fix(contrib/envoyproxy): use source.ip from ext_proc attributes

contrib/envoyproxy/go-control-plane/cmd/serviceextensions/README.md

@@ -22,6 +22,18 @@ The ASM Service Extension expose some configuration. The configuration can be tw
 
 >**GCP requires that the default configuration for the Service Extension should not change.**
 
+### Forward the source IP attribute
+
+The Service Extension must be configured to forward the GCP client address attribute:
+
+```yaml
+forwardAttributes: [source.ip]
+```
+
+The forwarded `source.ip` is authoritative for requests sent directly from the client to the Google Cloud Load Balancer. If `source.ip` is omitted, client IP detection retains its legacy header and connection-address fallback behavior.
+
+This configuration does not recover the original client address when a third-party CDN is deployed in front of the load balancer. Supporting that topology is outside the scope of this integration; configure and trust the CDN-specific forwarding mechanism separately.
+
 | Environment variable                      | Default value   | Description                                                                                                   |
 |-------------------------------------------|-----------------|---------------------------------------------------------------------------------------------------------------|
 | `DD_SERVICE_EXTENSION_HOST`               | `0.0.0.0`       | Host on where the gRPC and HTTP server should listen to.                                                      |

contrib/envoyproxy/go-control-plane/envoy_messages.go

@@ -8,13 +8,16 @@ package gocontrolplane
 import (
 	"context"
 	"fmt"
+	"net/netip"
 	"os"
 	"strconv"
 	"sync"
 
 	extproc "github.com/envoyproxy/go-control-plane/envoy/service/ext_proc/v3"
 	"google.golang.org/grpc/metadata"
 
+	"google.golang.org/protobuf/types/known/structpb"
+
 	"github.com/DataDog/dd-trace-go/v2/ddtrace/ext"
 	"github.com/DataDog/dd-trace-go/v2/ddtrace/tracer"
 	"github.com/DataDog/dd-trace-go/v2/instrumentation/appsec/proxy"
@@ -55,6 +58,40 @@ func (m messageRequestHeaders) ExtractRequest(ctx context.Context) (proxy.Pseudo
 	}, nil
 }
 
+const (
+	gcpServiceExtensionAttributesNamespace = "envoy.filters.http.ext_proc"
+	gcpServiceExtensionSourceIPAttribute   = "source.ip"
+)
+
+// ClientIPOverride returns the authoritative GCP Service Extension source IP when present.
+func (m messageRequestHeaders) ClientIPOverride(ctx context.Context) (netip.Addr, bool) {
+	if m.component(ctx) != componentNameGCPServiceExtension {
+		return netip.Addr{}, false
+	}
+
+	namespace, ok := m.ProcessingRequest.GetAttributes()[gcpServiceExtensionAttributesNamespace]
+	if !ok || namespace == nil {
+		return netip.Addr{}, false
+	}
+	value, ok := namespace.GetFields()[gcpServiceExtensionSourceIPAttribute]
+	if !ok {
+		return netip.Addr{}, false
+	}
+
+	if value == nil {
+		return netip.Addr{}, true
+	}
+	stringValue, ok := value.GetKind().(*structpb.Value_StringValue)
+	if !ok {
+		return netip.Addr{}, true
+	}
+	ip, err := netip.ParseAddr(stringValue.StringValue)
+	if err != nil || ip.Zone() != "" {
+		return netip.Addr{}, true
+	}
+	return ip.Unmap(), true
+}
+
 func (m messageRequestHeaders) MessageType() proxy.MessageType {
 	return proxy.MessageTypeRequestHeaders
 }

contrib/envoyproxy/go-control-plane/go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/sync v0.20.0
 	google.golang.org/grpc v1.80.0
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
@@ -82,7 +83,6 @@ require (
 	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )