http: support creating filters with match tree

api/BUILD

@@ -167,6 +167,8 @@ proto_library(
         "//envoy/extensions/compression/gzip/decompressor/v3:pkg",
         "//envoy/extensions/filters/common/fault/v3:pkg",
         "//envoy/extensions/filters/common/matcher/action/v3:pkg",
+        "//envoy/extensions/filters/common/matcher/http/v3:pkg",
+        "//envoy/extensions/filters/common/matcher/input/http/v3:pkg",
         "//envoy/extensions/filters/http/adaptive_concurrency/v3:pkg",
         "//envoy/extensions/filters/http/admission_control/v3alpha:pkg",
         "//envoy/extensions/filters/http/aws_lambda/v3:pkg",

api/envoy/extensions/filters/common/matcher/input/http/v3/BUILD

@@ -0,0 +1,9 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"],
+)

api/envoy/extensions/filters/common/matcher/input/http/v3/http_inputs.proto

@@ -0,0 +1,35 @@
+syntax = "proto3";
+
+package envoy.extensions.filters.common.matcher.input.http.v3;
+
+import "udpa/annotations/migrate.proto";
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.filters.common.matcher.input.http.v3";
+option java_outer_classname = "HttpInputsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Common HTTP Inputs]
+
+// Match input indicates that matching should be done on a specific request header.
+// The resulting input string will be all headers for the given key joined by a comma,
+// e.g. if the request contains two 'foo' headers with value 'bar' and 'baz', the input
+// string will be 'bar,baz'.
+// TODO(snowp): Link to unified matching docs.
+message HttpRequestHeaderMatchInput {
+  // The request header to match on.
+  string header_name = 1;
+}
+
+// Match input indicating that matching should be done on a specific response header.
+// The resulting input string will be all headers for the given key joined by a comma,
+// e.g. if the response contains two 'foo' headers with value 'bar' and 'baz', the input
+// string will be 'bar,baz'.
+// TODO(snowp): Link to unified matching docs.
+message HttpResponseHeaderMatchInput {
+  // The response header to match on.
+  string header_name = 1;
+}

api/versioning/BUILD

@@ -50,6 +50,8 @@ proto_library(
         "//envoy/extensions/compression/gzip/decompressor/v3:pkg",
         "//envoy/extensions/filters/common/fault/v3:pkg",
         "//envoy/extensions/filters/common/matcher/action/v3:pkg",
+        "//envoy/extensions/filters/common/matcher/http/v3:pkg",
+        "//envoy/extensions/filters/common/matcher/input/http/v3:pkg",
         "//envoy/extensions/filters/http/adaptive_concurrency/v3:pkg",
         "//envoy/extensions/filters/http/admission_control/v3alpha:pkg",
         "//envoy/extensions/filters/http/aws_lambda/v3:pkg",

include/envoy/http/filter.h

@@ -867,6 +867,8 @@ using StreamFilterSharedPtr = std::shared_ptr<StreamFilter>;
 
 class HttpMatchingData {
 public:
+  static absl::string_view name() { return "http"; }
+
   virtual ~HttpMatchingData() = default;
 
   virtual RequestHeaderMapOptConstRef requestHeaders() const PURE;

include/envoy/matcher/matcher.h

@@ -7,6 +7,7 @@
 #include "envoy/config/common/matcher/v3/matcher.pb.h"
 #include "envoy/config/core/v3/extension.pb.h"
 #include "envoy/config/typed_config.h"
+#include "envoy/protobuf/message_validator.h"
 
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
@@ -209,7 +210,9 @@ template <class DataType> class DataInputFactory : public Config::TypedFactory {
   /**
    * Creates a DataInput from the provided config.
    */
-  virtual DataInputPtr<DataType> createDataInput(const Protobuf::Message& config) PURE;
+  virtual DataInputPtr<DataType>
+  createDataInput(const Protobuf::Message& config,
+                  ProtobufMessage::ValidationVisitor& validation_visitor) PURE;
 
   /**
    * The category of this factory depends on the DataType, so we require a name() function to exist

source/common/http/BUILD

@@ -177,6 +177,8 @@ envoy_cc_library(
         "//source/common/local_reply:local_reply_lib",
         "//source/common/matcher:matcher_lib",
         "@envoy_api//envoy/extensions/filters/common/matcher/action/v3:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/common/matcher/input/http/v3:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
     ],
 )
 
@@ -242,6 +244,7 @@ envoy_cc_library(
         "//source/common/http/http2:codec_lib",
         "//source/common/http/http3:quic_codec_factory_lib",
         "//source/common/http/http3:well_known_names",
+        "//source/common/http/match_wrapper:config",
         "//source/common/network:utility_lib",
         "//source/common/router:config_lib",
         "//source/common/router:scoped_rds_lib",

source/common/http/filter_manager.cc

@@ -15,6 +15,8 @@ namespace Envoy {
 namespace Http {
 
 namespace {
+REGISTER_FACTORY(HttpRequestHeadersDataInputFactory, Matcher::DataInputFactory<HttpMatchingData>);
+REGISTER_FACTORY(SkipActionFactory, Matcher::ActionFactory);
 
 template <class T> using FilterList = std::list<std::unique_ptr<T>>;
 

source/common/http/filter_manager.h

@@ -1,11 +1,13 @@
 #pragma once
 
-#include <memory>
-
 #include "envoy/extensions/filters/common/matcher/action/v3/skip_action.pb.h"
+#include "envoy/extensions/filters/common/matcher/input/http/v3/http_inputs.pb.validate.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.validate.h"
 #include "envoy/http/filter.h"
 #include "envoy/http/header_map.h"
 #include "envoy/matcher/matcher.h"
+#include "envoy/protobuf/message_validator.h"
 
 #include "common/buffer/watermark_buffer.h"
 #include "common/common/dump_state_utils.h"
@@ -16,6 +18,7 @@
 #include "common/http/headers.h"
 #include "common/local_reply/local_reply.h"
 #include "common/matcher/matcher.h"
+#include "common/protobuf/utility.h"
 
 namespace Envoy {
 namespace Http {
@@ -103,6 +106,25 @@ class HttpRequestHeadersDataInput : public HttpHeadersDataInputBase<RequestHeade
   }
 };
 
+class HttpRequestHeadersDataInputFactory : public Matcher::DataInputFactory<HttpMatchingData> {
+public:
+  std::string name() const override { return "request-headers"; }
+  Matcher::DataInputPtr<HttpMatchingData>
+  createDataInput(const Protobuf::Message& config,
+                  ProtobufMessage::ValidationVisitor& validation_visitor) override {
+    const auto& typed_config =
+        MessageUtil::downcastAndValidate<const envoy::extensions::filters::common::matcher::input::
+                                             http::v3::HttpRequestHeaderMatchInput&>(
+            config, validation_visitor);
+
+    return std::make_unique<HttpRequestHeadersDataInput>(typed_config.header_name());
+  };
+  ProtobufTypes::MessagePtr createEmptyConfigProto() override {
+    return std::make_unique<envoy::extensions::filters::common::matcher::input::http::v3::
+                                HttpRequestHeaderMatchInput>();
+  }
+};
+
 class HttpResponseHeadersDataInput : public HttpHeadersDataInputBase<ResponseHeaderMap> {
 public:
   explicit HttpResponseHeadersDataInput(const std::string& name) : HttpHeadersDataInputBase(name) {}
@@ -113,9 +135,38 @@ class HttpResponseHeadersDataInput : public HttpHeadersDataInputBase<ResponseHea
   }
 };
 
+class HttpResponseHeadersDataInputFactory : public Matcher::DataInputFactory<HttpMatchingData> {
+public:
+  std::string name() const override { return "response-headers"; }
+  Matcher::DataInputPtr<HttpMatchingData>
+  createDataInput(const Protobuf::Message& config,
+                  ProtobufMessage::ValidationVisitor& validation_visitor) override {
+    const auto& typed_config =
+        MessageUtil::downcastAndValidate<const envoy::extensions::filters::common::matcher::input::
+                                             http::v3::HttpRequestHeaderMatchInput&>(
+            config, validation_visitor);
+
+    return std::make_unique<HttpResponseHeadersDataInput>(typed_config.header_name());
+  };
+  ProtobufTypes::MessagePtr createEmptyConfigProto() override {
+    return std::make_unique<envoy::extensions::filters::common::matcher::input::http::v3::
+                                HttpResponseHeaderMatchInput>();
+  }
+};
+
 class SkipAction : public Matcher::ActionBase<
                        envoy::extensions::filters::common::matcher::action::v3::SkipFilter> {};
 
+class SkipActionFactory : public Matcher::ActionFactory {
+public:
+  std::string name() const override { return "skip"; }
+  Matcher::ActionFactoryCb createActionFactoryCb(const Protobuf::Message&) override {
+    return []() { return std::make_unique<SkipAction>(); };
+  }
+  ProtobufTypes::MessagePtr createEmptyConfigProto() override {
+    return std::make_unique<envoy::extensions::filters::common::matcher::action::v3::SkipFilter>();
+  }
+};
 /**
  * Base class wrapper for both stream encoder and decoder filters.
  *

source/common/http/match_wrapper/BUILD

@@ -0,0 +1,23 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_package()
+
+envoy_cc_library(
+    name = "config",
+    srcs = ["config.cc"],
+    hdrs = ["config.h"],
+    deps = [
+        "//include/envoy/registry",
+        "//include/envoy/server:filter_config_interface",
+        "//source/common/matcher:matcher_lib",
+        "//source/extensions/filters/http:well_known_names",
+        "//source/extensions/filters/http/common:factory_base_lib",
+        "@envoy_api//envoy/extensions/common/matching/v3:pkg_cc_proto",
+    ],
+)

source/common/http/match_wrapper/config.cc

@@ -0,0 +1,90 @@
+#include "common/http/match_wrapper/config.h"
+
+#include "envoy/http/filter.h"
+#include "envoy/matcher/matcher.h"
+#include "envoy/registry/registry.h"
+
+#include "common/config/utility.h"
+#include "common/matcher/matcher.h"
+
+namespace Envoy {
+namespace Common {
+namespace Http {
+namespace MatchWrapper {
+
+namespace {
+struct DelegatingFactoryCallbacks : public Envoy::Http::FilterChainFactoryCallbacks {
+  DelegatingFactoryCallbacks(Envoy::Http::FilterChainFactoryCallbacks& delegated_callbacks,
+                             Matcher::MatchTreeSharedPtr<Envoy::Http::HttpMatchingData> match_tree)
+      : delegated_callbacks_(delegated_callbacks), match_tree_(std::move(match_tree)) {}
+
+  void addStreamDecoderFilter(Envoy::Http::StreamDecoderFilterSharedPtr filter) override {
+    delegated_callbacks_.addStreamDecoderFilter(std::move(filter), match_tree_);
+  }
+  void addStreamDecoderFilter(
+      Envoy::Http::StreamDecoderFilterSharedPtr filter,
+      Matcher::MatchTreeSharedPtr<Envoy::Http::HttpMatchingData> match_tree) override {
+    delegated_callbacks_.addStreamDecoderFilter(std::move(filter), std::move(match_tree));
+  }
+  void addStreamEncoderFilter(Envoy::Http::StreamEncoderFilterSharedPtr filter) override {
+    delegated_callbacks_.addStreamEncoderFilter(std::move(filter), match_tree_);
+  }
+  void addStreamEncoderFilter(
+      Envoy::Http::StreamEncoderFilterSharedPtr filter,
+      Matcher::MatchTreeSharedPtr<Envoy::Http::HttpMatchingData> match_tree) override {
+    delegated_callbacks_.addStreamEncoderFilter(std::move(filter), std::move(match_tree));
+  }
+  void addStreamFilter(Envoy::Http::StreamFilterSharedPtr filter) override {
+    delegated_callbacks_.addStreamFilter(std::move(filter), match_tree_);
+  }
+  void
+  addStreamFilter(Envoy::Http::StreamFilterSharedPtr filter,
+                  Matcher::MatchTreeSharedPtr<Envoy::Http::HttpMatchingData> match_tree) override {
+    delegated_callbacks_.addStreamFilter(std::move(filter), std::move(match_tree));
+  }
+  void addAccessLogHandler(AccessLog::InstanceSharedPtr handler) override {
+    delegated_callbacks_.addAccessLogHandler(std::move(handler));
+  }
+
+  Envoy::Http::FilterChainFactoryCallbacks& delegated_callbacks_;
+  Matcher::MatchTreeSharedPtr<Envoy::Http::HttpMatchingData> match_tree_;
+};
+} // namespace
+
+Envoy::Http::FilterFactoryCb MatchWrapperConfig::createFilterFactoryFromProtoTyped(
+    const envoy::extensions::common::matching::v3::ExtensionWithMatcher& proto_config,
+    const std::string& prefix, Server::Configuration::FactoryContext& context) {
+
+  ASSERT(proto_config.has_extension_config());
+  auto& factory =
+      Config::Utility::getAndCheckFactory<Server::Configuration::NamedHttpFilterConfigFactory>(
+          proto_config.extension_config());
+
+  auto message = Config::Utility::translateAnyToFactoryConfig(
+      proto_config.extension_config().typed_config(), context.messageValidationVisitor(), factory);
+  auto filter_factory = factory.createFilterFactoryFromProto(*message, prefix, context);
+
+  auto match_tree =
+      Matcher::MatchTreeFactory<Envoy::Http::HttpMatchingData>(context.messageValidationVisitor())
+          .create(proto_config.matcher());
+
+  return [filter_factory, match_tree](Envoy::Http::FilterChainFactoryCallbacks& callbacks) -> void {
+    DelegatingFactoryCallbacks delegated_callbacks(callbacks, match_tree);
+
+    return filter_factory(delegated_callbacks);
+  };
+}
+
+/**
+ * Static registration for the match wrapper filter. @see RegisterFactory.
+ * Note that we register this as a filter in order to serve as a drop in wrapper for other HTTP
+ * filters. While not a real filter, by being registered as one all the code paths that look up HTTP
+ * filters will look up this filter factory instead, which does the work to create and associate a
+ * match tree with the underlying filter.
+ */
+REGISTER_FACTORY(MatchWrapperConfig, Server::Configuration::NamedHttpFilterConfigFactory);
+
+} // namespace MatchWrapper
+} // namespace Http
+} // namespace Common
+} // namespace Envoy

source/common/http/match_wrapper/config.h

@@ -0,0 +1,28 @@
+#pragma once
+
+#include "envoy/extensions/common/matching/v3/extension_matcher.pb.validate.h"
+#include "envoy/server/filter_config.h"
+
+#include "extensions/filters/http/common/factory_base.h"
+#include "extensions/filters/http/well_known_names.h"
+
+namespace Envoy {
+namespace Common {
+namespace Http {
+namespace MatchWrapper {
+
+class MatchWrapperConfig : public Extensions::HttpFilters::Common::FactoryBase<
+                               envoy::extensions::common::matching::v3::ExtensionWithMatcher> {
+public:
+  MatchWrapperConfig() : FactoryBase("match-wrapper") {}
+
+private:
+  Envoy::Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
+      const envoy::extensions::common::matching::v3::ExtensionWithMatcher& proto_config,
+      const std::string&, Server::Configuration::FactoryContext& context) override;
+};
+
+} // namespace MatchWrapper
+} // namespace Http
+} // namespace Common
+} // namespace Envoy