SNI-based dynamic forward proxy filter by lizan · Pull Request #10448 · envoyproxy/envoy

lizan · 2020-03-19T00:35:29Z

Signed-off-by: Lizan Zhou lizan@tetrate.io

Description:
Implement a network filter to do DNS resolution based on SNI. So a TCP connection can be routed to a dynamic_forward_proxy cluster based on that.

Risk Level: Low (extension only)
Testing: manual, unit test, integration test.
Docs Changes: protodoc
Release Notes: Added
Fixes #9916

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

repokitteh-read-only · 2020-03-19T00:35:34Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/.

🐱

Caused by: #10448 was opened by lizan.

see: more, trace.

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

htuch

API review..

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

junr03 · 2020-03-20T20:00:24Z

Thanks for the API review @htuch. @lizan I have been in meetings all day today, I'll get a first review up by monday :)

junr03

First pass of comments!

junr03 · 2020-03-26T19:12:24Z

/wait

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

htuch · 2020-03-30T00:57:09Z

/lgtm api

junr03

mostly lgtm assigning to @mattklein123 so he can take a pass.

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

mattklein123

Thanks this is super cool. Just a few small comments.

/wait

mattklein123 · 2020-04-01T22:32:07Z

+      [(validate.rules).message = {required: true}];
+
+  oneof port_specifier {
+    // The port number to connect to the upstream.


Is this flexible enough? Might we need different ports for different hosts at some point? Is that why you did the oneof?

Yes that's the reason we have oneof here as pointed out by @htuch. SNI itself dosn't contain port number but we can support original dst port etc.

htuch · 2020-04-07T14:51:58Z

Please merge master to pick up #10672. We no longer accept changes to v2 (without explicit exception), so any API modifications should happen in v3. If this PR is adding a new proto, please follow the updated instructions in https://github.com/envoyproxy/envoy/blob/master/api/STYLE.md#adding-an-extension-configuration-to-the-api.

stale · 2020-04-14T16:03:39Z

This pull request has been automatically marked as stale because it has not had activity in the last 7 days. It will be closed in 7 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions!

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

mattklein123

Thanks LGTM with 1 question. Can you also merge master?

/wait

mattklein123 · 2020-04-15T23:24:38Z

+    return Network::FilterStatus::Continue;
+  }
+
+  // TODO(lizan): implement circuit breaker in SNI dynamic forward proxy like it is in HTTP:


Is there an reason not to do this now since it's pretty easy? Or can this be done as an immediate follow up? This is going to get used and this is a pretty big potential issue I think?

Unlike HTTP in network filters we don't have immediate access to cluster info through filter callbacks. There are plumbings need to happen there.

OK sounds good.

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

SNI-based dynamic forward proxy filter

7fc5e2a

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

lizan requested review from alyssawilk and mattklein123 as code owners March 19, 2020 00:35

repokitteh-read-only Bot added the api label Mar 19, 2020

lizan requested review from Shikugawa and rshriram March 19, 2020 00:35

fix docs

201a4cd

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

mattklein123 assigned junr03 Mar 19, 2020

htuch reviewed Mar 19, 2020

View reviewed changes

lizan added 3 commits March 20, 2020 00:03

deflake test

e22b9db

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

use new name

50345a9

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

Merge remote-tracking branch 'upstream/master' into sni_dynamic_forwa…

14f9e58

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

Shikugawa reviewed Mar 23, 2020

View reviewed changes

Comment thread docs/root/intro/version_history.rst Outdated

lizan mentioned this pull request Mar 23, 2020

Dynamic forward proxy support for TLS traffic #9916

Closed

junr03 suggested changes Mar 24, 2020

View reviewed changes

repokitteh-read-only Bot added the waiting label Mar 26, 2020

lizan added 2 commits March 27, 2020 21:37

Merge remote-tracking branch 'upstream/master' into sni_dynamic_forwa…

fb1f389

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

review

14385b1

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

repokitteh-read-only Bot removed the waiting label Mar 27, 2020

lizan added 4 commits March 27, 2020 23:36

add doc

278f62a

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

fix

7f3ffd0

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

review

6431bba

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

review

eae66c7

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

repokitteh-read-only Bot removed the api label Mar 30, 2020

junr03 reviewed Mar 31, 2020

View reviewed changes

Comment thread source/extensions/filters/network/sni_dynamic_forward_proxy/config.h

Comment thread source/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter.cc

Comment thread test/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter_integration_test.cc Outdated

junr03 assigned mattklein123 Mar 31, 2020

lizan added 2 commits March 31, 2020 22:22

fix tidy

c68f1f5

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

Merge remote-tracking branch 'upstream/master' into sni_dynamic_forwa…

4b1d334

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

repokitteh-read-only Bot added the api label Mar 31, 2020

add todo

3d6fbb2

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

mattklein123 requested changes Apr 1, 2020

View reviewed changes

repokitteh-read-only Bot added the waiting label Apr 1, 2020

stale Bot added the stale stalebot believes this issue/PR has not been touched recently label Apr 14, 2020

lizan added 6 commits April 15, 2020 00:59

Merge remote-tracking branch 'upstream/master' into sni_dynamic_forwa…

d519a1e

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

Merge remote-tracking branch 'upstream/master' into sni_dynamic_forwa…

aab0bb7

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

v3

b3f05d7

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

fix

b787f38

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

other review comment

2a7cfff

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

Merge remote-tracking branch 'upstream/master' into sni_dynamic_forwa…

10ac350

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

stale Bot removed the stale stalebot believes this issue/PR has not been touched recently label Apr 15, 2020

repokitteh-read-only Bot removed the waiting label Apr 15, 2020

fix docs

8bfec4a

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

mattklein123 reviewed Apr 15, 2020

View reviewed changes

repokitteh-read-only Bot added the waiting label Apr 15, 2020

Merge remote-tracking branch 'upstream/master' into sni_dynamic_forwa…

86389ca

…rd_proxy Signed-off-by: Lizan Zhou <lizan@tetrate.io>

repokitteh-read-only Bot removed the waiting label Apr 16, 2020

mattklein123 approved these changes Apr 16, 2020

View reviewed changes

repokitteh-read-only Bot removed the api label Apr 16, 2020

mattklein123 merged commit bc4ea0a into envoyproxy:master Apr 16, 2020

lizan deleted the sni_dynamic_forward_proxy branch April 16, 2020 17:10

stevesloka mentioned this pull request May 14, 2020

SNI is getting dropped when routing Cross Cluster TCP with tls passthrough between Edge and service clusters projectcontour/contour#2517

Closed

haitch mentioned this pull request Dec 18, 2021

sni-dynamic-forward-proxy-filter example not working, empty server name #19315

Closed

Conversation

lizan commented Mar 19, 2020

Uh oh!

repokitteh-read-only Bot commented Mar 19, 2020

Uh oh!

htuch left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

junr03 commented Mar 20, 2020

Uh oh!

Uh oh!

junr03 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

junr03 commented Mar 26, 2020

Uh oh!

htuch commented Mar 30, 2020

Uh oh!

junr03 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mattklein123 left a comment

Choose a reason for hiding this comment

Uh oh!

mattklein123 Apr 1, 2020

Choose a reason for hiding this comment

Uh oh!

lizan Apr 15, 2020

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

htuch commented Apr 7, 2020

Uh oh!

stale Bot commented Apr 14, 2020

Uh oh!

mattklein123 left a comment

Choose a reason for hiding this comment

Uh oh!

mattklein123 Apr 15, 2020

Choose a reason for hiding this comment

Uh oh!

lizan Apr 16, 2020

Choose a reason for hiding this comment

Uh oh!

mattklein123 Apr 16, 2020

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants