grpc 1.41.0 → 1.43.1

data/src/core/tsi/fake_transport_security.cc

@@ -27,6 +27,7 @@
 #include <grpc/support/log.h>
 
 #include "src/core/lib/gpr/useful.h"
+#include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/tsi/transport_security_grpc.h"
 
@@ -416,8 +417,8 @@ static tsi_result fake_zero_copy_grpc_protector_protect(
   /* Protects each frame. */
   while (unprotected_slices->length > 0) {
     size_t frame_length =
-        GPR_MIN(impl->max_frame_size,
-                unprotected_slices->length + TSI_FAKE_FRAME_HEADER_SIZE);
+        std::min(impl->max_frame_size,
+                 unprotected_slices->length + TSI_FAKE_FRAME_HEADER_SIZE);
     grpc_slice slice = GRPC_SLICE_MALLOC(TSI_FAKE_FRAME_HEADER_SIZE);
     store32_little_endian(static_cast<uint32_t>(frame_length),
                           GRPC_SLICE_START_PTR(slice));
@@ -498,6 +499,7 @@ struct fake_handshaker_result {
   unsigned char* unused_bytes;
   size_t unused_bytes_size;
 };
+
 static tsi_result fake_handshaker_result_extract_peer(
     const tsi_handshaker_result* /*self*/, tsi_peer* peer) {
   /* Construct a tsi_peer with 1 property: certificate type, security_level. */
@@ -514,6 +516,13 @@ static tsi_result fake_handshaker_result_extract_peer(
   return result;
 }
 
+static tsi_result fake_handshaker_result_get_frame_protector_type(
+    const tsi_handshaker_result* /*self*/,
+    tsi_frame_protector_type* frame_protector_type) {
+  *frame_protector_type = TSI_FRAME_PROTECTOR_NORMAL_OR_ZERO_COPY;
+  return TSI_OK;
+}
+
 static tsi_result fake_handshaker_result_create_zero_copy_grpc_protector(
     const tsi_handshaker_result* /*self*/,
     size_t* max_output_protected_frame_size,
@@ -549,6 +558,7 @@ static void fake_handshaker_result_destroy(tsi_handshaker_result* self) {
 
 static const tsi_handshaker_result_vtable handshaker_result_vtable = {
     fake_handshaker_result_extract_peer,
+    fake_handshaker_result_get_frame_protector_type,
     fake_handshaker_result_create_zero_copy_grpc_protector,
     fake_handshaker_result_create_frame_protector,
     fake_handshaker_result_get_unused_bytes,
@@ -562,8 +572,7 @@ static tsi_result fake_handshaker_result_create(
       handshaker_result == nullptr) {
     return TSI_INVALID_ARGUMENT;
   }
-  fake_handshaker_result* result =
-      static_cast<fake_handshaker_result*>(gpr_zalloc(sizeof(*result)));
+  fake_handshaker_result* result = grpc_core::Zalloc<fake_handshaker_result>();
   result->base.vtable = &handshaker_result_vtable;
   if (unused_bytes_size > 0) {
     result->unused_bytes =
@@ -755,8 +764,7 @@ static const tsi_handshaker_vtable handshaker_vtable = {
 };
 
 tsi_handshaker* tsi_create_fake_handshaker(int is_client) {
-  tsi_fake_handshaker* impl =
-      static_cast<tsi_fake_handshaker*>(gpr_zalloc(sizeof(*impl)));
+  tsi_fake_handshaker* impl = grpc_core::Zalloc<tsi_fake_handshaker>();
   impl->base.vtable = &handshaker_vtable;
   impl->is_client = is_client;
   impl->result = TSI_HANDSHAKE_IN_PROGRESS;
@@ -777,7 +785,7 @@ tsi_handshaker* tsi_create_fake_handshaker(int is_client) {
 tsi_frame_protector* tsi_create_fake_frame_protector(
     size_t* max_protected_frame_size) {
   tsi_fake_frame_protector* impl =
-      static_cast<tsi_fake_frame_protector*>(gpr_zalloc(sizeof(*impl)));
+      grpc_core::Zalloc<tsi_fake_frame_protector>();
   impl->max_frame_size = (max_protected_frame_size == nullptr)
                              ? TSI_FAKE_DEFAULT_FRAME_SIZE
                              : *max_protected_frame_size;

data/src/core/tsi/local_transport_security.cc

@@ -42,6 +42,8 @@ typedef struct local_zero_copy_grpc_protector {
 typedef struct local_tsi_handshaker_result {
   tsi_handshaker_result base;
   bool is_client;
+  unsigned char* unused_bytes;
+  size_t unused_bytes_size;
 } local_tsi_handshaker_result;
 
 /* Main struct for local TSI handshaker. */
@@ -50,109 +52,70 @@ typedef struct local_tsi_handshaker {
   bool is_client;
 } local_tsi_handshaker;
 
-/* --- tsi_zero_copy_grpc_protector methods implementation. --- */
+/* --- tsi_handshaker_result methods implementation. --- */
 
-static tsi_result local_zero_copy_grpc_protector_protect(
-    tsi_zero_copy_grpc_protector* self, grpc_slice_buffer* unprotected_slices,
-    grpc_slice_buffer* protected_slices) {
-  if (self == nullptr || unprotected_slices == nullptr ||
-      protected_slices == nullptr) {
-    gpr_log(GPR_ERROR, "Invalid nullptr arguments to zero-copy grpc protect.");
-    return TSI_INVALID_ARGUMENT;
-  }
-  grpc_slice_buffer_move_into(unprotected_slices, protected_slices);
+tsi_result handshaker_result_extract_peer(const tsi_handshaker_result* /*self*/,
+                                          tsi_peer* /*peer*/) {
   return TSI_OK;
 }
 
-static tsi_result local_zero_copy_grpc_protector_unprotect(
-    tsi_zero_copy_grpc_protector* self, grpc_slice_buffer* protected_slices,
-    grpc_slice_buffer* unprotected_slices) {
-  if (self == nullptr || unprotected_slices == nullptr ||
-      protected_slices == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid nullptr arguments to zero-copy grpc unprotect.");
-    return TSI_INVALID_ARGUMENT;
-  }
-  grpc_slice_buffer_move_into(protected_slices, unprotected_slices);
+tsi_result handshaker_result_get_frame_protector_type(
+    const tsi_handshaker_result* /*self*/,
+    tsi_frame_protector_type* frame_protector_type) {
+  *frame_protector_type = TSI_FRAME_PROTECTOR_NONE;
   return TSI_OK;
 }
 
-static void local_zero_copy_grpc_protector_destroy(
-    tsi_zero_copy_grpc_protector* self) {
-  gpr_free(self);
-}
-
-static const tsi_zero_copy_grpc_protector_vtable
-    local_zero_copy_grpc_protector_vtable = {
-        local_zero_copy_grpc_protector_protect,
-        local_zero_copy_grpc_protector_unprotect,
-        local_zero_copy_grpc_protector_destroy,
-        nullptr /* local_zero_copy_grpc_protector_max_frame_size */};
-
-tsi_result local_zero_copy_grpc_protector_create(
-    tsi_zero_copy_grpc_protector** protector) {
-  if (grpc_core::ExecCtx::Get() == nullptr || protector == nullptr) {
-    gpr_log(
-        GPR_ERROR,
-        "Invalid nullptr arguments to local_zero_copy_grpc_protector create.");
+tsi_result handshaker_result_get_unused_bytes(const tsi_handshaker_result* self,
+                                              const unsigned char** bytes,
+                                              size_t* bytes_size) {
+  if (self == nullptr || bytes == nullptr || bytes_size == nullptr) {
+    gpr_log(GPR_ERROR, "Invalid arguments to get_unused_bytes()");
     return TSI_INVALID_ARGUMENT;
   }
-  local_zero_copy_grpc_protector* impl =
-      static_cast<local_zero_copy_grpc_protector*>(gpr_zalloc(sizeof(*impl)));
-  impl->base.vtable = &local_zero_copy_grpc_protector_vtable;
-  *protector = &impl->base;
+  auto* result = reinterpret_cast<local_tsi_handshaker_result*>(
+      const_cast<tsi_handshaker_result*>(self));
+  *bytes_size = result->unused_bytes_size;
+  *bytes = result->unused_bytes;
   return TSI_OK;
 }
 
-/* --- tsi_handshaker_result methods implementation. --- */
-
-static tsi_result handshaker_result_extract_peer(
-    const tsi_handshaker_result* /*self*/, tsi_peer* /*peer*/) {
-  return TSI_OK;
-}
-
-static tsi_result handshaker_result_create_zero_copy_grpc_protector(
-    const tsi_handshaker_result* self,
-    size_t* /*max_output_protected_frame_size*/,
-    tsi_zero_copy_grpc_protector** protector) {
-  if (self == nullptr || protector == nullptr) {
-    gpr_log(GPR_ERROR,
-            "Invalid arguments to create_zero_copy_grpc_protector()");
-    return TSI_INVALID_ARGUMENT;
-  }
-  tsi_result ok = local_zero_copy_grpc_protector_create(protector);
-  if (ok != TSI_OK) {
-    gpr_log(GPR_ERROR, "Failed to create zero-copy grpc protector");
-  }
-  return ok;
-}
-
-static void handshaker_result_destroy(tsi_handshaker_result* self) {
+void handshaker_result_destroy(tsi_handshaker_result* self) {
   if (self == nullptr) {
     return;
   }
   local_tsi_handshaker_result* result =
       reinterpret_cast<local_tsi_handshaker_result*>(
           const_cast<tsi_handshaker_result*>(self));
+  gpr_free(result->unused_bytes);
   gpr_free(result);
 }
 
-static const tsi_handshaker_result_vtable result_vtable = {
+const tsi_handshaker_result_vtable result_vtable = {
     handshaker_result_extract_peer,
-    handshaker_result_create_zero_copy_grpc_protector,
+    handshaker_result_get_frame_protector_type,
+    nullptr, /* handshaker_result_create_zero_copy_grpc_protector */
     nullptr, /* handshaker_result_create_frame_protector */
-    nullptr, /* handshaker_result_get_unused_bytes */
+    handshaker_result_get_unused_bytes,
     handshaker_result_destroy};
 
-static tsi_result create_handshaker_result(bool is_client,
-                                           tsi_handshaker_result** self) {
+tsi_result create_handshaker_result(bool is_client,
+                                    const unsigned char* received_bytes,
+                                    size_t received_bytes_size,
+                                    tsi_handshaker_result** self) {
   if (self == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to create_handshaker_result()");
     return TSI_INVALID_ARGUMENT;
   }
   local_tsi_handshaker_result* result =
-      static_cast<local_tsi_handshaker_result*>(gpr_zalloc(sizeof(*result)));
+      grpc_core::Zalloc<local_tsi_handshaker_result>();
   result->is_client = is_client;
+  if (received_bytes_size > 0) {
+    result->unused_bytes =
+        static_cast<unsigned char*>(gpr_malloc(received_bytes_size));
+    memcpy(result->unused_bytes, received_bytes, received_bytes_size);
+  }
+  result->unused_bytes_size = received_bytes_size;
   result->base.vtable = &result_vtable;
   *self = &result->base;
   return TSI_OK;
@@ -160,9 +123,9 @@ static tsi_result create_handshaker_result(bool is_client,
 
 /* --- tsi_handshaker methods implementation. --- */
 
-static tsi_result handshaker_next(
-    tsi_handshaker* self, const unsigned char* /*received_bytes*/,
-    size_t /*received_bytes_size*/, const unsigned char** /*bytes_to_send*/,
+tsi_result handshaker_next(
+    tsi_handshaker* self, const unsigned char* received_bytes,
+    size_t received_bytes_size, const unsigned char** /*bytes_to_send*/,
     size_t* bytes_to_send_size, tsi_handshaker_result** result,
     tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/) {
   if (self == nullptr) {
@@ -175,11 +138,12 @@ static tsi_result handshaker_next(
   local_tsi_handshaker* handshaker =
       reinterpret_cast<local_tsi_handshaker*>(self);
   *bytes_to_send_size = 0;
-  create_handshaker_result(handshaker->is_client, result);
+  create_handshaker_result(handshaker->is_client, received_bytes,
+                           received_bytes_size, result);
   return TSI_OK;
 }
 
-static void handshaker_destroy(tsi_handshaker* self) {
+void handshaker_destroy(tsi_handshaker* self) {
   if (self == nullptr) {
     return;
   }
@@ -188,7 +152,7 @@ static void handshaker_destroy(tsi_handshaker* self) {
   gpr_free(handshaker);
 }
 
-static const tsi_handshaker_vtable handshaker_vtable = {
+const tsi_handshaker_vtable handshaker_vtable = {
     nullptr, /* get_bytes_to_send_to_peer -- deprecated */
     nullptr, /* process_bytes_from_peer   -- deprecated */
     nullptr, /* get_result                -- deprecated */
@@ -206,8 +170,7 @@ tsi_result tsi_local_handshaker_create(bool is_client, tsi_handshaker** self) {
     gpr_log(GPR_ERROR, "Invalid arguments to local_tsi_handshaker_create()");
     return TSI_INVALID_ARGUMENT;
   }
-  local_tsi_handshaker* handshaker =
-      static_cast<local_tsi_handshaker*>(gpr_zalloc(sizeof(*handshaker)));
+  local_tsi_handshaker* handshaker = grpc_core::Zalloc<local_tsi_handshaker>();
   handshaker->is_client = is_client;
   handshaker->base.vtable = &handshaker_vtable;
   *self = &handshaker->base;

data/src/core/tsi/ssl/session_cache/ssl_session_cache.cc

@@ -29,41 +29,18 @@
 
 namespace tsi {
 
-static void cache_key_avl_destroy(void* /*key*/, void* /*unused*/) {}
-
-static void* cache_key_avl_copy(void* key, void* /*unused*/) { return key; }
-
-static long cache_key_avl_compare(void* key1, void* key2, void* /*unused*/) {
-  return grpc_slice_cmp(*static_cast<grpc_slice*>(key1),
-                        *static_cast<grpc_slice*>(key2));
-}
-
-static void cache_value_avl_destroy(void* /*value*/, void* /*unused*/) {}
-
-static void* cache_value_avl_copy(void* value, void* /*unused*/) {
-  return value;
-}
-
-// AVL only stores pointers, ownership belonges to the linked list.
-static const grpc_avl_vtable cache_avl_vtable = {
-    cache_key_avl_destroy,   cache_key_avl_copy,   cache_key_avl_compare,
-    cache_value_avl_destroy, cache_value_avl_copy,
-};
-
 /// Node for single cached session.
 class SslSessionLRUCache::Node {
  public:
-  Node(const grpc_slice& key, SslSessionPtr session) : key_(key) {
+  Node(const std::string& key, SslSessionPtr session) : key_(key) {
     SetSession(std::move(session));
   }
 
-  ~Node() { grpc_slice_unref_internal(key_); }
-
   // Not copyable nor movable.
   Node(const Node&) = delete;
   Node& operator=(const Node&) = delete;
 
-  void* AvlKey() { return &key_; }
+  const std::string& key() const { return key_; }
 
   /// Returns a copy of the node's cache session.
   SslSessionPtr CopySession() const { return session_->CopySession(); }
@@ -76,7 +53,7 @@ class SslSessionLRUCache::Node {
  private:
   friend class SslSessionLRUCache;
 
-  grpc_slice key_;
+  std::string key_;
   std::unique_ptr<SslCachedSession> session_;
 
   Node* next_ = nullptr;
@@ -85,7 +62,6 @@ class SslSessionLRUCache::Node {
 
 SslSessionLRUCache::SslSessionLRUCache(size_t capacity) : capacity_(capacity) {
   GPR_ASSERT(capacity > 0);
-  entry_by_key_ = grpc_avl_create(&cache_avl_vtable);
 }
 
 SslSessionLRUCache::~SslSessionLRUCache() {
@@ -95,7 +71,6 @@ SslSessionLRUCache::~SslSessionLRUCache() {
     delete node;
     node = next;
   }
-  grpc_avl_unref(entry_by_key_, nullptr);
 }
 
 size_t SslSessionLRUCache::Size() {
@@ -104,13 +79,12 @@ size_t SslSessionLRUCache::Size() {
 }
 
 SslSessionLRUCache::Node* SslSessionLRUCache::FindLocked(
-    const grpc_slice& key) {
-  void* value =
-      grpc_avl_get(entry_by_key_, const_cast<grpc_slice*>(&key), nullptr);
-  if (value == nullptr) {
+    const std::string& key) {
+  auto it = entry_by_key_.find(key);
+  if (it == entry_by_key_.end()) {
     return nullptr;
   }
-  Node* node = static_cast<Node*>(value);
+  Node* node = it->second;
   // Move to the beginning.
   Remove(node);
   PushFront(node);
@@ -120,22 +94,21 @@ SslSessionLRUCache::Node* SslSessionLRUCache::FindLocked(
 
 void SslSessionLRUCache::Put(const char* key, SslSessionPtr session) {
   grpc_core::MutexLock lock(&lock_);
-  Node* node = FindLocked(grpc_slice_from_static_string(key));
+  Node* node = FindLocked(key);
   if (node != nullptr) {
     node->SetSession(std::move(session));
     return;
   }
-  grpc_slice key_slice = grpc_slice_from_copied_string(key);
-  node = new Node(key_slice, std::move(session));
+  node = new Node(key, std::move(session));
   PushFront(node);
-  entry_by_key_ = grpc_avl_add(entry_by_key_, node->AvlKey(), node, nullptr);
+  entry_by_key_.emplace(key, node);
   AssertInvariants();
   if (use_order_list_size_ > capacity_) {
     GPR_ASSERT(use_order_list_tail_);
     node = use_order_list_tail_;
     Remove(node);
     // Order matters, key is destroyed after deleting node.
-    entry_by_key_ = grpc_avl_remove(entry_by_key_, node->AvlKey(), nullptr);
+    entry_by_key_.erase(node->key());
     delete node;
     AssertInvariants();
   }
@@ -144,8 +117,7 @@ void SslSessionLRUCache::Put(const char* key, SslSessionPtr session) {
 SslSessionPtr SslSessionLRUCache::Get(const char* key) {
   grpc_core::MutexLock lock(&lock_);
   // Key is only used for lookups.
-  grpc_slice key_slice = grpc_slice_from_static_string(key);
-  Node* node = FindLocked(key_slice);
+  Node* node = FindLocked(key);
   if (node == nullptr) {
     return nullptr;
   }
@@ -183,13 +155,6 @@ void SslSessionLRUCache::PushFront(SslSessionLRUCache::Node* node) {
 }
 
 #ifndef NDEBUG
-static size_t calculate_tree_size(grpc_avl_node* node) {
-  if (node == nullptr) {
-    return 0;
-  }
-  return 1 + calculate_tree_size(node->left) + calculate_tree_size(node->right);
-}
-
 void SslSessionLRUCache::AssertInvariants() {
   size_t size = 0;
   Node* prev = nullptr;
@@ -197,14 +162,15 @@ void SslSessionLRUCache::AssertInvariants() {
   while (current != nullptr) {
     size++;
     GPR_ASSERT(current->prev_ == prev);
-    void* node = grpc_avl_get(entry_by_key_, current->AvlKey(), nullptr);
-    GPR_ASSERT(node == current);
+    auto it = entry_by_key_.find(current->key());
+    GPR_ASSERT(it != entry_by_key_.end());
+    GPR_ASSERT(it->second == current);
     prev = current;
     current = current->next_;
   }
   GPR_ASSERT(prev == use_order_list_tail_);
   GPR_ASSERT(size == use_order_list_size_);
-  GPR_ASSERT(calculate_tree_size(entry_by_key_.root) == use_order_list_size_);
+  GPR_ASSERT(entry_by_key_.size() == use_order_list_size_);
 }
 #else
 void SslSessionLRUCache::AssertInvariants() {}

data/src/core/tsi/ssl/session_cache/ssl_session_cache.h

@@ -28,7 +28,8 @@ extern "C" {
 #include <openssl/ssl.h>
 }
 
-#include "src/core/lib/avl/avl.h"
+#include <map>
+
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/sync.h"
@@ -72,7 +73,7 @@ class SslSessionLRUCache : public grpc_core::RefCounted<SslSessionLRUCache> {
  private:
   class Node;
 
-  Node* FindLocked(const grpc_slice& key);
+  Node* FindLocked(const std::string& key);
   void Remove(Node* node);
   void PushFront(Node* node);
   void AssertInvariants();
@@ -83,7 +84,7 @@ class SslSessionLRUCache : public grpc_core::RefCounted<SslSessionLRUCache> {
   Node* use_order_list_head_ = nullptr;
   Node* use_order_list_tail_ = nullptr;
   size_t use_order_list_size_ = 0;
-  grpc_avl entry_by_key_;
+  std::map<std::string, Node*> entry_by_key_;
 };
 
 }  // namespace tsi

data/src/core/tsi/ssl_transport_security.cc

@@ -323,6 +323,30 @@ static tsi_result peer_property_from_x509_common_name(
   return result;
 }
 
+/* Gets the subject of an X509 cert as a tsi_peer_property. */
+static tsi_result peer_property_from_x509_subject(X509* cert,
+                                                  tsi_peer_property* property) {
+  X509_NAME* subject_name = X509_get_subject_name(cert);
+  if (subject_name == nullptr) {
+    gpr_log(GPR_INFO, "Could not get subject name from certificate.");
+    return TSI_NOT_FOUND;
+  }
+  BIO* bio = BIO_new(BIO_s_mem());
+  X509_NAME_print_ex(bio, subject_name, 0, XN_FLAG_RFC2253);
+  char* contents;
+  long len = BIO_get_mem_data(bio, &contents);
+  if (len < 0) {
+    gpr_log(GPR_ERROR, "Could not get subject entry from certificate.");
+    BIO_free(bio);
+    return TSI_INTERNAL_ERROR;
+  }
+  tsi_result result = tsi_construct_string_peer_property(
+      TSI_X509_SUBJECT_PEER_PROPERTY, contents, static_cast<size_t>(len),
+      property);
+  BIO_free(bio);
+  return result;
+}
+
 /* Gets the X509 cert in PEM format as a tsi_peer_property. */
 static tsi_result add_pem_certificate(X509* cert, tsi_peer_property* property) {
   BIO* bio = BIO_new(BIO_s_mem());
@@ -439,7 +463,7 @@ static tsi_result peer_from_x509(X509* cert, int include_certificate_type,
   tsi_result result;
   GPR_ASSERT(subject_alt_name_count >= 0);
   property_count = (include_certificate_type ? static_cast<size_t>(1) : 0) +
-                   2 /* common name, certificate */ +
+                   3 /* subject, common name, certificate */ +
                    static_cast<size_t>(subject_alt_name_count);
   for (int i = 0; i < subject_alt_name_count; i++) {
     GENERAL_NAME* subject_alt_name =
@@ -465,6 +489,11 @@ static tsi_result peer_from_x509(X509* cert, int include_certificate_type,
           &peer->properties[current_insert_index++]);
       if (result != TSI_OK) break;
     }
+
+    result = peer_property_from_x509_subject(
+        cert, &peer->properties[current_insert_index++]);
+    if (result != TSI_OK) break;
+
     result = peer_property_from_x509_common_name(
         cert, &peer->properties[current_insert_index++]);
     if (result != TSI_OK) break;
@@ -1302,6 +1331,13 @@ static tsi_result ssl_handshaker_result_extract_peer(
   return result;
 }
 
+static tsi_result ssl_handshaker_result_get_frame_protector_type(
+    const tsi_handshaker_result* /*self*/,
+    tsi_frame_protector_type* frame_protector_type) {
+  *frame_protector_type = TSI_FRAME_PROTECTOR_NORMAL;
+  return TSI_OK;
+}
+
 static tsi_result ssl_handshaker_result_create_frame_protector(
     const tsi_handshaker_result* self, size_t* max_output_protected_frame_size,
     tsi_frame_protector** protector) {
@@ -1368,6 +1404,7 @@ static void ssl_handshaker_result_destroy(tsi_handshaker_result* self) {
 
 static const tsi_handshaker_result_vtable handshaker_result_vtable = {
     ssl_handshaker_result_extract_peer,
+    ssl_handshaker_result_get_frame_protector_type,
     nullptr, /* create_zero_copy_grpc_protector */
     ssl_handshaker_result_create_frame_protector,
     ssl_handshaker_result_get_unused_bytes,
@@ -1382,7 +1419,7 @@ static tsi_result ssl_handshaker_result_create(
     return TSI_INVALID_ARGUMENT;
   }
   tsi_ssl_handshaker_result* result =
-      static_cast<tsi_ssl_handshaker_result*>(gpr_zalloc(sizeof(*result)));
+      grpc_core::Zalloc<tsi_ssl_handshaker_result>();
   result->base.vtable = &handshaker_result_vtable;
   /* Transfer ownership of ssl and network_io to the handshaker result. */
   result->ssl = handshaker->ssl;
@@ -1661,7 +1698,7 @@ static tsi_result create_tsi_ssl_handshaker(SSL_CTX* ctx, int is_client,
     SSL_set_accept_state(ssl);
   }
 
-  impl = static_cast<tsi_ssl_handshaker*>(gpr_zalloc(sizeof(*impl)));
+  impl = grpc_core::Zalloc<tsi_ssl_handshaker>();
   impl->ssl = ssl;
   impl->network_io = network_io;
   impl->result = TSI_HANDSHAKE_IN_PROGRESS;

data/src/core/tsi/ssl_transport_security.h

@@ -35,6 +35,7 @@ extern "C" {
 #define TSI_X509_CERTIFICATE_TYPE "X509"
 
 /* This property is of type TSI_PEER_PROPERTY_STRING.  */
+#define TSI_X509_SUBJECT_PEER_PROPERTY "x509_subject"
 #define TSI_X509_SUBJECT_COMMON_NAME_PEER_PROPERTY "x509_subject_common_name"
 #define TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY \
   "x509_subject_alternative_name"

data/src/core/tsi/transport_security.cc

@@ -251,6 +251,18 @@ tsi_result tsi_handshaker_result_extract_peer(const tsi_handshaker_result* self,
   return self->vtable->extract_peer(self, peer);
 }
 
+tsi_result tsi_handshaker_result_get_frame_protector_type(
+    const tsi_handshaker_result* self,
+    tsi_frame_protector_type* frame_protector_type) {
+  if (self == nullptr || frame_protector_type == nullptr) {
+    return TSI_INVALID_ARGUMENT;
+  }
+  if (self->vtable->get_frame_protector_type == nullptr) {
+    return TSI_UNIMPLEMENTED;
+  }
+  return self->vtable->get_frame_protector_type(self, frame_protector_type);
+}
+
 tsi_result tsi_handshaker_result_create_frame_protector(
     const tsi_handshaker_result* self, size_t* max_output_protected_frame_size,
     tsi_frame_protector** protector) {

data/src/core/tsi/transport_security.h

@@ -29,7 +29,8 @@
 extern grpc_core::TraceFlag tsi_tracing_enabled;
 
 /* Base for tsi_frame_protector implementations.
-   See transport_security_interface.h for documentation. */
+   See transport_security_interface.h for documentation.
+   All methods must be implemented. */
 struct tsi_frame_protector_vtable {
   tsi_result (*protect)(tsi_frame_protector* self,
                         const unsigned char* unprotected_bytes,
@@ -54,6 +55,9 @@ struct tsi_frame_protector {
 /* Base for tsi_handshaker implementations.
    See transport_security_interface.h for documentation. */
 struct tsi_handshaker_vtable {
+  /* Methods for supporting the old synchronous API.
+     These can be null if the TSI impl supports only the new
+     async-capable API. */
   tsi_result (*get_bytes_to_send_to_peer)(tsi_handshaker* self,
                                           unsigned char* bytes,
                                           size_t* bytes_size);
@@ -65,7 +69,10 @@ struct tsi_handshaker_vtable {
   tsi_result (*create_frame_protector)(tsi_handshaker* self,
                                        size_t* max_protected_frame_size,
                                        tsi_frame_protector** protector);
+  /* Must be implemented by all TSI impls. */
   void (*destroy)(tsi_handshaker* self);
+  /* Methods for supporting the new async-capable API.
+     These can be null if the TSI impl supports only the old sync API. */
   tsi_result (*next)(tsi_handshaker* self, const unsigned char* received_bytes,
                      size_t received_bytes_size,
                      const unsigned char** bytes_to_send,
@@ -88,13 +95,21 @@ struct tsi_handshaker {
    API depend on grpc. The create_zero_copy_grpc_protector() method is only used
    in grpc, where we do need the exec_ctx passed through, but the API still
    needs to compile in other applications, where grpc_exec_ctx is not defined.
+   All methods must be non-null, except where noted below.
 */
 struct tsi_handshaker_result_vtable {
   tsi_result (*extract_peer)(const tsi_handshaker_result* self, tsi_peer* peer);
+  tsi_result (*get_frame_protector_type)(
+      const tsi_handshaker_result* self,
+      tsi_frame_protector_type* frame_protector_type);
+  /* May be null if get_frame_protector_type() returns
+     TSI_FRAME_PROTECTOR_NORMAL or TSI_FRAME_PROTECTOR_NONE. */
   tsi_result (*create_zero_copy_grpc_protector)(
       const tsi_handshaker_result* self,
       size_t* max_output_protected_frame_size,
       tsi_zero_copy_grpc_protector** protector);
+  /* May be null if get_frame_protector_type() returns
+     TSI_FRAME_PROTECTOR_ZERO_COPY or TSI_FRAME_PROTECTOR_NONE. */
   tsi_result (*create_frame_protector)(const tsi_handshaker_result* self,
                                        size_t* max_output_protected_frame_size,
                                        tsi_frame_protector** protector);

data/src/core/tsi/transport_security_interface.h

@@ -64,6 +64,26 @@ typedef enum {
   TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY,
 } tsi_client_certificate_request_type;
 
+typedef enum {
+  // TSI implementation provides a normal frame protector.  The caller
+  // should invoke tsi_handshaker_result_create_frame_protector() to
+  // generate the frame protector.
+  TSI_FRAME_PROTECTOR_NORMAL,
+  // TSI implementation provides a zero-copy frame protector.  The caller
+  // should invoke tsi_handshaker_result_create_zero_copy_grpc_protector()
+  // to generate the frame protector.
+  TSI_FRAME_PROTECTOR_ZERO_COPY,
+  // TSI implementation provides both normal and zero-copy frame protectors.
+  // The caller should invoke either
+  // tsi_handshaker_result_create_frame_protector() or
+  // tsi_handshaker_result_create_zero_copy_grpc_protector() to generate
+  // the frame protector.
+  TSI_FRAME_PROTECTOR_NORMAL_OR_ZERO_COPY,
+  // TSI implementation does not provide any frame protector.  This means
+  // that it is safe for the caller to send bytes unprotected on the wire.
+  TSI_FRAME_PROTECTOR_NONE,
+} tsi_frame_protector_type;
+
 typedef enum {
   TSI_TLS1_2,
   TSI_TLS1_3,
@@ -234,6 +254,12 @@ typedef struct tsi_handshaker_result tsi_handshaker_result;
 tsi_result tsi_handshaker_result_extract_peer(const tsi_handshaker_result* self,
                                               tsi_peer* peer);
 
+/* This method indicates what type of frame protector is provided by the
+   TSI implementation. */
+tsi_result tsi_handshaker_result_get_frame_protector_type(
+    const tsi_handshaker_result* self,
+    tsi_frame_protector_type* frame_protector_type);
+
 /* This method creates a tsi_frame_protector object. It returns TSI_OK assuming
    there is no fatal error.
    The caller is responsible for destroying the protector.  */