Merge branch 'main' of https://github.com/envoyproxy/envoy into dev-refactor-dynamic-module-abi

Author: wbpcode

.github/workflows/_run.yml

@@ -240,6 +240,9 @@ jobs:
       if: inputs.diskspace-hack || github.event.repository.private
       with:
         to_remove: ${{ inputs.diskspace-hack-paths }}
+    - run: |
+        mount
+        df -h
 
     - run: |
         sudo mkdir -p /etc/docker

api/tools/BUILD

@@ -19,7 +19,10 @@ py_test(
     ],
     # Don't run this by default, since we don't want to force local dependency on Wireshark/tshark,
     # will explicitly invoke in CI.
-    tags = ["manual"],
+    tags = [
+        "manual",
+        "no-remote-exec",
+    ],
     visibility = ["//visibility:public"],
     deps = [":tap2pcap"],
 )

bazel/external/fips_build.bzl

@@ -5,14 +5,14 @@ BUILD_COMMAND = """
 set -eo pipefail
 
 # c++
-export CC=$(CC)
+export CC="$$(realpath $(CC))"
 # bazel doesnt expose CXX so we have to construct it (or use foreign_cc)
 if [[ "%s" == "libc++" ]]; then
     export CXXFLAGS="-stdlib=libc++"
-    export LDFLAGS="-stdlib=libc++ -lc++ -lc++abi -lm -pthread"
+    export LDFLAGS="-fuse-ld=lld -stdlib=libc++ -lc++ -lc++abi -lm -pthread"
 else
     export CXXFLAGS=""
-    export LDFLAGS="-lstdc++ -lm -pthread"
+    export LDFLAGS="-fuse-ld=lld -lstdc++ -lm -pthread"
 fi
 
 # ninja
@@ -56,15 +56,15 @@ set -eo pipefail
 SRC_DIR=$$(dirname $(location @fips_ninja//:configure.py))
 OUT_FILE=$$(realpath $@)
 PYTHON_BIN=$$(realpath $(PYTHON3))
-export CC=$(CC)
-export CXX=$(CC)
+export CC="$$(realpath $(CC))"
+export CXX="$$(realpath $(CC))"
 # bazel doesnt expose CXX so we have to construct it (or use foreign_cc)
 if [[ "%s" == "libc++" ]]; then
     export CXXFLAGS="-stdlib=libc++"
-    export LDFLAGS="-stdlib=libc++ -lc++ -lc++abi -lm -pthread"
+    export LDFLAGS="-fuse-ld=lld -stdlib=libc++ -lc++ -lc++abi -lm -pthread"
 else
     export CXXFLAGS=""
-    export LDFLAGS="-lstdc++ -lm -pthread"
+    export LDFLAGS="-fuse-ld=lld -lstdc++ -lm -pthread"
 fi
 cd $$SRC_DIR
 OUTPUT=$$(mktemp)

ci/do_ci.sh

@@ -68,10 +68,12 @@ function bazel_with_collection() {
     then
         pushd bazel-testlogs
         failed_logs=$(grep "  /build.*test.log" "${BAZEL_OUTPUT}" | sed -e 's/  \/build.*\/testlogs\/\(.*\)/\1/')
-        while read -r f; do
-        cp --parents -f "$f" "${ENVOY_FAILED_TEST_LOGS}"
-        done <<< "$failed_logs"
-        popd
+        if [[ -n "${failed_logs}" ]]; then
+            while read -r f; do
+                cp --parents -f "$f" "${ENVOY_FAILED_TEST_LOGS}"
+            done <<< "$failed_logs"
+            popd
+        fi
     fi
     exit "${BAZEL_STATUS}"
   fi
@@ -192,7 +194,7 @@ function bazel_envoy_api_build() {
         --//tools/api_proto_plugin:extra_args=api_version:3.7 \
         //tools/protoprint:protoprint_test
     echo "Validating API structure..."
-    "${ENVOY_SRCDIR}"/tools/api/validate_structure.py
+    bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/api:validate_structure "${PWD}/api/envoy"
     echo "Testing API..."
     bazel_with_collection \
         test "${BAZEL_BUILD_OPTIONS[@]}" \

ci/format_pre.sh

@@ -56,7 +56,7 @@ CURRENT=configs
 bazel "${BAZEL_STARTUP_OPTIONS[@]}" run "${BAZEL_BUILD_OPTIONS[@]}" //configs:example_configs_validation
 
 CURRENT=spelling
-"${ENVOY_SRCDIR}/tools/spelling/check_spelling_pedantic.py" --mark check
+bazel "${BAZEL_STARTUP_OPTIONS[@]}" run "${BAZEL_BUILD_OPTIONS[@]}" //tools/spelling:check_spelling_pedantic -- --mark check --target_root="$PWD"
 
 CURRENT=check_format
 bazel "${BAZEL_STARTUP_OPTIONS[@]}" run "${BAZEL_BUILD_OPTIONS[@]}" //tools/code_format:check_format -- fix --fail_on_diff

docs/root/configuration/http/http_filters/rate_limit_quota_filter.rst

@@ -86,6 +86,37 @@ Rate limit filter :ref:`configuration <envoy_v3_api_msg_extensions.filters.http.
 at the virtual host or route levels using the :ref:`RateLimitQuotaOverride <envoy_v3_api_msg_extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaOverride>`
 configuration. The more specific configuration fully overrides less specific configuration.
 
+gRPC Status Configuration
+-------------------------
+
+The rate limit quota filter supports customizing the response when requests exceed quota limits through the
+:ref:`deny_response_settings <envoy_v3_api_field_extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaBucketSettings.deny_response_settings>`
+configuration.
+
+For HTTP requests, you can configure the HTTP status code via ``http_status`` (defaults to 429).
+
+For gRPC requests, you can optionally set ``grpc_status`` to specify the exact gRPC status code and message.
+If not set, Envoy will derive the gRPC status from the HTTP status code.
+
+**Example: Using default behavior (gRPC status derived from HTTP status)**
+
+.. code-block:: yaml
+
+  deny_response_settings:
+    http_status:
+      code: 429
+
+**Example: Using explicit gRPC status**
+
+.. code-block:: yaml
+
+  deny_response_settings:
+    http_status:
+      code: 429
+    grpc_status:
+      code: 8  # RESOURCE_EXHAUSTED
+      message: "Quota exhausted"
+
 Matcher extensions
 ------------------
 

source/extensions/dynamic_modules/abi.h

@@ -757,6 +757,36 @@ void envoy_dynamic_module_on_http_filter_scheduled(
     envoy_dynamic_module_type_http_filter_envoy_ptr filter_envoy_ptr,
     envoy_dynamic_module_type_http_filter_module_ptr filter_module_ptr, uint64_t event_id);
 
+/**
+ * envoy_dynamic_module_on_http_filter_downstream_above_write_buffer_high_watermark is called when
+ * the buffer for the downstream stream goes over the high watermark for a terminal filter. This may
+ * be called multiple times, in which case envoy_dynamic_module_on_above_write_buffer_low_watermark
+ * will be called an equal number of times until the write buffer is completely drained below the
+ * low watermark.
+ *
+ * @param filter_envoy_ptr is the pointer to the DynamicModuleHttpFilter object of the
+ * corresponding HTTP filter.
+ * @param filter_module_ptr is the pointer to the in-module HTTP filter created by
+ * envoy_dynamic_module_on_http_filter_new.
+ */
+void envoy_dynamic_module_on_http_filter_downstream_above_write_buffer_high_watermark(
+    envoy_dynamic_module_type_http_filter_envoy_ptr filter_envoy_ptr,
+    envoy_dynamic_module_type_http_filter_module_ptr filter_module_ptr);
+
+/**
+ * envoy_dynamic_module_on_http_filter_downstream_below_write_buffer_low_watermark is called when
+ * any buffer for the response stream goes from over its high watermark to under its low watermark
+ * for a terminal filter.
+ *
+ * @param filter_envoy_ptr is the pointer to the DynamicModuleHttpFilter object of the
+ * corresponding HTTP filter.
+ * @param filter_module_ptr is the pointer to the in-module HTTP filter created by
+ * envoy_dynamic_module_on_http_filter_new.
+ */
+void envoy_dynamic_module_on_http_filter_downstream_below_write_buffer_low_watermark(
+    envoy_dynamic_module_type_http_filter_envoy_ptr filter_envoy_ptr,
+    envoy_dynamic_module_type_http_filter_module_ptr filter_module_ptr);
+
 // -----------------------------------------------------------------------------
 // -------------------------------- Callbacks ----------------------------------
 // -----------------------------------------------------------------------------

source/extensions/dynamic_modules/abi_version.h

@@ -6,7 +6,7 @@ namespace DynamicModules {
 #endif
 // This is the ABI version calculated as a sha256 hash of the ABI header files. When the ABI
 // changes, this value must change, and the correctness of this value is checked by the test.
-const char* kAbiVersion = "b8d4d4c79b5f4743fea77f27a84f9a6f7523f97201c113508ccae569888f8be7";
+const char* kAbiVersion = "dcd3808436396000e681f7014dda187ca87708995367ea1374e4b3191281cb7c";
 
 #ifdef __cplusplus
 } // namespace DynamicModules

source/extensions/dynamic_modules/sdk/rust/src/lib.rs

@@ -365,6 +365,18 @@ pub trait HttpFilter<EHF: EnvoyHttpFilter> {
   ///
   /// See [`EnvoyHttpFilter::new_scheduler`] for more details on how to use this.
   fn on_scheduled(&mut self, _envoy_filter: &mut EHF, _event_id: u64) {}
+
+  /// This is called when the downstream buffer size goes above the high watermark for a
+  /// terminal filter.
+  ///
+  /// * `envoy_filter` can be used to interact with the underlying Envoy filter object.
+  fn on_downstream_above_write_buffer_high_watermark(&mut self, _envoy_filter: &mut EHF) {}
+
+  /// This is called when the downstream buffer size goes below the low watermark for a
+  /// terminal filter.
+  ///
+  /// * `envoy_filter` can be used to interact with the underlying Envoy filter object.
+  fn on_downstream_below_write_buffer_low_watermark(&mut self, _envoy_filter: &mut EHF) {}
 }
 
 /// An opaque object that represents the underlying Envoy Http filter config. This has one to one
@@ -2148,8 +2160,10 @@ impl EnvoyHttpFilterImpl {
 /// Since this is primarily designed to be used from a different thread than the one
 /// where the [`HttpFilter`] instance was created, it is marked as `Send` so that
 /// the [`Box<dyn EnvoyHttpFilterScheduler>`] can be sent across threads.
+///
+/// It is also safe to be called concurrently, so it is marked as `Sync` as well.
 #[automock]
-pub trait EnvoyHttpFilterScheduler: Send {
+pub trait EnvoyHttpFilterScheduler: Send + Sync {
   /// Commit the scheduled event to the worker thread where [`HttpFilter`] is running.
   ///
   /// It accepts an `event_id` which can be used to distinguish different events
@@ -2168,6 +2182,7 @@ struct EnvoyHttpFilterSchedulerImpl {
 }
 
 unsafe impl Send for EnvoyHttpFilterSchedulerImpl {}
+unsafe impl Sync for EnvoyHttpFilterSchedulerImpl {}
 
 impl Drop for EnvoyHttpFilterSchedulerImpl {
   fn drop(&mut self) {
@@ -2472,6 +2487,26 @@ unsafe extern "C" fn envoy_dynamic_module_on_http_filter_scheduled(
   filter.on_scheduled(&mut EnvoyHttpFilterImpl::new(envoy_ptr), event_id);
 }
 
+#[no_mangle]
+unsafe extern "C" fn envoy_dynamic_module_on_http_filter_downstream_above_write_buffer_high_watermark(
+  envoy_ptr: abi::envoy_dynamic_module_type_http_filter_envoy_ptr,
+  filter_ptr: abi::envoy_dynamic_module_type_http_filter_module_ptr,
+) {
+  let filter = filter_ptr as *mut *mut dyn HttpFilter<EnvoyHttpFilterImpl>;
+  let filter = &mut **filter;
+  filter.on_downstream_above_write_buffer_high_watermark(&mut EnvoyHttpFilterImpl::new(envoy_ptr));
+}
+
+#[no_mangle]
+unsafe extern "C" fn envoy_dynamic_module_on_http_filter_downstream_below_write_buffer_low_watermark(
+  envoy_ptr: abi::envoy_dynamic_module_type_http_filter_envoy_ptr,
+  filter_ptr: abi::envoy_dynamic_module_type_http_filter_module_ptr,
+) {
+  let filter = filter_ptr as *mut *mut dyn HttpFilter<EnvoyHttpFilterImpl>;
+  let filter = &mut **filter;
+  filter.on_downstream_below_write_buffer_low_watermark(&mut EnvoyHttpFilterImpl::new(envoy_ptr));
+}
+
 impl From<envoy_dynamic_module_type_metrics_result>
   for Result<(), envoy_dynamic_module_type_metrics_result>
 {

source/extensions/filters/http/dynamic_modules/factory.cc

@@ -29,8 +29,8 @@ absl::StatusOr<Http::FilterFactoryCb> DynamicModuleConfigFactory::createFilterFa
       Envoy::Extensions::DynamicModules::HttpFilters::DynamicModuleHttpFilterConfigSharedPtr>
       filter_config =
           Envoy::Extensions::DynamicModules::HttpFilters::newDynamicModuleHttpFilterConfig(
-              proto_config.filter_name(), config, std::move(dynamic_module.value()),
-              dual_info.scope, context);
+              proto_config.filter_name(), config, proto_config.terminal_filter(),
+              std::move(dynamic_module.value()), dual_info.scope, context);
 
   if (!filter_config.ok()) {
     return absl::InvalidArgumentError("Failed to create filter config: " +