feat(ssl): added timeout option

passthrough functionality for "TLS handshake timeout".  Envoy has supported this [for a bit](envoyproxy/envoy#13610), and this
PR will allow gloo-edge to support the functionality as well.

[Referenced Documentation Here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener_components.proto#config-listener-v3-filterchain)

closes solo-io#5438

changelog/v1.10.0-beta2/add-tls-timeout.yaml

@@ -0,0 +1,5 @@
+changelog:
+  - type: NEW_FEATURE
+    issueLink: https://github.com/solo-io/gloo/issues/5438
+    resolvesIssue: true
+    description: TLS handshake timeout is now configurable.

docs/content/reference/api/github.com/solo-io/gloo/projects/gloo/api/v1/ssl.proto.sk.md

@@ -45,6 +45,7 @@ SslConfig contains the options necessary to configure a virtual host or listener
 "alpnProtocols": []string
 "oneWayTls": .google.protobuf.BoolValue
 "disableTlsSessionResumption": .google.protobuf.BoolValue
+"transportSocketConnectTimeout": .google.protobuf.Duration
 
 ```
 
@@ -59,6 +60,7 @@ SslConfig contains the options necessary to configure a virtual host or listener
 | `alpnProtocols` | `[]string` | Set Application Level Protocol Negotiation If empty, defaults to ["h2", "http/1.1"]. |
 | `oneWayTls` | [.google.protobuf.BoolValue](https://developers.google.com/protocol-buffers/docs/reference/csharp/class/google/protobuf/well-known-types/bool-value) | If the SSL config has the ca.crt (root CA) provided, Gloo uses it to perform mTLS by default. Set oneWayTls to true to disable mTLS in favor of server-only TLS (one-way TLS), even if Gloo has the root CA. If unset, defaults to false. |
 | `disableTlsSessionResumption` | [.google.protobuf.BoolValue](https://developers.google.com/protocol-buffers/docs/reference/csharp/class/google/protobuf/well-known-types/bool-value) | If set to true, the TLS session resumption will be deactivated, note that it deactivates only the tickets based tls session resumption (not the cache). |
+| `transportSocketConnectTimeout` | [.google.protobuf.Duration](https://developers.google.com/protocol-buffers/docs/reference/csharp/class/google/protobuf/well-known-types/duration) | If present and nonzero, the amount of time to allow incoming connections to complete any transport socket negotiations. If this expires before the transport reports connection establishment, the connection is summarily closed. |
 
 
 

install/helm/gloo/crds/gateway.solo.io_v1_Gateway.yaml

@@ -2133,6 +2133,8 @@ spec:
                                 tlsKey:
                                   type: string
                               type: object
+                            transportSocketConnectTimeout:
+                              type: string
                             verifySubjectAltName:
                               items:
                                 type: string

install/helm/gloo/crds/gateway.solo.io_v1_VirtualService.yaml

@@ -102,6 +102,8 @@ spec:
                       tlsKey:
                         type: string
                     type: object
+                  transportSocketConnectTimeout:
+                    type: string
                   verifySubjectAltName:
                     items:
                       type: string

install/helm/gloo/crds/gloo.solo.io_v1_Proxy.yaml

@@ -5166,6 +5166,8 @@ spec:
                               tlsKey:
                                 type: string
                             type: object
+                          transportSocketConnectTimeout:
+                            type: string
                           verifySubjectAltName:
                             items:
                               type: string
@@ -6569,6 +6571,8 @@ spec:
                                       tlsKey:
                                         type: string
                                     type: object
+                                  transportSocketConnectTimeout:
+                                    type: string
                                   verifySubjectAltName:
                                     items:
                                       type: string

projects/gloo/api/v1/ssl.proto

@@ -2,6 +2,7 @@ syntax = "proto3";
 package gloo.solo.io;
 option go_package = "github.com/solo-io/gloo/projects/gloo/pkg/api/v1";
 
+import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
 import "extproto/ext.proto";
@@ -41,6 +42,11 @@ message SslConfig {
 
     // If set to true, the TLS session resumption will be deactivated, note that it deactivates only the tickets based tls session resumption (not the cache).
     google.protobuf.BoolValue disable_tls_session_resumption = 9;
+
+    // If present and nonzero, the amount of time to allow incoming connections to complete any
+    // transport socket negotiations. If this expires before the transport reports connection
+    // establishment, the connection is summarily closed.
+    google.protobuf.Duration transport_socket_connect_timeout = 10;
 }
 
 // SSLFiles reference paths to certificates which can be read by the proxy off of its local filesystem