Support enable_ja3_fingerprinting and enable_ja4_fingerprinting in EnvoyTLS config #7307
Description
Support TLS Fingerprinting
Today there's no way to config the envoy listeners to calculate tls fingerprinting.
Both fields are default to False and the TlsInspector object is created with no parameters.
Below is a config_dump:
"listener_filters": [
{
"name": "envoy.filters.listener.tls_inspector",
"typed_config": {
"@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
}
}
],
Looking at the code that construct it:
// TLSInspector returns a new TLS inspector listener filter.
func TLSInspector() *envoy_config_listener_v3.ListenerFilter {
return &envoy_config_listener_v3.ListenerFilter{
Name: wellknown.TlsInspector,
ConfigType: &envoy_config_listener_v3.ListenerFilter_TypedConfig{
TypedConfig: protobuf.MustMarshalAny(&envoy_filter_listener_tls_inspector_v3.TlsInspector{}),
},
}
}
it does not take any parameters
Can we make this configurable somewhere in the contour config or httpproxy specs?
Getting the TLS fingerprint is an important use case for our upstream service for bot fighting and etc.