tcp proxy: add default 1 hour idle timeout (#8705)

Fixes https://github.com/envoyproxy/envoy/issues/8679

Signed-off-by: Matt Klein <mklein@lyft.com>

Mirrored from https://github.com/envoyproxy/envoy @ fbd056aae8d74e8acae8880c0766af588a6c3583

envoy/api/v2/core/protocol.proto

@@ -26,6 +26,10 @@ message HttpProtocolOptions {
   // <envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.drain_timeout>`.
   // Note that request based timeouts mean that HTTP/2 PINGs will not keep the connection alive.
   // If not specified, this defaults to 1 hour. To disable idle timeouts explicitly set this to 0.
+  //
+  // .. warning::
+  //   Disabling this timeout has a highly likelihood of yielding connection leaks due to lost TCP
+  //   FIN packets, etc.
   google.protobuf.Duration idle_timeout = 1;
 
   // The maximum number of headers. If unconfigured, the default

envoy/api/v3alpha/core/protocol.proto

@@ -26,6 +26,10 @@ message HttpProtocolOptions {
   // <envoy_api_field_config.filter.network.http_connection_manager.v3alpha.HttpConnectionManager.drain_timeout>`.
   // Note that request based timeouts mean that HTTP/2 PINGs will not keep the connection alive.
   // If not specified, this defaults to 1 hour. To disable idle timeouts explicitly set this to 0.
+  //
+  // .. warning::
+  //   Disabling this timeout has a highly likelihood of yielding connection leaks due to lost TCP
+  //   FIN packets, etc.
   google.protobuf.Duration idle_timeout = 1;
 
   // The maximum number of headers. If unconfigured, the default

envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.proto

@@ -119,9 +119,13 @@ message TcpProxy {
 
   // The idle timeout for connections managed by the TCP proxy filter. The idle timeout
   // is defined as the period in which there are no bytes sent or received on either
-  // the upstream or downstream connection. If not set, connections will never be closed
+  // the upstream or downstream connection. If not set, the default idle timeout is 1 hour. If set
-  // by the TCP proxy due to being idle.
+  // to 0s, the timeout will be disabled.
-  google.protobuf.Duration idle_timeout = 8 [(validate.rules).duration = {gt {}}];
+  //
+  // .. warning::
+  //   Disabling this timeout has a highly likelihood of yielding connection leaks due to lost TCP
+  //   FIN packets, etc.
+  google.protobuf.Duration idle_timeout = 8;
 
   // [#not-implemented-hide:] The idle timeout for connections managed by the TCP proxy
   // filter. The idle timeout is defined as the period in which there is no

envoy/config/filter/network/tcp_proxy/v3alpha/tcp_proxy.proto

@@ -67,9 +67,13 @@ message TcpProxy {
 
   // The idle timeout for connections managed by the TCP proxy filter. The idle timeout
   // is defined as the period in which there are no bytes sent or received on either
-  // the upstream or downstream connection. If not set, connections will never be closed
+  // the upstream or downstream connection. If not set, the default idle timeout is 1 hour. If set
-  // by the TCP proxy due to being idle.
+  // to 0s, the timeout will be disabled.
-  google.protobuf.Duration idle_timeout = 8 [(validate.rules).duration = {gt {}}];
+  //
+  // .. warning::
+  //   Disabling this timeout has a highly likelihood of yielding connection leaks due to lost TCP
+  //   FIN packets, etc.
+  google.protobuf.Duration idle_timeout = 8;
 
   // [#not-implemented-hide:] The idle timeout for connections managed by the TCP proxy
   // filter. The idle timeout is defined as the period in which there is no