NET-6821 Disable Terminating Gateway Auto Host Header Rewrite

.changelog/20802.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Add ability to disable Auto Host Header Rewrite on Terminating Gateway at the service level
+```

agent/consul/state/catalog.go

@@ -3757,14 +3757,15 @@ func terminatingConfigGatewayServices(
 			return false, nil, fmt.Errorf("failed to get gateway service kind for service %s: %v", svc.Name, err)
 		}
 		mapping := &structs.GatewayService{
-			Gateway:     gateway,
-			Service:     structs.NewServiceName(svc.Name, &svc.EnterpriseMeta),
-			GatewayKind: structs.ServiceKindTerminatingGateway,
-			KeyFile:     svc.KeyFile,
-			CertFile:    svc.CertFile,
-			CAFile:      svc.CAFile,
-			SNI:         svc.SNI,
-			ServiceKind: kind,
+			Gateway:         gateway,
+			Service:         structs.NewServiceName(svc.Name, &svc.EnterpriseMeta),
+			GatewayKind:     structs.ServiceKindTerminatingGateway,
+			KeyFile:         svc.KeyFile,
+			CertFile:        svc.CertFile,
+			CAFile:          svc.CAFile,
+			SNI:             svc.SNI,
+			ServiceKind:     kind,
+			AutoHostRewrite: !svc.DisableAutoHostRewrite,
 		}
 
 		gatewayServices = append(gatewayServices, mapping)

agent/consul/state/catalog_test.go

@@ -9089,3 +9089,43 @@ func assertDeepEqual(t *testing.T, x, y interface{}, opts ...cmp.Option) {
 		t.Fatalf("assertion failed: values are not equal\n--- expected\n+++ actual\n%v", diff)
 	}
 }
+
+func Test_terminatingConfigGatewayServices(t *testing.T) {
+	s := testConfigStateStore(t)
+
+	cfg := &structs.TerminatingGatewayConfigEntry{
+		Kind: structs.TerminatingGateway,
+		Name: "terminating-gateway",
+		Services: []structs.LinkedService{
+			{
+				Name: "service-default-behavior",
+			},
+			{
+				Name:                   "service-disabled-behavior",
+				DisableAutoHostRewrite: true,
+			},
+		},
+	}
+
+	expected := structs.GatewayServices{
+		&structs.GatewayService{
+			Gateway:         structs.ServiceName{Name: "terminating-gateway"},
+			Service:         structs.ServiceName{Name: "service-default-behavior"},
+			GatewayKind:     "terminating-gateway",
+			AutoHostRewrite: true,
+		},
+		&structs.GatewayService{
+			Gateway:         structs.ServiceName{Name: "terminating-gateway"},
+			Service:         structs.ServiceName{Name: "service-disabled-behavior"},
+			GatewayKind:     "terminating-gateway",
+			AutoHostRewrite: false,
+		},
+	}
+
+	txn := s.db.Txn(false)
+
+	_, services, err := terminatingConfigGatewayServices(txn, structs.ServiceName{Name: "terminating-gateway"}, cfg, nil)
+	require.NoError(t, err)
+	require.Equal(t, services, expected)
+
+}

agent/proxycfg/testing_terminating_gateway.go

@@ -160,20 +160,24 @@ func TestConfigSnapshotTerminatingGateway(t testing.T, populateServices bool, ns
 
 		tgtwyServices = append(tgtwyServices,
 			&structs.GatewayService{
-				Service: web,
-				CAFile:  "ca.cert.pem",
+				Service:         web,
+				CAFile:          "ca.cert.pem",
+				AutoHostRewrite: true,
 			},
 			&structs.GatewayService{
-				Service:  api,
-				CAFile:   "ca.cert.pem",
-				CertFile: "api.cert.pem",
-				KeyFile:  "api.key.pem",
+				Service:         api,
+				CAFile:          "ca.cert.pem",
+				CertFile:        "api.cert.pem",
+				KeyFile:         "api.key.pem",
+				AutoHostRewrite: true,
 			},
 			&structs.GatewayService{
-				Service: db,
+				Service:         db,
+				AutoHostRewrite: true,
 			},
 			&structs.GatewayService{
-				Service: cache,
+				Service:         cache,
+				AutoHostRewrite: true,
 			},
 		)
 
@@ -359,26 +363,31 @@ func TestConfigSnapshotTerminatingGatewayDestinations(t testing.T, populateDesti
 	if populateDestinations {
 		tgtwyServices = append(tgtwyServices,
 			&structs.GatewayService{
-				Service:     externalIPTCP,
-				ServiceKind: structs.GatewayServiceKindDestination,
+				Service:         externalIPTCP,
+				ServiceKind:     structs.GatewayServiceKindDestination,
+				AutoHostRewrite: true,
 			},
 			&structs.GatewayService{
-				Service:     externalHostnameTCP,
-				ServiceKind: structs.GatewayServiceKindDestination,
+				Service:         externalHostnameTCP,
+				ServiceKind:     structs.GatewayServiceKindDestination,
+				AutoHostRewrite: true,
 			},
 			&structs.GatewayService{
-				Service:     externalIPHTTP,
-				ServiceKind: structs.GatewayServiceKindDestination,
+				Service:         externalIPHTTP,
+				ServiceKind:     structs.GatewayServiceKindDestination,
+				AutoHostRewrite: true,
 			},
 			&structs.GatewayService{
-				Service:     externalHostnameHTTP,
-				ServiceKind: structs.GatewayServiceKindDestination,
+				Service:         externalHostnameHTTP,
+				ServiceKind:     structs.GatewayServiceKindDestination,
+				AutoHostRewrite: true,
 			},
 			&structs.GatewayService{
-				Service:     externalHostnameWithSNI,
-				ServiceKind: structs.GatewayServiceKindDestination,
-				CAFile:      "cert.pem",
-				SNI:         "api.test.com",
+				Service:         externalHostnameWithSNI,
+				ServiceKind:     structs.GatewayServiceKindDestination,
+				CAFile:          "cert.pem",
+				SNI:             "api.test.com",
+				AutoHostRewrite: true,
 			},
 		)
 
@@ -713,16 +722,18 @@ func TestConfigSnapshotTerminatingGatewaySNI(t testing.T) *ConfigSnapshot {
 			Result: &structs.IndexedGatewayServices{
 				Services: []*structs.GatewayService{
 					{
-						Service: structs.NewServiceName("web", nil),
-						CAFile:  "ca.cert.pem",
-						SNI:     "foo.com",
+						Service:         structs.NewServiceName("web", nil),
+						CAFile:          "ca.cert.pem",
+						SNI:             "foo.com",
+						AutoHostRewrite: true,
 					},
 					{
-						Service:  structs.NewServiceName("api", nil),
-						CAFile:   "ca.cert.pem",
-						CertFile: "api.cert.pem",
-						KeyFile:  "api.key.pem",
-						SNI:      "bar.com",
+						Service:         structs.NewServiceName("api", nil),
+						CAFile:          "ca.cert.pem",
+						CertFile:        "api.cert.pem",
+						KeyFile:         "api.key.pem",
+						SNI:             "bar.com",
+						AutoHostRewrite: true,
 					},
 				},
 			},
@@ -739,8 +750,9 @@ func TestConfigSnapshotTerminatingGatewayHTTP2(t testing.T) *ConfigSnapshot {
 			Result: &structs.IndexedGatewayServices{
 				Services: []*structs.GatewayService{
 					{
-						Service: web,
-						CAFile:  "ca.cert.pem",
+						Service:         web,
+						CAFile:          "ca.cert.pem",
+						AutoHostRewrite: true,
 					},
 				},
 			},
@@ -799,8 +811,9 @@ func TestConfigSnapshotTerminatingGatewaySubsetsHTTP2(t testing.T) *ConfigSnapsh
 			Result: &structs.IndexedGatewayServices{
 				Services: []*structs.GatewayService{
 					{
-						Service: web,
-						CAFile:  "ca.cert.pem",
+						Service:         web,
+						CAFile:          "ca.cert.pem",
+						AutoHostRewrite: true,
 					},
 				},
 			},

agent/structs/config_entry_gateways.go

@@ -518,6 +518,9 @@ type LinkedService struct {
 	// SNI is the optional name to specify during the TLS handshake with a linked service
 	SNI string `json:",omitempty"`
 
+	//DisableAutoHostRewrite disables terminating gateways auto host rewrite feature when set to true.
+	DisableAutoHostRewrite bool `json:",omitempty"`
+
 	acl.EnterpriseMeta `hcl:",squash" mapstructure:",squash"`
 }
 
@@ -668,6 +671,7 @@ type GatewayService struct {
 	FromWildcard bool               `json:",omitempty"`
 	ServiceKind  GatewayServiceKind `json:",omitempty"`
 	RaftIndex
+	AutoHostRewrite bool `json:",omitempty"`
 }
 
 type GatewayServices []*GatewayService

agent/xds/routes.go

@@ -158,11 +158,13 @@ func (s *ResourceGenerator) routesForTerminatingGateway(cfgSnap *proxycfg.Config
 				"error", err,
 			)
 		}
+		service := cfgSnap.TerminatingGateway.GatewayServices[svc]
+		autoHostRewrite := service.AutoHostRewrite
 		if !structs.IsProtocolHTTPLike(cfg.Protocol) {
 			// Routes can only be defined for HTTP services
 			continue
 		}
-		routes, err := s.makeRoutes(cfgSnap, svc, clusterName, true)
+		routes, err := s.makeRoutes(cfgSnap, svc, clusterName, autoHostRewrite)
 		if err != nil {
 			return nil, err
 		}
@@ -231,7 +233,7 @@ func (s *ResourceGenerator) makeRoutes(
 	// If there is a service-resolver for this service then also setup routes for each subset
 	for name := range resolver.Subsets {
 		clusterName = connect.ServiceSNI(svc.Name, name, svc.NamespaceOrDefault(), svc.PartitionOrDefault(), cfgSnap.Datacenter, cfgSnap.Roots.TrustDomain)
-		route, err := makeNamedDefaultRouteWithLB(clusterName, lb, resolver.RequestTimeout, true)
+		route, err := makeNamedDefaultRouteWithLB(clusterName, lb, resolver.RequestTimeout, autoHostRewrite)
 		if err != nil {
 			s.Logger.Error("failed to make route", "cluster", clusterName, "error", err)
 			return nil, err

api/config_entry_gateways.go

@@ -195,6 +195,9 @@ type TerminatingGatewayConfigEntry struct {
 type LinkedService struct {
 	// Referencing other partitions is not supported.
 
+	//DisableAutoHostRewrite disables terminating gateways auto host rewrite feature when set to true.
+	DisableAutoHostRewrite bool `json:",omitempty"`
+
 	// Namespace is where the service is registered.
 	Namespace string `json:",omitempty"`
 

website/content/docs/connect/config-entries/terminating-gateway.mdx

@@ -679,6 +679,12 @@ spec:
           `An optional hostname or domain name to specify during the TLS handshake. This option will also configure [strict SAN matching](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#envoy-v3-api-field-extensions-transport-sockets-tls-v3-certificatevalidationcontext-match-typed-subject-alt-names), which requires
             the external services to have certificates with SANs, not having which will result in \`CERTIFICATE_VERIFY_FAILED\` error.`,
         },
+        {
+          name: 'DisableAutoHostRewrite',
+          type: 'bool: ""',
+          description:
+            'When set to true, Terminating Gateway will not modify the incoming requests host header for this service.',
+        },
       ],
     },
   ]}