Config switch to turn on/off Quic processing

api/envoy/config/listener/v3/quic_config.proto

@@ -2,6 +2,8 @@ syntax = "proto3";
 
 package envoy.config.listener.v3;
 
+import "envoy/config/core/v3/base.proto";
+
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
@@ -16,7 +18,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // [#protodoc-title: QUIC listener Config]
 
 // Configuration specific to the QUIC protocol.
-// Next id: 4
+// Next id: 5
 message QuicProtocolOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.listener.QuicProtocolOptions";
@@ -32,4 +34,8 @@ message QuicProtocolOptions {
   // Connection timeout in milliseconds before the crypto handshake is finished.
   // 20000ms if not specified.
   google.protobuf.Duration crypto_handshake_timeout = 3;
+
+  // Runtime flag that controls whether the listener is enabled or not. If not specified, defaults
+  // to enabled.
+  core.v3.RuntimeFeatureFlag enabled = 4;
 }

source/extensions/quic_listeners/quiche/BUILD

@@ -274,6 +274,7 @@ envoy_cc_library(
         "//include/envoy/network:listener_interface",
         "//source/common/network:listener_lib",
         "//source/common/protobuf:utility_lib",
+        "//source/common/runtime:runtime_lib",
         "//source/server:connection_handler_lib",
         "@envoy_api//envoy/config/listener/v3:pkg_cc_proto",
     ],

source/extensions/quic_listeners/quiche/active_quic_listener.cc

@@ -20,20 +20,22 @@ ActiveQuicListener::ActiveQuicListener(Event::Dispatcher& dispatcher,
                                        Network::ConnectionHandler& parent,
                                        Network::ListenerConfig& listener_config,
                                        const quic::QuicConfig& quic_config,
-                                       Network::Socket::OptionsSharedPtr options)
+                                       Network::Socket::OptionsSharedPtr options,
+                                       const envoy::config::core::v3::RuntimeFeatureFlag enabled)
     : ActiveQuicListener(dispatcher, parent,
                          listener_config.listenSocketFactory().getListenSocket(), listener_config,
-                         quic_config, std::move(options)) {}
+                         quic_config, std::move(options), enabled) {}
 
 ActiveQuicListener::ActiveQuicListener(Event::Dispatcher& dispatcher,
                                        Network::ConnectionHandler& parent,
                                        Network::SocketSharedPtr listen_socket,
                                        Network::ListenerConfig& listener_config,
                                        const quic::QuicConfig& quic_config,
-                                       Network::Socket::OptionsSharedPtr options)
+                                       Network::Socket::OptionsSharedPtr options,
+                                       const envoy::config::core::v3::RuntimeFeatureFlag enabled)
     : Server::ConnectionHandlerImpl::ActiveListenerImplBase(parent, &listener_config),
       dispatcher_(dispatcher), version_manager_(quic::CurrentSupportedVersions()),
-      listen_socket_(*listen_socket) {
+      listen_socket_(*listen_socket), enabled_(enabled, Runtime::LoaderSingleton::get()) {
   if (options != nullptr) {
     const bool ok = Network::Socket::applyOptions(
         options, listen_socket_, envoy::config::core::v3::SocketOption::STATE_BOUND);
@@ -93,6 +95,10 @@ void ActiveQuicListener::onData(Network::UdpRecvData& data) {
 }
 
 void ActiveQuicListener::onReadReady() {
+  if (!enabled()) {
+    ENVOY_LOG(trace, "Quic listener {}: runtime disabled", config_->name());
+    return;
+  }
   quic_dispatcher_->ProcessBufferedChlos(kNumSessionsToCreatePerLoop);
 }
 
@@ -112,7 +118,7 @@ void ActiveQuicListener::shutdownListener() {
 
 ActiveQuicListenerFactory::ActiveQuicListenerFactory(
     const envoy::config::listener::v3::QuicProtocolOptions& config, uint32_t concurrency)
-    : concurrency_(concurrency) {
+    : concurrency_(concurrency), enabled_(config.enabled()) {
   uint64_t idle_network_timeout_ms =
       config.has_idle_timeout() ? DurationUtil::durationToMilliseconds(config.idle_timeout())
                                 : 300000;
@@ -192,7 +198,7 @@ ActiveQuicListenerFactory::createActiveUdpListener(Network::ConnectionHandler& p
   }
 #endif
   return std::make_unique<ActiveQuicListener>(disptacher, parent, config, quic_config_,
-                                              std::move(options));
+                                              std::move(options), enabled_);
 }
 
 } // namespace Quic

source/extensions/quic_listeners/quiche/active_quic_listener.h

@@ -3,9 +3,11 @@
 #include "envoy/config/listener/v3/quic_config.pb.h"
 #include "envoy/network/connection_handler.h"
 #include "envoy/network/listener.h"
+#include "envoy/runtime/runtime.h"
 
 #include "common/network/socket_option_impl.h"
 #include "common/protobuf/utility.h"
+#include "common/runtime/runtime_protos.h"
 
 #include "server/connection_handler_impl.h"
 
@@ -25,12 +27,14 @@ class ActiveQuicListener : public Network::UdpListenerCallbacks,
 
   ActiveQuicListener(Event::Dispatcher& dispatcher, Network::ConnectionHandler& parent,
                      Network::ListenerConfig& listener_config, const quic::QuicConfig& quic_config,
-                     Network::Socket::OptionsSharedPtr options);
+                     Network::Socket::OptionsSharedPtr options,
+                     const envoy::config::core::v3::RuntimeFeatureFlag enabled);
 
   ActiveQuicListener(Event::Dispatcher& dispatcher, Network::ConnectionHandler& parent,
                      Network::SocketSharedPtr listen_socket,
                      Network::ListenerConfig& listener_config, const quic::QuicConfig& quic_config,
-                     Network::Socket::OptionsSharedPtr options);
+                     Network::Socket::OptionsSharedPtr options,
+                     const envoy::config::core::v3::RuntimeFeatureFlag enabled);
 
   ~ActiveQuicListener() override;
 
@@ -50,6 +54,8 @@ class ActiveQuicListener : public Network::UdpListenerCallbacks,
   void resumeListening() override;
   void shutdownListener() override;
 
+  bool enabled() { return enabled_.enabled(); }
+
 private:
   friend class ActiveQuicListenerPeer;
 
@@ -60,6 +66,7 @@ class ActiveQuicListener : public Network::UdpListenerCallbacks,
   quic::QuicVersionManager version_manager_;
   std::unique_ptr<EnvoyQuicDispatcher> quic_dispatcher_;
   Network::Socket& listen_socket_;
+  Runtime::FeatureFlag enabled_;
 };
 
 using ActiveQuicListenerPtr = std::unique_ptr<ActiveQuicListener>;
@@ -83,6 +90,7 @@ class ActiveQuicListenerFactory : public Network::ActiveUdpListenerFactory,
   quic::QuicConfig quic_config_;
   const uint32_t concurrency_;
   absl::once_flag install_bpf_once_;
+  envoy::config::core::v3::RuntimeFeatureFlag enabled_;
 };
 
 } // namespace Quic

test/extensions/quic_listeners/quiche/BUILD

@@ -150,6 +150,7 @@ envoy_cc_test(
         "//test/test_common:environment_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:simulated_time_system_lib",
+        "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
     ],
 )
 

test/extensions/quic_listeners/quiche/active_quic_listener_config_test.cc

@@ -15,6 +15,10 @@ class ActiveQuicListenerFactoryPeer {
   static quic::QuicConfig& quicConfig(ActiveQuicListenerFactory& factory) {
     return factory.quic_config_;
   }
+  static envoy::config::core::v3::RuntimeFeatureFlag&
+  runtimeEnabled(ActiveQuicListenerFactory& factory) {
+    return factory.enabled_;
+  }
 };
 
 TEST(ActiveQuicListenerConfigTest, CreateActiveQuicListenerFactory) {
@@ -29,6 +33,9 @@ TEST(ActiveQuicListenerConfigTest, CreateActiveQuicListenerFactory) {
     idle_timeout: {
       seconds: 2
     }
+    enabled:
+      default_value: true
+      runtime_key: foo_key
   )EOF";
   TestUtility::loadFromYaml(yaml, *config);
   Network::ActiveUdpListenerFactoryPtr listener_factory =
@@ -41,6 +48,35 @@ TEST(ActiveQuicListenerConfigTest, CreateActiveQuicListenerFactory) {
   EXPECT_EQ(2000u, quic_config.IdleNetworkTimeout().ToMilliseconds());
   // Default value if not present in config.
   EXPECT_EQ(20000u, quic_config.max_time_before_crypto_handshake().ToMilliseconds());
+  envoy::config::core::v3::RuntimeFeatureFlag& runtime_enabled =
+      ActiveQuicListenerFactoryPeer::runtimeEnabled(
+          dynamic_cast<ActiveQuicListenerFactory&>(*listener_factory));
+  EXPECT_EQ(true, runtime_enabled.default_value().value());
+  EXPECT_EQ("foo_key", runtime_enabled.runtime_key());
+}
+
+TEST(ActiveQuicListenerConfigTest, QuicListenerFlagNotConfigured) {
+  std::string listener_name = QuicListenerName;
+  auto& config_factory =
+      Config::Utility::getAndCheckFactoryByName<Server::ActiveUdpListenerConfigFactory>(
+          listener_name);
+  ProtobufTypes::MessagePtr config = config_factory.createEmptyConfigProto();
+
+  std::string yaml = R"EOF(
+    max_concurrent_streams: 10
+    idle_timeout: {
+      seconds: 2
+    }
+  )EOF";
+  TestUtility::loadFromYaml(yaml, *config);
+  Network::ActiveUdpListenerFactoryPtr listener_factory =
+      config_factory.createActiveUdpListenerFactory(*config, /*concurrency=*/1);
+  EXPECT_NE(nullptr, listener_factory);
+  envoy::config::core::v3::RuntimeFeatureFlag& runtime_enabled =
+      ActiveQuicListenerFactoryPeer::runtimeEnabled(
+          dynamic_cast<ActiveQuicListenerFactory&>(*listener_factory));
+  EXPECT_EQ(false, runtime_enabled.default_value().value());
+  EXPECT_EQ("", runtime_enabled.runtime_key());
 }
 
 } // namespace Quic

test/extensions/quic_listeners/quiche/active_quic_listener_test.cc

@@ -8,6 +8,9 @@
 
 #include <memory>
 
+#include "envoy/config/core/v3/base.pb.h"
+#include "envoy/config/core/v3/base.pb.validate.h"
+
 #include "quiche/quic/core/crypto/crypto_protocol.h"
 #include "quiche/quic/test_tools/crypto_test_utils.h"
 #include "quiche/quic/test_tools/quic_dispatcher_peer.h"
@@ -23,6 +26,7 @@
 #include "test/test_common/simulated_time_system.h"
 #include "test/test_common/environment.h"
 #include "test/mocks/network/mocks.h"
+#include "test/mocks/runtime/mocks.h"
 #include "test/test_common/utility.h"
 #include "test/test_common/network_utility.h"
 #include "absl/time/time.h"
@@ -57,19 +61,28 @@ class ActiveQuicListenerTest : public testing::TestWithParam<Network::Address::I
       : version_(GetParam()), api_(Api::createApiForTest(simulated_time_system_)),
         dispatcher_(api_->allocateDispatcher("test_thread")), clock_(*dispatcher_),
         local_address_(Network::Test::getCanonicalLoopbackAddress(version_)),
-        connection_handler_(*dispatcher_) {}
+        connection_handler_(*dispatcher_) {
+    Runtime::LoaderSingleton::initialize(&runtime_);
+  }
 
   void SetUp() override {
     listen_socket_ =
         std::make_shared<Network::UdpListenSocket>(local_address_, nullptr, /*bind*/ true);
     listen_socket_->addOptions(Network::SocketOptionFactory::buildIpPacketInfoOptions());
     listen_socket_->addOptions(Network::SocketOptionFactory::buildRxQueueOverFlowOptions());
 
-    quic_listener_ = std::make_unique<ActiveQuicListener>(
-        *dispatcher_, connection_handler_, listen_socket_, listener_config_, quic_config_, nullptr);
+    quic_listener_ = std::make_unique<ActiveQuicListener>(*dispatcher_, connection_handler_,
+                                                          listen_socket_, listener_config_,
+                                                          quic_config_, nullptr, enabledFlag());
+    quic_dispatcher_ = ActiveQuicListenerPeer::quic_dispatcher(*quic_listener_);
     simulated_time_system_.advanceTimeWait(std::chrono::milliseconds(100));
   }
 
+  void configureQuicRuntimeFlag(bool runtime_enabled) {
+    EXPECT_CALL(runtime_.snapshot_, getBoolean("quic.enabled", true))
+        .WillRepeatedly(Return(runtime_enabled));
+  }
+
   void configureMocks(int connection_count) {
     EXPECT_CALL(listener_config_, filterChainManager())
         .Times(connection_count)
@@ -116,7 +129,7 @@ class ActiveQuicListenerTest : public testing::TestWithParam<Network::Address::I
 
   // TODO(bencebeky): Factor out parts common with
   // EnvoyQuicDispatcherTest::createFullChloPacket() to test_utils.
-  void SendFullCHLO(quic::QuicConnectionId connection_id) {
+  void sendFullCHLO(quic::QuicConnectionId connection_id) {
     client_sockets_.push_back(std::make_unique<Socket>(local_address_, nullptr, /*bind*/ false));
     quic::CryptoHandshakeMessage chlo = quic::test::crypto_test_utils::GenerateDefaultInchoateCHLO(
         &clock_, quic::AllSupportedVersions()[0].transport_version,
@@ -185,6 +198,18 @@ class ActiveQuicListenerTest : public testing::TestWithParam<Network::Address::I
     quic_listener_->onListenerShutdown();
     // Trigger alarm to fire before listener destruction.
     dispatcher_->run(Event::Dispatcher::RunType::NonBlock);
+    Runtime::LoaderSingleton::clear();
+  }
+
+protected:
+  envoy::config::core::v3::RuntimeFeatureFlag enabledFlag() const {
+    envoy::config::core::v3::RuntimeFeatureFlag enabled_proto;
+    std::string yaml(R"EOF(
+runtime_key: "quic.enabled"
+default_value: true
+)EOF");
+    TestUtility::loadFromYamlAndValidate(yaml, enabled_proto);
+    return enabled_proto;
   }
 
   Network::Address::IpVersion version_;
@@ -201,6 +226,8 @@ class ActiveQuicListenerTest : public testing::TestWithParam<Network::Address::I
   quic::QuicConfig quic_config_;
   Server::ConnectionHandlerImpl connection_handler_;
   std::unique_ptr<ActiveQuicListener> quic_listener_;
+  EnvoyQuicDispatcher* quic_dispatcher_;
+  NiceMock<Runtime::MockLoader> runtime_;
 
   std::list<std::unique_ptr<Socket>> client_sockets_;
   std::list<std::shared_ptr<Network::MockReadFilter>> read_filters_;
@@ -221,30 +248,33 @@ TEST_P(ActiveQuicListenerTest, FailSocketOptionUponCreation) {
       .WillOnce(Return(false));
   auto options = std::make_shared<std::vector<Network::Socket::OptionConstSharedPtr>>();
   options->emplace_back(std::move(option));
-  EXPECT_THROW_WITH_REGEX(std::make_unique<ActiveQuicListener>(*dispatcher_, connection_handler_,
-                                                               listen_socket_, listener_config_,
-                                                               quic_config_, options),
-                          EnvoyException, "Failed to apply socket options.");
+  EXPECT_THROW_WITH_REGEX(
+      std::make_unique<ActiveQuicListener>(*dispatcher_, connection_handler_, listen_socket_,
+                                           listener_config_, quic_config_, options, enabledFlag()),
+      EnvoyException, "Failed to apply socket options.");
 }
 
 TEST_P(ActiveQuicListenerTest, ReceiveFullQuicCHLO) {
+  quic::QuicBufferedPacketStore* const buffered_packets =
+      quic::test::QuicDispatcherPeer::GetBufferedPackets(quic_dispatcher_);
+  configureQuicRuntimeFlag(/* runtime_enabled = */ true);
   configureMocks(/* connection_count = */ 1);
-  SendFullCHLO(quic::test::TestConnectionId(1));
+  sendFullCHLO(quic::test::TestConnectionId(1));
   dispatcher_->run(Event::Dispatcher::RunType::NonBlock);
+  EXPECT_FALSE(buffered_packets->HasChlosBuffered());
+  EXPECT_FALSE(quic_dispatcher_->session_map().empty());
   ReadFromClientSockets();
 }
 
 TEST_P(ActiveQuicListenerTest, ProcessBufferedChlos) {
-  EnvoyQuicDispatcher* const envoy_quic_dispatcher =
-      ActiveQuicListenerPeer::quic_dispatcher(*quic_listener_);
   quic::QuicBufferedPacketStore* const buffered_packets =
-      quic::test::QuicDispatcherPeer::GetBufferedPackets(envoy_quic_dispatcher);
-
+      quic::test::QuicDispatcherPeer::GetBufferedPackets(quic_dispatcher_);
+  configureQuicRuntimeFlag(/* runtime_enabled = */ true);
   configureMocks(ActiveQuicListener::kNumSessionsToCreatePerLoop + 2);
 
   // Generate one more CHLO than can be processed immediately.
   for (size_t i = 1; i <= ActiveQuicListener::kNumSessionsToCreatePerLoop + 1; ++i) {
-    SendFullCHLO(quic::test::TestConnectionId(i));
+    sendFullCHLO(quic::test::TestConnectionId(i));
   }
   dispatcher_->run(Event::Dispatcher::RunType::NonBlock);
 
@@ -256,9 +286,10 @@ TEST_P(ActiveQuicListenerTest, ProcessBufferedChlos) {
   EXPECT_TRUE(buffered_packets->HasBufferedPackets(
       quic::test::TestConnectionId(ActiveQuicListener::kNumSessionsToCreatePerLoop + 1)));
   EXPECT_TRUE(buffered_packets->HasChlosBuffered());
+  EXPECT_FALSE(quic_dispatcher_->session_map().empty());
 
   // Generate more data to trigger a socket read during the next event loop.
-  SendFullCHLO(quic::test::TestConnectionId(ActiveQuicListener::kNumSessionsToCreatePerLoop + 2));
+  sendFullCHLO(quic::test::TestConnectionId(ActiveQuicListener::kNumSessionsToCreatePerLoop + 2));
   dispatcher_->run(Event::Dispatcher::RunType::NonBlock);
 
   // The socket read results in processing all CHLOs.
@@ -270,5 +301,13 @@ TEST_P(ActiveQuicListenerTest, ProcessBufferedChlos) {
   ReadFromClientSockets();
 }
 
+TEST_P(ActiveQuicListenerTest, QuicProcessingDisabled) {
+  configureQuicRuntimeFlag(/* runtime_enabled = */ false);
+  sendFullCHLO(quic::test::TestConnectionId(1));
+  dispatcher_->run(Event::Dispatcher::RunType::NonBlock);
+  // If listener was enabled, there should have been session created for active connection.
+  EXPECT_TRUE(quic_dispatcher_->session_map().empty());
+}
+
 } // namespace Quic
 } // namespace Envoy