The proxyproto plugin parsed PROXY protocol v2 headers only to recover the real
client address; the TLV vector was discarded, so downstream plugins had no way to
read values such as the AWS VPC endpoint ID, SSL client CN, or vendor-specific
custom TLVs.
Add an opt-in `tlv_metadata` option. When set, the connection's raw PPv2 TLV
vector is captured and the plugin, acting as a metadata.Provider, publishes it
under the `proxyproto/tlv` label as a hex-encoded string. Consumers decode and
split it with proxyproto.SplitTLVs. The option is off by default, so existing
deployments skip the extra per-connection processing and behave exactly as before.
PROXY protocol v1 connections, which carry no TLVs, are unaffected.
Capture spans all transports: dns:// (UDP and TCP), tls:// (DoT), https:// (DoH),
grpc://, quic:// (DoQ), and https3:// (DoH3). QUIC-based transports require
udp_session_tracking, since the PPv2 header arrives as a standalone first datagram
ahead of the QUIC handshake.
Includes unit tests for capture, the metadata provider (direct and through the
real metadata chain), v1 compatibility, and option parsing, plus README and man
page updates.
Fixes#8633
Signed-off-by: Mekias Yohannes <mekias@amazon.com>
Co-authored-by: Mekias Yohannes <mekias@amazon.com>
The `tools.ietf.org` site now redirects to `www.rfc-editor.org`.
* Update various URLs to the new site.
* Make links to `www.rfc-editor.org` consistent.
Signed-off-by: SuperQ <superq@gmail.com>
Instead of casting lease ID to uint32, fix the TTL() function
to use etcd time-to-live API for determining TTL. Add configurable
min-lease-ttl and max-lease-ttl options to prevent extreme TTL
values. By default, lease records now go through bounds checking
with 30s to 1d as the min/max.
Added unit tests for validation and docs.
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
The rewrite plugin modifies DNS messages, affecting the request
size observed in the coredns_dns_request_size_bytes metric.
This change captures the original request size before any plugins
can modify it. It adds a functional options pattern to Report() to
pass this information while maintaining API compatibility.
Tests have been added to verify the fix prevents rewrite from
affecting the request size metrics.
Docs included.
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
* Upgrade antonmedv/expr to expr-lang/expr
The project has moved. This also upgrades from 1.15.5 to 1.16.9.
The expr project lacks a changelog but tests pass and the changes don't
seem to change it much - but there were a lot of changes.
Signed-off-by: Kevin Lyda <kevin@lyda.ie>
* Upgrade build image
In reviewing the build results I see the old build image was deprecated so
upgrading to something newer.
Signed-off-by: Kevin Lyda <kevin@lyda.ie>
---------
Signed-off-by: Kevin Lyda <kevin@lyda.ie>
-p is the default flag in DNS software for setting the port, we use
'dns.port' because of preventing clashes with other caddy software
users. This is no longer an issue, so we can do what we want here.
Add -p to works like -dns.port.
(this PR includes generated manpage, but that shouldn't matter too much)
Signed-off-by: Miek Gieben <miek@miek.nl>
