Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

All gRPC Services have a sanitized authority #4587

Merged
merged 5 commits into from
Jun 24, 2022
Merged

All gRPC Services have a sanitized authority #4587

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
664742d
internal/envoy/v3: use helper for GrpcService
sunjayBhatia Jun 21, 2022
53c396b
gRPC Services get a configured authority
sunjayBhatia Jun 21, 2022
0c74cb1
changelog
sunjayBhatia Jun 21, 2022
2a91c2f
move changelog to small
sunjayBhatia Jun 22, 2022
27539c6
Merge remote-tracking branch 'origin/main' into extensionservice-auth…
sunjayBhatia Jun 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelogs/unreleased/4587-sunjayBhatia-small.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Envoy will now make requests to gRPC ExtensionServices with a sanitized `:authority` header, rather than just using the extension cluster name.
6 changes: 6 additions & 0 deletions cmd/contour/serve.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -609,8 +609,14 @@ func (s *Server) setupRateLimitService(contourConfiguration contour_api_v1alpha1
}
}

var sni string
if extensionSvc.Spec.UpstreamValidation != nil {
sni = extensionSvc.Spec.UpstreamValidation.SubjectName
}

return &xdscache_v3.RateLimitConfig{
ExtensionService: key,
SNI: sni,
Domain: contourConfiguration.RateLimitService.Domain,
Timeout: responseTimeout,
FailOpen: pointer.BoolDeref(contourConfiguration.RateLimitService.FailOpen, false),
Expand Down
81 changes: 54 additions & 27 deletions internal/envoy/v3/bootstrap_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand All @@ -147,7 +148,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -192,7 +194,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -310,7 +313,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand All @@ -324,7 +328,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -369,7 +374,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -487,7 +493,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand All @@ -501,7 +508,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -546,7 +554,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -665,7 +674,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand All @@ -679,7 +689,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -724,7 +735,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -843,7 +855,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand All @@ -857,7 +870,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -902,7 +916,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -1021,7 +1036,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand All @@ -1035,7 +1051,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -1080,7 +1097,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -1201,7 +1219,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand All @@ -1215,7 +1234,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -1260,7 +1280,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -1415,7 +1436,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand All @@ -1429,7 +1451,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -1474,7 +1497,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -1627,7 +1651,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand All @@ -1641,7 +1666,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down Expand Up @@ -1686,7 +1712,8 @@ func TestBootstrap(t *testing.T) {
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "contour"
"cluster_name": "contour",
"authority": "contour"
}
}
]
Expand Down
10 changes: 3 additions & 7 deletions internal/envoy/v3/cluster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,13 +230,9 @@ func ConfigSource(cluster string) *envoy_core_v3.ConfigSource {
ApiConfigSource: &envoy_core_v3.ApiConfigSource{
ApiType: envoy_core_v3.ApiConfigSource_GRPC,
TransportApiVersion: envoy_core_v3.ApiVersion_V3,
GrpcServices: []*envoy_core_v3.GrpcService{{
TargetSpecifier: &envoy_core_v3.GrpcService_EnvoyGrpc_{
EnvoyGrpc: &envoy_core_v3.GrpcService_EnvoyGrpc{
ClusterName: cluster,
},
},
}},
GrpcServices: []*envoy_core_v3.GrpcService{
GrpcService(cluster, "", timeout.DefaultSetting()),
},
},
},
}
Expand Down
32 changes: 19 additions & 13 deletions internal/envoy/v3/listener.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -677,21 +677,10 @@ end

// FilterExternalAuthz returns an `ext_authz` filter configured with the
// requested parameters.
func FilterExternalAuthz(authzClusterName string, failOpen bool, timeout timeout.Setting, bufferSettings *dag.AuthorizationServerBufferSettings) *http.HttpFilter {
func FilterExternalAuthz(authzClusterName, sni string, failOpen bool, timeout timeout.Setting, bufferSettings *dag.AuthorizationServerBufferSettings) *http.HttpFilter {
authConfig := envoy_config_filter_http_ext_authz_v3.ExtAuthz{
Services: &envoy_config_filter_http_ext_authz_v3.ExtAuthz_GrpcService{
GrpcService: &envoy_core_v3.GrpcService{
TargetSpecifier: &envoy_core_v3.GrpcService_EnvoyGrpc_{
EnvoyGrpc: &envoy_core_v3.GrpcService_EnvoyGrpc{
ClusterName: authzClusterName,
},
},
Timeout: envoy.Timeout(timeout),
// We don't need to configure metadata here, since we allow
// operators to specify authorization context parameters at
// the virtual host and route.
InitialMetadata: []*envoy_core_v3.HeaderValue{},
},
GrpcService: GrpcService(authzClusterName, sni, timeout),
},
// Pretty sure we always want this. Why have an
// external auth service if it is not going to affect
Expand Down Expand Up @@ -768,6 +757,23 @@ func FilterChainTLSFallback(downstream *envoy_tls_v3.DownstreamTlsContext, filte
return fc
}

// GRPCService returns a envoy_core_v3.GrpcService for the given parameters.
func GrpcService(clusterName, sni string, timeout timeout.Setting) *envoy_core_v3.GrpcService {
authority := strings.ReplaceAll(clusterName, "/", ".")
if sni != "" {
authority = sni
}
return &envoy_core_v3.GrpcService{
TargetSpecifier: &envoy_core_v3.GrpcService_EnvoyGrpc_{
EnvoyGrpc: &envoy_core_v3.GrpcService_EnvoyGrpc{
ClusterName: clusterName,
Authority: authority,
},
},
Timeout: envoy.Timeout(timeout),
}
}

// ListenerFilters returns a []*envoy_listener_v3.ListenerFilter for the supplied listener filters.
func ListenerFilters(filters ...*envoy_listener_v3.ListenerFilter) []*envoy_listener_v3.ListenerFilter {
return filters
Expand Down
Loading