http: add Kill Request HTTP filter

.azure-pipelines/pipelines.yml

@@ -393,6 +393,12 @@ stages:
               BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
               BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
               GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+          - task: PublishTestResults@2
+            inputs:
+              testResultsFiles: "**/bazel-out/**/testlogs/**/test.xml"
+              testRunTitle: "windows"
+              searchFolder: $(Build.StagingDirectory)/tmp
+            condition: always()
           - task: PublishBuildArtifacts@1
             inputs:
               pathtoPublish: "$(Build.StagingDirectory)/envoy"

.devcontainer/devcontainer.json

@@ -12,6 +12,9 @@
     // Uncomment next line if you have devcontainer.env
     // "--env-file=.devcontainer/devcontainer.env"
   ],
+  "containerEnv": {
+    "ENVOY_SRCDIR": "${containerWorkspaceFolder}",
+  },
   "settings": {
     "terminal.integrated.shell.linux": "/bin/bash",
     "bazel.buildifierFixOnFormat": true,

.github/workflows/codeql-push.yml

@@ -24,7 +24,9 @@ jobs:
     - name: Get build targets
       run: |
        . .github/workflows/get_build_targets.sh
-       echo ::set-env name=BUILD_TARGETS::$(echo $BUILD_TARGETS_LOCAL)
+       echo 'BUILD_TARGETS<<EOF' >> $GITHUB_ENV
+       echo $BUILD_TARGETS_LOCAL >> $GITHUB_ENV
+       echo 'EOF' >> $GITHUB_ENV
     # If this run was triggered by a pull request event, then checkout
     # the head of the pull request instead of the merge commit.
     - run: git checkout HEAD^2

CODEOWNERS

@@ -92,6 +92,8 @@ extensions/filters/common/original_src @snowp @klarose
 /*/extensions/filters/network/wasm @PiotrSikora @lizan
 # webassembly common extension
 /*/extensions/common/wasm @PiotrSikora @lizan
+# webassembly runtimes
+/*/extensions/wasm_runtime/ @PiotrSikora @lizan
 # common matcher
 /*/extensions/common/matcher @mattklein123 @yangminzhu
 # common crypto extension
@@ -152,3 +154,5 @@ extensions/filters/http/oauth2 @rgs1 @derekargueta @snowp
 # HTTP Local Rate Limit
 /*/extensions/filters/http/local_ratelimit @rgs1 @mattklein123
 /*/extensions/filters/common/local_ratelimit @mattklein123 @rgs1
+# HTTP Kill Request
+/*/extensions/filters/http/kill_request @qqustc @htuch

PULL_REQUESTS.md

@@ -60,7 +60,7 @@ changes may be in [docs/root](docs/root) and/or inline with the API protos. Plea
 N/A if there were no documentation changes.
 
 Any PRs with structural changes to the dataplane should also update the [Life of a
-Request](docs/root/intro/life_of_a_request.md) documentation as appropriate.
+Request](https://www.envoyproxy.io/docs/envoy/latest/intro/life_of_a_request) documentation as appropriate.
 
 ### <a name="relnotes"></a>Release notes
 

REPO_LAYOUT.md

@@ -63,9 +63,8 @@ Not every directory within test is described below, but a few highlights:
 ## [source/extensions](source/extensions/) layout
 
 We maintain a very specific code and namespace layout for extensions. This aids in discovering
-code/extensions, and also will allow us in the future to more easily scale out our extension
-maintainers by having OWNERS files specific to certain extensions. (As of this writing, this is not
-currently implemented but that is the plan moving forward.)
+code/extensions, and allows us specify extension owners in [CODEOWNERS](CODEOWNERS).
+
 
 * All extensions are either registered in [all_extensions.bzl](source/extensions/all_extensions.bzl)
   or [extensions_build_config.bzl](source/extensions/extensions_build_config.bzl). The former is
@@ -76,6 +75,14 @@ currently implemented but that is the plan moving forward.)
 * These are the top level extension directories and associated namespaces:
   * [access_loggers/](/source/extensions/access_loggers): Access log implementations which use
     the `Envoy::Extensions::AccessLoggers` namespace.
+  * [bootstrap](/source/extensions/bootstrap): Bootstrap extensions which use
+    the `Envoy::Extensions::Bootstrap` namespace.
+  * [clusters](/source/extensions/clusters): Cluster extensions which use the
+    `Envoy::Extensions::Clusters` namespace.
+  * [compression](/source/extensions/compression): Compression extensions
+    which use `Envoy::Extensions::Compression` namespace.
+  * [fatal_actions](/source/extensions/fatal_actions): Fatal Action extensions
+    which use the `Envoy::Extensions::FatalActions` namespace.
   * [filters/http/](/source/extensions/filters/http): HTTP L7 filters which use the
     `Envoy::Extensions::HttpFilters` namespace.
   * [filters/listener/](/source/extensions/filters/listener): Listener filters which use the
@@ -86,14 +93,24 @@ currently implemented but that is the plan moving forward.)
     `Envoy::Extensions::GrpcCredentials` namespace.
   * [health_checker/](/source/extensions/health_checker): Custom health checkers which use the
     `Envoy::Extensions::HealthCheckers` namespace.
-  * [resolvers/](/source/extensions/resolvers): Network address resolvers which use the
-    `Envoy::Extensions::Resolvers` namespace.
+  * [internal_redirect](/source/extensions/internal_redirect): Internal Redirect
+    extensions which use the `Envoy::Extensions::InternalRedirect` namespace.
+  * [quic_listeners](/source/extensions/quic_listeners): QUIC extensions which
+    use the `Envoy::Quic` namespace.
+  * [resource_monitors](/source/extensions/resource_monitors): Resource monitor
+    extensions which use the `Envoy::Extensions::ResourceMonitors` namespace.
+  * [retry](/source/extensions/retry): Retry extensions which use the
+    `Envoy::Extensions::Retry` namespace.
   * [stat_sinks/](/source/extensions/stat_sinks): Stat sink implementations which use the
     `Envoy::Extensions::StatSinks` namespace.
   * [tracers/](/source/extensions/tracers): Tracers which use the
     `Envoy::Extensions::Tracers` namespace.
   * [transport_sockets/](/source/extensions/transport_sockets): Transport socket implementations
     which use the `Envoy::Extensions::TransportSockets` namespace.
+  * [upstreams](/source/extensions/upstreams): Upstream extensions use the
+    `Envoy::Extensions::Upstreams` namespace.
+  * [watchdog](/source/extensions/watchdog): Watchdog extensions use the
+    `Envoy::Extensions::Watchdog` namespace.
 * Each extension is contained wholly in its own namespace. E.g.,
   `Envoy::Extensions::NetworkFilters::Echo`.
 * Common code that is used by multiple extensions should be in a `common/` directory as close to

STYLE.md

@@ -19,7 +19,7 @@
 # Documentation
 
 * If you are modifying the data plane structually, please keep the [Life of a
-  Request](docs/root/intro/life_of_a_request.md) documentation up-to-date.
+  Request](https://www.envoyproxy.io/docs/envoy/latest/intro/life_of_a_request) documentation up-to-date.
 
 # Deviations from Google C++ style guidelines
 

api/BUILD

@@ -190,6 +190,7 @@ proto_library(
         "//envoy/extensions/filters/http/health_check/v3:pkg",
         "//envoy/extensions/filters/http/ip_tagging/v3:pkg",
         "//envoy/extensions/filters/http/jwt_authn/v3:pkg",
+        "//envoy/extensions/filters/http/kill_request/v3:pkg",
         "//envoy/extensions/filters/http/local_ratelimit/v3:pkg",
         "//envoy/extensions/filters/http/lua/v3:pkg",
         "//envoy/extensions/filters/http/oauth2/v3alpha:pkg",

api/envoy/config/bootstrap/v3/bootstrap.proto

@@ -40,7 +40,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // <config_overview_bootstrap>` for more detail.
 
 // Bootstrap :ref:`configuration overview <config_overview_bootstrap>`.
-// [#next-free-field: 28]
+// [#next-free-field: 29]
 message Bootstrap {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.bootstrap.v2.Bootstrap";
@@ -243,6 +243,10 @@ message Bootstrap {
   // Each item contains extension specific configuration.
   repeated core.v3.TypedExtensionConfig bootstrap_extensions = 21;
 
+  // Specifies optional extensions instantiated at startup time and
+  // invoked during crash time on the request that caused the crash.
+  repeated FatalAction fatal_actions = 28;
+
   // Configuration sources that will participate in
   // *udpa.core.v1.ResourceLocator* authority resolution. The algorithm is as
   // follows:
@@ -420,6 +424,20 @@ message Watchdog {
   type.v3.Percent multikill_threshold = 5;
 }
 
+// Fatal actions to run while crashing. Actions can be safe (meaning they are
+// async-signal safe) or unsafe. We run all safe actions before we run unsafe actions.
+// If using an unsafe action that could get stuck or deadlock, it important to
+// have an out of band system to terminate the process.
+//
+// The interface for the extension is ``Envoy::Server::Configuration::FatalAction``.
+// *FatalAction* extensions live in the ``envoy.extensions.fatal_actions`` API
+// namespace.
+message FatalAction {
+  // Extension specific configuration for the action. It's expected to conform
+  // to the ``Envoy::Server::Configuration::FatalAction`` interface.
+  core.v3.TypedExtensionConfig config = 1;
+}
+
 // Runtime :ref:`configuration overview <config_runtime>` (deprecated).
 message Runtime {
   option (udpa.annotations.versioning).previous_message_type = "envoy.config.bootstrap.v2.Runtime";

api/envoy/config/common/matcher/v3/matcher.proto

@@ -4,7 +4,7 @@ package envoy.config.common.matcher.v3;
 
 import "envoy/config/core/v3/extension.proto";
 import "envoy/config/route/v3/route_components.proto";
-import "envoy/type/matcher/v3/value.proto";
+import "envoy/type/matcher/v3/string.proto";
 
 import "udpa/annotations/migrate.proto";
 import "udpa/annotations/status.proto";
@@ -58,9 +58,8 @@ message Matcher {
         oneof matcher {
           option (validate.required) = true;
 
-          // Use existing infrastructure for actually matching the
-          // value.
-          type.matcher.v3.ValueMatcher value_match = 2;
+          // Built-in string matcher.
+          type.matcher.v3.StringMatcher value_match = 2;
 
           // Extension for custom matching logic.
           core.v3.TypedExtensionConfig custom_match = 3;

api/envoy/config/core/v3/base.proto

@@ -313,6 +313,13 @@ message HeaderMap {
   repeated HeaderValue headers = 1;
 }
 
+// A directory that is watched for changes, e.g. by inotify on Linux. Move/rename
+// events inside this directory trigger the watch.
+message WatchedDirectory {
+  // Directory path to watch.
+  string path = 1 [(validate.rules).string = {min_len: 1}];
+}
+
 // Data source consisting of either a file or an inline value.
 message DataSource {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.DataSource";

api/envoy/config/trace/v3/zipkin.proto

@@ -46,9 +46,7 @@ message ZipkinConfig {
     GRPC = 3;
   }
 
-  // The cluster manager cluster that hosts the Zipkin collectors. Note that the
-  // Zipkin cluster must be defined in the :ref:`Bootstrap static cluster
-  // resources <envoy_api_field_config.bootstrap.v3.Bootstrap.StaticResources.clusters>`.
+  // The cluster manager cluster that hosts the Zipkin collectors.
   string collector_cluster = 1 [(validate.rules).string = {min_len: 1}];
 
   // The API endpoint of the Zipkin service where the spans will be sent. When

api/envoy/extensions/filters/http/grpc_json_transcoder/v3/transcoder.proto

@@ -15,11 +15,27 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // gRPC-JSON transcoder :ref:`configuration overview <config_http_filters_grpc_json_transcoder>`.
 // [#extension: envoy.filters.http.grpc_json_transcoder]
 
-// [#next-free-field: 10]
+// [#next-free-field: 11]
 message GrpcJsonTranscoder {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.http.transcoder.v2.GrpcJsonTranscoder";
 
+  enum UrlUnescapeSpec {
+    // URL path parameters will not decode RFC 6570 reserved characters.
+    // For example, segment `%2f%23/%20%2523` is unescaped to `%2f%23/ %23`.
+    ALL_CHARACTERS_EXCEPT_RESERVED = 0;
+
+    // URL path parameters will be fully URI-decoded except in
+    // cases of single segment matches in reserved expansion, where "%2F" will be
+    // left encoded.
+    // For example, segment `%2f%23/%20%2523` is unescaped to `%2f#/ %23`.
+    ALL_CHARACTERS_EXCEPT_SLASH = 1;
+
+    // URL path parameters will be fully URI-decoded.
+    // For example, segment `%2f%23/%20%2523` is unescaped to `/#/ %23`.
+    ALL_CHARACTERS = 2;
+  }
+
   message PrintOptions {
     option (udpa.annotations.versioning).previous_message_type =
         "envoy.config.filter.http.transcoder.v2.GrpcJsonTranscoder.PrintOptions";
@@ -160,4 +176,11 @@ message GrpcJsonTranscoder {
   //  the ``google/rpc/error_details.proto`` should be included in the configured
   //  :ref:`proto descriptor set <config_grpc_json_generate_proto_descriptor_set>`.
   bool convert_grpc_status = 9;
+
+  // URL unescaping policy.
+  // This spec is only applied when extracting variable with multiple segments.
+  // For example, in case of `/foo/{x=*}/bar/{y=prefix/*}/{z=**}` `x` variable is single segment and `y` and `z` are multiple segments.
+  // For a path with `/foo/first/bar/prefix/second/third/fourth`, `x=first`, `y=prefix/second`, `z=third/fourth`.
+  // If this setting is not specified, the value defaults to :ref:`ALL_CHARACTERS_EXCEPT_RESERVED<envoy_api_enum_value_extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder.UrlUnescapeSpec.ALL_CHARACTERS_EXCEPT_RESERVED>`.
+  UrlUnescapeSpec url_unescape_spec = 10 [(validate.rules).enum = {defined_only: true}];
 }

api/envoy/extensions/filters/http/jwt_authn/v3/config.proto

@@ -51,7 +51,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 //       cache_duration:
 //         seconds: 300
 //
-// [#next-free-field: 10]
+// [#next-free-field: 11]
 message JwtProvider {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.http.jwt_authn.v2alpha.JwtProvider";
@@ -191,6 +191,10 @@ message JwtProvider {
   //       exp: 1501281058
   //
   string payload_in_metadata = 9;
+
+  // Specify the clock skew in seconds when verifying JWT time constraint,
+  // such as `exp`, and `nbf`. If not specified, default is 60 seconds.
+  uint32 clock_skew_seconds = 10;
 }
 
 // This message specifies how to fetch JWKS from remote and how to cache it.

api/envoy/extensions/filters/http/kill_request/v3/BUILD

@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/type/v3:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)