Add mode to PipeInstance #8423

athampy · 2019-09-28T21:30:21Z

Description:
Allows fine-grained access control for PipeInstances by specifying a mode parameter

Risk Level: Low
Testing: Added unit test
Fixes #5808

repokitteh-read-only · 2019-09-28T21:30:26Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/.

🐱

Caused by: #8423 was opened by athampy.

see: more, trace.

dio · 2019-09-30T05:12:21Z

@athampy could fix the formatting error? Thanks!

athampy · 2019-09-30T05:37:19Z

@dio updated

lizan · 2019-09-30T06:41:22Z

api/envoy/api/v2/core/address.proto

@@ -20,6 +20,9 @@ message Pipe {
  // Paths starting with '@' will result in an error in environments other than
  // Linux.
  string path = 1 [(validate.rules).string = {min_bytes: 1}];
+
+  // [#not-implemented-hide:]
+  uint32 mode = 2 [(validate.rules).uint32 = {lte: 777}];


lte: 0777?

0777 != 777 :)

wait, protobuf doesn't accept octal?

I believe it does but proto_format insists on decimal representation

api/envoy/api/v3alpha/core/address.proto

test/common/network/address_impl_test.cc

source/common/network/address_impl.cc

Signed-off-by: Akhil Thampy <[email protected]>

athampy · 2019-10-03T02:30:17Z

/wait

htuch · 2019-10-04T03:32:54Z

api/envoy/api/v2/core/address.proto

@@ -20,6 +20,9 @@ message Pipe {
  // Paths starting with '@' will result in an error in environments other than
  // Linux.
  string path = 1 [(validate.rules).string = {min_bytes: 1}];
+
+  // [#not-implemented-hide:]
+  uint32 mode = 2 [(validate.rules).uint32 = {lte: 777}];


0777 != 777 :)

api/envoy/api/v2/core/address.proto

Signed-off-by: Akhil Thampy <[email protected]>

athampy · 2019-10-09T20:27:34Z

/retest

repokitteh-read-only · 2019-10-09T20:27:37Z

🐴 hold your horses - no failures detected, yet.

🐱

Caused by: a #8423 (comment) was created by @athampy.

see: more, trace.

stale · 2019-10-16T21:03:42Z

This pull request has been automatically marked as stale because it has not had activity in the last 7 days. It will be closed in 7 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions!

mattklein123

LGTM with small comments, thanks.

/wait

mattklein123 · 2019-12-11T16:51:01Z

docs/root/intro/version_history.rst

+* router: exposed DOWNSTREAM_REMOTE_ADDRESS as custom HTTP request/response headers.
+* api: added ability to specify `mode` for :ref:`Pipe <envoy_api_field_core.Pipe.mode>`.


merge issue here, also please alpha short api

source/common/network/address_impl.cc

Signed-off-by: Akhil Thampy <[email protected]>

mattklein123

LGTM with a few small comments, thanks you!

/wait

mattklein123 · 2019-12-11T23:08:45Z

docs/root/intro/version_history.rst

@@ -32,6 +33,7 @@ Version history
 * thrift_proxy: added support for cluster header based routing.
 * thrift_proxy: added stats to the router filter.
 * tls: remove TLS 1.0 and 1.1 from client defaults
+* router: exposed DOWNSTREAM_REMOTE_ADDRESS as custom HTTP request/response headers.


source/common/network/address_impl.cc

Signed-off-by: Akhil Thampy <[email protected]>

athampy · 2019-12-13T13:23:24Z

/retest

repokitteh-read-only · 2019-12-13T13:23:29Z

🙀 Error while processing event:

evaluation error
error: function error error: user: combined status is failure, but no failed builds.

🐱

Caused by: a #8423 (comment) was created by @athampy.

see: more, trace.

Signed-off-by: Akhil Thampy <[email protected]>

mattklein123 · 2019-12-16T17:00:09Z

Looks like a legit ASAN failure. PTAL.

/wait

Signed-off-by: Akhil Thampy <[email protected]>

mattklein123

Thanks!

* master: (167 commits) stats: Avoid asserts in fuzz-tests by eliminating arbitrary length limits, using the new MemBlock wrapper for memcpy (envoyproxy#8779) Make %UPSTREAM_LOCAL_ADDRESS% access-log format work for HTTP requests. (envoyproxy#9362) tools: API boosting support for using decls and enum constants. (envoyproxy#9418) Fix incorrect cluster InitializePhase type (envoyproxy#9379) build: fix merge race between envoyproxy#9241 and envoyproxy#9413. (envoyproxy#9427) fuzz: fix incorrect evaluator test (envoyproxy#9402) server: fix bogus startup log message (envoyproxy#9404) tools: Add protoxform tests (envoyproxy#9241) api: options after import (envoyproxy#9413) misc: use std::move instead of constructing a copy (envoyproxy#9415) tools: API boosting support for rewriting elaborated types. (envoyproxy#9375) docs: fix invalid transport_socket value (envoyproxy#9403) fix typo in docs (envoyproxy#9394) srds: remove to-de-removed scopes first and then apply additions to avoid scope key conflict. (envoyproxy#9366) api: generate whole directory and sync (envoyproxy#9382) bazel: Add load statements for proto_library (envoyproxy#9367) Fix typo (envoyproxy#9388) Correct test of OptionsImpl argc type (Was: Correct type for std::array size() result) (envoyproxy#9290) http1 encode trailers in chunk encoding (envoyproxy#8667) Add mode to PipeInstance (envoyproxy#8423) ...

Signed-off-by: Akhil Thampy <[email protected]> Signed-off-by: Prakhar <[email protected]>

dio assigned lizan Sep 30, 2019

lizan reviewed Oct 1, 2019

View reviewed changes

lizan added api-review-required API review required by @envoyproxy/api-shepherds waiting labels Oct 1, 2019

repokitteh-read-only bot removed the waiting label Oct 2, 2019

lizan reviewed Oct 2, 2019

View reviewed changes

source/common/network/address_impl.cc Show resolved Hide resolved

lizan added the waiting label Oct 2, 2019

athampy added 8 commits October 2, 2019 18:15

syscall: add chmod envoyproxy#5808

147ccbf

Signed-off-by: Akhil Thampy <[email protected]>

api: add mode to Pipe envoyproxy#5808

e8245db

Signed-off-by: Akhil Thampy <[email protected]>

address: add mode to PipeInstance envoyproxy#5808

0715211

Signed-off-by: Akhil Thampy <[email protected]>

test: add tests for setting mode for PipeInstance envoyproxy#5808

ec7ea45

Signed-off-by: Akhil Thampy <[email protected]>

fix format

3920808

Signed-off-by: Akhil Thampy <[email protected]>

proto sync

5c30cf2

Signed-off-by: Akhil Thampy <[email protected]>

tools: add chmod to dictionary

318defb

Signed-off-by: Akhil Thampy <[email protected]>

add leading zero for mode_t values

72dbba4

Signed-off-by: Akhil Thampy <[email protected]>

athampy force-pushed the gh-5808 branch from 70cbbc6 to 72dbba4 Compare October 3, 2019 01:21

repokitteh-read-only bot removed the waiting label Oct 3, 2019

repokitteh-read-only bot added waiting and removed waiting labels Oct 3, 2019

htuch reviewed Oct 4, 2019

View reviewed changes

api: remove not-implemented-hide

970c88c

Signed-off-by: Akhil Thampy <[email protected]>

athampy force-pushed the gh-5808 branch from 997c0ef to 970c88c Compare October 4, 2019 05:45

api: update validate rules for mode

23d9f96

Signed-off-by: Akhil Thampy <[email protected]>

mattklein123 requested changes Dec 11, 2019

View reviewed changes

repokitteh-read-only bot added the waiting label Dec 11, 2019

mattklein123 self-assigned this Dec 11, 2019

test: add test for Pipe chmod fail; create mock for chmod syscall

342c394

Signed-off-by: Akhil Thampy <[email protected]>

repokitteh-read-only bot removed the waiting label Dec 11, 2019

mattklein123 requested changes Dec 11, 2019

View reviewed changes

repokitteh-read-only bot added the waiting label Dec 11, 2019

athampy added 2 commits December 12, 2019 20:47

docs: revert

8a32d78

Signed-off-by: Akhil Thampy <[email protected]>

Merge branch 'master' into envoyproxygh-5808

9585817

repokitteh-read-only bot removed the waiting label Dec 13, 2019

Kick CI

ff16f6d

Signed-off-by: Akhil Thampy <[email protected]>

repokitteh-read-only bot added waiting and removed waiting labels Dec 13, 2019

athampy force-pushed the gh-5808 branch 2 times, most recently from 699486c to d0d9e00 Compare December 15, 2019 22:00

fix coverage

0b72b99

Signed-off-by: Akhil Thampy <[email protected]>

athampy force-pushed the gh-5808 branch from d0d9e00 to 0b72b99 Compare December 16, 2019 04:38

repokitteh-read-only bot added the waiting label Dec 16, 2019

fix asan off by one

818e6b1

Signed-off-by: Akhil Thampy <[email protected]>

repokitteh-read-only bot removed the waiting label Dec 16, 2019

mattklein123 approved these changes Dec 17, 2019

View reviewed changes

repokitteh-read-only bot removed the api label Dec 17, 2019

mattklein123 merged commit 750431a into envoyproxy:master Dec 17, 2019

prakhag1 pushed a commit to prakhag1/envoy that referenced this pull request Jan 3, 2020

Add mode to PipeInstance (envoyproxy#8423)

9462817

Signed-off-by: Akhil Thampy <[email protected]> Signed-off-by: Prakhar <[email protected]>

sorah mentioned this pull request Oct 11, 2020

listener: respect address.pipe.mode (it didn't work) #13493

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add mode to PipeInstance #8423

Add mode to PipeInstance #8423

athampy commented Sep 28, 2019

repokitteh-read-only bot commented Sep 28, 2019

dio commented Sep 30, 2019

athampy commented Sep 30, 2019

lizan Sep 30, 2019

athampy Oct 2, 2019

htuch Oct 4, 2019

lizan Oct 4, 2019

athampy Oct 9, 2019

athampy commented Oct 3, 2019

htuch Oct 4, 2019

athampy commented Oct 9, 2019

repokitteh-read-only bot commented Oct 9, 2019

stale bot commented Oct 16, 2019

mattklein123 left a comment

mattklein123 Dec 11, 2019

athampy Dec 11, 2019

mattklein123 left a comment

mattklein123 Dec 11, 2019

athampy Dec 13, 2019

athampy commented Dec 13, 2019

repokitteh-read-only bot commented Dec 13, 2019

mattklein123 commented Dec 16, 2019

mattklein123 left a comment

		* router: exposed DOWNSTREAM_REMOTE_ADDRESS as custom HTTP request/response headers.
		* api: added ability to specify `mode` for :ref:`Pipe <envoy_api_field_core.Pipe.mode>`.

Add mode to PipeInstance #8423

Add mode to PipeInstance #8423

Conversation

athampy commented Sep 28, 2019

repokitteh-read-only bot commented Sep 28, 2019

dio commented Sep 30, 2019

athampy commented Sep 30, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

athampy commented Oct 3, 2019

Choose a reason for hiding this comment

athampy commented Oct 9, 2019

repokitteh-read-only bot commented Oct 9, 2019

stale bot commented Oct 16, 2019

mattklein123 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mattklein123 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

athampy commented Dec 13, 2019

repokitteh-read-only bot commented Dec 13, 2019

mattklein123 commented Dec 16, 2019

mattklein123 left a comment

Choose a reason for hiding this comment