grpc 1.21.0 → 1.32.0

data/src/core/lib/uri/uri_parser.cc

@@ -22,10 +22,13 @@
 
 #include <string.h>
 
+#include <string>
+
+#include "absl/strings/str_format.h"
+
 #include <grpc/slice_buffer.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
 
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/slice/percent_encoding.h"
@@ -35,34 +38,25 @@
 /** a size_t default value... maps to all 1's */
 #define NOT_SET (~(size_t)0)
 
-static grpc_uri* bad_uri(const char* uri_text, size_t pos, const char* section,
-                         bool suppress_errors) {
-  char* line_prefix;
-  size_t pfx_len;
-
+static grpc_uri* bad_uri(absl::string_view uri_text, size_t pos,
+                         const char* section, bool suppress_errors) {
   if (!suppress_errors) {
-    gpr_asprintf(&line_prefix, "bad uri.%s: '", section);
-    pfx_len = strlen(line_prefix) + pos;
-    gpr_log(GPR_ERROR, "%s%s'", line_prefix, uri_text);
-    gpr_free(line_prefix);
-
-    line_prefix = static_cast<char*>(gpr_malloc(pfx_len + 1));
-    memset(line_prefix, ' ', pfx_len);
-    line_prefix[pfx_len] = 0;
-    gpr_log(GPR_ERROR, "%s^ here", line_prefix);
-    gpr_free(line_prefix);
+    std::string line_prefix = absl::StrFormat("bad uri.%s: '", section);
+    gpr_log(GPR_ERROR, "%s%s'", line_prefix.c_str(),
+            std::string(uri_text).c_str());
+    size_t pfx_len = line_prefix.size() + pos;
+    gpr_log(GPR_ERROR, "%s^ here", std::string(pfx_len, ' ').c_str());
   }
-
   return nullptr;
 }
 
 /** Returns a copy of percent decoded \a src[begin, end) */
-static char* decode_and_copy_component(const char* src, size_t begin,
+static char* decode_and_copy_component(absl::string_view src, size_t begin,
                                        size_t end) {
   grpc_slice component =
       (begin == NOT_SET || end == NOT_SET)
           ? grpc_empty_slice()
-          : grpc_slice_from_copied_buffer(src + begin, end - begin);
+          : grpc_slice_from_copied_buffer(src.data() + begin, end - begin);
   grpc_slice decoded_component =
       grpc_permissive_percent_decode_slice(component);
   char* out = grpc_dump_slice(decoded_component, GPR_DUMP_ASCII);
@@ -79,7 +73,7 @@ static bool valid_hex(char c) {
 /** Returns how many chars to advance if \a uri_text[i] begins a valid \a pchar
  * production. If \a uri_text[i] introduces an invalid \a pchar (such as percent
  * sign not followed by two hex digits), NOT_SET is returned. */
-static size_t parse_pchar(const char* uri_text, size_t i) {
+static size_t parse_pchar(absl::string_view uri_text, size_t i) {
   /* pchar = unreserved / pct-encoded / sub-delims / ":" / "@"
    * unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~"
    * pct-encoded = "%" HEXDIG HEXDIG
@@ -112,7 +106,8 @@ static size_t parse_pchar(const char* uri_text, size_t i) {
     case '=':
       return 1;
     case '%': /* pct-encoded */
-      if (valid_hex(uri_text[i + 1]) && valid_hex(uri_text[i + 2])) {
+      if (uri_text.size() > i + 2 && valid_hex(uri_text[i + 1]) &&
+          valid_hex(uri_text[i + 2])) {
         return 2;
       }
       return NOT_SET;
@@ -121,9 +116,8 @@ static size_t parse_pchar(const char* uri_text, size_t i) {
 }
 
 /* *( pchar / "?" / "/" ) */
-static int parse_fragment_or_query(const char* uri_text, size_t* i) {
-  char c;
-  while ((c = uri_text[*i]) != 0) {
+static int parse_fragment_or_query(absl::string_view uri_text, size_t* i) {
+  while (uri_text.size() > *i) {
     const size_t advance = parse_pchar(uri_text, *i); /* pchar */
     switch (advance) {
       case 0: /* uri_text[i] isn't in pchar */
@@ -185,7 +179,7 @@ static void parse_query_parts(grpc_uri* uri) {
   }
 }
 
-grpc_uri* grpc_uri_parse(const char* uri_text, bool suppress_errors) {
+grpc_uri* grpc_uri_parse(absl::string_view uri_text, bool suppress_errors) {
   grpc_uri* uri;
   size_t scheme_begin = 0;
   size_t scheme_end = NOT_SET;
@@ -199,7 +193,7 @@ grpc_uri* grpc_uri_parse(const char* uri_text, bool suppress_errors) {
   size_t fragment_end = NOT_SET;
   size_t i;
 
-  for (i = scheme_begin; uri_text[i] != 0; i++) {
+  for (i = scheme_begin; i < uri_text.size(); ++i) {
     if (uri_text[i] == ':') {
       scheme_end = i;
       break;
@@ -218,15 +212,16 @@ grpc_uri* grpc_uri_parse(const char* uri_text, bool suppress_errors) {
     return bad_uri(uri_text, i, "scheme", suppress_errors);
   }
 
-  if (uri_text[scheme_end + 1] == '/' && uri_text[scheme_end + 2] == '/') {
+  if (uri_text.size() > scheme_end + 2 && uri_text[scheme_end + 1] == '/' &&
+      uri_text[scheme_end + 2] == '/') {
     authority_begin = scheme_end + 3;
-    for (i = authority_begin; uri_text[i] != 0 && authority_end == NOT_SET;
+    for (i = authority_begin; uri_text.size() > i && authority_end == NOT_SET;
          i++) {
       if (uri_text[i] == '/' || uri_text[i] == '?' || uri_text[i] == '#') {
         authority_end = i;
       }
     }
-    if (authority_end == NOT_SET && uri_text[i] == 0) {
+    if (authority_end == NOT_SET && uri_text.size() == i) {
       authority_end = i;
     }
     if (authority_end == NOT_SET) {
@@ -238,34 +233,34 @@ grpc_uri* grpc_uri_parse(const char* uri_text, bool suppress_errors) {
     path_begin = scheme_end + 1;
   }
 
-  for (i = path_begin; uri_text[i] != 0; i++) {
+  for (i = path_begin; i < uri_text.size(); ++i) {
     if (uri_text[i] == '?' || uri_text[i] == '#') {
       path_end = i;
       break;
     }
   }
-  if (path_end == NOT_SET && uri_text[i] == 0) {
+  if (path_end == NOT_SET && uri_text.size() == i) {
     path_end = i;
   }
   if (path_end == NOT_SET) {
     return bad_uri(uri_text, i, "path", suppress_errors);
   }
 
-  if (uri_text[i] == '?') {
+  if (uri_text.size() > i && uri_text[i] == '?') {
     query_begin = ++i;
     if (!parse_fragment_or_query(uri_text, &i)) {
       return bad_uri(uri_text, i, "query", suppress_errors);
-    } else if (uri_text[i] != 0 && uri_text[i] != '#') {
+    } else if (uri_text.size() > i && uri_text[i] != '#') {
       /* We must be at the end or at the beginning of a fragment */
       return bad_uri(uri_text, i, "query", suppress_errors);
     }
     query_end = i;
   }
-  if (uri_text[i] == '#') {
+  if (uri_text.size() > i && uri_text[i] == '#') {
     fragment_begin = ++i;
     if (!parse_fragment_or_query(uri_text, &i)) {
       return bad_uri(uri_text, i - fragment_end, "fragment", suppress_errors);
-    } else if (uri_text[i] != 0) {
+    } else if (uri_text.size() > i) {
       /* We must be at the end */
       return bad_uri(uri_text, i, "fragment", suppress_errors);
     }

data/src/core/lib/uri/uri_parser.h

@@ -21,9 +21,11 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "absl/strings/string_view.h"
+
 #include <stddef.h>
 
-typedef struct {
+struct grpc_uri {
   char* scheme;
   char* authority;
   char* path;
@@ -35,10 +37,9 @@ typedef struct {
   /** Split each query part by '='. NULL if not present. */
   char** query_parts_values;
   char* fragment;
-} grpc_uri;
-
+};
 /** parse a uri, return NULL on failure */
-grpc_uri* grpc_uri_parse(const char* uri_text, bool suppress_errors);
+grpc_uri* grpc_uri_parse(absl::string_view uri_text, bool suppress_errors);
 
 /** return the part of a query string after the '=' in "?key=xxx&...", or NULL
  * if key is not present */

data/src/core/plugin_registry/grpc_plugin_registry.cc

@@ -34,8 +34,18 @@ void grpc_resolver_fake_init(void);
 void grpc_resolver_fake_shutdown(void);
 void grpc_lb_policy_grpclb_init(void);
 void grpc_lb_policy_grpclb_shutdown(void);
-void grpc_lb_policy_xds_init(void);
-void grpc_lb_policy_xds_shutdown(void);
+void grpc_lb_policy_cds_init(void);
+void grpc_lb_policy_cds_shutdown(void);
+void grpc_lb_policy_eds_init(void);
+void grpc_lb_policy_eds_shutdown(void);
+void grpc_lb_policy_lrs_init(void);
+void grpc_lb_policy_lrs_shutdown(void);
+void grpc_lb_policy_priority_init(void);
+void grpc_lb_policy_priority_shutdown(void);
+void grpc_lb_policy_weighted_target_init(void);
+void grpc_lb_policy_weighted_target_shutdown(void);
+void grpc_lb_policy_xds_routing_init(void);
+void grpc_lb_policy_xds_routing_shutdown(void);
 void grpc_lb_policy_pick_first_init(void);
 void grpc_lb_policy_pick_first_shutdown(void);
 void grpc_lb_policy_round_robin_init(void);
@@ -46,10 +56,16 @@ void grpc_resolver_dns_native_init(void);
 void grpc_resolver_dns_native_shutdown(void);
 void grpc_resolver_sockaddr_init(void);
 void grpc_resolver_sockaddr_shutdown(void);
+void grpc_resolver_xds_init(void);
+void grpc_resolver_xds_shutdown(void);
+void grpc_client_idle_filter_init(void);
+void grpc_client_idle_filter_shutdown(void);
 void grpc_max_age_filter_init(void);
 void grpc_max_age_filter_shutdown(void);
 void grpc_message_size_filter_init(void);
 void grpc_message_size_filter_shutdown(void);
+void grpc_service_config_channel_arg_filter_init(void);
+void grpc_service_config_channel_arg_filter_shutdown(void);
 void grpc_client_authority_filter_init(void);
 void grpc_client_authority_filter_shutdown(void);
 void grpc_workaround_cronet_compression_filter_init(void);
@@ -70,8 +86,18 @@ void grpc_register_built_in_plugins(void) {
                        grpc_resolver_fake_shutdown);
   grpc_register_plugin(grpc_lb_policy_grpclb_init,
                        grpc_lb_policy_grpclb_shutdown);
-  grpc_register_plugin(grpc_lb_policy_xds_init,
-                       grpc_lb_policy_xds_shutdown);
+  grpc_register_plugin(grpc_lb_policy_cds_init,
+                       grpc_lb_policy_cds_shutdown);
+  grpc_register_plugin(grpc_lb_policy_eds_init,
+                       grpc_lb_policy_eds_shutdown);
+  grpc_register_plugin(grpc_lb_policy_lrs_init,
+                       grpc_lb_policy_lrs_shutdown);
+  grpc_register_plugin(grpc_lb_policy_priority_init,
+                       grpc_lb_policy_priority_shutdown);
+  grpc_register_plugin(grpc_lb_policy_weighted_target_init,
+                       grpc_lb_policy_weighted_target_shutdown);
+  grpc_register_plugin(grpc_lb_policy_xds_routing_init,
+                       grpc_lb_policy_xds_routing_shutdown);
   grpc_register_plugin(grpc_lb_policy_pick_first_init,
                        grpc_lb_policy_pick_first_shutdown);
   grpc_register_plugin(grpc_lb_policy_round_robin_init,
@@ -82,10 +108,16 @@ void grpc_register_built_in_plugins(void) {
                        grpc_resolver_dns_native_shutdown);
   grpc_register_plugin(grpc_resolver_sockaddr_init,
                        grpc_resolver_sockaddr_shutdown);
+  grpc_register_plugin(grpc_resolver_xds_init,
+                       grpc_resolver_xds_shutdown);
+  grpc_register_plugin(grpc_client_idle_filter_init,
+                       grpc_client_idle_filter_shutdown);
   grpc_register_plugin(grpc_max_age_filter_init,
                        grpc_max_age_filter_shutdown);
   grpc_register_plugin(grpc_message_size_filter_init,
                        grpc_message_size_filter_shutdown);
+  grpc_register_plugin(grpc_service_config_channel_arg_filter_init,
+                       grpc_service_config_channel_arg_filter_shutdown);
   grpc_register_plugin(grpc_client_authority_filter_init,
                        grpc_client_authority_filter_shutdown);
   grpc_register_plugin(grpc_workaround_cronet_compression_filter_init,

data/src/core/tsi/alts/crypt/aes_gcm.cc

@@ -18,8 +18,6 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/tsi/grpc_shadow_boringssl.h"
-
 #include "src/core/tsi/alts/crypt/gsec.h"
 
 #include <openssl/bio.h>

data/src/core/tsi/alts/frame_protector/alts_unseal_privacy_integrity_crypter.cc

@@ -33,7 +33,7 @@ static void maybe_copy_error_msg(const char* src, char** dst) {
 
 /* Perform input santity check. */
 static grpc_status_code unseal_check(alts_crypter* c, const unsigned char* data,
-                                     size_t data_allocated_size,
+                                     size_t /*data_allocated_size*/,
                                      size_t data_size, size_t* output_size,
                                      char** error_details) {
   /* Do common input sanity check. */

data/src/core/tsi/alts/handshaker/alts_handshaker_client.cc

@@ -18,16 +18,20 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <list>
+
 #include "src/core/tsi/alts/handshaker/alts_handshaker_client.h"
 
+#include "upb/upb.hpp"
+
 #include <grpc/byte_buffer.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 
+#include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/surface/call.h"
 #include "src/core/lib/surface/channel.h"
-#include "src/core/tsi/alts/handshaker/alts_handshaker_service_api.h"
 #include "src/core/tsi/alts/handshaker/alts_shared_resource.h"
 #include "src/core/tsi/alts/handshaker/alts_tsi_handshaker_private.h"
 #include "src/core/tsi/alts/handshaker/alts_tsi_utils.h"
@@ -40,8 +44,18 @@ struct alts_handshaker_client {
   const alts_handshaker_client_vtable* vtable;
 };
 
+struct recv_message_result {
+  tsi_result status;
+  const unsigned char* bytes_to_send;
+  size_t bytes_to_send_size;
+  tsi_handshaker_result* result;
+};
+
 typedef struct alts_grpc_handshaker_client {
   alts_handshaker_client base;
+  /* One ref is held by the entity that created this handshaker_client, and
+   * another ref is held by the pending RECEIVE_STATUS_ON_CLIENT op. */
+  gpr_refcount refs;
   alts_tsi_handshaker* handshaker;
   grpc_call* call;
   /* A pointer to a function handling the interaction with handshaker service.
@@ -50,12 +64,8 @@ typedef struct alts_grpc_handshaker_client {
    * that validates the data to be sent to handshaker service in a testing use
    * case. */
   alts_grpc_caller grpc_caller;
-  /* A callback function provided by gRPC to handle the response returned from
-   * handshaker service. It also serves to bring the control safely back to
-   * application when dedicated CQ and thread are used. */
-  grpc_iomgr_cb_func grpc_cb;
   /* A gRPC closure to be scheduled when the response from handshaker service
-   * is received. It will be initialized with grpc_cb. */
+   * is received. It will be initialized with the injected grpc RPC callback. */
   grpc_closure on_handshaker_service_resp_recv;
   /* Buffers containing information to be sent (or received) to (or from) the
    * handshaker service. */
@@ -82,6 +92,20 @@ typedef struct alts_grpc_handshaker_client {
   /* a buffer containing data to be sent to the grpc client or server's peer. */
   unsigned char* buffer;
   size_t buffer_size;
+  /** callback for receiving handshake call status */
+  grpc_closure on_status_received;
+  /** gRPC status code of handshake call */
+  grpc_status_code handshake_status_code;
+  /** gRPC status details of handshake call */
+  grpc_slice handshake_status_details;
+  /* mu synchronizes all fields below including their internal fields. */
+  gpr_mu mu;
+  /* indicates if the handshaker call's RECV_STATUS_ON_CLIENT op is done. */
+  bool receive_status_finished;
+  /* if non-null, contains arguments to complete a TSI next callback. */
+  recv_message_result* pending_recv_message_result;
+  /* Maximum frame size used by frame protector. */
+  size_t max_frame_size;
 } alts_grpc_handshaker_client;
 
 static void handshaker_client_send_buffer_destroy(
@@ -91,14 +115,83 @@ static void handshaker_client_send_buffer_destroy(
   client->send_buffer = nullptr;
 }
 
-static bool is_handshake_finished_properly(grpc_gcp_handshaker_resp* resp) {
+static bool is_handshake_finished_properly(grpc_gcp_HandshakerResp* resp) {
   GPR_ASSERT(resp != nullptr);
-  if (resp->has_result) {
+  if (grpc_gcp_HandshakerResp_result(resp)) {
     return true;
   }
   return false;
 }
 
+static void alts_grpc_handshaker_client_unref(
+    alts_grpc_handshaker_client* client) {
+  if (gpr_unref(&client->refs)) {
+    if (client->base.vtable != nullptr &&
+        client->base.vtable->destruct != nullptr) {
+      client->base.vtable->destruct(&client->base);
+    }
+    grpc_byte_buffer_destroy(client->send_buffer);
+    grpc_byte_buffer_destroy(client->recv_buffer);
+    client->send_buffer = nullptr;
+    client->recv_buffer = nullptr;
+    grpc_metadata_array_destroy(&client->recv_initial_metadata);
+    grpc_slice_unref_internal(client->recv_bytes);
+    grpc_slice_unref_internal(client->target_name);
+    grpc_alts_credentials_options_destroy(client->options);
+    gpr_free(client->buffer);
+    grpc_slice_unref_internal(client->handshake_status_details);
+    gpr_mu_destroy(&client->mu);
+    gpr_free(client);
+  }
+}
+
+static void maybe_complete_tsi_next(
+    alts_grpc_handshaker_client* client, bool receive_status_finished,
+    recv_message_result* pending_recv_message_result) {
+  recv_message_result* r;
+  {
+    grpc_core::MutexLock lock(&client->mu);
+    client->receive_status_finished |= receive_status_finished;
+    if (pending_recv_message_result != nullptr) {
+      GPR_ASSERT(client->pending_recv_message_result == nullptr);
+      client->pending_recv_message_result = pending_recv_message_result;
+    }
+    if (client->pending_recv_message_result == nullptr) {
+      return;
+    }
+    const bool have_final_result =
+        client->pending_recv_message_result->result != nullptr ||
+        client->pending_recv_message_result->status != TSI_OK;
+    if (have_final_result && !client->receive_status_finished) {
+      // If we've received the final message from the handshake
+      // server, or we're about to invoke the TSI next callback
+      // with a status other than TSI_OK (which terminates the
+      // handshake), then first wait for the RECV_STATUS op to complete.
+      return;
+    }
+    r = client->pending_recv_message_result;
+    client->pending_recv_message_result = nullptr;
+  }
+  client->cb(r->status, client->user_data, r->bytes_to_send,
+             r->bytes_to_send_size, r->result);
+  gpr_free(r);
+}
+
+static void handle_response_done(alts_grpc_handshaker_client* client,
+                                 tsi_result status,
+                                 const unsigned char* bytes_to_send,
+                                 size_t bytes_to_send_size,
+                                 tsi_handshaker_result* result) {
+  recv_message_result* p =
+      static_cast<recv_message_result*>(gpr_zalloc(sizeof(*p)));
+  p->status = status;
+  p->bytes_to_send = bytes_to_send;
+  p->bytes_to_send_size = bytes_to_send_size;
+  p->result = result;
+  maybe_complete_tsi_next(client, false /* receive_status_finished */,
+                          p /* pending_recv_message_result */);
+}
+
 void alts_handshaker_client_handle_response(alts_handshaker_client* c,
                                             bool is_ok) {
   GPR_ASSERT(c != nullptr);
@@ -106,95 +199,124 @@ void alts_handshaker_client_handle_response(alts_handshaker_client* c,
       reinterpret_cast<alts_grpc_handshaker_client*>(c);
   grpc_byte_buffer* recv_buffer = client->recv_buffer;
   grpc_status_code status = client->status;
-  tsi_handshaker_on_next_done_cb cb = client->cb;
-  void* user_data = client->user_data;
   alts_tsi_handshaker* handshaker = client->handshaker;
-
   /* Invalid input check. */
-  if (cb == nullptr) {
+  if (client->cb == nullptr) {
     gpr_log(GPR_ERROR,
-            "cb is nullptr in alts_tsi_handshaker_handle_response()");
+            "client->cb is nullptr in alts_tsi_handshaker_handle_response()");
     return;
   }
   if (handshaker == nullptr) {
     gpr_log(GPR_ERROR,
             "handshaker is nullptr in alts_tsi_handshaker_handle_response()");
-    cb(TSI_INTERNAL_ERROR, user_data, nullptr, 0, nullptr);
+    handle_response_done(client, TSI_INTERNAL_ERROR, nullptr, 0, nullptr);
     return;
   }
   /* TSI handshake has been shutdown. */
   if (alts_tsi_handshaker_has_shutdown(handshaker)) {
     gpr_log(GPR_ERROR, "TSI handshake shutdown");
-    cb(TSI_HANDSHAKE_SHUTDOWN, user_data, nullptr, 0, nullptr);
+    handle_response_done(client, TSI_HANDSHAKE_SHUTDOWN, nullptr, 0, nullptr);
     return;
   }
   /* Failed grpc call check. */
   if (!is_ok || status != GRPC_STATUS_OK) {
     gpr_log(GPR_ERROR, "grpc call made to handshaker service failed");
-    cb(TSI_INTERNAL_ERROR, user_data, nullptr, 0, nullptr);
+    handle_response_done(client, TSI_INTERNAL_ERROR, nullptr, 0, nullptr);
     return;
   }
   if (recv_buffer == nullptr) {
     gpr_log(GPR_ERROR,
             "recv_buffer is nullptr in alts_tsi_handshaker_handle_response()");
-    cb(TSI_INTERNAL_ERROR, user_data, nullptr, 0, nullptr);
+    handle_response_done(client, TSI_INTERNAL_ERROR, nullptr, 0, nullptr);
     return;
   }
-  grpc_gcp_handshaker_resp* resp =
-      alts_tsi_utils_deserialize_response(recv_buffer);
+  upb::Arena arena;
+  grpc_gcp_HandshakerResp* resp =
+      alts_tsi_utils_deserialize_response(recv_buffer, arena.ptr());
   grpc_byte_buffer_destroy(client->recv_buffer);
   client->recv_buffer = nullptr;
   /* Invalid handshaker response check. */
   if (resp == nullptr) {
     gpr_log(GPR_ERROR, "alts_tsi_utils_deserialize_response() failed");
-    cb(TSI_DATA_CORRUPTED, user_data, nullptr, 0, nullptr);
+    handle_response_done(client, TSI_DATA_CORRUPTED, nullptr, 0, nullptr);
+    return;
+  }
+  const grpc_gcp_HandshakerStatus* resp_status =
+      grpc_gcp_HandshakerResp_status(resp);
+  if (resp_status == nullptr) {
+    gpr_log(GPR_ERROR, "No status in HandshakerResp");
+    handle_response_done(client, TSI_DATA_CORRUPTED, nullptr, 0, nullptr);
     return;
   }
-  grpc_slice* slice = static_cast<grpc_slice*>(resp->out_frames.arg);
+  upb_strview out_frames = grpc_gcp_HandshakerResp_out_frames(resp);
   unsigned char* bytes_to_send = nullptr;
   size_t bytes_to_send_size = 0;
-  if (slice != nullptr) {
-    bytes_to_send_size = GRPC_SLICE_LENGTH(*slice);
+  if (out_frames.size > 0) {
+    bytes_to_send_size = out_frames.size;
     while (bytes_to_send_size > client->buffer_size) {
       client->buffer_size *= 2;
       client->buffer = static_cast<unsigned char*>(
           gpr_realloc(client->buffer, client->buffer_size));
     }
-    memcpy(client->buffer, GRPC_SLICE_START_PTR(*slice), bytes_to_send_size);
+    memcpy(client->buffer, out_frames.data, bytes_to_send_size);
     bytes_to_send = client->buffer;
   }
   tsi_handshaker_result* result = nullptr;
   if (is_handshake_finished_properly(resp)) {
-    alts_tsi_handshaker_result_create(resp, client->is_client, &result);
-    alts_tsi_handshaker_result_set_unused_bytes(result, &client->recv_bytes,
-                                                resp->bytes_consumed);
+    tsi_result status =
+        alts_tsi_handshaker_result_create(resp, client->is_client, &result);
+    if (status != TSI_OK) {
+      gpr_log(GPR_ERROR, "alts_tsi_handshaker_result_create() failed");
+      handle_response_done(client, status, nullptr, 0, nullptr);
+      return;
+    }
+    alts_tsi_handshaker_result_set_unused_bytes(
+        result, &client->recv_bytes,
+        grpc_gcp_HandshakerResp_bytes_consumed(resp));
   }
-  grpc_status_code code = static_cast<grpc_status_code>(resp->status.code);
+  grpc_status_code code = static_cast<grpc_status_code>(
+      grpc_gcp_HandshakerStatus_code(resp_status));
   if (code != GRPC_STATUS_OK) {
-    grpc_slice* details = static_cast<grpc_slice*>(resp->status.details.arg);
-    if (details != nullptr) {
-      char* error_details = grpc_slice_to_c_string(*details);
+    upb_strview details = grpc_gcp_HandshakerStatus_details(resp_status);
+    if (details.size > 0) {
+      char* error_details = (char*)gpr_zalloc(details.size + 1);
+      memcpy(error_details, details.data, details.size);
       gpr_log(GPR_ERROR, "Error from handshaker service:%s", error_details);
       gpr_free(error_details);
     }
   }
-  grpc_gcp_handshaker_resp_destroy(resp);
-  cb(alts_tsi_utils_convert_to_tsi_result(code), user_data, bytes_to_send,
-     bytes_to_send_size, result);
+  // TODO(apolcyn): consider short ciruiting handle_response_done and
+  // invoking the TSI callback directly if we aren't done yet, if
+  // handle_response_done's allocation per message received causes
+  // a performance issue.
+  handle_response_done(client, alts_tsi_utils_convert_to_tsi_result(code),
+                       bytes_to_send, bytes_to_send_size, result);
 }
 
-/**
- * Populate grpc operation data with the fields of ALTS handshaker client and
- * make a grpc call.
- */
-static tsi_result make_grpc_call(alts_handshaker_client* c, bool is_start) {
-  GPR_ASSERT(c != nullptr);
-  alts_grpc_handshaker_client* client =
-      reinterpret_cast<alts_grpc_handshaker_client*>(c);
+static tsi_result continue_make_grpc_call(alts_grpc_handshaker_client* client,
+                                          bool is_start) {
+  GPR_ASSERT(client != nullptr);
   grpc_op ops[kHandshakerClientOpNum];
   memset(ops, 0, sizeof(ops));
   grpc_op* op = ops;
   if (is_start) {
+    op->op = GRPC_OP_RECV_STATUS_ON_CLIENT;
+    op->data.recv_status_on_client.trailing_metadata = nullptr;
+    op->data.recv_status_on_client.status = &client->handshake_status_code;
+    op->data.recv_status_on_client.status_details =
+        &client->handshake_status_details;
+    op->flags = 0;
+    op->reserved = nullptr;
+    op++;
+    GPR_ASSERT(op - ops <= kHandshakerClientOpNum);
+    gpr_ref(&client->refs);
+    grpc_call_error call_error =
+        client->grpc_caller(client->call, ops, static_cast<size_t>(op - ops),
+                            &client->on_status_received);
+    // TODO(apolcyn): return the error here instead, as done for other ops?
+    GPR_ASSERT(call_error == GRPC_CALL_OK);
+    memset(ops, 0, sizeof(ops));
+    op = ops;
     op->op = GRPC_OP_SEND_INITIAL_METADATA;
     op->data.send_initial_metadata.count = 0;
     op++;
@@ -223,43 +345,180 @@ static tsi_result make_grpc_call(alts_handshaker_client* c, bool is_start) {
   return TSI_OK;
 }
 
+// TODO(apolcyn): remove this global queue when we can safely rely
+// on a MAX_CONCURRENT_STREAMS setting in the ALTS handshake server to
+// limit the number of concurrent handshakes.
+namespace {
+
+class HandshakeQueue {
+ public:
+  explicit HandshakeQueue(size_t max_outstanding_handshakes)
+      : max_outstanding_handshakes_(max_outstanding_handshakes) {}
+
+  void RequestHandshake(alts_grpc_handshaker_client* client) {
+    {
+      grpc_core::MutexLock lock(&mu_);
+      if (outstanding_handshakes_ == max_outstanding_handshakes_) {
+        // Max number already running, add to queue.
+        queued_handshakes_.push_back(client);
+        return;
+      }
+      // Start the handshake immediately.
+      ++outstanding_handshakes_;
+    }
+    continue_make_grpc_call(client, true /* is_start */);
+  }
+
+  void HandshakeDone() {
+    alts_grpc_handshaker_client* client = nullptr;
+    {
+      grpc_core::MutexLock lock(&mu_);
+      if (queued_handshakes_.empty()) {
+        // Nothing more in queue.  Decrement count and return immediately.
+        --outstanding_handshakes_;
+        return;
+      }
+      // Remove next entry from queue and start the handshake.
+      client = queued_handshakes_.front();
+      queued_handshakes_.pop_front();
+    }
+    continue_make_grpc_call(client, true /* is_start */);
+  }
+
+ private:
+  grpc_core::Mutex mu_;
+  std::list<alts_grpc_handshaker_client*> queued_handshakes_;
+  size_t outstanding_handshakes_ = 0;
+  const size_t max_outstanding_handshakes_;
+};
+
+gpr_once g_queued_handshakes_init = GPR_ONCE_INIT;
+/* Using separate queues for client and server handshakes is a
+ * hack that's mainly intended to satisfy the alts_concurrent_connectivity_test,
+ * which runs many concurrent handshakes where both endpoints
+ * are in the same process; this situation is problematic with a
+ * single queue because we have a high chance of using up all outstanding
+ * slots in the queue, such that there aren't any
+ * mutual client/server handshakes outstanding at the same time and
+ * able to make progress. */
+HandshakeQueue* g_client_handshake_queue;
+HandshakeQueue* g_server_handshake_queue;
+
+void DoHandshakeQueuesInit(void) {
+  const size_t per_queue_max_outstanding_handshakes = 40;
+  g_client_handshake_queue =
+      new HandshakeQueue(per_queue_max_outstanding_handshakes);
+  g_server_handshake_queue =
+      new HandshakeQueue(per_queue_max_outstanding_handshakes);
+}
+
+void RequestHandshake(alts_grpc_handshaker_client* client, bool is_client) {
+  gpr_once_init(&g_queued_handshakes_init, DoHandshakeQueuesInit);
+  HandshakeQueue* queue =
+      is_client ? g_client_handshake_queue : g_server_handshake_queue;
+  queue->RequestHandshake(client);
+}
+
+void HandshakeDone(bool is_client) {
+  HandshakeQueue* queue =
+      is_client ? g_client_handshake_queue : g_server_handshake_queue;
+  queue->HandshakeDone();
+}
+
+};  // namespace
+
+/**
+ * Populate grpc operation data with the fields of ALTS handshaker client and
+ * make a grpc call.
+ */
+static tsi_result make_grpc_call(alts_handshaker_client* c, bool is_start) {
+  GPR_ASSERT(c != nullptr);
+  alts_grpc_handshaker_client* client =
+      reinterpret_cast<alts_grpc_handshaker_client*>(c);
+  if (is_start) {
+    RequestHandshake(client, client->is_client);
+    return TSI_OK;
+  } else {
+    return continue_make_grpc_call(client, is_start);
+  }
+}
+
+static void on_status_received(void* arg, grpc_error* error) {
+  alts_grpc_handshaker_client* client =
+      static_cast<alts_grpc_handshaker_client*>(arg);
+  if (client->handshake_status_code != GRPC_STATUS_OK) {
+    // TODO(apolcyn): consider overriding the handshake result's
+    // status from the final ALTS message with the status here.
+    char* status_details =
+        grpc_slice_to_c_string(client->handshake_status_details);
+    gpr_log(GPR_INFO,
+            "alts_grpc_handshaker_client:%p on_status_received "
+            "status:%d details:|%s| error:|%s|",
+            client, client->handshake_status_code, status_details,
+            grpc_error_string(error));
+    gpr_free(status_details);
+  }
+  maybe_complete_tsi_next(client, true /* receive_status_finished */,
+                          nullptr /* pending_recv_message_result */);
+  HandshakeDone(client->is_client);
+  alts_grpc_handshaker_client_unref(client);
+}
+
+/* Serializes a grpc_gcp_HandshakerReq message into a buffer and returns newly
+ * grpc_byte_buffer holding it. */
+static grpc_byte_buffer* get_serialized_handshaker_req(
+    grpc_gcp_HandshakerReq* req, upb_arena* arena) {
+  size_t buf_length;
+  char* buf = grpc_gcp_HandshakerReq_serialize(req, arena, &buf_length);
+  if (buf == nullptr) {
+    return nullptr;
+  }
+  grpc_slice slice = grpc_slice_from_copied_buffer(buf, buf_length);
+  grpc_byte_buffer* byte_buffer = grpc_raw_byte_buffer_create(&slice, 1);
+  grpc_slice_unref_internal(slice);
+  return byte_buffer;
+}
+
 /* Create and populate a client_start handshaker request, then serialize it. */
 static grpc_byte_buffer* get_serialized_start_client(
     alts_handshaker_client* c) {
   GPR_ASSERT(c != nullptr);
   alts_grpc_handshaker_client* client =
       reinterpret_cast<alts_grpc_handshaker_client*>(c);
-  bool ok = true;
-  grpc_gcp_handshaker_req* req =
-      grpc_gcp_handshaker_req_create(CLIENT_START_REQ);
-  ok &= grpc_gcp_handshaker_req_set_handshake_protocol(
-      req, grpc_gcp_HandshakeProtocol_ALTS);
-  ok &= grpc_gcp_handshaker_req_add_application_protocol(
-      req, ALTS_APPLICATION_PROTOCOL);
-  ok &= grpc_gcp_handshaker_req_add_record_protocol(req, ALTS_RECORD_PROTOCOL);
-  grpc_gcp_rpc_protocol_versions* versions = &client->options->rpc_versions;
-  ok &= grpc_gcp_handshaker_req_set_rpc_versions(
-      req, versions->max_rpc_version.major, versions->max_rpc_version.minor,
-      versions->min_rpc_version.major, versions->min_rpc_version.minor);
-  char* target_name = grpc_slice_to_c_string(client->target_name);
-  ok &= grpc_gcp_handshaker_req_set_target_name(req, target_name);
+  upb::Arena arena;
+  grpc_gcp_HandshakerReq* req = grpc_gcp_HandshakerReq_new(arena.ptr());
+  grpc_gcp_StartClientHandshakeReq* start_client =
+      grpc_gcp_HandshakerReq_mutable_client_start(req, arena.ptr());
+  grpc_gcp_StartClientHandshakeReq_set_handshake_security_protocol(
+      start_client, grpc_gcp_ALTS);
+  grpc_gcp_StartClientHandshakeReq_add_application_protocols(
+      start_client, upb_strview_makez(ALTS_APPLICATION_PROTOCOL), arena.ptr());
+  grpc_gcp_StartClientHandshakeReq_add_record_protocols(
+      start_client, upb_strview_makez(ALTS_RECORD_PROTOCOL), arena.ptr());
+  grpc_gcp_RpcProtocolVersions* client_version =
+      grpc_gcp_StartClientHandshakeReq_mutable_rpc_versions(start_client,
+                                                            arena.ptr());
+  grpc_gcp_RpcProtocolVersions_assign_from_struct(
+      client_version, arena.ptr(), &client->options->rpc_versions);
+  grpc_gcp_StartClientHandshakeReq_set_target_name(
+      start_client,
+      upb_strview_make(reinterpret_cast<const char*>(
+                           GRPC_SLICE_START_PTR(client->target_name)),
+                       GRPC_SLICE_LENGTH(client->target_name)));
   target_service_account* ptr =
       (reinterpret_cast<grpc_alts_credentials_client_options*>(client->options))
           ->target_account_list_head;
   while (ptr != nullptr) {
-    grpc_gcp_handshaker_req_add_target_identity_service_account(req, ptr->data);
+    grpc_gcp_Identity* target_identity =
+        grpc_gcp_StartClientHandshakeReq_add_target_identities(start_client,
+                                                               arena.ptr());
+    grpc_gcp_Identity_set_service_account(target_identity,
+                                          upb_strview_makez(ptr->data));
     ptr = ptr->next;
   }
-  grpc_slice slice;
-  ok &= grpc_gcp_handshaker_req_encode(req, &slice);
-  grpc_byte_buffer* buffer = nullptr;
-  if (ok) {
-    buffer = grpc_raw_byte_buffer_create(&slice, 1 /* number of slices */);
-  }
-  grpc_slice_unref_internal(slice);
-  gpr_free(target_name);
-  grpc_gcp_handshaker_req_destroy(req);
-  return buffer;
+  grpc_gcp_StartClientHandshakeReq_set_max_frame_size(
+      start_client, static_cast<uint32_t>(client->max_frame_size));
+  return get_serialized_handshaker_req(req, arena.ptr());
 }
 
 static tsi_result handshaker_client_start_client(alts_handshaker_client* c) {
@@ -290,28 +549,32 @@ static grpc_byte_buffer* get_serialized_start_server(
   GPR_ASSERT(bytes_received != nullptr);
   alts_grpc_handshaker_client* client =
       reinterpret_cast<alts_grpc_handshaker_client*>(c);
-  grpc_gcp_handshaker_req* req =
-      grpc_gcp_handshaker_req_create(SERVER_START_REQ);
-  bool ok = grpc_gcp_handshaker_req_add_application_protocol(
-      req, ALTS_APPLICATION_PROTOCOL);
-  ok &= grpc_gcp_handshaker_req_param_add_record_protocol(
-      req, grpc_gcp_HandshakeProtocol_ALTS, ALTS_RECORD_PROTOCOL);
-  ok &= grpc_gcp_handshaker_req_set_in_bytes(
-      req, reinterpret_cast<const char*> GRPC_SLICE_START_PTR(*bytes_received),
-      GRPC_SLICE_LENGTH(*bytes_received));
-  grpc_gcp_rpc_protocol_versions* versions = &client->options->rpc_versions;
-  ok &= grpc_gcp_handshaker_req_set_rpc_versions(
-      req, versions->max_rpc_version.major, versions->max_rpc_version.minor,
-      versions->min_rpc_version.major, versions->min_rpc_version.minor);
-  grpc_slice req_slice;
-  ok &= grpc_gcp_handshaker_req_encode(req, &req_slice);
-  grpc_byte_buffer* buffer = nullptr;
-  if (ok) {
-    buffer = grpc_raw_byte_buffer_create(&req_slice, 1 /* number of slices */);
-  }
-  grpc_slice_unref_internal(req_slice);
-  grpc_gcp_handshaker_req_destroy(req);
-  return buffer;
+
+  upb::Arena arena;
+  grpc_gcp_HandshakerReq* req = grpc_gcp_HandshakerReq_new(arena.ptr());
+
+  grpc_gcp_StartServerHandshakeReq* start_server =
+      grpc_gcp_HandshakerReq_mutable_server_start(req, arena.ptr());
+  grpc_gcp_StartServerHandshakeReq_add_application_protocols(
+      start_server, upb_strview_makez(ALTS_APPLICATION_PROTOCOL), arena.ptr());
+  grpc_gcp_ServerHandshakeParameters* value =
+      grpc_gcp_ServerHandshakeParameters_new(arena.ptr());
+  grpc_gcp_ServerHandshakeParameters_add_record_protocols(
+      value, upb_strview_makez(ALTS_RECORD_PROTOCOL), arena.ptr());
+  grpc_gcp_StartServerHandshakeReq_handshake_parameters_set(
+      start_server, grpc_gcp_ALTS, value, arena.ptr());
+  grpc_gcp_StartServerHandshakeReq_set_in_bytes(
+      start_server, upb_strview_make(reinterpret_cast<const char*>(
+                                         GRPC_SLICE_START_PTR(*bytes_received)),
+                                     GRPC_SLICE_LENGTH(*bytes_received)));
+  grpc_gcp_RpcProtocolVersions* server_version =
+      grpc_gcp_StartServerHandshakeReq_mutable_rpc_versions(start_server,
+                                                            arena.ptr());
+  grpc_gcp_RpcProtocolVersions_assign_from_struct(
+      server_version, arena.ptr(), &client->options->rpc_versions);
+  grpc_gcp_StartServerHandshakeReq_set_max_frame_size(
+      start_server, static_cast<uint32_t>(client->max_frame_size));
+  return get_serialized_handshaker_req(req, arena.ptr());
 }
 
 static tsi_result handshaker_client_start_server(alts_handshaker_client* c,
@@ -339,19 +602,15 @@ static tsi_result handshaker_client_start_server(alts_handshaker_client* c,
 /* Create and populate a next handshaker request, then serialize it. */
 static grpc_byte_buffer* get_serialized_next(grpc_slice* bytes_received) {
   GPR_ASSERT(bytes_received != nullptr);
-  grpc_gcp_handshaker_req* req = grpc_gcp_handshaker_req_create(NEXT_REQ);
-  bool ok = grpc_gcp_handshaker_req_set_in_bytes(
-      req, reinterpret_cast<const char*> GRPC_SLICE_START_PTR(*bytes_received),
-      GRPC_SLICE_LENGTH(*bytes_received));
-  grpc_slice req_slice;
-  ok &= grpc_gcp_handshaker_req_encode(req, &req_slice);
-  grpc_byte_buffer* buffer = nullptr;
-  if (ok) {
-    buffer = grpc_raw_byte_buffer_create(&req_slice, 1 /* number of slices */);
-  }
-  grpc_slice_unref_internal(req_slice);
-  grpc_gcp_handshaker_req_destroy(req);
-  return buffer;
+  upb::Arena arena;
+  grpc_gcp_HandshakerReq* req = grpc_gcp_HandshakerReq_new(arena.ptr());
+  grpc_gcp_NextHandshakeMessageReq* next =
+      grpc_gcp_HandshakerReq_mutable_next(req, arena.ptr());
+  grpc_gcp_NextHandshakeMessageReq_set_in_bytes(
+      next, upb_strview_make(reinterpret_cast<const char*> GRPC_SLICE_START_PTR(
+                                 *bytes_received),
+                             GRPC_SLICE_LENGTH(*bytes_received)));
+  return get_serialized_handshaker_req(req, arena.ptr());
 }
 
 static tsi_result handshaker_client_next(alts_handshaker_client* c,
@@ -387,6 +646,11 @@ static void handshaker_client_shutdown(alts_handshaker_client* c) {
   }
 }
 
+static void handshaker_call_unref(void* arg, grpc_error* /* error */) {
+  grpc_call* call = static_cast<grpc_call*>(arg);
+  grpc_call_unref(call);
+}
+
 static void handshaker_client_destruct(alts_handshaker_client* c) {
   if (c == nullptr) {
     return;
@@ -394,7 +658,24 @@ static void handshaker_client_destruct(alts_handshaker_client* c) {
   alts_grpc_handshaker_client* client =
       reinterpret_cast<alts_grpc_handshaker_client*>(c);
   if (client->call != nullptr) {
-    grpc_call_unref(client->call);
+    // Throw this grpc_call_unref over to the ExecCtx so that
+    // we invoke it at the bottom of the call stack and
+    // prevent lock inversion problems due to nested ExecCtx flushing.
+    // TODO(apolcyn): we could remove this indirection and call
+    // grpc_call_unref inline if there was an internal variant of
+    // grpc_call_unref that didn't need to flush an ExecCtx.
+    if (grpc_core::ExecCtx::Get() == nullptr) {
+      // Unref handshaker call if there is no exec_ctx, e.g., in the case of
+      // Envoy ALTS transport socket.
+      grpc_call_unref(client->call);
+    } else {
+      // Using existing exec_ctx to unref handshaker call.
+      grpc_core::ExecCtx::Run(
+          DEBUG_LOCATION,
+          GRPC_CLOSURE_CREATE(handshaker_call_unref, client->call,
+                              grpc_schedule_on_exec_ctx),
+          GRPC_ERROR_NONE);
+    }
   }
 }
 
@@ -409,13 +690,15 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
     grpc_alts_credentials_options* options, const grpc_slice& target_name,
     grpc_iomgr_cb_func grpc_cb, tsi_handshaker_on_next_done_cb cb,
     void* user_data, alts_handshaker_client_vtable* vtable_for_testing,
-    bool is_client) {
+    bool is_client, size_t max_frame_size) {
   if (channel == nullptr || handshaker_service_url == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to alts_handshaker_client_create()");
     return nullptr;
   }
   alts_grpc_handshaker_client* client =
       static_cast<alts_grpc_handshaker_client*>(gpr_zalloc(sizeof(*client)));
+  gpr_mu_init(&client->mu);
+  gpr_ref_init(&client->refs, 1);
   client->grpc_caller = grpc_call_start_batch_and_execute;
   client->handshaker = handshaker;
   client->cb = cb;
@@ -426,8 +709,8 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
   client->target_name = grpc_slice_copy(target_name);
   client->recv_bytes = grpc_empty_slice();
   grpc_metadata_array_init(&client->recv_initial_metadata);
-  client->grpc_cb = grpc_cb;
   client->is_client = is_client;
+  client->max_frame_size = max_frame_size;
   client->buffer_size = TSI_ALTS_INITIAL_BUFFER_SIZE;
   client->buffer = static_cast<unsigned char*>(gpr_zalloc(client->buffer_size));
   grpc_slice slice = grpc_slice_from_copied_string(handshaker_service_url);
@@ -441,8 +724,10 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
                 GRPC_MILLIS_INF_FUTURE, nullptr);
   client->base.vtable =
       vtable_for_testing == nullptr ? &vtable : vtable_for_testing;
-  GRPC_CLOSURE_INIT(&client->on_handshaker_service_resp_recv, client->grpc_cb,
-                    client, grpc_schedule_on_exec_ctx);
+  GRPC_CLOSURE_INIT(&client->on_handshaker_service_resp_recv, grpc_cb, client,
+                    grpc_schedule_on_exec_ctx);
+  GRPC_CLOSURE_INIT(&client->on_status_received, on_status_received, client,
+                    grpc_schedule_on_exec_ctx);
   grpc_slice_unref_internal(slice);
   return &client->base;
 }
@@ -552,6 +837,27 @@ grpc_closure* alts_handshaker_client_get_closure_for_testing(
   return &client->on_handshaker_service_resp_recv;
 }
 
+void alts_handshaker_client_ref_for_testing(alts_handshaker_client* c) {
+  alts_grpc_handshaker_client* client =
+      reinterpret_cast<alts_grpc_handshaker_client*>(c);
+  gpr_ref(&client->refs);
+}
+
+void alts_handshaker_client_on_status_received_for_testing(
+    alts_handshaker_client* c, grpc_status_code status, grpc_error* error) {
+  // We first make sure that the handshake queue has been initialized
+  // here because there are tests that use this API that mock out
+  // other parts of the alts_handshaker_client in such a way that the
+  // code path that would normally ensure that the handshake queue
+  // has been initialized isn't taken.
+  gpr_once_init(&g_queued_handshakes_init, DoHandshakeQueuesInit);
+  alts_grpc_handshaker_client* client =
+      reinterpret_cast<alts_grpc_handshaker_client*>(c);
+  client->handshake_status_code = status;
+  client->handshake_status_details = grpc_empty_slice();
+  grpc_core::Closure::Run(DEBUG_LOCATION, &client->on_status_received, error);
+}
+
 }  // namespace internal
 }  // namespace grpc_core
 
@@ -596,20 +902,8 @@ void alts_handshaker_client_shutdown(alts_handshaker_client* client) {
 
 void alts_handshaker_client_destroy(alts_handshaker_client* c) {
   if (c != nullptr) {
-    if (c->vtable != nullptr && c->vtable->destruct != nullptr) {
-      c->vtable->destruct(c);
-    }
     alts_grpc_handshaker_client* client =
         reinterpret_cast<alts_grpc_handshaker_client*>(c);
-    grpc_byte_buffer_destroy(client->send_buffer);
-    grpc_byte_buffer_destroy(client->recv_buffer);
-    client->send_buffer = nullptr;
-    client->recv_buffer = nullptr;
-    grpc_metadata_array_destroy(&client->recv_initial_metadata);
-    grpc_slice_unref_internal(client->recv_bytes);
-    grpc_slice_unref_internal(client->target_name);
-    grpc_alts_credentials_options_destroy(client->options);
-    gpr_free(client->buffer);
-    gpr_free(client);
+    alts_grpc_handshaker_client_unref(client);
   }
 }