Add mTLS Failure Response filter

[arulthileeban]

Commit Message: Addition of a network filter to respond with a non-SSL failure response for client cert verification failure (close connection abruptly or tarpit)

Risk Level: Low Testing: Unit/Integration/Manual Docs Changes: Done Release Notes: TBD Fixes #34617

@ggreenway Thanks for the initial direction. I had a couple of initial questions:

• Does this look okay at a high level? Any preliminary changes before we get into the actual code review?
• As per extension policy, adding a filter requires a sponsor for this to be part of the repository (non-contrib). Would you be willing to help with that?
• I was thinking of adding another option to respond with a HTTP 403/401 like how NGINX helps handle mTLS, but that wouldn't be ideal since this is a network filter. Is there any recommendation you have on adding an option like "SET_METADATA_AND_CONTINUE" for eg. where we set some metadata for a filter higher in the stack like the CustomResponseFilter to match against it and issue a 403 or redirect to a standard error page? Or do we want to maybe take care of that in the core code by adding the validated/presented values in the matchers

[repokitteh-read-only[bot]]

As a reminder, PRs marked as draft will not be automatically assigned reviewers, or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

:cat:

Caused by: https://github.com/envoyproxy/envoy/pull/35006 was opened by arulthileeban.

see: more, trace.

[repokitteh-read-only[bot]]

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/). envoyproxy/api-shepherds assignee is @abeyad CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

:cat:

Caused by: https://github.com/envoyproxy/envoy/pull/35006 was opened by arulthileeban.

see: more, trace.

[abeyad]

/wait

[abeyad]

I just unassigned myself as I'll be OOO for a couple weeks.

[arulthileeban]

@ggreenway friendly ping for any thoughts here

[ggreenway]

I'd also like to hear @alyssawilk 's feedback on this, as she was also involved in the discussion about creating it.

[alyssawilk]

I'd say +1 on docs as I'm a bit confused between API and code how this all works, and move to contrib unless there's a maintainer volunteer for ownership

[github-actions[bot]]

This pull request has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in 7 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions!

[arulthileeban]

Not stale. Will address above comments

[github-actions[bot]]

This pull request has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in 7 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions!

[github-actions[bot]]

This pull request has been automatically closed because it has not had activity in the last 37 days. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions!