grpc 1.28.0 → 1.36.0

data/src/core/plugin_registry/grpc_plugin_registry.cc

@@ -34,10 +34,10 @@ void grpc_resolver_fake_init(void);
 void grpc_resolver_fake_shutdown(void);
 void grpc_lb_policy_grpclb_init(void);
 void grpc_lb_policy_grpclb_shutdown(void);
-void grpc_lb_policy_cds_init(void);
-void grpc_lb_policy_cds_shutdown(void);
-void grpc_lb_policy_xds_init(void);
-void grpc_lb_policy_xds_shutdown(void);
+void grpc_lb_policy_priority_init(void);
+void grpc_lb_policy_priority_shutdown(void);
+void grpc_lb_policy_weighted_target_init(void);
+void grpc_lb_policy_weighted_target_shutdown(void);
 void grpc_lb_policy_pick_first_init(void);
 void grpc_lb_policy_pick_first_shutdown(void);
 void grpc_lb_policy_round_robin_init(void);
@@ -48,19 +48,46 @@ void grpc_resolver_dns_native_init(void);
 void grpc_resolver_dns_native_shutdown(void);
 void grpc_resolver_sockaddr_init(void);
 void grpc_resolver_sockaddr_shutdown(void);
-void grpc_resolver_xds_init(void);
-void grpc_resolver_xds_shutdown(void);
 void grpc_client_idle_filter_init(void);
 void grpc_client_idle_filter_shutdown(void);
 void grpc_max_age_filter_init(void);
 void grpc_max_age_filter_shutdown(void);
 void grpc_message_size_filter_init(void);
 void grpc_message_size_filter_shutdown(void);
+void grpc_service_config_channel_arg_filter_init(void);
+void grpc_service_config_channel_arg_filter_shutdown(void);
 void grpc_client_authority_filter_init(void);
 void grpc_client_authority_filter_shutdown(void);
 void grpc_workaround_cronet_compression_filter_init(void);
 void grpc_workaround_cronet_compression_filter_shutdown(void);
 
+#ifndef GRPC_NO_XDS
+namespace grpc_core {
+void XdsClientGlobalInit();
+void XdsClientGlobalShutdown();
+}  // namespace grpc_core
+void grpc_certificate_provider_registry_init(void);
+void grpc_certificate_provider_registry_shutdown(void);
+namespace grpc_core {
+void FileWatcherCertificateProviderInit();
+void FileWatcherCertificateProviderShutdown();
+}  // namespace grpc_core
+void grpc_lb_policy_cds_init(void);
+void grpc_lb_policy_cds_shutdown(void);
+void grpc_lb_policy_xds_cluster_impl_init(void);
+void grpc_lb_policy_xds_cluster_impl_shutdown(void);
+void grpc_lb_policy_xds_cluster_resolver_init(void);
+void grpc_lb_policy_xds_cluster_resolver_shutdown(void);
+void grpc_lb_policy_xds_cluster_manager_init(void);
+void grpc_lb_policy_xds_cluster_manager_shutdown(void);
+void grpc_resolver_xds_init(void);
+void grpc_resolver_xds_shutdown(void);
+namespace grpc_core {
+void GoogleCloud2ProdResolverInit();
+void GoogleCloud2ProdResolverShutdown();
+}
+#endif
+
 void grpc_register_built_in_plugins(void) {
   grpc_register_plugin(grpc_http_filters_init,
                        grpc_http_filters_shutdown);
@@ -76,10 +103,10 @@ void grpc_register_built_in_plugins(void) {
                        grpc_resolver_fake_shutdown);
   grpc_register_plugin(grpc_lb_policy_grpclb_init,
                        grpc_lb_policy_grpclb_shutdown);
-  grpc_register_plugin(grpc_lb_policy_cds_init,
-                       grpc_lb_policy_cds_shutdown);
-  grpc_register_plugin(grpc_lb_policy_xds_init,
-                       grpc_lb_policy_xds_shutdown);
+  grpc_register_plugin(grpc_lb_policy_priority_init,
+                       grpc_lb_policy_priority_shutdown);
+  grpc_register_plugin(grpc_lb_policy_weighted_target_init,
+                       grpc_lb_policy_weighted_target_shutdown);
   grpc_register_plugin(grpc_lb_policy_pick_first_init,
                        grpc_lb_policy_pick_first_shutdown);
   grpc_register_plugin(grpc_lb_policy_round_robin_init,
@@ -90,16 +117,36 @@ void grpc_register_built_in_plugins(void) {
                        grpc_resolver_dns_native_shutdown);
   grpc_register_plugin(grpc_resolver_sockaddr_init,
                        grpc_resolver_sockaddr_shutdown);
-  grpc_register_plugin(grpc_resolver_xds_init,
-                       grpc_resolver_xds_shutdown);
   grpc_register_plugin(grpc_client_idle_filter_init,
                        grpc_client_idle_filter_shutdown);
   grpc_register_plugin(grpc_max_age_filter_init,
                        grpc_max_age_filter_shutdown);
   grpc_register_plugin(grpc_message_size_filter_init,
                        grpc_message_size_filter_shutdown);
+  grpc_register_plugin(grpc_service_config_channel_arg_filter_init,
+                       grpc_service_config_channel_arg_filter_shutdown);
   grpc_register_plugin(grpc_client_authority_filter_init,
                        grpc_client_authority_filter_shutdown);
   grpc_register_plugin(grpc_workaround_cronet_compression_filter_init,
                        grpc_workaround_cronet_compression_filter_shutdown);
+#ifndef GRPC_NO_XDS
+  grpc_register_plugin(grpc_core::XdsClientGlobalInit,
+                       grpc_core::XdsClientGlobalShutdown);
+  grpc_register_plugin(grpc_certificate_provider_registry_init,
+                       grpc_certificate_provider_registry_shutdown);
+  grpc_register_plugin(grpc_core::FileWatcherCertificateProviderInit,
+                       grpc_core::FileWatcherCertificateProviderShutdown);
+  grpc_register_plugin(grpc_lb_policy_cds_init,
+                       grpc_lb_policy_cds_shutdown);
+  grpc_register_plugin(grpc_lb_policy_xds_cluster_impl_init,
+                       grpc_lb_policy_xds_cluster_impl_shutdown);
+  grpc_register_plugin(grpc_lb_policy_xds_cluster_resolver_init,
+                       grpc_lb_policy_xds_cluster_resolver_shutdown);
+  grpc_register_plugin(grpc_lb_policy_xds_cluster_manager_init,
+                       grpc_lb_policy_xds_cluster_manager_shutdown);
+  grpc_register_plugin(grpc_resolver_xds_init,
+                       grpc_resolver_xds_shutdown);
+  grpc_register_plugin(grpc_core::GoogleCloud2ProdResolverInit,
+                       grpc_core::GoogleCloud2ProdResolverShutdown);
+#endif
 }

data/src/core/tsi/alts/crypt/aes_gcm.cc

@@ -18,8 +18,6 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/tsi/grpc_shadow_boringssl.h"
-
 #include "src/core/tsi/alts/crypt/gsec.h"
 
 #include <openssl/bio.h>

data/src/core/tsi/alts/crypt/gsec.cc

@@ -43,8 +43,9 @@ grpc_status_code gsec_aead_crypter_encrypt(
     char** error_details) {
   if (crypter != nullptr && crypter->vtable != nullptr &&
       crypter->vtable->encrypt_iovec != nullptr) {
-    struct iovec aad_vec = {(void*)aad, aad_length};
-    struct iovec plaintext_vec = {(void*)plaintext, plaintext_length};
+    struct iovec aad_vec = {const_cast<uint8_t*>(aad), aad_length};
+    struct iovec plaintext_vec = {const_cast<uint8_t*>(plaintext),
+                                  plaintext_length};
     struct iovec ciphertext_vec = {ciphertext_and_tag,
                                    ciphertext_and_tag_length};
     return crypter->vtable->encrypt_iovec(
@@ -81,8 +82,8 @@ grpc_status_code gsec_aead_crypter_decrypt(
     size_t plaintext_length, size_t* bytes_written, char** error_details) {
   if (crypter != nullptr && crypter->vtable != nullptr &&
       crypter->vtable->decrypt_iovec != nullptr) {
-    struct iovec aad_vec = {(void*)aad, aad_length};
-    struct iovec ciphertext_vec = {(void*)ciphertext_and_tag,
+    struct iovec aad_vec = {const_cast<uint8_t*>(aad), aad_length};
+    struct iovec ciphertext_vec = {const_cast<uint8_t*>(ciphertext_and_tag),
                                    ciphertext_and_tag_length};
     struct iovec plaintext_vec = {plaintext, plaintext_length};
     return crypter->vtable->decrypt_iovec(

data/src/core/tsi/alts/frame_protector/frame_handler.cc

@@ -31,16 +31,18 @@
 
 /* Use little endian to interpret a string of bytes as uint32_t. */
 static uint32_t load_32_le(const unsigned char* buffer) {
-  return (((uint32_t)buffer[3]) << 24) | (((uint32_t)buffer[2]) << 16) |
-         (((uint32_t)buffer[1]) << 8) | ((uint32_t)buffer[0]);
+  return (static_cast<uint32_t>(buffer[3]) << 24) |
+         (static_cast<uint32_t>(buffer[2]) << 16) |
+         (static_cast<uint32_t>(buffer[1]) << 8) |
+         static_cast<uint32_t>(buffer[0]);
 }
 
 /* Store uint32_t as a string of little endian bytes. */
 static void store_32_le(uint32_t value, unsigned char* buffer) {
-  buffer[3] = (unsigned char)(value >> 24) & 0xFF;
-  buffer[2] = (unsigned char)(value >> 16) & 0xFF;
-  buffer[1] = (unsigned char)(value >> 8) & 0xFF;
-  buffer[0] = (unsigned char)(value)&0xFF;
+  buffer[3] = static_cast<unsigned char>(value >> 24) & 0xFF;
+  buffer[2] = static_cast<unsigned char>(value >> 16) & 0xFF;
+  buffer[1] = static_cast<unsigned char>(value >> 8) & 0xFF;
+  buffer[0] = static_cast<unsigned char>(value) & 0xFF;
 }
 
 /* Frame writer implementation. */

data/src/core/tsi/alts/handshaker/alts_handshaker_client.cc

@@ -22,6 +22,8 @@
 
 #include "src/core/tsi/alts/handshaker/alts_handshaker_client.h"
 
+#include "upb/upb.hpp"
+
 #include <grpc/byte_buffer.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -67,9 +69,9 @@ typedef struct alts_grpc_handshaker_client {
   grpc_closure on_handshaker_service_resp_recv;
   /* Buffers containing information to be sent (or received) to (or from) the
    * handshaker service. */
-  grpc_byte_buffer* send_buffer;
-  grpc_byte_buffer* recv_buffer;
-  grpc_status_code status;
+  grpc_byte_buffer* send_buffer = nullptr;
+  grpc_byte_buffer* recv_buffer = nullptr;
+  grpc_status_code status = GRPC_STATUS_OK;
   /* Initial metadata to be received from handshaker service. */
   grpc_metadata_array recv_initial_metadata;
   /* A callback function provided by an application to be invoked when response
@@ -93,15 +95,17 @@ typedef struct alts_grpc_handshaker_client {
   /** callback for receiving handshake call status */
   grpc_closure on_status_received;
   /** gRPC status code of handshake call */
-  grpc_status_code handshake_status_code;
+  grpc_status_code handshake_status_code = GRPC_STATUS_OK;
   /** gRPC status details of handshake call */
   grpc_slice handshake_status_details;
   /* mu synchronizes all fields below including their internal fields. */
-  gpr_mu mu;
+  grpc_core::Mutex mu;
   /* indicates if the handshaker call's RECV_STATUS_ON_CLIENT op is done. */
-  bool receive_status_finished;
+  bool receive_status_finished = false;
   /* if non-null, contains arguments to complete a TSI next callback. */
-  recv_message_result* pending_recv_message_result;
+  recv_message_result* pending_recv_message_result = nullptr;
+  /* Maximum frame size used by frame protector. */
+  size_t max_frame_size;
 } alts_grpc_handshaker_client;
 
 static void handshaker_client_send_buffer_destroy(
@@ -136,8 +140,7 @@ static void alts_grpc_handshaker_client_unref(
     grpc_alts_credentials_options_destroy(client->options);
     gpr_free(client->buffer);
     grpc_slice_unref_internal(client->handshake_status_details);
-    gpr_mu_destroy(&client->mu);
-    gpr_free(client);
+    delete client;
   }
 }
 
@@ -259,7 +262,13 @@ void alts_handshaker_client_handle_response(alts_handshaker_client* c,
   }
   tsi_handshaker_result* result = nullptr;
   if (is_handshake_finished_properly(resp)) {
-    alts_tsi_handshaker_result_create(resp, client->is_client, &result);
+    tsi_result status =
+        alts_tsi_handshaker_result_create(resp, client->is_client, &result);
+    if (status != TSI_OK) {
+      gpr_log(GPR_ERROR, "alts_tsi_handshaker_result_create() failed");
+      handle_response_done(client, status, nullptr, 0, nullptr);
+      return;
+    }
     alts_tsi_handshaker_result_set_unused_bytes(
         result, &client->recv_bytes,
         grpc_gcp_HandshakerResp_bytes_consumed(resp));
@@ -269,7 +278,7 @@ void alts_handshaker_client_handle_response(alts_handshaker_client* c,
   if (code != GRPC_STATUS_OK) {
     upb_strview details = grpc_gcp_HandshakerStatus_details(resp_status);
     if (details.size > 0) {
-      char* error_details = (char*)gpr_zalloc(details.size + 1);
+      char* error_details = static_cast<char*>(gpr_zalloc(details.size + 1));
       memcpy(error_details, details.data, details.size);
       gpr_log(GPR_ERROR, "Error from handshaker service:%s", error_details);
       gpr_free(error_details);
@@ -506,6 +515,8 @@ static grpc_byte_buffer* get_serialized_start_client(
                                           upb_strview_makez(ptr->data));
     ptr = ptr->next;
   }
+  grpc_gcp_StartClientHandshakeReq_set_max_frame_size(
+      start_client, static_cast<uint32_t>(client->max_frame_size));
   return get_serialized_handshaker_req(req, arena.ptr());
 }
 
@@ -545,17 +556,12 @@ static grpc_byte_buffer* get_serialized_start_server(
       grpc_gcp_HandshakerReq_mutable_server_start(req, arena.ptr());
   grpc_gcp_StartServerHandshakeReq_add_application_protocols(
       start_server, upb_strview_makez(ALTS_APPLICATION_PROTOCOL), arena.ptr());
-  grpc_gcp_StartServerHandshakeReq_HandshakeParametersEntry* param =
-      grpc_gcp_StartServerHandshakeReq_add_handshake_parameters(start_server,
-                                                                arena.ptr());
-  grpc_gcp_StartServerHandshakeReq_HandshakeParametersEntry_set_key(
-      param, grpc_gcp_ALTS);
   grpc_gcp_ServerHandshakeParameters* value =
       grpc_gcp_ServerHandshakeParameters_new(arena.ptr());
   grpc_gcp_ServerHandshakeParameters_add_record_protocols(
       value, upb_strview_makez(ALTS_RECORD_PROTOCOL), arena.ptr());
-  grpc_gcp_StartServerHandshakeReq_HandshakeParametersEntry_set_value(param,
-                                                                      value);
+  grpc_gcp_StartServerHandshakeReq_handshake_parameters_set(
+      start_server, grpc_gcp_ALTS, value, arena.ptr());
   grpc_gcp_StartServerHandshakeReq_set_in_bytes(
       start_server, upb_strview_make(reinterpret_cast<const char*>(
                                          GRPC_SLICE_START_PTR(*bytes_received)),
@@ -565,6 +571,8 @@ static grpc_byte_buffer* get_serialized_start_server(
                                                             arena.ptr());
   grpc_gcp_RpcProtocolVersions_assign_from_struct(
       server_version, arena.ptr(), &client->options->rpc_versions);
+  grpc_gcp_StartServerHandshakeReq_set_max_frame_size(
+      start_server, static_cast<uint32_t>(client->max_frame_size));
   return get_serialized_handshaker_req(req, arena.ptr());
 }
 
@@ -655,11 +663,18 @@ static void handshaker_client_destruct(alts_handshaker_client* c) {
     // TODO(apolcyn): we could remove this indirection and call
     // grpc_call_unref inline if there was an internal variant of
     // grpc_call_unref that didn't need to flush an ExecCtx.
-    grpc_core::ExecCtx::Run(
-        DEBUG_LOCATION,
-        GRPC_CLOSURE_CREATE(handshaker_call_unref, client->call,
-                            grpc_schedule_on_exec_ctx),
-        GRPC_ERROR_NONE);
+    if (grpc_core::ExecCtx::Get() == nullptr) {
+      // Unref handshaker call if there is no exec_ctx, e.g., in the case of
+      // Envoy ALTS transport socket.
+      grpc_call_unref(client->call);
+    } else {
+      // Using existing exec_ctx to unref handshaker call.
+      grpc_core::ExecCtx::Run(
+          DEBUG_LOCATION,
+          GRPC_CLOSURE_CREATE(handshaker_call_unref, client->call,
+                              grpc_schedule_on_exec_ctx),
+          GRPC_ERROR_NONE);
+    }
   }
 }
 
@@ -674,28 +689,29 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
     grpc_alts_credentials_options* options, const grpc_slice& target_name,
     grpc_iomgr_cb_func grpc_cb, tsi_handshaker_on_next_done_cb cb,
     void* user_data, alts_handshaker_client_vtable* vtable_for_testing,
-    bool is_client) {
+    bool is_client, size_t max_frame_size) {
   if (channel == nullptr || handshaker_service_url == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to alts_handshaker_client_create()");
     return nullptr;
   }
-  alts_grpc_handshaker_client* client =
-      static_cast<alts_grpc_handshaker_client*>(gpr_zalloc(sizeof(*client)));
-  gpr_mu_init(&client->mu);
+  alts_grpc_handshaker_client* client = new alts_grpc_handshaker_client();
+  memset(&client->base, 0, sizeof(client->base));
+  client->base.vtable =
+      vtable_for_testing == nullptr ? &vtable : vtable_for_testing;
   gpr_ref_init(&client->refs, 1);
-  client->grpc_caller = grpc_call_start_batch_and_execute;
   client->handshaker = handshaker;
+  client->grpc_caller = grpc_call_start_batch_and_execute;
+  grpc_metadata_array_init(&client->recv_initial_metadata);
   client->cb = cb;
   client->user_data = user_data;
-  client->send_buffer = nullptr;
-  client->recv_buffer = nullptr;
   client->options = grpc_alts_credentials_options_copy(options);
   client->target_name = grpc_slice_copy(target_name);
-  client->recv_bytes = grpc_empty_slice();
-  grpc_metadata_array_init(&client->recv_initial_metadata);
   client->is_client = is_client;
+  client->recv_bytes = grpc_empty_slice();
   client->buffer_size = TSI_ALTS_INITIAL_BUFFER_SIZE;
   client->buffer = static_cast<unsigned char*>(gpr_zalloc(client->buffer_size));
+  client->handshake_status_details = grpc_empty_slice();
+  client->max_frame_size = max_frame_size;
   grpc_slice slice = grpc_slice_from_copied_string(handshaker_service_url);
   client->call =
       strcmp(handshaker_service_url, ALTS_HANDSHAKER_SERVICE_URL_FOR_TESTING) ==
@@ -705,8 +721,6 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
                 channel, nullptr, GRPC_PROPAGATE_DEFAULTS, interested_parties,
                 grpc_slice_from_static_string(ALTS_SERVICE_METHOD), &slice,
                 GRPC_MILLIS_INF_FUTURE, nullptr);
-  client->base.vtable =
-      vtable_for_testing == nullptr ? &vtable : vtable_for_testing;
   GRPC_CLOSURE_INIT(&client->on_handshaker_service_resp_recv, grpc_cb, client,
                     grpc_schedule_on_exec_ctx);
   GRPC_CLOSURE_INIT(&client->on_status_received, on_status_received, client,

data/src/core/tsi/alts/handshaker/alts_handshaker_client.h

@@ -117,7 +117,7 @@ void alts_handshaker_client_destroy(alts_handshaker_client* client);
  * This method creates an ALTS handshaker client.
  *
  * - handshaker: ALTS TSI handshaker to which the created handshaker client
- * belongs to.
+ *   belongs to.
  * - channel: grpc channel to ALTS handshaker service.
  * - handshaker_service_url: address of ALTS handshaker service in the format of
  *   "host:port".
@@ -132,8 +132,12 @@ void alts_handshaker_client_destroy(alts_handshaker_client* client);
  * - vtable_for_testing: ALTS handshaker client vtable instance used for
  *   testing purpose.
  * - is_client: a boolean value indicating if the created handshaker client is
- * used at the client (is_client = true) or server (is_client = false) side. It
- * returns the created ALTS handshaker client on success, and NULL on failure.
+ *   used at the client (is_client = true) or server (is_client = false) side.
+ * - max_frame_size: Maximum frame size used by frame protector (User specified
+ *   maximum frame size if present or default max frame size).
+ *
+ * It returns the created ALTS handshaker client on success, and NULL
+ * on failure.
  */
 alts_handshaker_client* alts_grpc_handshaker_client_create(
     alts_tsi_handshaker* handshaker, grpc_channel* channel,
@@ -141,7 +145,7 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
     grpc_alts_credentials_options* options, const grpc_slice& target_name,
     grpc_iomgr_cb_func grpc_cb, tsi_handshaker_on_next_done_cb cb,
     void* user_data, alts_handshaker_client_vtable* vtable_for_testing,
-    bool is_client);
+    bool is_client, size_t max_frame_size);
 
 /**
  * This method handles handshaker response returned from ALTS handshaker

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc

@@ -24,6 +24,8 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "upb/upb.hpp"
+
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
@@ -46,23 +48,25 @@ struct alts_tsi_handshaker {
   tsi_handshaker base;
   grpc_slice target_name;
   bool is_client;
-  bool has_sent_start_message;
-  bool has_created_handshaker_client;
+  bool has_sent_start_message = false;
+  bool has_created_handshaker_client = false;
   char* handshaker_service_url;
   grpc_pollset_set* interested_parties;
   grpc_alts_credentials_options* options;
-  alts_handshaker_client_vtable* client_vtable_for_testing;
-  grpc_channel* channel;
+  alts_handshaker_client_vtable* client_vtable_for_testing = nullptr;
+  grpc_channel* channel = nullptr;
   bool use_dedicated_cq;
   // mu synchronizes all fields below. Note these are the
   // only fields that can be concurrently accessed (due to
   // potential concurrency of tsi_handshaker_shutdown and
   // tsi_handshaker_next).
-  gpr_mu mu;
-  alts_handshaker_client* client;
+  grpc_core::Mutex mu;
+  alts_handshaker_client* client = nullptr;
   // shutdown effectively follows base.handshake_shutdown,
   // but is synchronized by the mutex of this object.
-  bool shutdown;
+  bool shutdown = false;
+  // Maximum frame size used by frame protector.
+  size_t max_frame_size;
 };
 
 /* Main struct for ALTS TSI handshaker result. */
@@ -75,6 +79,8 @@ typedef struct alts_tsi_handshaker_result {
   grpc_slice rpc_versions;
   bool is_client;
   grpc_slice serialized_context;
+  // Peer's maximum frame size.
+  size_t max_frame_size;
 } alts_tsi_handshaker_result;
 
 static tsi_result handshaker_result_extract_peer(
@@ -156,6 +162,26 @@ static tsi_result handshaker_result_create_zero_copy_grpc_protector(
   alts_tsi_handshaker_result* result =
       reinterpret_cast<alts_tsi_handshaker_result*>(
           const_cast<tsi_handshaker_result*>(self));
+
+  // In case the peer does not send max frame size (e.g. peer is gRPC Go or
+  // peer uses an old binary), the negotiated frame size is set to
+  // kTsiAltsMinFrameSize (ignoring max_output_protected_frame_size value if
+  // present). Otherwise, it is based on peer and user specified max frame
+  // size (if present).
+  size_t max_frame_size = kTsiAltsMinFrameSize;
+  if (result->max_frame_size) {
+    size_t peer_max_frame_size = result->max_frame_size;
+    max_frame_size = std::min<size_t>(peer_max_frame_size,
+                                      max_output_protected_frame_size == nullptr
+                                          ? kTsiAltsMaxFrameSize
+                                          : *max_output_protected_frame_size);
+    max_frame_size = std::max<size_t>(max_frame_size, kTsiAltsMinFrameSize);
+  }
+  max_output_protected_frame_size = &max_frame_size;
+  gpr_log(GPR_DEBUG,
+          "After Frame Size Negotiation, maximum frame size used by frame "
+          "protector equals %zu",
+          *max_output_protected_frame_size);
   tsi_result ok = alts_zero_copy_grpc_protector_create(
       reinterpret_cast<const uint8_t*>(result->key_data),
       kAltsAes128GcmRekeyKeyLength, /*is_rekey=*/true, result->is_client,
@@ -227,8 +253,8 @@ static const tsi_handshaker_result_vtable result_vtable = {
 
 tsi_result alts_tsi_handshaker_result_create(grpc_gcp_HandshakerResp* resp,
                                              bool is_client,
-                                             tsi_handshaker_result** self) {
-  if (self == nullptr || resp == nullptr) {
+                                             tsi_handshaker_result** result) {
+  if (result == nullptr || resp == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to create_handshaker_result()");
     return TSI_INVALID_ARGUMENT;
   }
@@ -279,18 +305,19 @@ tsi_result alts_tsi_handshaker_result_create(grpc_gcp_HandshakerResp* resp,
       grpc_gcp_Identity_service_account(local_identity);
   // We don't check if local service account is empty here
   // because local identity could be empty in certain situations.
-  alts_tsi_handshaker_result* result =
-      static_cast<alts_tsi_handshaker_result*>(gpr_zalloc(sizeof(*result)));
-  result->key_data =
+  alts_tsi_handshaker_result* sresult =
+      static_cast<alts_tsi_handshaker_result*>(gpr_zalloc(sizeof(*sresult)));
+  sresult->key_data =
       static_cast<char*>(gpr_zalloc(kAltsAes128GcmRekeyKeyLength));
-  memcpy(result->key_data, key_data.data, kAltsAes128GcmRekeyKeyLength);
-  result->peer_identity =
+  memcpy(sresult->key_data, key_data.data, kAltsAes128GcmRekeyKeyLength);
+  sresult->peer_identity =
       static_cast<char*>(gpr_zalloc(peer_service_account.size + 1));
-  memcpy(result->peer_identity, peer_service_account.data,
+  memcpy(sresult->peer_identity, peer_service_account.data,
          peer_service_account.size);
+  sresult->max_frame_size = grpc_gcp_HandshakerResult_max_frame_size(hresult);
   upb::Arena rpc_versions_arena;
   bool serialized = grpc_gcp_rpc_protocol_versions_encode(
-      peer_rpc_version, rpc_versions_arena.ptr(), &result->rpc_versions);
+      peer_rpc_version, rpc_versions_arena.ptr(), &sresult->rpc_versions);
   if (!serialized) {
     gpr_log(GPR_ERROR, "Failed to serialize peer's RPC protocol versions.");
     return TSI_FAILED_PRECONDITION;
@@ -307,6 +334,28 @@ tsi_result alts_tsi_handshaker_result_create(grpc_gcp_HandshakerResp* resp,
                                                  local_service_account);
   grpc_gcp_AltsContext_set_peer_rpc_versions(
       context, const_cast<grpc_gcp_RpcProtocolVersions*>(peer_rpc_version));
+  grpc_gcp_Identity* peer_identity = const_cast<grpc_gcp_Identity*>(identity);
+  if (peer_identity == nullptr) {
+    gpr_log(GPR_ERROR, "Null peer identity in ALTS context.");
+    return TSI_FAILED_PRECONDITION;
+  }
+  if (grpc_gcp_Identity_has_attributes(identity)) {
+    size_t iter = UPB_MAP_BEGIN;
+    grpc_gcp_Identity_AttributesEntry* peer_attributes_entry =
+        grpc_gcp_Identity_attributes_nextmutable(peer_identity, &iter);
+    while (peer_attributes_entry != nullptr) {
+      upb_strview key = grpc_gcp_Identity_AttributesEntry_key(
+          const_cast<grpc_gcp_Identity_AttributesEntry*>(
+              peer_attributes_entry));
+      upb_strview val = grpc_gcp_Identity_AttributesEntry_value(
+          const_cast<grpc_gcp_Identity_AttributesEntry*>(
+              peer_attributes_entry));
+      grpc_gcp_AltsContext_peer_attributes_set(context, key, val,
+                                               context_arena.ptr());
+      peer_attributes_entry =
+          grpc_gcp_Identity_attributes_nextmutable(peer_identity, &iter);
+    }
+  }
   size_t serialized_ctx_length;
   char* serialized_ctx = grpc_gcp_AltsContext_serialize(
       context, context_arena.ptr(), &serialized_ctx_length);
@@ -314,11 +363,11 @@ tsi_result alts_tsi_handshaker_result_create(grpc_gcp_HandshakerResp* resp,
     gpr_log(GPR_ERROR, "Failed to serialize peer's ALTS context.");
     return TSI_FAILED_PRECONDITION;
   }
-  result->serialized_context =
+  sresult->serialized_context =
       grpc_slice_from_copied_buffer(serialized_ctx, serialized_ctx_length);
-  result->is_client = is_client;
-  result->base.vtable = &result_vtable;
-  *self = &result->base;
+  sresult->is_client = is_client;
+  sresult->base.vtable = &result_vtable;
+  *result = &sresult->base;
   return TSI_OK;
 }
 
@@ -345,9 +394,10 @@ static void on_handshaker_service_resp_recv_dedicated(void* arg,
                                                       grpc_error* /*error*/) {
   alts_shared_resource_dedicated* resource =
       grpc_alts_get_shared_resource_dedicated();
-  grpc_cq_end_op(resource->cq, arg, GRPC_ERROR_NONE,
-                 [](void* /*done_arg*/, grpc_cq_completion* /*storage*/) {},
-                 nullptr, &resource->storage);
+  grpc_cq_end_op(
+      resource->cq, arg, GRPC_ERROR_NONE,
+      [](void* /*done_arg*/, grpc_cq_completion* /*storage*/) {}, nullptr,
+      &resource->storage);
 }
 
 /* Returns TSI_OK if and only if no error is encountered. */
@@ -374,7 +424,8 @@ static tsi_result alts_tsi_handshaker_continue_handshaker_next(
         handshaker, channel, handshaker->handshaker_service_url,
         handshaker->interested_parties, handshaker->options,
         handshaker->target_name, grpc_cb, cb, user_data,
-        handshaker->client_vtable_for_testing, handshaker->is_client);
+        handshaker->client_vtable_for_testing, handshaker->is_client,
+        handshaker->max_frame_size);
     if (client == nullptr) {
       gpr_log(GPR_ERROR, "Failed to create ALTS handshaker client");
       return TSI_FAILED_PRECONDITION;
@@ -541,8 +592,7 @@ static void handshaker_destroy(tsi_handshaker* self) {
     grpc_channel_destroy_internal(handshaker->channel);
   }
   gpr_free(handshaker->handshaker_service_url);
-  gpr_mu_destroy(&handshaker->mu);
-  gpr_free(handshaker);
+  delete handshaker;
 }
 
 static const tsi_handshaker_vtable handshaker_vtable = {
@@ -570,48 +620,48 @@ bool alts_tsi_handshaker_has_shutdown(alts_tsi_handshaker* handshaker) {
 tsi_result alts_tsi_handshaker_create(
     const grpc_alts_credentials_options* options, const char* target_name,
     const char* handshaker_service_url, bool is_client,
-    grpc_pollset_set* interested_parties, tsi_handshaker** self) {
+    grpc_pollset_set* interested_parties, tsi_handshaker** self,
+    size_t user_specified_max_frame_size) {
   if (handshaker_service_url == nullptr || self == nullptr ||
       options == nullptr || (is_client && target_name == nullptr)) {
     gpr_log(GPR_ERROR, "Invalid arguments to alts_tsi_handshaker_create()");
     return TSI_INVALID_ARGUMENT;
   }
-  alts_tsi_handshaker* handshaker =
-      static_cast<alts_tsi_handshaker*>(gpr_zalloc(sizeof(*handshaker)));
-  gpr_mu_init(&handshaker->mu);
-  handshaker->use_dedicated_cq = interested_parties == nullptr;
-  handshaker->client = nullptr;
-  handshaker->is_client = is_client;
-  handshaker->has_sent_start_message = false;
+  bool use_dedicated_cq = interested_parties == nullptr;
+  alts_tsi_handshaker* handshaker = new alts_tsi_handshaker();
+  memset(&handshaker->base, 0, sizeof(handshaker->base));
+  handshaker->base.vtable =
+      use_dedicated_cq ? &handshaker_vtable_dedicated : &handshaker_vtable;
   handshaker->target_name = target_name == nullptr
                                 ? grpc_empty_slice()
                                 : grpc_slice_from_static_string(target_name);
-  handshaker->interested_parties = interested_parties;
-  handshaker->has_created_handshaker_client = false;
+  handshaker->is_client = is_client;
   handshaker->handshaker_service_url = gpr_strdup(handshaker_service_url);
+  handshaker->interested_parties = interested_parties;
   handshaker->options = grpc_alts_credentials_options_copy(options);
-  handshaker->base.vtable = handshaker->use_dedicated_cq
-                                ? &handshaker_vtable_dedicated
-                                : &handshaker_vtable;
+  handshaker->use_dedicated_cq = use_dedicated_cq;
+  handshaker->max_frame_size = user_specified_max_frame_size != 0
+                                   ? user_specified_max_frame_size
+                                   : kTsiAltsMaxFrameSize;
   *self = &handshaker->base;
   return TSI_OK;
 }
 
-void alts_tsi_handshaker_result_set_unused_bytes(tsi_handshaker_result* self,
+void alts_tsi_handshaker_result_set_unused_bytes(tsi_handshaker_result* result,
                                                  grpc_slice* recv_bytes,
                                                  size_t bytes_consumed) {
-  GPR_ASSERT(recv_bytes != nullptr && self != nullptr);
+  GPR_ASSERT(recv_bytes != nullptr && result != nullptr);
   if (GRPC_SLICE_LENGTH(*recv_bytes) == bytes_consumed) {
     return;
   }
-  alts_tsi_handshaker_result* result =
-      reinterpret_cast<alts_tsi_handshaker_result*>(self);
-  result->unused_bytes_size = GRPC_SLICE_LENGTH(*recv_bytes) - bytes_consumed;
-  result->unused_bytes =
-      static_cast<unsigned char*>(gpr_zalloc(result->unused_bytes_size));
-  memcpy(result->unused_bytes,
+  alts_tsi_handshaker_result* sresult =
+      reinterpret_cast<alts_tsi_handshaker_result*>(result);
+  sresult->unused_bytes_size = GRPC_SLICE_LENGTH(*recv_bytes) - bytes_consumed;
+  sresult->unused_bytes =
+      static_cast<unsigned char*>(gpr_zalloc(sresult->unused_bytes_size));
+  memcpy(sresult->unused_bytes,
          GRPC_SLICE_START_PTR(*recv_bytes) + bytes_consumed,
-         result->unused_bytes_size);
+         sresult->unused_bytes_size);
 }
 
 namespace grpc_core {