Enable TLS Fingerprinting configuration (JA3/JA4)#7372
Enable TLS Fingerprinting configuration (JA3/JA4)#7372WUMUXIAN wants to merge 4 commits intoprojectcontour:mainfrom
Conversation
WUMUXIAN
requested review from
sunjayBhatia and
tsaarni
and removed request for
a team
sunjayBhatia
requested review from
a team,
clayton-gonsalves and
rajatvig
and removed request for
a team
|
Hi @WUMUXIAN! Welcome to our community and thank you for opening your first Pull Request. Someone will review it soon. Thank you for committing to making Contour better. You can also join us on our mailing list and in our channel in the Kubernetes Slack Workspace |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #7372 +/- ##
==========================================
- Coverage 81.18% 80.13% -1.06%
==========================================
Files 130 130
Lines 15803 15788 -15
==========================================
- Hits 12829 12651 -178
- Misses 2613 2624 +11
- Partials 361 513 +152
🚀 New features to boost your workflow:
|
|
hi @tsaarni , @sunjayBhatia can you review this? thank you |
WUMUXIAN
force-pushed
the
add_ja3_ja4_config_support
branch
from
ce51f73 to
8d38ebc
Compare
tsaarni
added
the
release-note/minor
Signed-off-by: Muxian Wu <muxianw@twitter.com>
Signed-off-by: Muxian Wu <muxianw@twitter.com>
|
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
github-actions
bot
added
the
lifecycle/stale
tsaarni
removed
the
lifecycle/stale
tsaarni
left a comment
tsaarni
left a comment
There was a problem hiding this comment.
Hi @WUMUXIAN, Thank You for contribution and sorry for the delay!
Have you considered how these fingerprints will be consumed or observed? I do not see that reflected in this change. Based on what I understood from Envoy documentation, the options include:
- Logging fingerprints in HTTP access logs (this requires changes in apis/projectcontour/v1alpha1/accesslog.go).
- Setting dynamic request headers (this requires changes in
internal/dag/policy.go). Header could make the fingerprints available to the backend service, and possibly to external authorization server.
We should also add some documentation regarding how to observe these fingerprints.
We need tests to verify this functionality. The simplest approach is to add unit tests in internal/featuretests/.
WUMUXIAN
force-pushed
the
add_ja3_ja4_config_support
branch
from
76feef1 to
4ccec21
Compare
Thanks for the thorough reviews! @tsaarni, I have updated the PR with all the comments addressed, please review again, ty! |
WUMUXIAN
force-pushed
the
add_ja3_ja4_config_support
branch
from
4ccec21 to
80b5e33
Compare
- Group JA3/JA4 config under a 'fingerprint' sub-struct in both the ContourConfiguration CRD (EnvoyTLS.Fingerprint) and the YAML config file (ProtocolParameters.Fingerprint) for cleaner API design. - Refactor TLSInspector() to be a no-arg function for backward compatibility, and add TLSInspectorWithConfig(enableJA3, enableJA4) for the configurable variant. - Refactor secureProxyProtocol() to accept the full ListenerConfig struct instead of individual boolean parameters. - Add access log support: register TLS_JA3_FINGERPRINT and TLS_JA4_FINGERPRINT as Envoy access log operators, add tls_ja3_fingerprint/tls_ja4_fingerprint JSON field aliases, and fix commandOperatorRegexp to support digits in operator names. - Add dynamic request header support: allow TLS_JA3_FINGERPRINT and TLS_JA4_FINGERPRINT variables in header policy values so fingerprints can be forwarded to backend services. - Add comprehensive tests: unit tests for TLSInspector/WithConfig, access log field validation, header policy passthrough, and feature tests covering JA3-only, JA4-only, both, and with PROXY protocol. - Add documentation: access log usage guide, request header variable list, and updated changelog. Signed-off-by: Muxian Wu <muxianw@twitter.com>
WUMUXIAN
force-pushed
the
add_ja3_ja4_config_support
branch
from
80b5e33 to
099a720
Compare
The testExternalAuth e2e test was flaky because it created the auth server deployment and immediately proceeded to make requests without waiting for the pod to be ready. In CI, image pulls and pod scheduling can be slow, causing Envoy's ext_authz filter to return 403 (default denial code for unreachable auth services) instead of the expected 401 from the auth server, even across the 60-second retry window. Add a wait for the auth server deployment to have at least one ready replica before creating the Service, ExtensionService, and HTTPProxy. This ensures Envoy can reach the ext_authz cluster when the test starts making requests. Signed-off-by: Muxian Wu <muxianw@twitter.com>
2 participants
internal/(envoy): Make it possible to enable TLS fingerprinting in Envoy's TLS Inspector Listener filter, useful for security monitoring, analytics, and bot detection. Provides independent control over JA3 and JA4 fingerprinting methods.
enableJA3Fingerprinting: Enable JA3 fingerprinting (requires Envoy 1.21.0+)
enableJA4Fingerprinting: Enable JA4 fingerprinting (requires Envoy 1.35.0+)
Both settings default to false.
Updates #7307
Release note: release-note/minor
Signed-off-by: Muxian Wu wumuxian1988@gmail.com