sdk: bump to the latest version of the dynamic modules sdk (#219)

Bumps the SDK to the latest version. This brings some goodies:

* Adds the `GetAttributeBool` so we can get the `mtls` attribute and use
it in OPA and Cedar policies (implemented in this PR).
* Introduces the `UnsafeEnvoyBuffer` to clearly set when allocations and
copies are used.
* This PR refactors all uses to use the `Unsafe` version where no copies
were used before, and to use the `safe` version where `strings.Clone` or
other copies were used.

The last commit
c2c35c2
fixes #254

---------

Signed-off-by: Ignasi Barrera <ignasi@tetrate.io>
Co-authored-by: code <wbphub@gmail.com>

Author: nacx

.github/workflows/cli.yaml

@@ -97,6 +97,7 @@ jobs:
       run:
         working-directory: ./cli
     env:
+      GO_TEST_ARGS: -v
       TEST_BOE_REGISTRY: ghcr.io/tetratelabs/built-on-envoy
       TEST_BOE_REGISTRY_USERNAME: ${{ github.actor }}
       TEST_BOE_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

cli/cmd/templates/create/go.mod.tmpl

@@ -3,5 +3,5 @@ module {{ .Name }}
 go 1.26.1
 
 require (
-	github.com/envoyproxy/envoy/source/extensions/dynamic_modules v0.0.0-20260224023207-910d516c7b4e
+	github.com/envoyproxy/envoy/source/extensions/dynamic_modules v0.0.0-20260311012303-5ef4e4cea57f
 )

cli/cmd/templates/create/rust/Cargo.toml.tmpl

@@ -7,7 +7,7 @@ repository = "https://github.com/tetratelabs/built-on-envoy"
 
 [dependencies]
 # The SDK version must match the Envoy version due to the strict compatibility requirements.
-envoy-proxy-dynamic-modules-rust-sdk = { git = "https://github.com/envoyproxy/envoy", rev = "07bece5476a5e3c95c8b0a3df4e41d3dd0769df4" }
+envoy-proxy-dynamic-modules-rust-sdk = { git = "https://github.com/envoyproxy/envoy", rev = "5ef4e4cea57f63e7e2970b9c1ad696278db927d6" }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 

cli/e2e/run_test.go

@@ -86,7 +86,7 @@ func TestDockerRemoteExtension(t *testing.T) {
 		"--listen-port", "11000",
 		"--dev",
 		"--log-level", "dynamic_modules:debug",
-		"--extension", "example-go")
+		"--extension", "example-go:0.3.0")
 
 	t.Cleanup(func() {
 		_ = proc.Signal(syscall.SIGTERM)
@@ -168,8 +168,16 @@ func TestRustLocalExtension(t *testing.T) {
 }
 
 func TestLocalGoExtension(t *testing.T) {
-	// Configure the test env vars, as composer src will be downloaded from the registry
-	internaltesting.SkipIfTestRegistryNotConfigured(t)
+	// Local builds for Go will pull libcomposer from the remote registry. However, when we're doing changes to versions, etc, we don't want it to
+	// pull an obsolete version, so we'll just push the current composer source to the local registry and use that for the test.
+	t.Setenv("BOE_REGISTRY", registryAddr)
+	t.Setenv("BOE_REGISTRY_INSECURE", "true")
+	makeCmd := exec.CommandContext(t.Context(), "make", "push_code")
+	makeCmd.Dir = "../../extensions/composer"
+	output, err := makeCmd.CombinedOutput()
+	t.Logf("make push_code output: %s", string(output))
+	require.NoError(t, err)
+
 	dataDir := t.TempDir()
 
 	// Create a brand new extension

extensions/composer/bedrock-guardrails/callback.go

@@ -50,7 +50,7 @@ type applyGuardrailCallback struct {
 	index int
 }
 
-func (a *applyGuardrailCallback) OnHttpCalloutDone(_ uint64, result shared.HttpCalloutResult, headers [][2]string, body [][]byte) { //nolint:revive
+func (a *applyGuardrailCallback) OnHttpCalloutDone(_ uint64, result shared.HttpCalloutResult, headers [][2]shared.UnsafeEnvoyBuffer, body []shared.UnsafeEnvoyBuffer) { //nolint:revive
 	a.handle.Log(shared.LogLevelDebug, "bedrock-guardrails: Started Callout callback")
 
 	fullbody := joinBody(body)
@@ -205,11 +205,15 @@ func (a *applyGuardrailCallback) OnHttpCalloutDone(_ uint64, result shared.HttpC
 
 // joinBody returns the body as a single byte slice, avoiding to call bytes.Join
 // when there is only one chunk which always returns a copy.
-func joinBody(body [][]byte) []byte {
+func joinBody(body []shared.UnsafeEnvoyBuffer) []byte {
 	if len(body) == 1 {
-		return body[0]
+		return body[0].ToUnsafeBytes()
 	}
-	return bytes.Join(body, nil)
+	chunks := make([][]byte, len(body))
+	for i, b := range body {
+		chunks[i] = b.ToUnsafeBytes()
+	}
+	return bytes.Join(chunks, nil)
 }
 
 // sendLocalRespError logs the message (with optional raw body), sends
@@ -225,10 +229,10 @@ func sendLocalRespError(handle shared.HttpFilterHandle, level shared.LogLevel, s
 }
 
 // headerValue returns the first value for a key in a [][2]string header list.
-func headerValue(headers [][2]string, key string) string {
+func headerValue(headers [][2]shared.UnsafeEnvoyBuffer, key string) string {
 	for _, h := range headers {
-		if h[0] == key {
-			return h[1]
+		if h[0].ToUnsafeString() == key {
+			return h[1].ToUnsafeString()
 		}
 	}
 	return ""

extensions/composer/bedrock-guardrails/callback_test.go

@@ -15,59 +15,61 @@ import (
 	"github.com/envoyproxy/envoy/source/extensions/dynamic_modules/sdk/go/shared/mocks"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
+
+	"github.com/tetratelabs/built-on-envoy/extensions/composer/pkg"
 )
 
 // --- Tests for joinBody ---
 
 func TestJoinBody_SingleChunk(t *testing.T) {
 	chunk := []byte("hello world")
-	result := joinBody([][]byte{chunk})
+	result := joinBody([]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes(chunk)})
 	require.Equal(t, chunk, result)
 }
 
 func TestJoinBody_MultipleChunks(t *testing.T) {
-	result := joinBody([][]byte{[]byte("foo"), []byte("bar"), []byte("baz")})
+	result := joinBody([]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes([]byte("foo")), pkg.UnsafeBufferFromBytes([]byte("bar")), pkg.UnsafeBufferFromBytes([]byte("baz"))})
 	require.Equal(t, []byte("foobarbaz"), result)
 }
 
 func TestJoinBody_EmptySlice(t *testing.T) {
-	result := joinBody([][]byte{})
+	result := joinBody([]shared.UnsafeEnvoyBuffer{})
 	require.Empty(t, result)
 }
 
 func TestJoinBody_EmptyChunks(t *testing.T) {
-	result := joinBody([][]byte{{}, []byte("data"), {}})
+	result := joinBody([]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes([]byte{}), pkg.UnsafeBufferFromBytes([]byte("data")), pkg.UnsafeBufferFromBytes([]byte{})})
 	require.Equal(t, []byte("data"), result)
 }
 
 // --- Tests for headerValue ---
 
 func TestHeaderValue_Found(t *testing.T) {
-	headers := [][2]string{
-		{":method", "POST"},
-		{":path", "/api/v1"},
-		{":status", "200"},
+	headers := [][2]shared.UnsafeEnvoyBuffer{
+		{pkg.UnsafeBufferFromBytes([]byte(":method")), pkg.UnsafeBufferFromBytes([]byte("POST"))},
+		{pkg.UnsafeBufferFromBytes([]byte(":path")), pkg.UnsafeBufferFromBytes([]byte("/api/v1"))},
+		{pkg.UnsafeBufferFromBytes([]byte(":status")), pkg.UnsafeBufferFromBytes([]byte("200"))},
 	}
 	require.Equal(t, "POST", headerValue(headers, ":method"))
 	require.Equal(t, "/api/v1", headerValue(headers, ":path"))
 	require.Equal(t, "200", headerValue(headers, ":status"))
 }
 
 func TestHeaderValue_NotFound(t *testing.T) {
-	headers := [][2]string{
-		{":method", "POST"},
+	headers := [][2]shared.UnsafeEnvoyBuffer{
+		{pkg.UnsafeBufferFromBytes([]byte(":method")), pkg.UnsafeBufferFromBytes([]byte("POST"))},
 	}
 	require.Empty(t, headerValue(headers, ":status"))
 }
 
 func TestHeaderValue_EmptyHeaders(t *testing.T) {
-	require.Empty(t, headerValue([][2]string{}, ":method"))
+	require.Empty(t, headerValue([][2]shared.UnsafeEnvoyBuffer{}, ":method"))
 }
 
 func TestHeaderValue_ReturnsFirstMatch(t *testing.T) {
-	headers := [][2]string{
-		{"x-header", "first"},
-		{"x-header", "second"},
+	headers := [][2]shared.UnsafeEnvoyBuffer{
+		{pkg.UnsafeBufferFromBytes([]byte("x-header")), pkg.UnsafeBufferFromBytes([]byte("first"))},
+		{pkg.UnsafeBufferFromBytes([]byte("x-header")), pkg.UnsafeBufferFromBytes([]byte("second"))},
 	}
 	require.Equal(t, "first", headerValue(headers, "x-header"))
 }
@@ -123,11 +125,13 @@ func TestGetCalloutHeaders_ValidBody(t *testing.T) {
 		APIKey:              "my-secret-key",
 	}
 
-	headers, calloutBody, err := getCalloutHeaders(args)
+	rawHeaders, calloutBody, err := getCalloutHeaders(args)
 	require.NoError(t, err)
-	require.NotNil(t, headers)
+	require.NotNil(t, rawHeaders)
 	require.NotNil(t, calloutBody)
 
+	headers := toUnsafeEnvoyBufferHeaders(rawHeaders)
+
 	// Verify path contains guardrail ID and version
 	require.Equal(t, "/guardrail/my-guardrail/version/DRAFT/apply", headerValue(headers, ":path"))
 	// Verify required HTTP/2 pseudo-headers
@@ -158,7 +162,7 @@ func TestGetCalloutHeaders_MultipleUserMessages(t *testing.T) {
 
 	headers, calloutBody, err := getCalloutHeaders(args)
 	require.NoError(t, err)
-	require.Equal(t, "/guardrail/g1/version/1/apply", headerValue(headers, ":path"))
+	require.Equal(t, "/guardrail/g1/version/1/apply", headerValue(toUnsafeEnvoyBufferHeaders(headers), ":path"))
 
 	var req ApplyGuardrailRequest
 	require.NoError(t, json.Unmarshal(calloutBody, &req))
@@ -382,7 +386,7 @@ func TestOnHttpCalloutDone_CalloutFailure(t *testing.T) {
 		},
 	}
 
-	a.OnHttpCalloutDone(1, shared.HttpCalloutReset, [][2]string{}, [][]byte{})
+	a.OnHttpCalloutDone(1, shared.HttpCalloutReset, [][2]shared.UnsafeEnvoyBuffer{}, []shared.UnsafeEnvoyBuffer{})
 }
 
 func TestOnHttpCalloutDone_NonSuccessHTTPStatus(t *testing.T) {
@@ -402,8 +406,8 @@ func TestOnHttpCalloutDone_NonSuccessHTTPStatus(t *testing.T) {
 	}
 
 	a.OnHttpCalloutDone(1, shared.HttpCalloutSuccess,
-		[][2]string{{":status", "503"}},
-		[][]byte{[]byte(`{"error":"service unavailable"}`)},
+		[][2]shared.UnsafeEnvoyBuffer{{pkg.UnsafeBufferFromBytes([]byte(":status")), pkg.UnsafeBufferFromBytes([]byte("503"))}},
+		[]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes([]byte(`{"error":"service unavailable"}`))},
 	)
 }
 
@@ -431,8 +435,8 @@ func TestOnHttpCalloutDone_NoInterventionLastGuardrail(t *testing.T) {
 	}
 
 	a.OnHttpCalloutDone(1, shared.HttpCalloutSuccess,
-		[][2]string{{":status", "200"}},
-		[][]byte{respBody},
+		[][2]shared.UnsafeEnvoyBuffer{{pkg.UnsafeBufferFromBytes([]byte(":status")), pkg.UnsafeBufferFromBytes([]byte("200"))}},
+		[]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes(respBody)},
 	)
 
 	// The original body should have been appended to the buffered body
@@ -456,8 +460,8 @@ func TestOnHttpCalloutDone_BlockedByContentPolicy(t *testing.T) {
 	}
 
 	a.OnHttpCalloutDone(1, shared.HttpCalloutSuccess,
-		[][2]string{{":status", "200"}},
-		[][]byte{blockedContentPolicyResponse("g1", "1")},
+		[][2]shared.UnsafeEnvoyBuffer{{pkg.UnsafeBufferFromBytes([]byte(":status")), pkg.UnsafeBufferFromBytes([]byte("200"))}},
+		[]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes(blockedContentPolicyResponse("g1", "1"))},
 	)
 }
 
@@ -478,8 +482,8 @@ func TestOnHttpCalloutDone_BlockedByTopicPolicy(t *testing.T) {
 	}
 
 	a.OnHttpCalloutDone(1, shared.HttpCalloutSuccess,
-		[][2]string{{":status", "200"}},
-		[][]byte{blockedTopicPolicyResponse("g1", "1")},
+		[][2]shared.UnsafeEnvoyBuffer{{pkg.UnsafeBufferFromBytes([]byte(":status")), pkg.UnsafeBufferFromBytes([]byte("200"))}},
+		[]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes(blockedTopicPolicyResponse("g1", "1"))},
 	)
 }
 
@@ -500,8 +504,8 @@ func TestOnHttpCalloutDone_BlockedByPIIPolicy(t *testing.T) {
 	}
 
 	a.OnHttpCalloutDone(1, shared.HttpCalloutSuccess,
-		[][2]string{{":status", "200"}},
-		[][]byte{blockedPIIResponse("g1", "1")},
+		[][2]shared.UnsafeEnvoyBuffer{{pkg.UnsafeBufferFromBytes([]byte(":status")), pkg.UnsafeBufferFromBytes([]byte("200"))}},
+		[]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes(blockedPIIResponse("g1", "1"))},
 	)
 }
 
@@ -530,8 +534,8 @@ func TestOnHttpCalloutDone_MaskedLastGuardrail(t *testing.T) {
 	}
 
 	a.OnHttpCalloutDone(1, shared.HttpCalloutSuccess,
-		[][2]string{{":status", "200"}},
-		[][]byte{respBody},
+		[][2]shared.UnsafeEnvoyBuffer{{pkg.UnsafeBufferFromBytes([]byte(":status")), pkg.UnsafeBufferFromBytes([]byte("200"))}},
+		[]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes(respBody)},
 	)
 
 	// The masked body should have been appended (not the original)
@@ -577,8 +581,8 @@ func TestOnHttpCalloutDone_NoInterventionTriggersNextGuardrail(t *testing.T) {
 	}
 
 	a.OnHttpCalloutDone(1, shared.HttpCalloutSuccess,
-		[][2]string{{":status", "200"}},
-		[][]byte{respBody},
+		[][2]shared.UnsafeEnvoyBuffer{{pkg.UnsafeBufferFromBytes([]byte(":status")), pkg.UnsafeBufferFromBytes([]byte("200"))}},
+		[]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes(respBody)},
 	)
 }
 
@@ -616,8 +620,8 @@ func TestOnHttpCalloutDone_MaskedTriggersNextGuardrail(t *testing.T) {
 	}
 
 	a.OnHttpCalloutDone(1, shared.HttpCalloutSuccess,
-		[][2]string{{":status", "200"}},
-		[][]byte{respBody},
+		[][2]shared.UnsafeEnvoyBuffer{{pkg.UnsafeBufferFromBytes([]byte(":status")), pkg.UnsafeBufferFromBytes([]byte("200"))}},
+		[]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes(respBody)},
 	)
 }
 
@@ -657,8 +661,8 @@ func TestOnHttpCalloutDone_NextGuardrailCalloutFailure(t *testing.T) {
 	}
 
 	a.OnHttpCalloutDone(1, shared.HttpCalloutSuccess,
-		[][2]string{{":status", "200"}},
-		[][]byte{respBody},
+		[][2]shared.UnsafeEnvoyBuffer{{pkg.UnsafeBufferFromBytes([]byte(":status")), pkg.UnsafeBufferFromBytes([]byte("200"))}},
+		[]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes(respBody)},
 	)
 }
 
@@ -689,8 +693,8 @@ func TestOnHttpCalloutDone_BodyMultipleChunks(t *testing.T) {
 	}
 
 	a.OnHttpCalloutDone(1, shared.HttpCalloutSuccess,
-		[][2]string{{":status", "200"}},
-		[][]byte{chunk1, chunk2},
+		[][2]shared.UnsafeEnvoyBuffer{{pkg.UnsafeBufferFromBytes([]byte(":status")), pkg.UnsafeBufferFromBytes([]byte("200"))}},
+		[]shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes(chunk1), pkg.UnsafeBufferFromBytes(chunk2)},
 	)
 
 	require.Equal(t, originalBody, fakeBuffer.Body)

extensions/composer/bedrock-guardrails/plugin_test.go

@@ -14,6 +14,8 @@ import (
 	"github.com/envoyproxy/envoy/source/extensions/dynamic_modules/sdk/go/shared/mocks"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
+
+	"github.com/tetratelabs/built-on-envoy/extensions/composer/pkg"
 )
 
 // testBodyBuffer is a correct implementation of shared.BodyBuffer for tests,
@@ -28,8 +30,10 @@ func newTestBodyBuffer(data []byte) *testBodyBuffer {
 	return &testBodyBuffer{body: b}
 }
 
-func (b *testBodyBuffer) GetChunks() [][]byte { return [][]byte{b.body} }
-func (b *testBodyBuffer) GetSize() uint64     { return uint64(len(b.body)) }
+func (b *testBodyBuffer) GetChunks() []shared.UnsafeEnvoyBuffer {
+	return []shared.UnsafeEnvoyBuffer{pkg.UnsafeBufferFromBytes(b.body)}
+}
+func (b *testBodyBuffer) GetSize() uint64 { return uint64(len(b.body)) }
 func (b *testBodyBuffer) Drain(size uint64) {
 	if size >= uint64(len(b.body)) {
 		b.body = nil
@@ -532,15 +536,15 @@ func TestOnRequestBody_MultipleGuardrails_FirstTriggered(t *testing.T) {
 	fakeHeaders := fake.NewFakeHeaderMap(map[string][]string{})
 	mockHandle.EXPECT().RequestHeaders().Return(fakeHeaders).AnyTimes()
 
-	var capturedHeaders [][2]string
+	var capturedHeaders [][2]shared.UnsafeEnvoyBuffer
 	mockHandle.EXPECT().HttpCallout(
 		"bedrock-cluster",
 		gomock.Any(),
 		gomock.Any(),
 		gomock.Any(),
 		gomock.Any(),
 	).DoAndReturn(func(_ string, headers [][2]string, _ []byte, _ uint64, _ shared.HttpCalloutCallback) (shared.HttpCalloutInitResult, uint64) {
-		capturedHeaders = headers
+		capturedHeaders = toUnsafeEnvoyBufferHeaders(headers)
 		return shared.HttpCalloutInitSuccess, uint64(1)
 	}).Times(1)
 
@@ -565,3 +569,12 @@ func TestOnRequestBody_MultipleGuardrails_FirstTriggered(t *testing.T) {
 	// Only the first guardrail should have been called
 	require.Equal(t, "/guardrail/first-guardrail/version/1/apply", headerValue(capturedHeaders, ":path"))
 }
+
+func toUnsafeEnvoyBufferHeaders(headers [][2]string) [][2]shared.UnsafeEnvoyBuffer {
+	unsafeHeaders := make([][2]shared.UnsafeEnvoyBuffer, len(headers))
+	for i, h := range headers {
+		unsafeHeaders[i][0] = pkg.UnsafeBufferFromBytes([]byte(h[0]))
+		unsafeHeaders[i][1] = pkg.UnsafeBufferFromBytes([]byte(h[1]))
+	}
+	return unsafeHeaders
+}

extensions/composer/cedar/manifest.yaml

@@ -75,6 +75,7 @@ longDescription: |
       "address": "10.0.0.2:443"
     },
     "connection": {
+      "mtls": true,
       "tls_version": "TLSv1.3"
     },
     "parsed_path": ["api", "v1", "resource"],