mirror of https://github.com/hashicorp/consul
1046 lines
32 KiB
Go
1046 lines
32 KiB
Go
package xds
|
||
|
||
import (
|
||
"fmt"
|
||
"sort"
|
||
"strings"
|
||
|
||
envoy_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
|
||
envoy_rbac_v3 "github.com/envoyproxy/go-control-plane/envoy/config/rbac/v3"
|
||
envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
|
||
envoy_http_header_to_meta_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/header_to_metadata/v3"
|
||
envoy_http_rbac_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/rbac/v3"
|
||
envoy_http_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
|
||
envoy_network_rbac_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/rbac/v3"
|
||
envoy_matcher_v3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
|
||
|
||
"github.com/hashicorp/consul/agent/connect"
|
||
"github.com/hashicorp/consul/agent/structs"
|
||
"github.com/hashicorp/consul/proto/private/pbpeering"
|
||
)
|
||
|
||
func makeRBACNetworkFilter(
|
||
intentions structs.Intentions,
|
||
intentionDefaultAllow bool,
|
||
localInfo rbacLocalInfo,
|
||
peerTrustBundles []*pbpeering.PeeringTrustBundle,
|
||
) (*envoy_listener_v3.Filter, error) {
|
||
rules := makeRBACRules(intentions, intentionDefaultAllow, localInfo, false, peerTrustBundles)
|
||
|
||
cfg := &envoy_network_rbac_v3.RBAC{
|
||
StatPrefix: "connect_authz",
|
||
Rules: rules,
|
||
}
|
||
return makeFilter("envoy.filters.network.rbac", cfg)
|
||
}
|
||
|
||
func makeRBACHTTPFilter(
|
||
intentions structs.Intentions,
|
||
intentionDefaultAllow bool,
|
||
localInfo rbacLocalInfo,
|
||
peerTrustBundles []*pbpeering.PeeringTrustBundle,
|
||
) (*envoy_http_v3.HttpFilter, error) {
|
||
rules := makeRBACRules(intentions, intentionDefaultAllow, localInfo, true, peerTrustBundles)
|
||
|
||
cfg := &envoy_http_rbac_v3.RBAC{
|
||
Rules: rules,
|
||
}
|
||
return makeEnvoyHTTPFilter("envoy.filters.http.rbac", cfg)
|
||
}
|
||
|
||
func intentionListToIntermediateRBACForm(
|
||
intentions structs.Intentions,
|
||
localInfo rbacLocalInfo,
|
||
isHTTP bool,
|
||
trustBundlesByPeer map[string]*pbpeering.PeeringTrustBundle,
|
||
) []*rbacIntention {
|
||
sort.Sort(structs.IntentionPrecedenceSorter(intentions))
|
||
|
||
// Omit any lower-precedence intentions that share the same source.
|
||
intentions = removeSameSourceIntentions(intentions)
|
||
|
||
rbacIxns := make([]*rbacIntention, 0, len(intentions))
|
||
for _, ixn := range intentions {
|
||
// trustBundle is only applicable to imported services
|
||
trustBundle, ok := trustBundlesByPeer[ixn.SourcePeer]
|
||
if ixn.SourcePeer != "" && !ok {
|
||
// If the intention defines a source peer, we expect to
|
||
// see a trust bundle. Otherwise the config snapshot may
|
||
// not have yet received the bundles and we fail silently
|
||
continue
|
||
}
|
||
|
||
rixn := intentionToIntermediateRBACForm(ixn, localInfo, isHTTP, trustBundle)
|
||
rbacIxns = append(rbacIxns, rixn)
|
||
}
|
||
return rbacIxns
|
||
}
|
||
|
||
func removeSourcePrecedence(rbacIxns []*rbacIntention, intentionDefaultAction intentionAction, localInfo rbacLocalInfo) []*rbacIntention {
|
||
if len(rbacIxns) == 0 {
|
||
return nil
|
||
}
|
||
|
||
// Remove source precedence:
|
||
//
|
||
// First walk backwards and add each intention to all subsequent statements
|
||
// (via AND NOT $x).
|
||
//
|
||
// If it is L4 and has the same action as the default intention action then
|
||
// mark the rule itself for erasure.
|
||
numRetained := 0
|
||
for i := len(rbacIxns) - 1; i >= 0; i-- {
|
||
for j := i + 1; j < len(rbacIxns); j++ {
|
||
if rbacIxns[j].Skip {
|
||
continue
|
||
}
|
||
// [i] is the intention candidate that we are distributing
|
||
// [j] is the thing to maybe NOT [i] from
|
||
if ixnSourceMatches(rbacIxns[i].Source, rbacIxns[j].Source) {
|
||
rbacIxns[j].NotSources = append(rbacIxns[j].NotSources, rbacIxns[i].Source)
|
||
}
|
||
}
|
||
if rbacIxns[i].Action == intentionDefaultAction {
|
||
// Lower precedence intentions that match the default intention
|
||
// action are skipped, since they're handled by the default
|
||
// catch-all.
|
||
rbacIxns[i].Skip = true // mark for deletion
|
||
} else {
|
||
numRetained++
|
||
}
|
||
}
|
||
// At this point precedence doesn't matter for the source element.
|
||
|
||
// Remove skipped intentions and also compute the final Principals for each
|
||
// intention.
|
||
out := make([]*rbacIntention, 0, numRetained)
|
||
for _, rixn := range rbacIxns {
|
||
if rixn.Skip {
|
||
continue
|
||
}
|
||
|
||
rixn.ComputedPrincipal = rixn.FlattenPrincipal(localInfo)
|
||
out = append(out, rixn)
|
||
}
|
||
|
||
return out
|
||
}
|
||
|
||
func removeIntentionPrecedence(rbacIxns []*rbacIntention, intentionDefaultAction intentionAction, localInfo rbacLocalInfo) []*rbacIntention {
|
||
// Remove source precedence. After this completes precedence doesn't matter
|
||
// between any two intentions.
|
||
rbacIxns = removeSourcePrecedence(rbacIxns, intentionDefaultAction, localInfo)
|
||
|
||
numRetained := 0
|
||
for _, rbacIxn := range rbacIxns {
|
||
// Remove permission precedence. After this completes precedence
|
||
// doesn't matter between any two permissions on this intention.
|
||
rbacIxn.Permissions = removePermissionPrecedence(rbacIxn.Permissions, intentionDefaultAction)
|
||
if rbacIxn.Action == intentionActionLayer7 && len(rbacIxn.Permissions) == 0 {
|
||
// All of the permissions must have had the default action type and
|
||
// were removed. Mark this for removal below.
|
||
rbacIxn.Skip = true
|
||
} else {
|
||
numRetained++
|
||
}
|
||
}
|
||
|
||
if numRetained == len(rbacIxns) {
|
||
return rbacIxns
|
||
}
|
||
|
||
// We previously used the absence of permissions (above) as a signal to
|
||
// mark the entire intention for removal. Now do the deletions.
|
||
out := make([]*rbacIntention, 0, numRetained)
|
||
for _, rixn := range rbacIxns {
|
||
if !rixn.Skip {
|
||
out = append(out, rixn)
|
||
}
|
||
}
|
||
|
||
return out
|
||
}
|
||
|
||
func removePermissionPrecedence(perms []*rbacPermission, intentionDefaultAction intentionAction) []*rbacPermission {
|
||
if len(perms) == 0 {
|
||
return nil
|
||
}
|
||
|
||
// First walk backwards and add each permission to all subsequent
|
||
// statements (via AND NOT $x).
|
||
//
|
||
// If it has the same action as the default intention action then mark the
|
||
// permission itself for erasure.
|
||
numRetained := 0
|
||
for i := len(perms) - 1; i >= 0; i-- {
|
||
for j := i + 1; j < len(perms); j++ {
|
||
if perms[j].Skip {
|
||
continue
|
||
}
|
||
// [i] is the permission candidate that we are distributing
|
||
// [j] is the thing to maybe NOT [i] from
|
||
perms[j].NotPerms = append(
|
||
perms[j].NotPerms,
|
||
perms[i].Perm,
|
||
)
|
||
}
|
||
if perms[i].Action == intentionDefaultAction {
|
||
// Lower precedence permissions that match the default intention
|
||
// action are skipped, since they're handled by the default
|
||
// catch-all.
|
||
perms[i].Skip = true // mark for deletion
|
||
} else {
|
||
numRetained++
|
||
}
|
||
}
|
||
|
||
// Remove skipped permissions and also compute the final Permissions for each item.
|
||
out := make([]*rbacPermission, 0, numRetained)
|
||
for _, perm := range perms {
|
||
if perm.Skip {
|
||
continue
|
||
}
|
||
|
||
perm.ComputedPermission = perm.Flatten()
|
||
out = append(out, perm)
|
||
}
|
||
|
||
return out
|
||
}
|
||
|
||
func intentionToIntermediateRBACForm(
|
||
ixn *structs.Intention,
|
||
localInfo rbacLocalInfo,
|
||
isHTTP bool,
|
||
bundle *pbpeering.PeeringTrustBundle,
|
||
) *rbacIntention {
|
||
rixn := &rbacIntention{
|
||
Source: rbacService{
|
||
ServiceName: ixn.SourceServiceName(),
|
||
Peer: ixn.SourcePeer,
|
||
TrustDomain: localInfo.trustDomain,
|
||
},
|
||
Precedence: ixn.Precedence,
|
||
}
|
||
|
||
// imported services will have addition metadata used to override SpiffeID creation
|
||
if bundle != nil {
|
||
rixn.Source.ExportedPartition = bundle.ExportedPartition
|
||
rixn.Source.TrustDomain = bundle.TrustDomain
|
||
}
|
||
|
||
if len(ixn.Permissions) > 0 {
|
||
if isHTTP {
|
||
rixn.Action = intentionActionLayer7
|
||
rixn.Permissions = make([]*rbacPermission, 0, len(ixn.Permissions))
|
||
for _, perm := range ixn.Permissions {
|
||
rixn.Permissions = append(rixn.Permissions, &rbacPermission{
|
||
Definition: perm,
|
||
Action: intentionActionFromString(perm.Action),
|
||
Perm: convertPermission(perm),
|
||
})
|
||
}
|
||
} else {
|
||
// In case L7 intentions slip through to here, treat them as deny intentions.
|
||
rixn.Action = intentionActionDeny
|
||
}
|
||
} else {
|
||
rixn.Action = intentionActionFromString(ixn.Action)
|
||
}
|
||
|
||
return rixn
|
||
}
|
||
|
||
type intentionAction int
|
||
|
||
const (
|
||
intentionActionDeny intentionAction = iota
|
||
intentionActionAllow
|
||
intentionActionLayer7
|
||
)
|
||
|
||
func intentionActionFromBool(v bool) intentionAction {
|
||
if v {
|
||
return intentionActionAllow
|
||
} else {
|
||
return intentionActionDeny
|
||
}
|
||
}
|
||
func intentionActionFromString(s structs.IntentionAction) intentionAction {
|
||
if s == structs.IntentionActionAllow {
|
||
return intentionActionAllow
|
||
}
|
||
return intentionActionDeny
|
||
}
|
||
|
||
type rbacService struct {
|
||
structs.ServiceName
|
||
|
||
// Peer, ExportedPartition, and TrustDomain are
|
||
// only applicable to imported services and are
|
||
// used to override SPIFFEID fields.
|
||
Peer string
|
||
ExportedPartition string
|
||
TrustDomain string
|
||
}
|
||
|
||
type rbacIntention struct {
|
||
Source rbacService
|
||
NotSources []rbacService
|
||
Action intentionAction
|
||
Permissions []*rbacPermission
|
||
Precedence int
|
||
|
||
// Skip is field used to indicate that this intention can be deleted in the
|
||
// final pass. Items marked as true should generally not escape the method
|
||
// that marked them.
|
||
Skip bool
|
||
|
||
ComputedPrincipal *envoy_rbac_v3.Principal
|
||
}
|
||
|
||
func (r *rbacIntention) FlattenPrincipal(localInfo rbacLocalInfo) *envoy_rbac_v3.Principal {
|
||
if !localInfo.expectXFCC {
|
||
return r.flattenPrincipalFromCert()
|
||
|
||
} else if r.Source.Peer == "" {
|
||
// NOTE: ixnSourceMatches should enforce that all of Source and NotSources
|
||
// are peered or not-peered, so we only need to look at the Source element.
|
||
return r.flattenPrincipalFromCert() // intention is not relevant to peering
|
||
}
|
||
|
||
// If this intention is an L7 peered one, then it is exclusively resolvable
|
||
// using XFCC, rather than the TLS SAN field.
|
||
fromXFCC := r.flattenPrincipalFromXFCC()
|
||
|
||
// Use of the XFCC one is gated on coming directly from our own gateways.
|
||
gwIDPattern := makeSpiffeMeshGatewayPattern(localInfo.trustDomain, localInfo.partition)
|
||
|
||
return andPrincipals([]*envoy_rbac_v3.Principal{
|
||
authenticatedPatternPrincipal(gwIDPattern),
|
||
fromXFCC,
|
||
})
|
||
}
|
||
|
||
func (r *rbacIntention) flattenPrincipalFromCert() *envoy_rbac_v3.Principal {
|
||
r.NotSources = simplifyNotSourceSlice(r.NotSources)
|
||
|
||
if len(r.NotSources) == 0 {
|
||
return idPrincipal(r.Source)
|
||
}
|
||
|
||
andIDs := make([]*envoy_rbac_v3.Principal, 0, len(r.NotSources)+1)
|
||
andIDs = append(andIDs, idPrincipal(r.Source))
|
||
for _, src := range r.NotSources {
|
||
andIDs = append(andIDs, notPrincipal(
|
||
idPrincipal(src),
|
||
))
|
||
}
|
||
return andPrincipals(andIDs)
|
||
}
|
||
|
||
func (r *rbacIntention) flattenPrincipalFromXFCC() *envoy_rbac_v3.Principal {
|
||
r.NotSources = simplifyNotSourceSlice(r.NotSources)
|
||
|
||
if len(r.NotSources) == 0 {
|
||
return xfccPrincipal(r.Source)
|
||
}
|
||
|
||
andIDs := make([]*envoy_rbac_v3.Principal, 0, len(r.NotSources)+1)
|
||
andIDs = append(andIDs, xfccPrincipal(r.Source))
|
||
for _, src := range r.NotSources {
|
||
andIDs = append(andIDs, notPrincipal(
|
||
xfccPrincipal(src),
|
||
))
|
||
}
|
||
return andPrincipals(andIDs)
|
||
}
|
||
|
||
type rbacPermission struct {
|
||
Definition *structs.IntentionPermission
|
||
|
||
Action intentionAction
|
||
Perm *envoy_rbac_v3.Permission
|
||
NotPerms []*envoy_rbac_v3.Permission
|
||
|
||
// Skip is field used to indicate that this permission can be deleted in
|
||
// the final pass. Items marked as true should generally not escape the
|
||
// method that marked them.
|
||
Skip bool
|
||
|
||
ComputedPermission *envoy_rbac_v3.Permission
|
||
}
|
||
|
||
func (p *rbacPermission) Flatten() *envoy_rbac_v3.Permission {
|
||
if len(p.NotPerms) == 0 {
|
||
return p.Perm
|
||
}
|
||
|
||
parts := make([]*envoy_rbac_v3.Permission, 0, len(p.NotPerms)+1)
|
||
parts = append(parts, p.Perm)
|
||
for _, notPerm := range p.NotPerms {
|
||
parts = append(parts, notPermission(notPerm))
|
||
}
|
||
return andPermissions(parts)
|
||
}
|
||
|
||
// simplifyNotSourceSlice will collapse NotSources elements together if any element is
|
||
// a subset of another.
|
||
// For example "default/web" is a subset of "default/*" because it is covered by the wildcard.
|
||
func simplifyNotSourceSlice(notSources []rbacService) []rbacService {
|
||
if len(notSources) <= 1 {
|
||
return notSources
|
||
}
|
||
|
||
// Sort, keeping the least wildcarded elements first.
|
||
// More specific elements have a higher precedence over more wildcarded elements.
|
||
sort.SliceStable(notSources, func(i, j int) bool {
|
||
return countWild(notSources[i]) < countWild(notSources[j])
|
||
})
|
||
|
||
keep := make([]rbacService, 0, len(notSources))
|
||
for i := 0; i < len(notSources); i++ {
|
||
si := notSources[i]
|
||
remove := false
|
||
for j := i + 1; j < len(notSources); j++ {
|
||
sj := notSources[j]
|
||
|
||
if ixnSourceMatches(si, sj) {
|
||
remove = true
|
||
break
|
||
}
|
||
}
|
||
if !remove {
|
||
keep = append(keep, si)
|
||
}
|
||
}
|
||
|
||
return keep
|
||
}
|
||
|
||
type rbacLocalInfo struct {
|
||
trustDomain string
|
||
datacenter string
|
||
partition string
|
||
expectXFCC bool
|
||
}
|
||
|
||
// makeRBACRules translates Consul intentions into RBAC Policies for Envoy.
|
||
//
|
||
// Consul lets you define up to 9 different kinds of intentions that apply at
|
||
// different levels of precedence (this is limited to 4 if not using Consul
|
||
// Enterprise). Each intention in this flat list (sorted by precedence) can either
|
||
// be an allow rule or a deny rule. Here’s a concrete example of this at work:
|
||
//
|
||
// intern/trusted-app => billing/payment-svc : ALLOW (prec=9)
|
||
// intern/* => billing/payment-svc : DENY (prec=8)
|
||
// */* => billing/payment-svc : ALLOW (prec=7)
|
||
// ::: ACL default policy ::: : DENY (prec=N/A)
|
||
//
|
||
// In contrast, Envoy lets you either configure a filter to be based on an
|
||
// allow-list or a deny-list based on the action attribute of the RBAC rules
|
||
// struct.
|
||
//
|
||
// On the surface it would seem that the configuration model of Consul
|
||
// intentions is incompatible with that of Envoy’s RBAC engine. For any given
|
||
// destination service Consul’s model requires evaluating a list of rules and
|
||
// short circuiting later rules once an earlier rule matches. After a rule is
|
||
// found to match then we decide if it is allow/deny. Envoy on the other hand
|
||
// requires the rules to express all conditions to allow access or all conditions
|
||
// to deny access.
|
||
//
|
||
// Despite the surface incompatibility it is possible to marry these two
|
||
// models. For clarity I’ll rewrite the earlier example intentions in an
|
||
// abbreviated form:
|
||
//
|
||
// A : ALLOW
|
||
// B : DENY
|
||
// C : ALLOW
|
||
// <default> : DENY
|
||
//
|
||
// 1. Given that the overall intention default is set to deny, we start by
|
||
// choosing to build an allow-list in Envoy (this is also the variant that I find
|
||
// easier to think about).
|
||
// 2. Next we traverse the list in precedence order (top down) and any DENY
|
||
// intentions are combined with later intentions using logical operations.
|
||
// 3. Now that all of the intentions result in the same action (allow) we have
|
||
// successfully removed precedence and we can express this in as a set of Envoy
|
||
// RBAC policies.
|
||
//
|
||
// After this the earlier A/B/C/default list becomes:
|
||
//
|
||
// A : ALLOW
|
||
// C AND NOT(B) : ALLOW
|
||
// <default> : DENY
|
||
//
|
||
// Which really is just an allow-list of [A, C AND NOT(B)]
|
||
func makeRBACRules(
|
||
intentions structs.Intentions,
|
||
intentionDefaultAllow bool,
|
||
localInfo rbacLocalInfo,
|
||
isHTTP bool,
|
||
peerTrustBundles []*pbpeering.PeeringTrustBundle,
|
||
) *envoy_rbac_v3.RBAC {
|
||
// TODO(banks,rb): Implement revocation list checking?
|
||
|
||
// TODO(peering): mkeeler asked that these maps come from proxycfg instead of
|
||
// being constructed in xds to save memory allocation and gc pressure. Low priority.
|
||
trustBundlesByPeer := make(map[string]*pbpeering.PeeringTrustBundle, len(peerTrustBundles))
|
||
for _, ptb := range peerTrustBundles {
|
||
trustBundlesByPeer[ptb.PeerName] = ptb
|
||
}
|
||
|
||
if isHTTP && len(peerTrustBundles) > 0 {
|
||
for _, ixn := range intentions {
|
||
if ixn.SourcePeer != "" {
|
||
localInfo.expectXFCC = true
|
||
break
|
||
}
|
||
}
|
||
}
|
||
|
||
// First build up just the basic principal matches.
|
||
rbacIxns := intentionListToIntermediateRBACForm(intentions, localInfo, isHTTP, trustBundlesByPeer)
|
||
|
||
// Normalize: if we are in default-deny then all intentions must be allows and vice versa
|
||
intentionDefaultAction := intentionActionFromBool(intentionDefaultAllow)
|
||
|
||
var rbacAction envoy_rbac_v3.RBAC_Action
|
||
if intentionDefaultAllow {
|
||
// The RBAC policies deny access to principals. The rest is allowed.
|
||
// This is block-list style access control.
|
||
rbacAction = envoy_rbac_v3.RBAC_DENY
|
||
} else {
|
||
// The RBAC policies grant access to principals. The rest is denied.
|
||
// This is safe-list style access control. This is the default type.
|
||
rbacAction = envoy_rbac_v3.RBAC_ALLOW
|
||
}
|
||
|
||
// Remove source and permissions precedence.
|
||
rbacIxns = removeIntentionPrecedence(rbacIxns, intentionDefaultAction, localInfo)
|
||
|
||
// For L4: we should generate one big Policy listing all Principals
|
||
// For L7: we should generate one Policy per Principal and list all of the Permissions
|
||
rbac := &envoy_rbac_v3.RBAC{
|
||
Action: rbacAction,
|
||
Policies: make(map[string]*envoy_rbac_v3.Policy),
|
||
}
|
||
|
||
var principalsL4 []*envoy_rbac_v3.Principal
|
||
for i, rbacIxn := range rbacIxns {
|
||
if rbacIxn.Action == intentionActionLayer7 {
|
||
if len(rbacIxn.Permissions) == 0 {
|
||
panic("invalid state: L7 intention has no permissions")
|
||
}
|
||
if !isHTTP {
|
||
panic("invalid state: L7 permissions present for TCP service")
|
||
}
|
||
|
||
// For L7: we should generate one Policy per Principal and list all of the Permissions
|
||
policy := &envoy_rbac_v3.Policy{
|
||
Principals: optimizePrincipals([]*envoy_rbac_v3.Principal{rbacIxn.ComputedPrincipal}),
|
||
Permissions: make([]*envoy_rbac_v3.Permission, 0, len(rbacIxn.Permissions)),
|
||
}
|
||
for _, perm := range rbacIxn.Permissions {
|
||
policy.Permissions = append(policy.Permissions, perm.ComputedPermission)
|
||
}
|
||
rbac.Policies[fmt.Sprintf("consul-intentions-layer7-%d", i)] = policy
|
||
} else {
|
||
// For L4: we should generate one big Policy listing all Principals
|
||
principalsL4 = append(principalsL4, rbacIxn.ComputedPrincipal)
|
||
}
|
||
}
|
||
if len(principalsL4) > 0 {
|
||
rbac.Policies["consul-intentions-layer4"] = &envoy_rbac_v3.Policy{
|
||
Principals: optimizePrincipals(principalsL4),
|
||
Permissions: []*envoy_rbac_v3.Permission{anyPermission()},
|
||
}
|
||
}
|
||
|
||
if len(rbac.Policies) == 0 {
|
||
rbac.Policies = nil
|
||
}
|
||
return rbac
|
||
}
|
||
|
||
func optimizePrincipals(orig []*envoy_rbac_v3.Principal) []*envoy_rbac_v3.Principal {
|
||
// If they are all ORs, then OR them together.
|
||
var orIds []*envoy_rbac_v3.Principal
|
||
for _, p := range orig {
|
||
or, ok := p.Identifier.(*envoy_rbac_v3.Principal_OrIds)
|
||
if !ok {
|
||
return orig
|
||
}
|
||
orIds = append(orIds, or.OrIds.Ids...)
|
||
}
|
||
|
||
return []*envoy_rbac_v3.Principal{orPrincipals(orIds)}
|
||
}
|
||
|
||
// removeSameSourceIntentions will iterate over intentions and remove any lower precedence
|
||
// intentions that share the same source. Intentions are sorted by descending precedence
|
||
// so once a source has been seen, additional intentions with the same source can be dropped.
|
||
//
|
||
// Example for the default/web service:
|
||
// input: [(backend/* -> default/web), (backend/* -> default/*)]
|
||
// output: [(backend/* -> default/web)]
|
||
//
|
||
// (backend/* -> default/*) was dropped because it is already known that any service
|
||
// in the backend namespace can target default/web.
|
||
func removeSameSourceIntentions(intentions structs.Intentions) structs.Intentions {
|
||
if len(intentions) < 2 {
|
||
return intentions
|
||
}
|
||
|
||
var (
|
||
out = make(structs.Intentions, 0, len(intentions))
|
||
changed = false
|
||
seenSource = make(map[structs.PeeredServiceName]struct{})
|
||
)
|
||
for _, ixn := range intentions {
|
||
psn := structs.PeeredServiceName{
|
||
ServiceName: ixn.SourceServiceName(),
|
||
Peer: ixn.SourcePeer,
|
||
}
|
||
if _, ok := seenSource[psn]; ok {
|
||
// A higher precedence intention already used this exact source
|
||
// definition with a different destination.
|
||
changed = true
|
||
continue
|
||
}
|
||
seenSource[psn] = struct{}{}
|
||
out = append(out, ixn)
|
||
}
|
||
|
||
if !changed {
|
||
return intentions
|
||
}
|
||
return out
|
||
}
|
||
|
||
// ixnSourceMatches determines if the 'tester' service name is matched by the
|
||
// 'against' service name via wildcard rules.
|
||
//
|
||
// For instance:
|
||
// - (web, api) => false, because these have no wildcards
|
||
// - (web, *) => true, because "all services" includes "web"
|
||
// - (default/web, default/*) => true, because "all services in the default NS" includes "default/web"
|
||
// - (default/*, */*) => true, "any service in any NS" includes "all services in the default NS"
|
||
// - (default/default/*, other/*/*) => false, "any service in "other" partition" does NOT include services in the default partition"
|
||
//
|
||
// Peer and partition must be exact names and cannot be compared with wildcards.
|
||
func ixnSourceMatches(tester, against rbacService) bool {
|
||
// We assume that we can't have the same intention twice before arriving
|
||
// here.
|
||
numWildTester := countWild(tester)
|
||
numWildAgainst := countWild(against)
|
||
|
||
if numWildTester == numWildAgainst {
|
||
return false
|
||
} else if numWildTester > numWildAgainst {
|
||
return false
|
||
}
|
||
|
||
matchesAP := tester.PartitionOrDefault() == against.PartitionOrDefault()
|
||
matchesPeer := tester.Peer == against.Peer
|
||
matchesNS := tester.NamespaceOrDefault() == against.NamespaceOrDefault() || against.NamespaceOrDefault() == structs.WildcardSpecifier
|
||
matchesName := tester.Name == against.Name || against.Name == structs.WildcardSpecifier
|
||
return matchesAP && matchesPeer && matchesNS && matchesName
|
||
}
|
||
|
||
// countWild counts the number of wildcard values in the given namespace and name.
|
||
func countWild(src rbacService) int {
|
||
// If Partition is wildcard, panic because it's not supported
|
||
if src.PartitionOrDefault() == structs.WildcardSpecifier {
|
||
panic("invalid state: intention references wildcard partition")
|
||
}
|
||
if src.Peer == structs.WildcardSpecifier {
|
||
panic("invalid state: intention references wildcard peer")
|
||
}
|
||
|
||
// If NS is wildcard, it must be 2 since wildcards only follow exact
|
||
if src.NamespaceOrDefault() == structs.WildcardSpecifier {
|
||
return 2
|
||
}
|
||
|
||
// Same reasoning as above, a wildcard can only follow an exact value
|
||
// and an exact value cannot follow a wildcard, so if name is a wildcard
|
||
// we must have exactly one.
|
||
if src.Name == structs.WildcardSpecifier {
|
||
return 1
|
||
}
|
||
|
||
return 0
|
||
}
|
||
|
||
func andPrincipals(ids []*envoy_rbac_v3.Principal) *envoy_rbac_v3.Principal {
|
||
return &envoy_rbac_v3.Principal{
|
||
Identifier: &envoy_rbac_v3.Principal_AndIds{
|
||
AndIds: &envoy_rbac_v3.Principal_Set{
|
||
Ids: ids,
|
||
},
|
||
},
|
||
}
|
||
}
|
||
|
||
func orPrincipals(ids []*envoy_rbac_v3.Principal) *envoy_rbac_v3.Principal {
|
||
return &envoy_rbac_v3.Principal{
|
||
Identifier: &envoy_rbac_v3.Principal_OrIds{
|
||
OrIds: &envoy_rbac_v3.Principal_Set{
|
||
Ids: ids,
|
||
},
|
||
},
|
||
}
|
||
}
|
||
|
||
func notPrincipal(id *envoy_rbac_v3.Principal) *envoy_rbac_v3.Principal {
|
||
return &envoy_rbac_v3.Principal{
|
||
Identifier: &envoy_rbac_v3.Principal_NotId{
|
||
NotId: id,
|
||
},
|
||
}
|
||
}
|
||
|
||
func idPrincipal(src rbacService) *envoy_rbac_v3.Principal {
|
||
pattern := makeSpiffePattern(src)
|
||
return authenticatedPatternPrincipal(pattern)
|
||
}
|
||
|
||
func authenticatedPatternPrincipal(pattern string) *envoy_rbac_v3.Principal {
|
||
return &envoy_rbac_v3.Principal{
|
||
Identifier: &envoy_rbac_v3.Principal_Authenticated_{
|
||
Authenticated: &envoy_rbac_v3.Principal_Authenticated{
|
||
PrincipalName: &envoy_matcher_v3.StringMatcher{
|
||
MatchPattern: &envoy_matcher_v3.StringMatcher_SafeRegex{
|
||
SafeRegex: makeEnvoyRegexMatch(pattern),
|
||
},
|
||
},
|
||
},
|
||
},
|
||
}
|
||
}
|
||
|
||
func xfccPrincipal(src rbacService) *envoy_rbac_v3.Principal {
|
||
// Same match we normally would use.
|
||
idPattern := makeSpiffePattern(src)
|
||
|
||
// Remove the leading ^ and trailing $.
|
||
idPattern = idPattern[1 : len(idPattern)-1]
|
||
|
||
// Anchor to the first XFCC component
|
||
pattern := `^[^,]+;URI=` + idPattern + `(?:,.*)?$`
|
||
|
||
// By=spiffe://8c7db6d3-e4ee-aa8c-488c-dbedd3772b78.consul/gateway/mesh/dc/dc2;
|
||
// Hash=2a2db78ac351a05854a0abd350631bf98cc0eb827d21f4ed5935ccd287779eb6;
|
||
// Cert="-----BEGIN%20CERTIFICATE-----<SNIP>";
|
||
// Chain="-----BEGIN%20CERTIFICATE-----<SNIP>";
|
||
// Subject="";
|
||
// URI=spiffe://5583c38e-c1c0-fd1e-2079-170bb2f396ad.consul/ns/default/dc/dc1/svc/pong,
|
||
|
||
return &envoy_rbac_v3.Principal{
|
||
Identifier: &envoy_rbac_v3.Principal_Header{
|
||
Header: &envoy_route_v3.HeaderMatcher{
|
||
Name: "x-forwarded-client-cert",
|
||
HeaderMatchSpecifier: &envoy_route_v3.HeaderMatcher_StringMatch{
|
||
StringMatch: &envoy_matcher_v3.StringMatcher{
|
||
MatchPattern: &envoy_matcher_v3.StringMatcher_SafeRegex{
|
||
SafeRegex: makeEnvoyRegexMatch(pattern),
|
||
},
|
||
},
|
||
},
|
||
},
|
||
},
|
||
}
|
||
}
|
||
|
||
const anyPath = `[^/]+`
|
||
const trustDomain = anyPath + "." + anyPath
|
||
|
||
// downstreamServiceIdentityMatcher needs to match XFCC headers in two cases:
|
||
// 1. Requests to cluster peered services through a mesh gateway. In this case, the XFCC header looks like the following (I added a new line after each ; for readability)
|
||
// By=spiffe://950df996-caef-ddef-ec5f-8d18a153b7b2.consul/gateway/mesh/dc/alpha;
|
||
// Hash=...;
|
||
// Cert=...;
|
||
// Chain=...;
|
||
// Subject="";
|
||
// URI=spiffe://c7e1d24a-eed8-10a3-286a-52bdb6b6a6fd.consul/ns/default/dc/primary/svc/s1,By=spiffe://950df996-caef-ddef-ec5f-8d18a153b7b2.consul/ns/default/dc/alpha/svc/s2;
|
||
// Hash=...;
|
||
// Cert=...;
|
||
// Chain=...;
|
||
// Subject="";
|
||
// URI=spiffe://950df996-caef-ddef-ec5f-8d18a153b7b2.consul/gateway/mesh/dc/alpha
|
||
//
|
||
// 2. Requests directly to another service
|
||
// By=spiffe://ae9dbea8-c1dd-7356-b211-c564f7917100.consul/ns/default/dc/primary/svc/s2;
|
||
// Hash=396218588ebc1655d32a49b68cedd6b66b9de7b3d69d0c0451bc5818132377d0;
|
||
// Cert=...;
|
||
// Chain=...;
|
||
// Subject="";
|
||
// URI=spiffe://ae9dbea8-c1dd-7356-b211-c564f7917100.consul/ns/default/dc/primary/svc/s1
|
||
//
|
||
// In either case, the regex matches the downstream service's spiffe id because mesh gateways use a different spiffe id format.
|
||
// Envoy requires us to include the trailing and leading .* to properly extract the properly submatch.
|
||
const downstreamServiceIdentityMatcher = ".*URI=spiffe://(" + trustDomain +
|
||
")(?:/ap/(" + anyPath +
|
||
"))?/ns/(" + anyPath +
|
||
")/dc/(" + anyPath +
|
||
")/svc/([^/;,]+).*"
|
||
|
||
func parseXFCCToDynamicMetaHTTPFilter() (*envoy_http_v3.HttpFilter, error) {
|
||
var rules []*envoy_http_header_to_meta_v3.Config_Rule
|
||
|
||
fields := []struct {
|
||
name string
|
||
sub string
|
||
}{
|
||
{
|
||
name: "trust-domain",
|
||
sub: `\1`,
|
||
},
|
||
{
|
||
name: "partition",
|
||
sub: `\2`,
|
||
},
|
||
{
|
||
name: "namespace",
|
||
sub: `\3`,
|
||
},
|
||
{
|
||
name: "datacenter",
|
||
sub: `\4`,
|
||
},
|
||
{
|
||
name: "service",
|
||
sub: `\5`,
|
||
},
|
||
}
|
||
|
||
for _, f := range fields {
|
||
rules = append(rules, &envoy_http_header_to_meta_v3.Config_Rule{
|
||
Header: "x-forwarded-client-cert",
|
||
OnHeaderPresent: &envoy_http_header_to_meta_v3.Config_KeyValuePair{
|
||
MetadataNamespace: "consul",
|
||
Key: f.name,
|
||
RegexValueRewrite: &envoy_matcher_v3.RegexMatchAndSubstitute{
|
||
Pattern: &envoy_matcher_v3.RegexMatcher{
|
||
Regex: downstreamServiceIdentityMatcher,
|
||
EngineType: &envoy_matcher_v3.RegexMatcher_GoogleRe2{
|
||
GoogleRe2: &envoy_matcher_v3.RegexMatcher_GoogleRE2{},
|
||
},
|
||
},
|
||
Substitution: f.sub,
|
||
},
|
||
},
|
||
})
|
||
}
|
||
|
||
cfg := &envoy_http_header_to_meta_v3.Config{RequestRules: rules}
|
||
|
||
return makeEnvoyHTTPFilter("envoy.filters.http.header_to_metadata", cfg)
|
||
}
|
||
|
||
func makeSpiffePattern(src rbacService) string {
|
||
var (
|
||
host = src.TrustDomain
|
||
ap = src.PartitionOrDefault()
|
||
ns = src.NamespaceOrDefault()
|
||
svc = src.Name
|
||
)
|
||
|
||
// Validate proper wildcarding
|
||
if ns == structs.WildcardSpecifier && svc != structs.WildcardSpecifier {
|
||
panic(fmt.Sprintf("not possible to have a wildcarded namespace %q but an exact service %q", ns, svc))
|
||
}
|
||
if ap == structs.WildcardSpecifier {
|
||
panic("not possible to have a wildcarded source partition")
|
||
}
|
||
if src.Peer == structs.WildcardSpecifier {
|
||
panic("not possible to have a wildcarded source peer")
|
||
}
|
||
|
||
// Match on any namespace or service if it is a wildcard, or on a specific value otherwise.
|
||
if ns == structs.WildcardSpecifier {
|
||
ns = anyPath
|
||
}
|
||
if svc == structs.WildcardSpecifier {
|
||
svc = anyPath
|
||
}
|
||
|
||
// If service is imported from a peer, the SpiffeID must
|
||
// refer to its remote partition and trust domain.
|
||
if src.Peer != "" {
|
||
ap = src.ExportedPartition
|
||
host = src.TrustDomain
|
||
}
|
||
|
||
id := connect.SpiffeIDService{
|
||
Namespace: ns,
|
||
Service: svc,
|
||
Host: host,
|
||
|
||
// Datacenter is not verified by RBAC, so we match on any value.
|
||
Datacenter: anyPath,
|
||
|
||
// Partition can only ever be an exact value.
|
||
Partition: ap,
|
||
}
|
||
|
||
return fmt.Sprintf(`^%s://%s%s$`, id.URI().Scheme, id.Host, id.URI().Path)
|
||
}
|
||
|
||
func makeSpiffeMeshGatewayPattern(gwTrustDomain, gwPartition string) string {
|
||
id := connect.SpiffeIDMeshGateway{
|
||
Host: gwTrustDomain,
|
||
Partition: gwPartition,
|
||
// Datacenter is not verified by RBAC, so we match on any value.
|
||
Datacenter: anyPath,
|
||
}
|
||
|
||
return fmt.Sprintf(`^%s://%s%s$`, id.URI().Scheme, id.Host, id.URI().Path)
|
||
}
|
||
|
||
func anyPermission() *envoy_rbac_v3.Permission {
|
||
return &envoy_rbac_v3.Permission{
|
||
Rule: &envoy_rbac_v3.Permission_Any{Any: true},
|
||
}
|
||
}
|
||
|
||
func convertPermission(perm *structs.IntentionPermission) *envoy_rbac_v3.Permission {
|
||
// NOTE: this does not do anything with perm.Action
|
||
if perm.HTTP == nil {
|
||
return anyPermission()
|
||
}
|
||
|
||
var parts []*envoy_rbac_v3.Permission
|
||
|
||
switch {
|
||
case perm.HTTP.PathExact != "":
|
||
parts = append(parts, &envoy_rbac_v3.Permission{
|
||
Rule: &envoy_rbac_v3.Permission_UrlPath{
|
||
UrlPath: &envoy_matcher_v3.PathMatcher{
|
||
Rule: &envoy_matcher_v3.PathMatcher_Path{
|
||
Path: &envoy_matcher_v3.StringMatcher{
|
||
MatchPattern: &envoy_matcher_v3.StringMatcher_Exact{
|
||
Exact: perm.HTTP.PathExact,
|
||
},
|
||
},
|
||
},
|
||
},
|
||
},
|
||
})
|
||
case perm.HTTP.PathPrefix != "":
|
||
parts = append(parts, &envoy_rbac_v3.Permission{
|
||
Rule: &envoy_rbac_v3.Permission_UrlPath{
|
||
UrlPath: &envoy_matcher_v3.PathMatcher{
|
||
Rule: &envoy_matcher_v3.PathMatcher_Path{
|
||
Path: &envoy_matcher_v3.StringMatcher{
|
||
MatchPattern: &envoy_matcher_v3.StringMatcher_Prefix{
|
||
Prefix: perm.HTTP.PathPrefix,
|
||
},
|
||
},
|
||
},
|
||
},
|
||
},
|
||
})
|
||
case perm.HTTP.PathRegex != "":
|
||
parts = append(parts, &envoy_rbac_v3.Permission{
|
||
Rule: &envoy_rbac_v3.Permission_UrlPath{
|
||
UrlPath: &envoy_matcher_v3.PathMatcher{
|
||
Rule: &envoy_matcher_v3.PathMatcher_Path{
|
||
Path: &envoy_matcher_v3.StringMatcher{
|
||
MatchPattern: &envoy_matcher_v3.StringMatcher_SafeRegex{
|
||
SafeRegex: makeEnvoyRegexMatch(perm.HTTP.PathRegex),
|
||
},
|
||
},
|
||
},
|
||
},
|
||
},
|
||
})
|
||
}
|
||
|
||
for _, hdr := range perm.HTTP.Header {
|
||
eh := &envoy_route_v3.HeaderMatcher{
|
||
Name: hdr.Name,
|
||
}
|
||
|
||
switch {
|
||
case hdr.Exact != "":
|
||
eh.HeaderMatchSpecifier = &envoy_route_v3.HeaderMatcher_ExactMatch{
|
||
ExactMatch: hdr.Exact,
|
||
}
|
||
case hdr.Regex != "":
|
||
eh.HeaderMatchSpecifier = &envoy_route_v3.HeaderMatcher_SafeRegexMatch{
|
||
SafeRegexMatch: makeEnvoyRegexMatch(hdr.Regex),
|
||
}
|
||
case hdr.Prefix != "":
|
||
eh.HeaderMatchSpecifier = &envoy_route_v3.HeaderMatcher_PrefixMatch{
|
||
PrefixMatch: hdr.Prefix,
|
||
}
|
||
case hdr.Suffix != "":
|
||
eh.HeaderMatchSpecifier = &envoy_route_v3.HeaderMatcher_SuffixMatch{
|
||
SuffixMatch: hdr.Suffix,
|
||
}
|
||
case hdr.Present:
|
||
eh.HeaderMatchSpecifier = &envoy_route_v3.HeaderMatcher_PresentMatch{
|
||
PresentMatch: true,
|
||
}
|
||
default:
|
||
continue // skip this impossible situation
|
||
}
|
||
|
||
if hdr.Invert {
|
||
eh.InvertMatch = true
|
||
}
|
||
|
||
parts = append(parts, &envoy_rbac_v3.Permission{
|
||
Rule: &envoy_rbac_v3.Permission_Header{
|
||
Header: eh,
|
||
},
|
||
})
|
||
}
|
||
|
||
if len(perm.HTTP.Methods) > 0 {
|
||
methodHeaderRegex := strings.Join(perm.HTTP.Methods, "|")
|
||
|
||
eh := &envoy_route_v3.HeaderMatcher{
|
||
Name: ":method",
|
||
HeaderMatchSpecifier: &envoy_route_v3.HeaderMatcher_SafeRegexMatch{
|
||
SafeRegexMatch: makeEnvoyRegexMatch(methodHeaderRegex),
|
||
},
|
||
}
|
||
|
||
parts = append(parts, &envoy_rbac_v3.Permission{
|
||
Rule: &envoy_rbac_v3.Permission_Header{
|
||
Header: eh,
|
||
},
|
||
})
|
||
}
|
||
|
||
// NOTE: if for some reason we errantly allow a permission to be defined
|
||
// with a body of "http{}" then we'll end up treating that like "ANY" here.
|
||
return andPermissions(parts)
|
||
}
|
||
|
||
func notPermission(perm *envoy_rbac_v3.Permission) *envoy_rbac_v3.Permission {
|
||
return &envoy_rbac_v3.Permission{
|
||
Rule: &envoy_rbac_v3.Permission_NotRule{NotRule: perm},
|
||
}
|
||
}
|
||
|
||
func andPermissions(perms []*envoy_rbac_v3.Permission) *envoy_rbac_v3.Permission {
|
||
switch len(perms) {
|
||
case 0:
|
||
return anyPermission()
|
||
case 1:
|
||
return perms[0]
|
||
default:
|
||
return &envoy_rbac_v3.Permission{
|
||
Rule: &envoy_rbac_v3.Permission_AndRules{
|
||
AndRules: &envoy_rbac_v3.Permission_Set{
|
||
Rules: perms,
|
||
},
|
||
},
|
||
}
|
||
}
|
||
}
|