Preserve original src ip

This is based on #28363, and with other fixes: adjust listener filters order,  route local net, added an integration test
Fix: https://github.com/istio/istio/issues/5679
For more details: https://github.com/istio/istio/pull/28363#issuecomment-718485392
RFC: https://docs.google.com/document/d/1fd9XWe755XtwNJCxpQe19oU1K6VR_wECB8uerWyu1xQ/edit?usp=sharing

@hzxuzhonghu: PR needs rebase.

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

/test all

@hzxuzhonghu: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

release-notes_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test release-notes_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

release-notes_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test release-notes_istio

unit-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

release-notes_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test release-notes_istio

unit-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test unit-tests_istio

lint_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

release-notes_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test release-notes_istio

unit-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test unit-tests_istio

lint_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test lint_istio

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

release-notes_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test release-notes_istio

unit-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test unit-tests_istio

lint_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test lint_istio

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-telemetry-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

release-notes_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test release-notes_istio

unit-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test unit-tests_istio

lint_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test lint_istio

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-pilot-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

release-notes_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test release-notes_istio

unit-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test unit-tests_istio

lint_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test lint_istio

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-pilot-k8s-tests_istio

integ-distroless-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-distroless-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

release-notes_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test release-notes_istio

unit-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test unit-tests_istio

lint_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test lint_istio

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-pilot-k8s-tests_istio

integ-distroless-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-distroless-k8s-tests_istio

integ-operator-controller-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-operator-controller-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

release-notes_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test release-notes_istio

unit-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test unit-tests_istio

lint_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test lint_istio

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-pilot-k8s-tests_istio

integ-distroless-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-distroless-k8s-tests_istio

integ-operator-controller-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-operator-controller-tests_istio

integ-ipv6-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-ipv6-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

release-notes_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test release-notes_istio

unit-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test unit-tests_istio

lint_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test lint_istio

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-pilot-k8s-tests_istio

integ-distroless-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-distroless-k8s-tests_istio

integ-operator-controller-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-operator-controller-tests_istio

integ-ipv6-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-ipv6-k8s-tests_istio

integ-multicluster-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-multicluster-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

analyze-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test analyze-tests_istio

unit-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test unit-tests_istio

lint_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test lint_istio

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-pilot-k8s-tests_istio

integ-distroless-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-distroless-k8s-tests_istio

integ-operator-controller-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-operator-controller-tests_istio

integ-ipv6-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-ipv6-k8s-tests_istio

integ-multicluster-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-multicluster-k8s-tests_istio

release-notes_istio
b2d26a957b46b823d340091c8a83e76a84c4218f
link
/test release-notes_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

unit-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test unit-tests_istio

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-pilot-k8s-tests_istio

integ-distroless-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-distroless-k8s-tests_istio

integ-operator-controller-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-operator-controller-tests_istio

integ-ipv6-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-ipv6-k8s-tests_istio

integ-multicluster-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-multicluster-k8s-tests_istio

release-notes_istio
b2d26a957b46b823d340091c8a83e76a84c4218f
link
/test release-notes_istio

analyze-tests_istio
b2d26a957b46b823d340091c8a83e76a84c4218f
link
/test analyze-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

cc @gmemcc  @rlenglet @howardjohn

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-telemetry-k8s-tests_istio

analyze-tests_istio
b2d26a957b46b823d340091c8a83e76a84c4218f
link
/test analyze-tests_istio

release-notes_istio
9e1e9dc8a9839fc9d8adb91009c3c50eceea84fb
link
/test release-notes_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-telemetry-k8s-tests_istio

gencheck_istio
9a5ceb6586f63ecb956261b9b5cac6a59edcf363
link
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
254848924f0c96e4908643eef1295159a30027ec
link
/test integ-telemetry-k8s-tests_istio

gencheck_istio
9a5ceb6586f63ecb956261b9b5cac6a59edcf363
link
/test gencheck_istio

integ-multicluster-k8s-tests_istio
9a5ceb6586f63ecb956261b9b5cac6a59edcf363
link
/test integ-multicluster-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest

@hzxuzhonghu: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-operator-controller-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-operator-controller-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-operator-controller-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-operator-controller-tests_istio

integ-ipv6-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-ipv6-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-operator-controller-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-operator-controller-tests_istio

integ-ipv6-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-ipv6-k8s-tests_istio

integ-distroless-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-distroless-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-operator-controller-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-operator-controller-tests_istio

integ-ipv6-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-ipv6-k8s-tests_istio

integ-distroless-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-distroless-k8s-tests_istio

integ-multicluster-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-multicluster-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-operator-controller-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-operator-controller-tests_istio

integ-ipv6-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-ipv6-k8s-tests_istio

integ-distroless-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-distroless-k8s-tests_istio

integ-multicluster-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-multicluster-k8s-tests_istio

integ-helm-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-helm-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-operator-controller-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-operator-controller-tests_istio

integ-ipv6-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-ipv6-k8s-tests_istio

integ-distroless-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-distroless-k8s-tests_istio

integ-multicluster-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-multicluster-k8s-tests_istio

integ-helm-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-helm-tests_istio

integ-pilot-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-pilot-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-operator-controller-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-operator-controller-tests_istio

integ-ipv6-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-ipv6-k8s-tests_istio

integ-distroless-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-distroless-k8s-tests_istio

integ-multicluster-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-multicluster-k8s-tests_istio

integ-helm-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-helm-tests_istio

integ-pilot-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-pilot-k8s-tests_istio

integ-security-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-security-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-operator-controller-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-operator-controller-tests_istio

integ-ipv6-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-ipv6-k8s-tests_istio

integ-distroless-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-distroless-k8s-tests_istio

integ-multicluster-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-multicluster-k8s-tests_istio

integ-helm-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-helm-tests_istio

integ-pilot-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-pilot-k8s-tests_istio

integ-security-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-telemetry-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-multicluster-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-multicluster-k8s-tests_istio

integ-security-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-k8s-tests_istio
e38dfa4aed73703bd941f7b51505bb6693da96ca
link
/test integ-pilot-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-security-k8s-tests_istio

integ-telemetry-k8s-tests_istio
b398574835ed25a6f443802c0f4936393aa2dbb5
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-k8s-tests_istio
e38dfa4aed73703bd941f7b51505bb6693da96ca
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
e38dfa4aed73703bd941f7b51505bb6693da96ca
link
/test integ-multicluster-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-multicluster-k8s-tests_istio
2ae81e8fc8075fd250c9595ad714bbfc84534ad4
link
/test integ-multicluster-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-multicluster-k8s-tests_istio
2ae81e8fc8075fd250c9595ad714bbfc84534ad4
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
d38259bab750a8e5721fab3c18e7838c5799c0c3
link
/test integ-pilot-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest

@rlenglet ptal

@hzxuzhonghu: PR needs rebase.

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hzxuzhonghu: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-multicluster-tests_istio
388e904d39674ae0a26c4bbda724841f60151f4f
link
/test integ-security-multicluster-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

ping @costinm @rlenglet @howardjohn @dgn is there any other comments

Thanks, i will do this and manually test it.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-multicluster-tests_istio
388e904d39674ae0a26c4bbda724841f60151f4f
link
/test integ-security-multicluster-tests_istio

unit-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-multicluster-tests_istio
388e904d39674ae0a26c4bbda724841f60151f4f
link
/test integ-security-multicluster-tests_istio

unit-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test unit-tests_istio

lint_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-multicluster-tests_istio
388e904d39674ae0a26c4bbda724841f60151f4f
link
/test integ-security-multicluster-tests_istio

unit-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test unit-tests_istio

lint_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test lint_istio

gencheck_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-multicluster-tests_istio
388e904d39674ae0a26c4bbda724841f60151f4f
link
/test integ-security-multicluster-tests_istio

unit-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test unit-tests_istio

lint_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test lint_istio

gencheck_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test gencheck_istio

integ-pilot-multicluster-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test integ-pilot-multicluster-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@jrajahalme has already signed the CLA, and committed into Istio before. Can a Googler please set the cla:yes label? Thanks!

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test lint_istio

gencheck_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test gencheck_istio

integ-pilot-multicluster-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test integ-pilot-multicluster-tests_istio

unit-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

gencheck_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test gencheck_istio

integ-pilot-multicluster-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test integ-pilot-multicluster-tests_istio

unit-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test unit-tests_istio

lint_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-pilot-multicluster-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test integ-pilot-multicluster-tests_istio

unit-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test unit-tests_istio

lint_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test lint_istio

gencheck_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

unit-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test unit-tests_istio

lint_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test lint_istio

gencheck_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test gencheck_istio

integ-security-multicluster-tests_istio
30ee1522db1c5a2a9a8ec8128bbeeace01e42567
link
/test integ-security-multicluster-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

wow, it seems the integration test i added passed.

I will also test it manually today

@hzxuzhonghu: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-multicluster-tests_istio
167129d36a726f22f4f5d23e2a815a60afbc9a44
link
/test integ-security-multicluster-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@jrajahalme could you please clear the CLA thing by adding a comment that contains only @googlebot I consent. in this PR? Thanks!

I tested it manually that it works. As for the route_localnet, it is set by kube-proxy on the host, and the pod inherited these settings, so generally, this is not needed to set again.

@googlebot I consent.

@howardjohn can you take a look

@hzxuzhonghu: PR needs rebase.

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Agree that mess everything up is not very friendly to review. I will revert the iptables refactor and some other unrelated changes. Only keep thoses changes related to original src ip preserve.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-multicluster-tests_istio
167129d36a726f22f4f5d23e2a815a60afbc9a44
link
/test integ-security-multicluster-tests_istio

unit-tests_istio
4ec080bbccf82a84d0360d546b37f85f5ad6dc96
link
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-multicluster-tests_istio
167129d36a726f22f4f5d23e2a815a60afbc9a44
link
/test integ-security-multicluster-tests_istio

unit-tests_istio
4ec080bbccf82a84d0360d546b37f85f5ad6dc96
link
/test unit-tests_istio

integ-pilot-multicluster-tests_istio
4ec080bbccf82a84d0360d546b37f85f5ad6dc96
link
/test integ-pilot-multicluster-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest

@hzxuzhonghu: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-telemetry-k8s-tests_istio
4ec080bbccf82a84d0360d546b37f85f5ad6dc96
link
/test integ-telemetry-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hzxuzhonghu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-telemetry-k8s-tests_istio
4ec080bbccf82a84d0360d546b37f85f5ad6dc96
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
4ec080bbccf82a84d0360d546b37f85f5ad6dc96
link
/test integ-pilot-multicluster-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest

@hzxuzhonghu: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-telemetry-k8s-tests_istio
4ec080bbccf82a84d0360d546b37f85f5ad6dc96
link
/test integ-telemetry-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest

Thanks everyone, this is a big improvement.

@hzxuzhonghu
I am unble to get any response in an application pod. How do you manually test this / what is your VirtualService YAML config? Previously, cURL would work and have source IP as <IP_ADDRESS>, but now cURL results in curl: (56) Recv failure: Connection reset by peer. I think my setup is fine, but I am not sure.
Istio VirtualService
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: tcp
  namespace: default
spec:
  hosts:
    - tcp
  tcp:
    - match:
        - port: 10001
      route:
        - destination:
            host: tcp
            port:
              number: 10001

Minimal TCP app
apiVersion: v1
kind: Service
metadata:
  name: tcp
spec:
  type: ClusterIP
  selector:
    component: tcp
  ports:
    - name: tcp
      port: 10001
      targetPort: 3333

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tcp
  namespace: default
spec:
  selector:
    matchLabels:
      component: tcp
  replicas: 1
  template:
    metadata:
      annotations:
        sidecar.istio.io/interceptionMode: TPROXY
        sidecar.istio.io/inject: "true"
        sidecar.istio.io/logLevel: trace
      labels:
        component: tcp
    spec:
      containers:
        - name: tcp
          image: n0r1skcom/echo
          ports:
            - containerPort: 3333
              protocol: TCP

enter pod namespace
export ID=ec1c2b2b29b7; nsenter --target $(docker inspect -f '{{ .State.Pid }}' $ID) --uts --ipc --net --pid

curl SVC IP of deployment
curl <IP_ADDRESS>:10001

(pod namespace)
tcpdump -i any portrange 10001 or port 3333
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
19:44:56.837597 IP <IP_ADDRESS>.44038 > <IP_ADDRESS>.3333: Flags [S], seq<PHONE_NUMBER>, win 64240, options [mss 1460,sackOK,TS val<PHONE_NUMBER> ecr 0,nop,wscale 7], length 0
19:44:56.837665 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.44038: Flags [S.], seq<PHONE_NUMBER>, ack<PHONE_NUMBER>, win 65160, options [mss 1460,sackOK,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>,nop,wscale 7], length 0
19:44:56.838348 IP <IP_ADDRESS>.44038 > <IP_ADDRESS>.3333: Flags [.], ack 1, win 502, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0
19:44:56.838546 IP <IP_ADDRESS>.44038 > <IP_ADDRESS>.3333: Flags [P.], seq 1:85, ack 1, win 502, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 84
19:44:56.838575 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.44038: Flags [.], ack 85, win 509, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0
19:44:56.839339 IP <IP_ADDRESS>.52873 > localhost.3333: Flags [S], seq<PHONE_NUMBER>, win 65495, options [mss 65495,sackOK,TS val<PHONE_NUMBER> ecr 0,nop,wscale 7], length 0
19:44:57.846297 IP <IP_ADDRESS>.52873 > localhost.3333: Flags [S], seq<PHONE_NUMBER>, win 65495, options [mss 65495,sackOK,TS val<PHONE_NUMBER> ecr 0,nop,wscale 7], length 0
19:44:59.862213 IP <IP_ADDRESS>.52873 > localhost.3333: Flags [S], seq<PHONE_NUMBER>, win 65495, options [mss 65495,sackOK,TS val<PHONE_NUMBER> ecr 0,nop,wscale 7], length 0
19:45:03.898208 IP <IP_ADDRESS>.52873 > localhost.3333: Flags [S], seq<PHONE_NUMBER>, win 65495, options [mss 65495,sackOK,TS val<PHONE_NUMBER> ecr 0,nop,wscale 7], length 0
19:45:06.843733 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.44038: Flags [R.], seq 1, ack 85, win 509, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0

(k8s node namespace)
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
19:46:46.758844 IP <IP_ADDRESS>.46114 > <IP_ADDRESS>.3333: Flags [S], seq<PHONE_NUMBER>, win 64240, options [mss 1460,sackOK,TS val<PHONE_NUMBER> ecr 0,nop,wscale 7], length 0
19:46:46.758912 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.46114: Flags [S.], seq 712021803, ack<PHONE_NUMBER>, win 65160, options [mss 1460,sackOK,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>,nop,wscale 7], length 0
19:46:46.759224 IP <IP_ADDRESS>.46114 > <IP_ADDRESS>.3333: Flags [.], ack 1, win 502, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0
19:46:46.759336 IP <IP_ADDRESS>.46114 > <IP_ADDRESS>.3333: Flags [P.], seq 1:85, ack 1, win 502, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 84
19:46:46.759351 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.46114: Flags [.], ack 85, win 509, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0
19:46:56.767114 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.46114: Flags [R.], seq 1, ack 85, win 509, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0

envoy-init logs
Environment:
------------
ENVOY_PORT=
INBOUND_CAPTURE_PORT=
ISTIO_INBOUND_INTERCEPTION_MODE=
ISTIO_INBOUND_TPROXY_MARK=
ISTIO_INBOUND_TPROXY_ROUTE_TABLE=
ISTIO_INBOUND_PORTS=
ISTIO_OUTBOUND_PORTS=
ISTIO_LOCAL_EXCLUDE_PORTS=
ISTIO_SERVICE_CIDR=
ISTIO_SERVICE_EXCLUDE_CIDR=

Variables:
----------
PROXY_PORT=15001
PROXY_INBOUND_CAPTURE_PORT=15006
PROXY_TUNNEL_PORT=15008
PROXY_UID=1337
PROXY_GID=1337
INBOUND_INTERCEPTION_MODE=TPROXY
INBOUND_TPROXY_MARK=1337
INBOUND_TPROXY_ROUTE_TABLE=133
INBOUND_PORTS_INCLUDE=*
INBOUND_PORTS_EXCLUDE=15090,15021,15020
OUTBOUND_IP_RANGES_INCLUDE=*
OUTBOUND_IP_RANGES_EXCLUDE=
OUTBOUND_PORTS_INCLUDE=
OUTBOUND_PORTS_EXCLUDE=
KUBEVIRT_INTERFACES=
ENABLE_INBOUND_IPV6=false

ip -f inet rule add fwmark 1337 lookup 133
ip -f inet route add local default dev lo table 133
Writing following contents to rules file:  /tmp/iptables-rules-1607914838208321568.txt463547299
* nat
-N ISTIO_INBOUND
-N ISTIO_REDIRECT
-N ISTIO_IN_REDIRECT
-N ISTIO_OUTPUT
-A ISTIO_INBOUND -p tcp --dport 15008 -j RETURN
-A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001
-A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
-A OUTPUT -p tcp -j ISTIO_OUTPUT
-A ISTIO_OUTPUT -o lo -s <IP_ADDRESS>/32 -j RETURN
-A ISTIO_OUTPUT -o lo ! -d <IP_ADDRESS>/32 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
-A ISTIO_OUTPUT -o lo -m owner ! --uid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -m owner --uid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -o lo ! -d <IP_ADDRESS>/32 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
-A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -m owner --gid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -d <IP_ADDRESS>/32 -j RETURN
-A ISTIO_OUTPUT -j ISTIO_REDIRECT
COMMIT
* mangle
-N ISTIO_DIVERT
-N ISTIO_TPROXY
-N ISTIO_INBOUND
-A ISTIO_DIVERT -j MARK --set-mark 1337
-A ISTIO_DIVERT -j ACCEPT
-A ISTIO_TPROXY ! -d <IP_ADDRESS>/32 -p tcp -j TPROXY --tproxy-mark 1337/0xffffffff --on-port 15006
-A PREROUTING -p tcp -j ISTIO_INBOUND
-A ISTIO_INBOUND -p tcp --dport 22 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15090 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15021 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15020 -j RETURN
-A ISTIO_INBOUND -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ISTIO_DIVERT
-A ISTIO_INBOUND -p tcp -j ISTIO_TPROXY
-A PREROUTING -p tcp -m mark --mark 1337 -j CONNMARK --save-mark
-A OUTPUT -p tcp -m connmark --mark 1337 -j CONNMARK --restore-mark
-I ISTIO_INBOUND 1 -p tcp -m mark --mark 1337 -j RETURN
COMMIT

iptables-restore --noflush /tmp/iptables-rules-1607914838208321568.txt463547299
Writing following contents to rules file:  /tmp/ip6tables-rules-1607914838226375591.txt502013094

ip6tables-restore --noflush /tmp/ip6tables-rules-1607914838226375591.txt502013094
iptables-save
# Generated by iptables-save v1.6.1 on Mon Dec 14 03:00:38 2020
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:ISTIO_DIVERT - [0:0]
:ISTIO_INBOUND - [0:0]
:ISTIO_TPROXY - [0:0]
-A PREROUTING -p tcp -j ISTIO_INBOUND
-A PREROUTING -p tcp -m mark --mark 0x539 -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A OUTPUT -p tcp -m connmark --mark 0x539 -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A ISTIO_DIVERT -j MARK --set-xmark 0x539/0xffffffff
-A ISTIO_DIVERT -j ACCEPT
-A ISTIO_INBOUND -p tcp -m mark --mark 0x539 -j RETURN
-A ISTIO_INBOUND -p tcp -m tcp --dport 22 -j RETURN
-A ISTIO_INBOUND -p tcp -m tcp --dport 15090 -j RETURN
-A ISTIO_INBOUND -p tcp -m tcp --dport 15021 -j RETURN
-A ISTIO_INBOUND -p tcp -m tcp --dport 15020 -j RETURN
-A ISTIO_INBOUND -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ISTIO_DIVERT
-A ISTIO_INBOUND -p tcp -j ISTIO_TPROXY
-A ISTIO_TPROXY ! -d <IP_ADDRESS>/32 -p tcp -j TPROXY --on-port 15006 --on-ip <IP_ADDRESS> --tproxy-mark 0x539/0xffffffff
COMMIT
# Completed on Mon Dec 14 03:00:38 2020
# Generated by iptables-save v1.6.1 on Mon Dec 14 03:00:38 2020
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:ISTIO_INBOUND - [0:0]
:ISTIO_IN_REDIRECT - [0:0]
:ISTIO_OUTPUT - [0:0]
:ISTIO_REDIRECT - [0:0]
-A OUTPUT -p tcp -j ISTIO_OUTPUT
-A ISTIO_INBOUND -p tcp -m tcp --dport 15008 -j RETURN
-A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
-A ISTIO_OUTPUT -s <IP_ADDRESS>/32 -o lo -j RETURN
-A ISTIO_OUTPUT ! -d <IP_ADDRESS>/32 -o lo -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
-A ISTIO_OUTPUT -o lo -m owner ! --uid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -m owner --uid-owner 1337 -j RETURN
-A ISTIO_OUTPUT ! -d <IP_ADDRESS>/32 -o lo -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
-A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -m owner --gid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -d <IP_ADDRESS>/32 -j RETURN
-A ISTIO_OUTPUT -j ISTIO_REDIRECT
-A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001
COMMIT
# Completed on Mon Dec 14 03:00:38 2020

iptables -t nat -S (pod namespace)
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N ISTIO_INBOUND
-N ISTIO_IN_REDIRECT
-N ISTIO_OUTPUT
-N ISTIO_REDIRECT
-A OUTPUT -p tcp -j ISTIO_OUTPUT
-A ISTIO_INBOUND -p tcp -m tcp --dport 15008 -j RETURN
-A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
-A ISTIO_OUTPUT -s <IP_ADDRESS>/32 -o lo -j RETURN
-A ISTIO_OUTPUT ! -d <IP_ADDRESS>/32 -o lo -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
-A ISTIO_OUTPUT -o lo -m owner ! --uid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -m owner --uid-owner 1337 -j RETURN
-A ISTIO_OUTPUT ! -d <IP_ADDRESS>/32 -o lo -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
-A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -m owner --gid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -d <IP_ADDRESS>/32 -j RETURN
-A ISTIO_OUTPUT -j ISTIO_REDIRECT
-A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001

iptables -t nat -S (k8s node namespace, Cilium BPF, not kube-proxy)
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N CILIUM_OUTPUT_nat
-N CILIUM_POST_nat
-N CILIUM_PRE_nat
-N DOCKER
-N KUBE-KUBELET-CANARY
-N KUBE-MARK-DROP
-N KUBE-MARK-MASQ
-N KUBE-POSTROUTING
-A PREROUTING -m comment --comment "cilium-feeder: CILIUM_PRE_nat" -j CILIUM_PRE_nat
-A OUTPUT -m comment --comment "cilium-feeder: CILIUM_OUTPUT_nat" -j CILIUM_OUTPUT_nat
-A POSTROUTING -m comment --comment "cilium-feeder: CILIUM_POST_nat" -j CILIUM_POST_nat
-A POSTROUTING -m comment --comment "kubernetes postrouting rules" -j KUBE-POSTROUTING
-A KUBE-MARK-DROP -j MARK --set-xmark 0x8000/0x8000
-A KUBE-MARK-MASQ -j MARK --set-xmark 0x4000/0x4000
-A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN
-A KUBE-POSTROUTING -j MARK --set-xmark 0x4000/0x0
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE --random-fully

istio-proxy logs
curl <IP_ADDRESS>:10001
kubectl logs -f deploy/tcp -c istio-proxy --tail 0

2020-12-14T03:53:34.744551Z     debug   envoy filter    original_dst: New connection accepted
2020-12-14T03:53:34.744618Z     debug   envoy filter    Got a new connection in the original_src filter for address <IP_ADDRESS>:53732. Marking with 1337
2020-12-14T03:53:34.744646Z     debug   envoy filter    tls inspector: new connection accepted
2020-12-14T03:53:34.744665Z     trace   envoy filter    tls inspector: recv: 0
2020-12-14T03:53:34.744724Z     trace   envoy filter    tls inspector: recv: 84
2020-12-14T03:53:34.744758Z     trace   envoy filter    tls inspector: done: true
2020-12-14T03:53:34.744845Z     debug   envoy filter    [C1645] new tcp proxy session
2020-12-14T03:53:34.744865Z     trace   envoy connection        [C1645] readDisable: disable=true disable_count=0 state=0 buffer_length=0
2020-12-14T03:53:34.744906Z     debug   envoy filter    [C1645] Creating connection to cluster inbound|3333||
2020-12-14T03:53:34.744951Z     debug   envoy pool      creating a new connection
2020-12-14T03:53:34.745036Z     debug   envoy pool      [C1646] connecting
2020-12-14T03:53:34.745055Z     debug   envoy connection        [C1646] connecting to <IP_ADDRESS>:3333
2020-12-14T03:53:34.745125Z     debug   envoy connection        [C1646] connection in progress
2020-12-14T03:53:34.745154Z     debug   envoy pool      queueing request due to no available connections
2020-12-14T03:53:34.745164Z     debug   envoy conn_handler      [C1645] new connection
2020-12-14T03:53:34.745173Z     trace   envoy main      item added to deferred deletion list (size=1)
2020-12-14T03:53:34.745182Z     trace   envoy main      clearing deferred deletion list (size=1)
2020-12-14T03:53:34.745196Z     trace   envoy connection        [C1645] socket event: 2
2020-12-14T03:53:34.745203Z     trace   envoy connection        [C1645] write ready
2020-12-14T03:53:35.809903Z     trace   envoy misc      enableTimer called on 0x55d172aa6100 for 3600000ms, min is 3600000ms
2020-12-14T03:53:35.809949Z     debug   envoy conn_handler      [C1647] new connection
2020-12-14T03:53:35.809987Z     trace   envoy connection        [C1647] socket event: 3
2020-12-14T03:53:35.809995Z     trace   envoy connection        [C1647] write ready
2020-12-14T03:53:35.810003Z     trace   envoy connection        [C1647] read ready. dispatch_buffered_data=false
2020-12-14T03:53:35.810023Z     trace   envoy connection        [C1647] read returns: 126
2020-12-14T03:53:35.810045Z     trace   envoy connection        [C1647] read error: Resource temporarily unavailable
2020-12-14T03:53:35.810073Z     trace   envoy http      [C1647] parsing 126 bytes
2020-12-14T03:53:35.810083Z     trace   envoy http      [C1647] message begin
2020-12-14T03:53:35.810096Z     debug   envoy http      [C1647] new stream
2020-12-14T03:53:35.810127Z     trace   envoy http      [C1647] completed header: key=Host value=<IP_ADDRESS>:15021
2020-12-14T03:53:35.810142Z     trace   envoy http      [C1647] completed header: key=User-Agent value=kube-probe/1.19
2020-12-14T03:53:35.810347Z     trace   envoy http      [C1647] completed header: key=Accept-Encoding value=gzip
2020-12-14T03:53:35.810363Z     trace   envoy http      [C1647] onHeadersCompleteBase
2020-12-14T03:53:35.810369Z     trace   envoy http      [C1647] completed header: key=Connection value=close
2020-12-14T03:53:35.810381Z     trace   envoy http      [C1647] Server: onHeadersComplete size=4
2020-12-14T03:53:35.810399Z     trace   envoy http      [C1647] message complete
2020-12-14T03:53:35.810407Z     trace   envoy connection        [C1647] readDisable: disable=true disable_count=0 state=0 buffer_length=126
2020-12-14T03:53:35.810449Z     debug   envoy http      [C1647][S14244208112977825498] request headers complete (end_stream=true):
':authority', '<IP_ADDRESS>:15021'
':path', '/healthz/ready'
':method', 'GET'
'user-agent', 'kube-probe/1.19'
'accept-encoding', 'gzip'
'connection', 'close'

2020-12-14T03:53:35.810458Z     debug   envoy http      [C1647][S14244208112977825498] request end stream
2020-12-14T03:53:35.810511Z     debug   envoy router    [C1647][S14244208112977825498] cluster 'agent' match for URL '/healthz/ready'
2020-12-14T03:53:35.810564Z     debug   envoy router    [C1647][S14244208112977825498] router decoding headers:
':authority', '<IP_ADDRESS>:15021'
':path', '/healthz/ready'
':method', 'GET'
':scheme', 'http'
'user-agent', 'kube-probe/1.19'
'accept-encoding', 'gzip'
'x-forwarded-proto', 'http'
'x-request-id', '6bfd60be-1ab9-4597-bd1c-c9e25cb350f0'
'x-envoy-expected-rq-timeout-ms', '15000'

2020-12-14T03:53:35.810582Z     debug   envoy pool      [C3] using existing connection
2020-12-14T03:53:35.810591Z     debug   envoy pool      [C3] creating stream
2020-12-14T03:53:35.810605Z     debug   envoy router    [C1647][S14244208112977825498] pool ready
2020-12-14T03:53:35.810628Z     trace   envoy connection        [C3] writing 242 bytes, end_stream false
2020-12-14T03:53:35.810650Z     trace   envoy http      [C1647][S14244208112977825498] decode headers called: filter=0x55d1727d64e0 status=1
2020-12-14T03:53:35.810661Z     trace   envoy http      [C1647] parsed 126 bytes
2020-12-14T03:53:35.810678Z     trace   envoy connection        [C1647] socket event: 2
2020-12-14T03:53:35.810684Z     trace   envoy connection        [C1647] write ready
2020-12-14T03:53:35.810692Z     trace   envoy connection        [C3] socket event: 2
2020-12-14T03:53:35.810697Z     trace   envoy connection        [C3] write ready
2020-12-14T03:53:35.810756Z     trace   envoy connection        [C3] write returns: 242
2020-12-14T03:53:35.811211Z     trace   envoy connection        [C3] socket event: 3
2020-12-14T03:53:35.811224Z     trace   envoy connection        [C3] write ready
2020-12-14T03:53:35.811231Z     trace   envoy connection        [C3] read ready. dispatch_buffered_data=false
2020-12-14T03:53:35.811247Z     trace   envoy connection        [C3] read returns: 75
2020-12-14T03:53:35.811261Z     trace   envoy connection        [C3] read error: Resource temporarily unavailable
2020-12-14T03:53:35.811271Z     trace   envoy http      [C3] parsing 75 bytes
2020-12-14T03:53:35.811278Z     trace   envoy http      [C3] message begin
2020-12-14T03:53:35.811291Z     trace   envoy http      [C3] completed header: key=Date value=Mon, 14 Dec 2020 03:53:35 GMT
2020-12-14T03:53:35.811303Z     trace   envoy http      [C3] onHeadersCompleteBase
2020-12-14T03:53:35.811308Z     trace   envoy http      [C3] completed header: key=Content-Length value=0
2020-12-14T03:53:35.811326Z     trace   envoy http      [C3] status_code 200
2020-12-14T03:53:35.811332Z     trace   envoy http      [C3] Client: onHeadersComplete size=2
2020-12-14T03:53:35.811339Z     trace   envoy http      [C3] message complete
2020-12-14T03:53:35.811344Z     trace   envoy http      [C3] message complete
2020-12-14T03:53:35.811351Z     debug   envoy client    [C3] response complete
2020-12-14T03:53:35.811357Z     trace   envoy main      item added to deferred deletion list (size=1)
2020-12-14T03:53:35.811373Z     debug   envoy router    [C1647][S14244208112977825498] upstream headers complete: end_stream=true
2020-12-14T03:53:35.811412Z     trace   envoy main      item added to deferred deletion list (size=2)
2020-12-14T03:53:35.811451Z     debug   envoy http      [C1647][S14244208112977825498] closing connection due to connection close header
2020-12-14T03:53:35.811470Z     debug   envoy http      [C1647][S14244208112977825498] encoding headers via codec (end_stream=true):
':status', '200'
'date', 'Mon, 14 Dec 2020 03:53:35 GMT'
'content-length', '0'
'x-envoy-upstream-service-time', '0'
'server', 'envoy'
'connection', 'close'

2020-12-14T03:53:35.811485Z     trace   envoy connection        [C1647] writing 143 bytes, end_stream false
2020-12-14T03:53:35.811505Z     trace   envoy connection        [C1647] readDisable: disable=false disable_count=1 state=0 buffer_length=0
2020-12-14T03:53:35.811542Z     trace   envoy main      item added to deferred deletion list (size=3)
2020-12-14T03:53:35.811555Z     trace   envoy misc      enableTimer called on 0x55d172aa6100 for 3600000ms, min is 3600000ms
2020-12-14T03:53:35.811567Z     debug   envoy connection        [C1647] closing data_to_write=143 type=2
2020-12-14T03:53:35.811577Z     debug   envoy connection        [C1647] setting delayed close timer with timeout 1000 ms
2020-12-14T03:53:35.811595Z     debug   envoy pool      [C3] response complete
2020-12-14T03:53:35.811604Z     debug   envoy pool      [C3] destroying stream: 0 remaining
2020-12-14T03:53:35.811614Z     trace   envoy http      [C3] parsed 75 bytes
2020-12-14T03:53:35.811623Z     trace   envoy main      clearing deferred deletion list (size=3)
2020-12-14T03:53:35.811645Z     trace   envoy connection        [C1647] socket event: 2
2020-12-14T03:53:35.811651Z     trace   envoy connection        [C1647] write ready
2020-12-14T03:53:35.811737Z     trace   envoy connection        [C1647] write returns: 143
2020-12-14T03:53:35.811748Z     debug   envoy connection        [C1647] write flush complete
2020-12-14T03:53:35.811949Z     trace   envoy connection        [C1647] socket event: 6
2020-12-14T03:53:35.811960Z     debug   envoy connection        [C1647] remote early close
2020-12-14T03:53:35.811967Z     debug   envoy connection        [C1647] closing socket: 0
2020-12-14T03:53:35.812059Z     trace   envoy connection        [C1647] raising connection event 0
2020-12-14T03:53:35.812071Z     debug   envoy conn_handler      [C1647] adding to cleanup list
2020-12-14T03:53:35.812077Z     trace   envoy main      item added to deferred deletion list (size=1)
2020-12-14T03:53:35.812084Z     trace   envoy main      item added to deferred deletion list (size=2)
2020-12-14T03:53:35.812091Z     trace   envoy main      clearing deferred deletion list (size=2)

@hi-usui Can you check the route_localnetwork config?

sysctl net/ipv4/conf/all/route_localnet shows 1
I tried again in a new GCP instance and did kubeadm reset on the previous instance. Connections to the pod go through now for both. Unsure what caused it.
My final step is to use proxy_protocol and original_src, but the listeners are not applying. The source IP address observed in application pod is ingress-nginx pod LoadBalancer internal IP, not IP address in PROXY TCP4 header. Without istioctl, is there an easy way to check which listeners are attached to a sidecar? Or see the reason for attachment failure?
Cannot get working the proxy_protocol and original_src filters for EnvoyFilter on a sidecar. Is there requirement for something else?
EnvoyFilter
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: proxy-protocol
  namespace: default
spec:
  configPatches:
    - applyTo: LISTENER
      match:
        context: SIDECAR_INBOUND
        listener:
          portNumber: 10001
      patch:
        operation: MERGE
        value:
          listener_filters:
            - name: envoy.filters.listener.proxy_protocol
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol
            - name: envoy.filters.listener.original_src
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.listener.original_src.v3.OriginalSrc
                mark: 1337

root@hozer-55:~# curl <IP_ADDRESS>:10001 -v
* Expire in 0 ms for 6 (transfer 0x55a0fc7b3ec0)
*   Trying <IP_ADDRESS>...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x55a0fc7b3ec0)
* Connected to <IP_ADDRESS> (<IP_ADDRESS>) port 10001 (#0)
> GET / HTTP/1.1
> Host: <IP_ADDRESS>:10001
> User-Agent: curl/7.64.0
> Accept: */*
>
Container information:
Hostname:       tcp-76d87cfd9f-ft8nm

Interface       NetMask         IP
lo              <IP_ADDRESS>       <IP_ADDRESS>
eth0            <IP_ADDRESS> <IP_ADDRESS>

TCP Remote information:
IP:     <IP_ADDRESS>

Data received:
PROXY TCP4 <IP_ADDRESS> <IP_ADDRESS> 54576 10001
GET / HTTP/1.1
Host: <IP_ADDRESS>:10001
User-Agent: curl/7.64.0
Accept: */*
* Closing connection 0

Miscellaneous
Cilium
kubeadm init --skip-phases addon/kube-proxy
helm install cilium cilium/cilium --version 1.9.1 --namespace kube-system --set global.k8sServiceHost=$EXTERNAL_IP,global.k8sServicePort=6443,global.kubeProxyReplacement=strict,operator.replicas=1

Linux
root@hozer-55:~# uname -a
Linux hozer-55 5.9.0-0.bpo.2-rt-amd64 #1 SMP PREEMPT_RT Debian 5.9.6-1~bpo10+1 (2020-11-19) x86_64 GNU/Linux

root@hozer-55:~# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

Cannot get working the proxy_protocol and original_src filters for EnvoyFilter on a sidecar. Is there requirement for something else?

For the inbound traffic, it will go through 15006 virtualInbound listener, maybe this is the reason

Cannot get working the proxy_protocol and original_src filters for EnvoyFilter on a sidecar. Is there requirement for something else?

For the inbound traffic, it will go through 15006 virtualInbound listener, maybe this is the reason

You are correct. I thought SIDECAR_INBOUND ports are for targeted service's ports only. The inbound listener matches on port 15006 and now they appear. Unfortunately I did not solve initial original problem, which is TCP does not receive a reply, both for internal and external traffic (client ?--> ingress-nginx <--> istio-proxy <--> tcp-pod)
Perhaps it is not possible with ingress-nginx LoadBalancer with external IP. ingress-nginx receives reply from TCP pod (<IP_ADDRESS>.3333 > <IP_ADDRESS>.55380) but nothing returns to client (<IP_ADDRESS>:55370 > ?), envoy-proxy always ends stream with read error: Resource temporarily unavailable. Maybe it is out of scope for return journey
root@hozer-55:~# clear; k logs -l component=tcp -c istio-proxy -f
2020-12-15T02:42:17.008562Z     trace   envoy main      item added to deferred deletion list (size=1)
2020-12-15T02:42:17.008569Z     trace   envoy main      item added to deferred deletion list (size=2)
2020-12-15T02:42:17.008576Z     trace   envoy main      clearing deferred deletion list (size=2)
2020-12-15T02:42:17.786889Z     trace   envoy upstream  starting async DNS resolution for zipkin.istio
2020-12-15T02:42:17.787237Z     trace   envoy upstream  Setting DNS resolution timer for 5000 milliseconds
2020-12-15T02:42:17.799052Z     trace   envoy upstream  Setting DNS resolution timer for 5000 milliseconds
2020-12-15T02:42:17.799603Z     trace   envoy upstream  Setting DNS resolution timer for 5000 milliseconds
2020-12-15T02:42:17.800043Z     trace   envoy upstream  Setting DNS resolution timer for 5000 milliseconds
2020-12-15T02:42:17.800362Z     trace   envoy upstream  async DNS resolution complete for zipkin.istio
2020-12-15T02:42:17.800378Z     debug   envoy upstream  DNS refresh rate reset for zipkin.istio, (failure) refresh rate 5000 ms
2020-12-15T02:42:18.109761Z     debug   envoy filter    original_dst: New connection accepted
2020-12-15T02:42:18.109967Z     debug   envoy filter    Got a new connection in the original_src filter for address <IP_ADDRESS>:42868. Marking with 1337
2020-12-15T02:42:18.110047Z     debug   envoy filter    tls inspector: new connection accepted
2020-12-15T02:42:18.110102Z     trace   envoy filter    tls inspector: recv: 47
2020-12-15T02:42:18.110244Z     debug   envoy filter    proxy_protocol: New connection accepted
2020-12-15T02:42:18.110401Z     debug   envoy filter    Got a new connection in the original_src filter for address <IP_ADDRESS>:53185. Marking with 1337
2020-12-15T02:42:18.111326Z     debug   envoy filter    [C1104] new tcp proxy session
2020-12-15T02:42:18.111399Z     trace   envoy connection        [C1104] readDisable: disable=true disable_count=0 state=0 buffer_length=0
2020-12-15T02:42:18.111494Z     debug   envoy filter    [C1104] Creating connection to cluster InboundPassthroughClusterIpv4
2020-12-15T02:42:18.111788Z     debug   envoy upstream  Using existing host <IP_ADDRESS>:10001.
2020-12-15T02:42:18.111916Z     debug   envoy pool      creating a new connection
2020-12-15T02:42:18.112123Z     debug   envoy pool      [C1105] connecting
2020-12-15T02:42:18.112242Z     debug   envoy connection        [C1105] connecting to <IP_ADDRESS>:10001
2020-12-15T02:42:18.112548Z     debug   envoy connection        [C1105] connection in progress
2020-12-15T02:42:18.112632Z     debug   envoy pool      queueing request due to no available connections
2020-12-15T02:42:18.112765Z     debug   envoy conn_handler      [C1104] new connection
2020-12-15T02:42:18.112832Z     trace   envoy main      item added to deferred deletion list (size=1)
2020-12-15T02:42:18.112963Z     trace   envoy main      clearing deferred deletion list (size=1)
2020-12-15T02:42:18.113041Z     trace   envoy connection        [C1104] socket event: 2
2020-12-15T02:42:18.113204Z     trace   envoy connection        [C1104] write ready
2020-12-15T02:42:18.642691Z     debug   envoy pool      [C1096] connect timeout
2020-12-15T02:42:18.642841Z     debug   envoy connection        [C1096] closing data_to_write=0 type=1
2020-12-15T02:42:18.642892Z     debug   envoy connection        [C1096] closing socket: 1
2020-12-15T02:42:18.643016Z     trace   envoy connection        [C1096] raising connection event 1
2020-12-15T02:42:18.643151Z     debug   envoy pool      [C1096] client disconnected
2020-12-15T02:42:18.643252Z     debug   envoy filter    [C1104] connect timeout
2020-12-15T02:42:18.643405Z     debug   envoy filter    [C1104] Creating connection to cluster InboundPassthroughClusterIpv4
2020-12-15T02:42:18.643469Z     debug   envoy connection        [C1104] closing data_to_write=0 type=1
2020-12-15T02:42:18.643547Z     debug   envoy connection        [C1104] closing socket: 1
2020-12-15T02:42:18.643705Z     trace   envoy connection        [C1104] raising connection event 1
2020-12-15T02:42:18.643816Z     debug   envoy wasm      wasm log: [extensions/stats/plugin.cc:615]::report() metricKey cache hit , stat=12
2020-12-15T02:42:18.643872Z     debug   envoy wasm      wasm log: [extensions/stats/plugin.cc:615]::report() metricKey cache hit , stat=16
2020-12-15T02:42:18.643913Z     debug   envoy wasm      wasm log: [extensions/stats/plugin.cc:615]::report() metricKey cache hit , stat=20
2020-12-15T02:42:18.643952Z     debug   envoy wasm      wasm log: [extensions/stats/plugin.cc:615]::report() metricKey cache hit , stat=24
2020-12-15T02:42:18.643995Z     debug   envoy conn_handler      [C1104] adding to cleanup list
2020-12-15T02:42:18.644043Z     trace   envoy main      item added to deferred deletion list (size=1)
2020-12-15T02:42:18.644082Z     trace   envoy main      item added to deferred deletion list (size=2)
2020-12-15T02:42:18.644122Z     trace   envoy main      item added to deferred deletion list (size=3)
2020-12-15T02:42:18.644162Z     trace   envoy main      clearing deferred deletion list (size=3)
2020-12-15T02:42:18.644804Z     debug   envoy pool      [C1096] connection destroyed
2020-12-15T02:42:19.005921Z     debug   envoy conn_handler      [C1106] new connection
2020-12-15T02:42:19.006141Z     trace   envoy connection        [C1106] socket event: 3
2020-12-15T02:42:19.006377Z     trace   envoy connection        [C1106] write ready
2020-12-15T02:42:19.006466Z     trace   envoy connection        [C1106] read ready. dispatch_buffered_data=false
2020-12-15T02:42:19.006621Z     trace   envoy connection        [C1106] read returns: 126
2020-12-15T02:42:19.006814Z     trace   envoy connection        [C1106] read error: Resource temporarily unavailable
2020-12-15T02:42:19.006965Z     trace   envoy http      [C1106] parsing 126 bytes
2020-12-15T02:42:19.007092Z     trace   envoy http      [C1106] message begin
2020-12-15T02:42:19.008157Z     debug   envoy http      [C1106] new stream
2020-12-15T02:42:19.008437Z     trace   envoy http      [C1106] completed header: key=Host value=<IP_ADDRESS>:15021
2020-12-15T02:42:19.008544Z     trace   envoy http      [C1106] completed header: key=User-Agent value=kube-probe/1.19
2020-12-15T02:42:19.008753Z     trace   envoy http      [C1106] completed header: key=Accept-Encoding value=gzip
2020-12-15T02:42:19.008849Z     trace   envoy http      [C1106] onHeadersCompleteBase
2020-12-15T02:42:19.008996Z     trace   envoy http      [C1106] completed header: key=Connection value=close
2020-12-15T02:42:19.009090Z     trace   envoy http      [C1106] Server: onHeadersComplete size=4
2020-12-15T02:42:19.009177Z     trace   envoy http      [C1106] message complete
2020-12-15T02:42:19.009255Z     trace   envoy connection        [C1106] readDisable: disable=true disable_count=0 state=0 buffer_length=126

root@hozer-55:~# clear; tcpdump -i any portrange 10001 or port 3333
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
18:53:12.149454 IP c-73-71-38-214.hsd1.ca.comcast.net.53253 > hozer-55.ocf.berkeley.edu.10001: Flags [S], seq<PHONE_NUMBER>, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 369528701 ecr 0,sackOK,eol], length 0
18:53:12.149542 IP c-73-71-38-214.hsd1.ca.comcast.net.53253 > <IP_ADDRESS>.10001: Flags [S], seq<PHONE_NUMBER>, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 369528701 ecr 0,sackOK,eol], length 0
18:53:12.149572 IP <IP_ADDRESS>.10001 > c-73-71-38-214.hsd1.ca.comcast.net.53253: Flags [S.], seq<PHONE_NUMBER>, ack<PHONE_NUMBER>, win 64308, options [mss 1410,sackOK,TS val 285244437 ecr 369528701,nop,wscale 7], length 0
18:53:12.149587 IP hozer-55.ocf.berkeley.edu.10001 > c-73-71-38-214.hsd1.ca.comcast.net.53253: Flags [S.], seq<PHONE_NUMBER>, ack<PHONE_NUMBER>, win 64308, options [mss 1410,sackOK,TS val 285244437 ecr 369528701,nop,wscale 7], length 0
18:53:12.183522 IP c-73-71-38-214.hsd1.ca.comcast.net.53253 > hozer-55.ocf.berkeley.edu.10001: Flags [.], ack 1, win 2053, options [nop,nop,TS val 369528771 ecr 285244437], length 0
18:53:12.183599 IP c-73-71-38-214.hsd1.ca.comcast.net.53253 > <IP_ADDRESS>.10001: Flags [.], ack 1, win 2053, options [nop,nop,TS val 369528771 ecr 285244437], length 0
18:53:12.183883 IP <IP_ADDRESS>.55380 > <IP_ADDRESS>.3333: Flags [S], seq<PHONE_NUMBER>, win 64860, options [mss 1410,sackOK,TS val<PHONE_NUMBER> ecr 0,nop,wscale 7], length 0
18:53:12.183966 IP <IP_ADDRESS>.55380 > <IP_ADDRESS>.3333: Flags [S], seq<PHONE_NUMBER>, win 64860, options [mss 1410,sackOK,TS val<PHONE_NUMBER> ecr 0,nop,wscale 7], length 0
18:53:12.184025 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.55380: Flags [S.], seq<PHONE_NUMBER>, ack<PHONE_NUMBER>, win 64308, options [mss 1410,sackOK,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>,nop,wscale 7], length 0
18:53:12.184043 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.55380: Flags [S.], seq<PHONE_NUMBER>, ack<PHONE_NUMBER>, win 64308, options [mss 1410,sackOK,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>,nop,wscale 7], length 0
18:53:12.184156 IP <IP_ADDRESS>.55380 > <IP_ADDRESS>.3333: Flags [.], ack 1, win 507, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0
18:53:12.184174 IP <IP_ADDRESS>.55380 > <IP_ADDRESS>.3333: Flags [.], ack 1, win 507, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0
18:53:12.184306 IP <IP_ADDRESS>.55380 > <IP_ADDRESS>.3333: Flags [P.], seq 1:48, ack 1, win 507, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 47
18:53:12.184325 IP <IP_ADDRESS>.55380 > <IP_ADDRESS>.3333: Flags [P.], seq 1:48, ack 1, win 507, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 47
18:53:12.184563 IP c-73-71-38-214.hsd1.ca.comcast.net.53253 > hozer-55.ocf.berkeley.edu.10001: Flags [P.], seq 1:87, ack 1, win 2053, options [nop,nop,TS val 369528771 ecr 285244437], length 86
18:53:12.184604 IP c-73-71-38-214.hsd1.ca.comcast.net.53253 > <IP_ADDRESS>.10001: Flags [P.], seq 1:87, ack 1, win 2053, options [nop,nop,TS val 369528771 ecr 285244437], length 86
18:53:12.184630 IP <IP_ADDRESS>.10001 > c-73-71-38-214.hsd1.ca.comcast.net.53253: Flags [.], ack 87, win 502, options [nop,nop,TS val 285244472 ecr 369528771], length 0
18:53:12.184643 IP hozer-55.ocf.berkeley.edu.10001 > c-73-71-38-214.hsd1.ca.comcast.net.53253: Flags [.], ack 87, win 502, options [nop,nop,TS val 285244472 ecr 369528771], length 0
18:53:12.184703 IP <IP_ADDRESS>.55380 > <IP_ADDRESS>.3333: Flags [P.], seq 48:134, ack 1, win 507, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 86
18:53:12.184728 IP <IP_ADDRESS>.55380 > <IP_ADDRESS>.3333: Flags [P.], seq 48:134, ack 1, win 507, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 86
18:53:12.184746 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.55380: Flags [.], ack 134, win 503, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0
18:53:12.184755 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.55380: Flags [.], ack 134, win 503, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0
*** cURL hang for 10 seconds ***
18:53:22.183574 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.55380: Flags [R.], seq 1, ack 134, win 503, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0
18:53:22.183615 IP <IP_ADDRESS>.3333 > <IP_ADDRESS>.55380: Flags [R.], seq 1, ack 134, win 503, options [nop,nop,TS val<PHONE_NUMBER> ecr<PHONE_NUMBER>], length 0
18:53:22.183924 IP <IP_ADDRESS>.10001 > c-73-71-38-214.hsd1.ca.comcast.net.53253: Flags [F.], seq 1, ack 87, win 502, options [nop,nop,TS val 285254471 ecr 369528771], length 0
18:53:22.183961 IP hozer-55.ocf.berkeley.edu.10001 > c-73-71-38-214.hsd1.ca.comcast.net.53253: Flags [F.], seq 1, ack 87, win 502, options [nop,nop,TS val 285254471 ecr 369528771], length 0
18:53:22.227551 IP c-73-71-38-214.hsd1.ca.comcast.net.53253 > hozer-55.ocf.berkeley.edu.10001: Flags [.], ack 2, win 2053, options [nop,nop,TS val 369538738 ecr 285254471], length 0
18:53:22.227634 IP c-73-71-38-214.hsd1.ca.comcast.net.53253 > <IP_ADDRESS>.10001: Flags [.], ack 2, win 2053, options [nop,nop,TS val 369538738 ecr 285254471], length 0
18:53:22.228397 IP c-73-71-38-214.hsd1.ca.comcast.net.53253 > hozer-55.ocf.berkeley.edu.10001: Flags [F.], seq 87, ack 2, win 2053, options [nop,nop,TS val 369538738 ecr 285254471], length 0
18:53:22.228482 IP c-73-71-38-214.hsd1.ca.comcast.net.53253 > <IP_ADDRESS>.10001: Flags [F.], seq 87, ack 2, win 2053, options [nop,nop,TS val 369538738 ecr 285254471], length 0
18:53:22.228535 IP <IP_ADDRESS>.10001 > c-73-71-38-214.hsd1.ca.comcast.net.53253: Flags [.], ack 88, win 502, options [nop,nop,TS val 285254516 ecr 369538738], length 0
18:53:22.228567 IP hozer-55.ocf.berkeley.edu.10001 > c-73-71-38-214.hsd1.ca.comcast.net.53253: Flags [.], ack 88, win 502, options [nop,nop,TS val 285254516 ecr 369538738], length 0
^C
32 packets captured
35 packets received by filter
2 packets dropped by kernel
root@hozer-55:~#

Does the ingress-nginx send with proxy protocol?

Note: if the filter is enabled, the Proxy Protocol must be present on the connection (either version 1 or version 2), the standard does not allow parsing to determine if it is present or not.

Does the ingress-nginx send with proxy protocol?

Note: if the filter is enabled, the Proxy Protocol must be present on the connection (either version 1 or version 2), the standard does not allow parsing to determine if it is present or not.

Yes, for ingress-nginx accepting non-PROXY that adds PROXY and sends to istio-proxy:
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update

helm install ingress-nginx ingress-nginx/ingress-nginx --version 3.15.2 --namespace ingress-nginx --create-namespace -f - << EOF
controller:
  service:
    type: LoadBalancer
    externalTrafficPolicy: Local
tcp:
  10001: default/tcp:10001::PROXY
EOF

export DEVICE_IP=$(ip -4 addr show $(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)') | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
helm install metallb2 bitnami/metallb --version 1.0.1 --namespace kube-system -f - << EOF
configInline:
  address-pools:
    - name: default
      protocol: layer2
      addresses:
        - $DEVICE_IP-$DEVICE_IP
EOF

ingress-nginx logs
[<IP_ADDRESS>] [15/Dec/2020:08:17:02 +0000] TCP 200 0 86 9.999
2020/12/15 08:17:02 [error] 1031#1031: *797350 recv() failed (104: Connection reset by peer) while proxying and reading from upstream, client: <IP_ADDRESS>, server: <IP_ADDRESS>:10001, upstream: "<IP_ADDRESS>:3333", bytes from/to client:86/0, bytes from/to upstream:0/133

but with no EnvoyFilter, TCP pod responds like:
root@hozer-55:~# clear; k logs -l component=tcp -c tcp -f
----- START 2020-12-15 09:17:12 -----
Container information:
Hostname:       tcp-7848c94d55-6spff

Interface       NetMask         IP
lo              <IP_ADDRESS>       <IP_ADDRESS>
eth0            <IP_ADDRESS> <IP_ADDRESS>

TCP Remote information:
IP:     <IP_ADDRESS>

Data received:
PROXY TCP4 <IP_ADDRESS> <IP_ADDRESS> 53853 10001
GET / HTTP/1.1
Host: berkeleytime.com:10001
User-Agent: curl/7.71.1
Accept: */*

----- END -----

On side note, @jrajahalme can you confirm up to which version this PR needs to be backported? I think you saw issues with TPROXY in 1.6, right?

@hzxuzhonghu Figured it out: Addenvoy.filters.listener.original_dst to listener_filters:
listener_filters:
  - name: envoy.filters.listener.proxy_protocol
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol
  - name: envoy.filters.listener.original_dst
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst
  - name: envoy.filters.listener.original_src
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.listener.original_src.v3.OriginalSrc

root@bt-gcp-2:~# k logs -f -l component=tcp
TCP Remote information:
IP:	<IP_ADDRESS>

Data received:
GET / HTTP/1.1
Host: <IP_ADDRESS>:10001
User-Agent: curl/7.71.1
Accept: */*

----- END -----

Pretty cool! Hopefully applications can now drop support for Proxy Protocol. Is there an easy way to have sidecars exclude cluster traffic from the listener match? Would like to apply this to Postgres DB but make it so cluster traffic does not have to send Proxy header

All traffic goes to the virtualInbound listener with the above filters enabled, so i donot think it is possible.


escape the $ in make file

dollar-sign needs to be escaped in Makefile:
Description of changes:
Escape dollar sign in make file
Testing performed:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

/lgtm


Implemented SA1514 (incl. codefix + tests)

Fixes #115

Tested this on a big non-StyleCop solution (170,000 StyleCop warnings). 600+ instances of this fixed with no issues :+1:


python311Packages.whoisdomain: init at 1.20240129.1

Module to perform whois lookups
https://github.com/mboot-github/WhoisDomain
Description of changes

Things done

Built on platform(s)

[ ] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[ ] aarch64-darwin

For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)

[ ] sandbox = relaxed
[ ] sandbox = true

[ ] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[ ] Tested basic functionality of all binary files (usually in ./result/bin/)
24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module

[ ] Fits CONTRIBUTING.md.

Add a :+1: reaction to pull requests you find important.

Result of nixpkgs-review pr 290435 run on x86_64-linux 1

4 packages built:

python311Packages.whoisdomain
python311Packages.whoisdomain.dist
python312Packages.whoisdomain
python312Packages.whoisdomain.dist


Upgrade rrweb

Issue: #
What Changed

Upgrade rrweb.

Is there a reason we're using the alpha version? Wondering for stability reasons.

@skitterm the 2.0 line is still in alpha. We've been using alpha.4 this whole time, which was published a year ago. alpha.11 is the newest at 6 months ago, and has the bulk of the downloads.


Unable to add channel by URL

Hey,
I wanted to add a new channel https://www.youtube.com/c/HomesystemSk to whitelist but when I used the URL from browser I got an error message below.
Also tried to use https://www.youtube.com/channel/HomesystemSk but ended up with the same error message.
Could you take a look into it?
Sep 18 20:23:26 LinPlex systemd[1]: Started YouTube email notification system from Github - bbyen.
Sep 18 20:23:27 LinPlex node[9864]: [error] [main]: Exhausted all methods of getting the ID for channel 'https://www.youtube.com/c/HomesystemSk'. If this is a mistake, please open a GitHub issue and show them this message: https://github.com/MarcelRobitaille/bbyen/issues/new {}
Sep 18 20:23:27 LinPlex node[9864]: Error: Exhausted all methods of getting the ID for channel 'https://www.youtube.com/c/HomesystemSk'. If this is a mistake, please open a GitHub issue and show them this message: https://github.com/MarcelRobitaille/bbyen/issues/new
Sep 18 20:23:27 LinPlex node[9864]:     at normalizeChannel (/opt/YoutubeNotify-bbyen/src/config.js:46:9)
Sep 18 20:23:27 LinPlex node[9864]:     at Array.map (<anonymous>)
Sep 18 20:23:27 LinPlex node[9864]:     at normalizeConfig (/opt/YoutubeNotify-bbyen/src/config.js:57:46)
Sep 18 20:23:27 LinPlex node[9864]:     at loadConfig (/opt/YoutubeNotify-bbyen/src/config.js:65:33)
Sep 18 20:23:27 LinPlex node[9864]:     at async main (/opt/YoutubeNotify-bbyen/src/index.js:21:18)

That's strange. I just tested that string and it is being matched properly. Could you please check if there are any invisible characters or anything you might have accidentally copied into the configuration file? If that does not work, could you please try the latest version and set your log level in your configuration file to verbose? I added some additional logging.

Hey, sorry for late reply. I think there's something wrong with the latest commit. I received an error right upon startup.
Log level is set to verbose. I've setup bbyen as a fresh install only with my auth token, config and db copied into the directory.
node src/index.js
node:internal/validators:120
    throw new ERR_INVALID_ARG_TYPE(name, 'string', value);
    ^

TypeError [ERR_INVALID_ARG_TYPE]: The "id" argument must be of type string. Received undefined
    at new NodeError (node:internal/errors:372:5)
    at validateString (node:internal/validators:120:11)
    at Module.require (node:internal/modules/cjs/loader:998:3)
    at require (node:internal/modules/cjs/helpers:102:18)
    at Object.<anonymous> (/opt/tempfolder/bbyen/src/lib/logger.js:4:16)
    at Module._compile (node:internal/modules/cjs/loader:1105:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1159:10)
    at Module.load (node:internal/modules/cjs/loader:981:32)
    at Function.Module._load (node:internal/modules/cjs/loader:822:12)
    at Module.require (node:internal/modules/cjs/loader:1005:19) {
  code: 'ERR_INVALID_ARG_TYPE'
}

Thanks for checking that commit. This new error is puzzling. Could you please share your entire configuration file?

Sure, I've changed the extension to .txt as GitHub doesn't like json files.
Here: Config.json.txt

I think it was just a dependency loop and an unhelpful error message. Would you try the latest commit please?

Sure, Unfortunately it still throws the same error.
Using latest commit 236e849d93518ef0a8232815bf4d016751bf8445
2022-09-28T18:36:48.300Z [verbose] [config]: Normalizing channel string 'UC2J-0g_nxlwcD9JBK1eTleQ' {}
2022-09-28T18:36:48.300Z [verbose] [config]: String matches ID {}
2022-09-28T18:36:48.300Z [verbose] [config]: Normalizing channel string 'https://www.youtube.com/channel/HomesystemSk' {}
2022-09-28T18:36:48.301Z [error] [main]: Exhausted all methods of getting the ID for channel 'https://www.youtube.com/channel/HomesystemSk'. If this is a mistake, please open a GitHub issue and show them this message: https://github.com/MarcelRobitaille/bbyen/issues/new {}
Error: Exhausted all methods of getting the ID for channel 'https://www.youtube.com/channel/HomesystemSk'. If this is a mistake, please open a GitHub issue and show them this message: https://github.com/MarcelRobitaille/bbyen/issues/new
    at normalizeChannel (/opt/tempfolder/bbyen/src/config.js:76:9)
    at Array.map (<anonymous>)
    at normalizeConfig (/opt/tempfolder/bbyen/src/config.js:87:46)
    at loadConfig (/opt/tempfolder/bbyen/src/config.js:96:33)
    at async main (/opt/tempfolder/bbyen/src/index.js:21:18)

I downloaded you config and I was able to reproduce your issue for https://www.youtube.com/channel/HomesystemSk. The latest commit should support that.
However, I was not able to reproduce the issue for https://www.youtube.com/c/HomesystemSk. Could you please try the latest commit and let me know if you are still getting that error?
I am using node 16.2.0, f89dbf67, and I used your config.json exactly.

Unfortunately yeah I still do receive the same error.
I'm using node v16.15.1, could that be the issue?
2022-09-30T07:06:59.439Z [verbose] [config]: Normalizing channel string 'UC2J-0g_nxlwcD9JBK1eTleQ' {}
2022-09-30T07:06:59.439Z [verbose] [config]: String matches ID {}
2022-09-30T07:06:59.439Z [verbose] [config]: Normalizing channel string 'https://www.youtube.com/channel/HomesystemSk' {}
2022-09-30T07:06:59.440Z [verbose] [config]: String matches URL with channel name {}
2022-09-30T07:06:59.960Z [error] [main]: Could not find channel ID using the API for 'https://www.youtube.com/channel/HomesystemSk'. Please open a GitHub issue and show them this message: https://github.com/MarcelRobitaille/bbyen/issues/new {}
Error: Could not find channel ID using the API for 'https://www.youtube.com/channel/HomesystemSk'. Please open a GitHub issue and show them this message: https://github.com/MarcelRobitaille/bbyen/issues/new
    at normalizeChannel (/opt/tempfolder/bbyen/src/config.js:72:11)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async Promise.all (index 316)
    at async normalizeConfig (/opt/tempfolder/bbyen/src/config.js:88:6)
    at async loadConfig (/opt/tempfolder/bbyen/src/config.js:97:27)
    at async main (/opt/tempfolder/bbyen/src/index.js:21:18)

That is interesting. This is actually a different error message. Notice String matches URL with channel name that is now present. That means that BBYEN is not correctly detecting that you have a channel URL with a custom name.
The new error message Could not find channel ID using the API, which is different than before, is saying that it was not possible to find the channel ID for that URL with the YouTube API.
Searching for this channel URL seems to give no results in the YouTube data API.

Would you mind manually getting the ID for this channel using this method for now and I will work on adding a more reliable method that works for all channel URLs in the future?

Aah, that would make sense. How did it work for you though?
I have no issue adding the URL from the RSS method as I did previously, just wanted to test it using this method :)

I only fixed it to make the first error message you reported go away. I don't have the google auth stuff set up in my development environment right now, so I didn't get past that part.
I will try to add something for that other method.

Ahh okay, I misunderstood.
Thanks!

The latest commit c27fa4c09aa6bca37c998a51468703a3669575ab adds an alternative method to get the channel ID from the URL by parsing the ytInitalData object like this method. Both methods are still implemented, and the first method to return a valid result will be used. I have tested for the URL https://www.youtube.com/c/HomesystemSk and it is working. @NightMean Would you mind testing that commit?

Works perfectly. The URL got converted to the channel ID without any issue.
2022-10-04T15:03:47.779Z [verbose] [videos]: Checking channel HomeSystem.sk (UCVOWBEMYDcDOYo_2L2zHrqA) {}
Thanks a lot!
Quick question, I've seen the commit e615487398b5f48de111f02cb9b7c674e52ecba1.
Does that makes it so I'll receive email whenever Google decides to refuse my API e.g as mentioned in https://github.com/MarcelRobitaille/bbyen/issues/7?

Unfortunately no. It only sends emails about errors encountered after the authentication is set up, the config is validated, etc. The reason is that the email setup depends on the config, which depends on Google authentication (to get the channel IDs for channel URLs).
However, the purpose is to notify you if an email is encountered after the service has been running for a long time. If the authentication fails, you should know immediately after starting the service.
If the new method I added today to get the channel ID is reliable, maybe I can remove the YouTube API method, which would remove the config validation's dependency on Google authentication. That way, I could set up the config and email first and send email notifications on Google authentication errors.

If the new method I added today to get the channel ID is reliable, maybe I can remove the YouTube API method, which would remove the config validation's dependency on Google authentication. That way, I could set up the config and email first and send email notifications on Google authentication errors.

That would be perfect! Currently I have to re-authorize every week or so as I receive the invalid grant mentioned in #7. Currently I have no way of knowing if there wasn't any new video uploaded from the whitelisted channels or that the authorization failed again.
The new method seems to work fine and reliable. I believe issue can be closed.
Thank you

@NightMean Ah, you should still get emails if you get an invalid grant. That is related to authentication, but is not caused by the initial authentication setup itself. Rather, it's caused by making an API call with credentials that Google has invalidated for whatever reason. Please let me know if you get an email the next time that invalid grand error arises.
You should not be getting an invalid grant and having to re-authenticate every week. You can open an issue about it, but I think the issue lies with google and there is likely little I can do.
If you don't mind, I will close this for now.


Backtest Performance Issues

Running a backtest just takes too long.
Using the following configuration, it completes in 4.64 minutes.
{
    "Type": "Candlestick Pattern",
    "Name": "Bullish Engulfing 1",
    "Source": "eodhd.com",
    "Description": "move: 0.1;prologue len: 15;trend desc: S21C;vol factor: 1",
    "Entry Price Point": "Close",
    "Target Up": {
        "Price Point": "High",
        "Value": 0.1
    },
    "Target Down": {
        "Price Point": "Low",
        "Value": 0.1
    },
    "Signal Names": [
        "Bullish Engulfing"
    ],
    "Length of Prologue": 15,
    "Max Parallelization": 10,
    "Only Signal With Market": false,
    "Volume Factor": 1,
    "Chart Configuration": {
        "Interval": "Daily",
        "Moving Averages": null,
        "Trend Configuration": [
            {
                "Trend": "S21C",
                "Weight": null
            }
        ]
    },
    "Market Configuration": null
}

One problem is the length of time it takes to complete this query:
        public string FetchCodesAndCounts => _dbDef.Engine switch
        {
            DatabaseEngine.PostgreSql => @"
SELECT P.code, E.industry, E.sector, COUNT(P.*)
FROM eod_adjusted_prices P
JOIN entities E ON P.source = E.source AND P.code = E.code
WHERE P.source = @Source
GROUP BY P.code, E.industry, E.sector
HAVING COUNT(P.*) > 500 AND
AVG(P.close) > 15",
            _ => ThrowSqlNotImplemented()
        };

This could be improved by adding some columns to the entities table, namely:

eod_count - the number of eod records.
avg_close - the average close on all eod records.
avg_volume - the average volume on all eod records.

The migration routine will have to be adjusted to preserve these database points on each migration.

Another enhancement to the database might be to store some averages with each price record:

The average height up to that point.
The average body height up to that point.
The average volume up to that point.

In the signal match algorithms, they could likely be improved by rearranging the conditions. By putting the Sentiment check at the top of the if statement, it will lower complexity.

Profiling the execution indicates that memory continues to increase as the program runs; might be an opportunity to clean up some objects instead of waiting for garbage collection to do it.

Rearranging the order in which the if conditions are evaluated reduced the runtime to 3.66 minutes; ~20% improvement.


speedy_tank

This is a small improvement based on tiny_tank.
In this pull request, I made
Increased Mobility: Faster movement speed (5.0f) and rotation (360°/s), making it highly agile.
Rapid Fire: Reduced cooldown for firing, allowing it to shoot twice as fast as TinyTank.
Enhanced Projectile Speed: Bullets have an initial velocity of 20.0f, improving range and accuracy.
Consistent Appearance: Retains the same model and visual style as TinyTank.
Personalized Identity: Custom unit name ("Speedy Tank") and author ("Allen_Liu").


Fix: style on selected range

i wanna fix bug on styling selected date range
from this

to this

i add condition for selected range with single and same day
from this

to be this

same problem. Hope it can be fixed soon.

any chance to merge it :) ?

any chance to merge it :) ?

i think yes, how to merge it?

LGTM!
However, there is still a related issue with the selected range when displayFullDays = true:

Start date is in the previous month
End date is in the next month
Start date is in the previous month and end date is in the next month
Start date and end date are in the current month

❌
❌
❌
✅

Any idea how to fix it? If so, wouldn't be a good idea to include it in this PR too?

i have fix it but i haven't push it

LGTM! However, there is still a related issue with the selected range when displayFullDays = true:
Start date is in the previous month	End date is in the next month	Start date is in the previous month and end date is in the next month	Start date and end date are in the current month

❌	❌	❌	✅
Any idea how to fix it? If so, wouldn't be a good idea to include it in this PR too?

i have fixed it and created a new pr. https://github.com/farhoudshapouran/react-native-ui-datepicker/pull/113


Adding Luminus Technical University and College in Jordan

added @ltuc.com (/lib/domains/com/ltuc.txt) for teachers.
added @students.ltuc.com (/lib/domains/com/ltuc/students.txt) for students.

The emails added are used only by the institute members, such as teachers and students from the same college.
Kindly note that I'm a software engineering student at LTUC. And representing the college for adding them to this repository, and Software Engineering and related fields can use and learn about the IDEs offered by Jetbrains.

@abdelsh First stage of verification passed, official domain for Luminus Technical University and College is ltuc.com as far as I verified. This is just an informational note. Pull request is still in the review. I appreciate your patience while waiting for the final decision.

@abdelsh I am sorry, the domain student.ltuc.com is removed from our trusted domains list because it was abused in the past. If you are the student of this school, please enroll to GitHub Student Developer Program. Then apply for JetBrains educational subscription with your GitHub account (GitHub tab at https://www.jetbrains.com/shop/eform/students).

@philipto Thanks for your quick reply, I will check the resources you sent. Therefore, I would like to ask what can I do to change your point of view on the student.ltuc.com? Such as training the students to not use it, or advising the college to have more strict rules with the usage of other company's software? Is there anything we can do, so software students can have access to this type of educational resources? Thanks again and looking forward to hear from you. :)