api: add 'redacted' option for protobuf messages, and redact SSL certs

api/envoy/api/v2/auth/BUILD

@@ -5,5 +5,8 @@ load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
 licenses(["notice"])  # Apache 2
 
 api_proto_package(
-    deps = ["//envoy/api/v2/core:pkg"],
+    deps = [
+        "//envoy/api/v2/core:pkg",
+        "//envoy/protobuf:pkg",
+    ],
 )

api/envoy/api/v2/auth/cert.proto

@@ -8,6 +8,7 @@ option java_multiple_files = true;
 
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/config_source.proto";
+import "envoy/protobuf/descriptor.proto";
 
 import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
@@ -123,7 +124,7 @@ message TlsCertificate {
   core.DataSource certificate_chain = 1;
 
   // The TLS private key.
-  core.DataSource private_key = 2;
+  core.DataSource private_key = 2 [(envoy.protobuf.redacted) = true];
 
   // BoringSSL private key method provider. This is an alternative to :ref:`private_key
   // <envoy_api_field_auth.TlsCertificate.private_key>` field. This can't be
@@ -136,7 +137,7 @@ message TlsCertificate {
 
   // The password to decrypt the TLS private key. If this field is not set, it is assumed that the
   // TLS private key is not password encrypted.
-  core.DataSource password = 3;
+  core.DataSource password = 3 [(envoy.protobuf.redacted) = true];
 
   // [#not-implemented-hide:]
   core.DataSource ocsp_staple = 4;

api/envoy/api/v3alpha/auth/BUILD

@@ -8,6 +8,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v2/auth:pkg",
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/protobuf:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
     ],
 )

api/envoy/api/v3alpha/auth/cert.proto

@@ -8,6 +8,7 @@ option java_multiple_files = true;
 
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/core/config_source.proto";
+import "envoy/protobuf/descriptor.proto";
 
 import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
@@ -134,7 +135,7 @@ message TlsCertificate {
   core.DataSource certificate_chain = 1;
 
   // The TLS private key.
-  core.DataSource private_key = 2;
+  core.DataSource private_key = 2 [(envoy.protobuf.redacted) = true];
 
   // BoringSSL private key method provider. This is an alternative to :ref:`private_key
   // <envoy_api_field_api.v3alpha.auth.TlsCertificate.private_key>` field. This can't be
@@ -147,7 +148,7 @@ message TlsCertificate {
 
   // The password to decrypt the TLS private key. If this field is not set, it is assumed that the
   // TLS private key is not password encrypted.
-  core.DataSource password = 3;
+  core.DataSource password = 3 [(envoy.protobuf.redacted) = true];
 
   // [#not-implemented-hide:]
   core.DataSource ocsp_staple = 4;

api/envoy/protobuf/BUILD

@@ -0,0 +1,7 @@
+# DO NOT EDIT. This file is generated by tools/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package()

api/envoy/protobuf/descriptor.proto

@@ -0,0 +1,18 @@
+syntax = "proto3";
+
+package envoy.protobuf;
+
+option java_outer_classname = "DescriptorProto";
+option java_multiple_files = true;
+option java_package = "io.envoyproxy.envoy.protobuf";
+
+import "google/protobuf/descriptor.proto";
+
+extend google.protobuf.FieldOptions {
+  // This option indicates that a field contains personally-identifying or otherwise sensitive data,
+  // such as a private key or a password. It is used by `MessageUtil::redact` to determine which
+  // fields need to be sanitized. Please note that this has no effect on standard Protobuf functions
+  // such as `TextFormat::PrintToString`; you must explicitly call `MessageUtil::redact` wherever
+  // you need to sanitize sensitive data.
+  bool redacted = 50000;
+}

source/common/protobuf/BUILD

@@ -64,6 +64,7 @@ envoy_cc_library(
         "//source/common/common:assert_lib",
         "//source/common/common:hash_lib",
         "//source/common/common:utility_lib",
+        "@envoy_api//envoy/protobuf:pkg_cc_proto",
         "@envoy_api//envoy/type:pkg_cc_proto",
     ],
 )

source/common/protobuf/utility.cc

@@ -3,6 +3,7 @@
 #include <limits>
 #include <numeric>
 
+#include "envoy/protobuf/descriptor.pb.h"
 #include "envoy/protobuf/message_validator.h"
 
 #include "common/common/assert.h"
@@ -505,6 +506,79 @@ std::string MessageUtil::CodeEnumToString(ProtobufUtil::error::Code code) {
   }
 }
 
+namespace {
+
+// Recursive helper method for MessageUtil::redact() below.
+void redactInPlace(Protobuf::Message* message, bool ancestor_is_redacted) {
+  // If the message is an `Any`, we can't use any type-based introspection. Instead, we have to
+  // unpack it to its original type to redact it...
+  auto* any = dynamic_cast<ProtobufWkt::Any*>(message);
+  if (any != nullptr) {
+    // 1. Extract the type name from the URL. This is guaranteed to be the portion of the URL
+    // following the last '/' character.
+    const std::string& type_url = any->type_url();
+    const std::size_t last_slash = type_url.find_last_of('/');
+    const std::string type_name = type_url.substr(last_slash + 1);
+    const auto* descriptor =
+        Protobuf::DescriptorPool::generated_pool()->FindMessageTypeByName(type_name);
+
+    // 2. Instantiate a mutable message of the correct dynamic type, and unpack the `Any` into it.
+    Protobuf::DynamicMessageFactory dmf;
+    std::unique_ptr<Protobuf::Message> typed_message(dmf.GetPrototype(descriptor)->New());
+    any->UnpackTo(typed_message.get());
+
+    // 3. Redact the typed message and repack it into the original `Any`.
+    redactInPlace(typed_message.get(), ancestor_is_redacted);
+    any->PackFrom(*typed_message);
+
+    return;
+  }
+
+  // Otherwise, use reflection to traverse all populated fields of this message...
+  const auto* reflection = message->GetReflection();
+  std::vector<const Protobuf::FieldDescriptor*> field_descriptors;
+  reflection->ListFields(*message, &field_descriptors);
+  for (const auto* field_descriptor : field_descriptors) {
+    // Redact if this field or any of its ancestors have the `redacted` option set.
+    const bool redacted =
+        ancestor_is_redacted || field_descriptor->options().GetExtension(envoy::protobuf::redacted);
+
+    if (redacted && field_descriptor->type() == Protobuf::FieldDescriptor::TYPE_STRING) {
+      // Base case: replace strings with "[redacted]".
+      if (field_descriptor->is_repeated()) {
+        const int field_size = reflection->FieldSize(*message, field_descriptor);
+        for (int i = 0; i < field_size; ++i) {
+          reflection->SetRepeatedString(message, field_descriptor, i, "[redacted]");
+        }
+      } else {
+        reflection->SetString(message, field_descriptor, "[redacted]");
+      }
+    } else if (field_descriptor->type() == Protobuf::FieldDescriptor::TYPE_MESSAGE) {
+      // Recursive case: traverse message fields.
+      if (field_descriptor->is_repeated()) {
+        const int field_size = reflection->FieldSize(*message, field_descriptor);
+        for (int i = 0; i < field_size; ++i) {
+          redactInPlace(reflection->MutableRepeatedMessage(message, field_descriptor, i), redacted);
+        }
+      } else {
+        redactInPlace(reflection->MutableMessage(message, field_descriptor), redacted);
+      }
+    }
+  }
+}
+
+} // namespace
+
+std::unique_ptr<Protobuf::Message> MessageUtil::redact(const Protobuf::Message& message) {
+  // 1. Clone the original message. New() will return an empty message of the correct dynamic type.
+  std::unique_ptr<Protobuf::Message> redacted(message.New());
+  redacted->MergeFrom(message);
+
+  // 2. Redact the cloned message.
+  redactInPlace(redacted.get(), /* ancestor_is_redacted = */ false);
+  return redacted;
+}
+
 ProtobufWkt::Value ValueUtil::loadFromYaml(const std::string& yaml) {
   try {
     return parseYamlNode(YAML::Load(yaml));

source/common/protobuf/utility.h

@@ -361,6 +361,18 @@ class MessageUtil {
    * @param code the protobuf error code
    */
   static std::string CodeEnumToString(ProtobufUtil::error::Code code);
+
+  /**
+   * Makes a copy of a source message with all `redacted` data sanitized. Specifically, any
+   * string-typed fields that are annotated as `redacted`, or that are contained directly or
+   * indirectly within a message-typed field that is annotated as `redacted`, will have their
+   * values replaced with the string "[redacted]" in the result.
+   * See also envoy.protobuf.redacted.
+   * @param message original message to copy from.
+   * @return cloned message of the same dynamic type as the original, with all `redacted` data
+   * sanitized.
+   */
+  static std::unique_ptr<Protobuf::Message> redact(const Protobuf::Message& message);
 };
 
 class ValueUtil {

source/server/http/admin.cc

@@ -539,9 +539,10 @@ Http::Code AdminImpl::handlerConfigDump(absl::string_view, Http::HeaderMap& resp
     auto& any_message = *(dump.add_configs());
     any_message.PackFrom(*message);
   }
+  const auto redacted = MessageUtil::redact(dump);
 
   response_headers.setReferenceContentType(Http::Headers::get().ContentTypeValues.Json);
-  response.add(MessageUtil::getJsonStringFromMessage(dump, true)); // pretty-print
+  response.add(MessageUtil::getJsonStringFromMessage(*redacted, true)); // pretty-print
   return Http::Code::OK;
 }