xds: Implementation of Unified Matcher and CEL Integration

MODULE.bazel

@@ -21,6 +21,10 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [
     "com.google.re2j:re2j:1.8",
     "com.google.s2a.proto.v2:s2a-proto:0.1.3",
     "com.google.truth:truth:1.4.5",
+    "dev.cel:runtime:0.11.1",
+    "dev.cel:compiler:0.11.1",
+    "dev.cel:protobuf:0.11.1",
+    "org.antlr:antlr4-runtime:4.9.1",
     "com.squareup.okhttp:okhttp:2.7.5",
     "com.squareup.okio:okio:2.10.0",  # 3.0+ needs swapping to -jvm; need work to avoid flag-day
     "io.netty:netty-buffer:4.1.130.Final",

gradle/libs.versions.toml

@@ -34,6 +34,9 @@ checkstyle = "com.puppycrawl.tools:checkstyle:10.26.1"
 # checkstyle 10.0+ requires Java 11+
 # See https://checkstyle.sourceforge.io/releasenotes_old_8-35_10-26.html#Release_10.0
 # checkForUpdates: checkstylejava8:9.+
+cel-runtime = "dev.cel:runtime:0.11.1"
+cel-protobuf = "dev.cel:protobuf:0.11.1"
+cel-compiler = "dev.cel:compiler:0.11.1"
 checkstylejava8 = "com.puppycrawl.tools:checkstyle:9.3"
 commons-math3 = "org.apache.commons:commons-math3:3.6.1"
 conscrypt = "org.conscrypt:conscrypt-openjdk-uber:2.5.2"

repositories.bzl

@@ -25,6 +25,10 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [
     "com.google.re2j:re2j:1.8",
     "com.google.s2a.proto.v2:s2a-proto:0.1.3",
     "com.google.truth:truth:1.4.5",
+    "dev.cel:runtime:0.11.1",
+    "dev.cel:compiler:0.11.1",
+    "dev.cel:protobuf:0.11.1",
+    "org.antlr:antlr4-runtime:4.9.1",
     "com.squareup.okhttp:okhttp:2.7.5",
     "com.squareup.okio:okio:2.10.0",  # 3.0+ needs swapping to -jvm; need work to avoid flag-day
     "io.netty:netty-buffer:4.1.130.Final",

xds/BUILD.bazel

@@ -41,6 +41,9 @@ java_library(
         artifact("com.google.errorprone:error_prone_annotations"),
         artifact("com.google.guava:guava"),
         artifact("com.google.re2j:re2j"),
+        artifact("dev.cel:runtime"),
+        artifact("dev.cel:protobuf"),
+        artifact("org.antlr:antlr4-runtime"),
         artifact("io.netty:netty-buffer"),
         artifact("io.netty:netty-codec"),
         artifact("io.netty:netty-common"),
@@ -97,6 +100,8 @@ JAR_JAR_RULES = [
     "rule com.google.api.expr.** io.grpc.xds.shaded.com.google.api.expr.@1",
     "rule com.google.security.** io.grpc.xds.shaded.com.google.security.@1",
     "rule dev.cel.expr.** io.grpc.xds.shaded.dev.cel.expr.@1",
+    "rule dev.cel.** io.grpc.xds.shaded.dev.cel.@1",
+    "rule cel.** io.grpc.xds.shaded.cel.@1",
     "rule envoy.annotations.** io.grpc.xds.shaded.envoy.annotations.@1",
     "rule io.envoyproxy.** io.grpc.xds.shaded.io.envoyproxy.@1",
     "rule udpa.annotations.** io.grpc.xds.shaded.udpa.annotations.@1",

xds/build.gradle

@@ -56,11 +56,19 @@ dependencies {
             libraries.re2j,
             libraries.auto.value.annotations,
             libraries.protobuf.java.util
+    implementation(libraries.cel.runtime) {
+        exclude group: 'com.google.protobuf', module: 'protobuf-java'
+    }
+    implementation(libraries.cel.protobuf) {
+        exclude group: 'com.google.protobuf', module: 'protobuf-java'
+    }
+    implementation "org.antlr:antlr4-runtime:4.9.1"
     def nettyDependency = implementation project(':grpc-netty')
 
     testImplementation project(':grpc-api')
     testImplementation project(':grpc-rls')
     testImplementation project(':grpc-inprocess')
+    testImplementation libraries.cel.compiler
     testImplementation testFixtures(project(':grpc-core')),
             testFixtures(project(':grpc-api')),
             testFixtures(project(':grpc-util'))
@@ -175,13 +183,15 @@ tasks.named("javadoc").configure {
     exclude 'io/grpc/xds/XdsNameResolverProvider.java'
     exclude 'io/grpc/xds/internal/**'
     exclude 'io/grpc/xds/Internal*'
+    exclude 'dev/cel/**'
 }
 
 def prefixName = 'io.grpc.xds'
 tasks.named("shadowJar").configure {
     archiveClassifier = null
     dependencies {
         include(project(':grpc-xds'))
+        include(dependency('dev.cel:.*'))
     }
     // Relocated packages commonly need exclusions in jacocoTestReport and javadoc
     // Keep in sync with BUILD.bazel's JAR_JAR_RULES
@@ -198,6 +208,8 @@ tasks.named("shadowJar").configure {
     // TODO: missing java_package option in .proto
     relocate 'udpa.annotations', "${prefixName}.shaded.udpa.annotations"
     relocate 'xds.annotations', "${prefixName}.shaded.xds.annotations"
+    relocate 'dev.cel', "${prefixName}.shaded.dev.cel"
+    relocate 'cel', "${prefixName}.shaded.cel"
     exclude "**/*.proto"
 }
 

xds/src/main/java/io/grpc/xds/internal/MatcherParser.java

@@ -90,11 +90,43 @@ public static Matchers.StringMatcher parseStringMatcher(
         return Matchers.StringMatcher.forSafeRegEx(
                 Pattern.compile(proto.getSafeRegex().getRegex()));
       case CONTAINS:
-        return Matchers.StringMatcher.forContains(proto.getContains());
+        return Matchers.StringMatcher.forContains(proto.getContains(), proto.getIgnoreCase());
       case MATCHPATTERN_NOT_SET:
       default:
         throw new IllegalArgumentException(
                 "Unknown StringMatcher match pattern: " + proto.getMatchPatternCase());
     }
   }
+
+  /** Translate StringMatcher xDS proto to internal StringMatcher. */
+  public static Matchers.StringMatcher parseStringMatcher(
+            com.github.xds.type.matcher.v3.StringMatcher proto) {
+    switch (proto.getMatchPatternCase()) {
+      case EXACT:
+        return Matchers.StringMatcher.forExact(proto.getExact(), proto.getIgnoreCase());
+      case PREFIX:
+        return Matchers.StringMatcher.forPrefix(
+            checkNonEmpty(proto.getPrefix(), "prefix"), proto.getIgnoreCase());
+      case SUFFIX:
+        return Matchers.StringMatcher.forSuffix(
+            checkNonEmpty(proto.getSuffix(), "suffix"), proto.getIgnoreCase());
+      case CONTAINS:
+        return Matchers.StringMatcher.forContains(
+            checkNonEmpty(proto.getContains(), "contains"), proto.getIgnoreCase());
+      case SAFE_REGEX:
+        String regex = checkNonEmpty(proto.getSafeRegex().getRegex(), "regex");
+        return Matchers.StringMatcher.forSafeRegEx(Pattern.compile(regex));
+      default:
+        throw new IllegalArgumentException(
+            "Unknown StringMatcher match pattern: " + proto.getMatchPatternCase());
+    }
+  }
+
+  private static String checkNonEmpty(String value, String name) {
+    if (value.isEmpty()) {
+      throw new IllegalArgumentException("StringMatcher " + name 
+          + " (match_pattern) must be non-empty");
+    }
+    return value;
+  }
 }

xds/src/main/java/io/grpc/xds/internal/Matchers.java

@@ -257,10 +257,15 @@ public static StringMatcher forSafeRegEx(Pattern regEx) {
     }
 
     /** The input string should contain this substring. */
-    public static StringMatcher forContains(String contains) {
+    public static StringMatcher forContains(String contains, boolean ignoreCase) {
       checkNotNull(contains, "contains");
       return StringMatcher.create(null, null, null, null, contains,
-          false/* doesn't matter */);
+          ignoreCase);
+    }
+
+    /** The input string should contain this substring. */
+    public static StringMatcher forContains(String contains) {
+      return forContains(contains, false);
     }
 
     /** Returns the matching result for this string. */
@@ -281,7 +286,9 @@ public boolean matches(String args) {
             ? args.toLowerCase(Locale.ROOT).endsWith(suffix().toLowerCase(Locale.ROOT))
             : args.endsWith(suffix());
       } else if (contains() != null) {
-        return args.contains(contains());
+        return ignoreCase()
+            ? args.toLowerCase(Locale.ROOT).contains(contains().toLowerCase(Locale.ROOT))
+            : args.contains(contains());
       }
       return regEx().matches(args);
     }

xds/src/main/java/io/grpc/xds/internal/matcher/CelCommon.java

@@ -0,0 +1,76 @@
+/*
+ * Copyright 2026 The gRPC Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.grpc.xds.internal.matcher;
+
+import dev.cel.common.CelAbstractSyntaxTree;
+import dev.cel.common.CelOptions;
+import dev.cel.common.ast.CelReference;
+import dev.cel.runtime.CelRuntime;
+import dev.cel.runtime.CelRuntimeFactory;
+import dev.cel.runtime.CelStandardFunctions;
+import dev.cel.runtime.CelStandardFunctions.StandardFunction;
+import dev.cel.runtime.standard.AddOperator.AddOverload;
+import java.util.Map;
+
+/**
+ * Shared utilities for CEL-based matchers and extractors.
+ */
+final class CelCommon {
+  private static final CelOptions CEL_OPTIONS = CelOptions.newBuilder()
+      .enableComprehension(false)
+      .maxRegexProgramSize(100)
+      .build();
+
+
+  private static final CelStandardFunctions FUNCTIONS = 
+      CelStandardFunctions.newBuilder()
+          .filterFunctions((func, over) -> {
+            if (func == StandardFunction.STRING) {
+              return false;
+            }
+            if (func == StandardFunction.ADD) {
+              // TODO: fix this, remove (object) casting when we upgrade to 0.12.0
+              return !over.equals((Object) AddOverload.ADD_STRING)
+                  && !over.equals((Object) AddOverload.ADD_LIST);
+            }
+            return true;
+          })
+          .build();
+
+  static final CelRuntime RUNTIME = CelRuntimeFactory.standardCelRuntimeBuilder()
+      .setStandardEnvironmentEnabled(false)
+      .setStandardFunctions(FUNCTIONS)
+      .setOptions(CEL_OPTIONS)
+      .build();
+
+  private CelCommon() {}
+
+  static void checkAllowedVariables(CelAbstractSyntaxTree ast) {
+    for (Map.Entry<Long, CelReference> entry : 
+        ast.getReferenceMap().entrySet()) {
+      CelReference ref = entry.getValue();
+      // If overload_id is empty, it's a variable reference or type name.
+      // We only support "request".
+      if (!ref.value().isPresent() && ref.overloadIds().isEmpty()) {
+        if (!"request".equals(ref.name())) {
+          throw new IllegalArgumentException(
+              "CEL expression references unknown variable: " + ref.name());
+        }
+      }
+    }
+  }
+}

xds/src/main/java/io/grpc/xds/internal/matcher/CelMatcher.java

@@ -0,0 +1,73 @@
+/*
+ * Copyright 2026 The gRPC Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.grpc.xds.internal.matcher;
+
+import dev.cel.common.CelAbstractSyntaxTree;
+import dev.cel.common.types.SimpleType;
+import dev.cel.runtime.CelEvaluationException;
+import dev.cel.runtime.CelRuntime;
+
+/**
+ * Executes compiled CEL expressions.
+ */
+public final class CelMatcher {
+  private final CelRuntime.Program program;
+
+  private CelMatcher(CelRuntime.Program program) {
+    this.program = program;
+  }
+
+  /**
+   * Compiles the AST into a CelMatcher.
+   * Throws an Exception if validation or evaluation fails during compilation setup.
+   */
+  public static CelMatcher compile(CelAbstractSyntaxTree ast)
+      throws Exception { 
+    // CelEvaluationException -> inside cel-runtime -> Allowed in production signatures
+    // CelValidationException -> inside cel-compiler -> Forbidden in production signatures
+    if (ast.getResultType() != SimpleType.BOOL) {
+      throw new IllegalArgumentException(
+          "CEL expression must evaluate to boolean, got: " + ast.getResultType());
+    }
+    CelCommon.checkAllowedVariables(ast);
+    CelRuntime.Program program = CelCommon.RUNTIME.createProgram(ast);
+    return new CelMatcher(program);
+  }
+
+  /**
+   * Evaluates the CEL expression against the input activation.
+   */
+  public boolean match(Object input) throws CelEvaluationException {
+    Object result;
+    if (input instanceof dev.cel.runtime.CelVariableResolver) {
+      result = program.eval((dev.cel.runtime.CelVariableResolver) input);
+    } else if (input instanceof java.util.Map) {
+      @SuppressWarnings("unchecked")
+      java.util.Map<String, ?> mapInput = (java.util.Map<String, ?>) input;
+      result = program.eval(mapInput);
+    } else {
+      throw new CelEvaluationException(
+          "Unsupported input type for CEL evaluation: " + input.getClass().getName());
+    }
+
+    if (result instanceof Boolean) {
+      return (Boolean) result;
+    }
+    throw new CelEvaluationException(
+        "CEL expression must evaluate to boolean, got: " + result.getClass().getName());
+  }
+}