istio · istio-testing · Jan 31, 2019 · Jul 3, 2018 · Jul 3, 2018 · Jul 4, 2018
diff --git a/.bazelrc b/.bazelrc
@@ -0,0 +1,60 @@
+# Copied from https://github.com/envoyproxy/envoy/blob/master/tools/bazel.rc
+# Envoy specific Bazel build/test options.
+
+build --workspace_status_command=tools/bazel_get_workspace_status
+
+# Basic ASAN/UBSAN that works for gcc
+build:asan --define ENVOY_CONFIG_ASAN=1
+build:asan --copt -fsanitize=address,undefined
+build:asan --linkopt -fsanitize=address,undefined
+build:asan --copt -fno-sanitize=vptr
+build:asan --linkopt -fno-sanitize=vptr
+build:asan --linkopt -ldl
+build:asan --define tcmalloc=disabled
+build:asan --build_tag_filters=-no_asan
+build:asan --test_tag_filters=-no_asan
+build:asan --define signal_trace=disabled
+
+# Clang 5.0 ASAN
+build:clang-asan --define ENVOY_CONFIG_ASAN=1
+build:clang-asan --copt -D__SANITIZE_ADDRESS__
+build:clang-asan --copt -fsanitize=address,undefined
+build:clang-asan --linkopt -fsanitize=address,undefined
+build:clang-asan --copt -fno-sanitize=vptr
+build:clang-asan --linkopt -fno-sanitize=vptr
+build:clang-asan --copt -fno-sanitize-recover=all
+build:clang-asan --linkopt -ldl
+build:clang-asan --define tcmalloc=disabled
+build:clang-asan --build_tag_filters=-no_asan
+build:clang-asan --test_tag_filters=-no_asan
+build:clang-asan --define signal_trace=disabled
+build:clang-asan --test_env=ASAN_SYMBOLIZER_PATH
+
+# Clang 5.0 TSAN
+build:clang-tsan --define ENVOY_CONFIG_TSAN=1
+build:clang-tsan --copt -fsanitize=thread
+build:clang-tsan --linkopt -fsanitize=thread
+build:clang-tsan --define tcmalloc=disabled
+
+# Clang 5.0 MSAN - broken today since we need to rebuild lib[std]c++ and external deps with MSAN
+# support (see https://github.com/envoyproxy/envoy/issues/443).
+build:clang-msan --define ENVOY_CONFIG_MSAN=1
+build:clang-msan --copt -fsanitize=memory
+build:clang-msan --linkopt -fsanitize=memory
+build:clang-msan --define tcmalloc=disabled
+build:clang-msan --copt -fsanitize-memory-track-origins=2
+
+# Test options
+test --test_env=HEAPCHECK=normal --test_env=PPROF_PATH
+
+# Release builds without debug symbols.
+build:release -c opt
+build:release --strip=always
+
+# Release builds with debug symbols
+build:release-symbol -c opt
+
+# Add compile option for all C++ files
+build --cxxopt -Wnon-virtual-dtor
+build --cxxopt -Wformat
+build --cxxopt -Wformat-security
diff --git a/.circleci/Dockerfile b/.circleci/Dockerfile
@@ -19,7 +19,11 @@ RUN sudo apt-get update && \
     clang-6.0 clang-format-6.0 rsync ninja-build
 
 # ~100M, depends on g++, zlib1g-dev, bash-completions
+<<<<<<< HEAD
 RUN curl -Lo /tmp/bazel.deb https://github.com/bazelbuild/bazel/releases/download/0.15.2/bazel_0.15.2-linux-x86_64.deb && \
+=======
+RUN curl -Lo /tmp/bazel.deb https://github.com/bazelbuild/bazel/releases/download/0.18.0/bazel_0.18.0-linux-x86_64.deb && \
+>>>>>>> upstream/release-1.1
     sudo dpkg -i /tmp/bazel.deb && rm /tmp/bazel.deb
 
 

diff --git a/.circleci/Makefile b/.circleci/Makefile
@@ -2,7 +2,11 @@ HUB ?=
 PROJECT ?= istio
 
 # Using same naming convention as istio/istio
+<<<<<<< HEAD
 VERSION ?= go1.10-bazel0.15-clang6.0
+=======
+VERSION ?= go1.10-bazel0.18-clang6.0
+>>>>>>> upstream/release-1.1
 IMG ?= ci
 
 # Build a local image, can be used for testing with circleci command line.

diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -3,7 +3,7 @@ version: 2
 jobs:
   build:
     docker:
-      - image: istio/ci:go1.10-bazel0.15-clang6.0
+      - image: istio/ci:go1.10-bazel0.18-clang6.0
     environment:
       - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
     resource_class: xlarge
@@ -30,7 +30,7 @@ jobs:
           destination: /proxy/bin
   linux_asan:
     docker:
-      - image: istio/ci:go1.10-bazel0.15-clang6.0
+      - image: istio/ci:go1.10-bazel0.18-clang6.0
     environment:
       - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
     resource_class: xlarge
@@ -49,7 +49,7 @@ jobs:
             - /home/circleci/.cache/bazel
   linux_tsan:
     docker:
-      - image: istio/ci:go1.10-bazel0.15-clang6.0
+      - image: istio/ci:go1.10-bazel0.18-clang6.0
     environment:
       - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
     resource_class: xlarge
@@ -80,12 +80,12 @@ jobs:
       - checkout
       - restore_cache:
           keys:
-            - macos_fastbuild_v2-bazel-cache-{{ checksum "WORKSPACE" }}
+            - macos_fastbuild-bazel-cache-{{ checksum "WORKSPACE" }}
       - run: rm ~/.gitconfig
       - run: make build_envoy
       - run: make test
       - save_cache:
-          key: macos_fastbuild_v2-bazel-cache-{{ checksum "WORKSPACE" }}
+          key: macos_fastbuild-bazel-cache-{{ checksum "WORKSPACE" }}
           paths:
             - /Users/distiller/.cache/bazel
 

diff --git a/BUILD b/BUILD
@@ -33,6 +33,3 @@ genrule(
     visibility = ["//visibility:public"],
 )
 
-load("@io_bazel_rules_go//go:def.bzl", "go_prefix")
-
-go_prefix("istio.io/proxy")
diff --git a/Makefile b/Makefile
@@ -20,6 +20,7 @@ ARTIFACTS_DIR ?= $(LOCAL_ARTIFACTS_DIR)
 BAZEL_STARTUP_ARGS ?=
 BAZEL_BUILD_ARGS ?=
 BAZEL_TEST_ARGS ?=
+BAZEL_TARGETS ?= //...
 HUB ?=
 TAG ?=
 ifeq "$(origin CC)" "default"
@@ -30,7 +31,7 @@ CXX := clang++-6.0
 endif
 
 build:
-	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) build $(BAZEL_BUILD_ARGS) //...
+	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) build $(BAZEL_BUILD_ARGS) $(BAZEL_TARGETS)
 	@bazel shutdown
 
 # Build only envoy - fast
@@ -43,19 +44,20 @@ clean:
 	@bazel shutdown
 
 test:
-	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) //...
+	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) $(BAZEL_TARGETS)
 	@bazel shutdown
 
 test_asan:
-	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) --config=clang-asan //...
+	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) --config=clang-asan $(BAZEL_TARGETS)
 	@bazel shutdown
 
 test_tsan:
-	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) --config=clang-tsan //...
+	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) --config=clang-tsan $(BAZEL_TARGETS)
 	@bazel shutdown
 
 check:
 	@script/check-license-headers
+	@script/check-repositories
 	@script/check-style
 
 artifacts: build

diff --git a/WORKSPACE b/WORKSPACE
@@ -15,6 +15,9 @@
 ################################################################################
 #
 
+# http_archive is not a native function since bazel 0.19
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
 load(
      "//:repositories.bzl",
      "googletest_repositories",
@@ -30,12 +33,16 @@ bind(
 )
 
 # When updating envoy sha manually please update the sha in istio.deps file also
-ENVOY_SHA = "15577326dbb4ebacf34990d1686be6f706ac02e4"
+#
+# Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/COMMIT.tar.gz && sha256sum COMMIT.tar.gz`
+ENVOY_SHA = "b3be5713f2100ab5c40316e73ce34581245bd26a"
+ENVOY_SHA256 = "79629284ae143d66b873c08883dc6382fac2e8ed45f6f3521f7e7282b6650216"
 
 http_archive(
     name = "envoy",
     strip_prefix = "envoy-" + ENVOY_SHA,
-    url = "https://github.com/istio/envoy/archive/" + ENVOY_SHA + ".zip",
+    url = "https://github.com/envoyproxy/envoy/archive/" + ENVOY_SHA + ".tar.gz",
+    sha256 = ENVOY_SHA256,
 )
 
 load("@envoy//bazel:repositories.bzl", "envoy_dependencies")
@@ -48,14 +55,16 @@ load("@envoy_api//bazel:repositories.bzl", "api_dependencies")
 api_dependencies()
 
 load("@io_bazel_rules_go//go:def.bzl", "go_rules_dependencies", "go_register_toolchains")
-load("@com_lyft_protoc_gen_validate//bazel:go_proto_library.bzl", "go_proto_repositories")
-go_proto_repositories(shared=0)
 go_rules_dependencies()
 go_register_toolchains()
 
-load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
-git_repository(
+# Nov 28, 2017 (bazel 0.8.0 support)
+RULES_PROTOBUF_SHA = "563b674a2ce6650d459732932ea2bc98c9c9a9bf"
+RULES_PROTOBUF_SHA256 = "338e0d65cd709c6a6f9b5702466e641d536479be8b564d1e12a5d1de22a5cff6"
+
+http_archive(
     name = "org_pubref_rules_protobuf",
-    commit = "563b674a2ce6650d459732932ea2bc98c9c9a9bf",  # Nov 28, 2017 (bazel 0.8.0 support)
-    remote = "https://github.com/pubref/rules_protobuf",
+    strip_prefix = "rules_protobuf-" + RULES_PROTOBUF_SHA,
+    url = "https://github.com/pubref/rules_protobuf/archive/" + RULES_PROTOBUF_SHA + ".tar.gz",
+    sha256 = RULES_PROTOBUF_SHA256,
 )
diff --git a/cc_gogo_protobuf.bzl b/cc_gogo_protobuf.bzl
@@ -14,8 +14,10 @@
 #
 ################################################################################
 #
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-load("@bazel_tools//tools/build_defs/repo:git.bzl", "new_git_repository")
+GOGO_PROTO_SHA = "100ba4e885062801d56799d78530b73b178a78f3"
+GOGO_PROTO_SHA256 = "b04eb8eddd2d15d8b12d111d4ef7816fca6e5c5d495adf45fb8478278aa80f79"
 
 def cc_gogoproto_repositories(bind=True):
     BUILD = """
@@ -56,10 +58,11 @@ cc_proto_library(
     ],
 )
 """
-    new_git_repository(
+    http_archive(
         name = "gogoproto_git",
-        commit = "100ba4e885062801d56799d78530b73b178a78f3",
-        remote = "https://github.com/gogo/protobuf",
+        strip_prefix = "protobuf-" + GOGO_PROTO_SHA,
+        url = "https://github.com/gogo/protobuf/archive/" + GOGO_PROTO_SHA + ".tar.gz",
+        sha256 = GOGO_PROTO_SHA256,
         build_file_content = BUILD,
     )
 

diff --git a/googleapis.bzl b/googleapis.bzl
@@ -14,8 +14,11 @@
 #
 ################################################################################
 #
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-load("@bazel_tools//tools/build_defs/repo:git.bzl", "new_git_repository")
+# Oct 21, 2016 (only release pre-dates sha)
+GOOGLEAPIS_SHA = "13ac2436c5e3d568bd0e938f6ed58b77a48aba15"
+GOOGLEAPIS_SHA256 = "f48956fb8c55617ed052c20884465f06b9a57b807164431185be397ea46993ca"
 
 def googleapis_repositories(bind=True):
     GOOGLEAPIS_BUILD_FILE = """
@@ -37,11 +40,12 @@ cc_proto_library(
 )
 
 """
-    new_git_repository(
+    http_archive(
         name = "com_github_googleapis_googleapis",
         build_file_content = GOOGLEAPIS_BUILD_FILE,
-        commit = "13ac2436c5e3d568bd0e938f6ed58b77a48aba15", # Oct 21, 2016 (only release pre-dates sha)
-        remote = "https://github.com/googleapis/googleapis.git",
+        strip_prefix = "googleapis-" + GOOGLEAPIS_SHA,
+        url = "https://github.com/googleapis/googleapis/archive/" + GOOGLEAPIS_SHA + ".tar.gz",
+        sha256 = GOOGLEAPIS_SHA256,
     )
 
     if bind:

diff --git a/include/istio/control/http/controller.h b/include/istio/control/http/controller.h
@@ -18,6 +18,8 @@
 
 #include "include/istio/control/http/request_handler.h"
 #include "include/istio/mixerclient/client.h"
+#include "include/istio/utils/attribute_names.h"
+#include "include/istio/utils/local_attributes.h"
 #include "mixer/v1/config/client/client_config.pb.h"
 
 namespace istio {
@@ -69,8 +71,9 @@ class Controller {
   // * some functions provided by the environment (Envoy)
   // * optional service config cache size.
   struct Options {
-    Options(const ::istio::mixer::v1::config::client::HttpClientConfig& config)
-        : config(config) {}
+    Options(const ::istio::mixer::v1::config::client::HttpClientConfig& config,
+            const ::istio::utils::LocalNode& local_node)
+        : config(config), local_node(local_node) {}
 
     // Mixer filter config
     const ::istio::mixer::v1::config::client::HttpClientConfig& config;
@@ -81,6 +84,8 @@ class Controller {
     // The LRU cache size for service config.
     // If not set or is 0 default value, the cache size is 1000.
     int service_config_cache_size{};
+
+    const ::istio::utils::LocalNode& local_node;
   };
 
   // The factory function to create a new instance of the controller.

diff --git a/include/istio/control/http/report_data.h b/include/istio/control/http/report_data.h
@@ -19,6 +19,8 @@
 #include <chrono>
 #include <map>
 
+#include "google/protobuf/struct.pb.h"
+
 namespace istio {
 namespace control {
 namespace http {
@@ -42,27 +44,32 @@ class ReportData {
     int response_code;
     std::string response_flags;
   };
-  virtual void GetReportInfo(ReportInfo* info) const = 0;
+  virtual void GetReportInfo(ReportInfo *info) const = 0;
 
   // Get destination ip/port.
-  virtual bool GetDestinationIpPort(std::string* ip, int* port) const = 0;
+  virtual bool GetDestinationIpPort(std::string *ip, int *port) const = 0;
 
   // Get Rbac attributes.
   struct RbacReportInfo {
     std::string permissive_resp_code;
     std::string permissive_policy_id;
   };
-  virtual bool GetRbacReportInfo(RbacReportInfo* report_info) const = 0;
+  virtual bool GetRbacReportInfo(RbacReportInfo *report_info) const = 0;
 
   // Get upstream host UID. This value overrides the value in the report bag.
-  virtual bool GetDestinationUID(std::string* uid) const = 0;
+  virtual bool GetDestinationUID(std::string *uid) const = 0;
 
   // gRPC status info
   struct GrpcStatus {
     std::string status;
     std::string message;
   };
-  virtual bool GetGrpcStatus(GrpcStatus* status) const = 0;
+  virtual bool GetGrpcStatus(GrpcStatus *status) const = 0;
+
+  // Get dynamic metadata generated by Envoy filters.
+  // Useful for logging info generated by custom codecs.
+  virtual const ::google::protobuf::Map<std::string, ::google::protobuf::Struct>
+      &GetDynamicFilterState() const = 0;
 };
 
 }  // namespace http

diff --git a/include/istio/control/http/request_handler.h b/include/istio/control/http/request_handler.h
@@ -42,24 +42,10 @@ class RequestHandler {
 
   // Make a Report call. It will:
   // * check service config to see if Report is required
+  // * extract check attributes if not done yet.
   // * extract more report attributes
   // * make a Report call.
-  virtual void Report(ReportData* report_data) = 0;
-
-  // Extract the request attributes for Report() call.
-  // This is called at Report time when Check() is not called.
-  // Normally request attributes are extracted at Check() call.
-  // This is for cases the requests are rejected by http filters
-  // before mixer, such as fault injection, or auth.
-  //
-  // Usage:  at Envoy filter::log() function
-  //   if (!hander) {
-  //       handle = control->CreateHandler();
-  //       handler->ExtractRequestAttributes();
-  //   }
-  //   handler->Report();
-  //
-  virtual void ExtractRequestAttributes(CheckData* check_data) = 0;
+  virtual void Report(CheckData* check_data, ReportData* report_data) = 0;
 };
 
 }  // namespace http