Merge branch 'envoyproxy:main' into nighthawk-connect-support

asingh-g · web-flow · commit 010fe717aa02 · 2025-10-22T10:52:40.000-04:00
diff --git a/.bazelrc b/.bazelrc
@@ -192,6 +192,7 @@ build:asan --linkopt='-L/opt/llvm/lib/clang/18/lib/x86_64-unknown-linux-gnu'
 build:macos --action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
 build:macos --host_action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
 build:macos --define tcmalloc=disabled
+build:macos --cxxopt=-Wno-nullability-completeness
 
 # macOS ASAN/UBSAN
 build:macos-asan --config=asan
@@ -293,7 +294,7 @@ build:fuzz-coverage --test_tag_filters=-nocoverage
 # resources required to build and run the tests.
 build:fuzz-coverage --define=wasm=disabled
 build:fuzz-coverage --config=fuzz-coverage-config
-build:fuzz-coverage-config --//tools/coverage:config=//test:fuzz_coverage_config
+build:fuzz-coverage-config --//tools/coverage:config=@envoy//test:fuzz_coverage_config
 
 build:cache-local --remote_cache=grpc://localhost:9092
 
@@ -397,7 +398,7 @@ build:compile-time-options --@envoy//source/extensions/filters/http/kill_request
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:f4a881a1205e8e6db1a57162faf3df7aed88eae8@sha256:b10346fe2eee41733dbab0e02322c47a538bf3938d093a5daebad9699860b814
+build:docker-sandbox --experimental_docker_image=docker.io/envoyproxy/envoy-build-ubuntu:f4a881a1205e8e6db1a57162faf3df7aed88eae8@sha256:b10346fe2eee41733dbab0e02322c47a538bf3938d093a5daebad9699860b814
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker
@@ -581,8 +582,10 @@ common:remote-envoy-engflow --config=rbe-envoy-engflow
 common:remote-cache-envoy-engflow --config=common-envoy-engflow
 common:remote-cache-envoy-engflow --config=cache-envoy-engflow
 
+common:cves --//tools/dependency:cve-data=//tools/dependency:cve-data-dir
+
 # Specifies the rustfmt.toml for all rustfmt_test targets.
-build --@rules_rust//rust/settings:rustfmt.toml=//:rustfmt.toml
+build --@rules_rust//rust/settings:rustfmt.toml=@envoy//:rustfmt.toml
 
 #############################################################################
 # debug: Various Bazel debugging flags
diff --git a/.bazelversion b/.bazelversion
@@ -1 +1 @@
-7.6.0
+7.6.1
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@f1f6e5f6af878fb37288ce1c627459e94dbf7d01  # v3.29.5
+      uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5  # v3.29.5
       with:
         sarif_file: results.sarif
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
@@ -58,6 +58,9 @@ You can customize the script's behavior using the following arguments:
 *   `--branch_name NAME`: The name of the branch to create in the Nighthawk
     repository for the update. Default: `update-envoy-YYYYMMDD` (e.g.,
     `update-envoy-20250809`)
+*   `--agent_invocation CMD`: Command to invoke an LLM agent (e.g., `gemini`) to
+    attempt to automatically fix errors. The agent will be called with the
+    prompt provided via stdin. Default: `None`
 
 The script provides detailed output for each step it performs, prefixed with
 `NighthawkEnvoyUpdate:` or `....EnvoyCommitIntegration:` for sub-steps.
@@ -72,6 +75,21 @@ manual step (like resolving merge conflicts):
 The script will detect the existing branch, rebase it on `origin/main` if
 necessary, and attempt to continue the update process.
 
+### LLM-in-the-loop automated integration fix
+
+To experimentaly enable automated fixes, you can use the `--agent_invocation`
+argument. The utility will use the specified command (e.g. `gemini`) when a step
+fails and pass a detailed prompt via stdin. The agent can then attempt to modify
+the files in your local Nighthawk repository to resolve the issue. The utility
+gives the agent 3 tries to fix an error before returning the error to the user.
+
+```bash
+./tools/nighthawk_envoy_updater.py \
+  --nighthawk_dir ~/my_local_nighthawk_git_repo \
+  --branch_name my-envoy-update-with-agent \
+  --agent_invocation gemini
+```
+
 ### Outcomes
 
 *   **Initial checks fail:** A script prerequisite is violated, like the
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
@@ -1,7 +1,7 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-ENVOY_COMMIT = "db557abb8afd8a4e91d3895979569ade35372de3"
-ENVOY_SHA = "8573a96a4883d24db35c7528637389fe6406a875b3593382af98d91718dc20e5"
+ENVOY_COMMIT = "405bf36c1ddd174f9c9dbc46766a455a29416dbd"
+ENVOY_SHA = "c62b45d821e172010e1ab20bdb86afb5c5561b0938c16259fe97398739895e3d"
 
 HDR_HISTOGRAM_C_VERSION = "0.11.8"  # June 18th, 2025
 HDR_HISTOGRAM_C_SHA = "bb95351a6a8b242dc9be1f28562761a84d4cf0a874ffc90a9b630770a6468e94"
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
@@ -255,6 +255,14 @@ function do_check_format() {
     ./tools/format_python_tools.sh check
 }
 
+function do_build_nighthawk_image() {
+    echo "Building docker images"
+    do_opt_build
+
+    echo "do_docker: Running ci/docker/docker_build.sh."
+    ./ci/docker/docker_build.sh
+}
+
 function do_docker() {
     echo "docker..."
     cd "${SRCDIR}"
@@ -368,6 +376,11 @@ case "$1" in
         do_opt_build
         exit 0
     ;;
+    build_nighthawk_image)
+        setup_clang_toolchain
+        do_build_nighthawk_image
+        exit 0
+    ;;
     *)
         echo "must be one of [opt_build,build,test,clang_tidy,coverage,coverage_integration,asan,tsan,benchmark_with_own_binaries,docker,check_format,fix_format,test_gcc]"
         exit 1
diff --git a/ci/docker-compose.yml b/ci/docker-compose.yml
@@ -1,6 +1,6 @@
 x-envoy-build-base: &envoy-build-base
   image: >-
-    ${ENVOY_BUILD_IMAGE:-envoyproxy/envoy-build-ubuntu:f4a881a1205e8e6db1a57162faf3df7aed88eae8@sha256:b10346fe2eee41733dbab0e02322c47a538bf3938d093a5daebad9699860b814}
+    ${ENVOY_BUILD_IMAGE:-docker.io/envoyproxy/envoy-build-ubuntu:f4a881a1205e8e6db1a57162faf3df7aed88eae8@sha256:b10346fe2eee41733dbab0e02322c47a538bf3938d093a5daebad9699860b814}
   user: root:root
   working_dir: ${ENVOY_DOCKER_SOURCE_DIR:-/source}
   stdin_open: true
diff --git a/ci/docker/Dockerfile-nighthawk b/ci/docker/Dockerfile-nighthawk
@@ -1,18 +1,19 @@
 FROM ubuntu:24.04@sha256:1e622c5f073b4f6bfad6632f2616c7f59ef256e96fe78bf6a595d1dc4376ac02
 
-RUN apt-get update && apt-get install libatomic1
+RUN apt -y update && apt -y install libatomic1 curl
 
 ADD nighthawk_client /usr/local/bin/nighthawk_client
 ADD nighthawk_test_server /usr/local/bin/nighthawk_test_server
 ADD nighthawk_output_transform /usr/local/bin/nighthawk_output_transform
 ADD nighthawk_service /usr/local/bin/nighthawk_service
 ADD nighthawk_adaptive_load_client /usr/local/bin/nighthawk_adaptive_load_client
-ADD default-config.yaml /etc/envoy/envoy.yaml
+
+ADD default-config.yaml /etc/nighthawk/nighthawk.yaml
 
 # Ports for nighthawk_test_server, see default-config.yaml
-EXPOSE 10001
-EXPOSE 10080
+EXPOSE 10001 10080
 # The default port for nighthawk_service
 EXPOSE 8443
 
-CMD ["-c", "/etc/envoy/envoy.yaml"]
+ENTRYPOINT ["/usr/local/bin/nighthawk_test_server"]
+CMD ["-c", "/etc/nighthawk/nighthawk.yaml"]
diff --git a/ci/docker/default-config.yaml b/ci/docker/default-config.yaml
@@ -5,31 +5,40 @@ admin:
     socket_address: { address: 0.0.0.0, port_value: 10001 }
 static_resources:
   listeners:
-  - address:
-      socket_address:
-        address: 0.0.0.0
-        port_value: 10080
-    filter_chains:
-    - filters:
-      - name: envoy.http_connection_manager
-        config:
-          generate_request_id: false
-          codec_type: auto
-          stat_prefix: ingress_http
-          route_config:
-            name: local_route
-            virtual_hosts:
-            - name: service
-              domains:
-              - "*"
-          http_filters:
-          - name: time-tracking
-          - name: dynamic-delay
-          - name: test-server
-            config:
-              response_body_size: 10
-              v3_response_headers:
-              - { header: { key: "x-nh", value: "1"}}
-          - name: envoy.router
-            config:
-              dynamic_stats: false
+    - address:
+        socket_address:
+          address: 0.0.0.0
+          port_value: 10080
+      filter_chains:
+        - filters:
+            - name: envoy.filters.network.http_connection_manager
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                generate_request_id: false
+                codec_type: AUTO
+                stat_prefix: ingress_http
+                route_config:
+                  name: local_route
+                  virtual_hosts:
+                    - name: service
+                      domains:
+                        - "*"
+                http_filters:
+                  - name: time-tracking
+                    typed_config:
+                      "@type": type.googleapis.com/nighthawk.server.TimeTrackingConfiguration
+                      emit_previous_request_delta_in_response_header: x-origin-request-receipt-delta
+                  - name: dynamic-delay
+                    typed_config:
+                      "@type": type.googleapis.com/nighthawk.server.DynamicDelayConfiguration
+                      static_delay: 0s
+                  - name: test-server # before envoy.router because order matters!
+                    typed_config:
+                      "@type": type.googleapis.com/nighthawk.server.ResponseOptions
+                      response_body_size: 10
+                      v3_response_headers:
+                        - { header: { key: "x-nh", value: "1" } }
+                  - name: envoy.filters.http.router
+                    typed_config:
+                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+                      dynamic_stats: false
diff --git a/ci/docker/docker_build.sh b/ci/docker/docker_build.sh
@@ -10,8 +10,8 @@ set -e
 # publishing sensitive information into public CI logs if someone makes a change in a
 # consuming script that is off guard.
 
-DOCKER_NAME="nighthawk"
-DOCKER_IMAGE_PREFIX="envoyproxy/${DOCKER_NAME}"
+DOCKER_IMAGE_PREFIX="${DOCKER_IMAGE_PREFIX:-envoyproxy/nighthawk}"
+
 BINARIES=(nighthawk_test_server nighthawk_client nighthawk_service nighthawk_output_transform nighthawk_adaptive_load_client)
 BAZEL_BIN="$(bazel info -c opt bazel-bin)"
 WORKSPACE="$(bazel info workspace)"
@@ -33,6 +33,6 @@ done
 
 cd "${TMP_DIR}"
 echo "running docker build ... "
-docker build -f "${TMP_DIR}/Dockerfile-${DOCKER_NAME}" -t "${DOCKER_IMAGE_PREFIX}-dev:latest" .
+docker build -f "${TMP_DIR}/Dockerfile-nighthawk" -t "${DOCKER_IMAGE_PREFIX}-dev:latest" .
 rm -rf "${TMP_DIR}"
 echo "docker build finished"
diff --git a/ci/docker/docker_push.sh b/ci/docker/docker_push.sh
@@ -25,5 +25,8 @@ fi
 docker login -u "$DOCKERHUB_USERNAME" -p "$DOCKERHUB_PASSWORD"
 
 docker push "${DOCKER_IMAGE_PREFIX}-dev:latest"
+
+# Push image tagged with Github SHA.
 docker tag "${DOCKER_IMAGE_PREFIX}-dev:latest" \
   "${DOCKER_IMAGE_PREFIX}-dev:${GH_SHA1}"
+docker push "${DOCKER_IMAGE_PREFIX}-dev:${GH_SHA1}"
diff --git a/docs/root/updating_envoy_dependency.md b/docs/root/updating_envoy_dependency.md
@@ -268,16 +268,6 @@ merge_from_envoy "tools/code_format/config.yaml"
 
 ### Step 11
 
-Perform this step if [tools/base/requirements.in](/tools/base/requirements.in)
-has not been updated in the last 30 days (based on comment at top of file).
-
-```bash
-head -1 tools/base/requirements.in
-```
-
-- If less than 30 days ago, skip to next step.
-- If more than 30 days ago, do the rest of this step.
-
 The Python dependencies need to be updated regularly. The list of packages
 the Nighthawk codebase uses is listed in
 [tools/base/requirements.in](/tools/base/requirements.in). This file specifies
@@ -287,15 +277,9 @@ incompatibility is found, you can pin a package by specifying a `<=` constraint.
 These should always be accompanied with a comment explaining them. Avoid using
 `==` constraint to the extent possible.
 
-First attempt to remove all existing pins in
-[tools/base/requirements.in](/tools/base/requirements.in) to see if they are
-still necessary. Once done editing
-[tools/base/requirements.in](/tools/base/requirements.in), delete the contents
-of [tools/base/requirements.txt](/tools/base/requirements.txt) and update the
-dependencies by running:
+Update the dependencies by running:
 
 ```bash
-echo > tools/base/requirements.txt
 bazel run //tools/base:requirements.update
 ```
 
diff --git a/source/client/benchmark_client_impl.cc b/source/client/benchmark_client_impl.cc
@@ -127,7 +127,7 @@ void BenchmarkClientHttpImpl::terminate() {
       ENVOY_LOG(info, "Wait for the connection pool drain timed out, proceeding to hard shutdown.");
       dispatcher_.exit();
     });
-    drain_timer_->enableTimer(30s);
+    drain_timer_->enableTimer(timeout_);
     dispatcher_.run(Envoy::Event::Dispatcher::RunType::RunUntilExit);
   }
 }
diff --git a/source/client/benchmark_client_impl.h b/source/client/benchmark_client_impl.h
@@ -123,6 +123,7 @@ class BenchmarkClientHttpImpl : public BenchmarkClient,
   void setMaxRequestsPerConnection(uint32_t max_requests_per_connection) {
     max_requests_per_connection_ = max_requests_per_connection;
   }
+  void setTimeout(std::chrono::seconds timeout) { timeout_ = timeout; }
 
   // BenchmarkClient
   void terminate() override;
@@ -161,7 +162,7 @@ class BenchmarkClientHttpImpl : public BenchmarkClient,
   Envoy::Stats::ScopeSharedPtr scope_;
   BenchmarkClientStatistic statistic_;
   const Envoy::Http::Protocol protocol_;
-  std::chrono::seconds timeout_{5s};
+  std::chrono::seconds timeout_{30s};
   uint32_t connection_limit_{1};
   uint32_t max_pending_requests_{1};
   uint32_t max_active_requests_{UINT32_MAX};
diff --git a/source/client/factories_impl.cc b/source/client/factories_impl.cc
@@ -60,6 +60,8 @@ BenchmarkClientPtr BenchmarkClientFactoryImpl::create(
   benchmark_client->setMaxPendingRequests(options_.maxPendingRequests());
   benchmark_client->setMaxActiveRequests(options_.maxActiveRequests());
   benchmark_client->setMaxRequestsPerConnection(options_.maxRequestsPerConnection());
+  benchmark_client->setTimeout(options_.timeout());
+
   return benchmark_client;
 }
 
diff --git a/source/client/process_impl.cc b/source/client/process_impl.cc
@@ -173,9 +173,7 @@ class NighthawkServerFactoryContext : public Envoy::Server::Configuration::Serve
     return Envoy::ProtobufMessage::getStrictValidationVisitor();
   };
 
-  Envoy::Stats::Scope& scope() override {
-    PANIC("NighthawkServerFactoryContext::scope not implemented");
-  };
+  Envoy::Stats::Scope& scope() override { return *server_scope_; };
 
   Envoy::Stats::Scope& serverScope() override { return *server_scope_; };
 
@@ -859,8 +857,7 @@ void ProcessImpl::maybeCreateTracingDriver(const envoy::config::trace::v3::Traci
             message.get());
     Envoy::Tracing::DriverPtr zipkin_driver =
         std::make_unique<Envoy::Extensions::Tracers::Zipkin::Driver>(
-            *zipkin_config, *cluster_manager_, scope_root_, tls_, *runtime_loader_.get(),
-            *local_info_, generator_, time_system_);
+            *zipkin_config, server_->serverFactoryContext());
     tracer_ = std::make_unique<Envoy::Tracing::TracerImpl>(std::move(zipkin_driver), *local_info_);
 #else
     ENVOY_LOG(error, "Not build with any tracing support");
diff --git a/source/client/stream_decoder.h b/source/client/stream_decoder.h
@@ -84,6 +84,7 @@ class StreamDecoder : public Envoy::Http::ResponseDecoder,
   void decodeTrailers(Envoy::Http::ResponseTrailerMapPtr&& trailers) override;
   void decodeMetadata(Envoy::Http::MetadataMapPtr&&) override { PANIC("not implemented"); }
   void dumpState(std::ostream&, int) const override { PANIC("not implemented"); }
+  Envoy::Http::ResponseDecoderHandlePtr createResponseDecoderHandle() override { return nullptr; }
 
   // Http::StreamCallbacks
   void onResetStream(Envoy::Http::StreamResetReason reason,
diff --git a/test/factories_test.cc b/test/factories_test.cc
@@ -43,6 +43,7 @@ TEST_F(FactoriesTest, CreateBenchmarkClient) {
   EXPECT_CALL(options_, maxRequestsPerConnection());
   EXPECT_CALL(options_, openLoop());
   EXPECT_CALL(options_, responseHeaderWithLatencyInput());
+  EXPECT_CALL(options_, timeout());
   auto cmd = std::make_unique<nighthawk::client::CommandLineOptions>();
   EXPECT_CALL(options_, toCommandLineOptions()).WillOnce(Return(ByMove(std::move(cmd))));
   StaticRequestSourceImpl request_generator(
diff --git a/tools/code_format/config.yaml b/tools/code_format/config.yaml
@@ -318,6 +318,7 @@ paths:
     - source/common/protobuf/utility.cc
     - source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.cc
     - source/extensions/http/cache/file_system_http_cache/cache_file_header_proto_util.cc
+    - source/extensions/http/cache_v2/file_system_http_cache/cache_file_header_proto_util.cc
     - test/common/grpc/codec_fuzz_test.cc
     - test/common/grpc/codec_test.cc
     - test/common/protobuf/utility_test.cc
@@ -326,7 +327,10 @@ paths:
     - test/extensions/filters/common/expr/context_test.cc
     - test/extensions/filters/http/common/fuzz/uber_filter.h
     - test/extensions/http/cache/file_system_http_cache/cache_file_header_proto_util_test.cc
+    - test/extensions/http/cache_v2/file_system_http_cache/cache_file_header_proto_util_test.cc
     - test/tools/router_check/router_check.cc
+    - source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/rc_connection_wrapper.cc
+    - test/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/rc_connection_wrapper_test.cc
 
   # Files in these paths can use std::regex
   std_regex:
@@ -392,7 +396,6 @@ re:
   codeowners_contrib: (/contrib/[^@]*\s+)(@.*)
   codeowners_extensions: .*(extensions[^@]*\s+)(@.*)
   comment: //|\*
-  designated_initializer: \{\s*\.\w+\s*\=
   # Check for punctuation in a terminal ref clause, e.g.
   # :ref:`panic mode. <arch_overview_load_balancing_panic_threshold>`
   dot_multi_space: \. +
diff --git a/tools/nighthawk_envoy_updater.py b/tools/nighthawk_envoy_updater.py
