connection: Set the SOL_IP,IP_TRANSPARENT option on listen sockets

source/common/config/lds_json.cc

@@ -56,6 +56,7 @@ void LdsJson::translateListener(const Json::Object& json_listener,
   JSON_UTIL_SET_BOOL(json_listener, listener, use_original_dst);
   JSON_UTIL_SET_BOOL(json_listener, *listener.mutable_deprecated_v1(), bind_to_port);
   JSON_UTIL_SET_INTEGER(json_listener, listener, per_connection_buffer_limit_bytes);
+  JSON_UTIL_SET_BOOL(json_listener, listener, transparent);
 }
 
 } // namespace Config

source/common/json/config_schemas.cc

@@ -185,6 +185,7 @@ const std::string Json::Schema::LISTENER_SCHEMA(R"EOF(
        },
        "drain_type": {"type" : "string", "enum" : ["default", "modify_only"]},
        "ssl_context" : {"$ref" : "#/definitions/ssl_context"},
+       "transparent" : {"type": "boolean"},
        "bind_to_port" : {"type": "boolean"},
        "use_proxy_proto" : {"type" : "boolean"},
        "use_original_dst" : {"type" : "boolean"},

source/common/network/listen_socket_impl.h

@@ -81,7 +81,6 @@ class ConnectionSocketImpl : public SocketImpl, public ConnectionSocket {
   const Address::InstanceConstSharedPtr& remoteAddress() const override { return remote_address_; }
   void setLocalAddress(const Address::InstanceConstSharedPtr& local_address,
                        bool restored) override {
-    ASSERT(!restored || *local_address != *local_address_);
     local_address_ = local_address;
     local_address_restored_ = restored;
   }

source/common/network/socket_option_impl.cc

@@ -11,6 +11,16 @@ namespace Network {
 
 bool SocketOptionImpl::setOption(Socket& socket, Socket::SocketState state) const {
   if (state == Socket::SocketState::PreBind) {
+    if (transparent_.has_value()) {
+      const int should_transparent = transparent_.value() ? 1 : 0;
+      const int error =
+          setIpSocketOption(socket, ENVOY_SOCKET_IP_TRANSPARENT, ENVOY_SOCKET_IPV6_TRANSPARENT,
+                            &should_transparent, sizeof(should_transparent));
+      if (error != 0) {
+        ENVOY_LOG(warn, "Setting IP_TRANSPARENT on listener socket failed: {}", strerror(error));
+        return false;
+      }
+    }
     if (freebind_.has_value()) {
       const int should_freebind = freebind_.value() ? 1 : 0;
       const int error =

source/common/network/socket_option_impl.h

@@ -17,6 +17,18 @@ namespace Network {
 // on a platform, we can make this the empty value. This allows us to avoid proliferation of #ifdef.
 typedef absl::optional<int> SocketOptionName;
 
+#ifdef IP_TRANSPARENT
+#define ENVOY_SOCKET_IP_TRANSPARENT Network::SocketOptionName(IP_TRANSPARENT)
+#else
+#define ENVOY_SOCKET_IP_TRANSPARENT Network::SocketOptionName()
+#endif
+
+#ifdef IPV6_TRANSPARENT
+#define ENVOY_SOCKET_IPV6_TRANSPARENT Network::SocketOptionName(IPV6_TRANSPARENT)
+#else
+#define ENVOY_SOCKET_IPV6_TRANSPARENT Network::SocketOptionName()
+#endif
+
 #ifdef IP_FREEBIND
 #define ENVOY_SOCKET_IP_FREEBIND Network::SocketOptionName(IP_FREEBIND)
 #else
@@ -31,7 +43,8 @@ typedef absl::optional<int> SocketOptionName;
 
 class SocketOptionImpl : public Socket::Option, Logger::Loggable<Logger::Id::connection> {
 public:
-  SocketOptionImpl(absl::optional<bool> freebind) : freebind_(freebind) {}
+  SocketOptionImpl(absl::optional<bool> transparent, absl::optional<bool> freebind)
+      : transparent_(transparent), freebind_(freebind) {}
 
   // Socket::Option
   bool setOption(Socket& socket, Socket::SocketState state) const override;
@@ -57,6 +70,7 @@ class SocketOptionImpl : public Socket::Option, Logger::Loggable<Logger::Id::con
                                SocketOptionName ipv6_optname, const void* optval, socklen_t optlen);
 
 private:
+  const absl::optional<bool> transparent_;
   const absl::optional<bool> freebind_;
 };
 

source/common/upstream/upstream_impl.cc

@@ -75,7 +75,9 @@ uint64_t parseFeatures(const envoy::api::v2::Cluster& config,
 class UpstreamSocketOption : public Network::SocketOptionImpl {
 public:
   UpstreamSocketOption(const ClusterInfo& cluster_info)
-      : Network::SocketOptionImpl(cluster_info.features() & ClusterInfo::Features::FREEBIND) {}
+      : Network::SocketOptionImpl({}, cluster_info.features() & ClusterInfo::Features::FREEBIND
+                                          ? true
+                                          : absl::optional<bool>{}) {}
 };
 
 } // namespace

source/extensions/filters/listener/original_dst/original_dst.cc

@@ -26,7 +26,7 @@ Network::FilterStatus OriginalDstFilter::onAccept(Network::ListenerFilterCallbac
     // connections that are NOT redirected using iptables. If a connection was not redirected,
     // the address returned by getOriginalDst() matches the local address of the new socket.
     // In this case the listener handles the connection directly and does not hand it off.
-    if (original_local_address && (*original_local_address != local_address)) {
+    if (original_local_address) {
       // Restore the local address to the original one.
       socket.setLocalAddress(original_local_address, true);
     }

source/server/BUILD

@@ -201,6 +201,7 @@ envoy_cc_library(
         "//include/envoy/server:listener_manager_interface",
         "//include/envoy/server:transport_socket_config_interface",
         "//include/envoy/server:worker_interface",
+        "//source/common/api:os_sys_calls_lib",
         "//source/common/config:utility_lib",
         "//source/common/config:well_known_names",
         "//source/common/network:listen_socket_lib",

source/server/listener_manager_impl.cc

@@ -3,6 +3,7 @@
 #include "envoy/registry/registry.h"
 #include "envoy/server/transport_socket_config.h"
 
+#include "common/api/os_sys_calls_impl.h"
 #include "common/common/assert.h"
 #include "common/common/fmt.h"
 #include "common/config/utility.h"
@@ -111,7 +112,9 @@ ProdListenerComponentFactory::createDrainManager(envoy::api::v2::Listener::Drain
 class ListenerSocketOption : public Network::SocketOptionImpl {
 public:
   ListenerSocketOption(const envoy::api::v2::Listener& config)
-      : Network::SocketOptionImpl(config.freebind().value()) {}
+      : Network::SocketOptionImpl(
+            PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, transparent, absl::optional<bool>{}),
+            PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, freebind, absl::optional<bool>{})) {}
 };
 
 ListenerImpl::ListenerImpl(const envoy::api::v2::Listener& config, ListenerManagerImpl& parent,
@@ -136,9 +139,7 @@ ListenerImpl::ListenerImpl(const envoy::api::v2::Listener& config, ListenerManag
   ASSERT(config.filter_chains().size() >= 1);
 
   // Add listen socket options from the config.
-  if (config.has_freebind()) {
-    addListenSocketOption(std::make_unique<ListenerSocketOption>(config));
-  }
+  addListenSocketOption(std::make_unique<ListenerSocketOption>(config));
 
   if (!config.listener_filters().empty()) {
     listener_filter_factories_ =

test/common/network/socket_option_impl_test.cc

@@ -33,20 +33,20 @@ TEST_F(SocketOptionImplTest, BadFd) {
 
 // Nop when there are no socket options set.
 TEST_F(SocketOptionImplTest, SetOptionEmptyNop) {
-  SocketOptionImpl socket_option{{}};
+  SocketOptionImpl socket_option{{}, {}};
   EXPECT_TRUE(socket_option.setOption(socket_, Socket::SocketState::PreBind));
   EXPECT_TRUE(socket_option.setOption(socket_, Socket::SocketState::PostBind));
 }
 
 // We fail to set the option when the underlying setsockopt syscall fails.
 TEST_F(SocketOptionImplTest, SetOptionFreebindFailure) {
-  SocketOptionImpl socket_option{true};
+  SocketOptionImpl socket_option{{}, true};
   EXPECT_FALSE(socket_option.setOption(socket_, Socket::SocketState::PreBind));
 }
 
 // The happy path for setOpion(); IP_FREEBIND is set true.
 TEST_F(SocketOptionImplTest, SetOptionFreeebindSuccessTrue) {
-  SocketOptionImpl socket_option{true};
+  SocketOptionImpl socket_option{{}, true};
   if (ENVOY_SOCKET_IP_FREEBIND.has_value()) {
     Address::Ipv4Instance address("1.2.3.4", 5678);
     const int fd = address.socket(Address::SocketType::Stream);
@@ -65,15 +65,15 @@ TEST_F(SocketOptionImplTest, SetOptionFreeebindSuccessTrue) {
 
 // The happy path for setOpion(); IP_FREEBIND is set false.
 TEST_F(SocketOptionImplTest, SetOptionFreeebindSuccessFalse) {
-  SocketOptionImpl socket_option{true};
+  SocketOptionImpl socket_option{{}, false};
   if (ENVOY_SOCKET_IP_FREEBIND.has_value()) {
     Address::Ipv4Instance address("1.2.3.4", 5678);
     const int fd = address.socket(Address::SocketType::Stream);
     EXPECT_CALL(socket_, fd()).WillRepeatedly(Return(fd));
     EXPECT_CALL(os_sys_calls_,
                 setsockopt_(_, IPPROTO_IP, ENVOY_SOCKET_IP_FREEBIND.value(), _, sizeof(int)))
         .WillOnce(Invoke([](int, int, int, const void* optval, socklen_t) -> int {
-          EXPECT_EQ(1, *static_cast<const int*>(optval));
+          EXPECT_EQ(0, *static_cast<const int*>(optval));
           return 0;
         }));
     EXPECT_TRUE(socket_option.setOption(socket_, Socket::SocketState::PreBind));
@@ -84,7 +84,7 @@ TEST_F(SocketOptionImplTest, SetOptionFreeebindSuccessFalse) {
 
 // Freebind settings have no effect on post-bind behavior.
 TEST_F(SocketOptionImplTest, SetOptionFreebindPostBind) {
-  SocketOptionImpl socket_option{true};
+  SocketOptionImpl socket_option{{}, true};
   EXPECT_TRUE(socket_option.setOption(socket_, Socket::SocketState::PostBind));
 }
 

test/mocks/network/mocks.h

@@ -307,6 +307,7 @@ class MockListenerConfig : public ListenerConfig {
   MOCK_METHOD0(filterChainFactory, FilterChainFactory&());
   MOCK_METHOD0(socket, Socket&());
   MOCK_METHOD0(transportSocketFactory, TransportSocketFactory&());
+  MOCK_METHOD0(transparent, bool());
   MOCK_METHOD0(bindToPort, bool());
   MOCK_CONST_METHOD0(handOffRestoredDestinationConnections, bool());
   MOCK_METHOD0(perConnectionBufferLimitBytes, uint32_t());

test/server/listener_manager_impl_test.cc

@@ -1407,7 +1407,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, FreebindListenerDisabled) {
       .WillOnce(Invoke([&](Network::Address::InstanceConstSharedPtr,
                            const Network::Socket::OptionsSharedPtr& options,
                            bool) -> Network::SocketSharedPtr {
-        EXPECT_EQ(options.get(), nullptr);
+        EXPECT_NE(options.get(), nullptr);
         return listener_factory_.socket_;
       }));
   manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), true);