Merge remote-tracking branch 'upstream/master' into access-log-format…

…ter-extensions

.azure-pipelines/pipelines.yml

@@ -54,6 +54,7 @@ stages:
           - script: ci/run_envoy_docker.sh 'ci/do_ci.sh docs'
             workingDirectory: $(Build.SourcesDirectory)
             env:
+              AZP_BRANCH: $(Build.SourceBranch)
               ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
               BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
               BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
@@ -303,6 +304,7 @@ stages:
           - script: ci/run_envoy_docker.sh 'ci/do_ci.sh docs'
             workingDirectory: $(Build.SourcesDirectory)
             env:
+              AZP_BRANCH: $(Build.SourceBranch)
               ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
               BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
               BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
@@ -321,7 +323,6 @@ stages:
             workingDirectory: $(Build.SourcesDirectory)
             env:
               AZP_BRANCH: $(Build.SourceBranch)
-              AZP_SHA1: $(Build.SourceVersion)
 
   - stage: verify
     dependsOn: ["docker"]

api/envoy/type/matcher/v3/http_inputs.proto

@@ -0,0 +1,35 @@
+syntax = "proto3";
+
+package envoy.type.matcher.v3;
+
+import "udpa/annotations/migrate.proto";
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.type.matcher.v3";
+option java_outer_classname = "HttpInputsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Common HTTP Inputs]
+
+// Match input indicates that matching should be done on a specific request header.
+// The resulting input string will be all headers for the given key joined by a comma,
+// e.g. if the request contains two 'foo' headers with value 'bar' and 'baz', the input
+// string will be 'bar,baz'.
+// [#comment:TODO(snowp): Link to unified matching docs.]
+message HttpRequestHeaderMatchInput {
+  // The request header to match on.
+  string header_name = 1;
+}
+
+// Match input indicating that matching should be done on a specific response header.
+// The resulting input string will be all headers for the given key joined by a comma,
+// e.g. if the response contains two 'foo' headers with value 'bar' and 'baz', the input
+// string will be 'bar,baz'.
+// [#comment:TODO(snowp): Link to unified matching docs.]
+message HttpResponseHeaderMatchInput {
+  // The response header to match on.
+  string header_name = 1;
+}

docs/root/api-v3/types/types.rst

@@ -21,5 +21,6 @@ Types
   ../type/matcher/v3/string.proto
   ../type/matcher/v3/struct.proto
   ../type/matcher/v3/value.proto
+  ../type/matcher/v3/http_inputs.proto
   ../type/metadata/v3/metadata.proto
   ../type/tracing/v3/custom_tag.proto

docs/root/intro/arch_overview/http/upgrades.rst

@@ -94,6 +94,8 @@ will synthesize 200 response headers, and then forward the TCP data as the HTTP
 For an example of proxying connect, please see :repo:`configs/proxy_connect.yaml <configs/proxy_connect.yaml>`
 For an example of terminating connect, please see :repo:`configs/terminate_connect.yaml <configs/terminate_connect.yaml>`
 
+.. _tunneling-tcp-over-http:
+
 Tunneling TCP over HTTP
 ^^^^^^^^^^^^^^^^^^^^^^^
 Envoy also has support for tunneling raw TCP over HTTP CONNECT requests. Find

docs/root/version_history/current.rst

@@ -20,6 +20,7 @@ Removed Config or Runtime
 New Features
 ------------
 * access log: added the :ref:`formatters <envoy_v3_api_field_config.core.v3.SubstitutionFormatString.formatters>` extension point for custom formatters (command operators).
+* tcp_proxy: add support for converting raw TCP streams into HTTP/1.1 CONNECT requests. See :ref:`upgrade documentation <tunneling-tcp-over-http>` for details.
 
 Deprecated
 ----------

include/envoy/http/filter.h

@@ -885,6 +885,8 @@ using StreamFilterSharedPtr = std::shared_ptr<StreamFilter>;
 
 class HttpMatchingData {
 public:
+  static absl::string_view name() { return "http"; }
+
   virtual ~HttpMatchingData() = default;
 
   virtual RequestHeaderMapOptConstRef requestHeaders() const PURE;

include/envoy/matcher/BUILD

@@ -17,6 +17,7 @@ envoy_cc_library(
     ],
     deps = [
         "//include/envoy/config:typed_config_interface",
+        "//include/envoy/protobuf:message_validator_interface",
         "@envoy_api//envoy/config/common/matcher/v3:pkg_cc_proto",
         "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
     ],

include/envoy/matcher/matcher.h

@@ -7,6 +7,7 @@
 #include "envoy/config/common/matcher/v3/matcher.pb.h"
 #include "envoy/config/core/v3/extension.pb.h"
 #include "envoy/config/typed_config.h"
+#include "envoy/protobuf/message_validator.h"
 
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
@@ -209,7 +210,9 @@ template <class DataType> class DataInputFactory : public Config::TypedFactory {
   /**
    * Creates a DataInput from the provided config.
    */
-  virtual DataInputPtr<DataType> createDataInput(const Protobuf::Message& config) PURE;
+  virtual DataInputPtr<DataType>
+  createDataInput(const Protobuf::Message& config,
+                  ProtobufMessage::ValidationVisitor& validation_visitor) PURE;
 
   /**
    * The category of this factory depends on the DataType, so we require a name() function to exist

source/common/http/BUILD

@@ -184,6 +184,8 @@ envoy_cc_library(
         "//source/common/local_reply:local_reply_lib",
         "//source/common/matcher:matcher_lib",
         "@envoy_api//envoy/extensions/filters/common/matcher/action/v3:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3:pkg_cc_proto",
     ],
 )
 
@@ -247,6 +249,7 @@ envoy_cc_library(
         "//source/common/http/http2:codec_lib",
         "//source/common/http/http3:quic_codec_factory_lib",
         "//source/common/http/http3:well_known_names",
+        "//source/common/http/match_wrapper:config",
         "//source/common/network:utility_lib",
         "//source/common/router:config_lib",
         "//source/common/router:scoped_rds_lib",

source/common/http/filter_manager.cc

@@ -15,6 +15,8 @@ namespace Envoy {
 namespace Http {
 
 namespace {
+REGISTER_FACTORY(HttpRequestHeadersDataInputFactory, Matcher::DataInputFactory<HttpMatchingData>);
+REGISTER_FACTORY(SkipActionFactory, Matcher::ActionFactory);
 
 template <class T> using FilterList = std::list<std::unique_ptr<T>>;
 

source/common/http/filter_manager.h

@@ -4,10 +4,14 @@
 
 #include "envoy/common/optref.h"
 #include "envoy/extensions/filters/common/matcher/action/v3/skip_action.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.validate.h"
 #include "envoy/http/filter.h"
 #include "envoy/http/header_map.h"
 #include "envoy/matcher/matcher.h"
 #include "envoy/network/socket.h"
+#include "envoy/protobuf/message_validator.h"
+#include "envoy/type/matcher/v3/http_inputs.pb.validate.h"
 
 #include "common/buffer/watermark_buffer.h"
 #include "common/common/dump_state_utils.h"
@@ -18,6 +22,7 @@
 #include "common/http/headers.h"
 #include "common/local_reply/local_reply.h"
 #include "common/matcher/matcher.h"
+#include "common/protobuf/utility.h"
 
 namespace Envoy {
 namespace Http {
@@ -97,6 +102,36 @@ class HttpRequestHeadersDataInput : public HttpHeadersDataInputBase<RequestHeade
   }
 };
 
+template <class DataInputType, class ProtoType>
+class HttpHeadersDataInputFactoryBase : public Matcher::DataInputFactory<HttpMatchingData> {
+public:
+  explicit HttpHeadersDataInputFactoryBase(const std::string& name) : name_(name) {}
+
+  std::string name() const override { return name_; }
+
+  Matcher::DataInputPtr<HttpMatchingData>
+  createDataInput(const Protobuf::Message& config,
+                  ProtobufMessage::ValidationVisitor& validation_visitor) override {
+    const auto& typed_config =
+        MessageUtil::downcastAndValidate<const ProtoType&>(config, validation_visitor);
+
+    return std::make_unique<DataInputType>(typed_config.header_name());
+  };
+  ProtobufTypes::MessagePtr createEmptyConfigProto() override {
+    return std::make_unique<ProtoType>();
+  }
+
+private:
+  const std::string name_;
+};
+
+class HttpRequestHeadersDataInputFactory
+    : public HttpHeadersDataInputFactoryBase<
+          HttpRequestHeadersDataInput, envoy::type::matcher::v3::HttpRequestHeaderMatchInput> {
+public:
+  HttpRequestHeadersDataInputFactory() : HttpHeadersDataInputFactoryBase("request-headers") {}
+};
+
 class HttpResponseHeadersDataInput : public HttpHeadersDataInputBase<ResponseHeaderMap> {
 public:
   explicit HttpResponseHeadersDataInput(const std::string& name) : HttpHeadersDataInputBase(name) {}
@@ -107,9 +142,26 @@ class HttpResponseHeadersDataInput : public HttpHeadersDataInputBase<ResponseHea
   }
 };
 
+class HttpResponseHeadersDataInputFactory
+    : public HttpHeadersDataInputFactoryBase<
+          HttpResponseHeadersDataInput, envoy::type::matcher::v3::HttpResponseHeaderMatchInput> {
+public:
+  HttpResponseHeadersDataInputFactory() : HttpHeadersDataInputFactoryBase("response-headers") {}
+};
+
 class SkipAction : public Matcher::ActionBase<
                        envoy::extensions::filters::common::matcher::action::v3::SkipFilter> {};
 
+class SkipActionFactory : public Matcher::ActionFactory {
+public:
+  std::string name() const override { return "skip"; }
+  Matcher::ActionFactoryCb createActionFactoryCb(const Protobuf::Message&) override {
+    return []() { return std::make_unique<SkipAction>(); };
+  }
+  ProtobufTypes::MessagePtr createEmptyConfigProto() override {
+    return std::make_unique<envoy::extensions::filters::common::matcher::action::v3::SkipFilter>();
+  }
+};
 /**
  * Base class wrapper for both stream encoder and decoder filters.
  *

source/common/http/http1/codec_impl.cc

@@ -1212,15 +1212,6 @@ Envoy::StatusOr<int> ClientConnectionImpl::onHeadersComplete() {
         pending_response_.value().encoder_.connectRequest()) {
       ENVOY_CONN_LOG(trace, "codec entering upgrade mode for CONNECT response.", connection_);
       handling_upgrade_ = true;
-
-      // For responses to connect requests, do not accept the chunked
-      // encoding header: https://tools.ietf.org/html/rfc7231#section-4.3.6
-      if (headers->TransferEncoding() &&
-          absl::EqualsIgnoreCase(headers->TransferEncoding()->value().getStringView(),
-                                 Headers::get().TransferEncodingValues.Chunked)) {
-        RETURN_IF_ERROR(sendProtocolError(Http1ResponseCodeDetails::get().InvalidTransferEncoding));
-        return codecProtocolError("http/1.1 protocol error: unsupported transfer encoding");
-      }
     }
 
     if (strict_1xx_and_204_headers_ && (parser_.status_code < 200 || parser_.status_code == 204)) {

source/common/http/match_wrapper/BUILD

@@ -0,0 +1,23 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_package()
+
+envoy_cc_library(
+    name = "config",
+    srcs = ["config.cc"],
+    hdrs = ["config.h"],
+    deps = [
+        "//include/envoy/registry",
+        "//include/envoy/server:filter_config_interface",
+        "//source/common/matcher:matcher_lib",
+        "//source/extensions/filters/http:well_known_names",
+        "//source/extensions/filters/http/common:factory_base_lib",
+        "@envoy_api//envoy/extensions/common/matching/v3:pkg_cc_proto",
+    ],
+)