build: use clang-10

.bazelrc

@@ -115,7 +115,8 @@ coverage --config=coverage
 build:coverage --action_env=BAZEL_USE_LLVM_NATIVE_COVERAGE=1
 build:coverage --action_env=GCOV=llvm-profdata
 build:coverage --copt=-DNDEBUG
-build:coverage --test_timeout=900
+# Doubling timeout in all categories
+build:coverage --test_timeout=120,600,1800,7200
 build:coverage --define=ENVOY_CONFIG_COVERAGE=1
 build:coverage --cxxopt="-DENVOY_CONFIG_COVERAGE=1"
 build:coverage --coverage_support=@envoy//bazel/coverage:coverage_support
@@ -182,7 +183,7 @@ build:remote-msan --config=rbe-toolchain-msan
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/master/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:04f06115b6ee7cfea74930353fb47a41149cbec3
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:12b3d2c2ffa582507e5d6dd34632b2b990f1b195
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker

.circleci/config.yml

@@ -5,7 +5,7 @@ executors:
     description: "A regular build executor based on ubuntu image"
     docker:
       # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/master/toolchains/rbe_toolchains_config.bzl#L8
-      - image: envoyproxy/envoy-build-ubuntu:04f06115b6ee7cfea74930353fb47a41149cbec3
+      - image: envoyproxy/envoy-build-ubuntu:12b3d2c2ffa582507e5d6dd34632b2b990f1b195
     resource_class: xlarge
     working_directory: /source
 

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM gcr.io/envoy-ci/envoy-build:04f06115b6ee7cfea74930353fb47a41149cbec3
+FROM gcr.io/envoy-ci/envoy-build:12b3d2c2ffa582507e5d6dd34632b2b990f1b195
 
 ARG USERNAME=vscode
 ARG USER_UID=501

bazel/README.md

@@ -267,7 +267,7 @@ for more details.
 ## Supported compiler versions
 
 We now require Clang >= 5.0 due to known issues with std::string thread safety and C++14 support. GCC >= 7 is also
-known to work. Currently the CI is running with Clang 9.
+known to work. Currently the CI is running with Clang 10.
 
 ## Clang STL debug symbols
 
@@ -725,7 +725,7 @@ also have 'buildifier' installed from the bazel distribution.
 Edit the paths shown here to reflect the installation locations on your system:
 
 ```shell
-export CLANG_FORMAT="$HOME/ext/clang+llvm-9.0.0-x86_64-linux-gnu-ubuntu-16.04/bin/clang-format"
+export CLANG_FORMAT="$HOME/ext/clang+llvm-10.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-format"
 export BUILDIFIER_BIN="/usr/bin/buildifier"
 ```
 

bazel/external/compiler_rt.BUILD

@@ -4,6 +4,6 @@ licenses(["notice"])  # Apache 2
 
 cc_library(
     name = "fuzzed_data_provider",
-    hdrs = ["fuzzer/utils/FuzzedDataProvider.h"],
+    hdrs = ["fuzzer/FuzzedDataProvider.h"],
     visibility = ["//visibility:public"],
 )

bazel/foreign_cc/nghttp2.patch

@@ -15,3 +15,73 @@ index 35c77d1d..47bd63f5 100644
  endif()
  # AC_TYPE_UINT8_T
  # AC_TYPE_UINT16_T
+# https://github.com/nghttp2/nghttp2/pull/1468
+diff --git a/lib/nghttp2_buf.c b/lib/nghttp2_buf.c
+index 2a435bebf..92f97f7f2 100644
+--- a/lib/nghttp2_buf.c
++++ b/lib/nghttp2_buf.c
+@@ -82,8 +82,10 @@ void nghttp2_buf_reset(nghttp2_buf *buf) {
+ }
+
+ void nghttp2_buf_wrap_init(nghttp2_buf *buf, uint8_t *begin, size_t len) {
+-  buf->begin = buf->pos = buf->last = buf->mark = begin;
+-  buf->end = begin + len;
++  buf->begin = buf->pos = buf->last = buf->mark = buf->end = begin;
++  if (buf->end != NULL) {
++    buf->end += len;
++  }
+ }
+
+ static int buf_chain_new(nghttp2_buf_chain **chain, size_t chunk_length,
+diff --git a/lib/nghttp2_frame.c b/lib/nghttp2_frame.c
+index 4821de408..940c723b0 100644
+--- a/lib/nghttp2_frame.c
++++ b/lib/nghttp2_frame.c
+@@ -818,8 +818,10 @@ int nghttp2_frame_unpack_origin_payload(nghttp2_extension *frame,
+   size_t len = 0;
+
+   origin = frame->payload;
+-  p = payload;
+-  end = p + payloadlen;
++  p = end = payload;
++  if (end != NULL) {
++    end += payloadlen;
++  }
+
+   for (; p != end;) {
+     if (end - p < 2) {
+diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c
+index 563ccd7de..794f141a1 100644
+--- a/lib/nghttp2_session.c
++++ b/lib/nghttp2_session.c
+@@ -5349,7 +5349,7 @@ static ssize_t inbound_frame_effective_readlen(nghttp2_inbound_frame *iframe,
+
+ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
+                                  size_t inlen) {
+-  const uint8_t *first = in, *last = in + inlen;
++  const uint8_t *first = in, *last = in;
+   nghttp2_inbound_frame *iframe = &session->iframe;
+   size_t readlen;
+   ssize_t padlen;
+@@ -5360,6 +5360,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
+   size_t pri_fieldlen;
+   nghttp2_mem *mem;
+
++  if (in != NULL) {
++    last += inlen;
++  }
++
+   DEBUGF("recv: connection recv_window_size=%d, local_window=%d\n",
+          session->recv_window_size, session->local_window_size);
+
+@@ -5389,7 +5393,9 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
+       }
+
+       iframe->payloadleft -= readlen;
+-      in += readlen;
++      if (in != NULL) {
++        in += readlen;
++      }
+
+       if (iframe->payloadleft == 0) {
+         session_inbound_frame_reset(session);

bazel/repository_locations.bzl

@@ -67,10 +67,10 @@ DEPENDENCY_REPOSITORIES = dict(
         use_category = ["build"],
     ),
     envoy_build_tools = dict(
-        sha256 = "78e794ae1c1197f59b7ecbf8bd62c053ecb1625daaccdbe287581ee6f12ec0fb",
-        strip_prefix = "envoy-build-tools-b47394aa94c45e15c479d18eab18ffd43ec62d89",
-        # 2020-05-14
-        urls = ["https://github.com/envoyproxy/envoy-build-tools/archive/b47394aa94c45e15c479d18eab18ffd43ec62d89.tar.gz"],
+        sha256 = "b0efe70a1d122fffb89570771f4ec3b912aa0a8a0ce56218223918d7737d01e2",
+        strip_prefix = "envoy-build-tools-3cbc1d66b9e9ead42daf69e01597cacf4fb52151",
+        # 2020-05-15
+        urls = ["https://github.com/envoyproxy/envoy-build-tools/archive/3cbc1d66b9e9ead42daf69e01597cacf4fb52151.tar.gz"],
         use_category = ["build"],
     ),
     boringssl = dict(
@@ -443,10 +443,10 @@ DEPENDENCY_REPOSITORIES = dict(
     # provided as part of the compiler-rt source distribution. We can't use the
     # Clang variant as we are not a Clang-LLVM only shop today.
     org_llvm_releases_compiler_rt = dict(
-        sha256 = "56e4cd96dd1d8c346b07b4d6b255f976570c6f2389697347a6c3dcb9e820d10e",
+        sha256 = "6a7da64d3a0a7320577b68b9ca4933bdcab676e898b759850e827333c3282c75",
         # Only allow peeking at fuzzer related files for now.
-        strip_prefix = "compiler-rt-9.0.0.src/lib",
-        urls = ["http://releases.llvm.org/9.0.0/compiler-rt-9.0.0.src.tar.xz"],
+        strip_prefix = "compiler-rt-10.0.0.src/include",
+        urls = ["https://github.com/llvm/llvm-project/releases/download/llvmorg-10.0.0/compiler-rt-10.0.0.src.tar.xz"],
         use_category = ["test"],
     ),
     upb = dict(

ci/README.md

@@ -32,8 +32,8 @@ running tests that reflects the latest built Windows 2019 Envoy image.
 Currently there are three build images for Linux and one for Windows:
 
 * `envoyproxy/envoy-build` — alias to `envoyproxy/envoy-build-ubuntu`.
-* `envoyproxy/envoy-build-ubuntu` — based on Ubuntu 18.04 (Bionic) with GCC 9 and Clang 9 compiler.
-* `envoyproxy/envoy-build-centos` — based on CentOS 7 with GCC 9 and Clang 9 compiler, this image is experimental and not well tested.
+* `envoyproxy/envoy-build-ubuntu` — based on Ubuntu 18.04 (Bionic) with GCC 9 and Clang 10 compiler.
+* `envoyproxy/envoy-build-centos` — based on CentOS 7 with GCC 9 and Clang 10 compiler, this image is experimental and not well tested.
 * `envoyproxy/envoy-build-windows2019` — based on Windows 2019 LTS with VS 2019 Build Tools.
 
 The source for these images is located in the [envoyproxy/envoy-build-tools](https://github.com/envoyproxy/envoy-build-tools)

ci/run_envoy_docker.sh

@@ -17,7 +17,7 @@ USER_GROUP=root
 [[ -z "${ENVOY_DOCKER_BUILD_DIR}" ]] && ENVOY_DOCKER_BUILD_DIR=/tmp/envoy-docker-build
 
 [[ -t 1 ]] && ENVOY_DOCKER_OPTIONS+=" -it"
-[[ -f .git ]] && [[ ! -d .git ]] && ENVOY_DOCKER_OPTIONS+=" -v \"$(git rev-parse --git-common-dir):$(git rev-parse --git-common-dir)\""
+[[ -f .git ]] && [[ ! -d .git ]] && ENVOY_DOCKER_OPTIONS+=" -v $(git rev-parse --git-common-dir):$(git rev-parse --git-common-dir)"
 
 export ENVOY_BUILD_IMAGE="${IMAGE_NAME}:${IMAGE_ID}"
 

docs/root/version_history/current.rst

@@ -53,6 +53,8 @@ New Features
 * access loggers: extened specifier for FilterStateFormatter to output :ref:`unstructured log string <config_access_log_format_filter_state>`.
 * access loggers: file access logger config added :ref:`log_format <envoy_v3_api_field_extensions.access_loggers.file.v3.FileAccessLog.log_format>`.
 * aggregate cluster: make route :ref:`retry_priority <envoy_v3_api_field_config.route.v3.RetryPolicy.retry_priority>` predicates work with :ref:`this cluster type <envoy_v3_api_msg_extensions.clusters.aggregate.v3.ClusterConfig>`.
+* build: official released binary is now built on Ubuntu 18.04, requires glibc >= 2.27.
+* build: official released binary is now built with Clang 10.0.0.
 * compressor: generic :ref:`compressor <config_http_filters_compressor>` filter exposed to users.
 * config: added :ref:`identifier <config_cluster_manager_cds>` stat that reflects control plane identifier.
 * config: added :ref:`version_text <config_cluster_manager_cds>` stat that reflects xDS version.

source/common/common/thread.h

@@ -64,9 +64,9 @@ class CondVar {
    * @return WaitStatus whether the condition timed out or not.
    */
   template <class Rep, class Period>
-  WaitStatus waitFor(
-      MutexBasicLockable& mutex,
-      std::chrono::duration<Rep, Period> duration) noexcept ABSL_EXCLUSIVE_LOCKS_REQUIRED(mutex) {
+  WaitStatus waitFor(MutexBasicLockable& mutex,
+                     std::chrono::duration<Rep, Period> duration) noexcept
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(mutex) {
     return condvar_.WaitWithTimeout(&mutex.mutex_, absl::FromChrono(duration))
                ? WaitStatus::Timeout
                : WaitStatus::NoTimeout;

source/common/stats/symbol_table_impl.h

@@ -386,12 +386,7 @@ class StatName {
       return H::combine(std::move(h), absl::string_view());
     }
 
-    // Casts the raw data as a string_view. Note that this string_view will not
-    // be in human-readable form, but it will be compatible with a string-view
-    // hasher.
-    const char* cdata = reinterpret_cast<const char*>(stat_name.data());
-    absl::string_view data_as_string_view = absl::string_view(cdata, stat_name.dataSize());
-    return H::combine(std::move(h), data_as_string_view);
+    return H::combine(std::move(h), stat_name.dataAsStringView());
   }
 
   /**
@@ -403,8 +398,7 @@ class StatName {
   uint64_t hash() const { return absl::Hash<StatName>()(*this); }
 
   bool operator==(const StatName& rhs) const {
-    const uint64_t sz = dataSize();
-    return sz == rhs.dataSize() && memcmp(data(), rhs.data(), sz * sizeof(uint8_t)) == 0;
+    return dataAsStringView() == rhs.dataAsStringView();
   }
   bool operator!=(const StatName& rhs) const { return !(*this == rhs); }
 
@@ -452,6 +446,9 @@ class StatName {
    * @return A pointer to the first byte of data (skipping over size bytes).
    */
   const uint8_t* data() const {
+    if (size_and_data_ == nullptr) {
+      return nullptr;
+    }
     return size_and_data_ + SymbolTableImpl::Encoding::encodingSizeBytes(dataSize());
   }
 
@@ -463,6 +460,15 @@ class StatName {
   bool empty() const { return size_and_data_ == nullptr || dataSize() == 0; }
 
 private:
+  /**
+   * Casts the raw data as a string_view. Note that this string_view will not
+   * be in human-readable form, but it will be compatible with a string-view
+   * hasher and comparator.
+   */
+  absl::string_view dataAsStringView() const {
+    return {reinterpret_cast<const char*>(data()), dataSize()};
+  }
+
   const uint8_t* size_and_data_{nullptr};
 };
 

source/extensions/common/tap/admin.cc

@@ -110,7 +110,7 @@ void AdminHandler::AdminPerTapSinkHandle::submitTrace(
   std::shared_ptr<envoy::data::tap::v3::TraceWrapper> shared_trace{std::move(trace)};
   // The handle can be destroyed before the cross thread post is complete. Thus, we capture a
   // reference to our parent.
-  parent_.main_thread_dispatcher_.post([& parent = parent_, trace = shared_trace, format]() {
+  parent_.main_thread_dispatcher_.post([&parent = parent_, trace = shared_trace, format]() {
     if (!parent.attached_request_.has_value()) {
       return;
     }

source/extensions/common/tap/tap_config_base.h

@@ -53,7 +53,9 @@ class Utility {
       const uint32_t start_offset_trim = std::min<uint32_t>(start_offset, slice.len_);
       slice.len_ -= start_offset_trim;
       start_offset -= start_offset_trim;
-      slice.mem_ = static_cast<char*>(slice.mem_) + start_offset_trim;
+      if (slice.mem_ != nullptr) {
+        slice.mem_ = static_cast<char*>(slice.mem_) + start_offset_trim;
+      }
 
       const uint32_t final_length = std::min<uint32_t>(length, slice.len_);
       slice.len_ = final_length;

source/extensions/filters/http/ext_authz/ext_authz.cc

@@ -212,7 +212,7 @@ void Filter::onComplete(Filters::Common::ExtAuthz::ResponsePtr&& response) {
 
     callbacks_->sendLocalReply(
         response->status_code, response->body,
-        [& headers = response->headers_to_add,
+        [&headers = response->headers_to_add,
          &callbacks = *callbacks_](Http::HeaderMap& response_headers) -> void {
           ENVOY_STREAM_LOG(trace,
                            "ext_authz filter added header(s) to the local response:", callbacks);

test/common/http/utility_test.cc

@@ -665,34 +665,33 @@ TEST(HttpUtility, ResolveMostSpecificPerFilterConfigGeneric) {
   const std::string filter_name = "envoy.filter";
   NiceMock<Http::MockStreamDecoderFilterCallbacks> filter_callbacks;
 
-  const Router::RouteSpecificFilterConfig* nullconfig = nullptr;
-  const Router::RouteSpecificFilterConfig* one = nullconfig + 1;
-  const Router::RouteSpecificFilterConfig* two = nullconfig + 2;
-  const Router::RouteSpecificFilterConfig* three = nullconfig + 3;
+  const Router::RouteSpecificFilterConfig one;
+  const Router::RouteSpecificFilterConfig two;
+  const Router::RouteSpecificFilterConfig three;
 
   // Test when there's nothing on the route
   EXPECT_EQ(nullptr, Utility::resolveMostSpecificPerFilterConfigGeneric(filter_name,
                                                                         filter_callbacks.route()));
 
   // Testing in reverse order, so that the method always returns the last object.
   ON_CALL(filter_callbacks.route_->route_entry_.virtual_host_, perFilterConfig(filter_name))
-      .WillByDefault(Return(one));
-  EXPECT_EQ(one, Utility::resolveMostSpecificPerFilterConfigGeneric(filter_name,
-                                                                    filter_callbacks.route()));
+      .WillByDefault(Return(&one));
+  EXPECT_EQ(&one, Utility::resolveMostSpecificPerFilterConfigGeneric(filter_name,
+                                                                     filter_callbacks.route()));
 
-  ON_CALL(*filter_callbacks.route_, perFilterConfig(filter_name)).WillByDefault(Return(two));
-  EXPECT_EQ(two, Utility::resolveMostSpecificPerFilterConfigGeneric(filter_name,
-                                                                    filter_callbacks.route()));
+  ON_CALL(*filter_callbacks.route_, perFilterConfig(filter_name)).WillByDefault(Return(&two));
+  EXPECT_EQ(&two, Utility::resolveMostSpecificPerFilterConfigGeneric(filter_name,
+                                                                     filter_callbacks.route()));
 
   ON_CALL(filter_callbacks.route_->route_entry_, perFilterConfig(filter_name))
-      .WillByDefault(Return(three));
-  EXPECT_EQ(three, Utility::resolveMostSpecificPerFilterConfigGeneric(filter_name,
-                                                                      filter_callbacks.route()));
+      .WillByDefault(Return(&three));
+  EXPECT_EQ(&three, Utility::resolveMostSpecificPerFilterConfigGeneric(filter_name,
+                                                                       filter_callbacks.route()));
 
   // Cover the case of no route entry
   ON_CALL(*filter_callbacks.route_, routeEntry()).WillByDefault(Return(nullptr));
-  EXPECT_EQ(two, Utility::resolveMostSpecificPerFilterConfigGeneric(filter_name,
-                                                                    filter_callbacks.route()));
+  EXPECT_EQ(&two, Utility::resolveMostSpecificPerFilterConfigGeneric(filter_name,
+                                                                     filter_callbacks.route()));
 }
 
 // Verify that traversePerFilterConfigGeneric traverses in the order of specificity.
@@ -702,16 +701,16 @@ TEST(HttpUtility, TraversePerFilterConfigIteratesInOrder) {
 
   // Create configs to test; to ease of testing instead of using real objects
   // we will use pointers that are actually indexes.
-  const Router::RouteSpecificFilterConfig* nullconfig = nullptr;
+  const std::vector<Router::RouteSpecificFilterConfig> nullconfigs(5);
   size_t num_configs = 1;
   ON_CALL(filter_callbacks.route_->route_entry_.virtual_host_, perFilterConfig(filter_name))
-      .WillByDefault(Return(nullconfig + num_configs));
+      .WillByDefault(Return(&nullconfigs[num_configs]));
   num_configs++;
   ON_CALL(*filter_callbacks.route_, perFilterConfig(filter_name))
-      .WillByDefault(Return(nullconfig + num_configs));
+      .WillByDefault(Return(&nullconfigs[num_configs]));
   num_configs++;
   ON_CALL(filter_callbacks.route_->route_entry_, perFilterConfig(filter_name))
-      .WillByDefault(Return(nullconfig + num_configs));
+      .WillByDefault(Return(&nullconfigs[num_configs]));
 
   // a vector to save which configs are visited by the traversePerFilterConfigGeneric
   std::vector<size_t> visited_configs(num_configs, 0);
@@ -720,7 +719,7 @@ TEST(HttpUtility, TraversePerFilterConfigIteratesInOrder) {
   size_t index = 0;
   Utility::traversePerFilterConfigGeneric(filter_name, filter_callbacks.route(),
                                           [&](const Router::RouteSpecificFilterConfig& cfg) {
-                                            int cfg_index = &cfg - nullconfig;
+                                            int cfg_index = &cfg - nullconfigs.data();
                                             visited_configs[index] = cfg_index - 1;
                                             index++;
                                           });