From 0865d3a1ec82b7f55de60f02a668ab2b2b3e3427 Mon Sep 17 00:00:00 2001 From: Ryan Northey Date: Tue, 4 Apr 2023 21:47:56 +0000 Subject: [PATCH] repo: Release v1.23.7 Signed-off-by: Ryan Northey --- VERSION.txt | 2 +- changelogs/1.22.10.yaml | 28 ++++++++++++++++++++++++++++ changelogs/current.yaml | 14 +------------- docs/inventories/v1.22/objects.inv | Bin 122338 -> 122356 bytes docs/inventories/v1.23/objects.inv | Bin 137898 -> 137962 bytes docs/versions.yaml | 4 ++-- 6 files changed, 32 insertions(+), 16 deletions(-) create mode 100644 changelogs/1.22.10.yaml diff --git a/VERSION.txt b/VERSION.txt index f38c83099ef5..2d27ccba161d 100644 --- a/VERSION.txt +++ b/VERSION.txt @@ -1 +1 @@ -1.23.7-dev +1.23.7 diff --git a/changelogs/1.22.10.yaml b/changelogs/1.22.10.yaml new file mode 100644 index 000000000000..890888ef8553 --- /dev/null +++ b/changelogs/1.22.10.yaml @@ -0,0 +1,28 @@ +date: April 4, 2023 + +behavior_changes: +- area: http + change: | + validate upstream request header names and values. The new runtime flag ``envoy.reloadable_features.validate_upstream_headers`` can be used for revert this behavior. + +bug_fixes: +- area: grpc + change: | + when Envoy was configured to use ext_authz, ext_proc, tap, ratelimit filters, and grpc access log service and an http header with non-UTF-8 data was received, Envoy would generate an invalid protobuf message and send it to the configured service. The receiving service would typically generate an error when decoding the protobuf message. For ext_authz that was configured with ``failure_mode_allow: true``, the request would have been allowed in this case. For the other services, this could have resulted in other unforseen errors such as a lack of visibility into requests (eg request not logged). Envoy will now by default sanitize the values sent in gRPC service calls to be valid UTF-8, replacing data that is not valid UTF-8 with a '!' character. This behavioral change can be temporarily reverted by setting runtime guard ``envoy.reloadable_features.service_sanitize_non_utf8_strings`` to false. +- area: http + change: | + fixed a bug where ``x-envoy-original-path`` was not being sanitized when sent from untrusted users. This behavioral change can be temporarily reverted by setting ``envoy.reloadable_features.sanitize_original_path`` to false. +- area: http + change: | + stop forwarding ``:method`` value which is not a valid token defined in https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2. + Also, reject ``:method`` and ``:scheme`` headers with multiple values. +- area: http3 + change: | + reject pseudo headers violating RFC 9114. Specifically, pseudo-header fields with more than one value for the ``:method`` (non-``CONNECT``), + ``:scheme``, and ``:path``; or pseudo-header fields after regular header fields; or undefined pseudo-headers. +- area: lua + change: | + lua coroutine should not execute after local reply is sent. +- area: oauth + change: | + fixed a bug where the oauth2 filter would crash if it received a redirect URL without a state query param set. diff --git a/changelogs/current.yaml b/changelogs/current.yaml index 24d01b19305e..cd03b53fcfd4 100644 --- a/changelogs/current.yaml +++ b/changelogs/current.yaml @@ -1,16 +1,11 @@ -date: Pending +date: April 4, 2023 behavior_changes: -# *Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required* - area: http change: | Validate upstream request header names and values. The new runtime flag ``envoy.reloadable_features.validate_upstream_headers`` can be used for revert this behavior. -minor_behavior_changes: -# *Changes that may cause incompatibilities for some users, but should not for most* - bug_fixes: -# *Changes expected to improve the state of the world and are unlikely to have negative effects* - area: oauth2 change: | fixed a bug where the oauth2 filter would crash if it received a redirect URL without a state query param set. @@ -36,10 +31,3 @@ bug_fixes: - area: http change: | fixed a bug where ``x-envoy-original-path`` was not being sanitized when sent from untrusted users. This behavioral change can be temporarily reverted by setting ``envoy.reloadable_features.sanitize_original_path`` to false. - -removed_config_or_runtime: -# *Normally occurs at the end of the* :ref:`deprecation period ` - -new_features: - -deprecated: diff --git a/docs/inventories/v1.22/objects.inv b/docs/inventories/v1.22/objects.inv index 418d07e651447fd0800b39675c7c8eec4b2dc443..cc6a587fd5ef565653b6607d3fe7bcc68678e20e 100644 GIT binary patch delta 1816 zcmV+z2j}?Wy9e~U2arPoF))EdwL}5J)qmn9d-d*dzglPYw^?~pR*vOwz7(%-Uf;xE zm4rqG;a7L<Vs$$61TdE;qn$2#AGQB&mkL0&|5!f zg0<9KY45+E*3Vf{#9<2_wji*Du=R8=7E)PJ#eqv6xFo=3_Ua$=;|?D0GzMJq4}YR0 z4+6vua8<;S3m&;3$OUNE)oe!74!#t5Gk31#FQ`?FQ`L!zxKXT3YkDBz4 z`n8!#MB7`3Mo!B{QzH`*1bJS^_qkrZ*M@>3M zJ*0EgeCMc1=K%4<23+%9qb6Mg#IZeK^9|sR_~ttz&39xbYm+!?!J`%gwMc))Bfbfb zND~I}0oWCfT@mam_5F?bwmc$j8N|EquL$9ec-#@e9l=Lb&$UCSW4=|4NvjysnQL^U z81oHdOd7_xGjWYiC&qlc7=M#?G49Mz@ldFWdLeXA!ZI8^#^`JD%{@ldH*j~LivlOEn#OMJD;RjV3=dH?}b-iJn9 ze`wN!X8aB@Sl$Ukd@y4>>r-x$V(JCu*YRW-uU7G=Eq;dsko*dhEHI}yjl?_mBl3$B zvPQYZ2O7U`et|;PC%3p*&C1|@W|*WX<o9U(iX_1^^D}_dzt)xAdpJ|H^<-af8tv9lVtLC^87tLJR2&e=Fn~zlCMgV675^V zI%v#W&i;6_Xg{4~cI7v0Wwh<#IbR*rsl^<{kgW)H{QmH4*q<_#(CkG@?*?Q{ee-qs*zER=r08g4mV@Az0}6WVf0J;z zkji)a9N{{K;mJHo;vfUk<F+%pFGrTw@v+^Kn-?Pr?< zhw94uFojIJg>f(r*Aw$0>Em^ApsrL5r-9T&aEvbruPYtJh2$-XpjMP30zcfF4Gib) z9>iCVez=evrU3nz;WaNP{+Wi{5yqr4+tqT_F0!B1rR?3uAH90^v+aGGf2M_qVu~Xu zh~9;yHAzIbqB?;RP@=@pfvjPBp9W85HHVdqZFCeQJQUx<_;8ZbNmPNeWQb(g{cIn zzkGl9t9%v`USH~fH?zgzECo4Ke0P5@nzZB+{myXnBK>Gr&7xiRr+%r5RMj81;*mob z(M;Z(2fe`q=bzdO^yC)g4*!xFh<4^6^`Wa;(x{xobV|IvgN$RFe?P0g7k&=KRC6?N zPJr_s@b@T_5t*zj)3w%&`Va1L?^MIg8FPj4x1EZZ*DwBmYFz)myV@ofy z3qhnQlA9O!6StWvUJfW0v(}9h?mk$vMlm;y1zn{!AV9?jkob)=n~IGJP(cD6#5)ri zpaKQx#jat;<9UN%4i$g>_3vG@)AquFf&%=f`5SITCZGun6sL~lg^B^9tNMqo>i+|M GW%X9XVwBqe delta 1798 zcmV+h2l@E)y9eUC2arPnIe|sBMFGOqf7|TU&oWG)EWgdlo3e5&fAghyee?Pz2CF1A zDhR*2Yafs8=9B0eg#<3fUf_ZSE-Wwzzxp5=g~Y9HVz|7;1uG2y7v2J>83iR8~}R;F1R}32>Rc`p5jZgU36K0hj!Pe<;a= z0C59c6>;Q(M=l6*L7D_(bIBu@1X($srQAY%Igs7^+g<;1$?3logv2RS`s1qJ_LQp4k=qYbw*cIQ1E7FK7*_&tE z(@c!T6zWI(w^BtMV+9Zxz@TdhrEz+Oyh;PCp(u6^L z0CvS=R|LCCeSagqEsscB2J!CuD?+#<9(P1=NAMBVbL|l7m~Rzh(kjMu<{BL-#(cvV zlZG+wOkCsBi80?U#-v@0e>*eRNgTQ2kt>2+rM!hr# zW2h6pMNCMGn9ylp+};V_BqpRufcUE)+E05m!yLt-OCGu;&}G_-oA3={LK?(Gtz`HI zQS+!ZL9J6>+?0QDQ}W`bc776n22=jEP04GU+6fAWTk^Oi!7Wp99V;HUBDhKKY|6j0 zDS2np)OR-KQO5*zOuK|~QI(gY*a7>0;1(&bjrZc0#EUP*@wMH=VJjZCBCwTyZId`` z&BN9NwoZf{@vtKTJF*)_WgK|S1CI&t*!{o-p(i}_gg{Toz%z;LO$yN|k31#FQ#z#8 z5omsgfNT&{YIY(9;MnAZcd8Pfs&c8S7pDvjpz^*h;_8x~F5@4F!Sc=$;wu?{+u50N zXB1N}D8Jq&%WbvVK5g-P8Gz(hf@C2$#pxd2xgU{VOpvw2Ek4lree(+mvW~dLMP*h7 z_Z`DzLMf*UoYMq4PbQqRX!h;0-M3Dv&+bVPUBmpLjxFf_a*(z_CjDk4kKW7V;RAtO z3b?uWeizrWpCse9laKG|;n`4sCN+n4yO6w6l00bN8g@Wq-g5TGn??KSB(osDVJo9; z56}7PpiUR&D2A*;sN?sCXT#Ezp@e1`QX+r#TPmZKfqYa*J?^%LcDTJRM8s+>oLhZf z+qGO~^zv5^=YG+vA=w$S>{3m0?NE<7_|M95_^0)`ux%+AWNOak!qC4@n<` zivx9~VmJ+?5Q5`&NqAl9C@v&fNd&c`6cKpb-fUnvZ}%X+di2AE#~0oKDK}4jBAiz{$_k{20e{B}ubuX7kUYLC!zBQxXAn zkVixxF~^S@QbkEFg+WyI`3xFh({>;%xS+3SOjyW_AA`P;zGM%TBVU- z82~TvcL>ll1fuQ2o?riNCye_b=3C!Gm4I=lM;QZpnOz7XO_3bBz;n3GRB=GDn6+-4 zu=K&2HHx`WX)Nd}wFmdrIerpnab{Dor}x!i{tn`uIl-?E^wW!7!;Z)E2EiOE{`%|R oyJ)BFg#!fz_)qgU+=xsR6BsB?9mxw714LK#4_(#&2enDsA_l>ZP5=M^ diff --git a/docs/inventories/v1.23/objects.inv b/docs/inventories/v1.23/objects.inv index 5535eaecfb2b5353ae1c13e2ea5836481a6297a8..f688874e2c09969085593507231ac0fe48b278c6 100644 GIT binary patch delta 3090 zcmXYweLU0a|HrqPyKba$T68M3V`LZ~=`eF!opuNvI?f8mO@>2MZpPevBndfM4Q*~l z({Z!Z(H6ofQaHA?k=wNpj=8@-MDD)({W||$kN4g4^}b%$#jaMGs#c;}E14VmnPSb& z0&bkSbp~2}2G*his?+Dou|q`cP=)W~&0k`$q>=DFb|e7bhIwQ-7%`EVwMg0TLBRd7+S zY}LRn*`lPmfQSwJl0%orx|*(@J*B&4DcHF@~Yom_sj1w zF0vfvf_V#q+!Xit@DbLF3bl}LbZEMiDG&AU*c^S^x^;C5@7N9h_DT3s9de)WbL!%P&>$kKDkIk%{eQ^Z;#+@5Q_3$l5_(U>izG3C2Q zn=jAEVL;Q#i!qZP>QCflb@9P}atq*TBRr28H6znt*3kMlr_|3PnT6AUn(xqQy=*@x-At-G?0+A-fTe;rn+;jpY4B8A5#whLH1o)P5IsfKw0<{6mc_fbUn3606x{^I+?*V*D0o-zLl5;R=Ou#{-eT6VOzZ+Nj%Yv4(knu-Aw8 zo3!GFN(po{RG`K&!OJw>tV-aMku#2+EIoxq0Vf6h&>2>)#+K;}9VL`^L8h{QGZSG# zVi8lAB+C*;C%{jX@exf{+J|}pK8p#DJCKBT#8wC9UWiwH0fr;zVcX8n{gUgfxHJC{ zifNFElu%m{h98TV!9Z}1*owehL%i}D3KDOBf)khSJb8TqLHJxkmK@Yf3AIOQg1MCAx0K*a^dR7fgQj$RU&QqfQmtO;O` z$yz`up&SkER?9QQb2BIY-&r?S6rL-XA`}NgI{?;8Ja^A5p?DnH5y6tT=4Ot`K2k(1 zvb=wv?nT*d@yryQ@+W7+%oHQQ^(({OF^ z5)lirkhOxaWf8_7M9lFabNm!Hh`@9Q4F!>q?JSUDltk3swCjGgzj614UrxA&ZZHD6 zU0{W9TlD1+ki=N0`IJHX^#`_Pf_G3Ki4gJ`oBd6dB@om{8e~p+D-*(1QKVjVk$X|5 zT&6&e@=SuqAAnewFpv4PF4(|709$0+j6QUtR+7fJSuNx$A81mViETTQv@B zT~j&r4EPb~3~Vj^KRem7azjkU6FktmsNKYj{Y%a@^n_}rlwtA!{ps9hj2cS=4@A$) zQezEru9fk$nPG;B&pz!{r~bofemVDp`h}SU95iC2t)RncKs=BVmOck>xJh`%N8%ce zX`DJ_JZaRURyG|;^30tCz27eO z*r}5gY62?NXX8$KZy66{)zGh{oVwWdd1^;EtCc=*ueU6-4yR z(;Z7i1_*^q);-3BVB0~4weQ)3!)xv!TII+fa$qz1ys>t(N(e8XqknSQRQ=dl!o*RS zz1J93qW8s1xABFshrw#F+faDq^YJM0H+NVD_QNq5EncrzFj;a-_aP#xzrtY&QEpQ> zAFz`WXBoXAS{l5wAyNFfS|{w=5dJ%uj=CMBSpTi_@!NJ8U|5Dt7IJJQtnQ!ntdi#Y zl354uYMrN^MqFQ2cCe92Vq?PJ?4Qr%(JZi4-HT>w#O-0y#Vhq3vARK%q&L6DX&m?S zexE0%;|ij7uQ7h)D?4bkp%3^<%&GUC-K_C^pe>~?KF!fMyy@yCj2MfeIY#0AOrtf+ zeh%mC@P>N9cL|*s-swbfx7WM%8ZRP-^F?>VJEQMhw8uNgJ-Ni7)oI1v?uMtA^XvUj zu7q*5+}D07_efcB$f}J<#33!e`@G_iN;XYIzrpRqEXG35H|H(U8?#m6bz$te;h;M$ zRVp78IOz^G+W22b!J&Vvq&+Oe(#k%i3NS~a~%`OQU-5tWQT9JU5&{n*SotNPlxVySc&-kp29_Y+t3Rl6Ekh) zsv^lgs}4<66E5EG+LKCXkYmyB5_~9s^hEqTPvIz7cfEuH>=N9eyp(!%=Zh|-z1~~) zX$YA=20r~ISKNmT9|UQHPV+P)owzQg{#g0j2AOqqJHj`fs(a<67xHJHh6GcO-S8F< zzj^TTO@m$kZ;lRb>+ruD9Dic`r9`b8rS&b8dA{$ctb|R= zp{PIhWb>DR{VkVs^r*J>!MMya=j3P0yx!aTiD2;rzq-wF43>`H-$z>uxIImy&$;i~ zG1fXL4I8`_bvGii{MdHs*6^aS`-InpGG*R}I=)kWL-zm1ld@ zQh3B?L7!oN+b#55Z~xWOn{|4%{e*a~#R&w9`78w{`K>c}a11Z&>>FP^p&wHYYD&16!2&(%m0d}OkU4^UtpL+&w6MOx#>RS-?6yP9=Xhkz9byRy(fLHJzX}` ze1J`D1R6-AzHs38B|zQpnwBv=Tkjk;JymgS<4Rrou5Hzw{+t+xwygxOi0h3DVqWwi z)kUi03UXoaNUP&M2oE&nc=9hYJSY~(`kKbr2 RX6@Um*|)VL7ugD4`X9)&^vVDL delta 3026 zcmV;@3oZ2OwFs)U2#`JqH7z+aH(_NlfkuT!0kuW~#SVWVn3?z+1CiOxTRjVDi@()6 zqb5Bwv!~!ott2N@h=~PZ&7NiykSP^pYJpg0JCkz?3c2=Y7K*+6KBb_XP*F}SloM)m zRl=uKlv4}k)NZaJ7!;0Gm&l}>>ddbw+D=tA#dRiTY7g?kdM0YPBNnS}kx8>W@hgh5 zRM`|u+&O>ltrB>M;$}$fiHS^_=&4^(l&H$4h~l=JZp9&{xEvnq*F`4H^vtg)%2Z`j zOwY^|U2KL-UOIW=f@|!TO$Ry)sK*7p z*oRAG(zWo?uP9mzDx2c@(q5l92@u5Kxmf&n$NET>7JlK|+1Y*NiETWS*QGypp# z8(Dud%N{xi+qZ~z!A?aL(+s7VWg$(%odj?vbkk{O*-Vpgrvcn)f-yC-tf)!AvjFgn zXkN`MyJ`~XNdWYOW^m0cOKTG5X#n$-XoAfw+iMc&Spf8mW|Yk=Yittcc>wb~#Y~%7 z7S%!IzD>0Yc_v<3nyEFjY^+JRlK}37XncRoEURl0=rjO2rI}+h%MP1_ISXLUhz8os zvdkudo&-QoXeQgtvehPGo(3>aQ;fKoWxY*8J_{h9rI>Xy%buHrd>%kPryF`R%fg$4 z`!az0l5YCVEGz9GZr@JZg?l1;i@5nVv+TA>n3DkJglN#sEK6<@=rjO2rI~m$%eH@; zggFaf&WJ|e%(C_-fu00FPiSV~%(DL`VV(vsPg4xTnPm}9LOu&1pV3XlnPnqR!aWb* zo>Ps-nPul4MD1I8yHHQX+j>fRTTdx(Yv1Wm3!u(u zCg;quH78-71Tas?M(E747Z1YrEyi82FGY)@7?Lx~f}Dgp37}4>rsd4CDJP*$1E^D~ zu{pD>%t@%T0P2ipe$Fhra}wrB0P}=wkj^YibQ0`Y0QM}wM4egI zX6DSYFDHRc0-zJJ;W@J`&Pji;vjFTY!4#cYHs~balK}7u)i|A5R_P?v(*Wuz&0L)s z`|=QE&%)dRD7GO8cIV785f1|Pjl^A$VoQr=JI*YlaT4q#06R&rCTErzISF_g0G=k; zmov+-oCG`z0MDov=gcxSC!wAMP)}$!=*%)cCt;ojFi(kA>C7@mCxL&S1whY;cIwPB zP$z+&2SCq>mg~$iG7p0G&CFe(Vn3K@ealQ2&Lm?uOlc4nEclR!@cpr=H;c4is0lR(b`pl1n|?#wbu4+8hi z(p|vv8%wcPXO@{d33Y!GK%LO+*O_IwPQsi9FsDR|c4nEflR#$y&>7Ljoms~1B+!!p z=n2v4omuAYB+%0U=qcF_o>>O)B-pb6>{)_kJhM#VNx`{vB+y9!bV9a?XO=NM33eKQozj1;W=dS;o>lWn5NY0E2 zIRS6t$D0sM%b9<%1rGuCtic_CVl|j#BhHLbcL=d(*6lzPD|bX=Z)VKA378W<=7eVc z&F&_2>ue|39ZVEme!bZp$w=6E+;*v+INfkF;~tx2YVFnjt=nxjGv2I8md0NF6StRZ zW?VLt>>|DTr*2oy%=o7z*-?4*&)j}%nemcIvitDrKXHG1&t%3kAZah&tN+yPF_0N= zZlqmOul_T)mp5iyaFO=Ry!y}GuDO_T&P3YJ@ali*cG|>@QytRUwpagmZf85}j`jBAzUbz+i+Tys zT3A!wlufyrm!WtwN<#k-5b7$2+(yywGWo@Qxmtg*Pn-IFqaz2e%dS`yT@ecHQY`KY zu4i!^ke38_h8#2KIKdj=cYZJXC*0FT;edubW(|>k*T2xHz?Xll@ozwr=i=W>GHk%ckyX&bRH#Vv*H1+4oYsZnC>- zUSi^0%EIrj$!Udfc@Nl;DOd40p8&gi)&>KKwJ83-0opp9Nz|Jc;Tw(ma3`(lt zf@m0gt=epNT}y);3G~ViAHM7z-VJ}kR$CgH$|peHU6RTqf6@?onFY+hHq}j4F0!8` z)~m~RLA-`P<&uVGWffQ-Ac0h>rd*bvi6|zkM1cenO50&J6xZ{bf;4Ie*u9Nck?c+dz{mBN&#&aC@bclcy~4bG#=1%ycU1MG-7W4 zofHESo|5zYISReH_~-F2{7+W!0g3AVGJwS45)90B@M%zGg;D3joz4-*y+61YG1?&* zX*qAo&M>eP{LOM>Ou>F)(>y4 zK4M*-nnUWU_yDTh8G-(q{L! zMVFb#^SlcAJF{yx9!4l^? zJ)4S&peq9E_B3AUD7rQxsIGmpPps?q>jZNU{P^*GU)yeTU`Jsq_?P|-1-WVJwXdVt U^>Q8v3@ZB2Z~M^yKU?Ver{