area/ext_authzbughelp wanted
Repository-Metriken
- Stars
- (27.997 Stars)
- PR-Merge-Metriken
- (Durchschn. Merge 8T) (378 gemergte PRs in 30 T)
Beschreibung
Issue Template
Title: ext-authz cannot be used with DNS.
Description:
When using a statically configured ext-authz cluster that has a cluster type of STRICT_DNS or LOGICAL_DNS the ext-authz filter will use the incoming host header for routing requests. This is problematic because if the wrong host is selected during routing traffic will flow to a cluster that may return 200 and allow traffic through where it shouldn't.
Repro steps:
- Statically configure a cluster for accepting ext-authz traffic. This cluster must use DNS as its cluster type.
- Configure any routes (ex: "foo.local", "bar.local")
- send requests to "foo.local". Requests intended for auth.local will instead be routed to
foo.local.
Config:
filters:
- name: envoy.ext_authz
stat_prefix: ext_authz
grpc_service:
envoy_grpc:
cluster_name: ext-authz
clusters:
- name: ext-authz
type: STRICT_DNS
http2_protocol_options: {}
hosts:
- socket_address: { address: auth.local, port_value: 80 }