[release-1.12] June CVE 2022 (#68)

* Update envoy

* Check if getValue returns true in the constructor (#156)

* Private build fixes

Co-authored-by: Jonh Wendell <jonh.wendell@redhat.com>

Makefile.core.mk

@@ -71,7 +71,7 @@ CENTOS_BAZEL_TEST_TARGETS ?= ${BAZEL_TARGETS} -tools/deb/... -tools/docker/... -
 
 # Prerun @com_googlesource_chromium_v8//:build if and only if BAZEL_TARGETS depends on v8.
 prerun_v8_build:
-	@if bazel query "deps($(BAZEL_TARGETS))" | grep -q com_googlesource_chromium_v8; then\
+	@if bazel $(BAZEL_BUILD_ARGS) query "deps($(BAZEL_TARGETS))" | grep -q com_googlesource_chromium_v8; then\
 		export PATH=$(PATH) CC=$(CC) CXX=$(CXX) && \
 		bazel $(BAZEL_STARTUP_ARGS) build $(BAZEL_BUILD_ARGS) ${V8_BUILD_CONFIG} @com_googlesource_chromium_v8//:build;\
 	fi
@@ -154,7 +154,6 @@ check:
 lint: lint-copyright-banner format-go lint-go tidy-go lint-scripts
 	@scripts/check-repository.sh
 	@scripts/check-style.sh
-	@scripts/verify-last-flag-matches-upstream.sh
 
 protoc = protoc -I common-protos -I extensions
 protoc_gen_docs_plugin := --docs_out=camel_case_fields=false,warnings=true,per_file=true,mode=html_fragment_with_front_matter:$(repo_dir)/

WORKSPACE

@@ -34,16 +34,16 @@ bind(
     actual = "//external:ssl",
 )
 
-# 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
+# 1. Determine SHA256 `wget https://github.com/istio/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
 # Note: this is needed by release builder to resolve envoy dep sha to tag.
-# Commit date: 2022-04-29
-ENVOY_SHA = "875bb7dda84a87786cb0b504a5b964d31141a653"
+# Commit date: 2022-06-02
+ENVOY_SHA = "ac7309d476a6331162efcb3170397ff6e02a7661"
 
-ENVOY_SHA256 = "a90001351386984ac36ee4a52b43098af8162294427e76a52509bc8743549a17"
+ENVOY_SHA256 = "0c985dc38b4112574ca19a629458072838c94cd981170a3750bae498d5cedfee"
 
-ENVOY_ORG = "envoyproxy"
+ENVOY_ORG = "istio"
 
 ENVOY_REPO = "envoy"
 

extensions/common/context.cc

@@ -346,8 +346,9 @@ PeerNodeInfo::PeerNodeInfo(const std::string_view peer_metadata_id_key,
   // Attempt to read from filter_state first.
   found_ = getValue({peer_metadata_id_key}, &peer_id_);
   if (found_ && peer_id_ != kMetadataNotFoundValue) {
-    getValue({peer_metadata_key}, &peer_node_);
-    return;
+    if (getValue({peer_metadata_key}, &peer_node_)) {
+      return;
+    }
   }
 
   // Sentinel value is preserved as ID to implement maybeWaiting.