WASM Null sandbox.

.azure-pipelines/linux.yml

@@ -0,0 +1,14 @@
+resources:
+  containers:
+  - container: envoy-build
+    image: envoyproxy/envoy-build:07f65995ece0b8a21bb2888d07a8c1d060e7daaa
+
+jobs:
+- job: BuildEnvoy
+  timeoutInMinutes: 360
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  container: envoy-build
+  steps:
+  - script: bazel build //source/exe:envoy-static
+

.azure-pipelines/macos.yml

@@ -0,0 +1,24 @@
+# Azure Pipelines
+trigger:
+- master
+
+jobs:
+- job: macOS
+  timeoutInMinutes: 360
+  pool:
+    vmImage: 'macos-latest'
+
+  steps:
+  - script: ./ci/mac_ci_setup.sh
+    displayName: 'Install dependencies'
+
+  - script: ./ci/mac_ci_steps.sh
+    displayName: 'Run Mac CI'
+    env:
+      BAZEL_REMOTE_CACHE: https://storage.googleapis.com/envoy-circleci-bazel-cache/
+
+  - task: PublishTestResults@2
+    inputs:
+      testResultsFiles: '**/bazel-testlogs/**/test.xml'
+      testRunTitle: 'macOS'
+    condition: always()

.bazelignore

@@ -0,0 +1 @@
+examples/grpc-bridge/script

.bazelrc

@@ -6,26 +6,28 @@
 # leave room for compiler/linker.
 startup --host_jvm_args=-Xmx512m
 build --workspace_status_command=bazel/get_workspace_status
+build --experimental_remap_main_repo
 
 # Basic ASAN/UBSAN that works for gcc
 build:asan --define ENVOY_CONFIG_ASAN=1
 build:asan --copt -fsanitize=address,undefined
 build:asan --linkopt -fsanitize=address,undefined
 build:asan --copt -fno-sanitize=vptr
 build:asan --linkopt -fno-sanitize=vptr
+build:asan --linkopt -fuse-ld=lld
 build:asan --linkopt -ldl
 build:asan --define tcmalloc=disabled
 build:asan --build_tag_filters=-no_asan
 build:asan --test_tag_filters=-no_asan
 build:asan --define signal_trace=disabled
 build:asan --copt -DADDRESS_SANITIZER=1
 build:asan --copt -D__SANITIZE_ADDRESS__
-build:asan --test_env=ASAN_OPTIONS=handle_abort=1:allow_addr2line=true:check_initialization_order=true:strict_init_order=true
+build:asan --test_env=ASAN_OPTIONS=handle_abort=1:allow_addr2line=true:check_initialization_order=true:strict_init_order=true:detect_odr_violation=1
+build:asan --test_env=UBSAN_OPTIONS=halt_on_error=true:print_stacktrace=1
 build:asan --test_env=ASAN_SYMBOLIZER_PATH
 
 # Clang ASAN/UBSAN
 build:clang-asan --config=asan
-build:clang-asan --linkopt -fuse-ld=lld
 
 # macOS ASAN/UBSAN
 build:macos-asan --config=asan
@@ -37,8 +39,10 @@ build:macos-asan --copt -D_FORTIFY_SOURCE=0
 build:clang-tsan --define ENVOY_CONFIG_TSAN=1
 build:clang-tsan --copt -fsanitize=thread
 build:clang-tsan --linkopt -fsanitize=thread
-build:clang-tsan --define tcmalloc=disabled
 build:clang-tsan --linkopt -fuse-ld=lld
+build:clang-tsan --define tcmalloc=disabled
+# Needed due to https://github.com/libevent/libevent/issues/777
+build:clang-tsan --copt -DEVENT__DISABLE_DEBUG_MODE
 
 # Clang MSAN - broken today since we need to rebuild lib[std]c++ and external deps with MSAN
 # support (see https://github.com/envoyproxy/envoy/issues/443).
@@ -47,15 +51,15 @@ build:clang-msan --copt -fsanitize=memory
 build:clang-msan --linkopt -fsanitize=memory
 build:clang-msan --define tcmalloc=disabled
 build:clang-msan --copt -fsanitize-memory-track-origins=2
-build:clang-msan --linkopt -fuse-ld=lld
 
 # Clang with libc++
+# TODO(cmluciano) fix and re-enable _LIBCPP_VERSION testing for TCMALLOC in Envoy::Stats::TestUtil::hasDeterministicMallocStats
+# and update stats_integration_test with appropriate m_per_cluster value
 build:libc++ --action_env=CC
 build:libc++ --action_env=CXX
 build:libc++ --action_env=CXXFLAGS=-stdlib=libc++
 build:libc++ --action_env=PATH
 build:libc++ --define force_libcpp=enabled
-build:libc++ --linkopt -fuse-ld=lld
 
 # Test options
 test --test_env=HEAPCHECK=normal --test_env=PPROF_PATH

.circleci/config.yml

@@ -4,26 +4,42 @@ executors:
   ubuntu-build:
     description: "A regular build executor based on ubuntu image"
     docker:
-      - image: envoyproxy/envoy-build:698009170e362f9ca0594f2b1927fbbee199bf98
+      - image: envoyproxy/envoy-build:cfc514546bc0284536893cca5fa43d7128edcd35
     resource_class: xlarge
     working_directory: /source
 
 jobs:
    release:
      executor: ubuntu-build
+     environment:
+       BAZEL_REMOTE_CACHE: https://storage.googleapis.com/envoy-circleci-bazel-cache/
      steps:
        - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
        - checkout
        - run:
            command:
              ci/do_circle_ci.sh bazel.release
            no_output_timeout: 60m
-       - setup_remote_docker
-       - run: ci/docker_push.sh
-       - run: ci/docker_tag.sh
+       - persist_to_workspace:
+           root: .
+           paths:
+             - build_release
+             - build_release_stripped
        - store_artifacts:
            path: /build/envoy/generated
            destination: /
+   docker:
+     docker:
+       - image: docker
+     steps:
+       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
+       - checkout
+       - attach_workspace:
+           at: .
+       - setup_remote_docker
+       - run: ci/docker_build.sh
+       - run: ci/docker_push.sh
+       - run: ci/docker_tag.sh
    asan:
      executor: ubuntu-build
      steps:
@@ -159,15 +175,6 @@ jobs:
        - run: docs/publish.sh
        - store_artifacts:
            path: generated/docs
-   mac:
-     macos:
-       xcode: "9.3.0"
-     steps:
-       - run: sudo ntpdate -vu time.apple.com
-       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
-       - checkout
-       - run: ci/mac_ci_setup.sh
-       - run: ci/mac_ci_steps.sh
 
 workflows:
   version: 2
@@ -177,6 +184,11 @@ workflows:
           filters:
             tags:
               only: /^v.*/
+      - docker:
+          requires: [release]
+          filters:
+            tags:
+              only: /^v.*/
       - asan
       - tsan
       - compile_time_options
@@ -191,4 +203,3 @@ workflows:
           filters:
             tags:
               only: /^v.*/
-      - mac

.clang-tidy

@@ -1,7 +1,7 @@
-Checks:          'clang-diagnostic-*,clang-analyzer-*,abseil-*,bugprone-*,modernize-*,performance-*,readability-redundant-*,readability-braces-around-statements'
+Checks:          'clang-diagnostic-*,clang-analyzer-*,abseil-*,bugprone-*,modernize-*,performance-*,readability-redundant-*,readability-braces-around-statements,readability-container-size-empty'
 
 #TODO(lizan): grow this list, fix possible warnings and make more checks as error
-WarningsAsErrors: 'bugprone-assert-side-effect,modernize-make-shared,modernize-make-unique,readability-redundant-smartptr-get,readability-braces-around-statements,readability-redundant-string-cstr,bugprone-use-after-move'
+WarningsAsErrors: 'bugprone-assert-side-effect,modernize-make-shared,modernize-make-unique,readability-redundant-smartptr-get,readability-braces-around-statements,readability-redundant-string-cstr,bugprone-use-after-move,readability-container-size-empty'
 
 CheckOptions:
   - key:             bugprone-assert-side-effect.AssertMacros

.gitignore

@@ -2,18 +2,22 @@
 BROWSE
 /build
 /build_*
+*.bzlc
 .cache
+.classpath
+.clwb/
 /ci/bazel-*
-/ci/prebuilt/thirdparty
-/ci/prebuilt/thirdparty_build
 compile_commands.json
 cscope.*
 .deps
 /docs/landing_source/.bundle
 /generated
+.idea/
+.project
 *.pyc
 **/pyformat
 SOURCE_VERSION
+.settings/
 *.sw*
 tags
 TAGS

CODEOWNERS

@@ -2,8 +2,10 @@
 # By default, @envoyproxy/maintainers own everything.
 #*       @envoyproxy/maintainers
 
+# csrf extension
+/*/extensions/filters/http/csrf @dschaller @mattklein123
 # dubbo_proxy extension
-/*/extensions/filters/network/dubbo_proxy @zyfjeff @lizan 
+/*/extensions/filters/network/dubbo_proxy @zyfjeff @lizan
 # thrift_proxy extension
 /*/extensions/filters/network/thrift_proxy @zuercher @brian-pane
 # jwt_authn http filter extension
@@ -22,3 +24,5 @@
 /*/extensions/filters/network/mysql_proxy @rshriram @venilnoronha @mattklein123
 # quic extension
 /*/extensions/quic_listeners/ @alyssawilk @danzh2010 @mattklein123 @mpwarres @wu-bin
+# zookeeper_proxy extension
+/*/extensions/filters/network/zookeeper_proxy @rgs1 @snowp

CONTRIBUTING.md

@@ -33,16 +33,29 @@ maximize the chances of your PR being merged.
   deprecations between 1.3.0 and 1.4.0 will be deleted soon AFTER 1.5.0 is tagged and released
   (at the beginning of the 1.6.0 release cycle). This results in a three to six month window for
   migrating from deprecated code paths to new code paths.
+* Unless the community and Envoy maintainer team agrees on an exception, during the
+  first release cycle after a feature has been deprecated, use of that feature
+  will cause a logged warning, and incrementing the
+  [runtime](https://www.envoyproxy.io/docs/envoy/latest/configuration/runtime#config-runtime)
+  runtime.deprecated_feature_use stat.
+  During the second release cycle, use of the deprecated configuration will
+  cause a configuration load failure, unless the feature in question is
+  explicitly overridden in
+  [runtime](https://www.envoyproxy.io/docs/envoy/latest/configuration/runtime#config-runtime)
+  config. Finally during the third release cycle the code and configuration will be removed
+  entirely.
 * This policy means that organizations deploying master should have some time to get ready for
   breaking changes, but we make no guarantees about the length of time.
 * The breaking change policy also applies to source level extensions (e.g., filters). Code that
   conforms to the public interface documentation should continue to compile and work within the
   deprecation window. Within this window, a warning of deprecation should be carefully logged (some
   features might need rate limiting for logging this). We make no guarantees about code or deployments
   that rely on undocumented behavior.
-* All deprecations/breaking changes will be clearly listed in [DEPRECATED.md](DEPRECATED.md).
-* All deprecations/breaking changes will be announced to the
-  [envoy-announce](https://groups.google.com/forum/#!forum/envoy-announce) email list.
+* All deprecations/breaking changes will be clearly listed in the [deprecated log](docs/root/intro/deprecated.rst).
+* High risk deprecations//breaking changes may be announced to the
+  [envoy-announce](https://groups.google.com/forum/#!forum/envoy-announce) email list but by default
+  it is expected the multi-phase warn-by-default/fail-by-default is sufficient to warn users to move
+  away from deprecated features.
 * Protobuf configuration in an alpha namespace, e.g. `v2alpha`, do not have any
   restrictions on breaking changes. They may be freely modified, together with
   their respective features.
@@ -119,13 +132,69 @@ maximize the chances of your PR being merged.
   changes for 7 days. Obviously PRs that are closed due to lack of activity can be reopened later.
   Closing stale PRs helps us to keep on top of all of the work currently in flight.
 * If a commit deprecates a feature, the commit message must mention what has been deprecated.
-  Additionally, [DEPRECATED.md](DEPRECATED.md) must be updated as part of the commit.
+  Additionally, the [deprecated log](docs/root/intro/deprecated.rst) must be updated with relevant
+  RST links for fields and messages as part of the commit.
 * Please consider joining the [envoy-dev](https://groups.google.com/forum/#!forum/envoy-dev)
   mailing list.
 * If your PR involves any changes to
   [envoy-filter-example](https://github.com/envoyproxy/envoy-filter-example) (for example making a new
   branch so that CI can pass) it is your responsibility to follow through with merging those
   changes back to master once the CI dance is done.
+* If your PR is a high risk change, the reviewer may ask that you runtime guard
+  it. See the section on runtime guarding below.
+
+
+# Runtime guarding
+
+Some high risk changes in Envoy are deemed worthy of runtime guarding. Instead of just replacing
+old code with new code, both code paths are supported for between one Envoy release (if it is
+guarded due to performance concerns) and a full deprecation cycle (if it is a high risk behavioral
+change).
+
+The canonical way to runtime guard a feature is
+```
+if (Runtime::runtimeFeatureEnabled("envoy.reloadable_features.my_feature_name")) {
+  [new code path]
+} else {
+  [old_code_path]
+}
+```
+Runtime guarded features named with the "envoy.reloadable_features." prefix must be safe to flip
+true or false on running Envoy instances. In some situations it may make more sense to
+latch the value in a member variable on class creation, for example:
+
+```
+bool use_new_code_path_ =
+    Runtime::runtimeFeatureEnabled("envoy.reloadable_features.my_feature_name")
+```
+
+This should only be done if the lifetime of the object in question is relatively short compared to
+the lifetime of most Envoy instances, i.e. latching state on creation of the
+Http::ConnectionManagerImpl or all Network::ConnectionImpl classes, to ensure that the new behavior
+will be exercised as the runtime value is flipped, and that the old behavior will trail off over
+time.
+
+Runtime guarded features may either set true (running the new code by default) in the initial PR,
+after a testing interval, or during the next release cycle, at the PR author's and reviewing
+maintainer's discretion. Generally all runtime guarded features will be set true when a
+release is cut, and the old code path will be deprecated at that time. Runtime features
+are set true by default by inclusion in
+[source/common/runtime/runtime_features.h](https://github.com/envoyproxy/envoy/blob/master/source/common/runtime/runtime_features.h)
+
+There are four suggested options for testing new runtime features:
+
+1. Create a per-test Runtime::LoaderSingleton as done in [DeprecatedFieldsTest.IndividualFieldDisallowedWithRuntimeOverride](https://github.com/envoyproxy/envoy/blob/master/test/common/protobuf/utility_test.cc)
+2. Create a [parameterized test](https://github.com/google/googletest/blob/master/googletest/docs/advanced.md#how-to-write-value-parameterized-tests)
+   where the set up of the test sets the new runtime value explicitly to
+   GetParam() as outlined in (1).
+3. Set up integration tests with custom runtime defaults as documented in the
+   [integration test README](https://github.com/envoyproxy/envoy/blob/master/test/integration/README.md)
+4. Run a given unit test with the new runtime value explicitly set true as done
+   for [runtime_flag_override_test](https://github.com/envoyproxy/envoy/blob/master/test/common/runtime/BUILD) 
+
+Runtime code is held to the same standard as regular Envoy code, so both the old
+path and the new should have 100% coverage both with the feature defaulting true
+and false.
 
 # PR review policy for maintainers
 
@@ -169,7 +238,7 @@ The sign-off is a simple line at the end of the explanation for the
 patch, which certifies that you wrote it or otherwise have the right to
 pass it on as an open-source patch. The rules are pretty simple: if you
 can certify the below (from
-[developercertificate.org](http://developercertificate.org/)):
+[developercertificate.org](https://developercertificate.org/)):
 
 ```
 Developer Certificate of Origin
@@ -228,7 +297,7 @@ git config --add alias.c "commit -s"
 ## Fixing DCO
 
 If your PR fails the DCO check, it's necessary to fix the entire commit history in the PR. Best
-practice is to [squash](http://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html)
+practice is to [squash](https://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html)
 the commit history to a single commit, append the DCO sign-off as described above, and [force
 push](https://git-scm.com/docs/git-push#git-push---force). For example, if you have 2 commits in
 your history:
@@ -244,9 +313,17 @@ should only be done to correct a DCO mistake.
 
 ## Triggering CI re-run without making changes
 
-Sometimes CI test runs fail due to obvious resource problems or other issues
-which are not related to your PR. It may be desirable to re-trigger CI without
-making any code changes. Consider adding an alias into your `.gitconfig` file:
+To rerun failed tasks in CI, add a comment with the the line
+
+```
+/retest
+```
+
+in it. This should rebuild only the failed tasks.
+
+Sometimes tasks will be stuck in CI and won't be marked as failed, which means
+the above command won't work. Should this happen, pushing an empty commit should
+re-run all the CI tasks. Consider adding an alias into your `.gitconfig` file:
 
 ```
 [alias]