Backport following commits to 1.16:
748b2ab (mac ci: try ignoring update failure (envoyproxy#13658), 2020-10-20)
f95f539 (ci: various improvements (envoyproxy#13660), 2020-10-20)
6481a27 (ci: stop building alpine-debug images in favor of ubuntu-based debug image (envoyproxy#13598), 2020-10-15)
73d78f8 (ci: use multiple stage (envoyproxy#13557), 2020-10-15)
b7a4756 (ci: use azp for api and go-control-plane sync (envoyproxy#13550), 2020-10-14)
876a6bb (ci use azp to sync filter example (envoyproxy#13501), 2020-10-12)
a0f31ee (ci: use azp to generate docs (envoyproxy#13481), 2020-10-12)
7e5d854 (ci: bring BAZEL_BUILD_OPTIONS back for format and docs (envoyproxy#13480), 2020-10-11)
7af2b2b (ci: use same flaky test process script on macOS (envoyproxy#13485), 2020-10-10)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
Co-authored-by: asraa <asraa@google.com>

…envoyproxy#13882)

* Prevent SEGFAULT when disabling listener (envoyproxy#13515)

This prevents the stop_listening overload action from causing
segmentation faults that can occur if the action is enabled after the
listener has already shut down.

Signed-off-by: Alex Konradi <akonradi@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

… (envoyproxy#13966)

Fix a bug where the transport socket options for the first downstream got reused for subsequent upstream connections.

Risk Level: low
Testing: new integration test
Docs Changes: n/a
Release Notes:
Platform Specific Features:
Fixes envoyproxy#13659

Signed-off-by: Alyssa Wilk <alyssar@chromium.org>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

…on requests and replay them when re-enabling read. (envoyproxy#13772) (envoyproxy#14017)

Fixes SslSocket read resumption after readDisable when processing the SSL record that contains the last bytes of the HTTP message

Risk Level: low
Testing: new unit and integration tests
Docs Changes: n/a
Release Notes: added
Platform Specific Features: n/a
Fixes envoyproxy#12304

Signed-off-by: Antonio Vicente <avd@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

…alloc (envoyproxy#13447) (envoyproxy#14082)

Signed-off-by: Joshua Marantz <jmarantz@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Co-authored-by: Joshua Marantz <jmarantz@google.com>

… (envoyproxy#14127)

The client request stream can be deleted under the call stack of Envoy::IntegrationCodecClient::startRequest if the proxy replies quickly enough. Attempts to send an end stream on that request result in use-after-free on the client stream in cases where the client processed the full reply inside startRequest.

Fixes envoyproxy#12960

Signed-off-by: Antonio Vicente <avd@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Co-authored-by: antonio <avd@google.com>

Backport of PR envoyproxy#13529 and envoyproxy#13503

Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Co-authored-by: phlax <phlax@users.noreply.github.com>

…nvoyproxy#14130)

Signed-off-by: Matt Klein <mklein@lyft.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>
Co-authored-by: Matt Klein <mklein@lyft.com>
Co-authored-by: Christoph Pakulski <christoph@tetrate.io>

…amInfo (envoyproxy#14132)

This fixes a regression which resulted in the downstreamRemoteAddress
on the StreamInfo for a connection not having the address supplied by
the proxy protocol filter, but instead having the address of the
directly connected peer.

This issue does not affect HTTP filters.

Signed-off-by: Greg Greenway <ggreenway@apple.com>

…ase-1.8-1.16.1-envoy-sync

Signed-off-by: Pengyuan Bian <bianpengyuan@google.com>