Repository navigation
Passthrough dial address resolved by the gateway - #2045
Merged
Bowei Du (bowei) merged 2 commits intoOct 1, 2026
Merged
Bowei Du (bowei) merged 2 commits into
Bowei Du (bowei) merged 2 commits into
Conversation
Lior Lieberman (LiorLieberman)
force-pushed
the
passthrough-dial-by-sni
branch
2 times, most recently
from
October 1, 2026 04:21
a1c1dc7 to
74d27f3
Compare
Lior Lieberman (LiorLieberman)
marked this pull request as ready for review
October 1, 2026 04:24
Lior Lieberman (LiorLieberman)
requested review from
Bowei Du (bowei) and
yanavlasov
and removed request for
yanavlasov
October 1, 2026 04:25
Lior Lieberman (LiorLieberman)
force-pushed
the
passthrough-dial-by-sni
branch
from
October 1, 2026 16:07
74d27f3 to
d40d6c7
Compare
yanavlasov
suggested changes
Oct 1, 2026
|
|
||
| // The rule for this name covers 8443 only, so the ClientHello on 443 is | ||
| // closed. | ||
| const wrongPortOrigin = "https://" + egressOriginPassthroughWrongPortHost + "/" |
Collaborator
There was a problem hiding this comment.
You need one more test to validate that SNI DFP works.
To test SNI DFP, the probe fetcher needs to dial TLS connection to a bogus IP address (240.0.0.1) but still use valid SNI "example.edu". Successful fetch means that SNI DFP did its job. I think you can do in the custom DialContext in transport,
substrate/internal/e2e/fixtures/probe/main.go
Line 382 in b5ad4b3
Collaborator
Author
There was a problem hiding this comment.
Good call, added something
Comment on lines
+280
to
+281
| // plainPassthroughDestinationFormat is what the plain gateway still copies | ||
| // into the ORIGINAL_DST filter state. Nothing sets it anymore. |
Collaborator
Author
There was a problem hiding this comment.
comments are bad, will remove in a followup as I have another open pr to remove the "plain gateway "
Bowei Du (bowei)
approved these changes
Oct 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The passthrough chain from #2019 dialed the ORIGINAL_DST filter state, which the CONNECT leg filled with the address the actor connected to. The SNI picked the chain, the actor's own resolution picked the destination, so a passthrough rule for one name let an actor reach any IP by claiming that name in the ClientHello.
We fix it by:
The passthrough chain is now
sni_dynamic_forward_proxythentcp_proxyto a new raw forward-proxy cluster,egress_forward_proxy_passthrough, on the shared egress_dns_cache. The gateway resolves the SNI itself and sends the bytes to it.The CONNECT leg answers the dialed port under dev.ate.egress:dialed_port; the outer chain copies it into envoy.upstream.dynamic_port, shared with the inner listener, which both the SNI filter and the cluster read before their configured port.