dio

Envoy dynamic hostnames and bounded SNI-scoped upstream TLS sessions

Patch target:

Envoy 0d6e3c60aa55e434f28e581df1d25fcb83404b68

This patch has two related themes:

dio

Envoy dynamic SNI session isolation

Patch target:

Envoy 0d6e3c60aa55e434f28e581df1d25fcb83404b68

This patch is for Envoy dynamic-module clusters that use async host selection and one static UpstreamTlsContext for multiple runtime-selected upstream

dio

Envoy patch: hostname ABI + defer TSO after async ChooseHost

Base commit: 0d6e3c60aa55e434f28e581df1d25fcb83404b68

Why

When a cluster uses lb_policy: CLUSTER_PROVIDED with an async ChooseHost (host selection suspends until a body-phase filter resolves it), two bugs combine to break per-host SNI:

dio

diff --git a/source/extensions/clusters/dynamic_modules/abi_impl.cc b/source/extensions/clusters/dynamic_modules/abi_impl.cc
index c9bca932..da0fe6f6 100644
--- a/source/extensions/clusters/dynamic_modules/abi_impl.cc
+++ b/source/extensions/clusters/dynamic_modules/abi_impl.cc
@@ -136,9 +136,76 @@ bool envoy_dynamic_module_callback_cluster_add_hosts(
     }
   }
 
+  // Empty hostnames vector preserves the legacy synthesized hostname (cluster name + address)
+  // that callers of this entrypoint have always received.

dio

From 0d3b9844fb0ef7c0577d300159d939e9a9e4365e Mon Sep 17 00:00:00 2001
From: Dhi Aurrahman <dio@rockybars.com>
Date: Wed, 20 May 2026 13:42:41 +0700
Subject: [PATCH] fix(macos): export all envoy_dynamic_module_callback_*
 symbols

On macOS, only symbols exported in the Mach-O export table are resolvable
via `dlsym` from dynamically loaded modules. Because Envoy is built with
`-fvisibility=hidden`, the `envoy_dynamic_module_callback_*` symbols were
not exported and were removed during the post-build `strip(1)` step.

dio

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index f41ae6e13..789e3e6b1 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -998,6 +998,9 @@ static int check_cert(X509_STORE_CTX *ctx)

 static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify)
 {
+    if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME) {
+        return 1;

dio

PPIU

The following scrape.ts scrapes (essential) PPIU data from: https://simpu.kemenag.go.id/home/travel.

To run the script, you need to have deno running on your machine.

Since it needs to access network and writing file to accomplish the task, you need to run the script as follows:

deno run --allow-net --allow-write scrape.ts

dio

[{"no":"1","name":"PT ALHIDAYAH WISATA UTAMA","link":"https://simpu.kemenag.go.id/home/detail/2289","nomorSk":"26082100094440001\t\t\t\tTGL SK: 13-12-2022\t\t\t\t\n\t\t\t\tDIREKTUR: Hj ANI PREMINI","kontakAlamat":"JALAN CENDRAWASIH II NO.48 RT-RW : 002-012 KELURAHAN CIBODASARI, KECAMATAN CIBODAS, KOTA TANGERANG, PROVINSI BANTEN. TELEPON : 081381796272 EMAIL : ALHIDAYAH.WISATA@GMAIL.COM","cabang":"0","detailLink":"https://simpu.kemenag.go.id/home/detail/2289"},{"no":"2","name":"PT. ALFATIH NUR HAROMAIN","link":"https://simpu.kemenag.go.id/home/detail/1164","nomorSk":"NOMOR U.180 TAHUN 2020\t\t\t\tTGL SK: 13-07-2020\t\t\t\t\n\t\t\t\tDIREKTUR: ARIFYANTO","kontakAlamat":"JL. DR RATULANGI NO. 204 RT 001 RW 002 KEL PARANG KEC MAMAJANG KOTA MAKASSAR, PROVINSI SULAWESI SELATAN TELP. 04118912372 EMAIL: ALFATIHTRAVEL.ID@GMAIL.COM","cabang":"0","detailLink":"https://simpu.kemenag.go.id/home/detail/1164"},{"no":"3","name":"PT. ALKAUTSAR GLOBAL PLUS","link":"https://simpu.kemenag.go.id/home/detail/1434","nomorSk":"NOMOR U

dio

dio

# Copyright Istio Authors
#
#   Licensed under the Apache License, Version 2.0 (the "License");
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at
#
#       http://www.apache.org/licenses/LICENSE-2.0
#
#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an "AS IS" BASIS,