grpc 1.42.0 → 1.51.0

data/src/core/tsi/fake_transport_security.cc

@@ -96,7 +96,8 @@ static const char* tsi_fake_handshake_message_to_string(int msg) {
 }
 
 static tsi_result tsi_fake_handshake_message_from_string(
-    const char* msg_string, tsi_fake_handshake_message* msg) {
+    const char* msg_string, tsi_fake_handshake_message* msg,
+    std::string* error) {
   for (int i = 0; i < TSI_FAKE_HANDSHAKE_MESSAGE_MAX; i++) {
     if (strncmp(msg_string, tsi_fake_handshake_message_strings[i],
                 strlen(tsi_fake_handshake_message_strings[i])) == 0) {
@@ -105,6 +106,7 @@ static tsi_result tsi_fake_handshake_message_from_string(
     }
   }
   gpr_log(GPR_ERROR, "Invalid handshake message.");
+  if (error != nullptr) *error = "invalid handshake message";
   return TSI_DATA_CORRUPTED;
 }
 
@@ -143,6 +145,11 @@ static uint32_t read_frame_size(const grpc_slice_buffer* sb) {
   return load32_little_endian(frame_size_buffer);
 }
 
+uint32_t tsi_fake_zero_copy_grpc_protector_next_frame_size(
+    const grpc_slice_buffer* protected_slices) {
+  return read_frame_size(protected_slices);
+}
+
 static void tsi_fake_frame_reset(tsi_fake_frame* frame, int needs_draining) {
   frame->offset = 0;
   frame->needs_draining = needs_draining;
@@ -169,12 +176,16 @@ static void tsi_fake_frame_ensure_size(tsi_fake_frame* frame) {
  * This method should not be called if frame->needs_framing is not 0.  */
 static tsi_result tsi_fake_frame_decode(const unsigned char* incoming_bytes,
                                         size_t* incoming_bytes_size,
-                                        tsi_fake_frame* frame) {
+                                        tsi_fake_frame* frame,
+                                        std::string* error) {
   size_t available_size = *incoming_bytes_size;
   size_t to_read_size = 0;
   const unsigned char* bytes_cursor = incoming_bytes;
 
-  if (frame->needs_draining) return TSI_INTERNAL_ERROR;
+  if (frame->needs_draining) {
+    if (error != nullptr) *error = "fake handshaker frame needs draining";
+    return TSI_INTERNAL_ERROR;
+  }
   if (frame->data == nullptr) {
     frame->allocated_size = TSI_FAKE_FRAME_INITIAL_ALLOCATED_SIZE;
     frame->data =
@@ -219,9 +230,13 @@ static tsi_result tsi_fake_frame_decode(const unsigned char* incoming_bytes,
  * This method should not be called if frame->needs_framing is 0.  */
 static tsi_result tsi_fake_frame_encode(unsigned char* outgoing_bytes,
                                         size_t* outgoing_bytes_size,
-                                        tsi_fake_frame* frame) {
+                                        tsi_fake_frame* frame,
+                                        std::string* error) {
   size_t to_write_size = frame->size - frame->offset;
-  if (!frame->needs_draining) return TSI_INTERNAL_ERROR;
+  if (!frame->needs_draining) {
+    if (error != nullptr) *error = "fake frame needs draining";
+    return TSI_INTERNAL_ERROR;
+  }
   if (*outgoing_bytes_size < to_write_size) {
     memcpy(outgoing_bytes, frame->data + frame->offset, *outgoing_bytes_size);
     frame->offset += *outgoing_bytes_size;
@@ -235,15 +250,14 @@ static tsi_result tsi_fake_frame_encode(unsigned char* outgoing_bytes,
 
 /* Sets the payload of a fake frame to contain the given data blob, where
  * data_size indicates the size of data. */
-static tsi_result tsi_fake_frame_set_data(unsigned char* data, size_t data_size,
-                                          tsi_fake_frame* frame) {
+static void tsi_fake_frame_set_data(unsigned char* data, size_t data_size,
+                                    tsi_fake_frame* frame) {
   frame->offset = 0;
   frame->size = data_size + TSI_FAKE_FRAME_HEADER_SIZE;
   tsi_fake_frame_ensure_size(frame);
   store32_little_endian(static_cast<uint32_t>(frame->size), frame->data);
   memcpy(frame->data + TSI_FAKE_FRAME_HEADER_SIZE, data, data_size);
   tsi_fake_frame_reset(frame, 1 /* needs draining */);
-  return TSI_OK;
 }
 
 /* Destroys the contents of a fake frame. */
@@ -271,8 +285,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
   /* Try to drain first. */
   if (frame->needs_draining) {
     drained_size = saved_output_size - *num_bytes_written;
-    result =
-        tsi_fake_frame_encode(protected_output_frames, &drained_size, frame);
+    result = tsi_fake_frame_encode(protected_output_frames, &drained_size,
+                                   frame, /*error=*/nullptr);
     *num_bytes_written += drained_size;
     protected_output_frames += drained_size;
     if (result != TSI_OK) {
@@ -292,7 +306,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
     store32_little_endian(static_cast<uint32_t>(impl->max_frame_size),
                           frame_header);
     written_in_frame_size = TSI_FAKE_FRAME_HEADER_SIZE;
-    result = tsi_fake_frame_decode(frame_header, &written_in_frame_size, frame);
+    result = tsi_fake_frame_decode(frame_header, &written_in_frame_size, frame,
+                                   /*error=*/nullptr);
     if (result != TSI_INCOMPLETE_DATA) {
       gpr_log(GPR_ERROR, "tsi_fake_frame_decode returned %s",
               tsi_result_to_string(result));
@@ -300,7 +315,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
     }
   }
   result =
-      tsi_fake_frame_decode(unprotected_bytes, unprotected_bytes_size, frame);
+      tsi_fake_frame_decode(unprotected_bytes, unprotected_bytes_size, frame,
+                            /*error=*/nullptr);
   if (result != TSI_OK) {
     if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
     return result;
@@ -310,7 +326,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
   if (!frame->needs_draining) return TSI_INTERNAL_ERROR;
   if (frame->offset != 0) return TSI_INTERNAL_ERROR;
   drained_size = saved_output_size - *num_bytes_written;
-  result = tsi_fake_frame_encode(protected_output_frames, &drained_size, frame);
+  result = tsi_fake_frame_encode(protected_output_frames, &drained_size, frame,
+                                 /*error=*/nullptr);
   *num_bytes_written += drained_size;
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   return result;
@@ -332,7 +349,8 @@ static tsi_result fake_protector_protect_flush(
                           frame->data); /* Overwrite header. */
   }
   result = tsi_fake_frame_encode(protected_output_frames,
-                                 protected_output_frames_size, frame);
+                                 protected_output_frames_size, frame,
+                                 /*error=*/nullptr);
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   *still_pending_size = frame->size - frame->offset;
   return result;
@@ -356,7 +374,8 @@ static tsi_result fake_protector_unprotect(
     /* Go past the header if needed. */
     if (frame->offset == 0) frame->offset = TSI_FAKE_FRAME_HEADER_SIZE;
     drained_size = saved_output_size - *num_bytes_written;
-    result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame);
+    result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame,
+                                   /*error=*/nullptr);
     unprotected_bytes += drained_size;
     *num_bytes_written += drained_size;
     if (result != TSI_OK) {
@@ -371,7 +390,8 @@ static tsi_result fake_protector_unprotect(
   /* Now process the protected_bytes. */
   if (frame->needs_draining) return TSI_INTERNAL_ERROR;
   result = tsi_fake_frame_decode(protected_frames_bytes,
-                                 protected_frames_bytes_size, frame);
+                                 protected_frames_bytes_size, frame,
+                                 /*error=*/nullptr);
   if (result != TSI_OK) {
     if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
     return result;
@@ -382,7 +402,8 @@ static tsi_result fake_protector_unprotect(
   if (frame->offset != 0) return TSI_INTERNAL_ERROR;
   frame->offset = TSI_FAKE_FRAME_HEADER_SIZE; /* Go past the header. */
   drained_size = saved_output_size - *num_bytes_written;
-  result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame);
+  result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame,
+                                 /*error=*/nullptr);
   *num_bytes_written += drained_size;
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   return result;
@@ -432,7 +453,7 @@ static tsi_result fake_zero_copy_grpc_protector_protect(
 
 static tsi_result fake_zero_copy_grpc_protector_unprotect(
     tsi_zero_copy_grpc_protector* self, grpc_slice_buffer* protected_slices,
-    grpc_slice_buffer* unprotected_slices) {
+    grpc_slice_buffer* unprotected_slices, int* min_progress_size) {
   if (self == nullptr || unprotected_slices == nullptr ||
       protected_slices == nullptr) {
     return TSI_INVALID_ARGUMENT;
@@ -460,7 +481,14 @@ static tsi_result fake_zero_copy_grpc_protector_unprotect(
         impl->parsed_frame_size - TSI_FAKE_FRAME_HEADER_SIZE,
         unprotected_slices);
     impl->parsed_frame_size = 0;
-    grpc_slice_buffer_reset_and_unref_internal(&impl->header_sb);
+    grpc_slice_buffer_reset_and_unref(&impl->header_sb);
+  }
+  if (min_progress_size != nullptr) {
+    if (impl->parsed_frame_size > TSI_FAKE_FRAME_HEADER_SIZE) {
+      *min_progress_size = impl->parsed_frame_size - impl->protected_sb.length;
+    } else {
+      *min_progress_size = 1;
+    }
   }
   return TSI_OK;
 }
@@ -470,8 +498,8 @@ static void fake_zero_copy_grpc_protector_destroy(
   if (self == nullptr) return;
   tsi_fake_zero_copy_grpc_protector* impl =
       reinterpret_cast<tsi_fake_zero_copy_grpc_protector*>(self);
-  grpc_slice_buffer_destroy_internal(&impl->header_sb);
-  grpc_slice_buffer_destroy_internal(&impl->protected_sb);
+  grpc_slice_buffer_destroy(&impl->header_sb);
+  grpc_slice_buffer_destroy(&impl->protected_sb);
   gpr_free(impl);
 }
 
@@ -567,9 +595,10 @@ static const tsi_handshaker_result_vtable handshaker_result_vtable = {
 
 static tsi_result fake_handshaker_result_create(
     const unsigned char* unused_bytes, size_t unused_bytes_size,
-    tsi_handshaker_result** handshaker_result) {
+    tsi_handshaker_result** handshaker_result, std::string* error) {
   if ((unused_bytes_size > 0 && unused_bytes == nullptr) ||
       handshaker_result == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   fake_handshaker_result* result = grpc_core::Zalloc<fake_handshaker_result>();
@@ -587,7 +616,8 @@ static tsi_result fake_handshaker_result_create(
 /* --- tsi_handshaker methods implementation. ---*/
 
 static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
-    tsi_handshaker* self, unsigned char* bytes, size_t* bytes_size) {
+    tsi_handshaker* self, unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   tsi_fake_handshaker* impl = reinterpret_cast<tsi_fake_handshaker*>(self);
   tsi_result result = TSI_OK;
   if (impl->needs_incoming_message || impl->result == TSI_OK) {
@@ -600,10 +630,9 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
         static_cast<tsi_fake_handshake_message>(impl->next_message_to_send + 2);
     const char* msg_string =
         tsi_fake_handshake_message_to_string(impl->next_message_to_send);
-    result = tsi_fake_frame_set_data(
+    tsi_fake_frame_set_data(
         reinterpret_cast<unsigned char*>(const_cast<char*>(msg_string)),
         strlen(msg_string), &impl->outgoing_frame);
-    if (result != TSI_OK) return result;
     if (next_message_to_send > TSI_FAKE_HANDSHAKE_MESSAGE_MAX) {
       next_message_to_send = TSI_FAKE_HANDSHAKE_MESSAGE_MAX;
     }
@@ -614,7 +643,8 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
     }
     impl->next_message_to_send = next_message_to_send;
   }
-  result = tsi_fake_frame_encode(bytes, bytes_size, &impl->outgoing_frame);
+  result =
+      tsi_fake_frame_encode(bytes, bytes_size, &impl->outgoing_frame, error);
   if (result != TSI_OK) return result;
   if (!impl->is_client &&
       impl->next_message_to_send == TSI_FAKE_HANDSHAKE_MESSAGE_MAX) {
@@ -630,7 +660,8 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
 }
 
 static tsi_result fake_handshaker_process_bytes_from_peer(
-    tsi_handshaker* self, const unsigned char* bytes, size_t* bytes_size) {
+    tsi_handshaker* self, const unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   tsi_result result = TSI_OK;
   tsi_fake_handshaker* impl = reinterpret_cast<tsi_fake_handshaker*>(self);
   tsi_fake_handshake_message expected_msg =
@@ -641,14 +672,15 @@ static tsi_result fake_handshaker_process_bytes_from_peer(
     *bytes_size = 0;
     return TSI_OK;
   }
-  result = tsi_fake_frame_decode(bytes, bytes_size, &impl->incoming_frame);
+  result =
+      tsi_fake_frame_decode(bytes, bytes_size, &impl->incoming_frame, error);
   if (result != TSI_OK) return result;
 
   /* We now have a complete frame. */
   result = tsi_fake_handshake_message_from_string(
       reinterpret_cast<const char*>(impl->incoming_frame.data) +
           TSI_FAKE_FRAME_HEADER_SIZE,
-      &received_msg);
+      &received_msg, error);
   if (result != TSI_OK) {
     impl->result = result;
     return result;
@@ -691,11 +723,13 @@ static tsi_result fake_handshaker_next(
     tsi_handshaker* self, const unsigned char* received_bytes,
     size_t received_bytes_size, const unsigned char** bytes_to_send,
     size_t* bytes_to_send_size, tsi_handshaker_result** handshaker_result,
-    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/) {
+    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/,
+    std::string* error) {
   /* Sanity check the arguments. */
   if ((received_bytes_size > 0 && received_bytes == nullptr) ||
       bytes_to_send == nullptr || bytes_to_send_size == nullptr ||
       handshaker_result == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   tsi_fake_handshaker* handshaker =
@@ -705,8 +739,8 @@ static tsi_result fake_handshaker_next(
   /* Decode and process a handshake frame from the peer. */
   size_t consumed_bytes_size = received_bytes_size;
   if (received_bytes_size > 0) {
-    result = fake_handshaker_process_bytes_from_peer(self, received_bytes,
-                                                     &consumed_bytes_size);
+    result = fake_handshaker_process_bytes_from_peer(
+        self, received_bytes, &consumed_bytes_size, error);
     if (result != TSI_OK) return result;
   }
 
@@ -716,7 +750,8 @@ static tsi_result fake_handshaker_next(
   do {
     size_t sent_bytes_size = handshaker->outgoing_bytes_buffer_size - offset;
     result = fake_handshaker_get_bytes_to_send_to_peer(
-        self, handshaker->outgoing_bytes_buffer + offset, &sent_bytes_size);
+        self, handshaker->outgoing_bytes_buffer + offset, &sent_bytes_size,
+        error);
     offset += sent_bytes_size;
     if (result == TSI_INCOMPLETE_DATA) {
       handshaker->outgoing_bytes_buffer_size *= 2;
@@ -742,7 +777,7 @@ static tsi_result fake_handshaker_next(
 
     /* Create a handshaker_result containing the unused bytes. */
     result = fake_handshaker_result_create(unused_bytes, unused_bytes_size,
-                                           handshaker_result);
+                                           handshaker_result, error);
     if (result == TSI_OK) {
       /* Indicate that the handshake has completed and that a handshaker_result
        * has been created. */

data/src/core/tsi/fake_transport_security.h

@@ -21,6 +21,7 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/lib/slice/slice_internal.h"
 #include "src/core/tsi/transport_security_interface.h"
 
 /* Value for the TSI_CERTIFICATE_TYPE_PEER_PROPERTY property for FAKE certs. */
@@ -44,4 +45,9 @@ tsi_frame_protector* tsi_create_fake_frame_protector(
 tsi_zero_copy_grpc_protector* tsi_create_fake_zero_copy_grpc_protector(
     size_t* max_protected_frame_size);
 
+/* Given a buffer containing slices encrypted by a fake_zero_copy_protector
+ * it parses these protected slices to return the total frame size of the first
+ * contained frame */
+uint32_t tsi_fake_zero_copy_grpc_protector_next_frame_size(
+    const grpc_slice_buffer* protected_slices);
 #endif /* GRPC_CORE_TSI_FAKE_TRANSPORT_SECURITY_H */

data/src/core/tsi/local_transport_security.cc

@@ -41,7 +41,6 @@ typedef struct local_zero_copy_grpc_protector {
 /* Main struct for local TSI handshaker result. */
 typedef struct local_tsi_handshaker_result {
   tsi_handshaker_result base;
-  bool is_client;
   unsigned char* unused_bytes;
   size_t unused_bytes_size;
 } local_tsi_handshaker_result;
@@ -49,26 +48,25 @@ typedef struct local_tsi_handshaker_result {
 /* Main struct for local TSI handshaker. */
 typedef struct local_tsi_handshaker {
   tsi_handshaker base;
-  bool is_client;
 } local_tsi_handshaker;
 
 /* --- tsi_handshaker_result methods implementation. --- */
 
-static tsi_result handshaker_result_extract_peer(
-    const tsi_handshaker_result* /*self*/, tsi_peer* /*peer*/) {
+tsi_result handshaker_result_extract_peer(const tsi_handshaker_result* /*self*/,
+                                          tsi_peer* /*peer*/) {
   return TSI_OK;
 }
 
-static tsi_result handshaker_result_get_frame_protector_type(
+tsi_result handshaker_result_get_frame_protector_type(
     const tsi_handshaker_result* /*self*/,
     tsi_frame_protector_type* frame_protector_type) {
   *frame_protector_type = TSI_FRAME_PROTECTOR_NONE;
   return TSI_OK;
 }
 
-static tsi_result handshaker_result_get_unused_bytes(
-    const tsi_handshaker_result* self, const unsigned char** bytes,
-    size_t* bytes_size) {
+tsi_result handshaker_result_get_unused_bytes(const tsi_handshaker_result* self,
+                                              const unsigned char** bytes,
+                                              size_t* bytes_size) {
   if (self == nullptr || bytes == nullptr || bytes_size == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to get_unused_bytes()");
     return TSI_INVALID_ARGUMENT;
@@ -80,7 +78,7 @@ static tsi_result handshaker_result_get_unused_bytes(
   return TSI_OK;
 }
 
-static void handshaker_result_destroy(tsi_handshaker_result* self) {
+void handshaker_result_destroy(tsi_handshaker_result* self) {
   if (self == nullptr) {
     return;
   }
@@ -91,7 +89,7 @@ static void handshaker_result_destroy(tsi_handshaker_result* self) {
   gpr_free(result);
 }
 
-static const tsi_handshaker_result_vtable result_vtable = {
+const tsi_handshaker_result_vtable result_vtable = {
     handshaker_result_extract_peer,
     handshaker_result_get_frame_protector_type,
     nullptr, /* handshaker_result_create_zero_copy_grpc_protector */
@@ -99,17 +97,15 @@ static const tsi_handshaker_result_vtable result_vtable = {
     handshaker_result_get_unused_bytes,
     handshaker_result_destroy};
 
-static tsi_result create_handshaker_result(bool is_client,
-                                           const unsigned char* received_bytes,
-                                           size_t received_bytes_size,
-                                           tsi_handshaker_result** self) {
+tsi_result create_handshaker_result(const unsigned char* received_bytes,
+                                    size_t received_bytes_size,
+                                    tsi_handshaker_result** self) {
   if (self == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to create_handshaker_result()");
     return TSI_INVALID_ARGUMENT;
   }
   local_tsi_handshaker_result* result =
       grpc_core::Zalloc<local_tsi_handshaker_result>();
-  result->is_client = is_client;
   if (received_bytes_size > 0) {
     result->unused_bytes =
         static_cast<unsigned char*>(gpr_malloc(received_bytes_size));
@@ -123,27 +119,28 @@ static tsi_result create_handshaker_result(bool is_client,
 
 /* --- tsi_handshaker methods implementation. --- */
 
-static tsi_result handshaker_next(
-    tsi_handshaker* self, const unsigned char* received_bytes,
-    size_t received_bytes_size, const unsigned char** /*bytes_to_send*/,
-    size_t* bytes_to_send_size, tsi_handshaker_result** result,
-    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/) {
+tsi_result handshaker_next(tsi_handshaker* self,
+                           const unsigned char* received_bytes,
+                           size_t received_bytes_size,
+                           const unsigned char** /*bytes_to_send*/,
+                           size_t* bytes_to_send_size,
+                           tsi_handshaker_result** result,
+                           tsi_handshaker_on_next_done_cb /*cb*/,
+                           void* /*user_data*/, std::string* error) {
   if (self == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to handshaker_next()");
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   /* Note that there is no interaction between TSI peers, and all operations are
    * local.
    */
-  local_tsi_handshaker* handshaker =
-      reinterpret_cast<local_tsi_handshaker*>(self);
   *bytes_to_send_size = 0;
-  create_handshaker_result(handshaker->is_client, received_bytes,
-                           received_bytes_size, result);
+  create_handshaker_result(received_bytes, received_bytes_size, result);
   return TSI_OK;
 }
 
-static void handshaker_destroy(tsi_handshaker* self) {
+void handshaker_destroy(tsi_handshaker* self) {
   if (self == nullptr) {
     return;
   }
@@ -152,7 +149,7 @@ static void handshaker_destroy(tsi_handshaker* self) {
   gpr_free(handshaker);
 }
 
-static const tsi_handshaker_vtable handshaker_vtable = {
+const tsi_handshaker_vtable handshaker_vtable = {
     nullptr, /* get_bytes_to_send_to_peer -- deprecated */
     nullptr, /* process_bytes_from_peer   -- deprecated */
     nullptr, /* get_result                -- deprecated */
@@ -165,13 +162,12 @@ static const tsi_handshaker_vtable handshaker_vtable = {
 
 }  // namespace
 
-tsi_result tsi_local_handshaker_create(bool is_client, tsi_handshaker** self) {
+tsi_result tsi_local_handshaker_create(tsi_handshaker** self) {
   if (self == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to local_tsi_handshaker_create()");
     return TSI_INVALID_ARGUMENT;
   }
   local_tsi_handshaker* handshaker = grpc_core::Zalloc<local_tsi_handshaker>();
-  handshaker->is_client = is_client;
   handshaker->base.vtable = &handshaker_vtable;
   *self = &handshaker->base;
   return TSI_OK;

data/src/core/tsi/local_transport_security.h

@@ -32,9 +32,6 @@
 /**
  * This method creates a local TSI handshaker instance.
  *
- * - is_client: boolean value indicating if the handshaker is used at the client
- *   (is_client = true) or server (is_client = false) side. The parameter is
- *   added for future extension.
  * - self: address of local TSI handshaker instance to be returned from the
  *   method.
  *
@@ -45,6 +42,6 @@
  * does not fit with an insecure connector, we would need to add a separate
  * handshaker for insecure connectors.
  */
-tsi_result tsi_local_handshaker_create(bool is_client, tsi_handshaker** self);
+tsi_result tsi_local_handshaker_create(tsi_handshaker** self);
 
 #endif /* GRPC_CORE_TSI_LOCAL_TRANSPORT_SECURITY_H */

data/src/core/tsi/ssl/key_logging/ssl_key_logging.cc

@@ -0,0 +1,145 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
+
+#include <map>
+
+#include <grpc/support/log.h>
+
+#include "src/core/lib/gprpp/sync.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/slice/slice_internal.h"
+
+using TlsSessionKeyLogger = tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger;
+
+namespace tsi {
+
+namespace {
+
+gpr_once g_cache_mutex_init = GPR_ONCE_INIT;
+grpc_core::Mutex* g_tls_session_key_log_cache_mu = nullptr;
+// A pointer to a global singleton instance.
+TlsSessionKeyLoggerCache* g_cache_instance
+    ABSL_GUARDED_BY(g_tls_session_key_log_cache_mu) = nullptr;
+
+void do_cache_mutex_init(void) {
+  g_tls_session_key_log_cache_mu = new grpc_core::Mutex();
+}
+
+}  // namespace
+
+TlsSessionKeyLoggerCache::TlsSessionKeyLogger::TlsSessionKeyLogger(
+    std::string tls_session_key_log_file_path,
+    grpc_core::RefCountedPtr<TlsSessionKeyLoggerCache> cache)
+    : tls_session_key_log_file_path_(std::move(tls_session_key_log_file_path)),
+      cache_(std::move(cache)) {
+  GPR_ASSERT(!tls_session_key_log_file_path_.empty());
+  GPR_ASSERT(cache_ != nullptr);
+  fd_ = fopen(tls_session_key_log_file_path_.c_str(), "w+");
+  if (fd_ == nullptr) {
+    grpc_error_handle error = GRPC_OS_ERROR(errno, "fopen");
+    gpr_log(GPR_ERROR,
+            "Ignoring TLS Key logging. ERROR Opening TLS Keylog "
+            "file: %s",
+            grpc_core::StatusToString(error).c_str());
+  }
+  cache_->tls_session_key_logger_map_.emplace(tls_session_key_log_file_path_,
+                                              this);
+};
+
+TlsSessionKeyLoggerCache::TlsSessionKeyLogger::~TlsSessionKeyLogger() {
+  {
+    grpc_core::MutexLock lock(&lock_);
+    if (fd_ != nullptr) fclose(fd_);
+  }
+  {
+    grpc_core::MutexLock lock(g_tls_session_key_log_cache_mu);
+    auto it = cache_->tls_session_key_logger_map_.find(
+        tls_session_key_log_file_path_);
+    if (it != cache_->tls_session_key_logger_map_.end() && it->second == this) {
+      cache_->tls_session_key_logger_map_.erase(it);
+    }
+  }
+}
+
+void TlsSessionKeyLoggerCache::TlsSessionKeyLogger::LogSessionKeys(
+    SSL_CTX* /* ssl_context */, const std::string& session_keys_info) {
+  grpc_core::MutexLock lock(&lock_);
+  if (fd_ == nullptr || session_keys_info.empty()) return;
+  // Append to key log file under lock
+  bool err =
+      fwrite((session_keys_info + "\r\n").c_str(), sizeof(char),
+             session_keys_info.length() + 1, fd_) < session_keys_info.length();
+
+  if (err) {
+    grpc_error_handle error = GRPC_OS_ERROR(errno, "fwrite");
+    gpr_log(GPR_ERROR, "Error Appending to TLS session key log file: %s",
+            grpc_core::StatusToString(error).c_str());
+    fclose(fd_);
+    fd_ = nullptr;  // disable future attempts to write to this file
+  } else {
+    fflush(fd_);
+  }
+}
+
+TlsSessionKeyLoggerCache::TlsSessionKeyLoggerCache()
+    ABSL_EXCLUSIVE_LOCKS_REQUIRED(g_tls_session_key_log_cache_mu) {
+  g_cache_instance = this;
+}
+
+TlsSessionKeyLoggerCache::~TlsSessionKeyLoggerCache() {
+  grpc_core::MutexLock lock(g_tls_session_key_log_cache_mu);
+  g_cache_instance = nullptr;
+}
+
+grpc_core::RefCountedPtr<TlsSessionKeyLogger> TlsSessionKeyLoggerCache::Get(
+    std::string tls_session_key_log_file_path) {
+  gpr_once_init(&g_cache_mutex_init, do_cache_mutex_init);
+  GPR_DEBUG_ASSERT(g_tls_session_key_log_cache_mu != nullptr);
+  if (tls_session_key_log_file_path.empty()) {
+    return nullptr;
+  }
+  {
+    grpc_core::MutexLock lock(g_tls_session_key_log_cache_mu);
+    grpc_core::RefCountedPtr<TlsSessionKeyLoggerCache> cache;
+    if (g_cache_instance == nullptr) {
+      // This will automatically set g_cache_instance.
+      // Not using MakeRefCounted because to the thread safety analysis, which
+      // cannot see through calls, it would look like MakeRefCounted was
+      // calling TlsSessionKeyLoggerCache without holding a lock on
+      // g_tls_session_key_log_cache_mu.
+      cache.reset(new TlsSessionKeyLoggerCache());
+    } else {
+      cache = g_cache_instance->Ref();
+    }
+    // Check cache for entry.
+    auto it =
+        cache->tls_session_key_logger_map_.find(tls_session_key_log_file_path);
+    if (it != cache->tls_session_key_logger_map_.end()) {
+      // Avoid a race condition if the destructor of the tls key logger
+      // of interest is currently executing.
+      auto key_logger = it->second->RefIfNonZero();
+      if (key_logger != nullptr) return key_logger;
+    }
+    // Not found in cache, so create new entry.
+    // This will automatically add itself to tls_session_key_logger_map_.
+    return grpc_core::MakeRefCounted<TlsSessionKeyLogger>(
+        std::move(tls_session_key_log_file_path), std::move(cache));
+  }
+}
+
+};  // namespace tsi