diff --git a/CMakeLists.txt b/CMakeLists.txt
index 6b7f4ecc0d14c..a76a1fb39a073 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -18,10 +18,6 @@ include_directories(SYSTEM ${ENVOY_PROTOBUF_INCLUDE_DIR})
 add_subdirectory(source)
 add_subdirectory(test)
 
-set(CLANG-FORMAT clang-format-3.6 CACHE FILEPATH "path to clang-format binary")
-set(BUILDIFIER /usr/lib/go/bin/buildifier CACHE FILEPATH "path to buildifier binary")
 set(CHECK_FORMAT_PATH ${CMAKE_CURRENT_SOURCE_DIR}/tools/check_format.py)
-add_custom_target(check_format
-                  ${CHECK_FORMAT_PATH} ${CMAKE_SOURCE_DIR} ${CLANG-FORMAT} ${BUILDIFIER} check)
-add_custom_target(fix_format
-                  ${CHECK_FORMAT_PATH} ${CMAKE_SOURCE_DIR} ${CLANG-FORMAT} ${BUILDIFIER} fix)
+add_custom_target(check_format ${CHECK_FORMAT_PATH} check ${CMAKE_SOURCE_DIR})
+add_custom_target(fix_format ${CHECK_FORMAT_PATH} fix ${CMAKE_SOURCE_DIR})
diff --git a/ci/build_setup.sh b/ci/build_setup.sh
index a19d0e71c7a02..b44bae4e0ef8a 100755
--- a/ci/build_setup.sh
+++ b/ci/build_setup.sh
@@ -12,6 +12,8 @@ export PPROF_PATH=/thirdparty_build/bin/pprof
 
 NUM_CPUS=`grep -c ^processor /proc/cpuinfo`
 
+export ENVOY_SRCDIR=/source
+
 if [[ "$1" == bazel* ]]
 then
   export BUILD_DIR=/build
@@ -22,7 +24,6 @@ then
     echo "${BUILD_DIR} mount missing - did you forget -v <something>:${BUILD_DIR}?"
     exit 1
   fi
-  export ENVOY_SRCDIR=/source
   export ENVOY_CONSUMER_SRCDIR="${BUILD_DIR}/envoy-consumer"
 
   # Make sure that /source doesn't contain /build on the underlying host
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index 27cd291ebc0b4..6866b7e593ad6 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -37,7 +37,13 @@ elif [[ "$1" == "bazel.coverage" ]]; then
   exit 0
 elif [[ "$1" == "fix_format" ]]; then
   echo "fix_format..."
-  make fix_format
+  cd "${ENVOY_SRCDIR}"
+  ./tools/check_format.py fix
+  exit 0
+elif [[ "$1" == "check_format" ]]; then
+  echo "check_format..."
+  cd "${ENVOY_SRCDIR}"
+  ./tools/check_format.py check
   exit 0
 elif [[ "$1" == "coverage" ]]; then
   echo "coverage build with tests..."
diff --git a/include/envoy/event/dispatcher.h b/include/envoy/event/dispatcher.h
index 9fd02ae268d3e..ea0d1b6e4a521 100644
--- a/include/envoy/event/dispatcher.h
+++ b/include/envoy/event/dispatcher.h
@@ -5,10 +5,10 @@
 #include "envoy/event/timer.h"
 #include "envoy/filesystem/filesystem.h"
 #include "envoy/network/connection.h"
+#include "envoy/network/connection_handler.h"
 #include "envoy/network/dns.h"
-#include "envoy/network/listener.h"
 #include "envoy/network/listen_socket.h"
-#include "envoy/network/connection_handler.h"
+#include "envoy/network/listener.h"
 #include "envoy/ssl/context.h"
 #include "envoy/stats/stats.h"
 
diff --git a/include/envoy/http/conn_pool.h b/include/envoy/http/conn_pool.h
index 3b0ee2358ad3f..7f9b5bb79de20 100644
--- a/include/envoy/http/conn_pool.h
+++ b/include/envoy/http/conn_pool.h
@@ -1,8 +1,8 @@
 #pragma once
 
 #include "envoy/common/pure.h"
-#include "envoy/http/codec.h"
 #include "envoy/event/deferred_deletable.h"
+#include "envoy/http/codec.h"
 #include "envoy/upstream/upstream.h"
 
 namespace Http {
diff --git a/include/envoy/network/connection_handler.h b/include/envoy/network/connection_handler.h
index fde5d139df9fe..21c7c8da96c8d 100644
--- a/include/envoy/network/connection_handler.h
+++ b/include/envoy/network/connection_handler.h
@@ -2,8 +2,8 @@
 
 #include "envoy/network/connection.h"
 #include "envoy/network/filter.h"
-#include "envoy/network/listener.h"
 #include "envoy/network/listen_socket.h"
+#include "envoy/network/listener.h"
 #include "envoy/ssl/context.h"
 
 namespace Network {
diff --git a/source/common/access_log/access_log_manager_impl.h b/source/common/access_log/access_log_manager_impl.h
index 060d1787fd967..8d315f1098a63 100644
--- a/source/common/access_log/access_log_manager_impl.h
+++ b/source/common/access_log/access_log_manager_impl.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/api.h"
 #include "envoy/access_log/access_log.h"
+#include "envoy/api/api.h"
 
 namespace AccessLog {
 
diff --git a/source/common/common/thread.cc b/source/common/common/thread.cc
index 7a1955d8f3337..5123a7f05687c 100644
--- a/source/common/common/thread.cc
+++ b/source/common/common/thread.cc
@@ -1,10 +1,10 @@
 #include "common/common/thread.h"
 
+#include <sys/syscall.h>
+
 #include "common/common/assert.h"
 #include "common/common/macros.h"
 
-#include <sys/syscall.h>
-
 namespace Thread {
 
 Thread::Thread(std::function<void()> thread_routine) : thread_routine_(thread_routine) {
diff --git a/source/common/event/dispatcher_impl.cc b/source/common/event/dispatcher_impl.cc
index 0caa71971f9d8..9c8cd643c3669 100644
--- a/source/common/event/dispatcher_impl.cc
+++ b/source/common/event/dispatcher_impl.cc
@@ -1,7 +1,7 @@
 #include "common/event/dispatcher_impl.h"
 
-#include "envoy/network/listener.h"
 #include "envoy/network/listen_socket.h"
+#include "envoy/network/listener.h"
 
 #include "common/event/file_event_impl.h"
 #include "common/event/signal_impl.h"
diff --git a/source/common/filesystem/filesystem_impl.cc b/source/common/filesystem/filesystem_impl.cc
index d910421881712..ab20895bd8263 100644
--- a/source/common/filesystem/filesystem_impl.cc
+++ b/source/common/filesystem/filesystem_impl.cc
@@ -1,5 +1,10 @@
 #include "common/filesystem/filesystem_impl.h"
 
+#include <dirent.h>
+#include <fcntl.h>
+
+#include <iostream>
+
 #include "envoy/common/exception.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/event/timer.h"
@@ -8,10 +13,6 @@
 #include "common/common/assert.h"
 #include "common/common/thread.h"
 
-#include <dirent.h>
-#include <fcntl.h>
-#include <iostream>
-
 namespace Filesystem {
 bool fileExists(const std::string& path) {
   std::ifstream input_file(path);
diff --git a/source/common/filesystem/watcher_impl.cc b/source/common/filesystem/watcher_impl.cc
index 741df31ef66ef..a75a3747996c8 100644
--- a/source/common/filesystem/watcher_impl.cc
+++ b/source/common/filesystem/watcher_impl.cc
@@ -1,5 +1,7 @@
 #include "common/filesystem/watcher_impl.h"
 
+#include <sys/inotify.h>
+
 #include "envoy/common/exception.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/event/file_event.h"
@@ -7,8 +9,6 @@
 #include "common/common/assert.h"
 #include "common/common/utility.h"
 
-#include <sys/inotify.h>
-
 namespace Filesystem {
 
 WatcherImpl::WatcherImpl(Event::Dispatcher& dispatcher)
diff --git a/source/common/http/access_log/access_log_impl.cc b/source/common/http/access_log/access_log_impl.cc
index 05717e7bcb372..bb52f4da87f00 100644
--- a/source/common/http/access_log/access_log_impl.cc
+++ b/source/common/http/access_log/access_log_impl.cc
@@ -8,8 +8,8 @@
 #include "common/common/assert.h"
 #include "common/common/utility.h"
 #include "common/http/access_log/access_log_formatter.h"
-#include "common/http/headers.h"
 #include "common/http/header_map_impl.h"
+#include "common/http/headers.h"
 #include "common/http/utility.h"
 #include "common/json/json_loader.h"
 #include "common/runtime/uuid_util.h"
diff --git a/source/common/http/date_provider_impl.h b/source/common/http/date_provider_impl.h
index 2a07332e89c10..6f7fa95c1146d 100644
--- a/source/common/http/date_provider_impl.h
+++ b/source/common/http/date_provider_impl.h
@@ -1,12 +1,12 @@
 #pragma once
 
-#include "date_provider.h"
-
 #include "envoy/event/dispatcher.h"
 #include "envoy/thread_local/thread_local.h"
 
 #include "common/common/utility.h"
 
+#include "date_provider.h"
+
 namespace Http {
 
 /**
diff --git a/source/common/http/http1/conn_pool.cc b/source/common/http/http1/conn_pool.cc
index d4e428953221e..08ebe33b2182d 100644
--- a/source/common/http/http1/conn_pool.cc
+++ b/source/common/http/http1/conn_pool.cc
@@ -1,8 +1,8 @@
 #include "common/http/http1/conn_pool.h"
 
-#include "envoy/http/header_map.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/event/timer.h"
+#include "envoy/http/header_map.h"
 #include "envoy/stats/stats.h"
 #include "envoy/upstream/upstream.h"
 
diff --git a/source/common/network/address_impl.h b/source/common/network/address_impl.h
index a22cc53546f6f..ef3f297d27546 100644
--- a/source/common/network/address_impl.h
+++ b/source/common/network/address_impl.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "envoy/network/address.h"
-
 #include <sys/un.h>
 
+#include "envoy/network/address.h"
+
 namespace Network {
 namespace Address {
 
diff --git a/source/common/network/listener_impl.h b/source/common/network/listener_impl.h
index 03ae8c5bdaf22..82ece76bc4394 100644
--- a/source/common/network/listener_impl.h
+++ b/source/common/network/listener_impl.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/network/listener.h"
 #include "envoy/network/connection_handler.h"
+#include "envoy/network/listener.h"
 
 #include "common/event/dispatcher_impl.h"
 #include "common/event/libevent.h"
diff --git a/source/common/network/utility.cc b/source/common/network/utility.cc
index 2115a3b2498c3..b268f7b73c85a 100644
--- a/source/common/network/utility.cc
+++ b/source/common/network/utility.cc
@@ -1,5 +1,8 @@
 #include "common/network/utility.h"
 
+#include <ifaddrs.h>
+#include <linux/netfilter_ipv4.h>
+
 #include "envoy/common/exception.h"
 #include "envoy/network/connection.h"
 #include "envoy/stats/stats.h"
@@ -8,9 +11,6 @@
 #include "common/common/utility.h"
 #include "common/network/address_impl.h"
 
-#include <ifaddrs.h>
-#include <linux/netfilter_ipv4.h>
-
 namespace Network {
 
 IpList::IpList(const std::vector<std::string>& subnets) {
diff --git a/source/common/redis/conn_pool_impl.h b/source/common/redis/conn_pool_impl.h
index 19c0207b0120c..1e6269bdb83ed 100644
--- a/source/common/redis/conn_pool_impl.h
+++ b/source/common/redis/conn_pool_impl.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "envoy/upstream/cluster_manager.h"
 #include "envoy/redis/conn_pool.h"
 #include "envoy/thread_local/thread_local.h"
+#include "envoy/upstream/cluster_manager.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/json/json_validator.h"
diff --git a/source/common/router/config_utility.cc b/source/common/router/config_utility.cc
index bd77e2b9b3a9b..340e035d569b8 100644
--- a/source/common/router/config_utility.cc
+++ b/source/common/router/config_utility.cc
@@ -1,6 +1,7 @@
-#include "common/common/assert.h"
 #include "common/router/config_utility.h"
 
+#include "common/common/assert.h"
+
 namespace Router {
 
 Upstream::ResourcePriority ConfigUtility::parsePriority(const Json::Object& config) {
diff --git a/source/common/router/retry_state_impl.cc b/source/common/router/retry_state_impl.cc
index 6ba651b6f1b9d..457b42a895a7f 100644
--- a/source/common/router/retry_state_impl.cc
+++ b/source/common/router/retry_state_impl.cc
@@ -2,8 +2,8 @@
 
 #include "common/common/assert.h"
 #include "common/common/utility.h"
-#include "common/http/headers.h"
 #include "common/http/codes.h"
+#include "common/http/headers.h"
 #include "common/http/utility.h"
 
 namespace Router {
diff --git a/source/common/runtime/runtime_impl.cc b/source/common/runtime/runtime_impl.cc
index 29edf0c1f2950..a22c1a422cc8f 100644
--- a/source/common/runtime/runtime_impl.cc
+++ b/source/common/runtime/runtime_impl.cc
@@ -1,5 +1,8 @@
 #include "common/runtime/runtime_impl.h"
 
+#include <fcntl.h>
+#include <unistd.h>
+
 #include "envoy/event/dispatcher.h"
 #include "envoy/stats/stats.h"
 #include "envoy/thread_local/thread_local.h"
@@ -7,9 +10,6 @@
 #include "common/common/utility.h"
 #include "common/filesystem/filesystem_impl.h"
 
-#include <fcntl.h>
-#include <unistd.h>
-
 namespace Runtime {
 
 const size_t RandomGeneratorImpl::UUID_LENGTH = 36;
diff --git a/source/common/runtime/runtime_impl.h b/source/common/runtime/runtime_impl.h
index d01f25e2e02b7..097bfc7a5f59d 100644
--- a/source/common/runtime/runtime_impl.h
+++ b/source/common/runtime/runtime_impl.h
@@ -1,5 +1,7 @@
 #pragma once
 
+#include <dirent.h>
+
 #include "envoy/common/exception.h"
 #include "envoy/common/optional.h"
 #include "envoy/runtime/runtime.h"
@@ -10,8 +12,6 @@
 #include "common/common/logger.h"
 #include "common/common/thread.h"
 
-#include <dirent.h>
-
 namespace Runtime {
 
 /**
diff --git a/source/common/ssl/context_impl.h b/source/common/ssl/context_impl.h
index 15ba30fc01ae1..ebe3257404245 100644
--- a/source/common/ssl/context_impl.h
+++ b/source/common/ssl/context_impl.h
@@ -1,15 +1,15 @@
 #pragma once
 
-#include "common/ssl/context_impl.h"
-#include "common/ssl/context_manager_impl.h"
-#include "common/ssl/openssl.h"
-
 #include "envoy/runtime/runtime.h"
 #include "envoy/ssl/context.h"
 #include "envoy/ssl/context_config.h"
 #include "envoy/stats/stats.h"
 #include "envoy/stats/stats_macros.h"
 
+#include "common/ssl/context_impl.h"
+#include "common/ssl/context_manager_impl.h"
+#include "common/ssl/openssl.h"
+
 namespace Ssl {
 
 // clang-format off
diff --git a/source/common/ssl/context_manager_impl.cc b/source/common/ssl/context_manager_impl.cc
index caccec20accbc..7d89881f22290 100644
--- a/source/common/ssl/context_manager_impl.cc
+++ b/source/common/ssl/context_manager_impl.cc
@@ -1,8 +1,7 @@
 #include "common/ssl/context_manager_impl.h"
 
-#include "common/ssl/context_impl.h"
-
 #include "common/common/assert.h"
+#include "common/ssl/context_impl.h"
 
 namespace Ssl {
 
diff --git a/source/common/tracing/http_tracer_impl.cc b/source/common/tracing/http_tracer_impl.cc
index e526426329fdb..8577112312637 100644
--- a/source/common/tracing/http_tracer_impl.cc
+++ b/source/common/tracing/http_tracer_impl.cc
@@ -5,8 +5,8 @@
 #include "common/common/utility.h"
 #include "common/http/access_log/access_log_formatter.h"
 #include "common/http/codes.h"
-#include "common/http/headers.h"
 #include "common/http/header_map_impl.h"
+#include "common/http/headers.h"
 #include "common/http/utility.h"
 #include "common/runtime/uuid_util.h"
 
diff --git a/source/common/tracing/lightstep_tracer_impl.cc b/source/common/tracing/lightstep_tracer_impl.cc
index 082c3eafcc17c..56f9ccf20d397 100644
--- a/source/common/tracing/lightstep_tracer_impl.cc
+++ b/source/common/tracing/lightstep_tracer_impl.cc
@@ -1,9 +1,9 @@
-#include "common/tracing/http_tracer_impl.h"
 #include "common/tracing/lightstep_tracer_impl.h"
 
 #include "common/common/base64.h"
 #include "common/grpc/common.h"
 #include "common/http/message_impl.h"
+#include "common/tracing/http_tracer_impl.h"
 
 namespace Tracing {
 
diff --git a/source/common/upstream/cluster_manager_impl.cc b/source/common/upstream/cluster_manager_impl.cc
index 5d4e976df02d1..e2517e341e637 100644
--- a/source/common/upstream/cluster_manager_impl.cc
+++ b/source/common/upstream/cluster_manager_impl.cc
@@ -6,9 +6,9 @@
 
 #include "common/common/enum_to_int.h"
 #include "common/common/utility.h"
+#include "common/http/async_client_impl.h"
 #include "common/http/http1/conn_pool.h"
 #include "common/http/http2/conn_pool.h"
-#include "common/http/async_client_impl.h"
 #include "common/json/config_schemas.h"
 #include "common/router/shadow_writer_impl.h"
 #include "common/upstream/cds_api_impl.h"
diff --git a/source/exe/hot_restart.cc b/source/exe/hot_restart.cc
index ebbf21d1f341f..8f582768ebbdd 100644
--- a/source/exe/hot_restart.cc
+++ b/source/exe/hot_restart.cc
@@ -1,5 +1,8 @@
 #include "exe/hot_restart.h"
 
+#include <sys/mman.h>
+#include <sys/prctl.h>
+
 #include "envoy/event/dispatcher.h"
 #include "envoy/event/file_event.h"
 #include "envoy/server/instance.h"
@@ -7,9 +10,6 @@
 
 #include "common/common/utility.h"
 
-#include <sys/mman.h>
-#include <sys/prctl.h>
-
 namespace Server {
 
 // Increment this whenever there is a shared memory / RPC change that will prevent a hot restart
diff --git a/source/exe/hot_restart.h b/source/exe/hot_restart.h
index 418195cf0dd5a..1e059cc824cc4 100644
--- a/source/exe/hot_restart.h
+++ b/source/exe/hot_restart.h
@@ -1,14 +1,14 @@
 #pragma once
 
+#include <fcntl.h>
+#include <sys/un.h>
+
 #include "envoy/server/hot_restart.h"
 #include "envoy/server/options.h"
 
 #include "common/common/assert.h"
 #include "common/stats/stats_impl.h"
 
-#include <fcntl.h>
-#include <sys/un.h>
-
 namespace Server {
 
 /**
diff --git a/source/exe/main.cc b/source/exe/main.cc
index 61836390ee977..0458735332357 100644
--- a/source/exe/main.cc
+++ b/source/exe/main.cc
@@ -3,7 +3,9 @@
 #include "common/network/utility.h"
 #include "common/ssl/openssl.h"
 #include "common/stats/thread_local_store.h"
+
 #include "exe/hot_restart.h"
+
 #include "server/drain_manager_impl.h"
 #include "server/options_impl.h"
 #include "server/server.h"
diff --git a/source/precompiled/precompiled.h b/source/precompiled/precompiled.h
index 3d828e6fc7780..38d75b85085d4 100644
--- a/source/precompiled/precompiled.h
+++ b/source/precompiled/precompiled.h
@@ -1,8 +1,15 @@
 #pragma once
 
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <netinet/tcp.h>
+#include <signal.h>
+#include <string.h>
+#include <sys/signalfd.h>
+#include <unistd.h>
+
 #include <algorithm>
 #include <array>
-#include <arpa/inet.h>
 #include <chrono>
 #include <cmath>
 #include <condition_variable>
@@ -12,15 +19,9 @@
 #include <list>
 #include <map>
 #include <memory>
-#include <netdb.h>
-#include <netinet/tcp.h>
 #include <random>
 #include <regex>
-#include <signal.h>
 #include <sstream>
-#include <string.h>
-#include <sys/signalfd.h>
-#include <unistd.h>
 #include <unordered_set>
 
 #pragma GCC diagnostic push
diff --git a/source/server/config/network/echo.cc b/source/server/config/network/echo.cc
index 50fa6675ff8aa..57aaa46cd73a5 100644
--- a/source/server/config/network/echo.cc
+++ b/source/server/config/network/echo.cc
@@ -1,6 +1,7 @@
 #include "envoy/network/connection.h"
 
 #include "common/filter/echo.h"
+
 #include "server/configuration_impl.h"
 
 namespace Server {
diff --git a/source/server/config/network/http_connection_manager.h b/source/server/config/network/http_connection_manager.h
index 62fc63dc44962..fdb2f5ae3e5ec 100644
--- a/source/server/config/network/http_connection_manager.h
+++ b/source/server/config/network/http_connection_manager.h
@@ -7,6 +7,7 @@
 #include "common/http/conn_manager_impl.h"
 #include "common/http/date_provider_impl.h"
 #include "common/json/json_loader.h"
+
 #include "server/configuration_impl.h"
 
 namespace Server {
diff --git a/source/server/connection_handler_impl.cc b/source/server/connection_handler_impl.cc
index 4bb805e126860..01d3176e99018 100644
--- a/source/server/connection_handler_impl.cc
+++ b/source/server/connection_handler_impl.cc
@@ -4,8 +4,8 @@
 #include "envoy/event/timer.h"
 #include "envoy/network/filter.h"
 
-#include "common/network/listener_impl.h"
 #include "common/event/dispatcher_impl.h"
+#include "common/network/listener_impl.h"
 
 namespace Server {
 
diff --git a/source/server/connection_handler_impl.h b/source/server/connection_handler_impl.h
index 1e2bdff325c99..cd11baa32a8a9 100644
--- a/source/server/connection_handler_impl.h
+++ b/source/server/connection_handler_impl.h
@@ -6,8 +6,8 @@
 #include "envoy/network/connection.h"
 #include "envoy/network/connection_handler.h"
 #include "envoy/network/filter.h"
-#include "envoy/network/listener.h"
 #include "envoy/network/listen_socket.h"
+#include "envoy/network/listener.h"
 
 #include "common/common/linked_object.h"
 #include "common/common/non_copyable.h"
diff --git a/source/server/guarddog_impl.cc b/source/server/guarddog_impl.cc
index 98b0293d974e0..09cd2934f5761 100644
--- a/source/server/guarddog_impl.cc
+++ b/source/server/guarddog_impl.cc
@@ -1,5 +1,7 @@
-#include "common/common/assert.h"
 #include "server/guarddog_impl.h"
+
+#include "common/common/assert.h"
+
 #include "server/watchdog_impl.h"
 
 namespace Server {
diff --git a/source/server/http/admin.h b/source/server/http/admin.h
index ca068536703b6..d83713c4b13a7 100644
--- a/source/server/http/admin.h
+++ b/source/server/http/admin.h
@@ -10,6 +10,7 @@
 #include "common/http/conn_manager_impl.h"
 #include "common/http/date_provider_impl.h"
 #include "common/http/utility.h"
+
 #include "server/config/network/http_connection_manager.h"
 
 namespace Server {
diff --git a/source/server/server.h b/source/server/server.h
index 7c3a0a0dc2ec2..6f2d06bba116f 100644
--- a/source/server/server.h
+++ b/source/server/server.h
@@ -11,6 +11,7 @@
 #include "common/runtime/runtime_impl.h"
 #include "common/ssl/context_manager_impl.h"
 #include "common/thread_local/thread_local_impl.h"
+
 #include "server/connection_handler_impl.h"
 #include "server/http/admin.h"
 #include "server/test_hooks.h"
diff --git a/source/server/watchdog_impl.cc b/source/server/watchdog_impl.cc
index 911379b338faf..4f8f4444671a9 100644
--- a/source/server/watchdog_impl.cc
+++ b/source/server/watchdog_impl.cc
@@ -1,7 +1,9 @@
-#include "common/common/assert.h"
-#include "envoy/event/dispatcher.h"
 #include "server/watchdog_impl.h"
 
+#include "envoy/event/dispatcher.h"
+
+#include "common/common/assert.h"
+
 namespace Server {
 
 void WatchDogImpl::startWatchdog(Event::Dispatcher& dispatcher) {
diff --git a/test/common/common/base64_test.cc b/test/common/common/base64_test.cc
index 9b6d5e76a2730..e119f6843ad41 100644
--- a/test/common/common/base64_test.cc
+++ b/test/common/common/base64_test.cc
@@ -1,5 +1,4 @@
 #include "common/buffer/buffer_impl.h"
-
 #include "common/common/base64.h"
 
 TEST(Base64Test, EmptyBufferEncode) {
diff --git a/test/common/dynamo/dynamo_request_parser_test.cc b/test/common/dynamo/dynamo_request_parser_test.cc
index 7868c4b650b8e..fa4de34bff072 100644
--- a/test/common/dynamo/dynamo_request_parser_test.cc
+++ b/test/common/dynamo/dynamo_request_parser_test.cc
@@ -1,6 +1,6 @@
 #include "common/dynamo/dynamo_request_parser.h"
-#include "common/json/json_loader.h"
 #include "common/http/header_map_impl.h"
+#include "common/json/json_loader.h"
 
 #include "test/test_common/utility.h"
 
diff --git a/test/common/http/filter/ratelimit_test.cc b/test/common/http/filter/ratelimit_test.cc
index c1b9abf0de215..1dfa10dc2dc44 100644
--- a/test/common/http/filter/ratelimit_test.cc
+++ b/test/common/http/filter/ratelimit_test.cc
@@ -7,8 +7,8 @@
 #include "test/mocks/local_info/mocks.h"
 #include "test/mocks/ratelimit/mocks.h"
 #include "test/mocks/runtime/mocks.h"
-#include "test/mocks/upstream/mocks.h"
 #include "test/mocks/tracing/mocks.h"
+#include "test/mocks/upstream/mocks.h"
 #include "test/test_common/utility.h"
 
 using testing::_;
diff --git a/test/common/network/address_impl_test.cc b/test/common/network/address_impl_test.cc
index 1a40b8189198d..069d765c9dbd6 100644
--- a/test/common/network/address_impl_test.cc
+++ b/test/common/network/address_impl_test.cc
@@ -1,14 +1,15 @@
+#include <fcntl.h>
+#include <sys/un.h>
+#include <unistd.h>
+
 #include "envoy/common/exception.h"
 
 #include "common/common/utility.h"
 #include "common/network/address_impl.h"
+
 #include "test/test_common/network_utility.h"
 #include "test/test_common/utility.h"
 
-#include <sys/un.h>
-#include <unistd.h>
-#include <fcntl.h>
-
 namespace Network {
 namespace Address {
 namespace {
diff --git a/test/common/network/cidr_range_test.cc b/test/common/network/cidr_range_test.cc
index 20154057c0377..d0969f204325f 100644
--- a/test/common/network/cidr_range_test.cc
+++ b/test/common/network/cidr_range_test.cc
@@ -1,9 +1,9 @@
+#include <sys/un.h>
+
 #include "envoy/common/exception.h"
 
-#include "common/network/cidr_range.h"
 #include "common/network/address_impl.h"
-
-#include <sys/un.h>
+#include "common/network/cidr_range.h"
 
 // We are adding things into the std namespace.
 // Note that this is technically undefined behavior!
diff --git a/test/common/network/connection_impl_test.cc b/test/common/network/connection_impl_test.cc
index 836be7c2793ba..7cd3ffe839601 100644
--- a/test/common/network/connection_impl_test.cc
+++ b/test/common/network/connection_impl_test.cc
@@ -8,8 +8,8 @@
 #include "common/stats/stats_impl.h"
 
 #include "test/mocks/network/mocks.h"
-#include "test/mocks/stats/mocks.h"
 #include "test/mocks/server/mocks.h"
+#include "test/mocks/stats/mocks.h"
 
 using testing::_;
 using testing::Sequence;
diff --git a/test/common/network/dns_impl_test.cc b/test/common/network/dns_impl_test.cc
index 10f5dcb205a39..1229bc535bf02 100644
--- a/test/common/network/dns_impl_test.cc
+++ b/test/common/network/dns_impl_test.cc
@@ -1,3 +1,6 @@
+#include <arpa/nameser.h>
+#include <arpa/nameser_compat.h>
+
 #include "envoy/event/dispatcher.h"
 #include "envoy/network/dns.h"
 
@@ -11,9 +14,6 @@
 
 #include "test/mocks/network/mocks.h"
 
-#include <arpa/nameser.h>
-#include <arpa/nameser_compat.h>
-
 #include "ares.h"
 #include "ares_dns.h"
 
diff --git a/test/common/network/filter_manager_impl_test.cc b/test/common/network/filter_manager_impl_test.cc
index d43a51f0e4cf3..0452ef7de681a 100644
--- a/test/common/network/filter_manager_impl_test.cc
+++ b/test/common/network/filter_manager_impl_test.cc
@@ -1,6 +1,6 @@
 #include "common/buffer/buffer_impl.h"
-#include "common/filter/tcp_proxy.h"
 #include "common/filter/ratelimit.h"
+#include "common/filter/tcp_proxy.h"
 #include "common/network/filter_manager_impl.h"
 #include "common/stats/stats_impl.h"
 #include "common/upstream/upstream_impl.h"
diff --git a/test/common/network/listen_socket_impl_test.cc b/test/common/network/listen_socket_impl_test.cc
index b99ea21068365..e3112e784bd5c 100644
--- a/test/common/network/listen_socket_impl_test.cc
+++ b/test/common/network/listen_socket_impl_test.cc
@@ -1,7 +1,7 @@
 #include "envoy/common/exception.h"
 
-#include "common/network/utility.h"
 #include "common/network/listen_socket_impl.h"
+#include "common/network/utility.h"
 
 #include "test/test_common/network_utility.h"
 
diff --git a/test/common/network/listener_impl_test.cc b/test/common/network/listener_impl_test.cc
index d6b209ec88139..5c39080bc59ae 100644
--- a/test/common/network/listener_impl_test.cc
+++ b/test/common/network/listener_impl_test.cc
@@ -1,5 +1,5 @@
-#include "common/network/listener_impl.h"
 #include "common/network/address_impl.h"
+#include "common/network/listener_impl.h"
 #include "common/network/utility.h"
 #include "common/stats/stats_impl.h"
 
diff --git a/test/common/redis/codec_impl_test.cc b/test/common/redis/codec_impl_test.cc
index 0e835aeaac609..4c2d986f86ede 100644
--- a/test/common/redis/codec_impl_test.cc
+++ b/test/common/redis/codec_impl_test.cc
@@ -1,7 +1,6 @@
-#include "common/redis/codec_impl.h"
-
 #include "common/buffer/buffer_impl.h"
 #include "common/common/assert.h"
+#include "common/redis/codec_impl.h"
 
 #include "test/mocks/redis/mocks.h"
 #include "test/test_common/utility.h"
diff --git a/test/common/ssl/connection_impl_test.cc b/test/common/ssl/connection_impl_test.cc
index d3291ea68bca0..face9e9b368b3 100644
--- a/test/common/ssl/connection_impl_test.cc
+++ b/test/common/ssl/connection_impl_test.cc
@@ -1,10 +1,9 @@
-#include "common/ssl/connection_impl.h"
-
 #include "common/buffer/buffer_impl.h"
 #include "common/event/dispatcher_impl.h"
 #include "common/json/json_loader.h"
 #include "common/network/listen_socket_impl.h"
 #include "common/network/utility.h"
+#include "common/ssl/connection_impl.h"
 #include "common/ssl/context_config_impl.h"
 #include "common/ssl/context_impl.h"
 #include "common/stats/stats_impl.h"
diff --git a/test/common/ssl/context_impl_test.cc b/test/common/ssl/context_impl_test.cc
index b2907a88b6802..d7057781ec08a 100644
--- a/test/common/ssl/context_impl_test.cc
+++ b/test/common/ssl/context_impl_test.cc
@@ -1,7 +1,6 @@
-#include "common/ssl/context_impl.h"
-
 #include "common/json/json_loader.h"
 #include "common/ssl/context_config_impl.h"
+#include "common/ssl/context_impl.h"
 #include "common/stats/stats_impl.h"
 
 #include "test/common/ssl/ssl_certs_test.h"
diff --git a/test/common/tracing/http_tracer_impl_test.cc b/test/common/tracing/http_tracer_impl_test.cc
index df18f9f524e62..5c92ff90f9902 100644
--- a/test/common/tracing/http_tracer_impl_test.cc
+++ b/test/common/tracing/http_tracer_impl_test.cc
@@ -1,6 +1,6 @@
 #include "common/common/base64.h"
-#include "common/http/headers.h"
 #include "common/http/header_map_impl.h"
+#include "common/http/headers.h"
 #include "common/http/message_impl.h"
 #include "common/runtime/runtime_impl.h"
 #include "common/runtime/uuid_util.h"
diff --git a/test/common/tracing/lightstep_tracer_impl_test.cc b/test/common/tracing/lightstep_tracer_impl_test.cc
index ec66c00524ceb..83dc724ceac16 100644
--- a/test/common/tracing/lightstep_tracer_impl_test.cc
+++ b/test/common/tracing/lightstep_tracer_impl_test.cc
@@ -1,6 +1,6 @@
 #include "common/common/base64.h"
-#include "common/http/headers.h"
 #include "common/http/header_map_impl.h"
+#include "common/http/headers.h"
 #include "common/http/message_impl.h"
 #include "common/runtime/runtime_impl.h"
 #include "common/runtime/uuid_util.h"
diff --git a/test/common/upstream/ring_hash_lb_test.cc b/test/common/upstream/ring_hash_lb_test.cc
index eeda99f89de14..633b819c3a2ef 100644
--- a/test/common/upstream/ring_hash_lb_test.cc
+++ b/test/common/upstream/ring_hash_lb_test.cc
@@ -1,6 +1,6 @@
 #include "common/network/utility.h"
-#include "common/upstream/upstream_impl.h"
 #include "common/upstream/ring_hash_lb.h"
+#include "common/upstream/upstream_impl.h"
 
 #include "test/mocks/runtime/mocks.h"
 #include "test/mocks/upstream/mocks.h"
diff --git a/test/integration/fake_upstream.h b/test/integration/fake_upstream.h
index 59030afc59fd0..5c7f7a51cb4c4 100644
--- a/test/integration/fake_upstream.h
+++ b/test/integration/fake_upstream.h
@@ -10,6 +10,7 @@
 #include "common/network/filter_impl.h"
 #include "common/network/listen_socket_impl.h"
 #include "common/stats/stats_impl.h"
+
 #include "server/connection_handler_impl.h"
 
 #include "test/test_common/utility.h"
diff --git a/test/integration/proxy_proto_integration_test.h b/test/integration/proxy_proto_integration_test.h
index 851aea175d6be..8e77ae30bea29 100644
--- a/test/integration/proxy_proto_integration_test.h
+++ b/test/integration/proxy_proto_integration_test.h
@@ -1,12 +1,12 @@
 #pragma once
 
+#include "common/http/codec_client.h"
+#include "common/stats/stats_impl.h"
+
 #include "test/integration/fake_upstream.h"
 #include "test/integration/integration.h"
 #include "test/integration/server.h"
 
-#include "common/http/codec_client.h"
-#include "common/stats/stats_impl.h"
-
 class ProxyProtoIntegrationTest : public BaseIntegrationTest, public testing::Test {
 public:
   /**
diff --git a/test/integration/server.h b/test/integration/server.h
index 62f8508b67f09..d256f002fe681 100644
--- a/test/integration/server.h
+++ b/test/integration/server.h
@@ -6,6 +6,7 @@
 #include "common/common/logger.h"
 #include "common/common/thread.h"
 #include "common/stats/stats_impl.h"
+
 #include "server/server.h"
 #include "server/test_hooks.h"
 
diff --git a/test/integration/ssl_integration_test.cc b/test/integration/ssl_integration_test.cc
index 9483962733227..5bf7ceddfea31 100644
--- a/test/integration/ssl_integration_test.cc
+++ b/test/integration/ssl_integration_test.cc
@@ -1,13 +1,13 @@
 #include "ssl_integration_test.h"
 
-#include "integration.h"
-#include "utility.h"
-
 #include "common/event/dispatcher_impl.h"
 #include "common/network/utility.h"
 #include "common/ssl/context_config_impl.h"
 #include "common/ssl/context_manager_impl.h"
 
+#include "integration.h"
+#include "utility.h"
+
 using testing::Return;
 
 namespace Ssl {
diff --git a/test/integration/ssl_integration_test.h b/test/integration/ssl_integration_test.h
index 96b0f4b09c161..16eed80c05545 100644
--- a/test/integration/ssl_integration_test.h
+++ b/test/integration/ssl_integration_test.h
@@ -2,7 +2,6 @@
 
 #include "test/integration/integration.h"
 #include "test/integration/server.h"
-
 #include "test/mocks/runtime/mocks.h"
 
 using testing::NiceMock;
diff --git a/test/integration/uds_integration_test.h b/test/integration/uds_integration_test.h
index 68b18f86fbc41..cfbb87fd596c0 100644
--- a/test/integration/uds_integration_test.h
+++ b/test/integration/uds_integration_test.h
@@ -1,13 +1,13 @@
 #pragma once
 
+#include "common/http/codec_client.h"
+#include "common/stats/stats_impl.h"
+
 #include "test/integration/fake_upstream.h"
 #include "test/integration/integration.h"
 #include "test/integration/server.h"
 #include "test/test_common/environment.h"
 
-#include "common/http/codec_client.h"
-#include "common/stats/stats_impl.h"
-
 class UdsIntegrationTest : public BaseIntegrationTest, public testing::Test {
 public:
   /**
diff --git a/test/main.cc b/test/main.cc
index d9698110359ff..33e6e08121d02 100644
--- a/test/main.cc
+++ b/test/main.cc
@@ -3,11 +3,11 @@
 #include "common/event/libevent.h"
 #include "common/ssl/openssl.h"
 
+#include "test/test_common/environment.h"
+
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 
-#include "test/test_common/environment.h"
-
 int main(int argc, char** argv) {
   ::testing::InitGoogleMock(&argc, argv);
   Ssl::OpenSsl::initialize();
diff --git a/test/mocks/api/mocks.h b/test/mocks/api/mocks.h
index 3a8f3b8e4de2d..0834b322ab946 100644
--- a/test/mocks/api/mocks.h
+++ b/test/mocks/api/mocks.h
@@ -2,6 +2,7 @@
 
 #include "envoy/api/api.h"
 #include "envoy/event/dispatcher.h"
+
 #include "test/mocks/filesystem/mocks.h"
 
 namespace Api {
diff --git a/test/mocks/event/mocks.h b/test/mocks/event/mocks.h
index 3f517aa8e742d..db74fb699db9b 100644
--- a/test/mocks/event/mocks.h
+++ b/test/mocks/event/mocks.h
@@ -6,10 +6,10 @@
 #include "envoy/event/signal.h"
 #include "envoy/event/timer.h"
 #include "envoy/network/connection.h"
+#include "envoy/network/connection_handler.h"
 #include "envoy/network/dns.h"
 #include "envoy/network/listener.h"
 #include "envoy/ssl/context.h"
-#include "envoy/network/connection_handler.h"
 
 namespace Event {
 
diff --git a/test/mocks/upstream/host.h b/test/mocks/upstream/host.h
index 90781c57625e1..f674bf717cfe7 100644
--- a/test/mocks/upstream/host.h
+++ b/test/mocks/upstream/host.h
@@ -1,11 +1,11 @@
 #pragma once
 
-#include "test/mocks/upstream/cluster_info.h"
-
 #include "envoy/upstream/upstream.h"
 
 #include "common/stats/stats_impl.h"
 
+#include "test/mocks/upstream/cluster_info.h"
+
 namespace Upstream {
 namespace Outlier {
 
diff --git a/test/mocks/upstream/mocks.h b/test/mocks/upstream/mocks.h
index 8b9e026a3ab63..30945b29d1a84 100644
--- a/test/mocks/upstream/mocks.h
+++ b/test/mocks/upstream/mocks.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include "cluster_info.h"
-
 #include "envoy/http/async_client.h"
 #include "envoy/upstream/cluster_manager.h"
 #include "envoy/upstream/health_checker.h"
@@ -13,6 +11,8 @@
 #include "test/mocks/runtime/mocks.h"
 #include "test/mocks/stats/mocks.h"
 
+#include "cluster_info.h"
+
 using testing::NiceMock;
 
 namespace Upstream {
diff --git a/test/server/config/network/http_connection_manager_test.cc b/test/server/config/network/http_connection_manager_test.cc
index 31185f4521559..65ab210244957 100644
--- a/test/server/config/network/http_connection_manager_test.cc
+++ b/test/server/config/network/http_connection_manager_test.cc
@@ -1,7 +1,7 @@
-#include "server/config/network/http_connection_manager.h"
-
 #include "common/buffer/buffer_impl.h"
 
+#include "server/config/network/http_connection_manager.h"
+
 #include "test/mocks/network/mocks.h"
 
 using testing::Return;
diff --git a/test/server/http/admin_test.cc b/test/server/http/admin_test.cc
index e52e9e612bffa..05b10513b2b92 100644
--- a/test/server/http/admin_test.cc
+++ b/test/server/http/admin_test.cc
@@ -1,5 +1,6 @@
 #include "common/http/message_impl.h"
 #include "common/profiler/profiler.h"
+
 #include "server/http/admin.h"
 
 #include "test/mocks/server/mocks.h"
diff --git a/test/server/http/health_check_test.cc b/test/server/http/health_check_test.cc
index 43bcea213fd24..e5082d47d7d3c 100644
--- a/test/server/http/health_check_test.cc
+++ b/test/server/http/health_check_test.cc
@@ -1,4 +1,5 @@
 #include "common/buffer/buffer_impl.h"
+
 #include "server/http/health_check.h"
 
 #include "test/mocks/server/mocks.h"
diff --git a/test/server/options_impl_test.cc b/test/server/options_impl_test.cc
index d8a3f7e211f60..2d7ad481fa138 100644
--- a/test/server/options_impl_test.cc
+++ b/test/server/options_impl_test.cc
@@ -1,4 +1,5 @@
 #include "common/common/utility.h"
+
 #include "server/options_impl.h"
 
 // Do the ugly work of turning a std::string into a char** and create an OptionsImpl. Args are
diff --git a/test/test_common/network_utility.cc b/test/test_common/network_utility.cc
index 3fb54b849605b..70d129684e23a 100644
--- a/test/test_common/network_utility.cc
+++ b/test/test_common/network_utility.cc
@@ -4,6 +4,7 @@
 #include "common/network/address_impl.h"
 #include "common/network/utility.h"
 #include "common/runtime/runtime_impl.h"
+
 #include "test/test_common/utility.h"
 
 namespace Network {
diff --git a/test/test_common/utility.cc b/test/test_common/utility.cc
index 88531c43027b1..60cb6d4bc602b 100644
--- a/test/test_common/utility.cc
+++ b/test/test_common/utility.cc
@@ -1,12 +1,12 @@
 #include "utility.h"
 
+#include <dirent.h>
+
 #include "envoy/buffer/buffer.h"
 
 #include "common/common/empty_string.h"
 #include "common/network/address_impl.h"
 
-#include <dirent.h>
-
 bool TestUtility::buffersEqual(const Buffer::Instance& lhs, const Buffer::Instance& rhs) {
   if (lhs.length() != rhs.length()) {
     return false;
diff --git a/tools/check_format.py b/tools/check_format.py
index 0f38020c2ba3c..fdae7b7e3f66c 100755
--- a/tools/check_format.py
+++ b/tools/check_format.py
@@ -4,43 +4,53 @@
 import os.path
 import sys
 
-EXCLUDED_PREFIXES = ("./generated/", "./thirdparty/", "./build", "./.git/", "./bazel-")
+EXCLUDED_PREFIXES = ("./generated/", "./thirdparty/", "./build", "./.git/",
+                     "./bazel-", "./test/precompiled/")
 SUFFIXES = (".cc", ".h", "BUILD")
 
-if len(sys.argv) != 5:
-  print("usage: check_format.py <directory|file> <clang_format_path> <buildifier_path> <check|fix>")
-  sys.exit(1)
-
-target_path = sys.argv[1]
-clang_format_path = sys.argv[2]
-buildifier_path = sys.argv[3]
-operation_type = sys.argv[4]
+CLANG_FORMAT_PATH = os.getenv("CLANG-FORMAT", "clang-format-3.6")
+BUILDIFIER_PATH = os.getenv("BUILDIFIER", "/usr/lib/go/bin/buildifier")
+HEADER_ORDER_PATH = os.path.join(
+    os.path.dirname(os.path.abspath(sys.argv[0])), "header_order.py")
 
 found_error = False
+
+
 def printError(error):
   global found_error
   found_error = True
   print "ERROR: %s" % (error)
 
+
 def checkFilePath(file_path):
-  if os.path.basename(file_path) == 'BUILD':
+  if os.path.basename(file_path) == "BUILD":
     if os.system("cat %s | %s -mode=fix | diff -q %s - > /dev/null" %
-                 (file_path, buildifier_path, file_path)) != 0:
+                 (file_path, BUILDIFIER_PATH, file_path)) != 0:
       printError("buildifier check failed for file: %s" % (file_path))
     return
-  command = ("%s %s | diff -q %s - > /dev/null" % (clang_format_path, file_path, file_path))
+  command = ("%s %s | diff -q %s - > /dev/null" % (HEADER_ORDER_PATH, file_path,
+                                                   file_path))
+  if os.system(command) != 0:
+    printError("header_order.py check failed for file: %s" % (file_path))
+  command = ("%s %s | diff -q %s - > /dev/null" % (CLANG_FORMAT_PATH, file_path,
+                                                   file_path))
   if os.system(command) != 0:
     printError("clang-format check failed for file: %s" % (file_path))
 
+
 def fixFilePath(file_path):
-  if os.path.basename(file_path) == 'BUILD':
-    if os.system("%s -mode=fix %s" % (buildifier_path, file_path)) != 0:
+  if os.path.basename(file_path) == "BUILD":
+    if os.system("%s -mode=fix %s" % (BUILDIFIER_PATH, file_path)) != 0:
       printError("buildifier rewrite failed for file: %s" % (file_path))
     return
-  command = "%s -i %s" % (clang_format_path, file_path)
+  command = "%s --rewrite %s" % (HEADER_ORDER_PATH, file_path)
+  if os.system(command) != 0:
+    printError("header_order.py rewrite error: %s" % (file_path))
+  command = "%s -i %s" % (CLANG_FORMAT_PATH, file_path)
   if os.system(command) != 0:
     printError("clang-format rewrite error: %s" % (file_path))
 
+
 def checkFormat(file_path):
   if file_path.startswith(EXCLUDED_PREFIXES):
     return
@@ -54,16 +64,26 @@ def checkFormat(file_path):
   if operation_type == "fix":
     fixFilePath(file_path)
 
+
 def checkFormatVisitor(arg, dir_name, names):
   for file_name in names:
-    checkFormat(dir_name + '/' + file_name)
+    checkFormat(dir_name + "/" + file_name)
+
+
+if __name__ == "__main__":
+  if len(sys.argv) != 2 and len(sys.argv) != 3:
+    print("usage: check_format.py <check|fix> [<directory|file>]")
+    sys.exit(1)
+
+  operation_type = sys.argv[1]
+  target_path = sys.argv[2] if len(sys.argv) == 3 else "."
 
-if os.path.isfile(target_path):
-  checkFormat("./" + target_path)
-else:
-  os.chdir(sys.argv[1])
-  os.path.walk(".", checkFormatVisitor, None)
+  if os.path.isfile(target_path):
+    checkFormat("./" + target_path)
+  else:
+    os.chdir(target_path)
+    os.path.walk(".", checkFormatVisitor, None)
 
-if found_error:
-  print "ERROR: check format failed. run 'make fix_format'"
-  sys.exit(1)
+  if found_error:
+    print "ERROR: check format failed. run 'tools/check_format.py fix'"
+    sys.exit(1)
diff --git a/tools/header_order.py b/tools/header_order.py
new file mode 100755
index 0000000000000..a49cf3153633c
--- /dev/null
+++ b/tools/header_order.py
@@ -0,0 +1,118 @@
+#!/usr/bin/env python
+
+# Enforce header order in a a given file. This will only reorder in the first sequence of contiguous
+# #include statements, so it will not play well with #ifdef.
+#
+# This attempts to enforce the guidelines at
+# https://google.github.io/styleguide/cppguide.html#Names_and_Order_of_Includes
+# with some allowances for Envoy-specific idioms.
+#
+# There is considerable overlap with what this does and clang-format's IncludeCategories (see
+# https://clang.llvm.org/docs/ClangFormatStyleOptions.html). But, clang-format doesn't seem smart
+# enough to handle block splitting and correctly detecting the main header subject to the Envoy
+# canonical paths.
+
+import re
+import sys
+
+
+def ReorderHeaders(path):
+  with open(path, 'r') as f:
+    source = f.read()
+
+  all_lines = iter(source.split('\n'))
+  before_includes_lines = []
+  includes_lines = []
+  after_includes_lines = []
+
+  # Collect all the lines prior to the first #include in before_includes_lines.
+  try:
+    while True:
+      line = all_lines.next()
+      if line.startswith('#include'):
+        includes_lines.append(line)
+        break
+      before_includes_lines.append(line)
+  except StopIteration:
+    pass
+
+  # Collect all the #include and whitespace lines in includes_lines.
+  try:
+    while True:
+      line = all_lines.next()
+      if not line:
+        continue
+      if not line.startswith('#include'):
+        after_includes_lines.append(line)
+        break
+      includes_lines.append(line)
+  except StopIteration:
+    pass
+
+  # Collect the remaining lines in after_includes_lines.
+  after_includes_lines += list(all_lines)
+
+  # Filter for includes that finds the #include of the header file associated with the source file
+  # being processed. E.g. if 'path' is source/common/common/hex.cc, this filter matches
+  # "common/common/hex.h".
+  def file_header_filter():
+    return lambda f: f.endswith('.h"') and path.endswith(f[1:-3] + '.cc')
+
+  def regex_filter(regex):
+    return lambda f: re.match(regex, f)
+
+  # Filters that define the #include blocks
+  block_filters = [
+      file_header_filter(),
+      regex_filter('<.*\.h>'),
+      regex_filter('<.*>'),
+      regex_filter('"envoy/.*"'),
+      regex_filter('"common/.*"'),
+      regex_filter('"exe/.*"'),
+      regex_filter('"server/.*"'),
+      regex_filter('"test/.*"'),
+  ]
+
+  blocks = []
+  already_included = set([])
+  for b in block_filters:
+    block = []
+    for line in includes_lines:
+      header = line[len('#include '):]
+      if line not in already_included and b(header):
+        block.append(line)
+        already_included.add(line)
+    if len(block) > 0:
+      blocks.append(block)
+
+  # Anything not covered by block_filters gets its own block.
+  misc_headers = list(set(includes_lines).difference(already_included))
+  if len(misc_headers) > 0:
+    blocks.append(misc_headers)
+
+  reordered_includes_lines = '\n\n'.join(
+      ['\n'.join(sorted(block)) for block in blocks])
+
+  if reordered_includes_lines:
+    reordered_includes_lines += '\n'
+
+  return '\n'.join(
+      filter(lambda x: x, [
+          '\n'.join(before_includes_lines),
+          reordered_includes_lines,
+          '\n'.join(after_includes_lines),
+      ]))
+
+
+if __name__ == '__main__':
+  if len(sys.argv) == 2:
+    sys.stdout.write(ReorderHeaders(sys.argv[1]))
+    sys.exit(0)
+  elif len(sys.argv) == 3 and sys.argv[1] == '--rewrite':
+    path = sys.argv[2]
+    reorderd_source = ReorderHeaders(path)
+    with open(path, 'w') as f:
+      f.write(reorderd_source)
+    sys.exit(0)
+  print 'Usage: %s [--rewrite] <source file path>' % sys.argv[0]
+  sys.exit(1)