mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-28 18:06:34 +02:00
Merge pull request from GHSA-pvrc-wvj2-f59p
* authorize: use route id from envoy for policy evaluation * authorize: normalize URL query params * config: enable envoy normalize_path option --------- Co-authored-by: Kenneth Jenkins <51246568+kenjenkins@users.noreply.github.com>
This commit is contained in:
Caleb Doxsey
GitHub
parent
d115774007
commit
5491f99d78
12 changed files with 594 additions and 313 deletions
|
|
@ -30,9 +30,10 @@ var notFoundOutput = &Result{
|
|||
|
||||
// Request contains the inputs needed for evaluation.
|
||||
type Request struct {
|
||||
Policy *config.Policy
|
||||
HTTP RequestHTTP
|
||||
Session RequestSession
|
||||
IsInternal bool
|
||||
Policy *config.Policy
|
||||
HTTP RequestHTTP
|
||||
Session RequestSession
|
||||
}
|
||||
|
||||
// RequestHTTP is the HTTP field in the request.
|
||||
|
|
@ -123,8 +124,60 @@ func (e *Evaluator) Evaluate(ctx context.Context, req *Request) (*Result, error)
|
|||
ctx, span := trace.StartSpan(ctx, "authorize.Evaluator.Evaluate")
|
||||
defer span.End()
|
||||
|
||||
eg, ctx := errgroup.WithContext(ctx)
|
||||
|
||||
var policyOutput *PolicyResponse
|
||||
eg.Go(func() error {
|
||||
var err error
|
||||
if req.IsInternal {
|
||||
policyOutput, err = e.evaluateInternal(ctx, req)
|
||||
} else {
|
||||
policyOutput, err = e.evaluatePolicy(ctx, req)
|
||||
}
|
||||
return err
|
||||
})
|
||||
|
||||
var headersOutput *HeadersResponse
|
||||
eg.Go(func() error {
|
||||
var err error
|
||||
headersOutput, err = e.evaluateHeaders(ctx, req)
|
||||
return err
|
||||
})
|
||||
|
||||
err := eg.Wait()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
res := &Result{
|
||||
Allow: policyOutput.Allow,
|
||||
Deny: policyOutput.Deny,
|
||||
Headers: headersOutput.Headers,
|
||||
Traces: policyOutput.Traces,
|
||||
}
|
||||
return res, nil
|
||||
}
|
||||
|
||||
func (e *Evaluator) evaluateInternal(_ context.Context, req *Request) (*PolicyResponse, error) {
|
||||
// these endpoints require a logged-in user
|
||||
if req.HTTP.Path == "/.pomerium/webauthn" || req.HTTP.Path == "/.pomerium/jwt" {
|
||||
if req.Session.ID == "" {
|
||||
return &PolicyResponse{
|
||||
Allow: NewRuleResult(false, criteria.ReasonUserUnauthenticated),
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
return &PolicyResponse{
|
||||
Allow: NewRuleResult(true, criteria.ReasonPomeriumRoute),
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (e *Evaluator) evaluatePolicy(ctx context.Context, req *Request) (*PolicyResponse, error) {
|
||||
if req.Policy == nil {
|
||||
return notFoundOutput, nil
|
||||
return &PolicyResponse{
|
||||
Deny: NewRuleResult(true, criteria.ReasonRouteNotFound),
|
||||
}, nil
|
||||
}
|
||||
|
||||
id, err := req.Policy.RouteID()
|
||||
|
|
@ -134,54 +187,37 @@ func (e *Evaluator) Evaluate(ctx context.Context, req *Request) (*Result, error)
|
|||
|
||||
policyEvaluator, ok := e.policyEvaluators[id]
|
||||
if !ok {
|
||||
return notFoundOutput, nil
|
||||
return &PolicyResponse{
|
||||
Deny: NewRuleResult(true, criteria.ReasonRouteNotFound),
|
||||
}, nil
|
||||
}
|
||||
|
||||
clientCA, err := e.getClientCA(req.Policy)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
isValidClientCertificate, err := isValidClientCertificate(clientCA, req.HTTP.ClientCertificate)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("authorize: error validating client certificate: %w", err)
|
||||
}
|
||||
|
||||
eg, ectx := errgroup.WithContext(ctx)
|
||||
|
||||
var policyOutput *PolicyResponse
|
||||
eg.Go(func() error {
|
||||
var err error
|
||||
policyOutput, err = policyEvaluator.Evaluate(ectx, &PolicyRequest{
|
||||
HTTP: req.HTTP,
|
||||
Session: req.Session,
|
||||
IsValidClientCertificate: isValidClientCertificate,
|
||||
})
|
||||
return err
|
||||
return policyEvaluator.Evaluate(ctx, &PolicyRequest{
|
||||
HTTP: req.HTTP,
|
||||
Session: req.Session,
|
||||
IsValidClientCertificate: isValidClientCertificate,
|
||||
})
|
||||
}
|
||||
|
||||
var headersOutput *HeadersResponse
|
||||
eg.Go(func() error {
|
||||
headersReq := NewHeadersRequestFromPolicy(req.Policy)
|
||||
headersReq.Session = req.Session
|
||||
var err error
|
||||
headersOutput, err = e.headersEvaluators.Evaluate(ectx, headersReq)
|
||||
return err
|
||||
})
|
||||
|
||||
err = eg.Wait()
|
||||
func (e *Evaluator) evaluateHeaders(ctx context.Context, req *Request) (*HeadersResponse, error) {
|
||||
headersReq := NewHeadersRequestFromPolicy(req.Policy)
|
||||
headersReq.Session = req.Session
|
||||
res, err := e.headersEvaluators.Evaluate(ctx, headersReq)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
carryOverJWTAssertion(headersOutput.Headers, req.HTTP.Headers)
|
||||
carryOverJWTAssertion(res.Headers, req.HTTP.Headers)
|
||||
|
||||
res := &Result{
|
||||
Allow: policyOutput.Allow,
|
||||
Deny: policyOutput.Deny,
|
||||
Headers: headersOutput.Headers,
|
||||
Traces: policyOutput.Traces,
|
||||
}
|
||||
return res, nil
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -31,18 +31,20 @@ type HeadersRequest struct {
|
|||
// NewHeadersRequestFromPolicy creates a new HeadersRequest from a policy.
|
||||
func NewHeadersRequestFromPolicy(policy *config.Policy) *HeadersRequest {
|
||||
input := new(HeadersRequest)
|
||||
input.EnableGoogleCloudServerlessAuthentication = policy.EnableGoogleCloudServerlessAuthentication
|
||||
input.EnableRoutingKey = policy.EnvoyOpts.GetLbPolicy() == envoy_config_cluster_v3.Cluster_RING_HASH ||
|
||||
policy.EnvoyOpts.GetLbPolicy() == envoy_config_cluster_v3.Cluster_MAGLEV
|
||||
if u, err := urlutil.ParseAndValidateURL(policy.From); err == nil {
|
||||
input.Issuer = u.Hostname()
|
||||
if policy != nil {
|
||||
input.EnableGoogleCloudServerlessAuthentication = policy.EnableGoogleCloudServerlessAuthentication
|
||||
input.EnableRoutingKey = policy.EnvoyOpts.GetLbPolicy() == envoy_config_cluster_v3.Cluster_RING_HASH ||
|
||||
policy.EnvoyOpts.GetLbPolicy() == envoy_config_cluster_v3.Cluster_MAGLEV
|
||||
if u, err := urlutil.ParseAndValidateURL(policy.From); err == nil {
|
||||
input.Issuer = u.Hostname()
|
||||
}
|
||||
input.KubernetesServiceAccountToken = policy.KubernetesServiceAccountToken
|
||||
for _, wu := range policy.To {
|
||||
input.ToAudience = "https://" + wu.URL.Hostname()
|
||||
}
|
||||
input.PassAccessToken = policy.GetSetAuthorizationHeader() == configpb.Route_ACCESS_TOKEN
|
||||
input.PassIDToken = policy.GetSetAuthorizationHeader() == configpb.Route_ID_TOKEN
|
||||
}
|
||||
input.KubernetesServiceAccountToken = policy.KubernetesServiceAccountToken
|
||||
for _, wu := range policy.To {
|
||||
input.ToAudience = "https://" + wu.URL.Hostname()
|
||||
}
|
||||
input.PassAccessToken = policy.GetSetAuthorizationHeader() == configpb.Route_ACCESS_TOKEN
|
||||
input.PassIDToken = policy.GetSetAuthorizationHeader() == configpb.Route_ID_TOKEN
|
||||
return input
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -110,7 +110,7 @@ func TestPolicyEvaluator(t *testing.T) {
|
|||
})
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, &PolicyResponse{
|
||||
Allow: NewRuleResult(false, criteria.ReasonEmailUnauthorized, criteria.ReasonNonPomeriumRoute, criteria.ReasonUserUnauthorized),
|
||||
Allow: NewRuleResult(false, criteria.ReasonEmailUnauthorized, criteria.ReasonUserUnauthorized),
|
||||
Deny: NewRuleResult(false, criteria.ReasonValidClientCertificateOrNoneRequired),
|
||||
Traces: []contextutil.PolicyEvaluationTrace{{}},
|
||||
}, output)
|
||||
|
|
@ -171,7 +171,7 @@ func TestPolicyEvaluator(t *testing.T) {
|
|||
})
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, &PolicyResponse{
|
||||
Allow: NewRuleResult(false, criteria.ReasonNonPomeriumRoute),
|
||||
Allow: NewRuleResult(false),
|
||||
Deny: NewRuleResult(true, criteria.ReasonAccept),
|
||||
Traces: []contextutil.PolicyEvaluationTrace{{}, {ID: "p1", Deny: true}},
|
||||
}, output)
|
||||
|
|
@ -202,7 +202,7 @@ func TestPolicyEvaluator(t *testing.T) {
|
|||
})
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, &PolicyResponse{
|
||||
Allow: NewRuleResult(false, criteria.ReasonNonPomeriumRoute),
|
||||
Allow: NewRuleResult(false),
|
||||
Deny: NewRuleResult(true, criteria.ReasonAccept, criteria.ReasonInvalidClientCertificate),
|
||||
Traces: []contextutil.PolicyEvaluationTrace{{Deny: true}, {ID: "p1", Deny: true}},
|
||||
}, output)
|
||||
|
|
@ -288,7 +288,7 @@ func TestPolicyEvaluator(t *testing.T) {
|
|||
})
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, &PolicyResponse{
|
||||
Allow: NewRuleResult(false, criteria.ReasonNonPomeriumRoute, criteria.ReasonUserUnauthenticated),
|
||||
Allow: NewRuleResult(false, criteria.ReasonUserUnauthenticated),
|
||||
Deny: NewRuleResult(false, criteria.ReasonValidClientCertificateOrNoneRequired),
|
||||
Traces: []contextutil.PolicyEvaluationTrace{{Allow: false}},
|
||||
}, output)
|
||||
|
|
|
|||
|
|
@ -159,6 +159,7 @@ func getCheckRequestURL(req *envoy_service_auth_v3.CheckRequest) url.URL {
|
|||
path := h.GetPath()
|
||||
if idx := strings.Index(path, "?"); idx != -1 {
|
||||
u.RawPath, u.RawQuery = path[:idx], path[idx+1:]
|
||||
u.RawQuery = u.Query().Encode()
|
||||
} else {
|
||||
u.RawPath = path
|
||||
}
|
||||
|
|
|
|||
|
|
@ -350,6 +350,7 @@ func (b *Builder) buildMainHTTPConnectionManagerFilter(
|
|||
SkipXffAppend: options.SkipXffAppend,
|
||||
XffNumTrustedHops: options.XffNumTrustedHops,
|
||||
LocalReplyConfig: b.buildLocalReplyConfig(options, requireStrictTransportSecurity),
|
||||
NormalizePath: wrapperspb.Bool(true),
|
||||
}), nil
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -216,6 +216,7 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
}
|
||||
}
|
||||
],
|
||||
"normalizePath": true,
|
||||
"requestTimeout": "30s",
|
||||
"routeConfig": {
|
||||
"name": "main",
|
||||
|
|
@ -245,24 +246,6 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
}
|
||||
}],
|
||||
"routes": [
|
||||
{
|
||||
"name": "pomerium-path-/.pomerium/jwt",
|
||||
"match": {
|
||||
"path": "/.pomerium/jwt"
|
||||
},
|
||||
"route": {
|
||||
"cluster": "pomerium-control-plane-http"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "pomerium-path-/.pomerium/webauthn",
|
||||
"match": {
|
||||
"path": "/.pomerium/webauthn"
|
||||
},
|
||||
"route": {
|
||||
"cluster": "pomerium-control-plane-http"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "pomerium-path-/ping",
|
||||
"match": {
|
||||
|
|
@ -274,7 +257,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -289,7 +277,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -304,7 +297,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -319,7 +317,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -334,7 +337,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -349,7 +357,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -364,7 +377,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -379,7 +397,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -394,7 +417,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -425,24 +453,6 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
}
|
||||
}],
|
||||
"routes": [
|
||||
{
|
||||
"name": "pomerium-path-/.pomerium/jwt",
|
||||
"match": {
|
||||
"path": "/.pomerium/jwt"
|
||||
},
|
||||
"route": {
|
||||
"cluster": "pomerium-control-plane-http"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "pomerium-path-/.pomerium/webauthn",
|
||||
"match": {
|
||||
"path": "/.pomerium/webauthn"
|
||||
},
|
||||
"route": {
|
||||
"cluster": "pomerium-control-plane-http"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "pomerium-path-/ping",
|
||||
"match": {
|
||||
|
|
@ -454,7 +464,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -469,7 +484,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -484,7 +504,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -499,7 +524,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -514,7 +544,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -529,7 +564,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -544,7 +584,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -559,7 +604,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -574,7 +624,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -605,24 +660,6 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
}
|
||||
}],
|
||||
"routes": [
|
||||
{
|
||||
"name": "pomerium-path-/.pomerium/jwt",
|
||||
"match": {
|
||||
"path": "/.pomerium/jwt"
|
||||
},
|
||||
"route": {
|
||||
"cluster": "pomerium-control-plane-http"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "pomerium-path-/.pomerium/webauthn",
|
||||
"match": {
|
||||
"path": "/.pomerium/webauthn"
|
||||
},
|
||||
"route": {
|
||||
"cluster": "pomerium-control-plane-http"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "pomerium-path-/ping",
|
||||
"match": {
|
||||
|
|
@ -634,7 +671,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -649,7 +691,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -664,7 +711,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -679,7 +731,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -694,7 +751,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -709,7 +771,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -724,7 +791,12 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
53
config/envoyconfig/per_filter_config.go
Normal file
53
config/envoyconfig/per_filter_config.go
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
package envoyconfig
|
||||
|
||||
import (
|
||||
"strconv"
|
||||
|
||||
envoy_extensions_filters_http_ext_authz_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3"
|
||||
"github.com/golang/protobuf/ptypes/any"
|
||||
)
|
||||
|
||||
// PerFilterConfigExtAuthzName is the name of the ext authz filter to apply config to
|
||||
const PerFilterConfigExtAuthzName = "envoy.filters.http.ext_authz"
|
||||
|
||||
// PerFilterConfigExtAuthzContextExtensions returns a per-filter config for ext authz that disables ext-authz.
|
||||
func PerFilterConfigExtAuthzContextExtensions(authzContextExtensions map[string]string) *any.Any {
|
||||
return marshalAny(&envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute{
|
||||
Override: &envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute_CheckSettings{
|
||||
CheckSettings: &envoy_extensions_filters_http_ext_authz_v3.CheckSettings{
|
||||
ContextExtensions: authzContextExtensions,
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
// PerFilterConfigExtAuthzDisabled returns a per-filter config for ext authz that disables ext-authz.
|
||||
func PerFilterConfigExtAuthzDisabled() *any.Any {
|
||||
return marshalAny(&envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute{
|
||||
Override: &envoy_extensions_filters_http_ext_authz_v3.ExtAuthzPerRoute_Disabled{
|
||||
Disabled: true,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
// MakeExtAuthzContextExtensions makes the ext authz context extensions.
|
||||
func MakeExtAuthzContextExtensions(internal bool, routeID uint64) map[string]string {
|
||||
return map[string]string{
|
||||
"internal": strconv.FormatBool(internal),
|
||||
"route_id": strconv.FormatUint(routeID, 10),
|
||||
}
|
||||
}
|
||||
|
||||
// ExtAuthzContextExtensionsIsInternal returns true if the context extensions indicates the route is internal.
|
||||
func ExtAuthzContextExtensionsIsInternal(extAuthzContextExtensions map[string]string) bool {
|
||||
return extAuthzContextExtensions != nil && extAuthzContextExtensions["internal"] == "true"
|
||||
}
|
||||
|
||||
// ExtAuthzContextExtensionsRouteID returns the route id for the context extensions.
|
||||
func ExtAuthzContextExtensionsRouteID(extAuthzContextExtensions map[string]string) uint64 {
|
||||
if extAuthzContextExtensions == nil {
|
||||
return 0
|
||||
}
|
||||
routeID, _ := strconv.ParseUint(extAuthzContextExtensions["route_id"], 10, 64)
|
||||
return routeID
|
||||
}
|
||||
|
|
@ -42,7 +42,7 @@ func (b *Builder) buildGRPCRoutes() ([]*envoy_config_route_v3.Route, error) {
|
|||
},
|
||||
Action: action,
|
||||
TypedPerFilterConfig: map[string]*any.Any{
|
||||
"envoy.filters.http.ext_authz": disableExtAuthz,
|
||||
PerFilterConfigExtAuthzName: PerFilterConfigExtAuthzDisabled(),
|
||||
},
|
||||
}}, nil
|
||||
}
|
||||
|
|
@ -58,20 +58,16 @@ func (b *Builder) buildPomeriumHTTPRoutes(options *config.Options, host string)
|
|||
}
|
||||
if !isFrontingAuthenticate {
|
||||
routes = append(routes,
|
||||
// enable ext_authz
|
||||
b.buildControlPlanePathRoute("/.pomerium/jwt", true),
|
||||
b.buildControlPlanePathRoute(urlutil.WebAuthnURLPath, true),
|
||||
// disable ext_authz and passthrough to proxy handlers
|
||||
b.buildControlPlanePathRoute("/ping", false),
|
||||
b.buildControlPlanePathRoute("/healthz", false),
|
||||
b.buildControlPlanePathRoute("/.pomerium", false),
|
||||
b.buildControlPlanePrefixRoute("/.pomerium/", false),
|
||||
b.buildControlPlanePathRoute("/.well-known/pomerium", false),
|
||||
b.buildControlPlanePrefixRoute("/.well-known/pomerium/", false),
|
||||
b.buildControlPlanePathRoute("/ping"),
|
||||
b.buildControlPlanePathRoute("/healthz"),
|
||||
b.buildControlPlanePathRoute("/.pomerium"),
|
||||
b.buildControlPlanePrefixRoute("/.pomerium/"),
|
||||
b.buildControlPlanePathRoute("/.well-known/pomerium"),
|
||||
b.buildControlPlanePrefixRoute("/.well-known/pomerium/"),
|
||||
)
|
||||
// per #837, only add robots.txt if there are no unauthenticated routes
|
||||
if !hasPublicPolicyMatchingURL(options, url.URL{Scheme: "https", Host: host, Path: "/robots.txt"}) {
|
||||
routes = append(routes, b.buildControlPlanePathRoute("/robots.txt", false))
|
||||
routes = append(routes, b.buildControlPlanePathRoute("/robots.txt"))
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -98,15 +94,15 @@ func (b *Builder) buildPomeriumAuthenticateHTTPRoutes(options *config.Options, h
|
|||
}
|
||||
if urlMatchesHost(u, host) {
|
||||
return []*envoy_config_route_v3.Route{
|
||||
b.buildControlPlanePathRoute(options.AuthenticateCallbackPath, false),
|
||||
b.buildControlPlanePathRoute("/", false),
|
||||
b.buildControlPlanePathRoute(options.AuthenticateCallbackPath),
|
||||
b.buildControlPlanePathRoute("/"),
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
func (b *Builder) buildControlPlanePathRoute(path string, protected bool) *envoy_config_route_v3.Route {
|
||||
func (b *Builder) buildControlPlanePathRoute(path string) *envoy_config_route_v3.Route {
|
||||
r := &envoy_config_route_v3.Route{
|
||||
Name: "pomerium-path-" + path,
|
||||
Match: &envoy_config_route_v3.RouteMatch{
|
||||
|
|
@ -119,16 +115,14 @@ func (b *Builder) buildControlPlanePathRoute(path string, protected bool) *envoy
|
|||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
if !protected {
|
||||
r.TypedPerFilterConfig = map[string]*any.Any{
|
||||
"envoy.filters.http.ext_authz": disableExtAuthz,
|
||||
}
|
||||
TypedPerFilterConfig: map[string]*any.Any{
|
||||
PerFilterConfigExtAuthzName: PerFilterConfigExtAuthzContextExtensions(MakeExtAuthzContextExtensions(true, 0)),
|
||||
},
|
||||
}
|
||||
return r
|
||||
}
|
||||
|
||||
func (b *Builder) buildControlPlanePrefixRoute(prefix string, protected bool) *envoy_config_route_v3.Route {
|
||||
func (b *Builder) buildControlPlanePrefixRoute(prefix string) *envoy_config_route_v3.Route {
|
||||
r := &envoy_config_route_v3.Route{
|
||||
Name: "pomerium-prefix-" + prefix,
|
||||
Match: &envoy_config_route_v3.RouteMatch{
|
||||
|
|
@ -141,11 +135,9 @@ func (b *Builder) buildControlPlanePrefixRoute(prefix string, protected bool) *e
|
|||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
if !protected {
|
||||
r.TypedPerFilterConfig = map[string]*any.Any{
|
||||
"envoy.filters.http.ext_authz": disableExtAuthz,
|
||||
}
|
||||
TypedPerFilterConfig: map[string]*any.Any{
|
||||
PerFilterConfigExtAuthzName: PerFilterConfigExtAuthzContextExtensions(MakeExtAuthzContextExtensions(true, 0)),
|
||||
},
|
||||
}
|
||||
return r
|
||||
}
|
||||
|
|
@ -178,6 +170,11 @@ func (b *Builder) buildPolicyRoutes(options *config.Options, host string) ([]*en
|
|||
continue
|
||||
}
|
||||
|
||||
routeID, err := policy.RouteID()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
match := mkRouteMatch(&policy)
|
||||
envoyRoute := &envoy_config_route_v3.Route{
|
||||
Name: fmt.Sprintf("policy-%d", i),
|
||||
|
|
@ -212,9 +209,12 @@ func (b *Builder) buildPolicyRoutes(options *config.Options, host string) ([]*en
|
|||
}
|
||||
if isFrontingAuthenticate {
|
||||
envoyRoute.TypedPerFilterConfig = map[string]*any.Any{
|
||||
"envoy.filters.http.ext_authz": disableExtAuthz,
|
||||
PerFilterConfigExtAuthzName: PerFilterConfigExtAuthzDisabled(),
|
||||
}
|
||||
} else {
|
||||
envoyRoute.TypedPerFilterConfig = map[string]*any.Any{
|
||||
PerFilterConfigExtAuthzName: PerFilterConfigExtAuthzContextExtensions(MakeExtAuthzContextExtensions(false, routeID)),
|
||||
}
|
||||
luaMetadata["remove_pomerium_cookie"] = &structpb.Value{
|
||||
Kind: &structpb.Value_StringValue{
|
||||
StringValue: options.CookieName,
|
||||
|
|
@ -233,8 +233,7 @@ func (b *Builder) buildPolicyRoutes(options *config.Options, host string) ([]*en
|
|||
}
|
||||
|
||||
if policy.IsForKubernetes() {
|
||||
policyID, _ := policy.RouteID()
|
||||
for _, hdr := range b.reproxy.GetPolicyIDHeaders(policyID) {
|
||||
for _, hdr := range b.reproxy.GetPolicyIDHeaders(routeID) {
|
||||
envoyRoute.RequestHeadersToAdd = append(envoyRoute.RequestHeadersToAdd,
|
||||
&envoy_config_core_v3.HeaderValueOption{
|
||||
Header: &envoy_config_core_v3.HeaderValue{
|
||||
|
|
|
|||
|
|
@ -16,7 +16,6 @@ import (
|
|||
"github.com/pomerium/pomerium/config"
|
||||
"github.com/pomerium/pomerium/config/envoyconfig/filemgr"
|
||||
"github.com/pomerium/pomerium/internal/testutil"
|
||||
"github.com/pomerium/pomerium/internal/urlutil"
|
||||
)
|
||||
|
||||
func policyNameFunc() func(*config.Policy) string {
|
||||
|
|
@ -55,27 +54,27 @@ func Test_buildGRPCRoutes(t *testing.T) {
|
|||
|
||||
func Test_buildPomeriumHTTPRoutes(t *testing.T) {
|
||||
b := &Builder{filemgr: filemgr.NewManager()}
|
||||
routeString := func(typ, name string, protected bool) string {
|
||||
routeString := func(typ, name string) string {
|
||||
str := `{
|
||||
"name": "pomerium-` + typ + `-` + name + `",
|
||||
"match": {
|
||||
"` + typ + `": "` + name + `"
|
||||
},
|
||||
"route": {
|
||||
"cluster": "pomerium-control-plane-http"
|
||||
}
|
||||
`
|
||||
if !protected {
|
||||
str += `,
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"name": "pomerium-` + typ + `-` + name + `",
|
||||
"match": {
|
||||
"` + typ + `": "` + name + `"
|
||||
},
|
||||
"route": {
|
||||
"cluster": "pomerium-control-plane-http"
|
||||
},
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
}
|
||||
str += "}"
|
||||
}
|
||||
}`
|
||||
return str
|
||||
}
|
||||
t.Run("authenticate", func(t *testing.T) {
|
||||
|
|
@ -88,17 +87,15 @@ func Test_buildPomeriumHTTPRoutes(t *testing.T) {
|
|||
require.NoError(t, err)
|
||||
|
||||
testutil.AssertProtoJSONEqual(t, `[
|
||||
`+routeString("path", "/.pomerium/jwt", true)+`,
|
||||
`+routeString("path", urlutil.WebAuthnURLPath, true)+`,
|
||||
`+routeString("path", "/ping", false)+`,
|
||||
`+routeString("path", "/healthz", false)+`,
|
||||
`+routeString("path", "/.pomerium", false)+`,
|
||||
`+routeString("prefix", "/.pomerium/", false)+`,
|
||||
`+routeString("path", "/.well-known/pomerium", false)+`,
|
||||
`+routeString("prefix", "/.well-known/pomerium/", false)+`,
|
||||
`+routeString("path", "/robots.txt", false)+`,
|
||||
`+routeString("path", "/oauth2/callback", false)+`,
|
||||
`+routeString("path", "/", false)+`
|
||||
`+routeString("path", "/ping")+`,
|
||||
`+routeString("path", "/healthz")+`,
|
||||
`+routeString("path", "/.pomerium")+`,
|
||||
`+routeString("prefix", "/.pomerium/")+`,
|
||||
`+routeString("path", "/.well-known/pomerium")+`,
|
||||
`+routeString("prefix", "/.well-known/pomerium/")+`,
|
||||
`+routeString("path", "/robots.txt")+`,
|
||||
`+routeString("path", "/oauth2/callback")+`,
|
||||
`+routeString("path", "/")+`
|
||||
]`, routes)
|
||||
})
|
||||
t.Run("proxy fronting authenticate", func(t *testing.T) {
|
||||
|
|
@ -127,15 +124,13 @@ func Test_buildPomeriumHTTPRoutes(t *testing.T) {
|
|||
require.NoError(t, err)
|
||||
|
||||
testutil.AssertProtoJSONEqual(t, `[
|
||||
`+routeString("path", "/.pomerium/jwt", true)+`,
|
||||
`+routeString("path", urlutil.WebAuthnURLPath, true)+`,
|
||||
`+routeString("path", "/ping", false)+`,
|
||||
`+routeString("path", "/healthz", false)+`,
|
||||
`+routeString("path", "/.pomerium", false)+`,
|
||||
`+routeString("prefix", "/.pomerium/", false)+`,
|
||||
`+routeString("path", "/.well-known/pomerium", false)+`,
|
||||
`+routeString("prefix", "/.well-known/pomerium/", false)+`,
|
||||
`+routeString("path", "/robots.txt", false)+`
|
||||
`+routeString("path", "/ping")+`,
|
||||
`+routeString("path", "/healthz")+`,
|
||||
`+routeString("path", "/.pomerium")+`,
|
||||
`+routeString("prefix", "/.pomerium/")+`,
|
||||
`+routeString("path", "/.well-known/pomerium")+`,
|
||||
`+routeString("prefix", "/.well-known/pomerium/")+`,
|
||||
`+routeString("path", "/robots.txt")+`
|
||||
]`, routes)
|
||||
})
|
||||
|
||||
|
|
@ -155,21 +150,19 @@ func Test_buildPomeriumHTTPRoutes(t *testing.T) {
|
|||
require.NoError(t, err)
|
||||
|
||||
testutil.AssertProtoJSONEqual(t, `[
|
||||
`+routeString("path", "/.pomerium/jwt", true)+`,
|
||||
`+routeString("path", urlutil.WebAuthnURLPath, true)+`,
|
||||
`+routeString("path", "/ping", false)+`,
|
||||
`+routeString("path", "/healthz", false)+`,
|
||||
`+routeString("path", "/.pomerium", false)+`,
|
||||
`+routeString("prefix", "/.pomerium/", false)+`,
|
||||
`+routeString("path", "/.well-known/pomerium", false)+`,
|
||||
`+routeString("prefix", "/.well-known/pomerium/", false)+`
|
||||
`+routeString("path", "/ping")+`,
|
||||
`+routeString("path", "/healthz")+`,
|
||||
`+routeString("path", "/.pomerium")+`,
|
||||
`+routeString("prefix", "/.pomerium/")+`,
|
||||
`+routeString("path", "/.well-known/pomerium")+`,
|
||||
`+routeString("prefix", "/.well-known/pomerium/")+`
|
||||
]`, routes)
|
||||
})
|
||||
}
|
||||
|
||||
func Test_buildControlPlanePathRoute(t *testing.T) {
|
||||
b := &Builder{filemgr: filemgr.NewManager()}
|
||||
route := b.buildControlPlanePathRoute("/hello/world", false)
|
||||
route := b.buildControlPlanePathRoute("/hello/world")
|
||||
testutil.AssertProtoJSONEqual(t, `
|
||||
{
|
||||
"name": "pomerium-path-/hello/world",
|
||||
|
|
@ -182,7 +175,12 @@ func Test_buildControlPlanePathRoute(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -191,7 +189,7 @@ func Test_buildControlPlanePathRoute(t *testing.T) {
|
|||
|
||||
func Test_buildControlPlanePrefixRoute(t *testing.T) {
|
||||
b := &Builder{filemgr: filemgr.NewManager()}
|
||||
route := b.buildControlPlanePrefixRoute("/hello/world/", false)
|
||||
route := b.buildControlPlanePrefixRoute("/hello/world/")
|
||||
testutil.AssertProtoJSONEqual(t, `
|
||||
{
|
||||
"name": "pomerium-prefix-/hello/world/",
|
||||
|
|
@ -204,7 +202,12 @@ func Test_buildControlPlanePrefixRoute(t *testing.T) {
|
|||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"disabled": true
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "true",
|
||||
"route_id": "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -249,6 +252,7 @@ func TestTimeouts(t *testing.T) {
|
|||
Policies: []config.Policy{
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://example.com"),
|
||||
Path: "/test",
|
||||
UpstreamTimeout: getDuration(tc.upstream),
|
||||
IdleTimeout: getDuration(tc.idle),
|
||||
|
|
@ -303,14 +307,17 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
Policies: []config.Policy{
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://ignore.example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
PassIdentityHeaders: true,
|
||||
},
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
PassIdentityHeaders: true,
|
||||
},
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
Path: "/some/path",
|
||||
AllowWebsockets: true,
|
||||
PreserveHostHeader: true,
|
||||
|
|
@ -318,6 +325,7 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
},
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
Prefix: "/some/prefix/",
|
||||
SetRequestHeaders: map[string]string{"HEADER-KEY": "HEADER-VALUE"},
|
||||
UpstreamTimeout: &oneMinute,
|
||||
|
|
@ -325,11 +333,13 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
},
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
Regex: `^/[a]+$`,
|
||||
PassIdentityHeaders: true,
|
||||
},
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
Prefix: "/some/prefix/",
|
||||
RemoveRequestHeaders: []string{"HEADER-KEY"},
|
||||
UpstreamTimeout: &oneMinute,
|
||||
|
|
@ -337,6 +347,7 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
},
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
Path: "/some/path",
|
||||
AllowSPDY: true,
|
||||
PreserveHostHeader: true,
|
||||
|
|
@ -344,6 +355,7 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
},
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
Path: "/some/path",
|
||||
AllowSPDY: true,
|
||||
AllowWebsockets: true,
|
||||
|
|
@ -352,6 +364,7 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
},
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
Path: "/websocket-timeout",
|
||||
AllowWebsockets: true,
|
||||
PreserveHostHeader: true,
|
||||
|
|
@ -405,7 +418,18 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "7746454661610785111"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-2",
|
||||
|
|
@ -449,7 +473,18 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "6370109395891044565"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-3",
|
||||
|
|
@ -499,7 +534,18 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "11248013325168299965"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-4",
|
||||
|
|
@ -545,7 +591,18 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "17692847211962454053"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-5",
|
||||
|
|
@ -589,7 +646,18 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
"HEADER-KEY",
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "11248013325168299965"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-6",
|
||||
|
|
@ -632,7 +700,18 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "6370109395891044565"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-7",
|
||||
|
|
@ -676,7 +755,18 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "6370109395891044565"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-8",
|
||||
|
|
@ -720,7 +810,18 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "7972237966834677964"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
`, routes)
|
||||
|
|
@ -734,6 +835,7 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
Policies: []config.Policy{
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://authenticate.example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://authenticate.internal"),
|
||||
PassIdentityHeaders: true,
|
||||
},
|
||||
},
|
||||
|
|
@ -799,10 +901,12 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
Policies: []config.Policy{
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "tcp+https://example.com:22")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
PassIdentityHeaders: true,
|
||||
},
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "tcp+https://example.com:22")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
PassIdentityHeaders: true,
|
||||
UpstreamTimeout: &ten,
|
||||
},
|
||||
|
|
@ -855,7 +959,18 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "4491062410224443025"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-1",
|
||||
|
|
@ -900,7 +1015,18 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "4491062410224443025"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
`, routes)
|
||||
|
|
@ -918,6 +1044,7 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
Policies: []config.Policy{
|
||||
{
|
||||
Source: &config.StringURL{URL: mustParseURL(t, "https://from.example.com")},
|
||||
To: mustParseWeightedURLs(t, "https://to.example.com"),
|
||||
},
|
||||
},
|
||||
}, "from.example.com")
|
||||
|
|
@ -969,7 +1096,18 @@ func Test_buildPolicyRoutes(t *testing.T) {
|
|||
"x-email",
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "16734437564672684348"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
`, routes)
|
||||
|
|
@ -1071,7 +1209,18 @@ func Test_buildPolicyRoutesRewrite(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "2168630557152195352"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-1",
|
||||
|
|
@ -1115,7 +1264,18 @@ func Test_buildPolicyRoutesRewrite(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "2168630557152195352"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-2",
|
||||
|
|
@ -1165,7 +1325,18 @@ func Test_buildPolicyRoutesRewrite(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "2168630557152195352"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-3",
|
||||
|
|
@ -1209,7 +1380,18 @@ func Test_buildPolicyRoutesRewrite(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "2168630557152195352"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-4",
|
||||
|
|
@ -1253,7 +1435,18 @@ func Test_buildPolicyRoutesRewrite(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "2168630557152195352"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy-5",
|
||||
|
|
@ -1303,7 +1496,18 @@ func Test_buildPolicyRoutesRewrite(t *testing.T) {
|
|||
"requestHeadersToRemove": [
|
||||
"x-pomerium-reproxy-policy",
|
||||
"x-pomerium-reproxy-policy-hmac"
|
||||
]
|
||||
],
|
||||
"typedPerFilterConfig": {
|
||||
"envoy.filters.http.ext_authz": {
|
||||
"@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
|
||||
"checkSettings": {
|
||||
"contextExtensions": {
|
||||
"internal": "false",
|
||||
"route_id": "2168630557152195352"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
`, routes)
|
||||
|
|
|
|||
|
|
@ -13,10 +13,6 @@ func (p *Policy) ToPPL() *parser.Policy {
|
|||
ppl := &parser.Policy{}
|
||||
|
||||
allowRule := parser.Rule{Action: parser.ActionAllow}
|
||||
allowRule.Or = append(allowRule.Or,
|
||||
parser.Criterion{
|
||||
Name: "pomerium_routes",
|
||||
})
|
||||
if p.AllowPublicUnauthenticatedAccess {
|
||||
allowRule.Or = append(allowRule.Or,
|
||||
parser.Criterion{
|
||||
|
|
|
|||
|
|
@ -57,24 +57,6 @@ default allow = [false, set()]
|
|||
|
||||
default deny = [false, set()]
|
||||
|
||||
pomerium_routes_0 = [true, {"pomerium-route"}] {
|
||||
session := get_session(input.session.id)
|
||||
session.id != ""
|
||||
contains(input.http.url, "/.pomerium/")
|
||||
}
|
||||
|
||||
else = [true, {"pomerium-route"}] {
|
||||
contains(input.http.url, "/.pomerium/")
|
||||
not contains(input.http.url, "/.pomerium/jwt")
|
||||
not contains(input.http.url, "/.pomerium/webauthn")
|
||||
}
|
||||
|
||||
else = [false, {"user-unauthenticated"}] {
|
||||
contains(input.http.url, "/.pomerium/")
|
||||
}
|
||||
|
||||
else = [false, {"non-pomerium-route"}]
|
||||
|
||||
accept_0 = [true, {"accept"}]
|
||||
|
||||
cors_preflight_0 = [true, {"cors-request"}] {
|
||||
|
|
@ -380,7 +362,7 @@ else = [false, {"email-unauthorized"}] {
|
|||
else = [false, {"user-unauthenticated"}]
|
||||
|
||||
or_0 = v {
|
||||
results := [pomerium_routes_0, accept_0, cors_preflight_0, authenticated_user_0, domain_0, domain_1, domain_2, domain_3, domain_4, claim_0, claim_1, claim_2, claim_3, user_0, email_0, user_1, email_1, user_2, email_2, user_3, email_3, user_4, email_4]
|
||||
results := [accept_0, cors_preflight_0, authenticated_user_0, domain_0, domain_1, domain_2, domain_3, domain_4, claim_0, claim_1, claim_2, claim_3, user_0, email_0, user_1, email_1, user_2, email_2, user_3, email_3, user_4, email_4]
|
||||
normalized := [normalize_criterion_result(x) | x := results[i]]
|
||||
v := merge_with_or(normalized)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,65 +0,0 @@
|
|||
package criteria
|
||||
|
||||
import (
|
||||
"github.com/open-policy-agent/opa/ast"
|
||||
|
||||
"github.com/pomerium/pomerium/internal/urlutil"
|
||||
"github.com/pomerium/pomerium/pkg/policy/generator"
|
||||
"github.com/pomerium/pomerium/pkg/policy/parser"
|
||||
"github.com/pomerium/pomerium/pkg/policy/rules"
|
||||
)
|
||||
|
||||
type pomeriumRoutesCriterion struct {
|
||||
g *Generator
|
||||
}
|
||||
|
||||
func (pomeriumRoutesCriterion) DataType() generator.CriterionDataType {
|
||||
return generator.CriterionDataTypeUnused
|
||||
}
|
||||
|
||||
func (pomeriumRoutesCriterion) Name() string {
|
||||
return "pomerium_routes"
|
||||
}
|
||||
|
||||
func (c pomeriumRoutesCriterion) GenerateRule(_ string, _ parser.Value) (*ast.Rule, []*ast.Rule, error) {
|
||||
r1 := c.g.NewRule(c.Name())
|
||||
r1.Head.Value = NewCriterionTerm(true, ReasonPomeriumRoute)
|
||||
r1.Body = ast.Body{
|
||||
ast.MustParseExpr(`session := get_session(input.session.id)`),
|
||||
ast.MustParseExpr(`session.id != ""`),
|
||||
ast.MustParseExpr(`contains(input.http.url, "/.pomerium/")`),
|
||||
}
|
||||
|
||||
r2 := c.g.NewRule(c.Name())
|
||||
r2.Head.Value = NewCriterionTerm(true, ReasonPomeriumRoute)
|
||||
r2.Body = ast.Body{
|
||||
ast.MustParseExpr(`contains(input.http.url, "/.pomerium/")`),
|
||||
ast.MustParseExpr(`not contains(input.http.url, "/.pomerium/jwt")`),
|
||||
ast.MustParseExpr(`not contains(input.http.url, "` + urlutil.WebAuthnURLPath + `")`),
|
||||
}
|
||||
r1.Else = r2
|
||||
|
||||
r3 := c.g.NewRule(c.Name())
|
||||
r3.Head.Value = NewCriterionTerm(false, ReasonUserUnauthenticated)
|
||||
r3.Body = ast.Body{
|
||||
ast.MustParseExpr(`contains(input.http.url, "/.pomerium/")`),
|
||||
}
|
||||
r2.Else = r3
|
||||
|
||||
r4 := c.g.NewRule(c.Name())
|
||||
r4.Head.Value = NewCriterionTerm(false, ReasonNonPomeriumRoute)
|
||||
r3.Else = r4
|
||||
|
||||
return r1, []*ast.Rule{
|
||||
rules.GetSession(),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// PomeriumRoutes returns a Criterion on that allows access to pomerium routes.
|
||||
func PomeriumRoutes(generator *Generator) Criterion {
|
||||
return pomeriumRoutesCriterion{g: generator}
|
||||
}
|
||||
|
||||
func init() {
|
||||
Register(PomeriumRoutes)
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue