Merge branch 'main' of github.com:envoyproxy/envoy into lua_route

.vscode/tasks.json

@@ -24,13 +24,13 @@
     {
       "label": "Refresh Compilation Database",
       "type": "shell",
-      "command": "tools/vscode/refresh_compdb.sh",
+      "command": "ENVOY_GEN_COMPDB_OPTIONS=\"--vscode\" ./ci/do_ci.sh refresh_compdb",
       "problemMatcher": []
     },
     {
       "label": "Refresh Compilation Database Exclude Contrib",
       "type": "shell",
-      "command": "EXCLUDE_CONTRIB=true tools/vscode/refresh_compdb.sh",
+      "command": "ENVOY_GEN_COMPDB_OPTIONS=\"--vscode --exclude_contrib\" ./ci/do_ci.sh refresh_compdb",
       "problemMatcher": []
     },
     {

api/bazel/repository_locations.bzl

@@ -105,9 +105,9 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Protobuf Rules for Bazel",
         project_desc = "Protocol buffer rules for Bazel",
         project_url = "https://github.com/bazelbuild/rules_proto",
-        version = "7.0.2",
-        sha256 = "0e5c64a2599a6e26c6a03d6162242d231ecc0de219534c38cb4402171def21e8",
-        release_date = "2024-11-12",
+        version = "7.1.0",
+        sha256 = "14a225870ab4e91869652cfd69ef2028277fc1dc4910d65d353b62d6e0ae21f4",
+        release_date = "2024-12-18",
         strip_prefix = "rules_proto-{version}",
         urls = ["https://github.com/bazelbuild/rules_proto/archive/refs/tags/{version}.tar.gz"],
         use_category = ["api"],
@@ -131,11 +131,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "buf",
         project_desc = "A new way of working with Protocol Buffers.",  # Used for breaking change detection in API protobufs
         project_url = "https://buf.build",
-        version = "1.47.2",
-        sha256 = "39716cfe0185df3cba21f66ec739620ffb6876c48b2da4338a8c68c290c9b116",
+        version = "1.48.0",
+        sha256 = "7983f273b21aa4f8f7b42899da8568ed89ce6b81088cd6cc9ced18d469565c58",
         strip_prefix = "buf",
         urls = ["https://github.com/bufbuild/buf/releases/download/v{version}/buf-Linux-x86_64.tar.gz"],
-        release_date = "2024-11-14",
+        release_date = "2024-12-19",
         use_category = ["api"],
         license = "Apache-2.0",
         license_url = "https://github.com/bufbuild/buf/blob/v{version}/LICENSE",

api/envoy/admin/v3/config_dump_shared.proto

@@ -43,7 +43,10 @@ enum ClientResourceStatus {
   // Client received an error from the control plane. The attached config
   // dump is the most recent accepted one. If no config is accepted yet,
   // the attached config dump will be empty.
-  CLIENT_RECEIVED_ERROR = 5;
+  RECEIVED_ERROR = 5;
+
+  // Client timed out waiting for the resource from the control plane.
+  TIMEOUT = 6;
 }
 
 message UpdateFailureState {

api/envoy/config/rbac/v3/rbac.proto

@@ -206,8 +206,10 @@ message Policy {
 // metadata should be sourced from, rather than only matching against dynamic metadata.
 //
 // The matcher can be configured to look up metadata from:
+//
 // * Dynamic metadata: Runtime metadata added by filters during request processing
 // * Route metadata: Static metadata configured on the route entry
+//
 message SourcedMetadata {
   // Metadata matcher configuration that defines what metadata to match against. This includes the filter name,
   // metadata key path, and expected value.

api/envoy/extensions/filters/network/rbac/v3/rbac.proto

@@ -4,6 +4,8 @@ package envoy.extensions.filters.network.rbac.v3;
 
 import "envoy/config/rbac/v3/rbac.proto";
 
+import "google/protobuf/duration.proto";
+
 import "xds/annotations/v3/status.proto";
 import "xds/type/matcher/v3/matcher.proto";
 
@@ -26,7 +28,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 //
 // Header should not be used in rules/shadow_rules in RBAC network filter as
 // this information is only available in :ref:`RBAC http filter <config_http_filters_rbac>`.
-// [#next-free-field: 8]
+// [#next-free-field: 9]
 message RBAC {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.network.rbac.v2.RBAC";
@@ -87,4 +89,10 @@ message RBAC {
   // every payload (e.g., Mongo, MySQL, Kafka) set the enforcement type to
   // CONTINUOUS to enforce RBAC policies on every message boundary.
   EnforcementType enforcement_type = 4;
+
+  // Delay the specified duration before closing the connection when the policy evaluation
+  // result is ``DENY``. If this is not present, the connection will be closed immediately.
+  // This is useful to provide a better protection for Envoy against clients that retries
+  // aggressively when the connection is rejected by the RBAC filter.
+  google.protobuf.Duration delay_deny = 8;
 }

api/envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto

@@ -3,6 +3,7 @@ syntax = "proto3";
 package envoy.extensions.filters.udp.udp_proxy.v3;
 
 import "envoy/config/accesslog/v3/accesslog.proto";
+import "envoy/config/core/v3/backoff.proto";
 import "envoy/config/core/v3/base.proto";
 import "envoy/config/core/v3/config_source.proto";
 import "envoy/config/core/v3/udp_socket_config.proto";
@@ -91,6 +92,9 @@ message UdpProxyConfig {
       // The maximum number of unsuccessful connection attempts that will be made before giving up.
       // If the parameter is not specified, 1 connection attempt will be made.
       google.protobuf.UInt32Value max_connect_attempts = 1;
+
+      // Sets the backoff strategy. If not set, the retries are performed without backoff.
+      config.core.v3.BackoffStrategy backoff_options = 2;
     }
 
     // The hostname to send in the synthesized CONNECT headers to the upstream proxy.

bazel/foreign_cc/BUILD

@@ -281,24 +281,24 @@ envoy_cmake(
         "CURL_DISABLE_CRYPTO_AUTH": "on",
         # C-Ares.
         "ENABLE_ARES": "on",
-        "CARES_LIBRARY": "$EXT_BUILD_DEPS/ares",
-        "CARES_INCLUDE_DIR": "$EXT_BUILD_DEPS/ares/include",
+        "CARES_LIBRARY": "$$EXT_BUILD_DEPS/ares",
+        "CARES_INCLUDE_DIR": "$$EXT_BUILD_DEPS/ares/include",
         # SSL (via Envoy's SSL dependency) is disabled, curl's CMake uses
         # FindOpenSSL.cmake which fails at what looks like version parsing
         # (the libraries are found ok).
         "CURL_CA_PATH": "none",
         "CURL_USE_OPENSSL": "off",
-        "OPENSSL_ROOT_DIR": "$EXT_BUILD_DEPS",
+        "OPENSSL_ROOT_DIR": "$$EXT_BUILD_DEPS",
         # Avoid libidn2
         "USE_LIBIDN2": "off",
         # NGHTTP2.
         "USE_NGHTTP2": "on",
-        "NGHTTP2_LIBRARY": "$EXT_BUILD_DEPS/nghttp2",
-        "NGHTTP2_INCLUDE_DIR": "$EXT_BUILD_DEPS/nghttp2/include",
+        "NGHTTP2_LIBRARY": "$$EXT_BUILD_DEPS/nghttp2",
+        "NGHTTP2_INCLUDE_DIR": "$$EXT_BUILD_DEPS/nghttp2/include",
         # ZLIB.
         "CURL_ZLIB": "on",
-        "ZLIB_LIBRARY": "$EXT_BUILD_DEPS/zlib",
-        "ZLIB_INCLUDE_DIR": "$EXT_BUILD_DEPS/zlib/include",
+        "ZLIB_LIBRARY": "$$EXT_BUILD_DEPS/zlib",
+        "ZLIB_INCLUDE_DIR": "$$EXT_BUILD_DEPS/zlib/include",
         "CMAKE_CXX_COMPILER_FORCED": "on",
     },
     defines = ["CURL_STATICLIB"],

bazel/repositories.bzl

@@ -215,11 +215,7 @@ def envoy_dependencies(skip_targets = []):
     _com_github_google_perfetto()
     _utf8_range()
     _rules_ruby()
-    external_http_archive(
-        "com_github_google_flatbuffers",
-        patch_args = ["-p1"],
-        patches = ["@envoy//bazel:flatbuffers.patch"],
-    )
+    external_http_archive("com_github_google_flatbuffers")
     external_http_archive("bazel_features")
     external_http_archive("bazel_toolchains")
     external_http_archive("bazel_compdb")
@@ -252,7 +248,6 @@ def envoy_dependencies(skip_targets = []):
 
     _com_github_wamr()
     _com_github_wasmtime()
-    _com_github_wasm_c_api()
 
     switched_rules_by_language(
         name = "com_google_googleapis_imports",
@@ -896,24 +891,12 @@ def _com_github_wamr():
 def _com_github_wasmtime():
     external_http_archive(
         name = "com_github_wasmtime",
-        build_file = "@envoy//bazel/external:wasmtime.BUILD",
+        build_file = "@proxy_wasm_cpp_host//:bazel/external/wasmtime.BUILD",
     )
 
-def _com_github_wasm_c_api():
-    external_http_archive(
-        name = "com_github_wasm_c_api",
-        build_file = "@envoy//bazel/external:wasm-c-api.BUILD",
-    )
     native.bind(
         name = "wasmtime",
-        actual = "@com_github_wasm_c_api//:wasmtime_lib",
-    )
-
-    # This isn't needed in builds with a single Wasm engine, but "bazel query"
-    # complains about a missing dependency, so point it at the regular target.
-    native.bind(
-        name = "prefixed_wasmtime",
-        actual = "@com_github_wasm_c_api//:wasmtime_lib",
+        actual = "@com_github_wasmtime//:wasmtime_lib",
     )
 
 def _intel_dlb():