grpc 1.82.0 → 1.83.0.pre1

data/src/core/server/xds_server_config_fetcher_legacy.cc

@@ -399,8 +399,7 @@ class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
   }
 
   absl::StatusOr<RefCountedPtr<ServerConfigSelector>> Watch(
-      std::unique_ptr<ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
-          watcher) override {
+      std::shared_ptr<ServerConfigSelectorWatcher> watcher) override {
     GRPC_CHECK(watcher_ == nullptr);
     watcher_ = std::move(watcher);
     if (!static_resource_.ok()) {
@@ -412,7 +411,11 @@ class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
         static_resource_.value(), http_filters_);
   }
 
-  void CancelWatch() override { watcher_.reset(); }
+  void CancelWatch(
+      std::shared_ptr<ServerConfigSelectorWatcher> watcher) override {
+    GRPC_CHECK(watcher == watcher_);
+    watcher_.reset();
+  }
 
  private:
   void Orphaned() override {}
@@ -425,7 +428,7 @@ class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
   // copying the HTTP filters here.
   std::vector<XdsListenerResource::HttpConnectionManager::HttpFilter>
       http_filters_;
-  std::unique_ptr<ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
+  std::shared_ptr<ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
       watcher_;
 };
 
@@ -447,9 +450,9 @@ class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
   }
 
   absl::StatusOr<RefCountedPtr<ServerConfigSelector>> Watch(
-      std::unique_ptr<ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
-          watcher) override;
-  void CancelWatch() override;
+      std::shared_ptr<ServerConfigSelectorWatcher> watcher) override;
+  void CancelWatch(
+      std::shared_ptr<ServerConfigSelectorWatcher> watcher) override;
 
  private:
   class RouteConfigWatcher;
@@ -468,7 +471,7 @@ class XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
       http_filters_;
   RouteConfigWatcher* route_config_watcher_ = nullptr;
   Mutex mu_;
-  std::unique_ptr<ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
+  std::shared_ptr<ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
       watcher_ ABSL_GUARDED_BY(mu_);
   absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>> resource_
       ABSL_GUARDED_BY(mu_);
@@ -1238,9 +1241,7 @@ void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
 absl::StatusOr<RefCountedPtr<ServerConfigSelector>>
 XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
     DynamicXdsServerConfigSelectorProvider::Watch(
-        std::unique_ptr<
-            ServerConfigSelectorProvider::ServerConfigSelectorWatcher>
-            watcher) {
+        std::shared_ptr<ServerConfigSelectorWatcher> watcher) {
   absl::StatusOr<std::shared_ptr<const XdsRouteConfigResource>> resource;
   {
     MutexLock lock(&mu_);
@@ -1258,8 +1259,10 @@ XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
 }
 
 void XdsServerConfigFetcher::ListenerWatcher::FilterChainMatchManager::
-    DynamicXdsServerConfigSelectorProvider::CancelWatch() {
+    DynamicXdsServerConfigSelectorProvider::CancelWatch(
+        std::shared_ptr<ServerConfigSelectorWatcher> watcher) {
   MutexLock lock(&mu_);
+  GRPC_CHECK(watcher == watcher_);
   watcher_.reset();
 }
 

data/src/core/telemetry/call_tracer.cc

@@ -18,6 +18,9 @@
 
 #include "src/core/telemetry/call_tracer.h"
 
+#include <grpc/event_engine/internal/write_event.h>
+
+#include <cstddef>
 #include <memory>
 #include <string>
 #include <utility>
@@ -37,6 +40,7 @@
 #include "absl/functional/function_ref.h"
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
+#include "absl/time/time.h"
 #include "absl/types/span.h"
 
 namespace grpc_core {
@@ -91,6 +95,31 @@ ServerCallTracerFactory* g_server_call_tracer_factory_ = nullptr;
 const char* kServerCallTracerFactoryChannelArgName =
     "grpc.experimental.server_call_tracer_factory";
 
+class DelegatingTcpCallTracer final : public TcpCallTracer {
+ public:
+  explicit DelegatingTcpCallTracer(
+      std::vector<std::shared_ptr<TcpCallTracer>> tracers)
+      : tracers_(std::move(tracers)) {}
+
+  void RecordConnectionTuple(const IpAddress& local_addr,
+                             const IpAddress& peer_addr) override {
+    for (const auto& tracer : tracers_) {
+      tracer->RecordConnectionTuple(local_addr, peer_addr);
+    }
+  }
+
+  void RecordEvent(grpc_event_engine::experimental::internal::WriteEvent event,
+                   absl::Time time, size_t byte_offset,
+                   const std::vector<TcpEventMetric>& metrics) override {
+    for (const auto& tracer : tracers_) {
+      tracer->RecordEvent(event, time, byte_offset, metrics);
+    }
+  }
+
+ private:
+  const std::vector<std::shared_ptr<TcpCallTracer>> tracers_;
+};
+
 }  // namespace
 
 ServerCallTracerFactory* ServerCallTracerFactory::Get(
@@ -223,7 +252,15 @@ class DelegatingClientCallTracer : public ClientCallTracerInterface {
       }
     }
     std::shared_ptr<TcpCallTracer> StartNewTcpTrace() override {
-      return nullptr;
+      std::vector<std::shared_ptr<TcpCallTracer>> tcp_tracers;
+      for (auto* tracer : tracers_) {
+        if (auto tcp_tracer = tracer->StartNewTcpTrace()) {
+          tcp_tracers.push_back(std::move(tcp_tracer));
+        }
+      }
+      if (tcp_tracers.empty()) return nullptr;
+      if (tcp_tracers.size() == 1) return tcp_tracers[0];
+      return std::make_shared<DelegatingTcpCallTracer>(std::move(tcp_tracers));
     }
     void SetOptionalLabel(OptionalLabelKey key,
                           RefCountedStringValue value) override {
@@ -386,7 +423,17 @@ class DelegatingServerCallTracer : public ServerCallTracerInterface {
       tracer->RecordAnnotation(annotation);
     }
   }
-  std::shared_ptr<TcpCallTracer> StartNewTcpTrace() override { return nullptr; }
+  std::shared_ptr<TcpCallTracer> StartNewTcpTrace() override {
+    std::vector<std::shared_ptr<TcpCallTracer>> tcp_tracers;
+    for (auto* tracer : tracers_) {
+      if (auto tcp_tracer = tracer->StartNewTcpTrace()) {
+        tcp_tracers.push_back(std::move(tcp_tracer));
+      }
+    }
+    if (tcp_tracers.empty()) return nullptr;
+    if (tcp_tracers.size() == 1) return tcp_tracers[0];
+    return std::make_shared<DelegatingTcpCallTracer>(std::move(tcp_tracers));
+  }
   std::string TraceId() override { return tracers_[0]->TraceId(); }
   std::string SpanId() override { return tracers_[0]->SpanId(); }
   bool IsSampled() override { return tracers_[0]->IsSampled(); }

data/src/core/telemetry/call_tracer.h

@@ -206,6 +206,7 @@ class ClientCallTracerInterface : public CallTracerAnnotationInterface {
       kXdsServiceNamespace,  // not public
       kLocality,
       kBackendService,
+      kTelemetryLabel,
       kSize  // should be last
     };
 

data/src/core/telemetry/tcp_tracer.h

@@ -19,10 +19,12 @@
 #ifndef GRPC_SRC_CORE_TELEMETRY_TCP_TRACER_H
 #define GRPC_SRC_CORE_TELEMETRY_TCP_TRACER_H
 
+#include <grpc/event_engine/event_engine.h>
 #include <grpc/event_engine/internal/write_event.h>
 #include <grpc/support/port_platform.h>
 #include <stddef.h>
 #include <stdint.h>
+#include <string.h>
 
 #include <optional>
 #include <string>
@@ -126,6 +128,42 @@ class TcpCallTracer {
 
   virtual ~TcpCallTracer() = default;
 
+  struct IpAddress {
+    uint16_t family = 0;
+    uint16_t port = 0;
+    uint8_t ip[16] = {0};
+  };
+
+  virtual void RecordConnectionTuple(const IpAddress& local_addr,
+                                     const IpAddress& peer_addr) {}
+
+  static IpAddress ExtractResolvedAddress(
+      const grpc_event_engine::experimental::EventEngine::ResolvedAddress&
+          addr) {
+    IpAddress out;
+    const sockaddr* sa = addr.address();
+    if (sa == nullptr) {
+      out.family = 0;
+      out.port = 0;
+      memset(out.ip, 0, sizeof(out.ip));
+      return out;
+    }
+    out.family = sa->sa_family;
+    memset(out.ip, 0, sizeof(out.ip));
+    if (sa->sa_family == AF_INET) {
+      const sockaddr_in* addr4 = reinterpret_cast<const sockaddr_in*>(sa);
+      out.port = ntohs(addr4->sin_port);
+      memcpy(out.ip, &addr4->sin_addr.s_addr, 4);
+    } else if (sa->sa_family == AF_INET6) {
+      const sockaddr_in6* addr6 = reinterpret_cast<const sockaddr_in6*>(sa);
+      out.port = ntohs(addr6->sin6_port);
+      memcpy(out.ip, &addr6->sin6_addr.s6_addr, 16);
+    } else {
+      out.port = 0;
+    }
+    return out;
+  }
+
   // Records a per-message event with an optional snapshot of connection
   // metrics.
   virtual void RecordEvent(

data/src/core/tsi/alts/handshaker/alts_handshaker_client.cc

@@ -809,7 +809,7 @@ alts_handshaker_client* alts_grpc_handshaker_client_create(
                 /*cq=*/nullptr, interested_parties,
                 grpc_core::Slice::FromStaticString(ALTS_SERVICE_METHOD),
                 /*authority=*/std::nullopt, grpc_core::Timestamp::InfFuture(),
-                /*registered_method=*/true);
+                /*registered_method=*/true, std::nullopt);
   GRPC_CLOSURE_INIT(&client->on_handshaker_service_resp_recv, grpc_cb, client,
                     grpc_schedule_on_exec_ctx);
   GRPC_CLOSURE_INIT(&client->on_status_received, on_status_received, client,

data/src/core/tsi/ssl_telemetry_utils.cc

@@ -0,0 +1,343 @@
+//
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include "src/core/tsi/ssl_telemetry_utils.h"
+
+#include <grpc/support/port_platform.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+#include <openssl/x509.h>
+
+namespace grpc_core {
+
+#if defined(OPENSSL_IS_BORINGSSL)
+
+namespace {
+
+TlsTelemetryHandshakeResult MapVerifyResultToTlsTelemetryHandshakeResult(
+    long verify_result) {
+  if (verify_result == X509_V_OK) return TlsTelemetryHandshakeResult::kSuccess;
+  switch (verify_result) {
+    case X509_V_ERR_CERT_REVOKED:
+      return TlsTelemetryHandshakeResult::kCertificateRevoked;
+    case X509_V_ERR_CERT_HAS_EXPIRED:
+      return TlsTelemetryHandshakeResult::kCertificateExpired;
+    case X509_V_ERR_CERT_NOT_YET_VALID:
+      return TlsTelemetryHandshakeResult::kCertificateNotYetValid;
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
+    case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+    case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+    case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
+      return TlsTelemetryHandshakeResult::kCertificateAuthorityInvalid;
+    case X509_V_ERR_HOSTNAME_MISMATCH:
+      return TlsTelemetryHandshakeResult::kCertificateHostnameMismatch;
+    case X509_V_ERR_CERT_REJECTED:
+      return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+    case X509_V_ERR_UNABLE_TO_GET_CRL:
+      return TlsTelemetryHandshakeResult::kCrlNotFound;
+    case X509_V_ERR_CRL_HAS_EXPIRED:
+    case X509_V_ERR_CRL_NOT_YET_VALID:
+      return TlsTelemetryHandshakeResult::kCrlExpired;
+    case X509_V_ERR_CRL_SIGNATURE_FAILURE:
+      return TlsTelemetryHandshakeResult::kCrlSignatureFailure;
+    case X509_V_ERR_INVALID_CA:
+    case X509_V_ERR_INVALID_NON_CA:
+    case X509_V_ERR_INVALID_PURPOSE:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
+      return TlsTelemetryHandshakeResult::kCertificateMalformed;
+    case X509_V_ERR_CERT_SIGNATURE_FAILURE:
+      return TlsTelemetryHandshakeResult::kSignatureVerificationFailed;
+    default:
+      return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+  }
+}
+
+}  // namespace
+
+TlsTelemetryHandshakeResult MapSslErrorToTlsTelemetryHandshakeResult(
+    int ssl_error, unsigned long err_code, long verify_result) {
+  if (ssl_error == SSL_ERROR_NONE) {
+    return MapVerifyResultToTlsTelemetryHandshakeResult(verify_result);
+  }
+
+  if (ssl_error == SSL_ERROR_ZERO_RETURN) {
+    return TlsTelemetryHandshakeResult::kPeerConnectionClosed;
+  }
+
+  if (ssl_error == SSL_ERROR_SYSCALL) {
+    return TlsTelemetryHandshakeResult::kPeerConnectionClosed;
+  }
+
+  if (ssl_error == SSL_ERROR_SSL) {
+    int reason = ERR_GET_REASON(err_code);
+    switch (reason) {
+      // Cipher suite mismatch failures
+      case SSL_R_NO_CIPHERS_AVAILABLE:
+      case SSL_R_NO_CIPHERS_PASSED:
+      case SSL_R_NO_CIPHER_MATCH:
+      case SSL_R_NO_SHARED_CIPHER:
+      case SSL_R_REQUIRED_CIPHER_MISSING:
+      case SSL_R_UNSUPPORTED_CIPHER:
+      case SSL_R_WRONG_CIPHER_RETURNED:
+      case SSL_R_CIPHER_MISMATCH_ON_EARLY_DATA:
+      case SSL_R_CIPHER_OR_HASH_UNAVAILABLE:
+        return TlsTelemetryHandshakeResult::kCipherSuiteMismatch;
+
+      // Protocol version unsupported failures
+      case SSL_R_UNKNOWN_PROTOCOL:
+      case SSL_R_UNKNOWN_SSL_VERSION:
+      case SSL_R_UNSUPPORTED_PROTOCOL:
+      case SSL_R_WRONG_SSL_VERSION:
+      case SSL_R_WRONG_VERSION_NUMBER:
+      case SSL_R_UNSUPPORTED_PROTOCOL_FOR_CUSTOM_KEY:
+      case SSL_R_WRONG_VERSION_ON_EARLY_DATA:
+      case SSL_R_NO_SUPPORTED_VERSIONS_ENABLED:
+      case SSL_R_SECOND_SERVERHELLO_VERSION_MISMATCH:
+        return TlsTelemetryHandshakeResult::kProtocolVersionUnsupported;
+
+      // Inappropriate fallback
+      case SSL_R_INAPPROPRIATE_FALLBACK:
+        return TlsTelemetryHandshakeResult::kInappropriateFallback;
+
+      // No application protocol
+      case SSL_R_NO_APPLICATION_PROTOCOL:
+      case SSL_R_INVALID_ALPN_PROTOCOL:
+      case SSL_R_INVALID_ALPN_PROTOCOL_LIST:
+      case SSL_R_NEGOTIATED_BOTH_NPN_AND_ALPN:
+      case SSL_R_ALPN_MISMATCH_ON_EARLY_DATA:
+        return TlsTelemetryHandshakeResult::kNoApplicationProtocol;
+
+      // Cryptographic failures: Signature verification failed
+      case SSL_R_BAD_SIGNATURE:
+      case SSL_R_WRONG_SIGNATURE_TYPE:
+        return TlsTelemetryHandshakeResult::kSignatureVerificationFailed;
+
+      // Cryptographic failures: Decryption failed
+      case SSL_R_DECRYPTION_FAILED:
+      case SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC:
+      case SSL_R_BLOCK_CIPHER_PAD_IS_WRONG:
+        return TlsTelemetryHandshakeResult::kDecryptionFailed;
+
+      // Cryptographic failures: Key exchange failure
+      case SSL_R_WRONG_CURVE:
+      case SSL_R_BAD_ECPOINT:
+        return TlsTelemetryHandshakeResult::kKeyExchangeFailure;
+
+      // Unexpected message
+      case SSL_R_UNEXPECTED_MESSAGE:
+      case SSL_R_UNEXPECTED_RECORD:
+      case SSL_R_APP_DATA_IN_HANDSHAKE:
+      case SSL_R_EXCESS_HANDSHAKE_DATA:
+        return TlsTelemetryHandshakeResult::kUnexpectedMessage;
+
+      // Handshake timeout
+      case SSL_R_READ_TIMEOUT_EXPIRED:
+        return TlsTelemetryHandshakeResult::kHandshakeTimeout;
+
+      // Certificate verification failures
+      case SSL_R_CERTIFICATE_VERIFY_FAILED: {
+        TlsTelemetryHandshakeResult result =
+            MapVerifyResultToTlsTelemetryHandshakeResult(verify_result);
+        if (result == TlsTelemetryHandshakeResult::kSuccess) {
+          // There's no more detail on certificate failure, this is as granular
+          // as we can get.
+          return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+        }
+        return result;
+      }
+
+      // Certificate malformed
+      case SSL_R_DECODE_ERROR:
+        return TlsTelemetryHandshakeResult::kCertificateMalformed;
+
+      // Peer Certificate required but missing
+      case SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE:
+      case SSL_R_NO_CERTIFICATES_RETURNED:
+      case SSL_R_NO_CERTIFICATE_SET:
+      case SSL_R_NO_CERTIFICATE_ASSIGNED:
+      case SSL_R_SSLV3_ALERT_NO_CERTIFICATE:
+      case SSL_R_TLSV1_ALERT_CERTIFICATE_REQUIRED:
+        return TlsTelemetryHandshakeResult::kPeerCertificateRequiredButMissing;
+
+      // Internal / Resource failures
+      case ERR_R_MALLOC_FAILURE:
+      case ERR_R_INTERNAL_ERROR:
+      case ERR_R_OVERFLOW:
+        return TlsTelemetryHandshakeResult::kInternalSystemError;
+
+      default:
+        break;
+    }
+  }
+
+  return TlsTelemetryHandshakeResult::kUnknownFailure;
+}
+
+#else  // !defined(OPENSSL_IS_BORINGSSL)
+
+namespace {
+
+TlsTelemetryHandshakeResult MapVerifyResultToTlsTelemetryHandshakeResult(
+    long verify_result) {
+  if (verify_result == X509_V_OK) return TlsTelemetryHandshakeResult::kSuccess;
+  switch (verify_result) {
+    case X509_V_ERR_CERT_REVOKED:
+      return TlsTelemetryHandshakeResult::kCertificateRevoked;
+    case X509_V_ERR_CERT_HAS_EXPIRED:
+      return TlsTelemetryHandshakeResult::kCertificateExpired;
+    case X509_V_ERR_CERT_NOT_YET_VALID:
+      return TlsTelemetryHandshakeResult::kCertificateNotYetValid;
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
+    case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+    case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+    case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
+      return TlsTelemetryHandshakeResult::kCertificateAuthorityInvalid;
+    case X509_V_ERR_HOSTNAME_MISMATCH:
+      return TlsTelemetryHandshakeResult::kCertificateHostnameMismatch;
+    case X509_V_ERR_CERT_REJECTED:
+      return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+    case X509_V_ERR_UNABLE_TO_GET_CRL:
+      return TlsTelemetryHandshakeResult::kCrlNotFound;
+    case X509_V_ERR_CRL_HAS_EXPIRED:
+    case X509_V_ERR_CRL_NOT_YET_VALID:
+      return TlsTelemetryHandshakeResult::kCrlExpired;
+    case X509_V_ERR_CRL_SIGNATURE_FAILURE:
+      return TlsTelemetryHandshakeResult::kCrlSignatureFailure;
+    case X509_V_ERR_INVALID_CA:
+    case X509_V_ERR_INVALID_NON_CA:
+    case X509_V_ERR_INVALID_PURPOSE:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
+      return TlsTelemetryHandshakeResult::kCertificateMalformed;
+    case X509_V_ERR_CERT_SIGNATURE_FAILURE:
+      return TlsTelemetryHandshakeResult::kSignatureVerificationFailed;
+    default:
+      return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+  }
+}
+
+}  // namespace
+
+TlsTelemetryHandshakeResult MapSslErrorToTlsTelemetryHandshakeResult(
+    int ssl_error, unsigned long err_code, long verify_result) {
+  if (ssl_error == SSL_ERROR_NONE) {
+    return MapVerifyResultToTlsTelemetryHandshakeResult(verify_result);
+  }
+
+  if (ssl_error == SSL_ERROR_ZERO_RETURN) {
+    return TlsTelemetryHandshakeResult::kPeerConnectionClosed;
+  }
+
+  if (ssl_error == SSL_ERROR_SYSCALL) {
+    return TlsTelemetryHandshakeResult::kPeerConnectionClosed;
+  }
+
+  if (ssl_error == SSL_ERROR_SSL) {
+    int reason = ERR_GET_REASON(err_code);
+    switch (reason) {
+      // Cipher suite mismatch failures
+      case SSL_R_NO_CIPHERS_AVAILABLE:
+      case SSL_R_NO_CIPHER_MATCH:
+      case SSL_R_NO_SHARED_CIPHER:
+      case SSL_R_REQUIRED_CIPHER_MISSING:
+      case SSL_R_WRONG_CIPHER_RETURNED:
+        return TlsTelemetryHandshakeResult::kCipherSuiteMismatch;
+
+      // Protocol version unsupported failures
+      case SSL_R_UNKNOWN_PROTOCOL:
+      case SSL_R_UNKNOWN_SSL_VERSION:
+      case SSL_R_UNSUPPORTED_PROTOCOL:
+      case SSL_R_WRONG_SSL_VERSION:
+      case SSL_R_WRONG_VERSION_NUMBER:
+        return TlsTelemetryHandshakeResult::kProtocolVersionUnsupported;
+
+      // Inappropriate fallback
+      case SSL_R_INAPPROPRIATE_FALLBACK:
+        return TlsTelemetryHandshakeResult::kInappropriateFallback;
+
+        // No application protocol
+#ifdef SSL_R_NO_APPLICATION_PROTOCOL
+      case SSL_R_NO_APPLICATION_PROTOCOL:
+        return TlsTelemetryHandshakeResult::kNoApplicationProtocol;
+#endif
+
+      // Cryptographic failures: Signature verification failed
+      case SSL_R_BAD_SIGNATURE:
+      case SSL_R_WRONG_SIGNATURE_TYPE:
+        return TlsTelemetryHandshakeResult::kSignatureVerificationFailed;
+
+      // Cryptographic failures: Decryption failed
+      case SSL_R_DECRYPTION_FAILED:
+      case SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC:
+      case SSL_R_BLOCK_CIPHER_PAD_IS_WRONG:
+        return TlsTelemetryHandshakeResult::kDecryptionFailed;
+
+      // Cryptographic failures: Key exchange failure
+      case SSL_R_WRONG_CURVE:
+      case SSL_R_BAD_ECPOINT:
+        return TlsTelemetryHandshakeResult::kKeyExchangeFailure;
+
+      // Unexpected message
+      case SSL_R_UNEXPECTED_MESSAGE:
+      case SSL_R_UNEXPECTED_RECORD:
+      case SSL_R_APP_DATA_IN_HANDSHAKE:
+        return TlsTelemetryHandshakeResult::kUnexpectedMessage;
+
+      // Handshake timeout
+      case SSL_R_READ_TIMEOUT_EXPIRED:
+        return TlsTelemetryHandshakeResult::kHandshakeTimeout;
+
+      // Certificate verification failures
+      case SSL_R_CERTIFICATE_VERIFY_FAILED: {
+        TlsTelemetryHandshakeResult result =
+            MapVerifyResultToTlsTelemetryHandshakeResult(verify_result);
+        if (result == TlsTelemetryHandshakeResult::kSuccess) {
+          // There's no more detail on certificate failure, this is as granular
+          // as we can get.
+          return TlsTelemetryHandshakeResult::kCertificateVerificationFailed;
+        }
+        return result;
+      }
+
+      // Peer Certificate required but missing
+      case SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE:
+      case SSL_R_NO_CERTIFICATES_RETURNED:
+      case SSL_R_NO_CERTIFICATE_SET:
+      case SSL_R_NO_CERTIFICATE_ASSIGNED:
+      case SSL_R_SSLV3_ALERT_NO_CERTIFICATE:
+        return TlsTelemetryHandshakeResult::kPeerCertificateRequiredButMissing;
+
+      // Internal / Resource failures
+      case ERR_R_MALLOC_FAILURE:
+      case ERR_R_INTERNAL_ERROR:
+        return TlsTelemetryHandshakeResult::kInternalSystemError;
+
+      default:
+        break;
+    }
+  }
+
+  return TlsTelemetryHandshakeResult::kUnknownFailure;
+}
+
+#endif  // OPENSSL_IS_BORINGSSL
+
+}  // namespace grpc_core

data/src/core/tsi/ssl_telemetry_utils.h

@@ -0,0 +1,74 @@
+//
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_SRC_CORE_TSI_SSL_TELEMETRY_UTILS_H
+#define GRPC_SRC_CORE_TSI_SSL_TELEMETRY_UTILS_H
+
+#include <grpc/support/port_platform.h>
+
+namespace grpc_core {
+
+enum class TlsTelemetryHandshakeResult {
+  kUnknownFailure,
+  kSuccess,
+  // Peer certificate verification failures.
+  kCertificateVerificationFailed,
+  kCertificateRevoked,
+  kCertificateExpired,
+  kCertificateNotYetValid,
+  kCertificateAuthorityInvalid,
+  kPeerCertificateRequiredButMissing,
+  kCrlNotFound,
+  kCrlExpired,
+  kCrlSignatureFailure,
+  // TLS negotiation mismatch failures
+  kCertificateHostnameMismatch,
+  kCertificateMalformed,
+  kCipherSuiteMismatch,
+  kProtocolVersionUnsupported,
+  kInappropriateFallback,
+  kNoApplicationProtocol,
+  // Cryptograpic failures
+  kSignatureVerificationFailed,
+  kDecryptionFailed,
+  kKeyExchangeFailure,
+  kPrivateKeySigningFailed,
+  // Other failures
+  kUnexpectedMessage,
+  kHandshakeTimeout,
+  kPeerConnectionClosed,
+  kInternalSystemError
+};
+
+// Maps different kinds of handshake/SSL/TLS errors to a unified
+// TlsTelemetryHandshakeResult.
+//
+// - ssl_error: the return code from SSL_get_error().
+// - err_code: the packed error code from the OpenSSL error queue
+// (ERR_get_error()).
+// - verify_result: the certificate verification result from
+// SSL_get_verify_result().
+//
+// - Returns the corresponding TlsTelemetryHandshakeResult mapping for the
+// failures.
+TlsTelemetryHandshakeResult MapSslErrorToTlsTelemetryHandshakeResult(
+    int ssl_error, unsigned long err_code, long verify_result);
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_TSI_SSL_TELEMETRY_UTILS_H