grpc 1.83.0 → 1.84.0.pre1

data/src/core/credentials/transport/tls/ssl_utils.h

@@ -34,6 +34,7 @@
 #include <vector>
 
 #include "src/core/credentials/transport/security_connector.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
@@ -88,7 +89,7 @@ const char** ParseAlpnStringIntoArray(absl::string_view preferred_protocols,
 
 // Initialize TSI SSL server/client handshaker factory.
 grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
-    tsi_ssl_pem_key_cert_pair* key_cert_pair,
+    const grpc_core::PemKeyCertPair* key_cert_pair,
     std::shared_ptr<tsi::RootCertInfo> root_cert_info,
     bool skip_server_certificate_verification, tsi_tls_version min_tls_version,
     tsi_tls_version max_tls_version, tsi_ssl_session_cache* ssl_session_cache,
@@ -99,7 +100,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
     tsi_ssl_client_handshaker_factory** handshaker_factory);
 
 grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
-    std::vector<tsi_ssl_pem_key_cert_pair> key_cert_pairs,
+    grpc_core::KeyCertPairsOrSelector key_cert_pairs,
     std::shared_ptr<tsi::RootCertInfo> root_cert_info,
     grpc_ssl_client_certificate_request_type client_certificate_request,
     tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
@@ -120,8 +121,6 @@ int grpc_ssl_host_matches_name(const tsi_peer* peer,
 
 // --- Default SSL Root Store. ---
 namespace grpc_core {
-using tsi::PrivateKey;
-
 bool IsPrivateKeyEmpty(const PrivateKey& private_key);
 
 // The class implements default SSL root store.
@@ -131,12 +130,11 @@ class DefaultSslRootStore {
   static const tsi_ssl_root_certs_store* GetRootStore();
 
   // Gets the default PEM root certificate.
-  static const char* GetPemRootCerts();
+  static absl::string_view GetPemRootCerts();
 
- protected:
-  // Returns default PEM root certificates in nullptr terminated grpc_slice.
-  // This function is protected instead of private, so that it can be tested.
-  static grpc_slice ComputePemRootCerts();
+  // Returns default PEM root certificates.
+  // DO NOT USE -- exposed for testing purposes only.
+  static Slice ComputePemRootCerts();
 
  private:
   // Construct me not!
@@ -152,48 +150,13 @@ class DefaultSslRootStore {
   static tsi_ssl_root_certs_store* default_root_store_;
 
   // Default PEM root certificates.
-  static grpc_slice default_pem_root_certs_;
-};
-
-class PemKeyCertPair {
- public:
-  PemKeyCertPair(PrivateKey private_key, absl::string_view cert_chain)
-      : private_key_(std::move(private_key)), cert_chain_(cert_chain) {}
-
-  // Movable.
-  PemKeyCertPair(PemKeyCertPair&& other) noexcept {
-    private_key_ = std::move(other.private_key_);
-    cert_chain_ = std::move(other.cert_chain_);
-  }
-  PemKeyCertPair& operator=(PemKeyCertPair&& other) noexcept {
-    private_key_ = std::move(other.private_key_);
-    cert_chain_ = std::move(other.cert_chain_);
-    return *this;
-  }
-
-  // Copyable.
-  PemKeyCertPair(const PemKeyCertPair& other)
-      : private_key_(other.private_key()), cert_chain_(other.cert_chain()) {}
-  PemKeyCertPair& operator=(const PemKeyCertPair& other) {
-    private_key_ = other.private_key();
-    cert_chain_ = other.cert_chain();
-    return *this;
-  }
-
-  bool operator==(const PemKeyCertPair& other) const {
-    return this->private_key() == other.private_key() &&
-           this->cert_chain() == other.cert_chain();
-  }
-
-  const PrivateKey& private_key() const { return private_key_; }
-  const std::string& cert_chain() const { return cert_chain_; }
-
- private:
-  PrivateKey private_key_;
-  std::string cert_chain_;
+  static Slice default_pem_root_certs_;
 };
 
-using PemKeyCertPairList = std::vector<PemKeyCertPair>;
+// Checks whether `std::vector<PemKeyCertPair>` in the variant is empty, or the
+// `CertficateSelector` is nullptr.
+bool IsKeyCertPairsOrSelectorEmpty(
+    const KeyCertPairsOrSelector& key_cert_pairs_or_selector);
 
 }  // namespace grpc_core
 

data/src/core/credentials/transport/tls/tls_security_connector.cc

@@ -31,6 +31,8 @@
 #include <utility>
 #include <vector>
 
+#include "src/core/client_channel/client_channel_args.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_verifier.h"
 #include "src/core/credentials/transport/tls/grpc_tls_credentials_options.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
@@ -75,6 +77,7 @@ void PendingVerifierRequestInit(
   bool has_peer_cert = false;
   bool has_peer_cert_full_chain = false;
   bool has_verified_root_cert_subject = false;
+  bool has_negotiated_key_exchange_group = false;
   std::vector<char*> uri_names;
   std::vector<char*> dns_names;
   std::vector<char*> email_names;
@@ -111,6 +114,10 @@ void PendingVerifierRequestInit(
       request->peer_info.verified_root_cert_subject =
           CopyCoreString(prop->value.data, prop->value.length);
       has_verified_root_cert_subject = true;
+    } else if (strcmp(prop->name, TSI_SSL_NEGOTIATED_KEY_EXCHANGE_GROUP) == 0) {
+      request->peer_info.negotiated_key_exchange_group =
+          CopyCoreString(prop->value.data, prop->value.length);
+      has_negotiated_key_exchange_group = true;
     }
   }
   if (!has_common_name) {
@@ -125,6 +132,9 @@ void PendingVerifierRequestInit(
   if (!has_verified_root_cert_subject) {
     request->peer_info.verified_root_cert_subject = nullptr;
   }
+  if (!has_negotiated_key_exchange_group) {
+    request->peer_info.negotiated_key_exchange_group = nullptr;
+  }
   request->peer_info.san_names.uri_names_size = uri_names.size();
   if (!uri_names.empty()) {
     request->peer_info.san_names.uri_names =
@@ -214,20 +224,11 @@ void PendingVerifierRequestDestroy(
   if (request->peer_info.verified_root_cert_subject != nullptr) {
     gpr_free(const_cast<char*>(request->peer_info.verified_root_cert_subject));
   }
-}
-
-std::vector<tsi_ssl_pem_key_cert_pair> ConvertToTsiPemKeyCertPair(
-    const PemKeyCertPairList& cert_pair_list) {
-  std::vector<tsi_ssl_pem_key_cert_pair> tsi_pairs;
-  for (size_t i = 0; i < cert_pair_list.size(); i++) {
-    GRPC_CHECK(!IsPrivateKeyEmpty(cert_pair_list[i].private_key()));
-    GRPC_CHECK(!cert_pair_list[i].cert_chain().empty());
-    tsi_pairs.emplace_back(cert_pair_list[i].private_key(),
-                           cert_pair_list[i].cert_chain());
+  if (request->peer_info.negotiated_key_exchange_group != nullptr) {
+    gpr_free(
+        const_cast<char*>(request->peer_info.negotiated_key_exchange_group));
   }
-  return tsi_pairs;
 }
-
 }  // namespace
 
 // -------------------channel security connector-------------------
@@ -369,12 +370,17 @@ void TlsChannelSecurityConnector::add_handshakers(
     RefCountedPtr<CollectionScope> collection_scope =
         stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
                                       : nullptr;
+    std::string backend_service(
+        args.GetString(GRPC_ARG_BACKEND_SERVICE).value_or(""));
+    std::string locality(args.GetString(GRPC_ARG_LB_LOCALITY).value_or(""));
+    std::string target(args.GetString(GRPC_ARG_SERVER_URI).value_or(""));
     tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
         client_handshaker_factory_, server_name_indication,
         /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0,
         args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS),
-        std::move(collection_scope), &tsi_hs);
+        std::move(collection_scope), std::move(target), std::move(locality),
+        std::move(backend_service), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);
@@ -455,15 +461,17 @@ ArenaPromise<absl::Status> TlsChannelSecurityConnector::CheckCallHost(
 }
 
 void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
-    OnCertificatesChanged(std::shared_ptr<tsi::RootCertInfo> root_certs,
-                          std::optional<PemKeyCertPairList> key_cert_pairs) {
+    OnCertificatesChanged(
+        std::shared_ptr<tsi::RootCertInfo> root_certs,
+        std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
   GRPC_CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
   if (root_certs != nullptr) {
     security_connector_->root_cert_info_ = std::move(root_certs);
   }
-  if (key_cert_pairs.has_value()) {
-    security_connector_->pem_key_cert_pair_list_ = std::move(key_cert_pairs);
+  if (key_cert_pairs_or_selector.has_value()) {
+    security_connector_->key_cert_pairs_or_selector_ =
+        std::move(key_cert_pairs_or_selector);
   }
   const bool root_ready =
       security_connector_->options_->root_certificate_distributor() ==
@@ -472,7 +480,7 @@ void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
   const bool identity_ready =
       security_connector_->options_->identity_certificate_distributor() ==
           nullptr ||
-      security_connector_->pem_key_cert_pair_list_.has_value();
+      security_connector_->key_cert_pairs_or_selector_.has_value();
   if (root_ready && identity_ready) {
     if (security_connector_->UpdateHandshakerFactoryLocked() !=
         GRPC_SECURITY_OK) {
@@ -554,14 +562,20 @@ TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
   if (client_handshaker_factory_ != nullptr) {
     tsi_ssl_client_handshaker_factory_unref(client_handshaker_factory_);
   }
-  std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pair;
-  if (pem_key_cert_pair_list_.has_value()) {
-    pem_key_cert_pair = ConvertToTsiPemKeyCertPair(*pem_key_cert_pair_list_);
+  const PemKeyCertPair* pem_key_cert_pair = nullptr;
+  if (key_cert_pairs_or_selector_.has_value()) {
+    Match(
+        *key_cert_pairs_or_selector_,
+        [&pem_key_cert_pair](const PemKeyCertPairList& pem_key_cert_pairs) {
+          pem_key_cert_pair =
+              pem_key_cert_pairs.empty() ? nullptr : &pem_key_cert_pairs[0];
+        },
+        // This is not expected to happen and we do nothing here.
+        [](const std::shared_ptr<CertificateSelector>&) {});
   }
   bool use_default_roots = options_->root_certificate_distributor() == nullptr;
   return grpc_ssl_tsi_client_handshaker_factory_init(
-      pem_key_cert_pair.empty() ? nullptr : &pem_key_cert_pair[0],
-      use_default_roots ? nullptr : root_cert_info_,
+      pem_key_cert_pair, use_default_roots ? nullptr : root_cert_info_,
       skip_server_certificate_verification,
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()), ssl_session_cache_,
@@ -730,15 +744,17 @@ int TlsServerSecurityConnector::cmp(
 }
 
 void TlsServerSecurityConnector::TlsServerCertificateWatcher::
-    OnCertificatesChanged(std::shared_ptr<tsi::RootCertInfo> roots,
-                          std::optional<PemKeyCertPairList> key_cert_pairs) {
+    OnCertificatesChanged(
+        std::shared_ptr<tsi::RootCertInfo> roots,
+        std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
   GRPC_CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
   if (roots != nullptr) {
     security_connector_->root_cert_info_ = std::move(roots);
   }
-  if (key_cert_pairs.has_value()) {
-    security_connector_->pem_key_cert_pair_list_ = std::move(key_cert_pairs);
+  if (key_cert_pairs_or_selector.has_value()) {
+    security_connector_->key_cert_pairs_or_selector_ =
+        std::move(key_cert_pairs_or_selector);
   }
   bool root_being_watched =
       security_connector_->options_->root_certificate_distributor() != nullptr;
@@ -747,7 +763,7 @@ void TlsServerSecurityConnector::TlsServerCertificateWatcher::
       security_connector_->options_->identity_certificate_distributor() !=
       nullptr;
   bool identity_has_value =
-      security_connector_->pem_key_cert_pair_list_.has_value();
+      security_connector_->key_cert_pairs_or_selector_.has_value();
   if ((root_being_watched && root_has_value && identity_being_watched &&
        identity_has_value) ||
       (root_being_watched && root_has_value && !identity_being_watched) ||
@@ -831,12 +847,11 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
     tsi_ssl_server_handshaker_factory_unref(server_handshaker_factory_);
   }
   // The identity certs on the server side shouldn't be empty.
-  GRPC_CHECK(pem_key_cert_pair_list_.has_value());
-  GRPC_CHECK(!(*pem_key_cert_pair_list_).empty());
-  std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pairs =
-      ConvertToTsiPemKeyCertPair(*pem_key_cert_pair_list_);
+  GRPC_CHECK(key_cert_pairs_or_selector_.has_value());
+  GRPC_CHECK(!IsKeyCertPairsOrSelectorEmpty(*key_cert_pairs_or_selector_));
   return grpc_ssl_tsi_server_handshaker_factory_init(
-      pem_key_cert_pairs, root_cert_info_, options_->cert_request_type(),
+      *key_cert_pairs_or_selector_, root_cert_info_,
+      options_->cert_request_type(),
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()),
       tls_session_key_logger_.get(), options_->crl_directory().c_str(),

data/src/core/credentials/transport/tls/tls_security_connector.h

@@ -25,11 +25,13 @@
 #include <grpc/support/port_platform.h>
 
 #include <map>
+#include <memory>
 #include <optional>
 #include <string>
 
 #include "src/core/credentials/transport/security_connector.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/handshaker/handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
@@ -41,6 +43,7 @@
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
+#include "src/core/util/match.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/sync.h"
 #include "absl/base/thread_annotations.h"
@@ -96,7 +99,16 @@ class TlsChannelSecurityConnector final
 
   std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
     MutexLock lock(&mu_);
-    return pem_key_cert_pair_list_;
+    std::optional<PemKeyCertPairList> pem_key_cert_pairs;
+    if (key_cert_pairs_or_selector_.has_value()) {
+      Match(
+          *key_cert_pairs_or_selector_,
+          [&pem_key_cert_pairs](const PemKeyCertPairList& key_cert_pairs) {
+            pem_key_cert_pairs = key_cert_pairs;
+          },
+          [](const std::shared_ptr<CertificateSelector>&) {});
+    }
+    return pem_key_cert_pairs;
   }
 
   std::shared_ptr<tsi::RootCertInfo> RootCertInfoForTesting() {
@@ -114,9 +126,9 @@ class TlsChannelSecurityConnector final
     explicit TlsChannelCertificateWatcher(
         TlsChannelSecurityConnector* security_connector)
         : security_connector_(security_connector) {}
-    void OnCertificatesChanged(
-        std::shared_ptr<tsi::RootCertInfo> root_certs,
-        std::optional<PemKeyCertPairList> key_cert_pairs) override;
+    void OnCertificatesChanged(std::shared_ptr<tsi::RootCertInfo> root_certs,
+                               std::optional<KeyCertPairsOrSelector>
+                                   key_cert_pairs_or_selector) override;
     void OnError(grpc_error_handle root_cert_error,
                  grpc_error_handle identity_cert_error) override;
 
@@ -167,7 +179,7 @@ class TlsChannelSecurityConnector final
       ABSL_GUARDED_BY(mu_) = nullptr;
   tsi_ssl_session_cache* ssl_session_cache_ ABSL_GUARDED_BY(mu_) = nullptr;
   RefCountedPtr<TlsSessionKeyLogger> tls_session_key_logger_;
-  std::optional<PemKeyCertPairList> pem_key_cert_pair_list_
+  std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector_
       ABSL_GUARDED_BY(mu_);
   std::shared_ptr<tsi::RootCertInfo> root_cert_info_ ABSL_GUARDED_BY(mu_);
   std::map<grpc_closure* /*on_peer_checked*/, ChannelPendingVerifierRequest*>
@@ -208,7 +220,16 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
 
   std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
     MutexLock lock(&mu_);
-    return pem_key_cert_pair_list_;
+    std::optional<PemKeyCertPairList> pem_key_cert_pairs;
+    if (key_cert_pairs_or_selector_.has_value()) {
+      Match(
+          *key_cert_pairs_or_selector_,
+          [&pem_key_cert_pairs](const PemKeyCertPairList& key_cert_pairs) {
+            pem_key_cert_pairs = key_cert_pairs;
+          },
+          [](const std::shared_ptr<CertificateSelector>&) {});
+    }
+    return pem_key_cert_pairs;
   }
 
   std::shared_ptr<tsi::RootCertInfo> RootCertInfoForTesting() {
@@ -226,9 +247,9 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
     explicit TlsServerCertificateWatcher(
         TlsServerSecurityConnector* security_connector)
         : security_connector_(security_connector) {}
-    void OnCertificatesChanged(
-        std::shared_ptr<tsi::RootCertInfo> roots,
-        std::optional<PemKeyCertPairList> key_cert_pairs) override;
+    void OnCertificatesChanged(std::shared_ptr<tsi::RootCertInfo> roots,
+                               std::optional<KeyCertPairsOrSelector>
+                                   key_cert_pairs_or_selector) override;
 
     void OnError(grpc_error_handle root_cert_error,
                  grpc_error_handle identity_cert_error) override;
@@ -276,7 +297,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
       identity_certificate_watcher_ = nullptr;
   tsi_ssl_server_handshaker_factory* server_handshaker_factory_
       ABSL_GUARDED_BY(mu_) = nullptr;
-  std::optional<PemKeyCertPairList> pem_key_cert_pair_list_
+  std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector_
       ABSL_GUARDED_BY(mu_);
   std::shared_ptr<tsi::RootCertInfo> root_cert_info_ ABSL_GUARDED_BY(mu_);
   RefCountedPtr<TlsSessionKeyLogger> tls_session_key_logger_;

data/src/core/ext/filters/channel_idle/legacy_channel_idle_filter.cc

@@ -284,9 +284,8 @@ void LegacyChannelIdleFilter::StartIdleTimer() {
 
 void LegacyChannelIdleFilter::CloseChannel(absl::string_view reason) {
   auto* op = grpc_make_transport_op(nullptr);
-  op->disconnect_with_error = grpc_error_set_int(
-      GRPC_ERROR_CREATE(reason), StatusIntProperty::ChannelConnectivityState,
-      GRPC_CHANNEL_IDLE);
+  op->disconnect_with_error = GRPC_ERROR_CREATE(reason);
+  op->go_idle = true;
   // Pass the transport op down to the channel stack.
   auto* elem = grpc_channel_stack_element(channel_stack_, 0);
   elem->filter->start_transport_op(elem, op);
@@ -305,14 +304,19 @@ void RegisterLegacyChannelIdleFilters(CoreConfiguration::Builder* builder) {
         return GetClientIdleTimeout(channel_args) != Duration::Infinity();
       });
 
-  builder->channel_init()
-      ->RegisterV2Filter<LegacyMaxAgeFilter>(GRPC_SERVER_CHANNEL)
-      .FloatToTop()
-      .ExcludeFromMinimalStack()
-      .If([](const ChannelArgs& channel_args) {
-        return LegacyMaxAgeFilter::Config::FromChannelArgs(channel_args)
-            .enable();
-      });
+  auto& max_age_registration =
+      builder->channel_init()
+          ->RegisterV2Filter<LegacyMaxAgeFilter>(GRPC_SERVER_CHANNEL)
+          .ExcludeFromMinimalStack()
+          .If([](const ChannelArgs& channel_args) {
+            return LegacyMaxAgeFilter::Config::FromChannelArgs(channel_args)
+                .enable();
+          });
+  if (IsFixV3FilterStackServerSideOrderingEnabled()) {
+    max_age_registration.SinkToBottom();
+  } else {
+    max_age_registration.FloatToTop();
+  }
 }
 
 LegacyMaxAgeFilter::LegacyMaxAgeFilter(grpc_channel_stack* channel_stack,

data/src/core/ext/filters/http/http_filters_plugin.cc

@@ -48,11 +48,6 @@ void RegisterHttpFilters(CoreConfiguration::Builder* builder) {
       .If(IsBuildingHttpLikeTransport)
       .After<HttpClientFilter>()
       .After<ClientMessageSizeFilter>();
-  builder->channel_init()
-      ->RegisterFilter<ServerCompressionFilter>(GRPC_SERVER_CHANNEL)
-      .If(IsBuildingHttpLikeTransport)
-      .After<HttpServerFilter>()
-      .After<ServerMessageSizeFilter>();
   builder->channel_init()
       ->RegisterFilter<HttpClientFilter>(GRPC_CLIENT_SUBCHANNEL)
       .If(IsBuildingHttpLikeTransport)
@@ -61,15 +56,31 @@ void RegisterHttpFilters(CoreConfiguration::Builder* builder) {
       ->RegisterFilter<HttpClientFilter>(GRPC_CLIENT_DIRECT_CHANNEL)
       .If(IsBuildingHttpLikeTransport)
       .After<ClientMessageSizeFilter>();
-  builder->channel_init()
-      ->RegisterFilter<HttpServerFilter>(GRPC_SERVER_CHANNEL)
-      .If(IsBuildingHttpLikeTransport)
-      .After<ServerMessageSizeFilter>();
   builder->channel_init()
       ->RegisterFilter<HttpClientFilter>(GRPC_CLIENT_VIRTUAL_CHANNEL)
       .If(IsBuildingHttpLikeTransport);
+
+  // Server side filters.
+  auto& compression_reg =
+      builder->channel_init()
+          ->RegisterFilter<ServerCompressionFilter>(GRPC_SERVER_CHANNEL)
+          .If(IsBuildingHttpLikeTransport);
+  auto& http_server_reg =
+      builder->channel_init()
+          ->RegisterFilter<HttpServerFilter>(GRPC_SERVER_CHANNEL)
+          .If(IsBuildingHttpLikeTransport);
+
   builder->channel_init()
       ->RegisterFilter<HttpServerFilter>(GRPC_SERVER_VIRTUAL_CHANNEL)
       .If(IsBuildingHttpLikeTransport);
+
+  if (IsFixV3FilterStackServerSideOrderingEnabled()) {
+    compression_reg.Before<HttpServerFilter>()
+        .Before<ServerMessageSizeFilter>();
+    http_server_reg.Before<ServerMessageSizeFilter>();
+  } else {
+    compression_reg.After<HttpServerFilter>().After<ServerMessageSizeFilter>();
+    http_server_reg.After<ServerMessageSizeFilter>();
+  }
 }
 }  // namespace grpc_core

data/src/core/ext/filters/http/message_compress/compression_filter.cc

@@ -21,6 +21,7 @@
 #include <grpc/support/port_platform.h>
 #include <inttypes.h>
 
+#include <cstdint>
 #include <functional>
 #include <memory>
 #include <optional>
@@ -44,6 +45,7 @@
 #include "src/core/lib/surface/call.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/telemetry/call_tracer.h"
+#include "src/core/transport/message_size_service_config.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/latent_see.h"
 #include "absl/status/status.h"
@@ -75,8 +77,6 @@ ServerCompressionFilter::Create(const ChannelArgs& args, ChannelFilter::Args) {
 
 ChannelCompression::ChannelCompression(const ChannelArgs& args)
     : max_recv_size_(GetMaxRecvSizeFromChannelArgs(args)),
-      message_size_service_config_parser_index_(
-          MessageSizeParser::ParserIndex()),
       default_compression_algorithm_(
           DefaultCompressionAlgorithmFromChannelArgs(args).value_or(
               GRPC_COMPRESS_NONE)),
@@ -118,26 +118,25 @@ MessageHandle ChannelCompression::CompressMessage(
     return message;
   }
   // Try to compress the payload.
-  SliceBuffer tmp;
-  SliceBuffer* payload = message->payload();
-  bool did_compress = grpc_msg_compress(algorithm, payload->c_slice_buffer(),
-                                        tmp.c_slice_buffer());
+  std::optional<SliceBuffer> compressed =
+      MessageCompress(algorithm, *message->payload());
+
   // If we achieved compression send it as compressed, otherwise send it as (to
   // avoid spending cycles on the receiver decompressing).
-  if (did_compress) {
+  if (compressed.has_value()) {
     if (GRPC_TRACE_FLAG_ENABLED(compression)) {
       const char* algo_name;
-      const size_t before_size = payload->Length();
-      const size_t after_size = tmp.Length();
+      GRPC_CHECK(grpc_compression_algorithm_name(algorithm, &algo_name));
+      const size_t before_size = message->payload()->Length();
+      const size_t after_size = compressed->Length();
       const float savings_ratio = 1.0f - (static_cast<float>(after_size) /
                                           static_cast<float>(before_size));
-      GRPC_CHECK(grpc_compression_algorithm_name(algorithm, &algo_name));
       LOG(INFO) << absl::StrFormat(
           "Compressed[%s] %" PRIuPTR " bytes vs. %" PRIuPTR
           " bytes (%.2f%% savings)",
           algo_name, before_size, after_size, 100 * savings_ratio);
     }
-    tmp.Swap(payload);
+    *message->payload() = std::move(*compressed);
     flags |= GRPC_WRITE_INTERNAL_COMPRESS;
     if (call_tracer != nullptr) {
       call_tracer->RecordSendCompressedMessage(*message);
@@ -148,7 +147,7 @@ MessageHandle ChannelCompression::CompressMessage(
       GRPC_CHECK(grpc_compression_algorithm_name(algorithm, &algo_name));
       LOG(INFO) << "Algorithm '" << algo_name
                 << "' enabled but decided not to compress. Input size: "
-                << payload->Length();
+                << message->payload()->Length();
     }
   }
   return message;
@@ -180,15 +179,17 @@ absl::StatusOr<MessageHandle> ChannelCompression::DecompressMessage(
     return std::move(message);
   }
   // Try to decompress the payload.
-  SliceBuffer decompressed_slices;
-  if (grpc_msg_decompress(args.algorithm, message->payload()->c_slice_buffer(),
-                          decompressed_slices.c_slice_buffer()) == 0) {
-    return absl::InternalError(
-        absl::StrCat("Unexpected error decompressing data for algorithm ",
-                     CompressionAlgorithmAsString(args.algorithm)));
+  std::optional<uint32_t> max_output_size = IsMessageSizeRefactoringEnabled()
+                                                ? args.max_recv_message_length
+                                                : std::nullopt;
+  absl::StatusOr<SliceBuffer> decompressed_slices =
+      MessageDecompress(args.algorithm, *message->payload(), max_output_size);
+  if (!decompressed_slices.ok()) {
+    return decompressed_slices.status();
   }
-  // Swap the decompressed slices into the message.
-  message->payload()->Swap(&decompressed_slices);
+
+  // Move the decompressed slices into the message.
+  *message->payload() = std::move(*decompressed_slices);
   message->mutable_flags() &= ~GRPC_WRITE_INTERNAL_COMPRESS;
   message->mutable_flags() |= GRPC_WRITE_INTERNAL_TEST_ONLY_WAS_COMPRESSED;
   if (call_tracer != nullptr) {
@@ -213,18 +214,10 @@ grpc_compression_algorithm ChannelCompression::HandleOutgoingMetadata(
 ChannelCompression::DecompressArgs ChannelCompression::HandleIncomingMetadata(
     const grpc_metadata_batch& incoming_metadata) {
   // Configure max receive size.
-  auto max_recv_message_length = max_recv_size_;
-  const MessageSizeParsedConfig* limits =
-      MessageSizeParsedConfig::GetFromCallContext(
-          GetContext<Arena>(), message_size_service_config_parser_index_);
-  if (limits != nullptr && limits->max_recv_size().has_value() &&
-      (!max_recv_message_length.has_value() ||
-       *limits->max_recv_size() < *max_recv_message_length)) {
-    max_recv_message_length = limits->max_recv_size();
-  }
-  return DecompressArgs{incoming_metadata.get(GrpcEncodingMetadata())
-                            .value_or(GRPC_COMPRESS_NONE),
-                        max_recv_message_length};
+  return DecompressArgs{
+      incoming_metadata.get(GrpcEncodingMetadata())
+          .value_or(GRPC_COMPRESS_NONE),
+      GetMaxRecvSizeFromCallContext(GetContext<Arena>(), max_recv_size_)};
 }
 
 void ClientCompressionFilter::Call::OnClientInitialMetadata(

data/src/core/ext/filters/http/message_compress/compression_filter.h

@@ -107,7 +107,6 @@ class ChannelCompression {
  private:
   // Max receive message length, if set.
   std::optional<uint32_t> max_recv_size_;
-  size_t message_size_service_config_parser_index_;
   // The default, channel-level, compression algorithm.
   grpc_compression_algorithm default_compression_algorithm_;
   // Enabled compression algorithms.