Permission::ToString() const {
   switch (type) {
     case RuleType::kAnd: {
@@ -245,7 +303,7 @@ std::string Rbac::Permission::ToString() const {
       for (const auto& permission : permissions) {
         contents.push_back(permission->ToString());
       }
-      return absl::StrFormat("and=[%s]", absl::StrJoin(contents, ","));
+      return absl::StrFormat("{and=[%s]}", absl::StrJoin(contents, ", "));
     }
     case RuleType::kOr: {
       std::vector<std::string> contents;
@@ -253,24 +311,24 @@ std::string Rbac::Permission::ToString() const {
       for (const auto& permission : permissions) {
         contents.push_back(permission->ToString());
       }
-      return absl::StrFormat("or=[%s]", absl::StrJoin(contents, ","));
+      return absl::StrFormat("{or=[%s]}", absl::StrJoin(contents, ", "));
     }
     case RuleType::kNot:
-      return absl::StrFormat("not %s", permissions[0]->ToString());
+      return absl::StrFormat("{not %s}", permissions[0]->ToString());
     case RuleType::kAny:
-      return "any";
+      return "{any}";
     case RuleType::kHeader:
-      return absl::StrFormat("header=%s", header_matcher.ToString());
+      return absl::StrFormat("{header=%s}", header_matcher.ToString());
     case RuleType::kPath:
-      return absl::StrFormat("path=%s", string_matcher.ToString());
+      return absl::StrFormat("{path=%s}", string_matcher.ToString());
     case RuleType::kDestIp:
-      return absl::StrFormat("dest_ip=%s", ip.ToString());
+      return absl::StrFormat("{dest_ip=%s}", ip.ToString());
     case RuleType::kDestPort:
-      return absl::StrFormat("dest_port=%d", port);
+      return absl::StrFormat("{dest_port=%d}", port);
     case RuleType::kMetadata:
-      return absl::StrFormat("%smetadata", invert ? "invert " : "");
+      return absl::StrFormat("{%smetadata}", invert ? "invert " : "");
     case RuleType::kReqServerName:
-      return absl::StrFormat("requested_server_name=%s",
+      return absl::StrFormat("{requested_server_name=%s}",
                              string_matcher.ToString());
     default:
       return "";
@@ -297,11 +355,11 @@ Rbac::Principal Rbac::Principal::MakeOrPrincipal(
   return principal;
 }
 
-Rbac::Principal Rbac::Principal::MakeNotPrincipal(Principal principal) {
+Rbac::Principal Rbac::Principal::MakeNotPrincipal(
+    std::unique_ptr<Principal> principal) {
   Principal not_principal;
   not_principal.type = Principal::RuleType::kNot;
-  not_principal.principals.push_back(
-      std::make_unique<Rbac::Principal>(std::move(principal)));
+  not_principal.principals.push_back(std::move(principal));
   return not_principal;
 }
 
@@ -409,6 +467,24 @@ Rbac::Principal& Rbac::Principal::operator=(Rbac::Principal&& other) noexcept {
   return *this;
 }
 
+bool Rbac::Principal::operator==(const Rbac::Principal& other) const {
+  if (type != other.type) return false;
+  if (header_matcher != other.header_matcher) return false;
+  if (string_matcher != other.string_matcher) return false;
+  if (ip != other.ip) return false;
+  if (invert != other.invert) return false;
+  if (principals.size() != other.principals.size()) return false;
+  for (size_t i = 0; i < principals.size(); ++i) {
+    if (principals[i] == nullptr) {
+      if (other.principals[i] != nullptr) return false;
+    } else {
+      if (other.principals[i] == nullptr) return false;
+      if (*principals[i] != *other.principals[i]) return false;
+    }
+  }
+  return true;
+}
+
 std::string Rbac::Principal::ToString() const {
   switch (type) {
     case RuleType::kAnd: {
@@ -417,7 +493,7 @@ std::string Rbac::Principal::ToString() const {
       for (const auto& principal : principals) {
         contents.push_back(principal->ToString());
       }
-      return absl::StrFormat("and=[%s]", absl::StrJoin(contents, ","));
+      return absl::StrFormat("{and=[%s]}", absl::StrJoin(contents, ", "));
     }
     case RuleType::kOr: {
       std::vector<std::string> contents;
@@ -425,26 +501,26 @@ std::string Rbac::Principal::ToString() const {
       for (const auto& principal : principals) {
         contents.push_back(principal->ToString());
       }
-      return absl::StrFormat("or=[%s]", absl::StrJoin(contents, ","));
+      return absl::StrFormat("{or=[%s]}", absl::StrJoin(contents, ", "));
     }
     case RuleType::kNot:
-      return absl::StrFormat("not %s", principals[0]->ToString());
+      return absl::StrFormat("{not %s}", principals[0]->ToString());
     case RuleType::kAny:
-      return "any";
+      return "{any}";
     case RuleType::kPrincipalName:
-      return absl::StrFormat("principal_name=%s", string_matcher->ToString());
+      return absl::StrFormat("{principal_name=%s}", string_matcher->ToString());
     case RuleType::kSourceIp:
-      return absl::StrFormat("source_ip=%s", ip.ToString());
+      return absl::StrFormat("{source_ip=%s}", ip.ToString());
     case RuleType::kDirectRemoteIp:
-      return absl::StrFormat("direct_remote_ip=%s", ip.ToString());
+      return absl::StrFormat("{direct_remote_ip=%s}", ip.ToString());
     case RuleType::kRemoteIp:
-      return absl::StrFormat("remote_ip=%s", ip.ToString());
+      return absl::StrFormat("{remote_ip=%s}", ip.ToString());
     case RuleType::kHeader:
-      return absl::StrFormat("header=%s", header_matcher.ToString());
+      return absl::StrFormat("{header=%s}", header_matcher.ToString());
     case RuleType::kPath:
-      return absl::StrFormat("path=%s", string_matcher->ToString());
+      return absl::StrFormat("{path=%s}", string_matcher->ToString());
     case RuleType::kMetadata:
-      return absl::StrFormat("%smetadata", invert ? "invert " : "");
+      return absl::StrFormat("{%smetadata}", invert ? "invert " : "");
     default:
       return "";
   }
@@ -467,10 +543,17 @@ Rbac::Policy& Rbac::Policy::operator=(Rbac::Policy&& other) noexcept {
   return *this;
 }
 
+bool Rbac::Policy::operator==(const Rbac::Policy& other) const {
+  return permissions == other.permissions && principals == other.principals;
+}
+
 std::string Rbac::Policy::ToString() const {
-  return absl::StrFormat(
-      "  Policy  {\n    Permissions{%s}\n    Principals{%s}\n  }",
-      permissions.ToString(), principals.ToString());
+  std::string str = "{permissions=";
+  StrAppend(str, permissions.ToString());
+  StrAppend(str, ", principals=");
+  StrAppend(str, principals.ToString());
+  StrAppend(str, "}");
+  return str;
 }
 
 }  // namespace grpc_core

data/src/core/lib/security/authorization/rbac_policy.h

@@ -44,6 +44,9 @@ struct Rbac {
     kOnDenyAndAllow,
   };
 
+  // TODO(roth): Unify this with
+  // XdsListenerResource::FilterChainMap::CidrRange, possibly as part of
+  // addressing https://github.com/grpc/grpc/issues/34172.
   struct CidrRange {
     CidrRange() = default;
     CidrRange(std::string address_prefix, uint32_t prefix_len);
@@ -51,6 +54,9 @@ struct Rbac {
     CidrRange(CidrRange&& other) noexcept;
     CidrRange& operator=(CidrRange&& other) noexcept;
 
+    bool operator==(const CidrRange& other) const;
+    bool operator!=(const CidrRange& other) const { return !(*this == other); }
+
     std::string ToString() const;
 
     std::string address_prefix;
@@ -76,7 +82,7 @@ struct Rbac {
         std::vector<std::unique_ptr<Permission>> permissions);
     static Permission MakeOrPermission(
         std::vector<std::unique_ptr<Permission>> permissions);
-    static Permission MakeNotPermission(Permission permission);
+    static Permission MakeNotPermission(std::unique_ptr<Permission> permission);
     static Permission MakeAnyPermission();
     static Permission MakeHeaderPermission(HeaderMatcher header_matcher);
     static Permission MakePathPermission(StringMatcher string_matcher);
@@ -91,6 +97,9 @@ struct Rbac {
     Permission(Permission&& other) noexcept;
     Permission& operator=(Permission&& other) noexcept;
 
+    bool operator==(const Permission& other) const;
+    bool operator!=(const Permission& other) const { return !(*this == other); }
+
     std::string ToString() const;
 
     RuleType type = RuleType::kAnd;
@@ -124,7 +133,7 @@ struct Rbac {
         std::vector<std::unique_ptr<Principal>> principals);
     static Principal MakeOrPrincipal(
         std::vector<std::unique_ptr<Principal>> principals);
-    static Principal MakeNotPrincipal(Principal principal);
+    static Principal MakeNotPrincipal(std::unique_ptr<Principal> principal);
     static Principal MakeAnyPrincipal();
     static Principal MakeAuthenticatedPrincipal(
         std::optional<StringMatcher> string_matcher);
@@ -141,6 +150,9 @@ struct Rbac {
     Principal(Principal&& other) noexcept;
     Principal& operator=(Principal&& other) noexcept;
 
+    bool operator==(const Principal& other) const;
+    bool operator!=(const Principal& other) const { return !(*this == other); }
+
     std::string ToString() const;
 
     RuleType type = RuleType::kAnd;
@@ -161,6 +173,9 @@ struct Rbac {
     Policy(Policy&& other) noexcept;
     Policy& operator=(Policy&& other) noexcept;
 
+    bool operator==(const Policy& other) const;
+    bool operator!=(const Policy& other) const { return !(*this == other); }
+
     std::string ToString() const;
 
     Permission permissions;
@@ -174,6 +189,9 @@ struct Rbac {
   Rbac(Rbac&& other) noexcept;
   Rbac& operator=(Rbac&& other) noexcept;
 
+  bool operator==(const Rbac& other) const;
+  bool operator!=(const Rbac& other) const { return !(*this == other); }
+
   std::string ToString() const;
 
   // The authorization policy name or empty string in xDS case.
@@ -182,8 +200,8 @@ struct Rbac {
   Action action;
   std::map<std::string, Policy> policies;
 
-  AuditCondition audit_condition;
-  std::vector<std::unique_ptr<experimental::AuditLoggerFactory::Config>>
+  AuditCondition audit_condition = AuditCondition::kNone;
+  std::vector<std::shared_ptr<const experimental::AuditLoggerFactory::Config>>
       logger_configs;
 };
 

data/src/core/lib/security/authorization/stdout_logger.cc

@@ -57,13 +57,13 @@ std::string StdoutAuditLoggerFactory::Config::ToString() const { return "{}"; }
 
 absl::string_view StdoutAuditLoggerFactory::name() const { return kName; }
 
-absl::StatusOr<std::unique_ptr<AuditLoggerFactory::Config>>
+absl::StatusOr<std::shared_ptr<const AuditLoggerFactory::Config>>
 StdoutAuditLoggerFactory::ParseAuditLoggerConfig(const Json&) {
-  return std::make_unique<StdoutAuditLoggerFactory::Config>();
+  return std::make_shared<StdoutAuditLoggerFactory::Config>();
 }
 
 std::unique_ptr<AuditLogger> StdoutAuditLoggerFactory::CreateAuditLogger(
-    std::unique_ptr<AuditLoggerFactory::Config> config) {
+    std::shared_ptr<const AuditLoggerFactory::Config> config) {
   // Sanity check.
   GRPC_CHECK(config != nullptr);
   GRPC_CHECK_EQ(config->name(), name());

data/src/core/lib/security/authorization/stdout_logger.h

@@ -28,30 +28,31 @@
 namespace grpc_core {
 namespace experimental {
 
-class StdoutAuditLogger : public AuditLogger {
+class StdoutAuditLogger final : public AuditLogger {
  public:
   StdoutAuditLogger() = default;
   absl::string_view name() const override { return "stdout_logger"; }
   void Log(const AuditContext&) override;
 };
 
-class StdoutAuditLoggerFactory : public AuditLoggerFactory {
+class StdoutAuditLoggerFactory final : public AuditLoggerFactory {
  public:
-  class Config : public AuditLoggerFactory::Config {
+  class Config final : public AuditLoggerFactory::Config {
    public:
     Config() = default;
     absl::string_view name() const override;
     std::string ToString() const override;
   };
+
   StdoutAuditLoggerFactory() = default;
 
   absl::string_view name() const override;
 
-  absl::StatusOr<std::unique_ptr<AuditLoggerFactory::Config>>
+  absl::StatusOr<std::shared_ptr<const AuditLoggerFactory::Config>>
   ParseAuditLoggerConfig(const Json& json) override;
 
   std::unique_ptr<AuditLogger> CreateAuditLogger(
-      std::unique_ptr<AuditLoggerFactory::Config>) override;
+      std::shared_ptr<const AuditLoggerFactory::Config> config) override;
 };
 
 }  // namespace experimental

data/src/core/lib/surface/call.cc

@@ -143,11 +143,11 @@ void Call::AddData(channelz::DataSink sink) {
       .Set("encodings_accepted_by_peer",
            encodings_accepted_by_peer_.ToString());
   {
-    MutexLock lock(&peer_mu_);
+    MutexLock lock(peer_mu_);
     properties.Set("peer_string", peer_string_.as_string_view());
   }
   {
-    MutexLock lock(&deadline_mu_);
+    MutexLock lock(deadline_mu_);
     properties.Set("deadline", deadline_);
   }
   sink.AddData("call", properties);
@@ -173,6 +173,11 @@ Call::ParentCall* Call::parent_call() {
 }
 
 absl::Status Call::InitParent(Call* parent, uint32_t propagation_mask) {
+  // Virtual RPCs: Provide a link back to the parent session arena to fetch
+  // context.
+  auto* parent_ctx = arena()->New<ParentCallContext>();
+  parent_ctx->arena = parent->arena()->Ref();
+  arena()->SetContext<ParentCallContext>(parent_ctx);
   child_ = arena()->New<ChildCall>(parent);
 
   parent->InternalRef("child");
@@ -208,7 +213,7 @@ absl::Status Call::InitParent(Call* parent, uint32_t propagation_mask) {
 void Call::PublishToParent(Call* parent) {
   ChildCall* cc = child_;
   ParentCall* pc = parent->GetOrCreateParentCall();
-  MutexLock lock(&pc->child_list_mu);
+  MutexLock lock(pc->child_list_mu);
   if (pc->first_child == nullptr) {
     pc->first_child = this;
     cc->sibling_next = cc->sibling_prev = this;
@@ -229,7 +234,7 @@ void Call::MaybeUnpublishFromParent() {
 
   ParentCall* pc = cc->parent->parent_call();
   {
-    MutexLock lock(&pc->child_list_mu);
+    MutexLock lock(pc->child_list_mu);
     if (this == pc->first_child) {
       pc->first_child = cc->sibling_next;
       if (this == pc->first_child) {
@@ -243,14 +248,6 @@ void Call::MaybeUnpublishFromParent() {
 }
 
 void Call::CancelWithStatus(grpc_status_code status, const char* description) {
-  if (!IsErrorFlattenEnabled()) {
-    CancelWithError(grpc_error_set_int(
-        grpc_error_set_str(
-            absl::Status(static_cast<absl::StatusCode>(status), description),
-            StatusStrProperty::kGrpcMessage, description),
-        StatusIntProperty::kRpcStatus, status));
-    return;
-  }
   if (status == GRPC_STATUS_OK) {
     VLOG(2) << "CancelWithStatus() called with OK status, using UNKNOWN";
     status = GRPC_STATUS_UNKNOWN;
@@ -263,7 +260,7 @@ void Call::PropagateCancellationToChildren() {
   ParentCall* pc = parent_call();
   if (pc != nullptr) {
     Call* child;
-    MutexLock lock(&pc->child_list_mu);
+    MutexLock lock(pc->child_list_mu);
     child = pc->first_child;
     if (child != nullptr) {
       do {
@@ -359,9 +356,8 @@ void Call::HandleCompressionAlgorithmDisabled(
   std::string error_msg =
       absl::StrFormat("Compression algorithm '%s' is disabled.", algo_name);
   LOG(ERROR) << error_msg;
-  CancelWithError(grpc_error_set_int(absl::UnimplementedError(error_msg),
-                                     StatusIntProperty::kRpcStatus,
-                                     GRPC_STATUS_UNIMPLEMENTED));
+  CancelWithError(is_client() ? absl::InternalError(error_msg)
+                              : absl::UnimplementedError(error_msg));
 }
 
 grpc_error_handle Call::UpdateDeadline(Timestamp deadline) {
@@ -372,9 +368,7 @@ grpc_error_handle Call::UpdateDeadline(Timestamp deadline) {
   if (deadline >= deadline_) return absl::OkStatus();
   if (deadline < Timestamp::Now()) {
     lock.Release();
-    grpc_error_handle error = grpc_error_set_int(
-        absl::DeadlineExceededError("Deadline Exceeded"),
-        StatusIntProperty::kRpcStatus, GRPC_STATUS_DEADLINE_EXCEEDED);
+    grpc_error_handle error = absl::DeadlineExceededError("Deadline Exceeded");
     CancelWithError(error);
     return error;
   }
@@ -392,7 +386,7 @@ grpc_error_handle Call::UpdateDeadline(Timestamp deadline) {
 
 void Call::ResetDeadline() {
   {
-    MutexLock lock(&deadline_mu_);
+    MutexLock lock(deadline_mu_);
     if (deadline_ == Timestamp::InfFuture()) return;
     if (!arena_->GetContext<grpc_event_engine::experimental::EventEngine>()
              ->Cancel(deadline_task_)) {
@@ -408,9 +402,7 @@ void Call::Run() {
   GRPC_TRACE_LOG(call, INFO)
       << "call deadline expired "
       << GRPC_DUMP_ARGS(Timestamp::Now(), send_deadline_);
-  CancelWithError(grpc_error_set_int(
-      absl::DeadlineExceededError("Deadline Exceeded"),
-      StatusIntProperty::kRpcStatus, GRPC_STATUS_DEADLINE_EXCEEDED));
+  CancelWithError(absl::DeadlineExceededError("Deadline Exceeded"));
   InternalUnref("deadline[run]");
 }
 
@@ -629,7 +621,7 @@ const char* grpc_call_error_to_string(grpc_call_error error) {
     case GRPC_CALL_OK:
       return "GRPC_CALL_OK";
   }
-  GPR_UNREACHABLE_CODE(return "GRPC_CALL_ERROR_UNKNOW");
+  GPR_UNREACHABLE_CODE(return "GRPC_CALL_ERROR_UNKNOWN");
 }
 
 void grpc_call_run_in_event_engine(const grpc_call* call,