fix(proxy): restore happy-eyeballs for TLS upstream dial#4236
Open
Gauravsingh096 wants to merge 1 commit into
Open
fix(proxy): restore happy-eyeballs for TLS upstream dial#4236Gauravsingh096 wants to merge 1 commit into
Gauravsingh096 wants to merge 1 commit into
Conversation
Commit 2916804 changed the dial-target guard from if dstURL != "" to if dstAddr == "" && dstURL != "" to fix Aerospike-over-stunnel (SNI "aerospike.local" is unresolvable, so dialing by hostname failed with "lookup ... server misbehaving"). Side-effect: for plain HTTPS connections (e.g. express-mongoose → reqres.in) the eBPF-captured original destination is the Cloudflare IPv6 literal the app connected to. Without the SNI-hostname fallback the proxy dials that IPv6 literal directly; on CI runners with no IPv6 route this produces "dial tcp [...]:443: connect: network is unreachable", which is logged at ERROR and trips the test script's grep -q "ERROR" record_log && exit 1 gate — failing the express-mongoose record_build jobs 5/5. Fix: prefer the SNI hostname when net.LookupHost resolves it (real hostnames like "reqres.in" resolve → happy-eyeballs → IPv4 fallback). For unresolvable cert names ("aerospike.local"), LookupHost returns an error and we keep the authoritative eBPF-captured dstAddr unchanged — Aerospike-over-stunnel is unaffected. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Describe the changes that are made
Fixed a regression in the TLS upstream dial-target selection in
pkg/agent/proxy/proxy.gothat causedexpress-mongoose record_buildCI jobs to fail 5/5.Root cause: commit
2916804changed the guard fromif dstURL != ""toif dstAddr == "" && dstURL != ""to fix Aerospike-over-stunnel (SNIaerospike.localis not DNS-resolvable, so dialing by hostname failed with "lookup ... server misbehaving"). Side effect: for plain HTTPS connections (e.g. express-mongoose →reqres.in), eBPF captures the Cloudflare IPv6 literal[2606:4700:20::681a:ad5]:443as the original destination. With the new guard,dstAddris non-empty so the hostname branch is skipped — the proxy dials the IPv6 literal directly. GitHub Actions runners have no IPv6 route →dial tcp [...]:443: connect: network is unreachable→ logged atERROR→ node test script'sgrep -q "ERROR"gate fails the build.Fix: use
net.LookupHost(dstURL)to decide which target to dial:reqres.in) resolve → dial by hostname → Go's dual-stack happy-eyeballs → IPv4 fallback on IPv6-less runners ✅aerospike.local) don't resolve →LookupHosterrors → keep eBPF-captureddstAddr→ Aerospike-stunnel unaffected ✅Links & References
Closes: NA
🔗 Related PRs
🐞 Related Issues
📄 Related Documents
What type of PR is this? (check all applicable)
Added e2e test pipeline?
Added comments for hard-to-understand areas?
Added to documentation?
Are there any sample code or steps to test the changes?