feat:support configuring xff trusted cidrs #4702

rudrakhp · 2024-11-11T11:44:39Z

What type of PR is this?

feat:support configuring xff trusted cidrs

What this PR does / why we need it:

Implement API introduced in #4500

Which issue(s) this PR fixes:

Refer #4489

Release Notes: No

codecov · 2024-11-11T11:51:32Z

Codecov Report

Attention: Patch coverage is 81.57895% with 7 lines in your changes missing coverage. Please review.

Project coverage is 66.71%. Comparing base (3ec3d43) to head (d0301e0).
Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/ir/xds.go	0.00%	6 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4702      +/-   ##
==========================================
- Coverage   66.71%   66.71%   -0.01%     
==========================================
  Files         211      211              
  Lines       32811    32846      +35     
==========================================
+ Hits        21891    21913      +22     
- Misses       9591     9600       +9     
- Partials     1329     1333       +4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

arkodg · 2024-11-14T06:12:49Z

hey @rudrakhp can we add an e2e for this in this PR, or can you confirm this works by testing manually (and e2e can be added in a follow up)

rudrakhp · 2024-11-14T13:37:01Z

@arkodg I tried to use original IP detection extension's xff_num_trusted_hops instead of the same param in the parent HCM filter (which is on deprecation path according to envoy community). But looks like it's breaking RBAC somehow (this e2e was failing). Started a thread envoyproxy/envoy#37140 to understand this further.
Meanwhile only using xff_trusted_cidrs in the new extension to ensure no change in NumTrustedHops behaviour. Just an FYI in case we might decide to use the extension for NumTrustedHops as well in the future which will require us to fix this.
I will add E2E for trusted CIDRs in this PR to ensure functionality.

zhaohuabing · 2024-11-25T02:20:53Z

@arkodg I tried to use original IP detection extension's xff_num_trusted_hops instead of the same param in the parent HCM filter (which is on deprecation path according to envoy community). But looks like it's breaking RBAC somehow (this e2e was failing). Started a thread envoyproxy/envoy#37140 to understand this further. Meanwhile only using xff_trusted_cidrs in the new extension to ensure no change in NumTrustedHops behaviour. Just an FYI in case we might decide to use the extension for NumTrustedHops as well in the future which will require us to fix this. I will add E2E for trusted CIDRs in this PR to ensure functionality.

@rudrakhp This is probably related to envoyproxy/envoy#34241

zhaohuabing · 2024-12-21T04:11:14Z

@rudrakhp

But due to known issues mentioned earlier, not able to move legacy num trusted hops to the new extension. Moving PR to draft till the envoy issue is resolved.

To move this PR ahead, We probably could modify the existing RBAC e2e.

numTrustedHops: 2

gateway/test/e2e/testdata/authorization-client-ip.yaml

Line 94 in 2a10d47

numTrustedHops: 1

But I'm not sure which behavior is correct, the HCM xff_num_trusted_hops or the xff extension.

zhaohuabing · 2024-12-21T04:19:52Z

Raised a PR envoyproxy/envoy#37780 to seek help from the Enovy maintainers.

rudrakhp · 2024-12-21T19:47:48Z

To move this PR ahead, We probably could modify the existing RBAC e2e.

Not sure if that's the right thing to do, isn't it essentially changing behaviour for EGW users, probably breaking?

arkodg · 2025-01-14T00:37:42Z

internal/xds/translator/listener.go

+		if clientIPDetection.XForwardedFor.TrustedCIDRs != nil {
+			trustedCidrs := make([]*corev3.CidrRange, 0)
+			for _, cidr := range clientIPDetection.XForwardedFor.TrustedCIDRs {
+				parsedCidr := strings.Split(string(cidr), "/")


can we use net.ParseCIDR here to derive prefix and mask ?

arkodg · 2025-01-14T00:39:18Z

internal/xds/translator/testdata/out/xds-ir/client-ip-detection.listeners.yaml

        rds:
          configSource:
            ads: {}
            resourceApiVersion: V3
          routeConfigName: first-listener
        serverHeaderTransformation: PASS_THROUGH
        statPrefix: http-8081
-        useRemoteAddress: true
-        xffNumTrustedHops: 2
+        useRemoteAddress: false


since skipXffAppend: false exists, we will maintain backwards compatibility where the gateway ip will be appended to the off ?

Yes, when use_remote_address: true was used earlier, HCM's skip_xff_append was used, which defaults to false (see this).
When moving to to the extension and setting use_remote_address: false, we will have to set the extension's skip_xff_append to false explicitly since it defaults to true (see this).

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

zhaohuabing

LGTM. Thank you for your patience and for adding this valuable feature!

arkodg

LGTM thanks !

the ipv6 address was not defined in the authorization section Test failure: https://github.com/envoyproxy/gateway/actions/runs/12772899958/job/35604351424 Relates to envoyproxy#4702 Signed-off-by: Arko Dasgupta <arko@tetrate.io>

rudrakhp requested a review from a team as a code owner November 11, 2024 11:44

rudrakhp force-pushed the xff_trusted_cidrs_feat branch from 3ba436b to 25f96f1 Compare November 11, 2024 12:36

rudrakhp force-pushed the xff_trusted_cidrs_feat branch 2 times, most recently from c145161 to 52831e6 Compare November 14, 2024 12:34

rudrakhp force-pushed the xff_trusted_cidrs_feat branch 12 times, most recently from 1fde45a to 5595e7d Compare November 24, 2024 10:38

rudrakhp force-pushed the xff_trusted_cidrs_feat branch 10 times, most recently from 5154988 to 5c96805 Compare December 1, 2024 13:26

rudrakhp marked this pull request as draft December 1, 2024 21:24

zhaohuabing mentioned this pull request Dec 20, 2024

fix xff trusted hops envoyproxy/envoy#37780

Closed

rudrakhp force-pushed the xff_trusted_cidrs_feat branch 10 times, most recently from 07db398 to 4ae4ecf Compare January 11, 2025 13:56

rudrakhp marked this pull request as ready for review January 11, 2025 14:05

rudrakhp force-pushed the xff_trusted_cidrs_feat branch from 4ae4ecf to 73f5b21 Compare January 11, 2025 14:40

arkodg added this to the v1.3.0-rc.1 milestone Jan 14, 2025

arkodg requested a review from zhaohuabing January 14, 2025 00:29

arkodg reviewed Jan 14, 2025

View reviewed changes

feat:support configuring xff trusted cidrs

d0301e0

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp force-pushed the xff_trusted_cidrs_feat branch from 73f5b21 to d0301e0 Compare January 14, 2025 06:26

zhaohuabing approved these changes Jan 14, 2025

View reviewed changes

arkodg approved these changes Jan 14, 2025

View reviewed changes

arkodg merged commit 3d986ae into envoyproxy:main Jan 14, 2025
24 of 25 checks passed

This was referenced Jan 14, 2025

Skip AuthorizationClientIPTrustedCidrsTest #5062

Merged

Fix AuthorizationClientIPTrustedCidrsTest on IPv6 Cluster #5063

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat:support configuring xff trusted cidrs #4702

feat:support configuring xff trusted cidrs #4702

rudrakhp commented Nov 11, 2024

codecov bot commented Nov 11, 2024 •

edited

Loading

arkodg commented Nov 14, 2024

rudrakhp commented Nov 14, 2024 •

edited

Loading

zhaohuabing commented Nov 25, 2024 •

edited

Loading

zhaohuabing commented Dec 21, 2024 •

edited

Loading

zhaohuabing commented Dec 21, 2024

rudrakhp commented Dec 21, 2024

arkodg Jan 14, 2025

arkodg Jan 14, 2025

rudrakhp Jan 14, 2025 •

edited

Loading

zhaohuabing left a comment •

edited

Loading

arkodg left a comment

feat:support configuring xff trusted cidrs #4702

feat:support configuring xff trusted cidrs #4702

Conversation

rudrakhp commented Nov 11, 2024

codecov bot commented Nov 11, 2024 • edited Loading

Codecov Report

arkodg commented Nov 14, 2024

rudrakhp commented Nov 14, 2024 • edited Loading

zhaohuabing commented Nov 25, 2024 • edited Loading

zhaohuabing commented Dec 21, 2024 • edited Loading

zhaohuabing commented Dec 21, 2024

rudrakhp commented Dec 21, 2024

arkodg Jan 14, 2025

Choose a reason for hiding this comment

arkodg Jan 14, 2025

Choose a reason for hiding this comment

rudrakhp Jan 14, 2025 • edited Loading

Choose a reason for hiding this comment

zhaohuabing left a comment • edited Loading

Choose a reason for hiding this comment

arkodg left a comment

Choose a reason for hiding this comment

codecov bot commented Nov 11, 2024 •

edited

Loading

rudrakhp commented Nov 14, 2024 •

edited

Loading

zhaohuabing commented Nov 25, 2024 •

edited

Loading

zhaohuabing commented Dec 21, 2024 •

edited

Loading

rudrakhp Jan 14, 2025 •

edited

Loading

zhaohuabing left a comment •

edited

Loading