Fixes MAISTRA-1265: Upstream release 1.4.6 + alpn fixes + latest bssl_wrapper #7

dmitri-d · 2020-03-12T22:54:37Z

This PR

brings maistra-1.1 branch up to date with changes in upstream 1.4.6
updates bssl_wrapper depedency to latest
resolves alpn issues in tls_inspector

I decided to postpone moving code accessing SSL struct internal into bssl_wrapper until the next release, mostly to simplify and speed up 1.1 release.

Signed-off-by: Kuat Yessenov <kuat@google.com>

Cherry-pick of envoyproxy/envoy#9839

Signed-off-by: Kuat Yessenov <kuat@google.com>

Cherry-pick of envoyproxy/envoy#9862

Previously, the update callback was called only when the secret was received for the first time or when its value changed. This meant that if the same secret (e.g. trusted CA) was used in multiple resources, then resources using it but configured after the secret was already received, remained unconfigured until the secret's value changed. The missing callback should have resulted in transport factories stuck in the "not ready" state, however, because of an incorrect code, the available secret was processed like inlined validation context, and only rules from the "secret" part of the validation context were applied, leading to a complete bypass of rules from the "default" part. Signed-off-by: Piotr Sikora <piotrsikora@google.com> Co-authored-by: Oliver Liu <yonggangl@google.com>

…ra#123) Given that we allow creating zero byte fragments, it'd be good to proactively drain them. For example if someone is doing timing instrumentation and wants to know when Network::Connection data is written to the kernel, it could be useful to have a zero byte sentinel. Risk Level: Low (I don't think anyone is adding zero byte fragments yet) Testing: new unit test Docs Changes: n/a Release Notes: n/a Signed-off-by: Alyssa Wilk <alyssar@chromium.org> Signed-off-by: Jianfei Hu <jianfeih@google.com> Co-authored-by: Lizan Zhou <lizan@tetrate.io>

) Signed-off-by: Alyssa Wilk <alyssar@chromium.org> Signed-off-by: Jianfei Hu <jianfeih@google.com> Co-authored-by: Lizan Zhou <lizan@tetrate.io>

Previously, TLS inspector didn't support TLSv1.3 and clients configured to use only TLSv1.3 were not recognized as TLS clients. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process. Fixes istio/istio#18695. Signed-off-by: Piotr Sikora <piotrsikora@google.com>

This is similar to the http2 frame protection, but rather than try to guard [header block || last body bytes || last chunk in chunk encoding || trailer block] depending on end stream, which just gets messy, I opted to just add an empty reference counted fragment after the body was serialized, which appears to work just as well with a small theoretical overhead. If folks think the complexity is warranted I can of course do that instead. Risk Level: Medium Testing: new unit tests, integration test Docs Changes: stats documented Release Notes: added Signed-off-by: Alyssa Wilk <alyssar@chromium.org> Signed-off-by: Lizan Zhou <lizan@tetrate.io> Signed-off-by: Jianfei Hu <jianfeih@google.com>

Description: Remove empty slices off the end of buffers after calls to OwnedImpl::commit. The slices reserved when OwnedImpl::reserve is called will sit unused in cases where the 0 bytes are commited, for example, when socket read returns 0 bytes EAGAIN. Trapped slices act like a memory leak until there is a successful read or the socket is closed. Risk Level: low Testing: unit Docs Changes: n/a Release Notes: n/a Signed-off-by: Antonio Vicente <avd@google.com> Signed-off-by: Asra Ali <asraa@google.com> Signed-off-by: Yangmin Zhu <ymzhu@google.com>

… avoid fragmentation (maistra#117) (maistra#127) Change OwnedImpl::move to force a copy instead of taking ownership of slices in cases where the offered slices are below kCopyThreshold Risk Level: medium, changes to buffer behavior Testing: Unit Tests Docs Changes: N/A Release Notes: N/A Signed-off-by: Antonio Vicente <avd@google.com> Signed-off-by: Yangmin Zhu <ymzhu@google.com>

…1.4-no-sts Backport changes from the upcoming Envoy 1.12.3 security release

dmitri-d · 2020-03-12T22:57:36Z

bazel/external/openssl_includes-1.patch

+         return 1;
+
+-    *data = OPENSSL_memdup(pkt->curr, length);
+    *data = (unsigned char *)OPENSSL_memdup(pkt->curr, length);


This is to make g++ compiler happy (implicit casts from void* are illegal in c++): I couldn't find a way to make bazel use gcc for this dependency.

dmitri-d · 2020-03-12T23:01:00Z

bazel/external/openssl_includes.BUILD

@@ -0,0 +1,18 @@
+cc_library(


This is used to open SSL structure to allow access to alpn-related fields here: https://github.com/Maistra/envoy/pull/7/files#diff-399c9deb5d9027103b258cd84614c9b6R59

We continue to link against system ssl libraries, this is just to allow inclusion of internal openssl headers.

brian-avery · 2020-03-12T23:54:45Z

bazel/repository_locations.bzl

-        urls = ["https://github.com/maistra/bssl_wrapper/archive/2eaed8832e12a0fada8f08a5e23522e035b80784.tar.gz"],
+        sha256 = "d84ea7d190210145695e5b172e8e6fb23f3464360da5efab5a1ae1a973c21f57",
+        strip_prefix = "bssl_wrapper-c9649facde3ab1d8bc871c7375a8946c50950e97",
+        urls = ["https://github.com/maistra/bssl_wrapper/archive/c9649facde3ab1d8bc871c7375a8946c50950e97.tar.gz"],


Out of curiosity, why don't you use the commit as a variable here?

I'm not sure it's possible in .bzl?

They are just python files. You can assign a variable and refer it later. That said, I think we should follow the standard on the file. If the rest of file is doing this way, let's just do the same.

True, handling this as a variable would be in line with the way proxy does it. Not sure what the standard is here.

knrc

lgtm

8f2ed86 Tim Walsh Tue Mar 31 03:42:57 2020 +1000 Fix for dual certificate issue MAISTRA-1142 (maistra#10) 13d2925 Dmitri Dolguikh Thu Mar 26 14:00:00 2020 -0700 Fixes MAISTRA-1299: fix ASSERT failure and infinite loop when attempting to unset readDisable state on a closed connection, part 2 (maistra#11) a939c3c Dmitri Dolguikh Wed Mar 25 14:22:39 2020 -0700 Fixes MAISTRA-1299: fix ASSERT failure and infinite loop when attempting to unset readDisable state on a closed connection (maistra#9) 09d777a Jonh Wendell Mon Mar 16 18:42:04 2020 -0400 Merge pull request maistra#8 from jwendell/MAISTRA-1275 362b623 Jonh Wendell Mon Mar 16 18:33:04 2020 -0400 MAISTRA-1275: Write "OpenSSL" into envoy --version 6110125 Dmitri Dolguikh Fri Mar 13 10:43:59 2020 -0700 Merge pull request maistra#7 from dmitri-d/maistra-1.1-upstream-release-1.4.6-patch 7f1eb1e Dmitri Dolguikh Thu Mar 12 16:19:25 2020 -0700 Removed no longer relevant comments from tls_inspector_test 8ccac21 Dmitri Dolguikh Thu Mar 12 10:49:01 2020 -0700 Fixing alpn detection in tls_inspector cf0f50b Dmitri Dolguikh Thu Mar 12 14:10:23 2020 -0700 Updated bssl_wrapper to latest version fac23c0 Dmitri Dolguikh Thu Mar 12 14:38:36 2020 -0700 Merge branch 'upstream-release-1.4.6-patch' into maistra-1.1 0b12b16 Dmitri Dolguikh Mon Mar 9 10:55:57 2020 -0700 Fixes MAISTRA-1226: added support for importPublicKey in lua filter (maistra#6) e6e28d9 Dmitri Dolguikh Fri Feb 28 14:59:58 2020 -0800 added an explanation why DynamicOpentracingHttpTracer has been disabled (maistra#5) 7e50506 Dmitri Dolguikh Fri Feb 28 14:58:46 2020 -0800 added an explanation why DynamicOpentracingHttpTracer has been disabled (maistra#4) 7fe1986 Dmitri Dolguikh Fri Feb 28 14:57:44 2020 -0800 Fixes MAISTRA-1167: RetryHostPredicateFilter in protocol_integration_test suite passes now (maistra#3) 2c5d27e Dmitri Dolguikh Fri Feb 14 12:50:21 2020 -0800 Fixes MAISTRA-1167: //test/extensions/filters/listener/proxy_protocol:proxy_protocol_test is passing now (maistra#2) 7d0995a Dmitri Dolguikh Fri Feb 14 12:49:59 2020 -0800 Merge pull request maistra#1 from dmitri-d/fix-1168-certchain ff116fa Dmitri Dolguikh Wed Feb 12 15:29:31 2020 -0800 Fixes MAISTRA-1168: added implementation of boringssl function SSL_get_peer_full_cert_chain 72c81ba Dmitri Dolguikh Tue Feb 11 16:27:50 2020 -0800 Updated jwt_verification_lib to the latest version 487d30c Dmitri Dolguikh Tue Feb 11 09:19:53 2020 -0800 Updated for maistra-1.1 release 071457c Dmitri Dolguikh Tue Feb 4 15:32:41 2020 -0800 updated to support openssl Signed-off-by: Dmitri Dolguikh <ddolguik@redhat.com>

* Changes and fixes to support OpenSSL 8f2ed86 Tim Walsh Tue Mar 31 03:42:57 2020 +1000 Fix for dual certificate issue MAISTRA-1142 (#10) 13d2925 Dmitri Dolguikh Thu Mar 26 14:00:00 2020 -0700 Fixes MAISTRA-1299: fix ASSERT failure and infinite loop when attempting to unset readDisable state on a closed connection, part 2 (#11) a939c3c Dmitri Dolguikh Wed Mar 25 14:22:39 2020 -0700 Fixes MAISTRA-1299: fix ASSERT failure and infinite loop when attempting to unset readDisable state on a closed connection (#9) 09d777a Jonh Wendell Mon Mar 16 18:42:04 2020 -0400 Merge pull request #8 from jwendell/MAISTRA-1275 362b623 Jonh Wendell Mon Mar 16 18:33:04 2020 -0400 MAISTRA-1275: Write "OpenSSL" into envoy --version 6110125 Dmitri Dolguikh Fri Mar 13 10:43:59 2020 -0700 Merge pull request #7 from dmitri-d/maistra-1.1-upstream-release-1.4.6-patch 7f1eb1e Dmitri Dolguikh Thu Mar 12 16:19:25 2020 -0700 Removed no longer relevant comments from tls_inspector_test 8ccac21 Dmitri Dolguikh Thu Mar 12 10:49:01 2020 -0700 Fixing alpn detection in tls_inspector cf0f50b Dmitri Dolguikh Thu Mar 12 14:10:23 2020 -0700 Updated bssl_wrapper to latest version fac23c0 Dmitri Dolguikh Thu Mar 12 14:38:36 2020 -0700 Merge branch 'upstream-release-1.4.6-patch' into maistra-1.1 0b12b16 Dmitri Dolguikh Mon Mar 9 10:55:57 2020 -0700 Fixes MAISTRA-1226: added support for importPublicKey in lua filter (#6) e6e28d9 Dmitri Dolguikh Fri Feb 28 14:59:58 2020 -0800 added an explanation why DynamicOpentracingHttpTracer has been disabled (#5) 7e50506 Dmitri Dolguikh Fri Feb 28 14:58:46 2020 -0800 added an explanation why DynamicOpentracingHttpTracer has been disabled (#4) 7fe1986 Dmitri Dolguikh Fri Feb 28 14:57:44 2020 -0800 Fixes MAISTRA-1167: RetryHostPredicateFilter in protocol_integration_test suite passes now (#3) 2c5d27e Dmitri Dolguikh Fri Feb 14 12:50:21 2020 -0800 Fixes MAISTRA-1167: //test/extensions/filters/listener/proxy_protocol:proxy_protocol_test is passing now (#2) 7d0995a Dmitri Dolguikh Fri Feb 14 12:49:59 2020 -0800 Merge pull request #1 from dmitri-d/fix-1168-certchain ff116fa Dmitri Dolguikh Wed Feb 12 15:29:31 2020 -0800 Fixes MAISTRA-1168: added implementation of boringssl function SSL_get_peer_full_cert_chain 72c81ba Dmitri Dolguikh Tue Feb 11 16:27:50 2020 -0800 Updated jwt_verification_lib to the latest version 487d30c Dmitri Dolguikh Tue Feb 11 09:19:53 2020 -0800 Updated for maistra-1.1 release 071457c Dmitri Dolguikh Tue Feb 4 15:32:41 2020 -0800 updated to support openssl Signed-off-by: Dmitri Dolguikh <ddolguik@redhat.com> * Fixed failing tests * Fixed failing tests * Removed todos that have been completed

* Changes and fixes to support OpenSSL 8f2ed86 Tim Walsh Tue Mar 31 03:42:57 2020 +1000 Fix for dual certificate issue MAISTRA-1142 (maistra#10) 13d2925 Dmitri Dolguikh Thu Mar 26 14:00:00 2020 -0700 Fixes MAISTRA-1299: fix ASSERT failure and infinite loop when attempting to unset readDisable state on a closed connection, part 2 (maistra#11) a939c3c Dmitri Dolguikh Wed Mar 25 14:22:39 2020 -0700 Fixes MAISTRA-1299: fix ASSERT failure and infinite loop when attempting to unset readDisable state on a closed connection (maistra#9) 09d777a Jonh Wendell Mon Mar 16 18:42:04 2020 -0400 Merge pull request maistra#8 from jwendell/MAISTRA-1275 362b623 Jonh Wendell Mon Mar 16 18:33:04 2020 -0400 MAISTRA-1275: Write "OpenSSL" into envoy --version 6110125 Dmitri Dolguikh Fri Mar 13 10:43:59 2020 -0700 Merge pull request maistra#7 from dmitri-d/maistra-1.1-upstream-release-1.4.6-patch 7f1eb1e Dmitri Dolguikh Thu Mar 12 16:19:25 2020 -0700 Removed no longer relevant comments from tls_inspector_test 8ccac21 Dmitri Dolguikh Thu Mar 12 10:49:01 2020 -0700 Fixing alpn detection in tls_inspector cf0f50b Dmitri Dolguikh Thu Mar 12 14:10:23 2020 -0700 Updated bssl_wrapper to latest version fac23c0 Dmitri Dolguikh Thu Mar 12 14:38:36 2020 -0700 Merge branch 'upstream-release-1.4.6-patch' into maistra-1.1 0b12b16 Dmitri Dolguikh Mon Mar 9 10:55:57 2020 -0700 Fixes MAISTRA-1226: added support for importPublicKey in lua filter (maistra#6) e6e28d9 Dmitri Dolguikh Fri Feb 28 14:59:58 2020 -0800 added an explanation why DynamicOpentracingHttpTracer has been disabled (maistra#5) 7e50506 Dmitri Dolguikh Fri Feb 28 14:58:46 2020 -0800 added an explanation why DynamicOpentracingHttpTracer has been disabled (maistra#4) 7fe1986 Dmitri Dolguikh Fri Feb 28 14:57:44 2020 -0800 Fixes MAISTRA-1167: RetryHostPredicateFilter in protocol_integration_test suite passes now (maistra#3) 2c5d27e Dmitri Dolguikh Fri Feb 14 12:50:21 2020 -0800 Fixes MAISTRA-1167: //test/extensions/filters/listener/proxy_protocol:proxy_protocol_test is passing now (maistra#2) 7d0995a Dmitri Dolguikh Fri Feb 14 12:49:59 2020 -0800 Merge pull request maistra#1 from dmitri-d/fix-1168-certchain ff116fa Dmitri Dolguikh Wed Feb 12 15:29:31 2020 -0800 Fixes MAISTRA-1168: added implementation of boringssl function SSL_get_peer_full_cert_chain 72c81ba Dmitri Dolguikh Tue Feb 11 16:27:50 2020 -0800 Updated jwt_verification_lib to the latest version 487d30c Dmitri Dolguikh Tue Feb 11 09:19:53 2020 -0800 Updated for maistra-1.1 release 071457c Dmitri Dolguikh Tue Feb 4 15:32:41 2020 -0800 updated to support openssl Signed-off-by: Dmitri Dolguikh <ddolguik@redhat.com> * Fixed failing tests * Fixed failing tests * Removed todos that have been completed

…2856) `//test/integration:tcp_proxy_odcds_integration_test` was observed to fail as follows: ``` ==================== Test output for //test/integration:tcp_proxy_odcds_integration_test: [==========] Running 24 tests from 1 test suite. [----------] Global test environment set-up. [----------] 24 tests from IpVersionsClientType/TcpProxyOdcdsIntegrationTest [ RUN ] IpVersionsClientType/TcpProxyOdcdsIntegrationTest.SingleTcpClient/0 [2022-08-25 20:22:46.750][3969][critical][assert] [test/integration/fake_upstream.cc:832] assert failure: !dispatcher_->isThreadSafe(). [2022-08-25 20:22:46.752][3969][critical][backtrace] [./source/server/backtrace.h:104] Caught Aborted, suspect faulting address 0x6b00000f81 [2022-08-25 20:22:46.752][3969][critical][backtrace] [./source/server/backtrace.h:91] Backtrace (use tools/stack_decode.py to get line numbers): [2022-08-25 20:22:46.752][3969][critical][backtrace] [./source/server/backtrace.h:92] Envoy version: 0/1.24.0-dev/test/DEBUG/BoringSSL [2022-08-25 20:22:46.773][3969][critical][backtrace] [./source/server/backtrace.h:96] #0: Envoy::SignalAction::sigHandler() [0x4c46a78]->[0x2cf2a78] external/com_google_googletest/googlemock/include/gmock/gmock-spec-builders.h:1267 [2022-08-25 20:22:46.773][3969][critical][backtrace] [./source/server/backtrace.h:96] #1: __restore_rt [0x7ffbdaa79420]->[0x7ffbd8b25420] ??:0 [2022-08-25 20:22:46.802][3969][critical][backtrace] [./source/server/backtrace.h:96] #2: Envoy::FakeUpstream::assertPendingConnectionsEmpty() [0x245bf0b]->[0x507f0b] ??:0 [2022-08-25 20:22:46.846][3969][critical][backtrace] [./source/server/backtrace.h:96] #3: Envoy::(anonymous namespace)::TcpProxyOdcdsIntegrationTest_SingleTcpClient_Test::TestBody() [0x1f596cb]->[0x56cb] ??:0 [2022-08-25 20:22:46.877][3969][critical][backtrace] [./source/server/backtrace.h:96] #4: testing::internal::HandleSehExceptionsInMethodIfSupported<>() [0x588b61b]->[0x393761b] ??:0 [2022-08-25 20:22:46.924][3969][critical][backtrace] [./source/server/backtrace.h:96] #5: testing::internal::HandleExceptionsInMethodIfSupported<>() [0x587c2bd]->[0x39282bd] ??:0 [2022-08-25 20:22:46.966][3969][critical][backtrace] [./source/server/backtrace.h:96] #6: testing::Test::Run() [0x5864ba3]->[0x3910ba3] /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/stl_vector.h:0 [2022-08-25 20:22:47.003][3969][critical][backtrace] [./source/server/backtrace.h:96] #7: testing::TestInfo::Run() [0x586576a]->[0x391176a] external/com_google_absl/absl/container/internal/raw_hash_set.h:1259 [2022-08-25 20:22:47.037][3969][critical][backtrace] [./source/server/backtrace.h:96] #8: testing::TestSuite::Run() [0x5865fbb]->[0x3911fbb] /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/stl_algo.h:1925 [2022-08-25 20:22:47.089][3969][critical][backtrace] [./source/server/backtrace.h:96] #9: testing::internal::UnitTestImpl::RunAllTests() [0x5874a28]->[0x3920a28] envoy/registry/registry.h:509 [2022-08-25 20:22:47.114][3969][critical][backtrace] [./source/server/backtrace.h:96] #10: testing::internal::HandleSehExceptionsInMethodIfSupported<>() [0x588ddbb]->[0x3939dbb] envoy/registry/registry.h:0 [2022-08-25 20:22:47.160][3969][critical][backtrace] [./source/server/backtrace.h:96] #11: testing::internal::HandleExceptionsInMethodIfSupported<>() [0x587e683]->[0x392a683] /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/unique_ptr.h:154 [2022-08-25 20:22:47.191][3969][critical][backtrace] [./source/server/backtrace.h:96] #12: testing::UnitTest::Run() [0x5874568]->[0x3920568] envoy/registry/registry.h:508 [2022-08-25 20:22:47.237][3969][critical][backtrace] [./source/server/backtrace.h:96] #13: RUN_ALL_TESTS() [0x4878d51]->[0x2924d51] external/com_google_googletest/googlemock/include/gmock/gmock-spec-builders.h:1203 [2022-08-25 20:22:47.284][3969][critical][backtrace] [./source/server/backtrace.h:96] #14: Envoy::TestRunner::RunTests() [0x48783b1]->[0x29243b1] external/com_google_googletest/googlemock/include/gmock/gmock-actions.h:485 [2022-08-25 20:22:47.316][3969][critical][backtrace] [./source/server/backtrace.h:96] #15: main [0x4874c3a]->[0x2920c3a] external/com_google_googletest/googlemock/include/gmock/gmock-spec-builders.h:1181 [2022-08-25 20:22:47.316][3969][critical][backtrace] [./source/server/backtrace.h:96] #16: __libc_start_main [0x7ffbda897083]->[0x7ffbd8943083] ??:0 ================================================================================ ``` This is due to the race described by envoyproxy/envoy#22855. Making sure the dispatcher thread is running before starting the test avoids this problem. Signed-off-by: Benjamin Peterson <benjamin@engflow.com>

This test sends a large number of metadata frames in order to trigger a disconnect. However, it was possible for the disconnect to happen and the connection to be torn down before all the metadata frames had been sent. If that happened, ASAN detected a UAF: ``` ==95==ERROR: AddressSanitizer: heap-use-after-free on address 0x60700037e5a0 at pc 0x000004811f9e bp 0x7ffc903af990 sp 0x7ffc903af988 READ of size 8 at 0x60700037e5a0 thread T0 #0 0x4811f9d in Envoy::IntegrationCodecClient::sendMetadata(Envoy::Http::RequestEncoder&, Envoy::Http::MetadataMap) /proc/self/cwd/test/integration/http_integration.cc:168:3 #1 0x46ed711 in Envoy::Http2FloodMitigationTest_RequestMetadata_Test::TestBody() /proc/self/cwd/test/integration/http2_flood_integration_test.cc:1486:20 #2 0xd380e64 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2580:10 #3 0xd348dc2 in testing::Test::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2655:5 #4 0xd34a927 in testing::TestInfo::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2832:11 #5 0xd34ccc4 in testing::TestSuite::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2986:28 #6 0xd36f07a in testing::internal::UnitTestImpl::RunAllTests() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5697:44 #7 0xd384e63 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/ gtest.cc:2580:10 #8 0xd36dd86 in testing::UnitTest::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5280:10 #9 0xa0e53a4 in Envoy::TestRunner::RunTests(int, char**) /proc/self/cwd/external/com_google_googletest/googletest/include/gtest/gtest.h:2485:46 #10 0xa0e0af7 in main /proc/self/cwd/test/main.cc:34:10 #11 0x7f442ef69082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) #12 0x45ed36d in _start (/mnt/ssd/cas/work/1/exec/bazel-out/k8-dbg/bin/test/integration/http2_flood_integration_test.runfiles/envoy/test/integration/http2_flood_integration_test+0x45ed36d) 0x60700037e5a0 is located 48 bytes inside of 80-byte region [0x60700037e570,0x60700037e5c0) freed by thread T0 here: #0 0x466f7d2 in free /local/mnt/workspace/bcain_clang_hu-bcain-lv_22036/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 #1 0x831dde8 in Envoy::Http::CodecClient::ActiveRequest::~ActiveRequest() /proc/self/cwd/./source/common/http/codec_client.h:220:10 #2 0x5aa33f9 in std::__1::unique_ptr<Envoy::Event::DeferredDeletable, std::__1::default_delete<Envoy::Event::DeferredDeletable> >::reset(Envoy::Event::DeferredDeletable*) /opt/llvm/bin/../include/c++/v1/__memory/unique_ptr.h:54:5 #3 0xa3218e8 in Envoy::Event::DispatcherImpl::clearDeferredDeleteList() /proc/self/cwd/source/common/event/dispatcher_impl.cc:142:21 #4 0xa3348df in void std::__1::__invoke_void_return_wrapper<void, true>::__call<Envoy::Event::DispatcherImpl::DispatcherImpl(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, Envoy::Thread::ThreadFactory&, Envoy::TimeSource& , Envoy::Random::RandomGenerator&, Envoy::Filesystem::Instance&, Envoy::Event::TimeSystem&, std::__1::function<std::__1::unique_ptr<Envoy::Event::ScaledRangeTimerManager, std::__1::default_delete<Envoy::Event::ScaledRangeTimerManager> > (Envoy::Event::Dispatcher&)> const& , std::__1::shared_ptr<Envoy::Buffer::WatermarkFactory> const&)::$_2&>(Envoy::Event::DispatcherImpl::DispatcherImpl(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, Envoy::Thread::ThreadFactory&, Envoy::TimeSource&, Envoy::Rand om::RandomGenerator&, Envoy::Filesystem::Instance&, Envoy::Event::TimeSystem&, std::__1::function<std::__1::unique_ptr<Envoy::Event::ScaledRangeTimerManager, std::__1::default_delete<Envoy::Event::ScaledRangeTimerManager> > (Envoy::Event::Dispatcher&)> const&, std::__1::s hared_ptr<Envoy::Buffer::WatermarkFactory> const&)::$_2&) /proc/self/cwd/source/common/event/dispatcher_impl.cc:79:30 #5 0xa334603 in std::__1::__function::__func<Envoy::Event::DispatcherImpl::DispatcherImpl(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, Envoy::Thread::ThreadFactory&, Envoy::TimeSource&, Envoy::Random::RandomGenerator&, Envoy::Filesystem::Instance&, Envoy::Event::TimeSystem&, std::__1::function<std::__1::unique_ptr<Envoy::Event::ScaledRangeTimerManager, std::__1::default_delete<Envoy::Event::ScaledRangeTimerManager> > (Envoy::Event::Dispatcher&)> const&, std::__1::shared_ptr<Envoy::Buffe r::WatermarkFactory> const&)::$_2, std::__1::allocator<Envoy::Event::DispatcherImpl::DispatcherImpl(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, Envoy::Thread::ThreadFactory&, Envoy::TimeSource&, Envoy::Random::RandomGenera tor&, Envoy::Filesystem::Instance&, Envoy::Event::TimeSystem&, std::__1::function<std::__1::unique_ptr<Envoy::Event::ScaledRangeTimerManager, std::__1::default_delete<Envoy::Event::ScaledRangeTimerManager> > (Envoy::Event::Dispatcher&)> const&, std::__1::shared_ptr<Envoy: :Buffer::WatermarkFactory> const&)::$_2>, void ()>::operator()() /opt/llvm/bin/../include/c++/v1/__functional/function.h:180:16 #6 0x4897039 in std::__1::__function::__value_func<void ()>::operator()() const /opt/llvm/bin/../include/c++/v1/__functional/function.h:507:16 #7 0xa8e6aa4 in Envoy::Event::SchedulableCallbackImpl::SchedulableCallbackImpl(Envoy::CSmartPtr<event_base, &(event_base_free)>&, std::__1::function<void ()>)::$_0::__invoke(int, short, void*) /opt/llvm/bin/../include/c++/v1/__functional/function.h:1184:12 #8 0xb557c5e in event_process_active_single_queue /mnt/ssd/cas/work/2/exec/external/com_github_libevent_libevent/event.c:1713:4 #9 0xb539252 in event_process_active /mnt/ssd/cas/work/2/exec/external/com_github_libevent_libevent/event.c #10 0xb539252 in event_base_loop /mnt/ssd/cas/work/2/exec/external/com_github_libevent_libevent/event.c:2047:12 #11 0xa8e1e3c in Envoy::Event::LibeventScheduler::run(Envoy::Event::Dispatcher::RunType) /proc/self/cwd/source/common/event/libevent_scheduler.cc:60:3 #12 0xa32bd94 in Envoy::Event::DispatcherImpl::run(Envoy::Event::Dispatcher::RunType) /proc/self/cwd/source/common/event/dispatcher_impl.cc:299:19 #13 0x480faad in Envoy::IntegrationCodecClient::flushWrite() /proc/self/cwd/test/integration/http_integration.cc:100:29 #14 0x4811e94 in Envoy::IntegrationCodecClient::sendMetadata(Envoy::Http::RequestEncoder&, Envoy::Http::MetadataMap) /proc/self/cwd/test/integration/http_integration.cc:169:3 #15 0x46ed711 in Envoy::Http2FloodMitigationTest_RequestMetadata_Test::TestBody() /proc/self/cwd/test/integration/http2_flood_integration_test.cc:1486:20 #16 0xd380e64 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2580:10 #17 0xd348dc2 in testing::Test::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2655:5 #18 0xd34a927 in testing::TestInfo::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2832:11 #19 0xd34ccc4 in testing::TestSuite::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2986:28 #20 0xd36f07a in testing::internal::UnitTestImpl::RunAllTests() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5697:44 #21 0xd384e63 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2580:10 #22 0xd36dd86 in testing::UnitTest::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5280:10 #23 0xa0e53a4 in Envoy::TestRunner::RunTests(int, char**) /proc/self/cwd/external/com_google_googletest/googletest/include/gtest/gtest.h:2485:46 #24 0xa0e0af7 in main /proc/self/cwd/test/main.cc:34:10 #25 0x7f442ef69082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) ``` To fix that, write all metadata frames at once. Signed-off-by: Benjamin Peterson <benjamin@engflow.com>

…2856) `//test/integration:tcp_proxy_odcds_integration_test` was observed to fail as follows: ``` ==================== Test output for //test/integration:tcp_proxy_odcds_integration_test: [==========] Running 24 tests from 1 test suite. [----------] Global test environment set-up. [----------] 24 tests from IpVersionsClientType/TcpProxyOdcdsIntegrationTest [ RUN ] IpVersionsClientType/TcpProxyOdcdsIntegrationTest.SingleTcpClient/0 [2022-08-25 20:22:46.750][3969][critical][assert] [test/integration/fake_upstream.cc:832] assert failure: !dispatcher_->isThreadSafe(). [2022-08-25 20:22:46.752][3969][critical][backtrace] [./source/server/backtrace.h:104] Caught Aborted, suspect faulting address 0x6b00000f81 [2022-08-25 20:22:46.752][3969][critical][backtrace] [./source/server/backtrace.h:91] Backtrace (use tools/stack_decode.py to get line numbers): [2022-08-25 20:22:46.752][3969][critical][backtrace] [./source/server/backtrace.h:92] Envoy version: 0/1.24.0-dev/test/DEBUG/BoringSSL [2022-08-25 20:22:46.773][3969][critical][backtrace] [./source/server/backtrace.h:96] #0: Envoy::SignalAction::sigHandler() [0x4c46a78]->[0x2cf2a78] external/com_google_googletest/googlemock/include/gmock/gmock-spec-builders.h:1267 [2022-08-25 20:22:46.773][3969][critical][backtrace] [./source/server/backtrace.h:96] #1: __restore_rt [0x7ffbdaa79420]->[0x7ffbd8b25420] ??:0 [2022-08-25 20:22:46.802][3969][critical][backtrace] [./source/server/backtrace.h:96] #2: Envoy::FakeUpstream::assertPendingConnectionsEmpty() [0x245bf0b]->[0x507f0b] ??:0 [2022-08-25 20:22:46.846][3969][critical][backtrace] [./source/server/backtrace.h:96] #3: Envoy::(anonymous namespace)::TcpProxyOdcdsIntegrationTest_SingleTcpClient_Test::TestBody() [0x1f596cb]->[0x56cb] ??:0 [2022-08-25 20:22:46.877][3969][critical][backtrace] [./source/server/backtrace.h:96] #4: testing::internal::HandleSehExceptionsInMethodIfSupported<>() [0x588b61b]->[0x393761b] ??:0 [2022-08-25 20:22:46.924][3969][critical][backtrace] [./source/server/backtrace.h:96] #5: testing::internal::HandleExceptionsInMethodIfSupported<>() [0x587c2bd]->[0x39282bd] ??:0 [2022-08-25 20:22:46.966][3969][critical][backtrace] [./source/server/backtrace.h:96] #6: testing::Test::Run() [0x5864ba3]->[0x3910ba3] /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/stl_vector.h:0 [2022-08-25 20:22:47.003][3969][critical][backtrace] [./source/server/backtrace.h:96] #7: testing::TestInfo::Run() [0x586576a]->[0x391176a] external/com_google_absl/absl/container/internal/raw_hash_set.h:1259 [2022-08-25 20:22:47.037][3969][critical][backtrace] [./source/server/backtrace.h:96] #8: testing::TestSuite::Run() [0x5865fbb]->[0x3911fbb] /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/stl_algo.h:1925 [2022-08-25 20:22:47.089][3969][critical][backtrace] [./source/server/backtrace.h:96] #9: testing::internal::UnitTestImpl::RunAllTests() [0x5874a28]->[0x3920a28] envoy/registry/registry.h:509 [2022-08-25 20:22:47.114][3969][critical][backtrace] [./source/server/backtrace.h:96] #10: testing::internal::HandleSehExceptionsInMethodIfSupported<>() [0x588ddbb]->[0x3939dbb] envoy/registry/registry.h:0 [2022-08-25 20:22:47.160][3969][critical][backtrace] [./source/server/backtrace.h:96] #11: testing::internal::HandleExceptionsInMethodIfSupported<>() [0x587e683]->[0x392a683] /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/unique_ptr.h:154 [2022-08-25 20:22:47.191][3969][critical][backtrace] [./source/server/backtrace.h:96] #12: testing::UnitTest::Run() [0x5874568]->[0x3920568] envoy/registry/registry.h:508 [2022-08-25 20:22:47.237][3969][critical][backtrace] [./source/server/backtrace.h:96] #13: RUN_ALL_TESTS() [0x4878d51]->[0x2924d51] external/com_google_googletest/googlemock/include/gmock/gmock-spec-builders.h:1203 [2022-08-25 20:22:47.284][3969][critical][backtrace] [./source/server/backtrace.h:96] #14: Envoy::TestRunner::RunTests() [0x48783b1]->[0x29243b1] external/com_google_googletest/googlemock/include/gmock/gmock-actions.h:485 [2022-08-25 20:22:47.316][3969][critical][backtrace] [./source/server/backtrace.h:96] #15: main [0x4874c3a]->[0x2920c3a] external/com_google_googletest/googlemock/include/gmock/gmock-spec-builders.h:1181 [2022-08-25 20:22:47.316][3969][critical][backtrace] [./source/server/backtrace.h:96] #16: __libc_start_main [0x7ffbda897083]->[0x7ffbd8943083] ??:0 ================================================================================ ``` This is due to the race described by envoyproxy/envoy#22855. Making sure the dispatcher thread is running before starting the test avoids this problem. Signed-off-by: Benjamin Peterson <benjamin@engflow.com>

This test sends a large number of metadata frames in order to trigger a disconnect. However, it was possible for the disconnect to happen and the connection to be torn down before all the metadata frames had been sent. If that happened, ASAN detected a UAF: ``` ==95==ERROR: AddressSanitizer: heap-use-after-free on address 0x60700037e5a0 at pc 0x000004811f9e bp 0x7ffc903af990 sp 0x7ffc903af988 READ of size 8 at 0x60700037e5a0 thread T0 #0 0x4811f9d in Envoy::IntegrationCodecClient::sendMetadata(Envoy::Http::RequestEncoder&, Envoy::Http::MetadataMap) /proc/self/cwd/test/integration/http_integration.cc:168:3 #1 0x46ed711 in Envoy::Http2FloodMitigationTest_RequestMetadata_Test::TestBody() /proc/self/cwd/test/integration/http2_flood_integration_test.cc:1486:20 #2 0xd380e64 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2580:10 #3 0xd348dc2 in testing::Test::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2655:5 #4 0xd34a927 in testing::TestInfo::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2832:11 #5 0xd34ccc4 in testing::TestSuite::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2986:28 #6 0xd36f07a in testing::internal::UnitTestImpl::RunAllTests() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5697:44 #7 0xd384e63 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/ gtest.cc:2580:10 #8 0xd36dd86 in testing::UnitTest::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5280:10 #9 0xa0e53a4 in Envoy::TestRunner::RunTests(int, char**) /proc/self/cwd/external/com_google_googletest/googletest/include/gtest/gtest.h:2485:46 #10 0xa0e0af7 in main /proc/self/cwd/test/main.cc:34:10 #11 0x7f442ef69082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) #12 0x45ed36d in _start (/mnt/ssd/cas/work/1/exec/bazel-out/k8-dbg/bin/test/integration/http2_flood_integration_test.runfiles/envoy/test/integration/http2_flood_integration_test+0x45ed36d) 0x60700037e5a0 is located 48 bytes inside of 80-byte region [0x60700037e570,0x60700037e5c0) freed by thread T0 here: #0 0x466f7d2 in free /local/mnt/workspace/bcain_clang_hu-bcain-lv_22036/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 #1 0x831dde8 in Envoy::Http::CodecClient::ActiveRequest::~ActiveRequest() /proc/self/cwd/./source/common/http/codec_client.h:220:10 #2 0x5aa33f9 in std::__1::unique_ptr<Envoy::Event::DeferredDeletable, std::__1::default_delete<Envoy::Event::DeferredDeletable> >::reset(Envoy::Event::DeferredDeletable*) /opt/llvm/bin/../include/c++/v1/__memory/unique_ptr.h:54:5 #3 0xa3218e8 in Envoy::Event::DispatcherImpl::clearDeferredDeleteList() /proc/self/cwd/source/common/event/dispatcher_impl.cc:142:21 #4 0xa3348df in void std::__1::__invoke_void_return_wrapper<void, true>::__call<Envoy::Event::DispatcherImpl::DispatcherImpl(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, Envoy::Thread::ThreadFactory&, Envoy::TimeSource& , Envoy::Random::RandomGenerator&, Envoy::Filesystem::Instance&, Envoy::Event::TimeSystem&, std::__1::function<std::__1::unique_ptr<Envoy::Event::ScaledRangeTimerManager, std::__1::default_delete<Envoy::Event::ScaledRangeTimerManager> > (Envoy::Event::Dispatcher&)> const& , std::__1::shared_ptr<Envoy::Buffer::WatermarkFactory> const&)::$_2&>(Envoy::Event::DispatcherImpl::DispatcherImpl(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, Envoy::Thread::ThreadFactory&, Envoy::TimeSource&, Envoy::Rand om::RandomGenerator&, Envoy::Filesystem::Instance&, Envoy::Event::TimeSystem&, std::__1::function<std::__1::unique_ptr<Envoy::Event::ScaledRangeTimerManager, std::__1::default_delete<Envoy::Event::ScaledRangeTimerManager> > (Envoy::Event::Dispatcher&)> const&, std::__1::s hared_ptr<Envoy::Buffer::WatermarkFactory> const&)::$_2&) /proc/self/cwd/source/common/event/dispatcher_impl.cc:79:30 #5 0xa334603 in std::__1::__function::__func<Envoy::Event::DispatcherImpl::DispatcherImpl(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, Envoy::Thread::ThreadFactory&, Envoy::TimeSource&, Envoy::Random::RandomGenerator&, Envoy::Filesystem::Instance&, Envoy::Event::TimeSystem&, std::__1::function<std::__1::unique_ptr<Envoy::Event::ScaledRangeTimerManager, std::__1::default_delete<Envoy::Event::ScaledRangeTimerManager> > (Envoy::Event::Dispatcher&)> const&, std::__1::shared_ptr<Envoy::Buffe r::WatermarkFactory> const&)::$_2, std::__1::allocator<Envoy::Event::DispatcherImpl::DispatcherImpl(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, Envoy::Thread::ThreadFactory&, Envoy::TimeSource&, Envoy::Random::RandomGenera tor&, Envoy::Filesystem::Instance&, Envoy::Event::TimeSystem&, std::__1::function<std::__1::unique_ptr<Envoy::Event::ScaledRangeTimerManager, std::__1::default_delete<Envoy::Event::ScaledRangeTimerManager> > (Envoy::Event::Dispatcher&)> const&, std::__1::shared_ptr<Envoy: :Buffer::WatermarkFactory> const&)::$_2>, void ()>::operator()() /opt/llvm/bin/../include/c++/v1/__functional/function.h:180:16 #6 0x4897039 in std::__1::__function::__value_func<void ()>::operator()() const /opt/llvm/bin/../include/c++/v1/__functional/function.h:507:16 #7 0xa8e6aa4 in Envoy::Event::SchedulableCallbackImpl::SchedulableCallbackImpl(Envoy::CSmartPtr<event_base, &(event_base_free)>&, std::__1::function<void ()>)::$_0::__invoke(int, short, void*) /opt/llvm/bin/../include/c++/v1/__functional/function.h:1184:12 #8 0xb557c5e in event_process_active_single_queue /mnt/ssd/cas/work/2/exec/external/com_github_libevent_libevent/event.c:1713:4 #9 0xb539252 in event_process_active /mnt/ssd/cas/work/2/exec/external/com_github_libevent_libevent/event.c #10 0xb539252 in event_base_loop /mnt/ssd/cas/work/2/exec/external/com_github_libevent_libevent/event.c:2047:12 #11 0xa8e1e3c in Envoy::Event::LibeventScheduler::run(Envoy::Event::Dispatcher::RunType) /proc/self/cwd/source/common/event/libevent_scheduler.cc:60:3 #12 0xa32bd94 in Envoy::Event::DispatcherImpl::run(Envoy::Event::Dispatcher::RunType) /proc/self/cwd/source/common/event/dispatcher_impl.cc:299:19 #13 0x480faad in Envoy::IntegrationCodecClient::flushWrite() /proc/self/cwd/test/integration/http_integration.cc:100:29 #14 0x4811e94 in Envoy::IntegrationCodecClient::sendMetadata(Envoy::Http::RequestEncoder&, Envoy::Http::MetadataMap) /proc/self/cwd/test/integration/http_integration.cc:169:3 #15 0x46ed711 in Envoy::Http2FloodMitigationTest_RequestMetadata_Test::TestBody() /proc/self/cwd/test/integration/http2_flood_integration_test.cc:1486:20 #16 0xd380e64 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2580:10 #17 0xd348dc2 in testing::Test::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2655:5 #18 0xd34a927 in testing::TestInfo::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2832:11 #19 0xd34ccc4 in testing::TestSuite::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2986:28 #20 0xd36f07a in testing::internal::UnitTestImpl::RunAllTests() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5697:44 #21 0xd384e63 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2580:10 #22 0xd36dd86 in testing::UnitTest::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5280:10 #23 0xa0e53a4 in Envoy::TestRunner::RunTests(int, char**) /proc/self/cwd/external/com_google_googletest/googletest/include/gtest/gtest.h:2485:46 #24 0xa0e0af7 in main /proc/self/cwd/test/main.cc:34:10 #25 0x7f442ef69082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) ``` To fix that, write all metadata frames at once. Signed-off-by: Benjamin Peterson <benjamin@engflow.com>

kyessenov and others added 15 commits January 28, 2020 11:43

Cherry-pick of envoyproxy/envoy#9839

8898368

Signed-off-by: Kuat Yessenov <kuat@google.com>

Merge pull request maistra#132 from kyessenov/patch_9839

6d5f90f

Cherry-pick of envoyproxy/envoy#9839

Cherry-pick of envoyproxy/envoy#9862

793809c

Signed-off-by: Kuat Yessenov <kuat@google.com>

Merge pull request maistra#133 from kyessenov/harden_context_14

b5c068e

Cherry-pick of envoyproxy/envoy#9862

network: draining the buffer on close (#9870) (maistra#110) (maistra#124

e90e85b

) Signed-off-by: Alyssa Wilk <alyssar@chromium.org> Signed-off-by: Jianfei Hu <jianfeih@google.com> Co-authored-by: Lizan Zhou <lizan@tetrate.io>

Merge pull request maistra#17 from istio-private/envoy-1.12-to-istio-…

524ab4c

…1.4-no-sts Backport changes from the upcoming Envoy 1.12.3 security release

Merge branch 'upstream-release-1.4.6-patch' into maistra-1.1

fac23c0

Updated bssl_wrapper to latest version

cf0f50b

Fixing alpn detection in tls_inspector

8ccac21

dmitri-d requested review from brian-avery, dgn, jwendell and knrc March 12, 2020 22:55

dmitri-d commented Mar 12, 2020

View reviewed changes

Removed no longer relevant comments from tls_inspector_test

7f1eb1e

brian-avery reviewed Mar 12, 2020

View reviewed changes

dmitri-d requested review from brian-avery and removed request for dgn and jwendell March 13, 2020 15:19

knrc approved these changes Mar 13, 2020

View reviewed changes

jwendell approved these changes Mar 13, 2020

View reviewed changes

brian-avery approved these changes Mar 13, 2020

View reviewed changes

dmitri-d merged commit 6110125 into maistra:maistra-1.1 Mar 13, 2020

dmitri-d deleted the maistra-1.1-upstream-release-1.4.6-patch branch July 7, 2020 22:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes MAISTRA-1265: Upstream release 1.4.6 + alpn fixes + latest bssl_wrapper #7

Fixes MAISTRA-1265: Upstream release 1.4.6 + alpn fixes + latest bssl_wrapper #7

dmitri-d commented Mar 12, 2020

dmitri-d Mar 12, 2020

dmitri-d Mar 12, 2020

brian-avery Mar 12, 2020

dmitri-d Mar 13, 2020

jwendell Mar 13, 2020

brian-avery Mar 13, 2020

knrc left a comment

Fixes MAISTRA-1265: Upstream release 1.4.6 + alpn fixes + latest bssl_wrapper #7

Fixes MAISTRA-1265: Upstream release 1.4.6 + alpn fixes + latest bssl_wrapper #7

Conversation

dmitri-d commented Mar 12, 2020

dmitri-d Mar 12, 2020

Choose a reason for hiding this comment

dmitri-d Mar 12, 2020

Choose a reason for hiding this comment

brian-avery Mar 12, 2020

Choose a reason for hiding this comment

dmitri-d Mar 13, 2020

Choose a reason for hiding this comment

jwendell Mar 13, 2020

Choose a reason for hiding this comment

brian-avery Mar 13, 2020

Choose a reason for hiding this comment

knrc left a comment

Choose a reason for hiding this comment