grpc 1.81.1 → 1.85.0

data/include/grpc/credentials.h

@@ -60,6 +60,14 @@ grpc_service_account_jwt_access_credentials_create(const char* json_key,
 GRPCAPI grpc_call_credentials* grpc_external_account_credentials_create(
     const char* json_string, const char* scopes_string);
 
+/** Builds Google Distributed Cloud Hosting Service Account credentials.
+- json_string is the JSON string containing the service account key.
+- audience_string is the intended recipient or service.
+  This API is used for experimental purposes for now and may change in the
+ future. */
+GRPCAPI grpc_call_credentials* grpc_gdch_service_account_credentials_create(
+    const char* json_string, const char* audience_string);
+
 /** Creates an Oauth2 Refresh Token credentials object for connecting to Google.
    May return NULL if the input is invalid.
    WARNING: Do NOT use this credentials to connect to a non-google service as
@@ -765,6 +773,8 @@ typedef struct grpc_tls_custom_verification_check_request {
      * This value will only be filled if the cryptographic peer certificate
      * verification was successful */
     const char* verified_root_cert_subject;
+    /* The negotiated key exchange group. */
+    const char* negotiated_key_exchange_group;
   } peer_info;
 } grpc_tls_custom_verification_check_request;
 

data/include/grpc/event_engine/memory_allocator.h

@@ -22,6 +22,7 @@
 #include <algorithm>
 #include <memory>
 #include <type_traits>
+#include <utility>
 #include <vector>
 
 namespace grpc_event_engine {

data/include/grpc/grpc.h

@@ -320,6 +320,9 @@ GRPCAPI grpc_channel* grpc_lame_client_channel_create(
 /** Close and destroy a grpc channel */
 GRPCAPI void grpc_channel_destroy(grpc_channel* channel);
 
+/** Returns a vtable for storing grpc_channel_args in a channel arg. */
+GRPCAPI const grpc_arg_pointer_vtable* grpc_channel_args_arg_vtable(void);
+
 /** Error handling for grpc_call
    Most grpc_call functions return a grpc_error. If the error is not GRPC_OK
    then the operation failed due to some unsatisfied precondition.
@@ -446,19 +449,18 @@ typedef struct {
 
 typedef struct grpc_server_config_fetcher grpc_server_config_fetcher;
 
+/** EXPERIMENTAL.  Channel arg vtable for server config fetcher. */
+GRPCAPI const grpc_arg_pointer_vtable* grpc_server_config_fetcher_arg_vtable(
+    void);
+
 /** EXPERIMENTAL.  Creates an xDS config fetcher. */
 GRPCAPI grpc_server_config_fetcher* grpc_server_config_fetcher_xds_create(
     grpc_server_xds_status_notifier notifier, const grpc_channel_args* args);
 
-/** EXPERIMENTAL.  Destroys a config fetcher. */
-GRPCAPI void grpc_server_config_fetcher_destroy(
+/** EXPERIMENTAL.  Unrefs a config fetcher. */
+GRPCAPI void grpc_server_config_fetcher_unref(
     grpc_server_config_fetcher* config_fetcher);
 
-/** EXPERIMENTAL.  Sets the server's config fetcher.  Takes ownership.
-    Must be called before adding ports */
-GRPCAPI void grpc_server_set_config_fetcher(
-    grpc_server* server, grpc_server_config_fetcher* config_fetcher);
-
 /** Add a HTTP2 over an encrypted link over tcp listener.
    Returns bound port number on success, 0 on failure.
    REQUIRES: server not started */

data/include/grpc/grpc_audit_logging.h

@@ -78,11 +78,11 @@ class AuditLoggerFactory {
   virtual ~AuditLoggerFactory() = default;
   virtual absl::string_view name() const = 0;
 
-  virtual absl::StatusOr<std::unique_ptr<Config>> ParseAuditLoggerConfig(
+  virtual absl::StatusOr<std::shared_ptr<const Config>> ParseAuditLoggerConfig(
       const Json& json) = 0;
 
   virtual std::unique_ptr<AuditLogger> CreateAuditLogger(
-      std::unique_ptr<AuditLoggerFactory::Config>) = 0;
+      std::shared_ptr<const Config> config) = 0;
 };
 
 // Registers an audit logger factory. This should only be called during

data/include/grpc/grpc_security_constants.h

@@ -44,6 +44,8 @@ extern "C" {
 // https://www.openssl.org/docs/man1.1.0/man3/SSL_get_peer_cert_chain.html.
 #define GRPC_X509_PEM_CERT_CHAIN_PROPERTY_NAME "x509_pem_cert_chain"
 #define GRPC_SSL_SESSION_REUSED_PROPERTY "ssl_session_reused"
+#define GRPC_SSL_NEGOTIATED_KEY_EXCHANGE_GROUP_PROPERTY_NAME \
+  "ssl_negotiated_key_exchange_group"
 #define GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME "security_level"
 #define GRPC_PEER_DNS_PROPERTY_NAME "peer_dns"
 #define GRPC_PEER_SPIFFE_ID_PROPERTY_NAME "peer_spiffe_id"
@@ -155,6 +157,10 @@ typedef enum {
   GRPC_TLS_GROUP_X25519,
   /** X25519_MLKEM768 hybrid key exchange. Post-quantum cryptography. */
   GRPC_TLS_GROUP_X25519_MLKEM768,
+  /** secp384r1 ECDH key exchange. */
+  GRPC_TLS_GROUP_SECP384R1,
+  /** MLKEM1024 key exchange. Post-quantum cryptography. */
+  GRPC_TLS_GROUP_MLKEM1024,
 } grpc_tls_key_exchange_group;
 
 #ifdef __cplusplus

data/include/grpc/impl/channel_arg_names.h

@@ -35,7 +35,7 @@
     Boolean valued. Defaults to false. */
 #define GRPC_ARG_MINIMAL_STACK "grpc.minimal_stack"
 /** Maximum number of concurrent incoming streams to allow on a http2
-    connection. Int valued. Deafult to -1(indicating no explicit limit).*/
+    connection. Int valued. Default to -1(indicating no explicit limit).*/
 #define GRPC_ARG_MAX_CONCURRENT_STREAMS "grpc.max_concurrent_streams"
 /** Maximum message length that the channel can receive. Int valued, bytes.
     -1 means unlimited. Defaults to 4MB(4*1024*1024 bytes). -1 means unlimited.
@@ -120,6 +120,26 @@
     before the request is cancelled */
 #define GRPC_ARG_SERVER_MAX_UNREQUESTED_TIME_IN_SERVER_SECONDS \
   "grpc.server_max_unrequested_time_in_server"
+/** The soft limit on the number of pending requests in the server. Int valued.
+ *  If the number of pending queued requests exceeds this soft limit, then the
+ *  server will start to probabilistically reject new incoming requests up until
+ *  the hard limit. Defaults to 1000.
+ *  Note: It is not recommended to change this value unless the operational
+ *  implications are fully understood.
+ */
+#define GRPC_ARG_SERVER_MAX_PENDING_REQUESTS "grpc.server.max_pending_requests"
+/** The hard limit on the number of pending requests in the server. Int valued.
+ *  If the number of pending queued requests reaches this hard limit, all new
+ *  incoming requests will be rejected. Defaults to 3000.
+ *  Note: It is not recommended to change this value unless the operational
+ *  implications are fully understood.
+ */
+#define GRPC_ARG_SERVER_MAX_PENDING_REQUESTS_HARD_LIMIT \
+  "grpc.server.max_pending_requests_hard_limit"
+/** A pointer argument key. The value is a pointer to a grpc_channel_args
+ *  struct containing the subset of options for child channels.
+ */
+#define GRPC_ARG_CHILD_CHANNEL_ARGS "grpc.child_channel.args"
 /** Channel arg to override the http2 :scheme header. String valued. */
 #define GRPC_ARG_HTTP2_SCHEME "grpc.http2_scheme"
 /** How many pings can the client send before needing to send a data/header
@@ -270,6 +290,15 @@
   "grpc.experimental.tcp_min_read_chunk_size"
 #define GRPC_ARG_TCP_MAX_READ_CHUNK_SIZE \
   "grpc.experimental.tcp_max_read_chunk_size"
+/** Channel arg (integer) setting an opt-in upper bound, in bytes, on the
+   adaptive read buffer size that a single TCP endpoint may preallocate for
+   reads. When unset (the default) the read buffer target grows as before,
+   preserving historical behavior. When set, the adaptive read target is
+   clamped to this value so occasional large reads do not leave a permanently
+   high read-buffer high-watermark. Unlike GRPC_ARG_TCP_MAX_READ_CHUNK_SIZE,
+   this does not change per-socket slice sizing. **/
+#define GRPC_ARG_TCP_MAX_READ_BUFFER_SIZE \
+  "grpc.experimental.tcp_max_read_buffer_size"
 /* TCP TX Zerocopy enable state: zero is disabled, non-zero is enabled. By
    default, it is disabled. */
 #define GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED \
@@ -441,5 +470,14 @@
 /** \} */
 /** If non-zero, enable TCP tracing and stats collection. */
 #define GRPC_ARG_TCP_TRACING_ENABLED "grpc.tcp_tracing_enabled"
+/* Enable tracing full buffer payloads for TCP telemetry. */
+#define GRPC_ARG_TCP_TRACE_FULL_BUFFER "grpc.experimental.tcp_trace_full_buffer"
+/** Server config fetcher. */
+#define GRPC_ARG_SERVER_CONFIG_FETCHER "grpc.server_config_fetcher"
+/** Set the maximum size of a security frame that can be received on a HTTP2
+ * Connection. Check file core/ext/transport/chttp2/transport/frame.cc for
+ * details on the Security Frame.
+ */
+#define GRPC_ARG_MAX_SECURITY_FRAME_SIZE "grpc.http2.max_security_frame_size"
 
 #endif /* GRPC_IMPL_CHANNEL_ARG_NAMES_H */

data/src/core/call/call_filters.h

@@ -89,9 +89,10 @@
 //   failure (in which case the call will be aborted).
 //   useful for cases where the exact metadata returned needs to be customized.
 // It's also acceptable to return a promise that resolves to the
-// relevant return type listed above.
+// relevant return type listed above (except for OnClientToServerHalfClose
+// and OnServerTrailingMetadata, which must be synchronous).
 //
-// OnFinalize is added to intecept call finalization.
+// OnFinalize is added to intercept call finalization.
 // It must have one of the signatures:
 // - static inline const NoInterceptor OnFinalize:
 //   the filter does not intercept call finalization.
@@ -276,7 +277,7 @@ struct CallConstructor {
 
 template <typename FilterType>
 struct CallConstructor<FilterType,
-                       absl::void_t<decltype(typename FilterType::Call(
+                       std::void_t<decltype(typename FilterType::Call(
                            static_cast<FilterType*>(nullptr)))>> {
   static void Construct(void* call_data, FilterType* channel) {
     new (call_data) typename FilterType::Call(channel);
@@ -887,7 +888,7 @@ template <typename FilterType, typename T, typename R,
           R (FilterType::Call::*impl)(typename T::element_type&)>
 struct AddOpImpl<
     FilterType, T, R (FilterType::Call::*)(typename T::element_type&), impl,
-    absl::enable_if_t<std::is_same<absl::Status, PromiseResult<R>>::value>> {
+    std::enable_if_t<std::is_same<absl::Status, PromiseResult<R>>::value>> {
   static void Add(FilterType* channel_data, size_t call_offset, Layout<T>& to) {
     class Promise {
      public:
@@ -939,8 +940,8 @@ template <typename FilterType, typename T, typename R,
 struct AddOpImpl<
     FilterType, T,
     R (FilterType::Call::*)(typename T::element_type&, FilterType*), impl,
-    absl::enable_if_t<!std::is_same<R, absl::Status>::value &&
-                      std::is_same<absl::Status, PromiseResult<R>>::value>> {
+    std::enable_if_t<!std::is_same<R, absl::Status>::value &&
+                     std::is_same<absl::Status, PromiseResult<R>>::value>> {
   static void Add(FilterType* channel_data, size_t call_offset, Layout<T>& to) {
     class Promise {
      public:
@@ -992,8 +993,8 @@ struct AddOpImpl<
 template <typename FilterType, typename T, typename R,
           R (FilterType::Call::*impl)(T, FilterType*)>
 struct AddOpImpl<FilterType, T, R (FilterType::Call::*)(T, FilterType*), impl,
-                 absl::enable_if_t<std::is_same<absl::StatusOr<T>,
-                                                PromiseResult<R>>::value>> {
+                 std::enable_if_t<std::is_same<absl::StatusOr<T>,
+                                               PromiseResult<R>>::value>> {
   static void Add(FilterType* channel_data, size_t call_offset, Layout<T>& to) {
 #if defined(__GNUC__) && __GNUC__ == 9
     // Workaround for a bug in GNU C++ 9 compilers that fail to compile this
@@ -1197,7 +1198,7 @@ struct StackData {
   // we have exactly one caller for is warranted for a more thorough testing
   // story.
   template <typename FilterType>
-  absl::enable_if_t<!std::is_empty<typename FilterType::Call>::value, size_t>
+  std::enable_if_t<!std::is_empty<typename FilterType::Call>::value, size_t>
   AddFilterConstructor(FilterType* channel_data) {
     const size_t alignment = alignof(typename FilterType::Call);
     call_data_alignment = std::max(call_data_alignment, alignment);
@@ -1218,7 +1219,7 @@ struct StackData {
   }
 
   template <typename FilterType>
-  absl::enable_if_t<
+  std::enable_if_t<
       std::is_empty<typename FilterType::Call>::value &&
           !std::is_trivially_constructible<typename FilterType::Call>::value,
       size_t>
@@ -1237,7 +1238,7 @@ struct StackData {
   }
 
   template <typename FilterType>
-  absl::enable_if_t<
+  std::enable_if_t<
       std::is_empty<typename FilterType::Call>::value &&
           std::is_trivially_constructible<typename FilterType::Call>::value,
       size_t>
@@ -1248,7 +1249,7 @@ struct StackData {
   }
 
   template <typename FilterType>
-  absl::enable_if_t<
+  std::enable_if_t<
       !std::is_trivially_destructible<typename FilterType::Call>::value>
   AddFilterDestructor(size_t call_offset) {
     filter_destructor.push_back(FilterDestructor{
@@ -1260,7 +1261,7 @@ struct StackData {
   }
 
   template <typename FilterType>
-  absl::enable_if_t<
+  std::enable_if_t<
       std::is_trivially_destructible<typename FilterType::Call>::value>
   AddFilterDestructor(size_t) {}
 
@@ -1976,10 +1977,15 @@ class CallFilters {
   // Returns a promise that resolves to a StatusFlag indicating success
   StatusFlag PushServerInitialMetadata(ServerMetadataHandle md) {
     push_server_initial_metadata_ = std::move(md);
-    return call_state_.PushServerInitialMetadata();
+    auto flag = call_state_.PushServerInitialMetadata();
+    if (!IsStatusOk(flag)) {
+      push_server_initial_metadata_ = nullptr;
+    }
+    return flag;
   }
   // Client: Fetch server initial metadata
-  // Returns a promise that resolves to ValueOrFailure<ServerMetadataHandle>
+  // Returns a promise that resolves to
+  // ValueOrFailure<std::optional<ServerMetadataHandle>>
   GRPC_MUST_USE_RESULT auto PullServerInitialMetadata() {
     return Seq(
         [this]() {
@@ -2015,7 +2021,13 @@ class CallFilters {
     GRPC_DCHECK_NE(message.get(), nullptr);
     GRPC_DCHECK_EQ(push_client_to_server_message_.get(), nullptr);
     push_client_to_server_message_ = std::move(message);
-    return [this]() { return call_state_.PollPushClientToServerMessage(); };
+    return Map([this]() { return call_state_.PollPushClientToServerMessage(); },
+               [this](StatusFlag r) {
+                 if (!IsStatusOk(r)) {
+                   push_client_to_server_message_ = nullptr;
+                 }
+                 return r;
+               });
   }
   // Client: Indicate that no more messages will be sent
   void FinishClientToServerSends() { call_state_.ClientToServerHalfClose(); }
@@ -2047,7 +2059,13 @@ class CallFilters {
   GRPC_MUST_USE_RESULT auto PushServerToClientMessage(MessageHandle message) {
     call_state_.BeginPushServerToClientMessage();
     push_server_to_client_message_ = std::move(message);
-    return [this]() { return call_state_.PollPushServerToClientMessage(); };
+    return Map([this]() { return call_state_.PollPushServerToClientMessage(); },
+               [this](StatusFlag r) {
+                 if (!IsStatusOk(r)) {
+                   push_server_to_client_message_ = nullptr;
+                 }
+                 return r;
+               });
   }
   // Server: Fetch server to client message
   // Returns a promise that resolves to ServerToClientNextMessage

data/src/core/call/call_spine.h

@@ -33,6 +33,7 @@
 #include "src/core/lib/promise/pipe.h"
 #include "src/core/lib/promise/prioritized_race.h"
 #include "src/core/lib/promise/promise.h"
+#include "src/core/lib/promise/race.h"
 #include "src/core/lib/promise/status_flag.h"
 #include "src/core/lib/promise/try_seq.h"
 #include "src/core/util/dual_ref_counted.h"
@@ -223,10 +224,9 @@ class CallSpine final : public Party, public channelz::DataSource {
   template <typename Promise>
   auto UntilCallCompletes(Promise&& promise) {
     using Result = PromiseResult<std::decay_t<Promise>>;
-    return PrioritizedRace(std::forward<Promise>(promise),
-                           Map(WasCancelled(), [](bool) {
-                             return FailureStatusCast<Result>(Failure{});
-                           }));
+    return Race(Map(WasCancelled(),
+                    [](bool) { return FailureStatusCast<Result>(Failure{}); }),
+                std::forward<Promise>(promise));
   }
 
   template <typename PromiseFactory>

data/src/core/call/client_call.cc

@@ -46,6 +46,7 @@
 #include "src/core/lib/promise/try_seq.h"
 #include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/slice/slice_buffer.h"
+#include "src/core/lib/surface/call_utils.h"
 #include "src/core/lib/surface/completion_queue.h"
 #include "src/core/telemetry/stats.h"
 #include "src/core/telemetry/stats_data.h"
@@ -62,7 +63,9 @@ namespace grpc_core {
 
 namespace {
 
-grpc_call_error ValidateClientBatch(const grpc_op* ops, size_t nops) {
+grpc_call_error ValidateClientBatch(
+    const grpc_op* ops, size_t nops,
+    CallOpInvariantsValidator& call_op_invariants_validator) {
   BitSet<8> got_ops;
   for (size_t op_idx = 0; op_idx < nops; op_idx++) {
     const grpc_op& op = ops[op_idx];
@@ -94,7 +97,7 @@ grpc_call_error ValidateClientBatch(const grpc_op* ops, size_t nops) {
     if (got_ops.is_set(op.op)) return GRPC_CALL_ERROR_TOO_MANY_OPERATIONS;
     got_ops.set(op.op);
   }
-  return GRPC_CALL_OK;
+  return call_op_invariants_validator.ValidateAndCommit(ops, nops);
 }
 
 }  // namespace
@@ -161,7 +164,8 @@ grpc_call_error ClientCall::StartBatch(const grpc_op* ops, size_t nops,
     EndOpImmediately(cq_, notify_tag, is_notify_tag_closure);
     return GRPC_CALL_OK;
   }
-  const grpc_call_error validation_result = ValidateClientBatch(ops, nops);
+  const grpc_call_error validation_result =
+      ValidateClientBatch(ops, nops, call_op_invariants_validator_);
   if (validation_result != GRPC_CALL_OK) {
     return validation_result;
   }
@@ -257,7 +261,7 @@ Party::WakeupHold ClientCall::StartCall(
     const grpc_op& send_initial_metadata_op) {
   GRPC_LATENT_SEE_SCOPE("ClientCall::StartCall");
   auto cur_state = call_state_.load(std::memory_order_acquire);
-  // TODO(akshitpatel): [PH2][P3]: Might need to invoke
+  // TODO(akshitpatel): [PH2][P1]: Might need to invoke
   // PrepareApplicationMetadata here.
   CToMetadata(send_initial_metadata_op.data.send_initial_metadata.metadata,
               send_initial_metadata_op.data.send_initial_metadata.count,
@@ -325,8 +329,12 @@ void ClientCall::CommitBatch(const grpc_op* ops, size_t nops, void* notify_tag,
   }
   if (!is_notify_tag_closure) grpc_cq_begin_op(cq_, notify_tag);
   BatchOpIndex op_index(ops, nops);
-  auto send_message =
-      op_index.OpHandler<GRPC_OP_SEND_MESSAGE>([this](const grpc_op& op) {
+  uint8_t concurrent_ops_to_reset = 0;
+
+  auto send_message = op_index.OpHandler<GRPC_OP_SEND_MESSAGE>(
+      [this, &concurrent_ops_to_reset](const grpc_op& op) {
+        concurrent_ops_to_reset |=
+            CallOpInvariantsValidator::OpBit(GRPC_OP_SEND_MESSAGE);
         SliceBuffer send;
         grpc_slice_buffer_swap(
             &op.data.send_message.send_message->data.raw.slice_buffer,
@@ -344,8 +352,10 @@ void ClientCall::CommitBatch(const grpc_op* ops, size_t nops, void* notify_tag,
               return Success{};
             };
           });
-  auto recv_message =
-      op_index.OpHandler<GRPC_OP_RECV_MESSAGE>([this](const grpc_op& op) {
+  auto recv_message = op_index.OpHandler<GRPC_OP_RECV_MESSAGE>(
+      [this, &concurrent_ops_to_reset](const grpc_op& op) {
+        concurrent_ops_to_reset |=
+            CallOpInvariantsValidator::OpBit(GRPC_OP_RECV_MESSAGE);
         return message_receiver_.MakeBatchOp(op, &started_call_initiator_);
       });
   auto recv_initial_metadata =
@@ -382,7 +392,9 @@ void ClientCall::CommitBatch(const grpc_op* ops, size_t nops, void* notify_tag,
       AllOk<StatusFlag>(
           TrySeq(std::move(send_message), std::move(send_close_from_client)),
           TrySeq(std::move(recv_initial_metadata), std::move(recv_message))),
-      [self = WeakRef()](StatusFlag x) { return x; });
+      [guard = PrimaryOpsCleanup<ClientCall>(WeakRefAsSubclass<ClientCall>(),
+                                             concurrent_ops_to_reset)](
+          StatusFlag x) { return x; });
   Party::WakeupHold wakeup_hold;
   if (const grpc_op* op = op_index.op(GRPC_OP_SEND_INITIAL_METADATA)) {
     wakeup_hold = StartCall(*op);
@@ -443,7 +455,7 @@ void ClientCall::OnReceivedStatus(ServerMetadataHandle server_trailing_metadata,
                           .value_or(GRPC_STATUS_UNKNOWN);
   *out_status = status;
   Slice message_slice;
-  if (!IsErrorFlattenEnabled() || status != GRPC_STATUS_OK) {
+  if (status != GRPC_STATUS_OK) {
     if (Slice* message =
             server_trailing_metadata->get_pointer(GrpcMessageMetadata())) {
       message_slice = message->Ref();

data/src/core/call/client_call.h

@@ -133,6 +133,9 @@ class ClientCall final
     UnorderedStart* next;
   };
 
+  template <typename T>
+  friend class PrimaryOpsCleanup;
+
   void CommitBatch(const grpc_op* ops, size_t nops, void* notify_tag,
                    bool is_notify_tag_closure);
   template <typename Batch>
@@ -178,6 +181,7 @@ class ClientCall final
   // otherwise the server trailing metadata from started_call_initiator_ is
   // authoritative.
   SingleSetPtr<absl::Status> cancel_status_;
+  CallOpInvariantsValidator call_op_invariants_validator_;
   MessageReceiver message_receiver_;
   grpc_completion_queue* const cq_;
   const RefCountedPtr<UnstartedCallDestination> call_destination_;

data/src/core/{lib/security/authorization → call}/evaluate_args.cc

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#include "src/core/lib/security/authorization/evaluate_args.h"
+#include "src/core/call/evaluate_args.h"
 
 #include <grpc/grpc_security_constants.h>
 #include <grpc/support/port_platform.h>
@@ -78,6 +78,10 @@ EvaluateArgs::PerChannelArgs::PerChannelArgs(grpc_auth_context* auth_context,
         GetAuthPropertyValue(auth_context, GRPC_X509_CN_PROPERTY_NAME);
     subject =
         GetAuthPropertyValue(auth_context, GRPC_X509_SUBJECT_PROPERTY_NAME);
+    requested_server_name = GetAuthPropertyValue(
+        auth_context, GRPC_SSL_REQUESTED_SERVER_NAME_PROPERTY_NAME);
+    tls_version =
+        GetAuthPropertyValue(auth_context, GRPC_SSL_TLS_VERSION_PROPERTY_NAME);
   }
   local_address = ParseEndpointUri(
       args.GetString(GRPC_ARG_ENDPOINT_LOCAL_ADDRESS).value_or(""));
@@ -100,6 +104,9 @@ absl::string_view EvaluateArgs::GetAuthority() const {
   if (metadata_ != nullptr) {
     if (auto* authority_md = metadata_->get_pointer(HttpAuthorityMetadata())) {
       authority = authority_md->as_string_view();
+    } else if (auto* host_md = metadata_->get_pointer(HostMetadata())) {
+      // Fall back to the legacy host header.
+      authority = host_md->as_string_view();
     }
   }
   return authority;
@@ -214,4 +221,18 @@ absl::string_view EvaluateArgs::GetSubject() const {
   return channel_args_->subject;
 }
 
+absl::string_view EvaluateArgs::GetRequestedServerName() const {
+  if (channel_args_ == nullptr) {
+    return "";
+  }
+  return channel_args_->requested_server_name;
+}
+
+absl::string_view EvaluateArgs::GetTlsVersion() const {
+  if (channel_args_ == nullptr) {
+    return "";
+  }
+  return channel_args_->tls_version;
+}
+
 }  // namespace grpc_core

data/src/core/{lib/security/authorization → call}/evaluate_args.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
-#define GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
+#ifndef GRPC_SRC_CORE_CALL_EVALUATE_ARGS_H
+#define GRPC_SRC_CORE_CALL_EVALUATE_ARGS_H
 
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>
@@ -50,14 +50,19 @@ class EvaluateArgs final {
     std::vector<absl::string_view> dns_sans;
     absl::string_view common_name;
     absl::string_view subject;
+    absl::string_view requested_server_name;
+    absl::string_view tls_version;
     Address local_address;
     Address peer_address;
   };
 
-  EvaluateArgs(grpc_metadata_batch* metadata, PerChannelArgs* channel_args)
+  EvaluateArgs(grpc_metadata_batch* metadata,
+               const PerChannelArgs* channel_args)
       : metadata_(metadata), channel_args_(channel_args) {}
 
   absl::string_view GetPath() const;
+  // Returns the value of the :authority header, falling back to the legacy
+  // host header if :authority is not present.
   absl::string_view GetAuthority() const;
   absl::string_view GetMethod() const;
   // Returns metadata value(s) for the specified key.
@@ -82,12 +87,21 @@ class EvaluateArgs final {
   std::vector<absl::string_view> GetDnsSans() const;
   absl::string_view GetCommonName() const;
   absl::string_view GetSubject() const;
+  absl::string_view GetRequestedServerName() const;
+  absl::string_view GetTlsVersion() const;
+
+  // Iterates over all metadata entries, invoking encoder->Encode() for each
+  // one.  See grpc_metadata_batch::Encode() for details.
+  template <typename Encoder>
+  void EncodeHeaders(Encoder* encoder) const {
+    if (metadata_ != nullptr) metadata_->Encode(encoder);
+  }
 
  private:
   grpc_metadata_batch* metadata_;
-  PerChannelArgs* channel_args_;
+  const PerChannelArgs* channel_args_;
 };
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
+#endif  // GRPC_SRC_CORE_CALL_EVALUATE_ARGS_H

data/src/core/call/filter_fusion.h

@@ -222,7 +222,7 @@ struct StatusType {
 
 template <typename T>
 struct StatusType<
-    T, absl::enable_if_t<
+    T, std::enable_if_t<
            std::is_same<decltype(IsStatusOk(std::declval<T>())), bool>::value &&
                !std::is_same<T, ServerMetadataHandle>::value &&
                !TakeValueExists<T>::value,
@@ -256,7 +256,7 @@ struct StatusOrType {
 template <typename T, typename U>
 struct StatusOrType<
     T, U,
-    absl::enable_if_t<
+    std::enable_if_t<
         std::is_same<decltype(IsStatusOk(std::declval<T>())), bool>::value &&
             TakeValueExists<T>::value && HasStatusMethod<T>::value &&
             std::is_same<decltype(TakeValue(std::declval<T>())), U>::value,
@@ -271,8 +271,8 @@ template <typename T, typename A, typename R, typename Call,
           R (Call::*method)(A)>
 class AdaptMethod<
     T, R (Call::*)(A), method,
-    absl::enable_if_t<StatusType<R>::value && IsSameExcludingCVRef<T, A>,
-                      void>> {
+    std::enable_if_t<StatusType<R>::value && IsSameExcludingCVRef<T, A>,
+                     void>> {
  public:
   explicit AdaptMethod(Call* call, void* /*filter*/ = nullptr) : call_(call) {}
   auto operator()(Hdl<T> x) {
@@ -290,7 +290,7 @@ class AdaptMethod<
 
 template <typename T, typename R, typename Call, R (Call::*method)()>
 class AdaptMethod<T, R (Call::*)(), method,
-                  absl::enable_if_t<StatusType<R>::value, void>> {
+                  std::enable_if_t<StatusType<R>::value, void>> {
  public:
   explicit AdaptMethod(Call* call, void* /*filter*/ = nullptr) : call_(call) {}
   auto operator()(Hdl<T> x) {
@@ -310,8 +310,8 @@ template <typename T, typename A, typename R, typename Call, typename Derived,
           R (Call::*method)(A, Derived*)>
 class AdaptMethod<
     T, R (Call::*)(A, Derived*), method,
-    absl::enable_if_t<StatusType<R>::value && IsSameExcludingCVRef<T, A>,
-                      void>> {
+    std::enable_if_t<StatusType<R>::value && IsSameExcludingCVRef<T, A>,
+                     void>> {
  public:
   explicit AdaptMethod(Call* call, Derived* filter)
       : call_(call), filter_(filter) {}
@@ -335,8 +335,8 @@ template <typename T, typename A, typename R, typename Call,
           R (Call::*method)(A)>
 class AdaptMethod<
     T, R (Call::*)(A), method,
-    absl::enable_if_t<StatusOrType<R, T>::value && IsSameExcludingCVRef<T, A>,
-                      void>> {
+    std::enable_if_t<StatusOrType<R, T>::value && IsSameExcludingCVRef<T, A>,
+                     void>> {
  public:
   explicit AdaptMethod(Call* call, void* /*filter*/ = nullptr) : call_(call) {}
   auto operator()(Hdl<T> x) {
@@ -355,7 +355,7 @@ class AdaptMethod<
 
 template <typename T, typename R, typename Call, R (Call::*method)()>
 class AdaptMethod<T, R (Call::*)(), method,
-                  absl::enable_if_t<StatusOrType<R, T>::value, void>> {
+                  std::enable_if_t<StatusOrType<R, T>::value, void>> {
  public:
   explicit AdaptMethod(Call* call, void* /*filter*/ = nullptr) : call_(call) {}
   auto operator()(Hdl<T> /*x*/) {
@@ -376,8 +376,8 @@ template <typename T, typename A, typename R, typename Call, typename Derived,
           R (Call::*method)(A, Derived*)>
 class AdaptMethod<
     T, R (Call::*)(A, Derived*), method,
-    absl::enable_if_t<StatusOrType<R, T>::value && IsSameExcludingCVRef<T, A>,
-                      void>> {
+    std::enable_if_t<StatusOrType<R, T>::value && IsSameExcludingCVRef<T, A>,
+                     void>> {
  public:
   using UnwrappedType = decltype(TakeValue(std::declval<R>()));
   static_assert(std::is_same<UnwrappedType, T>::value);
@@ -402,7 +402,7 @@ class AdaptMethod<
 // return a StatusOr<Hdl<T>> type as output
 template <typename T, typename R, typename Call, R (Call::*method)(Hdl<T>)>
 class AdaptMethod<T, R (Call::*)(Hdl<T>), method,
-                  absl::enable_if_t<StatusOrType<R, Hdl<T>>::value, void>> {
+                  std::enable_if_t<StatusOrType<R, Hdl<T>>::value, void>> {
  public:
   explicit AdaptMethod(Call* call, void* /*filter*/ = nullptr) : call_(call) {}
   auto operator()(Hdl<T> x) {
@@ -421,7 +421,7 @@ class AdaptMethod<T, R (Call::*)(Hdl<T>), method,
 
 template <typename T, typename R, typename Call, R (Call::*method)()>
 class AdaptMethod<T, R (Call::*)(), method,
-                  absl::enable_if_t<StatusOrType<R, Hdl<T>>::value, void>> {
+                  std::enable_if_t<StatusOrType<R, Hdl<T>>::value, void>> {
  public:
   explicit AdaptMethod(Call* call, void* /*filter*/ = nullptr) : call_(call) {}
   auto operator()(Hdl<T> /*x*/) {
@@ -441,7 +441,7 @@ class AdaptMethod<T, R (Call::*)(), method,
 template <typename T, typename R, typename Call, typename Derived,
           R (Call::*method)(Hdl<T>, Derived*)>
 class AdaptMethod<T, R (Call::*)(Hdl<T>, Derived*), method,
-                  absl::enable_if_t<StatusOrType<R, Hdl<T>>::value, void>> {
+                  std::enable_if_t<StatusOrType<R, Hdl<T>>::value, void>> {
  public:
   explicit AdaptMethod(Call* call, Derived* filter)
       : call_(call), filter_(filter) {}