{"action":"created","issue":{"url":"https://api.github.com/repos/envoyproxy/envoy/issues/5207","repository_url":"https://api.github.com/repos/envoyproxy/envoy","labels_url":"https://api.github.com/repos/envoyproxy/envoy/issues/5207/labels{/name}","comments_url":"https://api.github.com/repos/envoyproxy/envoy/issues/5207/comments","events_url":"https://api.github.com/repos/envoyproxy/envoy/issues/5207/events","html_url":"https://github.com/envoyproxy/envoy/pull/5207","id":387225507,"node_id":"MDExOlB1bGxSZXF1ZXN0MjM1NzYwODM1","number":5207,"title":"Support 'untrusted' client certificate routing","user":{"login":"jimini-lumox","id":45485811,"node_id":"MDQ6VXNlcjQ1NDg1ODEx","avatar_url":"https://avatars1.githubusercontent.com/u/45485811?v=4","gravatar_id":"","url":"https://api.github.com/users/jimini-lumox","html_url":"https://github.com/jimini-lumox","followers_url":"https://api.github.com/users/jimini-lumox/followers","following_url":"https://api.github.com/users/jimini-lumox/following{/other_user}","gists_url":"https://api.github.com/users/jimini-lumox/gists{/gist_id}","starred_url":"https://api.github.com/users/jimini-lumox/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimini-lumox/subscriptions","organizations_url":"https://api.github.com/users/jimini-lumox/orgs","repos_url":"https://api.github.com/users/jimini-lumox/repos","events_url":"https://api.github.com/users/jimini-lumox/events{/privacy}","received_events_url":"https://api.github.com/users/jimini-lumox/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"PiotrSikora","id":190297,"node_id":"MDQ6VXNlcjE5MDI5Nw==","avatar_url":"https://avatars3.githubusercontent.com/u/190297?v=4","gravatar_id":"","url":"https://api.github.com/users/PiotrSikora","html_url":"https://github.com/PiotrSikora","followers_url":"https://api.github.com/users/PiotrSikora/followers","following_url":"https://api.github.com/users/PiotrSikora/following{/other_user}","gists_url":"https://api.github.com/users/PiotrSikora/gists{/gist_id}","starred_url":"https://api.github.com/users/PiotrSikora/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PiotrSikora/subscriptions","organizations_url":"https://api.github.com/users/PiotrSikora/orgs","repos_url":"https://api.github.com/users/PiotrSikora/repos","events_url":"https://api.github.com/users/PiotrSikora/events{/privacy}","received_events_url":"https://api.github.com/users/PiotrSikora/received_events","type":"User","site_admin":false},"assignees":[{"login":"PiotrSikora","id":190297,"node_id":"MDQ6VXNlcjE5MDI5Nw==","avatar_url":"https://avatars3.githubusercontent.com/u/190297?v=4","gravatar_id":"","url":"https://api.github.com/users/PiotrSikora","html_url":"https://github.com/PiotrSikora","followers_url":"https://api.github.com/users/PiotrSikora/followers","following_url":"https://api.github.com/users/PiotrSikora/following{/other_user}","gists_url":"https://api.github.com/users/PiotrSikora/gists{/gist_id}","starred_url":"https://api.github.com/users/PiotrSikora/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PiotrSikora/subscriptions","organizations_url":"https://api.github.com/users/PiotrSikora/orgs","repos_url":"https://api.github.com/users/PiotrSikora/repos","events_url":"https://api.github.com/users/PiotrSikora/events{/privacy}","received_events_url":"https://api.github.com/users/PiotrSikora/received_events","type":"User","site_admin":false},{"login":"htuch","id":10914751,"node_id":"MDQ6VXNlcjEwOTE0NzUx","avatar_url":"https://avatars1.githubusercontent.com/u/10914751?v=4","gravatar_id":"","url":"https://api.github.com/users/htuch","html_url":"https://github.com/htuch","followers_url":"https://api.github.com/users/htuch/followers","following_url":"https://api.github.com/users/htuch/following{/other_user}","gists_url":"https://api.github.com/users/htuch/gists{/gist_id}","starred_url":"https://api.github.com/users/htuch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/htuch/subscriptions","organizations_url":"https://api.github.com/users/htuch/orgs","repos_url":"https://api.github.com/users/htuch/repos","events_url":"https://api.github.com/users/htuch/events{/privacy}","received_events_url":"https://api.github.com/users/htuch/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2018-12-04T10:47:25Z","updated_at":"2018-12-14T14:42:47Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/envoyproxy/envoy/pulls/5207","html_url":"https://github.com/envoyproxy/envoy/pull/5207","diff_url":"https://github.com/envoyproxy/envoy/pull/5207.diff","patch_url":"https://github.com/envoyproxy/envoy/pull/5207.patch"},"body":"*Description*: Add the ability to pass through and route 'untrusted' clients.\r\nUnit tests have not been added yet - want to get an early idea whether this PR would be rejected due to possible security concerns etc..\r\nBy default the client validation rules are unchanged.\r\n\r\nAdditional validation context options:\r\n* request_client_certificate :   // If specified, Envoy will always request for clients to provide their certificate (without requiring it).\r\n* permit_untrusted_client_certificate :  // If specified, Envoy will NOT reject connections using client certificates that have failed validation.\r\n* validation_permits_no_client_certificate :  // If specified, Envoy will NOT require a client certificate if a validation context exists.\r\n'untrusted' (either not validated, or failed validation) client certificate details added to 'x-forwarded-untrusted-client-cert' \r\n\r\n*Risk Level*: Medium\r\n*Testing*: Manual so far - unit tests will be added\r\n*Docs Changes*: API proto changes \r\n*Release Notes*: N/A\r\n"},"comment":{"url":"https://api.github.com/repos/envoyproxy/envoy/issues/comments/447345279","html_url":"https://github.com/envoyproxy/envoy/pull/5207#issuecomment-447345279","issue_url":"https://api.github.com/repos/envoyproxy/envoy/issues/5207","id":447345279,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NzM0NTI3OQ==","user":{"login":"PiotrSikora","id":190297,"node_id":"MDQ6VXNlcjE5MDI5Nw==","avatar_url":"https://avatars3.githubusercontent.com/u/190297?v=4","gravatar_id":"","url":"https://api.github.com/users/PiotrSikora","html_url":"https://github.com/PiotrSikora","followers_url":"https://api.github.com/users/PiotrSikora/followers","following_url":"https://api.github.com/users/PiotrSikora/following{/other_user}","gists_url":"https://api.github.com/users/PiotrSikora/gists{/gist_id}","starred_url":"https://api.github.com/users/PiotrSikora/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PiotrSikora/subscriptions","organizations_url":"https://api.github.com/users/PiotrSikora/orgs","repos_url":"https://api.github.com/users/PiotrSikora/repos","events_url":"https://api.github.com/users/PiotrSikora/events{/privacy}","received_events_url":"https://api.github.com/users/PiotrSikora/received_events","type":"User","site_admin":false},"created_at":"2018-12-14T14:42:47Z","updated_at":"2018-12-14T14:42:47Z","author_association":"MEMBER","body":"Oops, sorry for the delay, this felt off my radar.\r\n\r\nI think that we could simply add `verify_client_certificate: true|check|false`, where:\r\n- `true` would verify the client certificate and reject connection if the verification failed (what we have today),\r\n- `check` would verify the client certificate, but forward it and the verification status via `x-forwarded-client-cert` or another header (for easier matching), regardless of the verification status,\r\n- `false` would forward the client certificate to the backend via `x-forwarded-client-cert` without attempting to verify it (to avoid crypto operations, do access control at the backend, etc.).\r\n\r\nI believe that this, combined with the existing [`trusted_ca`](https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/auth/cert.proto#envoy-api-field-auth-certificatevalidationcontext-trusted-ca) and [`require_client_certificate`](https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/auth/cert.proto#envoy-api-field-auth-downstreamtlscontext-require-client-certificate) would work for @jimini-lumox, wouldn't it?\r\n\r\nAlso, we already have the [External Authorization filter](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/ext_authz_filter), which should work even better, shouldn't it?\r\n\r\nwrt filter chain matching, we do TLS after the filter chain and its TLS context are already selected, so doing verification, and then re-picking filter chain with a different TLS context in case of success/failure would be rather challenging and quite messy, IMHO."}}
{"actor":{"display_login":"PiotrSikora"}}