Envoy's L7 Go extension API

api/BUILD

@@ -73,6 +73,7 @@ proto_library(
     visibility = ["//visibility:public"],
     deps = [
         "//contrib/envoy/extensions/filters/http/dynamo/v3:pkg",
+        "//contrib/envoy/extensions/filters/http/golang/v3alpha:pkg",
         "//contrib/envoy/extensions/filters/http/language/v3alpha:pkg",
         "//contrib/envoy/extensions/filters/http/squash/v3:pkg",
         "//contrib/envoy/extensions/filters/http/sxg/v3alpha:pkg",

api/contrib/envoy/extensions/filters/http/golang/v3alpha/BUILD

@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+        "@com_github_cncf_udpa//xds/annotations/v3:pkg",
+    ],
+)

api/contrib/envoy/extensions/filters/http/golang/v3alpha/golang.proto

@@ -0,0 +1,214 @@
+syntax = "proto3";
+
+package envoy.extensions.filters.http.golang.v3alpha;
+
+import "google/protobuf/any.proto";
+
+import "xds/annotations/v3/status.proto";
+
+import "udpa/annotations/status.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.filters.http.golang.v3alpha";
+option java_outer_classname = "GolangProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/golang/v3alpha";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+option (xds.annotations.v3.file_status).work_in_progress = true;
+
+// [#protodoc-title: golang extension filter]
+// Golang :ref:`configuration overview <config_http_filters_golang>`.
+// [#extension: envoy.filters.http.golang]
+//
+// In the below example, we configured the go plugin 'auth' and 'limit' dynamic libraries into
+// Envoy, which can avoid rebuilding Envoy.
+//
+// * Develop go-plugin
+//
+// We can implement the interface of ``StreamFilter <contrib/golang/filters/http/source/go/pkg/api.StreamFilter>``
+// API by the GO language to achieve the effects of Envoy native filter.
+//
+// The filter based on the APIs implementation ``StreamFilter <contrib/golang/filters/http/source/go/pkg/api.StreamFilter>``
+// For details, take a look at the :repo:`/contrib/golang/filters/http/test/test_data/echo`.
+//
+// Then put the GO plugin source code into the ${OUTPUT}/src/ directory with the name of the plugin
+// for GO plugin builds.
+// The following examples implement limit and auth GO plugins.
+//
+// .. code-block:: bash
+//
+//   $ tree /home/admin/envoy/go-plugins/src/
+//     |--auth
+//     |   |--config.go
+//     |   |--filter.go
+//     ---limit
+//         |--config.go
+//         |--filter.go
+//
+// * Build go-plugin
+//
+// Build the Go plugin so by `go_plugin_generate.sh` script, below example the `liblimit.so` and
+// `libauth.so` will be generated in the `/home/admin/envoy/go-plugins/` directory.
+//
+// .. code-block:: bash
+//
+//   #!/bin/bash
+//   if [ $# != 2 ]; then
+//      echo "need input the go plugin name"
+//      exit 1
+//   fi
+//
+//   PLUGINNAME=$1
+//   OUTPUT=/home/admin/envoy/go-plugins/
+//   PLUGINSRCDIR=${OUTPUT}/src/${PLUGINNAME}
+//   go build --buildmode=c-shared  -v -o $OUTPUT/lib${PLUGINNAME}.so $PLUGINSRCDIR
+//
+// .. code-block:: bash
+//
+//   $ go_plugin_generate.sh limit
+//   $ go_plugin_generate.sh auth
+//
+// * Configure go-plugin
+//
+// Use the http filter of :ref: `golang <envoy.filters.http.golang>` to specify
+// :ref: `library` <envoy.filters.http.golang> in ingress and egress to enable the plugin.
+//
+// Example:
+//
+// .. code-block:: yaml
+//
+//   static_resources:
+//     listeners:
+//       - name: ingress
+//         address:
+//           socket_address:
+//             protocol: TCP
+//             address: 0.0.0.0
+//             port_value: 8080
+//         filter_chains:
+//           - filters:
+//               - name: envoy.filters.network.http_connection_manager
+//               ......
+//                   http_filters:
+//                     - name: envoy.filters.http.golang
+//                       typed_config:
+//                         "@type": type.googleapis.com/envoy.extensions.filters.http.golang.v3alpha.Config
+//                         library_id: limit-id
+//                         library_path: "/home/admin/envoy/go-plugins/liblimit.so"
+//                         plugine_name: limit
+//                         plugin_config:
+//                           "@type": type.googleapis.com/envoy.extensions.filters.http.golang.plugins.limit.v3.Config
+//                           xxx1: xx1
+//                           xxx2: xx2
+//                     - name: envoy.filters.http.header_to_metadata
+//                     - name: envoy.filters.http.golang
+//                       typed_config:
+//                         "@type": type.googleapis.com/envoy.extensions.filters.http.golang.v3alpha.Config
+//                         library_id: auth-id
+//                         library_path: "/home/admin/envoy/go-plugins/libauth.so"
+//                         plugine_name: auth
+//                         plugin_config:
+//                           "@type": type.googleapis.com/envoy.extensions.filters.http.golang.plugins.auth.v3.Config
+//                           xxx1: xx1
+//                           xxx2: xx2
+//                     - name: envoy.filters.http.router
+//       - name: egress
+//         address:
+//           socket_address:
+//             protocol: TCP
+//             address: 0.0.0.0
+//             port_value: 8081
+//         filter_chains:
+//           - filters:
+//               - name: envoy.filters.network.http_connection_manager
+//                   ......
+//                   http_filters:
+//                     - name: envoy.filters.http.golang
+//                       typed_config:
+//                         "@type": type.googleapis.com/envoy.extensions.filters.http.golang.v3alpha.Config
+//                         library_id: auth-id
+//                         library_path: "/home/admin/envoy/go-plugins/libauth.so"
+//                         plugine_name: auth
+//                         plugin_config:
+//                           "@type": type.googleapis.com/envoy.extensions.filters.http.golang.plugins.auth.v3.Config
+//                           xxx1: xx1
+//                           xxx2: xx2
+//                     - name: envoy.filters.http.router
+// [#next-free-field: 6]
+message Config {
+  enum MergePolicy {
+    MERGE_VIRTUALHOST_ROUTER_FILTER = 0;
+    MERGE_VIRTUALHOST_ROUTER = 1;
+    OVERRIDE = 3;
+  }
+
+  // library_id is a unique ID for a dynamic library file, must be unique globally.
+  string library_id = 1 [(validate.rules).string = {min_len: 1}];
+
+  // Dynamic library implementing the interface of
+  // ``StreamFilter <contrib/golang/filters/http/source/go/pkg/api.StreamFilter>``.
+  // [#comment:TODO(wangfakang): Support for downloading libraries from remote repositories.]
+  string library_path = 2 [(validate.rules).string = {min_len: 1}];
+
+  // plugin_name is the name of the go plugin, which needs to be consistent with the name
+  // registered in http::RegisterHttpFilterConfigFactory.
+  string plugin_name = 3 [(validate.rules).string = {min_bytes: 1}];
+
+  // plugin_config is the configuration of the go plugin, note that this configuration is
+  // only parsed in the go plugin.
+  google.protobuf.Any plugin_config = 4;
+
+  // merge_policy is the merge policy configured by the go plugin.
+  // go plugin configuration supports three dimensions: the virtual host’s typed_per_filter_config,
+  // the route’s typed_per_filter_config or filter's config.
+  // The meanings are as follows:
+  // MERGE_VIRTUALHOST_ROUTER_FILTER: pass all configuration into go plugin.
+  // MERGE_VIRTUALHOST_ROUTER: pass Virtual-Host and Router configuration into go plugin.
+  // OVERRIDE: override according to Router > Virtual_host > Filter priority and pass the
+  // configuration to the go plugin.
+  MergePolicy merge_policy = 5 [(validate.rules).enum = {defined_only: true}];
+}
+
+message RouterPlugin {
+  // Example
+  //
+  // .. code-block:: yaml
+  //
+  //   typed_per_filter_config:
+  //     envoy.filters.http.golang:
+  //       "@type": type.googleapis.com/envoy.extensions.filters.http.golang.v3alpha.ConfigsPerRoute
+  //       plugins_config:
+  //         plugin1:
+  //          disabled: true
+  oneof override {
+    option (validate.required) = true;
+
+    // [#not-implemented-hide:]
+    // Disable the filter for this particular vhost or route.
+    // If disabled is specified in multiple per-filter-configs, the most specific one will be used.
+    bool disabled = 1 [(validate.rules).bool = {const: true}];
+
+    // The config field is used to setting per-route plugin config.
+    google.protobuf.Any config = 2;
+  }
+}
+
+message ConfigsPerRoute {
+  // plugins_config is the configuration of the go plugin at the per-router, and
+  // key is the name of the go plugin.
+  // Example
+  //
+  // .. code-block:: yaml
+  //
+  //   typed_per_filter_config:
+  //     envoy.filters.http.golang:
+  //       "@type": type.googleapis.com/envoy.extensions.filters.http.golang.v3alpha.ConfigsPerRoute
+  //       plugins_config:
+  //         plugin1:
+  //          disabled: true
+  //         plugin2:
+  //          config:
+  //            "@type": type.googleapis.com/golang.http.plugin2
+  //            xxx: xxx
+  map<string, RouterPlugin> plugins_config = 1;
+}

api/versioning/BUILD

@@ -11,6 +11,7 @@ proto_library(
     deps = [
         "//contrib/envoy/extensions/config/v3alpha:pkg",
         "//contrib/envoy/extensions/filters/http/dynamo/v3:pkg",
+        "//contrib/envoy/extensions/filters/http/golang/v3alpha:pkg",
         "//contrib/envoy/extensions/filters/http/language/v3alpha:pkg",
         "//contrib/envoy/extensions/filters/http/squash/v3:pkg",
         "//contrib/envoy/extensions/filters/http/sxg/v3alpha:pkg",

bazel/dependency_imports.bzl

@@ -15,7 +15,7 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "register_jq_toolchains", "regis
 load("@com_google_cel_cpp//bazel:deps.bzl", "parser_deps")
 
 # go version for rules_go
-GO_VERSION = "1.17.5"
+GO_VERSION = "1.18"
 
 JQ_VERSION = "1.6"
 YQ_VERSION = "4.24.4"
@@ -94,6 +94,20 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
         # use_category = ["api"],
         # source = "https://github.com/bufbuild/protoc-gen-validate/blob/v0.6.1/dependencies.bzl#L148-L153"
     )
+    go_repository(
+        name = "org_golang_google_protobuf",
+        importpath = "google.golang.org/protobuf",
+        sum = "h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=",
+        version = "v1.28.1",
+        build_external = "external",
+    )
+    go_repository(
+        name = "com_github_cncf_xds_go",
+        importpath = "github.com/cncf/xds/go",
+        sum = "h1:B/lvg4tQ5hfFZd4V2hcSfFVfUvAK6GSFKxIIzwnkv8g=",
+        version = "v0.0.0-20220520190051-1e77728a1eaa",
+        build_external = "external",
+    )
     go_repository(
         name = "com_github_spf13_afero",
         importpath = "github.com/spf13/afero",

bazel/exported_symbols.txt

@@ -1,3 +1,4 @@
 {
 	lua*;
+	envoyGoFilterHttp*;
 };

changelogs/current.yaml

@@ -167,6 +167,9 @@ new_features:
   change: |
     added :ref:`dubbo codec support <envoy_v3_api_msg_extensions.filters.network.generic_proxy.codecs.dubbo.v3.DubboCodecConfig>` to the
     :ref:`generic_proxy filter <envoy_v3_api_msg_extensions.filters.network.generic_proxy.v3.GenericProxy>`.
+- area: golang
+  change: |
+    added new :ref:`HTTP golang extension filter <config_http_filters_golang>`.
 - area: custom response http filter
   change: |
     added :ref:`custom response http filter <config_http_filters_custom_response>` which adds the ability to customize responses sent to downstreams using local or remote sources.

contrib/contrib_build_config.bzl

@@ -5,6 +5,7 @@ CONTRIB_EXTENSIONS = {
     #
 
     "envoy.filters.http.dynamo":                                "//contrib/dynamo/filters/http/source:config",
+    "envoy.filters.http.golang":                                "//contrib/golang/filters/http/source:config",
     "envoy.filters.http.language":                              "//contrib/language/filters/http/source:config_lib",
     "envoy.filters.http.squash":                                "//contrib/squash/filters/http/source:config",
     "envoy.filters.http.sxg":                                   "//contrib/sxg/filters/http/source:config",

contrib/extensions_metadata.yaml

@@ -3,6 +3,11 @@ envoy.filters.http.dynamo:
   - envoy.filters.http
   security_posture: requires_trusted_downstream_and_upstream
   status: stable
+envoy.filters.http.golang:
+  categories:
+  - envoy.filters.http
+  security_posture: requires_trusted_downstream_and_upstream
+  status: alpha
 envoy.filters.http.squash:
   categories:
   - envoy.filters.http

contrib/golang/filters/http/source/BUILD

@@ -0,0 +1,79 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_contrib_extension",
+    "envoy_cc_library",
+    "envoy_contrib_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+# Golang extensions filter.
+# Public docs: https://envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/golang_filter
+
+envoy_contrib_package()
+
+envoy_cc_library(
+    name = "golang_filter_lib",
+    srcs = [
+        "golang_filter.cc",
+        "processor_state.cc",
+    ],
+    hdrs = [
+        "golang_filter.h",
+        "processor_state.h",
+    ],
+    deps = [
+        ":cgo",
+        "//contrib/golang/filters/http/source/common/dso:dso_lib",
+        "//envoy/http:codes_interface",
+        "//envoy/http:filter_interface",
+        "//source/common/buffer:watermark_buffer_lib",
+        "//source/common/common:enum_to_int",
+        "//source/common/common:linked_object",
+        "//source/common/common:thread_lib",
+        "//source/common/common:utility_lib",
+        "//source/common/grpc:context_lib",
+        "//source/common/http:headers_lib",
+        "//source/common/http:utility_lib",
+        "//source/common/http/http1:codec_lib",
+        "@envoy_api//contrib/envoy/extensions/filters/http/golang/v3alpha:pkg_cc_proto",
+    ],
+)
+
+envoy_cc_contrib_extension(
+    name = "config",
+    srcs = ["config.cc"],
+    hdrs = ["config.h"],
+    deps = [
+        ":golang_filter_lib",
+        "//contrib/golang/filters/http/source/common/dso:dso_lib",
+        "//envoy/registry",
+        "//envoy/server:filter_config_interface",
+        "//envoy/server:lifecycle_notifier_interface",
+        "//source/extensions/filters/http/common:factory_base_lib",
+        "@envoy_api//contrib/envoy/extensions/filters/http/golang/v3alpha:pkg_cc_proto",
+    ],
+)
+
+envoy_cc_library(
+    name = "cgo",
+    srcs = ["cgo.cc"],
+    hdrs = [
+        "golang_filter.h",
+        "processor_state.h",
+    ],
+    deps = [
+        "//contrib/golang/filters/http/source/common/dso:dso_lib",
+        "//envoy/http:codes_interface",
+        "//envoy/http:filter_interface",
+        "//source/common/buffer:watermark_buffer_lib",
+        "//source/common/common:enum_to_int",
+        "//source/common/common:linked_object",
+        "//source/common/common:utility_lib",
+        "//source/common/grpc:context_lib",
+        "//source/common/http:headers_lib",
+        "//source/common/http:utility_lib",
+        "//source/common/http/http1:codec_lib",
+        "@envoy_api//contrib/envoy/extensions/filters/http/golang/v3alpha:pkg_cc_proto",
+    ],
+)