listener: filter chain unified matchers

api/envoy/config/listener/v3/listener_components.proto

@@ -93,7 +93,7 @@ message Filter {
 // listed at the end, because that's how we want to list them in the docs.
 //
 // [#comment:TODO(PiotrSikora): Add support for configurable precedence of the rules]
-// [#next-free-field: 14]
+// [#next-free-field: 15]
 message FilterChainMatch {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.listener.FilterChainMatch";
@@ -109,6 +109,131 @@ message FilterChainMatch {
     EXTERNAL = 2;
   }
 
+  // Matches filter chains by the destination port.
+  // [#next-free-field: 6]
+  message DestinationPort {
+    // Optional destination port to consider when use_original_dst is set on the
+    // listener in determining a filter chain match.
+    google.protobuf.UInt32Value destination_port = 1
+        [(validate.rules).uint32 = {lte: 65535 gte: 1}];
+
+    // Match destination port by range.
+    type.v3.Int32Range destination_port_range = 5;
+  }
+
+  // Matches filter chains by the destination IP address.
+  message DestinationIP {
+    // If non-empty, an IP address and prefix length to match addresses when the
+    // listener is bound to 0.0.0.0/:: or when use_original_dst is specified.
+    // Empty list matches all.
+    repeated core.v3.CidrRange prefix_ranges = 1;
+  }
+
+  // Matches filter chains by the directly connected source IP address (this
+  // will only be different from the source IP address when using a listener
+  // filter that overrides the source address, such as the :ref:`Proxy Protocol
+  // listener filter <config_listener_filters_proxy_protocol>`).
+  message DirectSourceIP {
+    // The criteria is satisfied if the directly connected source IP address of the downstream
+    // connection is contained in at least one of the specified subnets. If the list is empty,
+    // the directly connected source IP address is ignored.
+    repeated core.v3.CidrRange direct_source_prefix_ranges = 1;
+  }
+
+  // Matches filter chains by the connection source IP type.
+  message SourceType {
+    // Specifies the connection source IP match type. Can be any, local or external network.
+    ConnectionSourceType source_type = 1 [(validate.rules).enum = {defined_only: true}];
+  }
+
+  // Matches filter chains by the source IP address.
+  message SourceIP {
+    // The criteria is satisfied if the source IP address of the downstream
+    // connection is contained in at least one of the specified subnets. If the list is empty, the source IP address is
+    // ignored.
+    repeated core.v3.CidrRange source_prefix_ranges = 1;
+  }
+
+  // Matches filter chains by the source port.
+  message SourcePort {
+    // The criteria is satisfied if the source port of the downstream connection
+    // is contained in at least one of the specified ports. If the parameter is
+    // not specified, the source port is ignored.
+    repeated uint32 source_ports = 1
+        [(validate.rules).repeated = {items {uint32 {lte: 65535 gte: 1}}}];
+  }
+
+  // Matches filter chains by the server name indication.
+  message SNI {
+    // If non-empty, a list of server names (e.g. SNI for TLS protocol) to consider when determining
+    // a filter chain match. Those values will be compared against the server names of a new
+    // connection, when detected by one of the listener filters.
+    //
+    // The server name will be matched against all wildcard domains, i.e. ``www.example.com``
+    // will be first matched against ``www.example.com``, then ``*.example.com``, then ``*.com``.
+    //
+    // Note that partial wildcards are not supported, and values like ``*w.example.com`` are invalid.
+    //
+    // .. attention::
+    //
+    //   See the :ref:`FAQ entry <faq_how_to_setup_sni>` on how to configure SNI for more
+    //   information.
+    repeated string server_names = 1;
+  }
+
+  // Matches filter chains by the transport protocol.
+  message TransportProtocol {
+    // If non-empty, a transport protocol to consider when determining a filter chain match.
+    // This value will be compared against the transport protocol of a new connection, when
+    // it's detected by one of the listener filters.
+    //
+    // Suggested values include:
+    //
+    // * ``raw_buffer`` - default, used when no transport protocol is detected,
+    // * ``tls`` - set by :ref:`envoy.filters.listener.tls_inspector <config_listener_filters_tls_inspector>`
+    //   when TLS protocol is detected.
+    string transport_protocol = 1;
+  }
+
+  // Matches filter chains by the application protocol (e.g. ALPN for TLS protocol).
+  message ApplicationProtocol {
+    // If non-empty, a list of application protocols (e.g. ALPN for TLS protocol) to consider when
+    // determining a filter chain match. Those values will be compared against the application
+    // protocols of a new connection, when detected by one of the listener filters.
+    //
+    // Suggested values include:
+    //
+    // * ``http/1.1`` - set by :ref:`envoy.filters.listener.tls_inspector
+    //   <config_listener_filters_tls_inspector>`,
+    // * ``h2`` - set by :ref:`envoy.filters.listener.tls_inspector <config_listener_filters_tls_inspector>`
+    //
+    // .. attention::
+    //
+    //   Currently, only :ref:`TLS Inspector <config_listener_filters_tls_inspector>` provides
+    //   application protocol detection based on the requested
+    //   `ALPN <https://en.wikipedia.org/wiki/Application-Layer_Protocol_Negotiation>`_ values.
+    //
+    //   However, the use of ALPN is pretty much limited to the HTTP/2 traffic on the Internet,
+    //   and matching on values other than ``h2`` is going to lead to a lot of false negatives,
+    //   unless all connecting clients are known to use ALPN.
+    repeated string application_protocols = 1;
+  }
+
+  // Individual filter chain match predicate.
+  message FilterChainMatchPredicate {
+    // The typed config for the match predicate extension. The type URL will be
+    // used to identify the extension. In the case that the type URL is
+    // *xds.type.v3.TypedStruct* (or, for historical reasons,
+    // *udpa.type.v1.TypedStruct*), the inner type URL of *TypedStruct* will be
+    // utilized. See the :ref:`extension configuration overview
+    // <config_overview_extension_configuration>` for further details.
+    google.protobuf.Any typed_config = 1 [(validate.rules).any = {required: true}];
+
+    // Flag to continue matching if this match is a wildcard match and there is a
+    // more specific match.
+    bool fallthrough = 2;
+  }
+
   reserved 1;
 
   // Optional destination port to consider when use_original_dst is set on the
@@ -193,6 +318,46 @@ message FilterChainMatch {
   //   and matching on values other than ``h2`` is going to lead to a lot of false negatives,
   //   unless all connecting clients are known to use ALPN.
   repeated string application_protocols = 10;
+
+  // A list of filter chain matching predicate extensions specifying the order
+  // of selection for the most specific filter chain. The filter chains in a
+  // single listener must have the identical order of predicate extension type
+  // URLs. For backwards compatibility, if the existing fields in the filter
+  // chain match are specified, the fields are converted to their corresponding
+  // filter chain matching predicates in the following default matching order:
+  // 1. :ref:`DestinationPort <envoy_v3_api_msg_config.listener.v3.FilterChainMatch.DestinationPort>`.
+  // 2. :ref:`DestinationIP <envoy_v3_api_msg_config.listener.v3.FilterChainMatch.DestinationIP>`.
+  // 3. :ref:`SNI <envoy_v3_api_msg_config.listener.v3.FilterChainMatch.SNI>`.
+  // 4. :ref:`TransportProtocol <envoy_v3_api_msg_config.listener.v3.FilterChainMatch.TransportProtocol>`.
+  // 5. :ref:`ApplicationProtocol <envoy_v3_api_msg_config.listener.v3.FilterChainMatch.ApplicationProtocol>`.
+  // 6. :ref:`DirectSourceIP <envoy_v3_api_msg_config.listener.v3.FilterChainMatch.DirectSourceIP>`.
+  // 7. :ref:`SourceType <envoy_v3_api_msg_config.listener.v3.FilterChainMatch.SourceType>`.
+  // 8. :ref:`SourceIP <envoy_v3_api_msg_config.listener.v3.FilterChainMatch.SourceIP>`.
+  // 9. :ref:`SourcePort <envoy_v3_api_msg_config.listener.v3.FilterChainMatch.SourcePort>`.
+  //
+  // At each step, the predicate is evaluated for each filter chain. If the
+  // predicate returns false, the filter chain is eliminated from subsequent
+  // consideration. If the predicate returns true, then the decision is based
+  // on the ``fallthrough`` flag. If there is another more specific match for
+  // the same predicate and the flag is not set, then the less specific match
+  // is eliminated. If the flag is set, then it remains as a candidate for the
+  // next step.
+  //
+  // For example, consider SNI ``www.example.com``and two filter chains with
+  // the predicates ```*.example.com``` and ```*.com```. If ``fallthrough``
+  // flag is not set then only the filter chain ```*.example.com``` matches. If
+  // ``fallthrough`` flag is set on ```*.com```, then both filter chains match.
+  // In general, the order of specificity is domain specific as defined by the
+  // predicate extension. The flag should be set when matching on multiple
+  // properties in order for a default chain to apply without explicit specific
+  // matching of the first properties in the list.
+  //
+  // In case, there is more than one filter chain candidates remaining after
+  // the process completes, the first of the filter chains in the order of
+  // their declaration is selected.
+  //
+  // [#not-implemented-hide:]
+  repeated FilterChainMatchPredicate predicates = 14;
 }
 
 // A filter chain wraps a set of match criteria, an option TLS context, a set of filters, and