envoyproxy / envoyproxy/envoy

ext-authz cannot be used with DNS.

Abierto
#4,637 9 comentarios 0 reacciones 1 asignado Reclamado por @gsagula Ver en GitHub
area/ext_authz bug help wanted
Lenguaje dominante
C++
Estrellas
28.9k
Forks
5.6k
Merge medio
1 d 22 h
PR fusionados (30 d)
430

Descripción

**Issue Template**

*Title*: *ext-authz cannot be used with DNS.*

*Description*:
>When using a statically configured ext-authz cluster that has a cluster type of STRICT_DNS or LOGICAL_DNS the ext-authz filter will use the incoming host header for routing requests. This is problematic because if the wrong host is selected during routing traffic will flow to a cluster that may return 200 and allow traffic through where it shouldn't.

*Repro steps*:
- Statically configure a cluster for accepting ext-authz traffic. This cluster must use DNS as its cluster type.
- Configure any routes (ex: "foo.local", "bar.local")
- send requests to "foo.local". Requests intended for auth.local will instead be routed to `foo.local`.

*Config*:
```
filters:
- name: envoy.ext_authz
stat_prefix: ext_authz
grpc_service:
envoy_grpc:
cluster_name: ext-authz

clusters:
- name: ext-authz
type: STRICT_DNS
http2_protocol_options: {}
hosts:
- socket_address: { address: auth.local, port_value: 80 }
```

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.