http_connection_manager: support multiple SAN URIs for XFCC #20724
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Author
|
The core requirement we are asked is to support is I can put this behind a feature toggle if needed to get this merged. I would also like for this to be as a feature toggle in Envoy 1.19-1.21 as well, if possible. Thoughts? |
...when using APPEND_FORWARD and SANITIZE set. Currently XFCC only keeps the first URI in a certificate or a header presented to it. This works fine for most use cases, however, not everyone uses a single URI (typically spiffe:// only). Add every URI present to the 'By=' portion as well as the 'URI=' portion of an XFCC header. Signed-off-by: Jacob Delgado <jacob.delgado@volunteers.acasi.info>
Signed-off-by: Jacob Delgado <jacob.delgado@volunteers.acasi.info>
Contributor
Author
|
/retest |
|
Retrying Azure Pipelines: |
lizan
approved these changes
Apr 11, 2022
Member
lizan
left a comment
lizan
left a comment
There was a problem hiding this comment.
Looks good and I don't feel strongly we need a toggle for main branch.
Though I don't think we should backport either even with a toggle but backports are up to stable maintainer @pradeepcrao
Member
|
/assign-from @envoyproxy/senior-maintainers |
|
@envoyproxy/senior-maintainers assignee is @htuch |
vehre-x41
pushed a commit
to vehre-x41/envoy
that referenced
this pull request
Apr 19, 2022
…xy#20724) ...when using APPEND_FORWARD and SANITIZE set. Currently XFCC only keeps the first URI in a certificate or a header presented to it. This works fine for most use cases, however, not everyone uses a single URI (typically spiffe:// only). Add every URI present to the 'By=' portion as well as the 'URI=' portion of an XFCC header. Additional Description: Risk Level: Low Testing: Unit and integration tests Docs Changes: Yes. The appropriate http_connection_managers configuration section. Release Notes: Yes Fixes envoyproxy#20723 Signed-off-by: Jacob Delgado <jacob.delgado@volunteers.acasi.info> Signed-off-by: Andre Vehreschild <vehre@x41-dsec.de>
ravenblackx
pushed a commit
to ravenblackx/envoy
that referenced
this pull request
Jun 8, 2022
…xy#20724) ...when using APPEND_FORWARD and SANITIZE set. Currently XFCC only keeps the first URI in a certificate or a header presented to it. This works fine for most use cases, however, not everyone uses a single URI (typically spiffe:// only). Add every URI present to the 'By=' portion as well as the 'URI=' portion of an XFCC header. Additional Description: Risk Level: Low Testing: Unit and integration tests Docs Changes: Yes. The appropriate http_connection_managers configuration section. Release Notes: Yes Fixes envoyproxy#20723 Signed-off-by: Jacob Delgado <jacob.delgado@volunteers.acasi.info>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Commit Message:
...when using APPEND_FORWARD and SANITIZE set.
Currently XFCC only keeps the first URI in a certificate or a header presented
to it.
This works fine for most use cases, however, not everyone uses a single
URI (typically spiffe:// only).
Add every URI present to the 'By=' portion as well as the 'URI=' portion of an
XFCC header.
Additional Description:
Risk Level: Low
Testing: Unit and integration tests
Docs Changes: Yes. The appropriate http_connection_managers configuration section.
Release Notes: Yes
Fixes #20723