network: add DownstreamTransportSocketConfigFactory and registry

include/envoy/event/dispatcher.h

@@ -45,8 +45,9 @@ class Dispatcher {
    * @param ssl_ctx supplies the SSL context to use, if not nullptr.
    * @return Network::ConnectionPtr a server connection that is owned by the caller.
    */
-  virtual Network::ConnectionPtr createServerConnection(Network::ConnectionSocketPtr&& socket,
-                                                        Ssl::Context* ssl_ctx) PURE;
+  virtual Network::ConnectionPtr
+  createServerConnection(Network::ConnectionSocketPtr&& socket,
+                         Network::TransportSocketPtr&& transport_socket) PURE;
 
   /**
    * Create a client connection.

include/envoy/network/listener.h

@@ -7,6 +7,7 @@
 #include "envoy/common/exception.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/listen_socket.h"
+#include "envoy/network/transport_socket.h"
 #include "envoy/ssl/context.h"
 
 namespace Envoy {
@@ -32,9 +33,9 @@ class ListenerConfig {
   virtual ListenSocket& socket() PURE;
 
   /**
-   * @return Ssl::ServerContext* the default SSL context.
+   * @return TransportSocketFacotry& the transport socket factory.
    */
-  virtual Ssl::ServerContext* defaultSslContext() PURE;
+  virtual TransportSocketFactory& transportSocketFactory() PURE;
 
   /**
    * @return bool specifies whether the listener should actually listen on the port.

include/envoy/server/transport_socket_config.h

@@ -33,11 +33,31 @@ class TransportSocketConfigFactory {
 public:
   virtual ~TransportSocketConfigFactory() {}
 
+  /**
+   * @return ProtobufTypes::MessagePtr create empty config proto message. The transport socket
+   *         config, which arrives in an opaque google.protobuf.Struct message, will be converted
+   *         to JSON and then parsed into this empty proto.
+   */
+  virtual ProtobufTypes::MessagePtr createEmptyConfigProto() PURE;
+
+  /**
+   * @return std::string the identifying name for a particular TransportSocketFactoryPtr
+   *         implementation produced by the factory.
+   */
+  virtual std::string name() const PURE;
+};
+
+/**
+ * Implemented by each transport socket which does upstream connection. Registered via class
+ * RegisterFactory.
+ */
+class UpstreamTransportSocketConfigFactory : public virtual TransportSocketConfigFactory {
+public:
   /**
    * Create a particular transport socket factory implementation.
    * @param config const Protobuf::Message& supplies the config message for the transport socket
    *        implementation.
-   * @param context TransportSocketFactoryContext&  supplies the transport socket's context.
+   * @param context TransportSocketFactoryContext& supplies the transport socket's context.
    * @return Network::TransportSocketFactoryPtr the transport socket factory instance. The returned
    *         TransportSocketFactoryPtr should not be nullptr.
    *
@@ -47,23 +67,40 @@ class TransportSocketConfigFactory {
   virtual Network::TransportSocketFactoryPtr
   createTransportSocketFactory(const Protobuf::Message& config,
                                TransportSocketFactoryContext& context) PURE;
+};
 
+/**
+ * Implemented by each transport socket which does downstream connection. Registered via class
+ * RegisterFactory.
+ */
+class DownstreamTransportSocketConfigFactory : public virtual TransportSocketConfigFactory {
+public:
   /**
-   * @return ProtobufTypes::MessagePtr create empty config proto message. The transport socket
-   *         config, which arrives in an opaque google.protobuf.Struct message, will be converted
-   *         to JSON and then parsed into this empty proto.
-   */
-  virtual ProtobufTypes::MessagePtr createEmptyConfigProto() PURE;
-
-  /**
-   * @return std::string the identifying name for a particular TransportSocketFactoryPtr
-   *         implementation produced by the factory.
+   * Create a particular downstream transport socket factory implementation.
+   * TODO(lizan): Revisit the parameters for SNI below when TLS sniffing and filter chain match are
+   * implemented.
+   * @param listener_name const std::string& the name of the listener.
+   * @param server_names const std::vector<std::string>& the names of the server. This parameter is
+   *        currently used by SNI implementation to know the expected server names.
+   * @param skip_ssl_context_update bool indicates whether the ssl context update should be skipped.
+   *        This parameter is currently used by SNI implementation to know whether it should perform
+   *        certificate selection.
+   * @param config const Protobuf::Message& supplies the config message for the transport socket
+   *        implementation.
+   * @param context TransportSocketFactoryContext& supplies the transport socket's context.
+   * @return Network::TransportSocketFactoryPtr the transport socket factory instance. The returned
+   *         TransportSocketFactoryPtr should not be nullptr.
+   *
+   * @throw EnvoyException if the implementation is unable to produce a factory with the provided
+   *        parameters.
    */
-  virtual std::string name() const PURE;
+  virtual Network::TransportSocketFactoryPtr
+  createTransportSocketFactory(const std::string& listener_name,
+                               const std::vector<std::string>& server_names,
+                               bool skip_ssl_context_update, const Protobuf::Message& config,
+                               TransportSocketFactoryContext& context) PURE;
 };
 
-class UpstreamTransportSocketConfigFactory : public virtual TransportSocketConfigFactory {};
-
 } // namespace Configuration
 } // namespace Server
 } // namespace Envoy

source/common/event/dispatcher_impl.cc

@@ -73,13 +73,12 @@ void DispatcherImpl::clearDeferredDeleteList() {
   deferred_deleting_ = false;
 }
 
-Network::ConnectionPtr DispatcherImpl::createServerConnection(Network::ConnectionSocketPtr&& socket,
-                                                              Ssl::Context* ssl_ctx) {
+Network::ConnectionPtr
+DispatcherImpl::createServerConnection(Network::ConnectionSocketPtr&& socket,
+                                       Network::TransportSocketPtr&& transport_socket) {
   ASSERT(isThreadSafe());
-  return Network::ConnectionPtr{ssl_ctx
-                                    ? new Ssl::ConnectionImpl(*this, std::move(socket), true,
-                                                              *ssl_ctx, Ssl::InitialState::Server)
-                                    : new Network::ConnectionImpl(*this, std::move(socket), true)};
+  return std::make_unique<Network::ConnectionImpl>(*this, std::move(socket),
+                                                   std::move(transport_socket), true);
 }
 
 Network::ClientConnectionPtr

source/common/event/dispatcher_impl.h

@@ -33,8 +33,9 @@ class DispatcherImpl : Logger::Loggable<Logger::Id::main>, public Dispatcher {
 
   // Event::Dispatcher
   void clearDeferredDeleteList() override;
-  Network::ConnectionPtr createServerConnection(Network::ConnectionSocketPtr&& socket,
-                                                Ssl::Context* ssl_ctx) override;
+  Network::ConnectionPtr
+  createServerConnection(Network::ConnectionSocketPtr&& socket,
+                         Network::TransportSocketPtr&& transport_socket) override;
   Network::ClientConnectionPtr
   createClientConnection(Network::Address::InstanceConstSharedPtr address,
                          Network::Address::InstanceConstSharedPtr source_address,

source/common/ssl/ssl_socket.cc

@@ -329,5 +329,20 @@ Network::TransportSocketPtr ClientSslSocketFactory::createTransportSocket() cons
 
 bool ClientSslSocketFactory::implementsSecureTransport() const { return true; }
 
+ServerSslSocketFactory::ServerSslSocketFactory(const ServerContextConfig& config,
+                                               const std::string& listener_name,
+                                               const std::vector<std::string>& server_names,
+                                               bool skip_context_update,
+                                               Ssl::ContextManager& manager,
+                                               Stats::Scope& stats_scope)
+    : ssl_ctx_(manager.createSslServerContext(listener_name, server_names, stats_scope, config,
+                                              skip_context_update)) {}
+
+Network::TransportSocketPtr ServerSslSocketFactory::createTransportSocket() const {
+  return std::make_unique<Ssl::SslSocket>(*ssl_ctx_, Ssl::InitialState::Server);
+}
+
+bool ServerSslSocketFactory::implementsSecureTransport() const { return true; }
+
 } // namespace Ssl
 } // namespace Envoy

source/common/ssl/ssl_socket.h

@@ -65,5 +65,17 @@ class ClientSslSocketFactory : public Network::TransportSocketFactory {
   ClientContextPtr ssl_ctx_;
 };
 
+class ServerSslSocketFactory : public Network::TransportSocketFactory {
+public:
+  ServerSslSocketFactory(const ServerContextConfig& config, const std::string& listener_name,
+                         const std::vector<std::string>& server_names, bool skip_context_update,
+                         Ssl::ContextManager& manager, Stats::Scope& stats_scope);
+  Network::TransportSocketPtr createTransportSocket() const override;
+  bool implementsSecureTransport() const override;
+
+private:
+  ServerContextPtr ssl_ctx_;
+};
+
 } // namespace Ssl
 } // namespace Envoy

source/server/BUILD

@@ -202,6 +202,7 @@ envoy_cc_library(
         ":init_manager_lib",
         "//include/envoy/server:filter_config_interface",
         "//include/envoy/server:listener_manager_interface",
+        "//include/envoy/server:transport_socket_config_interface",
         "//include/envoy/server:worker_interface",
         "//source/common/config:utility_lib",
         "//source/common/config:well_known_names",

source/server/config/network/raw_buffer_socket.cc

@@ -9,8 +9,14 @@ namespace Server {
 namespace Configuration {
 
 Network::TransportSocketFactoryPtr
-RawBufferSocketFactory::createTransportSocketFactory(const Protobuf::Message&,
-                                                     TransportSocketFactoryContext&) {
+UpstreamRawBufferSocketFactory::createTransportSocketFactory(const Protobuf::Message&,
+                                                             TransportSocketFactoryContext&) {
+  return std::make_unique<Network::RawBufferSocketFactory>();
+}
+
+Network::TransportSocketFactoryPtr DownstreamRawBufferSocketFactory::createTransportSocketFactory(
+    const std::string&, const std::vector<std::string>&, bool, const Protobuf::Message&,
+    TransportSocketFactoryContext&) {
   return std::make_unique<Network::RawBufferSocketFactory>();
 }
 
@@ -22,6 +28,10 @@ static Registry::RegisterFactory<UpstreamRawBufferSocketFactory,
                                  UpstreamTransportSocketConfigFactory>
     upstream_registered_;
 
+static Registry::RegisterFactory<DownstreamRawBufferSocketFactory,
+                                 DownstreamTransportSocketConfigFactory>
+    downstream_registered_;
+
 } // namespace Configuration
 } // namespace Server
 } // namespace Envoy

source/server/config/network/raw_buffer_socket.h

@@ -16,14 +16,26 @@ class RawBufferSocketFactory : public virtual TransportSocketConfigFactory {
 public:
   virtual ~RawBufferSocketFactory() {}
   std::string name() const override { return Config::TransportSocketNames::get().RAW_BUFFER; }
+  ProtobufTypes::MessagePtr createEmptyConfigProto() override;
+};
+
+class UpstreamRawBufferSocketFactory : public UpstreamTransportSocketConfigFactory,
+                                       public RawBufferSocketFactory {
+public:
   Network::TransportSocketFactoryPtr
   createTransportSocketFactory(const Protobuf::Message& config,
                                TransportSocketFactoryContext& context) override;
-  ProtobufTypes::MessagePtr createEmptyConfigProto() override;
 };
 
-class UpstreamRawBufferSocketFactory : public UpstreamTransportSocketConfigFactory,
-                                       public RawBufferSocketFactory {};
+class DownstreamRawBufferSocketFactory : public DownstreamTransportSocketConfigFactory,
+                                         public RawBufferSocketFactory {
+public:
+  Network::TransportSocketFactoryPtr
+  createTransportSocketFactory(const std::string& listener_name,
+                               const std::vector<std::string>& server_names,
+                               bool skip_context_update, const Protobuf::Message& config,
+                               TransportSocketFactoryContext& context) override;
+};
 
 } // namespace Configuration
 } // namespace Server

source/server/config/network/ssl_socket.cc

@@ -30,6 +30,24 @@ ProtobufTypes::MessagePtr UpstreamSslSocketFactory::createEmptyConfigProto() {
 static Registry::RegisterFactory<UpstreamSslSocketFactory, UpstreamTransportSocketConfigFactory>
     upstream_registered_;
 
+Network::TransportSocketFactoryPtr DownstreamSslSocketFactory::createTransportSocketFactory(
+    const std::string& listener_name, const std::vector<std::string>& server_names,
+    bool skip_context_update, const Protobuf::Message& message,
+    TransportSocketFactoryContext& context) {
+  return std::make_unique<Ssl::ServerSslSocketFactory>(
+      Ssl::ServerContextConfigImpl(
+          MessageUtil::downcastAndValidate<const envoy::api::v2::DownstreamTlsContext&>(message)),
+      listener_name, server_names, skip_context_update, context.sslContextManager(),
+      context.statsScope());
+}
+
+ProtobufTypes::MessagePtr DownstreamSslSocketFactory::createEmptyConfigProto() {
+  return std::make_unique<envoy::api::v2::DownstreamTlsContext>();
+}
+
+static Registry::RegisterFactory<DownstreamSslSocketFactory, DownstreamTransportSocketConfigFactory>
+    downstream_registered_;
+
 } // namespace Configuration
 } // namespace Server
 } // namespace Envoy

source/server/config/network/ssl_socket.h

@@ -27,6 +27,17 @@ class UpstreamSslSocketFactory : public UpstreamTransportSocketConfigFactory,
   ProtobufTypes::MessagePtr createEmptyConfigProto() override;
 };
 
+class DownstreamSslSocketFactory : public DownstreamTransportSocketConfigFactory,
+                                   public SslSocketConfigFactory {
+public:
+  Network::TransportSocketFactoryPtr
+  createTransportSocketFactory(const std::string& listener_name,
+                               const std::vector<std::string>& server_names,
+                               bool skip_context_update, const Protobuf::Message& config,
+                               TransportSocketFactoryContext& context) override;
+  ProtobufTypes::MessagePtr createEmptyConfigProto() override;
+};
+
 } // namespace Configuration
 } // namespace Server
 } // namespace Envoy

source/server/connection_handler_impl.cc

@@ -184,8 +184,9 @@ void ConnectionHandlerImpl::ActiveListener::onAccept(
 }
 
 void ConnectionHandlerImpl::ActiveListener::newConnection(Network::ConnectionSocketPtr&& socket) {
+  auto ts = config_.transportSocketFactory().createTransportSocket();
   Network::ConnectionPtr new_connection =
-      parent_.dispatcher_.createServerConnection(std::move(socket), config_.defaultSslContext());
+      parent_.dispatcher_.createServerConnection(std::move(socket), std::move(ts));
   new_connection->setBufferLimits(config_.perConnectionBufferLimitBytes());
   onNewConnection(std::move(new_connection));
 }

source/server/http/BUILD

@@ -44,6 +44,7 @@ envoy_cc_library(
         "//source/common/http:utility_lib",
         "//source/common/http/http1:codec_lib",
         "//source/common/network:listen_socket_lib",
+        "//source/common/network:raw_buffer_socket_lib",
         "//source/common/profiler:profiler_lib",
         "//source/common/router:config_lib",
         "//source/common/upstream:host_utility_lib",

source/server/http/admin.h

@@ -21,6 +21,7 @@
 #include "common/http/conn_manager_impl.h"
 #include "common/http/date_provider_impl.h"
 #include "common/http/utility.h"
+#include "common/network/raw_buffer_socket.h"
 
 #include "server/config/network/http_connection_manager.h"
 
@@ -174,7 +175,9 @@ class AdminImpl : public Admin,
     // Network::ListenerConfig
     Network::FilterChainFactory& filterChainFactory() override { return parent_; }
     Network::ListenSocket& socket() override { return parent_.mutable_socket(); }
-    Ssl::ServerContext* defaultSslContext() override { return nullptr; }
+    Network::TransportSocketFactory& transportSocketFactory() override {
+      return parent_.transport_socket_factory_;
+    }
     bool bindToPort() override { return true; }
     bool handOffRestoredDestinationConnections() const override { return false; }
     uint32_t perConnectionBufferLimitBytes() override { return 0; }
@@ -192,6 +195,7 @@ class AdminImpl : public Admin,
   std::list<AccessLog::InstanceSharedPtr> access_logs_;
   const std::string profile_path_;
   Network::ListenSocketPtr socket_;
+  Network::RawBufferSocketFactory transport_socket_factory_;
   Http::ConnectionManagerStats stats_;
   Http::ConnectionManagerTracingStats tracing_stats_;
   NullRouteConfigProvider route_config_provider_;

source/server/listener_manager_impl.cc

@@ -1,14 +1,14 @@
 #include "server/listener_manager_impl.h"
 
 #include "envoy/registry/registry.h"
+#include "envoy/server/transport_socket_config.h"
 
 #include "common/common/assert.h"
 #include "common/config/utility.h"
 #include "common/config/well_known_names.h"
 #include "common/network/listen_socket_impl.h"
 #include "common/network/utility.h"
 #include "common/protobuf/utility.h"
-#include "common/ssl/context_config_impl.h"
 
 #include "server/configuration_impl.h"
 #include "server/drain_manager_impl.h"
@@ -167,17 +167,33 @@ ListenerImpl::ListenerImpl(const envoy::api::v2::Listener& config, ListenerManag
                                        "is currently not supported",
                                        address_->asString()));
     }
-    if (filter_chain.has_tls_context()) {
-      Ssl::ServerContextConfigImpl context_config(filter_chain.tls_context());
-      tls_contexts_.emplace_back(parent_.server_.sslContextManager().createSslServerContext(
-          name_, sni_domains, *listener_scope_, context_config, skip_context_update));
-      has_tls++;
-      if (filter_chain.tls_context().has_session_ticket_keys()) {
-        has_stk++;
+
+    auto transport_socket = filter_chain.transport_socket();
+    if (!filter_chain.has_transport_socket()) {
+      if (filter_chain.has_tls_context()) {
+        transport_socket.set_name(Config::TransportSocketNames::get().SSL);
+        MessageUtil::jsonConvert(filter_chain.tls_context(), *transport_socket.mutable_config());
+
+        has_tls++;
+        if (filter_chain.tls_context().has_session_ticket_keys()) {
+          has_stk++;
+        }
+      } else {
+        transport_socket.set_name(Config::TransportSocketNames::get().RAW_BUFFER);
       }
     }
+
+    auto& config_factory = Config::Utility::getAndCheckFactory<
+        Server::Configuration::DownstreamTransportSocketConfigFactory>(transport_socket.name());
+    ProtobufTypes::MessagePtr message =
+        Config::Utility::translateToFactoryConfig(transport_socket, config_factory);
+    transport_socket_factories_.emplace_back(config_factory.createTransportSocketFactory(
+        name_, sni_domains, skip_context_update, *message, *this));
   }
 
+  ASSERT(!transport_socket_factories_.empty());
+  ASSERT(transport_socket_factories_[0]);
+
   // TODO(PiotrSikora): allow filter chains with mixed use of Session Ticket Keys.
   // This doesn't work right now, because BoringSSL uses "session context" (initial SSL_CTX that
   // accepted connection, before SNI update) for session related stuff, including Session Ticket