auto-merge envoyproxy/envoy[main] into envoyproxy/envoy-openssl[main]

* upstream/main:
  kafka: upgrade to 3.8, add support for more requests (#36166)
  tooling: narrowing exception checks (#36185)
  deps: Bump `rules_rust` -> 0.50.1 (#36194)
  Refactor async files library to use dispatcher for synchronization (#36063)
  upstream-filter: update default upstream filter type (#36186)
  deps: Bump `bazel_features` -> 1.17.0 (#36195)
  deps: Bump `proxy_wasm_rust_sdk` -> 0.2.2 (#35323)
  syscalls: minor refactor, adding coverage (#36075)
  quic: Adding QUIC listener option to reject new connections (#36070)
  rlqs: Implement RLQS stream restarts if the stream goes down mid-use. (#36170)
  bump googleapis (#36182)
  docs: update owners to reflect RedHat access (#36183)
  formatter: removing exceptions from substitution format string (#36168)
  route: use reference wrapper for get all filter config (#36079)

.bazelrc

@@ -25,6 +25,7 @@ build --copt=-DABSL_MIN_LOG_LEVEL=4
 build --define envoy_mobile_listener=enabled
 build --experimental_repository_downloader_retries=2
 build --enable_platform_specific_config
+build --incompatible_merge_fixed_and_default_shell_env
 
 # Pass CC, CXX and LLVM_CONFIG variables from the environment.
 # We assume they have stable values, so this won't cause action cache misses.

OWNERS.md

@@ -76,7 +76,6 @@ without further review.
 
 * All senior maintainers
 * Tony Allen ([tonya11en](https://github.com/tonya11en)) (tony@allen.gg)
-* Otto van der Schaaf ([oschaaf](https://github.com/oschaaf)) (oschaaf@redhat.com)
 * Tim Walsh ([twghu](https://github.com/twghu)) (twalsh@redhat.com)
 * Pradeep Rao ([pradeepcrao](https://github.com/pradeepcrao)) (pcrao@google.com)
 * Kateryna Nezdolii ([nezdolik](https://github.com/nezdolik)) (kateryna.nezdolii@gmail.com)

api/bazel/repository_locations.bzl

@@ -79,9 +79,9 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Google APIs",
         project_desc = "Public interface definitions of Google APIs",
         project_url = "https://github.com/googleapis/googleapis",
-        version = "114a745b2841a044e98cdbb19358ed29fcf4a5f1",
-        sha256 = "9b4e0d0a04a217c06b426aefd03b82581a9510ca766d2d1c70e52bb2ad4a0703",
-        release_date = "2023-01-10",
+        version = "fd52b5754b2b268bc3a22a10f29844f206abb327",
+        sha256 = "97fc354dddfd3ea03e7bf2ad74129291ed6fad7ff39d3bd8daec738a3672eb8a",
+        release_date = "2024-09-16",
         strip_prefix = "googleapis-{version}",
         urls = ["https://github.com/googleapis/googleapis/archive/{version}.tar.gz"],
         use_category = ["api"],

api/envoy/config/listener/v3/quic_config.proto

@@ -25,7 +25,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // [#protodoc-title: QUIC listener config]
 
 // Configuration specific to the UDP QUIC listener.
-// [#next-free-field: 13]
+// [#next-free-field: 14]
 message QuicProtocolOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.listener.QuicProtocolOptions";
@@ -94,4 +94,9 @@ message QuicProtocolOptions {
   // If not specified, no cmsg will be saved to QuicReceivedPacket.
   repeated core.v3.SocketCmsgHeaders save_cmsg_config = 12
       [(validate.rules).repeated = {max_items: 1}];
+
+  // If true, the listener will reject connection-establishing packets at the
+  // QUIC layer by replying with an empty version negotiation packet to the
+  // client.
+  bool reject_new_connections = 13;
 }

bazel/external/cargo/remote/BUILD.protobuf-2.24.1.bazel

@@ -33,7 +33,7 @@ licenses([
 # buildifier: disable=out-of-order-load
 # buildifier: disable=load-on-top
 load(
-    "@rules_rust//cargo:cargo_build_script.bzl",
+    "@rules_rust//cargo:defs.bzl",
     "cargo_build_script",
 )
 

bazel/repository_locations.bzl

@@ -33,11 +33,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Bazel features",
         project_desc = "Support Bazel feature detection from starlark",
         project_url = "https://github.com/bazel-contrib/bazel_features",
-        version = "1.15.0",
-        sha256 = "ba1282c1aa1d1fffdcf994ab32131d7c7551a9bc960fbf05f42d55a1b930cbfb",
+        version = "1.17.0",
+        sha256 = "bdc12fcbe6076180d835c9dd5b3685d509966191760a0eb10b276025fcb76158",
         urls = ["https://github.com/bazel-contrib/bazel_features/releases/download/v{version}/bazel_features-v{version}.tar.gz"],
         strip_prefix = "bazel_features-{version}",
-        release_date = "2024-08-09",
+        release_date = "2024-09-13",
         use_category = ["build"],
         license = "Apache-2.0",
         license_url = "https://github.com/bazel-contrib/bazel_features/blob/v{version}/LICENSE",
@@ -1333,13 +1333,13 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Kafka (source)",
         project_desc = "Open-source distributed event streaming platform",
         project_url = "https://kafka.apache.org",
-        version = "3.5.1",
-        sha256 = "9715589a02148fb21bc80d79f29763dbd371457bedcbbeab3db4f5c7fdd2d29c",
+        version = "3.8.0",
+        sha256 = "8761a0c22738201d3049f11f78c8e6c0f201203ba799157e498ef7eb04c259f3",
         strip_prefix = "kafka-{version}/clients/src/main/resources/common/message",
         urls = ["https://github.com/apache/kafka/archive/{version}.zip"],
         use_category = ["dataplane_ext"],
         extensions = ["envoy.filters.network.kafka_broker", "envoy.filters.network.kafka_mesh"],
-        release_date = "2023-07-14",
+        release_date = "2024-07-23",
         cpe = "cpe:2.3:a:apache:kafka:*",
         license = "Apache-2.0",
         license_url = "https://github.com/apache/kafka/blob/{version}/LICENSE",
@@ -1363,11 +1363,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Kafka (server binary)",
         project_desc = "Open-source distributed event streaming platform",
         project_url = "https://kafka.apache.org",
-        version = "3.5.1",
-        sha256 = "f7b74d544023f2c0ec52a179de59975cb64e34ea03650d829328b407b560e4da",
+        version = "3.8.0",
+        sha256 = "e0297cc6fdb09ef9d9905751b25d2b629c17528f8629b60561eeff87ce29099c",
         strip_prefix = "kafka_2.13-{version}",
         urls = ["https://archive.apache.org/dist/kafka/{version}/kafka_2.13-{version}.tgz"],
-        release_date = "2023-07-21",
+        release_date = "2024-07-23",
         use_category = ["test_only"],
     ),
     proxy_wasm_cpp_sdk = dict(
@@ -1424,12 +1424,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "WebAssembly for Proxies (Rust SDK)",
         project_desc = "WebAssembly for Proxies (Rust SDK)",
         project_url = "https://github.com/proxy-wasm/proxy-wasm-rust-sdk",
-        version = "0.2.1",
-        sha256 = "23f3f2d8c4c8069a2e72693b350d7442b7722d334f73169eea78804ff70cde20",
+        version = "0.2.2",
+        sha256 = "3d9e8f39f0356016c8ae6c74c0224eae1b44168be0ddf79e387d918a8f2cb4c6",
         strip_prefix = "proxy-wasm-rust-sdk-{version}",
         urls = ["https://github.com/proxy-wasm/proxy-wasm-rust-sdk/archive/v{version}.tar.gz"],
         use_category = ["test_only"],
-        release_date = "2022-11-22",
+        release_date = "2024-07-21",
         cpe = "N/A",
         license = "Apache-2.0",
         license_url = "https://github.com/proxy-wasm/proxy-wasm-rust-sdk/blob/v{version}/LICENSE",
@@ -1452,9 +1452,9 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Bazel rust rules",
         project_desc = "Bazel rust rules (used by Wasm)",
         project_url = "https://github.com/bazelbuild/rules_rust",
-        version = "0.35.0",
+        version = "0.50.1",
         strip_prefix = "rules_rust-{version}",
-        sha256 = "3120c7aa3a146dfe6be8d5f23f4cf10af7d0f74a5aed8b94a818f88643bd24c3",
+        sha256 = "ddfc0210b19498086d09c458672ef2a6fb7790103dbb1b2da73c54677c330ed1",
         urls = ["https://github.com/bazelbuild/rules_rust/archive/{version}.tar.gz"],
         use_category = [
             "controlplane",
@@ -1463,7 +1463,7 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         ],
         implied_untracked_deps = ["rules_cc"],
         extensions = ["envoy.wasm.runtime.wasmtime"],
-        release_date = "2023-12-27",
+        release_date = "2024-09-11",
         cpe = "N/A",
         license = "Apache-2.0",
         license_url = "https://github.com/bazelbuild/rules_rust/blob/{version}/LICENSE.txt",

changelogs/current.yaml

@@ -248,6 +248,11 @@ new_features:
     QUIC server and client support certificate compression, which can in some cases reduce the number of round trips
     required to setup a connection. This change temporarily disabled by setting the runtime flag
     ``envoy.reloadable_features.quic_support_certificate_compression`` to ``false``.
+- area: quic
+  change: |
+    Added QUIC protocol option :ref:`reject_new_connections
+    <envoy_v3_api_field_config.listener.v3.QuicProtocolOptions.reject_new_connections>` to reject connection-establishing
+    packets at the QUIC layer.
 - area: tls
   change: |
     Added an extension point :ref:`custom_tls_certificate_selector

contrib/golang/filters/http/source/golang_filter.cc

@@ -1377,16 +1377,13 @@ void Filter::deferredDeleteRequest(HttpRequestInternal* req) {
 uint64_t Filter::getMergedConfigId() {
   Http::StreamFilterCallbacks* callbacks = decoding_state_.getFilterCallbacks();
 
+  auto id = config_->getConfigId();
+
   // get all of the per route config
   auto route_config_list = Http::Utility::getAllPerFilterConfig<FilterConfigPerRoute>(callbacks);
-
   ENVOY_LOG(debug, "golang filter route config list length: {}.", route_config_list.size());
-
-  auto id = config_->getConfigId();
-  for (auto it : route_config_list) {
-    ASSERT(it != nullptr, "route config should not be null");
-    auto route_config = *it;
-    id = route_config.getPluginConfigId(id, config_->pluginName());
+  for (const FilterConfigPerRoute& typed_config : route_config_list) {
+    id = typed_config.getPluginConfigId(id, config_->pluginName());
   }
 
   return id;

contrib/kafka/filters/network/source/protocol/generator.py

@@ -153,9 +153,8 @@ def parse_messages(self, input_files):
                     amended = re.sub(r'-2147483648', 'INT32_MIN', without_empty_newlines)
                     message_spec = json.loads(amended)
                     api_key = message_spec['apiKey']
-                    # (adam.kotwasinski) Higher API keys in the future versions of Kafka need
-                    # some more changes to parse.
-                    if api_key < 68 or api_key == 69:
+                    # (adam.kotwasinski) Telemetry is not supported for now.
+                    if api_key not in [71, 72]:
                         message = self.parse_top_level_element(message_spec)
                         messages.append(message)
             except Exception as e:
@@ -224,8 +223,9 @@ def parse_complex_type(self, type_name, field_spec, versions):
                 fields.append(child)
 
         # Some structures share the same name, use request/response as prefix.
-        if cpp_name in ['EntityData', 'EntryData', 'PartitionData', 'PartitionSnapshot',
-                        'SnapshotId', 'TopicData', 'TopicPartitions', 'TopicSnapshot']:
+        if cpp_name in ['Cursor', 'DirectoryData', 'EntityData', 'EntryData', 'PartitionData',
+                        'PartitionSnapshot', 'SnapshotId', 'TopicData', 'TopicPartitions',
+                        'TopicSnapshot']:
             cpp_name = self.type.capitalize() + type_name
 
         # Some of the types repeat multiple times (e.g. AlterableConfig).
@@ -370,9 +370,9 @@ def example_value(self):
 
 class FieldSpec:
     """
-  Represents a field present in a structure (request, or child structure thereof).
-  Contains name, type, and versions when it is used (nullable or not).
-  """
+    Represents a field present in a structure (request, or child structure thereof).
+    Contains name, type, and versions when it is used (nullable or not).
+    """
 
     def __init__(self, name, type, version_usage, version_usage_as_nullable):
         import re
@@ -387,10 +387,10 @@ def is_nullable(self):
 
     def is_nullable_in_version(self, version):
         """
-    Whether the field is nullable in given version.
-    Fields can be non-nullable in earlier versions.
-    See https://github.com/apache/kafka/tree/2.2.0-rc0/clients/src/main/resources/common/message#nullable-fields
-    """
+        Whether the field is nullable in given version.
+        Fields can be non-nullable in earlier versions.
+        See https://github.com/apache/kafka/tree/3.8.0/clients/src/main/resources/common/message#nullable-fields
+        """
         return version in self.version_usage_as_nullable
 
     def used_in_version(self, version):
@@ -428,13 +428,21 @@ def example_value_for_test(self, version):
 
     def deserializer_name_in_version(self, version, compact):
         if self.is_nullable_in_version(version):
-            return 'Nullable%s' % self.type.deserializer_name_in_version(version, compact)
+            underlying_deserializer = self.type.deserializer_name_in_version(version, compact)
+            # Handles KAFKA-14425 - structs (complex types) can now be nullable.
+            if isinstance(self.type, Complex):
+                return 'NullableStructDeserializer<%s>' % underlying_deserializer
+            else:
+                return 'Nullable%s' % underlying_deserializer
         else:
             return self.type.deserializer_name_in_version(version, compact)
 
     def is_printable(self):
         return self.type.is_printable()
 
+    def __str__(self):
+        return '%s(%s)' % (self.name, self.type)
+
 
 class TypeSpecification:
 
@@ -471,10 +479,10 @@ def is_printable(self):
 
 class Array(TypeSpecification):
     """
-  Represents array complex type.
-  To use instance of this type, it is necessary to declare structures required by self.underlying
-  (e.g. to use Array<Foo>, we need to have `struct Foo {...}`).
-  """
+    Represents array complex type.
+    To use instance of this type, it is necessary to declare structures required by self.underlying
+    (e.g. to use Array<Foo>, we need to have `struct Foo {...}`).
+    """
 
     def __init__(self, underlying):
         self.underlying = underlying
@@ -505,6 +513,9 @@ def example_value_for_test(self, version):
     def is_printable(self):
         return self.underlying.is_printable()
 
+    def __str__(self):
+        return self.name
+
 
 class Primitive(TypeSpecification):
     """
@@ -643,6 +654,9 @@ def example_value_for_test(self, version):
     def is_printable(self):
         return self.name not in ['Bytes']
 
+    def __str__(self):
+        return self.name
+
 
 class FieldSerializationSpec():
 
@@ -679,9 +693,9 @@ def register_flexible_versions(self, flexible_versions):
 
     def compute_declaration_chain(self):
         """
-    Computes all dependencies, what means all non-primitive types used by this type.
-    They need to be declared before this struct is declared.
-    """
+        Computes all dependencies, what means all non-primitive types used by this type.
+        They need to be declared before this struct is declared.
+        """
         result = []
         for field in self.fields:
             field_dependencies = field.type.compute_declaration_chain()
@@ -700,10 +714,10 @@ def get_extra(self, key):
 
     def compute_constructors(self):
         """
-    Field lists for different versions may not differ (as Kafka can bump version without any
-    changes). But constructors need to be unique, so we need to remove duplicates if the signatures
-    match.
-    """
+        Field lists for different versions may not differ (as Kafka can bump version without any
+        changes). But constructors need to be unique, so we need to remove duplicates
+        if the signatures match.
+        """
         signature_to_constructor = {}
         for field_list in self.compute_field_lists():
             signature = field_list.constructor_signature()
@@ -724,8 +738,8 @@ def compute_constructors(self):
 
     def compute_field_lists(self):
         """
-    Return field lists representing each of structure versions.
-    """
+        Return field lists representing each of structure versions.
+        """
         field_lists = []
         for version in self.versions:
             field_list = FieldList(version, version in self.flexible_versions, self.fields)
@@ -772,6 +786,9 @@ def example_value_for_test(self, version):
     def is_printable(self):
         return True
 
+    def __str__(self):
+        return self.name
+
 
 class RenderingHelper:
     """