Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tls: add DetectSni middleware #3199

Merged
merged 6 commits into from
Sep 25, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
107 changes: 107 additions & 0 deletions linkerd/tls/src/detect_sni.rs
Original file line number Diff line number Diff line change
@@ -0,0 +1,107 @@
use crate::{
server::{detect_sni, DetectIo, Timeout},
ServerName,
};
use linkerd_error::Error;
use linkerd_io as io;
use linkerd_stack::{layer, ExtractParam, InsertParam, NewService, Service, ServiceExt};
use std::{
future::Future,
pin::Pin,
task::{Context, Poll},
};
use thiserror::Error;
use tokio::time;
use tracing::debug;

#[derive(Clone, Debug, Error)]
#[error("SNI detection timed out")]
pub struct SniDetectionTimeoutError;

#[derive(Clone, Debug, Error)]
#[error("Could not find SNI")]
pub struct NoSniFoundError;

#[derive(Clone, Debug)]
pub struct NewDetectSni<P, N> {
params: P,
inner: N,
}

#[derive(Clone, Debug)]
pub struct DetectSni<T, P, N> {
target: T,
inner: N,
timeout: Timeout,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm curious about the timeout handling here and whether this should be instrumented here. On a known TLS connection, what do we do in the face of a timeout? Error? The timeout case exists on the existing detection logic so that we can forward connections as opaque after a timeout elapses, but there's no such fallback logic here, is there? I'd probably have to go back to the higher level draft PR to get a sense of how this fits together, but my gut instinct is that we do not need a timeout here.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. So yes, essentially we would error with a SniDetectionTimeoutError if the timeout elapses. Does that make sense here?

params: P,
}

impl<P, N> NewDetectSni<P, N> {
pub fn new(params: P, inner: N) -> Self {
Self { inner, params }
}

pub fn layer(params: P) -> impl layer::Layer<N, Service = Self> + Clone
where
P: Clone,
{
layer::mk(move |inner| Self::new(params.clone(), inner))
}
}

impl<T, P, N> NewService<T> for NewDetectSni<P, N>
where
P: ExtractParam<Timeout, T> + Clone,
N: Clone,
{
type Service = DetectSni<T, P, N>;

fn new_service(&self, target: T) -> Self::Service {
let timeout = self.params.extract_param(&target);
DetectSni {
target,
timeout,
inner: self.inner.clone(),
params: self.params.clone(),
}
}
}

impl<T, P, I, N, S> Service<I> for DetectSni<T, P, N>
where
T: Clone + Send + Sync + 'static,
P: InsertParam<ServerName, T> + Clone + Send + Sync + 'static,
P::Target: Send + 'static,
I: io::AsyncRead + io::Peek + io::AsyncWrite + Send + Sync + Unpin + 'static,
N: NewService<P::Target, Service = S> + Clone + Send + 'static,
S: Service<DetectIo<I>> + Send,
S::Error: Into<Error>,
S::Future: Send,
{
type Response = S::Response;
type Error = Error;
type Future = Pin<Box<dyn Future<Output = Result<S::Response, Error>> + Send + 'static>>;

#[inline]
fn poll_ready(&mut self, _: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
Poll::Ready(Ok(()))
}

fn call(&mut self, io: I) -> Self::Future {
let target = self.target.clone();
let new_accept = self.inner.clone();
let params = self.params.clone();

// Detect the SNI from a ClientHello (or timeout).
let Timeout(timeout) = self.timeout;
let detect = time::timeout(timeout, detect_sni(io));
Box::pin(async move {
let (sni, io) = detect.await.map_err(|_| SniDetectionTimeoutError)??;
let sni = sni.ok_or(NoSniFoundError)?;

debug!("detected SNI: {:?}", sni);
let svc = new_accept.new_service(params.insert_param(sni, target));
svc.oneshot(io).await.map_err(Into::into)
})
}
}
1 change: 1 addition & 0 deletions linkerd/tls/src/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
#![forbid(unsafe_code)]

pub mod client;
pub mod detect_sni;
pub mod server;

pub use self::{
Expand Down
2 changes: 1 addition & 1 deletion linkerd/tls/src/server.rs
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ where
}

/// Peek or buffer the provided stream to determine an SNI value.
async fn detect_sni<I>(mut io: I) -> io::Result<(Option<ServerName>, DetectIo<I>)>
pub(crate) async fn detect_sni<I>(mut io: I) -> io::Result<(Option<ServerName>, DetectIo<I>)>
where
I: io::Peek + io::AsyncRead + io::AsyncWrite + Send + Sync + Unpin,
{
Expand Down
Loading