mc/mc-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add L7 and PROXY protocol fields to gRPC API and CLI

Browse Source 
Proto: Route message gains mode, tls_cert, tls_key, backend_tls,
send_proxy_protocol fields. ListenerStatus gains proxy_protocol.
Generated code regenerated with protoc v29.5.

gRPC server: AddRoute validates mode ("l4"/"l7", defaults to "l4"),
requires tls_cert/tls_key for L7 routes, persists all fields via
write-through. ListRoutes returns full route info. GetStatus
includes proxy_protocol on listener status.

Client package: Route struct expanded with Mode, TLSCert, TLSKey,
BackendTLS, SendProxyProtocol. AddRoute signature changed to accept
a Route struct instead of individual hostname/backend strings.
ListenerStatus gains ProxyProtocol. ListRoutes maps all proto fields.

mcproxyctl: routes add gains --mode, --tls-cert, --tls-key,
--backend-tls, --send-proxy-protocol flags. routes list displays
mode and option tags for each route.

New tests: add L7 route via gRPC with field round-trip verification,
L7 route missing cert/key (InvalidArgument), invalid mode rejection,
default-to-L4 backward compatibility, proxy_protocol in status.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kyle Isom
2026-03-25 13:55:43 -07:00
parent 97909b7fbc
commit 498f040cbe
9 changed files with 341 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
PROGRESS.md
View File

@@ -35,11 +35,11 @@ proceeds. Each item is marked:
## Phase 4: gRPC API & CLI Updates
- [ ] 4.1 Proto updates (new fields on `Route`, `AddRouteRequest`, `ListenerStatus`)
- [ ] 4.2 gRPC server updates (accept/validate/persist new route fields)
- [ ] 4.3 Client package updates (new fields on `Route`, `ListenerStatus`)
- [ ] 4.4 mcproxyctl updates (flags for `routes add`, display in `routes list`)
- [ ] 4.5 Tests (gRPC round-trip with new fields, backward compatibility)
- [x] 4.1 Proto updates (new fields on `Route`, `AddRouteRequest`, `ListenerStatus`)
- [x] 4.2 gRPC server updates (accept/validate/persist new route fields)
- [x] 4.3 Client package updates (new fields on `Route`, `ListenerStatus`)
- [x] 4.4 mcproxyctl updates (flags for `routes add`, display in `routes list`)
- [x] 4.5 Tests (gRPC round-trip with new fields, backward compatibility)
## Phase 5: Integration & Polish

25
client/mcproxy/client.go
View File

@@ -40,10 +40,15 @@ func (c *Client) Close() error {
return c.conn.Close()
}
// Route represents a hostname to backend mapping.
// Route represents a hostname to backend mapping with mode and options.
type Route struct {
Hostname string
Backend string
Mode string // "l4" or "l7"
TLSCert string
TLSKey string
BackendTLS bool
SendProxyProtocol bool
}
// ListRoutes returns all routes for the given listener address.
@@ -60,18 +65,28 @@ func (c *Client) ListRoutes(ctx context.Context, listenerAddr string) ([]Route,
routes[i] = Route{
Hostname: r.Hostname,
Backend: r.Backend,
Mode: r.Mode,
TLSCert: r.TlsCert,
TLSKey: r.TlsKey,
BackendTLS: r.BackendTls,
SendProxyProtocol: r.SendProxyProtocol,
}
}
return routes, nil
}
// AddRoute adds a route to the given listener.
func (c *Client) AddRoute(ctx context.Context, listenerAddr, hostname, backend string) error {
func (c *Client) AddRoute(ctx context.Context, listenerAddr string, route Route) error {
_, err := c.admin.AddRoute(ctx, &pb.AddRouteRequest{
ListenerAddr: listenerAddr,
Route: &pb.Route{
Hostname: hostname,
Backend: backend,
Hostname: route.Hostname,
Backend: route.Backend,
Mode: route.Mode,
TlsCert: route.TLSCert,
TlsKey: route.TLSKey,
BackendTls: route.BackendTLS,
SendProxyProtocol: route.SendProxyProtocol,
},
})
return err
@@ -145,6 +160,7 @@ type ListenerStatus struct {
Addr string
RouteCount int
ActiveConnections int64
ProxyProtocol bool
}
// Status contains the server's current status.
@@ -176,6 +192,7 @@ func (c *Client) GetStatus(ctx context.Context) (*Status, error) {
Addr: ls.Addr,
RouteCount: int(ls.RouteCount),
ActiveConnections: ls.ActiveConnections,
ProxyProtocol: ls.ProxyProtocol,
}
}

2
client/mcproxy/client_test.go
View File

@@ -219,7 +219,7 @@ func TestClientAddRemoveRoute(t *testing.T) {
ctx := context.Background()
// Add a new route.
err := client.AddRoute(ctx, ":443", "new.test", "127.0.0.1:9443")
err := client.AddRoute(ctx, ":443", Route{Hostname: "new.test", Backend: "127.0.0.1:9443"})
if err != nil {
t.Fatalf("AddRoute: %v", err)
}

48
cmd/mcproxyctl/routes.go
View File

@@ -6,6 +6,8 @@ import (
"time"
"github.com/spf13/cobra"
mcproxy "git.wntrmute.dev/kyle/mc-proxy/client/mcproxy"
)
func routesCmd() *cobra.Command {
@@ -45,7 +47,7 @@ func routesListCmd() *cobra.Command {
return nil
}
// Find max hostname length for alignment
// Find max hostname length for alignment.
maxHostLen := 0
for _, r := range routes {
if len(r.Hostname) > maxHostLen {
@@ -55,7 +57,18 @@ func routesListCmd() *cobra.Command {
fmt.Printf("Routes for %s:\n", listenerAddr)
for _, r := range routes {
fmt.Printf(" %-*s -> %s\n", maxHostLen, r.Hostname, r.Backend)
mode := r.Mode
if mode == "" {
mode = "l4"
}
extra := ""
if r.SendProxyProtocol {
extra += " [proxy-protocol]"
}
if r.BackendTLS {
extra += " [backend-tls]"
}
fmt.Printf(" %-*s -> %-25s [%s]%s\n", maxHostLen, r.Hostname, r.Backend, mode, extra)
}
return nil
@@ -64,7 +77,15 @@ func routesListCmd() *cobra.Command {
}
func routesAddCmd() *cobra.Command {
return &cobra.Command{
var (
mode string
tlsCert string
tlsKey string
backendTLS bool
sendProxyProtocol bool
)
cmd := &cobra.Command{
Use: "add LISTENER HOSTNAME BACKEND",
Short: "Add a route",
Long: "Add a route mapping a hostname to a backend for the specified listener.",
@@ -78,14 +99,31 @@ func routesAddCmd() *cobra.Command {
ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
defer cancel()
if err := client.AddRoute(ctx, listenerAddr, hostname, backend); err != nil {
route := mcproxy.Route{
Hostname: hostname,
Backend: backend,
Mode: mode,
TLSCert: tlsCert,
TLSKey: tlsKey,
BackendTLS: backendTLS,
SendProxyProtocol: sendProxyProtocol,
}
if err := client.AddRoute(ctx, listenerAddr, route); err != nil {
return fmt.Errorf("adding route: %w", err)
}
fmt.Printf("Added route: %s -> %s on %s\n", hostname, backend, listenerAddr)
fmt.Printf("Added route: %s -> %s on %s [%s]\n", hostname, backend, listenerAddr, mode)
return nil
},
}
cmd.Flags().StringVar(&mode, "mode", "l4", "route mode: l4 (passthrough) or l7 (TLS-terminating)")
cmd.Flags().StringVar(&tlsCert, "tls-cert", "", "TLS certificate path (L7 only)")
cmd.Flags().StringVar(&tlsKey, "tls-key", "", "TLS private key path (L7 only)")
cmd.Flags().BoolVar(&backendTLS, "backend-tls", false, "re-encrypt to backend (L7 only)")
cmd.Flags().BoolVar(&sendProxyProtocol, "send-proxy-protocol", false, "send PROXY v2 header to backend")
return cmd
}
func routesRemoveCmd() *cobra.Command {

65
gen/mc_proxy/v1/admin.pb.go
View File

@@ -1,7 +1,7 @@
// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// protoc-gen-go v1.36.11
// protoc v6.33.4
// protoc v5.29.5
// source: proto/mc_proxy/v1/admin.proto
package mcproxyv1
@@ -78,6 +78,11 @@ type Route struct {
state protoimpl.MessageState `protogen:"open.v1"`
Hostname string `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
Backend string `protobuf:"bytes,2,opt,name=backend,proto3" json:"backend,omitempty"`
Mode string `protobuf:"bytes,3,opt,name=mode,proto3" json:"mode,omitempty"` // "l4" (default) or "l7"
TlsCert string `protobuf:"bytes,4,opt,name=tls_cert,json=tlsCert,proto3" json:"tls_cert,omitempty"` // PEM certificate path (L7 only)
TlsKey string `protobuf:"bytes,5,opt,name=tls_key,json=tlsKey,proto3" json:"tls_key,omitempty"` // PEM private key path (L7 only)
BackendTls bool `protobuf:"varint,6,opt,name=backend_tls,json=backendTls,proto3" json:"backend_tls,omitempty"` // re-encrypt to backend (L7 only)
SendProxyProtocol bool `protobuf:"varint,7,opt,name=send_proxy_protocol,json=sendProxyProtocol,proto3" json:"send_proxy_protocol,omitempty"` // send PROXY v2 header to backend
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
@@ -126,6 +131,41 @@ func (x *Route) GetBackend() string {
return ""
}
func (x *Route) GetMode() string {
if x != nil {
return x.Mode
}
return ""
}
func (x *Route) GetTlsCert() string {
if x != nil {
return x.TlsCert
}
return ""
}
func (x *Route) GetTlsKey() string {
if x != nil {
return x.TlsKey
}
return ""
}
func (x *Route) GetBackendTls() bool {
if x != nil {
return x.BackendTls
}
return false
}
func (x *Route) GetSendProxyProtocol() bool {
if x != nil {
return x.SendProxyProtocol
}
return false
}
type ListRoutesRequest struct {
state protoimpl.MessageState `protogen:"open.v1"`
ListenerAddr string `protobuf:"bytes,1,opt,name=listener_addr,json=listenerAddr,proto3" json:"listener_addr,omitempty"`
@@ -695,6 +735,7 @@ type ListenerStatus struct {
Addr string `protobuf:"bytes,1,opt,name=addr,proto3" json:"addr,omitempty"`
RouteCount int32 `protobuf:"varint,2,opt,name=route_count,json=routeCount,proto3" json:"route_count,omitempty"`
ActiveConnections int64 `protobuf:"varint,3,opt,name=active_connections,json=activeConnections,proto3" json:"active_connections,omitempty"`
ProxyProtocol bool `protobuf:"varint,4,opt,name=proxy_protocol,json=proxyProtocol,proto3" json:"proxy_protocol,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
@@ -750,6 +791,13 @@ func (x *ListenerStatus) GetActiveConnections() int64 {
return 0
}
func (x *ListenerStatus) GetProxyProtocol() bool {
if x != nil {
return x.ProxyProtocol
}
return false
}
type GetStatusRequest struct {
state protoimpl.MessageState `protogen:"open.v1"`
unknownFields protoimpl.UnknownFields
@@ -858,10 +906,16 @@ var File_proto_mc_proxy_v1_admin_proto protoreflect.FileDescriptor
const file_proto_mc_proxy_v1_admin_proto_rawDesc = "" +
"\n" +
"\x1dproto/mc_proxy/v1/admin.proto\x12\vmc_proxy.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"=\n" +
"\x1dproto/mc_proxy/v1/admin.proto\x12\vmc_proxy.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"\xd6\x01\n" +
"\x05Route\x12\x1a\n" +
"\bhostname\x18\x01 \x01(\tR\bhostname\x12\x18\n" +
"\abackend\x18\x02 \x01(\tR\abackend\"8\n" +
"\abackend\x18\x02 \x01(\tR\abackend\x12\x12\n" +
"\x04mode\x18\x03 \x01(\tR\x04mode\x12\x19\n" +
"\btls_cert\x18\x04 \x01(\tR\atlsCert\x12\x17\n" +
"\atls_key\x18\x05 \x01(\tR\x06tlsKey\x12\x1f\n" +
"\vbackend_tls\x18\x06 \x01(\bR\n" +
"backendTls\x12.\n" +
"\x13send_proxy_protocol\x18\a \x01(\bR\x11sendProxyProtocol\"8\n" +
"\x11ListRoutesRequest\x12#\n" +
"\rlistener_addr\x18\x01 \x01(\tR\flistenerAddr\"e\n" +
"\x12ListRoutesResponse\x12#\n" +
@@ -886,12 +940,13 @@ const file_proto_mc_proxy_v1_admin_proto_rawDesc = "" +
"\x17AddFirewallRuleResponse\"J\n" +
"\x19RemoveFirewallRuleRequest\x12-\n" +
"\x04rule\x18\x01 \x01(\v2\x19.mc_proxy.v1.FirewallRuleR\x04rule\"\x1c\n" +
"\x1aRemoveFirewallRuleResponse\"t\n" +
"\x1aRemoveFirewallRuleResponse\"\x9b\x01\n" +
"\x0eListenerStatus\x12\x12\n" +
"\x04addr\x18\x01 \x01(\tR\x04addr\x12\x1f\n" +
"\vroute_count\x18\x02 \x01(\x05R\n" +
"routeCount\x12-\n" +
"\x12active_connections\x18\x03 \x01(\x03R\x11activeConnections\"\x12\n" +
"\x12active_connections\x18\x03 \x01(\x03R\x11activeConnections\x12%\n" +
"\x0eproxy_protocol\x18\x04 \x01(\bR\rproxyProtocol\"\x12\n" +
"\x10GetStatusRequest\"\xd0\x01\n" +
"\x11GetStatusResponse\x12\x18\n" +
"\aversion\x18\x01 \x01(\tR\aversion\x129\n" +

2
gen/mc_proxy/v1/admin_grpc.pb.go
View File

@@ -1,7 +1,7 @@
// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
// versions:
// - protoc-gen-go-grpc v1.6.1
// - protoc v6.33.4
// - protoc v5.29.5
// source: proto/mc_proxy/v1/admin.proto
package mcproxyv1

37
internal/grpcserver/grpcserver.go
View File

@@ -92,6 +92,11 @@ func (a *AdminServer) ListRoutes(_ context.Context, req *pb.ListRoutesRequest) (
resp.Routes = append(resp.Routes, &pb.Route{
Hostname: hostname,
Backend: route.Backend,
Mode: route.Mode,
TlsCert: route.TLSCert,
TlsKey: route.TLSKey,
BackendTls: route.BackendTLS,
SendProxyProtocol: route.SendProxyProtocol,
})
}
return resp, nil
@@ -118,17 +123,42 @@ func (a *AdminServer) AddRoute(_ context.Context, req *pb.AddRouteRequest) (*pb.
hostname := strings.ToLower(req.Route.Hostname)
// Normalize mode.
mode := req.Route.Mode
if mode == "" {
mode = "l4"
}
if mode != "l4" && mode != "l7" {
return nil, status.Errorf(codes.InvalidArgument, "mode must be \"l4\" or \"l7\", got %q", mode)
}
// L7 routes require cert/key paths.
if mode == "l7" {
if req.Route.TlsCert == "" || req.Route.TlsKey == "" {
return nil, status.Error(codes.InvalidArgument, "L7 routes require tls_cert and tls_key")
}
}
// Write-through: DB first, then memory.
if _, err := a.store.CreateRoute(ls.ID, hostname, req.Route.Backend, "l4", "", "", false, false); err != nil {
if _, err := a.store.CreateRoute(ls.ID, hostname, req.Route.Backend, mode,
req.Route.TlsCert, req.Route.TlsKey, req.Route.BackendTls, req.Route.SendProxyProtocol); err != nil {
return nil, status.Errorf(codes.AlreadyExists, "%v", err)
}
if err := ls.AddRoute(hostname, server.RouteInfo{Backend: req.Route.Backend, Mode: "l4"}); err != nil {
info := server.RouteInfo{
Backend: req.Route.Backend,
Mode: mode,
TLSCert: req.Route.TlsCert,
TLSKey: req.Route.TlsKey,
BackendTLS: req.Route.BackendTls,
SendProxyProtocol: req.Route.SendProxyProtocol,
}
if err := ls.AddRoute(hostname, info); err != nil {
// DB succeeded but memory failed (should not happen since DB enforces uniqueness).
a.logger.Error("inconsistency: DB write succeeded but memory update failed", "error", err)
}
a.logger.Info("route added", "listener", ls.Addr, "hostname", hostname, "backend", req.Route.Backend)
a.logger.Info("route added", "listener", ls.Addr, "hostname", hostname, "backend", req.Route.Backend, "mode", mode)
return &pb.AddRouteResponse{}, nil
}
@@ -287,6 +317,7 @@ func (a *AdminServer) GetStatus(_ context.Context, _ *pb.GetStatusRequest) (*pb.
Addr: ls.Addr,
RouteCount: int32(len(routes)),
ActiveConnections: ls.ActiveConnections.Load(),
ProxyProtocol: ls.ProxyProtocol,
})
}

159
internal/grpcserver/grpcserver_test.go
View File

@@ -517,3 +517,162 @@ func TestRemoveFirewallRuleNotFound(t *testing.T) {
t.Fatal("expected error for removing nonexistent rule")
}
}
func TestAddRouteL7(t *testing.T) {
env := setup(t)
ctx := context.Background()
_, err := env.client.AddRoute(ctx, &pb.AddRouteRequest{
ListenerAddr: ":443",
Route: &pb.Route{
Hostname: "l7.test",
Backend: "127.0.0.1:8080",
Mode: "l7",
TlsCert: "/certs/l7.crt",
TlsKey: "/certs/l7.key",
BackendTls: false,
SendProxyProtocol: true,
},
})
if err != nil {
t.Fatalf("AddRoute L7: %v", err)
}
// Verify in-memory via ListRoutes.
resp, err := env.client.ListRoutes(ctx, &pb.ListRoutesRequest{ListenerAddr: ":443"})
if err != nil {
t.Fatalf("ListRoutes: %v", err)
}
var found *pb.Route
for _, r := range resp.Routes {
if r.Hostname == "l7.test" {
found = r
break
}
}
if found == nil {
t.Fatal("L7 route not found in ListRoutes response")
}
if found.Mode != "l7" {
t.Fatalf("mode = %q, want %q", found.Mode, "l7")
}
if found.TlsCert != "/certs/l7.crt" {
t.Fatalf("tls_cert = %q, want %q", found.TlsCert, "/certs/l7.crt")
}
if found.TlsKey != "/certs/l7.key" {
t.Fatalf("tls_key = %q, want %q", found.TlsKey, "/certs/l7.key")
}
if found.BackendTls {
t.Fatal("expected backend_tls = false")
}
if !found.SendProxyProtocol {
t.Fatal("expected send_proxy_protocol = true")
}
// Verify DB persistence.
dbListeners, _ := env.store.ListListeners()
dbRoutes, _ := env.store.ListRoutes(dbListeners[0].ID)
var dbRoute *db.Route
for i := range dbRoutes {
if dbRoutes[i].Hostname == "l7.test" {
dbRoute = &dbRoutes[i]
break
}
}
if dbRoute == nil {
t.Fatal("L7 route not found in DB")
}
if dbRoute.Mode != "l7" {
t.Fatalf("DB mode = %q, want %q", dbRoute.Mode, "l7")
}
if !dbRoute.SendProxyProtocol {
t.Fatal("DB send_proxy_protocol should be true")
}
}
func TestAddRouteL7MissingCert(t *testing.T) {
env := setup(t)
ctx := context.Background()
_, err := env.client.AddRoute(ctx, &pb.AddRouteRequest{
ListenerAddr: ":443",
Route: &pb.Route{
Hostname: "nocert.test",
Backend: "127.0.0.1:8080",
Mode: "l7",
},
})
if err == nil {
t.Fatal("expected error for L7 route without cert/key")
}
if s, ok := status.FromError(err); !ok || s.Code() != codes.InvalidArgument {
t.Fatalf("expected InvalidArgument, got %v", err)
}
}
func TestAddRouteInvalidMode(t *testing.T) {
env := setup(t)
ctx := context.Background()
_, err := env.client.AddRoute(ctx, &pb.AddRouteRequest{
ListenerAddr: ":443",
Route: &pb.Route{
Hostname: "badmode.test",
Backend: "127.0.0.1:8080",
Mode: "l5",
},
})
if err == nil {
t.Fatal("expected error for invalid mode")
}
if s, ok := status.FromError(err); !ok || s.Code() != codes.InvalidArgument {
t.Fatalf("expected InvalidArgument, got %v", err)
}
}
func TestAddRouteDefaultsToL4(t *testing.T) {
env := setup(t)
ctx := context.Background()
// Add route without specifying mode — should default to "l4".
_, err := env.client.AddRoute(ctx, &pb.AddRouteRequest{
ListenerAddr: ":443",
Route: &pb.Route{
Hostname: "default.test",
Backend: "127.0.0.1:9443",
},
})
if err != nil {
t.Fatalf("AddRoute: %v", err)
}
resp, _ := env.client.ListRoutes(ctx, &pb.ListRoutesRequest{ListenerAddr: ":443"})
for _, r := range resp.Routes {
if r.Hostname == "default.test" {
if r.Mode != "l4" {
t.Fatalf("mode = %q, want %q", r.Mode, "l4")
}
return
}
}
t.Fatal("route not found")
}
func TestGetStatusProxyProtocol(t *testing.T) {
env := setup(t)
ctx := context.Background()
resp, err := env.client.GetStatus(ctx, &pb.GetStatusRequest{})
if err != nil {
t.Fatalf("GetStatus: %v", err)
}
// The seeded listener has proxy_protocol = false.
if len(resp.Listeners) != 1 {
t.Fatalf("got %d listeners, want 1", len(resp.Listeners))
}
if resp.Listeners[0].ProxyProtocol {
t.Fatal("expected proxy_protocol = false")
}
}

6
proto/mc_proxy/v1/admin.proto
View File

@@ -26,6 +26,11 @@ service ProxyAdminService {
message Route {
string hostname = 1;
string backend = 2;
string mode = 3; // "l4" (default) or "l7"
string tls_cert = 4; // PEM certificate path (L7 only)
string tls_key = 5; // PEM private key path (L7 only)
bool backend_tls = 6; // re-encrypt to backend (L7 only)
bool send_proxy_protocol = 7; // send PROXY v2 header to backend
}
message ListRoutesRequest {
@@ -89,6 +94,7 @@ message ListenerStatus {
string addr = 1;
int32 route_count = 2;
int64 active_connections = 3;
bool proxy_protocol = 4;
}
message GetStatusRequest {}