sync from master.

GOVERNANCE.md

@@ -37,8 +37,8 @@
 * Triage GitHub issues and perform pull request reviews for other maintainers and the community.
   The areas of specialization listed in [OWNERS.md](OWNERS.md) can be used to help with routing
   an issue/question to the right person.
-* Triage build issues - file issues for known flaky builds or bugs, and either fix or find someone
-  to fix any main build breakages.
+* Triage build and CI issues. Monitor #envoy-ci and #test-flaky and file issues for failing builds,
+  flaky tests or new bugs, and either fix or find someone to fix any main build breakages.
 * During GitHub issue triage, apply all applicable [labels](https://github.com/envoyproxy/envoy/labels)
   to each new issue. Labels are extremely useful for future issue follow up. Which labels to apply
   is somewhat subjective so just use your best judgment. A few of the most important labels that are

api/envoy/config/core/v3/base.proto

@@ -236,7 +236,19 @@ message Metadata {
 
   // Key is the reverse DNS filter name, e.g. com.acme.widget. The envoy.*
   // namespace is reserved for Envoy's built-in filters.
+  // If both *filter_metadata* and
+  // :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>`
+  // fields are present in the metadata with same keys,
+  // only *typed_filter_metadata* field will be parsed.
   map<string, google.protobuf.Struct> filter_metadata = 1;
+
+  // Key is the reverse DNS filter name, e.g. com.acme.widget. The envoy.*
+  // namespace is reserved for Envoy's built-in filters.
+  // The value is encoded as google.protobuf.Any.
+  // If both :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>`
+  // and *typed_filter_metadata* fields are present in the metadata with same keys,
+  // only *typed_filter_metadata* field will be parsed.
+  map<string, google.protobuf.Any> typed_filter_metadata = 2;
 }
 
 // Runtime derived uint32 with a default when not specified.

api/envoy/config/core/v3/protocol.proto

@@ -71,6 +71,28 @@ message UpstreamHttpProtocolOptions {
   bool auto_san_validation = 2;
 }
 
+// Configures the alternate protocols cache which tracks alternate protocols that can be used to
+// make an HTTP connection to an origin server. See https://tools.ietf.org/html/rfc7838 for
+// HTTP Alternate Services and https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https-04
+// for the "HTTPS" DNS resource record.
+message AlternateProtocolsCacheOptions {
+  // The name of the cache. Multiple named caches allow independent alternate protocols cache
+  // configurations to operate within a single Envoy process using different configurations. All
+  // alternate protocols cache options with the same name *must* be equal in all fields when
+  // referenced from different configuration components. Configuration will fail to load if this is
+  // not the case.
+  string name = 1 [(validate.rules).string = {min_len: 1}];
+
+  // The maximum number of entries that the cache will hold. If not specified defaults to 1024.
+  //
+  // .. note:
+  //
+  //   The implementation is approximate and enforced independently on each worker thread, thus
+  //   it is possible for the maximum entries in the cache to go slightly above the configured
+  //   value depending on timing. This is similar to how other circuit breakers work.
+  google.protobuf.UInt32Value max_entries = 2 [(validate.rules).uint32 = {gt: 0}];
+}
+
 // [#next-free-field: 6]
 message HttpProtocolOptions {
   option (udpa.annotations.versioning).previous_message_type =

api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto

@@ -979,7 +979,7 @@ message HttpFilter {
   // If true, clients that do not support this filter may ignore the
   // filter but otherwise accept the config.
   // Otherwise, clients that do not support this filter must reject the config.
-  // [#not-implemented-hide:]
+  // This is also same with typed per filter config.
   bool is_optional = 6;
 }
 

api/envoy/extensions/upstreams/http/v3/http_protocol_options.proto

@@ -114,6 +114,14 @@ message HttpProtocolOptions {
     //   AutoHttpConfig config is undergoing especially rapid change and as it
     //   is alpha is not guaranteed to be API-stable.
     config.core.v3.Http3ProtocolOptions http3_protocol_options = 3;
+
+    // [#not-implemented-hide:]
+    // The presence of alternate protocols cache options causes the use of the
+    // alternate protocols cache, which is responsible for parsing and caching
+    // HTTP Alt-Svc headers. This enables the use of HTTP/3 for origins that
+    // advertise supporting it.
+    // TODO(RyanTheOptimist): Make this field required when HTTP/3 is enabled.
+    config.core.v3.AlternateProtocolsCacheOptions alternate_protocols_cache_options = 4;
   }
 
   // This contains options common across HTTP/1 and HTTP/2

ci/flaky_test/process_xml.py

@@ -102,9 +102,15 @@ def parse_and_print_test_suite_error(testsuite, log_path):
             # parsed into the XML metadata. Here we attempt to extract those names from the log by
             # finding the last test case to run. The expected format of that is:
             #     "[ RUN      ] <TestParams>/<TestSuite>.<TestCase>\n".
+
             last_test_fullname = test_output.split('[ RUN      ]')[-1].splitlines()[0]
-            last_testsuite = last_test_fullname.split('/')[1].split('.')[0]
-            last_testcase = last_test_fullname.split('.')[1]
+            last_test_fullname_splitted_on_dot = last_test_fullname.split('.')
+            if len(last_test_fullname_splitted_on_dot) == 2:
+                last_testcase = last_test_fullname_splitted_on_dot[1]
+                last_testsuite = last_test_fullname_splitted_on_dot[0].split('/')[-1]
+            else:
+                last_testcase = "Could not retrieve last test case"
+                last_testsuite = "Could not retrieve last test suite"
 
     if error_msg != "":
         return print_test_suite_error(

docs/requirements.txt

@@ -41,9 +41,9 @@ gitdb==4.0.7 \
     # via
     #   -r docs/requirements.txt
     #   gitpython
-gitpython==3.1.14 \
-    --hash=sha256:3283ae2fba31c913d857e12e5ba5f9a7772bbc064ae2bb09efafa71b0dd4939b \
-    --hash=sha256:be27633e7509e58391f10207cd32b2a6cf5b908f92d9cd30da2e514e1137af61
+gitpython==3.1.17 \
+    --hash=sha256:29fe82050709760081f588dd50ce83504feddbebdc4da6956d02351552b1c135 \
+    --hash=sha256:ee24bdc93dce357630764db659edaf6b8d664d4ff5447ccfeedd2dc5c253f41e
     # via -r docs/requirements.txt
 idna==2.10 \
     --hash=sha256:b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6 \

docs/root/configuration/listeners/listener_filters/original_dst_filter.rst

@@ -4,14 +4,14 @@ Original Destination
 ====================
 
 Linux
-===============
+-----
 
 Original destination listener filter reads the SO_ORIGINAL_DST socket option set when a connection
 has been redirected by an iptables REDIRECT target, or by an iptables TPROXY target in combination
 with setting the listener's :ref:`transparent <envoy_v3_api_field_config.listener.v3.Listener.transparent>` option.
 
 Windows
-===============
+-------
 
 Original destination listener filter reads the SO_ORIGINAL_DST socket option set when a connection has been redirected by an
 `HNS <https://docs.microsoft.com/en-us/virtualization/windowscontainers/container-networking/architecture#container-network-management-with-host-network-service>`_

docs/root/version_history/current.rst

@@ -31,7 +31,7 @@ Minor Behavior Changes
 * http: serve HEAD requests from cache.
 * listener: respect the :ref:`connection balance config <envoy_v3_api_field_config.listener.v3.Listener.connection_balance_config>`
   defined within the listener where the sockets are redirected to. Clear that field to restore the previous behavior.
-
+* tcp: switched to the new connection pool by default. Any unexpected behavioral changes can be reverted by setting runtime guard ``envoy.reloadable_features.new_tcp_connection_pool`` to false.
 
 
 Bug Fixes
@@ -60,14 +60,20 @@ Removed Config or Runtime
 
 New Features
 ------------
+* http: a new field `is_optional` is added to `extensions.filters.network.http_connection_manager.v3.HttpFilter`. When
+  value is `true`, the unsupported http filter will be ignored by envoy. This is also same with unsupported http filter
+  in the typed per filter config. For more information, please reference
+  :ref:`HttpFilter <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpFilter.is_optional>`.
 
+* crash support: restore crash context when continuing to processing requests or responses as a result of an asynchronous callback that invokes a filter directly. This is unlike the call stacks that go through the various network layers, to eventually reach the filter. For a concrete example see: ``Envoy::Extensions::HttpFilters::Cache::CacheFilter::getHeaders`` which posts a callback on the dispatcher that will invoke the filter directly.
 * http: added support for :ref:`original IP detection extensions<envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.original_ip_detection_extensions>`.
   Two initial extensions were added, the :ref:`custom header <envoy_v3_api_msg_extensions.http.original_ip_detection.custom_header.v3.CustomHeaderConfig>` extension and the
   :ref:`xff <envoy_v3_api_msg_extensions.http.original_ip_detection.xff.v3.XffConfig>` extension.
 * http: added the ability to :ref:`unescape slash sequences<envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.path_with_escaped_slashes_action>` in the path. Requests with unescaped slashes can be proxied, rejected or redirected to the new unescaped path. By default this feature is disabled. The default behavior can be overridden through :ref:`http_connection_manager.path_with_escaped_slashes_action<config_http_conn_man_runtime_path_with_escaped_slashes_action>` runtime variable. This action can be selectively enabled for a portion of requests by setting the :ref:`http_connection_manager.path_with_escaped_slashes_action_sampling<config_http_conn_man_runtime_path_with_escaped_slashes_action_enabled>` runtime variable.
 * http: added upstream and downstream alpha HTTP/3 support! See :ref:`quic_options <envoy_v3_api_field_config.listener.v3.UdpListenerConfig.quic_options>` for downstream and the new http3_protocol_options in :ref:`http_protocol_options <envoy_v3_api_msg_extensions.upstreams.http.v3.HttpProtocolOptions>` for upstream HTTP/3.
 * listener: added ability to change an existing listener's address.
 * metric service: added support for sending metric tags as labels. This can be enabled by setting the :ref:`emit_tags_as_labels <envoy_v3_api_field_config.metrics.v3.MetricsServiceConfig.emit_tags_as_labels>` field to true.
+* tcp: added support for :ref:`preconnecting <v1.18.0:envoy_v3_api_msg_config.cluster.v3.Cluster.PreconnectPolicy>`. Preconnecting is off by default, but recommended for clusters serving latency-sensitive traffic.
 * udp_proxy: added :ref:`key <envoy_v3_api_msg_extensions.filters.udp.udp_proxy.v3.UdpProxyConfig.HashPolicy>` as another hash policy to support hash based routing on any given key.
 
 Deprecated

examples/grpc-bridge/client/requirements.txt

@@ -1,4 +1,4 @@
 requests>=2.22.0
 grpcio
 grpcio-tools
-protobuf==3.16.0
+protobuf==3.17.0