Repository: envoyproxy/envoy
File: api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto (Protocol Buffers)

Code before:

  // If set, Envoy will always set :ref:`x-request-id <config_http_conn_man_headers_x-request-id>` header in response.
  // If this is false or not set, the request ID is returned in responses only if tracing is forced using
  // :ref:`x-envoy-force-trace <config_http_conn_man_headers_x-envoy-force-trace>` header.
  bool always_set_request_id_in_response = 37;

  // How to handle the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` (XFCC) HTTP
  // header.
  ForwardClientCertDetails forward_client_cert_details = 16
      [(validate.rules).enum = {defined_only: true}];

  // This field is valid only when :ref:`forward_client_cert_details
  // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.forward_client_cert_details>`
  // is APPEND_FORWARD or SANITIZE_SET and the client connection is mTLS. It specifies the fields in
  // the client certificate to be forwarded. Note that in the
  // :ref:`config_http_conn_man_headers_x-forwarded-client-cert` header, ``Hash`` is always set, and
  // ``By`` is always set when the client certificate presents the URI type Subject Alternative Name
  // value.
  SetCurrentClientCertDetails set_current_client_cert_details = 17;

  // This field is valid only when :ref:`forward_client_cert_details
  // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.forward_client_cert_details>`
  // is SANITIZE_SET_OR_APPEND_FORWARD and the client connection is mTLS. If the client certificate matches the matcher,
  // the client certificate information will be appended to the request’s XFCC header. Otherwise, the XFCC header will be sanitized.
  SubjectAltNameMatcher append_forward_matcher = 60;

  // If proxy_100_continue is true, Envoy will proxy incoming "Expect:
  // 100-continue" headers upstream, and forward "100 Continue" responses
  // downstream. If this is false or not set, Envoy will instead strip the
  // "Expect: 100-continue" header, and send a "100 Continue" response itself.
  bool proxy_100_continue = 18;

  // If
  // :ref:`use_remote_address
  // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address>`
  // is true and represent_ipv4_remote_address_as_ipv4_mapped_ipv6 is true and the remote address is
  // an IPv4 address, the address will be mapped to IPv6 before it is appended to ``x-forwarded-for``.
  // This is useful for testing compatibility of upstream services that parse the header value. For
  // example, 50.0.0.1 is represented as ::FFFF:50.0.0.1. See `IPv4-Mapped IPv6 Addresses
  // <https://tools.ietf.org/html/rfc4291#section-2.5.5.2>`_ for details. This will also affect the
  // :ref:`config_http_conn_man_headers_x-envoy-external-address` header. See
  // :ref:`http_connection_manager.represent_ipv4_remote_address_as_ipv4_mapped_ipv6
  // <config_http_conn_man_runtime_represent_ipv4_remote_address_as_ipv4_mapped_ipv6>` for runtime
  // control.
  // [#not-implemented-hide:]
  bool represent_ipv4_remote_address_as_ipv4_mapped_ipv6 = 20;

  repeated UpgradeConfig upgrade_configs = 23;

  // Should paths be normalized according to RFC 3986 before any processing of
  // requests by HTTP filters or routing? This affects the upstream ``:path`` header

Review comment (security):
The requirement is reasonable, But I think this API is too specific for the feature requirement. I think maybe we can add a generic matcher tree here. And make the following result as the match result. Then, we can get a very flexible  and powerful way to customize the client cert forward behavior?

```
message ForwardClientCertConfig {
  // How to handle the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` (XFCC) HTTP
  // header.
  ForwardClientCertDetails forward_client_cert_details = 1
      [(validate.rules).enum = {defined_only: true}];
  // This field is valid only when :ref:`forward_client_cert_details
  // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.forward_client_cert_details>`
  // is APPEND_FORWARD or SANITIZE_SET and the client connection is mTLS. It specifies the fields in
  // the client certificate to be forwarded. Note that in the
  // :ref:`config_http_conn_man_headers_x-forwarded-client-cert` header, ``Hash`` is always set, and
  // ``By`` is always set when the client certificate presents the URI type Subject Alternative Name
  // value.
  SetCurrentClientCertDetails set_current_client_cert_details = 2;
}
```

Code after:
  // (Edge request is the request from external clients to front Envoy) and not reset it, which
  // is the current Envoy behaviour. This defaults to false.
  bool preserve_external_request_id = 32;

  // If set, Envoy will always set :ref:`x-request-id <config_http_conn_man_headers_x-request-id>` header in response.
  // If this is false or not set, the request ID is returned in responses only if tracing is forced using
  // :ref:`x-envoy-force-trace <config_http_conn_man_headers_x-envoy-force-trace>` header.
  bool always_set_request_id_in_response = 37;

  // How to handle the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` (XFCC) HTTP
  // header.
  ForwardClientCertDetails forward_client_cert_details = 16
      [(validate.rules).enum = {defined_only: true}];

  // This field is valid only when :ref:`forward_client_cert_details
  // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.forward_client_cert_details>`
  // is APPEND_FORWARD or SANITIZE_SET and the client connection is mTLS. It specifies the fields in
  // the client certificate to be forwarded. Note that in the
  // :ref:`config_http_conn_man_headers_x-forwarded-client-cert` header, ``Hash`` is always set, and
  // ``By`` is always set when the client certificate presents the URI type Subject Alternative Name
  // value.
  SetCurrentClientCertDetails set_current_client_cert_details = 17;

  // The matcher for forwarding client cert details.
  // [#not-implemented-hide:]
  xds.type.matcher.v3.Matcher forward_client_cert_matcher = 60;

  // If proxy_100_continue is true, Envoy will proxy incoming "Expect:
  // 100-continue" headers upstream, and forward "100 Continue" responses
  // downstream. If this is false or not set, Envoy will instead strip the
  // "Expect: 100-continue" header, and send a "100 Continue" response itself.
  bool proxy_100_continue = 18;

  // If
  // :ref:`use_remote_address
  // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address>`
  // is true and represent_ipv4_remote_address_as_ipv4_mapped_ipv6 is true and the remote address is
  // an IPv4 address, the address will be mapped to IPv6 before it is appended to ``x-forwarded-for``.
  // This is useful for testing compatibility of upstream services that parse the header value. For
  // example, 50.0.0.1 is represented as ::FFFF:50.0.0.1. See `IPv4-Mapped IPv6 Addresses
  // <https://tools.ietf.org/html/rfc4291#section-2.5.5.2>`_ for details. This will also affect the
  // :ref:`config_http_conn_man_headers_x-envoy-external-address` header. See
  // :ref:`http_connection_manager.represent_ipv4_remote_address_as_ipv4_mapped_ipv6
  // <config_http_conn_man_runtime_represent_ipv4_remote_address_as_ipv4_mapped_ipv6>` for runtime
  // control.
  // [#not-implemented-hide:]
  bool represent_ipv4_remote_address_as_ipv4_mapped_ipv6 = 20;

  repeated UpgradeConfig upgrade_configs = 23;

  // Should paths be normalized according to RFC 3986 before any processing of