auto-merge envoyproxy/envoy[release/v1.32] into envoyproxy/envoy-openssl[release/v1.32]

* upstream/release/v1.32:
  ci/cache: Shift cache create action to do_ci.sh (#39845)
  Commit Message: Add support for building envoy against newer releases of BoringCrypto FIPS via override_repository
  coverage: Disable large tests
  Don't build WASM for fuzz-coverage tests (#39296)
  ci/coverage: Fix path
  repo: Dev v1.32.7

Signed-off-by: tedjpoole <[email protected]>

Author: tedjpoole

.bazelrc

@@ -247,6 +247,11 @@ build:test-coverage --test_tag_filters=-nocoverage,-fuzz_target
 build:fuzz-coverage --config=plain-fuzzer
 build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
 build:fuzz-coverage --test_tag_filters=-nocoverage
+build:fuzz-coverage --define=dynamic_link_tests=true
+# Existing fuzz tests don't need a full WASM runtime and in generally we don't really want to
+# fuzz dependencies anyways. On the other hand, disabling WASM reduces the build time and
+# resources required to build and run the tests.
+build:fuzz-coverage --define=wasm=disabled
 
 build:cache-local --remote_cache=grpc://localhost:9092
 

VERSION.txt

@@ -1 +1 @@
-1.32.6
+1.32.7-dev

changelogs/1.32.6.yaml

@@ -0,0 +1,8 @@
+date: May 7, 2025
+
+bug_fixes:
+- area: url_template
+  change: |
+    Included the asterisk ``*`` in the match pattern when using the * or ** operators in the URL template.
+    This behavioral change can be temporarily reverted by setting runtime guard
+    ``envoy.reloadable_features.uri_template_match_on_asterisk`` to ``false``.

changelogs/current.yaml

@@ -1,8 +1,17 @@
-date: May 7, 2025
+date: Pending
+
+behavior_changes:
+# *Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required*
+
+minor_behavior_changes:
+# *Changes that may cause incompatibilities for some users, but should not for most*
 
 bug_fixes:
-- area: url_template
-  change: |
-    Included the asterisk ``*`` in the match pattern when using the * or ** operators in the URL template.
-    This behavioral change can be temporarily reverted by setting runtime guard
-    ``envoy.reloadable_features.uri_template_match_on_asterisk`` to ``false``.
+# *Changes expected to improve the state of the world and are unlikely to have negative effects*
+
+removed_config_or_runtime:
+# *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
+
+new_features:
+
+deprecated:

ci/do_ci.sh

@@ -379,6 +379,27 @@ case $CI_TARGET in
         # fi
         ;;
 
+    cache-create)
+        if [[ -z "${ENVOY_CACHE_TARGETS}" ]]; then
+            echo "ENVOY_CACHE_TARGETS not set" >&2
+            exit 1
+        fi
+        if [[ -z "${ENVOY_CACHE_ROOT}" ]]; then
+            echo "ENVOY_CACHE_ROOT not set" >&2
+            exit 1
+        fi
+        BAZEL_BUILD_OPTIONS=()
+        setup_clang_toolchain
+        echo "Fetching cache: ${ENVOY_CACHE_TARGETS}"
+        bazel --output_user_root="${ENVOY_CACHE_ROOT}" \
+              --output_base="${ENVOY_CACHE_ROOT}/base" \
+              aquery "deps(${ENVOY_CACHE_TARGETS})" \
+              --repository_cache="${ENVOY_REPOSITORY_CACHE}" \
+              "${BAZEL_BUILD_OPTIONS[@]}" \
+              "${BAZEL_BUILD_EXTRA_OPTIONS[@]}" \
+              > /dev/null
+        ;;
+
     format-api|check_and_fix_proto_format)
         setup_clang_toolchain
         echo "Check and fix proto format ..."

source/common/tls/context_impl.cc

@@ -571,10 +571,6 @@ void ContextImpl::logHandshake(SSL* ssl) const {
     stats_.no_certificate_.inc();
   }
 
-#if defined(BORINGSSL_FIPS) && BORINGSSL_API_VERSION >= 18
-#error "Delete preprocessor check below; no longer needed"
-#endif
-
 #if BORINGSSL_API_VERSION >= 18
   // Increment the `was_key_usage_invalid_` stats to indicate the given cert would have triggered an
   // error but is allowed because the enforcement that rsa key usage and tls usage need to be

test/config_test/BUILD

@@ -41,6 +41,7 @@ envoy_cc_test(
         "GODEBUG": "cgocheck=0",
     },
     rbe_pool = "6gig",
+    tags = ["nocoverage"],
     deps = [
         ":example_configs_test_lib",
     ],

test/exe/BUILD

@@ -125,6 +125,8 @@ envoy_cc_test(
     size = "large",
     srcs = ["extra_extensions_test.cc"],
     rbe_pool = "6gig",
+    # output is too large for workers
+    tags = ["nocoverage"],
     deps = [
         "//test/test_common:environment_lib",
     ] + select({
@@ -154,6 +156,7 @@ envoy_cc_test(
         "//source/extensions:extensions_metadata.yaml",
     ],
     rbe_pool = "6gig",
+    tags = ["nocoverage"],
     deps = [
         "//test/test_common:environment_lib",
     ] + select({

test/integration/BUILD

@@ -419,7 +419,10 @@ envoy_sh_test(
         "//test/config/integration:server_config_files",
     ],
     rbe_pool = "6gig",
-    tags = ["skip_on_windows"],
+    tags = [
+        "nocoverage",
+        "skip_on_windows",
+    ],
 )
 
 envoy_cc_test(

test/per_file_coverage.sh

@@ -15,32 +15,38 @@ declare -a KNOWN_LOW_COVERAGE=(
 "source/common/memory:74.5" # tcmalloc code path is not enabled in coverage build, only gperf tcmalloc, see PR#32589
 "source/common/network:94.4" # Flaky, `activateFileEvents`, `startSecureTransport` and `ioctl`, listener_socket do not always report LCOV
 "source/common/network/dns_resolver:91.4"  # A few lines of MacOS code not tested in linux scripts. Tested in MacOS scripts
-"source/common/quic:93.6"
+"source/common/quic:93.1"
 "source/common/secret:95.4"
 "source/common/signal:87.2" # Death tests don't report LCOV
 "source/common/thread:0.0" # Death tests don't report LCOV
 "source/common/tls:95.3"
 "source/common/tls/cert_validator:94.4"
 "source/common/tls/private_key:88.9"
 "source/common/watchdog:58.6" # Death tests don't report LCOV
-"source/exe:94.2" # increased by #32346, need coverage for terminate_handler and hot restart failures
+"source/exe:87.3" # increased by #32346, need coverage for terminate_handler and hot restart failures
+"source/extensions/common/aws:96.4"
 "source/extensions/common/proxy_protocol:93.8" # Adjusted for security patch
 "source/extensions/common/tap:94.6"
 "source/extensions/common/wasm:95.0" # flaky: be careful adjusting
 "source/extensions/common/wasm/ext:92.0"
+"source/extensions/filters/http/alternate_protocols_cache:95.3"
 "source/extensions/filters/common/fault:94.5"
 "source/extensions/filters/common/rbac:90.8"
 "source/extensions/filters/http/cache:95.4"
+"source/extensions/filters/http/csrf:96.5"
 "source/extensions/filters/http/grpc_json_transcoder:94.2" # TODO(#28232)
 "source/extensions/filters/http/ip_tagging:88.2"
 "source/extensions/filters/http/kill_request:91.7" # Death tests don't report LCOV
 "source/extensions/filters/listener/original_src:92.1"
 "source/extensions/filters/network/mongo_proxy:96.1"
 "source/extensions/filters/network/sni_cluster:88.9"
+"source/extensions/matching/actions:87.0"
+"source/extensions/matching/actions/format_string:87.0"
 "source/extensions/rate_limit_descriptors:95.0"
 "source/extensions/rate_limit_descriptors/expr:95.0"
 "source/extensions/stat_sinks/graphite_statsd:82.8" # Death tests don't report LCOV
 "source/extensions/stat_sinks/statsd:85.2" # Death tests don't report LCOV
+"source/extensions/stat_sinks/wasm:88.0"
 "source/extensions/tracers/opencensus:94.0"
 "source/extensions/tracers/zipkin:95.8"
 "source/extensions/transport_sockets:97.4"

test/run_envoy_bazel_coverage.sh

@@ -113,13 +113,13 @@ else
     cp bazel-out/_coverage/_coverage_report.dat "${COVERAGE_DATA}"
 fi
 
-COVERAGE_VALUE="$(genhtml --prefix "${PWD}" --output "${COVERAGE_DIR}" "${COVERAGE_DATA}" | tee /dev/stderr | grep lines... | cut -d ' ' -f 4)"
+COVERAGE_VALUE="$(genhtml --prefix "${PWD}" --output "${COVERAGE_DIR}/html" "${COVERAGE_DATA}" | tee /dev/stderr | grep lines... | cut -d ' ' -f 4)"
 COVERAGE_VALUE=${COVERAGE_VALUE%?}
 
 echo "Compressing coveraged data"
 if [[ "${FUZZ_COVERAGE}" == "true" ]]; then
     if [[ -n "${ENVOY_FUZZ_COVERAGE_ARTIFACT}" ]]; then
-        tar cf - -C "${COVERAGE_DIR}" --transform 's/^\./fuzz_coverage/' . \
+        tar cf - -C "${COVERAGE_DIR}/html" --transform 's/^\./fuzz_coverage/' . \
             | bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/zstd -- \
                     - -T0 -o "${ENVOY_FUZZ_COVERAGE_ARTIFACT}"
     fi
@@ -128,7 +128,7 @@ elif [[ -n "${ENVOY_COVERAGE_ARTIFACT}" ]]; then
         rm "${ENVOY_COVERAGE_ARTIFACT}"
     fi
 
-     tar cf - -C "${COVERAGE_DIR}" --transform 's/^\./coverage/' . \
+     tar cf - -C "${COVERAGE_DIR}/html" --transform 's/^\./coverage/' . \
          | bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/zstd -- \
                  - -T0 -o "${ENVOY_COVERAGE_ARTIFACT}"
 fi
@@ -168,4 +168,4 @@ if [[ -e ./test/per_file_coverage.sh ]]; then
 else
     echo "No per-file-coverage file found"
 fi
-echo "HTML coverage report is in ${COVERAGE_DIR}/index.html"
+echo "HTML coverage report is in ${COVERAGE_DIR}/html/index.html"

test/server/BUILD

@@ -320,7 +320,6 @@ envoy_cc_fuzz_test(
     size = "large",
     srcs = ["server_fuzz_test.cc"],
     corpus = "server_corpus",
-    rbe_pool = "6gig",
     deps = [
         "//source/common/thread_local:thread_local_lib",
         "//source/server:server_lib",

test/server/config_validation/BUILD

@@ -93,7 +93,6 @@ envoy_cc_fuzz_test(
     size = "large",
     srcs = ["config_fuzz_test.cc"],
     corpus = "//test/server:server_fuzz_test_corpus",
-    rbe_pool = "6gig",
     deps = [
         "//source/common/common:thread_lib",
         "//source/server/config_validation:server_lib",