From 97c779b5a2308a05fde93247209fa6e9cd3fc310 Mon Sep 17 00:00:00 2001 From: Michael Zalimeni Date: Thu, 15 Jun 2023 10:45:48 -0400 Subject: [PATCH] Reject inbound Prop Override patch with Services Services filtering is only supported for outbound TrafficDirection patches. --- .../builtin/property-override/property_override.go | 4 ++++ .../property-override/property_override_test.go | 14 ++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/agent/envoyextensions/builtin/property-override/property_override.go b/agent/envoyextensions/builtin/property-override/property_override.go index 51d7836852..d42e3d2d50 100644 --- a/agent/envoyextensions/builtin/property-override/property_override.go +++ b/agent/envoyextensions/builtin/property-override/property_override.go @@ -191,6 +191,10 @@ func (f *ResourceFilter) validate() error { return err } + if len(f.Services) > 0 && f.TrafficDirection != extensioncommon.TrafficDirectionOutbound { + return fmt.Errorf("patch contains non-empty ResourceFilter.Services but ResourceFilter.TrafficDirection is not %q", + extensioncommon.TrafficDirectionOutbound) + } for i := range f.Services { sn := f.Services[i] sn.normalize() diff --git a/agent/envoyextensions/builtin/property-override/property_override_test.go b/agent/envoyextensions/builtin/property-override/property_override_test.go index 21889d840f..4a80db8671 100644 --- a/agent/envoyextensions/builtin/property-override/property_override_test.go +++ b/agent/envoyextensions/builtin/property-override/property_override_test.go @@ -229,6 +229,20 @@ func TestConstructor(t *testing.T) { ok: false, errMsg: "service name is required", }, + "non-empty services with invalid traffic direction": { + arguments: makeArguments(map[string]any{"Patches": []map[string]any{ + makePatch(map[string]any{ + "ResourceFilter": makeResourceFilter(map[string]any{ + "TrafficDirection": extensioncommon.TrafficDirectionInbound, + "Services": []map[string]any{ + {"Name:": "foo"}, + }, + }), + }), + }}), + ok: false, + errMsg: "patch contains non-empty ResourceFilter.Services but ResourceFilter.TrafficDirection is not \"outbound\"", + }, // See decode.HookWeakDecodeFromSlice for more details. In practice, we can end up // with a "Patches" field decoded to the single "Patch" value contained in the // serialized slice (raised from the containing slice). Using WeakDecode solves