envoyproxy / envoyproxy/envoy

starttls should set ssl info for other filters

Open
#24,082 1 comment 0 reactions 0 assignees View on GitHub
area/postgres enhancement help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
428

Description

*Title*: starttls should set the ssl info (such as enabled, ssi, etc...) so that downstream filters can use it

*Description*:

I'm currently using the postgres proxy filter with ssl termination via starttls. This works really well for ssl connections, but I also want to disable cleartext connections. Since postgres connections start in cleartext and upgrade to tls, I can't just use a filter_chain_match for this. It would be really nice to be able to do something like this to confirm that a TLS handshake for "my-database-server" occurred before forwarding any traffic to the database cluster:
```
listener_filters:
- name: envoy.filters.listener.tls_inspector
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
filter_chains:
filters:
- name: envoy.filters.network.postgres_proxy
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.postgres_proxy.v3alpha.PostgresProxy
stat_prefix: postgres
terminate_ssl: true
- name: envoy.filters.network.rbac
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
stat_prefix: sql_rbac
rules:
action: ALLOW
policies:
"sni":
permissions:
- requested_server_name:
exact: "my-database-server"
principals:
- any: true
- name: envoy.filters.network.tcp_proxy
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
stat_prefix: destination
cluster: my-db-cluster
access_log:
- name: envoy.access_loggers.stdout
typed_config:
"@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog

transport_socket:
name: envoy.transport_sockets.starttls
typed_config:
"@type": type.googleapis.com/envoy.extensions.transport_sockets.starttls.v3.StartTlsConfig
tls_socket_config:
```
But this doesn't work because the starttls filter does not set the server name on the connection. As far as I can tell, it doesn't set any connection state or dynamic metadata based on the connections TLS properties.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.