[PSM Interop] Simplify PSM Interop Kokoro buildscripts (v1.56.x backport) (#36541 )

Backport of #36450 to v1.56.x. --- Integrates the new features of the the Kokoro PSM Interop install library introduced in grpc/psm-interop#73. Nearly all common functionality was moved from per-language/per-branch PSM Interop build scripts to [psm_interop_kokoro_lib.sh](https://github.com/grpc/psm-interop/blob/main/.kokoro/psm_interop_kokoro_lib.sh): 1. The list of tests in the each test suite 2. Per-test-suite flag customization 3. `run_test` methods 4. `build_docker_images_if_needed` methods 5. Generic `build_test_app_docker_images` methods (simple docker build + docker push + docker tag). grpc-java is one exception, as it doesn't run docker directly, but a cloudbuild flow. Now all PSM Interop jobs share the same buildscripts by all test suites: 1. buildscript that invokes the test: `psm-interop-test-{language}.sh` (configured as `build_file` in the build cfg) 2. buildscript that builds the xDS test client/server and publishes them as a Docker image: `psm-interop-build-{language}.sh` (conventional name called from `psm_interop_kokoro_lib.sh`) `psm-interop-test-{language}.sh`: 1. Sets `GRPC_LANGUAGE`, `BUILD_SCRIPT_DIR` environment variables. 2. Downloads the shared `psm_interop_kokoro_lib.sh` from the main branch of the psm-interop repo. 3. Sources `psm-interop-build-{language}.sh` 4. Calls `psm::run "${PSM_TEST_SUITE}"` (`PSM_TEST_SUITE` configured in the cfg file). `psm-interop-build-{language}.sh`: 1. Defines `psm::lang::build_docker_images` which is called from `psm_interop_kokoro_lib.sh`. 2. Invokes any repo-specific logic. 3. May use `psm::build::docker_images_generic` for generic Docker build, tag, push, or provide implement its own build/publish method. References: - b/288578634 - See the full list of the new features at grpc/psm-interop#73. - Additional fixes to the shared lib: grpc/psm-interop#78, grpc/psm-interop#79
[PSM Interop] Migrate to Artifact Registry (v1.56.x backport) (#36317 )
2024-05-06 15:14:55 -07:00 · 2024-04-09 14:03:17 -07:00 · 2024-02-05 15:00:20 -08:00 · 2024-02-05 11:04:00 -08:00 · 2023-12-20 10:14:18 -08:00 · 2023-10-09 10:08:36 -07:00
256 changed files with 14182 additions and 2295 deletions
--- a/34
+++ b/34
@ -215,7 +215,7 @@ g_stands_for = "galvanized"  # @unused

 core_version = "33.0.0"  # @unused

-version = "1.56.0-dev"  # @unused
+version = "1.56.4"  # @unused

 GPR_PUBLIC_HDRS = [
    "include/grpc/support/alloc.h",
@ -3699,23 +3699,47 @@ grpc_cc_library(
        "//src/core:ext/transport/chttp2/transport/hpack_parser_table.h",
    ],
    external_deps = [
+        "absl/functional:function_ref",
        "absl/status",
        "absl/strings",
-        "absl/strings:str_format",
    ],
    deps = [
        "gpr",
        "gpr_platform",
        "grpc_base",
        "grpc_trace",
+        "hpack_parse_result",
        "http_trace",
-        "//src/core:error",
        "//src/core:hpack_constants",
        "//src/core:no_destruct",
        "//src/core:slice",
    ],
 )

+grpc_cc_library(
+    name = "hpack_parse_result",
+    srcs = [
+        "//src/core:ext/transport/chttp2/transport/hpack_parse_result.cc",
+    ],
+    hdrs = [
+        "//src/core:ext/transport/chttp2/transport/hpack_parse_result.h",
+    ],
+    external_deps = [
+        "absl/status",
+        "absl/strings",
+        "absl/strings:str_format",
+        "absl/types:optional",
+    ],
+    deps = [
+        "gpr",
+        "grpc_base",
+        "//src/core:error",
+        "//src/core:hpack_constants",
+        "//src/core:slice",
+        "//src/core:status_helper",
+    ],
+)
+
 grpc_cc_library(
    name = "hpack_parser",
    srcs = [
@ -3728,7 +3752,6 @@ grpc_cc_library(
        "absl/base:core_headers",
        "absl/status",
        "absl/strings",
-        "absl/strings:str_format",
        "absl/types:optional",
        "absl/types:span",
        "absl/types:variant",
@ -3740,16 +3763,17 @@ grpc_cc_library(
        "grpc_base",
        "grpc_public_hdrs",
        "grpc_trace",
+        "hpack_parse_result",
        "hpack_parser_table",
        "stats",
        "//src/core:decode_huff",
        "//src/core:error",
        "//src/core:hpack_constants",
+        "//src/core:match",
        "//src/core:random_early_detection",
        "//src/core:slice",
        "//src/core:slice_refcount",
        "//src/core:stats_data",
-        "//src/core:status_helper",
    ],
 )

--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -25,12 +25,12 @@
 cmake_minimum_required(VERSION 3.8)

 set(PACKAGE_NAME          "grpc")
-set(PACKAGE_VERSION       "1.56.0-dev")
+set(PACKAGE_VERSION       "1.56.4")
 set(gRPC_CORE_VERSION     "33.0.0")
 set(gRPC_CORE_SOVERSION   "33")
-set(gRPC_CPP_VERSION      "1.56.0-dev")
+set(gRPC_CPP_VERSION      "1.56.4")
 set(gRPC_CPP_SOVERSION    "1.56")
-set(gRPC_CSHARP_VERSION   "2.56.0-dev")
+set(gRPC_CSHARP_VERSION   "2.56.4")
 set(gRPC_CSHARP_SOVERSION "2.56")
 set(PACKAGE_STRING        "${PACKAGE_NAME} ${PACKAGE_VERSION}")
 set(PACKAGE_TARNAME       "${PACKAGE_NAME}-${PACKAGE_VERSION}")
@ -299,7 +299,7 @@ endif()
 if (gRPC_XDS_USER_AGENT_IS_CSHARP)
  # The value of the defines needs to contain quotes.
  # See https://github.com/grpc/grpc/blob/fbf32836a418cc84f58786700273b65cb9174e1d/src/core/ext/xds/xds_api.cc#L854
-  add_definitions("-DGRPC_XDS_USER_AGENT_NAME_SUFFIX=\"csharp\"" "-DGRPC_XDS_USER_AGENT_VERSION_SUFFIX=\"2.56.0-dev\"")
+  add_definitions("-DGRPC_XDS_USER_AGENT_NAME_SUFFIX=\"csharp\"" "-DGRPC_XDS_USER_AGENT_VERSION_SUFFIX=\"2.56.4\"")
 endif()

 if(UNIX AND NOT HAIKU)
@ -394,18 +394,18 @@ if (NOT EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/third_party/xds)
  # Download the archive via HTTP, validate the checksum, and extract to third_party/xds.
  download_archive(
    ${CMAKE_CURRENT_SOURCE_DIR}/third_party/xds
-    https://storage.googleapis.com/grpc-bazel-mirror/github.com/cncf/xds/archive/4003588d1b747e37e911baa5a9c1c07fde4ca518.tar.gz
-    aef36c29bd0ef95509f7f52693dbdafe4a2c2c5d1eb406bf68e6364a0d12e11b
-    xds-4003588d1b747e37e911baa5a9c1c07fde4ca518
+    https://storage.googleapis.com/grpc-bazel-mirror/github.com/cncf/xds/archive/e9ce68804cb4e64cab5a52e3c8baf840d4ff87b7.tar.gz
+    0d33b83f8c6368954e72e7785539f0d272a8aba2f6e2e336ed15fd1514bc9899
+    xds-e9ce68804cb4e64cab5a52e3c8baf840d4ff87b7
  )
 endif()
 if (NOT EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/third_party/xds)
  # Download the archive via HTTP, validate the checksum, and extract to third_party/xds.
  download_archive(
    ${CMAKE_CURRENT_SOURCE_DIR}/third_party/xds
-    https://github.com/cncf/xds/archive/4003588d1b747e37e911baa5a9c1c07fde4ca518.tar.gz
-    aef36c29bd0ef95509f7f52693dbdafe4a2c2c5d1eb406bf68e6364a0d12e11b
-    xds-4003588d1b747e37e911baa5a9c1c07fde4ca518
+    https://github.com/cncf/xds/archive/e9ce68804cb4e64cab5a52e3c8baf840d4ff87b7.tar.gz
+    0d33b83f8c6368954e72e7785539f0d272a8aba2f6e2e336ed15fd1514bc9899
+    xds-e9ce68804cb4e64cab5a52e3c8baf840d4ff87b7
  )
 endif()

@ -1677,6 +1677,7 @@ add_library(grpc
  src/core/ext/transport/chttp2/transport/frame_window_update.cc
  src/core/ext/transport/chttp2/transport/hpack_encoder.cc
  src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc
+  src/core/ext/transport/chttp2/transport/hpack_parse_result.cc
  src/core/ext/transport/chttp2/transport/hpack_parser.cc
  src/core/ext/transport/chttp2/transport/hpack_parser_table.cc
  src/core/ext/transport/chttp2/transport/http2_settings.cc
@ -2696,6 +2697,7 @@ add_library(grpc_unsecure
  src/core/ext/transport/chttp2/transport/frame_window_update.cc
  src/core/ext/transport/chttp2/transport/hpack_encoder.cc
  src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc
+  src/core/ext/transport/chttp2/transport/hpack_parse_result.cc
  src/core/ext/transport/chttp2/transport/hpack_parser.cc
  src/core/ext/transport/chttp2/transport/hpack_parser_table.cc
  src/core/ext/transport/chttp2/transport/http2_settings.cc
@ -11486,6 +11488,7 @@ add_executable(frame_test
  src/core/ext/transport/chttp2/transport/decode_huff.cc
  src/core/ext/transport/chttp2/transport/hpack_encoder.cc
  src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc
+  src/core/ext/transport/chttp2/transport/hpack_parse_result.cc
  src/core/ext/transport/chttp2/transport/hpack_parser.cc
  src/core/ext/transport/chttp2/transport/hpack_parser_table.cc
  src/core/ext/transport/chttp2/transport/http_trace.cc
--- a/118
+++ b/118
@ -375,7 +375,7 @@ LDFLAGS += -pthread
 endif

 ifeq ($(SYSTEM),MINGW32)
-LIBS = m pthread ws2_32 dbghelp bcrypt
+LIBS = m pthread ws2_32 iphlpapi dbghelp bcrypt
 LDFLAGS += -pthread
 endif

@ -411,8 +411,8 @@ Q = @
 endif

 CORE_VERSION = 33.0.0
-CPP_VERSION = 1.56.0-dev
-CSHARP_VERSION = 2.56.0-dev
+CPP_VERSION = 1.56.4
+CSHARP_VERSION = 2.56.4

 CPPFLAGS_NO_ARCH += $(addprefix -I, $(INCLUDES)) $(addprefix -D, $(DEFINES))
 CPPFLAGS += $(CPPFLAGS_NO_ARCH) $(ARCH_FLAGS)
@ -1058,6 +1058,7 @@ LIBGRPC_SRC = \
    src/core/ext/transport/chttp2/transport/frame_window_update.cc \
    src/core/ext/transport/chttp2/transport/hpack_encoder.cc \
    src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc \
+    src/core/ext/transport/chttp2/transport/hpack_parse_result.cc \
    src/core/ext/transport/chttp2/transport/hpack_parser.cc \
    src/core/ext/transport/chttp2/transport/hpack_parser_table.cc \
    src/core/ext/transport/chttp2/transport/http2_settings.cc \
@ -1931,6 +1932,7 @@ LIBGRPC_UNSECURE_SRC = \
    src/core/ext/transport/chttp2/transport/frame_window_update.cc \
    src/core/ext/transport/chttp2/transport/hpack_encoder.cc \
    src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc \
+    src/core/ext/transport/chttp2/transport/hpack_parse_result.cc \
    src/core/ext/transport/chttp2/transport/hpack_parser.cc \
    src/core/ext/transport/chttp2/transport/hpack_parser_table.cc \
    src/core/ext/transport/chttp2/transport/http2_settings.cc \
@ -2805,62 +2807,66 @@ endif

 # start of build recipe for library "ares" (generated by makelib(lib) template function)
 LIBARES_SRC = \
-    third_party/cares/cares/src/lib/ares_init.c \
-    third_party/cares/cares/src/lib/ares_expand_string.c \
-    third_party/cares/cares/src/lib/ares_strcasecmp.c \
-    third_party/cares/cares/src/lib/ares_destroy.c \
-    third_party/cares/cares/src/lib/ares_free_string.c \
-    third_party/cares/cares/src/lib/ares__timeval.c \
-    third_party/cares/cares/src/lib/ares_library_init.c \
-    third_party/cares/cares/src/lib/ares_getsock.c \
-    third_party/cares/cares/src/lib/ares_process.c \
-    third_party/cares/cares/src/lib/ares_create_query.c \
-    third_party/cares/cares/src/lib/ares_fds.c \
-    third_party/cares/cares/src/lib/ares_gethostbyname.c \
-    third_party/cares/cares/src/lib/ares_mkquery.c \
-    third_party/cares/cares/src/lib/ares_freeaddrinfo.c \
-    third_party/cares/cares/src/lib/ares_strdup.c \
-    third_party/cares/cares/src/lib/ares_timeout.c \
-    third_party/cares/cares/src/lib/ares_getnameinfo.c \
-    third_party/cares/cares/src/lib/ares_parse_soa_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_naptr_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_a_reply.c \
-    third_party/cares/cares/src/lib/ares_send.c \
-    third_party/cares/cares/src/lib/ares_nowarn.c \
-    third_party/cares/cares/src/lib/ares__sortaddrinfo.c \
-    third_party/cares/cares/src/lib/ares_android.c \
-    third_party/cares/cares/src/lib/ares_strerror.c \
-    third_party/cares/cares/src/lib/ares_parse_caa_reply.c \
-    third_party/cares/cares/src/lib/ares__close_sockets.c \
-    third_party/cares/cares/src/lib/ares_llist.c \
-    third_party/cares/cares/src/lib/ares_parse_aaaa_reply.c \
-    third_party/cares/cares/src/lib/ares_getaddrinfo.c \
-    third_party/cares/cares/src/lib/ares_parse_ns_reply.c \
-    third_party/cares/cares/src/lib/windows_port.c \
-    third_party/cares/cares/src/lib/bitncmp.c \
-    third_party/cares/cares/src/lib/ares_strsplit.c \
-    third_party/cares/cares/src/lib/ares_data.c \
-    third_party/cares/cares/src/lib/ares_free_hostent.c \
-    third_party/cares/cares/src/lib/ares_platform.c \
-    third_party/cares/cares/src/lib/ares_parse_txt_reply.c \
-    third_party/cares/cares/src/lib/ares__parse_into_addrinfo.c \
-    third_party/cares/cares/src/lib/ares_gethostbyaddr.c \
-    third_party/cares/cares/src/lib/ares_parse_srv_reply.c \
-    third_party/cares/cares/src/lib/ares_version.c \
-    third_party/cares/cares/src/lib/ares_getenv.c \
-    third_party/cares/cares/src/lib/ares_search.c \
-    third_party/cares/cares/src/lib/ares_parse_mx_reply.c \
-    third_party/cares/cares/src/lib/ares__get_hostent.c \
-    third_party/cares/cares/src/lib/ares__readaddrinfo.c \
-    third_party/cares/cares/src/lib/ares_parse_ptr_reply.c \
    third_party/cares/cares/src/lib/ares__read_line.c \
-    third_party/cares/cares/src/lib/ares_query.c \
-    third_party/cares/cares/src/lib/ares_options.c \
-    third_party/cares/cares/src/lib/inet_net_pton.c \
-    third_party/cares/cares/src/lib/ares_expand_name.c \
-    third_party/cares/cares/src/lib/inet_ntop.c \
+    third_party/cares/cares/src/lib/ares__get_hostent.c \
+    third_party/cares/cares/src/lib/ares__close_sockets.c \
+    third_party/cares/cares/src/lib/ares__timeval.c \
+    third_party/cares/cares/src/lib/ares_gethostbyaddr.c \
+    third_party/cares/cares/src/lib/ares_getenv.c \
+    third_party/cares/cares/src/lib/ares_free_string.c \
+    third_party/cares/cares/src/lib/ares_free_hostent.c \
+    third_party/cares/cares/src/lib/ares_fds.c \
+    third_party/cares/cares/src/lib/ares_expand_string.c \
+    third_party/cares/cares/src/lib/ares_create_query.c \
    third_party/cares/cares/src/lib/ares_cancel.c \
+    third_party/cares/cares/src/lib/ares_android.c \
+    third_party/cares/cares/src/lib/ares_parse_txt_reply.c \
+    third_party/cares/cares/src/lib/ares_parse_srv_reply.c \
+    third_party/cares/cares/src/lib/ares_parse_soa_reply.c \
+    third_party/cares/cares/src/lib/ares_parse_ptr_reply.c \
+    third_party/cares/cares/src/lib/ares_parse_ns_reply.c \
+    third_party/cares/cares/src/lib/ares_parse_naptr_reply.c \
+    third_party/cares/cares/src/lib/ares_parse_mx_reply.c \
+    third_party/cares/cares/src/lib/ares_parse_caa_reply.c \
+    third_party/cares/cares/src/lib/ares_options.c \
+    third_party/cares/cares/src/lib/ares_nowarn.c \
+    third_party/cares/cares/src/lib/ares_mkquery.c \
+    third_party/cares/cares/src/lib/ares_llist.c \
+    third_party/cares/cares/src/lib/ares_getsock.c \
+    third_party/cares/cares/src/lib/ares_getnameinfo.c \
+    third_party/cares/cares/src/lib/bitncmp.c \
    third_party/cares/cares/src/lib/ares_writev.c \
+    third_party/cares/cares/src/lib/ares_version.c \
+    third_party/cares/cares/src/lib/ares_timeout.c \
+    third_party/cares/cares/src/lib/ares_strerror.c \
+    third_party/cares/cares/src/lib/ares_strcasecmp.c \
+    third_party/cares/cares/src/lib/ares_search.c \
+    third_party/cares/cares/src/lib/ares_platform.c \
+    third_party/cares/cares/src/lib/windows_port.c \
+    third_party/cares/cares/src/lib/inet_ntop.c \
+    third_party/cares/cares/src/lib/ares__sortaddrinfo.c \
+    third_party/cares/cares/src/lib/ares__readaddrinfo.c \
+    third_party/cares/cares/src/lib/ares_parse_uri_reply.c \
+    third_party/cares/cares/src/lib/ares__parse_into_addrinfo.c \
+    third_party/cares/cares/src/lib/ares_parse_a_reply.c \
+    third_party/cares/cares/src/lib/ares_parse_aaaa_reply.c \
+    third_party/cares/cares/src/lib/ares_library_init.c \
+    third_party/cares/cares/src/lib/ares_init.c \
+    third_party/cares/cares/src/lib/ares_gethostbyname.c \
+    third_party/cares/cares/src/lib/ares_getaddrinfo.c \
+    third_party/cares/cares/src/lib/ares_freeaddrinfo.c \
+    third_party/cares/cares/src/lib/ares_expand_name.c \
+    third_party/cares/cares/src/lib/ares_destroy.c \
+    third_party/cares/cares/src/lib/ares_data.c \
+    third_party/cares/cares/src/lib/ares__addrinfo_localhost.c \
+    third_party/cares/cares/src/lib/ares__addrinfo2hostent.c \
+    third_party/cares/cares/src/lib/inet_net_pton.c \
+    third_party/cares/cares/src/lib/ares_strsplit.c \
+    third_party/cares/cares/src/lib/ares_strdup.c \
+    third_party/cares/cares/src/lib/ares_send.c \
+    third_party/cares/cares/src/lib/ares_rand.c \
+    third_party/cares/cares/src/lib/ares_query.c \
+    third_party/cares/cares/src/lib/ares_process.c \


 LIBARES_OBJS = $(addprefix $(OBJDIR)/$(CONFIG)/, $(addsuffix .o, $(basename $(LIBARES_SRC))))
--- a/Package.swift
+++ b/Package.swift
--- a/_metadata.py
+++ b/_metadata.py
@ -14,4 +14,4 @@

 # AUTO-GENERATED FROM `$REPO_ROOT/templates/_metadata.py.template`!!!

-__version__ = """1.56.0.dev0"""
+__version__ = """1.56.4"""
--- a/bazel/grpc_deps.bzl
+++ b/bazel/grpc_deps.bzl
@ -327,11 +327,11 @@ def grpc_deps():
        http_archive(
            name = "com_github_cares_cares",
            build_file = "@com_github_grpc_grpc//third_party:cares/cares.BUILD",
-            sha256 = "ec76c5e79db59762776bece58b69507d095856c37b81fd35bfb0958e74b61d93",
-            strip_prefix = "c-ares-6654436a307a5a686b008c1d4c93b0085da6e6d8",
+            sha256 = "bf26e5b25e259911914a85ae847b6d723488adb5af4f8bdeb9d0871a318476e3",
+            strip_prefix = "c-ares-6360e96b5cf8e5980c887ce58ef727e53d77243a",
            urls = [
-                "https://storage.googleapis.com/grpc-bazel-mirror/github.com/c-ares/c-ares/archive/6654436a307a5a686b008c1d4c93b0085da6e6d8.tar.gz",
-                "https://github.com/c-ares/c-ares/archive/6654436a307a5a686b008c1d4c93b0085da6e6d8.tar.gz",
+                "https://storage.googleapis.com/grpc-bazel-mirror/github.com/c-ares/c-ares/archive/6360e96b5cf8e5980c887ce58ef727e53d77243a.tar.gz",
+                "https://github.com/c-ares/c-ares/archive/6360e96b5cf8e5980c887ce58ef727e53d77243a.tar.gz",
            ],
        )

@ -502,11 +502,11 @@ def grpc_deps():
    if "com_github_cncf_udpa" not in native.existing_rules():
        http_archive(
            name = "com_github_cncf_udpa",
-            sha256 = "aef36c29bd0ef95509f7f52693dbdafe4a2c2c5d1eb406bf68e6364a0d12e11b",
-            strip_prefix = "xds-4003588d1b747e37e911baa5a9c1c07fde4ca518",
+            sha256 = "0d33b83f8c6368954e72e7785539f0d272a8aba2f6e2e336ed15fd1514bc9899",
+            strip_prefix = "xds-e9ce68804cb4e64cab5a52e3c8baf840d4ff87b7",
            urls = [
-                "https://storage.googleapis.com/grpc-bazel-mirror/github.com/cncf/xds/archive/4003588d1b747e37e911baa5a9c1c07fde4ca518.tar.gz",
-                "https://github.com/cncf/xds/archive/4003588d1b747e37e911baa5a9c1c07fde4ca518.tar.gz",
+                "https://storage.googleapis.com/grpc-bazel-mirror/github.com/cncf/xds/archive/e9ce68804cb4e64cab5a52e3c8baf840d4ff87b7.tar.gz",
+                "https://github.com/cncf/xds/archive/e9ce68804cb4e64cab5a52e3c8baf840d4ff87b7.tar.gz",
            ],
        )

--- a/bazel/grpc_python_deps.bzl
+++ b/bazel/grpc_python_deps.bzl
@ -39,9 +39,9 @@ def grpc_python_deps():
        http_archive(
            name = "cython",
            build_file = "@com_github_grpc_grpc//third_party:cython.BUILD",
-            sha256 = "bb72b2f0ef029472759c711f0a4bded6e15e3f9bda3797550cef3c1d87d02283",
-            strip_prefix = "cython-0.29.26",
+            sha256 = "a2da56cc22be823acf49741b9aa3aa116d4f07fa8e8b35a3cb08b8447b37c607",
+            strip_prefix = "cython-0.29.35",
            urls = [
-                "https://github.com/cython/cython/archive/0.29.26.tar.gz",
+                "https://github.com/cython/cython/archive/0.29.35.tar.gz",
            ],
        )
--- a/build_autogenerated.yaml
+++ b/build_autogenerated.yaml
@ -299,6 +299,7 @@ libs:
  - src/core/ext/transport/chttp2/transport/hpack_constants.h
  - src/core/ext/transport/chttp2/transport/hpack_encoder.h
  - src/core/ext/transport/chttp2/transport/hpack_encoder_table.h
+  - src/core/ext/transport/chttp2/transport/hpack_parse_result.h
  - src/core/ext/transport/chttp2/transport/hpack_parser.h
  - src/core/ext/transport/chttp2/transport/hpack_parser_table.h
  - src/core/ext/transport/chttp2/transport/http2_settings.h
@ -1107,6 +1108,7 @@ libs:
  - src/core/ext/transport/chttp2/transport/frame_window_update.cc
  - src/core/ext/transport/chttp2/transport/hpack_encoder.cc
  - src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc
+  - src/core/ext/transport/chttp2/transport/hpack_parse_result.cc
  - src/core/ext/transport/chttp2/transport/hpack_parser.cc
  - src/core/ext/transport/chttp2/transport/hpack_parser_table.cc
  - src/core/ext/transport/chttp2/transport/http2_settings.cc
@ -1999,6 +2001,7 @@ libs:
  - src/core/ext/transport/chttp2/transport/hpack_constants.h
  - src/core/ext/transport/chttp2/transport/hpack_encoder.h
  - src/core/ext/transport/chttp2/transport/hpack_encoder_table.h
+  - src/core/ext/transport/chttp2/transport/hpack_parse_result.h
  - src/core/ext/transport/chttp2/transport/hpack_parser.h
  - src/core/ext/transport/chttp2/transport/hpack_parser_table.h
  - src/core/ext/transport/chttp2/transport/http2_settings.h
@ -2412,6 +2415,7 @@ libs:
  - src/core/ext/transport/chttp2/transport/frame_window_update.cc
  - src/core/ext/transport/chttp2/transport/hpack_encoder.cc
  - src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc
+  - src/core/ext/transport/chttp2/transport/hpack_parse_result.cc
  - src/core/ext/transport/chttp2/transport/hpack_parser.cc
  - src/core/ext/transport/chttp2/transport/hpack_parser_table.cc
  - src/core/ext/transport/chttp2/transport/http2_settings.cc
@ -7457,6 +7461,7 @@ targets:
  - src/core/ext/transport/chttp2/transport/hpack_constants.h
  - src/core/ext/transport/chttp2/transport/hpack_encoder.h
  - src/core/ext/transport/chttp2/transport/hpack_encoder_table.h
+  - src/core/ext/transport/chttp2/transport/hpack_parse_result.h
  - src/core/ext/transport/chttp2/transport/hpack_parser.h
  - src/core/ext/transport/chttp2/transport/hpack_parser_table.h
  - src/core/ext/transport/chttp2/transport/http_trace.h
@ -7737,6 +7742,7 @@ targets:
  - src/core/ext/transport/chttp2/transport/decode_huff.cc
  - src/core/ext/transport/chttp2/transport/hpack_encoder.cc
  - src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc
+  - src/core/ext/transport/chttp2/transport/hpack_parse_result.cc
  - src/core/ext/transport/chttp2/transport/hpack_parser.cc
  - src/core/ext/transport/chttp2/transport/hpack_parser_table.cc
  - src/core/ext/transport/chttp2/transport/http_trace.cc
@ -14092,10 +14098,10 @@ external_proto_libraries:
  - https://storage.googleapis.com/grpc-bazel-mirror/github.com/census-instrumentation/opencensus-proto/archive/v0.3.0.tar.gz
  - https://github.com/census-instrumentation/opencensus-proto/archive/v0.3.0.tar.gz
 - destination: third_party/xds
-  hash: aef36c29bd0ef95509f7f52693dbdafe4a2c2c5d1eb406bf68e6364a0d12e11b
+  hash: 0d33b83f8c6368954e72e7785539f0d272a8aba2f6e2e336ed15fd1514bc9899
  proto_prefix: third_party/xds/
-  strip_prefix: xds-4003588d1b747e37e911baa5a9c1c07fde4ca518
+  strip_prefix: xds-e9ce68804cb4e64cab5a52e3c8baf840d4ff87b7
  urls:
-  - https://storage.googleapis.com/grpc-bazel-mirror/github.com/cncf/xds/archive/4003588d1b747e37e911baa5a9c1c07fde4ca518.tar.gz
-  - https://github.com/cncf/xds/archive/4003588d1b747e37e911baa5a9c1c07fde4ca518.tar.gz
+  - https://storage.googleapis.com/grpc-bazel-mirror/github.com/cncf/xds/archive/e9ce68804cb4e64cab5a52e3c8baf840d4ff87b7.tar.gz
+  - https://github.com/cncf/xds/archive/e9ce68804cb4e64cab5a52e3c8baf840d4ff87b7.tar.gz
 tests: []
--- a/build_handwritten.yaml
+++ b/build_handwritten.yaml
@ -16,7 +16,7 @@ settings:
  csharp_major_version: 2
  g_stands_for: galvanized
  protobuf_version: 3.23.1
-  version: 1.56.0-dev
+  version: 1.56.4
 configs:
  asan:
    CC: clang
--- a/config.m4
+++ b/config.m4
@ -137,6 +137,7 @@ if test "$PHP_GRPC" != "no"; then
    src/core/ext/transport/chttp2/transport/frame_window_update.cc \
    src/core/ext/transport/chttp2/transport/hpack_encoder.cc \
    src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc \
+    src/core/ext/transport/chttp2/transport/hpack_parse_result.cc \
    src/core/ext/transport/chttp2/transport/hpack_parser.cc \
    src/core/ext/transport/chttp2/transport/hpack_parser_table.cc \
    src/core/ext/transport/chttp2/transport/http2_settings.cc \
@ -1318,7 +1319,7 @@ if test "$PHP_GRPC" != "no"; then
    -D_HAS_EXCEPTIONS=0 -DNOMINMAX -DGRPC_ARES=0 \
    -DGRPC_POSIX_FORK_ALLOW_PTHREAD_ATFORK=1 \
    -DGRPC_XDS_USER_AGENT_NAME_SUFFIX='"\"PHP\""' \
-    -DGRPC_XDS_USER_AGENT_VERSION_SUFFIX='"\"1.56.0dev\""')
+    -DGRPC_XDS_USER_AGENT_VERSION_SUFFIX='"\"1.56.4\""')

  PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/backend_metrics)
  PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/census)
--- a/config.w32
+++ b/config.w32
@ -102,6 +102,7 @@ if (PHP_GRPC != "no") {
    "src\\core\\ext\\transport\\chttp2\\transport\\frame_window_update.cc " +
    "src\\core\\ext\\transport\\chttp2\\transport\\hpack_encoder.cc " +
    "src\\core\\ext\\transport\\chttp2\\transport\\hpack_encoder_table.cc " +
+    "src\\core\\ext\\transport\\chttp2\\transport\\hpack_parse_result.cc " +
    "src\\core\\ext\\transport\\chttp2\\transport\\hpack_parser.cc " +
    "src\\core\\ext\\transport\\chttp2\\transport\\hpack_parser_table.cc " +
    "src\\core\\ext\\transport\\chttp2\\transport\\http2_settings.cc " +
--- a/doc/g_stands_for.md
+++ b/doc/g_stands_for.md
@ -55,4 +55,4 @@
 - 1.53 'g' stands for ['glockenspiel'](https://github.com/grpc/grpc/tree/v1.53.x)
 - 1.54 'g' stands for ['gracious'](https://github.com/grpc/grpc/tree/v1.54.x)
 - 1.55 'g' stands for ['grandslam'](https://github.com/grpc/grpc/tree/v1.55.x)
- 1.56 'g' stands for ['galvanized'](https://github.com/grpc/grpc/tree/master)
+- 1.56 'g' stands for ['galvanized'](https://github.com/grpc/grpc/tree/v1.56.x)
--- a/gRPC-C++.podspec
+++ b/gRPC-C++.podspec
@ -22,7 +22,7 @@
 Pod::Spec.new do |s|
  s.name     = 'gRPC-C++'
  # TODO (mxyan): use version that match gRPC version when pod is stabilized
-  version = '1.56.0-dev'
+  version = '1.56.4'
  s.version  = version
  s.summary  = 'gRPC C++ library'
  s.homepage = 'https://grpc.io'
@ -368,6 +368,7 @@ Pod::Spec.new do |s|
                      'src/core/ext/transport/chttp2/transport/hpack_constants.h',
                      'src/core/ext/transport/chttp2/transport/hpack_encoder.h',
                      'src/core/ext/transport/chttp2/transport/hpack_encoder_table.h',
+                      'src/core/ext/transport/chttp2/transport/hpack_parse_result.h',
                      'src/core/ext/transport/chttp2/transport/hpack_parser.h',
                      'src/core/ext/transport/chttp2/transport/hpack_parser_table.h',
                      'src/core/ext/transport/chttp2/transport/http2_settings.h',
@ -1406,6 +1407,7 @@ Pod::Spec.new do |s|
                              'src/core/ext/transport/chttp2/transport/hpack_constants.h',
                              'src/core/ext/transport/chttp2/transport/hpack_encoder.h',
                              'src/core/ext/transport/chttp2/transport/hpack_encoder_table.h',
+                              'src/core/ext/transport/chttp2/transport/hpack_parse_result.h',
                              'src/core/ext/transport/chttp2/transport/hpack_parser.h',
                              'src/core/ext/transport/chttp2/transport/hpack_parser_table.h',
                              'src/core/ext/transport/chttp2/transport/http2_settings.h',
--- a/gRPC-Core.podspec
+++ b/gRPC-Core.podspec
@ -21,7 +21,7 @@

 Pod::Spec.new do |s|
  s.name     = 'gRPC-Core'
-  version = '1.56.0-dev'
+  version = '1.56.4'
  s.version  = version
  s.summary  = 'Core cross-platform gRPC library, written in C'
  s.homepage = 'https://grpc.io'
@ -394,6 +394,8 @@ Pod::Spec.new do |s|
                      'src/core/ext/transport/chttp2/transport/hpack_encoder.h',
                      'src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc',
                      'src/core/ext/transport/chttp2/transport/hpack_encoder_table.h',
+                      'src/core/ext/transport/chttp2/transport/hpack_parse_result.cc',
+                      'src/core/ext/transport/chttp2/transport/hpack_parse_result.h',
                      'src/core/ext/transport/chttp2/transport/hpack_parser.cc',
                      'src/core/ext/transport/chttp2/transport/hpack_parser.h',
                      'src/core/ext/transport/chttp2/transport/hpack_parser_table.cc',
@ -2133,6 +2135,7 @@ Pod::Spec.new do |s|
                              'src/core/ext/transport/chttp2/transport/hpack_constants.h',
                              'src/core/ext/transport/chttp2/transport/hpack_encoder.h',
                              'src/core/ext/transport/chttp2/transport/hpack_encoder_table.h',
+                              'src/core/ext/transport/chttp2/transport/hpack_parse_result.h',
                              'src/core/ext/transport/chttp2/transport/hpack_parser.h',
                              'src/core/ext/transport/chttp2/transport/hpack_parser_table.h',
                              'src/core/ext/transport/chttp2/transport/http2_settings.h',
--- a/gRPC-ProtoRPC.podspec
+++ b/gRPC-ProtoRPC.podspec
@ -21,7 +21,7 @@

 Pod::Spec.new do |s|
  s.name     = 'gRPC-ProtoRPC'
-  version = '1.56.0-dev'
+  version = '1.56.4'
  s.version  = version
  s.summary  = 'RPC library for Protocol Buffers, based on gRPC'
  s.homepage = 'https://grpc.io'
--- a/gRPC-RxLibrary.podspec
+++ b/gRPC-RxLibrary.podspec
@ -21,7 +21,7 @@

 Pod::Spec.new do |s|
  s.name     = 'gRPC-RxLibrary'
-  version = '1.56.0-dev'
+  version = '1.56.4'
  s.version  = version
  s.summary  = 'Reactive Extensions library for iOS/OSX.'
  s.homepage = 'https://grpc.io'
--- a/gRPC.podspec
+++ b/gRPC.podspec
@ -20,7 +20,7 @@

 Pod::Spec.new do |s|
  s.name     = 'gRPC'
-  version = '1.56.0-dev'
+  version = '1.56.4'
  s.version  = version
  s.summary  = 'gRPC client library for iOS/OSX'
  s.homepage = 'https://grpc.io'
--- a/grpc.def
+++ b/grpc.def
@ -157,6 +157,8 @@ EXPORTS
    grpc_tls_certificate_provider_file_watcher_create
    grpc_tls_certificate_provider_release
    grpc_tls_credentials_options_create
+    grpc_tls_credentials_options_set_min_tls_version
+    grpc_tls_credentials_options_set_max_tls_version
    grpc_tls_credentials_options_set_certificate_provider
    grpc_tls_credentials_options_watch_root_certs
    grpc_tls_credentials_options_set_root_cert_name
@ -165,6 +167,7 @@ EXPORTS
    grpc_tls_credentials_options_set_cert_request_type
    grpc_tls_credentials_options_set_crl_directory
    grpc_tls_credentials_options_set_verify_server_cert
+    grpc_tls_credentials_options_set_send_client_ca_list
    grpc_tls_credentials_options_set_check_call_host
    grpc_insecure_credentials_create
    grpc_insecure_server_credentials_create
--- a/grpc.gemspec
+++ b/grpc.gemspec
@ -300,6 +300,8 @@ Gem::Specification.new do |s|
  s.files += %w( src/core/ext/transport/chttp2/transport/hpack_encoder.h )
  s.files += %w( src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc )
  s.files += %w( src/core/ext/transport/chttp2/transport/hpack_encoder_table.h )
+  s.files += %w( src/core/ext/transport/chttp2/transport/hpack_parse_result.cc )
+  s.files += %w( src/core/ext/transport/chttp2/transport/hpack_parse_result.h )
  s.files += %w( src/core/ext/transport/chttp2/transport/hpack_parser.cc )
  s.files += %w( src/core/ext/transport/chttp2/transport/hpack_parser.h )
  s.files += %w( src/core/ext/transport/chttp2/transport/hpack_parser_table.cc )
@ -2620,8 +2622,11 @@ Gem::Specification.new do |s|
  s.files += %w( third_party/cares/ares_build.h )
  s.files += %w( third_party/cares/cares/include/ares.h )
  s.files += %w( third_party/cares/cares/include/ares_dns.h )
+  s.files += %w( third_party/cares/cares/include/ares_nameser.h )
  s.files += %w( third_party/cares/cares/include/ares_rules.h )
  s.files += %w( third_party/cares/cares/include/ares_version.h )
+  s.files += %w( third_party/cares/cares/src/lib/ares__addrinfo2hostent.c )
+  s.files += %w( third_party/cares/cares/src/lib/ares__addrinfo_localhost.c )
  s.files += %w( third_party/cares/cares/src/lib/ares__close_sockets.c )
  s.files += %w( third_party/cares/cares/src/lib/ares__get_hostent.c )
  s.files += %w( third_party/cares/cares/src/lib/ares__parse_into_addrinfo.c )
@ -2654,11 +2659,9 @@ Gem::Specification.new do |s|
  s.files += %w( third_party/cares/cares/src/lib/ares_iphlpapi.h )
  s.files += %w( third_party/cares/cares/src/lib/ares_ipv6.h )
  s.files += %w( third_party/cares/cares/src/lib/ares_library_init.c )
-  s.files += %w( third_party/cares/cares/src/lib/ares_library_init.h )
  s.files += %w( third_party/cares/cares/src/lib/ares_llist.c )
  s.files += %w( third_party/cares/cares/src/lib/ares_llist.h )
  s.files += %w( third_party/cares/cares/src/lib/ares_mkquery.c )
-  s.files += %w( third_party/cares/cares/src/lib/ares_nameser.h )
  s.files += %w( third_party/cares/cares/src/lib/ares_nowarn.c )
  s.files += %w( third_party/cares/cares/src/lib/ares_nowarn.h )
  s.files += %w( third_party/cares/cares/src/lib/ares_options.c )
@ -2672,11 +2675,13 @@ Gem::Specification.new do |s|
  s.files += %w( third_party/cares/cares/src/lib/ares_parse_soa_reply.c )
  s.files += %w( third_party/cares/cares/src/lib/ares_parse_srv_reply.c )
  s.files += %w( third_party/cares/cares/src/lib/ares_parse_txt_reply.c )
+  s.files += %w( third_party/cares/cares/src/lib/ares_parse_uri_reply.c )
  s.files += %w( third_party/cares/cares/src/lib/ares_platform.c )
  s.files += %w( third_party/cares/cares/src/lib/ares_platform.h )
  s.files += %w( third_party/cares/cares/src/lib/ares_private.h )
  s.files += %w( third_party/cares/cares/src/lib/ares_process.c )
  s.files += %w( third_party/cares/cares/src/lib/ares_query.c )
+  s.files += %w( third_party/cares/cares/src/lib/ares_rand.c )
  s.files += %w( third_party/cares/cares/src/lib/ares_search.c )
  s.files += %w( third_party/cares/cares/src/lib/ares_send.c )
  s.files += %w( third_party/cares/cares/src/lib/ares_setup.h )
@ -2699,6 +2704,7 @@ Gem::Specification.new do |s|
  s.files += %w( third_party/cares/cares/src/lib/inet_ntop.c )
  s.files += %w( third_party/cares/cares/src/lib/setup_once.h )
  s.files += %w( third_party/cares/cares/src/lib/windows_port.c )
+  s.files += %w( third_party/cares/cares/src/tools/ares_getopt.h )
  s.files += %w( third_party/cares/config_darwin/ares_config.h )
  s.files += %w( third_party/cares/config_freebsd/ares_config.h )
  s.files += %w( third_party/cares/config_linux/ares_config.h )
--- a/grpc.gyp
+++ b/grpc.gyp
@ -361,6 +361,7 @@
        'src/core/ext/transport/chttp2/transport/frame_window_update.cc',
        'src/core/ext/transport/chttp2/transport/hpack_encoder.cc',
        'src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc',
+        'src/core/ext/transport/chttp2/transport/hpack_parse_result.cc',
        'src/core/ext/transport/chttp2/transport/hpack_parser.cc',
        'src/core/ext/transport/chttp2/transport/hpack_parser_table.cc',
        'src/core/ext/transport/chttp2/transport/http2_settings.cc',
@ -1173,6 +1174,7 @@
        'src/core/ext/transport/chttp2/transport/frame_window_update.cc',
        'src/core/ext/transport/chttp2/transport/hpack_encoder.cc',
        'src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc',
+        'src/core/ext/transport/chttp2/transport/hpack_parse_result.cc',
        'src/core/ext/transport/chttp2/transport/hpack_parser.cc',
        'src/core/ext/transport/chttp2/transport/hpack_parser_table.cc',
        'src/core/ext/transport/chttp2/transport/http2_settings.cc',
--- a/include/grpc/grpc_security.h
+++ b/include/grpc/grpc_security.h
@ -21,6 +21,8 @@

 #include <grpc/support/port_platform.h>

+#include <stdbool.h>
+
 #include <grpc/grpc.h>
 #include <grpc/grpc_security_constants.h>
 #include <grpc/status.h>
@ -813,6 +815,24 @@ GRPCAPI void grpc_tls_certificate_provider_release(
 */
 GRPCAPI grpc_tls_credentials_options* grpc_tls_credentials_options_create(void);

+/**
+ * EXPERIMENTAL API - Subject to change
+ *
+ * Sets the minimum TLS version that will be negotiated during the TLS
+ * handshake. If not set, the underlying SSL library will set it to TLS v1.2.
+ */
+GRPCAPI void grpc_tls_credentials_options_set_min_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version min_tls_version);
+
+/**
+ * EXPERIMENTAL API - Subject to change
+ *
+ * Sets the maximum TLS version that will be negotiated during the TLS
+ * handshake. If not set, the underlying SSL library will set it to TLS v1.3.
+ */
+GRPCAPI void grpc_tls_credentials_options_set_max_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version max_tls_version);
+
 /**
 * EXPERIMENTAL API - Subject to change
 *
@ -896,6 +916,23 @@ GRPCAPI void grpc_tls_credentials_options_set_crl_directory(
 GRPCAPI void grpc_tls_credentials_options_set_verify_server_cert(
    grpc_tls_credentials_options* options, int verify_server_cert);

+/**
+ * EXPERIMENTAL API - Subject to change
+ *
+ * Sets whether or not a TLS server should send a list of CA names in the
+ * ServerHello. This list of CA names is read from the server's trust bundle, so
+ * that the client can use this list as a hint to know which certificate it
+ * should send to the server.
+ *
+ * WARNING: This API is extremely dangerous and should not be used. If the
+ * server's trust bundle is too large, then the TLS server will be unable to
+ * form a ServerHello, and hence will be unusable. The definition of "too large"
+ * depends on the underlying SSL library being used and on the size of the CN
+ * fields of the certificates in the trust bundle.
+ */
+GRPCAPI void grpc_tls_credentials_options_set_send_client_ca_list(
+    grpc_tls_credentials_options* options, bool send_client_ca_list);
+
 /**
 * EXPERIMENTAL API - Subject to change
 *
--- a/include/grpcpp/ext/call_metric_recorder.h
+++ b/include/grpcpp/ext/call_metric_recorder.h
@ -50,6 +50,14 @@ class CallMetricRecorder {
  /// Values outside of the valid range [0, 1] are ignored.
  virtual CallMetricRecorder& RecordMemoryUtilizationMetric(double value) = 0;

+  /// Records a call metric measurement for application specific utilization.
+  /// Multiple calls to this method will override the stored value.
+  /// Values may be larger than 1.0 when the usage exceeds the reporter
+  /// dependent notion of soft limits.
+  /// Values outside of the valid range [0, infy] are ignored.
+  virtual CallMetricRecorder& RecordApplicationUtilizationMetric(
+      double value) = 0;
+
  /// Records a call metric measurement for queries per second.
  /// Multiple calls to this method will override the stored value.
  /// Values outside of the valid range [0, infy) are ignored.
--- a/include/grpcpp/ext/server_metric_recorder.h
+++ b/include/grpcpp/ext/server_metric_recorder.h
@ -52,6 +52,10 @@ class ServerMetricRecorder {
  /// Values outside of the valid range are rejected.
  /// Overrides the stored value when called again with a valid value.
  void SetMemoryUtilization(double value);
+  /// Records the application specific utilization in the range [0, infy].
+  /// Values outside of the valid range are rejected.
+  /// Overrides the stored value when called again with a valid value.
+  void SetApplicationUtilization(double value);
  /// Records number of queries per second to the server in the range [0, infy).
  /// Values outside of the valid range are rejected.
  /// Overrides the stored value when called again with a valid value.
@ -77,6 +81,8 @@ class ServerMetricRecorder {
  void ClearCpuUtilization();
  /// Clears the server memory utilization if recorded.
  void ClearMemoryUtilization();
+  /// Clears the application specific utilization if recorded.
+  void ClearApplicationUtilization();
  /// Clears number of queries per second to the server if recorded.
  void ClearQps();
  /// Clears number of errors per second to the server if recorded.
--- a/include/grpcpp/security/tls_credentials_options.h
+++ b/include/grpcpp/security/tls_credentials_options.h
@ -104,6 +104,15 @@ class TlsCredentialsOptions {
  // version > 1.1.
  void set_crl_directory(const std::string& path);

+  // Sets the minimum TLS version that will be negotiated during the TLS
+  // handshake. If not set, the underlying SSL library will use TLS v1.2.
+  // @param tls_version: The minimum TLS version.
+  void set_min_tls_version(grpc_tls_version tls_version);
+  // Sets the maximum TLS version that will be negotiated during the TLS
+  // handshake. If not set, the underlying SSL library will use TLS v1.3.
+  // @param tls_version: The maximum TLS version.
+  void set_max_tls_version(grpc_tls_version tls_version);
+
  // ----- Getters for member fields ----
  // Get the internal c options. This function shall be used only internally.
  grpc_tls_credentials_options* c_credentials_options() const {
@ -148,6 +157,18 @@ class TlsServerCredentialsOptions final : public TlsCredentialsOptions {
  void set_cert_request_type(
      grpc_ssl_client_certificate_request_type cert_request_type);

+  // Sets whether or not a TLS server should send a list of CA names in the
+  // ServerHello. This list of CA names is read from the server's trust bundle,
+  // so that the client can use this list as a hint to know which certificate it
+  // should send to the server.
+  //
+  // By default, this option is turned off.
+  //
+  // WARNING: This API is extremely dangerous and should not be used. If the
+  // server's trust bundle is too large, then the TLS server will be unable to
+  // form a ServerHello, and hence will be unusable.
+  void set_send_client_ca_list(bool send_client_ca_list);
+
 private:
 };

--- a/include/grpcpp/support/proto_buffer_reader.h
+++ b/include/grpcpp/support/proto_buffer_reader.h
@ -185,10 +185,17 @@ class ProtoBufferReader : public grpc::protobuf::io::ZeroCopyInputStream {
  // This function takes ownership of slice and return a newly created Cord off
  // of it.
  static absl::Cord MakeCordFromSlice(grpc_slice slice) {
+    // slice_for_cord is created to keep inlined data of the given slice
+    grpc_slice* slice_for_cord = new grpc_slice;
+    *slice_for_cord = slice;
    return absl::MakeCordFromExternal(
-        absl::string_view(reinterpret_cast<char*>(GRPC_SLICE_START_PTR(slice)),
-                          GRPC_SLICE_LENGTH(slice)),
-        [slice](absl::string_view view) { grpc_slice_unref(slice); });
+        absl::string_view(
+            reinterpret_cast<char*>(GRPC_SLICE_START_PTR(*slice_for_cord)),
+            GRPC_SLICE_LENGTH(*slice_for_cord)),
+        [slice_for_cord](absl::string_view /* view */) {
+          grpc_slice_unref(*slice_for_cord);
+          delete slice_for_cord;
+        });
  }
 #endif  // GRPC_PROTOBUF_CORD_SUPPORT_ENABLED

--- a/include/grpcpp/version_info.h
+++ b/include/grpcpp/version_info.h
@ -20,8 +20,8 @@

 #define GRPC_CPP_VERSION_MAJOR 1
 #define GRPC_CPP_VERSION_MINOR 56
-#define GRPC_CPP_VERSION_PATCH 0
-#define GRPC_CPP_VERSION_TAG "dev"
-#define GRPC_CPP_VERSION_STRING "1.56.0-dev"
+#define GRPC_CPP_VERSION_PATCH 4
+#define GRPC_CPP_VERSION_TAG ""
+#define GRPC_CPP_VERSION_STRING "1.56.4"

 #endif  // GRPCPP_VERSION_INFO_H
--- a/package.xml
+++ b/package.xml
@ -13,16 +13,16 @@
 <date>2019-09-24</date>
 <time>16:06:07</time>
 <version>
-  <release>1.56.0dev</release>
-  <api>1.56.0dev</api>
+  <release>1.56.4</release>
+  <api>1.56.4</api>
 </version>
 <stability>
-  <release>beta</release>
-  <api>beta</api>
+  <release>stable</release>
+  <api>stable</api>
 </stability>
 <license>Apache 2.0</license>
 <notes>
- gRPC Core 1.56.0 update
+- gRPC Core 1.56.4 update
 </notes>
 <contents>
  <dir baseinstalldir="/" name="/">
@ -282,6 +282,8 @@
    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/hpack_encoder.h" role="src" />
    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc" role="src" />
    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/hpack_encoder_table.h" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/hpack_parse_result.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/hpack_parse_result.h" role="src" />
    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/hpack_parser.cc" role="src" />
    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/hpack_parser.h" role="src" />
    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/hpack_parser_table.cc" role="src" />
--- a/requirements.bazel.txt
+++ b/requirements.bazel.txt
@ -11,7 +11,7 @@ chardet==3.0.4
 certifi==2017.4.17
 idna==2.7
 googleapis-common-protos==1.5.5
-gevent==21.12.0
+gevent==22.08.0
 zope.event==4.5.0
 setuptools==44.1.1
 xds-protos==0.0.11
--- a/requirements.txt
+++ b/requirements.txt
@ -1,5 +1,5 @@
 # GRPC Python setup requirements
 coverage>=4.0
-cython>=0.29.8
+cython>=0.29.8,<3.0.0rc1
 protobuf>=4.21.3,<5.0dev
 wheel>=0.29
--- a/setup.py
+++ b/setup.py
@ -508,8 +508,8 @@ except ImportError:
            "other commands, but the extension files will fail to build.\n")
    elif need_cython:
        sys.stderr.write(
-            'We could not find Cython. Setup may take 10-20 minutes.\n')
-        SETUP_REQUIRES += ('cython>=0.23',)
+            "We could not find Cython. Setup may take 10-20 minutes.\n")
+        SETUP_REQUIRES += ("cython>=0.23,<3.0.0rc1",)

 COMMAND_CLASS = {
    'doc': commands.SphinxDocumentation,
--- a/src/c-ares/gen_build_yaml.py
+++ b/src/c-ares/gen_build_yaml.py
@ -61,62 +61,66 @@ try:
        'secure':
            False,
        'src': [
-            "third_party/cares/cares/src/lib/ares_init.c",
-            "third_party/cares/cares/src/lib/ares_expand_string.c",
-            "third_party/cares/cares/src/lib/ares_strcasecmp.c",
-            "third_party/cares/cares/src/lib/ares_destroy.c",
-            "third_party/cares/cares/src/lib/ares_free_string.c",
-            "third_party/cares/cares/src/lib/ares__timeval.c",
-            "third_party/cares/cares/src/lib/ares_library_init.c",
-            "third_party/cares/cares/src/lib/ares_getsock.c",
-            "third_party/cares/cares/src/lib/ares_process.c",
-            "third_party/cares/cares/src/lib/ares_create_query.c",
-            "third_party/cares/cares/src/lib/ares_fds.c",
-            "third_party/cares/cares/src/lib/ares_gethostbyname.c",
-            "third_party/cares/cares/src/lib/ares_mkquery.c",
-            "third_party/cares/cares/src/lib/ares_freeaddrinfo.c",
-            "third_party/cares/cares/src/lib/ares_strdup.c",
-            "third_party/cares/cares/src/lib/ares_timeout.c",
-            "third_party/cares/cares/src/lib/ares_getnameinfo.c",
-            "third_party/cares/cares/src/lib/ares_parse_soa_reply.c",
-            "third_party/cares/cares/src/lib/ares_parse_naptr_reply.c",
-            "third_party/cares/cares/src/lib/ares_parse_a_reply.c",
-            "third_party/cares/cares/src/lib/ares_send.c",
-            "third_party/cares/cares/src/lib/ares_nowarn.c",
-            "third_party/cares/cares/src/lib/ares__sortaddrinfo.c",
-            "third_party/cares/cares/src/lib/ares_android.c",
-            "third_party/cares/cares/src/lib/ares_strerror.c",
-            "third_party/cares/cares/src/lib/ares_parse_caa_reply.c",
-            "third_party/cares/cares/src/lib/ares__close_sockets.c",
-            "third_party/cares/cares/src/lib/ares_llist.c",
-            "third_party/cares/cares/src/lib/ares_parse_aaaa_reply.c",
-            "third_party/cares/cares/src/lib/ares_getaddrinfo.c",
-            "third_party/cares/cares/src/lib/ares_parse_ns_reply.c",
-            "third_party/cares/cares/src/lib/windows_port.c",
-            "third_party/cares/cares/src/lib/bitncmp.c",
-            "third_party/cares/cares/src/lib/ares_strsplit.c",
-            "third_party/cares/cares/src/lib/ares_data.c",
-            "third_party/cares/cares/src/lib/ares_free_hostent.c",
-            "third_party/cares/cares/src/lib/ares_platform.c",
-            "third_party/cares/cares/src/lib/ares_parse_txt_reply.c",
-            "third_party/cares/cares/src/lib/ares__parse_into_addrinfo.c",
-            "third_party/cares/cares/src/lib/ares_gethostbyaddr.c",
-            "third_party/cares/cares/src/lib/ares_parse_srv_reply.c",
-            "third_party/cares/cares/src/lib/ares_version.c",
-            "third_party/cares/cares/src/lib/ares_getenv.c",
-            "third_party/cares/cares/src/lib/ares_search.c",
-            "third_party/cares/cares/src/lib/ares_parse_mx_reply.c",
-            "third_party/cares/cares/src/lib/ares__get_hostent.c",
-            "third_party/cares/cares/src/lib/ares__readaddrinfo.c",
-            "third_party/cares/cares/src/lib/ares_parse_ptr_reply.c",
            "third_party/cares/cares/src/lib/ares__read_line.c",
-            "third_party/cares/cares/src/lib/ares_query.c",
-            "third_party/cares/cares/src/lib/ares_options.c",
-            "third_party/cares/cares/src/lib/inet_net_pton.c",
-            "third_party/cares/cares/src/lib/ares_expand_name.c",
-            "third_party/cares/cares/src/lib/inet_ntop.c",
+            "third_party/cares/cares/src/lib/ares__get_hostent.c",
+            "third_party/cares/cares/src/lib/ares__close_sockets.c",
+            "third_party/cares/cares/src/lib/ares__timeval.c",
+            "third_party/cares/cares/src/lib/ares_gethostbyaddr.c",
+            "third_party/cares/cares/src/lib/ares_getenv.c",
+            "third_party/cares/cares/src/lib/ares_free_string.c",
+            "third_party/cares/cares/src/lib/ares_free_hostent.c",
+            "third_party/cares/cares/src/lib/ares_fds.c",
+            "third_party/cares/cares/src/lib/ares_expand_string.c",
+            "third_party/cares/cares/src/lib/ares_create_query.c",
            "third_party/cares/cares/src/lib/ares_cancel.c",
+            "third_party/cares/cares/src/lib/ares_android.c",
+            "third_party/cares/cares/src/lib/ares_parse_txt_reply.c",
+            "third_party/cares/cares/src/lib/ares_parse_srv_reply.c",
+            "third_party/cares/cares/src/lib/ares_parse_soa_reply.c",
+            "third_party/cares/cares/src/lib/ares_parse_ptr_reply.c",
+            "third_party/cares/cares/src/lib/ares_parse_ns_reply.c",
+            "third_party/cares/cares/src/lib/ares_parse_naptr_reply.c",
+            "third_party/cares/cares/src/lib/ares_parse_mx_reply.c",
+            "third_party/cares/cares/src/lib/ares_parse_caa_reply.c",
+            "third_party/cares/cares/src/lib/ares_options.c",
+            "third_party/cares/cares/src/lib/ares_nowarn.c",
+            "third_party/cares/cares/src/lib/ares_mkquery.c",
+            "third_party/cares/cares/src/lib/ares_llist.c",
+            "third_party/cares/cares/src/lib/ares_getsock.c",
+            "third_party/cares/cares/src/lib/ares_getnameinfo.c",
+            "third_party/cares/cares/src/lib/bitncmp.c",
            "third_party/cares/cares/src/lib/ares_writev.c",
+            "third_party/cares/cares/src/lib/ares_version.c",
+            "third_party/cares/cares/src/lib/ares_timeout.c",
+            "third_party/cares/cares/src/lib/ares_strerror.c",
+            "third_party/cares/cares/src/lib/ares_strcasecmp.c",
+            "third_party/cares/cares/src/lib/ares_search.c",
+            "third_party/cares/cares/src/lib/ares_platform.c",
+            "third_party/cares/cares/src/lib/windows_port.c",
+            "third_party/cares/cares/src/lib/inet_ntop.c",
+            "third_party/cares/cares/src/lib/ares__sortaddrinfo.c",
+            "third_party/cares/cares/src/lib/ares__readaddrinfo.c",
+            "third_party/cares/cares/src/lib/ares_parse_uri_reply.c",
+            "third_party/cares/cares/src/lib/ares__parse_into_addrinfo.c",
+            "third_party/cares/cares/src/lib/ares_parse_a_reply.c",
+            "third_party/cares/cares/src/lib/ares_parse_aaaa_reply.c",
+            "third_party/cares/cares/src/lib/ares_library_init.c",
+            "third_party/cares/cares/src/lib/ares_init.c",
+            "third_party/cares/cares/src/lib/ares_gethostbyname.c",
+            "third_party/cares/cares/src/lib/ares_getaddrinfo.c",
+            "third_party/cares/cares/src/lib/ares_freeaddrinfo.c",
+            "third_party/cares/cares/src/lib/ares_expand_name.c",
+            "third_party/cares/cares/src/lib/ares_destroy.c",
+            "third_party/cares/cares/src/lib/ares_data.c",
+            "third_party/cares/cares/src/lib/ares__addrinfo_localhost.c",
+            "third_party/cares/cares/src/lib/ares__addrinfo2hostent.c",
+            "third_party/cares/cares/src/lib/inet_net_pton.c",
+            "third_party/cares/cares/src/lib/ares_strsplit.c",
+            "third_party/cares/cares/src/lib/ares_strdup.c",
+            "third_party/cares/cares/src/lib/ares_send.c",
+            "third_party/cares/cares/src/lib/ares_rand.c",
+            "third_party/cares/cares/src/lib/ares_query.c",
+            "third_party/cares/cares/src/lib/ares_process.c",
        ],
        'headers': [
            "third_party/cares/ares_build.h",
@ -124,31 +128,31 @@ try:
            "third_party/cares/cares/include/ares.h",
            "third_party/cares/cares/include/ares_rules.h",
            "third_party/cares/cares/include/ares_dns.h",
-            "third_party/cares/cares/src/lib/ares_data.h",
+            "third_party/cares/cares/include/ares_nameser.h",
+            "third_party/cares/cares/src/tools/ares_getopt.h",
            "third_party/cares/cares/src/lib/ares_strsplit.h",
-            "third_party/cares/cares/src/lib/bitncmp.h",
-            "third_party/cares/cares/src/lib/ares_iphlpapi.h",
-            "third_party/cares/cares/src/lib/ares_inet_net_pton.h",
-            "third_party/cares/cares/src/lib/ares_getenv.h",
-            "third_party/cares/cares/src/lib/ares_platform.h",
-            "third_party/cares/cares/src/lib/ares_writev.h",
+            "third_party/cares/cares/src/lib/ares_android.h",
            "third_party/cares/cares/src/lib/ares_private.h",
-            "third_party/cares/cares/src/lib/ares_setup.h",
-            "third_party/cares/cares/src/lib/config-win32.h",
+            "third_party/cares/cares/src/lib/ares_llist.h",
+            "third_party/cares/cares/src/lib/ares_platform.h",
+            "third_party/cares/cares/src/lib/ares_ipv6.h",
+            "third_party/cares/cares/src/lib/config-dos.h",
+            "third_party/cares/cares/src/lib/bitncmp.h",
            "third_party/cares/cares/src/lib/ares_strcasecmp.h",
            "third_party/cares/cares/src/lib/setup_once.h",
-            "third_party/cares/cares/src/lib/ares_ipv6.h",
-            "third_party/cares/cares/src/lib/ares_library_init.h",
-            "third_party/cares/cares/src/lib/ares_nameser.h",
+            "third_party/cares/cares/src/lib/ares_inet_net_pton.h",
+            "third_party/cares/cares/src/lib/ares_data.h",
+            "third_party/cares/cares/src/lib/ares_getenv.h",
+            "third_party/cares/cares/src/lib/config-win32.h",
            "third_party/cares/cares/src/lib/ares_strdup.h",
-            "third_party/cares/cares/src/lib/config-dos.h",
-            "third_party/cares/cares/src/lib/ares_llist.h",
+            "third_party/cares/cares/src/lib/ares_iphlpapi.h",
+            "third_party/cares/cares/src/lib/ares_setup.h",
+            "third_party/cares/cares/src/lib/ares_writev.h",
            "third_party/cares/cares/src/lib/ares_nowarn.h",
-            "third_party/cares/cares/src/lib/ares_android.h",
            "third_party/cares/config_darwin/ares_config.h",
            "third_party/cares/config_freebsd/ares_config.h",
            "third_party/cares/config_linux/ares_config.h",
-            "third_party/cares/config_openbsd/ares_config.h"
+            "third_party/cares/config_openbsd/ares_config.h",
        ],
    }]
 except:
--- a/src/core/BUILD
+++ b/src/core/BUILD
@ -1937,6 +1937,7 @@ grpc_cc_library(
        "posix_event_engine_tcp_socket_utils",
        "socket_mutator",
        "status_helper",
+        "time",
        "//:event_engine_base_hdrs",
        "//:gpr",
    ],
@ -4582,6 +4583,7 @@ grpc_cc_library(
    deps = [
        "channel_args",
        "grpc_lb_subchannel_list",
+        "grpc_outlier_detection_header",
        "json",
        "lb_policy",
        "lb_policy_factory",
@ -4753,6 +4755,7 @@ grpc_cc_library(
        "time",
        "validation_errors",
        "//:gpr_platform",
+        "//:server_address",
    ],
 )

--- a/src/core/ext/filters/backend_metrics/backend_metric_filter.cc
+++ b/src/core/ext/filters/backend_metrics/backend_metric_filter.cc
@ -67,6 +67,11 @@ absl::optional<std::string> BackendMetricFilter::MaybeSerializeBackendMetrics(
                                                        data.mem_utilization);
    has_data = true;
  }
+  if (data.application_utilization != -1) {
+    xds_data_orca_v3_OrcaLoadReport_set_application_utilization(
+        response, data.application_utilization);
+    has_data = true;
+  }
  if (data.qps != -1) {
    xds_data_orca_v3_OrcaLoadReport_set_rps_fractional(response, data.qps);
    has_data = true;
--- a/src/core/ext/filters/client_channel/backend_metric.cc
+++ b/src/core/ext/filters/client_channel/backend_metric.cc
@ -69,6 +69,8 @@ const BackendMetricData* ParseBackendMetricData(
      xds_data_orca_v3_OrcaLoadReport_cpu_utilization(msg);
  backend_metric_data->mem_utilization =
      xds_data_orca_v3_OrcaLoadReport_mem_utilization(msg);
+  backend_metric_data->application_utilization =
+      xds_data_orca_v3_OrcaLoadReport_application_utilization(msg);
  backend_metric_data->qps =
      xds_data_orca_v3_OrcaLoadReport_rps_fractional(msg);
  backend_metric_data->eps = xds_data_orca_v3_OrcaLoadReport_eps(msg);
--- a/src/core/ext/filters/client_channel/lb_policy/backend_metric_data.h
+++ b/src/core/ext/filters/client_channel/lb_policy/backend_metric_data.h
@ -32,6 +32,9 @@ struct BackendMetricData {
  /// Memory utilization expressed as a fraction of available memory
  /// resources.
  double mem_utilization = -1;
+  /// Application specific utilization expressed as a fraction of available
+  /// resources.
+  double application_utilization = -1;
  /// Total queries per second being served by the backend across all services.
  double qps = -1;
  /// Total errors per second reported by the backend across all services.
--- a/src/core/ext/filters/client_channel/lb_policy/outlier_detection/outlier_detection.cc
+++ b/src/core/ext/filters/client_channel/lb_policy/outlier_detection/outlier_detection.cc
@ -68,6 +68,9 @@ namespace grpc_core {

 TraceFlag grpc_outlier_detection_lb_trace(false, "outlier_detection_lb");

+const char* DisableOutlierDetectionAttribute::kName =
+    "disable_outlier_detection";
+
 namespace {

 using ::grpc_event_engine::experimental::EventEngine;
@ -296,7 +299,7 @@ class OutlierDetectionLb : public LoadBalancingPolicy {
    }

    void DisableEjection() {
-      Uneject();
+      if (ejection_time_.has_value()) Uneject();
      multiplier_ = 0;
    }

@ -368,6 +371,8 @@ class OutlierDetectionLb : public LoadBalancingPolicy {

  ~OutlierDetectionLb() override;

+  // Returns the address map key for an address, or the empty string if
+  // the address should be ignored.
  static std::string MakeKeyForAddress(const ServerAddress& address);

  void ShutdownLocked() override;
@ -546,9 +551,21 @@ OutlierDetectionLb::~OutlierDetectionLb() {

 std::string OutlierDetectionLb::MakeKeyForAddress(
    const ServerAddress& address) {
+  // If the address has the DisableOutlierDetectionAttribute attribute,
+  // ignore it.
+  // TODO(roth): This is a hack to prevent outlier_detection from
+  // working with pick_first, as per discussion in
+  // https://github.com/grpc/grpc/issues/32967.  Remove this as part of
+  // implementing dualstack backend support.
+  if (address.GetAttribute(DisableOutlierDetectionAttribute::kName) !=
+      nullptr) {
+    return "";
+  }
  // Use only the address, not the attributes.
  auto addr_str = grpc_sockaddr_to_string(&address.address(), false);
-  return addr_str.ok() ? addr_str.value() : addr_str.status().ToString();
+  // If address couldn't be stringified, ignore it.
+  if (!addr_str.ok()) return "";
+  return std::move(*addr_str);
 }

 void OutlierDetectionLb::ShutdownLocked() {
@ -621,6 +638,7 @@ absl::Status OutlierDetectionLb::UpdateLocked(UpdateArgs args) {
    std::set<std::string> current_addresses;
    for (const ServerAddress& address : *args.addresses) {
      std::string address_key = MakeKeyForAddress(address);
+      if (address_key.empty()) continue;
      auto& subchannel_state = subchannel_state_map_[address_key];
      if (subchannel_state == nullptr) {
        subchannel_state = MakeRefCounted<SubchannelState>();
@ -722,11 +740,19 @@ OrphanablePtr<LoadBalancingPolicy> OutlierDetectionLb::CreateChildPolicyLocked(
 RefCountedPtr<SubchannelInterface> OutlierDetectionLb::Helper::CreateSubchannel(
    ServerAddress address, const ChannelArgs& args) {
  if (outlier_detection_policy_->shutting_down_) return nullptr;
-  std::string key = MakeKeyForAddress(address);
  RefCountedPtr<SubchannelState> subchannel_state;
-  auto it = outlier_detection_policy_->subchannel_state_map_.find(key);
-  if (it != outlier_detection_policy_->subchannel_state_map_.end()) {
-    subchannel_state = it->second->Ref();
+  std::string key = MakeKeyForAddress(address);
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_outlier_detection_lb_trace)) {
+    gpr_log(GPR_INFO,
+            "[outlier_detection_lb %p] using key %s for subchannel address %s",
+            outlier_detection_policy_.get(), key.c_str(),
+            address.ToString().c_str());
+  }
+  if (!key.empty()) {
+    auto it = outlier_detection_policy_->subchannel_state_map_.find(key);
+    if (it != outlier_detection_policy_->subchannel_state_map_.end()) {
+      subchannel_state = it->second->Ref();
+    }
  }
  auto subchannel = MakeRefCounted<SubchannelWrapper>(
      subchannel_state,
--- a/src/core/ext/filters/client_channel/lb_policy/outlier_detection/outlier_detection.h
+++ b/src/core/ext/filters/client_channel/lb_policy/outlier_detection/outlier_detection.h
@ -21,6 +21,9 @@

 #include <stdint.h>  // for uint32_t

+#include <memory>
+#include <string>
+
 #include "absl/types/optional.h"

 #include "src/core/lib/gprpp/time.h"
@ -28,6 +31,7 @@
 #include "src/core/lib/json/json.h"
 #include "src/core/lib/json/json_args.h"
 #include "src/core/lib/json/json_object_loader.h"
+#include "src/core/lib/resolver/server_address.h"

 namespace grpc_core {

@ -89,6 +93,23 @@ struct OutlierDetectionConfig {
                    ValidationErrors* errors);
 };

+// TODO(roth): This is a horrible hack used to disable outlier detection
+// when used with the pick_first policy.  Remove this as part of
+// implementing the dualstack backend design.
+class DisableOutlierDetectionAttribute
+    : public ServerAddress::AttributeInterface {
+ public:
+  static const char* kName;
+
+  std::unique_ptr<AttributeInterface> Copy() const override {
+    return std::make_unique<DisableOutlierDetectionAttribute>();
+  }
+
+  int Cmp(const AttributeInterface*) const override { return true; }
+
+  std::string ToString() const override { return "true"; }
+};
+
 }  // namespace grpc_core

 #endif  // GRPC_SRC_CORE_EXT_FILTERS_CLIENT_CHANNEL_LB_POLICY_OUTLIER_DETECTION_OUTLIER_DETECTION_H
--- a/src/core/ext/filters/client_channel/lb_policy/pick_first/pick_first.cc
+++ b/src/core/ext/filters/client_channel/lb_policy/pick_first/pick_first.cc
@ -35,6 +35,7 @@
 #include <grpc/impl/connectivity_state.h>
 #include <grpc/support/log.h>

+#include "src/core/ext/filters/client_channel/lb_policy/outlier_detection/outlier_detection.h"
 #include "src/core/ext/filters/client_channel/lb_policy/subchannel_list.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/config/core_configuration.h"
@ -274,6 +275,19 @@ absl::Status PickFirst::UpdateLocked(UpdateArgs args) {
  } else if (args.addresses->empty()) {
    status = absl::UnavailableError("address list must not be empty");
  }
+  // TODO(roth): This is a hack to disable outlier_detection when used
+  // with pick_first, for the reasons described in
+  // https://github.com/grpc/grpc/issues/32967.  Remove this when
+  // implementing the dualstack design.
+  if (args.addresses.ok()) {
+    ServerAddressList addresses;
+    for (const auto& address : *args.addresses) {
+      addresses.emplace_back(address.WithAttribute(
+          DisableOutlierDetectionAttribute::kName,
+          std::make_unique<DisableOutlierDetectionAttribute>()));
+    }
+    args.addresses = std::move(addresses);
+  }
  // If the update contains a resolver error and we have a previous update
  // that was not a resolver error, keep using the previous addresses.
  if (!args.addresses.ok() && latest_update_args_.config != nullptr) {
--- a/src/core/ext/filters/client_channel/lb_policy/weighted_round_robin/weighted_round_robin.cc
+++ b/src/core/ext/filters/client_channel/lb_policy/weighted_round_robin/weighted_round_robin.cc
@ -158,7 +158,7 @@ class WeightedRoundRobin : public LoadBalancingPolicy {
        : wrr_(std::move(wrr)), key_(std::move(key)) {}
    ~AddressWeight() override;

-    void MaybeUpdateWeight(double qps, double eps, double cpu_utilization,
+    void MaybeUpdateWeight(double qps, double eps, double utilization,
                           float error_utilization_penalty);

    float GetWeight(Timestamp now, Duration weight_expiration_period,
@ -398,23 +398,23 @@ WeightedRoundRobin::AddressWeight::~AddressWeight() {
 }

 void WeightedRoundRobin::AddressWeight::MaybeUpdateWeight(
-    double qps, double eps, double cpu_utilization,
+    double qps, double eps, double utilization,
    float error_utilization_penalty) {
  // Compute weight.
  float weight = 0;
-  if (qps > 0 && cpu_utilization > 0) {
+  if (qps > 0 && utilization > 0) {
    double penalty = 0.0;
    if (eps > 0 && error_utilization_penalty > 0) {
      penalty = eps / qps * error_utilization_penalty;
    }
-    weight = qps / (cpu_utilization + penalty);
+    weight = qps / (utilization + penalty);
  }
  if (weight == 0) {
    if (GRPC_TRACE_FLAG_ENABLED(grpc_lb_wrr_trace)) {
      gpr_log(GPR_INFO,
-              "[WRR %p] subchannel %s: qps=%f, eps=%f, cpu_utilization=%f: "
+              "[WRR %p] subchannel %s: qps=%f, eps=%f, utilization=%f: "
              "error_util_penalty=%f, weight=%f (not updating)",
-              wrr_.get(), key_.c_str(), qps, eps, cpu_utilization,
+              wrr_.get(), key_.c_str(), qps, eps, utilization,
              error_utilization_penalty, weight);
    }
    return;
@ -424,10 +424,10 @@ void WeightedRoundRobin::AddressWeight::MaybeUpdateWeight(
  MutexLock lock(&mu_);
  if (GRPC_TRACE_FLAG_ENABLED(grpc_lb_wrr_trace)) {
    gpr_log(GPR_INFO,
-            "[WRR %p] subchannel %s: qps=%f, eps=%f, cpu_utilization=%f "
+            "[WRR %p] subchannel %s: qps=%f, eps=%f, utilization=%f "
            "error_util_penalty=%f : setting weight=%f weight_=%f now=%s "
            "last_update_time_=%s non_empty_since_=%s",
-            wrr_.get(), key_.c_str(), qps, eps, cpu_utilization,
+            wrr_.get(), key_.c_str(), qps, eps, utilization,
            error_utilization_penalty, weight, weight_, now.ToString().c_str(),
            last_update_time_.ToString().c_str(),
            non_empty_since_.ToString().c_str());
@ -483,14 +483,16 @@ void WeightedRoundRobin::Picker::SubchannelCallTracker::Finish(
      args.backend_metric_accessor->GetBackendMetricData();
  double qps = 0;
  double eps = 0;
-  double cpu_utilization = 0;
+  double utilization = 0;
  if (backend_metric_data != nullptr) {
    qps = backend_metric_data->qps;
    eps = backend_metric_data->eps;
-    cpu_utilization = backend_metric_data->cpu_utilization;
+    utilization = backend_metric_data->application_utilization;
+    if (utilization <= 0) {
+      utilization = backend_metric_data->cpu_utilization;
+    }
  }
-  weight_->MaybeUpdateWeight(qps, eps, cpu_utilization,
-                             error_utilization_penalty_);
+  weight_->MaybeUpdateWeight(qps, eps, utilization, error_utilization_penalty_);
 }

 //
@ -847,9 +849,12 @@ void WeightedRoundRobin::WeightedRoundRobinSubchannelList::

 void WeightedRoundRobin::WeightedRoundRobinSubchannelData::OobWatcher::
    OnBackendMetricReport(const BackendMetricData& backend_metric_data) {
+  double utilization = backend_metric_data.application_utilization;
+  if (utilization <= 0) {
+    utilization = backend_metric_data.cpu_utilization;
+  }
  weight_->MaybeUpdateWeight(backend_metric_data.qps, backend_metric_data.eps,
-                             backend_metric_data.cpu_utilization,
-                             error_utilization_penalty_);
+                             utilization, error_utilization_penalty_);
 }

 //
@ -904,12 +909,21 @@ void WeightedRoundRobin::WeightedRoundRobinSubchannelData::
    subchannel()->RequestConnection();
  } else if (new_state == GRPC_CHANNEL_READY) {
    // If we transition back to READY state, restart the blackout period.
+    // Skip this if this is the initial notification for this
+    // subchannel (which happens whenever we get updated addresses and
+    // create a new endpoint list).  Also skip it if the previous state
+    // was READY (which should never happen in practice, but we've seen
+    // at least one bug that caused this in the outlier_detection
+    // policy, so let's be defensive here).
+    //
    // Note that we cannot guarantee that we will never receive
    // lingering callbacks for backend metric reports from the previous
    // connection after the new connection has been established, but they
    // should be masked by new backend metric reports from the new
    // connection by the time the blackout period ends.
-    weight_->ResetNonEmptySince();
+    if (old_state.has_value() && old_state != GRPC_CHANNEL_READY) {
+      weight_->ResetNonEmptySince();
+    }
  }
  // Update logical connectivity state.
  UpdateLogicalConnectivityStateLocked(new_state);
--- a/src/core/ext/transport/chttp2/transport/hpack_parse_result.cc
+++ b/src/core/ext/transport/chttp2/transport/hpack_parse_result.cc
@ -0,0 +1,176 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/ext/transport/chttp2/transport/hpack_parse_result.h"
+
+#include <stddef.h>
+
+#include <initializer_list>
+
+#include "absl/strings/str_format.h"
+
+#include "src/core/ext/transport/chttp2/transport/hpack_constants.h"
+#include "src/core/lib/gprpp/status_helper.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/slice/slice.h"
+
+namespace grpc_core {
+
+namespace {
+class MetadataSizeLimitExceededEncoder {
+ public:
+  explicit MetadataSizeLimitExceededEncoder(std::string& summary)
+      : summary_(summary) {}
+
+  void Encode(const Slice& key, const Slice& value) {
+    AddToSummary(key.as_string_view(), value.size());
+  }
+
+  template <typename Key, typename Value>
+  void Encode(Key, const Value& value) {
+    AddToSummary(Key::key(), EncodedSizeOfKey(Key(), value));
+  }
+
+ private:
+  void AddToSummary(absl::string_view key,
+                    size_t value_length) GPR_ATTRIBUTE_NOINLINE {
+    absl::StrAppend(&summary_, " ", key, ":",
+                    hpack_constants::SizeForEntry(key.size(), value_length),
+                    "B");
+  }
+  std::string& summary_;
+};
+
+absl::Status MakeStreamError(absl::Status error) {
+  GPR_DEBUG_ASSERT(!error.ok());
+  return grpc_error_set_int(std::move(error), StatusIntProperty::kStreamId, 0);
+}
+}  // namespace
+
+absl::Status HpackParseResult::Materialize() const {
+  if (materialized_status_.has_value()) return *materialized_status_;
+  materialized_status_ = BuildMaterialized();
+  return *materialized_status_;
+}
+
+absl::Status HpackParseResult::BuildMaterialized() const {
+  switch (status_.get()) {
+    case HpackParseStatus::kOk:
+      return absl::OkStatus();
+    case HpackParseStatus::kEof:
+      Crash("Materialize() called on EOF");
+      break;
+    case HpackParseStatus::kMovedFrom:
+      Crash("Materialize() called on moved-from object");
+      break;
+    case HpackParseStatus::kInvalidMetadata:
+      if (key_.empty()) {
+        return MakeStreamError(absl::InternalError(
+            ValidateMetadataResultToString(validate_metadata_result_)));
+      } else {
+        return MakeStreamError(absl::InternalError(absl::StrCat(
+            ValidateMetadataResultToString(validate_metadata_result_), ": ",
+            key_)));
+      }
+    case HpackParseStatus::kSoftMetadataLimitExceeded:
+    case HpackParseStatus::kHardMetadataLimitExceeded: {
+      const auto& e = metadata_limit_exceeded_;
+      // Collect a summary of sizes so far for debugging
+      // Do not collect contents, for fear of exposing PII.
+      std::string summary;
+      if (e.prior != nullptr) {
+        MetadataSizeLimitExceededEncoder encoder(summary);
+        e.prior->Encode(&encoder);
+      }
+      return MakeStreamError(absl::ResourceExhaustedError(absl::StrCat(
+          "received metadata size exceeds ",
+          status_.get() == HpackParseStatus::kSoftMetadataLimitExceeded
+              ? "soft"
+              : "hard",
+          " limit (", e.frame_length, " vs. ", e.limit, ")",
+          summary.empty() ? "" : "; ", summary)));
+    }
+    case HpackParseStatus::kHardMetadataLimitExceededByKey: {
+      const auto& e = metadata_limit_exceeded_by_atom_;
+      return MakeStreamError(absl::ResourceExhaustedError(
+          absl::StrCat("received metadata size exceeds hard limit (key length ",
+                       e.atom_length, " vs. ", e.limit, ")")));
+    }
+    case HpackParseStatus::kHardMetadataLimitExceededByValue: {
+      const auto& e = metadata_limit_exceeded_by_atom_;
+      return MakeStreamError(absl::ResourceExhaustedError(absl::StrCat(
+          "received metadata size exceeds hard limit (value length ",
+          e.atom_length, " vs. ", e.limit, ")")));
+    }
+    case HpackParseStatus::kMetadataParseError:
+      if (!key_.empty()) {
+        return MakeStreamError(absl::InternalError(
+            absl::StrCat("Error parsing '", key_, "' metadata")));
+      } else {
+        return MakeStreamError(absl::InternalError("Error parsing metadata"));
+      }
+    case HpackParseStatus::kUnbase64Failed:
+      if (!key_.empty()) {
+        return MakeStreamError(absl::InternalError(absl::StrCat(
+            "Error parsing '", key_, "' metadata: illegal base64 encoding")));
+      } else {
+        return MakeStreamError(absl::InternalError(
+            absl::StrCat("Failed base64 decoding metadata")));
+      }
+    case HpackParseStatus::kIncompleteHeaderAtBoundary:
+      return absl::InternalError(
+          "Incomplete header at the end of a header/continuation sequence");
+    case HpackParseStatus::kVarintOutOfRange:
+      return absl::InternalError(absl::StrFormat(
+          "integer overflow in hpack integer decoding: have 0x%08x, "
+          "got byte 0x%02x",
+          varint_out_of_range_.value, varint_out_of_range_.last_byte));
+    case HpackParseStatus::kIllegalTableSizeChange:
+      return absl::InternalError(absl::StrCat(
+          "Attempt to make hpack table ", illegal_table_size_change_.new_size,
+          " bytes when max is ", illegal_table_size_change_.max_size,
+          " bytes"));
+    case HpackParseStatus::kAddBeforeTableSizeUpdated:
+      return absl::InternalError(
+          absl::StrCat("HPACK max table size reduced to ",
+                       illegal_table_size_change_.new_size,
+                       " but not reflected by hpack stream (still at ",
+                       illegal_table_size_change_.max_size, ")"));
+    case HpackParseStatus::kParseHuffFailed:
+      if (!key_.empty()) {
+        return absl::InternalError(
+            absl::StrCat("Failed huffman decoding '", key_, "' metadata"));
+      } else {
+        return absl::InternalError(
+            absl::StrCat("Failed huffman decoding metadata"));
+      }
+      break;
+    case HpackParseStatus::kTooManyDynamicTableSizeChanges:
+      return absl::InternalError(
+          "More than two max table size changes in a single frame");
+    case HpackParseStatus::kMaliciousVarintEncoding:
+      return absl::InternalError(
+          "Malicious varint encoding detected in HPACK stream");
+    case HpackParseStatus::kInvalidHpackIndex:
+      return absl::InternalError(absl::StrFormat(
+          "Invalid HPACK index received (%d)", invalid_hpack_index_));
+    case HpackParseStatus::kIllegalHpackOpCode:
+      return absl::InternalError("Illegal hpack op code");
+  }
+  GPR_UNREACHABLE_CODE(return absl::UnknownError("Should never reach here"));
+}
+
+}  // namespace grpc_core
--- a/src/core/ext/transport/chttp2/transport/hpack_parse_result.h
+++ b/src/core/ext/transport/chttp2/transport/hpack_parse_result.h
@ -0,0 +1,325 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_HPACK_PARSE_RESULT_H
+#define GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_HPACK_PARSE_RESULT_H
+
+#include <grpc/support/port_platform.h>
+
+#include <stdint.h>
+
+#include <string>
+#include <utility>
+
+#include "absl/status/status.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
+
+#include <grpc/support/log.h>
+
+#include "src/core/lib/gprpp/crash.h"
+#include "src/core/lib/surface/validate_metadata.h"
+#include "src/core/lib/transport/metadata_batch.h"
+
+namespace grpc_core {
+
+// Result of parsing
+// Makes it trivial to identify stream vs connection errors (via a range check)
+enum class HpackParseStatus : uint8_t {
+  ///////////////////////////////////////////////////////
+  // Non-Errors
+
+  // Parsed OK
+  kOk,
+  // Parse reached end of the current frame
+  kEof,
+  // Moved from - used to denote a HpackParseResult that has been moved into a
+  // different object, and so the original should be deemed invalid.
+  kMovedFrom,
+
+  ///////////////////////////////////////////////////////////////////
+  // Stream Errors - result in a stream cancellation
+
+  // Sentinel value used to denote the first error that is a stream error.
+  // All stream errors are hence >= kFirstStreamError and <
+  // kFirstConnectionError.
+  // Should not be used in switch statements, instead the first error message
+  // after this one should be assigned the same value.
+  kFirstStreamError,
+  kInvalidMetadata = kFirstStreamError,
+  // Hard metadata limit exceeded by the total set of metadata
+  kHardMetadataLimitExceeded,
+  kSoftMetadataLimitExceeded,
+  // Hard metadata limit exceeded by a single key string
+  kHardMetadataLimitExceededByKey,
+  // Hard metadata limit exceeded by a single value string
+  kHardMetadataLimitExceededByValue,
+  kMetadataParseError,
+  // Parse failed due to a base64 decode error
+  kUnbase64Failed,
+
+  ///////////////////////////////////////////////////////////////////
+  // Connection Errors - result in the tcp connection closing
+
+  // Sentinel value used to denote the first error that is a connection error.
+  // All connection errors are hence >= kFirstConnectionError.
+  // Should not be used in switch statements, instead the first error message
+  // after this one should be assigned the same value.
+  kFirstConnectionError,
+  // Incomplete header at end of header boundary
+  kIncompleteHeaderAtBoundary = kFirstConnectionError,
+  // Varint out of range
+  kVarintOutOfRange,
+  // Invalid HPACK index
+  kInvalidHpackIndex,
+  // Illegal HPACK table size change
+  kIllegalTableSizeChange,
+  // Trying to add to the hpack table prior to reducing after a settings change
+  kAddBeforeTableSizeUpdated,
+  // Parse failed due to a huffman decode error
+  kParseHuffFailed,
+  // Too many dynamic table size changes in one frame
+  kTooManyDynamicTableSizeChanges,
+  // Maliciously long varint encoding
+  // We don't read past 16 repeated 0x80 prefixes on a varint (all zeros)
+  // because no reasonable varint encoder would emit that (16 is already quite
+  // generous!)
+  // Because we stop reading we don't parse the rest of the bytes and so we
+  // can't recover parsing and would end up with a hpack table desync if we
+  // tried, so this is a connection error.
+  kMaliciousVarintEncoding,
+  // Illegal hpack op code
+  kIllegalHpackOpCode,
+};
+
+inline bool IsStreamError(HpackParseStatus status) {
+  return status >= HpackParseStatus::kFirstStreamError &&
+         status < HpackParseStatus::kFirstConnectionError;
+}
+
+inline bool IsConnectionError(HpackParseStatus status) {
+  return status >= HpackParseStatus::kFirstConnectionError;
+}
+
+inline bool IsEphemeralError(HpackParseStatus status) {
+  switch (status) {
+    case HpackParseStatus::kSoftMetadataLimitExceeded:
+    case HpackParseStatus::kHardMetadataLimitExceeded:
+      return true;
+    default:
+      return false;
+  }
+}
+
+class HpackParseResult {
+ public:
+  HpackParseResult() : HpackParseResult{HpackParseStatus::kOk} {}
+
+  bool ok() const { return status_.get() == HpackParseStatus::kOk; }
+  bool stream_error() const { return IsStreamError(status_.get()); }
+  bool connection_error() const { return IsConnectionError(status_.get()); }
+  bool ephemeral() const { return IsEphemeralError(status_.get()); }
+
+  HpackParseResult PersistentStreamErrorOrOk() const {
+    if (connection_error() || ephemeral()) return HpackParseResult();
+    return *this;
+  }
+
+  static HpackParseResult FromStatus(HpackParseStatus status) {
+    // Most statuses need some payloads, and we only need this functionality
+    // rarely - so allow list the statuses that we can include here.
+    switch (status) {
+      case HpackParseStatus::kUnbase64Failed:
+      case HpackParseStatus::kParseHuffFailed:
+        return HpackParseResult{status};
+      default:
+        Crash(
+            absl::StrCat("Invalid HpackParseStatus for FromStatus: ", status));
+    }
+  }
+
+  static HpackParseResult FromStatusWithKey(HpackParseStatus status,
+                                            absl::string_view key) {
+    auto r = FromStatus(status);
+    r.key_ = std::string(key);
+    return r;
+  }
+
+  static HpackParseResult MetadataParseError(absl::string_view key) {
+    HpackParseResult r{HpackParseStatus::kMetadataParseError};
+    r.key_ = std::string(key);
+    return r;
+  }
+
+  static HpackParseResult AddBeforeTableSizeUpdated(uint32_t current_size,
+                                                    uint32_t max_size) {
+    HpackParseResult p{HpackParseStatus::kAddBeforeTableSizeUpdated};
+    p.illegal_table_size_change_ =
+        IllegalTableSizeChange{current_size, max_size};
+    return p;
+  }
+
+  static HpackParseResult MaliciousVarintEncodingError() {
+    return HpackParseResult{HpackParseStatus::kMaliciousVarintEncoding};
+  }
+
+  static HpackParseResult IllegalHpackOpCode() {
+    return HpackParseResult{HpackParseStatus::kIllegalHpackOpCode};
+  }
+
+  static HpackParseResult InvalidMetadataError(ValidateMetadataResult result,
+                                               absl::string_view key) {
+    GPR_DEBUG_ASSERT(result != ValidateMetadataResult::kOk);
+    HpackParseResult p{HpackParseStatus::kInvalidMetadata};
+    p.key_ = std::string(key);
+    p.validate_metadata_result_ = result;
+    return p;
+  }
+
+  static HpackParseResult IncompleteHeaderAtBoundaryError() {
+    return HpackParseResult{HpackParseStatus::kIncompleteHeaderAtBoundary};
+  }
+
+  static HpackParseResult VarintOutOfRangeError(uint32_t value,
+                                                uint8_t last_byte) {
+    HpackParseResult p{HpackParseStatus::kVarintOutOfRange};
+    p.varint_out_of_range_ = VarintOutOfRange{last_byte, value};
+    return p;
+  }
+
+  static HpackParseResult InvalidHpackIndexError(uint32_t index) {
+    HpackParseResult p{HpackParseStatus::kInvalidHpackIndex};
+    p.invalid_hpack_index_ = index;
+    return p;
+  }
+
+  static HpackParseResult IllegalTableSizeChangeError(uint32_t new_size,
+                                                      uint32_t max_size) {
+    HpackParseResult p{HpackParseStatus::kIllegalTableSizeChange};
+    p.illegal_table_size_change_ = IllegalTableSizeChange{new_size, max_size};
+    return p;
+  }
+
+  static HpackParseResult TooManyDynamicTableSizeChangesError() {
+    return HpackParseResult{HpackParseStatus::kTooManyDynamicTableSizeChanges};
+  }
+
+  static HpackParseResult SoftMetadataLimitExceededError(
+      grpc_metadata_batch* metadata, uint32_t frame_length, uint32_t limit) {
+    HpackParseResult p{HpackParseStatus::kSoftMetadataLimitExceeded};
+    p.metadata_limit_exceeded_ =
+        MetadataLimitExceeded{frame_length, limit, metadata};
+    return p;
+  }
+
+  static HpackParseResult HardMetadataLimitExceededError(
+      grpc_metadata_batch* metadata, uint32_t frame_length, uint32_t limit) {
+    HpackParseResult p{HpackParseStatus::kHardMetadataLimitExceeded};
+    p.metadata_limit_exceeded_ =
+        MetadataLimitExceeded{frame_length, limit, metadata};
+    return p;
+  }
+
+  static HpackParseResult HardMetadataLimitExceededByKeyError(
+      uint32_t key_length, uint32_t limit) {
+    HpackParseResult p{HpackParseStatus::kHardMetadataLimitExceededByKey};
+    p.metadata_limit_exceeded_by_atom_ =
+        MetadataLimitExceededByAtom{key_length, limit};
+    return p;
+  }
+
+  static HpackParseResult HardMetadataLimitExceededByValueError(
+      absl::string_view key, uint32_t value_length, uint32_t limit) {
+    HpackParseResult p{HpackParseStatus::kHardMetadataLimitExceededByValue};
+    p.metadata_limit_exceeded_by_atom_ =
+        MetadataLimitExceededByAtom{value_length, limit};
+    p.key_ = std::string(key);
+    return p;
+  }
+
+  // Compute the absl::Status that goes along with this HpackParseResult.
+  // (may be cached, so this is not thread safe)
+  absl::Status Materialize() const;
+
+ private:
+  explicit HpackParseResult(HpackParseStatus status) : status_(status) {}
+  absl::Status BuildMaterialized() const;
+
+  struct VarintOutOfRange {
+    uint8_t last_byte;
+    uint32_t value;
+  };
+
+  struct MetadataLimitExceeded {
+    uint32_t frame_length;
+    uint32_t limit;
+    grpc_metadata_batch* prior;
+  };
+
+  // atom here means one of either a key or a value - so this is used for when a
+  // metadata limit is consumed by either of these.
+  struct MetadataLimitExceededByAtom {
+    uint32_t atom_length;
+    uint32_t limit;
+  };
+
+  struct IllegalTableSizeChange {
+    uint32_t new_size;
+    uint32_t max_size;
+  };
+
+  class StatusWrapper {
+   public:
+    explicit StatusWrapper(HpackParseStatus status) : status_(status) {}
+
+    StatusWrapper(const StatusWrapper&) = default;
+    StatusWrapper& operator=(const StatusWrapper&) = default;
+    StatusWrapper(StatusWrapper&& other) noexcept
+        : status_(std::exchange(other.status_, HpackParseStatus::kMovedFrom)) {}
+    StatusWrapper& operator=(StatusWrapper&& other) noexcept {
+      status_ = std::exchange(other.status_, HpackParseStatus::kMovedFrom);
+      return *this;
+    }
+
+    HpackParseStatus get() const { return status_; }
+
+   private:
+    HpackParseStatus status_;
+  };
+
+  StatusWrapper status_;
+  union {
+    // Set if status == kInvalidMetadata
+    ValidateMetadataResult validate_metadata_result_;
+    // Set if status == kVarintOutOfRange
+    VarintOutOfRange varint_out_of_range_;
+    // Set if status == kInvalidHpackIndex
+    uint32_t invalid_hpack_index_;
+    // Set if status == kHardMetadataLimitExceeded or
+    // kSoftMetadataLimitExceeded
+    MetadataLimitExceeded metadata_limit_exceeded_;
+    // Set if status == kHardMetadataLimitExceededByKey or
+    // kHardMetadataLimitExceededByValue
+    MetadataLimitExceededByAtom metadata_limit_exceeded_by_atom_;
+    // Set if status == kIllegalTableSizeChange
+    IllegalTableSizeChange illegal_table_size_change_;
+  };
+  std::string key_;
+  mutable absl::optional<absl::Status> materialized_status_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_HPACK_PARSE_RESULT_H
--- a/src/core/ext/transport/chttp2/transport/hpack_parser.cc
+++ b/src/core/ext/transport/chttp2/transport/hpack_parser.cc
--- a/src/core/ext/transport/chttp2/transport/hpack_parser.h
+++ b/src/core/ext/transport/chttp2/transport/hpack_parser.h
@ -21,16 +21,28 @@

 #include <grpc/support/port_platform.h>

+#include <stddef.h>
 #include <stdint.h>

+#include <string>
+#include <utility>
 #include <vector>

+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
+#include "absl/types/span.h"
+#include "absl/types/variant.h"
+
 #include <grpc/slice.h>

 #include "src/core/ext/transport/chttp2/transport/frame.h"
+#include "src/core/ext/transport/chttp2/transport/hpack_parse_result.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_parser_table.h"
 #include "src/core/lib/backoff/random_early_detection.h"
 #include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/slice/slice.h"
+#include "src/core/lib/slice/slice_refcount.h"
 #include "src/core/lib/transport/metadata_batch.h"

 // IWYU pragma: no_include <type_traits>
@ -92,17 +104,150 @@ class HPackParser {
  void FinishFrame();

  // Retrieve the associated hpack table (for tests, debugging)
-  HPackTable* hpack_table() { return &table_; }
+  HPackTable* hpack_table() { return &state_.hpack_table; }
  // Is the current frame a boundary of some sort
  bool is_boundary() const { return boundary_ != Boundary::None; }
  // Is the current frame the end of a stream
  bool is_eof() const { return boundary_ == Boundary::EndOfStream; }

+  // How many bytes are buffered (for tests to assert on)
+  size_t buffered_bytes() const { return unparsed_bytes_.size(); }
+
 private:
  // Helper classes: see implementation
  class Parser;
  class Input;
-  class String;
+
+  // Helper to parse a string and turn it into a slice with appropriate memory
+  // management characteristics
+  class String {
+   public:
+    // StringResult carries both a HpackParseStatus and the parsed string
+    struct StringResult;
+
+    String() : value_(absl::Span<const uint8_t>()) {}
+    String(const String&) = delete;
+    String& operator=(const String&) = delete;
+    String(String&& other) noexcept : value_(std::move(other.value_)) {
+      other.value_ = absl::Span<const uint8_t>();
+    }
+    String& operator=(String&& other) noexcept {
+      value_ = std::move(other.value_);
+      other.value_ = absl::Span<const uint8_t>();
+      return *this;
+    }
+
+    // Take the value and leave this empty
+    Slice Take();
+
+    // Return a reference to the value as a string view
+    absl::string_view string_view() const;
+
+    // Parse a non-binary string
+    static StringResult Parse(Input* input, bool is_huff, size_t length);
+
+    // Parse a binary string
+    static StringResult ParseBinary(Input* input, bool is_huff, size_t length);
+
+   private:
+    void AppendBytes(const uint8_t* data, size_t length);
+    explicit String(std::vector<uint8_t> v) : value_(std::move(v)) {}
+    explicit String(absl::Span<const uint8_t> v) : value_(v) {}
+    String(grpc_slice_refcount* r, const uint8_t* begin, const uint8_t* end)
+        : value_(Slice::FromRefcountAndBytes(r, begin, end)) {}
+
+    // Parse some huffman encoded bytes, using output(uint8_t b) to emit each
+    // decoded byte.
+    template <typename Out>
+    static HpackParseStatus ParseHuff(Input* input, uint32_t length,
+                                      Out output);
+
+    // Parse some uncompressed string bytes.
+    static StringResult ParseUncompressed(Input* input, uint32_t length,
+                                          uint32_t wire_size);
+
+    // Turn base64 encoded bytes into not base64 encoded bytes.
+    static StringResult Unbase64(String s);
+
+    // Main loop for Unbase64
+    static absl::optional<std::vector<uint8_t>> Unbase64Loop(
+        const uint8_t* cur, const uint8_t* end);
+
+    absl::variant<Slice, absl::Span<const uint8_t>, std::vector<uint8_t>>
+        value_;
+  };
+
+  // Prefix for a string
+  struct StringPrefix {
+    // Number of bytes in input for string
+    uint32_t length;
+    // Is it huffman compressed
+    bool huff;
+
+    std::string ToString() const {
+      return absl::StrCat(length, " bytes ",
+                          huff ? "huffman compressed" : "uncompressed");
+    }
+  };
+
+  // Current parse state
+  // ┌───┐
+  // │Top│
+  // └┬─┬┘
+  //  │┌▽────────────────┐
+  //  ││ParsingKeyLength │
+  //  │└┬───────────────┬┘
+  //  │┌▽─────────────┐┌▽──────────────┐
+  //  ││ParsingKeyBody││SkippingKeyBody│
+  //  │└┬─────────────┘└───┬───────────┘
+  // ┌▽─▽────────────────┐┌▽──────────────────┐
+  // │ParsingValueLength ││SkippingValueLength│
+  // └┬─────────────────┬┘└┬──────────────────┘
+  // ┌▽───────────────┐┌▽──▽─────────────┐
+  // │ParsingValueBody││SkippingValueBody│
+  // └────────────────┘└─────────────────┘
+  enum class ParseState : uint8_t {
+    // Start of one opcode
+    kTop,
+    // Parsing a literal keys length
+    kParsingKeyLength,
+    // Parsing a literal key
+    kParsingKeyBody,
+    // Skipping a literal key
+    kSkippingKeyBody,
+    // Parsing a literal value length
+    kParsingValueLength,
+    // Parsing a literal value
+    kParsingValueBody,
+    // Reading a literal value length (so we can skip it)
+    kSkippingValueLength,
+    // Skipping a literal value
+    kSkippingValueBody,
+  };
+
+  // Shared state for Parser instances between slices.
+  struct InterSliceState {
+    HPackTable hpack_table;
+    // Error so far for this frame (set by class Input)
+    HpackParseResult frame_error;
+    // Length of frame so far.
+    uint32_t frame_length = 0;
+    // Length of the string being parsed
+    uint32_t string_length;
+    // How many more dynamic table updates are allowed
+    uint8_t dynamic_table_updates_allowed;
+    // Current parse state
+    ParseState parse_state = ParseState::kTop;
+    // RED for overly large metadata sets
+    RandomEarlyDetection metadata_early_detection;
+    // Should the current header be added to the hpack table?
+    bool add_to_table;
+    // Is the string being parsed huffman compressed?
+    bool is_string_huff_compressed;
+    // Is the value being parsed binary?
+    bool is_binary_header;
+    absl::variant<const HPackTable::Memento*, Slice> key;
+  };

  grpc_error_handle ParseInput(Input input, bool is_last);
  void ParseInputInner(Input* input);
@ -114,6 +259,8 @@ class HPackParser {

  // Bytes that could not be parsed last parsing round
  std::vector<uint8_t> unparsed_bytes_;
+  // How many bytes would be needed before progress could be made?
+  size_t min_progress_size_ = 0;
  // Buffer kind of boundary
  // TODO(ctiller): see if we can move this argument to Parse, and avoid
  // buffering.
@ -122,15 +269,9 @@ class HPackParser {
  // TODO(ctiller): see if we can move this argument to Parse, and avoid
  // buffering.
  Priority priority_;
-  uint8_t dynamic_table_updates_allowed_;
-  // Length of frame so far.
-  uint32_t frame_length_;
-  RandomEarlyDetection metadata_early_detection_;
  // Information for logging
  LogInfo log_info_;
-
-  // hpack table
-  HPackTable table_;
+  InterSliceState state_;
 };

 }  // namespace grpc_core
--- a/src/core/ext/transport/chttp2/transport/hpack_parser_table.cc
+++ b/src/core/ext/transport/chttp2/transport/hpack_parser_table.cc
@ -25,16 +25,16 @@
 #include <algorithm>
 #include <cstddef>
 #include <cstring>
-#include <initializer_list>
 #include <utility>

 #include "absl/status/status.h"
-#include "absl/strings/str_format.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"

 #include <grpc/support/log.h>

 #include "src/core/ext/transport/chttp2/transport/hpack_constants.h"
+#include "src/core/ext/transport/chttp2/transport/hpack_parse_result.h"
 #include "src/core/ext/transport/chttp2/transport/http_trace.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/slice/slice.h"
@ -80,6 +80,14 @@ void HPackTable::MementoRingBuffer::Rebuild(uint32_t max_entries) {
  entries_.swap(entries);
 }

+void HPackTable::MementoRingBuffer::ForEach(
+    absl::FunctionRef<void(uint32_t, const Memento&)> f) const {
+  uint32_t index = 0;
+  while (auto* m = Lookup(index++)) {
+    f(index, *m);
+  }
+}
+
 // Evict one element from the table
 void HPackTable::EvictOne() {
  auto first_entry = entries_.PopOne();
@ -100,15 +108,9 @@ void HPackTable::SetMaxBytes(uint32_t max_bytes) {
  max_bytes_ = max_bytes;
 }

-grpc_error_handle HPackTable::SetCurrentTableSize(uint32_t bytes) {
-  if (current_table_bytes_ == bytes) {
-    return absl::OkStatus();
-  }
-  if (bytes > max_bytes_) {
-    return absl::InternalError(absl::StrFormat(
-        "Attempt to make hpack table %d bytes when max is %d bytes", bytes,
-        max_bytes_));
-  }
+bool HPackTable::SetCurrentTableSize(uint32_t bytes) {
+  if (current_table_bytes_ == bytes) return true;
+  if (bytes > max_bytes_) return false;
  if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace)) {
    gpr_log(GPR_INFO, "Update hpack parser table size to %d", bytes);
  }
@ -119,30 +121,16 @@ grpc_error_handle HPackTable::SetCurrentTableSize(uint32_t bytes) {
  uint32_t new_cap = std::max(hpack_constants::EntriesForBytes(bytes),
                              hpack_constants::kInitialTableEntries);
  entries_.Rebuild(new_cap);
-  return absl::OkStatus();
+  return true;
 }

-grpc_error_handle HPackTable::Add(Memento md) {
-  if (current_table_bytes_ > max_bytes_) {
-    return GRPC_ERROR_CREATE(absl::StrFormat(
-        "HPACK max table size reduced to %d but not reflected by hpack "
-        "stream (still at %d)",
-        max_bytes_, current_table_bytes_));
-  }
+bool HPackTable::Add(Memento md) {
+  if (current_table_bytes_ > max_bytes_) return false;

  // we can't add elements bigger than the max table size
  if (md.md.transport_size() > current_table_bytes_) {
-    // HPACK draft 10 section 4.4 states:
-    // If the size of the new entry is less than or equal to the maximum
-    // size, that entry is added to the table.  It is not an error to
-    // attempt to add an entry that is larger than the maximum size; an
-    // attempt to add an entry larger than the entire table causes
-    // the table to be emptied of all existing entries, and results in an
-    // empty table.
-    while (entries_.num_entries()) {
-      EvictOne();
-    }
-    return absl::OkStatus();
+    AddLargerThanCurrentTableSize();
+    return true;
  }

  // evict entries to ensure no overflow
@ -154,7 +142,33 @@ grpc_error_handle HPackTable::Add(Memento md) {
  // copy the finalized entry in
  mem_used_ += md.md.transport_size();
  entries_.Put(std::move(md));
-  return absl::OkStatus();
+  return true;
+}
+
+void HPackTable::AddLargerThanCurrentTableSize() {
+  // HPACK draft 10 section 4.4 states:
+  // If the size of the new entry is less than or equal to the maximum
+  // size, that entry is added to the table.  It is not an error to
+  // attempt to add an entry that is larger than the maximum size; an
+  // attempt to add an entry larger than the entire table causes
+  // the table to be emptied of all existing entries, and results in an
+  // empty table.
+  while (entries_.num_entries()) {
+    EvictOne();
+  }
+}
+
+std::string HPackTable::TestOnlyDynamicTableAsString() const {
+  std::string out;
+  entries_.ForEach([&out](uint32_t i, const Memento& m) {
+    if (m.parse_status.ok()) {
+      absl::StrAppend(&out, i, ": ", m.md.DebugString(), "\n");
+    } else {
+      absl::StrAppend(&out, i, ": ", m.parse_status.Materialize().ToString(),
+                      "\n");
+    }
+  });
+  return out;
 }

 namespace {
@ -236,7 +250,7 @@ HPackTable::Memento MakeMemento(size_t i) {
          [](absl::string_view, const Slice&) {
            abort();  // not expecting to see this
          }),
-      absl::OkStatus()};
+      HpackParseResult()};
 }

 }  // namespace
--- a/src/core/ext/transport/chttp2/transport/hpack_parser_table.h
+++ b/src/core/ext/transport/chttp2/transport/hpack_parser_table.h
@ -23,13 +23,14 @@

 #include <stdint.h>

+#include <string>
 #include <vector>

-#include "absl/status/status.h"
+#include "absl/functional/function_ref.h"

 #include "src/core/ext/transport/chttp2/transport/hpack_constants.h"
+#include "src/core/ext/transport/chttp2/transport/hpack_parse_result.h"
 #include "src/core/lib/gprpp/no_destruct.h"
-#include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/lib/transport/parsed_metadata.h"

@ -45,11 +46,12 @@ class HPackTable {
  HPackTable& operator=(const HPackTable&) = delete;

  void SetMaxBytes(uint32_t max_bytes);
-  grpc_error_handle SetCurrentTableSize(uint32_t bytes);
+  bool SetCurrentTableSize(uint32_t bytes);
+  uint32_t current_table_size() { return current_table_bytes_; }

  struct Memento {
    ParsedMetadata<grpc_metadata_batch> md;
-    absl::Status parse_status;
+    HpackParseResult parse_status;
  };

  // Lookup, but don't ref.
@ -68,7 +70,8 @@ class HPackTable {
  }

  // add a table entry to the index
-  grpc_error_handle Add(Memento md) GRPC_MUST_USE_RESULT;
+  bool Add(Memento md) GRPC_MUST_USE_RESULT;
+  void AddLargerThanCurrentTableSize();

  // Current entry count in the table.
  uint32_t num_entries() const { return entries_.num_entries(); }
@ -76,6 +79,13 @@ class HPackTable {
  // Current size of the table.
  uint32_t test_only_table_size() const { return mem_used_; }

+  // Maximum allowed size of the table currently
+  uint32_t max_bytes() const { return max_bytes_; }
+  uint32_t current_table_bytes() const { return current_table_bytes_; }
+
+  // Dynamic table entries, stringified
+  std::string TestOnlyDynamicTableAsString() const;
+
 private:
  struct StaticMementos {
    StaticMementos();
@ -98,6 +108,9 @@ class HPackTable {
    // Lookup the entry at index, or return nullptr if none exists.
    const Memento* Lookup(uint32_t index) const;

+    void ForEach(absl::FunctionRef<void(uint32_t dynamic_index, const Memento&)>
+                     f) const;
+
    uint32_t max_entries() const { return max_entries_; }
    uint32_t num_entries() const { return num_entries_; }

--- a/src/core/ext/transport/chttp2/transport/parsing.cc
+++ b/src/core/ext/transport/chttp2/transport/parsing.cc
@ -23,7 +23,6 @@

 #include <initializer_list>
 #include <string>
-#include <utility>

 #include "absl/base/attributes.h"
 #include "absl/status/status.h"
@ -470,8 +469,8 @@ static HPackParser::LogInfo hpack_parser_log_info(
 }

 static grpc_error_handle init_header_skip_frame_parser(
-    grpc_chttp2_transport* t, HPackParser::Priority priority_type) {
-  bool is_eoh = t->expect_continuation_stream_id != 0;
+    grpc_chttp2_transport* t, HPackParser::Priority priority_type,
+    bool is_eoh) {
  t->parser = grpc_chttp2_transport::Parser{
      "header", grpc_chttp2_header_parser_parse, &t->hpack_parser};
  t->hpack_parser.BeginFrame(
@ -595,7 +594,7 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
      GRPC_CHTTP2_IF_TRACING(
          gpr_log(GPR_ERROR,
                  "grpc_chttp2_stream disbanded before CONTINUATION received"));
-      return init_header_skip_frame_parser(t, priority_type);
+      return init_header_skip_frame_parser(t, priority_type, is_eoh);
    }
    if (t->is_client) {
      if (GPR_LIKELY((t->incoming_stream_id & 1) &&
@ -605,7 +604,7 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
        GRPC_CHTTP2_IF_TRACING(gpr_log(
            GPR_ERROR, "ignoring new grpc_chttp2_stream creation on client"));
      }
-      return init_header_skip_frame_parser(t, priority_type);
+      return init_header_skip_frame_parser(t, priority_type, is_eoh);
    } else if (GPR_UNLIKELY(t->last_new_stream_id >= t->incoming_stream_id)) {
      GRPC_CHTTP2_IF_TRACING(gpr_log(
          GPR_ERROR,
@ -613,13 +612,13 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
          "last grpc_chttp2_stream "
          "id=%d, new grpc_chttp2_stream id=%d",
          t->last_new_stream_id, t->incoming_stream_id));
-      return init_header_skip_frame_parser(t, priority_type);
+      return init_header_skip_frame_parser(t, priority_type, is_eoh);
    } else if (GPR_UNLIKELY((t->incoming_stream_id & 1) == 0)) {
      GRPC_CHTTP2_IF_TRACING(gpr_log(
          GPR_ERROR,
          "ignoring grpc_chttp2_stream with non-client generated index %d",
          t->incoming_stream_id));
-      return init_header_skip_frame_parser(t, priority_type);
+      return init_header_skip_frame_parser(t, priority_type, is_eoh);
    } else if (GPR_UNLIKELY(
                   grpc_chttp2_stream_map_size(&t->stream_map) >=
                   t->settings[GRPC_ACKED_SETTINGS]
@ -632,7 +631,7 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
          "grpc_chttp2_stream request id=%d, last grpc_chttp2_stream id=%d",
          t, std::string(t->peer_string.as_string_view()).c_str(),
          t->incoming_stream_id, t->last_new_stream_id));
-      return init_header_skip_frame_parser(t, priority_type);
+      return init_header_skip_frame_parser(t, priority_type, is_eoh);
    }
    t->last_new_stream_id = t->incoming_stream_id;
    s = t->incoming_stream =
@ -640,7 +639,7 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
    if (GPR_UNLIKELY(s == nullptr)) {
      GRPC_CHTTP2_IF_TRACING(
          gpr_log(GPR_ERROR, "grpc_chttp2_stream not accepted"));
-      return init_header_skip_frame_parser(t, priority_type);
+      return init_header_skip_frame_parser(t, priority_type, is_eoh);
    }
    if (t->channelz_socket != nullptr) {
      t->channelz_socket->RecordStreamStartedFromRemote();
@ -654,7 +653,7 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
    GRPC_CHTTP2_IF_TRACING(gpr_log(
        GPR_ERROR, "skipping already closed grpc_chttp2_stream header"));
    t->incoming_stream = nullptr;
-    return init_header_skip_frame_parser(t, priority_type);
+    return init_header_skip_frame_parser(t, priority_type, is_eoh);
  }
  t->parser = grpc_chttp2_transport::Parser{
      "header", grpc_chttp2_header_parser_parse, &t->hpack_parser};
@ -687,7 +686,7 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
      break;
    case 2:
      gpr_log(GPR_ERROR, "too many header frames received");
-      return init_header_skip_frame_parser(t, priority_type);
+      return init_header_skip_frame_parser(t, priority_type, is_eoh);
  }
  if (frame_type == HPackParser::LogInfo::kTrailers && !t->header_eof) {
    return GRPC_ERROR_CREATE(
@ -815,8 +814,9 @@ static grpc_error_handle parse_frame_slice(grpc_chttp2_transport* t,
                         &unused)) {
    grpc_chttp2_parsing_become_skip_parser(t);
    if (s) {
-      grpc_chttp2_cancel_stream(t, s, std::exchange(err, absl::OkStatus()));
+      grpc_chttp2_cancel_stream(t, s, err);
    }
+    return absl::OkStatus();
  }
  return err;
 }
--- a/src/core/ext/upb-generated/xds/data/orca/v3/orca_load_report.upb.c
+++ b/src/core/ext/upb-generated/xds/data/orca/v3/orca_load_report.upb.c
@ -22,7 +22,7 @@ static const upb_MiniTableSub xds_data_orca_v3_OrcaLoadReport_submsgs[3] = {
  {.submsg = &xds_data_orca_v3_OrcaLoadReport_NamedMetricsEntry_msg_init},
 };

-static const upb_MiniTableField xds_data_orca_v3_OrcaLoadReport__fields[8] = {
+static const upb_MiniTableField xds_data_orca_v3_OrcaLoadReport__fields[9] = {
  {1, UPB_SIZE(16, 0), 0, kUpb_NoSub, 1, kUpb_FieldMode_Scalar | (kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
  {2, UPB_SIZE(24, 8), 0, kUpb_NoSub, 1, kUpb_FieldMode_Scalar | (kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
  {3, UPB_SIZE(32, 16), 0, kUpb_NoSub, 4, kUpb_FieldMode_Scalar | (kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
@ -31,12 +31,13 @@ static const upb_MiniTableField xds_data_orca_v3_OrcaLoadReport__fields[8] = {
  {6, 40, 0, kUpb_NoSub, 1, kUpb_FieldMode_Scalar | (kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
  {7, 48, 0, kUpb_NoSub, 1, kUpb_FieldMode_Scalar | (kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
  {8, UPB_SIZE(8, 56), 0, 2, 11, kUpb_FieldMode_Map | (UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {9, UPB_SIZE(56, 64), 0, kUpb_NoSub, 1, kUpb_FieldMode_Scalar | (kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
 };

 const upb_MiniTable xds_data_orca_v3_OrcaLoadReport_msg_init = {
  &xds_data_orca_v3_OrcaLoadReport_submsgs[0],
  &xds_data_orca_v3_OrcaLoadReport__fields[0],
-  UPB_SIZE(56, 64), 8, kUpb_ExtMode_NonExtendable, 8, UPB_FASTTABLE_MASK(56), 0,
+  UPB_SIZE(64, 72), 9, kUpb_ExtMode_NonExtendable, 9, UPB_FASTTABLE_MASK(120), 0,
  UPB_FASTTABLE_INIT({
    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
    {0x000000003f000009, &upb_psf8_1bt},
@ -46,6 +47,14 @@ const upb_MiniTable xds_data_orca_v3_OrcaLoadReport_msg_init = {
    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
    {0x002800003f000031, &upb_psf8_1bt},
    {0x003000003f000039, &upb_psf8_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x004000003f000049, &upb_psf8_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
  })
 };

--- a/src/core/ext/upb-generated/xds/data/orca/v3/orca_load_report.upb.h
+++ b/src/core/ext/upb-generated/xds/data/orca/v3/orca_load_report.upb.h
@ -189,6 +189,17 @@ UPB_INLINE const xds_data_orca_v3_OrcaLoadReport_NamedMetricsEntry* xds_data_orc
  if (!map) return NULL;
  return (const xds_data_orca_v3_OrcaLoadReport_NamedMetricsEntry*)_upb_map_next(map, iter);
 }
+UPB_INLINE void xds_data_orca_v3_OrcaLoadReport_clear_application_utilization(xds_data_orca_v3_OrcaLoadReport* msg) {
+  const upb_MiniTableField field = {9, UPB_SIZE(56, 64), 0, kUpb_NoSub, 1, kUpb_FieldMode_Scalar | (kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_ClearNonExtensionField(msg, &field);
+}
+UPB_INLINE double xds_data_orca_v3_OrcaLoadReport_application_utilization(const xds_data_orca_v3_OrcaLoadReport* msg) {
+  double default_val = 0;
+  double ret;
+  const upb_MiniTableField field = {9, UPB_SIZE(56, 64), 0, kUpb_NoSub, 1, kUpb_FieldMode_Scalar | (kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(msg, &field, &default_val, &ret);
+  return ret;
+}

 UPB_INLINE void xds_data_orca_v3_OrcaLoadReport_set_cpu_utilization(xds_data_orca_v3_OrcaLoadReport *msg, double value) {
  const upb_MiniTableField field = {1, UPB_SIZE(16, 0), 0, kUpb_NoSub, 1, kUpb_FieldMode_Scalar | (kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
@ -282,6 +293,10 @@ UPB_INLINE xds_data_orca_v3_OrcaLoadReport_NamedMetricsEntry* xds_data_orca_v3_O
  if (!map) return NULL;
  return (xds_data_orca_v3_OrcaLoadReport_NamedMetricsEntry*)_upb_map_next(map, iter);
 }
+UPB_INLINE void xds_data_orca_v3_OrcaLoadReport_set_application_utilization(xds_data_orca_v3_OrcaLoadReport *msg, double value) {
+  const upb_MiniTableField field = {9, UPB_SIZE(56, 64), 0, kUpb_NoSub, 1, kUpb_FieldMode_Scalar | (kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_SetNonExtensionField(msg, &field, &value);
+}

 /* xds.data.orca.v3.OrcaLoadReport.RequestCostEntry */

--- a/src/core/ext/xds/xds_route_config.cc
+++ b/src/core/ext/xds/xds_route_config.cc
@ -80,10 +80,10 @@

 namespace grpc_core {

-// TODO(donnadionne): Remove once RLS is no longer experimental
+// TODO(apolcyn): remove this flag by the 1.58 release
 bool XdsRlsEnabled() {
  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_RLS_LB");
-  if (!value.has_value()) return false;
+  if (!value.has_value()) return true;
  bool parsed_value;
  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
  return parse_succeeded && parsed_value;
--- a/src/core/lib/backoff/random_early_detection.h
+++ b/src/core/lib/backoff/random_early_detection.h
@ -43,6 +43,11 @@ class RandomEarlyDetection {
  uint64_t soft_limit() const { return soft_limit_; }
  uint64_t hard_limit() const { return hard_limit_; }

+  void SetLimits(uint64_t soft_limit, uint64_t hard_limit) {
+    soft_limit_ = soft_limit;
+    hard_limit_ = hard_limit;
+  }
+
 private:
  // The soft limit is the size at which we start rejecting items with a
  // probability that increases linearly to 1 as the size approaches the hard
--- a/src/core/lib/channel/channelz.h
+++ b/src/core/lib/channel/channelz.h
@ -152,12 +152,33 @@ class PerCpuCallCountingHelper {
  // testing peer friend.
  friend class testing::CallCountingHelperPeer;

+  // We want to ensure that this per-cpu data structure lands on different
+  // cachelines per cpu.
+  // With C++17 we can do so explicitly with an `alignas` specifier.
+  // Prior versions we can at best approximate it by padding the structure.
+  // It'll probably work out ok, but it's not guaranteed across allocators.
+  // (in the bad case where this gets split across cachelines we'll just have
+  // two cpus fighting over the same cacheline with a slight performance
+  // degregation).
+  // TODO(ctiller): When we move to C++17 delete the duplicate definition.
+#if __cplusplus >= 201703L
  struct alignas(GPR_CACHELINE_SIZE) PerCpuData {
    std::atomic<int64_t> calls_started{0};
    std::atomic<int64_t> calls_succeeded{0};
    std::atomic<int64_t> calls_failed{0};
    std::atomic<gpr_cycle_counter> last_call_started_cycle{0};
  };
+#else
+  struct PerCpuDataHeader {
+    std::atomic<int64_t> calls_started{0};
+    std::atomic<int64_t> calls_succeeded{0};
+    std::atomic<int64_t> calls_failed{0};
+    std::atomic<gpr_cycle_counter> last_call_started_cycle{0};
+  };
+  struct PerCpuData : public PerCpuDataHeader {
+    uint8_t padding[GPR_CACHELINE_SIZE - sizeof(PerCpuDataHeader)];
+  };
+#endif
  PerCpu<PerCpuData> per_cpu_data_{PerCpuOptions().SetCpusPerShard(4)};
 };

--- a/src/core/lib/event_engine/posix_engine/posix_engine.h
+++ b/src/core/lib/event_engine/posix_engine/posix_engine.h
@ -196,6 +196,7 @@ class PosixEventEngine final : public PosixEventEngineWithFdSupport,
      const DNSResolver::ResolverOptions& options) override;
  void Run(Closure* closure) override;
  void Run(absl::AnyInvocable<void()> closure) override;
+  // Caution!! The timer implementation cannot create any fds. See #20418.
  TaskHandle RunAfter(Duration when, Closure* closure) override;
  TaskHandle RunAfter(Duration when,
                      absl::AnyInvocable<void()> closure) override;
--- a/src/core/lib/event_engine/posix_engine/posix_engine_listener.cc
+++ b/src/core/lib/event_engine/posix_engine/posix_engine_listener.cc
@ -23,7 +23,9 @@
 #include <sys/socket.h>  // IWYU pragma: keep
 #include <unistd.h>      // IWYU pragma: keep

+#include <atomic>
 #include <string>
+#include <tuple>
 #include <utility>

 #include "absl/functional/any_invocable.h"
@ -41,6 +43,7 @@
 #include "src/core/lib/event_engine/posix_engine/tcp_socket_utils.h"
 #include "src/core/lib/event_engine/tcp_socket_utils.h"
 #include "src/core/lib/gprpp/status_helper.h"
+#include "src/core/lib/gprpp/time.h"
 #include "src/core/lib/iomgr/socket_mutator.h"

 namespace grpc_event_engine {
@ -136,6 +139,32 @@ void PosixEngineListenerImpl::AsyncConnectionAcceptor::NotifyOnAccept(
      switch (errno) {
        case EINTR:
          continue;
+        case EMFILE:
+          // When the process runs out of fds, accept4() returns EMFILE. When
+          // this happens, the connection is left in the accept queue until
+          // either a read event triggers the on_read callback, or time has
+          // passed and the accept should be re-tried regardless. This callback
+          // is not cancelled, so a spurious wakeup may occur even when there's
+          // nothing to accept. This is not a performant code path, but if an fd
+          // limit has been reached, the system is likely in an unhappy state
+          // regardless.
+          GRPC_LOG_EVERY_N_SEC(1, GPR_ERROR, "%s",
+                               "File descriptor limit reached. Retrying.");
+          handle_->NotifyOnRead(notify_on_accept_);
+          // Do not schedule another timer if one is already armed.
+          if (retry_timer_armed_.exchange(true)) return;
+          // Hold a ref while the retry timer is waiting, to prevent listener
+          // destruction and the races that would ensue.
+          Ref();
+          std::ignore =
+              engine_->RunAfter(grpc_core::Duration::Seconds(1), [this]() {
+                retry_timer_armed_.store(false);
+                if (!handle_->IsHandleShutdown()) {
+                  handle_->SetReadable();
+                }
+                Unref();
+              });
+          return;
        case EAGAIN:
        case ECONNABORTED:
          handle_->NotifyOnRead(notify_on_accept_);
--- a/src/core/lib/event_engine/posix_engine/posix_engine_listener.h
+++ b/src/core/lib/event_engine/posix_engine/posix_engine_listener.h
@ -121,6 +121,9 @@ class PosixEngineListenerImpl
    ListenerSocketsContainer::ListenerSocket socket_;
    EventHandle* handle_;
    PosixEngineClosure* notify_on_accept_;
+    // Tracks the status of a backup timer to retry accept4 calls after file
+    // descriptor exhaustion.
+    std::atomic<bool> retry_timer_armed_{false};
  };
  class ListenerAsyncAcceptors : public ListenerSocketsContainer {
   public:
--- a/src/core/lib/iomgr/tcp_server_posix.cc
+++ b/src/core/lib/iomgr/tcp_server_posix.cc
@ -18,6 +18,8 @@

 #include <grpc/support/port_platform.h>

+#include <utility>
+
 #include <grpc/support/atm.h>

 // FIXME: "posix" files shouldn't be depending on _GNU_SOURCE
@ -78,6 +80,8 @@
 #include "src/core/lib/transport/error_utils.h"

 static std::atomic<int64_t> num_dropped_connections{0};
+static constexpr grpc_core::Duration kRetryAcceptWaitTime{
+    grpc_core::Duration::Seconds(1)};

 using ::grpc_event_engine::experimental::EndpointConfig;
 using ::grpc_event_engine::experimental::EventEngine;
@ -361,22 +365,38 @@ static void on_read(void* arg, grpc_error_handle err) {
    if (fd < 0) {
      if (errno == EINTR) {
        continue;
-      } else if (errno == EAGAIN || errno == ECONNABORTED ||
-                 errno == EWOULDBLOCK) {
+      }
+      // When the process runs out of fds, accept4() returns EMFILE. When this
+      // happens, the connection is left in the accept queue until either a
+      // read event triggers the on_read callback, or time has passed and the
+      // accept should be re-tried regardless. This callback is not cancelled,
+      // so a spurious wakeup may occur even when there's nothing to accept.
+      // This is not a performant code path, but if an fd limit has been
+      // reached, the system is likely in an unhappy state regardless.
+      if (errno == EMFILE) {
+        GRPC_LOG_EVERY_N_SEC(1, GPR_ERROR, "%s",
+                             "File descriptor limit reached. Retrying.");
+        grpc_fd_notify_on_read(sp->emfd, &sp->read_closure);
+        if (gpr_atm_full_xchg(&sp->retry_timer_armed, true)) return;
+        grpc_timer_init(&sp->retry_timer,
+                        grpc_core::Timestamp::Now() + kRetryAcceptWaitTime,
+                        &sp->retry_closure);
+        return;
+      }
+      if (errno == EAGAIN || errno == ECONNABORTED || errno == EWOULDBLOCK) {
        grpc_fd_notify_on_read(sp->emfd, &sp->read_closure);
        return;
-      } else {
-        gpr_mu_lock(&sp->server->mu);
-        if (!sp->server->shutdown_listeners) {
-          gpr_log(GPR_ERROR, "Failed accept4: %s",
-                  grpc_core::StrError(errno).c_str());
-        } else {
-          // if we have shutdown listeners, accept4 could fail, and we
-          // needn't notify users
-        }
-        gpr_mu_unlock(&sp->server->mu);
-        goto error;
      }
+      gpr_mu_lock(&sp->server->mu);
+      if (!sp->server->shutdown_listeners) {
+        gpr_log(GPR_ERROR, "Failed accept4: %s",
+                grpc_core::StrError(errno).c_str());
+      } else {
+        // if we have shutdown listeners, accept4 could fail, and we
+        // needn't notify users
+      }
+      gpr_mu_unlock(&sp->server->mu);
+      goto error;
    }

    if (sp->server->memory_quota->IsMemoryPressureHigh()) {
@ -569,6 +589,7 @@ static grpc_error_handle clone_port(grpc_tcp_listener* listener,
    sp->port_index = listener->port_index;
    sp->fd_index = listener->fd_index + count - i;
    GPR_ASSERT(sp->emfd);
+    grpc_tcp_server_listener_initialize_retry_timer(sp);
    while (listener->server->tail->next != nullptr) {
      listener->server->tail = listener->server->tail->next;
    }
@ -817,6 +838,7 @@ static void tcp_server_shutdown_listeners(grpc_tcp_server* s) {
  if (s->active_ports) {
    grpc_tcp_listener* sp;
    for (sp = s->head; sp; sp = sp->next) {
+      grpc_timer_cancel(&sp->retry_timer);
      grpc_fd_shutdown(sp->emfd, GRPC_ERROR_CREATE("Server shutdown"));
    }
  }
--- a/src/core/lib/iomgr/tcp_server_utils_posix.h
+++ b/src/core/lib/iomgr/tcp_server_utils_posix.h
@ -30,6 +30,7 @@
 #include "src/core/lib/iomgr/resolve_address.h"
 #include "src/core/lib/iomgr/socket_utils_posix.h"
 #include "src/core/lib/iomgr/tcp_server.h"
+#include "src/core/lib/iomgr/timer.h"
 #include "src/core/lib/resource_quota/memory_quota.h"

 // one listening port
@ -52,6 +53,11 @@ typedef struct grpc_tcp_listener {
  // identified while iterating through 'next'.
  struct grpc_tcp_listener* sibling;
  int is_sibling;
+  // If an accept4() call fails, a timer is started to drain the accept queue in
+  // case no further connection attempts reach the gRPC server.
+  grpc_closure retry_closure;
+  grpc_timer retry_timer;
+  gpr_atm retry_timer_armed;
 } grpc_tcp_listener;

 // the overall server
@ -139,4 +145,10 @@ grpc_error_handle grpc_tcp_server_prepare_socket(
 // Ruturn true if the platform supports ifaddrs
 bool grpc_tcp_server_have_ifaddrs(void);

+// Initialize (but don't start) the timer and callback to retry accept4() on a
+// listening socket after file descriptors have been exhausted. This must be
+// called when creating a new listener.
+void grpc_tcp_server_listener_initialize_retry_timer(
+    grpc_tcp_listener* listener);
+
 #endif  // GRPC_SRC_CORE_LIB_IOMGR_TCP_SERVER_UTILS_POSIX_H
--- a/src/core/lib/iomgr/tcp_server_utils_posix_common.cc
+++ b/src/core/lib/iomgr/tcp_server_utils_posix_common.cc
@ -18,6 +18,8 @@

 #include <grpc/support/port_platform.h>

+#include <grpc/support/atm.h>
+
 #include "src/core/lib/iomgr/port.h"

 #ifdef GRPC_POSIX_SOCKET_TCP_SERVER_UTILS_COMMON
@ -81,6 +83,24 @@ static int get_max_accept_queue_size(void) {
  return s_max_accept_queue_size;
 }

+static void listener_retry_timer_cb(void* arg, grpc_error_handle err) {
+  // Do nothing if cancelled.
+  if (!err.ok()) return;
+  grpc_tcp_listener* listener = static_cast<grpc_tcp_listener*>(arg);
+  gpr_atm_no_barrier_store(&listener->retry_timer_armed, false);
+  if (!grpc_fd_is_shutdown(listener->emfd)) {
+    grpc_fd_set_readable(listener->emfd);
+  }
+}
+
+void grpc_tcp_server_listener_initialize_retry_timer(
+    grpc_tcp_listener* listener) {
+  gpr_atm_no_barrier_store(&listener->retry_timer_armed, false);
+  grpc_timer_init_unset(&listener->retry_timer);
+  GRPC_CLOSURE_INIT(&listener->retry_closure, listener_retry_timer_cb, listener,
+                    grpc_schedule_on_exec_ctx);
+}
+
 static grpc_error_handle add_socket_to_server(grpc_tcp_server* s, int fd,
                                              const grpc_resolved_address* addr,
                                              unsigned port_index,
@ -112,6 +132,7 @@ static grpc_error_handle add_socket_to_server(grpc_tcp_server* s, int fd,
  sp->server = s;
  sp->fd = fd;
  sp->emfd = grpc_fd_create(fd, name.c_str(), true);
+  grpc_tcp_server_listener_initialize_retry_timer(sp);

  // Check and set fd as prellocated
  if (grpc_tcp_server_pre_allocated_fd(s) == fd) {
--- a/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc
+++ b/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc
@ -120,3 +120,23 @@ void grpc_tls_credentials_options_set_tls_session_key_log_file_path(
  }
  options->set_tls_session_key_log_file_path(path != nullptr ? path : "");
 }
+
+void grpc_tls_credentials_options_set_send_client_ca_list(
+    grpc_tls_credentials_options* options, bool send_client_ca_list) {
+  if (options == nullptr) {
+    return;
+  }
+  options->set_send_client_ca_list(send_client_ca_list);
+}
+
+void grpc_tls_credentials_options_set_min_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version min_tls_version) {
+  GPR_ASSERT(options != nullptr);
+  options->set_min_tls_version(min_tls_version);
+}
+
+void grpc_tls_credentials_options_set_max_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version max_tls_version) {
+  GPR_ASSERT(options != nullptr);
+  options->set_max_tls_version(max_tls_version);
+}
--- a/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h
+++ b/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h
@ -61,6 +61,7 @@ struct grpc_tls_credentials_options
  const std::string& identity_cert_name() const { return identity_cert_name_; }
  const std::string& tls_session_key_log_file_path() const { return tls_session_key_log_file_path_; }
  const std::string& crl_directory() const { return crl_directory_; }
+  bool send_client_ca_list() const { return send_client_ca_list_; }

  // Setters for member fields.
  void set_cert_request_type(grpc_ssl_client_certificate_request_type cert_request_type) { cert_request_type_ = cert_request_type; }
@ -81,6 +82,7 @@ struct grpc_tls_credentials_options
  void set_tls_session_key_log_file_path(std::string tls_session_key_log_file_path) { tls_session_key_log_file_path_ = std::move(tls_session_key_log_file_path); }
  //  gRPC will enforce CRLs on all handshakes from all hashed CRL files inside of the crl_directory. If not set, an empty string will be used, which will not enable CRL checking. Only supported for OpenSSL version > 1.1.
  void set_crl_directory(std::string crl_directory) { crl_directory_ = std::move(crl_directory); }
+  void set_send_client_ca_list(bool send_client_ca_list) { send_client_ca_list_ = send_client_ca_list; }

  bool operator==(const grpc_tls_credentials_options& other) const {
    return cert_request_type_ == other.cert_request_type_ &&
@ -95,7 +97,8 @@ struct grpc_tls_credentials_options
      watch_identity_pair_ == other.watch_identity_pair_ &&
      identity_cert_name_ == other.identity_cert_name_ &&
      tls_session_key_log_file_path_ == other.tls_session_key_log_file_path_ &&
-      crl_directory_ == other.crl_directory_;
+      crl_directory_ == other.crl_directory_ &&
+      send_client_ca_list_ == other.send_client_ca_list_;
  }

 private:
@ -112,6 +115,7 @@ struct grpc_tls_credentials_options
  std::string identity_cert_name_;
  std::string tls_session_key_log_file_path_;
  std::string crl_directory_;
+  bool send_client_ca_list_ = false;
 };

 #endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CREDENTIALS_OPTIONS_H
--- a/src/core/lib/security/credentials/tls/tls_credentials.cc
+++ b/src/core/lib/security/credentials/tls/tls_credentials.cc
@ -45,6 +45,20 @@ bool CredentialOptionSanityCheck(grpc_tls_credentials_options* options,
    gpr_log(GPR_ERROR, "TLS credentials options is nullptr.");
    return false;
  }
+  // In this case, there will be non-retriable handshake errors.
+  if (options->min_tls_version() == grpc_tls_version::TLS1_3 &&
+      options->max_tls_version() == grpc_tls_version::TLS1_2) {
+    gpr_log(GPR_ERROR, "TLS min version must not be higher than max version.");
+    return false;
+  }
+  if (options->max_tls_version() > grpc_tls_version::TLS1_3) {
+    gpr_log(GPR_ERROR, "TLS max version must not be higher than v1.3.");
+    return false;
+  }
+  if (options->min_tls_version() < grpc_tls_version::TLS1_2) {
+    gpr_log(GPR_ERROR, "TLS min version must not be lower than v1.2.");
+    return false;
+  }
  // In the following conditions, there won't be any issues, but it might
  // indicate callers are doing something wrong with the API.
  if (is_client && options->cert_request_type() !=
--- a/src/core/lib/security/security_connector/ssl_utils.cc
+++ b/src/core/lib/security/security_connector/ssl_utils.cc
@ -465,7 +465,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
    grpc_ssl_client_certificate_request_type client_certificate_request,
    tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
    tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
-    const char* crl_directory,
+    const char* crl_directory, bool send_client_ca_list,
    tsi_ssl_server_handshaker_factory** handshaker_factory) {
  size_t num_alpn_protocols = 0;
  const char** alpn_protocol_strings =
@ -483,6 +483,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
  options.max_tls_version = max_tls_version;
  options.key_logger = tls_session_key_logger;
  options.crl_directory = crl_directory;
+  options.send_client_ca_list = send_client_ca_list;
  const tsi_result result =
      tsi_create_ssl_server_handshaker_factory_with_options(&options,
                                                            handshaker_factory);
--- a/src/core/lib/security/security_connector/ssl_utils.h
+++ b/src/core/lib/security/security_connector/ssl_utils.h
@ -93,7 +93,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
    grpc_ssl_client_certificate_request_type client_certificate_request,
    tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
    tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
-    const char* crl_directory,
+    const char* crl_directory, bool send_client_ca_list,
    tsi_ssl_server_handshaker_factory** handshaker_factory);

 // Free the memory occupied by key cert pairs.
--- a/src/core/lib/security/security_connector/tls/tls_security_connector.cc
+++ b/src/core/lib/security/security_connector/tls/tls_security_connector.cc
@ -830,7 +830,7 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
      grpc_get_tsi_tls_version(options_->min_tls_version()),
      grpc_get_tsi_tls_version(options_->max_tls_version()),
      tls_session_key_logger_.get(), options_->crl_directory().c_str(),
-      &server_handshaker_factory_);
+      options_->send_client_ca_list(), &server_handshaker_factory_);
  // Free memory.
  grpc_tsi_ssl_pem_key_cert_pairs_destroy(pem_key_cert_pairs,
                                          num_key_cert_pairs);
--- a/src/core/lib/surface/validate_metadata.cc
+++ b/src/core/lib/surface/validate_metadata.cc
@ -21,8 +21,6 @@
 #include "src/core/lib/surface/validate_metadata.h"

 #include "absl/status/status.h"
-#include "absl/strings/escaping.h"
-#include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"

 #include <grpc/grpc.h>
@ -46,32 +44,49 @@ class LegalHeaderKeyBits : public BitSet<256> {
 };
 constexpr LegalHeaderKeyBits g_legal_header_key_bits;

-GPR_ATTRIBUTE_NOINLINE
-absl::Status DoesNotConformTo(absl::string_view x, const char* err_desc) {
-  return absl::InternalError(absl::StrCat(err_desc, ": ", x, " (hex ",
-                                          absl::BytesToHexString(x), ")"));
-}
-
-absl::Status ConformsTo(absl::string_view x, const BitSet<256>& legal_bits,
-                        const char* err_desc) {
+ValidateMetadataResult ConformsTo(absl::string_view x,
+                                  const BitSet<256>& legal_bits,
+                                  ValidateMetadataResult error) {
  for (uint8_t c : x) {
    if (!legal_bits.is_set(c)) {
-      return DoesNotConformTo(x, err_desc);
+      return error;
    }
  }
-  return absl::OkStatus();
+  return ValidateMetadataResult::kOk;
 }
+
+absl::Status UpgradeToStatus(ValidateMetadataResult result) {
+  if (result == ValidateMetadataResult::kOk) return absl::OkStatus();
+  return absl::InternalError(ValidateMetadataResultToString(result));
+}
+
 }  // namespace

-absl::Status ValidateHeaderKeyIsLegal(absl::string_view key) {
+ValidateMetadataResult ValidateHeaderKeyIsLegal(absl::string_view key) {
  if (key.empty()) {
-    return absl::InternalError("Metadata keys cannot be zero length");
+    return ValidateMetadataResult::kCannotBeZeroLength;
  }
  if (key.size() > UINT32_MAX) {
-    return absl::InternalError(
-        "Metadata keys cannot be larger than UINT32_MAX");
+    return ValidateMetadataResult::kTooLong;
  }
-  return ConformsTo(key, g_legal_header_key_bits, "Illegal header key");
+  return ConformsTo(key, g_legal_header_key_bits,
+                    ValidateMetadataResult::kIllegalHeaderKey);
+}
+
+const char* ValidateMetadataResultToString(ValidateMetadataResult result) {
+  switch (result) {
+    case ValidateMetadataResult::kOk:
+      return "Ok";
+    case ValidateMetadataResult::kCannotBeZeroLength:
+      return "Metadata keys cannot be zero length";
+    case ValidateMetadataResult::kTooLong:
+      return "Metadata keys cannot be larger than UINT32_MAX";
+    case ValidateMetadataResult::kIllegalHeaderKey:
+      return "Illegal header key";
+    case ValidateMetadataResult::kIllegalHeaderValue:
+      return "Illegal header value";
+  }
+  GPR_UNREACHABLE_CODE(return "Unknown");
 }

 }  // namespace grpc_core
@ -82,8 +97,8 @@ static int error2int(grpc_error_handle error) {
 }

 grpc_error_handle grpc_validate_header_key_is_legal(const grpc_slice& slice) {
-  return grpc_core::ValidateHeaderKeyIsLegal(
-      grpc_core::StringViewFromSlice(slice));
+  return grpc_core::UpgradeToStatus(grpc_core::ValidateHeaderKeyIsLegal(
+      grpc_core::StringViewFromSlice(slice)));
 }

 int grpc_header_key_is_legal(grpc_slice slice) {
@ -104,9 +119,9 @@ constexpr LegalHeaderNonBinValueBits g_legal_header_non_bin_value_bits;

 grpc_error_handle grpc_validate_header_nonbin_value_is_legal(
    const grpc_slice& slice) {
-  return grpc_core::ConformsTo(grpc_core::StringViewFromSlice(slice),
-                               g_legal_header_non_bin_value_bits,
-                               "Illegal header value");
+  return grpc_core::UpgradeToStatus(grpc_core::ConformsTo(
+      grpc_core::StringViewFromSlice(slice), g_legal_header_non_bin_value_bits,
+      grpc_core::ValidateMetadataResult::kIllegalHeaderValue));
 }

 int grpc_header_nonbin_value_is_legal(grpc_slice slice) {
--- a/src/core/lib/surface/validate_metadata.h
+++ b/src/core/lib/surface/validate_metadata.h
@ -25,7 +25,6 @@

 #include <cstring>

-#include "absl/status/status.h"
 #include "absl/strings/string_view.h"

 #include <grpc/slice.h>
@ -35,9 +34,20 @@

 namespace grpc_core {

-absl::Status ValidateHeaderKeyIsLegal(absl::string_view key);
+enum class ValidateMetadataResult : uint8_t {
+  kOk,
+  kCannotBeZeroLength,
+  kTooLong,
+  kIllegalHeaderKey,
+  kIllegalHeaderValue
+};

-}
+const char* ValidateMetadataResultToString(ValidateMetadataResult result);
+
+// Returns nullopt if the key is legal, otherwise returns an error message.
+ValidateMetadataResult ValidateHeaderKeyIsLegal(absl::string_view key);
+
+}  // namespace grpc_core

 grpc_error_handle grpc_validate_header_key_is_legal(const grpc_slice& slice);
 grpc_error_handle grpc_validate_header_nonbin_value_is_legal(
--- a/src/core/tsi/ssl_transport_security.cc
+++ b/src/core/tsi/ssl_transport_security.cc
@ -2202,12 +2202,15 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
        STACK_OF(X509_NAME)* root_names = nullptr;
        result = ssl_ctx_load_verification_certs(
            impl->ssl_contexts[i], options->pem_client_root_certs,
-            strlen(options->pem_client_root_certs), &root_names);
+            strlen(options->pem_client_root_certs),
+            options->send_client_ca_list ? &root_names : nullptr);
        if (result != TSI_OK) {
          gpr_log(GPR_ERROR, "Invalid verification certs.");
          break;
        }
-        SSL_CTX_set_client_CA_list(impl->ssl_contexts[i], root_names);
+        if (options->send_client_ca_list) {
+          SSL_CTX_set_client_CA_list(impl->ssl_contexts[i], root_names);
+        }
      }
      switch (options->client_certificate_request) {
        case TSI_DONT_REQUEST_CLIENT_CERTIFICATE:
--- a/src/core/tsi/ssl_transport_security.h
+++ b/src/core/tsi/ssl_transport_security.h
@ -325,6 +325,17 @@ struct tsi_ssl_server_handshaker_options {
  // crl checking. Only OpenSSL version > 1.1 is supported for CRL checking
  const char* crl_directory;

+  // If true, the SSL server sends a list of CA names to the client in the
+  // ServerHello. This list of CA names is extracted from the server's trust
+  // bundle, and the client may use this lint as a hint to decide which
+  // certificate it should send to the server.
+  //
+  // WARNING: This is an extremely dangerous option. If the server's trust
+  // bundle is sufficiently large, then setting this bit to true will result in
+  // the server being unable to generate a ServerHello, and hence the server
+  // will be unusable.
+  bool send_client_ca_list;
+
  tsi_ssl_server_handshaker_options()
      : pem_key_cert_pairs(nullptr),
        num_key_cert_pairs(0),
@ -338,7 +349,8 @@ struct tsi_ssl_server_handshaker_options {
        min_tls_version(tsi_tls_version::TSI_TLS1_2),
        max_tls_version(tsi_tls_version::TSI_TLS1_3),
        key_logger(nullptr),
-        crl_directory(nullptr) {}
+        crl_directory(nullptr),
+        send_client_ca_list(true) {}
 };

 // Creates a server handshaker factory.
--- a/src/cpp/common/tls_credentials_options.cc
+++ b/src/cpp/common/tls_credentials_options.cc
@ -84,6 +84,18 @@ void TlsCredentialsOptions::set_certificate_verifier(
  }
 }

+void TlsCredentialsOptions::set_min_tls_version(grpc_tls_version tls_version) {
+  grpc_tls_credentials_options* options = c_credentials_options();
+  GPR_ASSERT(options != nullptr);
+  grpc_tls_credentials_options_set_min_tls_version(options, tls_version);
+}
+
+void TlsCredentialsOptions::set_max_tls_version(grpc_tls_version tls_version) {
+  grpc_tls_credentials_options* options = c_credentials_options();
+  GPR_ASSERT(options != nullptr);
+  grpc_tls_credentials_options_set_max_tls_version(options, tls_version);
+}
+
 void TlsCredentialsOptions::set_check_call_host(bool check_call_host) {
  grpc_tls_credentials_options* options = c_credentials_options();
  GPR_ASSERT(options != nullptr);
@ -106,5 +118,13 @@ void TlsServerCredentialsOptions::set_cert_request_type(
                                                     cert_request_type);
 }

+void TlsServerCredentialsOptions::set_send_client_ca_list(
+    bool send_client_ca_list) {
+  grpc_tls_credentials_options* options = c_credentials_options();
+  GPR_ASSERT(options != nullptr);
+  grpc_tls_credentials_options_set_send_client_ca_list(options,
+                                                       send_client_ca_list);
+}
+
 }  // namespace experimental
 }  // namespace grpc
--- a/src/cpp/server/backend_metric_recorder.cc
+++ b/src/cpp/server/backend_metric_recorder.cc
@ -34,8 +34,8 @@
 using grpc_core::BackendMetricData;

 namespace {
-// CPU utilization values must be in [0, infy).
-bool IsCpuUtilizationValid(double cpu) { return cpu >= 0.0; }
+// Utilization values with soft limits must be in [0, infy).
+bool IsUtilizationWithSoftLimitsValid(double util) { return util >= 0.0; }

 // Other utilization values must be in [0, 1].
 bool IsUtilizationValid(double utilization) {
@ -68,7 +68,7 @@ void ServerMetricRecorder::UpdateBackendMetricDataState(
 }

 void ServerMetricRecorder::SetCpuUtilization(double value) {
-  if (!IsCpuUtilizationValid(value)) {
+  if (!IsUtilizationWithSoftLimitsValid(value)) {
    if (GRPC_TRACE_FLAG_ENABLED(grpc_backend_metric_trace)) {
      gpr_log(GPR_INFO, "[%p] CPU utilization rejected: %f", this, value);
    }
@ -95,6 +95,22 @@ void ServerMetricRecorder::SetMemoryUtilization(double value) {
  }
 }

+void ServerMetricRecorder::SetApplicationUtilization(double value) {
+  if (!IsUtilizationWithSoftLimitsValid(value)) {
+    if (GRPC_TRACE_FLAG_ENABLED(grpc_backend_metric_trace)) {
+      gpr_log(GPR_INFO, "[%p] Application utilization rejected: %f", this,
+              value);
+    }
+    return;
+  }
+  UpdateBackendMetricDataState([value](BackendMetricData* data) {
+    data->application_utilization = value;
+  });
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_backend_metric_trace)) {
+    gpr_log(GPR_INFO, "[%p] Application utilization set: %f", this, value);
+  }
+}
+
 void ServerMetricRecorder::SetQps(double value) {
  if (!IsRateValid(value)) {
    if (GRPC_TRACE_FLAG_ENABLED(grpc_backend_metric_trace)) {
@ -172,6 +188,14 @@ void ServerMetricRecorder::ClearMemoryUtilization() {
  }
 }

+void ServerMetricRecorder::ClearApplicationUtilization() {
+  UpdateBackendMetricDataState(
+      [](BackendMetricData* data) { data->application_utilization = -1; });
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_backend_metric_trace)) {
+    gpr_log(GPR_INFO, "[%p] Application utilization cleared.", this);
+  }
+}
+
 void ServerMetricRecorder::ClearQps() {
  UpdateBackendMetricDataState([](BackendMetricData* data) { data->qps = -1; });
  if (GRPC_TRACE_FLAG_ENABLED(grpc_backend_metric_trace)) {
@ -212,9 +236,10 @@ ServerMetricRecorder::GetMetricsIfChanged() const {
    const auto& data = result->data;
    gpr_log(GPR_INFO,
            "[%p] GetMetrics() returned: seq:%" PRIu64
-            " cpu:%f mem:%f qps:%f eps:%f utilization size: %" PRIuPTR,
+            " cpu:%f mem:%f app:%f qps:%f eps:%f utilization size: %" PRIuPTR,
            this, result->sequence_number, data.cpu_utilization,
-            data.mem_utilization, data.qps, data.eps, data.utilization.size());
+            data.mem_utilization, data.application_utilization, data.qps,
+            data.eps, data.utilization.size());
  }
  return result;
 }
@ -223,7 +248,7 @@ ServerMetricRecorder::GetMetricsIfChanged() const {

 experimental::CallMetricRecorder&
 BackendMetricState::RecordCpuUtilizationMetric(double value) {
-  if (!IsCpuUtilizationValid(value)) {
+  if (!IsUtilizationWithSoftLimitsValid(value)) {
    if (GRPC_TRACE_FLAG_ENABLED(grpc_backend_metric_trace)) {
      gpr_log(GPR_INFO, "[%p] CPU utilization value rejected: %f", this, value);
    }
@ -251,6 +276,22 @@ BackendMetricState::RecordMemoryUtilizationMetric(double value) {
  return *this;
 }

+experimental::CallMetricRecorder&
+BackendMetricState::RecordApplicationUtilizationMetric(double value) {
+  if (!IsUtilizationWithSoftLimitsValid(value)) {
+    if (GRPC_TRACE_FLAG_ENABLED(grpc_backend_metric_trace)) {
+      gpr_log(GPR_INFO, "[%p] Application utilization value rejected: %f", this,
+              value);
+    }
+    return *this;
+  }
+  application_utilization_.store(value, std::memory_order_relaxed);
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_backend_metric_trace)) {
+    gpr_log(GPR_INFO, "[%p] Application utilization recorded: %f", this, value);
+  }
+  return *this;
+}
+
 experimental::CallMetricRecorder& BackendMetricState::RecordQpsMetric(
    double value) {
  if (!IsRateValid(value)) {
@ -333,13 +374,18 @@ BackendMetricData BackendMetricState::GetBackendMetricData() {
  }
  // Only overwrite if the value is set i.e. in the valid range.
  const double cpu = cpu_utilization_.load(std::memory_order_relaxed);
-  if (IsCpuUtilizationValid(cpu)) {
+  if (IsUtilizationWithSoftLimitsValid(cpu)) {
    data.cpu_utilization = cpu;
  }
  const double mem = mem_utilization_.load(std::memory_order_relaxed);
  if (IsUtilizationValid(mem)) {
    data.mem_utilization = mem;
  }
+  const double app_util =
+      application_utilization_.load(std::memory_order_relaxed);
+  if (IsUtilizationWithSoftLimitsValid(app_util)) {
+    data.application_utilization = app_util;
+  }
  const double qps = qps_.load(std::memory_order_relaxed);
  if (IsRateValid(qps)) {
    data.qps = qps;
--- a/src/cpp/server/backend_metric_recorder.h
+++ b/src/cpp/server/backend_metric_recorder.h
@ -58,6 +58,8 @@ class BackendMetricState : public grpc_core::BackendMetricProvider,
      double value) override;
  experimental::CallMetricRecorder& RecordMemoryUtilizationMetric(
      double value) override;
+  experimental::CallMetricRecorder& RecordApplicationUtilizationMetric(
+      double value) override;
  experimental::CallMetricRecorder& RecordQpsMetric(double value) override;
  experimental::CallMetricRecorder& RecordEpsMetric(double value) override;
  experimental::CallMetricRecorder& RecordUtilizationMetric(
@ -73,6 +75,7 @@ class BackendMetricState : public grpc_core::BackendMetricProvider,
  experimental::ServerMetricRecorder* server_metric_recorder_;
  std::atomic<double> cpu_utilization_{-1.0};
  std::atomic<double> mem_utilization_{-1.0};
+  std::atomic<double> application_utilization_{-1.0};
  std::atomic<double> qps_{-1.0};
  std::atomic<double> eps_{-1.0};
  internal::Mutex mu_;
--- a/src/cpp/server/orca/orca_service.cc
+++ b/src/cpp/server/orca/orca_service.cc
@ -203,6 +203,10 @@ Slice OrcaService::GetOrCreateSerializedResponse() {
      xds_data_orca_v3_OrcaLoadReport_set_mem_utilization(response,
                                                          data.mem_utilization);
    }
+    if (data.application_utilization != -1) {
+      xds_data_orca_v3_OrcaLoadReport_set_application_utilization(
+          response, data.application_utilization);
+    }
    if (data.qps != -1) {
      xds_data_orca_v3_OrcaLoadReport_set_rps_fractional(response, data.qps);
    }
--- a/src/cpp/server/secure_server_credentials.cc
+++ b/src/cpp/server/secure_server_credentials.cc
@ -152,8 +152,13 @@ std::shared_ptr<ServerCredentials> LocalServerCredentials(

 std::shared_ptr<ServerCredentials> TlsServerCredentials(
    const grpc::experimental::TlsServerCredentialsOptions& options) {
-  return std::shared_ptr<ServerCredentials>(new SecureServerCredentials(
-      grpc_tls_server_credentials_create(options.c_credentials_options())));
+  grpc_server_credentials* c_creds =
+      grpc_tls_server_credentials_create(options.c_credentials_options());
+  if (c_creds == nullptr) {
+    return nullptr;
+  }
+  return std::shared_ptr<ServerCredentials>(
+      new SecureServerCredentials(c_creds));
 }

 }  // namespace experimental
--- a/src/csharp/build/dependencies.props
+++ b/src/csharp/build/dependencies.props
@ -1,7 +1,7 @@
 <!-- This file is generated -->
 <Project>
  <PropertyGroup>
-    <GrpcCsharpVersion>2.56.0-dev</GrpcCsharpVersion>
+    <GrpcCsharpVersion>2.56.4</GrpcCsharpVersion>
    <GoogleProtobufVersion>3.23.1</GoogleProtobufVersion>
  </PropertyGroup>
 </Project>
--- a/src/objective-c/!ProtoCompiler-gRPCCppPlugin.podspec
+++ b/src/objective-c/!ProtoCompiler-gRPCCppPlugin.podspec
@ -42,7 +42,7 @@ Pod::Spec.new do |s|
  # exclamation mark ensures that other "regular" pods will be able to find it as it'll be installed
  # before them.
  s.name     = '!ProtoCompiler-gRPCCppPlugin'
-  v = '1.56.0-dev'
+  v = '1.56.4'
  s.version  = v
  s.summary  = 'The gRPC ProtoC plugin generates C++ files from .proto services.'
  s.description = <<-DESC
--- a/src/objective-c/!ProtoCompiler-gRPCPlugin.podspec
+++ b/src/objective-c/!ProtoCompiler-gRPCPlugin.podspec
@ -42,7 +42,7 @@ Pod::Spec.new do |s|
  # exclamation mark ensures that other "regular" pods will be able to find it as it'll be installed
  # before them.
  s.name     = '!ProtoCompiler-gRPCPlugin'
-  v = '1.56.0-dev'
+  v = '1.56.4'
  s.version  = v
  s.summary  = 'The gRPC ProtoC plugin generates Objective-C files from .proto services.'
  s.description = <<-DESC
--- a/src/objective-c/GRPCClient/version.h
+++ b/src/objective-c/GRPCClient/version.h
@ -22,4 +22,4 @@
 // instead. This file can be regenerated from the template by running
 // `tools/buildgen/generate_projects.sh`.

-#define GRPC_OBJC_VERSION_STRING @"1.56.0-dev"
+#define GRPC_OBJC_VERSION_STRING @"1.56.4"
--- a/src/objective-c/tests/version.h
+++ b/src/objective-c/tests/version.h
@ -22,5 +22,5 @@
 // instead. This file can be regenerated from the template by running
 // `tools/buildgen/generate_projects.sh`.

-#define GRPC_OBJC_VERSION_STRING @"1.56.0-dev"
+#define GRPC_OBJC_VERSION_STRING @"1.56.4"
 #define GRPC_C_VERSION_STRING @"33.0.0"
--- a/src/php/composer.json
+++ b/src/php/composer.json
@ -2,7 +2,7 @@
  "name": "grpc/grpc-dev",
  "description": "gRPC library for PHP - for Development use only",
  "license": "Apache-2.0",
-  "version": "1.56.0",
+  "version": "1.56.4",
  "require": {
    "php": ">=7.0.0",
    "google/protobuf": "^v3.3.0"
--- a/src/php/ext/grpc/version.h
+++ b/src/php/ext/grpc/version.h
@ -20,6 +20,6 @@
 #ifndef VERSION_H
 #define VERSION_H

-#define PHP_GRPC_VERSION "1.56.0dev"
+#define PHP_GRPC_VERSION "1.56.4"

 #endif /* VERSION_H */
--- a/src/proto/grpc/testing/xds/v3/orca_load_report.proto
+++ b/src/proto/grpc/testing/xds/v3/orca_load_report.proto
@ -52,5 +52,13 @@ message OrcaLoadReport {

  // Application specific opaque metrics.
  map<string, double> named_metrics = 8;
+
+  // Application specific utilization expressed as a fraction of available
+  // resources. For example, an application may report the max of CPU and memory
+  // utilization for better load balancing if it is both CPU and memory bound.
+  // This should be derived from the latest sample or measurement.
+  // The value may be larger than 1.0 when the usage exceeds the reporter
+  // dependent notion of soft limits.
+  double application_utilization = 9;
 }

--- a/src/python/grpcio/grpc/_grpcio_metadata.py
+++ b/src/python/grpcio/grpc/_grpcio_metadata.py
@ -14,4 +14,4 @@

 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio/grpc/_grpcio_metadata.py.template`!!!

-__version__ = """1.56.0.dev0"""
+__version__ = """1.56.4"""
--- a/src/python/grpcio/grpc_core_dependencies.py
+++ b/src/python/grpcio/grpc_core_dependencies.py
@ -111,6 +111,7 @@ CORE_SOURCE_FILES = [
    'src/core/ext/transport/chttp2/transport/frame_window_update.cc',
    'src/core/ext/transport/chttp2/transport/hpack_encoder.cc',
    'src/core/ext/transport/chttp2/transport/hpack_encoder_table.cc',
+    'src/core/ext/transport/chttp2/transport/hpack_parse_result.cc',
    'src/core/ext/transport/chttp2/transport/hpack_parser.cc',
    'src/core/ext/transport/chttp2/transport/hpack_parser_table.cc',
    'src/core/ext/transport/chttp2/transport/http2_settings.cc',
@ -1210,6 +1211,8 @@ CORE_SOURCE_FILES = [
    'third_party/boringssl-with-bazel/src/ssl/tls13_server.cc',
    'third_party/boringssl-with-bazel/src/ssl/tls_method.cc',
    'third_party/boringssl-with-bazel/src/ssl/tls_record.cc',
+    'third_party/cares/cares/src/lib/ares__addrinfo2hostent.c',
+    'third_party/cares/cares/src/lib/ares__addrinfo_localhost.c',
    'third_party/cares/cares/src/lib/ares__close_sockets.c',
    'third_party/cares/cares/src/lib/ares__get_hostent.c',
    'third_party/cares/cares/src/lib/ares__parse_into_addrinfo.c',
@ -1250,9 +1253,11 @@ CORE_SOURCE_FILES = [
    'third_party/cares/cares/src/lib/ares_parse_soa_reply.c',
    'third_party/cares/cares/src/lib/ares_parse_srv_reply.c',
    'third_party/cares/cares/src/lib/ares_parse_txt_reply.c',
+    'third_party/cares/cares/src/lib/ares_parse_uri_reply.c',
    'third_party/cares/cares/src/lib/ares_platform.c',
    'third_party/cares/cares/src/lib/ares_process.c',
    'third_party/cares/cares/src/lib/ares_query.c',
+    'third_party/cares/cares/src/lib/ares_rand.c',
    'third_party/cares/cares/src/lib/ares_search.c',
    'third_party/cares/cares/src/lib/ares_send.c',
    'third_party/cares/cares/src/lib/ares_strcasecmp.c',
--- a/src/python/grpcio/grpc_version.py
+++ b/src/python/grpcio/grpc_version.py
@ -14,4 +14,4 @@

 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio/grpc_version.py.template`!!!

-VERSION = '1.56.0.dev0'
+VERSION = '1.56.4'
--- a/src/python/grpcio_admin/grpc_version.py
+++ b/src/python/grpcio_admin/grpc_version.py
@ -14,4 +14,4 @@

 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_admin/grpc_version.py.template`!!!

-VERSION = '1.56.0.dev0'
+VERSION = '1.56.4'
--- a/src/python/grpcio_channelz/grpc_version.py
+++ b/src/python/grpcio_channelz/grpc_version.py
@ -14,4 +14,4 @@

 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_channelz/grpc_version.py.template`!!!

-VERSION = '1.56.0.dev0'
+VERSION = '1.56.4'
--- a/src/python/grpcio_csds/grpc_version.py
+++ b/src/python/grpcio_csds/grpc_version.py
@ -14,4 +14,4 @@

 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_csds/grpc_version.py.template`!!!

-VERSION = '1.56.0.dev0'
+VERSION = '1.56.4'
--- a/src/python/grpcio_health_checking/grpc_version.py
+++ b/src/python/grpcio_health_checking/grpc_version.py
@ -14,4 +14,4 @@

 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_health_checking/grpc_version.py.template`!!!

-VERSION = '1.56.0.dev0'
+VERSION = '1.56.4'
--- a/src/python/grpcio_reflection/grpc_version.py
+++ b/src/python/grpcio_reflection/grpc_version.py
@ -14,4 +14,4 @@

 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_reflection/grpc_version.py.template`!!!

-VERSION = '1.56.0.dev0'
+VERSION = '1.56.4'
--- a/src/python/grpcio_status/grpc_version.py
+++ b/src/python/grpcio_status/grpc_version.py
@ -14,4 +14,4 @@

 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_status/grpc_version.py.template`!!!

-VERSION = '1.56.0.dev0'
+VERSION = '1.56.4'
--- a/src/python/grpcio_testing/grpc_version.py
+++ b/src/python/grpcio_testing/grpc_version.py
@ -14,4 +14,4 @@

 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_testing/grpc_version.py.template`!!!

-VERSION = '1.56.0.dev0'
+VERSION = '1.56.4'
--- a/src/python/grpcio_tests/grpc_version.py
+++ b/src/python/grpcio_tests/grpc_version.py
@ -14,4 +14,4 @@

 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_tests/grpc_version.py.template`!!!

-VERSION = '1.56.0.dev0'
+VERSION = '1.56.4'
--- a/src/python/grpcio_tests/tests_py3_only/interop/Dockerfile.client
+++ b/src/python/grpcio_tests/tests_py3_only/interop/Dockerfile.client
@ -1,11 +1,6 @@
-FROM phusion/baseimage:master@sha256:65ea10d5f757e5e86272625f8675d437dd83d8db64bdb429e2354d58f5462750
+FROM python:3.9-slim-bookworm

-RUN apt-get update -y && \
-        apt-get install -y \
-            build-essential \
-            clang \
-            python3 \
-            python3-dev
+RUN apt-get update -y && apt-get upgrade -y && apt-get install -y build-essential clang curl

 WORKDIR /workdir

@ -16,13 +11,18 @@ COPY . .
 RUN tools/bazel build -c dbg //src/python/grpcio_tests/tests_py3_only/interop:xds_interop_client
 RUN cp -rL /workdir/bazel-bin/src/python/grpcio_tests/tests_py3_only/interop/xds_interop_client* /artifacts/

-FROM phusion/baseimage:master@sha256:65ea10d5f757e5e86272625f8675d437dd83d8db64bdb429e2354d58f5462750
-COPY --from=0 /artifacts ./
+FROM python:3.9-slim-bookworm

 ENV GRPC_VERBOSITY="DEBUG"
 ENV GRPC_TRACE="xds_client,xds_resolver,xds_cluster_manager_lb,cds_lb,xds_cluster_resolver_lb,priority_lb,xds_cluster_impl_lb,weighted_target_lb,ring_hash_lb,outlier_detection_lb"

-RUN apt-get update -y && apt-get install -y python3
+RUN apt-get update -y \
+  && apt-get install -y python3 \
+  && apt-get -y autoremove \
+  && rm -rf /var/lib/apt/lists/*
+
 RUN ln -s /usr/bin/python3 /usr/bin/python

+COPY --from=0 /artifacts ./
+
 ENTRYPOINT ["/xds_interop_client"]
--- a/src/python/grpcio_tests/tests_py3_only/interop/Dockerfile.server
+++ b/src/python/grpcio_tests/tests_py3_only/interop/Dockerfile.server
@ -1,11 +1,6 @@
-FROM phusion/baseimage:master@sha256:65ea10d5f757e5e86272625f8675d437dd83d8db64bdb429e2354d58f5462750
+FROM python:3.9-slim-bookworm

-RUN apt-get update -y && \
-        apt-get install -y \
-            build-essential \
-            clang \
-            python3 \
-            python3-dev
+RUN apt-get update -y && apt-get upgrade -y && apt-get install -y build-essential clang curl

 WORKDIR /workdir

@ -16,13 +11,18 @@ COPY . .
 RUN tools/bazel build -c dbg //src/python/grpcio_tests/tests_py3_only/interop:xds_interop_server
 RUN cp -rL /workdir/bazel-bin/src/python/grpcio_tests/tests_py3_only/interop/xds_interop_server* /artifacts/

-FROM phusion/baseimage:master@sha256:65ea10d5f757e5e86272625f8675d437dd83d8db64bdb429e2354d58f5462750
-COPY --from=0 /artifacts ./
+FROM python:3.9-slim-bookworm

 ENV GRPC_VERBOSITY="DEBUG"
 ENV GRPC_TRACE="xds_client,xds_resolver,xds_cluster_manager_lb,cds_lb,xds_cluster_resolver_lb,priority_lb,xds_cluster_impl_lb,weighted_target_lb"

-RUN apt-get update -y && apt-get install -y python3
+RUN apt-get update -y \
+    && apt-get install -y python3 \
+    && apt-get -y autoremove \
+    && rm -rf /var/lib/apt/lists/*
+
 RUN ln -s /usr/bin/python3 /usr/bin/python

+COPY --from=0 /artifacts ./
+
 ENTRYPOINT ["/xds_interop_server"]
--- a/src/ruby/ext/grpc/rb_grpc_imports.generated.c
+++ b/src/ruby/ext/grpc/rb_grpc_imports.generated.c
@ -180,6 +180,8 @@ grpc_tls_certificate_provider_static_data_create_type grpc_tls_certificate_provi
 grpc_tls_certificate_provider_file_watcher_create_type grpc_tls_certificate_provider_file_watcher_create_import;
 grpc_tls_certificate_provider_release_type grpc_tls_certificate_provider_release_import;
 grpc_tls_credentials_options_create_type grpc_tls_credentials_options_create_import;
+grpc_tls_credentials_options_set_min_tls_version_type grpc_tls_credentials_options_set_min_tls_version_import;
+grpc_tls_credentials_options_set_max_tls_version_type grpc_tls_credentials_options_set_max_tls_version_import;
 grpc_tls_credentials_options_set_certificate_provider_type grpc_tls_credentials_options_set_certificate_provider_import;
 grpc_tls_credentials_options_watch_root_certs_type grpc_tls_credentials_options_watch_root_certs_import;
 grpc_tls_credentials_options_set_root_cert_name_type grpc_tls_credentials_options_set_root_cert_name_import;
@ -188,6 +190,7 @@ grpc_tls_credentials_options_set_identity_cert_name_type grpc_tls_credentials_op
 grpc_tls_credentials_options_set_cert_request_type_type grpc_tls_credentials_options_set_cert_request_type_import;
 grpc_tls_credentials_options_set_crl_directory_type grpc_tls_credentials_options_set_crl_directory_import;
 grpc_tls_credentials_options_set_verify_server_cert_type grpc_tls_credentials_options_set_verify_server_cert_import;
+grpc_tls_credentials_options_set_send_client_ca_list_type grpc_tls_credentials_options_set_send_client_ca_list_import;
 grpc_tls_credentials_options_set_check_call_host_type grpc_tls_credentials_options_set_check_call_host_import;
 grpc_insecure_credentials_create_type grpc_insecure_credentials_create_import;
 grpc_insecure_server_credentials_create_type grpc_insecure_server_credentials_create_import;
@ -466,6 +469,8 @@ void grpc_rb_load_imports(HMODULE library) {
  grpc_tls_certificate_provider_file_watcher_create_import = (grpc_tls_certificate_provider_file_watcher_create_type) GetProcAddress(library, "grpc_tls_certificate_provider_file_watcher_create");
  grpc_tls_certificate_provider_release_import = (grpc_tls_certificate_provider_release_type) GetProcAddress(library, "grpc_tls_certificate_provider_release");
  grpc_tls_credentials_options_create_import = (grpc_tls_credentials_options_create_type) GetProcAddress(library, "grpc_tls_credentials_options_create");
+  grpc_tls_credentials_options_set_min_tls_version_import = (grpc_tls_credentials_options_set_min_tls_version_type) GetProcAddress(library, "grpc_tls_credentials_options_set_min_tls_version");
+  grpc_tls_credentials_options_set_max_tls_version_import = (grpc_tls_credentials_options_set_max_tls_version_type) GetProcAddress(library, "grpc_tls_credentials_options_set_max_tls_version");
  grpc_tls_credentials_options_set_certificate_provider_import = (grpc_tls_credentials_options_set_certificate_provider_type) GetProcAddress(library, "grpc_tls_credentials_options_set_certificate_provider");
  grpc_tls_credentials_options_watch_root_certs_import = (grpc_tls_credentials_options_watch_root_certs_type) GetProcAddress(library, "grpc_tls_credentials_options_watch_root_certs");
  grpc_tls_credentials_options_set_root_cert_name_import = (grpc_tls_credentials_options_set_root_cert_name_type) GetProcAddress(library, "grpc_tls_credentials_options_set_root_cert_name");
@ -474,6 +479,7 @@ void grpc_rb_load_imports(HMODULE library) {
  grpc_tls_credentials_options_set_cert_request_type_import = (grpc_tls_credentials_options_set_cert_request_type_type) GetProcAddress(library, "grpc_tls_credentials_options_set_cert_request_type");
  grpc_tls_credentials_options_set_crl_directory_import = (grpc_tls_credentials_options_set_crl_directory_type) GetProcAddress(library, "grpc_tls_credentials_options_set_crl_directory");
  grpc_tls_credentials_options_set_verify_server_cert_import = (grpc_tls_credentials_options_set_verify_server_cert_type) GetProcAddress(library, "grpc_tls_credentials_options_set_verify_server_cert");
+  grpc_tls_credentials_options_set_send_client_ca_list_import = (grpc_tls_credentials_options_set_send_client_ca_list_type) GetProcAddress(library, "grpc_tls_credentials_options_set_send_client_ca_list");
  grpc_tls_credentials_options_set_check_call_host_import = (grpc_tls_credentials_options_set_check_call_host_type) GetProcAddress(library, "grpc_tls_credentials_options_set_check_call_host");
  grpc_insecure_credentials_create_import = (grpc_insecure_credentials_create_type) GetProcAddress(library, "grpc_insecure_credentials_create");
  grpc_insecure_server_credentials_create_import = (grpc_insecure_server_credentials_create_type) GetProcAddress(library, "grpc_insecure_server_credentials_create");
--- a/src/ruby/ext/grpc/rb_grpc_imports.generated.h
+++ b/src/ruby/ext/grpc/rb_grpc_imports.generated.h
@ -515,6 +515,12 @@ extern grpc_tls_certificate_provider_release_type grpc_tls_certificate_provider_
 typedef grpc_tls_credentials_options*(*grpc_tls_credentials_options_create_type)(void);
 extern grpc_tls_credentials_options_create_type grpc_tls_credentials_options_create_import;
 #define grpc_tls_credentials_options_create grpc_tls_credentials_options_create_import
+typedef void(*grpc_tls_credentials_options_set_min_tls_version_type)(grpc_tls_credentials_options* options, grpc_tls_version min_tls_version);
+extern grpc_tls_credentials_options_set_min_tls_version_type grpc_tls_credentials_options_set_min_tls_version_import;
+#define grpc_tls_credentials_options_set_min_tls_version grpc_tls_credentials_options_set_min_tls_version_import
+typedef void(*grpc_tls_credentials_options_set_max_tls_version_type)(grpc_tls_credentials_options* options, grpc_tls_version max_tls_version);
+extern grpc_tls_credentials_options_set_max_tls_version_type grpc_tls_credentials_options_set_max_tls_version_import;
+#define grpc_tls_credentials_options_set_max_tls_version grpc_tls_credentials_options_set_max_tls_version_import
 typedef void(*grpc_tls_credentials_options_set_certificate_provider_type)(grpc_tls_credentials_options* options, grpc_tls_certificate_provider* provider);
 extern grpc_tls_credentials_options_set_certificate_provider_type grpc_tls_credentials_options_set_certificate_provider_import;
 #define grpc_tls_credentials_options_set_certificate_provider grpc_tls_credentials_options_set_certificate_provider_import
@ -539,6 +545,9 @@ extern grpc_tls_credentials_options_set_crl_directory_type grpc_tls_credentials_
 typedef void(*grpc_tls_credentials_options_set_verify_server_cert_type)(grpc_tls_credentials_options* options, int verify_server_cert);
 extern grpc_tls_credentials_options_set_verify_server_cert_type grpc_tls_credentials_options_set_verify_server_cert_import;
 #define grpc_tls_credentials_options_set_verify_server_cert grpc_tls_credentials_options_set_verify_server_cert_import
+typedef void(*grpc_tls_credentials_options_set_send_client_ca_list_type)(grpc_tls_credentials_options* options, bool send_client_ca_list);
+extern grpc_tls_credentials_options_set_send_client_ca_list_type grpc_tls_credentials_options_set_send_client_ca_list_import;
+#define grpc_tls_credentials_options_set_send_client_ca_list grpc_tls_credentials_options_set_send_client_ca_list_import
 typedef void(*grpc_tls_credentials_options_set_check_call_host_type)(grpc_tls_credentials_options* options, int check_call_host);
 extern grpc_tls_credentials_options_set_check_call_host_type grpc_tls_credentials_options_set_check_call_host_import;
 #define grpc_tls_credentials_options_set_check_call_host grpc_tls_credentials_options_set_check_call_host_import
--- a/src/ruby/lib/grpc/version.rb
+++ b/src/ruby/lib/grpc/version.rb
@ -14,5 +14,5 @@

 # GRPC contains the General RPC module.
 module GRPC
-  VERSION = '1.56.0.dev'
+  VERSION = '1.56.4'
 end
--- a/src/ruby/tools/version.rb
+++ b/src/ruby/tools/version.rb
@ -14,6 +14,6 @@

 module GRPC
  module Tools
-    VERSION = '1.56.0.dev'
+    VERSION = '1.56.4'
  end
 end
--- a/templates/Makefile.template
+++ b/templates/Makefile.template
@ -283,7 +283,7 @@
  endif

  ifeq ($(SYSTEM),MINGW32)
-  LIBS = m pthread ws2_32 dbghelp bcrypt
+  LIBS = m pthread ws2_32 iphlpapi dbghelp bcrypt
  LDFLAGS += -pthread
  endif

--- a/test/core/client_channel/lb_policy/lb_policy_test_lib.h
+++ b/test/core/client_channel/lb_policy/lb_policy_test_lib.h
@ -333,11 +333,9 @@ class LoadBalancingPolicyTest : public ::testing::Test {
    // unexpected events in the queue.
    void ExpectQueueEmpty(SourceLocation location = SourceLocation()) {
      MutexLock lock(&mu_);
-      EXPECT_TRUE(queue_.empty()) << location.file() << ":" << location.line();
-      for (const Event& event : queue_) {
-        gpr_log(GPR_ERROR, "UNEXPECTED EVENT LEFT IN QUEUE: %s",
-                EventString(event).c_str());
-      }
+      EXPECT_TRUE(queue_.empty())
+          << location.file() << ":" << location.line() << "\n"
+          << QueueString();
    }

    // Returns the next event in the queue if it is a state update.
@ -394,6 +392,14 @@ class LoadBalancingPolicyTest : public ::testing::Test {
          });
    }

+    std::string QueueString() const ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_) {
+      std::vector<std::string> parts = {"Queue:"};
+      for (const Event& event : queue_) {
+        parts.push_back(EventString(event));
+      }
+      return absl::StrJoin(parts, "\n  ");
+    }
+
    RefCountedPtr<SubchannelInterface> CreateSubchannel(
        ServerAddress address, const ChannelArgs& args) override {
      SubchannelKey key(address.address(), args);
--- a/test/core/client_channel/lb_policy/outlier_detection_test.cc
+++ b/test/core/client_channel/lb_policy/outlier_detection_test.cc
@ -240,7 +240,7 @@ TEST_F(OutlierDetectionTest, FailurePercentage) {
  picker = WaitForRoundRobinListChange(kAddresses, remaining_addresses);
 }

-TEST_F(OutlierDetectionTest, FailurePercentageWithPickFirst) {
+TEST_F(OutlierDetectionTest, DoesNotWorkWithPickFirst) {
  constexpr std::array<absl::string_view, 3> kAddresses = {
      "ipv4:127.0.0.1:440", "ipv4:127.0.0.1:441", "ipv4:127.0.0.1:442"};
  // Send initial update.
@ -284,13 +284,11 @@ TEST_F(OutlierDetectionTest, FailurePercentageWithPickFirst) {
  // Advance time and run the timer callback to trigger ejection.
  time_cache_.IncrementBy(Duration::Seconds(10));
  RunTimerCallback();
-  gpr_log(GPR_INFO, "### ejection complete");
-  // Expect a re-resolution request.
-  ExpectReresolutionRequest();
-  // The pick_first policy should report IDLE with a queuing picker.
-  ExpectStateAndQueuingPicker(GRPC_CHANNEL_IDLE);
-  // The queued pick should have triggered a reconnection attempt.
-  EXPECT_TRUE(subchannel->ConnectionRequested());
+  gpr_log(GPR_INFO, "### ejection timer pass complete");
+  // Subchannel should not be ejected.
+  ExpectQueueEmpty();
+  // Subchannel should not see a reconnection request.
+  EXPECT_FALSE(subchannel->ConnectionRequested());
 }

 }  // namespace
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Sergii Tkachenko	8f07bd14f1	[PSM Interop] Simplify PSM Interop Kokoro buildscripts (v1.56.x backport) (#36541 ) Backport of #36450 to v1.56.x. --- Integrates the new features of the the Kokoro PSM Interop install library introduced in grpc/psm-interop#73. Nearly all common functionality was moved from per-language/per-branch PSM Interop build scripts to [psm_interop_kokoro_lib.sh](https://github.com/grpc/psm-interop/blob/main/.kokoro/psm_interop_kokoro_lib.sh): 1. The list of tests in the each test suite 2. Per-test-suite flag customization 3. `run_test` methods 4. `build_docker_images_if_needed` methods 5. Generic `build_test_app_docker_images` methods (simple docker build + docker push + docker tag). grpc-java is one exception, as it doesn't run docker directly, but a cloudbuild flow. Now all PSM Interop jobs share the same buildscripts by all test suites: 1. buildscript that invokes the test: `psm-interop-test-{language}.sh` (configured as `build_file` in the build cfg) 2. buildscript that builds the xDS test client/server and publishes them as a Docker image: `psm-interop-build-{language}.sh` (conventional name called from `psm_interop_kokoro_lib.sh`) `psm-interop-test-{language}.sh`: 1. Sets `GRPC_LANGUAGE`, `BUILD_SCRIPT_DIR` environment variables. 2. Downloads the shared `psm_interop_kokoro_lib.sh` from the main branch of the psm-interop repo. 3. Sources `psm-interop-build-{language}.sh` 4. Calls `psm::run "${PSM_TEST_SUITE}"` (`PSM_TEST_SUITE` configured in the cfg file). `psm-interop-build-{language}.sh`: 1. Defines `psm::lang::build_docker_images` which is called from `psm_interop_kokoro_lib.sh`. 2. Invokes any repo-specific logic. 3. May use `psm::build::docker_images_generic` for generic Docker build, tag, push, or provide implement its own build/publish method. References: - b/288578634 - See the full list of the new features at grpc/psm-interop#73. - Additional fixes to the shared lib: grpc/psm-interop#78, grpc/psm-interop#79	2024-05-06 15:14:55 -07:00
Sergii Tkachenko	73741a55c5	[PSM Interop] Migrate to Artifact Registry (v1.56.x backport) (#36317 ) Backport of #36273 to v1.56.x. --- Migrate PSM Interop images from Container Registry (gcr.io) to Artifact Registry (pkg.dev).	2024-04-09 14:03:17 -07:00
Esun Kim	614d26a86d	[Release] Bump version to 1.56.4 (on v1.56.x branch) (#35815 ) Change was created by the release automation script. See go/grpc-release	2024-02-05 15:00:20 -08:00
Matthew Stevenson	eece0c034a	[tls] Backport of #34861 to v1.56.x. (#35795 ) Co-authored-by: Luwei Ge <lwge@google.com>	2024-02-05 11:04:00 -08:00
Xuan Wang	04dd012962	[PSM Interop] Use the Kokoro shared install lib from the new repo (v1.56.x backport) (#35339 ) Backport of #35327 to v1.56.x. --- Source: `4f7ead2c7b/tools/internal_ci/linux/grpc_xds_k8s_install_test_driver.sh` New repo: https://github.com/grpc/psm-interop New path: `.kokoro/psm_interop_kokoro_lib.sh` Ref https://github.com/grpc/psm-interop/pull/16 Co-authored-by: Sergii Tkachenko <sergiitk@google.com>	2023-12-20 10:14:18 -08:00
Esun Kim	06021d9184	[Release] Bump version to 1.56.3 (on v1.56.x branch) (#34622 ) Change was created by the release automation script. See go/grpc-release	2023-10-09 10:08:36 -07:00
Esun Kim	2456bf2d22	[Cord] Backport-1.56: Fix MakeCordFromSlice memory bug (#34558 ) Backport of https://github.com/grpc/grpc/pull/34549	2023-10-06 16:01:00 -07:00
Eugene Ostroukhov	f8d4a0bcc8	[Interop Tests][v1.56] Update Docker images (#34351 )	2023-09-15 10:23:38 -07:00
Eugene Ostroukhov	f0f5ed4dd3	[v1.56.x][Interop] Backport Python image update (#33867 ) Update Phusion base image to address security issues. Original PR: #33847	2023-07-25 13:28:50 -07:00
Eugene Ostroukhov	7536d8a849	[v1.56][Build] Update Phusion baseimage (#33767 ) (#33838 )	2023-07-24 16:09:07 -07:00
Richard Belleville	4d24d6476e	[Backport] [dependency] Restrict cython to less than 3.X (#33773 ) Beep boop. This is an automatically generated backport of #33738. This should resolve breakage on master caused by the jump to Cython 3.0.0 this morning.	2023-07-24 15:44:27 -07:00
Sergii Tkachenko	c9000c07ef	[PSM Interop] Legacy tests: fix xDS test client build (v1.56.x backport) (#33807 ) Backport of #33796 to v1.56.x. --- https://github.com/grpc/grpc/pull/33699 incorrectly changed the legacy builds to not just use the test driver from the master, but also to build from it. This PR fixes the issue, and also updates the python job to work use the driver from master.	2023-07-21 13:38:31 -07:00
Sergii Tkachenko	cebd1cb6bb	[PSM Interop] Legacy test builds always pull the driver from master (v1.56.x backport) (#33723 ) Backport of #33699 to v1.56.x. --- Similar to https://github.com/grpc/grpc-java/pull/8982. All other languages already to this. Needed for easier deployment of https://github.com/grpc/grpc/pull/33685. ref b/274944592	2023-07-14 17:30:55 -07:00
apolcyn	c0d1c393d9	[release] Bump release version to 1.56.2 (#33705 ) Generated by release script	2023-07-14 10:18:24 -07:00
Mark D. Roth	484820a800	[WRR] backport #33694 to 1.56 (#33698 )	2023-07-13 17:42:40 -07:00
github-actions[bot]	6425ed25d6	Automated fix for refs/heads/v1.56.x (#33681 ) PanCakes to the rescue! We noticed that our 'sanity' test was going to fail, but we think we can fix that automatically, so we put together this PR to do just that! If you'd like to opt-out of these PR's, add yourself to NO_AUTOFIX_USERS in .github/workflows/pr-auto-fix.yaml Co-authored-by: ctiller <ctiller@users.noreply.github.com>	2023-07-12 17:25:20 -07:00
AJ Heller	d4b53c70b9	[backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion (#33667 ) Backport of #33656	2023-07-12 15:12:46 -07:00
Yijie Ma	8a59ef0632	[Release] Bump version to 1.56.1 (on v1.56.x branch) (#33651 ) Change was created by the release automation script. See go/grpc-release.	2023-07-10 16:02:08 -07:00
Yijie Ma	67df2b3f49	[Release] Bump version to 1.56.1-pre1 (on v1.56.x branch) (#33619 ) Change was created by the release automation script. See go/grpc-release.	2023-07-06 13:18:41 -07:00
Esun Kim	e46dda5c7d	[Core] Backport:1.56 Improve HPACK (#33603 ) Cherry-pick https://github.com/grpc/grpc/pull/33597	2023-07-06 08:02:16 +09:00
Matthew Stevenson	53e637c18a	[tls] Backport - Remove use of SSL_CTX_set_client_CA_list for TLS server credentials. (#33583 ) See #33558.	2023-07-05 09:26:03 -07:00
Xuan Wang	45480ddd92	[PSM interop] Don't fail url_map target if sub-target already failed (v1.56.x backport) (#33523 ) Backport of #33520 to v1.56.x. --- Follow up change of #33222. We don't want file multiple bugs if any of the sub-tests of the `url_map` test fails. <!-- If you know who should review your pull request, please assign it to that person, otherwise the pull request would get assigned randomly. If your pull request is for a specific language, please add the appropriate lang label. -->	2023-06-22 16:48:06 -07:00
Yijie Ma	6e85620c7e	[Release] Bump version to 1.56.0 (on v1.56.x branch) (#33440 ) Change was created by the release automation script. See go/grpc-release.	2023-06-14 13:21:16 -07:00
Yijie Ma	eccf68abef	[Release] Bump version to 1.56.0-pre3 (on v1.56.x branch) (#33390 ) Change was created by the release automation script. See go/grpc-release.	2023-06-12 17:09:00 -07:00
apolcyn	d5bafa4755	[c-ares] Backport "[c-ares] Upgrade c-ares dependency to 1.19.1 (#33392 )" to v1.56.x (#33411 ) Backports https://github.com/grpc/grpc/pull/33392	2023-06-12 16:27:07 -07:00
Esun Kim	d9d47b5a18	[WRR] Backport 1.56: Prefer application_utilization to cpu_utilization (#33378 ) Backport of #33355 Co-authored-by: Yousuk Seung <ysseung@google.com>	2023-06-09 12:18:31 -07:00
Yijie Ma	fc64109383	[Release] Bump version to 1.56.0-pre2 (on v1.56.x branch) (#33350 ) Change was created by the release automation script. See go/grpc-release.	2023-06-05 13:43:55 -07:00
Mark D. Roth	ded9a15723	[outlier detection] backport to 1.56: hack to prevent OD from working with pick_first (#33347 ) Back-port #33336 to 1.56.	2023-06-05 13:01:58 -07:00
Yijie Ma	4ad81d3da5	[channelz] Backport "[channelz] Make the cacheline stuff work properly for C++14 (#33327 )" to v1.56.x (#33331 ) Backport https://github.com/grpc/grpc/pull/33327 to v1.56.x <!-- If you know who should review your pull request, please assign it to that person, otherwise the pull request would get assigned randomly. If your pull request is for a specific language, please add the appropriate lang label. --> Co-authored-by: Craig Tiller <ctiller@google.com>	2023-06-02 16:55:01 -07:00
apolcyn	91ff8b2bca	[Rls] Backport "[Rls] de-experimentalize RLS in XDS (#33290 )" to v1.56.x (#33330 ) Backport #33290 to 1.56.x.	2023-06-02 14:05:54 -07:00
Xuan Wang	a05e2e3bd2	[Bazel Python3.11] Update Bazel dependencies for Python 3.11 (v1.56.x backport) (#33329 ) Backport of #33318 to v1.56.x. --- We just found out that our current Bazel setup does not support Python 3.11. This PR updates some dependencies to allow using Bazel in Python 3.11. Cython: * Cython [backported Python 3.11 support change to 0.29x](https://github.com/cython/cython/issues/4500), but it appears that the Cython version we are using in Bazel does not include the fix, so we're using the latest stable version instead. Gevent: * The first version of gevent that supports [Python 3.11 is 22.08.0](https://github.com/gevent/gevent/issues/1903#issuecomment-1303227507). #### Testing * Tested locally using Python 3.11 virtual environment, was able to reproduce the issue and verified that those changes were able to fix it.	2023-06-02 12:56:39 -07:00
Yijie Ma	b39e015f34	[Release] Bump version to 1.56.0-pre1 (on v1.56.x branch) (#33312 ) Change was created by the release automation script. See go/grpc-release.	2023-06-01 10:55:53 -07:00