|
|
|
|
@ -21,9 +21,10 @@ import (
|
|
|
|
|
func makeRBACNetworkFilter(
|
|
|
|
|
intentions structs.Intentions,
|
|
|
|
|
intentionDefaultAllow bool,
|
|
|
|
|
peerTrustBundles map[string]*pbpeering.PeeringTrustBundle,
|
|
|
|
|
trustDomain string,
|
|
|
|
|
peerTrustBundles []*pbpeering.PeeringTrustBundle,
|
|
|
|
|
) (*envoy_listener_v3.Filter, error) {
|
|
|
|
|
rules, err := makeRBACRules(intentions, intentionDefaultAllow, false, peerTrustBundles)
|
|
|
|
|
rules, err := makeRBACRules(intentions, intentionDefaultAllow, trustDomain, false, peerTrustBundles)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, err
|
|
|
|
|
}
|
|
|
|
|
@ -38,9 +39,10 @@ func makeRBACNetworkFilter(
|
|
|
|
|
func makeRBACHTTPFilter(
|
|
|
|
|
intentions structs.Intentions,
|
|
|
|
|
intentionDefaultAllow bool,
|
|
|
|
|
peerTrustBundles map[string]*pbpeering.PeeringTrustBundle,
|
|
|
|
|
trustDomain string,
|
|
|
|
|
peerTrustBundles []*pbpeering.PeeringTrustBundle,
|
|
|
|
|
) (*envoy_http_v3.HttpFilter, error) {
|
|
|
|
|
rules, err := makeRBACRules(intentions, intentionDefaultAllow, true, peerTrustBundles)
|
|
|
|
|
rules, err := makeRBACRules(intentions, intentionDefaultAllow, trustDomain, true, peerTrustBundles)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, err
|
|
|
|
|
}
|
|
|
|
|
@ -53,6 +55,7 @@ func makeRBACHTTPFilter(
|
|
|
|
|
|
|
|
|
|
func intentionListToIntermediateRBACForm(
|
|
|
|
|
intentions structs.Intentions,
|
|
|
|
|
trustDomain string,
|
|
|
|
|
isHTTP bool,
|
|
|
|
|
trustBundlesByPeer map[string]*pbpeering.PeeringTrustBundle,
|
|
|
|
|
) []*rbacIntention {
|
|
|
|
|
@ -72,7 +75,7 @@ func intentionListToIntermediateRBACForm(
|
|
|
|
|
continue
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
rixn := intentionToIntermediateRBACForm(ixn, isHTTP, trustBundle)
|
|
|
|
|
rixn := intentionToIntermediateRBACForm(ixn, trustDomain, isHTTP, trustBundle)
|
|
|
|
|
rbacIxns = append(rbacIxns, rixn)
|
|
|
|
|
}
|
|
|
|
|
return rbacIxns
|
|
|
|
|
@ -210,11 +213,12 @@ func removePermissionPrecedence(perms []*rbacPermission, intentionDefaultAction
|
|
|
|
|
return out
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func intentionToIntermediateRBACForm(ixn *structs.Intention, isHTTP bool, bundle *pbpeering.PeeringTrustBundle) *rbacIntention {
|
|
|
|
|
func intentionToIntermediateRBACForm(ixn *structs.Intention, trustDomain string, isHTTP bool, bundle *pbpeering.PeeringTrustBundle) *rbacIntention {
|
|
|
|
|
rixn := &rbacIntention{
|
|
|
|
|
Source: rbacService{
|
|
|
|
|
ServiceName: ixn.SourceServiceName(),
|
|
|
|
|
Peer: ixn.SourcePeer,
|
|
|
|
|
TrustDomain: trustDomain,
|
|
|
|
|
},
|
|
|
|
|
Precedence: ixn.Precedence,
|
|
|
|
|
}
|
|
|
|
|
@ -426,25 +430,21 @@ func simplifyNotSourceSlice(notSources []rbacService) []rbacService {
|
|
|
|
|
func makeRBACRules(
|
|
|
|
|
intentions structs.Intentions,
|
|
|
|
|
intentionDefaultAllow bool,
|
|
|
|
|
trustDomain string,
|
|
|
|
|
isHTTP bool,
|
|
|
|
|
peerTrustBundles map[string]*pbpeering.PeeringTrustBundle,
|
|
|
|
|
peerTrustBundles []*pbpeering.PeeringTrustBundle,
|
|
|
|
|
) (*envoy_rbac_v3.RBAC, error) {
|
|
|
|
|
// Note that we DON'T explicitly validate the trust-domain matches ours.
|
|
|
|
|
//
|
|
|
|
|
// For now we don't validate the trust domain of the _destination_ at all.
|
|
|
|
|
// The RBAC policies below ignore the trust domain and it's implicit that
|
|
|
|
|
// the request is for the correct cluster. We might want to reconsider this
|
|
|
|
|
// later but plumbing in additional machinery to check the clusterID here
|
|
|
|
|
// is not really necessary for now unless the Envoys are badly configured.
|
|
|
|
|
// Our threat model _requires_ correctly configured and well behaved
|
|
|
|
|
// proxies given that they have ACLs to fetch certs and so can do whatever
|
|
|
|
|
// they want including not authorizing traffic at all or routing it do a
|
|
|
|
|
// different service than they auth'd against.
|
|
|
|
|
|
|
|
|
|
// TODO(banks,rb): Implement revocation list checking?
|
|
|
|
|
|
|
|
|
|
// TODO(peering): mkeeler asked that these maps come from proxycfg instead of
|
|
|
|
|
// being constructed in xds to save memory allocation and gc pressure. Low priority.
|
|
|
|
|
trustBundlesByPeer := make(map[string]*pbpeering.PeeringTrustBundle, len(peerTrustBundles))
|
|
|
|
|
for _, ptb := range peerTrustBundles {
|
|
|
|
|
trustBundlesByPeer[ptb.PeerName] = ptb
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// First build up just the basic principal matches.
|
|
|
|
|
rbacIxns := intentionListToIntermediateRBACForm(intentions, isHTTP, peerTrustBundles)
|
|
|
|
|
rbacIxns := intentionListToIntermediateRBACForm(intentions, trustDomain, isHTTP, trustBundlesByPeer)
|
|
|
|
|
|
|
|
|
|
// Normalize: if we are in default-deny then all intentions must be allows and vice versa
|
|
|
|
|
intentionDefaultAction := intentionActionFromBool(intentionDefaultAllow)
|
|
|
|
|
@ -641,7 +641,7 @@ const anyPath = `[^/]+`
|
|
|
|
|
|
|
|
|
|
func makeSpiffePattern(src rbacService) string {
|
|
|
|
|
var (
|
|
|
|
|
host = anyPath // TODO(peering): We match trust domain on any value but should be defaulting to the local trust domain
|
|
|
|
|
host = src.TrustDomain
|
|
|
|
|
ap = src.PartitionOrDefault()
|
|
|
|
|
ns = src.NamespaceOrDefault()
|
|
|
|
|
svc = src.Name
|
|
|
|
|
|
Chris S. Kim
2 years ago
committed by