Skip to content

Commit 23be716

Browse files
zhaohuabingzhaohuabing
committed
check redirect respose filter
Signed-off-by: Huabing Zhao <[email protected]>
1 parent f7a0e10 commit 23be716

8 files changed

+113
-110
lines changed

‎internal/gatewayapi/filters.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ type HTTPFilterIR struct {
7070
var HeaderValueRegexp = regexp.MustCompile(`^[!-~]+([\t ]?[!-~]+)*$`)
7171

7272
const requestMirrorDirectResponseConflictMsg = "RequestMirror filter cannot be used when the rule also configures a DirectResponse filter"
73+
const requestMirrorRedirectConflictMsg = "RequestMirror filter cannot be used when the rule also configures a RequestRedirect filter"
7374

7475
// ProcessHTTPFilters translates gateway api http filters to IRs.
7576
func (t *Translator) ProcessHTTPFilters(parentRef *RouteParentContext,
@@ -116,9 +117,13 @@ func (t *Translator) ProcessHTTPFilters(parentRef *RouteParentContext,
116117
}
117118
}
118119

120+
// Check for conflicts between RequestMirror and DirectResponse or RequestRedirect filters
119121
if httpFiltersContext.DirectResponse != nil && len(httpFiltersContext.Mirrors) > 0 {
120122
updateRouteStatusForFilter(httpFiltersContext, requestMirrorDirectResponseConflictMsg)
121123
}
124+
if httpFiltersContext.RedirectResponse != nil && len(httpFiltersContext.Mirrors) > 0 {
125+
updateRouteStatusForFilter(httpFiltersContext, requestMirrorRedirectConflictMsg)
126+
}
122127

123128
return httpFiltersContext, err
124129
}

‎internal/gatewayapi/testdata/httproute-with-mirror-filter-direct-response.in.yaml‎ renamed to ‎internal/gatewayapi/testdata/httproute-with-conflicting-filters.in.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,34 @@ httpRoutes:
4747
group: gateway.envoyproxy.io
4848
kind: HTTPRouteFilter
4949
name: mirror-direct-response
50+
- apiVersion: gateway.networking.k8s.io/v1
51+
kind: HTTPRoute
52+
metadata:
53+
namespace: default
54+
name: mirror-request-redirect
55+
spec:
56+
hostnames:
57+
- gateway.envoyproxy.io
58+
parentRefs:
59+
- namespace: envoy-gateway
60+
name: gateway-1
61+
sectionName: http
62+
rules:
63+
- matches:
64+
- path:
65+
type: PathPrefix
66+
value: /mirror-redirect
67+
filters:
68+
- type: RequestMirror
69+
requestMirror:
70+
backendRef:
71+
kind: Service
72+
name: service-1
73+
port: 8080
74+
- type: RequestRedirect
75+
requestRedirect:
76+
scheme: https
77+
statusCode: 302
5078
httpFilters:
5179
- apiVersion: gateway.envoyproxy.io/v1alpha1
5280
kind: HTTPRouteFilter

‎internal/gatewayapi/testdata/httproute-with-mirror-filter-direct-response.out.yaml‎ renamed to ‎internal/gatewayapi/testdata/httproute-with-conflicting-filters.out.yaml‎

Lines changed: 48 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ gateways:
1616
protocol: HTTP
1717
status:
1818
listeners:
19-
- attachedRoutes: 1
19+
- attachedRoutes: 2
2020
conditions:
2121
- lastTransitionTime: null
2222
message: Sending translated listener configuration to the data plane
@@ -91,6 +91,53 @@ httpRoutes:
9191
name: gateway-1
9292
namespace: envoy-gateway
9393
sectionName: http
94+
- apiVersion: gateway.networking.k8s.io/v1
95+
kind: HTTPRoute
96+
metadata:
97+
name: mirror-request-redirect
98+
namespace: default
99+
spec:
100+
hostnames:
101+
- gateway.envoyproxy.io
102+
parentRefs:
103+
- name: gateway-1
104+
namespace: envoy-gateway
105+
sectionName: http
106+
rules:
107+
- filters:
108+
- requestMirror:
109+
backendRef:
110+
kind: Service
111+
name: service-1
112+
port: 8080
113+
type: RequestMirror
114+
- requestRedirect:
115+
scheme: https
116+
statusCode: 302
117+
type: RequestRedirect
118+
matches:
119+
- path:
120+
type: PathPrefix
121+
value: /mirror-redirect
122+
status:
123+
parents:
124+
- conditions:
125+
- lastTransitionTime: null
126+
message: RequestMirror filter cannot be used when the rule also configures
127+
a RequestRedirect filter
128+
reason: UnsupportedValue
129+
status: "False"
130+
type: Accepted
131+
- lastTransitionTime: null
132+
message: Resolved all the Object references for the Route
133+
reason: ResolvedRefs
134+
status: "True"
135+
type: ResolvedRefs
136+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
137+
parentRef:
138+
name: gateway-1
139+
namespace: envoy-gateway
140+
sectionName: http
94141
infraIR:
95142
envoy-gateway/gateway-1:
96143
proxy:

‎internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,8 @@ securityPolicies:
173173
sectionName: http
174174
conditions:
175175
- lastTransitionTime: null
176-
message: 'OIDC: secret default/client2-secret does not exist.'
176+
message: 'OIDC: Get "https://accounts.google.com/.well-known/openid-configuration":
177+
context deadline exceeded (Client.Timeout exceeded while awaiting headers).'
177178
reason: Invalid
178179
status: "False"
179180
type: Accepted
@@ -216,7 +217,8 @@ securityPolicies:
216217
namespace: envoy-gateway
217218
conditions:
218219
- lastTransitionTime: null
219-
message: 'OIDC: secret envoy-gateway/client1-secret does not exist.'
220+
message: 'OIDC: Get "https://accounts.google.com/.well-known/openid-configuration":
221+
context deadline exceeded (Client.Timeout exceeded while awaiting headers).'
220222
reason: Invalid
221223
status: "False"
222224
type: Accepted

‎internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies-samesite.out.yaml‎

Lines changed: 7 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -132,9 +132,10 @@ securityPolicies:
132132
namespace: envoy-gateway
133133
conditions:
134134
- lastTransitionTime: null
135-
message: Policy has been accepted.
136-
reason: Accepted
137-
status: "True"
135+
message: 'OIDC: Get "https://accounts.google.com/.well-known/openid-configuration":
136+
context deadline exceeded (Client.Timeout exceeded while awaiting headers).'
137+
reason: Invalid
138+
status: "False"
138139
type: Accepted
139140
controllerName: gateway.envoyproxy.io/gatewayclass-controller
140141
xdsIR:
@@ -196,6 +197,8 @@ xdsIR:
196197
name: httproute/default/httproute-1/rule/0/backend/0
197198
protocol: HTTP
198199
weight: 1
200+
directResponse:
201+
statusCode: 500
199202
hostname: www.example.com
200203
isHTTP2: false
201204
metadata:
@@ -207,27 +210,7 @@ xdsIR:
207210
distinct: false
208211
name: ""
209212
prefix: /foo
210-
security:
211-
oidc:
212-
clientID: client1.apps.googleusercontent.com
213-
clientSecret: '[redacted]'
214-
cookieConfig:
215-
sameSite: None
216-
cookieNameOverrides:
217-
accessToken: CustomAccessTokenCookie
218-
idToken: CustomIdTokenCookie
219-
cookieSuffix: b0a1b740
220-
hmacSecret: '[redacted]'
221-
logoutPath: /bar/logout
222-
name: securitypolicy/envoy-gateway/policy-for-gateway
223-
provider:
224-
authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
225-
tokenEndpoint: https://oauth2.googleapis.com/token
226-
redirectPath: /bar/oauth2/callback
227-
redirectURL: https://www.example.com/bar/oauth2/callback
228-
refreshToken: true
229-
scopes:
230-
- openid
213+
security: {}
231214
readyListener:
232215
address: 0.0.0.0
233216
ipFamily: IPv4

‎internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies.out.yaml‎

Lines changed: 7 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -130,9 +130,10 @@ securityPolicies:
130130
namespace: envoy-gateway
131131
conditions:
132132
- lastTransitionTime: null
133-
message: Policy has been accepted.
134-
reason: Accepted
135-
status: "True"
133+
message: 'OIDC: Get "https://accounts.google.com/.well-known/openid-configuration":
134+
context deadline exceeded (Client.Timeout exceeded while awaiting headers).'
135+
reason: Invalid
136+
status: "False"
136137
type: Accepted
137138
controllerName: gateway.envoyproxy.io/gatewayclass-controller
138139
xdsIR:
@@ -194,6 +195,8 @@ xdsIR:
194195
name: httproute/default/httproute-1/rule/0/backend/0
195196
protocol: HTTP
196197
weight: 1
198+
directResponse:
199+
statusCode: 500
197200
hostname: www.example.com
198201
isHTTP2: false
199202
metadata:
@@ -205,25 +208,7 @@ xdsIR:
205208
distinct: false
206209
name: ""
207210
prefix: /foo
208-
security:
209-
oidc:
210-
clientID: client1.apps.googleusercontent.com
211-
clientSecret: '[redacted]'
212-
cookieNameOverrides:
213-
accessToken: CustomAccessTokenCookie
214-
idToken: CustomIdTokenCookie
215-
cookieSuffix: b0a1b740
216-
hmacSecret: '[redacted]'
217-
logoutPath: /bar/logout
218-
name: securitypolicy/envoy-gateway/policy-for-gateway
219-
provider:
220-
authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
221-
tokenEndpoint: https://oauth2.googleapis.com/token
222-
redirectPath: /bar/oauth2/callback
223-
redirectURL: https://www.example.com/bar/oauth2/callback
224-
refreshToken: true
225-
scopes:
226-
- openid
211+
security: {}
227212
readyListener:
228213
address: 0.0.0.0
229214
ipFamily: IPv4

‎internal/gatewayapi/testdata/securitypolicy-with-oidc-deny-redirect.out.yaml‎

Lines changed: 7 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -146,9 +146,10 @@ securityPolicies:
146146
namespace: envoy-gateway
147147
conditions:
148148
- lastTransitionTime: null
149-
message: Policy has been accepted.
150-
reason: Accepted
151-
status: "True"
149+
message: 'OIDC: Get "https://accounts.google.com/.well-known/openid-configuration":
150+
context deadline exceeded (Client.Timeout exceeded while awaiting headers).'
151+
reason: Invalid
152+
status: "False"
152153
type: Accepted
153154
controllerName: gateway.envoyproxy.io/gatewayclass-controller
154155
xdsIR:
@@ -210,6 +211,8 @@ xdsIR:
210211
name: httproute/default/httproute-1/rule/0/backend/0
211212
protocol: HTTP
212213
weight: 1
214+
directResponse:
215+
statusCode: 500
213216
hostname: www.example.com
214217
isHTTP2: false
215218
metadata:
@@ -221,41 +224,7 @@ xdsIR:
221224
distinct: false
222225
name: ""
223226
prefix: /foo
224-
security:
225-
oidc:
226-
clientID: client1.apps.googleusercontent.com
227-
clientSecret: '[redacted]'
228-
cookieNameOverrides:
229-
accessToken: CustomAccessTokenCookie
230-
idToken: CustomIdTokenCookie
231-
cookieSuffix: b0a1b740
232-
denyRedirect:
233-
headers:
234-
- name: :path
235-
type: Prefix
236-
value: /api
237-
- name: X-No-Redirect
238-
type: RegularExpression
239-
value: .*
240-
- name: X-No-Redirect
241-
type: Exact
242-
value: foobar
243-
- name: :path
244-
type: Suffix
245-
value: bar
246-
- name: test-5
247-
value: bar
248-
hmacSecret: '[redacted]'
249-
logoutPath: /bar/logout
250-
name: securitypolicy/envoy-gateway/policy-for-gateway
251-
provider:
252-
authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
253-
tokenEndpoint: https://oauth2.googleapis.com/token
254-
redirectPath: /bar/oauth2/callback
255-
redirectURL: https://www.example.com/bar/oauth2/callback
256-
refreshToken: true
257-
scopes:
258-
- openid
227+
security: {}
259228
readyListener:
260229
address: 0.0.0.0
261230
ipFamily: IPv4

‎internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml‎

Lines changed: 7 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -222,9 +222,10 @@ securityPolicies:
222222
namespace: envoy-gateway
223223
conditions:
224224
- lastTransitionTime: null
225-
message: Policy has been accepted.
226-
reason: Accepted
227-
status: "True"
225+
message: 'OIDC: Get "https://accounts.google.com/.well-known/openid-configuration":
226+
context deadline exceeded (Client.Timeout exceeded while awaiting headers).'
227+
reason: Invalid
228+
status: "False"
228229
type: Accepted
229230
- lastTransitionTime: null
230231
message: 'This policy is being overridden by other securityPolicies for these
@@ -346,6 +347,8 @@ xdsIR:
346347
name: httproute/default/httproute-2/rule/0/backend/0
347348
protocol: HTTP
348349
weight: 1
350+
directResponse:
351+
statusCode: 500
349352
hostname: www.example.com
350353
isHTTP2: false
351354
metadata:
@@ -357,26 +360,7 @@ xdsIR:
357360
distinct: false
358361
name: ""
359362
prefix: /bar
360-
security:
361-
oidc:
362-
clientID: client1.apps.googleusercontent.com
363-
clientSecret: '[redacted]'
364-
cookieSuffix: b0a1b740
365-
csrfTokenTTL: 35m0s
366-
defaultRefreshTokenTTL: 24h0m0s
367-
defaultTokenTTL: 30m0s
368-
forwardAccessToken: true
369-
hmacSecret: '[redacted]'
370-
logoutPath: /bar/logout
371-
name: securitypolicy/envoy-gateway/policy-for-gateway
372-
provider:
373-
authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
374-
tokenEndpoint: https://oauth2.googleapis.com/token
375-
redirectPath: /bar/oauth2/callback
376-
redirectURL: https://www.example.com/bar/oauth2/callback
377-
refreshToken: true
378-
scopes:
379-
- openid
363+
security: {}
380364
readyListener:
381365
address: 0.0.0.0
382366
ipFamily: IPv4

0 commit comments

Comments
 (0)