router: adding CONNECT support to upstreams (not prod-ready)

api/envoy/api/v2/route/route_components.proto

@@ -34,7 +34,7 @@ option (udpa.annotations.file_status).package_version_status = FROZEN;
 // host header. This allows a single listener to service multiple top level domain path trees. Once
 // a virtual host is selected based on the domain, the routes are processed in order to see which
 // upstream cluster to route to or whether to perform a redirect.
-// [#next-free-field: 21]
+// [#next-free-field: 23]
 message VirtualHost {
   enum TlsRequirementType {
     // No TLS requirement for the virtual host.
@@ -49,6 +49,13 @@ message VirtualHost {
     ALL = 2;
   }
 
+  // [#not-implemented-hide:]
+  // Configuration for sending data upstream as a raw data payload. This is used for
+  // CONNECT requests, when forwarding CONNECT payload as raw TCP.
+  message ProxyConfig {
+    // TODO(alyssawilk) add proxy proto configuration here.
+  }
+
   reserved 9;
 
   // The logical name of the virtual host. This is used when emitting certain
@@ -180,6 +187,13 @@ message VirtualHost {
   // If set and a route-specific limit is not set, the bytes actually buffered will be the minimum
   // value of this and the listener per_connection_buffer_limit_bytes.
   google.protobuf.UInt32Value per_request_buffer_limit_bytes = 18;
+
+  // [#not-implemented-hide:]
+  // Configuration for sending data upstream as a raw data payload. This is used for terminating
+  // CONNECT requests. If this message is present, the HTTP body of incoming CONNECT request
+  // will be proxied upstream as raw TCP. Upstream TCP payload will result in Envoy synthesizing
+  // response headers and forwarding the TCP response payload in the HTTP response body.
+  ProxyConfig proxying_config = 22;
 }
 
 // A filter-defined action type.

api/envoy/config/route/v3/route_components.proto

@@ -33,7 +33,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // host header. This allows a single listener to service multiple top level domain path trees. Once
 // a virtual host is selected based on the domain, the routes are processed in order to see which
 // upstream cluster to route to or whether to perform a redirect.
-// [#next-free-field: 21]
+// [#next-free-field: 23]
 message VirtualHost {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.VirtualHost";
 
@@ -50,6 +50,16 @@ message VirtualHost {
     ALL = 2;
   }
 
+  // [#not-implemented-hide:]
+  // Configuration for sending data upstream as a raw data payload. This is used for
+  // CONNECT requests, when forwarding CONNECT payload as raw TCP.
+  message ProxyConfig {
+    // TODO(alyssawilk) add proxy proto configuration here.
+
+    option (udpa.annotations.versioning).previous_message_type =
+        "envoy.api.v2.route.VirtualHost.ProxyConfig";
+  }
+
   reserved 9, 12;
 
   reserved "per_filter_config";
@@ -176,6 +186,13 @@ message VirtualHost {
   // If set and a route-specific limit is not set, the bytes actually buffered will be the minimum
   // value of this and the listener per_connection_buffer_limit_bytes.
   google.protobuf.UInt32Value per_request_buffer_limit_bytes = 18;
+
+  // [#not-implemented-hide:]
+  // Configuration for sending data upstream as a raw data payload. This is used for terminating
+  // CONNECT requests. If this message is present, the HTTP body of incoming CONNECT request
+  // will be proxied upstream as raw TCP. Upstream TCP payload will result in Envoy synthesizing
+  // response headers and forwarding the TCP response payload in the HTTP response body.
+  ProxyConfig proxying_config = 22;
 }
 
 // A filter-defined action type.

api/envoy/config/route/v4alpha/route_components.proto

@@ -33,7 +33,7 @@ option (udpa.annotations.file_status).package_version_status = NEXT_MAJOR_VERSIO
 // host header. This allows a single listener to service multiple top level domain path trees. Once
 // a virtual host is selected based on the domain, the routes are processed in order to see which
 // upstream cluster to route to or whether to perform a redirect.
-// [#next-free-field: 21]
+// [#next-free-field: 23]
 message VirtualHost {
   option (udpa.annotations.versioning).previous_message_type = "envoy.config.route.v3.VirtualHost";
 
@@ -50,6 +50,16 @@ message VirtualHost {
     ALL = 2;
   }
 
+  // [#not-implemented-hide:]
+  // Configuration for sending data upstream as a raw data payload. This is used for
+  // CONNECT requests, when forwarding CONNECT payload as raw TCP.
+  message ProxyConfig {
+    // TODO(alyssawilk) add proxy proto configuration here.
+
+    option (udpa.annotations.versioning).previous_message_type =
+        "envoy.config.route.v3.VirtualHost.ProxyConfig";
+  }
+
   reserved 9, 12;
 
   reserved "per_filter_config";
@@ -176,6 +186,13 @@ message VirtualHost {
   // If set and a route-specific limit is not set, the bytes actually buffered will be the minimum
   // value of this and the listener per_connection_buffer_limit_bytes.
   google.protobuf.UInt32Value per_request_buffer_limit_bytes = 18;
+
+  // [#not-implemented-hide:]
+  // Configuration for sending data upstream as a raw data payload. This is used for terminating
+  // CONNECT requests. If this message is present, the HTTP body of incoming CONNECT request
+  // will be proxied upstream as raw TCP. Upstream TCP payload will result in Envoy synthesizing
+  // response headers and forwarding the TCP response payload in the HTTP response body.
+  ProxyConfig proxying_config = 22;
 }
 
 // A filter-defined action type.

docs/root/intro/arch_overview/http/http.rst

@@ -7,5 +7,5 @@ HTTP
   http_connection_management
   http_filters
   http_routing
-  websocket
+  upgrades
   http_proxy

docs/root/intro/arch_overview/http/websocket.rst → docs/root/intro/arch_overview/http/upgrades.rst

@@ -1,19 +1,19 @@
 .. _arch_overview_websocket:
 
-WebSocket and HTTP upgrades
+HTTP upgrades
 ===========================
 
-Envoy Upgrade support is intended mainly for WebSocket but may be used for non-WebSocket
-upgrades as well. Upgrades pass both the HTTP headers and the upgrade payload
+Envoy Upgrade support is intended mainly for WebSocket and CONNECT support, but may be used for
+arbitrary upgrades as well. Upgrades pass both the HTTP headers and the upgrade payload
 through an HTTP filter chain. One may configure the
 :ref:`upgrade_configs <envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.upgrade_configs>`
 with or without custom filter chains. If only the
 :ref:`upgrade_type <envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.UpgradeConfig.upgrade_type>`
-is specified, both the upgrade headers, any request and response body, and WebSocket payload will
+is specified, both the upgrade headers, any request and response body, and HTTP data payload will
 pass through the default HTTP filter chain. To avoid the use of HTTP-only filters for upgrade payload,
 one can set up custom
 :ref:`filters <envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.UpgradeConfig.filters>`
-for the given upgrade type, up to and including only using the router filter to send the WebSocket
+for the given upgrade type, up to and including only using the router filter to send the HTTP
 data upstream.
 
 Upgrades can be enabled or disabled on a :ref:`per-route <envoy_api_field_route.RouteAction.upgrade_configs>` basis.
@@ -32,12 +32,12 @@ laid out below, but custom filter chains can only be configured on a per-HttpCon
 | F                     | F                       | F                 |
 +-----------------------+-------------------------+-------------------+
 
-Note that the statistics for upgrades are all bundled together so WebSocket
+Note that the statistics for upgrades are all bundled together so WebSocket and other upgrades
 :ref:`statistics <config_http_conn_man_stats>` are tracked by stats such as
 downstream_cx_upgrades_total and downstream_cx_upgrades_active
 
-Handling HTTP/2 hops
-^^^^^^^^^^^^^^^^^^^^
+Websocket over HTTP/2 hops
+^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 While HTTP/2 support for WebSockets is off by default, Envoy does support tunneling WebSockets over
 HTTP/2 streams for deployments that prefer a uniform HTTP/2 mesh throughout; this enables, for example,
@@ -61,3 +61,27 @@ a GET method on the final Envoy-Upstream hop.
 
 Note that the HTTP/2 upgrade path has very strict HTTP/1.1 compliance, so will not proxy WebSocket
 upgrade requests or responses with bodies.
+
+.. TODO(alyssawilk) unhide this when unhiding config
+.. CONNECT support
+.. ^^^^^^^^^^^^^^^
+
+.. Envoy CONNECT support is off by default (Envoy will send an internall generated 403 in response to
+.. CONNECT requests). CONNECT support can be enabled via the upgrade options described above, setting
+.. the upgrade value to the special keyword "CONNECT".
+
+.. Envoy can handle CONNECT in one of two ways, either proxying the CONNECT headers through as if they
+.. were any other request, and letting the upstream handle the CONNECT request, or by terminating the
+.. CONNECT request, and forwarding the payload as raw TCP data. When CONNECT upgrade configuration is
+.. set up, the default behavior is to proxy the CONNECT request. If termination is desired, this can
+.. be accomplished by setting
+.. the :ref:`per-route proxying_config <envoy_api_field_route.Route.proxying_config>` or
+.. :ref:`per-virtual-host proxying_config <envoy_api_field_route.VirtualHost.proxying_config>`
+.. If either is present for CONNECT requests, the router filter will strip the request headers,
+.. and forward the HTTP payload upstream. On receipt of initial TCP data from upstream, the router
+.. will synthesize 200 response headers, and then forward the TCP data as the HTTP response body.
+
+.. .. warning::
+.. This mode of CONNECT support can create major security holes if configured correctly, as the upstream
+.. will be forwarded *unsanitized* headers if they are in the body payload. Please use with caution
+

include/envoy/router/BUILD

@@ -66,6 +66,7 @@ envoy_cc_library(
         "//source/common/protobuf",
         "//source/common/protobuf:utility_lib",
         "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3:pkg_cc_proto",
         "@envoy_api//envoy/type/v3:pkg_cc_proto",
     ],
 )

include/envoy/router/router.h

@@ -11,6 +11,7 @@
 #include "envoy/access_log/access_log.h"
 #include "envoy/common/matchers.h"
 #include "envoy/config/core/v3/base.pb.h"
+#include "envoy/config/route/v3/route_components.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/http/codec.h"
 #include "envoy/http/codes.h"
@@ -477,6 +478,15 @@ class VirtualHost {
    */
   virtual bool includeAttemptCountInResponse() const PURE;
 
+  /**
+   * If present, this indicates that CONNECT requests to this host should be converted
+   * to TCP proxying, i.e. the payload of the HTTP body should be sent as raw
+   * TCP  upstream.
+   * @return configuration for TCP proxying, if present.
+   */
+  using ProxyConfig = envoy::config::route::v3::VirtualHost::ProxyConfig;
+  virtual const absl::optional<ProxyConfig>& proxyConfig() const PURE;
+
   /**
    * @return uint32_t any route cap on bytes which should be buffered for shadowing or retries.
    *         This is an upper bound so does not necessarily reflect the bytes which will be buffered
@@ -819,6 +829,15 @@ class RouteEntry : public ResponseEntry {
    */
   virtual bool includeAttemptCountInResponse() const PURE;
 
+  /**
+   * If present, this indicates that CONNECT requests on this route should be converted
+   * to TCP proxying, i.e. the payload of the HTTP body should be sent as raw
+   * TCP  upstream.
+   * @return configuration for TCP proxying, if present.
+   */
+  using ProxyConfig = envoy::config::route::v3::VirtualHost::ProxyConfig;
+  virtual const absl::optional<ProxyConfig>& proxyConfig() const PURE;
+
   using UpgradeMap = std::map<std::string, bool>;
   /**
    * @return a map of route-specific upgrades to their enabled/disabled status.

source/common/http/async_client_impl.cc

@@ -24,12 +24,16 @@ const std::vector<Router::ShadowPolicyPtr> AsyncStreamImpl::RouteEntryImpl::shad
 const AsyncStreamImpl::NullVirtualHost AsyncStreamImpl::RouteEntryImpl::virtual_host_;
 const AsyncStreamImpl::NullRateLimitPolicy AsyncStreamImpl::NullVirtualHost::rate_limit_policy_;
 const AsyncStreamImpl::NullConfig AsyncStreamImpl::NullVirtualHost::route_configuration_;
+const absl::optional<AsyncStreamImpl::NullVirtualHost::ProxyConfig>
+    AsyncStreamImpl::NullVirtualHost::proxy_config_nullopt_;
 const std::multimap<std::string, std::string> AsyncStreamImpl::RouteEntryImpl::opaque_config_;
 const envoy::config::core::v3::Metadata AsyncStreamImpl::RouteEntryImpl::metadata_;
 const Config::TypedMetadataImpl<Envoy::Config::TypedMetadataFactory>
     AsyncStreamImpl::RouteEntryImpl::typed_metadata_({});
 const AsyncStreamImpl::NullPathMatchCriterion
     AsyncStreamImpl::RouteEntryImpl::path_match_criterion_;
+const absl::optional<AsyncStreamImpl::RouteEntryImpl::ProxyConfig>
+    AsyncStreamImpl::RouteEntryImpl::proxy_config_nullopt_;
 const std::list<LowerCaseString> AsyncStreamImpl::NullConfig::internal_only_headers_;
 
 AsyncClientImpl::AsyncClientImpl(Upstream::ClusterInfoConstSharedPtr cluster,