Skip to content

Commit 4ef7164

Browse files
zhaohuabingzhaohuabing
committed
fix: prevent configuring RequestMirror and DirectResponse filters together
Signed-off-by: Huabing Zhao <[email protected]>
1 parent d1b87c0 commit 4ef7164

File tree

4 files changed

+227
-0
lines changed

4 files changed

+227
-0
lines changed

‎internal/gatewayapi/filters.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ type HTTPFilterIR struct {
6969
// Header value pattern according to RFC 7230
7070
var HeaderValueRegexp = regexp.MustCompile(`^[!-~]+([\t ]?[!-~]+)*$`)
7171

72+
const requestMirrorDirectResponseConflictMsg = "RequestMirror filter cannot be used when the rule also configures a DirectResponse filter"
73+
7274
// ProcessHTTPFilters translates gateway api http filters to IRs.
7375
func (t *Translator) ProcessHTTPFilters(parentRef *RouteParentContext,
7476
route RouteContext,
@@ -114,6 +116,10 @@ func (t *Translator) ProcessHTTPFilters(parentRef *RouteParentContext,
114116
}
115117
}
116118

119+
if httpFiltersContext.DirectResponse != nil && len(httpFiltersContext.Mirrors) > 0 {
120+
updateRouteStatusForFilter(httpFiltersContext, requestMirrorDirectResponseConflictMsg)
121+
}
122+
117123
return httpFiltersContext, err
118124
}
119125

‎internal/gatewayapi/testdata/httproute-with-mirror-filter-direct-response.in.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
gateways:
2+
- apiVersion: gateway.networking.k8s.io/v1
3+
kind: Gateway
4+
metadata:
5+
namespace: envoy-gateway
6+
name: gateway-1
7+
spec:
8+
gatewayClassName: envoy-gateway-class
9+
listeners:
10+
- name: http
11+
protocol: HTTP
12+
port: 80
13+
hostname: "*.envoyproxy.io"
14+
allowedRoutes:
15+
namespaces:
16+
from: All
17+
httpRoutes:
18+
- apiVersion: gateway.networking.k8s.io/v1
19+
kind: HTTPRoute
20+
metadata:
21+
namespace: default
22+
name: mirror-direct-response
23+
spec:
24+
hostnames:
25+
- gateway.envoyproxy.io
26+
parentRefs:
27+
- namespace: envoy-gateway
28+
name: gateway-1
29+
sectionName: http
30+
rules:
31+
- matches:
32+
- path:
33+
type: PathPrefix
34+
value: /
35+
backendRefs:
36+
- name: service-1
37+
port: 8080
38+
filters:
39+
- type: RequestMirror
40+
requestMirror:
41+
backendRef:
42+
kind: Service
43+
name: service-1
44+
port: 8080
45+
- type: ExtensionRef
46+
extensionRef:
47+
group: gateway.envoyproxy.io
48+
kind: HTTPRouteFilter
49+
name: mirror-direct-response
50+
httpFilters:
51+
- apiVersion: gateway.envoyproxy.io/v1alpha1
52+
kind: HTTPRouteFilter
53+
metadata:
54+
name: mirror-direct-response
55+
namespace: default
56+
spec:
57+
directResponse:
58+
statusCode: 404
59+
contentType: text/plain
60+
body:
61+
type: Inline
62+
inline: "blocked"

‎internal/gatewayapi/testdata/httproute-with-mirror-filter-direct-response.out.yaml‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
gateways:
2+
- apiVersion: gateway.networking.k8s.io/v1
3+
kind: Gateway
4+
metadata:
5+
name: gateway-1
6+
namespace: envoy-gateway
7+
spec:
8+
gatewayClassName: envoy-gateway-class
9+
listeners:
10+
- allowedRoutes:
11+
namespaces:
12+
from: All
13+
hostname: '*.envoyproxy.io'
14+
name: http
15+
port: 80
16+
protocol: HTTP
17+
status:
18+
listeners:
19+
- attachedRoutes: 1
20+
conditions:
21+
- lastTransitionTime: null
22+
message: Sending translated listener configuration to the data plane
23+
reason: Programmed
24+
status: "True"
25+
type: Programmed
26+
- lastTransitionTime: null
27+
message: Listener has been successfully translated
28+
reason: Accepted
29+
status: "True"
30+
type: Accepted
31+
- lastTransitionTime: null
32+
message: Listener references have been resolved
33+
reason: ResolvedRefs
34+
status: "True"
35+
type: ResolvedRefs
36+
name: http
37+
supportedKinds:
38+
- group: gateway.networking.k8s.io
39+
kind: HTTPRoute
40+
- group: gateway.networking.k8s.io
41+
kind: GRPCRoute
42+
httpRoutes:
43+
- apiVersion: gateway.networking.k8s.io/v1
44+
kind: HTTPRoute
45+
metadata:
46+
name: mirror-direct-response
47+
namespace: default
48+
spec:
49+
hostnames:
50+
- gateway.envoyproxy.io
51+
parentRefs:
52+
- name: gateway-1
53+
namespace: envoy-gateway
54+
sectionName: http
55+
rules:
56+
- backendRefs:
57+
- name: service-1
58+
port: 8080
59+
filters:
60+
- requestMirror:
61+
backendRef:
62+
kind: Service
63+
name: service-1
64+
port: 8080
65+
type: RequestMirror
66+
- extensionRef:
67+
group: gateway.envoyproxy.io
68+
kind: HTTPRouteFilter
69+
name: mirror-direct-response
70+
type: ExtensionRef
71+
matches:
72+
- path:
73+
type: PathPrefix
74+
value: /
75+
status:
76+
parents:
77+
- conditions:
78+
- lastTransitionTime: null
79+
message: RequestMirror filter cannot be used when the rule also configures
80+
a DirectResponse filter
81+
reason: UnsupportedValue
82+
status: "False"
83+
type: Accepted
84+
- lastTransitionTime: null
85+
message: Resolved all the Object references for the Route
86+
reason: ResolvedRefs
87+
status: "True"
88+
type: ResolvedRefs
89+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
90+
parentRef:
91+
name: gateway-1
92+
namespace: envoy-gateway
93+
sectionName: http
94+
infraIR:
95+
envoy-gateway/gateway-1:
96+
proxy:
97+
listeners:
98+
- address: null
99+
name: envoy-gateway/gateway-1/http
100+
ports:
101+
- containerPort: 10080
102+
name: http-80
103+
protocol: HTTP
104+
servicePort: 80
105+
metadata:
106+
labels:
107+
gateway.envoyproxy.io/owning-gateway-name: gateway-1
108+
gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
109+
ownerReference:
110+
kind: GatewayClass
111+
name: envoy-gateway-class
112+
name: envoy-gateway/gateway-1
113+
namespace: envoy-gateway-system
114+
xdsIR:
115+
envoy-gateway/gateway-1:
116+
accessLog:
117+
json:
118+
- path: /dev/stdout
119+
globalResources:
120+
proxyServiceCluster:
121+
metadata:
122+
name: envoy-envoy-gateway-gateway-1-196ae069
123+
namespace: envoy-gateway-system
124+
sectionName: "8080"
125+
name: envoy-gateway/gateway-1
126+
settings:
127+
- addressType: IP
128+
endpoints:
129+
- host: 7.6.5.4
130+
port: 8080
131+
zone: zone1
132+
metadata:
133+
name: envoy-envoy-gateway-gateway-1-196ae069
134+
namespace: envoy-gateway-system
135+
sectionName: "8080"
136+
name: envoy-gateway/gateway-1
137+
protocol: TCP
138+
http:
139+
- address: 0.0.0.0
140+
externalPort: 80
141+
hostnames:
142+
- '*.envoyproxy.io'
143+
isHTTP2: false
144+
metadata:
145+
kind: Gateway
146+
name: gateway-1
147+
namespace: envoy-gateway
148+
sectionName: http
149+
name: envoy-gateway/gateway-1/http
150+
path:
151+
escapedSlashesAction: UnescapeAndRedirect
152+
mergeSlashes: true
153+
port: 10080
154+
readyListener:
155+
address: 0.0.0.0
156+
ipFamily: IPv4
157+
path: /ready
158+
port: 19003

‎release-notes/current.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ date: Pending
22

33
# Changes that are expected to cause an incompatibility with previous versions, such as deletions or modifications to existing APIs.
44
breaking changes: |
5+
Set HTTPRoute Accepted status to False when RequestMirror filter is used together with DirectResponse filter.
56
67
# Updates addressing vulnerabilities, security flaws, or compliance requirements.
78
security updates: |

0 commit comments

Comments
 (0)