CVE-2023-33189 (Go, published 2023-05-30T06:16Z)
Description: value: Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/pomerium/pomerium
Files changed:
authorize/evaluator/evaluator.go
authorize/evaluator/headers_evaluator.go
authorize/evaluator/policy_evaluator_test.go
authorize/grpc.go
config/envoyconfig/listeners.go
config/envoyconfig/per_filter_config.go
config/envoyconfig/route_configurations_test.go
config/envoyconfig/routes.go
config/envoyconfig/routes_test.go
config/envoyconfig/testdata/main_http_connection_manager_filter.json
config/policy_ppl.go
config/policy_ppl_test.go
Commit message: Merge pull request from GHSA-pvrc-wvj2-f59p

* authorize: use route id from envoy for policy evaluation

* authorize: normalize URL query params

* config: enable envoy normalize_path option

* fix tests

---------

Co-authored-by: Kenneth Jenkins <51246568+kenjenkins@users.noreply.github.com>

Vulnerable code:
// notFoundOutput is what's returned if a route isn't found for a policy.
var notFoundOutput = &Result{
	Deny:    NewRuleResult(true, criteria.ReasonRouteNotFound),
	Headers: make(http.Header),
}

	Policy  *config.Policy
	HTTP    RequestHTTP
	Session RequestSession
		return notFoundOutput, nil
		return notFoundOutput, nil
	eg, ectx := errgroup.WithContext(ctx)

	var policyOutput *PolicyResponse
	eg.Go(func() error {
		var err error
		policyOutput, err = policyEvaluator.Evaluate(ectx, &PolicyRequest{
			HTTP:                     req.HTTP,
			Session:                  req.Session,
			IsValidClientCertificate: isValidClientCertificate,
		})
		return err
	})

	var headersOutput *HeadersResponse
	eg.Go(func() error {
		headersReq := NewHeadersRequestFromPolicy(req.Policy, req.HTTP.Hostname)
		headersReq.Session = req.Session
		var err error
		headersOutput, err = e.headersEvaluators.Evaluate(ectx, headersReq)
		return err
	err = eg.Wait()
	carryOverJWTAssertion(headersOutput.Headers, req.HTTP.Headers)
	res := &Result{
		Allow:   policyOutput.Allow,
		Deny:    policyOutput.Deny,
		Headers: headersOutput.Headers,
		Traces:  policyOutput.Traces,
	}
	input.EnableGoogleCloudServerlessAuthentication = policy.EnableGoogleCloudServerlessAuthentication
	input.EnableRoutingKey = policy.EnvoyOpts.GetLbPolicy() == envoy_config_cluster_v3.Cluster_RING_HASH ||
		policy.EnvoyOpts.GetLbPolicy() == envoy_config_cluster_v3.Cluster_MAGLEV
	input.Issuer = hostname
	input.KubernetesServiceAccountToken = policy.KubernetesServiceAccountToken
	for _, wu := range policy.To {
		input.ToAudience = "https://" + wu.URL.Hostname()
	input.PassAccessToken = policy.GetSetAuthorizationHeader() == configpb.Route_ACCESS_TOKEN
	input.PassIDToken = policy.GetSetAuthorizationHeader() == configpb.Route_ID_TOKEN
			Allow:  NewRuleResult(false, criteria.ReasonEmailUnauthorized, criteria.ReasonNonPomeriumRoute, criteria.ReasonUserUnauthorized),
				Allow:  NewRuleResult(false, criteria.ReasonNonPomeriumRoute),
				Allow:  NewRuleResult(false, criteria.ReasonNonPomeriumRoute),
			Allow:  NewRuleResult(false, criteria.ReasonNonPomeriumRoute, criteria.ReasonUserUnauthenticated),
	req.Policy = a.getMatchingPolicy(requestURL)
func (a *Authorize) getMatchingPolicy(requestURL url.URL) *config.Policy {
		if p.Matches(requestURL) {
	envoy_extensions_filters_http_ext_authz_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3"
	"github.com/golang/protobuf/ptypes/any"
var (
	disableExtAuthz *any.Any
	tlsParams       = &envoy_extensions_transport_sockets_tls_v3.TlsParameters{
		CipherSuites: []string{
			"ECDHE-ECDSA-AES256-GCM-SHA384",
			"ECDHE-RSA-AES256-GCM-SHA384",
			"ECDHE-ECDSA-AES128-GCM-SHA256",
			"ECDHE-RSA-AES128-GCM-SHA256",
			"ECDHE-ECDSA-CHACHA20-POLY1305",
			"ECDHE-RSA-CHACHA20-POLY1305",
		},
		TlsMinimumProtocolVersion: envoy_extensions_transport_sockets_tls_v3.TlsParameters_TLSv1_2,
	}
)

func init() {
	disableExtAuthz = marshalAny(&envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute{
		Override: &envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute_Disabled{
			Disabled: true,
		},
	})
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/.pomerium/jwt", true, false))+`,
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/.pomerium/webauthn", true, false))+`,
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/ping", false, false))+`,
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/healthz", false, false))+`,
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/.pomerium", false, false))+`,
					`+protojson.Format(b.buildControlPlanePrefixRoute(cfg.Options, "/.pomerium/", false, false))+`,
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/.well-known/pomerium", false, false))+`,
					`+protojson.Format(b.buildControlPlanePrefixRoute(cfg.Options, "/.well-known/pomerium/", false, false))+`,
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/robots.txt", false, false))+`,
							"cluster": "route-0",
							"cluster": "route-0",
			"envoy.filters.http.ext_authz": disableExtAuthz,
			// enable ext_authz
			b.buildControlPlanePathRoute(options, "/.pomerium/jwt", true, requireStrictTransportSecurity),
			b.buildControlPlanePathRoute(options, urlutil.WebAuthnURLPath, true, requireStrictTransportSecurity),
			// disable ext_authz and passthrough to proxy handlers
			b.buildControlPlanePathRoute(options, "/ping", false, requireStrictTransportSecurity),
			b.buildControlPlanePathRoute(options, "/healthz", false, requireStrictTransportSecurity),
			b.buildControlPlanePathRoute(options, "/.pomerium", false, requireStrictTransportSecurity),
			b.buildControlPlanePrefixRoute(options, "/.pomerium/", false, requireStrictTransportSecurity),
			b.buildControlPlanePathRoute(options, "/.well-known/pomerium", false, requireStrictTransportSecurity),
			b.buildControlPlanePrefixRoute(options, "/.well-known/pomerium/", false, requireStrictTransportSecurity),
			routes = append(routes, b.buildControlPlanePathRoute(options, "/robots.txt", false, requireStrictTransportSecurity))
				b.buildControlPlanePathRoute(options, options.AuthenticateCallbackPath, false, requireStrictTransportSecurity),
				b.buildControlPlanePathRoute(options, "/", false, requireStrictTransportSecurity),
	protected bool,
	}
	if !protected {
		r.TypedPerFilterConfig = map[string]*any.Any{
			"envoy.filters.http.ext_authz": disableExtAuthz,
		}
	protected bool,
	}
	if !protected {
		r.TypedPerFilterConfig = map[string]*any.Any{
			"envoy.filters.http.ext_authz": disableExtAuthz,
		}
			"envoy.filters.http.ext_authz": disableExtAuthz,
		policyID, _ := policy.RouteID()
		for _, hdr := range b.reproxy.GetPolicyIDHeaders(policyID) {
	"github.com/pomerium/pomerium/internal/urlutil"
	routeString := func(typ, name string, protected bool) string {
				"name": "pomerium-` + typ + `-` + name + `",
				"match": {
					"` + typ + `": "` + name + `"
				"responseHeadersToAdd": [
					{
						"appendAction": "OVERWRITE_IF_EXISTS_OR_ADD",
						"header": {
						  "key": "X-Frame-Options",
						  "value": "SAMEORIGIN"
						}
					},
					{
						"appendAction": "OVERWRITE_IF_EXISTS_OR_ADD",
						"header": {
						  "key": "X-XSS-Protection",
						  "value": "1; mode=block"
						}
				],
				"route": {
					"cluster": "pomerium-control-plane-http"
			`
		if !protected {
			str += `,
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"disabled": true
			`
		}
		str += "}"
			`+routeString("path", "/.pomerium/jwt", true)+`,
			`+routeString("path", urlutil.WebAuthnURLPath, true)+`,
			`+routeString("path", "/ping", false)+`,
			`+routeString("path", "/healthz", false)+`,
			`+routeString("path", "/.pomerium", false)+`,
			`+routeString("prefix", "/.pomerium/", false)+`,
			`+routeString("path", "/.well-known/pomerium", false)+`,
			`+routeString("prefix", "/.well-known/pomerium/", false)+`,
			`+routeString("path", "/robots.txt", false)+`,
			`+routeString("path", "/oauth2/callback", false)+`,
			`+routeString("path", "/", false)+`
			`+routeString("path", "/.pomerium/jwt", true)+`,
			`+routeString("path", urlutil.WebAuthnURLPath, true)+`,
			`+routeString("path", "/ping", false)+`,
			`+routeString("path", "/healthz", false)+`,
			`+routeString("path", "/.pomerium", false)+`,
			`+routeString("prefix", "/.pomerium/", false)+`,
			`+routeString("path", "/.well-known/pomerium", false)+`,
			`+routeString("prefix", "/.well-known/pomerium/", false)+`,
			`+routeString("path", "/robots.txt", false)+`
			`+routeString("path", "/.pomerium/jwt", true)+`,
			`+routeString("path", urlutil.WebAuthnURLPath, true)+`,
			`+routeString("path", "/ping", false)+`,
			`+routeString("path", "/healthz", false)+`,
			`+routeString("path", "/.pomerium", false)+`,
			`+routeString("prefix", "/.pomerium/", false)+`,
			`+routeString("path", "/.well-known/pomerium", false)+`,
			`+routeString("prefix", "/.well-known/pomerium/", false)+`
	route := b.buildControlPlanePathRoute(options, "/hello/world", false, false)
					"disabled": true
	route := b.buildControlPlanePrefixRoute(options, "/hello/world/", false, false)
					"disabled": true
				]
				]
				]
				]
				]
				]
				]
				]
				]
				]
					]
				]
				]
				]
				]
				]
				]
	allowRule.Or = append(allowRule.Or,
		parser.Criterion{
			Name: "pomerium_routes",
		})
pomerium_routes_0 = [true, {"pomerium-route"}] {
	session := get_session(input.session.id)
	session.id != ""
	contains(input.http.url, "/.pomerium/")
}

else = [true, {"pomerium-route"}] {
	contains(input.http.url, "/.pomerium/")
	not contains(input.http.url, "/.pomerium/jwt")
	not contains(input.http.url, "/.pomerium/webauthn")
}

else = [false, {"user-unauthenticated"}] {
	contains(input.http.url, "/.pomerium/")
}

else = [false, {"non-pomerium-route"}]

	results := [pomerium_routes_0, accept_0, cors_preflight_0, authenticated_user_0, domain_0, domain_1, domain_2, domain_3, domain_4, claim_0, claim_1, claim_2, claim_3, user_0, email_0, user_1, email_1, user_2, email_2, user_3, email_3, user_4, email_4]
package criteria

import (
	"github.com/open-policy-agent/opa/ast"

	"github.com/pomerium/pomerium/internal/urlutil"
	"github.com/pomerium/pomerium/pkg/policy/generator"
	"github.com/pomerium/pomerium/pkg/policy/parser"
	"github.com/pomerium/pomerium/pkg/policy/rules"
)

type pomeriumRoutesCriterion struct {
	g *Generator
}

func (pomeriumRoutesCriterion) DataType() generator.CriterionDataType {
	return generator.CriterionDataTypeUnused
}

func (pomeriumRoutesCriterion) Name() string {
	return "pomerium_routes"
}

func (c pomeriumRoutesCriterion) GenerateRule(_ string, _ parser.Value) (*ast.Rule, []*ast.Rule, error) {
	r1 := c.g.NewRule(c.Name())
	r1.Head.Value = NewCriterionTerm(true, ReasonPomeriumRoute)
	r1.Body = ast.Body{
		ast.MustParseExpr(`session := get_session(input.session.id)`),
		ast.MustParseExpr(`session.id != ""`),
		ast.MustParseExpr(`contains(input.http.url, "/.pomerium/")`),
	}

	r2 := c.g.NewRule(c.Name())
	r2.Head.Value = NewCriterionTerm(true, ReasonPomeriumRoute)
	r2.Body = ast.Body{
		ast.MustParseExpr(`contains(input.http.url, "/.pomerium/")`),
		ast.MustParseExpr(`not contains(input.http.url, "/.pomerium/jwt")`),
		ast.MustParseExpr(`not contains(input.http.url, "` + urlutil.WebAuthnURLPath + `")`),
	}
	r1.Else = r2

	r3 := c.g.NewRule(c.Name())
	r3.Head.Value = NewCriterionTerm(false, ReasonUserUnauthenticated)
	r3.Body = ast.Body{
		ast.MustParseExpr(`contains(input.http.url, "/.pomerium/")`),
	}
	r2.Else = r3

	r4 := c.g.NewRule(c.Name())
	r4.Head.Value = NewCriterionTerm(false, ReasonNonPomeriumRoute)
	r3.Else = r4

	return r1, []*ast.Rule{
		rules.GetSession(),
	}, nil
}

// PomeriumRoutes returns a Criterion on that allows access to pomerium routes.
func PomeriumRoutes(generator *Generator) Criterion {
	return pomeriumRoutesCriterion{g: generator}
}

func init() {
	Register(PomeriumRoutes)
}

Fixed code:
	IsInternal bool
	Policy     *config.Policy
	HTTP       RequestHTTP
	Session    RequestSession
	eg, ctx := errgroup.WithContext(ctx)

	var policyOutput *PolicyResponse
	eg.Go(func() error {
		var err error
		if req.IsInternal {
			policyOutput, err = e.evaluateInternal(ctx, req)
		} else {
			policyOutput, err = e.evaluatePolicy(ctx, req)
		}
		return err
	})

	var headersOutput *HeadersResponse
	eg.Go(func() error {
		var err error
		headersOutput, err = e.evaluateHeaders(ctx, req)
		return err
	})

	err := eg.Wait()
	if err != nil {
		return nil, err
	}

	res := &Result{
		Allow:   policyOutput.Allow,
		Deny:    policyOutput.Deny,
		Headers: headersOutput.Headers,
		Traces:  policyOutput.Traces,
	}
	return res, nil
}

func (e *Evaluator) evaluateInternal(_ context.Context, req *Request) (*PolicyResponse, error) {
	// these endpoints require a logged-in user
	if req.HTTP.Path == "/.pomerium/webauthn" || req.HTTP.Path == "/.pomerium/jwt" {
		if req.Session.ID == "" {
			return &PolicyResponse{
				Allow: NewRuleResult(false, criteria.ReasonUserUnauthenticated),
			}, nil
		}
	}

	return &PolicyResponse{
		Allow: NewRuleResult(true, criteria.ReasonPomeriumRoute),
	}, nil
}

func (e *Evaluator) evaluatePolicy(ctx context.Context, req *Request) (*PolicyResponse, error) {
		return &PolicyResponse{
			Deny: NewRuleResult(true, criteria.ReasonRouteNotFound),
		}, nil
		return &PolicyResponse{
			Deny: NewRuleResult(true, criteria.ReasonRouteNotFound),
		}, nil
	return policyEvaluator.Evaluate(ctx, &PolicyRequest{
		HTTP:                     req.HTTP,
		Session:                  req.Session,
		IsValidClientCertificate: isValidClientCertificate,
}
func (e *Evaluator) evaluateHeaders(ctx context.Context, req *Request) (*HeadersResponse, error) {
	headersReq := NewHeadersRequestFromPolicy(req.Policy, req.HTTP.Hostname)
	headersReq.Session = req.Session
	res, err := e.headersEvaluators.Evaluate(ctx, headersReq)
	carryOverJWTAssertion(res.Headers, req.HTTP.Headers)
	if policy != nil {
		input.EnableGoogleCloudServerlessAuthentication = policy.EnableGoogleCloudServerlessAuthentication
		input.EnableRoutingKey = policy.EnvoyOpts.GetLbPolicy() == envoy_config_cluster_v3.Cluster_RING_HASH ||
			policy.EnvoyOpts.GetLbPolicy() == envoy_config_cluster_v3.Cluster_MAGLEV
		input.Issuer = hostname
		input.KubernetesServiceAccountToken = policy.KubernetesServiceAccountToken
		for _, wu := range policy.To {
			input.ToAudience = "https://" + wu.URL.Hostname()
		}
		input.PassAccessToken = policy.GetSetAuthorizationHeader() == configpb.Route_ACCESS_TOKEN
		input.PassIDToken = policy.GetSetAuthorizationHeader() == configpb.Route_ID_TOKEN
			Allow:  NewRuleResult(false, criteria.ReasonEmailUnauthorized, criteria.ReasonUserUnauthorized),
				Allow:  NewRuleResult(false),
				Allow:  NewRuleResult(false),
			Allow:  NewRuleResult(false, criteria.ReasonUserUnauthenticated),
	"github.com/pomerium/pomerium/config/envoyconfig"
		IsInternal: envoyconfig.ExtAuthzContextExtensionsIsInternal(in.GetAttributes().GetContextExtensions()),
	req.Policy = a.getMatchingPolicy(envoyconfig.ExtAuthzContextExtensionsRouteID(in.Attributes.GetContextExtensions()))
func (a *Authorize) getMatchingPolicy(routeID uint64) *config.Policy {
		id, _ := p.RouteID()
		if id == routeID {
		u.RawQuery = u.Query().Encode()
var tlsParams = &envoy_extensions_transport_sockets_tls_v3.TlsParameters{
	CipherSuites: []string{
		"ECDHE-ECDSA-AES256-GCM-SHA384",
		"ECDHE-RSA-AES256-GCM-SHA384",
		"ECDHE-ECDSA-AES128-GCM-SHA256",
		"ECDHE-RSA-AES128-GCM-SHA256",
		"ECDHE-ECDSA-CHACHA20-POLY1305",
		"ECDHE-RSA-CHACHA20-POLY1305",
	},
	TlsMinimumProtocolVersion: envoy_extensions_transport_sockets_tls_v3.TlsParameters_TLSv1_2,
		NormalizePath:     wrapperspb.Bool(true),
package envoyconfig

import (
	"strconv"

	envoy_extensions_filters_http_ext_authz_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3"
	"github.com/golang/protobuf/ptypes/any"
)

// PerFilterConfigExtAuthzName is the name of the ext authz filter to apply config to
const PerFilterConfigExtAuthzName = "envoy.filters.http.ext_authz"

// PerFilterConfigExtAuthzContextExtensions returns a per-filter config for ext authz that disables ext-authz.
func PerFilterConfigExtAuthzContextExtensions(authzContextExtensions map[string]string) *any.Any {
	return marshalAny(&envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute{
		Override: &envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute_CheckSettings{
			CheckSettings: &envoy_extensions_filters_http_ext_authz_v3.CheckSettings{
				ContextExtensions: authzContextExtensions,
			},
		},
	})
}

// PerFilterConfigExtAuthzDisabled returns a per-filter config for ext authz that disables ext-authz.
func PerFilterConfigExtAuthzDisabled() *any.Any {
	return marshalAny(&envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute{
		Override: &envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute_Disabled{
			Disabled: true,
		},
	})
}

// MakeExtAuthzContextExtensions makes the ext authz context extensions.
func MakeExtAuthzContextExtensions(internal bool, routeID uint64) map[string]string {
	return map[string]string{
		"internal": strconv.FormatBool(internal),
		"route_id": strconv.FormatUint(routeID, 10),
	}
}

// ExtAuthzContextExtensionsIsInternal returns true if the context extensions indicates the route is internal.
func ExtAuthzContextExtensionsIsInternal(extAuthzContextExtensions map[string]string) bool {
	return extAuthzContextExtensions != nil && extAuthzContextExtensions["internal"] == "true"
}

// ExtAuthzContextExtensionsRouteID returns the route id for the context extensions.
func ExtAuthzContextExtensionsRouteID(extAuthzContextExtensions map[string]string) uint64 {
	if extAuthzContextExtensions == nil {
		return 0
	}
	routeID, _ := strconv.ParseUint(extAuthzContextExtensions["route_id"], 10, 64)
	return routeID
}
				To:   mustParseWeightedURLs(t, "https://www.example.com"),
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/ping", false))+`,
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/healthz", false))+`,
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/.pomerium", false))+`,
					`+protojson.Format(b.buildControlPlanePrefixRoute(cfg.Options, "/.pomerium/", false))+`,
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/.well-known/pomerium", false))+`,
					`+protojson.Format(b.buildControlPlanePrefixRoute(cfg.Options, "/.well-known/pomerium/", false))+`,
					`+protojson.Format(b.buildControlPlanePathRoute(cfg.Options, "/robots.txt", false))+`,
							"cluster": "route-5feb9fe8bd89aa97",
						},
						"typedPerFilterConfig": {
							"envoy.filters.http.ext_authz": {
								"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
								"checkSettings": {
									"contextExtensions": {
										"internal": "false",
										"route_id": "6911793875091303063"
									}
								}
							}
							"cluster": "route-5feb9fe8bd89aa97",
						},
						"typedPerFilterConfig": {
							"envoy.filters.http.ext_authz": {
								"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
								"checkSettings": {
									"contextExtensions": {
										"internal": "false",
										"route_id": "6911793875091303063"
									}
								}
							}
			PerFilterConfigExtAuthzName: PerFilterConfigExtAuthzDisabled(),
			b.buildControlPlanePathRoute(options, "/ping", requireStrictTransportSecurity),
			b.buildControlPlanePathRoute(options, "/healthz", requireStrictTransportSecurity),
			b.buildControlPlanePathRoute(options, "/.pomerium", requireStrictTransportSecurity),
			b.buildControlPlanePrefixRoute(options, "/.pomerium/", requireStrictTransportSecurity),
			b.buildControlPlanePathRoute(options, "/.well-known/pomerium", requireStrictTransportSecurity),
			b.buildControlPlanePrefixRoute(options, "/.well-known/pomerium/", requireStrictTransportSecurity),
			routes = append(routes, b.buildControlPlanePathRoute(options, "/robots.txt", requireStrictTransportSecurity))
				b.buildControlPlanePathRoute(options, options.AuthenticateCallbackPath, requireStrictTransportSecurity),
				b.buildControlPlanePathRoute(options, "/", requireStrictTransportSecurity),
		TypedPerFilterConfig: map[string]*any.Any{
			PerFilterConfigExtAuthzName: PerFilterConfigExtAuthzContextExtensions(MakeExtAuthzContextExtensions(true, 0)),
		},
		TypedPerFilterConfig: map[string]*any.Any{
			PerFilterConfigExtAuthzName: PerFilterConfigExtAuthzContextExtensions(MakeExtAuthzContextExtensions(true, 0)),
		},
	routeID, err := policy.RouteID()
	if err != nil {
		return nil, err
	}

			PerFilterConfigExtAuthzName: PerFilterConfigExtAuthzDisabled(),
		route.TypedPerFilterConfig = map[string]*any.Any{
			PerFilterConfigExtAuthzName: PerFilterConfigExtAuthzContextExtensions(MakeExtAuthzContextExtensions(false, routeID)),
		}
		for _, hdr := range b.reproxy.GetPolicyIDHeaders(routeID) {
	routeString := func(typ, name string) string {
			"name": "pomerium-` + typ + `-` + name + `",
			"match": {
				"` + typ + `": "` + name + `"
			},
			"responseHeadersToAdd": [
				{
					"appendAction": "OVERWRITE_IF_EXISTS_OR_ADD",
					"header": {
						"key": "X-Frame-Options",
						"value": "SAMEORIGIN"
					}
				{
					"appendAction": "OVERWRITE_IF_EXISTS_OR_ADD",
					"header": {
						"key": "X-XSS-Protection",
						"value": "1; mode=block"
			],
			"route": {
				"cluster": "pomerium-control-plane-http"
			},
			"typedPerFilterConfig": {
				"envoy.filters.http.ext_authz": {
					"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
					"checkSettings": {
						"contextExtensions": {
							"internal": "true",
							"route_id": "0"
						}
			}
		}`
			`+routeString("path", "/ping")+`,
			`+routeString("path", "/healthz")+`,
			`+routeString("path", "/.pomerium")+`,
			`+routeString("prefix", "/.pomerium/")+`,
			`+routeString("path", "/.well-known/pomerium")+`,
			`+routeString("prefix", "/.well-known/pomerium/")+`,
			`+routeString("path", "/robots.txt")+`,
			`+routeString("path", "/oauth2/callback")+`,
			`+routeString("path", "/")+`
			`+routeString("path", "/ping")+`,
			`+routeString("path", "/healthz")+`,
			`+routeString("path", "/.pomerium")+`,
			`+routeString("prefix", "/.pomerium/")+`,
			`+routeString("path", "/.well-known/pomerium")+`,
			`+routeString("prefix", "/.well-known/pomerium/")+`,
			`+routeString("path", "/robots.txt")+`
			`+routeString("path", "/ping")+`,
			`+routeString("path", "/healthz")+`,
			`+routeString("path", "/.pomerium")+`,
			`+routeString("prefix", "/.pomerium/")+`,
			`+routeString("path", "/.well-known/pomerium")+`,
			`+routeString("prefix", "/.well-known/pomerium/")+`
	route := b.buildControlPlanePathRoute(options, "/hello/world", false)
					"checkSettings": {
						"contextExtensions": {
							"internal": "true",
							"route_id": "0"
						}
					}
	route := b.buildControlPlanePrefixRoute(options, "/hello/world/", false)
					"checkSettings": {
						"contextExtensions": {
							"internal": "true",
							"route_id": "0"
						}
					}
					To:              mustParseWeightedURLs(t, "https://to.example.com"),
				To:                  mustParseWeightedURLs(t, "https://to.example.com"),
				To:                  mustParseWeightedURLs(t, "https://to.example.com"),
				To:                  mustParseWeightedURLs(t, "https://to.example.com"),
				To:                  mustParseWeightedURLs(t, "https://to.example.com"),
				To:                  mustParseWeightedURLs(t, "https://to.example.com"),
				To:                   mustParseWeightedURLs(t, "https://to.example.com"),
				To:                  mustParseWeightedURLs(t, "https://to.example.com"),
				To:                  mustParseWeightedURLs(t, "https://to.example.com"),
				To:                  mustParseWeightedURLs(t, "https://to.example.com"),
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "11444765232398592404"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "2990091139764155677"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "2544588842279234006"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "10244970664102670752"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "2544588842279234006"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "2990091139764155677"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "2990091139764155677"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "1052418080698022187"
							}
						}
					}
				}
					To:                  mustParseWeightedURLs(t, "https://authenticate.internal"),
					To:                  mustParseWeightedURLs(t, "https://to.example.com"),
					To:                  mustParseWeightedURLs(t, "https://to.example.com"),
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "2226589900561460978"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "2226589900561460978"
							}
						}
					}
				}
					To:   mustParseWeightedURLs(t, "https://to.example.com"),
					],
					"typedPerFilterConfig": {
						"envoy.filters.http.ext_authz": {
							"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
							"checkSettings": {
								"contextExtensions": {
									"internal": "false",
									"route_id": "15508081512033148378"
								}
							}
						}
					}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "285016060542193864"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "285016060542193864"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "285016060542193864"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "285016060542193864"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "285016060542193864"
							}
						}
					}
				}
				],
				"typedPerFilterConfig": {
					"envoy.filters.http.ext_authz": {
						"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
						"checkSettings": {
							"contextExtensions": {
								"internal": "false",
								"route_id": "285016060542193864"
							}
						}
					}
				}
    "normalizePath": true,
	results := [accept_0, cors_preflight_0, authenticated_user_0, domain_0, domain_1, domain_2, domain_3, domain_4, claim_0, claim_1, claim_2, claim_3, user_0, email_0, user_1, email_1, user_2, email_2, user_3, email_3, user_4, email_4]