Merge pull request #296 from jwendell/sync1

Sync with upstream

Author: tedjpoole

VERSION.txt

@@ -1 +1 @@
-1.32.3
+1.32.4-dev

changelogs/1.32.3.yaml

@@ -0,0 +1,13 @@
+date: December 18, 2024
+
+bug_fixes:
+- area: http/1
+  change: |
+    Fixes sending overload crashes when HTTP/1 request is reset.
+- area: happy_eyeballs
+  change: |
+    Validate that ``additional_address`` are IP addresses instead of crashing when sorting.
+- area: balsa
+  change: |
+    Fix incorrect handling of non-101 1xx responses. This fix can be temporarily reverted by setting runtime guard
+    ``envoy.reloadable_features.wait_for_first_byte_before_balsa_msg_done`` to false.

changelogs/current.yaml

@@ -1,4 +1,18 @@
-date: December 18, 2024
+date: Pending
+
+behavior_changes:
+# *Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required*
+
+minor_behavior_changes:
+# *Changes that may cause incompatibilities for some users, but should not for most*
+- area: rds
+  change: |
+    When a new RDS provider config is pushed via xDS and the only difference is change to
+    :ref:`initial_fetch_timeout <envoy_v3_api_field_config.core.v3.ConfigSource.initial_fetch_timeout>`,
+    the already existing provider will be reused. Envoy will not ask RDS server for routes
+    config because existing provider already has up to date routes config.
+    This behavioral change can be enabled by setting runtime guard
+    ``envoy.reloadable_features.normalize_rds_provider_config`` to true.
 
 bug_fixes:
 - area: http/1

ci/Dockerfile-envoy

@@ -59,7 +59,7 @@ COPY --chown=0:0 --chmod=755 \
 
 
 # STAGE: envoy-distroless
-FROM gcr.io/distroless/base-nossl-debian12:nonroot@sha256:2a803cc873dc1a69a33087ee10c75755367dd2c259219893504680480ad563f0 AS envoy-distroless
+FROM gcr.io/distroless/base-nossl-debian12:nonroot@sha256:e9554da0d9569cfa21023ee8d2624d7326d80791b49b7c71b08a8b4e8d206129 AS envoy-distroless
 EXPOSE 10000
 ENTRYPOINT ["/usr/local/bin/envoy"]
 CMD ["-c", "/etc/envoy/envoy.yaml"]

docs/root/configuration/http/http_filters/lua_filter.rst

@@ -278,7 +278,7 @@ Or, through ``bodyChunks()`` API, which let Envoy to skip buffering the upstream
 Complete example
 ----------------
 
-A complete example using Docker is available in :repo:`/examples/lua`.
+A complete example using Docker is available in `here <https://github.com/envoyproxy/examples/tree/main/lua>`__.
 
 Stream handle API
 -----------------

source/common/rds/route_config_provider_manager.cc

@@ -75,25 +75,6 @@ RouteConfigProviderPtr RouteConfigProviderManager::addStaticProvider(
   return provider;
 }
 
-RouteConfigProviderSharedPtr RouteConfigProviderManager::addDynamicProvider(
-    const Protobuf::Message& rds, const std::string& route_config_name, Init::Manager& init_manager,
-    std::function<
-        std::pair<RouteConfigProviderSharedPtr, const Init::Target*>(uint64_t manager_identifier)>
-        create_dynamic_provider) {
-  // RdsRouteConfigSubscriptions are unique based on their serialized RDS config.
-  const uint64_t manager_identifier = MessageUtil::hash(rds);
-  auto existing_provider =
-      reuseDynamicProvider(manager_identifier, init_manager, route_config_name);
-
-  if (existing_provider) {
-    return existing_provider;
-  }
-  auto new_provider = create_dynamic_provider(manager_identifier);
-  init_manager.add(*new_provider.second);
-  dynamic_route_config_providers_.insert({manager_identifier, new_provider});
-  return new_provider.first;
-}
-
 RouteConfigProviderSharedPtr
 RouteConfigProviderManager::reuseDynamicProvider(uint64_t manager_identifier,
                                                  Init::Manager& init_manager,

source/common/rds/route_config_provider_manager.h

@@ -12,6 +12,7 @@
 
 #include "source/common/common/matchers.h"
 #include "source/common/protobuf/utility.h"
+#include "source/common/runtime/runtime_features.h"
 
 #include "absl/container/node_hash_map.h"
 #include "absl/container/node_hash_set.h"
@@ -34,12 +35,43 @@ class RouteConfigProviderManager {
 
   RouteConfigProviderPtr
   addStaticProvider(std::function<RouteConfigProviderPtr()> create_static_provider);
+
+  template <class RdsConfig>
   RouteConfigProviderSharedPtr
-  addDynamicProvider(const Protobuf::Message& rds, const std::string& route_config_name,
+  addDynamicProvider(const RdsConfig& rds, const std::string& route_config_name,
                      Init::Manager& init_manager,
                      std::function<std::pair<RouteConfigProviderSharedPtr, const Init::Target*>(
                          uint64_t manager_identifier)>
-                         create_dynamic_provider);
+                         create_dynamic_provider) {
+
+    uint64_t manager_identifier;
+
+    if (Runtime::runtimeFeatureEnabled("envoy.reloadable_features.normalize_rds_provider_config")) {
+      // Normalize the config_source part of the passed config. Some parts of the config_source
+      // do not affect selection of the RDS provider. They will be cleared (zeroed) and restored
+      // after calculating hash.
+      // Since rds is passed as const, the constness must be casted away before modifying rds.
+      auto* orig_initial_timeout =
+          const_cast<RdsConfig&>(rds).mutable_config_source()->release_initial_fetch_timeout();
+      manager_identifier = MessageUtil::hash(rds);
+      const_cast<RdsConfig&>(rds).mutable_config_source()->set_allocated_initial_fetch_timeout(
+          orig_initial_timeout);
+
+    } else {
+      manager_identifier = MessageUtil::hash(rds);
+    }
+
+    auto existing_provider =
+        reuseDynamicProvider(manager_identifier, init_manager, route_config_name);
+
+    if (existing_provider) {
+      return existing_provider;
+    }
+    auto new_provider = create_dynamic_provider(manager_identifier);
+    init_manager.add(*new_provider.second);
+    dynamic_route_config_providers_.insert({manager_identifier, new_provider});
+    return new_provider.first;
+  }
 
 private:
   // TODO(jsedgwick) These two members are prime candidates for the owned-entry list/map

source/common/runtime/runtime_features.cc

@@ -171,6 +171,8 @@ FALSE_RUNTIME_GUARD(envoy_reloadable_features_logging_with_fast_json_formatter);
 // Controls whether a stream stays open when HTTP/2 or HTTP/3 upstream half closes
 // before downstream.
 FALSE_RUNTIME_GUARD(envoy_reloadable_features_allow_multiplexed_upstream_half_close);
+// A flag to enable normalization of RDS provider config. (see PR 37180).
+FALSE_RUNTIME_GUARD(envoy_reloadable_features_normalize_rds_provider_config);
 
 // Block of non-boolean flags. Use of int flags is deprecated. Do not add more.
 ABSL_FLAG(uint64_t, re2_max_program_size_error_level, 100, ""); // NOLINT

test/common/api/os_sys_calls_test.cc

@@ -69,14 +69,15 @@ TEST(OsSyscallsTest, OpenPwritePreadFstatCloseStatUnlink) {
 }
 
 TEST(OsSyscallsTest, SupportsIpTransparent) {
-  bool supported = Api::OsSysCallsSingleton::get().supportsIpTransparent(
-      TestEnvironment::getIpVersionsForTest()[0]);
-  EXPECT_FALSE(supported);
+  // Some environments support this and some don't; just call the function to make sure nothing
+  // dire (like a crash) happens, without validating the return value.
+  Api::OsSysCallsSingleton::get().supportsIpTransparent(TestEnvironment::getIpVersionsForTest()[0]);
 }
 
 TEST(OsSyscallsTest, SupportsMptcp) {
-  bool supported = Api::OsSysCallsSingleton::get().supportsMptcp();
-  EXPECT_TRUE(supported);
+  // Some environments support this and some don't; just call the function to make sure nothing
+  // dire (like a crash) happens, without validating the return value.
+  Api::OsSysCallsSingleton::get().supportsMptcp();
 }
 
 TEST(OsSyscallsTest, IoCtlInvalidFd) {

test/common/router/rds_impl_test.cc

@@ -1153,6 +1153,55 @@ version_info: '1'
   EXPECT_EQ(expected_route_config_dump.DebugString(), route_config_dump3.DebugString());
 }
 
+TEST_F(RouteConfigProviderManagerImplTest, NormalizeDynamicProviderConfig) {
+  setup();
+
+  const auto route_config = parseRouteConfigurationFromV3Yaml(R"EOF(
+name: foo_route_config
+virtual_hosts:
+  - name: bar
+    domains: ["*"]
+    routes:
+      - match: { prefix: "/" }
+        route: { cluster: baz }
+)EOF");
+  const auto decoded_resources = TestUtility::decodeResources({route_config});
+
+  EXPECT_TRUE(server_factory_context_.cluster_manager_.subscription_factory_.callbacks_
+                  ->onConfigUpdate(decoded_resources.refvec_, "1")
+                  .ok());
+
+  UniversalStringMatcher universal_name_matcher;
+  EXPECT_EQ(1UL, route_config_provider_manager_->dumpRouteConfigs(universal_name_matcher)
+                     ->dynamic_route_configs()
+                     .size());
+
+  for (bool normalize_config : std::vector<bool>({true, false})) {
+    Runtime::maybeSetRuntimeGuard("envoy.reloadable_features.normalize_rds_provider_config",
+                                  normalize_config);
+    envoy::extensions::filters::network::http_connection_manager::v3::Rds rds2;
+    rds2 = rds_;
+    // The following is valid only when normalize_config is true:
+    // Modify parameters which should not affect the provider. In other words, the same provider
+    // should be picked, regardless of the fact that initial_fetch_timeout is different for both
+    // configs.
+    rds2.mutable_config_source()->mutable_initial_fetch_timeout()->set_seconds(
+        rds_.config_source().initial_fetch_timeout().seconds() + 1);
+
+    RouteConfigProviderSharedPtr provider2 =
+        route_config_provider_manager_->createRdsRouteConfigProvider(
+            rds2, server_factory_context_, "foo_prefix", outer_init_manager_);
+
+    EXPECT_TRUE(server_factory_context_.cluster_manager_.subscription_factory_.callbacks_
+                    ->onConfigUpdate(decoded_resources.refvec_, "provider2")
+                    .ok());
+    EXPECT_EQ(normalize_config ? 1UL : 2UL,
+              route_config_provider_manager_->dumpRouteConfigs(universal_name_matcher)
+                  ->dynamic_route_configs()
+                  .size());
+  }
+}
+
 } // namespace
 } // namespace Router
 } // namespace Envoy