Skip to content

tcp_proxy: add COMMON_DURATION access log support#45449

Open
agrawroh wants to merge 3 commits into
envoyproxy:mainfrom
agrawroh:tcp-proxy-common-duration
Open

tcp_proxy: add COMMON_DURATION access log support#45449
agrawroh wants to merge 3 commits into
envoyproxy:mainfrom
agrawroh:tcp-proxy-common-duration

Conversation

@agrawroh
Copy link
Copy Markdown
Member

@agrawroh agrawroh commented Jun 4, 2026

Description

This PR adds a new COMMON_DURATION access log command operator for the TCP Proxy, which was previously rendered as - for TCP connections. The DS_CX_BEG, DS_CX_END, US_CX_BEG and US_CX_END connection time points would now get populated.

This could helps estimate the added latency for TLS termination and TCP proxying.


Commit Message: tcp_proxy: add COMMON_DURATION access log support
Additional Description: Added a new COMMON_DURATION access log command operator for the TCP Proxy.
Risk Level: Low
Testing: Added Tests
Docs Changes: Added
Release Notes: Added

@agrawroh agrawroh force-pushed the tcp-proxy-common-duration branch from a83d263 to fba91e8 Compare June 5, 2026 00:03
@agrawroh
Copy link
Copy Markdown
Member Author

agrawroh commented Jun 5, 2026

/gemini review

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds support for the COMMON_DURATION access log command operator to the TCP proxy, populating connection time points (DS_CX_BEG, DS_CX_END, US_CX_BEG, and US_CX_END) for TCP connections. Feedback suggests modifying onDownstreamConnectionEnd to only record the first close event instead of overwriting it, which prevents artificial inflation of connection duration metrics.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Comment thread envoy/stream_info/stream_info.h
Implement the COMMON_DURATION access log command operator for the TCP
proxy, which previously rendered as "-" for TCP connections. The
DS_CX_BEG, DS_CX_END, US_CX_BEG and US_CX_END connection time points are
now populated, which helps estimate added latency for TLS termination
and TCP proxying.

DS_CX_BEG and DS_CX_END are added as well-known COMMON_DURATION names,
backed by startTimeMonotonic() and a new DownstreamTiming connection-end
field. US_CX_BEG and US_CX_END are populated on the downstream
StreamInfo via the existing upstream connect timing setters.

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>
Co-authored-by: Isaac
Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>
@agrawroh agrawroh force-pushed the tcp-proxy-common-duration branch from fba91e8 to 60b8b9c Compare June 5, 2026 01:23
Copy link
Copy Markdown
Member

@botengyao botengyao left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for adding this support, and just have one major concern.

/wait

Comment thread source/common/tcp_proxy/tcp_proxy.cc Outdated
auto& time_source = read_callbacks_->connection().dispatcher().timeSource();
initial_upstream_connection_start_time_.emplace(time_source.monotonicTime());
// Record the upstream connect begin time point for COMMON_DURATION access logging.
getStreamInfo().upstreamInfo()->upstreamTiming().onUpstreamConnectStart(time_source);
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a onUpstreamConnectStart after the connection.connect() in the upstream client connection, for http, the upstream info is plumbed back to the downstream stream_info. Here, for tcp_proxy, this looks to me a little different, and it is more on the start of the connect attempt for the connection pool, which also could fail due to overflow, or other reasons.

I think there are two options:

  1. to really match what HTTP is doing, we can plumb the upstream connection stream_info to the downstream.
  2. update the naming/docs to say this is the upstream connection attempt begin from the pool.

up to you.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I like the 1st option to align with HTTP. I will remove the onUpstreamConnectStart call at the pool‑attempt site in establishUpstreamConnection, and instead plumb upstream_connect_start_/upstream_connect_complete_ from the upstream connection's StreamInfo in onGenericPoolReady.

It's gonna be similar to what Router::UpstreamRequest::onPoolReady does.

Comment thread source/common/tcp_proxy/tcp_proxy.cc Outdated
agrawroh added 2 commits June 5, 2026 20:58
Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants