grpc 1.82.2 → 1.83.0.pre1

data/src/core/credentials/transport/tls/grpc_tls_certificate_selector.cc

@@ -0,0 +1,172 @@
+//
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
+
+#include <openssl/bio.h>
+#include <openssl/crypto.h>
+#include <openssl/pem.h>
+#if defined(OPENSSL_IS_BORINGSSL)
+#include <openssl/bytestring.h>
+#endif
+
+#include <cstdint>
+#include <memory>
+#include <vector>
+
+#include "src/core/util/grpc_check.h"
+#include "src/core/util/match.h"
+#include "src/core/util/status_helper.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
+#if defined(OPENSSL_IS_BORINGSSL)
+
+namespace grpc_core {
+namespace {
+
+// TODO(lwge): Consider moving these into a util library.
+absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>>
+ParseCertificateChainFromDer(const std::vector<std::string>& der_cert_chain) {
+  if (der_cert_chain.empty()) {
+    return absl::InvalidArgumentError("The cert chain is empty.");
+  }
+  std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> raw_cert_chain;
+  raw_cert_chain.reserve(der_cert_chain.size());
+  for (absl::string_view cert : der_cert_chain) {
+    bssl::UniquePtr<CRYPTO_BUFFER> raw_cert(CRYPTO_BUFFER_new(
+        reinterpret_cast<const uint8_t*>(cert.data()), cert.size(),
+        /*pool=*/nullptr));
+    if (raw_cert == nullptr) {
+      return absl::InvalidArgumentError("Failed to create raw cert.");
+    }
+    raw_cert_chain.push_back(std::move(raw_cert));
+  }
+  return std::move(raw_cert_chain);
+}
+
+absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>>
+ParseCertificateChainFromPem(absl::string_view pem_cert_chain) {
+  if (pem_cert_chain.empty()) {
+    return absl::InvalidArgumentError("The cert chain is empty.");
+  }
+  std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> raw_cert_chain;
+  bssl::UniquePtr<BIO> bio(
+      BIO_new_mem_buf(pem_cert_chain.data(), pem_cert_chain.size()));
+  uint8_t* cert_data = nullptr;
+  long cert_len;
+  while (PEM_bytes_read_bio(&cert_data, &cert_len, nullptr, PEM_STRING_X509,
+                            bio.get(), nullptr, nullptr)) {
+    raw_cert_chain.push_back(bssl::UniquePtr<CRYPTO_BUFFER>(
+        CRYPTO_BUFFER_new(reinterpret_cast<const uint8_t*>(cert_data), cert_len,
+                          /*pool=*/nullptr)));
+    OPENSSL_free(cert_data);
+  }
+  if (raw_cert_chain.empty()) {
+    return absl::InvalidArgumentError("Failed to parse cert chain.");
+  }
+  return std::move(raw_cert_chain);
+}
+
+absl::StatusOr<bssl::UniquePtr<EVP_PKEY>> ParsePrivateKeyFromDer(
+    absl::string_view der_private_key) {
+  CBS cbs;
+  CBS_init(&cbs, reinterpret_cast<const uint8_t*>(der_private_key.data()),
+           der_private_key.size());
+  bssl::UniquePtr<EVP_PKEY> pkey(EVP_parse_private_key(&cbs));
+  if (pkey == nullptr || CBS_len(&cbs) != 0) {
+    return absl::InvalidArgumentError("Failed to parse private key.");
+  }
+  return std::move(pkey);
+}
+
+absl::StatusOr<bssl::UniquePtr<EVP_PKEY>> ParsePrivateKeyFromPem(
+    absl::string_view pem_private_key) {
+  GRPC_CHECK_LE(pem_private_key.size(), static_cast<size_t>(INT_MAX));
+  bssl::UniquePtr<BIO> pem(BIO_new_mem_buf(
+      pem_private_key.data(), static_cast<int>(pem_private_key.size())));
+  if (pem == nullptr) {
+    return absl::InvalidArgumentError("Failed to create pem BIO.");
+  }
+  bssl::UniquePtr<EVP_PKEY> pkey(PEM_read_bio_PrivateKey(
+      pem.get(), nullptr, nullptr, const_cast<char*>("")));
+  if (pkey == nullptr) {
+    return absl::InvalidArgumentError("Failed to read private key.");
+  }
+  return std::move(pkey);
+}
+
+// The type of the given private key string must match the parser.
+absl::Status CreatePrivateKey(
+    std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+        private_key,
+    CertificateSelector::SelectCertificateResult& result,
+    absl::AnyInvocable<
+        absl::StatusOr<bssl::UniquePtr<EVP_PKEY>>(absl::string_view)>
+        parser) {
+  return MatchMutable(
+      &private_key,
+      [&](absl::string_view* key) {
+        absl::StatusOr<bssl::UniquePtr<EVP_PKEY>> pkey = parser(*key);
+        if (!pkey.ok()) {
+          return pkey.status();
+        }
+        result.private_key = *std::move(pkey);
+        return absl::OkStatus();
+      },
+      [&](std::shared_ptr<PrivateKeySigner>* key_signer) {
+        result.private_key = std::move(*key_signer);
+        return absl::OkStatus();
+      });
+}
+
+}  // namespace
+
+absl::StatusOr<CertificateSelector::SelectCertificateResult>
+CertificateSelector::CreateSelectCertificateResult(
+    const std::vector<std::string>& der_cert_chain,
+    std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+        der_private_key) {
+  absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>> raw_cert_chain =
+      ParseCertificateChainFromDer(der_cert_chain);
+  GRPC_RETURN_IF_ERROR(raw_cert_chain.status());
+  SelectCertificateResult result;
+  result.certificate_chain = *std::move(raw_cert_chain);
+  GRPC_RETURN_IF_ERROR(
+      CreatePrivateKey(der_private_key, result, ParsePrivateKeyFromDer));
+  return std::move(result);
+}
+
+absl::StatusOr<CertificateSelector::SelectCertificateResult>
+CertificateSelector::CreateSelectCertificateResult(
+    absl::string_view pem_cert_chain,
+    std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+        pem_private_key) {
+  absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>> raw_cert_chain =
+      ParseCertificateChainFromPem(pem_cert_chain);
+  GRPC_RETURN_IF_ERROR(raw_cert_chain.status());
+  SelectCertificateResult result;
+  result.certificate_chain = *std::move(raw_cert_chain);
+  GRPC_RETURN_IF_ERROR(
+      CreatePrivateKey(pem_private_key, result, ParsePrivateKeyFromPem));
+  return std::move(result);
+}
+
+}  // namespace grpc_core
+
+#endif  // OPENSSL_IS_BORINGSSL

data/src/core/credentials/transport/tls/grpc_tls_certificate_selector.h

@@ -0,0 +1,103 @@
+//
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_GRPC_TLS_CERTIFICATE_SELECTOR_H
+#define GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_GRPC_TLS_CERTIFICATE_SELECTOR_H
+
+#include <grpc/private_key_signer.h>
+#include <openssl/bio.h>
+
+#include <memory>
+#include <string>
+#include <variant>
+#include <vector>
+
+#include "absl/functional/any_invocable.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
+namespace grpc_core {
+
+// Performs server-side certificate selection during the handshake based on the
+// SNI. Users must implement the `SelectCertificate` and `Cancel` methods.
+// The implementation must be thread-safe, as `SelectCertificate` may be called
+// for multiple TLS handshakes at the same time.
+class CertificateSelector {
+#if defined(OPENSSL_IS_BORINGSSL)
+ public:
+  struct SelectCertificateInfo {
+    std::string sni;
+  };
+
+  // TODO(lwge): This should be an opaque struct when moved to a public header.
+  struct SelectCertificateResult {
+    std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> certificate_chain;
+    std::variant<bssl::UniquePtr<EVP_PKEY>, std::shared_ptr<PrivateKeySigner>>
+        private_key;
+  };
+
+  // Returns a SelectCertificateResult given a DER-encoded certificate chain,
+  // and DER-encoded private key string or a signer.
+  static absl::StatusOr<SelectCertificateResult> CreateSelectCertificateResult(
+      const std::vector<std::string>& der_cert_chain,
+      std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+          der_private_key);
+
+  // Returns a SelectCertificateResult given a PEM-encoded certificate chain,
+  // and PEM-encoded private key string or a signer.
+  static absl::StatusOr<SelectCertificateResult> CreateSelectCertificateResult(
+      absl::string_view pem_cert_chain,
+      std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+          pem_private_key);
+
+  // Handle to be passed to `Cancel`, to enable user to clean up any resources
+  // used during an asynchronous certificate selection operation that is
+  // cancelled.
+  class AsyncCertificateSelectionHandle {
+   public:
+    virtual ~AsyncCertificateSelectionHandle() = default;
+  };
+
+  using OnSelectCertificateComplete =
+      absl::AnyInvocable<void(absl::StatusOr<SelectCertificateResult>)>;
+
+  virtual ~CertificateSelector() = default;
+
+  // Performs the cert selection based on `SelectCertificateInfo`.
+  // Since the client is not required to provide the server name in the
+  // ClientHello, the implementation should make a decision by itself on what to
+  // return.
+  // May return either synchronously or asynchronously.
+  // For synchronous returns, directly returns either the selected certificate
+  // or a failed status, and the callback will never be invoked.
+  // For asynchronous implementations, returns a handle for the asynchronous
+  // signing operation. The function argument on_complete must be called by
+  // the implementer when the async certificate selection operation is complete.
+  // on_complete must not be invoked synchronously within SelectCertificate().
+  virtual std::variant<absl::StatusOr<SelectCertificateResult>,
+                       std::shared_ptr<AsyncCertificateSelectionHandle>>
+  SelectCertificate(const SelectCertificateInfo& info,
+                    OnSelectCertificateComplete on_complete) = 0;
+
+  // Cancels the async select cert call corresponding to the handle.
+  virtual void Cancel(std::shared_ptr<AsyncCertificateSelectionHandle>) = 0;
+#endif  // OPENSSL_IS_BORINGSSL
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_GRPC_TLS_CERTIFICATE_SELECTOR_H

data/src/core/credentials/transport/tls/load_system_roots_fallback.cc

@@ -19,7 +19,8 @@
 #include <grpc/support/port_platform.h>
 
 #if !defined(GPR_LINUX) && !defined(GPR_ANDROID) && !defined(GPR_FREEBSD) && \
-    !defined(GPR_APPLE) && !defined(GPR_WINDOWS)
+    !defined(GPR_APPLE) && !defined(GPR_NETBSD) && !defined(GPR_OPENBSD) &&  \
+    !defined(GPR_WINDOWS)
 
 #include <grpc/slice.h>
 #include <grpc/slice_buffer.h>
@@ -33,4 +34,4 @@ grpc_slice LoadSystemRootCerts() { return grpc_empty_slice(); }
 }  // namespace grpc_core
 
 #endif  // !(GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE ||
-        // GPR_WINDOWS)
+        // GPR_NETBSD || GPR_OPENBSD || GPR_WINDOWS)

data/src/core/credentials/transport/tls/load_system_roots_supported.cc

@@ -23,7 +23,7 @@
 #include <vector>
 
 #if defined(GPR_LINUX) || defined(GPR_ANDROID) || defined(GPR_FREEBSD) || \
-    defined(GPR_APPLE)
+    defined(GPR_APPLE) || defined(GPR_NETBSD) || defined(GPR_OPENBSD)
 
 #include <dirent.h>
 #include <fcntl.h>
@@ -59,7 +59,13 @@ const char* kCertDirectories[] = {""};
 #elif defined(GPR_APPLE)    // endif GPR_FREEBSD
 const char* kCertFiles[] = {"/etc/ssl/cert.pem"};
 const char* kCertDirectories[] = {""};
-#endif                      // GPR_APPLE
+#elif defined(GPR_NETBSD)   // endif GPR_APPLE
+const char* kCertFiles[] = {"/etc/openssl/certs/ca-certificates.crt"};
+const char* kCertDirectories[] = {"/etc/openssl/certs"};
+#elif defined(GPR_OPENBSD)  // endif GPR_NETBSD
+const char* kCertFiles[] = {"/etc/ssl/cert.pem"};
+const char* kCertDirectories[] = {""};
+#endif                      // GPR_OPENBSD
 
 grpc_slice GetSystemRootCerts() {
   size_t num_cert_files_ = GPR_ARRAY_SIZE(kCertFiles);
@@ -163,4 +169,5 @@ grpc_slice LoadSystemRootCerts() {
 
 }  // namespace grpc_core
 
-#endif  // GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE
+#endif  // GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE ||
+        // GPR_NETNSD || GPR_OPENBSD

data/src/core/credentials/transport/tls/tls_security_connector.cc

@@ -39,6 +39,7 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/promise/promise.h"
+#include "src/core/telemetry/metrics.h"
 #include "src/core/transport/auth_context.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/util/debug_location.h"
@@ -363,11 +364,17 @@ void TlsChannelSecurityConnector::add_handshakers(
                                    ? target_name_.c_str()
                                    : overridden_target_name_.c_str();
     }
+    auto stats_plugin_group =
+        args.GetObject<GlobalStatsPluginRegistry::StatsPluginGroup>();
+    RefCountedPtr<CollectionScope> collection_scope =
+        stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
+                                      : nullptr;
     tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
         client_handshaker_factory_, server_name_indication,
         /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0,
-        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS), &tsi_hs);
+        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS),
+        std::move(collection_scope), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);
@@ -648,10 +655,15 @@ void TlsServerSecurityConnector::add_handshakers(
   MutexLock lock(&mu_);
   tsi_handshaker* tsi_hs = nullptr;
   if (server_handshaker_factory_ != nullptr) {
+    auto stats_plugin_group =
+        args.GetObject<GlobalStatsPluginRegistry::StatsPluginGroup>();
+    RefCountedPtr<CollectionScope> collection_scope =
+        stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
+                                      : nullptr;
     // Instantiate TSI handshaker.
     tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
         server_handshaker_factory_, /*network_bio_buf_size=*/0,
-        /*ssl_bio_buf_size=*/0, &tsi_hs);
+        /*ssl_bio_buf_size=*/0, std::move(collection_scope), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);

data/src/core/credentials/transport/xds/xds_credentials.cc

@@ -20,17 +20,16 @@
 
 #include <grpc/grpc_security_constants.h>
 #include <grpc/impl/channel_arg_names.h>
-#include <grpc/support/port_platform.h>
 
 #include <optional>
 
+#include "src/core/config/experiment_env_var.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_provider.h"
 #include "src/core/credentials/transport/tls/grpc_tls_credentials_options.h"
 #include "src/core/credentials/transport/tls/tls_credentials.h"
 #include "src/core/credentials/transport/tls/tls_utils.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/load_balancing/xds/xds_channel_args.h"
-#include "src/core/util/env.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/host_port.h"
 #include "src/core/util/useful.h"
@@ -40,15 +39,6 @@ namespace grpc_core {
 
 namespace {
 
-// TODO(mlumish): Remove this after 1.80
-bool UseChannelAuthorityIfNoSNIApplicable() {
-  auto value = GetEnv("GRPC_USE_CHANNEL_AUTHORITY_IF_NO_SNI_APPLICABLE");
-  if (!value.has_value()) return false;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
-}
-
 bool XdsVerifySubjectAlternativeNames(
     const char* const* subject_alternative_names,
     size_t subject_alternative_names_size,
@@ -194,7 +184,9 @@ XdsCredentials::create_security_connector(
         tls_credentials_options->set_sni_override(
             xds_certificate_provider->sni());
       } else {
-        if (!UseChannelAuthorityIfNoSNIApplicable()) {
+        // TODO(mlumish): Remove this after 1.80
+        if (!IsExperimentEnvVarEnabled(
+                "GRPC_USE_CHANNEL_AUTHORITY_IF_NO_SNI_APPLICABLE")) {
           tls_credentials_options->set_sni_override("");
         }
       }

data/src/core/ext/filters/http/message_compress/compression_filter.cc

@@ -21,7 +21,6 @@
 #include <grpc/support/port_platform.h>
 #include <inttypes.h>
 
-#include <cstdint>
 #include <functional>
 #include <memory>
 #include <optional>
@@ -45,7 +44,6 @@
 #include "src/core/lib/surface/call.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/telemetry/call_tracer.h"
-#include "src/core/transport/message_size_service_config.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/latent_see.h"
 #include "absl/status/status.h"
@@ -77,6 +75,8 @@ ServerCompressionFilter::Create(const ChannelArgs& args, ChannelFilter::Args) {
 
 ChannelCompression::ChannelCompression(const ChannelArgs& args)
     : max_recv_size_(GetMaxRecvSizeFromChannelArgs(args)),
+      message_size_service_config_parser_index_(
+          MessageSizeParser::ParserIndex()),
       default_compression_algorithm_(
           DefaultCompressionAlgorithmFromChannelArgs(args).value_or(
               GRPC_COMPRESS_NONE)),
@@ -118,25 +118,26 @@ MessageHandle ChannelCompression::CompressMessage(
     return message;
   }
   // Try to compress the payload.
-  std::optional<SliceBuffer> compressed =
-      MessageCompress(algorithm, *message->payload());
-
+  SliceBuffer tmp;
+  SliceBuffer* payload = message->payload();
+  bool did_compress = grpc_msg_compress(algorithm, payload->c_slice_buffer(),
+                                        tmp.c_slice_buffer());
   // If we achieved compression send it as compressed, otherwise send it as (to
   // avoid spending cycles on the receiver decompressing).
-  if (compressed.has_value()) {
+  if (did_compress) {
     if (GRPC_TRACE_FLAG_ENABLED(compression)) {
       const char* algo_name;
-      GRPC_CHECK(grpc_compression_algorithm_name(algorithm, &algo_name));
-      const size_t before_size = message->payload()->Length();
-      const size_t after_size = compressed->Length();
+      const size_t before_size = payload->Length();
+      const size_t after_size = tmp.Length();
       const float savings_ratio = 1.0f - (static_cast<float>(after_size) /
                                           static_cast<float>(before_size));
+      GRPC_CHECK(grpc_compression_algorithm_name(algorithm, &algo_name));
       LOG(INFO) << absl::StrFormat(
           "Compressed[%s] %" PRIuPTR " bytes vs. %" PRIuPTR
           " bytes (%.2f%% savings)",
           algo_name, before_size, after_size, 100 * savings_ratio);
     }
-    *message->payload() = std::move(*compressed);
+    tmp.Swap(payload);
     flags |= GRPC_WRITE_INTERNAL_COMPRESS;
     if (call_tracer != nullptr) {
       call_tracer->RecordSendCompressedMessage(*message);
@@ -147,7 +148,7 @@ MessageHandle ChannelCompression::CompressMessage(
       GRPC_CHECK(grpc_compression_algorithm_name(algorithm, &algo_name));
       LOG(INFO) << "Algorithm '" << algo_name
                 << "' enabled but decided not to compress. Input size: "
-                << message->payload()->Length();
+                << payload->Length();
     }
   }
   return message;
@@ -179,17 +180,15 @@ absl::StatusOr<MessageHandle> ChannelCompression::DecompressMessage(
     return std::move(message);
   }
   // Try to decompress the payload.
-  std::optional<uint32_t> max_output_size = IsMessageSizeRefactoringEnabled()
-                                                ? args.max_recv_message_length
-                                                : std::nullopt;
-  absl::StatusOr<SliceBuffer> decompressed_slices =
-      MessageDecompress(args.algorithm, *message->payload(), max_output_size);
-  if (!decompressed_slices.ok()) {
-    return decompressed_slices.status();
+  SliceBuffer decompressed_slices;
+  if (grpc_msg_decompress(args.algorithm, message->payload()->c_slice_buffer(),
+                          decompressed_slices.c_slice_buffer()) == 0) {
+    return absl::InternalError(
+        absl::StrCat("Unexpected error decompressing data for algorithm ",
+                     CompressionAlgorithmAsString(args.algorithm)));
   }
-
-  // Move the decompressed slices into the message.
-  *message->payload() = std::move(*decompressed_slices);
+  // Swap the decompressed slices into the message.
+  message->payload()->Swap(&decompressed_slices);
   message->mutable_flags() &= ~GRPC_WRITE_INTERNAL_COMPRESS;
   message->mutable_flags() |= GRPC_WRITE_INTERNAL_TEST_ONLY_WAS_COMPRESSED;
   if (call_tracer != nullptr) {
@@ -214,10 +213,18 @@ grpc_compression_algorithm ChannelCompression::HandleOutgoingMetadata(
 ChannelCompression::DecompressArgs ChannelCompression::HandleIncomingMetadata(
     const grpc_metadata_batch& incoming_metadata) {
   // Configure max receive size.
-  return DecompressArgs{
-      incoming_metadata.get(GrpcEncodingMetadata())
-          .value_or(GRPC_COMPRESS_NONE),
-      GetMaxRecvSizeFromCallContext(GetContext<Arena>(), max_recv_size_)};
+  auto max_recv_message_length = max_recv_size_;
+  const MessageSizeParsedConfig* limits =
+      MessageSizeParsedConfig::GetFromCallContext(
+          GetContext<Arena>(), message_size_service_config_parser_index_);
+  if (limits != nullptr && limits->max_recv_size().has_value() &&
+      (!max_recv_message_length.has_value() ||
+       *limits->max_recv_size() < *max_recv_message_length)) {
+    max_recv_message_length = limits->max_recv_size();
+  }
+  return DecompressArgs{incoming_metadata.get(GrpcEncodingMetadata())
+                            .value_or(GRPC_COMPRESS_NONE),
+                        max_recv_message_length};
 }
 
 void ClientCompressionFilter::Call::OnClientInitialMetadata(

data/src/core/ext/filters/http/message_compress/compression_filter.h

@@ -107,6 +107,7 @@ class ChannelCompression {
  private:
   // Max receive message length, if set.
   std::optional<uint32_t> max_recv_size_;
+  size_t message_size_service_config_parser_index_;
   // The default, channel-level, compression algorithm.
   grpc_compression_algorithm default_compression_algorithm_;
   // Enabled compression algorithms.

data/src/core/ext/filters/rbac/rbac_service_config_parser.cc

@@ -205,7 +205,8 @@ struct RbacConfig {
       std::map<std::string, Policy> policies;
       // Defaults to kNone since its json field is optional.
       Rbac::AuditCondition audit_condition = Rbac::AuditCondition::kNone;
-      std::vector<std::unique_ptr<AuditLoggerFactory::Config>> logger_configs;
+      std::vector<std::shared_ptr<const AuditLoggerFactory::Config>>
+          logger_configs;
 
       Rules() {}
       Rules(const Rules&) = delete;

data/src/core/ext/transport/chttp2/server/chttp2_server.cc

@@ -438,11 +438,16 @@ void NewChttp2ServerListener::ActiveConnection::SendGoAwayImplLocked() {
             transport->PerformOp(op);
           }
         },
-        [](GRPC_UNUSED const RefCountedPtr<http2::Http2ServerTransport>&
-               transport) {
-          // TODO(akshitpatel) [PH2][P0] : Add support for GOAWAY for
-          // Http2ServerTransport.
-          LOG(FATAL) << "Not implemented";
+        [](const RefCountedPtr<http2::Http2ServerTransport>& transport) {
+          // Send a GOAWAY if the transport exists
+          if (transport != nullptr) {
+            grpc_transport_op* op = grpc_make_transport_op(nullptr);
+            // We send a non-ok status here to send the status message in the
+            // GOAWAY frame.
+            op->goaway_error =
+                absl::UnavailableError("Server is stopping to serve requests.");
+            transport->PerformOp(op);
+          }
         });
   }
 }
@@ -468,11 +473,14 @@ void NewChttp2ServerListener::ActiveConnection::
           transport->PerformOp(op);
         }
       },
-      [](GRPC_UNUSED const RefCountedPtr<http2::Http2ServerTransport>&
-             transport) {
-        // TODO(akshitpatel) [PH2][P0] : Add support for disconnect immediately
-        // for Http2ServerTransport.
-        LOG(FATAL) << "Not implemented";
+      [](const RefCountedPtr<http2::Http2ServerTransport>& transport) {
+        // Disconnect immediately if the transport exists
+        if (transport != nullptr) {
+          grpc_transport_op* op = grpc_make_transport_op(nullptr);
+          op->disconnect_with_error = absl::UnavailableError(
+              "Drain grace time expired. Closing connection immediately.");
+          transport->PerformOp(op);
+        }
       });
 }
 
@@ -736,9 +744,7 @@ absl::StatusOr<int> Chttp2ServerAddPort(Server* server, const char* addr,
       resolved = grpc_resolve_vsock_address(parsed_addr_unprefixed);
       GRPC_RETURN_IF_ERROR(resolved.status());
     } else {
-      if (IsEventEngineDnsNonClientChannelEnabled() &&
-          !grpc_event_engine::experimental::
-              EventEngineExperimentDisabledForPython()) {
+      if (IsEventEngineDnsNonClientChannelEnabled()) {
         absl::StatusOr<std::unique_ptr<EventEngine::DNSResolver>> ee_resolver =
             args.GetObjectRef<EventEngine>()->GetDNSResolver(
                 EventEngine::DNSResolver::ResolverOptions());