Address Jiangtao's comments.

src/core/lib/security/security_connector/ssl/ssl_security_connector.cc

@@ -107,8 +107,8 @@ class grpc_ssl_channel_security_connector final
     }
     options.cipher_suites = grpc_get_ssl_cipher_suites();
     options.session_cache = ssl_session_cache;
-    options.min_tls_version = config->min_tls_version;
-    options.max_tls_version = config->max_tls_version;
+    options.min_tls_version = grpc_get_tsi_tls_version(config->min_tls_version);
+    options.max_tls_version = grpc_get_tsi_tls_version(config->max_tls_version);
     const tsi_result result =
         tsi_create_ssl_client_handshaker_factory_with_options(
             &options, &client_handshaker_factory_);
@@ -253,8 +253,10 @@ class grpc_ssl_server_security_connector
       options.cipher_suites = grpc_get_ssl_cipher_suites();
       options.alpn_protocols = alpn_protocol_strings;
       options.num_alpn_protocols = static_cast<uint16_t>(num_alpn_protocols);
-      options.min_tls_version = server_credentials->config().min_tls_version;
-      options.max_tls_version = server_credentials->config().max_tls_version;
+      options.min_tls_version = grpc_get_tsi_tls_version(
+          server_credentials->config().min_tls_version);
+      options.max_tls_version = grpc_get_tsi_tls_version(
+          server_credentials->config().max_tls_version);
       const tsi_result result =
           tsi_create_ssl_server_handshaker_factory_with_options(
               &options, &server_handshaker_factory_);

src/core/lib/security/security_connector/ssl_utils.cc

@@ -137,6 +137,18 @@ grpc_get_tsi_client_certificate_request_type(
   }
 }
 
+tsi_tls_version grpc_get_tsi_tls_version(grpc_tls_version tls_version) {
+  switch (tls_version) {
+    case grpc_tls_version::TLS1_2:
+      return tsi_tls_version::TSI_TLS1_2;
+    case grpc_tls_version::TLS1_3:
+      return tsi_tls_version::TSI_TLS1_3;
+    default:
+      gpr_log(GPR_INFO, "Falling back to TLS 1.2.");
+      return tsi_tls_version::TSI_TLS1_2;
+  }
+}
+
 grpc_error* grpc_ssl_check_alpn(const tsi_peer* peer) {
 #if TSI_OPENSSL_ALPN_SUPPORT
   /* Check the ALPN if ALPN is supported. */

src/core/lib/security/security_connector/ssl_utils.h

@@ -73,6 +73,9 @@ grpc_get_tsi_client_certificate_request_type(
 grpc_security_level grpc_tsi_security_level_string_to_enum(
     const char* security_level);
 
+/* Map grpc_tls_version to tsi_tls_version. */
+tsi_tls_version grpc_get_tsi_tls_version(grpc_tls_version tls_version);
+
 /* Map grpc_security_level enum to a string. */
 const char* grpc_security_level_to_string(grpc_security_level security_level);
 

src/core/tsi/ssl_transport_security.cc

@@ -892,8 +892,8 @@ static int NullVerifyCallback(int /*preverify_ok*/, X509_STORE_CTX* /*ctx*/) {
 // Sets the min and max TLS version of |ssl_context| to |min_tls_version| and
 // |max_tls_version|, respectively.
 static tsi_result tsi_set_min_and_max_tls_versions(
-    SSL_CTX* ssl_context, grpc_tls_version min_tls_version,
-    grpc_tls_version max_tls_version) {
+    SSL_CTX* ssl_context, tsi_tls_version min_tls_version,
+    tsi_tls_version max_tls_version) {
   if (ssl_context == nullptr) {
     gpr_log(GPR_INFO,
             "Invalid nullptr argument to |tsi_set_min_and_max_tls_versions|.");
@@ -902,11 +902,11 @@ static tsi_result tsi_set_min_and_max_tls_versions(
   // Set the min TLS version of the SSL context.
   switch (min_tls_version) {
 #if OPENSSL_VERSION_NUMBER >= 0x10100000
-    case grpc_tls_version::TLS1_2:
+    case tsi_tls_version::TSI_TLS1_2:
       SSL_CTX_set_min_proto_version(ssl_context, TLS1_2_VERSION);
       break;
 #if defined(TLS1_3_VERSION)
-    case grpc_tls_version::TLS1_3:
+    case tsi_tls_version::TSI_TLS1_3:
       SSL_CTX_set_min_proto_version(ssl_context, TLS1_3_VERSION);
       break;
 #endif
@@ -918,11 +918,11 @@ static tsi_result tsi_set_min_and_max_tls_versions(
   // Set the max TLS version of the SSL context.
   switch (max_tls_version) {
 #if OPENSSL_VERSION_NUMBER >= 0x10100000
-    case grpc_tls_version::TLS1_2:
+    case tsi_tls_version::TSI_TLS1_2:
       SSL_CTX_set_max_proto_version(ssl_context, TLS1_2_VERSION);
       break;
 #if defined(TLS1_3_VERSION)
-    case grpc_tls_version::TLS1_3:
+    case tsi_tls_version::TSI_TLS1_3:
       SSL_CTX_set_max_proto_version(ssl_context, TLS1_3_VERSION);
       break;
 #endif
@@ -1473,7 +1473,7 @@ static tsi_result ssl_bytes_remaining(tsi_ssl_handshaker* impl,
   // If an unexpected number of bytes were read, return an error status and free
   // all of the bytes that were read.
   if (bytes_read < 0 || static_cast<size_t>(bytes_read) != bytes_in_ssl) {
-    gpr_log(GPR_INFO,
+    gpr_log(GPR_ERROR,
             "Failed to read the expected number of bytes from SSL object.");
     gpr_free(*bytes_remaining);
     *bytes_remaining = nullptr;
@@ -1532,7 +1532,7 @@ static tsi_result ssl_handshaker_next(
     status = ssl_bytes_remaining(impl, &unused_bytes, &unused_bytes_size);
     if (status != TSI_OK) return status;
     if (unused_bytes_size > received_bytes_size) {
-      gpr_log(GPR_INFO, "More unused bytes than received bytes.");
+      gpr_log(GPR_ERROR, "More unused bytes than received bytes.");
       gpr_free(unused_bytes);
       return TSI_INTERNAL_ERROR;
     }

src/core/tsi/ssl_transport_security.h

@@ -154,8 +154,8 @@ struct tsi_ssl_client_handshaker_options {
   bool skip_server_certificate_verification;
 
   /* The min and max TLS versions that will be negotiated by the handshaker. */
-  grpc_tls_version min_tls_version;
-  grpc_tls_version max_tls_version;
+  tsi_tls_version min_tls_version;
+  tsi_tls_version max_tls_version;
 
   tsi_ssl_client_handshaker_options()
       : pem_key_cert_pair(nullptr),
@@ -166,8 +166,8 @@ struct tsi_ssl_client_handshaker_options {
         num_alpn_protocols(0),
         session_cache(nullptr),
         skip_server_certificate_verification(false),
-        min_tls_version(grpc_tls_version::TLS1_2),
-        max_tls_version(grpc_tls_version::TLS1_3) {}
+        min_tls_version(tsi_tls_version::TSI_TLS1_2),
+        max_tls_version(tsi_tls_version::TSI_TLS1_3) {}
 };
 
 /* Creates a client handshaker factory.
@@ -284,8 +284,8 @@ struct tsi_ssl_server_handshaker_options {
   /* session_ticket_key_size is a size of session ticket encryption key. */
   size_t session_ticket_key_size;
   /* The min and max TLS versions that will be negotiated by the handshaker. */
-  grpc_tls_version min_tls_version;
-  grpc_tls_version max_tls_version;
+  tsi_tls_version min_tls_version;
+  tsi_tls_version max_tls_version;
 
   tsi_ssl_server_handshaker_options()
       : pem_key_cert_pairs(nullptr),
@@ -297,8 +297,8 @@ struct tsi_ssl_server_handshaker_options {
         num_alpn_protocols(0),
         session_ticket_key(nullptr),
         session_ticket_key_size(0),
-        min_tls_version(grpc_tls_version::TLS1_2),
-        max_tls_version(grpc_tls_version::TLS1_3) {}
+        min_tls_version(tsi_tls_version::TSI_TLS1_2),
+        max_tls_version(tsi_tls_version::TSI_TLS1_3) {}
 };
 
 /* Creates a server handshaker factory.

src/core/tsi/transport_security_interface.h

@@ -64,6 +64,11 @@ typedef enum {
   TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY,
 } tsi_client_certificate_request_type;
 
+typedef enum {
+  TSI_TLS1_2,
+  TSI_TLS1_3,
+} tsi_tls_version;
+
 const char* tsi_result_to_string(tsi_result result);
 const char* tsi_security_level_to_string(tsi_security_level security_level);
 

test/core/tsi/ssl_transport_security_test.cc

@@ -56,7 +56,7 @@ const size_t kSessionTicketEncryptionKeySize = 48;
 #endif
 
 // Indicates the TLS version used for the test.
-static grpc_tls_version test_tls_version = grpc_tls_version::TLS1_3;
+static tsi_tls_version test_tls_version = tsi_tls_version::TSI_TLS1_3;
 
 typedef enum AlpnMode {
   NO_ALPN,
@@ -332,7 +332,7 @@ static void ssl_test_check_handshaker_peers(tsi_test_fixture* fixture) {
   bool expect_server_success =
       !(key_cert_lib->use_bad_server_cert ||
         (key_cert_lib->use_bad_client_cert && ssl_fixture->force_client_auth));
-  bool expect_client_success = test_tls_version == grpc_tls_version::TLS1_2
+  bool expect_client_success = test_tls_version == tsi_tls_version::TSI_TLS1_2
                                    ? expect_server_success
                                    : !key_cert_lib->use_bad_server_cert;
   if (expect_client_success) {
@@ -970,8 +970,8 @@ int main(int argc, char** argv) {
   grpc::testing::TestEnvironment env(argc, argv);
   grpc_init();
   const size_t number_tls_versions = 2;
-  const grpc_tls_version tls_versions[] = {grpc_tls_version::TLS1_2,
-                                           grpc_tls_version::TLS1_3};
+  const tsi_tls_version tls_versions[] = {tsi_tls_version::TSI_TLS1_2,
+                                          tsi_tls_version::TSI_TLS1_3};
   for (size_t i = 0; i < number_tls_versions; i++) {
     // Set the TLS version to be used in the tests.
     test_tls_version = tls_versions[i];