UDP session external authorization (proto)

This extension has the qualified name envoy.filters.udp.session.ext_authz

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.

Tip

This extension extends and can be used with the following extension category:

This extension must be configured with one of the following type URLs:

UDP proxy session external authorization configuration overview.

extensions.filters.udp.udp_proxy.session.ext_authz.v3.FilterConfig

External authorization for UDP proxy sessions over the gRPC CheckRequest API.

{
  "stat_prefix": ...,
  "grpc_service": {...},
  "failure_mode_allow": ...,
  "buffer_options": {...}
}

stat_prefix: (string, REQUIRED) The prefix to use when emitting statistics.

grpc_service: (config.core.v3.GrpcService, REQUIRED) The external authorization gRPC service configuration (default timeout: 200ms).

failure_mode_allow: (bool) The filter’s behaviour in case the external authorization service does not respond back, or when it returns an error. When set to true, the new session is established and traffic is forwarded to the upstream. When set to false, the session is dropped. Defaults to false.

buffer_options: (extensions.filters.udp.udp_proxy.session.ext_authz.v3.FilterConfig.BufferOptions) If configured, the filter will buffer datagrams while it is waiting for the authorization response. If this field is not configured, there will be no buffering and downstream datagrams that arrive while the authorization call is in progress will be dropped. In case this field is set but the options are not configured, the default values will be applied as described in the BufferOptions.

Configuration for UDP datagrams buffering while the authorization call is in flight.

{
  "max_buffered_datagrams": {...},
  "max_buffered_bytes": {...}
}

max_buffered_datagrams: (UInt32Value) If set, the filter will only buffer datagrams up to the requested limit, and will drop new UDP datagrams if the buffer contains the max_buffered_datagrams value at the time of a new datagram arrival. If not set, the default value is 1024 datagrams.

max_buffered_bytes: (UInt64Value) If set, the filter will only buffer datagrams up to the requested total buffered bytes limit, and will drop new UDP datagrams if the buffer contains the max_buffered_bytes value at the time of a new datagram arrival. If not set, the default value is 16,384 (16KB).