Skip to content

Commit fffbac2

Browse files
ovadiagalovadiagal
committed
,
1 parent fc48efe commit fffbac2

15 files changed

Lines changed: 1244 additions & 347 deletions

‎TESTING.md‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
# Testing Egress Policies Dynamic Module
2+
3+
Quick guide to compile and test your dynamic module with Envoy.
4+
5+
## Prerequisites
6+
7+
- Rust toolchain (`rustc`, `cargo`)
8+
- Envoy proxy (`brew install envoyproxy/envoy/envoy` on macOS)
9+
- `dig` command for DNS testing
10+
11+
## Quick Start
12+
13+
```bash
14+
# 1. Build the module
15+
cd rust
16+
cargo build --release
17+
18+
# 2. Start Envoy (from parent directory)
19+
cd ..
20+
./run-envoy.sh
21+
22+
# 3. In another terminal, test it
23+
./test-egress.sh
24+
```
25+
26+
## Manual Steps
27+
28+
### 1. Build Module
29+
30+
```bash
31+
cd rust
32+
cargo build --release
33+
# Output: target/release/librust_module.dylib (macOS) or .so (Linux)
34+
```
35+
36+
### 2. Set Environment
37+
38+
```bash
39+
export ENVOY_DYNAMIC_MODULES_SEARCH_PATH=/Users/govadia/Desktop/dynamic-modules-examples/rust/target/release
40+
```
41+
42+
### 3. Start Envoy
43+
44+
```bash
45+
envoy -c envoy-egress-test.yaml --log-level info
46+
```
47+
48+
**Expected logs:**
49+
```
50+
[info] Initialized VirtualIpCache with base IP 10.10.0.0
51+
[info] DnsGateway initialized with 2 policies
52+
```
53+
54+
### 4. Test DNS Gateway
55+
56+
```bash
57+
# Query a matching domain
58+
dig @127.0.0.1 -p 5353 api.aws.com +short
59+
# Expected: 10.10.0.0
60+
61+
# Query another domain
62+
dig @127.0.0.1 -p 5353 cdn.example.com +short
63+
# Expected: 10.10.0.1
64+
65+
# Query same domain again (cached)
66+
dig @127.0.0.1 -p 5353 api.aws.com +short
67+
# Expected: 10.10.0.0 (same IP)
68+
```
69+
70+
### 5. Check Envoy Stats
71+
72+
```bash
73+
curl http://127.0.0.1:9901/stats | grep -E "(dns|virtual|policy)"
74+
```
75+
76+
## Configuration
77+
78+
### DNS Gateway Config
79+
80+
The DNS gateway is configured in `envoy-egress-test.yaml`:
81+
82+
```yaml
83+
config:
84+
base_ip: "10.10.0.0" # Start allocating from this IP
85+
policies:
86+
- domain: "*.aws.com" # Wildcard pattern
87+
metadata:
88+
upstream_cluster: "aws_cluster"
89+
tunneling_hostname: "tunnel.aws.com"
90+
```
91+
92+
### How It Works
93+
94+
1. **DNS Query** (port 5353):
95+
- Client queries `api.aws.com`
96+
- DNS gateway matches `*.aws.com` policy
97+
- Allocates virtual IP `10.10.0.0`
98+
- Returns DNS A record with virtual IP
99+
100+
2. **TCP Connection** (port 17100):
101+
- Client connects to `10.10.0.0:17100`
102+
- Hostname lookup filter gets virtual IP
103+
- Looks up policy from cache
104+
- Stores metadata in FilterState
105+
- TCP proxy uses metadata for routing
106+
107+
## Debugging
108+
109+
### Check Module Loading
110+
111+
```bash
112+
# Envoy should log module initialization
113+
grep "dynamic_modules" envoy.log
114+
```
115+
116+
### Check Allocated IPs
117+
118+
```bash
119+
# Query admin endpoint
120+
curl http://127.0.0.1:9901/stats | grep allocated
121+
```
122+
123+
### Enable Debug Logging
124+
125+
```bash
126+
envoy -c envoy-egress-test.yaml --log-level debug
127+
```
128+
129+
### Common Issues
130+
131+
**Module not found:**
132+
```
133+
ENVOY_DYNAMIC_MODULES_SEARCH_PATH not set or incorrect
134+
```
135+
**Solution:** Set to the directory containing your `.dylib` or `.so` file
136+
137+
**No DNS response:**
138+
```
139+
Domain doesn't match any policy pattern
140+
```
141+
**Solution:** Check policy patterns in config
142+
143+
**Config parse error:**
144+
```
145+
Invalid JSON in config field
146+
```
147+
**Solution:** Validate JSON syntax in the `config:` section
148+
149+
## Integration Test
150+
151+
Run the full integration test:
152+
153+
```bash
154+
./test-egress.sh
155+
```
156+
157+
This tests:
158+
- ✅ DNS allocation for new domains
159+
- ✅ Cache hits for repeated queries
160+
- ✅ Policy matching with wildcards
161+
- ✅ Non-matching domains (no response)
162+
163+
## Next Steps
164+
165+
- Add more policy patterns
166+
- Implement TCP routing based on metadata
167+
- Add monitoring/metrics
168+
- Deploy to production environment

‎envoy-1.37‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Not Found

‎envoy-1.37.0‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Not Found

‎envoy-egress-test.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
admin:
2+
address:
3+
socket_address:
4+
address: 127.0.0.1
5+
port_value: 9901
6+
7+
static_resources:
8+
listeners:
9+
# DNS Gateway - Listens for DNS queries
10+
- name: dns_listener
11+
address:
12+
socket_address:
13+
address: 0.0.0.0
14+
port_value: 5353
15+
protocol: UDP
16+
udp_listener_config:
17+
listener_filters:
18+
- name: envoy.filters.udp_listener.dynamic_modules
19+
typed_config:
20+
"@type": type.googleapis.com/envoy.extensions.dynamic_modules.v3.DynamicModuleConfig
21+
name: dns_gateway
22+
do_not_close: true
23+
config:
24+
base_ip: "10.10.0.0"
25+
policies:
26+
- domain: "*.aws.com"
27+
metadata:
28+
upstream_cluster: "aws_cluster"
29+
tunneling_hostname: "tunnel.aws.com"
30+
- domain: "*.example.com"
31+
metadata:
32+
upstream_cluster: "example_cluster"
33+
tunneling_hostname: "tunnel.example.com"
34+
35+
# TCP Listener - Receives connections to virtual IPs
36+
- name: tcp_listener
37+
address:
38+
socket_address:
39+
address: 0.0.0.0
40+
port_value: 17100
41+
filter_chains:
42+
- filters:
43+
# Hostname lookup filter - looks up policy from virtual IP
44+
- name: envoy.filters.network.dynamic_modules
45+
typed_config:
46+
"@type": type.googleapis.com/envoy.extensions.dynamic_modules.v3.DynamicModuleConfig
47+
name: hostname_lookup
48+
do_not_close: true
49+
config: {}
50+
51+
# TCP proxy - forwards traffic
52+
- name: envoy.filters.network.tcp_proxy
53+
typed_config:
54+
"@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
55+
stat_prefix: egress_tcp
56+
cluster: default_cluster
57+
58+
clusters:
59+
- name: default_cluster
60+
connect_timeout: 5s
61+
type: STATIC
62+
load_assignment:
63+
cluster_name: default_cluster
64+
endpoints:
65+
- lb_endpoints:
66+
- endpoint:
67+
address:
68+
socket_address:
69+
address: 127.0.0.1
70+
port_value: 8080
71+
72+
- name: aws_cluster
73+
connect_timeout: 5s
74+
type: STATIC
75+
load_assignment:
76+
cluster_name: aws_cluster
77+
endpoints:
78+
- lb_endpoints:
79+
- endpoint:
80+
address:
81+
socket_address:
82+
address: 127.0.0.1
83+
port_value: 8081
84+
85+
- name: example_cluster
86+
connect_timeout: 5s
87+
type: STATIC
88+
load_assignment:
89+
cluster_name: example_cluster
90+
endpoints:
91+
- lb_endpoints:
92+
- endpoint:
93+
address:
94+
socket_address:
95+
address: 127.0.0.1
96+
port_value: 8082

‎envoy-simple-test.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
admin:
2+
address:
3+
socket_address:
4+
address: 127.0.0.1
5+
port_value: 9901
6+
7+
static_resources:
8+
listeners:
9+
# Simple TCP listener to test hostname lookup filter
10+
- name: tcp_listener
11+
address:
12+
socket_address:
13+
address: 0.0.0.0
14+
port_value: 17100
15+
filter_chains:
16+
- filters:
17+
# Hostname lookup filter - manually initialize cache for testing
18+
- name: envoy.filters.network.dynamic_modules
19+
typed_config:
20+
"@type": type.googleapis.com/envoy.extensions.dynamic_modules.v3.DynamicModuleConfig
21+
name: hostname_lookup
22+
do_not_close: true
23+
config: {}
24+
25+
# TCP proxy - forwards traffic
26+
- name: envoy.filters.network.tcp_proxy
27+
typed_config:
28+
"@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
29+
stat_prefix: egress_tcp
30+
cluster: default_cluster
31+
32+
clusters:
33+
- name: default_cluster
34+
connect_timeout: 5s
35+
type: STATIC
36+
load_assignment:
37+
cluster_name: default_cluster
38+
endpoints:
39+
- lb_endpoints:
40+
- endpoint:
41+
address:
42+
socket_address:
43+
address: 127.0.0.1
44+
port_value: 8080

‎run-envoy.sh‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/bin/bash
2+
3+
# Egress Policies Dynamic Module - Envoy Startup Script
4+
5+
# Set the module search path
6+
export ENVOY_DYNAMIC_MODULES_SEARCH_PATH=/Users/govadia/Desktop/dynamic-modules-examples/rust/target/release
7+
8+
echo "=== Starting Envoy with Egress Policies Dynamic Module ==="
9+
echo ""
10+
echo "Module path: $ENVOY_DYNAMIC_MODULES_SEARCH_PATH"
11+
echo "Config: envoy-egress-test.yaml"
12+
echo ""
13+
echo "Services:"
14+
echo " - DNS Gateway: udp://0.0.0.0:5353"
15+
echo " - TCP Listener: tcp://0.0.0.0:17100"
16+
echo " - Admin: http://127.0.0.1:9901"
17+
echo ""
18+
echo "Test with: ./test-egress.sh"
19+
echo ""
20+
21+
# Check if envoy is installed
22+
if ! command -v envoy &> /dev/null; then
23+
echo "ERROR: envoy command not found"
24+
echo "Install with: brew install envoyproxy/envoy/envoy"
25+
exit 1
26+
fi
27+
28+
# Check if module exists
29+
if [ ! -f "$ENVOY_DYNAMIC_MODULES_SEARCH_PATH/librust_module.dylib" ] && [ ! -f "$ENVOY_DYNAMIC_MODULES_SEARCH_PATH/librust_module.so" ]; then
30+
echo "ERROR: Dynamic module not found at $ENVOY_DYNAMIC_MODULES_SEARCH_PATH"
31+
echo "Build with: cd rust && cargo build --release"
32+
exit 1
33+
fi
34+
35+
# Start Envoy
36+
cd /Users/govadia/Desktop/dynamic-modules-examples
37+
envoy -c envoy-egress-test.yaml --log-level info

0 commit comments

Comments
 (0)