grpc 1.83.1 → 1.84.0

data/src/core/credentials/transport/tls/ssl_utils.h

@@ -34,6 +34,7 @@
 #include <vector>
 
 #include "src/core/credentials/transport/security_connector.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
@@ -88,7 +89,7 @@ const char** ParseAlpnStringIntoArray(absl::string_view preferred_protocols,
 
 // Initialize TSI SSL server/client handshaker factory.
 grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
-    tsi_ssl_pem_key_cert_pair* key_cert_pair,
+    const grpc_core::PemKeyCertPair* key_cert_pair,
     std::shared_ptr<tsi::RootCertInfo> root_cert_info,
     bool skip_server_certificate_verification, tsi_tls_version min_tls_version,
     tsi_tls_version max_tls_version, tsi_ssl_session_cache* ssl_session_cache,
@@ -99,7 +100,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
     tsi_ssl_client_handshaker_factory** handshaker_factory);
 
 grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
-    std::vector<tsi_ssl_pem_key_cert_pair> key_cert_pairs,
+    grpc_core::KeyCertPairsOrSelector key_cert_pairs,
     std::shared_ptr<tsi::RootCertInfo> root_cert_info,
     grpc_ssl_client_certificate_request_type client_certificate_request,
     tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
@@ -120,8 +121,6 @@ int grpc_ssl_host_matches_name(const tsi_peer* peer,
 
 // --- Default SSL Root Store. ---
 namespace grpc_core {
-using tsi::PrivateKey;
-
 bool IsPrivateKeyEmpty(const PrivateKey& private_key);
 
 // The class implements default SSL root store.
@@ -131,12 +130,11 @@ class DefaultSslRootStore {
   static const tsi_ssl_root_certs_store* GetRootStore();
 
   // Gets the default PEM root certificate.
-  static const char* GetPemRootCerts();
+  static absl::string_view GetPemRootCerts();
 
- protected:
-  // Returns default PEM root certificates in nullptr terminated grpc_slice.
-  // This function is protected instead of private, so that it can be tested.
-  static grpc_slice ComputePemRootCerts();
+  // Returns default PEM root certificates.
+  // DO NOT USE -- exposed for testing purposes only.
+  static Slice ComputePemRootCerts();
 
  private:
   // Construct me not!
@@ -152,48 +150,13 @@ class DefaultSslRootStore {
   static tsi_ssl_root_certs_store* default_root_store_;
 
   // Default PEM root certificates.
-  static grpc_slice default_pem_root_certs_;
-};
-
-class PemKeyCertPair {
- public:
-  PemKeyCertPair(PrivateKey private_key, absl::string_view cert_chain)
-      : private_key_(std::move(private_key)), cert_chain_(cert_chain) {}
-
-  // Movable.
-  PemKeyCertPair(PemKeyCertPair&& other) noexcept {
-    private_key_ = std::move(other.private_key_);
-    cert_chain_ = std::move(other.cert_chain_);
-  }
-  PemKeyCertPair& operator=(PemKeyCertPair&& other) noexcept {
-    private_key_ = std::move(other.private_key_);
-    cert_chain_ = std::move(other.cert_chain_);
-    return *this;
-  }
-
-  // Copyable.
-  PemKeyCertPair(const PemKeyCertPair& other)
-      : private_key_(other.private_key()), cert_chain_(other.cert_chain()) {}
-  PemKeyCertPair& operator=(const PemKeyCertPair& other) {
-    private_key_ = other.private_key();
-    cert_chain_ = other.cert_chain();
-    return *this;
-  }
-
-  bool operator==(const PemKeyCertPair& other) const {
-    return this->private_key() == other.private_key() &&
-           this->cert_chain() == other.cert_chain();
-  }
-
-  const PrivateKey& private_key() const { return private_key_; }
-  const std::string& cert_chain() const { return cert_chain_; }
-
- private:
-  PrivateKey private_key_;
-  std::string cert_chain_;
+  static Slice default_pem_root_certs_;
 };
 
-using PemKeyCertPairList = std::vector<PemKeyCertPair>;
+// Checks whether `std::vector<PemKeyCertPair>` in the variant is empty, or the
+// `CertficateSelector` is nullptr.
+bool IsKeyCertPairsOrSelectorEmpty(
+    const KeyCertPairsOrSelector& key_cert_pairs_or_selector);
 
 }  // namespace grpc_core
 

data/src/core/credentials/transport/tls/tls_security_connector.cc

@@ -31,6 +31,8 @@
 #include <utility>
 #include <vector>
 
+#include "src/core/client_channel/client_channel_args.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_verifier.h"
 #include "src/core/credentials/transport/tls/grpc_tls_credentials_options.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
@@ -75,6 +77,7 @@ void PendingVerifierRequestInit(
   bool has_peer_cert = false;
   bool has_peer_cert_full_chain = false;
   bool has_verified_root_cert_subject = false;
+  bool has_negotiated_key_exchange_group = false;
   std::vector<char*> uri_names;
   std::vector<char*> dns_names;
   std::vector<char*> email_names;
@@ -111,6 +114,10 @@ void PendingVerifierRequestInit(
       request->peer_info.verified_root_cert_subject =
           CopyCoreString(prop->value.data, prop->value.length);
       has_verified_root_cert_subject = true;
+    } else if (strcmp(prop->name, TSI_SSL_NEGOTIATED_KEY_EXCHANGE_GROUP) == 0) {
+      request->peer_info.negotiated_key_exchange_group =
+          CopyCoreString(prop->value.data, prop->value.length);
+      has_negotiated_key_exchange_group = true;
     }
   }
   if (!has_common_name) {
@@ -125,6 +132,9 @@ void PendingVerifierRequestInit(
   if (!has_verified_root_cert_subject) {
     request->peer_info.verified_root_cert_subject = nullptr;
   }
+  if (!has_negotiated_key_exchange_group) {
+    request->peer_info.negotiated_key_exchange_group = nullptr;
+  }
   request->peer_info.san_names.uri_names_size = uri_names.size();
   if (!uri_names.empty()) {
     request->peer_info.san_names.uri_names =
@@ -214,20 +224,11 @@ void PendingVerifierRequestDestroy(
   if (request->peer_info.verified_root_cert_subject != nullptr) {
     gpr_free(const_cast<char*>(request->peer_info.verified_root_cert_subject));
   }
-}
-
-std::vector<tsi_ssl_pem_key_cert_pair> ConvertToTsiPemKeyCertPair(
-    const PemKeyCertPairList& cert_pair_list) {
-  std::vector<tsi_ssl_pem_key_cert_pair> tsi_pairs;
-  for (size_t i = 0; i < cert_pair_list.size(); i++) {
-    GRPC_CHECK(!IsPrivateKeyEmpty(cert_pair_list[i].private_key()));
-    GRPC_CHECK(!cert_pair_list[i].cert_chain().empty());
-    tsi_pairs.emplace_back(cert_pair_list[i].private_key(),
-                           cert_pair_list[i].cert_chain());
+  if (request->peer_info.negotiated_key_exchange_group != nullptr) {
+    gpr_free(
+        const_cast<char*>(request->peer_info.negotiated_key_exchange_group));
   }
-  return tsi_pairs;
 }
-
 }  // namespace
 
 // -------------------channel security connector-------------------
@@ -369,12 +370,17 @@ void TlsChannelSecurityConnector::add_handshakers(
     RefCountedPtr<CollectionScope> collection_scope =
         stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
                                       : nullptr;
+    std::string backend_service(
+        args.GetString(GRPC_ARG_BACKEND_SERVICE).value_or(""));
+    std::string locality(args.GetString(GRPC_ARG_LB_LOCALITY).value_or(""));
+    std::string target(args.GetString(GRPC_ARG_SERVER_URI).value_or(""));
     tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
         client_handshaker_factory_, server_name_indication,
         /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0,
         args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS),
-        std::move(collection_scope), &tsi_hs);
+        std::move(collection_scope), std::move(target), std::move(locality),
+        std::move(backend_service), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);
@@ -455,15 +461,17 @@ ArenaPromise<absl::Status> TlsChannelSecurityConnector::CheckCallHost(
 }
 
 void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
-    OnCertificatesChanged(std::shared_ptr<tsi::RootCertInfo> root_certs,
-                          std::optional<PemKeyCertPairList> key_cert_pairs) {
+    OnCertificatesChanged(
+        std::shared_ptr<tsi::RootCertInfo> root_certs,
+        std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
   GRPC_CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
   if (root_certs != nullptr) {
     security_connector_->root_cert_info_ = std::move(root_certs);
   }
-  if (key_cert_pairs.has_value()) {
-    security_connector_->pem_key_cert_pair_list_ = std::move(key_cert_pairs);
+  if (key_cert_pairs_or_selector.has_value()) {
+    security_connector_->key_cert_pairs_or_selector_ =
+        std::move(key_cert_pairs_or_selector);
   }
   const bool root_ready =
       security_connector_->options_->root_certificate_distributor() ==
@@ -472,7 +480,7 @@ void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
   const bool identity_ready =
       security_connector_->options_->identity_certificate_distributor() ==
           nullptr ||
-      security_connector_->pem_key_cert_pair_list_.has_value();
+      security_connector_->key_cert_pairs_or_selector_.has_value();
   if (root_ready && identity_ready) {
     if (security_connector_->UpdateHandshakerFactoryLocked() !=
         GRPC_SECURITY_OK) {
@@ -554,14 +562,20 @@ TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
   if (client_handshaker_factory_ != nullptr) {
     tsi_ssl_client_handshaker_factory_unref(client_handshaker_factory_);
   }
-  std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pair;
-  if (pem_key_cert_pair_list_.has_value()) {
-    pem_key_cert_pair = ConvertToTsiPemKeyCertPair(*pem_key_cert_pair_list_);
+  const PemKeyCertPair* pem_key_cert_pair = nullptr;
+  if (key_cert_pairs_or_selector_.has_value()) {
+    Match(
+        *key_cert_pairs_or_selector_,
+        [&pem_key_cert_pair](const PemKeyCertPairList& pem_key_cert_pairs) {
+          pem_key_cert_pair =
+              pem_key_cert_pairs.empty() ? nullptr : &pem_key_cert_pairs[0];
+        },
+        // This is not expected to happen and we do nothing here.
+        [](const std::shared_ptr<CertificateSelector>&) {});
   }
   bool use_default_roots = options_->root_certificate_distributor() == nullptr;
   return grpc_ssl_tsi_client_handshaker_factory_init(
-      pem_key_cert_pair.empty() ? nullptr : &pem_key_cert_pair[0],
-      use_default_roots ? nullptr : root_cert_info_,
+      pem_key_cert_pair, use_default_roots ? nullptr : root_cert_info_,
       skip_server_certificate_verification,
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()), ssl_session_cache_,
@@ -730,15 +744,17 @@ int TlsServerSecurityConnector::cmp(
 }
 
 void TlsServerSecurityConnector::TlsServerCertificateWatcher::
-    OnCertificatesChanged(std::shared_ptr<tsi::RootCertInfo> roots,
-                          std::optional<PemKeyCertPairList> key_cert_pairs) {
+    OnCertificatesChanged(
+        std::shared_ptr<tsi::RootCertInfo> roots,
+        std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
   GRPC_CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
   if (roots != nullptr) {
     security_connector_->root_cert_info_ = std::move(roots);
   }
-  if (key_cert_pairs.has_value()) {
-    security_connector_->pem_key_cert_pair_list_ = std::move(key_cert_pairs);
+  if (key_cert_pairs_or_selector.has_value()) {
+    security_connector_->key_cert_pairs_or_selector_ =
+        std::move(key_cert_pairs_or_selector);
   }
   bool root_being_watched =
       security_connector_->options_->root_certificate_distributor() != nullptr;
@@ -747,7 +763,7 @@ void TlsServerSecurityConnector::TlsServerCertificateWatcher::
       security_connector_->options_->identity_certificate_distributor() !=
       nullptr;
   bool identity_has_value =
-      security_connector_->pem_key_cert_pair_list_.has_value();
+      security_connector_->key_cert_pairs_or_selector_.has_value();
   if ((root_being_watched && root_has_value && identity_being_watched &&
        identity_has_value) ||
       (root_being_watched && root_has_value && !identity_being_watched) ||
@@ -831,12 +847,11 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
     tsi_ssl_server_handshaker_factory_unref(server_handshaker_factory_);
   }
   // The identity certs on the server side shouldn't be empty.
-  GRPC_CHECK(pem_key_cert_pair_list_.has_value());
-  GRPC_CHECK(!(*pem_key_cert_pair_list_).empty());
-  std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pairs =
-      ConvertToTsiPemKeyCertPair(*pem_key_cert_pair_list_);
+  GRPC_CHECK(key_cert_pairs_or_selector_.has_value());
+  GRPC_CHECK(!IsKeyCertPairsOrSelectorEmpty(*key_cert_pairs_or_selector_));
   return grpc_ssl_tsi_server_handshaker_factory_init(
-      pem_key_cert_pairs, root_cert_info_, options_->cert_request_type(),
+      *key_cert_pairs_or_selector_, root_cert_info_,
+      options_->cert_request_type(),
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()),
       tls_session_key_logger_.get(), options_->crl_directory().c_str(),

data/src/core/credentials/transport/tls/tls_security_connector.h

@@ -25,11 +25,13 @@
 #include <grpc/support/port_platform.h>
 
 #include <map>
+#include <memory>
 #include <optional>
 #include <string>
 
 #include "src/core/credentials/transport/security_connector.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/handshaker/handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
@@ -41,6 +43,7 @@
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
+#include "src/core/util/match.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/sync.h"
 #include "absl/base/thread_annotations.h"
@@ -96,7 +99,16 @@ class TlsChannelSecurityConnector final
 
   std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
     MutexLock lock(&mu_);
-    return pem_key_cert_pair_list_;
+    std::optional<PemKeyCertPairList> pem_key_cert_pairs;
+    if (key_cert_pairs_or_selector_.has_value()) {
+      Match(
+          *key_cert_pairs_or_selector_,
+          [&pem_key_cert_pairs](const PemKeyCertPairList& key_cert_pairs) {
+            pem_key_cert_pairs = key_cert_pairs;
+          },
+          [](const std::shared_ptr<CertificateSelector>&) {});
+    }
+    return pem_key_cert_pairs;
   }
 
   std::shared_ptr<tsi::RootCertInfo> RootCertInfoForTesting() {
@@ -114,9 +126,9 @@ class TlsChannelSecurityConnector final
     explicit TlsChannelCertificateWatcher(
         TlsChannelSecurityConnector* security_connector)
         : security_connector_(security_connector) {}
-    void OnCertificatesChanged(
-        std::shared_ptr<tsi::RootCertInfo> root_certs,
-        std::optional<PemKeyCertPairList> key_cert_pairs) override;
+    void OnCertificatesChanged(std::shared_ptr<tsi::RootCertInfo> root_certs,
+                               std::optional<KeyCertPairsOrSelector>
+                                   key_cert_pairs_or_selector) override;
     void OnError(grpc_error_handle root_cert_error,
                  grpc_error_handle identity_cert_error) override;
 
@@ -167,7 +179,7 @@ class TlsChannelSecurityConnector final
       ABSL_GUARDED_BY(mu_) = nullptr;
   tsi_ssl_session_cache* ssl_session_cache_ ABSL_GUARDED_BY(mu_) = nullptr;
   RefCountedPtr<TlsSessionKeyLogger> tls_session_key_logger_;
-  std::optional<PemKeyCertPairList> pem_key_cert_pair_list_
+  std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector_
       ABSL_GUARDED_BY(mu_);
   std::shared_ptr<tsi::RootCertInfo> root_cert_info_ ABSL_GUARDED_BY(mu_);
   std::map<grpc_closure* /*on_peer_checked*/, ChannelPendingVerifierRequest*>
@@ -208,7 +220,16 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
 
   std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
     MutexLock lock(&mu_);
-    return pem_key_cert_pair_list_;
+    std::optional<PemKeyCertPairList> pem_key_cert_pairs;
+    if (key_cert_pairs_or_selector_.has_value()) {
+      Match(
+          *key_cert_pairs_or_selector_,
+          [&pem_key_cert_pairs](const PemKeyCertPairList& key_cert_pairs) {
+            pem_key_cert_pairs = key_cert_pairs;
+          },
+          [](const std::shared_ptr<CertificateSelector>&) {});
+    }
+    return pem_key_cert_pairs;
   }
 
   std::shared_ptr<tsi::RootCertInfo> RootCertInfoForTesting() {
@@ -226,9 +247,9 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
     explicit TlsServerCertificateWatcher(
         TlsServerSecurityConnector* security_connector)
         : security_connector_(security_connector) {}
-    void OnCertificatesChanged(
-        std::shared_ptr<tsi::RootCertInfo> roots,
-        std::optional<PemKeyCertPairList> key_cert_pairs) override;
+    void OnCertificatesChanged(std::shared_ptr<tsi::RootCertInfo> roots,
+                               std::optional<KeyCertPairsOrSelector>
+                                   key_cert_pairs_or_selector) override;
 
     void OnError(grpc_error_handle root_cert_error,
                  grpc_error_handle identity_cert_error) override;
@@ -276,7 +297,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
       identity_certificate_watcher_ = nullptr;
   tsi_ssl_server_handshaker_factory* server_handshaker_factory_
       ABSL_GUARDED_BY(mu_) = nullptr;
-  std::optional<PemKeyCertPairList> pem_key_cert_pair_list_
+  std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector_
       ABSL_GUARDED_BY(mu_);
   std::shared_ptr<tsi::RootCertInfo> root_cert_info_ ABSL_GUARDED_BY(mu_);
   RefCountedPtr<TlsSessionKeyLogger> tls_session_key_logger_;

data/src/core/ext/filters/channel_idle/legacy_channel_idle_filter.cc

@@ -284,9 +284,8 @@ void LegacyChannelIdleFilter::StartIdleTimer() {
 
 void LegacyChannelIdleFilter::CloseChannel(absl::string_view reason) {
   auto* op = grpc_make_transport_op(nullptr);
-  op->disconnect_with_error = grpc_error_set_int(
-      GRPC_ERROR_CREATE(reason), StatusIntProperty::ChannelConnectivityState,
-      GRPC_CHANNEL_IDLE);
+  op->disconnect_with_error = GRPC_ERROR_CREATE(reason);
+  op->go_idle = true;
   // Pass the transport op down to the channel stack.
   auto* elem = grpc_channel_stack_element(channel_stack_, 0);
   elem->filter->start_transport_op(elem, op);
@@ -305,14 +304,19 @@ void RegisterLegacyChannelIdleFilters(CoreConfiguration::Builder* builder) {
         return GetClientIdleTimeout(channel_args) != Duration::Infinity();
       });
 
-  builder->channel_init()
-      ->RegisterV2Filter<LegacyMaxAgeFilter>(GRPC_SERVER_CHANNEL)
-      .FloatToTop()
-      .ExcludeFromMinimalStack()
-      .If([](const ChannelArgs& channel_args) {
-        return LegacyMaxAgeFilter::Config::FromChannelArgs(channel_args)
-            .enable();
-      });
+  auto& max_age_registration =
+      builder->channel_init()
+          ->RegisterV2Filter<LegacyMaxAgeFilter>(GRPC_SERVER_CHANNEL)
+          .ExcludeFromMinimalStack()
+          .If([](const ChannelArgs& channel_args) {
+            return LegacyMaxAgeFilter::Config::FromChannelArgs(channel_args)
+                .enable();
+          });
+  if (IsFixV3FilterStackServerSideOrderingEnabled()) {
+    max_age_registration.SinkToBottom();
+  } else {
+    max_age_registration.FloatToTop();
+  }
 }
 
 LegacyMaxAgeFilter::LegacyMaxAgeFilter(grpc_channel_stack* channel_stack,

data/src/core/ext/filters/http/http_filters_plugin.cc

@@ -48,11 +48,6 @@ void RegisterHttpFilters(CoreConfiguration::Builder* builder) {
       .If(IsBuildingHttpLikeTransport)
       .After<HttpClientFilter>()
       .After<ClientMessageSizeFilter>();
-  builder->channel_init()
-      ->RegisterFilter<ServerCompressionFilter>(GRPC_SERVER_CHANNEL)
-      .If(IsBuildingHttpLikeTransport)
-      .After<HttpServerFilter>()
-      .After<ServerMessageSizeFilter>();
   builder->channel_init()
       ->RegisterFilter<HttpClientFilter>(GRPC_CLIENT_SUBCHANNEL)
       .If(IsBuildingHttpLikeTransport)
@@ -61,15 +56,31 @@ void RegisterHttpFilters(CoreConfiguration::Builder* builder) {
       ->RegisterFilter<HttpClientFilter>(GRPC_CLIENT_DIRECT_CHANNEL)
       .If(IsBuildingHttpLikeTransport)
       .After<ClientMessageSizeFilter>();
-  builder->channel_init()
-      ->RegisterFilter<HttpServerFilter>(GRPC_SERVER_CHANNEL)
-      .If(IsBuildingHttpLikeTransport)
-      .After<ServerMessageSizeFilter>();
   builder->channel_init()
       ->RegisterFilter<HttpClientFilter>(GRPC_CLIENT_VIRTUAL_CHANNEL)
       .If(IsBuildingHttpLikeTransport);
+
+  // Server side filters.
+  auto& compression_reg =
+      builder->channel_init()
+          ->RegisterFilter<ServerCompressionFilter>(GRPC_SERVER_CHANNEL)
+          .If(IsBuildingHttpLikeTransport);
+  auto& http_server_reg =
+      builder->channel_init()
+          ->RegisterFilter<HttpServerFilter>(GRPC_SERVER_CHANNEL)
+          .If(IsBuildingHttpLikeTransport);
+
   builder->channel_init()
       ->RegisterFilter<HttpServerFilter>(GRPC_SERVER_VIRTUAL_CHANNEL)
       .If(IsBuildingHttpLikeTransport);
+
+  if (IsFixV3FilterStackServerSideOrderingEnabled()) {
+    compression_reg.Before<HttpServerFilter>()
+        .Before<ServerMessageSizeFilter>();
+    http_server_reg.Before<ServerMessageSizeFilter>();
+  } else {
+    compression_reg.After<HttpServerFilter>().After<ServerMessageSizeFilter>();
+    http_server_reg.After<ServerMessageSizeFilter>();
+  }
 }
 }  // namespace grpc_core

data/src/core/ext/filters/rbac/rbac_filter.cc

@@ -44,21 +44,29 @@ namespace grpc_core {
 absl::Status RbacFilter::Call::OnClientInitialMetadata(ClientMetadata& md,
                                                        RbacFilter* filter) {
   GRPC_LATENT_SEE_SCOPE("RbacFilter::Call::OnClientInitialMetadata");
-  // Fetch and apply the rbac policy from the service config.
-  auto* service_config_call_data = GetContext<ServiceConfigCallData>();
-  auto* method_params = static_cast<RbacMethodParsedConfig*>(
-      service_config_call_data->GetMethodParsedConfig(
-          filter->service_config_parser_index_));
-  if (method_params == nullptr) {
-    return absl::PermissionDeniedError("No RBAC policy found.");
-  } else {
-    auto* authorization_engine =
-        method_params->authorization_engine(filter->index_);
-    if (authorization_engine
-            ->Evaluate(EvaluateArgs(&md, &filter->per_channel_evaluate_args_))
-            .type == AuthorizationEngine::Decision::Type::kDeny) {
-      return absl::PermissionDeniedError("Unauthorized RPC rejected");
+  if (!IsXdsServerFilterChainPerRouteEnabled()) {
+    // Fetch and apply the rbac policy from the service config.
+    auto* service_config_call_data = GetContext<ServiceConfigCallData>();
+    auto* method_params = static_cast<RbacMethodParsedConfig*>(
+        service_config_call_data->GetMethodParsedConfig(
+            filter->service_config_parser_index_));
+    if (method_params == nullptr) {
+      return absl::PermissionDeniedError("No RBAC policy found.");
+    } else {
+      auto* authorization_engine =
+          method_params->authorization_engine(filter->index_);
+      if (authorization_engine
+              ->Evaluate(EvaluateArgs(&md, &filter->per_channel_evaluate_args_))
+              .type == AuthorizationEngine::Decision::Type::kDeny) {
+        return absl::PermissionDeniedError("Unauthorized RPC rejected");
+      }
     }
+    return absl::OkStatus();
+  }
+  auto decision = filter->authorization_engine_.Evaluate(
+      EvaluateArgs(&md, &filter->per_channel_evaluate_args_));
+  if (decision.type == AuthorizationEngine::Decision::Type::kDeny) {
+    return absl::PermissionDeniedError("Unauthorized RPC rejected");
   }
   return absl::OkStatus();
 }
@@ -66,12 +74,6 @@ absl::Status RbacFilter::Call::OnClientInitialMetadata(ClientMetadata& md,
 const grpc_channel_filter RbacFilter::kFilterVtable =
     MakePromiseBasedFilter<RbacFilter, FilterEndpoint::kServer>();
 
-RbacFilter::RbacFilter(size_t index,
-                       EvaluateArgs::PerChannelArgs per_channel_evaluate_args)
-    : index_(index),
-      service_config_parser_index_(RbacServiceConfigParser::ParserIndex()),
-      per_channel_evaluate_args_(std::move(per_channel_evaluate_args)) {}
-
 absl::StatusOr<std::unique_ptr<RbacFilter>> RbacFilter::Create(
     const ChannelArgs& args, ChannelFilter::Args filter_args) {
   auto* auth_context = args.GetObject<grpc_auth_context>();
@@ -84,11 +86,31 @@ absl::StatusOr<std::unique_ptr<RbacFilter>> RbacFilter::Create(
     // side.
     return GRPC_ERROR_CREATE("No transport configured");
   }
+  if (!IsXdsServerFilterChainPerRouteEnabled()) {
+    return std::make_unique<RbacFilter>(
+        filter_args.instance_id(), Rbac(),
+        EvaluateArgs::PerChannelArgs(auth_context, args));
+  }
+  if (filter_args.config() == nullptr) {
+    return absl::InternalError("no config passed to RBAC filter");
+  }
+  if (filter_args.config()->type() != Config::Type()) {
+    return absl::InternalError(
+        absl::StrCat("wrong config type passed to RBAC filter: ",
+                     filter_args.config()->type().name()));
+  }
   return std::make_unique<RbacFilter>(
-      filter_args.instance_id(),
+      /*instance_id=*/0, DownCast<const Config&>(*filter_args.config()).rbac,
       EvaluateArgs::PerChannelArgs(auth_context, args));
 }
 
+RbacFilter::RbacFilter(size_t index, const Rbac& rbac,
+                       EvaluateArgs::PerChannelArgs per_channel_evaluate_args)
+    : index_(index),
+      service_config_parser_index_(RbacServiceConfigParser::ParserIndex()),
+      authorization_engine_(rbac),
+      per_channel_evaluate_args_(std::move(per_channel_evaluate_args)) {}
+
 void RbacFilterRegister(CoreConfiguration::Builder* builder) {
   RbacServiceConfigParser::Register(builder);
 }

data/src/core/ext/filters/rbac/rbac_filter.h

@@ -25,6 +25,8 @@
 #include "src/core/lib/channel/promise_based_filter.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/authorization/evaluate_args.h"
+#include "src/core/lib/security/authorization/grpc_authorization_engine.h"
+#include "src/core/lib/security/authorization/rbac_policy.h"
 #include "src/core/lib/transport/transport.h"
 #include "absl/status/statusor.h"
 
@@ -34,6 +36,20 @@ namespace grpc_core {
 // HTTP RBAC filter. Also serves as the type for channel data for the filter.
 class RbacFilter : public ImplementChannelFilter<RbacFilter> {
  public:
+  struct Config final : public FilterConfig {
+    static UniqueTypeName Type() {
+      return GRPC_UNIQUE_TYPE_NAME_HERE("rbac_filter_config");
+    }
+    UniqueTypeName type() const override { return Type(); }
+
+    bool Equals(const FilterConfig& other) const override {
+      return rbac == DownCast<const Config&>(other).rbac;
+    }
+    std::string ToString() const override { return rbac.ToString(); }
+
+    Rbac rbac;
+  };
+
   // This channel filter is intended to be used by connections on xDS enabled
   // servers configured with RBAC. The RBAC filter fetches the RBAC policy from
   // the method config of service config returned by the ServerConfigSelector,
@@ -45,7 +61,7 @@ class RbacFilter : public ImplementChannelFilter<RbacFilter> {
   static absl::StatusOr<std::unique_ptr<RbacFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
-  RbacFilter(size_t index,
+  RbacFilter(size_t index, const Rbac& rbac,
              EvaluateArgs::PerChannelArgs per_channel_evaluate_args);
 
   class Call {
@@ -64,10 +80,12 @@ class RbacFilter : public ImplementChannelFilter<RbacFilter> {
   };
 
  private:
-  // The index of this filter instance among instances of the same filter.
+  // TODO(roth): Remove these fields as part of removing the
+  // xds_server_filter_chain_per_route experiment.
   size_t index_;
-  // Assigned index for service config data from the parser.
   const size_t service_config_parser_index_;
+
+  GrpcAuthorizationEngine authorization_engine_;
   // Per channel args used for authorization.
   EvaluateArgs::PerChannelArgs per_channel_evaluate_args_;
 };

data/src/core/ext/filters/rbac/rbac_service_config_parser.cc

@@ -564,7 +564,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonPostLoad(
                                       /*required=*/false);
   if (not_rule.has_value()) {
     permission = std::make_unique<Rbac::Permission>(
-        Rbac::Permission::MakeNotPermission(std::move(*not_rule->permission)));
+        Rbac::Permission::MakeNotPermission(std::move(not_rule->permission)));
     return;
   }
   if (errors->size() == original_error_size) {
@@ -719,7 +719,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonPostLoad(
                                      /*required=*/false);
   if (not_rule.has_value()) {
     principal = std::make_unique<Rbac::Principal>(
-        Rbac::Principal::MakeNotPrincipal(std::move(*not_rule->principal)));
+        Rbac::Principal::MakeNotPrincipal(std::move(not_rule->principal)));
     return;
   }
   if (errors->size() == original_error_size) {

data/src/core/ext/transport/chttp2/client/chttp2_connector.cc

@@ -209,7 +209,7 @@ void Chttp2Connector::OnHandshakeDone(absl::StatusOr<HandshakerArgs*> result) {
     } else {
       GRPC_HTTP2_CONNECTOR_DLOG
           << "Chttp2Connector::OnHandshakeDone creating PH2 transport";
-      // TODO(tjagtap) : [PH2][P1] : Validate this code block thoroughly once
+      // TODO(tjagtap) : [PH2][P2] : Validate this code block thoroughly once
       // the ping pong test is in place.
       std::unique_ptr<grpc_event_engine::experimental::EventEngine::Endpoint>
           event_engine_endpoint = grpc_event_engine::experimental::