grpc 1.82.0 → 1.83.0.pre1

data/src/core/tsi/ssl_transport_security.h

@@ -25,13 +25,19 @@
 #include <grpc/support/port_platform.h>
 #include <openssl/x509.h>
 
+#include <cstdint>
 #include <memory>
 #include <string>
+#include <variant>
+#include <vector>
 
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/spiffe_utils.h"
+#include "src/core/telemetry/metrics.h"
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/ssl_transport_security_utils.h"
 #include "src/core/tsi/transport_security_interface.h"
+#include "src/core/util/ref_counted_ptr.h"
 #include "absl/strings/string_view.h"
 
 // Value for the TSI_CERTIFICATE_TYPE_PEER_PROPERTY property for X509 certs.
@@ -52,6 +58,8 @@
 #define TSI_X509_IP_PEER_PROPERTY "x509_ip"
 #define TSI_X509_VERIFIED_ROOT_CERT_SUBECT_PEER_PROPERTY \
   "x509_verified_root_cert_subject"
+#define TSI_SSL_NEGOTIATED_KEY_EXCHANGE_GROUP \
+  "ssl_negotiated_key_exchange_group"
 
 namespace tsi {
 using RootCertInfo = std::variant<std::string, grpc_core::SpiffeBundleMap>;
@@ -254,6 +262,7 @@ tsi_result tsi_ssl_client_handshaker_factory_create_handshaker(
     const char* server_name_indication, size_t network_bio_buf_size,
     size_t ssl_bio_buf_size,
     std::optional<std::string> alpn_preferred_protocol_list,
+    grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope,
     tsi_handshaker** handshaker);
 
 // Increments reference count of the client handshaker factory.
@@ -273,6 +282,10 @@ void tsi_ssl_client_handshaker_factory_unref(
 typedef struct tsi_ssl_server_handshaker_factory
     tsi_ssl_server_handshaker_factory;
 
+typedef std::variant<std::vector<tsi_ssl_pem_key_cert_pair>,
+                     std::shared_ptr<grpc_core::CertificateSelector>>
+    tsi_ssl_key_cert_pairs;
+
 // TO BE DEPRECATED.
 // Creates a server handshaker factory.
 // - pem_key_cert_pairs is an array private key / certificate chains of the
@@ -295,7 +308,7 @@ typedef struct tsi_ssl_server_handshaker_factory
 // - This method returns TSI_OK on success or TSI_INVALID_PARAMETER in the case
 //   where a parameter is invalid.
 tsi_result tsi_create_ssl_server_handshaker_factory(
-    std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pairs,
+    tsi_ssl_key_cert_pairs pem_key_cert_pairs,
     const char* pem_client_root_certs, int force_client_auth,
     const char* cipher_suites, const char** alpn_protocols,
     uint16_t num_alpn_protocols, tsi_ssl_server_handshaker_factory** factory);
@@ -308,16 +321,17 @@ tsi_result tsi_create_ssl_server_handshaker_factory(
 //   authenticate with an SSL cert. Note that this option is ignored if
 //   pem_client_root_certs is NULL or pem_client_roots_certs_size is 0
 tsi_result tsi_create_ssl_server_handshaker_factory_ex(
-    std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pairs,
-    const char* pem_client_root_certs,
+    tsi_ssl_key_cert_pairs pem_key_cert, const char* pem_client_root_certs,
     tsi_client_certificate_request_type client_certificate_request,
     const char* cipher_suites, const char** alpn_protocols,
     uint16_t num_alpn_protocols, tsi_ssl_server_handshaker_factory** factory);
 
 struct tsi_ssl_server_handshaker_options {
   // pem_key_cert_pairs is an array private key / certificate chains of the
-  // server.
-  std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pairs;
+  // server, or a certificate selector. The array of key / certificate chains is
+  // to support SNI. The certificate selector will be in charge of this. So they
+  // are mutually exclusive.
+  tsi_ssl_key_cert_pairs pem_key_cert_pairs;
   // client_certificate_request, if set to non-zero will force the client to
   // authenticate with an SSL cert. Note that this option is ignored if
   // root_cert_info is NULL
@@ -416,7 +430,9 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
 //  where a parameter is invalid.
 tsi_result tsi_ssl_server_handshaker_factory_create_handshaker(
     tsi_ssl_server_handshaker_factory* factory, size_t network_bio_buf_size,
-    size_t ssl_bio_buf_size, tsi_handshaker** handshaker);
+    size_t ssl_bio_buf_size,
+    grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope,
+    tsi_handshaker** handshaker);
 
 // Decrements reference count of the handshaker factory. Handshaker factory will
 // be destroyed once no references exist.

data/src/core/tsi/ssl_transport_security_utils.cc

@@ -456,6 +456,8 @@ absl::StatusOr<absl::string_view> ConvertKeyExchangeGroupToString(
   switch (group) {
     case GRPC_TLS_GROUP_SECP256R1:
       return "P-256";
+    case GRPC_TLS_GROUP_SECP384R1:
+      return "P-384";
     case GRPC_TLS_GROUP_X25519:
       return "X25519";
     case GRPC_TLS_GROUP_X25519_MLKEM768:

data/src/core/tsi/transport_security.h

@@ -83,6 +83,13 @@ struct tsi_handshaker_vtable {
   void (*shutdown)(tsi_handshaker* self);
 };
 struct tsi_handshaker {
+  tsi_handshaker() = default;
+  explicit tsi_handshaker(const tsi_handshaker_vtable* vtable)
+      : vtable(vtable),
+        frame_protector_created(false),
+        handshaker_result_created(false),
+        handshake_shutdown(false) {}
+
   const tsi_handshaker_vtable* vtable;
   bool frame_protector_created;
   bool handshaker_result_created;

data/src/core/util/http_client/httpcli.cc

@@ -176,10 +176,7 @@ HttpRequest::HttpRequest(
       pollent_(pollent),
       pollset_set_(grpc_pollset_set_create()),
       test_only_generate_response_(std::move(test_only_generate_response)),
-      use_event_engine_dns_resolver_(
-          IsEventEngineDnsNonClientChannelEnabled() &&
-          !grpc_event_engine::experimental::
-              EventEngineExperimentDisabledForPython()),
+      use_event_engine_dns_resolver_(IsEventEngineDnsNonClientChannelEnabled()),
       resolver_(!use_event_engine_dns_resolver_ ? GetDNSResolver() : nullptr),
       ee_resolver_(
           use_event_engine_dns_resolver_

data/src/core/util/http_client/httpcli_security_connector.cc

@@ -94,7 +94,8 @@ class grpc_httpcli_ssl_channel_security_connector final
       tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
           handshaker_factory_, secure_peer_name_, /*network_bio_buf_size=*/0,
           /*ssl_bio_buf_size=*/0,
-          args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS), &handshaker);
+          args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS),
+          /*collection_scope=*/nullptr, &handshaker);
       if (result != TSI_OK) {
         LOG(ERROR) << "Handshaker creation failed with error "
                    << tsi_result_to_string(result);

data/src/core/util/status_helper.cc

@@ -29,7 +29,6 @@
 #include "src/core/lib/slice/percent_encoding.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/status_conversion.h"
-#include "src/core/util/time.h"
 #include "upb/base/string_view.h"
 #include "upb/mem/arena.hpp"
 #include "absl/log/check.h"
@@ -47,16 +46,9 @@ namespace {
 
 #define TYPE_URL_PREFIX "type.googleapis.com/grpc.status."
 #define TYPE_INT_TAG "int."
-#define TYPE_STR_TAG "str."
-#define TYPE_TIME_TAG "time."
-#define TYPE_CHILDREN_TAG "children"
 #define TYPE_URL(name) (TYPE_URL_PREFIX name)
 const absl::string_view kTypeUrlPrefix = TYPE_URL_PREFIX;
 const absl::string_view kTypeIntTag = TYPE_INT_TAG;
-const absl::string_view kTypeStrTag = TYPE_STR_TAG;
-const absl::string_view kTypeTimeTag = TYPE_TIME_TAG;
-const absl::string_view kTypeChildrenTag = TYPE_CHILDREN_TAG;
-const absl::string_view kChildrenPropertyUrl = TYPE_URL(TYPE_CHILDREN_TAG);
 
 const char* GetStatusIntPropertyUrl(StatusIntProperty key) {
   switch (key) {
@@ -74,47 +66,6 @@ const char* GetStatusIntPropertyUrl(StatusIntProperty key) {
   GPR_UNREACHABLE_CODE(return "unknown");
 }
 
-const char* GetStatusStrPropertyUrl(StatusStrProperty key) {
-  switch (key) {
-    case StatusStrProperty::kGrpcMessage:
-      return TYPE_URL(TYPE_STR_TAG "grpc_message");
-  }
-  GPR_UNREACHABLE_CODE(return "unknown");
-}
-
-void EncodeUInt32ToBytes(uint32_t v, char* buf) {
-  buf[0] = v & 0xFF;
-  buf[1] = (v >> 8) & 0xFF;
-  buf[2] = (v >> 16) & 0xFF;
-  buf[3] = (v >> 24) & 0xFF;
-}
-
-uint32_t DecodeUInt32FromBytes(const char* buf) {
-  const unsigned char* ubuf = reinterpret_cast<const unsigned char*>(buf);
-  return ubuf[0] | (static_cast<uint32_t>(ubuf[1]) << 8) |
-         (static_cast<uint32_t>(ubuf[2]) << 16) |
-         (static_cast<uint32_t>(ubuf[3]) << 24);
-}
-
-std::vector<absl::Status> ParseChildren(absl::Cord children) {
-  std::vector<absl::Status> result;
-  upb::Arena arena;
-  // Cord is flattened to iterate the buffer easily at the cost of memory copy.
-  // TODO(veblush): Optimize this once CordReader is introduced.
-  absl::string_view buf = children.Flatten();
-  size_t cur = 0;
-  while (buf.size() - cur >= sizeof(uint32_t)) {
-    size_t msg_size = DecodeUInt32FromBytes(buf.data() + cur);
-    cur += sizeof(uint32_t);
-    CHECK(buf.size() - cur >= msg_size);
-    google_rpc_Status* msg =
-        google_rpc_Status_parse(buf.data() + cur, msg_size, arena.ptr());
-    cur += msg_size;
-    result.push_back(internal::StatusFromProto(msg));
-  }
-  return result;
-}
-
 }  // namespace
 
 absl::Status StatusCreate(absl::StatusCode code, absl::string_view msg,
@@ -144,7 +95,7 @@ absl::Status ReplaceStatusCode(const absl::Status& status,
 }  // namespace
 
 void StatusSetInt(absl::Status* status, StatusIntProperty key, intptr_t value) {
-  if (IsErrorFlattenEnabled() && key == StatusIntProperty::kRpcStatus) {
+  if (key == StatusIntProperty::kRpcStatus) {
     // When setting the RPC status, just replace the top-level status code.
     *status = ReplaceStatusCode(*status, static_cast<absl::StatusCode>(value));
     return;
@@ -155,7 +106,7 @@ void StatusSetInt(absl::Status* status, StatusIntProperty key, intptr_t value) {
 
 std::optional<intptr_t> StatusGetInt(const absl::Status& status,
                                      StatusIntProperty key) {
-  if (IsErrorFlattenEnabled() && key == StatusIntProperty::kRpcStatus) {
+  if (key == StatusIntProperty::kRpcStatus) {
     return static_cast<intptr_t>(status.code());
   }
   auto p = status.GetPayload(GetStatusIntPropertyUrl(key));
@@ -175,100 +126,37 @@ std::optional<intptr_t> StatusGetInt(const absl::Status& status,
   return {};
 }
 
-namespace {
-
-absl::Status ReplaceStatusMessage(const absl::Status& status,
-                                  absl::string_view message) {
-  absl::Status new_status(status.code(), message);
-  status.ForEachPayload(
+void StatusAddChild(absl::Status* status, absl::Status child) {
+  // If the child is OK, there's nothing to do.
+  if (child.ok()) return;
+  // If the parent is OK, replace it with the child.
+  if (status->ok()) {
+    *status = std::move(child);
+    return;
+  }
+  // Parent and child are both non-OK, so we need to merge.
+  absl::Status new_status(
+      // Prefer any other code over UNKNOWN.
+      status->code() == absl::StatusCode::kUnknown ? child.code()
+                                                   : status->code(),
+      absl::StrCat(status->message(), " (", child.message(), ")"));
+  // TODO(roth): Remove this once we eliminate all status attributes.
+  status->ForEachPayload(
       [&](absl::string_view type_url, const absl::Cord& payload) {
         new_status.SetPayload(type_url, payload);
       });
-  return new_status;
-}
-
-}  // namespace
-
-void StatusSetStr(absl::Status* status, StatusStrProperty key,
-                  absl::string_view value) {
-  if (IsErrorFlattenEnabled() && key == StatusStrProperty::kGrpcMessage) {
-    if (!status->ok()) {
-      *status = ReplaceStatusMessage(
-          *status, status->message().empty()
-                       ? value
-                       : absl::StrCat(value, " (", status->message(), ")"));
-    }
-    return;
-  }
-  status->SetPayload(GetStatusStrPropertyUrl(key), absl::Cord(value));
-}
-
-std::optional<std::string> StatusGetStr(const absl::Status& status,
-                                        StatusStrProperty key) {
-  if (IsErrorFlattenEnabled() && key == StatusStrProperty::kGrpcMessage) {
-    return std::string(status.message());
-  }
-  auto p = status.GetPayload(GetStatusStrPropertyUrl(key));
-  if (p.has_value()) {
-    return std::string(*p);
-  }
-  return {};
-}
-
-void StatusAddChild(absl::Status* status, absl::Status child) {
-  if (IsErrorFlattenEnabled()) {
-    // If the child is OK, there's nothing to do.
-    if (child.ok()) return;
-    // If the parent is OK, replace it with the child.
-    if (status->ok()) {
-      *status = std::move(child);
-      return;
-    }
-    // Parent and child are both non-OK, so we need to merge.
-    absl::Status new_status(
-        // Prefer any other code over UNKNOWN.
-        status->code() == absl::StatusCode::kUnknown ? child.code()
-                                                     : status->code(),
-        absl::StrCat(status->message(), " (", child.message(), ")"));
-    // TODO(roth): Remove this once we eliminate all status attributes.
-    status->ForEachPayload(
-        [&](absl::string_view type_url, const absl::Cord& payload) {
+  child.ForEachPayload(
+      [&](absl::string_view type_url, const absl::Cord& payload) {
+        // If the original error already has the attribute, don't overwrite
+        // it.
+        if (!new_status.GetPayload(type_url).has_value()) {
           new_status.SetPayload(type_url, payload);
-        });
-    child.ForEachPayload(
-        [&](absl::string_view type_url, const absl::Cord& payload) {
-          // If the original error already has the attribute, don't overwrite
-          // it.
-          if (!new_status.GetPayload(type_url).has_value()) {
-            new_status.SetPayload(type_url, payload);
-          }
-        });
-    *status = std::move(new_status);
-    return;
-  }
-  upb::Arena arena;
-  // Serialize msg to buf
-  google_rpc_Status* msg = internal::StatusToProto(child, arena.ptr());
-  size_t buf_len = 0;
-  char* buf = google_rpc_Status_serialize(msg, arena.ptr(), &buf_len);
-  // Append (msg-length and msg) to children payload
-  auto old_children = status->GetPayload(kChildrenPropertyUrl);
-  absl::Cord children;
-  if (old_children.has_value()) {
-    children = *old_children;
-  }
-  char head_buf[sizeof(uint32_t)];
-  EncodeUInt32ToBytes(buf_len, head_buf);
-  children.Append(absl::string_view(head_buf, sizeof(uint32_t)));
-  children.Append(absl::string_view(buf, buf_len));
-  status->SetPayload(kChildrenPropertyUrl, std::move(children));
+        }
+      });
+  *status = std::move(new_status);
 }
 
-std::vector<absl::Status> StatusGetChildren(absl::Status status) {
-  auto children = status.GetPayload(kChildrenPropertyUrl);
-  return children.has_value() ? ParseChildren(*children)
-                              : std::vector<absl::Status>();
-}
+std::vector<absl::Status> StatusGetChildren(absl::Status status) { return {}; }
 
 std::string StatusToString(const absl::Status& status) {
   if (status.ok()) {
@@ -280,71 +168,62 @@ std::string StatusToString(const absl::Status& status) {
     absl::StrAppend(&head, ":", status.message());
   }
   std::vector<std::string> kvs;
-  std::optional<absl::Cord> children;
-  status.ForEachPayload([&](absl::string_view type_url,
-                            const absl::Cord& payload) {
-    if (absl::StartsWith(type_url, kTypeUrlPrefix)) {
-      type_url.remove_prefix(kTypeUrlPrefix.size());
-      if (type_url == kTypeChildrenTag) {
-        children = payload;
-        return;
-      }
-      absl::string_view payload_view;
-      std::string payload_storage;
-      if (payload.TryFlat().has_value()) {
-        payload_view = payload.TryFlat().value();
-      } else {
-        payload_storage = std::string(payload);
-        payload_view = payload_storage;
-      }
-      if (absl::StartsWith(type_url, kTypeIntTag)) {
-        type_url.remove_prefix(kTypeIntTag.size());
-        kvs.push_back(absl::StrCat(type_url, ":", payload_view));
-      } else if (absl::StartsWith(type_url, kTypeStrTag)) {
-        type_url.remove_prefix(kTypeStrTag.size());
-        kvs.push_back(absl::StrCat(type_url, ":\"",
-                                   absl::CHexEscape(payload_view), "\""));
-      } else if (absl::StartsWith(type_url, kTypeTimeTag)) {
-        type_url.remove_prefix(kTypeTimeTag.size());
-        absl::Time t;
-        if (absl::ParseTime(absl::RFC3339_full, payload_view, &t, nullptr)) {
-          kvs.push_back(
-              absl::StrCat(type_url, ":\"", absl::FormatTime(t), "\""));
+  status.ForEachPayload(
+      [&](absl::string_view type_url, const absl::Cord& payload) {
+        if (absl::StartsWith(type_url, kTypeUrlPrefix)) {
+          type_url.remove_prefix(kTypeUrlPrefix.size());
+          absl::string_view payload_view;
+          std::string payload_storage;
+          if (payload.TryFlat().has_value()) {
+            payload_view = payload.TryFlat().value();
+          } else {
+            payload_storage = std::string(payload);
+            payload_view = payload_storage;
+          }
+          if (absl::StartsWith(type_url, kTypeIntTag)) {
+            type_url.remove_prefix(kTypeIntTag.size());
+            kvs.push_back(absl::StrCat(type_url, ":", payload_view));
+          } else {
+            kvs.push_back(absl::StrCat(type_url, ":\"",
+                                       absl::CHexEscape(payload_view), "\""));
+          }
         } else {
-          kvs.push_back(absl::StrCat(type_url, ":\"",
-                                     absl::CHexEscape(payload_view), "\""));
+          auto payload_view = payload.TryFlat();
+          std::string payload_str = absl::CHexEscape(
+              payload_view.has_value() ? *payload_view : std::string(payload));
+          kvs.push_back(absl::StrCat(type_url, ":\"", payload_str, "\""));
         }
-      } else {
-        kvs.push_back(absl::StrCat(type_url, ":\"",
-                                   absl::CHexEscape(payload_view), "\""));
-      }
-    } else {
-      auto payload_view = payload.TryFlat();
-      std::string payload_str = absl::CHexEscape(
-          payload_view.has_value() ? *payload_view : std::string(payload));
-      kvs.push_back(absl::StrCat(type_url, ":\"", payload_str, "\""));
-    }
-  });
-  if (children.has_value()) {
-    std::vector<absl::Status> children_status = ParseChildren(*children);
-    std::vector<std::string> children_text;
-    children_text.reserve(children_status.size());
-    for (const absl::Status& child_status : children_status) {
-      children_text.push_back(StatusToString(child_status));
-    }
-    kvs.push_back(
-        absl::StrCat("children:[", absl::StrJoin(children_text, ", "), "]"));
-  }
+      });
   return kvs.empty() ? head
                      : absl::StrCat(head, " {", absl::StrJoin(kvs, ", "), "}");
 }
 
+namespace {
+
+absl::Status ReplaceStatusMessage(const absl::Status& status,
+                                  absl::string_view message) {
+  absl::Status new_status(status.code(), message);
+  status.ForEachPayload(
+      [&](absl::string_view type_url, const absl::Cord& payload) {
+        new_status.SetPayload(type_url, payload);
+      });
+  return new_status;
+}
+
+}  // namespace
+
 absl::Status AddMessagePrefix(absl::string_view prefix,
                               const absl::Status& status) {
   return ReplaceStatusMessage(status,
                               absl::StrCat(prefix, ": ", status.message()));
 }
 
+absl::Status AddMessageDetail(absl::string_view detail,
+                              const absl::Status& status) {
+  return ReplaceStatusMessage(
+      status, absl::StrCat(status.message(), " (", detail, ")"));
+}
+
 namespace internal {
 
 google_rpc_Status* StatusToProto(const absl::Status& status, upb_Arena* arena) {

data/src/core/util/status_helper.h

@@ -19,7 +19,6 @@
 #ifndef GRPC_SRC_CORE_UTIL_STATUS_HELPER_H
 #define GRPC_SRC_CORE_UTIL_STATUS_HELPER_H
 
-#include <grpc/support/port_platform.h>
 #include <stdint.h>
 
 #include <optional>
@@ -29,7 +28,6 @@
 #include "src/core/util/debug_location.h"
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
-#include "absl/time/time.h"
 
 extern "C" {
 struct google_rpc_Status;
@@ -44,6 +42,22 @@ struct upb_Arena;
 
 namespace grpc_core {
 
+/// Adds prefix to the message of status.
+absl::Status AddMessagePrefix(absl::string_view prefix,
+                              const absl::Status& status);
+
+/// Adds detail to the message of status in parens.
+absl::Status AddMessageDetail(absl::string_view detail,
+                              const absl::Status& status);
+
+///////////////////////////////////////////////////////////////////////////////
+//
+//                  ALL APIs BELOW ARE DEPRECATED!
+//
+//         Callers should instead use absl::Status APIs directly.
+//
+///////////////////////////////////////////////////////////////////////////////
+
 /// This enum should have the same value of grpc_error_ints
 enum class StatusIntProperty {
   /// stream identifier: for errors that are associated with an individual
@@ -65,13 +79,6 @@ enum class StatusIntProperty {
   kLbPolicyDrop,
 };
 
-/// This enum should have the same value of grpc_error_strs
-// TODO(roth): Remove this after error_flatten experiment is removed.
-enum class StatusStrProperty {
-  /// peer that we were trying to communicate when this error occurred
-  kGrpcMessage,
-};
-
 /// Creates a status with given additional information
 absl::Status StatusCreate(absl::StatusCode code, absl::string_view msg,
                           const DebugLocation& location,
@@ -85,14 +92,6 @@ GRPC_MUST_USE_RESULT
 std::optional<intptr_t> StatusGetInt(const absl::Status& status,
                                      StatusIntProperty key);
 
-/// Sets the str property to the status
-void StatusSetStr(absl::Status* status, StatusStrProperty key,
-                  absl::string_view value);
-
-/// Gets the str property from the status
-GRPC_MUST_USE_RESULT std::optional<std::string> StatusGetStr(
-    const absl::Status& status, StatusStrProperty key);
-
 /// Adds a child status to status
 void StatusAddChild(absl::Status* status, absl::Status child);
 
@@ -107,10 +106,6 @@ GRPC_MUST_USE_RESULT std::vector<absl::Status> StatusGetChildren(
 ///   CANCELLATION:SampleMessage {errno:'2021', line:'54', children:[ABORTED]}
 GRPC_MUST_USE_RESULT std::string StatusToString(const absl::Status& status);
 
-/// Adds prefix to the message of status.
-absl::Status AddMessagePrefix(absl::string_view prefix,
-                              const absl::Status& status);
-
 namespace internal {
 
 /// Builds a upb message, google_rpc_Status from a status

data/src/core/xds/grpc/file_watcher_certificate_provider_factory.cc

@@ -26,10 +26,9 @@
 #include <vector>
 
 #include "src/core/config/core_configuration.h"
+#include "src/core/config/experiment_env_var.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_provider.h"
 #include "src/core/util/down_cast.h"
-#include "src/core/util/env.h"
-#include "src/core/util/string.h"
 #include "absl/log/log.h"
 
 namespace grpc_core {
@@ -38,14 +37,6 @@ namespace {
 
 constexpr absl::string_view kFileWatcherPlugin = "file_watcher";
 
-bool SpiffeBundleMapEnabled() {
-  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_MTLS_SPIFFE");
-  if (!value.has_value()) return false;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
-}
-
 }  // namespace
 
 //
@@ -115,7 +106,7 @@ void FileWatcherCertificateProviderFactory::Config::JsonPostLoad(
         "fields \"certificate_file\" and \"private_key_file\" must be both set "
         "or both unset");
   }
-  if (SpiffeBundleMapEnabled()) {
+  if (IsExperimentEnvVarEnabled("GRPC_EXPERIMENTAL_XDS_MTLS_SPIFFE")) {
     if (json.object().find("certificate_file") == json.object().end() &&
         json.object().find("ca_certificate_file") == json.object().end() &&
         json.object().find("spiffe_bundle_map_file") == json.object().end()) {

data/src/core/xds/grpc/xds_bootstrap_grpc.cc

@@ -24,14 +24,13 @@
 #include <utility>
 #include <vector>
 
+#include "src/core/config/experiment_env_var.h"
 #include "src/core/util/down_cast.h"
-#include "src/core/util/env.h"
 #include "src/core/util/json/json.h"
 #include "src/core/util/json/json_object_loader.h"
 #include "src/core/util/json/json_reader.h"
 #include "src/core/util/json/json_writer.h"
 #include "src/core/util/ref_counted_ptr.h"
-#include "src/core/util/string.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/match.h"
@@ -42,11 +41,7 @@ namespace grpc_core {
 
 // TODO(roth): Remove this once the feature passes interop tests.
 bool XdsExtProcOnClientEnabled() {
-  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_EXT_PROC_ON_CLIENT");
-  if (!value.has_value()) return false;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
+  return IsExperimentEnvVarEnabled("GRPC_EXPERIMENTAL_XDS_EXT_PROC_ON_CLIENT");
 }
 
 //

data/src/core/xds/grpc/xds_cluster_parser.cc

@@ -40,10 +40,10 @@
 #include "google/protobuf/struct.upb.h"
 #include "google/protobuf/wrappers.upb.h"
 #include "src/core/config/core_configuration.h"
+#include "src/core/config/experiment_env_var.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/load_balancing/lb_policy_registry.h"
 #include "src/core/util/down_cast.h"
-#include "src/core/util/env.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/host_port.h"
 #include "src/core/util/time.h"
@@ -68,24 +68,11 @@ namespace grpc_core {
 
 // TODO(roth): Remove this once the feature passes interop tests.
 bool XdsHttpConnectEnabled() {
-  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT");
-  if (!value.has_value()) return false;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
+  return IsExperimentEnvVarEnabled("GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT");
 }
 
 namespace {
 
-// TODO(mlumish): Remove this after the 1.81 release.
-bool XdsSniEnabled() {
-  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_SNI");
-  if (!value.has_value()) return true;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
-}
-
 constexpr absl::string_view kUpstreamTlsContextType =
     "envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext";
 
@@ -111,7 +98,9 @@ XdsClusterResource::UpstreamTlsContext UpstreamTlsContextParse(
     errors->AddError("can't decode UpstreamTlsContext");
     return {};
   }
-  if (XdsSniEnabled()) {
+  // TODO(mlumish): Remove this conditional after the 1.81 release.
+  if (IsExperimentEnvVarEnabled("GRPC_EXPERIMENTAL_XDS_SNI",
+                                /*default_value=*/true)) {
     upstream_tls_context.sni = UpbStringToStdString(
         envoy_extensions_transport_sockets_tls_v3_UpstreamTlsContext_sni(
             upstream_tls_context_proto));