Add ClientTrafficPolicy XFF append disable support

Signed-off-by: Alexander Bolshakov <lextiz@gmail.com>

Author: lextiz

api/v1alpha1/clienttrafficpolicy_types.go

@@ -139,6 +139,14 @@ type HeaderSettings struct {
 	// +optional
 	DisableRateLimitHeaders *bool `json:"disableRateLimitHeaders,omitempty"`
 
+	// DisableXForwardedFor configures Envoy Proxy to stop appending the downstream address
+	// to the X-Forwarded-For header.
+	//
+	// This only disables the automatic append behavior. It does not remove or sanitize
+	// an incoming X-Forwarded-For header.
+	// +optional
+	DisableXForwardedFor *bool `json:"disableXForwardedFor,omitempty"`
+
 	// XForwardedClientCert configures how Envoy Proxy handle the x-forwarded-client-cert (XFCC) HTTP header.
 	//
 	// x-forwarded-client-cert (XFCC) is an HTTP header used to forward the certificate

api/v1alpha1/zz_generated.deepcopy.go

@@ -237,6 +237,14 @@ spec:
                       DisableRateLimitHeaders configures Envoy Proxy to omit the "X-RateLimit-" response headers
                       when rate limiting is enabled.
                     type: boolean
+                  disableXForwardedFor:
+                    description: |-
+                      DisableXForwardedFor configures Envoy Proxy to stop appending the downstream address
+                      to the X-Forwarded-For header.
+
+                      This only disables the automatic append behavior. It does not remove or sanitize
+                      an incoming X-Forwarded-For header.
+                    type: boolean
                   earlyRequestHeaders:
                     description: |-
                       EarlyRequestHeaders defines settings for early request header modification, before envoy performs

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -236,6 +236,14 @@ spec:
                       DisableRateLimitHeaders configures Envoy Proxy to omit the "X-RateLimit-" response headers
                       when rate limiting is enabled.
                     type: boolean
+                  disableXForwardedFor:
+                    description: |-
+                      DisableXForwardedFor configures Envoy Proxy to stop appending the downstream address
+                      to the X-Forwarded-For header.
+
+                      This only disables the automatic append behavior. It does not remove or sanitize
+                      an incoming X-Forwarded-For header.
+                    type: boolean
                   earlyRequestHeaders:
                     description: |-
                       EarlyRequestHeaders defines settings for early request header modification, before envoy performs

charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -672,6 +672,7 @@ func translateListenerHeaderSettings(headerSettings *egv1a1.HeaderSettings, http
 	httpIR.Headers = &ir.HeaderSettings{
 		EnableEnvoyHeaders:      ptr.Deref(headerSettings.EnableEnvoyHeaders, false),
 		DisableRateLimitHeaders: ptr.Deref(headerSettings.DisableRateLimitHeaders, false),
+		DisableXForwardedFor:    ptr.Deref(headerSettings.DisableXForwardedFor, false),
 		WithUnderscoresAction:   ir.WithUnderscoresAction(ptr.Deref(headerSettings.WithUnderscoresAction, egv1a1.WithUnderscoresActionRejectRequest)),
 	}
 	if headerSettings.RequestID != nil {

internal/gatewayapi/clienttrafficpolicy.go

@@ -8,6 +8,8 @@ clientTrafficPolicies:
     clientIPDetection:
       xForwardedFor:
         numTrustedHops: 2
+    headers:
+      disableXForwardedFor: true
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
@@ -43,6 +45,19 @@ clientTrafficPolicies:
       kind: Gateway
       name: gateway-1
       sectionName: http-3
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1-http-4
+  spec:
+    headers:
+      disableXForwardedFor: true
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      sectionName: http-4
 gateways:
 - apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway

internal/gatewayapi/testdata/clienttrafficpolicy-client-ip-detection.in.yaml

@@ -8,6 +8,8 @@ clientTrafficPolicies:
     clientIPDetection:
       xForwardedFor:
         numTrustedHops: 2
+    headers:
+      disableXForwardedFor: true
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
@@ -88,6 +90,34 @@ clientTrafficPolicies:
         status: "True"
         type: Accepted
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    name: target-gateway-1-http-4
+    namespace: envoy-gateway
+  spec:
+    headers:
+      disableXForwardedFor: true
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      sectionName: http-4
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-4
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
 gateways:
 - apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
@@ -283,6 +313,9 @@ xdsIR:
       clientIPDetection:
         xForwardedFor:
           numTrustedHops: 2
+      headers:
+        disableXForwardedFor: true
+        withUnderscoresAction: RejectRequest
       externalPort: 8081
       hostnames:
       - '*'
@@ -334,6 +367,9 @@ xdsIR:
       port: 8083
     - address: 0.0.0.0
       externalPort: 8084
+      headers:
+        disableXForwardedFor: true
+        withUnderscoresAction: RejectRequest
       hostnames:
       - '*'
       metadata:

internal/gatewayapi/testdata/clienttrafficpolicy-client-ip-detection.out.yaml

@@ -777,6 +777,10 @@ type HeaderSettings struct {
 	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ratelimit/v3/rate_limit.proto#extensions-filters-http-ratelimit-v3-ratelimit
 	DisableRateLimitHeaders bool `json:"disableRateLimitHeaders,omitempty" yaml:"disableRateLimitHeaders,omitempty"`
 
+	// DisableXForwardedFor controls if Envoy should stop appending the downstream address to
+	// the X-Forwarded-For header. The default is to keep appending the downstream address.
+	DisableXForwardedFor bool `json:"disableXForwardedFor,omitempty" yaml:"disableXForwardedFor,omitempty"`
+
 	// Configure Envoy proxy how to handle the x-forwarded-client-cert (XFCC) HTTP header.
 	// refer to https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-enum-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-forwardclientcertdetails
 	XForwardedClientCert *XForwardedClientCert `json:"xForwardedClientCert,omitempty" yaml:"xForwardedClientCert,omitempty"`

internal/ir/xds.go

@@ -141,7 +141,7 @@ func xffNumTrustedHops(clientIPDetection *ir.ClientIPDetectionSettings) uint32 {
 	return 0
 }
 
-func originalIPDetectionExtensions(clientIPDetection *ir.ClientIPDetectionSettings) []*corev3.TypedExtensionConfig {
+func originalIPDetectionExtensions(clientIPDetection *ir.ClientIPDetectionSettings, headers *ir.HeaderSettings) []*corev3.TypedExtensionConfig {
 	// Return early if settings are nil
 	if clientIPDetection == nil {
 		return nil
@@ -183,12 +183,12 @@ func originalIPDetectionExtensions(clientIPDetection *ir.ClientIPDetectionSettin
 				XffTrustedCidrs: &xffv3.XffTrustedCidrs{
 					Cidrs: trustedCidrs,
 				},
-				SkipXffAppend: wrapperspb.Bool(false),
+				SkipXffAppend: wrapperspb.Bool(headers != nil && headers.DisableXForwardedFor),
 			})
 		} else if clientIPDetection.XForwardedFor.NumTrustedHops != nil {
 			xffHeaderConfigAny, _ = proto.ToAnyWithValidation(&xffv3.XffConfig{
 				XffNumTrustedHops: xffNumTrustedHops(clientIPDetection),
-				SkipXffAppend:     wrapperspb.Bool(false),
+				SkipXffAppend:     wrapperspb.Bool(headers != nil && headers.DisableXForwardedFor),
 			})
 		}
 		extensionConfig = append(extensionConfig, &corev3.TypedExtensionConfig{
@@ -354,7 +354,7 @@ func (t *Translator) addHCMToXDSListener(
 	// HTTP filter configuration
 	// Client IP detection
 	useRemoteAddress := true
-	originalIPDetectionExtensions := originalIPDetectionExtensions(irListener.ClientIPDetection)
+	originalIPDetectionExtensions := originalIPDetectionExtensions(irListener.ClientIPDetection, irListener.Headers)
 	if originalIPDetectionExtensions != nil {
 		useRemoteAddress = false
 	}
@@ -378,6 +378,7 @@ func (t *Translator) addHCMToXDSListener(
 		Http2ProtocolOptions: http2ProtocolOptions(irListener.HTTP2),
 		// https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-forwarded-for
 		UseRemoteAddress:              &wrapperspb.BoolValue{Value: useRemoteAddress},
+		SkipXffAppend:                 ptr.Deref(irListener.Headers, ir.HeaderSettings{}).DisableXForwardedFor,
 		OriginalIpDetectionExtensions: originalIPDetectionExtensions,
 		// normalize paths according to RFC 3986
 		NormalizePath:                &wrapperspb.BoolValue{Value: true},

internal/xds/translator/listener.go

@@ -17,6 +17,8 @@ http:
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
+  headers:
+    disableXForwardedFor: true
 - name: "second-listener"
   address: "::"
   port: 8082
@@ -76,3 +78,21 @@ http:
       - "192.168.1.0/24"
       - "10.0.0.0/16"
       - "172.16.0.0/12"
+
+- name: "fifth-listener"
+  address: "::"
+  port: 8085
+  hostnames:
+  - "*"
+  headers:
+    disableXForwardedFor: true
+  routes:
+  - name: "fifth-route"
+    hostname: "*"
+    destination:
+      name: "fifth-route-dest"
+      settings:
+      - endpoints:
+        - host: "5.5.5.5"
+          port: 8085
+        name: "fifth-route-dest/backend/0"