Setting forward as false in JWT Authn filter config removes the JWT from headers, but doesn't remove JWT from query params or cookies. This change adds functionality to remove query parameters based on forward config
Risk Level: Low
Testing: Unit Testing
Signed-off-by: Arul Thileeban Sagayam <arul.thilee@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ ee075b7c2a5f8449bfc17fbab94010696d3ed052
This PR provides gRPC client level control over Envoy generated headers. It currently controls x-envoy-internal and x-forwarded-for (can be expanded if needed)
If false, header will be added. But it can be overridden by setting setSendInternal or setSendXff to false in
Http::AsyncClient::StreamOptions, as per stream control.
If true, header will be removed and can not be overridden by per stream option.
This logic is designed in this way because:
Preserve backwards compatible behavior:
Both headers are still sent by default
If any existing users remove them with StreamOptions, headers are still removed
Still provide the per stream override control
Override here implicitly means setting to false as their default value in AsyncClient::StreamOptions is true.
Thus, per stream override is still available, just in one-way direction: disable on per stream basis
The only thing is that now user can not set StreamOptions to true if they are disabled in config. But it should be fine because:
For existing user, no one should set them to true in StreamOptions as they are already default to true.
For future user, per stream control can still be achieved as stated above.
Signed-off-by: Tianyu Xia <tyxia@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 9ce333ba1c46cde9e1a7af5bef99aceea1a80d77
In the current SAN matcher, only DNS, URI, IP, EMAIL types are supported. This change adds support to match against OtherName. A new config field oid is added which helps define the type of OtherName SAN envoy needs to match against.
Signed-off-by: Arul Thileeban Sagayam <arul.thilee@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ aef38c45a33e7c6a292f4e432a2b4940955ed96b
* add knob disable_dynamic_metadata_ingestion
Signed-off-by: antoniovleonti <leonti@google.com>
* move changelog entry to a more appropriate section
Signed-off-by: antoniovleonti <leonti@google.com>
* ignore dynamic metadata rather than failing entire request
Signed-off-by: antoniovleonti <leonti@google.com>
* fix proto documentation for field
Signed-off-by: antoniovleonti <leonti@google.com>
* use BoolValue to get 'positive' bool name
Signed-off-by: antoniovleonti <leonti@google.com>
* adjust wording of proto field comment
Signed-off-by: antoniovleonti <leonti@google.com>
* add check that dynamic metadata is not being set
Signed-off-by: antoniovleonti <leonti@google.com>
* fix doc link
Signed-off-by: antoniovleonti <leonti@google.com>
* fix doc link
Signed-off-by: antoniovleonti <leonti@google.com>
* fix doc link
Signed-off-by: antoniovleonti <leonti@google.com>
* reword doc comment
Signed-off-by: antoniovleonti <leonti@google.com>
---------
Signed-off-by: antoniovleonti <leonti@google.com>
Signed-off-by: Antonio V. Leonti <53806445+antoniovleonti@users.noreply.github.com>
Mirrored from https://github.com/envoyproxy/envoy @ 8646385431c3b91b94a3727766813615eeeaca10
This patch adds a metadata field to the [LocalityLbEndpoints](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/endpoint/v3/endpoint_components.proto#config-endpoint-v3-localitylbendpoints) configuration. The new field can be used to perform transport socket matching for all endpoints in a locality:
```
load_assignment:
cluster_name: example_cluster
endpoints:
- metadata: # <----- This is new.
filter_metadata:
envoy.transport_socket_match:
network.id: vpc-1
lb_endpoints:
- endpoint:
address:
socket_address:
address: 10.1.1.1
port_value: 11337
- endpoint:
address:
socket_address:
address: 10.1.1.2
port_value: 11337
```
Notice the ability to add metadata alongside the collection of endpoints. The transport socket matcher will still check the `envoy.transport_socket_match` metadata for an endpoint, but now if there is no match it will look at that field in its locality's metadata. This essentially allows one to set a transport socket match for groups of endpoints with a single metadata field, which can significantly improve scalability for deployments with many endpoints as shown in https://github.com/envoyproxy/envoy/issues/34530.
Signed-off-by: Tony Allen <txallen@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ f0201e54683875efeecf09df7328ad374be52d2c
JWT Authentication filter returns a 401 response with the details of failure back to client. It also sets the WWWAuthenticate header with "invalid token". Addition of this config would allow stripping these response details and return a 401 which would help with limiting unintended data leakage.
Risk Level: Low
Testing: Integration & Manual testing
Docs Changes: Done
Release Notes: Done
Fixes#34474
Signed-off-by: Arul Thileeban Sagayam <arul.thilee@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 9df04137f02e1da97528bb739df462aaab983697
* api: Add total_{active,new,error}_connections to UpstreamLocalityStats
They are marked with `[#not-implemented-hide:]` and `work_in_progress`.
Implementation will be added later.
Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>
* Update api/envoy/config/endpoint/v3/load_report.proto
Co-authored-by: htuch <htuch@users.noreply.github.com>
Signed-off-by: AwesomePatrol <AwesomePatrol@users.noreply.github.com>
* Rename total_error_connections to total_fail_connections
Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>
* Add mention of metrics to docstring
Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>
* Mention Envoy when pointing out relation to metrics
Put metric names in `` (as in other parts of the file)
Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>
---------
Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>
Signed-off-by: AwesomePatrol <AwesomePatrol@users.noreply.github.com>
Co-authored-by: htuch <htuch@users.noreply.github.com>
Mirrored from https://github.com/envoyproxy/envoy @ d2a20a02b6664c531e51cce04cc4283cb554ed4c
The extra dependency was introduced in 65273b2a9b. pgv.patch is only
used by envoy_api, so just moving the file avoids the dependency.
Signed-off-by: Eric Anderson <ejona@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 9fde867399cc7fcf97815995f8466f62172b26f6
Seems until now, we still have no a common key/value API that be applied to string-map-like structures. This PR add one.
Then we can use this API for query mutation, cookie mutation. And this could also be used by non-HTTP headers (like dubbo attachment) or any string-map-like structures.
Risk Level: low. API only.
Testing: n/a.
Signed-off-by: wbpcode <wbphub@live.com>
Mirrored from https://github.com/envoyproxy/envoy @ 3a0c2a4ffb5e199eed0be1738ff8e6590dcf94c6
Commit Message:
proxy_protocol_filter: Add field stat_prefix to the filter configuration
Additional Description:
This field allows for differentiating statistics when multiple proxy protocol listener filters are configured.
This PR is a follow-up from previous conversation: #32861 (comment)
Risk Level: Low
All client-facing behavior changes are guarded by new filter config field.
Testing:
Stats unit tests
Proxy protocol listener filter integration tests
Docs Changes:
Done
Release Notes:
Done
Platform Specific Features:
None
Signed-off-by: Teju Nareddy <tnareddy@confluent.io>
Mirrored from https://github.com/envoyproxy/envoy @ 69d4ef8d04678710ec1633e1e7effbda6623cc8d
Allows to preserve the exsting authorization header in oauth2 filter
Signed-off-by: Dennis Kniep <kniepdennis@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 7fcc47414c9ebc3915616730612b0608031ea8e9
Commit Message: Add the ability to bypass overload manager for listeners
Additional Description: This flag can be used to disable overload manager on specific listeners where, for instance, we don't want to stop accepting requests. In my company, we implemented a CPU Utilization resource monitor that helps us drop requests when we hit a certain utilization percentage, but there are certain listeners that receive administrative traffic that we don't want overload manager to touch. Another use case is, we want to only throttle ingress traffic but not egress traffic going via Envoy. Another contributor authored #29781, but it has been marked as stale.
Risk Level: Low
Testing: Unit tests & Integration tests added
Docs Changes: No
Release Notes: Add bypass_overload_manager flag to Listener in order to prevent overload manager from taking actions on the traffic going through the said listener.
Platform Specific Features:
Signed-off-by: Fernando Cainelli <fernando.cainelli-external@getyourguide.com>
Signed-off-by: Can Cecen <ccecen@netflix.com>
Mirrored from https://github.com/envoyproxy/envoy @ ea982dc8dd1afc2d4cacbcbb484cf00bc48dab93
resource_api_version has also been removed from all tests and
examples, as it isn't used for anything.
Signed-off-by: Greg Greenway <ggreenway@apple.com>
Mirrored from https://github.com/envoyproxy/envoy @ 505a8603f7997ef7a8ddd81fcba382caa2be5867
Commit Message: Add a way to configure a quic connection debug visitor factory that will be used to attach a debug visitor to all quic connections on the listener. Adds an interface for this new type of factory.
Additional Description:
Risk Level: Low
Testing: Added new tests and modified existing tests in /test/common/quic. Also performed manual testing on a real machine and sent traffic to it using quic_client.
Docs Changes: Update envoy.config.listener.v3.quic_config.proto inline.
Release Notes: N/A
Platform Specific Features: N/A
Signed-off-by: Will Lampert <wlampert@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 0c28205942066b2b5b2ef2a344c9357f27f642c7
This allows using system root certs in gRPC. For details, see grpc/proposal#436.
Risk Level: Low
Testing: N/A
Docs Changes: Included in PR
Signed-off-by: Mark D. Roth <roth@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 6364882088d5fce4b39d5ad3d0c0fac51c761b09
Expose config option for tcmalloc [memory background release rate](bf4db7e4c8/tcmalloc/malloc_extension.h (L637C15-L637C39), that eases tuning of tcmalloc in Envoy. Gperf tcmalloc is not yet supported in this change, as gperf tcmalloc memory release does not function the same way as tcmalloc does and introduced test flakiness.
Commit Message:
Additional Description:
Risk Level:
Testing: Unit tests
Docs Changes: API docs
Release Notes:
Platform Specific Features:
Signed-off-by: Kateryna Nezdolii <kateryna.nezdolii@gmail.com>
Signed-off-by: Kateryna Nezdolii <kateryna.nezdolii@docker.com>
Co-authored-by: Matt Klein <mattklein123@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 02dc6af0bd66af3105bb47919ee67102b6611feb
For apache thrift compatible HTTP requests and responses, this filter parses the thrift metadata and put them into filter dynamic metadata for other filter usage.
This is the initial proto design, which refers to other filters like json_to_metadata and payload_to_metadata.
Risk Level: low
Testing: build
Docs Changes: yes
#29371
Signed-off-by: kuochunghsu <kuochunghsu@pinterest.com>
Mirrored from https://github.com/envoyproxy/envoy @ 7081e5637c2cb0ecc90f1d1949c8acf27d576979
Created by Envoy dependency bot for @phlaxFix#34223
Signed-off-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>
Co-authored-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>
Mirrored from https://github.com/envoyproxy/envoy @ 580f37c7be39cae3bc9cf0eebf2227859487a86e
This PR provide a common data source provider to support file watching.
For the users who don't need the file watching or don't use the file data source, if the provider is used, then only need to pay 8 additional bytes and one additional if check (holds_alternative) compare to using the directly DataSource::read().
For the users who want to use the file watching, additional file watcher and TLS slot (ThreadLocalStorage) are necessary. This is much expensive but reasonable.
Risk Level: low.
Testing: unit.
Docs Changes: n/a.
Release Notes: n/a.
Platform Specific Features: n/a.
Signed-off-by: wbpcode <wbphub@live.com>
Signed-off-by: code <wangbaiping@corp.netease.com>
Mirrored from https://github.com/envoyproxy/envoy @ 838bc86a0fe46801320eef13cc599bc80bd88d10
* healthcheck: support TCP health check with ProxyProtocol
Signed-off-by: Rei Shimizu <shimizu.rei@linecorp.com>
Mirrored from https://github.com/envoyproxy/envoy @ a3ecbf09d08f457349126faaf64ce5005658637d
* Add command line flag to skip hot restart stats transfer
Signed-off-by: Raven Black <ravenblack@dropbox.com>
Mirrored from https://github.com/envoyproxy/envoy @ f0c232963ef5c36a3fe4f4697afc71ff3861873a
This PR is a follow up change for: #33582.
It is to support RouteCacheAction to force clearing the route cache in ext_proc filter even side stream server does not send the clear_route_cache in the response.
Signed-off-by: Yanjun Xiang <yanjunxiang@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ a7d3789c3eeda314c6a96be72485eb89a672a268
Risk Level: Low
Testing: Unit Tests
Signed-off-by: Yan Avlasov <yavlasov@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ ad82647bf6311f18d12321bbf65383ee4c5fc807
update-envoy[bot]