Merge branch 'main' into recvmsg

Signed-off-by: Martin Duke <martin.h.duke@gmail.com>

.github/workflows/_precheck_deps.yml

@@ -55,4 +55,4 @@ jobs:
  ref: ${{ fromJSON(inputs.request).request.sha }}
  persist-credentials: false
  - name: Dependency Review
- uses: actions/dependency-review-action@5bbc3ba658137598168acb2ab73b21c432dd411b # v4.2.5
+ uses: actions/dependency-review-action@e58c696e52cac8e62d61cc21fda89565d71505d7 # v4.3.1

README.md

@@ -20,9 +20,6 @@ involved and how Envoy plays a role, read the CNCF
 * [Official documentation](https://www.envoyproxy.io/)
 * [FAQ](https://www.envoyproxy.io/docs/envoy/latest/faq/overview)
 * [Unofficial Chinese documentation](https://cloudnative.to/envoy/)
-* Watch [a video overview of Envoy](https://www.youtube.com/watch?v=RVZX4CwKhGE)
-([transcript](https://www.microservices.com/talks/lyfts-envoy-monolith-service-mesh-matt-klein/))
-to find out more about the origin story and design philosophy of Envoy
 * [Blog](https://medium.com/@mattklein123/envoy-threading-model-a8d44b922310) about the threading model
 * [Blog](https://medium.com/@mattklein123/envoy-hot-restart-1d16b14555b5) about hot restart
 * [Blog](https://medium.com/@mattklein123/envoy-stats-b65c7f363342) about stats architecture

api/bazel/cc_proto_descriptor_library/builddefs.bzl

@@ -304,9 +304,6 @@ def _get_cc_proto_descriptor_library_aspect_provides():
 
 cc_proto_descriptor_library_aspect = aspect(
  attrs = _maybe_add({
- #"_copts": attr.label(
- # default = "//:upb_proto_library_copts__for_generated_code_only_do_not_use",
- #),
  "_gen_descriptor": attr.label(
  executable = True,
  cfg = "exec",

api/bazel/repository_locations.bzl

@@ -105,9 +105,9 @@ REPOSITORY_LOCATIONS_SPEC = dict(
  project_name = "Protobuf Rules for Bazel",
  project_desc = "Protocol buffer rules for Bazel",
  project_url = "https://github.com/bazelbuild/rules_proto",
- version = "4.0.0",
- sha256 = "66bfdf8782796239d3875d37e7de19b1d94301e8972b3cbd2446b332429b4df1",
- release_date = "2021-09-15",
+ version = "5.3.0-21.7",
+ sha256 = "dc3fb206a2cb3441b485eb1e423165b231235a1ea9b031b4433cf7bc1fa460dd",
+ release_date = "2022-12-27",
  strip_prefix = "rules_proto-{version}",
  urls = ["https://github.com/bazelbuild/rules_proto/archive/refs/tags/{version}.tar.gz"],
  use_category = ["api"],

api/envoy/config/route/v3/route_components.proto

@@ -763,7 +763,8 @@ message RouteAction {
  // collected for the shadow cluster making this feature useful for testing.
  //
  // During shadowing, the host/authority header is altered such that ``-shadow`` is appended. This is
- // useful for logging. For example, ``cluster1`` becomes ``cluster1-shadow``.
+ // useful for logging. For example, ``cluster1`` becomes ``cluster1-shadow``. This behavior can be
+ // disabled by setting ``disable_shadow_host_suffix_append`` to ``true``.
  //
  // .. note::
  //
@@ -772,7 +773,7 @@ message RouteAction {
  // .. note::
  //
  // Shadowing doesn't support Http CONNECT and upgrades.
- // [#next-free-field: 6]
+ // [#next-free-field: 7]
  message RequestMirrorPolicy {
  option (udpa.annotations.versioning).previous_message_type =
  "envoy.api.v2.route.RouteAction.RequestMirrorPolicy";
@@ -818,6 +819,9 @@ message RouteAction {
 
  // Determines if the trace span should be sampled. Defaults to true.
  google.protobuf.BoolValue trace_sampled = 4;
+
+ // Disables appending the ``-shadow`` suffix to the shadowed ``Host`` header. Defaults to ``false``.
+ bool disable_shadow_host_suffix_append = 6;
  }
 
  // Specifies the route's hashing policy if the upstream cluster uses a hashing :ref:`load balancer

api/envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto

@@ -11,6 +11,7 @@ import "envoy/type/matcher/v3/string.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 
+import "udpa/annotations/migrate.proto";
 import "udpa/annotations/status.proto";
 import "validate/validate.proto";
 
@@ -97,8 +98,27 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // <arch_overview_advanced_filter_state_sharing>` object in a namespace matching the filter
 // name.
 //
-// [#next-free-field: 18]
+// [#next-free-field: 19]
 message ExternalProcessor {
+ // Describes the route cache action to be taken when an external processor response
+ // is received in response to request headers.
+ enum RouteCacheAction {
+ // The default behavior is to clear the route cache only when the
+ // :ref:`clear_route_cache <envoy_v3_api_field_service.ext_proc.v3.CommonResponse.clear_route_cache>`
+ // field is set in an external processor response.
+ DEFAULT = 0;
+
+ // Always clear the route cache irrespective of the clear_route_cache bit in
+ // the external processor response.
+ CLEAR = 1;
+
+ // Do not clear the route cache irrespective of the clear_route_cache bit in
+ // the external processor response. Setting to RETAIN is equivalent to set the
+ // :ref:`disable_clear_route_cache <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.disable_clear_route_cache>`
+ // to true.
+ RETAIN = 2;
+ }
+
  reserved 4;
 
  reserved "async_mode";
@@ -172,11 +192,6 @@ message ExternalProcessor {
  gte {}
  }];
 
- // Prevents clearing the route-cache when the
- // :ref:`clear_route_cache <envoy_v3_api_field_service.ext_proc.v3.CommonResponse.clear_route_cache>`
- // field is set in an external processor response.
- bool disable_clear_route_cache = 11;
-
  // Allow headers matching the ``forward_rules`` to be forwarded to the external processing server.
  // If not set, all headers are forwarded to the external processing server.
  HeaderForwardingRules forward_rules = 12;
@@ -226,6 +241,22 @@ message ExternalProcessor {
  // This work is currently tracked under https://github.com/envoyproxy/envoy/issues/33319.
  //
  bool observability_mode = 17;
+
+ // Prevents clearing the route-cache when the
+ // :ref:`clear_route_cache <envoy_v3_api_field_service.ext_proc.v3.CommonResponse.clear_route_cache>`
+ // field is set in an external processor response.
+ // Only one of ``disable_clear_route_cache`` or ``route_cache_action`` can be set.
+ // It is recommended to set ``route_cache_action`` which supersedes ``disable_clear_route_cache``.
+ bool disable_clear_route_cache = 11
+ [(udpa.annotations.field_migrate).oneof_promotion = "clear_route_cache_type"];
+
+ // [#not-implemented-hide:]
+ // Specifies the action to be taken when an external processor response is
+ // received in response to request headers. It is recommended to set this field than set
+ // :ref:`disable_clear_route_cache <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.disable_clear_route_cache>`.
+ // Only one of ``disable_clear_route_cache`` or ``route_cache_action`` can be set.
+ RouteCacheAction route_cache_action = 18
+ [(udpa.annotations.field_migrate).oneof_promotion = "clear_route_cache_type"];
 }
 
 // The MetadataOptions structure defines options for the sending and receiving of

api/envoy/extensions/network/dns_resolver/cares/v3/cares_dns_resolver.proto

@@ -5,6 +5,8 @@ package envoy.extensions.network.dns_resolver.cares.v3;
 import "envoy/config/core/v3/address.proto";
 import "envoy/config/core/v3/resolver.proto";
 
+import "google/protobuf/wrappers.proto";
+
 import "udpa/annotations/status.proto";
 import "validate/validate.proto";
 
@@ -18,6 +20,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // [#extension: envoy.network.dns_resolver.cares]
 
 // Configuration for c-ares DNS resolver.
+// [#next-free-field: 6]
 message CaresDnsResolverConfig {
  // A list of dns resolver addresses.
  // :ref:`use_resolvers_as_fallback<envoy_v3_api_field_extensions.network.dns_resolver.cares.v3.CaresDnsResolverConfig.use_resolvers_as_fallback>`
@@ -41,4 +44,8 @@ message CaresDnsResolverConfig {
 
  // Configuration of DNS resolver option flags which control the behavior of the DNS resolver.
  config.core.v3.DnsResolverOptions dns_resolver_options = 2;
+
+ // This option allows for number of UDP based DNS queries to be capped. Note, this
+ // is only applicable to c-ares DNS resolver currently.
+ google.protobuf.UInt32Value udp_max_queries = 5;
 }

bazel/com_google_protoconverter.patch

@@ -5,7 +5,7 @@
  // The minimum library version which works with the current version of the
  // headers.
 -#define GOOGLE_PROTOBUF_MIN_LIBRARY_VERSION 4023000
-+#define GOOGLE_PROTOBUF_MIN_LIBRARY_VERSION 4024000
++#define GOOGLE_PROTOBUF_MIN_LIBRARY_VERSION 4025000
 
  #ifdef PROTOBUF_RTTI
  #error PROTOBUF_RTTI was previously defined

bazel/dependency_imports.bzl

@@ -16,7 +16,6 @@ load("@rules_pkg//:deps.bzl", "rules_pkg_dependencies")
 load("@rules_proto_grpc//:repositories.bzl", "rules_proto_grpc_toolchains")
 load("@rules_rust//rust:defs.bzl", "rust_common")
 load("@rules_rust//rust:repositories.bzl", "rules_rust_dependencies", "rust_register_toolchains", "rust_repository_set")
-load("@upb//bazel:workspace_deps.bzl", "upb_deps")
 
 # go version for rules_go
 GO_VERSION = "1.20"
@@ -53,7 +52,6 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
  ],
  )
  shellcheck_dependencies()
- upb_deps()
  proxy_wasm_rust_sdk_dependencies()
  rules_fuzzing_dependencies(
  oss_fuzz = True,

bazel/foreign_cc/ipp-crypto-bn2lebinpad.patch

@@ -0,0 +1,19 @@
+diff --git a/sources/ippcp/crypto_mb/src/common/ifma_cvt52.c b/sources/ippcp/crypto_mb/src/common/ifma_cvt52.c
+index e6db178c..0a1ecc49 100644
+--- a/sources/ippcp/crypto_mb/src/common/ifma_cvt52.c
++++ b/sources/ippcp/crypto_mb/src/common/ifma_cvt52.c
+@@ -16,9 +16,14 @@
+
+ #include <internal/common/ifma_defs.h>
+ #include <internal/common/ifma_math.h>
++#include <openssl/bn.h>
+
+ #include <assert.h>
+
++static int BN_bn2lebinpad(const BIGNUM *a, unsigned char *to, int tolen) {
++ return BN_bn2le_padded(to, tolen, a);
++}
++
+ #if defined(_MSC_VER) && (_MSC_VER < 1920)
+ // Disable optimization for VS2017 due to AVX512 masking bug
+ #define DISABLE_OPTIMIZATION __pragma(optimize( "", off ))

bazel/grpc.patch

@@ -3,14 +3,14 @@ index 06b69411a8..05cd878ae8 100644
 --- a/BUILD
 +++ b/BUILD
 @@ -29,7 +29,7 @@ licenses(["reciprocal"])
- package(
  default_visibility = ["//visibility:public"],
  features = [
+ "-parse_headers",
 - "layering_check",
 + "-layering_check",
- "-parse_headers",
  ],
  )
+
 diff --git a/src/core/BUILD b/src/core/BUILD
 index 1bb970e049..81265483e9 100644
 --- a/src/core/BUILD
@@ -24,16 +24,15 @@ index 1bb970e049..81265483e9 100644
  ],
  )
 
-diff --git a/src/core/lib/channel/channel_args.h b/src/core/lib/channel/channel_args.h
-index 38bb070213..b53086e680 100644
---- a/src/core/lib/channel/channel_args.h
-+++ b/src/core/lib/channel/channel_args.h
-@@ -284,7 +284,7 @@ class ChannelArgs {
+diff --git a/src/core/lib/promise/detail/promise_like.h b/src/core/lib/promise/detail/promise_like.h
+--- a/src/core/lib/promise/detail/promise_like.h 2024-04-18 19:47:19.524155042 +0000
++++ b/src/core/lib/promise/detail/promise_like.h 2024-04-18 23:40:29.050761807 +0000
+@@ -71,7 +71,7 @@
+
+ template <typename F>
+ class PromiseLike<F, absl::enable_if_t<!std::is_void<
+- typename std::result_of<F()>::type>::value>> {
++ typename std::invoke_result<F>::type>::value>> {
+ private:
+ GPR_NO_UNIQUE_ADDRESS F f_;
 
- class Value {
- public:
-- explicit Value(int n) : rep_(reinterpret_cast<void*>(n), &int_vtable_) {}
-+ explicit Value(int n) : rep_(reinterpret_cast<void*>(static_cast<intptr_t>(n)), &int_vtable_) {}
- explicit Value(std::string s)
- : rep_(RefCountedString::Make(s).release(), &string_vtable_) {}
- explicit Value(Pointer p) : rep_(std::move(p)) {}

bazel/protobuf.patch

@@ -87,10 +87,10 @@ diff --git a/python/google/protobuf/__init__.py b/python/google/protobuf/__init_
 index e7555ee10..a93beb1c5 100644
 --- a/python/google/protobuf/__init__.py
 +++ b/python/google/protobuf/__init__.py
-@@ -31,3 +31,10 @@
+@@ -8,3 +8,10 @@
  # Copyright 2007 Google Inc. All Rights Reserved.
 
- __version__ = '4.24.4'
+ __version__ = '4.25.3'
 +
 +
 +if __name__ != '__main__':
@@ -105,7 +105,7 @@ diff --git a/src/google/protobuf/io/BUILD.bazel b/src/google/protobuf/io/BUILD.b
  "@com_google_absl//absl/log:absl_log",
  ] + select({
  "//build_defs:config_msvc": [],
-- "//conditions:default": ["@zlib//:zlib"],
+- "//conditions:default": ["@zlib"],
 + "//conditions:default": ["//external:zlib"],
  }),
  )
@@ -122,18 +122,6 @@ diff --git a/src/google/protobuf/port_def.inc b/src/google/protobuf/port_def.inc
  // This error has been generally flaky, but we need to disable it specifically
  // to fix https://github.com/protocolbuffers/protobuf/issues/12313
  #pragma clang diagnostic ignored "-Wunused-parameter"
-diff --git a/src/google/protobuf/map_field.h b/src/google/protobuf/map_field.h
---- a/src/google/protobuf/map_field.h 2023-06-30 17:14:18.934528580 +0000
-+++ b/src/google/protobuf/map_field.h 2023-06-30 17:14:52.098500807 +0000
-@@ -345,7 +345,7 @@
-
- protected:
- // "protected" stops users from deleting a `MapFieldBase *`
-- ~MapFieldBase();
-+ virtual ~MapFieldBase();
-
- public:
- // Returns reference to internal repeated field. Data written using
 diff --git a/src/google/protobuf/compiler/BUILD.bazel b/src/google/protobuf/compiler/BUILD.bazel
 --- a/src/google/protobuf/compiler/BUILD.bazel
 +++ b/src/google/protobuf/compiler/BUILD.bazel
@@ -161,3 +149,15 @@ index 1c6a24945..c27d0bf2a 100644
  #if PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII
  #define PROTOBUF_DEBUG true
  #else
+diff --git a/src/google/protobuf/message_lite.cc b/src/google/protobuf/message_lite.cc
+--- a/src/google/protobuf/message_lite.cc 2024-04-19 15:49:01.333322873 +0000
++++ b/src/google/protobuf/message_lite.cc 2024-04-19 15:50:41.065136525 +0000
+@@ -66,7 +66,7 @@
+
+ int MessageLite::GetCachedSize() const {
+ auto* cached_size = AccessCachedSize();
+- if (PROTOBUF_PREDICT_FALSE(cached_size == nullptr)) return ByteSize();
++ if (PROTOBUF_PREDICT_FALSE(cached_size == nullptr)) return (int)ByteSizeLong();
+ return cached_size->Get();
+ }
+