From f0748fcf52d541d37fb5e6b68b6d1840a8993165 Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Wed, 19 Nov 2025 17:17:45 -1000 Subject: [PATCH 01/16] Add TCP rerouting example with dynamic cluster selection Introduce a new Proxy-Wasm TCP filter example that demonstrates dynamic routing of TCP connections based on source IP addresses. This example showcases TCP-level filtering, filling a gap in the existing HTTP-focused examples. Key features: - Dynamic cluster selection based on source IP last octet (even/odd) - Uses Envoy's set_envoy_filter_state foreign function with protobuf encoding - Includes comprehensive Docker Compose setup for testing - Full documentation with usage examples and expected output Implementation details: - Protobuf definitions for Envoy's filter state API - Build script for code generation from proto files - Unit tests for IP parsing and routing logic - Envoy configuration with dual upstream clusters Signed-off-by: Christof Gerber --- examples/tcp_rerouting/Cargo.toml | 19 ++ examples/tcp_rerouting/README.md | 81 ++++++++ examples/tcp_rerouting/build.rs | 11 ++ examples/tcp_rerouting/docker-compose.yaml | 18 ++ examples/tcp_rerouting/envoy/envoy.yaml | 76 ++++++++ .../envoy.source.extensions.common.wasm.rs | 42 +++++ examples/tcp_rerouting/src/lib.rs | 174 ++++++++++++++++++ .../src/set_envoy_filter_state.proto | 17 ++ 8 files changed, 438 insertions(+) create mode 100644 examples/tcp_rerouting/Cargo.toml create mode 100644 examples/tcp_rerouting/README.md create mode 100644 examples/tcp_rerouting/build.rs create mode 100644 examples/tcp_rerouting/docker-compose.yaml create mode 100644 examples/tcp_rerouting/envoy/envoy.yaml create mode 100644 examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs create mode 100644 examples/tcp_rerouting/src/lib.rs create mode 100644 examples/tcp_rerouting/src/set_envoy_filter_state.proto diff --git a/examples/tcp_rerouting/Cargo.toml b/examples/tcp_rerouting/Cargo.toml new file mode 100644 index 00000000..766f32aa --- /dev/null +++ b/examples/tcp_rerouting/Cargo.toml @@ -0,0 +1,19 @@ +[package] +publish = false +name = "proxy-wasm-example-tcp-rerouting" +version = "0.0.1" +authors = ["Proxy-Wasm contributors"] +description = "Proxy-Wasm plugin example: TCP Rerouting based on source IP" +license = "Apache-2.0" +edition = "2021" + +[lib] +crate-type = ["cdylib"] + +[dependencies] +log = "0.4" +proxy-wasm = { path = "../../" } +prost = "0.12" + +[build-dependencies] +prost-build = "0.12" diff --git a/examples/tcp_rerouting/README.md b/examples/tcp_rerouting/README.md new file mode 100644 index 00000000..b805aad1 --- /dev/null +++ b/examples/tcp_rerouting/README.md @@ -0,0 +1,81 @@ +## Proxy-Wasm plugin example: TCP Rerouting + +Proxy-Wasm TCP filter that dynamically routes connections to different upstream clusters based on the source IP address. + +Most WASM filter examples focus on HTTP, but this example shows how to work at the TCP/IP level. + +This example is inspired by the [wasmerang](https://github.com/SiiiTschiii/wasmerang) project, which demonstrates advanced TCP routing patterns in Envoy/Istio/K8s using WASM filters. + +### Overview + +This example demonstrates how to build a TCP filter that: + +- Intercepts incoming TCP connections +- Extracts the source IP address +- Routes traffic to different upstream clusters based on whether the last octet is even or odd + - **Even last octet** → routes to `egress-router1` + - **Odd last octet** → routes to `egress-router2` + +The filter uses Envoy's `set_envoy_filter_state` foreign function to dynamically override the TCP proxy cluster at runtime, requiring proper protobuf encoding via the included `set_envoy_filter_state.proto` file. + +### Building + +Build the WASM plugin from the example directory: + +```sh +$ cargo build --target wasm32-wasip1 --release +``` + +### Running with Docker Compose + +This example can be run with [`docker compose`](https://docs.docker.com/compose/install/) and has a matching Envoy configuration. + +From the example directory: + +```sh +$ docker compose up +``` + +### Test the Routing + +In separate terminals, test the routing behavior with different source IP addresses: + +```bash +# Even IP (last octet 10) → routes to egress-router1 +docker run --rm -it --network tcp_rerouting_envoymesh --ip 172.22.0.10 curlimages/curl curl http://proxy:10000/ip -H "Host: httpbin.org" + +# Odd IP (last octet 11) → routes to egress-router2 +docker run --rm -it --network tcp_rerouting_envoymesh --ip 172.22.0.11 curlimages/curl curl http://proxy:10000/ip -H "Host: httpbin.org" +``` + +### Expected Output + +Check the Docker Compose logs to see the WASM filter in action: + +```console +$ docker compose logs -f +``` + +**For even IP (last octet 10) → routes to egress-router1:** + +``` +proxy-1 | [TCP WASM] Source address: 172.22.0.10:39484 +proxy-1 | [TCP WASM] Source IP last octet: 10, intercepting ALL traffic +proxy-1 | [TCP WASM] Routing to egress-router1 +proxy-1 | [TCP WASM] set_envoy_filter_state status (envoy.tcp_proxy.cluster): Ok(None) +proxy-1 | [TCP WASM] Rerouting to egress-router1 via filter state +proxy-1 | [2025-11-20T03:08:18.423Z] cluster=egress-router1 src=172.22.0.10:39484 dst=172.22.0.2:10000 -> 35.170.145.70:80 +``` + +**For odd IP (last octet 11) → routes to egress-router2:** + +``` +proxy-1 | [TCP WASM] Source address: 172.22.0.11:55320 +proxy-1 | [TCP WASM] Source IP last octet: 11, intercepting ALL traffic +proxy-1 | [TCP WASM] Routing to egress-router2 +proxy-1 | [TCP WASM] set_envoy_filter_state status (envoy.tcp_proxy.cluster): Ok(None) +proxy-1 | [TCP WASM] Rerouting to egress-router2 via filter state +proxy-1 | [2025-11-20T03:08:39.974Z] cluster=egress-router2 src=172.22.0.11:55320 dst=172.22.0.2:10000 -> 52.44.182.178:80 +``` + +The `Ok(None)` status confirms that the filter state was successfully set, and you can see in the access logs that traffic is being routed to the correct clusters (`egress-router1` for even IPs, `egress-router2` for odd IPs). diff --git a/examples/tcp_rerouting/build.rs b/examples/tcp_rerouting/build.rs new file mode 100644 index 00000000..a4d41c42 --- /dev/null +++ b/examples/tcp_rerouting/build.rs @@ -0,0 +1,11 @@ +use std::fs; + +fn main() { + let out_dir = "src/generated"; + fs::create_dir_all(out_dir).unwrap(); + prost_build::Config::new() + .out_dir(out_dir) + .compile_protos(&["src/set_envoy_filter_state.proto"], &["src/"]) + .unwrap(); + println!("cargo:rerun-if-changed=src/set_envoy_filter_state.proto"); +} diff --git a/examples/tcp_rerouting/docker-compose.yaml b/examples/tcp_rerouting/docker-compose.yaml new file mode 100644 index 00000000..35439e04 --- /dev/null +++ b/examples/tcp_rerouting/docker-compose.yaml @@ -0,0 +1,18 @@ +services: + proxy: + image: envoyproxy/envoy:v1.34.1 + entrypoint: /usr/local/bin/envoy -c /etc/envoy.yaml -l info --service-cluster proxy + volumes: + - ./envoy/envoy.yaml:/etc/envoy.yaml + - ./target/wasm32-wasip1/release/proxy_wasm_example_tcp_rerouting.wasm:/etc/tcp_rerouting.wasm + networks: + - envoymesh + ports: + - "10000:10000" + - "8001:8001" + +networks: + envoymesh: + ipam: + config: + - subnet: 172.22.0.0/16 diff --git a/examples/tcp_rerouting/envoy/envoy.yaml b/examples/tcp_rerouting/envoy/envoy.yaml new file mode 100644 index 00000000..6f2b2567 --- /dev/null +++ b/examples/tcp_rerouting/envoy/envoy.yaml @@ -0,0 +1,76 @@ +# Envoy configuration for TCP rerouting example +static_resources: + listeners: + - name: main + address: + socket_address: + address: 0.0.0.0 + port_value: 10000 + filter_chains: + - filters: + # WASM filter for TCP rerouting + - name: envoy.filters.network.wasm + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm + config: + name: tcp_rerouting_filter + root_id: tcp_rerouting_filter + configuration: + "@type": type.googleapis.com/google.protobuf.StringValue + value: "standalone" + vm_config: + vm_id: vm.tcp_rerouting + runtime: envoy.wasm.runtime.v8 + code: + local: + filename: /etc/tcp_rerouting.wasm + allow_precompiled: true + # TCP proxy filter + - name: envoy.filters.network.tcp_proxy + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy + stat_prefix: destination + cluster: egress-router1 # Default cluster, overridden by WASM filter + access_log: + - name: envoy.access_loggers.file + typed_config: + "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog + path: /dev/stdout + log_format: + text_format: "[%START_TIME%] cluster=%UPSTREAM_CLUSTER% src=%DOWNSTREAM_REMOTE_ADDRESS% dst=%DOWNSTREAM_LOCAL_ADDRESS% -> %UPSTREAM_HOST%\n" + + clusters: + - name: egress-router1 + connect_timeout: 30s + type: LOGICAL_DNS + dns_lookup_family: V4_ONLY + load_assignment: + cluster_name: egress-router1 + endpoints: + - lb_endpoints: + - endpoint: + address: + socket_address: + address: httpbin.org + port_value: 80 + + - name: egress-router2 + connect_timeout: 30s + type: LOGICAL_DNS + dns_lookup_family: V4_ONLY + load_assignment: + cluster_name: egress-router2 + endpoints: + - lb_endpoints: + - endpoint: + address: + socket_address: + address: httpbin.org + port_value: 80 + +admin: + access_log_path: "/dev/null" + address: + socket_address: + address: 0.0.0.0 + port_value: 8001 diff --git a/examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs b/examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs new file mode 100644 index 00000000..53b19a2b --- /dev/null +++ b/examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs @@ -0,0 +1,42 @@ +// This file is @generated by prost-build. +/// Argument expected by set_envoy_filter_state in envoy +/// +#[allow(clippy::derive_partial_eq_without_eq)] +#[derive(Clone, PartialEq, ::prost::Message)] +pub struct SetEnvoyFilterStateArguments { + #[prost(string, tag = "1")] + pub path: ::prost::alloc::string::String, + #[prost(string, tag = "2")] + pub value: ::prost::alloc::string::String, + #[prost(enumeration = "LifeSpan", tag = "3")] + pub span: i32, +} +#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)] +#[repr(i32)] +pub enum LifeSpan { + FilterChain = 0, + DownstreamRequest = 1, + DownstreamConnection = 2, +} +impl LifeSpan { + /// String value of the enum field names used in the ProtoBuf definition. + /// + /// The values are not transformed in any way and thus are considered stable + /// (if the ProtoBuf definition does not change) and safe for programmatic use. + pub fn as_str_name(&self) -> &'static str { + match self { + LifeSpan::FilterChain => "FilterChain", + LifeSpan::DownstreamRequest => "DownstreamRequest", + LifeSpan::DownstreamConnection => "DownstreamConnection", + } + } + /// Creates an enum from field names used in the ProtoBuf definition. + pub fn from_str_name(value: &str) -> ::core::option::Option { + match value { + "FilterChain" => Some(Self::FilterChain), + "DownstreamRequest" => Some(Self::DownstreamRequest), + "DownstreamConnection" => Some(Self::DownstreamConnection), + _ => None, + } + } +} diff --git a/examples/tcp_rerouting/src/lib.rs b/examples/tcp_rerouting/src/lib.rs new file mode 100644 index 00000000..f5b68984 --- /dev/null +++ b/examples/tcp_rerouting/src/lib.rs @@ -0,0 +1,174 @@ +// Copyright 2020 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +//! TCP Rerouting Example +//! +//! This example demonstrates dynamic TCP routing based on source IP address. +//! Inspired by https://github.com/SiiiTschiii/wasmerang +//! +//! The filter intercepts TCP connections and routes them to different upstream +//! clusters based on whether the last octet of the source IP is even or odd: +//! - Even last octet → egress-router1 +//! - Odd last octet → egress-router2 + +use log::{info, warn}; +use proxy_wasm::traits::*; +use proxy_wasm::types::*; + +// Include the generated protobuf code +pub mod set_envoy_filter_state { + include!("generated/envoy.source.extensions.common.wasm.rs"); +} + +proxy_wasm::main! {{ + proxy_wasm::set_log_level(LogLevel::Info); + proxy_wasm::set_root_context(|_| -> Box { + Box::new(TcpReroutingRoot) + }); +}} + +struct TcpReroutingRoot; + +impl Context for TcpReroutingRoot {} + +impl RootContext for TcpReroutingRoot { + fn on_configure(&mut self, _plugin_configuration_size: usize) -> bool { + if let Some(config_bytes) = self.get_plugin_configuration() { + info!( + "[TCP WASM] Configuration: {:?}", + std::str::from_utf8(&config_bytes).unwrap_or("invalid UTF-8") + ); + } + true + } + + fn create_stream_context(&self, _context_id: u32) -> Option> { + Some(Box::new(TcpReroutingStream)) + } + + fn get_type(&self) -> Option { + Some(ContextType::StreamContext) + } +} + +struct TcpReroutingStream; + +impl Context for TcpReroutingStream {} + +impl StreamContext for TcpReroutingStream { + fn on_new_connection(&mut self) -> Action { + if let Some(source_addr_bytes) = self.get_property(vec!["source", "address"]) { + if let Ok(source_addr) = std::str::from_utf8(&source_addr_bytes) { + info!("[TCP WASM] Source address: {}", source_addr); + + // Extract the last octet from the source IP address + if let Some(last_octet) = extract_last_octet(source_addr) { + info!( + "[TCP WASM] Source IP last octet: {}, intercepting ALL traffic", + last_octet + ); + + // Determine target cluster based on even/odd last octet + let cluster = if last_octet % 2 == 0 { + "egress-router1" + } else { + "egress-router2" + }; + + info!("[TCP WASM] Routing to {}", cluster); + + // Set the cluster via Envoy's filter state mechanism using proper protobuf encoding + use set_envoy_filter_state::{LifeSpan, SetEnvoyFilterStateArguments}; + + let args = SetEnvoyFilterStateArguments { + path: "envoy.tcp_proxy.cluster".to_string(), + value: cluster.to_string(), + span: LifeSpan::FilterChain as i32, + }; + + let mut buf = Vec::new(); + if let Err(e) = prost::Message::encode(&args, &mut buf) { + warn!("[TCP WASM] Failed to encode filter state: {}", e); + return Action::Continue; + } + + // Use the Envoy-specific filter state mechanism + // https://github.com/envoyproxy/envoy/issues/28128 + let status = self.call_foreign_function("set_envoy_filter_state", Some(&buf)); + + info!( + "[TCP WASM] set_envoy_filter_state status (envoy.tcp_proxy.cluster): {:?}", + status + ); + info!("[TCP WASM] Rerouting to {} via filter state", cluster); + } + } + } + Action::Continue + } +} + +/// Extracts the last octet from an IP address string. +/// +/// Handles both IPv4 addresses with and without port numbers. +/// Examples: +/// - "192.168.1.10" → Some(10) +/// - "192.168.1.10:8080" → Some(10) +/// - "172.21.0.11:58762" → Some(11) +fn extract_last_octet(addr: &str) -> Option { + // Remove port if present (format: "ip:port") + let ip_part = addr.split(':').next()?; + + // Split by '.' and get the last segment + let last_segment = ip_part.split('.').last()?; + + // Parse as u8 + last_segment.parse::().ok() +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn test_extract_last_octet() { + assert_eq!(extract_last_octet("192.168.1.10"), Some(10)); + assert_eq!(extract_last_octet("192.168.1.10:8080"), Some(10)); + assert_eq!(extract_last_octet("172.21.0.11:58762"), Some(11)); + assert_eq!(extract_last_octet("10.0.0.2"), Some(2)); + assert_eq!(extract_last_octet("invalid"), None); + assert_eq!(extract_last_octet(""), None); + } + + #[test] + fn test_routing_logic() { + // Even last octet should route to egress-router1 + let last_octet = 10; + let cluster = if last_octet % 2 == 0 { + "egress-router1" + } else { + "egress-router2" + }; + assert_eq!(cluster, "egress-router1"); + + // Odd last octet should route to egress-router2 + let last_octet = 11; + let cluster = if last_octet % 2 == 0 { + "egress-router1" + } else { + "egress-router2" + }; + assert_eq!(cluster, "egress-router2"); + } +} diff --git a/examples/tcp_rerouting/src/set_envoy_filter_state.proto b/examples/tcp_rerouting/src/set_envoy_filter_state.proto new file mode 100644 index 00000000..3caceedf --- /dev/null +++ b/examples/tcp_rerouting/src/set_envoy_filter_state.proto @@ -0,0 +1,17 @@ +syntax = "proto3"; + +package envoy.source.extensions.common.wasm; + +enum LifeSpan { + FilterChain = 0; + DownstreamRequest = 1; + DownstreamConnection = 2; +} + +// Argument expected by set_envoy_filter_state in envoy +// https://github.com/envoyproxy/envoy/blob/d741713c376d1e024236519fb59406c05702ad77/source/extensions/common/wasm/foreign.cc#L116 +message SetEnvoyFilterStateArguments { + string path = 1; + string value = 2; + LifeSpan span = 3; +} From 633ad4f79c6c087011594faaddf54cd84a93dacf Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Wed, 19 Nov 2025 17:30:30 -1000 Subject: [PATCH 02/16] Fix formatting and clippy warning in tcp_rerouting example - Remove trailing whitespace - Use next_back() instead of last() for better performance Signed-off-by: Christof Gerber --- examples/tcp_rerouting/src/lib.rs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/examples/tcp_rerouting/src/lib.rs b/examples/tcp_rerouting/src/lib.rs index f5b68984..ca5b2e61 100644 --- a/examples/tcp_rerouting/src/lib.rs +++ b/examples/tcp_rerouting/src/lib.rs @@ -106,7 +106,7 @@ impl StreamContext for TcpReroutingStream { // Use the Envoy-specific filter state mechanism // https://github.com/envoyproxy/envoy/issues/28128 let status = self.call_foreign_function("set_envoy_filter_state", Some(&buf)); - + info!( "[TCP WASM] set_envoy_filter_state status (envoy.tcp_proxy.cluster): {:?}", status @@ -129,10 +129,10 @@ impl StreamContext for TcpReroutingStream { fn extract_last_octet(addr: &str) -> Option { // Remove port if present (format: "ip:port") let ip_part = addr.split(':').next()?; - + // Split by '.' and get the last segment - let last_segment = ip_part.split('.').last()?; - + let last_segment = ip_part.split('.').next_back()?; + // Parse as u8 last_segment.parse::().ok() } From ff85e6fa68325f7da2715425ea350468d3e02360 Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Wed, 19 Nov 2025 17:35:34 -1000 Subject: [PATCH 03/16] Update Bazel dependencies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Update log 0.4.27 → 0.4.28 - Update proc-macro2 1.0.101 → 1.0.103 - Update quote 1.0.41 → 1.0.42 - Update unicode-ident 1.0.19 → 1.0.22 Generated by: bazelisk run //bazel/cargo:crates_vendor -- --repin all Signed-off-by: Christof Gerber --- bazel/cargo/Cargo.Bazel.lock | 16 +++---- bazel/cargo/remote/BUILD.bazel | 6 +-- ...og-0.4.27.bazel => BUILD.log-0.4.28.bazel} | 2 +- .../remote/BUILD.mockalloc-macros-0.1.0.bazel | 4 +- ....bazel => BUILD.proc-macro2-1.0.103.bazel} | 8 ++-- ...-1.0.41.bazel => BUILD.quote-1.0.42.bazel} | 8 ++-- bazel/cargo/remote/BUILD.syn-1.0.109.bazel | 6 +-- ...bazel => BUILD.unicode-ident-1.0.22.bazel} | 2 +- bazel/cargo/remote/defs.bzl | 44 +++++++++---------- 9 files changed, 48 insertions(+), 48 deletions(-) rename bazel/cargo/remote/{BUILD.log-0.4.27.bazel => BUILD.log-0.4.28.bazel} (99%) rename bazel/cargo/remote/{BUILD.proc-macro2-1.0.101.bazel => BUILD.proc-macro2-1.0.103.bazel} (96%) rename bazel/cargo/remote/{BUILD.quote-1.0.41.bazel => BUILD.quote-1.0.42.bazel} (96%) rename bazel/cargo/remote/{BUILD.unicode-ident-1.0.19.bazel => BUILD.unicode-ident-1.0.22.bazel} (99%) diff --git a/bazel/cargo/Cargo.Bazel.lock b/bazel/cargo/Cargo.Bazel.lock index 21d41bc9..92dd9b11 100644 --- a/bazel/cargo/Cargo.Bazel.lock +++ b/bazel/cargo/Cargo.Bazel.lock @@ -33,9 +33,9 @@ dependencies = [ [[package]] name = "log" -version = "0.4.27" +version = "0.4.28" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94" +checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432" [[package]] name = "mockalloc" @@ -59,9 +59,9 @@ dependencies = [ [[package]] name = "proc-macro2" -version = "1.0.101" +version = "1.0.103" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de" +checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8" dependencies = [ "unicode-ident", ] @@ -77,9 +77,9 @@ dependencies = [ [[package]] name = "quote" -version = "1.0.41" +version = "1.0.42" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1" +checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f" dependencies = [ "proc-macro2", ] @@ -97,6 +97,6 @@ dependencies = [ [[package]] name = "unicode-ident" -version = "1.0.19" +version = "1.0.22" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d" +checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5" diff --git a/bazel/cargo/remote/BUILD.bazel b/bazel/cargo/remote/BUILD.bazel index 294313a7..df6e7fb1 100644 --- a/bazel/cargo/remote/BUILD.bazel +++ b/bazel/cargo/remote/BUILD.bazel @@ -44,14 +44,14 @@ alias( ) alias( - name = "log-0.4.27", - actual = "@crates_vendor__log-0.4.27//:log", + name = "log-0.4.28", + actual = "@crates_vendor__log-0.4.28//:log", tags = ["manual"], ) alias( name = "log", - actual = "@crates_vendor__log-0.4.27//:log", + actual = "@crates_vendor__log-0.4.28//:log", tags = ["manual"], ) diff --git a/bazel/cargo/remote/BUILD.log-0.4.27.bazel b/bazel/cargo/remote/BUILD.log-0.4.28.bazel similarity index 99% rename from bazel/cargo/remote/BUILD.log-0.4.27.bazel rename to bazel/cargo/remote/BUILD.log-0.4.28.bazel index dbfcf020..b0dc7030 100644 --- a/bazel/cargo/remote/BUILD.log-0.4.27.bazel +++ b/bazel/cargo/remote/BUILD.log-0.4.28.bazel @@ -88,5 +88,5 @@ rust_library( "@rules_rust//rust/platform:x86_64-unknown-uefi": [], "//conditions:default": ["@platforms//:incompatible"], }), - version = "0.4.27", + version = "0.4.28", ) diff --git a/bazel/cargo/remote/BUILD.mockalloc-macros-0.1.0.bazel b/bazel/cargo/remote/BUILD.mockalloc-macros-0.1.0.bazel index 70ab9d81..591dac06 100644 --- a/bazel/cargo/remote/BUILD.mockalloc-macros-0.1.0.bazel +++ b/bazel/cargo/remote/BUILD.mockalloc-macros-0.1.0.bazel @@ -90,8 +90,8 @@ rust_proc_macro( }), version = "0.1.0", deps = [ - "@crates_vendor__proc-macro2-1.0.101//:proc_macro2", - "@crates_vendor__quote-1.0.41//:quote", + "@crates_vendor__proc-macro2-1.0.103//:proc_macro2", + "@crates_vendor__quote-1.0.42//:quote", "@crates_vendor__syn-1.0.109//:syn", ], ) diff --git a/bazel/cargo/remote/BUILD.proc-macro2-1.0.101.bazel b/bazel/cargo/remote/BUILD.proc-macro2-1.0.103.bazel similarity index 96% rename from bazel/cargo/remote/BUILD.proc-macro2-1.0.101.bazel rename to bazel/cargo/remote/BUILD.proc-macro2-1.0.103.bazel index 51c8d72d..87577bc0 100644 --- a/bazel/cargo/remote/BUILD.proc-macro2-1.0.101.bazel +++ b/bazel/cargo/remote/BUILD.proc-macro2-1.0.103.bazel @@ -96,10 +96,10 @@ rust_library( "@rules_rust//rust/platform:x86_64-unknown-uefi": [], "//conditions:default": ["@platforms//:incompatible"], }), - version = "1.0.101", + version = "1.0.103", deps = [ - "@crates_vendor__proc-macro2-1.0.101//:build_script_build", - "@crates_vendor__unicode-ident-1.0.19//:unicode_ident", + "@crates_vendor__proc-macro2-1.0.103//:build_script_build", + "@crates_vendor__unicode-ident-1.0.22//:unicode_ident", ], ) @@ -155,7 +155,7 @@ cargo_build_script( "noclippy", "norustfmt", ], - version = "1.0.101", + version = "1.0.103", visibility = ["//visibility:private"], ) diff --git a/bazel/cargo/remote/BUILD.quote-1.0.41.bazel b/bazel/cargo/remote/BUILD.quote-1.0.42.bazel similarity index 96% rename from bazel/cargo/remote/BUILD.quote-1.0.41.bazel rename to bazel/cargo/remote/BUILD.quote-1.0.42.bazel index 2576b03c..f2c6332b 100644 --- a/bazel/cargo/remote/BUILD.quote-1.0.41.bazel +++ b/bazel/cargo/remote/BUILD.quote-1.0.42.bazel @@ -96,10 +96,10 @@ rust_library( "@rules_rust//rust/platform:x86_64-unknown-uefi": [], "//conditions:default": ["@platforms//:incompatible"], }), - version = "1.0.41", + version = "1.0.42", deps = [ - "@crates_vendor__proc-macro2-1.0.101//:proc_macro2", - "@crates_vendor__quote-1.0.41//:build_script_build", + "@crates_vendor__proc-macro2-1.0.103//:proc_macro2", + "@crates_vendor__quote-1.0.42//:build_script_build", ], ) @@ -155,7 +155,7 @@ cargo_build_script( "noclippy", "norustfmt", ], - version = "1.0.41", + version = "1.0.42", visibility = ["//visibility:private"], ) diff --git a/bazel/cargo/remote/BUILD.syn-1.0.109.bazel b/bazel/cargo/remote/BUILD.syn-1.0.109.bazel index 057bf1d9..ef19ab41 100644 --- a/bazel/cargo/remote/BUILD.syn-1.0.109.bazel +++ b/bazel/cargo/remote/BUILD.syn-1.0.109.bazel @@ -104,10 +104,10 @@ rust_library( }), version = "1.0.109", deps = [ - "@crates_vendor__proc-macro2-1.0.101//:proc_macro2", - "@crates_vendor__quote-1.0.41//:quote", + "@crates_vendor__proc-macro2-1.0.103//:proc_macro2", + "@crates_vendor__quote-1.0.42//:quote", "@crates_vendor__syn-1.0.109//:build_script_build", - "@crates_vendor__unicode-ident-1.0.19//:unicode_ident", + "@crates_vendor__unicode-ident-1.0.22//:unicode_ident", ], ) diff --git a/bazel/cargo/remote/BUILD.unicode-ident-1.0.19.bazel b/bazel/cargo/remote/BUILD.unicode-ident-1.0.22.bazel similarity index 99% rename from bazel/cargo/remote/BUILD.unicode-ident-1.0.19.bazel rename to bazel/cargo/remote/BUILD.unicode-ident-1.0.22.bazel index c60baf29..ea7867d2 100644 --- a/bazel/cargo/remote/BUILD.unicode-ident-1.0.19.bazel +++ b/bazel/cargo/remote/BUILD.unicode-ident-1.0.22.bazel @@ -88,5 +88,5 @@ rust_library( "@rules_rust//rust/platform:x86_64-unknown-uefi": [], "//conditions:default": ["@platforms//:incompatible"], }), - version = "1.0.19", + version = "1.0.22", ) diff --git a/bazel/cargo/remote/defs.bzl b/bazel/cargo/remote/defs.bzl index 9587c7f8..19090501 100644 --- a/bazel/cargo/remote/defs.bzl +++ b/bazel/cargo/remote/defs.bzl @@ -296,7 +296,7 @@ _NORMAL_DEPENDENCIES = { "": { _COMMON_CONDITION: { "hashbrown": Label("@crates_vendor//:hashbrown-0.16.0"), - "log": Label("@crates_vendor//:log-0.4.27"), + "log": Label("@crates_vendor//:log-0.4.28"), }, }, } @@ -454,12 +454,12 @@ def crate_repositories(): maybe( http_archive, - name = "crates_vendor__log-0.4.27", - sha256 = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94", + name = "crates_vendor__log-0.4.28", + sha256 = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432", type = "tar.gz", - urls = ["https://static.crates.io/crates/log/0.4.27/download"], - strip_prefix = "log-0.4.27", - build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.log-0.4.27.bazel"), + urls = ["https://static.crates.io/crates/log/0.4.28/download"], + strip_prefix = "log-0.4.28", + build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.log-0.4.28.bazel"), ) maybe( @@ -484,22 +484,22 @@ def crate_repositories(): maybe( http_archive, - name = "crates_vendor__proc-macro2-1.0.101", - sha256 = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de", + name = "crates_vendor__proc-macro2-1.0.103", + sha256 = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8", type = "tar.gz", - urls = ["https://static.crates.io/crates/proc-macro2/1.0.101/download"], - strip_prefix = "proc-macro2-1.0.101", - build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.proc-macro2-1.0.101.bazel"), + urls = ["https://static.crates.io/crates/proc-macro2/1.0.103/download"], + strip_prefix = "proc-macro2-1.0.103", + build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.proc-macro2-1.0.103.bazel"), ) maybe( http_archive, - name = "crates_vendor__quote-1.0.41", - sha256 = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1", + name = "crates_vendor__quote-1.0.42", + sha256 = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f", type = "tar.gz", - urls = ["https://static.crates.io/crates/quote/1.0.41/download"], - strip_prefix = "quote-1.0.41", - build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.quote-1.0.41.bazel"), + urls = ["https://static.crates.io/crates/quote/1.0.42/download"], + strip_prefix = "quote-1.0.42", + build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.quote-1.0.42.bazel"), ) maybe( @@ -514,16 +514,16 @@ def crate_repositories(): maybe( http_archive, - name = "crates_vendor__unicode-ident-1.0.19", - sha256 = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d", + name = "crates_vendor__unicode-ident-1.0.22", + sha256 = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5", type = "tar.gz", - urls = ["https://static.crates.io/crates/unicode-ident/1.0.19/download"], - strip_prefix = "unicode-ident-1.0.19", - build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.unicode-ident-1.0.19.bazel"), + urls = ["https://static.crates.io/crates/unicode-ident/1.0.22/download"], + strip_prefix = "unicode-ident-1.0.22", + build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.unicode-ident-1.0.22.bazel"), ) return [ struct(repo = "crates_vendor__hashbrown-0.16.0", is_dev_dep = False), - struct(repo = "crates_vendor__log-0.4.27", is_dev_dep = False), + struct(repo = "crates_vendor__log-0.4.28", is_dev_dep = False), struct(repo = "crates_vendor__mockalloc-0.1.2", is_dev_dep = True), ] From 94d5d0ffe652b2f225da2287c55e229a52a66b2d Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Wed, 19 Nov 2025 17:39:30 -1000 Subject: [PATCH 04/16] Add TCP rerouting example to main README Signed-off-by: Christof Gerber --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index fa53c221..9ef939c1 100644 --- a/README.md +++ b/README.md @@ -23,6 +23,7 @@ - [HTTP Configuration](./examples/http_config/) - [gRPC Auth (random)](./examples/grpc_auth_random/) - [Envoy filter metadata](./examples/envoy_filter_metadata/) +- [TCP Rerouting](./examples/tcp_rerouting/) ## Articles & blog posts from the community From d4bd7c3f5681c453fa77861343a3a9ba6d93f380 Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Thu, 27 Nov 2025 17:14:19 -1000 Subject: [PATCH 05/16] Add Apache 2.0 license headers to tcp_rerouting example files Signed-off-by: Christof Gerber --- examples/tcp_rerouting/build.rs | 14 ++++++++++++++ examples/tcp_rerouting/docker-compose.yaml | 14 ++++++++++++++ examples/tcp_rerouting/envoy/envoy.yaml | 14 ++++++++++++++ .../envoy.source.extensions.common.wasm.rs | 14 ++++++++++++++ 4 files changed, 56 insertions(+) diff --git a/examples/tcp_rerouting/build.rs b/examples/tcp_rerouting/build.rs index a4d41c42..5e904520 100644 --- a/examples/tcp_rerouting/build.rs +++ b/examples/tcp_rerouting/build.rs @@ -1,3 +1,17 @@ +// Copyright 2020 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + use std::fs; fn main() { diff --git a/examples/tcp_rerouting/docker-compose.yaml b/examples/tcp_rerouting/docker-compose.yaml index 35439e04..3b6ef2a1 100644 --- a/examples/tcp_rerouting/docker-compose.yaml +++ b/examples/tcp_rerouting/docker-compose.yaml @@ -1,3 +1,17 @@ +# Copyright 2020 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + services: proxy: image: envoyproxy/envoy:v1.34.1 diff --git a/examples/tcp_rerouting/envoy/envoy.yaml b/examples/tcp_rerouting/envoy/envoy.yaml index 6f2b2567..324bb8ac 100644 --- a/examples/tcp_rerouting/envoy/envoy.yaml +++ b/examples/tcp_rerouting/envoy/envoy.yaml @@ -1,3 +1,17 @@ +# Copyright 2020 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + # Envoy configuration for TCP rerouting example static_resources: listeners: diff --git a/examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs b/examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs index 53b19a2b..53e2945c 100644 --- a/examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs +++ b/examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs @@ -1,3 +1,17 @@ +// Copyright 2020 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + // This file is @generated by prost-build. /// Argument expected by set_envoy_filter_state in envoy /// From e00a95b06b61311157b19c41e4bddd9b6427b19c Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Thu, 27 Nov 2025 17:39:03 -1000 Subject: [PATCH 06/16] Pin tcp_rerouting build dependencies for Rust 1.65 MSRV compatibility Pin proc-macro2 and quote in build-dependencies to versions compatible with Rust 1.65 (the SDK's MSRV). Without these pins, cargo may select newer versions (e.g., quote 1.0.42) that require Rust 1.68+, causing CI builds to fail. This follows best practices by explicitly pinning problematic transitive dependencies rather than setting rust-version, which is not used by other examples. Signed-off-by: Christof Gerber --- examples/tcp_rerouting/Cargo.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/examples/tcp_rerouting/Cargo.toml b/examples/tcp_rerouting/Cargo.toml index 766f32aa..a1310ae8 100644 --- a/examples/tcp_rerouting/Cargo.toml +++ b/examples/tcp_rerouting/Cargo.toml @@ -6,6 +6,7 @@ authors = ["Proxy-Wasm contributors"] description = "Proxy-Wasm plugin example: TCP Rerouting based on source IP" license = "Apache-2.0" edition = "2021" +rust-version = "1.65" [lib] crate-type = ["cdylib"] From 4eb0ffd2456d32534952ada4ad63306d2e1447c1 Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Fri, 28 Nov 2025 12:17:56 -1000 Subject: [PATCH 07/16] Add license header to .proto file and refine MSRV approach - Add Apache 2.0 license header to set_envoy_filter_state.proto - Remove rust-version field from tcp_rerouting example Cargo.toml - Keep explicit dependency pins for proc-macro2 and quote to ensure Rust 1.65 compatibility This approach follows the pattern of other examples (no rust-version) while ensuring MSRV compatibility through explicit dependency pinning rather than relying on rust-version, which doesn't prevent Cargo from selecting incompatible dependency versions. Signed-off-by: Christof Gerber --- examples/tcp_rerouting/Cargo.toml | 4 +++- .../tcp_rerouting/src/set_envoy_filter_state.proto | 14 ++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/examples/tcp_rerouting/Cargo.toml b/examples/tcp_rerouting/Cargo.toml index a1310ae8..665a0c53 100644 --- a/examples/tcp_rerouting/Cargo.toml +++ b/examples/tcp_rerouting/Cargo.toml @@ -6,7 +6,6 @@ authors = ["Proxy-Wasm contributors"] description = "Proxy-Wasm plugin example: TCP Rerouting based on source IP" license = "Apache-2.0" edition = "2021" -rust-version = "1.65" [lib] crate-type = ["cdylib"] @@ -18,3 +17,6 @@ prost = "0.12" [build-dependencies] prost-build = "0.12" +# Pin proc-macro2 and quote to versions compatible with Rust 1.65 (MSRV) +proc-macro2 = "=1.0.92" +quote = "=1.0.37" diff --git a/examples/tcp_rerouting/src/set_envoy_filter_state.proto b/examples/tcp_rerouting/src/set_envoy_filter_state.proto index 3caceedf..8d709c92 100644 --- a/examples/tcp_rerouting/src/set_envoy_filter_state.proto +++ b/examples/tcp_rerouting/src/set_envoy_filter_state.proto @@ -1,3 +1,17 @@ +// Copyright 2020 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + syntax = "proto3"; package envoy.source.extensions.common.wasm; From 6193bdd228536d37e08b1f4f52a3f4f00adce884 Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Fri, 28 Nov 2025 13:00:31 -1000 Subject: [PATCH 08/16] Remove generated protobuf file from version control Remove examples/tcp_rerouting/src/generated/ from git tracking and add to .gitignore. Generated code should not be committed as it: - Can be regenerated from the .proto file via build.rs - Creates unnecessary diff noise when dependencies update - Can get out of sync with source The file is automatically generated during build by prost-build, so this does not affect functionality. Signed-off-by: Christof Gerber --- .gitignore | 2 + .../envoy.source.extensions.common.wasm.rs | 56 ------------------- 2 files changed, 2 insertions(+), 56 deletions(-) delete mode 100644 examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs diff --git a/.gitignore b/.gitignore index 2886ad76..576db526 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,5 @@ /bazel-* target Cargo.lock +# Generated protobuf code +examples/tcp_rerouting/src/generated/ diff --git a/examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs b/examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs deleted file mode 100644 index 53e2945c..00000000 --- a/examples/tcp_rerouting/src/generated/envoy.source.extensions.common.wasm.rs +++ /dev/null @@ -1,56 +0,0 @@ -// Copyright 2020 Google LLC -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -// This file is @generated by prost-build. -/// Argument expected by set_envoy_filter_state in envoy -/// -#[allow(clippy::derive_partial_eq_without_eq)] -#[derive(Clone, PartialEq, ::prost::Message)] -pub struct SetEnvoyFilterStateArguments { - #[prost(string, tag = "1")] - pub path: ::prost::alloc::string::String, - #[prost(string, tag = "2")] - pub value: ::prost::alloc::string::String, - #[prost(enumeration = "LifeSpan", tag = "3")] - pub span: i32, -} -#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)] -#[repr(i32)] -pub enum LifeSpan { - FilterChain = 0, - DownstreamRequest = 1, - DownstreamConnection = 2, -} -impl LifeSpan { - /// String value of the enum field names used in the ProtoBuf definition. - /// - /// The values are not transformed in any way and thus are considered stable - /// (if the ProtoBuf definition does not change) and safe for programmatic use. - pub fn as_str_name(&self) -> &'static str { - match self { - LifeSpan::FilterChain => "FilterChain", - LifeSpan::DownstreamRequest => "DownstreamRequest", - LifeSpan::DownstreamConnection => "DownstreamConnection", - } - } - /// Creates an enum from field names used in the ProtoBuf definition. - pub fn from_str_name(value: &str) -> ::core::option::Option { - match value { - "FilterChain" => Some(Self::FilterChain), - "DownstreamRequest" => Some(Self::DownstreamRequest), - "DownstreamConnection" => Some(Self::DownstreamConnection), - _ => None, - } - } -} From 025f43a74d69114559c6e513da5bcb05bb8a8717 Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Fri, 28 Nov 2025 13:06:45 -1000 Subject: [PATCH 09/16] Rename example to "Envoy TCP Routing" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rename tcp_rerouting to envoy_tcp_routing to: - Clearly indicate this is an Envoy-specific example - Use "routing" instead of "rerouting" for better terminology Changes: - Renamed directory: examples/tcp_rerouting → examples/envoy_tcp_routing - Updated package name: proxy-wasm-example-envoy-tcp-routing - Updated all references in README.md files - Updated Docker Compose network name and WASM filename - Updated Envoy config filter names and WASM path - Updated .gitignore path Signed-off-by: Christof Gerber --- .gitignore | 2 +- README.md | 2 +- examples/{tcp_rerouting => envoy_tcp_routing}/Cargo.toml | 4 ++-- examples/{tcp_rerouting => envoy_tcp_routing}/README.md | 6 +++--- examples/{tcp_rerouting => envoy_tcp_routing}/build.rs | 0 .../docker-compose.yaml | 2 +- .../{tcp_rerouting => envoy_tcp_routing}/envoy/envoy.yaml | 8 ++++---- examples/{tcp_rerouting => envoy_tcp_routing}/src/lib.rs | 0 .../src/set_envoy_filter_state.proto | 0 9 files changed, 12 insertions(+), 12 deletions(-) rename examples/{tcp_rerouting => envoy_tcp_routing}/Cargo.toml (75%) rename examples/{tcp_rerouting => envoy_tcp_routing}/README.md (89%) rename examples/{tcp_rerouting => envoy_tcp_routing}/build.rs (100%) rename examples/{tcp_rerouting => envoy_tcp_routing}/docker-compose.yaml (89%) rename examples/{tcp_rerouting => envoy_tcp_routing}/envoy/envoy.yaml (93%) rename examples/{tcp_rerouting => envoy_tcp_routing}/src/lib.rs (100%) rename examples/{tcp_rerouting => envoy_tcp_routing}/src/set_envoy_filter_state.proto (100%) diff --git a/.gitignore b/.gitignore index 576db526..e630c22e 100644 --- a/.gitignore +++ b/.gitignore @@ -2,4 +2,4 @@ target Cargo.lock # Generated protobuf code -examples/tcp_rerouting/src/generated/ +examples/envoy_tcp_routing/src/generated/ diff --git a/README.md b/README.md index 9ef939c1..4acad661 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ - [HTTP Configuration](./examples/http_config/) - [gRPC Auth (random)](./examples/grpc_auth_random/) - [Envoy filter metadata](./examples/envoy_filter_metadata/) -- [TCP Rerouting](./examples/tcp_rerouting/) +- [Envoy TCP Routing](./examples/envoy_tcp_routing/) ## Articles & blog posts from the community diff --git a/examples/tcp_rerouting/Cargo.toml b/examples/envoy_tcp_routing/Cargo.toml similarity index 75% rename from examples/tcp_rerouting/Cargo.toml rename to examples/envoy_tcp_routing/Cargo.toml index 665a0c53..d7b4e303 100644 --- a/examples/tcp_rerouting/Cargo.toml +++ b/examples/envoy_tcp_routing/Cargo.toml @@ -1,9 +1,9 @@ [package] publish = false -name = "proxy-wasm-example-tcp-rerouting" +name = "proxy-wasm-example-envoy-tcp-routing" version = "0.0.1" authors = ["Proxy-Wasm contributors"] -description = "Proxy-Wasm plugin example: TCP Rerouting based on source IP" +description = "Proxy-Wasm plugin example: Envoy TCP Routing based on source IP" license = "Apache-2.0" edition = "2021" diff --git a/examples/tcp_rerouting/README.md b/examples/envoy_tcp_routing/README.md similarity index 89% rename from examples/tcp_rerouting/README.md rename to examples/envoy_tcp_routing/README.md index b805aad1..51d9662c 100644 --- a/examples/tcp_rerouting/README.md +++ b/examples/envoy_tcp_routing/README.md @@ -1,4 +1,4 @@ -## Proxy-Wasm plugin example: TCP Rerouting +## Proxy-Wasm plugin example: Envoy TCP Routing Proxy-Wasm TCP filter that dynamically routes connections to different upstream clusters based on the source IP address. @@ -42,10 +42,10 @@ In separate terminals, test the routing behavior with different source IP addres ```bash # Even IP (last octet 10) → routes to egress-router1 -docker run --rm -it --network tcp_rerouting_envoymesh --ip 172.22.0.10 curlimages/curl curl http://proxy:10000/ip -H "Host: httpbin.org" +docker run --rm -it --network envoy_tcp_routing_envoymesh --ip 172.22.0.10 curlimages/curl curl http://proxy:10000/ip -H "Host: httpbin.org" # Odd IP (last octet 11) → routes to egress-router2 -docker run --rm -it --network tcp_rerouting_envoymesh --ip 172.22.0.11 curlimages/curl curl http://proxy:10000/ip -H "Host: httpbin.org" +docker run --rm -it --network envoy_tcp_routing_envoymesh --ip 172.22.0.11 curlimages/curl curl http://proxy:10000/ip -H "Host: httpbin.org" ``` ### Expected Output diff --git a/examples/tcp_rerouting/build.rs b/examples/envoy_tcp_routing/build.rs similarity index 100% rename from examples/tcp_rerouting/build.rs rename to examples/envoy_tcp_routing/build.rs diff --git a/examples/tcp_rerouting/docker-compose.yaml b/examples/envoy_tcp_routing/docker-compose.yaml similarity index 89% rename from examples/tcp_rerouting/docker-compose.yaml rename to examples/envoy_tcp_routing/docker-compose.yaml index 3b6ef2a1..fc294f33 100644 --- a/examples/tcp_rerouting/docker-compose.yaml +++ b/examples/envoy_tcp_routing/docker-compose.yaml @@ -18,7 +18,7 @@ services: entrypoint: /usr/local/bin/envoy -c /etc/envoy.yaml -l info --service-cluster proxy volumes: - ./envoy/envoy.yaml:/etc/envoy.yaml - - ./target/wasm32-wasip1/release/proxy_wasm_example_tcp_rerouting.wasm:/etc/tcp_rerouting.wasm + - ./target/wasm32-wasip1/release/proxy_wasm_example_envoy_tcp_routing.wasm:/etc/envoy_tcp_routing.wasm networks: - envoymesh ports: diff --git a/examples/tcp_rerouting/envoy/envoy.yaml b/examples/envoy_tcp_routing/envoy/envoy.yaml similarity index 93% rename from examples/tcp_rerouting/envoy/envoy.yaml rename to examples/envoy_tcp_routing/envoy/envoy.yaml index 324bb8ac..cffebd7a 100644 --- a/examples/tcp_rerouting/envoy/envoy.yaml +++ b/examples/envoy_tcp_routing/envoy/envoy.yaml @@ -27,17 +27,17 @@ static_resources: typed_config: "@type": type.googleapis.com/envoy.extensions.filters.network.wasm.v3.Wasm config: - name: tcp_rerouting_filter - root_id: tcp_rerouting_filter + name: envoy_tcp_routing_filter + root_id: envoy_tcp_routing_filter configuration: "@type": type.googleapis.com/google.protobuf.StringValue value: "standalone" vm_config: - vm_id: vm.tcp_rerouting + vm_id: vm.envoy_tcp_routing runtime: envoy.wasm.runtime.v8 code: local: - filename: /etc/tcp_rerouting.wasm + filename: /etc/envoy_tcp_routing.wasm allow_precompiled: true # TCP proxy filter - name: envoy.filters.network.tcp_proxy diff --git a/examples/tcp_rerouting/src/lib.rs b/examples/envoy_tcp_routing/src/lib.rs similarity index 100% rename from examples/tcp_rerouting/src/lib.rs rename to examples/envoy_tcp_routing/src/lib.rs diff --git a/examples/tcp_rerouting/src/set_envoy_filter_state.proto b/examples/envoy_tcp_routing/src/set_envoy_filter_state.proto similarity index 100% rename from examples/tcp_rerouting/src/set_envoy_filter_state.proto rename to examples/envoy_tcp_routing/src/set_envoy_filter_state.proto From a497acb6bc3e44f1fda4d1e283add2eeb1e2d4b2 Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Fri, 28 Nov 2025 13:23:10 -1000 Subject: [PATCH 10/16] Remove unnecessary statement from README Remove the statement about most examples focusing on HTTP, as it's not essential information for the README. Signed-off-by: Christof Gerber --- examples/envoy_tcp_routing/README.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/examples/envoy_tcp_routing/README.md b/examples/envoy_tcp_routing/README.md index 51d9662c..aa940377 100644 --- a/examples/envoy_tcp_routing/README.md +++ b/examples/envoy_tcp_routing/README.md @@ -2,8 +2,6 @@ Proxy-Wasm TCP filter that dynamically routes connections to different upstream clusters based on the source IP address. -Most WASM filter examples focus on HTTP, but this example shows how to work at the TCP/IP level. - This example is inspired by the [wasmerang](https://github.com/SiiiTschiii/wasmerang) project, which demonstrates advanced TCP routing patterns in Envoy/Istio/K8s using WASM filters. ### Overview From 4c45b591285d8377a52bbfa49fe3ffa5699a604f Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Fri, 28 Nov 2025 13:25:34 -1000 Subject: [PATCH 11/16] Clarify TCP stream context operation in README Add explanation that the example operates at the TCP stream context (L4) rather than the HTTP application layer, highlighting its usefulness for scenarios where application-layer processing should be avoided. Signed-off-by: Christof Gerber --- examples/envoy_tcp_routing/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/examples/envoy_tcp_routing/README.md b/examples/envoy_tcp_routing/README.md index aa940377..0a327ff6 100644 --- a/examples/envoy_tcp_routing/README.md +++ b/examples/envoy_tcp_routing/README.md @@ -2,6 +2,8 @@ Proxy-Wasm TCP filter that dynamically routes connections to different upstream clusters based on the source IP address. +This example operates at the TCP stream context (L4) rather than the HTTP application layer, making it useful for use cases where application-layer processing should be avoided while still enabling intelligent routing decisions. + This example is inspired by the [wasmerang](https://github.com/SiiiTschiii/wasmerang) project, which demonstrates advanced TCP routing patterns in Envoy/Istio/K8s using WASM filters. ### Overview From 22e1515b1939e7956ee327c75764f36813d544df Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Fri, 28 Nov 2025 14:26:29 -1000 Subject: [PATCH 12/16] Add Proxy-Wasm spec links and mention performance benefits Add links to TCP stream and HTTP stream contexts in the Proxy-Wasm spec, and clarify that operating at the TCP level is useful for performance and protocol-agnostic routing decisions. Signed-off-by: Christof Gerber --- examples/envoy_tcp_routing/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/envoy_tcp_routing/README.md b/examples/envoy_tcp_routing/README.md index 0a327ff6..88150458 100644 --- a/examples/envoy_tcp_routing/README.md +++ b/examples/envoy_tcp_routing/README.md @@ -2,7 +2,7 @@ Proxy-Wasm TCP filter that dynamically routes connections to different upstream clusters based on the source IP address. -This example operates at the TCP stream context (L4) rather than the HTTP application layer, making it useful for use cases where application-layer processing should be avoided while still enabling intelligent routing decisions. +This example operates at the [TCP stream context](https://github.com/proxy-wasm/spec/tree/main/abi-versions/v0.2.1#tcp-streams) (L4) rather than the [HTTP application layer](https://github.com/proxy-wasm/spec/tree/main/abi-versions/v0.2.1#http-streams), making it useful for use cases where application-layer processing should be avoided for performance or protocol-agnostic routing decisions. This example is inspired by the [wasmerang](https://github.com/SiiiTschiii/wasmerang) project, which demonstrates advanced TCP routing patterns in Envoy/Istio/K8s using WASM filters. From 7bba77f93066ca246547e02c340af28dc003684f Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Fri, 28 Nov 2025 15:08:25 -1000 Subject: [PATCH 13/16] docs(envoy_tcp_routing): improve README with destination info and future enhancements MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Fix grammar: "In separate terminals" → "In a separate terminal" - Add consistency: "routes to" → "routes via" in output examples - Add "Note on Destination Information" section explaining: - Hardcoded httpbin.org endpoints in both clusters - PROXY protocol for preserving metadata across TCP hops - Implementation approach using WASM stream context + Envoy config - Document future enhancement for source-based egress router use case: - Routing via different external IPs (e.g., even vs. odd source IP) - Explain conventional network approach (routing tables + IP rules) - Note challenges in managed K8s (requires plugins like Multus CNI) - Clarify how K8s abstracts layer 3 routing configuration Signed-off-by: Christof Gerber --- examples/envoy_tcp_routing/README.md | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/examples/envoy_tcp_routing/README.md b/examples/envoy_tcp_routing/README.md index 88150458..a128c454 100644 --- a/examples/envoy_tcp_routing/README.md +++ b/examples/envoy_tcp_routing/README.md @@ -38,7 +38,7 @@ $ docker compose up ### Test the Routing -In separate terminals, test the routing behavior with different source IP addresses: +In a separate terminal test the routing behavior with different source IP addresses: ```bash # Even IP (last octet 10) → routes to egress-router1 @@ -56,7 +56,7 @@ Check the Docker Compose logs to see the WASM filter in action: $ docker compose logs -f ``` -**For even IP (last octet 10) → routes to egress-router1:** +**For even IP (last octet 10) → routes via egress-router1:** ``` proxy-1 | [TCP WASM] Source address: 172.22.0.10:39484 @@ -67,7 +67,7 @@ proxy-1 | [TCP WASM] Rerouting to egress-router1 via filter state proxy-1 | [2025-11-20T03:08:18.423Z] cluster=egress-router1 src=172.22.0.10:39484 dst=172.22.0.2:10000 -> 35.170.145.70:80 ``` -**For odd IP (last octet 11) → routes to egress-router2:** +**For odd IP (last octet 11) → routes via egress-router2:** ``` proxy-1 | [TCP WASM] Source address: 172.22.0.11:55320 @@ -79,3 +79,11 @@ proxy-1 | [2025-11-20T03:08:39.974Z] cluster=egress-router2 src=172.22.0.11:553 ``` The `Ok(None)` status confirms that the filter state was successfully set, and you can see in the access logs that traffic is being routed to the correct clusters (`egress-router1` for even IPs, `egress-router2` for odd IPs). + +### Note on Destination Information + +In this example, both Envoy clusters (`egress-router1` and `egress-router2`) have `httpbin.org` hardcoded as their load balancer endpoints. + +In real world scenarios where destination information needs to be preserved across TCP hops, the [PROXY protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) could be used to forward metadata like the original source and destination addresses between proxies. This could be implemented using advanced WASM stream context capabilities combined with Envoy's PROXY protocol configuration. + +**Future Enhancement:** With Istio (Envoy-based) in a Kubernetes setup and PROXY protocol support, this example could be extended to serve as a source-based egress router. One practical use case would be routing user's web traffic via different external IP addresses based on source-based routing decisions (e.g., even vs. odd source IP like in the example). In conventional networks, this would be achieved with routing tables and IP rules to select egress interfaces based on source addresses. However, this approach is close to impossible with managed Kubernetes services (without additional network plugins like [Multus CNI](https://github.com/k8snetworkplumbingwg/multus-cni), as Kubernetes largely abstracts away the network layer where such layer 3 routing (different outgoing IPs) would normally be configured. From f74a46a2e7dc8b7a1f20b5c12b9d2ee05e0139dd Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Fri, 28 Nov 2025 15:24:40 -1000 Subject: [PATCH 14/16] Revert "Update Bazel dependencies" This reverts commit 467e8d60249357747a2c22de511e77b2c4f40f36. The Bazel dependency updates are not related to the envoy_tcp_routing example, which builds using cargo with wasm32-wasip1 target. The example has its own dependency pins in Cargo.toml for MSRV compatibility and does not use the Bazel build system. Signed-off-by: Christof Gerber --- bazel/cargo/Cargo.Bazel.lock | 16 +++---- bazel/cargo/remote/BUILD.bazel | 6 +-- ...og-0.4.28.bazel => BUILD.log-0.4.27.bazel} | 2 +- .../remote/BUILD.mockalloc-macros-0.1.0.bazel | 4 +- ....bazel => BUILD.proc-macro2-1.0.101.bazel} | 8 ++-- ...-1.0.42.bazel => BUILD.quote-1.0.41.bazel} | 8 ++-- bazel/cargo/remote/BUILD.syn-1.0.109.bazel | 6 +-- ...bazel => BUILD.unicode-ident-1.0.19.bazel} | 2 +- bazel/cargo/remote/defs.bzl | 44 +++++++++---------- 9 files changed, 48 insertions(+), 48 deletions(-) rename bazel/cargo/remote/{BUILD.log-0.4.28.bazel => BUILD.log-0.4.27.bazel} (99%) rename bazel/cargo/remote/{BUILD.proc-macro2-1.0.103.bazel => BUILD.proc-macro2-1.0.101.bazel} (96%) rename bazel/cargo/remote/{BUILD.quote-1.0.42.bazel => BUILD.quote-1.0.41.bazel} (96%) rename bazel/cargo/remote/{BUILD.unicode-ident-1.0.22.bazel => BUILD.unicode-ident-1.0.19.bazel} (99%) diff --git a/bazel/cargo/Cargo.Bazel.lock b/bazel/cargo/Cargo.Bazel.lock index 92dd9b11..21d41bc9 100644 --- a/bazel/cargo/Cargo.Bazel.lock +++ b/bazel/cargo/Cargo.Bazel.lock @@ -33,9 +33,9 @@ dependencies = [ [[package]] name = "log" -version = "0.4.28" +version = "0.4.27" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432" +checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94" [[package]] name = "mockalloc" @@ -59,9 +59,9 @@ dependencies = [ [[package]] name = "proc-macro2" -version = "1.0.103" +version = "1.0.101" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8" +checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de" dependencies = [ "unicode-ident", ] @@ -77,9 +77,9 @@ dependencies = [ [[package]] name = "quote" -version = "1.0.42" +version = "1.0.41" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f" +checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1" dependencies = [ "proc-macro2", ] @@ -97,6 +97,6 @@ dependencies = [ [[package]] name = "unicode-ident" -version = "1.0.22" +version = "1.0.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5" +checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d" diff --git a/bazel/cargo/remote/BUILD.bazel b/bazel/cargo/remote/BUILD.bazel index df6e7fb1..294313a7 100644 --- a/bazel/cargo/remote/BUILD.bazel +++ b/bazel/cargo/remote/BUILD.bazel @@ -44,14 +44,14 @@ alias( ) alias( - name = "log-0.4.28", - actual = "@crates_vendor__log-0.4.28//:log", + name = "log-0.4.27", + actual = "@crates_vendor__log-0.4.27//:log", tags = ["manual"], ) alias( name = "log", - actual = "@crates_vendor__log-0.4.28//:log", + actual = "@crates_vendor__log-0.4.27//:log", tags = ["manual"], ) diff --git a/bazel/cargo/remote/BUILD.log-0.4.28.bazel b/bazel/cargo/remote/BUILD.log-0.4.27.bazel similarity index 99% rename from bazel/cargo/remote/BUILD.log-0.4.28.bazel rename to bazel/cargo/remote/BUILD.log-0.4.27.bazel index b0dc7030..dbfcf020 100644 --- a/bazel/cargo/remote/BUILD.log-0.4.28.bazel +++ b/bazel/cargo/remote/BUILD.log-0.4.27.bazel @@ -88,5 +88,5 @@ rust_library( "@rules_rust//rust/platform:x86_64-unknown-uefi": [], "//conditions:default": ["@platforms//:incompatible"], }), - version = "0.4.28", + version = "0.4.27", ) diff --git a/bazel/cargo/remote/BUILD.mockalloc-macros-0.1.0.bazel b/bazel/cargo/remote/BUILD.mockalloc-macros-0.1.0.bazel index 591dac06..70ab9d81 100644 --- a/bazel/cargo/remote/BUILD.mockalloc-macros-0.1.0.bazel +++ b/bazel/cargo/remote/BUILD.mockalloc-macros-0.1.0.bazel @@ -90,8 +90,8 @@ rust_proc_macro( }), version = "0.1.0", deps = [ - "@crates_vendor__proc-macro2-1.0.103//:proc_macro2", - "@crates_vendor__quote-1.0.42//:quote", + "@crates_vendor__proc-macro2-1.0.101//:proc_macro2", + "@crates_vendor__quote-1.0.41//:quote", "@crates_vendor__syn-1.0.109//:syn", ], ) diff --git a/bazel/cargo/remote/BUILD.proc-macro2-1.0.103.bazel b/bazel/cargo/remote/BUILD.proc-macro2-1.0.101.bazel similarity index 96% rename from bazel/cargo/remote/BUILD.proc-macro2-1.0.103.bazel rename to bazel/cargo/remote/BUILD.proc-macro2-1.0.101.bazel index 87577bc0..51c8d72d 100644 --- a/bazel/cargo/remote/BUILD.proc-macro2-1.0.103.bazel +++ b/bazel/cargo/remote/BUILD.proc-macro2-1.0.101.bazel @@ -96,10 +96,10 @@ rust_library( "@rules_rust//rust/platform:x86_64-unknown-uefi": [], "//conditions:default": ["@platforms//:incompatible"], }), - version = "1.0.103", + version = "1.0.101", deps = [ - "@crates_vendor__proc-macro2-1.0.103//:build_script_build", - "@crates_vendor__unicode-ident-1.0.22//:unicode_ident", + "@crates_vendor__proc-macro2-1.0.101//:build_script_build", + "@crates_vendor__unicode-ident-1.0.19//:unicode_ident", ], ) @@ -155,7 +155,7 @@ cargo_build_script( "noclippy", "norustfmt", ], - version = "1.0.103", + version = "1.0.101", visibility = ["//visibility:private"], ) diff --git a/bazel/cargo/remote/BUILD.quote-1.0.42.bazel b/bazel/cargo/remote/BUILD.quote-1.0.41.bazel similarity index 96% rename from bazel/cargo/remote/BUILD.quote-1.0.42.bazel rename to bazel/cargo/remote/BUILD.quote-1.0.41.bazel index f2c6332b..2576b03c 100644 --- a/bazel/cargo/remote/BUILD.quote-1.0.42.bazel +++ b/bazel/cargo/remote/BUILD.quote-1.0.41.bazel @@ -96,10 +96,10 @@ rust_library( "@rules_rust//rust/platform:x86_64-unknown-uefi": [], "//conditions:default": ["@platforms//:incompatible"], }), - version = "1.0.42", + version = "1.0.41", deps = [ - "@crates_vendor__proc-macro2-1.0.103//:proc_macro2", - "@crates_vendor__quote-1.0.42//:build_script_build", + "@crates_vendor__proc-macro2-1.0.101//:proc_macro2", + "@crates_vendor__quote-1.0.41//:build_script_build", ], ) @@ -155,7 +155,7 @@ cargo_build_script( "noclippy", "norustfmt", ], - version = "1.0.42", + version = "1.0.41", visibility = ["//visibility:private"], ) diff --git a/bazel/cargo/remote/BUILD.syn-1.0.109.bazel b/bazel/cargo/remote/BUILD.syn-1.0.109.bazel index ef19ab41..057bf1d9 100644 --- a/bazel/cargo/remote/BUILD.syn-1.0.109.bazel +++ b/bazel/cargo/remote/BUILD.syn-1.0.109.bazel @@ -104,10 +104,10 @@ rust_library( }), version = "1.0.109", deps = [ - "@crates_vendor__proc-macro2-1.0.103//:proc_macro2", - "@crates_vendor__quote-1.0.42//:quote", + "@crates_vendor__proc-macro2-1.0.101//:proc_macro2", + "@crates_vendor__quote-1.0.41//:quote", "@crates_vendor__syn-1.0.109//:build_script_build", - "@crates_vendor__unicode-ident-1.0.22//:unicode_ident", + "@crates_vendor__unicode-ident-1.0.19//:unicode_ident", ], ) diff --git a/bazel/cargo/remote/BUILD.unicode-ident-1.0.22.bazel b/bazel/cargo/remote/BUILD.unicode-ident-1.0.19.bazel similarity index 99% rename from bazel/cargo/remote/BUILD.unicode-ident-1.0.22.bazel rename to bazel/cargo/remote/BUILD.unicode-ident-1.0.19.bazel index ea7867d2..c60baf29 100644 --- a/bazel/cargo/remote/BUILD.unicode-ident-1.0.22.bazel +++ b/bazel/cargo/remote/BUILD.unicode-ident-1.0.19.bazel @@ -88,5 +88,5 @@ rust_library( "@rules_rust//rust/platform:x86_64-unknown-uefi": [], "//conditions:default": ["@platforms//:incompatible"], }), - version = "1.0.22", + version = "1.0.19", ) diff --git a/bazel/cargo/remote/defs.bzl b/bazel/cargo/remote/defs.bzl index 19090501..9587c7f8 100644 --- a/bazel/cargo/remote/defs.bzl +++ b/bazel/cargo/remote/defs.bzl @@ -296,7 +296,7 @@ _NORMAL_DEPENDENCIES = { "": { _COMMON_CONDITION: { "hashbrown": Label("@crates_vendor//:hashbrown-0.16.0"), - "log": Label("@crates_vendor//:log-0.4.28"), + "log": Label("@crates_vendor//:log-0.4.27"), }, }, } @@ -454,12 +454,12 @@ def crate_repositories(): maybe( http_archive, - name = "crates_vendor__log-0.4.28", - sha256 = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432", + name = "crates_vendor__log-0.4.27", + sha256 = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94", type = "tar.gz", - urls = ["https://static.crates.io/crates/log/0.4.28/download"], - strip_prefix = "log-0.4.28", - build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.log-0.4.28.bazel"), + urls = ["https://static.crates.io/crates/log/0.4.27/download"], + strip_prefix = "log-0.4.27", + build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.log-0.4.27.bazel"), ) maybe( @@ -484,22 +484,22 @@ def crate_repositories(): maybe( http_archive, - name = "crates_vendor__proc-macro2-1.0.103", - sha256 = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8", + name = "crates_vendor__proc-macro2-1.0.101", + sha256 = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de", type = "tar.gz", - urls = ["https://static.crates.io/crates/proc-macro2/1.0.103/download"], - strip_prefix = "proc-macro2-1.0.103", - build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.proc-macro2-1.0.103.bazel"), + urls = ["https://static.crates.io/crates/proc-macro2/1.0.101/download"], + strip_prefix = "proc-macro2-1.0.101", + build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.proc-macro2-1.0.101.bazel"), ) maybe( http_archive, - name = "crates_vendor__quote-1.0.42", - sha256 = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f", + name = "crates_vendor__quote-1.0.41", + sha256 = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1", type = "tar.gz", - urls = ["https://static.crates.io/crates/quote/1.0.42/download"], - strip_prefix = "quote-1.0.42", - build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.quote-1.0.42.bazel"), + urls = ["https://static.crates.io/crates/quote/1.0.41/download"], + strip_prefix = "quote-1.0.41", + build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.quote-1.0.41.bazel"), ) maybe( @@ -514,16 +514,16 @@ def crate_repositories(): maybe( http_archive, - name = "crates_vendor__unicode-ident-1.0.22", - sha256 = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5", + name = "crates_vendor__unicode-ident-1.0.19", + sha256 = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d", type = "tar.gz", - urls = ["https://static.crates.io/crates/unicode-ident/1.0.22/download"], - strip_prefix = "unicode-ident-1.0.22", - build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.unicode-ident-1.0.22.bazel"), + urls = ["https://static.crates.io/crates/unicode-ident/1.0.19/download"], + strip_prefix = "unicode-ident-1.0.19", + build_file = Label("@proxy_wasm_rust_sdk//bazel/cargo/remote:BUILD.unicode-ident-1.0.19.bazel"), ) return [ struct(repo = "crates_vendor__hashbrown-0.16.0", is_dev_dep = False), - struct(repo = "crates_vendor__log-0.4.28", is_dev_dep = False), + struct(repo = "crates_vendor__log-0.4.27", is_dev_dep = False), struct(repo = "crates_vendor__mockalloc-0.1.2", is_dev_dep = True), ] From 1745d75f583e5698c7ab6ae8c83ef2792133e854 Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Fri, 28 Nov 2025 16:42:44 -1000 Subject: [PATCH 15/16] Switch TCP routing example to wasm32-wasi target and pin MSRV-compatible deps - Change build target from wasm32-wasip1 to wasm32-wasi for MSRV (1.65) compatibility - Update docker-compose.yaml to mount wasm32-wasi artifact path - Pin build dependencies to latest MSRV-compatible versions: - prost-build 0.11.9, quote 1.0.41, proc-macro2 1.0 (existing pins) - indexmap 2.11.4, home 0.5.5 (pinned transitive deps) - Update README.md build instructions to reflect new target The wasm32-wasip1 target is not available in Rust 1.65. By switching to wasm32-wasi and constraining transitive dependencies that require newer Rust editions (indexmap 2.12+ needs edition 2024, home 0.5.12+ needs edition 2024), we ensure the example builds with the project's MSRV. Signed-off-by: Christof Gerber --- examples/envoy_tcp_routing/Cargo.toml | 15 ++++++++++----- examples/envoy_tcp_routing/README.md | 2 +- examples/envoy_tcp_routing/docker-compose.yaml | 2 +- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/examples/envoy_tcp_routing/Cargo.toml b/examples/envoy_tcp_routing/Cargo.toml index d7b4e303..39e5ba94 100644 --- a/examples/envoy_tcp_routing/Cargo.toml +++ b/examples/envoy_tcp_routing/Cargo.toml @@ -13,10 +13,15 @@ crate-type = ["cdylib"] [dependencies] log = "0.4" proxy-wasm = { path = "../../" } -prost = "0.12" +# Pin to MSRV-compatible prost release +prost = "=0.11.9" [build-dependencies] -prost-build = "0.12" -# Pin proc-macro2 and quote to versions compatible with Rust 1.65 (MSRV) -proc-macro2 = "=1.0.92" -quote = "=1.0.37" +# Pin to MSRV (v1.65) compatible releases +prost-build = "=0.11.9" +quote = "=1.0.41" +proc-macro2 = "1.0" +# Pin transitive dependencies to MSRV (v1.65) versions +indexmap = "=2.11.4" +home = "=0.5.5" + diff --git a/examples/envoy_tcp_routing/README.md b/examples/envoy_tcp_routing/README.md index a128c454..cd1120b5 100644 --- a/examples/envoy_tcp_routing/README.md +++ b/examples/envoy_tcp_routing/README.md @@ -23,7 +23,7 @@ The filter uses Envoy's `set_envoy_filter_state` foreign function to dynamically Build the WASM plugin from the example directory: ```sh -$ cargo build --target wasm32-wasip1 --release +$ cargo build --target wasm32-wasi --release ``` ### Running with Docker Compose diff --git a/examples/envoy_tcp_routing/docker-compose.yaml b/examples/envoy_tcp_routing/docker-compose.yaml index fc294f33..35be5e2c 100644 --- a/examples/envoy_tcp_routing/docker-compose.yaml +++ b/examples/envoy_tcp_routing/docker-compose.yaml @@ -18,7 +18,7 @@ services: entrypoint: /usr/local/bin/envoy -c /etc/envoy.yaml -l info --service-cluster proxy volumes: - ./envoy/envoy.yaml:/etc/envoy.yaml - - ./target/wasm32-wasip1/release/proxy_wasm_example_envoy_tcp_routing.wasm:/etc/envoy_tcp_routing.wasm + - ./target/wasm32-wasi/release/proxy_wasm_example_envoy_tcp_routing.wasm:/etc/envoy_tcp_routing.wasm networks: - envoymesh ports: From 28e1234e5fd10eb73129a2e445bb560f9569fe27 Mon Sep 17 00:00:00 2001 From: Christof Gerber Date: Fri, 5 Dec 2025 12:02:43 -1000 Subject: [PATCH 16/16] Update TCP routing example to use latest dependencies - Upgrade prost to 0.14 (from 0.11.9) - Remove MSRV-specific dependency pins (indexmap, home, quote) - Switch back to wasm32-wasip1 target (now supported in current Rust) - Update docker-compose.yaml to use wasm32-wasip1 artifact path This change addresses the cargo outdated CI check failures and aligns with the maintainer's guidance that examples don't need to be MSRV-compatible. Signed-off-by: Christof Gerber --- examples/envoy_tcp_routing/Cargo.toml | 10 ++-------- examples/envoy_tcp_routing/README.md | 2 +- examples/envoy_tcp_routing/docker-compose.yaml | 2 +- 3 files changed, 4 insertions(+), 10 deletions(-) diff --git a/examples/envoy_tcp_routing/Cargo.toml b/examples/envoy_tcp_routing/Cargo.toml index 39e5ba94..ab7c38b5 100644 --- a/examples/envoy_tcp_routing/Cargo.toml +++ b/examples/envoy_tcp_routing/Cargo.toml @@ -13,15 +13,9 @@ crate-type = ["cdylib"] [dependencies] log = "0.4" proxy-wasm = { path = "../../" } -# Pin to MSRV-compatible prost release -prost = "=0.11.9" +prost = "0.14" [build-dependencies] -# Pin to MSRV (v1.65) compatible releases -prost-build = "=0.11.9" -quote = "=1.0.41" +prost-build = "0.14" proc-macro2 = "1.0" -# Pin transitive dependencies to MSRV (v1.65) versions -indexmap = "=2.11.4" -home = "=0.5.5" diff --git a/examples/envoy_tcp_routing/README.md b/examples/envoy_tcp_routing/README.md index cd1120b5..a128c454 100644 --- a/examples/envoy_tcp_routing/README.md +++ b/examples/envoy_tcp_routing/README.md @@ -23,7 +23,7 @@ The filter uses Envoy's `set_envoy_filter_state` foreign function to dynamically Build the WASM plugin from the example directory: ```sh -$ cargo build --target wasm32-wasi --release +$ cargo build --target wasm32-wasip1 --release ``` ### Running with Docker Compose diff --git a/examples/envoy_tcp_routing/docker-compose.yaml b/examples/envoy_tcp_routing/docker-compose.yaml index 35be5e2c..fc294f33 100644 --- a/examples/envoy_tcp_routing/docker-compose.yaml +++ b/examples/envoy_tcp_routing/docker-compose.yaml @@ -18,7 +18,7 @@ services: entrypoint: /usr/local/bin/envoy -c /etc/envoy.yaml -l info --service-cluster proxy volumes: - ./envoy/envoy.yaml:/etc/envoy.yaml - - ./target/wasm32-wasi/release/proxy_wasm_example_envoy_tcp_routing.wasm:/etc/envoy_tcp_routing.wasm + - ./target/wasm32-wasip1/release/proxy_wasm_example_envoy_tcp_routing.wasm:/etc/envoy_tcp_routing.wasm networks: - envoymesh ports: