[WIP] Tmp code to verify xDS HTTP Connect end-to-end

allows nested transport_sockets = RawBuffer
grpc · sergiitk · Jan 24, 2026 · Jan 24, 2026 · Jan 26, 2026 · Jan 24, 2026
commit 9dcf939af640b50ea590b1735bf4a9a4eb2867ff
diff --git a/xds/src/main/java/io/grpc/xds/MessagePrinter.java b/xds/src/main/java/io/grpc/xds/MessagePrinter.java
@@ -35,6 +35,8 @@
 import io.envoyproxy.envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager;
 import io.envoyproxy.envoy.extensions.load_balancing_policies.round_robin.v3.RoundRobin;
 import io.envoyproxy.envoy.extensions.load_balancing_policies.wrr_locality.v3.WrrLocality;
+import io.envoyproxy.envoy.extensions.transport_sockets.http_11_proxy.v3.Http11ProxyUpstreamTransport;
+import io.envoyproxy.envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer;
 import io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext;
 import io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext;
 import io.envoyproxy.envoy.service.discovery.v3.Resource;
@@ -72,8 +74,12 @@ private static JsonFormat.Printer newPrinter() {
               .add(ClusterConfig.getDescriptor())
               .add(ClusterLoadAssignment.getDescriptor())
               .add(WrrLocality.getDescriptor())
-              .add(TypedStruct.getDescriptor())
-              .add(RoundRobin.getDescriptor());
+              .add(RoundRobin.getDescriptor())
+              // Transports
+              .add(Http11ProxyUpstreamTransport.getDescriptor())
+              .add(RawBuffer.getDescriptor())
+              // Always last, guarding the semicolon.
+              .add(TypedStruct.getDescriptor());
       try {
         @SuppressWarnings("unchecked")
         Class<? extends Message> routeLookupClusterSpecifierClass =

diff --git a/xds/src/main/java/io/grpc/xds/XdsClusterResource.java b/xds/src/main/java/io/grpc/xds/XdsClusterResource.java
@@ -83,6 +83,8 @@ class XdsClusterResource extends XdsResourceType<CdsUpdate> {
   static final String TRANSPORT_SOCKET_NAME_HTTP11_PROXY =
       "type.googleapis.com/envoy.extensions.transport_sockets.http_11_proxy.v3"
           + ".Http11ProxyUpstreamTransport";
+  static final String TRANSPORT_SOCKET_NAME_RAW_BUFFER =
+      "type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer";
   private final LoadBalancerRegistry loadBalancerRegistry
       = LoadBalancerRegistry.getDefaultRegistry();
 
@@ -260,15 +262,21 @@ private static StructOrError<CdsUpdate.Builder> parseNonAggregateCluster(
     boolean hasTransportSocket = cluster.hasTransportSocket();
     TransportSocket transportSocket = cluster.getTransportSocket();
 
-    if (hasTransportSocket && !TRANSPORT_SOCKET_NAME_TLS.equals(transportSocket.getName())
-        && !(isEnabledXdsHttpConnect
-        && TRANSPORT_SOCKET_NAME_HTTP11_PROXY.equals(transportSocket.getName()))) {
+
+    String transportSocketName = hasTransportSocket ? transportSocket.getName() : "<invalid>";
+    boolean socketIsTls = transportSocketName.equals(TRANSPORT_SOCKET_NAME_TLS);
+    boolean socketIsH1Proxy = transportSocketName.equals(TRANSPORT_SOCKET_NAME_HTTP11_PROXY);
+    boolean supportSocketIsH1Proxy = isEnabledXdsHttpConnect && socketIsH1Proxy;
+
+    if (hasTransportSocket && !socketIsTls && !supportSocketIsH1Proxy) {
       return StructOrError.fromError(
-          "transport-socket with name " + transportSocket.getName() + " not supported.");
+          "transport-socket with name " + transportSocketName + " not supported, socketIsTls="
+              + socketIsTls + ", socketIsH1Proxy=" + socketIsH1Proxy
+              + ", isEnabledXdsHttpConnect=" + isEnabledXdsHttpConnect
+              + ", supportSocketIsH1Proxy=" + supportSocketIsH1Proxy + ".");
     }
 
-    if (hasTransportSocket && isEnabledXdsHttpConnect
-        && TRANSPORT_SOCKET_NAME_HTTP11_PROXY.equals(transportSocket.getName())) {
+    if (hasTransportSocket && supportSocketIsH1Proxy) {
       isHttp11ProxyAvailable = true;
       try {
         Http11ProxyUpstreamTransport wrappedTransportSocket = transportSocket

diff --git a/xds/src/test/java/io/grpc/xds/GrpcXdsClientImplDataTest.java b/xds/src/test/java/io/grpc/xds/GrpcXdsClientImplDataTest.java
@@ -19,6 +19,7 @@
 import static com.google.common.truth.Truth.assertThat;
 import static io.envoyproxy.envoy.config.route.v3.RouteAction.ClusterSpecifierCase.CLUSTER_SPECIFIER_PLUGIN;
 import static io.grpc.xds.XdsClusterResource.TRANSPORT_SOCKET_NAME_HTTP11_PROXY;
+import static io.grpc.xds.XdsClusterResource.TRANSPORT_SOCKET_NAME_RAW_BUFFER;
 import static io.grpc.xds.XdsEndpointResource.GRPC_EXPERIMENTAL_XDS_DUALSTACK_ENDPOINTS;
 import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.fail;
@@ -97,6 +98,7 @@
 import io.envoyproxy.envoy.extensions.load_balancing_policies.client_side_weighted_round_robin.v3.ClientSideWeightedRoundRobin;
 import io.envoyproxy.envoy.extensions.load_balancing_policies.wrr_locality.v3.WrrLocality;
 import io.envoyproxy.envoy.extensions.transport_sockets.http_11_proxy.v3.Http11ProxyUpstreamTransport;
+import io.envoyproxy.envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer;
 import io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstance;
 import io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext;
 import io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CommonTlsContext;
@@ -2639,6 +2641,50 @@ public void parseNonAggregateCluster_withHttp11ProxyTransportSocket() throws Exc
     assertThat(result.isHttp11ProxyAvailable()).isTrue();
   }
 
+  /**
+   * Http11ProxyUpstreamTransport with transport_socket=RawBuffer must behave the same as
+   * when transport_socket is unset.
+   */
+  @Test
+  public void parseNonAggregateCluster_withHttp11ProxyTransportSocket_rawBuffer() throws Exception {
+    XdsClusterResource.isEnabledXdsHttpConnect = true;
+
+    // Nested transport_socket (Http11ProxyUpstreamTransport.transport_socket).
+    TransportSocket transportSocketRawBuffer = TransportSocket.newBuilder()
+        .setName(TRANSPORT_SOCKET_NAME_RAW_BUFFER)
+        .setTypedConfig(Any.pack(RawBuffer.getDefaultInstance()))
+        .build();
+
+    Http11ProxyUpstreamTransport http11ProxyUpstreamTransport =
+        Http11ProxyUpstreamTransport.newBuilder()
+            .setTransportSocket(transportSocketRawBuffer)
+            .build();
+
+    TransportSocket transportSocket = TransportSocket.newBuilder()
+        .setName(TRANSPORT_SOCKET_NAME_HTTP11_PROXY)
+        .setTypedConfig(Any.pack(http11ProxyUpstreamTransport))
+        .build();
+
+    Cluster cluster = Cluster.newBuilder()
+        .setName("cluster-http11-proxy.googleapis.com")
+        .setType(DiscoveryType.EDS)
+        .setEdsClusterConfig(
+            EdsClusterConfig.newBuilder()
+                .setEdsConfig(
+                    ConfigSource.newBuilder().setAds(AggregatedConfigSource.getDefaultInstance()))
+                .setServiceName("service-http11-proxy.googleapis.com"))
+        .setLbPolicy(LbPolicy.ROUND_ROBIN)
+        .setTransportSocket(transportSocket)
+        .build();
+
+    CdsUpdate result =
+        XdsClusterResource.processCluster(cluster, null, LRS_SERVER_INFO,
+            LoadBalancerRegistry.getDefaultRegistry());
+
+    assertThat(result).isNotNull();
+    assertThat(result.isHttp11ProxyAvailable()).isTrue();
+  }
+
   @Test
   public void processCluster_parsesOrcaLrsPropagationMetrics() throws ResourceInvalidException {
     LoadStatsManager2.isEnabledOrcaLrsPropagation = true;

diff --git a/xds/third_party/envoy/import.sh b/xds/third_party/envoy/import.sh
@@ -96,6 +96,7 @@ envoy/extensions/load_balancing_policies/ring_hash/v3/ring_hash.proto
 envoy/extensions/load_balancing_policies/round_robin/v3/round_robin.proto
 envoy/extensions/load_balancing_policies/wrr_locality/v3/wrr_locality.proto
 envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto
+envoy/extensions/transport_sockets/raw_buffer/v3/raw_buffer.proto
 envoy/extensions/transport_sockets/tls/v3/cert.proto
 envoy/extensions/transport_sockets/tls/v3/common.proto
 envoy/extensions/transport_sockets/tls/v3/secret.proto

diff --git a/...ty/envoy/src/main/proto/envoy/extensions/transport_sockets/raw_buffer/v3/raw_buffer.proto b/...ty/envoy/src/main/proto/envoy/extensions/transport_sockets/raw_buffer/v3/raw_buffer.proto
@@ -0,0 +1,21 @@
+syntax = "proto3";
+
+package envoy.extensions.transport_sockets.raw_buffer.v3;
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.transport_sockets.raw_buffer.v3";
+option java_outer_classname = "RawBufferProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/raw_buffer/v3;raw_bufferv3";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Raw Buffer]
+// [#extension: envoy.transport_sockets.raw_buffer]
+
+// Configuration for raw buffer transport socket.
+message RawBuffer {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.config.transport_socket.raw_buffer.v2.RawBuffer";
+}