grpc 1.84.0.pre1 → 1.85.0.pre1

data/src/core/credentials/call/token_fetcher/token_fetcher_credentials.cc

@@ -94,7 +94,7 @@ void TokenFetcherCredentials::FetchState::BackoffTimer::Orphan() {
 }
 
 void TokenFetcherCredentials::FetchState::BackoffTimer::OnTimer() {
-  MutexLock lock(&fetch_state_->creds_->mu_);
+  MutexLock lock(fetch_state_->creds_->mu_);
   if (!timer_handle_.has_value()) return;
   timer_handle_.reset();
   GRPC_TRACE_LOG(token_fetcher_credentials, INFO)
@@ -156,7 +156,7 @@ void TokenFetcherCredentials::FetchState::StartFetchAttempt() {
 
 void TokenFetcherCredentials::FetchState::TokenFetchComplete(
     absl::StatusOr<RefCountedPtr<Token>> token) {
-  MutexLock lock(&creds_->mu_);
+  MutexLock lock(creds_->mu_);
   // If we were shut down, clean up.
   if (std::holds_alternative<Shutdown>(state_)) {
     if (token.ok()) token = absl::CancelledError("credentials shutdown");
@@ -232,7 +232,7 @@ TokenFetcherCredentials::~TokenFetcherCredentials() {
 }
 
 void TokenFetcherCredentials::Orphaned() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   fetch_state_.reset();
 }
 
@@ -241,7 +241,7 @@ TokenFetcherCredentials::GetRequestMetadata(
     ClientMetadataHandle initial_metadata, const GetRequestMetadataArgs*) {
   RefCountedPtr<QueuedCall> queued_call;
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     // If we don't have a cached token or the token is within the
     // refresh duration, start a new fetch if there isn't a pending one.
     if ((token_ == nullptr || (token_->ExpirationTime() - Timestamp::Now()) <=

data/src/core/credentials/transport/google_default/google_default_credentials.cc

@@ -314,7 +314,7 @@ static grpc_error_handle create_default_creds_from_path(
 
 static void update_tenancy() {
   gpr_once_init(&g_once, init_default_credentials);
-  grpc_core::MutexLock lock(g_state_mu);
+  grpc_core::MutexLock lock(*g_state_mu);
 
   // Try a platform-provided hint for GCE.
   if (!g_metadata_server_available) {
@@ -329,7 +329,7 @@ static void update_tenancy() {
 }
 
 static bool metadata_server_available() {
-  grpc_core::MutexLock lock(g_state_mu);
+  grpc_core::MutexLock lock(*g_state_mu);
   return static_cast<bool>(g_metadata_server_available);
 }
 
@@ -531,7 +531,7 @@ void set_gce_tenancy_checker_for_testing(grpc_gce_tenancy_checker checker) {
 void grpc_flush_cached_google_default_credentials(void) {
   ExecCtx exec_ctx;
   gpr_once_init(&g_once, init_default_credentials);
-  MutexLock lock(g_state_mu);
+  MutexLock lock(*g_state_mu);
   g_metadata_server_available = 0;
 }
 

data/src/core/credentials/transport/ssl/ssl_security_connector.cc

@@ -331,7 +331,7 @@ class grpc_ssl_server_security_connector
     bool status;
     if (!has_cert_config_fetcher()) return false;
 
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(mu_);
     grpc_ssl_server_credentials* server_creds =
         static_cast<grpc_ssl_server_credentials*>(this->mutable_server_creds());
     grpc_ssl_certificate_config_reload_status cb_result =

data/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.cc

@@ -34,7 +34,7 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
     std::optional<grpc_core::KeyCertPairsOrSelector>
         key_cert_pairs_or_selector) {
   GRPC_CHECK(roots != nullptr || key_cert_pairs_or_selector.has_value());
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   auto& cert_info = certificate_info_map_[cert_name];
   if (roots != nullptr) {
     // Successful credential updates will clear any pre-existing error.
@@ -93,14 +93,14 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
 
 bool grpc_tls_certificate_distributor::HasRootCerts(
     const std::string& root_cert_name) {
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   const auto it = certificate_info_map_.find(root_cert_name);
   return it != certificate_info_map_.end() && !it->second.AreRootsEmpty();
 };
 
 bool grpc_tls_certificate_distributor::HasKeyCertPairs(
     const std::string& identity_cert_name) {
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   const auto it = certificate_info_map_.find(identity_cert_name);
   return it != certificate_info_map_.end() &&
          !grpc_core::IsKeyCertPairsOrSelectorEmpty(
@@ -112,7 +112,7 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
     std::optional<grpc_error_handle> root_cert_error,
     std::optional<grpc_error_handle> identity_cert_error) {
   GRPC_CHECK(root_cert_error.has_value() || identity_cert_error.has_value());
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   CertificateInfo& cert_info = certificate_info_map_[cert_name];
   if (root_cert_error.has_value()) {
     for (auto* watcher_ptr : cert_info.root_cert_watchers) {
@@ -160,7 +160,7 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
 
 void grpc_tls_certificate_distributor::SetError(grpc_error_handle error) {
   GRPC_CHECK(!error.ok());
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   for (const auto& watcher : watchers_) {
     const auto watcher_ptr = watcher.first;
     GRPC_CHECK_NE(watcher_ptr, nullptr);
@@ -189,7 +189,7 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
   GRPC_CHECK_NE(watcher_ptr, nullptr);
   // Update watchers_ and certificate_info_map_.
   {
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(mu_);
     const auto watcher_it = watchers_.find(watcher_ptr);
     // The caller needs to cancel the watcher first if it wants to re-register
     // the watcher.
@@ -245,7 +245,7 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
   }
   // Invoke watch status callback if needed.
   {
-    grpc_core::MutexLock lock(&callback_mu_);
+    grpc_core::MutexLock lock(callback_mu_);
     if (watch_status_callback_ != nullptr) {
       if (root_cert_name == identity_cert_name &&
           (start_watching_root_cert || start_watching_identity_cert)) {
@@ -275,7 +275,7 @@ void grpc_tls_certificate_distributor::CancelTlsCertificatesWatch(
   bool already_watching_root_for_identity_cert = false;
   // Update watchers_ and certificate_info_map_.
   {
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(mu_);
     auto it = watchers_.find(watcher);
     if (it == watchers_.end()) return;
     WatcherInfo& watcher_info = it->second;
@@ -310,7 +310,7 @@ void grpc_tls_certificate_distributor::CancelTlsCertificatesWatch(
   }
   // Invoke watch status callback if needed.
   {
-    grpc_core::MutexLock lock(&callback_mu_);
+    grpc_core::MutexLock lock(callback_mu_);
     if (watch_status_callback_ != nullptr) {
       if (root_cert_name == identity_cert_name &&
           (stop_watching_root_cert || stop_watching_identity_cert)) {

data/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h

@@ -138,7 +138,7 @@ struct grpc_tls_certificate_distributor
   // are being watched.
   void SetWatchStatusCallback(
       std::function<void(std::string, bool, bool)> callback) {
-    grpc_core::MutexLock lock(&callback_mu_);
+    grpc_core::MutexLock lock(callback_mu_);
     watch_status_callback_ = std::move(callback);
   };
 

data/src/core/credentials/transport/tls/grpc_tls_certificate_provider.cc

@@ -172,7 +172,7 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
   distributor_->SetWatchStatusCallback([this](std::string cert_name,
                                               bool root_being_watched,
                                               bool identity_being_watched) {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     absl::StatusOr<std::shared_ptr<tsi::RootCertInfo>> roots = nullptr;
     std::optional<PemKeyCertPairList> pem_key_cert_pairs;
     FileWatcherCertificateProvider::WatcherInfo& info =
@@ -212,7 +212,7 @@ UniqueTypeName FileWatcherCertificateProvider::type() const {
 }
 
 absl::Status FileWatcherCertificateProvider::ValidateCredentials() const {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!root_cert_info_.ok()) {
     return root_cert_info_.status();
   }
@@ -254,7 +254,7 @@ void FileWatcherCertificateProvider::ForceUpdate() {
     pem_key_cert_pairs = ReadIdentityKeyCertPairFromFiles(
         private_key_path_, identity_certificate_path_);
   }
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   const bool root_changed =
       HasRootCertInfoChanged(root_cert_info_, root_cert_info);
   if (root_changed) {
@@ -406,7 +406,7 @@ InMemoryCertificateProvider::InMemoryCertificateProvider()
   distributor_->SetWatchStatusCallback([this](std::string cert_name,
                                               bool root_being_watched,
                                               bool identity_being_watched) {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     std::shared_ptr<tsi::RootCertInfo> roots;
     std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector;
     WatcherInfo& info = watcher_info_[cert_name];
@@ -433,7 +433,7 @@ InMemoryCertificateProvider::InMemoryCertificateProvider()
 absl::Status InMemoryCertificateProvider::Update(
     std::optional<std::shared_ptr<tsi::RootCertInfo>> root_cert_info,
     std::optional<const KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   const bool root_changed =
       root_cert_info.has_value() &&
       HasRootCertInfoChanged(root_certificates_, *root_cert_info);
@@ -488,7 +488,7 @@ absl::Status InMemoryCertificateProvider::Update(
 }
 
 absl::Status InMemoryCertificateProvider::ValidateCredentials() const {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!root_certificates_.ok()) {
     return root_certificates_.status();
   }

data/src/core/credentials/transport/tls/grpc_tls_certificate_verifier.cc

@@ -41,7 +41,7 @@ bool ExternalCertificateVerifier::Verify(
     grpc_tls_custom_verification_check_request* request,
     std::function<void(absl::Status)> callback, absl::Status* sync_status) {
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     request_map_.emplace(request, std::move(callback));
   }
   // Invoke the caller-specified verification logic embedded in
@@ -56,7 +56,7 @@ bool ExternalCertificateVerifier::Verify(
       *sync_status = absl::Status(static_cast<absl::StatusCode>(status_code),
                                   error_details);
     }
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     request_map_.erase(request);
   }
   gpr_free(error_details);
@@ -75,7 +75,7 @@ void ExternalCertificateVerifier::OnVerifyDone(
   auto* self = static_cast<ExternalCertificateVerifier*>(callback_arg);
   std::function<void(absl::Status)> callback;
   {
-    MutexLock lock(&self->mu_);
+    MutexLock lock(self->mu_);
     auto it = self->request_map_.find(request);
     if (it != self->request_map_.end()) {
       callback = std::move(it->second);

data/src/core/credentials/transport/tls/grpc_tls_crl_provider.cc

@@ -56,12 +56,12 @@ absl::StatusOr<std::string> IssuerFromCrl(X509_CRL* crl) {
   if (crl == nullptr) {
     return absl::InvalidArgumentError("crl cannot be null");
   }
-  X509_NAME* issuer = X509_CRL_get_issuer(crl);
+  auto* issuer = X509_CRL_get_issuer(crl);
   if (issuer == nullptr) {
     return absl::InvalidArgumentError("crl cannot have null issuer");
   }
   unsigned char* buf = nullptr;
-  int len = i2d_X509_NAME(issuer, &buf);
+  int len = i2d_X509_NAME(const_cast<X509_NAME*>(issuer), &buf);
   if (len < 0 || buf == nullptr) {
     return absl::InvalidArgumentError("crl cannot have null issuer");
   }
@@ -222,7 +222,7 @@ absl::Status DirectoryReloaderCrlProvider::Update() {
   if (!status.ok()) {
     return status;
   }
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!files_with_errors.empty()) {
     // Need to make sure CRLs we read successfully into new_crls are still
     // in-place updated in crls_.
@@ -245,7 +245,7 @@ absl::Status DirectoryReloaderCrlProvider::Update() {
 
 std::shared_ptr<Crl> DirectoryReloaderCrlProvider::GetCrl(
     const CertificateInfo& certificate_info) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   auto it = crls_.find(certificate_info.Issuer());
   if (it == crls_.end()) {
     return nullptr;

data/src/core/credentials/transport/tls/ssl_utils.cc

@@ -36,6 +36,7 @@
 #include "src/core/config/config_vars.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/load_system_roots.h"
+#include "src/core/credentials/transport/tls/tls_utils.h"
 #include "src/core/ext/transport/chttp2/alpn/alpn.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/transport/auth_context.h"
@@ -308,6 +309,15 @@ grpc_core::RefCountedPtr<grpc_auth_context> grpc_ssl_peer_to_auth_context(
       grpc_auth_context_add_property(
           ctx.get(), GRPC_SSL_NEGOTIATED_KEY_EXCHANGE_GROUP_PROPERTY_NAME,
           prop->value.data, prop->value.length);
+    } else if (strcmp(prop->name,
+                      TSI_SSL_REQUESTED_SERVER_NAME_PEER_PROPERTY) == 0) {
+      grpc_auth_context_add_property(
+          ctx.get(), GRPC_SSL_REQUESTED_SERVER_NAME_PROPERTY_NAME,
+          prop->value.data, prop->value.length);
+    } else if (strcmp(prop->name, TSI_SSL_TLS_VERSION_PEER_PROPERTY) == 0) {
+      grpc_auth_context_add_property(ctx.get(),
+                                     GRPC_SSL_TLS_VERSION_PROPERTY_NAME,
+                                     prop->value.data, prop->value.length);
     } else if (strcmp(prop->name, TSI_SECURITY_LEVEL_PEER_PROPERTY) == 0) {
       grpc_auth_context_add_property(
           ctx.get(), GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME,

data/src/core/credentials/transport/tls/tls_security_connector.cc

@@ -349,7 +349,7 @@ TlsChannelSecurityConnector::~TlsChannelSecurityConnector() {
 void TlsChannelSecurityConnector::add_handshakers(
     const ChannelArgs& args, grpc_pollset_set* /*interested_parties*/,
     HandshakeManager* handshake_mgr) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   tsi_handshaker* tsi_hs = nullptr;
   if (client_handshaker_factory_ != nullptr) {
     // Instantiate TSI handshaker.
@@ -410,7 +410,7 @@ void TlsChannelSecurityConnector::check_peer(
       RefAsSubclass<TlsChannelSecurityConnector>(), on_peer_checked, peer,
       target_name);
   {
-    MutexLock lock(&verifier_request_map_mu_);
+    MutexLock lock(verifier_request_map_mu_);
     pending_verifier_requests_.emplace(on_peer_checked, pending_request);
   }
   pending_request->Start();
@@ -423,7 +423,7 @@ void TlsChannelSecurityConnector::cancel_check_peer(
     grpc_tls_custom_verification_check_request* pending_verifier_request =
         nullptr;
     {
-      MutexLock lock(&verifier_request_map_mu_);
+      MutexLock lock(verifier_request_map_mu_);
       auto it = pending_verifier_requests_.find(on_peer_checked);
       if (it != pending_verifier_requests_.end()) {
         pending_verifier_request = it->second->request();
@@ -465,7 +465,7 @@ void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
         std::shared_ptr<tsi::RootCertInfo> root_certs,
         std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
   GRPC_CHECK_NE(security_connector_, nullptr);
-  MutexLock lock(&security_connector_->mu_);
+  MutexLock lock(security_connector_->mu_);
   if (root_certs != nullptr) {
     security_connector_->root_cert_info_ = std::move(root_certs);
   }
@@ -535,7 +535,7 @@ void TlsChannelSecurityConnector::ChannelPendingVerifierRequest::Start() {
 void TlsChannelSecurityConnector::ChannelPendingVerifierRequest::OnVerifyDone(
     bool run_callback_inline, absl::Status status) {
   {
-    MutexLock lock(&security_connector_->verifier_request_map_mu_);
+    MutexLock lock(security_connector_->verifier_request_map_mu_);
     security_connector_->pending_verifier_requests_.erase(on_peer_checked_);
   }
   grpc_error_handle error;
@@ -666,7 +666,7 @@ TlsServerSecurityConnector::~TlsServerSecurityConnector() {
 void TlsServerSecurityConnector::add_handshakers(
     const ChannelArgs& args, grpc_pollset_set* /*interested_parties*/,
     HandshakeManager* handshake_mgr) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   tsi_handshaker* tsi_hs = nullptr;
   if (server_handshaker_factory_ != nullptr) {
     auto stats_plugin_group =
@@ -703,7 +703,7 @@ void TlsServerSecurityConnector::check_peer(
     auto* pending_request = new ServerPendingVerifierRequest(
         RefAsSubclass<TlsServerSecurityConnector>(), on_peer_checked, peer);
     {
-      MutexLock lock(&verifier_request_map_mu_);
+      MutexLock lock(verifier_request_map_mu_);
       pending_verifier_requests_.emplace(on_peer_checked, pending_request);
     }
     pending_request->Start();
@@ -720,7 +720,7 @@ void TlsServerSecurityConnector::cancel_check_peer(
     grpc_tls_custom_verification_check_request* pending_verifier_request =
         nullptr;
     {
-      MutexLock lock(&verifier_request_map_mu_);
+      MutexLock lock(verifier_request_map_mu_);
       auto it = pending_verifier_requests_.find(on_peer_checked);
       if (it != pending_verifier_requests_.end()) {
         pending_verifier_request = it->second->request();
@@ -748,7 +748,7 @@ void TlsServerSecurityConnector::TlsServerCertificateWatcher::
         std::shared_ptr<tsi::RootCertInfo> roots,
         std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
   GRPC_CHECK_NE(security_connector_, nullptr);
-  MutexLock lock(&security_connector_->mu_);
+  MutexLock lock(security_connector_->mu_);
   if (roots != nullptr) {
     security_connector_->root_cert_info_ = std::move(roots);
   }
@@ -820,7 +820,7 @@ void TlsServerSecurityConnector::ServerPendingVerifierRequest::Start() {
 void TlsServerSecurityConnector::ServerPendingVerifierRequest::OnVerifyDone(
     bool run_callback_inline, absl::Status status) {
   {
-    MutexLock lock(&security_connector_->verifier_request_map_mu_);
+    MutexLock lock(security_connector_->verifier_request_map_mu_);
     security_connector_->pending_verifier_requests_.erase(on_peer_checked_);
   }
   grpc_error_handle error;

data/src/core/credentials/transport/tls/tls_security_connector.h

@@ -93,12 +93,12 @@ class TlsChannelSecurityConnector final
       absl::string_view host, grpc_auth_context* auth_context) override;
 
   tsi_ssl_client_handshaker_factory* ClientHandshakerFactoryForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     return client_handshaker_factory_;
   };
 
   std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     std::optional<PemKeyCertPairList> pem_key_cert_pairs;
     if (key_cert_pairs_or_selector_.has_value()) {
       Match(
@@ -112,7 +112,7 @@ class TlsChannelSecurityConnector final
   }
 
   std::shared_ptr<tsi::RootCertInfo> RootCertInfoForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     return root_cert_info_;
   }
 
@@ -214,12 +214,12 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
   int cmp(const grpc_security_connector* other) const override;
 
   tsi_ssl_server_handshaker_factory* ServerHandshakerFactoryForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     return server_handshaker_factory_;
   };
 
   std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     std::optional<PemKeyCertPairList> pem_key_cert_pairs;
     if (key_cert_pairs_or_selector_.has_value()) {
       Match(
@@ -233,7 +233,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
   }
 
   std::shared_ptr<tsi::RootCertInfo> RootCertInfoForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     return root_cert_info_;
   }
 

data/src/core/credentials/transport/tls/tls_utils.h

@@ -27,6 +27,15 @@
 
 #include "absl/strings/string_view.h"
 
+// --- Auth context property names for connection/TLS attributes. ---
+
+// The server name requested by the client via the TLS SNI extension. Note that
+// this is the SNI requested by the client regardless of whether the auth
+// context is on the client side or the server side.
+#define GRPC_SSL_REQUESTED_SERVER_NAME_PROPERTY_NAME "ssl_requested_server_name"
+// The TLS version negotiated for the connection.
+#define GRPC_SSL_TLS_VERSION_PROPERTY_NAME "ssl_tls_version"
+
 namespace grpc_core {
 
 // Matches \a subject_alternative_name with \a matcher. Returns true if there

data/src/core/ext/filters/channel_idle/legacy_channel_idle_filter.cc

@@ -104,7 +104,7 @@ struct LegacyMaxAgeFilter::Config {
       Mutex mu;
       absl::BitGen bit_gen ABSL_GUARDED_BY(mu);
       double MakeUniformDouble(double min, double max) {
-        MutexLock lock(&mu);
+        MutexLock lock(mu);
         return absl::Uniform(bit_gen, min, max);
       }
     };

data/src/core/ext/filters/fault_injection/fault_injection_filter.cc

@@ -266,7 +266,7 @@ FaultInjectionFilter::MakeInjectionDecision(
   bool delay_request = delay != Duration::Zero();
   bool abort_request = abort_code != GRPC_STATUS_OK;
   if (delay_request || abort_request) {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     if (delay_request) {
       delay_request =
           UnderFraction(&delay_rand_generator_, delay_percentage_numerator,

data/src/core/ext/filters/gcp_authentication/gcp_authentication_filter.cc

@@ -134,14 +134,14 @@ UniqueTypeName GcpAuthenticationFilter::CallCredentialsCache::Type() {
 
 void GcpAuthenticationFilter::CallCredentialsCache::SetMaxSize(
     size_t max_size) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   cache_.SetMaxSize(max_size);
 }
 
 RefCountedPtr<grpc_call_credentials>
 GcpAuthenticationFilter::CallCredentialsCache::Get(
     const std::string& audience) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   return cache_.GetOrInsert(audience, [](const std::string& audience) {
     return MakeRefCounted<GcpServiceAccountIdentityCallCredentials>(audience);
   });

data/src/core/ext/filters/gcp_authentication/gcp_authentication_filter.h

@@ -50,7 +50,7 @@ class GcpAuthenticationFilter
     void SetMaxSize(size_t max_size);
 
     size_t max_size() const {
-      MutexLock lock(&mu_);
+      MutexLock lock(mu_);
       return cache_.max_size();
     }
 

data/src/core/ext/filters/http/message_compress/compression_filter.cc

@@ -172,12 +172,27 @@ absl::StatusOr<MessageHandle> ChannelCompression::DecompressMessage(
         is_client ? "CLIENT" : "SERVER", message->payload()->Length(),
         *args.max_recv_message_length));
   }
+  if ((message->flags() & GRPC_WRITE_INTERNAL_COMPRESS) &&
+      args.algorithm == GRPC_COMPRESS_NONE) {
+    return absl::InternalError(
+        "Compression bit set but no encoding configured");
+  }
   // Check if decompression is enabled (if not, we can just pass the message
   // up).
   if (!enable_decompression_ ||
       (message->flags() & GRPC_WRITE_INTERNAL_COMPRESS) == 0) {
     return std::move(message);
   }
+  if (!enabled_compression_algorithms().IsSet(args.algorithm)) {
+    const char* algo_name = CompressionAlgorithmAsString(args.algorithm);
+    absl::string_view algo_name_view =
+        algo_name != nullptr ? algo_name : "unknown";
+    return is_client
+               ? absl::InternalError(absl::StrCat(
+                     "Compression algorithm not supported: ", algo_name_view))
+               : absl::UnimplementedError(absl::StrCat(
+                     "Compression algorithm not supported: ", algo_name_view));
+  }
   // Try to decompress the payload.
   std::optional<uint32_t> max_output_size = IsMessageSizeRefactoringEnabled()
                                                 ? args.max_recv_message_length

data/src/core/ext/filters/rbac/rbac_filter.h

@@ -20,11 +20,11 @@
 #include <grpc/support/port_platform.h>
 #include <stddef.h>
 
+#include "src/core/call/evaluate_args.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
 #include "src/core/lib/promise/arena_promise.h"
-#include "src/core/lib/security/authorization/evaluate_args.h"
 #include "src/core/lib/security/authorization/grpc_authorization_engine.h"
 #include "src/core/lib/security/authorization/rbac_policy.h"
 #include "src/core/lib/transport/transport.h"

data/src/core/ext/transport/chttp2/client/chttp2_connector.cc

@@ -110,7 +110,7 @@ void NullThenSchedClosure(const DebugLocation& location, grpc_closure** closure,
 void Chttp2Connector::Connect(const Args& args, Result* result,
                               grpc_closure* notify) {
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     GRPC_CHECK_EQ(notify_, nullptr);
     args_ = args;
     result_ = result;
@@ -155,7 +155,7 @@ void Chttp2Connector::Connect(const Args& args, Result* result,
 }
 
 void Chttp2Connector::Shutdown(grpc_error_handle error) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   shutdown_ = true;
   if (handshake_mgr_ != nullptr) {
     // Handshaker will also shutdown the endpoint if it exists
@@ -164,7 +164,7 @@ void Chttp2Connector::Shutdown(grpc_error_handle error) {
 }
 
 void Chttp2Connector::OnHandshakeDone(absl::StatusOr<HandshakerArgs*> result) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!result.ok() || shutdown_) {
     if (result.ok()) {
       result = GRPC_ERROR_CREATE("connector shutdown");
@@ -261,7 +261,7 @@ void Chttp2Connector::OnHandshakeDone(absl::StatusOr<HandshakerArgs*> result) {
 
 void Chttp2Connector::OnReceiveSettings(
     absl::StatusOr<uint32_t> max_concurrent_streams) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (max_concurrent_streams.ok()) {
     result_->max_concurrent_streams = *max_concurrent_streams;
   }
@@ -287,7 +287,7 @@ void Chttp2Connector::OnReceiveSettings(
 }
 
 void Chttp2Connector::OnTimeout() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   timer_handle_.reset();
   if (!notify_error_.has_value()) {
     // The transport did not receive the settings frame in time. Destroy the