Typing

src/configuration.rs

@@ -1,5 +1,6 @@
 use crate::glob::GlobPattern;
 use crate::policy_index::PolicyIndex;
+use crate::typing::TypedProperty;
 use log::warn;
 use serde::Deserialize;
 
@@ -54,36 +55,36 @@ pub enum WhenConditionOperator {
  Matches,
 }
 
-impl WhenConditionOperator {
- pub fn eval(&self, value: &str, attr_value: &str) -> bool {
- match *self {
- WhenConditionOperator::Equal => value.eq(attr_value),
- WhenConditionOperator::NotEqual => !value.eq(attr_value),
- WhenConditionOperator::StartsWith => attr_value.starts_with(value),
- WhenConditionOperator::EndsWith => attr_value.ends_with(value),
- WhenConditionOperator::Matches => match GlobPattern::try_from(value) {
+#[derive(Deserialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct PatternExpression {
+ pub selector: String,
+ pub operator: WhenConditionOperator,
+ pub value: String,
+}
+
+impl PatternExpression {
+ pub fn eval(&self, value: &TypedProperty) -> bool {
+ match self.operator {
+ WhenConditionOperator::Equal => value.eq(&self.value),
+ WhenConditionOperator::NotEqual => value.ne(&self.value),
+ WhenConditionOperator::StartsWith => value.as_string().starts_with(&self.value),
+ WhenConditionOperator::EndsWith => value.as_string().ends_with(&self.value),
+ WhenConditionOperator::Matches => match GlobPattern::try_from(self.value.as_str()) {
  // TODO(eastizle): regexp being compiled and validated at request time.
  // Validations and possibly regexp compilation should happen at boot time instead.
  // In addition, if the regexp is not valid, the only consequence is that
  // the current condition would not apply
- Ok(glob_pattern) => glob_pattern.is_match(attr_value),
+ Ok(glob_pattern) => glob_pattern.is_match(&value.as_string()),
  Err(e) => {
- warn!("failed to parse regexp: {value}, error: {e:?}");
+ warn!("failed to parse regexp: {}, error: {e:?}", self.value);
  false
  }
  },
  }
  }
 }
 
-#[derive(Deserialize, Debug, Clone)]
-#[serde(rename_all = "camelCase")]
-pub struct PatternExpression {
- pub selector: String,
- pub operator: WhenConditionOperator,
- pub value: String,
-}
-
 #[derive(Deserialize, Debug, Clone)]
 #[serde(rename_all = "camelCase")]
 pub struct Condition {

src/envoy/mod.rs

@@ -30,24 +30,12 @@ mod timestamp;
 mod token_bucket;
 mod value;
 
+pub mod properties;
+
 pub use {
- address::{
- Address, Address_oneof_address, SocketAddress, SocketAddress_Protocol,
- SocketAddress_oneof_port_specifier as SocketAddress_port,
- },
- attribute_context::{
- AttributeContext, AttributeContext_HttpRequest, AttributeContext_Peer,
- AttributeContext_Request,
- },
- base::HeaderValue,
- base::Metadata,
- external_auth::{CheckRequest, CheckResponse},
  ratelimit::{RateLimitDescriptor, RateLimitDescriptor_Entry},
  rls::{RateLimitRequest, RateLimitResponse, RateLimitResponse_Code},
- route_components::{
- HeaderMatcher, HeaderMatcher_oneof_header_match_specifier as HeaderMatcher_specifier,
- RateLimit_Action, RateLimit_Action_oneof_action_specifier as RLA_action_specifier,
- },
- string::StringMatcher_oneof_match_pattern as StringMatcher_pattern,
- timestamp::Timestamp,
 };
+
+#[cfg(test)]
+pub use base::HeaderValue;

src/envoy/properties.rs

@@ -0,0 +1,201 @@
+use crate::typing::TypedProperty;
+use std::collections::BTreeMap;
+
+type MapperFn = dyn Fn(Vec<u8>) -> TypedProperty;
+
+pub struct EnvoyTypeMapper {
+ known_properties: BTreeMap<String, Box<MapperFn>>,
+}
+
+impl EnvoyTypeMapper {
+ pub fn new() -> Self {
+ let mut properties: BTreeMap<String, Box<MapperFn>> = BTreeMap::new();
+ properties.insert(
+ "request.time".to_string(),
+ Box::new(TypedProperty::timestamp),
+ );
+
+ properties.insert("request.id".to_string(), Box::new(TypedProperty::string));
+ properties.insert(
+ "request.protocol".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "request.scheme".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert("request.host".to_string(), Box::new(TypedProperty::string));
+ properties.insert(
+ "request.method".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert("request.path".to_string(), Box::new(TypedProperty::string));
+ properties.insert(
+ "request.url_path".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert("request.query".to_string(), Box::new(TypedProperty::string));
+ properties.insert(
+ "request.referer".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "request.useragent".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert("request.body".to_string(), Box::new(TypedProperty::string));
+ properties.insert(
+ "source.address".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "source.service".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "source.principal".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "source.certificate".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "destination.address".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "destination.service".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "destination.principal".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "destination.certificate".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "connection.requested_server_name".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "connection.tls_session.sni".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "connection.tls_version".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "connection.subject_local_certificate".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "connection.subject_peer_certificate".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "connection.dns_san_local_certificate".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "connection.dns_san_peer_certificate".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "connection.uri_san_local_certificate".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "connection.uri_san_peer_certificate".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "connection.sha256_peer_certificate_digest".to_string(),
+ Box::new(TypedProperty::string),
+ );
+ properties.insert(
+ "ratelimit.domain".to_string(),
+ Box::new(TypedProperty::string),
+ );
+
+ properties.insert("request.size".to_string(), Box::new(TypedProperty::integer));
+ properties.insert("source.port".to_string(), Box::new(TypedProperty::integer));
+ properties.insert(
+ "destination.port".to_string(),
+ Box::new(TypedProperty::integer),
+ );
+ properties.insert(
+ "connection.id".to_string(),
+ Box::new(TypedProperty::integer),
+ );
+ properties.insert(
+ "ratelimit.hits_addend".to_string(),
+ Box::new(TypedProperty::integer),
+ );
+
+ properties.insert("metadata".to_string(), Box::new(TypedProperty::metadata));
+
+ properties.insert(
+ "request.headers".to_string(),
+ Box::new(TypedProperty::string_map),
+ );
+ properties.insert(
+ "request.context_extensions".to_string(),
+ Box::new(TypedProperty::string_map),
+ );
+ properties.insert(
+ "source.labels".to_string(),
+ Box::new(TypedProperty::string_map),
+ );
+ properties.insert(
+ "destination.labels".to_string(),
+ Box::new(TypedProperty::string_map),
+ );
+ properties.insert(
+ "filter_state".to_string(),
+ Box::new(TypedProperty::string_map),
+ );
+
+ properties.insert(
+ "auth.metadata".to_string(),
+ Box::new(TypedProperty::complex_map),
+ );
+ properties.insert(
+ "auth.authorization".to_string(),
+ Box::new(TypedProperty::complex_map),
+ );
+ properties.insert(
+ "auth.response".to_string(),
+ Box::new(TypedProperty::complex_map),
+ );
+ properties.insert(
+ "auth.callbacks".to_string(),
+ Box::new(TypedProperty::complex_map),
+ );
+
+ properties.insert(
+ "connection.mtls".to_string(),
+ Box::new(TypedProperty::boolean),
+ );
+
+ properties.insert(
+ "request.raw_body".to_string(),
+ Box::new(TypedProperty::bytes),
+ );
+ properties.insert("auth.identity".to_string(), Box::new(TypedProperty::bytes));
+
+ Self {
+ known_properties: properties,
+ }
+ }
+
+ pub fn typed(&self, path: &str, raw: Vec<u8>) -> Result<TypedProperty, Vec<u8>> {
+ match self.known_properties.get(path) {
+ None => Err(raw),
+ Some(mapper) => Ok(mapper(raw)),
+ }
+ }
+}

src/filter.rs

@@ -1,3 +1,5 @@
+use crate::envoy::properties::EnvoyTypeMapper;
+
 mod http_context;
 mod root_context;
 
@@ -35,6 +37,7 @@ extern "C" fn start() {
  Box::new(FilterRoot {
  context_id,
  config: Rc::new(FilterConfig::new()),
+ property_mapper: Rc::new(EnvoyTypeMapper::new()),
  })
  });
 }