Update Envoy-WASM SHA to latest. (istio#2956)

* Update Envoy-WASM SHA to latest.

Signed-off-by: Piotr Sikora <[email protected]>

* review: update SHA.

Signed-off-by: Piotr Sikora <[email protected]>

.bazelversion

@@ -1 +1 @@
-3.1.0
+3.4.1

WORKSPACE

@@ -38,10 +38,10 @@ bind(
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
 # Note: this is needed by release builder to resolve envoy dep sha to tag.
-# Commit date: 7/20/20
-ENVOY_SHA = "5dca4c64067783b463af7698411dd7a1d9cc5333"
+# Commit date: 2020-08-05
+ENVOY_SHA = "9ad2c737438c6f51f42bb588517a84603e9a8132"
 
-ENVOY_SHA256 = "4550dfbf5fff8b73c8a3a5fe616c7541dad6e079c93f186c5183a9d56a5d628a"
+ENVOY_SHA256 = "2b433916da4e1e2b6a1a7c2cac760dffaffb3d3c9c6d6efd44193926437f0a0a"
 
 ENVOY_ORG = "envoyproxy"
 
@@ -80,6 +80,21 @@ load("@rules_antlr//antlr:deps.bzl", "antlr_dependencies")
 
 antlr_dependencies(471)
 
+# Bazel @rules_pkg
+
+http_archive(
+    name = "rules_pkg",
+    sha256 = "aeca78988341a2ee1ba097641056d168320ecc51372ef7ff8e64b139516a4937",
+    urls = [
+        "https://github.com/bazelbuild/rules_pkg/releases/download/0.2.6/rules_pkg-0.2.6.tar.gz",
+        "https://mirror.bazel.build/github.com/bazelbuild/rules_pkg/releases/download/0.2.6/rules_pkg-0.2.6.tar.gz",
+    ],
+)
+
+load("@rules_pkg//:deps.bzl", "rules_pkg_dependencies")
+
+rules_pkg_dependencies()
+
 # Docker dependencies
 
 docker_dependencies()
@@ -95,6 +110,10 @@ load("@io_bazel_rules_docker//repositories:deps.bzl", container_deps = "deps")
 
 container_deps()
 
+load("@io_bazel_rules_docker//repositories:pip_repositories.bzl", "pip_deps")
+
+pip_deps()
+
 load(
     "@io_bazel_rules_docker//container:container.bzl",
     "container_pull",

envoy.bazelrc

@@ -13,7 +13,7 @@ startup --host_jvm_args=-Xmx2g
 build --workspace_status_command="bash bazel/get_workspace_status"
 build --experimental_local_memory_estimate
 build --experimental_strict_action_env=true
-build --host_force_python=PY2
+build --host_force_python=PY3
 build --action_env=BAZEL_LINKLIBS=-l%:libstdc++.a
 build --action_env=BAZEL_LINKOPTS=-lm
 build --host_javabase=@bazel_tools//tools/jdk:remote_jdk11
@@ -22,6 +22,8 @@ build --enable_platform_specific_config
 
 # Enable position independent code, this option is not supported on Windows and default on on macOS.
 build:linux --copt=-fPIC
+build:linux --cxxopt=-std=c++17
+build:linux --conlyopt=-fexceptions
 
 # We already have absl in the build, define absl=1 to tell googletest to use absl for backtrace.
 build --define absl=1
@@ -65,6 +67,7 @@ build:clang-asan --config=asan
 build:clang-asan --linkopt -fuse-ld=lld
 
 # macOS ASAN/UBSAN
+build:macos --cxxopt=-std=c++17
 build:macos-asan --config=asan
 # Workaround, see https://github.com/bazelbuild/bazel/issues/6932
 build:macos-asan --copt -Wno-macro-redefined
@@ -81,6 +84,8 @@ build:clang-tsan --define ENVOY_CONFIG_TSAN=1
 build:clang-tsan --copt -fsanitize=thread
 build:clang-tsan --linkopt -fsanitize=thread
 build:clang-tsan --linkopt -fuse-ld=lld
+build:clang-tsan --build_tag_filters=-no_san,-no_tsan
+build:clang-tsan --test_tag_filters=-no_san,-no_tsan
 # Needed due to https://github.com/libevent/libevent/issues/777
 build:clang-tsan --copt -DEVENT__DISABLE_DEBUG_MODE
 
@@ -112,6 +117,7 @@ build --test_env=HEAPCHECK=normal --test_env=PPROF_PATH
 
 # Coverage options
 coverage --config=coverage
+coverage --build_tests_only
 build:coverage --action_env=BAZEL_USE_LLVM_NATIVE_COVERAGE=1
 build:coverage --action_env=GCOV=llvm-profdata
 build:coverage --copt=-DNDEBUG
@@ -128,23 +134,24 @@ build:coverage --strategy=CoverageReport=sandboxed,local
 build:coverage --experimental_use_llvm_covmap
 build:coverage --collect_code_coverage
 build:coverage --test_tag_filters=-nocoverage
-build:coverage --instrumentation_filter="//source(?!/common/chromium_url|/extensions/quic_listeners/quiche/platform)[/:],//include[/:]"
-coverage:test-coverage --test_arg="--log-path /dev/null"
+build:coverage --instrumentation_filter="//source(?!/extensions/quic_listeners/quiche/platform)[/:],//include[/:]"
 coverage:test-coverage --test_arg="-l trace"
-coverage:fuzz-coverage --config=asan-fuzzer
+coverage:fuzz-coverage --config=plain-fuzzer
 coverage:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
 
 # Remote execution: https://docs.bazel.build/versions/master/remote-execution.html
-build:rbe-toolchain --host_platform=@envoy_build_tools//toolchains:rbe_ubuntu_clang_platform
-build:rbe-toolchain --platforms=@envoy_build_tools//toolchains:rbe_ubuntu_clang_platform
 build:rbe-toolchain --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 
 build:rbe-toolchain-clang --config=rbe-toolchain
+build:rbe-toolchain-clang --platforms=@rbe_ubuntu_clang//config:platform
+build:rbe-toolchain-clang --host_platform=@rbe_ubuntu_clang//config:platform
 build:rbe-toolchain-clang --crosstool_top=@rbe_ubuntu_clang//cc:toolchain
 build:rbe-toolchain-clang --extra_toolchains=@rbe_ubuntu_clang//config:cc-toolchain
 build:rbe-toolchain-clang --action_env=CC=clang --action_env=CXX=clang++ --action_env=PATH=/usr/sbin:/usr/bin:/sbin:/bin:/opt/llvm/bin
 
 build:rbe-toolchain-clang-libc++ --config=rbe-toolchain
+build:rbe-toolchain-clang-libc++ --platforms=@rbe_ubuntu_clang_libcxx//config:platform
+build:rbe-toolchain-clang-libc++ --host_platform=@rbe_ubuntu_clang_libcxx//config:platform
 build:rbe-toolchain-clang-libc++ --crosstool_top=@rbe_ubuntu_clang_libcxx//cc:toolchain
 build:rbe-toolchain-clang-libc++ --extra_toolchains=@rbe_ubuntu_clang_libcxx//config:cc-toolchain
 build:rbe-toolchain-clang-libc++ --action_env=CC=clang --action_env=CXX=clang++ --action_env=PATH=/usr/sbin:/usr/bin:/sbin:/bin:/opt/llvm/bin
@@ -156,10 +163,21 @@ build:rbe-toolchain-msan --linkopt=-L/opt/libcxx_msan/lib
 build:rbe-toolchain-msan --linkopt=-Wl,-rpath,/opt/libcxx_msan/lib
 build:rbe-toolchain-msan --config=clang-msan
 
+build:rbe-toolchain-tsan --linkopt=-L/opt/libcxx_tsan/lib
+build:rbe-toolchain-tsan --linkopt=-Wl,-rpath,/opt/libcxx_tsan/lib
+build:rbe-toolchain-tsan --config=clang-tsan
+
 build:rbe-toolchain-gcc --config=rbe-toolchain
+build:rbe-toolchain-gcc --platforms=@rbe_ubuntu_gcc//config:platform
+build:rbe-toolchain-gcc --host_platform=@rbe_ubuntu_gcc//config:platform
 build:rbe-toolchain-gcc --crosstool_top=@rbe_ubuntu_gcc//cc:toolchain
 build:rbe-toolchain-gcc --extra_toolchains=@rbe_ubuntu_gcc//config:cc-toolchain
 
+build:rbe-toolchain-msvc-cl --host_platform=@rbe_windows_msvc_cl//config:platform
+build:rbe-toolchain-msvc-cl --platforms=@rbe_windows_msvc_cl//config:platform
+build:rbe-toolchain-msvc-cl --crosstool_top=@rbe_windows_msvc_cl//cc:toolchain
+build:rbe-toolchain-msvc-cl --extra_toolchains=@rbe_windows_msvc_cl//config:cc-toolchain
+
 build:remote --spawn_strategy=remote,sandboxed,local
 build:remote --strategy=Javac=remote,sandboxed,local
 build:remote --strategy=Closure=remote,sandboxed,local
@@ -168,6 +186,15 @@ build:remote --remote_timeout=7200
 build:remote --auth_enabled=true
 build:remote --remote_download_toplevel
 
+# Windows bazel does not allow sandboxed as a spawn strategy
+build:remote-windows --spawn_strategy=remote,local
+build:remote-windows --strategy=Javac=remote,local
+build:remote-windows --strategy=Closure=remote,local
+build:remote-windows --strategy=Genrule=remote,local
+build:remote-windows --remote_timeout=7200
+build:remote-windows --auth_enabled=true
+build:remote-windows --remote_download_toplevel
+
 build:remote-clang --config=remote
 build:remote-clang --config=rbe-toolchain-clang
 
@@ -181,9 +208,12 @@ build:remote-msan --config=remote
 build:remote-msan --config=rbe-toolchain-clang-libc++
 build:remote-msan --config=rbe-toolchain-msan
 
+build:remote-msvc-cl --config=remote-windows
+build:remote-msvc-cl --config=rbe-toolchain-msvc-cl
+
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/master/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:12b3d2c2ffa582507e5d6dd34632b2b990f1b195
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:923df85a4ba7f30dcd0cb6b0c6d8d604f0e20f48
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker
@@ -205,23 +235,29 @@ build:docker-msan --config=docker-sandbox
 build:docker-msan --config=rbe-toolchain-clang-libc++
 build:docker-msan --config=rbe-toolchain-msan
 
+build:docker-tsan --config=docker-sandbox
+build:docker-tsan --config=rbe-toolchain-clang-libc++
+build:docker-tsan --config=rbe-toolchain-tsan
+
 # CI configurations
 build:remote-ci --remote_cache=grpcs://remotebuildexecution.googleapis.com
 build:remote-ci --remote_executor=grpcs://remotebuildexecution.googleapis.com
 
 # Fuzz builds
-build:asan-fuzzer --config=clang-asan
+# -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION is passed in in the bazel build target
+# rules for fuzz tests. Passing it in the CLI will cause dependencies to be build
+# with the macro. Causing issues in RouteMatcherTest.TestRoutes that expect prod
+# behavior from RE2 library.
+build:asan-fuzzer --config=asan
 build:asan-fuzzer --define=FUZZING_ENGINE=libfuzzer
 build:asan-fuzzer --copt=-fsanitize=fuzzer-no-link
 build:asan-fuzzer --copt=-fno-omit-frame-pointer
-build:asan-fuzzer --copt=-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
 # Remove UBSAN halt_on_error to avoid crashing on protobuf errors.
 build:asan-fuzzer --test_env=UBSAN_OPTIONS=print_stacktrace=1
 
 # Fuzzing without ASAN. This is useful for profiling fuzzers without any ASAN artifacts.
 build:plain-fuzzer --define=FUZZING_ENGINE=libfuzzer
-build:plain-fuzzer --copt=-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
-build:plain-fuzzer --copt=-fsanitize=fuzzer-no-link
+build:plain-fuzzer --define ENVOY_CONFIG_ASAN=1
 
 # Compile database generation config
 # We don't care about built binaries so always strip and use fastbuild.
@@ -243,6 +279,7 @@ build:windows --define manual_stamp=manual_stamp
 build:windows --copt="-DCARES_STATICLIB"
 build:windows --copt="-DNGHTTP2_STATICLIB"
 build:windows --copt="-DCURL_STATICLIB"
+build:windows --cxxopt="/std:c++17"
 
 # Required to work around build defects on Windows MSVC cl
 # Unguarded gcc pragmas in quiche are not recognized by MSVC

extensions/access_log_policy/plugin.cc

@@ -60,13 +60,13 @@ bool setFilterStateValue(bool log) {
 constexpr long long kDefaultLogWindowDurationNanoseconds =
     43200000000000;  // 12h
 
-constexpr StringView kSource = "source";
-constexpr StringView kAddress = "address";
-constexpr StringView kConnection = "connection";
-constexpr StringView kUriSanPeerCertificate = "uri_san_peer_certificate";
-constexpr StringView kResponse = "response";
-constexpr StringView kCode = "code";
-constexpr StringView kGrpcStatus = "grpc_status";
+constexpr std::string_view kSource = "source";
+constexpr std::string_view kAddress = "address";
+constexpr std::string_view kConnection = "connection";
+constexpr std::string_view kUriSanPeerCertificate = "uri_san_peer_certificate";
+constexpr std::string_view kResponse = "response";
+constexpr std::string_view kCode = "code";
+constexpr std::string_view kGrpcStatus = "grpc_status";
 
 static RegisterContextFactory register_AccessLogPolicy(
     CONTEXT_FACTORY(PluginContext), ROOT_FACTORY(PluginRootContext));

extensions/access_log_policy/plugin.h

@@ -47,7 +47,7 @@ const size_t DefaultClientCacheMaxSize = 500;
 // interactions that outlives individual stream, e.g. timer, async calls.
 class PluginRootContext : public RootContext {
  public:
-  PluginRootContext(uint32_t id, StringView root_id)
+  PluginRootContext(uint32_t id, std::string_view root_id)
       : RootContext(id, root_id) {}
   ~PluginRootContext() = default;
 

extensions/attributegen/plugin.cc

@@ -33,12 +33,12 @@ namespace AttributeGen {
 
 // class Match
 // Returns the result of evaluation or nothing in case of an error.
-Optional<bool> Match::evaluate() const {
+std::optional<bool> Match::evaluate() const {
   if (condition_.empty()) {
     return true;
   }
 
-  Optional<bool> ret = {};
+  std::optional<bool> ret = {};
 
   const std::string function = "expr_evaluate";
   char* out = nullptr;
@@ -57,7 +57,7 @@ Optional<bool> Match::evaluate() const {
   } else {
     // we have a bool.
     bool matched = *reinterpret_cast<bool*>(out);
-    ret = Optional<bool>{matched};
+    ret = std::optional<bool>{matched};
   }
 
   if (out != nullptr) {
@@ -72,7 +72,7 @@ Optional<bool> Match::evaluate() const {
 // class AttributeGenerator
 
 // If evaluation is successful returns true and sets result.
-Optional<bool> AttributeGenerator::evaluate(std::string* val) const {
+std::optional<bool> AttributeGenerator::evaluate(std::string* val) const {
   for (const auto& match : matches_) {
     auto eval_status = match.evaluate();
     if (!eval_status) {

extensions/attributegen/plugin.h

@@ -41,8 +41,6 @@ namespace null_plugin {
 
 namespace AttributeGen {
 
-using StringView = absl::string_view;
-
 using google::protobuf::util::JsonParseOptions;
 using google::protobuf::util::Status;
 
@@ -54,7 +52,7 @@ class Match {
         condition_token_(condition_token),
         value_(value){};
 
-  Optional<bool> evaluate() const;
+  std::optional<bool> evaluate() const;
   const std::string& value() const { return value_; };
 
  private:
@@ -76,7 +74,7 @@ class AttributeGenerator {
         matches_(std::move(matches)) {}
 
   // If evaluation is successful returns true and sets result.
-  Optional<bool> evaluate(std::string* val) const;
+  std::optional<bool> evaluate(std::string* val) const;
   EvalPhase phase() const { return phase_; }
   const std::string& outputAttribute() const { return output_attribute_; }
 
@@ -91,7 +89,7 @@ class AttributeGenerator {
 // for interactions that outlives individual stream, e.g. timer, async calls.
 class PluginRootContext : public RootContext {
  public:
-  PluginRootContext(uint32_t id, StringView root_id)
+  PluginRootContext(uint32_t id, std::string_view root_id)
       : RootContext(id, root_id) {
     Metric error_count(MetricType::Counter, "error_count",
                        {MetricTag{"wasm_filter", MetricTag::TagType::String},

extensions/attributegen/plugin_test.cc

@@ -83,8 +83,7 @@ class TestRoot : public Envoy::Extensions::Common::Wasm::Context {
 
   // MOCK_CONTEXT_LOG_;
 
-  proxy_wasm::WasmResult defineMetric(proxy_wasm::MetricType type,
-                                      absl::string_view name,
+  proxy_wasm::WasmResult defineMetric(uint32_t type, std::string_view name,
                                       uint32_t* metric_id_ptr) override {
     auto rs = Envoy::Extensions::Common::Wasm::Context::defineMetric(
         type, name, metric_id_ptr);
@@ -94,7 +93,7 @@ class TestRoot : public Envoy::Extensions::Common::Wasm::Context {
     return rs;
   }
 
-  uint64_t readMetric(absl::string_view name) {
+  uint64_t readMetric(std::string_view name) {
     auto mid = metrics_.find(std::string(name));
     if (mid == metrics_.end()) {
       return 0;
@@ -171,7 +170,7 @@ class WasmHttpFilterTest : public testing::TestWithParam<TestParams> {
 
     auto vm_id = "";
     plugin_ = std::make_shared<Extensions::Common::Wasm::Plugin>(
-        c.name, c.root_id, vm_id, c.plugin_config, false,
+        c.name, c.root_id, vm_id, params.runtime, c.plugin_config, false,
         TrafficDirection::INBOUND, local_info_, &listener_metadata_);
     // creates a base VM
     // This is synchronous, even though it happens thru a callback due to null
@@ -245,7 +244,7 @@ class WasmHttpFilterTest : public testing::TestWithParam<TestParams> {
   Stats::ScopeSharedPtr scope_;
   NiceMock<ThreadLocal::MockInstance> tls_;
   NiceMock<Event::MockDispatcher> dispatcher_;
-  NiceMock<Runtime::MockRandomGenerator> random_;
+  NiceMock<Random::MockRandomGenerator> random_;
   NiceMock<Upstream::MockClusterManager> cluster_manager_;
   NiceMock<Init::MockManager> init_manager_;
   WasmHandleSharedPtr wasm_;

extensions/common/context.cc

@@ -26,7 +26,6 @@
 
 #else  // NULL_PLUGIN
 
-#include "absl/strings/str_split.h"
 #include "include/proxy-wasm/null_plugin.h"
 
 using proxy_wasm::WasmHeaderMapType;
@@ -123,7 +122,7 @@ void getDestinationService(const std::string& dest_namespace,
     return;
   }
 
-  std::vector<absl::string_view> parts = absl::StrSplit(cluster_name, '|');
+  std::vector<std::string_view> parts = absl::StrSplit(cluster_name, '|');
   if (parts.size() == 4) {
     *dest_svc_host = std::string(parts[3].data(), parts[3].size());
   }
@@ -178,7 +177,8 @@ void populateRequestInfo(bool outbound, bool use_host_header_fallback,
 
 }  // namespace
 
-StringView AuthenticationPolicyString(ServiceAuthenticationPolicy policy) {
+std::string_view AuthenticationPolicyString(
+    ServiceAuthenticationPolicy policy) {
   switch (policy) {
     case ServiceAuthenticationPolicy::None:
       return kNone;
@@ -190,7 +190,7 @@ StringView AuthenticationPolicyString(ServiceAuthenticationPolicy policy) {
   return {};
 }
 
-StringView TCPConnectionStateString(TCPConnectionState state) {
+std::string_view TCPConnectionStateString(TCPConnectionState state) {
   switch (state) {
     case TCPConnectionState::Open:
       return kOpen;
@@ -311,8 +311,8 @@ void populateHTTPRequestInfo(bool outbound, bool use_host_header_fallback,
   getValue({"response", "total_size"}, &request_info->response_size);
 }
 
-absl::string_view nodeInfoSchema() {
-  return absl::string_view(
+std::string_view nodeInfoSchema() {
+  return std::string_view(
       reinterpret_cast<const char*>(FlatNodeBinarySchema::data()),
       FlatNodeBinarySchema::size());
 }