Fix websocket test flakes and complete TCP half-closed support

WORKSPACE

@@ -45,6 +45,8 @@ git_repository(
         "@//patches:0006-test-integration-Defer-fake-upstream-read-enable-un.patch",
         "@//patches:0007-config-add-grpc-mux-stream-event-callback.patch",
         "@//patches:0008-repo-Make-yq-dependency-optional-for-CI-config-parsi.patch",
+        "@//patches:0009-network-Allow-write-filters-to-consume-data-after-e.patch",
+        "@//patches:0010-tcp_proxy-Allow-filters-to-wait-for-upstream-close.patch",
     ],
     # // clang-format off: Envoy's format check: Only repository_locations.bzl may contains URL references
     remote = "https://github.com/envoyproxy/envoy.git",

cilium/BUILD

@@ -160,6 +160,7 @@ envoy_cc_library(
         "//cilium:accesslog_lib",
         "//cilium:filter_state_lib",
         "//cilium/api:websocket_cc_proto",
+        "@com_google_protobuf//third_party/utf8_range:utf8_validity",
         "@envoy//bazel/external/http_parser",
         "@envoy//envoy/common/crypto:crypto_interface",
         "@envoy//source/common/common:base64_lib",
@@ -171,6 +172,7 @@ envoy_cc_library(
         "@envoy//source/common/http:utility_lib",
         "@envoy//source/common/network:filter_manager_lib",
         "@envoy//source/common/stream_info:bool_accessor_lib",
+        "@envoy//source/common/stream_info:uint64_accessor_lib",
         "@envoy//source/common/tcp_proxy",
         "@envoy_api//envoy/extensions/request_id/uuid/v3:pkg_cc_proto",
     ],

cilium/websocket.cc

@@ -1,5 +1,6 @@
 #include "cilium/websocket.h"
 
+#include <chrono>
 #include <cstdint>
 #include <memory>
 #include <string>
@@ -19,6 +20,7 @@
 #include "source/common/protobuf/protobuf.h"
 #include "source/common/protobuf/utility.h"
 #include "source/common/stream_info/bool_accessor_impl.h"
+#include "source/common/stream_info/uint64_accessor_impl.h"
 #include "source/common/tcp_proxy/tcp_proxy.h"
 
 #include "absl/status/statusor.h"
@@ -34,6 +36,8 @@ namespace WebSocket {
 
 namespace {
 
+constexpr std::chrono::milliseconds WebSocketTransportCloseTimeout{1000};
+
 Http::RegisterCustomInlineHeader<Http::CustomInlineHeaderRegistry::Type::RequestHeaders>
     origin_handle(Http::CustomHeaders::get().Origin);
 Http::RegisterCustomInlineHeader<Http::CustomInlineHeaderRegistry::Type::RequestHeaders>
@@ -128,6 +132,16 @@ void Instance::initializeReadFilterCallbacks(Network::ReadFilterCallbacks& callb
   callbacks_->connection().streamInfo().filterState()->setData(
       TcpProxy::ReceiveBeforeConnectKey, std::make_unique<StreamInfo::BoolAccessorImpl>(true),
       StreamInfo::FilterState::StateType::Mutable, StreamInfo::FilterState::LifeSpan::Connection);
+
+  // After both directions of a client-side WebSocket tunnel have ended, TcpProxy must flush the
+  // final data and CLOSE frame and wait for the peer's transport FIN. Closing immediately can
+  // generate an RST if a peer control frame is still unread, losing the just-flushed frames.
+  if (config_->client_) {
+    callbacks_->connection().streamInfo().filterState()->setData(
+        TcpProxy::UpstreamFlushWaitTimeoutMs,
+        std::make_unique<StreamInfo::UInt64AccessorImpl>(WebSocketTransportCloseTimeout.count()),
+        StreamInfo::FilterState::StateType::Mutable, StreamInfo::FilterState::LifeSpan::Connection);
+  }
 }
 
 Network::FilterStatus Instance::onNewConnection() {