Repository navigation
Egress policy plumbing - #1978
Conversation
Signed-off-by: Yan Avlasov <[email protected]>
Signed-off-by: Yan Avlasov <[email protected]>
Signed-off-by: Yan Avlasov <[email protected]>
Signed-off-by: Yan Avlasov <[email protected]>
Signed-off-by: Yan Avlasov <[email protected]>
Lior Lieberman (LiorLieberman)
left a comment
Lior Lieberman (LiorLieberman)
left a comment
There was a problem hiding this comment.
Thanks Yan, a few comments to fix in a followup;
-
HostnamePatterns seem to merge both https and tls_passthrough lists. until we passthrough works we need to drop these from the list likely
-
I understand wildcards are not supported, but they are compared verbatim. So
https: {hostnames: ["*"]}now means all traffic is blocked. Same for *.foo.com or wherever wildcard is used. -
how does is the tie-breaking rules implemented? I couldnt tell from the PR
-
we probably should prune the hostnamePatterns list by port?
-
if we are denied at the SNI level, its kinda invisible (i think) - we only have no_filter_chain_match which also counts other stuff like sniff timeouts. Maybe something like a listener-level access_log on mitm_listener with SNI, actor identity, and the chain filter state?
-
Why did we delete this test?
TestEgressManifestsClaimEveryTransportProtocol? -
why did we add
InsecureSkipVerifyto the test? we should not do that probably
|
we also need to re-enable this test - TestActorEgressHTTPSByHostnameMITM to run here - it would have caught the https issue probably |
Bowei Du (bowei)
added
area/demos
area/network
area/tests
Plumbing of actor's EgressPolicy into Envoy dataplane. This is the first commit that only implements SNI allowlist, without wildcards. Followup PRs will implement there rest of the policy:
httprules.