Envoy tap filter threat model clarifications

[lhluo]

Hi Envoy team, we're working on a custom filter extension that models after the Tap filter. In Envoy's threat model page, I see that envoy.filters.http.tap should "only be used when both the downstream and upstream are trusted". One of our top requirements is system security with untrusted downstreams. I dug into the tap filter implementation but couldn't identify any obvious attack vectors (admittedly C++ security is not my area of expertise).

I've posted to slack but this might be a better place to pose the question. Wondering if anyone with more familiarity can comment on the security implications of the tap filter? What are the risks of using a tap filter with an untrusted downstream?

[mattklein123]

It's only noted that because it hasn't been hardened. There may be buffering issues that need to be looked at, etc.

[lhluo]

@mattklein123 thanks for the answer. Could you clarify on what hardened means? How can we help harden this filter against untrusted downstreams?

[mattklein123]

Could you clarify on what hardened means? How can we help harden this filter against untrusted downstreams?

Run it in production, audit it for security/unlimited buffering/etc. issues.

[lhluo]

I'm assuming other "hardened" filters have undergone the above auditing?
Is there a standard process we use to audit envoy filters? Or case-by-case basis?

[mattklein123]

I wish I had a an official checklist for you but I don't. cc @htuch as such a checklist would be pretty nice from an extension maturity level tracking perspective.

[htuch]

I've opened #12962 to track this, with some suggestions to start things of.

[stale]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or "no stalebot" or other activity occurs. Thank you for your contributions.

[github-actions]

This issue has been automatically closed because it has not had activity in the last 37 days. If this issue is still valid, please ping a maintainer and ask them to label it as "help wanted" or "no stalebot". Thank you for your contributions.