grpc 1.55.0 → 1.58.0

data/src/core/lib/transport/metadata_batch.h

@@ -41,8 +41,10 @@
 
 #include "src/core/lib/compression/compression_internal.h"
 #include "src/core/lib/gprpp/chunked_vector.h"
+#include "src/core/lib/gprpp/if_list.h"
 #include "src/core/lib/gprpp/packed_table.h"
 #include "src/core/lib/gprpp/time.h"
+#include "src/core/lib/gprpp/type_list.h"
 #include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/custom_metadata.h"
@@ -78,7 +80,9 @@ struct GrpcTimeoutMetadata {
   using MementoType = Duration;
   using CompressionTraits = TimeoutCompressor;
   static absl::string_view key() { return "grpc-timeout"; }
-  static MementoType ParseMemento(Slice value, MetadataParseErrorFn on_error);
+  static MementoType ParseMemento(Slice value,
+                                  bool will_keep_past_request_lifetime,
+                                  MetadataParseErrorFn on_error);
   static ValueType MementoToValue(MementoType timeout);
   static Slice Encode(ValueType x);
   static std::string DisplayValue(ValueType x) { return x.ToString(); }
@@ -98,7 +102,9 @@ struct TeMetadata {
   using MementoType = ValueType;
   using CompressionTraits = KnownValueCompressor<ValueType, kTrailers>;
   static absl::string_view key() { return "te"; }
-  static MementoType ParseMemento(Slice value, MetadataParseErrorFn on_error);
+  static MementoType ParseMemento(Slice value,
+                                  bool will_keep_past_request_lifetime,
+                                  MetadataParseErrorFn on_error);
   static ValueType MementoToValue(MementoType te) { return te; }
   static StaticSlice Encode(ValueType x) {
     GPR_ASSERT(x == kTrailers);
@@ -126,7 +132,9 @@ struct ContentTypeMetadata {
   using MementoType = ValueType;
   using CompressionTraits = KnownValueCompressor<ValueType, kApplicationGrpc>;
   static absl::string_view key() { return "content-type"; }
-  static MementoType ParseMemento(Slice value, MetadataParseErrorFn on_error);
+  static MementoType ParseMemento(Slice value,
+                                  bool will_keep_past_request_lifetime,
+                                  MetadataParseErrorFn on_error);
   static ValueType MementoToValue(MementoType content_type) {
     return content_type;
   }
@@ -149,7 +157,8 @@ struct HttpSchemeMetadata {
   using MementoType = ValueType;
   using CompressionTraits = HttpSchemeCompressor;
   static absl::string_view key() { return ":scheme"; }
-  static MementoType ParseMemento(Slice value, MetadataParseErrorFn on_error) {
+  static MementoType ParseMemento(Slice value, bool,
+                                  MetadataParseErrorFn on_error) {
     return Parse(value.as_string_view(), on_error);
   }
   static ValueType Parse(absl::string_view value,
@@ -178,7 +187,9 @@ struct HttpMethodMetadata {
   using MementoType = ValueType;
   using CompressionTraits = HttpMethodCompressor;
   static absl::string_view key() { return ":method"; }
-  static MementoType ParseMemento(Slice value, MetadataParseErrorFn on_error);
+  static MementoType ParseMemento(Slice value,
+                                  bool will_keep_past_request_lifetime,
+                                  MetadataParseErrorFn on_error);
   static ValueType MementoToValue(MementoType content_type) {
     return content_type;
   }
@@ -194,7 +205,9 @@ struct HttpMethodMetadata {
 struct CompressionAlgorithmBasedMetadata {
   using ValueType = grpc_compression_algorithm;
   using MementoType = ValueType;
-  static MementoType ParseMemento(Slice value, MetadataParseErrorFn on_error);
+  static MementoType ParseMemento(Slice value,
+                                  bool will_keep_past_request_lifetime,
+                                  MetadataParseErrorFn on_error);
   static ValueType MementoToValue(MementoType x) { return x; }
   static Slice Encode(ValueType x) {
     GPR_ASSERT(x != GRPC_COMPRESS_ALGORITHMS_COUNT);
@@ -232,7 +245,7 @@ struct GrpcAcceptEncodingMetadata {
   using ValueType = CompressionAlgorithmSet;
   using MementoType = ValueType;
   using CompressionTraits = StableValueCompressor;
-  static MementoType ParseMemento(Slice value, MetadataParseErrorFn) {
+  static MementoType ParseMemento(Slice value, bool, MetadataParseErrorFn) {
     return CompressionAlgorithmSet::FromString(value.as_string_view());
   }
   static ValueType MementoToValue(MementoType x) { return x; }
@@ -322,7 +335,7 @@ struct SimpleIntBasedMetadataBase {
 template <typename Int, Int kInvalidValue>
 struct SimpleIntBasedMetadata : public SimpleIntBasedMetadataBase<Int> {
   static constexpr Int invalid_value() { return kInvalidValue; }
-  static Int ParseMemento(Slice value, MetadataParseErrorFn on_error) {
+  static Int ParseMemento(Slice value, bool, MetadataParseErrorFn on_error) {
     Int out;
     if (!absl::SimpleAtoi(value.as_string_view(), &out)) {
       on_error("not an integer", value);
@@ -359,7 +372,9 @@ struct GrpcRetryPushbackMsMetadata {
   static Slice Encode(Duration x) { return Slice::FromInt64(x.millis()); }
   static int64_t DisplayValue(Duration x) { return x.millis(); }
   static int64_t DisplayMemento(Duration x) { return DisplayValue(x); }
-  static Duration ParseMemento(Slice value, MetadataParseErrorFn on_error);
+  static Duration ParseMemento(Slice value,
+                               bool will_keep_past_request_lifetime,
+                               MetadataParseErrorFn on_error);
 };
 
 // :status metadata trait.
@@ -386,7 +401,7 @@ struct GrpcLbClientStatsMetadata {
   static const char* DisplayMemento(MementoType) {
     return "<internal-lb-stats>";
   }
-  static MementoType ParseMemento(Slice, MetadataParseErrorFn) {
+  static MementoType ParseMemento(Slice, bool, MetadataParseErrorFn) {
     return nullptr;
   }
 };
@@ -417,7 +432,9 @@ struct LbCostBinMetadata {
   static Slice Encode(const ValueType& x);
   static std::string DisplayValue(ValueType x);
   static std::string DisplayMemento(MementoType x) { return DisplayValue(x); }
-  static MementoType ParseMemento(Slice value, MetadataParseErrorFn on_error);
+  static MementoType ParseMemento(Slice value,
+                                  bool will_keep_past_request_lifetime,
+                                  MetadataParseErrorFn on_error);
 };
 
 // Annotation added by a transport to note whether a failed request was never
@@ -517,44 +534,53 @@ struct IsEncodableTrait<Trait, absl::void_t<decltype(Trait::key())>> {
   static const bool value = true;
 };
 
-// Helper type - maps a string name to a trait.
 template <typename MustBeVoid, typename... Traits>
-struct NameLookup;
+struct EncodableTraits;
 
 template <typename Trait, typename... Traits>
-struct NameLookup<absl::enable_if_t<IsEncodableTrait<Trait>::value, void>,
-                  Trait, Traits...> {
-  // Call op->Found(Trait()) if op->name == Trait::key() for some Trait in
-  // Traits. If not found, call op->NotFound().
-  template <typename Op>
-  static auto Lookup(absl::string_view key, Op* op)
-      -> decltype(op->Found(Trait())) {
-    if (key == Trait::key()) {
-      return op->Found(Trait());
-    }
-    return NameLookup<void, Traits...>::Lookup(key, op);
-  }
+struct EncodableTraits<absl::enable_if_t<IsEncodableTrait<Trait>::value, void>,
+                       Trait, Traits...> {
+  using List =
+      typename EncodableTraits<void,
+                               Traits...>::List::template PushFront<Trait>;
 };
 
 template <typename Trait, typename... Traits>
-struct NameLookup<absl::enable_if_t<!IsEncodableTrait<Trait>::value, void>,
-                  Trait, Traits...> {
-  template <typename Op>
-  static auto Lookup(absl::string_view key, Op* op)
-      -> decltype(NameLookup<void, Traits...>::Lookup(key, op)) {
-    return NameLookup<void, Traits...>::Lookup(key, op);
-  }
+struct EncodableTraits<absl::enable_if_t<!IsEncodableTrait<Trait>::value, void>,
+                       Trait, Traits...> {
+  using List = typename EncodableTraits<void, Traits...>::List;
 };
 
 template <>
-struct NameLookup<void> {
+struct EncodableTraits<void> {
+  using List = Typelist<>;
+};
+
+template <typename Trait>
+struct EncodableNameLookupKeyComparison {
+  bool operator()(absl::string_view key) { return key == Trait::key(); }
+};
+
+template <typename Trait, typename Op>
+struct EncodableNameLookupOnFound {
+  auto operator()(Op* op) { return op->Found(Trait()); }
+};
+
+template <typename... Traits>
+struct EncodableNameLookup {
   template <typename Op>
-  static auto Lookup(absl::string_view key, Op* op)
-      -> decltype(op->NotFound(key)) {
-    return op->NotFound(key);
+  static auto Lookup(absl::string_view key, Op* op) {
+    return IfList(
+        key, op, [key](Op* op) { return op->NotFound(key); },
+        EncodableNameLookupKeyComparison<Traits>()...,
+        EncodableNameLookupOnFound<Traits, Op>()...);
   }
 };
 
+template <typename... Traits>
+using NameLookup = typename EncodableTraits<
+    void, Traits...>::List::template Instantiate<EncodableNameLookup>;
+
 // Helper to take a slice to a memento to a value.
 // By splitting this part out we can scale code size as the number of
 // (memento, value) types, rather than as the number of traits.
@@ -563,9 +589,9 @@ struct ParseValue {
   template <ParseMementoFn parse_memento, MementoToValueFn memento_to_value>
   static GPR_ATTRIBUTE_NOINLINE auto Parse(Slice* value,
                                            MetadataParseErrorFn on_error)
-      -> decltype(memento_to_value(parse_memento(std::move(*value),
+      -> decltype(memento_to_value(parse_memento(std::move(*value), false,
                                                  on_error))) {
-    return memento_to_value(parse_memento(std::move(*value), on_error));
+    return memento_to_value(parse_memento(std::move(*value), false, on_error));
   }
 };
 
@@ -575,8 +601,10 @@ struct ParseValue {
 template <typename Container>
 class ParseHelper {
  public:
-  ParseHelper(Slice value, MetadataParseErrorFn on_error, size_t transport_size)
+  ParseHelper(Slice value, bool will_keep_past_request_lifetime,
+              MetadataParseErrorFn on_error, size_t transport_size)
       : value_(std::move(value)),
+        will_keep_past_request_lifetime_(will_keep_past_request_lifetime),
         on_error_(on_error),
         transport_size_(transport_size) {}
 
@@ -596,12 +624,14 @@ class ParseHelper {
   }
 
  private:
-  template <typename T, T (*parse_memento)(Slice, MetadataParseErrorFn)>
+  template <typename T, T (*parse_memento)(Slice, bool, MetadataParseErrorFn)>
   GPR_ATTRIBUTE_NOINLINE T ParseValueToMemento() {
-    return parse_memento(std::move(value_), on_error_);
+    return parse_memento(std::move(value_), will_keep_past_request_lifetime_,
+                         on_error_);
   }
 
   Slice value_;
+  const bool will_keep_past_request_lifetime_;
   MetadataParseErrorFn on_error_;
   const size_t transport_size_;
 };
@@ -1096,8 +1126,14 @@ MetadataValueAsSlice(typename Which::ValueType value) {
 //   static absl::string_view key() { return "grpc-xyz"; }
 //   // Parse a memento from a slice
 //   // Takes ownership of value
+//   // If will_keep_past_request_lifetime is true, expect that the returned
+//   // memento will be kept for a long time, and so try not to keep a ref to
+//   // the input slice.
 //   // Calls fn in the case of an error that should be reported to the user
-//   static MementoType ParseMemento(Slice value, MementoParseErrorFn fn) {
+//   static MementoType ParseMemento(
+//       Slice value,
+//       bool will_keep_past_request_lifetime,
+//       MementoParseErrorFn fn) {
 //   ...
 //   }
 //   // Convert a memento to a value
@@ -1277,7 +1313,7 @@ class MetadataMap {
   // Remove some metadata by name
   void Remove(absl::string_view key) {
     metadata_detail::RemoveHelper<Derived> helper(static_cast<Derived*>(this));
-    metadata_detail::NameLookup<void, Traits...>::Lookup(key, &helper);
+    metadata_detail::NameLookup<Traits...>::Lookup(key, &helper);
   }
 
   void Remove(const char* key) { Remove(absl::string_view(key)); }
@@ -1287,7 +1323,7 @@ class MetadataMap {
                                                    std::string* buffer) const {
     metadata_detail::GetStringValueHelper<Derived> helper(
         static_cast<const Derived*>(this), buffer);
-    return metadata_detail::NameLookup<void, Traits...>::Lookup(name, &helper);
+    return metadata_detail::NameLookup<Traits...>::Lookup(name, &helper);
   }
 
   // Extract a piece of known metadata.
@@ -1324,11 +1360,13 @@ class MetadataMap {
   // Parse metadata from a key/value pair, and return an object representing
   // that result.
   static ParsedMetadata<Derived> Parse(absl::string_view key, Slice value,
+                                       bool will_keep_past_request_lifetime,
                                        uint32_t transport_size,
                                        MetadataParseErrorFn on_error) {
-    metadata_detail::ParseHelper<Derived> helper(value.TakeOwned(), on_error,
-                                                 transport_size);
-    return metadata_detail::NameLookup<void, Traits...>::Lookup(key, &helper);
+    metadata_detail::ParseHelper<Derived> helper(
+        value.TakeOwned(), will_keep_past_request_lifetime, on_error,
+        transport_size);
+    return metadata_detail::NameLookup<Traits...>::Lookup(key, &helper);
   }
 
   // Set a value from a parsed metadata object.
@@ -1341,7 +1379,7 @@ class MetadataMap {
               MetadataParseErrorFn on_error) {
     metadata_detail::AppendHelper<Derived> helper(static_cast<Derived*>(this),
                                                   value.TakeOwned(), on_error);
-    metadata_detail::NameLookup<void, Traits...>::Lookup(key, &helper);
+    metadata_detail::NameLookup<Traits...>::Lookup(key, &helper);
   }
 
   void Clear();

data/src/core/lib/transport/parsed_metadata.h

@@ -33,6 +33,7 @@
 
 #include <grpc/slice.h>
 
+#include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/gprpp/time.h"
 #include "src/core/lib/slice/slice.h"
 
@@ -193,14 +194,16 @@ class ParsedMetadata {
   // HTTP2 defined storage size of this metadatum.
   uint32_t transport_size() const { return transport_size_; }
   // Create a new parsed metadata with the same key but a different value.
-  ParsedMetadata WithNewValue(Slice value, uint32_t value_wire_size,
+  ParsedMetadata WithNewValue(Slice value, bool will_keep_past_request_lifetime,
+                              uint32_t value_wire_size,
                               MetadataParseErrorFn on_error) const {
     ParsedMetadata result;
     result.vtable_ = vtable_;
     result.value_ = value_;
     result.transport_size_ =
         TransportSize(static_cast<uint32_t>(key().length()), value_wire_size);
-    vtable_->with_new_value(&value, on_error, &result);
+    vtable_->with_new_value(&value, will_keep_past_request_lifetime, on_error,
+                            &result);
     return result;
   }
   std::string DebugString() const { return vtable_->debug_string(value_); }
@@ -224,6 +227,7 @@ class ParsedMetadata {
     void (*const set)(const Buffer& value, MetadataContainer* container);
     // result is a bitwise copy of the originating ParsedMetadata.
     void (*const with_new_value)(Slice* new_value,
+                                 bool will_keep_past_request_lifetime,
                                  MetadataParseErrorFn on_error,
                                  ParsedMetadata* result);
     std::string (*const debug_string)(const Buffer& value);
@@ -241,17 +245,22 @@ class ParsedMetadata {
   template <typename Which>
   static const VTable* SliceTraitVTable();
 
-  template <Slice (*ParseMemento)(Slice, MetadataParseErrorFn)>
+  template <Slice (*ParseMemento)(Slice, bool, MetadataParseErrorFn)>
   GPR_ATTRIBUTE_NOINLINE static void WithNewValueSetSlice(
-      Slice* slice, MetadataParseErrorFn on_error, ParsedMetadata* result) {
+      Slice* slice, bool will_keep_past_request_lifetime,
+      MetadataParseErrorFn on_error, ParsedMetadata* result) {
     result->value_.slice =
-        ParseMemento(std::move(*slice), on_error).TakeCSlice();
+        ParseMemento(std::move(*slice), will_keep_past_request_lifetime,
+                     on_error)
+            .TakeCSlice();
   }
 
-  template <typename T, T (*ParseMemento)(Slice, MetadataParseErrorFn)>
+  template <typename T, T (*ParseMemento)(Slice, bool, MetadataParseErrorFn)>
   GPR_ATTRIBUTE_NOINLINE static void WithNewValueSetTrivial(
-      Slice* slice, MetadataParseErrorFn on_error, ParsedMetadata* result) {
-    T memento = ParseMemento(std::move(*slice), on_error);
+      Slice* slice, bool will_keep_past_request_lifetime,
+      MetadataParseErrorFn on_error, ParsedMetadata* result) {
+    T memento = ParseMemento(std::move(*slice), will_keep_past_request_lifetime,
+                             on_error);
     memcpy(result->value_.trivial, &memento, sizeof(memento));
   }
 
@@ -272,7 +281,7 @@ ParsedMetadata<MetadataContainer>::EmptyVTable() {
       // set
       [](const Buffer&, MetadataContainer*) {},
       // with_new_value
-      [](Slice*, MetadataParseErrorFn, ParsedMetadata*) {},
+      [](Slice*, bool, MetadataParseErrorFn, ParsedMetadata*) {},
       // debug_string
       [](const Buffer&) -> std::string { return "empty"; },
       // key
@@ -330,9 +339,11 @@ ParsedMetadata<MetadataContainer>::NonTrivialTraitVTable() {
         map->Set(Which(), Which::MementoToValue(*p));
       },
       // with_new_value
-      [](Slice* value, MetadataParseErrorFn on_error, ParsedMetadata* result) {
-        result->value_.pointer = new typename Which::MementoType(
-            Which::ParseMemento(std::move(*value), on_error));
+      [](Slice* value, bool will_keep_past_request_lifetime,
+         MetadataParseErrorFn on_error, ParsedMetadata* result) {
+        result->value_.pointer =
+            new typename Which::MementoType(Which::ParseMemento(
+                std::move(*value), will_keep_past_request_lifetime, on_error));
       },
       // debug_string
       [](const Buffer& value) {
@@ -387,14 +398,17 @@ ParsedMetadata<MetadataContainer>::KeyValueVTable(absl::string_view key) {
     auto* p = static_cast<KV*>(value.pointer);
     map->unknown_.Append(p->first.as_string_view(), p->second.Ref());
   };
-  static const auto with_new_value = [](Slice* value, MetadataParseErrorFn,
-                                        ParsedMetadata* result) {
-    auto* p = new KV{
-        static_cast<KV*>(result->value_.pointer)->first.Ref(),
-        std::move(*value),
-    };
-    result->value_.pointer = p;
-  };
+  static const auto with_new_value =
+      [](Slice* value, bool will_keep_past_request_lifetime,
+         MetadataParseErrorFn, ParsedMetadata* result) {
+        auto* p = new KV{
+            static_cast<KV*>(result->value_.pointer)->first.Ref(),
+            will_keep_past_request_lifetime && IsUniqueMetadataStringsEnabled()
+                ? value->TakeUniquelyOwned()
+                : std::move(*value),
+        };
+        result->value_.pointer = p;
+      };
   static const auto debug_string = [](const Buffer& value) {
     auto* p = static_cast<KV*>(value.pointer);
     return absl::StrCat(p->first.as_string_view(), ": ",

data/src/core/lib/transport/simple_slice_based_metadata.h

@@ -19,6 +19,7 @@
 
 #include "absl/strings/string_view.h"
 
+#include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/parsed_metadata.h"
 
@@ -30,8 +31,14 @@ namespace grpc_core {
 struct SimpleSliceBasedMetadata {
   using ValueType = Slice;
   using MementoType = Slice;
-  static MementoType ParseMemento(Slice value, MetadataParseErrorFn) {
-    return value.TakeOwned();
+  static MementoType ParseMemento(Slice value,
+                                  bool will_keep_past_request_lifetime,
+                                  MetadataParseErrorFn) {
+    if (will_keep_past_request_lifetime && IsUniqueMetadataStringsEnabled()) {
+      return value.TakeUniquelyOwned();
+    } else {
+      return value.TakeOwned();
+    }
   }
   static ValueType MementoToValue(MementoType value) { return value; }
   static Slice Encode(const ValueType& x) { return x.Ref(); }

data/src/core/plugin_registry/grpc_plugin_registry.cc

@@ -62,7 +62,6 @@ extern void RegisterPickFirstLbPolicy(CoreConfiguration::Builder* builder);
 extern void RegisterRoundRobinLbPolicy(CoreConfiguration::Builder* builder);
 extern void RegisterWeightedRoundRobinLbPolicy(
     CoreConfiguration::Builder* builder);
-extern void RegisterRingHashLbPolicy(CoreConfiguration::Builder* builder);
 extern void RegisterHttpProxyMapper(CoreConfiguration::Builder* builder);
 #ifndef GRPC_NO_RLS
 extern void RegisterRlsLbPolicy(CoreConfiguration::Builder* builder);
@@ -85,7 +84,6 @@ void BuildCoreConfiguration(CoreConfiguration::Builder* builder) {
   RegisterPickFirstLbPolicy(builder);
   RegisterRoundRobinLbPolicy(builder);
   RegisterWeightedRoundRobinLbPolicy(builder);
-  RegisterRingHashLbPolicy(builder);
   BuildClientChannelConfiguration(builder);
   SecurityRegisterHandshakerFactories(builder);
   RegisterClientAuthorityFilter(builder);

data/src/core/plugin_registry/grpc_plugin_registry_extra.cc

@@ -39,6 +39,7 @@ extern void RegisterXdsClusterResolverLbPolicy(
 extern void RegisterXdsOverrideHostLbPolicy(
     CoreConfiguration::Builder* builder);
 extern void RegisterXdsWrrLocalityLbPolicy(CoreConfiguration::Builder* builder);
+extern void RegisterRingHashLbPolicy(CoreConfiguration::Builder* builder);
 extern void RegisterFileWatcherCertificateProvider(
     CoreConfiguration::Builder* builder);
 #endif
@@ -60,6 +61,7 @@ void RegisterExtraFilters(CoreConfiguration::Builder* builder) {
   RegisterXdsClusterResolverLbPolicy(builder);
   RegisterXdsOverrideHostLbPolicy(builder);
   RegisterXdsWrrLocalityLbPolicy(builder);
+  RegisterRingHashLbPolicy(builder);
   RegisterFileWatcherCertificateProvider(builder);
 #endif
 }

data/src/core/tsi/alts/crypt/aes_gcm.cc

@@ -35,7 +35,12 @@ constexpr size_t kKdfCounterLen = 6;
 constexpr size_t kKdfCounterOffset = 2;
 constexpr size_t kRekeyAeadKeyLen = kAes128GcmKeyLength;
 
-// Struct for additional data required if rekeying is enabled.
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+const char kEvpMacAlgorithm[] = "HMAC";
+char kEvpDigest[] = "SHA-256";
+#endif
+
+/* Struct for additional data required if rekeying is enabled. */
 struct gsec_aes_gcm_aead_rekey_data {
   uint8_t kdf_counter[kKdfCounterLen];
   uint8_t nonce_mask[kAesGcmNonceLength];
@@ -196,7 +201,7 @@ static grpc_status_code aes_gcm_derive_aead_key(uint8_t* dst,
     return GRPC_STATUS_INTERNAL;
   }
   HMAC_CTX_cleanup(&hmac);
-#else
+#elif OPENSSL_VERSION_NUMBER < 0x30000000L
   HMAC_CTX* hmac = HMAC_CTX_new();
   if (hmac == nullptr) {
     return GRPC_STATUS_INTERNAL;
@@ -208,6 +213,26 @@ static grpc_status_code aes_gcm_derive_aead_key(uint8_t* dst,
     return GRPC_STATUS_INTERNAL;
   }
   HMAC_CTX_free(hmac);
+#else
+  EVP_MAC* mac = EVP_MAC_fetch(nullptr, kEvpMacAlgorithm, nullptr);
+  EVP_MAC_CTX* ctx = EVP_MAC_CTX_new(mac);
+  if (ctx == nullptr) {
+    return GRPC_STATUS_INTERNAL;
+  }
+  OSSL_PARAM params[2];
+  params[0] = OSSL_PARAM_construct_utf8_string("digest", kEvpDigest, 0);
+  params[1] = OSSL_PARAM_construct_end();
+
+  if (!EVP_MAC_init(ctx, kdf_key, kKdfKeyLen, params) ||
+      !EVP_MAC_update(ctx, kdf_counter, kKdfCounterLen) ||
+      !EVP_MAC_update(ctx, &ctr, 1) ||
+      !EVP_MAC_final(ctx, buf, nullptr, EVP_MAX_MD_SIZE)) {
+    EVP_MAC_CTX_free(ctx);
+    EVP_MAC_free(mac);
+    return GRPC_STATUS_INTERNAL;
+  }
+  EVP_MAC_CTX_free(ctx);
+  EVP_MAC_free(mac);
 #endif
   memcpy(dst, buf, kRekeyAeadKeyLen);
   return GRPC_STATUS_OK;

data/src/core/tsi/alts/zero_copy_frame_protector/alts_grpc_record_protocol_common.cc

@@ -124,9 +124,8 @@ tsi_result alts_grpc_record_protocol_init(alts_grpc_record_protocol* rp,
 tsi_result alts_grpc_record_protocol_protect(
     alts_grpc_record_protocol* self, grpc_slice_buffer* unprotected_slices,
     grpc_slice_buffer* protected_slices) {
-  if (grpc_core::ExecCtx::Get() == nullptr || self == nullptr ||
-      self->vtable == nullptr || unprotected_slices == nullptr ||
-      protected_slices == nullptr) {
+  if (self == nullptr || self->vtable == nullptr ||
+      unprotected_slices == nullptr || protected_slices == nullptr) {
     return TSI_INVALID_ARGUMENT;
   }
   if (self->vtable->protect == nullptr) {
@@ -138,9 +137,8 @@ tsi_result alts_grpc_record_protocol_protect(
 tsi_result alts_grpc_record_protocol_unprotect(
     alts_grpc_record_protocol* self, grpc_slice_buffer* protected_slices,
     grpc_slice_buffer* unprotected_slices) {
-  if (grpc_core::ExecCtx::Get() == nullptr || self == nullptr ||
-      self->vtable == nullptr || protected_slices == nullptr ||
-      unprotected_slices == nullptr) {
+  if (self == nullptr || self->vtable == nullptr ||
+      protected_slices == nullptr || unprotected_slices == nullptr) {
     return TSI_INVALID_ARGUMENT;
   }
   if (self->vtable->unprotect == nullptr) {

data/src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.cc

@@ -263,8 +263,7 @@ tsi_result alts_zero_copy_grpc_protector_create(
     bool is_integrity_only, bool enable_extra_copy,
     size_t* max_protected_frame_size,
     tsi_zero_copy_grpc_protector** protector) {
-  if (grpc_core::ExecCtx::Get() == nullptr || key == nullptr ||
-      protector == nullptr) {
+  if (key == nullptr || protector == nullptr) {
     gpr_log(
         GPR_ERROR,
         "Invalid nullptr arguments to alts_zero_copy_grpc_protector create.");

data/src/core/tsi/ssl_transport_security.cc

@@ -65,6 +65,7 @@
 
 // --- Constants. ---
 
+#define TSI_SSL_MAX_BIO_WRITE_ATTEMPTS 100
 #define TSI_SSL_MAX_PROTECTED_FRAME_SIZE_UPPER_BOUND 16384
 #define TSI_SSL_MAX_PROTECTED_FRAME_SIZE_LOWER_BOUND 1024
 #define TSI_SSL_HANDSHAKER_OUTGOING_BUFFER_INITIAL_SIZE 1024
@@ -148,6 +149,9 @@ static int g_ssl_ex_verified_root_cert_index = -1;
 #if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_NO_ENGINE)
 static const char kSslEnginePrefix[] = "engine:";
 #endif
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+static const int kSslEcCurveNames[] = {NID_X9_62_prime256v1};
+#endif
 
 #if OPENSSL_VERSION_NUMBER < 0x10100000
 static gpr_mu* g_openssl_mutexes = nullptr;
@@ -788,6 +792,7 @@ static tsi_result populate_ssl_context(
     return TSI_INVALID_ARGUMENT;
   }
   {
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
     EC_KEY* ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
     if (!SSL_CTX_set_tmp_ecdh(context, ecdh)) {
       gpr_log(GPR_ERROR, "Could not set ephemeral ECDH key.");
@@ -796,6 +801,13 @@ static tsi_result populate_ssl_context(
     }
     SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
     EC_KEY_free(ecdh);
+#else
+    if (!SSL_CTX_set1_groups(context, kSslEcCurveNames, 1)) {
+      gpr_log(GPR_ERROR, "Could not set ephemeral ECDH key.");
+      return TSI_INTERNAL_ERROR;
+    }
+    SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
+#endif
   }
   return TSI_OK;
 }
@@ -1538,15 +1550,35 @@ static tsi_result ssl_handshaker_next(tsi_handshaker* self,
   // If there are received bytes, process them first.
   tsi_ssl_handshaker* impl = reinterpret_cast<tsi_ssl_handshaker*>(self);
   tsi_result status = TSI_OK;
-  size_t bytes_consumed = received_bytes_size;
   size_t bytes_written = 0;
   if (received_bytes_size > 0) {
-    status = ssl_handshaker_process_bytes_from_peer(impl, received_bytes,
-                                                    &bytes_consumed, error);
-    while (status == TSI_DRAIN_BUFFER) {
-      status = ssl_handshaker_write_output_buffer(self, &bytes_written, error);
-      if (status != TSI_OK) return status;
-      status = ssl_handshaker_do_handshake(impl, error);
+    unsigned char* remaining_bytes_to_write_to_openssl =
+        const_cast<unsigned char*>(received_bytes);
+    size_t remaining_bytes_to_write_to_openssl_size = received_bytes_size;
+    size_t number_bio_write_attempts = 0;
+    while (remaining_bytes_to_write_to_openssl_size > 0 &&
+           (status == TSI_OK || status == TSI_INCOMPLETE_DATA) &&
+           number_bio_write_attempts < TSI_SSL_MAX_BIO_WRITE_ATTEMPTS) {
+      ++number_bio_write_attempts;
+      // Try to write all of the remaining bytes to the BIO.
+      size_t bytes_written_to_openssl =
+          remaining_bytes_to_write_to_openssl_size;
+      status = ssl_handshaker_process_bytes_from_peer(
+          impl, remaining_bytes_to_write_to_openssl, &bytes_written_to_openssl,
+          error);
+      // As long as the BIO is full, drive the SSL handshake to consume bytes
+      // from the BIO. If the SSL handshake returns any bytes, write them to the
+      // peer.
+      while (status == TSI_DRAIN_BUFFER) {
+        status =
+            ssl_handshaker_write_output_buffer(self, &bytes_written, error);
+        if (status != TSI_OK) return status;
+        status = ssl_handshaker_do_handshake(impl, error);
+      }
+      // Move the pointer to the first byte not yet successfully written to the
+      // BIO.
+      remaining_bytes_to_write_to_openssl_size -= bytes_written_to_openssl;
+      remaining_bytes_to_write_to_openssl += bytes_written_to_openssl;
     }
   }
   if (status != TSI_OK) return status;
@@ -2202,12 +2234,15 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
         STACK_OF(X509_NAME)* root_names = nullptr;
         result = ssl_ctx_load_verification_certs(
             impl->ssl_contexts[i], options->pem_client_root_certs,
-            strlen(options->pem_client_root_certs), &root_names);
+            strlen(options->pem_client_root_certs),
+            options->send_client_ca_list ? &root_names : nullptr);
         if (result != TSI_OK) {
           gpr_log(GPR_ERROR, "Invalid verification certs.");
           break;
         }
-        SSL_CTX_set_client_CA_list(impl->ssl_contexts[i], root_names);
+        if (options->send_client_ca_list) {
+          SSL_CTX_set_client_CA_list(impl->ssl_contexts[i], root_names);
+        }
       }
       switch (options->client_certificate_request) {
         case TSI_DONT_REQUEST_CLIENT_CERTIFICATE: