grpc 1.45.0 → 1.46.3

data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc

@@ -852,6 +852,9 @@ static void inc_initiate_write_reason(
     case GRPC_CHTTP2_INITIATE_WRITE_SEND_SETTINGS:
       GRPC_STATS_INC_HTTP2_INITIATE_WRITE_DUE_TO_SEND_SETTINGS();
       break;
+    case GRPC_CHTTP2_INITIATE_WRITE_SETTINGS_ACK:
+      GRPC_STATS_INC_HTTP2_INITIATE_WRITE_DUE_TO_SETTINGS_ACK();
+      break;
     case GRPC_CHTTP2_INITIATE_WRITE_FLOW_CONTROL_UNSTALLED_BY_SETTING:
       GRPC_STATS_INC_HTTP2_INITIATE_WRITE_DUE_TO_FLOW_CONTROL_UNSTALLED_BY_SETTING();
       break;
@@ -1006,8 +1009,8 @@ static void write_action_end_locked(void* tp, grpc_error_handle error) {
     closed = true;
   }
 
-  if (t->sent_goaway_state == GRPC_CHTTP2_GOAWAY_SEND_SCHEDULED) {
-    t->sent_goaway_state = GRPC_CHTTP2_GOAWAY_SENT;
+  if (t->sent_goaway_state == GRPC_CHTTP2_FINAL_GOAWAY_SEND_SCHEDULED) {
+    t->sent_goaway_state = GRPC_CHTTP2_FINAL_GOAWAY_SENT;
     closed = true;
     if (grpc_chttp2_stream_map_size(&t->stream_map) == 0) {
       close_transport_locked(
@@ -1100,22 +1103,24 @@ void grpc_chttp2_add_incoming_goaway(grpc_chttp2_transport* t,
     gpr_log(GPR_INFO, "%s: Got goaway [%d] err=%s", t->peer_string.c_str(),
             goaway_error, grpc_error_std_string(t->goaway_error).c_str());
   }
-  cancel_unstarted_streams(t, GRPC_ERROR_REF(t->goaway_error));
-  // Cancel all unseen streams
-  grpc_chttp2_stream_map_for_each(
-      &t->stream_map,
-      [](void* user_data, uint32_t /* key */, void* stream) {
-        uint32_t last_stream_id = *(static_cast<uint32_t*>(user_data));
-        grpc_chttp2_stream* s = static_cast<grpc_chttp2_stream*>(stream);
-        if (s->id > last_stream_id) {
-          s->trailing_metadata_buffer.Set(
-              grpc_core::GrpcStreamNetworkState(),
-              grpc_core::GrpcStreamNetworkState::kNotSeenByServer);
-          grpc_chttp2_cancel_stream(s->t, s,
-                                    GRPC_ERROR_REF(s->t->goaway_error));
-        }
-      },
-      &last_stream_id);
+  if (t->is_client) {
+    cancel_unstarted_streams(t, GRPC_ERROR_REF(t->goaway_error));
+    // Cancel all unseen streams
+    grpc_chttp2_stream_map_for_each(
+        &t->stream_map,
+        [](void* user_data, uint32_t /* key */, void* stream) {
+          uint32_t last_stream_id = *(static_cast<uint32_t*>(user_data));
+          grpc_chttp2_stream* s = static_cast<grpc_chttp2_stream*>(stream);
+          if (s->id > last_stream_id) {
+            s->trailing_metadata_buffer.Set(
+                grpc_core::GrpcStreamNetworkState(),
+                grpc_core::GrpcStreamNetworkState::kNotSeenByServer);
+            grpc_chttp2_cancel_stream(s->t, s,
+                                      GRPC_ERROR_REF(s->t->goaway_error));
+          }
+        },
+        &last_stream_id);
+  }
   absl::Status status = grpc_error_to_absl_status(t->goaway_error);
   // When a client receives a GOAWAY with error code ENHANCE_YOUR_CALM and debug
   // data equal to "too_many_pings", it should log the occurrence at a log level
@@ -1757,18 +1762,120 @@ void grpc_chttp2_ack_ping(grpc_chttp2_transport* t, uint64_t id) {
   }
 }
 
+namespace {
+
+// Fire and forget (deletes itself on completion). Does a graceful shutdown by
+// sending a GOAWAY frame with the last stream id set to 2^31-1, sending a ping
+// and waiting for an ack (effective waiting for an RTT) and then sending a
+// final GOAWAY freame with an updated last stream identifier. This helps ensure
+// that a connection can be cleanly shut down without losing requests.
+// In the event, that the client does not respond to the ping for some reason,
+// we add a 20 second deadline, after which we send the second goaway.
+class GracefulGoaway : public grpc_core::RefCounted<GracefulGoaway> {
+ public:
+  static void Start(grpc_chttp2_transport* t) { new GracefulGoaway(t); }
+
+  ~GracefulGoaway() override {
+    GRPC_CHTTP2_UNREF_TRANSPORT(t_, "graceful goaway");
+  }
+
+ private:
+  explicit GracefulGoaway(grpc_chttp2_transport* t) : t_(t) {
+    t->sent_goaway_state = GRPC_CHTTP2_GRACEFUL_GOAWAY;
+    GRPC_CHTTP2_REF_TRANSPORT(t_, "graceful goaway");
+    grpc_chttp2_goaway_append((1u << 31) - 1, 0, grpc_empty_slice(), &t->qbuf);
+    send_ping_locked(
+        t, nullptr, GRPC_CLOSURE_INIT(&on_ping_ack_, OnPingAck, this, nullptr));
+    grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_GOAWAY_SENT);
+    Ref().release();  // Ref for the timer
+    grpc_timer_init(
+        &timer_,
+        grpc_core::ExecCtx::Get()->Now() + grpc_core::Duration::Seconds(20),
+        GRPC_CLOSURE_INIT(&on_timer_, OnTimer, this, nullptr));
+  }
+
+  void MaybeSendFinalGoawayLocked() {
+    if (t_->sent_goaway_state != GRPC_CHTTP2_GRACEFUL_GOAWAY) {
+      // We already sent the final GOAWAY.
+      return;
+    }
+    if (t_->destroying || t_->closed_with_error != GRPC_ERROR_NONE) {
+      GRPC_CHTTP2_IF_TRACING(gpr_log(
+          GPR_INFO,
+          "transport:%p %s peer:%s Transport already shutting down. "
+          "Graceful GOAWAY abandoned.",
+          t_, t_->is_client ? "CLIENT" : "SERVER", t_->peer_string.c_str()));
+      return;
+    }
+    // Ping completed. Send final goaway.
+    GRPC_CHTTP2_IF_TRACING(
+        gpr_log(GPR_INFO,
+                "transport:%p %s peer:%s Graceful shutdown: Ping received. "
+                "Sending final GOAWAY with stream_id:%d",
+                t_, t_->is_client ? "CLIENT" : "SERVER",
+                t_->peer_string.c_str(), t_->last_new_stream_id));
+    t_->sent_goaway_state = GRPC_CHTTP2_FINAL_GOAWAY_SEND_SCHEDULED;
+    grpc_chttp2_goaway_append(t_->last_new_stream_id, 0, grpc_empty_slice(),
+                              &t_->qbuf);
+    grpc_chttp2_initiate_write(t_, GRPC_CHTTP2_INITIATE_WRITE_GOAWAY_SENT);
+  }
+
+  static void OnPingAck(void* arg, grpc_error_handle /* error */) {
+    auto* self = static_cast<GracefulGoaway*>(arg);
+    self->t_->combiner->Run(
+        GRPC_CLOSURE_INIT(&self->on_ping_ack_, OnPingAckLocked, self, nullptr),
+        GRPC_ERROR_NONE);
+  }
+
+  static void OnPingAckLocked(void* arg, grpc_error_handle /* error */) {
+    auto* self = static_cast<GracefulGoaway*>(arg);
+    grpc_timer_cancel(&self->timer_);
+    self->MaybeSendFinalGoawayLocked();
+    self->Unref();
+  }
+
+  static void OnTimer(void* arg, grpc_error_handle error) {
+    auto* self = static_cast<GracefulGoaway*>(arg);
+    if (error != GRPC_ERROR_NONE) {
+      self->Unref();
+      return;
+    }
+    self->t_->combiner->Run(
+        GRPC_CLOSURE_INIT(&self->on_timer_, OnTimerLocked, self, nullptr),
+        GRPC_ERROR_NONE);
+  }
+
+  static void OnTimerLocked(void* arg, grpc_error_handle /* error */) {
+    auto* self = static_cast<GracefulGoaway*>(arg);
+    self->MaybeSendFinalGoawayLocked();
+    self->Unref();
+  }
+
+  grpc_chttp2_transport* t_;
+  grpc_closure on_ping_ack_;
+  grpc_timer timer_;
+  grpc_closure on_timer_;
+};
+
+}  // namespace
+
 static void send_goaway(grpc_chttp2_transport* t, grpc_error_handle error) {
-  // We want to log this irrespective of whether http tracing is enabled
-  gpr_log(GPR_DEBUG, "%s: Sending goaway err=%s", t->peer_string.c_str(),
-          grpc_error_std_string(error).c_str());
-  t->sent_goaway_state = GRPC_CHTTP2_GOAWAY_SEND_SCHEDULED;
   grpc_http2_error_code http_error;
   std::string message;
   grpc_error_get_status(error, grpc_core::Timestamp::InfFuture(), nullptr,
                         &message, &http_error, nullptr);
-  grpc_chttp2_goaway_append(
-      t->last_new_stream_id, static_cast<uint32_t>(http_error),
-      grpc_slice_from_cpp_string(std::move(message)), &t->qbuf);
+  if (!t->is_client && http_error == GRPC_HTTP2_NO_ERROR) {
+    // Do a graceful shutdown.
+    GracefulGoaway::Start(t);
+  } else {
+    // We want to log this irrespective of whether http tracing is enabled
+    gpr_log(GPR_DEBUG, "%s: Sending goaway err=%s", t->peer_string.c_str(),
+            grpc_error_std_string(error).c_str());
+    t->sent_goaway_state = GRPC_CHTTP2_FINAL_GOAWAY_SEND_SCHEDULED;
+    grpc_chttp2_goaway_append(
+        t->last_new_stream_id, static_cast<uint32_t>(http_error),
+        grpc_slice_from_cpp_string(std::move(message)), &t->qbuf);
+  }
   grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_GOAWAY_SENT);
   GRPC_ERROR_UNREF(error);
 }
@@ -1859,8 +1966,8 @@ static void perform_transport_op(grpc_transport* gt, grpc_transport_op* op) {
 // INPUT PROCESSING - GENERAL
 //
 
-void grpc_chttp2_maybe_complete_recv_initial_metadata(
-    grpc_chttp2_transport* /*t*/, grpc_chttp2_stream* s) {
+void grpc_chttp2_maybe_complete_recv_initial_metadata(grpc_chttp2_transport* t,
+                                                      grpc_chttp2_stream* s) {
   if (s->recv_initial_metadata_ready != nullptr &&
       s->published_metadata[0] != GRPC_METADATA_NOT_PUBLISHED) {
     if (s->seen_error) {
@@ -1871,6 +1978,7 @@ void grpc_chttp2_maybe_complete_recv_initial_metadata(
       }
     }
     *s->recv_initial_metadata = std::move(s->initial_metadata_buffer);
+    s->recv_initial_metadata->Set(grpc_core::PeerString(), t->peer_string);
     // If we didn't receive initial metadata from the wire and instead faked a
     // status (due to stream cancellations for example), let upper layers know
     // that trailing metadata is immediately available.
@@ -1966,6 +2074,7 @@ void grpc_chttp2_maybe_complete_recv_trailing_metadata(grpc_chttp2_transport* t,
       grpc_transport_move_stats(&s->stats, s->collecting_stats);
       s->collecting_stats = nullptr;
       *s->recv_trailing_metadata = std::move(s->trailing_metadata_buffer);
+      s->recv_trailing_metadata->Set(grpc_core::PeerString(), t->peer_string);
       null_then_sched_closure(&s->recv_trailing_metadata_finished);
     }
   }
@@ -1997,7 +2106,7 @@ static void remove_stream(grpc_chttp2_transport* t, uint32_t id,
 
   if (grpc_chttp2_stream_map_size(&t->stream_map) == 0) {
     post_benign_reclaimer(t);
-    if (t->sent_goaway_state == GRPC_CHTTP2_GOAWAY_SENT) {
+    if (t->sent_goaway_state == GRPC_CHTTP2_FINAL_GOAWAY_SENT) {
       close_transport_locked(
           t, GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
                  "Last stream closed after sending GOAWAY", &error, 1));
@@ -3194,6 +3303,8 @@ const char* grpc_chttp2_initiate_write_reason_string(
       return "TRANSPORT_FLOW_CONTROL";
     case GRPC_CHTTP2_INITIATE_WRITE_SEND_SETTINGS:
       return "SEND_SETTINGS";
+    case GRPC_CHTTP2_INITIATE_WRITE_SETTINGS_ACK:
+      return "SETTINGS_ACK";
     case GRPC_CHTTP2_INITIATE_WRITE_FLOW_CONTROL_UNSTALLED_BY_SETTING:
       return "FLOW_CONTROL_UNSTALLED_BY_SETTING";
     case GRPC_CHTTP2_INITIATE_WRITE_FLOW_CONTROL_UNSTALLED_BY_UPDATE:

data/src/core/ext/transport/chttp2/transport/frame_settings.cc

@@ -151,6 +151,8 @@ grpc_error_handle grpc_chttp2_settings_parser_parse(void* p,
                    GRPC_CHTTP2_NUM_SETTINGS * sizeof(uint32_t));
             t->num_pending_induced_frames++;
             grpc_slice_buffer_add(&t->qbuf, grpc_chttp2_settings_ack_create());
+            grpc_chttp2_initiate_write(t,
+                                       GRPC_CHTTP2_INITIATE_WRITE_SETTINGS_ACK);
             if (t->notify_on_receive_settings != nullptr) {
               grpc_core::ExecCtx::Run(DEBUG_LOCATION,
                                       t->notify_on_receive_settings,

data/src/core/ext/transport/chttp2/transport/hpack_encoder.cc

@@ -481,15 +481,11 @@ void HPackCompressor::Framer::Encode(HttpStatusMetadata, uint32_t status) {
 void HPackCompressor::Framer::Encode(HttpMethodMetadata,
                                      HttpMethodMetadata::ValueType method) {
   switch (method) {
-    case HttpMethodMetadata::ValueType::kGet:
-      EmitIndexed(2);  // :method: GET
-      break;
     case HttpMethodMetadata::ValueType::kPost:
       EmitIndexed(3);  // :method: POST
       break;
-    case HttpMethodMetadata::ValueType::kPut:
-      EmitLitHdrWithNonBinaryStringKeyNotIdx(Slice::FromStaticString(":method"),
-                                             Slice::FromStaticString("PUT"));
+    case HttpMethodMetadata::ValueType::kGet:
+      EmitIndexed(2);  // :method: GET
       break;
     case HttpMethodMetadata::ValueType::kInvalid:
       GPR_ASSERT(false);

data/src/core/ext/transport/chttp2/transport/internal.h

@@ -98,6 +98,7 @@ typedef enum {
   GRPC_CHTTP2_INITIATE_WRITE_STREAM_FLOW_CONTROL,
   GRPC_CHTTP2_INITIATE_WRITE_TRANSPORT_FLOW_CONTROL,
   GRPC_CHTTP2_INITIATE_WRITE_SEND_SETTINGS,
+  GRPC_CHTTP2_INITIATE_WRITE_SETTINGS_ACK,
   GRPC_CHTTP2_INITIATE_WRITE_FLOW_CONTROL_UNSTALLED_BY_SETTING,
   GRPC_CHTTP2_INITIATE_WRITE_FLOW_CONTROL_UNSTALLED_BY_UPDATE,
   GRPC_CHTTP2_INITIATE_WRITE_APPLICATION_PING,
@@ -196,8 +197,9 @@ typedef enum {
 
 typedef enum {
   GRPC_CHTTP2_NO_GOAWAY_SEND,
-  GRPC_CHTTP2_GOAWAY_SEND_SCHEDULED,
-  GRPC_CHTTP2_GOAWAY_SENT,
+  GRPC_CHTTP2_GRACEFUL_GOAWAY,
+  GRPC_CHTTP2_FINAL_GOAWAY_SEND_SCHEDULED,
+  GRPC_CHTTP2_FINAL_GOAWAY_SENT,
 } grpc_chttp2_sent_goaway_state;
 
 typedef struct grpc_chttp2_write_cb {

data/src/core/ext/transport/chttp2/transport/parsing.cc

@@ -479,6 +479,14 @@ static grpc_error_handle init_header_frame_parser(grpc_chttp2_transport* t,
                    t->settings[GRPC_ACKED_SETTINGS]
                               [GRPC_CHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS])) {
       return GRPC_ERROR_CREATE_FROM_STATIC_STRING("Max stream count exceeded");
+    } else if (t->sent_goaway_state == GRPC_CHTTP2_FINAL_GOAWAY_SENT) {
+      GRPC_CHTTP2_IF_TRACING(gpr_log(
+          GPR_INFO,
+          "transport:%p SERVER peer:%s Final GOAWAY sent. Ignoring new "
+          "grpc_chttp2_stream request id=%d, last grpc_chttp2_stream id=%d",
+          t, t->peer_string.c_str(), t->incoming_stream_id,
+          t->last_new_stream_id));
+      return init_header_skip_frame_parser(t, priority_type);
     }
     t->last_new_stream_id = t->incoming_stream_id;
     s = t->incoming_stream =

data/src/core/ext/transport/chttp2/transport/writing.cc

@@ -60,15 +60,15 @@ static void maybe_initiate_ping(grpc_chttp2_transport* t) {
     }
     return;
   }
-  if (t->ping_state.pings_before_data_required == 0 &&
+  if (t->is_client && t->ping_state.pings_before_data_required == 0 &&
       t->ping_policy.max_pings_without_data != 0) {
     /* need to receive something of substance before sending a ping again */
     if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace) ||
         GRPC_TRACE_FLAG_ENABLED(grpc_bdp_estimator_trace) ||
         GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {
-      gpr_log(GPR_INFO, "%s: Ping delayed [%s]: too many recent pings: %d/%d",
-              t->is_client ? "CLIENT" : "SERVER", t->peer_string.c_str(),
-              t->ping_state.pings_before_data_required,
+      gpr_log(GPR_INFO,
+              "CLIENT: Ping delayed [%s]: too many recent pings: %d/%d",
+              t->peer_string.c_str(), t->ping_state.pings_before_data_required,
               t->ping_policy.max_pings_without_data);
     }
     return;
@@ -79,13 +79,23 @@ static void maybe_initiate_ping(grpc_chttp2_transport* t) {
   grpc_core::ExecCtx::Get()->InvalidateNow();
   grpc_core::Timestamp now = grpc_core::ExecCtx::Get()->Now();
 
-  grpc_core::Duration next_allowed_ping_interval =
-      (t->keepalive_permit_without_calls == 0 &&
-       grpc_chttp2_stream_map_size(&t->stream_map) == 0)
-          ? grpc_core::Duration::Hours(2)
-          : grpc_core::Duration::Seconds(
-                1); /* A second is added to deal with network delays and timing
-                       imprecision */
+  grpc_core::Duration next_allowed_ping_interval = grpc_core::Duration::Zero();
+  if (t->is_client) {
+    next_allowed_ping_interval =
+        (t->keepalive_permit_without_calls == 0 &&
+         grpc_chttp2_stream_map_size(&t->stream_map) == 0)
+            ? grpc_core::Duration::Hours(2)
+            : grpc_core::Duration::Seconds(1); /* A second is added to deal with
+                         network delays and timing imprecision */
+  } else if (t->sent_goaway_state != GRPC_CHTTP2_GRACEFUL_GOAWAY) {
+    // The gRPC keepalive spec doesn't call for any throttling on the server
+    // side, but we are adding some throttling for protection anyway, unless
+    // we are doing a graceful GOAWAY in which case we don't want to wait.
+    next_allowed_ping_interval =
+        t->keepalive_time == grpc_core::Duration::Infinity()
+            ? grpc_core::Duration::Seconds(20)
+            : t->keepalive_time / 2;
+  }
   grpc_core::Timestamp next_allowed_ping =
       t->ping_state.last_ping_sent_time + next_allowed_ping_interval;
 
@@ -96,7 +106,8 @@ static void maybe_initiate_ping(grpc_chttp2_transport* t) {
         GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {
       gpr_log(
           GPR_INFO,
-          "%s: Ping delayed [%s]: not enough time elapsed since last ping. "
+          "%s: Ping delayed [%s]: not enough time elapsed since last "
+          "ping. "
           " Last ping %" PRId64 ": Next ping %" PRId64 ": Now %" PRId64,
           t->is_client ? "CLIENT" : "SERVER", t->peer_string.c_str(),
           t->ping_state.last_ping_sent_time.milliseconds_after_process_epoch(),
@@ -114,6 +125,7 @@ static void maybe_initiate_ping(grpc_chttp2_transport* t) {
     }
     return;
   }
+  t->ping_state.last_ping_sent_time = now;
 
   pq->inflight_id = t->ping_ctr;
   t->ping_ctr++;
@@ -124,7 +136,6 @@ static void maybe_initiate_ping(grpc_chttp2_transport* t) {
   grpc_slice_buffer_add(&t->outbuf,
                         grpc_chttp2_ping_create(false, pq->inflight_id));
   GRPC_STATS_INC_HTTP2_PINGS_SENT();
-  t->ping_state.last_ping_sent_time = now;
   if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace) ||
       GRPC_TRACE_FLAG_ENABLED(grpc_bdp_estimator_trace) ||
       GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {

data/src/core/ext/upb-generated/envoy/admin/v3/certs.upb.c

@@ -20,77 +20,80 @@ static const upb_MiniTable_Sub envoy_admin_v3_Certificates_submsgs[1] = {
 };
 
 static const upb_MiniTable_Field envoy_admin_v3_Certificates__fields[1] = {
-  {1, UPB_SIZE(0, 0), 0, 0, 11, kUpb_FieldMode_Array | (upb_FieldRep_Pointer << upb_FieldRep_Shift)},
+  {1, UPB_SIZE(0, 0), UPB_SIZE(0, 0), 0, 11, kUpb_FieldMode_Array | (kUpb_FieldRep_Pointer << kUpb_FieldRep_Shift)},
 };
 
 const upb_MiniTable envoy_admin_v3_Certificates_msginit = {
   &envoy_admin_v3_Certificates_submsgs[0],
   &envoy_admin_v3_Certificates__fields[0],
-  UPB_SIZE(8, 8), 1, upb_ExtMode_NonExtendable, 1, 255, 0,
+  UPB_SIZE(4, 8), 1, kUpb_ExtMode_NonExtendable, 1, 255, 0,
 };
 
-static const upb_MiniTable_Sub envoy_admin_v3_Certificate_submsgs[1] = {
+static const upb_MiniTable_Sub envoy_admin_v3_Certificate_submsgs[2] = {
+  {.submsg = &envoy_admin_v3_CertificateDetails_msginit},
   {.submsg = &envoy_admin_v3_CertificateDetails_msginit},
 };
 
 static const upb_MiniTable_Field envoy_admin_v3_Certificate__fields[2] = {
-  {1, UPB_SIZE(0, 0), 0, 0, 11, kUpb_FieldMode_Array | (upb_FieldRep_Pointer << upb_FieldRep_Shift)},
-  {2, UPB_SIZE(4, 8), 0, 0, 11, kUpb_FieldMode_Array | (upb_FieldRep_Pointer << upb_FieldRep_Shift)},
+  {1, UPB_SIZE(0, 0), UPB_SIZE(0, 0), 0, 11, kUpb_FieldMode_Array | (kUpb_FieldRep_Pointer << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(4, 8), UPB_SIZE(0, 0), 1, 11, kUpb_FieldMode_Array | (kUpb_FieldRep_Pointer << kUpb_FieldRep_Shift)},
 };
 
 const upb_MiniTable envoy_admin_v3_Certificate_msginit = {
   &envoy_admin_v3_Certificate_submsgs[0],
   &envoy_admin_v3_Certificate__fields[0],
-  UPB_SIZE(8, 16), 2, upb_ExtMode_NonExtendable, 2, 255, 0,
+  UPB_SIZE(8, 24), 2, kUpb_ExtMode_NonExtendable, 2, 255, 0,
 };
 
-static const upb_MiniTable_Sub envoy_admin_v3_CertificateDetails_submsgs[3] = {
-  {.submsg = &envoy_admin_v3_CertificateDetails_OcspDetails_msginit},
+static const upb_MiniTable_Sub envoy_admin_v3_CertificateDetails_submsgs[4] = {
   {.submsg = &envoy_admin_v3_SubjectAlternateName_msginit},
   {.submsg = &google_protobuf_Timestamp_msginit},
+  {.submsg = &google_protobuf_Timestamp_msginit},
+  {.submsg = &envoy_admin_v3_CertificateDetails_OcspDetails_msginit},
 };
 
 static const upb_MiniTable_Field envoy_admin_v3_CertificateDetails__fields[7] = {
-  {1, UPB_SIZE(16, 16), 0, 0, 9, kUpb_FieldMode_Scalar | (upb_FieldRep_StringView << upb_FieldRep_Shift)},
-  {2, UPB_SIZE(24, 32), 0, 0, 9, kUpb_FieldMode_Scalar | (upb_FieldRep_StringView << upb_FieldRep_Shift)},
-  {3, UPB_SIZE(44, 72), 0, 1, 11, kUpb_FieldMode_Array | (upb_FieldRep_Pointer << upb_FieldRep_Shift)},
-  {4, UPB_SIZE(8, 8), 0, 0, 4, kUpb_FieldMode_Scalar | (upb_FieldRep_8Byte << upb_FieldRep_Shift)},
-  {5, UPB_SIZE(32, 48), 1, 2, 11, kUpb_FieldMode_Scalar | (upb_FieldRep_Pointer << upb_FieldRep_Shift)},
-  {6, UPB_SIZE(36, 56), 2, 2, 11, kUpb_FieldMode_Scalar | (upb_FieldRep_Pointer << upb_FieldRep_Shift)},
-  {7, UPB_SIZE(40, 64), 3, 0, 11, kUpb_FieldMode_Scalar | (upb_FieldRep_Pointer << upb_FieldRep_Shift)},
+  {1, UPB_SIZE(4, 8), UPB_SIZE(0, 0), kUpb_NoSub, 9, kUpb_FieldMode_Scalar | (kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(12, 24), UPB_SIZE(0, 0), kUpb_NoSub, 9, kUpb_FieldMode_Scalar | (kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(20, 40), UPB_SIZE(0, 0), 0, 11, kUpb_FieldMode_Array | (kUpb_FieldRep_Pointer << kUpb_FieldRep_Shift)},
+  {4, UPB_SIZE(40, 72), UPB_SIZE(0, 0), kUpb_NoSub, 4, kUpb_FieldMode_Scalar | (kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {5, UPB_SIZE(24, 48), UPB_SIZE(1, 1), 1, 11, kUpb_FieldMode_Scalar | (kUpb_FieldRep_Pointer << kUpb_FieldRep_Shift)},
+  {6, UPB_SIZE(28, 56), UPB_SIZE(2, 2), 2, 11, kUpb_FieldMode_Scalar | (kUpb_FieldRep_Pointer << kUpb_FieldRep_Shift)},
+  {7, UPB_SIZE(32, 64), UPB_SIZE(3, 3), 3, 11, kUpb_FieldMode_Scalar | (kUpb_FieldRep_Pointer << kUpb_FieldRep_Shift)},
 };
 
 const upb_MiniTable envoy_admin_v3_CertificateDetails_msginit = {
   &envoy_admin_v3_CertificateDetails_submsgs[0],
   &envoy_admin_v3_CertificateDetails__fields[0],
-  UPB_SIZE(48, 80), 7, upb_ExtMode_NonExtendable, 7, 255, 0,
+  UPB_SIZE(48, 88), 7, kUpb_ExtMode_NonExtendable, 7, 255, 0,
 };
 
-static const upb_MiniTable_Sub envoy_admin_v3_CertificateDetails_OcspDetails_submsgs[1] = {
+static const upb_MiniTable_Sub envoy_admin_v3_CertificateDetails_OcspDetails_submsgs[2] = {
+  {.submsg = &google_protobuf_Timestamp_msginit},
   {.submsg = &google_protobuf_Timestamp_msginit},
 };
 
 static const upb_MiniTable_Field envoy_admin_v3_CertificateDetails_OcspDetails__fields[2] = {
-  {1, UPB_SIZE(4, 8), 1, 0, 11, kUpb_FieldMode_Scalar | (upb_FieldRep_Pointer << upb_FieldRep_Shift)},
-  {2, UPB_SIZE(8, 16), 2, 0, 11, kUpb_FieldMode_Scalar | (upb_FieldRep_Pointer << upb_FieldRep_Shift)},
+  {1, UPB_SIZE(4, 8), UPB_SIZE(1, 1), 0, 11, kUpb_FieldMode_Scalar | (kUpb_FieldRep_Pointer << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(8, 16), UPB_SIZE(2, 2), 1, 11, kUpb_FieldMode_Scalar | (kUpb_FieldRep_Pointer << kUpb_FieldRep_Shift)},
 };
 
 const upb_MiniTable envoy_admin_v3_CertificateDetails_OcspDetails_msginit = {
   &envoy_admin_v3_CertificateDetails_OcspDetails_submsgs[0],
   &envoy_admin_v3_CertificateDetails_OcspDetails__fields[0],
-  UPB_SIZE(16, 24), 2, upb_ExtMode_NonExtendable, 2, 255, 0,
+  UPB_SIZE(12, 24), 2, kUpb_ExtMode_NonExtendable, 2, 255, 0,
 };
 
 static const upb_MiniTable_Field envoy_admin_v3_SubjectAlternateName__fields[3] = {
-  {1, UPB_SIZE(0, 0), UPB_SIZE(-9, -17), 0, 9, kUpb_FieldMode_Scalar | (upb_FieldRep_StringView << upb_FieldRep_Shift)},
-  {2, UPB_SIZE(0, 0), UPB_SIZE(-9, -17), 0, 9, kUpb_FieldMode_Scalar | (upb_FieldRep_StringView << upb_FieldRep_Shift)},
-  {3, UPB_SIZE(0, 0), UPB_SIZE(-9, -17), 0, 9, kUpb_FieldMode_Scalar | (upb_FieldRep_StringView << upb_FieldRep_Shift)},
+  {1, UPB_SIZE(4, 8), UPB_SIZE(-1, -1), kUpb_NoSub, 9, kUpb_FieldMode_Scalar | (kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(4, 8), UPB_SIZE(-1, -1), kUpb_NoSub, 9, kUpb_FieldMode_Scalar | (kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(4, 8), UPB_SIZE(-1, -1), kUpb_NoSub, 9, kUpb_FieldMode_Scalar | (kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
 };
 
 const upb_MiniTable envoy_admin_v3_SubjectAlternateName_msginit = {
   NULL,
   &envoy_admin_v3_SubjectAlternateName__fields[0],
-  UPB_SIZE(16, 32), 3, upb_ExtMode_NonExtendable, 3, 255, 0,
+  UPB_SIZE(12, 24), 3, kUpb_ExtMode_NonExtendable, 3, 255, 0,
 };
 
 static const upb_MiniTable *messages_layout[5] = {