Skip to content

Commit 8a34627

Browse files
zirainzirain
authored
fix auto http config with proxy protocol (#7439)
* don't set TypedExtensionProtocolOptions when ProxyProtocol enabled Signed-off-by: zirain <[email protected]> * update test Signed-off-by: zirain <[email protected]> * enable auto ALPN for proxy protocol Signed-off-by: zirain <[email protected]> * add e2e Signed-off-by: zirain <[email protected]> * update Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]>
1 parent 89e8256 commit 8a34627

12 files changed

+335
-161
lines changed

‎internal/xds/translator/cluster.go‎

Lines changed: 29 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -203,13 +203,6 @@ func buildXdsCluster(args *xdsClusterArgs) (*buildClusterResult, error) {
203203
}
204204
}
205205

206-
// Set Proxy Protocol
207-
if args.proxyProtocol != nil {
208-
cluster.TransportSocket = buildProxyProtocolSocket(args.proxyProtocol, args.tSocket)
209-
} else if args.tSocket != nil {
210-
cluster.TransportSocket = args.tSocket
211-
}
212-
213206
// scan through settings to determine cluster-level configuration options, as some of them
214207
// influence transport socket specific settings
215208
requiresAutoHTTPConfig := false
@@ -235,15 +228,23 @@ func buildXdsCluster(args *xdsClusterArgs) (*buildClusterResult, error) {
235228
// only enable auto sni if TLS is configured
236229
requiresAutoSNI := !hasLiteralSNI && requiresAutoHTTPConfig
237230

231+
// Set Proxy Protocol
232+
proxyProtocolEnabled := args.proxyProtocol != nil
233+
if proxyProtocolEnabled {
234+
cluster.TransportSocket = buildProxyProtocolSocket(args.proxyProtocol, args.tSocket, requiresAutoHTTPConfig)
235+
} else if args.tSocket != nil {
236+
cluster.TransportSocket = args.tSocket
237+
}
238+
238239
for i, ds := range args.settings {
239240
if ds.TLS != nil {
240241
socket, err := buildXdsUpstreamTLSSocketWthCert(ds.TLS, requiresAutoSNI, args.endpointType)
241242
if err != nil {
242243
// TODO: Log something here
243244
return nil, err
244245
}
245-
if args.proxyProtocol != nil {
246-
socket = buildProxyProtocolSocket(args.proxyProtocol, socket)
246+
if proxyProtocolEnabled {
247+
socket = buildProxyProtocolSocket(args.proxyProtocol, socket, requiresAutoHTTPConfig)
247248
}
248249
matchName := fmt.Sprintf("%s/tls/%d", args.name, i)
249250

@@ -265,7 +266,7 @@ func buildXdsCluster(args *xdsClusterArgs) (*buildClusterResult, error) {
265266
}
266267

267268
// TransportSocket is required for auto HTTP config
268-
if requiresAutoHTTPConfig && cluster.TransportSocket == nil {
269+
if requiresAutoHTTPConfig && cluster.TransportSocket == nil && !proxyProtocolEnabled {
269270
// we need a dummy transport socket to pass the validation
270271
cluster.TransportSocket = dummyTransportSocket
271272
}
@@ -275,7 +276,8 @@ func buildXdsCluster(args *xdsClusterArgs) (*buildClusterResult, error) {
275276
if err != nil {
276277
return nil, err
277278
}
278-
if epo != nil {
279+
// Set TypedExtensionProtocolOptions if not using Proxy Protocol
280+
if !proxyProtocolEnabled && epo != nil {
279281
cluster.TypedExtensionProtocolOptions = epo
280282
}
281283

@@ -1006,7 +1008,7 @@ func buildUpstreamCodecFilter() (*hcmv3.HttpFilter, error) {
10061008
}
10071009

10081010
// buildProxyProtocolSocket builds the ProxyProtocol transport socket.
1009-
func buildProxyProtocolSocket(proxyProtocol *ir.ProxyProtocol, tSocket *corev3.TransportSocket) *corev3.TransportSocket {
1011+
func buildProxyProtocolSocket(proxyProtocol *ir.ProxyProtocol, tSocket *corev3.TransportSocket, requiresAutoHTTPConfig bool) *corev3.TransportSocket {
10101012
if proxyProtocol == nil {
10111013
return nil
10121014
}
@@ -1026,18 +1028,22 @@ func buildProxyProtocolSocket(proxyProtocol *ir.ProxyProtocol, tSocket *corev3.T
10261028

10271029
// If existing transport socket does not exist wrap around raw buffer
10281030
if tSocket == nil {
1029-
rawCtx := &rawbufferv3.RawBuffer{}
1030-
rawCtxAny, err := proto.ToAnyWithValidation(rawCtx)
1031-
if err != nil {
1032-
return nil
1033-
}
1034-
rawSocket := &corev3.TransportSocket{
1035-
Name: wellknown.TransportSocketRawBuffer,
1036-
ConfigType: &corev3.TransportSocket_TypedConfig{
1037-
TypedConfig: rawCtxAny,
1038-
},
1031+
if requiresAutoHTTPConfig {
1032+
ppCtx.TransportSocket = dummyTransportSocket
1033+
} else {
1034+
rawCtx := &rawbufferv3.RawBuffer{}
1035+
rawCtxAny, err := proto.ToAnyWithValidation(rawCtx)
1036+
if err != nil {
1037+
return nil
1038+
}
1039+
rawSocket := &corev3.TransportSocket{
1040+
Name: wellknown.TransportSocketRawBuffer,
1041+
ConfigType: &corev3.TransportSocket_TypedConfig{
1042+
TypedConfig: rawCtxAny,
1043+
},
1044+
}
1045+
ppCtx.TransportSocket = rawSocket
10391046
}
1040-
ppCtx.TransportSocket = rawSocket
10411047
} else {
10421048
ppCtx.TransportSocket = tSocket
10431049
}

‎internal/xds/translator/testdata/in/xds-ir/accesslog-als-tcp.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,6 @@ accesslog:
3232
interval: 5s
3333
maxEjectionPercent: 10
3434
splitExternalLocalOriginErrors: false
35-
proxyProtocol:
36-
version: V2
3735
tcpKeepalive:
3836
probes: 7
3937
timeout:

‎internal/xds/translator/testdata/in/xds-ir/ext-proc-with-retries.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -102,8 +102,6 @@ http:
102102
roundRobin:
103103
slowStart:
104104
window: 5s
105-
proxyProtocol:
106-
version: V2
107105
tcpKeepalive:
108106
probes: 7
109107
timeout:

‎internal/xds/translator/testdata/in/xds-ir/ext-proc-with-traffic-settings.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,8 +89,6 @@ http:
8989
roundRobin:
9090
slowStart:
9191
window: 5s
92-
proxyProtocol:
93-
version: V2
9492
tcpKeepalive:
9593
probes: 7
9694
timeout:

‎internal/xds/translator/testdata/in/xds-ir/tracing.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,6 @@ tracing:
4141
interval: 5s
4242
maxEjectionPercent: 10
4343
splitExternalLocalOriginErrors: false
44-
proxyProtocol:
45-
version: V2
4644
tcpKeepalive:
4745
probes: 7
4846
timeout:

‎internal/xds/translator/testdata/out/xds-ir/accesslog-als-tcp.clusters.yaml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,16 +30,6 @@
3030
interval: 5s
3131
maxEjectionPercent: 10
3232
perConnectionBufferLimitBytes: 20971520
33-
transportSocket:
34-
name: envoy.transport_sockets.upstream_proxy_protocol
35-
typedConfig:
36-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
37-
config:
38-
version: V2
39-
transportSocket:
40-
name: envoy.transport_sockets.raw_buffer
41-
typedConfig:
42-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer
4333
type: EDS
4434
typedExtensionProtocolOptions:
4535
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:

‎internal/xds/translator/testdata/out/xds-ir/ext-proc-with-retries.clusters.yaml‎

Lines changed: 33 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -80,68 +80,51 @@
8080
maxEjectionPercent: 10
8181
perConnectionBufferLimitBytes: 20971520
8282
transportSocket:
83-
name: envoy.transport_sockets.upstream_proxy_protocol
83+
name: dummy.transport_socket
8484
typedConfig:
85-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
86-
config:
87-
version: V2
88-
transportSocket:
89-
name: envoy.transport_sockets.raw_buffer
90-
typedConfig:
91-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer
85+
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
86+
commonTlsContext: {}
9287
transportSocketMatches:
9388
- match:
9489
name: envoyextensionpolicy/default/policy-for-http-route/0/tls/0
9590
name: envoyextensionpolicy/default/policy-for-http-route/0/tls/0
9691
transportSocket:
97-
name: envoy.transport_sockets.upstream_proxy_protocol
92+
name: envoy.transport_sockets.tls
9893
typedConfig:
99-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
100-
config:
101-
version: V2
102-
transportSocket:
103-
name: envoy.transport_sockets.tls
104-
typedConfig:
105-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
106-
commonTlsContext:
107-
combinedValidationContext:
108-
defaultValidationContext:
109-
matchTypedSubjectAltNames:
110-
- matcher:
111-
exact: grpc-backend
112-
sanType: DNS
113-
validationContextSdsSecretConfig:
114-
name: policy-btls-grpc/envoy-gateway-ca
115-
sdsConfig:
116-
ads: {}
117-
resourceApiVersion: V3
118-
sni: grpc-backend
94+
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
95+
commonTlsContext:
96+
combinedValidationContext:
97+
defaultValidationContext:
98+
matchTypedSubjectAltNames:
99+
- matcher:
100+
exact: grpc-backend
101+
sanType: DNS
102+
validationContextSdsSecretConfig:
103+
name: policy-btls-grpc/envoy-gateway-ca
104+
sdsConfig:
105+
ads: {}
106+
resourceApiVersion: V3
107+
sni: grpc-backend
119108
- match:
120109
name: envoyextensionpolicy/default/policy-for-http-route/0/tls/3
121110
name: envoyextensionpolicy/default/policy-for-http-route/0/tls/3
122111
transportSocket:
123-
name: envoy.transport_sockets.upstream_proxy_protocol
112+
name: envoy.transport_sockets.tls
124113
typedConfig:
125-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
126-
config:
127-
version: V2
128-
transportSocket:
129-
name: envoy.transport_sockets.tls
130-
typedConfig:
131-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
132-
commonTlsContext:
133-
combinedValidationContext:
134-
defaultValidationContext:
135-
matchTypedSubjectAltNames:
136-
- matcher:
137-
exact: ip-backend
138-
sanType: DNS
139-
validationContextSdsSecretConfig:
140-
name: policy-btls-backend-ip/envoy-gateway-ca
141-
sdsConfig:
142-
ads: {}
143-
resourceApiVersion: V3
144-
sni: ip-backend
114+
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
115+
commonTlsContext:
116+
combinedValidationContext:
117+
defaultValidationContext:
118+
matchTypedSubjectAltNames:
119+
- matcher:
120+
exact: ip-backend
121+
sanType: DNS
122+
validationContextSdsSecretConfig:
123+
name: policy-btls-backend-ip/envoy-gateway-ca
124+
sdsConfig:
125+
ads: {}
126+
resourceApiVersion: V3
127+
sni: ip-backend
145128
type: EDS
146129
typedExtensionProtocolOptions:
147130
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:

‎internal/xds/translator/testdata/out/xds-ir/ext-proc-with-traffic-settings.clusters.yaml‎

Lines changed: 33 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -80,68 +80,51 @@
8080
maxEjectionPercent: 10
8181
perConnectionBufferLimitBytes: 20971520
8282
transportSocket:
83-
name: envoy.transport_sockets.upstream_proxy_protocol
83+
name: dummy.transport_socket
8484
typedConfig:
85-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
86-
config:
87-
version: V2
88-
transportSocket:
89-
name: envoy.transport_sockets.raw_buffer
90-
typedConfig:
91-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer
85+
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
86+
commonTlsContext: {}
9287
transportSocketMatches:
9388
- match:
9489
name: envoyextensionpolicy/default/policy-for-http-route/0/tls/0
9590
name: envoyextensionpolicy/default/policy-for-http-route/0/tls/0
9691
transportSocket:
97-
name: envoy.transport_sockets.upstream_proxy_protocol
92+
name: envoy.transport_sockets.tls
9893
typedConfig:
99-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
100-
config:
101-
version: V2
102-
transportSocket:
103-
name: envoy.transport_sockets.tls
104-
typedConfig:
105-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
106-
commonTlsContext:
107-
combinedValidationContext:
108-
defaultValidationContext:
109-
matchTypedSubjectAltNames:
110-
- matcher:
111-
exact: grpc-backend
112-
sanType: DNS
113-
validationContextSdsSecretConfig:
114-
name: policy-btls-grpc/envoy-gateway-ca
115-
sdsConfig:
116-
ads: {}
117-
resourceApiVersion: V3
118-
sni: grpc-backend
94+
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
95+
commonTlsContext:
96+
combinedValidationContext:
97+
defaultValidationContext:
98+
matchTypedSubjectAltNames:
99+
- matcher:
100+
exact: grpc-backend
101+
sanType: DNS
102+
validationContextSdsSecretConfig:
103+
name: policy-btls-grpc/envoy-gateway-ca
104+
sdsConfig:
105+
ads: {}
106+
resourceApiVersion: V3
107+
sni: grpc-backend
119108
- match:
120109
name: envoyextensionpolicy/default/policy-for-http-route/0/tls/3
121110
name: envoyextensionpolicy/default/policy-for-http-route/0/tls/3
122111
transportSocket:
123-
name: envoy.transport_sockets.upstream_proxy_protocol
112+
name: envoy.transport_sockets.tls
124113
typedConfig:
125-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
126-
config:
127-
version: V2
128-
transportSocket:
129-
name: envoy.transport_sockets.tls
130-
typedConfig:
131-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
132-
commonTlsContext:
133-
combinedValidationContext:
134-
defaultValidationContext:
135-
matchTypedSubjectAltNames:
136-
- matcher:
137-
exact: ip-backend
138-
sanType: DNS
139-
validationContextSdsSecretConfig:
140-
name: policy-btls-backend-ip/envoy-gateway-ca
141-
sdsConfig:
142-
ads: {}
143-
resourceApiVersion: V3
144-
sni: ip-backend
114+
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
115+
commonTlsContext:
116+
combinedValidationContext:
117+
defaultValidationContext:
118+
matchTypedSubjectAltNames:
119+
- matcher:
120+
exact: ip-backend
121+
sanType: DNS
122+
validationContextSdsSecretConfig:
123+
name: policy-btls-backend-ip/envoy-gateway-ca
124+
sdsConfig:
125+
ads: {}
126+
resourceApiVersion: V3
127+
sni: ip-backend
145128
type: EDS
146129
typedExtensionProtocolOptions:
147130
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:

‎internal/xds/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.clusters.yaml‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -106,9 +106,10 @@
106106
config:
107107
version: V2
108108
transportSocket:
109-
name: envoy.transport_sockets.raw_buffer
109+
name: dummy.transport_socket
110110
typedConfig:
111-
'@type': type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer
111+
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
112+
commonTlsContext: {}
112113
transportSocketMatches:
113114
- match:
114115
name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/1
@@ -137,11 +138,3 @@
137138
resourceApiVersion: V3
138139
sni: example.com
139140
type: EDS
140-
typedExtensionProtocolOptions:
141-
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
142-
'@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
143-
autoConfig:
144-
http2ProtocolOptions:
145-
initialConnectionWindowSize: 1048576
146-
initialStreamWindowSize: 65536
147-
httpProtocolOptions: {}

0 commit comments

Comments
 (0)