StartTls (proto)

This extension has the qualified name envoy.transport_sockets.starttls

Note

This extension is intended to be robust against both untrusted downstream and upstream traffic.

Tip

This extension extends and can be used with the following extension categories:

• envoy.transport_sockets.downstream

• envoy.transport_sockets.upstream

This extension must be configured with one of the following type URLs:

• type.googleapis.com/envoy.extensions.transport_sockets.starttls.v3.StartTlsConfig

• type.googleapis.com/envoy.extensions.transport_sockets.starttls.v3.UpstreamStartTlsConfig

StartTls transport socket addresses situations when a protocol starts in clear-text and negotiates an in-band switch to TLS. StartTls transport socket is protocol agnostic. In the case of downstream StartTls a network filter is required which understands protocol exchange and a state machine to signal to the StartTls transport socket when a switch to TLS is required. Similarly, upstream StartTls requires the owner of an upstream transport socket to manage the state machine necessary to properly coordinate negotiation with the upstream and signal to the transport socket when a switch to secure transport is required.

extensions.transport_sockets.starttls.v3.StartTlsConfig

[extensions.transport_sockets.starttls.v3.StartTlsConfig proto]

Configuration for a downstream StartTls transport socket. StartTls transport socket wraps two sockets: * raw_buffer socket which is used at the beginning of the session * TLS socket used when a protocol negotiates a switch to encrypted traffic.

{
  "cleartext_socket_config": {...},
  "tls_socket_config": {...}
}

cleartext_socket_config

(extensions.transport_sockets.raw_buffer.v3.RawBuffer) (optional) Configuration for clear-text socket used at the beginning of the session.

tls_socket_config

(extensions.transport_sockets.tls.v3.DownstreamTlsContext, REQUIRED) Configuration for a downstream TLS socket.

extensions.transport_sockets.starttls.v3.UpstreamStartTlsConfig

[extensions.transport_sockets.starttls.v3.UpstreamStartTlsConfig proto]

Configuration for an upstream StartTls transport socket. StartTls transport socket wraps two sockets: * raw_buffer socket which is used at the beginning of the session * TLS socket used when a protocol negotiates a switch to encrypted traffic.

{
  "cleartext_socket_config": {...},
  "tls_socket_config": {...}
}

cleartext_socket_config

(extensions.transport_sockets.raw_buffer.v3.RawBuffer) (optional) Configuration for clear-text socket used at the beginning of the session.

tls_socket_config

(extensions.transport_sockets.tls.v3.UpstreamTlsContext, REQUIRED) Configuration for an upstream TLS socket.