mirror of https://github.com/hashicorp/consul
375 lines
12 KiB
Go
375 lines
12 KiB
Go
package xds
|
||
|
||
import (
|
||
"fmt"
|
||
"sort"
|
||
|
||
envoylistener "github.com/envoyproxy/go-control-plane/envoy/api/v2/listener"
|
||
envoyhttprbac "github.com/envoyproxy/go-control-plane/envoy/config/filter/http/rbac/v2"
|
||
envoyhttp "github.com/envoyproxy/go-control-plane/envoy/config/filter/network/http_connection_manager/v2"
|
||
envoynetrbac "github.com/envoyproxy/go-control-plane/envoy/config/filter/network/rbac/v2"
|
||
envoyrbac "github.com/envoyproxy/go-control-plane/envoy/config/rbac/v2"
|
||
envoymatcher "github.com/envoyproxy/go-control-plane/envoy/type/matcher"
|
||
"github.com/hashicorp/consul/agent/structs"
|
||
)
|
||
|
||
func makeRBACNetworkFilter(intentions structs.Intentions, intentionDefaultAllow bool) (*envoylistener.Filter, error) {
|
||
rules, err := makeRBACRules(intentions, intentionDefaultAllow)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
cfg := &envoynetrbac.RBAC{
|
||
StatPrefix: "connect_authz",
|
||
Rules: rules,
|
||
}
|
||
return makeFilter("envoy.filters.network.rbac", cfg, false)
|
||
}
|
||
|
||
func makeRBACHTTPFilter(intentions structs.Intentions, intentionDefaultAllow bool) (*envoyhttp.HttpFilter, error) {
|
||
rules, err := makeRBACRules(intentions, intentionDefaultAllow)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
cfg := &envoyhttprbac.RBAC{
|
||
Rules: rules,
|
||
}
|
||
return makeEnvoyHTTPFilter("envoy.filters.http.rbac", cfg)
|
||
}
|
||
|
||
type rbacIntention struct {
|
||
Source structs.ServiceName
|
||
NotSources []structs.ServiceName
|
||
Allow bool
|
||
Precedence int
|
||
Skip bool
|
||
}
|
||
|
||
func (r *rbacIntention) Simplify() {
|
||
r.NotSources = simplifyNotSourceSlice(r.NotSources)
|
||
}
|
||
|
||
func simplifyNotSourceSlice(notSources []structs.ServiceName) []structs.ServiceName {
|
||
if len(notSources) <= 1 {
|
||
return notSources
|
||
}
|
||
|
||
// Collapse NotSources elements together if any element is a subset of
|
||
// another.
|
||
|
||
// Sort, keeping the least wildcarded elements first.
|
||
sort.SliceStable(notSources, func(i, j int) bool {
|
||
return countWild(notSources[i]) < countWild(notSources[j])
|
||
})
|
||
|
||
keep := make([]structs.ServiceName, 0, len(notSources))
|
||
for i := 0; i < len(notSources); i++ {
|
||
si := notSources[i]
|
||
remove := false
|
||
for j := i + 1; j < len(notSources); j++ {
|
||
sj := notSources[j]
|
||
|
||
if ixnSourceMatches(si, sj) {
|
||
remove = true
|
||
break
|
||
}
|
||
}
|
||
if !remove {
|
||
keep = append(keep, si)
|
||
}
|
||
}
|
||
|
||
return keep
|
||
}
|
||
|
||
// makeRBACRules translates Consul intentions into RBAC Policies for Envoy.
|
||
//
|
||
// Consul lets you define up to 9 different kinds of intentions that apply at
|
||
// different levels of precedence (this is limited to 4 if not using Consul
|
||
// Enterprise). Each intention in this flat list (sorted by precedence) can either
|
||
// be an allow rule or a deny rule. Here’s a concrete example of this at work:
|
||
//
|
||
// intern/trusted-app => billing/payment-svc : ALLOW (prec=9)
|
||
// intern/* => billing/payment-svc : DENY (prec=8)
|
||
// */* => billing/payment-svc : ALLOW (prec=7)
|
||
// ::: ACL default policy ::: : DENY (prec=N/A)
|
||
//
|
||
// In contrast, Envoy lets you either configure a filter to be based on an
|
||
// allow-list or a deny-list based on the action attribute of the RBAC rules
|
||
// struct.
|
||
//
|
||
// On the surface it would seem that the configuration model of Consul
|
||
// intentions is incompatible with that of Envoy’s RBAC engine. For any given
|
||
// destination service Consul’s model requires evaluating a list of rules and
|
||
// short circuiting later rules once an earlier rule matches. After a rule is
|
||
// found to match then we decide if it is allow/deny. Envoy on the other hand
|
||
// requires the rules to express all conditions to allow access or all conditions
|
||
// to deny access.
|
||
//
|
||
// Despite the surface incompatibility it is possible to marry these two
|
||
// models. For clarity I’ll rewrite the earlier example intentions in an
|
||
// abbreviated form:
|
||
//
|
||
// A : ALLOW
|
||
// B : DENY
|
||
// C : ALLOW
|
||
// <default> : DENY
|
||
//
|
||
// 1. Given that the overall intention default is set to deny, we start by
|
||
// choosing to build an allow-list in Envoy (this is also the variant that I find
|
||
// easier to think about).
|
||
// 2. Next we traverse the list in precedence order (top down) and any DENY
|
||
// intentions are combined with later intentions using logical operations.
|
||
// 3. Now that all of the intentions result in the same action (allow) we have
|
||
// successfully removed precedence and we can express this in as a set of Envoy
|
||
// RBAC policies.
|
||
//
|
||
// After this the earlier A/B/C/default list becomes:
|
||
//
|
||
// A : ALLOW
|
||
// C AND NOT(B) : ALLOW
|
||
// <default> : DENY
|
||
//
|
||
// Which really is just an allow-list of [A, C AND NOT(B)]
|
||
func makeRBACRules(intentions structs.Intentions, intentionDefaultAllow bool) (*envoyrbac.RBAC, error) {
|
||
// Note that we DON'T explicitly validate the trust-domain matches ours.
|
||
//
|
||
// For now we don't validate the trust domain of the _destination_ at all.
|
||
// The RBAC policies below ignore the trust domain and it's implicit that
|
||
// the request is for the correct cluster. We might want to reconsider this
|
||
// later but plumbing in additional machinery to check the clusterID here
|
||
// is not really necessary for now unless the Envoys are badly configured.
|
||
// Our threat model _requires_ correctly configured and well behaved
|
||
// proxies given that they have ACLs to fetch certs and so can do whatever
|
||
// they want including not authorizing traffic at all or routing it do a
|
||
// different service than they auth'd against.
|
||
|
||
// TODO(banks,rb): Implement revocation list checking?
|
||
|
||
// Omit any lower-precedence intentions that share the same source.
|
||
intentions = removeSameSourceIntentions(intentions)
|
||
|
||
// First build up just the basic principal matches.
|
||
rbacIxns := make([]*rbacIntention, 0, len(intentions))
|
||
for _, ixn := range intentions {
|
||
rbacIxns = append(rbacIxns, &rbacIntention{
|
||
Source: ixn.SourceServiceName(),
|
||
Allow: (ixn.Action == structs.IntentionActionAllow),
|
||
Precedence: ixn.Precedence,
|
||
})
|
||
}
|
||
|
||
// Normalize: if we are in default-deny then all intentions must be allows and vice versa
|
||
|
||
var rbacAction envoyrbac.RBAC_Action
|
||
if intentionDefaultAllow {
|
||
// The RBAC policies deny access to principals. The rest is allowed.
|
||
// This is block-list style access control.
|
||
rbacAction = envoyrbac.RBAC_DENY
|
||
} else {
|
||
// The RBAC policies grant access to principals. The rest is denied.
|
||
// This is safe-list style access control. This is the default type.
|
||
rbacAction = envoyrbac.RBAC_ALLOW
|
||
}
|
||
|
||
// First walk backwards and if we encounter an intention with an action
|
||
// that is the same as the default intention action, add it to all
|
||
// subsequent statements (via AND NOT $x) and mark the rule itself for
|
||
// erasure.
|
||
//
|
||
// i.e. for a default-deny setup we look for denies.
|
||
if len(rbacIxns) > 0 {
|
||
for i := len(rbacIxns) - 1; i >= 0; i-- {
|
||
if rbacIxns[i].Allow == intentionDefaultAllow {
|
||
for j := i + 1; j < len(rbacIxns); j++ {
|
||
if rbacIxns[j].Skip {
|
||
continue
|
||
}
|
||
// [i] is the intention candidate that we are distributing
|
||
// [j] is the thing to maybe NOT [i] from
|
||
if ixnSourceMatches(rbacIxns[i].Source, rbacIxns[j].Source) {
|
||
rbacIxns[j].NotSources = append(rbacIxns[j].NotSources, rbacIxns[i].Source)
|
||
}
|
||
}
|
||
// since this is default-FOO, any trailing FOO intentions will just evaporate
|
||
rbacIxns[i].Skip = true // mark for deletion
|
||
}
|
||
}
|
||
}
|
||
// At this point precedence doesn't matter since all roads lead to the same action.
|
||
|
||
var principals []*envoyrbac.Principal
|
||
for _, rbacIxn := range rbacIxns {
|
||
if rbacIxn.Skip {
|
||
continue
|
||
}
|
||
|
||
// NOTE: at this point "rbacIxn.Allow != intentionDefaultAllow"
|
||
|
||
rbacIxn.Simplify()
|
||
|
||
if len(rbacIxn.NotSources) > 0 {
|
||
andIDs := make([]*envoyrbac.Principal, 0, len(rbacIxn.NotSources)+1)
|
||
andIDs = append(andIDs, idPrincipal(rbacIxn.Source))
|
||
for _, src := range rbacIxn.NotSources {
|
||
andIDs = append(andIDs, notPrincipal(
|
||
idPrincipal(src),
|
||
))
|
||
}
|
||
principals = append(principals, andPrincipals(andIDs))
|
||
} else {
|
||
principals = append(principals, idPrincipal(rbacIxn.Source))
|
||
}
|
||
}
|
||
|
||
rbac := &envoyrbac.RBAC{
|
||
Action: rbacAction,
|
||
}
|
||
if len(principals) > 0 {
|
||
policy := &envoyrbac.Policy{
|
||
Principals: principals,
|
||
Permissions: []*envoyrbac.Permission{anyPermission()},
|
||
}
|
||
rbac.Policies = map[string]*envoyrbac.Policy{
|
||
"consul-intentions": policy,
|
||
}
|
||
}
|
||
|
||
return rbac, nil
|
||
}
|
||
|
||
func removeSameSourceIntentions(intentions structs.Intentions) structs.Intentions {
|
||
if len(intentions) < 2 {
|
||
return intentions
|
||
}
|
||
|
||
var (
|
||
out = make(structs.Intentions, 0, len(intentions))
|
||
changed = false
|
||
seenSource = make(map[structs.ServiceName]struct{})
|
||
)
|
||
for _, ixn := range intentions {
|
||
sn := ixn.SourceServiceName()
|
||
if _, ok := seenSource[sn]; ok {
|
||
// A higher precedence intention already used this exact source
|
||
// definition with a different destination.
|
||
changed = true
|
||
continue
|
||
}
|
||
seenSource[sn] = struct{}{}
|
||
out = append(out, ixn)
|
||
}
|
||
|
||
if !changed {
|
||
return intentions
|
||
}
|
||
return out
|
||
}
|
||
|
||
type sourceMatch int
|
||
|
||
const (
|
||
sourceMatchIgnore sourceMatch = 0
|
||
sourceMatchSuperset sourceMatch = 1
|
||
matchSameSubset sourceMatch = 2
|
||
)
|
||
|
||
// ixnSourceMatches deterines if the 'tester' service name is matched by the
|
||
// 'against' service name via wildcard rules.
|
||
//
|
||
// For instance:
|
||
// - (web, api) => false, because these have no wildcards
|
||
// - (web, *) => true, because "all services" includes "web"
|
||
// - (default/web, default/*) => true, because "all services in the default NS" includes "default/web"
|
||
// - (default/*, */*) => true, "any service in any NS" includes "all services in the default NS"
|
||
func ixnSourceMatches(tester, against structs.ServiceName) bool {
|
||
// We assume that we can't have the same intention twice before arriving
|
||
// here.
|
||
numWildTester := countWild(tester)
|
||
numWildAgainst := countWild(against)
|
||
|
||
if numWildTester == numWildAgainst {
|
||
return false
|
||
} else if numWildTester > numWildAgainst {
|
||
return false
|
||
}
|
||
|
||
matchesNS := tester.NamespaceOrDefault() == against.NamespaceOrDefault() || against.NamespaceOrDefault() == structs.WildcardSpecifier
|
||
matchesName := tester.Name == against.Name || against.Name == structs.WildcardSpecifier
|
||
return matchesNS && matchesName
|
||
}
|
||
|
||
// countWild counts the number of wildcard values in the given namespace and name.
|
||
func countWild(src structs.ServiceName) int {
|
||
// If NS is wildcard, it must be 2 since wildcards only follow exact
|
||
if src.NamespaceOrDefault() == structs.WildcardSpecifier {
|
||
return 2
|
||
}
|
||
|
||
// Same reasoning as above, a wildcard can only follow an exact value
|
||
// and an exact value cannot follow a wildcard, so if name is a wildcard
|
||
// we must have exactly one.
|
||
if src.Name == structs.WildcardSpecifier {
|
||
return 1
|
||
}
|
||
|
||
return 0
|
||
}
|
||
|
||
func andPrincipals(ids []*envoyrbac.Principal) *envoyrbac.Principal {
|
||
return &envoyrbac.Principal{
|
||
Identifier: &envoyrbac.Principal_AndIds{
|
||
AndIds: &envoyrbac.Principal_Set{
|
||
Ids: ids,
|
||
},
|
||
},
|
||
}
|
||
}
|
||
|
||
func notPrincipal(id *envoyrbac.Principal) *envoyrbac.Principal {
|
||
return &envoyrbac.Principal{
|
||
Identifier: &envoyrbac.Principal_NotId{
|
||
NotId: id,
|
||
},
|
||
}
|
||
}
|
||
|
||
func idPrincipal(src structs.ServiceName) *envoyrbac.Principal {
|
||
pattern := makeSpiffePattern(src.NamespaceOrDefault(), src.Name)
|
||
|
||
return &envoyrbac.Principal{
|
||
Identifier: &envoyrbac.Principal_Authenticated_{
|
||
Authenticated: &envoyrbac.Principal_Authenticated{
|
||
PrincipalName: &envoymatcher.StringMatcher{
|
||
MatchPattern: &envoymatcher.StringMatcher_SafeRegex{
|
||
SafeRegex: makeEnvoyRegexMatch(pattern),
|
||
},
|
||
},
|
||
},
|
||
},
|
||
}
|
||
}
|
||
func makeSpiffePattern(sourceNS, sourceName string) string {
|
||
const (
|
||
anyPath = `[^/]+`
|
||
spiffeTemplate = `^spiffe://%s/ns/%s/dc/%s/svc/%s$`
|
||
)
|
||
switch {
|
||
case sourceNS != structs.WildcardSpecifier && sourceName != structs.WildcardSpecifier:
|
||
return fmt.Sprintf(spiffeTemplate, anyPath, sourceNS, anyPath, sourceName)
|
||
case sourceNS != structs.WildcardSpecifier && sourceName == structs.WildcardSpecifier:
|
||
return fmt.Sprintf(spiffeTemplate, anyPath, sourceNS, anyPath, anyPath)
|
||
case sourceNS == structs.WildcardSpecifier && sourceName == structs.WildcardSpecifier:
|
||
return fmt.Sprintf(spiffeTemplate, anyPath, anyPath, anyPath, anyPath)
|
||
default:
|
||
panic(fmt.Sprintf("not possible to have a wildcarded namespace %q but an exact service %q", sourceNS, sourceName))
|
||
}
|
||
}
|
||
|
||
func anyPermission() *envoyrbac.Permission {
|
||
return &envoyrbac.Permission{
|
||
Rule: &envoyrbac.Permission_Any{Any: true},
|
||
}
|
||
}
|