authz_filter: extended ext_authz to support v2alpha api

api/envoy/service/auth/v2alpha/external_auth.proto

@@ -24,21 +24,24 @@ message CheckRequest {
   AttributeContext attributes = 1;
 }
 
+// An message that contains HTTP response attributes. This message is
+// used when the authorization service needs to send custom responses to the
+// downstream client or, to modify/add request headers being dispatched to the upstream.
+message HttpResponse {
+  // Http status code.
+  uint32 status_code = 1 [(validate.rules).uint32 = {gte: 100, lt: 600}];
+
+  // Http entity headers.
+  map<string, string> headers = 2;
+
+  // Http entity body.
+  string body = 3;
+}
+
 message CheckResponse {
   // Status `OK` allows the request. Any other status indicates the request should be denied.
   google.rpc.Status status = 1;
 
-  // An optional message that contains HTTP response attributes. This message is
-  // used when the authorization service needs to send custom responses to the
-  // downstream client or, to modify/add request headers being dispatched to the upstream.
-  message HttpResponse {
-    // Http status code.
-    uint32 status_code = 1 [(validate.rules).uint32 = {gte: 100, lt: 600}];
-
-    // Http entity headers.
-    map<string, string> headers = 2;
-
-    // Http entity body.
-    string body = 3;
-  }
+  // A field that supplies the attributes for an HTTP response.
+  HttpResponse http_response = 2;
 }

source/extensions/filters/common/ext_authz/BUILD

@@ -34,6 +34,7 @@ envoy_cc_library(
         "//include/envoy/ssl:connection_interface",
         "//include/envoy/upstream:cluster_manager_interface",
         "//source/common/common:assert_lib",
+        "//source/common/buffer:buffer_lib",
         "//source/common/grpc:async_client_lib",
         "//source/common/http:headers_lib",
         "//source/common/http:utility_lib",

source/extensions/filters/common/ext_authz/ext_authz.h

@@ -27,6 +27,24 @@ enum class CheckStatus {
   Denied
 };
 
+typedef std::vector<std::pair<Http::LowerCaseString, std::string>> KeyValueHeaders;
+
+/**
+ * Authorization response object for a RequestCallback.
+ */
+struct Response {
+  // Call status.
+  CheckStatus status;
+  // Optional http headers attribute.
+  KeyValueHeaders headers;
+  // Optional http body attribute.
+  Buffer::InstancePtr body;
+  // Extra http status code attribute.
+  uint32_t status_code;
+};
+
+typedef std::unique_ptr<Response> ResponsePtr;
+
 /**
  * Async callbacks used during check() calls.
  */
@@ -35,9 +53,9 @@ class RequestCallbacks {
   virtual ~RequestCallbacks() {}
 
   /**
-   * Called when a check request is complete. The resulting status is supplied.
+   * Called when a check request is complete. The resulting ResponsePtr is supplied.
    */
-  virtual void onComplete(CheckStatus status) PURE;
+  virtual void onComplete(ResponsePtr&& response) PURE;
 };
 
 class Client {

source/extensions/filters/common/ext_authz/ext_authz_impl.cc

@@ -8,6 +8,7 @@
 #include "envoy/access_log/access_log.h"
 #include "envoy/ssl/connection.h"
 
+#include "common/buffer/buffer_impl.h"
 #include "common/common/assert.h"
 #include "common/grpc/async_client_impl.h"
 #include "common/http/headers.h"
@@ -47,23 +48,39 @@ void GrpcClientImpl::check(RequestCallbacks& callbacks,
 
 void GrpcClientImpl::onSuccess(
     std::unique_ptr<envoy::service::auth::v2alpha::CheckResponse>&& response, Tracing::Span& span) {
-  CheckStatus status = CheckStatus::OK;
+
   ASSERT(response->status().code() != Grpc::Status::GrpcStatus::Unknown);
+  ResponsePtr authz_response = std::make_unique<Response>();
+
+  if (response->has_http_response()) {
+    for (const auto& header : response->http_response().headers()) {
+      authz_response->headers.emplace_back(
+          std::make_pair(Http::LowerCaseString(header.first), header.second));
+    }
+    if (!response->http_response().body().empty()) {
+      authz_response->body = std::make_unique<Buffer::OwnedImpl>(response->http_response().body());
+    }
+  }
+
   if (response->status().code() != Grpc::Status::GrpcStatus::Ok) {
-    status = CheckStatus::Denied;
     span.setTag(Constants::get().TraceStatus, Constants::get().TraceUnauthz);
+    authz_response->status = CheckStatus::Denied;
+    authz_response->status_code = response->http_response().status_code();
   } else {
     span.setTag(Constants::get().TraceStatus, Constants::get().TraceOk);
+    authz_response->status = CheckStatus::OK;
   }
 
-  callbacks_->onComplete(status);
+  callbacks_->onComplete(std::move(authz_response));
   callbacks_ = nullptr;
 }
 
 void GrpcClientImpl::onFailure(Grpc::Status::GrpcStatus status, const std::string&,
                                Tracing::Span&) {
   ASSERT(status != Grpc::Status::GrpcStatus::Ok);
-  callbacks_->onComplete(CheckStatus::Error);
+  ResponsePtr response = std::make_unique<Response>();
+  response->status = CheckStatus::Error;
+  callbacks_->onComplete(std::move(response));
   callbacks_ = nullptr;
 }
 

source/extensions/filters/http/ext_authz/BUILD

@@ -16,6 +16,7 @@ envoy_cc_library(
     hdrs = ["ext_authz.h"],
     deps = [
         "//include/envoy/http:codes_interface",
+        "//source/common/buffer:buffer_lib",
         "//source/common/common:assert_lib",
         "//source/common/common:empty_string",
         "//source/common/common:enum_to_int",

source/extensions/filters/http/ext_authz/ext_authz.cc

@@ -20,13 +20,11 @@ namespace HttpFilters {
 namespace ExtAuthz {
 
 namespace {
-
 const Http::HeaderMap* getDeniedHeader() {
   static const Http::HeaderMap* header_map = new Http::HeaderMapImpl{
       {Http::Headers::get().Status, std::to_string(enumToInt(Http::Code::Forbidden))}};
   return header_map;
 }
-
 } // namespace
 
 void Filter::initiateCall(const Http::HeaderMap& headers) {
@@ -52,6 +50,7 @@ void Filter::initiateCall(const Http::HeaderMap& headers) {
 }
 
 Http::FilterHeadersStatus Filter::decodeHeaders(Http::HeaderMap& headers, bool) {
+  request_headers_ = &headers;
   initiateCall(headers);
   return state_ == State::Calling ? Http::FilterHeadersStatus::StopIteration
                                   : Http::FilterHeadersStatus::Continue;
@@ -78,14 +77,16 @@ void Filter::onDestroy() {
   }
 }
 
-void Filter::onComplete(Filters::Common::ExtAuthz::CheckStatus status) {
+void Filter::onComplete(Filters::Common::ExtAuthz::ResponsePtr&& response) {
   ASSERT(cluster_);
-
   state_ = State::Complete;
 
   using Filters::Common::ExtAuthz::CheckStatus;
 
-  switch (status) {
+  const bool update_status_code = response->status_code >= enumToInt(Http::Code::Continue) &&
+                                  response->status_code != enumToInt(Http::Code::Forbidden);
+
+  switch (response->status) {
   case CheckStatus::OK:
     cluster_->statsScope().counter("ext_authz.ok").inc();
     break;
@@ -94,35 +95,59 @@ void Filter::onComplete(Filters::Common::ExtAuthz::CheckStatus status) {
     break;
   case CheckStatus::Denied:
     cluster_->statsScope().counter("ext_authz.denied").inc();
-    Http::CodeUtility::ResponseStatInfo info{config_->scope(),
-                                             cluster_->statsScope(),
-                                             EMPTY_STRING,
-                                             enumToInt(Http::Code::Forbidden),
-                                             true,
-                                             EMPTY_STRING,
-                                             EMPTY_STRING,
-                                             EMPTY_STRING,
-                                             EMPTY_STRING,
-                                             false};
+    Http::CodeUtility::ResponseStatInfo info{
+        config_->scope(),
+        cluster_->statsScope(),
+        EMPTY_STRING,
+        (update_status_code ? response->status_code : enumToInt(Http::Code::Forbidden)),
+        true,
+        EMPTY_STRING,
+        EMPTY_STRING,
+        EMPTY_STRING,
+        EMPTY_STRING,
+        false};
     Http::CodeUtility::chargeResponseStat(info);
     break;
   }
 
   // We fail open/fail close based of filter config
   // if there is an error contacting the service.
-  if (status == CheckStatus::Denied ||
-      (status == CheckStatus::Error && !config_->failureModeAllow())) {
-    Http::HeaderMapPtr response_headers{new Http::HeaderMapImpl(*getDeniedHeader())};
-    callbacks_->encodeHeaders(std::move(response_headers), true);
+  if (response->status == CheckStatus::Denied ||
+      (response->status == CheckStatus::Error && !config_->failureModeAllow())) {
+    Http::HeaderMapPtr response_headers;
+    if (update_status_code) {
+      response_headers = std::make_unique<Http::HeaderMapImpl>(Http::HeaderMapImpl{
+          {Http::Headers::get().Status, std::to_string(response->status_code)}});
+    } else {
+      response_headers = std::make_unique<Http::HeaderMapImpl>(*getDeniedHeader());
+    }
+
+    for (const auto& header : response->headers) {
+      response_headers->setReferenceKey(header.first, header.second);
+    }
+
+    if (response->body) {
+      callbacks_->encodeHeaders(std::move(response_headers), false);
+      callbacks_->encodeData(*response->body.get(), true);
+    } else {
+      callbacks_->encodeHeaders(std::move(response_headers), true);
+    }
+
     callbacks_->requestInfo().setResponseFlag(
         RequestInfo::ResponseFlag::UnauthorizedExternalService);
   } else {
-    if (config_->failureModeAllow() && status == CheckStatus::Error) {
+    if (config_->failureModeAllow() && response->status == CheckStatus::Error) {
       // Status is Error and yet we are allowing the request. Click a counter.
       cluster_->statsScope().counter("ext_authz.failure_mode_allowed").inc();
     }
+
     // We can get completion inline, so only call continue if that isn't happening.
     if (!initiating_call_) {
+      if (response->status == CheckStatus::OK) {
+        for (const auto& header : response->headers) {
+          request_headers_->setReferenceKey(header.first, header.second);
+        }
+      }
       callbacks_->continueDecoding();
     }
   }

source/extensions/filters/http/ext_authz/ext_authz.h

@@ -77,7 +77,7 @@ class Filter : public Http::StreamDecoderFilter,
   void setDecoderFilterCallbacks(Http::StreamDecoderFilterCallbacks& callbacks) override;
 
   // ExtAuthz::RequestCallbacks
-  void onComplete(Filters::Common::ExtAuthz::CheckStatus status) override;
+  void onComplete(Filters::Common::ExtAuthz::ResponsePtr&&) override;
 
 private:
   enum class State { NotStarted, Calling, Complete };
@@ -86,6 +86,7 @@ class Filter : public Http::StreamDecoderFilter,
   FilterConfigSharedPtr config_;
   Filters::Common::ExtAuthz::ClientPtr client_;
   Http::StreamDecoderFilterCallbacks* callbacks_{};
+  Http::HeaderMap* request_headers_;
   State state_{State::NotStarted};
   Upstream::ClusterInfoConstSharedPtr cluster_;
   bool initiating_call_{};

source/extensions/filters/network/ext_authz/ext_authz.cc

@@ -56,11 +56,11 @@ void Filter::onEvent(Network::ConnectionEvent event) {
   }
 }
 
-void Filter::onComplete(Filters::Common::ExtAuthz::CheckStatus status) {
+void Filter::onComplete(Filters::Common::ExtAuthz::ResponsePtr&& response) {
   status_ = Status::Complete;
   config_->stats().active_.dec();
 
-  switch (status) {
+  switch (response->status) {
   case Filters::Common::ExtAuthz::CheckStatus::OK:
     config_->stats().ok_.inc();
     break;
@@ -73,12 +73,14 @@ void Filter::onComplete(Filters::Common::ExtAuthz::CheckStatus status) {
   }
 
   // Fail open only if configured to do so and if the check status was a error.
-  if (status == Filters::Common::ExtAuthz::CheckStatus::Denied ||
-      (status == Filters::Common::ExtAuthz::CheckStatus::Error && !config_->failureModeAllow())) {
+  if (response->status == Filters::Common::ExtAuthz::CheckStatus::Denied ||
+      (response->status == Filters::Common::ExtAuthz::CheckStatus::Error &&
+       !config_->failureModeAllow())) {
     config_->stats().cx_closed_.inc();
     filter_callbacks_->connection().close(Network::ConnectionCloseType::NoFlush);
   } else {
-    if (config_->failureModeAllow() && status == Filters::Common::ExtAuthz::CheckStatus::Error) {
+    if (config_->failureModeAllow() &&
+        response->status == Filters::Common::ExtAuthz::CheckStatus::Error) {
       // Status is Error and yet we are configured to allow traffic. Click a counter.
       config_->stats().failure_mode_allowed_.inc();
     }

source/extensions/filters/network/ext_authz/ext_authz.h

@@ -90,7 +90,7 @@ class Filter : public Network::ReadFilter,
   void onBelowWriteBufferLowWatermark() override {}
 
   // ExtAuthz::RequestCallbacks
-  void onComplete(Filters::Common::ExtAuthz::CheckStatus status) override;
+  void onComplete(Filters::Common::ExtAuthz::ResponsePtr&&) override;
 
 private:
   enum class Status { NotStarted, Calling, Complete };

test/extensions/filters/common/ext_authz/ext_authz_impl_test.cc

@@ -38,7 +38,9 @@ namespace ExtAuthz {
 
 class MockRequestCallbacks : public RequestCallbacks {
 public:
-  MOCK_METHOD1(onComplete, void(CheckStatus status));
+  void onComplete(ResponsePtr&& response) override { onComplete_(response); }
+
+  MOCK_METHOD1(onComplete_, void(ResponsePtr& response));
 };
 
 class ExtAuthzGrpcClientTest : public testing::Test {
@@ -68,7 +70,7 @@ TEST_F(ExtAuthzGrpcClientTest, BasicOK) {
   auto status = response->mutable_status();
   status->set_code(Grpc::Status::GrpcStatus::Ok);
   EXPECT_CALL(span_, setTag("ext_authz_status", "ext_authz_ok"));
-  EXPECT_CALL(request_callbacks_, onComplete(CheckStatus::OK));
+  EXPECT_CALL(request_callbacks_, onComplete_(_));
   client_.onSuccess(std::move(response), span_);
 }
 
@@ -98,7 +100,7 @@ TEST_F(ExtAuthzGrpcClientTest, BasicDenied) {
   auto status = response->mutable_status();
   status->set_code(Grpc::Status::GrpcStatus::PermissionDenied);
   EXPECT_CALL(span_, setTag("ext_authz_status", "ext_authz_unauthorized"));
-  EXPECT_CALL(request_callbacks_, onComplete(CheckStatus::Denied));
+  EXPECT_CALL(request_callbacks_, onComplete_(_));
   client_.onSuccess(std::move(response), span_);
 }
 
@@ -108,7 +110,7 @@ TEST_F(ExtAuthzGrpcClientTest, BasicError) {
 
   client_.check(request_callbacks_, request, Tracing::NullSpan::instance());
 
-  EXPECT_CALL(request_callbacks_, onComplete(CheckStatus::Error));
+  EXPECT_CALL(request_callbacks_, onComplete_(_));
   client_.onFailure(Grpc::Status::Unknown, "", span_);
 }