Lightning Talk: Leveraging Envoy's New Filter Chain Matchers for Advanced TLS Rou...
summary
Extension to Envoy's filter_chain_matcher inspects client hello cipher suites, writes them into filter state, and uses a per-virtual-host match tree to pick one of three paths: native TLS termination, L4 proxy pass-through to a separate upstream, or handshake failure. Implementation is a C++ listener filter that emits uint16 cipher IDs (e.g. 49200) into config-driven match rules. Demo shows Envoy successfully terminating one cipher, returning handshake failure for another, and proxying a legacy cipher to a TCP echo upstream.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:31What motivated this application
- 1:39How does it work
- 3:10How does Envoy work
- 5:27Filter Chain Match
- 8:37Demonstration
- 10:14Summary
- 11:31Outro
related talks
11mLightning Talk: Building a Scalable Multi-Protocol API Gateway with Envoy
21mDeep Dive: Envoy
23mUsing Envoy as an Egress Proxy for TLS Enabled Traffic
09mLightning Talk: Manipulating HTTP Headers Using a Full Set of Substitution...
10mLightning Talk: Envoy Upstream Enhancements
42mAccelerating Envoy with the Linux Kernel
28mExtending Envoy for Our Use: An End User Adoption Story from Fidelity
11mLightning Talk: How to deploy mutually authenticated TLS without ruining everything