bhuvan-somisetty opened a new issue, #14116:
URL: https://github.com/apache/apisix/issues/14116
### Current Behavior
When configuring a stream route with the `traffic-split` plugin that
specifies an inline upstream with `"scheme": "tls"` (or upstream client
certificates for mTLS), `apisix/upstream.lua` short-circuits the upstream setup
in `_M.set_by_route`:
```lua
if api_ctx.upstream_conf then
-- upstream_conf has been set by traffic-split plugin
return set_http_upstream_tls(api_ctx, api_ctx.upstream_conf)
end
```
In the stream (L4) subsystem (`is_http` is `false`), this early return
invokes `set_http_upstream_tls()` (which only handles `https` and `grpcs`
schemes) and exits immediately. Consequently, the stream subsystem upstream
initialization block is completely bypassed:
1. `fill_node_info(up_conf, nil, true)` is never executed for the inline
upstream.
2. `set_stream_upstream_tls()` is never called, so APISIX fails to trigger
the upstream TLS handshake and instead initiates a plaintext TCP connection to
the upstream TLS server.
3. `ngx_var.upstream_sni` and `set_stream_upstream_client_cert(api_ctx,
up_conf)` are skipped, preventing upstream SNI and client certificate mTLS
configuration from being applied.
### Expected Behavior
When a stream route uses `traffic-split` with an inline upstream,
`_M.set_by_route` should recognize the stream subsystem and invoke the stream
upstream configuration (`fill_node_info`, `set_stream_upstream_tls`,
`set_stream_upstream_client_cert`, and health checker registration if
applicable) instead of calling `set_http_upstream_tls`.
### Error Logs
The stream proxy connection fails or gets rejected by the upstream TLS
server because APISIX connects via plaintext TCP rather than completing a TLS
handshake:
```text
[error] peer closed connection in SSL handshake (or handshake failure /
plaintext connection rejected by TLS upstream)
```
### Steps to Reproduce
1. Configure an upstream TCP server listening with TLS enabled (e.g. port
8765 with SSL certificates).
2. Create a stream route with `traffic-split` plugin using an inline
upstream having `scheme: "tls"`:
```bash
curl http://127.0.0.1:9180/apisix/admin/stream_routes/1 -H 'X-API-KEY:
edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '{
"plugins": {
"traffic-split": {
"rules": [
{
"weighted_upstreams": [
{
"upstream": {
"name": "stream-tls-inline",
"type": "roundrobin",
"scheme": "tls",
"nodes": {
"127.0.0.1:8765": 1
}
},
"weight": 1
}
]
}
]
}
}
}'
```
3. Send a TCP connection to the stream route.
4. Observe that APISIX proxies via plaintext TCP instead of TLS handshake,
causing the upstream TLS connection to fail.
### Environment
- APISIX version: master / 3.11.0
- Operating system: Linux / Windows
- OpenResty / Nginx version: openresty/1.25.3.1
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
