area/listenerdesign proposalhelp wanted
Repository-Metriken
- Stars
- (27.997 Stars)
- PR-Merge-Metriken
- (Durchschn. Merge 8T) (378 gemergte PRs in 30 T)
Beschreibung
Currently, listener inspectors and transport sockets are forced to reside at one-level: first inspect, then match, then use a transport socket. This is quite inflexible, and leads to situations where a whole expensive listener is needed (e.g. https://github.com/envoyproxy/envoy/issues/4076). The proposal is to add a oneof that allows (inspectors + filter chains) to reside within the filter chains next to filters. The semantics is that processing is staged where once a filter chain is selected, transport socket is applied, and then inspector + filter chain matching restart.
This solves a bunch of issues:
- Proxy protocol can be placed within TLS on server-side.
- TLS-within-TLS can be matched provided outer TLS is prior knowledge.
- HTTP-within-TLS can be sniffed provided outer TLS is prior knowledge.