config: adding connect matcher (unused)

api/envoy/config/route/v3/route_components.proto

@@ -370,7 +370,7 @@ message WeightedCluster {
  string runtime_key_prefix = 2;
 }
 
-// [#next-free-field: 12]
+// [#next-free-field: 13]
 message RouteMatch {
  option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.RouteMatch";
 
@@ -392,6 +392,11 @@ message RouteMatch {
  google.protobuf.BoolValue validated = 2;
  }
 
+ // [#not-implemented-hide:]
+ // An extensible message for matching CONNECT requests.
+ message ConnectMatcher {
+ }
+
  reserved 5, 3;
 
  reserved "regex";
@@ -420,6 +425,16 @@ message RouteMatch {
  // on :path, etc. The issue with that is it is unclear how to generically deal with query string
  // stripping. This needs more thought.]
  type.matcher.v3.RegexMatcher safe_regex = 10 [(validate.rules).message = {required: true}];
+
+ // [#not-implemented-hide:]
+ // If this is used as the matcher, the matcher will only match CONNECT requests.
+ // Note that this will not match HTTP/2 upgrade-style CONNECT requests
+ // (WebSocket and the like) as they are normalized in Envoy as HTTP/1.1 style
+ // upgrades.
+ // This is the only way to match CONNECT requests for HTTP/1.1. For HTTP/2,
+ // where CONNECT requests may have a path, the path matchers will work if
+ // there is a path present.
+ ConnectMatcher connect_matcher = 12;
  }
 
  // Indicates that prefix/path matching should be case insensitive. The default
@@ -705,6 +720,13 @@ message RouteAction {
  option (udpa.annotations.versioning).previous_message_type =
  "envoy.api.v2.route.RouteAction.UpgradeConfig";
 
+ // [#not-implemented-hide:]
+ // Configuration for sending data upstream as a raw data payload. This is used for
+ // CONNECT requests, when forwarding CONNECT payload as raw TCP.
+ message ConnectConfig {
+ // TODO(alyssawilk) add proxy proto configuration here.
+ }
+
  // The case-insensitive name of this upgrade, e.g. "websocket".
  // For each upgrade type present in upgrade_configs, requests with
  // Upgrade: [upgrade_type] will be proxied upstream.
@@ -713,6 +735,11 @@ message RouteAction {
 
  // Determines if upgrades are available on this route. Defaults to true.
  google.protobuf.BoolValue enabled = 2;
+
+ // [#not-implemented-hide:]
+ // Configuration for sending data upstream as a raw data payload. This is used for
+ // CONNECT requests, when forwarding CONNECT payload as raw TCP.
+ ConnectConfig connect_config = 3;
  }
 
  reserved 12, 18, 19, 16, 22, 21, 10;

api/envoy/config/route/v4alpha/route_components.proto

@@ -371,7 +371,7 @@ message WeightedCluster {
  string runtime_key_prefix = 2;
 }
 
-// [#next-free-field: 12]
+// [#next-free-field: 13]
 message RouteMatch {
  option (udpa.annotations.versioning).previous_message_type = "envoy.config.route.v3.RouteMatch";
 
@@ -393,6 +393,13 @@ message RouteMatch {
  google.protobuf.BoolValue validated = 2;
  }
 
+ // [#not-implemented-hide:]
+ // An extensible message for matching CONNECT requests.
+ message ConnectMatcher {
+ option (udpa.annotations.versioning).previous_message_type =
+ "envoy.config.route.v3.RouteMatch.ConnectMatcher";
+ }
+
  reserved 5, 3;
 
  reserved "regex";
@@ -421,6 +428,16 @@ message RouteMatch {
  // on :path, etc. The issue with that is it is unclear how to generically deal with query string
  // stripping. This needs more thought.]
  type.matcher.v3.RegexMatcher safe_regex = 10 [(validate.rules).message = {required: true}];
+
+ // [#not-implemented-hide:]
+ // If this is used as the matcher, the matcher will only match CONNECT requests.
+ // Note that this will not match HTTP/2 upgrade-style CONNECT requests
+ // (WebSocket and the like) as they are normalized in Envoy as HTTP/1.1 style
+ // upgrades.
+ // This is the only way to match CONNECT requests for HTTP/1.1. For HTTP/2,
+ // where CONNECT requests may have a path, the path matchers will work if
+ // there is a path present.
+ ConnectMatcher connect_matcher = 12;
  }
 
  // Indicates that prefix/path matching should be case insensitive. The default
@@ -706,6 +723,16 @@ message RouteAction {
  option (udpa.annotations.versioning).previous_message_type =
  "envoy.config.route.v3.RouteAction.UpgradeConfig";
 
+ // [#not-implemented-hide:]
+ // Configuration for sending data upstream as a raw data payload. This is used for
+ // CONNECT requests, when forwarding CONNECT payload as raw TCP.
+ message ConnectConfig {
+ // TODO(alyssawilk) add proxy proto configuration here.
+
+ option (udpa.annotations.versioning).previous_message_type =
+ "envoy.config.route.v3.RouteAction.UpgradeConfig.ConnectConfig";
+ }
+
  // The case-insensitive name of this upgrade, e.g. "websocket".
  // For each upgrade type present in upgrade_configs, requests with
  // Upgrade: [upgrade_type] will be proxied upstream.
@@ -714,6 +741,11 @@ message RouteAction {
 
  // Determines if upgrades are available on this route. Defaults to true.
  google.protobuf.BoolValue enabled = 2;
+
+ // [#not-implemented-hide:]
+ // Configuration for sending data upstream as a raw data payload. This is used for
+ // CONNECT requests, when forwarding CONNECT payload as raw TCP.
+ ConnectConfig connect_config = 3;
  }
 
  reserved 12, 18, 19, 16, 22, 21, 10;

include/envoy/router/BUILD

@@ -66,6 +66,7 @@ envoy_cc_library(
  "//source/common/protobuf",
  "//source/common/protobuf:utility_lib",
  "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
+ "@envoy_api//envoy/config/route/v3:pkg_cc_proto",
  "@envoy_api//envoy/type/v3:pkg_cc_proto",
  ],
 )

include/envoy/router/router.h

@@ -11,6 +11,7 @@
 #include "envoy/access_log/access_log.h"
 #include "envoy/common/matchers.h"
 #include "envoy/config/core/v3/base.pb.h"
+#include "envoy/config/route/v3/route_components.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/http/codec.h"
 #include "envoy/http/codes.h"
@@ -825,6 +826,12 @@ class RouteEntry : public ResponseEntry {
  */
  virtual const UpgradeMap& upgradeMap() const PURE;
 
+ using ConnectConfig = envoy::config::route::v3::RouteAction::UpgradeConfig::ConnectConfig;
+ /**
+ * If present, informs how to handle proxying CONNECT requests on this route.
+ */
+ virtual const absl::optional<ConnectConfig>& connectConfig() const PURE;
+
  /**
  * @returns the internal redirect action which should be taken on this route.
  */

source/common/http/async_client_impl.cc

@@ -30,6 +30,8 @@ const Config::TypedMetadataImpl<Envoy::Config::TypedMetadataFactory>
  AsyncStreamImpl::RouteEntryImpl::typed_metadata_({});
 const AsyncStreamImpl::NullPathMatchCriterion
  AsyncStreamImpl::RouteEntryImpl::path_match_criterion_;
+const absl::optional<envoy::config::route::v3::RouteAction::UpgradeConfig::ConnectConfig>
+ AsyncStreamImpl::RouteEntryImpl::connect_config_nullopt_;
 const std::list<LowerCaseString> AsyncStreamImpl::NullConfig::internal_only_headers_;
 
 AsyncClientImpl::AsyncClientImpl(Upstream::ClusterInfoConstSharedPtr cluster,

source/common/http/async_client_impl.h

@@ -268,6 +268,9 @@ class AsyncStreamImpl : public AsyncClient::Stream,
  const Router::RouteSpecificFilterConfig* perFilterConfig(const std::string&) const override {
  return nullptr;
  }
+ const absl::optional<ConnectConfig>& connectConfig() const override {
+ return connect_config_nullopt_;
+ }
 
  bool includeAttemptCountInRequest() const override { return false; }
  bool includeAttemptCountInResponse() const override { return false; }
@@ -292,6 +295,7 @@ class AsyncStreamImpl : public AsyncClient::Stream,
  Router::RouteEntry::UpgradeMap upgrade_map_;
  const std::string& cluster_name_;
  absl::optional<std::chrono::milliseconds> timeout_;
+ static const absl::optional<ConnectConfig> connect_config_nullopt_;
  const std::string route_name_;
  };