Merge github.com:grpc/grpc into propagate
diff --git a/Makefile b/Makefile
index 194810c..33a86b4 100644
--- a/Makefile
+++ b/Makefile
@@ -20268,6 +20268,8 @@
 # This is to ensure the embedded OpenSSL is built beforehand, properly
 # installing headers to their final destination on the drive. We need this
 # otherwise parallel compilation will fail if a source is compiled first.
+examples/pubsub/publisher.cc: $(OPENSSL_DEP)
+examples/pubsub/subscriber.cc: $(OPENSSL_DEP)
 src/core/httpcli/format_request.c: $(OPENSSL_DEP)
 src/core/httpcli/httpcli.c: $(OPENSSL_DEP)
 src/core/httpcli/httpcli_security_connector.c: $(OPENSSL_DEP)
@@ -20292,6 +20294,42 @@
 src/core/tsi/fake_transport_security.c: $(OPENSSL_DEP)
 src/core/tsi/ssl_transport_security.c: $(OPENSSL_DEP)
 src/core/tsi/transport_security.c: $(OPENSSL_DEP)
+src/cpp/client/secure_channel_arguments.cc: $(OPENSSL_DEP)
+src/cpp/client/secure_credentials.cc: $(OPENSSL_DEP)
+src/cpp/common/auth_property_iterator.cc: $(OPENSSL_DEP)
+src/cpp/common/secure_auth_context.cc: $(OPENSSL_DEP)
+src/cpp/common/secure_create_auth_context.cc: $(OPENSSL_DEP)
+src/cpp/server/secure_server_credentials.cc: $(OPENSSL_DEP)
+src/csharp/ext/grpc_csharp_ext.c: $(OPENSSL_DEP)
+test/core/bad_client/bad_client.c: $(OPENSSL_DEP)
+test/core/end2end/data/server1_cert.c: $(OPENSSL_DEP)
+test/core/end2end/data/server1_key.c: $(OPENSSL_DEP)
+test/core/end2end/data/test_root_cert.c: $(OPENSSL_DEP)
+test/core/end2end/fixtures/chttp2_fake_security.c: $(OPENSSL_DEP)
+test/core/end2end/fixtures/chttp2_simple_ssl_fullstack.c: $(OPENSSL_DEP)
+test/core/end2end/fixtures/chttp2_simple_ssl_fullstack_with_poll.c: $(OPENSSL_DEP)
+test/core/end2end/fixtures/chttp2_simple_ssl_with_oauth2_fullstack.c: $(OPENSSL_DEP)
+test/core/end2end/tests/request_response_with_payload_and_call_creds.c: $(OPENSSL_DEP)
+test/cpp/interop/client.cc: $(OPENSSL_DEP)
+test/cpp/interop/client_helper.cc: $(OPENSSL_DEP)
+test/cpp/interop/interop_client.cc: $(OPENSSL_DEP)
+test/cpp/interop/server.cc: $(OPENSSL_DEP)
+test/cpp/interop/server_helper.cc: $(OPENSSL_DEP)
+test/cpp/qps/client_async.cc: $(OPENSSL_DEP)
+test/cpp/qps/client_sync.cc: $(OPENSSL_DEP)
+test/cpp/qps/driver.cc: $(OPENSSL_DEP)
+test/cpp/qps/perf_db_client.cc: $(OPENSSL_DEP)
+test/cpp/qps/qps_worker.cc: $(OPENSSL_DEP)
+test/cpp/qps/report.cc: $(OPENSSL_DEP)
+test/cpp/qps/server_async.cc: $(OPENSSL_DEP)
+test/cpp/qps/server_sync.cc: $(OPENSSL_DEP)
+test/cpp/qps/timer.cc: $(OPENSSL_DEP)
+test/cpp/util/benchmark_config.cc: $(OPENSSL_DEP)
+test/cpp/util/cli_call.cc: $(OPENSSL_DEP)
+test/cpp/util/create_test_channel.cc: $(OPENSSL_DEP)
+test/cpp/util/fake_credentials.cc: $(OPENSSL_DEP)
+test/cpp/util/subprocess.cc: $(OPENSSL_DEP)
+test/cpp/util/test_config.cc: $(OPENSSL_DEP)
 endif
 
 .PHONY: all strip tools dep_error openssl_dep_error openssl_dep_message git_update stop buildtests buildtests_c buildtests_cxx test test_c test_cxx install install_c install_cxx install-headers install-headers_c install-headers_cxx install-shared install-shared_c install-shared_cxx install-static install-static_c install-static_cxx strip strip-shared strip-static strip_c strip-shared_c strip-static_c strip_cxx strip-shared_cxx strip-static_cxx dep_c dep_cxx bins_dep_c bins_dep_cxx clean
diff --git a/README.md b/README.md
index 36d9fa0..f830629 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-[![Build Status](https://travis-ci.org/grpc/grpc.svg?branch=master)](https://travis-ci.org/grpc/grpc)
+[![Build Status](https://grpc-testing.appspot.com/job/gRPC_master/badge/icon)](https://grpc-testing.appspot.com/job/gRPC_master)
 [![Coverage Status](https://img.shields.io/coveralls/grpc/grpc.svg)](https://coveralls.io/r/grpc/grpc?branch=master)
 
 [gRPC - An RPC library and framework](http://github.com/grpc/grpc)
diff --git a/include/grpc++/client_context.h b/include/grpc++/client_context.h
index 5cf4d33..10c967d 100644
--- a/include/grpc++/client_context.h
+++ b/include/grpc++/client_context.h
@@ -118,6 +118,12 @@
 
   std::shared_ptr<const AuthContext> auth_context() const;
 
+  // Return the peer uri in a string.
+  // WARNING: this value is never authenticated or subject to any security
+  // related code. It must not be used for any authentication related
+  // functionality. Instead, use auth_context.
+  grpc::string peer() const;
+
   // Get and set census context
   void set_census_context(struct census_context* ccp) { census_context_ = ccp; }
   struct census_context* census_context() const { return census_context_; }
diff --git a/include/grpc++/server_context.h b/include/grpc++/server_context.h
index e204d66..cf2732b 100644
--- a/include/grpc++/server_context.h
+++ b/include/grpc++/server_context.h
@@ -117,6 +117,12 @@
 
   std::shared_ptr<const AuthContext> auth_context() const;
 
+  // Return the peer uri in a string.
+  // WARNING: this value is never authenticated or subject to any security
+  // related code. It must not be used for any authentication related
+  // functionality. Instead, use auth_context.
+  grpc::string peer() const;
+
   const struct census_context* census_context() const;
 
  private:
diff --git a/include/grpc/grpc.h b/include/grpc/grpc.h
index 28511a6..a1287b3 100644
--- a/include/grpc/grpc.h
+++ b/include/grpc/grpc.h
@@ -435,14 +435,10 @@
     Once the channel connectivity state is different from last_observed_state,
     tag will be enqueued on cq with success=1.
     If deadline expires BEFORE the state is changed, tag will be enqueued on cq
-    with success=0.
-    If optional_new_state is non-NULL, it will be set to the newly observed
-    connectivity state of the channel at the same point as tag is enqueued onto 
-    the completion queue. */
+    with success=0. */
 void grpc_channel_watch_connectivity_state(
     grpc_channel *channel, grpc_connectivity_state last_observed_state,
-    grpc_connectivity_state *optional_new_state, gpr_timespec deadline,
-    grpc_completion_queue *cq, void *tag);
+    gpr_timespec deadline, grpc_completion_queue *cq, void *tag);
 
 /** Create a call given a grpc_channel, in order to call 'method'. All
     completions are sent to 'completion_queue'. 'method' and 'host' need only
diff --git a/src/compiler/generator_helpers.h b/src/compiler/generator_helpers.h
index 7bdaff1..68b807b 100644
--- a/src/compiler/generator_helpers.h
+++ b/src/compiler/generator_helpers.h
@@ -126,7 +126,13 @@
 }
 
 inline grpc::string FileNameInUpperCamel(const grpc::protobuf::FileDescriptor *file) {
-  return LowerUnderscoreToUpperCamel(StripProto(file->name()));
+  std::vector<grpc::string> tokens = tokenize(StripProto(file->name()), "/");
+  grpc::string result = "";
+  for (unsigned int i = 0; i < tokens.size() - 1; i++) {
+    result += tokens[i] + "/";
+  }
+  result += LowerUnderscoreToUpperCamel(tokens.back());
+  return result;
 }
 
 enum MethodType {
diff --git a/src/core/iomgr/fd_posix.c b/src/core/iomgr/fd_posix.c
index a2df838..cbc141a 100644
--- a/src/core/iomgr/fd_posix.c
+++ b/src/core/iomgr/fd_posix.c
@@ -376,13 +376,15 @@
     return 0;
   }
   /* if there is nobody polling for read, but we need to, then start doing so */
-  if (read_mask && !fd->read_watcher && gpr_atm_acq_load(&fd->readst) > READY) {
+  if (read_mask && !fd->read_watcher &&
+      (gpr_uintptr)gpr_atm_acq_load(&fd->readst) > READY) {
     fd->read_watcher = watcher;
     mask |= read_mask;
   }
   /* if there is nobody polling for write, but we need to, then start doing so
    */
-  if (write_mask && !fd->write_watcher && gpr_atm_acq_load(&fd->writest) > READY) {
+  if (write_mask && !fd->write_watcher &&
+      (gpr_uintptr)gpr_atm_acq_load(&fd->writest) > READY) {
     fd->write_watcher = watcher;
     mask |= write_mask;
   }
diff --git a/src/core/iomgr/sockaddr_utils.c b/src/core/iomgr/sockaddr_utils.c
index 71ac12e..65ec1f9 100644
--- a/src/core/iomgr/sockaddr_utils.c
+++ b/src/core/iomgr/sockaddr_utils.c
@@ -170,6 +170,11 @@
 char *grpc_sockaddr_to_uri(const struct sockaddr *addr) {
   char *temp;
   char *result;
+  struct sockaddr_in addr_normalized;
+
+  if (grpc_sockaddr_is_v4mapped(addr, &addr_normalized)) {
+    addr = (const struct sockaddr *)&addr_normalized;
+  }
 
   switch (addr->sa_family) {
     case AF_INET:
diff --git a/src/core/iomgr/tcp_server_windows.c b/src/core/iomgr/tcp_server_windows.c
index bcd2aa8..0adbe95 100644
--- a/src/core/iomgr/tcp_server_windows.c
+++ b/src/core/iomgr/tcp_server_windows.c
@@ -186,6 +186,17 @@
   return -1;
 }
 
+static void decrement_active_ports_and_notify(server_port *sp) {
+  sp->shutting_down = 0;
+  sp->socket->read_info.outstanding = 0;
+  gpr_mu_lock(&sp->server->mu);
+  GPR_ASSERT(sp->server->active_ports > 0);
+  if (0 == --sp->server->active_ports) {
+    gpr_cv_broadcast(&sp->server->cv);
+  }
+  gpr_mu_unlock(&sp->server->mu);
+}
+
 /* start_accept will reference that for the IOCP notification request. */
 static void on_accept(void *arg, int from_iocp);
 
@@ -234,6 +245,15 @@
   return;
 
 failure:
+  if (port->shutting_down) {
+    /* We are abandoning the listener port, take that into account to prevent
+       occasional hangs on shutdown. The hang happens when sp->shutting_down
+       change is not seen by on_accept and we proceed to trying new accept,
+       but we fail there because the listening port has been closed in the
+       meantime. */
+    decrement_active_ports_and_notify(port);
+    return;
+  }
   utf8_message = gpr_format_message(WSAGetLastError());
   gpr_log(GPR_ERROR, message, utf8_message);
   gpr_free(utf8_message);
@@ -277,14 +297,7 @@
     if (sp->shutting_down) {
       /* During the shutdown case, we ARE expecting an error. So that's well,
          and we can wake up the shutdown thread. */
-      sp->shutting_down = 0;
-      sp->socket->read_info.outstanding = 0;
-      gpr_mu_lock(&sp->server->mu);
-      GPR_ASSERT(sp->server->active_ports > 0);
-      if (0 == --sp->server->active_ports) {
-        gpr_cv_broadcast(&sp->server->cv);
-      }
-      gpr_mu_unlock(&sp->server->mu);
+      decrement_active_ports_and_notify(sp);
       return;
     } else {
       char *utf8_message = gpr_format_message(WSAGetLastError());
diff --git a/src/core/iomgr/tcp_windows.c b/src/core/iomgr/tcp_windows.c
index 5e0457a..89aa741 100644
--- a/src/core/iomgr/tcp_windows.c
+++ b/src/core/iomgr/tcp_windows.c
@@ -369,14 +369,16 @@
 }
 
 static void win_add_to_pollset(grpc_endpoint *ep, grpc_pollset *ps) {
+  grpc_tcp *tcp;
   (void) ps;
-  grpc_tcp *tcp = (grpc_tcp *) ep;
+  tcp = (grpc_tcp *) ep;
   grpc_iocp_add_socket(tcp->socket);
 }
 
 static void win_add_to_pollset_set(grpc_endpoint *ep, grpc_pollset_set *pss) {
+  grpc_tcp *tcp;
   (void) pss;
-  grpc_tcp *tcp = (grpc_tcp *) ep;
+  tcp = (grpc_tcp *) ep;
   grpc_iocp_add_socket(tcp->socket);
 }
 
diff --git a/src/core/surface/channel.c b/src/core/surface/channel.c
index fe71bc0..8692aa3 100644
--- a/src/core/surface/channel.c
+++ b/src/core/surface/channel.c
@@ -234,7 +234,9 @@
     registered_call *rc = channel->registered_calls;
     channel->registered_calls = rc->next;
     GRPC_MDELEM_UNREF(rc->path);
-    GRPC_MDELEM_UNREF(rc->authority);
+    if (rc->authority) {
+      GRPC_MDELEM_UNREF(rc->authority);
+    }
     gpr_free(rc);
   }
   grpc_mdctx_unref(channel->metadata_context);
diff --git a/src/core/surface/channel_connectivity.c b/src/core/surface/channel_connectivity.c
index b6ea86d..1223706 100644
--- a/src/core/surface/channel_connectivity.c
+++ b/src/core/surface/channel_connectivity.c
@@ -70,7 +70,6 @@
   grpc_iomgr_closure on_complete;
   grpc_alarm alarm;
   grpc_connectivity_state state;
-  grpc_connectivity_state *optional_new_state;
   grpc_completion_queue *cq;
   grpc_cq_completion completion_storage;
   grpc_channel *channel;
@@ -124,9 +123,6 @@
   switch (w->phase) {
     case WAITING:
       w->phase = CALLING_BACK;
-      if (w->optional_new_state) {
-        *w->optional_new_state = w->state;
-      }
       grpc_cq_end_op(w->cq, w->tag, w->success, finished_completion, w,
                      &w->completion_storage);
       break;
@@ -154,8 +150,7 @@
 
 void grpc_channel_watch_connectivity_state(
     grpc_channel *channel, grpc_connectivity_state last_observed_state,
-    grpc_connectivity_state *optional_new_state, gpr_timespec deadline,
-    grpc_completion_queue *cq, void *tag) {
+    gpr_timespec deadline, grpc_completion_queue *cq, void *tag) {
   grpc_channel_element *client_channel_elem =
       grpc_channel_stack_last_element(grpc_channel_get_channel_stack(channel));
   state_watcher *w = gpr_malloc(sizeof(*w));
@@ -167,7 +162,6 @@
   w->phase = WAITING;
   w->state = last_observed_state;
   w->success = 0;
-  w->optional_new_state = optional_new_state;
   w->cq = cq;
   w->tag = tag;
   w->channel = channel;
diff --git a/src/core/transport/chttp2/alpn.c b/src/core/transport/chttp2/alpn.c
index 3ccd579..69da4e6 100644
--- a/src/core/transport/chttp2/alpn.c
+++ b/src/core/transport/chttp2/alpn.c
@@ -36,8 +36,7 @@
 #include <grpc/support/useful.h>
 
 /* in order of preference */
-static const char *const supported_versions[] = {"h2", "h2-17", "h2-16",
-                                                 "h2-15", "h2-14"};
+static const char *const supported_versions[] = {"h2"};
 
 int grpc_chttp2_is_alpn_version_supported(const char *version, size_t size) {
   size_t i;
diff --git a/src/cpp/client/channel.cc b/src/cpp/client/channel.cc
index 463e8bc..1912e5e 100644
--- a/src/cpp/client/channel.cc
+++ b/src/cpp/client/channel.cc
@@ -51,13 +51,16 @@
 
 namespace grpc {
 
-Channel::Channel(const grpc::string& target, grpc_channel* channel)
-    : target_(target), c_channel_(channel) {}
+Channel::Channel(grpc_channel* channel) : c_channel_(channel) {}
+
+Channel::Channel(const grpc::string& host, grpc_channel* channel)
+    : host_(host), c_channel_(channel) {}
 
 Channel::~Channel() { grpc_channel_destroy(c_channel_); }
 
 Call Channel::CreateCall(const RpcMethod& method, ClientContext* context,
                          CompletionQueue* cq) {
+  const char* host_str = host_.empty() ? NULL : host_.c_str();
   auto c_call = method.channel_tag() && context->authority().empty()
                     ? grpc_channel_create_registered_call(
                           c_channel_, NULL, GRPC_PROPAGATE_DEFAULTS, cq->cq(),
@@ -65,7 +68,7 @@
                     : grpc_channel_create_call(
                           c_channel_, NULL, GRPC_PROPAGATE_DEFAULTS, cq->cq(),
                           method.name(), context->authority().empty()
-                                             ? target_.c_str()
+                                             ? host_str
                                              : context->authority().c_str(),
                           context->raw_deadline());
   grpc_census_call_set_context(c_call, context->census_context());
@@ -86,7 +89,8 @@
 }
 
 void* Channel::RegisterMethod(const char* method) {
-  return grpc_channel_register_call(c_channel_, method, target_.c_str());
+  return grpc_channel_register_call(c_channel_, method,
+                                    host_.empty() ? NULL : host_.c_str());
 }
 
 }  // namespace grpc
diff --git a/src/cpp/client/channel.h b/src/cpp/client/channel.h
index 9108713..8660146 100644
--- a/src/cpp/client/channel.h
+++ b/src/cpp/client/channel.h
@@ -52,7 +52,8 @@
 
 class Channel GRPC_FINAL : public GrpcLibrary, public ChannelInterface {
  public:
-  Channel(const grpc::string& target, grpc_channel* c_channel);
+  explicit Channel(grpc_channel* c_channel);
+  Channel(const grpc::string& host, grpc_channel* c_channel);
   ~Channel() GRPC_OVERRIDE;
 
   virtual void* RegisterMethod(const char* method) GRPC_OVERRIDE;
@@ -62,7 +63,7 @@
                                 Call* call) GRPC_OVERRIDE;
 
  private:
-  const grpc::string target_;
+  const grpc::string host_;
   grpc_channel* const c_channel_;  // owned
 };
 
diff --git a/src/cpp/client/client_context.cc b/src/cpp/client/client_context.cc
index 14ab772..c38d0c1 100644
--- a/src/cpp/client/client_context.cc
+++ b/src/cpp/client/client_context.cc
@@ -34,6 +34,7 @@
 #include <grpc++/client_context.h>
 
 #include <grpc/grpc.h>
+#include <grpc/support/alloc.h>
 #include <grpc/support/string_util.h>
 #include <grpc++/credentials.h>
 #include <grpc++/time.h>
@@ -104,4 +105,14 @@
   }
 }
 
+grpc::string ClientContext::peer() const {
+  grpc::string peer;
+  if (call_) {
+    char* c_peer = grpc_call_get_peer(call_);
+    peer = c_peer;
+    gpr_free(c_peer);
+  }
+  return peer;
+}
+
 }  // namespace grpc
diff --git a/src/cpp/client/create_channel.cc b/src/cpp/client/create_channel.cc
index dbe2694..21d01b7 100644
--- a/src/cpp/client/create_channel.cc
+++ b/src/cpp/client/create_channel.cc
@@ -51,7 +51,7 @@
   cp_args.SetString(GRPC_ARG_PRIMARY_USER_AGENT_STRING,
                     user_agent_prefix.str());
   return creds ? creds->CreateChannel(target, cp_args)
-               : std::shared_ptr<ChannelInterface>(new Channel(
-                     target, grpc_lame_client_channel_create(NULL)));
+               : std::shared_ptr<ChannelInterface>(
+                     new Channel(grpc_lame_client_channel_create(NULL)));
 }
 }  // namespace grpc
diff --git a/src/cpp/client/insecure_credentials.cc b/src/cpp/client/insecure_credentials.cc
index e802fa8..d8dcaa1 100644
--- a/src/cpp/client/insecure_credentials.cc
+++ b/src/cpp/client/insecure_credentials.cc
@@ -49,7 +49,7 @@
     grpc_channel_args channel_args;
     args.SetChannelArgs(&channel_args);
     return std::shared_ptr<ChannelInterface>(new Channel(
-        target, grpc_insecure_channel_create(target.c_str(), &channel_args)));
+        grpc_insecure_channel_create(target.c_str(), &channel_args)));
   }
 
   // InsecureCredentials should not be applied to a call.
diff --git a/src/cpp/client/secure_credentials.cc b/src/cpp/client/secure_credentials.cc
index abf0cb3..2d6114e 100644
--- a/src/cpp/client/secure_credentials.cc
+++ b/src/cpp/client/secure_credentials.cc
@@ -44,8 +44,7 @@
   grpc_channel_args channel_args;
   args.SetChannelArgs(&channel_args);
   return std::shared_ptr<ChannelInterface>(new Channel(
-      args.GetSslTargetNameOverride().empty() ? target
-                                              : args.GetSslTargetNameOverride(),
+      args.GetSslTargetNameOverride(),
       grpc_secure_channel_create(c_creds_, target.c_str(), &channel_args)));
 }
 
diff --git a/src/cpp/server/server_context.cc b/src/cpp/server/server_context.cc
index f6c0730..cf19556 100644
--- a/src/cpp/server/server_context.cc
+++ b/src/cpp/server/server_context.cc
@@ -34,6 +34,7 @@
 #include <grpc++/server_context.h>
 
 #include <grpc/grpc.h>
+#include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc++/impl/call.h>
 #include <grpc++/impl/sync.h>
@@ -179,6 +180,16 @@
   return auth_context_;
 }
 
+grpc::string ServerContext::peer() const {
+  grpc::string peer;
+  if (call_) {
+    char* c_peer = grpc_call_get_peer(call_);
+    peer = c_peer;
+    gpr_free(c_peer);
+  }
+  return peer;
+}
+
 const struct census_context* ServerContext::census_context() const {
   return grpc_census_call_get_context(call_);
 }
diff --git a/src/csharp/Grpc.Auth/OAuth2Interceptors.cs b/src/csharp/Grpc.Auth/OAuth2Interceptors.cs
index c785ca5..cc9d2c1 100644
--- a/src/csharp/Grpc.Auth/OAuth2Interceptors.cs
+++ b/src/csharp/Grpc.Auth/OAuth2Interceptors.cs
@@ -119,7 +119,5 @@
                 return new Metadata.Entry(AuthorizationHeader, Schema + " " + accessToken);
             }
         }
-
-
     }
 }
diff --git a/src/csharp/Grpc.Core.Tests/ChannelTest.cs b/src/csharp/Grpc.Core.Tests/ChannelTest.cs
new file mode 100644
index 0000000..60b4517
--- /dev/null
+++ b/src/csharp/Grpc.Core.Tests/ChannelTest.cs
@@ -0,0 +1,91 @@
+#region Copyright notice and license
+
+// Copyright 2015, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#endregion
+
+using System;
+using Grpc.Core;
+using Grpc.Core.Internal;
+using Grpc.Core.Utils;
+using NUnit.Framework;
+
+namespace Grpc.Core.Tests
+{
+    public class ChannelTest
+    {
+        [TestFixtureTearDown]
+        public void CleanupClass()
+        {
+            GrpcEnvironment.Shutdown();
+        }
+
+        [Test]
+        public void Constructor_RejectsInvalidParams()
+        {
+            Assert.Throws(typeof(NullReferenceException), () => new Channel(null, Credentials.Insecure));
+        }
+
+        [Test]
+        public void State_IdleAfterCreation()
+        {
+            using (var channel = new Channel("localhost", Credentials.Insecure))
+            {
+                Assert.AreEqual(ChannelState.Idle, channel.State);
+            }
+        }
+
+        [Test]
+        public void WaitForStateChangedAsync_InvalidArgument()
+        {
+            using (var channel = new Channel("localhost", Credentials.Insecure))
+            {
+                Assert.Throws(typeof(ArgumentException), () => channel.WaitForStateChangedAsync(ChannelState.FatalFailure));
+            }
+        }
+
+        [Test]
+        public void Target()
+        {
+            using (var channel = new Channel("127.0.0.1", Credentials.Insecure))
+            {
+                Assert.IsTrue(channel.Target.Contains("127.0.0.1"));
+            }
+        }
+
+        [Test]
+        public void Dispose_IsIdempotent()
+        {
+            var channel = new Channel("localhost", Credentials.Insecure);
+            channel.Dispose();
+            channel.Dispose();
+        }
+    }
+}
diff --git a/src/csharp/Grpc.Core.Tests/ClientServerTest.cs b/src/csharp/Grpc.Core.Tests/ClientServerTest.cs
index 540fe75..3592486 100644
--- a/src/csharp/Grpc.Core.Tests/ClientServerTest.cs
+++ b/src/csharp/Grpc.Core.Tests/ClientServerTest.cs
@@ -276,6 +276,30 @@
             Assert.IsTrue(peer.Contains(Host));
         }
 
+        [Test]
+        public async Task Channel_WaitForStateChangedAsync()
+        {
+            Assert.Throws(typeof(TaskCanceledException), 
+                async () => await channel.WaitForStateChangedAsync(channel.State, DateTime.UtcNow.AddMilliseconds(10)));
+
+            var stateChangedTask = channel.WaitForStateChangedAsync(channel.State);
+
+            var internalCall = new Call<string, string>(ServiceName, EchoMethod, channel, Metadata.Empty);
+            await Calls.AsyncUnaryCall(internalCall, "abc", CancellationToken.None);
+
+            await stateChangedTask;
+            Assert.AreEqual(ChannelState.Ready, channel.State);
+        }
+
+        [Test]
+        public async Task Channel_ConnectAsync()
+        {
+            await channel.ConnectAsync();
+            Assert.AreEqual(ChannelState.Ready, channel.State);
+            await channel.ConnectAsync(DateTime.UtcNow.AddMilliseconds(1000));
+            Assert.AreEqual(ChannelState.Ready, channel.State);
+        }
+
         private static async Task<string> EchoHandler(string request, ServerCallContext context)
         {
             foreach (Metadata.Entry metadataEntry in context.RequestHeaders)
diff --git a/src/csharp/Grpc.Core.Tests/Grpc.Core.Tests.csproj b/src/csharp/Grpc.Core.Tests/Grpc.Core.Tests.csproj
index 242a60d..f2bf459 100644
--- a/src/csharp/Grpc.Core.Tests/Grpc.Core.Tests.csproj
+++ b/src/csharp/Grpc.Core.Tests/Grpc.Core.Tests.csproj
@@ -76,6 +76,7 @@
     <Compile Include="Internal\TimespecTest.cs" />
     <Compile Include="TimeoutsTest.cs" />
     <Compile Include="NUnitVersionTest.cs" />
+    <Compile Include="ChannelTest.cs" />
   </ItemGroup>
   <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
   <ItemGroup>
diff --git a/src/csharp/Grpc.Core.Tests/NUnitVersionTest.cs b/src/csharp/Grpc.Core.Tests/NUnitVersionTest.cs
index 600df1a..3fa6ad0 100644
--- a/src/csharp/Grpc.Core.Tests/NUnitVersionTest.cs
+++ b/src/csharp/Grpc.Core.Tests/NUnitVersionTest.cs
@@ -70,10 +70,8 @@
         [Test]
         public async Task NUnitVersionTest2()
         {
-            testRunCount ++;
+            testRunCount++;
             await Task.Delay(10);
         }
-
-
     }
 }
diff --git a/src/csharp/Grpc.Core.Tests/TimeoutsTest.cs b/src/csharp/Grpc.Core.Tests/TimeoutsTest.cs
index 010ffd8..a09273b 100644
--- a/src/csharp/Grpc.Core.Tests/TimeoutsTest.cs
+++ b/src/csharp/Grpc.Core.Tests/TimeoutsTest.cs
@@ -134,7 +134,8 @@
             }
             catch (RpcException e)
             {
-                Assert.AreEqual(StatusCode.DeadlineExceeded, e.Status.StatusCode);
+                // We can't guarantee the status code always DeadlineExceeded. See issue #2685.
+                Assert.Contains(e.Status.StatusCode, new[] { StatusCode.DeadlineExceeded, StatusCode.Internal });
             }
         }
 
@@ -151,7 +152,8 @@
             }
             catch (RpcException e)
             {
-                Assert.AreEqual(StatusCode.DeadlineExceeded, e.Status.StatusCode);
+                // We can't guarantee the status code always DeadlineExceeded. See issue #2685.
+                Assert.Contains(e.Status.StatusCode, new[] { StatusCode.DeadlineExceeded, StatusCode.Internal });
             }
         }
 
@@ -168,7 +170,8 @@
             }
             catch (RpcException e)
             {
-                Assert.AreEqual(StatusCode.DeadlineExceeded, e.Status.StatusCode);
+                // We can't guarantee the status code is always DeadlineExceeded. See issue #2685.
+                Assert.Contains(e.Status.StatusCode, new[] { StatusCode.DeadlineExceeded, StatusCode.Internal });
             }
             Assert.AreEqual("CANCELLED", stringFromServerHandlerTcs.Task.Result);
         }
diff --git a/src/csharp/Grpc.Core/Channel.cs b/src/csharp/Grpc.Core/Channel.cs
index 18e6f2f..0b69610 100644
--- a/src/csharp/Grpc.Core/Channel.cs
+++ b/src/csharp/Grpc.Core/Channel.cs
@@ -37,6 +37,8 @@
 using System.Threading.Tasks;
 
 using Grpc.Core.Internal;
+using Grpc.Core.Logging;
+using Grpc.Core.Utils;
 
 namespace Grpc.Core
 {
@@ -45,21 +47,23 @@
     /// </summary>
     public class Channel : IDisposable
     {
+        static readonly ILogger Logger = GrpcEnvironment.Logger.ForType<Channel>();
+
         readonly GrpcEnvironment environment;
         readonly ChannelSafeHandle handle;
         readonly List<ChannelOption> options;
-        readonly string target;
         bool disposed;
 
         /// <summary>
         /// Creates a channel that connects to a specific host.
-        /// Port will default to 80 for an unsecure channel and to 443 a secure channel.
+        /// Port will default to 80 for an unsecure channel and to 443 for a secure channel.
         /// </summary>
-        /// <param name="host">The DNS name of IP address of the host.</param>
+        /// <param name="host">The name or IP address of the host.</param>
         /// <param name="credentials">Credentials to secure the channel.</param>
         /// <param name="options">Channel options.</param>
         public Channel(string host, Credentials credentials, IEnumerable<ChannelOption> options = null)
         {
+            Preconditions.CheckNotNull(host);
             this.environment = GrpcEnvironment.GetInstance();
             this.options = options != null ? new List<ChannelOption>(options) : new List<ChannelOption>();
 
@@ -76,14 +80,13 @@
                     this.handle = ChannelSafeHandle.CreateInsecure(host, nativeChannelArgs);
                 }
             }
-            this.target = GetOverridenTarget(host, this.options);
         }
 
         /// <summary>
         /// Creates a channel that connects to a specific host and port.
         /// </summary>
-        /// <param name="host">DNS name or IP address</param>
-        /// <param name="port">the port</param>
+        /// <param name="host">The name or IP address of the host.</param>
+        /// <param name="port">The port.</param>
         /// <param name="credentials">Credentials to secure the channel.</param>
         /// <param name="options">Channel options.</param>
         public Channel(string host, int port, Credentials credentials, IEnumerable<ChannelOption> options = null) :
@@ -91,20 +94,82 @@
         {
         }
 
+        /// <summary>
+        /// Gets current connectivity state of this channel.
+        /// </summary>
+        public ChannelState State
+        {
+            get
+            {
+                return handle.CheckConnectivityState(false);        
+            }
+        }
+
+        /// <summary>
+        /// Returned tasks completes once channel state has become different from 
+        /// given lastObservedState. 
+        /// If deadline is reached or and error occurs, returned task is cancelled.
+        /// </summary>
+        public Task WaitForStateChangedAsync(ChannelState lastObservedState, DateTime? deadline = null)
+        {
+            Preconditions.CheckArgument(lastObservedState != ChannelState.FatalFailure,
+                "FatalFailure is a terminal state. No further state changes can occur.");
+            var tcs = new TaskCompletionSource<object>();
+            var deadlineTimespec = deadline.HasValue ? Timespec.FromDateTime(deadline.Value) : Timespec.InfFuture;
+            var handler = new BatchCompletionDelegate((success, ctx) =>
+            {
+                if (success)
+                {
+                    tcs.SetResult(null);
+                }
+                else
+                {
+                    tcs.SetCanceled();
+                }
+            });
+            handle.WatchConnectivityState(lastObservedState, deadlineTimespec, environment.CompletionQueue, environment.CompletionRegistry, handler);
+            return tcs.Task;
+        }
+
+        /// <summary> Address of the remote endpoint in URI format.</summary>
+        public string Target
+        {
+            get
+            {
+                return handle.GetTarget();
+            }
+        }
+
+        /// <summary>
+        /// Allows explicitly requesting channel to connect without starting an RPC.
+        /// Returned task completes once state Ready was seen. If the deadline is reached,
+        /// or channel enters the FatalFailure state, the task is cancelled.
+        /// There is no need to call this explicitly unless your use case requires that.
+        /// Starting an RPC on a new channel will request connection implicitly.
+        /// </summary>
+        public async Task ConnectAsync(DateTime? deadline = null)
+        {
+            var currentState = handle.CheckConnectivityState(true);
+            while (currentState != ChannelState.Ready)
+            {
+                if (currentState == ChannelState.FatalFailure)
+                {
+                    throw new OperationCanceledException("Channel has reached FatalFailure state.");
+                }
+                await WaitForStateChangedAsync(currentState, deadline);
+                currentState = handle.CheckConnectivityState(false);
+            }
+        }
+
+        /// <summary>
+        /// Destroys the underlying channel.
+        /// </summary>
         public void Dispose()
         {
             Dispose(true);
             GC.SuppressFinalize(this);
         }
 
-        internal string Target
-        {
-            get
-            {
-                return target;
-            }
-        }
-
         internal ChannelSafeHandle Handle
         {
             get
@@ -159,26 +224,5 @@
             // TODO(jtattermusch): it would be useful to also provide .NET/mono version.
             return string.Format("grpc-csharp/{0}", VersionInfo.CurrentVersion);
         }
-
-        /// <summary>
-        /// Look for SslTargetNameOverride option and return its value instead of originalTarget
-        /// if found.
-        /// </summary>
-        private static string GetOverridenTarget(string originalTarget, IEnumerable<ChannelOption> options)
-        {
-            if (options == null)
-            {
-                return originalTarget;
-            }
-            foreach (var option in options)
-            {
-                if (option.Type == ChannelOption.OptionType.String
-                    && option.Name == ChannelOptions.SslTargetNameOverride)
-                {
-                    return option.StringValue;
-                }
-            }
-            return originalTarget;
-        }
     }
 }
diff --git a/src/csharp/Grpc.Core/ChannelOptions.cs b/src/csharp/Grpc.Core/ChannelOptions.cs
index 9fe03d2..f70408d 100644
--- a/src/csharp/Grpc.Core/ChannelOptions.cs
+++ b/src/csharp/Grpc.Core/ChannelOptions.cs
@@ -135,6 +135,9 @@
         /// <summary>Initial sequence number for http2 transports</summary>
         public const string Http2InitialSequenceNumber = "grpc.http2.initial_sequence_number";
 
+        /// <summary>Default authority for calls.</summary>
+        public const string DefaultAuthority = "grpc.default_authority";
+
         /// <summary>Primary user agent: goes at the start of the user-agent metadata</summary>
         public const string PrimaryUserAgentString = "grpc.primary_user_agent";
 
diff --git a/src/csharp/Grpc.Core/ChannelState.cs b/src/csharp/Grpc.Core/ChannelState.cs
new file mode 100644
index 0000000..d293b98
--- /dev/null
+++ b/src/csharp/Grpc.Core/ChannelState.cs
@@ -0,0 +1,69 @@
+#region Copyright notice and license
+
+// Copyright 2015, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#endregion
+
+using System;
+
+namespace Grpc.Core
+{
+    /// <summary>
+    /// Connectivity state of a channel.
+    /// Based on grpc_connectivity_state from grpc/grpc.h
+    /// </summary>
+    public enum ChannelState
+    {
+        /// <summary>
+        /// Channel is idle
+        /// </summary>
+        Idle,
+
+        /// <summary>
+        /// Channel is connecting
+        /// </summary>
+        Connecting,
+
+        /// <summary>
+        /// Channel is ready for work
+        /// </summary>
+        Ready,
+
+        /// <summary>
+        /// Channel has seen a failure but expects to recover
+        /// </summary>
+        TransientFailure,
+
+        /// <summary>
+        /// Channel has seen a failure that it cannot recover from
+        /// </summary>
+        FatalFailure
+    }
+}
diff --git a/src/csharp/Grpc.Core/Grpc.Core.csproj b/src/csharp/Grpc.Core/Grpc.Core.csproj
index 940a6b8..641b54b 100644
--- a/src/csharp/Grpc.Core/Grpc.Core.csproj
+++ b/src/csharp/Grpc.Core/Grpc.Core.csproj
@@ -115,6 +115,7 @@
     <Compile Include="Logging\ILogger.cs" />
     <Compile Include="Logging\ConsoleLogger.cs" />
     <Compile Include="Internal\NativeLogRedirector.cs" />
+    <Compile Include="ChannelState.cs" />
   </ItemGroup>
   <ItemGroup>
     <None Include="Grpc.Core.nuspec" />
diff --git a/src/csharp/Grpc.Core/Internal/AsyncCall.cs b/src/csharp/Grpc.Core/Internal/AsyncCall.cs
index bfcb936..48f4664 100644
--- a/src/csharp/Grpc.Core/Internal/AsyncCall.cs
+++ b/src/csharp/Grpc.Core/Internal/AsyncCall.cs
@@ -67,7 +67,7 @@
         public void Initialize(Channel channel, CompletionQueueSafeHandle cq, string methodName, Timespec deadline)
         {
             this.channel = channel;
-            var call = channel.Handle.CreateCall(channel.CompletionRegistry, cq, methodName, channel.Target, deadline);
+            var call = channel.Handle.CreateCall(channel.CompletionRegistry, cq, methodName, null, deadline);
             channel.Environment.DebugStats.ActiveClientCalls.Increment();
             InitializeInternal(call);
         }
diff --git a/src/csharp/Grpc.Core/Internal/ChannelSafeHandle.cs b/src/csharp/Grpc.Core/Internal/ChannelSafeHandle.cs
index 20815ef..7324ebd 100644
--- a/src/csharp/Grpc.Core/Internal/ChannelSafeHandle.cs
+++ b/src/csharp/Grpc.Core/Internal/ChannelSafeHandle.cs
@@ -50,6 +50,16 @@
         static extern CallSafeHandle grpcsharp_channel_create_call(ChannelSafeHandle channel, CompletionQueueSafeHandle cq, string method, string host, Timespec deadline);
 
         [DllImport("grpc_csharp_ext.dll")]
+        static extern ChannelState grpcsharp_channel_check_connectivity_state(ChannelSafeHandle channel, int tryToConnect);
+
+        [DllImport("grpc_csharp_ext.dll")]
+        static extern void grpcsharp_channel_watch_connectivity_state(ChannelSafeHandle channel, ChannelState lastObservedState,
+            Timespec deadline, CompletionQueueSafeHandle cq, BatchContextSafeHandle ctx);
+
+        [DllImport("grpc_csharp_ext.dll")]
+        static extern CStringSafeHandle grpcsharp_channel_get_target(ChannelSafeHandle call);
+
+        [DllImport("grpc_csharp_ext.dll")]
         static extern void grpcsharp_channel_destroy(IntPtr channel);
 
         private ChannelSafeHandle()
@@ -73,6 +83,27 @@
             return result;
         }
 
+        public ChannelState CheckConnectivityState(bool tryToConnect)
+        {
+            return grpcsharp_channel_check_connectivity_state(this, tryToConnect ? 1 : 0);
+        }
+
+        public void WatchConnectivityState(ChannelState lastObservedState, Timespec deadline, CompletionQueueSafeHandle cq,
+            CompletionRegistry completionRegistry, BatchCompletionDelegate callback)
+        {
+            var ctx = BatchContextSafeHandle.Create();
+            completionRegistry.RegisterBatchCompletion(ctx, callback);
+            grpcsharp_channel_watch_connectivity_state(this, lastObservedState, deadline, cq, ctx);
+        }
+
+        public string GetTarget()
+        {
+            using (var cstring = grpcsharp_channel_get_target(this))
+            {
+                return cstring.GetValue();
+            }
+        }
+
         protected override bool ReleaseHandle()
         {
             grpcsharp_channel_destroy(handle);
diff --git a/src/csharp/ext/grpc_csharp_ext.c b/src/csharp/ext/grpc_csharp_ext.c
index b0612d4..65f3303 100644
--- a/src/csharp/ext/grpc_csharp_ext.c
+++ b/src/csharp/ext/grpc_csharp_ext.c
@@ -383,6 +383,22 @@
                                   method, host, deadline);
 }
 
+GPR_EXPORT grpc_connectivity_state GPR_CALLTYPE
+grpcsharp_channel_check_connectivity_state(grpc_channel *channel, gpr_int32 try_to_connect) {
+  return grpc_channel_check_connectivity_state(channel, try_to_connect);
+}
+
+GPR_EXPORT void GPR_CALLTYPE grpcsharp_channel_watch_connectivity_state(
+    grpc_channel *channel, grpc_connectivity_state last_observed_state,
+    gpr_timespec deadline, grpc_completion_queue *cq, grpcsharp_batch_context *ctx) {
+  grpc_channel_watch_connectivity_state(channel, last_observed_state,
+                                        deadline, cq, ctx);
+}
+
+GPR_EXPORT char *GPR_CALLTYPE grpcsharp_channel_get_target(grpc_channel *channel) {
+  return grpc_channel_get_target(channel);
+}
+
 /* Channel args */
 
 GPR_EXPORT grpc_channel_args *GPR_CALLTYPE
diff --git a/src/node/examples/math_server.js b/src/node/examples/math_server.js
index b1f8a63..31892c6 100644
--- a/src/node/examples/math_server.js
+++ b/src/node/examples/math_server.js
@@ -115,7 +115,7 @@
 });
 
 if (require.main === module) {
-  server.bind('0.0.0.0:50051');
+  server.bind('0.0.0.0:50051', grpc.ServerCredentials.createInsecure());
   server.start();
 }
 
diff --git a/src/node/examples/route_guide_server.js b/src/node/examples/route_guide_server.js
index 70044a3..bb8e79b 100644
--- a/src/node/examples/route_guide_server.js
+++ b/src/node/examples/route_guide_server.js
@@ -239,7 +239,7 @@
 if (require.main === module) {
   // If this is run as a script, start a server on an unused port
   var routeServer = getServer();
-  routeServer.bind('0.0.0.0:50051');
+  routeServer.bind('0.0.0.0:50051', grpc.ServerCredentials.createInsecure());
   var argv = parseArgs(process.argv, {
     string: 'db_path'
   });
diff --git a/src/node/examples/stock_server.js b/src/node/examples/stock_server.js
index f2eb6ad..dfcfe30 100644
--- a/src/node/examples/stock_server.js
+++ b/src/node/examples/stock_server.js
@@ -80,7 +80,7 @@
 });
 
 if (require.main === module) {
-  stockServer.bind('0.0.0.0:50051');
+  stockServer.bind('0.0.0.0:50051', grpc.ServerCredentials.createInsecure());
   stockServer.listen();
 }
 
diff --git a/src/node/ext/server.cc b/src/node/ext/server.cc
index 8554fce..04fabc8 100644
--- a/src/node/ext/server.cc
+++ b/src/node/ext/server.cc
@@ -136,10 +136,6 @@
       tpl, "addHttp2Port",
       NanNew<FunctionTemplate>(AddHttp2Port)->GetFunction());
 
-  NanSetPrototypeTemplate(
-      tpl, "addSecureHttp2Port",
-      NanNew<FunctionTemplate>(AddSecureHttp2Port)->GetFunction());
-
   NanSetPrototypeTemplate(tpl, "start",
                           NanNew<FunctionTemplate>(Start)->GetFunction());
 
@@ -248,43 +244,35 @@
 NAN_METHOD(Server::AddHttp2Port) {
   NanScope();
   if (!HasInstance(args.This())) {
-    return NanThrowTypeError("addHttp2Port can only be called on a Server");
-  }
-  if (!args[0]->IsString()) {
-    return NanThrowTypeError("addHttp2Port's argument must be a String");
-  }
-  Server *server = ObjectWrap::Unwrap<Server>(args.This());
-  if (server->wrapped_server == NULL) {
-    return NanThrowError("addHttp2Port cannot be called on a shut down Server");
-  }
-  NanReturnValue(NanNew<Number>(grpc_server_add_http2_port(
-      server->wrapped_server, *NanUtf8String(args[0]))));
-}
-
-NAN_METHOD(Server::AddSecureHttp2Port) {
-  NanScope();
-  if (!HasInstance(args.This())) {
     return NanThrowTypeError(
-        "addSecureHttp2Port can only be called on a Server");
+        "addHttp2Port can only be called on a Server");
   }
   if (!args[0]->IsString()) {
     return NanThrowTypeError(
-        "addSecureHttp2Port's first argument must be a String");
+        "addHttp2Port's first argument must be a String");
   }
   if (!ServerCredentials::HasInstance(args[1])) {
     return NanThrowTypeError(
-        "addSecureHttp2Port's second argument must be ServerCredentials");
+        "addHttp2Port's second argument must be ServerCredentials");
   }
   Server *server = ObjectWrap::Unwrap<Server>(args.This());
   if (server->wrapped_server == NULL) {
     return NanThrowError(
-        "addSecureHttp2Port cannot be called on a shut down Server");
+        "addHttp2Port cannot be called on a shut down Server");
   }
-  ServerCredentials *creds = ObjectWrap::Unwrap<ServerCredentials>(
+  ServerCredentials *creds_object = ObjectWrap::Unwrap<ServerCredentials>(
       args[1]->ToObject());
-  NanReturnValue(NanNew<Number>(grpc_server_add_secure_http2_port(
-      server->wrapped_server, *NanUtf8String(args[0]),
-      creds->GetWrappedServerCredentials())));
+  grpc_server_credentials *creds = creds_object->GetWrappedServerCredentials();
+  int port;
+  if (creds == NULL) {
+    port = grpc_server_add_http2_port(server->wrapped_server,
+                                      *NanUtf8String(args[0]));
+  } else {
+    port = grpc_server_add_secure_http2_port(server->wrapped_server,
+                                             *NanUtf8String(args[0]),
+                                             creds);
+  }
+  NanReturnValue(NanNew<Number>(port));
 }
 
 NAN_METHOD(Server::Start) {
diff --git a/src/node/ext/server.h b/src/node/ext/server.h
index 5b4b18a..faab7e3 100644
--- a/src/node/ext/server.h
+++ b/src/node/ext/server.h
@@ -66,7 +66,6 @@
   static NAN_METHOD(New);
   static NAN_METHOD(RequestCall);
   static NAN_METHOD(AddHttp2Port);
-  static NAN_METHOD(AddSecureHttp2Port);
   static NAN_METHOD(Start);
   static NAN_METHOD(Shutdown);
   static NanCallback *constructor;
diff --git a/src/node/ext/server_credentials.cc b/src/node/ext/server_credentials.cc
index c4a93a6..1b8e7b4 100644
--- a/src/node/ext/server_credentials.cc
+++ b/src/node/ext/server_credentials.cc
@@ -73,6 +73,8 @@
   Handle<Function> ctr = tpl->GetFunction();
   ctr->Set(NanNew("createSsl"),
            NanNew<FunctionTemplate>(CreateSsl)->GetFunction());
+  ctr->Set(NanNew("createInsecure"),
+           NanNew<FunctionTemplate>(CreateInsecure)->GetFunction());
   constructor = new NanCallback(ctr);
   exports->Set(NanNew("ServerCredentials"), ctr);
 }
@@ -85,9 +87,6 @@
 Handle<Value> ServerCredentials::WrapStruct(
     grpc_server_credentials *credentials) {
   NanEscapableScope();
-  if (credentials == NULL) {
-    return NanEscapeScope(NanNull());
-  }
   const int argc = 1;
   Handle<Value> argv[argc] = {
     NanNew<External>(reinterpret_cast<void *>(credentials))};
@@ -140,8 +139,17 @@
   key_cert_pair.cert_chain = ::node::Buffer::Data(args[2]);
   // TODO Add a force_client_auth parameter and pass it as the last parameter
   // here.
-  NanReturnValue(WrapStruct(
-      grpc_ssl_server_credentials_create(root_certs, &key_cert_pair, 1, 0)));
+  grpc_server_credentials *creds =
+      grpc_ssl_server_credentials_create(root_certs, &key_cert_pair, 1, 0);
+  if (creds == NULL) {
+    NanReturnNull();
+  }
+  NanReturnValue(WrapStruct(creds));
+}
+
+NAN_METHOD(ServerCredentials::CreateInsecure) {
+  NanScope();
+  NanReturnValue(WrapStruct(NULL));
 }
 
 }  // namespace node
diff --git a/src/node/ext/server_credentials.h b/src/node/ext/server_credentials.h
index 8074750..63903f6 100644
--- a/src/node/ext/server_credentials.h
+++ b/src/node/ext/server_credentials.h
@@ -63,6 +63,7 @@
 
   static NAN_METHOD(New);
   static NAN_METHOD(CreateSsl);
+  static NAN_METHOD(CreateInsecure);
   static NanCallback *constructor;
   // Used for typechecking instances of this javascript class
   static v8::Persistent<v8::FunctionTemplate> fun_tpl;
diff --git a/src/node/interop/interop_server.js b/src/node/interop/interop_server.js
index 505c6bb..ece22cc 100644
--- a/src/node/interop/interop_server.js
+++ b/src/node/interop/interop_server.js
@@ -161,7 +161,7 @@
 function getServer(port, tls) {
   // TODO(mlumish): enable TLS functionality
   var options = {};
-  var server_creds = null;
+  var server_creds;
   if (tls) {
     var key_path = path.join(__dirname, '../test/data/server1.key');
     var pem_path = path.join(__dirname, '../test/data/server1.pem');
@@ -171,6 +171,8 @@
     server_creds = grpc.ServerCredentials.createSsl(null,
                                                     key_data,
                                                     pem_data);
+  } else {
+    server_creds = grpc.ServerCredentials.createInsecure();
   }
   var server = new grpc.Server(options);
   server.addProtoService(testProto.TestService.service, {
diff --git a/src/node/src/server.js b/src/node/src/server.js
index 9fbd1ee..5c62f59 100644
--- a/src/node/src/server.js
+++ b/src/node/src/server.js
@@ -714,11 +714,7 @@
   if (this.started) {
     throw new Error('Can\'t bind an already running server to an address');
   }
-  if (creds) {
-    return this._server.addSecureHttp2Port(port, creds);
-  } else {
-    return this._server.addHttp2Port(port);
-  }
+  return this._server.addHttp2Port(port, creds);
 };
 
 /**
diff --git a/src/node/test/call_test.js b/src/node/test/call_test.js
index c5edab8..48d859a 100644
--- a/src/node/test/call_test.js
+++ b/src/node/test/call_test.js
@@ -55,7 +55,8 @@
   var server;
   before(function() {
     server = new grpc.Server();
-    var port = server.addHttp2Port('localhost:0');
+    var port = server.addHttp2Port('localhost:0',
+                                   grpc.ServerCredentials.createInsecure());
     server.start();
     channel = new grpc.Channel('localhost:' + port, insecureCreds);
   });
diff --git a/src/node/test/end_to_end_test.js b/src/node/test/end_to_end_test.js
index 9133cec..ea41dfc 100644
--- a/src/node/test/end_to_end_test.js
+++ b/src/node/test/end_to_end_test.js
@@ -64,7 +64,8 @@
   var channel;
   before(function() {
     server = new grpc.Server();
-    var port_num = server.addHttp2Port('0.0.0.0:0');
+    var port_num = server.addHttp2Port('0.0.0.0:0',
+                                       grpc.ServerCredentials.createInsecure());
     server.start();
     channel = new grpc.Channel('localhost:' + port_num, insecureCreds);
   });
diff --git a/src/node/test/health_test.js b/src/node/test/health_test.js
index 93b068b..be4ef1d 100644
--- a/src/node/test/health_test.js
+++ b/src/node/test/health_test.js
@@ -54,7 +54,8 @@
                                new health.Implementation(statusMap));
   var healthClient;
   before(function() {
-    var port_num = healthServer.bind('0.0.0.0:0');
+    var port_num = healthServer.bind('0.0.0.0:0',
+                                     grpc.ServerCredentials.createInsecure());
     healthServer.start();
     healthClient = new health.Client('localhost:' + port_num,
                                      grpc.Credentials.createInsecure());
diff --git a/src/node/test/math_client_test.js b/src/node/test/math_client_test.js
index 1bd85ca..ef01870 100644
--- a/src/node/test/math_client_test.js
+++ b/src/node/test/math_client_test.js
@@ -51,7 +51,8 @@
 
 describe('Math client', function() {
   before(function(done) {
-    var port_num = server.bind('0.0.0.0:0');
+    var port_num = server.bind('0.0.0.0:0',
+                               grpc.ServerCredentials.createInsecure());
     server.start();
     math_client = new math.Math('localhost:' + port_num,
                                 grpc.Credentials.createInsecure());
diff --git a/src/node/test/server_test.js b/src/node/test/server_test.js
index 9c7bb46..a9df439 100644
--- a/src/node/test/server_test.js
+++ b/src/node/test/server_test.js
@@ -59,16 +59,11 @@
     it('should bind to an unused port', function() {
       var port;
       assert.doesNotThrow(function() {
-        port = server.addHttp2Port('0.0.0.0:0');
+        port = server.addHttp2Port('0.0.0.0:0',
+                                   grpc.ServerCredentials.createInsecure());
       });
       assert(port > 0);
     });
-  });
-  describe('addSecureHttp2Port', function() {
-    var server;
-    before(function() {
-      server = new grpc.Server();
-    });
     it('should bind to an unused port with ssl credentials', function() {
       var port;
       var key_path = path.join(__dirname, '../test/data/server1.key');
@@ -77,16 +72,22 @@
       var pem_data = fs.readFileSync(pem_path);
       var creds = grpc.ServerCredentials.createSsl(null, key_data, pem_data);
       assert.doesNotThrow(function() {
-        port = server.addSecureHttp2Port('0.0.0.0:0', creds);
+        port = server.addHttp2Port('0.0.0.0:0', creds);
       });
       assert(port > 0);
     });
   });
+  describe('addSecureHttp2Port', function() {
+    var server;
+    before(function() {
+      server = new grpc.Server();
+    });
+  });
   describe('listen', function() {
     var server;
     before(function() {
       server = new grpc.Server();
-      server.addHttp2Port('0.0.0.0:0');
+      server.addHttp2Port('0.0.0.0:0', grpc.ServerCredentials.createInsecure());
     });
     after(function() {
       server.shutdown();
diff --git a/src/node/test/surface_test.js b/src/node/test/surface_test.js
index 18c99a5..dda2f8d 100644
--- a/src/node/test/surface_test.js
+++ b/src/node/test/surface_test.js
@@ -47,6 +47,8 @@
 
 var _ = require('lodash');
 
+var server_insecure_creds = grpc.ServerCredentials.createInsecure();
+
 describe('File loader', function() {
   it('Should load a proto file by default', function() {
     assert.doesNotThrow(function() {
@@ -122,7 +124,7 @@
         callback(null, call.request);
       }
     });
-    var port = server.bind('localhost:0');
+    var port = server.bind('localhost:0', server_insecure_creds);
     var Client = surface_client.makeProtobufClientConstructor(echo_service);
     client = new Client('localhost:' + port, grpc.Credentials.createInsecure());
     server.start();
@@ -166,7 +168,7 @@
           callback(null, _.capitalize(call.request));
         }
       });
-      var port = server.bind('localhost:0');
+      var port = server.bind('localhost:0', server_insecure_creds);
       server.start();
       var Client = grpc.makeGenericClientConstructor(string_service_attrs);
       client = new Client('localhost:' + port,
@@ -215,7 +217,7 @@
         });
       }
     });
-    var port = server.bind('localhost:0');
+    var port = server.bind('localhost:0', server_insecure_creds);
     var Client = surface_client.makeProtobufClientConstructor(test_service);
     client = new Client('localhost:' + port, grpc.Credentials.createInsecure());
     server.start();
@@ -336,7 +338,7 @@
         });
       }
     });
-    port = server.bind('localhost:0');
+    port = server.bind('localhost:0', server_insecure_creds);
     var Client = surface_client.makeProtobufClientConstructor(test_service);
     client = new Client('localhost:' + port, grpc.Credentials.createInsecure());
     server.start();
@@ -602,7 +604,7 @@
       'fib': function(stream) {},
       'sum': function(stream) {}
     });
-    var port = server.bind('localhost:0');
+    var port = server.bind('localhost:0', server_insecure_creds);
     var Client = surface_client.makeProtobufClientConstructor(mathService);
     client = new Client('localhost:' + port, grpc.Credentials.createInsecure());
     server.start();
diff --git a/src/objective-c/GRPCClient/GRPCCall.m b/src/objective-c/GRPCClient/GRPCCall.m
index 9435bf2..9d9648a 100644
--- a/src/objective-c/GRPCClient/GRPCCall.m
+++ b/src/objective-c/GRPCClient/GRPCCall.m
@@ -38,7 +38,6 @@
 #import <RxLibrary/GRXConcurrentWriteable.h>
 
 #import "private/GRPCChannel.h"
-#import "private/GRPCCompletionQueue.h"
 #import "private/GRPCWrappedCall.h"
 #import "private/NSData+GRPC.h"
 #import "private/NSDictionary+GRPC.h"
@@ -72,7 +71,6 @@
   dispatch_once_t _callAlreadyInvoked;
 
   GRPCChannel *_channel;
-  GRPCCompletionQueue *_completionQueue;
 
   // The C gRPC library has less guarantees on the ordering of events than we
   // do. Particularly, in the face of errors, there's no ordering guarantee at
@@ -100,19 +98,13 @@
                         path:(NSString *)path
               requestsWriter:(GRXWriter *)requestWriter {
   if (!host || !path) {
-    [NSException raise:NSInvalidArgumentException format:@"Neither host nor method can be nil."];
+    [NSException raise:NSInvalidArgumentException format:@"Neither host nor path can be nil."];
   }
   if (requestWriter.state != GRXWriterStateNotStarted) {
-    [NSException raise:NSInvalidArgumentException format:@"The requests writer can't be already started."];
+    [NSException raise:NSInvalidArgumentException
+                format:@"The requests writer can't be already started."];
   }
   if ((self = [super init])) {
-    static dispatch_once_t initialization;
-    dispatch_once(&initialization, ^{
-      grpc_init();
-    });
-
-    _completionQueue = [GRPCCompletionQueue completionQueue];
-
     _channel = [GRPCChannel channelToHost:host];
 
     _wrappedCall = [[GRPCWrappedCall alloc] initWithChannel:_channel
diff --git a/src/objective-c/GRPCClient/private/GRPCCompletionQueue.h b/src/objective-c/GRPCClient/private/GRPCCompletionQueue.h
index 603bf01..ab8d714 100644
--- a/src/objective-c/GRPCClient/private/GRPCCompletionQueue.h
+++ b/src/objective-c/GRPCClient/private/GRPCCompletionQueue.h
@@ -36,15 +36,15 @@
 
 typedef void(^GRPCQueueCompletionHandler)(bool success);
 
-// This class lets one more easily use grpc_completion_queue. To use it, pass
-// the value of the unmanagedQueue property of an instance of this class to
-// grpc_call_start_invoke. Then for every grpc_call_* method that accepts a tag,
-// you can pass a block of type GRPCEventHandler (remembering to cast it using
-// __bridge_retained). The block is guaranteed to eventually be called, by a
-// concurrent queue, and then released. Each such block is passed a pointer to
-// the grpc_event that carried it (in event->tag).
-// Release the GRPCCompletionQueue object only after you are not going to pass
-// any more blocks to the grpc_call that's using it.
+// This class lets one more easily use |grpc_completion_queue|. To use it, pass the value of the
+// |unmanagedQueue| property of an instance of this class to |grpc_channel_create_call|. Then for
+// every |grpc_call_*| method that accepts a tag, you can pass a block of type
+// |GRPCQueueCompletionHandler| (remembering to cast it using |__bridge_retained|). The block is
+// guaranteed to eventually be called, by a concurrent queue, and then released. Each such block is
+// passed a |bool| that tells if the operation was successful.
+//
+// Release the GRPCCompletionQueue object only after you are not going to pass any more blocks to
+// the |grpc_call| that's using it.
 @interface GRPCCompletionQueue : NSObject
 @property(nonatomic, readonly) grpc_completion_queue *unmanagedQueue;
 
diff --git a/src/objective-c/generated_libraries/RemoteTestClient/RemoteTest.podspec b/src/objective-c/generated_libraries/RemoteTestClient/RemoteTest.podspec
index 6b00efe..8710753 100644
--- a/src/objective-c/generated_libraries/RemoteTestClient/RemoteTest.podspec
+++ b/src/objective-c/generated_libraries/RemoteTestClient/RemoteTest.podspec
@@ -8,7 +8,10 @@
 
   # Run protoc with the Objective-C and gRPC plugins to generate protocol messages and gRPC clients.
   s.prepare_command = <<-CMD
-    protoc --plugin=protoc-gen-grpc=../../../../bins/$CONFIG/grpc_objective_c_plugin --objc_out=. --grpc_out=. *.proto
+    BINDIR=../../../../bins/$CONFIG
+    PROTOC=$BINDIR/protobuf/protoc
+    PLUGIN=$BINDIR/grpc_objective_c_plugin
+    $PROTOC --plugin=protoc-gen-grpc=$PLUGIN --objc_out=. --grpc_out=. *.proto
   CMD
 
   s.subspec "Messages" do |ms|
diff --git a/src/objective-c/generated_libraries/RouteGuideClient/RouteGuide.podspec b/src/objective-c/generated_libraries/RouteGuideClient/RouteGuide.podspec
index 2c9cead..23ccffe 100644
--- a/src/objective-c/generated_libraries/RouteGuideClient/RouteGuide.podspec
+++ b/src/objective-c/generated_libraries/RouteGuideClient/RouteGuide.podspec
@@ -8,7 +8,10 @@
 
   # Run protoc with the Objective-C and gRPC plugins to generate protocol messages and gRPC clients.
   s.prepare_command = <<-CMD
-    protoc --plugin=protoc-gen-grpc=../../../../bins/$CONFIG/grpc_objective_c_plugin --objc_out=. --grpc_out=. *.proto
+    BINDIR=../../../../bins/$CONFIG
+    PROTOC=$BINDIR/protobuf/protoc
+    PLUGIN=$BINDIR/grpc_objective_c_plugin
+    $PROTOC --plugin=protoc-gen-grpc=$PLUGIN --objc_out=. --grpc_out=. *.proto
   CMD
 
   s.subspec "Messages" do |ms|
diff --git a/src/objective-c/tests/build_tests.sh b/src/objective-c/tests/build_tests.sh
index d98e0a7..e7ad31e 100755
--- a/src/objective-c/tests/build_tests.sh
+++ b/src/objective-c/tests/build_tests.sh
@@ -28,12 +28,39 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+# Don't run this script standalone. Instead, run from the repository root:
+# ./tools/run_tests/run_tests.py -l objc
+
 set -e
 
 cd $(dirname $0)
 
-# The local test server needs to be compiled before this because pod install of
-# gRPC renames some C gRPC files and not the server's code references to them.
-#
-# Suppress error output because Cocoapods issue #3823 causes a flooding warning.
-pod install 2>/dev/null
+hash pod 2>/dev/null || { echo >&2 "Cocoapods needs to be installed."; exit 1; }
+hash xcodebuild 2>/dev/null || {
+    echo >&2 "XCode command-line tools need to be installed."
+    exit 1
+}
+
+BINDIR=../../../bins/$CONFIG
+
+if [ ! -f $BINDIR/protobuf/protoc ]; then
+    hash protoc 2>/dev/null || {
+        echo >&2 "Can't find protoc. Make sure run_tests.py is making" \
+                 "grpc_objective_c_plugin before calling this script."
+        exit 1
+    }
+    # When protoc is already installed, make doesn't compile one. Put a link
+    # there so the podspecs can do codegen using that path.
+    mkdir -p $BINDIR/protobuf
+    ln -s `which protoc` $BINDIR/protobuf/protoc
+fi
+
+[ -f $BINDIR/interop_server ] || {
+    echo >&2 "Can't find the test server. Make sure run_tests.py is making" \
+             "interop_server before calling this script. It needs to be done" \
+             "before because pod install of gRPC renames some C gRPC files" \
+             "and not the server's code references to them."
+    exit 1
+}
+
+pod install
diff --git a/src/objective-c/tests/run_tests.sh b/src/objective-c/tests/run_tests.sh
index 9afec68..b13c0f0 100755
--- a/src/objective-c/tests/run_tests.sh
+++ b/src/objective-c/tests/run_tests.sh
@@ -28,6 +28,9 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+# Don't run this script standalone. Instead, run from the repository root:
+# ./tools/run_tests/run_tests.py -l objc
+
 set -e
 
 cd $(dirname $0)
diff --git a/src/python/grpcio_test/grpc_test/_links/_transmission_test.py b/src/python/grpcio_test/grpc_test/_links/_transmission_test.py
index 0531fa1..9cdc962 100644
--- a/src/python/grpcio_test/grpc_test/_links/_transmission_test.py
+++ b/src/python/grpcio_test/grpc_test/_links/_transmission_test.py
@@ -35,6 +35,7 @@
 from grpc._links import invocation
 from grpc._links import service
 from grpc.framework.interfaces.links import links
+from grpc_test import test_common
 from grpc_test._links import _proto_scenarios
 from grpc_test.framework.common import test_constants
 from grpc_test.framework.interfaces.links import test_cases
@@ -94,12 +95,11 @@
     return _intermediary_low.Code.OK, 'An exuberant test "details" message!'
 
   def assertMetadataTransmitted(self, original_metadata, transmitted_metadata):
-    # we need to filter out any additional metadata added in transmitted_metadata
-    # since implementations are allowed to add to what is sent (in any position)
-    keys, _ = zip(*original_metadata)
-    self.assertSequenceEqual(
-        original_metadata,
-        [x for x in transmitted_metadata if x[0] in keys])
+    self.assertTrue(
+        test_common.metadata_transmitted(
+            original_metadata, transmitted_metadata),
+        '%s erroneously transmitted as %s' % (
+            original_metadata, transmitted_metadata))
 
 
 class RoundTripTest(unittest.TestCase):
diff --git a/src/python/grpcio_test/grpc_test/test_common.py b/src/python/grpcio_test/grpc_test/test_common.py
new file mode 100644
index 0000000..f8e1f1e
--- /dev/null
+++ b/src/python/grpcio_test/grpc_test/test_common.py
@@ -0,0 +1,71 @@
+# Copyright 2015, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"""Common code used throughout tests of gRPC."""
+
+import collections
+
+
+def metadata_transmitted(original_metadata, transmitted_metadata):
+  """Judges whether or not metadata was acceptably transmitted.
+
+  gRPC is allowed to insert key-value pairs into the metadata values given by
+  applications and to reorder key-value pairs with different keys but it is not
+  allowed to alter existing key-value pairs or to reorder key-value pairs with
+  the same key.
+
+  Args:
+    original_metadata: A metadata value used in a test of gRPC.
+    transmitted_metadata: A metadata value corresponding to original_metadata
+      after having been transmitted via gRPC.
+
+  Returns:
+     A boolean indicating whether transmitted_metadata accurately reflects
+      original_metadata after having been transmitted via gRPC.
+  """
+  original = collections.defaultdict(list)
+  for key, value in original_metadata:
+    original[key].append(value)
+  transmitted = collections.defaultdict(list)
+  for key, value in transmitted_metadata:
+    transmitted[key].append(value)
+
+  for key, values in original.iteritems():
+    transmitted_values = transmitted[key]
+    transmitted_iterator = iter(transmitted_values)
+    try:
+      for value in values:
+        while True:
+          transmitted_value = next(transmitted_iterator)
+          if value == transmitted_value:
+            break
+    except StopIteration:
+      return False
+  else:
+    return True
diff --git a/templates/Makefile.template b/templates/Makefile.template
index 1e46db1..6530ea5 100644
--- a/templates/Makefile.template
+++ b/templates/Makefile.template
@@ -1468,10 +1468,14 @@
     mingw_libs = mingw_libs + ' -l' + dep + '-imp'
     mingw_lib_deps = mingw_lib_deps + ' $(LIBDIR)/$(CONFIG)/' + dep + '.$(SHARED_EXT)'
 
-  if lib.get('secure', 'check') == 'yes':
+  security = lib.get('secure', 'check')
+  if security == 'yes':
     common = common + ' $(OPENSSL_MERGE_LIBS) $(LDLIBS_SECURE)'
+
+  if security in ['yes', 'check']:
     for src in lib.src:
-      sources_that_need_openssl.add(src)
+      if not proto_re.match(src):
+        sources_that_need_openssl.add(src)
   else:
     for src in lib.src:
       sources_that_don_t_need_openssl.add(src)
diff --git a/test/core/end2end/tests/channel_connectivity.c b/test/core/end2end/tests/channel_connectivity.c
index 3917cad..ec0417a 100644
--- a/test/core/end2end/tests/channel_connectivity.c
+++ b/test/core/end2end/tests/channel_connectivity.c
@@ -54,7 +54,7 @@
 
   /* start watching for a change */
   grpc_channel_watch_connectivity_state(
-  	f.client, GRPC_CHANNEL_IDLE, &state, GRPC_TIMEOUT_SECONDS_TO_DEADLINE(3), f.cq, tag(1));
+  	f.client, GRPC_CHANNEL_IDLE, GRPC_TIMEOUT_SECONDS_TO_DEADLINE(3), f.cq, tag(1));
   /* nothing should happen */
   cq_verify_empty(cqv);
 
@@ -64,14 +64,18 @@
   /* and now the watch should trigger */
   cq_expect_completion(cqv, tag(1), 1);
   cq_verify(cqv);
-  GPR_ASSERT(state == GRPC_CHANNEL_CONNECTING);
+  state = grpc_channel_check_connectivity_state(f.client, 0);
+  GPR_ASSERT(state == GRPC_CHANNEL_TRANSIENT_FAILURE || 
+             state == GRPC_CHANNEL_CONNECTING);
 
   /* quickly followed by a transition to TRANSIENT_FAILURE */
   grpc_channel_watch_connectivity_state(
-  	f.client, GRPC_CHANNEL_CONNECTING, &state, GRPC_TIMEOUT_SECONDS_TO_DEADLINE(3), f.cq, tag(2));
+  	f.client, GRPC_CHANNEL_CONNECTING, GRPC_TIMEOUT_SECONDS_TO_DEADLINE(3), f.cq, tag(2));
   cq_expect_completion(cqv, tag(2), 1);
   cq_verify(cqv);
-  GPR_ASSERT(state == GRPC_CHANNEL_TRANSIENT_FAILURE);
+  state = grpc_channel_check_connectivity_state(f.client, 0);
+  GPR_ASSERT(state == GRPC_CHANNEL_TRANSIENT_FAILURE || 
+             state == GRPC_CHANNEL_CONNECTING);
 
   gpr_log(GPR_DEBUG, "*** STARTING SERVER ***");
 
@@ -84,10 +88,13 @@
      READY is reached */
   while (state != GRPC_CHANNEL_READY) {
   	grpc_channel_watch_connectivity_state(
-  		f.client, state, &state, GRPC_TIMEOUT_SECONDS_TO_DEADLINE(3), f.cq, tag(3));
+  		f.client, state, GRPC_TIMEOUT_SECONDS_TO_DEADLINE(3), f.cq, tag(3));
   	cq_expect_completion(cqv, tag(3), 1);
     cq_verify(cqv);
-  	GPR_ASSERT(state == GRPC_CHANNEL_READY || state == GRPC_CHANNEL_CONNECTING || state == GRPC_CHANNEL_TRANSIENT_FAILURE);
+    state = grpc_channel_check_connectivity_state(f.client, 0);
+  	GPR_ASSERT(state == GRPC_CHANNEL_READY || 
+               state == GRPC_CHANNEL_CONNECTING || 
+               state == GRPC_CHANNEL_TRANSIENT_FAILURE);
   }
 
   /* bring down the server again */
@@ -95,14 +102,16 @@
   gpr_log(GPR_DEBUG, "*** SHUTTING DOWN SERVER ***");
 
   grpc_channel_watch_connectivity_state(
-  	f.client, GRPC_CHANNEL_READY, &state, GRPC_TIMEOUT_SECONDS_TO_DEADLINE(3), f.cq, tag(4));
+  	f.client, GRPC_CHANNEL_READY, GRPC_TIMEOUT_SECONDS_TO_DEADLINE(3), f.cq, tag(4));
 
   grpc_server_shutdown_and_notify(f.server, f.cq, tag(0xdead));
 
   cq_expect_completion(cqv, tag(4), 1);
   cq_expect_completion(cqv, tag(0xdead), 1);
   cq_verify(cqv);
-  GPR_ASSERT(state == GRPC_CHANNEL_TRANSIENT_FAILURE);
+  state = grpc_channel_check_connectivity_state(f.client, 0);
+  GPR_ASSERT(state == GRPC_CHANNEL_TRANSIENT_FAILURE || 
+             state == GRPC_CHANNEL_CONNECTING);
 
   /* cleanup server */
   grpc_server_destroy(f.server);
diff --git a/test/core/iomgr/sockaddr_utils_test.c b/test/core/iomgr/sockaddr_utils_test.c
index dfab340..72a0f71 100644
--- a/test/core/iomgr/sockaddr_utils_test.c
+++ b/test/core/iomgr/sockaddr_utils_test.c
@@ -187,6 +187,15 @@
   gpr_free(str);
 }
 
+static void expect_sockaddr_uri(const char *expected, void *addr) {
+  char *str;
+  gpr_log(GPR_INFO, "  expect_sockaddr_uri(%s)", expected);
+  str = grpc_sockaddr_to_uri((struct sockaddr *)addr);
+  GPR_ASSERT(str != NULL);
+  GPR_ASSERT(strcmp(expected, str) == 0);
+  gpr_free(str);
+}
+
 static void test_sockaddr_to_string(void) {
   struct sockaddr_in input4;
   struct sockaddr_in6 input6;
@@ -199,23 +208,28 @@
   input4 = make_addr4(kIPv4, sizeof(kIPv4));
   expect_sockaddr_str("192.0.2.1:12345", &input4, 0);
   expect_sockaddr_str("192.0.2.1:12345", &input4, 1);
+  expect_sockaddr_uri("ipv4:192.0.2.1:12345", &input4);
 
   input6 = make_addr6(kIPv6, sizeof(kIPv6));
   expect_sockaddr_str("[2001:db8::1]:12345", &input6, 0);
   expect_sockaddr_str("[2001:db8::1]:12345", &input6, 1);
+  expect_sockaddr_uri("ipv6:[2001:db8::1]:12345", &input6);
 
   input6 = make_addr6(kMapped, sizeof(kMapped));
   expect_sockaddr_str("[::ffff:192.0.2.1]:12345", &input6, 0);
   expect_sockaddr_str("192.0.2.1:12345", &input6, 1);
+  expect_sockaddr_uri("ipv4:192.0.2.1:12345", &input6);
 
   input6 = make_addr6(kNotQuiteMapped, sizeof(kNotQuiteMapped));
   expect_sockaddr_str("[::fffe:c000:263]:12345", &input6, 0);
   expect_sockaddr_str("[::fffe:c000:263]:12345", &input6, 1);
+  expect_sockaddr_uri("ipv6:[::fffe:c000:263]:12345", &input6);
 
   memset(&dummy, 0, sizeof(dummy));
   dummy.sa_family = 123;
   expect_sockaddr_str("(sockaddr family=123)", &dummy, 0);
   expect_sockaddr_str("(sockaddr family=123)", &dummy, 1);
+  GPR_ASSERT(grpc_sockaddr_to_uri(&dummy) == NULL);
 
   GPR_ASSERT(errno == 0x7EADBEEF);
 }
diff --git a/test/core/transport/chttp2/alpn_test.c b/test/core/transport/chttp2/alpn_test.c
index c2497d3..9a7d5ef 100644
--- a/test/core/transport/chttp2/alpn_test.c
+++ b/test/core/transport/chttp2/alpn_test.c
@@ -37,9 +37,7 @@
 #include "test/core/util/test_config.h"
 
 static void test_alpn_success(void) {
-  GPR_ASSERT(grpc_chttp2_is_alpn_version_supported("h2-16", 5));
-  GPR_ASSERT(grpc_chttp2_is_alpn_version_supported("h2-15", 5));
-  GPR_ASSERT(grpc_chttp2_is_alpn_version_supported("h2-14", 5));
+  GPR_ASSERT(grpc_chttp2_is_alpn_version_supported("h2", 2));
 }
 
 static void test_alpn_failure(void) {
diff --git a/test/cpp/end2end/end2end_test.cc b/test/cpp/end2end/end2end_test.cc
index 5b351c1..f39c6cf 100644
--- a/test/cpp/end2end/end2end_test.cc
+++ b/test/cpp/end2end/end2end_test.cc
@@ -93,6 +93,15 @@
   EXPECT_TRUE(auth_ctx->GetPeerIdentity().empty());
 }
 
+bool CheckIsLocalhost(const grpc::string& addr) {
+  const grpc::string kIpv6("ipv6:[::1]:");
+  const grpc::string kIpv4MappedIpv6("ipv6:[::ffff:127.0.0.1]:");
+  const grpc::string kIpv4("ipv4:127.0.0.1:");
+  return addr.substr(0, kIpv4.size()) == kIpv4 ||
+         addr.substr(0, kIpv4MappedIpv6.size()) == kIpv4MappedIpv6 ||
+         addr.substr(0, kIpv6.size()) == kIpv6;
+}
+
 }  // namespace
 
 class TestServiceImpl : public ::grpc::cpp::test::util::TestService::Service {
@@ -148,6 +157,9 @@
       response->set_message(
           grpc::string(request->param().response_message_length(), '\0'));
     }
+    if (request->has_param() && request->param().echo_peer()) {
+      response->mutable_param()->set_peer(context->peer());
+    }
     return Status::OK;
   }
 
@@ -236,7 +248,7 @@
 
   void SetUp() GRPC_OVERRIDE {
     int port = grpc_pick_unused_port_or_die();
-    server_address_ << "localhost:" << port;
+    server_address_ << "127.0.0.1:" << port;
     // Setup server
     ServerBuilder builder;
     SslServerCredentialsOptions::PemKeyCertPair pkcp = {test_server1_key,
@@ -818,6 +830,21 @@
   EXPECT_TRUE(s.ok());
 }
 
+TEST_F(End2endTest, Peer) {
+  ResetStub();
+  EchoRequest request;
+  EchoResponse response;
+  request.set_message("hello");
+  request.mutable_param()->set_echo_peer(true);
+
+  ClientContext context;
+  Status s = stub_->Echo(&context, request, &response);
+  EXPECT_EQ(response.message(), request.message());
+  EXPECT_TRUE(s.ok());
+  EXPECT_TRUE(CheckIsLocalhost(response.param().peer()));
+  EXPECT_TRUE(CheckIsLocalhost(context.peer()));
+}
+
 }  // namespace testing
 }  // namespace grpc
 
diff --git a/test/cpp/end2end/generic_end2end_test.cc b/test/cpp/end2end/generic_end2end_test.cc
index 4951c82..b53c321 100644
--- a/test/cpp/end2end/generic_end2end_test.cc
+++ b/test/cpp/end2end/generic_end2end_test.cc
@@ -100,11 +100,11 @@
 
 class GenericEnd2endTest : public ::testing::Test {
  protected:
-  GenericEnd2endTest() : generic_service_("*") {}
+  GenericEnd2endTest() : generic_service_("*"), server_host_("localhost") {}
 
   void SetUp() GRPC_OVERRIDE {
     int port = grpc_pick_unused_port_or_die();
-    server_address_ << "localhost:" << port;
+    server_address_ << server_host_ << ":" << port;
     // Setup server
     ServerBuilder builder;
     builder.AddListeningPort(server_address_.str(), InsecureServerCredentials());
@@ -165,7 +165,7 @@
                                    srv_cq_.get(), tag(4));
 
       verify_ok(srv_cq_.get(), 4, true);
-      EXPECT_EQ(server_address_.str(), srv_ctx.host());
+      EXPECT_EQ(server_host_, srv_ctx.host());
       EXPECT_EQ(kMethodName, srv_ctx.method());
       ByteBuffer recv_buffer;
       stream.Read(&recv_buffer, tag(5));
@@ -200,6 +200,7 @@
   std::unique_ptr<grpc::GenericStub> generic_stub_;
   std::unique_ptr<Server> server_;
   AsyncGenericService generic_service_;
+  const grpc::string server_host_;
   std::ostringstream server_address_;
 };
 
@@ -237,7 +238,7 @@
                                srv_cq_.get(), tag(2));
 
   verify_ok(srv_cq_.get(), 2, true);
-  EXPECT_EQ(server_address_.str(), srv_ctx.host());
+  EXPECT_EQ(server_host_, srv_ctx.host());
   EXPECT_EQ(kMethodName, srv_ctx.method());
 
   std::unique_ptr<ByteBuffer> send_buffer =
diff --git a/test/cpp/util/messages.proto b/test/cpp/util/messages.proto
index 2fad8b4..24e199b 100644
--- a/test/cpp/util/messages.proto
+++ b/test/cpp/util/messages.proto
@@ -39,6 +39,7 @@
   optional bool echo_metadata = 4;
   optional bool check_auth_context = 5;
   optional int32 response_message_length = 6;
+  optional bool echo_peer = 7;
 }
 
 message EchoRequest {
@@ -49,6 +50,7 @@
 message ResponseParams {
   optional int64 request_deadline = 1;
   optional string host = 2;
+  optional string peer = 3;
 }
 
 message EchoResponse {
diff --git a/third_party/openssl b/third_party/openssl
index 3df69d3..33dd083 160000
--- a/third_party/openssl
+++ b/third_party/openssl
@@ -1 +1 @@
-Subproject commit 3df69d3aefde7671053d4e3c242b228e5d79c83f
+Subproject commit 33dd08320648ac71d7d9d732be774ed3818dccc5
diff --git a/tools/README.md b/tools/README.md
index 3daf732..be7d84b 100644
--- a/tools/README.md
+++ b/tools/README.md
@@ -1,11 +1,17 @@
-buildgen: contains the template renderer for our build system.
+buildgen: template renderer for our build system.
 
-distpackages: contains script to generate debian packages.
+distpackages: script to generate debian packages.
 
-dockerfile: contains all of the docker files to test gRPC.
+distrib: scripts to distribute language-specific packages.
 
-gce_setup: contains boilerplate for running the docker files under GCE.
+dockerfile: Docker files to test gRPC.
 
-jenkins: support for running tests on Jenkins
+doxygen: gRPC C/C++ documentation generation via Doxygen.
 
-run_tests: contains python scripts to properly run the tests in parallel.
+gce_setup: boilerplate to run the Docker files under GCE.
+
+jenkins: support for running tests on Jenkins.
+
+profile_analyzer: pretty printer for gRPC profiling data.
+
+run_tests: scripts to run gRPC tests in parallel.
diff --git a/tools/gce_setup/grpc_docker.sh b/tools/gce_setup/grpc_docker.sh
index c06780a..ea7c798 100755
--- a/tools/gce_setup/grpc_docker.sh
+++ b/tools/gce_setup/grpc_docker.sh
@@ -1638,6 +1638,68 @@
   echo $the_cmd
 }
 
+# constructs the full dockerized csharp-mono oauth2_auth_token auth interop test cmd.
+#
+# call-seq:
+#   flags= .... # generic flags to include the command
+#   cmd=$($grpc_gen_test_cmd $flags)
+grpc_cloud_prod_auth_oauth2_auth_token_gen_csharp_mono_cmd() {
+  local workdir_flag="-w /var/local/git/grpc/src/csharp/Grpc.IntegrationTesting.Client/bin/Debug"
+  local env_flag="-e SSL_CERT_FILE=/cacerts/roots.pem "
+  env_flag+="-e GOOGLE_APPLICATION_CREDENTIALS=/service_account/stubbyCloudTestingTest-7dd63462c60c.json "
+  local cmd_prefix="sudo docker run $workdir_flag $env_flag grpc/csharp_mono";
+  local test_script="mono Grpc.IntegrationTesting.Client.exe --use_tls=true";
+  local gfe_flags=$(_grpc_prod_gfe_flags);
+  local the_cmd="$cmd_prefix $test_script $gfe_flags $@";
+  echo $the_cmd
+}
+
+# constructs the csharp-dotnet oauth2_auth_token auth interop test cmd.
+#
+# call-seq:
+#   flags= .... # generic flags to include the command
+#   cmd=$($grpc_gen_test_cmd $flags)
+grpc_cloud_prod_auth_oauth2_auth_token_gen_csharp_dotnet_cmd() {
+  local set_workdir="cd /cygdrive/c/github/grpc/src/csharp/Grpc.IntegrationTesting.Client/bin/Debug &&"
+  local test_script="./Grpc.IntegrationTesting.Client.exe --use_tls=true";
+  local set_certfile="SSL_CERT_FILE=/cacerts/roots.pem "
+  local set_creds="GOOGLE_APPLICATION_CREDENTIALS=/service_account/stubbyCloudTestingTest-7dd63462c60c.json "
+  local gfe_flags=$(_grpc_prod_gfe_flags);
+  local the_cmd="$set_workdir $set_certfile $set_creds $test_script $gfe_flags $@";
+  echo $the_cmd
+}
+
+# constructs the full dockerized csharp-mono per_rpc_creds auth interop test cmd.
+#
+# call-seq:
+#   flags= .... # generic flags to include the command
+#   cmd=$($grpc_gen_test_cmd $flags)
+grpc_cloud_prod_auth_per_rpc_creds_gen_csharp_mono_cmd() {
+  local workdir_flag="-w /var/local/git/grpc/src/csharp/Grpc.IntegrationTesting.Client/bin/Debug"
+  local env_flag="-e SSL_CERT_FILE=/cacerts/roots.pem "
+  env_flag+="-e GOOGLE_APPLICATION_CREDENTIALS=/service_account/stubbyCloudTestingTest-7dd63462c60c.json "
+  local cmd_prefix="sudo docker run $workdir_flag $env_flag grpc/csharp_mono";
+  local test_script="mono Grpc.IntegrationTesting.Client.exe --use_tls=true";
+  local gfe_flags=$(_grpc_prod_gfe_flags);
+  local the_cmd="$cmd_prefix $test_script $gfe_flags $@";
+  echo $the_cmd
+}
+
+# constructs the csharp-dotnet per_rpc_creds auth interop test cmd.
+#
+# call-seq:
+#   flags= .... # generic flags to include the command
+#   cmd=$($grpc_gen_test_cmd $flags)
+grpc_cloud_prod_auth_per_rpc_creds_gen_csharp_dotnet_cmd() {
+  local set_workdir="cd /cygdrive/c/github/grpc/src/csharp/Grpc.IntegrationTesting.Client/bin/Debug &&"
+  local test_script="./Grpc.IntegrationTesting.Client.exe --use_tls=true";
+  local set_certfile="SSL_CERT_FILE=/cacerts/roots.pem "
+  local set_creds="GOOGLE_APPLICATION_CREDENTIALS=/service_account/stubbyCloudTestingTest-7dd63462c60c.json "
+  local gfe_flags=$(_grpc_prod_gfe_flags);
+  local the_cmd="$set_workdir $set_certfile $set_creds $test_script $gfe_flags $@";
+  echo $the_cmd
+}
+
 # outputs the flags passed to gfe tests
 _grpc_prod_gfe_flags() {
   echo " --server_port=443 --server_host=grpc-test.sandbox.google.com --server_host_override=grpc-test.sandbox.google.com"
diff --git a/tools/run_tests/jobset.py b/tools/run_tests/jobset.py
index ec25b47..e5e778a 100755
--- a/tools/run_tests/jobset.py
+++ b/tools/run_tests/jobset.py
@@ -130,7 +130,8 @@
 class JobSpec(object):
   """Specifies what to run for a job."""
 
-  def __init__(self, cmdline, shortname=None, environ=None, hash_targets=None, cwd=None, shell=False):
+  def __init__(self, cmdline, shortname=None, environ=None, hash_targets=None,
+               cwd=None, shell=False, timeout_seconds=900):
     """
     Arguments:
       cmdline: a list of arguments to pass as the command line
@@ -148,6 +149,7 @@
     self.hash_targets = hash_targets or []
     self.cwd = cwd
     self.shell = shell
+    self.timeout_seconds = timeout_seconds
 
   def identity(self):
     return '%r %r %r' % (self.cmdline, self.environ, self.hash_targets)
@@ -206,7 +208,7 @@
                 do_newline=self._newline_on_success or self._travis)
         if self._bin_hash:
           update_cache.finished(self._spec.identity(), self._bin_hash)
-    elif self._state == _RUNNING and time.time() - self._start > 900:
+    elif self._state == _RUNNING and time.time() - self._start > self._spec.timeout_seconds:
       self._tempfile.seek(0)
       stdout = self._tempfile.read()
       filtered_stdout = filter(lambda x: x in string.printable, stdout.decode(errors='ignore'))
diff --git a/tools/run_tests/run_sanity.sh b/tools/run_tests/run_sanity.sh
index ebb09d9..18d5ba0 100755
--- a/tools/run_tests/run_sanity.sh
+++ b/tools/run_tests/run_sanity.sh
@@ -44,7 +44,12 @@
 
 diff -u $submodules - << EOF
  05b155ff59114735ec8cd089f669c4c3d8f59029 third_party/gflags (v2.1.0-45-g05b155f)
- 3df69d3aefde7671053d4e3c242b228e5d79c83f third_party/openssl (OpenSSL_1_0_2a)
+ 33dd08320648ac71d7d9d732be774ed3818dccc5 third_party/openssl (OpenSSL_1_0_2d)
  3e2c8a5dd79481e1d36572cdf65be93514ba6581 third_party/protobuf (v3.0.0-alpha-1-1048-g3e2c8a5)
  50893291621658f355bc5b4d450a8d06a563053d third_party/zlib (v1.2.8)
 EOF
+
+if [ -f cache.mk ] ; then
+  echo "Please don't commit cache.mk"
+  exit 1
+fi
diff --git a/tools/run_tests/run_tests.py b/tools/run_tests/run_tests.py
index fa74949..b93f584 100755
--- a/tools/run_tests/run_tests.py
+++ b/tools/run_tests/run_tests.py
@@ -254,6 +254,7 @@
   def test_specs(self, config, travis):
     assemblies = ['Grpc.Core.Tests',
                   'Grpc.Examples.Tests',
+                  'Grpc.HealthCheck.Tests',
                   'Grpc.IntegrationTesting']
     if self.platform == 'windows':
       cmd = 'tools\\run_tests\\run_csharp.bat'