grpc 1.82.0 → 1.83.0.pre1

data/src/core/credentials/transport/tls/grpc_tls_certificate_selector.cc

@@ -0,0 +1,172 @@
+//
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
+
+#include <openssl/bio.h>
+#include <openssl/crypto.h>
+#include <openssl/pem.h>
+#if defined(OPENSSL_IS_BORINGSSL)
+#include <openssl/bytestring.h>
+#endif
+
+#include <cstdint>
+#include <memory>
+#include <vector>
+
+#include "src/core/util/grpc_check.h"
+#include "src/core/util/match.h"
+#include "src/core/util/status_helper.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
+#if defined(OPENSSL_IS_BORINGSSL)
+
+namespace grpc_core {
+namespace {
+
+// TODO(lwge): Consider moving these into a util library.
+absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>>
+ParseCertificateChainFromDer(const std::vector<std::string>& der_cert_chain) {
+  if (der_cert_chain.empty()) {
+    return absl::InvalidArgumentError("The cert chain is empty.");
+  }
+  std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> raw_cert_chain;
+  raw_cert_chain.reserve(der_cert_chain.size());
+  for (absl::string_view cert : der_cert_chain) {
+    bssl::UniquePtr<CRYPTO_BUFFER> raw_cert(CRYPTO_BUFFER_new(
+        reinterpret_cast<const uint8_t*>(cert.data()), cert.size(),
+        /*pool=*/nullptr));
+    if (raw_cert == nullptr) {
+      return absl::InvalidArgumentError("Failed to create raw cert.");
+    }
+    raw_cert_chain.push_back(std::move(raw_cert));
+  }
+  return std::move(raw_cert_chain);
+}
+
+absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>>
+ParseCertificateChainFromPem(absl::string_view pem_cert_chain) {
+  if (pem_cert_chain.empty()) {
+    return absl::InvalidArgumentError("The cert chain is empty.");
+  }
+  std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> raw_cert_chain;
+  bssl::UniquePtr<BIO> bio(
+      BIO_new_mem_buf(pem_cert_chain.data(), pem_cert_chain.size()));
+  uint8_t* cert_data = nullptr;
+  long cert_len;
+  while (PEM_bytes_read_bio(&cert_data, &cert_len, nullptr, PEM_STRING_X509,
+                            bio.get(), nullptr, nullptr)) {
+    raw_cert_chain.push_back(bssl::UniquePtr<CRYPTO_BUFFER>(
+        CRYPTO_BUFFER_new(reinterpret_cast<const uint8_t*>(cert_data), cert_len,
+                          /*pool=*/nullptr)));
+    OPENSSL_free(cert_data);
+  }
+  if (raw_cert_chain.empty()) {
+    return absl::InvalidArgumentError("Failed to parse cert chain.");
+  }
+  return std::move(raw_cert_chain);
+}
+
+absl::StatusOr<bssl::UniquePtr<EVP_PKEY>> ParsePrivateKeyFromDer(
+    absl::string_view der_private_key) {
+  CBS cbs;
+  CBS_init(&cbs, reinterpret_cast<const uint8_t*>(der_private_key.data()),
+           der_private_key.size());
+  bssl::UniquePtr<EVP_PKEY> pkey(EVP_parse_private_key(&cbs));
+  if (pkey == nullptr || CBS_len(&cbs) != 0) {
+    return absl::InvalidArgumentError("Failed to parse private key.");
+  }
+  return std::move(pkey);
+}
+
+absl::StatusOr<bssl::UniquePtr<EVP_PKEY>> ParsePrivateKeyFromPem(
+    absl::string_view pem_private_key) {
+  GRPC_CHECK_LE(pem_private_key.size(), static_cast<size_t>(INT_MAX));
+  bssl::UniquePtr<BIO> pem(BIO_new_mem_buf(
+      pem_private_key.data(), static_cast<int>(pem_private_key.size())));
+  if (pem == nullptr) {
+    return absl::InvalidArgumentError("Failed to create pem BIO.");
+  }
+  bssl::UniquePtr<EVP_PKEY> pkey(PEM_read_bio_PrivateKey(
+      pem.get(), nullptr, nullptr, const_cast<char*>("")));
+  if (pkey == nullptr) {
+    return absl::InvalidArgumentError("Failed to read private key.");
+  }
+  return std::move(pkey);
+}
+
+// The type of the given private key string must match the parser.
+absl::Status CreatePrivateKey(
+    std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+        private_key,
+    CertificateSelector::SelectCertificateResult& result,
+    absl::AnyInvocable<
+        absl::StatusOr<bssl::UniquePtr<EVP_PKEY>>(absl::string_view)>
+        parser) {
+  return MatchMutable(
+      &private_key,
+      [&](absl::string_view* key) {
+        absl::StatusOr<bssl::UniquePtr<EVP_PKEY>> pkey = parser(*key);
+        if (!pkey.ok()) {
+          return pkey.status();
+        }
+        result.private_key = *std::move(pkey);
+        return absl::OkStatus();
+      },
+      [&](std::shared_ptr<PrivateKeySigner>* key_signer) {
+        result.private_key = std::move(*key_signer);
+        return absl::OkStatus();
+      });
+}
+
+}  // namespace
+
+absl::StatusOr<CertificateSelector::SelectCertificateResult>
+CertificateSelector::CreateSelectCertificateResult(
+    const std::vector<std::string>& der_cert_chain,
+    std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+        der_private_key) {
+  absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>> raw_cert_chain =
+      ParseCertificateChainFromDer(der_cert_chain);
+  GRPC_RETURN_IF_ERROR(raw_cert_chain.status());
+  SelectCertificateResult result;
+  result.certificate_chain = *std::move(raw_cert_chain);
+  GRPC_RETURN_IF_ERROR(
+      CreatePrivateKey(der_private_key, result, ParsePrivateKeyFromDer));
+  return std::move(result);
+}
+
+absl::StatusOr<CertificateSelector::SelectCertificateResult>
+CertificateSelector::CreateSelectCertificateResult(
+    absl::string_view pem_cert_chain,
+    std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+        pem_private_key) {
+  absl::StatusOr<std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>> raw_cert_chain =
+      ParseCertificateChainFromPem(pem_cert_chain);
+  GRPC_RETURN_IF_ERROR(raw_cert_chain.status());
+  SelectCertificateResult result;
+  result.certificate_chain = *std::move(raw_cert_chain);
+  GRPC_RETURN_IF_ERROR(
+      CreatePrivateKey(pem_private_key, result, ParsePrivateKeyFromPem));
+  return std::move(result);
+}
+
+}  // namespace grpc_core
+
+#endif  // OPENSSL_IS_BORINGSSL

data/src/core/credentials/transport/tls/grpc_tls_certificate_selector.h

@@ -0,0 +1,103 @@
+//
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_GRPC_TLS_CERTIFICATE_SELECTOR_H
+#define GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_GRPC_TLS_CERTIFICATE_SELECTOR_H
+
+#include <grpc/private_key_signer.h>
+#include <openssl/bio.h>
+
+#include <memory>
+#include <string>
+#include <variant>
+#include <vector>
+
+#include "absl/functional/any_invocable.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
+namespace grpc_core {
+
+// Performs server-side certificate selection during the handshake based on the
+// SNI. Users must implement the `SelectCertificate` and `Cancel` methods.
+// The implementation must be thread-safe, as `SelectCertificate` may be called
+// for multiple TLS handshakes at the same time.
+class CertificateSelector {
+#if defined(OPENSSL_IS_BORINGSSL)
+ public:
+  struct SelectCertificateInfo {
+    std::string sni;
+  };
+
+  // TODO(lwge): This should be an opaque struct when moved to a public header.
+  struct SelectCertificateResult {
+    std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> certificate_chain;
+    std::variant<bssl::UniquePtr<EVP_PKEY>, std::shared_ptr<PrivateKeySigner>>
+        private_key;
+  };
+
+  // Returns a SelectCertificateResult given a DER-encoded certificate chain,
+  // and DER-encoded private key string or a signer.
+  static absl::StatusOr<SelectCertificateResult> CreateSelectCertificateResult(
+      const std::vector<std::string>& der_cert_chain,
+      std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+          der_private_key);
+
+  // Returns a SelectCertificateResult given a PEM-encoded certificate chain,
+  // and PEM-encoded private key string or a signer.
+  static absl::StatusOr<SelectCertificateResult> CreateSelectCertificateResult(
+      absl::string_view pem_cert_chain,
+      std::variant<absl::string_view, std::shared_ptr<PrivateKeySigner>>
+          pem_private_key);
+
+  // Handle to be passed to `Cancel`, to enable user to clean up any resources
+  // used during an asynchronous certificate selection operation that is
+  // cancelled.
+  class AsyncCertificateSelectionHandle {
+   public:
+    virtual ~AsyncCertificateSelectionHandle() = default;
+  };
+
+  using OnSelectCertificateComplete =
+      absl::AnyInvocable<void(absl::StatusOr<SelectCertificateResult>)>;
+
+  virtual ~CertificateSelector() = default;
+
+  // Performs the cert selection based on `SelectCertificateInfo`.
+  // Since the client is not required to provide the server name in the
+  // ClientHello, the implementation should make a decision by itself on what to
+  // return.
+  // May return either synchronously or asynchronously.
+  // For synchronous returns, directly returns either the selected certificate
+  // or a failed status, and the callback will never be invoked.
+  // For asynchronous implementations, returns a handle for the asynchronous
+  // signing operation. The function argument on_complete must be called by
+  // the implementer when the async certificate selection operation is complete.
+  // on_complete must not be invoked synchronously within SelectCertificate().
+  virtual std::variant<absl::StatusOr<SelectCertificateResult>,
+                       std::shared_ptr<AsyncCertificateSelectionHandle>>
+  SelectCertificate(const SelectCertificateInfo& info,
+                    OnSelectCertificateComplete on_complete) = 0;
+
+  // Cancels the async select cert call corresponding to the handle.
+  virtual void Cancel(std::shared_ptr<AsyncCertificateSelectionHandle>) = 0;
+#endif  // OPENSSL_IS_BORINGSSL
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_GRPC_TLS_CERTIFICATE_SELECTOR_H

data/src/core/credentials/transport/tls/load_system_roots_fallback.cc

@@ -19,7 +19,8 @@
 #include <grpc/support/port_platform.h>
 
 #if !defined(GPR_LINUX) && !defined(GPR_ANDROID) && !defined(GPR_FREEBSD) && \
-    !defined(GPR_APPLE) && !defined(GPR_WINDOWS)
+    !defined(GPR_APPLE) && !defined(GPR_NETBSD) && !defined(GPR_OPENBSD) &&  \
+    !defined(GPR_WINDOWS)
 
 #include <grpc/slice.h>
 #include <grpc/slice_buffer.h>
@@ -33,4 +34,4 @@ grpc_slice LoadSystemRootCerts() { return grpc_empty_slice(); }
 }  // namespace grpc_core
 
 #endif  // !(GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE ||
-        // GPR_WINDOWS)
+        // GPR_NETBSD || GPR_OPENBSD || GPR_WINDOWS)

data/src/core/credentials/transport/tls/load_system_roots_supported.cc

@@ -23,7 +23,7 @@
 #include <vector>
 
 #if defined(GPR_LINUX) || defined(GPR_ANDROID) || defined(GPR_FREEBSD) || \
-    defined(GPR_APPLE)
+    defined(GPR_APPLE) || defined(GPR_NETBSD) || defined(GPR_OPENBSD)
 
 #include <dirent.h>
 #include <fcntl.h>
@@ -59,7 +59,13 @@ const char* kCertDirectories[] = {""};
 #elif defined(GPR_APPLE)    // endif GPR_FREEBSD
 const char* kCertFiles[] = {"/etc/ssl/cert.pem"};
 const char* kCertDirectories[] = {""};
-#endif                      // GPR_APPLE
+#elif defined(GPR_NETBSD)   // endif GPR_APPLE
+const char* kCertFiles[] = {"/etc/openssl/certs/ca-certificates.crt"};
+const char* kCertDirectories[] = {"/etc/openssl/certs"};
+#elif defined(GPR_OPENBSD)  // endif GPR_NETBSD
+const char* kCertFiles[] = {"/etc/ssl/cert.pem"};
+const char* kCertDirectories[] = {""};
+#endif                      // GPR_OPENBSD
 
 grpc_slice GetSystemRootCerts() {
   size_t num_cert_files_ = GPR_ARRAY_SIZE(kCertFiles);
@@ -163,4 +169,5 @@ grpc_slice LoadSystemRootCerts() {
 
 }  // namespace grpc_core
 
-#endif  // GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE
+#endif  // GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE ||
+        // GPR_NETNSD || GPR_OPENBSD

data/src/core/credentials/transport/tls/tls_security_connector.cc

@@ -39,6 +39,7 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/promise/promise.h"
+#include "src/core/telemetry/metrics.h"
 #include "src/core/transport/auth_context.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/util/debug_location.h"
@@ -363,11 +364,17 @@ void TlsChannelSecurityConnector::add_handshakers(
                                    ? target_name_.c_str()
                                    : overridden_target_name_.c_str();
     }
+    auto stats_plugin_group =
+        args.GetObject<GlobalStatsPluginRegistry::StatsPluginGroup>();
+    RefCountedPtr<CollectionScope> collection_scope =
+        stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
+                                      : nullptr;
     tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
         client_handshaker_factory_, server_name_indication,
         /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0,
-        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS), &tsi_hs);
+        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS),
+        std::move(collection_scope), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);
@@ -648,10 +655,15 @@ void TlsServerSecurityConnector::add_handshakers(
   MutexLock lock(&mu_);
   tsi_handshaker* tsi_hs = nullptr;
   if (server_handshaker_factory_ != nullptr) {
+    auto stats_plugin_group =
+        args.GetObject<GlobalStatsPluginRegistry::StatsPluginGroup>();
+    RefCountedPtr<CollectionScope> collection_scope =
+        stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
+                                      : nullptr;
     // Instantiate TSI handshaker.
     tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
         server_handshaker_factory_, /*network_bio_buf_size=*/0,
-        /*ssl_bio_buf_size=*/0, &tsi_hs);
+        /*ssl_bio_buf_size=*/0, std::move(collection_scope), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);

data/src/core/credentials/transport/xds/xds_credentials.cc

@@ -20,17 +20,16 @@
 
 #include <grpc/grpc_security_constants.h>
 #include <grpc/impl/channel_arg_names.h>
-#include <grpc/support/port_platform.h>
 
 #include <optional>
 
+#include "src/core/config/experiment_env_var.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_provider.h"
 #include "src/core/credentials/transport/tls/grpc_tls_credentials_options.h"
 #include "src/core/credentials/transport/tls/tls_credentials.h"
 #include "src/core/credentials/transport/tls/tls_utils.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/load_balancing/xds/xds_channel_args.h"
-#include "src/core/util/env.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/host_port.h"
 #include "src/core/util/useful.h"
@@ -40,15 +39,6 @@ namespace grpc_core {
 
 namespace {
 
-// TODO(mlumish): Remove this after 1.80
-bool UseChannelAuthorityIfNoSNIApplicable() {
-  auto value = GetEnv("GRPC_USE_CHANNEL_AUTHORITY_IF_NO_SNI_APPLICABLE");
-  if (!value.has_value()) return false;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
-}
-
 bool XdsVerifySubjectAlternativeNames(
     const char* const* subject_alternative_names,
     size_t subject_alternative_names_size,
@@ -194,7 +184,9 @@ XdsCredentials::create_security_connector(
         tls_credentials_options->set_sni_override(
             xds_certificate_provider->sni());
       } else {
-        if (!UseChannelAuthorityIfNoSNIApplicable()) {
+        // TODO(mlumish): Remove this after 1.80
+        if (!IsExperimentEnvVarEnabled(
+                "GRPC_USE_CHANNEL_AUTHORITY_IF_NO_SNI_APPLICABLE")) {
           tls_credentials_options->set_sni_override("");
         }
       }

data/src/core/ext/filters/rbac/rbac_service_config_parser.cc

@@ -205,7 +205,8 @@ struct RbacConfig {
       std::map<std::string, Policy> policies;
       // Defaults to kNone since its json field is optional.
       Rbac::AuditCondition audit_condition = Rbac::AuditCondition::kNone;
-      std::vector<std::unique_ptr<AuditLoggerFactory::Config>> logger_configs;
+      std::vector<std::shared_ptr<const AuditLoggerFactory::Config>>
+          logger_configs;
 
       Rules() {}
       Rules(const Rules&) = delete;

data/src/core/ext/transport/chttp2/server/chttp2_server.cc

@@ -438,11 +438,16 @@ void NewChttp2ServerListener::ActiveConnection::SendGoAwayImplLocked() {
             transport->PerformOp(op);
           }
         },
-        [](GRPC_UNUSED const RefCountedPtr<http2::Http2ServerTransport>&
-               transport) {
-          // TODO(akshitpatel) [PH2][P0] : Add support for GOAWAY for
-          // Http2ServerTransport.
-          LOG(FATAL) << "Not implemented";
+        [](const RefCountedPtr<http2::Http2ServerTransport>& transport) {
+          // Send a GOAWAY if the transport exists
+          if (transport != nullptr) {
+            grpc_transport_op* op = grpc_make_transport_op(nullptr);
+            // We send a non-ok status here to send the status message in the
+            // GOAWAY frame.
+            op->goaway_error =
+                absl::UnavailableError("Server is stopping to serve requests.");
+            transport->PerformOp(op);
+          }
         });
   }
 }
@@ -468,11 +473,14 @@ void NewChttp2ServerListener::ActiveConnection::
           transport->PerformOp(op);
         }
       },
-      [](GRPC_UNUSED const RefCountedPtr<http2::Http2ServerTransport>&
-             transport) {
-        // TODO(akshitpatel) [PH2][P0] : Add support for disconnect immediately
-        // for Http2ServerTransport.
-        LOG(FATAL) << "Not implemented";
+      [](const RefCountedPtr<http2::Http2ServerTransport>& transport) {
+        // Disconnect immediately if the transport exists
+        if (transport != nullptr) {
+          grpc_transport_op* op = grpc_make_transport_op(nullptr);
+          op->disconnect_with_error = absl::UnavailableError(
+              "Drain grace time expired. Closing connection immediately.");
+          transport->PerformOp(op);
+        }
       });
 }
 
@@ -736,9 +744,7 @@ absl::StatusOr<int> Chttp2ServerAddPort(Server* server, const char* addr,
       resolved = grpc_resolve_vsock_address(parsed_addr_unprefixed);
       GRPC_RETURN_IF_ERROR(resolved.status());
     } else {
-      if (IsEventEngineDnsNonClientChannelEnabled() &&
-          !grpc_event_engine::experimental::
-              EventEngineExperimentDisabledForPython()) {
+      if (IsEventEngineDnsNonClientChannelEnabled()) {
         absl::StatusOr<std::unique_ptr<EventEngine::DNSResolver>> ee_resolver =
             args.GetObjectRef<EventEngine>()->GetDNSResolver(
                 EventEngine::DNSResolver::ResolverOptions());

data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc

@@ -545,6 +545,10 @@ static void read_channel_args(grpc_chttp2_transport* t,
 
   t->settings.mutable_local().SetAllowSecurityFrame(
       channel_args.GetBool(GRPC_ARG_SECURITY_FRAME_ALLOWED).value_or(false));
+  t->max_security_frame_size = static_cast<uint32_t>(grpc_core::Clamp(
+      channel_args.GetInt(GRPC_ARG_MAX_SECURITY_FRAME_SIZE)
+          .value_or(kMaxSecurityFrameSize),
+      kMinMaxSecurityFrameSize, static_cast<int>(kMaxSecurityFrameSize)));
 
   t->ping_on_rst_stream_percent = grpc_core::Clamp(
       channel_args.GetInt(GRPC_ARG_HTTP2_PING_ON_RST_STREAM_PERCENT)
@@ -759,7 +763,8 @@ grpc_chttp2_transport::grpc_chttp2_transport(
         grpc_core::GlobalStatsPluginRegistry::StatsPluginGroup>();
     if (epte != nullptr && stats_plugin_group != nullptr) {
       epte->EnableTcpTelemetry(stats_plugin_group->GetCollectionScope(),
-                               /*is_control_endpoint=*/false);
+                               /*is_control_endpoint=*/false,
+                               /*trace_full_buffer=*/false);
       epte->SetTcpTracer(std::make_shared<grpc_core::DefaultTcpTracer>(
           std::move(stats_plugin_group)));
     }
@@ -1372,14 +1377,11 @@ void grpc_chttp2_add_incoming_goaway(grpc_chttp2_transport* t,
                                      uint32_t last_stream_id,
                                      absl::string_view goaway_text) {
   t->goaway_error = grpc_error_set_int(
-      grpc_error_set_int(
-          grpc_core::StatusCreate(
-              absl::StatusCode::kUnavailable,
-              absl::StrFormat("GOAWAY received; Error code: %u; Debug Text: %s",
-                              goaway_error, goaway_text),
-              DEBUG_LOCATION, {}),
-          grpc_core::StatusIntProperty::kHttp2Error,
-          static_cast<intptr_t>(goaway_error)),
+      grpc_error_set_int(absl::UnavailableError(absl::StrFormat(
+                             "GOAWAY received; Error code: %u; Debug Text: %s",
+                             goaway_error, goaway_text)),
+                         grpc_core::StatusIntProperty::kHttp2Error,
+                         static_cast<intptr_t>(goaway_error)),
       grpc_core::StatusIntProperty::kRpcStatus, GRPC_STATUS_UNAVAILABLE);
 
   GRPC_TRACE_LOG(http, INFO)

data/src/core/ext/transport/chttp2/transport/flow_control.cc

@@ -119,12 +119,12 @@ std::string FlowControlAction::ImmediateUpdateReasons() const {
   return result;
 }
 
-TransportFlowControl::TransportFlowControl(absl::string_view name,
+TransportFlowControl::TransportFlowControl(absl::string_view peer_name,
                                            bool enable_bdp_probe,
                                            MemoryOwner* memory_owner)
     : memory_owner_(memory_owner),
       enable_bdp_probe_(enable_bdp_probe),
-      bdp_estimator_(name) {}
+      bdp_estimator_(peer_name) {}
 
 uint32_t TransportFlowControl::DesiredAnnounceSize(bool writing_anyway) const {
   const uint32_t target_announced_window =

data/src/core/ext/transport/chttp2/transport/flow_control.h

@@ -201,7 +201,8 @@ std::ostream& operator<<(std::ostream& out, const FlowControlAction& action);
 // This class manages the flow control at a connection level.
 class TransportFlowControl final {
  public:
-  explicit TransportFlowControl(absl::string_view name, bool enable_bdp_probe,
+  explicit TransportFlowControl(absl::string_view peer_name,
+                                bool enable_bdp_probe,
                                 MemoryOwner* memory_owner);
   ~TransportFlowControl() {}
 
@@ -318,7 +319,7 @@ class TransportFlowControl final {
   // Call periodically (at a low-ish rate, 100ms - 10s makes sense)
   // to perform more complex flow control calculations and return an action
   // to let the transport change its parameters.
-  // TODO(tjagtap) [PH2][P2] Plumb with PH2 flow control.
+  // TODO(tjagtap) [PH2][P2][FCV3] Plumb with PH2 flow control.
   FlowControlAction PeriodicUpdate();
 
   int64_t test_only_target_window() const { return target_window(); }

data/src/core/ext/transport/chttp2/transport/frame.cc

@@ -831,7 +831,8 @@ Http2Status ValidateFrameHeader(const uint32_t max_frame_size_setting,
                                 const uint32_t last_stream_id,
                                 const bool is_client,
                                 const bool is_first_settings_processed,
-                                Http2FrameCountTracker& tracker) {
+                                Http2FrameCountTracker& tracker,
+                                const uint32_t max_security_frame_size) {
   const bool is_data_frame =
       current_frame_header.type == static_cast<uint8_t>(FrameType::kData);
   const bool is_continuation_frame =
@@ -861,6 +862,16 @@ Http2Status ValidateFrameHeader(const uint32_t max_frame_size_setting,
                      ", Max Size = ", max_frame_size_setting));
   }
 
+  if (GPR_UNLIKELY(current_frame_header.type ==
+                       static_cast<uint8_t>(FrameType::kCustomSecurity) &&
+                   current_frame_header.length > max_security_frame_size)) {
+    return Http2Status::Http2ConnectionError(
+        Http2ErrorCode::kFrameSizeError,
+        absl::StrCat(GrpcErrors::kSecurityFrameTooLarge,
+                     max_security_frame_size,
+                     ", Received size : ", current_frame_header.length));
+  }
+
   // RFC 9113 (Section 6.10) requires that if a HEADERS frame does not have
   // END_HEADERS set, it must be followed by a contiguous sequence of
   // CONTINUATION frames for the same stream, ending with END_HEADERS. No other
@@ -928,3 +939,49 @@ Http2Status ValidateFrameHeader(const uint32_t max_frame_size_setting,
   return Http2Status::Ok();
 }
 }  // namespace grpc_core
+
+/*
+A note on Security Frames
+
+Security Frame is a custom frame defined by gRPC.
+
+SECURITY Frame
+
+   The SECURITY frame (type=200) is used to transmit out-of-band security and
+   transport-level privacy information between peers.
+
+   Both peers MUST agree to allow SECURITY frames.
+
+    +------------------------+
+    |     Payload Length     |
+    |          (24)          |
+    +--------+--------+------+
+    |  Type  | Flags  |
+    |  (200) |  (8)   |
+    +-+------+--------+---------------+
+    |R|       Stream Identifier       |
+    | |             (31)              |
+    +=+===============================+
+    |      Security Payload (*)     ...
+    +---------------------------------+
+
+   The SECURITY frame payload contains opaque data intended for the registered
+   transport framing endpoint extension.
+
+   The SECURITY frame does not define flags.
+
+Payload Size Limits and Chunking
+
+   The current implementation of the SECURITY frame has a HARD limit of 16,384
+   bytes (16 KB) for its payload.
+
+   This strict 16 KB limit is enforced because 16,384 bytes is the minimum
+   valid value for SETTINGS_MAX_FRAME_SIZE (the smallest maximum frame size an
+   HTTP/2 peer is allowed to advertise). Currently, the SECURITY frame does not
+   support chunking. Therefore, if a peer attempts to send a SECURITY payload
+   larger than the receiver's advertised SETTINGS_MAX_FRAME_SIZE, the endpoint
+   MUST treat this as a CONNECTION ERROR of type FRAME_SIZE_ERROR. By enforcing
+a hard 16 KB upper bound, we guarantee that the frame will safely fit within any
+compliant peer's single-frame receive buffer without requiring payload chunking.
+
+*/