Add file server filter

CODEOWNERS

@@ -268,6 +268,7 @@ extensions/upstreams/tcp @ggreenway @mattklein123
 /*/extensions/config/validators/minimum_clusters @adisuissa @yanavlasov
 # File system based extensions
 /*/extensions/common/async_files @mattklein123 @ravenblackx
+/*/extensions/filters/http/file_server @ravenblackx @wbpcode @phlax
 /*/extensions/filters/http/file_system_buffer @mattklein123 @ravenblackx
 /*/extensions/http/cache/file_system_http_cache @ggreenway @UNOWNED
 /*/extensions/http/cache_v2/file_system_http_cache @ggreenway @ravenblackx

api/BUILD

@@ -204,6 +204,7 @@ proto_library(
         "//envoy/extensions/filters/http/ext_authz/v3:pkg",
         "//envoy/extensions/filters/http/ext_proc/v3:pkg",
         "//envoy/extensions/filters/http/fault/v3:pkg",
+        "//envoy/extensions/filters/http/file_server/v3:pkg",
         "//envoy/extensions/filters/http/file_system_buffer/v3:pkg",
         "//envoy/extensions/filters/http/gcp_authn/v3:pkg",
         "//envoy/extensions/filters/http/geoip/v3:pkg",

api/envoy/extensions/filters/http/file_server/v3/BUILD

@@ -0,0 +1,13 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/extensions/common/async_files/v3:pkg",
+        "@xds//udpa/annotations:pkg",
+        "@xds//xds/annotations/v3:pkg",
+    ],
+)

api/envoy/extensions/filters/http/file_server/v3/file_server.proto

@@ -0,0 +1,85 @@
+syntax = "proto3";
+
+package envoy.extensions.filters.http.file_server.v3;
+
+import "envoy/extensions/common/async_files/v3/async_file_manager.proto";
+
+import "xds/annotations/v3/status.proto";
+
+import "udpa/annotations/status.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.filters.http.file_server.v3";
+option java_outer_classname = "FileServerProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/file_server/v3;file_serverv3";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+option (xds.annotations.v3.file_status).work_in_progress = true;
+
+// [#protodoc-title: FileServerConfig]
+// [#extension: envoy.filters.http.file_server]
+
+// A :ref:`file server <config_http_filters_file_server>` filter configuration.
+// [#next-free-field: 6]
+message FileServerConfig {
+  message PathMapping {
+    // If no ``request_path_prefix`` is matched, the filter does not intercept a request.
+    //
+    // If a ``request_path_prefix`` is matched, that prefix is removed from the request
+    // and replaced with ``file_path_prefix`` to form a filesystem path for
+    // the request.
+    //
+    // Prefix ``/`` will match all GET requests.
+    string request_path_prefix = 1 [(validate.rules).string = {min_len: 1}];
+
+    // Replaces a matched ``request_path_prefix`` to form a filesystem path for a
+    // request. May be relative to the working directory of the envoy execution,
+    // or an absolute path.
+    string file_path_prefix = 2 [(validate.rules).string = {min_len: 1}];
+  }
+
+  message DirectoryBehavior {
+    // [#not-implemented-hide:] Directory operations currently have no async implementation.
+    message List {
+    }
+
+    // Attempts to serve the given file within the directory, e.g. ``index.html``.
+    // Precisely one of ``default_file`` and ``list`` must be set per ``DirectoryBehavior``.
+    string default_file = 1 [(validate.rules).string = {pattern: "^[^/]*$"}];
+
+    // Responds with an html formatted list of the files and subdirectories in the directory.
+    // Precisely one of ``default_file`` and ``list`` must be set per ``DirectoryBehavior``.
+    // [#not-implemented-hide:] Directory operations currently have no async implementation.
+    List list = 2;
+  }
+
+  // A configuration for the AsyncFileManager to be used to read from the filesystem.
+  common.async_files.v3.AsyncFileManagerConfig manager_config = 1
+      [(validate.rules).message = {required: true}];
+
+  // The longest matching path_mapping takes precedence.
+  repeated PathMapping path_mappings = 2;
+
+  // A map from filename suffix to content type header.
+  // e.g. {"txt": "text/plain"}
+  //
+  // File suffixes may not contain ``.`` as the filename suffix after
+  // the last ``.`` is used to perform an O(1) lookup against the keys.
+  //
+  // An empty string suffix will only match files ending with a ``.``.
+  //
+  // Files with no suffix (e.g. ``README``) can be matched as the full string.
+  map<string, string> content_types = 3;
+
+  // If ``content_types`` does not contain a match for a file suffix,
+  // ``default_content_type`` is used.
+  //
+  // If there is no match and ``default_content_type`` is empty, the
+  // ``content-type`` header will be omitted from the response.
+  string default_content_type = 4;
+
+  // If the requested path refers to a directory, the given behaviors are
+  // tried in order until one succeeds. If the end of the list is reached
+  // with no success, the result is a 403 Forbidden.
+  repeated DirectoryBehavior directory_behaviors = 5;
+}

api/versioning/BUILD

@@ -143,6 +143,7 @@ proto_library(
         "//envoy/extensions/filters/http/ext_authz/v3:pkg",
         "//envoy/extensions/filters/http/ext_proc/v3:pkg",
         "//envoy/extensions/filters/http/fault/v3:pkg",
+        "//envoy/extensions/filters/http/file_server/v3:pkg",
         "//envoy/extensions/filters/http/file_system_buffer/v3:pkg",
         "//envoy/extensions/filters/http/gcp_authn/v3:pkg",
         "//envoy/extensions/filters/http/geoip/v3:pkg",

bazel/repositories.bzl

@@ -8,6 +8,7 @@ PPC_SKIP_TARGETS = ["envoy.string_matcher.lua", "envoy.filters.http.lua", "envoy
 WINDOWS_SKIP_TARGETS = [
     "envoy.extensions.http.cache.file_system_http_cache",
     "envoy.extensions.http.cache_v2.file_system_http_cache",
+    "envoy.filters.http.file_server",
     "envoy.filters.http.file_system_buffer",
     "envoy.filters.http.language",
     "envoy.filters.http.sxg",

docs/root/configuration/http/http_filters/file_server_filter.rst

@@ -0,0 +1,20 @@
+.. _config_http_filters_file_server:
+
+File Server
+===========
+
+The file server filter can be used to respond with the contents of a file from the filesystem.
+
+The ``content-length`` header will be the size of the file.
+
+The ``content-type`` header will be set based on filename suffix and filter configuration.
+
+.. note::
+
+ This filter is not yet supported on Windows.
+
+Configuration
+-------------
+
+* This filter should be configured with the type URL ``type.googleapis.com/envoy.extensions.filters.http.file_server.v3.FileServerConfig``.
+* :ref:`v3 API reference <envoy_v3_api_msg_extensions.filters.http.file_server.v3.FileServerConfig>`

docs/root/configuration/http/http_filters/http_filters.rst

@@ -31,6 +31,7 @@ HTTP filters
   ext_authz_filter
   ext_proc_filter
   fault_filter
+  file_server_filter
   file_system_buffer_filter
   gcp_authn_filter
   geoip_filter

source/extensions/extensions_build_config.bzl

@@ -179,6 +179,7 @@ EXTENSIONS = {
     "envoy.filters.http.ext_authz":                     "//source/extensions/filters/http/ext_authz:config",
     "envoy.filters.http.ext_proc":                      "//source/extensions/filters/http/ext_proc:config",
     "envoy.filters.http.fault":                         "//source/extensions/filters/http/fault:config",
+    "envoy.filters.http.file_server":                   "//source/extensions/filters/http/file_server:config",
     "envoy.filters.http.file_system_buffer":            "//source/extensions/filters/http/file_system_buffer:config",
     "envoy.filters.http.gcp_authn":                     "//source/extensions/filters/http/gcp_authn:config",
     "envoy.filters.http.geoip":                         "//source/extensions/filters/http/geoip:config",

source/extensions/extensions_metadata.yaml

@@ -482,6 +482,13 @@ envoy.filters.http.fault:
   status: stable
   type_urls:
   - envoy.extensions.filters.http.fault.v3.HTTPFault
+envoy.filters.http.file_server:
+  categories:
+  - envoy.filters.http
+  security_posture: unknown
+  status: wip
+  type_urls:
+  - envoy.extensions.filters.http.file_server.v3.FileServerConfig
 envoy.filters.http.file_system_buffer:
   categories:
   - envoy.filters.http

source/extensions/filters/http/file_server/BUILD

@@ -0,0 +1,56 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_extension",
+    "envoy_cc_library",
+    "envoy_extension_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_extension_package()
+
+envoy_cc_library(
+    name = "absl_status_to_http_status",
+    srcs = ["absl_status_to_http_status.cc"],
+    hdrs = ["absl_status_to_http_status.h"],
+    deps = [
+        "//envoy/http:codes_interface",
+    ],
+)
+
+envoy_cc_library(
+    name = "file_server_lib",
+    srcs = [
+        "file_streamer.cc",
+        "filter.cc",
+        "filter_config.cc",
+    ],
+    hdrs = [
+        "file_streamer.h",
+        "filter.h",
+        "filter_config.h",
+    ],
+    deps = [
+        ":absl_status_to_http_status",
+        "//envoy/buffer:buffer_interface",
+        "//envoy/server:instance_interface",
+        "//source/common/common:enum_to_int",
+        "//source/common/common:radix_tree_lib",
+        "//source/common/http:codes_lib",
+        "//source/common/http:header_map_lib",
+        "//source/extensions/common/async_files",
+        "//source/extensions/filters/http/common:pass_through_filter_lib",
+        "@envoy_api//envoy/extensions/filters/http/file_server/v3:pkg_cc_proto",
+    ],
+)
+
+envoy_cc_extension(
+    name = "config",
+    srcs = ["config.cc"],
+    hdrs = ["config.h"],
+    deps = [
+        ":file_server_lib",
+        "//source/extensions/filters/http/common:factory_base_lib",
+        "@envoy_api//envoy/extensions/filters/http/file_server/v3:pkg_cc_proto",
+    ],
+)

source/extensions/filters/http/file_server/absl_status_to_http_status.cc

@@ -0,0 +1,48 @@
+#include "source/extensions/filters/http/file_server/absl_status_to_http_status.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace HttpFilters {
+namespace FileServer {
+
+Http::Code abslStatusToHttpStatus(absl::StatusCode code) {
+  switch (code) {
+  case absl::StatusCode::kOk:
+    return Http::Code::OK;
+  case absl::StatusCode::kCancelled:
+    return static_cast<Http::Code>(499);
+  case absl::StatusCode::kUnknown:
+    return Http::Code::InternalServerError;
+  case absl::StatusCode::kInvalidArgument:
+    return Http::Code::BadRequest;
+  case absl::StatusCode::kDeadlineExceeded:
+    return Http::Code::GatewayTimeout;
+  case absl::StatusCode::kNotFound:
+    return Http::Code::NotFound;
+  case absl::StatusCode::kAlreadyExists:
+    return Http::Code::Conflict;
+  case absl::StatusCode::kPermissionDenied:
+    return Http::Code::Forbidden;
+  case absl::StatusCode::kResourceExhausted:
+    return Http::Code::TooManyRequests;
+  case absl::StatusCode::kFailedPrecondition:
+    return Http::Code::BadRequest;
+  case absl::StatusCode::kAborted:
+    return Http::Code::Conflict;
+  case absl::StatusCode::kOutOfRange:
+    return Http::Code::RangeNotSatisfiable;
+  case absl::StatusCode::kUnimplemented:
+    return Http::Code::ServiceUnavailable;
+  case absl::StatusCode::kDataLoss:
+    return Http::Code::InternalServerError;
+  case absl::StatusCode::kUnauthenticated:
+    return Http::Code::Unauthorized;
+  default:
+    return Http::Code::InternalServerError;
+  }
+}
+
+} // namespace FileServer
+} // namespace HttpFilters
+} // namespace Extensions
+} // namespace Envoy

source/extensions/filters/http/file_server/absl_status_to_http_status.h

@@ -0,0 +1,17 @@
+#pragma once
+
+#include "envoy/http/codes.h"
+
+#include "absl/status/status.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace HttpFilters {
+namespace FileServer {
+
+Http::Code abslStatusToHttpStatus(absl::StatusCode code);
+
+} // namespace FileServer
+} // namespace HttpFilters
+} // namespace Extensions
+} // namespace Envoy