area/listenerdesign proposalhelp wanted
Repository metrics
- Stars
- (27,997 stars)
- PR merge metrics
- (平均マージ 8d) (30d で 378 merged PRs)
説明
Currently, listener inspectors and transport sockets are forced to reside at one-level: first inspect, then match, then use a transport socket. This is quite inflexible, and leads to situations where a whole expensive listener is needed (e.g. https://github.com/envoyproxy/envoy/issues/4076). The proposal is to add a oneof that allows (inspectors + filter chains) to reside within the filter chains next to filters. The semantics is that processing is staged where once a filter chain is selected, transport socket is applied, and then inspector + filter chain matching restart.
This solves a bunch of issues:
- Proxy protocol can be placed within TLS on server-side.
- TLS-within-TLS can be matched provided outer TLS is prior knowledge.
- HTTP-within-TLS can be sniffed provided outer TLS is prior knowledge.