Merge branch 'envoyproxy:main' into add_tunnel_impl

.bazelrc

@@ -343,7 +343,7 @@ build:compile-time-options --@envoy//source/extensions/filters/http/kill_request
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:56f235b141079013e64912d676fe7da981368402@sha256:d44499c6fd28a8a6a75dc61668b8a9e7bc3d99db11f9a61e8ea1d1f39c20a236
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:94e5d873c145ae86f205117e76276161c9af4806@sha256:8d3763e19d5b71fdc95666d75073ce4581e566ce28ca09106607b6a3ef7ba902
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM gcr.io/envoy-ci/envoy-build:56f235b141079013e64912d676fe7da981368402@sha256:6e3e8bd34ba568befa3f9c2fd067a1d82c1e55f0f597bcc5fddebbb644930761
+FROM gcr.io/envoy-ci/envoy-build:94e5d873c145ae86f205117e76276161c9af4806@sha256:3c3d299423a878a219a333153726cddf7cc5e5ff30f596dc97bafba521f2f928
 
 ARG USERNAME=vscode
 ARG USER_UID=501

.github/workflows/_env.yml

@@ -12,13 +12,13 @@ on:
         default: envoyproxy/envoy-build-ubuntu
       build_image_sha:
         type: string
-        default: d44499c6fd28a8a6a75dc61668b8a9e7bc3d99db11f9a61e8ea1d1f39c20a236
+        default: 8d3763e19d5b71fdc95666d75073ce4581e566ce28ca09106607b6a3ef7ba902
       build_image_mobile_sha:
         type: string
-        default: b3cfc59c2fd1a86a2b12d303324f33d7f7248458233f3be2959fab119b11fa6f
+        default: 0f51a1015964355092d9204acdacdd727474d1af189bc256dd5a28e6126f9c95
       build_image_tag:
         type: string
-        default: 56f235b141079013e64912d676fe7da981368402
+        default: 94e5d873c145ae86f205117e76276161c9af4806
 
       check_mobile_run:
         type: boolean

.github/workflows/mobile-docs.yml

@@ -30,21 +30,29 @@ jobs:
     runs-on: ${{ needs.env.outputs.agent_ubuntu }}
     timeout-minutes: 20
     steps:
+    # Checkout the Envoy repo
     - uses: actions/checkout@v4
+    # Checkout the envoy-mobile/envoy-mobile.github.io repo
+    - uses: actions/checkout@v4
+      with:
+        repository: envoy-mobile/envoy-mobile.github.io
+        path: mobile-docs
+        fetch-depth: 0
+        ssh-key: ${{ secrets.ENVOY_MOBILE_WEBSITE_DEPLOY_KEY }}
     - name: Add safe directory
       run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+    # Not sure if this is necessary
+    - name: Add safe directory
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE/mobile-docs"
     - name: Generate docs
       run: ./ci/run_envoy_docker.sh 'cd mobile && docs/build.sh'
-    - name: Set up deploy key
-      if: github.ref == 'refs/heads/main'
-      uses: shimataro/[email protected]
-      with:
-        key: ${{ secrets.ENVOY_MOBILE_WEBSITE_DEPLOY_KEY }}
-        known_hosts: unnecessary
     - name: Publish docs
-      if: github.ref == 'refs/heads/main'
       run: ./ci/run_envoy_docker.sh 'cd mobile && docs/publish.sh'
+      env:
+        # Path relative to ./mobile directory
+        MOBILE_DOCS_CHECKOUT_DIR: ../mobile-docs
+        MOBILE_PUSH_CHANGES: ${{ github.event_name != 'pull_request' }}
     - uses: actions/upload-artifact@v3
       with:
         name: docs
-        path: generated/docs
+        path: mobile/generated/docs

api/BUILD

@@ -236,6 +236,7 @@ proto_library(
         "//envoy/extensions/filters/network/wasm/v3:pkg",
         "//envoy/extensions/filters/network/zookeeper_proxy/v3:pkg",
         "//envoy/extensions/filters/udp/dns_filter/v3:pkg",
+        "//envoy/extensions/filters/udp/udp_proxy/session/http_capsule/v3:pkg",
         "//envoy/extensions/filters/udp/udp_proxy/v3:pkg",
         "//envoy/extensions/formatter/cel/v3:pkg",
         "//envoy/extensions/formatter/metadata/v3:pkg",

api/envoy/config/route/v3/route_components.proto

@@ -619,7 +619,8 @@ message RouteMatch {
   // match. The router will check the query string from the ``path`` header
   // against all the specified query parameters. If the number of specified
   // query parameters is nonzero, they all must match the ``path`` header's
-  // query string for a match to occur.
+  // query string for a match to occur.  In the event query parameters are
+  // repeated, only the first value for each key will be considered.
   //
   // .. note::
   //

api/envoy/extensions/common/matching/v3/BUILD

@@ -10,7 +10,6 @@ api_proto_package(
         "//envoy/config/common/matcher/v3:pkg",
         "//envoy/config/core/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
-        "@com_github_cncf_udpa//xds/annotations/v3:pkg",
         "@com_github_cncf_udpa//xds/type/matcher/v3:pkg",
     ],
 )

api/envoy/extensions/common/matching/v3/extension_matcher.proto

@@ -5,7 +5,6 @@ package envoy.extensions.common.matching.v3;
 import "envoy/config/common/matcher/v3/matcher.proto";
 import "envoy/config/core/v3/extension.proto";
 
-import "xds/annotations/v3/status.proto";
 import "xds/type/matcher/v3/matcher.proto";
 
 import "envoy/annotations/deprecation.proto";
@@ -24,8 +23,6 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // decorating an existing extension with a matcher, which can be used to match against
 // relevant protocol data.
 message ExtensionWithMatcher {
-  option (xds.annotations.v3.message_status).work_in_progress = true;
-
   // The associated matcher. This is deprecated in favor of xds_matcher.
   config.common.matcher.v3.Matcher matcher = 1
       [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];

api/envoy/extensions/filters/http/composite/v3/BUILD

@@ -8,6 +8,5 @@ api_proto_package(
     deps = [
         "//envoy/config/core/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
-        "@com_github_cncf_udpa//xds/annotations/v3:pkg",
     ],
 )

api/envoy/extensions/filters/http/composite/v3/composite.proto

@@ -4,8 +4,6 @@ package envoy.extensions.filters.http.composite.v3;
 
 import "envoy/config/core/v3/extension.proto";
 
-import "xds/annotations/v3/status.proto";
-
 import "udpa/annotations/status.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.http.composite.v3";
@@ -29,7 +27,6 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // :ref:`ExecuteFilterAction <envoy_v3_api_msg_extensions.filters.http.composite.v3.ExecuteFilterAction>`)
 // which filter configuration to create and delegate to.
 message Composite {
-  option (xds.annotations.v3.message_status).work_in_progress = true;
 }
 
 // Composite match action (see :ref:`matching docs <arch_overview_matching_api>` for more info on match actions).

api/envoy/extensions/filters/udp/udp_proxy/session/http_capsule/v3/BUILD

@@ -0,0 +1,9 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"],
+)

api/envoy/extensions/filters/udp/udp_proxy/session/http_capsule/v3/http_capsule.proto

@@ -0,0 +1,18 @@
+syntax = "proto3";
+
+package envoy.extensions.filters.udp.udp_proxy.session.http_capsule.v3;
+
+import "udpa/annotations/status.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.filters.udp.udp_proxy.session.http_capsule.v3";
+option java_outer_classname = "HttpCapsuleProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/udp/udp_proxy/session/http_capsule/v3;http_capsulev3";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: UDP HTTP Capsule filter]
+// UDP to HTTP capsules :ref:`overview <config_udp_session_filters_http_capsule>`.
+// [#extension: envoy.filters.udp.session.http_capsule]
+
+message FilterConfig {
+}

api/envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto

@@ -127,5 +127,6 @@ message UdpProxyConfig {
 
   // Optional session filters that will run for each UDP session.
   // Only one of use_per_packet_load_balancing or session_filters can be used.
+  // [#extension-category: envoy.filters.udp.session]
   repeated SessionFilter session_filters = 11;
 }

api/versioning/BUILD

@@ -174,6 +174,7 @@ proto_library(
         "//envoy/extensions/filters/network/wasm/v3:pkg",
         "//envoy/extensions/filters/network/zookeeper_proxy/v3:pkg",
         "//envoy/extensions/filters/udp/dns_filter/v3:pkg",
+        "//envoy/extensions/filters/udp/udp_proxy/session/http_capsule/v3:pkg",
         "//envoy/extensions/filters/udp/udp_proxy/v3:pkg",
         "//envoy/extensions/formatter/cel/v3:pkg",
         "//envoy/extensions/formatter/metadata/v3:pkg",

bazel/repository_locations.bzl

@@ -102,11 +102,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "envoy-build-tools",
         project_desc = "Common build tools shared by the Envoy/UDPA ecosystem",
         project_url = "https://github.com/envoyproxy/envoy-build-tools",
-        version = "633f57439ba683c1370fb8b1025680f1ce678caf",
-        sha256 = "88e4b7d12429d488daff522b765f0f21a3204d2c4b262b4b9d67587230415454",
+        version = "fc1ab3e96cf275ecaac913be2a22bce4a74b9272",
+        sha256 = "75fff0c28766ccb4e625244e35c950eb071d4bfb4a443b387140e1c037eeb6cc",
         strip_prefix = "envoy-build-tools-{version}",
         urls = ["https://github.com/envoyproxy/envoy-build-tools/archive/{version}.tar.gz"],
-        release_date = "2023-09-15",
+        release_date = "2023-09-20",
         use_category = ["build"],
         license = "Apache-2.0",
         license_url = "https://github.com/envoyproxy/envoy-build-tools/blob/{version}/LICENSE",

changelogs/current.yaml

@@ -256,6 +256,10 @@ new_features:
   change: |
     added :ref:` stats prefix option<envoy_v3_api_field_extensions.stat_sinks.open_telemetry.v3.SinkConfig.stats_prefix>`
     to OTLP stats sink that enables adding a static prefix to all stats flushed by this sink.
+- area: udp_proxy
+  change: |
+    added :ref:`http_capsule <envoy_v3_api_msg_extensions.filters.udp.udp_proxy.session.http_capsule.v3.FilterConfig>` UDP session filter
+    that can be used to encapsule or decapsulate UDP datagrams in HTTP, when used for UDP tunneling.
 - area: tap
   change: |
     added :ref:`record_headers_received_time <envoy_v3_api_field_extensions.filters.http.tap.v3.Tap.record_headers_received_time>`

ci/run_envoy_docker.sh

@@ -56,16 +56,6 @@ else
   BUILD_DIR_MOUNT_DEST=/build
   SOURCE_DIR="${PWD}"
   SOURCE_DIR_MOUNT_DEST=/source
-  if [[ -n "$DOCKER_IN_DOCKER" ]]; then
-      DOCKER_START_EXTRA=(
-          "echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /' | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list"
-          "&& curl -fsSL https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/xUbuntu_20.04/Release.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/devel_kubic_libcontainers_stable.gpg > /dev/null"
-          "&& apt-get -qq update -y"
-          "&& apt-get -qq install -y --no-install-recommends skopeo")
-  else
-      DOCKER_START_EXTRA=(":")
-  fi
-
   START_COMMAND=(
       "/bin/bash"
       "-lc"
@@ -74,7 +64,6 @@ else
           && usermod -a -G pcap envoybuild \
           && chown envoybuild:envoygroup /build \
           && chown envoybuild /proc/self/fd/2 \
-          && ${DOCKER_START_EXTRA[*]} \
           && sudo -EHs -u envoybuild bash -c 'cd /source && $*'")
 fi
 
@@ -171,6 +160,8 @@ docker run --rm \
        -e GITHUB_TOKEN \
        -e GITHUB_APP_ID \
        -e GITHUB_INSTALL_ID \
+       -e MOBILE_DOCS_CHECKOUT_DIR \
+       -e MOBILE_PUSH_CHANGES \
        -e NETLIFY_TRIGGER_URL \
        -e BUILD_SOURCEBRANCHNAME \
        -e BAZELISK_BASE_URL \

contrib/golang/common/go/api/type.go

@@ -126,9 +126,6 @@ type HeaderMap interface {
 
 	// RangeWithCopy calls f sequentially for each key and value copied from the map.
 	RangeWithCopy(f func(key, value string) bool)
-
-	// ByteSize return size of HeaderMap
-	ByteSize() uint64
 }
 
 type RequestHeaderMap interface {

contrib/golang/filters/http/source/go/pkg/http/type.go

@@ -46,11 +46,6 @@ type headerMapImpl struct {
 	mutex       sync.Mutex
 }
 
-// ByteSize return size of HeaderMap
-func (h *headerMapImpl) ByteSize() uint64 {
-	return h.headerBytes
-}
-
 type requestOrResponseHeaderMapImpl struct {
 	headerMapImpl
 }
@@ -337,17 +332,19 @@ type httpBuffer struct {
 var _ api.BufferInstance = (*httpBuffer)(nil)
 
 func (b *httpBuffer) Write(p []byte) (n int, err error) {
-	cAPI.HttpSetBufferHelper(unsafe.Pointer(b.request.req), b.envoyBufferInstance, string(p), api.AppendBuffer)
-	return len(p), nil
+	return b.WriteString(string(p))
 }
 
 func (b *httpBuffer) WriteString(s string) (n int, err error) {
 	cAPI.HttpSetBufferHelper(unsafe.Pointer(b.request.req), b.envoyBufferInstance, s, api.AppendBuffer)
-	return len(s), nil
+	n = len(s)
+	b.length += uint64(n)
+	return n, nil
 }
 
 func (b *httpBuffer) WriteByte(p byte) error {
 	cAPI.HttpSetBufferHelper(unsafe.Pointer(b.request.req), b.envoyBufferInstance, string(p), api.AppendBuffer)
+	b.length++
 	return nil
 }
 
@@ -409,31 +406,35 @@ func (b *httpBuffer) String() string {
 }
 
 func (b *httpBuffer) Append(data []byte) error {
-	cAPI.HttpSetBufferHelper(unsafe.Pointer(b.request.req), b.envoyBufferInstance, string(data), api.AppendBuffer)
-	return nil
+	_, err := b.Write(data)
+	return err
 }
 
 func (b *httpBuffer) Prepend(data []byte) error {
 	cAPI.HttpSetBufferHelper(unsafe.Pointer(b.request.req), b.envoyBufferInstance, string(data), api.PrependBuffer)
+	b.length += uint64(len(data))
 	return nil
 }
 
 func (b *httpBuffer) AppendString(s string) error {
-	cAPI.HttpSetBufferHelper(unsafe.Pointer(b.request.req), b.envoyBufferInstance, s, api.AppendBuffer)
-	return nil
+	_, err := b.WriteString(s)
+	return err
 }
 
 func (b *httpBuffer) PrependString(s string) error {
 	cAPI.HttpSetBufferHelper(unsafe.Pointer(b.request.req), b.envoyBufferInstance, s, api.PrependBuffer)
+	b.length += uint64(len(s))
 	return nil
 }
 
 func (b *httpBuffer) Set(data []byte) error {
 	cAPI.HttpSetBufferHelper(unsafe.Pointer(b.request.req), b.envoyBufferInstance, string(data), api.SetBuffer)
+	b.length = uint64(len(data))
 	return nil
 }
 
 func (b *httpBuffer) SetString(s string) error {
 	cAPI.HttpSetBufferHelper(unsafe.Pointer(b.request.req), b.envoyBufferInstance, s, api.SetBuffer)
+	b.length = uint64(len(s))
 	return nil
 }

contrib/golang/filters/http/test/golang_integration_test.cc

@@ -794,6 +794,8 @@ TEST_P(GolangIntegrationTest, BufferReset) { testBufferApi("Reset"); }
 
 TEST_P(GolangIntegrationTest, BufferResetAfterDrain) { testBufferApi("ResetAfterDrain"); }
 
+TEST_P(GolangIntegrationTest, BufferLen) { testBufferApi("Len"); }
+
 TEST_P(GolangIntegrationTest, Property) {
   initializePropertyConfig(PROPERTY, genSoPath(PROPERTY), PROPERTY);
   initialize();