Upgrade the WASM .wat files to match the new version of WAVM we are using.

CODEOWNERS

@@ -20,3 +20,5 @@
 /*/extensions/tracers/datadog @cgilmour @palazzem
 # mysql_proxy extension
 /*/extensions/filters/network/mysql_proxy @rshriram @venilnoronha @mattklein123
+# quic extension
+/*/extensions/quic_listeners/ @alyssawilk @danzh2010 @mattklein123 @mpwarres @wu-bin

WASM.md

@@ -0,0 +1,23 @@
+Proof of Concept WebAssembly Support.
+
+# WebAssembly VM
+
+The WebAssembly VM is https://github.com/WAVM/WAVM. This VM was chosen for the
+proof of concept because:
+
+  - It is OSS with a permissive license.
+  - It compiles with LLVM for high performance.
+  - It can attach pre-compiled code to the WASM files (e.g. during distribution
+      from a central controller) for faster startup and reduced load on a pool
+      of proxies.
+
+# TODO
+
+  - Check if the thread is running in the VM in the WAVM Runtime signal handlers and
+    if not call the underlying signal handler from Envoy or add the WAVM signal handler
+    as a pre-check to the Envoy signal handler with the same check.
+  - Add support to WAVM for multple stacks for coroutines/streams with thread shared state.
+    - evaluate async emscripten: https://github.com/kripken/emscripten/wiki/Asyncify
+    - evaulate boost::fiber, GNU Pth, getcontext(), setcontext(), swapcontext().
+  - Add support for shared global state.
+  - Intercept logging messages from WAVM and send to Envoy logs.

api/bazel/repositories.bzl

@@ -7,8 +7,8 @@ GOGOPROTO_SHA256 = "957c8f03cf595525d2a667035d9865a0930b3d446be0ab6eb76972934f92
 OPENCENSUS_RELEASE = "0.1.0"
 OPENCENSUS_SHA256 = "4fd21cc6de63d7cb979fd749d8101ff425905aa0826fed26019d1c311fcf19a7"
 
-PGV_RELEASE = "0.0.12"
-PGV_SHA256 = "3be735345d1953d6d4c1cb89ace739cd6c98873d08b11218e181b0d3b0441627"
+PGV_RELEASE = "0.0.13"
+PGV_SHA256 = "dce6c8a43849d2abe4d5e40f16e9a476bca6b7a47e128db4458a52d748f4a5eb"
 
 GOOGLEAPIS_GIT_SHA = "d642131a6e6582fc226caf9893cb7fe7885b3411"  # May 23, 2018
 GOOGLEAPIS_SHA = "16f5b2e8bf1e747a32f9a62e211f8f33c94645492e9bbd72458061d9a9de1f63"

api/docs/BUILD

@@ -33,6 +33,7 @@ proto_library(
         "//envoy/config/accesslog/v2:als",
         "//envoy/config/accesslog/v2:file",
         "//envoy/config/bootstrap/v2:bootstrap",
+        "//envoy/config/common/tap/v2alpha:common",
         "//envoy/config/filter/accesslog/v2:accesslog",
         "//envoy/config/filter/http/buffer/v2:buffer",
         "//envoy/config/filter/http/ext_authz/v2:ext_authz",

api/envoy/config/accesslog/v2/BUILD

@@ -14,3 +14,11 @@ api_proto_library_internal(
     name = "file",
     srcs = ["file.proto"],
 )
+
+api_proto_library_internal(
+    name = "wasm",
+    srcs = ["wasm.proto"],
+    deps = [
+        "//envoy/config/wasm/v2:wasm",
+    ],
+)

api/envoy/config/accesslog/v2/wasm.proto

@@ -0,0 +1,24 @@
+syntax = "proto3";
+
+package envoy.config.accesslog.v2;
+option java_package = "io.envoyproxy.envoy.config.accesslog.v2";
+option go_package = "v2";
+
+import "validate/validate.proto";
+import "google/protobuf/struct.proto";
+import "envoy/config/wasm/v2/wasm.proto";
+
+// [#protodoc-title: Wasm access log]
+
+// Custom configuration for an :ref:`AccessLog <envoy_api_msg_config.filter.accesslog.v2.AccessLog>`
+// that calls into a WASM VM. Configures the built-in *envoy.wasm_access_log*
+// AccessLog.
+message WasmAccessLog {
+  // A unique ID so that multiple filters/services can call into the same VM.
+  string id = 1;
+  //  Wasm configuration string e.g. a serialized protobuf which will be the argument to the
+  // VM configure() call.
+  string configuration = 2;
+  // Configuration for starting a new VM to be associated with the given vm_id.
+  envoy.config.wasm.v2.VmConfig vm_config = 3;
+}

api/envoy/config/bootstrap/v2/BUILD

@@ -18,6 +18,7 @@ api_proto_library_internal(
         "//envoy/config/overload/v2alpha:overload",
         "//envoy/config/ratelimit/v2:rls",
         "//envoy/config/trace/v2:trace",
+        "//envoy/config/wasm/v2:wasm",
     ],
 )
 
@@ -36,5 +37,6 @@ api_go_proto_library(
         "//envoy/config/overload/v2alpha:overload_go_proto",
         "//envoy/config/ratelimit/v2:rls_go_grpc",
         "//envoy/config/trace/v2:trace_go_proto",
+        "//envoy/config/wasm/v2:wasm_go_proto",
     ],
 )

api/envoy/config/bootstrap/v2/bootstrap.proto

@@ -19,6 +19,7 @@ import "envoy/config/trace/v2/trace.proto";
 import "envoy/config/metrics/v2/stats.proto";
 import "envoy/config/overload/v2alpha/overload.proto";
 import "envoy/config/ratelimit/v2/rls.proto";
+import "envoy/config/wasm/v2/wasm.proto";
 
 import "google/protobuf/duration.proto";
 
@@ -119,6 +120,9 @@ message Bootstrap {
 
   // Optional overload manager configuration.
   envoy.config.overload.v2alpha.OverloadManager overload_manager = 15;
+
+  // Configuration for an wasm service provider(s).
+  repeated envoy.config.wasm.v2.WasmConfig wasm_service = 16;
 }
 
 // Administration interface :ref:`operations documentation

api/envoy/config/common/tap/v2alpha/BUILD

@@ -0,0 +1,12 @@
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_library_internal(
+    name = "common",
+    srcs = ["common.proto"],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//envoy/service/tap/v2alpha:common",
+    ],
+)

api/envoy/config/common/tap/v2alpha/common.proto

@@ -0,0 +1,32 @@
+syntax = "proto3";
+
+import "envoy/service/tap/v2alpha/common.proto";
+
+import "validate/validate.proto";
+
+package envoy.config.common.tap.v2alpha;
+option java_package = "io.envoyproxy.envoy.service.tap.v2alpha";
+
+// [#protodoc-title: Common tap extension configuration]
+
+// Common configuration for all tap extensions.
+message CommonExtensionConfig {
+  oneof config_type {
+    option (validate.required) = true;
+
+    // If specified, the tap filter will be configured via an admin handler.
+    AdminConfig admin_config = 1;
+
+    // If specified, the tap filter will be configured via a static configuration that cannot be
+    // changed.
+    service.tap.v2alpha.TapConfig static_config = 2;
+  }
+}
+
+// Configuration for the admin handler. See :ref:`here <config_http_filters_tap_admin_handler>` for
+// more information.
+message AdminConfig {
+  // Opaque configuration ID. When requests are made to the admin handler, the passed opaque ID is
+  // matched to the configured filter opaque ID to determine which filter to configure.
+  string config_id = 1 [(validate.rules).string.min_bytes = 1];
+}

api/envoy/config/filter/http/tap/v2alpha/BUILD

@@ -6,6 +6,6 @@ api_proto_library_internal(
     name = "tap",
     srcs = ["tap.proto"],
     deps = [
-        "//envoy/service/tap/v2alpha:common",
+        "//envoy/config/common/tap/v2alpha:common",
     ],
 )

api/envoy/config/filter/http/tap/v2alpha/tap.proto

@@ -1,6 +1,6 @@
 syntax = "proto3";
 
-import "envoy/service/tap/v2alpha/common.proto";
+import "envoy/config/common/tap/v2alpha/common.proto";
 
 import "validate/validate.proto";
 
@@ -12,18 +12,7 @@ option java_package = "io.envoyproxy.envoy.config.filter.http.tap.v2alpha";
 
 // Top level configuration for the tap filter.
 message Tap {
-  oneof config_type {
-    option (validate.required) = true;
-
-    // If specified, the tap filter will be configured via an admin handler.
-    AdminConfig admin_config = 1;
-  }
-}
-
-// Configuration for the admin handler. See :ref:`here <config_http_filters_tap_admin_handler>` for
-// more information.
-message AdminConfig {
-  // Opaque configuration ID. When requests are made to the admin handler, the passed opaque ID is
-  // matched to the configured filter opaque ID to determine which filter to configure.
-  string config_id = 1 [(validate.rules).string.min_bytes = 1];
+  // Common configuration for the HTTP tap filter.
+  common.tap.v2alpha.CommonExtensionConfig common_config = 1
+      [(validate.rules).message.required = true];
 }

api/envoy/config/filter/http/wasm/v2/BUILD

@@ -0,0 +1,11 @@
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_library_internal(
+    name = "wasm",
+    srcs = ["wasm.proto"],
+    deps = [
+        "//envoy/config/wasm/v2:wasm",
+    ],
+)

api/envoy/config/filter/http/wasm/v2/wasm.proto

@@ -0,0 +1,20 @@
+syntax = "proto3";
+
+package envoy.config.filter.http.wasm.v2;
+option java_package = "io.envoyproxy.envoy.config.filter.http.wasm.v2";
+option go_package = "v2";
+import "validate/validate.proto";
+import "envoy/config/wasm/v2/wasm.proto";
+
+// [#protodoc-title: Wasm]
+// Wasm :ref:`configuration overview <config_http_filters_wasm>`.
+
+message Wasm {
+  // A unique ID so that multiple filters/services can call into the same VM.
+  string id = 1;
+  // Configuration for starting a new VM (optionally associated with the given 'id').
+  envoy.config.wasm.v2.VmConfig vm_config = 2;
+  // Wasm service configuration string e.g. a serialized protobuf which will be the
+  // argument to the VM configure() call.
+  string configuration = 3;
+}

api/envoy/config/transport_socket/tap/v2alpha/BUILD

@@ -7,5 +7,6 @@ api_proto_library_internal(
     srcs = ["tap.proto"],
     deps = [
         "//envoy/api/v2/core:base",
+        "//envoy/config/common/tap/v2alpha:common",
     ],
 )

api/envoy/config/transport_socket/tap/v2alpha/tap.proto

@@ -6,41 +6,18 @@ option go_package = "v2";
 
 // [#protodoc-title: Tap]
 
+import "envoy/config/common/tap/v2alpha/common.proto";
 import "envoy/api/v2/core/base.proto";
 
-// File sink.
-//
-// .. warning::
-//
-//   The current file sink implementation buffers the entire trace in memory
-//   prior to writing. This will OOM for long lived sockets and/or where there
-//   is a large amount of traffic on the socket.
-message FileSink {
-  // Path prefix. The output file will be of the form <path_prefix>_<id>.pb, where <id> is an
-  // identifier distinguishing the recorded trace for individual socket instances (the Envoy
-  // connection ID).
-  string path_prefix = 1;
-
-  // File format.
-  enum Format {
-    // Binary proto format as per :ref:`Trace
-    // <envoy_api_msg_data.tap.v2alpha.Trace>`.
-    PROTO_BINARY = 0;
-    // Text proto format as per :ref:`Trace
-    // <envoy_api_msg_data.tap.v2alpha.Trace>`.
-    PROTO_TEXT = 1;
-  }
-  Format format = 2;
-}
+import "validate/validate.proto";
 
 // Configuration for tap transport socket. This wraps another transport socket, providing the
 // ability to interpose and record in plain text any traffic that is surfaced to Envoy.
 message Tap {
-  oneof sink_selector {
-    // Trace is to be written to a file sink.
-    FileSink file_sink = 1;
-  }
+  // Common configuration for the tap transport socket.
+  common.tap.v2alpha.CommonExtensionConfig common_config = 1
+      [(validate.rules).message.required = true];
 
   // The underlying transport socket being wrapped.
-  api.v2.core.TransportSocket transport_socket = 2;
+  api.v2.core.TransportSocket transport_socket = 2 [(validate.rules).message.required = true];
 }

api/envoy/config/wasm/v2/BUILD

@@ -0,0 +1,22 @@
+load("//bazel:api_build_system.bzl", "api_go_grpc_library", "api_go_proto_library", "api_proto_library_internal")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_library_internal(
+    name = "wasm",
+    srcs = ["wasm.proto"],
+    visibility = [
+        "//envoy/config/accesslog/v2:__pkg__",
+        "//envoy/config/bootstrap/v2:__pkg__",
+        "//envoy/config/filter/http/wasm/v2:__pkg__",
+        "//source/extensions/wasm:__pkg__",
+    ],
+    deps = [
+        "//envoy/api/v2/core:base",
+    ],
+)
+
+api_go_proto_library(
+    name = "wasm",
+    proto = ":wasm",
+)

api/envoy/config/wasm/v2/wasm.proto

@@ -0,0 +1,37 @@
+syntax = "proto3";
+
+// [#protodoc-title: Metrics service]
+
+package envoy.config.wasm.v2;
+option java_package = "io.envoyproxy.envoy.config.wasm.v2";
+
+import "envoy/api/v2/core/base.proto";
+
+import "validate/validate.proto";
+
+message VmConfig {
+  // The Wasm VM type (see source/extensions/commmon/wasm/well_known_names.h).
+  string vm = 1;
+  // The Wasm code that Envoy will execute.
+  envoy.api.v2.core.DataSource code = 2;
+  // The Wasm configuration string used on initialization of a new VM.
+  string initial_configuration = 3;
+  // Allow the wasm_file to include pre-compiled code.
+  bool allow_precompiled = 4;
+}
+
+// Wasm is configured as a built-in *envoy.wasm_service* :ref:`WasmConig
+// <envoy_api_msg_config.wasm.v2.WasmConfig>`. This opaque configuration will be used to
+// create a Wasm Service.
+message WasmConfig {
+  // A unique ID so that multiple filters/services can call into the same VM.
+  string id = 1;
+  // Configuration for starting a new VM (optionally associated with the given 'id').
+  VmConfig vm_config = 2;
+  // Wasm service configuration string e.g. a serialized protobuf which will be the
+  // argument to the VM configure() call.
+  string configuration = 3;
+  // If true, create a single VM rather than creating one VM per silo. Such a singleton can
+  // not be used with filters.
+  bool singleton = 4;
+}

api/envoy/data/tap/v2alpha/BUILD

@@ -17,5 +17,8 @@ api_proto_library_internal(
 api_proto_library_internal(
     name = "wrapper",
     srcs = ["wrapper.proto"],
-    deps = [":http"],
+    deps = [
+        ":http",
+        ":transport",
+    ],
 )

api/envoy/data/tap/v2alpha/transport.proto

@@ -23,8 +23,8 @@ message Connection {
   envoy.api.v2.core.Address remote_address = 3;
 }
 
-// Event in a trace.
-message Event {
+// Event in a socket trace.
+message SocketEvent {
   // Timestamp for event.
   google.protobuf.Timestamp timestamp = 1;
   // Data read by Envoy from the transport socket.
@@ -50,9 +50,9 @@ message Event {
 // Sequence of read/write events that constitute a trace on a socket.
 // Multiple Trace messages might be emitted for a given connection ID, with the
 // sink (e.g. file set, network) responsible for later reassembly.
-message Trace {
+message SocketTrace {
   // Connection properties.
   Connection connection = 1;
   // Sequence of observed events.
-  repeated Event events = 2;
+  repeated SocketEvent events = 2;
 }