udp: no SO_REUSEPORT if not explicitly configured

api/envoy/api/v2/lds.proto

@@ -241,7 +241,6 @@ message Listener {
   // create one socket for each worker thread. This makes inbound connections
   // distribute among worker threads roughly evenly in cases where there are a high number
   // of connections. When this flag is set to false, all worker threads share one socket.
-  // For UDP this flag is set to true forcibly.
   //
   // Before Linux v4.19-rc1, new TCP connections may be rejected during hot restart
   // (see `3rd paragraph in 'soreuseport' commit message

api/envoy/api/v3alpha/lds.proto

@@ -238,7 +238,6 @@ message Listener {
   // create one socket for each worker thread. This makes inbound connections
   // distribute among worker threads roughly evenly in cases where there are a high number
   // of connections. When this flag is set to false, all worker threads share one socket.
-  // For UDP this flag is set to true forcibly.
   //
   // Before Linux v4.19-rc1, new TCP connections may be rejected during hot restart
   // (see `3rd paragraph in 'soreuseport' commit message

source/server/listener_impl.cc

@@ -126,7 +126,8 @@ Network::SocketSharedPtr ListenSocketFactoryImpl::getListenSocket() {
 ListenerImpl::ListenerImpl(const envoy::api::v2::Listener& config, const std::string& version_info,
                            ListenerManagerImpl& parent, const std::string& name, bool added_via_api,
                            bool workers_started, uint64_t hash,
-                           ProtobufMessage::ValidationVisitor& validation_visitor)
+                           ProtobufMessage::ValidationVisitor& validation_visitor,
+                           uint32_t concurrency)
     : parent_(parent), address_(Network::Address::resolveProtoAddress(config.address())),
       filter_chain_manager_(address_), global_scope_(parent_.server_.stats().createScope("")),
       listener_scope_(
@@ -154,8 +155,11 @@ ListenerImpl::ListenerImpl(const envoy::api::v2::Listener& config, const std::st
   if (PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, freebind, false)) {
     addListenSocketOptions(Network::SocketOptionFactory::buildIpFreebindOptions());
   }
-  if ((socket_type == Network::Address::SocketType::Datagram) || config.reuse_port()) {
+  if (config.reuse_port()) {
     addListenSocketOptions(Network::SocketOptionFactory::buildReusePortOptions());
+  } else if (socket_type == Network::Address::SocketType::Datagram && concurrency > 1) {
+    ENVOY_LOG(warn, "Listening on UDP without SO_REUSEPORT socket option may result to unstable "
+                    "packet proxying. Consider configuring the reuse_port listener option.");
   }
   if (!config.socket_options().empty()) {
     addListenSocketOptions(

source/server/listener_impl.h

@@ -96,7 +96,7 @@ class ListenerImpl : public Network::ListenerConfig,
   ListenerImpl(const envoy::api::v2::Listener& config, const std::string& version_info,
                ListenerManagerImpl& parent, const std::string& name, bool added_via_api,
                bool workers_started, uint64_t hash,
-               ProtobufMessage::ValidationVisitor& validation_visitor);
+               ProtobufMessage::ValidationVisitor& validation_visitor, uint32_t concurrency);
   ~ListenerImpl() override;
 
   /**

source/server/listener_manager_impl.cc

@@ -357,10 +357,11 @@ bool ListenerManagerImpl::addOrUpdateListenerInternal(const envoy::api::v2::List
     return false;
   }
 
-  ListenerImplPtr new_listener(new ListenerImpl(
-      config, version_info, *this, name, added_via_api, workers_started_, hash,
-      added_via_api ? server_.messageValidationContext().dynamicValidationVisitor()
-                    : server_.messageValidationContext().staticValidationVisitor()));
+  ListenerImplPtr new_listener(
+      new ListenerImpl(config, version_info, *this, name, added_via_api, workers_started_, hash,
+                       added_via_api ? server_.messageValidationContext().dynamicValidationVisitor()
+                                     : server_.messageValidationContext().staticValidationVisitor(),
+                       server_.options().concurrency()));
   ListenerImpl& new_listener_ref = *new_listener;
 
   // We mandate that a listener with the same name must have the same configured address. This

test/server/listener_manager_impl_quic_only_test.cc

@@ -39,6 +39,7 @@ TEST_F(ListenerManagerImplQuicOnlyTest, QuicListenerFactoryAndSslContext) {
           verify_subject_alt_name:
           - localhost
           - 127.0.0.1
+reuse_port: true
 udp_listener_config:
   udp_listener_name: "quiche_quic_listener"
   )EOF",
@@ -48,7 +49,7 @@ TEST_F(ListenerManagerImplQuicOnlyTest, QuicListenerFactoryAndSslContext) {
   EXPECT_CALL(server_.random_, uuid());
   expectCreateListenSocket(envoy::api::v2::core::SocketOption::STATE_PREBIND,
 #ifdef SO_RXQ_OVFL
-                           /* expected_num_options */ 3, // SO_REUSEPORT is on forcibly for UDP
+                           /* expected_num_options */ 3, // SO_REUSEPORT is on as configured
 #else
                            /* expected_num_options */ 2,
 #endif

test/server/listener_manager_impl_test.cc

@@ -3361,7 +3361,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, ReusePortListenerEnabledForTcp) {
                    /* expected_creation_params */ {true, false});
 }
 
-TEST_F(ListenerManagerImplWithRealFiltersTest, ReusePortListenerEnabledForUdp) {
+TEST_F(ListenerManagerImplWithRealFiltersTest, ReusePortListenerDisabled) {
 
   auto listener = createIPv4Listener("UdpListener");
   listener.mutable_address()->mutable_socket_address()->set_protocol(
@@ -3376,9 +3376,9 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, ReusePortListenerEnabledForUdp) {
   // IpPacketInfo and RxQueueOverFlow are always set if supported
   expectCreateListenSocket(envoy::api::v2::core::SocketOption::STATE_PREBIND,
 #ifdef SO_RXQ_OVFL
-                           /* expected_num_options */ 3,
-#else
                            /* expected_num_options */ 2,
+#else
+                           /* expected_num_options */ 1,
 #endif
                            /* expected_creation_params */ {true, false});
 
@@ -3395,12 +3395,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, ReusePortListenerEnabledForUdp) {
                    /* expected_num_calls */ 1);
 #endif
 
-  expectSetsockopt(os_sys_calls_,
-                   /* expected_sockopt_level */ SOL_SOCKET,
-                   /* expected_sockopt_name */ SO_REUSEPORT,
-                   /* expected_value */ 1,
-                   /* expected_num_calls */ 1);
-
+  server_.options_.concurrency_ = 2;
   manager_->addOrUpdateListener(listener, "", true);
   EXPECT_EQ(1U, manager_->listeners().size());
 }