grpc 1.15.0 → 1.30.0

data/src/core/lib/security/transport/secure_endpoint.cc

@@ -22,6 +22,8 @@
    headers. Therefore, sockaddr.h must always be included first */
 #include <grpc/support/port_platform.h>
 
+#include <new>
+
 #include "src/core/lib/iomgr/sockaddr.h"
 
 #include <grpc/slice.h>
@@ -31,6 +33,7 @@
 #include <grpc/support/sync.h>
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gpr/string.h"
+#include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/profiling/timers.h"
 #include "src/core/lib/security/transport/secure_endpoint.h"
 #include "src/core/lib/security/transport/tsi_error.h"
@@ -40,44 +43,68 @@
 
 #define STAGING_BUFFER_SIZE 8192
 
-typedef struct {
+static void on_read(void* user_data, grpc_error* error);
+
+namespace {
+struct secure_endpoint {
+  secure_endpoint(const grpc_endpoint_vtable* vtable,
+                  tsi_frame_protector* protector,
+                  tsi_zero_copy_grpc_protector* zero_copy_protector,
+                  grpc_endpoint* transport, grpc_slice* leftover_slices,
+                  size_t leftover_nslices)
+      : wrapped_ep(transport),
+        protector(protector),
+        zero_copy_protector(zero_copy_protector) {
+    base.vtable = vtable;
+    gpr_mu_init(&protector_mu);
+    GRPC_CLOSURE_INIT(&on_read, ::on_read, this, grpc_schedule_on_exec_ctx);
+    grpc_slice_buffer_init(&source_buffer);
+    grpc_slice_buffer_init(&leftover_bytes);
+    for (size_t i = 0; i < leftover_nslices; i++) {
+      grpc_slice_buffer_add(&leftover_bytes,
+                            grpc_slice_ref_internal(leftover_slices[i]));
+    }
+    grpc_slice_buffer_init(&output_buffer);
+    gpr_ref_init(&ref, 1);
+  }
+
+  ~secure_endpoint() {
+    grpc_endpoint_destroy(wrapped_ep);
+    tsi_frame_protector_destroy(protector);
+    tsi_zero_copy_grpc_protector_destroy(zero_copy_protector);
+    grpc_slice_buffer_destroy_internal(&source_buffer);
+    grpc_slice_buffer_destroy_internal(&leftover_bytes);
+    grpc_slice_unref_internal(read_staging_buffer);
+    grpc_slice_unref_internal(write_staging_buffer);
+    grpc_slice_buffer_destroy_internal(&output_buffer);
+    gpr_mu_destroy(&protector_mu);
+  }
+
   grpc_endpoint base;
   grpc_endpoint* wrapped_ep;
   struct tsi_frame_protector* protector;
   struct tsi_zero_copy_grpc_protector* zero_copy_protector;
   gpr_mu protector_mu;
   /* saved upper level callbacks and user_data. */
-  grpc_closure* read_cb;
-  grpc_closure* write_cb;
+  grpc_closure* read_cb = nullptr;
+  grpc_closure* write_cb = nullptr;
   grpc_closure on_read;
-  grpc_slice_buffer* read_buffer;
+  grpc_slice_buffer* read_buffer = nullptr;
   grpc_slice_buffer source_buffer;
   /* saved handshaker leftover data to unprotect. */
   grpc_slice_buffer leftover_bytes;
   /* buffers for read and write */
-  grpc_slice read_staging_buffer;
-
-  grpc_slice write_staging_buffer;
+  grpc_slice read_staging_buffer = GRPC_SLICE_MALLOC(STAGING_BUFFER_SIZE);
+  grpc_slice write_staging_buffer = GRPC_SLICE_MALLOC(STAGING_BUFFER_SIZE);
   grpc_slice_buffer output_buffer;
 
   gpr_refcount ref;
-} secure_endpoint;
+};
+}  // namespace
 
 grpc_core::TraceFlag grpc_trace_secure_endpoint(false, "secure_endpoint");
 
-static void destroy(secure_endpoint* secure_ep) {
-  secure_endpoint* ep = secure_ep;
-  grpc_endpoint_destroy(ep->wrapped_ep);
-  tsi_frame_protector_destroy(ep->protector);
-  tsi_zero_copy_grpc_protector_destroy(ep->zero_copy_protector);
-  grpc_slice_buffer_destroy_internal(&ep->leftover_bytes);
-  grpc_slice_unref_internal(ep->read_staging_buffer);
-  grpc_slice_unref_internal(ep->write_staging_buffer);
-  grpc_slice_buffer_destroy_internal(&ep->output_buffer);
-  grpc_slice_buffer_destroy_internal(&ep->source_buffer);
-  gpr_mu_destroy(&ep->protector_mu);
-  gpr_free(ep);
-}
+static void destroy(secure_endpoint* ep) { delete ep; }
 
 #ifndef NDEBUG
 #define SECURE_ENDPOINT_UNREF(ep, reason) \
@@ -86,7 +113,7 @@ static void destroy(secure_endpoint* secure_ep) {
   secure_endpoint_ref((ep), (reason), __FILE__, __LINE__)
 static void secure_endpoint_unref(secure_endpoint* ep, const char* reason,
                                   const char* file, int line) {
-  if (grpc_trace_secure_endpoint.enabled()) {
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_trace_secure_endpoint)) {
     gpr_atm val = gpr_atm_no_barrier_load(&ep->ref.count);
     gpr_log(file, line, GPR_LOG_SEVERITY_DEBUG,
             "SECENDP unref %p : %s %" PRIdPTR " -> %" PRIdPTR, ep, reason, val,
@@ -99,7 +126,7 @@ static void secure_endpoint_unref(secure_endpoint* ep, const char* reason,
 
 static void secure_endpoint_ref(secure_endpoint* ep, const char* reason,
                                 const char* file, int line) {
-  if (grpc_trace_secure_endpoint.enabled()) {
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_trace_secure_endpoint)) {
     gpr_atm val = gpr_atm_no_barrier_load(&ep->ref.count);
     gpr_log(file, line, GPR_LOG_SEVERITY_DEBUG,
             "SECENDP   ref %p : %s %" PRIdPTR " -> %" PRIdPTR, ep, reason, val,
@@ -128,7 +155,7 @@ static void flush_read_staging_buffer(secure_endpoint* ep, uint8_t** cur,
 }
 
 static void call_read_cb(secure_endpoint* ep, grpc_error* error) {
-  if (grpc_trace_secure_endpoint.enabled()) {
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_trace_secure_endpoint)) {
     size_t i;
     for (i = 0; i < ep->read_buffer->count; i++) {
       char* data = grpc_dump_slice(ep->read_buffer->slices[i],
@@ -138,7 +165,7 @@ static void call_read_cb(secure_endpoint* ep, grpc_error* error) {
     }
   }
   ep->read_buffer = nullptr;
-  GRPC_CLOSURE_SCHED(ep->read_cb, error);
+  grpc_core::ExecCtx::Run(DEBUG_LOCATION, ep->read_cb, error);
   SECURE_ENDPOINT_UNREF(ep, "read");
 }
 
@@ -228,7 +255,7 @@ static void on_read(void* user_data, grpc_error* error) {
 }
 
 static void endpoint_read(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
-                          grpc_closure* cb) {
+                          grpc_closure* cb, bool urgent) {
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
   ep->read_cb = cb;
   ep->read_buffer = slices;
@@ -242,7 +269,7 @@ static void endpoint_read(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
     return;
   }
 
-  grpc_endpoint_read(ep->wrapped_ep, &ep->source_buffer, &ep->on_read);
+  grpc_endpoint_read(ep->wrapped_ep, &ep->source_buffer, &ep->on_read, urgent);
 }
 
 static void flush_write_staging_buffer(secure_endpoint* ep, uint8_t** cur,
@@ -254,7 +281,7 @@ static void flush_write_staging_buffer(secure_endpoint* ep, uint8_t** cur,
 }
 
 static void endpoint_write(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
-                           grpc_closure* cb) {
+                           grpc_closure* cb, void* arg) {
   GPR_TIMER_SCOPE("secure_endpoint.endpoint_write", 0);
 
   unsigned i;
@@ -265,7 +292,7 @@ static void endpoint_write(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
 
   grpc_slice_buffer_reset_and_unref_internal(&ep->output_buffer);
 
-  if (grpc_trace_secure_endpoint.enabled()) {
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_trace_secure_endpoint)) {
     for (i = 0; i < slices->count; i++) {
       char* data =
           grpc_dump_slice(slices->slices[i], GPR_DUMP_HEX | GPR_DUMP_ASCII);
@@ -336,13 +363,14 @@ static void endpoint_write(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
   if (result != TSI_OK) {
     /* TODO(yangg) do different things according to the error type? */
     grpc_slice_buffer_reset_and_unref_internal(&ep->output_buffer);
-    GRPC_CLOSURE_SCHED(
-        cb, grpc_set_tsi_error_result(
-                GRPC_ERROR_CREATE_FROM_STATIC_STRING("Wrap failed"), result));
+    grpc_core::ExecCtx::Run(
+        DEBUG_LOCATION, cb,
+        grpc_set_tsi_error_result(
+            GRPC_ERROR_CREATE_FROM_STATIC_STRING("Wrap failed"), result));
     return;
   }
 
-  grpc_endpoint_write(ep->wrapped_ep, &ep->output_buffer, cb);
+  grpc_endpoint_write(ep->wrapped_ep, &ep->output_buffer, cb, arg);
 }
 
 static void endpoint_shutdown(grpc_endpoint* secure_ep, grpc_error* why) {
@@ -389,6 +417,11 @@ static grpc_resource_user* endpoint_get_resource_user(
   return grpc_endpoint_get_resource_user(ep->wrapped_ep);
 }
 
+static bool endpoint_can_track_err(grpc_endpoint* secure_ep) {
+  secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
+  return grpc_endpoint_can_track_err(ep->wrapped_ep);
+}
+
 static const grpc_endpoint_vtable vtable = {endpoint_read,
                                             endpoint_write,
                                             endpoint_add_to_pollset,
@@ -398,32 +431,16 @@ static const grpc_endpoint_vtable vtable = {endpoint_read,
                                             endpoint_destroy,
                                             endpoint_get_resource_user,
                                             endpoint_get_peer,
-                                            endpoint_get_fd};
+                                            endpoint_get_fd,
+                                            endpoint_can_track_err};
 
 grpc_endpoint* grpc_secure_endpoint_create(
     struct tsi_frame_protector* protector,
     struct tsi_zero_copy_grpc_protector* zero_copy_protector,
     grpc_endpoint* transport, grpc_slice* leftover_slices,
     size_t leftover_nslices) {
-  size_t i;
   secure_endpoint* ep =
-      static_cast<secure_endpoint*>(gpr_malloc(sizeof(secure_endpoint)));
-  ep->base.vtable = &vtable;
-  ep->wrapped_ep = transport;
-  ep->protector = protector;
-  ep->zero_copy_protector = zero_copy_protector;
-  grpc_slice_buffer_init(&ep->leftover_bytes);
-  for (i = 0; i < leftover_nslices; i++) {
-    grpc_slice_buffer_add(&ep->leftover_bytes,
-                          grpc_slice_ref_internal(leftover_slices[i]));
-  }
-  ep->write_staging_buffer = GRPC_SLICE_MALLOC(STAGING_BUFFER_SIZE);
-  ep->read_staging_buffer = GRPC_SLICE_MALLOC(STAGING_BUFFER_SIZE);
-  grpc_slice_buffer_init(&ep->output_buffer);
-  grpc_slice_buffer_init(&ep->source_buffer);
-  ep->read_buffer = nullptr;
-  GRPC_CLOSURE_INIT(&ep->on_read, on_read, ep, grpc_schedule_on_exec_ctx);
-  gpr_mu_init(&ep->protector_mu);
-  gpr_ref_init(&ep->ref, 1);
+      new secure_endpoint(&vtable, protector, zero_copy_protector, transport,
+                          leftover_slices, leftover_nslices);
   return &ep->base;
 }

data/src/core/lib/security/transport/security_handshaker.cc

@@ -22,6 +22,7 @@
 
 #include <stdbool.h>
 #include <string.h>
+#include <limits>
 
 #include <grpc/slice_buffer.h>
 #include <grpc/support/alloc.h>
@@ -30,6 +31,7 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/handshaker.h"
 #include "src/core/lib/channel/handshaker_registry.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/transport/secure_endpoint.h"
 #include "src/core/lib/security/transport/tsi_error.h"
@@ -38,88 +40,141 @@
 
 #define GRPC_INITIAL_HANDSHAKE_BUFFER_SIZE 256
 
-typedef struct {
-  grpc_handshaker base;
+namespace grpc_core {
+
+namespace {
+
+class SecurityHandshaker : public Handshaker {
+ public:
+  SecurityHandshaker(tsi_handshaker* handshaker,
+                     grpc_security_connector* connector,
+                     const grpc_channel_args* args);
+  ~SecurityHandshaker() override;
+  void Shutdown(grpc_error* why) override;
+  void DoHandshake(grpc_tcp_server_acceptor* acceptor,
+                   grpc_closure* on_handshake_done,
+                   HandshakerArgs* args) override;
+  const char* name() const override { return "security"; }
+
+ private:
+  grpc_error* DoHandshakerNextLocked(const unsigned char* bytes_received,
+                                     size_t bytes_received_size);
+
+  grpc_error* OnHandshakeNextDoneLocked(
+      tsi_result result, const unsigned char* bytes_to_send,
+      size_t bytes_to_send_size, tsi_handshaker_result* handshaker_result);
+  void HandshakeFailedLocked(grpc_error* error);
+  void CleanupArgsForFailureLocked();
+
+  static void OnHandshakeDataReceivedFromPeerFn(void* arg, grpc_error* error);
+  static void OnHandshakeDataSentToPeerFn(void* arg, grpc_error* error);
+  static void OnHandshakeDataReceivedFromPeerFnScheduler(void* arg,
+                                                         grpc_error* error);
+  static void OnHandshakeDataSentToPeerFnScheduler(void* arg,
+                                                   grpc_error* error);
+  static void OnHandshakeNextDoneGrpcWrapper(
+      tsi_result result, void* user_data, const unsigned char* bytes_to_send,
+      size_t bytes_to_send_size, tsi_handshaker_result* handshaker_result);
+  static void OnPeerCheckedFn(void* arg, grpc_error* error);
+  void OnPeerCheckedInner(grpc_error* error);
+  size_t MoveReadBufferIntoHandshakeBuffer();
+  grpc_error* CheckPeerLocked();
 
   // State set at creation time.
-  tsi_handshaker* handshaker;
-  grpc_security_connector* connector;
+  tsi_handshaker* handshaker_;
+  RefCountedPtr<grpc_security_connector> connector_;
 
-  gpr_mu mu;
-  gpr_refcount refs;
+  gpr_mu mu_;
 
-  bool shutdown;
+  bool is_shutdown_ = false;
   // Endpoint and read buffer to destroy after a shutdown.
-  grpc_endpoint* endpoint_to_destroy;
-  grpc_slice_buffer* read_buffer_to_destroy;
+  grpc_endpoint* endpoint_to_destroy_ = nullptr;
+  grpc_slice_buffer* read_buffer_to_destroy_ = nullptr;
 
   // State saved while performing the handshake.
-  grpc_handshaker_args* args;
-  grpc_closure* on_handshake_done;
-
-  unsigned char* handshake_buffer;
-  size_t handshake_buffer_size;
-  grpc_slice_buffer outgoing;
-  grpc_closure on_handshake_data_sent_to_peer;
-  grpc_closure on_handshake_data_received_from_peer;
-  grpc_closure on_peer_checked;
-  grpc_auth_context* auth_context;
-  tsi_handshaker_result* handshaker_result;
-} security_handshaker;
-
-static size_t move_read_buffer_into_handshake_buffer(security_handshaker* h) {
-  size_t bytes_in_read_buffer = h->args->read_buffer->length;
-  if (h->handshake_buffer_size < bytes_in_read_buffer) {
-    h->handshake_buffer = static_cast<uint8_t*>(
-        gpr_realloc(h->handshake_buffer, bytes_in_read_buffer));
-    h->handshake_buffer_size = bytes_in_read_buffer;
+  HandshakerArgs* args_ = nullptr;
+  grpc_closure* on_handshake_done_ = nullptr;
+
+  size_t handshake_buffer_size_;
+  unsigned char* handshake_buffer_;
+  grpc_slice_buffer outgoing_;
+  grpc_closure on_handshake_data_sent_to_peer_;
+  grpc_closure on_handshake_data_received_from_peer_;
+  grpc_closure on_peer_checked_;
+  RefCountedPtr<grpc_auth_context> auth_context_;
+  tsi_handshaker_result* handshaker_result_ = nullptr;
+  size_t max_frame_size_ = 0;
+};
+
+SecurityHandshaker::SecurityHandshaker(tsi_handshaker* handshaker,
+                                       grpc_security_connector* connector,
+                                       const grpc_channel_args* args)
+    : handshaker_(handshaker),
+      connector_(connector->Ref(DEBUG_LOCATION, "handshake")),
+      handshake_buffer_size_(GRPC_INITIAL_HANDSHAKE_BUFFER_SIZE),
+      handshake_buffer_(
+          static_cast<uint8_t*>(gpr_malloc(handshake_buffer_size_))) {
+  const grpc_arg* arg =
+      grpc_channel_args_find(args, GRPC_ARG_TSI_MAX_FRAME_SIZE);
+  if (arg != nullptr && arg->type == GRPC_ARG_INTEGER) {
+    max_frame_size_ = grpc_channel_arg_get_integer(
+        arg, {0, 0, std::numeric_limits<int>::max()});
   }
-  size_t offset = 0;
-  while (h->args->read_buffer->count > 0) {
-    grpc_slice next_slice = grpc_slice_buffer_take_first(h->args->read_buffer);
-    memcpy(h->handshake_buffer + offset, GRPC_SLICE_START_PTR(next_slice),
-           GRPC_SLICE_LENGTH(next_slice));
-    offset += GRPC_SLICE_LENGTH(next_slice);
-    grpc_slice_unref_internal(next_slice);
+  gpr_mu_init(&mu_);
+  grpc_slice_buffer_init(&outgoing_);
+  GRPC_CLOSURE_INIT(&on_peer_checked_, &SecurityHandshaker::OnPeerCheckedFn,
+                    this, grpc_schedule_on_exec_ctx);
+}
+
+SecurityHandshaker::~SecurityHandshaker() {
+  gpr_mu_destroy(&mu_);
+  tsi_handshaker_destroy(handshaker_);
+  tsi_handshaker_result_destroy(handshaker_result_);
+  if (endpoint_to_destroy_ != nullptr) {
+    grpc_endpoint_destroy(endpoint_to_destroy_);
   }
-  return bytes_in_read_buffer;
+  if (read_buffer_to_destroy_ != nullptr) {
+    grpc_slice_buffer_destroy_internal(read_buffer_to_destroy_);
+    gpr_free(read_buffer_to_destroy_);
+  }
+  gpr_free(handshake_buffer_);
+  grpc_slice_buffer_destroy_internal(&outgoing_);
+  auth_context_.reset(DEBUG_LOCATION, "handshake");
+  connector_.reset(DEBUG_LOCATION, "handshake");
 }
 
-static void security_handshaker_unref(security_handshaker* h) {
-  if (gpr_unref(&h->refs)) {
-    gpr_mu_destroy(&h->mu);
-    tsi_handshaker_destroy(h->handshaker);
-    tsi_handshaker_result_destroy(h->handshaker_result);
-    if (h->endpoint_to_destroy != nullptr) {
-      grpc_endpoint_destroy(h->endpoint_to_destroy);
-    }
-    if (h->read_buffer_to_destroy != nullptr) {
-      grpc_slice_buffer_destroy_internal(h->read_buffer_to_destroy);
-      gpr_free(h->read_buffer_to_destroy);
-    }
-    gpr_free(h->handshake_buffer);
-    grpc_slice_buffer_destroy_internal(&h->outgoing);
-    GRPC_AUTH_CONTEXT_UNREF(h->auth_context, "handshake");
-    GRPC_SECURITY_CONNECTOR_UNREF(h->connector, "handshake");
-    gpr_free(h);
+size_t SecurityHandshaker::MoveReadBufferIntoHandshakeBuffer() {
+  size_t bytes_in_read_buffer = args_->read_buffer->length;
+  if (handshake_buffer_size_ < bytes_in_read_buffer) {
+    handshake_buffer_ = static_cast<uint8_t*>(
+        gpr_realloc(handshake_buffer_, bytes_in_read_buffer));
+    handshake_buffer_size_ = bytes_in_read_buffer;
+  }
+  size_t offset = 0;
+  while (args_->read_buffer->count > 0) {
+    grpc_slice* next_slice = grpc_slice_buffer_peek_first(args_->read_buffer);
+    memcpy(handshake_buffer_ + offset, GRPC_SLICE_START_PTR(*next_slice),
+           GRPC_SLICE_LENGTH(*next_slice));
+    offset += GRPC_SLICE_LENGTH(*next_slice);
+    grpc_slice_buffer_remove_first(args_->read_buffer);
   }
+  return bytes_in_read_buffer;
 }
 
-// Set args fields to NULL, saving the endpoint and read buffer for
+// Set args_ fields to NULL, saving the endpoint and read buffer for
 // later destruction.
-static void cleanup_args_for_failure_locked(security_handshaker* h) {
-  h->endpoint_to_destroy = h->args->endpoint;
-  h->args->endpoint = nullptr;
-  h->read_buffer_to_destroy = h->args->read_buffer;
-  h->args->read_buffer = nullptr;
-  grpc_channel_args_destroy(h->args->args);
-  h->args->args = nullptr;
+void SecurityHandshaker::CleanupArgsForFailureLocked() {
+  endpoint_to_destroy_ = args_->endpoint;
+  args_->endpoint = nullptr;
+  read_buffer_to_destroy_ = args_->read_buffer;
+  args_->read_buffer = nullptr;
+  grpc_channel_args_destroy(args_->args);
+  args_->args = nullptr;
 }
 
 // If the handshake failed or we're shutting down, clean up and invoke the
 // callback with the error.
-static void security_handshake_failed_locked(security_handshaker* h,
-                                             grpc_error* error) {
+void SecurityHandshaker::HandshakeFailedLocked(grpc_error* error) {
   if (error == GRPC_ERROR_NONE) {
     // If we were shut down after the handshake succeeded but before an
     // endpoint callback was invoked, we need to generate our own error.
@@ -128,50 +183,54 @@ static void security_handshake_failed_locked(security_handshaker* h,
   const char* msg = grpc_error_string(error);
   gpr_log(GPR_DEBUG, "Security handshake failed: %s", msg);
 
-  if (!h->shutdown) {
+  if (!is_shutdown_) {
+    tsi_handshaker_shutdown(handshaker_);
     // TODO(ctiller): It is currently necessary to shutdown endpoints
     // before destroying them, even if we know that there are no
     // pending read/write callbacks.  This should be fixed, at which
     // point this can be removed.
-    grpc_endpoint_shutdown(h->args->endpoint, GRPC_ERROR_REF(error));
+    grpc_endpoint_shutdown(args_->endpoint, GRPC_ERROR_REF(error));
     // Not shutting down, so the write failed.  Clean up before
     // invoking the callback.
-    cleanup_args_for_failure_locked(h);
+    CleanupArgsForFailureLocked();
     // Set shutdown to true so that subsequent calls to
     // security_handshaker_shutdown() do nothing.
-    h->shutdown = true;
+    is_shutdown_ = true;
   }
   // Invoke callback.
-  GRPC_CLOSURE_SCHED(h->on_handshake_done, error);
+  ExecCtx::Run(DEBUG_LOCATION, on_handshake_done_, error);
 }
 
-static void on_peer_checked_inner(security_handshaker* h, grpc_error* error) {
-  if (error != GRPC_ERROR_NONE || h->shutdown) {
-    security_handshake_failed_locked(h, GRPC_ERROR_REF(error));
+void SecurityHandshaker::OnPeerCheckedInner(grpc_error* error) {
+  MutexLock lock(&mu_);
+  if (error != GRPC_ERROR_NONE || is_shutdown_) {
+    HandshakeFailedLocked(error);
     return;
   }
   // Create zero-copy frame protector, if implemented.
   tsi_zero_copy_grpc_protector* zero_copy_protector = nullptr;
   tsi_result result = tsi_handshaker_result_create_zero_copy_grpc_protector(
-      h->handshaker_result, nullptr, &zero_copy_protector);
+      handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
+      &zero_copy_protector);
   if (result != TSI_OK && result != TSI_UNIMPLEMENTED) {
     error = grpc_set_tsi_error_result(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING(
             "Zero-copy frame protector creation failed"),
         result);
-    security_handshake_failed_locked(h, error);
+    HandshakeFailedLocked(error);
     return;
   }
   // Create frame protector if zero-copy frame protector is NULL.
   tsi_frame_protector* protector = nullptr;
   if (zero_copy_protector == nullptr) {
-    result = tsi_handshaker_result_create_frame_protector(h->handshaker_result,
-                                                          nullptr, &protector);
+    result = tsi_handshaker_result_create_frame_protector(
+        handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
+        &protector);
     if (result != TSI_OK) {
       error = grpc_set_tsi_error_result(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                                             "Frame protector creation failed"),
                                         result);
-      security_handshake_failed_locked(h, error);
+      HandshakeFailedLocked(error);
       return;
     }
   }
@@ -179,68 +238,68 @@ static void on_peer_checked_inner(security_handshaker* h, grpc_error* error) {
   const unsigned char* unused_bytes = nullptr;
   size_t unused_bytes_size = 0;
   result = tsi_handshaker_result_get_unused_bytes(
-      h->handshaker_result, &unused_bytes, &unused_bytes_size);
+      handshaker_result_, &unused_bytes, &unused_bytes_size);
   // Create secure endpoint.
   if (unused_bytes_size > 0) {
     grpc_slice slice =
         grpc_slice_from_copied_buffer((char*)unused_bytes, unused_bytes_size);
-    h->args->endpoint = grpc_secure_endpoint_create(
-        protector, zero_copy_protector, h->args->endpoint, &slice, 1);
+    args_->endpoint = grpc_secure_endpoint_create(
+        protector, zero_copy_protector, args_->endpoint, &slice, 1);
     grpc_slice_unref_internal(slice);
   } else {
-    h->args->endpoint = grpc_secure_endpoint_create(
-        protector, zero_copy_protector, h->args->endpoint, nullptr, 0);
+    args_->endpoint = grpc_secure_endpoint_create(
+        protector, zero_copy_protector, args_->endpoint, nullptr, 0);
   }
-  tsi_handshaker_result_destroy(h->handshaker_result);
-  h->handshaker_result = nullptr;
+  tsi_handshaker_result_destroy(handshaker_result_);
+  handshaker_result_ = nullptr;
   // Add auth context to channel args.
-  grpc_arg auth_context_arg = grpc_auth_context_to_arg(h->auth_context);
-  grpc_channel_args* tmp_args = h->args->args;
-  h->args->args =
-      grpc_channel_args_copy_and_add(tmp_args, &auth_context_arg, 1);
+  grpc_arg auth_context_arg = grpc_auth_context_to_arg(auth_context_.get());
+  grpc_channel_args* tmp_args = args_->args;
+  args_->args = grpc_channel_args_copy_and_add(tmp_args, &auth_context_arg, 1);
   grpc_channel_args_destroy(tmp_args);
   // Invoke callback.
-  GRPC_CLOSURE_SCHED(h->on_handshake_done, GRPC_ERROR_NONE);
+  ExecCtx::Run(DEBUG_LOCATION, on_handshake_done_, GRPC_ERROR_NONE);
   // Set shutdown to true so that subsequent calls to
   // security_handshaker_shutdown() do nothing.
-  h->shutdown = true;
+  is_shutdown_ = true;
 }
 
-static void on_peer_checked(void* arg, grpc_error* error) {
-  security_handshaker* h = static_cast<security_handshaker*>(arg);
-  gpr_mu_lock(&h->mu);
-  on_peer_checked_inner(h, error);
-  gpr_mu_unlock(&h->mu);
-  security_handshaker_unref(h);
+void SecurityHandshaker::OnPeerCheckedFn(void* arg, grpc_error* error) {
+  RefCountedPtr<SecurityHandshaker>(static_cast<SecurityHandshaker*>(arg))
+      ->OnPeerCheckedInner(GRPC_ERROR_REF(error));
 }
 
-static grpc_error* check_peer_locked(security_handshaker* h) {
+grpc_error* SecurityHandshaker::CheckPeerLocked() {
   tsi_peer peer;
   tsi_result result =
-      tsi_handshaker_result_extract_peer(h->handshaker_result, &peer);
+      tsi_handshaker_result_extract_peer(handshaker_result_, &peer);
   if (result != TSI_OK) {
     return grpc_set_tsi_error_result(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING("Peer extraction failed"), result);
   }
-  grpc_security_connector_check_peer(h->connector, peer, &h->auth_context,
-                                     &h->on_peer_checked);
+  connector_->check_peer(peer, args_->endpoint, &auth_context_,
+                         &on_peer_checked_);
   return GRPC_ERROR_NONE;
 }
 
-static grpc_error* on_handshake_next_done_locked(
-    security_handshaker* h, tsi_result result,
-    const unsigned char* bytes_to_send, size_t bytes_to_send_size,
-    tsi_handshaker_result* handshaker_result) {
+grpc_error* SecurityHandshaker::OnHandshakeNextDoneLocked(
+    tsi_result result, const unsigned char* bytes_to_send,
+    size_t bytes_to_send_size, tsi_handshaker_result* handshaker_result) {
   grpc_error* error = GRPC_ERROR_NONE;
   // Handshaker was shutdown.
-  if (h->shutdown) {
+  if (is_shutdown_) {
     return GRPC_ERROR_CREATE_FROM_STATIC_STRING("Handshaker shutdown");
   }
   // Read more if we need to.
   if (result == TSI_INCOMPLETE_DATA) {
     GPR_ASSERT(bytes_to_send_size == 0);
-    grpc_endpoint_read(h->args->endpoint, h->args->read_buffer,
-                       &h->on_handshake_data_received_from_peer);
+    grpc_endpoint_read(
+        args_->endpoint, args_->read_buffer,
+        GRPC_CLOSURE_INIT(
+            &on_handshake_data_received_from_peer_,
+            &SecurityHandshaker::OnHandshakeDataReceivedFromPeerFnScheduler,
+            this, grpc_schedule_on_exec_ctx),
+        /*urgent=*/true);
     return error;
   }
   if (result != TSI_OK) {
@@ -249,58 +308,62 @@ static grpc_error* on_handshake_next_done_locked(
   }
   // Update handshaker result.
   if (handshaker_result != nullptr) {
-    GPR_ASSERT(h->handshaker_result == nullptr);
-    h->handshaker_result = handshaker_result;
+    GPR_ASSERT(handshaker_result_ == nullptr);
+    handshaker_result_ = handshaker_result;
   }
   if (bytes_to_send_size > 0) {
     // Send data to peer, if needed.
     grpc_slice to_send = grpc_slice_from_copied_buffer(
         reinterpret_cast<const char*>(bytes_to_send), bytes_to_send_size);
-    grpc_slice_buffer_reset_and_unref_internal(&h->outgoing);
-    grpc_slice_buffer_add(&h->outgoing, to_send);
-    grpc_endpoint_write(h->args->endpoint, &h->outgoing,
-                        &h->on_handshake_data_sent_to_peer);
+    grpc_slice_buffer_reset_and_unref_internal(&outgoing_);
+    grpc_slice_buffer_add(&outgoing_, to_send);
+    grpc_endpoint_write(
+        args_->endpoint, &outgoing_,
+        GRPC_CLOSURE_INIT(
+            &on_handshake_data_sent_to_peer_,
+            &SecurityHandshaker::OnHandshakeDataSentToPeerFnScheduler, this,
+            grpc_schedule_on_exec_ctx),
+        nullptr);
   } else if (handshaker_result == nullptr) {
     // There is nothing to send, but need to read from peer.
-    grpc_endpoint_read(h->args->endpoint, h->args->read_buffer,
-                       &h->on_handshake_data_received_from_peer);
+    grpc_endpoint_read(
+        args_->endpoint, args_->read_buffer,
+        GRPC_CLOSURE_INIT(
+            &on_handshake_data_received_from_peer_,
+            &SecurityHandshaker::OnHandshakeDataReceivedFromPeerFnScheduler,
+            this, grpc_schedule_on_exec_ctx),
+        /*urgent=*/true);
   } else {
     // Handshake has finished, check peer and so on.
-    error = check_peer_locked(h);
+    error = CheckPeerLocked();
   }
   return error;
 }
 
-static void on_handshake_next_done_grpc_wrapper(
+void SecurityHandshaker::OnHandshakeNextDoneGrpcWrapper(
     tsi_result result, void* user_data, const unsigned char* bytes_to_send,
     size_t bytes_to_send_size, tsi_handshaker_result* handshaker_result) {
-  security_handshaker* h = static_cast<security_handshaker*>(user_data);
-  // This callback will be invoked by TSI in a non-grpc thread, so it's
-  // safe to create our own exec_ctx here.
-  grpc_core::ExecCtx exec_ctx;
-  gpr_mu_lock(&h->mu);
-  grpc_error* error = on_handshake_next_done_locked(
-      h, result, bytes_to_send, bytes_to_send_size, handshaker_result);
+  RefCountedPtr<SecurityHandshaker> h(
+      static_cast<SecurityHandshaker*>(user_data));
+  MutexLock lock(&h->mu_);
+  grpc_error* error = h->OnHandshakeNextDoneLocked(
+      result, bytes_to_send, bytes_to_send_size, handshaker_result);
   if (error != GRPC_ERROR_NONE) {
-    security_handshake_failed_locked(h, error);
-    gpr_mu_unlock(&h->mu);
-    security_handshaker_unref(h);
+    h->HandshakeFailedLocked(error);
   } else {
-    gpr_mu_unlock(&h->mu);
+    h.release();  // Avoid unref
   }
 }
 
-static grpc_error* do_handshaker_next_locked(
-    security_handshaker* h, const unsigned char* bytes_received,
-    size_t bytes_received_size) {
+grpc_error* SecurityHandshaker::DoHandshakerNextLocked(
+    const unsigned char* bytes_received, size_t bytes_received_size) {
   // Invoke TSI handshaker.
   const unsigned char* bytes_to_send = nullptr;
   size_t bytes_to_send_size = 0;
-  tsi_handshaker_result* handshaker_result = nullptr;
+  tsi_handshaker_result* hs_result = nullptr;
   tsi_result result = tsi_handshaker_next(
-      h->handshaker, bytes_received, bytes_received_size, &bytes_to_send,
-      &bytes_to_send_size, &handshaker_result,
-      &on_handshake_next_done_grpc_wrapper, h);
+      handshaker_, bytes_received, bytes_received_size, &bytes_to_send,
+      &bytes_to_send_size, &hs_result, &OnHandshakeNextDoneGrpcWrapper, this);
   if (result == TSI_ASYNC) {
     // Handshaker operating asynchronously. Nothing else to do here;
     // callback will be invoked in a TSI thread.
@@ -308,224 +371,204 @@ static grpc_error* do_handshaker_next_locked(
   }
   // Handshaker returned synchronously. Invoke callback directly in
   // this thread with our existing exec_ctx.
-  return on_handshake_next_done_locked(h, result, bytes_to_send,
-                                       bytes_to_send_size, handshaker_result);
+  return OnHandshakeNextDoneLocked(result, bytes_to_send, bytes_to_send_size,
+                                   hs_result);
 }
 
-static void on_handshake_data_received_from_peer(void* arg, grpc_error* error) {
-  security_handshaker* h = static_cast<security_handshaker*>(arg);
-  gpr_mu_lock(&h->mu);
-  if (error != GRPC_ERROR_NONE || h->shutdown) {
-    security_handshake_failed_locked(
-        h, GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
-               "Handshake read failed", &error, 1));
-    gpr_mu_unlock(&h->mu);
-    security_handshaker_unref(h);
+// This callback might be run inline while we are still holding on to the mutex,
+// so schedule OnHandshakeDataReceivedFromPeerFn on ExecCtx to avoid a deadlock.
+void SecurityHandshaker::OnHandshakeDataReceivedFromPeerFnScheduler(
+    void* arg, grpc_error* error) {
+  SecurityHandshaker* h = static_cast<SecurityHandshaker*>(arg);
+  grpc_core::ExecCtx::Run(
+      DEBUG_LOCATION,
+      GRPC_CLOSURE_INIT(&h->on_handshake_data_received_from_peer_,
+                        &SecurityHandshaker::OnHandshakeDataReceivedFromPeerFn,
+                        h, grpc_schedule_on_exec_ctx),
+      GRPC_ERROR_REF(error));
+}
+
+void SecurityHandshaker::OnHandshakeDataReceivedFromPeerFn(void* arg,
+                                                           grpc_error* error) {
+  RefCountedPtr<SecurityHandshaker> h(static_cast<SecurityHandshaker*>(arg));
+  MutexLock lock(&h->mu_);
+  if (error != GRPC_ERROR_NONE || h->is_shutdown_) {
+    h->HandshakeFailedLocked(GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
+        "Handshake read failed", &error, 1));
     return;
   }
   // Copy all slices received.
-  size_t bytes_received_size = move_read_buffer_into_handshake_buffer(h);
+  size_t bytes_received_size = h->MoveReadBufferIntoHandshakeBuffer();
   // Call TSI handshaker.
-  error =
-      do_handshaker_next_locked(h, h->handshake_buffer, bytes_received_size);
+  error = h->DoHandshakerNextLocked(h->handshake_buffer_, bytes_received_size);
 
   if (error != GRPC_ERROR_NONE) {
-    security_handshake_failed_locked(h, error);
-    gpr_mu_unlock(&h->mu);
-    security_handshaker_unref(h);
+    h->HandshakeFailedLocked(error);
   } else {
-    gpr_mu_unlock(&h->mu);
+    h.release();  // Avoid unref
   }
 }
 
-static void on_handshake_data_sent_to_peer(void* arg, grpc_error* error) {
-  security_handshaker* h = static_cast<security_handshaker*>(arg);
-  gpr_mu_lock(&h->mu);
-  if (error != GRPC_ERROR_NONE || h->shutdown) {
-    security_handshake_failed_locked(
-        h, GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
-               "Handshake write failed", &error, 1));
-    gpr_mu_unlock(&h->mu);
-    security_handshaker_unref(h);
+// This callback might be run inline while we are still holding on to the mutex,
+// so schedule OnHandshakeDataSentToPeerFn on ExecCtx to avoid a deadlock.
+void SecurityHandshaker::OnHandshakeDataSentToPeerFnScheduler(
+    void* arg, grpc_error* error) {
+  SecurityHandshaker* h = static_cast<SecurityHandshaker*>(arg);
+  grpc_core::ExecCtx::Run(
+      DEBUG_LOCATION,
+      GRPC_CLOSURE_INIT(&h->on_handshake_data_sent_to_peer_,
+                        &SecurityHandshaker::OnHandshakeDataSentToPeerFn, h,
+                        grpc_schedule_on_exec_ctx),
+      GRPC_ERROR_REF(error));
+}
+
+void SecurityHandshaker::OnHandshakeDataSentToPeerFn(void* arg,
+                                                     grpc_error* error) {
+  RefCountedPtr<SecurityHandshaker> h(static_cast<SecurityHandshaker*>(arg));
+  MutexLock lock(&h->mu_);
+  if (error != GRPC_ERROR_NONE || h->is_shutdown_) {
+    h->HandshakeFailedLocked(GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
+        "Handshake write failed", &error, 1));
     return;
   }
   // We may be done.
-  if (h->handshaker_result == nullptr) {
-    grpc_endpoint_read(h->args->endpoint, h->args->read_buffer,
-                       &h->on_handshake_data_received_from_peer);
+  if (h->handshaker_result_ == nullptr) {
+    grpc_endpoint_read(
+        h->args_->endpoint, h->args_->read_buffer,
+        GRPC_CLOSURE_INIT(
+            &h->on_handshake_data_received_from_peer_,
+            &SecurityHandshaker::OnHandshakeDataReceivedFromPeerFnScheduler,
+            h.get(), grpc_schedule_on_exec_ctx),
+        /*urgent=*/true);
   } else {
-    error = check_peer_locked(h);
+    error = h->CheckPeerLocked();
     if (error != GRPC_ERROR_NONE) {
-      security_handshake_failed_locked(h, error);
-      gpr_mu_unlock(&h->mu);
-      security_handshaker_unref(h);
+      h->HandshakeFailedLocked(error);
       return;
     }
   }
-  gpr_mu_unlock(&h->mu);
+  h.release();  // Avoid unref
 }
 
 //
 // public handshaker API
 //
 
-static void security_handshaker_destroy(grpc_handshaker* handshaker) {
-  security_handshaker* h = reinterpret_cast<security_handshaker*>(handshaker);
-  security_handshaker_unref(h);
-}
-
-static void security_handshaker_shutdown(grpc_handshaker* handshaker,
-                                         grpc_error* why) {
-  security_handshaker* h = reinterpret_cast<security_handshaker*>(handshaker);
-  gpr_mu_lock(&h->mu);
-  if (!h->shutdown) {
-    h->shutdown = true;
-    tsi_handshaker_shutdown(h->handshaker);
-    grpc_endpoint_shutdown(h->args->endpoint, GRPC_ERROR_REF(why));
-    cleanup_args_for_failure_locked(h);
+void SecurityHandshaker::Shutdown(grpc_error* why) {
+  MutexLock lock(&mu_);
+  if (!is_shutdown_) {
+    is_shutdown_ = true;
+    tsi_handshaker_shutdown(handshaker_);
+    grpc_endpoint_shutdown(args_->endpoint, GRPC_ERROR_REF(why));
+    CleanupArgsForFailureLocked();
   }
-  gpr_mu_unlock(&h->mu);
   GRPC_ERROR_UNREF(why);
 }
 
-static void security_handshaker_do_handshake(grpc_handshaker* handshaker,
-                                             grpc_tcp_server_acceptor* acceptor,
-                                             grpc_closure* on_handshake_done,
-                                             grpc_handshaker_args* args) {
-  security_handshaker* h = reinterpret_cast<security_handshaker*>(handshaker);
-  gpr_mu_lock(&h->mu);
-  h->args = args;
-  h->on_handshake_done = on_handshake_done;
-  gpr_ref(&h->refs);
-  size_t bytes_received_size = move_read_buffer_into_handshake_buffer(h);
+void SecurityHandshaker::DoHandshake(grpc_tcp_server_acceptor* /*acceptor*/,
+                                     grpc_closure* on_handshake_done,
+                                     HandshakerArgs* args) {
+  auto ref = Ref();
+  MutexLock lock(&mu_);
+  args_ = args;
+  on_handshake_done_ = on_handshake_done;
+  size_t bytes_received_size = MoveReadBufferIntoHandshakeBuffer();
   grpc_error* error =
-      do_handshaker_next_locked(h, h->handshake_buffer, bytes_received_size);
+      DoHandshakerNextLocked(handshake_buffer_, bytes_received_size);
   if (error != GRPC_ERROR_NONE) {
-    security_handshake_failed_locked(h, error);
-    gpr_mu_unlock(&h->mu);
-    security_handshaker_unref(h);
-    return;
+    HandshakeFailedLocked(error);
+  } else {
+    ref.release();  // Avoid unref
   }
-  gpr_mu_unlock(&h->mu);
-}
-
-static const grpc_handshaker_vtable security_handshaker_vtable = {
-    security_handshaker_destroy, security_handshaker_shutdown,
-    security_handshaker_do_handshake, "security"};
-
-static grpc_handshaker* security_handshaker_create(
-    tsi_handshaker* handshaker, grpc_security_connector* connector) {
-  security_handshaker* h = static_cast<security_handshaker*>(
-      gpr_zalloc(sizeof(security_handshaker)));
-  grpc_handshaker_init(&security_handshaker_vtable, &h->base);
-  h->handshaker = handshaker;
-  h->connector = GRPC_SECURITY_CONNECTOR_REF(connector, "handshake");
-  gpr_mu_init(&h->mu);
-  gpr_ref_init(&h->refs, 1);
-  h->handshake_buffer_size = GRPC_INITIAL_HANDSHAKE_BUFFER_SIZE;
-  h->handshake_buffer =
-      static_cast<uint8_t*>(gpr_malloc(h->handshake_buffer_size));
-  GRPC_CLOSURE_INIT(&h->on_handshake_data_sent_to_peer,
-                    on_handshake_data_sent_to_peer, h,
-                    grpc_schedule_on_exec_ctx);
-  GRPC_CLOSURE_INIT(&h->on_handshake_data_received_from_peer,
-                    on_handshake_data_received_from_peer, h,
-                    grpc_schedule_on_exec_ctx);
-  GRPC_CLOSURE_INIT(&h->on_peer_checked, on_peer_checked, h,
-                    grpc_schedule_on_exec_ctx);
-  grpc_slice_buffer_init(&h->outgoing);
-  return &h->base;
 }
 
 //
-// fail_handshaker
+// FailHandshaker
 //
 
-static void fail_handshaker_destroy(grpc_handshaker* handshaker) {
-  gpr_free(handshaker);
-}
-
-static void fail_handshaker_shutdown(grpc_handshaker* handshaker,
-                                     grpc_error* why) {
-  GRPC_ERROR_UNREF(why);
-}
-
-static void fail_handshaker_do_handshake(grpc_handshaker* handshaker,
-                                         grpc_tcp_server_acceptor* acceptor,
-                                         grpc_closure* on_handshake_done,
-                                         grpc_handshaker_args* args) {
-  GRPC_CLOSURE_SCHED(on_handshake_done,
-                     GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-                         "Failed to create security handshaker"));
-}
-
-static const grpc_handshaker_vtable fail_handshaker_vtable = {
-    fail_handshaker_destroy, fail_handshaker_shutdown,
-    fail_handshaker_do_handshake, "security_fail"};
+class FailHandshaker : public Handshaker {
+ public:
+  const char* name() const override { return "security_fail"; }
+  void Shutdown(grpc_error* why) override { GRPC_ERROR_UNREF(why); }
+  void DoHandshake(grpc_tcp_server_acceptor* /*acceptor*/,
+                   grpc_closure* on_handshake_done,
+                   HandshakerArgs* /*args*/) override {
+    ExecCtx::Run(DEBUG_LOCATION, on_handshake_done,
+                 GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+                     "Failed to create security handshaker"));
+  }
 
-static grpc_handshaker* fail_handshaker_create() {
-  grpc_handshaker* h = static_cast<grpc_handshaker*>(gpr_malloc(sizeof(*h)));
-  grpc_handshaker_init(&fail_handshaker_vtable, h);
-  return h;
-}
+ private:
+  virtual ~FailHandshaker() = default;
+};
 
 //
 // handshaker factories
 //
 
-static void client_handshaker_factory_add_handshakers(
-    grpc_handshaker_factory* handshaker_factory, const grpc_channel_args* args,
-    grpc_handshake_manager* handshake_mgr) {
-  grpc_channel_security_connector* security_connector =
-      reinterpret_cast<grpc_channel_security_connector*>(
-          grpc_security_connector_find_in_args(args));
-  grpc_channel_security_connector_add_handshakers(security_connector,
-                                                  handshake_mgr);
-}
-
-static void server_handshaker_factory_add_handshakers(
-    grpc_handshaker_factory* hf, const grpc_channel_args* args,
-    grpc_handshake_manager* handshake_mgr) {
-  grpc_server_security_connector* security_connector =
-      reinterpret_cast<grpc_server_security_connector*>(
-          grpc_security_connector_find_in_args(args));
-  grpc_server_security_connector_add_handshakers(security_connector,
-                                                 handshake_mgr);
-}
-
-static void handshaker_factory_destroy(
-    grpc_handshaker_factory* handshaker_factory) {}
-
-static const grpc_handshaker_factory_vtable client_handshaker_factory_vtable = {
-    client_handshaker_factory_add_handshakers, handshaker_factory_destroy};
-
-static grpc_handshaker_factory client_handshaker_factory = {
-    &client_handshaker_factory_vtable};
-
-static const grpc_handshaker_factory_vtable server_handshaker_factory_vtable = {
-    server_handshaker_factory_add_handshakers, handshaker_factory_destroy};
+class ClientSecurityHandshakerFactory : public HandshakerFactory {
+ public:
+  void AddHandshakers(const grpc_channel_args* args,
+                      grpc_pollset_set* interested_parties,
+                      HandshakeManager* handshake_mgr) override {
+    auto* security_connector =
+        reinterpret_cast<grpc_channel_security_connector*>(
+            grpc_security_connector_find_in_args(args));
+    if (security_connector) {
+      security_connector->add_handshakers(args, interested_parties,
+                                          handshake_mgr);
+    }
+  }
+  ~ClientSecurityHandshakerFactory() override = default;
+};
+
+class ServerSecurityHandshakerFactory : public HandshakerFactory {
+ public:
+  void AddHandshakers(const grpc_channel_args* args,
+                      grpc_pollset_set* interested_parties,
+                      HandshakeManager* handshake_mgr) override {
+    auto* security_connector =
+        reinterpret_cast<grpc_server_security_connector*>(
+            grpc_security_connector_find_in_args(args));
+    if (security_connector) {
+      security_connector->add_handshakers(args, interested_parties,
+                                          handshake_mgr);
+    }
+  }
+  ~ServerSecurityHandshakerFactory() override = default;
+};
 
-static grpc_handshaker_factory server_handshaker_factory = {
-    &server_handshaker_factory_vtable};
+}  // namespace
 
 //
 // exported functions
 //
 
-grpc_handshaker* grpc_security_handshaker_create(
-    tsi_handshaker* handshaker, grpc_security_connector* connector) {
+RefCountedPtr<Handshaker> SecurityHandshakerCreate(
+    tsi_handshaker* handshaker, grpc_security_connector* connector,
+    const grpc_channel_args* args) {
   // If no TSI handshaker was created, return a handshaker that always fails.
   // Otherwise, return a real security handshaker.
   if (handshaker == nullptr) {
-    return fail_handshaker_create();
+    return MakeRefCounted<FailHandshaker>();
   } else {
-    return security_handshaker_create(handshaker, connector);
+    return MakeRefCounted<SecurityHandshaker>(handshaker, connector, args);
   }
 }
 
-void grpc_security_register_handshaker_factories() {
-  grpc_handshaker_factory_register(false /* at_start */, HANDSHAKER_CLIENT,
-                                   &client_handshaker_factory);
-  grpc_handshaker_factory_register(false /* at_start */, HANDSHAKER_SERVER,
-                                   &server_handshaker_factory);
+void SecurityRegisterHandshakerFactories() {
+  HandshakerRegistry::RegisterHandshakerFactory(
+      false /* at_start */, HANDSHAKER_CLIENT,
+      absl::make_unique<ClientSecurityHandshakerFactory>());
+  HandshakerRegistry::RegisterHandshakerFactory(
+      false /* at_start */, HANDSHAKER_SERVER,
+      absl::make_unique<ServerSecurityHandshakerFactory>());
+}
+
+}  // namespace grpc_core
+
+grpc_handshaker* grpc_security_handshaker_create(
+    tsi_handshaker* handshaker, grpc_security_connector* connector,
+    const grpc_channel_args* args) {
+  return SecurityHandshakerCreate(handshaker, connector, args).release();
 }