mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-29 10:26:29 +02:00
8e4f728c11
Add a new Lua filter that will store client certificate info as dynamic metadata. This will allow us to configure client certificate validation at the Envoy listener level, and then pass the results of that validation into our ExtAuthz service. This also allows us to pass the entire client certificate chain (and not just the leaf certificate, which is how the 'include_peer_certificate' ExtAuthz setting behaves). This will allow us to add support for intermediate CA certificates supplied by the client. However, if a client certificate does not validate successfully by Envoy, we will not store the certificate chain. (This should help guard against any possibility of making policy decisions based on unvalidated client certificate data.)
51 lines
1.1 KiB
Go
51 lines
1.1 KiB
Go
package envoyconfig
|
|
|
|
import (
|
|
"embed"
|
|
"io/fs"
|
|
)
|
|
|
|
//go:embed luascripts
|
|
var luaFS embed.FS
|
|
|
|
var luascripts struct {
|
|
ExtAuthzSetCookie string
|
|
CleanUpstream string
|
|
RemoveImpersonateHeaders string
|
|
RewriteHeaders string
|
|
SetClientCertificateMetadata string
|
|
}
|
|
|
|
func init() {
|
|
fileToField := map[string]*string{
|
|
"luascripts/clean-upstream.lua": &luascripts.CleanUpstream,
|
|
"luascripts/ext-authz-set-cookie.lua": &luascripts.ExtAuthzSetCookie,
|
|
"luascripts/remove-impersonate-headers.lua": &luascripts.RemoveImpersonateHeaders,
|
|
"luascripts/rewrite-headers.lua": &luascripts.RewriteHeaders,
|
|
"luascripts/set-client-certificate-metadata.lua": &luascripts.SetClientCertificateMetadata,
|
|
}
|
|
|
|
err := fs.WalkDir(luaFS, "luascripts", func(p string, d fs.DirEntry, err error) error {
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if d.IsDir() {
|
|
return nil
|
|
}
|
|
|
|
bs, err := luaFS.ReadFile(p)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if ptr, ok := fileToField[p]; ok {
|
|
*ptr = string(bs)
|
|
}
|
|
|
|
return nil
|
|
})
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
}
|