Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable UDP listener & proxy support #1066

Merged
merged 2 commits into from
Dec 19, 2024
Merged

Conversation

mhofstetter
Copy link
Member

@mhofstetter mhofstetter commented Dec 17, 2024

extensions: enable udp proxy

This commit enables the UDP proxy related envoy extensions.

* `UDPProxy` UDP listener filter
* `HTTPCapsule` UDP session filter
* `DynamicForwardProxy` UDP session filter
bpf_metadata: introduce udp bpf_metadata factory & instance

Currently, configuring a UDP listener (Envoy listener with socket
address protocol set to `udp`) with a UDPProxy in Envoy may
fail due to Envoy missing privileges to bind the listener
address.

The reason is that the Cilium Proxy uses a "starter" that drops all
privileged capabilities before forking the actual Envoy process
(See https://github.com/cilium/proxy/pull/315 for more details.) Setting up the necessary socket options
is part of the Cilium `BPFMetadata` listener filter.

The current `BPFMetadata` listener filter can't be used as UDP listener
filter (different factory). Therefore, this commit introduces a UDP
capable version of the `BPFMetadata` listener filter. It's only purpose
is to setup the UDP listener socket correctly (IP_TRANSPARENT, SO_REUSEADDR,
...). It's currently NOT adding any BPF metadata related information to the
socket. This is not necessary as the Cilium network filters aren't yet available
for UDP either.

@mhofstetter mhofstetter force-pushed the pr/mhofstetter/udp-proxy branch from 4e2651f to bd183b5 Compare December 18, 2024 19:36
This commit enables the UDP proxy related envoy extensions.

* `UDPProxy` UDP listener filter
* `HTTPCapsule` UDP session filter
* `DynamicForwardProxy` UDP session filter

Signed-off-by: Marco Hofstetter <marco.hofstetter@isovalent.com>
Currently, configuring a UDP listener (Envoy listener with socket
address protocol set to `udp`) with a UDPProxy in Envoy may
fail due to Envoy failing to missing privileges to bind the listener
address.

The reason is that the Cilium Proxy uses a "starter" that drops all
privileged capabilities before forking the actual Envoy process
(See #315 for more details.) Setting up the necessary socket options
is part of the Cilium `BPFMetadata` listener filter.

The current `BPFMetadata` listener filter can't be used as UDP listener
filter (different factory). Therefore, this commit introduces a UDP
capable version of the `BPFMetadata` listener filter. It's only purpose
is to setup the UDP listener socket correctly (IP_TRANSPARENT, SO_REUSEADDR,
...). It's currently NOT adding any BPF metadata related information to the
socket. This is not necessary as the Cilium network filters aren't yet available
for UDP either.

Signed-off-by: Marco Hofstetter <marco.hofstetter@isovalent.com>
@mhofstetter mhofstetter force-pushed the pr/mhofstetter/udp-proxy branch from bd183b5 to f6b8495 Compare December 19, 2024 07:35
@mhofstetter mhofstetter changed the title extensions: enable udp proxy Enable UDP listener & proxy support Dec 19, 2024
@mhofstetter mhofstetter marked this pull request as ready for review December 19, 2024 08:19
@mhofstetter mhofstetter requested a review from a team as a code owner December 19, 2024 08:19
@jrajahalme jrajahalme added this pull request to the merge queue Dec 19, 2024
Merged via the queue into main with commit b2e1bb5 Dec 19, 2024
5 checks passed
@jrajahalme jrajahalme deleted the pr/mhofstetter/udp-proxy branch December 19, 2024 10:51
@sayboras
Copy link
Member

sayboras commented Dec 19, 2024

We might need to backport this to v1.31, as main branch is now with envoy v1.32.

@mhofstetter
Copy link
Member Author

We might need to backport this to v1.31, as main branch is now with envoy v1.32.

Thanks for the reminder Tam! #1070

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants