Signed-off-by: Ryan Northey <[email protected]>

HTTP/2 user agents split individual cookies into dedicated header
entries to improve header map compression. The
``envoy.reloadable_features.http2_max_cookies_size_in_kb`` value can be
set to limit the size of the re-assembled cookie header. This value is 0
by default, which is treated as having no limit.

This value can be used as a stop gap protection while safe header map
count and size limits are determined for H/1 requests.

Risk Level: low
Testing: unit tests
Docs Changes: no
Release Notes: yes
Platform Specific Features: no

---------

Signed-off-by: Yan Avlasov <[email protected]>

Signed-off-by: yanavlasov <[email protected]>

Document the http2.cookies_total_bytes_too_large counter added for the
HTTP/2 re-assembled cookie header size limit. Followup for
#45476

<!--
!!!ATTENTION!!!

If you are fixing **any** crash or **any** potential security issue,
**do not
open a pull request**.

Instead, please
[open a GitHub Security
Advisory](https://github.com/envoyproxy/envoy/security/advisories/new)
(preferred). Alternatively, you may email
[email protected].

Thank you in advance for helping to keep Envoy secure.

!!!ATTENTION!!!

For an explanation of how to fill out the fields, please see the
relevant section
in
[PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md)

!!!ATTENTION!!!

Please check the [use of generative AI
policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41).

You may use generative AI only if you fully understand the code. You
need to disclose
this usage in the PR description to ensure transparency.
-->

Commit Message:
Additional Description:
Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional [API
Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):]

Signed-off-by: Kateryna Nezdolii <[email protected]>
Signed-off-by: Kateryna Nezdolii <[email protected]>

Add histograms for HTTP/2 header map stats.

* header_count - total count of header entries received (including
individual ``cookie`` headers)
* header_list_size - total byte size of header map entries, total length
of the re-assembled ``cookie``
* cookie_count - count of individual ``cookie`` headers.
* cookie_size - size of re-assembled ``cookie`` headers.

Histograms are disabled by default and can be enabled by
setting the runtime guard
``envoy.reloadable_features.http2_record_histograms`` to ``true``.

Risk Level: low
Testing: unit tests
Docs Changes: yes
Release Notes: yes
Platform Specific Features: no
Runtime guard: envoy.reloadable_features.http2_record_histograms

---------

Signed-off-by: Yan Avlasov <[email protected]>

…the default value (#45477)

Implemented failing-integration-test-first, proving the bug existed.

Assisted by Codex 5.5 xhigh, but I went over all the changes manually
and cleaned up several.

I don't think it's possible to sanely runtime-guard the change, because
how can you possibly make runtime-guards optionally not update correctly
based on a runtime-guard? Updating that value would work if set and not
work if not set, very confusingly.

Issue was discovered when we tried to turn the recent "cookie overload"
patch back on after tuning the limits, and it appeared to be fine, but
then wasn't fine on instances deployed after the reset - the runtime
override to "off" was still in effect on the original instances, while
admin `/runtime` on the same instance was reporting no such override.

Risk Level: Small - it is a behavior change, but the old behavior was
incorrect, and unlikely to have been positively relied upon.
Testing: Integration test and unit test.
Docs Changes: n/a
Release Notes: yes
Platform Specific Features: n/a

---------

Signed-off-by: Raven Black <[email protected]>

Signed-off-by: Kateryna Nezdolii <[email protected]>

**Summary of changes**:

* Bug fixes:
  - runtime: fixed RTDS runtime guard override removal so deleting an override restores the process-wide runtime guard value to the default value.

* New features:
  - http2: added opt-in histograms for HTTP/2 header statistics, including header-entry count, header-map byte size, reassembled ``cookie`` header length, and individual ``cookie`` header count. Enable with ``envoy.reloadable_features.http2_record_histograms``; the histograms and runtime guard will be removed in a future Envoy release.
  - http2: added ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` to limit the size of the reassembled ``cookie`` header. By default, no cookie-size limit is enforced.

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.36.8
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.36.8/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.36.8/version_history/v1.36/v1.36.8
**Full changelog**:
    v1.36.7...v1.36.8