grpc 1.63.0 → 1.65.2

data/src/core/{client_channel → handshaker/http_connect}/http_proxy_mapper.h

@@ -16,19 +16,19 @@
 //
 //
 
-#ifndef GRPC_SRC_CORE_CLIENT_CHANNEL_HTTP_PROXY_MAPPER_H
-#define GRPC_SRC_CORE_CLIENT_CHANNEL_HTTP_PROXY_MAPPER_H
-
-#include <grpc/support/port_platform.h>
+#ifndef GRPC_SRC_CORE_HANDSHAKER_HTTP_CONNECT_HTTP_PROXY_MAPPER_H
+#define GRPC_SRC_CORE_HANDSHAKER_HTTP_CONNECT_HTTP_PROXY_MAPPER_H
 
 #include <string>
 
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
+#include <grpc/support/port_platform.h>
+
+#include "src/core/handshaker/proxy_mapper.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/config/core_configuration.h"
-#include "src/core/lib/handshaker/proxy_mapper.h"
 #include "src/core/lib/iomgr/resolved_address.h"
 
 namespace grpc_core {
@@ -50,4 +50,4 @@ void RegisterHttpProxyMapper(CoreConfiguration::Builder* builder);
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_CLIENT_CHANNEL_HTTP_PROXY_MAPPER_H
+#endif  // GRPC_SRC_CORE_HANDSHAKER_HTTP_CONNECT_HTTP_PROXY_MAPPER_H

data/src/core/{lib/handshaker → handshaker}/proxy_mapper.h

@@ -16,16 +16,16 @@
 //
 //
 
-#ifndef GRPC_SRC_CORE_LIB_HANDSHAKER_PROXY_MAPPER_H
-#define GRPC_SRC_CORE_LIB_HANDSHAKER_PROXY_MAPPER_H
-
-#include <grpc/support/port_platform.h>
+#ifndef GRPC_SRC_CORE_HANDSHAKER_PROXY_MAPPER_H
+#define GRPC_SRC_CORE_HANDSHAKER_PROXY_MAPPER_H
 
 #include <string>
 
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
+#include <grpc/support/port_platform.h>
+
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/resolved_address.h"
 
@@ -50,4 +50,4 @@ class ProxyMapperInterface {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_HANDSHAKER_PROXY_MAPPER_H
+#endif  // GRPC_SRC_CORE_HANDSHAKER_PROXY_MAPPER_H

data/src/core/{lib/handshaker → handshaker}/proxy_mapper_registry.cc

@@ -16,9 +16,7 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
-#include "src/core/lib/handshaker/proxy_mapper_registry.h"
+#include "src/core/handshaker/proxy_mapper_registry.h"
 
 #include <algorithm>
 #include <memory>
@@ -27,6 +25,8 @@
 
 #include "absl/types/optional.h"
 
+#include <grpc/support/port_platform.h>
+
 namespace grpc_core {
 
 void ProxyMapperRegistry::Builder::Register(

data/src/core/{lib/handshaker → handshaker}/proxy_mapper_registry.h

@@ -16,10 +16,8 @@
 //
 //
 
-#ifndef GRPC_SRC_CORE_LIB_HANDSHAKER_PROXY_MAPPER_REGISTRY_H
-#define GRPC_SRC_CORE_LIB_HANDSHAKER_PROXY_MAPPER_REGISTRY_H
-
-#include <grpc/support/port_platform.h>
+#ifndef GRPC_SRC_CORE_HANDSHAKER_PROXY_MAPPER_REGISTRY_H
+#define GRPC_SRC_CORE_HANDSHAKER_PROXY_MAPPER_REGISTRY_H
 
 #include <algorithm>
 #include <memory>
@@ -29,8 +27,10 @@
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
+#include <grpc/support/port_platform.h>
+
+#include "src/core/handshaker/proxy_mapper.h"
 #include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/handshaker/proxy_mapper.h"
 #include "src/core/lib/iomgr/resolved_address.h"
 
 namespace grpc_core {
@@ -72,4 +72,4 @@ class ProxyMapperRegistry {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_HANDSHAKER_PROXY_MAPPER_REGISTRY_H
+#endif  // GRPC_SRC_CORE_HANDSHAKER_PROXY_MAPPER_REGISTRY_H

data/src/core/{lib/security/transport → handshaker/security}/secure_endpoint.cc

@@ -16,9 +16,7 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
-#include "src/core/lib/security/transport/secure_endpoint.h"
+#include "src/core/handshaker/security/secure_endpoint.h"
 
 #include <inttypes.h>
 
@@ -27,6 +25,8 @@
 #include <memory>
 
 #include "absl/base/thread_annotations.h"
+#include "absl/log/check.h"
+#include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
@@ -38,10 +38,10 @@
 #include <grpc/support/alloc.h>
 #include <grpc/support/atm.h>
 #include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 #include <grpc/support/sync.h>
 
 #include "src/core/lib/debug/trace.h"
-#include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/sync.h"
@@ -52,16 +52,16 @@
 #include "src/core/lib/resource_quota/api.h"
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/lib/resource_quota/resource_quota.h"
-#include "src/core/lib/resource_quota/trace.h"
-#include "src/core/lib/security/transport/tsi_error.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
 #include "src/core/tsi/transport_security_grpc.h"
 #include "src/core/tsi/transport_security_interface.h"
+#include "src/core/util/string.h"
 
 #define STAGING_BUFFER_SIZE 8192
 
 static void on_read(void* user_data, grpc_error_handle error);
+static void on_write(void* user_data, grpc_error_handle error);
 
 namespace {
 struct secure_endpoint {
@@ -77,6 +77,7 @@ struct secure_endpoint {
     base.vtable = vtable;
     gpr_mu_init(&protector_mu);
     GRPC_CLOSURE_INIT(&on_read, ::on_read, this, grpc_schedule_on_exec_ctx);
+    GRPC_CLOSURE_INIT(&on_write, ::on_write, this, grpc_schedule_on_exec_ctx);
     grpc_slice_buffer_init(&source_buffer);
     grpc_slice_buffer_init(&leftover_bytes);
     for (size_t i = 0; i < leftover_nslices; i++) {
@@ -104,7 +105,7 @@ struct secure_endpoint {
   }
 
   ~secure_endpoint() {
-    grpc_endpoint_destroy(wrapped_ep);
+    memory_owner.Reset();
     tsi_frame_protector_destroy(protector);
     tsi_zero_copy_grpc_protector_destroy(zero_copy_protector);
     grpc_slice_buffer_destroy(&source_buffer);
@@ -127,6 +128,7 @@ struct secure_endpoint {
   grpc_closure* read_cb = nullptr;
   grpc_closure* write_cb = nullptr;
   grpc_closure on_read;
+  grpc_closure on_write;
   grpc_slice_buffer* read_buffer = nullptr;
   grpc_slice_buffer source_buffer;
   // saved handshaker leftover data to unprotect.
@@ -144,8 +146,6 @@ struct secure_endpoint {
 };
 }  // namespace
 
-grpc_core::TraceFlag grpc_trace_secure_endpoint(false, "secure_endpoint");
-
 static void destroy(secure_endpoint* ep) { delete ep; }
 
 #ifndef NDEBUG
@@ -155,7 +155,7 @@ static void destroy(secure_endpoint* ep) { delete ep; }
   secure_endpoint_ref((ep), (reason), __FILE__, __LINE__)
 static void secure_endpoint_unref(secure_endpoint* ep, const char* reason,
                                   const char* file, int line) {
-  if (GRPC_TRACE_FLAG_ENABLED(grpc_trace_secure_endpoint)) {
+  if (GRPC_TRACE_FLAG_ENABLED(secure_endpoint)) {
     gpr_atm val = gpr_atm_no_barrier_load(&ep->ref.count);
     gpr_log(file, line, GPR_LOG_SEVERITY_DEBUG,
             "SECENDP unref %p : %s %" PRIdPTR " -> %" PRIdPTR, ep, reason, val,
@@ -168,7 +168,7 @@ static void secure_endpoint_unref(secure_endpoint* ep, const char* reason,
 
 static void secure_endpoint_ref(secure_endpoint* ep, const char* reason,
                                 const char* file, int line) {
-  if (GRPC_TRACE_FLAG_ENABLED(grpc_trace_secure_endpoint)) {
+  if (GRPC_TRACE_FLAG_ENABLED(secure_endpoint)) {
     gpr_atm val = gpr_atm_no_barrier_load(&ep->ref.count);
     gpr_log(file, line, GPR_LOG_SEVERITY_DEBUG,
             "SECENDP   ref %p : %s %" PRIdPTR " -> %" PRIdPTR, ep, reason, val,
@@ -196,7 +196,7 @@ static void maybe_post_reclaimer(secure_endpoint* ep) {
         grpc_core::ReclamationPass::kBenign,
         [ep](absl::optional<grpc_core::ReclamationSweep> sweep) {
           if (sweep.has_value()) {
-            if (GRPC_TRACE_FLAG_ENABLED(grpc_resource_quota_trace)) {
+            if (GRPC_TRACE_FLAG_ENABLED(resource_quota)) {
               gpr_log(GPR_INFO,
                       "secure endpoint: benign reclamation to free memory");
             }
@@ -233,13 +233,12 @@ static void flush_read_staging_buffer(secure_endpoint* ep, uint8_t** cur,
 }
 
 static void call_read_cb(secure_endpoint* ep, grpc_error_handle error) {
-  if (GRPC_TRACE_FLAG_ENABLED(grpc_trace_secure_endpoint) &&
-      gpr_should_log(GPR_LOG_SEVERITY_INFO)) {
+  if (GRPC_TRACE_FLAG_ENABLED(secure_endpoint) && ABSL_VLOG_IS_ON(2)) {
     size_t i;
     for (i = 0; i < ep->read_buffer->count; i++) {
       char* data = grpc_dump_slice(ep->read_buffer->slices[i],
                                    GPR_DUMP_HEX | GPR_DUMP_ASCII);
-      gpr_log(GPR_INFO, "READ %p: %s", ep, data);
+      VLOG(2) << "READ " << ep << ": " << data;
       gpr_free(data);
     }
   }
@@ -261,12 +260,7 @@ static void on_read(void* user_data, grpc_error_handle error) {
 
     if (!error.ok()) {
       grpc_slice_buffer_reset_and_unref(ep->read_buffer);
-      call_read_cb(
-          ep, GRPC_ERROR_CREATE_REFERENCING("Secure read failed", &error, 1));
-      return;
-    }
-
-    if (ep->zero_copy_protector != nullptr) {
+    } else if (ep->zero_copy_protector != nullptr) {
       // Use zero-copy grpc protector to unprotect.
       int min_progress_size = 1;
       // Get the size of the last frame which is not yet fully decrypted.
@@ -334,14 +328,21 @@ static void on_read(void* user_data, grpc_error_handle error) {
     }
   }
 
+  if (!error.ok()) {
+    call_read_cb(
+        ep, GRPC_ERROR_CREATE_REFERENCING("Secure read failed", &error, 1));
+    return;
+  }
+
   // TODO(yangg) experiment with moving this block after read_cb to see if it
   // helps latency
   grpc_slice_buffer_reset_and_unref(&ep->source_buffer);
 
   if (result != TSI_OK) {
     grpc_slice_buffer_reset_and_unref(ep->read_buffer);
-    call_read_cb(ep, grpc_set_tsi_error_result(
-                         GRPC_ERROR_CREATE("Unwrap failed"), result));
+    call_read_cb(
+        ep, GRPC_ERROR_CREATE(absl::StrCat("Unwrap failed (",
+                                           tsi_result_to_string(result), ")")));
     return;
   }
 
@@ -359,7 +360,7 @@ static void endpoint_read(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
   SECURE_ENDPOINT_REF(ep, "read");
   if (ep->leftover_bytes.count) {
     grpc_slice_buffer_swap(&ep->leftover_bytes, &ep->source_buffer);
-    GPR_ASSERT(ep->leftover_bytes.count == 0);
+    CHECK_EQ(ep->leftover_bytes.count, 0u);
     on_read(ep, absl::OkStatus());
     return;
   }
@@ -379,6 +380,13 @@ static void flush_write_staging_buffer(secure_endpoint* ep, uint8_t** cur,
   maybe_post_reclaimer(ep);
 }
 
+static void on_write(void* user_data, grpc_error_handle error) {
+  secure_endpoint* ep = static_cast<secure_endpoint*>(user_data);
+  grpc_core::ExecCtx::Run(DEBUG_LOCATION, std::exchange(ep->write_cb, nullptr),
+                          std::move(error));
+  SECURE_ENDPOINT_UNREF(ep, "write");
+}
+
 static void endpoint_write(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
                            grpc_closure* cb, void* arg, int max_frame_size) {
   unsigned i;
@@ -392,12 +400,11 @@ static void endpoint_write(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
 
     grpc_slice_buffer_reset_and_unref(&ep->output_buffer);
 
-    if (GRPC_TRACE_FLAG_ENABLED(grpc_trace_secure_endpoint) &&
-        gpr_should_log(GPR_LOG_SEVERITY_INFO)) {
+    if (GRPC_TRACE_FLAG_ENABLED(secure_endpoint) && ABSL_VLOG_IS_ON(2)) {
       for (i = 0; i < slices->count; i++) {
         char* data =
             grpc_dump_slice(slices->slices[i], GPR_DUMP_HEX | GPR_DUMP_ASCII);
-        gpr_log(GPR_INFO, "WRITE %p: %s", ep, data);
+        VLOG(2) << "WRITE " << ep << ": " << data;
         gpr_free(data);
       }
     }
@@ -484,22 +491,22 @@ static void endpoint_write(grpc_endpoint* secure_ep, grpc_slice_buffer* slices,
     grpc_slice_buffer_reset_and_unref(&ep->output_buffer);
     grpc_core::ExecCtx::Run(
         DEBUG_LOCATION, cb,
-        grpc_set_tsi_error_result(GRPC_ERROR_CREATE("Wrap failed"), result));
+        GRPC_ERROR_CREATE(
+            absl::StrCat("Wrap failed (", tsi_result_to_string(result), ")")));
     return;
   }
 
-  grpc_endpoint_write(ep->wrapped_ep, &ep->output_buffer, cb, arg,
+  // Need to hold a ref here, because the wrapped endpoint may access
+  // output_buffer at any time until the write completes.
+  SECURE_ENDPOINT_REF(ep, "write");
+  ep->write_cb = cb;
+  grpc_endpoint_write(ep->wrapped_ep, &ep->output_buffer, &ep->on_write, arg,
                       max_frame_size);
 }
 
-static void endpoint_shutdown(grpc_endpoint* secure_ep, grpc_error_handle why) {
-  secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
-  grpc_endpoint_shutdown(ep->wrapped_ep, why);
-}
-
 static void endpoint_destroy(grpc_endpoint* secure_ep) {
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
-  ep->memory_owner.Reset();
+  grpc_endpoint_destroy(ep->wrapped_ep);
   SECURE_ENDPOINT_UNREF(ep, "destroy");
 }
 
@@ -546,7 +553,6 @@ static const grpc_endpoint_vtable vtable = {endpoint_read,
                                             endpoint_add_to_pollset,
                                             endpoint_add_to_pollset_set,
                                             endpoint_delete_from_pollset_set,
-                                            endpoint_shutdown,
                                             endpoint_destroy,
                                             endpoint_get_peer,
                                             endpoint_get_local_address,

data/src/core/{lib/security/transport → handshaker/security}/secure_endpoint.h

@@ -16,21 +16,18 @@
 //
 //
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_TRANSPORT_SECURE_ENDPOINT_H
-#define GRPC_SRC_CORE_LIB_SECURITY_TRANSPORT_SECURE_ENDPOINT_H
-
-#include <grpc/support/port_platform.h>
+#ifndef GRPC_SRC_CORE_HANDSHAKER_SECURITY_SECURE_ENDPOINT_H
+#define GRPC_SRC_CORE_HANDSHAKER_SECURITY_SECURE_ENDPOINT_H
 
 #include <stddef.h>
 
 #include <grpc/grpc.h>
 #include <grpc/slice.h>
+#include <grpc/support/port_platform.h>
 
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/iomgr/endpoint.h"
 
-extern grpc_core::TraceFlag grpc_trace_secure_endpoint;
-
 // Takes ownership of protector, zero_copy_protector, and to_wrap, and refs
 // leftover_slices. If zero_copy_protector is not NULL, protector will never be
 // used.
@@ -40,4 +37,4 @@ grpc_endpoint* grpc_secure_endpoint_create(
     grpc_endpoint* to_wrap, grpc_slice* leftover_slices,
     const grpc_channel_args* channel_args, size_t leftover_nslices);
 
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_TRANSPORT_SECURE_ENDPOINT_H
+#endif  // GRPC_SRC_CORE_HANDSHAKER_SECURITY_SECURE_ENDPOINT_H

data/src/core/{lib/security/transport → handshaker/security}/security_handshaker.cc

@@ -16,9 +16,7 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
-#include "src/core/lib/security/transport/security_handshaker.h"
+#include "src/core/handshaker/security/security_handshaker.h"
 
 #include <limits.h>
 #include <stdint.h>
@@ -30,6 +28,7 @@
 #include <utility>
 
 #include "absl/base/attributes.h"
+#include "absl/log/check.h"
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
@@ -42,12 +41,15 @@
 #include <grpc/slice_buffer.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 
+#include "src/core/channelz/channelz.h"
+#include "src/core/handshaker/handshaker.h"
+#include "src/core/handshaker/handshaker_factory.h"
+#include "src/core/handshaker/handshaker_registry.h"
+#include "src/core/handshaker/security/secure_endpoint.h"
 #include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/channel/channelz.h"
 #include "src/core/lib/config/core_configuration.h"
-#include "src/core/lib/debug/stats.h"
-#include "src/core/lib/debug/stats_data.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/sync.h"
@@ -59,13 +61,10 @@
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/iomgr/tcp_server.h"
 #include "src/core/lib/security/context/security_context.h"
-#include "src/core/lib/security/transport/secure_endpoint.h"
-#include "src/core/lib/security/transport/tsi_error.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"
-#include "src/core/lib/transport/handshaker.h"
-#include "src/core/lib/transport/handshaker_factory.h"
-#include "src/core/lib/transport/handshaker_registry.h"
+#include "src/core/telemetry/stats.h"
+#include "src/core/telemetry/stats_data.h"
 #include "src/core/tsi/transport_security_grpc.h"
 
 #define GRPC_INITIAL_HANDSHAKE_BUFFER_SIZE 256
@@ -118,8 +117,7 @@ class SecurityHandshaker : public Handshaker {
   Mutex mu_;
 
   bool is_shutdown_ = false;
-  // Endpoint and read buffer to destroy after a shutdown.
-  grpc_endpoint* endpoint_to_destroy_ = nullptr;
+  // Read buffer to destroy after a shutdown.
   grpc_slice_buffer* read_buffer_to_destroy_ = nullptr;
 
   // State saved while performing the handshake.
@@ -156,9 +154,6 @@ SecurityHandshaker::SecurityHandshaker(tsi_handshaker* handshaker,
 SecurityHandshaker::~SecurityHandshaker() {
   tsi_handshaker_destroy(handshaker_);
   tsi_handshaker_result_destroy(handshaker_result_);
-  if (endpoint_to_destroy_ != nullptr) {
-    grpc_endpoint_destroy(endpoint_to_destroy_);
-  }
   if (read_buffer_to_destroy_ != nullptr) {
     grpc_slice_buffer_destroy(read_buffer_to_destroy_);
     gpr_free(read_buffer_to_destroy_);
@@ -190,8 +185,6 @@ size_t SecurityHandshaker::MoveReadBufferIntoHandshakeBuffer() {
 // Set args_ fields to NULL, saving the endpoint and read buffer for
 // later destruction.
 void SecurityHandshaker::CleanupArgsForFailureLocked() {
-  endpoint_to_destroy_ = args_->endpoint;
-  args_->endpoint = nullptr;
   read_buffer_to_destroy_ = args_->read_buffer;
   args_->read_buffer = nullptr;
   args_->args = ChannelArgs();
@@ -207,11 +200,8 @@ void SecurityHandshaker::HandshakeFailedLocked(grpc_error_handle error) {
   }
   if (!is_shutdown_) {
     tsi_handshaker_shutdown(handshaker_);
-    // TODO(ctiller): It is currently necessary to shutdown endpoints
-    // before destroying them, even if we know that there are no
-    // pending read/write callbacks.  This should be fixed, at which
-    // point this can be removed.
-    grpc_endpoint_shutdown(args_->endpoint, error);
+    grpc_endpoint_destroy(args_->endpoint);
+    args_->endpoint = nullptr;
     // Not shutting down, so the write failed.  Clean up before
     // invoking the callback.
     CleanupArgsForFailureLocked();
@@ -260,10 +250,9 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
   tsi_result result = tsi_handshaker_result_get_unused_bytes(
       handshaker_result_, &unused_bytes, &unused_bytes_size);
   if (result != TSI_OK) {
-    HandshakeFailedLocked(grpc_set_tsi_error_result(
-        GRPC_ERROR_CREATE(
-            "TSI handshaker result does not provide unused bytes"),
-        result));
+    HandshakeFailedLocked(GRPC_ERROR_CREATE(
+        absl::StrCat("TSI handshaker result does not provide unused bytes (",
+                     tsi_result_to_string(result), ")")));
     return;
   }
   // Check whether we need to wrap the endpoint.
@@ -271,10 +260,10 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
   result = tsi_handshaker_result_get_frame_protector_type(
       handshaker_result_, &frame_protector_type);
   if (result != TSI_OK) {
-    HandshakeFailedLocked(grpc_set_tsi_error_result(
-        GRPC_ERROR_CREATE("TSI handshaker result does not implement "
-                          "get_frame_protector_type"),
-        result));
+    HandshakeFailedLocked(GRPC_ERROR_CREATE(
+        absl::StrCat("TSI handshaker result does not implement "
+                     "get_frame_protector_type (",
+                     tsi_result_to_string(result), ")")));
     return;
   }
   tsi_zero_copy_grpc_protector* zero_copy_protector = nullptr;
@@ -288,9 +277,9 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
           handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
           &zero_copy_protector);
       if (result != TSI_OK) {
-        HandshakeFailedLocked(grpc_set_tsi_error_result(
-            GRPC_ERROR_CREATE("Zero-copy frame protector creation failed"),
-            result));
+        HandshakeFailedLocked(GRPC_ERROR_CREATE(
+            absl::StrCat("Zero-copy frame protector creation failed (",
+                         tsi_result_to_string(result), ")")));
         return;
       }
       break;
@@ -300,8 +289,9 @@ void SecurityHandshaker::OnPeerCheckedInner(grpc_error_handle error) {
           handshaker_result_, max_frame_size_ == 0 ? nullptr : &max_frame_size_,
           &protector);
       if (result != TSI_OK) {
-        HandshakeFailedLocked(grpc_set_tsi_error_result(
-            GRPC_ERROR_CREATE("Frame protector creation failed"), result));
+        HandshakeFailedLocked(
+            GRPC_ERROR_CREATE(absl::StrCat("Frame protector creation failed (",
+                                           tsi_result_to_string(result), ")")));
         return;
       }
       break;
@@ -356,8 +346,8 @@ grpc_error_handle SecurityHandshaker::CheckPeerLocked() {
   tsi_result result =
       tsi_handshaker_result_extract_peer(handshaker_result_, &peer);
   if (result != TSI_OK) {
-    return grpc_set_tsi_error_result(
-        GRPC_ERROR_CREATE("Peer extraction failed"), result);
+    return GRPC_ERROR_CREATE(absl::StrCat("Peer extraction failed (",
+                                          tsi_result_to_string(result), ")"));
   }
   connector_->check_peer(peer, args_->endpoint, args_->args, &auth_context_,
                          &on_peer_checked_);
@@ -382,7 +372,7 @@ grpc_error_handle SecurityHandshaker::OnHandshakeNextDoneLocked(
   }
   // Read more if we need to.
   if (result == TSI_INCOMPLETE_DATA) {
-    GPR_ASSERT(bytes_to_send_size == 0);
+    CHECK_EQ(bytes_to_send_size, 0u);
     grpc_endpoint_read(
         args_->endpoint, args_->read_buffer,
         GRPC_CLOSURE_INIT(
@@ -398,15 +388,13 @@ grpc_error_handle SecurityHandshaker::OnHandshakeNextDoneLocked(
     if (security_connector != nullptr) {
       connector_type = security_connector->type().name();
     }
-    return grpc_set_tsi_error_result(
-        GRPC_ERROR_CREATE(absl::StrCat(
-            connector_type, " handshake failed",
-            (tsi_handshake_error_.empty() ? "" : ": "), tsi_handshake_error_)),
-        result);
+    return GRPC_ERROR_CREATE(absl::StrCat(
+        connector_type, " handshake failed (", tsi_result_to_string(result),
+        ")", (tsi_handshake_error_.empty() ? "" : ": "), tsi_handshake_error_));
   }
   // Update handshaker result.
   if (handshaker_result != nullptr) {
-    GPR_ASSERT(handshaker_result_ == nullptr);
+    CHECK_EQ(handshaker_result_, nullptr);
     handshaker_result_ = handshaker_result;
   }
   if (bytes_to_send_size > 0) {
@@ -558,7 +546,8 @@ void SecurityHandshaker::Shutdown(grpc_error_handle why) {
     is_shutdown_ = true;
     connector_->cancel_check_peer(&on_peer_checked_, why);
     tsi_handshaker_shutdown(handshaker_);
-    grpc_endpoint_shutdown(args_->endpoint, why);
+    grpc_endpoint_destroy(args_->endpoint);
+    args_->endpoint = nullptr;
     CleanupArgsForFailureLocked();
   }
 }
@@ -592,7 +581,6 @@ class FailHandshaker : public Handshaker {
   void DoHandshake(grpc_tcp_server_acceptor* /*acceptor*/,
                    grpc_closure* on_handshake_done,
                    HandshakerArgs* args) override {
-    grpc_endpoint_shutdown(args->endpoint, status_);
     grpc_endpoint_destroy(args->endpoint);
     args->endpoint = nullptr;
     args->args = ChannelArgs();

data/src/core/{lib/security/transport → handshaker/security}/security_handshaker.h

@@ -16,20 +16,19 @@
 //
 //
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_TRANSPORT_SECURITY_HANDSHAKER_H
-#define GRPC_SRC_CORE_LIB_SECURITY_TRANSPORT_SECURITY_HANDSHAKER_H
-
-#include <grpc/support/port_platform.h>
+#ifndef GRPC_SRC_CORE_HANDSHAKER_SECURITY_SECURITY_HANDSHAKER_H
+#define GRPC_SRC_CORE_HANDSHAKER_SECURITY_SECURITY_HANDSHAKER_H
 
 #include "absl/status/statusor.h"
 
 #include <grpc/grpc.h>
+#include <grpc/support/port_platform.h>
 
+#include "src/core/handshaker/handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/config/core_configuration.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
-#include "src/core/lib/transport/handshaker.h"
 #include "src/core/tsi/transport_security_interface.h"
 
 namespace grpc_core {
@@ -44,4 +43,4 @@ void SecurityRegisterHandshakerFactories(CoreConfiguration::Builder*);
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_TRANSPORT_SECURITY_HANDSHAKER_H
+#endif  // GRPC_SRC_CORE_HANDSHAKER_SECURITY_SECURITY_HANDSHAKER_H