grpc 1.83.1 → 1.84.0

data/src/core/lib/iomgr/tcp_posix.cc

@@ -70,6 +70,7 @@
 #include "src/core/util/string.h"
 #include "src/core/util/sync.h"
 #include "src/core/util/time.h"
+#include "src/core/util/useful.h"
 #include "absl/base/thread_annotations.h"
 #include "absl/log/log.h"
 #include "absl/status/status.h"
@@ -478,6 +479,7 @@ struct grpc_tcp {
   explicit grpc_tcp(const grpc_core::PosixTcpOptions& tcp_options)
       : min_read_chunk_size(tcp_options.tcp_min_read_chunk_size),
         max_read_chunk_size(tcp_options.tcp_max_read_chunk_size),
+        max_read_buffer_size(tcp_options.tcp_max_read_buffer_size),
         tcp_zerocopy_send_ctx(
             tcp_options.tcp_tx_zerocopy_max_simultaneous_sends,
             tcp_options.tcp_tx_zerocopy_send_bytes_threshold) {}
@@ -492,6 +494,7 @@ struct grpc_tcp {
 
   int min_read_chunk_size;
   int max_read_chunk_size;
+  int max_read_buffer_size;
 
   // garbage after the last read
   grpc_slice_buffer last_read_buffer;
@@ -736,17 +739,17 @@ static void finish_estimate(grpc_tcp* tcp) {
     tcp->target_length =
         0.99 * tcp->target_length + 0.01 * tcp->bytes_read_this_round;
   }
+  // Opt-in: if a maximum read buffer size has been configured, clamp the
+  // adaptive target so that occasional large reads do not leave a permanently
+  // high read-buffer high-watermark. When unset (max_read_buffer_size < 0) the
+  // behavior is unchanged.
+  if (tcp->max_read_buffer_size >= 0 &&
+      tcp->target_length > static_cast<double>(tcp->max_read_buffer_size)) {
+    tcp->target_length = static_cast<double>(tcp->max_read_buffer_size);
+  }
   tcp->bytes_read_this_round = 0;
 }
 
-static grpc_error_handle tcp_annotate_error(grpc_error_handle src_error) {
-  return grpc_error_set_int(src_error,
-                            // All tcp errors are marked with UNAVAILABLE so
-                            // that application may choose to retry.
-                            grpc_core::StatusIntProperty::kRpcStatus,
-                            GRPC_STATUS_UNAVAILABLE);
-}
-
 static void tcp_handle_read(void* arg /* grpc_tcp */, grpc_error_handle error);
 static void tcp_handle_write(void* arg /* grpc_tcp */, grpc_error_handle error);
 
@@ -975,10 +978,10 @@ static bool tcp_do_read(grpc_tcp* tcp, grpc_error_handle* error)
       // 0 read size ==> end of stream
       grpc_slice_buffer_reset_and_unref(tcp->incoming_buffer);
       if (read_bytes == 0) {
-        *error = tcp_annotate_error(absl::InternalError("Socket closed"));
+        *error = absl::UnavailableError("Socket closed");
       } else {
-        *error = tcp_annotate_error(absl::InternalError(
-            absl::StrCat("recvmsg:", grpc_core::StrError(saved_errno))));
+        *error = absl::UnavailableError(
+            absl::StrCat("recvmsg:", grpc_core::StrError(saved_errno)));
       }
       return true;
     }
@@ -1126,7 +1129,7 @@ static void tcp_handle_read(void* arg /* grpc_tcp */, grpc_error_handle error) {
     tcp_trace_read(tcp, tcp_read_error);
   } else {
     if (!tcp->memory_owner.is_valid() && error.ok()) {
-      tcp_read_error = tcp_annotate_error(absl::InternalError("Socket closed"));
+      tcp_read_error = absl::UnavailableError("Socket closed");
     } else {
       tcp_read_error = error;
     }
@@ -1563,6 +1566,11 @@ void TcpZerocopySendRecord::UpdateOffsetForBytesSent(size_t sending_length,
   }
 }
 
+static absl::Status OSError(int err, absl::string_view call_name) {
+  return absl::UnavailableError(
+      absl::StrCat(call_name, ": ", grpc_core::StrError(err), " (", err, ")"));
+}
+
 // returns true if done, false if pending; if returning true, *error is set
 static bool do_tcp_flush_zerocopy(grpc_tcp* tcp, TcpZerocopySendRecord* record,
                                   grpc_error_handle* error) {
@@ -1625,7 +1633,7 @@ static bool do_tcp_flush_zerocopy(grpc_tcp* tcp, TcpZerocopySendRecord* record,
         record->UnwindIfThrottled(unwind_slice_idx, unwind_byte_idx);
         return false;
       } else {
-        *error = tcp_annotate_error(GRPC_OS_ERROR(saved_errno, "sendmsg"));
+        *error = OSError(saved_errno, "sendmsg");
         tcp_shutdown_buffer_list(tcp);
         return true;
       }
@@ -1735,7 +1743,7 @@ static bool tcp_flush(grpc_tcp* tcp, grpc_error_handle* error) {
         }
         return false;
       } else {
-        *error = tcp_annotate_error(GRPC_OS_ERROR(saved_errno, "sendmsg"));
+        *error = OSError(saved_errno, "sendmsg");
         grpc_slice_buffer_reset_and_unref(tcp->outgoing_buffer);
         tcp_shutdown_buffer_list(tcp);
         return true;
@@ -1833,7 +1841,7 @@ static void tcp_write(
   if (buf->length == 0) {
     grpc_core::Closure::Run(DEBUG_LOCATION, cb,
                             grpc_fd_is_shutdown(tcp->em_fd)
-                                ? tcp_annotate_error(GRPC_ERROR_CREATE("EOF"))
+                                ? absl::UnavailableError("EOF")
                                 : absl::OkStatus());
     tcp_shutdown_buffer_list(tcp);
     return;

data/src/core/lib/iomgr/tcp_server.h

@@ -28,7 +28,7 @@
 
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/endpoint.h"
-#include "src/core/lib/iomgr/resolve_address.h"
+#include "src/core/lib/iomgr/resolved_address.h"
 
 // Forward decl of grpc_tcp_server
 typedef struct grpc_tcp_server grpc_tcp_server;

data/src/core/lib/iomgr/tcp_server_posix.cc

@@ -61,7 +61,6 @@
 #include "src/core/lib/iomgr/event_engine_shims/closure.h"
 #include "src/core/lib/iomgr/event_engine_shims/endpoint.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
-#include "src/core/lib/iomgr/resolve_address.h"
 #include "src/core/lib/iomgr/sockaddr.h"
 #include "src/core/lib/iomgr/socket_utils_posix.h"
 #include "src/core/lib/iomgr/systemd_utils.h"
@@ -212,7 +211,7 @@ static grpc_error_handle CreateEventEngineListener(
         std::move(accept_cb),
         [s, shutdown_complete](absl::Status status) {
           grpc_event_engine::experimental::RunEventEngineClosure(
-              shutdown_complete, absl_status_to_grpc_error(status));
+              shutdown_complete, status);
           finish_shutdown(s);
         },
         config,
@@ -240,7 +239,7 @@ static grpc_error_handle CreateEventEngineListener(
         [s, ee = keeper, shutdown_complete](absl::Status status) {
           GRPC_CHECK_EQ(gpr_atm_no_barrier_load(&s->refs.count), 0);
           grpc_event_engine::experimental::RunEventEngineClosure(
-              shutdown_complete, absl_status_to_grpc_error(status));
+              shutdown_complete, status);
           finish_shutdown(s);
         },
         config,

data/src/core/lib/iomgr/tcp_server_utils_posix.h

@@ -25,7 +25,6 @@
 
 #include "src/core/lib/event_engine/posix.h"
 #include "src/core/lib/iomgr/ev_posix.h"
-#include "src/core/lib/iomgr/resolve_address.h"
 #include "src/core/lib/iomgr/socket_utils_posix.h"
 #include "src/core/lib/iomgr/tcp_server.h"
 #include "src/core/lib/iomgr/timer.h"

data/src/core/lib/iomgr/tcp_server_windows.cc

@@ -46,7 +46,6 @@
 #include "src/core/lib/iomgr/event_engine_shims/endpoint.h"
 #include "src/core/lib/iomgr/iocp_windows.h"
 #include "src/core/lib/iomgr/pollset_windows.h"
-#include "src/core/lib/iomgr/resolve_address.h"
 #include "src/core/lib/iomgr/sockaddr.h"
 #include "src/core/lib/iomgr/socket_windows.h"
 #include "src/core/lib/iomgr/tcp_server.h"

data/src/core/lib/iomgr/tcp_windows.cc

@@ -206,10 +206,9 @@ static void on_read(void* tcpp, grpc_error_handle error) {
       } else {
         GRPC_TRACE_LOG(tcp, INFO) << "TCP:" << tcp << " unref read_slice";
         grpc_slice_buffer_reset_and_unref(tcp->read_slices);
-        error = grpc_error_set_int(
-            tcp->shutting_down ? GRPC_ERROR_CREATE("TCP stream shutting down")
-                               : GRPC_ERROR_CREATE("End of TCP stream"),
-            grpc_core::StatusIntProperty::kRpcStatus, GRPC_STATUS_UNAVAILABLE);
+        error = absl::UnavailableError(tcp->shutting_down
+                                           ? "TCP stream shutting down"
+                                           : "End of TCP stream");
       }
     }
   }
@@ -238,9 +237,7 @@ static void win_read(grpc_endpoint* ep, grpc_slice_buffer* read_slices,
   if (tcp->shutting_down) {
     grpc_core::ExecCtx::Run(
         DEBUG_LOCATION, cb,
-        grpc_error_set_int(GRPC_ERROR_CREATE("TCP socket is shutting down"),
-                           grpc_core::StatusIntProperty::kRpcStatus,
-                           GRPC_STATUS_UNAVAILABLE));
+        absl::UnavailableError("TCP socket is shutting down"));
     return;
   }
 
@@ -351,9 +348,7 @@ static void win_write(grpc_endpoint* ep, grpc_slice_buffer* slices,
   if (tcp->shutting_down) {
     grpc_core::ExecCtx::Run(
         DEBUG_LOCATION, cb,
-        grpc_error_set_int(GRPC_ERROR_CREATE("TCP socket is shutting down"),
-                           grpc_core::StatusIntProperty::kRpcStatus,
-                           GRPC_STATUS_UNAVAILABLE));
+        absl::UnavailableError("TCP socket is shutting down"));
     return;
   }
 

data/src/core/lib/iomgr/unix_sockets_posix.cc

@@ -59,8 +59,7 @@ grpc_resolve_unix_domain_address(absl::string_view name) {
   if (error.ok()) {
     return std::vector<grpc_resolved_address>({addr});
   }
-  auto result = grpc_error_to_absl_status(error);
-  return result;
+  return error;
 }
 
 absl::StatusOr<std::vector<grpc_resolved_address>>
@@ -71,8 +70,7 @@ grpc_resolve_unix_abstract_domain_address(const absl::string_view name) {
   if (error.ok()) {
     return std::vector<grpc_resolved_address>({addr});
   }
-  auto result = grpc_error_to_absl_status(error);
-  return result;
+  return error;
 }
 
 int grpc_is_unix_socket(const grpc_resolved_address* resolved_addr) {

data/src/core/lib/iomgr/unix_sockets_posix.h

@@ -23,9 +23,11 @@
 #include <grpc/support/string_util.h>
 
 #include <string>
+#include <vector>
 
 #include "src/core/lib/iomgr/port.h"
-#include "src/core/lib/iomgr/resolve_address.h"
+#include "src/core/lib/iomgr/resolved_address.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 
 void grpc_create_socketpair_if_unix(int sv[2]);

data/src/core/lib/iomgr/vsock.h

@@ -23,9 +23,11 @@
 #include <grpc/support/string_util.h>
 
 #include <string>
+#include <vector>
 
 #include "src/core/lib/iomgr/port.h"
-#include "src/core/lib/iomgr/resolve_address.h"
+#include "src/core/lib/iomgr/resolved_address.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 
 absl::StatusOr<std::vector<grpc_resolved_address>> grpc_resolve_vsock_address(

data/src/core/lib/resource_quota/memory_quota.cc

@@ -405,7 +405,7 @@ void GrpcMemoryAllocatorImpl::Replenish() {
 
 grpc_slice GrpcMemoryAllocatorImpl::MakeSlice(MemoryRequest request) {
   auto size = Reserve(request.Increase(sizeof(SliceRefCount)));
-  void* p = malloc(size);
+  void* p = gpr_malloc(size);
   new (p) SliceRefCount(shared_from_this(), size);
   grpc_slice slice;
   slice.refcount = static_cast<SliceRefCount*>(p);

data/src/core/lib/security/authorization/rbac_policy.cc

@@ -14,10 +14,9 @@
 
 #include "src/core/lib/security/authorization/rbac_policy.h"
 
-#include <grpc/support/port_platform.h>
-
 #include <utility>
 
+#include "src/core/util/string.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/string_view.h"
@@ -51,36 +50,71 @@ Rbac& Rbac::operator=(Rbac&& other) noexcept {
   return *this;
 }
 
-std::string Rbac::ToString() const {
-  std::vector<std::string> contents;
-  absl::string_view condition_str;
+bool Rbac::operator==(const Rbac& other) const {
+  if (name != other.name) return false;
+  if (action != other.action) return false;
+  if (policies != other.policies) return false;
+  if (audit_condition != other.audit_condition) return false;
+  if (logger_configs.size() != other.logger_configs.size()) return false;
+  for (size_t i = 0; i < logger_configs.size(); ++i) {
+    if (logger_configs[i] == nullptr) {
+      if (other.logger_configs[i] != nullptr) return false;
+      continue;
+    }
+    if (other.logger_configs[i] == nullptr) return false;
+    if (logger_configs[i]->name() != other.logger_configs[i]->name() ||
+        logger_configs[i]->ToString() != other.logger_configs[i]->ToString()) {
+      return false;
+    }
+  }
+  return true;
+}
+
+namespace {
+
+absl::string_view AuditConditionString(Rbac::AuditCondition audit_condition) {
   switch (audit_condition) {
     case Rbac::AuditCondition::kNone:
-      condition_str = "None";
-      break;
-    case AuditCondition::kOnDeny:
-      condition_str = "OnDeny";
-      break;
-    case AuditCondition::kOnAllow:
-      condition_str = "OnAllow";
-      break;
-    case AuditCondition::kOnDenyAndAllow:
-      condition_str = "OnDenyAndAllow";
-      break;
+      return "None";
+    case Rbac::AuditCondition::kOnDeny:
+      return "OnDeny";
+    case Rbac::AuditCondition::kOnAllow:
+      return "OnAllow";
+    case Rbac::AuditCondition::kOnDenyAndAllow:
+      return "OnDenyAndAllow";
   }
-  contents.push_back(absl::StrFormat(
-      "Rbac name=%s action=%s audit_condition=%s{", name,
-      action == Rbac::Action::kAllow ? "Allow" : "Deny", condition_str));
-  for (const auto& p : policies) {
-    contents.push_back(absl::StrFormat("{\n  policy_name=%s\n%s\n}", p.first,
-                                       p.second.ToString()));
+  return "<UNKNOWN>";
+}
+
+}  // namespace
+
+std::string Rbac::ToString() const {
+  std::string str = "Rbac{name=";
+  StrAppend(str, name);
+  StrAppend(str, ", action=");
+  StrAppend(str, action == Rbac::Action::kAllow ? "Allow" : "Deny");
+  StrAppend(str, ", audit_condition=");
+  StrAppend(str, AuditConditionString(audit_condition));
+  StrAppend(str, ", policies={");
+  bool is_first = true;
+  for (const auto& [name, policy] : policies) {
+    if (!is_first) StrAppend(str, ", ");
+    StrAppend(str, name);
+    StrAppend(str, "=");
+    StrAppend(str, policy.ToString());
+    is_first = false;
   }
+  StrAppend(str, "}, audit_loggers={");
+  is_first = true;
   for (const auto& config : logger_configs) {
-    contents.push_back(absl::StrFormat("{\n  audit_logger=%s\n%s\n}",
-                                       config->name(), config->ToString()));
+    if (!is_first) StrAppend(str, ", ");
+    StrAppend(str, config->name());
+    StrAppend(str, "=");
+    StrAppend(str, config->ToString());
+    is_first = false;
   }
-  contents.push_back("}");
-  return absl::StrJoin(contents, "\n");
+  StrAppend(str, "}}");
+  return str;
 }
 
 //
@@ -100,6 +134,11 @@ Rbac::CidrRange& Rbac::CidrRange::operator=(Rbac::CidrRange&& other) noexcept {
   return *this;
 }
 
+bool Rbac::CidrRange::operator==(const Rbac::CidrRange& other) const {
+  return address_prefix == other.address_prefix &&
+         prefix_len == other.prefix_len;
+}
+
 std::string Rbac::CidrRange::ToString() const {
   return absl::StrFormat("CidrRange{address_prefix=%s,prefix_len=%d}",
                          address_prefix, prefix_len);
@@ -125,11 +164,11 @@ Rbac::Permission Rbac::Permission::MakeOrPermission(
   return permission;
 }
 
-Rbac::Permission Rbac::Permission::MakeNotPermission(Permission permission) {
+Rbac::Permission Rbac::Permission::MakeNotPermission(
+    std::unique_ptr<Permission> permission) {
   Permission not_permission;
   not_permission.type = Permission::RuleType::kNot;
-  not_permission.permissions.push_back(
-      std::make_unique<Rbac::Permission>(std::move(permission)));
+  not_permission.permissions.push_back(std::move(permission));
   return not_permission;
 }
 
@@ -237,6 +276,25 @@ Rbac::Permission& Rbac::Permission::operator=(
   return *this;
 }
 
+bool Rbac::Permission::operator==(const Rbac::Permission& other) const {
+  if (type != other.type) return false;
+  if (header_matcher != other.header_matcher) return false;
+  if (string_matcher != other.string_matcher) return false;
+  if (ip != other.ip) return false;
+  if (port != other.port) return false;
+  if (invert != other.invert) return false;
+  if (permissions.size() != other.permissions.size()) return false;
+  for (size_t i = 0; i < permissions.size(); ++i) {
+    if (permissions[i] == nullptr) {
+      if (other.permissions[i] != nullptr) return false;
+    } else {
+      if (other.permissions[i] == nullptr) return false;
+      if (*permissions[i] != *other.permissions[i]) return false;
+    }
+  }
+  return true;
+}
+
 std::string Rbac::Permission::ToString() const {
   switch (type) {
     case RuleType::kAnd: {
@@ -245,7 +303,7 @@ std::string Rbac::Permission::ToString() const {
       for (const auto& permission : permissions) {
         contents.push_back(permission->ToString());
       }
-      return absl::StrFormat("and=[%s]", absl::StrJoin(contents, ","));
+      return absl::StrFormat("{and=[%s]}", absl::StrJoin(contents, ", "));
     }
     case RuleType::kOr: {
       std::vector<std::string> contents;
@@ -253,24 +311,24 @@ std::string Rbac::Permission::ToString() const {
       for (const auto& permission : permissions) {
         contents.push_back(permission->ToString());
       }
-      return absl::StrFormat("or=[%s]", absl::StrJoin(contents, ","));
+      return absl::StrFormat("{or=[%s]}", absl::StrJoin(contents, ", "));
     }
     case RuleType::kNot:
-      return absl::StrFormat("not %s", permissions[0]->ToString());
+      return absl::StrFormat("{not %s}", permissions[0]->ToString());
     case RuleType::kAny:
-      return "any";
+      return "{any}";
     case RuleType::kHeader:
-      return absl::StrFormat("header=%s", header_matcher.ToString());
+      return absl::StrFormat("{header=%s}", header_matcher.ToString());
     case RuleType::kPath:
-      return absl::StrFormat("path=%s", string_matcher.ToString());
+      return absl::StrFormat("{path=%s}", string_matcher.ToString());
     case RuleType::kDestIp:
-      return absl::StrFormat("dest_ip=%s", ip.ToString());
+      return absl::StrFormat("{dest_ip=%s}", ip.ToString());
     case RuleType::kDestPort:
-      return absl::StrFormat("dest_port=%d", port);
+      return absl::StrFormat("{dest_port=%d}", port);
     case RuleType::kMetadata:
-      return absl::StrFormat("%smetadata", invert ? "invert " : "");
+      return absl::StrFormat("{%smetadata}", invert ? "invert " : "");
     case RuleType::kReqServerName:
-      return absl::StrFormat("requested_server_name=%s",
+      return absl::StrFormat("{requested_server_name=%s}",
                              string_matcher.ToString());
     default:
       return "";
@@ -297,11 +355,11 @@ Rbac::Principal Rbac::Principal::MakeOrPrincipal(
   return principal;
 }
 
-Rbac::Principal Rbac::Principal::MakeNotPrincipal(Principal principal) {
+Rbac::Principal Rbac::Principal::MakeNotPrincipal(
+    std::unique_ptr<Principal> principal) {
   Principal not_principal;
   not_principal.type = Principal::RuleType::kNot;
-  not_principal.principals.push_back(
-      std::make_unique<Rbac::Principal>(std::move(principal)));
+  not_principal.principals.push_back(std::move(principal));
   return not_principal;
 }
 
@@ -409,6 +467,24 @@ Rbac::Principal& Rbac::Principal::operator=(Rbac::Principal&& other) noexcept {
   return *this;
 }
 
+bool Rbac::Principal::operator==(const Rbac::Principal& other) const {
+  if (type != other.type) return false;
+  if (header_matcher != other.header_matcher) return false;
+  if (string_matcher != other.string_matcher) return false;
+  if (ip != other.ip) return false;
+  if (invert != other.invert) return false;
+  if (principals.size() != other.principals.size()) return false;
+  for (size_t i = 0; i < principals.size(); ++i) {
+    if (principals[i] == nullptr) {
+      if (other.principals[i] != nullptr) return false;
+    } else {
+      if (other.principals[i] == nullptr) return false;
+      if (*principals[i] != *other.principals[i]) return false;
+    }
+  }
+  return true;
+}
+
 std::string Rbac::Principal::ToString() const {
   switch (type) {
     case RuleType::kAnd: {
@@ -417,7 +493,7 @@ std::string Rbac::Principal::ToString() const {
       for (const auto& principal : principals) {
         contents.push_back(principal->ToString());
       }
-      return absl::StrFormat("and=[%s]", absl::StrJoin(contents, ","));
+      return absl::StrFormat("{and=[%s]}", absl::StrJoin(contents, ", "));
     }
     case RuleType::kOr: {
       std::vector<std::string> contents;
@@ -425,26 +501,26 @@ std::string Rbac::Principal::ToString() const {
       for (const auto& principal : principals) {
         contents.push_back(principal->ToString());
       }
-      return absl::StrFormat("or=[%s]", absl::StrJoin(contents, ","));
+      return absl::StrFormat("{or=[%s]}", absl::StrJoin(contents, ", "));
     }
     case RuleType::kNot:
-      return absl::StrFormat("not %s", principals[0]->ToString());
+      return absl::StrFormat("{not %s}", principals[0]->ToString());
     case RuleType::kAny:
-      return "any";
+      return "{any}";
     case RuleType::kPrincipalName:
-      return absl::StrFormat("principal_name=%s", string_matcher->ToString());
+      return absl::StrFormat("{principal_name=%s}", string_matcher->ToString());
     case RuleType::kSourceIp:
-      return absl::StrFormat("source_ip=%s", ip.ToString());
+      return absl::StrFormat("{source_ip=%s}", ip.ToString());
     case RuleType::kDirectRemoteIp:
-      return absl::StrFormat("direct_remote_ip=%s", ip.ToString());
+      return absl::StrFormat("{direct_remote_ip=%s}", ip.ToString());
     case RuleType::kRemoteIp:
-      return absl::StrFormat("remote_ip=%s", ip.ToString());
+      return absl::StrFormat("{remote_ip=%s}", ip.ToString());
     case RuleType::kHeader:
-      return absl::StrFormat("header=%s", header_matcher.ToString());
+      return absl::StrFormat("{header=%s}", header_matcher.ToString());
     case RuleType::kPath:
-      return absl::StrFormat("path=%s", string_matcher->ToString());
+      return absl::StrFormat("{path=%s}", string_matcher->ToString());
     case RuleType::kMetadata:
-      return absl::StrFormat("%smetadata", invert ? "invert " : "");
+      return absl::StrFormat("{%smetadata}", invert ? "invert " : "");
     default:
       return "";
   }
@@ -467,10 +543,17 @@ Rbac::Policy& Rbac::Policy::operator=(Rbac::Policy&& other) noexcept {
   return *this;
 }
 
+bool Rbac::Policy::operator==(const Rbac::Policy& other) const {
+  return permissions == other.permissions && principals == other.principals;
+}
+
 std::string Rbac::Policy::ToString() const {
-  return absl::StrFormat(
-      "  Policy  {\n    Permissions{%s}\n    Principals{%s}\n  }",
-      permissions.ToString(), principals.ToString());
+  std::string str = "{permissions=";
+  StrAppend(str, permissions.ToString());
+  StrAppend(str, ", principals=");
+  StrAppend(str, principals.ToString());
+  StrAppend(str, "}");
+  return str;
 }
 
 }  // namespace grpc_core

data/src/core/lib/security/authorization/rbac_policy.h

@@ -44,6 +44,9 @@ struct Rbac {
     kOnDenyAndAllow,
   };
 
+  // TODO(roth): Unify this with
+  // XdsListenerResource::FilterChainMap::CidrRange, possibly as part of
+  // addressing https://github.com/grpc/grpc/issues/34172.
   struct CidrRange {
     CidrRange() = default;
     CidrRange(std::string address_prefix, uint32_t prefix_len);
@@ -51,6 +54,9 @@ struct Rbac {
     CidrRange(CidrRange&& other) noexcept;
     CidrRange& operator=(CidrRange&& other) noexcept;
 
+    bool operator==(const CidrRange& other) const;
+    bool operator!=(const CidrRange& other) const { return !(*this == other); }
+
     std::string ToString() const;
 
     std::string address_prefix;
@@ -76,7 +82,7 @@ struct Rbac {
         std::vector<std::unique_ptr<Permission>> permissions);
     static Permission MakeOrPermission(
         std::vector<std::unique_ptr<Permission>> permissions);
-    static Permission MakeNotPermission(Permission permission);
+    static Permission MakeNotPermission(std::unique_ptr<Permission> permission);
     static Permission MakeAnyPermission();
     static Permission MakeHeaderPermission(HeaderMatcher header_matcher);
     static Permission MakePathPermission(StringMatcher string_matcher);
@@ -91,6 +97,9 @@ struct Rbac {
     Permission(Permission&& other) noexcept;
     Permission& operator=(Permission&& other) noexcept;
 
+    bool operator==(const Permission& other) const;
+    bool operator!=(const Permission& other) const { return !(*this == other); }
+
     std::string ToString() const;
 
     RuleType type = RuleType::kAnd;
@@ -124,7 +133,7 @@ struct Rbac {
         std::vector<std::unique_ptr<Principal>> principals);
     static Principal MakeOrPrincipal(
         std::vector<std::unique_ptr<Principal>> principals);
-    static Principal MakeNotPrincipal(Principal principal);
+    static Principal MakeNotPrincipal(std::unique_ptr<Principal> principal);
     static Principal MakeAnyPrincipal();
     static Principal MakeAuthenticatedPrincipal(
         std::optional<StringMatcher> string_matcher);
@@ -141,6 +150,9 @@ struct Rbac {
     Principal(Principal&& other) noexcept;
     Principal& operator=(Principal&& other) noexcept;
 
+    bool operator==(const Principal& other) const;
+    bool operator!=(const Principal& other) const { return !(*this == other); }
+
     std::string ToString() const;
 
     RuleType type = RuleType::kAnd;
@@ -161,6 +173,9 @@ struct Rbac {
     Policy(Policy&& other) noexcept;
     Policy& operator=(Policy&& other) noexcept;
 
+    bool operator==(const Policy& other) const;
+    bool operator!=(const Policy& other) const { return !(*this == other); }
+
     std::string ToString() const;
 
     Permission permissions;
@@ -174,6 +189,9 @@ struct Rbac {
   Rbac(Rbac&& other) noexcept;
   Rbac& operator=(Rbac&& other) noexcept;
 
+  bool operator==(const Rbac& other) const;
+  bool operator!=(const Rbac& other) const { return !(*this == other); }
+
   std::string ToString() const;
 
   // The authorization policy name or empty string in xDS case.
@@ -182,7 +200,7 @@ struct Rbac {
   Action action;
   std::map<std::string, Policy> policies;
 
-  AuditCondition audit_condition;
+  AuditCondition audit_condition = AuditCondition::kNone;
   std::vector<std::shared_ptr<const experimental::AuditLoggerFactory::Config>>
       logger_configs;
 };