formatter: add REQ_ALL_HEADERS/RESP_ALL_HEADERS extension formatter

api/BUILD

@@ -300,6 +300,7 @@ proto_library(
         "//envoy/extensions/filters/udp/udp_proxy/session/dynamic_forward_proxy/v3:pkg",
         "//envoy/extensions/filters/udp/udp_proxy/session/http_capsule/v3:pkg",
         "//envoy/extensions/filters/udp/udp_proxy/v3:pkg",
+        "//envoy/extensions/formatter/all_headers/v3:pkg",
         "//envoy/extensions/formatter/cel/v3:pkg",
         "//envoy/extensions/formatter/file_content/v3:pkg",
         "//envoy/extensions/formatter/generic_secret/v3:pkg",

api/envoy/extensions/formatter/all_headers/v3/BUILD

@@ -0,0 +1,9 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = ["@xds//udpa/annotations:pkg"],
+)

api/envoy/extensions/formatter/all_headers/v3/all_headers.proto

@@ -0,0 +1,39 @@
+syntax = "proto3";
+
+package envoy.extensions.formatter.all_headers.v3;
+
+import "udpa/annotations/status.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.formatter.all_headers.v3";
+option java_outer_classname = "AllHeadersProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/formatter/all_headers/v3;all_headersv3";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Formatter extension for printing all request or response headers]
+// [#extension: envoy.formatter.all_headers]
+
+// AllHeaders formatter extension implements REQ_ALL_HEADERS and RESP_ALL_HEADERS command
+// operators that serialize all HTTP request or response headers into a JSON object.
+// This is useful for security observability and threat detection where logging all headers
+// is needed without enumerating each header individually in the access log configuration.
+// See :ref:`here <config_access_log>` for more information on access log configuration.
+
+// %REQ_ALL_HEADERS%
+//   Serializes all HTTP request headers as a JSON object. Each header name becomes a key
+//   and the header value becomes the corresponding string value. Repeated headers are
+//   comma-joined per RFC 7230. Pseudo-headers (e.g. ``:method``, ``:path``) are included.
+
+// %RESP_ALL_HEADERS%
+//   Serializes all HTTP response headers as a JSON object. Same behavior as
+//   REQ_ALL_HEADERS but operates on response headers.
+
+// Configuration for the all headers formatter.
+message AllHeaders {
+  // Truncate individual header values longer than this many bytes. 0 means unlimited.
+  uint32 max_value_bytes = 1;
+
+  // Header names to exclude from output (case-insensitive).
+  // Recommended: ["authorization", "cookie", "set-cookie"] to avoid logging sensitive data.
+  repeated string exclude_headers = 2;
+}

api/versioning/BUILD

@@ -239,6 +239,7 @@ proto_library(
         "//envoy/extensions/filters/udp/udp_proxy/session/dynamic_forward_proxy/v3:pkg",
         "//envoy/extensions/filters/udp/udp_proxy/session/http_capsule/v3:pkg",
         "//envoy/extensions/filters/udp/udp_proxy/v3:pkg",
+        "//envoy/extensions/formatter/all_headers/v3:pkg",
         "//envoy/extensions/formatter/cel/v3:pkg",
         "//envoy/extensions/formatter/file_content/v3:pkg",
         "//envoy/extensions/formatter/generic_secret/v3:pkg",

changelogs/current/new_features/formatter__added-req-all-headers-resp-all-headers.rst

@@ -0,0 +1,4 @@
+Added :ref:`%REQ_ALL_HEADERS% and %RESP_ALL_HEADERS% <config_advanced_substitution_formatter>`
+access log formatters that serialize all HTTP request or response headers as a JSON object.
+Configured via the ``envoy.formatter.all_headers`` extension with ``exclude_headers`` and
+``max_value_bytes`` options.

docs/root/configuration/advanced/substitution_formatter.rst

@@ -1795,6 +1795,58 @@ Current supported substitution commands include:
   TCP/UDP
     Not implemented. It will appear as ``"-"`` in the access logs.
 
+``%REQ_ALL_HEADERS%``
+  HTTP
+    Serializes all HTTP request headers as a JSON object. Each header name becomes a
+    lowercase key and the header value becomes the corresponding string value. Repeated
+    headers with the same name are comma-joined per RFC 7230. Pseudo-headers
+    (``:method``, ``:path``, ``:authority``) are included. When no request headers are
+    available, ``"-"`` appears in the access log (or ``null`` in JSON format).
+
+    .. note::
+
+      ``set-cookie`` headers are not safely comma-joinable per RFC 6265. If you need
+      to log ``set-cookie`` values faithfully, consider excluding them via
+      ``exclude_headers`` and logging them separately with ``%RESP(set-cookie)%``.
+
+    When used with ``json_format``, the output is a nested JSON object rather than a flat
+    string, allowing downstream log consumers to parse individual headers without
+    additional deserialization.
+
+    This formatter is an extension, which must be explicitly configured with:
+
+    .. validated-code-block:: yaml
+      :type-name: envoy.config.core.v3.TypedExtensionConfig
+
+      name: envoy.formatter.all_headers
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.formatter.all_headers.v3.AllHeaders
+        max_value_bytes: 256
+        exclude_headers:
+          - "authorization"
+          - "cookie"
+          - "set-cookie"
+
+    Configuration options:
+
+    - ``max_value_bytes``: Truncate individual header values longer than this many bytes.
+      ``0`` means unlimited (default).
+    - ``exclude_headers``: List of header names (case-insensitive) to omit from the output.
+      It is recommended to exclude sensitive headers such as ``authorization``, ``cookie``,
+      and ``set-cookie``.
+
+  TCP/UDP
+    Not implemented. It will appear as ``"-"`` in the access logs.
+
+``%RESP_ALL_HEADERS%``
+  HTTP
+    Serializes all HTTP response headers as a JSON object. Behavior is the same as
+    ``%REQ_ALL_HEADERS%`` but operates on response headers. Shares the same extension
+    configuration (``envoy.formatter.all_headers``).
+
+  TCP/UDP
+    Not implemented. It will appear as ``"-"`` in the access logs.
+
 ``%FILE_CONTENT(X:Y):Z%``
   Evaluates to the content of the file at path ``X``. The file is reloaded whenever it changes.
 

source/extensions/extensions_build_config.bzl

@@ -507,6 +507,7 @@ EXTENSIONS = {
     # Formatter
     #
 
+    "envoy.formatter.all_headers":                       "//source/extensions/formatter/all_headers:config",
     "envoy.formatter.cel":                              "//source/extensions/formatter/cel:config",
     "envoy.formatter.file_content":                     "//source/extensions/formatter/file_content:config",
     "envoy.formatter.generic_secret":                   "//source/extensions/formatter/generic_secret:config",

source/extensions/extensions_metadata.yaml

@@ -1066,6 +1066,13 @@ envoy.filters.upstream_network.reverse_tunnel_lifecycle:
   status: wip
   type_urls:
   - google.protobuf.Empty
+envoy.formatter.all_headers:
+  categories:
+  - envoy.formatter
+  security_posture: robust_to_untrusted_downstream_and_upstream
+  status: alpha
+  type_urls:
+  - envoy.extensions.formatter.all_headers.v3.AllHeaders
 envoy.formatter.cel:
   categories:
   - envoy.formatter

source/extensions/formatter/all_headers/BUILD

@@ -0,0 +1,33 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_extension",
+    "envoy_cc_library",
+    "envoy_extension_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_extension_package()
+
+envoy_cc_library(
+    name = "all_headers_lib",
+    srcs = ["all_headers.cc"],
+    hdrs = ["all_headers.h"],
+    deps = [
+        "//source/common/formatter:substitution_format_utility_lib",
+        "//source/common/formatter:substitution_formatter_lib",
+        "//source/common/http:utility_lib",
+        "//source/common/protobuf:utility_lib",
+    ],
+)
+
+envoy_cc_extension(
+    name = "config",
+    srcs = ["config.cc"],
+    hdrs = ["config.h"],
+    deps = [
+        "//envoy/registry",
+        "//source/extensions/formatter/all_headers:all_headers_lib",
+        "@envoy_api//envoy/extensions/formatter/all_headers/v3:pkg_cc_proto",
+    ],
+)

source/extensions/formatter/all_headers/all_headers.cc

@@ -0,0 +1,113 @@
+#include "source/extensions/formatter/all_headers/all_headers.h"
+
+#include <string>
+
+#include "source/common/http/utility.h"
+#include "source/common/protobuf/utility.h"
+
+#include "absl/strings/ascii.h"
+#include "absl/strings/str_cat.h"
+#include "fmt/format.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace Formatter {
+
+AllHeadersFormatter::AllHeadersFormatter(AllHeadersType type, uint32_t max_value_bytes,
+                                         absl::flat_hash_set<std::string> exclude_headers)
+    : type_(type), max_value_bytes_(max_value_bytes), exclude_headers_(std::move(exclude_headers)) {
+}
+
+Protobuf::Struct AllHeadersFormatter::buildHeadersStruct(const Http::HeaderMap& headers) const {
+  Protobuf::Struct headers_struct;
+  auto* fields = headers_struct.mutable_fields();
+
+  headers.iterate([&](const Http::HeaderEntry& entry) -> Http::HeaderMap::Iterate {
+    std::string key(entry.key().getStringView());
+    const std::string key_lower = absl::AsciiStrToLower(key);
+    if (exclude_headers_.contains(key_lower)) {
+      return Http::HeaderMap::Iterate::Continue;
+    }
+
+    std::string val(entry.value().getStringView());
+    if (max_value_bytes_ > 0 && val.size() > max_value_bytes_) {
+      val = val.substr(0, max_value_bytes_);
+    }
+
+    // Comma-join repeated headers per RFC 7230.
+    auto it = fields->find(key_lower);
+    if (it != fields->end()) {
+      it->second.set_string_value(absl::StrCat(it->second.string_value(), ",", val));
+    } else {
+      (*fields)[key_lower].set_string_value(std::move(val));
+    }
+    return Http::HeaderMap::Iterate::Continue;
+  });
+
+  return headers_struct;
+}
+
+namespace {
+const Http::HeaderMap* getHeaders(AllHeadersType type, const Envoy::Formatter::Context& context) {
+  if (type == AllHeadersType::Request) {
+    const auto ref = context.requestHeaders();
+    return ref.has_value() ? &ref.ref() : nullptr;
+  }
+  const auto ref = context.responseHeaders();
+  return ref.has_value() ? &ref.ref() : nullptr;
+}
+} // namespace
+
+absl::optional<std::string> AllHeadersFormatter::format(const Envoy::Formatter::Context& context,
+                                                        const StreamInfo::StreamInfo&) const {
+  const Http::HeaderMap* headers = getHeaders(type_, context);
+  if (headers == nullptr) {
+    return absl::nullopt;
+  }
+
+  Protobuf::Struct headers_struct = buildHeadersStruct(*headers);
+  Protobuf::Value wrapper;
+  *wrapper.mutable_struct_value() = std::move(headers_struct);
+  return MessageUtil::getJsonStringFromMessageOrError(wrapper, false, true);
+}
+
+Protobuf::Value AllHeadersFormatter::formatValue(const Envoy::Formatter::Context& context,
+                                                 const StreamInfo::StreamInfo&) const {
+  const Http::HeaderMap* headers = getHeaders(type_, context);
+  if (headers == nullptr) {
+    return ValueUtil::nullValue();
+  }
+
+  return ValueUtil::structValue(buildHeadersStruct(*headers));
+}
+
+AllHeadersCommandParser::AllHeadersCommandParser(uint32_t max_value_bytes,
+                                                 absl::flat_hash_set<std::string> exclude_headers)
+    : max_value_bytes_(max_value_bytes), exclude_headers_(std::move(exclude_headers)) {}
+
+::Envoy::Formatter::FormatterProviderPtr
+AllHeadersCommandParser::parse(absl::string_view command, absl::string_view subcommand,
+                               absl::optional<size_t> max_length) const {
+  AllHeadersType type;
+  if (command == "REQ_ALL_HEADERS") {
+    type = AllHeadersType::Request;
+  } else if (command == "RESP_ALL_HEADERS") {
+    type = AllHeadersType::Response;
+  } else {
+    return nullptr;
+  }
+
+  if (!subcommand.empty()) {
+    throw EnvoyException(
+        fmt::format("{} does not accept subcommands, got '{}'", command, subcommand));
+  }
+  if (max_length.has_value()) {
+    throw EnvoyException(fmt::format("{} does not accept a max_length parameter", command));
+  }
+
+  return std::make_unique<AllHeadersFormatter>(type, max_value_bytes_, exclude_headers_);
+}
+
+} // namespace Formatter
+} // namespace Extensions
+} // namespace Envoy

source/extensions/formatter/all_headers/all_headers.h

@@ -0,0 +1,52 @@
+#pragma once
+
+#include <string>
+
+#include "envoy/config/typed_config.h"
+#include "envoy/registry/registry.h"
+
+#include "source/common/formatter/substitution_format_utility.h"
+#include "source/common/formatter/substitution_formatter.h"
+
+#include "absl/container/flat_hash_set.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace Formatter {
+
+enum class AllHeadersType { Request, Response };
+
+class AllHeadersFormatter : public ::Envoy::Formatter::FormatterProvider {
+public:
+  AllHeadersFormatter(AllHeadersType type, uint32_t max_value_bytes,
+                      absl::flat_hash_set<std::string> exclude_headers);
+
+  absl::optional<std::string> format(const Envoy::Formatter::Context& context,
+                                     const StreamInfo::StreamInfo&) const override;
+  Protobuf::Value formatValue(const Envoy::Formatter::Context& context,
+                              const StreamInfo::StreamInfo&) const override;
+
+private:
+  Protobuf::Struct buildHeadersStruct(const Http::HeaderMap& headers) const;
+  const AllHeadersType type_;
+  const uint32_t max_value_bytes_;
+  const absl::flat_hash_set<std::string> exclude_headers_;
+};
+
+class AllHeadersCommandParser : public ::Envoy::Formatter::CommandParser {
+public:
+  AllHeadersCommandParser(uint32_t max_value_bytes,
+                          absl::flat_hash_set<std::string> exclude_headers);
+
+  ::Envoy::Formatter::FormatterProviderPtr parse(absl::string_view command,
+                                                 absl::string_view subcommand,
+                                                 absl::optional<size_t> max_length) const override;
+
+private:
+  const uint32_t max_value_bytes_;
+  const absl::flat_hash_set<std::string> exclude_headers_;
+};
+
+} // namespace Formatter
+} // namespace Extensions
+} // namespace Envoy

source/extensions/formatter/all_headers/config.cc

@@ -0,0 +1,37 @@
+#include "source/extensions/formatter/all_headers/config.h"
+
+#include "envoy/extensions/formatter/all_headers/v3/all_headers.pb.h"
+
+#include "source/extensions/formatter/all_headers/all_headers.h"
+
+#include "absl/strings/ascii.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace Formatter {
+
+::Envoy::Formatter::CommandParserPtr AllHeadersFormatterFactory::createCommandParserFromProto(
+    const Protobuf::Message& message, Server::Configuration::GenericFactoryContext&) {
+  const auto& config =
+      dynamic_cast<const envoy::extensions::formatter::all_headers::v3::AllHeaders&>(message);
+
+  absl::flat_hash_set<std::string> exclude_headers;
+  for (const auto& header : config.exclude_headers()) {
+    exclude_headers.insert(absl::AsciiStrToLower(header));
+  }
+
+  return std::make_unique<AllHeadersCommandParser>(config.max_value_bytes(),
+                                                   std::move(exclude_headers));
+}
+
+ProtobufTypes::MessagePtr AllHeadersFormatterFactory::createEmptyConfigProto() {
+  return std::make_unique<envoy::extensions::formatter::all_headers::v3::AllHeaders>();
+}
+
+std::string AllHeadersFormatterFactory::name() const { return "envoy.formatter.all_headers"; }
+
+REGISTER_FACTORY(AllHeadersFormatterFactory, ::Envoy::Formatter::CommandParserFactory);
+
+} // namespace Formatter
+} // namespace Extensions
+} // namespace Envoy