Support the Envoy tap filter mechanism

[nbrandaleone]

Tell us about your request What do you want us to build?

Support the Envoy tap filter.

The Tap filter allows you to capture a request and its response when certain criteria are met. The captured data can be streamed to another service or stored in a filesystem. Unlike other tools that are safe to make widely available to your dev teams, the Tap filter captures a full copy of all data included in the request and response. The match criteria is very expressive so you can pinpoint the traffic that you are interested in investigating. You can limit the capture size to avoid wasteful captures, defaulting to 1 kibibyte buffered per body.

There is also a tap filter for TCP traffic (envoy.transport_sockets.tap) but the http taps would be a good start.

Here is a minimal config to get started. This tells Envoy to capture all http traffic and write it to the taps directory in files prefixed with the “any” string.

Use cases: 1) sample live data flows

Simplest config: match everything, save to filesystem

http_filters:

• name: envoy.filters.http.tap config: common_config: static_config: match_config: any_match: true output_config: sinks:
  • file_per_tap: path_prefix: taps/any

2) assistance in error recovery For example:

all errors

match_config: http_response_headers_match: headers:

• name: ":status" exact_match: "500"

Which integration(s) is this request for? This could be Fargate, ECS, EKS, EC2, Kubernetes, something else.

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard? What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now? What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.

Are you currently working around this issue? How are you currently solving this problem?

Additional context Anything else we should know?

Attachments If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

[shubharao]

Waiting to hear from customers on how they plan to use this

[kevin-phillips-ah]

@shubharao my organization is interested in using such a feature.

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?

What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now?

• We'd like to capture scan traffic in the mesh and stream/ship-pcap-files to a security appliance for detection of malicious traffic. Additionally, it would be a useful forensics tool for exploit validation and error recovery.
• Logging request bodies and payloads is not practical both from a detection and cost basis.
• Intra-mesh traffic cannot pass through WAF ruleset and it's impractical to use ingress/virtual-gateway to gate these services (latency and cost).
• Additionally, vpc flow logs do not have sufficient resolution to review payloads.

What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.

• There is no ability to detect malicious traffic with intra-mesh traffic patterns. Additionally WAF is not practical for protecting specific services which do not employ http 1/2.