udp: add router for UDP proxy

api/envoy/extensions/filters/udp/udp_proxy/v3/BUILD

@@ -6,8 +6,11 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/accesslog/v3:pkg",
         "//envoy/config/core/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
+        "@com_github_cncf_udpa//xds/annotations/v3:pkg",
+        "@com_github_cncf_udpa//xds/type/matcher/v3:pkg",
     ],
 )

api/envoy/extensions/filters/udp/udp_proxy/v3/route.proto

@@ -0,0 +1,20 @@
+syntax = "proto3";
+
+package envoy.extensions.filters.udp.udp_proxy.v3;
+
+import "udpa/annotations/status.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.filters.udp.udp_proxy.v3";
+option java_outer_classname = "RouteProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/udp/udp_proxy/v3;udp_proxyv3";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: UDP proxy route configuration]
+// UDP proxy :ref:`configuration overview <config_udp_listener_filters_udp_proxy>`.
+
+message Route {
+  // Indicates the upstream cluster to which the request should be routed.
+  string cluster = 1 [(validate.rules).string = {min_len: 1}];
+}

api/envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto

@@ -7,6 +7,10 @@ import "envoy/config/core/v3/udp_socket_config.proto";
 
 import "google/protobuf/duration.proto";
 
+import "xds/annotations/v3/status.proto";
+import "xds/type/matcher/v3/matcher.proto";
+
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -22,7 +26,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // [#extension: envoy.filters.udp_listener.udp_proxy]
 
 // Configuration for the UDP proxy filter.
-// [#next-free-field: 9]
+// [#next-free-field: 10]
 message UdpProxyConfig {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.udp.udp_proxy.v2alpha.UdpProxyConfig";
@@ -52,7 +56,18 @@ message UdpProxyConfig {
     option (validate.required) = true;
 
     // The upstream cluster to connect to.
-    string cluster = 2 [(validate.rules).string = {min_len: 1}];
+    // This field is deprecated in favor of
+    // :ref:`matcher <envoy_v3_api_field_extensions.filters.udp.udp_proxy.v3.UdpProxyConfig.matcher>`.
+    string cluster = 2 [
+      deprecated = true,
+      (validate.rules).string = {min_len: 1},
+      (envoy.annotations.deprecated_at_minor_version) = "3.0"
+    ];
+
+    // The match tree to use when resolving route actions for incoming requests.
+    // See :ref:`Routing <config_udp_listener_filters_udp_proxy_routing>` for more information.
+    xds.type.matcher.v3.Matcher matcher = 9
+        [(xds.annotations.v3.field_status).work_in_progress = true];
   }
 
   // The idle timeout for sessions. Idle is defined as no datagrams between received or sent by

docs/root/configuration/listeners/udp_filters/_include/udp-proxy-router.yaml

@@ -0,0 +1,90 @@
+static_resources:
+  listeners:
+  - name: listener_0
+    address:
+      socket_address:
+        protocol: UDP
+        address: 0.0.0.0
+        port_value: 1234
+    listener_filters:
+    - name: envoy.filters.udp_listener.udp_proxy
+      typed_config:
+        '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig
+        stat_prefix: service
+        matcher:
+          # The outer matcher list matches source IP.
+          matcher_list:
+            matchers:
+            - predicate:
+                single_predicate:
+                  input:
+                    name: envoy.matching.inputs.source_ip
+                    typed_config:
+                      '@type': type.googleapis.com/envoy.extensions.matching.common_inputs.network.v3.SourceIPInput
+                  value_match:
+                    exact: 127.0.0.1
+              on_match:
+                matcher:
+                  # The inner matcher tree matches source port.
+                  matcher_tree:
+                    input:
+                      name: envoy.matching.inputs.source_port
+                      typed_config:
+                        '@type': type.googleapis.com/envoy.extensions.matching.common_inputs.network.v3.SourcePortInput
+                    exact_match_map:
+                      map:
+                        "80":
+                          action:
+                            name: route
+                            typed_config:
+                              '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.Route
+                              cluster: udp_service
+                        "443":
+                          action:
+                            name: route
+                            typed_config:
+                              '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.Route
+                              cluster: udp_service2
+                  on_no_match:
+                    action:
+                      name: route
+                      typed_config:
+                        '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.Route
+                        cluster: udp_service3
+  clusters:
+  - name: service_udp
+    type: STATIC
+    lb_policy: ROUND_ROBIN
+    load_assignment:
+      cluster_name: service_udp
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: 127.0.0.1
+                port_value: 1235
+  - name: service_udp2
+    type: STATIC
+    lb_policy: ROUND_ROBIN
+    load_assignment:
+      cluster_name: service_udp
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: 127.0.0.1
+                port_value: 1236
+  - name: service_udp3
+    type: STATIC
+    lb_policy: ROUND_ROBIN
+    load_assignment:
+      cluster_name: service_udp
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: 127.0.0.1
+                port_value: 1237

docs/root/configuration/listeners/udp_filters/_include/udp-proxy.yaml

@@ -20,7 +20,13 @@ static_resources:
       typed_config:
         '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig
         stat_prefix: service
-        cluster: service_udp
+        matcher:
+          on_no_match:
+            action:
+              name: route
+              typed_config:
+                '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.Route
+                cluster: service_udp
         upstream_socket_config:
           max_rx_datagram_size: 9000
   clusters:

docs/root/configuration/listeners/udp_filters/udp_proxy.rst

@@ -52,6 +52,28 @@ The number of sessions that can be created per upstream cluster is limited by th
 :ref:`maximum connection circuit breaker <arch_overview_circuit_break_cluster_maximum_connections>`.
 By default this is 1024.
 
+
+.. _config_udp_listener_filters_udp_proxy_routing:
+
+Routing
+-------
+
+The filter can route different datagrams to different upstream clusters with their source
+addresses. The matching API can be used with UDP routing, by specifying a matcher, a
+:ref:`UDP network input <extension_category_envoy.matching.network.input>` as the matching rule and
+:ref:`Route <envoy_v3_api_msg_extensions.filters.udp.udp_proxy.v3.Route>` as the resulting action.
+
+The following matcher configuration will lead Envoy to route UDP datagrams according to their
+source IPs, ignore datagrams other than those with a source IP of 127.0.0.1, and then filter the
+remaining datagrams to different clusters according to their source ports.
+
+.. literalinclude:: _include/udp-proxy-router.yaml
+   :language: yaml
+   :linenos:
+   :lineno-start: 14
+   :lines: 14-53
+   :caption: :download:`udp-proxy-router.yaml <_include/udp-proxy-router.yaml>`
+
 Example configuration
 ---------------------
 

docs/root/version_history/current.rst

@@ -146,6 +146,7 @@ New Features
   useful in support systems such as CI, CD, etc. The
   :ref:`schema validator check tool <install_tools_schema_validator_check_tool>` has been added
   to the tools image.
+* udp_proxy: added :ref:`matcher <envoy_v3_api_field_extensions.filters.udp.udp_proxy.v3.UdpProxyConfig.matcher>` to support matching and routing to different clusters.
 * udp_proxy: added support for :ref:`access_log <envoy_v3_api_field_extensions.filters.udp.udp_proxy.v3.UdpProxyConfig.access_log>`.
 
 Deprecated
@@ -157,3 +158,4 @@ Deprecated
 * http: removing support for long-deprecated old style filter names, e.g. envoy.router, envoy.lua.
 * re2: removed undocumented histograms ``re2.program_size`` and ``re2.exceeded_warn_level``.
 * thrift: deprecated TTwitter protocol since we believe it's not used and it's causing significant maintenance burden.
+* udp_proxy: deprecated :ref:`cluster <envoy_v3_api_field_extensions.filters.udp.udp_proxy.v3.UdpProxyConfig.cluster>` in favor of :ref:`matcher <envoy_v3_api_field_extensions.filters.udp.udp_proxy.v3.UdpProxyConfig.matcher>`.

envoy/network/filter.h

@@ -555,8 +555,8 @@ class UdpMatchingData {
 
   virtual ~UdpMatchingData() = default;
 
-  virtual const Address::InstanceConstSharedPtr& localAddress() const PURE;
-  virtual const Address::InstanceConstSharedPtr& remoteAddress() const PURE;
+  virtual const Address::Instance& localAddress() const PURE;
+  virtual const Address::Instance& remoteAddress() const PURE;
 };
 
 } // namespace Network

examples/udp/envoy.yaml

@@ -11,7 +11,13 @@ static_resources:
       typed_config:
         '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig
         stat_prefix: service
-        cluster: service_udp
+        matcher:
+          on_no_match:
+            action:
+              name: route
+              typed_config:
+                '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.Route
+                cluster: service_udp
 
   clusters:
   - name: service_udp

source/common/network/matching/data_impl.h

@@ -24,15 +24,15 @@ class MatchingDataImpl : public MatchingData {
  */
 class UdpMatchingDataImpl : public UdpMatchingData {
 public:
-  UdpMatchingDataImpl(const Address::InstanceConstSharedPtr& local_address,
-                      const Address::InstanceConstSharedPtr& remote_address)
+  UdpMatchingDataImpl(const Address::Instance& local_address,
+                      const Address::Instance& remote_address)
       : local_address_(local_address), remote_address_(remote_address) {}
-  const Address::InstanceConstSharedPtr& localAddress() const override { return local_address_; }
-  const Address::InstanceConstSharedPtr& remoteAddress() const override { return remote_address_; }
+  const Address::Instance& localAddress() const override { return local_address_; }
+  const Address::Instance& remoteAddress() const override { return remote_address_; }
 
 private:
-  const Address::InstanceConstSharedPtr& local_address_;
-  const Address::InstanceConstSharedPtr& remote_address_;
+  const Address::Instance& local_address_;
+  const Address::Instance& remote_address_;
 };
 
 } // namespace Matching

source/common/network/matching/inputs.cc

@@ -24,11 +24,11 @@ template <>
 Matcher::DataInputGetResult
 DestinationIPInput<UdpMatchingData>::get(const UdpMatchingData& data) const {
   const auto& address = data.localAddress();
-  if (address->type() != Network::Address::Type::Ip) {
+  if (address.type() != Network::Address::Type::Ip) {
     return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt};
   }
   return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable,
-          address->ip()->addressAsString()};
+          address.ip()->addressAsString()};
 }
 
 template <>
@@ -46,11 +46,11 @@ template <>
 Matcher::DataInputGetResult
 DestinationPortInput<UdpMatchingData>::get(const UdpMatchingData& data) const {
   const auto& address = data.localAddress();
-  if (address->type() != Network::Address::Type::Ip) {
+  if (address.type() != Network::Address::Type::Ip) {
     return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt};
   }
   return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable,
-          absl::StrCat(address->ip()->port())};
+          absl::StrCat(address.ip()->port())};
 }
 
 template <>
@@ -66,11 +66,11 @@ Matcher::DataInputGetResult SourceIPInput<MatchingData>::get(const MatchingData&
 template <>
 Matcher::DataInputGetResult SourceIPInput<UdpMatchingData>::get(const UdpMatchingData& data) const {
   const auto& address = data.remoteAddress();
-  if (address->type() != Network::Address::Type::Ip) {
+  if (address.type() != Network::Address::Type::Ip) {
     return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt};
   }
   return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable,
-          address->ip()->addressAsString()};
+          address.ip()->addressAsString()};
 }
 
 template <>
@@ -87,11 +87,11 @@ template <>
 Matcher::DataInputGetResult
 SourcePortInput<UdpMatchingData>::get(const UdpMatchingData& data) const {
   const auto& address = data.remoteAddress();
-  if (address->type() != Network::Address::Type::Ip) {
+  if (address.type() != Network::Address::Type::Ip) {
     return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt};
   }
   return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable,
-          absl::StrCat(address->ip()->port())};
+          absl::StrCat(address.ip()->port())};
 }
 
 Matcher::DataInputGetResult DirectSourceIPInput::get(const MatchingData& data) const {

source/extensions/filters/udp/udp_proxy/BUILD

@@ -35,12 +35,14 @@ envoy_cc_library(
         "//envoy/upstream:cluster_manager_interface",
         "//source/common/access_log:access_log_lib",
         "//source/common/api:os_sys_calls_lib",
+        "//source/common/common:empty_string",
         "//source/common/common:random_generator_lib",
         "//source/common/network:socket_lib",
         "//source/common/network:socket_option_factory_lib",
         "//source/common/network:utility_lib",
         "//source/common/stream_info:stream_info_lib",
         "//source/common/upstream:load_balancer_lib",
+        "//source/extensions/filters/udp/udp_proxy/router:router_lib",
         "@envoy_api//envoy/config/accesslog/v3:pkg_cc_proto",
         "@envoy_api//envoy/extensions/filters/udp/udp_proxy/v3:pkg_cc_proto",
     ],

source/extensions/filters/udp/udp_proxy/router/BUILD

@@ -0,0 +1,29 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_extension_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_extension_package()
+
+envoy_cc_library(
+    name = "router_interface",
+    hdrs = ["router.h"],
+)
+
+envoy_cc_library(
+    name = "router_lib",
+    srcs = ["router_impl.cc"],
+    hdrs = ["router_impl.h"],
+    deps = [
+        ":router_interface",
+        "//source/common/common:empty_string",
+        "//source/common/matcher:matcher_lib",
+        "//source/common/matcher:validation_visitor_lib",
+        "//source/common/network/matching:data_impl_lib",
+        "//source/common/network/matching:inputs_lib",
+        "@envoy_api//envoy/extensions/filters/udp/udp_proxy/v3:pkg_cc_proto",
+    ],
+)