From 5d4e345e5d74e33d26ec9484517637d99406b246 Mon Sep 17 00:00:00 2001 From: Caleb Doxsey Date: Fri, 26 May 2023 14:46:34 -0600 Subject: [PATCH 1/2] authorize: fix IsInternal check --- authorize/grpc.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/authorize/grpc.go b/authorize/grpc.go index e5851881975..d18cc365486 100644 --- a/authorize/grpc.go +++ b/authorize/grpc.go @@ -11,6 +11,7 @@ import ( "github.com/pomerium/pomerium/authorize/evaluator" "github.com/pomerium/pomerium/config" + "github.com/pomerium/pomerium/config/envoyconfig" "github.com/pomerium/pomerium/internal/log" "github.com/pomerium/pomerium/internal/sessions" "github.com/pomerium/pomerium/internal/telemetry/requestid" @@ -93,6 +94,7 @@ func (a *Authorize) getEvaluatorRequestFromCheckRequest( ) (*evaluator.Request, error) { requestURL := getCheckRequestURL(in) req := &evaluator.Request{ + IsInternal: envoyconfig.ExtAuthzContextExtensionsIsInternal(in.GetAttributes().GetContextExtensions()), HTTP: evaluator.NewRequestHTTP( in.GetAttributes().GetRequest().GetHttp().GetMethod(), requestURL, @@ -106,15 +108,16 @@ func (a *Authorize) getEvaluatorRequestFromCheckRequest( ID: sessionState.ID, } } - req.Policy = a.getMatchingPolicy(requestURL) + req.Policy = a.getMatchingPolicy(envoyconfig.ExtAuthzContextExtensionsRouteID(in.Attributes.GetContextExtensions())) return req, nil } -func (a *Authorize) getMatchingPolicy(requestURL url.URL) *config.Policy { +func (a *Authorize) getMatchingPolicy(routeID uint64) *config.Policy { options := a.currentOptions.Load() for _, p := range options.GetAllPolicies() { - if p.Matches(requestURL) { + id, _ := p.RouteID() + if id == routeID { return &p } } From 08cfc3bed1925971a294c28ce4a4c99e4868ceb5 Mon Sep 17 00:00:00 2001 From: Caleb Doxsey Date: Fri, 26 May 2023 14:55:17 -0600 Subject: [PATCH 2/2] fix lint --- authorize/evaluator/evaluator.go | 6 ------ config/envoyconfig/listeners.go | 33 ++++++++++---------------------- 2 files changed, 10 insertions(+), 29 deletions(-) diff --git a/authorize/evaluator/evaluator.go b/authorize/evaluator/evaluator.go index 605502b6bbe..e217cfe17e7 100644 --- a/authorize/evaluator/evaluator.go +++ b/authorize/evaluator/evaluator.go @@ -22,12 +22,6 @@ import ( "github.com/pomerium/pomerium/pkg/policy/criteria" ) -// notFoundOutput is what's returned if a route isn't found for a policy. -var notFoundOutput = &Result{ - Deny: NewRuleResult(true, criteria.ReasonRouteNotFound), - Headers: make(http.Header), -} - // Request contains the inputs needed for evaluation. type Request struct { IsInternal bool diff --git a/config/envoyconfig/listeners.go b/config/envoyconfig/listeners.go index d5b4aa2ccf8..7438fa5209f 100644 --- a/config/envoyconfig/listeners.go +++ b/config/envoyconfig/listeners.go @@ -11,11 +11,9 @@ import ( envoy_config_core_v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" envoy_config_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3" envoy_config_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3" - envoy_extensions_filters_http_ext_authz_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3" envoy_http_connection_manager "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3" envoy_extensions_transport_sockets_tls_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3" envoy_type_v3 "github.com/envoyproxy/go-control-plane/envoy/type/v3" - "github.com/golang/protobuf/ptypes/any" "github.com/golang/protobuf/ptypes/wrappers" "google.golang.org/protobuf/types/known/durationpb" "google.golang.org/protobuf/types/known/wrapperspb" @@ -31,27 +29,16 @@ import ( const listenerBufferLimit uint32 = 32 * 1024 -var ( - disableExtAuthz *any.Any - tlsParams = &envoy_extensions_transport_sockets_tls_v3.TlsParameters{ - CipherSuites: []string{ - "ECDHE-ECDSA-AES256-GCM-SHA384", - "ECDHE-RSA-AES256-GCM-SHA384", - "ECDHE-ECDSA-AES128-GCM-SHA256", - "ECDHE-RSA-AES128-GCM-SHA256", - "ECDHE-ECDSA-CHACHA20-POLY1305", - "ECDHE-RSA-CHACHA20-POLY1305", - }, - TlsMinimumProtocolVersion: envoy_extensions_transport_sockets_tls_v3.TlsParameters_TLSv1_2, - } -) - -func init() { - disableExtAuthz = marshalAny(&envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute{ - Override: &envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute_Disabled{ - Disabled: true, - }, - }) +var tlsParams = &envoy_extensions_transport_sockets_tls_v3.TlsParameters{ + CipherSuites: []string{ + "ECDHE-ECDSA-AES256-GCM-SHA384", + "ECDHE-RSA-AES256-GCM-SHA384", + "ECDHE-ECDSA-AES128-GCM-SHA256", + "ECDHE-RSA-AES128-GCM-SHA256", + "ECDHE-ECDSA-CHACHA20-POLY1305", + "ECDHE-RSA-CHACHA20-POLY1305", + }, + TlsMinimumProtocolVersion: envoy_extensions_transport_sockets_tls_v3.TlsParameters_TLSv1_2, } // BuildListeners builds envoy listeners from the given config.