E2e test non http sdsmint - #1039
Draft
haiyanmeng wants to merge 4 commits into
Draft
Conversation
TestActorEgress and TestActorEgressHTTPS both have the client send the
first bytes, so neither notices an egress path that waits for downstream
data before dialing upstream, or that inspects those first bytes to
route. SSH does not work that way: the server announces itself on
accept.
Add that shape to the egress demo and the networking suite:
- /tcp on the egress demo opens a raw TCP connection and reads before
it writes, so an empty banner really does mean the peer stayed
silent rather than that the probe got the ordering wrong.
- bannerserver is an in-cluster TCP origin that echoes on two ports:
on one it greets on accept, on the other it stays silent until
spoken to. Two ports, because the server has to decide whether to
greet before it has read anything, so nothing in the request could
select the behavior -- only the address dialed can.
- TestActorEgressRawTCP dials both ports through one Actor and
requires, per port, both the CONNECT record and the byte counters on
the gateway's close-time access log, which is what shows the gateway
relayed the payload rather than the Actor having reached the origin
some other way.
- TestActorEgressSSH is the same probe against github.com:22.
The MITM gateway accepted a CONNECT for any destination and then broke everything that was not TLS or cleartext HTTP. Two separate faults, both on mitm_listener: tls_inspector peeks for a ClientHello, so on a server-speaks-first protocol it waited for a client that was itself waiting for the origin's banner. The tunnel opened, nothing crossed it, and the actor eventually timed out. Giving up quickly is the only way out of that: a 1s listener_filters_timeout with continue_on_listener_filters_timeout hands the socket on with no transport protocol detected, which Envoy defaults to raw_buffer. Only connections that send nothing pay the second. The raw_buffer chain was then an HTTP connection manager, so "not TLS" was treated as "cleartext HTTP" and SSH got its first bytes parsed as a request line and dropped, silently. http_inspector now splits raw_buffer again, the cleartext chain is confined to what it actually recognises, and a third chain tcp_proxies the rest. That last chain needs a destination and has no name to resolve: an opaque stream carries no SNI and no Host, and the CONNECT authority is the only place the address appears. proxy_protocol_config on the CONNECT route looks like the answer but is not -- it reports the downstream connection's own addresses, which here is the gateway's :443. Instead set_filter_state records the authority ext_proc just authorized, internal_upstream carries it across the loopback hop, and an ORIGINAL_DST cluster consults that key ahead of everything else. Also drops the route timeout on the CONNECT itself. A tunnel is a session, not a request, and the default 15s was a ceiling on how long an actor could hold any TCP connection open. Nothing here weakens authorization. The passthrough leg cannot name what it carries, but ext_proc has already policed the CONNECT against the same IP:port this chain dials; before, these connections were not blocked, they were accepted and then mangled. TestActorEgressRawTCP and TestActorEgressSSH now pass against the sdsmint gateway, with TestActorEgressHTTP and the sdsmint suite still green. TestActorEgressHTTPS still fails, as it did before: nothing in the cluster trusts the MITM anchor, which is by design and not reachable from Envoy config.
haiyanmeng
marked this pull request as draft
August 18, 2026 14:42
haiyanmeng
force-pushed
the
e2e-test-non-http-sdsmint
branch
from
August 18, 2026 17:27
804913a to
dfd3e4b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #<issue_number_goes_here>