tls: add options to validate SANs and send SNI for upstream hostname #36903

ggreenway · 2024-10-29T23:46:55Z

These options are related, but do not have to be used together.

The existing auto_sni and auto_san_validation make Envoy set upstream TLS SNI and validate SANs based on the downstream requests's :authority (or override header).

The new auto_host_sni option causes Envoy to set the upstream TLS SNI to the hostname in the cluster for the host being connected to. For example, in a DNS cluster with server1.example.com and server2.example as the cluster members, connections would have SNI of server1.example.com and server2.example.com, respectively.

The new auto_sni_san_validation option causes Envoy to validate that the peer's server certificate has a DNS SAN that matches whatever SNI value was sent (regardless of how it's configured). This is appropriate to set in many/most configurations for normally-behaving upstream servers without special certificate validation requirements.

Risk Level: Low
Testing: New tests
Release Notes: Added

Signed-off-by: Greg Greenway <[email protected]>

repokitteh-read-only · 2024-10-29T23:47:06Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @abeyad
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #36903 was opened by ggreenway.

see: more, trace.

Signed-off-by: Greg Greenway <[email protected]>

abeyad

/lgtm api

abeyad · 2024-10-31T14:58:57Z

/assign-from @envoyproxy/senior-maintainers

repokitteh-read-only · 2024-10-31T14:59:04Z

@envoyproxy/senior-maintainers assignee is @alyssawilk

🐱

Caused by: a #36903 (comment) was created by @abeyad.

see: more, trace.

Signed-off-by: Greg Greenway <[email protected]>

RyanTheOptimist

I think I might be a bit unclear about the use case here. Do we have an issue which explains the motivation? Or maybe we could just flesh out the PR description?

RyanTheOptimist · 2024-11-05T06:06:07Z

api/envoy/extensions/transport_sockets/tls/v3/tls.proto

+  // If true, replace any Subject Alternative Name validations with a validation for a DNS SAN matching
+  // the SNI value sent. Note that the validation will be against the actual requested SNI, regardless of how it
+  // is configured.
+  bool auto_sni_san_validation = 7;


I don't think I quite understand the semantics here. Perhaps we could have an example?

RyanTheOptimist · 2024-11-05T06:15:57Z

api/envoy/extensions/transport_sockets/tls/v3/tls.proto

+  // the hostname is known due to either a DNS cluster type or the
+  // :ref:`hostname <envoy_v3_api_field_config.endpoint.v3.Endpoint.hostname>` is set on
+  // the host.
+  bool auto_host_sni = 6;


How is this intended to relate to the auto_sni here:
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#config-core-v3-upstreamhttpprotocoloptions
And ditto for auto_san_validation vs auto_sni_san_validation?

ggreenway · 2024-11-05T17:46:43Z

I updated the PR description with a lot more details. That text should probably make it into the docs somewhere; do you have a good idea of the appropriate place for them?

abeyad · 2024-11-07T15:27:33Z

auto_san_validation

Maybe here? https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#config-core-v3-upstreamhttpprotocoloptions

Also, could add to the protocol buffer changes for more elucidation.

Signed-off-by: Greg Greenway <[email protected]>

ggreenway · 2024-11-07T19:32:09Z

I took a stab at finding a common place to describe the various related options and their interactions, and linked to that from the proto fields. I also made some minor cleanups and corrections.

ggreenway · 2024-11-07T19:33:27Z

docs/root/start/quick-start/_include/envoy-demo-tls-sni.yaml

@@ -60,3 +60,11 @@ static_resources:
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        sni: www.envoyproxy.io
+        common_tls_context:


I added this because I didn't want an example to not have a validation_context. That makes it a dangerously-insecure example.

probably we can use 1 config file and just highlight different parts - i can follow up with this

ggreenway · 2024-11-07T19:34:03Z

docs/root/start/quick-start/_include/envoy-demo-tls-validation.yaml

@@ -46,6 +46,7 @@ static_resources:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        sni: proxy-postgres-backend.example.com


I added this so that it's a more complete example for how someone should actually configure this

im not sure i agree with this change - this is an example not using sni - also this breaks the highlighting

actually - it doesnt break it - its ~similar in current docs - wondering what should be highlighed here

Want me to revert this one? No SNI with validation is fine. Anything with no validation is probably not-fine.

yeah - understood - on balance i would say keep the status quo on this

ok, reverted that change

ggreenway · 2024-11-07T19:36:24Z

docs/root/start/quick-start/securing.rst

   :caption: :download:`envoy-demo-tls-validation.yaml <_include/envoy-demo-tls-validation.yaml>`

-.. note::
-
-   If the "Subject Alternative Names" for a certificate are for a wildcard domain, eg ``*.example.com``,


This note didn't make sense; Envoy will correctly validate an expected SAN of test.example.com against a certificate with *.example.com (Envoy considers that a match)

it was quite a while ago when i added this - but i thought i added it after testing it out

It's documented in match_typed_subject_alt_names; this definitely works

envoy/api/envoy/extensions/transport_sockets/tls/v3/common.proto

Line 495 in b28b7f6

// For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",

hmm - not sure - but im wondering if there are some circumstances where it doesnt work

If there are, it's a bug and we should fix it.

if i get some time ill try and retry the steps i might have taken

phlax · 2024-11-07T20:02:05Z

/docs

repokitteh-read-only · 2024-11-07T20:02:11Z

Docs for this Pull Request will be rendered here:

https://storage.googleapis.com/envoy-pr/36903/docs/index.html

The docs are (re-)rendered each time the CI envoy-presubmit (precheck docs) job completes.

🐱

Caused by: a #36903 (comment) was created by @phlax.

see: more, trace.

RyanTheOptimist

Thanks for the new comments and docs. LGTM, though obviously please wait for phlax's review too.

Signed-off-by: Greg Greenway <[email protected]>

phlax

lgtm, thanks @ggreenway

phlax · 2024-11-08T20:43:49Z

headsup that CI is currently down 8(

phlax · 2024-11-08T21:00:40Z

/retest

tls: add options to validate SANs and send SNI for upstream hostname

81b960e

Signed-off-by: Greg Greenway <[email protected]>

repokitteh-read-only bot added the api label Oct 29, 2024

repokitteh-read-only bot assigned abeyad Oct 29, 2024

ggreenway added 6 commits October 29, 2024 17:37

fix tests/mocks

2a3f7d2

Signed-off-by: Greg Greenway <[email protected]>

format

4afa88e

Signed-off-by: Greg Greenway <[email protected]>

format

9652d94

Signed-off-by: Greg Greenway <[email protected]>

fix

dc5cfd4

Signed-off-by: Greg Greenway <[email protected]>

fix test flake

a39a863

Signed-off-by: Greg Greenway <[email protected]>

Merge remote-tracking branch 'upstream/main' into auto-host-sni

d1ae94f

abeyad previously approved these changes Oct 31, 2024

View reviewed changes

repokitteh-read-only bot removed the api label Oct 31, 2024

repokitteh-read-only bot assigned alyssawilk Oct 31, 2024

alyssawilk assigned RyanTheOptimist and unassigned alyssawilk Nov 4, 2024

Merge remote-tracking branch 'upstream/main' into auto-host-sni

e1162e4

Signed-off-by: Greg Greenway <[email protected]>

ggreenway dismissed abeyad’s stale review via e1162e4 November 4, 2024 17:42

RyanTheOptimist reviewed Nov 5, 2024

View reviewed changes

ggreenway added 2 commits November 7, 2024 10:09

Merge remote-tracking branch 'upstream/main' into auto-host-sni

04bb7be

improve docs

4699715

Signed-off-by: Greg Greenway <[email protected]>

repokitteh-read-only bot added the api label Nov 7, 2024

ggreenway commented Nov 7, 2024

View reviewed changes

RyanTheOptimist previously approved these changes Nov 8, 2024

View reviewed changes

revert adding sni to example/docs in one case as per review comments

cc03ba4

Signed-off-by: Greg Greenway <[email protected]>

ggreenway dismissed RyanTheOptimist’s stale review via cc03ba4 November 8, 2024 20:16

ggreenway assigned phlax Nov 8, 2024

phlax approved these changes Nov 8, 2024

View reviewed changes

ggreenway enabled auto-merge (squash) November 8, 2024 21:00

ggreenway merged commit 8ef1ecc into envoyproxy:main Nov 9, 2024
23 of 24 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tls: add options to validate SANs and send SNI for upstream hostname #36903

tls: add options to validate SANs and send SNI for upstream hostname #36903

ggreenway commented Oct 29, 2024 •

edited

Loading

repokitteh-read-only bot commented Oct 29, 2024

abeyad left a comment

abeyad commented Oct 31, 2024

repokitteh-read-only bot commented Oct 31, 2024

RyanTheOptimist left a comment

RyanTheOptimist Nov 5, 2024

RyanTheOptimist Nov 5, 2024

ggreenway commented Nov 5, 2024

abeyad commented Nov 7, 2024

ggreenway commented Nov 7, 2024

ggreenway Nov 7, 2024

phlax Nov 8, 2024

ggreenway Nov 7, 2024

phlax Nov 8, 2024

phlax Nov 8, 2024

ggreenway Nov 8, 2024

phlax Nov 8, 2024

ggreenway Nov 8, 2024

ggreenway Nov 7, 2024 •

edited

Loading

phlax Nov 7, 2024 •

edited

Loading

ggreenway Nov 7, 2024 •

edited

Loading

phlax Nov 8, 2024

ggreenway Nov 8, 2024

phlax Nov 8, 2024

phlax commented Nov 7, 2024

repokitteh-read-only bot commented Nov 7, 2024

RyanTheOptimist left a comment

phlax left a comment

phlax commented Nov 8, 2024

phlax commented Nov 8, 2024

tls: add options to validate SANs and send SNI for upstream hostname #36903

tls: add options to validate SANs and send SNI for upstream hostname #36903

Conversation

ggreenway commented Oct 29, 2024 • edited Loading

repokitteh-read-only bot commented Oct 29, 2024

abeyad left a comment

Choose a reason for hiding this comment

abeyad commented Oct 31, 2024

repokitteh-read-only bot commented Oct 31, 2024

RyanTheOptimist left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ggreenway commented Nov 5, 2024

abeyad commented Nov 7, 2024

ggreenway commented Nov 7, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ggreenway Nov 7, 2024 • edited Loading

Choose a reason for hiding this comment

phlax Nov 7, 2024 • edited Loading

Choose a reason for hiding this comment

ggreenway Nov 7, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

phlax commented Nov 7, 2024

repokitteh-read-only bot commented Nov 7, 2024

RyanTheOptimist left a comment

Choose a reason for hiding this comment

phlax left a comment

Choose a reason for hiding this comment

phlax commented Nov 8, 2024

phlax commented Nov 8, 2024

ggreenway commented Oct 29, 2024 •

edited

Loading

ggreenway Nov 7, 2024 •

edited

Loading

phlax Nov 7, 2024 •

edited

Loading

ggreenway Nov 7, 2024 •

edited

Loading