You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Michael Zalimeni d9206fc7e2 [NET-1151 NET-11228] security: Add request normalization and header match options to prevent L7 intentions bypass (#21816) ... mesh: add options for HTTP incoming request normalization Expose global mesh configuration to enforce inbound HTTP request normalization on mesh traffic via Envoy xDS config. mesh: enable inbound URL path normalization by default mesh: add support for L7 header match contains and ignore_case Enable partial string and case-insensitive matching in L7 intentions header match rules. ui: support L7 header match contains and ignore_case Co-authored-by: Phil Renaud <phil@riotindustries.com> test: add request normalization integration bats tests Add both "positive" and "negative" test suites, showing normalization in action as well as expected results when it is not enabled, for the same set of test cases. Also add some alternative service container test helpers for verifying raw HTTP request paths, which is difficult to do with Fortio. docs: update security and reference docs for L7 intentions bypass prevention - Update security docs with best practices for service intentions configuration - Update configuration entry references for mesh and intentions to reflect new values and add guidance on usage		1 month ago
..
aclfilter	…
acltemplatedpolicy	remove v2 tenancy, catalog, and mesh (#21592)	3 months ago
acl.go	remove v2 tenancy, catalog, and mesh (#21592)	3 months ago
acl_cache.go	…
acl_cache_test.go	…
acl_ce.go	Remove old build tags (#19128)	1 year ago
acl_templated_policy.go	remove v2 tenancy, catalog, and mesh (#21592)	3 months ago
acl_templated_policy_ce.go	remove v2 tenancy, catalog, and mesh (#21592)	3 months ago
acl_templated_policy_ce_test.go	remove v2 tenancy, catalog, and mesh (#21592)	3 months ago
acl_templated_policy_test.go	…
acl_test.go	…
auto_encrypt.go	…
autopilot.go	…
autopilot_ce.go	Remove old build tags (#19128)	1 year ago
catalog.go	…
catalog_ce.go	Remove old build tags (#19128)	1 year ago
check_definition.go	…
check_definition_test.go	…
check_type.go	…
config_entry.go	NET-5912/service-defaults protocol validation (#21593)	3 months ago
config_entry_apigw_jwt_ce.go	Remove old build tags (#19128)	1 year ago
config_entry_ce.go	Remove old build tags (#19128)	1 year ago
config_entry_ce_test.go	Remove old build tags (#19128)	1 year ago
config_entry_discoverychain.go	Case sensitive route match (#19647)	10 months ago
config_entry_discoverychain_ce.go	Remove old build tags (#19128)	1 year ago
config_entry_discoverychain_ce_test.go	Remove old build tags (#19128)	1 year ago
config_entry_discoverychain_test.go	Case sensitive route match (#19647)	10 months ago
config_entry_exports.go	Hash based config entry replication (#19795)	12 months ago
config_entry_exports_ce.go	Remove old build tags (#19128)	1 year ago
config_entry_exports_ce_test.go	Remove old build tags (#19128)	1 year ago
config_entry_exports_test.go	…
config_entry_file_system_certificate.go	[NET-8091] Add file-system-certificate config entry for API gateway (#20873)	7 months ago
config_entry_gateways.go	[NET-8091] Add file-system-certificate config entry for API gateway (#20873)	7 months ago
config_entry_gateways_test.go	[NET-5688] APIGateway UI Topology Fixes (#19657)	1 year ago
config_entry_inline_certificate.go	Hash based config entry replication (#19795)	12 months ago
config_entry_inline_certificate_test.go	…
config_entry_intentions.go	[NET-1151 NET-11228] security: Add request normalization and header match options to prevent L7 intentions bypass (#21816)	1 month ago
config_entry_intentions_ce.go	Remove old build tags (#19128)	1 year ago
config_entry_intentions_ce_test.go	Remove old build tags (#19128)	1 year ago
config_entry_intentions_test.go	[NET-1151 NET-11228] security: Add request normalization and header match options to prevent L7 intentions bypass (#21816)	1 month ago
config_entry_jwt_provider.go	Hash based config entry replication (#19795)	12 months ago
config_entry_jwt_provider_ce.go	Remove old build tags (#19128)	1 year ago
config_entry_jwt_provider_test.go	…
config_entry_mesh.go	[NET-1151 NET-11228] security: Add request normalization and header match options to prevent L7 intentions bypass (#21816)	1 month ago
config_entry_mesh_ce.go	Remove old build tags (#19128)	1 year ago
config_entry_mesh_test.go	[NET-1151 NET-11228] security: Add request normalization and header match options to prevent L7 intentions bypass (#21816)	1 month ago
config_entry_routes.go	Hash based config entry replication (#19795)	12 months ago
config_entry_routes_test.go	…
config_entry_sameness_group.go	Hash based config entry replication (#19795)	12 months ago
config_entry_sameness_group_ce.go	Remove old build tags (#19128)	1 year ago
config_entry_status.go	…
config_entry_test.go	[NET-1151 NET-11228] security: Add request normalization and header match options to prevent L7 intentions bypass (#21816)	1 month ago
connect.go	…
connect_ca.go	remove v2 tenancy, catalog, and mesh (#21592)	3 months ago
connect_ca_test.go	…
connect_ce.go	Remove old build tags (#19128)	1 year ago
connect_proxy_config.go	remove v2 tenancy, catalog, and mesh (#21592)	3 months ago
connect_proxy_config_ce.go	Remove old build tags (#19128)	1 year ago
connect_proxy_config_test.go	…
deep-copy.sh	NET-5879 - expose sameness group param on service health endpoint and move sameness group health fallback logic into HealthService RPC layer (#21096)	6 months ago
discovery_chain.go	parse config protocol on write to optimize disco-chain compilation (#19829)	12 months ago
discovery_chain_ce.go	Remove old build tags (#19128)	1 year ago
dns.go	[OSS] feat: add experiments flag for v2 dns and skeleton interfaces (#20115)	11 months ago
dns_test.go	[OSS] feat: add experiments flag for v2 dns and skeleton interfaces (#20115)	11 months ago
envoy_extension.go	…
errors.go	remove v2 tenancy, catalog, and mesh (#21592)	3 months ago
federation_state.go	…
identity.go	…
intention.go	Add default intention policy (#20544)	10 months ago
intention_ce.go	Remove old build tags (#19128)	1 year ago
intention_test.go	…
operator.go	…
peering.go	…
prepared_query.go	…
prepared_query_test.go	…
protobuf_compat.go	…
service_definition.go	…
service_definition_test.go	…
snapshot.go	…
structs.deepcopy.go	[NET-1151 NET-11228] security: Add request normalization and header match options to prevent L7 intentions bypass (#21816)	1 month ago
structs.deepcopy_ce.go	Remove old build tags (#19128)	1 year ago
structs.go	NET-5879 - expose sameness group param on service health endpoint and move sameness group health fallback logic into HealthService RPC layer (#21096)	6 months ago
structs_ce.go	Remove old build tags (#19128)	1 year ago
structs_ce_test.go	Remove old build tags (#19128)	1 year ago
structs_ext_test.go	…
structs_filtering_test.go	…
structs_test.go	NET-5879 - move the filter for non-passing to occur in the health RPC layer rather than the callers of the RPC (#21098)	6 months ago
system_metadata.go	…
testing.go	…
testing_catalog.go	…
testing_connect_proxy_config.go	…
testing_intention.go	…
testing_service_definition.go	…
txn.go	…