grpc 1.68.1 → 1.74.1

data/src/core/transport/endpoint_transport.h

@@ -0,0 +1,90 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_H
+#define GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_H
+
+#include <grpc/impl/grpc_types.h>
+
+#include <memory>
+#include <string>
+
+#include "src/core/lib/channel/channel_args.h"
+
+namespace grpc_core {
+
+class Server;
+
+// Comma separated list of transport protocols in order of most preferred to
+// least preferred.
+#define GRPC_ARG_PREFERRED_TRANSPORT_PROTOCOLS \
+  "grpc.preferred_transport_protocols"
+
+// EndpointTransport is a transport that operates over EventEngine::Endpoint
+// objects.
+// This interface is an iterim thing whilst call-v3 is finished and we flesh
+// out next protocol negotiation in all transport stacks. At that point this
+// interface will change so that we can run many kinds of EndpointTransport
+// on one listener, and negotiate protocol with one connector.
+class EndpointTransport {
+ public:
+  virtual absl::StatusOr<grpc_channel*> ChannelCreate(
+      std::string target, const ChannelArgs& args) = 0;
+  virtual absl::StatusOr<int> AddPort(Server* server, std::string addr,
+                                      const ChannelArgs& args) = 0;
+  virtual ~EndpointTransport() = default;
+};
+
+class EndpointTransportRegistry {
+ private:
+  using TransportMap =
+      std::map<std::string, std::unique_ptr<EndpointTransport>>;
+
+ public:
+  class Builder {
+   public:
+    void RegisterTransport(std::string name,
+                           std::unique_ptr<EndpointTransport> transport) {
+      if (transports_.find(name) != transports_.end()) {
+        LOG(FATAL) << "Duplicate endpoint transport registration: " << name;
+      }
+      transports_[name] = std::move(transport);
+    }
+
+    EndpointTransportRegistry Build() {
+      return EndpointTransportRegistry(std::move(transports_));
+    }
+
+   private:
+    TransportMap transports_;
+  };
+
+  EndpointTransport* GetTransport(absl::string_view name) const {
+    auto it = transports_.find(std::string(name));
+    if (it == transports_.end()) {
+      return nullptr;
+    }
+    return it->second.get();
+  }
+
+ private:
+  explicit EndpointTransportRegistry(TransportMap transports)
+      : transports_(std::move(transports)) {}
+
+  TransportMap transports_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_H

data/src/core/transport/endpoint_transport_client_channel_factory.cc

@@ -0,0 +1,61 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/core/transport/endpoint_transport_client_channel_factory.h"
+
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/credentials/transport/transport_credentials.h"
+
+namespace grpc_core::endpoint_transport_client_channel_factory_detail {
+
+RefCountedPtr<Subchannel> GenericClientChannelFactory::CreateSubchannel(
+    const grpc_resolved_address& address, const ChannelArgs& args) {
+  absl::StatusOr<ChannelArgs> new_args = GetSecureNamingChannelArgs(args);
+  if (!new_args.ok()) {
+    LOG(ERROR) << "Failed to create channel args during subchannel creation: "
+               << new_args.status() << "; Got args: " << args.ToString();
+    return nullptr;
+  }
+  return Subchannel::Create(MakeConnector(), address, *new_args);
+}
+
+absl::StatusOr<ChannelArgs>
+GenericClientChannelFactory::GetSecureNamingChannelArgs(ChannelArgs args) {
+  auto* channel_credentials = args.GetObject<grpc_channel_credentials>();
+  if (channel_credentials == nullptr) {
+    return absl::InternalError("channel credentials missing for channel");
+  }
+  // Make sure security connector does not already exist in args.
+  if (args.Contains(GRPC_ARG_SECURITY_CONNECTOR)) {
+    return absl::InternalError(
+        "security connector already present in channel args.");
+  }
+  // Find the authority to use in the security connector.
+  std::optional<std::string> authority =
+      args.GetOwnedString(GRPC_ARG_DEFAULT_AUTHORITY);
+  if (!authority.has_value()) {
+    return absl::InternalError("authority not present in channel args");
+  }
+  // Create the security connector using the credentials and target name.
+  RefCountedPtr<grpc_channel_security_connector> subchannel_security_connector =
+      channel_credentials->create_security_connector(
+          /*call_creds=*/nullptr, authority->c_str(), &args);
+  if (subchannel_security_connector == nullptr) {
+    return absl::InternalError(absl::StrFormat(
+        "Failed to create subchannel for secure name '%s'", *authority));
+  }
+  return args.SetObject(std::move(subchannel_security_connector));
+}
+
+}  // namespace grpc_core::endpoint_transport_client_channel_factory_detail

data/src/core/transport/endpoint_transport_client_channel_factory.h

@@ -0,0 +1,57 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_CLIENT_CHANNEL_FACTORY_H
+#define GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_CLIENT_CHANNEL_FACTORY_H
+
+#include "src/core/client_channel/client_channel_factory.h"
+#include "src/core/client_channel/subchannel.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/util/no_destruct.h"
+
+namespace grpc_core {
+
+namespace endpoint_transport_client_channel_factory_detail {
+
+class GenericClientChannelFactory : public ClientChannelFactory {
+ public:
+  RefCountedPtr<Subchannel> CreateSubchannel(
+      const grpc_resolved_address& address, const ChannelArgs& args) override;
+
+ private:
+  virtual OrphanablePtr<SubchannelConnector> MakeConnector() = 0;
+
+  static absl::StatusOr<ChannelArgs> GetSecureNamingChannelArgs(
+      ChannelArgs args);
+};
+
+template <typename Connector>
+class TypedClientChannelFactory final : public GenericClientChannelFactory {
+ private:
+  OrphanablePtr<SubchannelConnector> MakeConnector() override {
+    return MakeOrphanable<Connector>();
+  };
+};
+
+}  // namespace endpoint_transport_client_channel_factory_detail
+
+template <typename Connector>
+auto EndpointTransportClientChannelFactory() {
+  return NoDestructSingleton<endpoint_transport_client_channel_factory_detail::
+                                 TypedClientChannelFactory<Connector>>::Get();
+}
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_CLIENT_CHANNEL_FACTORY_H

data/src/core/tsi/alts/frame_protector/alts_counter.h

@@ -88,7 +88,7 @@ size_t alts_counter_get_size(alts_counter* crypter_counter);
 unsigned char* alts_counter_get_counter(alts_counter* crypter_counter);
 
 ///
-/// This method de-allocates all memory allocated to an alts_coutner instance.
+/// This method de-allocates all memory allocated to an alts_counter instance.
 ///- crypter_counter: an alts_counter instance.
 ///
 void alts_counter_destroy(alts_counter* crypter_counter);

data/src/core/tsi/alts/frame_protector/alts_seal_privacy_integrity_crypter.cc

@@ -30,7 +30,7 @@ static void maybe_copy_error_msg(const char* src, char** dst) {
   }
 }
 
-// Perform input santity check for a seal operation.
+// Perform input sanity check for a seal operation.
 static grpc_status_code seal_check(alts_crypter* c, const unsigned char* data,
                                    size_t data_allocated_size, size_t data_size,
                                    size_t* output_size, char** error_details) {

data/src/core/tsi/alts/frame_protector/alts_unseal_privacy_integrity_crypter.cc

@@ -30,7 +30,7 @@ static void maybe_copy_error_msg(const char* src, char** dst) {
   }
 }
 
-// Perform input santity check.
+// Perform input sanity check.
 static grpc_status_code unseal_check(alts_crypter* c, const unsigned char* data,
                                      size_t /*data_allocated_size*/,
                                      size_t data_size, size_t* output_size,

data/src/core/tsi/alts/handshaker/alts_handshaker_client.cc

@@ -27,6 +27,7 @@
 #include "absl/log/check.h"
 #include "absl/log/log.h"
 #include "absl/strings/numbers.h"
+#include "absl/strings/str_split.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/surface/call.h"
 #include "src/core/lib/surface/channel.h"
@@ -111,6 +112,7 @@ typedef struct alts_grpc_handshaker_client {
   recv_message_result* pending_recv_message_result = nullptr;
   // Maximum frame size used by frame protector.
   size_t max_frame_size;
+  std::vector<std::string> preferred_transport_protocols;
   // If non-null, will be populated with an error string upon error.
   std::string* error;
 } alts_grpc_handshaker_client;
@@ -298,7 +300,7 @@ void alts_handshaker_client_handle_response(alts_handshaker_client* c,
     if (details.size > 0) {
       error = absl::StrCat("Status ", code, " from handshaker service: ",
                            absl::string_view(details.data, details.size));
-      LOG(ERROR) << error;
+      LOG_EVERY_N_SEC(INFO, 1) << error;
     }
   }
   // TODO(apolcyn): consider short ciruiting handle_response_done and
@@ -537,6 +539,17 @@ static grpc_byte_buffer* get_serialized_start_client(
   }
   grpc_gcp_StartClientHandshakeReq_set_max_frame_size(
       start_client, static_cast<uint32_t>(client->max_frame_size));
+  if (!client->preferred_transport_protocols.empty()) {
+    grpc_gcp_TransportProtocolPreferences* preferences =
+        grpc_gcp_StartClientHandshakeReq_mutable_transport_protocol_preferences(
+            start_client, arena.ptr());
+    for (const auto& transport_protocol :
+         client->preferred_transport_protocols) {
+      grpc_gcp_TransportProtocolPreferences_add_transport_protocol(
+          preferences, upb_StringView_FromString(transport_protocol.c_str()),
+          arena.ptr());
+    }
+  }
   return get_serialized_handshaker_req(req, arena.ptr());
 }
 
@@ -595,6 +608,17 @@ static grpc_byte_buffer* get_serialized_start_server(
       server_version, arena.ptr(), &client->options->rpc_versions);
   grpc_gcp_StartServerHandshakeReq_set_max_frame_size(
       start_server, static_cast<uint32_t>(client->max_frame_size));
+  if (!client->preferred_transport_protocols.empty()) {
+    grpc_gcp_TransportProtocolPreferences* preferences =
+        grpc_gcp_StartServerHandshakeReq_mutable_transport_protocol_preferences(
+            start_server, arena.ptr());
+    for (const auto& transport_protocol :
+         client->preferred_transport_protocols) {
+      grpc_gcp_TransportProtocolPreferences_add_transport_protocol(
+          preferences, upb_StringView_FromString(transport_protocol.c_str()),
+          arena.ptr());
+    }
+  }
   return get_serialized_handshaker_req(req, arena.ptr());
 }
 
@@ -712,7 +736,9 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
     grpc_alts_credentials_options* options, const grpc_slice& target_name,
     grpc_iomgr_cb_func grpc_cb, tsi_handshaker_on_next_done_cb cb,
     void* user_data, alts_handshaker_client_vtable* vtable_for_testing,
-    bool is_client, size_t max_frame_size, std::string* error) {
+    bool is_client, size_t max_frame_size,
+    std::optional<absl::string_view> preferred_transport_protocols,
+    std::string* error) {
   if (channel == nullptr || handshaker_service_url == nullptr) {
     LOG(ERROR) << "Invalid arguments to alts_handshaker_client_create()";
     return nullptr;
@@ -735,6 +761,12 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
   client->buffer = static_cast<unsigned char*>(gpr_zalloc(client->buffer_size));
   client->handshake_status_details = grpc_empty_slice();
   client->max_frame_size = max_frame_size;
+  std::vector<std::string> transport_protocols;
+  if (preferred_transport_protocols.has_value()) {
+    transport_protocols = absl::StrSplit(preferred_transport_protocols.value(),
+                                         ',', absl::SkipWhitespace());
+  }
+  client->preferred_transport_protocols = transport_protocols;
   client->error = error;
   client->call =
       strcmp(handshaker_service_url, ALTS_HANDSHAKER_SERVICE_URL_FOR_TESTING) ==
@@ -744,7 +776,7 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
                 /*parent_call=*/nullptr, GRPC_PROPAGATE_DEFAULTS,
                 /*cq=*/nullptr, interested_parties,
                 grpc_core::Slice::FromStaticString(ALTS_SERVICE_METHOD),
-                /*authority=*/absl::nullopt, grpc_core::Timestamp::InfFuture(),
+                /*authority=*/std::nullopt, grpc_core::Timestamp::InfFuture(),
                 /*registered_method=*/true);
   GRPC_CLOSURE_INIT(&client->on_handshaker_service_resp_recv, grpc_cb, client,
                     grpc_schedule_on_exec_ctx);
@@ -930,7 +962,7 @@ void alts_handshaker_client_destroy(alts_handshaker_client* c) {
 
 size_t MaxNumberOfConcurrentHandshakes() {
   size_t max_concurrent_handshakes = 100;
-  absl::optional<std::string> env_var_max_concurrent_handshakes =
+  std::optional<std::string> env_var_max_concurrent_handshakes =
       grpc_core::GetEnv(kMaxConcurrentStreamsEnvironmentVariable);
   if (env_var_max_concurrent_handshakes.has_value()) {
     size_t effective_max_concurrent_handshakes = 100;

data/src/core/tsi/alts/handshaker/alts_handshaker_client.h

@@ -143,7 +143,9 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
     grpc_alts_credentials_options* options, const grpc_slice& target_name,
     grpc_iomgr_cb_func grpc_cb, tsi_handshaker_on_next_done_cb cb,
     void* user_data, alts_handshaker_client_vtable* vtable_for_testing,
-    bool is_client, size_t max_frame_size, std::string* error);
+    bool is_client, size_t max_frame_size,
+    std::optional<absl::string_view> preferred_transport_protocol,
+    std::string* error);
 
 ///
 /// This method handles handshaker response returned from ALTS handshaker

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc

@@ -38,10 +38,21 @@
 #include "src/core/tsi/alts/handshaker/alts_handshaker_client.h"
 #include "src/core/tsi/alts/handshaker/alts_shared_resource.h"
 #include "src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.h"
+#include "src/core/util/env.h"
 #include "src/core/util/memory.h"
 #include "src/core/util/sync.h"
 #include "upb/mem/arena.hpp"
 
+namespace {
+constexpr absl::string_view kUseGrpcExperimentalAltsHandshakerKeepaliveParams =
+    "GRPC_EXPERIMENTAL_ALTS_HANDSHAKER_KEEPALIVE_PARAMS";
+
+// 10 seconds
+constexpr int kExperimentalKeepAliveTimeoutMs = 10 * 1000;
+// 10 minutes
+constexpr int kExperimentalKeepAliveTimeMs = 10 * 60 * 1000;
+}  // namespace
+
 // Main struct for ALTS TSI handshaker.
 struct alts_tsi_handshaker {
   tsi_handshaker base;
@@ -66,6 +77,9 @@ struct alts_tsi_handshaker {
   bool shutdown = false;
   // Maximum frame size used by frame protector.
   size_t max_frame_size;
+  // A comma-separated list of preferred transport protocols, sorted by
+  // preference.
+  std::optional<std::string> preferred_transport_protocols;
 };
 
 // Main struct for ALTS TSI handshaker result.
@@ -80,6 +94,7 @@ typedef struct alts_tsi_handshaker_result {
   grpc_slice serialized_context;
   // Peer's maximum frame size.
   size_t max_frame_size;
+  std::optional<std::string> negotiated_transport_protocol;
 } alts_tsi_handshaker_result;
 
 static tsi_result handshaker_result_extract_peer(
@@ -91,8 +106,11 @@ static tsi_result handshaker_result_extract_peer(
   alts_tsi_handshaker_result* result =
       reinterpret_cast<alts_tsi_handshaker_result*>(
           const_cast<tsi_handshaker_result*>(self));
-  CHECK_EQ(kTsiAltsNumOfPeerProperties, 5u);
-  tsi_result ok = tsi_construct_peer(kTsiAltsNumOfPeerProperties, peer);
+  const int peer_properties_count =
+      (result && result->negotiated_transport_protocol.has_value())
+          ? (kTsiAltsMinNumOfPeerProperties + 1)
+          : kTsiAltsMinNumOfPeerProperties;
+  tsi_result ok = tsi_construct_peer(peer_properties_count, peer);
   int index = 0;
   if (ok != TSI_OK) {
     LOG(ERROR) << "Failed to construct tsi peer";
@@ -146,7 +164,19 @@ static tsi_result handshaker_result_extract_peer(
     tsi_peer_destruct(peer);
     LOG(ERROR) << "Failed to set tsi peer property";
   }
-  CHECK(++index == kTsiAltsNumOfPeerProperties);
+  if (result->negotiated_transport_protocol.has_value()) {
+    index++;
+    CHECK_NE(&peer->properties[index], nullptr);
+    ok = tsi_construct_string_peer_property_from_cstring(
+        TSI_ALTS_NEGOTIATED_TRANSPORT_PROTOCOL,
+        result->negotiated_transport_protocol.value().c_str(),
+        &peer->properties[index]);
+    if (ok != TSI_OK) {
+      tsi_peer_destruct(peer);
+      LOG(ERROR) << "Failed to set tsi peer property";
+    }
+  }
+  CHECK(++index == peer_properties_count);
   return ok;
 }
 
@@ -313,7 +343,8 @@ tsi_result alts_tsi_handshaker_result_create(grpc_gcp_HandshakerResp* resp,
   // We don't check if local service account is empty here
   // because local identity could be empty in certain situations.
   alts_tsi_handshaker_result* sresult =
-      grpc_core::Zalloc<alts_tsi_handshaker_result>();
+      static_cast<alts_tsi_handshaker_result*>(
+          gpr_zalloc(sizeof(alts_tsi_handshaker_result)));
   sresult->key_data =
       static_cast<char*>(gpr_zalloc(kAltsAes128GcmRekeyKeyLength));
   memcpy(sresult->key_data, key_data.data, kAltsAes128GcmRekeyKeyLength);
@@ -322,6 +353,19 @@ tsi_result alts_tsi_handshaker_result_create(grpc_gcp_HandshakerResp* resp,
   memcpy(sresult->peer_identity, peer_service_account.data,
          peer_service_account.size);
   sresult->max_frame_size = grpc_gcp_HandshakerResult_max_frame_size(hresult);
+  const grpc_gcp_NegotiatedTransportProtocol* negotiated_transport_protocol =
+      grpc_gcp_HandshakerResult_transport_protocol(hresult);
+
+  sresult->negotiated_transport_protocol = std::nullopt;
+  if (negotiated_transport_protocol != nullptr) {
+    upb_StringView transport_protocol =
+        grpc_gcp_NegotiatedTransportProtocol_transport_protocol(
+            negotiated_transport_protocol);
+    if (transport_protocol.size != 0) {
+      sresult->negotiated_transport_protocol =
+          std::string(transport_protocol.data, transport_protocol.size);
+    }
+  }
   upb::Arena rpc_versions_arena;
   bool serialized = grpc_gcp_rpc_protocol_versions_encode(
       peer_rpc_version, rpc_versions_arena.ptr(), &sresult->rpc_versions);
@@ -348,21 +392,15 @@ tsi_result alts_tsi_handshaker_result_create(grpc_gcp_HandshakerResp* resp,
   }
   if (grpc_gcp_Identity_attributes_size(identity) != 0) {
     size_t iter = kUpb_Map_Begin;
-    grpc_gcp_Identity_AttributesEntry* peer_attributes_entry =
-        grpc_gcp_Identity_attributes_nextmutable(peer_identity, &iter);
-    while (peer_attributes_entry != nullptr) {
-      upb_StringView key = grpc_gcp_Identity_AttributesEntry_key(
-          const_cast<grpc_gcp_Identity_AttributesEntry*>(
-              peer_attributes_entry));
-      upb_StringView val = grpc_gcp_Identity_AttributesEntry_value(
-          const_cast<grpc_gcp_Identity_AttributesEntry*>(
-              peer_attributes_entry));
+    upb_StringView key;
+    upb_StringView val;
+    while (
+        grpc_gcp_Identity_attributes_next(peer_identity, &key, &val, &iter)) {
       grpc_gcp_AltsContext_peer_attributes_set(context, key, val,
                                                context_arena.ptr());
-      peer_attributes_entry =
-          grpc_gcp_Identity_attributes_nextmutable(peer_identity, &iter);
     }
   }
+
   size_t serialized_ctx_length;
   char* serialized_ctx = grpc_gcp_AltsContext_serialize(
       context, context_arena.ptr(), &serialized_ctx_length);
@@ -432,7 +470,8 @@ static tsi_result alts_tsi_handshaker_continue_handshaker_next(
         handshaker->interested_parties, handshaker->options,
         handshaker->target_name, grpc_cb, cb, user_data,
         handshaker->client_vtable_for_testing, handshaker->is_client,
-        handshaker->max_frame_size, error);
+        handshaker->max_frame_size, handshaker->preferred_transport_protocols,
+        error);
     if (client == nullptr) {
       LOG(ERROR) << "Failed to create ALTS handshaker client";
       if (error != nullptr) *error = "Failed to create ALTS handshaker client";
@@ -499,9 +538,22 @@ static void alts_tsi_handshaker_create_channel(
   grpc_channel_credentials* creds = grpc_insecure_credentials_create();
   // Disable retries so that we quickly get a signal when the
   // handshake server is not reachable.
-  grpc_arg disable_retries_arg = grpc_channel_arg_integer_create(
-      const_cast<char*>(GRPC_ARG_ENABLE_RETRIES), 0);
-  grpc_channel_args args = {1, &disable_retries_arg};
+  std::vector<grpc_arg> args_vec;
+  args_vec.push_back(grpc_channel_arg_integer_create(
+      const_cast<char*>(GRPC_ARG_ENABLE_RETRIES), 0));
+  // TODO(gtcooke94) - Flag to try new values for ALTS keep alive settings,
+  // remove after trial
+  std::optional<std::string> env = grpc_core::GetEnv(
+      kUseGrpcExperimentalAltsHandshakerKeepaliveParams.data());
+  if (env.has_value() && (*env == "true")) {
+    args_vec.push_back(grpc_channel_arg_integer_create(
+        const_cast<char*>(GRPC_ARG_KEEPALIVE_TIMEOUT_MS),
+        kExperimentalKeepAliveTimeoutMs));
+    args_vec.push_back(grpc_channel_arg_integer_create(
+        const_cast<char*>(GRPC_ARG_KEEPALIVE_TIME_MS),
+        kExperimentalKeepAliveTimeMs));
+  }
+  grpc_channel_args args = {args_vec.size(), args_vec.data()};
   handshaker->channel = grpc_channel_create(
       next_args->handshaker->handshaker_service_url, creds, &args);
   grpc_channel_credentials_release(creds);
@@ -646,7 +698,8 @@ tsi_result alts_tsi_handshaker_create(
     const grpc_alts_credentials_options* options, const char* target_name,
     const char* handshaker_service_url, bool is_client,
     grpc_pollset_set* interested_parties, tsi_handshaker** self,
-    size_t user_specified_max_frame_size) {
+    size_t user_specified_max_frame_size,
+    std::optional<std::string> preferred_transport_protocols) {
   if (handshaker_service_url == nullptr || self == nullptr ||
       options == nullptr || (is_client && target_name == nullptr)) {
     LOG(ERROR) << "Invalid arguments to alts_tsi_handshaker_create()";
@@ -668,6 +721,7 @@ tsi_result alts_tsi_handshaker_create(
   handshaker->max_frame_size = user_specified_max_frame_size != 0
                                    ? user_specified_max_frame_size
                                    : kTsiAltsMaxFrameSize;
+  handshaker->preferred_transport_protocols = preferred_transport_protocols;
   *self = &handshaker->base;
   return TSI_OK;
 }

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.h

@@ -22,8 +22,8 @@
 #include <grpc/grpc.h>
 #include <grpc/support/port_platform.h>
 
+#include "src/core/credentials/transport/alts/grpc_alts_credentials_options.h"
 #include "src/core/lib/iomgr/pollset_set.h"
-#include "src/core/lib/security/credentials/alts/grpc_alts_credentials_options.h"
 #include "src/core/tsi/alts/handshaker/alts_handshaker_client.h"
 #include "src/core/tsi/transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
@@ -34,8 +34,10 @@
 #define TSI_ALTS_CERTIFICATE_TYPE "ALTS"
 #define TSI_ALTS_RPC_VERSIONS "rpc_versions"
 #define TSI_ALTS_CONTEXT "alts_context"
+#define TSI_ALTS_NEGOTIATED_TRANSPORT_PROTOCOL \
+  "alts_negotiated_transport_protocol"
 
-const size_t kTsiAltsNumOfPeerProperties = 5;
+inline const size_t kTsiAltsMinNumOfPeerProperties = 5;
 
 // Frame size negotiation extends send frame size range to
 // [kTsiAltsMinFrameSize, kTsiAltsMaxFrameSize].
@@ -60,6 +62,9 @@ typedef struct alts_tsi_handshaker alts_tsi_handshaker;
 ///  method.
 ///- user_specified_max_frame_size: Determines the maximum frame size used by
 ///  frame protector that is specified via user. If unspecified, the value is 0.
+///- preferred_transport_protocols: a comma separated list of preferred
+///  transport protocols to be negotiated for this connection. If empty, no
+///  negotiation will occur.
 ///
 /// It returns TSI_OK on success and an error status code on failure. Note that
 /// if interested_parties is nullptr, a dedicated TSI thread will be created and
@@ -69,7 +74,8 @@ tsi_result alts_tsi_handshaker_create(
     const grpc_alts_credentials_options* options, const char* target_name,
     const char* handshaker_service_url, bool is_client,
     grpc_pollset_set* interested_parties, tsi_handshaker** self,
-    size_t user_specified_max_frame_size);
+    size_t user_specified_max_frame_size,
+    std::optional<std::string> preferred_transport_protocols);
 
 ///
 /// This method creates an ALTS TSI handshaker result instance.

data/src/core/tsi/alts/handshaker/transport_security_common_api.h

@@ -27,13 +27,13 @@
 #include "src/core/util/crash.h"
 #include "src/proto/grpc/gcp/transport_security_common.upb.h"
 
-// C struct coresponding to protobuf message RpcProtocolVersions.Version
+// C struct corresponding to protobuf message RpcProtocolVersions.Version
 typedef struct _grpc_gcp_RpcProtocolVersions_Version {
   uint32_t major;
   uint32_t minor;
 } grpc_gcp_rpc_protocol_versions_version;
 
-// C struct coresponding to protobuf message RpcProtocolVersions
+// C struct corresponding to protobuf message RpcProtocolVersions
 typedef struct _grpc_gcp_RpcProtocolVersions {
   grpc_gcp_rpc_protocol_versions_version max_rpc_version;
   grpc_gcp_rpc_protocol_versions_version min_rpc_version;

data/src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.cc

@@ -156,7 +156,7 @@ static tsi_result alts_zero_copy_grpc_protector_protect(
   }
   alts_zero_copy_grpc_protector* protector =
       reinterpret_cast<alts_zero_copy_grpc_protector*>(self);
-  // Calls alts_grpc_record_protocol protect repeatly.
+  // Calls alts_grpc_record_protocol protect repeatedly.
   while (unprotected_slices->length > protector->max_unprotected_data_size) {
     grpc_slice_buffer_move_first(unprotected_slices,
                                  protector->max_unprotected_data_size,
@@ -249,12 +249,20 @@ static tsi_result alts_zero_copy_grpc_protector_max_frame_size(
   return TSI_OK;
 }
 
+static bool alts_zero_copy_grpc_protector_read_frame_size(
+    tsi_zero_copy_grpc_protector*, grpc_slice_buffer* protected_slices,
+    uint32_t* frame_size) {
+  if (frame_size == nullptr) return false;
+  return read_frame_size(protected_slices, frame_size);
+}
+
 static const tsi_zero_copy_grpc_protector_vtable
     alts_zero_copy_grpc_protector_vtable = {
         alts_zero_copy_grpc_protector_protect,
         alts_zero_copy_grpc_protector_unprotect,
         alts_zero_copy_grpc_protector_destroy,
-        alts_zero_copy_grpc_protector_max_frame_size};
+        alts_zero_copy_grpc_protector_max_frame_size,
+        alts_zero_copy_grpc_protector_read_frame_size};
 
 tsi_result alts_zero_copy_grpc_protector_create(
     const grpc_core::GsecKeyFactoryInterface& key_factory, bool is_client,
@@ -262,8 +270,8 @@ tsi_result alts_zero_copy_grpc_protector_create(
     size_t* max_protected_frame_size,
     tsi_zero_copy_grpc_protector** protector) {
   if (protector == nullptr) {
-    LOG(ERROR)
-        << "Invalid nullptr arguments to alts_zero_copy_grpc_protector create.";
+    LOG(ERROR) << "Invalid nullptr arguments to "
+                  "alts_zero_copy_grpc_protector create.";
     return TSI_INVALID_ARGUMENT;
   }
   // Creates alts_zero_copy_protector.