envoyproxy / envoyproxy/envoy

ext-authz cannot be used with DNS.

Aperta
#4,637 9 commenti 0 reazioni 1 assegnatario Rivendicata da @gsagula Vedi su GitHub
area/ext_authz bug help wanted
Lingua principale
C++
Stelle
28.9k
Fork
5.6k
Merge medio
1g 22h
PR unite (30g)
430

Descrizione

**Issue Template**

*Title*: *ext-authz cannot be used with DNS.*

*Description*:
>When using a statically configured ext-authz cluster that has a cluster type of STRICT_DNS or LOGICAL_DNS the ext-authz filter will use the incoming host header for routing requests. This is problematic because if the wrong host is selected during routing traffic will flow to a cluster that may return 200 and allow traffic through where it shouldn't.

*Repro steps*:
- Statically configure a cluster for accepting ext-authz traffic. This cluster must use DNS as its cluster type.
- Configure any routes (ex: "foo.local", "bar.local")
- send requests to "foo.local". Requests intended for auth.local will instead be routed to `foo.local`.

*Config*:
```
filters:
- name: envoy.ext_authz
stat_prefix: ext_authz
grpc_service:
envoy_grpc:
cluster_name: ext-authz

clusters:
- name: ext-authz
type: STRICT_DNS
http2_protocol_options: {}
hosts:
- socket_address: { address: auth.local, port_value: 80 }
```

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.