From aea58ebf48a907436ac8eadd374c31f04658c6ee Mon Sep 17 00:00:00 2001 From: Kuat Yessenov Date: Tue, 11 Jan 2022 11:04:40 -0800 Subject: [PATCH 01/10] add matching types for network streams Signed-off-by: Kuat Yessenov --- .../type/matcher/v3/network_inputs.proto | 83 +++++++++ envoy/network/filter.h | 4 + source/common/network/matching/BUILD | 30 +++ source/common/network/matching/data_impl.h | 27 +++ source/common/network/matching/inputs.cc | 99 ++++++++++ source/common/network/matching/inputs.h | 176 ++++++++++++++++++ 6 files changed, 419 insertions(+) create mode 100644 api/envoy/type/matcher/v3/network_inputs.proto create mode 100644 source/common/network/matching/BUILD create mode 100644 source/common/network/matching/data_impl.h create mode 100644 source/common/network/matching/inputs.cc create mode 100644 source/common/network/matching/inputs.h diff --git a/api/envoy/type/matcher/v3/network_inputs.proto b/api/envoy/type/matcher/v3/network_inputs.proto new file mode 100644 index 0000000000000..2fa0895329f54 --- /dev/null +++ b/api/envoy/type/matcher/v3/network_inputs.proto @@ -0,0 +1,83 @@ +syntax = "proto3"; + +package envoy.type.matcher.v3; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.type.matcher.v3"; +option java_outer_classname = "NetworkInputsProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3;matcherv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Common Network Matching Inputs] + +// Specifies that matching should be performed by the destination IP address. +message DestinationIPInput { +} + +// Specifies that matching should be performed by the destination port. +message DestinationPortInput { +} + +// Specifies that matching should be performed by the source IP address. +message SourceIPInput { +} + +// Specifies that matching should be performed by the source port. +message SourcePortInput { +} + +// Input that matches by the directly connected source IP address (this +// will only be different from the source IP address when using a listener +// filter that overrides the source address, such as the :ref:`Proxy Protocol +// listener filter `). +message DirectSourceIPInput { +} + +// Input that matches by the source IP type. +// Specifies the source IP match type. The values include: +// +// * ``local`` - matches a connection originating from the same host, +message SourceTypeInput { +} + +// Input that matches by the requested server name (e.g. SNI in TLS), when detected by one of the listener filters. +// +// :ref:`TLS Inspector ` provides the requested server name based on SNI. +message ServerNameInput { +} + +// Input that matches by the transport protocol, when +// detected by one of the listener filters. +// +// Suggested values include: +// +// * ``raw_buffer`` - default, used when no transport protocol is detected, +// * ``tls`` - set by :ref:`envoy.filters.listener.tls_inspector ` +// when TLS protocol is detected. +message TransportProtocolInput { +} + +// List of comma-separated requested application protocols, when detected by one of the listener filters. +// +// Suggested values in the list include: +// +// * ``http/1.1`` - set by :ref:`envoy.filters.listener.tls_inspector +// ` and :ref:`envoy.filters.listener.http_inspector +// `, +// * ``h2`` - set by :ref:`envoy.filters.listener.tls_inspector ` +// * ``h2c`` - set by :ref:`envoy.filters.listener.http_inspector ` +// +// .. attention:: +// +// Currently, :ref:`TLS Inspector ` provides +// application protocol detection based on the requested +// `ALPN `_ values. +// +// However, the use of ALPN is pretty much limited to the HTTP/2 traffic on the Internet, +// and matching on values other than ``h2`` is going to lead to a lot of false negatives, +// unless all connecting clients are known to use ALPN. +message ApplicationProtocolInput { +} diff --git a/envoy/network/filter.h b/envoy/network/filter.h index 16a5de4c2e3e4..a41a76cad45ab 100644 --- a/envoy/network/filter.h +++ b/envoy/network/filter.h @@ -525,6 +525,10 @@ class FilterChainFactory { class MatchingData { public: static absl::string_view name() { return "network"; } + + virtual ~MatchingData() = default; + + virtual const ConnectionSocket& socket() const PURE; }; } // namespace Network diff --git a/source/common/network/matching/BUILD b/source/common/network/matching/BUILD new file mode 100644 index 0000000000000..2611c953b2d7d --- /dev/null +++ b/source/common/network/matching/BUILD @@ -0,0 +1,30 @@ +load( + "//bazel:envoy_build_system.bzl", + "envoy_cc_library", + "envoy_package", +) + +licenses(["notice"]) # Apache 2 + +envoy_package() + +envoy_cc_library( + name = "data_impl_lib", + hdrs = ["data_impl.h"], + deps = [ + "//envoy/network:filter_interface", + ], +) + +envoy_cc_library( + name = "inputs_lib", + srcs = ["inputs.cc"], + hdrs = ["inputs.h"], + deps = [ + "//envoy/matcher:matcher_interface", + "//envoy/network:filter_interface", + "//envoy/registry", + "//source/common/network:utility_lib", + "@envoy_api//envoy/type/matcher/v3:pkg_cc_proto", + ], +) diff --git a/source/common/network/matching/data_impl.h b/source/common/network/matching/data_impl.h new file mode 100644 index 0000000000000..bf362f0974a67 --- /dev/null +++ b/source/common/network/matching/data_impl.h @@ -0,0 +1,27 @@ +#pragma once + +#include "envoy/network/filter.h" + +namespace Envoy { +namespace Network { +namespace Matching { + +/** + * Implementation of Network::MatchingData, providing connection-level data to + * the match tree. + */ +class MatchingDataImpl : public MatchingData { +public: + static absl::string_view name() { return "network"; } + + void onSocket(const ConnectionSocket& socket) { socket_ = &socket; } + + virtual const ConnectionSocket& socket() { return *socket_; } + +private: + const ConnectionSocket* socket_{}; +}; + +} // namespace Matching +} // namespace Network +} // namespace Envoy diff --git a/source/common/network/matching/inputs.cc b/source/common/network/matching/inputs.cc new file mode 100644 index 0000000000000..ac321fc1f1307 --- /dev/null +++ b/source/common/network/matching/inputs.cc @@ -0,0 +1,99 @@ +#include "source/common/network/matching/inputs.h" + +#include "envoy/registry/registry.h" + +#include "source/common/network/utility.h" + +#include "absl/strings/str_cat.h" + +namespace Envoy { +namespace Network { +namespace Matching { + +Matcher::DataInputGetResult DestinationIPInput::get(const MatchingData& data) const { + const auto& address = data.socket().connectionInfoProvider().localAddress(); + if (address->type() != Network::Address::Type::Ip) { + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt}; + } + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, + address->ip()->addressAsString()}; +} + +Matcher::DataInputGetResult DestinationPortInput::get(const MatchingData& data) const { + const auto& address = data.socket().connectionInfoProvider().localAddress(); + if (address->type() != Network::Address::Type::Ip) { + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt}; + } + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, + absl::StrCat(address->ip()->port())}; +} + +Matcher::DataInputGetResult SourceIPInput::get(const MatchingData& data) const { + const auto& address = data.socket().connectionInfoProvider().remoteAddress(); + if (address->type() != Network::Address::Type::Ip) { + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt}; + } + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, + address->ip()->addressAsString()}; +} + +Matcher::DataInputGetResult SourcePortInput::get(const MatchingData& data) const { + const auto& address = data.socket().connectionInfoProvider().remoteAddress(); + if (address->type() != Network::Address::Type::Ip) { + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt}; + } + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, + absl::StrCat(address->ip()->port())}; +} + +Matcher::DataInputGetResult DirectSourceIPInput::get(const MatchingData& data) const { + const auto& address = data.socket().connectionInfoProvider().directRemoteAddress(); + if (address->type() != Network::Address::Type::Ip) { + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt}; + } + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, + address->ip()->addressAsString()}; +} + +Matcher::DataInputGetResult SourceTypeInput::get(const MatchingData& data) const { + const bool is_local_connection = Network::Utility::isSameIpOrLoopback(data.socket()); + if (is_local_connection) { + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, "local"}; + } + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt}; +} + +Matcher::DataInputGetResult ServerNameInput::get(const MatchingData& data) const { + if (!data.socket().requestedServerName().empty()) { + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, + std::string(data.socket().requestedServerName())}; + } + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt}; +} + +Matcher::DataInputGetResult TransportProtocolInput::get(const MatchingData& data) const { + if (!data.socket().detectedTransportProtocol().empty()) { + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, + std::string(data.socket().detectedTransportProtocol())}; + } + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt}; +} + +Matcher::DataInputGetResult ApplicationProtocolInput::get(const MatchingData& data) const { + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, + absl::StrJoin(data.socket().requestedApplicationProtocols(), ",")}; +} + +REGISTER_FACTORY(DestinationIPInputFactory, Matcher::DataInputFactory); +REGISTER_FACTORY(DestinationPortInputFactory, Matcher::DataInputFactory); +REGISTER_FACTORY(SourceIPInputFactory, Matcher::DataInputFactory); +REGISTER_FACTORY(SourcePortInputFactory, Matcher::DataInputFactory); +REGISTER_FACTORY(DirectSourceIPInputFactory, Matcher::DataInputFactory); +REGISTER_FACTORY(SourceTypeInputFactory, Matcher::DataInputFactory); +REGISTER_FACTORY(ServerNameInputFactory, Matcher::DataInputFactory); +REGISTER_FACTORY(TransportProtocolInputFactory, Matcher::DataInputFactory); +REGISTER_FACTORY(ApplicationProtocolInputFactory, Matcher::DataInputFactory); + +} // namespace Matching +} // namespace Network +} // namespace Envoy diff --git a/source/common/network/matching/inputs.h b/source/common/network/matching/inputs.h new file mode 100644 index 0000000000000..83aeba60411a8 --- /dev/null +++ b/source/common/network/matching/inputs.h @@ -0,0 +1,176 @@ +#pragma once + +#include "envoy/matcher/matcher.h" +#include "envoy/network/filter.h" +#include "envoy/type/matcher/v3/network_inputs.pb.h" +#include "envoy/type/matcher/v3/network_inputs.pb.validate.h" + +namespace Envoy { +namespace Network { +namespace Matching { + +class DestinationIPInput : public Matcher::DataInput { +public: + Matcher::DataInputGetResult get(const MatchingData& data) const override; +}; + +class DestinationIPInputFactory : public Matcher::DataInputFactory { +public: + std::string name() const override { return "destination-ip"; } + + Matcher::DataInputFactoryCb + createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { + return []() { return std::make_unique(); }; + }; + ProtobufTypes::MessagePtr createEmptyConfigProto() override { + return std::make_unique(); + } +}; + +class DestinationPortInput : public Matcher::DataInput { +public: + Matcher::DataInputGetResult get(const MatchingData& data) const override; +}; + +class DestinationPortInputFactory : public Matcher::DataInputFactory { +public: + std::string name() const override { return "destination-port"; } + + Matcher::DataInputFactoryCb + createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { + return []() { return std::make_unique(); }; + }; + ProtobufTypes::MessagePtr createEmptyConfigProto() override { + return std::make_unique(); + } +}; + +class SourceIPInput : public Matcher::DataInput { +public: + Matcher::DataInputGetResult get(const MatchingData& data) const override; +}; + +class SourceIPInputFactory : public Matcher::DataInputFactory { +public: + std::string name() const override { return "source-ip"; } + + Matcher::DataInputFactoryCb + createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { + return []() { return std::make_unique(); }; + }; + ProtobufTypes::MessagePtr createEmptyConfigProto() override { + return std::make_unique(); + } +}; + +class SourcePortInput : public Matcher::DataInput { +public: + Matcher::DataInputGetResult get(const MatchingData& data) const override; +}; + +class SourcePortInputFactory : public Matcher::DataInputFactory { +public: + std::string name() const override { return "source-port"; } + + Matcher::DataInputFactoryCb + createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { + return []() { return std::make_unique(); }; + }; + ProtobufTypes::MessagePtr createEmptyConfigProto() override { + return std::make_unique(); + } +}; + +class DirectSourceIPInput : public Matcher::DataInput { +public: + Matcher::DataInputGetResult get(const MatchingData& data) const override; +}; + +class DirectSourceIPInputFactory : public Matcher::DataInputFactory { +public: + std::string name() const override { return "direct-source-ip"; } + + Matcher::DataInputFactoryCb + createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { + return []() { return std::make_unique(); }; + }; + ProtobufTypes::MessagePtr createEmptyConfigProto() override { + return std::make_unique(); + } +}; + +class SourceTypeInput : public Matcher::DataInput { +public: + Matcher::DataInputGetResult get(const MatchingData& data) const override; +}; + +class SourceTypeInputFactory : public Matcher::DataInputFactory { +public: + std::string name() const override { return "source-type"; } + + Matcher::DataInputFactoryCb + createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { + return []() { return std::make_unique(); }; + }; + ProtobufTypes::MessagePtr createEmptyConfigProto() override { + return std::make_unique(); + } +}; + +class ServerNameInput : public Matcher::DataInput { +public: + Matcher::DataInputGetResult get(const MatchingData& data) const override; +}; + +class ServerNameInputFactory : public Matcher::DataInputFactory { +public: + std::string name() const override { return "server-name"; } + + Matcher::DataInputFactoryCb + createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { + return []() { return std::make_unique(); }; + }; + ProtobufTypes::MessagePtr createEmptyConfigProto() override { + return std::make_unique(); + } +}; + +class TransportProtocolInput : public Matcher::DataInput { +public: + Matcher::DataInputGetResult get(const MatchingData& data) const override; +}; + +class TransportProtocolInputFactory : public Matcher::DataInputFactory { +public: + std::string name() const override { return "transport-protocol"; } + + Matcher::DataInputFactoryCb + createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { + return []() { return std::make_unique(); }; + }; + ProtobufTypes::MessagePtr createEmptyConfigProto() override { + return std::make_unique(); + } +}; + +class ApplicationProtocolInput : public Matcher::DataInput { +public: + Matcher::DataInputGetResult get(const MatchingData& data) const override; +}; + +class ApplicationProtocolInputFactory : public Matcher::DataInputFactory { +public: + std::string name() const override { return "application-protocol"; } + + Matcher::DataInputFactoryCb + createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { + return []() { return std::make_unique(); }; + }; + ProtobufTypes::MessagePtr createEmptyConfigProto() override { + return std::make_unique(); + } +}; + +} // namespace Matching +} // namespace Network +} // namespace Envoy From f4ed5de2ac6d1062b0909d848a846aaccb1f973c Mon Sep 17 00:00:00 2001 From: Kuat Yessenov Date: Tue, 11 Jan 2022 14:31:48 -0800 Subject: [PATCH 02/10] quoted Signed-off-by: Kuat Yessenov --- api/envoy/type/matcher/v3/network_inputs.proto | 6 +++++- source/common/network/matching/inputs.cc | 8 ++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/api/envoy/type/matcher/v3/network_inputs.proto b/api/envoy/type/matcher/v3/network_inputs.proto index 2fa0895329f54..49a1ab0818968 100644 --- a/api/envoy/type/matcher/v3/network_inputs.proto +++ b/api/envoy/type/matcher/v3/network_inputs.proto @@ -60,7 +60,11 @@ message ServerNameInput { message TransportProtocolInput { } -// List of comma-separated requested application protocols, when detected by one of the listener filters. +// List of quoted and comma-separated requested application protocols, when detected by one of the listener filters. +// Examples: +// +// * ``'h2','http/1.1'`` +// * ``'h2c'``` // // Suggested values in the list include: // diff --git a/source/common/network/matching/inputs.cc b/source/common/network/matching/inputs.cc index ac321fc1f1307..8d9fcbfb1cfb3 100644 --- a/source/common/network/matching/inputs.cc +++ b/source/common/network/matching/inputs.cc @@ -80,8 +80,12 @@ Matcher::DataInputGetResult TransportProtocolInput::get(const MatchingData& data } Matcher::DataInputGetResult ApplicationProtocolInput::get(const MatchingData& data) const { - return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, - absl::StrJoin(data.socket().requestedApplicationProtocols(), ",")}; + const auto& protocols = data.socket().requestedApplicationProtocols(); + if (!protocols.empty()) { + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, + absl::StrCat("'", absl::StrJoin(protocols, "','"), "'")}; + } + return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt}; } REGISTER_FACTORY(DestinationIPInputFactory, Matcher::DataInputFactory); From 41e60d6a6d05370bbc059bbee857fb132465479b Mon Sep 17 00:00:00 2001 From: Kuat Yessenov Date: Tue, 11 Jan 2022 20:02:23 -0800 Subject: [PATCH 03/10] docs Signed-off-by: Kuat Yessenov --- docs/root/api-v3/types/types.rst | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/root/api-v3/types/types.rst b/docs/root/api-v3/types/types.rst index 5fa6b7b45b0f7..8eddaf209dc3d 100644 --- a/docs/root/api-v3/types/types.rst +++ b/docs/root/api-v3/types/types.rst @@ -23,5 +23,6 @@ Types ../type/matcher/v3/struct.proto ../type/matcher/v3/value.proto ../type/matcher/v3/http_inputs.proto + ../type/matcher/v3/network_inputs.proto ../type/metadata/v3/metadata.proto ../type/tracing/v3/custom_tag.proto From 89eaf620ab5d5e98b853f45a1e4c7cacd721f2d5 Mon Sep 17 00:00:00 2001 From: Kuat Yessenov Date: Wed, 12 Jan 2022 10:46:46 -0800 Subject: [PATCH 04/10] tests Signed-off-by: Kuat Yessenov --- source/common/network/matching/data_impl.h | 8 +- source/common/network/matching/inputs.cc | 10 +- test/common/network/matching/BUILD | 20 ++ test/common/network/matching/inputs_test.cc | 237 ++++++++++++++++++++ 4 files changed, 266 insertions(+), 9 deletions(-) create mode 100644 test/common/network/matching/BUILD create mode 100644 test/common/network/matching/inputs_test.cc diff --git a/source/common/network/matching/data_impl.h b/source/common/network/matching/data_impl.h index bf362f0974a67..9190083edf21f 100644 --- a/source/common/network/matching/data_impl.h +++ b/source/common/network/matching/data_impl.h @@ -12,14 +12,12 @@ namespace Matching { */ class MatchingDataImpl : public MatchingData { public: + MatchingDataImpl(const ConnectionSocket& socket) : socket_(socket) {} static absl::string_view name() { return "network"; } - - void onSocket(const ConnectionSocket& socket) { socket_ = &socket; } - - virtual const ConnectionSocket& socket() { return *socket_; } + const ConnectionSocket& socket() const override { return socket_; } private: - const ConnectionSocket* socket_{}; + const ConnectionSocket& socket_; }; } // namespace Matching diff --git a/source/common/network/matching/inputs.cc b/source/common/network/matching/inputs.cc index 8d9fcbfb1cfb3..deb64a6b40357 100644 --- a/source/common/network/matching/inputs.cc +++ b/source/common/network/matching/inputs.cc @@ -64,17 +64,19 @@ Matcher::DataInputGetResult SourceTypeInput::get(const MatchingData& data) const } Matcher::DataInputGetResult ServerNameInput::get(const MatchingData& data) const { - if (!data.socket().requestedServerName().empty()) { + const auto server_name = data.socket().requestedServerName(); + if (!server_name.empty()) { return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, - std::string(data.socket().requestedServerName())}; + std::string(server_name)}; } return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt}; } Matcher::DataInputGetResult TransportProtocolInput::get(const MatchingData& data) const { - if (!data.socket().detectedTransportProtocol().empty()) { + const auto transport_protocol = data.socket().detectedTransportProtocol(); + if (!transport_protocol.empty()) { return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, - std::string(data.socket().detectedTransportProtocol())}; + std::string(transport_protocol)}; } return {Matcher::DataInputGetResult::DataAvailability::AllDataAvailable, absl::nullopt}; } diff --git a/test/common/network/matching/BUILD b/test/common/network/matching/BUILD new file mode 100644 index 0000000000000..e9f3947bdab07 --- /dev/null +++ b/test/common/network/matching/BUILD @@ -0,0 +1,20 @@ +load( + "//bazel:envoy_build_system.bzl", + "envoy_cc_test", + "envoy_package", +) + +licenses(["notice"]) # Apache 2 + +envoy_package() + +envoy_cc_test( + name = "inputs_test", + srcs = ["inputs_test.cc"], + deps = [ + "//source/common/network:address_lib", + "//source/common/network/matching:data_impl_lib", + "//source/common/network/matching:inputs_lib", + "//test/mocks/network:network_mocks", + ], +) diff --git a/test/common/network/matching/inputs_test.cc b/test/common/network/matching/inputs_test.cc new file mode 100644 index 0000000000000..b3b733facaa75 --- /dev/null +++ b/test/common/network/matching/inputs_test.cc @@ -0,0 +1,237 @@ +#include "envoy/http/filter.h" + +#include "source/common/network/address_impl.h" +#include "source/common/network/matching/data_impl.h" +#include "source/common/network/matching/inputs.h" + +#include "test/mocks/network/mocks.h" + +namespace Envoy { +namespace Network { +namespace Matching { + +TEST(MatchingData, DestinationIPInput) { + DestinationIPInput input; + MockConnectionSocket socket; + MatchingDataImpl data(socket); + + { + socket.connection_info_provider_->setLocalAddress( + std::make_shared("127.0.0.1", 8080)); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, "127.0.0.1"); + } + + { + socket.connection_info_provider_->setLocalAddress( + std::make_shared("/pipe/path")); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, absl::nullopt); + } +} + +TEST(MatchingData, DestinationPortInput) { + DestinationPortInput input; + MockConnectionSocket socket; + MatchingDataImpl data(socket); + + { + socket.connection_info_provider_->setLocalAddress( + std::make_shared("127.0.0.1", 8080)); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, "8080"); + } + + { + socket.connection_info_provider_->setLocalAddress( + std::make_shared("/pipe/path")); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, absl::nullopt); + } +} + +TEST(MatchingData, SourceIPInput) { + SourceIPInput input; + MockConnectionSocket socket; + MatchingDataImpl data(socket); + + { + socket.connection_info_provider_->setRemoteAddress( + std::make_shared("127.0.0.1", 8080)); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, "127.0.0.1"); + } + + { + socket.connection_info_provider_->setRemoteAddress( + std::make_shared("/pipe/path")); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, absl::nullopt); + } +} + +TEST(MatchingData, SourcePortInput) { + SourcePortInput input; + MockConnectionSocket socket; + MatchingDataImpl data(socket); + + { + socket.connection_info_provider_->setRemoteAddress( + std::make_shared("127.0.0.1", 8080)); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, "8080"); + } + + { + socket.connection_info_provider_->setRemoteAddress( + std::make_shared("/pipe/path")); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, absl::nullopt); + } +} + +TEST(MatchingData, DirectSourceIPInput) { + DirectSourceIPInput input; + MockConnectionSocket socket; + MatchingDataImpl data(socket); + + { + socket.connection_info_provider_->setDirectRemoteAddressForTest( + std::make_shared("127.0.0.1", 8080)); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, "127.0.0.1"); + } + + { + socket.connection_info_provider_->setDirectRemoteAddressForTest( + std::make_shared("/pipe/path")); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, absl::nullopt); + } +} + +TEST(MatchingData, SourceTypeInput) { + SourceTypeInput input; + MockConnectionSocket socket; + MatchingDataImpl data(socket); + + { + socket.connection_info_provider_->setRemoteAddress( + std::make_shared("127.0.0.1", 8080)); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, "local"); + } + + { + socket.connection_info_provider_->setRemoteAddress( + std::make_shared("10.0.0.1")); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, absl::nullopt); + } +} + +TEST(MatchingData, ServerNameInput) { + ServerNameInput input; + MockConnectionSocket socket; + MatchingDataImpl data(socket); + + { + EXPECT_CALL(socket, requestedServerName).WillOnce(testing::Return("")); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, absl::nullopt); + } + + { + const auto host = "example.com"; + EXPECT_CALL(socket, requestedServerName).WillOnce(testing::Return(host)); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, host); + } +} + +TEST(MatchingData, TransportProtocolInput) { + TransportProtocolInput input; + MockConnectionSocket socket; + MatchingDataImpl data(socket); + + { + EXPECT_CALL(socket, detectedTransportProtocol).WillOnce(testing::Return("")); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, absl::nullopt); + } + + { + const auto protocol = "tls"; + EXPECT_CALL(socket, detectedTransportProtocol).WillOnce(testing::Return(protocol)); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, protocol); + } +} + +TEST(MatchingData, ApplicationProtocolInput) { + ApplicationProtocolInput input; + MockConnectionSocket socket; + MatchingDataImpl data(socket); + + { + std::vector protocols = {}; + EXPECT_CALL(socket, requestedApplicationProtocols).WillOnce(testing::ReturnRef(protocols)); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, absl::nullopt); + } + + { + std::vector protocols = {"h2c"}; + EXPECT_CALL(socket, requestedApplicationProtocols).WillOnce(testing::ReturnRef(protocols)); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, "'h2c'"); + } + + { + std::vector protocols = {"h2", "http/1.1"}; + EXPECT_CALL(socket, requestedApplicationProtocols).WillOnce(testing::ReturnRef(protocols)); + const auto result = input.get(data); + EXPECT_EQ(result.data_availability_, + Matcher::DataInputGetResult::DataAvailability::AllDataAvailable); + EXPECT_EQ(result.data_, "'h2','http/1.1'"); + } +} +} // namespace Matching +} // namespace Network +} // namespace Envoy From ebb06349cdbe909b3cf9dc517a2fe14d4136d069 Mon Sep 17 00:00:00 2001 From: Kuat Yessenov Date: Wed, 12 Jan 2022 13:28:36 -0800 Subject: [PATCH 05/10] coverage Signed-off-by: Kuat Yessenov --- source/common/network/matching/inputs.h | 134 ++++++++---------------- 1 file changed, 46 insertions(+), 88 deletions(-) diff --git a/source/common/network/matching/inputs.h b/source/common/network/matching/inputs.h index 83aeba60411a8..96d35be11723b 100644 --- a/source/common/network/matching/inputs.h +++ b/source/common/network/matching/inputs.h @@ -9,40 +9,46 @@ namespace Envoy { namespace Network { namespace Matching { -class DestinationIPInput : public Matcher::DataInput { -public: - Matcher::DataInputGetResult get(const MatchingData& data) const override; -}; +template +class BaseFactory : public Matcher::DataInputFactory { +protected: + explicit BaseFactory(const std::string& name) : name_(name) {} -class DestinationIPInputFactory : public Matcher::DataInputFactory { public: - std::string name() const override { return "destination-ip"; } + std::string name() const override { return name_; } Matcher::DataInputFactoryCb createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { - return []() { return std::make_unique(); }; + return []() { return std::make_unique(); }; }; ProtobufTypes::MessagePtr createEmptyConfigProto() override { - return std::make_unique(); + return std::make_unique(); } + +private: + const std::string name_; }; -class DestinationPortInput : public Matcher::DataInput { +class DestinationIPInput : public Matcher::DataInput { public: Matcher::DataInputGetResult get(const MatchingData& data) const override; }; -class DestinationPortInputFactory : public Matcher::DataInputFactory { +class DestinationIPInputFactory + : public BaseFactory { public: - std::string name() const override { return "destination-port"; } + DestinationIPInputFactory() : BaseFactory("destination-ip") {} +}; - Matcher::DataInputFactoryCb - createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { - return []() { return std::make_unique(); }; - }; - ProtobufTypes::MessagePtr createEmptyConfigProto() override { - return std::make_unique(); - } +class DestinationPortInput : public Matcher::DataInput { +public: + Matcher::DataInputGetResult get(const MatchingData& data) const override; +}; + +class DestinationPortInputFactory + : public BaseFactory { +public: + DestinationPortInputFactory() : BaseFactory("destination-port") {} }; class SourceIPInput : public Matcher::DataInput { @@ -50,17 +56,10 @@ class SourceIPInput : public Matcher::DataInput { Matcher::DataInputGetResult get(const MatchingData& data) const override; }; -class SourceIPInputFactory : public Matcher::DataInputFactory { +class SourceIPInputFactory + : public BaseFactory { public: - std::string name() const override { return "source-ip"; } - - Matcher::DataInputFactoryCb - createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { - return []() { return std::make_unique(); }; - }; - ProtobufTypes::MessagePtr createEmptyConfigProto() override { - return std::make_unique(); - } + SourceIPInputFactory() : BaseFactory("source-ip") {} }; class SourcePortInput : public Matcher::DataInput { @@ -68,17 +67,10 @@ class SourcePortInput : public Matcher::DataInput { Matcher::DataInputGetResult get(const MatchingData& data) const override; }; -class SourcePortInputFactory : public Matcher::DataInputFactory { +class SourcePortInputFactory + : public BaseFactory { public: - std::string name() const override { return "source-port"; } - - Matcher::DataInputFactoryCb - createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { - return []() { return std::make_unique(); }; - }; - ProtobufTypes::MessagePtr createEmptyConfigProto() override { - return std::make_unique(); - } + SourcePortInputFactory() : BaseFactory("source-port") {} }; class DirectSourceIPInput : public Matcher::DataInput { @@ -86,17 +78,10 @@ class DirectSourceIPInput : public Matcher::DataInput { Matcher::DataInputGetResult get(const MatchingData& data) const override; }; -class DirectSourceIPInputFactory : public Matcher::DataInputFactory { +class DirectSourceIPInputFactory + : public BaseFactory { public: - std::string name() const override { return "direct-source-ip"; } - - Matcher::DataInputFactoryCb - createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { - return []() { return std::make_unique(); }; - }; - ProtobufTypes::MessagePtr createEmptyConfigProto() override { - return std::make_unique(); - } + DirectSourceIPInputFactory() : BaseFactory("direct-source-ip") {} }; class SourceTypeInput : public Matcher::DataInput { @@ -104,17 +89,10 @@ class SourceTypeInput : public Matcher::DataInput { Matcher::DataInputGetResult get(const MatchingData& data) const override; }; -class SourceTypeInputFactory : public Matcher::DataInputFactory { +class SourceTypeInputFactory + : public BaseFactory { public: - std::string name() const override { return "source-type"; } - - Matcher::DataInputFactoryCb - createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { - return []() { return std::make_unique(); }; - }; - ProtobufTypes::MessagePtr createEmptyConfigProto() override { - return std::make_unique(); - } + SourceTypeInputFactory() : BaseFactory("source-type") {} }; class ServerNameInput : public Matcher::DataInput { @@ -122,17 +100,10 @@ class ServerNameInput : public Matcher::DataInput { Matcher::DataInputGetResult get(const MatchingData& data) const override; }; -class ServerNameInputFactory : public Matcher::DataInputFactory { +class ServerNameInputFactory + : public BaseFactory { public: - std::string name() const override { return "server-name"; } - - Matcher::DataInputFactoryCb - createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { - return []() { return std::make_unique(); }; - }; - ProtobufTypes::MessagePtr createEmptyConfigProto() override { - return std::make_unique(); - } + ServerNameInputFactory() : BaseFactory("server-name") {} }; class TransportProtocolInput : public Matcher::DataInput { @@ -140,17 +111,10 @@ class TransportProtocolInput : public Matcher::DataInput { Matcher::DataInputGetResult get(const MatchingData& data) const override; }; -class TransportProtocolInputFactory : public Matcher::DataInputFactory { +class TransportProtocolInputFactory + : public BaseFactory { public: - std::string name() const override { return "transport-protocol"; } - - Matcher::DataInputFactoryCb - createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { - return []() { return std::make_unique(); }; - }; - ProtobufTypes::MessagePtr createEmptyConfigProto() override { - return std::make_unique(); - } + TransportProtocolInputFactory() : BaseFactory("transport-protocol") {} }; class ApplicationProtocolInput : public Matcher::DataInput { @@ -158,17 +122,11 @@ class ApplicationProtocolInput : public Matcher::DataInput { Matcher::DataInputGetResult get(const MatchingData& data) const override; }; -class ApplicationProtocolInputFactory : public Matcher::DataInputFactory { +class ApplicationProtocolInputFactory + : public BaseFactory { public: - std::string name() const override { return "application-protocol"; } - - Matcher::DataInputFactoryCb - createDataInputFactoryCb(const Protobuf::Message&, ProtobufMessage::ValidationVisitor&) override { - return []() { return std::make_unique(); }; - }; - ProtobufTypes::MessagePtr createEmptyConfigProto() override { - return std::make_unique(); - } + ApplicationProtocolInputFactory() : BaseFactory("application-protocol") {} }; } // namespace Matching From 74275336beb41d4acd9581b721ae19ea4b8ce06b Mon Sep 17 00:00:00 2001 From: Kuat Yessenov Date: Wed, 12 Jan 2022 20:44:27 -0800 Subject: [PATCH 06/10] coverage Signed-off-by: Kuat Yessenov --- test/common/network/matching/inputs_test.cc | 1 + test/extensions/common/matcher/BUILD | 4 ++ .../common/matcher/trie_matcher_test.cc | 48 +++++++++++++++++++ 3 files changed, 53 insertions(+) diff --git a/test/common/network/matching/inputs_test.cc b/test/common/network/matching/inputs_test.cc index b3b733facaa75..45ab24cfdbfee 100644 --- a/test/common/network/matching/inputs_test.cc +++ b/test/common/network/matching/inputs_test.cc @@ -232,6 +232,7 @@ TEST(MatchingData, ApplicationProtocolInput) { EXPECT_EQ(result.data_, "'h2','http/1.1'"); } } + } // namespace Matching } // namespace Network } // namespace Envoy diff --git a/test/extensions/common/matcher/BUILD b/test/extensions/common/matcher/BUILD index e3724745b1443..a6a0bf0d0a5ad 100644 --- a/test/extensions/common/matcher/BUILD +++ b/test/extensions/common/matcher/BUILD @@ -23,10 +23,14 @@ envoy_cc_test( srcs = ["trie_matcher_test.cc"], deps = [ "//source/common/matcher:matcher_lib", + "//source/common/network:address_lib", + "//source/common/network/matching:data_impl_lib", + "//source/common/network/matching:inputs_lib", "//source/extensions/common/matcher:trie_matcher_lib", "//test/common/matcher:test_utility_lib", "//test/mocks/http:http_mocks", "//test/mocks/matcher:matcher_mocks", + "//test/mocks/network:network_mocks", "//test/mocks/server:factory_context_mocks", "//test/mocks/stream_info:stream_info_mocks", "//test/test_common:registry_lib", diff --git a/test/extensions/common/matcher/trie_matcher_test.cc b/test/extensions/common/matcher/trie_matcher_test.cc index d5c66ed71bb06..f345769528644 100644 --- a/test/extensions/common/matcher/trie_matcher_test.cc +++ b/test/extensions/common/matcher/trie_matcher_test.cc @@ -5,11 +5,14 @@ #include "envoy/registry/registry.h" #include "source/common/matcher/matcher.h" +#include "source/common/network/address_impl.h" +#include "source/common/network/matching/data_impl.h" #include "source/common/protobuf/utility.h" #include "source/extensions/common/matcher/trie_matcher.h" #include "test/common/matcher/test_utility.h" #include "test/mocks/matcher/mocks.h" +#include "test/mocks/network/mocks.h" #include "test/mocks/server/factory_context.h" #include "test/test_common/registry.h" #include "test/test_common/utility.h" @@ -441,6 +444,51 @@ TEST_F(TrieMatcherTest, NoData) { } } +TEST(TrieMatcherIntegrationTest, NetworkMatchingData) { + const std::string yaml = R"EOF( +matcher_tree: + input: + name: input + typed_config: + "@type": type.googleapis.com/envoy.type.matcher.v3.DestinationIPInput + custom_match: + name: ip_matcher + typed_config: + "@type": type.googleapis.com/xds.type.matcher.v3.IPMatcher + range_matchers: + - ranges: + - address_prefix: 192.0.0.0 + prefix_len: 2 + on_match: + action: + name: test_action + typed_config: + "@type": type.googleapis.com/google.protobuf.StringValue + value: foo + )EOF"; + xds::type::matcher::v3::Matcher matcher; + MessageUtil::loadFromYaml(yaml, matcher, ProtobufMessage::getStrictValidationVisitor()); + + StringActionFactory action_factory; + Registry::InjectFactory> inject_action(action_factory); + NiceMock factory_context; + MockMatchTreeValidationVisitor validation_visitor; + EXPECT_CALL(validation_visitor, performDataInputValidation(_, _)).Times(testing::AnyNumber()); + absl::string_view context = ""; + MatchTreeFactory matcher_factory( + context, factory_context, validation_visitor); + auto match_tree = matcher_factory.create(matcher); + + Network::MockConnectionSocket socket; + socket.connection_info_provider_->setLocalAddress( + std::make_shared("192.168.0.1", 8080)); + Network::Matching::MatchingDataImpl data(socket); + + const auto result = match_tree()->match(data); + EXPECT_EQ(result.match_state_, MatchState::MatchComplete); + EXPECT_EQ(result.on_match_->action_cb_()->getTyped().string_, "foo"); +} + } // namespace } // namespace Matcher } // namespace Common From 35850bb2773442c859b72df3138faa22081c304d Mon Sep 17 00:00:00 2001 From: Kuat Yessenov Date: Thu, 13 Jan 2022 10:58:00 -0800 Subject: [PATCH 07/10] limit listener language Signed-off-by: Kuat Yessenov --- api/envoy/type/matcher/v3/network_inputs.proto | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/api/envoy/type/matcher/v3/network_inputs.proto b/api/envoy/type/matcher/v3/network_inputs.proto index 49a1ab0818968..46928357b259d 100644 --- a/api/envoy/type/matcher/v3/network_inputs.proto +++ b/api/envoy/type/matcher/v3/network_inputs.proto @@ -3,7 +3,6 @@ syntax = "proto3"; package envoy.type.matcher.v3; import "udpa/annotations/status.proto"; -import "validate/validate.proto"; option java_package = "io.envoyproxy.envoy.type.matcher.v3"; option java_outer_classname = "NetworkInputsProto"; @@ -43,14 +42,14 @@ message DirectSourceIPInput { message SourceTypeInput { } -// Input that matches by the requested server name (e.g. SNI in TLS), when detected by one of the listener filters. +// Input that matches by the requested server name (e.g. SNI in TLS). // -// :ref:`TLS Inspector ` provides the requested server name based on SNI. +// :ref:`TLS Inspector ` provides the requested server name based on SNI, +// when TLS protocol is detected. message ServerNameInput { } -// Input that matches by the transport protocol, when -// detected by one of the listener filters. +// Input that matches by the transport protocol. // // Suggested values include: // @@ -60,7 +59,9 @@ message ServerNameInput { message TransportProtocolInput { } -// List of quoted and comma-separated requested application protocols, when detected by one of the listener filters. +// List of quoted and comma-separated requested application protocols. The list consists of a +// single negotiated application protocol once the network stream is established. +// // Examples: // // * ``'h2','http/1.1'`` From eeef2bf615212a36c5cbad5f6dc0a57e52f9caa9 Mon Sep 17 00:00:00 2001 From: Kuat Yessenov Date: Mon, 24 Jan 2022 12:16:10 -0800 Subject: [PATCH 08/10] review Signed-off-by: Kuat Yessenov --- .../matching/common_inputs/network/v3/BUILD | 9 +++++ .../network}/v3/network_inputs.proto | 6 +-- api/versioning/BUILD | 1 + .../common_messages/common_messages.rst | 1 + docs/root/api-v3/types/types.rst | 1 - source/common/network/matching/BUILD | 2 +- source/common/network/matching/data_impl.h | 1 - source/common/network/matching/inputs.h | 37 +++++++++++++------ .../common/matcher/trie_matcher_test.cc | 2 +- 9 files changed, 41 insertions(+), 19 deletions(-) create mode 100644 api/envoy/extensions/matching/common_inputs/network/v3/BUILD rename api/envoy/{type/matcher => extensions/matching/common_inputs/network}/v3/network_inputs.proto (93%) diff --git a/api/envoy/extensions/matching/common_inputs/network/v3/BUILD b/api/envoy/extensions/matching/common_inputs/network/v3/BUILD new file mode 100644 index 0000000000000..ee92fb652582e --- /dev/null +++ b/api/envoy/extensions/matching/common_inputs/network/v3/BUILD @@ -0,0 +1,9 @@ +# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py. + +load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package") + +licenses(["notice"]) # Apache 2 + +api_proto_package( + deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"], +) diff --git a/api/envoy/type/matcher/v3/network_inputs.proto b/api/envoy/extensions/matching/common_inputs/network/v3/network_inputs.proto similarity index 93% rename from api/envoy/type/matcher/v3/network_inputs.proto rename to api/envoy/extensions/matching/common_inputs/network/v3/network_inputs.proto index 46928357b259d..8f54d34587026 100644 --- a/api/envoy/type/matcher/v3/network_inputs.proto +++ b/api/envoy/extensions/matching/common_inputs/network/v3/network_inputs.proto @@ -1,13 +1,13 @@ syntax = "proto3"; -package envoy.type.matcher.v3; +package envoy.extensions.matching.common_inputs.network.v3; import "udpa/annotations/status.proto"; -option java_package = "io.envoyproxy.envoy.type.matcher.v3"; +option java_package = "io.envoyproxy.envoy.extensions.matching.common_inputs.network.v3"; option java_outer_classname = "NetworkInputsProto"; option java_multiple_files = true; -option go_package = "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3;matcherv3"; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/common_inputs/network/v3;networkv3"; option (udpa.annotations.file_status).package_version_status = ACTIVE; // [#protodoc-title: Common Network Matching Inputs] diff --git a/api/versioning/BUILD b/api/versioning/BUILD index 3397139697590..ec1462ad2d571 100644 --- a/api/versioning/BUILD +++ b/api/versioning/BUILD @@ -159,6 +159,7 @@ proto_library( "//envoy/extensions/load_balancing_policies/round_robin/v3:pkg", "//envoy/extensions/load_balancing_policies/wrr_locality/v3:pkg", "//envoy/extensions/matching/common_inputs/environment_variable/v3:pkg", + "//envoy/extensions/matching/common_inputs/network/v3:pkg", "//envoy/extensions/matching/input_matchers/consistent_hashing/v3:pkg", "//envoy/extensions/matching/input_matchers/ip/v3:pkg", "//envoy/extensions/network/dns_resolver/apple/v3:pkg", diff --git a/docs/root/api-v3/common_messages/common_messages.rst b/docs/root/api-v3/common_messages/common_messages.rst index d14a59db966c2..8462681ee1bf1 100644 --- a/docs/root/api-v3/common_messages/common_messages.rst +++ b/docs/root/api-v3/common_messages/common_messages.rst @@ -31,3 +31,4 @@ Common messages ../extensions/matching/input_matchers/consistent_hashing/v3/consistent_hashing.proto ../extensions/matching/input_matchers/ip/v3/ip.proto ../extensions/matching/common_inputs/environment_variable/v3/input.proto + ../extensions/matching/common_inputs/network/v3/network_inputs.proto diff --git a/docs/root/api-v3/types/types.rst b/docs/root/api-v3/types/types.rst index b5c8ac8f3801c..a86620519ff87 100644 --- a/docs/root/api-v3/types/types.rst +++ b/docs/root/api-v3/types/types.rst @@ -24,6 +24,5 @@ Types ../type/matcher/v3/struct.proto ../type/matcher/v3/value.proto ../type/matcher/v3/http_inputs.proto - ../type/matcher/v3/network_inputs.proto ../type/metadata/v3/metadata.proto ../type/tracing/v3/custom_tag.proto diff --git a/source/common/network/matching/BUILD b/source/common/network/matching/BUILD index 2611c953b2d7d..dce37cb6a2dc8 100644 --- a/source/common/network/matching/BUILD +++ b/source/common/network/matching/BUILD @@ -25,6 +25,6 @@ envoy_cc_library( "//envoy/network:filter_interface", "//envoy/registry", "//source/common/network:utility_lib", - "@envoy_api//envoy/type/matcher/v3:pkg_cc_proto", + "@envoy_api//envoy/extensions/matching/common_inputs/network/v3:pkg_cc_proto", ], ) diff --git a/source/common/network/matching/data_impl.h b/source/common/network/matching/data_impl.h index 9190083edf21f..eab575d79a4ed 100644 --- a/source/common/network/matching/data_impl.h +++ b/source/common/network/matching/data_impl.h @@ -13,7 +13,6 @@ namespace Matching { class MatchingDataImpl : public MatchingData { public: MatchingDataImpl(const ConnectionSocket& socket) : socket_(socket) {} - static absl::string_view name() { return "network"; } const ConnectionSocket& socket() const override { return socket_; } private: diff --git a/source/common/network/matching/inputs.h b/source/common/network/matching/inputs.h index 96d35be11723b..20bb872e36edf 100644 --- a/source/common/network/matching/inputs.h +++ b/source/common/network/matching/inputs.h @@ -1,9 +1,9 @@ #pragma once +#include "envoy/extensions/matching/common_inputs/network/v3/network_inputs.pb.h" +#include "envoy/extensions/matching/common_inputs/network/v3/network_inputs.pb.validate.h" #include "envoy/matcher/matcher.h" #include "envoy/network/filter.h" -#include "envoy/type/matcher/v3/network_inputs.pb.h" -#include "envoy/type/matcher/v3/network_inputs.pb.validate.h" namespace Envoy { namespace Network { @@ -35,7 +35,9 @@ class DestinationIPInput : public Matcher::DataInput { }; class DestinationIPInputFactory - : public BaseFactory { + : public BaseFactory< + DestinationIPInput, + envoy::extensions::matching::common_inputs::network::v3::DestinationIPInput> { public: DestinationIPInputFactory() : BaseFactory("destination-ip") {} }; @@ -46,7 +48,9 @@ class DestinationPortInput : public Matcher::DataInput { }; class DestinationPortInputFactory - : public BaseFactory { + : public BaseFactory< + DestinationPortInput, + envoy::extensions::matching::common_inputs::network::v3::DestinationPortInput> { public: DestinationPortInputFactory() : BaseFactory("destination-port") {} }; @@ -57,7 +61,8 @@ class SourceIPInput : public Matcher::DataInput { }; class SourceIPInputFactory - : public BaseFactory { + : public BaseFactory { public: SourceIPInputFactory() : BaseFactory("source-ip") {} }; @@ -68,7 +73,8 @@ class SourcePortInput : public Matcher::DataInput { }; class SourcePortInputFactory - : public BaseFactory { + : public BaseFactory { public: SourcePortInputFactory() : BaseFactory("source-port") {} }; @@ -79,7 +85,9 @@ class DirectSourceIPInput : public Matcher::DataInput { }; class DirectSourceIPInputFactory - : public BaseFactory { + : public BaseFactory< + DirectSourceIPInput, + envoy::extensions::matching::common_inputs::network::v3::DirectSourceIPInput> { public: DirectSourceIPInputFactory() : BaseFactory("direct-source-ip") {} }; @@ -90,7 +98,8 @@ class SourceTypeInput : public Matcher::DataInput { }; class SourceTypeInputFactory - : public BaseFactory { + : public BaseFactory { public: SourceTypeInputFactory() : BaseFactory("source-type") {} }; @@ -101,7 +110,8 @@ class ServerNameInput : public Matcher::DataInput { }; class ServerNameInputFactory - : public BaseFactory { + : public BaseFactory { public: ServerNameInputFactory() : BaseFactory("server-name") {} }; @@ -112,7 +122,9 @@ class TransportProtocolInput : public Matcher::DataInput { }; class TransportProtocolInputFactory - : public BaseFactory { + : public BaseFactory< + TransportProtocolInput, + envoy::extensions::matching::common_inputs::network::v3::TransportProtocolInput> { public: TransportProtocolInputFactory() : BaseFactory("transport-protocol") {} }; @@ -123,8 +135,9 @@ class ApplicationProtocolInput : public Matcher::DataInput { }; class ApplicationProtocolInputFactory - : public BaseFactory { + : public BaseFactory< + ApplicationProtocolInput, + envoy::extensions::matching::common_inputs::network::v3::ApplicationProtocolInput> { public: ApplicationProtocolInputFactory() : BaseFactory("application-protocol") {} }; diff --git a/test/extensions/common/matcher/trie_matcher_test.cc b/test/extensions/common/matcher/trie_matcher_test.cc index f345769528644..ddf41211576fb 100644 --- a/test/extensions/common/matcher/trie_matcher_test.cc +++ b/test/extensions/common/matcher/trie_matcher_test.cc @@ -450,7 +450,7 @@ TEST(TrieMatcherIntegrationTest, NetworkMatchingData) { input: name: input typed_config: - "@type": type.googleapis.com/envoy.type.matcher.v3.DestinationIPInput + "@type": type.googleapis.com/envoy.extensions.matching.common_inputs.network.v3.DestinationIPInput custom_match: name: ip_matcher typed_config: From 93fd7fb42921bc36e1ac5c168c0d6943e06933d0 Mon Sep 17 00:00:00 2001 From: Kuat Yessenov Date: Mon, 24 Jan 2022 13:05:51 -0800 Subject: [PATCH 09/10] fix docs Signed-off-by: Kuat Yessenov --- api/BUILD | 1 + 1 file changed, 1 insertion(+) diff --git a/api/BUILD b/api/BUILD index 2caeb712b65e8..1cf18ef314de6 100644 --- a/api/BUILD +++ b/api/BUILD @@ -219,6 +219,7 @@ proto_library( "//envoy/extensions/internal_redirect/safe_cross_scheme/v3:pkg", "//envoy/extensions/key_value/file_based/v3:pkg", "//envoy/extensions/matching/common_inputs/environment_variable/v3:pkg", + "//envoy/extensions/matching/common_inputs/network/v3:pkg", "//envoy/extensions/matching/input_matchers/consistent_hashing/v3:pkg", "//envoy/extensions/matching/input_matchers/ip/v3:pkg", "//envoy/extensions/network/dns_resolver/apple/v3:pkg", From a35a28a50c5eff33e8e0ec2e70c0ef5c17d7a1e1 Mon Sep 17 00:00:00 2001 From: Kuat Yessenov Date: Wed, 26 Jan 2022 09:19:52 -0800 Subject: [PATCH 10/10] review Signed-off-by: Kuat Yessenov --- source/common/network/matching/data_impl.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/common/network/matching/data_impl.h b/source/common/network/matching/data_impl.h index eab575d79a4ed..c8fd65b29f262 100644 --- a/source/common/network/matching/data_impl.h +++ b/source/common/network/matching/data_impl.h @@ -12,7 +12,7 @@ namespace Matching { */ class MatchingDataImpl : public MatchingData { public: - MatchingDataImpl(const ConnectionSocket& socket) : socket_(socket) {} + explicit MatchingDataImpl(const ConnectionSocket& socket) : socket_(socket) {} const ConnectionSocket& socket() const override { return socket_; } private: