Envoy ext_proc filter throw exception when received response timeout Duration is too large (#27260)

* Adding ext_proc filter config and response timeout Duration PGVs to avoid ext_proc filter fuzzer crash due to duration config out-of-bounds.

Signed-off-by: Yanjun Xiang <yanjunxiang@google.com>

Mirrored from https://github.com/envoyproxy/envoy @ b14b3e875db1436d2239c0affb8f9429196b13dd

envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto

@@ -139,13 +139,16 @@ message ExternalProcessor {
   repeated string response_attributes = 6;
 
   // Specifies the timeout for each individual message sent on the stream and
-  // when the filter is running in synchronous mode. Whenever
-  // the proxy sends a message on the stream that requires a response, it will
-  // reset this timer, and will stop processing and return an error (subject
-  // to the processing mode) if the timer expires before a matching response
-  // is received. There is no timeout when the filter is running in asynchronous
-  // mode. Default is 200 milliseconds.
-  google.protobuf.Duration message_timeout = 7;
+  // when the filter is running in synchronous mode. Whenever the proxy sends
+  // a message on the stream that requires a response, it will reset this timer,
+  // and will stop processing and return an error (subject to the processing mode)
+  // if the timer expires before a matching response is received. There is no
+  // timeout when the filter is running in asynchronous mode. The
+  // ``message_timeout`` range is >= 0s and <= 3600s. Default is 200 milliseconds.
+  google.protobuf.Duration message_timeout = 7 [(validate.rules).duration = {
+    lte {seconds: 3600}
+    gte {}
+  }];
 
   // Optional additional prefix to use when emitting statistics. This allows to distinguish
   // emitted statistics between configured *ext_proc* filters in an HTTP filter chain.
@@ -166,8 +169,12 @@ message ExternalProcessor {
 
   // Specify the upper bound of
   // :ref:`override_message_timeout <envoy_v3_api_field_service.ext_proc.v3.ProcessingResponse.override_message_timeout>`
+  // The ``max_message_timeout`` range is >= 0s and <= 3600s.
   // If not specified, by default it is 0, which will effectively disable the ``override_message_timeout`` API.
-  google.protobuf.Duration max_message_timeout = 10;
+  google.protobuf.Duration max_message_timeout = 10 [(validate.rules).duration = {
+    lte {seconds: 3600}
+    gte {}
+  }];
 
   // Prevents clearing the route-cache when the
   // :ref:`clear_route_cache <envoy_v3_api_field_service.ext_proc.v3.CommonResponse.clear_route_cache>`