This changes the Upstream Filter code to creating the codec filter via factory which
requires adding all UpstreamRequest/CodecFilter interactions to an UpstreamCallback interface accessible through the filter manager
requires unhiding the configuration because the presubmit cross-checks for the registered factory require all the config be unhidden
allows configuring the codec filter in configuration, in case of eventual alternate terminal filter
allows fixing up the filter dependency validator to validate the entire upstream filter chain.
Upstream filters flipped on for CI, SHOULD BE FLIPPED OFF BEFORE SUBMITTING
Risk Level: low assuming it's flipped back off
Testing: updated unit tests, covered by filter integration tests
Docs Changes: n/a
Release Notes: n/a (off by default)
Part of #10455
Signed-off-by: Alyssa Wilk <alyssar@chromium.org>
Mirrored from https://github.com/envoyproxy/envoy @ 978004308203aa9e86886512adf6b26376958405
This updates the version of buf.build/googleapis/googleapis to the
latest pushed version. The BSR had a change in the googleapis module to
to concerns with the number of files in BSR, requiring previous commits
to be removed. See https://docs.buf.build/faq#googleapis-failure for
more details. This PR fixes the issue for envoy.
Signed-off-by: bufdev <bufdev-github@buf.build>
Signed-off-by: bufdev <bufdev-github@buf.build>
Mirrored from https://github.com/envoyproxy/envoy @ 68758cef311f65e8813df6b7235ead660cd952f8
Signed-off-by: Marcin Falkowski <marcin.falkowski@allegro.pl>
Mirrored from https://github.com/envoyproxy/envoy @ 2bee66e427f26680f799643ba9ce82ffd5541895
The HeaderAppendAction was added in the #18246. But the implementation never done. This PR try to complete this feature.
Further work of #18246. To close#22713.
Risk Level: Low.
Testing: Unit Test.
Signed-off-by: wbpcode <wangbaiping@corp.netease.com>
Mirrored from https://github.com/envoyproxy/envoy @ 5183dbf7f11b23f1f7013a3e42cbce71eb63252a
Currently stats are not available in lua filter, which makes it hard to
track/alert for the script errors. This change adds error stat.
Signed-off-by: Suresh Kumar <sureshkumar.pp@gmail.com>
Signed-off-by: Suresh Kumar <suresh.ponnusamy@freshworks.com>
Mirrored from https://github.com/envoyproxy/envoy @ 8c88943b747bd74517eaf257cd75dd686aa7bbb8
Signed-off-by: Kuat Yessenov <kuat@google.com>
Commit Message: Expose internal listener functionality. Marks the fields as implemented. Adds the following functional changes prior to publishing:
* do not use the `address` field per https://github.com/envoyproxy/envoy/pull/21132, and instead use the listener `name` field as originally expected.
* add an `endpoint_id` field to upstream address to fix https://github.com/envoyproxy/envoy/pull/22420; it's not possible to have multiple internal addresses to the same listener in a single pool without some extra identifier beyond the listener name, because pools identify addresses using `asString()`.
* fixes https://github.com/envoyproxy/envoy/issues/20665 by using stat prefix `listener.envoy_internal_<listener_name>`.
Adds a few sample configs (and fixes https://github.com/envoyproxy/envoy/issues/20335):
* minimal two chained `tcp_proxy` listeners;
* encap HTTP in HTTP CONNECT;
* decap HTTP in HTTP CONNECT;
Risk Level: low, hidden prior
Testing: yes
Docs Changes: yes
Release Notes: yes
Mirrored from https://github.com/envoyproxy/envoy @ 02489bbf8990faddb6be1f2e0f22851b64c3fc85
adding hidden config for upstream filters, and setting the cluster up to create upstream filters.
upstream filters are as yet unused, still cleaning up (#22434) but this makes it a much cleaner PR
(Also adding 2 random tweaks to router code because coverage was failing despite there previously being no changes to router code)
Risk Level: low (no-op if not configured)
Testing: unit tests
Docs Changes: n/a
Release Notes: n/a
part of #10455
Signed-off-by: Alyssa Wilk <alyssar@chromium.org>
Mirrored from https://github.com/envoyproxy/envoy @ 5261b4285d1487f93e7aece94786de9a8d3a2529
Commit Message: contrib: add Hyperscan regex engine
Additional Description: Hyperscan has been introduced as an input matcher earlier this year. Since the regex engine interface has been completed, the patch extent the usage of Hyperscan into a contrib regex engine.
Risk Level: Low
Testing: Unit
Docs Changes: API
Release Notes: N/A
Platform Specific Features: Requires processor with SSSE3 support (nearly any modern x86 processor)
Signed-off-by: Xie Zhihao <zhihao.xie@intel.com>
Mirrored from https://github.com/envoyproxy/envoy @ 725d0b4b3e6fb84aa7dfd1ca4d5792f2dc4558b2
* cors: add PNA support
Signed-off-by: Loong Dai <loong.dai@intel.com>
* fix field
Signed-off-by: Loong Dai <loong.dai@intel.com>
* use runtime guard rather than api change
Signed-off-by: Loong Dai <loong.dai@intel.com>
* fix CI
Signed-off-by: Loong Dai <loong.dai@intel.com>
* update changelog
Signed-off-by: Loong Dai <loong.dai@intel.com>
* revert unrelated changes
Signed-off-by: Loong Dai <loong.dai@intel.com>
* update API
Signed-off-by: Loong Dai <loong.dai@intel.com>
* feedback and update tests
Signed-off-by: Loong Dai <loong.dai@intel.com>
* update tests
Signed-off-by: Loong Dai <loong.dai@intel.com>
* update tests
Signed-off-by: Loong Dai <loong.dai@intel.com>
* add tests
Signed-off-by: Loong Dai <loong.dai@intel.com>
* feedback
Signed-off-by: Loong Dai <loong.dai@intel.com>
* remove useless test
Signed-off-by: Loong Dai <loong.dai@intel.com>
* feedback
Signed-off-by: Loong Dai <loong.dai@intel.com>
* fix CI
Signed-off-by: Loong Dai <loong.dai@intel.com>
Mirrored from https://github.com/envoyproxy/envoy @ bf61b077e77197a28fefa5798902fd94008e4137
This PR is the first of a series to implement pattern matching and rewrite functionality for Envoy.
These specific proto changes:
Add the foundation for two extension configs
Change the API to expose the extension configs to end users
Risk Level: Low
Signed-off-by: silverstar195 <seanmaloney@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 25654b97cdd2647c258ae459e6607f51e99c99cc
Commit Message: The documentation in the protobuf comments for stats tag extractors has been stale since 2018. This corrects the documentation to match the current behavior.
Additional Description: This documents a change that was done in Feb 2018: #2515 -- obviously we should've fixed the doc then but it was overlooked.
Risk Level: low
Testing: none
Docs Changes: this is a doc change only, to reflect current reality
Release Notes: n/a
Platform Specific Features: n/a
Signed-off-by: Joshua Marantz <jmarantz@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 076bc515b3e6fca54592174928fc7ab06763b812
Commit Message: This PR entirely removes the Lightstep tracer. Lightstep is looking forward to the OpenTelemetry tracer integration.
Additional Description: The owner of this code left Lightstep and we have no plans to maintain this code now that OpenTelemetry is ready.
Risk Level: Low
Docs Changes:
Release Notes: Remove Lightstep tracer.
Co-authored-by: alyssawilk <alyssar@google.com>
Co-authored-by: alyssawilk <alyssar@chromium.org>
Mirrored from https://github.com/envoyproxy/envoy @ eb521f42e760b9e5cb6ca544e5c87523f0592fa9
Signed-off-by: Jacek Ewertowski <jacek.ewertowski1@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ c2dab844230197a1109e62f1d735384b67d74c9c
Next generation Intel® QAT support with Intel® Xeon® Scalable processors
will feature an Intel® QAT cryptography and compression acceleration
engine.
QAT private key provider extension will use qatlib library
(https://github.com/intel/qatlib) to accelerate RSA operations in
handshakes. The extension will look a bit like the existing cryptomb
private key provider. The use case is to move the expensive
cryptographic operations away from the CPU to the accelerator device,
leaving CPU cycles for other use.
Support for Intel® QAT is already present in the mainline Linux kernel
and in Kubernetes device plugins (to expose the device files to
containers). There are previous generations of Intel QAT® hardware
devices, but they are not supported by this extension.
Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com>
Mirrored from https://github.com/envoyproxy/envoy @ 9447ff5bfa8081fc2ddd5918b8ee9c1fd6720c7a
Adding an API field treat_missing_header_as_empty for better compatibility (both backward and to other xDS clients like gRPC) and potential to expand (not restricted to invert_match)
Risk Level: Low
Testing: Unit test
Docs Changes: inline
Release Notes: inline
Fixes#21828
Signed-off-by: Yuhao Liu <yuhaoliu@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 3e4b31b513765bcff4dba7e2e5b723cb8bd6ffca
This can be used when using the system resolver is desired. For
example, on Android.
Signed-off-by: Matt Klein <mklein@lyft.com>
Mirrored from https://github.com/envoyproxy/envoy @ 516b3f304bccf451691224c71a357f9c62840b2b
This PR contains the following changes:
* SIP Proxy extension TRA API updated to send additional SIP context (method type and from header), so TRA service can use this information for customized affinity management.
* Fix an error with decoding of SIP headers with a valid format causing Envoy proxy to crash in case of empty header fields.
Risk Level: Low
Testing: Unit tests
Docs Changes: None
Release Notes: None
Platform Specific Features: None
Signed-off-by: Jonah Murphy <jonamurp@cisco.com>
Signed-off-by: Adrian Rejas Conde <arejasco@cisco.com>
Mirrored from https://github.com/envoyproxy/envoy @ 09549da9045d9c85ffaf851b6d740de0b507708f
When rotating passwords, we need to support multiple passwords for graceful
deployment/rollout. This change adds support for multiple passwords in AUTH,
for both old auth and new ACL based one.
Signed-off-by: Suresh Kumar <sureshkumar.pp@gmail.com>
Signed-off-by: Suresh Kumar <suresh.ponnusamy@freshworks.com>
Mirrored from https://github.com/envoyproxy/envoy @ 8ef5da2cee7328d24f80aa816aad0f4f22d6f1e0
Creates a transport socket for HTP/1.1 proxy support.
With the combination of the transport socket, and a filter putting the proxy stream info in place this will
redirect TCP connections to the proxy IP address
prefix TLS connections with cleartext CONECT headers to the destination host, and strip CONNECT response
change cleartext HTTP/1.1 to send fully qualified URLs
Risk Level: medium (intended as a no op but it does have data plane refactory)
Testing: new unit, integration tests
Docs Changes: n/a
Part of envoyproxy/envoy-mobile#1622
Signed-off-by: Alyssa Wilk <alyssar@chromium.org>
Mirrored from https://github.com/envoyproxy/envoy @ 095f4ca336d3d705e629b207fb2cbbc22d29db8f
data-plane-api(Azure Pipelines)