mirror of https://github.com/agent-substrate/substrate.git synced 2026-10-02 03:24:42 +08:00

Files

T

History

Lior Lieberman 944096fa21 Passthrough dial address resolved by the gateway (#2045 )

The passthrough chain from #2019 dialed the ORIGINAL_DST filter state,
which the CONNECT leg filled with the address the actor connected to.
The SNI picked the chain, the actor's own resolution picked the
destination, so a passthrough rule for one name let an actor reach any
IP by claiming that name in the ClientHello.

We fix it by:

- The passthrough chain is now `sni_dynamic_forward_proxy` then
`tcp_proxy` to a new raw forward-proxy cluster,
`egress_forward_proxy_passthrough`, on the shared egress_dns_cache. The
gateway resolves the SNI itself and sends the bytes to it.

- The CONNECT leg answers the dialed port under
dev.ate.egress:dialed_port; the outer chain copies it into
envoy.upstream.dynamic_port, shared with the inner listener, which both
the SNI filter and the cluster read before their configured port.

> It's a good idea to open an issue first for discussion.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR

2026-10-01 18:50:20 +00:00

dynamic-modules/egress-policy

Passthrough dial address resolved by the gateway (#2045 )

2026-10-01 18:50:20 +00:00

Dockerfile

Fix the kind install on arm64 hosts (#1869 )

2026-09-25 01:36:37 +00:00

README.md

Pin envoy-dataplane from the release on a pre-built install (#1964 )

2026-09-29 21:58:58 +00:00

README.md

Envoy Dataplane Image

This directory contains the build definition and custom extensions for the Envoy dataplane container image (envoy-dataplane) used by Agent Substrate's atenet-egress gateway.

Directory Contents

cmd/dataplane/envoy/
├── Dockerfile                       # Multi-stage build for the Envoy dataplane image
└── dynamic-modules/
    └── egress-policy/               # Rust Envoy Dynamic Module for egress policy enforcement

Dockerfile: Multi-stage container build that:
1. Compiles the Rust dynamic module (envoy-substrate-egress-policy) into a shared library (libenvoy_substrate_egress_policy.so) in a rust:bookworm builder stage.
2. Packages the compiled .so into the envoyproxy/envoy:v1.39-latest runtime image under /usr/local/lib/libenvoy_substrate_egress_policy.so and sets ENVOY_DYNAMIC_MODULES_SEARCH_PATH=/usr/local/lib.
dynamic-modules/egress-policy/: A Rust crate using the Envoy Dynamic Modules SDK (envoy-proxy-dynamic-modules-rust-sdk) that implements a custom Envoy listener filter for Substrate egress policy evaluation. See dynamic-modules/egress-policy/README.md for module-specific build, test, and Envoy configuration details.

Building and Deployment

During a build from source, ate-setup builds the image from this directory via docker buildx, pushes it to $KO_DOCKER_REPO/envoy-dataplane, and its resolved digest replaces the ${ENVOY_DATAPLANE_IMAGE} placeholder in the egress manifests (manifests/ate-install/atenet-egress*.yaml).

A pre-built install (ate-setup deploy --image-repo REPO --image-tag TAG) builds nothing and pins REPO/envoy-dataplane:TAG instead, so a release publishes it with the other images:

make build-release-images KO_DOCKER_REPO=REPO VERSION=TAG

make build-envoy-dataplane builds just this image. It targets KO_DEFAULTPLATFORMS, or linux/amd64 when unset; set DOCKERFILE_PLATFORMS to override. Building another architecture compiles Rust under QEMU, which must be registered with binfmt (e.g. docker run --privileged --rm tonistiigi/binfmt --install arm64).

To build the image locally without pushing it:

docker buildx build -t envoy-dataplane cmd/dataplane/envoy