grpc 1.44.0.pre2 → 1.46.3

data/src/core/tsi/local_transport_security.h

@@ -32,9 +32,6 @@
 /**
  * This method creates a local TSI handshaker instance.
  *
- * - is_client: boolean value indicating if the handshaker is used at the client
- *   (is_client = true) or server (is_client = false) side. The parameter is
- *   added for future extension.
  * - self: address of local TSI handshaker instance to be returned from the
  *   method.
  *
@@ -45,6 +42,6 @@
  * does not fit with an insecure connector, we would need to add a separate
  * handshaker for insecure connectors.
  */
-tsi_result tsi_local_handshaker_create(bool is_client, tsi_handshaker** self);
+tsi_result tsi_local_handshaker_create(tsi_handshaker** self);
 
 #endif /* GRPC_CORE_TSI_LOCAL_TRANSPORT_SECURITY_H */

data/src/core/tsi/ssl/key_logging/ssl_key_logging.cc

@@ -0,0 +1,141 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
+
+#include <map>
+
+#include <grpc/support/log.h>
+
+#include "src/core/lib/gprpp/sync.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/slice/slice_internal.h"
+
+using TlsSessionKeyLogger = tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger;
+
+namespace tsi {
+
+namespace {
+
+gpr_once g_cache_mutex_init = GPR_ONCE_INIT;
+grpc_core::Mutex* g_tls_session_key_log_cache_mu = nullptr;
+// A pointer to a global singleton instance.
+TlsSessionKeyLoggerCache* g_cache_instance
+    ABSL_GUARDED_BY(g_tls_session_key_log_cache_mu) = nullptr;
+
+void do_cache_mutex_init(void) {
+  g_tls_session_key_log_cache_mu = new grpc_core::Mutex();
+}
+
+}  // namespace
+
+TlsSessionKeyLoggerCache::TlsSessionKeyLogger::TlsSessionKeyLogger(
+    std::string tls_session_key_log_file_path,
+    grpc_core::RefCountedPtr<TlsSessionKeyLoggerCache> cache)
+    : tls_session_key_log_file_path_(std::move(tls_session_key_log_file_path)),
+      cache_(std::move(cache)) {
+  GPR_ASSERT(!tls_session_key_log_file_path_.empty());
+  GPR_ASSERT(cache_ != nullptr);
+  fd_ = fopen(tls_session_key_log_file_path_.c_str(), "w+");
+  if (fd_ == nullptr) {
+    grpc_error_handle error = GRPC_OS_ERROR(errno, "fopen");
+    gpr_log(GPR_ERROR,
+            "Ignoring TLS Key logging. ERROR Opening TLS Keylog "
+            "file: %s",
+            grpc_error_std_string(error).c_str());
+  }
+  cache_->tls_session_key_logger_map_.emplace(tls_session_key_log_file_path_,
+                                              this);
+};
+
+TlsSessionKeyLoggerCache::TlsSessionKeyLogger::~TlsSessionKeyLogger() {
+  {
+    grpc_core::MutexLock lock(&lock_);
+    if (fd_ != nullptr) fclose(fd_);
+  }
+  {
+    grpc_core::MutexLock lock(g_tls_session_key_log_cache_mu);
+    auto it = cache_->tls_session_key_logger_map_.find(
+        tls_session_key_log_file_path_);
+    if (it != cache_->tls_session_key_logger_map_.end() && it->second == this) {
+      cache_->tls_session_key_logger_map_.erase(it);
+    }
+  }
+}
+
+void TlsSessionKeyLoggerCache::TlsSessionKeyLogger::LogSessionKeys(
+    SSL_CTX* /* ssl_context */, const std::string& session_keys_info) {
+  grpc_core::MutexLock lock(&lock_);
+  if (fd_ == nullptr || session_keys_info.empty()) return;
+  // Append to key log file under lock
+  bool err =
+      fwrite((session_keys_info + "\r\n").c_str(), sizeof(char),
+             session_keys_info.length() + 1, fd_) < session_keys_info.length();
+
+  if (err) {
+    grpc_error_handle error = GRPC_OS_ERROR(errno, "fwrite");
+    gpr_log(GPR_ERROR, "Error Appending to TLS session key log file: %s",
+            grpc_error_std_string(error).c_str());
+    fclose(fd_);
+    fd_ = nullptr;  // disable future attempts to write to this file
+  } else {
+    fflush(fd_);
+  }
+}
+
+TlsSessionKeyLoggerCache::TlsSessionKeyLoggerCache()
+    ABSL_EXCLUSIVE_LOCKS_REQUIRED(g_tls_session_key_log_cache_mu) {
+  g_cache_instance = this;
+}
+
+TlsSessionKeyLoggerCache::~TlsSessionKeyLoggerCache() {
+  grpc_core::MutexLock lock(g_tls_session_key_log_cache_mu);
+  g_cache_instance = nullptr;
+}
+
+grpc_core::RefCountedPtr<TlsSessionKeyLogger> TlsSessionKeyLoggerCache::Get(
+    std::string tls_session_key_log_file_path) {
+  gpr_once_init(&g_cache_mutex_init, do_cache_mutex_init);
+  GPR_DEBUG_ASSERT(g_tls_session_key_log_cache_mu != nullptr);
+  if (tls_session_key_log_file_path.empty()) {
+    return nullptr;
+  }
+  {
+    grpc_core::MutexLock lock(g_tls_session_key_log_cache_mu);
+    grpc_core::RefCountedPtr<TlsSessionKeyLoggerCache> cache;
+    if (g_cache_instance == nullptr) {
+      // This will automatically set g_cache_instance.
+      cache = grpc_core::MakeRefCounted<TlsSessionKeyLoggerCache>();
+    } else {
+      cache = g_cache_instance->Ref();
+    }
+    // Check cache for entry.
+    auto it =
+        cache->tls_session_key_logger_map_.find(tls_session_key_log_file_path);
+    if (it != cache->tls_session_key_logger_map_.end()) {
+      // Avoid a race condition if the destructor of the tls key logger
+      // of interest is currently executing.
+      auto key_logger = it->second->RefIfNonZero();
+      if (key_logger != nullptr) return key_logger;
+    }
+    // Not found in cache, so create new entry.
+    // This will automatically add itself to tls_session_key_logger_map_.
+    return grpc_core::MakeRefCounted<TlsSessionKeyLogger>(
+        std::move(tls_session_key_log_file_path), std::move(cache));
+  }
+}
+
+};  // namespace tsi

data/src/core/tsi/ssl/key_logging/ssl_key_logging.h

@@ -0,0 +1,81 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_TSI_SSL_KEY_LOGGING_SSL_KEY_LOGGING_H
+#define GRPC_CORE_TSI_SSL_KEY_LOGGING_SSL_KEY_LOGGING_H
+
+#include <grpc/support/port_platform.h>
+
+#include <iostream>
+#include <map>
+
+#include <openssl/ssl.h>
+
+#include "absl/base/thread_annotations.h"
+
+#include <grpc/grpc_security.h>
+#include <grpc/slice.h>
+#include <grpc/support/sync.h>
+
+#include "src/core/lib/gprpp/memory.h"
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/gprpp/sync.h"
+
+namespace tsi {
+
+class TlsSessionKeyLoggerCache
+    : public grpc_core::RefCounted<TlsSessionKeyLoggerCache> {
+ public:
+  TlsSessionKeyLoggerCache();
+  ~TlsSessionKeyLoggerCache() override;
+
+  // A helper class which facilitates appending Tls session keys into a file.
+  // The instance is bound to a file meaning only one instance of this object
+  // can ever exist for a given file path.
+  class TlsSessionKeyLogger
+      : public grpc_core::RefCounted<TlsSessionKeyLogger> {
+   public:
+    // Instantiates a TlsSessionKeyLogger instance bound to a specific path.
+    TlsSessionKeyLogger(
+        std::string tls_session_key_log_file_path,
+        grpc_core::RefCountedPtr<TlsSessionKeyLoggerCache> cache);
+    ~TlsSessionKeyLogger() override;
+
+    // Not copyable nor assignable.
+    TlsSessionKeyLogger(const TlsSessionKeyLogger&) = delete;
+    TlsSessionKeyLogger& operator=(const TlsSessionKeyLogger&) = delete;
+    // Writes session keys into the file in the NSS key logging format.
+    // This is called upon completion of a handshake. The associated ssl_context
+    // is also provided here to support future extensions such as logging
+    // keys only when connections are made by certain IPs etc.
+    void LogSessionKeys(SSL_CTX* ssl_context,
+                        const std::string& session_keys_info);
+
+   private:
+    grpc_core::Mutex lock_;  // protects appends to file
+    FILE* fd_ ABSL_GUARDED_BY(lock_);
+    std::string tls_session_key_log_file_path_;
+    grpc_core::RefCountedPtr<TlsSessionKeyLoggerCache> cache_;
+  };
+  // Creates and returns a TlsSessionKeyLogger instance.
+  static grpc_core::RefCountedPtr<TlsSessionKeyLogger> Get(
+      std::string tls_session_key_log_file_path);
+
+ private:
+  std::map<std::string, TlsSessionKeyLogger*> tls_session_key_logger_map_;
+};
+
+}  // namespace tsi
+
+#endif  // GRPC_CORE_TSI_SSL_KEY_LOGGING_SSL_KEY_LOGGING_H

data/src/core/tsi/ssl_transport_security.cc

@@ -55,6 +55,7 @@
 #include <grpc/support/thd_id.h>
 
 #include "src/core/lib/gpr/useful.h"
+#include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/ssl/session_cache/ssl_session_cache.h"
 #include "src/core/tsi/ssl_types.h"
 #include "src/core/tsi/transport_security.h"
@@ -76,6 +77,8 @@
    SSL structure. This is what we would ultimately want though... */
 #define TSI_SSL_MAX_PROTECTION_OVERHEAD 100
 
+using TlsSessionKeyLogger = tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger;
+
 /* --- Structure definitions. ---*/
 
 struct tsi_ssl_root_certs_store {
@@ -93,6 +96,7 @@ struct tsi_ssl_client_handshaker_factory {
   unsigned char* alpn_protocol_list;
   size_t alpn_protocol_list_length;
   grpc_core::RefCountedPtr<tsi::SslSessionLRUCache> session_cache;
+  grpc_core::RefCountedPtr<TlsSessionKeyLogger> key_logger;
 };
 
 struct tsi_ssl_server_handshaker_factory {
@@ -105,6 +109,7 @@ struct tsi_ssl_server_handshaker_factory {
   size_t ssl_context_count;
   unsigned char* alpn_protocol_list;
   size_t alpn_protocol_list_length;
+  grpc_core::RefCountedPtr<TlsSessionKeyLogger> key_logger;
 };
 
 struct tsi_ssl_handshaker {
@@ -1436,8 +1441,7 @@ static tsi_result ssl_handshaker_result_create(
 static tsi_result ssl_handshaker_get_bytes_to_send_to_peer(
     tsi_ssl_handshaker* impl, unsigned char* bytes, size_t* bytes_size) {
   int bytes_read_from_ssl = 0;
-  if (bytes == nullptr || bytes_size == nullptr || *bytes_size == 0 ||
-      *bytes_size > INT_MAX) {
+  if (bytes == nullptr || bytes_size == nullptr || *bytes_size > INT_MAX) {
     return TSI_INVALID_ARGUMENT;
   }
   GPR_ASSERT(*bytes_size <= INT_MAX);
@@ -1464,22 +1468,7 @@ static tsi_result ssl_handshaker_get_result(tsi_ssl_handshaker* impl) {
   return impl->result;
 }
 
-static tsi_result ssl_handshaker_process_bytes_from_peer(
-    tsi_ssl_handshaker* impl, const unsigned char* bytes, size_t* bytes_size) {
-  int bytes_written_into_ssl_size = 0;
-  if (bytes == nullptr || bytes_size == nullptr || *bytes_size > INT_MAX) {
-    return TSI_INVALID_ARGUMENT;
-  }
-  GPR_ASSERT(*bytes_size <= INT_MAX);
-  bytes_written_into_ssl_size =
-      BIO_write(impl->network_io, bytes, static_cast<int>(*bytes_size));
-  if (bytes_written_into_ssl_size < 0) {
-    gpr_log(GPR_ERROR, "Could not write to memory BIO.");
-    impl->result = TSI_INTERNAL_ERROR;
-    return impl->result;
-  }
-  *bytes_size = static_cast<size_t>(bytes_written_into_ssl_size);
-
+static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl) {
   if (ssl_handshaker_get_result(impl) != TSI_HANDSHAKE_IN_PROGRESS) {
     impl->result = TSI_OK;
     return impl->result;
@@ -1498,6 +1487,8 @@ static tsi_result ssl_handshaker_process_bytes_from_peer(
         }
       case SSL_ERROR_NONE:
         return TSI_OK;
+      case SSL_ERROR_WANT_WRITE:
+        return TSI_DRAIN_BUFFER;
       default: {
         char err_str[256];
         ERR_error_string_n(ERR_get_error(), err_str, sizeof(err_str));
@@ -1510,6 +1501,24 @@ static tsi_result ssl_handshaker_process_bytes_from_peer(
   }
 }
 
+static tsi_result ssl_handshaker_process_bytes_from_peer(
+    tsi_ssl_handshaker* impl, const unsigned char* bytes, size_t* bytes_size) {
+  int bytes_written_into_ssl_size = 0;
+  if (bytes == nullptr || bytes_size == nullptr || *bytes_size > INT_MAX) {
+    return TSI_INVALID_ARGUMENT;
+  }
+  GPR_ASSERT(*bytes_size <= INT_MAX);
+  bytes_written_into_ssl_size =
+      BIO_write(impl->network_io, bytes, static_cast<int>(*bytes_size));
+  if (bytes_written_into_ssl_size < 0) {
+    gpr_log(GPR_ERROR, "Could not write to memory BIO.");
+    impl->result = TSI_INTERNAL_ERROR;
+    return impl->result;
+  }
+  *bytes_size = static_cast<size_t>(bytes_written_into_ssl_size);
+  return ssl_handshaker_do_handshake(impl);
+}
+
 static void ssl_handshaker_destroy(tsi_handshaker* self) {
   tsi_ssl_handshaker* impl = reinterpret_cast<tsi_ssl_handshaker*>(self);
   SSL_free(impl->ssl);
@@ -1549,6 +1558,30 @@ static tsi_result ssl_bytes_remaining(tsi_ssl_handshaker* impl,
   return TSI_OK;
 }
 
+// Write handshake data received from SSL to an unbound output buffer.
+// By doing that, we drain SSL bio buffer used to hold handshake data.
+// This API needs to be repeatedly called until all handshake data are
+// received from SSL.
+static tsi_result ssl_handshaker_write_output_buffer(tsi_handshaker* self,
+                                                     size_t* bytes_written) {
+  tsi_ssl_handshaker* impl = reinterpret_cast<tsi_ssl_handshaker*>(self);
+  tsi_result status = TSI_OK;
+  int offset = *bytes_written;
+  do {
+    size_t to_send_size = impl->outgoing_bytes_buffer_size - offset;
+    status = ssl_handshaker_get_bytes_to_send_to_peer(
+        impl, impl->outgoing_bytes_buffer + offset, &to_send_size);
+    offset += to_send_size;
+    if (status == TSI_INCOMPLETE_DATA) {
+      impl->outgoing_bytes_buffer_size *= 2;
+      impl->outgoing_bytes_buffer = static_cast<unsigned char*>(gpr_realloc(
+          impl->outgoing_bytes_buffer, impl->outgoing_bytes_buffer_size));
+    }
+  } while (status == TSI_INCOMPLETE_DATA);
+  *bytes_written = offset;
+  return status;
+}
+
 static tsi_result ssl_handshaker_next(
     tsi_handshaker* self, const unsigned char* received_bytes,
     size_t received_bytes_size, const unsigned char** bytes_to_send,
@@ -1564,27 +1597,22 @@ static tsi_result ssl_handshaker_next(
   tsi_ssl_handshaker* impl = reinterpret_cast<tsi_ssl_handshaker*>(self);
   tsi_result status = TSI_OK;
   size_t bytes_consumed = received_bytes_size;
+  size_t bytes_written = 0;
   if (received_bytes_size > 0) {
     status = ssl_handshaker_process_bytes_from_peer(impl, received_bytes,
                                                     &bytes_consumed);
-    if (status != TSI_OK) return status;
+    while (status == TSI_DRAIN_BUFFER) {
+      status = ssl_handshaker_write_output_buffer(self, &bytes_written);
+      if (status != TSI_OK) return status;
+      status = ssl_handshaker_do_handshake(impl);
+    }
   }
+  if (status != TSI_OK) return status;
   /* Get bytes to send to the peer, if available.  */
-  size_t offset = 0;
-  do {
-    size_t to_send_size = impl->outgoing_bytes_buffer_size - offset;
-    status = ssl_handshaker_get_bytes_to_send_to_peer(
-        impl, impl->outgoing_bytes_buffer + offset, &to_send_size);
-    offset += to_send_size;
-    if (status == TSI_INCOMPLETE_DATA) {
-      impl->outgoing_bytes_buffer_size *= 2;
-      impl->outgoing_bytes_buffer = static_cast<unsigned char*>(gpr_realloc(
-          impl->outgoing_bytes_buffer, impl->outgoing_bytes_buffer_size));
-    }
-  } while (status == TSI_INCOMPLETE_DATA);
+  status = ssl_handshaker_write_output_buffer(self, &bytes_written);
   if (status != TSI_OK) return status;
   *bytes_to_send = impl->outgoing_bytes_buffer;
-  *bytes_to_send_size = offset;
+  *bytes_to_send_size = bytes_written;
   /* If handshake completes, create tsi_handshaker_result.  */
   if (ssl_handshaker_get_result(impl) == TSI_HANDSHAKE_IN_PROGRESS) {
     *handshaker_result = nullptr;
@@ -1641,6 +1669,8 @@ static void tsi_ssl_handshaker_resume_session(
 
 static tsi_result create_tsi_ssl_handshaker(SSL_CTX* ctx, int is_client,
                                             const char* server_name_indication,
+                                            size_t network_bio_buf_size,
+                                            size_t ssl_bio_buf_size,
                                             tsi_ssl_handshaker_factory* factory,
                                             tsi_handshaker** handshaker) {
   SSL* ssl = SSL_new(ctx);
@@ -1657,7 +1687,8 @@ static tsi_result create_tsi_ssl_handshaker(SSL_CTX* ctx, int is_client,
   }
   SSL_set_info_callback(ssl, ssl_info_callback);
 
-  if (!BIO_new_bio_pair(&network_io, 0, &ssl_io, 0)) {
+  if (!BIO_new_bio_pair(&network_io, network_bio_buf_size, &ssl_io,
+                        ssl_bio_buf_size)) {
     gpr_log(GPR_ERROR, "BIO_new_bio_pair failed.");
     SSL_free(ssl);
     return TSI_OUT_OF_RESOURCES;
@@ -1742,10 +1773,11 @@ static int select_protocol_list(const unsigned char** out,
 
 tsi_result tsi_ssl_client_handshaker_factory_create_handshaker(
     tsi_ssl_client_handshaker_factory* factory,
-    const char* server_name_indication, tsi_handshaker** handshaker) {
-  return create_tsi_ssl_handshaker(factory->ssl_context, 1,
-                                   server_name_indication, &factory->base,
-                                   handshaker);
+    const char* server_name_indication, size_t network_bio_buf_size,
+    size_t ssl_bio_buf_size, tsi_handshaker** handshaker) {
+  return create_tsi_ssl_handshaker(
+      factory->ssl_context, 1, server_name_indication, network_bio_buf_size,
+      ssl_bio_buf_size, &factory->base, handshaker);
 }
 
 void tsi_ssl_client_handshaker_factory_unref(
@@ -1762,6 +1794,7 @@ static void tsi_ssl_client_handshaker_factory_destroy(
   if (self->ssl_context != nullptr) SSL_CTX_free(self->ssl_context);
   if (self->alpn_protocol_list != nullptr) gpr_free(self->alpn_protocol_list);
   self->session_cache.reset();
+  self->key_logger.reset();
   gpr_free(self);
 }
 
@@ -1778,11 +1811,13 @@ static int client_handshaker_factory_npn_callback(
 /* --- tsi_ssl_server_handshaker_factory methods implementation. --- */
 
 tsi_result tsi_ssl_server_handshaker_factory_create_handshaker(
-    tsi_ssl_server_handshaker_factory* factory, tsi_handshaker** handshaker) {
+    tsi_ssl_server_handshaker_factory* factory, size_t network_bio_buf_size,
+    size_t ssl_bio_buf_size, tsi_handshaker** handshaker) {
   if (factory->ssl_context_count == 0) return TSI_INVALID_ARGUMENT;
   /* Create the handshaker with the first context. We will switch if needed
      because of SNI in ssl_server_handshaker_factory_servername_callback.  */
   return create_tsi_ssl_handshaker(factory->ssl_contexts[0], 0, nullptr,
+                                   network_bio_buf_size, ssl_bio_buf_size,
                                    &factory->base, handshaker);
 }
 
@@ -1809,6 +1844,7 @@ static void tsi_ssl_server_handshaker_factory_destroy(
     gpr_free(self->ssl_context_x509_subject_names);
   }
   if (self->alpn_protocol_list != nullptr) gpr_free(self->alpn_protocol_list);
+  self->key_logger.reset();
   gpr_free(self);
 }
 
@@ -1921,8 +1957,27 @@ static int server_handshaker_factory_new_session_callback(
   return 1;
 }
 
+/// This callback is invoked at client or server when ssl/tls handshakes
+/// complete and keylogging is enabled.
+template <typename T>
+static void ssl_keylogging_callback(const SSL* ssl, const char* info) {
+  SSL_CTX* ssl_context = SSL_get_SSL_CTX(ssl);
+  GPR_ASSERT(ssl_context != nullptr);
+  void* arg = SSL_CTX_get_ex_data(ssl_context, g_ssl_ctx_ex_factory_index);
+  T* factory = static_cast<T*>(arg);
+  factory->key_logger->LogSessionKeys(ssl_context, info);
+}
+
+// This callback is invoked when the CRL has been verified and will soft-fail
+// errors in verification depending on certain error types.
 static int verify_cb(int ok, X509_STORE_CTX* ctx) {
   int cert_error = X509_STORE_CTX_get_error(ctx);
+  if (cert_error == X509_V_ERR_UNABLE_TO_GET_CRL) {
+    gpr_log(
+        GPR_INFO,
+        "Certificate verification failed to get CRL files. Ignoring error.");
+    return 1;
+  }
   if (cert_error != 0) {
     gpr_log(GPR_ERROR, "Certificate verify failed with code %d", cert_error);
   }
@@ -1989,12 +2044,27 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
     impl->session_cache =
         reinterpret_cast<tsi::SslSessionLRUCache*>(options->session_cache)
             ->Ref();
-    SSL_CTX_set_ex_data(ssl_context, g_ssl_ctx_ex_factory_index, impl);
     SSL_CTX_sess_set_new_cb(ssl_context,
                             server_handshaker_factory_new_session_callback);
     SSL_CTX_set_session_cache_mode(ssl_context, SSL_SESS_CACHE_CLIENT);
   }
 
+#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
+  if (options->key_logger != nullptr) {
+    impl->key_logger = options->key_logger->Ref();
+    // SSL_CTX_set_keylog_callback is set here to register callback
+    // when ssl/tls handshakes complete.
+    SSL_CTX_set_keylog_callback(
+        ssl_context,
+        ssl_keylogging_callback<tsi_ssl_client_handshaker_factory>);
+  }
+#endif
+
+  if (options->session_cache != nullptr || options->key_logger != nullptr) {
+    // Need to set factory at g_ssl_ctx_ex_factory_index
+    SSL_CTX_set_ex_data(ssl_context, g_ssl_ctx_ex_factory_index, impl);
+  }
+
   do {
     result = populate_ssl_context(ssl_context, options->pem_key_cert_pair,
                                   options->cipher_suites);
@@ -2148,6 +2218,10 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
     }
   }
 
+  if (options->key_logger != nullptr) {
+    impl->key_logger = options->key_logger->Ref();
+  }
+
   for (i = 0; i < options->num_key_cert_pairs; i++) {
     do {
 #if OPENSSL_VERSION_NUMBER >= 0x10100000
@@ -2263,6 +2337,20 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
       SSL_CTX_set_next_protos_advertised_cb(
           impl->ssl_contexts[i],
           server_handshaker_factory_npn_advertised_callback, impl);
+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
+      /* Register factory at index */
+      if (options->key_logger != nullptr) {
+        // Need to set factory at g_ssl_ctx_ex_factory_index
+        SSL_CTX_set_ex_data(impl->ssl_contexts[i], g_ssl_ctx_ex_factory_index,
+                            impl);
+        // SSL_CTX_set_keylog_callback is set here to register callback
+        // when ssl/tls handshakes complete.
+        SSL_CTX_set_keylog_callback(
+            impl->ssl_contexts[i],
+            ssl_keylogging_callback<tsi_ssl_server_handshaker_factory>);
+      }
+#endif
     } while (false);
 
     if (result != TSI_OK) {

data/src/core/tsi/ssl_transport_security.h

@@ -27,6 +27,7 @@
 
 #include <grpc/grpc_security_constants.h>
 
+#include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/transport_security_interface.h"
 
 /* Value for the TSI_CERTIFICATE_TYPE_PEER_PROPERTY property for X509 certs. */
@@ -75,6 +76,19 @@ void tsi_ssl_session_cache_ref(tsi_ssl_session_cache* cache);
 /* Decrement reference counter of \a cache.  */
 void tsi_ssl_session_cache_unref(tsi_ssl_session_cache* cache);
 
+/* --- tsi_ssl_key_logger object ---
+
+   Experimental SSL Key logging functionality to enable decryption of
+   packet captures.  */
+static constexpr bool tsi_tls_session_key_logging_supported() {
+// Supported only for open-ssl versions >= 1.1.1
+#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
+  return true;
+#else
+  return false;
+#endif
+}
+
 /* --- tsi_ssl_client_handshaker_factory object ---
 
    This object creates a client tsi_handshaker objects implemented in terms of
@@ -149,6 +163,8 @@ struct tsi_ssl_client_handshaker_options {
   size_t num_alpn_protocols;
   /* ssl_session_cache is a cache for reusable client-side sessions. */
   tsi_ssl_session_cache* session_cache;
+  /* tsi_ssl_key_logger is an instance used to log SSL keys to a file. */
+  tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* key_logger;
 
   /* skip server certificate verification. */
   bool skip_server_certificate_verification;
@@ -171,6 +187,7 @@ struct tsi_ssl_client_handshaker_options {
         alpn_protocols(nullptr),
         num_alpn_protocols(0),
         session_cache(nullptr),
+        key_logger(nullptr),
         skip_server_certificate_verification(false),
         min_tls_version(tsi_tls_version::TSI_TLS1_2),
         max_tls_version(tsi_tls_version::TSI_TLS1_3),
@@ -192,13 +209,16 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
   - server_name_indication indicates the name of the server the client is
     trying to connect to which will be relayed to the server using the SNI
     extension.
+  - network_bio_buf_size and ssl_bio_buf_size represent BIO pair buffers used in
+    SSL. The buffer size being 0 translates to 17KB in boringSSL.
   - handshaker is the address of the handshaker pointer to be created.
 
   - This method returns TSI_OK on success or TSI_INVALID_PARAMETER in the case
     where a parameter is invalid.  */
 tsi_result tsi_ssl_client_handshaker_factory_create_handshaker(
     tsi_ssl_client_handshaker_factory* factory,
-    const char* server_name_indication, tsi_handshaker** handshaker);
+    const char* server_name_indication, size_t network_bio_buf_size,
+    size_t ssl_bio_buf_size, tsi_handshaker** handshaker);
 
 /* Decrements reference count of the handshaker factory. Handshaker factory will
  * be destroyed once no references exist. */
@@ -293,6 +313,8 @@ struct tsi_ssl_server_handshaker_options {
   /* The min and max TLS versions that will be negotiated by the handshaker. */
   tsi_tls_version min_tls_version;
   tsi_tls_version max_tls_version;
+  /* tsi_ssl_key_logger is an instance used to log SSL keys to a file. */
+  tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* key_logger;
 
   /* The directory where all hashed CRL files are cached in the x.509 store and
    * enforced by the handshaker are located. If the directory is invalid, CRL
@@ -312,6 +334,7 @@ struct tsi_ssl_server_handshaker_options {
         session_ticket_key_size(0),
         min_tls_version(tsi_tls_version::TSI_TLS1_2),
         max_tls_version(tsi_tls_version::TSI_TLS1_3),
+        key_logger(nullptr),
         crl_directory(nullptr) {}
 };
 
@@ -327,12 +350,15 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
 
 /* Creates a server handshaker.
   - factory is the factory from which the handshaker will be created.
+  - network_bio_buf_size and ssl_bio_buf_size represent BIO pair buffers used in
+    SSL. The buffer size being 0 translates to 17KB in boringSSL.
   - handshaker is the address of the handshaker pointer to be created.
 
   - This method returns TSI_OK on success or TSI_INVALID_PARAMETER in the case
     where a parameter is invalid.  */
 tsi_result tsi_ssl_server_handshaker_factory_create_handshaker(
-    tsi_ssl_server_handshaker_factory* factory, tsi_handshaker** handshaker);
+    tsi_ssl_server_handshaker_factory* factory, size_t network_bio_buf_size,
+    size_t ssl_bio_buf_size, tsi_handshaker** handshaker);
 
 /* Decrements reference count of the handshaker factory. Handshaker factory will
  * be destroyed once no references exist. */

data/src/core/tsi/transport_security_interface.h

@@ -45,6 +45,8 @@ typedef enum {
   TSI_ASYNC = 13,
   TSI_HANDSHAKE_SHUTDOWN = 14,
   TSI_CLOSE_NOTIFY = 15,  // Indicates that the connection should be closed.
+  TSI_DRAIN_BUFFER = 16,  // Indicates that the buffer used to store handshake
+                          // data should be drained.
 } tsi_result;
 
 typedef enum {

data/src/ruby/ext/grpc/extconf.rb

@@ -60,7 +60,7 @@ end
 
 ENV['CPPFLAGS'] = '-DGPR_BACKWARDS_COMPATIBILITY_MODE'
 ENV['CPPFLAGS'] += ' -DGRPC_XDS_USER_AGENT_NAME_SUFFIX="\"RUBY\"" '
-ENV['CPPFLAGS'] += ' -DGRPC_XDS_USER_AGENT_VERSION_SUFFIX="\"1.44.0.pre2\"" '
+ENV['CPPFLAGS'] += ' -DGRPC_XDS_USER_AGENT_VERSION_SUFFIX="\"1.46.3\"" '
 
 output_dir = File.expand_path(RbConfig::CONFIG['topdir'])
 grpc_lib_dir = File.join(output_dir, 'libs', grpc_config)