transport_socket(http_11_proxy): Add config for default proxy address #42914

tonya11en · 2026-01-08T22:51:13Z

This patch adds an optional config parameter for specifying a default
proxy address to be used by the transport socket if a proxy address is
not found in the filter state metadata. If the parameter is not set,
behavior of the transport socket remains identical to before this patch.

Risk Level: Low. New parameter.
Testing: unit/integration
Docs Changes: config documented
Release Notes: done
Platform Specific Features: n/a

This patch adds an optional config parameter for specifying a default proxy address to be used by the transport socket if a proxy address is not found in the filter state metadata. If the parameter is not set, behavior of the transport socket remains identical to before this patch. Signed-off-by: Tony Allen <[email protected]>

repokitteh-read-only · 2026-01-08T22:51:23Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @adisuissa
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #42914 was opened by tonya11en.

see: more, trace.

api/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto

kyessenov · 2026-01-08T22:59:15Z

envoy/network/transport_socket.h

+  /**
+   * @return the default Http11ProxyInfo if configured, or nullopt.
+   */
+  virtual absl::optional<TransportSocketOptions::Http11ProxyInfo> http11ProxyInfo() const PURE;


OptRef like the above options would probably be better (avoids copy of shared_ptr)

kyessenov · 2026-01-08T23:00:43Z

source/common/upstream/upstream_impl.cc


+  // Proxy address was not found in the metadata. If a default proxy address is set, return that.
+  const auto* proxy_config =
+      dynamic_cast<const Network::Http11ProxyConfiguration*>(&socket_factory);


Hmmm, wouldn't this break with nested factories (e.g. TLS over HTTP CONNECT)?

Something like TLS over HTTP CONNECT would be configured as an http_11_proxy transport socket with a TLS transport socket configured as the inner/wrapped transport, right? The nested factories would have the http_11_proxy TS factory on the outside, so this should still work.

I just checked and the integration test actually uses TLS for the inner transport socket by default, so the inner socket is TLS for the integration test in this patch.

I think it can be the other way: CONNECT inside TLS factory (e.g. HBONE thing from Istio). I think it's OK to accept this limitation, but we should make it clear in the docs.

There should be an easy way to solve it? The config should be loaded into the factory and pass the default that way.

In the xDS representation, the http_11_proxy transport socket is configured with a child, which would be the TLS transport socket. The TLS transport socket does not have a way to configure a child transport socket, so it can't be configured the other way.

I'm not sure how that config maps to the underlying Envoy implementation, though.

@markdroth My concern was about the other way, a TLS socket wrapping HTTP/1.1 PROXY. The dynamic cast would find TLS socket and fail in the previous code iteration.

@markdroth since you started looking, can you own the API review? I think Adi has a lot assigned.
@abeyad I also assigned you as the code owner. The code is mostly OK to me.

What I'm saying is that from the xDS perspective, it's not possible to configure a TLS transport socket wrapping an HTTP/1.1 proxy transport socket -- or any other type of transport socket. There is no way to configure a child transport socket of any type in the TLS transport socket.

Yeah, I'm happy to do the API review.

Ah, sorry, I forgot we didn't add it. s/TLS/TCP stats from https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tcp_stats/v3/tcp_stats.proto.

With the latest patch, shouldn't this be moot? I don't do the cast anymore.

Signed-off-by: Tony Allen <[email protected]>

markdroth

Just a couple of quick drive-by comments from an xDS perspective...

api/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto

markdroth · 2026-01-09T22:34:39Z

source/common/upstream/upstream_impl.cc


+  // Proxy address was not found in the metadata. If a default proxy address is set, return that.
+  const auto* proxy_config =
+      dynamic_cast<const Network::Http11ProxyConfiguration*>(&socket_factory);


In the xDS representation, the http_11_proxy transport socket is configured with a child, which would be the TLS transport socket. The TLS transport socket does not have a way to configure a child transport socket, so it can't be configured the other way.

I'm not sure how that config maps to the underlying Envoy implementation, though.

Signed-off-by: Tony Allen <[email protected]>

kyessenov · 2026-01-09T23:04:09Z

envoy/network/transport_socket.h

+  /**
+   * @return the default Http11ProxyInfo if configured, or nullopt.
+   */
+  virtual OptRef<const TransportSocketOptions::Http11ProxyInfo> http11ProxyInfo() const {


call it defaultHttp11ProxyInfo similar to defaultSNI down below?

Signed-off-by: Tony Allen <[email protected]>

…fault Signed-off-by: Tony Allen <[email protected]>

tonya11en · 2026-01-13T20:10:47Z

/retest

…fault Signed-off-by: Tony Allen <[email protected]>

markdroth

/lgtm api

markdroth · 2026-01-13T22:30:06Z

source/common/upstream/upstream_impl.cc


+  // Proxy address was not found in the metadata. If a default proxy address is set, return that.
+  const auto* proxy_config =
+      dynamic_cast<const Network::Http11ProxyConfiguration*>(&socket_factory);


What I'm saying is that from the xDS perspective, it's not possible to configure a TLS transport socket wrapping an HTTP/1.1 proxy transport socket -- or any other type of transport socket. There is no way to configure a child transport socket of any type in the TLS transport socket.

Yeah, I'm happy to do the API review.

tonya11en · 2026-01-14T00:42:22Z

/retest

adisuissa

/lgtm api

kyessenov · 2026-01-15T21:34:48Z

source/extensions/transport_sockets/http_11_proxy/connect.cc

+    Network::TransportSocketOptions::Http11ProxyInfo actual_info = proxy_info.value();
+    if (actual_info.hostname.empty() && host) {
+      actual_info.hostname = host->hostname().empty() ? host->address()->asStringView()
+                                                      : absl::StrCat(host->hostname(), ":",


port derivation is strange here: it uses endpoint port which doesn't work if it's a gateway (should be stripping :80), and also it defaults to :443 in the alternate case.

tonya11en · 2026-01-15T23:46:06Z

/assign-from @envoyproxy/senior-maintainers

repokitteh-read-only · 2026-01-15T23:46:12Z

@envoyproxy/senior-maintainers assignee is @ggreenway

🐱

Caused by: a #42914 (comment) was created by @tonya11en.

see: more, trace.

repokitteh-read-only bot added the api label Jan 8, 2026

repokitteh-read-only bot assigned adisuissa Jan 8, 2026

tonya11en requested a review from kyessenov January 8, 2026 22:53

kyessenov reviewed Jan 8, 2026

View reviewed changes

api/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto Show resolved Hide resolved

kyessenov reviewed Jan 8, 2026

View reviewed changes

tonya11en added 2 commits January 8, 2026 23:30

kuat comment

e6e4e62

Signed-off-by: Tony Allen <[email protected]>

kuat other comment

8af897d

Signed-off-by: Tony Allen <[email protected]>

markdroth reviewed Jan 9, 2026

View reviewed changes

mark's comment

132ff6e

Signed-off-by: Tony Allen <[email protected]>

kyessenov reviewed Jan 9, 2026

View reviewed changes

tonya11en added 2 commits January 10, 2026 00:10

kuat

470eff1

Signed-off-by: Tony Allen <[email protected]>

Merge remote-tracking branch 'upstream/main' into tallen-http11-ts-de…

ec7f5b0

…fault Signed-off-by: Tony Allen <[email protected]>

Merge remote-tracking branch 'upstream/main' into tallen-http11-ts-de…

b885f34

…fault Signed-off-by: Tony Allen <[email protected]>

kyessenov assigned markdroth and abeyad and unassigned adisuissa Jan 13, 2026

markdroth reviewed Jan 13, 2026

View reviewed changes

repokitteh-read-only bot removed the api label Jan 13, 2026

adisuissa reviewed Jan 14, 2026

View reviewed changes

tonya11en requested a review from kyessenov January 14, 2026 18:32

kyessenov reviewed Jan 15, 2026

View reviewed changes

kyessenov approved these changes Jan 15, 2026

View reviewed changes

repokitteh-read-only bot assigned ggreenway Jan 15, 2026

transport_socket(http_11_proxy): Add config for default proxy address #42914

Are you sure you want to change the base?

transport_socket(http_11_proxy): Add config for default proxy address #42914

Conversation

tonya11en commented Jan 8, 2026

Uh oh!

repokitteh-read-only bot commented Jan 8, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kyessenov Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

markdroth left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tonya11en commented Jan 13, 2026

Uh oh!

markdroth left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tonya11en commented Jan 14, 2026

Uh oh!

adisuissa left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tonya11en commented Jan 15, 2026

Uh oh!

repokitteh-read-only bot commented Jan 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

kyessenov Jan 9, 2026 •

edited

Loading