fix ListenerSetProtocolConflict

Signed-off-by: zirain <zirain2009@gmail.com>

Author: zirain

internal/cmd/egctl/testdata/translate/in/default-resources.yaml

@@ -19,7 +19,7 @@ spec:
       port: 1234
     - name: udp
       protocol: UDP
-      port: 1234
+      port: 2345
     - name: tls-passthrough
       protocol: TLS
       port: 8443

internal/cmd/egctl/testdata/translate/in/from-gateway-api-to-xds.yaml

@@ -18,7 +18,7 @@ spec:
       port: 1234
     - name: udp
       protocol: UDP
-      port: 1234
+      port: 2345
     - name: tls-passthrough
       protocol: TLS
       port: 8443

internal/cmd/egctl/testdata/translate/in/valid-envoyproxy.yaml

@@ -36,7 +36,7 @@ spec:
       port: 1234
     - name: udp
       protocol: UDP
-      port: 1234
+      port: 2345
     - name: tls-passthrough
       protocol: TLS
       port: 8443

internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml

@@ -211,7 +211,7 @@ gateways:
         namespaces:
           from: Same
       name: udp
-      port: 1234
+      port: 2345
       protocol: UDP
     - allowedRoutes:
         namespaces:
@@ -1502,7 +1502,7 @@ xds:
             address:
               socketAddress:
                 address: 0.0.0.0
-                portValue: 1234
+                portValue: 2345
                 protocol: UDP
             listenerFilters:
             - name: envoy.filters.udp_listener.udp_proxy

internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json

@@ -1446,7 +1446,7 @@
                   "address": {
                     "socketAddress": {
                       "address": "0.0.0.0",
-                      "portValue": 1234,
+                      "portValue": 2345,
                       "protocol": "UDP"
                     }
                   },

internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml

@@ -923,7 +923,7 @@ xds:
             address:
               socketAddress:
                 address: 0.0.0.0
-                portValue: 1234
+                portValue: 2345
                 protocol: UDP
             listenerFilters:
             - name: envoy.filters.udp_listener.udp_proxy

internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.listener.yaml

@@ -473,7 +473,7 @@ xds:
           address:
             socketAddress:
               address: 0.0.0.0
-              portValue: 1234
+              portValue: 2345
               protocol: UDP
           listenerFilters:
           - name: envoy.filters.udp_listener.udp_proxy

internal/cmd/egctl/testdata/translate/out/valid-envoyproxy.all.yaml

@@ -55,7 +55,7 @@ gateways:
         namespaces:
           from: Same
       name: udp
-      port: 1234
+      port: 2345
       protocol: UDP
     - allowedRoutes:
         namespaces:

internal/gatewayapi/helpers.go

@@ -31,11 +31,9 @@ import (
 )
 
 const (
-	TCPProtocol = "TCP"
-	UDPProtocol = "UDP"
-
-	L4Protocol = "L4"
-	L7Protocol = "L7"
+	HTTPProtocol = "HTTP"
+	TCPProtocol  = "TCP"
+	UDPProtocol  = "UDP"
 
 	// CACertKey is the key used in ConfigMaps and Secrets to store CA certificate data
 	CACertKey = "ca.crt"
@@ -381,26 +379,27 @@ func hostnameMatchesWildcardHostname(hostname, wildcardHostname string) bool {
 	return len(wildcardMatch) > 0
 }
 
-func containsPort(ports []*protocolPort, port *protocolPort) bool {
-	for _, protocolPort := range ports {
-		curProtocol, curLevel := layer4Protocol(protocolPort)
-		myProtocol, myLevel := layer4Protocol(port)
-		if protocolPort.port == port.port && (curProtocol == myProtocol && curLevel == myLevel) {
-			return true
+func checkPortProtocol(gatewayPorts []*protocolPort, servicePort *protocolPort) (bool, bool) {
+	for _, gatewayPort := range gatewayPorts {
+		if gatewayPort.port != servicePort.port {
+			continue
 		}
+
+		return true, listenerProtocol(gatewayPort) == listenerProtocol(servicePort)
 	}
-	return false
+
+	return false, true
 }
 
-// layer4Protocol returns listener L4 protocol and listen protocol level
-func layer4Protocol(protocolPort *protocolPort) (string, string) {
+// listenerProtocol returns listener L4 protocol and listen protocol level
+func listenerProtocol(protocolPort *protocolPort) string {
 	switch protocolPort.protocol {
 	case gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType, gwapiv1.TLSProtocolType:
-		return TCPProtocol, L7Protocol
+		return HTTPProtocol
 	case gwapiv1.TCPProtocolType:
-		return TCPProtocol, L4Protocol
+		return TCPProtocol
 	default:
-		return UDPProtocol, L4Protocol
+		return UDPProtocol
 	}
 }
 

internal/gatewayapi/listener.go

@@ -45,6 +45,7 @@ func (t *Translator) ProcessListeners(gateways []*GatewayContext, xdsIR resource
 	t.validateConflictedLayer7Listeners(gateways)
 	t.validateConflictedLayer4Listeners(gateways, gwapiv1.TCPProtocolType)
 	t.validateConflictedLayer4Listeners(gateways, gwapiv1.UDPProtocolType)
+	t.validateConflictedProtocolsListeners(gateways)
 	if t.MergeGateways {
 		t.validateConflictedMergedListeners(gateways)
 	}
@@ -104,15 +105,10 @@ func (t *Translator) ProcessListeners(gateways []*GatewayContext, xdsIR resource
 			t.validateHostName(listener)
 
 			// Process conditions and check if the listener is ready
-			isReady := t.validateListenerConditions(listener)
-
-			if listener.isFromListenerSet() && isReady {
-				lsKey := types.NamespacedName{
-					Namespace: listener.listenerSet.Namespace,
-					Name:      listener.listenerSet.Name,
-				}.String()
-				gatewayAttachedListenerSets.Insert(lsKey)
-			}
+			// TODO: this's skipped in https://github.com/envoyproxy/gateway/pull/8194
+			// for TLSRouteInvalidNoMatchingListener conformance test, but looks like it's
+			// a must, consider to skip invalid listener again?
+			listenerValid := t.validateListenerConditions(listener)
 
 			address := netutils.IPv4ListenerAddress
 			ipFamily := getEnvoyIPFamily(gateway.envoyProxy)
@@ -122,7 +118,30 @@ func (t *Translator) ProcessListeners(gateways []*GatewayContext, xdsIR resource
 
 			// Add the listener to the Xds IR
 			servicePort := &protocolPort{protocol: listener.Protocol, port: listener.Port}
+			// Add the listener to the Infra IR.
+			// Infra IR ports must have a unique port number per layer protocol.
+			gatewayPortProtocols := foundPorts[irKey]
+			portExists, protocolValid := checkPortProtocol(gatewayPortProtocols, servicePort)
+			if !protocolValid {
+				continue
+			}
+
+			if listener.isFromListenerSet() && listenerValid {
+				lsKey := types.NamespacedName{
+					Namespace: listener.listenerSet.Namespace,
+					Name:      listener.listenerSet.Name,
+				}.String()
+				gatewayAttachedListenerSets.Insert(lsKey)
+			}
+			foundPorts[irKey] = append(foundPorts[irKey], servicePort)
 			containerPort := t.servicePortToContainerPort(listener.Port, gateway.envoyProxy)
+			if !portExists {
+				// Only add to Infra IR if the port number is unique for the layer protocol.
+				// If the same port number is used in another listener with a different protocol,
+				// it will be skipped when checking port protocol.
+				t.processInfraIRListener(listener, infraIR, irKey, servicePort, containerPort)
+			}
+
 			switch listener.Protocol {
 			case gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType:
 				irListener := &ir.HTTPListener{
@@ -184,14 +203,6 @@ func (t *Translator) ProcessListeners(gateways []*GatewayContext, xdsIR resource
 				}
 				xdsIR[irKey].UDP = append(xdsIR[irKey].UDP, irListener)
 			}
-
-			// Add the listener to the Infra IR. Infra IR ports must have a unique port number per layer-4 protocol
-			// (TCP or UDP).
-			if !containsPort(foundPorts[irKey], servicePort) {
-				t.processInfraIRListener(listener, infraIR, irKey, servicePort, containerPort)
-				foundPorts[irKey] = append(foundPorts[irKey], servicePort)
-			}
-
 		}
 		gateway.IncreaseAttachedListenerSets(uint32(len(gatewayAttachedListenerSets)))
 	}