grpc 1.81.1 → 1.83.0

data/src/core/transport/session_endpoint.cc

@@ -30,6 +30,7 @@
 #include <memory>
 #include <utility>
 
+#include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/event_engine_shims/endpoint.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
@@ -241,8 +242,7 @@ class SessionEndpointImpl {
         Ref();
         if (shutdown_ref_.fetch_sub(1, std::memory_order_acq_rel) ==
             kShutdownBit + 1) {
-          grpc_call_cancel_internal(call_);
-          Unref();
+          CompleteShutdown();
         }
         break;
       }
@@ -251,7 +251,27 @@ class SessionEndpointImpl {
     Unref();
   }
 
+  void SetGracefulShutdown() {
+    if (!ShutdownRef()) return;
+    graceful_shutdown_ = true;
+    ShutdownUnref();
+  }
+
+  void ClearCall() { call_cleared_.store(true, std::memory_order_release); }
+
  private:
+  void CompleteShutdown() {
+    if (graceful_shutdown_ || call_cleared_.load(std::memory_order_acquire)) {
+      // Just drop our refs so the call can finish normally.
+      call_cleared_.store(true, std::memory_order_release);
+      Unref();
+    } else {
+      call_cleared_.store(true, std::memory_order_release);
+      grpc_call_cancel_internal(call_);
+      Unref();
+    }
+  }
+
   bool ShutdownRef() {
     int64_t curr = shutdown_ref_.load(std::memory_order_acquire);
     while (true) {
@@ -269,12 +289,12 @@ class SessionEndpointImpl {
   void ShutdownUnref() {
     if (shutdown_ref_.fetch_sub(1, std::memory_order_acq_rel) ==
         kShutdownBit + 1) {
-      grpc_call_cancel_internal(call_);
-      Unref();
+      CompleteShutdown();
     }
   }
 
   grpc_call* const call_;
+  std::atomic<bool> call_cleared_{false};
   const bool is_client_;
 
   std::atomic<int64_t> refs_{1};
@@ -286,6 +306,7 @@ class SessionEndpointImpl {
 
   SessionEndpointTag write_tag_;
   std::atomic<bool> write_in_progress_{false};
+  bool graceful_shutdown_ = false;
 };
 
 grpc_endpoint* SessionEndpoint::Create(grpc_call* call, bool is_client) {
@@ -299,6 +320,10 @@ SessionEndpoint::SessionEndpoint(grpc_call* call, bool is_client)
 
 SessionEndpoint::~SessionEndpoint() { impl_->TriggerShutdown(); }
 
+void SessionEndpoint::SetGracefulShutdown() { impl_->SetGracefulShutdown(); }
+
+void SessionEndpoint::ClearCall() { impl_->ClearCall(); }
+
 bool SessionEndpoint::Read(absl::AnyInvocable<void(absl::Status)> on_read,
                            grpc_event_engine::experimental::SliceBuffer* buffer,
                            ReadArgs /*args*/) {

data/src/core/transport/session_endpoint.h

@@ -74,6 +74,10 @@ class SessionEndpoint
     return nullptr;
   }
 
+  void SetGracefulShutdown();
+
+  void ClearCall();
+
  private:
   SessionEndpointImpl* impl_;
   grpc_event_engine::experimental::EventEngine::ResolvedAddress local_address_;

data/src/core/tsi/alts/crypt/gsec.h

@@ -98,14 +98,16 @@ class GsecKey : public GsecKeyInterface {
 
 }  // namespace grpc_core
 
-#ifndef _STRUCT_IOVEC
+#if !defined(_STRUCT_IOVEC) && !defined(__DEFINED_struct_iovec)
 #if !defined(GRPC_EVENT_ENGINE_POSIX)
+#define _STRUCT_IOVEC
+#define __DEFINED_struct_iovec
 struct iovec {
   void* iov_base;
   size_t iov_len;
 };
 #endif  // GRPC_EVENT_ENGINE_POSIX
-#endif  // _STRUCT_IOVEC
+#endif  // !defined(_STRUCT_IOVEC) && !defined(__DEFINED_struct_iovec)
 
 //
 // A gsec interface for AEAD encryption schemes. The API is thread-compatible.

data/src/core/tsi/alts/handshaker/alts_handshaker_client.cc

@@ -809,7 +809,7 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
                 /*cq=*/nullptr, interested_parties,
                 grpc_core::Slice::FromStaticString(ALTS_SERVICE_METHOD),
                 /*authority=*/std::nullopt, grpc_core::Timestamp::InfFuture(),
-                /*registered_method=*/true);
+                /*registered_method=*/true, std::nullopt);
   GRPC_CLOSURE_INIT(&client->on_handshaker_service_resp_recv, grpc_cb, client,
                     grpc_schedule_on_exec_ctx);
   GRPC_CLOSURE_INIT(&client->on_status_received, on_status_received, client,

data/src/core/tsi/ssl_telemetry_utils.cc

@@ -0,0 +1,343 @@
+//
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include "src/core/tsi/ssl_telemetry_utils.h"
+
+#include <grpc/support/port_platform.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+#include <openssl/x509.h>
+
+namespace grpc_core {
+
+#if defined(OPENSSL_IS_BORINGSSL)
+
+namespace {
+
+TlsTelemetryHandshakeResult MapVerifyResultToTlsTelemetryHandshakeResult(
+    long verify_result) {
+  if (verify_result == X509_V_OK) return TlsTelemetryHandshakeResult::kSuccess;
+  switch (verify_result) {
+    case X509_V_ERR_CERT_REVOKED:
+      return TlsTelemetryHandshakeResult::kCertificateRevoked;
+    case X509_V_ERR_CERT_HAS_EXPIRED:
+      return TlsTelemetryHandshakeResult::kCertificateExpired;
+    case X509_V_ERR_CERT_NOT_YET_VALID:
+      return TlsTelemetryHandshakeResult::kCertificateNotYetValid;
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
+    case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+    case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+    case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
+      return TlsTelemetryHandshakeResult::kCertificateAuthorityInvalid;
+    case X509_V_ERR_HOSTNAME_MISMATCH:
+      return TlsTelemetryHandshakeResult::kCertificateHostnameMismatch;
+    case X509_V_ERR_CERT_REJECTED:
+      return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+    case X509_V_ERR_UNABLE_TO_GET_CRL:
+      return TlsTelemetryHandshakeResult::kCrlNotFound;
+    case X509_V_ERR_CRL_HAS_EXPIRED:
+    case X509_V_ERR_CRL_NOT_YET_VALID:
+      return TlsTelemetryHandshakeResult::kCrlExpired;
+    case X509_V_ERR_CRL_SIGNATURE_FAILURE:
+      return TlsTelemetryHandshakeResult::kCrlSignatureFailure;
+    case X509_V_ERR_INVALID_CA:
+    case X509_V_ERR_INVALID_NON_CA:
+    case X509_V_ERR_INVALID_PURPOSE:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
+      return TlsTelemetryHandshakeResult::kCertificateMalformed;
+    case X509_V_ERR_CERT_SIGNATURE_FAILURE:
+      return TlsTelemetryHandshakeResult::kSignatureVerificationFailed;
+    default:
+      return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+  }
+}
+
+}  // namespace
+
+TlsTelemetryHandshakeResult MapSslErrorToTlsTelemetryHandshakeResult(
+    int ssl_error, unsigned long err_code, long verify_result) {
+  if (ssl_error == SSL_ERROR_NONE) {
+    return MapVerifyResultToTlsTelemetryHandshakeResult(verify_result);
+  }
+
+  if (ssl_error == SSL_ERROR_ZERO_RETURN) {
+    return TlsTelemetryHandshakeResult::kPeerConnectionClosed;
+  }
+
+  if (ssl_error == SSL_ERROR_SYSCALL) {
+    return TlsTelemetryHandshakeResult::kPeerConnectionClosed;
+  }
+
+  if (ssl_error == SSL_ERROR_SSL) {
+    int reason = ERR_GET_REASON(err_code);
+    switch (reason) {
+      // Cipher suite mismatch failures
+      case SSL_R_NO_CIPHERS_AVAILABLE:
+      case SSL_R_NO_CIPHERS_PASSED:
+      case SSL_R_NO_CIPHER_MATCH:
+      case SSL_R_NO_SHARED_CIPHER:
+      case SSL_R_REQUIRED_CIPHER_MISSING:
+      case SSL_R_UNSUPPORTED_CIPHER:
+      case SSL_R_WRONG_CIPHER_RETURNED:
+      case SSL_R_CIPHER_MISMATCH_ON_EARLY_DATA:
+      case SSL_R_CIPHER_OR_HASH_UNAVAILABLE:
+        return TlsTelemetryHandshakeResult::kCipherSuiteMismatch;
+
+      // Protocol version unsupported failures
+      case SSL_R_UNKNOWN_PROTOCOL:
+      case SSL_R_UNKNOWN_SSL_VERSION:
+      case SSL_R_UNSUPPORTED_PROTOCOL:
+      case SSL_R_WRONG_SSL_VERSION:
+      case SSL_R_WRONG_VERSION_NUMBER:
+      case SSL_R_UNSUPPORTED_PROTOCOL_FOR_CUSTOM_KEY:
+      case SSL_R_WRONG_VERSION_ON_EARLY_DATA:
+      case SSL_R_NO_SUPPORTED_VERSIONS_ENABLED:
+      case SSL_R_SECOND_SERVERHELLO_VERSION_MISMATCH:
+        return TlsTelemetryHandshakeResult::kProtocolVersionUnsupported;
+
+      // Inappropriate fallback
+      case SSL_R_INAPPROPRIATE_FALLBACK:
+        return TlsTelemetryHandshakeResult::kInappropriateFallback;
+
+      // No application protocol
+      case SSL_R_NO_APPLICATION_PROTOCOL:
+      case SSL_R_INVALID_ALPN_PROTOCOL:
+      case SSL_R_INVALID_ALPN_PROTOCOL_LIST:
+      case SSL_R_NEGOTIATED_BOTH_NPN_AND_ALPN:
+      case SSL_R_ALPN_MISMATCH_ON_EARLY_DATA:
+        return TlsTelemetryHandshakeResult::kNoApplicationProtocol;
+
+      // Cryptographic failures: Signature verification failed
+      case SSL_R_BAD_SIGNATURE:
+      case SSL_R_WRONG_SIGNATURE_TYPE:
+        return TlsTelemetryHandshakeResult::kSignatureVerificationFailed;
+
+      // Cryptographic failures: Decryption failed
+      case SSL_R_DECRYPTION_FAILED:
+      case SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC:
+      case SSL_R_BLOCK_CIPHER_PAD_IS_WRONG:
+        return TlsTelemetryHandshakeResult::kDecryptionFailed;
+
+      // Cryptographic failures: Key exchange failure
+      case SSL_R_WRONG_CURVE:
+      case SSL_R_BAD_ECPOINT:
+        return TlsTelemetryHandshakeResult::kKeyExchangeFailure;
+
+      // Unexpected message
+      case SSL_R_UNEXPECTED_MESSAGE:
+      case SSL_R_UNEXPECTED_RECORD:
+      case SSL_R_APP_DATA_IN_HANDSHAKE:
+      case SSL_R_EXCESS_HANDSHAKE_DATA:
+        return TlsTelemetryHandshakeResult::kUnexpectedMessage;
+
+      // Handshake timeout
+      case SSL_R_READ_TIMEOUT_EXPIRED:
+        return TlsTelemetryHandshakeResult::kHandshakeTimeout;
+
+      // Certificate verification failures
+      case SSL_R_CERTIFICATE_VERIFY_FAILED: {
+        TlsTelemetryHandshakeResult result =
+            MapVerifyResultToTlsTelemetryHandshakeResult(verify_result);
+        if (result == TlsTelemetryHandshakeResult::kSuccess) {
+          // There's no more detail on certificate failure, this is as granular
+          // as we can get.
+          return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+        }
+        return result;
+      }
+
+      // Certificate malformed
+      case SSL_R_DECODE_ERROR:
+        return TlsTelemetryHandshakeResult::kCertificateMalformed;
+
+      // Peer Certificate required but missing
+      case SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE:
+      case SSL_R_NO_CERTIFICATES_RETURNED:
+      case SSL_R_NO_CERTIFICATE_SET:
+      case SSL_R_NO_CERTIFICATE_ASSIGNED:
+      case SSL_R_SSLV3_ALERT_NO_CERTIFICATE:
+      case SSL_R_TLSV1_ALERT_CERTIFICATE_REQUIRED:
+        return TlsTelemetryHandshakeResult::kPeerCertificateRequiredButMissing;
+
+      // Internal / Resource failures
+      case ERR_R_MALLOC_FAILURE:
+      case ERR_R_INTERNAL_ERROR:
+      case ERR_R_OVERFLOW:
+        return TlsTelemetryHandshakeResult::kInternalSystemError;
+
+      default:
+        break;
+    }
+  }
+
+  return TlsTelemetryHandshakeResult::kUnknownFailure;
+}
+
+#else  // !defined(OPENSSL_IS_BORINGSSL)
+
+namespace {
+
+TlsTelemetryHandshakeResult MapVerifyResultToTlsTelemetryHandshakeResult(
+    long verify_result) {
+  if (verify_result == X509_V_OK) return TlsTelemetryHandshakeResult::kSuccess;
+  switch (verify_result) {
+    case X509_V_ERR_CERT_REVOKED:
+      return TlsTelemetryHandshakeResult::kCertificateRevoked;
+    case X509_V_ERR_CERT_HAS_EXPIRED:
+      return TlsTelemetryHandshakeResult::kCertificateExpired;
+    case X509_V_ERR_CERT_NOT_YET_VALID:
+      return TlsTelemetryHandshakeResult::kCertificateNotYetValid;
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
+    case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+    case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+    case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
+      return TlsTelemetryHandshakeResult::kCertificateAuthorityInvalid;
+    case X509_V_ERR_HOSTNAME_MISMATCH:
+      return TlsTelemetryHandshakeResult::kCertificateHostnameMismatch;
+    case X509_V_ERR_CERT_REJECTED:
+      return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+    case X509_V_ERR_UNABLE_TO_GET_CRL:
+      return TlsTelemetryHandshakeResult::kCrlNotFound;
+    case X509_V_ERR_CRL_HAS_EXPIRED:
+    case X509_V_ERR_CRL_NOT_YET_VALID:
+      return TlsTelemetryHandshakeResult::kCrlExpired;
+    case X509_V_ERR_CRL_SIGNATURE_FAILURE:
+      return TlsTelemetryHandshakeResult::kCrlSignatureFailure;
+    case X509_V_ERR_INVALID_CA:
+    case X509_V_ERR_INVALID_NON_CA:
+    case X509_V_ERR_INVALID_PURPOSE:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
+      return TlsTelemetryHandshakeResult::kCertificateMalformed;
+    case X509_V_ERR_CERT_SIGNATURE_FAILURE:
+      return TlsTelemetryHandshakeResult::kSignatureVerificationFailed;
+    default:
+      return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+  }
+}
+
+}  // namespace
+
+TlsTelemetryHandshakeResult MapSslErrorToTlsTelemetryHandshakeResult(
+    int ssl_error, unsigned long err_code, long verify_result) {
+  if (ssl_error == SSL_ERROR_NONE) {
+    return MapVerifyResultToTlsTelemetryHandshakeResult(verify_result);
+  }
+
+  if (ssl_error == SSL_ERROR_ZERO_RETURN) {
+    return TlsTelemetryHandshakeResult::kPeerConnectionClosed;
+  }
+
+  if (ssl_error == SSL_ERROR_SYSCALL) {
+    return TlsTelemetryHandshakeResult::kPeerConnectionClosed;
+  }
+
+  if (ssl_error == SSL_ERROR_SSL) {
+    int reason = ERR_GET_REASON(err_code);
+    switch (reason) {
+      // Cipher suite mismatch failures
+      case SSL_R_NO_CIPHERS_AVAILABLE:
+      case SSL_R_NO_CIPHER_MATCH:
+      case SSL_R_NO_SHARED_CIPHER:
+      case SSL_R_REQUIRED_CIPHER_MISSING:
+      case SSL_R_WRONG_CIPHER_RETURNED:
+        return TlsTelemetryHandshakeResult::kCipherSuiteMismatch;
+
+      // Protocol version unsupported failures
+      case SSL_R_UNKNOWN_PROTOCOL:
+      case SSL_R_UNKNOWN_SSL_VERSION:
+      case SSL_R_UNSUPPORTED_PROTOCOL:
+      case SSL_R_WRONG_SSL_VERSION:
+      case SSL_R_WRONG_VERSION_NUMBER:
+        return TlsTelemetryHandshakeResult::kProtocolVersionUnsupported;
+
+      // Inappropriate fallback
+      case SSL_R_INAPPROPRIATE_FALLBACK:
+        return TlsTelemetryHandshakeResult::kInappropriateFallback;
+
+        // No application protocol
+#ifdef SSL_R_NO_APPLICATION_PROTOCOL
+      case SSL_R_NO_APPLICATION_PROTOCOL:
+        return TlsTelemetryHandshakeResult::kNoApplicationProtocol;
+#endif
+
+      // Cryptographic failures: Signature verification failed
+      case SSL_R_BAD_SIGNATURE:
+      case SSL_R_WRONG_SIGNATURE_TYPE:
+        return TlsTelemetryHandshakeResult::kSignatureVerificationFailed;
+
+      // Cryptographic failures: Decryption failed
+      case SSL_R_DECRYPTION_FAILED:
+      case SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC:
+      case SSL_R_BLOCK_CIPHER_PAD_IS_WRONG:
+        return TlsTelemetryHandshakeResult::kDecryptionFailed;
+
+      // Cryptographic failures: Key exchange failure
+      case SSL_R_WRONG_CURVE:
+      case SSL_R_BAD_ECPOINT:
+        return TlsTelemetryHandshakeResult::kKeyExchangeFailure;
+
+      // Unexpected message
+      case SSL_R_UNEXPECTED_MESSAGE:
+      case SSL_R_UNEXPECTED_RECORD:
+      case SSL_R_APP_DATA_IN_HANDSHAKE:
+        return TlsTelemetryHandshakeResult::kUnexpectedMessage;
+
+      // Handshake timeout
+      case SSL_R_READ_TIMEOUT_EXPIRED:
+        return TlsTelemetryHandshakeResult::kHandshakeTimeout;
+
+      // Certificate verification failures
+      case SSL_R_CERTIFICATE_VERIFY_FAILED: {
+        TlsTelemetryHandshakeResult result =
+            MapVerifyResultToTlsTelemetryHandshakeResult(verify_result);
+        if (result == TlsTelemetryHandshakeResult::kSuccess) {
+          // There's no more detail on certificate failure, this is as granular
+          // as we can get.
+          return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+        }
+        return result;
+      }
+
+      // Peer Certificate required but missing
+      case SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE:
+      case SSL_R_NO_CERTIFICATES_RETURNED:
+      case SSL_R_NO_CERTIFICATE_SET:
+      case SSL_R_NO_CERTIFICATE_ASSIGNED:
+      case SSL_R_SSLV3_ALERT_NO_CERTIFICATE:
+        return TlsTelemetryHandshakeResult::kPeerCertificateRequiredButMissing;
+
+      // Internal / Resource failures
+      case ERR_R_MALLOC_FAILURE:
+      case ERR_R_INTERNAL_ERROR:
+        return TlsTelemetryHandshakeResult::kInternalSystemError;
+
+      default:
+        break;
+    }
+  }
+
+  return TlsTelemetryHandshakeResult::kUnknownFailure;
+}
+
+#endif  // OPENSSL_IS_BORINGSSL
+
+}  // namespace grpc_core

data/src/core/tsi/ssl_telemetry_utils.h

@@ -0,0 +1,74 @@
+//
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_SRC_CORE_TSI_SSL_TELEMETRY_UTILS_H
+#define GRPC_SRC_CORE_TSI_SSL_TELEMETRY_UTILS_H
+
+#include <grpc/support/port_platform.h>
+
+namespace grpc_core {
+
+enum class TlsTelemetryHandshakeResult {
+  kUnknownFailure,
+  kSuccess,
+  // Peer certificate verification failures.
+  kCertificateVerificationFailed,
+  kCertificateRevoked,
+  kCertificateExpired,
+  kCertificateNotYetValid,
+  kCertificateAuthorityInvalid,
+  kPeerCertificateRequiredButMissing,
+  kCrlNotFound,
+  kCrlExpired,
+  kCrlSignatureFailure,
+  // TLS negotiation mismatch failures
+  kCertificateHostnameMismatch,
+  kCertificateMalformed,
+  kCipherSuiteMismatch,
+  kProtocolVersionUnsupported,
+  kInappropriateFallback,
+  kNoApplicationProtocol,
+  // Cryptograpic failures
+  kSignatureVerificationFailed,
+  kDecryptionFailed,
+  kKeyExchangeFailure,
+  kPrivateKeySigningFailed,
+  // Other failures
+  kUnexpectedMessage,
+  kHandshakeTimeout,
+  kPeerConnectionClosed,
+  kInternalSystemError
+};
+
+// Maps different kinds of handshake/SSL/TLS errors to a unified
+// TlsTelemetryHandshakeResult.
+//
+// - ssl_error: the return code from SSL_get_error().
+// - err_code: the packed error code from the OpenSSL error queue
+// (ERR_get_error()).
+// - verify_result: the certificate verification result from
+// SSL_get_verify_result().
+//
+// - Returns the corresponding TlsTelemetryHandshakeResult mapping for the
+// failures.
+TlsTelemetryHandshakeResult MapSslErrorToTlsTelemetryHandshakeResult(
+    int ssl_error, unsigned long err_code, long verify_result);
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_TSI_SSL_TELEMETRY_UTILS_H