[PSM Interop] Simplify PSM Interop Kokoro buildscripts (v1.59.x backport) (#36538)

Backport of #36450 to v1.59.x.
---
Integrates the new features of the the Kokoro PSM Interop install
library introduced in grpc/psm-interop#73.

Nearly all common functionality was moved from per-language/per-branch
PSM Interop build scripts to
[psm_interop_kokoro_lib.sh](https://github.com/grpc/psm-interop/blob/main/.kokoro/psm_interop_kokoro_lib.sh):
1. The list of tests in the each test suite 
2. Per-test-suite flag customization
3. `run_test` methods
4. `build_docker_images_if_needed` methods
5. Generic `build_test_app_docker_images` methods (simple docker build +
docker push + docker tag). grpc-java is one exception, as it doesn't run
docker directly, but a cloudbuild flow.

Now all PSM Interop jobs share the same buildscripts by all test suites:
1. buildscript that invokes the test: `psm-interop-test-{language}.sh`
(configured as `build_file` in the build cfg)
2. buildscript that builds the xDS test client/server and publishes them
as a Docker image: `psm-interop-build-{language}.sh` (conventional name
called from `psm_interop_kokoro_lib.sh`)

`psm-interop-test-{language}.sh`:
1. Sets `GRPC_LANGUAGE`, `BUILD_SCRIPT_DIR` environment variables.
2. Downloads the shared `psm_interop_kokoro_lib.sh` from the main branch
of the psm-interop repo.
3. Sources `psm-interop-build-{language}.sh`
4. Calls `psm::run "${PSM_TEST_SUITE}"` (`PSM_TEST_SUITE` configured in
the cfg file).

`psm-interop-build-{language}.sh`:
1. Defines `psm::lang::build_docker_images` which is called from
`psm_interop_kokoro_lib.sh`.
2. Invokes any repo-specific logic.
3. May use `psm::build::docker_images_generic` for generic Docker build,
tag, push, or provide implement its own build/publish method.

References:
- b/288578634
- See the full list of the new features at grpc/psm-interop#73.
- Additional fixes to the shared lib: grpc/psm-interop#78,
grpc/psm-interop#79

.gitmodules

@@ -47,6 +47,3 @@
 	# generated file that makes Git consider the submodule dirty. This
 	# state can be ignored for day-to-day development on gRPC.
 	ignore = dirty
-[submodule "third_party/upb"]
-	path = third_party/upb
-	url = https://github.com/protocolbuffers/upb.git

BUILD

@@ -215,7 +215,7 @@ g_stands_for = "generative"  # @unused
 
 core_version = "36.0.0"  # @unused
 
-version = "1.59.0-dev"  # @unused
+version = "1.59.4"  # @unused
 
 GPR_PUBLIC_HDRS = [
     "include/grpc/support/alloc.h",
@@ -254,6 +254,7 @@ GPR_PUBLIC_HDRS = [
 
 GRPC_PUBLIC_HDRS = [
     "include/grpc/grpc_audit_logging.h",
+    "include/grpc/grpc_crl_provider.h",
     "include/grpc/byte_buffer.h",
     "include/grpc/byte_buffer_reader.h",
     "include/grpc/compression.h",
@@ -423,6 +424,7 @@ GRPCXX_PUBLIC_HDRS = [
     "include/grpcpp/impl/sync.h",
     "include/grpcpp/resource_quota.h",
     "include/grpcpp/security/audit_logging.h",
+    "include/grpcpp/security/tls_crl_provider.h",
     "include/grpcpp/security/auth_context.h",
     "include/grpcpp/security/auth_metadata_processor.h",
     "include/grpcpp/security/credentials.h",
@@ -1966,6 +1968,7 @@ grpc_cc_library(
         "//src/core:gpr_manual_constructor",
         "//src/core:grpc_audit_logging",
         "//src/core:grpc_backend_metric_provider",
+        "//src/core:grpc_crl_provider",
         "//src/core:grpc_service_config",
         "//src/core:grpc_transport_inproc",
         "//src/core:json",
@@ -3543,6 +3546,7 @@ grpc_cc_library(
         "tsi_ssl_session_cache",
         "//src/core:channel_args",
         "//src/core:error",
+        "//src/core:grpc_crl_provider",
         "//src/core:grpc_transport_chttp2_alpn",
         "//src/core:ref_counted",
         "//src/core:slice",
@@ -3983,11 +3987,13 @@ grpc_cc_library(
         "absl/meta:type_traits",
         "absl/random",
         "absl/random:bit_gen_ref",
+        "absl/random:distributions",
         "absl/status",
         "absl/strings",
         "absl/strings:cord",
         "absl/strings:str_format",
         "absl/types:optional",
+        "absl/types:variant",
     ],
     language = "c++",
     visibility = ["@grpc:grpclb"],
@@ -4025,10 +4031,13 @@ grpc_cc_library(
         "//src/core:iomgr_fwd",
         "//src/core:iomgr_port",
         "//src/core:match",
+        "//src/core:max_concurrent_streams_policy",
         "//src/core:memory_quota",
         "//src/core:ping_abuse_policy",
+        "//src/core:ping_callbacks",
         "//src/core:ping_rate_policy",
         "//src/core:poll",
+        "//src/core:random_early_detection",
         "//src/core:ref_counted",
         "//src/core:resource_quota",
         "//src/core:resource_quota_trace",
@@ -4040,6 +4049,7 @@ grpc_cc_library(
         "//src/core:time",
         "//src/core:transport_fwd",
         "//src/core:useful",
+        "//src/core:write_size_policy",
     ],
 )
 

CMakeLists.txt

@@ -25,10 +25,10 @@
 cmake_minimum_required(VERSION 3.8)
 
 set(PACKAGE_NAME          "grpc")
-set(PACKAGE_VERSION       "1.59.0-dev")
+set(PACKAGE_VERSION       "1.59.4")
 set(gRPC_CORE_VERSION     "36.0.0")
 set(gRPC_CORE_SOVERSION   "36")
-set(gRPC_CPP_VERSION      "1.59.0-dev")
+set(gRPC_CPP_VERSION      "1.59.4")
 set(gRPC_CPP_SOVERSION    "1.59")
 set(PACKAGE_STRING        "${PACKAGE_NAME} ${PACKAGE_VERSION}")
 set(PACKAGE_TARNAME       "${PACKAGE_NAME}-${PACKAGE_VERSION}")
@@ -816,6 +816,9 @@ protobuf_generate_grpc_cpp_with_import_path_correction(
 protobuf_generate_grpc_cpp_with_import_path_correction(
   test/core/tsi/alts/fake_handshaker/transport_security_common.proto test/core/tsi/alts/fake_handshaker/transport_security_common.proto
 )
+protobuf_generate_grpc_cpp_with_import_path_correction(
+  test/core/util/fuzz_config_vars.proto test/core/util/fuzz_config_vars.proto
+)
 
 if(gRPC_BUILD_TESTS)
   add_custom_target(buildtests_c)
@@ -966,6 +969,7 @@ if(gRPC_BUILD_TESTS)
   add_dependencies(buildtests_cxx core_configuration_test)
   add_dependencies(buildtests_cxx cpp_impl_of_test)
   add_dependencies(buildtests_cxx cpu_test)
+  add_dependencies(buildtests_cxx crl_provider_test)
   if(_gRPC_PLATFORM_LINUX OR _gRPC_PLATFORM_MAC OR _gRPC_PLATFORM_POSIX)
     add_dependencies(buildtests_cxx crl_ssl_transport_security_test)
   endif()
@@ -973,6 +977,7 @@ if(gRPC_BUILD_TESTS)
   add_dependencies(buildtests_cxx default_host_test)
   add_dependencies(buildtests_cxx delegating_channel_test)
   add_dependencies(buildtests_cxx destroy_grpclb_channel_with_active_connect_stress_test)
+  add_dependencies(buildtests_cxx directory_reader_test)
   add_dependencies(buildtests_cxx disappearing_server_test)
   add_dependencies(buildtests_cxx dns_resolver_cooldown_test)
   add_dependencies(buildtests_cxx dns_resolver_test)
@@ -1032,6 +1037,7 @@ if(gRPC_BUILD_TESTS)
   if(_gRPC_PLATFORM_LINUX OR _gRPC_PLATFORM_POSIX)
     add_dependencies(buildtests_cxx fuzzing_event_engine_test)
   endif()
+  add_dependencies(buildtests_cxx fuzzing_event_engine_unittest)
   add_dependencies(buildtests_cxx generic_end2end_test)
   add_dependencies(buildtests_cxx goaway_server_test)
   add_dependencies(buildtests_cxx google_c2p_resolver_test)
@@ -1052,6 +1058,7 @@ if(gRPC_BUILD_TESTS)
   add_dependencies(buildtests_cxx grpc_tls_certificate_verifier_test)
   add_dependencies(buildtests_cxx grpc_tls_credentials_options_comparator_test)
   add_dependencies(buildtests_cxx grpc_tls_credentials_options_test)
+  add_dependencies(buildtests_cxx grpc_tls_crl_provider_test)
   if(_gRPC_PLATFORM_LINUX OR _gRPC_PLATFORM_POSIX)
     add_dependencies(buildtests_cxx grpc_tool_test)
   endif()
@@ -1124,6 +1131,7 @@ if(gRPC_BUILD_TESTS)
   add_dependencies(buildtests_cxx map_pipe_test)
   add_dependencies(buildtests_cxx match_test)
   add_dependencies(buildtests_cxx matchers_test)
+  add_dependencies(buildtests_cxx max_concurrent_streams_policy_test)
   add_dependencies(buildtests_cxx max_concurrent_streams_test)
   add_dependencies(buildtests_cxx max_connection_age_test)
   add_dependencies(buildtests_cxx max_connection_idle_test)
@@ -1175,6 +1183,7 @@ if(gRPC_BUILD_TESTS)
   add_dependencies(buildtests_cxx pick_first_test)
   add_dependencies(buildtests_cxx pid_controller_test)
   add_dependencies(buildtests_cxx ping_abuse_policy_test)
+  add_dependencies(buildtests_cxx ping_callbacks_test)
   add_dependencies(buildtests_cxx ping_configuration_test)
   add_dependencies(buildtests_cxx ping_pong_streaming_test)
   add_dependencies(buildtests_cxx ping_rate_policy_test)
@@ -1441,6 +1450,7 @@ if(gRPC_BUILD_TESTS)
   endif()
   add_dependencies(buildtests_cxx write_buffering_at_end_test)
   add_dependencies(buildtests_cxx write_buffering_test)
+  add_dependencies(buildtests_cxx write_size_policy_test)
   if(_gRPC_PLATFORM_LINUX OR _gRPC_PLATFORM_MAC OR _gRPC_PLATFORM_POSIX)
     add_dependencies(buildtests_cxx writes_per_rpc_test)
   endif()
@@ -1830,11 +1840,14 @@ add_library(grpc
   src/core/ext/transport/chttp2/transport/http2_settings.cc
   src/core/ext/transport/chttp2/transport/http_trace.cc
   src/core/ext/transport/chttp2/transport/huffsyms.cc
+  src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc
   src/core/ext/transport/chttp2/transport/parsing.cc
   src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc
+  src/core/ext/transport/chttp2/transport/ping_callbacks.cc
   src/core/ext/transport/chttp2/transport/ping_rate_policy.cc
   src/core/ext/transport/chttp2/transport/stream_lists.cc
   src/core/ext/transport/chttp2/transport/varint.cc
+  src/core/ext/transport/chttp2/transport/write_size_policy.cc
   src/core/ext/transport/chttp2/transport/writing.cc
   src/core/ext/transport/inproc/inproc_plugin.cc
   src/core/ext/transport/inproc/inproc_transport.cc
@@ -2252,11 +2265,13 @@ add_library(grpc
   src/core/lib/experiments/experiments.cc
   src/core/lib/gprpp/load_file.cc
   src/core/lib/gprpp/per_cpu.cc
+  src/core/lib/gprpp/posix/directory_reader.cc
   src/core/lib/gprpp/ref_counted_string.cc
   src/core/lib/gprpp/status_helper.cc
   src/core/lib/gprpp/time.cc
   src/core/lib/gprpp/time_averaged_stats.cc
   src/core/lib/gprpp/validation_errors.cc
+  src/core/lib/gprpp/windows/directory_reader.cc
   src/core/lib/gprpp/work_serializer.cc
   src/core/lib/handshaker/proxy_mapper_registry.cc
   src/core/lib/http/format_request.cc
@@ -2406,6 +2421,7 @@ add_library(grpc
   src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc
   src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.cc
   src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc
+  src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc
   src/core/lib/security/credentials/tls/tls_credentials.cc
   src/core/lib/security/credentials/tls/tls_utils.cc
   src/core/lib/security/credentials/xds/xds_credentials.cc
@@ -2585,6 +2601,7 @@ foreach(_hdr
   include/grpc/fork.h
   include/grpc/grpc.h
   include/grpc/grpc_audit_logging.h
+  include/grpc/grpc_crl_provider.h
   include/grpc/grpc_posix.h
   include/grpc/grpc_security.h
   include/grpc/grpc_security_constants.h
@@ -2866,11 +2883,14 @@ add_library(grpc_unsecure
   src/core/ext/transport/chttp2/transport/http2_settings.cc
   src/core/ext/transport/chttp2/transport/http_trace.cc
   src/core/ext/transport/chttp2/transport/huffsyms.cc
+  src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc
   src/core/ext/transport/chttp2/transport/parsing.cc
   src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc
+  src/core/ext/transport/chttp2/transport/ping_callbacks.cc
   src/core/ext/transport/chttp2/transport/ping_rate_policy.cc
   src/core/ext/transport/chttp2/transport/stream_lists.cc
   src/core/ext/transport/chttp2/transport/varint.cc
+  src/core/ext/transport/chttp2/transport/write_size_policy.cc
   src/core/ext/transport/chttp2/transport/writing.cc
   src/core/ext/transport/inproc/inproc_plugin.cc
   src/core/ext/transport/inproc/inproc_transport.cc
@@ -3245,6 +3265,7 @@ foreach(_hdr
   include/grpc/fork.h
   include/grpc/grpc.h
   include/grpc/grpc_audit_logging.h
+  include/grpc/grpc_crl_provider.h
   include/grpc/grpc_posix.h
   include/grpc/grpc_security.h
   include/grpc/grpc_security_constants.h
@@ -4094,6 +4115,7 @@ foreach(_hdr
   include/grpcpp/security/tls_certificate_provider.h
   include/grpcpp/security/tls_certificate_verifier.h
   include/grpcpp/security/tls_credentials_options.h
+  include/grpcpp/security/tls_crl_provider.h
   include/grpcpp/server.h
   include/grpcpp/server_builder.h
   include/grpcpp/server_context.h
@@ -4782,6 +4804,7 @@ foreach(_hdr
   include/grpcpp/security/tls_certificate_provider.h
   include/grpcpp/security/tls_certificate_verifier.h
   include/grpcpp/security/tls_credentials_options.h
+  include/grpcpp/security/tls_crl_provider.h
   include/grpcpp/server.h
   include/grpcpp/server_builder.h
   include/grpcpp/server_context.h
@@ -5165,6 +5188,7 @@ foreach(_hdr
   include/grpc/fork.h
   include/grpc/grpc.h
   include/grpc/grpc_audit_logging.h
+  include/grpc/grpc_crl_provider.h
   include/grpc/grpc_posix.h
   include/grpc/grpc_security.h
   include/grpc/grpc_security_constants.h
@@ -10016,6 +10040,56 @@ target_link_libraries(cpu_test
 )
 
 
+endif()
+if(gRPC_BUILD_TESTS)
+
+add_executable(crl_provider_test
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/echo.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/echo.grpc.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/echo.pb.h
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/echo.grpc.pb.h
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/echo_messages.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/echo_messages.grpc.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/echo_messages.pb.h
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/echo_messages.grpc.pb.h
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/simple_messages.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/simple_messages.grpc.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/simple_messages.pb.h
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/simple_messages.grpc.pb.h
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/xds/v3/orca_load_report.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/xds/v3/orca_load_report.grpc.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/xds/v3/orca_load_report.pb.h
+  ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/xds/v3/orca_load_report.grpc.pb.h
+  test/cpp/end2end/crl_provider_test.cc
+  test/cpp/end2end/test_service_impl.cc
+)
+target_compile_features(crl_provider_test PUBLIC cxx_std_14)
+target_include_directories(crl_provider_test
+  PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}
+    ${CMAKE_CURRENT_SOURCE_DIR}/include
+    ${_gRPC_ADDRESS_SORTING_INCLUDE_DIR}
+    ${_gRPC_RE2_INCLUDE_DIR}
+    ${_gRPC_SSL_INCLUDE_DIR}
+    ${_gRPC_UPB_GENERATED_DIR}
+    ${_gRPC_UPB_GRPC_GENERATED_DIR}
+    ${_gRPC_UPB_INCLUDE_DIR}
+    ${_gRPC_XXHASH_INCLUDE_DIR}
+    ${_gRPC_ZLIB_INCLUDE_DIR}
+    third_party/googletest/googletest/include
+    third_party/googletest/googletest
+    third_party/googletest/googlemock/include
+    third_party/googletest/googlemock
+    ${_gRPC_PROTO_GENS_DIR}
+)
+
+target_link_libraries(crl_provider_test
+  ${_gRPC_ALLTARGETS_LIBRARIES}
+  gtest
+  grpc++_test_util
+)
+
+
 endif()
 if(gRPC_BUILD_TESTS)
 if(_gRPC_PLATFORM_LINUX OR _gRPC_PLATFORM_MAC OR _gRPC_PLATFORM_POSIX)
@@ -10212,6 +10286,39 @@ target_link_libraries(destroy_grpclb_channel_with_active_connect_stress_test
 )
 
 
+endif()
+if(gRPC_BUILD_TESTS)
+
+add_executable(directory_reader_test
+  test/core/gprpp/directory_reader_test.cc
+)
+target_compile_features(directory_reader_test PUBLIC cxx_std_14)
+target_include_directories(directory_reader_test
+  PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}
+    ${CMAKE_CURRENT_SOURCE_DIR}/include
+    ${_gRPC_ADDRESS_SORTING_INCLUDE_DIR}
+    ${_gRPC_RE2_INCLUDE_DIR}
+    ${_gRPC_SSL_INCLUDE_DIR}
+    ${_gRPC_UPB_GENERATED_DIR}
+    ${_gRPC_UPB_GRPC_GENERATED_DIR}
+    ${_gRPC_UPB_INCLUDE_DIR}
+    ${_gRPC_XXHASH_INCLUDE_DIR}
+    ${_gRPC_ZLIB_INCLUDE_DIR}
+    third_party/googletest/googletest/include
+    third_party/googletest/googletest
+    third_party/googletest/googlemock/include
+    third_party/googletest/googlemock
+    ${_gRPC_PROTO_GENS_DIR}
+)
+
+target_link_libraries(directory_reader_test
+  ${_gRPC_ALLTARGETS_LIBRARIES}
+  gtest
+  grpc_test_util
+)
+
+
 endif()
 if(gRPC_BUILD_TESTS)
 
@@ -12235,6 +12342,45 @@ endif()
 endif()
 if(gRPC_BUILD_TESTS)
 
+add_executable(fuzzing_event_engine_unittest
+  ${_gRPC_PROTO_GENS_DIR}/test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.grpc.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.pb.h
+  ${_gRPC_PROTO_GENS_DIR}/test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.grpc.pb.h
+  test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.cc
+  test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine_unittest.cc
+)
+target_compile_features(fuzzing_event_engine_unittest PUBLIC cxx_std_14)
+target_include_directories(fuzzing_event_engine_unittest
+  PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}
+    ${CMAKE_CURRENT_SOURCE_DIR}/include
+    ${_gRPC_ADDRESS_SORTING_INCLUDE_DIR}
+    ${_gRPC_RE2_INCLUDE_DIR}
+    ${_gRPC_SSL_INCLUDE_DIR}
+    ${_gRPC_UPB_GENERATED_DIR}
+    ${_gRPC_UPB_GRPC_GENERATED_DIR}
+    ${_gRPC_UPB_INCLUDE_DIR}
+    ${_gRPC_XXHASH_INCLUDE_DIR}
+    ${_gRPC_ZLIB_INCLUDE_DIR}
+    third_party/googletest/googletest/include
+    third_party/googletest/googletest
+    third_party/googletest/googlemock/include
+    third_party/googletest/googlemock
+    ${_gRPC_PROTO_GENS_DIR}
+)
+
+target_link_libraries(fuzzing_event_engine_unittest
+  ${_gRPC_ALLTARGETS_LIBRARIES}
+  gtest
+  ${_gRPC_PROTOBUF_LIBRARIES}
+  grpc_test_util
+)
+
+
+endif()
+if(gRPC_BUILD_TESTS)
+
 add_executable(generic_end2end_test
   ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/duplicate/echo_duplicate.pb.cc
   ${_gRPC_PROTO_GENS_DIR}/src/proto/grpc/testing/duplicate/echo_duplicate.grpc.pb.cc
@@ -13322,6 +13468,50 @@ target_link_libraries(grpc_tls_credentials_options_test
 )
 
 
+endif()
+if(gRPC_BUILD_TESTS)
+
+add_executable(grpc_tls_crl_provider_test
+  ${_gRPC_PROTO_GENS_DIR}/test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.grpc.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.pb.h
+  ${_gRPC_PROTO_GENS_DIR}/test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.grpc.pb.h
+  ${_gRPC_PROTO_GENS_DIR}/test/core/util/fuzz_config_vars.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/test/core/util/fuzz_config_vars.grpc.pb.cc
+  ${_gRPC_PROTO_GENS_DIR}/test/core/util/fuzz_config_vars.pb.h
+  ${_gRPC_PROTO_GENS_DIR}/test/core/util/fuzz_config_vars.grpc.pb.h
+  test/core/event_engine/event_engine_test_utils.cc
+  test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.cc
+  test/core/security/grpc_tls_crl_provider_test.cc
+)
+target_compile_features(grpc_tls_crl_provider_test PUBLIC cxx_std_14)
+target_include_directories(grpc_tls_crl_provider_test
+  PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}
+    ${CMAKE_CURRENT_SOURCE_DIR}/include
+    ${_gRPC_ADDRESS_SORTING_INCLUDE_DIR}
+    ${_gRPC_RE2_INCLUDE_DIR}
+    ${_gRPC_SSL_INCLUDE_DIR}
+    ${_gRPC_UPB_GENERATED_DIR}
+    ${_gRPC_UPB_GRPC_GENERATED_DIR}
+    ${_gRPC_UPB_INCLUDE_DIR}
+    ${_gRPC_XXHASH_INCLUDE_DIR}
+    ${_gRPC_ZLIB_INCLUDE_DIR}
+    third_party/googletest/googletest/include
+    third_party/googletest/googletest
+    third_party/googletest/googlemock/include
+    third_party/googletest/googlemock
+    ${_gRPC_PROTO_GENS_DIR}
+)
+
+target_link_libraries(grpc_tls_crl_provider_test
+  ${_gRPC_ALLTARGETS_LIBRARIES}
+  gtest
+  ${_gRPC_PROTOBUF_LIBRARIES}
+  grpc_test_util
+)
+
+
 endif()
 if(gRPC_BUILD_TESTS)
 if(_gRPC_PLATFORM_LINUX OR _gRPC_PLATFORM_POSIX)
@@ -15588,6 +15778,40 @@ target_link_libraries(matchers_test
 )
 
 
+endif()
+if(gRPC_BUILD_TESTS)
+
+add_executable(max_concurrent_streams_policy_test
+  src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc
+  test/core/transport/chttp2/max_concurrent_streams_policy_test.cc
+)
+target_compile_features(max_concurrent_streams_policy_test PUBLIC cxx_std_14)
+target_include_directories(max_concurrent_streams_policy_test
+  PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}
+    ${CMAKE_CURRENT_SOURCE_DIR}/include
+    ${_gRPC_ADDRESS_SORTING_INCLUDE_DIR}
+    ${_gRPC_RE2_INCLUDE_DIR}
+    ${_gRPC_SSL_INCLUDE_DIR}
+    ${_gRPC_UPB_GENERATED_DIR}
+    ${_gRPC_UPB_GRPC_GENERATED_DIR}
+    ${_gRPC_UPB_INCLUDE_DIR}
+    ${_gRPC_XXHASH_INCLUDE_DIR}
+    ${_gRPC_ZLIB_INCLUDE_DIR}
+    third_party/googletest/googletest/include
+    third_party/googletest/googletest
+    third_party/googletest/googlemock/include
+    third_party/googletest/googlemock
+    ${_gRPC_PROTO_GENS_DIR}
+)
+
+target_link_libraries(max_concurrent_streams_policy_test
+  ${_gRPC_ALLTARGETS_LIBRARIES}
+  gtest
+  gpr
+)
+
+
 endif()
 if(gRPC_BUILD_TESTS)
 
@@ -17287,6 +17511,39 @@ target_link_libraries(ping_abuse_policy_test
 )
 
 
+endif()
+if(gRPC_BUILD_TESTS)
+
+add_executable(ping_callbacks_test
+  test/core/transport/chttp2/ping_callbacks_test.cc
+)
+target_compile_features(ping_callbacks_test PUBLIC cxx_std_14)
+target_include_directories(ping_callbacks_test
+  PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}
+    ${CMAKE_CURRENT_SOURCE_DIR}/include
+    ${_gRPC_ADDRESS_SORTING_INCLUDE_DIR}
+    ${_gRPC_RE2_INCLUDE_DIR}
+    ${_gRPC_SSL_INCLUDE_DIR}
+    ${_gRPC_UPB_GENERATED_DIR}
+    ${_gRPC_UPB_GRPC_GENERATED_DIR}
+    ${_gRPC_UPB_INCLUDE_DIR}
+    ${_gRPC_XXHASH_INCLUDE_DIR}
+    ${_gRPC_ZLIB_INCLUDE_DIR}
+    third_party/googletest/googletest/include
+    third_party/googletest/googletest
+    third_party/googletest/googlemock/include
+    third_party/googletest/googlemock
+    ${_gRPC_PROTO_GENS_DIR}
+)
+
+target_link_libraries(ping_callbacks_test
+  ${_gRPC_ALLTARGETS_LIBRARIES}
+  gtest
+  grpc
+)
+
+
 endif()
 if(gRPC_BUILD_TESTS)
 
@@ -26104,6 +26361,42 @@ target_link_libraries(write_buffering_test
 )
 
 
+endif()
+if(gRPC_BUILD_TESTS)
+
+add_executable(write_size_policy_test
+  src/core/ext/transport/chttp2/transport/write_size_policy.cc
+  src/core/lib/gprpp/time.cc
+  test/core/transport/chttp2/write_size_policy_test.cc
+)
+target_compile_features(write_size_policy_test PUBLIC cxx_std_14)
+target_include_directories(write_size_policy_test
+  PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}
+    ${CMAKE_CURRENT_SOURCE_DIR}/include
+    ${_gRPC_ADDRESS_SORTING_INCLUDE_DIR}
+    ${_gRPC_RE2_INCLUDE_DIR}
+    ${_gRPC_SSL_INCLUDE_DIR}
+    ${_gRPC_UPB_GENERATED_DIR}
+    ${_gRPC_UPB_GRPC_GENERATED_DIR}
+    ${_gRPC_UPB_INCLUDE_DIR}
+    ${_gRPC_XXHASH_INCLUDE_DIR}
+    ${_gRPC_ZLIB_INCLUDE_DIR}
+    third_party/googletest/googletest/include
+    third_party/googletest/googletest
+    third_party/googletest/googlemock/include
+    third_party/googletest/googlemock
+    ${_gRPC_PROTO_GENS_DIR}
+)
+
+target_link_libraries(write_size_policy_test
+  ${_gRPC_ALLTARGETS_LIBRARIES}
+  gtest
+  absl::statusor
+  gpr
+)
+
+
 endif()
 if(gRPC_BUILD_TESTS)
 if(_gRPC_PLATFORM_LINUX OR _gRPC_PLATFORM_MAC OR _gRPC_PLATFORM_POSIX)

Makefile

@@ -411,7 +411,7 @@ Q = @
 endif
 
 CORE_VERSION = 36.0.0
-CPP_VERSION = 1.59.0-dev
+CPP_VERSION = 1.59.4
 
 CPPFLAGS_NO_ARCH += $(addprefix -I, $(INCLUDES)) $(addprefix -D, $(DEFINES))
 CPPFLAGS += $(CPPFLAGS_NO_ARCH) $(ARCH_FLAGS)
@@ -1057,11 +1057,14 @@ LIBGRPC_SRC = \
     src/core/ext/transport/chttp2/transport/http2_settings.cc \
     src/core/ext/transport/chttp2/transport/http_trace.cc \
     src/core/ext/transport/chttp2/transport/huffsyms.cc \
+    src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc \
     src/core/ext/transport/chttp2/transport/parsing.cc \
     src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc \
+    src/core/ext/transport/chttp2/transport/ping_callbacks.cc \
     src/core/ext/transport/chttp2/transport/ping_rate_policy.cc \
     src/core/ext/transport/chttp2/transport/stream_lists.cc \
     src/core/ext/transport/chttp2/transport/varint.cc \
+    src/core/ext/transport/chttp2/transport/write_size_policy.cc \
     src/core/ext/transport/chttp2/transport/writing.cc \
     src/core/ext/transport/inproc/inproc_plugin.cc \
     src/core/ext/transport/inproc/inproc_transport.cc \
@@ -1479,11 +1482,13 @@ LIBGRPC_SRC = \
     src/core/lib/experiments/experiments.cc \
     src/core/lib/gprpp/load_file.cc \
     src/core/lib/gprpp/per_cpu.cc \
+    src/core/lib/gprpp/posix/directory_reader.cc \
     src/core/lib/gprpp/ref_counted_string.cc \
     src/core/lib/gprpp/status_helper.cc \
     src/core/lib/gprpp/time.cc \
     src/core/lib/gprpp/time_averaged_stats.cc \
     src/core/lib/gprpp/validation_errors.cc \
+    src/core/lib/gprpp/windows/directory_reader.cc \
     src/core/lib/gprpp/work_serializer.cc \
     src/core/lib/handshaker/proxy_mapper_registry.cc \
     src/core/lib/http/format_request.cc \
@@ -1633,6 +1638,7 @@ LIBGRPC_SRC = \
     src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc \
     src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.cc \
     src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc \
+    src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc \
     src/core/lib/security/credentials/tls/tls_credentials.cc \
     src/core/lib/security/credentials/tls/tls_utils.cc \
     src/core/lib/security/credentials/xds/xds_credentials.cc \
@@ -1747,6 +1753,7 @@ PUBLIC_HEADERS_C += \
     include/grpc/fork.h \
     include/grpc/grpc.h \
     include/grpc/grpc_audit_logging.h \
+    include/grpc/grpc_crl_provider.h \
     include/grpc/grpc_posix.h \
     include/grpc/grpc_security.h \
     include/grpc/grpc_security_constants.h \
@@ -1945,11 +1952,14 @@ LIBGRPC_UNSECURE_SRC = \
     src/core/ext/transport/chttp2/transport/http2_settings.cc \
     src/core/ext/transport/chttp2/transport/http_trace.cc \
     src/core/ext/transport/chttp2/transport/huffsyms.cc \
+    src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc \
     src/core/ext/transport/chttp2/transport/parsing.cc \
     src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc \
+    src/core/ext/transport/chttp2/transport/ping_callbacks.cc \
     src/core/ext/transport/chttp2/transport/ping_rate_policy.cc \
     src/core/ext/transport/chttp2/transport/stream_lists.cc \
     src/core/ext/transport/chttp2/transport/varint.cc \
+    src/core/ext/transport/chttp2/transport/write_size_policy.cc \
     src/core/ext/transport/chttp2/transport/writing.cc \
     src/core/ext/transport/inproc/inproc_plugin.cc \
     src/core/ext/transport/inproc/inproc_transport.cc \
@@ -2260,6 +2270,7 @@ PUBLIC_HEADERS_C += \
     include/grpc/fork.h \
     include/grpc/grpc.h \
     include/grpc/grpc_audit_logging.h \
+    include/grpc/grpc_crl_provider.h \
     include/grpc/grpc_posix.h \
     include/grpc/grpc_security.h \
     include/grpc/grpc_security_constants.h \
@@ -3650,6 +3661,8 @@ src/core/ext/xds/xds_route_config.cc: $(OPENSSL_DEP)
 src/core/ext/xds/xds_routing.cc: $(OPENSSL_DEP)
 src/core/ext/xds/xds_server_config_fetcher.cc: $(OPENSSL_DEP)
 src/core/ext/xds/xds_transport_grpc.cc: $(OPENSSL_DEP)
+src/core/lib/gprpp/posix/directory_reader.cc: $(OPENSSL_DEP)
+src/core/lib/gprpp/windows/directory_reader.cc: $(OPENSSL_DEP)
 src/core/lib/http/httpcli_security_connector.cc: $(OPENSSL_DEP)
 src/core/lib/json/json_util.cc: $(OPENSSL_DEP)
 src/core/lib/matchers/matchers.cc: $(OPENSSL_DEP)
@@ -3679,6 +3692,7 @@ src/core/lib/security/credentials/tls/grpc_tls_certificate_match.cc: $(OPENSSL_D
 src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc: $(OPENSSL_DEP)
 src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.cc: $(OPENSSL_DEP)
 src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc: $(OPENSSL_DEP)
+src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc: $(OPENSSL_DEP)
 src/core/lib/security/credentials/tls/tls_credentials.cc: $(OPENSSL_DEP)
 src/core/lib/security/credentials/xds/xds_credentials.cc: $(OPENSSL_DEP)
 src/core/lib/security/security_connector/alts/alts_security_connector.cc: $(OPENSSL_DEP)

Package.swift

@@ -57,6 +57,7 @@ let package = Package(
         "include/grpc/fork.h",
         "include/grpc/grpc.h",
         "include/grpc/grpc_audit_logging.h",
+        "include/grpc/grpc_crl_provider.h",
         "include/grpc/grpc_posix.h",
         "include/grpc/grpc_security.h",
         "include/grpc/grpc_security_constants.h",
@@ -311,14 +312,20 @@ let package = Package(
         "src/core/ext/transport/chttp2/transport/huffsyms.h",
         "src/core/ext/transport/chttp2/transport/internal.h",
         "src/core/ext/transport/chttp2/transport/legacy_frame.h",
+        "src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc",
+        "src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h",
         "src/core/ext/transport/chttp2/transport/parsing.cc",
         "src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc",
         "src/core/ext/transport/chttp2/transport/ping_abuse_policy.h",
+        "src/core/ext/transport/chttp2/transport/ping_callbacks.cc",
+        "src/core/ext/transport/chttp2/transport/ping_callbacks.h",
         "src/core/ext/transport/chttp2/transport/ping_rate_policy.cc",
         "src/core/ext/transport/chttp2/transport/ping_rate_policy.h",
         "src/core/ext/transport/chttp2/transport/stream_lists.cc",
         "src/core/ext/transport/chttp2/transport/varint.cc",
         "src/core/ext/transport/chttp2/transport/varint.h",
+        "src/core/ext/transport/chttp2/transport/write_size_policy.cc",
+        "src/core/ext/transport/chttp2/transport/write_size_policy.h",
         "src/core/ext/transport/chttp2/transport/writing.cc",
         "src/core/ext/transport/inproc/inproc_plugin.cc",
         "src/core/ext/transport/inproc/inproc_transport.cc",
@@ -1211,6 +1218,7 @@ let package = Package(
         "src/core/lib/gprpp/crash.cc",
         "src/core/lib/gprpp/crash.h",
         "src/core/lib/gprpp/debug_location.h",
+        "src/core/lib/gprpp/directory_reader.h",
         "src/core/lib/gprpp/dual_ref_counted.h",
         "src/core/lib/gprpp/env.h",
         "src/core/lib/gprpp/examine_stack.cc",
@@ -1235,6 +1243,7 @@ let package = Package(
         "src/core/lib/gprpp/packed_table.h",
         "src/core/lib/gprpp/per_cpu.cc",
         "src/core/lib/gprpp/per_cpu.h",
+        "src/core/lib/gprpp/posix/directory_reader.cc",
         "src/core/lib/gprpp/posix/env.cc",
         "src/core/lib/gprpp/posix/stat.cc",
         "src/core/lib/gprpp/posix/thd.cc",
@@ -1264,6 +1273,7 @@ let package = Package(
         "src/core/lib/gprpp/unique_type_name.h",
         "src/core/lib/gprpp/validation_errors.cc",
         "src/core/lib/gprpp/validation_errors.h",
+        "src/core/lib/gprpp/windows/directory_reader.cc",
         "src/core/lib/gprpp/windows/env.cc",
         "src/core/lib/gprpp/windows/stat.cc",
         "src/core/lib/gprpp/windows/thd.cc",
@@ -1582,6 +1592,8 @@ let package = Package(
         "src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h",
         "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc",
         "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h",
+        "src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc",
+        "src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h",
         "src/core/lib/security/credentials/tls/tls_credentials.cc",
         "src/core/lib/security/credentials/tls/tls_credentials.h",
         "src/core/lib/security/credentials/tls/tls_utils.cc",

_metadata.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/_metadata.py.template`!!!
 
-__version__ = """1.59.0.dev0"""
+__version__ = """1.59.4"""

bazel/experiments.bzl

@@ -39,7 +39,10 @@ EXPERIMENTS = {
                 "event_engine_listener",
             ],
             "flow_control_test": [
+                "multiping",
                 "peer_state_based_framing",
+                "red_max_concurrent_streams",
+                "rstpit",
                 "tcp_frame_size_tuning",
                 "tcp_rcv_lowat",
             ],
@@ -63,12 +66,23 @@ EXPERIMENTS = {
             ],
         },
         "on": {
+            "bad_client_test": [
+                "block_excessive_requests_before_settings_ack",
+                "tarpit",
+            ],
+            "cpp_end2end_test": [
+                "chttp2_offload_on_rst_stream",
+            ],
             "cpp_lb_end2end_test": [
                 "round_robin_delegate_to_pick_first",
                 "wrr_delegate_to_pick_first",
             ],
             "flow_control_test": [
+                "chttp2_offload_on_rst_stream",
                 "lazier_stream_updates",
+                "overload_protection",
+                "write_size_cap",
+                "write_size_policy",
             ],
             "lb_unit_test": [
                 "round_robin_delegate_to_pick_first",
@@ -105,7 +119,10 @@ EXPERIMENTS = {
                 "event_engine_listener",
             ],
             "flow_control_test": [
+                "multiping",
                 "peer_state_based_framing",
+                "red_max_concurrent_streams",
+                "rstpit",
                 "tcp_frame_size_tuning",
                 "tcp_rcv_lowat",
             ],
@@ -129,12 +146,23 @@ EXPERIMENTS = {
             ],
         },
         "on": {
+            "bad_client_test": [
+                "block_excessive_requests_before_settings_ack",
+                "tarpit",
+            ],
+            "cpp_end2end_test": [
+                "chttp2_offload_on_rst_stream",
+            ],
             "cpp_lb_end2end_test": [
                 "round_robin_delegate_to_pick_first",
                 "wrr_delegate_to_pick_first",
             ],
             "flow_control_test": [
+                "chttp2_offload_on_rst_stream",
                 "lazier_stream_updates",
+                "overload_protection",
+                "write_size_cap",
+                "write_size_policy",
             ],
             "lb_unit_test": [
                 "round_robin_delegate_to_pick_first",
@@ -178,7 +206,10 @@ EXPERIMENTS = {
                 "event_engine_listener",
             ],
             "flow_control_test": [
+                "multiping",
                 "peer_state_based_framing",
+                "red_max_concurrent_streams",
+                "rstpit",
                 "tcp_frame_size_tuning",
                 "tcp_rcv_lowat",
             ],
@@ -205,12 +236,23 @@ EXPERIMENTS = {
             ],
         },
         "on": {
+            "bad_client_test": [
+                "block_excessive_requests_before_settings_ack",
+                "tarpit",
+            ],
+            "cpp_end2end_test": [
+                "chttp2_offload_on_rst_stream",
+            ],
             "cpp_lb_end2end_test": [
                 "round_robin_delegate_to_pick_first",
                 "wrr_delegate_to_pick_first",
             ],
             "flow_control_test": [
+                "chttp2_offload_on_rst_stream",
                 "lazier_stream_updates",
+                "overload_protection",
+                "write_size_cap",
+                "write_size_policy",
             ],
             "lb_unit_test": [
                 "round_robin_delegate_to_pick_first",

build_autogenerated.yaml

@@ -158,6 +158,7 @@ libs:
   - include/grpc/fork.h
   - include/grpc/grpc.h
   - include/grpc/grpc_audit_logging.h
+  - include/grpc/grpc_crl_provider.h
   - include/grpc/grpc_posix.h
   - include/grpc/grpc_security.h
   - include/grpc/grpc_security_constants.h
@@ -309,9 +310,12 @@ libs:
   - src/core/ext/transport/chttp2/transport/huffsyms.h
   - src/core/ext/transport/chttp2/transport/internal.h
   - src/core/ext/transport/chttp2/transport/legacy_frame.h
+  - src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h
   - src/core/ext/transport/chttp2/transport/ping_abuse_policy.h
+  - src/core/ext/transport/chttp2/transport/ping_callbacks.h
   - src/core/ext/transport/chttp2/transport/ping_rate_policy.h
   - src/core/ext/transport/chttp2/transport/varint.h
+  - src/core/ext/transport/chttp2/transport/write_size_policy.h
   - src/core/ext/transport/inproc/inproc_transport.h
   - src/core/ext/upb-generated/envoy/admin/v3/certs.upb.h
   - src/core/ext/upb-generated/envoy/admin/v3/clusters.upb.h
@@ -745,6 +749,7 @@ libs:
   - src/core/lib/gprpp/bitset.h
   - src/core/lib/gprpp/chunked_vector.h
   - src/core/lib/gprpp/cpp_impl_of.h
+  - src/core/lib/gprpp/directory_reader.h
   - src/core/lib/gprpp/dual_ref_counted.h
   - src/core/lib/gprpp/if_list.h
   - src/core/lib/gprpp/load_file.h
@@ -929,6 +934,7 @@ libs:
   - src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h
   - src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h
   - src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h
+  - src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h
   - src/core/lib/security/credentials/tls/tls_credentials.h
   - src/core/lib/security/credentials/tls/tls_utils.h
   - src/core/lib/security/credentials/xds/xds_credentials.h
@@ -1133,11 +1139,14 @@ libs:
   - src/core/ext/transport/chttp2/transport/http2_settings.cc
   - src/core/ext/transport/chttp2/transport/http_trace.cc
   - src/core/ext/transport/chttp2/transport/huffsyms.cc
+  - src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc
   - src/core/ext/transport/chttp2/transport/parsing.cc
   - src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc
+  - src/core/ext/transport/chttp2/transport/ping_callbacks.cc
   - src/core/ext/transport/chttp2/transport/ping_rate_policy.cc
   - src/core/ext/transport/chttp2/transport/stream_lists.cc
   - src/core/ext/transport/chttp2/transport/varint.cc
+  - src/core/ext/transport/chttp2/transport/write_size_policy.cc
   - src/core/ext/transport/chttp2/transport/writing.cc
   - src/core/ext/transport/inproc/inproc_plugin.cc
   - src/core/ext/transport/inproc/inproc_transport.cc
@@ -1555,11 +1564,13 @@ libs:
   - src/core/lib/experiments/experiments.cc
   - src/core/lib/gprpp/load_file.cc
   - src/core/lib/gprpp/per_cpu.cc
+  - src/core/lib/gprpp/posix/directory_reader.cc
   - src/core/lib/gprpp/ref_counted_string.cc
   - src/core/lib/gprpp/status_helper.cc
   - src/core/lib/gprpp/time.cc
   - src/core/lib/gprpp/time_averaged_stats.cc
   - src/core/lib/gprpp/validation_errors.cc
+  - src/core/lib/gprpp/windows/directory_reader.cc
   - src/core/lib/gprpp/work_serializer.cc
   - src/core/lib/handshaker/proxy_mapper_registry.cc
   - src/core/lib/http/format_request.cc
@@ -1709,6 +1720,7 @@ libs:
   - src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc
   - src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.cc
   - src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc
+  - src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc
   - src/core/lib/security/credentials/tls/tls_credentials.cc
   - src/core/lib/security/credentials/tls/tls_utils.cc
   - src/core/lib/security/credentials/xds/xds_credentials.cc
@@ -1908,6 +1920,7 @@ libs:
   - include/grpc/fork.h
   - include/grpc/grpc.h
   - include/grpc/grpc_audit_logging.h
+  - include/grpc/grpc_crl_provider.h
   - include/grpc/grpc_posix.h
   - include/grpc/grpc_security.h
   - include/grpc/grpc_security_constants.h
@@ -2047,9 +2060,12 @@ libs:
   - src/core/ext/transport/chttp2/transport/huffsyms.h
   - src/core/ext/transport/chttp2/transport/internal.h
   - src/core/ext/transport/chttp2/transport/legacy_frame.h
+  - src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h
   - src/core/ext/transport/chttp2/transport/ping_abuse_policy.h
+  - src/core/ext/transport/chttp2/transport/ping_callbacks.h
   - src/core/ext/transport/chttp2/transport/ping_rate_policy.h
   - src/core/ext/transport/chttp2/transport/varint.h
+  - src/core/ext/transport/chttp2/transport/write_size_policy.h
   - src/core/ext/transport/inproc/inproc_transport.h
   - src/core/ext/upb-generated/google/api/annotations.upb.h
   - src/core/ext/upb-generated/google/api/http.upb.h
@@ -2483,11 +2499,14 @@ libs:
   - src/core/ext/transport/chttp2/transport/http2_settings.cc
   - src/core/ext/transport/chttp2/transport/http_trace.cc
   - src/core/ext/transport/chttp2/transport/huffsyms.cc
+  - src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc
   - src/core/ext/transport/chttp2/transport/parsing.cc
   - src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc
+  - src/core/ext/transport/chttp2/transport/ping_callbacks.cc
   - src/core/ext/transport/chttp2/transport/ping_rate_policy.cc
   - src/core/ext/transport/chttp2/transport/stream_lists.cc
   - src/core/ext/transport/chttp2/transport/varint.cc
+  - src/core/ext/transport/chttp2/transport/write_size_policy.cc
   - src/core/ext/transport/chttp2/transport/writing.cc
   - src/core/ext/transport/inproc/inproc_plugin.cc
   - src/core/ext/transport/inproc/inproc_transport.cc
@@ -3500,6 +3519,7 @@ libs:
   - include/grpcpp/security/tls_certificate_provider.h
   - include/grpcpp/security/tls_certificate_verifier.h
   - include/grpcpp/security/tls_credentials_options.h
+  - include/grpcpp/security/tls_crl_provider.h
   - include/grpcpp/server.h
   - include/grpcpp/server_builder.h
   - include/grpcpp/server_context.h
@@ -3924,6 +3944,7 @@ libs:
   - include/grpcpp/security/tls_certificate_provider.h
   - include/grpcpp/security/tls_certificate_verifier.h
   - include/grpcpp/security/tls_credentials_options.h
+  - include/grpcpp/security/tls_crl_provider.h
   - include/grpcpp/server.h
   - include/grpcpp/server_builder.h
   - include/grpcpp/server_context.h
@@ -4024,6 +4045,7 @@ libs:
   - include/grpc/fork.h
   - include/grpc/grpc.h
   - include/grpc/grpc_audit_logging.h
+  - include/grpc/grpc_crl_provider.h
   - include/grpc/grpc_posix.h
   - include/grpc/grpc_security.h
   - include/grpc/grpc_security_constants.h
@@ -7389,6 +7411,22 @@ targets:
   - gtest
   - grpc_test_util
   uses_polling: false
+- name: crl_provider_test
+  gtest: true
+  build: test
+  language: c++
+  headers:
+  - test/cpp/end2end/test_service_impl.h
+  src:
+  - src/proto/grpc/testing/echo.proto
+  - src/proto/grpc/testing/echo_messages.proto
+  - src/proto/grpc/testing/simple_messages.proto
+  - src/proto/grpc/testing/xds/v3/orca_load_report.proto
+  - test/cpp/end2end/crl_provider_test.cc
+  - test/cpp/end2end/test_service_impl.cc
+  deps:
+  - gtest
+  - grpc++_test_util
 - name: crl_ssl_transport_security_test
   gtest: true
   build: test
@@ -7477,6 +7515,17 @@ targets:
   deps:
   - gtest
   - grpc++_test_util
+- name: directory_reader_test
+  gtest: true
+  build: test
+  language: c++
+  headers: []
+  src:
+  - test/core/gprpp/directory_reader_test.cc
+  deps:
+  - gtest
+  - grpc_test_util
+  uses_polling: false
 - name: disappearing_server_test
   gtest: true
   build: test
@@ -8863,6 +8912,20 @@ targets:
   - linux
   - posix
   uses_polling: false
+- name: fuzzing_event_engine_unittest
+  gtest: true
+  build: test
+  language: c++
+  headers:
+  - test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.h
+  src:
+  - test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.proto
+  - test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.cc
+  - test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine_unittest.cc
+  deps:
+  - gtest
+  - protobuf
+  - grpc_test_util
 - name: generic_end2end_test
   gtest: true
   build: test
@@ -9409,6 +9472,23 @@ targets:
   deps:
   - gtest
   - grpc_test_util
+- name: grpc_tls_crl_provider_test
+  gtest: true
+  build: test
+  language: c++
+  headers:
+  - test/core/event_engine/event_engine_test_utils.h
+  - test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.h
+  src:
+  - test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.proto
+  - test/core/util/fuzz_config_vars.proto
+  - test/core/event_engine/event_engine_test_utils.cc
+  - test/core/event_engine/fuzzing_event_engine/fuzzing_event_engine.cc
+  - test/core/security/grpc_tls_crl_provider_test.cc
+  deps:
+  - gtest
+  - protobuf
+  - grpc_test_util
 - name: grpc_tool_test
   gtest: true
   build: test
@@ -10761,6 +10841,18 @@ targets:
   deps:
   - gtest
   - grpc_test_util
+- name: max_concurrent_streams_policy_test
+  gtest: true
+  build: test
+  language: c++
+  headers:
+  - src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h
+  src:
+  - src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc
+  - test/core/transport/chttp2/max_concurrent_streams_policy_test.cc
+  deps:
+  - gtest
+  - gpr
 - name: max_concurrent_streams_test
   gtest: true
   build: test
@@ -11687,6 +11779,18 @@ targets:
   - gtest
   - grpc_test_util
   uses_polling: false
+- name: ping_callbacks_test
+  gtest: true
+  build: test
+  language: c++
+  headers:
+  - test/core/event_engine/mock_event_engine.h
+  src:
+  - test/core/transport/chttp2/ping_callbacks_test.cc
+  deps:
+  - gtest
+  - grpc
+  uses_polling: false
 - name: ping_configuration_test
   gtest: true
   build: test
@@ -17283,6 +17387,22 @@ targets:
   - grpc_authorization_provider
   - grpc_unsecure
   - grpc_test_util
+- name: write_size_policy_test
+  gtest: true
+  build: test
+  language: c++
+  headers:
+  - src/core/ext/transport/chttp2/transport/write_size_policy.h
+  - src/core/lib/gprpp/time.h
+  src:
+  - src/core/ext/transport/chttp2/transport/write_size_policy.cc
+  - src/core/lib/gprpp/time.cc
+  - test/core/transport/chttp2/write_size_policy_test.cc
+  deps:
+  - gtest
+  - absl/status:statusor
+  - gpr
+  uses_polling: false
 - name: writes_per_rpc_test
   gtest: true
   build: test

build_handwritten.yaml

@@ -16,7 +16,7 @@ settings:
   csharp_major_version: 2
   g_stands_for: generative
   protobuf_version: 3.24.3
-  version: 1.59.0-dev
+  version: 1.59.4
 configs:
   asan:
     CC: clang

config.m4

@@ -144,11 +144,14 @@ if test "$PHP_GRPC" != "no"; then
     src/core/ext/transport/chttp2/transport/http2_settings.cc \
     src/core/ext/transport/chttp2/transport/http_trace.cc \
     src/core/ext/transport/chttp2/transport/huffsyms.cc \
+    src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc \
     src/core/ext/transport/chttp2/transport/parsing.cc \
     src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc \
+    src/core/ext/transport/chttp2/transport/ping_callbacks.cc \
     src/core/ext/transport/chttp2/transport/ping_rate_policy.cc \
     src/core/ext/transport/chttp2/transport/stream_lists.cc \
     src/core/ext/transport/chttp2/transport/varint.cc \
+    src/core/ext/transport/chttp2/transport/write_size_policy.cc \
     src/core/ext/transport/chttp2/transport/writing.cc \
     src/core/ext/transport/inproc/inproc_plugin.cc \
     src/core/ext/transport/inproc/inproc_transport.cc \
@@ -603,6 +606,7 @@ if test "$PHP_GRPC" != "no"; then
     src/core/lib/gprpp/load_file.cc \
     src/core/lib/gprpp/mpscq.cc \
     src/core/lib/gprpp/per_cpu.cc \
+    src/core/lib/gprpp/posix/directory_reader.cc \
     src/core/lib/gprpp/posix/env.cc \
     src/core/lib/gprpp/posix/stat.cc \
     src/core/lib/gprpp/posix/thd.cc \
@@ -614,6 +618,7 @@ if test "$PHP_GRPC" != "no"; then
     src/core/lib/gprpp/time_averaged_stats.cc \
     src/core/lib/gprpp/time_util.cc \
     src/core/lib/gprpp/validation_errors.cc \
+    src/core/lib/gprpp/windows/directory_reader.cc \
     src/core/lib/gprpp/windows/env.cc \
     src/core/lib/gprpp/windows/stat.cc \
     src/core/lib/gprpp/windows/thd.cc \
@@ -766,6 +771,7 @@ if test "$PHP_GRPC" != "no"; then
     src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc \
     src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.cc \
     src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc \
+    src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc \
     src/core/lib/security/credentials/tls/tls_credentials.cc \
     src/core/lib/security/credentials/tls/tls_utils.cc \
     src/core/lib/security/credentials/xds/xds_credentials.cc \
@@ -1338,7 +1344,7 @@ if test "$PHP_GRPC" != "no"; then
     -D_HAS_EXCEPTIONS=0 -DNOMINMAX -DGRPC_ARES=0 \
     -DGRPC_POSIX_FORK_ALLOW_PTHREAD_ATFORK=1 \
     -DGRPC_XDS_USER_AGENT_NAME_SUFFIX='"\"PHP\""' \
-    -DGRPC_XDS_USER_AGENT_VERSION_SUFFIX='"\"1.59.0dev\""')
+    -DGRPC_XDS_USER_AGENT_VERSION_SUFFIX='"\"1.59.4\""')
 
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/backend_metrics)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/census)

config.w32

@@ -109,11 +109,14 @@ if (PHP_GRPC != "no") {
     "src\\core\\ext\\transport\\chttp2\\transport\\http2_settings.cc " +
     "src\\core\\ext\\transport\\chttp2\\transport\\http_trace.cc " +
     "src\\core\\ext\\transport\\chttp2\\transport\\huffsyms.cc " +
+    "src\\core\\ext\\transport\\chttp2\\transport\\max_concurrent_streams_policy.cc " +
     "src\\core\\ext\\transport\\chttp2\\transport\\parsing.cc " +
     "src\\core\\ext\\transport\\chttp2\\transport\\ping_abuse_policy.cc " +
+    "src\\core\\ext\\transport\\chttp2\\transport\\ping_callbacks.cc " +
     "src\\core\\ext\\transport\\chttp2\\transport\\ping_rate_policy.cc " +
     "src\\core\\ext\\transport\\chttp2\\transport\\stream_lists.cc " +
     "src\\core\\ext\\transport\\chttp2\\transport\\varint.cc " +
+    "src\\core\\ext\\transport\\chttp2\\transport\\write_size_policy.cc " +
     "src\\core\\ext\\transport\\chttp2\\transport\\writing.cc " +
     "src\\core\\ext\\transport\\inproc\\inproc_plugin.cc " +
     "src\\core\\ext\\transport\\inproc\\inproc_transport.cc " +
@@ -568,6 +571,7 @@ if (PHP_GRPC != "no") {
     "src\\core\\lib\\gprpp\\load_file.cc " +
     "src\\core\\lib\\gprpp\\mpscq.cc " +
     "src\\core\\lib\\gprpp\\per_cpu.cc " +
+    "src\\core\\lib\\gprpp\\posix\\directory_reader.cc " +
     "src\\core\\lib\\gprpp\\posix\\env.cc " +
     "src\\core\\lib\\gprpp\\posix\\stat.cc " +
     "src\\core\\lib\\gprpp\\posix\\thd.cc " +
@@ -579,6 +583,7 @@ if (PHP_GRPC != "no") {
     "src\\core\\lib\\gprpp\\time_averaged_stats.cc " +
     "src\\core\\lib\\gprpp\\time_util.cc " +
     "src\\core\\lib\\gprpp\\validation_errors.cc " +
+    "src\\core\\lib\\gprpp\\windows\\directory_reader.cc " +
     "src\\core\\lib\\gprpp\\windows\\env.cc " +
     "src\\core\\lib\\gprpp\\windows\\stat.cc " +
     "src\\core\\lib\\gprpp\\windows\\thd.cc " +
@@ -731,6 +736,7 @@ if (PHP_GRPC != "no") {
     "src\\core\\lib\\security\\credentials\\tls\\grpc_tls_certificate_provider.cc " +
     "src\\core\\lib\\security\\credentials\\tls\\grpc_tls_certificate_verifier.cc " +
     "src\\core\\lib\\security\\credentials\\tls\\grpc_tls_credentials_options.cc " +
+    "src\\core\\lib\\security\\credentials\\tls\\grpc_tls_crl_provider.cc " +
     "src\\core\\lib\\security\\credentials\\tls\\tls_credentials.cc " +
     "src\\core\\lib\\security\\credentials\\tls\\tls_utils.cc " +
     "src\\core\\lib\\security\\credentials\\xds\\xds_credentials.cc " +

doc/environment_variables.md

@@ -69,6 +69,7 @@ some configuration as environment variables that can be set.
   - health_check_client - traces health checking client code
   - http - traces state in the http2 transport engine
   - http2_stream_state - traces all http2 stream state mutations.
+  - http2_ping - traces pings/ping acks/antagonist writes in http2 stack.
   - http1 - traces HTTP/1.x operations performed by gRPC
   - inproc - traces the in-process transport
   - http_keepalive - traces gRPC keepalive pings

doc/g_stands_for.md

@@ -58,4 +58,4 @@
 - 1.56 'g' stands for ['galvanized'](https://github.com/grpc/grpc/tree/v1.56.x)
 - 1.57 'g' stands for ['grounded'](https://github.com/grpc/grpc/tree/v1.57.x)
 - 1.58 'g' stands for ['goku'](https://github.com/grpc/grpc/tree/v1.58.x)
-- 1.59 'g' stands for ['generative'](https://github.com/grpc/grpc/tree/master)
+- 1.59 'g' stands for ['generative'](https://github.com/grpc/grpc/tree/v1.59.x)

fuzztest/core/transport/chttp2/BUILD

@@ -12,16 +12,15 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Config file for the internal CI (in protobuf text format)
+load("//fuzztest:grpc_fuzz_test.bzl", "grpc_fuzz_test")
 
-# Location of the continuous shell script in repository.
-# TODO(sergiitk): delete when the job is renamed
-build_file: "grpc/tools/internal_ci/linux/psm-csm.sh"
-timeout_mins: 60
-action {
-  define_artifacts {
-    regex: "artifacts/**/*sponge_log.xml"
-    regex: "artifacts/**/*.log"
-    strip_prefix: "artifacts"
-  }
-}
+grpc_fuzz_test(
+    name = "write_size_policy_test",
+    srcs = ["write_size_policy_test.cc"],
+    external_deps = [
+        "fuzztest",
+        "fuzztest_main",
+        "gtest",
+    ],
+    deps = ["//src/core:write_size_policy"],
+)

fuzztest/core/transport/chttp2/write_size_policy_test.cc

@@ -0,0 +1,64 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Test to verify Fuzztest integration
+
+#include "src/core/ext/transport/chttp2/transport/write_size_policy.h"
+
+#include <vector>
+
+#include "fuzztest/fuzztest.h"
+#include "gtest/gtest.h"
+
+namespace grpc_core {
+
+struct OneWrite {
+  uint16_t delay_start;
+  uint32_t size;
+  uint16_t write_time;
+  bool success;
+};
+
+void WriteSizePolicyStaysWithinBounds(std::vector<OneWrite> ops) {
+  ScopedTimeCache time_cache;
+  uint32_t now = 100;
+  Chttp2WriteSizePolicy policy;
+  for (const OneWrite op : ops) {
+    const auto start_target = policy.WriteTargetSize();
+    now += op.delay_start;
+    time_cache.TestOnlySetNow(Timestamp::ProcessEpoch() +
+                              Duration::Milliseconds(now));
+    policy.BeginWrite(op.size);
+    now += op.write_time;
+    time_cache.TestOnlySetNow(Timestamp::ProcessEpoch() +
+                              Duration::Milliseconds(now));
+    policy.EndWrite(op.success);
+    if (op.size >= start_target * 7 / 10) {
+      if (op.write_time < Chttp2WriteSizePolicy::FastWrite().millis()) {
+        EXPECT_GE(policy.WriteTargetSize(), start_target);
+        EXPECT_LE(policy.WriteTargetSize(), start_target * 3 / 2);
+      } else if (op.write_time > Chttp2WriteSizePolicy::SlowWrite().millis()) {
+        EXPECT_LE(policy.WriteTargetSize(), start_target);
+        EXPECT_GE(policy.WriteTargetSize(), start_target / 3);
+      }
+    } else {
+      EXPECT_EQ(policy.WriteTargetSize(), start_target);
+    }
+    EXPECT_GE(policy.WriteTargetSize(), Chttp2WriteSizePolicy::MinTarget());
+    EXPECT_LE(policy.WriteTargetSize(), Chttp2WriteSizePolicy::MaxTarget());
+  }
+}
+FUZZ_TEST(MyTestSuite, WriteSizePolicyStaysWithinBounds);
+
+}  // namespace grpc_core

gRPC-C++.podspec

@@ -22,7 +22,7 @@
 Pod::Spec.new do |s|
   s.name     = 'gRPC-C++'
   # TODO (mxyan): use version that match gRPC version when pod is stabilized
-  version = '1.59.0-dev'
+  version = '1.59.4'
   s.version  = version
   s.summary  = 'gRPC C++ library'
   s.homepage = 'https://grpc.io'
@@ -179,6 +179,7 @@ Pod::Spec.new do |s|
                       'include/grpcpp/security/tls_certificate_provider.h',
                       'include/grpcpp/security/tls_certificate_verifier.h',
                       'include/grpcpp/security/tls_credentials_options.h',
+                      'include/grpcpp/security/tls_crl_provider.h',
                       'include/grpcpp/server.h',
                       'include/grpcpp/server_builder.h',
                       'include/grpcpp/server_context.h',
@@ -380,9 +381,12 @@ Pod::Spec.new do |s|
                       'src/core/ext/transport/chttp2/transport/huffsyms.h',
                       'src/core/ext/transport/chttp2/transport/internal.h',
                       'src/core/ext/transport/chttp2/transport/legacy_frame.h',
+                      'src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h',
                       'src/core/ext/transport/chttp2/transport/ping_abuse_policy.h',
+                      'src/core/ext/transport/chttp2/transport/ping_callbacks.h',
                       'src/core/ext/transport/chttp2/transport/ping_rate_policy.h',
                       'src/core/ext/transport/chttp2/transport/varint.h',
+                      'src/core/ext/transport/chttp2/transport/write_size_policy.h',
                       'src/core/ext/transport/inproc/inproc_transport.h',
                       'src/core/ext/upb-generated/envoy/admin/v3/certs.upb.h',
                       'src/core/ext/upb-generated/envoy/admin/v3/clusters.upb.h',
@@ -829,6 +833,7 @@ Pod::Spec.new do |s|
                       'src/core/lib/gprpp/cpp_impl_of.h',
                       'src/core/lib/gprpp/crash.h',
                       'src/core/lib/gprpp/debug_location.h',
+                      'src/core/lib/gprpp/directory_reader.h',
                       'src/core/lib/gprpp/dual_ref_counted.h',
                       'src/core/lib/gprpp/env.h',
                       'src/core/lib/gprpp/examine_stack.h',
@@ -1026,6 +1031,7 @@ Pod::Spec.new do |s|
                       'src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h',
                       'src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h',
                       'src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h',
+                      'src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h',
                       'src/core/lib/security/credentials/tls/tls_credentials.h',
                       'src/core/lib/security/credentials/tls/tls_utils.h',
                       'src/core/lib/security/credentials/xds/xds_credentials.h',
@@ -1449,9 +1455,12 @@ Pod::Spec.new do |s|
                               'src/core/ext/transport/chttp2/transport/huffsyms.h',
                               'src/core/ext/transport/chttp2/transport/internal.h',
                               'src/core/ext/transport/chttp2/transport/legacy_frame.h',
+                              'src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h',
                               'src/core/ext/transport/chttp2/transport/ping_abuse_policy.h',
+                              'src/core/ext/transport/chttp2/transport/ping_callbacks.h',
                               'src/core/ext/transport/chttp2/transport/ping_rate_policy.h',
                               'src/core/ext/transport/chttp2/transport/varint.h',
+                              'src/core/ext/transport/chttp2/transport/write_size_policy.h',
                               'src/core/ext/transport/inproc/inproc_transport.h',
                               'src/core/ext/upb-generated/envoy/admin/v3/certs.upb.h',
                               'src/core/ext/upb-generated/envoy/admin/v3/clusters.upb.h',
@@ -1898,6 +1907,7 @@ Pod::Spec.new do |s|
                               'src/core/lib/gprpp/cpp_impl_of.h',
                               'src/core/lib/gprpp/crash.h',
                               'src/core/lib/gprpp/debug_location.h',
+                              'src/core/lib/gprpp/directory_reader.h',
                               'src/core/lib/gprpp/dual_ref_counted.h',
                               'src/core/lib/gprpp/env.h',
                               'src/core/lib/gprpp/examine_stack.h',
@@ -2095,6 +2105,7 @@ Pod::Spec.new do |s|
                               'src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h',
                               'src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h',
                               'src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h',
+                              'src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h',
                               'src/core/lib/security/credentials/tls/tls_credentials.h',
                               'src/core/lib/security/credentials/tls/tls_utils.h',
                               'src/core/lib/security/credentials/xds/xds_credentials.h',

gRPC-Core.podspec

@@ -21,7 +21,7 @@
 
 Pod::Spec.new do |s|
   s.name     = 'gRPC-Core'
-  version = '1.59.0-dev'
+  version = '1.59.4'
   s.version  = version
   s.summary  = 'Core cross-platform gRPC library, written in C'
   s.homepage = 'https://grpc.io'
@@ -123,6 +123,7 @@ Pod::Spec.new do |s|
                       'include/grpc/fork.h',
                       'include/grpc/grpc.h',
                       'include/grpc/grpc_audit_logging.h',
+                      'include/grpc/grpc_crl_provider.h',
                       'include/grpc/grpc_posix.h',
                       'include/grpc/grpc_security.h',
                       'include/grpc/grpc_security_constants.h',
@@ -414,14 +415,20 @@ Pod::Spec.new do |s|
                       'src/core/ext/transport/chttp2/transport/huffsyms.h',
                       'src/core/ext/transport/chttp2/transport/internal.h',
                       'src/core/ext/transport/chttp2/transport/legacy_frame.h',
+                      'src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc',
+                      'src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h',
                       'src/core/ext/transport/chttp2/transport/parsing.cc',
                       'src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc',
                       'src/core/ext/transport/chttp2/transport/ping_abuse_policy.h',
+                      'src/core/ext/transport/chttp2/transport/ping_callbacks.cc',
+                      'src/core/ext/transport/chttp2/transport/ping_callbacks.h',
                       'src/core/ext/transport/chttp2/transport/ping_rate_policy.cc',
                       'src/core/ext/transport/chttp2/transport/ping_rate_policy.h',
                       'src/core/ext/transport/chttp2/transport/stream_lists.cc',
                       'src/core/ext/transport/chttp2/transport/varint.cc',
                       'src/core/ext/transport/chttp2/transport/varint.h',
+                      'src/core/ext/transport/chttp2/transport/write_size_policy.cc',
+                      'src/core/ext/transport/chttp2/transport/write_size_policy.h',
                       'src/core/ext/transport/chttp2/transport/writing.cc',
                       'src/core/ext/transport/inproc/inproc_plugin.cc',
                       'src/core/ext/transport/inproc/inproc_transport.cc',
@@ -1314,6 +1321,7 @@ Pod::Spec.new do |s|
                       'src/core/lib/gprpp/crash.cc',
                       'src/core/lib/gprpp/crash.h',
                       'src/core/lib/gprpp/debug_location.h',
+                      'src/core/lib/gprpp/directory_reader.h',
                       'src/core/lib/gprpp/dual_ref_counted.h',
                       'src/core/lib/gprpp/env.h',
                       'src/core/lib/gprpp/examine_stack.cc',
@@ -1338,6 +1346,7 @@ Pod::Spec.new do |s|
                       'src/core/lib/gprpp/packed_table.h',
                       'src/core/lib/gprpp/per_cpu.cc',
                       'src/core/lib/gprpp/per_cpu.h',
+                      'src/core/lib/gprpp/posix/directory_reader.cc',
                       'src/core/lib/gprpp/posix/env.cc',
                       'src/core/lib/gprpp/posix/stat.cc',
                       'src/core/lib/gprpp/posix/thd.cc',
@@ -1367,6 +1376,7 @@ Pod::Spec.new do |s|
                       'src/core/lib/gprpp/unique_type_name.h',
                       'src/core/lib/gprpp/validation_errors.cc',
                       'src/core/lib/gprpp/validation_errors.h',
+                      'src/core/lib/gprpp/windows/directory_reader.cc',
                       'src/core/lib/gprpp/windows/env.cc',
                       'src/core/lib/gprpp/windows/stat.cc',
                       'src/core/lib/gprpp/windows/thd.cc',
@@ -1681,6 +1691,8 @@ Pod::Spec.new do |s|
                       'src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h',
                       'src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc',
                       'src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h',
+                      'src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc',
+                      'src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h',
                       'src/core/lib/security/credentials/tls/tls_credentials.cc',
                       'src/core/lib/security/credentials/tls/tls_credentials.h',
                       'src/core/lib/security/credentials/tls/tls_utils.cc',
@@ -2201,9 +2213,12 @@ Pod::Spec.new do |s|
                               'src/core/ext/transport/chttp2/transport/huffsyms.h',
                               'src/core/ext/transport/chttp2/transport/internal.h',
                               'src/core/ext/transport/chttp2/transport/legacy_frame.h',
+                              'src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h',
                               'src/core/ext/transport/chttp2/transport/ping_abuse_policy.h',
+                              'src/core/ext/transport/chttp2/transport/ping_callbacks.h',
                               'src/core/ext/transport/chttp2/transport/ping_rate_policy.h',
                               'src/core/ext/transport/chttp2/transport/varint.h',
+                              'src/core/ext/transport/chttp2/transport/write_size_policy.h',
                               'src/core/ext/transport/inproc/inproc_transport.h',
                               'src/core/ext/upb-generated/envoy/admin/v3/certs.upb.h',
                               'src/core/ext/upb-generated/envoy/admin/v3/clusters.upb.h',
@@ -2649,6 +2664,7 @@ Pod::Spec.new do |s|
                               'src/core/lib/gprpp/cpp_impl_of.h',
                               'src/core/lib/gprpp/crash.h',
                               'src/core/lib/gprpp/debug_location.h',
+                              'src/core/lib/gprpp/directory_reader.h',
                               'src/core/lib/gprpp/dual_ref_counted.h',
                               'src/core/lib/gprpp/env.h',
                               'src/core/lib/gprpp/examine_stack.h',
@@ -2846,6 +2862,7 @@ Pod::Spec.new do |s|
                               'src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h',
                               'src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h',
                               'src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h',
+                              'src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h',
                               'src/core/lib/security/credentials/tls/tls_credentials.h',
                               'src/core/lib/security/credentials/tls/tls_utils.h',
                               'src/core/lib/security/credentials/xds/xds_credentials.h',

gRPC-ProtoRPC.podspec

@@ -21,7 +21,7 @@
 
 Pod::Spec.new do |s|
   s.name     = 'gRPC-ProtoRPC'
-  version = '1.59.0-dev'
+  version = '1.59.4'
   s.version  = version
   s.summary  = 'RPC library for Protocol Buffers, based on gRPC'
   s.homepage = 'https://grpc.io'

gRPC-RxLibrary.podspec

@@ -21,7 +21,7 @@
 
 Pod::Spec.new do |s|
   s.name     = 'gRPC-RxLibrary'
-  version = '1.59.0-dev'
+  version = '1.59.4'
   s.version  = version
   s.summary  = 'Reactive Extensions library for iOS/OSX.'
   s.homepage = 'https://grpc.io'

gRPC.podspec

@@ -20,7 +20,7 @@
 
 Pod::Spec.new do |s|
   s.name     = 'gRPC'
-  version = '1.59.0-dev'
+  version = '1.59.4'
   s.version  = version
   s.summary  = 'gRPC client library for iOS/OSX'
   s.homepage = 'https://grpc.io'

grpc.def

@@ -157,6 +157,8 @@ EXPORTS
     grpc_tls_certificate_provider_file_watcher_create
     grpc_tls_certificate_provider_release
     grpc_tls_credentials_options_create
+    grpc_tls_credentials_options_set_min_tls_version
+    grpc_tls_credentials_options_set_max_tls_version
     grpc_tls_credentials_options_set_certificate_provider
     grpc_tls_credentials_options_watch_root_certs
     grpc_tls_credentials_options_set_root_cert_name

grpc.gemspec

@@ -63,6 +63,7 @@ Gem::Specification.new do |s|
   s.files += %w( include/grpc/fork.h )
   s.files += %w( include/grpc/grpc.h )
   s.files += %w( include/grpc/grpc_audit_logging.h )
+  s.files += %w( include/grpc/grpc_crl_provider.h )
   s.files += %w( include/grpc/grpc_posix.h )
   s.files += %w( include/grpc/grpc_security.h )
   s.files += %w( include/grpc/grpc_security_constants.h )
@@ -317,14 +318,20 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/ext/transport/chttp2/transport/huffsyms.h )
   s.files += %w( src/core/ext/transport/chttp2/transport/internal.h )
   s.files += %w( src/core/ext/transport/chttp2/transport/legacy_frame.h )
+  s.files += %w( src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc )
+  s.files += %w( src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h )
   s.files += %w( src/core/ext/transport/chttp2/transport/parsing.cc )
   s.files += %w( src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc )
   s.files += %w( src/core/ext/transport/chttp2/transport/ping_abuse_policy.h )
+  s.files += %w( src/core/ext/transport/chttp2/transport/ping_callbacks.cc )
+  s.files += %w( src/core/ext/transport/chttp2/transport/ping_callbacks.h )
   s.files += %w( src/core/ext/transport/chttp2/transport/ping_rate_policy.cc )
   s.files += %w( src/core/ext/transport/chttp2/transport/ping_rate_policy.h )
   s.files += %w( src/core/ext/transport/chttp2/transport/stream_lists.cc )
   s.files += %w( src/core/ext/transport/chttp2/transport/varint.cc )
   s.files += %w( src/core/ext/transport/chttp2/transport/varint.h )
+  s.files += %w( src/core/ext/transport/chttp2/transport/write_size_policy.cc )
+  s.files += %w( src/core/ext/transport/chttp2/transport/write_size_policy.h )
   s.files += %w( src/core/ext/transport/chttp2/transport/writing.cc )
   s.files += %w( src/core/ext/transport/inproc/inproc_plugin.cc )
   s.files += %w( src/core/ext/transport/inproc/inproc_transport.cc )
@@ -1217,6 +1224,7 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/lib/gprpp/crash.cc )
   s.files += %w( src/core/lib/gprpp/crash.h )
   s.files += %w( src/core/lib/gprpp/debug_location.h )
+  s.files += %w( src/core/lib/gprpp/directory_reader.h )
   s.files += %w( src/core/lib/gprpp/dual_ref_counted.h )
   s.files += %w( src/core/lib/gprpp/env.h )
   s.files += %w( src/core/lib/gprpp/examine_stack.cc )
@@ -1241,6 +1249,7 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/lib/gprpp/packed_table.h )
   s.files += %w( src/core/lib/gprpp/per_cpu.cc )
   s.files += %w( src/core/lib/gprpp/per_cpu.h )
+  s.files += %w( src/core/lib/gprpp/posix/directory_reader.cc )
   s.files += %w( src/core/lib/gprpp/posix/env.cc )
   s.files += %w( src/core/lib/gprpp/posix/stat.cc )
   s.files += %w( src/core/lib/gprpp/posix/thd.cc )
@@ -1270,6 +1279,7 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/lib/gprpp/unique_type_name.h )
   s.files += %w( src/core/lib/gprpp/validation_errors.cc )
   s.files += %w( src/core/lib/gprpp/validation_errors.h )
+  s.files += %w( src/core/lib/gprpp/windows/directory_reader.cc )
   s.files += %w( src/core/lib/gprpp/windows/env.cc )
   s.files += %w( src/core/lib/gprpp/windows/stat.cc )
   s.files += %w( src/core/lib/gprpp/windows/thd.cc )
@@ -1584,6 +1594,8 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h )
   s.files += %w( src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc )
   s.files += %w( src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h )
+  s.files += %w( src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc )
+  s.files += %w( src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h )
   s.files += %w( src/core/lib/security/credentials/tls/tls_credentials.cc )
   s.files += %w( src/core/lib/security/credentials/tls/tls_credentials.h )
   s.files += %w( src/core/lib/security/credentials/tls/tls_utils.cc )

grpc.gyp

@@ -375,11 +375,14 @@
         'src/core/ext/transport/chttp2/transport/http2_settings.cc',
         'src/core/ext/transport/chttp2/transport/http_trace.cc',
         'src/core/ext/transport/chttp2/transport/huffsyms.cc',
+        'src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc',
         'src/core/ext/transport/chttp2/transport/parsing.cc',
         'src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc',
+        'src/core/ext/transport/chttp2/transport/ping_callbacks.cc',
         'src/core/ext/transport/chttp2/transport/ping_rate_policy.cc',
         'src/core/ext/transport/chttp2/transport/stream_lists.cc',
         'src/core/ext/transport/chttp2/transport/varint.cc',
+        'src/core/ext/transport/chttp2/transport/write_size_policy.cc',
         'src/core/ext/transport/chttp2/transport/writing.cc',
         'src/core/ext/transport/inproc/inproc_plugin.cc',
         'src/core/ext/transport/inproc/inproc_transport.cc',
@@ -797,11 +800,13 @@
         'src/core/lib/experiments/experiments.cc',
         'src/core/lib/gprpp/load_file.cc',
         'src/core/lib/gprpp/per_cpu.cc',
+        'src/core/lib/gprpp/posix/directory_reader.cc',
         'src/core/lib/gprpp/ref_counted_string.cc',
         'src/core/lib/gprpp/status_helper.cc',
         'src/core/lib/gprpp/time.cc',
         'src/core/lib/gprpp/time_averaged_stats.cc',
         'src/core/lib/gprpp/validation_errors.cc',
+        'src/core/lib/gprpp/windows/directory_reader.cc',
         'src/core/lib/gprpp/work_serializer.cc',
         'src/core/lib/handshaker/proxy_mapper_registry.cc',
         'src/core/lib/http/format_request.cc',
@@ -951,6 +956,7 @@
         'src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc',
         'src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.cc',
         'src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc',
+        'src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc',
         'src/core/lib/security/credentials/tls/tls_credentials.cc',
         'src/core/lib/security/credentials/tls/tls_utils.cc',
         'src/core/lib/security/credentials/xds/xds_credentials.cc',
@@ -1205,11 +1211,14 @@
         'src/core/ext/transport/chttp2/transport/http2_settings.cc',
         'src/core/ext/transport/chttp2/transport/http_trace.cc',
         'src/core/ext/transport/chttp2/transport/huffsyms.cc',
+        'src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc',
         'src/core/ext/transport/chttp2/transport/parsing.cc',
         'src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc',
+        'src/core/ext/transport/chttp2/transport/ping_callbacks.cc',
         'src/core/ext/transport/chttp2/transport/ping_rate_policy.cc',
         'src/core/ext/transport/chttp2/transport/stream_lists.cc',
         'src/core/ext/transport/chttp2/transport/varint.cc',
+        'src/core/ext/transport/chttp2/transport/write_size_policy.cc',
         'src/core/ext/transport/chttp2/transport/writing.cc',
         'src/core/ext/transport/inproc/inproc_plugin.cc',
         'src/core/ext/transport/inproc/inproc_transport.cc',

include/grpc/grpc_crl_provider.h

@@ -0,0 +1,94 @@
+//
+//
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_GRPC_CRL_PROVIDER_H
+#define GRPC_GRPC_CRL_PROVIDER_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+#include <string>
+
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
+#include <grpc/grpc_security.h>
+
+namespace grpc_core {
+namespace experimental {
+
+// Opaque representation of a CRL. Must be thread safe.
+class Crl {
+ public:
+  static absl::StatusOr<std::unique_ptr<Crl>> Parse(
+      absl::string_view crl_string);
+  virtual ~Crl() = default;
+  virtual absl::string_view Issuer() = 0;
+};
+
+// Information about a certificate to be used to fetch its associated CRL. Must
+// be thread safe.
+class CertificateInfo {
+ public:
+  virtual ~CertificateInfo() = default;
+  virtual absl::string_view Issuer() const = 0;
+};
+
+// The base class for CRL Provider implementations.
+// CrlProviders can be passed in as a way to supply CRLs during handshakes.
+// CrlProviders must be thread safe. They are on the critical path of gRPC
+// creating a connection and doing a handshake, so the implementation of
+// `GetCrl` should be very fast. It is suggested to have an in-memory map of
+// CRLs for quick lookup and return, and doing expensive updates to this map
+// asynchronously.
+class CrlProvider {
+ public:
+  virtual ~CrlProvider() = default;
+  // Get the CRL associated with a certificate. Read-only.
+  virtual std::shared_ptr<Crl> GetCrl(
+      const CertificateInfo& certificate_info) = 0;
+};
+
+absl::StatusOr<std::shared_ptr<CrlProvider>> CreateStaticCrlProvider(
+    absl::Span<const std::string> crls);
+
+// Creates a CRL Provider that periodically and asynchronously reloads a
+// directory. The refresh_duration minimum is 60 seconds. The
+// reload_error_callback provides a way for the user to specifically log or
+// otherwise notify of errors during reloading. Since reloading is asynchronous
+// and not on the main codepath, the grpc process will continue to run through
+// reloading errors, so this mechanism is an important way to provide signals to
+// your monitoring and alerting setup.
+absl::StatusOr<std::shared_ptr<CrlProvider>> CreateDirectoryReloaderCrlProvider(
+    absl::string_view directory, std::chrono::seconds refresh_duration,
+    std::function<void(absl::Status)> reload_error_callback);
+
+}  // namespace experimental
+}  // namespace grpc_core
+
+// TODO(gtcooke94) - Mark with api macro when all wrapped langauges support C++
+// in core APIs
+/**
+ * EXPERIMENTAL API - Subject to change
+ *
+ * Sets the crl provider in the options.
+ */
+void grpc_tls_credentials_options_set_crl_provider(
+    grpc_tls_credentials_options* options,
+    std::shared_ptr<grpc_core::experimental::CrlProvider> provider);
+#endif /* GRPC_GRPC_CRL_PROVIDER_H */

include/grpc/grpc_security.h

@@ -815,6 +815,24 @@ GRPCAPI void grpc_tls_certificate_provider_release(
  */
 GRPCAPI grpc_tls_credentials_options* grpc_tls_credentials_options_create(void);
 
+/**
+ * EXPERIMENTAL API - Subject to change
+ *
+ * Sets the minimum TLS version that will be negotiated during the TLS
+ * handshake. If not set, the underlying SSL library will set it to TLS v1.2.
+ */
+GRPCAPI void grpc_tls_credentials_options_set_min_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version min_tls_version);
+
+/**
+ * EXPERIMENTAL API - Subject to change
+ *
+ * Sets the maximum TLS version that will be negotiated during the TLS
+ * handshake. If not set, the underlying SSL library will set it to TLS v1.3.
+ */
+GRPCAPI void grpc_tls_credentials_options_set_max_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version max_tls_version);
+
 /**
  * EXPERIMENTAL API - Subject to change
  *

include/grpc/module.modulemap

@@ -9,6 +9,7 @@ header "byte_buffer.h"
   header "fork.h"
   header "grpc.h"
   header "grpc_audit_logging.h"
+  header "grpc_crl_provider.h"
   header "grpc_posix.h"
   header "grpc_security.h"
   header "grpc_security_constants.h"

include/grpcpp/security/tls_credentials_options.h

@@ -28,6 +28,7 @@
 #include <grpc/support/log.h>
 #include <grpcpp/security/tls_certificate_provider.h>
 #include <grpcpp/security/tls_certificate_verifier.h>
+#include <grpcpp/security/tls_crl_provider.h>
 #include <grpcpp/support/config.h>
 
 namespace grpc {
@@ -104,6 +105,17 @@ class TlsCredentialsOptions {
   // version > 1.1.
   void set_crl_directory(const std::string& path);
 
+  void set_crl_provider(std::shared_ptr<CrlProvider> crl_provider);
+
+  // Sets the minimum TLS version that will be negotiated during the TLS
+  // handshake. If not set, the underlying SSL library will use TLS v1.2.
+  // @param tls_version: The minimum TLS version.
+  void set_min_tls_version(grpc_tls_version tls_version);
+  // Sets the maximum TLS version that will be negotiated during the TLS
+  // handshake. If not set, the underlying SSL library will use TLS v1.3.
+  // @param tls_version: The maximum TLS version.
+  void set_max_tls_version(grpc_tls_version tls_version);
+
   // ----- Getters for member fields ----
   // Get the internal c options. This function shall be used only internally.
   grpc_tls_credentials_options* c_credentials_options() const {

include/grpcpp/security/tls_crl_provider.h

@@ -0,0 +1,39 @@
+//
+//
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPCPP_SECURITY_TLS_CRL_PROVIDER_H
+#define GRPCPP_SECURITY_TLS_CRL_PROVIDER_H
+
+#include <grpc/grpc_crl_provider.h>
+#include <grpcpp/impl/sync.h>
+#include <grpcpp/support/string_ref.h>
+
+namespace grpc {
+namespace experimental {
+
+using grpc_core::experimental::
+    CertificateInfo;  // NOLINT(misc-unused-using-decls)
+using grpc_core::experimental::
+    CreateStaticCrlProvider;                 // NOLINT(misc-unused-using-decls)
+using grpc_core::experimental::Crl;          // NOLINT(misc-unused-using-decls)
+using grpc_core::experimental::CrlProvider;  // NOLINT(misc-unused-using-decls)
+
+}  // namespace experimental
+}  // namespace grpc
+
+#endif  // GRPCPP_SECURITY_TLS_CRL_PROVIDER_H

include/grpcpp/support/proto_buffer_reader.h

@@ -189,10 +189,17 @@ class ProtoBufferReader : public grpc::protobuf::io::ZeroCopyInputStream {
   // This function takes ownership of slice and return a newly created Cord off
   // of it.
   static absl::Cord MakeCordFromSlice(grpc_slice slice) {
+    // slice_for_cord is created to keep inlined data of the given slice
+    grpc_slice* slice_for_cord = new grpc_slice;
+    *slice_for_cord = slice;
     return absl::MakeCordFromExternal(
-        absl::string_view(reinterpret_cast<char*>(GRPC_SLICE_START_PTR(slice)),
-                          GRPC_SLICE_LENGTH(slice)),
-        [slice](absl::string_view /* view */) { grpc_slice_unref(slice); });
+        absl::string_view(
+            reinterpret_cast<char*>(GRPC_SLICE_START_PTR(*slice_for_cord)),
+            GRPC_SLICE_LENGTH(*slice_for_cord)),
+        [slice_for_cord](absl::string_view /* view */) {
+          grpc_slice_unref(*slice_for_cord);
+          delete slice_for_cord;
+        });
   }
 #endif  // GRPC_PROTOBUF_CORD_SUPPORT_ENABLED
 

include/grpcpp/version_info.h

@@ -20,8 +20,8 @@
 
 #define GRPC_CPP_VERSION_MAJOR 1
 #define GRPC_CPP_VERSION_MINOR 59
-#define GRPC_CPP_VERSION_PATCH 0
-#define GRPC_CPP_VERSION_TAG "dev"
-#define GRPC_CPP_VERSION_STRING "1.59.0-dev"
+#define GRPC_CPP_VERSION_PATCH 4
+#define GRPC_CPP_VERSION_TAG ""
+#define GRPC_CPP_VERSION_STRING "1.59.4"
 
 #endif  // GRPCPP_VERSION_INFO_H

package.xml

@@ -13,16 +13,16 @@
  <date>2019-09-24</date>
  <time>16:06:07</time>
  <version>
-  <release>1.59.0dev</release>
-  <api>1.59.0dev</api>
+  <release>1.59.4</release>
+  <api>1.59.4</api>
  </version>
  <stability>
-  <release>beta</release>
-  <api>beta</api>
+  <release>stable</release>
+  <api>stable</api>
  </stability>
  <license>Apache 2.0</license>
  <notes>
-- gRPC Core 1.59.0 update
+- gRPC Core 1.59.4 update
  </notes>
  <contents>
   <dir baseinstalldir="/" name="/">
@@ -45,6 +45,7 @@
     <file baseinstalldir="/" name="include/grpc/fork.h" role="src" />
     <file baseinstalldir="/" name="include/grpc/grpc.h" role="src" />
     <file baseinstalldir="/" name="include/grpc/grpc_audit_logging.h" role="src" />
+    <file baseinstalldir="/" name="include/grpc/grpc_crl_provider.h" role="src" />
     <file baseinstalldir="/" name="include/grpc/grpc_posix.h" role="src" />
     <file baseinstalldir="/" name="include/grpc/grpc_security.h" role="src" />
     <file baseinstalldir="/" name="include/grpc/grpc_security_constants.h" role="src" />
@@ -299,14 +300,20 @@
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/huffsyms.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/internal.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/legacy_frame.h" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/parsing.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/ping_abuse_policy.h" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/ping_callbacks.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/ping_callbacks.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/ping_rate_policy.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/ping_rate_policy.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/stream_lists.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/varint.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/varint.h" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/write_size_policy.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/write_size_policy.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/chttp2/transport/writing.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/inproc/inproc_plugin.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/transport/inproc/inproc_transport.cc" role="src" />
@@ -1199,6 +1206,7 @@
     <file baseinstalldir="/" name="src/core/lib/gprpp/crash.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/crash.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/debug_location.h" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/gprpp/directory_reader.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/dual_ref_counted.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/env.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/examine_stack.cc" role="src" />
@@ -1223,6 +1231,7 @@
     <file baseinstalldir="/" name="src/core/lib/gprpp/packed_table.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/per_cpu.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/per_cpu.h" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/gprpp/posix/directory_reader.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/posix/env.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/posix/stat.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/posix/thd.cc" role="src" />
@@ -1252,6 +1261,7 @@
     <file baseinstalldir="/" name="src/core/lib/gprpp/unique_type_name.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/validation_errors.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/validation_errors.h" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/gprpp/windows/directory_reader.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/windows/env.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/windows/stat.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/gprpp/windows/thd.cc" role="src" />
@@ -1566,6 +1576,8 @@
     <file baseinstalldir="/" name="src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc" role="src" />
+    <file baseinstalldir="/" name="src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/credentials/tls/tls_credentials.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/credentials/tls/tls_credentials.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/credentials/tls/tls_utils.cc" role="src" />

src/core/BUILD

@@ -239,6 +239,27 @@ grpc_cc_library(
     ],
 )
 
+grpc_cc_library(
+    name = "directory_reader",
+    srcs = [
+        "lib/gprpp/posix/directory_reader.cc",
+        "lib/gprpp/windows/directory_reader.cc",
+    ],
+    hdrs = [
+        "lib/gprpp/directory_reader.h",
+    ],
+    external_deps = [
+        "absl/functional:function_ref",
+        "absl/status",
+        "absl/status:statusor",
+        "absl/strings",
+    ],
+    deps = [
+        "//:gpr",
+        "//:gpr_platform",
+    ],
+)
+
 grpc_cc_library(
     name = "chunked_vector",
     hdrs = ["lib/gprpp/chunked_vector.h"],
@@ -3057,6 +3078,38 @@ grpc_cc_library(
     ],
 )
 
+grpc_cc_library(
+    name = "grpc_crl_provider",
+    srcs = [
+        "lib/security/credentials/tls/grpc_tls_crl_provider.cc",
+    ],
+    hdrs = [
+        "lib/security/credentials/tls/grpc_tls_crl_provider.h",
+    ],
+    external_deps = [
+        "absl/base:core_headers",
+        "absl/container:flat_hash_map",
+        "absl/meta:type_traits",
+        "absl/status",
+        "absl/status:statusor",
+        "absl/strings",
+        "absl/types:optional",
+        "absl/types:span",
+        "libcrypto",
+        "libssl",
+    ],
+    deps = [
+        "default_event_engine",
+        "directory_reader",
+        "load_file",
+        "slice",
+        "time",
+        "//:exec_ctx",
+        "//:gpr",
+        "//:grpc_base",
+    ],
+)
+
 grpc_cc_library(
     name = "grpc_fake_credentials",
     srcs = [
@@ -5671,6 +5724,47 @@ grpc_cc_library(
     ],
 )
 
+grpc_cc_library(
+    name = "ping_callbacks",
+    srcs = [
+        "ext/transport/chttp2/transport/ping_callbacks.cc",
+    ],
+    hdrs = [
+        "ext/transport/chttp2/transport/ping_callbacks.h",
+    ],
+    external_deps = [
+        "absl/container:flat_hash_map",
+        "absl/functional:any_invocable",
+        "absl/hash",
+        "absl/meta:type_traits",
+        "absl/random:bit_gen_ref",
+        "absl/random:distributions",
+        "absl/types:optional",
+    ],
+    deps = [
+        "time",
+        "//:event_engine_base_hdrs",
+        "//:gpr",
+        "//:gpr_platform",
+        "//:grpc_trace",
+    ],
+)
+
+grpc_cc_library(
+    name = "write_size_policy",
+    srcs = [
+        "ext/transport/chttp2/transport/write_size_policy.cc",
+    ],
+    hdrs = [
+        "ext/transport/chttp2/transport/write_size_policy.h",
+    ],
+    deps = [
+        "time",
+        "//:gpr",
+        "//:gpr_platform",
+    ],
+)
+
 grpc_cc_library(
     name = "ping_rate_policy",
     srcs = [
@@ -5686,6 +5780,7 @@ grpc_cc_library(
     ],
     deps = [
         "channel_args",
+        "experiments",
         "match",
         "time",
         "//:channel_arg_names",
@@ -5693,6 +5788,20 @@ grpc_cc_library(
     ],
 )
 
+grpc_cc_library(
+    name = "max_concurrent_streams_policy",
+    srcs = [
+        "ext/transport/chttp2/transport/max_concurrent_streams_policy.cc",
+    ],
+    hdrs = [
+        "ext/transport/chttp2/transport/max_concurrent_streams_policy.h",
+    ],
+    deps = [
+        "//:gpr",
+        "//:gpr_platform",
+    ],
+)
+
 grpc_cc_library(
     name = "huffsyms",
     srcs = [

src/core/ext/filters/http/server/http_server_filter.cc

@@ -27,20 +27,23 @@
 
 #include "absl/base/attributes.h"
 #include "absl/meta/type_traits.h"
-#include "absl/status/status.h"
+#include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
 #include <grpc/impl/channel_arg_names.h>
+#include <grpc/status.h>
 #include <grpc/support/log.h>
 
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/promise/activity.h"
+#include "src/core/lib/promise/context.h"
 #include "src/core/lib/promise/map.h"
 #include "src/core/lib/promise/pipe.h"
 #include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
+#include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/slice/percent_encoding.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/surface/call_trace.h"
@@ -59,6 +62,15 @@ void FilterOutgoingMetadata(ServerMetadata* md) {
                                        PercentEncodingType::Compatible);
   }
 }
+
+ServerMetadataHandle MalformedRequest(absl::string_view explanation) {
+  auto* arena = GetContext<Arena>();
+  auto hdl = arena->MakePooled<ServerMetadata>(arena);
+  hdl->Set(GrpcStatusMetadata(), GRPC_STATUS_UNKNOWN);
+  hdl->Set(GrpcMessageMetadata(), Slice::FromStaticString(explanation));
+  hdl->Set(GrpcTarPit(), Empty());
+  return hdl;
+}
 }  // namespace
 
 ArenaPromise<ServerMetadataHandle> HttpServerFilter::MakeCallPromise(
@@ -77,42 +89,35 @@ ArenaPromise<ServerMetadataHandle> HttpServerFilter::MakeCallPromise(
         ABSL_FALLTHROUGH_INTENDED;
       case HttpMethodMetadata::kInvalid:
       case HttpMethodMetadata::kGet:
-        return Immediate(
-            ServerMetadataFromStatus(absl::UnknownError("Bad method header")));
+        return Immediate(MalformedRequest("Bad method header"));
     }
   } else {
-    return Immediate(
-        ServerMetadataFromStatus(absl::UnknownError("Missing :method header")));
+    return Immediate(MalformedRequest("Missing :method header"));
   }
 
   auto te = md->Take(TeMetadata());
   if (te == TeMetadata::kTrailers) {
     // Do nothing, ok.
   } else if (!te.has_value()) {
-    return Immediate(
-        ServerMetadataFromStatus(absl::UnknownError("Missing :te header")));
+    return Immediate(MalformedRequest("Missing :te header"));
   } else {
-    return Immediate(
-        ServerMetadataFromStatus(absl::UnknownError("Bad :te header")));
+    return Immediate(MalformedRequest("Bad :te header"));
   }
 
   auto scheme = md->Take(HttpSchemeMetadata());
   if (scheme.has_value()) {
     if (*scheme == HttpSchemeMetadata::kInvalid) {
-      return Immediate(
-          ServerMetadataFromStatus(absl::UnknownError("Bad :scheme header")));
+      return Immediate(MalformedRequest("Bad :scheme header"));
     }
   } else {
-    return Immediate(
-        ServerMetadataFromStatus(absl::UnknownError("Missing :scheme header")));
+    return Immediate(MalformedRequest("Missing :scheme header"));
   }
 
   md->Remove(ContentTypeMetadata());
 
   Slice* path_slice = md->get_pointer(HttpPathMetadata());
   if (path_slice == nullptr) {
-    return Immediate(
-        ServerMetadataFromStatus(absl::UnknownError("Missing :path header")));
+    return Immediate(MalformedRequest("Missing :path header"));
   }
 
   if (md->get_pointer(HttpAuthorityMetadata()) == nullptr) {
@@ -123,8 +128,7 @@ ArenaPromise<ServerMetadataHandle> HttpServerFilter::MakeCallPromise(
   }
 
   if (md->get_pointer(HttpAuthorityMetadata()) == nullptr) {
-    return Immediate(ServerMetadataFromStatus(
-        absl::UnknownError("Missing :authority header")));
+    return Immediate(MalformedRequest("Missing :authority header"));
   }
 
   if (!surface_user_agent_) {

src/core/ext/transport/chttp2/transport/frame_ping.cc

@@ -20,6 +20,7 @@
 
 #include "src/core/ext/transport/chttp2/transport/frame_ping.h"
 
+#include <inttypes.h>
 #include <string.h>
 
 #include <algorithm>
@@ -35,6 +36,7 @@
 
 #include "src/core/ext/transport/chttp2/transport/internal.h"
 #include "src/core/ext/transport/chttp2/transport/ping_abuse_policy.h"
+#include "src/core/ext/transport/chttp2/transport/ping_callbacks.h"
 #include "src/core/lib/debug/trace.h"
 
 extern grpc_core::TraceFlag grpc_keepalive_trace;
@@ -96,18 +98,26 @@ grpc_error_handle grpc_chttp2_ping_parser_parse(void* parser,
   if (p->byte == 8) {
     GPR_ASSERT(is_last);
     if (p->is_ack) {
+      if (grpc_ping_trace.enabled()) {
+        gpr_log(GPR_INFO, "%s[%p]: received ping ack %" PRIx64,
+                t->is_client ? "CLIENT" : "SERVER", t, p->opaque_8bytes);
+      }
       grpc_chttp2_ack_ping(t, p->opaque_8bytes);
     } else {
       if (!t->is_client) {
         const bool transport_idle =
             t->keepalive_permit_without_calls == 0 && t->stream_map.empty();
         if (grpc_keepalive_trace.enabled() || grpc_http_trace.enabled()) {
-          gpr_log(GPR_INFO, "t=%p received ping: %s", t,
+          gpr_log(GPR_INFO, "SERVER[%p]: received ping %" PRIx64 ": %s", t,
+                  p->opaque_8bytes,
                   t->ping_abuse_policy.GetDebugString(transport_idle).c_str());
         }
         if (t->ping_abuse_policy.ReceivedOnePing(transport_idle)) {
           grpc_chttp2_exceeded_ping_strikes(t);
         }
+      } else if (grpc_ping_trace.enabled()) {
+        gpr_log(GPR_INFO, "CLIENT[%p]: received ping %" PRIx64, t,
+                p->opaque_8bytes);
       }
       if (t->ack_pings) {
         if (t->ping_ack_count == t->ping_ack_capacity) {

src/core/ext/transport/chttp2/transport/frame_rst_stream.cc

@@ -24,6 +24,7 @@
 
 #include <initializer_list>
 
+#include "absl/random/distributions.h"
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
@@ -34,7 +35,9 @@
 #include "src/core/ext/transport/chttp2/transport/http_trace.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
 #include "src/core/ext/transport/chttp2/transport/legacy_frame.h"
+#include "src/core/ext/transport/chttp2/transport/ping_callbacks.h"
 #include "src/core/lib/debug/trace.h"
+#include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/gprpp/status_helper.h"
 #include "src/core/lib/transport/http2_errors.h"
 #include "src/core/lib/transport/metadata_batch.h"
@@ -125,6 +128,12 @@ grpc_error_handle grpc_chttp2_rst_stream_parser_parse(void* parser,
           grpc_core::StatusIntProperty::kHttp2Error,
           static_cast<intptr_t>(reason));
     }
+    if (grpc_core::IsPingOnRstStreamEnabled() && !t->is_client &&
+        absl::Bernoulli(t->bitgen, t->ping_on_rst_stream_percent / 100.0)) {
+      ++t->num_pending_induced_frames;
+      t->ping_callbacks.RequestPing();
+      grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_KEEPALIVE_PING);
+    }
     grpc_chttp2_mark_stream_closed(t, s, true, true, error);
   }
 

src/core/ext/transport/chttp2/transport/internal.h

@@ -24,13 +24,17 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include <atomic>
 #include <memory>
+#include <utility>
 
 #include "absl/container/flat_hash_map.h"
 #include "absl/meta/type_traits.h"
 #include "absl/random/random.h"
+#include "absl/status/status.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
+#include "absl/types/variant.h"
 
 #include <grpc/event_engine/event_engine.h>
 #include <grpc/event_engine/memory_allocator.h>
@@ -49,8 +53,11 @@
 #include "src/core/ext/transport/chttp2/transport/hpack_parser.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
 #include "src/core/ext/transport/chttp2/transport/legacy_frame.h"
+#include "src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h"
 #include "src/core/ext/transport/chttp2/transport/ping_abuse_policy.h"
+#include "src/core/ext/transport/chttp2/transport/ping_callbacks.h"
 #include "src/core/ext/transport/chttp2/transport/ping_rate_policy.h"
+#include "src/core/ext/transport/chttp2/transport/write_size_policy.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channelz.h"
 #include "src/core/lib/debug/trace.h"
@@ -145,18 +152,6 @@ typedef enum {
 const char* grpc_chttp2_initiate_write_reason_string(
     grpc_chttp2_initiate_write_reason reason);
 
-struct grpc_chttp2_ping_queue {
-  grpc_closure_list lists[GRPC_CHTTP2_PCL_COUNT] = {};
-  uint64_t inflight_id = 0;
-};
-
-struct grpc_chttp2_repeated_ping_state {
-  grpc_core::Timestamp last_ping_sent_time;
-  int pings_before_data_required;
-  absl::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
-      delayed_ping_timer_handle;
-};
-
 // deframer state for the overall http2 stream of bytes
 typedef enum {
   // prefix: one entry per http2 connection prefix byte
@@ -283,6 +278,31 @@ struct grpc_chttp2_transport : public grpc_core::KeepsGrpcInitialized {
 
   /// maps stream id to grpc_chttp2_stream objects
   absl::flat_hash_map<uint32_t, grpc_chttp2_stream*> stream_map;
+  // Count of streams that should be counted against max concurrent streams but
+  // are not in stream_map (due to tarpitting).
+  size_t extra_streams = 0;
+
+  class RemovedStreamHandle {
+   public:
+    RemovedStreamHandle() = default;
+    explicit RemovedStreamHandle(
+        grpc_core::RefCountedPtr<grpc_chttp2_transport> t)
+        : transport_(std::move(t)) {
+      ++transport_->extra_streams;
+    }
+    ~RemovedStreamHandle() {
+      if (transport_ != nullptr) {
+        --transport_->extra_streams;
+      }
+    }
+    RemovedStreamHandle(const RemovedStreamHandle&) = delete;
+    RemovedStreamHandle& operator=(const RemovedStreamHandle&) = delete;
+    RemovedStreamHandle(RemovedStreamHandle&&) = default;
+    RemovedStreamHandle& operator=(RemovedStreamHandle&&) = default;
+
+   private:
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> transport_;
+  };
 
   grpc_closure write_action_begin_locked;
   grpc_closure write_action;
@@ -311,13 +331,15 @@ struct grpc_chttp2_transport : public grpc_core::KeepsGrpcInitialized {
   grpc_core::ConnectivityStateTracker state_tracker;
 
   /// data to write now
-  grpc_slice_buffer outbuf;
+  grpc_core::SliceBuffer outbuf;
   /// hpack encoding
   grpc_core::HPackCompressor hpack_compressor;
 
   /// data to write next write
   grpc_slice_buffer qbuf;
 
+  size_t max_requests_per_read;
+
   /// Set to a grpc_error object if a goaway frame is received. By default, set
   /// to absl::OkStatus()
   grpc_error_handle goaway_error;
@@ -331,6 +353,10 @@ struct grpc_chttp2_transport : public grpc_core::KeepsGrpcInitialized {
   /// settings values
   uint32_t settings[GRPC_NUM_SETTING_SETS][GRPC_CHTTP2_NUM_SETTINGS];
 
+  grpc_event_engine::experimental::EventEngine::TaskHandle
+      settings_ack_watchdog =
+          grpc_event_engine::experimental::EventEngine::TaskHandle::kInvalid;
+
   /// what is the next stream id to be allocated by this peer?
   /// copied to next_stream_id in parsing when parsing commences
   uint32_t next_stream_id = 0;
@@ -338,15 +364,19 @@ struct grpc_chttp2_transport : public grpc_core::KeepsGrpcInitialized {
   /// last new stream id
   uint32_t last_new_stream_id = 0;
 
+  /// Number of incoming streams allowed before a settings ACK is required
+  uint32_t num_incoming_streams_before_settings_ack = 0;
+
   /// ping queues for various ping insertion points
-  grpc_chttp2_ping_queue ping_queue = grpc_chttp2_ping_queue();
   grpc_core::Chttp2PingAbusePolicy ping_abuse_policy;
   grpc_core::Chttp2PingRatePolicy ping_rate_policy;
+  grpc_core::Chttp2PingCallbacks ping_callbacks;
   absl::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
       delayed_ping_timer_handle;
-  uint64_t ping_ctr = 0;  // unique id for pings
   grpc_closure retry_initiate_ping_locked;
 
+  grpc_core::Chttp2MaxConcurrentStreamsPolicy max_concurrent_streams_policy;
+
   /// ping acks
   size_t ping_ack_count = 0;
   size_t ping_ack_capacity = 0;
@@ -379,6 +409,10 @@ struct grpc_chttp2_transport : public grpc_core::KeepsGrpcInitialized {
   uint32_t expect_continuation_stream_id = 0;
   uint32_t incoming_frame_size = 0;
 
+  int min_tarpit_duration_ms;
+  int max_tarpit_duration_ms;
+  bool allow_tarpit;
+
   grpc_chttp2_stream* incoming_stream = nullptr;
   // active parser
   struct Parser {
@@ -425,13 +459,13 @@ struct grpc_chttp2_transport : public grpc_core::KeepsGrpcInitialized {
   /// timer to initiate ping events
   absl::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
       keepalive_ping_timer_handle;
-  /// watchdog to kill the transport when waiting for the keepalive ping
-  absl::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
-      keepalive_watchdog_timer_handle;
   /// time duration in between pings
   grpc_core::Duration keepalive_time;
-  /// grace period for a ping to complete before watchdog kicks in
+  /// grace period to wait for data after sending a ping before keepalives
+  /// timeout
   grpc_core::Duration keepalive_timeout;
+  /// number of stream objects currently allocated by this transport
+  std::atomic<size_t> streams_allocated{0};
   /// keep-alive state machine state
   grpc_chttp2_keepalive_state keepalive_state;
   // Soft limit on max header size.
@@ -447,10 +481,20 @@ struct grpc_chttp2_transport : public grpc_core::KeepsGrpcInitialized {
   uint32_t num_pending_induced_frames = 0;
   uint32_t incoming_stream_id = 0;
 
+  /// grace period after sending a ping to wait for the ping ack
+  grpc_core::Duration ping_timeout;
+  grpc_event_engine::experimental::EventEngine::TaskHandle
+      keepalive_ping_timeout_handle =
+          grpc_event_engine::experimental::EventEngine::TaskHandle::kInvalid;
+  /// grace period before settings timeout expires
+  grpc_core::Duration settings_timeout;
+
   /// how much data are we willing to buffer when the WRITE_BUFFER_HINT is set?
-  ///
   uint32_t write_buffer_size = grpc_core::chttp2::kDefaultWindow;
 
+  /// policy for how much data we're willing to put into one http2 write
+  grpc_core::Chttp2WriteSizePolicy write_size_policy;
+
   bool reading_paused_on_pending_induced_frames = false;
   /// Based on channel args, preferred_rx_crypto_frame_sizes are advertised to
   /// the peer
@@ -492,6 +536,12 @@ struct grpc_chttp2_transport : public grpc_core::KeepsGrpcInitialized {
   bool bdp_ping_started = false;
   // True if pings should be acked
   bool ack_pings = true;
+  /// True if the keepalive system wants to see some data incoming
+  bool keepalive_incoming_data_wanted = false;
+
+  // What percentage of rst_stream frames on the server should cause a ping
+  // frame to be generated.
+  uint8_t ping_on_rst_stream_percent;
 
   /// write execution state of the transport
   grpc_chttp2_write_state write_state = GRPC_CHTTP2_WRITE_STATE_IDLE;
@@ -618,6 +668,8 @@ struct grpc_chttp2_stream {
   bool traced = false;
 };
 
+#define GRPC_ARG_PING_TIMEOUT_MS "grpc.http2.ping_timeout_ms"
+
 /// Transport writing call flow:
 /// grpc_chttp2_initiate_write() is called anywhere that we know bytes need to
 /// go out on the wire.
@@ -645,10 +697,14 @@ grpc_chttp2_begin_write_result grpc_chttp2_begin_write(
     grpc_chttp2_transport* t);
 void grpc_chttp2_end_write(grpc_chttp2_transport* t, grpc_error_handle error);
 
-/// Process one slice of incoming data; return 1 if the connection is still
-/// viable after reading, or 0 if the connection should be torn down
-grpc_error_handle grpc_chttp2_perform_read(grpc_chttp2_transport* t,
-                                           const grpc_slice& slice);
+/// Process one slice of incoming data
+/// Returns:
+///  - a count of parsed bytes in the event of a partial read: the caller should
+///    offload responsibilities to another thread to continue parsing.
+///  - or a status in the case of a completed read
+absl::variant<size_t, absl::Status> grpc_chttp2_perform_read(
+    grpc_chttp2_transport* t, const grpc_slice& slice,
+    size_t& requests_started);
 
 bool grpc_chttp2_list_add_writable_stream(grpc_chttp2_transport* t,
                                           grpc_chttp2_stream* s);
@@ -723,6 +779,14 @@ void grpc_chttp2_complete_closure_step(grpc_chttp2_transport* t,
                                        const char* desc,
                                        grpc_core::DebugLocation whence = {});
 
+void grpc_chttp2_keepalive_timeout(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t);
+void grpc_chttp2_ping_timeout(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t);
+
+void grpc_chttp2_settings_timeout(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t);
+
 #define GRPC_HEADER_SIZE_IN_BYTES 5
 #define MAX_SIZE_T (~(size_t)0)
 
@@ -742,9 +806,9 @@ void grpc_chttp2_complete_closure_step(grpc_chttp2_transport* t,
 void grpc_chttp2_fake_status(grpc_chttp2_transport* t,
                              grpc_chttp2_stream* stream,
                              grpc_error_handle error);
-void grpc_chttp2_mark_stream_closed(grpc_chttp2_transport* t,
-                                    grpc_chttp2_stream* s, int close_reads,
-                                    int close_writes, grpc_error_handle error);
+grpc_chttp2_transport::RemovedStreamHandle grpc_chttp2_mark_stream_closed(
+    grpc_chttp2_transport* t, grpc_chttp2_stream* s, int close_reads,
+    int close_writes, grpc_error_handle error);
 void grpc_chttp2_start_writing(grpc_chttp2_transport* t);
 
 #ifndef NDEBUG
@@ -780,7 +844,7 @@ void grpc_chttp2_mark_stream_writable(grpc_chttp2_transport* t,
                                       grpc_chttp2_stream* s);
 
 void grpc_chttp2_cancel_stream(grpc_chttp2_transport* t, grpc_chttp2_stream* s,
-                               grpc_error_handle due_to_error);
+                               grpc_error_handle due_to_error, bool tarpit);
 
 void grpc_chttp2_maybe_complete_recv_initial_metadata(grpc_chttp2_transport* t,
                                                       grpc_chttp2_stream* s);

src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc

@@ -0,0 +1,44 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h"
+
+#include <utility>
+
+#include <grpc/support/log.h>
+
+namespace grpc_core {
+
+void Chttp2MaxConcurrentStreamsPolicy::AddDemerit() {
+  ++new_demerits_;
+  ++unacked_demerits_;
+}
+
+void Chttp2MaxConcurrentStreamsPolicy::FlushedSettings() {
+  sent_demerits_ += std::exchange(new_demerits_, 0);
+}
+
+void Chttp2MaxConcurrentStreamsPolicy::AckLastSend() {
+  GPR_ASSERT(unacked_demerits_ >= sent_demerits_);
+  unacked_demerits_ -= std::exchange(sent_demerits_, 0);
+}
+
+uint32_t Chttp2MaxConcurrentStreamsPolicy::AdvertiseValue() const {
+  if (target_ < unacked_demerits_) return 0;
+  return target_ - unacked_demerits_;
+}
+
+}  // namespace grpc_core

src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h

@@ -0,0 +1,67 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_MAX_CONCURRENT_STREAMS_POLICY_H
+#define GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_MAX_CONCURRENT_STREAMS_POLICY_H
+
+#include <grpc/support/port_platform.h>
+
+#include <cstdint>
+#include <limits>
+
+namespace grpc_core {
+
+class Chttp2MaxConcurrentStreamsPolicy {
+ public:
+  // Set the target number of concurrent streams.
+  // If everything is idle we should advertise this number.
+  void SetTarget(uint32_t target) { target_ = target; }
+
+  // Add one demerit to the current target.
+  // We need to do one full settings round trip after this to clear this
+  // demerit.
+  // It will reduce our advertised max concurrent streams by one.
+  void AddDemerit();
+
+  // Notify the policy that we've sent a settings frame.
+  // Newly added demerits since the last settings frame was sent will be cleared
+  // once that settings frame is acknowledged.
+  void FlushedSettings();
+
+  // Notify the policy that we've received an acknowledgement for the last
+  // settings frame we sent.
+  void AckLastSend();
+
+  // Returns what we should advertise as max concurrent streams.
+  uint32_t AdvertiseValue() const;
+
+ private:
+  uint32_t target_ = std::numeric_limits<int32_t>::max();
+  // Demerit flow:
+  // When we add a demerit, we add to both new & unacked.
+  // When we flush settings, we move new to sent.
+  // When we ack settings, we remove what we sent from unacked.
+  // eg:
+  // we add 10 demerits - now new=10, sent=0, unacked=10
+  // we send settings - now new=0, sent=10, unacked=10
+  // we add 5 demerits - now new=5, sent=10, unacked=15
+  // we get the settings ack - now new=5, sent=0, unacked=5
+  uint32_t new_demerits_ = 0;
+  uint32_t sent_demerits_ = 0;
+  uint32_t unacked_demerits_ = 0;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_MAX_CONCURRENT_STREAMS_POLICY_H

src/core/ext/transport/chttp2/transport/parsing.cc

@@ -21,8 +21,12 @@
 #include <inttypes.h>
 #include <string.h>
 
+#include <atomic>
 #include <initializer_list>
+#include <limits>
+#include <memory>
 #include <string>
+#include <utility>
 
 #include "absl/base/attributes.h"
 #include "absl/container/flat_hash_map.h"
@@ -31,8 +35,11 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/string_view.h"
+#include "absl/types/variant.h"
 
+#include <grpc/event_engine/event_engine.h>
 #include <grpc/slice.h>
+#include <grpc/slice_buffer.h>
 #include <grpc/support/log.h>
 
 #include "src/core/ext/transport/chttp2/transport/flow_control.h"
@@ -48,11 +55,14 @@
 #include "src/core/ext/transport/chttp2/transport/http_trace.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
 #include "src/core/ext/transport/chttp2/transport/legacy_frame.h"
+#include "src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h"
 #include "src/core/ext/transport/chttp2/transport/ping_rate_policy.h"
+#include "src/core/lib/backoff/random_early_detection.h"
 #include "src/core/lib/channel/call_tracer.h"
 #include "src/core/lib/channel/channelz.h"
 #include "src/core/lib/channel/context.h"
 #include "src/core/lib/debug/trace.h"
+#include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/status_helper.h"
 #include "src/core/lib/iomgr/closure.h"
@@ -70,9 +80,11 @@ using grpc_core::HPackParser;
 
 grpc_core::TraceFlag grpc_trace_chttp2_new_stream(false, "chttp2_new_stream");
 
-static grpc_error_handle init_frame_parser(grpc_chttp2_transport* t);
+static grpc_error_handle init_frame_parser(grpc_chttp2_transport* t,
+                                           size_t& requests_started);
 static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
-                                                  int is_continuation);
+                                                  int is_continuation,
+                                                  size_t& requests_started);
 static grpc_error_handle init_data_frame_parser(grpc_chttp2_transport* t);
 static grpc_error_handle init_rst_stream_parser(grpc_chttp2_transport* t);
 static grpc_error_handle init_settings_frame_parser(grpc_chttp2_transport* t);
@@ -194,8 +206,9 @@ std::string FrameTypeString(uint8_t frame_type, uint8_t flags) {
 }
 }  // namespace
 
-grpc_error_handle grpc_chttp2_perform_read(grpc_chttp2_transport* t,
-                                           const grpc_slice& slice) {
+absl::variant<size_t, absl::Status> grpc_chttp2_perform_read(
+    grpc_chttp2_transport* t, const grpc_slice& slice,
+    size_t& requests_started) {
   const uint8_t* beg = GRPC_SLICE_START_PTR(slice);
   const uint8_t* end = GRPC_SLICE_END_PTR(slice);
   const uint8_t* cur = beg;
@@ -249,6 +262,10 @@ grpc_error_handle grpc_chttp2_perform_read(grpc_chttp2_transport* t,
         return absl::OkStatus();
       }
     dts_fh_0:
+      if (requests_started >= t->max_requests_per_read) {
+        t->deframe_state = GRPC_DTS_FH_0;
+        return static_cast<size_t>(cur - beg);
+      }
       ABSL_FALLTHROUGH_INTENDED;
     case GRPC_DTS_FH_0:
       GPR_DEBUG_ASSERT(cur < end);
@@ -324,7 +341,7 @@ grpc_error_handle grpc_chttp2_perform_read(grpc_chttp2_transport* t,
                 t->incoming_frame_size, t->incoming_stream_id);
       }
       t->deframe_state = GRPC_DTS_FRAME;
-      err = init_frame_parser(t);
+      err = init_frame_parser(t, requests_started);
       if (!err.ok()) {
         return err;
       }
@@ -378,6 +395,10 @@ grpc_error_handle grpc_chttp2_perform_read(grpc_chttp2_transport* t,
         }
         cur += t->incoming_frame_size;
         t->incoming_stream = nullptr;
+        if (t->incoming_frame_type == GRPC_CHTTP2_FRAME_RST_STREAM &&
+            grpc_core::IsChttp2OffloadOnRstStreamEnabled()) {
+          requests_started = std::numeric_limits<size_t>::max();
+        }
         goto dts_fh_0;  // loop
       } else {
         err = parse_frame_slice(
@@ -397,7 +418,8 @@ grpc_error_handle grpc_chttp2_perform_read(grpc_chttp2_transport* t,
   GPR_UNREACHABLE_CODE(return absl::OkStatus());
 }
 
-static grpc_error_handle init_frame_parser(grpc_chttp2_transport* t) {
+static grpc_error_handle init_frame_parser(grpc_chttp2_transport* t,
+                                           size_t& requests_started) {
   if (t->is_first_frame &&
       t->incoming_frame_type != GRPC_CHTTP2_FRAME_SETTINGS) {
     return GRPC_ERROR_CREATE(absl::StrCat(
@@ -417,13 +439,13 @@ static grpc_error_handle init_frame_parser(grpc_chttp2_transport* t) {
           "grpc_chttp2_stream %08x",
           t->expect_continuation_stream_id, t->incoming_stream_id));
     }
-    return init_header_frame_parser(t, 1);
+    return init_header_frame_parser(t, 1, requests_started);
   }
   switch (t->incoming_frame_type) {
     case GRPC_CHTTP2_FRAME_DATA:
       return init_data_frame_parser(t);
     case GRPC_CHTTP2_FRAME_HEADER:
-      return init_header_frame_parser(t, 0);
+      return init_header_frame_parser(t, 0, requests_started);
     case GRPC_CHTTP2_FRAME_CONTINUATION:
       return GRPC_ERROR_CREATE("Unexpected CONTINUATION frame");
     case GRPC_CHTTP2_FRAME_RST_STREAM:
@@ -567,7 +589,8 @@ error_handler:
 }
 
 static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
-                                                  int is_continuation) {
+                                                  int is_continuation,
+                                                  size_t& requests_started) {
   const bool is_eoh =
       (t->incoming_frame_flags & GRPC_CHTTP2_DATA_FLAG_END_HEADERS) != 0;
   grpc_chttp2_stream* s;
@@ -625,10 +648,40 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
           t->incoming_stream_id));
       return init_header_skip_frame_parser(t, priority_type, is_eoh);
     } else if (GPR_UNLIKELY(
-                   t->stream_map.size() >=
+                   t->stream_map.size() + t->extra_streams >=
                    t->settings[GRPC_ACKED_SETTINGS]
                               [GRPC_CHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS])) {
       return GRPC_ERROR_CREATE("Max stream count exceeded");
+    } else if (GPR_UNLIKELY(
+                   grpc_core::IsOverloadProtectionEnabled() &&
+                   t->streams_allocated.load(std::memory_order_relaxed) >
+                       t->max_concurrent_streams_policy.AdvertiseValue())) {
+      // We have more streams allocated than we'd like, so apply some pushback
+      // by refusing this stream.
+      ++t->num_pending_induced_frames;
+      grpc_slice_buffer_add(&t->qbuf, grpc_chttp2_rst_stream_create(
+                                          t->incoming_stream_id,
+                                          GRPC_HTTP2_REFUSED_STREAM, nullptr));
+      grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_RST_STREAM);
+      return init_header_skip_frame_parser(t, priority_type, is_eoh);
+    } else if (GPR_UNLIKELY(
+                   grpc_core::IsRedMaxConcurrentStreamsEnabled() &&
+                   t->stream_map.size() >=
+                       t->max_concurrent_streams_policy.AdvertiseValue() &&
+                   grpc_core::RandomEarlyDetection(
+                       t->max_concurrent_streams_policy.AdvertiseValue(),
+                       t->settings[GRPC_ACKED_SETTINGS]
+                                  [GRPC_CHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS])
+                       .Reject(t->stream_map.size(), t->bitgen))) {
+      // We are under the limit of max concurrent streams for the current
+      // setting, but are over the next value that will be advertised.
+      // Apply some backpressure by randomly not accepting new streams.
+      ++t->num_pending_induced_frames;
+      grpc_slice_buffer_add(&t->qbuf, grpc_chttp2_rst_stream_create(
+                                          t->incoming_stream_id,
+                                          GRPC_HTTP2_REFUSED_STREAM, nullptr));
+      grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_RST_STREAM);
+      return init_header_skip_frame_parser(t, priority_type, is_eoh);
     } else if (t->sent_goaway_state == GRPC_CHTTP2_FINAL_GOAWAY_SENT ||
                t->sent_goaway_state ==
                    GRPC_CHTTP2_FINAL_GOAWAY_SEND_SCHEDULED) {
@@ -639,10 +692,29 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
           t, std::string(t->peer_string.as_string_view()).c_str(),
           t->incoming_stream_id, t->last_new_stream_id));
       return init_header_skip_frame_parser(t, priority_type, is_eoh);
+    } else if (grpc_core::IsBlockExcessiveRequestsBeforeSettingsAckEnabled() &&
+               t->num_incoming_streams_before_settings_ack == 0) {
+      GRPC_CHTTP2_IF_TRACING(gpr_log(
+          GPR_ERROR,
+          "transport:%p SERVER peer:%s rejecting grpc_chttp2_stream id=%d, "
+          "last grpc_chttp2_stream id=%d before settings have been "
+          "acknowledged",
+          t, std::string(t->peer_string.as_string_view()).c_str(),
+          t->incoming_stream_id, t->last_new_stream_id));
+      ++t->num_pending_induced_frames;
+      grpc_slice_buffer_add(
+          &t->qbuf,
+          grpc_chttp2_rst_stream_create(t->incoming_stream_id,
+                                        GRPC_HTTP2_ENHANCE_YOUR_CALM, nullptr));
+      grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_RST_STREAM);
+      t->last_new_stream_id = t->incoming_stream_id;
+      return init_header_skip_frame_parser(t, priority_type, is_eoh);
     }
+    --t->num_incoming_streams_before_settings_ack;
     t->last_new_stream_id = t->incoming_stream_id;
     s = t->incoming_stream =
         grpc_chttp2_parsing_accept_stream(t, t->incoming_stream_id);
+    ++requests_started;
     if (GPR_UNLIKELY(s == nullptr)) {
       GRPC_CHTTP2_IF_TRACING(
           gpr_log(GPR_ERROR, "grpc_chttp2_stream not accepted"));
@@ -650,9 +722,12 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
     }
     if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace) ||
         GRPC_TRACE_FLAG_ENABLED(grpc_trace_chttp2_new_stream)) {
-      gpr_log(GPR_INFO, "[t:%p fd:%d peer:%s] Accepting new stream", t,
-              grpc_endpoint_get_fd(t->ep),
-              std::string(t->peer_string.as_string_view()).c_str());
+      gpr_log(GPR_INFO,
+              "[t:%p fd:%d peer:%s] Accepting new stream; "
+              "num_incoming_streams_before_settings_ack=%u",
+              t, grpc_endpoint_get_fd(t->ep),
+              std::string(t->peer_string.as_string_view()).c_str(),
+              t->num_incoming_streams_before_settings_ack);
     }
     if (t->channelz_socket != nullptr) {
       t->channelz_socket->RecordStreamStartedFromRemote();
@@ -763,6 +838,9 @@ static grpc_error_handle init_rst_stream_parser(grpc_chttp2_transport* t) {
   s->stats.incoming.framing_bytes += 9;
   t->parser = grpc_chttp2_transport::Parser{
       "rst_stream", grpc_chttp2_rst_stream_parser_parse, &t->simple.rst_stream};
+  if (!t->is_client && grpc_core::IsRstpitEnabled()) {
+    t->max_concurrent_streams_policy.AddDemerit();
+  }
   return absl::OkStatus();
 }
 
@@ -787,6 +865,7 @@ static grpc_error_handle init_settings_frame_parser(grpc_chttp2_transport* t) {
     return err;
   }
   if (t->incoming_frame_flags & GRPC_CHTTP2_FLAG_ACK) {
+    t->max_concurrent_streams_policy.AckLastSend();
     memcpy(t->settings[GRPC_ACKED_SETTINGS], t->settings[GRPC_SENT_SETTINGS],
            GRPC_CHTTP2_NUM_SETTINGS * sizeof(uint32_t));
     t->hpack_parser.hpack_table()->SetMaxBytes(
@@ -797,7 +876,17 @@ static grpc_error_handle init_settings_frame_parser(grpc_chttp2_transport* t) {
             t->settings[GRPC_ACKED_SETTINGS]
                        [GRPC_CHTTP2_SETTINGS_INITIAL_WINDOW_SIZE]),
         t, nullptr);
+    if (t->settings_ack_watchdog !=
+        grpc_event_engine::experimental::EventEngine::TaskHandle::kInvalid) {
+      t->event_engine->Cancel(std::exchange(
+          t->settings_ack_watchdog,
+          grpc_event_engine::experimental::EventEngine::TaskHandle::kInvalid));
+    }
     t->sent_local_settings = false;
+    // This is more streams than can be started in http2, so setting this
+    // effictively removes the limit for the rest of the connection.
+    t->num_incoming_streams_before_settings_ack =
+        std::numeric_limits<uint32_t>::max();
   }
   t->parser = grpc_chttp2_transport::Parser{
       "settings", grpc_chttp2_settings_parser_parse, &t->simple.settings};
@@ -828,7 +917,7 @@ static grpc_error_handle parse_frame_slice(grpc_chttp2_transport* t,
                          &unused)) {
     grpc_chttp2_parsing_become_skip_parser(t);
     if (s) {
-      grpc_chttp2_cancel_stream(t, s, err);
+      grpc_chttp2_cancel_stream(t, s, err, true);
     }
     return absl::OkStatus();
   }

src/core/ext/transport/chttp2/transport/ping_callbacks.cc

@@ -0,0 +1,108 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/ext/transport/chttp2/transport/ping_callbacks.h"
+
+#include <utility>
+
+#include "absl/meta/type_traits.h"
+#include "absl/random/distributions.h"
+
+#include <grpc/support/log.h>
+
+grpc_core::TraceFlag grpc_ping_trace(false, "http2_ping");
+
+namespace grpc_core {
+
+void Chttp2PingCallbacks::OnPing(Callback on_start, Callback on_ack) {
+  on_start_.emplace_back(std::move(on_start));
+  on_ack_.emplace_back(std::move(on_ack));
+  ping_requested_ = true;
+}
+
+void Chttp2PingCallbacks::OnPingAck(Callback on_ack) {
+  auto it = inflight_.find(most_recent_inflight_);
+  if (it != inflight_.end()) {
+    it->second.on_ack.emplace_back(std::move(on_ack));
+    return;
+  }
+  ping_requested_ = true;
+  on_ack_.emplace_back(std::move(on_ack));
+}
+
+uint64_t Chttp2PingCallbacks::StartPing(absl::BitGenRef bitgen) {
+  uint64_t id;
+  do {
+    id = absl::Uniform<uint64_t>(bitgen);
+  } while (inflight_.contains(id));
+  CallbackVec cbs = std::move(on_start_);
+  CallbackVec().swap(on_start_);
+  InflightPing inflight;
+  inflight.on_ack.swap(on_ack_);
+  started_new_ping_without_setting_timeout_ = true;
+  inflight_.emplace(id, std::move(inflight));
+  most_recent_inflight_ = id;
+  ping_requested_ = false;
+  for (auto& cb : cbs) {
+    cb();
+  }
+  return id;
+}
+
+bool Chttp2PingCallbacks::AckPing(
+    uint64_t id, grpc_event_engine::experimental::EventEngine* event_engine) {
+  auto ping = inflight_.extract(id);
+  if (ping.empty()) return false;
+  if (ping.mapped().on_timeout !=
+      grpc_event_engine::experimental::EventEngine::TaskHandle::kInvalid) {
+    event_engine->Cancel(ping.mapped().on_timeout);
+  }
+  for (auto& cb : ping.mapped().on_ack) {
+    cb();
+  }
+  return true;
+}
+
+void Chttp2PingCallbacks::CancelAll(
+    grpc_event_engine::experimental::EventEngine* event_engine) {
+  CallbackVec().swap(on_start_);
+  CallbackVec().swap(on_ack_);
+  for (auto& cbs : inflight_) {
+    CallbackVec().swap(cbs.second.on_ack);
+    if (cbs.second.on_timeout !=
+        grpc_event_engine::experimental::EventEngine::TaskHandle::kInvalid) {
+      event_engine->Cancel(std::exchange(
+          cbs.second.on_timeout,
+          grpc_event_engine::experimental::EventEngine::TaskHandle::kInvalid));
+    }
+  }
+  ping_requested_ = false;
+}
+
+absl::optional<uint64_t> Chttp2PingCallbacks::OnPingTimeout(
+    Duration ping_timeout,
+    grpc_event_engine::experimental::EventEngine* event_engine,
+    Callback callback) {
+  GPR_ASSERT(started_new_ping_without_setting_timeout_);
+  started_new_ping_without_setting_timeout_ = false;
+  auto it = inflight_.find(most_recent_inflight_);
+  if (it == inflight_.end()) return absl::nullopt;
+  it->second.on_timeout =
+      event_engine->RunAfter(ping_timeout, std::move(callback));
+  return most_recent_inflight_;
+}
+
+}  // namespace grpc_core

src/core/ext/transport/chttp2/transport/ping_callbacks.h

@@ -0,0 +1,115 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_PING_CALLBACKS_H
+#define GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_PING_CALLBACKS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <algorithm>
+#include <vector>
+
+#include "absl/container/flat_hash_map.h"
+#include "absl/functional/any_invocable.h"
+#include "absl/hash/hash.h"
+#include "absl/random/bit_gen_ref.h"
+#include "absl/types/optional.h"
+
+#include <grpc/event_engine/event_engine.h>
+
+#include "src/core/lib/debug/trace.h"
+#include "src/core/lib/gprpp/time.h"
+
+extern grpc_core::TraceFlag grpc_ping_trace;
+
+namespace grpc_core {
+
+class Chttp2PingCallbacks {
+ public:
+  // One callback from OnPing/OnPingAck or the timeout.
+  using Callback = absl::AnyInvocable<void()>;
+
+  // Request a ping (but one we don't need any notification for when it begins
+  // or ends).
+  void RequestPing() { ping_requested_ = true; }
+
+  // Request a ping, and specify callbacks for when it begins and ends.
+  // on_start is invoked during the call to StartPing.
+  // on_ack is invoked during the call to AckPing.
+  void OnPing(Callback on_start, Callback on_ack);
+
+  // Request a notification when *some* ping is acked:
+  // If there is no ping in flight, one will be scheduled and the callback
+  // will be invoked when it is acked. (ie as per OnPing([]{}, on_ack)).
+  // If there is a ping in flight, the callback will be invoked when the most
+  // recently sent ping is acked.
+  // on_ack is invoked during the call to AckPing.
+  void OnPingAck(Callback on_ack);
+
+  // Write path: begin a ping.
+  // Uses bitgen to generate a randomized id for the ping.
+  // Sets started_new_ping_without_setting_timeout.
+  GRPC_MUST_USE_RESULT uint64_t StartPing(absl::BitGenRef bitgen);
+  bool AckPing(uint64_t id,
+               grpc_event_engine::experimental::EventEngine* event_engine);
+
+  // Cancel all the ping callbacks.
+  // Sufficient state is maintained such that AckPing will still return true
+  // if a ping is acked after this call.
+  // No timeouts or start or ack callbacks previously scheduled will be invoked.
+  void CancelAll(grpc_event_engine::experimental::EventEngine* event_engine);
+
+  // Return true if a ping needs to be started due to
+  // RequestPing/OnPing/OnPingAck.
+  bool ping_requested() const { return ping_requested_; }
+
+  // Returns the number of pings currently in flight.
+  size_t pings_inflight() const { return inflight_.size(); }
+
+  // Returns true if a ping was started without setting a timeout yet.
+  bool started_new_ping_without_setting_timeout() const {
+    return started_new_ping_without_setting_timeout_;
+  }
+
+  // Add a ping timeout for the most recently started ping.
+  // started_new_ping_without_setting_timeout must be set.
+  // Clears started_new_ping_without_setting_timeout.
+  // Returns the ping id of the ping the timeout was attached to if a timer was
+  // started, or nullopt otherwise.
+  absl::optional<uint64_t> OnPingTimeout(
+      Duration ping_timeout,
+      grpc_event_engine::experimental::EventEngine* event_engine,
+      Callback callback);
+
+ private:
+  using CallbackVec = std::vector<Callback>;
+  struct InflightPing {
+    grpc_event_engine::experimental::EventEngine::TaskHandle on_timeout =
+        grpc_event_engine::experimental::EventEngine::TaskHandle::kInvalid;
+    CallbackVec on_ack;
+  };
+  absl::flat_hash_map<uint64_t, InflightPing> inflight_;
+  uint64_t most_recent_inflight_ = 0;
+  bool ping_requested_ = false;
+  bool started_new_ping_without_setting_timeout_ = false;
+  CallbackVec on_start_;
+  CallbackVec on_ack_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_PING_CALLBACKS_H

src/core/ext/transport/chttp2/transport/ping_rate_policy.cc

@@ -25,12 +25,20 @@
 
 #include <grpc/impl/channel_arg_names.h>
 
+#include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/gprpp/match.h"
 
+// How many pings do we allow to be inflight at any given time?
+// In older versions of gRPC this was implicitly 1.
+// With the multiping experiment we allow this to rise to 100 by default.
+// TODO(ctiller): consider making this public API
+#define GRPC_ARG_HTTP2_MAX_INFLIGHT_PINGS "grpc.http2.max_inflight_pings"
+
 namespace grpc_core {
 
 namespace {
 int g_default_max_pings_without_data = 2;
+absl::optional<int> g_default_max_inflight_pings;
 }  // namespace
 
 Chttp2PingRatePolicy::Chttp2PingRatePolicy(const ChannelArgs& args,
@@ -39,19 +47,31 @@ Chttp2PingRatePolicy::Chttp2PingRatePolicy(const ChannelArgs& args,
           is_client
               ? std::max(0, args.GetInt(GRPC_ARG_HTTP2_MAX_PINGS_WITHOUT_DATA)
                                 .value_or(g_default_max_pings_without_data))
-              : 0) {}
+              : 0),
+      // Configuration via channel arg dominates, otherwise if the multiping
+      // experiment is enabled we use 100, otherwise 1.
+      max_inflight_pings_(
+          std::max(0, args.GetInt(GRPC_ARG_HTTP2_MAX_INFLIGHT_PINGS)
+                          .value_or(g_default_max_inflight_pings.value_or(
+                              IsMultipingEnabled() ? 100 : 1)))) {}
 
 void Chttp2PingRatePolicy::SetDefaults(const ChannelArgs& args) {
   g_default_max_pings_without_data =
       std::max(0, args.GetInt(GRPC_ARG_HTTP2_MAX_PINGS_WITHOUT_DATA)
                       .value_or(g_default_max_pings_without_data));
+  g_default_max_inflight_pings = args.GetInt(GRPC_ARG_HTTP2_MAX_INFLIGHT_PINGS);
 }
 
 Chttp2PingRatePolicy::RequestSendPingResult
-Chttp2PingRatePolicy::RequestSendPing(Duration next_allowed_ping_interval) {
+Chttp2PingRatePolicy::RequestSendPing(Duration next_allowed_ping_interval,
+                                      size_t inflight_pings) const {
   if (max_pings_without_data_ != 0 && pings_before_data_required_ == 0) {
     return TooManyRecentPings{};
   }
+  if (max_inflight_pings_ != 0 &&
+      inflight_pings > static_cast<size_t>(max_inflight_pings_)) {
+    return TooManyRecentPings{};
+  }
   const Timestamp next_allowed_ping =
       last_ping_sent_time_ + next_allowed_ping_interval;
   const Timestamp now = Timestamp::Now();
@@ -59,11 +79,14 @@ Chttp2PingRatePolicy::RequestSendPing(Duration next_allowed_ping_interval) {
     return TooSoon{next_allowed_ping_interval, last_ping_sent_time_,
                    next_allowed_ping - now};
   }
-  last_ping_sent_time_ = now;
-  if (pings_before_data_required_) --pings_before_data_required_;
   return SendGranted{};
 }
 
+void Chttp2PingRatePolicy::SentPing() {
+  last_ping_sent_time_ = Timestamp::Now();
+  if (pings_before_data_required_) --pings_before_data_required_;
+}
+
 void Chttp2PingRatePolicy::ReceivedDataFrame() {
   last_ping_sent_time_ = Timestamp::InfPast();
 }

src/core/ext/transport/chttp2/transport/ping_rate_policy.h

@@ -17,6 +17,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <stddef.h>
+
 #include <iosfwd>
 #include <string>
 
@@ -51,8 +53,20 @@ class Chttp2PingRatePolicy {
   using RequestSendPingResult =
       absl::variant<SendGranted, TooManyRecentPings, TooSoon>;
 
-  RequestSendPingResult RequestSendPing(Duration next_allowed_ping_interval);
+  // Request that one ping be sent.
+  // Returns:
+  //  - SendGranted if a ping can be sent.
+  //  - TooManyRecentPings if too many pings have been sent recently and we
+  //    should wait for some future write.
+  //  - TooSoon if we should wait for some time before sending the ping.
+  RequestSendPingResult RequestSendPing(Duration next_allowed_ping_interval,
+                                        size_t inflight_pings) const;
+  // Notify the policy that one ping has been sent.
+  void SentPing();
+  // Notify the policy that some data has been sent and so we should no longer
+  // block pings on that basis.
   void ResetPingsBeforeDataRequired();
+  // Notify the policy that we've received some data.
   void ReceivedDataFrame();
   std::string GetDebugString() const;
 
@@ -60,6 +74,7 @@ class Chttp2PingRatePolicy {
 
  private:
   const int max_pings_without_data_;
+  const int max_inflight_pings_;
   // No pings allowed before receiving a header or data frame.
   int pings_before_data_required_ = 0;
   Timestamp last_ping_sent_time_ = Timestamp::InfPast();

src/core/ext/transport/chttp2/transport/write_size_policy.cc

@@ -0,0 +1,60 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/ext/transport/chttp2/transport/write_size_policy.h"
+
+#include <algorithm>
+
+#include <grpc/support/log.h>
+
+namespace grpc_core {
+
+size_t Chttp2WriteSizePolicy::WriteTargetSize() { return current_target_; }
+
+void Chttp2WriteSizePolicy::BeginWrite(size_t size) {
+  GPR_ASSERT(experiment_start_time_ == Timestamp::InfFuture());
+  if (size < current_target_ * 7 / 10) {
+    // If we were trending fast but stopped getting enough data to verify, then
+    // reset back to the default state.
+    if (state_ < 0) state_ = 0;
+    return;
+  }
+  experiment_start_time_ = Timestamp::Now();
+}
+
+void Chttp2WriteSizePolicy::EndWrite(bool success) {
+  if (experiment_start_time_ == Timestamp::InfFuture()) return;
+  const auto elapsed = Timestamp::Now() - experiment_start_time_;
+  experiment_start_time_ = Timestamp::InfFuture();
+  if (!success) return;
+  if (elapsed < FastWrite()) {
+    --state_;
+    if (state_ == -2) {
+      state_ = 0;
+      current_target_ = std::min(current_target_ * 3 / 2, MaxTarget());
+    }
+  } else if (elapsed > SlowWrite()) {
+    ++state_;
+    if (state_ == 2) {
+      state_ = 0;
+      current_target_ = std::max(current_target_ / 3, MinTarget());
+    }
+  } else {
+    state_ = 0;
+  }
+}
+
+}  // namespace grpc_core

src/core/ext/transport/chttp2/transport/write_size_policy.h

@@ -0,0 +1,66 @@
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_WRITE_SIZE_POLICY_H
+#define GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_WRITE_SIZE_POLICY_H
+
+#include <grpc/support/port_platform.h>
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "src/core/lib/gprpp/time.h"
+
+namespace grpc_core {
+
+class Chttp2WriteSizePolicy {
+ public:
+  // Smallest possible WriteTargetSize
+  static constexpr size_t MinTarget() { return 32 * 1024; }
+  // Largest possible WriteTargetSize
+  static constexpr size_t MaxTarget() { return 16 * 1024 * 1024; }
+  // How long should a write take to be considered "fast"
+  static constexpr Duration FastWrite() { return Duration::Milliseconds(100); }
+  // How long should a write take to be considered "slow"
+  static constexpr Duration SlowWrite() { return Duration::Seconds(1); }
+  // If a read is slow, what target time should we use to try and adjust back
+  // to?
+  static constexpr Duration TargetWriteTime() {
+    return Duration::Milliseconds(300);
+  }
+
+  // What size should be targetted for the next write.
+  size_t WriteTargetSize();
+  // Notify the policy that a write of some size has begun.
+  // EndWrite must be called when the write completes.
+  void BeginWrite(size_t size);
+  // Notify the policy that a write of some size has ended.
+  void EndWrite(bool success);
+
+ private:
+  size_t current_target_ = 128 * 1024;
+  Timestamp experiment_start_time_ = Timestamp::InfFuture();
+  // State varies from -2...2
+  // Every time we do a write faster than kFastWrite, we decrement
+  // Every time we do a write slower than kSlowWrite, we increment
+  // If we hit -2, we increase the target size and reset state to 0
+  // If we hit 2, we decrease the target size and reset state to 0
+  // In this way, we need two consecutive fast/slow operations to adjust,
+  // denoising the signal significantly
+  int8_t state_ = 0;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_WRITE_SIZE_POLICY_H

src/core/ext/transport/chttp2/transport/writing.cc

@@ -22,6 +22,7 @@
 #include <stddef.h>
 
 #include <algorithm>
+#include <limits>
 #include <memory>
 #include <string>
 #include <utility>
@@ -49,21 +50,25 @@
 #include "src/core/ext/transport/chttp2/transport/http_trace.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
 #include "src/core/ext/transport/chttp2/transport/legacy_frame.h"
+#include "src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h"
+#include "src/core/ext/transport/chttp2/transport/ping_callbacks.h"
 #include "src/core/ext/transport/chttp2/transport/ping_rate_policy.h"
+#include "src/core/ext/transport/chttp2/transport/write_size_policy.h"
 #include "src/core/lib/channel/channelz.h"
 #include "src/core/lib/debug/stats.h"
 #include "src/core/lib/debug/stats_data.h"
 #include "src/core/lib/debug/trace.h"
-#include "src/core/lib/gprpp/debug_location.h"
+#include "src/core/lib/experiments/experiments.h"
+#include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/match.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/time.h"
-#include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/endpoint.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/slice/slice.h"
+#include "src/core/lib/slice/slice_buffer.h"
 #include "src/core/lib/transport/bdp_estimator.h"
 #include "src/core/lib/transport/http2_errors.h"
 #include "src/core/lib/transport/metadata_batch.h"
@@ -97,6 +102,9 @@ static grpc_core::Duration NextAllowedPingInterval(grpc_chttp2_transport* t) {
     // The gRPC keepalive spec doesn't call for any throttling on the server
     // side, but we are adding some throttling for protection anyway, unless
     // we are doing a graceful GOAWAY in which case we don't want to wait.
+    if (grpc_core::IsMultipingEnabled()) {
+      return grpc_core::Duration::Seconds(1);
+    }
     return t->keepalive_time == grpc_core::Duration::Infinity()
                ? grpc_core::Duration::Seconds(20)
                : t->keepalive_time / 2;
@@ -105,43 +113,33 @@ static grpc_core::Duration NextAllowedPingInterval(grpc_chttp2_transport* t) {
 }
 
 static void maybe_initiate_ping(grpc_chttp2_transport* t) {
-  grpc_chttp2_ping_queue* pq = &t->ping_queue;
-  if (grpc_closure_list_empty(pq->lists[GRPC_CHTTP2_PCL_NEXT])) {
+  if (!t->ping_callbacks.ping_requested()) {
     // no ping needed: wait
     return;
   }
-  if (!grpc_closure_list_empty(pq->lists[GRPC_CHTTP2_PCL_INFLIGHT])) {
-    // ping already in-flight: wait
-    if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace) ||
-        GRPC_TRACE_FLAG_ENABLED(grpc_bdp_estimator_trace) ||
-        GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {
-      gpr_log(GPR_INFO, "%s: Ping delayed [%s]: already pinging",
-              t->is_client ? "CLIENT" : "SERVER",
-              std::string(t->peer_string.as_string_view()).c_str());
-    }
-    return;
-  }
   // InvalidateNow to avoid getting stuck re-initializing the ping timer
   // in a loop while draining the currently-held combiner. Also see
   // https://github.com/grpc/grpc/issues/26079.
   grpc_core::ExecCtx::Get()->InvalidateNow();
   Match(
-      t->ping_rate_policy.RequestSendPing(NextAllowedPingInterval(t)),
-      [pq, t](grpc_core::Chttp2PingRatePolicy::SendGranted) {
-        pq->inflight_id = t->ping_ctr;
-        t->ping_ctr++;
-        grpc_core::ExecCtx::RunList(DEBUG_LOCATION,
-                                    &pq->lists[GRPC_CHTTP2_PCL_INITIATE]);
-        grpc_closure_list_move(&pq->lists[GRPC_CHTTP2_PCL_NEXT],
-                               &pq->lists[GRPC_CHTTP2_PCL_INFLIGHT]);
-        grpc_slice_buffer_add(&t->outbuf,
-                              grpc_chttp2_ping_create(false, pq->inflight_id));
+      t->ping_rate_policy.RequestSendPing(NextAllowedPingInterval(t),
+                                          t->ping_callbacks.pings_inflight()),
+      [t](grpc_core::Chttp2PingRatePolicy::SendGranted) {
+        t->ping_rate_policy.SentPing();
+        const uint64_t id = t->ping_callbacks.StartPing(t->bitgen);
+        grpc_slice_buffer_add(t->outbuf.c_slice_buffer(),
+                              grpc_chttp2_ping_create(false, id));
+        t->keepalive_incoming_data_wanted = true;
+        if (t->channelz_socket != nullptr) {
+          t->channelz_socket->RecordKeepaliveSent();
+        }
         grpc_core::global_stats().IncrementHttp2PingsSent();
         if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace) ||
             GRPC_TRACE_FLAG_ENABLED(grpc_bdp_estimator_trace) ||
-            GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {
-          gpr_log(GPR_INFO, "%s: Ping sent [%s]: %s",
-                  t->is_client ? "CLIENT" : "SERVER",
+            GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace) ||
+            GRPC_TRACE_FLAG_ENABLED(grpc_ping_trace)) {
+          gpr_log(GPR_INFO, "%s[%p]: Ping %" PRIx64 " sent [%s]: %s",
+                  t->is_client ? "CLIENT" : "SERVER", t, id,
                   std::string(t->peer_string.as_string_view()).c_str(),
                   t->ping_rate_policy.GetDebugString().c_str());
         }
@@ -150,9 +148,11 @@ static void maybe_initiate_ping(grpc_chttp2_transport* t) {
         // need to receive something of substance before sending a ping again
         if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace) ||
             GRPC_TRACE_FLAG_ENABLED(grpc_bdp_estimator_trace) ||
-            GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {
+            GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace) ||
+            GRPC_TRACE_FLAG_ENABLED(grpc_ping_trace)) {
           gpr_log(GPR_INFO,
-                  "CLIENT: Ping delayed [%s]: too many recent pings: %s",
+                  "%s[%p]: Ping delayed [%s]: too many recent pings: %s",
+                  t->is_client ? "CLIENT" : "SERVER", t,
                   std::string(t->peer_string.as_string_view()).c_str(),
                   t->ping_rate_policy.GetDebugString().c_str());
         }
@@ -161,16 +161,17 @@ static void maybe_initiate_ping(grpc_chttp2_transport* t) {
         // not enough elapsed time between successive pings
         if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace) ||
             GRPC_TRACE_FLAG_ENABLED(grpc_bdp_estimator_trace) ||
-            GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {
-          gpr_log(GPR_INFO,
-                  "%s: Ping delayed [%s]: not enough time elapsed since last "
-                  "ping. "
-                  " Last ping:%s, minimum wait:%s need to wait:%s",
-                  t->is_client ? "CLIENT" : "SERVER",
-                  std::string(t->peer_string.as_string_view()).c_str(),
-                  too_soon.last_ping.ToString().c_str(),
-                  too_soon.next_allowed_ping_interval.ToString().c_str(),
-                  too_soon.wait.ToString().c_str());
+            GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace) ||
+            GRPC_TRACE_FLAG_ENABLED(grpc_ping_trace)) {
+          gpr_log(
+              GPR_INFO,
+              "%s[%p]: Ping delayed [%s]: not enough time elapsed since last "
+              "ping. Last ping:%s, minimum wait:%s need to wait:%s",
+              t->is_client ? "CLIENT" : "SERVER", t,
+              std::string(t->peer_string.as_string_view()).c_str(),
+              too_soon.last_ping.ToString().c_str(),
+              too_soon.next_allowed_ping_interval.ToString().c_str(),
+              too_soon.wait.ToString().c_str());
         }
         if (!t->delayed_ping_timer_handle.has_value()) {
           t->delayed_ping_timer_handle = t->event_engine->RunAfter(
@@ -228,11 +229,6 @@ static void report_stall(grpc_chttp2_transport* t, grpc_chttp2_stream* s,
   }
 }
 
-// How many bytes would we like to put on the wire during a single syscall
-static uint32_t target_write_size(grpc_chttp2_transport* /*t*/) {
-  return 1024 * 1024;
-}
-
 namespace {
 
 class CountDefaultMetadataEncoder {
@@ -268,42 +264,66 @@ class WriteContext {
   }
 
   void FlushSettings() {
-    if (t_->dirtied_local_settings && !t_->sent_local_settings) {
+    const bool dirty =
+        t_->dirtied_local_settings ||
+        t_->settings[GRPC_SENT_SETTINGS]
+                    [GRPC_CHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS] !=
+            t_->max_concurrent_streams_policy.AdvertiseValue();
+    if (dirty && !t_->sent_local_settings) {
+      t_->settings[GRPC_LOCAL_SETTINGS]
+                  [GRPC_CHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS] =
+          t_->max_concurrent_streams_policy.AdvertiseValue();
       grpc_slice_buffer_add(
-          &t_->outbuf, grpc_chttp2_settings_create(
-                           t_->settings[GRPC_SENT_SETTINGS],
-                           t_->settings[GRPC_LOCAL_SETTINGS],
-                           t_->force_send_settings, GRPC_CHTTP2_NUM_SETTINGS));
+          t_->outbuf.c_slice_buffer(),
+          grpc_chttp2_settings_create(t_->settings[GRPC_SENT_SETTINGS],
+                                      t_->settings[GRPC_LOCAL_SETTINGS],
+                                      t_->force_send_settings,
+                                      GRPC_CHTTP2_NUM_SETTINGS));
+      if (grpc_core::IsSettingsTimeoutEnabled() &&
+          t_->keepalive_timeout != grpc_core::Duration::Infinity()) {
+        GPR_ASSERT(
+            t_->settings_ack_watchdog ==
+            grpc_event_engine::experimental::EventEngine::TaskHandle::kInvalid);
+        // We base settings timeout on keepalive timeout, but double it to allow
+        // for implementations taking some more time about acking a setting.
+        t_->settings_ack_watchdog = t_->event_engine->RunAfter(
+            t_->settings_timeout, [t = t_->Ref()]() mutable {
+              grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
+              grpc_core::ExecCtx exec_ctx;
+              grpc_chttp2_settings_timeout(std::move(t));
+            });
+      }
       t_->force_send_settings = false;
       t_->dirtied_local_settings = false;
       t_->sent_local_settings = true;
       t_->flow_control.FlushedSettings();
+      t_->max_concurrent_streams_policy.FlushedSettings();
       grpc_core::global_stats().IncrementHttp2SettingsWrites();
     }
   }
 
   void FlushQueuedBuffers() {
     // simple writes are queued to qbuf, and flushed here
-    grpc_slice_buffer_move_into(&t_->qbuf, &t_->outbuf);
+    grpc_slice_buffer_move_into(&t_->qbuf, t_->outbuf.c_slice_buffer());
     t_->num_pending_induced_frames = 0;
     GPR_ASSERT(t_->qbuf.count == 0);
   }
 
   void FlushWindowUpdates() {
-    uint32_t transport_announce =
-        t_->flow_control.MaybeSendUpdate(t_->outbuf.count > 0);
+    uint32_t transport_announce = t_->flow_control.MaybeSendUpdate(
+        t_->outbuf.c_slice_buffer()->count > 0);
     if (transport_announce) {
       grpc_transport_one_way_stats throwaway_stats;
-      grpc_slice_buffer_add(
-          &t_->outbuf, grpc_chttp2_window_update_create(0, transport_announce,
-                                                        &throwaway_stats));
+      grpc_slice_buffer_add(t_->outbuf.c_slice_buffer(),
+                            grpc_chttp2_window_update_create(
+                                0, transport_announce, &throwaway_stats));
       grpc_chttp2_reset_ping_clock(t_);
     }
   }
 
   void FlushPingAcks() {
     for (size_t i = 0; i < t_->ping_ack_count; i++) {
-      grpc_slice_buffer_add(&t_->outbuf,
+      grpc_slice_buffer_add(t_->outbuf.c_slice_buffer(),
                             grpc_chttp2_ping_create(true, t_->ping_acks[i]));
     }
     t_->ping_ack_count = 0;
@@ -328,7 +348,7 @@ class WriteContext {
   }
 
   grpc_chttp2_stream* NextStream() {
-    if (t_->outbuf.length > target_write_size(t_)) {
+    if (t_->outbuf.c_slice_buffer()->length > target_write_size()) {
       result_.partial = true;
       return nullptr;
     }
@@ -351,12 +371,17 @@ class WriteContext {
   grpc_chttp2_transport* transport() const { return t_; }
 
   grpc_chttp2_begin_write_result Result() {
-    result_.writing = t_->outbuf.count > 0;
+    result_.writing = t_->outbuf.c_slice_buffer()->count > 0;
     return result_;
   }
 
+  size_t target_write_size() const { return target_write_size_; }
+
  private:
   grpc_chttp2_transport* const t_;
+  size_t target_write_size_ = grpc_core::IsWriteSizePolicyEnabled()
+                                  ? t_->write_size_policy.WriteTargetSize()
+                                  : 1024 * 1024;
 
   // stats histogram counters: we increment these throughout this function,
   // and at the end publish to the central stats histograms
@@ -386,11 +411,15 @@ class DataSendContext {
   }
 
   uint32_t max_outgoing() const {
-    return static_cast<uint32_t>(std::min(
-        t_->settings[GRPC_PEER_SETTINGS][GRPC_CHTTP2_SETTINGS_MAX_FRAME_SIZE],
-        static_cast<uint32_t>(
-            std::min(static_cast<int64_t>(stream_remote_window()),
-                     t_->flow_control.remote_window()))));
+    return grpc_core::Clamp<uint32_t>(
+        std::min<int64_t>(
+            {t_->settings[GRPC_PEER_SETTINGS]
+                         [GRPC_CHTTP2_SETTINGS_MAX_FRAME_SIZE],
+             stream_remote_window(), t_->flow_control.remote_window(),
+             grpc_core::IsWriteSizeCapEnabled()
+                 ? static_cast<int64_t>(write_context_->target_write_size())
+                 : std::numeric_limits<uint32_t>::max()}),
+        0, std::numeric_limits<uint32_t>::max());
   }
 
   bool AnyOutgoing() const { return max_outgoing() > 0; }
@@ -403,7 +432,8 @@ class DataSendContext {
                      s_->send_trailing_metadata != nullptr &&
                      s_->send_trailing_metadata->empty();
     grpc_chttp2_encode_data(s_->id, &s_->flow_controlled_buffer, send_bytes,
-                            is_last_frame_, &s_->stats.outgoing, &t_->outbuf);
+                            is_last_frame_, &s_->stats.outgoing,
+                            t_->outbuf.c_slice_buffer());
     sfc_upd_.SentData(send_bytes);
     s_->sending_bytes += send_bytes;
   }
@@ -468,7 +498,7 @@ class StreamWriteContext {
                   [GRPC_CHTTP2_SETTINGS_MAX_FRAME_SIZE],  // max_frame_size
               &s_->stats.outgoing                         // stats
           },
-          *s_->send_initial_metadata, &t_->outbuf);
+          *s_->send_initial_metadata, t_->outbuf.c_slice_buffer());
       grpc_chttp2_reset_ping_clock(t_);
       write_context_->IncInitialMetadataWrites();
     }
@@ -488,9 +518,9 @@ class StreamWriteContext {
     const uint32_t stream_announce = s_->flow_control.MaybeSendUpdate();
     if (stream_announce == 0) return;
 
-    grpc_slice_buffer_add(
-        &t_->outbuf, grpc_chttp2_window_update_create(s_->id, stream_announce,
-                                                      &s_->stats.outgoing));
+    grpc_slice_buffer_add(t_->outbuf.c_slice_buffer(),
+                          grpc_chttp2_window_update_create(
+                              s_->id, stream_announce, &s_->stats.outgoing));
     grpc_chttp2_reset_ping_clock(t_);
     write_context_->IncWindowUpdateWrites();
   }
@@ -543,7 +573,7 @@ class StreamWriteContext {
     GRPC_CHTTP2_IF_TRACING(gpr_log(GPR_INFO, "sending trailing_metadata"));
     if (s_->send_trailing_metadata->empty()) {
       grpc_chttp2_encode_data(s_->id, &s_->flow_controlled_buffer, 0, true,
-                              &s_->stats.outgoing, &t_->outbuf);
+                              &s_->stats.outgoing, t_->outbuf.c_slice_buffer());
     } else {
       if (send_status_.has_value()) {
         s_->send_trailing_metadata->Set(grpc_core::HttpStatusMetadata(),
@@ -563,7 +593,7 @@ class StreamWriteContext {
               t_->settings[GRPC_PEER_SETTINGS]
                           [GRPC_CHTTP2_SETTINGS_MAX_FRAME_SIZE],
               &s_->stats.outgoing},
-          *s_->send_trailing_metadata, &t_->outbuf);
+          *s_->send_trailing_metadata, t_->outbuf.c_slice_buffer());
     }
     write_context_->IncTrailingMetadataWrites();
     grpc_chttp2_reset_ping_clock(t_);
@@ -600,8 +630,9 @@ class StreamWriteContext {
 
     if (!t_->is_client && !s_->read_closed) {
       grpc_slice_buffer_add(
-          &t_->outbuf, grpc_chttp2_rst_stream_create(
-                           s_->id, GRPC_HTTP2_NO_ERROR, &s_->stats.outgoing));
+          t_->outbuf.c_slice_buffer(),
+          grpc_chttp2_rst_stream_create(s_->id, GRPC_HTTP2_NO_ERROR,
+                                        &s_->stats.outgoing));
     }
     grpc_chttp2_mark_stream_closed(t_, s_, !t_->is_client, true,
                                    absl::OkStatus());
@@ -634,15 +665,15 @@ grpc_chttp2_begin_write_result grpc_chttp2_begin_write(
   // (according to available window sizes) and add to the output buffer
   while (grpc_chttp2_stream* s = ctx.NextStream()) {
     StreamWriteContext stream_ctx(&ctx, s);
-    size_t orig_len = t->outbuf.length;
+    size_t orig_len = t->outbuf.c_slice_buffer()->length;
     int64_t num_stream_bytes = 0;
     stream_ctx.FlushInitialMetadata();
     stream_ctx.FlushWindowUpdates();
     stream_ctx.FlushData();
     stream_ctx.FlushTrailingMetadata();
-    if (t->outbuf.length > orig_len) {
+    if (t->outbuf.c_slice_buffer()->length > orig_len) {
       // Add this stream to the list of the contexts to be traced at TCP
-      num_stream_bytes = t->outbuf.length - orig_len;
+      num_stream_bytes = t->outbuf.c_slice_buffer()->length - orig_len;
       s->byte_counter += static_cast<size_t>(num_stream_bytes);
       if (s->traced && grpc_endpoint_can_track_err(t->ep)) {
         grpc_core::CopyContextFn copy_context_fn =
@@ -683,6 +714,47 @@ void grpc_chttp2_end_write(grpc_chttp2_transport* t, grpc_error_handle error) {
   }
   t->num_messages_in_next_write = 0;
 
+  if (t->ping_callbacks.started_new_ping_without_setting_timeout() &&
+      t->keepalive_timeout != grpc_core::Duration::Infinity()) {
+    // Set ping timeout after finishing write so we don't measure our own send
+    // time.
+    const auto timeout = grpc_core::IsSeparatePingFromKeepaliveEnabled()
+                             ? t->ping_timeout
+                             : t->keepalive_timeout;
+    auto id = t->ping_callbacks.OnPingTimeout(
+        timeout, t->event_engine.get(), [t = t->Ref()] {
+          grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
+          grpc_core::ExecCtx exec_ctx;
+          grpc_chttp2_ping_timeout(t);
+        });
+    if (GRPC_TRACE_FLAG_ENABLED(grpc_ping_trace) && id.has_value()) {
+      gpr_log(GPR_INFO,
+              "%s[%p]: Set ping timeout timer of %s for ping id %" PRIx64,
+              t->is_client ? "CLIENT" : "SERVER", t, timeout.ToString().c_str(),
+              id.value());
+    }
+
+    if (grpc_core::IsSeparatePingFromKeepaliveEnabled() &&
+        t->keepalive_incoming_data_wanted &&
+        t->keepalive_timeout < t->ping_timeout &&
+        t->keepalive_ping_timeout_handle !=
+            grpc_event_engine::experimental::EventEngine::TaskHandle::
+                kInvalid) {
+      if (GRPC_TRACE_FLAG_ENABLED(grpc_ping_trace) ||
+          GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {
+        gpr_log(GPR_INFO, "%s[%p]: Set keepalive ping timeout timer of %s",
+                t->is_client ? "CLIENT" : "SERVER", t,
+                t->keepalive_timeout.ToString().c_str());
+      }
+      t->keepalive_ping_timeout_handle =
+          t->event_engine->RunAfter(t->keepalive_timeout, [t = t->Ref()] {
+            grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
+            grpc_core::ExecCtx exec_ctx;
+            grpc_chttp2_keepalive_timeout(t);
+          });
+    }
+  }
+
   while (grpc_chttp2_list_pop_writing_stream(t, &s)) {
     if (s->sending_bytes != 0) {
       update_list(t, s, static_cast<int64_t>(s->sending_bytes),
@@ -692,5 +764,5 @@ void grpc_chttp2_end_write(grpc_chttp2_transport* t, grpc_error_handle error) {
     }
     GRPC_CHTTP2_STREAM_UNREF(s, "chttp2_writing:end");
   }
-  grpc_slice_buffer_reset_and_unref(&t->outbuf);
+  grpc_slice_buffer_reset_and_unref(t->outbuf.c_slice_buffer());
 }

src/core/lib/channel/promise_based_filter.cc

@@ -2047,7 +2047,8 @@ void ServerCallData::StartBatch(grpc_transport_stream_op_batch* b) {
                !batch->recv_initial_metadata && !batch->recv_message &&
                !batch->recv_trailing_metadata);
     PollContext poll_ctx(this, &flusher);
-    Completed(batch->payload->cancel_stream.cancel_error, &flusher);
+    Completed(batch->payload->cancel_stream.cancel_error,
+              batch->payload->cancel_stream.tarpit, &flusher);
     if (is_last()) {
       batch.CompleteWith(&flusher);
     } else {
@@ -2166,7 +2167,8 @@ void ServerCallData::StartBatch(grpc_transport_stream_op_batch* b) {
 }
 
 // Handle cancellation.
-void ServerCallData::Completed(grpc_error_handle error, Flusher* flusher) {
+void ServerCallData::Completed(grpc_error_handle error,
+                               bool tarpit_cancellation, Flusher* flusher) {
   if (grpc_trace_channel.enabled()) {
     gpr_log(
         GPR_DEBUG,
@@ -2196,6 +2198,7 @@ void ServerCallData::Completed(grpc_error_handle error, Flusher* flusher) {
             }));
         batch->cancel_stream = true;
         batch->payload->cancel_stream.cancel_error = error;
+        batch->payload->cancel_stream.tarpit = tarpit_cancellation;
         flusher->Resume(batch);
       }
       break;
@@ -2331,7 +2334,8 @@ void ServerCallData::RecvTrailingMetadataReady(grpc_error_handle error) {
   }
   Flusher flusher(this);
   PollContext poll_ctx(this, &flusher);
-  Completed(error, &flusher);
+  Completed(error, recv_trailing_metadata_->get(GrpcTarPit()).has_value(),
+            &flusher);
   flusher.AddClosure(original_recv_trailing_metadata_ready_, std::move(error),
                      "continue recv trailing");
 }
@@ -2551,7 +2555,8 @@ void ServerCallData::WakeInsideCombiner(Flusher* flusher) {
           break;
         case SendTrailingState::kInitial: {
           GPR_ASSERT(*md->get_pointer(GrpcStatusMetadata()) != GRPC_STATUS_OK);
-          Completed(StatusFromMetadata(*md), flusher);
+          Completed(StatusFromMetadata(*md), md->get(GrpcTarPit()).has_value(),
+                    flusher);
         } break;
         case SendTrailingState::kCancelled:
           // Nothing to do.

src/core/lib/channel/promise_based_filter.h

@@ -739,7 +739,8 @@ class ServerCallData : public BaseCallData {
   struct SendInitialMetadata;
 
   // Shut things down when the call completes.
-  void Completed(grpc_error_handle error, Flusher* flusher);
+  void Completed(grpc_error_handle error, bool tarpit_cancellation,
+                 Flusher* flusher);
   // Construct a promise that will "call" the next filter.
   // Effectively:
   //   - put the modified initial metadata into the batch being sent up.

src/core/lib/event_engine/thread_pool/thread_count.h

@@ -18,6 +18,7 @@
 
 #include <atomic>
 #include <cstddef>
+#include <cstdint>
 #include <numeric>
 #include <utility>
 #include <vector>
@@ -88,9 +89,23 @@ class BusyThreadCount {
   size_t NextIndex() { return next_idx_.fetch_add(1) % shards_.size(); }
 
  private:
+// We want to ensure that this data structure lands on different cachelines per
+// cpu. With C++17 we can do so explicitly with an `alignas` specifier. Prior
+// versions we can at best approximate it by padding the structure. It'll
+// probably work out ok, but it's not guaranteed across allocators.
+// TODO(ctiller): When we move to C++17 delete the duplicate definition.
+#if __cplusplus >= 201703L
   struct ShardedData {
     std::atomic<size_t> busy_count{0};
   } GPR_ALIGN_STRUCT(GPR_CACHELINE_SIZE);
+#else
+  struct ShardedDataHeader {
+    std::atomic<size_t> busy_count{0};
+  };
+  struct ShardedData : public ShardedDataHeader {
+    uint8_t padding[GPR_CACHELINE_SIZE - sizeof(ShardedDataHeader)];
+  };
+#endif
 
   std::vector<ShardedData> shards_;
   std::atomic<size_t> next_idx_{0};

src/core/lib/experiments/experiments.cc

@@ -88,6 +88,16 @@ const char* const description_keepalive_server_fix =
     "Allows overriding keepalive_permit_without_calls for servers. Refer "
     "https://github.com/grpc/grpc/pull/33917 for more information.";
 const char* const additional_constraints_keepalive_server_fix = "{}";
+const char* const description_overload_protection =
+    "If chttp2 has more streams than it can handle open, send RST_STREAM "
+    "immediately on new streams appearing.";
+const char* const additional_constraints_overload_protection = "{}";
+const char* const description_separate_ping_from_keepalive =
+    "Keep a different keepalive timeout (resolution is seeing data after "
+    "sending a ping) from a ping timeout (resolution is getting a ping ack "
+    "after sending a ping) The first can be short and determines liveness. The "
+    "second can be longer and determines protocol correctness.";
+const char* const additional_constraints_separate_ping_from_keepalive = "{}";
 const char* const description_work_serializer_dispatch =
     "Have the work serializer dispatch work to event engine for every "
     "callback, instead of running things inline in the first thread that "
@@ -107,6 +117,12 @@ const char* const description_round_robin_delegate_to_pick_first =
     "backend design.";
 const char* const additional_constraints_round_robin_delegate_to_pick_first =
     "{}";
+const char* const description_write_size_cap =
+    "Limit outgoing writes proportional to the target write size";
+const char* const additional_constraints_write_size_cap = "{}";
+const char* const description_write_size_policy =
+    "Try to size writes such that they don't create too large of a backlog";
+const char* const additional_constraints_write_size_policy = "{}";
 const char* const description_wrr_delegate_to_pick_first =
     "Change WRR code to delegate to pick_first as per dualstack backend "
     "design.";
@@ -115,10 +131,42 @@ const char* const description_combiner_offload_to_event_engine =
     "Offload Combiner work onto the EventEngine instead of the Executor.";
 const char* const additional_constraints_combiner_offload_to_event_engine =
     "{}";
+const char* const description_multiping =
+    "Allow more than one ping to be in flight at a time by default.";
+const char* const additional_constraints_multiping = "{}";
 const char* const description_registered_method_lookup_in_transport =
     "Change registered method's lookup point to transport";
 const char* const additional_constraints_registered_method_lookup_in_transport =
     "{}";
+const char* const description_tarpit =
+    "If set, tarpit invalid requests for some amount of time";
+const char* const additional_constraints_tarpit = "{}";
+const char* const description_settings_timeout =
+    "If set, use the settings timeout to send settings frame to the peer.";
+const char* const additional_constraints_settings_timeout = "{}";
+const char* const description_rstpit =
+    "On RST_STREAM on a server, reduce MAX_CONCURRENT_STREAMS for a short "
+    "duration";
+const char* const additional_constraints_rstpit = "{}";
+const char* const description_red_max_concurrent_streams =
+    "Perform random early rejection of requests that would exceed a newly "
+    "reduced MAX_CONCURRENT_STREAMS but are allowed by the current.";
+const char* const additional_constraints_red_max_concurrent_streams = "{}";
+const char* const description_chttp2_batch_requests =
+    "Cap the number of requests received by one transport read prior to "
+    "offload.";
+const char* const additional_constraints_chttp2_batch_requests = "{}";
+const char* const description_chttp2_offload_on_rst_stream =
+    "Offload work on RST_STREAM.";
+const char* const additional_constraints_chttp2_offload_on_rst_stream = "{}";
+const char* const description_block_excessive_requests_before_settings_ack =
+    "If set, block excessive requests before receiving SETTINGS ACK.";
+const char* const
+    additional_constraints_block_excessive_requests_before_settings_ack = "{}";
+const char* const description_ping_on_rst_stream =
+    "Send a ping on receiving some RST_STREAM frames on the server (proportion "
+    "configurable via grpc.http2.ping_on_rst_stream_percent channel arg).";
+const char* const additional_constraints_ping_on_rst_stream = "{}";
 }  // namespace
 
 namespace grpc_core {
@@ -164,6 +212,10 @@ const ExperimentMetadata g_experiment_metadata[] = {
      additional_constraints_keepalive_fix, false, false},
     {"keepalive_server_fix", description_keepalive_server_fix,
      additional_constraints_keepalive_server_fix, false, false},
+    {"overload_protection", description_overload_protection,
+     additional_constraints_overload_protection, true, true},
+    {"separate_ping_from_keepalive", description_separate_ping_from_keepalive,
+     additional_constraints_separate_ping_from_keepalive, true, true},
     {"work_serializer_dispatch", description_work_serializer_dispatch,
      additional_constraints_work_serializer_dispatch, false, true},
     {"lazier_stream_updates", description_lazier_stream_updates,
@@ -173,14 +225,36 @@ const ExperimentMetadata g_experiment_metadata[] = {
     {"round_robin_delegate_to_pick_first",
      description_round_robin_delegate_to_pick_first,
      additional_constraints_round_robin_delegate_to_pick_first, true, true},
+    {"write_size_cap", description_write_size_cap,
+     additional_constraints_write_size_cap, true, true},
+    {"write_size_policy", description_write_size_policy,
+     additional_constraints_write_size_policy, true, true},
     {"wrr_delegate_to_pick_first", description_wrr_delegate_to_pick_first,
      additional_constraints_wrr_delegate_to_pick_first, true, true},
     {"combiner_offload_to_event_engine",
      description_combiner_offload_to_event_engine,
      additional_constraints_combiner_offload_to_event_engine, true, true},
+    {"multiping", description_multiping, additional_constraints_multiping,
+     false, true},
     {"registered_method_lookup_in_transport",
      description_registered_method_lookup_in_transport,
      additional_constraints_registered_method_lookup_in_transport, true, true},
+    {"tarpit", description_tarpit, additional_constraints_tarpit, true, true},
+    {"settings_timeout", description_settings_timeout,
+     additional_constraints_settings_timeout, true, true},
+    {"rstpit", description_rstpit, additional_constraints_rstpit, false, true},
+    {"red_max_concurrent_streams", description_red_max_concurrent_streams,
+     additional_constraints_red_max_concurrent_streams, false, true},
+    {"chttp2_batch_requests", description_chttp2_batch_requests,
+     additional_constraints_chttp2_batch_requests, true, true},
+    {"chttp2_offload_on_rst_stream", description_chttp2_offload_on_rst_stream,
+     additional_constraints_chttp2_offload_on_rst_stream, true, true},
+    {"block_excessive_requests_before_settings_ack",
+     description_block_excessive_requests_before_settings_ack,
+     additional_constraints_block_excessive_requests_before_settings_ack, true,
+     true},
+    {"ping_on_rst_stream", description_ping_on_rst_stream,
+     additional_constraints_ping_on_rst_stream, true, true},
 };
 
 }  // namespace grpc_core
@@ -253,6 +327,16 @@ const char* const description_keepalive_server_fix =
     "Allows overriding keepalive_permit_without_calls for servers. Refer "
     "https://github.com/grpc/grpc/pull/33917 for more information.";
 const char* const additional_constraints_keepalive_server_fix = "{}";
+const char* const description_overload_protection =
+    "If chttp2 has more streams than it can handle open, send RST_STREAM "
+    "immediately on new streams appearing.";
+const char* const additional_constraints_overload_protection = "{}";
+const char* const description_separate_ping_from_keepalive =
+    "Keep a different keepalive timeout (resolution is seeing data after "
+    "sending a ping) from a ping timeout (resolution is getting a ping ack "
+    "after sending a ping) The first can be short and determines liveness. The "
+    "second can be longer and determines protocol correctness.";
+const char* const additional_constraints_separate_ping_from_keepalive = "{}";
 const char* const description_work_serializer_dispatch =
     "Have the work serializer dispatch work to event engine for every "
     "callback, instead of running things inline in the first thread that "
@@ -272,6 +356,12 @@ const char* const description_round_robin_delegate_to_pick_first =
     "backend design.";
 const char* const additional_constraints_round_robin_delegate_to_pick_first =
     "{}";
+const char* const description_write_size_cap =
+    "Limit outgoing writes proportional to the target write size";
+const char* const additional_constraints_write_size_cap = "{}";
+const char* const description_write_size_policy =
+    "Try to size writes such that they don't create too large of a backlog";
+const char* const additional_constraints_write_size_policy = "{}";
 const char* const description_wrr_delegate_to_pick_first =
     "Change WRR code to delegate to pick_first as per dualstack backend "
     "design.";
@@ -280,10 +370,42 @@ const char* const description_combiner_offload_to_event_engine =
     "Offload Combiner work onto the EventEngine instead of the Executor.";
 const char* const additional_constraints_combiner_offload_to_event_engine =
     "{}";
+const char* const description_multiping =
+    "Allow more than one ping to be in flight at a time by default.";
+const char* const additional_constraints_multiping = "{}";
 const char* const description_registered_method_lookup_in_transport =
     "Change registered method's lookup point to transport";
 const char* const additional_constraints_registered_method_lookup_in_transport =
     "{}";
+const char* const description_tarpit =
+    "If set, tarpit invalid requests for some amount of time";
+const char* const additional_constraints_tarpit = "{}";
+const char* const description_settings_timeout =
+    "If set, use the settings timeout to send settings frame to the peer.";
+const char* const additional_constraints_settings_timeout = "{}";
+const char* const description_rstpit =
+    "On RST_STREAM on a server, reduce MAX_CONCURRENT_STREAMS for a short "
+    "duration";
+const char* const additional_constraints_rstpit = "{}";
+const char* const description_red_max_concurrent_streams =
+    "Perform random early rejection of requests that would exceed a newly "
+    "reduced MAX_CONCURRENT_STREAMS but are allowed by the current.";
+const char* const additional_constraints_red_max_concurrent_streams = "{}";
+const char* const description_chttp2_batch_requests =
+    "Cap the number of requests received by one transport read prior to "
+    "offload.";
+const char* const additional_constraints_chttp2_batch_requests = "{}";
+const char* const description_chttp2_offload_on_rst_stream =
+    "Offload work on RST_STREAM.";
+const char* const additional_constraints_chttp2_offload_on_rst_stream = "{}";
+const char* const description_block_excessive_requests_before_settings_ack =
+    "If set, block excessive requests before receiving SETTINGS ACK.";
+const char* const
+    additional_constraints_block_excessive_requests_before_settings_ack = "{}";
+const char* const description_ping_on_rst_stream =
+    "Send a ping on receiving some RST_STREAM frames on the server (proportion "
+    "configurable via grpc.http2.ping_on_rst_stream_percent channel arg).";
+const char* const additional_constraints_ping_on_rst_stream = "{}";
 }  // namespace
 
 namespace grpc_core {
@@ -329,6 +451,10 @@ const ExperimentMetadata g_experiment_metadata[] = {
      additional_constraints_keepalive_fix, false, false},
     {"keepalive_server_fix", description_keepalive_server_fix,
      additional_constraints_keepalive_server_fix, false, false},
+    {"overload_protection", description_overload_protection,
+     additional_constraints_overload_protection, true, true},
+    {"separate_ping_from_keepalive", description_separate_ping_from_keepalive,
+     additional_constraints_separate_ping_from_keepalive, true, true},
     {"work_serializer_dispatch", description_work_serializer_dispatch,
      additional_constraints_work_serializer_dispatch, false, true},
     {"lazier_stream_updates", description_lazier_stream_updates,
@@ -338,14 +464,36 @@ const ExperimentMetadata g_experiment_metadata[] = {
     {"round_robin_delegate_to_pick_first",
      description_round_robin_delegate_to_pick_first,
      additional_constraints_round_robin_delegate_to_pick_first, true, true},
+    {"write_size_cap", description_write_size_cap,
+     additional_constraints_write_size_cap, true, true},
+    {"write_size_policy", description_write_size_policy,
+     additional_constraints_write_size_policy, true, true},
     {"wrr_delegate_to_pick_first", description_wrr_delegate_to_pick_first,
      additional_constraints_wrr_delegate_to_pick_first, true, true},
     {"combiner_offload_to_event_engine",
      description_combiner_offload_to_event_engine,
      additional_constraints_combiner_offload_to_event_engine, true, true},
+    {"multiping", description_multiping, additional_constraints_multiping,
+     false, true},
     {"registered_method_lookup_in_transport",
      description_registered_method_lookup_in_transport,
      additional_constraints_registered_method_lookup_in_transport, true, true},
+    {"tarpit", description_tarpit, additional_constraints_tarpit, true, true},
+    {"settings_timeout", description_settings_timeout,
+     additional_constraints_settings_timeout, true, true},
+    {"rstpit", description_rstpit, additional_constraints_rstpit, false, true},
+    {"red_max_concurrent_streams", description_red_max_concurrent_streams,
+     additional_constraints_red_max_concurrent_streams, false, true},
+    {"chttp2_batch_requests", description_chttp2_batch_requests,
+     additional_constraints_chttp2_batch_requests, true, true},
+    {"chttp2_offload_on_rst_stream", description_chttp2_offload_on_rst_stream,
+     additional_constraints_chttp2_offload_on_rst_stream, true, true},
+    {"block_excessive_requests_before_settings_ack",
+     description_block_excessive_requests_before_settings_ack,
+     additional_constraints_block_excessive_requests_before_settings_ack, true,
+     true},
+    {"ping_on_rst_stream", description_ping_on_rst_stream,
+     additional_constraints_ping_on_rst_stream, true, true},
 };
 
 }  // namespace grpc_core
@@ -418,6 +566,16 @@ const char* const description_keepalive_server_fix =
     "Allows overriding keepalive_permit_without_calls for servers. Refer "
     "https://github.com/grpc/grpc/pull/33917 for more information.";
 const char* const additional_constraints_keepalive_server_fix = "{}";
+const char* const description_overload_protection =
+    "If chttp2 has more streams than it can handle open, send RST_STREAM "
+    "immediately on new streams appearing.";
+const char* const additional_constraints_overload_protection = "{}";
+const char* const description_separate_ping_from_keepalive =
+    "Keep a different keepalive timeout (resolution is seeing data after "
+    "sending a ping) from a ping timeout (resolution is getting a ping ack "
+    "after sending a ping) The first can be short and determines liveness. The "
+    "second can be longer and determines protocol correctness.";
+const char* const additional_constraints_separate_ping_from_keepalive = "{}";
 const char* const description_work_serializer_dispatch =
     "Have the work serializer dispatch work to event engine for every "
     "callback, instead of running things inline in the first thread that "
@@ -437,6 +595,12 @@ const char* const description_round_robin_delegate_to_pick_first =
     "backend design.";
 const char* const additional_constraints_round_robin_delegate_to_pick_first =
     "{}";
+const char* const description_write_size_cap =
+    "Limit outgoing writes proportional to the target write size";
+const char* const additional_constraints_write_size_cap = "{}";
+const char* const description_write_size_policy =
+    "Try to size writes such that they don't create too large of a backlog";
+const char* const additional_constraints_write_size_policy = "{}";
 const char* const description_wrr_delegate_to_pick_first =
     "Change WRR code to delegate to pick_first as per dualstack backend "
     "design.";
@@ -445,10 +609,42 @@ const char* const description_combiner_offload_to_event_engine =
     "Offload Combiner work onto the EventEngine instead of the Executor.";
 const char* const additional_constraints_combiner_offload_to_event_engine =
     "{}";
+const char* const description_multiping =
+    "Allow more than one ping to be in flight at a time by default.";
+const char* const additional_constraints_multiping = "{}";
 const char* const description_registered_method_lookup_in_transport =
     "Change registered method's lookup point to transport";
 const char* const additional_constraints_registered_method_lookup_in_transport =
     "{}";
+const char* const description_tarpit =
+    "If set, tarpit invalid requests for some amount of time";
+const char* const additional_constraints_tarpit = "{}";
+const char* const description_settings_timeout =
+    "If set, use the settings timeout to send settings frame to the peer.";
+const char* const additional_constraints_settings_timeout = "{}";
+const char* const description_rstpit =
+    "On RST_STREAM on a server, reduce MAX_CONCURRENT_STREAMS for a short "
+    "duration";
+const char* const additional_constraints_rstpit = "{}";
+const char* const description_red_max_concurrent_streams =
+    "Perform random early rejection of requests that would exceed a newly "
+    "reduced MAX_CONCURRENT_STREAMS but are allowed by the current.";
+const char* const additional_constraints_red_max_concurrent_streams = "{}";
+const char* const description_chttp2_batch_requests =
+    "Cap the number of requests received by one transport read prior to "
+    "offload.";
+const char* const additional_constraints_chttp2_batch_requests = "{}";
+const char* const description_chttp2_offload_on_rst_stream =
+    "Offload work on RST_STREAM.";
+const char* const additional_constraints_chttp2_offload_on_rst_stream = "{}";
+const char* const description_block_excessive_requests_before_settings_ack =
+    "If set, block excessive requests before receiving SETTINGS ACK.";
+const char* const
+    additional_constraints_block_excessive_requests_before_settings_ack = "{}";
+const char* const description_ping_on_rst_stream =
+    "Send a ping on receiving some RST_STREAM frames on the server (proportion "
+    "configurable via grpc.http2.ping_on_rst_stream_percent channel arg).";
+const char* const additional_constraints_ping_on_rst_stream = "{}";
 }  // namespace
 
 namespace grpc_core {
@@ -494,6 +690,10 @@ const ExperimentMetadata g_experiment_metadata[] = {
      additional_constraints_keepalive_fix, false, false},
     {"keepalive_server_fix", description_keepalive_server_fix,
      additional_constraints_keepalive_server_fix, false, false},
+    {"overload_protection", description_overload_protection,
+     additional_constraints_overload_protection, true, true},
+    {"separate_ping_from_keepalive", description_separate_ping_from_keepalive,
+     additional_constraints_separate_ping_from_keepalive, true, true},
     {"work_serializer_dispatch", description_work_serializer_dispatch,
      additional_constraints_work_serializer_dispatch, false, true},
     {"lazier_stream_updates", description_lazier_stream_updates,
@@ -503,14 +703,36 @@ const ExperimentMetadata g_experiment_metadata[] = {
     {"round_robin_delegate_to_pick_first",
      description_round_robin_delegate_to_pick_first,
      additional_constraints_round_robin_delegate_to_pick_first, true, true},
+    {"write_size_cap", description_write_size_cap,
+     additional_constraints_write_size_cap, true, true},
+    {"write_size_policy", description_write_size_policy,
+     additional_constraints_write_size_policy, true, true},
     {"wrr_delegate_to_pick_first", description_wrr_delegate_to_pick_first,
      additional_constraints_wrr_delegate_to_pick_first, true, true},
     {"combiner_offload_to_event_engine",
      description_combiner_offload_to_event_engine,
      additional_constraints_combiner_offload_to_event_engine, true, true},
+    {"multiping", description_multiping, additional_constraints_multiping,
+     false, true},
     {"registered_method_lookup_in_transport",
      description_registered_method_lookup_in_transport,
      additional_constraints_registered_method_lookup_in_transport, true, true},
+    {"tarpit", description_tarpit, additional_constraints_tarpit, true, true},
+    {"settings_timeout", description_settings_timeout,
+     additional_constraints_settings_timeout, true, true},
+    {"rstpit", description_rstpit, additional_constraints_rstpit, false, true},
+    {"red_max_concurrent_streams", description_red_max_concurrent_streams,
+     additional_constraints_red_max_concurrent_streams, false, true},
+    {"chttp2_batch_requests", description_chttp2_batch_requests,
+     additional_constraints_chttp2_batch_requests, true, true},
+    {"chttp2_offload_on_rst_stream", description_chttp2_offload_on_rst_stream,
+     additional_constraints_chttp2_offload_on_rst_stream, true, true},
+    {"block_excessive_requests_before_settings_ack",
+     description_block_excessive_requests_before_settings_ack,
+     additional_constraints_block_excessive_requests_before_settings_ack, true,
+     true},
+    {"ping_on_rst_stream", description_ping_on_rst_stream,
+     additional_constraints_ping_on_rst_stream, true, true},
 };
 
 }  // namespace grpc_core

src/core/lib/experiments/experiments.h

@@ -77,6 +77,10 @@ inline bool IsCanaryClientPrivacyEnabled() { return false; }
 inline bool IsServerPrivacyEnabled() { return false; }
 inline bool IsKeepaliveFixEnabled() { return false; }
 inline bool IsKeepaliveServerFixEnabled() { return false; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_OVERLOAD_PROTECTION
+inline bool IsOverloadProtectionEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_SEPARATE_PING_FROM_KEEPALIVE
+inline bool IsSeparatePingFromKeepaliveEnabled() { return true; }
 inline bool IsWorkSerializerDispatchEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_LAZIER_STREAM_UPDATES
 inline bool IsLazierStreamUpdatesEnabled() { return true; }
@@ -84,12 +88,31 @@ inline bool IsLazierStreamUpdatesEnabled() { return true; }
 inline bool IsJitterMaxIdleEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_ROUND_ROBIN_DELEGATE_TO_PICK_FIRST
 inline bool IsRoundRobinDelegateToPickFirstEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_WRITE_SIZE_CAP
+inline bool IsWriteSizeCapEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_WRITE_SIZE_POLICY
+inline bool IsWriteSizePolicyEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_WRR_DELEGATE_TO_PICK_FIRST
 inline bool IsWrrDelegateToPickFirstEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_COMBINER_OFFLOAD_TO_EVENT_ENGINE
 inline bool IsCombinerOffloadToEventEngineEnabled() { return true; }
+inline bool IsMultipingEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_REGISTERED_METHOD_LOOKUP_IN_TRANSPORT
 inline bool IsRegisteredMethodLookupInTransportEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_TARPIT
+inline bool IsTarpitEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_SETTINGS_TIMEOUT
+inline bool IsSettingsTimeoutEnabled() { return true; }
+inline bool IsRstpitEnabled() { return false; }
+inline bool IsRedMaxConcurrentStreamsEnabled() { return false; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_CHTTP2_BATCH_REQUESTS
+inline bool IsChttp2BatchRequestsEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_CHTTP2_OFFLOAD_ON_RST_STREAM
+inline bool IsChttp2OffloadOnRstStreamEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_BLOCK_EXCESSIVE_REQUESTS_BEFORE_SETTINGS_ACK
+inline bool IsBlockExcessiveRequestsBeforeSettingsAckEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_PING_ON_RST_STREAM
+inline bool IsPingOnRstStreamEnabled() { return true; }
 
 #elif defined(GPR_WINDOWS)
 inline bool IsTcpFrameSizeTuningEnabled() { return false; }
@@ -112,6 +135,10 @@ inline bool IsCanaryClientPrivacyEnabled() { return false; }
 inline bool IsServerPrivacyEnabled() { return false; }
 inline bool IsKeepaliveFixEnabled() { return false; }
 inline bool IsKeepaliveServerFixEnabled() { return false; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_OVERLOAD_PROTECTION
+inline bool IsOverloadProtectionEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_SEPARATE_PING_FROM_KEEPALIVE
+inline bool IsSeparatePingFromKeepaliveEnabled() { return true; }
 inline bool IsWorkSerializerDispatchEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_LAZIER_STREAM_UPDATES
 inline bool IsLazierStreamUpdatesEnabled() { return true; }
@@ -119,12 +146,31 @@ inline bool IsLazierStreamUpdatesEnabled() { return true; }
 inline bool IsJitterMaxIdleEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_ROUND_ROBIN_DELEGATE_TO_PICK_FIRST
 inline bool IsRoundRobinDelegateToPickFirstEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_WRITE_SIZE_CAP
+inline bool IsWriteSizeCapEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_WRITE_SIZE_POLICY
+inline bool IsWriteSizePolicyEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_WRR_DELEGATE_TO_PICK_FIRST
 inline bool IsWrrDelegateToPickFirstEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_COMBINER_OFFLOAD_TO_EVENT_ENGINE
 inline bool IsCombinerOffloadToEventEngineEnabled() { return true; }
+inline bool IsMultipingEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_REGISTERED_METHOD_LOOKUP_IN_TRANSPORT
 inline bool IsRegisteredMethodLookupInTransportEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_TARPIT
+inline bool IsTarpitEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_SETTINGS_TIMEOUT
+inline bool IsSettingsTimeoutEnabled() { return true; }
+inline bool IsRstpitEnabled() { return false; }
+inline bool IsRedMaxConcurrentStreamsEnabled() { return false; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_CHTTP2_BATCH_REQUESTS
+inline bool IsChttp2BatchRequestsEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_CHTTP2_OFFLOAD_ON_RST_STREAM
+inline bool IsChttp2OffloadOnRstStreamEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_BLOCK_EXCESSIVE_REQUESTS_BEFORE_SETTINGS_ACK
+inline bool IsBlockExcessiveRequestsBeforeSettingsAckEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_PING_ON_RST_STREAM
+inline bool IsPingOnRstStreamEnabled() { return true; }
 
 #else
 inline bool IsTcpFrameSizeTuningEnabled() { return false; }
@@ -147,6 +193,10 @@ inline bool IsCanaryClientPrivacyEnabled() { return false; }
 inline bool IsServerPrivacyEnabled() { return false; }
 inline bool IsKeepaliveFixEnabled() { return false; }
 inline bool IsKeepaliveServerFixEnabled() { return false; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_OVERLOAD_PROTECTION
+inline bool IsOverloadProtectionEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_SEPARATE_PING_FROM_KEEPALIVE
+inline bool IsSeparatePingFromKeepaliveEnabled() { return true; }
 inline bool IsWorkSerializerDispatchEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_LAZIER_STREAM_UPDATES
 inline bool IsLazierStreamUpdatesEnabled() { return true; }
@@ -154,12 +204,31 @@ inline bool IsLazierStreamUpdatesEnabled() { return true; }
 inline bool IsJitterMaxIdleEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_ROUND_ROBIN_DELEGATE_TO_PICK_FIRST
 inline bool IsRoundRobinDelegateToPickFirstEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_WRITE_SIZE_CAP
+inline bool IsWriteSizeCapEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_WRITE_SIZE_POLICY
+inline bool IsWriteSizePolicyEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_WRR_DELEGATE_TO_PICK_FIRST
 inline bool IsWrrDelegateToPickFirstEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_COMBINER_OFFLOAD_TO_EVENT_ENGINE
 inline bool IsCombinerOffloadToEventEngineEnabled() { return true; }
+inline bool IsMultipingEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_REGISTERED_METHOD_LOOKUP_IN_TRANSPORT
 inline bool IsRegisteredMethodLookupInTransportEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_TARPIT
+inline bool IsTarpitEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_SETTINGS_TIMEOUT
+inline bool IsSettingsTimeoutEnabled() { return true; }
+inline bool IsRstpitEnabled() { return false; }
+inline bool IsRedMaxConcurrentStreamsEnabled() { return false; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_CHTTP2_BATCH_REQUESTS
+inline bool IsChttp2BatchRequestsEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_CHTTP2_OFFLOAD_ON_RST_STREAM
+inline bool IsChttp2OffloadOnRstStreamEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_BLOCK_EXCESSIVE_REQUESTS_BEFORE_SETTINGS_ACK
+inline bool IsBlockExcessiveRequestsBeforeSettingsAckEnabled() { return true; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_PING_ON_RST_STREAM
+inline bool IsPingOnRstStreamEnabled() { return true; }
 #endif
 
 #else
@@ -183,13 +252,26 @@ enum ExperimentIds {
   kExperimentIdServerPrivacy,
   kExperimentIdKeepaliveFix,
   kExperimentIdKeepaliveServerFix,
+  kExperimentIdOverloadProtection,
+  kExperimentIdSeparatePingFromKeepalive,
   kExperimentIdWorkSerializerDispatch,
   kExperimentIdLazierStreamUpdates,
   kExperimentIdJitterMaxIdle,
   kExperimentIdRoundRobinDelegateToPickFirst,
+  kExperimentIdWriteSizeCap,
+  kExperimentIdWriteSizePolicy,
   kExperimentIdWrrDelegateToPickFirst,
   kExperimentIdCombinerOffloadToEventEngine,
+  kExperimentIdMultiping,
   kExperimentIdRegisteredMethodLookupInTransport,
+  kExperimentIdTarpit,
+  kExperimentIdSettingsTimeout,
+  kExperimentIdRstpit,
+  kExperimentIdRedMaxConcurrentStreams,
+  kExperimentIdChttp2BatchRequests,
+  kExperimentIdChttp2OffloadOnRstStream,
+  kExperimentIdBlockExcessiveRequestsBeforeSettingsAck,
+  kExperimentIdPingOnRstStream,
   kNumExperiments
 };
 #define GRPC_EXPERIMENT_IS_INCLUDED_TCP_FRAME_SIZE_TUNING
@@ -268,6 +350,14 @@ inline bool IsKeepaliveFixEnabled() {
 inline bool IsKeepaliveServerFixEnabled() {
   return IsExperimentEnabled(kExperimentIdKeepaliveServerFix);
 }
+#define GRPC_EXPERIMENT_IS_INCLUDED_OVERLOAD_PROTECTION
+inline bool IsOverloadProtectionEnabled() {
+  return IsExperimentEnabled(kExperimentIdOverloadProtection);
+}
+#define GRPC_EXPERIMENT_IS_INCLUDED_SEPARATE_PING_FROM_KEEPALIVE
+inline bool IsSeparatePingFromKeepaliveEnabled() {
+  return IsExperimentEnabled(kExperimentIdSeparatePingFromKeepalive);
+}
 #define GRPC_EXPERIMENT_IS_INCLUDED_WORK_SERIALIZER_DISPATCH
 inline bool IsWorkSerializerDispatchEnabled() {
   return IsExperimentEnabled(kExperimentIdWorkSerializerDispatch);
@@ -284,6 +374,14 @@ inline bool IsJitterMaxIdleEnabled() {
 inline bool IsRoundRobinDelegateToPickFirstEnabled() {
   return IsExperimentEnabled(kExperimentIdRoundRobinDelegateToPickFirst);
 }
+#define GRPC_EXPERIMENT_IS_INCLUDED_WRITE_SIZE_CAP
+inline bool IsWriteSizeCapEnabled() {
+  return IsExperimentEnabled(kExperimentIdWriteSizeCap);
+}
+#define GRPC_EXPERIMENT_IS_INCLUDED_WRITE_SIZE_POLICY
+inline bool IsWriteSizePolicyEnabled() {
+  return IsExperimentEnabled(kExperimentIdWriteSizePolicy);
+}
 #define GRPC_EXPERIMENT_IS_INCLUDED_WRR_DELEGATE_TO_PICK_FIRST
 inline bool IsWrrDelegateToPickFirstEnabled() {
   return IsExperimentEnabled(kExperimentIdWrrDelegateToPickFirst);
@@ -292,10 +390,47 @@ inline bool IsWrrDelegateToPickFirstEnabled() {
 inline bool IsCombinerOffloadToEventEngineEnabled() {
   return IsExperimentEnabled(kExperimentIdCombinerOffloadToEventEngine);
 }
+#define GRPC_EXPERIMENT_IS_INCLUDED_MULTIPING
+inline bool IsMultipingEnabled() {
+  return IsExperimentEnabled(kExperimentIdMultiping);
+}
 #define GRPC_EXPERIMENT_IS_INCLUDED_REGISTERED_METHOD_LOOKUP_IN_TRANSPORT
 inline bool IsRegisteredMethodLookupInTransportEnabled() {
   return IsExperimentEnabled(kExperimentIdRegisteredMethodLookupInTransport);
 }
+#define GRPC_EXPERIMENT_IS_INCLUDED_TARPIT
+inline bool IsTarpitEnabled() {
+  return IsExperimentEnabled(kExperimentIdTarpit);
+}
+#define GRPC_EXPERIMENT_IS_INCLUDED_SETTINGS_TIMEOUT
+inline bool IsSettingsTimeoutEnabled() {
+  return IsExperimentEnabled(kExperimentIdSettingsTimeout);
+}
+#define GRPC_EXPERIMENT_IS_INCLUDED_RSTPIT
+inline bool IsRstpitEnabled() {
+  return IsExperimentEnabled(kExperimentIdRstpit);
+}
+#define GRPC_EXPERIMENT_IS_INCLUDED_RED_MAX_CONCURRENT_STREAMS
+inline bool IsRedMaxConcurrentStreamsEnabled() {
+  return IsExperimentEnabled(kExperimentIdRedMaxConcurrentStreams);
+}
+#define GRPC_EXPERIMENT_IS_INCLUDED_CHTTP2_BATCH_REQUESTS
+inline bool IsChttp2BatchRequestsEnabled() {
+  return IsExperimentEnabled(kExperimentIdChttp2BatchRequests);
+}
+#define GRPC_EXPERIMENT_IS_INCLUDED_CHTTP2_OFFLOAD_ON_RST_STREAM
+inline bool IsChttp2OffloadOnRstStreamEnabled() {
+  return IsExperimentEnabled(kExperimentIdChttp2OffloadOnRstStream);
+}
+#define GRPC_EXPERIMENT_IS_INCLUDED_BLOCK_EXCESSIVE_REQUESTS_BEFORE_SETTINGS_ACK
+inline bool IsBlockExcessiveRequestsBeforeSettingsAckEnabled() {
+  return IsExperimentEnabled(
+      kExperimentIdBlockExcessiveRequestsBeforeSettingsAck);
+}
+#define GRPC_EXPERIMENT_IS_INCLUDED_PING_ON_RST_STREAM
+inline bool IsPingOnRstStreamEnabled() {
+  return IsExperimentEnabled(kExperimentIdPingOnRstStream);
+}
 
 extern const ExperimentMetadata g_experiment_metadata[kNumExperiments];
 

src/core/lib/experiments/experiments.yaml

@@ -153,6 +153,22 @@
   owner: yashkt@google.com
   test_tags: []
   allow_in_fuzzing_config: false
+- name: overload_protection
+  description:
+    If chttp2 has more streams than it can handle open, send RST_STREAM immediately
+    on new streams appearing.
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+  test_tags: [flow_control_test]
+- name: separate_ping_from_keepalive
+  description:
+    Keep a different keepalive timeout (resolution is seeing data after sending a ping)
+    from a ping timeout (resolution is getting a ping ack after sending a ping)
+    The first can be short and determines liveness.
+    The second can be longer and determines protocol correctness.
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+  test_tags: []
 - name: work_serializer_dispatch
   description:
     Have the work serializer dispatch work to event engine for every callback,
@@ -184,6 +200,18 @@
   expiry: 2023/11/15
   owner: roth@google.com
   test_tags: ["lb_unit_test", "cpp_lb_end2end_test", "xds_end2end_test"]
+- name: write_size_cap
+  description:
+    Limit outgoing writes proportional to the target write size
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+  test_tags: [flow_control_test]
+- name: write_size_policy
+  description:
+    Try to size writes such that they don't create too large of a backlog
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+  test_tags: [flow_control_test]
 - name: wrr_delegate_to_pick_first
   description:
     Change WRR code to delegate to pick_first as per dualstack
@@ -197,9 +225,64 @@
   expiry: 2024/01/15
   owner: hork@google.com
   test_tags: []
+- name: multiping
+  description:
+    Allow more than one ping to be in flight at a time by default.
+  expiry: 2024/01/15
+  owner: ctiller@google.com
+  test_tags: [flow_control_test]
 - name: registered_method_lookup_in_transport
   description:
     Change registered method's lookup point to transport
   expiry: 2024/03/31
   owner: yashkt@google.com
   test_tags: ["surface_registered_method_lookup"]
+- name: tarpit
+  description:
+    If set, tarpit invalid requests for some amount of time
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+  test_tags: [bad_client_test]
+- name: settings_timeout
+  description:
+    If set, use the settings timeout to send settings frame to the peer.
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+  test_tags: []
+- name: rstpit
+  description:
+    On RST_STREAM on a server, reduce MAX_CONCURRENT_STREAMS for a short duration
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+  test_tags: [flow_control_test]
+- name: red_max_concurrent_streams
+  description:
+    Perform random early rejection of requests that would exceed a newly reduced
+    MAX_CONCURRENT_STREAMS but are allowed by the current.
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+  test_tags: [flow_control_test]
+- name: chttp2_batch_requests
+  description:
+    Cap the number of requests received by one transport read prior to offload.
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+- name: chttp2_offload_on_rst_stream
+  description:
+    Offload work on RST_STREAM.
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+  test_tags: ["cpp_end2end_test", "flow_control_test"]
+- name: block_excessive_requests_before_settings_ack
+  description:
+    If set, block excessive requests before receiving SETTINGS ACK.
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+  test_tags: [bad_client_test]
+- name: ping_on_rst_stream
+  description:
+    Send a ping on receiving some RST_STREAM frames on the server
+    (proportion configurable via grpc.http2.ping_on_rst_stream_percent channel arg).
+  expiry: 2024/03/03
+  owner: ctiller@google.com
+  test_tags: []

src/core/lib/experiments/rollouts.yaml

@@ -92,11 +92,35 @@
   default: true
 - name: jitter_max_idle
   default: true
+- name: overload_protection
+  default: true
 - name: round_robin_delegate_to_pick_first
   default: true
+- name: separate_ping_from_keepalive
+  default: true
+- name: write_size_cap
+  default: true
+- name: write_size_policy
+  default: true
 - name: wrr_delegate_to_pick_first
   default: true
 - name: combiner_offload_to_event_engine
   default: true
 - name: registered_method_lookup_in_transport
   default: true
+- name: rstpit
+  default: false
+- name: red_max_concurrent_streams
+  default: false
+- name: tarpit
+  default: true
+- name: settings_timeout
+  default: true
+- name: chttp2_batch_requests
+  default: true
+- name: chttp2_offload_on_rst_stream
+  default: true
+- name: block_excessive_requests_before_settings_ack
+  default: true
+- name: ping_on_rst_stream
+  default: true

src/core/lib/gprpp/directory_reader.h

@@ -0,0 +1,48 @@
+//
+//
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_SRC_CORE_LIB_GPRPP_DIRECTORY_READER_H
+#define GRPC_SRC_CORE_LIB_GPRPP_DIRECTORY_READER_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+
+#include "absl/functional/function_ref.h"
+#include "absl/status/status.h"
+#include "absl/strings/string_view.h"
+
+namespace grpc_core {
+
+class DirectoryReader {
+ public:
+  virtual ~DirectoryReader() = default;
+  // Returns the name of the directory being read.
+  virtual absl::string_view Name() const = 0;
+  // Calls callback for each name in the directory except for "." and "..".
+  // Returns non-OK if there was an error reading the directory.
+  virtual absl::Status ForEach(
+      absl::FunctionRef<void(absl::string_view)> callback) = 0;
+};
+
+std::unique_ptr<DirectoryReader> MakeDirectoryReader(
+    absl::string_view filename);
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_LIB_GPRPP_DIRECTORY_READER_H

src/core/lib/gprpp/posix/directory_reader.cc

@@ -0,0 +1,82 @@
+//
+//
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+
+#include "absl/functional/function_ref.h"
+#include "absl/status/status.h"
+#include "absl/strings/string_view.h"
+
+#if defined(GPR_LINUX) || defined(GPR_ANDROID) || defined(GPR_FREEBSD) || \
+    defined(GPR_APPLE)
+
+#include <dirent.h>
+
+#include <string>
+
+#include "src/core/lib/gprpp/directory_reader.h"
+
+namespace grpc_core {
+
+namespace {
+const char kSkipEntriesSelf[] = ".";
+const char kSkipEntriesParent[] = "..";
+}  // namespace
+
+class DirectoryReaderImpl : public DirectoryReader {
+ public:
+  explicit DirectoryReaderImpl(absl::string_view directory_path)
+      : directory_path_(directory_path) {}
+  absl::string_view Name() const override { return directory_path_; }
+  absl::Status ForEach(absl::FunctionRef<void(absl::string_view)>) override;
+
+ private:
+  const std::string directory_path_;
+};
+
+std::unique_ptr<DirectoryReader> MakeDirectoryReader(
+    absl::string_view filename) {
+  return std::make_unique<DirectoryReaderImpl>(filename);
+}
+
+absl::Status DirectoryReaderImpl::ForEach(
+    absl::FunctionRef<void(absl::string_view)> callback) {
+  // Open the dir for reading
+  DIR* directory = opendir(directory_path_.c_str());
+  if (directory == nullptr) {
+    return absl::InternalError("Could not read crl directory.");
+  }
+  struct dirent* directory_entry;
+  // Iterate over everything in the directory
+  while ((directory_entry = readdir(directory)) != nullptr) {
+    const absl::string_view file_name = directory_entry->d_name;
+    // Skip "." and ".."
+    if (file_name == kSkipEntriesParent || file_name == kSkipEntriesSelf) {
+      continue;
+    }
+    // Call the callback with this filename
+    callback(file_name);
+  }
+  closedir(directory);
+  return absl::OkStatus();
+}
+}  // namespace grpc_core
+
+#endif  // GPR_LINUX || GPR_ANDROID || GPR_FREEBSD || GPR_APPLE

src/core/lib/gprpp/windows/directory_reader.cc

@@ -0,0 +1,80 @@
+//
+//
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#if defined(GPR_WINDOWS)
+
+#include <sys/stat.h>
+#include <windows.h>
+
+#include <string>
+#include <vector>
+
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
+#include <grpc/support/log.h>
+
+#include "src/core/lib/gprpp/directory_reader.h"
+namespace grpc_core {
+
+namespace {
+const char kSkipEntriesSelf[] = ".";
+const char kSkipEntriesParent[] = "..";
+}  // namespace
+
+class DirectoryReaderImpl : public DirectoryReader {
+ public:
+  explicit DirectoryReaderImpl(absl::string_view directory_path)
+      : directory_path_(directory_path) {}
+  absl::string_view Name() const override { return directory_path_; }
+  absl::Status ForEach(absl::FunctionRef<void(absl::string_view)>) override;
+
+ private:
+  const std::string directory_path_;
+};
+
+std::unique_ptr<DirectoryReader> MakeDirectoryReader(
+    absl::string_view filename) {
+  return std::make_unique<DirectoryReaderImpl>(filename);
+}
+
+// Reference for reading directory in Windows:
+// https://stackoverflow.com/questions/612097/how-can-i-get-the-list-of-files-in-a-directory-using-c-or-c
+// https://learn.microsoft.com/en-us/windows/win32/fileio/listing-the-files-in-a-directory
+absl::Status DirectoryReaderImpl::ForEach(
+    absl::FunctionRef<void(absl::string_view)> callback) {
+  std::string search_path = absl::StrCat(directory_path_, "/*");
+  WIN32_FIND_DATAA find_data;
+  HANDLE hFind = ::FindFirstFileA(search_path.c_str(), &find_data);
+  if (hFind == INVALID_HANDLE_VALUE) {
+    return absl::InternalError("Could not read crl directory.");
+  }
+  do {
+    if (!(find_data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)) {
+      callback(find_data.cFileName);
+    }
+  } while (::FindNextFileA(hFind, &find_data));
+  ::FindClose(hFind);
+  return absl::OkStatus();
+}
+
+}  // namespace grpc_core
+
+#endif  // GPR_WINDOWS

src/core/lib/iomgr/combiner.cc

@@ -180,6 +180,9 @@ static void offload(void* arg, grpc_error_handle /*error*/) {
 
 static void queue_offload(grpc_core::Combiner* lock) {
   move_next();
+  // Make the combiner look uncontended by storing a non-null value here, so
+  // that we don't immediately offload again.
+  gpr_atm_no_barrier_store(&lock->initiating_exec_ctx_or_null, 1);
   GRPC_COMBINER_TRACE(gpr_log(GPR_INFO, "C:%p queue_offload", lock));
   if (grpc_core::IsCombinerOffloadToEventEngineEnabled()) {
     lock->event_engine->Run([lock] {

src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc

@@ -20,6 +20,9 @@
 
 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 
+#include <memory>
+
+#include <grpc/grpc_crl_provider.h>
 #include <grpc/support/log.h>
 
 #include "src/core/lib/debug/trace.h"
@@ -128,3 +131,22 @@ void grpc_tls_credentials_options_set_send_client_ca_list(
   }
   options->set_send_client_ca_list(send_client_ca_list);
 }
+
+void grpc_tls_credentials_options_set_crl_provider(
+    grpc_tls_credentials_options* options,
+    std::shared_ptr<grpc_core::experimental::CrlProvider> provider) {
+  GPR_ASSERT(options != nullptr);
+  options->set_crl_provider(std::move(provider));
+}
+
+void grpc_tls_credentials_options_set_min_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version min_tls_version) {
+  GPR_ASSERT(options != nullptr);
+  options->set_min_tls_version(min_tls_version);
+}
+
+void grpc_tls_credentials_options_set_max_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version max_tls_version) {
+  GPR_ASSERT(options != nullptr);
+  options->set_max_tls_version(max_tls_version);
+}

src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -61,6 +61,8 @@ struct grpc_tls_credentials_options
   const std::string& identity_cert_name() const { return identity_cert_name_; }
   const std::string& tls_session_key_log_file_path() const { return tls_session_key_log_file_path_; }
   const std::string& crl_directory() const { return crl_directory_; }
+  // Returns the CRL Provider
+  std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider() const { return crl_provider_; }
   bool send_client_ca_list() const { return send_client_ca_list_; }
 
   // Setters for member fields.
@@ -82,6 +84,7 @@ struct grpc_tls_credentials_options
   void set_tls_session_key_log_file_path(std::string tls_session_key_log_file_path) { tls_session_key_log_file_path_ = std::move(tls_session_key_log_file_path); }
   //  gRPC will enforce CRLs on all handshakes from all hashed CRL files inside of the crl_directory. If not set, an empty string will be used, which will not enable CRL checking. Only supported for OpenSSL version > 1.1.
   void set_crl_directory(std::string crl_directory) { crl_directory_ = std::move(crl_directory); }
+  void set_crl_provider(std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider) { crl_provider_ = std::move(crl_provider); }
   void set_send_client_ca_list(bool send_client_ca_list) { send_client_ca_list_ = send_client_ca_list; }
 
   bool operator==(const grpc_tls_credentials_options& other) const {
@@ -98,6 +101,7 @@ struct grpc_tls_credentials_options
       identity_cert_name_ == other.identity_cert_name_ &&
       tls_session_key_log_file_path_ == other.tls_session_key_log_file_path_ &&
       crl_directory_ == other.crl_directory_ &&
+      (crl_provider_ == other.crl_provider_) &&
       send_client_ca_list_ == other.send_client_ca_list_;
   }
 
@@ -115,6 +119,7 @@ struct grpc_tls_credentials_options
   std::string identity_cert_name_;
   std::string tls_session_key_log_file_path_;
   std::string crl_directory_;
+  std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider_;
   bool send_client_ca_list_ = false;
 };
 

src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc

@@ -0,0 +1,238 @@
+//
+//
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h"
+
+#include <limits.h>
+// IWYU pragma: no_include <openssl/mem.h>
+#include <openssl/bio.h>
+#include <openssl/crypto.h>  // IWYU pragma: keep
+#include <openssl/pem.h>
+#include <openssl/x509.h>
+
+#include <grpc/support/log.h>
+// IWYU pragma: no_include <ratio>
+#include <algorithm>
+#include <memory>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+#include "absl/container/flat_hash_map.h"
+#include "absl/meta/type_traits.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_join.h"
+#include "absl/types/span.h"
+
+#include "src/core/lib/event_engine/default_event_engine.h"
+#include "src/core/lib/gprpp/directory_reader.h"
+#include "src/core/lib/gprpp/load_file.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
+#include "src/core/lib/slice/slice.h"
+
+namespace grpc_core {
+namespace experimental {
+
+namespace {
+std::string IssuerFromCrl(X509_CRL* crl) {
+  if (crl == nullptr) {
+    return "";
+  }
+  char* buf = X509_NAME_oneline(X509_CRL_get_issuer(crl), nullptr, 0);
+  std::string ret;
+  if (buf != nullptr) {
+    ret = buf;
+  }
+  OPENSSL_free(buf);
+  return ret;
+}
+
+absl::StatusOr<std::shared_ptr<Crl>> ReadCrlFromFile(
+    const std::string& crl_path) {
+  absl::StatusOr<Slice> crl_slice = LoadFile(crl_path, false);
+  if (!crl_slice.ok()) {
+    return crl_slice.status();
+  }
+  absl::StatusOr<std::unique_ptr<Crl>> crl =
+      Crl::Parse(crl_slice->as_string_view());
+  if (!crl.ok()) {
+    return crl.status();
+  }
+  return crl;
+}
+
+}  // namespace
+
+absl::StatusOr<std::unique_ptr<Crl>> Crl::Parse(absl::string_view crl_string) {
+  if (crl_string.size() >= INT_MAX) {
+    return absl::InvalidArgumentError("crl_string cannot be of size INT_MAX");
+  }
+  BIO* crl_bio =
+      BIO_new_mem_buf(crl_string.data(), static_cast<int>(crl_string.size()));
+  // Errors on BIO
+  if (crl_bio == nullptr) {
+    return absl::InvalidArgumentError(
+        "Conversion from crl string to BIO failed.");
+  }
+  X509_CRL* crl = PEM_read_bio_X509_CRL(crl_bio, nullptr, nullptr, nullptr);
+  BIO_free(crl_bio);
+  if (crl == nullptr) {
+    return absl::InvalidArgumentError(
+        "Conversion from PEM string to X509 CRL failed.");
+  }
+  return CrlImpl::Create(crl);
+}
+
+absl::StatusOr<std::unique_ptr<CrlImpl>> CrlImpl::Create(X509_CRL* crl) {
+  std::string issuer = IssuerFromCrl(crl);
+  if (issuer.empty()) {
+    return absl::InvalidArgumentError("Issuer of crl cannot be empty");
+  }
+  return std::make_unique<CrlImpl>(crl, issuer);
+}
+
+CrlImpl::~CrlImpl() { X509_CRL_free(crl_); }
+
+absl::StatusOr<std::shared_ptr<CrlProvider>> CreateStaticCrlProvider(
+    absl::Span<const std::string> crls) {
+  absl::flat_hash_map<std::string, std::shared_ptr<Crl>> crl_map;
+  for (const auto& raw_crl : crls) {
+    absl::StatusOr<std::unique_ptr<Crl>> crl = Crl::Parse(raw_crl);
+    if (!crl.ok()) {
+      return absl::InvalidArgumentError(absl::StrCat(
+          "Parsing crl string failed with result ", crl.status().ToString()));
+    }
+    bool inserted = crl_map.emplace((*crl)->Issuer(), std::move(*crl)).second;
+    if (!inserted) {
+      gpr_log(GPR_ERROR,
+              "StaticCrlProvider received multiple CRLs with the same issuer. "
+              "The first one in the span will be used.");
+    }
+  }
+  StaticCrlProvider provider = StaticCrlProvider(std::move(crl_map));
+  return std::make_shared<StaticCrlProvider>(std::move(provider));
+}
+
+std::shared_ptr<Crl> StaticCrlProvider::GetCrl(
+    const CertificateInfo& certificate_info) {
+  auto it = crls_.find(certificate_info.Issuer());
+  if (it == crls_.end()) {
+    return nullptr;
+  }
+  return it->second;
+}
+
+absl::StatusOr<std::shared_ptr<CrlProvider>> CreateDirectoryReloaderCrlProvider(
+    absl::string_view directory, std::chrono::seconds refresh_duration,
+    std::function<void(absl::Status)> reload_error_callback) {
+  if (refresh_duration < std::chrono::seconds(60)) {
+    return absl::InvalidArgumentError("Refresh duration minimum is 60 seconds");
+  }
+  auto provider = std::make_shared<DirectoryReloaderCrlProvider>(
+      refresh_duration, reload_error_callback,
+      grpc_event_engine::experimental::GetDefaultEventEngine(),
+      MakeDirectoryReader(directory));
+  // This could be slow to do at startup, but we want to
+  // make sure it's done before the provider is used.
+  provider->UpdateAndStartTimer();
+  return provider;
+}
+
+DirectoryReloaderCrlProvider::~DirectoryReloaderCrlProvider() {
+  if (refresh_handle_.has_value()) {
+    event_engine_->Cancel(refresh_handle_.value());
+  }
+}
+
+void DirectoryReloaderCrlProvider::UpdateAndStartTimer() {
+  absl::Status status = Update();
+  if (!status.ok() && reload_error_callback_ != nullptr) {
+    reload_error_callback_(status);
+  }
+  std::weak_ptr<DirectoryReloaderCrlProvider> self = shared_from_this();
+  refresh_handle_ =
+      event_engine_->RunAfter(refresh_duration_, [self = std::move(self)]() {
+        ApplicationCallbackExecCtx callback_exec_ctx;
+        ExecCtx exec_ctx;
+        if (std::shared_ptr<DirectoryReloaderCrlProvider> valid_ptr =
+                self.lock()) {
+          valid_ptr->UpdateAndStartTimer();
+        }
+      });
+}
+
+absl::Status DirectoryReloaderCrlProvider::Update() {
+  absl::flat_hash_map<std::string, std::shared_ptr<Crl>> new_crls;
+  std::vector<std::string> files_with_errors;
+  absl::Status status = crl_directory_->ForEach([&](absl::string_view file) {
+    std::string file_path = absl::StrCat(crl_directory_->Name(), "/", file);
+    // Build a map of new_crls to update to. If all files successful, do a
+    // full swap of the map. Otherwise update in place.
+    absl::StatusOr<std::shared_ptr<Crl>> crl = ReadCrlFromFile(file_path);
+    if (!crl.ok()) {
+      files_with_errors.push_back(
+          absl::StrCat(file_path, ": ", crl.status().ToString()));
+      return;
+    }
+    // Now we have a good CRL to update in our map.
+    // It's not safe to say crl->Issuer() on the LHS and std::move(crl) on the
+    // RHS, because C++ does not guarantee which of those will be executed
+    // first.
+    std::string issuer((*crl)->Issuer());
+    new_crls[std::move(issuer)] = std::move(*crl);
+  });
+  if (!status.ok()) {
+    return status;
+  }
+  MutexLock lock(&mu_);
+  if (!files_with_errors.empty()) {
+    // Need to make sure CRLs we read successfully into new_crls are still
+    // in-place updated in crls_.
+    for (auto& kv : new_crls) {
+      std::shared_ptr<Crl>& crl = kv.second;
+      // It's not safe to say crl->Issuer() on the LHS and std::move(crl) on the
+      // RHS, because C++ does not guarantee which of those will be executed
+      // first.
+      std::string issuer(crl->Issuer());
+      crls_[std::move(issuer)] = std::move(crl);
+    }
+    return absl::UnknownError(absl::StrCat(
+        "Errors reading the following files in the CRL directory: [",
+        absl::StrJoin(files_with_errors, "; "), "]"));
+  } else {
+    crls_ = std::move(new_crls);
+  }
+  return absl::OkStatus();
+}
+
+std::shared_ptr<Crl> DirectoryReloaderCrlProvider::GetCrl(
+    const CertificateInfo& certificate_info) {
+  MutexLock lock(&mu_);
+  auto it = crls_.find(certificate_info.Issuer());
+  if (it == crls_.end()) {
+    return nullptr;
+  }
+  return it->second;
+}
+
+}  // namespace experimental
+}  // namespace grpc_core

src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h

@@ -0,0 +1,132 @@
+//
+//
+// Copyright 2023 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CRL_PROVIDER_H
+#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CRL_PROVIDER_H
+
+#include <grpc/support/port_platform.h>
+
+#include <chrono>
+#include <functional>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include <openssl/crypto.h>
+
+#include "absl/base/thread_annotations.h"
+#include "absl/container/flat_hash_map.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
+
+#include <grpc/event_engine/event_engine.h>
+#include <grpc/grpc_crl_provider.h>
+
+#include "src/core/lib/gprpp/directory_reader.h"
+#include "src/core/lib/gprpp/sync.h"
+#include "src/core/lib/gprpp/time.h"
+
+namespace grpc_core {
+namespace experimental {
+
+class StaticCrlProvider : public CrlProvider {
+ public:
+  // Each element of the input vector is expected to be the raw contents of a
+  // CRL file.
+  explicit StaticCrlProvider(
+      absl::flat_hash_map<std::string, std::shared_ptr<Crl>> crls)
+      : crls_(std::move(crls)) {}
+  std::shared_ptr<Crl> GetCrl(const CertificateInfo& certificate_info) override;
+
+ private:
+  const absl::flat_hash_map<std::string, std::shared_ptr<Crl>> crls_;
+};
+
+class CrlImpl : public Crl {
+ public:
+  static absl::StatusOr<std::unique_ptr<CrlImpl>> Create(X509_CRL* crl);
+  // Takes ownership of the X509_CRL pointer.
+  CrlImpl(X509_CRL* crl, absl::string_view issuer)
+      : crl_(crl), issuer_(issuer) {}
+  ~CrlImpl() override;
+  // Returns a string view representation of the issuer pulled from the CRL.
+  absl::string_view Issuer() override { return issuer_; }
+  // The caller should not take ownership of the returned pointer.
+  X509_CRL* crl() const { return crl_; }
+
+ private:
+  X509_CRL* crl_;
+  const std::string issuer_;
+};
+
+class CertificateInfoImpl : public CertificateInfo {
+ public:
+  explicit CertificateInfoImpl(absl::string_view issuer) : issuer_(issuer) {}
+  // Returns a string representation of the issuer pulled from the
+  // certificate.
+  absl::string_view Issuer() const override { return issuer_; }
+
+ private:
+  const std::string issuer_;
+};
+
+// Defining this here lets us hide implementation details (and includes) from
+// the header in include
+class DirectoryReloaderCrlProvider
+    : public CrlProvider,
+      public std::enable_shared_from_this<DirectoryReloaderCrlProvider> {
+ public:
+  DirectoryReloaderCrlProvider(
+      std::chrono::seconds duration, std::function<void(absl::Status)> callback,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine,
+      std::shared_ptr<DirectoryReader> directory_impl)
+      : refresh_duration_(Duration::FromSecondsAsDouble(duration.count())),
+        reload_error_callback_(std::move(callback)),
+        event_engine_(std::move(event_engine)),
+        crl_directory_(std::move(directory_impl)) {}
+
+  ~DirectoryReloaderCrlProvider() override;
+  std::shared_ptr<Crl> GetCrl(const CertificateInfo& certificate_info) override;
+  // Reads the configured directory and updates the internal crls_ map, called
+  // asynchronously by event engine then schedules the timer for the next
+  // update.
+  void UpdateAndStartTimer();
+
+ private:
+  // Reads the configured directory and updates the internal crls_ map, called
+  // asynchronously by event engine.
+  absl::Status Update();
+  Duration refresh_duration_;
+  std::function<void(::absl::Status)> reload_error_callback_;
+  std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine_;
+  std::shared_ptr<DirectoryReader> crl_directory_;
+  // guards the crls_ map
+  Mutex mu_;
+  absl::flat_hash_map<::std::string, ::std::shared_ptr<Crl>> crls_
+      ABSL_GUARDED_BY(mu_);
+  absl::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
+      refresh_handle_;
+};
+
+}  // namespace experimental
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_GRPC_TLS_CRL_PROVIDER_H

src/core/lib/security/credentials/tls/tls_credentials.cc

@@ -20,6 +20,7 @@
 
 #include "src/core/lib/security/credentials/tls/tls_credentials.h"
 
+#include <memory>
 #include <string>
 #include <utility>
 
@@ -46,6 +47,28 @@ bool CredentialOptionSanityCheck(grpc_tls_credentials_options* options,
     gpr_log(GPR_ERROR, "TLS credentials options is nullptr.");
     return false;
   }
+  // In this case, there will be non-retriable handshake errors.
+  if (options->min_tls_version() == grpc_tls_version::TLS1_3 &&
+      options->max_tls_version() == grpc_tls_version::TLS1_2) {
+    gpr_log(GPR_ERROR, "TLS min version must not be higher than max version.");
+    return false;
+  }
+  if (options->max_tls_version() > grpc_tls_version::TLS1_3) {
+    gpr_log(GPR_ERROR, "TLS max version must not be higher than v1.3.");
+    return false;
+  }
+  if (options->min_tls_version() < grpc_tls_version::TLS1_2) {
+    gpr_log(GPR_ERROR, "TLS min version must not be lower than v1.2.");
+    return false;
+  }
+  if (!options->crl_directory().empty() && options->crl_provider() != nullptr) {
+    gpr_log(GPR_ERROR,
+            "Setting crl_directory and crl_provider not supported. Using the "
+            "crl_provider.");
+    // TODO(gtcooke94) - Maybe return false here. Right now object lifetime of
+    // this options struct is leaky if false is returned and represents a more
+    // complex fix to handle in another PR.
+  }
   // In the following conditions, there won't be any issues, but it might
   // indicate callers are doing something wrong with the API.
   if (is_client && options->cert_request_type() !=

src/core/lib/security/security_connector/ssl_utils.cc

@@ -23,6 +23,8 @@
 #include <stdint.h>
 #include <string.h>
 
+#include <memory>
+#include <utility>
 #include <vector>
 
 #include "absl/strings/match.h"
@@ -30,6 +32,7 @@
 #include "absl/strings/str_split.h"
 
 #include <grpc/grpc.h>
+#include <grpc/grpc_crl_provider.h>
 #include <grpc/impl/channel_arg_names.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -410,6 +413,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
     tsi_tls_version max_tls_version, tsi_ssl_session_cache* ssl_session_cache,
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory,
+    std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider,
     tsi_ssl_client_handshaker_factory** handshaker_factory) {
   const char* root_certs;
   const tsi_ssl_root_certs_store* root_store;
@@ -448,6 +452,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
   options.min_tls_version = min_tls_version;
   options.max_tls_version = max_tls_version;
   options.crl_directory = crl_directory;
+  options.crl_provider = std::move(crl_provider);
   const tsi_result result =
       tsi_create_ssl_client_handshaker_factory_with_options(&options,
                                                             handshaker_factory);
@@ -467,6 +472,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
     tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory, bool send_client_ca_list,
+    std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider,
     tsi_ssl_server_handshaker_factory** handshaker_factory) {
   size_t num_alpn_protocols = 0;
   const char** alpn_protocol_strings =
@@ -484,6 +490,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
   options.max_tls_version = max_tls_version;
   options.key_logger = tls_session_key_logger;
   options.crl_directory = crl_directory;
+  options.crl_provider = std::move(crl_provider);
   options.send_client_ca_list = send_client_ca_list;
   const tsi_result result =
       tsi_create_ssl_server_handshaker_factory_with_options(&options,

src/core/lib/security/security_connector/ssl_utils.h

@@ -23,6 +23,7 @@
 
 #include <stddef.h>
 
+#include <memory>
 #include <string>
 #include <utility>
 #include <vector>
@@ -30,6 +31,7 @@
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/grpc_crl_provider.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
 #include <grpc/slice.h>
@@ -85,6 +87,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
     tsi_tls_version max_tls_version, tsi_ssl_session_cache* ssl_session_cache,
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory,
+    std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider,
     tsi_ssl_client_handshaker_factory** handshaker_factory);
 
 grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
@@ -94,6 +97,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
     tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory, bool send_client_ca_list,
+    std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider,
     tsi_ssl_server_handshaker_factory** handshaker_factory);
 
 // Free the memory occupied by key cert pairs.

src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -551,7 +551,7 @@ TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()), ssl_session_cache_,
       tls_session_key_logger_.get(), options_->crl_directory().c_str(),
-      &client_handshaker_factory_);
+      options_->crl_provider(), &client_handshaker_factory_);
   // Free memory.
   if (pem_key_cert_pair != nullptr) {
     grpc_tsi_ssl_pem_key_cert_pairs_destroy(pem_key_cert_pair, 1);
@@ -818,7 +818,8 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()),
       tls_session_key_logger_.get(), options_->crl_directory().c_str(),
-      options_->send_client_ca_list(), &server_handshaker_factory_);
+      options_->send_client_ca_list(), options_->crl_provider(),
+      &server_handshaker_factory_);
   // Free memory.
   grpc_tsi_ssl_pem_key_cert_pairs_destroy(pem_key_cert_pairs,
                                           num_key_cert_pairs);

src/core/lib/transport/metadata_batch.h

@@ -45,6 +45,7 @@
 #include "src/core/lib/gprpp/packed_table.h"
 #include "src/core/lib/gprpp/time.h"
 #include "src/core/lib/gprpp/type_list.h"
+#include "src/core/lib/promise/poll.h"
 #include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/custom_metadata.h"
@@ -519,6 +520,15 @@ struct GrpcRegisteredMethod {
   static std::string DisplayValue(void* x);
 };
 
+// Annotation added by filters to inform the transport to tarpit this
+// response: add some random delay to thwart certain kinds of attacks.
+struct GrpcTarPit {
+  static absl::string_view DebugKey() { return "GrpcTarPit"; }
+  static constexpr bool kRepeatable = false;
+  using ValueType = Empty;
+  static absl::string_view DisplayValue(Empty) { return "tarpit"; }
+};
+
 namespace metadata_detail {
 
 // Build a key/value formatted debug string.
@@ -1496,7 +1506,7 @@ using grpc_metadata_batch_base = grpc_core::MetadataMap<
     grpc_core::GrpcStreamNetworkState, grpc_core::PeerString,
     grpc_core::GrpcStatusContext, grpc_core::GrpcStatusFromWire,
     grpc_core::GrpcCallWasCancelled, grpc_core::WaitForReady,
-    grpc_core::GrpcTrailersOnly,
+    grpc_core::GrpcTrailersOnly, grpc_core::GrpcTarPit,
     grpc_core::GrpcRegisteredMethod GRPC_CUSTOM_CLIENT_METADATA
         GRPC_CUSTOM_SERVER_METADATA>;
 

src/core/lib/transport/transport.h

@@ -495,6 +495,12 @@ struct grpc_transport_stream_op_batch_payload {
     // Error contract: the transport that gets this op must cause cancel_error
     //                 to be unref'ed after processing it
     grpc_error_handle cancel_error;
+    // If true the transport should endeavor to delay sending the cancellation
+    // notification for some small amount of time, in order to foil certain
+    // exploits.
+    // This should be set for cancellations that result from malformed client
+    // initial metadata.
+    bool tarpit = false;
   } cancel_stream;
 
   // Indexes correspond to grpc_context_index enum values

src/core/tsi/ssl_transport_security.cc

@@ -33,6 +33,7 @@
 #include <sys/socket.h>
 #endif
 
+#include <memory>
 #include <string>
 
 #include <openssl/bio.h>
@@ -48,6 +49,7 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/grpc_crl_provider.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -57,6 +59,7 @@
 
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/crash.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h"
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/ssl/session_cache/ssl_session_cache.h"
 #include "src/core/tsi/ssl_transport_security_utils.h"
@@ -144,6 +147,7 @@ struct tsi_ssl_frame_protector {
 
 static gpr_once g_init_openssl_once = GPR_ONCE_INIT;
 static int g_ssl_ctx_ex_factory_index = -1;
+static int g_ssl_ctx_ex_crl_provider_index = -1;
 static const unsigned char kSslSessionIdContext[] = {'g', 'r', 'p', 'c'};
 static int g_ssl_ex_verified_root_cert_index = -1;
 #if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_NO_ENGINE)
@@ -199,6 +203,10 @@ static void init_openssl(void) {
       SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
   GPR_ASSERT(g_ssl_ctx_ex_factory_index != -1);
 
+  g_ssl_ctx_ex_crl_provider_index =
+      SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
+  GPR_ASSERT(g_ssl_ctx_ex_crl_provider_index != -1);
+
   g_ssl_ex_verified_root_cert_index =
       SSL_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
   GPR_ASSERT(g_ssl_ex_verified_root_cert_index != -1);
@@ -876,9 +884,9 @@ static tsi_result build_alpn_protocol_name_list(
 static int verify_cb(int ok, X509_STORE_CTX* ctx) {
   int cert_error = X509_STORE_CTX_get_error(ctx);
   if (cert_error == X509_V_ERR_UNABLE_TO_GET_CRL) {
-    gpr_log(
-        GPR_INFO,
-        "Certificate verification failed to get CRL files. Ignoring error.");
+    gpr_log(GPR_INFO,
+            "Certificate verification failed to find relevant CRL file. "
+            "Ignoring error.");
     return 1;
   }
   if (cert_error != 0) {
@@ -940,8 +948,16 @@ static int RootCertExtractCallback(int preverify_ok, X509_STORE_CTX* ctx) {
     return preverify_ok;
   }
 
-  SSL* ssl = static_cast<SSL*>(
-      X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()));
+  ERR_clear_error();
+  int ssl_index = SSL_get_ex_data_X509_STORE_CTX_idx();
+  if (ssl_index < 0) {
+    char err_str[256];
+    ERR_error_string_n(ERR_get_error(), err_str, sizeof(err_str));
+    gpr_log(GPR_ERROR,
+            "error getting the SSL index from the X509_STORE_CTX: %s", err_str);
+    return preverify_ok;
+  }
+  SSL* ssl = static_cast<SSL*>(X509_STORE_CTX_get_ex_data(ctx, ssl_index));
   if (ssl == nullptr) {
     return preverify_ok;
   }
@@ -953,6 +969,69 @@ static int RootCertExtractCallback(int preverify_ok, X509_STORE_CTX* ctx) {
   return preverify_ok;
 }
 
+// X509_STORE_set_get_crl() sets the function to get the crl for a given
+// certificate x. When found, the crl must be assigned to *crl. This function
+// must return 0 on failure and 1 on success. If no function to get the issuer
+// is provided, the internal default function will be used instead.
+static int GetCrlFromProvider(X509_STORE_CTX* ctx, X509_CRL** crl_out,
+                              X509* cert) {
+  ERR_clear_error();
+  int ssl_index = SSL_get_ex_data_X509_STORE_CTX_idx();
+  if (ssl_index < 0) {
+    char err_str[256];
+    ERR_error_string_n(ERR_get_error(), err_str, sizeof(err_str));
+    gpr_log(GPR_ERROR,
+            "error getting the SSL index from the X509_STORE_CTX while looking "
+            "up Crl: %s",
+            err_str);
+    return 0;
+  }
+  SSL* ssl = static_cast<SSL*>(X509_STORE_CTX_get_ex_data(ctx, ssl_index));
+  if (ssl == nullptr) {
+    gpr_log(GPR_ERROR,
+            "error while fetching from CrlProvider. SSL object is null");
+    return 0;
+  }
+  SSL_CTX* ssl_ctx = SSL_get_SSL_CTX(ssl);
+  auto* provider = static_cast<grpc_core::experimental::CrlProvider*>(
+      SSL_CTX_get_ex_data(ssl_ctx, g_ssl_ctx_ex_crl_provider_index));
+
+  char* buf = X509_NAME_oneline(X509_get_issuer_name(cert), nullptr, 0);
+  if (buf == nullptr) {
+    gpr_log(GPR_ERROR, "Certificate has null issuer, cannot do CRL lookup");
+    return 0;
+  }
+  grpc_core::experimental::CertificateInfoImpl cert_impl(buf);
+  std::shared_ptr<grpc_core::experimental::Crl> internal_crl =
+      provider->GetCrl(cert_impl);
+  OPENSSL_free(buf);
+  // There wasn't a CRL found in the provider. Returning 0 will end up causing
+  // OpenSSL to return X509_V_ERR_UNABLE_TO_GET_CRL. We then catch that error
+  // and behave how we want for a missing CRL.
+  // It is important to treat missing CRLs and empty CRLs differently.
+  if (internal_crl == nullptr) {
+    return 0;
+  }
+  X509_CRL* crl =
+      std::static_pointer_cast<grpc_core::experimental::CrlImpl>(internal_crl)
+          ->crl();
+
+  X509_CRL* copy = X509_CRL_dup(crl);
+  *crl_out = copy;
+  return 1;
+}
+
+// When using CRL Providers, this function used to override the default
+// `check_crl` function in OpenSSL using `X509_STORE_set_check_crl`.
+// CrlProviders put the onus on the users to provide the CRLs that they want to
+// provide, and because we override default CRL fetching behavior, we can expect
+// some of these verification checks to fails for custom CRL providers as well.
+// Thus, we need a passthrough to indicate to OpenSSL that we've provided a CRL
+// and we are good with it.
+static int CheckCrlPassthrough(X509_STORE_CTX* /*ctx*/, X509_CRL* /*crl*/) {
+  return 1;
+}
+
 // Sets the min and max TLS version of |ssl_context| to |min_tls_version| and
 // |max_tls_version|, respectively. Calling this method is a no-op when using
 // OpenSSL versions < 1.1.
@@ -2088,10 +2167,18 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
   }
 
 #if OPENSSL_VERSION_NUMBER >= 0x10100000
-  if (options->crl_directory != nullptr &&
-      strcmp(options->crl_directory, "") != 0) {
-    gpr_log(GPR_INFO, "enabling client CRL checking with path: %s",
-            options->crl_directory);
+  if (options->crl_provider != nullptr) {
+    SSL_CTX_set_ex_data(impl->ssl_context, g_ssl_ctx_ex_crl_provider_index,
+                        options->crl_provider.get());
+    X509_STORE* cert_store = SSL_CTX_get_cert_store(impl->ssl_context);
+    X509_STORE_set_get_crl(cert_store, GetCrlFromProvider);
+    X509_STORE_set_check_crl(cert_store, CheckCrlPassthrough);
+    X509_STORE_set_verify_cb(cert_store, verify_cb);
+    X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
+    X509_VERIFY_PARAM_set_flags(
+        param, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
+  } else if (options->crl_directory != nullptr &&
+             strcmp(options->crl_directory, "") != 0) {
     X509_STORE* cert_store = SSL_CTX_get_cert_store(ssl_context);
     X509_STORE_set_verify_cb(cert_store, verify_cb);
     if (!X509_STORE_load_locations(cert_store, nullptr,
@@ -2101,7 +2188,6 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
       X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
       X509_VERIFY_PARAM_set_flags(
           param, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
-      gpr_log(GPR_INFO, "enabled client side CRL checking.");
     }
   }
 #endif
@@ -2276,10 +2362,19 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
       }
 
 #if OPENSSL_VERSION_NUMBER >= 0x10100000
-      if (options->crl_directory != nullptr &&
-          strcmp(options->crl_directory, "") != 0) {
-        gpr_log(GPR_INFO, "enabling server CRL checking with path %s",
-                options->crl_directory);
+      if (options->crl_provider != nullptr) {
+        SSL_CTX_set_ex_data(impl->ssl_contexts[i],
+                            g_ssl_ctx_ex_crl_provider_index,
+                            options->crl_provider.get());
+        X509_STORE* cert_store = SSL_CTX_get_cert_store(impl->ssl_contexts[i]);
+        X509_STORE_set_get_crl(cert_store, GetCrlFromProvider);
+        X509_STORE_set_check_crl(cert_store, CheckCrlPassthrough);
+        X509_STORE_set_verify_cb(cert_store, verify_cb);
+        X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
+        X509_VERIFY_PARAM_set_flags(
+            param, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
+      } else if (options->crl_directory != nullptr &&
+                 strcmp(options->crl_directory, "") != 0) {
         X509_STORE* cert_store = SSL_CTX_get_cert_store(impl->ssl_contexts[i]);
         X509_STORE_set_verify_cb(cert_store, verify_cb);
         if (!X509_STORE_load_locations(cert_store, nullptr,
@@ -2289,7 +2384,6 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
           X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
           X509_VERIFY_PARAM_set_flags(
               param, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
-          gpr_log(GPR_INFO, "enabled server CRL checking.");
         }
       }
 #endif

src/core/tsi/ssl_transport_security.h

@@ -21,10 +21,13 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <memory>
+
 #include <openssl/x509.h>
 
 #include "absl/strings/string_view.h"
 
+#include <grpc/grpc_crl_provider.h>
 #include <grpc/grpc_security_constants.h>
 
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
@@ -179,9 +182,17 @@ struct tsi_ssl_client_handshaker_options {
   // The directory where all hashed CRL files enforced by the handshaker are
   // located. If the directory is invalid, CRL checking will fail open and just
   // log. An empty directory will not enable crl checking. Only OpenSSL version
-  // > 1.1 is supported for CRL checking
+  // >= 1.1 is supported for CRL checking. Cannot be used in conjunction with
+  // `crl_provider`.
   const char* crl_directory;
 
+  // A provider of CRLs. If set, when doing handshakes the `CrlProvider`'s
+  // `GetCrl` function will be called to find CRLs when checking certificates
+  // for revocation. Cannot be used in conjunction with `crl_directory`.
+  // This provider is created and owned by the user and passed in through
+  // options as a shared_ptr.
+  std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider;
+
   tsi_ssl_client_handshaker_options()
       : pem_key_cert_pair(nullptr),
         pem_root_certs(nullptr),
@@ -329,6 +340,13 @@ struct tsi_ssl_server_handshaker_options {
   // crl checking. Only OpenSSL version > 1.1 is supported for CRL checking
   const char* crl_directory;
 
+  // A provider of CRLs. If set, when doing handshakes the `CrlProvider`'s
+  // `GetCrl` function will be called to find CRLs when checking certificates
+  // for revocation. Cannot be used in conjunction with `crl_directory`.
+  // This provider is created and owned by the user and passed in through
+  // options as a shared_ptr.
+  std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider;
+
   // If true, the SSL server sends a list of CA names to the client in the
   // ServerHello. This list of CA names is extracted from the server's trust
   // bundle, and the client may use this lint as a hint to decide which

src/cpp/common/tls_credentials_options.cc

@@ -20,12 +20,14 @@
 #include <string>
 #include <utility>
 
+#include <grpc/grpc_crl_provider.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
 #include <grpc/support/log.h>
 #include <grpcpp/security/tls_certificate_provider.h>
 #include <grpcpp/security/tls_certificate_verifier.h>
 #include <grpcpp/security/tls_credentials_options.h>
+#include <grpcpp/security/tls_crl_provider.h>
 
 namespace grpc {
 namespace experimental {
@@ -43,6 +45,12 @@ void TlsCredentialsOptions::set_certificate_provider(
   }
 }
 
+void TlsCredentialsOptions::set_crl_provider(
+    std::shared_ptr<CrlProvider> crl_provider) {
+  grpc_tls_credentials_options_set_crl_provider(c_credentials_options_,
+                                                std::move(crl_provider));
+}
+
 void TlsCredentialsOptions::watch_root_certs() {
   grpc_tls_credentials_options_watch_root_certs(c_credentials_options_);
 }
@@ -84,6 +92,18 @@ void TlsCredentialsOptions::set_certificate_verifier(
   }
 }
 
+void TlsCredentialsOptions::set_min_tls_version(grpc_tls_version tls_version) {
+  grpc_tls_credentials_options* options = c_credentials_options();
+  GPR_ASSERT(options != nullptr);
+  grpc_tls_credentials_options_set_min_tls_version(options, tls_version);
+}
+
+void TlsCredentialsOptions::set_max_tls_version(grpc_tls_version tls_version) {
+  grpc_tls_credentials_options* options = c_credentials_options();
+  GPR_ASSERT(options != nullptr);
+  grpc_tls_credentials_options_set_max_tls_version(options, tls_version);
+}
+
 void TlsCredentialsOptions::set_check_call_host(bool check_call_host) {
   grpc_tls_credentials_options* options = c_credentials_options();
   GPR_ASSERT(options != nullptr);

src/cpp/server/secure_server_credentials.cc

@@ -152,8 +152,13 @@ std::shared_ptr<ServerCredentials> LocalServerCredentials(
 
 std::shared_ptr<ServerCredentials> TlsServerCredentials(
     const grpc::experimental::TlsServerCredentialsOptions& options) {
-  return std::shared_ptr<ServerCredentials>(new SecureServerCredentials(
-      grpc_tls_server_credentials_create(options.c_credentials_options())));
+  grpc_server_credentials* c_creds =
+      grpc_tls_server_credentials_create(options.c_credentials_options());
+  if (c_creds == nullptr) {
+    return nullptr;
+  }
+  return std::shared_ptr<ServerCredentials>(
+      new SecureServerCredentials(c_creds));
 }
 
 }  // namespace experimental

src/csharp/build/dependencies.props

@@ -1,7 +1,7 @@
 <!-- This file is generated -->
 <Project>
   <PropertyGroup>
-    <GrpcCsharpVersion>2.59.0-dev</GrpcCsharpVersion>
+    <GrpcCsharpVersion>2.59.4</GrpcCsharpVersion>
     <GoogleProtobufVersion>3.24.3</GoogleProtobufVersion>
   </PropertyGroup>
 </Project>

src/objective-c/!ProtoCompiler-gRPCCppPlugin.podspec

@@ -42,7 +42,7 @@ Pod::Spec.new do |s|
   # exclamation mark ensures that other "regular" pods will be able to find it as it'll be installed
   # before them.
   s.name     = '!ProtoCompiler-gRPCCppPlugin'
-  v = '1.59.0-dev'
+  v = '1.59.4'
   s.version  = v
   s.summary  = 'The gRPC ProtoC plugin generates C++ files from .proto services.'
   s.description = <<-DESC

src/objective-c/!ProtoCompiler-gRPCPlugin.podspec

@@ -42,7 +42,7 @@ Pod::Spec.new do |s|
   # exclamation mark ensures that other "regular" pods will be able to find it as it'll be installed
   # before them.
   s.name     = '!ProtoCompiler-gRPCPlugin'
-  v = '1.59.0-dev'
+  v = '1.59.4'
   s.version  = v
   s.summary  = 'The gRPC ProtoC plugin generates Objective-C files from .proto services.'
   s.description = <<-DESC

src/objective-c/GRPCClient/version.h

@@ -22,4 +22,4 @@
 // instead. This file can be regenerated from the template by running
 // `tools/buildgen/generate_projects.sh`.
 
-#define GRPC_OBJC_VERSION_STRING @"1.59.0-dev"
+#define GRPC_OBJC_VERSION_STRING @"1.59.4"

src/objective-c/tests/version.h

@@ -22,5 +22,5 @@
 // instead. This file can be regenerated from the template by running
 // `tools/buildgen/generate_projects.sh`.
 
-#define GRPC_OBJC_VERSION_STRING @"1.59.0-dev"
+#define GRPC_OBJC_VERSION_STRING @"1.59.4"
 #define GRPC_C_VERSION_STRING @"36.0.0"

src/php/composer.json

@@ -2,7 +2,7 @@
   "name": "grpc/grpc-dev",
   "description": "gRPC library for PHP - for Development use only",
   "license": "Apache-2.0",
-  "version": "1.59.0",
+  "version": "1.59.4",
   "require": {
     "php": ">=7.0.0",
     "google/protobuf": "^v3.3.0"

src/php/ext/grpc/version.h

@@ -20,6 +20,6 @@
 #ifndef VERSION_H
 #define VERSION_H
 
-#define PHP_GRPC_VERSION "1.59.0dev"
+#define PHP_GRPC_VERSION "1.59.4"
 
 #endif /* VERSION_H */

src/python/grpcio/grpc/_cython/_cygrpc/credentials.pyx.pxi

@@ -153,8 +153,9 @@ cdef class SSLChannelCredentials(ChannelCredentials):
     else:
       c_pem_root_certificates = self._pem_root_certificates
     if self._private_key is None and self._certificate_chain is None:
-      return grpc_ssl_credentials_create(
-          c_pem_root_certificates, NULL, NULL, NULL)
+      with nogil:
+        return grpc_ssl_credentials_create(
+            c_pem_root_certificates, NULL, NULL, NULL)
     else:
       if self._private_key:
         c_pem_key_certificate_pair.private_key = self._private_key
@@ -164,8 +165,9 @@ cdef class SSLChannelCredentials(ChannelCredentials):
         c_pem_key_certificate_pair.certificate_chain = self._certificate_chain
       else:
         c_pem_key_certificate_pair.certificate_chain = NULL
-      return grpc_ssl_credentials_create(
-          c_pem_root_certificates, &c_pem_key_certificate_pair, NULL, NULL)
+      with nogil:
+        return grpc_ssl_credentials_create(
+            c_pem_root_certificates, &c_pem_key_certificate_pair, NULL, NULL)
 
 
 cdef class CompositeChannelCredentials(ChannelCredentials):

src/python/grpcio/grpc/_grpcio_metadata.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio/grpc/_grpcio_metadata.py.template`!!!
 
-__version__ = """1.59.0.dev0"""
+__version__ = """1.59.4"""

src/python/grpcio/grpc_core_dependencies.py

@@ -118,11 +118,14 @@ CORE_SOURCE_FILES = [
     'src/core/ext/transport/chttp2/transport/http2_settings.cc',
     'src/core/ext/transport/chttp2/transport/http_trace.cc',
     'src/core/ext/transport/chttp2/transport/huffsyms.cc',
+    'src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.cc',
     'src/core/ext/transport/chttp2/transport/parsing.cc',
     'src/core/ext/transport/chttp2/transport/ping_abuse_policy.cc',
+    'src/core/ext/transport/chttp2/transport/ping_callbacks.cc',
     'src/core/ext/transport/chttp2/transport/ping_rate_policy.cc',
     'src/core/ext/transport/chttp2/transport/stream_lists.cc',
     'src/core/ext/transport/chttp2/transport/varint.cc',
+    'src/core/ext/transport/chttp2/transport/write_size_policy.cc',
     'src/core/ext/transport/chttp2/transport/writing.cc',
     'src/core/ext/transport/inproc/inproc_plugin.cc',
     'src/core/ext/transport/inproc/inproc_transport.cc',
@@ -577,6 +580,7 @@ CORE_SOURCE_FILES = [
     'src/core/lib/gprpp/load_file.cc',
     'src/core/lib/gprpp/mpscq.cc',
     'src/core/lib/gprpp/per_cpu.cc',
+    'src/core/lib/gprpp/posix/directory_reader.cc',
     'src/core/lib/gprpp/posix/env.cc',
     'src/core/lib/gprpp/posix/stat.cc',
     'src/core/lib/gprpp/posix/thd.cc',
@@ -588,6 +592,7 @@ CORE_SOURCE_FILES = [
     'src/core/lib/gprpp/time_averaged_stats.cc',
     'src/core/lib/gprpp/time_util.cc',
     'src/core/lib/gprpp/validation_errors.cc',
+    'src/core/lib/gprpp/windows/directory_reader.cc',
     'src/core/lib/gprpp/windows/env.cc',
     'src/core/lib/gprpp/windows/stat.cc',
     'src/core/lib/gprpp/windows/thd.cc',
@@ -740,6 +745,7 @@ CORE_SOURCE_FILES = [
     'src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc',
     'src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.cc',
     'src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc',
+    'src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc',
     'src/core/lib/security/credentials/tls/tls_credentials.cc',
     'src/core/lib/security/credentials/tls/tls_utils.cc',
     'src/core/lib/security/credentials/xds/xds_credentials.cc',

src/python/grpcio/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio/grpc_version.py.template`!!!
 
-VERSION = '1.59.0.dev0'
+VERSION = '1.59.4'

src/python/grpcio_admin/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_admin/grpc_version.py.template`!!!
 
-VERSION = '1.59.0.dev0'
+VERSION = '1.59.4'

src/python/grpcio_channelz/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_channelz/grpc_version.py.template`!!!
 
-VERSION = '1.59.0.dev0'
+VERSION = '1.59.4'

src/python/grpcio_csds/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_csds/grpc_version.py.template`!!!
 
-VERSION = '1.59.0.dev0'
+VERSION = '1.59.4'

src/python/grpcio_health_checking/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_health_checking/grpc_version.py.template`!!!
 
-VERSION = '1.59.0.dev0'
+VERSION = '1.59.4'

src/python/grpcio_reflection/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_reflection/grpc_version.py.template`!!!
 
-VERSION = '1.59.0.dev0'
+VERSION = '1.59.4'

src/python/grpcio_status/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_status/grpc_version.py.template`!!!
 
-VERSION = '1.59.0.dev0'
+VERSION = '1.59.4'

src/python/grpcio_testing/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_testing/grpc_version.py.template`!!!
 
-VERSION = '1.59.0.dev0'
+VERSION = '1.59.4'

src/python/grpcio_tests/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_tests/grpc_version.py.template`!!!
 
-VERSION = '1.59.0.dev0'
+VERSION = '1.59.4'

src/python/grpcio_tests/tests/unit/_api_test.py

@@ -14,11 +14,13 @@
 """Test of gRPC Python's application-layer API."""
 
 import logging
+import threading
 import unittest
 
 import grpc
 
 from tests.unit import _from_grpc_import_star
+from tests.unit import test_common
 
 
 class AllTest(unittest.TestCase):
@@ -115,6 +117,27 @@ class ChannelTest(unittest.TestCase):
         channel = grpc.secure_channel("google.com:443", channel_credentials)
         channel.close()
 
+    def test_multiple_secure_channel(self):
+        _THREAD_COUNT = 10
+        wait_group = test_common.WaitGroup(_THREAD_COUNT)
+
+        def create_secure_channel():
+            channel_credentials = grpc.ssl_channel_credentials()
+            wait_group.done()
+            wait_group.wait()
+            channel = grpc.secure_channel("google.com:443", channel_credentials)
+            channel.close()
+
+        threads = []
+        for _ in range(_THREAD_COUNT):
+            thread = threading.Thread(target=create_secure_channel)
+            thread.setDaemon(True)
+            thread.start()
+            threads.append(thread)
+
+        for thread in threads:
+            thread.join()
+
 
 if __name__ == "__main__":
     logging.basicConfig()

src/ruby/ext/grpc/rb_grpc_imports.generated.c

@@ -180,6 +180,8 @@ grpc_tls_certificate_provider_static_data_create_type grpc_tls_certificate_provi
 grpc_tls_certificate_provider_file_watcher_create_type grpc_tls_certificate_provider_file_watcher_create_import;
 grpc_tls_certificate_provider_release_type grpc_tls_certificate_provider_release_import;
 grpc_tls_credentials_options_create_type grpc_tls_credentials_options_create_import;
+grpc_tls_credentials_options_set_min_tls_version_type grpc_tls_credentials_options_set_min_tls_version_import;
+grpc_tls_credentials_options_set_max_tls_version_type grpc_tls_credentials_options_set_max_tls_version_import;
 grpc_tls_credentials_options_set_certificate_provider_type grpc_tls_credentials_options_set_certificate_provider_import;
 grpc_tls_credentials_options_watch_root_certs_type grpc_tls_credentials_options_watch_root_certs_import;
 grpc_tls_credentials_options_set_root_cert_name_type grpc_tls_credentials_options_set_root_cert_name_import;
@@ -467,6 +469,8 @@ void grpc_rb_load_imports(HMODULE library) {
   grpc_tls_certificate_provider_file_watcher_create_import = (grpc_tls_certificate_provider_file_watcher_create_type) GetProcAddress(library, "grpc_tls_certificate_provider_file_watcher_create");
   grpc_tls_certificate_provider_release_import = (grpc_tls_certificate_provider_release_type) GetProcAddress(library, "grpc_tls_certificate_provider_release");
   grpc_tls_credentials_options_create_import = (grpc_tls_credentials_options_create_type) GetProcAddress(library, "grpc_tls_credentials_options_create");
+  grpc_tls_credentials_options_set_min_tls_version_import = (grpc_tls_credentials_options_set_min_tls_version_type) GetProcAddress(library, "grpc_tls_credentials_options_set_min_tls_version");
+  grpc_tls_credentials_options_set_max_tls_version_import = (grpc_tls_credentials_options_set_max_tls_version_type) GetProcAddress(library, "grpc_tls_credentials_options_set_max_tls_version");
   grpc_tls_credentials_options_set_certificate_provider_import = (grpc_tls_credentials_options_set_certificate_provider_type) GetProcAddress(library, "grpc_tls_credentials_options_set_certificate_provider");
   grpc_tls_credentials_options_watch_root_certs_import = (grpc_tls_credentials_options_watch_root_certs_type) GetProcAddress(library, "grpc_tls_credentials_options_watch_root_certs");
   grpc_tls_credentials_options_set_root_cert_name_import = (grpc_tls_credentials_options_set_root_cert_name_type) GetProcAddress(library, "grpc_tls_credentials_options_set_root_cert_name");

src/ruby/ext/grpc/rb_grpc_imports.generated.h

@@ -515,6 +515,12 @@ extern grpc_tls_certificate_provider_release_type grpc_tls_certificate_provider_
 typedef grpc_tls_credentials_options*(*grpc_tls_credentials_options_create_type)(void);
 extern grpc_tls_credentials_options_create_type grpc_tls_credentials_options_create_import;
 #define grpc_tls_credentials_options_create grpc_tls_credentials_options_create_import
+typedef void(*grpc_tls_credentials_options_set_min_tls_version_type)(grpc_tls_credentials_options* options, grpc_tls_version min_tls_version);
+extern grpc_tls_credentials_options_set_min_tls_version_type grpc_tls_credentials_options_set_min_tls_version_import;
+#define grpc_tls_credentials_options_set_min_tls_version grpc_tls_credentials_options_set_min_tls_version_import
+typedef void(*grpc_tls_credentials_options_set_max_tls_version_type)(grpc_tls_credentials_options* options, grpc_tls_version max_tls_version);
+extern grpc_tls_credentials_options_set_max_tls_version_type grpc_tls_credentials_options_set_max_tls_version_import;
+#define grpc_tls_credentials_options_set_max_tls_version grpc_tls_credentials_options_set_max_tls_version_import
 typedef void(*grpc_tls_credentials_options_set_certificate_provider_type)(grpc_tls_credentials_options* options, grpc_tls_certificate_provider* provider);
 extern grpc_tls_credentials_options_set_certificate_provider_type grpc_tls_credentials_options_set_certificate_provider_import;
 #define grpc_tls_credentials_options_set_certificate_provider grpc_tls_credentials_options_set_certificate_provider_import

src/ruby/lib/grpc/version.rb

@@ -14,5 +14,5 @@
 
 # GRPC contains the General RPC module.
 module GRPC
-  VERSION = '1.59.0.dev'
+  VERSION = '1.59.4'
 end

src/ruby/tools/version.rb

@@ -14,6 +14,6 @@
 
 module GRPC
   module Tools
-    VERSION = '1.59.0.dev'
+    VERSION = '1.59.4'
   end
 end

test/core/bad_client/bad_client.cc

@@ -21,6 +21,7 @@
 #include <inttypes.h>
 #include <limits.h>
 
+#include <grpc/impl/channel_arg_names.h>
 #include <grpc/slice_buffer.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -28,6 +29,7 @@
 #include <grpc/support/time.h>
 
 #include "src/core/ext/transport/chttp2/transport/chttp2_transport.h"
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_args_preconditioning.h"
 #include "src/core/lib/channel/channelz.h"
 #include "src/core/lib/config/core_configuration.h"
@@ -205,12 +207,16 @@ void grpc_run_bad_client_test(
   grpc_completion_queue* shutdown_cq;
   grpc_completion_queue* client_cq;
 
+  const auto server_args = grpc_core::ChannelArgs().Set(
+      GRPC_ARG_MAX_CONCURRENT_STREAMS,
+      (flags & GRPC_BAD_CLIENT_MAX_CONCURRENT_REQUESTS_OF_ONE) ? 1 : 10000);
+
   // Init grpc
   grpc_init();
 
   sfd = grpc_iomgr_create_endpoint_pair("fixture", nullptr);
   // Create server, completion events
-  a.server = grpc_server_create(nullptr, nullptr);
+  a.server = grpc_server_create(server_args.ToC().get(), nullptr);
   a.cq = grpc_completion_queue_create_for_next(nullptr);
   client_cq = grpc_completion_queue_create_for_next(nullptr);
   grpc_server_register_completion_queue(a.server, a.cq, nullptr);
@@ -219,11 +225,11 @@ void grpc_run_bad_client_test(
                                   GRPC_BAD_CLIENT_REGISTERED_HOST,
                                   GRPC_SRM_PAYLOAD_READ_INITIAL_BYTE_BUFFER, 0);
   grpc_server_start(a.server);
-  transport =
-      grpc_create_chttp2_transport(grpc_core::CoreConfiguration::Get()
-                                       .channel_args_preconditioning()
-                                       .PreconditionChannelArgs(nullptr),
-                                   sfd.server, false);
+  transport = grpc_create_chttp2_transport(
+      grpc_core::CoreConfiguration::Get()
+          .channel_args_preconditioning()
+          .PreconditionChannelArgs(server_args.ToC().get()),
+      sfd.server, false);
   server_setup_transport(&a, transport);
   grpc_chttp2_transport_start_reading(transport, nullptr, nullptr, nullptr);
 

test/core/bad_client/bad_client.h

@@ -47,6 +47,7 @@ struct grpc_bad_client_arg {
 // Flags for grpc_run_bad_client_test
 #define GRPC_BAD_CLIENT_DISCONNECT 1
 #define GRPC_BAD_CLIENT_LARGE_REQUEST 2
+#define GRPC_BAD_CLIENT_MAX_CONCURRENT_REQUESTS_OF_ONE 4
 
 // Test runner.
 //

test/core/bad_client/generate_tests.bzl

@@ -57,6 +57,7 @@ def grpc_bad_client_tests():
             name = "%s_bad_client_test" % t,
             srcs = ["tests/%s.cc" % t],
             deps = [":bad_client_test"],
+            tags = ["bad_client_test"],
             external_deps = [
                 "gtest",
             ],

test/core/bad_client/tests/initial_settings_frame.cc

@@ -16,15 +16,75 @@
 //
 //
 
+#include <string>
+
+#include "absl/strings/str_cat.h"
+
 #include <grpc/grpc.h>
+#include <grpc/slice.h>
 #include <grpc/support/log.h>
 
+#include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/surface/server.h"
 #include "test/core/bad_client/bad_client.h"
+#include "test/core/end2end/cq_verifier.h"
 #include "test/core/util/test_config.h"
 
 #define PFX_STR "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n"
 #define ONE_SETTING_HDR "\x00\x00\x06\x04\x00\x00\x00\x00\x00"
+#define ZERO_SETTING_HDR "\x00\x00\x00\x04\x00\x00\x00\x00\x00"
+#define SETTING_ACK "\x00\x00\x00\x04\x01\x00\x00\x00\x00"
+
+#define RST_STREAM_1 "\x00\x00\x04\x03\x00\x00\x00\x00\x01\x00\x00\x00\x00"
+#define RST_STREAM_3 "\x00\x00\x04\x03\x00\x00\x00\x00\x03\x00\x00\x00\x00"
+
+#define FOOBAR_0                                                           \
+  "\x00\x00\xca\x01\x04\x00\x00\x00\x01" /* headers: generated from        \
+                                            simple_request.headers in this \
+                                            directory */                   \
+  "\x10\x05:path\x09/foo/bar0"                                             \
+  "\x10\x07:scheme\x04http"                                                \
+  "\x10\x07:method\x04POST"                                                \
+  "\x10\x0a:authority\x09localhost"                                        \
+  "\x10\x0c"                                                               \
+  "content-type\x10"                                                       \
+  "application/grpc"                                                       \
+  "\x10\x14grpc-accept-encoding\x15"                                       \
+  "deflate,identity,gzip"                                                  \
+  "\x10\x02te\x08trailers"                                                 \
+  "\x10\x0auser-agent\"bad-client grpc-c/0.12.0.0 (linux)"
+
+#define FOOBAR_1                                                           \
+  "\x00\x00\xca\x01\x04\x00\x00\x00\x05" /* headers: generated from        \
+                                            simple_request.headers in this \
+                                            directory */                   \
+  "\x10\x05:path\x09/foo/bar1"                                             \
+  "\x10\x07:scheme\x04http"                                                \
+  "\x10\x07:method\x04POST"                                                \
+  "\x10\x0a:authority\x09localhost"                                        \
+  "\x10\x0c"                                                               \
+  "content-type\x10"                                                       \
+  "application/grpc"                                                       \
+  "\x10\x14grpc-accept-encoding\x15"                                       \
+  "deflate,identity,gzip"                                                  \
+  "\x10\x02te\x08trailers"                                                 \
+  "\x10\x0auser-agent\"bad-client grpc-c/0.12.0.0 (linux)"
+
+#define FOOBAR_2                                                           \
+  "\x00\x00\xca\x01\x04\x00\x00\x00\x03" /* headers: generated from        \
+                                            simple_request.headers in this \
+                                            directory */                   \
+  "\x10\x05:path\x09/foo/bar2"                                             \
+  "\x10\x07:scheme\x04http"                                                \
+  "\x10\x07:method\x04POST"                                                \
+  "\x10\x0a:authority\x09localhost"                                        \
+  "\x10\x0c"                                                               \
+  "content-type\x10"                                                       \
+  "application/grpc"                                                       \
+  "\x10\x14grpc-accept-encoding\x15"                                       \
+  "deflate,identity,gzip"                                                  \
+  "\x10\x02te\x08trailers"                                                 \
+  "\x10\x0auser-agent\"bad-client grpc-c/0.12.0.0 (linux)"
 
 static void verifier(grpc_server* server, grpc_completion_queue* cq,
                      void* /*registered_method*/) {
@@ -35,6 +95,36 @@ static void verifier(grpc_server* server, grpc_completion_queue* cq,
   }
 }
 
+static void single_request_verifier(grpc_server* server,
+                                    grpc_completion_queue* cq,
+                                    void* /*registered_method*/) {
+  grpc_call_error error;
+  grpc_call* s;
+  grpc_call_details call_details;
+  grpc_core::CqVerifier cqv(cq);
+  grpc_metadata_array request_metadata_recv;
+
+  for (int i = 0; i < 2; i++) {
+    grpc_call_details_init(&call_details);
+    grpc_metadata_array_init(&request_metadata_recv);
+
+    error = grpc_server_request_call(server, &s, &call_details,
+                                     &request_metadata_recv, cq, cq,
+                                     grpc_core::CqVerifier::tag(101));
+    GPR_ASSERT(GRPC_CALL_OK == error);
+    cqv.Expect(grpc_core::CqVerifier::tag(101), true);
+    cqv.Verify();
+
+    GPR_ASSERT(0 == grpc_slice_str_cmp(call_details.host, "localhost"));
+    GPR_ASSERT(0 == grpc_slice_str_cmp(call_details.method,
+                                       absl::StrCat("/foo/bar", i).c_str()));
+
+    grpc_metadata_array_destroy(&request_metadata_recv);
+    grpc_call_details_destroy(&call_details);
+    grpc_call_unref(s);
+  }
+}
+
 int main(int argc, char** argv) {
   grpc::testing::TestEnvironment env(&argc, argv);
   grpc_init();
@@ -111,6 +201,14 @@ int main(int argc, char** argv) {
                            PFX_STR ONE_SETTING_HDR "\x00\x99\x00\x00\x00\x00",
                            GRPC_BAD_CLIENT_DISCONNECT);
 
+  // too many requests before the settings ack is sent should be cancelled
+  if (grpc_core::IsBlockExcessiveRequestsBeforeSettingsAckEnabled()) {
+    GRPC_RUN_BAD_CLIENT_TEST(single_request_verifier, nullptr,
+                             PFX_STR ZERO_SETTING_HDR FOOBAR_0 FOOBAR_2
+                                 SETTING_ACK RST_STREAM_1 RST_STREAM_3 FOOBAR_1,
+                             GRPC_BAD_CLIENT_MAX_CONCURRENT_REQUESTS_OF_ONE);
+  }
+
   grpc_shutdown();
   return 0;
 }