Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ability to disable Envoy adding server headers to responses #4906

Merged
merged 17 commits into from
Jan 23, 2023
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
changed server header transformation to enum
Signed-off-by: Vishal Choudhary <[email protected]>
vishal-chdhry committed Jan 14, 2023
commit 5e3b212a990ee7d52a744291e19ad4cd97af6e43
8 changes: 4 additions & 4 deletions apis/projectcontour/v1alpha1/contourconfig.go
Original file line number Diff line number Diff line change
@@ -16,6 +16,7 @@ package v1alpha1
import (
contour_api_v1 "github.com/projectcontour/contour/apis/projectcontour/v1"

http "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

@@ -337,12 +338,11 @@ type EnvoyListenerConfig struct {
DisableMergeSlashes *bool `json:"disableMergeSlashes,omitempty"`

// DisableServerHeaderTransformation signifies Envoy will not modify the Server header.
// false: OVERWRITE
// true: PASS_THROUGH
// It has 3 possible values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT
//
// Contour's default is false.
// Contour's default is OVERWRITE.
// +optional
DisableServerHeaderTransformation *bool `json:"disableServerHeaderTransformation,omitempty"`
DisableServerHeaderTransformation *http.HttpConnectionManager_ServerHeaderTransformation `json:"disableServerHeaderTransformation,omitempty"`
vishal-chdhry marked this conversation as resolved.
Show resolved Hide resolved
vishal-chdhry marked this conversation as resolved.
Show resolved Hide resolved

// ConnectionBalancer. If the value is exact, the listener will use the exact connection balancer
// See https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/listener.proto#envoy-api-msg-listener-connectionbalanceconfig
3 changes: 2 additions & 1 deletion apis/projectcontour/v1alpha1/zz_generated.deepcopy.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion cmd/contour/serve.go
Original file line number Diff line number Diff line change
@@ -348,7 +348,7 @@ func (s *Server) doServe() error {
DefaultHTTPVersions: parseDefaultHTTPVersions(contourConfiguration.Envoy.DefaultHTTPVersions),
AllowChunkedLength: !*contourConfiguration.Envoy.Listener.DisableAllowChunkedLength,
MergeSlashes: !*contourConfiguration.Envoy.Listener.DisableMergeSlashes,
ServerHeaderTransformation: !*contourConfiguration.Envoy.Listener.DisableServerHeaderTransformation,
ServerHeaderTransformation: *contourConfiguration.Envoy.Listener.DisableServerHeaderTransformation,
XffNumTrustedHops: *contourConfiguration.Envoy.Network.XffNumTrustedHops,
ConnectionBalancer: contourConfiguration.Envoy.Listener.ConnectionBalancer,
}
24 changes: 14 additions & 10 deletions examples/contour/01-crds.yaml
Original file line number Diff line number Diff line change
@@ -159,11 +159,6 @@ spec:
description: Listener hold various configurable Envoy listener
values.
properties:
DisableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
we will not modify the Server header. false: OVERWRITE true:\tPASS_THROUGH
\n Contour's default is false."
type: boolean
connectionBalancer:
description: "ConnectionBalancer. If the value is exact, the
listener will use the exact connection balancer See https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/listener.proto#envoy-api-msg-listener-connectionbalanceconfig
@@ -186,6 +181,13 @@ spec:
slashes from request URL paths. \n Contour's default is
false."
type: boolean
disableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
Envoy will not modify the Server header. It has 3 possible
values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT \n Contour's
default is OVERWRITE."
format: int32
type: integer
tls:
description: TLS holds various configurable Envoy TLS listener
values.
@@ -3158,11 +3160,6 @@ spec:
description: Listener hold various configurable Envoy listener
values.
properties:
DisableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
we will not modify the Server header. false: OVERWRITE
true:\tPASS_THROUGH \n Contour's default is false."
type: boolean
connectionBalancer:
description: "ConnectionBalancer. If the value is exact,
the listener will use the exact connection balancer
@@ -3187,6 +3184,13 @@ spec:
duplicate slashes from request URL paths. \n Contour's
default is false."
type: boolean
disableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
Envoy will not modify the Server header. It has 3 possible
values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT \n
Contour's default is OVERWRITE."
format: int32
type: integer
tls:
description: TLS holds various configurable Envoy TLS
listener values.
14 changes: 14 additions & 0 deletions examples/render/contour-deployment.yaml
Original file line number Diff line number Diff line change
@@ -394,6 +394,13 @@ spec:
slashes from request URL paths. \n Contour's default is
false."
type: boolean
disableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
Envoy will not modify the Server header. It has 3 possible
values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT \n Contour's
default is OVERWRITE."
format: int32
type: integer
tls:
description: TLS holds various configurable Envoy TLS listener
values.
@@ -3390,6 +3397,13 @@ spec:
duplicate slashes from request URL paths. \n Contour's
default is false."
type: boolean
disableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
Envoy will not modify the Server header. It has 3 possible
values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT \n
Contour's default is OVERWRITE."
format: int32
type: integer
tls:
description: TLS holds various configurable Envoy TLS
listener values.
14 changes: 14 additions & 0 deletions examples/render/contour-gateway-provisioner.yaml
Original file line number Diff line number Diff line change
@@ -195,6 +195,13 @@ spec:
slashes from request URL paths. \n Contour's default is
false."
type: boolean
disableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
Envoy will not modify the Server header. It has 3 possible
values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT \n Contour's
default is OVERWRITE."
format: int32
type: integer
tls:
description: TLS holds various configurable Envoy TLS listener
values.
@@ -3191,6 +3198,13 @@ spec:
duplicate slashes from request URL paths. \n Contour's
default is false."
type: boolean
disableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
Envoy will not modify the Server header. It has 3 possible
values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT \n
Contour's default is OVERWRITE."
format: int32
type: integer
tls:
description: TLS holds various configurable Envoy TLS
listener values.
14 changes: 14 additions & 0 deletions examples/render/contour-gateway.yaml
Original file line number Diff line number Diff line change
@@ -400,6 +400,13 @@ spec:
slashes from request URL paths. \n Contour's default is
false."
type: boolean
disableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
Envoy will not modify the Server header. It has 3 possible
values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT \n Contour's
default is OVERWRITE."
format: int32
type: integer
tls:
description: TLS holds various configurable Envoy TLS listener
values.
@@ -3396,6 +3403,13 @@ spec:
duplicate slashes from request URL paths. \n Contour's
default is false."
type: boolean
disableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
Envoy will not modify the Server header. It has 3 possible
values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT \n
Contour's default is OVERWRITE."
format: int32
type: integer
tls:
description: TLS holds various configurable Envoy TLS
listener values.
14 changes: 14 additions & 0 deletions examples/render/contour.yaml
Original file line number Diff line number Diff line change
@@ -394,6 +394,13 @@ spec:
slashes from request URL paths. \n Contour's default is
false."
type: boolean
disableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
Envoy will not modify the Server header. It has 3 possible
values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT \n Contour's
default is OVERWRITE."
format: int32
type: integer
tls:
description: TLS holds various configurable Envoy TLS listener
values.
@@ -3390,6 +3397,13 @@ spec:
duplicate slashes from request URL paths. \n Contour's
default is false."
type: boolean
disableServerHeaderTransformation:
description: "DisableServerHeaderTransformation signifies
Envoy will not modify the Server header. It has 3 possible
values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT \n
Contour's default is OVERWRITE."
format: int32
type: integer
tls:
description: TLS holds various configurable Envoy TLS
listener values.
8 changes: 2 additions & 6 deletions internal/envoy/v3/listener.go
Original file line number Diff line number Diff line change
@@ -242,12 +242,8 @@ func (b *httpConnectionManagerBuilder) MergeSlashes(enabled bool) *httpConnectio
return b
}

func (b *httpConnectionManagerBuilder) ServerHeaderTransformation(enabled bool) *httpConnectionManagerBuilder {
tserverHeaderTransformation := http.HttpConnectionManager_OVERWRITE
if enabled {
tserverHeaderTransformation = http.HttpConnectionManager_PASS_THROUGH
}
b.serverHeaderTransformation = tserverHeaderTransformation
func (b *httpConnectionManagerBuilder) ServerHeaderTransformation(value http.HttpConnectionManager_ServerHeaderTransformation) *httpConnectionManagerBuilder {
b.serverHeaderTransformation = value
return b
}

2 changes: 1 addition & 1 deletion internal/xdscache/v3/listener.go
Original file line number Diff line number Diff line change
@@ -126,7 +126,7 @@ type ListenerConfig struct {
MergeSlashes bool

// ServerHeaderTransformation signifies we will not modify the Server header.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update godoc to reflect enum nature

Copy link
Member

@skriss skriss Jan 20, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// ServerHeaderTransformation signifies we will not modify the Server header.
// ServerHeaderTransformation defines the action to be applied to the Server header on the response path.

ServerHeaderTransformation bool
ServerHeaderTransformation http.HttpConnectionManager_ServerHeaderTransformation

// XffNumTrustedHops sets the number of additional ingress proxy hops from the
// right side of the x-forwarded-for HTTP header to trust.
5 changes: 3 additions & 2 deletions pkg/config/parameters.go
Original file line number Diff line number Diff line change
@@ -22,6 +22,7 @@ import (
"strings"
"time"

http "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
contour_api_v1alpha1 "github.com/projectcontour/contour/apis/projectcontour/v1alpha1"
"gopkg.in/yaml.v3"
"k8s.io/apimachinery/pkg/util/validation"
@@ -490,7 +491,7 @@ type Parameters struct {
DisableMergeSlashes bool `yaml:"disableMergeSlashes,omitempty"`

// DisableServerHeaderTransformation signifies Envoy will not modify the Server header.
DisableServerHeaderTransformation bool `yaml:"disableServerHeaderTransformation,omitempty"`
DisableServerHeaderTransformation http.HttpConnectionManager_ServerHeaderTransformation `yaml:"disableServerHeaderTransformation,omitempty"`
vishal-chdhry marked this conversation as resolved.
Show resolved Hide resolved
vishal-chdhry marked this conversation as resolved.
Show resolved Hide resolved

// EnableExternalNameService allows processing of ExternalNameServices
// Defaults to disabled for security reasons.
@@ -705,7 +706,7 @@ func Defaults() Parameters {
DisablePermitInsecure: false,
DisableAllowChunkedLength: false,
DisableMergeSlashes: false,
DisableServerHeaderTransformation: false,
DisableServerHeaderTransformation: http.HttpConnectionManager_OVERWRITE,
Timeouts: TimeoutParameters{
// This is chosen as a rough default to stop idle connections wasting resources,
// without stopping slow connections from being terminated too quickly.
15 changes: 15 additions & 0 deletions site/content/docs/main/config/api-reference.html
Original file line number Diff line number Diff line change
@@ -5928,6 +5928,21 @@ <h3 id="projectcontour.io/v1alpha1.EnvoyListenerConfig">EnvoyListenerConfig
</tr>
<tr>
<td style="white-space:nowrap">
<code>disableServerHeaderTransformation</code>
<br>
<em>
github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3.HttpConnectionManager_ServerHeaderTransformation
</em>
</td>
<td>
<em>(Optional)</em>
<p>DisableServerHeaderTransformation signifies Envoy will not modify the Server header.
It has 3 possible values: OVERWRITE, PASS_THROUGH, APPEND_IF_ABSENT</p>
<p>Contour&rsquo;s default is OVERWRITE.</p>
</td>
</tr>
<tr>
<td style="white-space:nowrap">
<code>connectionBalancer</code>
<br>
<em>