grpc 1.48.0 → 1.50.0

data/src/core/tsi/alts/handshaker/alts_handshaker_client.cc

@@ -71,7 +71,8 @@ typedef struct alts_grpc_handshaker_client {
    * handshaker service. */
   grpc_byte_buffer* send_buffer = nullptr;
   grpc_byte_buffer* recv_buffer = nullptr;
-  grpc_status_code status = GRPC_STATUS_OK;
+  // Used to inject a read failure from tests.
+  bool inject_read_failure = false;
   /* Initial metadata to be received from handshaker service. */
   grpc_metadata_array recv_initial_metadata;
   /* A callback function provided by an application to be invoked when response
@@ -106,6 +107,8 @@ typedef struct alts_grpc_handshaker_client {
   recv_message_result* pending_recv_message_result = nullptr;
   /* Maximum frame size used by frame protector. */
   size_t max_frame_size;
+  // If non-null, will be populated with an error string upon error.
+  std::string* error;
 } alts_grpc_handshaker_client;
 
 static void handshaker_client_send_buffer_destroy(
@@ -174,10 +177,11 @@ static void maybe_complete_tsi_next(
 }
 
 static void handle_response_done(alts_grpc_handshaker_client* client,
-                                 tsi_result status,
+                                 tsi_result status, std::string error,
                                  const unsigned char* bytes_to_send,
                                  size_t bytes_to_send_size,
                                  tsi_handshaker_result* result) {
+  if (client->error != nullptr) *client->error = std::move(error);
   recv_message_result* p = grpc_core::Zalloc<recv_message_result>();
   p->status = status;
   p->bytes_to_send = bytes_to_send;
@@ -193,7 +197,6 @@ void alts_handshaker_client_handle_response(alts_handshaker_client* c,
   alts_grpc_handshaker_client* client =
       reinterpret_cast<alts_grpc_handshaker_client*>(c);
   grpc_byte_buffer* recv_buffer = client->recv_buffer;
-  grpc_status_code status = client->status;
   alts_tsi_handshaker* handshaker = client->handshaker;
   /* Invalid input check. */
   if (client->cb == nullptr) {
@@ -204,25 +207,34 @@ void alts_handshaker_client_handle_response(alts_handshaker_client* c,
   if (handshaker == nullptr) {
     gpr_log(GPR_ERROR,
             "handshaker is nullptr in alts_tsi_handshaker_handle_response()");
-    handle_response_done(client, TSI_INTERNAL_ERROR, nullptr, 0, nullptr);
+    handle_response_done(
+        client, TSI_INTERNAL_ERROR,
+        "handshaker is nullptr in alts_tsi_handshaker_handle_response()",
+        nullptr, 0, nullptr);
     return;
   }
   /* TSI handshake has been shutdown. */
   if (alts_tsi_handshaker_has_shutdown(handshaker)) {
     gpr_log(GPR_INFO, "TSI handshake shutdown");
-    handle_response_done(client, TSI_HANDSHAKE_SHUTDOWN, nullptr, 0, nullptr);
+    handle_response_done(client, TSI_HANDSHAKE_SHUTDOWN,
+                         "TSI handshake shutdown", nullptr, 0, nullptr);
     return;
   }
-  /* Failed grpc call check. */
-  if (!is_ok || status != GRPC_STATUS_OK) {
-    gpr_log(GPR_INFO, "grpc call made to handshaker service failed");
-    handle_response_done(client, TSI_INTERNAL_ERROR, nullptr, 0, nullptr);
+  /* Check for failed grpc read. */
+  if (!is_ok || client->inject_read_failure) {
+    gpr_log(GPR_INFO, "read failed on grpc call to handshaker service");
+    handle_response_done(client, TSI_INTERNAL_ERROR,
+                         "read failed on grpc call to handshaker service",
+                         nullptr, 0, nullptr);
     return;
   }
   if (recv_buffer == nullptr) {
     gpr_log(GPR_ERROR,
             "recv_buffer is nullptr in alts_tsi_handshaker_handle_response()");
-    handle_response_done(client, TSI_INTERNAL_ERROR, nullptr, 0, nullptr);
+    handle_response_done(
+        client, TSI_INTERNAL_ERROR,
+        "recv_buffer is nullptr in alts_tsi_handshaker_handle_response()",
+        nullptr, 0, nullptr);
     return;
   }
   upb::Arena arena;
@@ -233,14 +245,17 @@ void alts_handshaker_client_handle_response(alts_handshaker_client* c,
   /* Invalid handshaker response check. */
   if (resp == nullptr) {
     gpr_log(GPR_ERROR, "alts_tsi_utils_deserialize_response() failed");
-    handle_response_done(client, TSI_DATA_CORRUPTED, nullptr, 0, nullptr);
+    handle_response_done(client, TSI_DATA_CORRUPTED,
+                         "alts_tsi_utils_deserialize_response() failed",
+                         nullptr, 0, nullptr);
     return;
   }
   const grpc_gcp_HandshakerStatus* resp_status =
       grpc_gcp_HandshakerResp_status(resp);
   if (resp_status == nullptr) {
     gpr_log(GPR_ERROR, "No status in HandshakerResp");
-    handle_response_done(client, TSI_DATA_CORRUPTED, nullptr, 0, nullptr);
+    handle_response_done(client, TSI_DATA_CORRUPTED,
+                         "No status in HandshakerResp", nullptr, 0, nullptr);
     return;
   }
   upb_StringView out_frames = grpc_gcp_HandshakerResp_out_frames(resp);
@@ -262,7 +277,9 @@ void alts_handshaker_client_handle_response(alts_handshaker_client* c,
         alts_tsi_handshaker_result_create(resp, client->is_client, &result);
     if (status != TSI_OK) {
       gpr_log(GPR_ERROR, "alts_tsi_handshaker_result_create() failed");
-      handle_response_done(client, status, nullptr, 0, nullptr);
+      handle_response_done(client, status,
+                           "alts_tsi_handshaker_result_create() failed",
+                           nullptr, 0, nullptr);
       return;
     }
     alts_tsi_handshaker_result_set_unused_bytes(
@@ -271,13 +288,13 @@ void alts_handshaker_client_handle_response(alts_handshaker_client* c,
   }
   grpc_status_code code = static_cast<grpc_status_code>(
       grpc_gcp_HandshakerStatus_code(resp_status));
+  std::string error;
   if (code != GRPC_STATUS_OK) {
     upb_StringView details = grpc_gcp_HandshakerStatus_details(resp_status);
     if (details.size > 0) {
-      char* error_details = static_cast<char*>(gpr_zalloc(details.size + 1));
-      memcpy(error_details, details.data, details.size);
-      gpr_log(GPR_ERROR, "Error from handshaker service:%s", error_details);
-      gpr_free(error_details);
+      error = absl::StrCat("Status ", code, " from handshaker service: ",
+                           absl::string_view(details.data, details.size));
+      gpr_log(GPR_ERROR, "%s", error.c_str());
     }
   }
   // TODO(apolcyn): consider short ciruiting handle_response_done and
@@ -285,7 +302,8 @@ void alts_handshaker_client_handle_response(alts_handshaker_client* c,
   // handle_response_done's allocation per message received causes
   // a performance issue.
   handle_response_done(client, alts_tsi_utils_convert_to_tsi_result(code),
-                       bytes_to_send, bytes_to_send_size, result);
+                       std::move(error), bytes_to_send, bytes_to_send_size,
+                       result);
 }
 
 static tsi_result continue_make_grpc_call(alts_grpc_handshaker_client* client,
@@ -690,7 +708,7 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
     grpc_alts_credentials_options* options, const grpc_slice& target_name,
     grpc_iomgr_cb_func grpc_cb, tsi_handshaker_on_next_done_cb cb,
     void* user_data, alts_handshaker_client_vtable* vtable_for_testing,
-    bool is_client, size_t max_frame_size) {
+    bool is_client, size_t max_frame_size, std::string* error) {
   if (channel == nullptr || handshaker_service_url == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to alts_handshaker_client_create()");
     return nullptr;
@@ -713,6 +731,7 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
   client->buffer = static_cast<unsigned char*>(gpr_zalloc(client->buffer_size));
   client->handshake_status_details = grpc_empty_slice();
   client->max_frame_size = max_frame_size;
+  client->error = error;
   grpc_slice slice = grpc_slice_from_copied_string(handshaker_service_url);
   client->call =
       strcmp(handshaker_service_url, ALTS_HANDSHAKER_SERVICE_URL_FOR_TESTING) ==
@@ -776,7 +795,7 @@ void alts_handshaker_client_set_recv_bytes_for_testing(
 void alts_handshaker_client_set_fields_for_testing(
     alts_handshaker_client* c, alts_tsi_handshaker* handshaker,
     tsi_handshaker_on_next_done_cb cb, void* user_data,
-    grpc_byte_buffer* recv_buffer, grpc_status_code status) {
+    grpc_byte_buffer* recv_buffer, bool inject_read_failure) {
   GPR_ASSERT(c != nullptr);
   alts_grpc_handshaker_client* client =
       reinterpret_cast<alts_grpc_handshaker_client*>(c);
@@ -784,7 +803,7 @@ void alts_handshaker_client_set_fields_for_testing(
   client->cb = cb;
   client->user_data = user_data;
   client->recv_buffer = recv_buffer;
-  client->status = status;
+  client->inject_read_failure = inject_read_failure;
 }
 
 void alts_handshaker_client_check_fields_for_testing(

data/src/core/tsi/alts/handshaker/alts_handshaker_client.h

@@ -144,7 +144,7 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
     grpc_alts_credentials_options* options, const grpc_slice& target_name,
     grpc_iomgr_cb_func grpc_cb, tsi_handshaker_on_next_done_cb cb,
     void* user_data, alts_handshaker_client_vtable* vtable_for_testing,
-    bool is_client, size_t max_frame_size);
+    bool is_client, size_t max_frame_size, std::string* error);
 
 /**
  * This method handles handshaker response returned from ALTS handshaker

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc

@@ -416,7 +416,7 @@ static void on_handshaker_service_resp_recv_dedicated(
 static tsi_result alts_tsi_handshaker_continue_handshaker_next(
     alts_tsi_handshaker* handshaker, const unsigned char* received_bytes,
     size_t received_bytes_size, tsi_handshaker_on_next_done_cb cb,
-    void* user_data) {
+    void* user_data, std::string* error) {
   if (!handshaker->has_created_handshaker_client) {
     if (handshaker->channel == nullptr) {
       grpc_alts_shared_resource_dedicated_start(
@@ -437,9 +437,10 @@ static tsi_result alts_tsi_handshaker_continue_handshaker_next(
         handshaker->interested_parties, handshaker->options,
         handshaker->target_name, grpc_cb, cb, user_data,
         handshaker->client_vtable_for_testing, handshaker->is_client,
-        handshaker->max_frame_size);
+        handshaker->max_frame_size, error);
     if (client == nullptr) {
       gpr_log(GPR_ERROR, "Failed to create ALTS handshaker client");
+      if (error != nullptr) *error = "Failed to create ALTS handshaker client";
       return TSI_FAILED_PRECONDITION;
     }
     {
@@ -448,6 +449,7 @@ static tsi_result alts_tsi_handshaker_continue_handshaker_next(
       handshaker->client = client;
       if (handshaker->shutdown) {
         gpr_log(GPR_INFO, "TSI handshake shutdown");
+        if (error != nullptr) *error = "TSI handshaker shutdown";
         return TSI_HANDSHAKE_SHUTDOWN;
       }
     }
@@ -490,6 +492,7 @@ struct alts_tsi_handshaker_continue_handshaker_next_args {
   tsi_handshaker_on_next_done_cb cb;
   void* user_data;
   grpc_closure closure;
+  std::string* error = nullptr;
 };
 
 static void alts_tsi_handshaker_create_channel(
@@ -510,7 +513,8 @@ static void alts_tsi_handshaker_create_channel(
   tsi_result continue_next_result =
       alts_tsi_handshaker_continue_handshaker_next(
           handshaker, next_args->received_bytes.get(),
-          next_args->received_bytes_size, next_args->cb, next_args->user_data);
+          next_args->received_bytes_size, next_args->cb, next_args->user_data,
+          next_args->error);
   if (continue_next_result != TSI_OK) {
     next_args->cb(continue_next_result, next_args->user_data, nullptr, 0,
                   nullptr);
@@ -522,9 +526,10 @@ static tsi_result handshaker_next(
     tsi_handshaker* self, const unsigned char* received_bytes,
     size_t received_bytes_size, const unsigned char** /*bytes_to_send*/,
     size_t* /*bytes_to_send_size*/, tsi_handshaker_result** /*result*/,
-    tsi_handshaker_on_next_done_cb cb, void* user_data) {
+    tsi_handshaker_on_next_done_cb cb, void* user_data, std::string* error) {
   if (self == nullptr || cb == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to handshaker_next()");
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   alts_tsi_handshaker* handshaker =
@@ -533,6 +538,7 @@ static tsi_result handshaker_next(
     grpc_core::MutexLock lock(&handshaker->mu);
     if (handshaker->shutdown) {
       gpr_log(GPR_INFO, "TSI handshake shutdown");
+      if (error != nullptr) *error = "handshake shutdown";
       return TSI_HANDSHAKE_SHUTDOWN;
     }
   }
@@ -542,6 +548,7 @@ static tsi_result handshaker_next(
     args->handshaker = handshaker;
     args->received_bytes = nullptr;
     args->received_bytes_size = received_bytes_size;
+    args->error = error;
     if (received_bytes_size > 0) {
       args->received_bytes = std::unique_ptr<unsigned char>(
           static_cast<unsigned char*>(gpr_zalloc(received_bytes_size)));
@@ -559,7 +566,7 @@ static tsi_result handshaker_next(
     grpc_core::ExecCtx::Run(DEBUG_LOCATION, &args->closure, GRPC_ERROR_NONE);
   } else {
     tsi_result ok = alts_tsi_handshaker_continue_handshaker_next(
-        handshaker, received_bytes, received_bytes_size, cb, user_data);
+        handshaker, received_bytes, received_bytes_size, cb, user_data, error);
     if (ok != TSI_OK) {
       gpr_log(GPR_ERROR, "Failed to schedule ALTS handshaker requests");
       return ok;
@@ -577,11 +584,11 @@ static tsi_result handshaker_next_dedicated(
     tsi_handshaker* self, const unsigned char* received_bytes,
     size_t received_bytes_size, const unsigned char** bytes_to_send,
     size_t* bytes_to_send_size, tsi_handshaker_result** result,
-    tsi_handshaker_on_next_done_cb cb, void* user_data) {
+    tsi_handshaker_on_next_done_cb cb, void* user_data, std::string* error) {
   grpc_core::ExecCtx exec_ctx;
   return handshaker_next(self, received_bytes, received_bytes_size,
                          bytes_to_send, bytes_to_send_size, result, cb,
-                         user_data);
+                         user_data, error);
 }
 
 static void handshaker_shutdown(tsi_handshaker* self) {

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker_private.h

@@ -63,7 +63,7 @@ void alts_handshaker_client_check_fields_for_testing(
 void alts_handshaker_client_set_fields_for_testing(
     alts_handshaker_client* client, alts_tsi_handshaker* handshaker,
     tsi_handshaker_on_next_done_cb cb, void* user_data,
-    grpc_byte_buffer* recv_buffer, grpc_status_code status);
+    grpc_byte_buffer* recv_buffer, bool inject_read_failure);
 
 void alts_handshaker_client_set_vtable_for_testing(
     alts_handshaker_client* client, alts_handshaker_client_vtable* vtable);

data/src/core/tsi/fake_transport_security.cc

@@ -96,7 +96,8 @@ static const char* tsi_fake_handshake_message_to_string(int msg) {
 }
 
 static tsi_result tsi_fake_handshake_message_from_string(
-    const char* msg_string, tsi_fake_handshake_message* msg) {
+    const char* msg_string, tsi_fake_handshake_message* msg,
+    std::string* error) {
   for (int i = 0; i < TSI_FAKE_HANDSHAKE_MESSAGE_MAX; i++) {
     if (strncmp(msg_string, tsi_fake_handshake_message_strings[i],
                 strlen(tsi_fake_handshake_message_strings[i])) == 0) {
@@ -105,6 +106,7 @@ static tsi_result tsi_fake_handshake_message_from_string(
     }
   }
   gpr_log(GPR_ERROR, "Invalid handshake message.");
+  if (error != nullptr) *error = "invalid handshake message";
   return TSI_DATA_CORRUPTED;
 }
 
@@ -174,12 +176,16 @@ static void tsi_fake_frame_ensure_size(tsi_fake_frame* frame) {
  * This method should not be called if frame->needs_framing is not 0.  */
 static tsi_result tsi_fake_frame_decode(const unsigned char* incoming_bytes,
                                         size_t* incoming_bytes_size,
-                                        tsi_fake_frame* frame) {
+                                        tsi_fake_frame* frame,
+                                        std::string* error) {
   size_t available_size = *incoming_bytes_size;
   size_t to_read_size = 0;
   const unsigned char* bytes_cursor = incoming_bytes;
 
-  if (frame->needs_draining) return TSI_INTERNAL_ERROR;
+  if (frame->needs_draining) {
+    if (error != nullptr) *error = "fake handshaker frame needs draining";
+    return TSI_INTERNAL_ERROR;
+  }
   if (frame->data == nullptr) {
     frame->allocated_size = TSI_FAKE_FRAME_INITIAL_ALLOCATED_SIZE;
     frame->data =
@@ -224,9 +230,13 @@ static tsi_result tsi_fake_frame_decode(const unsigned char* incoming_bytes,
  * This method should not be called if frame->needs_framing is 0.  */
 static tsi_result tsi_fake_frame_encode(unsigned char* outgoing_bytes,
                                         size_t* outgoing_bytes_size,
-                                        tsi_fake_frame* frame) {
+                                        tsi_fake_frame* frame,
+                                        std::string* error) {
   size_t to_write_size = frame->size - frame->offset;
-  if (!frame->needs_draining) return TSI_INTERNAL_ERROR;
+  if (!frame->needs_draining) {
+    if (error != nullptr) *error = "fake frame needs draining";
+    return TSI_INTERNAL_ERROR;
+  }
   if (*outgoing_bytes_size < to_write_size) {
     memcpy(outgoing_bytes, frame->data + frame->offset, *outgoing_bytes_size);
     frame->offset += *outgoing_bytes_size;
@@ -240,15 +250,14 @@ static tsi_result tsi_fake_frame_encode(unsigned char* outgoing_bytes,
 
 /* Sets the payload of a fake frame to contain the given data blob, where
  * data_size indicates the size of data. */
-static tsi_result tsi_fake_frame_set_data(unsigned char* data, size_t data_size,
-                                          tsi_fake_frame* frame) {
+static void tsi_fake_frame_set_data(unsigned char* data, size_t data_size,
+                                    tsi_fake_frame* frame) {
   frame->offset = 0;
   frame->size = data_size + TSI_FAKE_FRAME_HEADER_SIZE;
   tsi_fake_frame_ensure_size(frame);
   store32_little_endian(static_cast<uint32_t>(frame->size), frame->data);
   memcpy(frame->data + TSI_FAKE_FRAME_HEADER_SIZE, data, data_size);
   tsi_fake_frame_reset(frame, 1 /* needs draining */);
-  return TSI_OK;
 }
 
 /* Destroys the contents of a fake frame. */
@@ -276,8 +285,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
   /* Try to drain first. */
   if (frame->needs_draining) {
     drained_size = saved_output_size - *num_bytes_written;
-    result =
-        tsi_fake_frame_encode(protected_output_frames, &drained_size, frame);
+    result = tsi_fake_frame_encode(protected_output_frames, &drained_size,
+                                   frame, /*error=*/nullptr);
     *num_bytes_written += drained_size;
     protected_output_frames += drained_size;
     if (result != TSI_OK) {
@@ -297,7 +306,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
     store32_little_endian(static_cast<uint32_t>(impl->max_frame_size),
                           frame_header);
     written_in_frame_size = TSI_FAKE_FRAME_HEADER_SIZE;
-    result = tsi_fake_frame_decode(frame_header, &written_in_frame_size, frame);
+    result = tsi_fake_frame_decode(frame_header, &written_in_frame_size, frame,
+                                   /*error=*/nullptr);
     if (result != TSI_INCOMPLETE_DATA) {
       gpr_log(GPR_ERROR, "tsi_fake_frame_decode returned %s",
               tsi_result_to_string(result));
@@ -305,7 +315,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
     }
   }
   result =
-      tsi_fake_frame_decode(unprotected_bytes, unprotected_bytes_size, frame);
+      tsi_fake_frame_decode(unprotected_bytes, unprotected_bytes_size, frame,
+                            /*error=*/nullptr);
   if (result != TSI_OK) {
     if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
     return result;
@@ -315,7 +326,8 @@ static tsi_result fake_protector_protect(tsi_frame_protector* self,
   if (!frame->needs_draining) return TSI_INTERNAL_ERROR;
   if (frame->offset != 0) return TSI_INTERNAL_ERROR;
   drained_size = saved_output_size - *num_bytes_written;
-  result = tsi_fake_frame_encode(protected_output_frames, &drained_size, frame);
+  result = tsi_fake_frame_encode(protected_output_frames, &drained_size, frame,
+                                 /*error=*/nullptr);
   *num_bytes_written += drained_size;
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   return result;
@@ -337,7 +349,8 @@ static tsi_result fake_protector_protect_flush(
                           frame->data); /* Overwrite header. */
   }
   result = tsi_fake_frame_encode(protected_output_frames,
-                                 protected_output_frames_size, frame);
+                                 protected_output_frames_size, frame,
+                                 /*error=*/nullptr);
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   *still_pending_size = frame->size - frame->offset;
   return result;
@@ -361,7 +374,8 @@ static tsi_result fake_protector_unprotect(
     /* Go past the header if needed. */
     if (frame->offset == 0) frame->offset = TSI_FAKE_FRAME_HEADER_SIZE;
     drained_size = saved_output_size - *num_bytes_written;
-    result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame);
+    result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame,
+                                   /*error=*/nullptr);
     unprotected_bytes += drained_size;
     *num_bytes_written += drained_size;
     if (result != TSI_OK) {
@@ -376,7 +390,8 @@ static tsi_result fake_protector_unprotect(
   /* Now process the protected_bytes. */
   if (frame->needs_draining) return TSI_INTERNAL_ERROR;
   result = tsi_fake_frame_decode(protected_frames_bytes,
-                                 protected_frames_bytes_size, frame);
+                                 protected_frames_bytes_size, frame,
+                                 /*error=*/nullptr);
   if (result != TSI_OK) {
     if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
     return result;
@@ -387,7 +402,8 @@ static tsi_result fake_protector_unprotect(
   if (frame->offset != 0) return TSI_INTERNAL_ERROR;
   frame->offset = TSI_FAKE_FRAME_HEADER_SIZE; /* Go past the header. */
   drained_size = saved_output_size - *num_bytes_written;
-  result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame);
+  result = tsi_fake_frame_encode(unprotected_bytes, &drained_size, frame,
+                                 /*error=*/nullptr);
   *num_bytes_written += drained_size;
   if (result == TSI_INCOMPLETE_DATA) result = TSI_OK;
   return result;
@@ -579,9 +595,10 @@ static const tsi_handshaker_result_vtable handshaker_result_vtable = {
 
 static tsi_result fake_handshaker_result_create(
     const unsigned char* unused_bytes, size_t unused_bytes_size,
-    tsi_handshaker_result** handshaker_result) {
+    tsi_handshaker_result** handshaker_result, std::string* error) {
   if ((unused_bytes_size > 0 && unused_bytes == nullptr) ||
       handshaker_result == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   fake_handshaker_result* result = grpc_core::Zalloc<fake_handshaker_result>();
@@ -599,7 +616,8 @@ static tsi_result fake_handshaker_result_create(
 /* --- tsi_handshaker methods implementation. ---*/
 
 static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
-    tsi_handshaker* self, unsigned char* bytes, size_t* bytes_size) {
+    tsi_handshaker* self, unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   tsi_fake_handshaker* impl = reinterpret_cast<tsi_fake_handshaker*>(self);
   tsi_result result = TSI_OK;
   if (impl->needs_incoming_message || impl->result == TSI_OK) {
@@ -612,10 +630,9 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
         static_cast<tsi_fake_handshake_message>(impl->next_message_to_send + 2);
     const char* msg_string =
         tsi_fake_handshake_message_to_string(impl->next_message_to_send);
-    result = tsi_fake_frame_set_data(
+    tsi_fake_frame_set_data(
         reinterpret_cast<unsigned char*>(const_cast<char*>(msg_string)),
         strlen(msg_string), &impl->outgoing_frame);
-    if (result != TSI_OK) return result;
     if (next_message_to_send > TSI_FAKE_HANDSHAKE_MESSAGE_MAX) {
       next_message_to_send = TSI_FAKE_HANDSHAKE_MESSAGE_MAX;
     }
@@ -626,7 +643,8 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
     }
     impl->next_message_to_send = next_message_to_send;
   }
-  result = tsi_fake_frame_encode(bytes, bytes_size, &impl->outgoing_frame);
+  result =
+      tsi_fake_frame_encode(bytes, bytes_size, &impl->outgoing_frame, error);
   if (result != TSI_OK) return result;
   if (!impl->is_client &&
       impl->next_message_to_send == TSI_FAKE_HANDSHAKE_MESSAGE_MAX) {
@@ -642,7 +660,8 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
 }
 
 static tsi_result fake_handshaker_process_bytes_from_peer(
-    tsi_handshaker* self, const unsigned char* bytes, size_t* bytes_size) {
+    tsi_handshaker* self, const unsigned char* bytes, size_t* bytes_size,
+    std::string* error) {
   tsi_result result = TSI_OK;
   tsi_fake_handshaker* impl = reinterpret_cast<tsi_fake_handshaker*>(self);
   tsi_fake_handshake_message expected_msg =
@@ -653,14 +672,15 @@ static tsi_result fake_handshaker_process_bytes_from_peer(
     *bytes_size = 0;
     return TSI_OK;
   }
-  result = tsi_fake_frame_decode(bytes, bytes_size, &impl->incoming_frame);
+  result =
+      tsi_fake_frame_decode(bytes, bytes_size, &impl->incoming_frame, error);
   if (result != TSI_OK) return result;
 
   /* We now have a complete frame. */
   result = tsi_fake_handshake_message_from_string(
       reinterpret_cast<const char*>(impl->incoming_frame.data) +
           TSI_FAKE_FRAME_HEADER_SIZE,
-      &received_msg);
+      &received_msg, error);
   if (result != TSI_OK) {
     impl->result = result;
     return result;
@@ -703,11 +723,13 @@ static tsi_result fake_handshaker_next(
     tsi_handshaker* self, const unsigned char* received_bytes,
     size_t received_bytes_size, const unsigned char** bytes_to_send,
     size_t* bytes_to_send_size, tsi_handshaker_result** handshaker_result,
-    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/) {
+    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/,
+    std::string* error) {
   /* Sanity check the arguments. */
   if ((received_bytes_size > 0 && received_bytes == nullptr) ||
       bytes_to_send == nullptr || bytes_to_send_size == nullptr ||
       handshaker_result == nullptr) {
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   tsi_fake_handshaker* handshaker =
@@ -717,8 +739,8 @@ static tsi_result fake_handshaker_next(
   /* Decode and process a handshake frame from the peer. */
   size_t consumed_bytes_size = received_bytes_size;
   if (received_bytes_size > 0) {
-    result = fake_handshaker_process_bytes_from_peer(self, received_bytes,
-                                                     &consumed_bytes_size);
+    result = fake_handshaker_process_bytes_from_peer(
+        self, received_bytes, &consumed_bytes_size, error);
     if (result != TSI_OK) return result;
   }
 
@@ -728,7 +750,8 @@ static tsi_result fake_handshaker_next(
   do {
     size_t sent_bytes_size = handshaker->outgoing_bytes_buffer_size - offset;
     result = fake_handshaker_get_bytes_to_send_to_peer(
-        self, handshaker->outgoing_bytes_buffer + offset, &sent_bytes_size);
+        self, handshaker->outgoing_bytes_buffer + offset, &sent_bytes_size,
+        error);
     offset += sent_bytes_size;
     if (result == TSI_INCOMPLETE_DATA) {
       handshaker->outgoing_bytes_buffer_size *= 2;
@@ -754,7 +777,7 @@ static tsi_result fake_handshaker_next(
 
     /* Create a handshaker_result containing the unused bytes. */
     result = fake_handshaker_result_create(unused_bytes, unused_bytes_size,
-                                           handshaker_result);
+                                           handshaker_result, error);
     if (result == TSI_OK) {
       /* Indicate that the handshake has completed and that a handshaker_result
        * has been created. */

data/src/core/tsi/local_transport_security.cc

@@ -119,13 +119,17 @@ tsi_result create_handshaker_result(const unsigned char* received_bytes,
 
 /* --- tsi_handshaker methods implementation. --- */
 
-tsi_result handshaker_next(
-    tsi_handshaker* self, const unsigned char* received_bytes,
-    size_t received_bytes_size, const unsigned char** /*bytes_to_send*/,
-    size_t* bytes_to_send_size, tsi_handshaker_result** result,
-    tsi_handshaker_on_next_done_cb /*cb*/, void* /*user_data*/) {
+tsi_result handshaker_next(tsi_handshaker* self,
+                           const unsigned char* received_bytes,
+                           size_t received_bytes_size,
+                           const unsigned char** /*bytes_to_send*/,
+                           size_t* bytes_to_send_size,
+                           tsi_handshaker_result** result,
+                           tsi_handshaker_on_next_done_cb /*cb*/,
+                           void* /*user_data*/, std::string* error) {
   if (self == nullptr) {
     gpr_log(GPR_ERROR, "Invalid arguments to handshaker_next()");
+    if (error != nullptr) *error = "invalid argument";
     return TSI_INVALID_ARGUMENT;
   }
   /* Note that there is no interaction between TSI peers, and all operations are

data/src/core/tsi/ssl/session_cache/ssl_session_cache.h

@@ -25,9 +25,11 @@
 
 #include <openssl/ssl.h>
 
+#include <grpc/impl/codegen/grpc_types.h>
 #include <grpc/slice.h>
 #include <grpc/support/sync.h>
 
+#include "src/core/lib/gprpp/cpp_impl_of.h"
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/sync.h"
@@ -44,7 +46,10 @@
 
 namespace tsi {
 
-class SslSessionLRUCache : public grpc_core::RefCounted<SslSessionLRUCache> {
+class SslSessionLRUCache
+    : public grpc_core::CppImplOf<SslSessionLRUCache,
+                                  struct tsi_ssl_session_cache>,
+      public grpc_core::RefCounted<SslSessionLRUCache> {
  public:
   /// Create new LRU cache with the given capacity.
   static grpc_core::RefCountedPtr<SslSessionLRUCache> Create(size_t capacity) {
@@ -59,6 +64,10 @@ class SslSessionLRUCache : public grpc_core::RefCounted<SslSessionLRUCache> {
   SslSessionLRUCache(const SslSessionLRUCache&) = delete;
   SslSessionLRUCache& operator=(const SslSessionLRUCache&) = delete;
 
+  static absl::string_view ChannelArgName() {
+    return GRPC_SSL_SESSION_CACHE_ARG;
+  }
+
   /// Returns current number of sessions in the cache.
   size_t Size();
   /// Add \a session in the cache using \a key. This operation may discard older