Route security management by end user #14536

pecameron · 2017-06-08T21:05:03Z

Add a new route annotation "haproxy.router.openshift.io/ip_whitelist"
that specifies a space separated list of white listed source IP
addresses and/or CIDRs. Requests from IP addresses that are not in
the whitelist are dropped.

When the annotation is present for a route a acl is set up in the
backend with the whitelist.

This PR addresses issue #13709

Some examples:

When editing a route add the following annotation to define the desired
source ip's.

allow only one ip

haproxy.router.openshift.io/whitelist:
192.168.1.10

several ip's

haproxy.router.openshift.io/whitelist:
192.168.1.10 192.168.1.11 192.168.1.12

ip ranges

haproxy.router.openshift.io/whitelist:
192.168.1.0/24

ip's and ranges

haproxy.router.openshift.io/whitelist:
180.5.61.153 192.168.1.0/24 10.0.0.0/8

Trello: TbZPhHKE Route security management by end user
https://trello.com/c/TbZPhHKE/

Bug: 1426562
https://bugzilla.redhat.com/show_bug.cgi?id=1426562

This was ported from PR 13729

Committer: pcameron@redhat.com
Author: aranda@redhat.com

pecameron · 2017-06-08T21:10:25Z

@openshift/networking @knobunc @jorgemoralespou PTAL
@fbac

jorgemoralespou · 2017-06-08T21:13:54Z

@fbac Take a look at this PR

fbac · 2017-06-09T07:53:13Z

Great work, thank guys! 👍

knobunc

Sorry, woke up this morning with some more thoughts about this. Just minor stuff. The general thrust is good.

knobunc · 2017-06-09T12:27:13Z

images/router/haproxy/conf/haproxy-config.template

@@ -6,6 +6,9 @@
 {{- define "/var/lib/haproxy/conf/haproxy.config" }}
 {{- $workingDir := .WorkingDir }}
 {{- $defaultDestinationCA := .DefaultDestinationCA }}
+{{- $cidrPattern := "(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(/([0-9]|[1-2][0-9]|3[0-2]))?" -}}


We could make this a hair less ugly by having:

{{- $quadPattern := "(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])" -}}
{{- $ipPattern := printf "(?:%s\.%s\.%s\.%s)" $quadPattern $quadPattern $quadPattern $quadPattern -}}
{{- $cidrPattern := printf "(?:%s(?:/(?:[0-9]|[1-2][0-9]|3[0-2]))?)" $ipPattern -}}

I also think we should wrap all named regexes in ()s (as I did above) so that they are more easily composed into other regexes without the alternations getting messed up. (i.e. if I have $foo := "a|b"; then that is risky to use in a subsequent regex.

Also all regexes should not be using capturing ()s. We should say (?:) instead.

Finally, all regexes should have a comment explaining what they match, with a sample match.

knobunc · 2017-06-09T12:28:11Z

images/router/haproxy/conf/haproxy-config.template

@@ -6,6 +6,9 @@
 {{- define "/var/lib/haproxy/conf/haproxy.config" }}
 {{- $workingDir := .WorkingDir }}
 {{- $defaultDestinationCA := .DefaultDestinationCA }}
+{{- $cidrPattern := "(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(/([0-9]|[1-2][0-9]|3[0-2]))?" -}}
+{{- $cidrListPattern := printf "%s( +(%s))*" $cidrPattern $cidrPattern -}}


Based on the above rules, this should be:
{{- $cidrListPattern := printf "(?:%s(?: +%s)*)" $cidrPattern $cidrPattern -}}

pecameron · 2017-06-09T13:49:38Z

@knobunc is this what you are looking for? PTAL

knobunc

LGTM

I'd really like to see some tests... but I'm not sure how

knobunc · 2017-06-09T19:34:47Z

images/router/haproxy/conf/haproxy-config.template

+
+{{/* A bunch of regular expressions. Each should be wrapped in (?:) so that it is safe to include bare */}}
+{{/* quadPattern: Match a quad in an IP address; e.g. 123 */}}
+{{- $quadPattern := "(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])" -}}


Much better. But can we flip all of these regexes to be enclosed in backticks, that way we can lose any double \ stuff. Do it to all of the ones you are adding just for consistency.

Add a new route annotation "haproxy.router.openshift.io/ip_whitelist" that specifies a space separated list of white listed source IP addresses and/or CIDRs. Requests from IP addresses that are not in the whitelist are dropped. When the annotation is present for a route a acl is set up in the backend with the whitelist. This PR addresses issue openshift#13709 Some examples: When editing a route add the following annotation to define the desired source ip's. 1) allow only one ip haproxy.router.openshift.io/whitelist: 192.168.1.10 2) several ip's haproxy.router.openshift.io/whitelist: 192.168.1.10 192.168.1.11 192.168.1.12 3) ip ranges haproxy.router.openshift.io/whitelist: 192.168.1.0/24 4) ip's and ranges haproxy.router.openshift.io/whitelist: 180.5.61.153 192.168.1.0/24 10.0.0.0/8 Trello: TbZPhHKE Route security management by end user https://trello.com/c/TbZPhHKE/ Bug: 1426562 https://bugzilla.redhat.com/show_bug.cgi?id=1426562 Committer: pcameron@redhat.com Author: aranda@redhat.com

pecameron · 2017-06-12T13:25:34Z

@knobunc I put in the `, is this ready to merge?

knobunc · 2017-06-12T14:28:24Z

@pecameron I'd like someone else to weigh in. I flagged @rajatchopra for review too.

pravisankar

Changes looks good to me.

knobunc · 2017-06-14T18:09:07Z

[merge]

openshift-bot · 2017-06-14T18:14:01Z

[Test]ing while waiting on the merge queue

openshift-bot · 2017-06-14T18:22:16Z

Evaluated for origin test up to 7c4719f

openshift-bot · 2017-06-14T20:17:43Z

continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pull_request_origin/2229/) (Base Commit: ee9f436)

pecameron · 2017-06-15T17:21:47Z

flaked on #13816

The error was in https://ci.openshift.redhat.com/jenkins/job/merge_pull_request_origin/1007/consoleFull#-169259343956c60d7be4b02b88ae8c268b

knobunc · 2017-06-15T17:43:46Z

[merge][severity: bug]

openshift-bot · 2017-06-15T17:59:11Z

Evaluated for origin merge up to 7c4719f

openshift-bot · 2017-06-15T20:56:43Z

continuous-integration/openshift-jenkins/merge FAILURE (https://ci.openshift.redhat.com/jenkins/job/merge_pull_request_origin/1010/) (Base Commit: 98b2737) (PR Branch Commit: 7c4719f) (Extended Tests: bug)

dobbymoodge · 2017-06-15T21:05:30Z

False merge failure, merging anyway

Openshift 3.6 Add a new route annotation "haproxy.router.openshift.io/ip_whitelist" that specifies a space separated list of white listed source IP addresses and/or CIDRs. Requests from IP addresses that are not in the whitelist are dropped. origin PR 14536 openshift/origin#14536 Trello: TbZPhHKE Route security management by end user https://trello.com/c/TbZPhHKE/ Bug: 1426562 https://bugzilla.redhat.com/show_bug.cgi?id=1426562

knobunc requested changes Jun 9, 2017

View reviewed changes

pecameron force-pushed the bz1426562 branch from d6f1db8 to 838abdf Compare June 9, 2017 13:49

pecameron force-pushed the bz1426562 branch from 838abdf to 74c592d Compare June 9, 2017 14:58

knobunc approved these changes Jun 9, 2017

View reviewed changes

pecameron force-pushed the bz1426562 branch from 74c592d to 7c4719f Compare June 12, 2017 13:21

knobunc requested a review from rajatchopra June 12, 2017 14:27

pravisankar approved these changes Jun 13, 2017

View reviewed changes

dobbymoodge merged commit 34764f7 into openshift:master Jun 15, 2017

pecameron mentioned this pull request Jun 16, 2017

Route security management by end user openshift/openshift-docs#4590

Merged

pecameron deleted the bz1426562 branch June 19, 2017 15:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Route security management by end user #14536

Route security management by end user #14536

pecameron commented Jun 8, 2017 •

edited

Loading

pecameron commented Jun 8, 2017

jorgemoralespou commented Jun 8, 2017

fbac commented Jun 9, 2017

knobunc left a comment

knobunc Jun 9, 2017

pecameron Jun 9, 2017

knobunc Jun 9, 2017

pecameron Jun 9, 2017

pecameron commented Jun 9, 2017

knobunc left a comment

knobunc Jun 9, 2017

pecameron commented Jun 12, 2017 •

edited

Loading

knobunc commented Jun 12, 2017

pravisankar left a comment

knobunc commented Jun 14, 2017

openshift-bot commented Jun 14, 2017

openshift-bot commented Jun 14, 2017

openshift-bot commented Jun 14, 2017

pecameron commented Jun 15, 2017

knobunc commented Jun 15, 2017

openshift-bot commented Jun 15, 2017

openshift-bot commented Jun 15, 2017

dobbymoodge commented Jun 15, 2017

Route security management by end user #14536

Route security management by end user #14536

Conversation

pecameron commented Jun 8, 2017 • edited Loading

pecameron commented Jun 8, 2017

jorgemoralespou commented Jun 8, 2017

fbac commented Jun 9, 2017

knobunc left a comment

Choose a reason for hiding this comment

knobunc Jun 9, 2017

Choose a reason for hiding this comment

pecameron Jun 9, 2017

Choose a reason for hiding this comment

knobunc Jun 9, 2017

Choose a reason for hiding this comment

pecameron Jun 9, 2017

Choose a reason for hiding this comment

pecameron commented Jun 9, 2017

knobunc left a comment

Choose a reason for hiding this comment

knobunc Jun 9, 2017

Choose a reason for hiding this comment

pecameron commented Jun 12, 2017 • edited Loading

knobunc commented Jun 12, 2017

pravisankar left a comment

Choose a reason for hiding this comment

knobunc commented Jun 14, 2017

openshift-bot commented Jun 14, 2017

openshift-bot commented Jun 14, 2017

openshift-bot commented Jun 14, 2017

pecameron commented Jun 15, 2017

knobunc commented Jun 15, 2017

openshift-bot commented Jun 15, 2017

openshift-bot commented Jun 15, 2017

dobbymoodge commented Jun 15, 2017

pecameron commented Jun 8, 2017 •

edited

Loading

pecameron commented Jun 12, 2017 •

edited

Loading