Merge branch 'master' into mpuncel/lua-base64-encode

* master: (67 commits)
  logger: support log control in admin interface and command line option for Fancy Logger (envoyproxy#12369)
  test: fix http_timeout_integration_test flake (envoyproxy#12654)
  [fuzz]added an input check in writefilter fuzzer and added test cases (envoyproxy#12628)
  add 'explicit' restriction. (envoyproxy#12643)
  scoped_rds_integration_test migrate from api v2 to api v3. (envoyproxy#12633)
  fuzz: added fuzz test for listener filter tls_inspector (envoyproxy#12617)
  testing: fix multiple race conditions in simulated time tests (envoyproxy#12527)
  [tls] Move handshaking behavior into SslSocketInfo. (envoyproxy#12571)
  header: getting rid of exception-throwing behaviors in header files [the rest] (envoyproxy#12611)
  router: add new ratelimited retry backoff strategy (envoyproxy#12202)
  [redis_proxy] added a constraint for route.prefix().size() (envoyproxy#12637)
  network: add tcp listener backlog config (envoyproxy#12625)
  runtime: debug log that condition is always true when fractionalPercent numerator > denominator (envoyproxy#12068)
  WatchDog Extension hook (envoyproxy#12416)
  router: add dynamic metadata header formatter (envoyproxy#11858)
  statsd: revert visibility to public (envoyproxy#12621)
  Fix regression of /build_* in gitignore (envoyproxy#12630)
  Added a missing extension point to documentation. (envoyproxy#12620)
  Reverts proxy protocol test on windows (envoyproxy#12619)
  caching: Improved the tests and coverage of the CacheFilter tree (envoyproxy#12544)
  ...

Signed-off-by: Michael Puncel <mpuncel@squareup.com>

.bazelrc

@@ -89,6 +89,9 @@ build:clang-tsan --build_tag_filters=-no_san,-no_tsan
 build:clang-tsan --test_tag_filters=-no_san,-no_tsan
 # Needed due to https://github.com/libevent/libevent/issues/777
 build:clang-tsan --copt -DEVENT__DISABLE_DEBUG_MODE
+# https://github.com/abseil/abseil-cpp/issues/760
+# https://github.com/google/sanitizers/issues/953
+build:clang-tsan --test_env="TSAN_OPTIONS=report_atomic_races=0"
 
 # Clang MSAN - this is the base config for remote-msan and docker-msan. To run this config without
 # our build image, follow https://github.com/google/sanitizers/wiki/MemorySanitizerLibcxxHowTo

.gitignore

@@ -34,3 +34,5 @@ clang.bazelrc
 user.bazelrc
 CMakeLists.txt
 cmake-build-debug
+/linux
+bazel.output.txt

CODEOWNERS

@@ -80,6 +80,8 @@ extensions/filters/common/original_src @snowp @klarose
 /*/extensions/filters/common/expr @kyessenov @yangminzhu @lizan
 # webassembly common extension
 /*/extensions/common/wasm @jplevyak @PiotrSikora @lizan
+# common matcher
+/*/extensions/common/matcher @mattklein123 @yangminzhu
 # common crypto extension
 /*/extensions/common/crypto @lizan @PiotrSikora @bdecoste
 /*/extensions/common/proxy_protocol @alyssawilk @wez470

api/BUILD

@@ -130,6 +130,7 @@ proto_library(
         "//envoy/config/accesslog/v3:pkg",
         "//envoy/config/bootstrap/v3:pkg",
         "//envoy/config/cluster/v3:pkg",
+        "//envoy/config/common/matcher/v3:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/endpoint/v3:pkg",
         "//envoy/config/filter/thrift/router/v2alpha1:pkg",

api/envoy/admin/v3/server_info.proto

@@ -54,7 +54,7 @@ message ServerInfo {
   CommandLineOptions command_line_options = 6;
 }
 
-// [#next-free-field: 34]
+// [#next-free-field: 35]
 message CommandLineOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.admin.v2alpha.CommandLineOptions";
@@ -176,4 +176,7 @@ message CommandLineOptions {
 
   // See :option:`--bootstrap-version` for details.
   uint32 bootstrap_version = 29;
+
+  // See :option:`--enable-fine-grain-logging` for details.
+  bool enable_fine_grain_logging = 34;
 }

api/envoy/config/bootstrap/v3/bootstrap.proto

@@ -305,10 +305,35 @@ message ClusterManager {
 // Envoy process watchdog configuration. When configured, this monitors for
 // nonresponsive threads and kills the process after the configured thresholds.
 // See the :ref:`watchdog documentation <operations_performance_watchdog>` for more information.
-// [#next-free-field: 7]
+// [#next-free-field: 8]
 message Watchdog {
   option (udpa.annotations.versioning).previous_message_type = "envoy.config.bootstrap.v2.Watchdog";
 
+  message WatchdogAction {
+    // The events are fired in this order: KILL, MULTIKILL, MEGAMISS, MISS.
+    // Within an event type, actions execute in the order they are configured.
+    // For KILL/MULTIKILL there is a default PANIC that will run after the
+    // registered actions and kills the process if it wasn't already killed.
+    // It might be useful to specify several debug actions, and possibly an
+    // alternate FATAL action.
+    enum WatchdogEvent {
+      UNKNOWN = 0;
+      KILL = 1;
+      MULTIKILL = 2;
+      MEGAMISS = 3;
+      MISS = 4;
+    }
+
+    // Extension specific configuration for the action.
+    core.v3.TypedExtensionConfig config = 1;
+
+    WatchdogEvent event = 2 [(validate.rules).enum = {defined_only: true}];
+  }
+
+  // Register actions that will fire on given WatchDog events.
+  // See *WatchDogAction* for priority of events.
+  repeated WatchdogAction actions = 7;
+
   // The duration after which Envoy counts a nonresponsive thread in the
   // *watchdog_miss* statistic. If not specified the default is 200ms.
   google.protobuf.Duration miss_timeout = 1;

api/envoy/config/common/matcher/v3/BUILD

@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/config/route/v3:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)

api/envoy/config/common/matcher/v3/matcher.proto

@@ -0,0 +1,100 @@
+syntax = "proto3";
+
+package envoy.config.common.matcher.v3;
+
+import "envoy/config/route/v3/route_components.proto";
+
+import "udpa/annotations/migrate.proto";
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.config.common.matcher.v3";
+option java_outer_classname = "MatcherProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Unified Matcher API]
+
+// Match configuration. This is a recursive structure which allows complex nested match
+// configurations to be built using various logical operators.
+// [#next-free-field: 11]
+message MatchPredicate {
+  // A set of match configurations used for logical operations.
+  message MatchSet {
+    // The list of rules that make up the set.
+    repeated MatchPredicate rules = 1 [(validate.rules).repeated = {min_items: 2}];
+  }
+
+  oneof rule {
+    option (validate.required) = true;
+
+    // A set that describes a logical OR. If any member of the set matches, the match configuration
+    // matches.
+    MatchSet or_match = 1;
+
+    // A set that describes a logical AND. If all members of the set match, the match configuration
+    // matches.
+    MatchSet and_match = 2;
+
+    // A negation match. The match configuration will match if the negated match condition matches.
+    MatchPredicate not_match = 3;
+
+    // The match configuration will always match.
+    bool any_match = 4 [(validate.rules).bool = {const: true}];
+
+    // HTTP request headers match configuration.
+    HttpHeadersMatch http_request_headers_match = 5;
+
+    // HTTP request trailers match configuration.
+    HttpHeadersMatch http_request_trailers_match = 6;
+
+    // HTTP response headers match configuration.
+    HttpHeadersMatch http_response_headers_match = 7;
+
+    // HTTP response trailers match configuration.
+    HttpHeadersMatch http_response_trailers_match = 8;
+
+    // HTTP request generic body match configuration.
+    HttpGenericBodyMatch http_request_generic_body_match = 9;
+
+    // HTTP response generic body match configuration.
+    HttpGenericBodyMatch http_response_generic_body_match = 10;
+  }
+}
+
+// HTTP headers match configuration.
+message HttpHeadersMatch {
+  // HTTP headers to match.
+  repeated route.v3.HeaderMatcher headers = 1;
+}
+
+// HTTP generic body match configuration.
+// List of text strings and hex strings to be located in HTTP body.
+// All specified strings must be found in the HTTP body for positive match.
+// The search may be limited to specified number of bytes from the body start.
+//
+// .. attention::
+//
+//   Searching for patterns in HTTP body is potentially cpu intensive. For each specified pattern, http body is scanned byte by byte to find a match.
+//   If multiple patterns are specified, the process is repeated for each pattern. If location of a pattern is known, ``bytes_limit`` should be specified
+//   to scan only part of the http body.
+message HttpGenericBodyMatch {
+  message GenericTextMatch {
+    oneof rule {
+      option (validate.required) = true;
+
+      // Text string to be located in HTTP body.
+      string string_match = 1;
+
+      // Sequence of bytes to be located in HTTP body.
+      bytes binary_match = 2;
+    }
+  }
+
+  // Limits search to specified number of bytes - default zero (no limit - match entire captured buffer).
+  uint32 bytes_limit = 1;
+
+  // List of patterns to match.
+  repeated GenericTextMatch patterns = 2 [(validate.rules).repeated = {min_items: 1}];
+}