Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ability to disable Envoy adding server headers to responses #4906

Merged
merged 17 commits into from
Jan 23, 2023
Merged

Ability to disable Envoy adding server headers to responses #4906

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
487bd4c
WIP
vishal-chdhry Dec 7, 2022
7613b45
NIT
vishal-chdhry Dec 7, 2022
d779ee5
NIT
vishal-chdhry Dec 23, 2022
73fc2eb
Merge branch 'main' into disable-envoy-adding-server
vishal-chdhry Jan 14, 2023
5e3b212
changed server header transformation to enum
vishal-chdhry Jan 14, 2023
8b8aa12
wrote serverHeaderTransformationType
vishal-chdhry Jan 19, 2023
0af9fc9
added serverHeaderTransformation to config file
vishal-chdhry Jan 19, 2023
b12cce2
added changelog
vishal-chdhry Jan 19, 2023
7022e23
changed serverheader transform type to string
vishal-chdhry Jan 20, 2023
00ec3ec
NIT
vishal-chdhry Jan 20, 2023
965212c
tests
vishal-chdhry Jan 20, 2023
6635ef4
test changes
vishal-chdhry Jan 21, 2023
48f434e
Merge branch 'main' of https://github.com/projectcontour/contour into…
vishal-chdhry Jan 21, 2023
48b5224
make generate
vishal-chdhry Jan 21, 2023
f74bb55
fix unit test failures
skriss Jan 23, 2023
b7cf999
lowercase field values
skriss Jan 23, 2023
147e890
docs updates
skriss Jan 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions apis/projectcontour/v1alpha1/contourconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -336,6 +336,14 @@ type EnvoyListenerConfig struct {
// +optional
DisableMergeSlashes *bool `json:"disableMergeSlashes,omitempty"`

// DisableServerHeaderTransformation signifies we will not modify the Server header.
vishal-chdhry marked this conversation as resolved.
Show resolved Hide resolved
// false: OVERWRITE
// true: PASS_THROUGH
//
// Contour's default is false.
// +optional
DisableServerHeaderTransformation *bool `json:"DisableServerHeaderTransformation,omitempty"`
vishal-chdhry marked this conversation as resolved.
Show resolved Hide resolved

// ConnectionBalancer. If the value is exact, the listener will use the exact connection balancer
// See https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/listener.proto#envoy-api-msg-listener-connectionbalanceconfig
// for more information.
Expand Down
5 changes: 5 additions & 0 deletions apis/projectcontour/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cmd/contour/serve.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,6 +348,7 @@ func (s *Server) doServe() error {
DefaultHTTPVersions: parseDefaultHTTPVersions(contourConfiguration.Envoy.DefaultHTTPVersions),
AllowChunkedLength: !*contourConfiguration.Envoy.Listener.DisableAllowChunkedLength,
MergeSlashes: !*contourConfiguration.Envoy.Listener.DisableMergeSlashes,
ServerHeaderTransformation: !*contourConfiguration.Envoy.Listener.DisableServerHeaderTransformation,
XffNumTrustedHops: *contourConfiguration.Envoy.Network.XffNumTrustedHops,
ConnectionBalancer: contourConfiguration.Envoy.Listener.ConnectionBalancer,
}
Expand Down
9 changes: 5 additions & 4 deletions cmd/contour/servecontext.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -436,10 +436,11 @@ func (ctx *serveContext) convertToContourConfigurationSpec() contour_api_v1alpha
},
Envoy: &contour_api_v1alpha1.EnvoyConfig{
Listener: &contour_api_v1alpha1.EnvoyListenerConfig{
UseProxyProto: &ctx.useProxyProto,
DisableAllowChunkedLength: &ctx.Config.DisableAllowChunkedLength,
DisableMergeSlashes: &ctx.Config.DisableMergeSlashes,
ConnectionBalancer: ctx.Config.Listener.ConnectionBalancer,
UseProxyProto: &ctx.useProxyProto,
DisableAllowChunkedLength: &ctx.Config.DisableAllowChunkedLength,
DisableMergeSlashes: &ctx.Config.DisableMergeSlashes,
DisableServerHeaderTransformation: &ctx.Config.DisableServerHeaderTransformation,
ConnectionBalancer: ctx.Config.Listener.ConnectionBalancer,
TLS: &contour_api_v1alpha1.EnvoyTLS{
MinimumProtocolVersion: ctx.Config.TLS.MinimumProtocolVersion,
CipherSuites: cipherSuites,
Expand Down
10 changes: 10 additions & 0 deletions examples/contour/01-crds.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,11 @@ spec:
description: Listener hold various configurable Envoy listener
values.
properties:
DisableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
we will not modify the Server header. false: OVERWRITE true:\tPASS_THROUGH
\n Contour's default is false."
type: boolean
connectionBalancer:
description: "ConnectionBalancer. If the value is exact, the
listener will use the exact connection balancer See https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/listener.proto#envoy-api-msg-listener-connectionbalanceconfig
Expand Down Expand Up @@ -3054,6 +3059,11 @@ spec:
description: Listener hold various configurable Envoy listener
values.
properties:
DisableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
we will not modify the Server header. false: OVERWRITE
true:\tPASS_THROUGH \n Contour's default is false."
type: boolean
connectionBalancer:
description: "ConnectionBalancer. If the value is exact,
the listener will use the exact connection balancer
Expand Down
9 changes: 5 additions & 4 deletions internal/contourconfig/contourconfiguration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,10 +74,11 @@ func Defaults() contour_api_v1alpha1.ContourConfigurationSpec {
},
Envoy: &contour_api_v1alpha1.EnvoyConfig{
Listener: &contour_api_v1alpha1.EnvoyListenerConfig{
UseProxyProto: pointer.Bool(false),
DisableAllowChunkedLength: pointer.Bool(false),
DisableMergeSlashes: pointer.Bool(false),
ConnectionBalancer: "",
UseProxyProto: pointer.Bool(false),
DisableAllowChunkedLength: pointer.Bool(false),
DisableMergeSlashes: pointer.Bool(false),
DisableServerHeaderTransformation: pointer.Bool(false),
ConnectionBalancer: "",
TLS: &contour_api_v1alpha1.EnvoyTLS{
MinimumProtocolVersion: "1.2",
CipherSuites: contour_api_v1alpha1.DefaultTLSCiphers,
Expand Down
15 changes: 13 additions & 2 deletions internal/envoy/v3/listener.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,7 @@ type httpConnectionManagerBuilder struct {
codec HTTPVersionType // Note the zero value is AUTO, which is the default we want.
allowChunkedLength bool
mergeSlashes bool
serverHeaderTransformation http.HttpConnectionManager_ServerHeaderTransformation
forwardClientCertificate *dag.ClientCertificateDetails
numTrustedHops uint32
}
Expand Down Expand Up @@ -241,6 +242,15 @@ func (b *httpConnectionManagerBuilder) MergeSlashes(enabled bool) *httpConnectio
return b
}

func (b *httpConnectionManagerBuilder) ServerHeaderTransformation(enabled bool) *httpConnectionManagerBuilder {
tserverHeaderTransformation := http.HttpConnectionManager_OVERWRITE
if enabled {
tserverHeaderTransformation = http.HttpConnectionManager_PASS_THROUGH
}
b.serverHeaderTransformation = tserverHeaderTransformation
return b
}

func (b *httpConnectionManagerBuilder) ForwardClientCertificate(details *dag.ClientCertificateDetails) *httpConnectionManagerBuilder {
b.forwardClientCertificate = details
return b
Expand Down Expand Up @@ -452,8 +462,9 @@ func (b *httpConnectionManagerBuilder) Get() *envoy_listener_v3.Filter {
},

// issue #1487 pass through X-Request-Id if provided.
PreserveExternalRequestId: true,
MergeSlashes: b.mergeSlashes,
PreserveExternalRequestId: true,
MergeSlashes: b.mergeSlashes,
ServerHeaderTransformation: b.serverHeaderTransformation,

RequestTimeout: envoy.Timeout(b.requestTimeout),
StreamIdleTimeout: envoy.Timeout(b.streamIdleTimeout),
Expand Down
6 changes: 6 additions & 0 deletions internal/xdscache/v3/listener.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,9 @@ type ListenerConfig struct {
// MergeSlashes toggles Envoy's non-standard merge_slashes path transformation option for all listeners.
MergeSlashes bool

// ServerHeaderTransformation signifies we will not modify the Server header.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update godoc to reflect enum nature

Copy link
Member

@skriss skriss Jan 20, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// ServerHeaderTransformation signifies we will not modify the Server header.
// ServerHeaderTransformation defines the action to be applied to the Server header on the response path.

ServerHeaderTransformation bool

// XffNumTrustedHops sets the number of additional ingress proxy hops from the
// right side of the x-forwarded-for HTTP header to trust.
XffNumTrustedHops uint32
Expand Down Expand Up @@ -388,6 +391,7 @@ func (c *ListenerCache) OnChange(root *dag.DAG) {
ConnectionShutdownGracePeriod(cfg.Timeouts.ConnectionShutdownGracePeriod).
AllowChunkedLength(cfg.AllowChunkedLength).
MergeSlashes(cfg.MergeSlashes).
ServerHeaderTransformation(cfg.ServerHeaderTransformation).
NumTrustedHops(cfg.XffNumTrustedHops).
AddFilter(envoy_v3.GlobalRateLimitFilter(envoyGlobalRateLimitConfig(cfg.RateLimitConfig))).
Get()
Expand Down Expand Up @@ -448,6 +452,7 @@ func (c *ListenerCache) OnChange(root *dag.DAG) {
ConnectionShutdownGracePeriod(cfg.Timeouts.ConnectionShutdownGracePeriod).
AllowChunkedLength(cfg.AllowChunkedLength).
MergeSlashes(cfg.MergeSlashes).
ServerHeaderTransformation(cfg.ServerHeaderTransformation).
NumTrustedHops(cfg.XffNumTrustedHops).
AddFilter(envoy_v3.GlobalRateLimitFilter(envoyGlobalRateLimitConfig(cfg.RateLimitConfig))).
ForwardClientCertificate(forwardClientCertificate).
Expand Down Expand Up @@ -514,6 +519,7 @@ func (c *ListenerCache) OnChange(root *dag.DAG) {
ConnectionShutdownGracePeriod(cfg.Timeouts.ConnectionShutdownGracePeriod).
AllowChunkedLength(cfg.AllowChunkedLength).
MergeSlashes(cfg.MergeSlashes).
ServerHeaderTransformation(cfg.ServerHeaderTransformation).
NumTrustedHops(cfg.XffNumTrustedHops).
AddFilter(envoy_v3.GlobalRateLimitFilter(envoyGlobalRateLimitConfig(cfg.RateLimitConfig))).
ForwardClientCertificate(forwardClientCertificate).
Expand Down
20 changes: 12 additions & 8 deletions pkg/config/parameters.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -485,6 +485,9 @@ type Parameters struct {
// which strips duplicate slashes from request URL paths.
DisableMergeSlashes bool `yaml:"disableMergeSlashes,omitempty"`

// DisableServerHeaderTransformation signifies we will not modify the Server header.
DisableServerHeaderTransformation bool `yaml:"DisableServerHeaderTransformation,omitempty"`
vishal-chdhry marked this conversation as resolved.
Show resolved Hide resolved

// EnableExternalNameService allows processing of ExternalNameServices
// Defaults to disabled for security reasons.
// TODO(youngnick): put a link to the issue and CVE here.
Expand Down Expand Up @@ -686,14 +689,15 @@ func Defaults() Parameters {
Server: ServerParameters{
XDSServerType: ContourServerType,
},
IngressStatusAddress: "",
AccessLogFormat: DEFAULT_ACCESS_LOG_TYPE,
AccessLogFields: DefaultFields,
AccessLogLevel: LogLevelInfo,
TLS: TLSParameters{},
DisablePermitInsecure: false,
DisableAllowChunkedLength: false,
DisableMergeSlashes: false,
IngressStatusAddress: "",
AccessLogFormat: DEFAULT_ACCESS_LOG_TYPE,
AccessLogFields: DefaultFields,
AccessLogLevel: LogLevelInfo,
TLS: TLSParameters{},
DisablePermitInsecure: false,
DisableAllowChunkedLength: false,
DisableMergeSlashes: false,
DisableServerHeaderTransformation: false,
Timeouts: TimeoutParameters{
// This is chosen as a rough default to stop idle connections wasting resources,
// without stopping slow connections from being terminated too quickly.
Expand Down