fix(contrib/envoyproxy): use source.ip from ext_proc attributes

[e-n-0]

What does this PR do?

• Reads the GCP Service Extension source.ip attribute from the structured Envoy ext_proc attribute namespace.
• Uses a valid forwarded source IP as the authoritative trace and AppSec/WAF client identity.
• Treats a present but invalid attribute as authoritative-invalid, preventing fallback to spoofable request headers.
• Preserves the existing header and connection-address resolver when the attribute is absent, and leaves non-GCP integrations unchanged.
• Documents the required forwardAttributes: [source.ip] deployment setting.

The rollout assumes clients connect directly to the Google Cloud Load Balancer. Deployments must also restrict access to the ext_proc endpoint to the intended GCP Service Extension path. A CDN in front of GCLB requires its own separately trusted forwarding mechanism.

Motivation

The existing generic client-IP resolver intentionally falls back to forwarding headers. In the direct GCLB Service Extension topology, that can allow a client-supplied X-Forwarded-For value to become the AppSec identity even though GCLB can provide the connection source as trusted structured metadata.

Using the GCP source.ip attribute fixes the trust boundary without changing shared resolver behavior for other tracers, integrations, or deployments.

Related Google context:

• https://docs.cloud.google.com/service-extensions/docs/attributes
• source attributes (IP, region) inside an Edge Extension wasmPlugin? GoogleCloudPlatform/service-extensions#339
• Is there way to get access to the source IP address? GoogleCloudPlatform/service-extensions#249

Testing

• go test -count=1 ./... in contrib/envoyproxy/go-control-plane
• go test -race -count=1 ./... in contrib/envoyproxy/go-control-plane
• go vet ./... in contrib/envoyproxy/go-control-plane
• go test -count=1 ./instrumentation/httptrace ./instrumentation/appsec/proxy ./instrumentation/appsec/emitter/httpsec ./internal/appsec/listener/httpsec/...
• go test -race -count=1 ./instrumentation/httptrace ./instrumentation/appsec/proxy ./instrumentation/appsec/emitter/httpsec ./internal/appsec/listener/httpsec/...
• make test/appsec
• make format/go
• make fix-modules
• ./bin/golangci-lint run --new-from-rev=origin/main ./contrib/envoyproxy/go-control-plane/... ./instrumentation/appsec/emitter/httpsec ./instrumentation/appsec/proxy ./instrumentation/httptrace ./internal/appsec/listener/httpsec/...

The repository-wide lint target currently reports unrelated pre-existing modernize findings. The broader contrib target exceeded the local 10-minute limit after unrelated CI Visibility safe-directory failures; the complete affected Envoy module and root packages pass, including race detection.

Reviewer's Checklist

• Changed code has unit tests for its functionality at or near 100% coverage.
• System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
• There is a benchmark for any new code, or changes to existing code.
• If this interacts with the agent in a new way, a system test has been added.
• New code is free of linting errors.
• New code doesn't break affected tests.
• Add an appropriate team label so this PR gets put in the right place for the release notes.
• All generated files are up to date.
• Nested modules are up to date via make fix-modules.

[datadog-official]

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 6 Pipeline jobs failed

Check Pull Request CI Status | all-jobs-are-green     

Code Freeze Check | code_freeze_check     

Label APM Ecosystems Pull Requests | label_issues     

View all 6 failed jobs.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 392a738 | Docs | Datadog PR Page | Give us feedback!}