Skip to content

rbac: add matched policy name in response code detail for RBAC filter#12912

Merged
alyssawilk merged 18 commits intoenvoyproxy:masterfrom
yangminzhu:rbac-flag
Sep 23, 2020
Merged

rbac: add matched policy name in response code detail for RBAC filter#12912
alyssawilk merged 18 commits intoenvoyproxy:masterfrom
yangminzhu:rbac-flag

Conversation

@yangminzhu
Copy link
Copy Markdown
Contributor

@yangminzhu yangminzhu commented Sep 1, 2020

Commit Message: This patch adds the matched policy name in the response code detail for request denied by the RBAC filter.

Risk Level: Low
Testing: Added e2e tests and also tested manually
Docs Changes: Updated
Release Notes: Updated
Fixes #12873.
Signed-off-by: Yangmin Zhu ymzhu@google.com

@repokitteh-read-only
Copy link
Copy Markdown

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/envoy/.
CC @envoyproxy/api-watchers: FYI only for changes made to api/envoy/.

🐱

Caused by: #12912 was opened by yangminzhu.

see: more, trace.

@yangminzhu
Copy link
Copy Markdown
Contributor Author

Signed-off-by: Yangmin Zhu <ymzhu@google.com>
Signed-off-by: Yangmin Zhu <ymzhu@google.com>
@snowp snowp assigned dio Sep 2, 2020
Signed-off-by: Yangmin Zhu <ymzhu@google.com>
@yangminzhu
Copy link
Copy Markdown
Contributor Author

@dio @alyssawilk would you mind to take a look at this PR? thanks.

Copy link
Copy Markdown
Contributor

@alyssawilk alyssawilk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks great! Just a few requests and you should be good to go

Signed-off-by: Yangmin Zhu <ymzhu@google.com>
@alyssawilk alyssawilk self-assigned this Sep 9, 2020
Copy link
Copy Markdown
Contributor

@alyssawilk alyssawilk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good once you do that one rename. @dio can you do a pass as well?

Signed-off-by: Yangmin Zhu <ymzhu@google.com>
Signed-off-by: Yangmin Zhu <ymzhu@google.com>
@yangminzhu
Copy link
Copy Markdown
Contributor Author

@dio @htuch could you take a look? thanks.

Copy link
Copy Markdown
Member

@dio dio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, was drowned by internal stuff. Looks good. A couple of comments.

Signed-off-by: Yangmin Zhu <ymzhu@google.com>
Signed-off-by: Yangmin Zhu <ymzhu@google.com>
Signed-off-by: Yangmin Zhu <ymzhu@google.com>
Signed-off-by: Yangmin Zhu <ymzhu@google.com>
Signed-off-by: Yangmin Zhu <ymzhu@google.com>
@yangminzhu yangminzhu changed the title rbac: set response flag and detail for request denied by RBAC filter rbac: add matched policy name in response code detail for RBAC filter Sep 22, 2020
Signed-off-by: Yangmin Zhu <ymzhu@google.com>
Signed-off-by: Yangmin Zhu <ymzhu@google.com>
@yangminzhu
Copy link
Copy Markdown
Contributor Author

sorry I force pushed the last 2 commits to fix the DCO issue, @dio Could you take a look again, I reverted the API change, thanks.

Copy link
Copy Markdown
Member

@dio dio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Just one small nit. Thanks!

Signed-off-by: Yangmin Zhu <ymzhu@google.com>
if (engine_result_ == Allow) {
return Network::FilterStatus::Continue;
} else if (engine_result_ == Deny) {
callbacks_->connection().streamInfo().setResponseCodeDetails(
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry I missed this earlier (I was focused on the filters/http part) but I don't think setting responseCodeDetails on the network filter makes sense per se. Response code details is an HTTP / L7 construct. Unfortunately I don't think there is a network (L4) equivalent for downstream. It might make more sense to add one than reuse the HTTP field.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

okay I reverted the change in the network filter, I feel we really should have a network equivalent, or maybe have a general RESPONSE_DETAILS so that it can be used in both L4 and L7?

Signed-off-by: Yangmin Zhu <ymzhu@google.com>
Signed-off-by: Yangmin Zhu <ymzhu@google.com>
@alyssawilk
Copy link
Copy Markdown
Contributor

LGTM! @dio any final thoughts?

Copy link
Copy Markdown
Member

@dio dio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! Thanks!

@alyssawilk alyssawilk merged commit d0b8177 into envoyproxy:master Sep 23, 2020
@yangminzhu yangminzhu deleted the rbac-flag branch September 29, 2020 00:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Rbac: Disambiguate between rbac 403 and application 403

6 participants