feat: auto tls sni #1160

buroa · 2024-01-18T17:04:56Z

Closes #541

buroa · 2024-01-18T20:02:52Z

@chungthuang, @sudarshan-reddy Can you check this out & if it makes sense? I have it working on my end, but I don't know if this is the best way to implement it.

Ref: cloudflare/cloudflared#1160 Signed-off-by: Steven Kreitzer <[email protected]>

buroa · 2024-01-22T11:59:42Z

Maybe @joliveirinha?

buroa · 2024-03-19T16:42:58Z

@jcsf Can you help?

jcsf · 2024-03-19T18:06:40Z

@jcsf Can you help?

Took a look didn't saw anything strange. Let me just discuss this with the team so that we can be sure that this can be merged. Will try to get back to you as soon as possible.

jcsf

Removing the approval to avoid accidental merge

buroa · 2024-03-21T16:13:18Z

Thanks @jcsf for taking a look here, greatly appreciate it! :-)

jcsf · 2024-03-21T17:32:10Z

@buroa Can you rename the configuration from autoOriginServerName to matchSNItoHost and remove the command line argument? we are no longer adding command line arguments for ingress rules, we are only allowing it in the configuration file.

buroa · 2024-03-21T17:57:40Z

@buroa Can you rename the configuration from autoOriginServerName to matchSNItoHost and remove the command line argument? we are no longer adding command line arguments for ingress rules, we are only allowing it in the configuration file.

Done!

owenhaynes · 2024-03-26T15:24:55Z

This would be handy to merge and a release for.

buroa · 2024-04-02T15:42:30Z

@jcsf Any update?

DevinCarr · 2024-04-02T15:44:21Z

@jcsf is currently busy, but we hope to be able to review this by the end of the week.

DevinCarr · 2024-04-02T16:41:50Z

Looks like you will need to make the following changes to this branch to correct the tests:

diff --git a/ingress/rule_test.go b/ingress/rule_test.go
index 1a46f155..a3d12e01 100644
--- a/ingress/rule_test.go
+++ b/ingress/rule_test.go
@@ -204,25 +204,25 @@ func TestMarshalJSON(t *testing.T) {
                {
                        name:     "Nil",
                        path:     nil,
-                       expected: `{"hostname":"example.com","path":null,"service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
+                       expected: `{"hostname":"example.com","path":null,"service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","matchSNItoHost":false,"caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
                        want:     true,
                },
                {
                        name:     "Nil regex",
                        path:     &Regexp{Regexp: nil},
-                       expected: `{"hostname":"example.com","path":null,"service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
+                       expected: `{"hostname":"example.com","path":null,"service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","matchSNItoHost":false,"caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
                        want:     true,
                },
                {
                        name:     "Empty",
                        path:     &Regexp{Regexp: regexp.MustCompile("")},
-                       expected: `{"hostname":"example.com","path":"","service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
+                       expected: `{"hostname":"example.com","path":"","service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","matchSNItoHost":false,"caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
                        want:     true,
                },
                {
                        name:     "Basic",
                        path:     &Regexp{Regexp: regexp.MustCompile("/echo")},
-                       expected: `{"hostname":"example.com","path":"/echo","service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
+                       expected: `{"hostname":"example.com","path":"/echo","service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","matchSNItoHost":false,"caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
                        want:     true,
                },
        }

Signed-off-by: Steven Kreitzer <[email protected]>

buroa · 2024-04-02T16:54:11Z

Looks like you will need to make the following changes to this branch to correct the tests:

diff --git a/ingress/rule_test.go b/ingress/rule_test.go
index 1a46f155..a3d12e01 100644
--- a/ingress/rule_test.go
+++ b/ingress/rule_test.go
@@ -204,25 +204,25 @@ func TestMarshalJSON(t *testing.T) {
                {
                        name:     "Nil",
                        path:     nil,
-                       expected: `{"hostname":"example.com","path":null,"service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
+                       expected: `{"hostname":"example.com","path":null,"service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","matchSNItoHost":false,"caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
                        want:     true,
                },
                {
                        name:     "Nil regex",
                        path:     &Regexp{Regexp: nil},
-                       expected: `{"hostname":"example.com","path":null,"service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
+                       expected: `{"hostname":"example.com","path":null,"service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","matchSNItoHost":false,"caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
                        want:     true,
                },
                {
                        name:     "Empty",
                        path:     &Regexp{Regexp: regexp.MustCompile("")},
-                       expected: `{"hostname":"example.com","path":"","service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
+                       expected: `{"hostname":"example.com","path":"","service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","matchSNItoHost":false,"caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
                        want:     true,
                },
                {
                        name:     "Basic",
                        path:     &Regexp{Regexp: regexp.MustCompile("/echo")},
-                       expected: `{"hostname":"example.com","path":"/echo","service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
+                       expected: `{"hostname":"example.com","path":"/echo","service":"https://localhost:8000","Handlers":null,"originRequest":{"connectTimeout":30,"tlsTimeout":10,"tcpKeepAlive":30,"noHappyEyeballs":false,"keepAliveTimeout":90,"keepAliveConnections":100,"httpHostHeader":"","originServerName":"","matchSNItoHost":false,"caPool":"","noTLSVerify":false,"disableChunkedEncoding":false,"bastionMode":false,"proxyAddress":"127.0.0.1","proxyPort":0,"proxyType":"","ipRules":null,"http2Origin":false,"access":{"teamName":"","audTag":null}}}`,
                        want:     true,
                },
        }

Done :)

buroa · 2024-04-03T10:54:56Z

Thanks for the merge @DevinCarr & @jcsf 🧡

DevinCarr · 2024-04-03T15:45:14Z

Thank you for the contribution!

jcsf · 2024-04-10T13:47:16Z

This has been released on version 2024.4.0

buroa force-pushed the master branch 2 times, most recently from c0b8c50 to baf9216 Compare January 18, 2024 17:41

buroa added a commit to buroa/k8s-gitops that referenced this pull request Jan 18, 2024

feat(cloudflared): use auto sni image

2d3fb16

Ref: cloudflare/cloudflared#1160 Signed-off-by: Steven Kreitzer <[email protected]>

buroa force-pushed the master branch from baf9216 to 0c10728 Compare January 18, 2024 22:29

buroa changed the title ~~feat: set auto sni~~ feat: auto tls sni Jan 18, 2024

jcsf requested review from jcsf, joliveirinha, DevinCarr and chungthuang March 21, 2024 15:49

jcsf approved these changes Mar 21, 2024

View reviewed changes

jcsf self-requested a review March 21, 2024 15:54

jcsf requested changes Mar 21, 2024

View reviewed changes

jcsf self-requested a review March 21, 2024 15:56

buroa force-pushed the master branch from 0c10728 to ca5710d Compare March 21, 2024 17:56

feat: auto tls sni

d91a1be

Signed-off-by: Steven Kreitzer <[email protected]>

buroa force-pushed the master branch from ca5710d to d91a1be Compare April 2, 2024 16:53

DevinCarr merged commit b5be8a6 into cloudflare:master Apr 2, 2024
3 of 4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: auto tls sni #1160

feat: auto tls sni #1160

buroa commented Jan 18, 2024

buroa commented Jan 18, 2024

buroa commented Jan 22, 2024

buroa commented Mar 19, 2024

jcsf commented Mar 19, 2024

jcsf left a comment

buroa commented Mar 21, 2024

jcsf commented Mar 21, 2024

buroa commented Mar 21, 2024

owenhaynes commented Mar 26, 2024

buroa commented Apr 2, 2024

DevinCarr commented Apr 2, 2024

DevinCarr commented Apr 2, 2024

buroa commented Apr 2, 2024

buroa commented Apr 3, 2024

DevinCarr commented Apr 3, 2024

jcsf commented Apr 10, 2024

feat: auto tls sni #1160

feat: auto tls sni #1160

Conversation

buroa commented Jan 18, 2024

buroa commented Jan 18, 2024

buroa commented Jan 22, 2024

buroa commented Mar 19, 2024

jcsf commented Mar 19, 2024

jcsf left a comment

Choose a reason for hiding this comment

buroa commented Mar 21, 2024

jcsf commented Mar 21, 2024

buroa commented Mar 21, 2024

owenhaynes commented Mar 26, 2024

buroa commented Apr 2, 2024

DevinCarr commented Apr 2, 2024

DevinCarr commented Apr 2, 2024

buroa commented Apr 2, 2024

buroa commented Apr 3, 2024

DevinCarr commented Apr 3, 2024

jcsf commented Apr 10, 2024