Skip to content

Commit e5a8dbb

Browse files
jrajahalmejrajahalme
committed
network_filter: make dual filter
Signed-off-by: Jarno Rajahalme <[email protected]>
1 parent dc45dca commit e5a8dbb

15 files changed

+816
-654
lines changed

‎WORKSPACE‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,14 @@ git_repository(
3737
patch_args = ["apply"],
3838
patch_tool = "git",
3939
patches = [
40-
"@//patches:0001-network-Add-callback-for-upstream-authorization.patch",
41-
"@//patches:0002-listener-add-socket-options.patch",
42-
"@//patches:0003-original_dst_cluster-Avoid-multiple-hosts-for-the-sa.patch",
43-
"@//patches:0004-tcp_proxy-Check-for-nullptr-in-watermark-ASSERTs.patch",
44-
"@//patches:0005-thread_local-reset-slot-in-worker-threads-first.patch",
45-
"@//patches:0006-http-header-expose-attribute.patch",
46-
"@//patches:0007-liburing-arm-build.patch",
40+
"@//patches:0001-listener-add-socket-options.patch",
41+
"@//patches:0002-original_dst_cluster-Avoid-multiple-hosts-for-the-sa.patch",
42+
"@//patches:0003-tcp_proxy-Check-for-nullptr-in-watermark-ASSERTs.patch",
43+
"@//patches:0004-thread_local-reset-slot-in-worker-threads-first.patch",
44+
"@//patches:0005-Expose-HTTP-Header-matcher-attribute.patch",
45+
"@//patches:0006-build-Fix-arm-build-for-liburing.patch",
46+
"@//patches:0007-network-Add-filter-callback-onDestinationSelected.patch",
47+
"@//patches:0008-network-Compat-for-missing-upstream-filter.patch",
4748
],
4849
# // clang-format off: Envoy's format check: Only repository_locations.bzl may contains URL references
4950
remote = "https://github.com/envoyproxy/envoy.git",

‎cilium/filter_state_cilium_policy.cc‎

Lines changed: 58 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -20,64 +20,75 @@ const std::string& CiliumPolicyFilterState::key() {
2020
CONSTRUCT_ON_FIRST_USE(std::string, "cilium.policy");
2121
}
2222

23-
bool CiliumPolicyFilterState::enforceNetworkPolicy(const Network::Connection& conn,
24-
uint32_t destination_identity,
25-
uint16_t destination_port,
26-
const absl::string_view sni,
27-
/* OUT */ bool& use_proxy_lib,
28-
/* OUT */ std::string& l7_proto,
29-
/* INOUT */ AccessLog::Entry& log_entry) const {
23+
bool CiliumPolicyFilterState::enforcePodNetworkPolicy(const Network::Connection& conn,
24+
uint32_t destination_identity,
25+
uint16_t destination_port,
26+
const absl::string_view sni,
27+
/* OUT */ bool& use_proxy_lib,
28+
/* OUT */ std::string& l7_proto) const {
29+
auto remote_id = ingress_ ? source_identity_ : destination_identity;
30+
const auto& policy = policy_resolver_->getPolicy(pod_ip_);
31+
auto port = ingress_ ? port_ : destination_port;
32+
auto port_policy = policy.findPortPolicy(ingress_, port);
33+
3034
use_proxy_lib = false;
3135
l7_proto = "";
3236

33-
// enforce pod policy first, if any
34-
if (pod_ip_.length() > 0) {
35-
const auto& policy = policy_resolver_->getPolicy(pod_ip_);
36-
auto remote_id = ingress_ ? source_identity_ : destination_identity;
37-
auto port = ingress_ ? port_ : destination_port;
38-
39-
auto port_policy = policy.findPortPolicy(ingress_, port);
40-
41-
if (!port_policy.allowed(proxy_id_, remote_id, sni)) {
42-
ENVOY_CONN_LOG(debug, "Pod policy DENY on proxy_id: {} id: {} port: {} sni: \"{}\"", conn,
43-
proxy_id_, remote_id, port, sni);
44-
return false;
45-
}
46-
47-
// populate l7proto_ if available
48-
use_proxy_lib = port_policy.useProxylib(proxy_id_, remote_id, l7_proto);
37+
if (!port_policy.allowed(proxy_id_, remote_id, sni)) {
38+
ENVOY_CONN_LOG(debug,
39+
"cilium.network: Pod {} network {} policy DENY on proxy_id: {} id: {} port: {} "
40+
"sni: \"{}\"",
41+
conn, pod_ip_, ingress_ ? "ingress" : "egress", proxy_id_, remote_id,
42+
destination_port, sni);
43+
return false;
4944
}
5045

51-
// enforce Ingress policy 2nd, if any
52-
if (ingress_policy_name_.length() > 0) {
53-
log_entry.entry_.set_policy_name(ingress_policy_name_);
54-
const auto& policy = policy_resolver_->getPolicy(ingress_policy_name_);
46+
// populate l7proto_ if available
47+
use_proxy_lib = port_policy.useProxylib(proxy_id_, remote_id, l7_proto);
5548

56-
// Enforce ingress policy for Ingress, on the original destination port
57-
if (ingress_source_identity_ != 0) {
58-
auto ingress_port_policy = policy.findPortPolicy(true, port_);
59-
if (!ingress_port_policy.allowed(proxy_id_, ingress_source_identity_, sni)) {
60-
ENVOY_CONN_LOG(debug,
61-
"Ingress network policy {} DROP for source identity and destination "
62-
"reserved ingress identity: {} proxy_id: {} port: {} sni: \"{}\"",
63-
conn, ingress_policy_name_, ingress_source_identity_, proxy_id_, port_, sni);
64-
return false;
65-
}
66-
}
49+
ENVOY_CONN_LOG(debug,
50+
"cilium.network: Pod {} network {} policy ALLOW on proxy_id: {} id: {} port: {} "
51+
"sni: \"{}\"",
52+
conn, pod_ip_, ingress_ ? "ingress" : "egress", proxy_id_, remote_id,
53+
destination_port, sni);
54+
return true;
55+
}
6756

68-
// Enforce egress policy for Ingress
69-
auto egress_port_policy = policy.findPortPolicy(false, destination_port);
70-
if (!egress_port_policy.allowed(proxy_id_, destination_identity, sni)) {
71-
ENVOY_CONN_LOG(debug,
72-
"Egress network policy {} DROP for reserved ingress identity and destination "
73-
"identity: {} proxy_id: {} port: {} sni: \"{}\"",
74-
conn, ingress_policy_name_, destination_identity, proxy_id_, destination_port,
75-
sni);
57+
bool CiliumPolicyFilterState::enforceIngressNetworkPolicy(const Network::Connection& conn,
58+
uint32_t destination_identity,
59+
uint16_t destination_port,
60+
const absl::string_view sni) const {
61+
const auto& policy = policy_resolver_->getPolicy(ingress_policy_name_);
62+
63+
// Enforce ingress policy for Ingress, on the original destination port
64+
if (ingress_source_identity_ != 0) {
65+
auto ingress_port_policy = policy.findPortPolicy(true, port_);
66+
if (!ingress_port_policy.allowed(proxy_id_, ingress_source_identity_, sni)) {
67+
ENVOY_CONN_LOG(
68+
debug,
69+
"cilium.network: Ingress {} network ingress policy DENY on proxy_id: {} id: {} "
70+
"port: {} sni: \"{}\"",
71+
conn, ingress_policy_name_, proxy_id_, ingress_source_identity_, port_, sni);
7672
return false;
7773
}
7874
}
7975

80-
// Connection allowed by policy
76+
// Enforce egress policy for Ingress
77+
auto egress_port_policy = policy.findPortPolicy(false, destination_port);
78+
if (!egress_port_policy.allowed(proxy_id_, destination_identity, sni)) {
79+
ENVOY_CONN_LOG(debug,
80+
"cilium.network: Ingress {} network egress policy DENY on proxy_id: {} "
81+
"id: {} port: {} sni: \"{}\"",
82+
conn, ingress_policy_name_, proxy_id_, destination_identity, destination_port,
83+
sni);
84+
return false;
85+
}
86+
87+
ENVOY_CONN_LOG(debug,
88+
"cilium.network: Ingress {} network policy ALLOW on proxy_id: {} id: {} port: {} "
89+
"sni: \"{}\"",
90+
conn, ingress_policy_name_, proxy_id_, destination_identity, destination_port,
91+
sni);
8192
return true;
8293
}
8394

‎cilium/filter_state_cilium_policy.h‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,13 @@ class CiliumPolicyFilterState : public StreamInfo::FilterState::Object,
8080

8181
const PolicyInstance& getPolicy() const { return policy_resolver_->getPolicy(pod_ip_); }
8282

83-
bool enforceNetworkPolicy(const Network::Connection& conn, uint32_t destination_identity,
84-
uint16_t destination_port, const absl::string_view sni,
85-
/* OUT */ bool& use_proxy_lib,
86-
/* OUT */ std::string& l7_proto,
87-
/* INOUT */ AccessLog::Entry& log_entry) const;
83+
bool enforcePodNetworkPolicy(const Network::Connection& conn, uint32_t destination_identity,
84+
uint16_t destination_port, const absl::string_view sni,
85+
/* OUT */ bool& use_proxy_lib,
86+
/* OUT */ std::string& l7_proto) const;
87+
88+
bool enforceIngressNetworkPolicy(const Network::Connection& conn, uint32_t destination_identity,
89+
uint16_t destination_port, const absl::string_view sni) const;
8890

8991
bool enforcePodHTTPPolicy(const Network::Connection& conn, uint32_t destination_identity,
9092
uint16_t destination_port,

0 commit comments

Comments
 (0)