grpc 1.48.0 → 1.49.1

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc

@@ -416,7 +416,7 @@ static void on_handshaker_service_resp_recv_dedicated(
 static tsi_result alts_tsi_handshaker_continue_handshaker_next(
     alts_tsi_handshaker* handshaker, const unsigned char* received_bytes,
     size_t received_bytes_size, tsi_handshaker_on_next_done_cb cb,
-    void* user_data) {
+    void* user_data, std::string* error) {
   if (!handshaker->has_created_handshaker_client) {
     if (handshaker->channel == nullptr) {
       grpc_alts_shared_resource_dedicated_start(
@@ -437,9 +437,10 @@ static tsi_result alts_tsi_handshaker_continue_handshaker_next(
         handshaker->interested_parties, handshaker->options,
         handshaker->target_name, grpc_cb, cb, user_data,
         handshaker->client_vtable_for_testing, handshaker->is_client,
-        handshaker->max_frame_size);
+        handshaker->max_frame_size, error);
     if (client == nullptr) {
       gpr_log(GPR_ERROR, "Failed to create ALTS handshaker client");
+      if (error != nullptr) *error = "Failed to create ALTS handshaker client";
       return TSI_FAILED_PRECONDITION;
     }
     {
@@ -448,6 +449,7 @@ static tsi_result alts_tsi_handshaker_continue_handshaker_next(
       handshaker->client = client;
       if (handshaker->shutdown) {
         gpr_log(GPR_INFO, "TSI handshake shutdown");
+        if (error != nullptr) *error = "TSI handshaker shutdown";
         return TSI_HANDSHAKE_SHUTDOWN;
       }
     }
@@ -490,6 +492,7 @@ struct alts_tsi_handshaker_continue_handshaker_next_args {
   tsi_handshaker_on_next_done_cb cb;
   void* user_data;
   grpc_closure closure;
+  std::string* error = nullptr;
 };
 
 static void alts_tsi_handshaker_create_channel(
@@ -510,7 +513,8 @@ static void alts_tsi_handshaker_create_channel(
   tsi_result continue_next_result =
       alts_tsi_handshaker_continue_handshaker_next(
           handshaker, next_args->received_bytes.get(),
-          next_args->received_bytes_size, next_args->cb, next_args->user_data);
+          next_args->received_bytes_size, next_args->cb, next_args->user_data,
+          next_args->error);
   if (continue_next_result != TSI_OK) {
     next_args->cb(continue_next_result, next_args->user_data, nullptr, 0,
                   nullptr);
@@ -522,9 +526,10 @@ static tsi_result handshaker_next(
     tsi_handshaker* self, const unsigned char* received_bytes,
     size_t received_bytes_size, const unsigned char** /*bytes_to_send*/,
     size_t* /*bytes_to_send_size*/, tsi_handshaker_result** /*result*/,
-    tsi_handshaker_on_next_done_cb cb, void* user_data) {
+    tsi_handshaker_on_next_done_cb cb, void* user_data, std::string* error) {
   if (self == nullptr || cb == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to handshaker_next()");
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   alts_tsi_handshaker* handshaker =
@@ -533,6 +538,7 @@ static tsi_result handshaker_next(
     grpc_core::MutexLock lock(&handshaker->mu);
     if (handshaker->shutdown) {
       gpr_log(GPR_INFO, "TSI handshake shutdown");
+      if (error != nullptr) *error = "handshake shutdown";
       return TSI_HANDSHAKE_SHUTDOWN;
     }
   }
@@ -542,6 +548,7 @@ static tsi_result handshaker_next(
     args->handshaker = handshaker;
     args->received_bytes = nullptr;
     args->received_bytes_size = received_bytes_size;
+    args->error = error;
     if (received_bytes_size > 0) {
       args->received_bytes = std::unique_ptr<unsigned char>(
           static_cast<unsigned char*>(gpr_zalloc(received_bytes_size)));
@@ -559,7 +566,7 @@ static tsi_result handshaker_next(
     grpc_core::ExecCtx::Run(DEBUG_LOCATION, &args->closure, GRPC_ERROR_NONE);
   } else {
     tsi_result ok = alts_tsi_handshaker_continue_handshaker_next(
-        handshaker, received_bytes, received_bytes_size, cb, user_data);
+        handshaker, received_bytes, received_bytes_size, cb, user_data, error);
     if (ok != TSI_OK) {
       gpr_log(GPR_ERROR, "Failed to schedule ALTS handshaker requests");
       return ok;
@@ -577,11 +584,11 @@ static tsi_result handshaker_next_dedicated(
     tsi_handshaker* self, const unsigned char* received_bytes,
     size_t received_bytes_size, const unsigned char** bytes_to_send,
     size_t* bytes_to_send_size, tsi_handshaker_result** result,
-    tsi_handshaker_on_next_done_cb cb, void* user_data) {
+    tsi_handshaker_on_next_done_cb cb, void* user_data, std::string* error) {
   grpc_core::ExecCtx exec_ctx;
   return handshaker_next(self, received_bytes, received_bytes_size,
                          bytes_to_send, bytes_to_send_size, result, cb,
-                         user_data);
+                         user_data, error);
 }
 
 static void handshaker_shutdown(tsi_handshaker* self) {

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker_private.h

@@ -63,7 +63,7 @@ void alts_handshaker_client_check_fields_for_testing(
 void alts_handshaker_client_set_fields_for_testing(
     alts_handshaker_client* client, alts_tsi_handshaker* handshaker,
     tsi_handshaker_on_next_done_cb cb, void* user_data,
-    grpc_byte_buffer* recv_buffer, grpc_status_code status);
+    grpc_byte_buffer* recv_buffer, bool inject_read_failure);
 
 void alts_handshaker_client_set_vtable_for_testing(
     alts_handshaker_client* client, alts_handshaker_client_vtable* vtable);

data/src/core/tsi/fake_transport_security.cc

@@ -96,7 +96,8 @@ static const char* tsi_fake_handshake_message_to_string(int msg) {
 }
 
 static tsi_result tsi_fake_handshake_message_from_string(
-    const char* msg_string, tsi_fake_handshake_message* msg) {
+    const char* msg_string, tsi_fake_handshake_message* msg,
+    std::string* error) {
   for (int i = 0; i < TSI_FAKE_HANDSHAKE_MESSAGE_MAX; i++) {
     if (strncmp(msg_string, tsi_fake_handshake_message_strings[i],
                 strlen(tsi_fake_handshake_message_strings[i])) == 0) {
@@ -105,6 +106,7 @@ static tsi_result tsi_fake_handshake_message_from_string(
     }
   }
   gpr_log(GPR_ERROR, "Invalid handshake message.");
+  if (error != nullptr) *error = "invalid handshake message";
   return TSI_DATA_CORRUPTED;
 }
 
@@ -174,12 +176,16 @@ static void tsi_fake_frame_ensure_size(tsi_fake_frame* frame) {
  * This method should not be called if frame->needs_framing is not 0.  */
 static tsi_result tsi_fake_frame_decode(const unsigned char* incoming_bytes,
                                         size_t* incoming_bytes_size,
-                                        tsi_fake_frame* frame) {
+                                        tsi_fake_frame* frame,
+                                        std::string* error) {
   size_t available_size = *incoming_bytes_size;
   size_t to_read_size = 0;
   const unsigned char* bytes_cursor = incoming_bytes;
 
-  if (frame->needs_draining) return TSI_INTERNAL_ERROR;
+  if (frame->needs_draining) {
+    if (error != nullptr) *error = "fake handshaker frame needs draining";
+    return TSI_INTERNAL_ERROR;
+  }
   if (frame->data == nullptr) {
     frame->allocated_size = TSI_FAKE_FRAME_INITIAL_ALLOCATED_SIZE;
     frame->data =
@@ -224,9 +230,13 @@ static tsi_result tsi_fake_frame_decode(const unsigned char* incoming_bytes,
  * This method should not be called if frame->needs_framing is 0.  */
 static tsi_result tsi_fake_frame_encode(unsigned char* outgoing_bytes,
                                         size_t* outgoing_bytes_size,
-                                        tsi_fake_frame* frame) {
+                                        tsi_fake_frame* frame,
+                                        std::string* error) {
   size_t to_write_size = frame->size - frame->offset;
-  if (!frame->needs_draining) return TSI_INTERNAL_ERROR;
+  if (!frame->needs_draining) {
+    if (error != nullptr) *error = "fake frame needs draining";
+    return TSI_INTERNAL_ERROR;
+  }
   if (*outgoing_bytes_size < to_write_size) {
     memcpy(outgoing_bytes, frame->data + frame->offset, *outgoing_bytes_size);
     frame->offset += *outgoing_bytes_size;
@@ -240,15 +250,14 @@ static tsi_result tsi_fake_frame_encode(unsigned char* outgoing_bytes,
 
 /* Sets the payload of a fake frame to contain the given data blob, where
  * data_size indicates the size of data. */
-static tsi_result tsi_fake_frame_set_data(unsigned char* data, size_t data_size,
-                                          tsi_fake_frame* frame) {
+static void tsi_fake_frame_set_data(unsigned char* data, size_t data_size,
+                                    tsi_fake_frame* frame) {
   frame->offset = 0;
   frame->size = data_size + TSI_FAKE_FRAME_HEADER_SIZE;
   tsi_fake_frame_ensure_size(frame);
   store32_little_endian(static_cast<uint32_t>(frame->size), frame->data);
   memcpy(frame->data + TSI_FAKE_FRAME_HEADER_SIZE, data, data_size);
   tsi_fake_frame_reset(frame, 1 /* needs draining */);
-  return TSI_OK;
 }
 
 /* Destroys the contents of a fake frame. */
@@ -276,8 +285,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
   /* Try to drain first. */
   if (frame->needs_draining) {
     drained_size = saved_output_size - *num_bytes_written;
-    result =
-        tsi_fake_frame_encode(protected_output_frames, &drained_size, frame);
+    result = tsi_fake_frame_encode(protected_output_frames, &drained_size,
+                                   frame, /*error=*/nullptr);
     *num_bytes_written += drained_size;
     protected_output_frames += drained_size;
     if (result != TSI_OK) {
@@ -297,7 +306,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
     store32_little_endian(static_cast<uint32_t>(impl->max_frame_size),
                           frame_header);
     written_in_frame_size = TSI_FAKE_FRAME_HEADER_SIZE;
-    result = tsi_fake_frame_decode(frame_header, &written_in_frame_size, frame);
+    result = tsi_fake_frame_decode(frame_header, &written_in_frame_size, frame,
+                                   /*error=*/nullptr);
     if (result != TSI_INCOMPLETE_DATA) {
       gpr_log(GPR_ERROR, "tsi_fake_frame_decode returned %s",
               tsi_result_to_string(result));
@@ -305,7 +315,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
     }
   }
   result =
-      tsi_fake_frame_decode(unprotected_bytes, unprotected_bytes_size, frame);
+      tsi_fake_frame_decode(unprotected_bytes, unprotected_bytes_size, frame,
+                            /*error=*/nullptr);
   if (result != TSI_OK) {
     if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
     return result;
@@ -315,7 +326,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
   if (!frame->needs_draining) return TSI_INTERNAL_ERROR;
   if (frame->offset != 0) return TSI_INTERNAL_ERROR;
   drained_size = saved_output_size - *num_bytes_written;
-  result = tsi_fake_frame_encode(protected_output_frames, &drained_size, frame);
+  result = tsi_fake_frame_encode(protected_output_frames, &drained_size, frame,
+                                 /*error=*/nullptr);
   *num_bytes_written += drained_size;
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   return result;
@@ -337,7 +349,8 @@ static tsi_result fake_protector_protect_flush(
                           frame->data); /* Overwrite header. */
   }
   result = tsi_fake_frame_encode(protected_output_frames,
-                                 protected_output_frames_size, frame);
+                                 protected_output_frames_size, frame,
+                                 /*error=*/nullptr);
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   *still_pending_size = frame->size - frame->offset;
   return result;
@@ -361,7 +374,8 @@ static tsi_result fake_protector_unprotect(
     /* Go past the header if needed. */
     if (frame->offset == 0) frame->offset = TSI_FAKE_FRAME_HEADER_SIZE;
     drained_size = saved_output_size - *num_bytes_written;
-    result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame);
+    result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame,
+                                   /*error=*/nullptr);
     unprotected_bytes += drained_size;
     *num_bytes_written += drained_size;
     if (result != TSI_OK) {
@@ -376,7 +390,8 @@ static tsi_result fake_protector_unprotect(
   /* Now process the protected_bytes. */
   if (frame->needs_draining) return TSI_INTERNAL_ERROR;
   result = tsi_fake_frame_decode(protected_frames_bytes,
-                                 protected_frames_bytes_size, frame);
+                                 protected_frames_bytes_size, frame,
+                                 /*error=*/nullptr);
   if (result != TSI_OK) {
     if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
     return result;
@@ -387,7 +402,8 @@ static tsi_result fake_protector_unprotect(
   if (frame->offset != 0) return TSI_INTERNAL_ERROR;
   frame->offset = TSI_FAKE_FRAME_HEADER_SIZE; /* Go past the header. */
   drained_size = saved_output_size - *num_bytes_written;
-  result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame);
+  result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame,
+                                 /*error=*/nullptr);
   *num_bytes_written += drained_size;
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   return result;
@@ -579,9 +595,10 @@ static const tsi_handshaker_result_vtable handshaker_result_vtable = {
 
 static tsi_result fake_handshaker_result_create(
     const unsigned char* unused_bytes, size_t unused_bytes_size,
-    tsi_handshaker_result** handshaker_result) {
+    tsi_handshaker_result** handshaker_result, std::string* error) {
   if ((unused_bytes_size > 0 && unused_bytes == nullptr) ||
       handshaker_result == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   fake_handshaker_result* result = grpc_core::Zalloc<fake_handshaker_result>();
@@ -599,7 +616,8 @@ static tsi_result fake_handshaker_result_create(
 /* --- tsi_handshaker methods implementation. ---*/
 
 static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
-    tsi_handshaker* self, unsigned char* bytes, size_t* bytes_size) {
+    tsi_handshaker* self, unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   tsi_fake_handshaker* impl = reinterpret_cast<tsi_fake_handshaker*>(self);
   tsi_result result = TSI_OK;
   if (impl->needs_incoming_message || impl->result == TSI_OK) {
@@ -612,10 +630,9 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
         static_cast<tsi_fake_handshake_message>(impl->next_message_to_send + 2);
     const char* msg_string =
         tsi_fake_handshake_message_to_string(impl->next_message_to_send);
-    result = tsi_fake_frame_set_data(
+    tsi_fake_frame_set_data(
         reinterpret_cast<unsigned char*>(const_cast<char*>(msg_string)),
         strlen(msg_string), &impl->outgoing_frame);
-    if (result != TSI_OK) return result;
     if (next_message_to_send > TSI_FAKE_HANDSHAKE_MESSAGE_MAX) {
       next_message_to_send = TSI_FAKE_HANDSHAKE_MESSAGE_MAX;
     }
@@ -626,7 +643,8 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
     }
     impl->next_message_to_send = next_message_to_send;
   }
-  result = tsi_fake_frame_encode(bytes, bytes_size, &impl->outgoing_frame);
+  result =
+      tsi_fake_frame_encode(bytes, bytes_size, &impl->outgoing_frame, error);
   if (result != TSI_OK) return result;
   if (!impl->is_client &&
       impl->next_message_to_send == TSI_FAKE_HANDSHAKE_MESSAGE_MAX) {
@@ -642,7 +660,8 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
 }
 
 static tsi_result fake_handshaker_process_bytes_from_peer(
-    tsi_handshaker* self, const unsigned char* bytes, size_t* bytes_size) {
+    tsi_handshaker* self, const unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   tsi_result result = TSI_OK;
   tsi_fake_handshaker* impl = reinterpret_cast<tsi_fake_handshaker*>(self);
   tsi_fake_handshake_message expected_msg =
@@ -653,14 +672,15 @@ static tsi_result fake_handshaker_process_bytes_from_peer(
     *bytes_size = 0;
     return TSI_OK;
   }
-  result = tsi_fake_frame_decode(bytes, bytes_size, &impl->incoming_frame);
+  result =
+      tsi_fake_frame_decode(bytes, bytes_size, &impl->incoming_frame, error);
   if (result != TSI_OK) return result;
 
   /* We now have a complete frame. */
   result = tsi_fake_handshake_message_from_string(
       reinterpret_cast<const char*>(impl->incoming_frame.data) +
           TSI_FAKE_FRAME_HEADER_SIZE,
-      &received_msg);
+      &received_msg, error);
   if (result != TSI_OK) {
     impl->result = result;
     return result;
@@ -703,11 +723,13 @@ static tsi_result fake_handshaker_next(
     tsi_handshaker* self, const unsigned char* received_bytes,
     size_t received_bytes_size, const unsigned char** bytes_to_send,
     size_t* bytes_to_send_size, tsi_handshaker_result** handshaker_result,
-    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/) {
+    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/,
+    std::string* error) {
   /* Sanity check the arguments. */
   if ((received_bytes_size > 0 && received_bytes == nullptr) ||
       bytes_to_send == nullptr || bytes_to_send_size == nullptr ||
       handshaker_result == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   tsi_fake_handshaker* handshaker =
@@ -717,8 +739,8 @@ static tsi_result fake_handshaker_next(
   /* Decode and process a handshake frame from the peer. */
   size_t consumed_bytes_size = received_bytes_size;
   if (received_bytes_size > 0) {
-    result = fake_handshaker_process_bytes_from_peer(self, received_bytes,
-                                                     &consumed_bytes_size);
+    result = fake_handshaker_process_bytes_from_peer(
+        self, received_bytes, &consumed_bytes_size, error);
     if (result != TSI_OK) return result;
   }
 
@@ -728,7 +750,8 @@ static tsi_result fake_handshaker_next(
   do {
     size_t sent_bytes_size = handshaker->outgoing_bytes_buffer_size - offset;
     result = fake_handshaker_get_bytes_to_send_to_peer(
-        self, handshaker->outgoing_bytes_buffer + offset, &sent_bytes_size);
+        self, handshaker->outgoing_bytes_buffer + offset, &sent_bytes_size,
+        error);
     offset += sent_bytes_size;
     if (result == TSI_INCOMPLETE_DATA) {
       handshaker->outgoing_bytes_buffer_size *= 2;
@@ -754,7 +777,7 @@ static tsi_result fake_handshaker_next(
 
     /* Create a handshaker_result containing the unused bytes. */
     result = fake_handshaker_result_create(unused_bytes, unused_bytes_size,
-                                           handshaker_result);
+                                           handshaker_result, error);
     if (result == TSI_OK) {
       /* Indicate that the handshake has completed and that a handshaker_result
        * has been created. */

data/src/core/tsi/local_transport_security.cc

@@ -119,13 +119,17 @@ tsi_result create_handshaker_result(const unsigned char* received_bytes,
 
 /* --- tsi_handshaker methods implementation. --- */
 
-tsi_result handshaker_next(
-    tsi_handshaker* self, const unsigned char* received_bytes,
-    size_t received_bytes_size, const unsigned char** /*bytes_to_send*/,
-    size_t* bytes_to_send_size, tsi_handshaker_result** result,
-    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/) {
+tsi_result handshaker_next(tsi_handshaker* self,
+                           const unsigned char* received_bytes,
+                           size_t received_bytes_size,
+                           const unsigned char** /*bytes_to_send*/,
+                           size_t* bytes_to_send_size,
+                           tsi_handshaker_result** result,
+                           tsi_handshaker_on_next_done_cb /*cb*/,
+                           void* /*user_data*/, std::string* error) {
   if (self == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to handshaker_next()");
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   /* Note that there is no interaction between TSI peers, and all operations are

data/src/core/tsi/ssl/session_cache/ssl_session_cache.h

@@ -25,9 +25,11 @@
 
 #include <openssl/ssl.h>
 
+#include <grpc/impl/codegen/grpc_types.h>
 #include <grpc/slice.h>
 #include <grpc/support/sync.h>
 
+#include "src/core/lib/gprpp/cpp_impl_of.h"
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/sync.h"
@@ -44,7 +46,10 @@
 
 namespace tsi {
 
-class SslSessionLRUCache : public grpc_core::RefCounted<SslSessionLRUCache> {
+class SslSessionLRUCache
+    : public grpc_core::CppImplOf<SslSessionLRUCache,
+                                  struct tsi_ssl_session_cache>,
+      public grpc_core::RefCounted<SslSessionLRUCache> {
  public:
   /// Create new LRU cache with the given capacity.
   static grpc_core::RefCountedPtr<SslSessionLRUCache> Create(size_t capacity) {
@@ -59,6 +64,10 @@ class SslSessionLRUCache : public grpc_core::RefCounted<SslSessionLRUCache> {
   SslSessionLRUCache(const SslSessionLRUCache&) = delete;
   SslSessionLRUCache& operator=(const SslSessionLRUCache&) = delete;
 
+  static absl::string_view ChannelArgName() {
+    return GRPC_SSL_SESSION_CACHE_ARG;
+  }
+
   /// Returns current number of sessions in the cache.
   size_t Size();
   /// Add \a session in the cache using \a key. This operation may discard older

data/src/core/tsi/ssl_transport_security.cc

@@ -45,6 +45,7 @@
 #include <openssl/x509v3.h>
 
 #include "absl/strings/match.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 
 #include <grpc/grpc_security.h>
@@ -1036,17 +1037,16 @@ void tsi_ssl_root_certs_store_destroy(tsi_ssl_root_certs_store* self) {
 
 tsi_ssl_session_cache* tsi_ssl_session_cache_create_lru(size_t capacity) {
   /* Pointer will be dereferenced by unref call. */
-  return reinterpret_cast<tsi_ssl_session_cache*>(
-      tsi::SslSessionLRUCache::Create(capacity).release());
+  return tsi::SslSessionLRUCache::Create(capacity).release()->c_ptr();
 }
 
 void tsi_ssl_session_cache_ref(tsi_ssl_session_cache* cache) {
   /* Pointer will be dereferenced by unref call. */
-  reinterpret_cast<tsi::SslSessionLRUCache*>(cache)->Ref().release();
+  tsi::SslSessionLRUCache::FromC(cache)->Ref().release();
 }
 
 void tsi_ssl_session_cache_unref(tsi_ssl_session_cache* cache) {
-  reinterpret_cast<tsi::SslSessionLRUCache*>(cache)->Unref();
+  tsi::SslSessionLRUCache::FromC(cache)->Unref();
 }
 
 /* --- tsi_frame_protector methods implementation. ---*/
@@ -1416,9 +1416,11 @@ static const tsi_handshaker_result_vtable handshaker_result_vtable = {
 
 static tsi_result ssl_handshaker_result_create(
     tsi_ssl_handshaker* handshaker, unsigned char* unused_bytes,
-    size_t unused_bytes_size, tsi_handshaker_result** handshaker_result) {
+    size_t unused_bytes_size, tsi_handshaker_result** handshaker_result,
+    std::string* error) {
   if (handshaker == nullptr || handshaker_result == nullptr ||
       (unused_bytes_size > 0 && unused_bytes == nullptr)) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   tsi_ssl_handshaker_result* result =
@@ -1439,9 +1441,11 @@ static tsi_result ssl_handshaker_result_create(
 /* --- tsi_handshaker methods implementation. ---*/
 
 static tsi_result ssl_handshaker_get_bytes_to_send_to_peer(
-    tsi_ssl_handshaker* impl, unsigned char* bytes, size_t* bytes_size) {
+    tsi_ssl_handshaker* impl, unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   int bytes_read_from_ssl = 0;
   if (bytes == nullptr || bytes_size == nullptr || *bytes_size > INT_MAX) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   GPR_ASSERT(*bytes_size <= INT_MAX);
@@ -1450,6 +1454,7 @@ static tsi_result ssl_handshaker_get_bytes_to_send_to_peer(
   if (bytes_read_from_ssl < 0) {
     *bytes_size = 0;
     if (!BIO_should_retry(impl->network_io)) {
+      if (error != nullptr) *error = "error reading from BIO";
       impl->result = TSI_INTERNAL_ERROR;
       return impl->result;
     } else {
@@ -1468,7 +1473,8 @@ static tsi_result ssl_handshaker_get_result(tsi_ssl_handshaker* impl) {
   return impl->result;
 }
 
-static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl) {
+static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl,
+                                              std::string* error) {
   if (ssl_handshaker_get_result(impl) != TSI_HANDSHAKE_IN_PROGRESS) {
     impl->result = TSI_OK;
     return impl->result;
@@ -1494,6 +1500,9 @@ static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl) {
         ERR_error_string_n(ERR_get_error(), err_str, sizeof(err_str));
         gpr_log(GPR_ERROR, "Handshake failed with fatal error %s: %s.",
                 ssl_error_string(ssl_result), err_str);
+        if (error != nullptr) {
+          *error = absl::StrCat(ssl_error_string(ssl_result), ": ", err_str);
+        }
         impl->result = TSI_PROTOCOL_FAILURE;
         return impl->result;
       }
@@ -1502,9 +1511,11 @@ static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl) {
 }
 
 static tsi_result ssl_handshaker_process_bytes_from_peer(
-    tsi_ssl_handshaker* impl, const unsigned char* bytes, size_t* bytes_size) {
+    tsi_ssl_handshaker* impl, const unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   int bytes_written_into_ssl_size = 0;
   if (bytes == nullptr || bytes_size == nullptr || *bytes_size > INT_MAX) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   GPR_ASSERT(*bytes_size <= INT_MAX);
@@ -1512,11 +1523,12 @@ static tsi_result ssl_handshaker_process_bytes_from_peer(
       BIO_write(impl->network_io, bytes, static_cast<int>(*bytes_size));
   if (bytes_written_into_ssl_size < 0) {
     gpr_log(GPR_ERROR, "Could not write to memory BIO.");
+    if (error != nullptr) *error = "could not write to memory BIO";
     impl->result = TSI_INTERNAL_ERROR;
     return impl->result;
   }
   *bytes_size = static_cast<size_t>(bytes_written_into_ssl_size);
-  return ssl_handshaker_do_handshake(impl);
+  return ssl_handshaker_do_handshake(impl, error);
 }
 
 static void ssl_handshaker_destroy(tsi_handshaker* self) {
@@ -1532,9 +1544,11 @@ static void ssl_handshaker_destroy(tsi_handshaker* self) {
 // |bytes_remaining|.
 static tsi_result ssl_bytes_remaining(tsi_ssl_handshaker* impl,
                                       unsigned char** bytes_remaining,
-                                      size_t* bytes_remaining_size) {
+                                      size_t* bytes_remaining_size,
+                                      std::string* error) {
   if (impl == nullptr || bytes_remaining == nullptr ||
       bytes_remaining_size == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   // Atempt to read all of the bytes in SSL's read BIO. These bytes should
@@ -1552,6 +1566,9 @@ static tsi_result ssl_bytes_remaining(tsi_ssl_handshaker* impl,
             "Failed to read the expected number of bytes from SSL object.");
     gpr_free(*bytes_remaining);
     *bytes_remaining = nullptr;
+    if (error != nullptr) {
+      *error = "Failed to read the expected number of bytes from SSL object.";
+    }
     return TSI_INTERNAL_ERROR;
   }
   *bytes_remaining_size = static_cast<size_t>(bytes_read);
@@ -1563,14 +1580,15 @@ static tsi_result ssl_bytes_remaining(tsi_ssl_handshaker* impl,
 // This API needs to be repeatedly called until all handshake data are
 // received from SSL.
 static tsi_result ssl_handshaker_write_output_buffer(tsi_handshaker* self,
-                                                     size_t* bytes_written) {
+                                                     size_t* bytes_written,
+                                                     std::string* error) {
   tsi_ssl_handshaker* impl = reinterpret_cast<tsi_ssl_handshaker*>(self);
   tsi_result status = TSI_OK;
   size_t offset = *bytes_written;
   do {
     size_t to_send_size = impl->outgoing_bytes_buffer_size - offset;
     status = ssl_handshaker_get_bytes_to_send_to_peer(
-        impl, impl->outgoing_bytes_buffer + offset, &to_send_size);
+        impl, impl->outgoing_bytes_buffer + offset, &to_send_size, error);
     offset += to_send_size;
     if (status == TSI_INCOMPLETE_DATA) {
       impl->outgoing_bytes_buffer_size *= 2;
@@ -1582,15 +1600,19 @@ static tsi_result ssl_handshaker_write_output_buffer(tsi_handshaker* self,
   return status;
 }
 
-static tsi_result ssl_handshaker_next(
-    tsi_handshaker* self, const unsigned char* received_bytes,
-    size_t received_bytes_size, const unsigned char** bytes_to_send,
-    size_t* bytes_to_send_size, tsi_handshaker_result** handshaker_result,
-    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/) {
+static tsi_result ssl_handshaker_next(tsi_handshaker* self,
+                                      const unsigned char* received_bytes,
+                                      size_t received_bytes_size,
+                                      const unsigned char** bytes_to_send,
+                                      size_t* bytes_to_send_size,
+                                      tsi_handshaker_result** handshaker_result,
+                                      tsi_handshaker_on_next_done_cb /*cb*/,
+                                      void* /*user_data*/, std::string* error) {
   /* Input sanity check.  */
   if ((received_bytes_size > 0 && received_bytes == nullptr) ||
       bytes_to_send == nullptr || bytes_to_send_size == nullptr ||
       handshaker_result == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   /* If there are received bytes, process them first.  */
@@ -1600,16 +1622,16 @@ static tsi_result ssl_handshaker_next(
   size_t bytes_written = 0;
   if (received_bytes_size > 0) {
     status = ssl_handshaker_process_bytes_from_peer(impl, received_bytes,
-                                                    &bytes_consumed);
+                                                    &bytes_consumed, error);
     while (status == TSI_DRAIN_BUFFER) {
-      status = ssl_handshaker_write_output_buffer(self, &bytes_written);
+      status = ssl_handshaker_write_output_buffer(self, &bytes_written, error);
       if (status != TSI_OK) return status;
-      status = ssl_handshaker_do_handshake(impl);
+      status = ssl_handshaker_do_handshake(impl, error);
     }
   }
   if (status != TSI_OK) return status;
   /* Get bytes to send to the peer, if available.  */
-  status = ssl_handshaker_write_output_buffer(self, &bytes_written);
+  status = ssl_handshaker_write_output_buffer(self, &bytes_written, error);
   if (status != TSI_OK) return status;
   *bytes_to_send = impl->outgoing_bytes_buffer;
   *bytes_to_send_size = bytes_written;
@@ -1623,15 +1645,17 @@ static tsi_result ssl_handshaker_next(
     // peer that must be processed.
     unsigned char* unused_bytes = nullptr;
     size_t unused_bytes_size = 0;
-    status = ssl_bytes_remaining(impl, &unused_bytes, &unused_bytes_size);
+    status =
+        ssl_bytes_remaining(impl, &unused_bytes, &unused_bytes_size, error);
     if (status != TSI_OK) return status;
     if (unused_bytes_size > received_bytes_size) {
       gpr_log(GPR_ERROR, "More unused bytes than received bytes.");
       gpr_free(unused_bytes);
+      if (error != nullptr) *error = "More unused bytes than received bytes.";
       return TSI_INTERNAL_ERROR;
     }
     status = ssl_handshaker_result_create(impl, unused_bytes, unused_bytes_size,
-                                          handshaker_result);
+                                          handshaker_result, error);
     if (status == TSI_OK) {
       /* Indicates that the handshake has completed and that a handshaker_result
        * has been created. */