Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add HTTP route filter for setting client IP headers #1817

Draft
wants to merge 7 commits into
base: main
Choose a base branch
from

Conversation

hawkw
Copy link
Contributor

@hawkw hawkw commented Jul 8, 2022

HTTP proxies are often configured to add headers to requests that
contain the IP address of the client that request originated from, such
as Forwarded or X-Forwarded-For. The Linkerd proxy does not
currently set these headers.

Depending on the use case, users may desire different behavior regarding
these headers. For example, the Forwarded header is standardized, but
some software may only support the X-Forwarded-For header, which
predated it. In other cases, users may wish to set additional
Linkerd-specific client IP headers, or to configure whether an
additional header value is added to the existing set of headers or
overwrites any previously present header value. See
linkerd/linkerd2#4219 (comment)
for details on some of the potential configurations. Linkerd has not
previously implemented support for these headers, since there was not an
appropriate mechanism for configuring this behavior.

The Gateway API's HTTPRoute filters provide such a configuration
mechanism. However, the RequestHeaderModifier filter (which is
specified by the Gateway API), is not suitable for these headers, as it
can currently only be configured with fixed header values, and not
dynamic ones (such as the client's IP). Adding some mechanism to this
filter for setting client IP headers would probably be a bad idea, since
it would result in Linkerd implementing additional non-standard
behaviour that may not be supported by other systems that implement the
Gateway API's RequestHeaderModifier filter. Instead, we should add a
new filter specifically for these headers.

This branch introduces a new HTTP route filter type, ClientIpHeaders,
which sets headers based on a request's client address. This filter can
modify multiple headers (for example, both Forwarded and
X-Forwarded-For), and can be configured to either append a new value
to a header, or replace the previous value.

This branch adds the implementation of the filter type for setting
client IP headers and adds it to the inbound HTTP route policy service.
However, it does not add this filter to the proxy API, so the control
plane cannot currently configure proxies to enable this filter. This
will be addressed separately, along with the user-facing aspects of
actually configuring this filter, once the implementation of the filter
itself has been added to the proxy. Therefore, this is part of the
implementation of linkerd/linkerd2#4219, but it does not close that
issue.

hawkw added 7 commits July 8, 2022 13:34
Signed-off-by: Eliza Weisman <[email protected]>
Signed-off-by: Eliza Weisman <[email protected]>
Signed-off-by: Eliza Weisman <[email protected]>
Signed-off-by: Eliza Weisman <[email protected]>
@hawkw hawkw requested a review from a team as a code owner July 8, 2022 21:26
@olix0r olix0r marked this pull request as draft July 12, 2022 21:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant