xds: shadow the entire non-enforced CSRF remainder

Envoy draws filter_enabled and shadow_enabled independently, so a partial
shadow_enabled compounded with filter_enabled instead of partitioning with
it: a request selected by neither was left unenforced and unevaluated, never
reaching the csrf stats. Enforcement was skewed upwards too, since the filter
re-randomizes both predicates at each of its two call sites -- shadowFraction
90 rejected ~17% of invalid requests rather than 10%.

Pin shadow_enabled to 100% and let filter_enabled alone carry the rollout.
featureEnabled() short-circuits at 100% without touching the PRNG, so the
filter's first gate becomes unconditional -- every mutating request reaches
the stats block -- and the reject decision reduces to a single filter_enabled
draw. shadowFraction 40 now yields exactly 60% enforced and 40% shadowed,
with nothing unevaluated.

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

Author: zhaohuabing

internal/xds/translator/csrf.go

@@ -144,16 +144,22 @@ func (*csrf) patchResources(*types.ResourceVersionTable, []*ir.HTTPRoute) error
 
 // buildXdsCSRFPolicy builds the full Envoy CSRF policy from the IR.
 func buildXdsCSRFPolicy(csrf *ir.CSRF) *csrfv3.CsrfPolicy {
-	// Envoy only lets an invalid request through in shadow mode if that request wasn't
-	// also selected by FilterEnabled, so enforcement is set to the complement of the
-	// shadow fraction: every request is either enforced or observed, never neither.
+	// Envoy rolls the dice separately for FilterEnabled and ShadowEnabled on every request.
+	// FilterEnabled decides whether the request is enforced. ShadowEnabled only applies to
+	// requests that FilterEnabled did not pick, because Envoy checks it as "shadow && !enabled".
+	//
+	// So FilterEnabled alone carries the fraction, set to the complement of the shadow
+	// fraction, while ShadowEnabled stays at 100% to pick up everything FilterEnabled left.
+	// A shadow fraction of 40% gives FilterEnabled 60%: 60% of requests are enforced and the
+	// other 40% are checked and recorded in the csrf stats but allowed through, so every
+	// request lands in one group or the other.
 	// With no shadow fraction, all requests are enforced.
 	enforcedFraction := fractionalpercent.FromIn32(100)
 	var shadowEnabled *corev3.RuntimeFractionalPercent
 	if csrf.ShadowFraction != nil {
 		enforcedFraction = fractionalpercent.FromFraction(complementFraction(csrf.ShadowFraction))
 		shadowEnabled = &corev3.RuntimeFractionalPercent{
-			DefaultValue: fractionalpercent.FromFraction(csrf.ShadowFraction),
+			DefaultValue: fractionalpercent.FromIn32(100),
 		}
 	}
 
@@ -164,9 +170,6 @@ func buildXdsCSRFPolicy(csrf *ir.CSRF) *csrfv3.CsrfPolicy {
 		ShadowEnabled: shadowEnabled,
 	}
 
-	// Values are passed directly to Envoy without transformation. Users must provide
-	// host:port values (not full URLs) because Envoy's CSRF filter strips the scheme
-	// from the Origin header before matching.
 	for _, origin := range csrf.AdditionalOrigins {
 		policy.AdditionalOrigins = append(policy.AdditionalOrigins, buildXdsStringMatcher(origin))
 	}

internal/xds/translator/csrf_test.go

@@ -17,8 +17,9 @@ import (
 )
 
 // Envoy only lets an invalid request through in shadow mode if that request wasn't also
-// selected by FilterEnabled, so the enforced fraction must be the complement of the
-// shadow fraction for shadowing to have any effect.
+// selected by FilterEnabled, and it draws the two fractions independently. FilterEnabled
+// must therefore be the complement of the shadow fraction, and ShadowEnabled must stay at
+// 100% so it claims the whole non-enforced remainder rather than a fraction of it.
 func TestBuildXdsCSRFPolicyFractions(t *testing.T) {
 	tests := []struct {
 		name           string
@@ -41,13 +42,13 @@ func TestBuildXdsCSRFPolicyFractions(t *testing.T) {
 			name:           "partial shadow fraction enforces the remainder",
 			shadowFraction: &gwapiv1.Fraction{Numerator: 20},
 			expectedFilter: &xdstype.FractionalPercent{Numerator: 80, Denominator: xdstype.FractionalPercent_HUNDRED},
-			expectedShadow: &xdstype.FractionalPercent{Numerator: 20, Denominator: xdstype.FractionalPercent_HUNDRED},
+			expectedShadow: &xdstype.FractionalPercent{Numerator: 100, Denominator: xdstype.FractionalPercent_HUNDRED},
 		},
 		{
 			name:           "custom denominator is preserved in the complement",
 			shadowFraction: &gwapiv1.Fraction{Numerator: 25, Denominator: ptr.To(int32(1000))},
 			expectedFilter: &xdstype.FractionalPercent{Numerator: 9750, Denominator: xdstype.FractionalPercent_TEN_THOUSAND},
-			expectedShadow: &xdstype.FractionalPercent{Numerator: 250, Denominator: xdstype.FractionalPercent_TEN_THOUSAND},
+			expectedShadow: &xdstype.FractionalPercent{Numerator: 100, Denominator: xdstype.FractionalPercent_HUNDRED},
 		},
 	}
 

internal/xds/translator/testdata/out/xds-ir/csrf.routes.yaml

@@ -41,5 +41,4 @@
               numerator: 9750
           shadowEnabled:
             defaultValue:
-              denominator: TEN_THOUSAND
-              numerator: 250
+              numerator: 100