Signed-off-by: Kevin Baichoo <[email protected]>

Commit Message: context: use server factory context as lb context
Additional Description:

1. Simplify the context. We needn't more and more factory context.
2. allow the lb to access other API like runtime when loading
configuration.

NOTE: This PR also changed the signature of the loadConfig() method. The
message validator is removed and you can use the
messageValidationVisitor() of the input factory context to validate the
proto message.

Risk Level: low.
Testing: n/a.
Docs Changes: n/a.
Release Notes: n/a.

---------

Signed-off-by: wangbaiping(wbpcode) <[email protected]>

…813)

Signed-off-by: Greg Greenway <[email protected]>

Commit Message: Fix parameter type in JNI function
Additional Description: The parameter is declared as int in
https://github.com/envoyproxy/envoy/blob/main/mobile/library/java/io/envoyproxy/envoymobile/engine/JniLibrary.java#L309,
implementing it with jlong will cause undefined behavior and potential
crashes.
Risk Level: low
Testing: n/a
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: mobile only

Signed-off-by: Renjie Tang <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

Fixes #35524

Signed-off-by: Zhimeng Shi <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

Signed-off-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>

…n to clear the route cache (#36671)

Commit Message: wasm: removed automatical route refreshment and add a
foreign function to clear the route cache

Additional Description:

Here are the reasons to do this change:
1. It make it's impossible to only mofify the host or path or some
headers but don't effect the route result.
2. Basically, refreshing route is not encouraged. Even the filters
(ext_authz, jwt_authz, ext_proc, etc) who acutally need or want to clear
the route cache will also provide a flag (and basically default to
`false`) to control the behavior.
3. Refreshing route have big effect to the traffic and should only be
done explicitly (code or configurations), we should never change it
implicitly.

Risk Level: low.
Testing: n/a.
Docs Changes: n/a.
Release Notes: n/a.
Platform Specific Features: n/a.

---------

Signed-off-by: wangbaiping/wbpcode <[email protected]>
Signed-off-by: wangbaiping(wbpcode) <[email protected]>

…(#36836)

Signed-off-by: Adi Suissa-Peleg <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

…786)

Commit Message: Remove unused listener FilterChain
on_demand_configuration field

Additional Description:

API added in envoyproxy/envoy#12599 but the
implementation was abandoned in
envoyproxy/envoy#12310. The
`FilterChain.OnDemandConfiguration` message still shows up in docs,
which is confusing:
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener_components.proto.html#config-listener-v3-filterchain-ondemandconfiguration

Risk Level: low
Testing: none
Docs Changes: none
Release Notes: Removed unused
`config.listener.v3.FilterChain.OnDemandConfiguration` message
Platform Specific Features: none

Signed-off-by: Lann Martin <[email protected]>

Commit Message: router: converting internal_only_headers from list to
vector
Additional Description:
Converting the use of std::list to std::vector for
internal_only_headers.
Typically std::vector is better than std::list in many aspects, so
changing the non-mutable list to vector makes more sense.

Risk Level: low - refactor only
Testing: N/A
Docs Changes: N/A
Release Notes: N/A
Platform Specific Features: N/A

Signed-off-by: Adi Suissa-Peleg <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

supportsIpTransparent() and supportsMptcp() results depend on the OS
being run on and the configuration of that OS, so remove the expectation
of a specific value from the tests so that they'll pass in all
environments.

Signed-off-by: Greg Greenway <[email protected]>

…nges (#36702)

Commit Message: srds: remove scope from scope_name_by_hash_ in case the
scope key changes
Additional Description:
When a SRDS resource is updated such that its scope key changes, the
scope_name_by_hash_ map used to detect scope key conflicts keeps the
resource around under the old hash. This may cause spurious conflicts if
the resource is removed and/or a resource is added with the old key, as
demonstrated in the included tests.
Risk Level: low
Testing: CI, also added a DeltaXDS version of the test
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

---------

Signed-off-by: Eugene Chan <[email protected]>
Signed-off-by: pianiststickman <[email protected]>

Risk Level: low
Testing: updated tests
Docs Changes: n/a
Release Notes: n/a
envoyproxy/envoy-mobile#176

Signed-off-by: Alyssa Wilk <[email protected]>

add OLM scaling for max_connection_duration

This allows for configuring scaling the max connection duration in
response to overload.

Risk Level: low
Testing: integration & unit tests
Docs Changes: none
Release Notes: in changelog

---------

Signed-off-by: antoniovleonti <[email protected]>

…(#36926)

Adding a test to validate that the expected stat is incremented when the
server certificate chain is too long to send to the client in the first
round trip.
Risk Level: Low

---------

Signed-off-by: Greg Greenway <[email protected]>

…905)


Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…6906)


Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Fix #36908

Signed-off-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>

Fix #36909

Signed-off-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>

… (#36935)


Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Ryan Northey <[email protected]>

Risk Level: low
Testing: updated tests
Docs Changes: n/a
Release Notes: n/a
envoyproxy/envoy-mobile#176

Signed-off-by: Alyssa Wilk <[email protected]>

Risk Level: high
Testing: adapted tests previously
Docs Changes: yes
Release Notes: yes

---------

Signed-off-by: Alyssa Wilk <[email protected]>

…on (#36703)

Commit Message: permit dynamic SRDS resources to contain inline RDS
configuration
Additional Description:
Currently, scoped_routes specified inline into the HCM may only contain
inline route_configuration, and scoped_routes that are delivered via
SRDS may only contain route_configuration_name which is used to open an
RDS subscription. This PR permits resources delivered via SRDS to
contain inline RouteConfiguration, forgoing the RDS subscription.

Risk Level: low
Testing: CI & integration
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

---------

Signed-off-by: Eugene Chan <[email protected]>

Resolve #36037 

Commit Message: Support dynamic cluster selection per session in UDP
proxy
Additional Description: More details in
envoyproxy/envoy#36037
Risk Level: low
Testing: integration test
Docs Changes:
Release Notes:
Platform Specific Features:

---------

Signed-off-by: Issa Abu Kalbein <[email protected]>
Signed-off-by: IssaAbuKalbein <[email protected]>
Co-authored-by: Issa Abu Kalbein <[email protected]>

…6809)

Commit Message:
This change fixes envoyproxy/envoy#28826. Some
additional discussions for context can be found in
proxy-wasm/proxy-wasm-cpp-host#423.

The issue reported in envoyproxy/envoy#28826
happens when proxy-wasm plugin calls proxy_send_local_response during
the HTTP request proessing and HTTP response processing.

This happens because in attempt to mitigate a use-after-free issue (see
envoyproxy/envoy#23049) we added logic to
proxy-wasm that avoids calling sendLocalReply multiple times.

So now when proxy-wasm plugin calls proxy_send_local_response only the
first call will result in sendLocalReply, while all subsequent calls
will get ignored. At the same time, when proxy-wasm plugins call
proxy_send_local_response, because it's used to report an error in the
plugin, proxy-wasm also stops iteration.

During HTTP request processing this leads to the following chain of
events:

1. During request proxy-wasm plugin calls proxy_send_local_response
2. proxy_send_local_response calls sendLocalReply, which schedules the
local reply to be processed later through the filter chain
3. Request processing filter chain gets aborted and Envoy sends the
previous created local reply though the filter chain
4. Proxy-wasm plugin gets called to process the response it generated
and it calls proxy_send_local_response
5. proxy_send_local_response **does not** call sendLocalReply, because
proxy-wasm prevents multiple calls to sendLocalReply currently
6. proxy-wasm stops iteration

So in the end the filter chain iteration is stopped for the response and
because proxy_send_local_respose does not actually call sendLocalReply
we don't send another locally generated response either.

I think we can do slightly better and close the connection in this case.
This change includes the following parts:

1. Partial rollback of envoyproxy/envoy#23049
2. Tests covering this case and some other using the actual
FilterManager.

The most important question is why rolling back
envoyproxy/envoy#23049 now is safe?

The reason why it's safe, is that since introduction of
prepareLocalReplyViaFilterChain in
envoyproxy/envoy#24367, calling sendLocalReply
multiple times is safe - that PR basically address the issue in a
generic way for all the plugins, so a proxy-wasm specific fix is not
needed anymore.

On top of being safe, there are additional benefits to making this
change:

1. We don't end up with a stuck connection in case of errors, which is
slightly better
2. We remove a failure mode from proxy_send_local_response that was
introduced in envoyproxy/envoy#23049 - which is
good, because proxy-wasm plugins don't have a good fallback when
proxy_send_local_response is failing.

Finally, why replace the current mocks with a real FilterManager?

Mock implementation of sendLocalReply works fine for tests that just
need to assert that sendLocalReply gets called. However, in this case we
rely on the fact that it's safe to call sendLocalReply multiple times
and it will do the right thing and we want to assert that the connection
will get closed in the end - that cannot be tested by just checking that
the sendLocalReply gets called or by relying on a simplistic mock
implementation of sendLocalReply.

Additional Description:
Risk Level: low
Testing: Manually, by reproducing the case reported in
envoyproxy/envoy#28826. I also added new unit
tests and verified that they pass and aren't flaky:

```
bazel test --runs_per_test=1000 //test/extensions/common/wasm:all --config=docker-clang
```

Docs Changes: N/A
Release Notes: N/A
Platform Specific Features: N/A
Fixes #28826

---------

Signed-off-by: Mikhail Krinkin <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

Risk Level: n/a (tools only)
Testing: n/a
Docs Changes: n/a
Release Notes: n/a

Signed-off-by: Alyssa Wilk <[email protected]>

Change-Id: I171afa0d240065d3f4872730fc71d70a46c03a93
Commit Message: remove listener info accessors in plugin config since
they are dead code
Risk Level: low

Signed-off-by: Kuat Yessenov <[email protected]>

<!--
!!!ATTENTION!!!

If you are fixing *any* crash or *any* potential security issue, *do
not*
open a pull request in this repo. Please report the issue via emailing
[email protected] where the issue will be triaged
appropriately.
Thank you in advance for helping to keep Envoy secure.

!!!ATTENTION!!!

For an explanation of how to fill out the fields, please see the
relevant section
in
[PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md)
-->

Commit Message: golang: provide method to refresh route cache
Additional Description:
Risk Level: Low, add new method
Testing: Integration
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
Fixes #36848
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional [API
Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):]

---------

Signed-off-by: spacewander <[email protected]>

<!--
!!!ATTENTION!!!

If you are fixing *any* crash or *any* potential security issue, *do
not*
open a pull request in this repo. Please report the issue via emailing
[email protected] where the issue will be triaged
appropriately.
Thank you in advance for helping to keep Envoy secure.

!!!ATTENTION!!!

For an explanation of how to fill out the fields, please see the
relevant section
in
[PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md)
-->

This PR adds the API for HTTP APIKey Auth Filter that is proposed at
envoyproxy/envoy#34877 and
envoyproxy/gateway#2630.

Commit Message: api: HTTP APIKey Auth Filter
Risk Level: Low (only API)
Testing: WIP (will be done after we agree on the API)
Docs Changes: WIP
Release Notes: WIP
Platform Specific Features: No
Part of: #34877

---------

Signed-off-by: Kensei Nakada <[email protected]>
Signed-off-by: wangbaiping(wbpcode) <[email protected]>
Co-authored-by: wangbaiping(wbpcode) <[email protected]>

Risk Level: low
Testing: updated tests
Docs Changes: n/a
Release Notes: n/a
envoyproxy/envoy-mobile#176

Signed-off-by: Alyssa Wilk <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…… (#36922)

reinstating a false-by-default (true on android) runtime guard.

Risk Level: should be a no-op for anything but android
Testing: n/a
Docs Changes: n/a
Release Notes: n/a

Signed-off-by: Alyssa Wilk <[email protected]>

Commit Message: matchers: remove unneeded ListMatcher data member
Additional Description:
Removed a protobuf that was kept as a data member but only used in the
c'tor.

Risk Level: low
Testing: N/A
Docs Changes: N/A
Release Notes: N/A
Platform Specific Features: N/A

Signed-off-by: Adi Suissa-Peleg <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

An extraneous if block was introduced merging #36702 into #36703. We're
checking this condition above in L282, so this block should never be
executed.

Commit Message: remove a redundant if block
Additional Description: n/a
Risk Level: low
Testing: existing CI
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

Signed-off-by: Eugene Chan <[email protected]>

Signed-off-by: Adi Suissa-Peleg <[email protected]>

Currently this breaks running `bazel aquery "deps(...)"` - not sure why

Signed-off-by: Ryan Northey <[email protected]>

Risk Level: medium
Testing: updated tests
Docs Changes: n/a
Release Notes: n/a
envoyproxy/envoy-mobile#176

Signed-off-by: Alyssa Wilk <[email protected]>

Fixes #12954

Signed-off-by: Rama Chavali <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

Signed-off-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>

Signed-off-by: Adi Suissa-Peleg <[email protected]>

…derData (#36878)

Signed-off-by: Adi Suissa-Peleg <[email protected]>

Commit Message: Add cancelWrapper helper function in /common.
Additional Description: In the cache filter implementation where there
are multiple async streams and objects in flight any of which can be
aborted from outside the filter's own flow, it's convenient and clear to
have a cancel operation performed on being destroyed, rather than
inferring "don't call the callback" from a `weak_ptr` (which can do the
wrong thing in that onDestroy can happen before destructor, and is
verbose and repetitive). Implementing these cancellation functions
manually every time is also error-prone and repetitive. This introduces
a reusable wrapper template to facilitate cancellable callbacks.
Risk Level: None, no change to production code yet.
Testing: Unit tested.
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

---------

Signed-off-by: Raven Black <[email protected]>

Commit Message: Enabling envoy test cases by adding missing options for
s390x
Additional Description: envoy test cases were enabled for s390x, so
included the missing options

Signed-off-by: Surender Yadav <[email protected]>

This PR make the tests `HTTPRequestUsingProxyTest.swift` hermetic since
it's causing 403 issues when hitting external URLs, for example:
-
https://github.com/envoyproxy/envoy/actions/runs/11671611154/job/32500065249
-
https://github.com/envoyproxy/envoy/actions/runs/11670461951/job/32494723883

This PR also fixes and enables `testHTTPSRequestUsingProxy` test that
was previously disabled.

Risk Level: low (tests only)
Testing: unit test
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

---------

Signed-off-by: Fredy Wijaya <[email protected]>

Update QUICHE from 5621f6366 to aaf48d2e5
 
https://github.com/google/quiche/compare/5621f6366..aaf48d2e5
    
```
$ git log 5621f6366..aaf48d2e5 --date=short --no-merges --format="%ad %al %s"
     
2024-11-04 asedeno MASQUE: add tap bridging support for CONNECT-ETHERNET
2024-11-04 quiche-dev Fix the issue that -Wrange-loop-construct higlighted in quiche.
2024-11-01 martinduke Send raw counts of reported ECN marks in QUIC ACK frames to the debugger.
2024-11-01 wub No public description
2024-11-01 quiche-dev Mark sec-authenticated-request-headers as a repeated header
2024-10-31 ricea Remove a stray semi-colon from quiche_protocol_flags_list.h
2024-10-31 birenroy Adds unit tests for clients handling END_STREAM after 1xx headers without final response headers.
2024-10-29 wub Add transport parameter 'discard' to QUIC and switch connection option `CHP1` and `CHP2` to use it.
2024-10-29 rch Record stats when forward progress is made on a QUIC connection after changing the flow label on PTO.
2024-10-29 vasilvv Implement QuicAlarmMultiplexer.
2024-10-28 wub Deprecate gfe2_reloadable_flag_quic_add_ssl_error_stack_to_error_detail.
2024-10-28 martinduke Parser/Framer for MoQT FETCH Stream messages.
2024-10-28 martinduke Delete Subscribe ID from MoQT Object headers
```

---------

Signed-off-by: Fredy Wijaya <[email protected]>

PR updates the location of the envoy's build folder which was moved from
`envoy-build-tools` to `docker`.

Signed-off-by: Emmanuel Ferdman <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

Commit Message: kafka: close connection when rejectable request appears
Additional Description: provides
envoyproxy/envoy#36978 by making the broker
filter check the requests' API key against allow/denylists in the config
- if we find a request to reject, we just close the connection. There is
also a bonus: this sets up a framework for "_close connection if we
don't like the request_" that we can expand upon later.
Risk Level: Low
Testing: automated (no filtering) + manual (filtering)
Docs Changes: Kafka broker .rst
Release Notes: n/a
Platform Specific Features: n/a

---------

Signed-off-by: Adam Kotwasinski <[email protected]>

- Remove obsolete TODO. Refactor is not needed as we will need add a new
isClosed() helper fucntion which is virtual function and will be invoked
multiple layers/classes.
- Use isEnvoyGrpc helper in the test

Signed-off-by: tyxia <[email protected]>

Fix #36843

Signed-off-by: Ryan Northey <[email protected]>

the `envoy_package` rule works against bazel's visibility system by just
making everything visible - which is a bit of an anti-pattern - but it
also pulls in a lot of unused/unnecessary deps when accessing tools

Signed-off-by: Ryan Northey <[email protected]>

Commit Message: wasm: remove the shutdown callback in lifetime_notifier
Fixes: #35882

---------

Signed-off-by: Boteng Yao <[email protected]>

Commit Message: Downstream apply back pressure to Sidestream and
Upstream when downstream buffers are overrun.
Risk Level: Low, whole flow control is runtime guarded 
Testing: Unit test; ext_proc integration test: sidestream response to
downstream triggers the back pressure.
Docs Changes: N/A
Release Notes: N/A
Platform Specific Features: N/A

---------

Signed-off-by: tyxia <[email protected]>

…(#36994)



Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

See istio/istio#53426. Istio has used
underscores in their SNI since the beginning and it is critical to its
functionality. Usage of underscores in SNI is a bit of a grey area in
the RFCs, which are extremely under-specified wrt to what exactly is the
allowed formats. However, the de-facto standard is to allow them, as
virtually every TLS library does so (including, but not limited to,
Golang, rustls, openssl, boringssl).

This PR loosens the restriction to additionally allow underscores.

Note the intent of the SNI restrictions was not RFC compliance, etc --
but rather to fix [log
injection](GHSA-p222-xhp9-39rc)
attacks (putting ANSI escapes, HTML, etc) into logs. This change does
not loosen the security properties we hoped to gain with the initial
patch.

Signed-off-by: John Howard <[email protected]>

**Commit Message**: add `upstream.request_attempt_count` to get the
number of times a request is attempted upstream
**Additional Description**: Added a new attribute to extract
`upstream.request_attempt_count` from the `StreamInfo()`. This could be
used in CEL Matcher for access log filtering.
**Risk Level**: Low
**Testing:** Added Unit Tests
**Docs Changes:** Added
**Release Notes:** Added

---------

Signed-off-by: Rohit Agrawal <[email protected]>
Signed-off-by: Rohit Agrawal <[email protected]>

Part of #21595 
Risk Level: low

Signed-off-by: Gustavo <[email protected]>

Followup to #36938, in debug builds, enforcing
the directive that callbacks and cancellations must be on the same
thread.

Signed-off-by: Raven Black <[email protected]>

Adds a release note for
envoyproxy/envoy#36950 (comment)

Signed-off-by: John Howard <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

…#37013)


Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Ryan Northey <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

Workaround for #36984

Signed-off-by: Ryan Northey <[email protected]>

Signed-off-by: spacewander <[email protected]>

…ts (#36998)

Signed-off-by: Greg Greenway <[email protected]>

This also includes a gRPC dependency update.

Signed-off-by: Greg Greenway <[email protected]>

With reference to PR envoyproxy/envoy#36915 by
mistake added the .cc extension instead of the .h extension. So fixing
the extension to (options_impl_platform_linux.h).

Signed-off-by: Surender Yadav <[email protected]>

…36434)

# Description

This change adds support for specifying an optional header to ip-tagging
filter instead of the default header that it uses (`x-envoy-ip-tags`).

example
```
   http_filters
     - name: ip.tagging
       typed_config:
         "@type": type.googleapis.com/envoy.extensions.filters.http.ip_tagging.v3.IPTagging
         request_type: BOTH
         ip_tag_header: "x-slack-foo-bar"
         ip_tags: []
```

# Why

Currently, the ip-tagging filter always writes its output into the
`x-envoy-ip-tags` header. When this filter is used for more than one
purpose in the same filter chain which we do at Slack in our production
environment, we do need to take care of cleaning up the header in
between which has been proven a bit tricky sometimes. Leaking the values
in between the filter chain is bad so we try to avoid that.

We would like this to be configurable. This way we can use the optional
header instead of trying the use the same header however many times the
same filter is used on the same filter chain in a listener.

# Risk Level
this is a new feature, doesn't affect the existing functionality so
guessing low but open to changing if I'm wrong.

# Testing
added test

Docs Changes: Added, alongside release notes

Co-authored-by: Ariane van der Steldt
[[email protected]](mailto:[email protected])
Signed-off-by: Radha Kumari
[[email protected]](mailto:[email protected])

---------

Signed-off-by: Radha Kumari <[email protected]>
Signed-off-by: Radha <[email protected]>
Signed-off-by: Radha <[email protected]>
Signed-off-by: Ariane van der Steldt <[email protected]>
Co-authored-by: Adi (Suissa) Peleg <[email protected]>
Co-authored-by: Ariane van der Steldt <[email protected]>

Risk Level: low
Testing: updated tests
Docs Changes: n/a
Release Notes: n/a
envoyproxy/envoy-mobile#176

Signed-off-by: Alyssa Wilk <[email protected]>

ext_proc: refactoring onData() to make it modularized based on the
comments:
https://github.com/envoyproxy/envoy/pull/34942/files#r1829466794

Fixes: issue: #36970

---------

Signed-off-by: Yanjun Xiang <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>

For cel, envoy_toolshed, fmt, protoc-gen-jsonschema, shellcheck rules

Risk Level: Low
Docs Changes: add and fix license URLs of external components

Signed-off-by: Michael Kaufmann <[email protected]>

…… (#36947)

## Background

We recently saw a small number of DNS queries getting timed out. There
is currently no option for us to [initialize
c-ares](https://c-ares.org/ares_init_options.html) by passing in a
custom
[timeout](https://c-ares.org/ares_init_options.html#:~:text=c%2Dares%201.5.2.-,ARES_OPT_TIMEOUTMS,-int%20timeout%3B)
and
[tries](https://c-ares.org/ares_init_options.html#:~:text=c%2Dares%201.5.2.-,ARES_OPT_TRIES,-int%20tries%3B)
config options.

## Changes
In this PR, we are adding two new options in c-ares resolver for
configuring custom timeouts and tries while resolving DNS queries.
Custom timeouts could be configured by specifying
`query_timeout_seconds` option and custom tries could be configured by
specifying `query_tries` config option.

**Commit Message:** dns resolver: add options to initialize c-ares with
custom timeout and tries
**Additional Description:** add two new options called
`query_timeout_seconds` and `query_tries` for initializing c-ares with
custom timeout and tries.
**Risk Level:** Low
**Testing:** Added Unit/Integration Tests
**Docs Changes:** Added
**Release Notes:** Added
**Platform Specific Features:** N/A

---------

Signed-off-by: Rohit Agrawal <[email protected]>

## Description

Add additional unit tests to cover edge cases in DNS cache.

---

**Commit Message:** dns_cache: add more unit tests
**Additional Description:** Added a few more tests to cover edge
scenarios in DNS cache implementation.
**Risk Level:** Very Low
**Testing:** Added
**Docs Changes:** N/A
**Release Notes:** N/A

Signed-off-by: Rohit Agrawal <[email protected]>

Commit Message: Remove extraneous target
source/common/common:xds_manager_lib

Fairly sure that this was introduced in #36768 by mistake. I can't find
any references to the target, `source/common/common/xds_manager_impl.{h,c}` don't exist.

Signed-off-by: Steven Jin Xuan <[email protected]>

build file change removing an unnecessary (and disallowed) extension
dependency.

Risk Level: low
Testing: n/a
Docs Changes: n/a
Release Notes: n/a

Signed-off-by: Alyssa Wilk <[email protected]>

fetch doesnt work very well or in ways you would expect (may improve
with bzlmod)

currently this isnt used but when we add it back we will use `aquery`
instead to populate the cache

Signed-off-by: Ryan Northey <[email protected]>

…7018)

An internal tool we have notified us that some API fields and
enum-values that we use do not have comments.
I've added some comments, and updated some of the ext-proc comments to
make it a bit clearer.

Signed-off-by: Adi Suissa-Peleg <[email protected]>

…when linking ICU tools (#37060)

Commit Message:

Clang and gcc are subtly different and it seems to be the cause of
contrib build failures reported in
envoyproxy/envoy#31807 (e.g., when using gcc
to link the final binary it results in a bunch of essential for gcc C++
symbols like __gxx_personality_v0).

The issue appear to be the order of the libraries when linking. gcc,
when building statically linked binaries basically needs libstdc++ to be
the last library or alsmot the last library in the command line. And
clang does not appear to care about it much.

This change provides libstdc++ library in LIBS environment variabe which
will put it in the right position when building the ICU library. This
works well for both clang and gcc.

Additional Description:

It address the issue reported in
envoyproxy/envoy#31807, though by itseld this
change is not enough to make gcc builds work - a few more changes are
needed.

Risk Level: Low
Testing: built with `--config=gcc` and `--config=docker-gcc` and checked
that //contrib/language/filters/http/test:language_config_test pass
after the change.
Docs Changes: N/A
Release Notes: N/A
Platform Specific Features: N/A

Signed-off-by: Mikhail Krinkin <[email protected]>

…37061)


Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Ryan Northey <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Ryan Northey <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

Signed-off-by: Ryan Northey <[email protected]>

Commit Message: kafka: split protocol generation into .h and .cc files
Additional Description: instead of having enormous generated
`requests.h` and `responses.h`, split them into header and
implementation files - this will allow me to add proper static functions
in the future (such as the one converting `string request_name ->
int16_t api_key` for better configs)
Risk Level: low
Testing: unit and integration tests
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

---------

Signed-off-by: Adam Kotwasinski <[email protected]>

Commit Message: When HTTP/3 is not known to work, we should attempt both
QUIC and TCP at the same time instead of giving QUIC a head start and
delaying the TCP connection attempt.
Additional Description: In Envoy Mobile, the HTTP/3 status will be reset
upon network change.
Risk Level: low (runtime guarded and the default is false)
Testing: unit and integration tests
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: quic, mobile
Optional Runtime guard: `envoy.reloadable_features.quic_no_tcp_delay`
(default is false)

---------

Signed-off-by: Fredy Wijaya <[email protected]>