Update authn filter to use first spiffe san (envoyproxy#2617)

Signed-off-by: Prabu Shyam <prabushyam41@gmail.com> Co-authored-by: Prabu Shyam <prabushyam@users.noreply.github.com>
Shikugawa · Jan 3, 2020 · 96a5090 · 96a5090
1 parent 116466b
commit 96a5090
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 3 deletions.
diff --git a/src/envoy/utils/utils.cc b/src/envoy/utils/utils.cc
@@ -36,6 +36,10 @@ const std::string kPerHostMetadataKey("istio");
 // Attribute field for per-host data override
 const std::string kMetadataDestinationUID("uid");
 
+bool hasSPIFFEPrefix(const std::string& san) {
+  return absl::StartsWith(san, kSPIFFEPrefix);
+}
+
 bool getCertSAN(const Network::Connection* connection, bool peer,
                 std::string* principal) {
   if (connection) {
@@ -47,16 +51,21 @@ bool getCertSAN(const Network::Connection* connection, bool peer,
         // empty result is not allowed.
         return false;
       }
+      // return the first san with the 'spiffe://' prefix
+      for (const auto& san : sans) {
+        if (hasSPIFFEPrefix(san)) {
+          *principal = san;
+          return true;
+        }
+      }
+      // return the first san if no sans have the spiffe:// prefix
       *principal = sans[0];
       return true;
     }
   }
   return false;
 }
 
-bool hasSPIFFEPrefix(const std::string& san) {
-  return absl::StartsWith(san, kSPIFFEPrefix);
-}
 }  // namespace
 
 void ExtractHeaders(const Http::HeaderMap& header_map,

diff --git a/src/envoy/utils/utils_test.cc b/src/envoy/utils/utils_test.cc
@@ -128,6 +128,16 @@ TEST_P(UtilsTest, GetPrincipalNoSpiffePrefix) {
   testGetPrincipal(sans, "spiffe:foo/bar", true);
 }
 
+TEST_P(UtilsTest, GetPrincipalFromSpiffePrefixSAN) {
+  std::vector<std::string> sans{"bad", "spiffe://foo/bar"};
+  testGetPrincipal(sans, "foo/bar", true);
+}
+
+TEST_P(UtilsTest, GetPrincipalFromNonSpiffePrefixSAN) {
+  std::vector<std::string> sans{"foobar", "xyz"};
+  testGetPrincipal(sans, "foobar", true);
+}
+
 TEST_P(UtilsTest, GetPrincipalEmpty) {
   std::vector<std::string> sans;
   testGetPrincipal(sans, "", false);
@@ -148,6 +158,16 @@ TEST_P(UtilsTest, GetTrustDomainNoSpiffePrefix) {
   testGetTrustDomain(sans, "", false);
 }
 
+TEST_P(UtilsTest, GetTrustDomainFromSpiffePrefixSAN) {
+  std::vector<std::string> sans{"bad", "spiffe://td/bar", "xyz"};
+  testGetTrustDomain(sans, "td", true);
+}
+
+TEST_P(UtilsTest, GetTrustDomainFromNonSpiffePrefixSAN) {
+  std::vector<std::string> sans{"tdbar", "xyz"};
+  testGetTrustDomain(sans, "", false);
+}
+
 TEST_P(UtilsTest, GetTrustDomainNoSlash) {
   std::vector<std::string> sans{"spiffe://td", "bad"};
   testGetTrustDomain(sans, "", false);