Repository: istio/istio
File: pilot/pkg/model/gateway.go (Go)

Code before:
					lookupNamespace := proxy.VerifiedIdentity.Namespace
					if strings.HasPrefix(gatewayConfig.Annotations[constants.InternalParentNames], gvk.XListenerSet.Kind+"/") {
						gwKind = gvk.XListenerSet
						lookupNamespace = gatewayConfig.Namespace
					}
					// Ignore BuiltinGatewaySecretTypeURI, as it is not referencing a Secret at all
					if !strings.HasPrefix(cn, credentials.BuiltinGatewaySecretTypeURI) {
						rn := credentials.ToResourceName(cn)
						parse, err := credentials.ParseResourceName(rn, proxy.VerifiedIdentity.Namespace, "", "")
						// For ListenerSet, we do not require the config to live in the same namespace. However, there is a trust handshake via AllowedListeners.
						configAndProxyAllowed := gatewayConfig.Namespace == proxy.VerifiedIdentity.Namespace || gwKind == gvk.XListenerSet
						if err == nil && configAndProxyAllowed && parse.Namespace == lookupNamespace {
							// Same namespace is always allowed
							verifiedCertificateReferences.Insert(rn)
							if s.GetTls().GetMode() == networking.ServerTLSSettings_MUTUAL {
								verifiedCertificateReferences.Insert(rn + credentials.SdsCaSuffix)
							}
						} else if ps.SecretAllowed(gwKind, rn, lookupNamespace) {
							// Explicitly allowed by some policy
							verifiedCertificateReferences.Insert(rn)
							if s.GetTls().GetMode() == networking.ServerTLSSettings_MUTUAL {
								verifiedCertificateReferences.Insert(rn + credentials.SdsCaSuffix)
							}
						}
					}
				}
			}
			for _, resolvedPort := range resolvePorts(s.Port.Number, gwAndInstance.instances, gwAndInstance.legacyGatewaySelector) {
				routeName := gatewayRDSRouteName(s, resolvedPort, gatewayConfig)
				if s.Tls != nil {
					// Envoy will reject config that has multiple filter chain matches with the same matching rules.
					// To avoid this, we need to make sure we don't have duplicated hosts, which will become
					// SNI filter chain matches.

					// When there is Bind specified in the Gateway, the listener is built per IP instead of
					// sharing one wildcard listener. So different Gateways can
					// have same host as long as they have different Bind.
					if tlsHostsByPort[resolvedPort] == nil {
						tlsHostsByPort[resolvedPort] = map[string]string{}
					}
					if duplicateHosts := CheckDuplicates(s.Hosts, s.Bind, tlsHostsByPort[resolvedPort]); len(duplicateHosts) != 0 {
						log.Warnf("skipping server on gateway %s, duplicate host names: %v", gatewayName, duplicateHosts)
						RecordRejectedConfig(gatewayName)
						continue
					}
					tlsServerInfo[s] = &TLSServerInfo{SNIHosts: GetSNIHostsForServer(s), RouteName: routeName}
					if s.Tls.Mode == networking.ServerTLSSettings_AUTO_PASSTHROUGH {
						autoPassthrough = true
					}
				}
				serverPort := ServerPort{resolvedPort, s.Port.Protocol, s.Bind}

Review comment (security):
				if !(cn != "" && identityVerified) {
				        continue
				}
				gwKind := gvk.KubernetesGateway
				lookupNamespace := proxy.VerifiedIdentity.Namespace
				if strings.HasPrefix(gatewayConfig.Annotations[constants.InternalParentNames], gvk.XListenerSet.Kind+"/") {
					gwKind = gvk.XListenerSet
					lookupNamespace = gatewayConfig.Namespace
				}
				// Ignore BuiltinGatewaySecretTypeURI, as it is not referencing a Secret at all
				if !strings.HasPrefix(cn, credentials.BuiltinGatewaySecretTypeURI) {
					rn := credentials.ToResourceName(cn)
					parse, err := credentials.ParseResourceName(rn, proxy.VerifiedIdentity.Namespace, "", "")
					// For ListenerSet, we do not require the config to live in the same namespace. However, there is a trust handshake via AllowedListeners.
					configAndProxyAllowed := gatewayConfig.Namespace == proxy.VerifiedIdentity.Namespace || gwKind == gvk.XListenerSet
					if err == nil && configAndProxyAllowed && parse.Namespace == lookupNamespace {
						// Same namespace is always allowed
						verifiedCertificateReferences.Insert(rn)
						if s.GetTls().GetMode() == networking.ServerTLSSettings_MUTUAL {
							verifiedCertificateReferences.Insert(rn + credentials.SdsCaSuffix)
						}
					} else if ps.SecretAllowed(gwKind, rn, lookupNamespace) {
						// Explicitly allowed by some policy
						verifiedCertificateReferences.Insert(rn)
						if s.GetTls().GetMode() == networking.ServerTLSSettings_MUTUAL {
							verifiedCertificateReferences.Insert(rn + credentials.SdsCaSuffix)
						}
					}
				}

Code after:
				}

				gwKind := gvk.KubernetesGateway
				lookupNamespace := proxy.VerifiedIdentity.Namespace
				if strings.HasPrefix(gatewayConfig.Annotations[constants.InternalParentNames], gvk.XListenerSet.Kind+"/") {
					gwKind = gvk.XListenerSet
					lookupNamespace = gatewayConfig.Namespace
				}

				// Ignore BuiltinGatewaySecretTypeURI, as it is not referencing a Secret at all
				if !strings.HasPrefix(cn, credentials.BuiltinGatewaySecretTypeURI) {
					rn := credentials.ToResourceName(cn)
					parse, err := credentials.ParseResourceName(rn, proxy.VerifiedIdentity.Namespace, "", "")
					// For ListenerSet, we do not require the config to live in the same namespace. However, there is a trust handshake via AllowedListeners.
					configAndProxyAllowed := gatewayConfig.Namespace == proxy.VerifiedIdentity.Namespace || gwKind == gvk.XListenerSet
					if err == nil && configAndProxyAllowed && parse.Namespace == lookupNamespace {
						// Same namespace is always allowed
						verifiedCertificateReferences.Insert(rn)
						if s.GetTls().GetMode() == networking.ServerTLSSettings_MUTUAL {
							verifiedCertificateReferences.Insert(rn + credentials.SdsCaSuffix)
						}
					} else if ps.SecretAllowed(gwKind, rn, lookupNamespace) {
						// Explicitly allowed by some policy
						verifiedCertificateReferences.Insert(rn)
						if s.GetTls().GetMode() == networking.ServerTLSSettings_MUTUAL {
							verifiedCertificateReferences.Insert(rn + credentials.SdsCaSuffix)
						}
					}
				}
			}

			for _, resolvedPort := range resolvePorts(s.Port.Number, gwAndInstance.instances, gwAndInstance.legacyGatewaySelector) {
				routeName := gatewayRDSRouteName(s, resolvedPort, gatewayConfig)
				if s.Tls != nil {
					// Envoy will reject config that has multiple filter chain matches with the same matching rules.
					// To avoid this, we need to make sure we don't have duplicated hosts, which will become
					// SNI filter chain matches.

					// When there is Bind specified in the Gateway, the listener is built per IP instead of
					// sharing one wildcard listener. So different Gateways can
					// have same host as long as they have different Bind.
					if tlsHostsByPort[resolvedPort] == nil {
						tlsHostsByPort[resolvedPort] = map[string]string{}
					}
					if duplicateHosts := CheckDuplicates(s.Hosts, s.Bind, tlsHostsByPort[resolvedPort]); len(duplicateHosts) != 0 {
						log.Warnf("skipping server on gateway %s, duplicate host names: %v", gatewayName, duplicateHosts)
						RecordRejectedConfig(gatewayName)
						continue
					}
					tlsServerInfo[s] = &TLSServerInfo{SNIHosts: GetSNIHostsForServer(s), RouteName: routeName}
					if s.Tls.Mode == networking.ServerTLSSettings_AUTO_PASSTHROUGH {