@@ -6326,6 +6326,166 @@ bool envoy_dynamic_module_callback_lb_context_get_downstream_header(
63266326 envoy_dynamic_module_type_module_buffer key,
63276327 envoy_dynamic_module_type_envoy_buffer* result_buffer, size_t index, size_t * optional_size);
63286328
6329+ // =============================================================================
6330+ // ============================ Cert Validator ==================================
6331+ // =============================================================================
6332+ //
6333+ // This extension enables custom TLS certificate validation via dynamic modules.
6334+ // It integrates with Envoy's custom_validator_config in CertificateValidationContext,
6335+ // registered under the envoy.tls.cert_validator category.
6336+ //
6337+ // The module receives DER-encoded certificates during validation and returns
6338+ // a result indicating success or failure with optional TLS alert and error details.
6339+
6340+ // =============================================================================
6341+ // Cert Validator Types
6342+ // =============================================================================
6343+
6344+ /* *
6345+ * envoy_dynamic_module_type_cert_validator_config_envoy_ptr is a pointer to the
6346+ * DynamicModuleCertValidatorConfig object in Envoy. This is passed to the module during config
6347+ * creation and cert chain verification.
6348+ *
6349+ * OWNERSHIP: Envoy owns this object.
6350+ */
6351+ typedef void * envoy_dynamic_module_type_cert_validator_config_envoy_ptr;
6352+
6353+ /* *
6354+ * envoy_dynamic_module_type_cert_validator_config_module_ptr is a pointer to the in-module cert
6355+ * validator configuration created and owned by the module.
6356+ *
6357+ * OWNERSHIP: Module owns this pointer.
6358+ */
6359+ typedef const void * envoy_dynamic_module_type_cert_validator_config_module_ptr;
6360+
6361+ /* *
6362+ * envoy_dynamic_module_type_cert_validator_validation_status represents the status of the
6363+ * certificate chain validation. This corresponds to ValidationResults::ValidationStatus in
6364+ * cert_validator.h.
6365+ *
6366+ * Note: Pending (asynchronous) validation is not supported.
6367+ */
6368+ typedef enum envoy_dynamic_module_type_cert_validator_validation_status {
6369+ envoy_dynamic_module_type_cert_validator_validation_status_Successful = 0 ,
6370+ envoy_dynamic_module_type_cert_validator_validation_status_Failed = 1 ,
6371+ } envoy_dynamic_module_type_cert_validator_validation_status;
6372+
6373+ /* *
6374+ * envoy_dynamic_module_type_cert_validator_client_validation_status represents the detailed client
6375+ * validation status. This corresponds to Ssl::ClientValidationStatus in
6376+ * ssl_socket_extended_info.h.
6377+ */
6378+ typedef enum envoy_dynamic_module_type_cert_validator_client_validation_status {
6379+ envoy_dynamic_module_type_cert_validator_client_validation_status_NotValidated = 0 ,
6380+ envoy_dynamic_module_type_cert_validator_client_validation_status_NoClientCertificate = 1 ,
6381+ envoy_dynamic_module_type_cert_validator_client_validation_status_Validated = 2 ,
6382+ envoy_dynamic_module_type_cert_validator_client_validation_status_Failed = 3 ,
6383+ } envoy_dynamic_module_type_cert_validator_client_validation_status;
6384+
6385+ /* *
6386+ * envoy_dynamic_module_type_cert_validator_validation_result is the result of a certificate chain
6387+ * verification. Returned by the envoy_dynamic_module_on_cert_validator_do_verify_cert_chain event
6388+ * hook.
6389+ */
6390+ typedef struct envoy_dynamic_module_type_cert_validator_validation_result {
6391+ // The overall validation status (Successful or Failed).
6392+ envoy_dynamic_module_type_cert_validator_validation_status status;
6393+ // The detailed client validation status.
6394+ envoy_dynamic_module_type_cert_validator_client_validation_status detailed_status;
6395+ // The TLS alert code to send on failure (e.g. SSL_AD_BAD_CERTIFICATE).
6396+ uint8_t tls_alert;
6397+ // Whether the tls_alert field is set.
6398+ bool has_tls_alert;
6399+ // Error details string owned by the module. Must remain valid until the end of the
6400+ // do_verify_cert_chain event hook. Can be empty (length 0) if no details are available.
6401+ envoy_dynamic_module_type_module_buffer error_details;
6402+ } envoy_dynamic_module_type_cert_validator_validation_result;
6403+
6404+ // =============================================================================
6405+ // Cert Validator Event Hooks
6406+ // =============================================================================
6407+
6408+ /* *
6409+ * envoy_dynamic_module_on_cert_validator_config_new is called by the main thread when the cert
6410+ * validator config is loaded. The function returns a
6411+ * envoy_dynamic_module_type_cert_validator_config_module_ptr for given name and config.
6412+ *
6413+ * @param config_envoy_ptr is the pointer to the DynamicModuleCertValidatorConfig object for the
6414+ * corresponding config.
6415+ * @param name is the name of the validator owned by Envoy.
6416+ * @param config is the configuration for the module owned by Envoy.
6417+ * @return envoy_dynamic_module_type_cert_validator_config_module_ptr is the pointer to the
6418+ * in-module cert validator configuration. Returning nullptr indicates a failure to initialize the
6419+ * module. When it fails, the cert validator configuration will be rejected.
6420+ */
6421+ envoy_dynamic_module_type_cert_validator_config_module_ptr
6422+ envoy_dynamic_module_on_cert_validator_config_new (
6423+ envoy_dynamic_module_type_cert_validator_config_envoy_ptr config_envoy_ptr,
6424+ envoy_dynamic_module_type_envoy_buffer name, envoy_dynamic_module_type_envoy_buffer config);
6425+
6426+ /* *
6427+ * envoy_dynamic_module_on_cert_validator_config_destroy is called when the cert validator
6428+ * configuration is destroyed in Envoy. The module should release any resources associated with
6429+ * the corresponding in-module cert validator configuration.
6430+ *
6431+ * @param config_module_ptr is a pointer to the in-module cert validator configuration whose
6432+ * corresponding Envoy cert validator configuration is being destroyed.
6433+ */
6434+ void envoy_dynamic_module_on_cert_validator_config_destroy (
6435+ envoy_dynamic_module_type_cert_validator_config_module_ptr config_module_ptr);
6436+
6437+ /* *
6438+ * envoy_dynamic_module_on_cert_validator_do_verify_cert_chain is called to verify a certificate
6439+ * chain during a TLS handshake. The certificates are provided as DER-encoded buffers. The first
6440+ * certificate (index 0) is the leaf certificate.
6441+ *
6442+ * The certs array and its buffer contents are owned by Envoy and are valid only for the duration
6443+ * of this event hook call.
6444+ *
6445+ * @param config_envoy_ptr is the pointer to the DynamicModuleCertValidatorConfig object.
6446+ * @param config_module_ptr is the pointer to the in-module cert validator configuration.
6447+ * @param certs is an array of DER-encoded certificate buffers.
6448+ * @param certs_count is the number of certificates in the array.
6449+ * @param host_name is the SNI host name for validation.
6450+ * @param is_server is true if the validation is on the server side (validating client certs).
6451+ * @return envoy_dynamic_module_type_cert_validator_validation_result is the validation result.
6452+ */
6453+ envoy_dynamic_module_type_cert_validator_validation_result
6454+ envoy_dynamic_module_on_cert_validator_do_verify_cert_chain (
6455+ envoy_dynamic_module_type_cert_validator_config_envoy_ptr config_envoy_ptr,
6456+ envoy_dynamic_module_type_cert_validator_config_module_ptr config_module_ptr,
6457+ envoy_dynamic_module_type_envoy_buffer* certs, size_t certs_count,
6458+ envoy_dynamic_module_type_envoy_buffer host_name, bool is_server);
6459+
6460+ /* *
6461+ * envoy_dynamic_module_on_cert_validator_get_ssl_verify_mode is called during SSL context
6462+ * initialization to get the SSL verify mode flags that should be applied to SSL contexts.
6463+ *
6464+ * The return value should be a combination of SSL_VERIFY_* flags (e.g. SSL_VERIFY_PEER,
6465+ * SSL_VERIFY_FAIL_IF_NO_PEER_CERT). Returning 0 means SSL_VERIFY_NONE.
6466+ *
6467+ * @param config_module_ptr is the pointer to the in-module cert validator configuration.
6468+ * @param handshaker_provides_certificates is true if the handshaker provides certificates itself.
6469+ * @return int the SSL verify mode flags.
6470+ */
6471+ int envoy_dynamic_module_on_cert_validator_get_ssl_verify_mode (
6472+ envoy_dynamic_module_type_cert_validator_config_module_ptr config_module_ptr,
6473+ bool handshaker_provides_certificates);
6474+
6475+ /* *
6476+ * envoy_dynamic_module_on_cert_validator_update_digest is called to contribute to the session
6477+ * context hash. The module should provide bytes that uniquely identify its validation configuration
6478+ * so that configuration changes invalidate existing TLS sessions. The output buffer must remain
6479+ * valid until the end of this event hook.
6480+ *
6481+ * @param config_module_ptr is the pointer to the in-module cert validator configuration.
6482+ * @param out_data is a pointer to a buffer that the module should fill with the digest data.
6483+ * The module should set the ptr and length fields.
6484+ */
6485+ void envoy_dynamic_module_on_cert_validator_update_digest (
6486+ envoy_dynamic_module_type_cert_validator_config_module_ptr config_module_ptr,
6487+ envoy_dynamic_module_type_module_buffer* out_data);
6488+
63296489#ifdef __cplusplus
63306490}
63316491#endif
0 commit comments