auto-merge envoyproxy/envoy[release/v1.32] into envoyproxy/envoy-openssl[release/v1.32]

VERSION.txt

@@ -1 +1 @@
-1.32.6-dev
+1.32.7-dev

changelogs/1.31.8.yaml

@@ -0,0 +1,8 @@
+date: May 7, 2025
+
+bug_fixes:
+- area: url_template
+  change: |
+    Included the asterisk ``*`` in the match pattern when using the * or ** operators in the URL template.
+    This behavioral change can be temporarily reverted by setting runtime guard
+    ``envoy.reloadable_features.uri_template_match_on_asterisk`` to ``false``.

changelogs/1.32.6.yaml

@@ -0,0 +1,8 @@
+date: May 7, 2025
+
+bug_fixes:
+- area: url_template
+  change: |
+    Included the asterisk ``*`` in the match pattern when using the * or ** operators in the URL template.
+    This behavioral change can be temporarily reverted by setting runtime guard
+    ``envoy.reloadable_features.uri_template_match_on_asterisk`` to ``false``.

ci/Dockerfile-envoy

@@ -1,6 +1,6 @@
 ARG BUILD_OS=ubuntu
 ARG BUILD_TAG=22.04
-ARG BUILD_SHA=ed1544e454989078f5dec1bfdabd8c5cc9c48e0705d07b678ab6ae3fb61952d2
+ARG BUILD_SHA=67cadaff1dca187079fce41360d5a7eb6f7dcd3745e53c79ad5efd8563118240
 ARG ENVOY_VRP_BASE_IMAGE=envoy-base
 
 
@@ -59,7 +59,7 @@ COPY --chown=0:0 --chmod=755 \
 
 
 # STAGE: envoy-distroless
-FROM gcr.io/distroless/base-nossl-debian12:nonroot@sha256:462657c8bb91f01a95cb1aabdd13d9fd2b816ac2f9fb7fe52ff07bfe50a03b38 AS envoy-distroless
+FROM gcr.io/distroless/base-nossl-debian12:nonroot@sha256:d1fc914c43cea489c26c896721344a49a1761b9bb678bcba1758772d22913302 AS envoy-distroless
 EXPOSE 10000
 ENTRYPOINT ["/usr/local/bin/envoy"]
 CMD ["-c", "/etc/envoy/envoy.yaml"]

docs/root/start/install.rst

@@ -110,8 +110,7 @@ The Envoy project currently supports ``amd64`` and ``arm64`` architectures for i
 
 Contrib builds
 ^^^^^^^^^^^^^^
-As described in `this document <https://docs.google.com/document/d/1yl7GOZK1TDm_7vxQvt8UQEAu07UQFru1uEKXM6ZZg_g/edit#>`_,
-the Envoy project allows extensions to enter the repository as "contrib" extensions. The requirements
+Envoy project allows extensions to enter the repository as "contrib" extensions. The requirements
 for such extensions are lower, and as such they are only available by default in special images.
 
 Throughout the documentation, extensions are clearly marked as being a contrib extension or a core extension.

docs/versions.yaml

@@ -24,5 +24,5 @@
 "1.28": 1.28.7
 "1.29": 1.29.12
 "1.30": 1.30.11
-"1.31": 1.31.7
-"1.32": 1.32.4
+"1.31": 1.31.8
+"1.32": 1.32.5

source/common/runtime/runtime_features.cc

@@ -101,6 +101,7 @@ RUNTIME_GUARD(envoy_reloadable_features_udp_set_do_not_fragment);
 RUNTIME_GUARD(envoy_reloadable_features_udp_socket_apply_aggregated_read_limit);
 RUNTIME_GUARD(envoy_reloadable_features_uhv_allow_malformed_url_encoding);
 RUNTIME_GUARD(envoy_reloadable_features_upstream_remote_address_use_connection);
+RUNTIME_GUARD(envoy_reloadable_features_uri_template_match_on_asterisk);
 RUNTIME_GUARD(envoy_reloadable_features_use_config_in_happy_eyeballs);
 RUNTIME_GUARD(envoy_reloadable_features_use_filter_manager_state_for_downstream_end_stream);
 RUNTIME_GUARD(envoy_reloadable_features_use_http_client_to_fetch_aws_credentials);

source/extensions/path/uri_template_lib/BUILD

@@ -35,6 +35,7 @@ envoy_cc_library(
     hdrs = ["uri_template_internal.h"],
     deps = [
         "//source/common/common:fmt_lib",
+        "//source/common/runtime:runtime_features_lib",
         "@com_google_absl//absl/container:flat_hash_set",
         "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/functional:function_ref",

source/extensions/path/uri_template_lib/uri_template_internal.cc

@@ -7,6 +7,7 @@
 #include <vector>
 
 #include "source/common/common/fmt.h"
+#include "source/common/runtime/runtime_features.h"
 
 #include "absl/container/flat_hash_set.h"
 #include "absl/flags/flag.h"
@@ -46,6 +47,16 @@ constexpr absl::string_view kLiteral = "a-zA-Z0-9-._~" // Unreserved
                                        ":@"
                                        "="; // user included "=" allowed
 
+// Additional literal that allows "*" in the pattern.
+// This should replace "kLiteral" after removal of
+// "reloadable_features.uri_template_match_on_asterisk" runtime guard.
+// Valid pchar from https://datatracker.ietf.org/doc/html/rfc3986#appendix-A
+constexpr absl::string_view kLiteralWithAsterisk = "a-zA-Z0-9-._~" // Unreserved
+                                                   "%"             // pct-encoded
+                                                   "!$&'()+,;"     // sub-delims excluding *=
+                                                   ":@"
+                                                   "=*"; // reserved characters
+
 // Default operator used for the variable when none specified.
 constexpr Operator kDefaultVariableOperator = Operator::PathGlob;
 
@@ -122,17 +133,30 @@ std::string ParsedPathPattern::debugString() const {
 }
 
 bool isValidLiteral(absl::string_view literal) {
+  static const std::string* kValidLiteralRegexAsterisk =
+      new std::string(absl::StrCat("^[", kLiteralWithAsterisk, "]+$"));
   static const std::string* kValidLiteralRegex =
       new std::string(absl::StrCat("^[", kLiteral, "]+$"));
+  static const LazyRE2 literal_regex_asterisk = {kValidLiteralRegexAsterisk->data()};
   static const LazyRE2 literal_regex = {kValidLiteralRegex->data()};
-  return RE2::FullMatch(literal, *literal_regex);
+
+  return Runtime::runtimeFeatureEnabled("envoy.reloadable_features.uri_template_match_on_asterisk")
+             ? RE2::FullMatch(literal, *literal_regex_asterisk)
+             : RE2::FullMatch(literal, *literal_regex);
 }
 
 bool isValidRewriteLiteral(absl::string_view literal) {
   static const std::string* kValidLiteralRegex =
       new std::string(absl::StrCat("^[", kLiteral, "/]+$"));
+  static const std::string* kValidLiteralRegexAsterisk =
+      new std::string(absl::StrCat("^[", kLiteralWithAsterisk, "/]+$"));
+
   static const LazyRE2 literal_regex = {kValidLiteralRegex->data()};
-  return RE2::FullMatch(literal, *literal_regex);
+  static const LazyRE2 literal_regex_asterisk = {kValidLiteralRegexAsterisk->data()};
+
+  return Runtime::runtimeFeatureEnabled("envoy.reloadable_features.uri_template_match_on_asterisk")
+             ? RE2::FullMatch(literal, *literal_regex_asterisk)
+             : RE2::FullMatch(literal, *literal_regex);
 }
 
 bool isValidVariableName(absl::string_view variable) {
@@ -360,11 +384,26 @@ std::string toRegexPattern(absl::string_view pattern) {
 std::string toRegexPattern(Operator pattern) {
   static const std::string* kPathGlobRegex = new std::string(absl::StrCat("[", kLiteral, "]+"));
   static const std::string* kTextGlobRegex = new std::string(absl::StrCat("[", kLiteral, "/]*"));
-  switch (pattern) {
-  case Operator::PathGlob: // "*"
-    return *kPathGlobRegex;
-  case Operator::TextGlob: // "**"
-    return *kTextGlobRegex;
+
+  static const std::string* kPathGlobRegexAsterisk =
+      new std::string(absl::StrCat("[", kLiteralWithAsterisk, "]+"));
+  static const std::string* kTextGlobRegexAsterisk =
+      new std::string(absl::StrCat("[", kLiteralWithAsterisk, "/]*"));
+
+  if (Runtime::runtimeFeatureEnabled("envoy.reloadable_features.uri_template_match_on_asterisk")) {
+    switch (pattern) {
+    case Operator::PathGlob: // "*"
+      return *kPathGlobRegexAsterisk;
+    case Operator::TextGlob: // "**"
+      return *kTextGlobRegexAsterisk;
+    }
+  } else {
+    switch (pattern) {
+    case Operator::PathGlob: // "*"
+      return *kPathGlobRegex;
+    case Operator::TextGlob: // "**"
+      return *kTextGlobRegex;
+    }
   }
   return "";
 }

test/extensions/path/match/uri_template/library_test.cc

@@ -43,6 +43,66 @@ TEST(MatchTest, BasicUsage) {
   EXPECT_TRUE(matcher->match("/bar/en/us"));
 }
 
+TEST(MatchTest, MatchSingleAsteriskInWildcard) {
+  const std::string yaml_string = R"EOF(
+      name: envoy.path.match.uri_template.uri_template_matcher
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig
+        path_template: "/bar/{lang}/{country=**}"
+)EOF";
+
+  Router::PathMatcherSharedPtr matcher = createMatcherFromYaml(yaml_string);
+  EXPECT_EQ(matcher->uriTemplate(), "/bar/{lang}/{country=**}");
+  EXPECT_EQ(matcher->name(), "envoy.path.match.uri_template.uri_template_matcher");
+
+  EXPECT_TRUE(matcher->match("/bar/en/us*"));
+}
+
+TEST(MatchTest, MatchDoubleAsteriskInWildcard) {
+  const std::string yaml_string = R"EOF(
+      name: envoy.path.match.uri_template.uri_template_matcher
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig
+        path_template: "/bar/{lang}/{country=**}"
+)EOF";
+
+  Router::PathMatcherSharedPtr matcher = createMatcherFromYaml(yaml_string);
+  EXPECT_EQ(matcher->uriTemplate(), "/bar/{lang}/{country=**}");
+  EXPECT_EQ(matcher->name(), "envoy.path.match.uri_template.uri_template_matcher");
+
+  EXPECT_TRUE(matcher->match("/bar/en/us**"));
+}
+
+TEST(MatchTest, MatchSingleAsterisk) {
+  const std::string yaml_string = R"EOF(
+      name: envoy.path.match.uri_template.uri_template_matcher
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig
+        path_template: "/bar/{lang}/{country=**}"
+)EOF";
+
+  Router::PathMatcherSharedPtr matcher = createMatcherFromYaml(yaml_string);
+  EXPECT_EQ(matcher->uriTemplate(), "/bar/{lang}/{country=**}");
+  EXPECT_EQ(matcher->name(), "envoy.path.match.uri_template.uri_template_matcher");
+
+  EXPECT_TRUE(matcher->match("/bar/en*/us"));
+}
+
+TEST(MatchTest, MatchDoubleAsterisk) {
+  const std::string yaml_string = R"EOF(
+      name: envoy.path.match.uri_template.uri_template_matcher
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig
+        path_template: "/bar/{lang}/{country=**}"
+)EOF";
+
+  Router::PathMatcherSharedPtr matcher = createMatcherFromYaml(yaml_string);
+  EXPECT_EQ(matcher->uriTemplate(), "/bar/{lang}/{country=**}");
+  EXPECT_EQ(matcher->name(), "envoy.path.match.uri_template.uri_template_matcher");
+
+  EXPECT_TRUE(matcher->match("/bar/en**/us"));
+}
+
 TEST(MatchTest, MatchDoubleEqualsInWildcard) {
   const std::string yaml_string = R"EOF(
       name: envoy.path.match.uri_template.uri_template_matcher

test/extensions/path/rewrite/uri_template/library_test.cc

@@ -71,6 +71,62 @@ TEST(RewriteTest, BasicUsage) {
   EXPECT_EQ(rewriter->name(), "envoy.path.rewrite.uri_template.uri_template_rewriter");
 }
 
+TEST(RewriteTest, SingleAsteriskAtEndOfPath) {
+  const std::string yaml_string = R"EOF(
+      name: envoy.path.rewrite.uri_template.uri_template_rewriter
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.path.rewrite.uri_template.v3.UriTemplateRewriteConfig
+        path_template_rewrite: "/bar/{country}/{final}"
+)EOF";
+
+  Router::PathRewriterSharedPtr rewriter = createRewriterFromYaml(yaml_string);
+  EXPECT_EQ(rewriter->rewritePath("/bar/usa/final*1", "/bar/{final}/{country}").value(),
+            "/bar/final*1/usa");
+  EXPECT_EQ(rewriter->name(), "envoy.path.rewrite.uri_template.uri_template_rewriter");
+}
+
+TEST(RewriteTest, SingleAsterisk) {
+  const std::string yaml_string = R"EOF(
+      name: envoy.path.rewrite.uri_template.uri_template_rewriter
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.path.rewrite.uri_template.v3.UriTemplateRewriteConfig
+        path_template_rewrite: "/bar/{country}/final"
+)EOF";
+
+  Router::PathRewriterSharedPtr rewriter = createRewriterFromYaml(yaml_string);
+  EXPECT_EQ(rewriter->rewritePath("/bar/usa*/final", "/bar/{country}/final").value(),
+            "/bar/usa*/final");
+  EXPECT_EQ(rewriter->name(), "envoy.path.rewrite.uri_template.uri_template_rewriter");
+}
+
+TEST(RewriteTest, DoubleAsteriskAtEndOfPath) {
+  const std::string yaml_string = R"EOF(
+      name: envoy.path.rewrite.uri_template.uri_template_rewriter
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.path.rewrite.uri_template.v3.UriTemplateRewriteConfig
+        path_template_rewrite: "/bar/{country}/{final}"
+)EOF";
+
+  Router::PathRewriterSharedPtr rewriter = createRewriterFromYaml(yaml_string);
+  EXPECT_EQ(rewriter->rewritePath("/bar/usa/final**1", "/bar/{final}/{country}").value(),
+            "/bar/final**1/usa");
+  EXPECT_EQ(rewriter->name(), "envoy.path.rewrite.uri_template.uri_template_rewriter");
+}
+
+TEST(RewriteTest, DoubleAsterisk) {
+  const std::string yaml_string = R"EOF(
+      name: envoy.path.rewrite.uri_template.uri_template_rewriter
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.path.rewrite.uri_template.v3.UriTemplateRewriteConfig
+        path_template_rewrite: "/bar/{country}/final"
+)EOF";
+
+  Router::PathRewriterSharedPtr rewriter = createRewriterFromYaml(yaml_string);
+  EXPECT_EQ(rewriter->rewritePath("/bar/usa**/final", "/bar/{country}/final").value(),
+            "/bar/usa**/final");
+  EXPECT_EQ(rewriter->name(), "envoy.path.rewrite.uri_template.uri_template_rewriter");
+}
+
 TEST(RewriteTest, DoubleEqualAtEndOfPath) {
   const std::string yaml_string = R"EOF(
       name: envoy.path.rewrite.uri_template.uri_template_rewriter

test/extensions/path/uri_template_lib/BUILD

@@ -31,6 +31,7 @@ envoy_cc_test(
     deps = [
         "//source/extensions/path/uri_template_lib:uri_template_internal_cc",
         "//test/test_common:status_utility_lib",
+        "//test/test_common:test_runtime_lib",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",