sync from master.

.bazelrc

@@ -237,6 +237,10 @@ build:remote-msan --config=remote
 build:remote-msan --config=rbe-toolchain-clang-libc++
 build:remote-msan --config=rbe-toolchain-msan
 
+build:remote-tsan --config=remote
+build:remote-tsan --config=rbe-toolchain-clang-libc++
+build:remote-tsan --config=rbe-toolchain-tsan
+
 build:remote-msvc-cl --config=remote-windows
 build:remote-msvc-cl --config=msvc-cl
 build:remote-msvc-cl --config=rbe-toolchain-msvc-cl
@@ -247,7 +251,7 @@ build:remote-clang-cl --config=rbe-toolchain-clang-cl
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:e33c93e6d79804bf95ff80426d10bdcc9096c785
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:55d9e4719d2bd0accce8f829b44dab70cd42112a
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker
@@ -265,6 +269,10 @@ build:docker-clang-libc++ --config=rbe-toolchain-clang-libc++
 build:docker-gcc --config=docker-sandbox
 build:docker-gcc --config=rbe-toolchain-gcc
 
+build:docker-asan --config=docker-sandbox
+build:docker-asan --config=rbe-toolchain-clang-libc++
+build:docker-asan --config=rbe-toolchain-asan
+
 build:docker-msan --config=docker-sandbox
 build:docker-msan --config=rbe-toolchain-clang-libc++
 build:docker-msan --config=rbe-toolchain-msan

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM gcr.io/envoy-ci/envoy-build:e33c93e6d79804bf95ff80426d10bdcc9096c785
+FROM gcr.io/envoy-ci/envoy-build:55d9e4719d2bd0accce8f829b44dab70cd42112a
 
 ARG USERNAME=vscode
 ARG USER_UID=501

.flake8

@@ -1,8 +1,8 @@
 
 [flake8]
 
-# TODO(phlax): make this an exclusive list and enable most tests
-select = N802,F401,E111,F821,E9,F63,F72,F82
+# TODO(phlax): ignore less
+ignore = W503,W504,E121,E126,E241,E125,E127,E129,E251,E265,E303,E306,E402,E501,E502,E711,E713,E722,E741,F523,F541,F841,N803,N806,N817,W605
 
 # TODO(phlax): exclude less
 exclude = build_docs,.git,generated,test,examples,venv

.github/workflows/get_build_targets.sh

@@ -5,24 +5,28 @@ readonly SEARCH_FOLDER="//source/common/..."
 
 set -e -o pipefail
 
-function get_targets() {
-  # Comparing the PR HEAD with the upstream main HEAD.
-  git diff --name-only HEAD FETCH_HEAD | while IFS= read -r line
-  do
-    # Only targets under those folders.
-    case "$line" in
-      source/*|include/*)
-        bazel query "rdeps($SEARCH_FOLDER, $line, 1)" 2>/dev/null
-        ;;
-    esac
+function compare_head () {
+    # Comparing the PR HEAD with the upstream main HEAD.
+    git diff --name-only HEAD FETCH_HEAD | while IFS= read -r line; do
+        # Only targets under those folders.
+        case "$line" in
+            source/*|include/*)
+                bazel query "rdeps($SEARCH_FOLDER, $line, 1)" 2>/dev/null
+                ;;
+        esac
+    done
+}
+
+get_targets () {
     # This chain of commands from left to right are:
     # 1. Excluding the redundant .cc/.h targets that bazel query emits.
     # 2. Storing only the unique output.
     # 3. Limiting to the first 3 targets.
-  done | grep -v '\.cc\|\.h' | sort -u | head -n 3
+    compare_head | grep -v '\.cc\|\.h' | sort -u | head -n 3
 }
 
 # Fetching the upstream HEAD to compare with and stored in FETCH_HEAD.
 git fetch https://github.com/envoyproxy/envoy.git main 2>/dev/null
 
-export BUILD_TARGETS_LOCAL=$(echo $(get_targets))
+BUILD_TARGETS_LOCAL=$(get_targets || :)
+export BUILD_TARGETS_LOCAL

.gitignore

@@ -37,3 +37,4 @@ cmake-build-debug
 /linux
 bazel.output.txt
 *~
+.coverage

.yapfignore

@@ -0,0 +1,8 @@
+*generated*
+*venv*
+*protos*
+*~
+*_pb2.py
+*tests*
+*#*
+*intersphinx_custom.py

CODEOWNERS

@@ -183,3 +183,6 @@ extensions/filters/http/oauth2 @rgs1 @derekargueta @snowp
 /*/extensions/filters/common/ext_authz @esmet @gsagula @dio
 /*/extensions/filters/http/ext_authz @esmet @gsagula @dio
 /*/extensions/filters/network/ext_authz @esmet @gsagula @dio
+# Original IP detection
+/*/extensions/http/original_ip_detection/custom_header @rgs1 @alyssawilk @antoniovicente
+/*/extensions/http/original_ip_detection/xff @rgs1 @alyssawilk @antoniovicente

OWNERS.md

@@ -37,6 +37,10 @@ routing PRs, questions, etc. to the right place.
   * Lua, access logging, and general miscellany.
 * Joshua Marantz ([jmarantz](https://github.com/jmarantz)) ([email protected])
   * Stats, abseil, scalability, and performance.
+* Ryan Northey ([phlax](https://github.com/phlax)) ([email protected])
+  * Docs, tooling, CI, containers and sandbox examples
+* William A Rowe Jr ([wrowe](https://github.com/wrowe)) ([email protected])
+  * Windows port and CI build, `bazel/foreign_cc` build and dependencies liason.
 * Antonio Vicente ([antoniovicente](https://github.com/antoniovicente)) ([email protected])
   * Event management, security, performance, data plane.
 

README.md

@@ -80,7 +80,9 @@ Google calendar is here: https://goo.gl/PkDijT
 
 ### Security Audit
 
-A third party security audit was performed by Cure53, you can see the full report [here](docs/SECURITY_AUDIT.pdf).
+There has been several third party engagements focused on Envoy security:
+* In 2018 Cure53 performed a security audit, [full report](docs/security/audit_cure53_2018.pdf).
+* In 2021 Ada Logics performed an audit on our fuzzing infrastructure with recommendations for improvements, [full report](docs/security/audit_fuzzer_adalogics_2021.pdf).
 
 ### Reporting security vulnerabilities
 

RELEASES.md

@@ -53,6 +53,7 @@ stable releases and sending announcements about them. This role is rotating on a
 | 2020 Q3 | Yuchen Dai ([lambdai](https://github.com/lambdai))             |
 | 2020 Q4 | Christoph Pakulski ([cpakulski](https://github.com/cpakulski)) |
 | 2021 Q1 | Rei Shimizu ([Shikugawa](https://github.com/Shikugawa))        |
+| 2021 Q2 | Dmitri Dolguikh ([dmitri-d](https://github.com/dmitri-d))      |
 
 ## Release schedule
 
@@ -68,6 +69,7 @@ deadline of 3 weeks.
 | 1.15.0  | 2020/06/30 | 2020/07/07 |   +7 days  | 2021/07/07  |
 | 1.16.0  | 2020/09/30 | 2020/10/08 |   +8 days  | 2021/10/08  |
 | 1.17.0  | 2020/12/31 | 2021/01/11 |  +11 days  | 2022/01/11  |
-| 1.18.0  | 2021/03/31 |            |            |             |
+| 1.18.0  | 2021/03/31 | 2021/04/15 |  +15 days  | 2022/04/15  |
+| 1.19.0  | 2021/06/30 |            |            |             |
 
 [repokitteh]: https://github.com/repokitteh

VERSION

@@ -1 +1 @@
-1.18.0-dev
+1.19.0-dev

api/BUILD

@@ -158,6 +158,7 @@ proto_library(
         "//envoy/extensions/access_loggers/open_telemetry/v3alpha:pkg",
         "//envoy/extensions/access_loggers/stream/v3:pkg",
         "//envoy/extensions/access_loggers/wasm/v3:pkg",
+        "//envoy/extensions/cache/simple_http_cache/v3alpha:pkg",
         "//envoy/extensions/clusters/aggregate/v3:pkg",
         "//envoy/extensions/clusters/dynamic_forward_proxy/v3:pkg",
         "//envoy/extensions/clusters/redis/v3:pkg",
@@ -244,6 +245,8 @@ proto_library(
         "//envoy/extensions/filters/udp/udp_proxy/v3:pkg",
         "//envoy/extensions/health_checkers/redis/v3:pkg",
         "//envoy/extensions/http/header_formatters/preserve_case/v3:pkg",
+        "//envoy/extensions/http/original_ip_detection/custom_header/v3:pkg",
+        "//envoy/extensions/http/original_ip_detection/xff/v3:pkg",
         "//envoy/extensions/internal_redirect/allow_listed_routes/v3:pkg",
         "//envoy/extensions/internal_redirect/previous_routes/v3:pkg",
         "//envoy/extensions/internal_redirect/safe_cross_scheme/v3:pkg",
@@ -263,6 +266,7 @@ proto_library(
         "//envoy/extensions/transport_sockets/proxy_protocol/v3:pkg",
         "//envoy/extensions/transport_sockets/quic/v3:pkg",
         "//envoy/extensions/transport_sockets/raw_buffer/v3:pkg",
+        "//envoy/extensions/transport_sockets/s2a/v3alpha:pkg",
         "//envoy/extensions/transport_sockets/starttls/v3:pkg",
         "//envoy/extensions/transport_sockets/tap/v3:pkg",
         "//envoy/extensions/transport_sockets/tls/v3:pkg",

api/CONTRIBUTING.md

@@ -72,7 +72,6 @@ The following are some general guidelines around documentation.
   // [#comment:TODO(mattklein123): Do something cooler]
   string foo_field = 3;
   ```
-
-* Prefer *italics* for emphasis as `backtick` emphasis is somewhat jarring in our Sphinx theme.
+* Please use *italics* (enclosed in asterisks `*emphasized word*`) for emphasis and `inline literals` for code quotation (enclosed in *double* backticks ` ``code`` `).
 * All documentation is expected to use proper English grammar with proper punctuation. If you are
   not a fluent English speaker please let us know and we will help out.

api/STYLE.md

@@ -122,8 +122,7 @@ To add an extension config to the API, the steps below should be followed:
        deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"],
    )
    ```
-1. Add to the v3 extension config proto `import "udpa/annotations/migrate.proto";`
-   and `import "udpa/annotations/status.proto";`
+1. Add to the v3 extension config proto `import "udpa/annotations/status.proto";`
 1. If this is still WiP and subject to breaking changes, set
    `option (udpa.annotations.file_status).work_in_progress = true;`.
 1. Add to the v3 extension config proto a file level

api/envoy/admin/v3/clusters.proto

@@ -41,10 +41,10 @@ message ClusterStatus {
 
   // The success rate threshold used in the last interval.
   // If
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *false*, all errors: externally and locally generated were used to calculate the threshold.
   // If
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *true*, only externally generated errors were used to calculate the threshold.
   // The threshold is used to eject hosts based on their success rate. See
   // :ref:`Cluster outlier detection <arch_overview_outlier_detection>` documentation for details.
@@ -64,7 +64,7 @@ message ClusterStatus {
   // The success rate threshold used in the last interval when only locally originated failures were
   // taken into account and externally originated errors were treated as success.
   // This field should be interpreted only when
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *true*. The threshold is used to eject hosts based on their success rate.
   // See :ref:`Cluster outlier detection <arch_overview_outlier_detection>` documentation for
   // details.
@@ -101,10 +101,10 @@ message HostStatus {
 
   // Request success rate for this host over the last calculated interval.
   // If
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *false*, all errors: externally and locally generated were used in success rate
   // calculation. If
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *true*, only externally generated errors were used in success rate calculation.
   // See :ref:`Cluster outlier detection <arch_overview_outlier_detection>` documentation for
   // details.
@@ -127,7 +127,7 @@ message HostStatus {
   // interval when only locally originated errors are taken into account and externally originated
   // errors were treated as success.
   // This field should be interpreted only when
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *true*.
   // See :ref:`Cluster outlier detection <arch_overview_outlier_detection>` documentation for
   // details.

api/envoy/admin/v3/config_dump.proto

@@ -53,11 +53,11 @@ message ConfigDump {
   // The following configurations are currently supported and will be dumped in the order given
   // below:
   //
-  // * *bootstrap*: :ref:`BootstrapConfigDump <envoy_api_msg_admin.v3.BootstrapConfigDump>`
-  // * *clusters*: :ref:`ClustersConfigDump <envoy_api_msg_admin.v3.ClustersConfigDump>`
-  // * *endpoints*:  :ref:`EndpointsConfigDump <envoy_api_msg_admin.v3.EndpointsConfigDump>`
-  // * *listeners*: :ref:`ListenersConfigDump <envoy_api_msg_admin.v3.ListenersConfigDump>`
-  // * *routes*:  :ref:`RoutesConfigDump <envoy_api_msg_admin.v3.RoutesConfigDump>`
+  // * *bootstrap*: :ref:`BootstrapConfigDump <envoy_v3_api_msg_admin.v3.BootstrapConfigDump>`
+  // * *clusters*: :ref:`ClustersConfigDump <envoy_v3_api_msg_admin.v3.ClustersConfigDump>`
+  // * *endpoints*:  :ref:`EndpointsConfigDump <envoy_v3_api_msg_admin.v3.EndpointsConfigDump>`
+  // * *listeners*: :ref:`ListenersConfigDump <envoy_v3_api_msg_admin.v3.ListenersConfigDump>`
+  // * *routes*:  :ref:`RoutesConfigDump <envoy_v3_api_msg_admin.v3.RoutesConfigDump>`
   //
   // EDS Configuration will only be dumped by using parameter `?include_eds`
   //
@@ -126,7 +126,7 @@ message ListenersConfigDump {
         "envoy.admin.v2alpha.ListenersConfigDump.DynamicListenerState";
 
     // This is the per-resource version information. This version is currently taken from the
-    // :ref:`version_info <envoy_api_field_service.discovery.v3.DiscoveryResponse.version_info>` field at the time
+    // :ref:`version_info <envoy_v3_api_field_service.discovery.v3.DiscoveryResponse.version_info>` field at the time
     // that the listener was loaded. In the future, discrete per-listener versions may be supported
     // by the API.
     string version_info = 1;
@@ -174,7 +174,7 @@ message ListenersConfigDump {
     ClientResourceStatus client_status = 6;
   }
 
-  // This is the :ref:`version_info <envoy_api_field_service.discovery.v3.DiscoveryResponse.version_info>` in the
+  // This is the :ref:`version_info <envoy_v3_api_field_service.discovery.v3.DiscoveryResponse.version_info>` in the
   // last processed LDS discovery response. If there are only static bootstrap listeners, this field
   // will be "".
   string version_info = 1;
@@ -212,7 +212,7 @@ message ClustersConfigDump {
         "envoy.admin.v2alpha.ClustersConfigDump.DynamicCluster";
 
     // This is the per-resource version information. This version is currently taken from the
-    // :ref:`version_info <envoy_api_field_service.discovery.v3.DiscoveryResponse.version_info>` field at the time
+    // :ref:`version_info <envoy_v3_api_field_service.discovery.v3.DiscoveryResponse.version_info>` field at the time
     // that the cluster was loaded. In the future, discrete per-cluster versions may be supported by
     // the API.
     string version_info = 1;
@@ -235,7 +235,7 @@ message ClustersConfigDump {
     ClientResourceStatus client_status = 5;
   }
 
-  // This is the :ref:`version_info <envoy_api_field_service.discovery.v3.DiscoveryResponse.version_info>` in the
+  // This is the :ref:`version_info <envoy_v3_api_field_service.discovery.v3.DiscoveryResponse.version_info>` in the
   // last processed CDS discovery response. If there are only static bootstrap clusters, this field
   // will be "".
   string version_info = 1;
@@ -280,7 +280,7 @@ message RoutesConfigDump {
         "envoy.admin.v2alpha.RoutesConfigDump.DynamicRouteConfig";
 
     // This is the per-resource version information. This version is currently taken from the
-    // :ref:`version_info <envoy_api_field_service.discovery.v3.DiscoveryResponse.version_info>` field at the time that
+    // :ref:`version_info <envoy_v3_api_field_service.discovery.v3.DiscoveryResponse.version_info>` field at the time that
     // the route configuration was loaded.
     string version_info = 1;
 
@@ -340,7 +340,7 @@ message ScopedRoutesConfigDump {
     string name = 1;
 
     // This is the per-resource version information. This version is currently taken from the
-    // :ref:`version_info <envoy_api_field_service.discovery.v3.DiscoveryResponse.version_info>` field at the time that
+    // :ref:`version_info <envoy_v3_api_field_service.discovery.v3.DiscoveryResponse.version_info>` field at the time that
     // the scoped routes configuration was loaded.
     string version_info = 2;
 
@@ -450,7 +450,7 @@ message EndpointsConfigDump {
   // [#next-free-field: 6]
   message DynamicEndpointConfig {
     // [#not-implemented-hide:] This is the per-resource version information. This version is currently taken from the
-    // :ref:`version_info <envoy_api_field_service.discovery.v3.DiscoveryResponse.version_info>` field at the time that
+    // :ref:`version_info <envoy_v3_api_field_service.discovery.v3.DiscoveryResponse.version_info>` field at the time that
     // the endpoint configuration was loaded.
     string version_info = 1;