grpc 1.72.0 → 1.73.0

data/src/core/telemetry/tcp_tracer.h

@@ -19,12 +19,14 @@
 #ifndef GRPC_SRC_CORE_TELEMETRY_TCP_TRACER_H
 #define GRPC_SRC_CORE_TELEMETRY_TCP_TRACER_H
 
+#include <grpc/event_engine/internal/write_event.h>
 #include <grpc/support/port_platform.h>
 #include <stddef.h>
 #include <stdint.h>
 
 #include <optional>
 #include <string>
+#include <vector>
 
 #include "absl/time/time.h"
 
@@ -112,28 +114,24 @@ struct TcpConnectionMetrics {
 
 class TcpCallTracer {
  public:
-  enum class Type {
-    kUnknown = 0,
-    // When the sendmsg system call or its variants returned for the traced byte
-    // offset.
-    kSendMsg,
-    // When the traced byte offset is enqueued in kernel schedulers (aka,
-    // qdiscs). There can be multiple schedulers.
-    kScheduled,
-    // When the traced byte offset is handed over to the NIC.
-    kSent,
-    // When the acknowledgement for the traced byte offset was received.
-    kAcked,
-    // When the connection is closed. This is not associated with a byte offset.
-    kClosed,
+  struct TcpEventMetric {
+    absl::string_view key;
+    int64_t value;
+
+    std::string ToString();
   };
 
+  std::string TcpEventMetricsToString(
+      const std::vector<TcpEventMetric>& metrics);
+
   virtual ~TcpCallTracer() = default;
 
   // Records a per-message event with an optional snapshot of connection
   // metrics.
-  virtual void RecordEvent(Type type, absl::Time time, size_t byte_offset,
-                           std::optional<TcpConnectionMetrics> metrics) = 0;
+  virtual void RecordEvent(
+      grpc_event_engine::experimental::internal::WriteEvent event,
+      absl::Time time, size_t byte_offset,
+      std::vector<TcpEventMetric> metrics) = 0;
 };
 
 class TcpConnectionTracer {

data/src/core/transport/auth_context.cc

@@ -31,7 +31,6 @@
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/resource_quota/arena.h"
-#include "src/core/lib/surface/call.h"
 #include "src/core/util/ref_counted_ptr.h"
 
 void grpc_auth_context_release(grpc_auth_context* context) {

data/src/core/transport/auth_context.h

@@ -28,7 +28,6 @@
 #include <utility>
 
 #include "absl/strings/string_view.h"
-#include "src/core/credentials/transport/transport_credentials.h"  // IWYU pragma: keep
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/surface/connection_context.h"

data/src/core/transport/endpoint_transport.h

@@ -0,0 +1,90 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_H
+#define GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_H
+
+#include <grpc/impl/grpc_types.h>
+
+#include <memory>
+#include <string>
+
+#include "src/core/lib/channel/channel_args.h"
+
+namespace grpc_core {
+
+class Server;
+
+// Comma separated list of transport protocols in order of most preferred to
+// least preferred.
+#define GRPC_ARG_PREFERRED_TRANSPORT_PROTOCOLS \
+  "grpc.preferred_transport_protocols"
+
+// EndpointTransport is a transport that operates over EventEngine::Endpoint
+// objects.
+// This interface is an iterim thing whilst call-v3 is finished and we flesh
+// out next protocol negotiation in all transport stacks. At that point this
+// interface will change so that we can run many kinds of EndpointTransport
+// on one listener, and negotiate protocol with one connector.
+class EndpointTransport {
+ public:
+  virtual absl::StatusOr<grpc_channel*> ChannelCreate(
+      std::string target, const ChannelArgs& args) = 0;
+  virtual absl::StatusOr<int> AddPort(Server* server, std::string addr,
+                                      const ChannelArgs& args) = 0;
+  virtual ~EndpointTransport() = default;
+};
+
+class EndpointTransportRegistry {
+ private:
+  using TransportMap =
+      std::map<std::string, std::unique_ptr<EndpointTransport>>;
+
+ public:
+  class Builder {
+   public:
+    void RegisterTransport(std::string name,
+                           std::unique_ptr<EndpointTransport> transport) {
+      if (transports_.find(name) != transports_.end()) {
+        LOG(FATAL) << "Duplicate endpoint transport registration: " << name;
+      }
+      transports_[name] = std::move(transport);
+    }
+
+    EndpointTransportRegistry Build() {
+      return EndpointTransportRegistry(std::move(transports_));
+    }
+
+   private:
+    TransportMap transports_;
+  };
+
+  EndpointTransport* GetTransport(absl::string_view name) const {
+    auto it = transports_.find(std::string(name));
+    if (it == transports_.end()) {
+      return nullptr;
+    }
+    return it->second.get();
+  }
+
+ private:
+  explicit EndpointTransportRegistry(TransportMap transports)
+      : transports_(std::move(transports)) {}
+
+  TransportMap transports_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_H

data/src/core/transport/endpoint_transport_client_channel_factory.cc

@@ -0,0 +1,61 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/core/transport/endpoint_transport_client_channel_factory.h"
+
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/credentials/transport/transport_credentials.h"
+
+namespace grpc_core::endpoint_transport_client_channel_factory_detail {
+
+RefCountedPtr<Subchannel> GenericClientChannelFactory::CreateSubchannel(
+    const grpc_resolved_address& address, const ChannelArgs& args) {
+  absl::StatusOr<ChannelArgs> new_args = GetSecureNamingChannelArgs(args);
+  if (!new_args.ok()) {
+    LOG(ERROR) << "Failed to create channel args during subchannel creation: "
+               << new_args.status() << "; Got args: " << args.ToString();
+    return nullptr;
+  }
+  return Subchannel::Create(MakeConnector(), address, *new_args);
+}
+
+absl::StatusOr<ChannelArgs>
+GenericClientChannelFactory::GetSecureNamingChannelArgs(ChannelArgs args) {
+  auto* channel_credentials = args.GetObject<grpc_channel_credentials>();
+  if (channel_credentials == nullptr) {
+    return absl::InternalError("channel credentials missing for channel");
+  }
+  // Make sure security connector does not already exist in args.
+  if (args.Contains(GRPC_ARG_SECURITY_CONNECTOR)) {
+    return absl::InternalError(
+        "security connector already present in channel args.");
+  }
+  // Find the authority to use in the security connector.
+  std::optional<std::string> authority =
+      args.GetOwnedString(GRPC_ARG_DEFAULT_AUTHORITY);
+  if (!authority.has_value()) {
+    return absl::InternalError("authority not present in channel args");
+  }
+  // Create the security connector using the credentials and target name.
+  RefCountedPtr<grpc_channel_security_connector> subchannel_security_connector =
+      channel_credentials->create_security_connector(
+          /*call_creds=*/nullptr, authority->c_str(), &args);
+  if (subchannel_security_connector == nullptr) {
+    return absl::InternalError(absl::StrFormat(
+        "Failed to create subchannel for secure name '%s'", *authority));
+  }
+  return args.SetObject(std::move(subchannel_security_connector));
+}
+
+}  // namespace grpc_core::endpoint_transport_client_channel_factory_detail

data/src/core/transport/endpoint_transport_client_channel_factory.h

@@ -0,0 +1,57 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_CLIENT_CHANNEL_FACTORY_H
+#define GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_CLIENT_CHANNEL_FACTORY_H
+
+#include "src/core/client_channel/client_channel_factory.h"
+#include "src/core/client_channel/subchannel.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/util/no_destruct.h"
+
+namespace grpc_core {
+
+namespace endpoint_transport_client_channel_factory_detail {
+
+class GenericClientChannelFactory : public ClientChannelFactory {
+ public:
+  RefCountedPtr<Subchannel> CreateSubchannel(
+      const grpc_resolved_address& address, const ChannelArgs& args) override;
+
+ private:
+  virtual OrphanablePtr<SubchannelConnector> MakeConnector() = 0;
+
+  static absl::StatusOr<ChannelArgs> GetSecureNamingChannelArgs(
+      ChannelArgs args);
+};
+
+template <typename Connector>
+class TypedClientChannelFactory final : public GenericClientChannelFactory {
+ private:
+  OrphanablePtr<SubchannelConnector> MakeConnector() override {
+    return MakeOrphanable<Connector>();
+  };
+};
+
+}  // namespace endpoint_transport_client_channel_factory_detail
+
+template <typename Connector>
+auto EndpointTransportClientChannelFactory() {
+  return NoDestructSingleton<endpoint_transport_client_channel_factory_detail::
+                                 TypedClientChannelFactory<Connector>>::Get();
+}
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_TRANSPORT_ENDPOINT_TRANSPORT_CLIENT_CHANNEL_FACTORY_H

data/src/core/tsi/alts/handshaker/alts_handshaker_client.cc

@@ -27,6 +27,7 @@
 #include "absl/log/check.h"
 #include "absl/log/log.h"
 #include "absl/strings/numbers.h"
+#include "absl/strings/str_split.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/surface/call.h"
 #include "src/core/lib/surface/channel.h"
@@ -111,6 +112,7 @@ typedef struct alts_grpc_handshaker_client {
   recv_message_result* pending_recv_message_result = nullptr;
   // Maximum frame size used by frame protector.
   size_t max_frame_size;
+  std::vector<std::string> preferred_transport_protocols;
   // If non-null, will be populated with an error string upon error.
   std::string* error;
 } alts_grpc_handshaker_client;
@@ -537,6 +539,17 @@ static grpc_byte_buffer* get_serialized_start_client(
   }
   grpc_gcp_StartClientHandshakeReq_set_max_frame_size(
       start_client, static_cast<uint32_t>(client->max_frame_size));
+  if (!client->preferred_transport_protocols.empty()) {
+    grpc_gcp_TransportProtocolPreferences* preferences =
+        grpc_gcp_StartClientHandshakeReq_mutable_transport_protocol_preferences(
+            start_client, arena.ptr());
+    for (const auto& transport_protocol :
+         client->preferred_transport_protocols) {
+      grpc_gcp_TransportProtocolPreferences_add_transport_protocol(
+          preferences, upb_StringView_FromString(transport_protocol.c_str()),
+          arena.ptr());
+    }
+  }
   return get_serialized_handshaker_req(req, arena.ptr());
 }
 
@@ -595,6 +608,17 @@ static grpc_byte_buffer* get_serialized_start_server(
       server_version, arena.ptr(), &client->options->rpc_versions);
   grpc_gcp_StartServerHandshakeReq_set_max_frame_size(
       start_server, static_cast<uint32_t>(client->max_frame_size));
+  if (!client->preferred_transport_protocols.empty()) {
+    grpc_gcp_TransportProtocolPreferences* preferences =
+        grpc_gcp_StartServerHandshakeReq_mutable_transport_protocol_preferences(
+            start_server, arena.ptr());
+    for (const auto& transport_protocol :
+         client->preferred_transport_protocols) {
+      grpc_gcp_TransportProtocolPreferences_add_transport_protocol(
+          preferences, upb_StringView_FromString(transport_protocol.c_str()),
+          arena.ptr());
+    }
+  }
   return get_serialized_handshaker_req(req, arena.ptr());
 }
 
@@ -712,7 +736,9 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
     grpc_alts_credentials_options* options, const grpc_slice& target_name,
     grpc_iomgr_cb_func grpc_cb, tsi_handshaker_on_next_done_cb cb,
     void* user_data, alts_handshaker_client_vtable* vtable_for_testing,
-    bool is_client, size_t max_frame_size, std::string* error) {
+    bool is_client, size_t max_frame_size,
+    std::optional<absl::string_view> preferred_transport_protocols,
+    std::string* error) {
   if (channel == nullptr || handshaker_service_url == nullptr) {
     LOG(ERROR) << "Invalid arguments to alts_handshaker_client_create()";
     return nullptr;
@@ -735,6 +761,12 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
   client->buffer = static_cast<unsigned char*>(gpr_zalloc(client->buffer_size));
   client->handshake_status_details = grpc_empty_slice();
   client->max_frame_size = max_frame_size;
+  std::vector<std::string> transport_protocols;
+  if (preferred_transport_protocols.has_value()) {
+    transport_protocols = absl::StrSplit(preferred_transport_protocols.value(),
+                                         ',', absl::SkipWhitespace());
+  }
+  client->preferred_transport_protocols = transport_protocols;
   client->error = error;
   client->call =
       strcmp(handshaker_service_url, ALTS_HANDSHAKER_SERVICE_URL_FOR_TESTING) ==

data/src/core/tsi/alts/handshaker/alts_handshaker_client.h

@@ -143,7 +143,9 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
     grpc_alts_credentials_options* options, const grpc_slice& target_name,
     grpc_iomgr_cb_func grpc_cb, tsi_handshaker_on_next_done_cb cb,
     void* user_data, alts_handshaker_client_vtable* vtable_for_testing,
-    bool is_client, size_t max_frame_size, std::string* error);
+    bool is_client, size_t max_frame_size,
+    std::optional<absl::string_view> preferred_transport_protocol,
+    std::string* error);
 
 ///
 /// This method handles handshaker response returned from ALTS handshaker

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc

@@ -38,10 +38,21 @@
 #include "src/core/tsi/alts/handshaker/alts_handshaker_client.h"
 #include "src/core/tsi/alts/handshaker/alts_shared_resource.h"
 #include "src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.h"
+#include "src/core/util/env.h"
 #include "src/core/util/memory.h"
 #include "src/core/util/sync.h"
 #include "upb/mem/arena.hpp"
 
+namespace {
+constexpr absl::string_view kUseGrpcExperimentalAltsHandshakerKeepaliveParams =
+    "GRPC_EXPERIMENTAL_ALTS_HANDSHAKER_KEEPALIVE_PARAMS";
+
+// 10 seconds
+constexpr int kExperimentalKeepAliveTimeoutMs = 10 * 1000;
+// 10 minutes
+constexpr int kExperimentalKeepAliveTimeMs = 10 * 60 * 1000;
+}  // namespace
+
 // Main struct for ALTS TSI handshaker.
 struct alts_tsi_handshaker {
   tsi_handshaker base;
@@ -66,6 +77,9 @@ struct alts_tsi_handshaker {
   bool shutdown = false;
   // Maximum frame size used by frame protector.
   size_t max_frame_size;
+  // A comma-separated list of preferred transport protocols, sorted by
+  // preference.
+  std::optional<std::string> preferred_transport_protocols;
 };
 
 // Main struct for ALTS TSI handshaker result.
@@ -80,6 +94,7 @@ typedef struct alts_tsi_handshaker_result {
   grpc_slice serialized_context;
   // Peer's maximum frame size.
   size_t max_frame_size;
+  std::optional<std::string> negotiated_transport_protocol;
 } alts_tsi_handshaker_result;
 
 static tsi_result handshaker_result_extract_peer(
@@ -91,8 +106,11 @@ static tsi_result handshaker_result_extract_peer(
   alts_tsi_handshaker_result* result =
       reinterpret_cast<alts_tsi_handshaker_result*>(
           const_cast<tsi_handshaker_result*>(self));
-  CHECK_EQ(kTsiAltsNumOfPeerProperties, 5u);
-  tsi_result ok = tsi_construct_peer(kTsiAltsNumOfPeerProperties, peer);
+  const int peer_properties_count =
+      (result && result->negotiated_transport_protocol.has_value())
+          ? (kTsiAltsMinNumOfPeerProperties + 1)
+          : kTsiAltsMinNumOfPeerProperties;
+  tsi_result ok = tsi_construct_peer(peer_properties_count, peer);
   int index = 0;
   if (ok != TSI_OK) {
     LOG(ERROR) << "Failed to construct tsi peer";
@@ -146,7 +164,19 @@ static tsi_result handshaker_result_extract_peer(
     tsi_peer_destruct(peer);
     LOG(ERROR) << "Failed to set tsi peer property";
   }
-  CHECK(++index == kTsiAltsNumOfPeerProperties);
+  if (result->negotiated_transport_protocol.has_value()) {
+    index++;
+    CHECK_NE(&peer->properties[index], nullptr);
+    ok = tsi_construct_string_peer_property_from_cstring(
+        TSI_ALTS_NEGOTIATED_TRANSPORT_PROTOCOL,
+        result->negotiated_transport_protocol.value().c_str(),
+        &peer->properties[index]);
+    if (ok != TSI_OK) {
+      tsi_peer_destruct(peer);
+      LOG(ERROR) << "Failed to set tsi peer property";
+    }
+  }
+  CHECK(++index == peer_properties_count);
   return ok;
 }
 
@@ -313,7 +343,8 @@ tsi_result alts_tsi_handshaker_result_create(grpc_gcp_HandshakerResp* resp,
   // We don't check if local service account is empty here
   // because local identity could be empty in certain situations.
   alts_tsi_handshaker_result* sresult =
-      grpc_core::Zalloc<alts_tsi_handshaker_result>();
+      static_cast<alts_tsi_handshaker_result*>(
+          gpr_zalloc(sizeof(alts_tsi_handshaker_result)));
   sresult->key_data =
       static_cast<char*>(gpr_zalloc(kAltsAes128GcmRekeyKeyLength));
   memcpy(sresult->key_data, key_data.data, kAltsAes128GcmRekeyKeyLength);
@@ -322,6 +353,19 @@ tsi_result alts_tsi_handshaker_result_create(grpc_gcp_HandshakerResp* resp,
   memcpy(sresult->peer_identity, peer_service_account.data,
          peer_service_account.size);
   sresult->max_frame_size = grpc_gcp_HandshakerResult_max_frame_size(hresult);
+  const grpc_gcp_NegotiatedTransportProtocol* negotiated_transport_protocol =
+      grpc_gcp_HandshakerResult_transport_protocol(hresult);
+
+  sresult->negotiated_transport_protocol = std::nullopt;
+  if (negotiated_transport_protocol != nullptr) {
+    upb_StringView transport_protocol =
+        grpc_gcp_NegotiatedTransportProtocol_transport_protocol(
+            negotiated_transport_protocol);
+    if (transport_protocol.size != 0) {
+      sresult->negotiated_transport_protocol =
+          std::string(transport_protocol.data, transport_protocol.size);
+    }
+  }
   upb::Arena rpc_versions_arena;
   bool serialized = grpc_gcp_rpc_protocol_versions_encode(
       peer_rpc_version, rpc_versions_arena.ptr(), &sresult->rpc_versions);
@@ -347,19 +391,13 @@ tsi_result alts_tsi_handshaker_result_create(grpc_gcp_HandshakerResp* resp,
     return TSI_FAILED_PRECONDITION;
   }
   if (grpc_gcp_Identity_attributes_size(identity) != 0) {
-    // TODO(b/397931390): Clean up the code after gRPC OSS migrates to proto
-    // v30.0.
-    const upb_Map* upb_map =
-        _grpc_gcp_Identity_attributes_upb_map(peer_identity);
-    if (upb_map) {
-      size_t iter = kUpb_Map_Begin;
-      upb_MessageValue k, v;
-      while (upb_Map_Next(upb_map, &k, &v, &iter)) {
-        upb_StringView key = k.str_val;
-        upb_StringView val = v.str_val;
-        grpc_gcp_AltsContext_peer_attributes_set(context, key, val,
-                                                 context_arena.ptr());
-      }
+    size_t iter = kUpb_Map_Begin;
+    upb_StringView key;
+    upb_StringView val;
+    while (
+        grpc_gcp_Identity_attributes_next(peer_identity, &key, &val, &iter)) {
+      grpc_gcp_AltsContext_peer_attributes_set(context, key, val,
+                                               context_arena.ptr());
     }
   }
 
@@ -432,7 +470,8 @@ static tsi_result alts_tsi_handshaker_continue_handshaker_next(
         handshaker->interested_parties, handshaker->options,
         handshaker->target_name, grpc_cb, cb, user_data,
         handshaker->client_vtable_for_testing, handshaker->is_client,
-        handshaker->max_frame_size, error);
+        handshaker->max_frame_size, handshaker->preferred_transport_protocols,
+        error);
     if (client == nullptr) {
       LOG(ERROR) << "Failed to create ALTS handshaker client";
       if (error != nullptr) *error = "Failed to create ALTS handshaker client";
@@ -499,9 +538,22 @@ static void alts_tsi_handshaker_create_channel(
   grpc_channel_credentials* creds = grpc_insecure_credentials_create();
   // Disable retries so that we quickly get a signal when the
   // handshake server is not reachable.
-  grpc_arg disable_retries_arg = grpc_channel_arg_integer_create(
-      const_cast<char*>(GRPC_ARG_ENABLE_RETRIES), 0);
-  grpc_channel_args args = {1, &disable_retries_arg};
+  std::vector<grpc_arg> args_vec;
+  args_vec.push_back(grpc_channel_arg_integer_create(
+      const_cast<char*>(GRPC_ARG_ENABLE_RETRIES), 0));
+  // TODO(gtcooke94) - Flag to try new values for ALTS keep alive settings,
+  // remove after trial
+  std::optional<std::string> env = grpc_core::GetEnv(
+      kUseGrpcExperimentalAltsHandshakerKeepaliveParams.data());
+  if (env.has_value() && (*env == "true")) {
+    args_vec.push_back(grpc_channel_arg_integer_create(
+        const_cast<char*>(GRPC_ARG_KEEPALIVE_TIMEOUT_MS),
+        kExperimentalKeepAliveTimeoutMs));
+    args_vec.push_back(grpc_channel_arg_integer_create(
+        const_cast<char*>(GRPC_ARG_KEEPALIVE_TIME_MS),
+        kExperimentalKeepAliveTimeMs));
+  }
+  grpc_channel_args args = {args_vec.size(), args_vec.data()};
   handshaker->channel = grpc_channel_create(
       next_args->handshaker->handshaker_service_url, creds, &args);
   grpc_channel_credentials_release(creds);
@@ -646,7 +698,8 @@ tsi_result alts_tsi_handshaker_create(
     const grpc_alts_credentials_options* options, const char* target_name,
     const char* handshaker_service_url, bool is_client,
     grpc_pollset_set* interested_parties, tsi_handshaker** self,
-    size_t user_specified_max_frame_size) {
+    size_t user_specified_max_frame_size,
+    std::optional<std::string> preferred_transport_protocols) {
   if (handshaker_service_url == nullptr || self == nullptr ||
       options == nullptr || (is_client && target_name == nullptr)) {
     LOG(ERROR) << "Invalid arguments to alts_tsi_handshaker_create()";
@@ -668,6 +721,7 @@ tsi_result alts_tsi_handshaker_create(
   handshaker->max_frame_size = user_specified_max_frame_size != 0
                                    ? user_specified_max_frame_size
                                    : kTsiAltsMaxFrameSize;
+  handshaker->preferred_transport_protocols = preferred_transport_protocols;
   *self = &handshaker->base;
   return TSI_OK;
 }

data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.h

@@ -34,8 +34,10 @@
 #define TSI_ALTS_CERTIFICATE_TYPE "ALTS"
 #define TSI_ALTS_RPC_VERSIONS "rpc_versions"
 #define TSI_ALTS_CONTEXT "alts_context"
+#define TSI_ALTS_NEGOTIATED_TRANSPORT_PROTOCOL \
+  "alts_negotiated_transport_protocol"
 
-const size_t kTsiAltsNumOfPeerProperties = 5;
+inline const size_t kTsiAltsMinNumOfPeerProperties = 5;
 
 // Frame size negotiation extends send frame size range to
 // [kTsiAltsMinFrameSize, kTsiAltsMaxFrameSize].
@@ -60,6 +62,9 @@ typedef struct alts_tsi_handshaker alts_tsi_handshaker;
 ///  method.
 ///- user_specified_max_frame_size: Determines the maximum frame size used by
 ///  frame protector that is specified via user. If unspecified, the value is 0.
+///- preferred_transport_protocols: a comma separated list of preferred
+///  transport protocols to be negotiated for this connection. If empty, no
+///  negotiation will occur.
 ///
 /// It returns TSI_OK on success and an error status code on failure. Note that
 /// if interested_parties is nullptr, a dedicated TSI thread will be created and
@@ -69,7 +74,8 @@ tsi_result alts_tsi_handshaker_create(
     const grpc_alts_credentials_options* options, const char* target_name,
     const char* handshaker_service_url, bool is_client,
     grpc_pollset_set* interested_parties, tsi_handshaker** self,
-    size_t user_specified_max_frame_size);
+    size_t user_specified_max_frame_size,
+    std::optional<std::string> preferred_transport_protocols);
 
 ///
 /// This method creates an ALTS TSI handshaker result instance.