transport_socket(http_11_proxy): add Proxy-Authorization header support

api/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto

@@ -36,6 +36,10 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // If the ``default_proxy_address`` is set and proxy address is not found in
 // ``typed_filter_metadata``, the default proxy address is used.
 //
+// Optionally, the key ``envoy.http11_proxy_transport_socket.proxy_authorization`` and the
+// proxy authorization value in ``google.protobuf.StringValue`` format can be set to send the
+// ``Proxy-Authorization`` header with the ``CONNECT`` request.
+//
 message Http11ProxyUpstreamTransport {
   // The underlying transport socket being wrapped. Defaults to plaintext (raw_buffer) if unset.
   config.core.v3.TransportSocket transport_socket = 1;

source/common/config/well_known_names.h

@@ -40,6 +40,12 @@ class MetadataFilterValues {
   // Proxy address configuration namespace for HTTP/1.1 proxy transport sockets.
   const std::string ENVOY_HTTP11_PROXY_TRANSPORT_SOCKET_ADDR =
       "envoy.http11_proxy_transport_socket.proxy_address";
+
+  // Proxy-Authorization header value for HTTP/1.1 proxy transport sockets.
+  // When present, the value (a google.protobuf.StringValue) is added as a
+  // "Proxy-Authorization" header in the HTTP/1.1 CONNECT request.
+  const std::string ENVOY_HTTP11_PROXY_TRANSPORT_SOCKET_AUTH =
+      "envoy.http11_proxy_transport_socket.proxy_authorization";
 };
 
 using MetadataFilters = ConstSingleton<MetadataFilterValues>;

source/extensions/transport_sockets/http_11_proxy/connect.cc

@@ -10,6 +10,8 @@
 #include "source/common/config/well_known_names.h"
 #include "source/common/http/header_utility.h"
 #include "source/common/network/address_impl.h"
+#include "source/common/protobuf/protobuf.h"
+#include "source/common/protobuf/utility.h"
 #include "source/common/runtime/runtime_features.h"
 
 namespace Envoy {
@@ -69,8 +71,15 @@ UpstreamHttp11ConnectSocket::UpstreamHttp11ConnectSocket(
 }
 
 // Helper method to create a properly formatted CONNECT request with Host header.
-std::string UpstreamHttp11ConnectSocket::formatConnectRequest(absl::string_view target) {
-  return absl::StrCat("CONNECT ", target, " HTTP/1.1\r\n", "Host: ", target, "\r\n\r\n");
+std::string UpstreamHttp11ConnectSocket::formatConnectRequest(absl::string_view target,
+                                                              bool include_host_header,
+                                                              absl::string_view authorization) {
+  std::string connect_header = absl::StrCat("CONNECT ", target, " HTTP/1.1\r\n");
+  std::string host_header = include_host_header ? absl::StrCat("Host: ", target, "\r\n") : "";
+  std::string proxy_authorization_header =
+      !authorization.empty() ? absl::StrCat("Proxy-Authorization: ", authorization, "\r\n") : "";
+
+  return absl::StrCat(connect_header, host_header, proxy_authorization_header, "\r\n");
 }
 
 inline void UpstreamHttp11ConnectSocket::handleProxyInfoConnect(
@@ -82,17 +91,35 @@ inline void UpstreamHttp11ConnectSocket::handleProxyInfoConnect(
     if (!Runtime::runtimeFeatureEnabled(
             "envoy.reloadable_features.http_11_proxy_connect_legacy_format")) {
       // RFC 9110 compliant CONNECT format that includes Host header.
-      header_buffer_.add(formatConnectRequest(target));
+      header_buffer_.add(formatConnectRequest(target, true /* include_host_header */));
     } else {
       // Legacy behavior: no Host header for backward compatibility.
-      header_buffer_.add(absl::StrCat("CONNECT ", target, " HTTP/1.1\r\n\r\n"));
+      header_buffer_.add(formatConnectRequest(target, false /* include_host_header */));
     }
     need_to_strip_connect_response_ = true;
   }
 }
 
 inline void UpstreamHttp11ConnectSocket::handleHostMetadataConnect(
     std::shared_ptr<const Upstream::HostDescription> host) {
+  // Look up the optional Proxy-Authorization value from the endpoint's typed metadata.
+  std::string authorization;
+  if (host->metadata() != nullptr) {
+    auto auth_it = host->metadata()->typed_filter_metadata().find(
+        Config::MetadataFilters::get().ENVOY_HTTP11_PROXY_TRANSPORT_SOCKET_AUTH);
+    if (auth_it != host->metadata()->typed_filter_metadata().end()) {
+      Protobuf::StringValue auth_value;
+      if (MessageUtil::unpackTo(auth_it->second, auth_value).ok()) {
+        authorization = auth_value.value();
+      } else {
+        ENVOY_CONN_LOG(trace,
+                       "Failed to unpack Proxy-Authorization string from host metadata, "
+                       "proceeding with empty authorization",
+                       callbacks_->connection());
+      }
+    }
+  }
+
   if (!Runtime::runtimeFeatureEnabled(
           "envoy.reloadable_features.http_11_proxy_connect_legacy_format")) {
     // Prefer <host-name>:<port> for RFC 9110 compliance, unless URI is <host-ip>:<port>.
@@ -103,11 +130,11 @@ inline void UpstreamHttp11ConnectSocket::handleHostMetadataConnect(
     } else {
       target = host->address()->asStringView();
     }
-    header_buffer_.add(formatConnectRequest(target));
+    header_buffer_.add(formatConnectRequest(target, true /* include_host_header */, authorization));
   } else {
     // Legacy behavior: <host-ip>:<port> format, no Host header for backward compatibility.
-    header_buffer_.add(
-        absl::StrCat("CONNECT ", host->address()->asStringView(), " HTTP/1.1\r\n\r\n"));
+    header_buffer_.add(formatConnectRequest(host->address()->asStringView(),
+                                            false /* include_host_header */, authorization));
   }
   need_to_strip_connect_response_ = true;
 }

source/extensions/transport_sockets/http_11_proxy/connect.h

@@ -29,8 +29,12 @@ class UpstreamHttp11ConnectSocket : public TransportSockets::PassthroughSocket,
 
   // Helper method to create a properly formatted CONNECT request with Host header.
   // @param target the target hostname:port or IP:port to connect to.
+  // @param include_host_header whether to include the Host header in the CONNECT request.
+  // @param authorization when non-empty, added as the Proxy-Authorization header in the CONNECT
+  //        request.
   // @return a properly formatted CONNECT request string per RFC 9110 section 9.3.6.
-  static std::string formatConnectRequest(absl::string_view target);
+  static std::string formatConnectRequest(absl::string_view target, bool include_host_header,
+                                          absl::string_view authorization = "");
 
   UpstreamHttp11ConnectSocket(
       Network::TransportSocketPtr&& transport_socket,

test/extensions/transport_sockets/http_11_proxy/connect_integration_test.cc

@@ -1,11 +1,14 @@
 #include "envoy/config/common/key_value/v3/config.pb.h"
+#include "envoy/config/core/v3/address.pb.h"
 #include "envoy/config/core/v3/base.pb.h"
 #include "envoy/config/core/v3/health_check.pb.h"
 #include "envoy/extensions/key_value/file_based/v3/config.pb.h"
 #include "envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.pb.h"
 #include "envoy/extensions/transport_sockets/raw_buffer/v3/raw_buffer.pb.h"
 
+#include "source/common/config/well_known_names.h"
 #include "source/common/network/utility.h"
+#include "source/common/protobuf/protobuf.h"
 
 #include "test/integration/http_integration.h"
 #include "test/integration/integration.h"
@@ -98,7 +101,12 @@ name: envoy.clusters.dynamic_forward_proxy
         addFakeUpstream(upstreamProtocol());
       }
       fake_upstreams_[1]->setDisableAllAndDoNotEnable(true);
-      default_proxy_address_ = fake_upstreams_[1]->localAddress();
+      if (use_host_metadata_proxy_) {
+        // Populating default_proxy_address_
+        host_metadata_proxy_address_ = fake_upstreams_[1]->localAddress();
+      } else {
+        default_proxy_address_ = fake_upstreams_[1]->localAddress();
+      }
     }
 
     config_helper_.addConfigModifier([&](envoy::config::bootstrap::v3::Bootstrap& bootstrap) {
@@ -123,6 +131,30 @@ name: envoy.clusters.dynamic_forward_proxy
 
       auto* cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
 
+      if (use_host_metadata_proxy_) {
+        auto* lb_endpoint =
+            cluster->mutable_load_assignment()->mutable_endpoints(0)->mutable_lb_endpoints(0);
+        auto* md = lb_endpoint->mutable_metadata();
+
+        envoy::config::core::v3::Address addr_proto;
+        Network::Utility::addressToProtobufAddress(*host_metadata_proxy_address_, addr_proto);
+        Protobuf::Any addr_any;
+        std::ignore = addr_any.PackFrom(addr_proto);
+        (*md->mutable_typed_filter_metadata())[Config::MetadataFilters::get()
+                                                   .ENVOY_HTTP11_PROXY_TRANSPORT_SOCKET_ADDR] =
+            addr_any;
+
+        if (!host_metadata_proxy_authorization_.empty()) {
+          Protobuf::StringValue auth_value;
+          auth_value.set_value(host_metadata_proxy_authorization_);
+          Protobuf::Any auth_any;
+          std::ignore = auth_any.PackFrom(auth_value);
+          (*md->mutable_typed_filter_metadata())[Config::MetadataFilters::get()
+                                                     .ENVOY_HTTP11_PROXY_TRANSPORT_SOCKET_AUTH] =
+              auth_any;
+        }
+      }
+
       ConfigHelper::HttpProtocolOptions protocol_options;
       protocol_options.mutable_upstream_http_protocol_options()->set_auto_sni(true);
       protocol_options.mutable_upstream_http_protocol_options()->set_auto_san_validation(true);
@@ -184,6 +216,9 @@ name: envoy.clusters.dynamic_forward_proxy
 
   bool pre_create_upstreams_ = false;
   Network::Address::InstanceConstSharedPtr default_proxy_address_;
+  bool use_host_metadata_proxy_ = false;
+  std::string host_metadata_proxy_authorization_;
+  Network::Address::InstanceConstSharedPtr host_metadata_proxy_address_;
 };
 
 INSTANTIATE_TEST_SUITE_P(IpVersions, Http11ConnectHttpIntegrationTest,
@@ -638,5 +673,37 @@ TEST_P(Http11ConnectHttpIntegrationTest, ConfiguredProxy) {
   ASSERT_FALSE(response->headers().get(Http::LowerCaseString("foo")).empty());
 }
 
+TEST_P(Http11ConnectHttpIntegrationTest, ProxyAuthorizationViaHostMetadata) {
+  pre_create_upstreams_ = true;
+  use_host_metadata_proxy_ = true;
+  host_metadata_proxy_authorization_ = "Basic abcdefghijk";
+  initialize();
+
+  codec_client_ = makeHttpConnection(lookupPort("http"));
+  auto response = codec_client_->makeHeaderOnlyRequest(default_request_headers_);
+
+  // Envoy dials the proxy (fake upstream 1) from the endpoint address metadata.
+  ASSERT_TRUE(fake_upstreams_[1]->waitForHttpConnection(*dispatcher_, fake_upstream_connection_));
+
+  // Verify the CONNECT request contains the Proxy-Authorization header.
+  std::string prefix_data;
+  ASSERT_TRUE(fake_upstream_connection_->waitForInexactRawData("\r\n\r\n", prefix_data));
+  const std::string target = fake_upstreams_[0]->localAddress()->asString();
+  const std::string expected_connect =
+      absl::StrCat("CONNECT ", target, " HTTP/1.1\r\n", "Host: ", target, "\r\n",
+                   "Proxy-Authorization: ", host_metadata_proxy_authorization_, "\r\n\r\n");
+  EXPECT_EQ(expected_connect, prefix_data);
+
+  // Ship the CONNECT response and complete the encapsulated exchange.
+  fake_upstream_connection_->writeRawData("HTTP/1.1 200 OK\r\n\r\n");
+  ASSERT_TRUE(fake_upstream_connection_->readDisable(false));
+  ASSERT_TRUE(fake_upstream_connection_->waitForNewStream(*dispatcher_, upstream_request_));
+  ASSERT_TRUE(upstream_request_->waitForEndStream(*dispatcher_));
+  upstream_request_->encodeHeaders(default_response_headers_, true);
+
+  ASSERT_TRUE(response->waitForEndStream());
+  EXPECT_EQ("200", response->headers().getStatusValue());
+}
+
 } // namespace
 } // namespace Envoy