Document the egress traffic supported for GA - #1749
haiyanmeng wants to merge 1 commit into
Conversation
|
|
||
| | Port | Traffic | Behavior | Path | What the actor sees when refused | | ||
| | :---- | :---- | :---- | :---- | :---- | | ||
| | any | HTTP(S) 1.1 / 2 | Supported with policy controls | atunnel -> egress gateway -> origin | `403 Forbidden` with body `egress denied`. | |
There was a problem hiding this comment.
Not sure we should mandate the response body here
| | any | WebSocket | Blocked | n/a | `403 Forbidden` with an empty body. | | ||
| | any | Standard HTTP(S) CONNECT (forward-proxy tunnel) | Blocked | n/a | `403 Forbidden` with an empty body. | | ||
| | 53 | DNS | Allowed via netfilter rules | nftables -> node-configured DNS | n/a | | ||
| | any | Any other TCP | Blocked | n/a | The connection is accepted and then closed with no bytes returned. There is no status code. atunnel logs the failure. | |
There was a problem hiding this comment.
We should send an RST by setting SO_LINGER to 0 on close vs having a normal FIN close.
There was a problem hiding this comment.
Keith Mattix II (@keithmattix) , yanavlasov, WDYT?
There was a problem hiding this comment.
This is a bit complicated. Actor's connection is inside the CONNECT tunnel. Egress Gateway can close the CONNECT abortively. For H/2 it is closed with RTS_STREAM and for H/1 TCP connection is closed abortively with RST. However the iptables interceptor that initiated CONNECT needs to translate these events into abortive close for the TCP connection from actor. I think Envoy already has the functionality it needs, but I'm not 100% sure. The atunnel client will need to have support for this as well.
We could work toward making this be the behavior for GA.
Record which egress protocols are allowed, which are allowed only under policy controls, and which are blocked, along with the data path each one takes. Having this written down gives users a single place to check what Substrate lets an actor reach, and gives us a checklist to implement and test against before GA. Point readers at the issue tracker so that requests for traffic we do not yet support arrive with a use case attached.
426b52f to
90e534e
Compare
| Actor TCP egress (except DNS traffic on port 53) is redirected to atunnel, | ||
| which opens a CONNECT tunnel to the egress gateway. Egress gateway applies policy. |
| Actor TCP egress (except DNS traffic on port 53) is redirected to atunnel, | ||
| which opens a CONNECT tunnel to the egress gateway. Egress gateway applies policy. | ||
|
|
||
| DNS-over-TCP, UDP and other traffic is filtered by nftables and never reaches the gateway. |
|
|
||
| ## Other transports | ||
|
|
||
| Everything that is neither TCP nor UDP is blocked. Packets are dropped, not rejected: no ICMP port-unreachable is sent, so the client hangs until its own timeout. |
There was a problem hiding this comment.
either we say, future version can look into ICMP rejection messages for verbosity or we drop ICMP from here
| | 53 | DNS | Allowed via netfilter rules | nftables -> node-configured DNS | n/a | | ||
| | any other | Any other UDP | Blocked | n/a | Packets are dropped, not rejected: no ICMP port-unreachable is sent, so the client hangs until its own timeout. | |
There was a problem hiding this comment.
I think we should update this to reflect the state after #1689
cc: Benjamin Elder (@BenTheElder)
There was a problem hiding this comment.
I believe this line aligns with #1689 currently
| | any | HTTP(S) 1.1 / 2 | Supported with policy controls | atunnel -> egress gateway -> origin | `403 Forbidden` | | ||
| | any | WebSocket | Blocked | n/a | `403 Forbidden` | | ||
| | any | Standard HTTP(S) CONNECT (forward-proxy tunnel) | Blocked | n/a | `403 Forbidden` | | ||
| | 53 | DNS | Allowed via netfilter rules | nftables -> node-configured DNS | n/a | |
4 participants
Record which egress protocols are allowed, which are allowed only under policy controls, and which are blocked, along with the data path each one takes. Having this written down gives users a single place to check what Substrate lets an actor reach, and gives us a checklist to implement and test against before GA.
Point readers at the issue tracker so that requests for traffic we do not yet support arrive with a use case attached.
Address #1339