[sfc-gh-pkowalewski]

Problem

A proxy policy can only allow or deny a call. Some setups need the policy to hand information about its decision to the target, for example which rule allowed the request, so the target can act on it. Request metadata is the natural place for that, but the proxy opens the stream to the target before it authorizes the first request, and gRPC sends metadata when a stream opens, so there is no moment where a policy result can be attached.

Solution

A policy or hook can now set TargetMetadata on the authorization input, and the proxy sends it with the call to the target.

To authorize before the stream opens, the new NewCredentialsDialer records the identity each target presents during the TLS handshake, which is the same identity policies see today. The proxy authorizes the first request with it and then opens the stream with the metadata attached.

Metadata cannot change once a stream is open, so a later request that produces different metadata closes the stream. The proxy binary switches to the new dialer. The existing dialer keeps its current behaviour and rejects calls whose policy sets metadata.

sequenceDiagram
    participant C as Client
    participant P as Proxy
    participant T as Target

    C->>P: Request
    P->>T: Connect (TLS handshake)
    T-->>P: Target identity
    Note over P: Authorize the first request.<br/>The policy may set TargetMetadata.
    P->>T: Open stream with TargetMetadata
    P->>T: First request
    T-->>P: Response
    P-->>C: Response
    C->>P: Later request
    Note over P: Authorize again. If TargetMetadata<br/>differs, close with PermissionDenied.
    P->>T: Later request

Loading

Testing

The existing proxy tests now run through the new dialer and pass, also with the race detector.

New tests check that the metadata reaches the target for unary, server streaming and bidirectional calls, that a client stream with no requests still works, that a mid stream change is rejected, and that the old dialer refuses calls that set metadata. Two more check that an unreachable target still reports the underlying connection error and that a cancelled call returns Canceled. Each new test fails when the behaviour it covers is removed.

I also deployed the change to a staging proxy with a hook that sets metadata on one method. The target received it on that method only, the end to end suite passed, streaming, fan out and dry run calls behaved as before, and error rates did not change.

go test ./... passes apart from TestServerWithUnixCredentials, which fails the same way on main on macOS because it depends on local group membership.