Proxying the client <-> server GRPC connection.

[nickgautier]

Dear Flare community,

we have a use case that requires the client <-> server connection be proxied. In addition we have the following requirements:

• The server name is fixed a priori and cannot be set to the proxy address.
• The client certificate can be passed along by the proxy, however the proxy will not have it's own certificate. I'm unsure as to how this will affect validation of the certificate chain.

We've thought about:

• Host aliases on the client side, would only work with fixed IP proxies. We could make that work.
• Using a GRPC gateway to move to JSON for the communication, not sure how this will play with payload size & signing though.
• Intercepting the traffic and routing it to the proxy url.

Any ideas are welcome, thank you! I'm happy to provide more context on requirements should this not be sufficient.

[nickgautier]

Thanks to help from the Flare team we achieved this by leveraging the CommConfigurator. It can be configured by placing a comm_config.json file in the workspace. We used the following settings:

{
     "grpc": {
        "options": [
          [
            "grpc.http_proxy", "http://<proxy-host>:<proxy-port>"
          ]
        ]
      }
    }

This will make the grpc client initiate a CONNECT request to the proxy address. This allows for an L7 proxy using SSL tunneling. Here's a good explanation. This requires building nginx with a 3rd party module. Here's a reference Dockerfile that will provide a lean image. The corresponding nginx configuration will look something like:

server {
          proxy_connect;
          proxy_connect_allow            <proxy-port>;
          proxy_connect_connect_timeout  5s;
          proxy_connect_read_timeout     5s;
          proxy_connect_send_timeout     5s;

          listen 8002;

          access_log /logs logs;
        }