wangfakang · wangfakang · Nov 2, 2021 · Oct 11, 2021 · Oct 11, 2021 · Oct 11, 2021
diff --git a/.bazelrc b/.bazelrc
@@ -47,6 +47,7 @@ build:sanitizer --test_tag_filters=-no_san
 
 # Common flags for Clang
 build:clang --action_env=BAZEL_COMPILER=clang
+build:clang --action_env=CC=clang --action_env=CXX=clang++
 build:clang --linkopt=-fuse-ld=lld
 
 # Flags for Clang + PCH
@@ -79,11 +80,13 @@ build:clang-asan --linkopt -fuse-ld=lld
 build:clang-asan --linkopt --rtlib=compiler-rt
 build:clang-asan --linkopt --unwindlib=libgcc
 
-# macOS ASAN/UBSAN
+# macOS
 build:macos --cxxopt=-std=c++17
 build:macos --action_env=PATH=/usr/bin:/bin:/opt/homebrew/bin:/usr/local/bin:/opt/local/bin
 build:macos --host_action_env=PATH=/usr/bin:/bin:/opt/homebrew/bin:/usr/local/bin:/opt/local/bin
+build:macos --define tcmalloc=disabled
 
+# macOS ASAN/UBSAN
 build:macos-asan --config=asan
 # Workaround, see https://github.com/bazelbuild/bazel/issues/6932
 build:macos-asan --copt -Wno-macro-redefined
@@ -158,7 +161,7 @@ build:coverage --strategy=CoverageReport=sandboxed,local
 build:coverage --experimental_use_llvm_covmap
 build:coverage --collect_code_coverage
 build:coverage --test_tag_filters=-nocoverage
-build:coverage --instrumentation_filter="//source(?!/common/chromium_url|/common/quic/platform)[/:],//include[/:]"
+build:coverage --instrumentation_filter="//source(?!/common/quic/platform)[/:],//include[/:]"
 build:test-coverage --test_arg="-l trace"
 build:fuzz-coverage --config=plain-fuzzer
 build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
@@ -189,7 +192,7 @@ build:rbe-toolchain-asan --linkopt -fuse-ld=lld
 build:rbe-toolchain-asan --action_env=ENVOY_UBSAN_VPTR=1
 build:rbe-toolchain-asan --copt=-fsanitize=vptr,function
 build:rbe-toolchain-asan --linkopt=-fsanitize=vptr,function
-build:rbe-toolchain-asan --linkopt=-L/opt/llvm/lib/clang/11.0.1/lib/linux
+build:rbe-toolchain-asan --linkopt=-L/opt/llvm/lib/clang/12.0.1/lib/linux
 build:rbe-toolchain-asan --linkopt=-l:libclang_rt.ubsan_standalone-x86_64.a
 build:rbe-toolchain-asan --linkopt=-l:libclang_rt.ubsan_standalone_cxx-x86_64.a
 

diff --git a/.bazelversion b/.bazelversion
@@ -1 +1 @@
-4.1.0
+4.2.1
diff --git a/.github/actions/pr_notifier/pr_notifier.py b/.github/actions/pr_notifier/pr_notifier.py
@@ -30,6 +30,7 @@
     'asraa': 'UKZKCFRTP',
     'davinci26': 'U013608CUDV',
     'rojkov': 'UH5EXLYQK',
+    'RyanTheOptimist': 'U01SW3JC8GP',
 }
 
 # First pass reviewers who are not maintainers should get
@@ -43,7 +44,6 @@
     'KBaichoo': 'U016ZPU8KBK',
     'wbpcode': 'U017KF5C0Q6',
     'mathetake': 'UG9TD2FSB',
-    'RyanTheOptimist': 'U01SW3JC8GP',
 }
 
 # Only notify API reviewers who aren't maintainers.

diff --git a/.github/workflows/check-deps.yml b/.github/workflows/check-deps.yml
@@ -9,6 +9,8 @@ on :
 jobs :
   build :
     runs-on : ubuntu-latest
+    if: github.repository_owner == 'envoyproxy'
+
     steps :
       - name : checkout
         uses : actions/checkout/@v2

diff --git a/.github/workflows/pr_notifier.yml b/.github/workflows/pr_notifier.yml
@@ -7,6 +7,7 @@ jobs:
   pr_notifier:
     name: PR Notifier
     runs-on: ubuntu-latest
+    if: github.repository_owner == 'envoyproxy'
 
     steps:
     - uses: actions/checkout@v2

diff --git a/CODEOWNERS b/CODEOWNERS
@@ -40,6 +40,8 @@ extensions/filters/common/original_src @snowp @klarose
 /*/extensions/filters/http/header_to_metadata @rgs1 @zuercher
 # alts transport socket extension
 /*/extensions/transport_sockets/alts @antoniovicente @asraa @yangminzhu
+# tcp_stats transport socket extension
+/*/extensions/transport_sockets/tcp_stats @ggreenway @mattklein123
 # tls transport socket extension
 /*/extensions/transport_sockets/tls @lizan @asraa @ggreenway
 # tls SPIFFE certificate validator extension
@@ -192,6 +194,9 @@ extensions/filters/http/oauth2 @rgs1 @derekargueta @snowp
 /*/extensions/matching/input_matchers/ip @aguinet @snowp
 # Key Value store
 /*/extensions/key_value @alyssawilk @ryantheoptimist
+# DNS Resolver
+/*/extensions/network/dns_resolver/cares @junr03 @yanavlasov
+/*/extensions/network/dns_resolver/apple @junr03 @yanavlasov
 
 # Contrib
 /contrib/exe/ @mattklein123 @lizan
@@ -204,3 +209,4 @@ extensions/filters/http/oauth2 @rgs1 @derekargueta @snowp
 /contrib/sxg/ @cpapazian @rgs1 @alyssawilk
 /contrib/sip_proxy/ @durd07 @nearbyfly @dorisd0102
 /contrib/cryptomb/ @rojkov @ipuustin
+/contrib/vcl/ @florincoras @rojkov
diff --git a/OWNERS.md b/OWNERS.md
@@ -47,6 +47,8 @@ routing PRs, questions, etc. to the right place.
   * Windows, low level networking.
 * Dmitry Rozhkov ([rojkov](https://github.com/rojkov)) (dmitry.rozhkov@intel.com)
   * Scalability and performance.
+* Ryan Hamilton ([RyanTheOptimist](https://github.com/ryantheoptimist)) (rch@google.com)
+  * HTTP/3, upstream connection management.
 
 # Senior extension maintainers
 
@@ -63,7 +65,6 @@ without further review.
 
 * All senior maintainers
 * Tony Allen ([tonya11en](https://github.com/tonya11en)) (tony@allen.gg)
-* Dmitri Dolguikh ([dmitri-d](https://github.com/dmitri-d)) (ddolguik@redhat.com)
 * Yan Avlasov ([yanavlasov](https://github.com/yanavlasov)) (yavlasov@google.com)
 * William A Rowe Jr ([wrowe](https://github.com/wrowe)) (wrowe@vmware.com)
 

diff --git a/README.md b/README.md
@@ -17,7 +17,7 @@ involved and how Envoy plays a role, read the CNCF
 
 * [Official documentation](https://www.envoyproxy.io/)
 * [FAQ](https://www.envoyproxy.io/docs/envoy/latest/faq/overview)
-* [Unofficial Chinese documentation](https://www.servicemesher.com/envoy/)
+* [Unofficial Chinese documentation](https://cloudnative.to/envoy/)
 * Watch [a video overview of Envoy](https://www.youtube.com/watch?v=RVZX4CwKhGE)
 ([transcript](https://www.microservices.com/talks/lyfts-envoy-monolith-service-mesh-matt-klein/))
 to find out more about the origin story and design philosophy of Envoy

diff --git a/api/BUILD b/api/BUILD
@@ -18,24 +18,39 @@ proto_library(
         "//envoy/api/v2/ratelimit:pkg",
         "//envoy/api/v2/route:pkg",
         "//envoy/config/bootstrap/v2:pkg",
+        "//envoy/config/cluster/dynamic_forward_proxy/v2alpha:pkg",
+        "//envoy/config/common/dynamic_forward_proxy/v2alpha:pkg",
+        "//envoy/config/common/tap/v2alpha:pkg",
         "//envoy/config/filter/accesslog/v2:pkg",
         "//envoy/config/filter/fault/v2:pkg",
+        "//envoy/config/filter/http/compressor/v2:pkg",
+        "//envoy/config/filter/http/dynamic_forward_proxy/v2alpha:pkg",
+        "//envoy/config/filter/http/gzip/v2:pkg",
+        "//envoy/config/filter/http/rate_limit/v2:pkg",
+        "//envoy/config/filter/http/rbac/v2:pkg",
+        "//envoy/config/filter/network/dubbo_proxy/v2alpha1:pkg",
         "//envoy/config/filter/network/http_connection_manager/v2:pkg",
+        "//envoy/config/filter/network/rate_limit/v2:pkg",
+        "//envoy/config/filter/network/rbac/v2:pkg",
         "//envoy/config/filter/network/redis_proxy/v2:pkg",
         "//envoy/config/filter/network/tcp_proxy/v2:pkg",
         "//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg",
+        "//envoy/config/filter/thrift/rate_limit/v2alpha1:pkg",
         "//envoy/config/filter/thrift/router/v2alpha1:pkg",
         "//envoy/config/health_checker/redis/v2:pkg",
         "//envoy/config/listener/v2:pkg",
         "//envoy/config/metrics/v2:pkg",
         "//envoy/config/overload/v2alpha:pkg",
+        "//envoy/config/ratelimit/v2:pkg",
+        "//envoy/config/rbac/v2:pkg",
         "//envoy/config/resource_monitor/fixed_heap/v2alpha:pkg",
         "//envoy/config/resource_monitor/injected_resource/v2alpha:pkg",
         "//envoy/config/retry/omit_canary_hosts/v2:pkg",
         "//envoy/config/retry/previous_hosts/v2:pkg",
         "//envoy/config/trace/v2:pkg",
         "//envoy/config/trace/v2alpha:pkg",
         "//envoy/config/transport_socket/alts/v2alpha:pkg",
+        "//envoy/config/transport_socket/tap/v2alpha:pkg",
         "//envoy/data/accesslog/v2:pkg",
         "//envoy/data/tap/v2alpha:pkg",
         "//envoy/service/accesslog/v2:pkg",
@@ -67,6 +82,7 @@ proto_library(
         "//contrib/envoy/extensions/filters/network/sip_proxy/router/v3alpha:pkg",
         "//contrib/envoy/extensions/filters/network/sip_proxy/v3alpha:pkg",
         "//contrib/envoy/extensions/private_key_providers/cryptomb/v3alpha:pkg",
+        "//contrib/envoy/extensions/vcl/v3alpha:pkg",
         "//envoy/admin/v3:pkg",
         "//envoy/config/accesslog/v3:pkg",
         "//envoy/config/bootstrap/v3:pkg",
@@ -197,6 +213,8 @@ proto_library(
         "//envoy/extensions/matching/common_inputs/environment_variable/v3:pkg",
         "//envoy/extensions/matching/input_matchers/consistent_hashing/v3:pkg",
         "//envoy/extensions/matching/input_matchers/ip/v3:pkg",
+        "//envoy/extensions/network/dns_resolver/apple/v3:pkg",
+        "//envoy/extensions/network/dns_resolver/cares/v3:pkg",
         "//envoy/extensions/network/socket_interface/v3:pkg",
         "//envoy/extensions/quic/crypto_stream/v3:pkg",
         "//envoy/extensions/quic/proof_source/v3:pkg",
@@ -218,6 +236,7 @@ proto_library(
         "//envoy/extensions/transport_sockets/s2a/v3:pkg",
         "//envoy/extensions/transport_sockets/starttls/v3:pkg",
         "//envoy/extensions/transport_sockets/tap/v3:pkg",
+        "//envoy/extensions/transport_sockets/tcp_stats/v3:pkg",
         "//envoy/extensions/transport_sockets/tls/v3:pkg",
         "//envoy/extensions/upstreams/http/generic/v3:pkg",
         "//envoy/extensions/upstreams/http/http/v3:pkg",

diff --git a/api/bazel/external_deps.bzl b/api/bazel/external_deps.bzl
@@ -71,7 +71,7 @@ USE_CATEGORIES = [
 USE_CATEGORIES_WITH_CPE_OPTIONAL = ["build", "other", "test_only", "api"]
 
 def _fail_missing_attribute(attr, key):
-    fail("The '%s' attribute must be defined for external dependecy " % attr + key)
+    fail("The '%s' attribute must be defined for external dependency " % attr + key)
 
 # Method for verifying content of the repository location specifications.
 #

diff --git a/api/bazel/repository_locations.bzl b/api/bazel/repository_locations.bzl
@@ -14,9 +14,9 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "protoc-gen-validate (PGV)",
         project_desc = "protoc plugin to generate polyglot message validators",
         project_url = "https://github.com/envoyproxy/protoc-gen-validate",
-        version = "0.6.1",
-        sha256 = "c695fc5a2e5a1b52904cd8a58ce7a1c3a80f7f50719496fd606e551685c01101",
-        release_date = "2021-04-26",
+        version = "0.6.2",
+        sha256 = "b02da533c77023238c556982507b9a71afc850478b637a7a13ec13f311efa5c0",
+        release_date = "2021-10-21",
         strip_prefix = "protoc-gen-validate-{version}",
         urls = ["https://github.com/envoyproxy/protoc-gen-validate/archive/v{version}.tar.gz"],
         use_category = ["api"],
@@ -44,9 +44,9 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_desc = "xDS API Working Group (xDS-WG)",
         project_url = "https://github.com/cncf/xds",
         # During the UDPA -> xDS migration, we aren't working with releases.
-        version = "c0841ac0dd72f6d26903f7e68fa64bd038533ba5",
-        sha256 = "ddd12de0fab2356db6c353e2ae75a21d83712c869aeb0ec73b215ca3eba9ee77",
-        release_date = "2021-10-07",
+        version = "cb28da3451f158a947dfc45090fe92b07b243bc1",
+        sha256 = "5bc8365613fe2f8ce6cc33959b7667b13b7fe56cb9d16ba740c06e1a7c4242fc",
+        release_date = "2021-10-11",
         strip_prefix = "xds-{version}",
         urls = ["https://github.com/cncf/xds/archive/{version}.tar.gz"],
         use_category = ["api"],

diff --git a/api/contrib/envoy/extensions/vcl/v3alpha/BUILD b/api/contrib/envoy/extensions/vcl/v3alpha/BUILD
@@ -0,0 +1,9 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"],
+)
diff --git a/api/contrib/envoy/extensions/vcl/v3alpha/vcl_socket_interface.proto b/api/contrib/envoy/extensions/vcl/v3alpha/vcl_socket_interface.proto
@@ -0,0 +1,19 @@
+syntax = "proto3";
+
+package envoy.extensions.vcl.v3alpha;
+
+import "udpa/annotations/status.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.vcl.v3alpha";
+option java_outer_classname = "VclSocketInterfaceProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).work_in_progress = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Vcl Socket Interface configuration]
+// VCL :ref:`configuration overview <config_sock_interface_vcl>`.
+// [#extension: envoy.bootstrap.vcl]
+
+// Configuration for vcl socket interface that relies on `vpp` `comms` library (VCL)
+message VclSocketInterface {
+}
diff --git a/api/envoy/admin/v3/BUILD b/api/envoy/admin/v3/BUILD
@@ -6,7 +6,6 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
-        "//envoy/admin/v2alpha:pkg",
         "//envoy/config/bootstrap/v3:pkg",
         "//envoy/config/cluster/v3:pkg",
         "//envoy/config/core/v3:pkg",

diff --git a/api/envoy/api/v2/auth/tls.proto b/api/envoy/api/v2/auth/tls.proto
@@ -81,10 +81,9 @@ message DownstreamTlsContext {
     bool disable_stateless_session_resumption = 7;
   }
 
-  // If specified, session_timeout will change maximum lifetime (in seconds) of TLS session
-  // Currently this value is used as a hint to `TLS session ticket lifetime (for TLSv1.2)
-  // <https://tools.ietf.org/html/rfc5077#section-5.6>`
-  // only seconds could be specified (fractional seconds are going to be ignored).
+  // If specified, ``session_timeout`` will change the maximum lifetime (in seconds) of the TLS session.
+  // Currently this value is used as a hint for the `TLS session ticket lifetime (for TLSv1.2) <https://tools.ietf.org/html/rfc5077#section-5.6>`_.
+  // Only seconds can be specified (fractional seconds are ignored).
   google.protobuf.Duration session_timeout = 6 [(validate.rules).duration = {
     lt {seconds: 4294967296}
     gte {}

diff --git a/api/envoy/api/v2/route/route_components.proto b/api/envoy/api/v2/route/route_components.proto
@@ -675,8 +675,8 @@ message RouteAction {
 
     message FilterState {
       // The name of the Object in the per-request filterState, which is an
-      // Envoy::Http::Hashable object. If there is no data associated with the key,
-      // or the stored object is not Envoy::Http::Hashable, no hash will be produced.
+      // Envoy::Hashable object. If there is no data associated with the key,
+      // or the stored object is not Envoy::Hashable, no hash will be produced.
       string key = 1 [(validate.rules).string = {min_bytes: 1}];
     }
 

diff --git a/api/envoy/config/accesslog/v3/BUILD b/api/envoy/config/accesslog/v3/BUILD
@@ -7,7 +7,6 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/config/core/v3:pkg",
-        "//envoy/config/filter/accesslog/v2:pkg",
         "//envoy/config/route/v3:pkg",
         "//envoy/type/matcher/v3:pkg",
         "//envoy/type/v3:pkg",

diff --git a/api/envoy/config/bootstrap/v3/BUILD b/api/envoy/config/bootstrap/v3/BUILD
@@ -8,7 +8,6 @@ api_proto_package(
     deps = [
         "//envoy/annotations:pkg",
         "//envoy/config/accesslog/v3:pkg",
-        "//envoy/config/bootstrap/v2:pkg",
         "//envoy/config/cluster/v3:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/listener/v3:pkg",

diff --git a/api/envoy/config/bootstrap/v3/bootstrap.proto b/api/envoy/config/bootstrap/v3/bootstrap.proto
@@ -248,9 +248,6 @@ message Bootstrap {
   // when :ref:`dns_resolvers <envoy_v3_api_field_config.cluster.v3.Cluster.dns_resolvers>` and
   // :ref:`use_tcp_for_dns_lookups <envoy_v3_api_field_config.cluster.v3.Cluster.use_tcp_for_dns_lookups>` are
   // specified.
-  // Setting this value causes failure if the
-  // ``envoy.restart_features.use_apple_api_for_dns_lookups`` runtime value is true during
-  // server startup. Apple' API only uses UDP for DNS resolution.
   // This field is deprecated in favor of *dns_resolution_config*
   // which aggregates all of the DNS resolver configuration in a single message.
   bool use_tcp_for_dns_lookups = 20
@@ -260,23 +257,22 @@ message Bootstrap {
   // This may be overridden on a per-cluster basis in cds_config, when
   // :ref:`dns_resolution_config <envoy_v3_api_field_config.cluster.v3.Cluster.dns_resolution_config>`
   // is specified.
-  // *dns_resolution_config* will be deprecated once
-  // :ref:'typed_dns_resolver_config <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.typed_dns_resolver_config>'
-  // is fully supported.
-  core.v3.DnsResolutionConfig dns_resolution_config = 30;
+  // This field is deprecated in favor of
+  // :ref:`typed_dns_resolver_config <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.typed_dns_resolver_config>`.
+  core.v3.DnsResolutionConfig dns_resolution_config = 30
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // DNS resolver type configuration extension. This extension can be used to configure c-ares, apple,
   // or any other DNS resolver types and the related parameters.
-  // For example, an object of :ref:`DnsResolutionConfig <envoy_v3_api_msg_config.core.v3.DnsResolutionConfig>`
-  // can be packed into this *typed_dns_resolver_config*. This configuration will replace the
-  // :ref:'dns_resolution_config <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.dns_resolution_config>'
-  // configuration eventually.
-  // TODO(yanjunxiang): Investigate the deprecation plan for *dns_resolution_config*.
+  // For example, an object of
+  // :ref:`CaresDnsResolverConfig <envoy_v3_api_msg_extensions.network.dns_resolver.cares.v3.CaresDnsResolverConfig>`
+  // can be packed into this *typed_dns_resolver_config*. This configuration replaces the
+  // :ref:`dns_resolution_config <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.dns_resolution_config>`
+  // configuration.
   // During the transition period when both *dns_resolution_config* and *typed_dns_resolver_config* exists,
-  // this configuration is optional.
-  // When *typed_dns_resolver_config* is in place, Envoy will use it and ignore *dns_resolution_config*.
+  // when *typed_dns_resolver_config* is in place, Envoy will use it and ignore *dns_resolution_config*.
   // When *typed_dns_resolver_config* is missing, the default behavior is in place.
-  // [#not-implemented-hide:]
+  // [#extension-category: envoy.network.dns_resolver]
   core.v3.TypedExtensionConfig typed_dns_resolver_config = 31;
 
   // Specifies optional bootstrap extensions to be instantiated at startup time.

diff --git a/api/envoy/config/cluster/v3/BUILD b/api/envoy/config/cluster/v3/BUILD
@@ -7,8 +7,6 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/annotations:pkg",
-        "//envoy/api/v2:pkg",
-        "//envoy/api/v2/cluster:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/endpoint/v3:pkg",
         "//envoy/type/v3:pkg",