grpc 1.47.0-x86_64-linux → 1.49.0.pre1-x86_64-linux

data/src/core/tsi/fake_transport_security.cc

@@ -96,7 +96,8 @@ static const char* tsi_fake_handshake_message_to_string(int msg) {
 }
 
 static tsi_result tsi_fake_handshake_message_from_string(
-    const char* msg_string, tsi_fake_handshake_message* msg) {
+    const char* msg_string, tsi_fake_handshake_message* msg,
+    std::string* error) {
   for (int i = 0; i < TSI_FAKE_HANDSHAKE_MESSAGE_MAX; i++) {
     if (strncmp(msg_string, tsi_fake_handshake_message_strings[i],
                 strlen(tsi_fake_handshake_message_strings[i])) == 0) {
@@ -105,6 +106,7 @@ static tsi_result tsi_fake_handshake_message_from_string(
     }
   }
   gpr_log(GPR_ERROR, "Invalid handshake message.");
+  if (error != nullptr) *error = "invalid handshake message";
   return TSI_DATA_CORRUPTED;
 }
 
@@ -143,6 +145,11 @@ static uint32_t read_frame_size(const grpc_slice_buffer* sb) {
   return load32_little_endian(frame_size_buffer);
 }
 
+uint32_t tsi_fake_zero_copy_grpc_protector_next_frame_size(
+    const grpc_slice_buffer* protected_slices) {
+  return read_frame_size(protected_slices);
+}
+
 static void tsi_fake_frame_reset(tsi_fake_frame* frame, int needs_draining) {
   frame->offset = 0;
   frame->needs_draining = needs_draining;
@@ -169,12 +176,16 @@ static void tsi_fake_frame_ensure_size(tsi_fake_frame* frame) {
  * This method should not be called if frame->needs_framing is not 0.  */
 static tsi_result tsi_fake_frame_decode(const unsigned char* incoming_bytes,
                                         size_t* incoming_bytes_size,
-                                        tsi_fake_frame* frame) {
+                                        tsi_fake_frame* frame,
+                                        std::string* error) {
   size_t available_size = *incoming_bytes_size;
   size_t to_read_size = 0;
   const unsigned char* bytes_cursor = incoming_bytes;
 
-  if (frame->needs_draining) return TSI_INTERNAL_ERROR;
+  if (frame->needs_draining) {
+    if (error != nullptr) *error = "fake handshaker frame needs draining";
+    return TSI_INTERNAL_ERROR;
+  }
   if (frame->data == nullptr) {
     frame->allocated_size = TSI_FAKE_FRAME_INITIAL_ALLOCATED_SIZE;
     frame->data =
@@ -219,9 +230,13 @@ static tsi_result tsi_fake_frame_decode(const unsigned char* incoming_bytes,
  * This method should not be called if frame->needs_framing is 0.  */
 static tsi_result tsi_fake_frame_encode(unsigned char* outgoing_bytes,
                                         size_t* outgoing_bytes_size,
-                                        tsi_fake_frame* frame) {
+                                        tsi_fake_frame* frame,
+                                        std::string* error) {
   size_t to_write_size = frame->size - frame->offset;
-  if (!frame->needs_draining) return TSI_INTERNAL_ERROR;
+  if (!frame->needs_draining) {
+    if (error != nullptr) *error = "fake frame needs draining";
+    return TSI_INTERNAL_ERROR;
+  }
   if (*outgoing_bytes_size < to_write_size) {
     memcpy(outgoing_bytes, frame->data + frame->offset, *outgoing_bytes_size);
     frame->offset += *outgoing_bytes_size;
@@ -235,15 +250,14 @@ static tsi_result tsi_fake_frame_encode(unsigned char* outgoing_bytes,
 
 /* Sets the payload of a fake frame to contain the given data blob, where
  * data_size indicates the size of data. */
-static tsi_result tsi_fake_frame_set_data(unsigned char* data, size_t data_size,
-                                          tsi_fake_frame* frame) {
+static void tsi_fake_frame_set_data(unsigned char* data, size_t data_size,
+                                    tsi_fake_frame* frame) {
   frame->offset = 0;
   frame->size = data_size + TSI_FAKE_FRAME_HEADER_SIZE;
   tsi_fake_frame_ensure_size(frame);
   store32_little_endian(static_cast<uint32_t>(frame->size), frame->data);
   memcpy(frame->data + TSI_FAKE_FRAME_HEADER_SIZE, data, data_size);
   tsi_fake_frame_reset(frame, 1 /* needs draining */);
-  return TSI_OK;
 }
 
 /* Destroys the contents of a fake frame. */
@@ -271,8 +285,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
   /* Try to drain first. */
   if (frame->needs_draining) {
     drained_size = saved_output_size - *num_bytes_written;
-    result =
-        tsi_fake_frame_encode(protected_output_frames, &drained_size, frame);
+    result = tsi_fake_frame_encode(protected_output_frames, &drained_size,
+                                   frame, /*error=*/nullptr);
     *num_bytes_written += drained_size;
     protected_output_frames += drained_size;
     if (result != TSI_OK) {
@@ -292,7 +306,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
     store32_little_endian(static_cast<uint32_t>(impl->max_frame_size),
                           frame_header);
     written_in_frame_size = TSI_FAKE_FRAME_HEADER_SIZE;
-    result = tsi_fake_frame_decode(frame_header, &written_in_frame_size, frame);
+    result = tsi_fake_frame_decode(frame_header, &written_in_frame_size, frame,
+                                   /*error=*/nullptr);
     if (result != TSI_INCOMPLETE_DATA) {
       gpr_log(GPR_ERROR, "tsi_fake_frame_decode returned %s",
               tsi_result_to_string(result));
@@ -300,7 +315,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
     }
   }
   result =
-      tsi_fake_frame_decode(unprotected_bytes, unprotected_bytes_size, frame);
+      tsi_fake_frame_decode(unprotected_bytes, unprotected_bytes_size, frame,
+                            /*error=*/nullptr);
   if (result != TSI_OK) {
     if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
     return result;
@@ -310,7 +326,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
   if (!frame->needs_draining) return TSI_INTERNAL_ERROR;
   if (frame->offset != 0) return TSI_INTERNAL_ERROR;
   drained_size = saved_output_size - *num_bytes_written;
-  result = tsi_fake_frame_encode(protected_output_frames, &drained_size, frame);
+  result = tsi_fake_frame_encode(protected_output_frames, &drained_size, frame,
+                                 /*error=*/nullptr);
   *num_bytes_written += drained_size;
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   return result;
@@ -332,7 +349,8 @@ static tsi_result fake_protector_protect_flush(
                           frame->data); /* Overwrite header. */
   }
   result = tsi_fake_frame_encode(protected_output_frames,
-                                 protected_output_frames_size, frame);
+                                 protected_output_frames_size, frame,
+                                 /*error=*/nullptr);
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   *still_pending_size = frame->size - frame->offset;
   return result;
@@ -356,7 +374,8 @@ static tsi_result fake_protector_unprotect(
     /* Go past the header if needed. */
     if (frame->offset == 0) frame->offset = TSI_FAKE_FRAME_HEADER_SIZE;
     drained_size = saved_output_size - *num_bytes_written;
-    result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame);
+    result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame,
+                                   /*error=*/nullptr);
     unprotected_bytes += drained_size;
     *num_bytes_written += drained_size;
     if (result != TSI_OK) {
@@ -371,7 +390,8 @@ static tsi_result fake_protector_unprotect(
   /* Now process the protected_bytes. */
   if (frame->needs_draining) return TSI_INTERNAL_ERROR;
   result = tsi_fake_frame_decode(protected_frames_bytes,
-                                 protected_frames_bytes_size, frame);
+                                 protected_frames_bytes_size, frame,
+                                 /*error=*/nullptr);
   if (result != TSI_OK) {
     if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
     return result;
@@ -382,7 +402,8 @@ static tsi_result fake_protector_unprotect(
   if (frame->offset != 0) return TSI_INTERNAL_ERROR;
   frame->offset = TSI_FAKE_FRAME_HEADER_SIZE; /* Go past the header. */
   drained_size = saved_output_size - *num_bytes_written;
-  result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame);
+  result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame,
+                                 /*error=*/nullptr);
   *num_bytes_written += drained_size;
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   return result;
@@ -432,7 +453,7 @@ static tsi_result fake_zero_copy_grpc_protector_protect(
 
 static tsi_result fake_zero_copy_grpc_protector_unprotect(
     tsi_zero_copy_grpc_protector* self, grpc_slice_buffer* protected_slices,
-    grpc_slice_buffer* unprotected_slices) {
+    grpc_slice_buffer* unprotected_slices, int* min_progress_size) {
   if (self == nullptr || unprotected_slices == nullptr ||
       protected_slices == nullptr) {
     return TSI_INVALID_ARGUMENT;
@@ -462,6 +483,13 @@ static tsi_result fake_zero_copy_grpc_protector_unprotect(
     impl->parsed_frame_size = 0;
     grpc_slice_buffer_reset_and_unref_internal(&impl->header_sb);
   }
+  if (min_progress_size != nullptr) {
+    if (impl->parsed_frame_size > TSI_FAKE_FRAME_HEADER_SIZE) {
+      *min_progress_size = impl->parsed_frame_size - impl->protected_sb.length;
+    } else {
+      *min_progress_size = 1;
+    }
+  }
   return TSI_OK;
 }
 
@@ -567,9 +595,10 @@ static const tsi_handshaker_result_vtable handshaker_result_vtable = {
 
 static tsi_result fake_handshaker_result_create(
     const unsigned char* unused_bytes, size_t unused_bytes_size,
-    tsi_handshaker_result** handshaker_result) {
+    tsi_handshaker_result** handshaker_result, std::string* error) {
   if ((unused_bytes_size > 0 && unused_bytes == nullptr) ||
       handshaker_result == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   fake_handshaker_result* result = grpc_core::Zalloc<fake_handshaker_result>();
@@ -587,7 +616,8 @@ static tsi_result fake_handshaker_result_create(
 /* --- tsi_handshaker methods implementation. ---*/
 
 static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
-    tsi_handshaker* self, unsigned char* bytes, size_t* bytes_size) {
+    tsi_handshaker* self, unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   tsi_fake_handshaker* impl = reinterpret_cast<tsi_fake_handshaker*>(self);
   tsi_result result = TSI_OK;
   if (impl->needs_incoming_message || impl->result == TSI_OK) {
@@ -600,10 +630,9 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
         static_cast<tsi_fake_handshake_message>(impl->next_message_to_send + 2);
     const char* msg_string =
         tsi_fake_handshake_message_to_string(impl->next_message_to_send);
-    result = tsi_fake_frame_set_data(
+    tsi_fake_frame_set_data(
         reinterpret_cast<unsigned char*>(const_cast<char*>(msg_string)),
         strlen(msg_string), &impl->outgoing_frame);
-    if (result != TSI_OK) return result;
     if (next_message_to_send > TSI_FAKE_HANDSHAKE_MESSAGE_MAX) {
       next_message_to_send = TSI_FAKE_HANDSHAKE_MESSAGE_MAX;
     }
@@ -614,7 +643,8 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
     }
     impl->next_message_to_send = next_message_to_send;
   }
-  result = tsi_fake_frame_encode(bytes, bytes_size, &impl->outgoing_frame);
+  result =
+      tsi_fake_frame_encode(bytes, bytes_size, &impl->outgoing_frame, error);
   if (result != TSI_OK) return result;
   if (!impl->is_client &&
       impl->next_message_to_send == TSI_FAKE_HANDSHAKE_MESSAGE_MAX) {
@@ -630,7 +660,8 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
 }
 
 static tsi_result fake_handshaker_process_bytes_from_peer(
-    tsi_handshaker* self, const unsigned char* bytes, size_t* bytes_size) {
+    tsi_handshaker* self, const unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   tsi_result result = TSI_OK;
   tsi_fake_handshaker* impl = reinterpret_cast<tsi_fake_handshaker*>(self);
   tsi_fake_handshake_message expected_msg =
@@ -641,14 +672,15 @@ static tsi_result fake_handshaker_process_bytes_from_peer(
     *bytes_size = 0;
     return TSI_OK;
   }
-  result = tsi_fake_frame_decode(bytes, bytes_size, &impl->incoming_frame);
+  result =
+      tsi_fake_frame_decode(bytes, bytes_size, &impl->incoming_frame, error);
   if (result != TSI_OK) return result;
 
   /* We now have a complete frame. */
   result = tsi_fake_handshake_message_from_string(
       reinterpret_cast<const char*>(impl->incoming_frame.data) +
           TSI_FAKE_FRAME_HEADER_SIZE,
-      &received_msg);
+      &received_msg, error);
   if (result != TSI_OK) {
     impl->result = result;
     return result;
@@ -691,11 +723,13 @@ static tsi_result fake_handshaker_next(
     tsi_handshaker* self, const unsigned char* received_bytes,
     size_t received_bytes_size, const unsigned char** bytes_to_send,
     size_t* bytes_to_send_size, tsi_handshaker_result** handshaker_result,
-    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/) {
+    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/,
+    std::string* error) {
   /* Sanity check the arguments. */
   if ((received_bytes_size > 0 && received_bytes == nullptr) ||
       bytes_to_send == nullptr || bytes_to_send_size == nullptr ||
       handshaker_result == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   tsi_fake_handshaker* handshaker =
@@ -705,8 +739,8 @@ static tsi_result fake_handshaker_next(
   /* Decode and process a handshake frame from the peer. */
   size_t consumed_bytes_size = received_bytes_size;
   if (received_bytes_size > 0) {
-    result = fake_handshaker_process_bytes_from_peer(self, received_bytes,
-                                                     &consumed_bytes_size);
+    result = fake_handshaker_process_bytes_from_peer(
+        self, received_bytes, &consumed_bytes_size, error);
     if (result != TSI_OK) return result;
   }
 
@@ -716,7 +750,8 @@ static tsi_result fake_handshaker_next(
   do {
     size_t sent_bytes_size = handshaker->outgoing_bytes_buffer_size - offset;
     result = fake_handshaker_get_bytes_to_send_to_peer(
-        self, handshaker->outgoing_bytes_buffer + offset, &sent_bytes_size);
+        self, handshaker->outgoing_bytes_buffer + offset, &sent_bytes_size,
+        error);
     offset += sent_bytes_size;
     if (result == TSI_INCOMPLETE_DATA) {
       handshaker->outgoing_bytes_buffer_size *= 2;
@@ -742,7 +777,7 @@ static tsi_result fake_handshaker_next(
 
     /* Create a handshaker_result containing the unused bytes. */
     result = fake_handshaker_result_create(unused_bytes, unused_bytes_size,
-                                           handshaker_result);
+                                           handshaker_result, error);
     if (result == TSI_OK) {
       /* Indicate that the handshake has completed and that a handshaker_result
        * has been created. */

data/src/core/tsi/fake_transport_security.h

@@ -21,6 +21,7 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/lib/slice/slice_internal.h"
 #include "src/core/tsi/transport_security_interface.h"
 
 /* Value for the TSI_CERTIFICATE_TYPE_PEER_PROPERTY property for FAKE certs. */
@@ -44,4 +45,9 @@ tsi_frame_protector* tsi_create_fake_frame_protector(
 tsi_zero_copy_grpc_protector* tsi_create_fake_zero_copy_grpc_protector(
     size_t* max_protected_frame_size);
 
+/* Given a buffer containing slices encrypted by a fake_zero_copy_protector
+ * it parses these protected slices to return the total frame size of the first
+ * contained frame */
+uint32_t tsi_fake_zero_copy_grpc_protector_next_frame_size(
+    const grpc_slice_buffer* protected_slices);
 #endif /* GRPC_CORE_TSI_FAKE_TRANSPORT_SECURITY_H */

data/src/core/tsi/local_transport_security.cc

@@ -119,13 +119,17 @@ tsi_result create_handshaker_result(const unsigned char* received_bytes,
 
 /* --- tsi_handshaker methods implementation. --- */
 
-tsi_result handshaker_next(
-    tsi_handshaker* self, const unsigned char* received_bytes,
-    size_t received_bytes_size, const unsigned char** /*bytes_to_send*/,
-    size_t* bytes_to_send_size, tsi_handshaker_result** result,
-    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/) {
+tsi_result handshaker_next(tsi_handshaker* self,
+                           const unsigned char* received_bytes,
+                           size_t received_bytes_size,
+                           const unsigned char** /*bytes_to_send*/,
+                           size_t* bytes_to_send_size,
+                           tsi_handshaker_result** result,
+                           tsi_handshaker_on_next_done_cb /*cb*/,
+                           void* /*user_data*/, std::string* error) {
   if (self == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to handshaker_next()");
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   /* Note that there is no interaction between TSI peers, and all operations are

data/src/core/tsi/ssl/session_cache/ssl_session_cache.h

@@ -25,9 +25,11 @@
 
 #include <openssl/ssl.h>
 
+#include <grpc/impl/codegen/grpc_types.h>
 #include <grpc/slice.h>
 #include <grpc/support/sync.h>
 
+#include "src/core/lib/gprpp/cpp_impl_of.h"
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/sync.h"
@@ -44,7 +46,10 @@
 
 namespace tsi {
 
-class SslSessionLRUCache : public grpc_core::RefCounted<SslSessionLRUCache> {
+class SslSessionLRUCache
+    : public grpc_core::CppImplOf<SslSessionLRUCache,
+                                  struct tsi_ssl_session_cache>,
+      public grpc_core::RefCounted<SslSessionLRUCache> {
  public:
   /// Create new LRU cache with the given capacity.
   static grpc_core::RefCountedPtr<SslSessionLRUCache> Create(size_t capacity) {
@@ -59,6 +64,10 @@ class SslSessionLRUCache : public grpc_core::RefCounted<SslSessionLRUCache> {
   SslSessionLRUCache(const SslSessionLRUCache&) = delete;
   SslSessionLRUCache& operator=(const SslSessionLRUCache&) = delete;
 
+  static absl::string_view ChannelArgName() {
+    return GRPC_SSL_SESSION_CACHE_ARG;
+  }
+
   /// Returns current number of sessions in the cache.
   size_t Size();
   /// Add \a session in the cache using \a key. This operation may discard older

data/src/core/tsi/ssl_transport_security.cc

@@ -45,6 +45,7 @@
 #include <openssl/x509v3.h>
 
 #include "absl/strings/match.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 
 #include <grpc/grpc_security.h>
@@ -1036,17 +1037,16 @@ void tsi_ssl_root_certs_store_destroy(tsi_ssl_root_certs_store* self) {
 
 tsi_ssl_session_cache* tsi_ssl_session_cache_create_lru(size_t capacity) {
   /* Pointer will be dereferenced by unref call. */
-  return reinterpret_cast<tsi_ssl_session_cache*>(
-      tsi::SslSessionLRUCache::Create(capacity).release());
+  return tsi::SslSessionLRUCache::Create(capacity).release()->c_ptr();
 }
 
 void tsi_ssl_session_cache_ref(tsi_ssl_session_cache* cache) {
   /* Pointer will be dereferenced by unref call. */
-  reinterpret_cast<tsi::SslSessionLRUCache*>(cache)->Ref().release();
+  tsi::SslSessionLRUCache::FromC(cache)->Ref().release();
 }
 
 void tsi_ssl_session_cache_unref(tsi_ssl_session_cache* cache) {
-  reinterpret_cast<tsi::SslSessionLRUCache*>(cache)->Unref();
+  tsi::SslSessionLRUCache::FromC(cache)->Unref();
 }
 
 /* --- tsi_frame_protector methods implementation. ---*/
@@ -1416,9 +1416,11 @@ static const tsi_handshaker_result_vtable handshaker_result_vtable = {
 
 static tsi_result ssl_handshaker_result_create(
     tsi_ssl_handshaker* handshaker, unsigned char* unused_bytes,
-    size_t unused_bytes_size, tsi_handshaker_result** handshaker_result) {
+    size_t unused_bytes_size, tsi_handshaker_result** handshaker_result,
+    std::string* error) {
   if (handshaker == nullptr || handshaker_result == nullptr ||
       (unused_bytes_size > 0 && unused_bytes == nullptr)) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   tsi_ssl_handshaker_result* result =
@@ -1439,9 +1441,11 @@ static tsi_result ssl_handshaker_result_create(
 /* --- tsi_handshaker methods implementation. ---*/
 
 static tsi_result ssl_handshaker_get_bytes_to_send_to_peer(
-    tsi_ssl_handshaker* impl, unsigned char* bytes, size_t* bytes_size) {
+    tsi_ssl_handshaker* impl, unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   int bytes_read_from_ssl = 0;
   if (bytes == nullptr || bytes_size == nullptr || *bytes_size > INT_MAX) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   GPR_ASSERT(*bytes_size <= INT_MAX);
@@ -1450,6 +1454,7 @@ static tsi_result ssl_handshaker_get_bytes_to_send_to_peer(
   if (bytes_read_from_ssl < 0) {
     *bytes_size = 0;
     if (!BIO_should_retry(impl->network_io)) {
+      if (error != nullptr) *error = "error reading from BIO";
       impl->result = TSI_INTERNAL_ERROR;
       return impl->result;
     } else {
@@ -1468,7 +1473,8 @@ static tsi_result ssl_handshaker_get_result(tsi_ssl_handshaker* impl) {
   return impl->result;
 }
 
-static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl) {
+static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl,
+                                              std::string* error) {
   if (ssl_handshaker_get_result(impl) != TSI_HANDSHAKE_IN_PROGRESS) {
     impl->result = TSI_OK;
     return impl->result;
@@ -1494,6 +1500,9 @@ static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl) {
         ERR_error_string_n(ERR_get_error(), err_str, sizeof(err_str));
         gpr_log(GPR_ERROR, "Handshake failed with fatal error %s: %s.",
                 ssl_error_string(ssl_result), err_str);
+        if (error != nullptr) {
+          *error = absl::StrCat(ssl_error_string(ssl_result), ": ", err_str);
+        }
         impl->result = TSI_PROTOCOL_FAILURE;
         return impl->result;
       }
@@ -1502,9 +1511,11 @@ static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl) {
 }
 
 static tsi_result ssl_handshaker_process_bytes_from_peer(
-    tsi_ssl_handshaker* impl, const unsigned char* bytes, size_t* bytes_size) {
+    tsi_ssl_handshaker* impl, const unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   int bytes_written_into_ssl_size = 0;
   if (bytes == nullptr || bytes_size == nullptr || *bytes_size > INT_MAX) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   GPR_ASSERT(*bytes_size <= INT_MAX);
@@ -1512,11 +1523,12 @@ static tsi_result ssl_handshaker_process_bytes_from_peer(
       BIO_write(impl->network_io, bytes, static_cast<int>(*bytes_size));
   if (bytes_written_into_ssl_size < 0) {
     gpr_log(GPR_ERROR, "Could not write to memory BIO.");
+    if (error != nullptr) *error = "could not write to memory BIO";
     impl->result = TSI_INTERNAL_ERROR;
     return impl->result;
   }
   *bytes_size = static_cast<size_t>(bytes_written_into_ssl_size);
-  return ssl_handshaker_do_handshake(impl);
+  return ssl_handshaker_do_handshake(impl, error);
 }
 
 static void ssl_handshaker_destroy(tsi_handshaker* self) {
@@ -1532,9 +1544,11 @@ static void ssl_handshaker_destroy(tsi_handshaker* self) {
 // |bytes_remaining|.
 static tsi_result ssl_bytes_remaining(tsi_ssl_handshaker* impl,
                                       unsigned char** bytes_remaining,
-                                      size_t* bytes_remaining_size) {
+                                      size_t* bytes_remaining_size,
+                                      std::string* error) {
   if (impl == nullptr || bytes_remaining == nullptr ||
       bytes_remaining_size == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   // Atempt to read all of the bytes in SSL's read BIO. These bytes should
@@ -1552,6 +1566,9 @@ static tsi_result ssl_bytes_remaining(tsi_ssl_handshaker* impl,
             "Failed to read the expected number of bytes from SSL object.");
     gpr_free(*bytes_remaining);
     *bytes_remaining = nullptr;
+    if (error != nullptr) {
+      *error = "Failed to read the expected number of bytes from SSL object.";
+    }
     return TSI_INTERNAL_ERROR;
   }
   *bytes_remaining_size = static_cast<size_t>(bytes_read);
@@ -1563,14 +1580,15 @@ static tsi_result ssl_bytes_remaining(tsi_ssl_handshaker* impl,
 // This API needs to be repeatedly called until all handshake data are
 // received from SSL.
 static tsi_result ssl_handshaker_write_output_buffer(tsi_handshaker* self,
-                                                     size_t* bytes_written) {
+                                                     size_t* bytes_written,
+                                                     std::string* error) {
   tsi_ssl_handshaker* impl = reinterpret_cast<tsi_ssl_handshaker*>(self);
   tsi_result status = TSI_OK;
-  int offset = *bytes_written;
+  size_t offset = *bytes_written;
   do {
     size_t to_send_size = impl->outgoing_bytes_buffer_size - offset;
     status = ssl_handshaker_get_bytes_to_send_to_peer(
-        impl, impl->outgoing_bytes_buffer + offset, &to_send_size);
+        impl, impl->outgoing_bytes_buffer + offset, &to_send_size, error);
     offset += to_send_size;
     if (status == TSI_INCOMPLETE_DATA) {
       impl->outgoing_bytes_buffer_size *= 2;
@@ -1582,15 +1600,19 @@ static tsi_result ssl_handshaker_write_output_buffer(tsi_handshaker* self,
   return status;
 }
 
-static tsi_result ssl_handshaker_next(
-    tsi_handshaker* self, const unsigned char* received_bytes,
-    size_t received_bytes_size, const unsigned char** bytes_to_send,
-    size_t* bytes_to_send_size, tsi_handshaker_result** handshaker_result,
-    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/) {
+static tsi_result ssl_handshaker_next(tsi_handshaker* self,
+                                      const unsigned char* received_bytes,
+                                      size_t received_bytes_size,
+                                      const unsigned char** bytes_to_send,
+                                      size_t* bytes_to_send_size,
+                                      tsi_handshaker_result** handshaker_result,
+                                      tsi_handshaker_on_next_done_cb /*cb*/,
+                                      void* /*user_data*/, std::string* error) {
   /* Input sanity check.  */
   if ((received_bytes_size > 0 && received_bytes == nullptr) ||
       bytes_to_send == nullptr || bytes_to_send_size == nullptr ||
       handshaker_result == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   /* If there are received bytes, process them first.  */
@@ -1600,16 +1622,16 @@ static tsi_result ssl_handshaker_next(
   size_t bytes_written = 0;
   if (received_bytes_size > 0) {
     status = ssl_handshaker_process_bytes_from_peer(impl, received_bytes,
-                                                    &bytes_consumed);
+                                                    &bytes_consumed, error);
     while (status == TSI_DRAIN_BUFFER) {
-      status = ssl_handshaker_write_output_buffer(self, &bytes_written);
+      status = ssl_handshaker_write_output_buffer(self, &bytes_written, error);
       if (status != TSI_OK) return status;
-      status = ssl_handshaker_do_handshake(impl);
+      status = ssl_handshaker_do_handshake(impl, error);
     }
   }
   if (status != TSI_OK) return status;
   /* Get bytes to send to the peer, if available.  */
-  status = ssl_handshaker_write_output_buffer(self, &bytes_written);
+  status = ssl_handshaker_write_output_buffer(self, &bytes_written, error);
   if (status != TSI_OK) return status;
   *bytes_to_send = impl->outgoing_bytes_buffer;
   *bytes_to_send_size = bytes_written;
@@ -1623,15 +1645,17 @@ static tsi_result ssl_handshaker_next(
     // peer that must be processed.
     unsigned char* unused_bytes = nullptr;
     size_t unused_bytes_size = 0;
-    status = ssl_bytes_remaining(impl, &unused_bytes, &unused_bytes_size);
+    status =
+        ssl_bytes_remaining(impl, &unused_bytes, &unused_bytes_size, error);
     if (status != TSI_OK) return status;
     if (unused_bytes_size > received_bytes_size) {
       gpr_log(GPR_ERROR, "More unused bytes than received bytes.");
       gpr_free(unused_bytes);
+      if (error != nullptr) *error = "More unused bytes than received bytes.";
       return TSI_INTERNAL_ERROR;
     }
     status = ssl_handshaker_result_create(impl, unused_bytes, unused_bytes_size,
-                                          handshaker_result);
+                                          handshaker_result, error);
     if (status == TSI_OK) {
       /* Indicates that the handshake has completed and that a handshaker_result
        * has been created. */

data/src/core/tsi/transport_security.cc

@@ -216,14 +216,26 @@ tsi_result tsi_handshaker_next(
     tsi_handshaker* self, const unsigned char* received_bytes,
     size_t received_bytes_size, const unsigned char** bytes_to_send,
     size_t* bytes_to_send_size, tsi_handshaker_result** handshaker_result,
-    tsi_handshaker_on_next_done_cb cb, void* user_data) {
-  if (self == nullptr || self->vtable == nullptr) return TSI_INVALID_ARGUMENT;
-  if (self->handshaker_result_created) return TSI_FAILED_PRECONDITION;
-  if (self->handshake_shutdown) return TSI_HANDSHAKE_SHUTDOWN;
-  if (self->vtable->next == nullptr) return TSI_UNIMPLEMENTED;
+    tsi_handshaker_on_next_done_cb cb, void* user_data, std::string* error) {
+  if (self == nullptr || self->vtable == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
+    return TSI_INVALID_ARGUMENT;
+  }
+  if (self->handshaker_result_created) {
+    if (error != nullptr) *error = "handshaker already returned a result";
+    return TSI_FAILED_PRECONDITION;
+  }
+  if (self->handshake_shutdown) {
+    if (error != nullptr) *error = "handshaker shutdown";
+    return TSI_HANDSHAKE_SHUTDOWN;
+  }
+  if (self->vtable->next == nullptr) {
+    if (error != nullptr) *error = "TSI handshaker does not implement next()";
+    return TSI_UNIMPLEMENTED;
+  }
   return self->vtable->next(self, received_bytes, received_bytes_size,
                             bytes_to_send, bytes_to_send_size,
-                            handshaker_result, cb, user_data);
+                            handshaker_result, cb, user_data, error);
 }
 
 void tsi_handshaker_shutdown(tsi_handshaker* self) {

data/src/core/tsi/transport_security.h

@@ -78,7 +78,8 @@ struct tsi_handshaker_vtable {
                      const unsigned char** bytes_to_send,
                      size_t* bytes_to_send_size,
                      tsi_handshaker_result** handshaker_result,
-                     tsi_handshaker_on_next_done_cb cb, void* user_data);
+                     tsi_handshaker_on_next_done_cb cb, void* user_data,
+                     std::string* error);
   void (*shutdown)(tsi_handshaker* self);
 };
 struct tsi_handshaker {

data/src/core/tsi/transport_security_grpc.cc

@@ -51,13 +51,14 @@ tsi_result tsi_zero_copy_grpc_protector_protect(
 
 tsi_result tsi_zero_copy_grpc_protector_unprotect(
     tsi_zero_copy_grpc_protector* self, grpc_slice_buffer* protected_slices,
-    grpc_slice_buffer* unprotected_slices) {
+    grpc_slice_buffer* unprotected_slices, int* min_progress_size) {
   if (self == nullptr || self->vtable == nullptr ||
       protected_slices == nullptr || unprotected_slices == nullptr) {
     return TSI_INVALID_ARGUMENT;
   }
   if (self->vtable->unprotect == nullptr) return TSI_UNIMPLEMENTED;
-  return self->vtable->unprotect(self, protected_slices, unprotected_slices);
+  return self->vtable->unprotect(self, protected_slices, unprotected_slices,
+                                 min_progress_size);
 }
 
 void tsi_zero_copy_grpc_protector_destroy(tsi_zero_copy_grpc_protector* self) {