http: support creating filters with match tree

api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto

@@ -838,3 +838,17 @@ message RequestIDExtension {
   // Request ID extension specific configuration.
   google.protobuf.Any typed_config = 1;
 }
+
+// Match input indicates that matching should be done on a specific request header.
+// TODO(snowp): Link to unified matching docs.
+message HttpRequestHeaderMatchInput {
+  // The request header to match on.
+  string header_name = 1;
+}
+
+// Match input indicating that matching should be done on a specific response header.
+// TODO(snowp): Link to unified matching docs.
+message HttpResponseHeaderMatchInput {
+  // The response header to match on.
+  string header_name = 1;
+}

include/envoy/http/filter.h

@@ -867,6 +867,8 @@ using StreamFilterSharedPtr = std::shared_ptr<StreamFilter>;
 
 class HttpMatchingData {
 public:
+  static absl::string_view name() { return "http"; }
+
   virtual ~HttpMatchingData() = default;
 
   virtual RequestHeaderMapOptConstRef requestHeaders() const PURE;

source/common/http/BUILD

@@ -177,6 +177,7 @@ envoy_cc_library(
         "//source/common/local_reply:local_reply_lib",
         "//source/common/matcher:matcher_lib",
         "@envoy_api//envoy/extensions/filters/common/matcher/action/v3:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
     ],
 )
 
@@ -242,6 +243,7 @@ envoy_cc_library(
         "//source/common/http/http2:codec_lib",
         "//source/common/http/http3:quic_codec_factory_lib",
         "//source/common/http/http3:well_known_names",
+        "//source/common/http/match_wrapper:config",
         "//source/common/network:utility_lib",
         "//source/common/router:config_lib",
         "//source/common/router:scoped_rds_lib",

source/common/http/filter_manager.cc

@@ -15,6 +15,8 @@ namespace Envoy {
 namespace Http {
 
 namespace {
+REGISTER_FACTORY(HttpRequestHeadersDataInputFactory, Matcher::DataInputFactory<HttpMatchingData>);
+REGISTER_FACTORY(SkipActionFactory, Matcher::ActionFactory);
 
 template <class T> using FilterList = std::list<std::unique_ptr<T>>;
 

source/common/http/filter_manager.h

@@ -1,8 +1,7 @@
 #pragma once
 
-#include <memory>
-
 #include "envoy/extensions/filters/common/matcher/action/v3/skip_action.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/http/header_map.h"
 #include "envoy/matcher/matcher.h"
@@ -103,6 +102,23 @@ class HttpRequestHeadersDataInput : public HttpHeadersDataInputBase<RequestHeade
   }
 };
 
+class HttpRequestHeadersDataInputFactory : public Matcher::DataInputFactory<HttpMatchingData> {
+public:
+  std::string name() const override { return "request-headers"; }
+  Matcher::DataInputPtr<HttpMatchingData>
+  createDataInput(const Protobuf::Message& config) override {
+    const auto& typed_config =
+        dynamic_cast<const envoy::extensions::filters::network::http_connection_manager::v3::
+                         HttpRequestHeaderMatchInput&>(config);
+
+    return std::make_unique<HttpRequestHeadersDataInput>(typed_config.header_name());
+  };
+  ProtobufTypes::MessagePtr createEmptyConfigProto() override {
+    return std::make_unique<envoy::extensions::filters::network::http_connection_manager::v3::
+                                HttpRequestHeaderMatchInput>();
+  }
+};
+
 class HttpResponseHeadersDataInput : public HttpHeadersDataInputBase<ResponseHeaderMap> {
 public:
   explicit HttpResponseHeadersDataInput(const std::string& name) : HttpHeadersDataInputBase(name) {}
@@ -113,9 +129,36 @@ class HttpResponseHeadersDataInput : public HttpHeadersDataInputBase<ResponseHea
   }
 };
 
+class HttpResponseHeadersDataInputFactory : public Matcher::DataInputFactory<HttpMatchingData> {
+public:
+  std::string name() const override { return "response-headers"; }
+  Matcher::DataInputPtr<HttpMatchingData>
+  createDataInput(const Protobuf::Message& config) override {
+    const auto& typed_config =
+        dynamic_cast<const envoy::extensions::filters::network::http_connection_manager::v3::
+                         HttpResponseHeaderMatchInput&>(config);
+
+    return std::make_unique<HttpResponseHeadersDataInput>(typed_config.header_name());
+  };
+  ProtobufTypes::MessagePtr createEmptyConfigProto() override {
+    return std::make_unique<envoy::extensions::filters::network::http_connection_manager::v3::
+                                HttpResponseHeaderMatchInput>();
+  }
+};
+
 class SkipAction : public Matcher::ActionBase<
                        envoy::extensions::filters::common::matcher::action::v3::SkipFilter> {};
 
+class SkipActionFactory : public Matcher::ActionFactory {
+public:
+  std::string name() const override { return "skip"; }
+  Matcher::ActionFactoryCb createActionFactoryCb(const Protobuf::Message&) override {
+    return []() { return std::make_unique<SkipAction>(); };
+  }
+  ProtobufTypes::MessagePtr createEmptyConfigProto() override {
+    return std::make_unique<envoy::extensions::filters::common::matcher::action::v3::SkipFilter>();
+  }
+};
 /**
  * Base class wrapper for both stream encoder and decoder filters.
  *

source/common/http/match_wrapper/BUILD

@@ -0,0 +1,23 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_package()
+
+envoy_cc_library(
+    name = "config",
+    srcs = ["config.cc"],
+    hdrs = ["config.h"],
+    deps = [
+        "//include/envoy/registry",
+        "//include/envoy/server:filter_config_interface",
+        "//source/common/matcher:matcher_lib",
+        "//source/extensions/filters/http:well_known_names",
+        "//source/extensions/filters/http/common:factory_base_lib",
+        "@envoy_api//envoy/extensions/common/matching/v3:pkg_cc_proto",
+    ],
+)

source/common/http/match_wrapper/config.cc

@@ -0,0 +1,92 @@
+#include "common/http/match_wrapper/config.h"
+
+#include "envoy/http/filter.h"
+#include "envoy/matcher/matcher.h"
+#include "envoy/registry/registry.h"
+
+#include "common/matcher/matcher.h"
+
+namespace Envoy {
+namespace Common {
+namespace Http {
+namespace MatchWrapper {
+
+namespace {
+struct DelegatingFactoryCallbacks : public Envoy::Http::FilterChainFactoryCallbacks {
+  DelegatingFactoryCallbacks(Envoy::Http::FilterChainFactoryCallbacks& delegated_callbacks,
+                             Matcher::MatchTreeSharedPtr<Envoy::Http::HttpMatchingData> match_tree)
+      : delegated_callbacks_(delegated_callbacks), match_tree_(std::move(match_tree)) {}
+
+  void addStreamDecoderFilter(Envoy::Http::StreamDecoderFilterSharedPtr filter) override {
+    delegated_callbacks_.addStreamDecoderFilter(std::move(filter), match_tree_);
+  }
+  void addStreamDecoderFilter(
+      Envoy::Http::StreamDecoderFilterSharedPtr filter,
+      Matcher::MatchTreeSharedPtr<Envoy::Http::HttpMatchingData> match_tree) override {
+    delegated_callbacks_.addStreamDecoderFilter(std::move(filter), std::move(match_tree));
+  }
+  void addStreamEncoderFilter(Envoy::Http::StreamEncoderFilterSharedPtr filter) override {
+    delegated_callbacks_.addStreamEncoderFilter(std::move(filter), match_tree_);
+  }
+  void addStreamEncoderFilter(
+      Envoy::Http::StreamEncoderFilterSharedPtr filter,
+      Matcher::MatchTreeSharedPtr<Envoy::Http::HttpMatchingData> match_tree) override {
+    delegated_callbacks_.addStreamEncoderFilter(std::move(filter), std::move(match_tree));
+  }
+  void addStreamFilter(Envoy::Http::StreamFilterSharedPtr filter) override {
+    delegated_callbacks_.addStreamFilter(std::move(filter), match_tree_);
+  }
+  void
+  addStreamFilter(Envoy::Http::StreamFilterSharedPtr filter,
+                  Matcher::MatchTreeSharedPtr<Envoy::Http::HttpMatchingData> match_tree) override {
+    delegated_callbacks_.addStreamFilter(std::move(filter), std::move(match_tree));
+  }
+  void addAccessLogHandler(AccessLog::InstanceSharedPtr handler) override {
+    delegated_callbacks_.addAccessLogHandler(std::move(handler));
+  }
+
+  Envoy::Http::FilterChainFactoryCallbacks& delegated_callbacks_;
+  Matcher::MatchTreeSharedPtr<Envoy::Http::HttpMatchingData> match_tree_;
+};
+} // namespace
+
+Envoy::Http::FilterFactoryCb MatchWrapperConfig::createFilterFactoryFromProtoTyped(
+    const envoy::extensions::common::matching::v3::ExtensionWithMatcher& proto_config,
+    const std::string& prefix, Server::Configuration::FactoryContext& context) {
+
+  if (proto_config.has_extension_config()) {
+    auto& factory =
+        Config::Utility::getAndCheckFactory<Server::Configuration::NamedHttpFilterConfigFactory>(
+            proto_config.extension_config());
+
+    auto message = factory.createEmptyConfigProto();
+    proto_config.extension_config().typed_config();
+    Config::Utility::translateOpaqueConfig(proto_config.extension_config().typed_config(),
+                                           ProtobufWkt::Struct(),
+                                           context.messageValidationVisitor(), *message);
+    auto filter_factory = factory.createFilterFactoryFromProto(*message, prefix, context);
+
+    auto match_tree =
+        Matcher::MatchTreeFactory<Envoy::Http::HttpMatchingData>(context.messageValidationVisitor())
+            .create(proto_config.matcher());
+
+    return
+        [filter_factory, match_tree](Envoy::Http::FilterChainFactoryCallbacks& callbacks) -> void {
+          DelegatingFactoryCallbacks delegated_callbacks(callbacks, match_tree);
+
+          return filter_factory(delegated_callbacks);
+        };
+  }
+
+  return [](Envoy::Http::FilterChainFactoryCallbacks&) -> void {};
+}
+
+/**
+ * Static registration for the Lua filter. @see RegisterFactory.
+ */
+REGISTER_FACTORY(MatchWrapperConfig, Server::Configuration::NamedHttpFilterConfigFactory){"blah"};
+
+} // namespace MatchWrapper
+} // namespace Http
+} // namespace Common
+} // namespace Envoy

source/common/http/match_wrapper/config.h

@@ -0,0 +1,28 @@
+#pragma once
+
+#include "envoy/extensions/common/matching/v3/extension_matcher.pb.validate.h"
+#include "envoy/server/filter_config.h"
+
+#include "extensions/filters/http/common/factory_base.h"
+#include "extensions/filters/http/well_known_names.h"
+
+namespace Envoy {
+namespace Common {
+namespace Http {
+namespace MatchWrapper {
+
+class MatchWrapperConfig : public Extensions::HttpFilters::Common::FactoryBase<
+                               envoy::extensions::common::matching::v3::ExtensionWithMatcher> {
+public:
+  MatchWrapperConfig() : FactoryBase("match-wrapper") {}
+
+private:
+  Envoy::Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
+      const envoy::extensions::common::matching::v3::ExtensionWithMatcher& proto_config,
+      const std::string&, Server::Configuration::FactoryContext& context) override;
+};
+
+} // namespace MatchWrapper
+} // namespace Http
+} // namespace Common
+} // namespace Envoy

test/integration/BUILD

@@ -882,6 +882,8 @@ envoy_cc_test(
         "//test/integration/filters:encoder_decoder_buffer_filter_lib",
         "//test/integration/filters:invalid_header_filter_lib",
         "//test/integration/filters:process_context_lib",
+        "//test/integration/filters:set_response_code_filter_config_proto_cc_proto",
+        "//test/integration/filters:set_response_code_filter_lib",
         "//test/integration/filters:stop_iteration_and_continue",
         "//test/mocks/http:http_mocks",
         "//test/test_common:utility_lib",
@@ -1083,6 +1085,7 @@ envoy_cc_test(
         "//test/integration/filters:set_response_code_filter_config_proto_cc_proto",
         "//test/integration/filters:set_response_code_filter_lib",
         "//test/test_common:utility_lib",
+        "@envoy_api//envoy/extensions/common/matching/v3:pkg_cc_proto",
         "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
         "@envoy_api//envoy/service/extension/v3:pkg_cc_proto",
     ],