Signed-off-by: Ryan Northey <ryan@synca.io>

In SslCertficateIntegrationTest.BothEcdsaAndRsaOnlyEcdsaOcspResponse,
the only check made on the OCSP response was on it's length not being
zero. However, in some error circumstances, the length given by
SSL_get0_ocsp_response() may be -1, which gives a false positive
result from the test. This commit expands the checking on the OCSP
response to check for the actual expected length and expected bytes.

Signed-off-by: Ted Poole <tpoole@redhat.com>

…12c829` in /ci (#33860)

build(deps): bump distroless/base-nossl-debian12 in /ci

Bumps distroless/base-nossl-debian12 from `0cf184c` to `312c829`.

---
updated-dependencies:
- dependency-name: distroless/base-nossl-debian12
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: He Jie Xu <hejie.xu@intel.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

…a09e57` in /ci (#33956)

build(deps): bump distroless/base-nossl-debian12 in /ci

Bumps distroless/base-nossl-debian12 from `312c829` to `8a09e57`.

---
updated-dependencies:
- dependency-name: distroless/base-nossl-debian12
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

* backports: backporting 34142

Signed-off-by: Alyssa Wilk <alyssar@chromium.org>
Co-authored-by: botengyao <boteng@google.com>

Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Ryan Northey <ryan@synca.io>

…4300) (#34302)

tls_inspector: Fix invalid ALPN extension in test (#34300)

This commit stops generateClientHelloFromJA3Fingerprint() generating client
hellos containing an invalid ALPN extension. It also updates relevant
tls_inspector_test functions to check the ALPN value, if expected.

When the generateClientHelloFromJA3Fingerprint() function was asked to include
an ALPN extension (16) in the generated client hello, it was generating a
default empty extension with the correct id (16) but a zero length. While this
is technically a valid extension, it is not a valid ALPN extension, which must
include a list of the client's preferred protocol(s).

This was causing test failures in the envoy-openssl repo because OpenSSL
responds to the malformed ALPN extension by sending a TLS alert 50 (Decode
Error) which causes many of the tls_inspector_test functions to fail.

Signed-off-by: Ted Poole <tpoole@redhat.com>

Signed-off-by: wbpcode <wbphub@live.com>

Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Dan Zhang <danzh@google.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Kevin Baichoo <kbaichoo@netflix.com>

Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Dan Zhang <danzh@google.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Boteng Yao <boteng@google.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Boteng Yao <boteng@google.com>
Signed-off-by: Yan Avlasov <yavlasov@google.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Ryan Northey <ryan@synca.io>

**Summary of changes:**

- [CVE-2024-34362: Crash (use-after-free) in EnvoyQuicServerStream](GHSA-hww5-43gv-35jv)
- [CVE-2024-34363: Crash due to uncaught nlohmann JSON exception](GHSA-g979-ph9j-5gg4)
- [CVE-2024-34364: Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response, and other components](GHSA-xcj3-h7vf-fw26)
- [CVE-2024-32974: Crash in EnvoyQuicServerStream::OnInitialHeadersComplete()](GHSA-mgxp-7hhp-8299)
- [CVE-2024-32975: Crash in QuicheDataReader::PeekVarInt62Length()](GHSA-g9mq-6v96-cpqc)
- [CVE-2024-32976: Endless loop while decompressing Brotli data with extra input](GHSA-7wp5-c2vq-4f8m)
- [CVE-2024-23326: Envoy incorrectly accepts HTTP 200 response for entering upgrade mode](GHSA-vcf8-7238-v74c)

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.28.4
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.28.4/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.28.4/version_history/v1.28/v1.28.4
**Full changelog**:
    v1.28.3...v1.28.4

Signed-off-by: Ryan Northey <ryan@synca.io>