fix(policy): matcher with same key not the same value (#6460)

* fix(policies): matcher with same key not the same value Signed-off-by: Jakub Dyszkiewicz <jakub.dyszkiewicz@gmail.com> (cherry picked from commit 0e3ca75)
kumahq · Apr 5, 2023 · 739a67c · 739a67c
1 parent e37b639
commit 739a67c
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 1 deletion.
diff --git a/pkg/core/xds/rules.go b/pkg/core/xds/rules.go
@@ -42,7 +42,7 @@ func (ss Subset) IsSubset(other Subset) bool {
 			if otherTag.Value == tag.Value && otherTag.Not != tag.Not {
 				return false
 			}
-			if otherTag.Value != tag.Value && !otherTag.Not {
+			if otherTag.Value != tag.Value && !otherTag.Not && !tag.Not {
 				return false
 			}
 		}

diff --git a/pkg/core/xds/rules_test.go b/pkg/core/xds/rules_test.go
@@ -265,6 +265,22 @@ var _ = Describe("Rules", func() {
 				},
 				confYAML: []byte(`action: ALLOW`),
 			}),
+			Entry("single matched not", testCase{
+				rules: xds.Rules{
+					{
+						Subset: []xds.Tag{
+							{Key: "key1", Value: "val1", Not: true},
+						},
+						Conf: meshtrafficpermission_api.Conf{
+							Action: "Allow",
+						},
+					},
+				},
+				subset: []xds.Tag{
+					{Key: "key1", Value: "val2"},
+				},
+				confYAML: []byte(`action: Allow`),
+			}),
 			Entry("single matched rule, rule and subset with negation", testCase{
 				rules: xds.Rules{
 					{