listener: Local rate limit listener filter (#25440)

* listener: Local rate limit listener filter

Signed-off-by: kuochunghsu <kuochunghsu@pinterest.com>

Mirrored from https://github.com/envoyproxy/envoy @ e71a141c3f191e5a0c5ddfb8c41151a5fbef3dd2

BUILD

@@ -200,6 +200,7 @@ proto_library(
         "//envoy/extensions/filters/http/upstream_codec/v3:pkg",
         "//envoy/extensions/filters/http/wasm/v3:pkg",
         "//envoy/extensions/filters/listener/http_inspector/v3:pkg",
+        "//envoy/extensions/filters/listener/local_ratelimit/v3:pkg",
         "//envoy/extensions/filters/listener/original_dst/v3:pkg",
         "//envoy/extensions/filters/listener/original_src/v3:pkg",
         "//envoy/extensions/filters/listener/proxy_protocol/v3:pkg",

envoy/extensions/filters/listener/local_ratelimit/v3/BUILD

@@ -0,0 +1,13 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/config/core/v3:pkg",
+        "//envoy/type/v3:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)

envoy/extensions/filters/listener/local_ratelimit/v3/local_ratelimit.proto

@@ -0,0 +1,38 @@
+syntax = "proto3";
+
+package envoy.extensions.filters.listener.local_ratelimit.v3;
+
+import "envoy/config/core/v3/base.proto";
+import "envoy/type/v3/token_bucket.proto";
+
+import "udpa/annotations/status.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.filters.listener.local_ratelimit.v3";
+option java_outer_classname = "LocalRatelimitProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/local_ratelimit/v3;local_ratelimitv3";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Local Rate Limit Filter]
+// Local rate limit :ref:`configuration overview <config_listener_filters_local_rate_limit>`.
+// [#extension: envoy.filters.listener.local_ratelimit]
+
+message LocalRateLimit {
+  // The prefix to use when emitting :ref:`statistics
+  // <config_listener_filters_local_rate_limit_stats>`.
+  string stat_prefix = 1 [(validate.rules).string = {min_len: 1}];
+
+  // The token bucket configuration to use for rate limiting all incoming sockets. If the token is available,
+  // the socket will be allowed. If no tokens are available, the socket will be immediately closed.
+  //
+  // .. note::
+  //   In the current implementation the token bucket's :ref:`fill_interval
+  //   <envoy_v3_api_field_type.v3.TokenBucket.fill_interval>` must be >= 50ms to avoid too aggressive
+  //   refills.
+  type.v3.TokenBucket token_bucket = 2 [(validate.rules).message = {required: true}];
+
+  // Runtime flag that controls whether the filter is enabled or not. If not specified, defaults
+  // to enabled.
+  config.core.v3.RuntimeFeatureFlag runtime_enabled = 3;
+}

versioning/BUILD

@@ -138,6 +138,7 @@ proto_library(
         "//envoy/extensions/filters/http/upstream_codec/v3:pkg",
         "//envoy/extensions/filters/http/wasm/v3:pkg",
         "//envoy/extensions/filters/listener/http_inspector/v3:pkg",
+        "//envoy/extensions/filters/listener/local_ratelimit/v3:pkg",
         "//envoy/extensions/filters/listener/original_dst/v3:pkg",
         "//envoy/extensions/filters/listener/original_src/v3:pkg",
         "//envoy/extensions/filters/listener/proxy_protocol/v3:pkg",