Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ext authz: add dns san support for ext authz service #7948

Merged
merged 7 commits into from
Aug 22, 2019
Merged

ext authz: add dns san support for ext authz service #7948

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a7cbf3d
add dns san support for ext authz
ramaraochavali Aug 16, 2019
465a783
Merge remote-tracking branch 'upstream/master' into fix/ext_authz_dns…
ramaraochavali Aug 21, 2019
3da1534
update comment
ramaraochavali Aug 21, 2019
98a9866
proto doc and format
ramaraochavali Aug 21, 2019
7899e4f
refactor tests
ramaraochavali Aug 21, 2019
06f669a
address review comments
ramaraochavali Aug 22, 2019
d552c3f
Merge branch 'master' into fix/ext_authz_dns_san
ramaraochavali Aug 22, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions source/extensions/filters/common/ext_authz/check_request_utils.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,14 +45,24 @@ void CheckRequestUtils::setAttrContextPeer(envoy::service::auth::v2::AttributeCo
if (local) {
const auto uriSans = ssl->uriSanLocalCertificate();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: already there, but uri_sans

if (uriSans.empty()) {
peer.set_principal(ssl->subjectLocalCertificate());
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you update the comment on

envoy/source/extensions/filters/common/ext_authz/check_request_utils.cc

Lines 40 to 42 in a7cbf3d

// Set the principal
// Preferably the SAN from the peer's cert or
// Subject from the peer's cert.
to be more complete and reflects this change?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update the comment.

const auto dnsSans = ssl->dnsSansLocalCertificate();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: dns_sans

if (dnsSans.empty()) {
peer.set_principal(ssl->subjectLocalCertificate());
} else {
peer.set_principal(dnsSans[0]);
}
} else {
peer.set_principal(uriSans[0]);
}
} else {
const auto uriSans = ssl->uriSanPeerCertificate();
if (uriSans.empty()) {
peer.set_principal(ssl->subjectPeerCertificate());
const auto dnsSans = ssl->dnsSansPeerCertificate();
if (dnsSans.empty()) {
peer.set_principal(ssl->subjectPeerCertificate());
} else {
peer.set_principal(dnsSans[0]);
}
} else {
peer.set_principal(uriSans[0]);
}
Expand Down
33 changes: 32 additions & 1 deletion test/extensions/filters/common/ext_authz/check_request_utils_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,7 @@ TEST_F(CheckRequestUtilsTest, BasicHttpWithFullBody) {

// Verify that createHttpCheck extract the proper attributes from the http request into CheckRequest
// proto object.
TEST_F(CheckRequestUtilsTest, CheckAttrContextPeer) {
TEST_F(CheckRequestUtilsTest, CheckAttrContextPeerUriSans) {
Http::TestHeaderMapImpl request_headers{{"x-envoy-downstream-service-cluster", "foo"},
{":path", "/bar"}};
envoy::service::auth::v2::CheckRequest request;
Expand Down Expand Up @@ -155,6 +155,37 @@ TEST_F(CheckRequestUtilsTest, CheckAttrContextPeer) {
EXPECT_EQ("value", request.attributes().context_extensions().at("key"));
}

TEST_F(CheckRequestUtilsTest, CheckAttrContextPeerDnsSans) {
Http::TestHeaderMapImpl request_headers{{"x-envoy-downstream-service-cluster", "foo"},
{":path", "/bar"}};
envoy::service::auth::v2::CheckRequest request;
EXPECT_CALL(callbacks_, connection()).WillRepeatedly(Return(&connection_));
EXPECT_CALL(connection_, remoteAddress()).WillRepeatedly(ReturnRef(addr_));
EXPECT_CALL(connection_, localAddress()).WillRepeatedly(ReturnRef(addr_));
EXPECT_CALL(Const(connection_), ssl()).WillRepeatedly(Return(&ssl_));
EXPECT_CALL(callbacks_, streamId()).WillRepeatedly(Return(0));
EXPECT_CALL(callbacks_, streamInfo()).WillRepeatedly(ReturnRef(req_info_));
EXPECT_CALL(callbacks_, decodingBuffer()).Times(1);
EXPECT_CALL(req_info_, protocol()).WillRepeatedly(ReturnPointee(&protocol_));
EXPECT_CALL(ssl_, uriSanPeerCertificate()).WillOnce(Return(std::vector<std::string>{}));
EXPECT_CALL(ssl_, dnsSansPeerCertificate()).WillOnce(Return(std::vector<std::string>{"source"}));

EXPECT_CALL(ssl_, uriSanLocalCertificate()).WillOnce(Return(std::vector<std::string>{}));
EXPECT_CALL(ssl_, dnsSansLocalCertificate())
.WillOnce(Return(std::vector<std::string>{"destination"}));

Protobuf::Map<std::string, std::string> context_extensions;
context_extensions["key"] = "value";

CheckRequestUtils::createHttpCheck(&callbacks_, request_headers, std::move(context_extensions),
request, false);

EXPECT_EQ("source", request.attributes().source().principal());
EXPECT_EQ("destination", request.attributes().destination().principal());
EXPECT_EQ("foo", request.attributes().source().service());
EXPECT_EQ("value", request.attributes().context_extensions().at("key"));
}

} // namespace
} // namespace ExtAuthz
} // namespace Common
Expand Down