Use app policy for staged policies (#9804)

app-policy/checker/adapter_checkrequest.go

@@ -0,0 +1,120 @@
+// Copyright (c) 2024-2025 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package checker
+
+import (
+	"net"
+	"strings"
+
+	authz "github.com/envoyproxy/go-control-plane/envoy/service/auth/v3"
+	log "github.com/sirupsen/logrus"
+)
+
+// CheckRequestToFlowAdapter adapts CheckRequest to the l4 and l7 flow interfaces for use in the
+// matchers.
+type CheckRequestToFlowAdapter struct {
+	flow *authz.CheckRequest
+}
+
+func NewCheckRequestToFlowAdapter(req *authz.CheckRequest) *CheckRequestToFlowAdapter {
+	return &CheckRequestToFlowAdapter{flow: req}
+}
+
+func (a *CheckRequestToFlowAdapter) GetSourceIP() net.IP {
+	if a.flow == nil || a.flow.GetAttributes().GetSource().GetAddress().GetSocketAddress() == nil {
+		return nil
+	}
+	return net.ParseIP(a.flow.GetAttributes().GetSource().GetAddress().GetSocketAddress().GetAddress())
+}
+
+func (a *CheckRequestToFlowAdapter) GetDestIP() net.IP {
+	if a.flow == nil || a.flow.GetAttributes().GetDestination().GetAddress().GetSocketAddress() == nil {
+		return nil
+	}
+	return net.ParseIP(a.flow.GetAttributes().GetDestination().GetAddress().GetSocketAddress().GetAddress())
+}
+
+func (a *CheckRequestToFlowAdapter) GetSourcePort() int {
+	if a.flow == nil || a.flow.GetAttributes().GetSource().GetAddress().GetSocketAddress() == nil {
+		return 0
+	}
+	return int(a.flow.GetAttributes().GetSource().GetAddress().GetSocketAddress().GetPortValue())
+}
+
+func (a *CheckRequestToFlowAdapter) GetDestPort() int {
+	if a.flow == nil || a.flow.GetAttributes().GetDestination().GetAddress().GetSocketAddress() == nil {
+		return 0
+	}
+	return int(a.flow.GetAttributes().GetDestination().GetAddress().GetSocketAddress().GetPortValue())
+}
+
+func (a *CheckRequestToFlowAdapter) GetProtocol() int {
+	if a.flow == nil || a.flow.GetAttributes().GetDestination().GetAddress().GetSocketAddress() == nil {
+		// Default to TCP if protocol is not set.
+		return 6
+	}
+	protocol := a.flow.GetAttributes().GetDestination().GetAddress().GetSocketAddress().GetProtocol().String()
+	if p, ok := protocolMap[strings.ToLower(protocol)]; ok {
+		return p
+	}
+	log.Warnf("unsupported protocol: %s, defaulting to TCP", protocol)
+	return 6
+}
+
+func (a *CheckRequestToFlowAdapter) GetHttpMethod() *string {
+	if a.flow == nil || a.flow.GetAttributes().GetRequest().GetHttp() == nil {
+		return nil
+	}
+	method := a.flow.GetAttributes().GetRequest().GetHttp().GetMethod()
+	return &method
+}
+
+func (a *CheckRequestToFlowAdapter) GetHttpPath() *string {
+	if a.flow == nil || a.flow.GetAttributes().GetRequest().GetHttp() == nil {
+		return nil
+	}
+	path := a.flow.GetAttributes().GetRequest().GetHttp().GetPath()
+	return &path
+}
+
+func (a *CheckRequestToFlowAdapter) GetSourcePrincipal() *string {
+	if a.flow == nil {
+		return nil
+	}
+	principal := a.flow.GetAttributes().GetSource().GetPrincipal()
+	return &principal
+}
+
+func (a *CheckRequestToFlowAdapter) GetDestPrincipal() *string {
+	if a.flow == nil {
+		return nil
+	}
+	principal := a.flow.GetAttributes().GetDestination().GetPrincipal()
+	return &principal
+}
+
+func (a *CheckRequestToFlowAdapter) GetSourceLabels() map[string]string {
+	if a.flow == nil {
+		return nil
+	}
+	return a.flow.GetAttributes().GetSource().GetLabels()
+}
+
+func (a *CheckRequestToFlowAdapter) GetDestLabels() map[string]string {
+	if a.flow == nil {
+		return nil
+	}
+	return a.flow.GetAttributes().GetDestination().GetLabels()
+}