proxy_protocol_filter: Add configuration to match only specific proxy protocol versions, new stats by nareddyt · Pull Request #32861 · envoyproxy/envoy

nareddyt · 2024-03-12T23:12:55Z

Commit Message:
proxy_protocol_filter: Configuration to match only specific proxy protocol versions, new stats

Additional Description:
Currently the Proxy Protocol Listener filter will try to match incoming connections against both proxy protocol v1 and v2 signatures. While this is convenient, it:

Increases the attack surface of the filter.
(when allow_requests_without_proxy_protocol is enabled) Increases the chance of signature conflicts between proxy protocol v1 requests and non-proxy protocol requests.

This change adds a new config option disallowed_versions that scopes down the set of proxy protocol versions that the filter matches. The configuration is optional and defaults to current behavior when not specified.

This change also adds new statistics per matched proxy protocol version. See doc update for details.

downstream_cx_proxy_proto.not_found_disallowed
downstream_cx_proxy_proto.not_found_allowed
downstream_cx_proxy_proto.v1.found
downstream_cx_proxy_proto.v1.disallowed
downstream_cx_proxy_proto.v1.error
downstream_cx_proxy_proto.v2.found
downstream_cx_proxy_proto.v2.disallowed
downstream_cx_proxy_proto.v2.error

Pre-existing stat downstream_cx_proxy_proto_error is kept at it's own scope for backwards-compatibility.

Risk Level: Low

All client-facing behavior changes are guarded by new filter config field.
Only default behavior change is incrementing new counters.

Testing:

Extensive unit tests
Some integration tests

Docs Changes:
Updated proto and filter docs

Release Notes:
Updated

Platform Specific Features:
N/A

Fixes #32425

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

repokitteh-read-only · 2024-03-12T23:13:04Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @markdroth
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #32861 was opened by nareddyt.

see: more, trace.

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

nareddyt · 2024-03-12T23:29:12Z

/review @fzhong-connect

repokitteh-read-only · 2024-03-12T23:29:16Z

nareddyt is not a collaborator, thus allowed to assign users.

🐱

Caused by: a #32861 (comment) was created by @nareddyt.

see: more, trace.

nareddyt · 2024-03-12T23:29:33Z

cc @fzhong-connect @jaysonjdmello

source/extensions/filters/listener/proxy_protocol/proxy_protocol.cc

source/extensions/filters/listener/proxy_protocol/proxy_protocol.h

source/extensions/filters/listener/proxy_protocol/proxy_protocol.cc

source/extensions/filters/listener/proxy_protocol/proxy_protocol.h

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

api/envoy/extensions/filters/listener/proxy_protocol/v3/proxy_protocol.proto

nareddyt · 2024-03-15T15:40:40Z

@markdroth or @envoyproxy/api-shepherds PTAL, we have a question for you in the comments.

nareddyt · 2024-03-18T18:03:24Z

PTAL

nareddyt · 2024-03-26T17:13:50Z

/retest

ggreenway

/wait

docs/root/configuration/listeners/listener_filters/proxy_protocol.rst

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

nareddyt · 2024-03-27T14:33:57Z

/retest

nareddyt · 2024-03-27T14:35:29Z

Ready for review @ggreenway . Not sure how to re-run the flaky CI failure

ggreenway

This mostly LGTM, aside from these small details.

I'm going to be out for awhile starting tomorrow, so one of the other maintainers will need to finish review of this and get it merged.

/wait

source/common/config/well_known_names.cc

source/extensions/filters/listener/proxy_protocol/proxy_protocol.cc

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

nareddyt · 2024-03-27T23:11:33Z

This mostly LGTM, aside from these small details.

I'm going to be out for awhile starting tomorrow, so one of the other maintainers will need to finish review of this and get it merged.

Thanks @ggreenway . If you have time, feel free to review today. Slightly worried Github may not let other reviewers merge as the status checks say:

1 review requesting changes by reviewers with write access. Merging can be performed automatically once the requested changes are addressed.

But no worries if you have taken off already, I can ping other reviewers tomorrow. Thanks for the thorough feedback!

nareddyt · 2024-03-28T15:43:19Z

/retest

Comments were addressed

… protocol versions, new stats (envoyproxy#32861) --------- Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

…ation (#34414) Commit Message: proxy_protocol_filter: Add field stat_prefix to the filter configuration Additional Description: This field allows for differentiating statistics when multiple proxy protocol listener filters are configured. This PR is a follow-up from previous conversation: #32861 (comment) Risk Level: Low All client-facing behavior changes are guarded by new filter config field. Testing: Stats unit tests Proxy protocol listener filter integration tests Docs Changes: Done Release Notes: Done Platform Specific Features: None Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

…ation (envoyproxy#34414) Commit Message: proxy_protocol_filter: Add field stat_prefix to the filter configuration Additional Description: This field allows for differentiating statistics when multiple proxy protocol listener filters are configured. This PR is a follow-up from previous conversation: envoyproxy#32861 (comment) Risk Level: Low All client-facing behavior changes are guarded by new filter config field. Testing: Stats unit tests Proxy protocol listener filter integration tests Docs Changes: Done Release Notes: Done Platform Specific Features: None Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

nareddyt added 5 commits March 12, 2024 15:28

Code changes

787d32b

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

Format

3010892

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

Docs

c285452

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

Docs fix

c846b2e

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

Add release notes

0a8f787

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

nareddyt requested review from ggreenway and soulxu as code owners March 12, 2024 23:12

repokitteh-read-only bot added the api label Mar 12, 2024

repokitteh-read-only bot assigned markdroth Mar 12, 2024

nareddyt added 2 commits March 12, 2024 18:19

Fix typo

ebcb7dd

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

Fix typo

cfb3be7

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

ggreenway requested changes Mar 13, 2024

View reviewed changes

nareddyt added 2 commits March 13, 2024 10:21

review comments

ae9c3e3

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

update doc

5df93bb

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

nareddyt requested a review from ggreenway March 13, 2024 15:26

nareddyt added 3 commits March 13, 2024 10:37

Fix docs

03b353e

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

Fix windows build

ed99e3c

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

Attempt to fix test failure

c0614b3

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

nezdolik assigned ggreenway and soulxu Mar 13, 2024

ggreenway reviewed Mar 13, 2024

View reviewed changes

api/envoy/extensions/filters/listener/proxy_protocol/v3/proxy_protocol.proto Outdated Show resolved Hide resolved

soulxu reviewed Mar 14, 2024

View reviewed changes

api/envoy/extensions/filters/listener/proxy_protocol/v3/proxy_protocol.proto Outdated Show resolved Hide resolved

nareddyt requested review from ggreenway and soulxu March 18, 2024 15:45

ggreenway requested changes Mar 26, 2024

View reviewed changes

docs/root/configuration/listeners/listener_filters/proxy_protocol.rst Outdated Show resolved Hide resolved

docs/root/configuration/listeners/listener_filters/proxy_protocol.rst Outdated Show resolved Hide resolved

repokitteh-read-only bot added the waiting label Mar 26, 2024

review comments: change root stats scope, fix docs

4a02c62

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

repokitteh-read-only bot removed the waiting label Mar 26, 2024

nareddyt requested a review from ggreenway March 26, 2024 22:21

ggreenway previously requested changes Mar 27, 2024

View reviewed changes

source/common/config/well_known_names.cc Outdated Show resolved Hide resolved

source/extensions/filters/listener/proxy_protocol/proxy_protocol.cc Outdated Show resolved Hide resolved

repokitteh-read-only bot added the waiting label Mar 27, 2024

ggreenway removed their assignment Mar 27, 2024

nareddyt added 3 commits March 27, 2024 17:34

Merge branch 'main' into pp-allowed-versions-stats

2c0f33f

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

review comments: fix stats tag extraction

5ae0954

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

review comments: stats prefix name

9674dbf

Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

repokitteh-read-only bot removed the waiting label Mar 27, 2024

nareddyt requested a review from ggreenway March 27, 2024 23:07

yanavlasov approved these changes Mar 29, 2024

View reviewed changes

yanavlasov merged commit 113e997 into envoyproxy:main Mar 29, 2024

nareddyt added a commit to nareddyt/envoy that referenced this pull request Apr 1, 2024

proxy_protocol_filter: Add configuration to match only specific proxy…

1ff7c1b

… protocol versions, new stats (envoyproxy#32861) --------- Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

nareddyt added a commit to nareddyt/envoy that referenced this pull request Apr 11, 2024

proxy_protocol_filter: Add configuration to match only specific proxy…

91ada95

… protocol versions, new stats (envoyproxy#32861) --------- Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

alyssawilk pushed a commit to alyssawilk/envoy that referenced this pull request Apr 29, 2024

proxy_protocol_filter: Add configuration to match only specific proxy…

f99459a

… protocol versions, new stats (envoyproxy#32861) --------- Signed-off-by: Teju Nareddy <tnareddy@confluent.io>

nareddyt mentioned this pull request May 29, 2024

proxy_protocol_filter: Add field stat_prefix to the filter configuration #34414

Merged

This was referenced Feb 27, 2026

🌱 CNCF mission generation 2026-02-27 kubestellar/console-kb#6

Closed

🌱 CNCF mission generation 2026-02-27 kubestellar/console-kb#10

Merged

Conversation

nareddyt commented Mar 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

repokitteh-read-only bot commented Mar 12, 2024

Uh oh!

nareddyt commented Mar 12, 2024

Uh oh!

repokitteh-read-only bot commented Mar 12, 2024

Uh oh!

nareddyt commented Mar 12, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nareddyt commented Mar 15, 2024

Uh oh!

nareddyt commented Mar 18, 2024

Uh oh!

nareddyt commented Mar 26, 2024

Uh oh!

ggreenway left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nareddyt commented Mar 27, 2024

Uh oh!

nareddyt commented Mar 27, 2024

Uh oh!

ggreenway left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nareddyt commented Mar 27, 2024

Uh oh!

nareddyt commented Mar 28, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

nareddyt commented Mar 12, 2024 •

edited

Loading