grpc 1.71.0 → 1.73.0

data/src/core/telemetry/tcp_tracer.h

@@ -19,123 +19,127 @@
 #ifndef GRPC_SRC_CORE_TELEMETRY_TCP_TRACER_H
 #define GRPC_SRC_CORE_TELEMETRY_TCP_TRACER_H
 
+#include <grpc/event_engine/internal/write_event.h>
 #include <grpc/support/port_platform.h>
 #include <stddef.h>
 #include <stdint.h>
 
 #include <optional>
 #include <string>
+#include <vector>
 
 #include "absl/time/time.h"
 
 namespace grpc_core {
 
-// Interface for TCP tracer implementations. Created by CallTracerInterface.
-class TcpTracerInterface {
+struct TcpConnectionMetrics {
+  // Congestion control name.
+  std::string congestion_ctrl;
+  // Delivery rate in Bps.
+  std::optional<uint64_t> delivery_rate;
+  // Total bytes retransmitted so far.
+  std::optional<uint64_t> data_retx;
+  // Total bytes sent so far.
+  std::optional<uint64_t> data_sent;
+  // Total packets lost so far.
+  // Includes lost or spuriously retransmitted packets.
+  std::optional<uint32_t> packet_retx;
+  // Total packets spuriously retransmitted so far.
+  std::optional<uint32_t> packet_spurious_retx;
+  // Total packets sent so far.
+  std::optional<uint32_t> packet_sent;
+  // Total packets delivered so far.
+  std::optional<uint32_t> packet_delivered;
+  // Total packets delivered so far with ECE marked.
+  // This metric is smaller than or equal to packet_delivered.
+  std::optional<uint32_t> packet_delivered_ce;
+  // Total bytes in write queue but not sent.
+  std::optional<uint64_t> data_notsent;
+  // Minimum RTT observed in usec.
+  std::optional<uint32_t> min_rtt;
+  // Smoothed RTT in usec
+  std::optional<uint32_t> srtt;
+  // TTL or hop limit of a packet received
+  // Only available with ACKED timestamps.
+  std::optional<uint32_t> ttl;
+  // Represents the number of recurring retransmissions of
+  // the first sequence that is not acknowledged yet.
+  std::optional<uint32_t> recurring_retrans;
+  // Network RTT using hardware timestamps (in usec).
+  // A value of -1 indicates that net_rtt could not be measured.
+  std::optional<int32_t> net_rtt_usec;
+  // Timeout-triggered rehash attempts.
+  std::optional<uint32_t> timeout_rehash;
+  // Rehash due to ECN congestion.
+  std::optional<uint32_t> ecn_rehash;
+  // Earliest departure time (CLOCK_MONOTONIC).
+  // Only available with SCHEDULED and SENT timestamps.
+  std::optional<uint64_t> edt;
+  // If the delivery rate is limited by the application, this is set to
+  // true.
+  std::optional<bool> is_delivery_rate_app_limited;
+  // Pacing rate of the connection in Bps.
+  std::optional<uint64_t> pacing_rate;
+  // Send congestion window in packets.
+  std::optional<uint32_t> congestion_window;
+  // Maximum degree of reordering (i.e., maximum number of packets reordered)
+  // on the connection.
+  std::optional<uint32_t> reordering;
+  // Cumulative duration (in usec) that the transport protocol
+  // was busy sending time.
+  std::optional<uint64_t> busy_usec;
+  // Cumulative duration (in usec) that the transport protocol
+  // was limited by the receive window size.
+  std::optional<uint64_t> rwnd_limited_usec;
+  // Cumulative duration (in usec) that the transport protocol
+  // was limited by the send buffer size.
+  std::optional<uint64_t> sndbuf_limited_usec;
+  // Slow start size threshold in packets.
+  // Set to TCP_INFINITE_SSTHRESH when still in slow start.
+  std::optional<uint32_t> snd_ssthresh;
+  // The extra time it takes for the receiver to generate the
+  // acknowledgement after receiving the last packet. This metric is not
+  // cumulative. Only available with ACKED timestamps.
+  std::optional<uint32_t> time_to_ack_usec;
+  // Last socket error code. Only populated for CLOSED timestamps.
+  std::optional<uint32_t> socket_errno;
+  // Peer's receive window after scaling (tcpi_snd_wnd).
+  // Only available with SENDMSG timestamps.
+  std::optional<uint32_t> peer_rwnd;
+  // Receive queue drops.
+  std::optional<uint32_t> rcvq_drops;
+  // The NIC Rx delay reported by the remote host.
+  std::optional<uint32_t> nic_rx_delay_usec;
+};
+
+class TcpCallTracer {
  public:
-  enum class Type {
-    kUnknown = 0,
-    // When the sendmsg system call or its variants returned for the traced byte
-    // offset.
-    kSendMsg,
-    // When the traced byte offset is enqueued in kernel schedulers (aka,
-    // qdiscs). There can be multiple schedulers.
-    kScheduled,
-    // When the traced byte offset is handed over to the NIC.
-    kSent,
-    // When the acknowledgement for the traced byte offset was received.
-    kAcked,
-    // When the connection is closed. This is not associated with a byte offset.
-    kClosed,
-  };
+  struct TcpEventMetric {
+    absl::string_view key;
+    int64_t value;
 
-  struct ConnectionMetrics {
-    // Congestion control name.
-    std::string congestion_ctrl;
-    // Delivery rate in Bps.
-    std::optional<uint64_t> delivery_rate;
-    // Total bytes retransmitted so far.
-    std::optional<uint64_t> data_retx;
-    // Total bytes sent so far.
-    std::optional<uint64_t> data_sent;
-    // Total packets lost so far.
-    // Includes lost or spuriously retransmitted packets.
-    std::optional<uint32_t> packet_retx;
-    // Total packets spuriously retransmitted so far.
-    std::optional<uint32_t> packet_spurious_retx;
-    // Total packets sent so far.
-    std::optional<uint32_t> packet_sent;
-    // Total packets delivered so far.
-    std::optional<uint32_t> packet_delivered;
-    // Total packets delivered so far with ECE marked.
-    // This metric is smaller than or equal to packet_delivered.
-    std::optional<uint32_t> packet_delivered_ce;
-    // Total bytes in write queue but not sent.
-    std::optional<uint64_t> data_notsent;
-    // Minimum RTT observed in usec.
-    std::optional<uint32_t> min_rtt;
-    // Smoothed RTT in usec
-    std::optional<uint32_t> srtt;
-    // TTL or hop limit of a packet received
-    // Only available with ACKED timestamps.
-    std::optional<uint32_t> ttl;
-    // Represents the number of recurring retransmissions of
-    // the first sequence that is not acknowledged yet.
-    std::optional<uint32_t> recurring_retrans;
-    // Network RTT using hardware timestamps (in usec).
-    // A value of -1 indicates that net_rtt could not be measured.
-    std::optional<int32_t> net_rtt_usec;
-    // Timeout-triggered rehash attempts.
-    std::optional<uint32_t> timeout_rehash;
-    // Rehash due to ECN congestion.
-    std::optional<uint32_t> ecn_rehash;
-    // Earliest departure time (CLOCK_MONOTONIC).
-    // Only available with SCHEDULED and SENT timestamps.
-    std::optional<uint64_t> edt;
-    // If the delivery rate is limited by the application, this is set to
-    // true.
-    std::optional<bool> is_delivery_rate_app_limited;
-    // Pacing rate of the connection in Bps.
-    std::optional<uint64_t> pacing_rate;
-    // Send congestion window in packets.
-    std::optional<uint32_t> congestion_window;
-    // Maximum degree of reordering (i.e., maximum number of packets reodered)
-    // on the connection.
-    std::optional<uint32_t> reordering;
-    // Cumulative duration (in usec) that the transport protocol
-    // was busy sending time.
-    std::optional<uint64_t> busy_usec;
-    // Cumulative duration (in usec) that the transport protocol
-    // was limited by the receive window size.
-    std::optional<uint64_t> rwnd_limited_usec;
-    // Cumulative duration (in usec) that the transport protocol
-    // was limited by the send buffer size.
-    std::optional<uint64_t> sndbuf_limited_usec;
-    // Slow start size threshold in packets.
-    // Set to TCP_INFINITE_SSTHRESH when still in slow start.
-    std::optional<uint32_t> snd_ssthresh;
-    // The extra time it takes for the receiver to generate the
-    // acknowledgement after receiving the last packet. This metric is not
-    // cumulative. Only available with ACKED timestamps.
-    std::optional<uint32_t> time_to_ack_usec;
-    // Last socket error code. Only populated for CLOSED timestamps.
-    std::optional<uint32_t> socket_errno;
-    // Peer's receive window after scaling (tcpi_snd_wnd).
-    // Only available with SENDMSG timestamps.
-    std::optional<uint32_t> peer_rwnd;
-    // Receive queue drops.
-    std::optional<uint32_t> rcvq_drops;
-    // The NIC Rx delay reported by the remote host.
-    std::optional<uint32_t> nic_rx_delay_usec;
+    std::string ToString();
   };
 
-  virtual ~TcpTracerInterface() = default;
+  std::string TcpEventMetricsToString(
+      const std::vector<TcpEventMetric>& metrics);
+
+  virtual ~TcpCallTracer() = default;
+
   // Records a per-message event with an optional snapshot of connection
   // metrics.
-  virtual void RecordEvent(Type type, absl::Time time, size_t byte_offset,
-                           std::optional<ConnectionMetrics> metrics) = 0;
+  virtual void RecordEvent(
+      grpc_event_engine::experimental::internal::WriteEvent event,
+      absl::Time time, size_t byte_offset,
+      std::vector<TcpEventMetric> metrics) = 0;
+};
+
+class TcpConnectionTracer {
+ public:
+  virtual ~TcpConnectionTracer() = default;
+
   // Records a snapshot of connection metrics.
-  virtual void RecordConnectionMetrics(ConnectionMetrics metrics) = 0;
+  virtual void RecordConnectionMetrics(TcpConnectionMetrics metrics) = 0;
 };
 
 }  // namespace grpc_core

data/src/core/{lib/security/context/security_context.cc → transport/auth_context.cc}

@@ -1,5 +1,4 @@
 //
-//
 // Copyright 2015 gRPC authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
@@ -14,9 +13,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
-//
 
-#include "src/core/lib/security/context/security_context.h"
+#include "src/core/transport/auth_context.h"
 
 #include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
@@ -33,61 +31,8 @@
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/resource_quota/arena.h"
-#include "src/core/lib/security/credentials/credentials.h"
-#include "src/core/lib/surface/call.h"
 #include "src/core/util/ref_counted_ptr.h"
 
-// --- grpc_call ---
-
-grpc_call_error grpc_call_set_credentials(grpc_call* call,
-                                          grpc_call_credentials* creds) {
-  grpc_core::ExecCtx exec_ctx;
-  grpc_client_security_context* ctx = nullptr;
-  GRPC_TRACE_LOG(api, INFO) << "grpc_call_set_credentials(call=" << call
-                            << ", creds=" << creds << ")";
-  if (!grpc_call_is_client(call)) {
-    LOG(ERROR) << "Method is client-side only.";
-    return GRPC_CALL_ERROR_NOT_ON_SERVER;
-  }
-  auto* arena = grpc_call_get_arena(call);
-  ctx = grpc_core::DownCast<grpc_client_security_context*>(
-      arena->GetContext<grpc_core::SecurityContext>());
-  if (ctx == nullptr) {
-    ctx = grpc_client_security_context_create(arena, creds);
-    arena->SetContext<grpc_core::SecurityContext>(ctx);
-  } else {
-    ctx->creds = creds != nullptr ? creds->Ref() : nullptr;
-  }
-
-  return GRPC_CALL_OK;
-}
-
-grpc_auth_context* grpc_call_auth_context(grpc_call* call) {
-  auto* sec_ctx =
-      grpc_call_get_arena(call)->GetContext<grpc_core::SecurityContext>();
-  GRPC_TRACE_LOG(api, INFO) << "grpc_call_auth_context(call=" << call << ")";
-  if (sec_ctx == nullptr) return nullptr;
-  if (grpc_call_is_client(call)) {
-    auto* sc = grpc_core::DownCast<grpc_client_security_context*>(sec_ctx);
-    if (sc->auth_context == nullptr) {
-      return nullptr;
-    } else {
-      return sc->auth_context
-          ->Ref(DEBUG_LOCATION, "grpc_call_auth_context client")
-          .release();
-    }
-  } else {
-    auto* sc = grpc_core::DownCast<grpc_server_security_context*>(sec_ctx);
-    if (sc->auth_context == nullptr) {
-      return nullptr;
-    } else {
-      return sc->auth_context
-          ->Ref(DEBUG_LOCATION, "grpc_call_auth_context server")
-          .release();
-    }
-  }
-}
-
 void grpc_auth_context_release(grpc_auth_context* context) {
   GRPC_TRACE_LOG(api, INFO)
       << "grpc_auth_context_release(context=" << context << ")";
@@ -95,47 +40,6 @@ void grpc_auth_context_release(grpc_auth_context* context) {
   context->Unref(DEBUG_LOCATION, "grpc_auth_context_unref");
 }
 
-// --- grpc_client_security_context ---
-grpc_client_security_context::~grpc_client_security_context() {
-  auth_context.reset(DEBUG_LOCATION, "client_security_context");
-  if (extension.instance != nullptr && extension.destroy != nullptr) {
-    extension.destroy(extension.instance);
-  }
-}
-
-grpc_client_security_context* grpc_client_security_context_create(
-    grpc_core::Arena* arena, grpc_call_credentials* creds) {
-  return arena->New<grpc_client_security_context>(
-      creds != nullptr ? creds->Ref() : nullptr);
-}
-
-void grpc_client_security_context_destroy(void* ctx) {
-  grpc_client_security_context* c =
-      static_cast<grpc_client_security_context*>(ctx);
-  c->~grpc_client_security_context();
-}
-
-// --- grpc_server_security_context ---
-grpc_server_security_context::~grpc_server_security_context() {
-  auth_context.reset(DEBUG_LOCATION, "server_security_context");
-  if (extension.instance != nullptr && extension.destroy != nullptr) {
-    extension.destroy(extension.instance);
-  }
-}
-
-grpc_server_security_context* grpc_server_security_context_create(
-    grpc_core::Arena* arena) {
-  return arena->New<grpc_server_security_context>();
-}
-
-void grpc_server_security_context_destroy(void* ctx) {
-  grpc_server_security_context* c =
-      static_cast<grpc_server_security_context*>(ctx);
-  c->~grpc_server_security_context();
-}
-
-// --- grpc_auth_context ---
-
 static grpc_auth_property_iterator empty_iterator = {nullptr, 0, nullptr};
 
 const char* grpc_auth_context_peer_identity_property_name(

data/src/core/{lib/security/context/security_context.h → transport/auth_context.h}

@@ -1,5 +1,4 @@
 //
-//
 // Copyright 2015 gRPC authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
@@ -14,10 +13,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
-//
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_CONTEXT_SECURITY_CONTEXT_H
-#define GRPC_SRC_CORE_LIB_SECURITY_CONTEXT_SECURITY_CONTEXT_H
+#ifndef GRPC_SRC_CORE_TRANSPORT_AUTH_CONTEXT_H
+#define GRPC_SRC_CORE_TRANSPORT_AUTH_CONTEXT_H
 
 #include <grpc/credentials.h>
 #include <grpc/grpc.h>
@@ -32,7 +30,6 @@
 #include "absl/strings/string_view.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/resource_quota/arena.h"
-#include "src/core/lib/security/credentials/credentials.h"  // IWYU pragma: keep
 #include "src/core/lib/surface/connection_context.h"
 #include "src/core/util/debug_location.h"
 #include "src/core/util/orphanable.h"
@@ -59,6 +56,8 @@ void grpc_auth_property_reset(grpc_auth_property* property);
 // This type is forward declared as a C struct and we cannot define it as a
 // class. Otherwise, compiler will complain about type mismatch due to
 // -Wmismatched-tags.
+// TODO(roth): Consider renaming to something like ConnectionSecurityContext
+// to reflect the fact that it stores connection-level security properties.
 struct grpc_auth_context
     : public grpc_core::RefCounted<grpc_auth_context,
                                    grpc_core::NonPolymorphicRefCount> {
@@ -130,60 +129,6 @@ struct grpc_auth_context
   grpc_core::OrphanablePtr<grpc_core::ConnectionContext> connection_context_;
 };
 
-// --- grpc_security_context_extension ---
-
-// Extension to the security context that may be set in a filter and accessed
-// later by a higher level method on a grpc_call object.
-
-struct grpc_security_context_extension {
-  void* instance = nullptr;
-  void (*destroy)(void*) = nullptr;
-};
-
-namespace grpc_core {
-
-class SecurityContext {
- public:
-  virtual ~SecurityContext() = default;
-};
-
-}  // namespace grpc_core
-
-// --- grpc_client_security_context ---
-
-// Internal client-side security context.
-
-struct grpc_client_security_context final : public grpc_core::SecurityContext {
-  explicit grpc_client_security_context(
-      grpc_core::RefCountedPtr<grpc_call_credentials> creds)
-      : creds(std::move(creds)) {}
-  ~grpc_client_security_context() override;
-
-  grpc_core::RefCountedPtr<grpc_call_credentials> creds;
-  grpc_core::RefCountedPtr<grpc_auth_context> auth_context;
-  grpc_security_context_extension extension;
-};
-
-grpc_client_security_context* grpc_client_security_context_create(
-    grpc_core::Arena* arena, grpc_call_credentials* creds);
-void grpc_client_security_context_destroy(void* ctx);
-
-// --- grpc_server_security_context ---
-
-// Internal server-side security context.
-
-struct grpc_server_security_context final : public grpc_core::SecurityContext {
-  grpc_server_security_context() = default;
-  ~grpc_server_security_context() override;
-
-  grpc_core::RefCountedPtr<grpc_auth_context> auth_context;
-  grpc_security_context_extension extension;
-};
-
-grpc_server_security_context* grpc_server_security_context_create(
-    grpc_core::Arena* arena);
-void grpc_server_security_context_destroy(void* ctx);
-
 // --- Channel args for auth context ---
 
 grpc_arg grpc_auth_context_to_arg(grpc_auth_context* c);
@@ -191,20 +136,4 @@ grpc_auth_context* grpc_auth_context_from_arg(const grpc_arg* arg);
 grpc_auth_context* grpc_find_auth_context_in_args(
     const grpc_channel_args* args);
 
-namespace grpc_core {
-template <>
-struct ArenaContextType<SecurityContext> {
-  static void Destroy(SecurityContext* p) { p->~SecurityContext(); }
-};
-
-template <>
-struct ContextSubclass<grpc_client_security_context> {
-  using Base = SecurityContext;
-};
-template <>
-struct ContextSubclass<grpc_server_security_context> {
-  using Base = SecurityContext;
-};
-}  // namespace grpc_core
-
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_CONTEXT_SECURITY_CONTEXT_H
+#endif  // GRPC_SRC_CORE_TRANSPORT_AUTH_CONTEXT_H

data/src/core/transport/endpoint_transport.h

@@ -0,0 +1,90 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_H
+#define GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_H
+
+#include <grpc/impl/grpc_types.h>
+
+#include <memory>
+#include <string>
+
+#include "src/core/lib/channel/channel_args.h"
+
+namespace grpc_core {
+
+class Server;
+
+// Comma separated list of transport protocols in order of most preferred to
+// least preferred.
+#define GRPC_ARG_PREFERRED_TRANSPORT_PROTOCOLS \
+  "grpc.preferred_transport_protocols"
+
+// EndpointTransport is a transport that operates over EventEngine::Endpoint
+// objects.
+// This interface is an iterim thing whilst call-v3 is finished and we flesh
+// out next protocol negotiation in all transport stacks. At that point this
+// interface will change so that we can run many kinds of EndpointTransport
+// on one listener, and negotiate protocol with one connector.
+class EndpointTransport {
+ public:
+  virtual absl::StatusOr<grpc_channel*> ChannelCreate(
+      std::string target, const ChannelArgs& args) = 0;
+  virtual absl::StatusOr<int> AddPort(Server* server, std::string addr,
+                                      const ChannelArgs& args) = 0;
+  virtual ~EndpointTransport() = default;
+};
+
+class EndpointTransportRegistry {
+ private:
+  using TransportMap =
+      std::map<std::string, std::unique_ptr<EndpointTransport>>;
+
+ public:
+  class Builder {
+   public:
+    void RegisterTransport(std::string name,
+                           std::unique_ptr<EndpointTransport> transport) {
+      if (transports_.find(name) != transports_.end()) {
+        LOG(FATAL) << "Duplicate endpoint transport registration: " << name;
+      }
+      transports_[name] = std::move(transport);
+    }
+
+    EndpointTransportRegistry Build() {
+      return EndpointTransportRegistry(std::move(transports_));
+    }
+
+   private:
+    TransportMap transports_;
+  };
+
+  EndpointTransport* GetTransport(absl::string_view name) const {
+    auto it = transports_.find(std::string(name));
+    if (it == transports_.end()) {
+      return nullptr;
+    }
+    return it->second.get();
+  }
+
+ private:
+  explicit EndpointTransportRegistry(TransportMap transports)
+      : transports_(std::move(transports)) {}
+
+  TransportMap transports_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_H

data/src/core/transport/endpoint_transport_client_channel_factory.cc

@@ -0,0 +1,61 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/core/transport/endpoint_transport_client_channel_factory.h"
+
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/credentials/transport/transport_credentials.h"
+
+namespace grpc_core::endpoint_transport_client_channel_factory_detail {
+
+RefCountedPtr<Subchannel> GenericClientChannelFactory::CreateSubchannel(
+    const grpc_resolved_address& address, const ChannelArgs& args) {
+  absl::StatusOr<ChannelArgs> new_args = GetSecureNamingChannelArgs(args);
+  if (!new_args.ok()) {
+    LOG(ERROR) << "Failed to create channel args during subchannel creation: "
+               << new_args.status() << "; Got args: " << args.ToString();
+    return nullptr;
+  }
+  return Subchannel::Create(MakeConnector(), address, *new_args);
+}
+
+absl::StatusOr<ChannelArgs>
+GenericClientChannelFactory::GetSecureNamingChannelArgs(ChannelArgs args) {
+  auto* channel_credentials = args.GetObject<grpc_channel_credentials>();
+  if (channel_credentials == nullptr) {
+    return absl::InternalError("channel credentials missing for channel");
+  }
+  // Make sure security connector does not already exist in args.
+  if (args.Contains(GRPC_ARG_SECURITY_CONNECTOR)) {
+    return absl::InternalError(
+        "security connector already present in channel args.");
+  }
+  // Find the authority to use in the security connector.
+  std::optional<std::string> authority =
+      args.GetOwnedString(GRPC_ARG_DEFAULT_AUTHORITY);
+  if (!authority.has_value()) {
+    return absl::InternalError("authority not present in channel args");
+  }
+  // Create the security connector using the credentials and target name.
+  RefCountedPtr<grpc_channel_security_connector> subchannel_security_connector =
+      channel_credentials->create_security_connector(
+          /*call_creds=*/nullptr, authority->c_str(), &args);
+  if (subchannel_security_connector == nullptr) {
+    return absl::InternalError(absl::StrFormat(
+        "Failed to create subchannel for secure name '%s'", *authority));
+  }
+  return args.SetObject(std::move(subchannel_security_connector));
+}
+
+}  // namespace grpc_core::endpoint_transport_client_channel_factory_detail

data/src/core/transport/endpoint_transport_client_channel_factory.h

@@ -0,0 +1,57 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_CLIENT_CHANNEL_FACTORY_H
+#define GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_CLIENT_CHANNEL_FACTORY_H
+
+#include "src/core/client_channel/client_channel_factory.h"
+#include "src/core/client_channel/subchannel.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/util/no_destruct.h"
+
+namespace grpc_core {
+
+namespace endpoint_transport_client_channel_factory_detail {
+
+class GenericClientChannelFactory : public ClientChannelFactory {
+ public:
+  RefCountedPtr<Subchannel> CreateSubchannel(
+      const grpc_resolved_address& address, const ChannelArgs& args) override;
+
+ private:
+  virtual OrphanablePtr<SubchannelConnector> MakeConnector() = 0;
+
+  static absl::StatusOr<ChannelArgs> GetSecureNamingChannelArgs(
+      ChannelArgs args);
+};
+
+template <typename Connector>
+class TypedClientChannelFactory final : public GenericClientChannelFactory {
+ private:
+  OrphanablePtr<SubchannelConnector> MakeConnector() override {
+    return MakeOrphanable<Connector>();
+  };
+};
+
+}  // namespace endpoint_transport_client_channel_factory_detail
+
+template <typename Connector>
+auto EndpointTransportClientChannelFactory() {
+  return NoDestructSingleton<endpoint_transport_client_channel_factory_detail::
+                                 TypedClientChannelFactory<Connector>>::Get();
+}
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_CLIENT_CHANNEL_FACTORY_H