{"action":"created","comment":{"url":"https://api.github.com/repos/istio/proxy/pulls/comments/237599068","pull_request_review_id":179938506,"id":237599068,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzNzU5OTA2OA==","diff_hunk":"@@ -0,0 +1,161 @@\n+/* Copyright 2018 Istio Authors. All Rights Reserved.\n+ *\n+ * Licensed under the Apache License, Version 2.0 (the \"License\");\n+ * you may not use this file except in compliance with the License.\n+ * You may obtain a copy of the License at\n+ *\n+ *    http://www.apache.org/licenses/LICENSE-2.0\n+ *\n+ * Unless required by applicable law or agreed to in writing, software\n+ * distributed under the License is distributed on an \"AS IS\" BASIS,\n+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n+ * See the License for the specific language governing permissions and\n+ * limitations under the License.\n+ */\n+\n+#include \"src/envoy/tcp/sni_verifier/sni_verifier.h\"\n+\n+#include \"envoy/buffer/buffer.h\"\n+#include \"envoy/common/exception.h\"\n+#include \"envoy/network/connection.h\"\n+#include \"envoy/stats/scope.h\"\n+\n+#include \"common/common/assert.h\"\n+\n+#include \"openssl/bytestring.h\"\n+#include \"openssl/ssl.h\"\n+\n+namespace Envoy {\n+namespace Tcp {\n+namespace SniVerifier {\n+\n+Config::Config(Stats::Scope& scope, uint32_t max_client_hello_size)\n+    : stats_{SNI_VERIFIER_STATS(POOL_COUNTER_PREFIX(scope, \"sni_verifier.\"))},\n+      ssl_ctx_(SSL_CTX_new(TLS_with_buffers_method())),\n+      max_client_hello_size_(max_client_hello_size) {\n+  if (max_client_hello_size_ > TLS_MAX_CLIENT_HELLO) {\n+    throw EnvoyException(fmt::format(\n+        \"max_client_hello_size of {} is greater than maximum of {}.\",\n+        max_client_hello_size_, size_t(TLS_MAX_CLIENT_HELLO)));\n+  }\n+\n+  SSL_CTX_set_options(ssl_ctx_.get(), SSL_OP_NO_TICKET);\n+  SSL_CTX_set_session_cache_mode(ssl_ctx_.get(), SSL_SESS_CACHE_OFF);\n+  SSL_CTX_set_tlsext_servername_callback(\n+      ssl_ctx_.get(), [](SSL* ssl, int* out_alert, void*) -> int {\n+        SniVerifierFilter* filter =\n+            static_cast<SniVerifierFilter*>(SSL_get_app_data(ssl));\n+        filter->onServername(\n+            SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name));\n+\n+        // Return an error to stop the handshake; we have what we wanted\n+        // already.\n+        *out_alert = SSL_AD_USER_CANCELLED;\n+        return SSL_TLSEXT_ERR_ALERT_FATAL;\n+      });\n+}\n+\n+bssl::UniquePtr<SSL> Config::newSsl() {\n+  return bssl::UniquePtr<SSL>{SSL_new(ssl_ctx_.get())};\n+}\n+\n+thread_local uint8_t SniVerifierFilter::buf_[Config::TLS_MAX_CLIENT_HELLO];","path":"src/envoy/tcp/sni_verifier/sni_verifier.cc","position":62,"original_position":62,"commit_id":"939e482c846ba80cff5b288d498118eaa37eb4d7","original_commit_id":"939e482c846ba80cff5b288d498118eaa37eb4d7","user":{"login":"qiwzhang","id":11790727,"node_id":"MDQ6VXNlcjExNzkwNzI3","avatar_url":"https://avatars0.githubusercontent.com/u/11790727?v=4","gravatar_id":"","url":"https://api.github.com/users/qiwzhang","html_url":"https://github.com/qiwzhang","followers_url":"https://api.github.com/users/qiwzhang/followers","following_url":"https://api.github.com/users/qiwzhang/following{/other_user}","gists_url":"https://api.github.com/users/qiwzhang/gists{/gist_id}","starred_url":"https://api.github.com/users/qiwzhang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qiwzhang/subscriptions","organizations_url":"https://api.github.com/users/qiwzhang/orgs","repos_url":"https://api.github.com/users/qiwzhang/repos","events_url":"https://api.github.com/users/qiwzhang/events{/privacy}","received_events_url":"https://api.github.com/users/qiwzhang/received_events","type":"User","site_admin":false},"body":"Is it possible that two filter instances from two downstream connections are sharing this buffer so their data collapse?","created_at":"2018-11-29T18:09:27Z","updated_at":"2018-11-29T18:09:27Z","html_url":"https://github.com/istio/proxy/pull/2046#discussion_r237599068","pull_request_url":"https://api.github.com/repos/istio/proxy/pulls/2046","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/istio/proxy/pulls/comments/237599068"},"html":{"href":"https://github.com/istio/proxy/pull/2046#discussion_r237599068"},"pull_request":{"href":"https://api.github.com/repos/istio/proxy/pulls/2046"}}},"pull_request":{"url":"https://api.github.com/repos/istio/proxy/pulls/2046","id":234409872,"node_id":"MDExOlB1bGxSZXF1ZXN0MjM0NDA5ODcy","html_url":"https://github.com/istio/proxy/pull/2046","diff_url":"https://github.com/istio/proxy/pull/2046.diff","patch_url":"https://github.com/istio/proxy/pull/2046.patch","issue_url":"https://api.github.com/repos/istio/proxy/issues/2046","number":2046,"state":"open","locked":false,"title":"[WIP] add sni_verifier filter","user":{"login":"vadimeisenbergibm","id":16784982,"node_id":"MDQ6VXNlcjE2Nzg0OTgy","avatar_url":"https://avatars1.githubusercontent.com/u/16784982?v=4","gravatar_id":"","url":"https://api.github.com/users/vadimeisenbergibm","html_url":"https://github.com/vadimeisenbergibm","followers_url":"https://api.github.com/users/vadimeisenbergibm/followers","following_url":"https://api.github.com/users/vadimeisenbergibm/following{/other_user}","gists_url":"https://api.github.com/users/vadimeisenbergibm/gists{/gist_id}","starred_url":"https://api.github.com/users/vadimeisenbergibm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vadimeisenbergibm/subscriptions","organizations_url":"https://api.github.com/users/vadimeisenbergibm/orgs","repos_url":"https://api.github.com/users/vadimeisenbergibm/repos","events_url":"https://api.github.com/users/vadimeisenbergibm/events{/privacy}","received_events_url":"https://api.github.com/users/vadimeisenbergibm/received_events","type":"User","site_admin":false},"body":"This PR solves the security hole described in https://goo.gl/cQ29rX, \"Enable egress policies per source workload\". The solution is related to the following text:\r\n\r\n> Set the outer SNI to be equal to the inner SNI in the sidecar proxy and then add a filter in the gateway’s proxy that will verify that the outer SNI and the inner SNI match.\r\n\r\nThis PR adds a filter \"that will verify that the outer SNI and the inner SNI match\".","created_at":"2018-11-28T20:14:42Z","updated_at":"2018-11-29T18:09:27Z","closed_at":null,"merged_at":null,"merge_commit_sha":"ebe40c4bf3bf8e06ff96766613edce45bd3df727","assignee":null,"assignees":[],"requested_reviewers":[{"login":"JimmyCYJ","id":28548492,"node_id":"MDQ6VXNlcjI4NTQ4NDky","avatar_url":"https://avatars0.githubusercontent.com/u/28548492?v=4","gravatar_id":"","url":"https://api.github.com/users/JimmyCYJ","html_url":"https://github.com/JimmyCYJ","followers_url":"https://api.github.com/users/JimmyCYJ/followers","following_url":"https://api.github.com/users/JimmyCYJ/following{/other_user}","gists_url":"https://api.github.com/users/JimmyCYJ/gists{/gist_id}","starred_url":"https://api.github.com/users/JimmyCYJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JimmyCYJ/subscriptions","organizations_url":"https://api.github.com/users/JimmyCYJ/orgs","repos_url":"https://api.github.com/users/JimmyCYJ/repos","events_url":"https://api.github.com/users/JimmyCYJ/events{/privacy}","received_events_url":"https://api.github.com/users/JimmyCYJ/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[{"id":712050392,"node_id":"MDU6TGFiZWw3MTIwNTAzOTI=","url":"https://api.github.com/repos/istio/proxy/labels/cla:%20yes","name":"cla: yes","color":"1d76db","default":false},{"id":989176649,"node_id":"MDU6TGFiZWw5ODkxNzY2NDk=","url":"https://api.github.com/repos/istio/proxy/labels/do-not-merge/work-in-progress","name":"do-not-merge/work-in-progress","color":"ededed","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/istio/proxy/pulls/2046/commits","review_comments_url":"https://api.github.com/repos/istio/proxy/pulls/2046/comments","review_comment_url":"https://api.github.com/repos/istio/proxy/pulls/comments{/number}","comments_url":"https://api.github.com/repos/istio/proxy/issues/2046/comments","statuses_url":"https://api.github.com/repos/istio/proxy/statuses/939e482c846ba80cff5b288d498118eaa37eb4d7","head":{"label":"ronenschafferibm:sni-verifier-master","ref":"sni-verifier-master","sha":"939e482c846ba80cff5b288d498118eaa37eb4d7","user":{"login":"ronenschafferibm","id":31612939,"node_id":"MDQ6VXNlcjMxNjEyOTM5","avatar_url":"https://avatars1.githubusercontent.com/u/31612939?v=4","gravatar_id":"","url":"https://api.github.com/users/ronenschafferibm","html_url":"https://github.com/ronenschafferibm","followers_url":"https://api.github.com/users/ronenschafferibm/followers","following_url":"https://api.github.com/users/ronenschafferibm/following{/other_user}","gists_url":"https://api.github.com/users/ronenschafferibm/gists{/gist_id}","starred_url":"https://api.github.com/users/ronenschafferibm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ronenschafferibm/subscriptions","organizations_url":"https://api.github.com/users/ronenschafferibm/orgs","repos_url":"https://api.github.com/users/ronenschafferibm/repos","events_url":"https://api.github.com/users/ronenschafferibm/events{/privacy}","received_events_url":"https://api.github.com/users/ronenschafferibm/received_events","type":"User","site_admin":false},"repo":{"id":147330250,"node_id":"MDEwOlJlcG9zaXRvcnkxNDczMzAyNTA=","name":"proxy","full_name":"ronenschafferibm/proxy","private":false,"owner":{"login":"ronenschafferibm","id":31612939,"node_id":"MDQ6VXNlcjMxNjEyOTM5","avatar_url":"https://avatars1.githubusercontent.com/u/31612939?v=4","gravatar_id":"","url":"https://api.github.com/users/ronenschafferibm","html_url":"https://github.com/ronenschafferibm","followers_url":"https://api.github.com/users/ronenschafferibm/followers","following_url":"https://api.github.com/users/ronenschafferibm/following{/other_user}","gists_url":"https://api.github.com/users/ronenschafferibm/gists{/gist_id}","starred_url":"https://api.github.com/users/ronenschafferibm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ronenschafferibm/subscriptions","organizations_url":"https://api.github.com/users/ronenschafferibm/orgs","repos_url":"https://api.github.com/users/ronenschafferibm/repos","events_url":"https://api.github.com/users/ronenschafferibm/events{/privacy}","received_events_url":"https://api.github.com/users/ronenschafferibm/received_events","type":"User","site_admin":false},"html_url":"https://github.com/ronenschafferibm/proxy","description":"The Istio proxy components.","fork":true,"url":"https://api.github.com/repos/ronenschafferibm/proxy","forks_url":"https://api.github.com/repos/ronenschafferibm/proxy/forks","keys_url":"https://api.github.com/repos/ronenschafferibm/proxy/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ronenschafferibm/proxy/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ronenschafferibm/proxy/teams","hooks_url":"https://api.github.com/repos/ronenschafferibm/proxy/hooks","issue_events_url":"https://api.github.com/repos/ronenschafferibm/proxy/issues/events{/number}","events_url":"https://api.github.com/repos/ronenschafferibm/proxy/events","assignees_url":"https://api.github.com/repos/ronenschafferibm/proxy/assignees{/user}","branches_url":"https://api.github.com/repos/ronenschafferibm/proxy/branches{/branch}","tags_url":"https://api.github.com/repos/ronenschafferibm/proxy/tags","blobs_url":"https://api.github.com/repos/ronenschafferibm/proxy/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ronenschafferibm/proxy/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ronenschafferibm/proxy/git/refs{/sha}","trees_url":"https://api.github.com/repos/ronenschafferibm/proxy/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ronenschafferibm/proxy/statuses/{sha}","languages_url":"https://api.github.com/repos/ronenschafferibm/proxy/languages","stargazers_url":"https://api.github.com/repos/ronenschafferibm/proxy/stargazers","contributors_url":"https://api.github.com/repos/ronenschafferibm/proxy/contributors","subscribers_url":"https://api.github.com/repos/ronenschafferibm/proxy/subscribers","subscription_url":"https://api.github.com/repos/ronenschafferibm/proxy/subscription","commits_url":"https://api.github.com/repos/ronenschafferibm/proxy/commits{/sha}","git_commits_url":"https://api.github.com/repos/ronenschafferibm/proxy/git/commits{/sha}","comments_url":"https://api.github.com/repos/ronenschafferibm/proxy/comments{/number}","issue_comment_url":"https://api.github.com/repos/ronenschafferibm/proxy/issues/comments{/number}","contents_url":"https://api.github.com/repos/ronenschafferibm/proxy/contents/{+path}","compare_url":"https://api.github.com/repos/ronenschafferibm/proxy/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ronenschafferibm/proxy/merges","archive_url":"https://api.github.com/repos/ronenschafferibm/proxy/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ronenschafferibm/proxy/downloads","issues_url":"https://api.github.com/repos/ronenschafferibm/proxy/issues{/number}","pulls_url":"https://api.github.com/repos/ronenschafferibm/proxy/pulls{/number}","milestones_url":"https://api.github.com/repos/ronenschafferibm/proxy/milestones{/number}","notifications_url":"https://api.github.com/repos/ronenschafferibm/proxy/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ronenschafferibm/proxy/labels{/name}","releases_url":"https://api.github.com/repos/ronenschafferibm/proxy/releases{/id}","deployments_url":"https://api.github.com/repos/ronenschafferibm/proxy/deployments","created_at":"2018-09-04T10:40:30Z","updated_at":"2018-09-04T10:40:33Z","pushed_at":"2018-11-29T16:45:21Z","git_url":"git://github.com/ronenschafferibm/proxy.git","ssh_url":"git@github.com:ronenschafferibm/proxy.git","clone_url":"https://github.com/ronenschafferibm/proxy.git","svn_url":"https://github.com/ronenschafferibm/proxy","homepage":"","size":2965,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":1,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"istio:master","ref":"master","sha":"14c0bb7fb78df41fe71ca407caf0ad87e308124f","user":{"login":"istio","id":23534644,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIzNTM0NjQ0","avatar_url":"https://avatars1.githubusercontent.com/u/23534644?v=4","gravatar_id":"","url":"https://api.github.com/users/istio","html_url":"https://github.com/istio","followers_url":"https://api.github.com/users/istio/followers","following_url":"https://api.github.com/users/istio/following{/other_user}","gists_url":"https://api.github.com/users/istio/gists{/gist_id}","starred_url":"https://api.github.com/users/istio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/istio/subscriptions","organizations_url":"https://api.github.com/users/istio/orgs","repos_url":"https://api.github.com/users/istio/repos","events_url":"https://api.github.com/users/istio/events{/privacy}","received_events_url":"https://api.github.com/users/istio/received_events","type":"Organization","site_admin":false},"repo":{"id":75322405,"node_id":"MDEwOlJlcG9zaXRvcnk3NTMyMjQwNQ==","name":"proxy","full_name":"istio/proxy","private":false,"owner":{"login":"istio","id":23534644,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIzNTM0NjQ0","avatar_url":"https://avatars1.githubusercontent.com/u/23534644?v=4","gravatar_id":"","url":"https://api.github.com/users/istio","html_url":"https://github.com/istio","followers_url":"https://api.github.com/users/istio/followers","following_url":"https://api.github.com/users/istio/following{/other_user}","gists_url":"https://api.github.com/users/istio/gists{/gist_id}","starred_url":"https://api.github.com/users/istio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/istio/subscriptions","organizations_url":"https://api.github.com/users/istio/orgs","repos_url":"https://api.github.com/users/istio/repos","events_url":"https://api.github.com/users/istio/events{/privacy}","received_events_url":"https://api.github.com/users/istio/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/istio/proxy","description":"The Istio proxy components.","fork":false,"url":"https://api.github.com/repos/istio/proxy","forks_url":"https://api.github.com/repos/istio/proxy/forks","keys_url":"https://api.github.com/repos/istio/proxy/keys{/key_id}","collaborators_url":"https://api.github.com/repos/istio/proxy/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/istio/proxy/teams","hooks_url":"https://api.github.com/repos/istio/proxy/hooks","issue_events_url":"https://api.github.com/repos/istio/proxy/issues/events{/number}","events_url":"https://api.github.com/repos/istio/proxy/events","assignees_url":"https://api.github.com/repos/istio/proxy/assignees{/user}","branches_url":"https://api.github.com/repos/istio/proxy/branches{/branch}","tags_url":"https://api.github.com/repos/istio/proxy/tags","blobs_url":"https://api.github.com/repos/istio/proxy/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/istio/proxy/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/istio/proxy/git/refs{/sha}","trees_url":"https://api.github.com/repos/istio/proxy/git/trees{/sha}","statuses_url":"https://api.github.com/repos/istio/proxy/statuses/{sha}","languages_url":"https://api.github.com/repos/istio/proxy/languages","stargazers_url":"https://api.github.com/repos/istio/proxy/stargazers","contributors_url":"https://api.github.com/repos/istio/proxy/contributors","subscribers_url":"https://api.github.com/repos/istio/proxy/subscribers","subscription_url":"https://api.github.com/repos/istio/proxy/subscription","commits_url":"https://api.github.com/repos/istio/proxy/commits{/sha}","git_commits_url":"https://api.github.com/repos/istio/proxy/git/commits{/sha}","comments_url":"https://api.github.com/repos/istio/proxy/comments{/number}","issue_comment_url":"https://api.github.com/repos/istio/proxy/issues/comments{/number}","contents_url":"https://api.github.com/repos/istio/proxy/contents/{+path}","compare_url":"https://api.github.com/repos/istio/proxy/compare/{base}...{head}","merges_url":"https://api.github.com/repos/istio/proxy/merges","archive_url":"https://api.github.com/repos/istio/proxy/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/istio/proxy/downloads","issues_url":"https://api.github.com/repos/istio/proxy/issues{/number}","pulls_url":"https://api.github.com/repos/istio/proxy/pulls{/number}","milestones_url":"https://api.github.com/repos/istio/proxy/milestones{/number}","notifications_url":"https://api.github.com/repos/istio/proxy/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/istio/proxy/labels{/name}","releases_url":"https://api.github.com/repos/istio/proxy/releases{/id}","deployments_url":"https://api.github.com/repos/istio/proxy/deployments","created_at":"2016-12-01T18:51:04Z","updated_at":"2018-11-29T05:37:29Z","pushed_at":"2018-11-29T16:45:22Z","git_url":"git://github.com/istio/proxy.git","ssh_url":"git@github.com:istio/proxy.git","clone_url":"https://github.com/istio/proxy.git","svn_url":"https://github.com/istio/proxy","homepage":"","size":2946,"stargazers_count":200,"watchers_count":200,"language":"C++","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":137,"mirror_url":null,"archived":false,"open_issues_count":36,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":137,"open_issues":36,"watchers":200,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/istio/proxy/pulls/2046"},"html":{"href":"https://github.com/istio/proxy/pull/2046"},"issue":{"href":"https://api.github.com/repos/istio/proxy/issues/2046"},"comments":{"href":"https://api.github.com/repos/istio/proxy/issues/2046/comments"},"review_comments":{"href":"https://api.github.com/repos/istio/proxy/pulls/2046/comments"},"review_comment":{"href":"https://api.github.com/repos/istio/proxy/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/istio/proxy/pulls/2046/commits"},"statuses":{"href":"https://api.github.com/repos/istio/proxy/statuses/939e482c846ba80cff5b288d498118eaa37eb4d7"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"qiwzhang"}}