Kyle Isom
b6c96ad42f
Multi-hop integration tests (server package): - TestMultiHopProxyProtocol: full edge→origin deployment with two mc-proxy instances. Edge uses L4 passthrough with send_proxy_protocol, origin has proxy_protocol listener with L7 route. Verifies the real client IP (127.0.0.1) flows through PROXY protocol into the origin's X-Forwarded-For header on the h2c backend. - TestMultiHopFirewallBlocksRealIP: origin firewall blocks an IP from the PROXY header while allowing the TCP peer (edge proxy). Verifies the backend is never reached. L7 package integration tests: - TestL7LargeResponse: 1 MB response through the reverse proxy. - TestL7GRPCTrailers: HTTP/2 trailer propagation (Grpc-Status, Grpc-Message) through the reverse proxy, validating gRPC compatibility. - TestL7HTTP11Fallback: client negotiates HTTP/1.1 only (no h2 ALPN), verifies the proxy falls back to HTTP/1.1 serving and still forwards to the h2c backend successfully. Also updates PROGRESS.md to mark all five phases complete. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
68 lines
3.0 KiB
Markdown
68 lines
3.0 KiB
Markdown
# PROGRESS.md
|
|
|
|
Tracks implementation status against PROJECT_PLAN.md. Updated as work
|
|
proceeds. Each item is marked:
|
|
|
|
- `[ ]` not started
|
|
- `[~]` in progress
|
|
- `[x]` complete
|
|
- `[—]` skipped (with reason)
|
|
|
|
---
|
|
|
|
## Phase 1: Database & Config Foundation
|
|
|
|
- [x] 1.1 Config struct updates (`Listener.ProxyProtocol`, `Route.Mode/TLSCert/TLSKey/BackendTLS/SendProxyProtocol`)
|
|
- [x] 1.2 Config validation updates (L7 requires cert/key, mode enum, cert/key pair loading)
|
|
- [x] 1.3 Database migration v2 (new columns on `listeners` and `routes`)
|
|
- [x] 1.4 DB struct and CRUD updates (new fields in `Listener`, `Route`, all queries)
|
|
- [x] 1.5 Server data loading (`RouteInfo` struct replaces bare backend string in route lookup)
|
|
- [x] 1.6 Tests (config, DB migration, CRUD, server unchanged)
|
|
|
|
## Phase 2: PROXY Protocol
|
|
|
|
- [x] 2.1 `internal/proxyproto/` package (v1/v2 parser, v2 writer)
|
|
- [x] 2.2 Server integration — receive (parse PROXY header before firewall on enabled listeners)
|
|
- [x] 2.3 Server integration — send on L4 (write PROXY v2 header before ClientHello on enabled routes)
|
|
- [x] 2.4 Tests (receive, send, firewall uses real IP, malformed header rejection)
|
|
|
|
## Phase 3: L7 Proxying
|
|
|
|
- [x] 3.1 `internal/l7/` package (`PrefixConn`, HTTP/2 reverse proxy with h2c, `Serve` entry point)
|
|
- [x] 3.2 Server integration (dispatch to L4 or L7 based on `route.Mode` in `handleConn`)
|
|
- [x] 3.3 PROXY protocol sending in L7 path
|
|
- [x] 3.4 Tests (TLS termination, h2c backend, re-encrypt, mixed L4/L7 listener, gRPC through L7)
|
|
|
|
## Phase 4: gRPC API & CLI Updates
|
|
|
|
- [x] 4.1 Proto updates (new fields on `Route`, `AddRouteRequest`, `ListenerStatus`)
|
|
- [x] 4.2 gRPC server updates (accept/validate/persist new route fields)
|
|
- [x] 4.3 Client package updates (new fields on `Route`, `ListenerStatus`)
|
|
- [x] 4.4 mcproxyctl updates (flags for `routes add`, display in `routes list`)
|
|
- [x] 4.5 Tests (gRPC round-trip with new fields, backward compatibility)
|
|
|
|
## Phase 5: Integration & Polish
|
|
|
|
- [x] 5.1 Dev config update (`srv/mc-proxy.toml` with L7 route example)
|
|
- [x] 5.2 Multi-hop integration test (edge→origin via PROXY protocol)
|
|
- [x] 5.3 gRPC-through-L7 validation (trailer propagation, large responses)
|
|
- [x] 5.4 Web UI through L7 validation (HTTP/1.1 fallback, HTTP/2)
|
|
- [x] 5.5 Documentation (verified ARCHITECTURE.md, CLAUDE.md, Makefile)
|
|
|
|
---
|
|
|
|
## Current State
|
|
|
|
All five phases are complete. The codebase implements the full dual-mode
|
|
(L4/L7) architecture with PROXY protocol support:
|
|
|
|
- L4 passthrough: SNI extraction, raw TCP relay (original behavior)
|
|
- L7 terminating: TLS termination, HTTP/2 reverse proxy with h2c backends
|
|
- PROXY protocol: v1/v2 receive on listeners, v2 send on routes
|
|
- Per-route mode selection: L4 and L7 routes coexist on the same listener
|
|
- gRPC admin API: full CRUD for routes with L7 fields, PROXY protocol flags
|
|
- CLI tools: `mcproxyctl routes add` with `--mode`, `--tls-cert`, etc.
|
|
- Multi-hop deployment tested: edge→origin with real client IP preservation
|
|
|
|
`go vet` and `go test` pass across all 13 packages.
|