tls: implement SPIFFE Certificate Validator for independent multiple trust domain support

api/envoy/extensions/transport_sockets/tls/v3/common.proto

@@ -3,6 +3,7 @@ syntax = "proto3";
 package envoy.extensions.transport_sockets.tls.v3;
 
 import "envoy/config/core/v3/base.proto";
+import "envoy/config/core/v3/extension.proto";
 import "envoy/type/matcher/v3/string.proto";
 
 import "google/protobuf/any.proto";
@@ -212,7 +213,7 @@ message TlsSessionTicketKeys {
       [(validate.rules).repeated = {min_items: 1}, (udpa.annotations.sensitive) = true];
 }
 
-// [#next-free-field: 12]
+// [#next-free-field: 13]
 message CertificateValidationContext {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.auth.CertificateValidationContext";
@@ -372,4 +373,11 @@ message CertificateValidationContext {
   // Certificate trust chain verification mode.
   TrustChainVerification trust_chain_verification = 10
       [(validate.rules).enum = {defined_only: true}];
+
+  // The configuration of an extension specific certificate validator.
+  // If specified, all the values above are *ignored*.
+  // Currently only
+  // :ref:`envoy.extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig>`
+  // is implemented in Envoy.
+  config.core.v3.TypedExtensionConfig custom_validator_config = 12;
 }

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto

@@ -0,0 +1,46 @@
+syntax = "proto3";
+
+package envoy.extensions.transport_sockets.tls.v3;
+
+import "envoy/config/core/v3/base.proto";
+
+import "udpa/annotations/sensitive.proto";
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.transport_sockets.tls.v3";
+option java_outer_classname = "TlsSpiffeValidatorConfigProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: SPIFFE Certificate Validator Configuration]
+
+// Configuration specific to the SPIFFE certificate validator provided at
+// :ref:`envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.custom_validator_config<envoy_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.custom_validator_config>`.
+//
+// Example:
+//
+// .. code-block:: yaml
+//
+//  custom_validator_config:
+//    name: envoy.tls.cert_validator.spiffe
+//    typed_config:
+//      "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig
+//      trust_bundles:
+//        foo.com:
+//          filename: "foo.pem"
+//        envoy.com:
+//          filename: "envoy.pem"
+//
+// In this example, a presented peer certificate whose SAN matches `spiffe//foo.com/**` is validated against
+// the "foo.pem" x.509 certificate. All the trust bundles are isolated from each other, so no trust domain can mint
+// a SVID belonging to another trust domain. That means, in this example, a SVID signed by `envoy.com`'s CA with `spiffe//foo.com/**`
+// SAN would be rejected since Envoy selects the trust bundle according to the presented SAN before validate the certificate.
+message SPIFFECertValidatorConfig {
+  // This field specifies the x.509 trust bundles used for validating incoming X.509-SVID(s).
+  // The key is a SPIFFE trust domain, `example.com`, `foo.bar.gov` for example,
+  // and maps to a data source storing x.509 trust bundle.
+  // Note that the key must *not* have "spiffe://" prefix.
+  map<string, config.core.v3.DataSource> trust_bundles = 1;
+}

generated_api_shadow/BUILD

@@ -146,6 +146,7 @@ proto_library(
         "//envoy/config/retry/omit_canary_hosts/v2:pkg",
         "//envoy/config/retry/omit_canary_hosts/v3:pkg",
         "//envoy/config/retry/previous_hosts/v2:pkg",
+        "//envoy/config/retry/previous_hosts/v3:pkg",
         "//envoy/config/route/v3:pkg",
         "//envoy/config/tap/v3:pkg",
         "//envoy/config/trace/v3:pkg",

include/envoy/ssl/BUILD

@@ -57,6 +57,7 @@ envoy_cc_library(
 envoy_cc_library(
     name = "certificate_validation_context_config_interface",
     hdrs = ["certificate_validation_context_config.h"],
+    external_deps = ["abseil_optional"],
     deps = [
         "//source/common/common:matchers_lib",
         "@envoy_api//envoy/extensions/transport_sockets/tls/v3:pkg_cc_proto",

include/envoy/ssl/certificate_validation_context_config.h

@@ -4,10 +4,13 @@
 #include <string>
 #include <vector>
 
+#include "envoy/api/api.h"
 #include "envoy/common/pure.h"
 #include "envoy/extensions/transport_sockets/tls/v3/cert.pb.h"
 #include "envoy/type/matcher/v3/string.pb.h"
 
+#include "absl/types/optional.h"
+
 namespace Envoy {
 namespace Ssl {
 
@@ -69,6 +72,17 @@ class CertificateValidationContextConfig {
   virtual envoy::extensions::transport_sockets::tls::v3::CertificateValidationContext::
       TrustChainVerification
       trustChainVerification() const PURE;
+
+  /**
+   * @return  the configuration for the custom certificate validator if configured.
+   */
+  virtual const absl::optional<envoy::config::core::v3::TypedExtensionConfig>&
+  customValidatorConfig() const PURE;
+
+  /**
+   * @return a reference to the api object.
+   */
+  virtual Api::Api& api() PURE;
 };
 
 using CertificateValidationContextConfigPtr = std::unique_ptr<CertificateValidationContextConfig>;

include/envoy/ssl/context_config.h

@@ -50,7 +50,7 @@ class ContextConfig {
   /**
    * @return CertificateValidationContextConfig the certificate validation context config.
    */
-  virtual const CertificateValidationContextConfig* certificateValidationContext() const PURE;
+  virtual CertificateValidationContextConfig* certificateValidationContext() const PURE;
 
   /**
    * @return The minimum TLS protocol version to negotiate.

source/common/ssl/BUILD

@@ -26,6 +26,7 @@ envoy_cc_library(
     name = "certificate_validation_context_config_impl_lib",
     srcs = ["certificate_validation_context_config_impl.cc"],
     hdrs = ["certificate_validation_context_config_impl.h"],
+    external_deps = ["abseil_optional"],
     deps = [
         "//include/envoy/api:api_interface",
         "//include/envoy/ssl:certificate_validation_context_config_interface",

source/common/ssl/certificate_validation_context_config_impl.cc

@@ -32,7 +32,13 @@ CertificateValidationContextConfigImpl::CertificateValidationContextConfigImpl(
       verify_certificate_spki_list_(config.verify_certificate_spki().begin(),
                                     config.verify_certificate_spki().end()),
       allow_expired_certificate_(config.allow_expired_certificate()),
-      trust_chain_verification_(config.trust_chain_verification()) {
+      trust_chain_verification_(config.trust_chain_verification()),
+      custom_validator_config_(
+          config.has_custom_validator_config()
+              ? absl::make_optional<envoy::config::core::v3::TypedExtensionConfig>(
+                    config.custom_validator_config())
+              : absl::nullopt),
+      api_(api) {
   if (ca_cert_.empty()) {
     if (!certificate_revocation_list_.empty()) {
       throw EnvoyException(fmt::format("Failed to load CRL from {} without trusted CA",