Add authorize Monitor connection elements. #1333

anastasia-malysheva · 2022-07-27T12:02:42Z

…Server chain element. Add options to enable mointor authorize element. Add unit tests. Turn off authorize monitor by default in the network service chain.

Signed-off-by: anastasia.malysheva anastasia.malysheva@xored.com

Description

Issue link

#46

How Has This Been Tested?

Added unit testing to cover
Tested manually
Tested by integration testing
Have not tested

Types of changes

…Server chain element. Add options to enable mointor authorize element. Add unit tests. Turn off authorize monitor by default in the network service chain. Signed-off-by: anastasia.malysheva <anastasia.malysheva@xored.com>

denis-tingaikin · 2022-07-27T17:32:06Z

pkg/networkservice/chains/nsmgrproxy/server.go

@@ -117,6 +119,16 @@ func WithAuthorizeServer(authorizeServer networkservice.NetworkServiceServer) Op
 	}
 }

+// WithAuthorizeMonitorServer sets authorization MonitorConnectionServer chain element
+func WithAuthorizeMonitorServer(authorizeMonitorServer networkservice.MonitorConnectionServer) Option {


Please apply for other places

Suggested change

func WithAuthorizeMonitorServer(authorizeMonitorServer networkservice.MonitorConnectionServer) Option {

func WithAuthorizeMonitorConnectionServer(authorizeMonitorServer networkservice.MonitorConnectionServer) Option {

denis-tingaikin · 2022-07-27T17:34:13Z

pkg/tools/monitorconnection/authorize/server.go

+	for _, v := range in.PathSegments {
+		seg = append(seg, v.GetId())
+	}


Please check only previous segment.

denis-tingaikin · 2022-07-27T17:36:10Z

pkg/tools/opa/policies/service_connection.rego

+   conn_ids := [y | y = input.spiffe_id_connection_map[input.service_spiffe_id][_]]
+   count(input.path_segments) > 0
+   count(conn_ids) > 0
+   conn_ids == input.path_segments
+}


Please note: the client is always previous segment. Please check only previous id.

Signed-off-by: anastasia.malysheva <anastasia.malysheva@xored.com>

denis-tingaikin · 2022-07-28T09:30:54Z

pkg/tools/opa/opainput.go

@@ -55,7 +54,8 @@ func pemEncodingX509Cert(cert *x509.Certificate) string {
 	return string(certpem)
 }

-func parseX509Cert(authInfo credentials.AuthInfo) *x509.Certificate {
+// ParseX509Cert - parses x509 certificate from the passed credentials.AuthInfo
+func ParseX509Cert(authInfo credentials.AuthInfo) *x509.Certificate {


Can be private

I use this method in other package.

denis-tingaikin · 2022-07-28T10:11:18Z

pkg/networkservice/common/authorize/server.go

+			ids = &spire.ConnectionIDSet{}
+		}
+		var placer struct{}
+		ids.Store(connID, placer)


Suggested change

ids.Store(connID, placer)

ids.Store(connID, struct{}{})

Signed-off-by: anastasia.malysheva <anastasia.malysheva@xored.com>

denis-tingaikin · 2022-07-28T11:56:01Z

pkg/tools/monitorconnection/next/tail_client.go

@@ -0,0 +1,36 @@
+// Copyright (c) 2022 Cisco and/or its affiliates.


this file can be removed

Signed-off-by: anastasia.malysheva <anastasia.malysheva@xored.com>

…k@main PR link: networkservicemesh/sdk#1333 Commit: 990b341 Author: anastasia-malysheva Date: 2022-07-28 19:53:47 +0700 Message: - Add authorize Monitor connection elements. (#1333) * Add authorize Monitor connection elements. Add next monitorConnectionServer chain element. Add options to enable mointor authorize element. Add unit tests. Turn off authorize monitor by default in the network service chain. Signed-off-by: anastasia.malysheva <anastasia.malysheva@xored.com> * rename options Signed-off-by: anastasia.malysheva <anastasia.malysheva@xored.com> * update auth monitor police Signed-off-by: anastasia.malysheva <anastasia.malysheva@xored.com> * update auth monitor police Signed-off-by: NSMBot <nsmbot@networkservicmesh.io>

anastasia-malysheva requested a review from denis-tingaikin July 27, 2022 12:02

denis-tingaikin reviewed Jul 27, 2022

View reviewed changes

rename options

b13cf2a

Signed-off-by: anastasia.malysheva <anastasia.malysheva@xored.com>

denis-tingaikin reviewed Jul 28, 2022

View reviewed changes

update auth monitor police

88aac29

Signed-off-by: anastasia.malysheva <anastasia.malysheva@xored.com>

denis-tingaikin reviewed Jul 28, 2022

View reviewed changes

update auth monitor police

8226867

Signed-off-by: anastasia.malysheva <anastasia.malysheva@xored.com>

denis-tingaikin approved these changes Jul 28, 2022

View reviewed changes

denis-tingaikin merged commit 990b341 into networkservicemesh:main Jul 28, 2022

nsmbot mentioned this pull request Jul 29, 2022

Update from update/networkservicemesh/sdk networkservicemesh/cmd-registry-proxy-dns#521

Merged

denis-tingaikin mentioned this pull request Aug 1, 2022

Add Auth MonitorConnections chain elements #1317

Closed

13 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add authorize Monitor connection elements. #1333

Add authorize Monitor connection elements. #1333

anastasia-malysheva commented Jul 27, 2022 •

edited

Loading

denis-tingaikin Jul 27, 2022

denis-tingaikin Jul 27, 2022

denis-tingaikin Jul 27, 2022

anastasia-malysheva Jul 28, 2022

denis-tingaikin Jul 28, 2022

anastasia-malysheva Jul 28, 2022

denis-tingaikin Jul 28, 2022

anastasia-malysheva Jul 28, 2022

denis-tingaikin Jul 28, 2022

anastasia-malysheva Jul 28, 2022

	func WithAuthorizeMonitorServer(authorizeMonitorServer networkservice.MonitorConnectionServer) Option {
	func WithAuthorizeMonitorConnectionServer(authorizeMonitorServer networkservice.MonitorConnectionServer) Option {

		@@ -0,0 +1,36 @@
		// Copyright (c) 2022 Cisco and/or its affiliates.

Add authorize Monitor connection elements. #1333

Add authorize Monitor connection elements. #1333

Conversation

anastasia-malysheva commented Jul 27, 2022 • edited Loading

Description

Issue link

How Has This Been Tested?

Types of changes

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

anastasia-malysheva commented Jul 27, 2022 •

edited

Loading