Skip to content

Commit 1a6f3cf

Browse files
PiotrSikoraPiotrSikora
authored
Merge branch 'main' into bazel_v7.2.1
2 parents 85b6333 + 74f60a4 commit 1a6f3cf

File tree

14 files changed

+376
-39
lines changed

14 files changed

+376
-39
lines changed

‎.github/workflows/rust.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,7 @@ jobs:
238238
- 'http_body'
239239
- 'http_config'
240240
- 'http_headers'
241+
- 'grpc_auth_random'
241242

242243
defaults:
243244
run:
@@ -301,6 +302,7 @@ jobs:
301302
- 'http_body'
302303
- 'http_config'
303304
- 'http_headers'
305+
- 'grpc_auth_random'
304306

305307
defaults:
306308
run:

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
- [HTTP Headers](./examples/http_headers/)
2222
- [HTTP Response body](./examples/http_body/)
2323
- [HTTP Configuration](./examples/http_config/)
24+
- [gRPC Auth (random)](./examples/grpc_auth_random/)
2425

2526
## Articles & blog posts from the community
2627

‎examples/grpc_auth_random/Cargo.toml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
[package]
2+
publish = false
3+
name = "proxy-wasm-example-grpc-auth-random"
4+
version = "0.0.1"
5+
description = "Proxy-Wasm plugin example: gRPC auth (random)"
6+
license = "Apache-2.0"
7+
edition = "2018"
8+
9+
[lib]
10+
crate-type = ["cdylib"]
11+
12+
[dependencies]
13+
log = "0.4"
14+
proxy-wasm = { path = "../../" }
15+
16+
[profile.release]
17+
lto = true
18+
opt-level = 3
19+
codegen-units = 1
20+
panic = "abort"
21+
strip = "debuginfo"

‎examples/grpc_auth_random/README.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
## Proxy-Wasm plugin example: gRPC auth (random)
2+
3+
Proxy-Wasm plugin that grants access based on a result of gRPC callout.
4+
5+
### Building
6+
7+
```sh
8+
$ cargo build --target wasm32-wasi --release
9+
```
10+
11+
### Using in Envoy
12+
13+
This example can be run with [`docker compose`](https://docs.docker.com/compose/install/)
14+
and has a matching Envoy configuration.
15+
16+
```sh
17+
$ docker compose up
18+
```
19+
20+
#### Access granted.
21+
22+
Send gRPC request to `localhost:10000` service `hello.HelloService`:
23+
24+
```sh
25+
$ grpcurl -d '{"greeting": "Rust"}' -plaintext localhost:10000 hello.HelloService/SayHello
26+
{
27+
"reply": "hello Rust"
28+
}
29+
```
30+
31+
Expected Envoy logs:
32+
33+
```console
34+
[...] wasm log grpc_auth_random: Access granted.
35+
```
36+
37+
#### Access forbidden.
38+
39+
Send gRPC request to `localhost:10000` service `hello.HelloService`:
40+
41+
```sh
42+
$ grpcurl -d '{"greeting": "Rust"}' -plaintext localhost:10000 hello.HelloService/SayHello
43+
ERROR:
44+
Code: Aborted
45+
Message: Aborted by Proxy-Wasm!
46+
```
47+
48+
Expected Envoy logs:
49+
50+
```console
51+
[...] wasm log grpc_auth_random: Access forbidden.
52+
```

‎examples/grpc_auth_random/docker-compose.yaml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Copyright 2022 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
services:
16+
envoy:
17+
image: envoyproxy/envoy:v1.24-latest
18+
hostname: envoy
19+
ports:
20+
- "10000:10000"
21+
volumes:
22+
- ./envoy.yaml:/etc/envoy/envoy.yaml
23+
- ./target/wasm32-wasi/release:/etc/envoy/proxy-wasm-plugins
24+
networks:
25+
- envoymesh
26+
depends_on:
27+
- grpcbin
28+
grpcbin:
29+
image: kong/grpcbin
30+
hostname: grpcbin
31+
ports:
32+
- "9000:9000"
33+
networks:
34+
- envoymesh
35+
networks:
36+
envoymesh: {}

‎examples/grpc_auth_random/envoy.yaml

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Copyright 2022 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
static_resources:
16+
listeners:
17+
address:
18+
socket_address:
19+
address: 0.0.0.0
20+
port_value: 10000
21+
filter_chains:
22+
- filters:
23+
- name: envoy.filters.network.http_connection_manager
24+
typed_config:
25+
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
26+
stat_prefix: ingress_http
27+
codec_type: AUTO
28+
route_config:
29+
name: local_routes
30+
virtual_hosts:
31+
- name: local_service
32+
domains:
33+
- "*"
34+
routes:
35+
- match:
36+
prefix: "/"
37+
route:
38+
cluster: grpcbin
39+
http_filters:
40+
- name: envoy.filters.http.wasm
41+
typed_config:
42+
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
43+
type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
44+
value:
45+
config:
46+
name: "grpc_auth_random"
47+
vm_config:
48+
runtime: "envoy.wasm.runtime.v8"
49+
code:
50+
local:
51+
filename: "/etc/envoy/proxy-wasm-plugins/proxy_wasm_example_grpc_auth_random.wasm"
52+
- name: envoy.filters.http.router
53+
typed_config:
54+
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
55+
clusters:
56+
- name: grpcbin
57+
connect_timeout: 5s
58+
type: STRICT_DNS
59+
lb_policy: ROUND_ROBIN
60+
http2_protocol_options: {}
61+
load_assignment:
62+
cluster_name: grpcbin
63+
endpoints:
64+
- lb_endpoints:
65+
- endpoint:
66+
address:
67+
socket_address:
68+
address: grpcbin
69+
port_value: 9000

‎examples/grpc_auth_random/src/lib.rs

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
// Copyright 2020 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
use log::info;
16+
use proxy_wasm::traits::*;
17+
use proxy_wasm::types::*;
18+
use std::time::Duration;
19+
20+
proxy_wasm::main! {{
21+
proxy_wasm::set_log_level(LogLevel::Trace);
22+
proxy_wasm::set_http_context(|_, _| -> Box<dyn HttpContext> { Box::new(GrpcAuthRandom) });
23+
}}
24+
25+
struct GrpcAuthRandom;
26+
27+
impl HttpContext for GrpcAuthRandom {
28+
fn on_http_request_headers(&mut self, _: usize, _: bool) -> Action {
29+
match self.get_http_request_header("content-type") {
30+
Some(value) if value.starts_with("application/grpc") => {}
31+
_ => {
32+
// Reject non-gRPC clients.
33+
self.send_http_response(
34+
503,
35+
vec![("Powered-By", "proxy-wasm")],
36+
Some(b"Service accessible only to gRPC clients.\n"),
37+
);
38+
return Action::Pause;
39+
}
40+
}
41+
42+
match self.get_http_request_header(":path") {
43+
Some(value) if value.starts_with("/grpc.reflection") => {
44+
// Always allow gRPC calls to the reflection API.
45+
Action::Continue
46+
}
47+
_ => {
48+
// Allow other gRPC calls based on the result of grpcbin.GRPCBin/RandomError.
49+
self.dispatch_grpc_call(
50+
"grpcbin",
51+
"grpcbin.GRPCBin",
52+
"RandomError",
53+
vec![],
54+
None,
55+
Duration::from_secs(1),
56+
)
57+
.unwrap();
58+
Action::Pause
59+
}
60+
}
61+
}
62+
63+
fn on_http_response_headers(&mut self, _: usize, _: bool) -> Action {
64+
self.set_http_response_header("Powered-By", Some("proxy-wasm"));
65+
Action::Continue
66+
}
67+
}
68+
69+
impl Context for GrpcAuthRandom {
70+
fn on_grpc_call_response(&mut self, _: u32, status_code: u32, _: usize) {
71+
if status_code % 2 == 0 {
72+
info!("Access granted.");
73+
self.resume_http_request();
74+
} else {
75+
info!("Access forbidden.");
76+
self.send_grpc_response(
77+
GrpcStatusCode::Aborted,
78+
Some("Aborted by Proxy-Wasm!"),
79+
vec![("Powered-By", b"proxy-wasm")],
80+
);
81+
}
82+
}
83+
}

‎examples/http_auth_random/docker-compose.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,5 +23,14 @@ services:
2323
- ./target/wasm32-wasi/release:/etc/envoy/proxy-wasm-plugins
2424
networks:
2525
- envoymesh
26+
depends_on:
27+
- httpbin
28+
httpbin:
29+
image: mccutchen/go-httpbin
30+
hostname: httpbin
31+
ports:
32+
- "8080:8080"
33+
networks:
34+
- envoymesh
2635
networks:
2736
envoymesh: {}

‎examples/http_auth_random/envoy.yaml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,5 @@ static_resources:
6464
- endpoint:
6565
address:
6666
socket_address:
67-
address: httpbin.org
68-
port_value: 80
69-
hostname: "httpbin.org"
67+
address: httpbin
68+
port_value: 8080

‎examples/http_auth_random/src/lib.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ impl HttpContext for HttpAuthRandom {
3535
],
3636
None,
3737
vec![],
38-
Duration::from_secs(5),
38+
Duration::from_secs(1),
3939
)
4040
.unwrap();
4141
Action::Pause

0 commit comments

Comments
 (0)