api: add 'redacted' option for protobuf messages, and redact SSL certs

api/envoy/api/v2/auth/BUILD

@@ -5,5 +5,8 @@ load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
 licenses(["notice"])  # Apache 2
 
 api_proto_package(
-    deps = ["//envoy/api/v2/core:pkg"],
+    deps = [
+        "//envoy/api/v2/core:pkg",
+        "//envoy/protobuf:pkg",
+    ],
 )

api/envoy/api/v2/auth/cert.proto

@@ -8,6 +8,7 @@ option java_multiple_files = true;
 
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/config_source.proto";
+import "envoy/protobuf/descriptor.proto";
 
 import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
@@ -119,6 +120,8 @@ message PrivateKeyProvider {
 
 // [#next-free-field: 7]
 message TlsCertificate {
+  option (envoy.protobuf.redacted) = true;
+
   // The TLS certificate chain.
   core.DataSource certificate_chain = 1;
 

api/envoy/api/v3alpha/auth/BUILD

@@ -8,6 +8,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v2/auth:pkg",
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/protobuf:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
     ],
 )

api/envoy/api/v3alpha/auth/cert.proto

@@ -8,6 +8,7 @@ option java_multiple_files = true;
 
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/core/config_source.proto";
+import "envoy/protobuf/descriptor.proto";
 
 import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
@@ -129,6 +130,7 @@ message PrivateKeyProvider {
 // [#next-free-field: 7]
 message TlsCertificate {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.auth.TlsCertificate";
+  option (envoy.protobuf.redacted) = true;
 
   // The TLS certificate chain.
   core.DataSource certificate_chain = 1;

api/envoy/protobuf/BUILD

@@ -0,0 +1,7 @@
+# DO NOT EDIT. This file is generated by tools/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package()

api/envoy/protobuf/descriptor.proto

@@ -0,0 +1,13 @@
+syntax = "proto3";
+
+package envoy.protobuf;
+
+option java_outer_classname = "DescriptorProto";
+option java_multiple_files = true;
+option java_package = "io.envoyproxy.envoy.protobuf";
+
+import "google/protobuf/descriptor.proto";
+
+extend google.protobuf.MessageOptions {
+  bool redacted = 50000;
+}

source/common/protobuf/BUILD

@@ -64,6 +64,7 @@ envoy_cc_library(
         "//source/common/common:assert_lib",
         "//source/common/common:hash_lib",
         "//source/common/common:utility_lib",
+        "@envoy_api//envoy/protobuf:pkg_cc_proto",
         "@envoy_api//envoy/type:pkg_cc_proto",
     ],
 )

source/common/protobuf/utility.cc

@@ -3,6 +3,7 @@
 #include <limits>
 #include <numeric>
 
+#include "envoy/protobuf/descriptor.pb.h"
 #include "envoy/protobuf/message_validator.h"
 
 #include "common/common/assert.h"
@@ -505,6 +506,77 @@ std::string MessageUtil::CodeEnumToString(ProtobufUtil::error::Code code) {
   }
 }
 
+namespace {
+
+// Recursive helper method for MessageUtil::redact() below.
+void redactInPlace(Protobuf::Message* message) {
+  // If the message is an `Any`, we can't use any type-based introspection. Instead, we have to
+  // unpack it to its original type to redact it...
+  auto* any = dynamic_cast<ProtobufWkt::Any*>(message);
+  if (any != nullptr) {
+    // 1. Extract the type name from the URL. This is guaranteed to be the portion of the URL
+    // following the last '/' character.
+    const std::string& type_url = any->type_url();
+    const std::size_t last_slash = type_url.find_last_of('/');
+    const std::string type_name = type_url.substr(last_slash + 1);
+    const auto* descriptor =
+        Protobuf::DescriptorPool::generated_pool()->FindMessageTypeByName(type_name);
+
+    // 2. Instantiate a mutable message of the correct dynamic type, and unpack the `Any` into it.
+    Protobuf::DynamicMessageFactory dmf;
+    std::unique_ptr<Protobuf::Message> typed_message(dmf.GetPrototype(descriptor)->New());
+    any->UnpackTo(typed_message.get());
+
+    // 3. Redact the typed message and repack it into the original `Any`.
+    redactInPlace(typed_message.get());
+    any->PackFrom(*typed_message);
+
+    return;
+  }
+
+  // If the message isn't an `Any`, determine whether we need to redact it by looking for the
+  // `redacted` option on the message's descriptor.
+  const auto* descriptor = message->GetDescriptor();
+  if (descriptor->options().GetExtension(envoy::protobuf::redacted)) {
+    // If this message should be redacted, clear it and don't recurse any deeper.
+    message->Clear();
+  } else {
+    // Otherwise, use reflection to recurse into all message-typed fields of this message.
+    const auto* reflection = message->GetReflection();
+    std::vector<const Protobuf::FieldDescriptor*> field_descriptors;
+    reflection->ListFields(*message, &field_descriptors);
+    for (const auto* field_descriptor : field_descriptors) {
+      // Note for the future: if we ever need to support a "redacted" option at the field level,
+      // in addition to the existing message-level option, this is where we would check the field
+      // descriptor's options and clear out individual fields. Currently, we simply don't touch
+      // any fields that aren't of message type.
+      if (field_descriptor->type() == Protobuf::FieldDescriptor::TYPE_MESSAGE) {
+        // Repeated fields need slightly different handling from non-repeated...
+        if (field_descriptor->is_repeated()) {
+          const int field_size = reflection->FieldSize(*message, field_descriptor);
+          for (int i = 0; i < field_size; ++i) {
+            redactInPlace(reflection->MutableRepeatedMessage(message, field_descriptor, i));
+          }
+        } else {
+          redactInPlace(reflection->MutableMessage(message, field_descriptor));
+        }
+      }
+    }
+  }
+}
+
+} // namespace
+
+std::unique_ptr<Protobuf::Message> MessageUtil::redact(const Protobuf::Message& message) {
+  // 1. Clone the original message. New() will return an empty message of the correct dynamic type.
+  std::unique_ptr<Protobuf::Message> redacted(message.New());
+  redacted->MergeFrom(message);
+
+  // 2. Redact the cloned message.
+  redactInPlace(redacted.get());
+  return redacted;
+}
+
 ProtobufWkt::Value ValueUtil::loadFromYaml(const std::string& yaml) {
   try {
     return parseYamlNode(YAML::Load(yaml));

source/common/protobuf/utility.h

@@ -361,6 +361,14 @@ class MessageUtil {
    * @param code the protobuf error code
    */
   static std::string CodeEnumToString(ProtobufUtil::error::Code code);
+
+  /**
+   * Makes a copy of a source message with all "redacted" data cleared. See envoy.protobuf.redacted.
+   * @param message original message to copy from.
+   * @return cloned message of the same dynamic type as the original, with all "redacted" data
+   * cleared.
+   */
+  static std::unique_ptr<Protobuf::Message> redact(const Protobuf::Message& message);
 };
 
 class ValueUtil {

source/server/http/admin.cc

@@ -539,9 +539,10 @@ Http::Code AdminImpl::handlerConfigDump(absl::string_view, Http::HeaderMap& resp
     auto& any_message = *(dump.add_configs());
     any_message.PackFrom(*message);
   }
+  const auto redacted = MessageUtil::redact(dump);
 
   response_headers.setReferenceContentType(Http::Headers::get().ContentTypeValues.Json);
-  response.add(MessageUtil::getJsonStringFromMessage(dump, true)); // pretty-print
+  response.add(MessageUtil::getJsonStringFromMessage(*redacted, true)); // pretty-print
   return Http::Code::OK;
 }