Support for external authorization grpc service.

bazel/repositories.bzl

@@ -170,6 +170,7 @@ def _envoy_api_deps():
         "rate_limit",
         "router",
         "transcoder",
+        "ext_authz",
     ]
     for t in http_filter_bind_targets:
         native.bind(
@@ -183,6 +184,7 @@ def _envoy_api_deps():
         "redis_proxy",
         "rate_limit",
         "client_ssl_auth",
+        "ext_authz",
     ]
     for t in network_filter_bind_targets:
         native.bind(
@@ -197,6 +199,14 @@ def _envoy_api_deps():
         name = "http_api_protos",
         actual = "@googleapis//:http_api_protos",
     )
+    auth_bind_targets = [
+        "auth"
+    ]
+    for t in auth_bind_targets:
+        native.bind(
+            name = "envoy_api_auth_" + t,
+            actual = "@envoy_api//api/auth:" + t + "_cc",
+        )
 
 def envoy_dependencies(path = "@envoy_deps//", skip_targets = []):
     envoy_repository = repository_rule(

include/envoy/ext_authz/BUILD

@@ -0,0 +1,23 @@
+licenses(["notice"])  # Apache 2
+
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_package",
+)
+
+envoy_package()
+
+envoy_cc_library(
+    name = "ext_authz_interface",
+    hdrs = ["ext_authz.h"],
+    external_deps = ["envoy_api_auth_auth"],
+    deps = [
+        "//include/envoy/common:optional",
+        "//include/envoy/http:filter_interface",
+        "//include/envoy/http:header_map_interface",
+        "//include/envoy/network:filter_interface",
+        "//include/envoy/tracing:http_tracer_interface",
+    ],
+)
+

include/envoy/ext_authz/ext_authz.h

@@ -0,0 +1,102 @@
+#pragma once
+
+#include <chrono>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "envoy/common/optional.h"
+#include "envoy/common/pure.h"
+#include "envoy/http/filter.h"
+#include "envoy/http/header_map.h"
+#include "envoy/network/filter.h"
+#include "envoy/tracing/http_tracer.h"
+
+#include "api/auth/external_auth.pb.h"
+
+namespace Envoy {
+namespace ExtAuthz {
+
+/**
+ * Possible async results for a check call.
+ */
+enum class CheckStatus {
+  // The request is authorized.
+  OK,
+  // The authz service could not be queried.
+  Error,
+  // The request is denied.
+  Denied
+};
+
+/**
+ * Async callbacks used during check() calls.
+ */
+class RequestCallbacks {
+public:
+  virtual ~RequestCallbacks() {}
+
+  /**
+   * Called when a check request is complete. The resulting status is supplied.
+   */
+  virtual void complete(CheckStatus status) PURE;
+};
+
+
+class Client {
+ public:
+  // Destructor
+  virtual ~Client() {}
+
+  /**
+   * Cancel an inflight Check request.
+   */
+  virtual void cancel() PURE;
+
+  // A check call.
+  virtual void check(RequestCallbacks &callback, const envoy::api::v2::auth::CheckRequest& request,
+                     Tracing::Span& parent_span) PURE;
+
+};
+
+typedef std::unique_ptr<Client> ClientPtr;
+
+/**
+ * An interface for creating a  external authorization client.
+ */
+class ClientFactory {
+public:
+  virtual ~ClientFactory() {}
+
+  /**
+   * Return a new authz client.
+   */
+  virtual ClientPtr create(const Optional<std::chrono::milliseconds>& timeout) PURE;
+};
+
+typedef std::unique_ptr<ClientFactory> ClientFactoryPtr;
+
+
+/**
+ * An interface for creating ext_authz.proto (authorization) request.
+ * CheckRequestGenerator is used to extract attributes from the TCP/HTTP request
+ * and fill out the details in the authorization protobuf that is sent to authorization
+ * service.
+ */
+class CheckRequestGenerator {
+public:
+    // Destructor
+  virtual ~CheckRequestGenerator() {}
+
+  virtual void createHttpCheck(const Envoy::Http::StreamDecoderFilterCallbacks* callbacks,
+                               const Envoy::Http::HeaderMap &headers,
+                               envoy::api::v2::auth::CheckRequest& request) PURE;
+  virtual void createTcpCheck(const Network::ReadFilterCallbacks* callbacks,
+                              envoy::api::v2::auth::CheckRequest& request) PURE;
+};
+
+typedef std::unique_ptr<CheckRequestGenerator> CheckRequestGeneratorPtr;
+
+} // namespace ExtAuthz
+} // namespace Envoy
+

include/envoy/request_info/request_info.h

@@ -43,8 +43,10 @@ enum ResponseFlag {
   FaultInjected = 0x400,
   // Request was ratelimited locally by rate limit filter.
   RateLimited = 0x800,
+  // Request was unauthorized.
+  Unauthorized = 0x1000,
   // ATTENTION: MAKE SURE THIS REMAINS EQUAL TO THE LAST FLAG.
-  LastFlag = RateLimited
+  LastFlag = Unauthorized
 };
 
 /**

source/common/access_log/grpc_access_log_impl.cc

@@ -81,7 +81,7 @@ void HttpGrpcAccessLog::responseFlagsToAccessLogResponseFlags(
     envoy::api::v2::filter::accesslog::AccessLogCommon& common_access_log,
     const RequestInfo::RequestInfo& request_info) {
 
-  static_assert(RequestInfo::ResponseFlag::LastFlag == 0x800,
+  static_assert(RequestInfo::ResponseFlag::LastFlag == 0x1000,
                 "A flag has been added. Fix this code.");
 
   if (request_info.getResponseFlag(RequestInfo::ResponseFlag::FailedLocalHealthCheck)) {
@@ -131,6 +131,13 @@ void HttpGrpcAccessLog::responseFlagsToAccessLogResponseFlags(
   if (request_info.getResponseFlag(RequestInfo::ResponseFlag::RateLimited)) {
     common_access_log.mutable_response_flags()->set_rate_limited(true);
   }
+
+  // TODO(saumoh): Uncomment once unauthorization has been added to accesslog.proto
+  //
+  // if (request_info.getResponseFlag(RequestInfo::ResponseFlag::Unauthorized)) {
+  //  common_access_log.mutable_response_flags()->set_unauthorized(true);
+  // }
+
 }
 
 void HttpGrpcAccessLog::log(const Http::HeaderMap* request_headers,

source/common/config/well_known_names.h

@@ -66,13 +66,15 @@ class NetworkFilterNameValues {
   const std::string REDIS_PROXY = "envoy.redis_proxy";
   // IP tagging filter
   const std::string TCP_PROXY = "envoy.tcp_proxy";
+  // Authorization filter
+  const std::string EXT_AUTHORIZATION = "envoy.ext_authz";
 
   // Converts names from v1 to v2
   const V1Converter v1_converter_;
 
   NetworkFilterNameValues()
       : v1_converter_({CLIENT_SSL_AUTH, ECHO, HTTP_CONNECTION_MANAGER, MONGO_PROXY, RATE_LIMIT,
-                       REDIS_PROXY, TCP_PROXY}) {}
+                       REDIS_PROXY, TCP_PROXY, EXT_AUTHORIZATION}) {}
 };
 
 typedef ConstSingleton<NetworkFilterNameValues> NetworkFilterNames;
@@ -117,13 +119,16 @@ class HttpFilterNameValues {
   const std::string HEALTH_CHECK = "envoy.health_check";
   // Lua filter
   const std::string LUA = "envoy.lua";
+  // External Authorization filter
+  const std::string EXT_AUTHORIZATION = "envoy.ext_authz";
+
 
   // Converts names from v1 to v2
   const V1Converter v1_converter_;
 
   HttpFilterNameValues()
       : v1_converter_({BUFFER, CORS, DYNAMO, FAULT, GRPC_HTTP1_BRIDGE, GRPC_JSON_TRANSCODER,
-                       GRPC_WEB, HEALTH_CHECK, IP_TAGGING, RATE_LIMIT, ROUTER, LUA}) {}
+                       GRPC_WEB, HEALTH_CHECK, IP_TAGGING, RATE_LIMIT, ROUTER, LUA, EXT_AUTHORIZATION}) {}
 };
 
 typedef ConstSingleton<HttpFilterNameValues> HttpFilterNames;

source/common/ext_authz/BUILD

@@ -0,0 +1,30 @@
+licenses(["notice"])  # Apache 2
+
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_package",
+)
+
+envoy_package()
+
+envoy_cc_library(
+    name = "ext_authz_lib",
+    srcs = ["ext_authz_impl.cc"],
+    hdrs = ["ext_authz_impl.h"],
+    deps = [
+        "//include/envoy/ext_authz:ext_authz_interface",
+        "//include/envoy/grpc:async_client_interface",
+        "//include/envoy/grpc:async_client_manager_interface",
+        "//include/envoy/http:protocol_interface",
+        "//include/envoy/network:address_interface",
+        "//include/envoy/network:connection_interface",
+        "//include/envoy/upstream:cluster_manager_interface",
+        "//include/envoy/ssl:connection_interface",
+        "//source/common/common:assert_lib",
+        "//source/common/grpc:async_client_lib",
+        "//source/common/http:headers_lib",
+        "//source/common/tracing:http_tracer_lib",
+    ],
+)
+