Skip to content

Commit 082bf0f

Browse files
akshaysnguptaakshaysngupta
authored
fix: when path=('/', '/*', ''), set the waf policy to listener (#863)
1 parent 5195fbc commit 082bf0f

File tree

4 files changed

+116
-17
lines changed

4 files changed

+116
-17
lines changed

‎functional_tests/functional_test.go‎

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -701,6 +701,49 @@ var _ = ginkgo.Describe("Tests `appgw.ConfigBuilder`", func() {
701701
},
702702
}
703703

704+
ingressSlashNothingSlashSomething := &v1beta1.Ingress{
705+
Spec: v1beta1.IngressSpec{
706+
Rules: []v1beta1.IngressRule{
707+
{
708+
// This one has no host
709+
IngressRuleValue: v1beta1.IngressRuleValue{
710+
HTTP: &v1beta1.HTTPIngressRuleValue{
711+
Paths: []v1beta1.HTTPIngressPath{
712+
{
713+
Path: "/",
714+
Backend: v1beta1.IngressBackend{
715+
ServiceName: serviceNameB,
716+
ServicePort: intstr.IntOrString{
717+
Type: intstr.Int,
718+
IntVal: 80,
719+
},
720+
},
721+
},
722+
{
723+
Path: "/A",
724+
Backend: v1beta1.IngressBackend{
725+
ServiceName: serviceNameA,
726+
ServicePort: intstr.IntOrString{
727+
Type: intstr.Int,
728+
IntVal: 80,
729+
},
730+
},
731+
},
732+
},
733+
},
734+
},
735+
},
736+
},
737+
},
738+
ObjectMeta: metav1.ObjectMeta{
739+
Annotations: map[string]string{
740+
annotations.IngressClassKey: annotations.ApplicationGatewayIngressClass,
741+
},
742+
Namespace: tests.Namespace,
743+
Name: tests.Name,
744+
},
745+
}
746+
704747
ginkgo.It("THREE Ingress Resources", func() {
705748
cbCtx := &ConfigBuilderContext{
706749
IngressList: []*v1beta1.Ingress{
@@ -851,7 +894,7 @@ var _ = ginkgo.Describe("Tests `appgw.ConfigBuilder`", func() {
851894
})
852895

853896
ginkgo.It("WAF Annotation", func() {
854-
annotatedIngress := ingressB
897+
annotatedIngress := ingressSlashNothingSlashSomething
855898
annotatedIngress.Annotations[annotations.FirewallPolicy] = "/some/policy/here"
856899

857900
cbCtx := &ConfigBuilderContext{
@@ -863,6 +906,8 @@ var _ = ginkgo.Describe("Tests `appgw.ConfigBuilder`", func() {
863906
ExistingPortsByNumber: map[Port]n.ApplicationGatewayFrontendPort{
864907
Port(80): fixtures.GetDefaultPort(),
865908
},
909+
DefaultAddressPoolID: to.StringPtr("xx"),
910+
DefaultHTTPSettingsID: to.StringPtr("yy"),
866911
}
867912
check(cbCtx, "waf_annotation.json", stopChannel, ctxt, configBuilder)
868913
})

‎functional_tests/waf_annotation.json‎

Lines changed: 61 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,23 @@
88
"backendAddresses": []
99
}
1010
},
11+
{
12+
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/backendAddressPools/pool---namespace---hello-world-a-80-bp-80",
13+
"name": "pool---namespace---hello-world-a-80-bp-80",
14+
"properties": {
15+
"backendAddresses": [
16+
{
17+
"ipAddress": "1.1.1.1"
18+
},
19+
{
20+
"ipAddress": "1.1.1.2"
21+
},
22+
{
23+
"ipAddress": "1.1.1.3"
24+
}
25+
]
26+
}
27+
},
1128
{
1229
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/backendAddressPools/pool---namespace---hello-world-b-80-bp-80",
1330
"name": "pool---namespace---hello-world-b-80-bp-80",
@@ -27,6 +44,20 @@
2744
}
2845
],
2946
"backendHttpSettingsCollection": [
47+
{
48+
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/backendHttpSettingsCollection/bp---namespace---hello-world-a-80-80---name--",
49+
"name": "bp---namespace---hello-world-a-80-80---name--",
50+
"properties": {
51+
"cookieBasedAffinity": "Disabled",
52+
"pickHostNameFromBackendAddress": false,
53+
"port": 80,
54+
"probe": {
55+
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/probes/pb---namespace---hello-world-a-80---name--"
56+
},
57+
"protocol": "Http",
58+
"requestTimeout": 30
59+
}
60+
},
3061
{
3162
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/backendHttpSettingsCollection/bp---namespace---hello-world-b-80-80---name--",
3263
"name": "bp---namespace---hello-world-b-80-80---name--",
@@ -88,6 +119,9 @@
88119
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/httpListeners/fl-e1903c8aa3446b7b3207aec6d6ecba8a",
89120
"name": "fl-e1903c8aa3446b7b3207aec6d6ecba8a",
90121
"properties": {
122+
"firewallPolicy": {
123+
"id": "/some/policy/here"
124+
},
91125
"frontendIPConfiguration": {
92126
"id": "--front-end-ip-id-1--"
93127
},
@@ -131,6 +165,21 @@
131165
"unhealthyThreshold": 3
132166
}
133167
},
168+
{
169+
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/probes/pb---namespace---hello-world-a-80---name--",
170+
"name": "pb---namespace---hello-world-a-80---name--",
171+
"properties": {
172+
"host": "localhost",
173+
"interval": 30,
174+
"match": {},
175+
"minServers": 0,
176+
"path": "/A",
177+
"pickHostNameFromBackendHttpSettings": false,
178+
"protocol": "Http",
179+
"timeout": 30,
180+
"unhealthyThreshold": 3
181+
}
182+
},
134183
{
135184
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/probes/pb---namespace---hello-world-b-80---name--",
136185
"name": "pb---namespace---hello-world-b-80---name--",
@@ -139,7 +188,7 @@
139188
"interval": 30,
140189
"match": {},
141190
"minServers": 0,
142-
"path": "/B/",
191+
"path": "/",
143192
"pickHostNameFromBackendHttpSettings": false,
144193
"protocol": "Http",
145194
"timeout": 30,
@@ -174,24 +223,28 @@
174223
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/urlPathMaps/url-e1903c8aa3446b7b3207aec6d6ecba8a",
175224
"name": "url-e1903c8aa3446b7b3207aec6d6ecba8a",
176225
"properties": {
177-
"defaultBackendAddressPool": {},
178-
"defaultBackendHttpSettings": {},
226+
"defaultBackendAddressPool": {
227+
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/backendAddressPools/pool---namespace---hello-world-b-80-bp-80"
228+
},
229+
"defaultBackendHttpSettings": {
230+
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/backendHttpSettingsCollection/bp---namespace---hello-world-b-80-80---name--"
231+
},
179232
"pathRules": [
180233
{
181-
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/urlPathMaps/url-e1903c8aa3446b7b3207aec6d6ecba8a/pathRules/pr---namespace-----name---0",
182-
"name": "pr---namespace-----name---0",
234+
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/urlPathMaps/url-e1903c8aa3446b7b3207aec6d6ecba8a/pathRules/pr---namespace-----name---1",
235+
"name": "pr---namespace-----name---1",
183236
"properties": {
184237
"backendAddressPool": {
185-
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/backendAddressPools/pool---namespace---hello-world-b-80-bp-80"
238+
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/backendAddressPools/pool---namespace---hello-world-a-80-bp-80"
186239
},
187240
"backendHttpSettings": {
188-
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/backendHttpSettingsCollection/bp---namespace---hello-world-b-80-80---name--"
241+
"id": "/subscriptions/--subscription--/resourceGroups/--resource-group--/providers/Microsoft.Network/applicationGateways/--app-gw-name--/backendHttpSettingsCollection/bp---namespace---hello-world-a-80-80---name--"
189242
},
190243
"firewallPolicy": {
191244
"id": "/some/policy/here"
192245
},
193246
"paths": [
194-
"/B/"
247+
"/A"
195248
]
196249
}
197250
}

‎pkg/appgw/ingress_rules.go‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,13 +51,12 @@ func (c *appGwConfigBuilder) getListenersFromIngress(ingress *v1beta1.Ingress, e
5151
func (c *appGwConfigBuilder) applyToListener(rule *v1beta1.IngressRule) bool {
5252
for pathIdx := range rule.HTTP.Paths {
5353
path := &rule.HTTP.Paths[pathIdx]
54-
// if path is specified, apply waf policy to the pathRule, otherwise apply to a listener, listener is per ingress host
55-
if len(path.Path) != 0 && path.Path != "/" && path.Path != "/*" {
56-
// apply to path rule instead of listener
57-
return false
54+
// if there is path that is /, /* , empty string, then apply the waf policy to the listener.
55+
if len(path.Path) == 0 || path.Path == "/" || path.Path == "/*" {
56+
return true
5857
}
5958
}
60-
return true
59+
return false
6160
}
6261

6362
func (c *appGwConfigBuilder) processIngressRuleWithTLS(rule *v1beta1.IngressRule, ingress *v1beta1.Ingress, env environment.EnvVariables) (map[Port]interface{}, map[listenerIdentifier]listenerAzConfig) {

‎scripts/e2e/cmd/runner/testdata/one-namespace-one-ingress/ssl-e2e-redirect/app.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,19 +70,21 @@ metadata:
7070
appgw.ingress.kubernetes.io/ssl-redirect: "true"
7171
appgw.ingress.kubernetes.io/backend-hostname: "test"
7272
appgw.ingress.kubernetes.io/appgw-trusted-root-certificate: "test"
73+
appgw.ingress.kubernetes.io/waf-policy-for-path : "/subscriptions/2ce9a29e-219e-422b-b9f8-5c5e54d5439e/resourceGroups/agic-e2e/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/waf-policy"
7374
spec:
7475
tls:
7576
- secretName: testsecret-tls
76-
backend:
77-
serviceName: ssl-redirect-service
78-
servicePort: 443
7977
rules:
8078
- http:
8179
paths:
8280
- path: /index.html
8381
backend:
8482
serviceName: ssl-redirect-service
8583
servicePort: 443
84+
- path: /*
85+
backend:
86+
serviceName: ssl-redirect-service
87+
servicePort: 443
8688
---
8789
apiVersion: v1
8890
kind: Secret

0 commit comments

Comments
 (0)