status-im/consul
2
0
Fork 0
mirror of https://github.com/status-im/consul.git synced 2025-02-02 00:46:43 +00:00
Code Issues Projects Releases Wiki Activity

Augment intention decision summary with DefaultAllow mode

Browse Source
This commit is contained in:
freddygv 2021-04-12 19:32:09 -06:00
parent 18decbba9d
commit 932fbddd27
5 changed files with 25 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
agent/consul/internal_endpoint_test.go
View File

@ -1721,6 +1721,7 @@ func TestInternal_ServiceTopology(t *testing.T) {
expectUp := map[string]structs.IntentionDecisionSummary{
web.String(): {
DefaultAllow: true,
Allowed: false,
HasPermissions: false,
ExternalSource: "nomad",
@ -1749,6 +1750,7 @@ func TestInternal_ServiceTopology(t *testing.T) {
expectDown := map[string]structs.IntentionDecisionSummary{
api.String(): {
DefaultAllow: true,
Allowed: false,
HasPermissions: false,
ExternalSource: "nomad",
@ -1764,6 +1766,7 @@ func TestInternal_ServiceTopology(t *testing.T) {
expectUp := map[string]structs.IntentionDecisionSummary{
redis.String(): {
DefaultAllow: true,
Allowed: false,
HasPermissions: true,
HasExact: true,
@ -1791,6 +1794,7 @@ func TestInternal_ServiceTopology(t *testing.T) {
expectDown := map[string]structs.IntentionDecisionSummary{
web.String(): {
DefaultAllow: true,
Allowed: false,
HasPermissions: true,
HasExact: true,

6
agent/consul/state/intention.go
View File

@ -750,10 +750,12 @@ func (s *Store) IntentionDecision(
}
}
var resp structs.IntentionDecisionSummary
resp := structs.IntentionDecisionSummary{
DefaultAllow: defaultDecision == acl.Allow,
}
if ixnMatch == nil {
// No intention found, fall back to default
resp.Allowed = defaultDecision == acl.Allow
resp.Allowed = resp.DefaultAllow
return resp, nil
}

10
agent/consul/state/intention_test.go
View File

@ -1774,7 +1774,10 @@ func TestStore_IntentionDecision(t *testing.T) {
dst: "ditto",
matchType: structs.IntentionMatchDestination,
defaultDecision: acl.Deny,
expect: structs.IntentionDecisionSummary{Allowed: false},
expect: structs.IntentionDecisionSummary{
Allowed: false,
DefaultAllow: false,
},
},
{
name: "no matching intention and default allow",
@ -1782,7 +1785,10 @@ func TestStore_IntentionDecision(t *testing.T) {
dst: "ditto",
matchType: structs.IntentionMatchDestination,
defaultDecision: acl.Allow,
expect: structs.IntentionDecisionSummary{Allowed: true},
expect: structs.IntentionDecisionSummary{
Allowed: true,
DefaultAllow: true,
},
},
{
name: "denied with permissions",

4
agent/structs/intention.go
View File

@ -666,12 +666,14 @@ type IntentionQueryCheckResponse struct {
// - Whether all actions are allowed
// - Whether the matching intention has L7 permissions attached
// - Whether the intention is managed by an external source like k8s
// - Whether there is an exact, on-wildcard, intention referencing the two services
// - Whether there is an exact, or wildcard, intention referencing the two services
// - Whether ACLs are in DefaultAllow mode
type IntentionDecisionSummary struct {
Allowed bool
HasPermissions bool
ExternalSource string
HasExact bool
DefaultAllow bool
}
// IntentionQueryExact holds the parameters for performing a lookup of an

6
agent/ui_endpoint_test.go
View File

@ -1431,6 +1431,7 @@ func TestUIServiceTopology(t *testing.T) {
EnterpriseMeta: *structs.DefaultEnterpriseMeta(),
},
Intention: structs.IntentionDecisionSummary{
DefaultAllow: true,
Allowed: true,
HasPermissions: false,
HasExact: true,
@ -1474,6 +1475,7 @@ func TestUIServiceTopology(t *testing.T) {
EnterpriseMeta: *structs.DefaultEnterpriseMeta(),
},
Intention: structs.IntentionDecisionSummary{
DefaultAllow: true,
Allowed: true,
HasPermissions: false,
HasExact: true,
@ -1493,6 +1495,7 @@ func TestUIServiceTopology(t *testing.T) {
EnterpriseMeta: *structs.DefaultEnterpriseMeta(),
},
Intention: structs.IntentionDecisionSummary{
DefaultAllow: true,
Allowed: false,
HasPermissions: false,
ExternalSource: "nomad",
@ -1542,6 +1545,7 @@ func TestUIServiceTopology(t *testing.T) {
EnterpriseMeta: *structs.DefaultEnterpriseMeta(),
},
Intention: structs.IntentionDecisionSummary{
DefaultAllow: true,
Allowed: false,
HasPermissions: true,
HasExact: true,
@ -1559,6 +1563,7 @@ func TestUIServiceTopology(t *testing.T) {
EnterpriseMeta: *structs.DefaultEnterpriseMeta(),
},
Intention: structs.IntentionDecisionSummary{
DefaultAllow: true,
Allowed: false,
HasPermissions: false,
ExternalSource: "nomad",
@ -1610,6 +1615,7 @@ func TestUIServiceTopology(t *testing.T) {
EnterpriseMeta: *structs.DefaultEnterpriseMeta(),
},
Intention: structs.IntentionDecisionSummary{
DefaultAllow: true,
Allowed: false,
HasPermissions: true,
HasExact: true,