Update envoy to v1.30.1. (#904)

.bazelrc

@@ -2,7 +2,7 @@
 
 # Required by envoy and its tests
 build --define=grpc_no_ares=true
-build --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
+build --cxxopt=-std=c++20 --host_cxxopt=-std=c++20
 
 # We already have absl in the build, define absl=1 to tell googletest to use absl for backtrace.
 build --define absl=1

WORKSPACE

@@ -39,9 +39,9 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # 3) Check if envoy_build_config/extensions_build_config.bzl is up-to-date.
 # Try to match it with the one in source/extensions and comment out unneeded extensions.
 
-ENVOY_SHA1 = "6b9db09c69965d5bfb37bdd29693f8b7f9e9e9ec"  # v1.27.1, 2023.10.11
+ENVOY_SHA1 = "816188b86a0a52095b116b107f576324082c7c02"  # v1.30.1
 
-ENVOY_SHA256 = "d6cde20343d67fa4e25b9047bd805c522ece80b8058f1f311cb90ee7f3287f63"
+ENVOY_SHA256 = "41064ee8fbafc2ac3fd0d6531a106139adbbea3585defff22fdb99e06d7862e5"
 
 http_archive(
     name = "envoy",

src/api_proxy/service_control/check_response_convert_utils_test.cc

@@ -191,8 +191,7 @@ TEST_F(CheckResponseConverterTest, ConvertConsumerInfo) {
   EXPECT_EQ(info.consumer_number, std::to_string(consumer_number));
 }
 
-TEST_F(CheckResponseConverterTest,
-       ApiKeyUidCarriedInCheckResponseInfo) {
+TEST_F(CheckResponseConverterTest, ApiKeyUidCarriedInCheckResponseInfo) {
   CheckResponseInfo info;
   CheckResponse response;
   response.mutable_check_info()->set_api_key_uid("fake_api_key_uid");

src/api_proxy/service_control/request_builder.cc

@@ -348,7 +348,6 @@ constexpr char kServiceControlBackendProtocol[] =
 constexpr char kServiceControlConsumerProject[] =
     "serviceruntime.googleapis.com/consumer_project";
 constexpr char kApiKeyPrefix[] = "apikey:";
-
 
 // User agent label value
 // The value for kUserAgent should be configured at service control server.
@@ -384,8 +383,10 @@ Status set_credential_id(const SupportedLabel& l, const ReportRequestInfo& info,
       api_key::ApiKeyState::VERIFIED) {
     ASSERT(!info.api_key.empty(),
            "API Key must be set, otherwise consumer would not be verified.");
-    (*labels)[l.name] = absl::StrCat(kApiKeyPrefix, info.check_response_info.api_key_uid.empty() ? info.api_key
-                      : info.check_response_info.api_key_uid);
+    (*labels)[l.name] =
+        absl::StrCat(kApiKeyPrefix, info.check_response_info.api_key_uid.empty()
+                                        ? info.api_key
+                                        : info.check_response_info.api_key_uid);
   } else if (!info.auth_issuer.empty()) {
     std::string base64_issuer = Envoy::Base64Url::encode(
         info.auth_issuer.data(), info.auth_issuer.size());

src/envoy/http/backend_auth/config_parser_impl.cc

@@ -39,7 +39,7 @@ AudienceContext::AudienceContext(
     const FilterConfig& filter_config,
     const token::TokenSubscriberFactory& token_subscriber_factory,
     GetTokenFunc access_token_fn)
-    : tls_(context.threadLocal()) {
+    : tls_(context.serverFactoryContext().threadLocal()) {
   tls_.set(
       [](Envoy::Event::Dispatcher&) { return std::make_shared<TokenCache>(); });
 

src/envoy/http/grpc_metadata_scrubber/BUILD

@@ -16,7 +16,7 @@ envoy_cc_library(
     repository = "@envoy",
     deps = [
         ":filter_lib",
-        "@envoy//source/exe:envoy_common_lib",
+        "@envoy//source/exe:all_extensions_lib",
     ],
 )
 

src/envoy/http/header_sanitizer/BUILD

@@ -34,6 +34,6 @@ envoy_cc_library(
     deps = [
         ":filter_lib",
         "//api/envoy/v12/http/header_sanitizer:config_proto_cc_proto",
-        "@envoy//source/exe:envoy_common_lib",
+        "@envoy//source/exe:all_extensions_lib",
     ],
 )

src/envoy/http/service_control/BUILD

@@ -168,7 +168,7 @@ envoy_cc_library(
     ],
     repository = "@envoy",
     deps = [
-        "@envoy//source/exe:envoy_common_lib",
+        "@envoy//source/exe:all_extensions_lib",
     ],
 )
 
@@ -188,7 +188,7 @@ envoy_cc_library(
         "//src/envoy/utils:rc_detail_utils_lib",
         "@envoy//source/common/grpc:status_lib",
         "@envoy//source/common/http:headers_lib",
-        "@envoy//source/exe:envoy_common_lib",
+        "@envoy//source/exe:all_extensions_lib",
         "@envoy//source/extensions/filters/http/common:pass_through_filter_lib",
     ],
 )
@@ -203,7 +203,7 @@ envoy_cc_library(
         ":filter_stats_lib",
         ":handler_impl_lib",
         ":service_control_call_impl_lib",
-        "@envoy//source/exe:envoy_common_lib",
+        "@envoy//source/exe:all_extensions_lib",
     ],
 )
 
@@ -215,7 +215,7 @@ envoy_cc_library(
     deps = [
         ":filter_config_lib",
         ":filter_lib",
-        "@envoy//source/exe:envoy_common_lib",
+        "@envoy//source/exe:all_extensions_lib",
     ],
 )
 

src/envoy/http/service_control/config_parser.cc

@@ -40,18 +40,20 @@ FilterConfigParser::FilterConfigParser(const FilterConfig& config,
     service_map_.emplace(service.service_name(), ServiceContextPtr(srv_ctx));
   }
   if (first_srv_ctx == nullptr) {
-    throw Envoy::ProtoValidationException("Empty services", config_);
+    Envoy::ProtoExceptionUtil::throwProtoValidationException("Empty services",
+                                                             config_);
   }
 
   if (service_map_.size() < static_cast<size_t>(config_.services_size())) {
-    throw Envoy::ProtoValidationException("Duplicated service names", config_);
+    Envoy::ProtoExceptionUtil::throwProtoValidationException(
+        "Duplicated service names", config_);
   }
 
   for (const auto& requirement : config_.requirements()) {
     const auto service_it = service_map_.find(requirement.service_name());
     if (service_it == service_map_.end()) {
-      throw Envoy::ProtoValidationException("Invalid service name",
-                                            requirement);
+      Envoy::ProtoExceptionUtil::throwProtoValidationException(
+          "Invalid service name", requirement);
     }
     requirements_map_.emplace(requirement.operation_name(),
                               RequirementContextPtr(new RequirementContext(
@@ -60,8 +62,8 @@ FilterConfigParser::FilterConfigParser(const FilterConfig& config,
 
   if (requirements_map_.size() <
       static_cast<size_t>(config_.requirements_size())) {
-    throw Envoy::ProtoValidationException("Duplicated operation names",
-                                          config_);
+    Envoy::ProtoExceptionUtil::throwProtoValidationException(
+        "Duplicated operation names", config_);
   }
 
   // Construct a requirement for non matched requests

src/envoy/http/service_control/config_parser.h

@@ -51,7 +51,7 @@ class ServiceContext {
       min_stream_report_interval_ms_ = kDefaultMinStreamReportIntervalMs;
     }
     if (min_stream_report_interval_ms_ < kLowerBoundMinStreamReportIntervalMs) {
-      throw Envoy::ProtoValidationException(
+      Envoy::ProtoExceptionUtil::throwProtoValidationException(
           absl::StrCat("min_stream_report_interval_ms must be larger than: ",
                        kLowerBoundMinStreamReportIntervalMs),
           config);

src/envoy/http/service_control/filter.cc

@@ -110,7 +110,7 @@ void ServiceControlFilter::rejectRequest(Envoy::Http::Code code,
   decoder_callbacks_->sendLocalReply(code, error_msg, nullptr, absl::nullopt,
                                      rc_detail);
   decoder_callbacks_->streamInfo().setResponseFlag(
-      Envoy::StreamInfo::ResponseFlag::UnauthorizedExternalService);
+      Envoy::StreamInfo::UnauthorizedExternalService);
 }
 
 Envoy::Http::FilterDataStatus ServiceControlFilter::decodeData(
@@ -132,20 +132,17 @@ Envoy::Http::FilterTrailersStatus ServiceControlFilter::decodeTrailers(
 }
 
 void ServiceControlFilter::log(
-    const Envoy::Http::RequestHeaderMap* request_headers,
-    const Envoy::Http::ResponseHeaderMap* response_headers,
-    const Envoy::Http::ResponseTrailerMap* response_trailers,
-    const Envoy::StreamInfo::StreamInfo&, Envoy::AccessLog::AccessLogType) {
+    const Envoy::Formatter::HttpFormatterContext& context,
+    const Envoy::StreamInfo::StreamInfo&) {
   ENVOY_LOG(debug, "Called ServiceControl Filter : {}", __func__);
   if (!handler_) {
-    if (!request_headers) return;
-    handler_ =
-        factory_.createHandler(*request_headers, decoder_callbacks_, stats_);
+    handler_ = factory_.createHandler(context.requestHeaders(),
+                                      decoder_callbacks_, stats_);
   }
 
   Envoy::Tracing::Span& parent_span = decoder_callbacks_->activeSpan();
-  handler_->callReport(request_headers, response_headers, response_trailers,
-                       parent_span);
+  handler_->callReport(&context.requestHeaders(), &context.responseHeaders(),
+                       &context.responseTrailers(), parent_span);
 }
 
 }  // namespace service_control

src/envoy/http/service_control/filter.h

@@ -51,11 +51,8 @@ class ServiceControlFilter
       Envoy::Http::RequestTrailerMap&) override;
 
   // Called when the request is completed.
-  void log(const Envoy::Http::RequestHeaderMap* request_headers,
-           const Envoy::Http::ResponseHeaderMap* response_headers,
-           const Envoy::Http::ResponseTrailerMap* response_trailers,
-           const Envoy::StreamInfo::StreamInfo& stream_info,
-           Envoy::AccessLog::AccessLogType access_log_type) override;
+  void log(const Envoy::Formatter::HttpFormatterContext& context,
+           const Envoy::StreamInfo::StreamInfo& stream_info) override;
 
   // For Handler::CheckDoneCallback, called when callCheck() is done
   void onCheckDone(const absl::Status& status,

src/envoy/http/service_control/filter_config.h

@@ -45,8 +45,9 @@ class ServiceControlFilterConfig
                 proto_config)),
         call_factory_(proto_config_, stats_prefix, context),
         config_parser_(*proto_config_, call_factory_),
-        handler_factory_(context.api().randomGenerator(), config_parser_,
-                         context.timeSource()) {}
+        handler_factory_(context.serverFactoryContext().api().randomGenerator(),
+                         config_parser_,
+                         context.serverFactoryContext().timeSource()) {}
 
   const ServiceControlHandlerFactory& handler_factory() const {
     return handler_factory_;

src/envoy/http/service_control/filter_fuzz_test.cc

@@ -72,7 +72,8 @@ DEFINE_PROTO_FUZZER(
   NiceMock<MockFactoryContext> context;
   NiceMock<Envoy::Upstream::MockThreadLocalCluster> thread_local_cluster;
   NiceMock<Envoy::Http::MockAsyncClientRequest> request(
-      &context.cluster_manager_.thread_local_cluster_.async_client_);
+      &context.server_factory_context_.cluster_manager_.thread_local_cluster_
+           .async_client_);
   NiceMock<Envoy::Http::MockStreamDecoderFilterCallbacks>
       mock_decoder_callbacks;
 
@@ -82,7 +83,7 @@ DEFINE_PROTO_FUZZER(
 
   // Callback for token subscriber to start.
   Envoy::Event::TimerCb onReadyCallback;
-  EXPECT_CALL(context.dispatcher_, createTimer_(_))
+  EXPECT_CALL(context.server_factory_context_.dispatcher_, createTimer_(_))
       .WillRepeatedly(
           Invoke([&onReadyCallback](const Envoy::Event::TimerCb& cb) {
             ENVOY_LOG_MISC(trace, "Mocking dispatcher createTimer");
@@ -92,7 +93,8 @@ DEFINE_PROTO_FUZZER(
 
   // Mock the http async client.
   int resp_num = 0;
-  EXPECT_CALL(context.cluster_manager_, getThreadLocalCluster(_))
+  EXPECT_CALL(context.server_factory_context_.cluster_manager_,
+              getThreadLocalCluster(_))
       .WillRepeatedly(Return(&thread_local_cluster));
   EXPECT_CALL(thread_local_cluster.async_client_, send_(_, _, _))
       .WillRepeatedly(Invoke([&request, &input, &resp_num](

src/envoy/http/service_control/filter_test.cc

@@ -91,8 +91,7 @@ TEST_F(ServiceControlFilterTest, DecodeHeadersMissingHeaders) {
 
   // Filter should reject this request
   EXPECT_CALL(mock_decoder_callbacks_.stream_info_,
-              setResponseFlag(
-                  Envoy::StreamInfo::ResponseFlag::UnauthorizedExternalService))
+              setResponseFlag(Envoy::StreamInfo::UnauthorizedExternalService))
       .Times(2);
 
   EXPECT_CALL(mock_decoder_callbacks_,
@@ -146,10 +145,8 @@ TEST_F(ServiceControlFilterTest, DecodeHeadersSyncBadStatus) {
                              "service_control_check_error{API_KEY_INVALID}");
       }));
 
-  EXPECT_CALL(
-      mock_decoder_callbacks_.stream_info_,
-      setResponseFlag(
-          Envoy::StreamInfo::ResponseFlag::UnauthorizedExternalService));
+  EXPECT_CALL(mock_decoder_callbacks_.stream_info_,
+              setResponseFlag(Envoy::StreamInfo::UnauthorizedExternalService));
   EXPECT_CALL(
       mock_decoder_callbacks_,
       sendLocalReply(Envoy::Http::Code::Unauthorized, "UNAUTHENTICATED: test",
@@ -202,10 +199,8 @@ TEST_F(ServiceControlFilterTest, DecodeHeadersAsyncBadStatus) {
             filter_->decodeHeaders(req_headers_, true));
 
   // Filter should reject this request
-  EXPECT_CALL(
-      mock_decoder_callbacks_.stream_info_,
-      setResponseFlag(
-          Envoy::StreamInfo::ResponseFlag::UnauthorizedExternalService));
+  EXPECT_CALL(mock_decoder_callbacks_.stream_info_,
+              setResponseFlag(Envoy::StreamInfo::UnauthorizedExternalService));
 
   EXPECT_CALL(
       mock_decoder_callbacks_,
@@ -215,22 +210,12 @@ TEST_F(ServiceControlFilterTest, DecodeHeadersAsyncBadStatus) {
       kBadStatus, "service_control_check_error{API_KEY_INVALID}");
 }
 
-TEST_F(ServiceControlFilterTest, LogWithoutHandlerOrHeaders) {
-  // Test: If no handler and no headers, a handler is not created
-  EXPECT_CALL(mock_handler_factory_, createHandler(_, _, _)).Times(0);
-
-  // Filter has no handler. If it tries to callReport, it will seg fault
-  filter_->log(nullptr, &resp_headers_, &resp_trailer_,
-               mock_decoder_callbacks_.stream_info_,
-               Envoy::AccessLog::AccessLogType::NotSet);
-}
-
 TEST_F(ServiceControlFilterTest, LogWithoutHandler) {
   // Test: When a Filter has no Handler yet, another is created for log()
   EXPECT_CALL(*mock_handler_, callReport(_, _, _, _));
-  filter_->log(&req_headers_, &resp_headers_, &resp_trailer_,
-               mock_decoder_callbacks_.stream_info_,
-               Envoy::AccessLog::AccessLogType::NotSet);
+  Envoy::Formatter::HttpFormatterContext context(&req_headers_, &resp_headers_,
+                                                 &resp_trailer_);
+  filter_->log(context, mock_decoder_callbacks_.stream_info_);
 }
 
 TEST_F(ServiceControlFilterTest, LogWithHandler) {
@@ -240,9 +225,9 @@ TEST_F(ServiceControlFilterTest, LogWithHandler) {
 
   EXPECT_CALL(mock_handler_factory_, createHandler(_, _, _)).Times(0);
   EXPECT_CALL(*mock_handler_, callReport(_, _, _, _));
-  filter_->log(&req_headers_, &resp_headers_, &resp_trailer_,
-               mock_decoder_callbacks_.stream_info_,
-               Envoy::AccessLog::AccessLogType::NotSet);
+  Envoy::Formatter::HttpFormatterContext context(&req_headers_, &resp_headers_,
+                                                 &resp_trailer_);
+  filter_->log(context, mock_decoder_callbacks_.stream_info_);
 }
 
 TEST_F(ServiceControlFilterTest, DecodeHelpersWhileStopped) {

src/envoy/http/service_control/handler_utils.cc

@@ -62,22 +62,24 @@ inline int64_t convertNsToMs(std::chrono::nanoseconds ns) {
   return std::chrono::duration_cast<std::chrono::milliseconds>(ns).count();
 }
 
-bool extractAPIKeyFromQuery(const Envoy::Http::RequestHeaderMap& headers,
-                            const std::string& query, bool& were_params_parsed,
-                            Envoy::Http::Utility::QueryParams& parsed_params,
-                            std::string& api_key) {
+bool extractAPIKeyFromQuery(
+    const Envoy::Http::RequestHeaderMap& headers, const std::string& query,
+    bool& were_params_parsed,
+    Envoy::Http::Utility::QueryParamsMulti& parsed_params,
+    std::string& api_key) {
   if (!were_params_parsed) {
     if (headers.Path() == nullptr) {
       return false;
     }
-    parsed_params = Envoy::Http::Utility::parseQueryString(
+    parsed_params = Envoy::Http::Utility::QueryParamsMulti::parseQueryString(
         headers.Path()->value().getStringView());
     were_params_parsed = true;
   }
 
-  const auto& it = parsed_params.find(query);
-  if (it != parsed_params.end()) {
-    api_key = it->second;
+  std::optional<std::string> query_param_value =
+      parsed_params.getFirstValue(query);
+  if (query_param_value.has_value()) {
+    api_key = *query_param_value;
     return true;
   }
   return false;
@@ -309,7 +311,7 @@ bool extractAPIKey(
   // If checking multiple headers, cache the parameters so they are only parsed
   // once
   bool were_params_parsed{false};
-  Envoy::Http::Utility::QueryParams parsed_params;
+  Envoy::Http::Utility::QueryParamsMulti parsed_params;
 
   for (const auto& location : locations) {
     switch (location.key_case()) {

src/envoy/http/service_control/http_call.cc

@@ -207,7 +207,8 @@ class HttpCallImpl : public HttpCall,
     request_span_->setTag(Envoy::Tracing::Tags::get().HttpMethod, "POST");
 
     Envoy::Http::RequestMessagePtr message = prepareHeaders(token);
-    request_span_->injectContext(message->headers(), nullptr);
+    Envoy::Tracing::HttpTraceContext trace_context(message->headers());
+    request_span_->injectContext(trace_context, nullptr);
     ENVOY_LOG(debug, "http call from [uri = {}]: start", uri_);
 
     const auto thread_local_cluster =

src/envoy/http/service_control/service_control_call_impl.cc

@@ -107,13 +107,14 @@ ServiceControlCallImpl::ServiceControlCallImpl(
     Envoy::Server::Configuration::FactoryContext& context)
     : filter_config_(*proto_config),
       token_subscriber_factory_(context),
-      tls_(context.threadLocal()) {
+      tls_(context.serverFactoryContext().threadLocal()) {
   // Pass shared_ptr of proto_config to the function capture so that
   // it will not be released when the function is called.
-  tls_.set([proto_config, &config, stats_prefix, &scope = context.scope(),
-            &cm = context.clusterManager(),
-            &time_source =
-                context.timeSource()](Envoy::Event::Dispatcher& dispatcher) {
+  tls_.set([proto_config, &config, stats_prefix,
+            &scope = context.serverFactoryContext().scope(),
+            &cm = context.serverFactoryContext().clusterManager(),
+            &time_source = context.serverFactoryContext().timeSource()](
+               Envoy::Event::Dispatcher& dispatcher) {
     return std::make_shared<ThreadLocalCache>(config, *proto_config,
                                               stats_prefix, scope, cm,
                                               time_source, dispatcher);