pomerium / pomerium / 5603560386

45%

push

github

envoy: add a filter to store client cert info (#4372)

Add a new Lua filter that will store client certificate info as dynamic
metadata. This will allow us to configure client certificate validation
at the Envoy listener level, and then pass the results of that
validation into our ExtAuthz service.

This also allows us to pass the entire client certificate chain (and not
just the leaf certificate, which is how the 'include_peer_certificate'
ExtAuthz setting behaves). This will allow us to add support for
intermediate CA certificates supplied by the client.

However, if a client certificate does not validate successfully by
Envoy, we will not store the certificate chain. (This should help guard
against any possibility of making policy decisions based on unvalidated
client certificate data.)

5 of 5 new or added lines in 1 file covered. (100.0%)

13640 of 21528 relevant lines covered (63.36%)

122.03 hits per line