1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
// This file is @generated by prost-build.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ReloadConfig {
/// Backoff strategy for the VM failure reload. If not specified, the default 1s base interval
/// will be applied.
#[prost(message, optional, tag = "1")]
pub backoff: ::core::option::Option<
super::super::super::config::core::v3::BackoffStrategy,
>,
}
impl ::prost::Name for ReloadConfig {
const NAME: &'static str = "ReloadConfig";
const PACKAGE: &'static str = "envoy.extensions.wasm.v3";
fn full_name() -> ::prost::alloc::string::String {
"envoy.extensions.wasm.v3.ReloadConfig".into()
}
fn type_url() -> ::prost::alloc::string::String {
"type.googleapis.com/envoy.extensions.wasm.v3.ReloadConfig".into()
}
}
/// Configuration for restricting Proxy-Wasm capabilities available to modules.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CapabilityRestrictionConfig {
/// The Proxy-Wasm capabilities which will be allowed. Capabilities are mapped by
/// name. The `SanitizationConfig` which each capability maps to is currently unimplemented and ignored,
/// and so should be left empty.
///
/// The capability names are given in the
/// `Proxy-Wasm ABI <<https://github.com/proxy-wasm/spec/tree/master/abi-versions/vNEXT>`*.>
/// Additionally, the following WASI capabilities from
/// `this list <<https://github.com/WebAssembly/WASI/blob/master/phases/snapshot/docs.md#modules>`*>
/// are implemented and can be allowed:
/// `fd_write`, `fd_read`, `fd_seek`, `fd_close`, `fd_fdstat_get`, `environ_get`, `environ_sizes_get`,
/// `args_get`, `args_sizes_get`, `proc_exit`, `clock_time_get`, `random_get`.
#[prost(map = "string, message", tag = "1")]
pub allowed_capabilities: ::std::collections::HashMap<
::prost::alloc::string::String,
SanitizationConfig,
>,
}
impl ::prost::Name for CapabilityRestrictionConfig {
const NAME: &'static str = "CapabilityRestrictionConfig";
const PACKAGE: &'static str = "envoy.extensions.wasm.v3";
fn full_name() -> ::prost::alloc::string::String {
"envoy.extensions.wasm.v3.CapabilityRestrictionConfig".into()
}
fn type_url() -> ::prost::alloc::string::String {
"type.googleapis.com/envoy.extensions.wasm.v3.CapabilityRestrictionConfig".into()
}
}
/// Configuration for sanitization of inputs to an allowed capability.
///
/// .. note::
/// This is currently unimplemented.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SanitizationConfig {}
impl ::prost::Name for SanitizationConfig {
const NAME: &'static str = "SanitizationConfig";
const PACKAGE: &'static str = "envoy.extensions.wasm.v3";
fn full_name() -> ::prost::alloc::string::String {
"envoy.extensions.wasm.v3.SanitizationConfig".into()
}
fn type_url() -> ::prost::alloc::string::String {
"type.googleapis.com/envoy.extensions.wasm.v3.SanitizationConfig".into()
}
}
/// Configuration for a Wasm VM.
/// \[\#next-free-field: 8\]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct VmConfig {
/// An ID which will be used along with a hash of the wasm code (or the name of the registered Null
/// VM plugin) to determine which VM will be used for the plugin. All plugins which use the same
/// `vm_id` and code will use the same VM. May be left blank. Sharing a VM between plugins can
/// reduce memory utilization and make sharing of data easier which may have security implications.
/// \[\#comment: TODO: add ref for details.\]
#[prost(string, tag = "1")]
pub vm_id: ::prost::alloc::string::String,
/// The Wasm runtime type, defaults to the first available Wasm engine used at Envoy build-time.
/// The priority to search for the available engine is: v8 -> wasmtime -> wamr.
/// Available Wasm runtime types are registered as extensions. The following runtimes are included
/// in Envoy code base:
///
/// .. \_extension_envoy.wasm.runtime.null:
///
/// **envoy.wasm.runtime.null**: Null sandbox, the Wasm module must be compiled and linked into the
/// Envoy binary. The registered name is given in the `code` field as `inline_string`.
///
/// .. \_extension_envoy.wasm.runtime.v8:
///
/// **envoy.wasm.runtime.v8**: `V8 <<https://v8.dev/>`\_-based> WebAssembly runtime.
///
/// .. \_extension_envoy.wasm.runtime.wamr:
///
/// **envoy.wasm.runtime.wamr**: `WAMR <<https://github.com/bytecodealliance/wasm-micro-runtime/>`\_-based> WebAssembly runtime.
/// This runtime is not enabled in the official build.
///
/// .. \_extension_envoy.wasm.runtime.wasmtime:
///
/// **envoy.wasm.runtime.wasmtime**: `Wasmtime <<https://wasmtime.dev/>`\_-based> WebAssembly runtime.
/// This runtime is not enabled in the official build.
///
/// \[\#extension-category: envoy.wasm.runtime\]
#[prost(string, tag = "2")]
pub runtime: ::prost::alloc::string::String,
/// The Wasm code that Envoy will execute.
#[prost(message, optional, tag = "3")]
pub code: ::core::option::Option<
super::super::super::config::core::v3::AsyncDataSource,
>,
/// The Wasm configuration used in initialization of a new VM
/// (`proxy_on_start`). `google.protobuf.Struct` is serialized as JSON before
/// passing it to the plugin. `google.protobuf.BytesValue` and
/// `google.protobuf.StringValue` are passed directly without the wrapper.
#[prost(message, optional, tag = "4")]
pub configuration: ::core::option::Option<
super::super::super::super::google::protobuf::Any,
>,
/// Allow the wasm file to include pre-compiled code on VMs which support it.
///
/// .. warning::
/// This should only be enabled for trusted sources as the precompiled code is not
/// verified.
#[prost(bool, tag = "5")]
pub allow_precompiled: bool,
/// If true and the code needs to be remotely fetched and it is not in the cache then NACK the configuration
/// update and do a background fetch to fill the cache, otherwise fetch the code asynchronously and enter
/// warming state.
#[prost(bool, tag = "6")]
pub nack_on_code_cache_miss: bool,
/// Specifies environment variables to be injected to this VM which will be available through
/// WASI's `environ_get` and `environ_get_sizes` system calls. Note that these functions
/// are generally called implicitly by your language's standard library. Therefore, you do not
/// need to call them directly. You can access environment variables in the same way you would
/// on native platforms.
///
/// .. warning::
/// Envoy rejects the configuration if there's conflict of key space.
#[prost(message, optional, tag = "7")]
pub environment_variables: ::core::option::Option<EnvironmentVariables>,
}
impl ::prost::Name for VmConfig {
const NAME: &'static str = "VmConfig";
const PACKAGE: &'static str = "envoy.extensions.wasm.v3";
fn full_name() -> ::prost::alloc::string::String {
"envoy.extensions.wasm.v3.VmConfig".into()
}
fn type_url() -> ::prost::alloc::string::String {
"type.googleapis.com/envoy.extensions.wasm.v3.VmConfig".into()
}
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct EnvironmentVariables {
/// The keys of *Envoy's* environment variables exposed to this VM. In other words, if a key exists in Envoy's environment
/// variables, then that key-value pair will be injected. Note that if a key does not exist, it will be ignored.
#[prost(string, repeated, tag = "1")]
pub host_env_keys: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
/// Explicitly given key-value pairs to be injected to this VM in the form of "KEY=VALUE".
#[prost(map = "string, string", tag = "2")]
pub key_values: ::std::collections::HashMap<
::prost::alloc::string::String,
::prost::alloc::string::String,
>,
}
impl ::prost::Name for EnvironmentVariables {
const NAME: &'static str = "EnvironmentVariables";
const PACKAGE: &'static str = "envoy.extensions.wasm.v3";
fn full_name() -> ::prost::alloc::string::String {
"envoy.extensions.wasm.v3.EnvironmentVariables".into()
}
fn type_url() -> ::prost::alloc::string::String {
"type.googleapis.com/envoy.extensions.wasm.v3.EnvironmentVariables".into()
}
}
/// Base Configuration for Wasm Plugins e.g. filters and services.
/// \[\#next-free-field: 10\]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct PluginConfig {
/// A unique name for a filters/services in a VM for use in identifying the filter/service if
/// multiple filters/services are handled by the same `vm_id` and `root_id` and for
/// logging/debugging.
#[prost(string, tag = "1")]
pub name: ::prost::alloc::string::String,
/// A unique ID for a set of filters/services in a VM which will share a RootContext and Contexts
/// if applicable (e.g. an Wasm HttpFilter and an Wasm AccessLog). If left blank, all
/// filters/services with a blank root_id with the same `vm_id` will share Context(s).
#[prost(string, tag = "2")]
pub root_id: ::prost::alloc::string::String,
/// Filter/service configuration used to configure or reconfigure a plugin
/// (`proxy_on_configure`).
/// `google.protobuf.Struct` is serialized as JSON before
/// passing it to the plugin. `google.protobuf.BytesValue` and
/// `google.protobuf.StringValue` are passed directly without the wrapper.
#[prost(message, optional, tag = "4")]
pub configuration: ::core::option::Option<
super::super::super::super::google::protobuf::Any,
>,
/// If there is a fatal error on the VM (e.g. exception, `abort()`, `on_start` or `on_configure` return false),
/// then all plugins associated with the VM will either fail closed (by default), e.g. by returning an HTTP 503 error,
/// or fail open (if 'fail_open' is set to true) by bypassing the filter.
///
/// .. note::
/// When `on_start` or `on_configure` return `false` during xDS updates the xDS configuration will be rejected and when `on_start` or `on_configure` return `false` on
/// initial startup the proxy will not start.
///
/// This field is deprecated in favor of the `failure_policy` field.
#[deprecated]
#[prost(bool, tag = "5")]
pub fail_open: bool,
/// The failure policy for the plugin.
#[prost(enumeration = "FailurePolicy", tag = "7")]
pub failure_policy: i32,
/// Reload configuration. This is only applied when `failure_policy` is set to `FAIL_RELOAD`.
#[prost(message, optional, tag = "8")]
pub reload_config: ::core::option::Option<ReloadConfig>,
/// Configuration for restricting Proxy-Wasm capabilities available to modules.
#[prost(message, optional, tag = "6")]
pub capability_restriction_config: ::core::option::Option<
CapabilityRestrictionConfig,
>,
/// Whether or not to allow plugin onRequestHeaders and onResponseHeaders callbacks to return
/// FilterHeadersStatus::StopIteration.
#[prost(message, optional, tag = "9")]
pub allow_on_headers_stop_iteration: ::core::option::Option<
super::super::super::super::google::protobuf::BoolValue,
>,
/// Configuration for finding or starting VM.
#[prost(oneof = "plugin_config::Vm", tags = "3")]
pub vm: ::core::option::Option<plugin_config::Vm>,
}
/// Nested message and enum types in `PluginConfig`.
pub mod plugin_config {
/// Configuration for finding or starting VM.
#[derive(Clone, PartialEq, ::prost::Oneof)]
pub enum Vm {
/// TODO: add referential VM configurations.
#[prost(message, tag = "3")]
VmConfig(super::VmConfig),
}
}
impl ::prost::Name for PluginConfig {
const NAME: &'static str = "PluginConfig";
const PACKAGE: &'static str = "envoy.extensions.wasm.v3";
fn full_name() -> ::prost::alloc::string::String {
"envoy.extensions.wasm.v3.PluginConfig".into()
}
fn type_url() -> ::prost::alloc::string::String {
"type.googleapis.com/envoy.extensions.wasm.v3.PluginConfig".into()
}
}
/// WasmService is configured as a built-in `envoy.wasm_service` :ref:`WasmService <config_wasm_service>` This opaque configuration will be used to create a Wasm Service.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct WasmService {
/// General plugin configuration.
#[prost(message, optional, tag = "1")]
pub config: ::core::option::Option<PluginConfig>,
/// If true, create a single VM rather than creating one VM per worker. Such a singleton can
/// not be used with filters.
#[prost(bool, tag = "2")]
pub singleton: bool,
}
impl ::prost::Name for WasmService {
const NAME: &'static str = "WasmService";
const PACKAGE: &'static str = "envoy.extensions.wasm.v3";
fn full_name() -> ::prost::alloc::string::String {
"envoy.extensions.wasm.v3.WasmService".into()
}
fn type_url() -> ::prost::alloc::string::String {
"type.googleapis.com/envoy.extensions.wasm.v3.WasmService".into()
}
}
/// If there is a fatal error on the VM (e.g. exception, `abort()`), then the policy will be applied.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum FailurePolicy {
/// No policy is specified. The default policy will be used. The default policy is `FAIL_CLOSED`.
Unspecified = 0,
/// New plugin instance will be created for the new request if the VM is failed. Note this will only
/// be applied to the following failures:
///
/// * `proxy_wasm::FailState::RuntimeError`
///
/// This will fallback to the `FAIL_CLOSED` for all other failures.
FailReload = 1,
/// All plugins associated with the VM will return an HTTP 503 error.
FailClosed = 2,
/// All plugins associated with the VM will be ignored and the filter chain will continue. This
/// makes sense when the plugin is optional.
FailOpen = 3,
}
impl FailurePolicy {
/// String value of the enum field names used in the ProtoBuf definition.
///
/// The values are not transformed in any way and thus are considered stable
/// (if the ProtoBuf definition does not change) and safe for programmatic use.
pub fn as_str_name(&self) -> &'static str {
match self {
Self::Unspecified => "UNSPECIFIED",
Self::FailReload => "FAIL_RELOAD",
Self::FailClosed => "FAIL_CLOSED",
Self::FailOpen => "FAIL_OPEN",
}
}
/// Creates an enum from field names used in the ProtoBuf definition.
pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
match value {
"UNSPECIFIED" => Some(Self::Unspecified),
"FAIL_RELOAD" => Some(Self::FailReload),
"FAIL_CLOSED" => Some(Self::FailClosed),
"FAIL_OPEN" => Some(Self::FailOpen),
_ => None,
}
}
}