release-1.24: fix web socket handshake and ext_proc issue (#5)

.github/workflows/build.yaml

@@ -0,0 +1,36 @@
+name: build
+on:
+  push:
+    branches:
+      - release-1.24
+
+concurrency: ${{ github.ref }}
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  build:
+    runs-on: [gyg-gha-runner-32x128]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          pull: true
+          file: Dockerfile
+          context: .
+          platforms: linux/amd64
+          push: true
+          tags: getyourguide/proxy:1.24.2-patch

Dockerfile

@@ -0,0 +1,11 @@
+FROM gcr.io/istio-testing/build-tools-proxy:release-1.24-latest AS builder
+
+WORKDIR /work/
+
+COPY . /work/
+
+RUN BAZEL_BUILD_ARGS="--config=libc++" make build_envoy
+
+FROM istio/proxyv2:1.24.2
+
+COPY --from=builder /work/bazel-bin/envoy /usr/local/bin/

WORKSPACE

@@ -38,6 +38,8 @@ http_archive(
     sha256 = ENVOY_SHA256,
     strip_prefix = ENVOY_REPO + "-" + ENVOY_SHA,
     url = "https://github.com/" + ENVOY_ORG + "/" + ENVOY_REPO + "/archive/" + ENVOY_SHA + ".tar.gz",
+    patches = ["fix-websocket-handshake.patch"],
+    patch_args = ["-p1"],
 )
 
 load("@envoy//bazel:api_binding.bzl", "envoy_api_binding")

external/fix-websocket-handshake.patch

@@ -0,0 +1,20 @@
+diff --git a/source/extensions/filters/http/ext_proc/ext_proc.h b/source/extensions/filters/http/ext_proc/ext_proc.h
+index 240ffc505e..4bca507463 100644
+--- a/source/extensions/filters/http/ext_proc/ext_proc.h
++++ b/source/extensions/filters/http/ext_proc/ext_proc.h
+@@ -455,6 +455,15 @@ public:
+   void onComplete(envoy::service::ext_proc::v3::ProcessingResponse& response) override;
+   void onError() override;
+
++  Envoy::Http::LocalErrorStatus
++  onLocalReply(const Envoy::Http::StreamFilterBase::LocalReplyData&) override {
++    ENVOY_LOG(debug, "When onLocalReply() is called, set processing_complete_ to true to skip "
++                     "external processing");
++    processing_complete_ = true;
++
++    return ::Envoy::Http::LocalErrorStatus::Continue;
++  }
++
+ private:
+   void mergePerRouteConfig();
+   StreamOpenState openStream();