grpc 1.84.1 → 1.85.0.pre1

data/src/core/credentials/transport/tls/grpc_tls_certificate_verifier.cc

@@ -41,7 +41,7 @@ bool ExternalCertificateVerifier::Verify(
     grpc_tls_custom_verification_check_request* request,
     std::function<void(absl::Status)> callback, absl::Status* sync_status) {
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     request_map_.emplace(request, std::move(callback));
   }
   // Invoke the caller-specified verification logic embedded in
@@ -56,7 +56,7 @@ bool ExternalCertificateVerifier::Verify(
       *sync_status = absl::Status(static_cast<absl::StatusCode>(status_code),
                                   error_details);
     }
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     request_map_.erase(request);
   }
   gpr_free(error_details);
@@ -75,7 +75,7 @@ void ExternalCertificateVerifier::OnVerifyDone(
   auto* self = static_cast<ExternalCertificateVerifier*>(callback_arg);
   std::function<void(absl::Status)> callback;
   {
-    MutexLock lock(&self->mu_);
+    MutexLock lock(self->mu_);
     auto it = self->request_map_.find(request);
     if (it != self->request_map_.end()) {
       callback = std::move(it->second);

data/src/core/credentials/transport/tls/grpc_tls_crl_provider.cc

@@ -56,12 +56,12 @@ absl::StatusOr<std::string> IssuerFromCrl(X509_CRL* crl) {
   if (crl == nullptr) {
     return absl::InvalidArgumentError("crl cannot be null");
   }
-  X509_NAME* issuer = X509_CRL_get_issuer(crl);
+  auto* issuer = X509_CRL_get_issuer(crl);
   if (issuer == nullptr) {
     return absl::InvalidArgumentError("crl cannot have null issuer");
   }
   unsigned char* buf = nullptr;
-  int len = i2d_X509_NAME(issuer, &buf);
+  int len = i2d_X509_NAME(const_cast<X509_NAME*>(issuer), &buf);
   if (len < 0 || buf == nullptr) {
     return absl::InvalidArgumentError("crl cannot have null issuer");
   }
@@ -222,7 +222,7 @@ absl::Status DirectoryReloaderCrlProvider::Update() {
   if (!status.ok()) {
     return status;
   }
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!files_with_errors.empty()) {
     // Need to make sure CRLs we read successfully into new_crls are still
     // in-place updated in crls_.
@@ -245,7 +245,7 @@ absl::Status DirectoryReloaderCrlProvider::Update() {
 
 std::shared_ptr<Crl> DirectoryReloaderCrlProvider::GetCrl(
     const CertificateInfo& certificate_info) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   auto it = crls_.find(certificate_info.Issuer());
   if (it == crls_.end()) {
     return nullptr;

data/src/core/credentials/transport/tls/ssl_utils.cc

@@ -36,6 +36,7 @@
 #include "src/core/config/config_vars.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/load_system_roots.h"
+#include "src/core/credentials/transport/tls/tls_utils.h"
 #include "src/core/ext/transport/chttp2/alpn/alpn.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/transport/auth_context.h"
@@ -308,6 +309,15 @@ grpc_core::RefCountedPtr<grpc_auth_context> grpc_ssl_peer_to_auth_context(
       grpc_auth_context_add_property(
           ctx.get(), GRPC_SSL_NEGOTIATED_KEY_EXCHANGE_GROUP_PROPERTY_NAME,
           prop->value.data, prop->value.length);
+    } else if (strcmp(prop->name,
+                      TSI_SSL_REQUESTED_SERVER_NAME_PEER_PROPERTY) == 0) {
+      grpc_auth_context_add_property(
+          ctx.get(), GRPC_SSL_REQUESTED_SERVER_NAME_PROPERTY_NAME,
+          prop->value.data, prop->value.length);
+    } else if (strcmp(prop->name, TSI_SSL_TLS_VERSION_PEER_PROPERTY) == 0) {
+      grpc_auth_context_add_property(ctx.get(),
+                                     GRPC_SSL_TLS_VERSION_PROPERTY_NAME,
+                                     prop->value.data, prop->value.length);
     } else if (strcmp(prop->name, TSI_SECURITY_LEVEL_PEER_PROPERTY) == 0) {
       grpc_auth_context_add_property(
           ctx.get(), GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME,

data/src/core/credentials/transport/tls/tls_security_connector.cc

@@ -349,7 +349,7 @@ TlsChannelSecurityConnector::~TlsChannelSecurityConnector() {
 void TlsChannelSecurityConnector::add_handshakers(
     const ChannelArgs& args, grpc_pollset_set* /*interested_parties*/,
     HandshakeManager* handshake_mgr) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   tsi_handshaker* tsi_hs = nullptr;
   if (client_handshaker_factory_ != nullptr) {
     // Instantiate TSI handshaker.
@@ -410,7 +410,7 @@ void TlsChannelSecurityConnector::check_peer(
       RefAsSubclass<TlsChannelSecurityConnector>(), on_peer_checked, peer,
       target_name);
   {
-    MutexLock lock(&verifier_request_map_mu_);
+    MutexLock lock(verifier_request_map_mu_);
     pending_verifier_requests_.emplace(on_peer_checked, pending_request);
   }
   pending_request->Start();
@@ -423,7 +423,7 @@ void TlsChannelSecurityConnector::cancel_check_peer(
     grpc_tls_custom_verification_check_request* pending_verifier_request =
         nullptr;
     {
-      MutexLock lock(&verifier_request_map_mu_);
+      MutexLock lock(verifier_request_map_mu_);
       auto it = pending_verifier_requests_.find(on_peer_checked);
       if (it != pending_verifier_requests_.end()) {
         pending_verifier_request = it->second->request();
@@ -465,7 +465,7 @@ void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
         std::shared_ptr<tsi::RootCertInfo> root_certs,
         std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
   GRPC_CHECK_NE(security_connector_, nullptr);
-  MutexLock lock(&security_connector_->mu_);
+  MutexLock lock(security_connector_->mu_);
   if (root_certs != nullptr) {
     security_connector_->root_cert_info_ = std::move(root_certs);
   }
@@ -535,7 +535,7 @@ void TlsChannelSecurityConnector::ChannelPendingVerifierRequest::Start() {
 void TlsChannelSecurityConnector::ChannelPendingVerifierRequest::OnVerifyDone(
     bool run_callback_inline, absl::Status status) {
   {
-    MutexLock lock(&security_connector_->verifier_request_map_mu_);
+    MutexLock lock(security_connector_->verifier_request_map_mu_);
     security_connector_->pending_verifier_requests_.erase(on_peer_checked_);
   }
   grpc_error_handle error;
@@ -666,7 +666,7 @@ TlsServerSecurityConnector::~TlsServerSecurityConnector() {
 void TlsServerSecurityConnector::add_handshakers(
     const ChannelArgs& args, grpc_pollset_set* /*interested_parties*/,
     HandshakeManager* handshake_mgr) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   tsi_handshaker* tsi_hs = nullptr;
   if (server_handshaker_factory_ != nullptr) {
     auto stats_plugin_group =
@@ -703,7 +703,7 @@ void TlsServerSecurityConnector::check_peer(
     auto* pending_request = new ServerPendingVerifierRequest(
         RefAsSubclass<TlsServerSecurityConnector>(), on_peer_checked, peer);
     {
-      MutexLock lock(&verifier_request_map_mu_);
+      MutexLock lock(verifier_request_map_mu_);
       pending_verifier_requests_.emplace(on_peer_checked, pending_request);
     }
     pending_request->Start();
@@ -720,7 +720,7 @@ void TlsServerSecurityConnector::cancel_check_peer(
     grpc_tls_custom_verification_check_request* pending_verifier_request =
         nullptr;
     {
-      MutexLock lock(&verifier_request_map_mu_);
+      MutexLock lock(verifier_request_map_mu_);
       auto it = pending_verifier_requests_.find(on_peer_checked);
       if (it != pending_verifier_requests_.end()) {
         pending_verifier_request = it->second->request();
@@ -748,7 +748,7 @@ void TlsServerSecurityConnector::TlsServerCertificateWatcher::
         std::shared_ptr<tsi::RootCertInfo> roots,
         std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
   GRPC_CHECK_NE(security_connector_, nullptr);
-  MutexLock lock(&security_connector_->mu_);
+  MutexLock lock(security_connector_->mu_);
   if (roots != nullptr) {
     security_connector_->root_cert_info_ = std::move(roots);
   }
@@ -820,7 +820,7 @@ void TlsServerSecurityConnector::ServerPendingVerifierRequest::Start() {
 void TlsServerSecurityConnector::ServerPendingVerifierRequest::OnVerifyDone(
     bool run_callback_inline, absl::Status status) {
   {
-    MutexLock lock(&security_connector_->verifier_request_map_mu_);
+    MutexLock lock(security_connector_->verifier_request_map_mu_);
     security_connector_->pending_verifier_requests_.erase(on_peer_checked_);
   }
   grpc_error_handle error;

data/src/core/credentials/transport/tls/tls_security_connector.h

@@ -93,12 +93,12 @@ class TlsChannelSecurityConnector final
       absl::string_view host, grpc_auth_context* auth_context) override;
 
   tsi_ssl_client_handshaker_factory* ClientHandshakerFactoryForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     return client_handshaker_factory_;
   };
 
   std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     std::optional<PemKeyCertPairList> pem_key_cert_pairs;
     if (key_cert_pairs_or_selector_.has_value()) {
       Match(
@@ -112,7 +112,7 @@ class TlsChannelSecurityConnector final
   }
 
   std::shared_ptr<tsi::RootCertInfo> RootCertInfoForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     return root_cert_info_;
   }
 
@@ -214,12 +214,12 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
   int cmp(const grpc_security_connector* other) const override;
 
   tsi_ssl_server_handshaker_factory* ServerHandshakerFactoryForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     return server_handshaker_factory_;
   };
 
   std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     std::optional<PemKeyCertPairList> pem_key_cert_pairs;
     if (key_cert_pairs_or_selector_.has_value()) {
       Match(
@@ -233,7 +233,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
   }
 
   std::shared_ptr<tsi::RootCertInfo> RootCertInfoForTesting() {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     return root_cert_info_;
   }
 

data/src/core/credentials/transport/tls/tls_utils.h

@@ -27,6 +27,15 @@
 
 #include "absl/strings/string_view.h"
 
+// --- Auth context property names for connection/TLS attributes. ---
+
+// The server name requested by the client via the TLS SNI extension. Note that
+// this is the SNI requested by the client regardless of whether the auth
+// context is on the client side or the server side.
+#define GRPC_SSL_REQUESTED_SERVER_NAME_PROPERTY_NAME "ssl_requested_server_name"
+// The TLS version negotiated for the connection.
+#define GRPC_SSL_TLS_VERSION_PROPERTY_NAME "ssl_tls_version"
+
 namespace grpc_core {
 
 // Matches \a subject_alternative_name with \a matcher. Returns true if there

data/src/core/ext/filters/channel_idle/legacy_channel_idle_filter.cc

@@ -104,7 +104,7 @@ struct LegacyMaxAgeFilter::Config {
       Mutex mu;
       absl::BitGen bit_gen ABSL_GUARDED_BY(mu);
       double MakeUniformDouble(double min, double max) {
-        MutexLock lock(&mu);
+        MutexLock lock(mu);
         return absl::Uniform(bit_gen, min, max);
       }
     };

data/src/core/ext/filters/fault_injection/fault_injection_filter.cc

@@ -266,7 +266,7 @@ FaultInjectionFilter::MakeInjectionDecision(
   bool delay_request = delay != Duration::Zero();
   bool abort_request = abort_code != GRPC_STATUS_OK;
   if (delay_request || abort_request) {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     if (delay_request) {
       delay_request =
           UnderFraction(&delay_rand_generator_, delay_percentage_numerator,

data/src/core/ext/filters/gcp_authentication/gcp_authentication_filter.cc

@@ -134,14 +134,14 @@ UniqueTypeName GcpAuthenticationFilter::CallCredentialsCache::Type() {
 
 void GcpAuthenticationFilter::CallCredentialsCache::SetMaxSize(
     size_t max_size) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   cache_.SetMaxSize(max_size);
 }
 
 RefCountedPtr<grpc_call_credentials>
 GcpAuthenticationFilter::CallCredentialsCache::Get(
     const std::string& audience) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   return cache_.GetOrInsert(audience, [](const std::string& audience) {
     return MakeRefCounted<GcpServiceAccountIdentityCallCredentials>(audience);
   });

data/src/core/ext/filters/gcp_authentication/gcp_authentication_filter.h

@@ -50,7 +50,7 @@ class GcpAuthenticationFilter
     void SetMaxSize(size_t max_size);
 
     size_t max_size() const {
-      MutexLock lock(&mu_);
+      MutexLock lock(mu_);
       return cache_.max_size();
     }
 

data/src/core/ext/filters/http/message_compress/compression_filter.cc

@@ -172,12 +172,27 @@ absl::StatusOr<MessageHandle> ChannelCompression::DecompressMessage(
         is_client ? "CLIENT" : "SERVER", message->payload()->Length(),
         *args.max_recv_message_length));
   }
+  if ((message->flags() & GRPC_WRITE_INTERNAL_COMPRESS) &&
+      args.algorithm == GRPC_COMPRESS_NONE) {
+    return absl::InternalError(
+        "Compression bit set but no encoding configured");
+  }
   // Check if decompression is enabled (if not, we can just pass the message
   // up).
   if (!enable_decompression_ ||
       (message->flags() & GRPC_WRITE_INTERNAL_COMPRESS) == 0) {
     return std::move(message);
   }
+  if (!enabled_compression_algorithms().IsSet(args.algorithm)) {
+    const char* algo_name = CompressionAlgorithmAsString(args.algorithm);
+    absl::string_view algo_name_view =
+        algo_name != nullptr ? algo_name : "unknown";
+    return is_client
+               ? absl::InternalError(absl::StrCat(
+                     "Compression algorithm not supported: ", algo_name_view))
+               : absl::UnimplementedError(absl::StrCat(
+                     "Compression algorithm not supported: ", algo_name_view));
+  }
   // Try to decompress the payload.
   std::optional<uint32_t> max_output_size = IsMessageSizeRefactoringEnabled()
                                                 ? args.max_recv_message_length

data/src/core/ext/filters/rbac/rbac_filter.h

@@ -20,11 +20,11 @@
 #include <grpc/support/port_platform.h>
 #include <stddef.h>
 
+#include "src/core/call/evaluate_args.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
 #include "src/core/lib/promise/arena_promise.h"
-#include "src/core/lib/security/authorization/evaluate_args.h"
 #include "src/core/lib/security/authorization/grpc_authorization_engine.h"
 #include "src/core/lib/security/authorization/rbac_policy.h"
 #include "src/core/lib/transport/transport.h"

data/src/core/ext/transport/chttp2/client/chttp2_connector.cc

@@ -110,7 +110,7 @@ void NullThenSchedClosure(const DebugLocation& location, grpc_closure** closure,
 void Chttp2Connector::Connect(const Args& args, Result* result,
                               grpc_closure* notify) {
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     GRPC_CHECK_EQ(notify_, nullptr);
     args_ = args;
     result_ = result;
@@ -155,7 +155,7 @@ void Chttp2Connector::Connect(const Args& args, Result* result,
 }
 
 void Chttp2Connector::Shutdown(grpc_error_handle error) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   shutdown_ = true;
   if (handshake_mgr_ != nullptr) {
     // Handshaker will also shutdown the endpoint if it exists
@@ -164,7 +164,7 @@ void Chttp2Connector::Shutdown(grpc_error_handle error) {
 }
 
 void Chttp2Connector::OnHandshakeDone(absl::StatusOr<HandshakerArgs*> result) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!result.ok() || shutdown_) {
     if (result.ok()) {
       result = GRPC_ERROR_CREATE("connector shutdown");
@@ -261,7 +261,7 @@ void Chttp2Connector::OnHandshakeDone(absl::StatusOr<HandshakerArgs*> result) {
 
 void Chttp2Connector::OnReceiveSettings(
     absl::StatusOr<uint32_t> max_concurrent_streams) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (max_concurrent_streams.ok()) {
     result_->max_concurrent_streams = *max_concurrent_streams;
   }
@@ -287,7 +287,7 @@ void Chttp2Connector::OnReceiveSettings(
 }
 
 void Chttp2Connector::OnTimeout() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   timer_handle_.reset();
   if (!notify_error_.has_value()) {
     // The transport did not receive the settings frame in time. Destroy the

data/src/core/ext/transport/chttp2/server/chttp2_server.cc

@@ -508,7 +508,7 @@ grpc_error_handle NewChttp2ServerListener::Create(
     // number.
     listener->resolved_address_ = iomgr_addr;
     {
-      MutexLock lock(&listener->mu_);
+      MutexLock lock(listener->mu_);
       listener->add_port_on_start_ = true;
     }
   } else {
@@ -583,7 +583,7 @@ void NewChttp2ServerListener::Start() {
   bool should_add_port = false;
   grpc_tcp_server* tcp_server = nullptr;
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     if (!shutdown_) {
       should_add_port = std::exchange(add_port_on_start_, false);
       // Hold a ref while we start the server
@@ -612,7 +612,7 @@ void NewChttp2ServerListener::Start() {
 }
 
 void NewChttp2ServerListener::SetOnDestroyDone(grpc_closure* on_destroy_done) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   on_destroy_done_ = on_destroy_done;
 }
 
@@ -635,7 +635,8 @@ void NewChttp2ServerListener::OnAccept(
   }
   RefCountedPtr<MitigationEngine> mitigation_engine = self->mitigation_engine();
   if (mitigation_engine != nullptr) {
-    auto action = mitigation_engine->EvaluateIncomingConnection(peer);
+    auto action = mitigation_engine->EvaluateIncomingConnection(
+        MitigationEngine::EvaluateArgs(peer, endpoint.get()));
     if (action == MitigationEngine::Action::kCloseConnection) {
       LOG_EVERY_N_SEC(INFO, 60)
           << "Mitigation engine rejected connection from " << peer;
@@ -651,7 +652,7 @@ void NewChttp2ServerListener::OnAccept(
     // tcp_server but this ref is given away when the listener is orphaned
     // (shutdown). A connection needs the tcp_server to outlast the handshake
     // since the acceptor needs it.
-    MutexLock lock(&self->mu_);
+    MutexLock lock(self->mu_);
     if (self->shutdown_) {
       self->listener_state_->connection_quota()->ReleaseConnections(1);
       return;
@@ -690,7 +691,7 @@ void NewChttp2ServerListener::TcpServerShutdownComplete(
 void NewChttp2ServerListener::Orphan() {
   grpc_tcp_server* tcp_server;
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     shutdown_ = true;
     tcp_server = tcp_server_;
   }
@@ -801,17 +802,22 @@ absl::StatusOr<int> Chttp2ServerAddPort(Server* server, const char* addr,
 
 namespace experimental {
 
+void PassiveListenerImpl::Init(RefCountedPtr<Server> server,
+                               NewChttp2ServerListener* listener) {
+  MutexLock lock(mu_);
+  server_ = std::move(server);
+  listener_ = listener;
+}
+
 absl::Status PassiveListenerImpl::AcceptConnectedEndpoint(
     std::unique_ptr<EventEngine::Endpoint> endpoint) {
-  GRPC_CHECK_NE(server_.get(), nullptr);
   RefCountedPtr<NewChttp2ServerListener> new_listener;
   {
-    MutexLock lock(&mu_);
-    auto* new_listener_ptr = std::get_if<NewChttp2ServerListener*>(&listener_);
-    if (new_listener_ptr != nullptr && *new_listener_ptr != nullptr) {
-      new_listener = (*new_listener_ptr)
-                         ->RefIfNonZero()
-                         .TakeAsSubclass<NewChttp2ServerListener>();
+    MutexLock lock(mu_);
+    GRPC_CHECK_NE(server_.get(), nullptr);
+    if (listener_ != nullptr) {
+      new_listener =
+          listener_->RefIfNonZero().TakeAsSubclass<NewChttp2ServerListener>();
     }
   }
   if (new_listener == nullptr) {
@@ -823,9 +829,13 @@ absl::Status PassiveListenerImpl::AcceptConnectedEndpoint(
 }
 
 absl::Status PassiveListenerImpl::AcceptConnectedFd(int fd) {
-  GRPC_CHECK_NE(server_.get(), nullptr);
   ExecCtx exec_ctx;
-  auto& args = server_->channel_args();
+  ChannelArgs args;
+  {
+    MutexLock lock(mu_);
+    GRPC_CHECK_NE(server_.get(), nullptr);
+    args = server_->channel_args();
+  }
   auto* supports_fd = QueryExtension<EventEngineSupportsFdExtension>(
       args.GetObjectRef<EventEngine>().get());
   if (supports_fd == nullptr) {
@@ -842,8 +852,8 @@ absl::Status PassiveListenerImpl::AcceptConnectedFd(int fd) {
 }
 
 void PassiveListenerImpl::ListenerDestroyed() {
-  MutexLock lock(&mu_);
-  listener_ = static_cast<Chttp2ServerListener*>(nullptr);
+  MutexLock lock(mu_);
+  listener_ = nullptr;
 }
 
 }  // namespace experimental
@@ -953,10 +963,9 @@ absl::Status grpc_server_add_passive_listener(
                   .SetObject(std::move(sc))
                   .Set(GRPC_ARG_USE_V3_STACK,
                        grpc_core::http2::ShouldEnablePh2Server());
-  passive_listener->listener_ =
+  passive_listener->Init(
+      server->Ref(),
       grpc_core::NewChttp2ServerListener::CreateForPassiveListener(
-          server, args, passive_listener);
-
-  passive_listener->server_ = server->Ref();
+          server, args, passive_listener));
   return absl::OkStatus();
 }

data/src/core/ext/transport/chttp2/server/chttp2_server.h

@@ -46,8 +46,6 @@ struct AcceptorDeleter {
   }
 };
 
-class Chttp2ServerListener;
-
 namespace testing {
 class Chttp2ServerListenerTestPeer;
 class ActiveConnectionTestPeer;
@@ -239,6 +237,9 @@ namespace experimental {
 // details.
 class PassiveListenerImpl final : public PassiveListener {
  public:
+  // Called by grpc_server_add_passive_listener().
+  void Init(RefCountedPtr<Server> server, NewChttp2ServerListener* listener);
+
   absl::Status AcceptConnectedEndpoint(
       std::unique_ptr<grpc_event_engine::experimental::EventEngine::Endpoint>
           endpoint) override ABSL_LOCKS_EXCLUDED(mu_);
@@ -249,17 +250,10 @@ class PassiveListenerImpl final : public PassiveListener {
   void ListenerDestroyed() ABSL_LOCKS_EXCLUDED(mu_);
 
  private:
-  // note: the grpc_core::Server redundant namespace qualification is
-  // required for older gcc versions.
-  friend absl::Status(::grpc_server_add_passive_listener)(
-      grpc_core::Server* server, grpc_server_credentials* credentials,
-      std::shared_ptr<grpc_core::experimental::PassiveListenerImpl>
-          passive_listener);
-
   Mutex mu_;
   // Data members will be populated when initialized.
-  RefCountedPtr<Server> server_;
-  std::variant<Chttp2ServerListener*, NewChttp2ServerListener*> listener_;
+  RefCountedPtr<Server> server_ ABSL_GUARDED_BY(mu_);
+  NewChttp2ServerListener* listener_ ABSL_GUARDED_BY(mu_) = nullptr;
 };
 
 }  // namespace experimental

data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc

@@ -684,13 +684,14 @@ grpc_chttp2_transport::ChannelzDataSource::GetZTrace(absl::string_view name) {
 }
 
 // TODO(alishananda): add unit testing as part of chttp2 promise conversion work
-void grpc_chttp2_transport::WriteSecurityFrame(grpc_core::SliceBuffer* data) {
+void grpc_chttp2_transport::WriteSecurityFrame(grpc_core::SliceBuffer data) {
   grpc_core::ExecCtx exec_ctx;
-  combiner->Run(grpc_core::NewClosure(
-                    [transport = Ref(), data](grpc_error_handle) mutable {
-                      transport->WriteSecurityFrameLocked(data);
-                    }),
-                absl::OkStatus());
+  combiner->Run(
+      grpc_core::NewClosure([transport = Ref(), data = std::move(data)](
+                                grpc_error_handle) mutable {
+        transport->WriteSecurityFrameLocked(&data);
+      }),
+      absl::OkStatus());
 }
 
 void grpc_chttp2_transport::WriteSecurityFrameLocked(
@@ -747,6 +748,7 @@ grpc_chttp2_transport::grpc_chttp2_transport(
           &memory_owner),
       deframe_state(is_client ? GRPC_DTS_FH_0 : GRPC_DTS_CLIENT_PREFIX_0),
       is_client(is_client),
+      auth_context(channel_args.GetObject<grpc_auth_context>()),
       mitigation_engine([&]() {
         auto* provider =
             channel_args.GetObject<grpc_core::MitigationEngineProvider>();
@@ -778,7 +780,9 @@ grpc_chttp2_transport::grpc_chttp2_transport(
             ep.get()));
     if (transport_framing_endpoint_extension != nullptr) {
       transport_framing_endpoint_extension->SetSendFrameCallback(
-          [this](grpc_core::SliceBuffer* data) { WriteSecurityFrame(data); });
+          [this](grpc_core::SliceBuffer data) {
+            WriteSecurityFrame(std::move(data));
+          });
     }
   }
 
@@ -830,7 +834,6 @@ grpc_chttp2_transport::grpc_chttp2_transport(
     grpc_core::test_only_init_callback();
   }
 
-  grpc_auth_context* auth_context = channel_args.GetObject<grpc_auth_context>();
   http2_stats = grpc_core::CreateHttp2StatsCollector(auth_context);
   hpack_parser.hpack_table()->SetHttp2StatsCollector(http2_stats);
 
@@ -959,7 +962,7 @@ static void close_transport_locked(grpc_chttp2_transport* t,
           t->ep.get(), t->interested_parties_until_recv_settings);
       t->interested_parties_until_recv_settings = nullptr;
     }
-    grpc_core::MutexLock lock(&t->ep_destroy_mu);
+    grpc_core::MutexLock lock(t->ep_destroy_mu);
     t->ep.reset();
   }
   t->MaybeNotifyOnReceiveSettingsLocked(error);
@@ -3447,7 +3450,7 @@ void grpc_chttp2_transport::SetPollset(grpc_stream* /*gs*/,
   // using the "poll" polling engine, which is the only one that
   // actually uses pollsets.
   if (strcmp(grpc_get_poll_strategy_name(), "poll") != 0) return;
-  grpc_core::MutexLock lock(&ep_destroy_mu);
+  grpc_core::MutexLock lock(ep_destroy_mu);
   if (ep != nullptr) grpc_endpoint_add_to_pollset(ep.get(), pollset);
 }
 
@@ -3457,7 +3460,7 @@ void grpc_chttp2_transport::SetPollsetSet(grpc_stream* /*gs*/,
   // using the "poll" polling engine, which is the only one that
   // actually uses pollsets.
   if (strcmp(grpc_get_poll_strategy_name(), "poll") != 0) return;
-  grpc_core::MutexLock lock(&ep_destroy_mu);
+  grpc_core::MutexLock lock(ep_destroy_mu);
   if (ep != nullptr) grpc_endpoint_add_to_pollset_set(ep.get(), pollset_set);
 }
 

data/src/core/ext/transport/chttp2/transport/flow_control.cc

@@ -409,6 +409,7 @@ FlowControlAction StreamFlowControl::UpdateAction(FlowControlAction action) {
 void StreamFlowControl::IncomingUpdateContext::HackIncrementPendingSize(
     int64_t pending_size) {
   GRPC_CHECK_GE(pending_size, 0);
+  SetMinProgressSize(1u);
   if (sfc_->pending_size_.has_value()) {
     int64_t final_size = Clamp(sfc_->pending_size_.value() + pending_size,
                                int64_t{0}, kMaxWindowUpdateSize);

data/src/core/ext/transport/chttp2/transport/flow_control.h

@@ -58,10 +58,6 @@ static constexpr const uint32_t kMaxInitialWindowSize = (1u << 30);
 static constexpr const int64_t kMaxWindowDelta = (1u << 20);
 static constexpr const int kDefaultPreferredRxCryptoFrameSize = INT_MAX;
 
-// TODO(tjagtap) [PH2][P2][BDP] Remove this static sleep when the BDP code is
-// done. This needs to be dynamic.
-constexpr Duration kFlowControlPeriodicUpdateTimer = Duration::Seconds(8);
-
 class TransportFlowControl;
 class StreamFlowControl;
 

data/src/core/ext/transport/chttp2/transport/frame.h

@@ -415,6 +415,8 @@ inline constexpr absl::string_view kIdleStreamError =
     "Stream Idle : Receiving any frame other than HEADERS or PRIORITY on a "
     "stream in this state MUST be treated as a connection error of type "
     "PROTOCOL_ERROR.";
+inline constexpr absl::string_view kMaxConcurrentStreamsExceeded =
+    "Exceeded MAX_CONCURRENT_STREAMS limit.";
 
 inline constexpr uint32_t kMaxStreamId31Bit = 0x7fffffffu;
 inline constexpr uint32_t kMaxSize31Bit = 0x7fffffffu;
@@ -445,6 +447,13 @@ inline constexpr absl::string_view kFailedToEnqueueStream =
     "gRPC Transport Error : Failed to enqueue stream to writable stream list";
 inline constexpr absl::string_view kStreamCreationFailed =
     "gRPC Transport Error : Stream creation failed";
+inline constexpr absl::string_view kTransportUnderHighMemoryPressure =
+    "gRPC Stream Error : Server is under memory pressure. Stream rejected.";
+inline constexpr absl::string_view kRejectStreamBeforeSettingsAck =
+    "gRPC Stream Error : Rejecting stream before settings have been "
+    "acknowledged.";
+inline constexpr absl::string_view kRejectStreamOverload =
+    "Rejecting stream due to overload protection.";
 
 inline constexpr uint32_t kDefaultMaxPendingInducedFrames = 10000u;