Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ability to disable Envoy adding server headers to responses #4906

Merged
merged 17 commits into from
Jan 23, 2023
Merged

Ability to disable Envoy adding server headers to responses #4906

Show file tree
Hide file tree
Changes from 16 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
487bd4c
WIP
vishal-chdhry Dec 7, 2022
7613b45
NIT
vishal-chdhry Dec 7, 2022
d779ee5
NIT
vishal-chdhry Dec 23, 2022
73fc2eb
Merge branch 'main' into disable-envoy-adding-server
vishal-chdhry Jan 14, 2023
5e3b212
changed server header transformation to enum
vishal-chdhry Jan 14, 2023
8b8aa12
wrote serverHeaderTransformationType
vishal-chdhry Jan 19, 2023
0af9fc9
added serverHeaderTransformation to config file
vishal-chdhry Jan 19, 2023
b12cce2
added changelog
vishal-chdhry Jan 19, 2023
7022e23
changed serverheader transform type to string
vishal-chdhry Jan 20, 2023
00ec3ec
NIT
vishal-chdhry Jan 20, 2023
965212c
tests
vishal-chdhry Jan 20, 2023
6635ef4
test changes
vishal-chdhry Jan 21, 2023
48f434e
Merge branch 'main' of https://github.com/projectcontour/contour into…
vishal-chdhry Jan 21, 2023
48b5224
make generate
vishal-chdhry Jan 21, 2023
f74bb55
fix unit test failures
skriss Jan 23, 2023
b7cf999
lowercase field values
skriss Jan 23, 2023
147e890
docs updates
skriss Jan 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions apis/projectcontour/v1alpha1/contourconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -336,6 +336,18 @@ type EnvoyListenerConfig struct {
// +optional
DisableMergeSlashes *bool `json:"disableMergeSlashes,omitempty"`

// Defines the action to be applied to the Server header on the response path
// When configured as overwrite, overwrites any Server header with the contents of server_name.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in this section probably replace server_name with envoy? since we don't make it configurable (i think this was copied from the envoy docs)

// When configured as append_if_absent, ⁣If no Server header is present, append Server server_name If a Server header is present, pass it through.
// When configured as pass_through, pPass through the value of the server header, and do not append a header if none is present.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// When configured as pass_through, pPass through the value of the server header, and do not append a header if none is present.
// When configured as pass_through, pass through the value of the server header, and do not append a header if none is present.

//
// Values: `overwrite` (default), `append_if_absent`, `pass_through`
//
// Other values will produce an error.
// Contour's default is overwrite.
// +optional
ServerHeaderTransformation ServerHeaderTransformationType `json:"serverHeaderTransformation,omitempty"`

// ConnectionBalancer. If the value is exact, the listener will use the exact connection balancer
// See https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/listener.proto#envoy-api-msg-listener-connectionbalanceconfig
// for more information.
Expand Down Expand Up @@ -532,6 +544,21 @@ const (
AllClusterDNSFamily ClusterDNSFamilyType = "all"
)

// ServerHeaderTransformation defines the action to be applied to the Server header on the response path
type ServerHeaderTransformationType string

const (
// Overwrite any Server header with the contents of server_name.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe similar here with server_name

// This is the default value
OverwriteServerHeader ServerHeaderTransformationType = "overwrite"
// If no Server header is present, append Server server_name
// If a Server header is present, pass it through.
AppendIfAbsentServerHeader ServerHeaderTransformationType = "append_if_absent"
// Pass through the value of the server header, and do not append a header
// if none is present.
PassThroughServerHeader ServerHeaderTransformationType = "pass_through"
)

// ClusterParameters holds various configurable cluster values.
type ClusterParameters struct {
// DNSLookupFamily defines how external names are looked up
Expand Down
6 changes: 6 additions & 0 deletions changelogs/unreleased/4906-Vishal-Chdhry-minor.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
## Enable configuring Server header transformation

Envoy's treatment of the Server header on responses can now be configured in the Contour config file or ContourConfiguration CRD.
When configured as `overwrite`, Envoy overwrites any Server header with "envoy".
When configured as `append_if_absent`, ⁣if a Server header is present, Envoy will pass it through, otherwise, it will set it to "envoy".
When configured as `pass_through`, Envoy passes through the value of the Server header and does not append a header if none is present.
1 change: 1 addition & 0 deletions cmd/contour/serve.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,6 +348,7 @@ func (s *Server) doServe() error {
DefaultHTTPVersions: parseDefaultHTTPVersions(contourConfiguration.Envoy.DefaultHTTPVersions),
AllowChunkedLength: !*contourConfiguration.Envoy.Listener.DisableAllowChunkedLength,
MergeSlashes: !*contourConfiguration.Envoy.Listener.DisableMergeSlashes,
ServerHeaderTransformation: contourConfiguration.Envoy.Listener.ServerHeaderTransformation,
XffNumTrustedHops: *contourConfiguration.Envoy.Network.XffNumTrustedHops,
ConnectionBalancer: contourConfiguration.Envoy.Listener.ConnectionBalancer,
}
Expand Down
19 changes: 15 additions & 4 deletions cmd/contour/servecontext.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -378,6 +378,16 @@ func (ctx *serveContext) convertToContourConfigurationSpec() contour_api_v1alpha
}
}

var serverHeaderTransformation contour_api_v1alpha1.ServerHeaderTransformationType
switch ctx.Config.ServerHeaderTransformation {
case config.OverwriteServerHeader:
serverHeaderTransformation = contour_api_v1alpha1.OverwriteServerHeader
case config.AppendIfAbsentServerHeader:
serverHeaderTransformation = contour_api_v1alpha1.AppendIfAbsentServerHeader
case config.PassThroughServerHeader:
serverHeaderTransformation = contour_api_v1alpha1.PassThroughServerHeader
}

policy := &contour_api_v1alpha1.PolicyConfig{
RequestHeadersPolicy: &contour_api_v1alpha1.HeadersPolicy{
Set: ctx.Config.Policy.RequestHeadersPolicy.Set,
Expand Down Expand Up @@ -439,10 +449,11 @@ func (ctx *serveContext) convertToContourConfigurationSpec() contour_api_v1alpha
},
Envoy: &contour_api_v1alpha1.EnvoyConfig{
Listener: &contour_api_v1alpha1.EnvoyListenerConfig{
UseProxyProto: &ctx.useProxyProto,
DisableAllowChunkedLength: &ctx.Config.DisableAllowChunkedLength,
DisableMergeSlashes: &ctx.Config.DisableMergeSlashes,
ConnectionBalancer: ctx.Config.Listener.ConnectionBalancer,
UseProxyProto: &ctx.useProxyProto,
DisableAllowChunkedLength: &ctx.Config.DisableAllowChunkedLength,
DisableMergeSlashes: &ctx.Config.DisableMergeSlashes,
ServerHeaderTransformation: serverHeaderTransformation,
ConnectionBalancer: ctx.Config.Listener.ConnectionBalancer,
TLS: &contour_api_v1alpha1.EnvoyTLS{
MinimumProtocolVersion: ctx.Config.TLS.MinimumProtocolVersion,
CipherSuites: cipherSuites,
Expand Down
17 changes: 14 additions & 3 deletions cmd/contour/servecontext_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -406,9 +406,10 @@ func TestConvertServeContext(t *testing.T) {
Namespace: "projectcontour",
},
Listener: &contour_api_v1alpha1.EnvoyListenerConfig{
UseProxyProto: ref.To(false),
DisableAllowChunkedLength: ref.To(false),
DisableMergeSlashes: ref.To(false),
UseProxyProto: ref.To(false),
DisableAllowChunkedLength: ref.To(false),
DisableMergeSlashes: ref.To(false),
ServerHeaderTransformation: contour_api_v1alpha1.OverwriteServerHeader,
TLS: &contour_api_v1alpha1.EnvoyTLS{
MinimumProtocolVersion: "",
},
Expand Down Expand Up @@ -688,6 +689,16 @@ func TestConvertServeContext(t *testing.T) {
return cfg
},
},
"server header transformation": {
getServeContext: func(ctx *serveContext) *serveContext {
ctx.Config.ServerHeaderTransformation = config.AppendIfAbsentServerHeader
return ctx
},
getContourConfiguration: func(cfg contour_api_v1alpha1.ContourConfigurationSpec) contour_api_v1alpha1.ContourConfigurationSpec {
cfg.Envoy.Listener.ServerHeaderTransformation = contour_api_v1alpha1.AppendIfAbsentServerHeader
return cfg
},
},
}

for name, tc := range cases {
Expand Down
25 changes: 25 additions & 0 deletions examples/contour/01-crds.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,18 @@ spec:
slashes from request URL paths. \n Contour's default is
false."
type: boolean
serverHeaderTransformation:
description: "Defines the action to be applied to the Server
header on the response path When configured as overwrite,
overwrites any Server header with the contents of server_name.
When configured as append_if_absent, ⁣If no Server header
is present, append Server server_name If a Server header
is present, pass it through. When configured as pass_through,
pPass through the value of the server header, and do not
append a header if none is present. \n Values: `overwrite`
(default), `append_if_absent`, `pass_through` \n Other values
will produce an error. Contour's default is overwrite."
type: string
tls:
description: TLS holds various configurable Envoy TLS listener
values.
Expand Down Expand Up @@ -3184,6 +3196,19 @@ spec:
duplicate slashes from request URL paths. \n Contour's
default is false."
type: boolean
serverHeaderTransformation:
description: "Defines the action to be applied to the
Server header on the response path When configured as
overwrite, overwrites any Server header with the contents
of server_name. When configured as append_if_absent,
⁣If no Server header is present, append Server server_name
If a Server header is present, pass it through. When
configured as pass_through, pPass through the value
of the server header, and do not append a header if
none is present. \n Values: `overwrite` (default), `append_if_absent`,
`pass_through` \n Other values will produce an error.
Contour's default is overwrite."
type: string
tls:
description: TLS holds various configurable Envoy TLS
listener values.
Expand Down
25 changes: 25 additions & 0 deletions examples/render/contour-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -394,6 +394,18 @@ spec:
slashes from request URL paths. \n Contour's default is
false."
type: boolean
serverHeaderTransformation:
description: "Defines the action to be applied to the Server
header on the response path When configured as overwrite,
overwrites any Server header with the contents of server_name.
When configured as append_if_absent, ⁣If no Server header
is present, append Server server_name If a Server header
is present, pass it through. When configured as pass_through,
pPass through the value of the server header, and do not
append a header if none is present. \n Values: `overwrite`
(default), `append_if_absent`, `pass_through` \n Other values
will produce an error. Contour's default is overwrite."
type: string
tls:
description: TLS holds various configurable Envoy TLS listener
values.
Expand Down Expand Up @@ -3397,6 +3409,19 @@ spec:
duplicate slashes from request URL paths. \n Contour's
default is false."
type: boolean
serverHeaderTransformation:
description: "Defines the action to be applied to the
Server header on the response path When configured as
overwrite, overwrites any Server header with the contents
of server_name. When configured as append_if_absent,
⁣If no Server header is present, append Server server_name
If a Server header is present, pass it through. When
configured as pass_through, pPass through the value
of the server header, and do not append a header if
none is present. \n Values: `overwrite` (default), `append_if_absent`,
`pass_through` \n Other values will produce an error.
Contour's default is overwrite."
type: string
tls:
description: TLS holds various configurable Envoy TLS
listener values.
Expand Down
25 changes: 25 additions & 0 deletions examples/render/contour-gateway-provisioner.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,18 @@ spec:
slashes from request URL paths. \n Contour's default is
false."
type: boolean
serverHeaderTransformation:
description: "Defines the action to be applied to the Server
header on the response path When configured as overwrite,
overwrites any Server header with the contents of server_name.
When configured as append_if_absent, ⁣If no Server header
is present, append Server server_name If a Server header
is present, pass it through. When configured as pass_through,
pPass through the value of the server header, and do not
append a header if none is present. \n Values: `overwrite`
(default), `append_if_absent`, `pass_through` \n Other values
will produce an error. Contour's default is overwrite."
type: string
tls:
description: TLS holds various configurable Envoy TLS listener
values.
Expand Down Expand Up @@ -3198,6 +3210,19 @@ spec:
duplicate slashes from request URL paths. \n Contour's
default is false."
type: boolean
serverHeaderTransformation:
description: "Defines the action to be applied to the
Server header on the response path When configured as
overwrite, overwrites any Server header with the contents
of server_name. When configured as append_if_absent,
⁣If no Server header is present, append Server server_name
If a Server header is present, pass it through. When
configured as pass_through, pPass through the value
of the server header, and do not append a header if
none is present. \n Values: `overwrite` (default), `append_if_absent`,
`pass_through` \n Other values will produce an error.
Contour's default is overwrite."
type: string
tls:
description: TLS holds various configurable Envoy TLS
listener values.
Expand Down
25 changes: 25 additions & 0 deletions examples/render/contour-gateway.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -400,6 +400,18 @@ spec:
slashes from request URL paths. \n Contour's default is
false."
type: boolean
serverHeaderTransformation:
description: "Defines the action to be applied to the Server
header on the response path When configured as overwrite,
overwrites any Server header with the contents of server_name.
When configured as append_if_absent, ⁣If no Server header
is present, append Server server_name If a Server header
is present, pass it through. When configured as pass_through,
pPass through the value of the server header, and do not
append a header if none is present. \n Values: `overwrite`
(default), `append_if_absent`, `pass_through` \n Other values
will produce an error. Contour's default is overwrite."
type: string
tls:
description: TLS holds various configurable Envoy TLS listener
values.
Expand Down Expand Up @@ -3403,6 +3415,19 @@ spec:
duplicate slashes from request URL paths. \n Contour's
default is false."
type: boolean
serverHeaderTransformation:
description: "Defines the action to be applied to the
Server header on the response path When configured as
overwrite, overwrites any Server header with the contents
of server_name. When configured as append_if_absent,
⁣If no Server header is present, append Server server_name
If a Server header is present, pass it through. When
configured as pass_through, pPass through the value
of the server header, and do not append a header if
none is present. \n Values: `overwrite` (default), `append_if_absent`,
`pass_through` \n Other values will produce an error.
Contour's default is overwrite."
type: string
tls:
description: TLS holds various configurable Envoy TLS
listener values.
Expand Down
25 changes: 25 additions & 0 deletions examples/render/contour.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -394,6 +394,18 @@ spec:
slashes from request URL paths. \n Contour's default is
false."
type: boolean
serverHeaderTransformation:
description: "Defines the action to be applied to the Server
header on the response path When configured as overwrite,
overwrites any Server header with the contents of server_name.
When configured as append_if_absent, ⁣If no Server header
is present, append Server server_name If a Server header
is present, pass it through. When configured as pass_through,
pPass through the value of the server header, and do not
append a header if none is present. \n Values: `overwrite`
(default), `append_if_absent`, `pass_through` \n Other values
will produce an error. Contour's default is overwrite."
type: string
tls:
description: TLS holds various configurable Envoy TLS listener
values.
Expand Down Expand Up @@ -3397,6 +3409,19 @@ spec:
duplicate slashes from request URL paths. \n Contour's
default is false."
type: boolean
serverHeaderTransformation:
description: "Defines the action to be applied to the
Server header on the response path When configured as
overwrite, overwrites any Server header with the contents
of server_name. When configured as append_if_absent,
⁣If no Server header is present, append Server server_name
If a Server header is present, pass it through. When
configured as pass_through, pPass through the value
of the server header, and do not append a header if
none is present. \n Values: `overwrite` (default), `append_if_absent`,
`pass_through` \n Other values will produce an error.
Contour's default is overwrite."
type: string
tls:
description: TLS holds various configurable Envoy TLS
listener values.
Expand Down
9 changes: 5 additions & 4 deletions internal/contourconfig/contourconfiguration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,10 +74,11 @@ func Defaults() contour_api_v1alpha1.ContourConfigurationSpec {
},
Envoy: &contour_api_v1alpha1.EnvoyConfig{
Listener: &contour_api_v1alpha1.EnvoyListenerConfig{
UseProxyProto: ref.To(false),
DisableAllowChunkedLength: ref.To(false),
DisableMergeSlashes: ref.To(false),
ConnectionBalancer: "",
UseProxyProto: ref.To(false),
DisableAllowChunkedLength: ref.To(false),
DisableMergeSlashes: ref.To(false),
ServerHeaderTransformation: contour_api_v1alpha1.OverwriteServerHeader,
ConnectionBalancer: "",
TLS: &contour_api_v1alpha1.EnvoyTLS{
MinimumProtocolVersion: "1.2",
CipherSuites: contour_api_v1alpha1.DefaultTLSCiphers,
Expand Down
Loading