diff --git a/go.mod b/go.mod index 29bb0036..60c55c67 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/mozilla-services/stubattribution go 1.26.0 require ( - cloud.google.com/go/storage v1.63.0 + cloud.google.com/go/storage v1.63.1 github.com/getsentry/sentry-go v0.47.0 github.com/getsentry/sentry-go/logrus v0.47.0 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da @@ -27,7 +27,7 @@ require ( cloud.google.com/go/compute/metadata v0.9.0 // indirect cloud.google.com/go/iam v1.11.0 // indirect cloud.google.com/go/monitoring v1.29.0 // indirect - github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect + github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect @@ -39,14 +39,14 @@ require ( github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/google/s2a-go v0.1.9 // indirect - github.com/googleapis/enterprise-certificate-proxy v0.3.16 // indirect - github.com/googleapis/gax-go/v2 v2.22.0 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.17 // indirect + github.com/googleapis/gax-go/v2 v2.23.0 // indirect github.com/oremj/gostatsd v0.0.0-20190107234615-91b6458719ae // indirect github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect go.mozilla.org/mozlog v0.0.0-20170222151521-4bb13139d403 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/contrib/detectors/gcp v1.42.0 // indirect + go.opentelemetry.io/contrib/detectors/gcp v1.43.0 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect go.opentelemetry.io/otel v1.44.0 // indirect @@ -61,10 +61,10 @@ require ( golang.org/x/sys v0.46.0 // indirect golang.org/x/text v0.38.0 // indirect golang.org/x/time v0.15.0 // indirect - google.golang.org/api v0.285.0 // indirect + google.golang.org/api v0.287.1 // indirect google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260615183401-62b3387ff324 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260615183401-62b3387ff324 // indirect - google.golang.org/grpc v1.81.1 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect + google.golang.org/grpc v1.82.0 // indirect google.golang.org/protobuf v1.36.11 // indirect ) diff --git a/go.sum b/go.sum index df1f07fc..83dc2891 100644 --- a/go.sum +++ b/go.sum @@ -12,16 +12,16 @@ cloud.google.com/go/iam v1.11.0 h1:KieQ9Pb+LLPak1O3Rv3GgCxhnmkYf7Xyh0P5HfF1jFM= cloud.google.com/go/iam v1.11.0/go.mod h1:KP+nKGugNJW4LcLx1uEZcq1ok5sQHFaQehQNl4QDgV4= cloud.google.com/go/logging v1.18.0 h1:KhzZq+1cSkPH9YUaKLLhLtQxIHitVayBmk0sGfoM9+k= cloud.google.com/go/logging v1.18.0/go.mod h1:ZGKnpBaURITh+g/uom2VhbiFoFWvejcrHPDhxFtU/gI= -cloud.google.com/go/longrunning v1.0.0 h1:lwzWEYD8+NkYV7dhexOz6kmlvajZA70+bW/xMhRVVdY= -cloud.google.com/go/longrunning v1.0.0/go.mod h1:8nqFBPOO1U/XkhWl0I19AMZEphrHi73VNABIpKYaTwM= +cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM= +cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0= cloud.google.com/go/monitoring v1.29.0 h1:AHhDsFaSax1/4k+qlIDX/SDGe6hggnfXJ9dkgD9qBPY= cloud.google.com/go/monitoring v1.29.0/go.mod h1:72NOVjJXHY/HBfoLT0+qlCZBT059+9VXLeAnL2PeeVM= -cloud.google.com/go/storage v1.63.0 h1:hvXF2xfg9I32bjujggxgkEZn/Ej6sJ9pieFgeueBLrQ= -cloud.google.com/go/storage v1.63.0/go.mod h1:tirWVptrFNo5GEX2DQ47JooF7yaweJdAJ1hYAVMvKzE= +cloud.google.com/go/storage v1.63.1 h1:CYXILV9G4CH0C18IQ9+V0h4XiqD2LhKnMLO0o7uJWNs= +cloud.google.com/go/storage v1.63.1/go.mod h1:lWyAtwvDZHdL3k68WVKbESP6bmWaV23ZJJ/JEVw/ZaQ= cloud.google.com/go/trace v1.16.0 h1:GmQovzFc5F0CNfl0VLgL64aoTtu7xsM0YajW2GlG9+E= cloud.google.com/go/trace v1.16.0/go.mod h1:r+bdAn16dKLSV1G2D5v3e58IlQlizfxWrUfjx7kM7X0= -github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 h1:DHa2U07rk8syqvCge0QIGMCE1WxGj9njT44GH7zNJLQ= -github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0= +github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 h1:rIkQfkCOVKc1OiRCNcSDD8ml5RJlZbH/Xsq7lbpynwc= +github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0/go.mod h1:RD2SsorTmYhF6HkTmDw7KmPYQk8OBYwTkuasChwv7R4= github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 h1:jLdiS1vO+XJFyDSWRHBx56r4s/NNtcl5J6KyCcWUX/w= github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0/go.mod h1:8lmpHY+1VRoteiOwyrQMDt1YGXOrFKCz+1wJW7n3ODY= github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.57.0 h1:cSjUzZ7KU8hicTgzaSv9NmSyM9fTVK3y5lsBUl3wOis= @@ -69,10 +69,10 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/enterprise-certificate-proxy v0.3.16 h1:F/VPrx0YPBdksZJQdCAp0WUsqnNmZpUZszzfYt0M5Dw= -github.com/googleapis/enterprise-certificate-proxy v0.3.16/go.mod h1:9Yb0eAkH/Xqhvv3zbeKf/+wMJqCeocWc6KIhDvEAuYE= -github.com/googleapis/gax-go/v2 v2.22.0 h1:PjIWBpgGIVKGoCXuiCoP64altEJCj3/Ei+kSU5vlZD4= -github.com/googleapis/gax-go/v2 v2.22.0/go.mod h1:irWBbALSr0Sk3qlqb9SyJ1h68WjgeFuiOzI4Rqw5+aY= +github.com/googleapis/enterprise-certificate-proxy v0.3.17 h1:73NfMHdiqo9JFU9+7a5ExpVa10/R29pXfZIaW559nrg= +github.com/googleapis/enterprise-certificate-proxy v0.3.17/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k= +github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE= +github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= @@ -104,8 +104,8 @@ go.mozilla.org/mozlogrus v1.0.0 h1:8FWASFDozt1q1B+j6EoSBt62YN4k7nMWFLb3VyawXzA= go.mozilla.org/mozlogrus v1.0.0/go.mod h1:bg4v22liQ+tLlQ6nI56e5C7Xe8AqEU4xDdEpWoCzQ6M= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/detectors/gcp v1.42.0 h1:kpt2PEJuOuqYkPcktfJqWWDjTEd/FNgrxcniL7kQrXQ= -go.opentelemetry.io/contrib/detectors/gcp v1.42.0/go.mod h1:W9zQ439utxymRrXsUOzZbFX4JhLxXU4+ZnCt8GG7yA8= +go.opentelemetry.io/contrib/detectors/gcp v1.43.0 h1:62yY3dT7/ShwOxzA0RsKRgshBmfElKI4d/Myu2OxDFU= +go.opentelemetry.io/contrib/detectors/gcp v1.43.0/go.mod h1:RyaZMFY7yi1kAs45S6mbFGz8O8rqB0dTY14uzvG4LCs= go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 h1:0Qx7VGBacMm9ZENQ7TnNObTYI4ShC+lHI16seduaxZo= go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o= @@ -144,16 +144,16 @@ golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.285.0 h1:B7eHHoKGAX/LrPkQvhQqnGwjgWxofbdGwCTQvpm8FkM= -google.golang.org/api v0.285.0/go.mod h1:NlOlUIr8MPoIhT9Bb/oUnRuHbJOLwxb6JSYJM8Yz+jQ= +google.golang.org/api v0.287.1 h1:LiyJx32VU3cwQfLchn/513qKhc25hq0pEANYJoWNnnI= +google.golang.org/api v0.287.1/go.mod h1:lM2kYRzYUCBY91P9h6VF1PYmvhxii3O5hji37qRvIcY= google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 h1:YJjbgu+dkp5kUJLfpMyCLfBIWZb/FcJyuLeo1gVBOuo= google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94/go.mod h1:RRHjglSYABVCWpQ7USCpdfhcd9t4PkajvVwyynZizTc= -google.golang.org/genproto/googleapis/api v0.0.0-20260615183401-62b3387ff324 h1:g0RAkxK/smSu/iRwC/KIX1mwUoVJtk2OjbgaeS4DmUM= -google.golang.org/genproto/googleapis/api v0.0.0-20260615183401-62b3387ff324/go.mod h1:Z4WJ5pJOYWFWcHEQUelD5QaZDknIQkpIL/+fyJOT9+A= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260615183401-62b3387ff324 h1:9HZDLIdYBJXAnaFOr9WHrKVycfpY+75s9HGadC0305A= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260615183401-62b3387ff324/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ= -google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I= +google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU= +google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU= +google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/vendor/cloud.google.com/go/storage/CHANGES.md b/vendor/cloud.google.com/go/storage/CHANGES.md index a2f4f6de..b9000d87 100644 --- a/vendor/cloud.google.com/go/storage/CHANGES.md +++ b/vendor/cloud.google.com/go/storage/CHANGES.md @@ -1,6 +1,18 @@ # Changes +## [1.63.1](https://github.com/googleapis/google-cloud-go/compare/storage/v1.63.0...storage/v1.63.1) (2026-07-13) + + +### Features + +* **o11y:** Regenerate clients for LRO tracing ([#20107](https://github.com/googleapis/google-cloud-go/issues/20107)) ([779074e](https://github.com/googleapis/google-cloud-go/commit/779074edd267a26520bae459307660953129eb07)) + + +### Bug Fixes + +* **storage:** Minor documentation fix ([#20139](https://github.com/googleapis/google-cloud-go/issues/20139)) ([37f1745](https://github.com/googleapis/google-cloud-go/commit/37f17453d73ad7abbc424f51b51ff82f8004c5b2)) + ## [1.63.0](https://github.com/googleapis/google-cloud-go/compare/storage/v1.62.2...storage/v1.63.0) (2026-06-25) diff --git a/vendor/cloud.google.com/go/storage/doc.go b/vendor/cloud.google.com/go/storage/doc.go index 5a232c1e..c905741b 100644 --- a/vendor/cloud.google.com/go/storage/doc.go +++ b/vendor/cloud.google.com/go/storage/doc.go @@ -429,8 +429,8 @@ For gRPC clients, read checksumming is also performed for partial reads (range r by validating the checksum of each individual data chunk returned by the server. Automatic read checksumming can be disabled using the [WithDisableReaderChecksum] option -for a normal range reader, or the [WithDisableMRDReadChecksum] option for the multi-range -downloader. +for a normal reader (both gRPC and JSON), or the [WithDisableMRDReadChecksum] option +for the multi-range downloader (gRPC only). # Parallel Uploads diff --git a/vendor/cloud.google.com/go/storage/experimental/experimental.go b/vendor/cloud.google.com/go/storage/experimental/experimental.go index ed09f2dd..dbad7b63 100644 --- a/vendor/cloud.google.com/go/storage/experimental/experimental.go +++ b/vendor/cloud.google.com/go/storage/experimental/experimental.go @@ -115,3 +115,10 @@ func WithZonalBucketAPIs() option.ClientOption { func WithDirectConnectivityEnforced() option.ClientOption { return internal.WithDirectConnectivityEnforced.(func() option.ClientOption)() } + +// WithOtelMetrics provides an [option.ClientOption] that may be passed to +// [cloud.google.com/go/storage.NewClient] or [cloud.google.com/go/storage.NewGRPCClient]. +// It enables client-side OpenTelemetry metrics. +func WithOtelMetrics() option.ClientOption { + return internal.WithOtelMetrics.(func() option.ClientOption)() +} diff --git a/vendor/cloud.google.com/go/storage/grpc_client.go b/vendor/cloud.google.com/go/storage/grpc_client.go index fe087f0b..fb2eedc1 100644 --- a/vendor/cloud.google.com/go/storage/grpc_client.go +++ b/vendor/cloud.google.com/go/storage/grpc_client.go @@ -120,10 +120,12 @@ func defaultGRPCOptions() []option.ClientOption { // grpcStorageClient is the gRPC API implementation of the transport-agnostic // storageClient interface. type grpcStorageClient struct { - raw *gapic.Client - settings *settings - config *storageConfig - dpDiag string + raw *gapic.Client + settings *settings + config *storageConfig + dpDiag string + metrics *clientMetrics + metricsCleanup func() // configFeatureAttributes tracks client-level features that are enabled for this // client instance. @@ -152,7 +154,7 @@ func enableClientMetrics(ctx context.Context, s *settings, config storageConfig) // newGRPCStorageClient initializes a new storageClient that uses the gRPC // Storage API. -func newGRPCStorageClient(ctx context.Context, opts ...storageOption) (*grpcStorageClient, error) { +func newGRPCStorageClient(ctx context.Context, opts ...storageOption) (client *grpcStorageClient, err error) { s := initSettings(opts...) s.clientOption = append(defaultGRPCOptions(), s.clientOption...) // Disable all gax-level retries in favor of retry logic in the veneer client. @@ -172,9 +174,42 @@ func newGRPCStorageClient(ctx context.Context, opts ...storageOption) (*grpcStor log.Printf("Failed to enable client metrics: %v", err) } } + + var clientMetrics *clientMetrics + var metricsCleanup func() + if isOtelMetricsEnabled(&config) { + var project string + c, err := transport.Creds(ctx, s.clientOption...) + if err == nil { + project = c.ProjectID + } + if cm, cleanup, err := initMetrics(ctx, project, &config); err == nil { + clientMetrics = cm + metricsCleanup = cleanup + + unaryInt, streamInt := metricsInterceptors(cm) + s.clientOption = append(s.clientOption, + option.WithGRPCDialOption(grpc.WithChainUnaryInterceptor(unaryInt)), + option.WithGRPCDialOption(grpc.WithChainStreamInterceptor(streamInt)), + ) + } else { + log.Printf("Failed to enable metrics: %v", err) + } + } + + if metricsCleanup != nil { + defer func() { + if err != nil { + metricsCleanup() + } + }() + } + c := &grpcStorageClient{ - settings: s, - config: &config, + settings: s, + config: &config, + metrics: clientMetrics, + metricsCleanup: metricsCleanup, } // Add routing interceptors to inject headers. ui, si := c.routingInterceptors() @@ -275,6 +310,9 @@ func (c *grpcStorageClient) Close() error { if c.settings.metricsContext != nil { c.settings.metricsContext.close() } + if c.metricsCleanup != nil { + c.metricsCleanup() + } return c.raw.Close() } @@ -582,7 +620,7 @@ func (c *grpcStorageClient) ListObjects(ctx context.Context, bucket string, q *Q gitr = c.raw.ListObjects(ctx, req, s.gax...) objects, token, err = gitr.InternalFetch(pageSize, pageToken) return err - }, s.retry, s.idempotent) + }, s.retry, s.idempotent, withOperation("ListObjects"), withBucket(bucket), withObject(it.query.Prefix)) if err != nil { return "", formatBucketError(err) } @@ -1331,7 +1369,7 @@ func (c *grpcStorageClient) NewRangeReader(ctx context.Context, params *newRange } err = decoder.readFullObjectResponse() return err - }, s.retry, s.idempotent) + }, s.retry, s.idempotent, withOperation("ReadObject"), withBucket(params.bucket), withObject(params.object)) if err != nil { // Close the stream context we just created to ensure we don't leak // resources. @@ -1862,6 +1900,7 @@ type readResponseDecoder struct { msg *storagepb.BidiReadObjectResponse // processed response message with all fields other than object data populated dataOffsets map[int64]bufferSliceOffsets // Map ReadId to the offsets of the object data for that ID in the message. done bool // true if the data has been completely read. + crcErrs map[int64]error // Map ReadId to the CRC validation error if it failed. } type bufferSliceOffsets struct { @@ -1989,6 +2028,51 @@ func (d *readResponseDecoder) readAndUpdateCRC(p []byte, readID int64, updateCRC return n, true } +func (d *readResponseDecoder) verifyChecksums() { + if d.msg == nil { + return + } + for _, dataRange := range d.msg.GetObjectDataRanges() { + checksummedData := dataRange.GetChecksummedData() + if checksummedData == nil || checksummedData.Crc32C == nil { + continue + } + readID := dataRange.GetReadRange().GetReadId() + offsets, ok := d.dataOffsets[readID] + wantCRC := *checksummedData.Crc32C + var gotCRC uint32 + + if ok { + for i := offsets.startBuf; i <= offsets.endBuf; i++ { + if i < 0 || i >= len(d.databufs) { + continue + } + databuf := d.databufs[i] + var start uint64 + if i == offsets.startBuf { + start = min(offsets.startOff, uint64(databuf.Len())) + } + end := uint64(databuf.Len()) + if i == offsets.endBuf { + end = min(offsets.endOff, end) + } + if start >= end { + continue + } + dataSlice := databuf.ReadOnlyData()[start:end] + gotCRC = crc32.Update(gotCRC, crc32cTable, dataSlice) + } + } + + if gotCRC != wantCRC { + if d.crcErrs == nil { + d.crcErrs = make(map[int64]error) + } + d.crcErrs[readID] = fmt.Errorf("storage: bad CRC on chunk read: got %d, want %d", gotCRC, wantCRC) + } + } +} + func (d *readResponseDecoder) writeToAndUpdateCRC(w io.Writer, readID int64, updateCRC func([]byte)) (totalWritten int64, found bool, err error) { // For a completely empty message, just return 0 if len(d.databufs) == 0 { @@ -2004,6 +2088,9 @@ func (d *readResponseDecoder) writeToAndUpdateCRC(w io.Writer, readID int64, upd // Loop from the current buffer to the ending buffer for this specific data range. for i := offsets.currBuf; i <= offsets.endBuf; i++ { + if i < 0 || i >= len(d.databufs) { + continue + } databuf := d.databufs[i] // Determine the start and end of the data slice for the current buffer. diff --git a/vendor/cloud.google.com/go/storage/grpc_metrics.go b/vendor/cloud.google.com/go/storage/grpc_metrics.go index 04421015..62d53876 100644 --- a/vendor/cloud.google.com/go/storage/grpc_metrics.go +++ b/vendor/cloud.google.com/go/storage/grpc_metrics.go @@ -53,7 +53,9 @@ type storageMonitoredResource struct { func (smr *storageMonitoredResource) exporter() (metric.Exporter, error) { exporter, err := mexporter.New( mexporter.WithProjectID(smr.project), - mexporter.WithMetricDescriptorTypeFormatter(metricFormatter), + mexporter.WithMetricDescriptorTypeFormatter(func(m metricdata.Metrics) string { + return formatMetricWithPrefix(m, metricPrefix) + }), mexporter.WithCreateServiceTimeSeries(), mexporter.WithMonitoredResourceDescription(monitoredResourceName, []string{"project_id", "location", "cloud_platform", "host_id", "instance_id", "api"}), ) @@ -281,7 +283,3 @@ func createHistogramView(name string, boundaries []float64) metric.View { Aggregation: metric.AggregationExplicitBucketHistogram{Boundaries: boundaries}, }) } - -func metricFormatter(m metricdata.Metrics) string { - return metricPrefix + strings.ReplaceAll(string(m.Name), ".", "/") -} diff --git a/vendor/cloud.google.com/go/storage/grpc_reader_multi_range.go b/vendor/cloud.google.com/go/storage/grpc_reader_multi_range.go index 7965becb..acd83c09 100644 --- a/vendor/cloud.google.com/go/storage/grpc_reader_multi_range.go +++ b/vendor/cloud.google.com/go/storage/grpc_reader_multi_range.go @@ -19,7 +19,6 @@ import ( "context" "errors" "fmt" - "hash/crc32" "io" "log" "sync" @@ -405,10 +404,6 @@ type rangeRequest struct { readID int64 bytesWritten int64 completed bool - - wantChunkCRC uint32 - gotChunkCRC uint32 - chunkCRCPresent bool } // Methods implementing internalMultiRangeDownloader @@ -775,7 +770,7 @@ func (m *multiRangeDownloaderManager) createNewSession(id int, readSpec *storage newSession = session firstResult = result return nil - }, retry, true) + }, retry, true, withOperation("ReadObject"), withBucket(m.params.bucket), withObject(m.params.object)) if err != nil { return nil, nil, err @@ -1016,6 +1011,10 @@ func (m *multiRangeDownloaderManager) processSessionResult(result mrdSessionResu m.handleStreamEnd(result, m.streams[result.id]) return } + // Safety check but this should not happen. + if result.decoder == nil { + return + } resp := result.decoder.msg if handle := resp.GetReadHandle().GetHandle(); len(handle) > 0 { @@ -1064,33 +1063,22 @@ func (m *multiRangeDownloaderManager) processDataRanges(result mrdSessionResult, continue } - var updateCRC func(b []byte) - // If checksum is enabled and data has checksum, validate it. - if !m.params.disableMRDReadChecksum && - dataRange.GetChecksummedData() != nil && - dataRange.GetChecksummedData().Crc32C != nil { - req.gotChunkCRC = 0 - req.chunkCRCPresent = true - req.wantChunkCRC = *dataRange.GetChecksummedData().Crc32C - updateCRC = func(b []byte) { - req.gotChunkCRC = crc32.Update(req.gotChunkCRC, crc32cTable, b) - } - } - written, _, err := result.decoder.writeToAndUpdateCRC(req.output, readID, updateCRC) + written, _, err := result.decoder.writeToAndUpdateCRC(req.output, readID, nil) req.bytesWritten += written mrdStream.updateCapacity(m, 0, -written) if err != nil { m.failRange(mrdStream, req, err) continue } - err = m.checkAndResetChunkCRC(req) - if err != nil { - m.failRange(mrdStream, req, err) + + if result.decoder.crcErrs != nil && result.decoder.crcErrs[readID] != nil { + m.failRange(mrdStream, req, result.decoder.crcErrs[readID]) continue } + if dataRange.GetRangeEnd() { req.completed = true - delete(mrdStream.pendingRanges, req.readID) + delete(mrdStream.pendingRanges, readID) mrdStream.updateCapacity(m, -1, 0) if req.length >= 0 && req.bytesWritten > req.length { log.Printf("storage: received %d more bytes than requested from GCS for bucket %q, object %q", req.bytesWritten-req.length, m.params.bucket, m.params.object) @@ -1100,19 +1088,6 @@ func (m *multiRangeDownloaderManager) processDataRanges(result mrdSessionResult, } } -func (m *multiRangeDownloaderManager) checkAndResetChunkCRC(req *rangeRequest) error { - if m.params.disableMRDReadChecksum || !req.chunkCRCPresent { - return nil - } - if req.gotChunkCRC != req.wantChunkCRC { - return fmt.Errorf("storage: bad CRC on chunk read: got %d, want %d", req.gotChunkCRC, req.wantChunkCRC) - } - req.gotChunkCRC = 0 - req.wantChunkCRC = 0 - req.chunkCRCPresent = false - return nil -} - // ensureSession is now only for reconnecting *after* the initial session is up. func (m *multiRangeDownloaderManager) ensureSession(ctx context.Context, stream *mrdStream) { if stream.session != nil || stream.reconnecting { @@ -1373,6 +1348,9 @@ func (s *bidiReadStreamSession) receiveLoop() { databufs: databufs, } err = decoder.readFullObjectResponse() + if err == nil && !s.params.disableMRDReadChecksum { + decoder.verifyChecksums() + } } if err != nil { diff --git a/vendor/cloud.google.com/go/storage/http_client.go b/vendor/cloud.google.com/go/storage/http_client.go index 7573942a..daa0daf1 100644 --- a/vendor/cloud.google.com/go/storage/http_client.go +++ b/vendor/cloud.google.com/go/storage/http_client.go @@ -54,6 +54,8 @@ type httpStorageClient struct { settings *settings config *storageConfig dynamicReadReqStallTimeout *bucketDelayManager + metrics *clientMetrics + metricsCleanup func() // configFeatureAttributes tracks client-level features that are enabled for this // client instance. @@ -62,7 +64,7 @@ type httpStorageClient struct { // newHTTPStorageClient initializes a new storageClient that uses the HTTP-JSON // Storage API. -func newHTTPStorageClient(ctx context.Context, opts ...storageOption) (storageClient, error) { +func newHTTPStorageClient(ctx context.Context, opts ...storageOption) (client storageClient, err error) { s := initSettings(opts...) o := s.clientOption config := newStorageConfig(o...) @@ -122,18 +124,50 @@ func newHTTPStorageClient(ctx context.Context, opts ...storageOption) (storageCl return nil, fmt.Errorf("dialing: %w", err) } + var clientMetrics *clientMetrics + var metricsCleanup func() + if isOtelMetricsEnabled(&config) { + var project string + if creds != nil { + project, _ = creds.ProjectID(ctx) + } + if cm, cleanup, err := initMetrics(ctx, project, &config); err == nil { + clientMetrics = cm + metricsCleanup = cleanup + } else { + log.Printf("Failed to enable metrics: %v", err) + } + } + + if metricsCleanup != nil { + defer func() { + if err != nil { + metricsCleanup() + } + }() + } + // Clone the http.Client to avoid modifying the original one if it was provided by the user. hcClone := *hc c := &httpStorageClient{ - creds: creds, - hc: &hcClone, - settings: s, - config: &config, + creds: creds, + hc: &hcClone, + settings: s, + config: &config, + metrics: clientMetrics, + metricsCleanup: metricsCleanup, + } + + // Wrap transport to inject tracking headers and metrics. + transport := hc.Transport + if clientMetrics != nil { + transport = &metricsRoundTripper{ + base: transport, + metrics: clientMetrics, + } } - - // Wrap transport to inject tracking headers. hcClone.Transport = &trackingTransport{ - base: hc.Transport, + base: transport, features: c.configFeatureAttributes, } @@ -172,6 +206,9 @@ func newHTTPStorageClient(ctx context.Context, opts ...storageOption) (storageCl func (c *httpStorageClient) Close() error { c.hc.CloseIdleConnections() + if c.metricsCleanup != nil { + c.metricsCleanup() + } return nil } @@ -1588,7 +1625,7 @@ func readerReopen(ctx context.Context, header http.Header, params *newRangeReade params.gen = gen64 } return nil - }, s.retry, s.idempotent) + }, s.retry, s.idempotent, withOperation("ReadObject"), withBucket(params.bucket), withObject(params.object)) if err != nil { return nil, err } diff --git a/vendor/cloud.google.com/go/storage/internal/experimental.go b/vendor/cloud.google.com/go/storage/internal/experimental.go index 38ab96d6..3f6d33bd 100644 --- a/vendor/cloud.google.com/go/storage/internal/experimental.go +++ b/vendor/cloud.google.com/go/storage/internal/experimental.go @@ -47,4 +47,8 @@ var ( // It sets the gRPC client to use direct path connectivity for all requests and may fail // if direct path connectivity cannot be established for a request. WithDirectConnectivityEnforced any // func() option.ClientOption + + // WithOtelMetrics is a function which is implemented by the storage package. + // It enables client-side OpenTelemetry metrics. + WithOtelMetrics any // func() option.ClientOption ) diff --git a/vendor/cloud.google.com/go/storage/internal/version.go b/vendor/cloud.google.com/go/storage/internal/version.go index 4ea0bddd..86da2df7 100644 --- a/vendor/cloud.google.com/go/storage/internal/version.go +++ b/vendor/cloud.google.com/go/storage/internal/version.go @@ -17,4 +17,4 @@ package internal // Version is the current tagged release of the library. -const Version = "1.63.0" +const Version = "1.63.1" diff --git a/vendor/cloud.google.com/go/storage/metrics.go b/vendor/cloud.google.com/go/storage/metrics.go new file mode 100644 index 00000000..e79787f7 --- /dev/null +++ b/vendor/cloud.google.com/go/storage/metrics.go @@ -0,0 +1,515 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package storage + +import ( + "context" + "fmt" + "io" + "net" + "net/http" + "os" + "strconv" + "strings" + "sync/atomic" + "time" + + "cloud.google.com/go/storage/internal" + mexporter "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric" + "go.opentelemetry.io/otel/attribute" + "go.opentelemetry.io/otel/metric" + sdkmetric "go.opentelemetry.io/otel/sdk/metric" + "go.opentelemetry.io/otel/sdk/metric/metricdata" + "go.opentelemetry.io/otel/sdk/resource" + "google.golang.org/grpc" + "google.golang.org/grpc/codes" + "google.golang.org/grpc/status" +) + +const ( + customMetricPrefix = "custom.googleapis.com/" +) + +// clientMetrics contains the OpenTelemetry metric instruments to record client-side metrics. +type clientMetrics struct { + provider *sdkmetric.MeterProvider + rpcClientCallDuration metric.Float64Histogram + httpClientRequestDuration metric.Float64Histogram +} + +func formatMetricWithPrefix(m metricdata.Metrics, prefix string) string { + return prefix + strings.ReplaceAll(string(m.Name), ".", "/") +} + +// isOtelMetricsEnabled checks if Otel metrics are enabled. +// The environment variable GCP_STORAGE_GO_ENABLE_OTEL_METRICS takes precedence. +func isOtelMetricsEnabled(config *storageConfig) bool { + if config.disableClientMetrics { + return false + } + if valStr, present := os.LookupEnv("GCP_STORAGE_GO_ENABLE_OTEL_METRICS"); present { + v, err := strconv.ParseBool(valStr) + if err == nil { + return v + } + } + return config.enableOtelMetrics +} + +// newMetricsGCMExporter creates a Google Cloud Monitoring exporter. +func newMetricsGCMExporter(ctx context.Context, projectID string) (sdkmetric.Exporter, error) { + exporter, err := mexporter.New( + mexporter.WithProjectID(projectID), + mexporter.WithMetricDescriptorTypeFormatter(func(m metricdata.Metrics) string { + return formatMetricWithPrefix(m, customMetricPrefix) + }), + mexporter.WithCreateServiceTimeSeries(), + ) + if err != nil { + return nil, fmt.Errorf("storage: creating GCM exporter: %w", err) + } + return exporter, nil +} + +// initMetrics initializes clientMetrics with a meter provider and registered exporter. +func initMetrics(ctx context.Context, projectID string, config *storageConfig) (*clientMetrics, func(), error) { + var provider *sdkmetric.MeterProvider + var ownProvider bool + + if config.meterProvider != nil { + provider = config.meterProvider + } else { + var exporter sdkmetric.Exporter + var err error + if config.metricExporter != nil { + exporter = *config.metricExporter + } else { + exporter, err = newMetricsGCMExporter(ctx, projectID) + if err != nil { + return nil, nil, err + } + } + + interval := time.Minute + if config.metricInterval > 0 { + interval = config.metricInterval + } + + reader := sdkmetric.NewPeriodicReader(&exporterLogSuppressor{Exporter: exporter}, sdkmetric.WithInterval(interval)) + + // Static common attributes are defined as Resource Attributes. + res, err := resource.New(ctx, + resource.WithAttributes( + attribute.String("gcp.client.version", internal.Version), + attribute.String("gcp.client.service", "storage"), + attribute.String("gcp.client.repo", "googleapis/google-cloud-go"), + attribute.String("gcp.client.artifact", "cloud.google.com/go/storage"), + ), + ) + if err != nil { + return nil, nil, fmt.Errorf("storage: creating metrics resource: %w", err) + } + + provider = sdkmetric.NewMeterProvider( + sdkmetric.WithReader(reader), + sdkmetric.WithResource(res), + sdkmetric.WithView( + sdkmetric.NewView( + sdkmetric.Instrument{Name: "rpc.client.call.duration", Kind: sdkmetric.InstrumentKindHistogram}, + sdkmetric.Stream{Aggregation: sdkmetric.AggregationExplicitBucketHistogram{Boundaries: latencyHistogramBoundaries()}}, + ), + sdkmetric.NewView( + sdkmetric.Instrument{Name: "http.client.request.duration", Kind: sdkmetric.InstrumentKindHistogram}, + sdkmetric.Stream{Aggregation: sdkmetric.AggregationExplicitBucketHistogram{Boundaries: latencyHistogramBoundaries()}}, + ), + ), + ) + ownProvider = true + } + + meter := provider.Meter("cloud.google.com/go/storage") + + rpcDuration, err := meter.Float64Histogram( + "rpc.client.call.duration", + metric.WithDescription("Duration of one gRPC request. Retries not included (Otel)"), + metric.WithUnit("s"), + ) + if err != nil { + return nil, nil, err + } + + httpDuration, err := meter.Float64Histogram( + "http.client.request.duration", + metric.WithDescription("Duration of one HTTP client request. Retried not included (Otel)"), + metric.WithUnit("s"), + ) + if err != nil { + return nil, nil, err + } + + cm := &clientMetrics{ + provider: provider, + rpcClientCallDuration: rpcDuration, + httpClientRequestDuration: httpDuration, + } + + var cleanup func() + if ownProvider { + cleanup = func() { + shutdownCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second) + defer cancel() + provider.Shutdown(shutdownCtx) + } + } + + return cm, cleanup, nil +} + +// grpcCodeToString maps a gRPC status code to its screaming-snake-case protocol name. +func grpcCodeToString(code codes.Code) string { + switch code { + case codes.OK: + return "OK" + case codes.Canceled: + return "CANCELLED" + case codes.Unknown: + return "UNKNOWN" + case codes.InvalidArgument: + return "INVALID_ARGUMENT" + case codes.DeadlineExceeded: + return "DEADLINE_EXCEEDED" + case codes.NotFound: + return "NOT_FOUND" + case codes.AlreadyExists: + return "ALREADY_EXISTS" + case codes.PermissionDenied: + return "PERMISSION_DENIED" + case codes.ResourceExhausted: + return "RESOURCE_EXHAUSTED" + case codes.FailedPrecondition: + return "FAILED_PRECONDITION" + case codes.Aborted: + return "ABORTED" + case codes.OutOfRange: + return "OUT_OF_RANGE" + case codes.Unimplemented: + return "UNIMPLEMENTED" + case codes.Internal: + return "INTERNAL" + case codes.Unavailable: + return "UNAVAILABLE" + case codes.DataLoss: + return "DATA_LOSS" + case codes.Unauthenticated: + return "UNAUTHENTICATED" + default: + return "UNKNOWN" + } +} + +// computeErrorType maps the request result to the standard error.type values. +func computeErrorType(err error, isHTTP bool, statusCode int64) string { + if err == nil { + if isHTTP && statusCode >= 400 { + return strconv.FormatInt(statusCode, 10) + } + return "OK" + } + + if err == io.EOF { + return "OK" + } + + errStr := strings.ToLower(err.Error()) + + if err == context.Canceled || strings.Contains(errStr, "context canceled") { + return "CANCELLED" + } + + if err == context.DeadlineExceeded || strings.Contains(errStr, "deadline exceeded") || strings.Contains(errStr, "timeout") { + return "TIMEOUT" + } + + if strings.Contains(errStr, "checksum") || strings.Contains(errStr, "mismatch") { + return "CHECKSUM_MISMATCH" + } + + if strings.Contains(errStr, "auth") || strings.Contains(errStr, "credentials") || strings.Contains(errStr, "token") || strings.Contains(errStr, "key") { + return "AUTHENTICATION_ERROR" + } + + if strings.Contains(errStr, "connection refused") || strings.Contains(errStr, "dial tcp") || strings.Contains(errStr, "no such host") || strings.Contains(errStr, "broken pipe") || strings.Contains(errStr, "connection reset") || strings.Contains(errStr, "eof") { + return "CONNECTIVITY" + } + + if !isHTTP { + if st, ok := status.FromError(err); ok && st.Code() != codes.OK { + return grpcCodeToString(st.Code()) + } + } + + if isHTTP && statusCode >= 400 { + return strconv.FormatInt(statusCode, 10) + } + + return "UNKNOWN" +} + +func (cm *clientMetrics) recordRPC(ctx context.Context, method, target string, duration float64, err error) { + statusCode := int64(codes.OK) + if err != nil && err != io.EOF { + statusCode = int64(status.Code(err)) + } + + service := "google.storage.v2.Storage" + methodName := method + if strings.HasPrefix(method, "/") { + parts := strings.Split(strings.TrimPrefix(method, "/"), "/") + if len(parts) >= 2 { + service = parts[0] + methodName = parts[1] + } + } + + errorType := computeErrorType(err, false, statusCode) + + attrs := []attribute.KeyValue{ + attribute.String("rpc.system.name", "grpc"), + attribute.String("rpc.service", service), + attribute.String("rpc.method", methodName), + attribute.Int64("rpc.grpc.status_code", statusCode), + attribute.Int64("rpc.response.status_code", statusCode), + attribute.String("server.address", stripPort(target)), + attribute.String("error.type", errorType), + } + + cm.rpcClientCallDuration.Record(ctx, duration, metric.WithAttributes(attrs...)) +} + +func (cm *clientMetrics) recordHTTP(ctx context.Context, req *http.Request, resp *http.Response, duration float64, err error) { + statusCode := int64(0) + if resp != nil { + statusCode = int64(resp.StatusCode) + } + + urlTemplate := computeURLTemplate(req.URL.Path, req.URL.Host) + errorType := computeErrorType(err, true, statusCode) + + attrs := []attribute.KeyValue{ + attribute.String("rpc.system.name", "http"), + attribute.String("http.request.method", req.Method), + attribute.String("url.template", urlTemplate), + attribute.Int64("http.response.status_code", statusCode), + attribute.Int64("rpc.response.status_code", statusCode), + attribute.String("server.address", stripPort(req.URL.Host)), + attribute.String("error.type", errorType), + } + + cm.httpClientRequestDuration.Record(ctx, duration, metric.WithAttributes(attrs...)) +} + +// computeURLTemplate extracts a parameterized template path for a given GCS HTTP request URL path. +func computeURLTemplate(path, host string) string { + // Check for XML host-style: {bucket}.storage.googleapis.com. + if strings.HasSuffix(host, ".storage.googleapis.com") && host != "storage.googleapis.com" { + if path == "/" || path == "" { + return "/" + } + return "/{object}" + } + + // Check for XML path-style or JSON API. + if !strings.HasPrefix(path, "/storage/") && !strings.HasPrefix(path, "/upload/") && !strings.HasPrefix(path, "/batch") { + p := strings.TrimPrefix(path, "/") + parts := strings.SplitN(p, "/", 2) + if len(parts) == 1 { + if parts[0] == "" { + return "/" + } + return "/{bucket}" + } + return "/{bucket}/{object}" + } + + // JSON API: /storage/v1/b/bucket-name/o/object-name etc. + bIdx := strings.Index(path, "/b/") + if bIdx == -1 { + return path + } + prefix := path[:bIdx+3] + rest := path[bIdx+3:] + + parts := strings.SplitN(rest, "/", 2) + if len(parts) == 1 { + return prefix + "{bucket}" + } + + oRest := parts[1] + if oRest == "o" { + return prefix + "{bucket}/o" + } + if strings.HasPrefix(oRest, "o/") { + return prefix + "{bucket}/o/{object}" + } + + return prefix + "{bucket}/" + oRest +} + +func stripPort(host string) string { + if h, _, err := net.SplitHostPort(host); err == nil { + return h + } + return host +} + +// metricsRoundTripper is an http.RoundTripper that wraps an underlying transport. +type metricsRoundTripper struct { + base http.RoundTripper + metrics *clientMetrics +} + +func (rt *metricsRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) { + startTime := time.Now() + resp, err := rt.base.RoundTrip(req) + if err != nil { + duration := time.Since(startTime).Seconds() + rt.metrics.recordHTTP(req.Context(), req, nil, duration, err) + return nil, err + } + + if resp.Body != nil { + resp.Body = &wrappedResponseBody{ + ReadCloser: resp.Body, + startTime: startTime, + req: req, + resp: resp, + metrics: rt.metrics, + } + } else { + duration := time.Since(startTime).Seconds() + rt.metrics.recordHTTP(req.Context(), req, resp, duration, nil) + } + return resp, nil +} + +type wrappedResponseBody struct { + io.ReadCloser + startTime time.Time + req *http.Request + resp *http.Response + metrics *clientMetrics + recorded atomic.Bool +} + +func (w *wrappedResponseBody) Read(p []byte) (n int, err error) { + n, err = w.ReadCloser.Read(p) + if err != nil { + w.record(err) + } + return n, err +} + +func (w *wrappedResponseBody) Close() error { + err := w.ReadCloser.Close() + w.record(err) + return err +} + +func (w *wrappedResponseBody) record(err error) { + if w.recorded.CompareAndSwap(false, true) { + duration := time.Since(w.startTime).Seconds() + w.metrics.recordHTTP(w.req.Context(), w.req, w.resp, duration, err) + } +} + +// metricsInterceptors returns gRPC client interceptors. +func metricsInterceptors(cm *clientMetrics) (grpc.UnaryClientInterceptor, grpc.StreamClientInterceptor) { + unary := func(ctx context.Context, method string, req, reply interface{}, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error { + startTime := time.Now() + err := invoker(ctx, method, req, reply, cc, opts...) + duration := time.Since(startTime).Seconds() + target := "" + if cc != nil { + target = cc.Target() + } + cm.recordRPC(ctx, method, target, duration, err) + return err + } + + stream := func(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string, streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) { + startTime := time.Now() + clientStream, err := streamer(ctx, desc, cc, method, opts...) + target := "" + if cc != nil { + target = cc.Target() + } + if err != nil { + duration := time.Since(startTime).Seconds() + cm.recordRPC(ctx, method, target, duration, err) + return nil, err + } + + return &wrappedClientStream{ + ClientStream: clientStream, + startTime: startTime, + method: method, + target: target, + metrics: cm, + ctx: ctx, + serverStreams: desc.ServerStreams, + clientStreams: desc.ClientStreams, + }, nil + } + + return unary, stream +} + +type wrappedClientStream struct { + grpc.ClientStream + startTime time.Time + method string + target string + metrics *clientMetrics + ctx context.Context + recorded atomic.Bool + serverStreams bool + clientStreams bool +} + +func (w *wrappedClientStream) RecvMsg(m interface{}) error { + err := w.ClientStream.RecvMsg(m) + // For client-streaming streams (like WriteObject), the single successful RecvMsg call + // returns the response and nil error, which marks the completion of the stream. + isClientStreaming := !w.serverStreams && w.clientStreams + if err != nil || isClientStreaming { + w.record(err) + } + return err +} + +func (w *wrappedClientStream) SendMsg(m interface{}) error { + err := w.ClientStream.SendMsg(m) + if err != nil { + w.record(err) + } + return err +} + +func (w *wrappedClientStream) record(err error) { + if w.recorded.CompareAndSwap(false, true) { + duration := time.Since(w.startTime).Seconds() + w.metrics.recordRPC(w.ctx, w.method, w.target, duration, err) + } +} diff --git a/vendor/cloud.google.com/go/storage/option.go b/vendor/cloud.google.com/go/storage/option.go index 8b75edef..c49b224e 100644 --- a/vendor/cloud.google.com/go/storage/option.go +++ b/vendor/cloud.google.com/go/storage/option.go @@ -44,6 +44,7 @@ func init() { storageinternal.WithGRPCBidiReads = withGRPCBidiReads storageinternal.WithZonalBucketAPIs = withZonalBucketAPIs storageinternal.WithDirectConnectivityEnforced = withDirectConnectivityEnforced + storageinternal.WithOtelMetrics = withOtelMetrics } // getDynamicReadReqIncreaseRateFromEnv returns the value set in the env variable. @@ -81,6 +82,7 @@ type storageConfig struct { useJSONforReads bool readAPIWasSet bool disableClientMetrics bool + enableOtelMetrics bool metricExporter *metric.Exporter metricInterval time.Duration meterProvider *metric.MeterProvider @@ -300,3 +302,15 @@ func (w *withZonalBucketAPIsConfig) ApplyStorageOpt(config *storageConfig) { config.grpcAppendableUploads = true config.grpcBidiReads = true } + +func withOtelMetrics() option.ClientOption { + return &withOtelMetricsConfig{} +} + +type withOtelMetricsConfig struct { + internaloption.EmbeddableAdapter +} + +func (w *withOtelMetricsConfig) ApplyStorageOpt(c *storageConfig) { + c.enableOtelMetrics = true +} diff --git a/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.pb.go b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.pb.go new file mode 100644 index 00000000..5c5e7bbd --- /dev/null +++ b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.pb.go @@ -0,0 +1,371 @@ +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.10 +// protoc v6.33.2 +// source: envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto + +package gcp_authnv3 + +import ( + _ "github.com/cncf/xds/go/udpa/annotations" + _ "github.com/envoyproxy/go-control-plane/envoy/annotations" + v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" + _ "github.com/envoyproxy/protoc-gen-validate/validate" + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + durationpb "google.golang.org/protobuf/types/known/durationpb" + wrapperspb "google.golang.org/protobuf/types/known/wrapperspb" + reflect "reflect" + sync "sync" + unsafe "unsafe" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +// Filter configuration. +// [#next-free-field: 7] +type GcpAuthnFilterConfig struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The HTTP URI to fetch tokens from GCE Metadata Server(https://cloud.google.com/compute/docs/metadata/overview). + // The URL format is "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=[AUDIENCE]" + // + // This field is deprecated because it does not match the API surface provided by the google auth libraries. + // Control planes should not attempt to override the metadata server URI. + // The cluster and timeout can be configured using the “cluster“ and “timeout“ fields instead. + // For backward compatibility, the cluster and timeout configured in this field will be used + // if the new “cluster“ and “timeout“ fields are not set. + // + // Deprecated: Marked as deprecated in envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto. + HttpUri *v3.HttpUri `protobuf:"bytes,1,opt,name=http_uri,json=httpUri,proto3" json:"http_uri,omitempty"` + // Retry policy for fetching tokens. + // Not supported by all data planes. + RetryPolicy *v3.RetryPolicy `protobuf:"bytes,2,opt,name=retry_policy,json=retryPolicy,proto3" json:"retry_policy,omitempty"` + // Token cache configuration. This field is optional. + CacheConfig *TokenCacheConfig `protobuf:"bytes,3,opt,name=cache_config,json=cacheConfig,proto3" json:"cache_config,omitempty"` + // Request header location to extract the token. By default (i.e. if this field is not specified), the token + // is extracted to the Authorization HTTP header, in the format "Authorization: Bearer ". + // Not supported by all data planes. + TokenHeader *TokenHeader `protobuf:"bytes,4,opt,name=token_header,json=tokenHeader,proto3" json:"token_header,omitempty"` + // Cluster to send traffic to the GCE metadata server. Not supported + // by all data planes; a data plane may instead have its own mechanism + // for contacting the metadata server. + Cluster string `protobuf:"bytes,5,opt,name=cluster,proto3" json:"cluster,omitempty"` + // Timeout for fetching the tokens from the GCE metadata server. + // Not supported by all data planes. + Timeout *durationpb.Duration `protobuf:"bytes,6,opt,name=timeout,proto3" json:"timeout,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *GcpAuthnFilterConfig) Reset() { + *x = GcpAuthnFilterConfig{} + mi := &file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *GcpAuthnFilterConfig) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*GcpAuthnFilterConfig) ProtoMessage() {} + +func (x *GcpAuthnFilterConfig) ProtoReflect() protoreflect.Message { + mi := &file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use GcpAuthnFilterConfig.ProtoReflect.Descriptor instead. +func (*GcpAuthnFilterConfig) Descriptor() ([]byte, []int) { + return file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDescGZIP(), []int{0} +} + +// Deprecated: Marked as deprecated in envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto. +func (x *GcpAuthnFilterConfig) GetHttpUri() *v3.HttpUri { + if x != nil { + return x.HttpUri + } + return nil +} + +func (x *GcpAuthnFilterConfig) GetRetryPolicy() *v3.RetryPolicy { + if x != nil { + return x.RetryPolicy + } + return nil +} + +func (x *GcpAuthnFilterConfig) GetCacheConfig() *TokenCacheConfig { + if x != nil { + return x.CacheConfig + } + return nil +} + +func (x *GcpAuthnFilterConfig) GetTokenHeader() *TokenHeader { + if x != nil { + return x.TokenHeader + } + return nil +} + +func (x *GcpAuthnFilterConfig) GetCluster() string { + if x != nil { + return x.Cluster + } + return "" +} + +func (x *GcpAuthnFilterConfig) GetTimeout() *durationpb.Duration { + if x != nil { + return x.Timeout + } + return nil +} + +// Audience is the URL of the receiving service that performs token authentication. +// It will be provided to the filter through cluster's typed_filter_metadata. +type Audience struct { + state protoimpl.MessageState `protogen:"open.v1"` + Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Audience) Reset() { + *x = Audience{} + mi := &file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Audience) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Audience) ProtoMessage() {} + +func (x *Audience) ProtoReflect() protoreflect.Message { + mi := &file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_msgTypes[1] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Audience.ProtoReflect.Descriptor instead. +func (*Audience) Descriptor() ([]byte, []int) { + return file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDescGZIP(), []int{1} +} + +func (x *Audience) GetUrl() string { + if x != nil { + return x.Url + } + return "" +} + +// Token Cache configuration. +type TokenCacheConfig struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The number of cache entries. The maximum number of entries is INT64_MAX as it is constrained by underlying cache implementation. + // Default value 0 (i.e., proto3 defaults) disables the cache by default. Other default values will enable the cache. + CacheSize *wrapperspb.UInt64Value `protobuf:"bytes,1,opt,name=cache_size,json=cacheSize,proto3" json:"cache_size,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *TokenCacheConfig) Reset() { + *x = TokenCacheConfig{} + mi := &file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_msgTypes[2] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *TokenCacheConfig) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*TokenCacheConfig) ProtoMessage() {} + +func (x *TokenCacheConfig) ProtoReflect() protoreflect.Message { + mi := &file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_msgTypes[2] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use TokenCacheConfig.ProtoReflect.Descriptor instead. +func (*TokenCacheConfig) Descriptor() ([]byte, []int) { + return file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDescGZIP(), []int{2} +} + +func (x *TokenCacheConfig) GetCacheSize() *wrapperspb.UInt64Value { + if x != nil { + return x.CacheSize + } + return nil +} + +type TokenHeader struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The HTTP header's name. + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + // The header's prefix. The format is "value_prefix" + // For example, for "Authorization: Bearer ", value_prefix="Bearer " with a space at the + // end. + ValuePrefix string `protobuf:"bytes,2,opt,name=value_prefix,json=valuePrefix,proto3" json:"value_prefix,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *TokenHeader) Reset() { + *x = TokenHeader{} + mi := &file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_msgTypes[3] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *TokenHeader) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*TokenHeader) ProtoMessage() {} + +func (x *TokenHeader) ProtoReflect() protoreflect.Message { + mi := &file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_msgTypes[3] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use TokenHeader.ProtoReflect.Descriptor instead. +func (*TokenHeader) Descriptor() ([]byte, []int) { + return file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDescGZIP(), []int{3} +} + +func (x *TokenHeader) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *TokenHeader) GetValuePrefix() string { + if x != nil { + return x.ValuePrefix + } + return "" +} + +var File_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto protoreflect.FileDescriptor + +const file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDesc = "" + + "\n" + + ":envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto\x12*envoy.extensions.filters.http.gcp_authn.v3\x1a\x1fenvoy/config/core/v3/base.proto\x1a#envoy/config/core/v3/http_uri.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a#envoy/annotations/deprecation.proto\x1a\x1dudpa/annotations/status.proto\x1a\x17validate/validate.proto\"\xc1\x03\n" + + "\x14GcpAuthnFilterConfig\x12E\n" + + "\bhttp_uri\x18\x01 \x01(\v2\x1d.envoy.config.core.v3.HttpUriB\v\x92dž\xd8\x04\x033.0\x18\x01R\ahttpUri\x12D\n" + + "\fretry_policy\x18\x02 \x01(\v2!.envoy.config.core.v3.RetryPolicyR\vretryPolicy\x12_\n" + + "\fcache_config\x18\x03 \x01(\v2<.envoy.extensions.filters.http.gcp_authn.v3.TokenCacheConfigR\vcacheConfig\x12Z\n" + + "\ftoken_header\x18\x04 \x01(\v27.envoy.extensions.filters.http.gcp_authn.v3.TokenHeaderR\vtokenHeader\x12\x18\n" + + "\acluster\x18\x05 \x01(\tR\acluster\x12E\n" + + "\atimeout\x18\x06 \x01(\v2\x19.google.protobuf.DurationB\x10\xfaB\r\xaa\x01\n" + + "\x1a\x06\b\x80\x80\x80\x80\x102\x00R\atimeout\"%\n" + + "\bAudience\x12\x19\n" + + "\x03url\x18\x01 \x01(\tB\a\xfaB\x04r\x02\x10\x01R\x03url\"`\n" + + "\x10TokenCacheConfig\x12L\n" + + "\n" + + "cache_size\x18\x01 \x01(\v2\x1c.google.protobuf.UInt64ValueB\x0f\xfaB\f2\n" + + "\x18\xff\xff\xff\xff\xff\xff\xff\xff\x7fR\tcacheSize\"`\n" + + "\vTokenHeader\x12!\n" + + "\x04name\x18\x01 \x01(\tB\r\xfaB\n" + + "r\b\x10\x01\xc8\x01\x00\xc0\x01\x01R\x04name\x12.\n" + + "\fvalue_prefix\x18\x02 \x01(\tB\v\xfaB\br\x06\xc8\x01\x00\xc0\x01\x02R\vvaluePrefixB\xb2\x01\xba\x80\xc8\xd1\x06\x02\x10\x02\n" + + "8io.envoyproxy.envoy.extensions.filters.http.gcp_authn.v3B\rGcpAuthnProtoP\x01Z]github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3;gcp_authnv3b\x06proto3" + +var ( + file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDescOnce sync.Once + file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDescData []byte +) + +func file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDescGZIP() []byte { + file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDescOnce.Do(func() { + file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDesc), len(file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDesc))) + }) + return file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDescData +} + +var file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_msgTypes = make([]protoimpl.MessageInfo, 4) +var file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_goTypes = []any{ + (*GcpAuthnFilterConfig)(nil), // 0: envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig + (*Audience)(nil), // 1: envoy.extensions.filters.http.gcp_authn.v3.Audience + (*TokenCacheConfig)(nil), // 2: envoy.extensions.filters.http.gcp_authn.v3.TokenCacheConfig + (*TokenHeader)(nil), // 3: envoy.extensions.filters.http.gcp_authn.v3.TokenHeader + (*v3.HttpUri)(nil), // 4: envoy.config.core.v3.HttpUri + (*v3.RetryPolicy)(nil), // 5: envoy.config.core.v3.RetryPolicy + (*durationpb.Duration)(nil), // 6: google.protobuf.Duration + (*wrapperspb.UInt64Value)(nil), // 7: google.protobuf.UInt64Value +} +var file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_depIdxs = []int32{ + 4, // 0: envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig.http_uri:type_name -> envoy.config.core.v3.HttpUri + 5, // 1: envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig.retry_policy:type_name -> envoy.config.core.v3.RetryPolicy + 2, // 2: envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig.cache_config:type_name -> envoy.extensions.filters.http.gcp_authn.v3.TokenCacheConfig + 3, // 3: envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig.token_header:type_name -> envoy.extensions.filters.http.gcp_authn.v3.TokenHeader + 6, // 4: envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig.timeout:type_name -> google.protobuf.Duration + 7, // 5: envoy.extensions.filters.http.gcp_authn.v3.TokenCacheConfig.cache_size:type_name -> google.protobuf.UInt64Value + 6, // [6:6] is the sub-list for method output_type + 6, // [6:6] is the sub-list for method input_type + 6, // [6:6] is the sub-list for extension type_name + 6, // [6:6] is the sub-list for extension extendee + 0, // [0:6] is the sub-list for field type_name +} + +func init() { file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_init() } +func file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_init() { + if File_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto != nil { + return + } + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDesc), len(file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_rawDesc)), + NumEnums: 0, + NumMessages: 4, + NumExtensions: 0, + NumServices: 0, + }, + GoTypes: file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_goTypes, + DependencyIndexes: file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_depIdxs, + MessageInfos: file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_msgTypes, + }.Build() + File_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto = out.File + file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_goTypes = nil + file_envoy_extensions_filters_http_gcp_authn_v3_gcp_authn_proto_depIdxs = nil +} diff --git a/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.pb.validate.go b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.pb.validate.go new file mode 100644 index 00000000..340cc275 --- /dev/null +++ b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.pb.validate.go @@ -0,0 +1,649 @@ +//go:build !disable_pgv +// Code generated by protoc-gen-validate. DO NOT EDIT. +// source: envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto + +package gcp_authnv3 + +import ( + "bytes" + "errors" + "fmt" + "net" + "net/mail" + "net/url" + "regexp" + "sort" + "strings" + "time" + "unicode/utf8" + + "google.golang.org/protobuf/types/known/anypb" +) + +// ensure the imports are used +var ( + _ = bytes.MinRead + _ = errors.New("") + _ = fmt.Print + _ = utf8.UTFMax + _ = (*regexp.Regexp)(nil) + _ = (*strings.Reader)(nil) + _ = net.IPv4len + _ = time.Duration(0) + _ = (*url.URL)(nil) + _ = (*mail.Address)(nil) + _ = anypb.Any{} + _ = sort.Sort +) + +// Validate checks the field values on GcpAuthnFilterConfig with the rules +// defined in the proto definition for this message. If any rules are +// violated, the first error encountered is returned, or nil if there are no violations. +func (m *GcpAuthnFilterConfig) Validate() error { + return m.validate(false) +} + +// ValidateAll checks the field values on GcpAuthnFilterConfig with the rules +// defined in the proto definition for this message. If any rules are +// violated, the result is a list of violation errors wrapped in +// GcpAuthnFilterConfigMultiError, or nil if none found. +func (m *GcpAuthnFilterConfig) ValidateAll() error { + return m.validate(true) +} + +func (m *GcpAuthnFilterConfig) validate(all bool) error { + if m == nil { + return nil + } + + var errors []error + + if all { + switch v := interface{}(m.GetHttpUri()).(type) { + case interface{ ValidateAll() error }: + if err := v.ValidateAll(); err != nil { + errors = append(errors, GcpAuthnFilterConfigValidationError{ + field: "HttpUri", + reason: "embedded message failed validation", + cause: err, + }) + } + case interface{ Validate() error }: + if err := v.Validate(); err != nil { + errors = append(errors, GcpAuthnFilterConfigValidationError{ + field: "HttpUri", + reason: "embedded message failed validation", + cause: err, + }) + } + } + } else if v, ok := interface{}(m.GetHttpUri()).(interface{ Validate() error }); ok { + if err := v.Validate(); err != nil { + return GcpAuthnFilterConfigValidationError{ + field: "HttpUri", + reason: "embedded message failed validation", + cause: err, + } + } + } + + if all { + switch v := interface{}(m.GetRetryPolicy()).(type) { + case interface{ ValidateAll() error }: + if err := v.ValidateAll(); err != nil { + errors = append(errors, GcpAuthnFilterConfigValidationError{ + field: "RetryPolicy", + reason: "embedded message failed validation", + cause: err, + }) + } + case interface{ Validate() error }: + if err := v.Validate(); err != nil { + errors = append(errors, GcpAuthnFilterConfigValidationError{ + field: "RetryPolicy", + reason: "embedded message failed validation", + cause: err, + }) + } + } + } else if v, ok := interface{}(m.GetRetryPolicy()).(interface{ Validate() error }); ok { + if err := v.Validate(); err != nil { + return GcpAuthnFilterConfigValidationError{ + field: "RetryPolicy", + reason: "embedded message failed validation", + cause: err, + } + } + } + + if all { + switch v := interface{}(m.GetCacheConfig()).(type) { + case interface{ ValidateAll() error }: + if err := v.ValidateAll(); err != nil { + errors = append(errors, GcpAuthnFilterConfigValidationError{ + field: "CacheConfig", + reason: "embedded message failed validation", + cause: err, + }) + } + case interface{ Validate() error }: + if err := v.Validate(); err != nil { + errors = append(errors, GcpAuthnFilterConfigValidationError{ + field: "CacheConfig", + reason: "embedded message failed validation", + cause: err, + }) + } + } + } else if v, ok := interface{}(m.GetCacheConfig()).(interface{ Validate() error }); ok { + if err := v.Validate(); err != nil { + return GcpAuthnFilterConfigValidationError{ + field: "CacheConfig", + reason: "embedded message failed validation", + cause: err, + } + } + } + + if all { + switch v := interface{}(m.GetTokenHeader()).(type) { + case interface{ ValidateAll() error }: + if err := v.ValidateAll(); err != nil { + errors = append(errors, GcpAuthnFilterConfigValidationError{ + field: "TokenHeader", + reason: "embedded message failed validation", + cause: err, + }) + } + case interface{ Validate() error }: + if err := v.Validate(); err != nil { + errors = append(errors, GcpAuthnFilterConfigValidationError{ + field: "TokenHeader", + reason: "embedded message failed validation", + cause: err, + }) + } + } + } else if v, ok := interface{}(m.GetTokenHeader()).(interface{ Validate() error }); ok { + if err := v.Validate(); err != nil { + return GcpAuthnFilterConfigValidationError{ + field: "TokenHeader", + reason: "embedded message failed validation", + cause: err, + } + } + } + + // no validation rules for Cluster + + if d := m.GetTimeout(); d != nil { + dur, err := d.AsDuration(), d.CheckValid() + if err != nil { + err = GcpAuthnFilterConfigValidationError{ + field: "Timeout", + reason: "value is not a valid duration", + cause: err, + } + if !all { + return err + } + errors = append(errors, err) + } else { + + lt := time.Duration(4294967296*time.Second + 0*time.Nanosecond) + gte := time.Duration(0*time.Second + 0*time.Nanosecond) + + if dur < gte || dur >= lt { + err := GcpAuthnFilterConfigValidationError{ + field: "Timeout", + reason: "value must be inside range [0s, 1193046h28m16s)", + } + if !all { + return err + } + errors = append(errors, err) + } + + } + } + + if len(errors) > 0 { + return GcpAuthnFilterConfigMultiError(errors) + } + + return nil +} + +// GcpAuthnFilterConfigMultiError is an error wrapping multiple validation +// errors returned by GcpAuthnFilterConfig.ValidateAll() if the designated +// constraints aren't met. +type GcpAuthnFilterConfigMultiError []error + +// Error returns a concatenation of all the error messages it wraps. +func (m GcpAuthnFilterConfigMultiError) Error() string { + msgs := make([]string, 0, len(m)) + for _, err := range m { + msgs = append(msgs, err.Error()) + } + return strings.Join(msgs, "; ") +} + +// AllErrors returns a list of validation violation errors. +func (m GcpAuthnFilterConfigMultiError) AllErrors() []error { return m } + +// GcpAuthnFilterConfigValidationError is the validation error returned by +// GcpAuthnFilterConfig.Validate if the designated constraints aren't met. +type GcpAuthnFilterConfigValidationError struct { + field string + reason string + cause error + key bool +} + +// Field function returns field value. +func (e GcpAuthnFilterConfigValidationError) Field() string { return e.field } + +// Reason function returns reason value. +func (e GcpAuthnFilterConfigValidationError) Reason() string { return e.reason } + +// Cause function returns cause value. +func (e GcpAuthnFilterConfigValidationError) Cause() error { return e.cause } + +// Key function returns key value. +func (e GcpAuthnFilterConfigValidationError) Key() bool { return e.key } + +// ErrorName returns error name. +func (e GcpAuthnFilterConfigValidationError) ErrorName() string { + return "GcpAuthnFilterConfigValidationError" +} + +// Error satisfies the builtin error interface +func (e GcpAuthnFilterConfigValidationError) Error() string { + cause := "" + if e.cause != nil { + cause = fmt.Sprintf(" | caused by: %v", e.cause) + } + + key := "" + if e.key { + key = "key for " + } + + return fmt.Sprintf( + "invalid %sGcpAuthnFilterConfig.%s: %s%s", + key, + e.field, + e.reason, + cause) +} + +var _ error = GcpAuthnFilterConfigValidationError{} + +var _ interface { + Field() string + Reason() string + Key() bool + Cause() error + ErrorName() string +} = GcpAuthnFilterConfigValidationError{} + +// Validate checks the field values on Audience with the rules defined in the +// proto definition for this message. If any rules are violated, the first +// error encountered is returned, or nil if there are no violations. +func (m *Audience) Validate() error { + return m.validate(false) +} + +// ValidateAll checks the field values on Audience with the rules defined in +// the proto definition for this message. If any rules are violated, the +// result is a list of violation errors wrapped in AudienceMultiError, or nil +// if none found. +func (m *Audience) ValidateAll() error { + return m.validate(true) +} + +func (m *Audience) validate(all bool) error { + if m == nil { + return nil + } + + var errors []error + + if utf8.RuneCountInString(m.GetUrl()) < 1 { + err := AudienceValidationError{ + field: "Url", + reason: "value length must be at least 1 runes", + } + if !all { + return err + } + errors = append(errors, err) + } + + if len(errors) > 0 { + return AudienceMultiError(errors) + } + + return nil +} + +// AudienceMultiError is an error wrapping multiple validation errors returned +// by Audience.ValidateAll() if the designated constraints aren't met. +type AudienceMultiError []error + +// Error returns a concatenation of all the error messages it wraps. +func (m AudienceMultiError) Error() string { + msgs := make([]string, 0, len(m)) + for _, err := range m { + msgs = append(msgs, err.Error()) + } + return strings.Join(msgs, "; ") +} + +// AllErrors returns a list of validation violation errors. +func (m AudienceMultiError) AllErrors() []error { return m } + +// AudienceValidationError is the validation error returned by +// Audience.Validate if the designated constraints aren't met. +type AudienceValidationError struct { + field string + reason string + cause error + key bool +} + +// Field function returns field value. +func (e AudienceValidationError) Field() string { return e.field } + +// Reason function returns reason value. +func (e AudienceValidationError) Reason() string { return e.reason } + +// Cause function returns cause value. +func (e AudienceValidationError) Cause() error { return e.cause } + +// Key function returns key value. +func (e AudienceValidationError) Key() bool { return e.key } + +// ErrorName returns error name. +func (e AudienceValidationError) ErrorName() string { return "AudienceValidationError" } + +// Error satisfies the builtin error interface +func (e AudienceValidationError) Error() string { + cause := "" + if e.cause != nil { + cause = fmt.Sprintf(" | caused by: %v", e.cause) + } + + key := "" + if e.key { + key = "key for " + } + + return fmt.Sprintf( + "invalid %sAudience.%s: %s%s", + key, + e.field, + e.reason, + cause) +} + +var _ error = AudienceValidationError{} + +var _ interface { + Field() string + Reason() string + Key() bool + Cause() error + ErrorName() string +} = AudienceValidationError{} + +// Validate checks the field values on TokenCacheConfig with the rules defined +// in the proto definition for this message. If any rules are violated, the +// first error encountered is returned, or nil if there are no violations. +func (m *TokenCacheConfig) Validate() error { + return m.validate(false) +} + +// ValidateAll checks the field values on TokenCacheConfig with the rules +// defined in the proto definition for this message. If any rules are +// violated, the result is a list of violation errors wrapped in +// TokenCacheConfigMultiError, or nil if none found. +func (m *TokenCacheConfig) ValidateAll() error { + return m.validate(true) +} + +func (m *TokenCacheConfig) validate(all bool) error { + if m == nil { + return nil + } + + var errors []error + + if wrapper := m.GetCacheSize(); wrapper != nil { + + if wrapper.GetValue() > 9223372036854775807 { + err := TokenCacheConfigValidationError{ + field: "CacheSize", + reason: "value must be less than or equal to 9223372036854775807", + } + if !all { + return err + } + errors = append(errors, err) + } + + } + + if len(errors) > 0 { + return TokenCacheConfigMultiError(errors) + } + + return nil +} + +// TokenCacheConfigMultiError is an error wrapping multiple validation errors +// returned by TokenCacheConfig.ValidateAll() if the designated constraints +// aren't met. +type TokenCacheConfigMultiError []error + +// Error returns a concatenation of all the error messages it wraps. +func (m TokenCacheConfigMultiError) Error() string { + msgs := make([]string, 0, len(m)) + for _, err := range m { + msgs = append(msgs, err.Error()) + } + return strings.Join(msgs, "; ") +} + +// AllErrors returns a list of validation violation errors. +func (m TokenCacheConfigMultiError) AllErrors() []error { return m } + +// TokenCacheConfigValidationError is the validation error returned by +// TokenCacheConfig.Validate if the designated constraints aren't met. +type TokenCacheConfigValidationError struct { + field string + reason string + cause error + key bool +} + +// Field function returns field value. +func (e TokenCacheConfigValidationError) Field() string { return e.field } + +// Reason function returns reason value. +func (e TokenCacheConfigValidationError) Reason() string { return e.reason } + +// Cause function returns cause value. +func (e TokenCacheConfigValidationError) Cause() error { return e.cause } + +// Key function returns key value. +func (e TokenCacheConfigValidationError) Key() bool { return e.key } + +// ErrorName returns error name. +func (e TokenCacheConfigValidationError) ErrorName() string { return "TokenCacheConfigValidationError" } + +// Error satisfies the builtin error interface +func (e TokenCacheConfigValidationError) Error() string { + cause := "" + if e.cause != nil { + cause = fmt.Sprintf(" | caused by: %v", e.cause) + } + + key := "" + if e.key { + key = "key for " + } + + return fmt.Sprintf( + "invalid %sTokenCacheConfig.%s: %s%s", + key, + e.field, + e.reason, + cause) +} + +var _ error = TokenCacheConfigValidationError{} + +var _ interface { + Field() string + Reason() string + Key() bool + Cause() error + ErrorName() string +} = TokenCacheConfigValidationError{} + +// Validate checks the field values on TokenHeader with the rules defined in +// the proto definition for this message. If any rules are violated, the first +// error encountered is returned, or nil if there are no violations. +func (m *TokenHeader) Validate() error { + return m.validate(false) +} + +// ValidateAll checks the field values on TokenHeader with the rules defined in +// the proto definition for this message. If any rules are violated, the +// result is a list of violation errors wrapped in TokenHeaderMultiError, or +// nil if none found. +func (m *TokenHeader) ValidateAll() error { + return m.validate(true) +} + +func (m *TokenHeader) validate(all bool) error { + if m == nil { + return nil + } + + var errors []error + + if utf8.RuneCountInString(m.GetName()) < 1 { + err := TokenHeaderValidationError{ + field: "Name", + reason: "value length must be at least 1 runes", + } + if !all { + return err + } + errors = append(errors, err) + } + + if !_TokenHeader_Name_Pattern.MatchString(m.GetName()) { + err := TokenHeaderValidationError{ + field: "Name", + reason: "value does not match regex pattern \"^[^\\x00\\n\\r]*$\"", + } + if !all { + return err + } + errors = append(errors, err) + } + + if !_TokenHeader_ValuePrefix_Pattern.MatchString(m.GetValuePrefix()) { + err := TokenHeaderValidationError{ + field: "ValuePrefix", + reason: "value does not match regex pattern \"^[^\\x00\\n\\r]*$\"", + } + if !all { + return err + } + errors = append(errors, err) + } + + if len(errors) > 0 { + return TokenHeaderMultiError(errors) + } + + return nil +} + +// TokenHeaderMultiError is an error wrapping multiple validation errors +// returned by TokenHeader.ValidateAll() if the designated constraints aren't met. +type TokenHeaderMultiError []error + +// Error returns a concatenation of all the error messages it wraps. +func (m TokenHeaderMultiError) Error() string { + msgs := make([]string, 0, len(m)) + for _, err := range m { + msgs = append(msgs, err.Error()) + } + return strings.Join(msgs, "; ") +} + +// AllErrors returns a list of validation violation errors. +func (m TokenHeaderMultiError) AllErrors() []error { return m } + +// TokenHeaderValidationError is the validation error returned by +// TokenHeader.Validate if the designated constraints aren't met. +type TokenHeaderValidationError struct { + field string + reason string + cause error + key bool +} + +// Field function returns field value. +func (e TokenHeaderValidationError) Field() string { return e.field } + +// Reason function returns reason value. +func (e TokenHeaderValidationError) Reason() string { return e.reason } + +// Cause function returns cause value. +func (e TokenHeaderValidationError) Cause() error { return e.cause } + +// Key function returns key value. +func (e TokenHeaderValidationError) Key() bool { return e.key } + +// ErrorName returns error name. +func (e TokenHeaderValidationError) ErrorName() string { return "TokenHeaderValidationError" } + +// Error satisfies the builtin error interface +func (e TokenHeaderValidationError) Error() string { + cause := "" + if e.cause != nil { + cause = fmt.Sprintf(" | caused by: %v", e.cause) + } + + key := "" + if e.key { + key = "key for " + } + + return fmt.Sprintf( + "invalid %sTokenHeader.%s: %s%s", + key, + e.field, + e.reason, + cause) +} + +var _ error = TokenHeaderValidationError{} + +var _ interface { + Field() string + Reason() string + Key() bool + Cause() error + ErrorName() string +} = TokenHeaderValidationError{} + +var _TokenHeader_Name_Pattern = regexp.MustCompile("^[^\x00\n\r]*$") + +var _TokenHeader_ValuePrefix_Pattern = regexp.MustCompile("^[^\x00\n\r]*$") diff --git a/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn_vtproto.pb.go b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn_vtproto.pb.go new file mode 100644 index 00000000..1b08fd98 --- /dev/null +++ b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn_vtproto.pb.go @@ -0,0 +1,358 @@ +//go:build vtprotobuf +// +build vtprotobuf + +// Code generated by protoc-gen-go-vtproto. DO NOT EDIT. +// source: envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto + +package gcp_authnv3 + +import ( + protohelpers "github.com/planetscale/vtprotobuf/protohelpers" + durationpb "github.com/planetscale/vtprotobuf/types/known/durationpb" + wrapperspb "github.com/planetscale/vtprotobuf/types/known/wrapperspb" + proto "google.golang.org/protobuf/proto" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +func (m *GcpAuthnFilterConfig) MarshalVTStrict() (dAtA []byte, err error) { + if m == nil { + return nil, nil + } + size := m.SizeVT() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size]) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *GcpAuthnFilterConfig) MarshalToVTStrict(dAtA []byte) (int, error) { + size := m.SizeVT() + return m.MarshalToSizedBufferVTStrict(dAtA[:size]) +} + +func (m *GcpAuthnFilterConfig) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) { + if m == nil { + return 0, nil + } + i := len(dAtA) + _ = i + var l int + _ = l + if m.unknownFields != nil { + i -= len(m.unknownFields) + copy(dAtA[i:], m.unknownFields) + } + if m.Timeout != nil { + size, err := (*durationpb.Duration)(m.Timeout).MarshalToSizedBufferVTStrict(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = protohelpers.EncodeVarint(dAtA, i, uint64(size)) + i-- + dAtA[i] = 0x32 + } + if len(m.Cluster) > 0 { + i -= len(m.Cluster) + copy(dAtA[i:], m.Cluster) + i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Cluster))) + i-- + dAtA[i] = 0x2a + } + if m.TokenHeader != nil { + size, err := m.TokenHeader.MarshalToSizedBufferVTStrict(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = protohelpers.EncodeVarint(dAtA, i, uint64(size)) + i-- + dAtA[i] = 0x22 + } + if m.CacheConfig != nil { + size, err := m.CacheConfig.MarshalToSizedBufferVTStrict(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = protohelpers.EncodeVarint(dAtA, i, uint64(size)) + i-- + dAtA[i] = 0x1a + } + if m.RetryPolicy != nil { + if vtmsg, ok := interface{}(m.RetryPolicy).(interface { + MarshalToSizedBufferVTStrict([]byte) (int, error) + }); ok { + size, err := vtmsg.MarshalToSizedBufferVTStrict(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = protohelpers.EncodeVarint(dAtA, i, uint64(size)) + } else { + encoded, err := proto.Marshal(m.RetryPolicy) + if err != nil { + return 0, err + } + i -= len(encoded) + copy(dAtA[i:], encoded) + i = protohelpers.EncodeVarint(dAtA, i, uint64(len(encoded))) + } + i-- + dAtA[i] = 0x12 + } + if m.HttpUri != nil { + if vtmsg, ok := interface{}(m.HttpUri).(interface { + MarshalToSizedBufferVTStrict([]byte) (int, error) + }); ok { + size, err := vtmsg.MarshalToSizedBufferVTStrict(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = protohelpers.EncodeVarint(dAtA, i, uint64(size)) + } else { + encoded, err := proto.Marshal(m.HttpUri) + if err != nil { + return 0, err + } + i -= len(encoded) + copy(dAtA[i:], encoded) + i = protohelpers.EncodeVarint(dAtA, i, uint64(len(encoded))) + } + i-- + dAtA[i] = 0xa + } + return len(dAtA) - i, nil +} + +func (m *Audience) MarshalVTStrict() (dAtA []byte, err error) { + if m == nil { + return nil, nil + } + size := m.SizeVT() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size]) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *Audience) MarshalToVTStrict(dAtA []byte) (int, error) { + size := m.SizeVT() + return m.MarshalToSizedBufferVTStrict(dAtA[:size]) +} + +func (m *Audience) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) { + if m == nil { + return 0, nil + } + i := len(dAtA) + _ = i + var l int + _ = l + if m.unknownFields != nil { + i -= len(m.unknownFields) + copy(dAtA[i:], m.unknownFields) + } + if len(m.Url) > 0 { + i -= len(m.Url) + copy(dAtA[i:], m.Url) + i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Url))) + i-- + dAtA[i] = 0xa + } + return len(dAtA) - i, nil +} + +func (m *TokenCacheConfig) MarshalVTStrict() (dAtA []byte, err error) { + if m == nil { + return nil, nil + } + size := m.SizeVT() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size]) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *TokenCacheConfig) MarshalToVTStrict(dAtA []byte) (int, error) { + size := m.SizeVT() + return m.MarshalToSizedBufferVTStrict(dAtA[:size]) +} + +func (m *TokenCacheConfig) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) { + if m == nil { + return 0, nil + } + i := len(dAtA) + _ = i + var l int + _ = l + if m.unknownFields != nil { + i -= len(m.unknownFields) + copy(dAtA[i:], m.unknownFields) + } + if m.CacheSize != nil { + size, err := (*wrapperspb.UInt64Value)(m.CacheSize).MarshalToSizedBufferVTStrict(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = protohelpers.EncodeVarint(dAtA, i, uint64(size)) + i-- + dAtA[i] = 0xa + } + return len(dAtA) - i, nil +} + +func (m *TokenHeader) MarshalVTStrict() (dAtA []byte, err error) { + if m == nil { + return nil, nil + } + size := m.SizeVT() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size]) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *TokenHeader) MarshalToVTStrict(dAtA []byte) (int, error) { + size := m.SizeVT() + return m.MarshalToSizedBufferVTStrict(dAtA[:size]) +} + +func (m *TokenHeader) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) { + if m == nil { + return 0, nil + } + i := len(dAtA) + _ = i + var l int + _ = l + if m.unknownFields != nil { + i -= len(m.unknownFields) + copy(dAtA[i:], m.unknownFields) + } + if len(m.ValuePrefix) > 0 { + i -= len(m.ValuePrefix) + copy(dAtA[i:], m.ValuePrefix) + i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ValuePrefix))) + i-- + dAtA[i] = 0x12 + } + if len(m.Name) > 0 { + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name))) + i-- + dAtA[i] = 0xa + } + return len(dAtA) - i, nil +} + +func (m *GcpAuthnFilterConfig) SizeVT() (n int) { + if m == nil { + return 0 + } + var l int + _ = l + if m.HttpUri != nil { + if size, ok := interface{}(m.HttpUri).(interface { + SizeVT() int + }); ok { + l = size.SizeVT() + } else { + l = proto.Size(m.HttpUri) + } + n += 1 + l + protohelpers.SizeOfVarint(uint64(l)) + } + if m.RetryPolicy != nil { + if size, ok := interface{}(m.RetryPolicy).(interface { + SizeVT() int + }); ok { + l = size.SizeVT() + } else { + l = proto.Size(m.RetryPolicy) + } + n += 1 + l + protohelpers.SizeOfVarint(uint64(l)) + } + if m.CacheConfig != nil { + l = m.CacheConfig.SizeVT() + n += 1 + l + protohelpers.SizeOfVarint(uint64(l)) + } + if m.TokenHeader != nil { + l = m.TokenHeader.SizeVT() + n += 1 + l + protohelpers.SizeOfVarint(uint64(l)) + } + l = len(m.Cluster) + if l > 0 { + n += 1 + l + protohelpers.SizeOfVarint(uint64(l)) + } + if m.Timeout != nil { + l = (*durationpb.Duration)(m.Timeout).SizeVT() + n += 1 + l + protohelpers.SizeOfVarint(uint64(l)) + } + n += len(m.unknownFields) + return n +} + +func (m *Audience) SizeVT() (n int) { + if m == nil { + return 0 + } + var l int + _ = l + l = len(m.Url) + if l > 0 { + n += 1 + l + protohelpers.SizeOfVarint(uint64(l)) + } + n += len(m.unknownFields) + return n +} + +func (m *TokenCacheConfig) SizeVT() (n int) { + if m == nil { + return 0 + } + var l int + _ = l + if m.CacheSize != nil { + l = (*wrapperspb.UInt64Value)(m.CacheSize).SizeVT() + n += 1 + l + protohelpers.SizeOfVarint(uint64(l)) + } + n += len(m.unknownFields) + return n +} + +func (m *TokenHeader) SizeVT() (n int) { + if m == nil { + return 0 + } + var l int + _ = l + l = len(m.Name) + if l > 0 { + n += 1 + l + protohelpers.SizeOfVarint(uint64(l)) + } + l = len(m.ValuePrefix) + if l > 0 { + n += 1 + l + protohelpers.SizeOfVarint(uint64(l)) + } + n += len(m.unknownFields) + return n +} diff --git a/vendor/github.com/googleapis/gax-go/v2/.release-please-manifest.json b/vendor/github.com/googleapis/gax-go/v2/.release-please-manifest.json index 2fcff6e2..90b5af3c 100644 --- a/vendor/github.com/googleapis/gax-go/v2/.release-please-manifest.json +++ b/vendor/github.com/googleapis/gax-go/v2/.release-please-manifest.json @@ -1,3 +1,3 @@ { - "v2": "2.15.0" + "v2": "2.23.0" } diff --git a/vendor/github.com/googleapis/gax-go/v2/CHANGES.md b/vendor/github.com/googleapis/gax-go/v2/CHANGES.md index ed27c5ee..d7559b75 100644 --- a/vendor/github.com/googleapis/gax-go/v2/CHANGES.md +++ b/vendor/github.com/googleapis/gax-go/v2/CHANGES.md @@ -1,5 +1,17 @@ # Changes +## [2.23.0](https://github.com/googleapis/gax-go/compare/v2.22.0...v2.23.0) (2026-07-07) + + +### Features + +* **v2:** add http.response.status_code to TransportTelemetryData ([#513](https://github.com/googleapis/gax-go/issues/513)) ([7d5554f](https://github.com/googleapis/gax-go/commit/7d5554f433f669fba3db5c5b64ed67a30813c568)) + + +### Bug Fixes + +* correct min go version ([#517](https://github.com/googleapis/gax-go/issues/517)) ([fc62896](https://github.com/googleapis/gax-go/commit/fc62896b04d04db85c48585b9311ec4bbee1d9bc)) + ## [2.22.0](https://github.com/googleapis/google-cloud-go/releases/tag/v2.22.0) (2026-04-14) ## [2.21.0](https://github.com/googleapis/google-cloud-go/releases/tag/v2.21.0) (2026-04-01) diff --git a/vendor/github.com/googleapis/gax-go/v2/internal/version.go b/vendor/github.com/googleapis/gax-go/v2/internal/version.go index f324d1ab..d35188c5 100644 --- a/vendor/github.com/googleapis/gax-go/v2/internal/version.go +++ b/vendor/github.com/googleapis/gax-go/v2/internal/version.go @@ -17,4 +17,4 @@ package internal // Version is the current tagged release of the library. -const Version = "2.22.0" +const Version = "2.23.0" diff --git a/vendor/github.com/googleapis/gax-go/v2/release-please-config.json b/vendor/github.com/googleapis/gax-go/v2/release-please-config.json index 61ee266a..80724af0 100644 --- a/vendor/github.com/googleapis/gax-go/v2/release-please-config.json +++ b/vendor/github.com/googleapis/gax-go/v2/release-please-config.json @@ -1,5 +1,5 @@ { - "release-type": "go-yoshi", + "release-type": "go-librarian", "separate-pull-requests": true, "include-component-in-tag": false, "packages": { diff --git a/vendor/github.com/googleapis/gax-go/v2/telemetry.go b/vendor/github.com/googleapis/gax-go/v2/telemetry.go index b849b369..2490c369 100644 --- a/vendor/github.com/googleapis/gax-go/v2/telemetry.go +++ b/vendor/github.com/googleapis/gax-go/v2/telemetry.go @@ -54,8 +54,9 @@ import ( // regardless of any other documented package stability guarantees. // It should not be used by external consumers. type TransportTelemetryData struct { - serverAddress string - serverPort int + serverAddress string + serverPort int + httpStatusCode int } // SetServerAddress sets the server address. @@ -78,6 +79,16 @@ func (d *TransportTelemetryData) SetServerPort(port int) { d.serverPort = port } // regardless of any other documented package stability guarantees. func (d *TransportTelemetryData) ServerPort() int { return d.serverPort } +// SetHTTPStatusCode sets the HTTP status code. +// Experimental: This function is experimental and may be modified or removed in future versions, +// regardless of any other documented package stability guarantees. +func (d *TransportTelemetryData) SetHTTPStatusCode(code int) { d.httpStatusCode = code } + +// HTTPStatusCode returns the HTTP status code. +// Experimental: This function is experimental and may be modified or removed in future versions, +// regardless of any other documented package stability guarantees. +func (d *TransportTelemetryData) HTTPStatusCode() int { return d.httpStatusCode } + // transportTelemetryKey is the private context key used to inject TransportTelemetryData type transportTelemetryKey struct{} @@ -450,6 +461,9 @@ func recordMetric(ctx context.Context, settings CallSettings, d time.Duration, e if td.ServerPort() != 0 { attrs = append(attrs, attribute.Int("server.port", td.ServerPort())) } + if td.HTTPStatusCode() != 0 { + attrs = append(attrs, attribute.Int("http.response.status_code", td.HTTPStatusCode())) + } } if errInfo.ErrorType != "" { diff --git a/vendor/go.opentelemetry.io/contrib/detectors/gcp/version.go b/vendor/go.opentelemetry.io/contrib/detectors/gcp/version.go index d95fcf4d..1b98a97f 100644 --- a/vendor/go.opentelemetry.io/contrib/detectors/gcp/version.go +++ b/vendor/go.opentelemetry.io/contrib/detectors/gcp/version.go @@ -5,7 +5,7 @@ package gcp // import "go.opentelemetry.io/contrib/detectors/gcp" // Version is the current release version of the GCP resource detector. func Version() string { - return "1.42.0" + return "1.43.0" // This string is updated by the pre_release.sh script during release } diff --git a/vendor/google.golang.org/api/internal/version.go b/vendor/google.golang.org/api/internal/version.go index 73cc73c9..146ea7c1 100644 --- a/vendor/google.golang.org/api/internal/version.go +++ b/vendor/google.golang.org/api/internal/version.go @@ -5,4 +5,4 @@ package internal // Version is the current tagged release of the library. -const Version = "0.285.0" +const Version = "0.287.1" diff --git a/vendor/google.golang.org/api/storage/v1/storage-api.json b/vendor/google.golang.org/api/storage/v1/storage-api.json index b32da8f7..e3761497 100644 --- a/vendor/google.golang.org/api/storage/v1/storage-api.json +++ b/vendor/google.golang.org/api/storage/v1/storage-api.json @@ -253,7 +253,7 @@ "location": "northamerica-south1" } ], - "etag": "\"3135343638383433383330343638393536313030\"", + "etag": "\"3137393330363130333534383930343731333832\"", "icons": { "x16": "https://www.google.com/images/icons/product/cloud_storage-16.png", "x32": "https://www.google.com/images/icons/product/cloud_storage-32.png" @@ -4120,99 +4120,6 @@ "https://www.googleapis.com/auth/cloud-platform", "https://www.googleapis.com/auth/devstorage.full_control" ] - }, - "watchAll": { - "description": "Watch for changes on all objects in a bucket.", - "httpMethod": "POST", - "id": "storage.objects.watchAll", - "parameterOrder": [ - "bucket" - ], - "parameters": { - "bucket": { - "description": "Name of the bucket in which to look for objects.", - "location": "path", - "required": true, - "type": "string" - }, - "delimiter": { - "description": "Returns results in a directory-like mode. items will contain only objects whose names, aside from the prefix, do not contain delimiter. Objects whose names, aside from the prefix, contain delimiter will have their name, truncated after the delimiter, returned in prefixes. Duplicate prefixes are omitted.", - "location": "query", - "type": "string" - }, - "endOffset": { - "description": "Filter results to objects whose names are lexicographically before endOffset. If startOffset is also set, the objects listed will have names between startOffset (inclusive) and endOffset (exclusive).", - "location": "query", - "type": "string" - }, - "includeTrailingDelimiter": { - "description": "If true, objects that end in exactly one instance of delimiter will have their metadata included in items in addition to prefixes.", - "location": "query", - "type": "boolean" - }, - "maxResults": { - "default": "1000", - "description": "Maximum number of items plus prefixes to return in a single page of responses. As duplicate prefixes are omitted, fewer total results may be returned than requested. The service will use this parameter or 1,000 items, whichever is smaller.", - "format": "uint32", - "location": "query", - "minimum": "0", - "type": "integer" - }, - "pageToken": { - "description": "A previously-returned page token representing part of the larger set of results to view.", - "location": "query", - "type": "string" - }, - "prefix": { - "description": "Filter results to objects whose names begin with this prefix.", - "location": "query", - "type": "string" - }, - "projection": { - "description": "Set of properties to return. Defaults to noAcl.", - "enum": [ - "full", - "noAcl" - ], - "enumDescriptions": [ - "Include all properties.", - "Omit the owner, acl property." - ], - "location": "query", - "type": "string" - }, - "startOffset": { - "description": "Filter results to objects whose names are lexicographically equal to or after startOffset. If endOffset is also set, the objects listed will have names between startOffset (inclusive) and endOffset (exclusive).", - "location": "query", - "type": "string" - }, - "userProject": { - "description": "The project to be billed for this request. Required for Requester Pays buckets.", - "location": "query", - "type": "string" - }, - "versions": { - "description": "If true, lists all versions of an object as distinct results. The default is false. For more information, see [Object Versioning](https://cloud.google.com/storage/docs/object-versioning).", - "location": "query", - "type": "boolean" - } - }, - "path": "b/{bucket}/o/watch", - "request": { - "$ref": "Channel", - "parameterName": "resource" - }, - "response": { - "$ref": "Channel" - }, - "scopes": [ - "https://www.googleapis.com/auth/cloud-platform", - "https://www.googleapis.com/auth/cloud-platform.read-only", - "https://www.googleapis.com/auth/devstorage.full_control", - "https://www.googleapis.com/auth/devstorage.read_only", - "https://www.googleapis.com/auth/devstorage.read_write" - ], - "supportsSubscription": true } } }, @@ -4605,7 +4512,7 @@ } } }, - "revision": "20260524", + "revision": "20260625", "rootUrl": "https://storage.googleapis.com/", "schemas": { "AdvanceRelocateBucketOperationRequest": { diff --git a/vendor/google.golang.org/api/storage/v1/storage-gen.go b/vendor/google.golang.org/api/storage/v1/storage-gen.go index ec9db608..632149c5 100644 --- a/vendor/google.golang.org/api/storage/v1/storage-gen.go +++ b/vendor/google.golang.org/api/storage/v1/storage-gen.go @@ -1718,9 +1718,6 @@ type Channel struct { Token string `json:"token,omitempty"` // Type: The type of delivery mechanism used for this channel. Type string `json:"type,omitempty"` - - // ServerResponse contains the HTTP response code and headers from the server. - googleapi.ServerResponse `json:"-"` // ForceSendFields is a list of field names (e.g. "Address") to unconditionally // include in API requests. By default, fields with empty or default values are // omitted from API requests. See @@ -12839,197 +12836,6 @@ func (c *ObjectsUpdateCall) Do(opts ...googleapi.CallOption) (*Object, error) { return ret, nil } -type ObjectsWatchAllCall struct { - s *Service - bucket string - channel *Channel - urlParams_ gensupport.URLParams - ctx_ context.Context - header_ http.Header -} - -// WatchAll: Watch for changes on all objects in a bucket. -// -// - bucket: Name of the bucket in which to look for objects. -func (r *ObjectsService) WatchAll(bucket string, channel *Channel) *ObjectsWatchAllCall { - c := &ObjectsWatchAllCall{s: r.s, urlParams_: make(gensupport.URLParams)} - c.bucket = bucket - c.channel = channel - return c -} - -// Delimiter sets the optional parameter "delimiter": Returns results in a -// directory-like mode. items will contain only objects whose names, aside from -// the prefix, do not contain delimiter. Objects whose names, aside from the -// prefix, contain delimiter will have their name, truncated after the -// delimiter, returned in prefixes. Duplicate prefixes are omitted. -func (c *ObjectsWatchAllCall) Delimiter(delimiter string) *ObjectsWatchAllCall { - c.urlParams_.Set("delimiter", delimiter) - return c -} - -// EndOffset sets the optional parameter "endOffset": Filter results to objects -// whose names are lexicographically before endOffset. If startOffset is also -// set, the objects listed will have names between startOffset (inclusive) and -// endOffset (exclusive). -func (c *ObjectsWatchAllCall) EndOffset(endOffset string) *ObjectsWatchAllCall { - c.urlParams_.Set("endOffset", endOffset) - return c -} - -// IncludeTrailingDelimiter sets the optional parameter -// "includeTrailingDelimiter": If true, objects that end in exactly one -// instance of delimiter will have their metadata included in items in addition -// to prefixes. -func (c *ObjectsWatchAllCall) IncludeTrailingDelimiter(includeTrailingDelimiter bool) *ObjectsWatchAllCall { - c.urlParams_.Set("includeTrailingDelimiter", fmt.Sprint(includeTrailingDelimiter)) - return c -} - -// MaxResults sets the optional parameter "maxResults": Maximum number of items -// plus prefixes to return in a single page of responses. As duplicate prefixes -// are omitted, fewer total results may be returned than requested. The service -// will use this parameter or 1,000 items, whichever is smaller. -func (c *ObjectsWatchAllCall) MaxResults(maxResults int64) *ObjectsWatchAllCall { - c.urlParams_.Set("maxResults", fmt.Sprint(maxResults)) - return c -} - -// PageToken sets the optional parameter "pageToken": A previously-returned -// page token representing part of the larger set of results to view. -func (c *ObjectsWatchAllCall) PageToken(pageToken string) *ObjectsWatchAllCall { - c.urlParams_.Set("pageToken", pageToken) - return c -} - -// Prefix sets the optional parameter "prefix": Filter results to objects whose -// names begin with this prefix. -func (c *ObjectsWatchAllCall) Prefix(prefix string) *ObjectsWatchAllCall { - c.urlParams_.Set("prefix", prefix) - return c -} - -// Projection sets the optional parameter "projection": Set of properties to -// return. Defaults to noAcl. -// -// Possible values: -// -// "full" - Include all properties. -// "noAcl" - Omit the owner, acl property. -func (c *ObjectsWatchAllCall) Projection(projection string) *ObjectsWatchAllCall { - c.urlParams_.Set("projection", projection) - return c -} - -// StartOffset sets the optional parameter "startOffset": Filter results to -// objects whose names are lexicographically equal to or after startOffset. If -// endOffset is also set, the objects listed will have names between -// startOffset (inclusive) and endOffset (exclusive). -func (c *ObjectsWatchAllCall) StartOffset(startOffset string) *ObjectsWatchAllCall { - c.urlParams_.Set("startOffset", startOffset) - return c -} - -// UserProject sets the optional parameter "userProject": The project to be -// billed for this request. Required for Requester Pays buckets. -func (c *ObjectsWatchAllCall) UserProject(userProject string) *ObjectsWatchAllCall { - c.urlParams_.Set("userProject", userProject) - return c -} - -// Versions sets the optional parameter "versions": If true, lists all versions -// of an object as distinct results. The default is false. For more -// information, see Object Versioning -// (https://cloud.google.com/storage/docs/object-versioning). -func (c *ObjectsWatchAllCall) Versions(versions bool) *ObjectsWatchAllCall { - c.urlParams_.Set("versions", fmt.Sprint(versions)) - return c -} - -// Fields allows partial responses to be retrieved. See -// https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more -// details. -func (c *ObjectsWatchAllCall) Fields(s ...googleapi.Field) *ObjectsWatchAllCall { - c.urlParams_.Set("fields", googleapi.CombineFields(s)) - return c -} - -// Context sets the context to be used in this call's Do method. -func (c *ObjectsWatchAllCall) Context(ctx context.Context) *ObjectsWatchAllCall { - c.ctx_ = ctx - return c -} - -// Header returns a http.Header that can be modified by the caller to add -// headers to the request. -func (c *ObjectsWatchAllCall) Header() http.Header { - if c.header_ == nil { - c.header_ = make(http.Header) - } - return c.header_ -} - -func (c *ObjectsWatchAllCall) doRequest(alt string) (*http.Response, error) { - reqHeaders := gensupport.SetHeaders(c.s.userAgent(), "application/json", c.header_) - body, err := googleapi.WithoutDataWrapper.JSONBuffer(c.channel) - if err != nil { - return nil, err - } - c.urlParams_.Set("alt", alt) - c.urlParams_.Set("prettyPrint", "false") - urls := googleapi.ResolveRelative(c.s.BasePath, "b/{bucket}/o/watch") - urls += "?" + c.urlParams_.Encode() - req, err := http.NewRequest("POST", urls, body) - if err != nil { - return nil, err - } - req.Header = reqHeaders - googleapi.Expand(req.URL, map[string]string{ - "bucket": c.bucket, - }) - c.s.logger.DebugContext(c.ctx_, "api request", "serviceName", apiName, "rpcName", "storage.objects.watchAll", "request", internallog.HTTPRequest(req, body.Bytes())) - return gensupport.SendRequest(c.ctx_, c.s.client, req) -} - -// Do executes the "storage.objects.watchAll" call. -// Any non-2xx status code is an error. Response headers are in either -// *Channel.ServerResponse.Header or (if a response was returned at all) in -// error.(*googleapi.Error).Header. Use googleapi.IsNotModified to check -// whether the returned error was because http.StatusNotModified was returned. -func (c *ObjectsWatchAllCall) Do(opts ...googleapi.CallOption) (*Channel, error) { - gensupport.SetOptions(c.urlParams_, opts...) - res, err := c.doRequest("json") - if res != nil && res.StatusCode == http.StatusNotModified { - if res.Body != nil { - res.Body.Close() - } - return nil, gensupport.WrapError(&googleapi.Error{ - Code: res.StatusCode, - Header: res.Header, - }) - } - if err != nil { - return nil, err - } - defer googleapi.CloseBody(res) - if err := googleapi.CheckResponse(res); err != nil { - return nil, gensupport.WrapError(err) - } - ret := &Channel{ - ServerResponse: googleapi.ServerResponse{ - Header: res.Header, - HTTPStatusCode: res.StatusCode, - }, - } - target := &ret - b, err := gensupport.DecodeResponseBytes(target, res) - if err != nil { - return nil, err - } - c.s.logger.DebugContext(c.ctx_, "api response", "serviceName", apiName, "rpcName", "storage.objects.watchAll", "response", internallog.HTTPResponse(res, b)) - return ret, nil -} - type OperationsAdvanceRelocateBucketCall struct { s *Service bucket string diff --git a/vendor/google.golang.org/grpc/balancer/balancer.go b/vendor/google.golang.org/grpc/balancer/balancer.go index 326888ae..7e3dbaad 100644 --- a/vendor/google.golang.org/grpc/balancer/balancer.go +++ b/vendor/google.golang.org/grpc/balancer/balancer.go @@ -60,7 +60,7 @@ func Register(b Builder) { if !envconfig.CaseSensitiveBalancerRegistries { name = strings.ToLower(name) if name != b.Name() { - logger.Warningf("Balancer registered with name %q. grpc-go will be switching to case sensitive balancer registries soon. After 2 releases, we will enable the env var by default.", b.Name()) + logger.Warningf("Balancer registered with name %q. grpc-go has switched to case sensitive balancer registries. GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES env variable will be removed in release v1.82.0", b.Name()) } } m[name] = b @@ -85,7 +85,7 @@ func Get(name string) Builder { if !envconfig.CaseSensitiveBalancerRegistries { lowerName := strings.ToLower(name) if lowerName != name { - logger.Warningf("Balancer retrieved for name %q. grpc-go will be switching to case sensitive balancer registries soon. After 2 releases, we will enable the env var by default.", name) + logger.Warningf("Balancer retrieved for name %q. grpc-go has switched to case sensitive balancer registries. GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES env variable will be removed in release v1.82.0", name) } name = lowerName } diff --git a/vendor/google.golang.org/grpc/balancer/grpclb/grpc_lb_v1/load_balancer_grpc.pb.go b/vendor/google.golang.org/grpc/balancer/grpclb/grpc_lb_v1/load_balancer_grpc.pb.go index 942b7e96..6aeb8198 100644 --- a/vendor/google.golang.org/grpc/balancer/grpclb/grpc_lb_v1/load_balancer_grpc.pb.go +++ b/vendor/google.golang.org/grpc/balancer/grpclb/grpc_lb_v1/load_balancer_grpc.pb.go @@ -19,7 +19,7 @@ // Code generated by protoc-gen-go-grpc. DO NOT EDIT. // versions: -// - protoc-gen-go-grpc v1.6.1 +// - protoc-gen-go-grpc v1.6.2 // - protoc v5.27.1 // source: grpc/lb/v1/load_balancer.proto diff --git a/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go b/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go index 518a69d5..d48bc304 100644 --- a/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go +++ b/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go @@ -35,9 +35,9 @@ import ( "google.golang.org/grpc/balancer" "google.golang.org/grpc/balancer/pickfirst/internal" "google.golang.org/grpc/connectivity" + "google.golang.org/grpc/experimental/balancer/weight" expstats "google.golang.org/grpc/experimental/stats" "google.golang.org/grpc/grpclog" - "google.golang.org/grpc/internal/balancer/weight" "google.golang.org/grpc/internal/envconfig" internalgrpclog "google.golang.org/grpc/internal/grpclog" "google.golang.org/grpc/internal/pretty" diff --git a/vendor/google.golang.org/grpc/balancer/ringhash/ringhash.go b/vendor/google.golang.org/grpc/balancer/ringhash/ringhash.go index 027b4339..171cdd96 100644 --- a/vendor/google.golang.org/grpc/balancer/ringhash/ringhash.go +++ b/vendor/google.golang.org/grpc/balancer/ringhash/ringhash.go @@ -42,7 +42,7 @@ import ( "google.golang.org/grpc/balancer/lazy" "google.golang.org/grpc/balancer/pickfirst" "google.golang.org/grpc/connectivity" - "google.golang.org/grpc/internal/balancer/weight" + "google.golang.org/grpc/experimental/balancer/weight" "google.golang.org/grpc/internal/grpclog" "google.golang.org/grpc/internal/pretty" iringhash "google.golang.org/grpc/internal/ringhash" diff --git a/vendor/google.golang.org/grpc/balancer/rls/control_channel.go b/vendor/google.golang.org/grpc/balancer/rls/control_channel.go index 60e6a021..844cfc3d 100644 --- a/vendor/google.golang.org/grpc/balancer/rls/control_channel.go +++ b/vendor/google.golang.org/grpc/balancer/rls/control_channel.go @@ -29,7 +29,6 @@ import ( "google.golang.org/grpc/connectivity" "google.golang.org/grpc/credentials/insecure" "google.golang.org/grpc/internal" - "google.golang.org/grpc/internal/buffer" internalgrpclog "google.golang.org/grpc/internal/grpclog" "google.golang.org/grpc/internal/grpcsync" "google.golang.org/grpc/internal/pretty" @@ -39,6 +38,12 @@ import ( var newAdaptiveThrottler = func() adaptiveThrottler { return adaptive.New() } +// newConnectivityStateSubscriber is a variable that can be overridden in tests +// to wrap the connectivity state subscriber for testing purposes. +var newConnectivityStateSubscriber = func(sub grpcsync.Subscriber) grpcsync.Subscriber { + return sub +} + type adaptiveThrottler interface { ShouldThrottle() bool RegisterBackendResponse(throttled bool) @@ -57,12 +62,11 @@ type controlChannel struct { // hammering the RLS service while it is overloaded or down. throttler adaptiveThrottler - cc *grpc.ClientConn - client rlsgrpc.RouteLookupServiceClient - logger *internalgrpclog.PrefixLogger - connectivityStateCh *buffer.Unbounded - unsubscribe func() - monitorDoneCh chan struct{} + cc *grpc.ClientConn + client rlsgrpc.RouteLookupServiceClient + logger *internalgrpclog.PrefixLogger + dropConnStateSubscriber func() + seenTransientFailure bool } // newControlChannel creates a controlChannel to rlsServerName and uses @@ -70,11 +74,9 @@ type controlChannel struct { // gRPC channel. func newControlChannel(rlsServerName, serviceConfig string, rpcTimeout time.Duration, bOpts balancer.BuildOptions, backToReadyFunc func()) (*controlChannel, error) { ctrlCh := &controlChannel{ - rpcTimeout: rpcTimeout, - backToReadyFunc: backToReadyFunc, - throttler: newAdaptiveThrottler(), - connectivityStateCh: buffer.NewUnbounded(), - monitorDoneCh: make(chan struct{}), + rpcTimeout: rpcTimeout, + backToReadyFunc: backToReadyFunc, + throttler: newAdaptiveThrottler(), } ctrlCh.logger = internalgrpclog.NewPrefixLogger(logger, fmt.Sprintf("[rls-control-channel %p] ", ctrlCh)) @@ -88,11 +90,11 @@ func newControlChannel(rlsServerName, serviceConfig string, rpcTimeout time.Dura } // Subscribe to connectivity state before connecting to avoid missing initial // updates, which are only delivered to active subscribers. - ctrlCh.unsubscribe = internal.SubscribeToConnectivityStateChanges.(func(cc *grpc.ClientConn, s grpcsync.Subscriber) func())(ctrlCh.cc, ctrlCh) + subscribe := internal.SubscribeToConnectivityStateChanges.(func(cc *grpc.ClientConn, s grpcsync.Subscriber) func()) + ctrlCh.dropConnStateSubscriber = subscribe(ctrlCh.cc, newConnectivityStateSubscriber(ctrlCh)) ctrlCh.cc.Connect() ctrlCh.client = rlsgrpc.NewRouteLookupServiceClient(ctrlCh.cc) ctrlCh.logger.Infof("Control channel created to RLS server at: %v", rlsServerName) - go ctrlCh.monitorConnectivityState() return ctrlCh, nil } @@ -101,7 +103,37 @@ func (cc *controlChannel) OnMessage(msg any) { if !ok { panic(fmt.Sprintf("Unexpected message type %T , wanted connectectivity.State type", msg)) } - cc.connectivityStateCh.Put(st) + + switch st { + case connectivity.Ready: + // Only reset backoff when transitioning from TRANSIENT_FAILURE to READY. + // This indicates the RLS server has recovered from being unreachable, so + // we reset backoff state in all cache entries to allow pending RPCs to + // proceed immediately. We skip benign transitions like READY → IDLE → READY + // since those don't represent actual failures. + if cc.seenTransientFailure { + if cc.logger.V(2) { + cc.logger.Infof("Control channel back to READY after TRANSIENT_FAILURE") + } + cc.seenTransientFailure = false + if cc.backToReadyFunc != nil { + cc.backToReadyFunc() + } + } else { + if cc.logger.V(2) { + cc.logger.Infof("Control channel is READY") + } + } + case connectivity.TransientFailure: + // Track that we've entered TRANSIENT_FAILURE state so we know to reset + // backoffs when we recover to READY. + cc.logger.Warningf("Control channel is TRANSIENT_FAILURE") + cc.seenTransientFailure = true + default: + if cc.logger.V(2) { + cc.logger.Infof("Control channel connectivity state is %s", st) + } + } } // dialOpts constructs the dial options for the control plane channel. @@ -148,68 +180,8 @@ func (cc *controlChannel) dialOpts(bOpts balancer.BuildOptions, serviceConfig st return dopts, nil } -func (cc *controlChannel) monitorConnectivityState() { - cc.logger.Infof("Starting connectivity state monitoring goroutine") - defer close(cc.monitorDoneCh) - - // Since we use two mechanisms to deal with RLS server being down: - // - adaptive throttling for the channel as a whole - // - exponential backoff on a per-request basis - // we need a way to avoid double-penalizing requests by counting failures - // toward both mechanisms when the RLS server is unreachable. - // - // To accomplish this, we monitor the state of the control plane channel. If - // the state has been TRANSIENT_FAILURE since the last time it was in state - // READY, and it then transitions into state READY, we push on a channel - // which is being read by the LB policy. - // - // The LB the policy will iterate through the cache to reset the backoff - // timeouts in all cache entries. Specifically, this means that it will - // reset the backoff state and cancel the pending backoff timer. Note that - // when cancelling the backoff timer, just like when the backoff timer fires - // normally, a new picker is returned to the channel, to force it to - // re-process any wait-for-ready RPCs that may still be queued if we failed - // them while we were in backoff. However, we should optimize this case by - // returning only one new picker, regardless of how many backoff timers are - // cancelled. - - // Wait for the control channel to become READY for the first time. - for s, ok := <-cc.connectivityStateCh.Get(); s != connectivity.Ready; s, ok = <-cc.connectivityStateCh.Get() { - if !ok { - return - } - - cc.connectivityStateCh.Load() - if s == connectivity.Shutdown { - return - } - } - cc.connectivityStateCh.Load() - cc.logger.Infof("Connectivity state is READY") - - for { - s, ok := <-cc.connectivityStateCh.Get() - if !ok { - return - } - cc.connectivityStateCh.Load() - - if s == connectivity.Shutdown { - return - } - if s == connectivity.Ready { - cc.logger.Infof("Control channel back to READY") - cc.backToReadyFunc() - } - - cc.logger.Infof("Connectivity state is %s", s) - } -} - func (cc *controlChannel) close() { - cc.unsubscribe() - cc.connectivityStateCh.Close() - <-cc.monitorDoneCh + cc.dropConnStateSubscriber() cc.cc.Close() cc.logger.Infof("Shutdown") } diff --git a/vendor/google.golang.org/grpc/credentials/alts/alts.go b/vendor/google.golang.org/grpc/credentials/alts/alts.go index 35539eb1..b8afa917 100644 --- a/vendor/google.golang.org/grpc/credentials/alts/alts.go +++ b/vendor/google.golang.org/grpc/credentials/alts/alts.go @@ -181,16 +181,9 @@ func (g *altsTC) ClientHandshake(ctx context.Context, addr string, rawConn net.C } // Do not close hsConn since it is shared with other handshakes. - // Possible context leak: - // The cancel function for the child context we create will only be - // called a non-nil error is returned. var cancel context.CancelFunc ctx, cancel = context.WithCancel(ctx) - defer func() { - if err != nil { - cancel() - } - }() + defer cancel() opts := handshaker.DefaultClientHandshakerOptions() opts.TargetName = addr @@ -204,11 +197,8 @@ func (g *altsTC) ClientHandshake(ctx context.Context, addr string, rawConn net.C if err != nil { return nil, nil, err } - defer func() { - if err != nil { - chs.Close() - } - }() + // Close the handshaker since we have obtained a connection. + defer chs.Close() secConn, authInfo, err := chs.ClientHandshake(ctx) if err != nil { return nil, nil, err @@ -247,15 +237,12 @@ func (g *altsTC) ServerHandshake(rawConn net.Conn) (_ net.Conn, _ credentials.Au if err != nil { return nil, nil, err } - defer func() { - if err != nil { - shs.Close() - } - }() secConn, authInfo, err := shs.ServerHandshake(ctx) if err != nil { return nil, nil, err } + // Close the handshaker since we have obtained a connection. + defer shs.Close() altsAuthInfo, ok := authInfo.(AuthInfo) if !ok { return nil, nil, errors.New("server-side auth info is not of type alts.AuthInfo") diff --git a/vendor/google.golang.org/grpc/credentials/alts/internal/proto/grpc_gcp/handshaker_grpc.pb.go b/vendor/google.golang.org/grpc/credentials/alts/internal/proto/grpc_gcp/handshaker_grpc.pb.go index 2dee74f1..96a40fc3 100644 --- a/vendor/google.golang.org/grpc/credentials/alts/internal/proto/grpc_gcp/handshaker_grpc.pb.go +++ b/vendor/google.golang.org/grpc/credentials/alts/internal/proto/grpc_gcp/handshaker_grpc.pb.go @@ -17,7 +17,7 @@ // Code generated by protoc-gen-go-grpc. DO NOT EDIT. // versions: -// - protoc-gen-go-grpc v1.6.1 +// - protoc-gen-go-grpc v1.6.2 // - protoc v5.27.1 // source: grpc/gcp/handshaker.proto diff --git a/vendor/google.golang.org/grpc/dialoptions.go b/vendor/google.golang.org/grpc/dialoptions.go index 4ec5f9cd..3af08e1a 100644 --- a/vendor/google.golang.org/grpc/dialoptions.go +++ b/vendor/google.golang.org/grpc/dialoptions.go @@ -173,10 +173,8 @@ func newJoinDialOption(opts ...DialOption) DialOption { // If this option is set to true every connection will release the buffer after // flushing the data on the wire. // -// # Experimental -// -// Notice: This API is EXPERIMENTAL and may be changed or removed in a -// later release. +// Deprecated: shared write buffer is enabled by default. WithSharedWriteBuffer +// will be removed in a future release. func WithSharedWriteBuffer(val bool) DialOption { return newFuncDialOption(func(o *dialOptions) { o.copts.SharedWriteBuffer = val @@ -229,6 +227,14 @@ func WithInitialConnWindowSize(s int32) DialOption { // WithStaticStreamWindowSize returns a DialOption which sets the initial // stream window size to the value provided and disables dynamic flow control. +// +// Note that this also disables dynamic flow control for the connection, +// falling back to a default static connection-level window of 64KB. To +// use a larger connection-level window, you must also use the +// [WithStaticConnWindowSize] DialOption. +// +// Most users should not configure static flow control windows unless +// operating in a memory-constrained environment. func WithStaticStreamWindowSize(s int32) DialOption { return newFuncDialOption(func(o *dialOptions) { o.copts.InitialWindowSize = s @@ -239,6 +245,14 @@ func WithStaticStreamWindowSize(s int32) DialOption { // WithStaticConnWindowSize returns a DialOption which sets the initial // connection window size to the value provided and disables dynamic flow // control. +// +// Note that this also disables dynamic flow control for individual streams, +// falling back to a default static connection-level window of 64KB. To +// explicitly configure the stream-level window size, you must also use the +// [WithStaticStreamWindowSize] DialOption. +// +// Most users should not configure static flow control windows unless +// operating in a memory-constrained environment. func WithStaticConnWindowSize(s int32) DialOption { return newFuncDialOption(func(o *dialOptions) { o.copts.InitialConnWindowSize = s diff --git a/vendor/google.golang.org/grpc/encoding/encoding.go b/vendor/google.golang.org/grpc/encoding/encoding.go index 296f38c3..bfa8b268 100644 --- a/vendor/google.golang.org/grpc/encoding/encoding.go +++ b/vendor/google.golang.org/grpc/encoding/encoding.go @@ -66,6 +66,9 @@ type Compressor interface { // Decompress reads data from r, decompresses it, and provides the // uncompressed data via the returned io.Reader. If an error occurs while // initializing the decompressor, that error is returned instead. + // + // The returned io.Reader may optionally implement io.ReadCloser, and if it + // does, gRPC will call Close() exactly once. Decompress(r io.Reader) (io.Reader, error) // Name is the name of the compression codec and is used to set the content // coding header. The result must be static; the result cannot change diff --git a/vendor/google.golang.org/grpc/encoding/gzip/gzip.go b/vendor/google.golang.org/grpc/encoding/gzip/gzip.go index 153e4dbf..65908d9a 100644 --- a/vendor/google.golang.org/grpc/encoding/gzip/gzip.go +++ b/vendor/google.golang.org/grpc/encoding/gzip/gzip.go @@ -81,6 +81,8 @@ func (z *writer) Close() error { return z.Writer.Close() } +var _ io.Closer = &reader{} + type reader struct { *gzip.Reader pool *sync.Pool @@ -102,14 +104,16 @@ func (c *compressor) Decompress(r io.Reader) (io.Reader, error) { return z, nil } -func (z *reader) Read(p []byte) (n int, err error) { - n, err = z.Reader.Read(p) - if err == io.EOF { - z.pool.Put(z) - } +func (r *reader) Read(p []byte) (n int, err error) { + n, err = r.Reader.Read(p) return n, err } +func (r *reader) Close() error { + defer r.pool.Put(r) + return r.Reader.Close() +} + func (c *compressor) Name() string { return Name } diff --git a/vendor/google.golang.org/grpc/experimental/balancer/hostname/hostname.go b/vendor/google.golang.org/grpc/experimental/balancer/hostname/hostname.go new file mode 100644 index 00000000..f42a7cf2 --- /dev/null +++ b/vendor/google.golang.org/grpc/experimental/balancer/hostname/hostname.go @@ -0,0 +1,47 @@ +/* + * + * Copyright 2026 gRPC authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ + +// Package hostname contains utilities for the endpoint hostname attribute +// (used for per-endpoint :authority / SNI override). +// +// # Experimental +// +// Notice: All APIs in this package are EXPERIMENTAL and may be changed +// or removed in a later release. +package hostname + +import "google.golang.org/grpc/resolver" + +type hostnameKey struct{} + +// Set returns a copy of the given endpoint with the hostname attribute +// set. If hostname is empty the endpoint is returned unmodified. +func Set(endpoint resolver.Endpoint, hostname string) resolver.Endpoint { + if hostname == "" { + return endpoint + } + endpoint.Attributes = endpoint.Attributes.WithValue(hostnameKey{}, hostname) + return endpoint +} + +// FromEndpoint returns the hostname attribute of endpoint. If this +// attribute is not set, it returns the empty string. +func FromEndpoint(endpoint resolver.Endpoint) string { + h, _ := endpoint.Attributes.Value(hostnameKey{}).(string) + return h +} diff --git a/vendor/google.golang.org/grpc/internal/balancer/weight/weight.go b/vendor/google.golang.org/grpc/experimental/balancer/weight/weight.go similarity index 71% rename from vendor/google.golang.org/grpc/internal/balancer/weight/weight.go rename to vendor/google.golang.org/grpc/experimental/balancer/weight/weight.go index 11beb07d..beab9e07 100644 --- a/vendor/google.golang.org/grpc/internal/balancer/weight/weight.go +++ b/vendor/google.golang.org/grpc/experimental/balancer/weight/weight.go @@ -16,23 +16,23 @@ * */ -// Package weight contains utilities to manage endpoint weights. Weights are -// used by LB policies such as ringhash to distribute load across multiple -// endpoints. +// Package weight contains utilities to manage endpoint weights. +// Weights may be used by LB policies to distribute load across +// multiple endpoints. +// +// # Experimental +// +// Notice: All APIs in this package are EXPERIMENTAL and may be changed +// or removed in a later release. package weight -import ( - "fmt" - - "google.golang.org/grpc/resolver" -) +import "google.golang.org/grpc/resolver" // attributeKey is the type used as the key to store EndpointInfo in the // Attributes field of resolver.Endpoint. type attributeKey struct{} -// EndpointInfo will be stored in the Attributes field of Endpoints in order to -// use the ringhash balancer. +// EndpointInfo will be stored in the Attributes field of Endpoints. type EndpointInfo struct { Weight uint32 } @@ -43,22 +43,16 @@ func (a EndpointInfo) Equal(o any) bool { return ok && oa.Weight == a.Weight } -// Set returns a copy of endpoint in which the Attributes field is updated with -// EndpointInfo. +// Set returns a copy of endpoint in which the Attributes field is +// updated with EndpointInfo. func Set(endpoint resolver.Endpoint, epInfo EndpointInfo) resolver.Endpoint { endpoint.Attributes = endpoint.Attributes.WithValue(attributeKey{}, epInfo) return endpoint } -// String returns a human-readable representation of EndpointInfo. -// This method is intended for logging, testing, and debugging purposes only. -// Do not rely on the output format, as it is not guaranteed to remain stable. -func (a EndpointInfo) String() string { - return fmt.Sprintf("Weight: %d", a.Weight) -} - -// FromEndpoint returns the EndpointInfo stored in the Attributes field of an -// endpoint. It returns an empty EndpointInfo if attribute is not found. +// FromEndpoint returns the EndpointInfo stored in the Attributes +// field of an endpoint. It returns an empty EndpointInfo if attribute +// is not found. func FromEndpoint(endpoint resolver.Endpoint) EndpointInfo { v := endpoint.Attributes.Value(attributeKey{}) ei, _ := v.(EndpointInfo) diff --git a/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go b/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go index 8ca87a57..ba05b65d 100644 --- a/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go +++ b/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go @@ -59,6 +59,15 @@ var ( // unconditionally. XDSEndpointHashKeyBackwardCompat = boolFromEnv("GRPC_XDS_ENDPOINT_HASH_KEY_BACKWARD_COMPAT", false) + // LabelServerGoroutines controls setting [runtime/pprof.Labels] on the + // goroutines spawned by [grpc.Server] type. + // For now, this is limited to the goroutines spawned to handle incoming + // requests on the server. + // Set "GRPC_GO_SERVER_GOROUTINE_LABELS" to "grpc.method=true" to + // enable this grpc.method label, or "all" to enable all valid labels. + // This variable is a bit-field. + LabelServerGoroutines = goroutineLabelsFromEnv("GRPC_GO_SERVER_GOROUTINE_LABELS", 0) + // RingHashSetRequestHashKey is set if the ring hash balancer can get the // request hash header by setting the "requestHashHeader" field, according // to gRFC A76. It can be disabled by setting the environment variable @@ -78,12 +87,12 @@ var ( EnableDefaultPortForProxyTarget = boolFromEnv("GRPC_EXPERIMENTAL_ENABLE_DEFAULT_PORT_FOR_PROXY_TARGET", true) // CaseSensitiveBalancerRegistries is set if the balancer registry should be - // case-sensitive. This is disabled by default, but can be enabled by setting + // case-sensitive. This is enabled by default, but can be disabled by setting // the env variable "GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES" - // to "true". + // to "false". // - // TODO: After 2 releases, we will enable the env var by default. - CaseSensitiveBalancerRegistries = boolFromEnv("GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES", false) + // This env varible will be removed in release v1.82.0. + CaseSensitiveBalancerRegistries = boolFromEnv("GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES", true) // XDSAuthorityRewrite indicates whether xDS authority rewriting is enabled. // This feature is defined in gRFC A81 and is enabled by setting the @@ -104,22 +113,6 @@ var ( // to "false". XDSRecoverPanicInResourceParsing = boolFromEnv("GRPC_GO_EXPERIMENTAL_XDS_RESOURCE_PANIC_RECOVERY", true) - // DisableStrictPathChecking indicates whether strict path checking is - // disabled. This feature can be disabled by setting the environment - // variable GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING to "true". - // - // When strict path checking is enabled, gRPC will reject requests with - // paths that do not conform to the gRPC over HTTP/2 specification found at - // https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md. - // - // When disabled, gRPC will allow paths that do not contain a leading slash. - // Enabling strict path checking is recommended for security reasons, as it - // prevents potential path traversal vulnerabilities. - // - // A future release will remove this environment variable, enabling strict - // path checking behavior unconditionally. - DisableStrictPathChecking = boolFromEnv("GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING", false) - // EnablePriorityLBChildPolicyCache controls whether the priority balancer // should cache child balancers that are removed from the LB policy config, // for a period of 15 minutes. This is disabled by default, but can be @@ -127,6 +120,18 @@ var ( // GRPC_EXPERIMENTAL_ENABLE_PRIORITY_LB_CHILD_POLICY_CACHE to true. EnablePriorityLBChildPolicyCache = boolFromEnv("GRPC_EXPERIMENTAL_ENABLE_PRIORITY_LB_CHILD_POLICY_CACHE", false) + // Enable8KBDefaultHeaderListSize indicates that default maximum header list + // size is restricted to 8KB. This is disabled by default, but can be enabled + // by setting the environment variable + // "GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE" to "true". + // When disabled, the default maximum header list size of 16MB is used. + // + // When enabled, RPCs with a total size of headers exceeding 8KB will fail + // unless explicitly configured otherwise by the user. + // + // TODO: In release v1.82.0, env var will be enabled by default. + Enable8KBDefaultHeaderListSize = boolFromEnv("GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE", false) + // EnableHTTPFramerReadBufferPooling enables the use of the // readyreader.Reader interface to perform non-memory-pinning reads, // provided the underlying net.Conn supports it. This reduces memory usage @@ -160,3 +165,52 @@ func uint64FromEnv(envVar string, def, min, max uint64) uint64 { } return v } + +// GoroutineLabels is a bitfield indicating which goroutine labels are enabled. +type GoroutineLabels uint16 + +func goroutineLabelsFromEnv(envVar string, def GoroutineLabels) GoroutineLabels { + val := def + v := os.Getenv(envVar) + if strings.EqualFold(v, "all") { + return AllGoroutineLabels + } else if strings.EqualFold(v, "none") { + return 0 + } + for s := range strings.SplitSeq(v, ",") { + s = strings.TrimSpace(s) + if len(s) == 0 { + continue + } + pre, post, ok := strings.Cut(s, "=") + if !ok { + // no equals sign + continue + } + post = strings.TrimSpace(post) + pre = strings.TrimSpace(pre) + bitDesignator := GoroutineLabels(0) + switch { + case strings.EqualFold(pre, "grpc.method"): + bitDesignator = GoroutineLabelServerMethod + default: + continue + } + if strings.EqualFold(post, "true") { + val |= bitDesignator + } else if strings.EqualFold(post, "false") { + val &^= bitDesignator + } + } + return val +} + +const ( + // GoroutineLabelServerMethod sets the grpc.method label on new + // server-side gRPC streams. + GoroutineLabelServerMethod GoroutineLabels = 1 << iota +) + +// AllGoroutineLabels is an or'd together bitfield of all valid GoroutineLabels +// constant values (above). +const AllGoroutineLabels = GoroutineLabelServerMethod diff --git a/vendor/google.golang.org/grpc/internal/envconfig/xds.go b/vendor/google.golang.org/grpc/internal/envconfig/xds.go index 333d8a0b..a2312f8e 100644 --- a/vendor/google.golang.org/grpc/internal/envconfig/xds.go +++ b/vendor/google.golang.org/grpc/internal/envconfig/xds.go @@ -89,4 +89,14 @@ var ( // filtered and prefix-propagated to the LRS server. For more details, see: // https://github.com/grpc/proposal/blob/master/A85-lrs-custom-metrics-changes.md XDSORCAToLRSPropEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION", false) + + // XDSClientExtProcEnabled indicates whether ExtProc filter is enabled on + // the client side. For more details, see: + // https://github.com/grpc/proposal/blob/master/A93-xds-ext-proc.md + XDSClientExtProcEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_EXT_PROC_ON_CLIENT", false) + + // GCPAuthenticationFilterEnabled enables the xDS GCP Authentication + // filter. For more details, see: + // https://github.com/grpc/proposal/blob/master/A83-xds-gcp-authn-filter.md + GCPAuthenticationFilterEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER", false) ) diff --git a/vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go b/vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go index b25b0bae..1cc43fc6 100644 --- a/vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go +++ b/vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go @@ -39,7 +39,6 @@ func div(d, r time.Duration) int64 { // // https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests func EncodeDuration(t time.Duration) string { - // TODO: This is simplistic and not bandwidth efficient. Improve it. if t <= 0 { return "0n" } diff --git a/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls_grpc.pb.go b/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls_grpc.pb.go index 0386dcf5..0bf8477a 100644 --- a/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls_grpc.pb.go +++ b/vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls_grpc.pb.go @@ -14,7 +14,7 @@ // Code generated by protoc-gen-go-grpc. DO NOT EDIT. // versions: -// - protoc-gen-go-grpc v1.6.1 +// - protoc-gen-go-grpc v1.6.2 // - protoc v5.27.1 // source: grpc/lookup/v1/rls.proto diff --git a/vendor/google.golang.org/grpc/internal/resolver/config_selector.go b/vendor/google.golang.org/grpc/internal/resolver/config_selector.go index 3db62cca..6320e9b5 100644 --- a/vendor/google.golang.org/grpc/internal/resolver/config_selector.go +++ b/vendor/google.golang.org/grpc/internal/resolver/config_selector.go @@ -106,14 +106,24 @@ type ClientStream interface { // ClientInterceptor is an interceptor for gRPC client streams. type ClientInterceptor interface { - // NewStream produces a ClientStream for an RPC which may optionally use - // the provided function to produce a stream for delegation. Note: - // RPCInfo.Context should not be used (will be nil). + // NewStream creates a ClientStream for an RPC. // - // done is invoked when the RPC is finished using its connection, or could - // not be assigned a connection. RPC operations may still occur on - // ClientStream after done is called, since the interceptor is invoked by - // application-layer operations. done must never be nil when called. + // Implementations must delegate stream creation to the provided newStream + // function. To intercept or override stream behavior, implementations + // may wrap the ClientStream returned by the delegate. + // + // Note: RPCInfo.Context is currently unused and will be nil. + // + // The done function is invoked when the RPC has finished using its + // underlying connection or if a connection could not be assigned. Because + // interceptors operate at the application layer, RPC operations may + // continue on the ClientStream even after done has been called. The + // caller must ensure done is non-nil. + // + // To ensure RPC completion notifications propagate through the entire + // interceptor chain, implementations must ensure that the done function + // passed to the delegate newStream invokes the done function passed to + // NewStream. NewStream(ctx context.Context, ri RPCInfo, done func(), newStream func(ctx context.Context, done func()) (ClientStream, error)) (ClientStream, error) // Close closes the interceptor. Once called, no new calls to NewStream are // accepted. Ongoing calls to NewStream are allowed to complete. diff --git a/vendor/google.golang.org/grpc/internal/stats/labels.go b/vendor/google.golang.org/grpc/internal/stats/labels.go index fd33af51..5ea898cb 100644 --- a/vendor/google.golang.org/grpc/internal/stats/labels.go +++ b/vendor/google.golang.org/grpc/internal/stats/labels.go @@ -19,24 +19,56 @@ // Package stats provides internal stats related functionality. package stats -import "context" +import ( + "context" + "maps" +) -// Labels are the labels for metrics. -type Labels struct { - // TelemetryLabels are the telemetry labels to record. - TelemetryLabels map[string]string +// LabelCallback is a function that is executed when telemetry +// label keys are updated. +type LabelCallback func(map[string]string) +type telemetryLabelCallbackKey struct{} + +// UpdateLabels executes registered telemetry callbacks with the update labels. Labels +// are copied before being processed by any callbacks to ensure mutations are not +// shared among derived contexts. +// +// It is the responsibility of the registrant to handle conflicts or label resets. +func UpdateLabels(ctx context.Context, update map[string]string) { + executeTelemetryLabelCallbacks(ctx, update) } -type labelsKey struct{} +// RegisterTelemetryLabelCallback registers a callback function that is executed whenever +// telemetry labels are updated. +func RegisterTelemetryLabelCallback(ctx context.Context, callback LabelCallback) context.Context { + if callback == nil { + return ctx + } + + callbacks, ok := ctx.Value(telemetryLabelCallbackKey{}).([]LabelCallback) + if !ok { + return context.WithValue(ctx, telemetryLabelCallbackKey{}, []LabelCallback{callback}) + } + return context.WithValue(ctx, telemetryLabelCallbackKey{}, append(append([]LabelCallback(nil), callbacks...), callback)) -// GetLabels returns the Labels stored in the context, or nil if there is one. -func GetLabels(ctx context.Context) *Labels { - labels, _ := ctx.Value(labelsKey{}).(*Labels) - return labels } -// SetLabels sets the Labels in the context. -func SetLabels(ctx context.Context, labels *Labels) context.Context { - // could also append - return context.WithValue(ctx, labelsKey{}, labels) +// executeTelemetryLabelCallback runs the registered callbacks in the order they were +// registered on the context with the provided labels. If no callbacks are registered +// it does nothing. +// +// To ensure callbacks do not mutate the state of the provided label map it is copied +// before execution. +func executeTelemetryLabelCallbacks(ctx context.Context, labels map[string]string) { + callbacks, ok := ctx.Value(telemetryLabelCallbackKey{}).([]LabelCallback) + if !ok { + return + } + + labelsCopy := map[string]string{} + maps.Copy(labelsCopy, labels) + for _, callback := range callbacks { + callback(labelsCopy) + } + } diff --git a/vendor/google.golang.org/grpc/internal/transport/client_stream.go b/vendor/google.golang.org/grpc/internal/transport/client_stream.go index cd8152ef..ad382b0f 100644 --- a/vendor/google.golang.org/grpc/internal/transport/client_stream.go +++ b/vendor/google.golang.org/grpc/internal/transport/client_stream.go @@ -19,6 +19,7 @@ package transport import ( + "fmt" "sync/atomic" "golang.org/x/net/http2" @@ -28,6 +29,12 @@ import ( "google.golang.org/grpc/status" ) +// nonGRPCDataMaxLen is the maximum length of nonGRPCDataBuf. +// +// NOTE: If changed this value, you MUST update the corresponding test in: +// - /test/end2end_test.go:TestHTTPServerSendsNonGRPCHeaderSurfaceFurtherData +const nonGRPCDataMaxLen = 1024 + // ClientStream implements streaming functionality for a gRPC client. type ClientStream struct { Stream // Embed for common stream functionality. @@ -46,7 +53,11 @@ type ClientStream struct { // headerValid indicates whether a valid header was received. Only // meaningful after headerChan is closed (always call waitOnHeader() before // reading its value). - headerValid bool + headerValid bool + + nonGRPCStatus *status.Status // the initial status from the non-gRPC response header, finalized with collected data before closing. + nonGRPCDataBuf []byte // stores the data of a non-gRPC response. + noHeaders bool // set if the client never received headers (set only after the stream is done). headerChanClosed uint32 // set when headerChan is closed. Used to avoid closing headerChan multiple times. bytesReceived atomic.Bool // indicates whether any bytes have been received on this stream @@ -54,6 +65,29 @@ type ClientStream struct { statsHandler stats.Handler // nil for internal streams (e.g., health check, ORCA) where telemetry is not supported. } +func (s *ClientStream) startNonGRPCDataCollection(st *status.Status) { + s.nonGRPCStatus = st + s.nonGRPCDataBuf = make([]byte, 0, nonGRPCDataMaxLen) +} + +// finalizeNonGRPCStatus builds the terminal status by appending the collected +// response body to the original non-gRPC status message. +func (s *ClientStream) finalizeNonGRPCStatus() *status.Status { + msg := fmt.Sprintf("%s\ndata: %q", s.nonGRPCStatus.Message(), s.nonGRPCDataBuf) + return status.New(s.nonGRPCStatus.Code(), msg) +} + +// handleNonGRPCData collects non-gRPC body from the given data frame. +// It returns non-nil value when the stream should be closed with it. +func (s *ClientStream) handleNonGRPCData(f *parsedDataFrame) *status.Status { + n := min(f.data.Len(), nonGRPCDataMaxLen-len(s.nonGRPCDataBuf)) + s.nonGRPCDataBuf = append(s.nonGRPCDataBuf, f.data.ReadOnlyData()[0:n]...) + if len(s.nonGRPCDataBuf) >= nonGRPCDataMaxLen || f.StreamEnded() { + return s.finalizeNonGRPCStatus() + } + return nil +} + // Read reads an n byte message from the input stream. func (s *ClientStream) Read(n int) (mem.BufferSlice, error) { b, err := s.Stream.read(n) diff --git a/vendor/google.golang.org/grpc/internal/transport/controlbuf.go b/vendor/google.golang.org/grpc/internal/transport/controlbuf.go index 7efa5247..c5a76b70 100644 --- a/vendor/google.golang.org/grpc/internal/transport/controlbuf.go +++ b/vendor/google.golang.org/grpc/internal/transport/controlbuf.go @@ -956,39 +956,16 @@ func (l *loopyWriter) processData() (bool, error) { // from data is copied to h to make as big as the maximum possible HTTP2 frame // size. - if len(dataItem.h) == 0 && reader.Remaining() == 0 { // Empty data frame - // Client sends out empty data frame with endStream = true - if err := l.framer.writeData(dataItem.streamID, dataItem.endStream, nil); err != nil { - return false, err - } - str.itl.dequeue() // remove the empty data item from stream - reader.Close() - if str.itl.isEmpty() { - str.state = empty - } else if trailer, ok := str.itl.peek().(*headerFrame); ok { // the next item is trailers. - if err := l.writeHeader(trailer.streamID, trailer.endStream, trailer.hf, trailer.onWrite); err != nil { - return false, err - } - if err := l.cleanupStreamHandler(trailer.cleanup); err != nil { - return false, err - } - } else { - l.activeStreams.enqueue(str) - } - return false, nil - } - + isEmpty := len(dataItem.h) == 0 && reader.Remaining() == 0 // Figure out the maximum size we can send maxSize := http2MaxFrameLen - if strQuota := int(l.oiws) - str.bytesOutStanding; strQuota <= 0 { // stream-level flow control. + strQuota := int(l.oiws) - str.bytesOutStanding + if strQuota <= 0 && !isEmpty { // stream-level flow control. str.state = waitingOnStreamQuota return false, nil - } else if maxSize > strQuota { - maxSize = strQuota - } - if maxSize > int(l.sendQuota) { // connection-level flow control. - maxSize = int(l.sendQuota) } + maxSize = min(maxSize, max(strQuota, 0)) + maxSize = min(maxSize, int(l.sendQuota)) // connection-level flow control. // Compute how much of the header and data we can send within quota and max frame length hSize := min(maxSize, len(dataItem.h)) dSize := min(maxSize-hSize, reader.Remaining()) @@ -1039,19 +1016,23 @@ func (l *loopyWriter) processData() (bool, error) { reader.Close() str.itl.dequeue() } + return false, l.updateStreamAfterWrite(str) +} + +func (l *loopyWriter) updateStreamAfterWrite(str *outStream) error { if str.itl.isEmpty() { str.state = empty - } else if trailer, ok := str.itl.peek().(*headerFrame); ok { // The next item is trailers. + } else if trailer, ok := str.itl.peek().(*headerFrame); ok { // the next item is trailers. if err := l.writeHeader(trailer.streamID, trailer.endStream, trailer.hf, trailer.onWrite); err != nil { - return false, err + return err } if err := l.cleanupStreamHandler(trailer.cleanup); err != nil { - return false, err + return err } } else if int(l.oiws)-str.bytesOutStanding <= 0 { // Ran out of stream quota. str.state = waitingOnStreamQuota } else { // Otherwise add it back to the list of active streams. l.activeStreams.enqueue(str) } - return false, nil + return nil } diff --git a/vendor/google.golang.org/grpc/internal/transport/flowcontrol.go b/vendor/google.golang.org/grpc/internal/transport/flowcontrol.go index 7cfbc963..98cef9ec 100644 --- a/vendor/google.golang.org/grpc/internal/transport/flowcontrol.go +++ b/vendor/google.golang.org/grpc/internal/transport/flowcontrol.go @@ -115,7 +115,6 @@ func (f *trInFlow) getSize() uint32 { return atomic.LoadUint32(&f.effectiveWindowSize) } -// TODO(mmukhi): Simplify this code. // inFlow deals with inbound flow control type inFlow struct { mu sync.Mutex @@ -174,14 +173,14 @@ func (f *inFlow) maybeAdjust(n uint32) uint32 { // onData is invoked when some data frame is received. It updates pendingData. func (f *inFlow) onData(n uint32) error { f.mu.Lock() + defer f.mu.Unlock() + f.pendingData += n if f.pendingData+f.pendingUpdate > f.limit+f.delta { limit := f.limit rcvd := f.pendingData + f.pendingUpdate - f.mu.Unlock() return fmt.Errorf("received %d-bytes data exceeding the limit %d bytes", rcvd, limit) } - f.mu.Unlock() return nil } @@ -189,8 +188,9 @@ func (f *inFlow) onData(n uint32) error { // to be sent to the peer. func (f *inFlow) onRead(n uint32) uint32 { f.mu.Lock() + defer f.mu.Unlock() + if f.pendingData == 0 { - f.mu.Unlock() return 0 } f.pendingData -= n @@ -205,9 +205,7 @@ func (f *inFlow) onRead(n uint32) uint32 { if f.pendingUpdate >= f.limit/4 { wu := f.pendingUpdate f.pendingUpdate = 0 - f.mu.Unlock() return wu } - f.mu.Unlock() return 0 } diff --git a/vendor/google.golang.org/grpc/internal/transport/handler_server.go b/vendor/google.golang.org/grpc/internal/transport/handler_server.go index 7ab3422b..a8356c9a 100644 --- a/vendor/google.golang.org/grpc/internal/transport/handler_server.go +++ b/vendor/google.golang.org/grpc/internal/transport/handler_server.go @@ -479,8 +479,8 @@ func (ht *serverHandlerTransport) runStream() { func (ht *serverHandlerTransport) incrMsgRecv() {} -func (ht *serverHandlerTransport) Drain(string) { - panic("Drain() is not implemented") +func (ht *serverHandlerTransport) Drain(s string) { + ht.Close(errors.New(s)) } // mapRecvMsgError returns the non-nil err into the appropriate diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_client.go b/vendor/google.golang.org/grpc/internal/transport/http2_client.go index d6bc6a6c..133f5d70 100644 --- a/vendor/google.golang.org/grpc/internal/transport/http2_client.go +++ b/vendor/google.golang.org/grpc/internal/transport/http2_client.go @@ -39,6 +39,7 @@ import ( "google.golang.org/grpc/internal" "google.golang.org/grpc/internal/channelz" icredentials "google.golang.org/grpc/internal/credentials" + "google.golang.org/grpc/internal/envconfig" "google.golang.org/grpc/internal/grpclog" "google.golang.org/grpc/internal/grpcsync" "google.golang.org/grpc/internal/grpcutil" @@ -318,7 +319,13 @@ func NewHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts } writeBufSize := opts.WriteBufferSize readBufSize := opts.ReadBufferSize + // The default header list size is moving from 16MB to 8KB. The 8KB limit + // is only used if Enable8KBDefaultHeaderListSize is true; otherwise, the + // old 16MB default is used. User-specified options always take precedence. maxHeaderListSize := defaultClientMaxHeaderListSize + if envconfig.Enable8KBDefaultHeaderListSize { + maxHeaderListSize = upcomingDefaultHeaderListSize + } if opts.MaxHeaderListSize != nil { maxHeaderListSize = *opts.MaxHeaderListSize } @@ -879,8 +886,8 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr, handler s return false } } - if sz > int64(upcomingDefaultHeaderListSize) { - t.logger.Warningf("Header list size to send (%d bytes) is larger than the upcoming default limit (%d bytes). In a future release, this will be restricted to %d bytes.", sz, upcomingDefaultHeaderListSize, upcomingDefaultHeaderListSize) + if !envconfig.Enable8KBDefaultHeaderListSize && sz > int64(upcomingDefaultHeaderListSize) { + t.logger.Warningf("Header list size to send (%d bytes) is larger than the upcoming default limit (%d bytes). In release v1.82.0, GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE will be enabled by default, enforcing this limit.", sz, upcomingDefaultHeaderListSize) } return true } @@ -1224,6 +1231,23 @@ func (t *http2Client) handleData(f *parsedDataFrame) { t.closeStream(s, io.EOF, true, http2.ErrCodeFlowControl, status.New(codes.Internal, err.Error()), nil, false) return } + + if s.nonGRPCStatus != nil { + // The frame should be handled as a non-gRPC response body + st := s.handleNonGRPCData(f) + if st != nil { + t.closeStream(s, st.Err(), true, http2.ErrCodeProtocol, st, nil, true) + return + } + if w := s.fc.onRead(size); w > 0 { + t.controlBuf.put(&outgoingWindowUpdate{ + streamID: s.id, + increment: w, + }) + } + return + } + dataLen := f.data.Len() if f.Header().Flags.Has(http2.FlagDataPadded) { if w := s.fc.onRead(size - uint32(dataLen)); w > 0 { @@ -1468,6 +1492,17 @@ func (t *http2Client) operateHeaders(frame *http2.MetaHeadersFrame) { return } + // If we are collecting non-gRPC response data and receive a trailing + // HEADERS frame with END_STREAM, finalize the buffered data and close + // the stream. + if s.nonGRPCStatus != nil { + if endStream { + st := s.finalizeNonGRPCStatus() + t.closeStream(s, st.Err(), true, http2.ErrCodeProtocol, st, nil, true) + } + return + } + var ( // If a gRPC Response-Headers has already been received, then it means // that the peer is speaking gRPC and we are in gRPC mode. @@ -1568,7 +1603,12 @@ func (t *http2Client) operateHeaders(frame *http2.MetaHeadersFrame) { } se := status.New(grpcErrorCode, strings.Join(errs, "; ")) - t.closeStream(s, se.Err(), true, http2.ErrCodeProtocol, se, nil, endStream) + if endStream { + t.closeStream(s, se.Err(), true, http2.ErrCodeProtocol, se, nil, true) + return + } + + s.startNonGRPCDataCollection(se) return } diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_server.go b/vendor/google.golang.org/grpc/internal/transport/http2_server.go index 3a8c36e4..1acd44be 100644 --- a/vendor/google.golang.org/grpc/internal/transport/http2_server.go +++ b/vendor/google.golang.org/grpc/internal/transport/http2_server.go @@ -38,11 +38,13 @@ import ( "google.golang.org/protobuf/proto" "google.golang.org/grpc/internal" + "google.golang.org/grpc/internal/envconfig" "google.golang.org/grpc/internal/grpclog" "google.golang.org/grpc/internal/grpcutil" "google.golang.org/grpc/internal/pretty" istatus "google.golang.org/grpc/internal/status" "google.golang.org/grpc/internal/syscall" + transportinternal "google.golang.org/grpc/internal/transport/internal" "google.golang.org/grpc/mem" "google.golang.org/grpc/codes" @@ -165,7 +167,13 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport, } writeBufSize := config.WriteBufferSize readBufSize := config.ReadBufferSize + // The default header list size is moving from 16MB to 8KB. The 8KB limit + // is only used if Enable8KBDefaultHeaderListSize is true; otherwise, the + // old 16MB default is used. User-specified options always take precedence. maxHeaderListSize := defaultServerMaxHeaderListSize + if envconfig.Enable8KBDefaultHeaderListSize { + maxHeaderListSize = upcomingDefaultHeaderListSize + } if config.MaxHeaderListSize != nil { maxHeaderListSize = *config.MaxHeaderListSize } @@ -948,8 +956,8 @@ func (t *http2Server) checkForHeaderListSize(hf []hpack.HeaderField) bool { return false } } - if sz > int64(upcomingDefaultHeaderListSize) { - t.logger.Warningf("Header list size to send (%d bytes) is larger than the upcoming default limit (%d bytes). In a future release, this will be restricted to %d bytes.", sz, upcomingDefaultHeaderListSize, upcomingDefaultHeaderListSize) + if !envconfig.Enable8KBDefaultHeaderListSize && sz > int64(upcomingDefaultHeaderListSize) { + t.logger.Warningf("Header list size to send (%d bytes) is larger than the upcoming default limit (%d bytes). In release v1.82.0, GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE will be enabled by default, enforcing this limit.", sz, upcomingDefaultHeaderListSize) } return true } @@ -1441,14 +1449,14 @@ func (t *http2Server) socketMetrics() *channelz.EphemeralSocketMetrics { func (t *http2Server) incrMsgSent() { if channelz.IsOn() { t.channelz.SocketMetrics.MessagesSent.Add(1) - t.channelz.SocketMetrics.LastMessageSentTimestamp.Add(1) + t.channelz.SocketMetrics.LastMessageSentTimestamp.Store(transportinternal.TimeNowFunc()) } } func (t *http2Server) incrMsgRecv() { if channelz.IsOn() { t.channelz.SocketMetrics.MessagesReceived.Add(1) - t.channelz.SocketMetrics.LastMessageReceivedTimestamp.Add(1) + t.channelz.SocketMetrics.LastMessageReceivedTimestamp.Store(transportinternal.TimeNowFunc()) } } diff --git a/vendor/google.golang.org/grpc/internal/grpcutil/regex.go b/vendor/google.golang.org/grpc/internal/transport/internal/internal.go similarity index 59% rename from vendor/google.golang.org/grpc/internal/grpcutil/regex.go rename to vendor/google.golang.org/grpc/internal/transport/internal/internal.go index 7a092b2b..a7c7c7d5 100644 --- a/vendor/google.golang.org/grpc/internal/grpcutil/regex.go +++ b/vendor/google.golang.org/grpc/internal/transport/internal/internal.go @@ -1,6 +1,6 @@ /* * - * Copyright 2021 gRPC authors. + * Copyright 2026 gRPC authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -16,16 +16,10 @@ * */ -package grpcutil +// Package internal contains functionality internal to the transport package. +package internal -import "regexp" - -// FullMatchWithRegex returns whether the full text matches the regex provided. -func FullMatchWithRegex(re *regexp.Regexp, text string) bool { - if len(text) == 0 { - return re.MatchString(text) - } - re.Longest() - rem := re.FindString(text) - return len(rem) == len(text) -} +// TimeNowFunc is a variable that can be set to override the default behavior of +// getting the current time in nanoseconds. It is used in transport code to set +// channelz timestamps, and is exposed here for testing purposes. +var TimeNowFunc func() int64 diff --git a/vendor/google.golang.org/grpc/internal/transport/transport.go b/vendor/google.golang.org/grpc/internal/transport/transport.go index 1e224576..6dfae398 100644 --- a/vendor/google.golang.org/grpc/internal/transport/transport.go +++ b/vendor/google.golang.org/grpc/internal/transport/transport.go @@ -35,6 +35,7 @@ import ( "google.golang.org/grpc/codes" "google.golang.org/grpc/credentials" "google.golang.org/grpc/internal/channelz" + "google.golang.org/grpc/internal/transport/internal" "google.golang.org/grpc/keepalive" "google.golang.org/grpc/mem" "google.golang.org/grpc/metadata" @@ -46,6 +47,10 @@ import ( const logLevel = 2 +func init() { + internal.TimeNowFunc = func() int64 { return time.Now().UnixNano() } +} + // recvMsg represents the received msg from the transport. All transport // protocol specific info has been removed. type recvMsg struct { diff --git a/vendor/google.golang.org/grpc/internal/xds/balancer/cdsbalancer/configbuilder.go b/vendor/google.golang.org/grpc/internal/xds/balancer/cdsbalancer/configbuilder.go index 54bede89..336d2400 100644 --- a/vendor/google.golang.org/grpc/internal/xds/balancer/cdsbalancer/configbuilder.go +++ b/vendor/google.golang.org/grpc/internal/xds/balancer/cdsbalancer/configbuilder.go @@ -24,7 +24,8 @@ import ( "maps" "slices" - "google.golang.org/grpc/internal/balancer/weight" + "google.golang.org/grpc/experimental/balancer/hostname" + "google.golang.org/grpc/experimental/balancer/weight" "google.golang.org/grpc/internal/envconfig" "google.golang.org/grpc/internal/hierarchy" internalserviceconfig "google.golang.org/grpc/internal/serviceconfig" @@ -181,7 +182,7 @@ func buildClusterImplConfigForDNS(g *nameGenerator, config *xdsresource.ClusterC // LB policies that rely on locality information (like weighted_target) // continue to work. localityStr := xdsinternal.LocalityString(clients.Locality{}) - retEndpoint = xdsresource.SetHostname(hierarchy.SetInEndpoint(retEndpoint, []string{pName, localityStr}), clusterUpdate.DNSHostName) + retEndpoint = hostname.Set(hierarchy.SetInEndpoint(retEndpoint, []string{pName, localityStr}), clusterUpdate.DNSHostName) // Set the locality weight to 1. This is required because the child policy // like weighted_target which relies on locality weights to distribute // traffic. These policies may drop traffic if the weight is 0. diff --git a/vendor/google.golang.org/grpc/internal/xds/balancer/clusterimpl/clusterimpl.go b/vendor/google.golang.org/grpc/internal/xds/balancer/clusterimpl/clusterimpl.go index 8c8f00d1..73247d4d 100644 --- a/vendor/google.golang.org/grpc/internal/xds/balancer/clusterimpl/clusterimpl.go +++ b/vendor/google.golang.org/grpc/internal/xds/balancer/clusterimpl/clusterimpl.go @@ -575,18 +575,18 @@ func (b *clusterImplBalancer) NewSubConn(addrs []resolver.Address, opts balancer newAddrs[i] = xdsinternal.SetXDSHandshakeClusterName(addr, clusterName) newAddrs[i] = xds.SetHandshakeInfo(newAddrs[i], &b.xdsHIPtr) - hostname := xdsresource.Hostname(addr) + host := xdsresource.Hostname(addr) // If the hostname contains a port, strip it. Per [RFC 6066, Section // 3](https://www.rfc-editor.org/rfc/rfc6066.html#section-3), the SNI // may only contain a qualified DNS hostname, which excludes port // numbers. - h, _, err := net.SplitHostPort(hostname) + h, _, err := net.SplitHostPort(host) if err == nil { - hostname = h + host = h } // Store hostname in the address attributes, so that it can be used in // the client handshake. - newAddrs[i] = xds.SetAddressHostname(newAddrs[i], hostname) + newAddrs[i] = xds.SetAddressHostname(newAddrs[i], host) } var sc balancer.SubConn scw := &scWrapper{} diff --git a/vendor/google.golang.org/grpc/internal/xds/balancer/clusterimpl/picker.go b/vendor/google.golang.org/grpc/internal/xds/balancer/clusterimpl/picker.go index b808f6dd..00ed6da3 100644 --- a/vendor/google.golang.org/grpc/internal/xds/balancer/clusterimpl/picker.go +++ b/vendor/google.golang.org/grpc/internal/xds/balancer/clusterimpl/picker.go @@ -20,7 +20,6 @@ package clusterimpl import ( "context" - "maps" v3orcapb "github.com/cncf/xds/go/xds/data/orca/v3" "google.golang.org/grpc/balancer" @@ -95,24 +94,10 @@ type picker struct { metrics *xdsresource.LRSReportEndpointMetricsConfig } -func telemetryLabels(ctx context.Context) map[string]string { - if ctx == nil { - return nil - } - labels := stats.GetLabels(ctx) - if labels == nil { - return nil - } - return labels.TelemetryLabels -} - func (d *picker) Pick(info balancer.PickInfo) (balancer.PickResult, error) { - // Unconditionally set labels if present, even dropped or queued RPC's can + // Unconditionally update labels if present, even dropped or queued RPC's can // use these labels. - labels := telemetryLabels(info.Ctx) - if labels != nil { - maps.Copy(labels, d.telemetryLabels) - } + stats.UpdateLabels(info.Ctx, d.telemetryLabels) // Don't drop unless the inner picker is READY. Similar to // https://github.com/grpc/grpc-go/issues/2622. @@ -167,10 +152,13 @@ func (d *picker) Pick(info balancer.PickInfo) (balancer.PickResult, error) { return pr, err } - if labels != nil { - labels["grpc.lb.locality"] = xdsinternal.LocalityString(lID) - labels["grpc.lb.backend_service"] = d.clusterName - } + stats.UpdateLabels( + info.Ctx, + map[string]string{ + "grpc.lb.locality": xdsinternal.LocalityString(lID), + "grpc.lb.backend_service": d.clusterName, + }, + ) if d.loadStore != nil { locality := clients.Locality{Region: lID.Region, Zone: lID.Zone, SubZone: lID.SubZone} diff --git a/vendor/google.golang.org/grpc/internal/xds/httpfilter/extconfig.go b/vendor/google.golang.org/grpc/internal/xds/httpfilter/extconfig.go new file mode 100644 index 00000000..f93ab5bf --- /dev/null +++ b/vendor/google.golang.org/grpc/internal/xds/httpfilter/extconfig.go @@ -0,0 +1,88 @@ +/* + * + * Copyright 2026 gRPC authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ + +package httpfilter + +import ( + "fmt" + "regexp" + + "google.golang.org/grpc/internal/xds/matcher" + + v3mutationpb "github.com/envoyproxy/go-control-plane/envoy/config/common/mutation_rules/v3" + v3matcherpb "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3" +) + +// HeaderMutationRules specifies the rules for what modifications an external +// processing server may make to headers sent on the data plane RPC. +type HeaderMutationRules struct { + // AllowExpr specifies a regular expression that matches the headers that can + // be mutated. + AllowExpr *regexp.Regexp + // DisallowExpr specifies a regular expression that matches the headers that + // cannot be mutated. This overrides the above allowExpr if a header matches + // both. + DisallowExpr *regexp.Regexp + // DisallowAll specifies that no header mutations are allowed. This overrides + // all other settings. + DisallowAll bool + // DisallowIsError specifies whether to return an error if a header mutation + // is disallowed. If true, the data plane RPC will be failed with a grpc + // status code of Unknown. + DisallowIsError bool +} + +// ConvertStringMatchers converts a slice of protobuf StringMatcher messages to +// a slice of matcher.StringMatcher. +func ConvertStringMatchers(patterns []*v3matcherpb.StringMatcher) ([]matcher.StringMatcher, error) { + matchers := make([]matcher.StringMatcher, 0, len(patterns)) + for _, p := range patterns { + sm, err := matcher.StringMatcherFromProto(p) + if err != nil { + return nil, err + } + matchers = append(matchers, sm) + } + return matchers, nil +} + +// HeaderMutationRulesFromProto converts a protobuf HeaderMutationRules proto +// message to a HeaderMutationRules struct. +func HeaderMutationRulesFromProto(mr *v3mutationpb.HeaderMutationRules) (HeaderMutationRules, error) { + var rules HeaderMutationRules + if mr == nil { + return rules, nil + } + if allowExpr := mr.GetAllowExpression(); allowExpr != nil { + re, err := matcher.CompileSafeRegex(allowExpr.GetRegex()) + if err != nil { + return rules, fmt.Errorf("httpfilter: %v", err) + } + rules.AllowExpr = re + } + if disallowExpr := mr.GetDisallowExpression(); disallowExpr != nil { + re, err := matcher.CompileSafeRegex(disallowExpr.GetRegex()) + if err != nil { + return rules, fmt.Errorf("httpfilter: %v", err) + } + rules.DisallowExpr = re + } + rules.DisallowAll = mr.GetDisallowAll().GetValue() + rules.DisallowIsError = mr.GetDisallowIsError().GetValue() + return rules, nil +} diff --git a/vendor/google.golang.org/grpc/internal/xds/httpfilter/httpfilter.go b/vendor/google.golang.org/grpc/internal/xds/httpfilter/httpfilter.go index 0b004f5c..b37ed9d1 100644 --- a/vendor/google.golang.org/grpc/internal/xds/httpfilter/httpfilter.go +++ b/vendor/google.golang.org/grpc/internal/xds/httpfilter/httpfilter.go @@ -31,6 +31,16 @@ type FilterConfig interface { isFilterConfig() } +// DisabledFilterConfig represents a disabled filter override. It implements the +// FilterConfig interface and can be returned by ParseFilterConfigOverride to +// indicate that the filter should be disabled. It is not used as a config for +// any filter, and is only used as a marker in the override configuration. For +// more information, see +// envoyproxy.io/docs/envoy/latest/intro/arch_overview/http/http_filters#route-based-filter-chain +type DisabledFilterConfig struct{} + +func (DisabledFilterConfig) isFilterConfig() {} + // Builder defines the parsing functionality of an HTTP filter. A Builder may // optionally implement either ClientFilterBuilder or ServerFilterBuilder or // both, indicating it is capable of working on the client side or server side diff --git a/vendor/google.golang.org/grpc/internal/xds/matcher/matcher_header.go b/vendor/google.golang.org/grpc/internal/xds/matcher/matcher_header.go index 780257ec..efda7f8a 100644 --- a/vendor/google.golang.org/grpc/internal/xds/matcher/matcher_header.go +++ b/vendor/google.golang.org/grpc/internal/xds/matcher/matcher_header.go @@ -24,7 +24,6 @@ import ( "strconv" "strings" - "google.golang.org/grpc/internal/grpcutil" "google.golang.org/grpc/metadata" ) @@ -94,7 +93,7 @@ func (hrm *HeaderRegexMatcher) Match(md metadata.MD) bool { if !ok { return false } - return grpcutil.FullMatchWithRegex(hrm.re, v) != hrm.invert + return hrm.re.MatchString(v) != hrm.invert } func (hrm *HeaderRegexMatcher) String() string { diff --git a/vendor/google.golang.org/grpc/internal/xds/matcher/string_matcher.go b/vendor/google.golang.org/grpc/internal/xds/matcher/string_matcher.go index a6cf05dd..edcc36c8 100644 --- a/vendor/google.golang.org/grpc/internal/xds/matcher/string_matcher.go +++ b/vendor/google.golang.org/grpc/internal/xds/matcher/string_matcher.go @@ -27,7 +27,6 @@ import ( "strings" v3matcherpb "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3" - "google.golang.org/grpc/internal/grpcutil" ) // StringMatcher contains match criteria for matching a string, and is an @@ -70,7 +69,7 @@ func (sm StringMatcher) Match(input string) bool { } return strings.Contains(input, *sm.containsMatch) case sm.regexMatch != nil: - return grpcutil.FullMatchWithRegex(sm.regexMatch, input) + return sm.regexMatch.MatchString(input) } return false } @@ -116,11 +115,11 @@ func StringMatcherFromProto(matcherProto *v3matcherpb.StringMatcher) (StringMatc matcher.suffixMatch = newStrPtr(&mt.Suffix, matcher.ignoreCase) case *v3matcherpb.StringMatcher_SafeRegex: regex := matcherProto.GetSafeRegex().GetRegex() - re, err := regexp.Compile(regex) + re, err := CompileSafeRegex(regex) if err != nil { return StringMatcher{}, fmt.Errorf("safe_regex matcher %q is invalid", regex) } - matcher.regexMatch = re + matcher = NewRegexStringMatcher(re) case *v3matcherpb.StringMatcher_Contains: if matcherProto.GetContains() == "" { return StringMatcher{}, errors.New("empty contains is not allowed in StringMatcher") @@ -217,3 +216,14 @@ func (sm StringMatcher) Equal(other StringMatcher) bool { } return true } + +// CompileSafeRegex attempts to compile the provided pattern as a regular +// expression. It first compiles the unanchored pattern to catch syntax errors +// and then compiles and returns the explicitly anchored pattern to guarantee +// full-string matching. +func CompileSafeRegex(pattern string) (*regexp.Regexp, error) { + if _, err := regexp.Compile(pattern); err != nil { + return nil, err + } + return regexp.Compile(fmt.Sprintf("^(?:%s)$", pattern)) +} diff --git a/vendor/google.golang.org/grpc/internal/xds/rbac/matchers.go b/vendor/google.golang.org/grpc/internal/xds/rbac/matchers.go index fede2fe7..e90945ae 100644 --- a/vendor/google.golang.org/grpc/internal/xds/rbac/matchers.go +++ b/vendor/google.golang.org/grpc/internal/xds/rbac/matchers.go @@ -21,7 +21,6 @@ import ( "fmt" "net" "net/netip" - "regexp" v3corepb "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" v3rbacpb "github.com/envoyproxy/go-control-plane/envoy/config/rbac/v3" @@ -271,7 +270,7 @@ func newHeaderMatcher(headerMatcherConfig *v3route_componentspb.HeaderMatcher) ( case *v3route_componentspb.HeaderMatcher_ExactMatch: m = internalmatcher.NewHeaderExactMatcher(headerMatcherConfig.Name, headerMatcherConfig.GetExactMatch(), headerMatcherConfig.InvertMatch) case *v3route_componentspb.HeaderMatcher_SafeRegexMatch: - regex, err := regexp.Compile(headerMatcherConfig.GetSafeRegexMatch().Regex) + regex, err := internalmatcher.CompileSafeRegex(headerMatcherConfig.GetSafeRegexMatch().GetRegex()) if err != nil { return nil, err } diff --git a/vendor/google.golang.org/grpc/internal/xds/resolver/serviceconfig.go b/vendor/google.golang.org/grpc/internal/xds/resolver/serviceconfig.go index 563026a6..b19bb7e3 100644 --- a/vendor/google.golang.org/grpc/internal/xds/resolver/serviceconfig.go +++ b/vendor/google.golang.org/grpc/internal/xds/resolver/serviceconfig.go @@ -24,7 +24,6 @@ import ( "math/bits" rand "math/rand/v2" "strings" - "sync/atomic" "time" xxhash "github.com/cespare/xxhash/v2" @@ -196,16 +195,13 @@ func (cs *configSelector) SelectConfig(rpcInfo iresolver.RPCInfo) (*iresolver.RP return nil, annotateErrorWithNodeID(status.Errorf(codes.Internal, "error retrieving cluster for match: %v (%T)", cluster, cluster), cs.xdsNodeID) } - // Add a ref to the selected cluster, as this RPC needs this cluster until - // it is committed. - var ref *int32 + // Add a ref to the selected cluster/plugin, as this RPC needs this + // cluster/plugin until it is committed. if info, ok := cs.clusters[cluster.name]; ok { - ref = &info.refCount + info.refCount.Add(1) + } else if info, ok := cs.plugins[cluster.name]; ok { + info.refCount.Add(1) } - if info, ok := cs.plugins[cluster.name]; ok { - ref = &info.refCount - } - atomic.AddInt32(ref, 1) lbCtx := clustermanager.SetPickedCluster(rpcInfo.Context, cluster.name) lbCtx = xdsresource.NewContextWithXDSConfig(lbCtx, cs.xdsConfig) @@ -221,8 +217,7 @@ func (cs *configSelector) SelectConfig(rpcInfo iresolver.RPCInfo) (*iresolver.RP // When the RPC is committed, the cluster is no longer required. // Decrease its ref. if info, ok := cs.clusters[cluster.name]; ok { - ref := &info.refCount - if v := atomic.AddInt32(ref, -1); v == 0 { + if v := info.refCount.Add(-1); v == 0 { // We call unsubscribe rather than sendNewServiceConfig to // prevent redundant updates. If the reference count in the // dependency manager drops to zero, it will automatically @@ -233,8 +228,7 @@ func (cs *configSelector) SelectConfig(rpcInfo iresolver.RPCInfo) (*iresolver.RP } } if info, ok := cs.plugins[cluster.name]; ok { - ref := &info.refCount - if v := atomic.AddInt32(ref, -1); v == 0 { + if v := info.refCount.Add(-1); v == 0 { // This entry will be removed from activePlugins when // producing a new service config update. cs.sendNewServiceConfig() @@ -350,12 +344,12 @@ func (cs *configSelector) stop() { // after a new one is active, we must trigger a subsequent update to delete // the now-unused clusters. for _, ci := range cs.clusters { - if v := atomic.AddInt32(&ci.refCount, -1); v == 0 { + if v := ci.refCount.Add(-1); v == 0 { ci.unsubscribe() } } for _, ci := range cs.plugins { - if v := atomic.AddInt32(&ci.refCount, -1); v == 0 { + if v := ci.refCount.Add(-1); v == 0 { cs.sendNewServiceConfig() } } diff --git a/vendor/google.golang.org/grpc/internal/xds/resolver/xds_resolver.go b/vendor/google.golang.org/grpc/internal/xds/resolver/xds_resolver.go index 8de3a14b..3d4932bc 100644 --- a/vendor/google.golang.org/grpc/internal/xds/resolver/xds_resolver.go +++ b/vendor/google.golang.org/grpc/internal/xds/resolver/xds_resolver.go @@ -415,9 +415,26 @@ func (r *xdsResolver) newConfigSelector() (_ *configSelector, err error) { for i, rt := range r.xdsConfig.VirtualHost.Routes { clusters := rinternal.NewWRR.(func() wrr.WRR)() interceptors := []iresolver.ClientInterceptor{} + // TODO: Carve out the common logic between the ClusterSpecifierPlugin + // and WeightedClusters. if rt.ClusterSpecifierPlugin != "" { clusterName := clusterSpecifierPluginPrefix + rt.ClusterSpecifierPlugin - clusters.Add(&routeCluster{name: clusterName}, 1) + interceptor, err := r.newInterceptor(r.xdsConfig.Listener.APIListener.HTTPFilters, nil, rt.HTTPFilterConfigOverride, r.xdsConfig.VirtualHost.HTTPFilterConfigOverride) + if err != nil { + // Clean up any interceptors that were successfully built + // for the current route before this error occurred. Note + // that this is not handled by the call to cs.stop() in the + // deferred function. + for _, i := range interceptors { + i.Close() + } + return nil, err + } + clusters.Add(&routeCluster{ + name: clusterName, + interceptor: interceptor, + }, 1) + interceptors = append(interceptors, interceptor) ci := r.addOrGetActiveClusterInfo(clusterName, "") ci.cfg = xdsChildConfig{ChildPolicy: balancerConfig(r.xdsConfig.RouteConfig.ClusterSpecifierPlugins[rt.ClusterSpecifierPlugin])} cs.plugins[clusterName] = ci @@ -464,10 +481,10 @@ func (r *xdsResolver) newConfigSelector() (_ *configSelector, err error) { // errors may occur. Note: cs.clusters are pointers to entries in // activeClusters. for _, ci := range cs.clusters { - atomic.AddInt32(&ci.refCount, 1) + ci.refCount.Add(1) } for _, ci := range cs.plugins { - atomic.AddInt32(&ci.refCount, 1) + ci.refCount.Add(1) } // Cleanup filter instances that are no longer specified in the current @@ -496,13 +513,13 @@ func (r *xdsResolver) newConfigSelector() (_ *configSelector, err error) { // Only executed in the context of a serializer callback. func (r *xdsResolver) pruneActiveClustersAndPlugins() { for cluster, ci := range r.activeClusters { - if atomic.LoadInt32(&ci.refCount) == 0 { + if ci.refCount.Load() == 0 { ci.unsubscribe() delete(r.activeClusters, cluster) } } for cluster, ci := range r.activePlugins { - if atomic.LoadInt32(&ci.refCount) == 0 { + if ci.refCount.Load() == 0 { delete(r.activePlugins, cluster) } } @@ -535,8 +552,8 @@ func (r *xdsResolver) addOrGetActiveClusterInfo(key string, name string) *cluste } type clusterInfo struct { - // number of references to this cluster; accessed atomically - refCount int32 + // refCount is the number of references to this cluster. + refCount atomic.Int32 // cfg is the child configuration for this cluster, containing either the // csp config or the cds cluster config. cfg xdsChildConfig @@ -596,6 +613,23 @@ func (r *xdsResolver) newInterceptor(filters []xdsresource.HTTPFilter, clusterOv if override == nil { override = virtualHostOverride[filter.Name] } + + // Determine the effective disabled state of the filter. The base + // configuration's disabled state is used unless an override is present. + // If an override is present, the filter is disabled if the override is + // a DisabledFilterConfig. + disabled := filter.Disabled + if override != nil { + _, disabled = override.(httpfilter.DisabledFilterConfig) + } + + if disabled { + if r.logger.V(2) { + r.logger.Infof("Filter %q has been disabled.", filter.Name) + } + continue + } + builder, ok := filter.Filter.(httpfilter.ClientFilterBuilder) if !ok { // Should not happen if it passed xdsClient validation. diff --git a/vendor/google.golang.org/grpc/internal/xds/server/filter_chain_manager.go b/vendor/google.golang.org/grpc/internal/xds/server/filter_chain_manager.go index 2a12fd73..f3d0143c 100644 --- a/vendor/google.golang.org/grpc/internal/xds/server/filter_chain_manager.go +++ b/vendor/google.golang.org/grpc/internal/xds/server/filter_chain_manager.go @@ -122,17 +122,7 @@ func (fcm *filterChainManager) filterChainFromConfig(config *xdsresource.Network func (fcm *filterChainManager) stop() { for _, fc := range fcm.filterChains { - urc := fc.usableRouteConfiguration.Load() - if urc.err != nil { - continue - } - for _, vh := range urc.vhs { - for _, r := range vh.routes { - if r.interceptor != nil { - r.interceptor.Close() - } - } - } + fc.usableRouteConfiguration.Load().stop() fc.stop() } } @@ -172,11 +162,20 @@ type sourcePrefixEntry struct { // Listener resource. This struct contains the active state of a filter chain, // which includes the usable route configuration. type filterChain struct { - securityCfg *xdsresource.SecurityConfig - httpFilters []xdsresource.HTTPFilter - serverFilters []httpfilter.ServerFilter // Server filters with reference counts, stored for cleanup purposes. - routeConfigName string - inlineRouteConfig *xdsresource.RouteConfigUpdate + // The following fields are set at initialization time, and are not + // updated afterwards. + securityCfg *xdsresource.SecurityConfig + httpFilters []xdsresource.HTTPFilter + routeConfigName string + inlineRouteConfig *xdsresource.RouteConfigUpdate + + // Server filters with reference counts. Is updated when a usable route + // configuration is set, and when the filter chain is stopped. Both these + // operations always happen with the listener wrapper's lock held. + serverFilters []httpfilter.ServerFilter + + // The usable route configuration, is passed to the connWrapper, and is used + // to route incoming RPCs. Therefore, this needs to be accessed atomically. usableRouteConfiguration *atomic.Pointer[usableRouteConfiguration] } @@ -188,6 +187,16 @@ type usableRouteConfiguration struct { nodeID string // For logging purposes. Populated by the listener wrapper. } +func (rc *usableRouteConfiguration) stop() { + for _, vh := range rc.vhs { + for _, r := range vh.routes { + if r.interceptor != nil { + r.interceptor.Close() + } + } + } +} + // virtualHostWithInterceptors captures information present in a VirtualHost // update, and also contains routes with instantiated HTTP Filters. type virtualHostWithInterceptors struct { @@ -397,32 +406,61 @@ func (fc *filterChain) stop() { // state across resource updates. type serverFilterProvider func(filter xdsresource.HTTPFilter) (httpfilter.ServerFilter, error) -// constructUsableRouteConfiguration takes Route Configuration and converts it +// updateUsableRouteConfiguration takes Route Configuration and converts it // into matchable route configuration, with instantiated HTTP Filters per route. -func (fc *filterChain) constructUsableRouteConfiguration(config xdsresource.RouteConfigUpdate, provider serverFilterProvider) *usableRouteConfiguration { - vhs := make([]virtualHostWithInterceptors, 0, len(config.VirtualHosts)) +func (fc *filterChain) updateUsableRouteConfiguration(config *xdsresource.RouteConfigUpdate, updateErr error, provider serverFilterProvider, nodeID string) { + if updateErr != nil { + urc := &usableRouteConfiguration{err: updateErr, nodeID: nodeID} + fc.applyConfiguration(urc, nil) + return + } + var serverFilters []httpfilter.ServerFilter + vhs := make([]virtualHostWithInterceptors, 0, len(config.VirtualHosts)) for _, vh := range config.VirtualHosts { vhwi, sfs, err := fc.convertVirtualHost(vh, provider) if err != nil { for _, sf := range serverFilters { sf.Close() } + // Close interceptors from successfully converted virtual hosts. + for _, v := range vhs { + for _, r := range v.routes { + if r.interceptor != nil { + r.interceptor.Close() + r.interceptor = nil + } + } + } // Non nil if (lds + rds) fails, shouldn't happen since validated by // xDS Client, treat as L7 error but shouldn't happen. - return &usableRouteConfiguration{err: fmt.Errorf("virtual host construction: %v", err)} + urc := &usableRouteConfiguration{err: fmt.Errorf("virtual host construction: %v", err), nodeID: nodeID} + fc.applyConfiguration(urc, nil) + return } vhs = append(vhs, vhwi) serverFilters = append(serverFilters, sfs...) } - // Release references to old server filters before replacing with new ones. - for _, sf := range fc.serverFilters { - sf.Close() - } + urc := &usableRouteConfiguration{vhs: vhs, nodeID: nodeID} + fc.applyConfiguration(urc, serverFilters) +} + +func (fc *filterChain) applyConfiguration(urc *usableRouteConfiguration, serverFilters []httpfilter.ServerFilter) { + // Swap in the new configuration first so new RPCs use it immediately. + oldURC := fc.usableRouteConfiguration.Swap(urc) + oldFilters := fc.serverFilters fc.serverFilters = serverFilters - return &usableRouteConfiguration{vhs: vhs} + // Stop the old interceptors before releasing the filters they might depend on. + if oldURC != nil { + oldURC.stop() + } + + // Release references to old server filters. + for _, sf := range oldFilters { + sf.Close() + } } func (fc *filterChain) convertVirtualHost(virtualHost *xdsresource.VirtualHost, provider serverFilterProvider) (_ virtualHostWithInterceptors, _ []httpfilter.ServerFilter, err error) { @@ -441,6 +479,13 @@ func (fc *filterChain) convertVirtualHost(virtualHost *xdsresource.VirtualHost, rs[i].matcher = xdsresource.RouteToMatcher(r) interceptor, sfs, err := fc.newInterceptor(r.HTTPFilterConfigOverride, virtualHost.HTTPFilterConfigOverride, provider) if err != nil { + // Close interceptors from successfully converted routes. + for _, route := range rs { + if route.interceptor != nil { + route.interceptor.Close() + route.interceptor = nil + } + } return virtualHostWithInterceptors{}, nil, err } serverFilters = append(serverFilters, sfs...) @@ -478,6 +523,14 @@ func (fc *filterChain) newInterceptor(routeOverride, virtualHostOverride map[str override = virtualHostOverride[filter.Name] } + disabled := filter.Disabled + if override != nil { + _, disabled = override.(httpfilter.DisabledFilterConfig) + } + if disabled { + continue + } + serverFilter, err := provider(filter) if err != nil { return nil, nil, err diff --git a/vendor/google.golang.org/grpc/internal/xds/server/listener_wrapper.go b/vendor/google.golang.org/grpc/internal/xds/server/listener_wrapper.go index b7d20b2b..92b654b6 100644 --- a/vendor/google.golang.org/grpc/internal/xds/server/listener_wrapper.go +++ b/vendor/google.golang.org/grpc/internal/xds/server/listener_wrapper.go @@ -154,7 +154,6 @@ func (l *listenerWrapper) maybeUpdateFilterChains() { } l.mu.Lock() - l.switchModeLocked(connectivity.ServingModeServing, nil) // "Updates to a Listener cause all older connections on that Listener to be // gracefully shut down with a grace period of 10 minutes for long-lived // RPC's, such that clients will reconnect and have the updated @@ -189,6 +188,7 @@ func (l *listenerWrapper) maybeUpdateFilterChains() { delete(l.httpFilters, key) } } + l.switchModeLocked(connectivity.ServingModeServing, nil) l.mu.Unlock() go func() { @@ -210,14 +210,10 @@ func (l *listenerWrapper) handleRDSUpdate(routeName string, rcu rdsWatcherUpdate continue } if rcu.err != nil && rcu.data == nil { // Either NACK before update, or resource not found triggers this conditional. - urc := &usableRouteConfiguration{err: rcu.err} - urc.nodeID = l.xdsNodeID - fc.usableRouteConfiguration.Store(urc) + fc.updateUsableRouteConfiguration(nil, rcu.err, l.getOrCreateServerFilterLocked, l.xdsNodeID) continue } - urc := fc.constructUsableRouteConfiguration(*rcu.data, l.getOrCreateServerFilterLocked) - urc.nodeID = l.xdsNodeID - fc.usableRouteConfiguration.Store(urc) + fc.updateUsableRouteConfiguration(rcu.data, nil, l.getOrCreateServerFilterLocked, l.xdsNodeID) } } l.mu.Unlock() @@ -235,21 +231,15 @@ func (l *listenerWrapper) handleRDSUpdate(routeName string, rcu rdsWatcherUpdate func (l *listenerWrapper) instantiateFilterChainRoutingConfigurationsLocked() { for _, fc := range l.activeFilterChainManager.filterChains { if fc.inlineRouteConfig != nil { - urc := fc.constructUsableRouteConfiguration(*fc.inlineRouteConfig, l.getOrCreateServerFilterLocked) - urc.nodeID = l.xdsNodeID - fc.usableRouteConfiguration.Store(urc) // Can't race with an RPC coming in but no harm making atomic. + fc.updateUsableRouteConfiguration(fc.inlineRouteConfig, nil, l.getOrCreateServerFilterLocked, l.xdsNodeID) continue } // Inline configuration constructed once here, will remain for lifetime of filter chain. rcu := l.rdsHandler.updates[fc.routeConfigName] if rcu.err != nil && rcu.data == nil { - urc := &usableRouteConfiguration{err: rcu.err} - urc.nodeID = l.xdsNodeID - fc.usableRouteConfiguration.Store(urc) + fc.updateUsableRouteConfiguration(nil, rcu.err, l.getOrCreateServerFilterLocked, l.xdsNodeID) continue } - urc := fc.constructUsableRouteConfiguration(*rcu.data, l.getOrCreateServerFilterLocked) - urc.nodeID = l.xdsNodeID - fc.usableRouteConfiguration.Store(urc) // Can't race with an RPC coming in but no harm making atomic. + fc.updateUsableRouteConfiguration(rcu.data, nil, l.getOrCreateServerFilterLocked, l.xdsNodeID) } } diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/grpc_service.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/grpc_service.go new file mode 100644 index 00000000..c4571d09 --- /dev/null +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/grpc_service.go @@ -0,0 +1,49 @@ +/* + * + * Copyright 2026 gRPC authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package xdsresource + +import ( + "time" + + "google.golang.org/grpc/metadata" +) + +// GRPCServiceConfig contains the configuration for an external server. It is +// the parsed configuration for the GrpcService proto message. +// See: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/grpc_service.proto +type GRPCServiceConfig struct { + // TargetURI is the name of the external server. + TargetURI string + // ChannelCredentials specifies the configuration for the transport + // credentials to use to connect to the external server, as a JSON string. + ChannelCredentials string + // CallCredentials specifies the configuration for the per-RPC credentials to + // use when making calls to the external server, as a JSON string. + CallCredentials string + // Timeout is the RPC timeout for the call to the external server. If unset, + // the timeout depends on the usage of this external server. For example, + // cases like ext_authz and ext_proc, where there is a 1:1 mapping between the + // data plane RPC and the external server call, the timeout will be capped by + // the timeout on the data plane RPC. For cases like RLQS where there is a + // side channel to the external server, an unset timeout will result in no + // timeout being applied to the external server call. + Timeout time.Duration + // InitialMetadata is the additional metadata to include in all RPCs sent to + // the external server. + InitialMetadata metadata.MD +} diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/matcher_path.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/matcher_path.go index da487e20..8627ed3c 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/matcher_path.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/matcher_path.go @@ -20,8 +20,6 @@ package xdsresource import ( "regexp" "strings" - - "google.golang.org/grpc/internal/grpcutil" ) type pathMatcher interface { @@ -94,7 +92,7 @@ func newPathRegexMatcher(re *regexp.Regexp) *pathRegexMatcher { } func (prm *pathRegexMatcher) match(path string) bool { - return grpcutil.FullMatchWithRegex(prm.re, path) + return prm.re.MatchString(path) } func (prm *pathRegexMatcher) String() string { diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/metadata.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/metadata.go index 566f46f8..4d915c5e 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/metadata.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/metadata.go @@ -21,15 +21,20 @@ import ( "fmt" "net/netip" - v3corepb "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" "google.golang.org/grpc/internal/envconfig" "google.golang.org/protobuf/types/known/anypb" + + v3corepb "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" + v3gcpauthnpb "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3" ) func init() { if envconfig.XDSHTTPConnectEnabled { registerMetadataConverter("type.googleapis.com/envoy.config.core.v3.Address", proxyAddressConvertor{}) } + if envconfig.GCPAuthenticationFilterEnabled { + registerMetadataConverter("type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.Audience", audienceConverter{}) + } } var ( @@ -100,3 +105,28 @@ func (proxyAddressConvertor) convert(anyProto *anypb.Any) (any, error) { } return ProxyAddressMetadataValue{Address: parseAddress(socketaddress)}, nil } + +// AudienceMetadataValue holds the audience parsed from the +// envoy.extensions.filters.http.gcp_authn.v3.Audience proto message, as +// specified in gRFC A83. +type AudienceMetadataValue struct { + // Audience is the URL of the receiving service that performs token + // authentication. + Audience string +} + +// audienceConverter implements the metadataConverter interface to +// handle the conversion of envoy.extensions.filters.http.gcp_authn.v3.Audience +// protobuf messages into an internal representation. +type audienceConverter struct{} + +func (audienceConverter) convert(anyProto *anypb.Any) (any, error) { + audienceProto := &v3gcpauthnpb.Audience{} + if err := anyProto.UnmarshalTo(audienceProto); err != nil { + return nil, fmt.Errorf("failed to unmarshal the envoy.extensions.filters.http.gcp_authn.v3.Audience resource from Any proto: %v", err) + } + if audienceProto.GetUrl() == "" { + return nil, fmt.Errorf("empty url field in audience metadata") + } + return AudienceMetadataValue{Audience: audienceProto.GetUrl()}, nil +} diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_cds.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_cds.go index d4b2d323..f2063827 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_cds.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_cds.go @@ -83,6 +83,9 @@ type ClusterUpdate struct { // LRSReportEndpointMetrics specifies the subset of ORCA metrics that // should be propagated to the LRS server. LRSReportEndpointMetrics *LRSReportEndpointMetricsConfig + + // Metadata contains the metadata from the cluster resource. + Metadata map[string]any } // LRSReportEndpointMetricsConfig holds the configuration for propagating ORCA diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_lds.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_lds.go index 8993c8cf..a03fd2db 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_lds.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_lds.go @@ -69,6 +69,9 @@ type HTTPFilter struct { Filter httpfilter.Builder // Config contains the filter's configuration Config httpfilter.FilterConfig + // Disabled specifies if the filter is disabled. For more information, see + // envoyproxy.io/docs/envoy/latest/intro/arch_overview/http/http_filters#route-based-filter-chain + Disabled bool } // InboundListenerConfig contains information about the inbound listener, i.e diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_cds.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_cds.go index 4ff3224b..151143a1 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_cds.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_cds.go @@ -215,6 +215,14 @@ func validateClusterAndConstructClusterUpdate(cluster *v3clusterpb.Cluster, serv } } + var metadata map[string]any + if envconfig.GCPAuthenticationFilterEnabled { + var err error + if metadata, err = validateAndConstructMetadata(cluster.GetMetadata()); err != nil { + return ClusterUpdate{}, err + } + } + ret := ClusterUpdate{ ClusterName: cluster.GetName(), SecurityCfg: sc, @@ -223,6 +231,7 @@ func validateClusterAndConstructClusterUpdate(cluster *v3clusterpb.Cluster, serv OutlierDetection: od, TelemetryLabels: telemetryLabels, LRSReportEndpointMetrics: lrsReportEndpointMetrics, + Metadata: metadata, } if lrs := cluster.GetLrsServer(); lrs != nil { diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_eds.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_eds.go index 93bb3e42..22eb8500 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_eds.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_eds.go @@ -26,6 +26,7 @@ import ( v3corepb "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" v3endpointpb "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3" v3typepb "github.com/envoyproxy/go-control-plane/envoy/type/v3" + "google.golang.org/grpc/experimental/balancer/hostname" "google.golang.org/grpc/internal/envconfig" "google.golang.org/grpc/internal/pretty" xdsinternal "google.golang.org/grpc/internal/xds" @@ -36,27 +37,12 @@ import ( "google.golang.org/protobuf/types/known/anypb" ) -// hostnameKeyType is the key to store the hostname attribute in -// a resolver.Endpoint. -type hostnameKeyType struct{} - -// SetHostname returns a copy of the given endpoint with hostname added -// as an attribute. -func SetHostname(endpoint resolver.Endpoint, hostname string) resolver.Endpoint { - // Only set if non-empty; xds_cluster_impl uses this to trigger :authority - // rewriting. - if hostname == "" { - return endpoint - } - endpoint.Attributes = endpoint.Attributes.WithValue(hostnameKeyType{}, hostname) - return endpoint -} - -// Hostname returns the hostname from the BalancerAttributes of the given -// Address. If this attribute is not set, it returns the empty string. +// Hostname returns the hostname from the BalancerAttributes of the +// given Address. If this attribute is not set, it returns the empty +// string. func Hostname(addr resolver.Address) string { - hostname, _ := addr.BalancerAttributes.Value(hostnameKeyType{}).(string) - return hostname + ep := resolver.Endpoint{Attributes: addr.BalancerAttributes} + return hostname.FromEndpoint(ep) } func unmarshalEndpointsResource(r *anypb.Any) (string, EndpointsUpdate, error) { @@ -166,7 +152,7 @@ func parseEndpoints(lbEndpoints []*v3endpointpb.LbEndpoint, uniqueEndpointAddrs } } endpoint := resolver.Endpoint{Addresses: address} - endpoint = SetHostname(endpoint, lbEndpoint.GetEndpoint().GetHostname()) + endpoint = hostname.Set(endpoint, lbEndpoint.GetEndpoint().GetHostname()) endpoint = ringhash.SetHashKey(endpoint, hashKey) endpoints = append(endpoints, Endpoint{ ResolverEndpoint: endpoint, @@ -268,6 +254,8 @@ func parseEDSRespProto(m *v3endpointpb.ClusterLoadAssignment) (EndpointsUpdate, return ret, nil } +// validateAndConstructMetadata processes the metadata from the xDS resource +// and returns a map of parsed metadata values. func validateAndConstructMetadata(metadataProto *v3corepb.Metadata) (map[string]any, error) { if metadataProto == nil { return nil, nil diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_lds.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_lds.go index 117f5e4b..e4c8bfd5 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_lds.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_lds.go @@ -30,6 +30,7 @@ import ( v3routepb "github.com/envoyproxy/go-control-plane/envoy/config/route/v3" v3httppb "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3" v3tlspb "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3" + "google.golang.org/grpc/internal/envconfig" "google.golang.org/grpc/internal/xds/clients/xdsclient" "google.golang.org/grpc/internal/xds/httpfilter" "google.golang.org/grpc/internal/xds/xdsclient/xdsresource/version" @@ -178,6 +179,7 @@ func processHTTPFilterOverrides(cfgs map[string]*anypb.Any) (map[string]httpfilt m := make(map[string]httpfilter.FilterConfig) for name, cfg := range cfgs { optional := false + disabled := false s := new(v3routepb.FilterConfig) if cfg.MessageIs(s) { if err := cfg.UnmarshalTo(s); err != nil { @@ -185,6 +187,14 @@ func processHTTPFilterOverrides(cfgs map[string]*anypb.Any) (map[string]httpfilt } cfg = s.GetConfig() optional = s.GetIsOptional() + if envconfig.XDSClientExtProcEnabled { + disabled = s.GetDisabled() + } + } + + if disabled { + m[name] = httpfilter.DisabledFilterConfig{} + continue } httpFilter, config, err := validateHTTPFilterConfig(cfg, false, optional) @@ -235,8 +245,12 @@ func processHTTPFilters(filters []*v3httppb.HttpFilter, server bool) ([]HTTPFilt return nil, fmt.Errorf("HTTP filter %q not supported client-side", name) } + disabled := false + if envconfig.XDSClientExtProcEnabled { + disabled = filter.GetDisabled() + } // Save name/config - ret = append(ret, HTTPFilter{Name: name, Filter: httpFilter, Config: config}) + ret = append(ret, HTTPFilter{Name: name, Filter: httpFilter, Config: config, Disabled: disabled}) } // "Validation will fail if a terminal filter is not the last filter in the // chain or if a non-terminal filter is the last filter in the chain." - A39 diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_rds.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_rds.go index 09589d6b..15a8e103 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_rds.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_rds.go @@ -241,7 +241,7 @@ func routesProtoToSlice(routes []*v3routepb.Route, csps map[string]clusterspecif route.Path = &pt.Path case *v3routepb.RouteMatch_SafeRegex: regex := pt.SafeRegex.GetRegex() - re, err := regexp.Compile(regex) + re, err := matcher.CompileSafeRegex(regex) if err != nil { return nil, nil, fmt.Errorf("route %+v contains an invalid regex %q", r, regex) } @@ -261,7 +261,7 @@ func routesProtoToSlice(routes []*v3routepb.Route, csps map[string]clusterspecif header.ExactMatch = &ht.ExactMatch case *v3routepb.HeaderMatcher_SafeRegexMatch: regex := ht.SafeRegexMatch.GetRegex() - re, err := regexp.Compile(regex) + re, err := matcher.CompileSafeRegex(regex) if err != nil { return nil, nil, fmt.Errorf("route %+v contains an invalid regex %q", r, regex) } diff --git a/vendor/google.golang.org/grpc/rpc_util.go b/vendor/google.golang.org/grpc/rpc_util.go index ee7f7dea..52f4ea51 100644 --- a/vendor/google.golang.org/grpc/rpc_util.go +++ b/vendor/google.golang.org/grpc/rpc_util.go @@ -128,6 +128,16 @@ func NewGZIPDecompressor() Decompressor { } func (d *gzipDecompressor) Do(r io.Reader) ([]byte, error) { + return d.doWithMaxSize(r, math.MaxInt64) +} + +// doWithMaxSize behaves like Do but caps the size of the decompressed +// payload at maxMessageSize+1 bytes. The Decompressor interface does not +// allow extra parameters, so callers inside the package type-assert to +// *gzipDecompressor to invoke this method directly. The +1 byte makes it +// possible for the caller to detect that the limit was exceeded and +// return ResourceExhausted instead of materializing an unbounded payload. +func (d *gzipDecompressor) doWithMaxSize(r io.Reader, maxMessageSize int64) ([]byte, error) { var z *gzip.Reader switch maybeZ := d.pool.Get().(type) { case nil: @@ -148,7 +158,11 @@ func (d *gzipDecompressor) Do(r io.Reader) ([]byte, error) { z.Close() d.pool.Put(z) }() - return io.ReadAll(z) + var src io.Reader = z + if maxMessageSize < math.MaxInt64 { + src = io.LimitReader(z, maxMessageSize+1) + } + return io.ReadAll(src) } func (d *gzipDecompressor) Type() string { @@ -830,15 +844,15 @@ func compress(in mem.BufferSlice, cp Compressor, compressor encoding.Compressor, if compressor != nil { z, err := compressor.Compress(w) if err != nil { - return nil, 0, wrapErr(err) + return nil, compressionNone, wrapErr(err) } for _, b := range in { if _, err := z.Write(b.ReadOnlyData()); err != nil { - return nil, 0, wrapErr(err) + return nil, compressionNone, wrapErr(err) } } if err := z.Close(); err != nil { - return nil, 0, wrapErr(err) + return nil, compressionNone, wrapErr(err) } } else { // This is obviously really inefficient since it fully materializes the data, but @@ -848,7 +862,7 @@ func compress(in mem.BufferSlice, cp Compressor, compressor encoding.Compressor, buf := in.MaterializeToBuffer(pool) defer buf.Free() if err := cp.Do(w, buf.ReadOnlyData()); err != nil { - return nil, 0, wrapErr(err) + return nil, compressionNone, wrapErr(err) } } return out, compressionMade, nil @@ -971,7 +985,20 @@ func recvAndDecompress(p *parser, s recvCompressor, dc Decompressor, maxReceiveM func decompress(compressor encoding.Compressor, d mem.BufferSlice, dc Decompressor, maxReceiveMessageSize int, pool mem.BufferPool) (mem.BufferSlice, error) { if dc != nil { r := d.Reader() - uncompressed, err := dc.Do(r) + // For the built-in gzip decompressor, bound the decompressed output + // at maxReceiveMessageSize+1 so that a small but highly compressed + // payload (a "zip bomb") cannot expand to gigabytes in memory before + // the post-decompression size check below has a chance to fire. The + // Decompressor interface does not accept an extra size parameter, + // so we type-assert to invoke a size-aware helper. Third-party + // Decompressor implementations keep the original Do behavior. + var uncompressed []byte + var err error + if gd, ok := dc.(*gzipDecompressor); ok { + uncompressed, err = gd.doWithMaxSize(r, int64(maxReceiveMessageSize)) + } else { + uncompressed, err = dc.Do(r) + } if err != nil { r.Close() // ensure buffers are reused return nil, status.Errorf(codes.Internal, "grpc: failed to decompress the received message: %v", err) @@ -989,6 +1016,9 @@ func decompress(compressor encoding.Compressor, d mem.BufferSlice, dc Decompress r.Close() // ensure buffers are reused return nil, status.Errorf(codes.Internal, "grpc: failed to decompress the message: %v", err) } + if closer, ok := dcReader.(io.Closer); ok { + defer closer.Close() + } // Read at most one byte more than the limit from the decompressor. // Unless the limit is MaxInt64, in which case, that's impossible, so diff --git a/vendor/google.golang.org/grpc/server.go b/vendor/google.golang.org/grpc/server.go index 5229adf7..cf0a2067 100644 --- a/vendor/google.golang.org/grpc/server.go +++ b/vendor/google.golang.org/grpc/server.go @@ -28,6 +28,7 @@ import ( "net/http" "reflect" "runtime" + "runtime/pprof" "strings" "sync" "sync/atomic" @@ -150,8 +151,6 @@ type Server struct { serverWorkerChannel chan func() serverWorkerChannelClose func() - - strictPathCheckingLogEmitted atomic.Bool } type serverOptions struct { @@ -250,10 +249,8 @@ func newJoinServerOption(opts ...ServerOption) ServerOption { // If this option is set to true every connection will release the buffer after // flushing the data on the wire. // -// # Experimental -// -// Notice: This API is EXPERIMENTAL and may be changed or removed in a -// later release. +// Deprecated: shared write buffer is enabled by default. SharedWriteBuffer +// will be removed in a future release. func SharedWriteBuffer(val bool) ServerOption { return newFuncServerOption(func(o *serverOptions) { o.sharedWriteBuffer = val @@ -302,6 +299,14 @@ func InitialConnWindowSize(s int32) ServerOption { // window size to the value provided and disables dynamic flow control. // The lower bound for window size is 64K and any value smaller than that // will be ignored. +// +// Note that this also disables dynamic flow control for the connection, +// falling back to a default static connection-level window of 64KB. To +// use a larger connection-level window, you must also use the +// [StaticConnWindowSize] ServerOption. +// +// Most users should not configure static flow control windows unless +// operating in a memory-constrained environment. func StaticStreamWindowSize(s int32) ServerOption { return newFuncServerOption(func(o *serverOptions) { o.initialWindowSize = s @@ -313,6 +318,14 @@ func StaticStreamWindowSize(s int32) ServerOption { // window size to the value provided and disables dynamic flow control. // The lower bound for window size is 64K and any value smaller than that // will be ignored. +// +// Note that this also disables dynamic flow control for individual streams, +// falling back to a default static connection-level window of 64KB. To +// explicitly configure the stream-level window size, you must also use the +// [StaticStreamWindowSize] ServerOption. +// +// Most users should not configure static flow control windows unless +// operating in a memory-constrained environment. func StaticConnWindowSize(s int32) ServerOption { return newFuncServerOption(func(o *serverOptions) { o.initialConnWindowSize = s @@ -1787,6 +1800,12 @@ func (s *Server) handleMalformedMethodName(stream *transport.ServerStream, ti *t func (s *Server) handleStream(t transport.ServerTransport, stream *transport.ServerStream) { ctx := stream.Context() ctx = contextWithServer(ctx, s) + if envconfig.LabelServerGoroutines&envconfig.GoroutineLabelServerMethod != 0 { + // This method always runs in its own goroutine, so we can set a + // goroutine label without needing to restore a previous context. + ctx = pprof.WithLabels(ctx, pprof.Labels("grpc.method", stream.Method())) + pprof.SetGoroutineLabels(ctx) + } var ti *traceInfo if EnableTracing { tr := newTrace("grpc.Recv."+methodFamily(stream.Method()), stream.Method()) @@ -1803,28 +1822,11 @@ func (s *Server) handleStream(t transport.ServerTransport, stream *transport.Ser } } - sm := stream.Method() - if sm == "" { + sm, found := strings.CutPrefix(stream.Method(), "/") + if !found { s.handleMalformedMethodName(stream, ti) return } - if sm[0] != '/' { - // TODO(easwars): Add a link to the CVE in the below log messages once - // published. - if envconfig.DisableStrictPathChecking { - if old := s.strictPathCheckingLogEmitted.Swap(true); !old { - channelz.Warningf(logger, s.channelz, "grpc: Server.handleStream received malformed method name %q. Allowing it because the environment variable GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING is set to true, but this option will be removed in a future release.", sm) - } - } else { - if old := s.strictPathCheckingLogEmitted.Swap(true); !old { - channelz.Warningf(logger, s.channelz, "grpc: Server.handleStream rejected malformed method name %q. To temporarily allow such requests, set the environment variable GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING to true. Note that this is not recommended as it may allow requests to bypass security policies.", sm) - } - s.handleMalformedMethodName(stream, ti) - return - } - } else { - sm = sm[1:] - } pos := strings.LastIndex(sm, "/") if pos == -1 { s.handleMalformedMethodName(stream, ti) diff --git a/vendor/google.golang.org/grpc/stats/opentelemetry/client_metrics.go b/vendor/google.golang.org/grpc/stats/opentelemetry/client_metrics.go index 91bda9ac..fb07704f 100644 --- a/vendor/google.golang.org/grpc/stats/opentelemetry/client_metrics.go +++ b/vendor/google.golang.org/grpc/stats/opentelemetry/client_metrics.go @@ -18,6 +18,7 @@ package opentelemetry import ( "context" + "maps" "sync/atomic" "time" @@ -159,27 +160,26 @@ func (h *clientMetricsHandler) HandleConn(context.Context, stats.ConnStats) {} // TagRPC implements per RPC attempt context management for metrics. func (h *clientMetricsHandler) TagRPC(ctx context.Context, info *stats.RPCTagInfo) context.Context { - // Numerous stats handlers can be used for the same channel. The cluster - // impl balancer which writes to this will only write once, thus have this - // stats handler's per attempt scoped context point to the same optional - // labels map if set. - var labels *istats.Labels - if labels = istats.GetLabels(ctx); labels == nil { - labels = &istats.Labels{ + ctx, ri := getOrCreateClientRPCInfo(ctx) + ai := ri.ai + if ai.xdsLabels == nil { + ai.xdsLabels = map[string]string{ // The defaults for all the per call labels from a plugin that // executes on the callpath that this OpenTelemetry component // currently supports. - TelemetryLabels: map[string]string{ - "grpc.lb.locality": "", - "grpc.lb.backend_service": "", - }, + "grpc.lb.locality": "", + "grpc.lb.backend_service": "", } - ctx = istats.SetLabels(ctx, labels) } - ctx, ri := getOrCreateClientRPCInfo(ctx) - ai := ri.ai + + // Numerous stats handlers can be used for the same channel. This callback + // ensures that all label updates are propagated to the rpc attempt info across + // derived contexts. + ctx = istats.RegisterTelemetryLabelCallback(ctx, func(labels map[string]string) { + maps.Copy(ai.xdsLabels, labels) + }) + ai.startTime = time.Now() - ai.xdsLabels = labels.TelemetryLabels ai.method = removeLeadingSlash(info.FullMethodName) return ctx diff --git a/vendor/google.golang.org/grpc/stats/opentelemetry/client_tracing.go b/vendor/google.golang.org/grpc/stats/opentelemetry/client_tracing.go index 718a634d..cffdb969 100644 --- a/vendor/google.golang.org/grpc/stats/opentelemetry/client_tracing.go +++ b/vendor/google.golang.org/grpc/stats/opentelemetry/client_tracing.go @@ -21,6 +21,7 @@ import ( "log" "strings" + "go.opentelemetry.io/otel/attribute" otelcodes "go.opentelemetry.io/otel/codes" "go.opentelemetry.io/otel/trace" "google.golang.org/grpc" @@ -83,7 +84,10 @@ func (h *clientTracingHandler) finishTrace(err error, ts trace.Span) { // It creates a new outgoing carrier which serializes information about this // span into gRPC Metadata, if TextMapPropagator is provided in the trace // options. if TextMapPropagator is not provided, it returns the context as is. -func (h *clientTracingHandler) traceTagRPC(ctx context.Context, ai *attemptInfo, nameResolutionDelayed bool) (context.Context, *attemptInfo) { +// +// Note: The passed attemptInfo pointer (ai) is mutated in-place. Fields such as +// ai.traceSpan are updated directly. No new attemptInfo is returned. +func (h *clientTracingHandler) traceTagRPC(ctx context.Context, ai *attemptInfo, nameResolutionDelayed bool) context.Context { // Add a "Delayed name resolution complete" event to the call span // if there was name resolution delay. In case of multiple retry attempts, // ensure that event is added only once. @@ -98,7 +102,7 @@ func (h *clientTracingHandler) traceTagRPC(ctx context.Context, ai *attemptInfo, carrier := otelinternaltracing.NewOutgoingCarrier(ctx) h.options.TraceOptions.TextMapPropagator.Inject(ctx, carrier) ai.traceSpan = span - return carrier.Context(), ai + return carrier.Context() } // createCallTraceSpan creates a call span to put in the provided context using @@ -121,7 +125,12 @@ func (h *clientTracingHandler) HandleConn(context.Context, stats.ConnStats) {} // TagRPC implements per RPC attempt context management for traces. func (h *clientTracingHandler) TagRPC(ctx context.Context, info *stats.RPCTagInfo) context.Context { ctx, ri := getOrCreateClientRPCInfo(ctx) - ctx, _ = h.traceTagRPC(ctx, ri.ai, info.NameResolutionDelay) + ci := getCallInfo(ctx) + if ci == nil { + logger.Error("context passed into client side stats handler (TagRPC) has no call info") + return ctx + } + ctx = h.traceTagRPC(ctx, ri.ai, info.NameResolutionDelay) return ctx } @@ -132,5 +141,15 @@ func (h *clientTracingHandler) HandleRPC(ctx context.Context, rs stats.RPCStats) logger.Error("ctx passed into client side tracing handler trace event handling has no client attempt data present") return } + + // Client-specific Begin attributes. + if begin, ok := rs.(*stats.Begin); ok { + ci := getCallInfo(ctx) + previousRPCAttempts := ci.previousRPCAttempts.Add(1) - 1 + ri.ai.traceSpan.SetAttributes( + attribute.Int64("previous-rpc-attempts", int64(previousRPCAttempts)), + attribute.Bool("transparent-retry", begin.IsTransparentRetryAttempt), + ) + } populateSpan(rs, ri.ai) } diff --git a/vendor/google.golang.org/grpc/stats/opentelemetry/opentelemetry.go b/vendor/google.golang.org/grpc/stats/opentelemetry/opentelemetry.go index d976e60c..b9b0c7af 100644 --- a/vendor/google.golang.org/grpc/stats/opentelemetry/opentelemetry.go +++ b/vendor/google.golang.org/grpc/stats/opentelemetry/opentelemetry.go @@ -179,6 +179,9 @@ type callInfo struct { // nameResolutionEventAdded is set when the resolver delay trace event // is added. Prevents duplicate events, since it is reported per-attempt. nameResolutionEventAdded atomic.Bool + // previousRPCAttempts holds the count of RPC attempts that have happened + // before current attempt. Transparent retries are excluded. + previousRPCAttempts atomic.Uint32 } type callInfoKey struct{} @@ -257,9 +260,8 @@ type attemptInfo struct { // message counters for sent and received messages (used for // generating message IDs), and the number of previous RPC attempts for the // associated call. - countSentMsg uint32 - countRecvMsg uint32 - previousRPCAttempts uint32 + countSentMsg uint32 + countRecvMsg uint32 } type clientMetrics struct { diff --git a/vendor/google.golang.org/grpc/stats/opentelemetry/trace.go b/vendor/google.golang.org/grpc/stats/opentelemetry/trace.go index 40ac7a1b..3ee66d1e 100644 --- a/vendor/google.golang.org/grpc/stats/opentelemetry/trace.go +++ b/vendor/google.golang.org/grpc/stats/opentelemetry/trace.go @@ -17,8 +17,6 @@ package opentelemetry import ( - "sync/atomic" - "go.opentelemetry.io/otel/attribute" otelcodes "go.opentelemetry.io/otel/codes" "go.opentelemetry.io/otel/trace" @@ -40,18 +38,6 @@ func populateSpan(rs stats.RPCStats, ai *attemptInfo) { span := ai.traceSpan switch rs := rs.(type) { - case *stats.Begin: - // Note: Go always added Client and FailFast attributes even though they are not - // defined by the OpenCensus gRPC spec. Thus, they are unimportant for - // correctness. - span.SetAttributes( - attribute.Bool("Client", rs.Client), - attribute.Bool("FailFast", rs.FailFast), - attribute.Int64("previous-rpc-attempts", int64(ai.previousRPCAttempts)), - attribute.Bool("transparent-retry", rs.IsTransparentRetryAttempt), - ) - // increment previous rpc attempts applicable for next attempt - atomic.AddUint32(&ai.previousRPCAttempts, 1) case *stats.DelayedPickComplete: span.AddEvent("Delayed LB pick complete") case *stats.InPayload: diff --git a/vendor/google.golang.org/grpc/version.go b/vendor/google.golang.org/grpc/version.go index 3ccfe515..cf114ef4 100644 --- a/vendor/google.golang.org/grpc/version.go +++ b/vendor/google.golang.org/grpc/version.go @@ -19,4 +19,4 @@ package grpc // Version is the current grpc version. -const Version = "1.81.1" +const Version = "1.82.0" diff --git a/vendor/modules.txt b/vendor/modules.txt index f6e0bdbc..e20b47ed 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -42,14 +42,14 @@ cloud.google.com/go/iam/apiv1/iampb cloud.google.com/go/monitoring/apiv3/v2 cloud.google.com/go/monitoring/apiv3/v2/monitoringpb cloud.google.com/go/monitoring/internal -# cloud.google.com/go/storage v1.63.0 -## explicit; go 1.25.8 +# cloud.google.com/go/storage v1.63.1 +## explicit; go 1.25.0 cloud.google.com/go/storage cloud.google.com/go/storage/experimental cloud.google.com/go/storage/internal cloud.google.com/go/storage/internal/apiv2 cloud.google.com/go/storage/internal/apiv2/storagepb -# github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 +# github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 ## explicit; go 1.24.0 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp # github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 @@ -93,6 +93,7 @@ github.com/envoyproxy/go-control-plane/envoy/data/accesslog/v3 github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/aggregate/v3 github.com/envoyproxy/go-control-plane/envoy/extensions/filters/common/fault/v3 github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/fault/v3 +github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3 github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/rbac/v3 github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/router/v3 github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3 @@ -176,11 +177,11 @@ github.com/google/s2a-go/stream # github.com/google/uuid v1.6.0 ## explicit github.com/google/uuid -# github.com/googleapis/enterprise-certificate-proxy v0.3.16 -## explicit; go 1.25.8 +# github.com/googleapis/enterprise-certificate-proxy v0.3.17 +## explicit; go 1.25.0 github.com/googleapis/enterprise-certificate-proxy/client github.com/googleapis/enterprise-certificate-proxy/client/util -# github.com/googleapis/gax-go/v2 v2.22.0 +# github.com/googleapis/gax-go/v2 v2.23.0 ## explicit; go 1.25.0 github.com/googleapis/gax-go/v2 github.com/googleapis/gax-go/v2/apierror @@ -241,7 +242,7 @@ go.mozilla.org/mozlogrus ## explicit; go 1.24.0 go.opentelemetry.io/auto/sdk go.opentelemetry.io/auto/sdk/internal/telemetry -# go.opentelemetry.io/contrib/detectors/gcp v1.42.0 +# go.opentelemetry.io/contrib/detectors/gcp v1.43.0 ## explicit; go 1.25.0 go.opentelemetry.io/contrib/detectors/gcp # go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 @@ -360,8 +361,8 @@ golang.org/x/text/unicode/norm # golang.org/x/time v0.15.0 ## explicit; go 1.25.0 golang.org/x/time/rate -# google.golang.org/api v0.285.0 -## explicit; go 1.25.8 +# google.golang.org/api v0.287.1 +## explicit; go 1.25.0 google.golang.org/api/googleapi google.golang.org/api/googleapi/transport google.golang.org/api/iamcredentials/v1 @@ -384,7 +385,7 @@ google.golang.org/genproto/googleapis/type/calendarperiod google.golang.org/genproto/googleapis/type/date google.golang.org/genproto/googleapis/type/expr google.golang.org/genproto/googleapis/type/timeofday -# google.golang.org/genproto/googleapis/api v0.0.0-20260615183401-62b3387ff324 +# google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 ## explicit; go 1.25.0 google.golang.org/genproto/googleapis/api google.golang.org/genproto/googleapis/api/annotations @@ -393,12 +394,12 @@ google.golang.org/genproto/googleapis/api/expr/v1alpha1 google.golang.org/genproto/googleapis/api/label google.golang.org/genproto/googleapis/api/metric google.golang.org/genproto/googleapis/api/monitoredres -# google.golang.org/genproto/googleapis/rpc v0.0.0-20260615183401-62b3387ff324 +# google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 ## explicit; go 1.25.0 google.golang.org/genproto/googleapis/rpc/code google.golang.org/genproto/googleapis/rpc/errdetails google.golang.org/genproto/googleapis/rpc/status -# google.golang.org/grpc v1.81.1 +# google.golang.org/grpc v1.82.0 ## explicit; go 1.25.0 google.golang.org/grpc google.golang.org/grpc/attributes @@ -446,6 +447,8 @@ google.golang.org/grpc/encoding google.golang.org/grpc/encoding/gzip google.golang.org/grpc/encoding/internal google.golang.org/grpc/encoding/proto +google.golang.org/grpc/experimental/balancer/hostname +google.golang.org/grpc/experimental/balancer/weight google.golang.org/grpc/experimental/opentelemetry google.golang.org/grpc/experimental/stats google.golang.org/grpc/grpclog @@ -455,7 +458,6 @@ google.golang.org/grpc/internal/admin google.golang.org/grpc/internal/backoff google.golang.org/grpc/internal/balancer/gracefulswitch google.golang.org/grpc/internal/balancer/nop -google.golang.org/grpc/internal/balancer/weight google.golang.org/grpc/internal/balancergroup google.golang.org/grpc/internal/balancerload google.golang.org/grpc/internal/binarylog @@ -489,6 +491,7 @@ google.golang.org/grpc/internal/stats google.golang.org/grpc/internal/status google.golang.org/grpc/internal/syscall google.golang.org/grpc/internal/transport +google.golang.org/grpc/internal/transport/internal google.golang.org/grpc/internal/transport/networktype google.golang.org/grpc/internal/transport/readyreader google.golang.org/grpc/internal/wrr