tls: add options to validate SANs and send SNI for upstream hostname by ggreenway · Pull Request #36903 · envoyproxy/envoy

ggreenway · 2024-10-29T23:46:55Z

These options are related, but do not have to be used together.

The existing auto_sni and auto_san_validation make Envoy set upstream TLS SNI and validate SANs based on the downstream requests's :authority (or override header).

The new auto_host_sni option causes Envoy to set the upstream TLS SNI to the hostname in the cluster for the host being connected to. For example, in a DNS cluster with server1.example.com and server2.example as the cluster members, connections would have SNI of server1.example.com and server2.example.com, respectively.

The new auto_sni_san_validation option causes Envoy to validate that the peer's server certificate has a DNS SAN that matches whatever SNI value was sent (regardless of how it's configured). This is appropriate to set in many/most configurations for normally-behaving upstream servers without special certificate validation requirements.

Risk Level: Low
Testing: New tests
Release Notes: Added

Signed-off-by: Greg Greenway <ggreenway@apple.com>

repokitteh-read-only · 2024-10-29T23:47:06Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @abeyad
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #36903 was opened by ggreenway.

see: more, trace.

Signed-off-by: Greg Greenway <ggreenway@apple.com>

abeyad

/lgtm api

abeyad · 2024-10-31T14:58:57Z

/assign-from @envoyproxy/senior-maintainers

repokitteh-read-only · 2024-10-31T14:59:04Z

@envoyproxy/senior-maintainers assignee is @alyssawilk

🐱

Caused by: a #36903 (comment) was created by @abeyad.

see: more, trace.

Signed-off-by: Greg Greenway <ggreenway@apple.com>

RyanTheOptimist

I think I might be a bit unclear about the use case here. Do we have an issue which explains the motivation? Or maybe we could just flesh out the PR description?

RyanTheOptimist · 2024-11-05T06:06:07Z

+  // If true, replace any Subject Alternative Name validations with a validation for a DNS SAN matching
+  // the SNI value sent. Note that the validation will be against the actual requested SNI, regardless of how it
+  // is configured.
+  bool auto_sni_san_validation = 7;


I don't think I quite understand the semantics here. Perhaps we could have an example?

RyanTheOptimist · 2024-11-05T06:15:57Z

+  // the hostname is known due to either a DNS cluster type or the
+  // :ref:`hostname <envoy_v3_api_field_config.endpoint.v3.Endpoint.hostname>` is set on
+  // the host.
+  bool auto_host_sni = 6;


How is this intended to relate to the auto_sni here:
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#config-core-v3-upstreamhttpprotocoloptions
And ditto for auto_san_validation vs auto_sni_san_validation?

ggreenway · 2024-11-05T17:46:43Z

I updated the PR description with a lot more details. That text should probably make it into the docs somewhere; do you have a good idea of the appropriate place for them?

abeyad · 2024-11-07T15:27:33Z

auto_san_validation

Maybe here? https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#config-core-v3-upstreamhttpprotocoloptions

Also, could add to the protocol buffer changes for more elucidation.

Signed-off-by: Greg Greenway <ggreenway@apple.com>

ggreenway · 2024-11-07T19:32:09Z

I took a stab at finding a common place to describe the various related options and their interactions, and linked to that from the proto fields. I also made some minor cleanups and corrections.

ggreenway · 2024-11-07T19:33:27Z

      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        sni: www.envoyproxy.io
+        common_tls_context:


I added this because I didn't want an example to not have a validation_context. That makes it a dangerously-insecure example.

probably we can use 1 config file and just highlight different parts - i can follow up with this

ggreenway · 2024-11-07T19:34:03Z

      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        sni: proxy-postgres-backend.example.com


I added this so that it's a more complete example for how someone should actually configure this

im not sure i agree with this change - this is an example not using sni - also this breaks the highlighting

actually - it doesnt break it - its ~similar in current docs - wondering what should be highlighed here

Want me to revert this one? No SNI with validation is fine. Anything with no validation is probably not-fine.

yeah - understood - on balance i would say keep the status quo on this

ok, reverted that change

ggreenway · 2024-11-07T19:36:24Z


-.. note::
-
-   If the "Subject Alternative Names" for a certificate are for a wildcard domain, eg ``*.example.com``,


This note didn't make sense; Envoy will correctly validate an expected SAN of test.example.com against a certificate with *.example.com (Envoy considers that a match)

it was quite a while ago when i added this - but i thought i added it after testing it out

It's documented in match_typed_subject_alt_names; this definitely works

envoy/api/envoy/extensions/transport_sockets/tls/v3/common.proto

Line 495 in b28b7f6

// For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",

hmm - not sure - but im wondering if there are some circumstances where it doesnt work

If there are, it's a bug and we should fix it.

if i get some time ill try and retry the steps i might have taken

phlax · 2024-11-07T20:02:05Z

/docs

repokitteh-read-only · 2024-11-07T20:02:11Z

Docs for this Pull Request will be rendered here:

https://storage.googleapis.com/envoy-pr/36903/docs/index.html

The docs are (re-)rendered each time the CI envoy-presubmit (precheck docs) job completes.

🐱

Caused by: a #36903 (comment) was created by @phlax.

see: more, trace.

RyanTheOptimist

Thanks for the new comments and docs. LGTM, though obviously please wait for phlax's review too.

Signed-off-by: Greg Greenway <ggreenway@apple.com>

phlax

lgtm, thanks @ggreenway

phlax · 2024-11-08T20:43:49Z

headsup that CI is currently down 8(

phlax · 2024-11-08T21:00:40Z

/retest

tls: add options to validate SANs and send SNI for upstream hostname

81b960e

Signed-off-by: Greg Greenway <ggreenway@apple.com>

repokitteh-read-only Bot added the api label Oct 29, 2024

repokitteh-read-only Bot assigned abeyad Oct 29, 2024

ggreenway added 6 commits October 29, 2024 17:37

fix tests/mocks

2a3f7d2

Signed-off-by: Greg Greenway <ggreenway@apple.com>

format

4afa88e

Signed-off-by: Greg Greenway <ggreenway@apple.com>

format

9652d94

Signed-off-by: Greg Greenway <ggreenway@apple.com>

fix

dc5cfd4

Signed-off-by: Greg Greenway <ggreenway@apple.com>

fix test flake

a39a863

Signed-off-by: Greg Greenway <ggreenway@apple.com>

Merge remote-tracking branch 'upstream/main' into auto-host-sni

d1ae94f

abeyad previously approved these changes Oct 31, 2024

View reviewed changes

repokitteh-read-only Bot removed the api label Oct 31, 2024

repokitteh-read-only Bot assigned alyssawilk Oct 31, 2024

alyssawilk assigned RyanTheOptimist and unassigned alyssawilk Nov 4, 2024

Merge remote-tracking branch 'upstream/main' into auto-host-sni

e1162e4

Signed-off-by: Greg Greenway <ggreenway@apple.com>

ggreenway dismissed abeyad’s stale review via e1162e4 November 4, 2024 17:42

RyanTheOptimist reviewed Nov 5, 2024

View reviewed changes

ggreenway added 2 commits November 7, 2024 10:09

Merge remote-tracking branch 'upstream/main' into auto-host-sni

04bb7be

improve docs

4699715

Signed-off-by: Greg Greenway <ggreenway@apple.com>

repokitteh-read-only Bot added the api label Nov 7, 2024

ggreenway commented Nov 7, 2024

View reviewed changes

RyanTheOptimist previously approved these changes Nov 8, 2024

View reviewed changes

revert adding sni to example/docs in one case as per review comments

cc03ba4

Signed-off-by: Greg Greenway <ggreenway@apple.com>

ggreenway dismissed RyanTheOptimist’s stale review via cc03ba4 November 8, 2024 20:16

ggreenway assigned phlax Nov 8, 2024

phlax approved these changes Nov 8, 2024

View reviewed changes

ggreenway enabled auto-merge (squash) November 8, 2024 21:00

ggreenway merged commit 8ef1ecc into envoyproxy:main Nov 9, 2024

ggreenway mentioned this pull request Nov 11, 2024

conn pool: use hostnames of endpoints as SNI values #35380

Closed

AleksanderBrzozowski mentioned this pull request Aug 21, 2025

Expose autoHostRewrite in HTTPRewrite for a virtual service istio/istio#56117

Closed

david-stroup mentioned this pull request Oct 30, 2025

Envoy Mobile DNS #41685

Closed

david-stroup mentioned this pull request Nov 27, 2025

Add API to specify server name for certificate validation for Envoy Mobile #42294

Open


		.. note::

		If the "Subject Alternative Names" for a certificate are for a wildcard domain, eg ``*.example.com``,

Conversation

ggreenway commented Oct 29, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

repokitteh-read-only Bot commented Oct 29, 2024

Uh oh!

abeyad left a comment

Choose a reason for hiding this comment

Uh oh!

abeyad commented Oct 31, 2024

Uh oh!

repokitteh-read-only Bot commented Oct 31, 2024

Uh oh!

RyanTheOptimist left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ggreenway commented Nov 5, 2024

Uh oh!

abeyad commented Nov 7, 2024

Uh oh!

ggreenway commented Nov 7, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ggreenway Nov 7, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

phlax Nov 7, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ggreenway Nov 7, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

phlax commented Nov 7, 2024

Uh oh!

repokitteh-read-only Bot commented Nov 7, 2024

Uh oh!

RyanTheOptimist left a comment

Choose a reason for hiding this comment

Uh oh!

phlax left a comment

Choose a reason for hiding this comment

Uh oh!

phlax commented Nov 8, 2024

Uh oh!

phlax commented Nov 8, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

ggreenway commented Oct 29, 2024 •

edited

Loading

ggreenway Nov 7, 2024 •

edited

Loading

phlax Nov 7, 2024 •

edited

Loading

ggreenway Nov 7, 2024 •

edited

Loading