Repository navigation
Implement passthrough egress policy - #2019
Lior Lieberman (LiorLieberman) merged 7 commits into
Conversation
Signed-off-by: Yan Avlasov <[email protected]>
Signed-off-by: Yan Avlasov <[email protected]>
Lior Lieberman (LiorLieberman)
left a comment
Lior Lieberman (LiorLieberman)
left a comment
There was a problem hiding this comment.
largely lgtm,
Is http a gap now?
|
Another thing I find, is that we have to re-resolve the sni we recieved for passthrough, we cant trust the actor resolved address. with this PR CONNECT leg sets the dialed IP:port as the passthrough destination, and this is taken from the ORIGINAL_DST. We have to instruct the gateway to not honor that ip the actor gave us and resolve the sni (if its a hostname) |
Signed-off-by: Yan Avlasov <[email protected]>
maybe |
Signed-off-by: Yan Avlasov <[email protected]>
Signed-off-by: Yan Avlasov <[email protected]>
Sounds good. I propose doing it in a followup PR as it will require adding SNI based DFP into the filter chain and testing. |
Yes. Will will need this one. I suggest a follow up PR, so we do not hold up release. |
Lior Lieberman (LiorLieberman)
left a comment
Lior Lieberman (LiorLieberman)
left a comment
There was a problem hiding this comment.
LGTM
We are fixing the SNI re-resolve in a quick follow-up
Maya Wang (mayawang)
added
kind/feature
Signed-off-by: Yan Avlasov <[email protected]>
8abfa18
| # Since this template is used to test both passthrough and MITM policies | ||
| # it will use both system and ATE bundles. | ||
| # For deployments with MITM only policies, add | ||
| # | ||
| # - name: SSL_CERT_DIR | ||
| # value: /run/ate | ||
| # | ||
| # to the "env" section to only use ATE bundle. |
There was a problem hiding this comment.
I dont think we need it
| # Since this template is used to test both passthrough and MITM policies | |
| # it will use both system and ATE bundles. | |
| # For deployments with MITM only policies, add | |
| # | |
| # - name: SSL_CERT_DIR | |
| # value: /run/ate | |
| # | |
| # to the "env" section to only use ATE bundle. |
There was a problem hiding this comment.
nit: you probably also need to do this fo microvm
Signed-off-by: Yan Avlasov <[email protected]>
8c70e89
The passthrough chain from agent-substrate#2019 dialed the ORIGINAL_DST filter state, which the CONNECT leg filled with the address the actor connected to. The SNI picked the chain, the actor's own resolution picked the destination, so a passthrough rule for one name let an actor reach any IP by claiming that name in the ClientHello. We fix it by: - The passthrough chain is now `sni_dynamic_forward_proxy` then `tcp_proxy` to a new raw forward-proxy cluster, `egress_forward_proxy_passthrough`, on the shared egress_dns_cache. The gateway resolves the SNI itself and sends the bytes to it. - The CONNECT leg answers the dialed port under dev.ate.egress:dialed_port; the outer chain copies it into envoy.upstream.dynamic_port, shared with the inner listener, which both the SNI filter and the cluster read before their configured port. > It's a good idea to open an issue first for discussion. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR
Implement passthrough egress policy.