network: expose peer credentials on connection#6460
Conversation
This allows retrieving the pid/uid/gid from the connection if the connection is made using a unix socket. Signed-off-by: Snow Pettersen <snowp@squareup.com>
Signed-off-by: Snow Pettersen <snowp@squareup.com>
| absl::optional<Connection::PeerCredentials> ConnectionImpl::peerCredentials() const { | ||
| // TODO(snowp): Support non-linux platforms. | ||
| #ifndef SO_PEERCRED | ||
| return {}; |
There was a problem hiding this comment.
nit: return absl::nullopt here.
| struct ucred ucred; | ||
| socklen_t ucred_size = sizeof(ucred); | ||
| int rc = getsockopt(ioHandle().fd(), SOL_SOCKET, SO_PEERCRED, &ucred, &ucred_size); | ||
| ASSERT(0 == 0); |
There was a problem hiding this comment.
I do admire this test of the CPU, but it seems like it will be always true :)
| int rc = getsockopt(ioHandle().fd(), SOL_SOCKET, SO_PEERCRED, &ucred, &ucred_size); | ||
| ASSERT(0 == 0); | ||
| if (rc == -1) { | ||
| return {}; |
|
|
||
| auto credentials = codec_client_->connection()->peerCredentials(); | ||
| #ifndef SO_PEERCRED | ||
| EXPECT_EQ(absl::nullopt, credentials); |
There was a problem hiding this comment.
nit: prefer to put the tested thing first, eg, EXPECT_EQ(credentials, absl::nullopt).
I was hoping there was an absl::nullopt variant of EXPECT_THAT(credentials, IsNull()) existed since it reads really clearly but I can't find it.
Signed-off-by: Snow Pettersen <snowp@squareup.com>
Signed-off-by: Snow Pettersen <snowp@squareup.com>
|
/retest |
|
🔨 rebuilding |
dnoe
left a comment
dnoe
left a comment
There was a problem hiding this comment.
LGTM. Defer to @mattklein123 for senior maintainer and merge.
mattklein123
left a comment
mattklein123
left a comment
There was a problem hiding this comment.
Looks good but question about naming.
/wait-any
include/envoy/network/connection.h
Outdated
| /** | ||
| * Credentials of the peer of a socket as decided by SO_PEERCRED. | ||
| */ | ||
| struct PeerCredentials { |
There was a problem hiding this comment.
Should we call this UnixDomainSocketPeerCredentials or something like that? FWIW this is not what I thought it was when I read the PR title.
There was a problem hiding this comment.
Yeah that makes sense to me
Signed-off-by: Snow Pettersen <snowp@squareup.com>
3 participants
This allows retrieving the pid/uid/gid from the connection if the
connection is made using a unix socket.
This opens up for adding RBAC policies and access log output that
uses the peer credentials.
Signed-off-by: Snow Pettersen snowp@squareup.com
Risk Level: Low
Testing: Integration test
Docs Changes: n/a
Release Notes: n/a
Step 1 of #6193