|
| 1 | +mod json_parse; |
| 2 | + |
| 3 | +use json_parse::ConfigJwt; |
| 4 | +use proxy_wasm::traits::*; |
| 5 | +use proxy_wasm::types::*; |
| 6 | +use serde::Deserialize; |
| 7 | + |
| 8 | +use std::collections::HashMap; |
| 9 | + |
| 10 | +// We need to make sure a HTTP root context is created and initialized when the filter is initialized. |
| 11 | +// The _start() function initialises this root context |
| 12 | +#[no_mangle] |
| 13 | +pub fn _start() { |
| 14 | + proxy_wasm::set_log_level(LogLevel::Info); |
| 15 | + proxy_wasm::set_root_context(|_| -> Box<dyn RootContext> { |
| 16 | + Box::new(UpstreamCallRoot { |
| 17 | + config_jwt: ConfigJwt::new(), |
| 18 | + }) |
| 19 | + }); |
| 20 | +} |
| 21 | + |
| 22 | +// Defining standard CORS headers |
| 23 | +static CORS_HEADERS: [(&str, &str); 5] = [ |
| 24 | + ("Powered-By", "proxy-wasm"), |
| 25 | + ("Access-Control-Allow-Origin", "*"), |
| 26 | + ("Access-Control-Allow-Methods", "*"), |
| 27 | + ("Access-Control-Allow-Headers", "*"), |
| 28 | + ("Access-Control-Max-Age", "3600"), |
| 29 | +]; |
| 30 | + |
| 31 | +// This struct is what the JWT token sent by the user will deserialize to |
| 32 | +#[derive(Deserialize, Debug)] |
| 33 | +struct Jwt { |
| 34 | + headers: HashMap<String,String>, |
| 35 | + payload: HashMap<String,String>, |
| 36 | +} |
| 37 | + |
| 38 | +impl Jwt { |
| 39 | + fn new() -> Self { |
| 40 | + Jwt { |
| 41 | + headers: HashMap::new(), |
| 42 | + payload: HashMap::new(), |
| 43 | + } |
| 44 | + } |
| 45 | + |
| 46 | + fn add_header(&mut self, key: &String, value: &String) { |
| 47 | + self.headers.insert(key.clone(), value.clone()); |
| 48 | + } |
| 49 | + |
| 50 | + fn del_header(&mut self, key: &String) { |
| 51 | + self.headers.remove(key); |
| 52 | + } |
| 53 | + |
| 54 | + fn add_payload(&mut self, key: &String, value: &String) { |
| 55 | + self.payload.insert(key.clone(), value.clone()); |
| 56 | + } |
| 57 | + |
| 58 | + fn del_payload(&mut self, key: &String) { |
| 59 | + self.payload.remove(key); |
| 60 | + } |
| 61 | + |
| 62 | + fn payload_to_header(&mut self, key: &String, value: &String) { |
| 63 | + self.del_payload(key); |
| 64 | + self.add_header(key, value); |
| 65 | + } |
| 66 | + |
| 67 | + fn header_to_payload(&mut self, key: &String, value: &String) { |
| 68 | + self.del_header(key); |
| 69 | + self.add_payload(key, value); |
| 70 | + } |
| 71 | + |
| 72 | + // Wrapper function to run operations |
| 73 | + fn modify_jwt(&mut self, config: &ConfigJwt) { |
| 74 | + for (i,j ) in config.add_header.iter() { |
| 75 | + self.add_header(&i,&j); |
| 76 | + } |
| 77 | + |
| 78 | + for i in config.del_header.iter() { |
| 79 | + self.del_header(&i); |
| 80 | + } |
| 81 | + |
| 82 | + for (i,j ) in config.add_payload.iter() { |
| 83 | + self.add_payload(&i,&j); |
| 84 | + } |
| 85 | + |
| 86 | + for i in config.del_payload.iter() { |
| 87 | + self.del_payload(&i); |
| 88 | + } |
| 89 | + proxy_wasm::hostcalls::log(LogLevel::Critical, format!("jwt: {:#?}",self).as_str()) |
| 90 | + .ok(); |
| 91 | + |
| 92 | + for i in config.payload_to_header.iter() { |
| 93 | + proxy_wasm::hostcalls::log(LogLevel::Critical, format!("p2h: {}",i).as_str()).ok(); |
| 94 | + let (key,value) = (i.clone(),self.payload.get(i).unwrap().clone()); |
| 95 | + self.payload_to_header(&key,&value); |
| 96 | + } |
| 97 | + |
| 98 | + for i in config.header_to_payload.iter() { |
| 99 | + let (key,value) = (i.clone(),self.headers.get(i).unwrap().clone()); |
| 100 | + self.header_to_payload(&key.clone(), &value.clone()); |
| 101 | + } |
| 102 | + } |
| 103 | +} |
| 104 | + |
| 105 | +// This is the instance of a call made. It sorta derives from the root context |
| 106 | +#[derive(Debug)] |
| 107 | +struct UpstreamCall { |
| 108 | + config_jwt: ConfigJwt, |
| 109 | + final_jwt: String, |
| 110 | +} |
| 111 | + |
| 112 | +impl UpstreamCall { |
| 113 | + // Takes in the HashMap created in the root context mapping path name to rule type |
| 114 | + fn new(jwt: &ConfigJwt) -> Self { |
| 115 | + Self { |
| 116 | + config_jwt: jwt.clone(), |
| 117 | + final_jwt: String::new(), |
| 118 | + } |
| 119 | + } |
| 120 | +} |
| 121 | + |
| 122 | +impl Context for UpstreamCall {} |
| 123 | + |
| 124 | +impl HttpContext for UpstreamCall { |
| 125 | + fn on_http_request_headers(&mut self, _num_headers: usize) -> Action { |
| 126 | + if let Some(method) = self.get_http_request_header(":method") { |
| 127 | + if method == "OPTIONS" { |
| 128 | + self.send_http_response(204, CORS_HEADERS.to_vec(), None); |
| 129 | + return Action::Pause; |
| 130 | + } |
| 131 | + } |
| 132 | + |
| 133 | + |
| 134 | + if let Some(jwt) = self.get_http_request_header("Authorization") { |
| 135 | + // Decoding JWT token |
| 136 | + let mut split_jwt: Vec<String> = jwt.splitn(3,".").map(|s| s.to_string()).collect(); |
| 137 | + let (h, p) = (split_jwt[0].as_str(), split_jwt[1].as_str()); |
| 138 | + let mut jwt = Jwt::new(); |
| 139 | + |
| 140 | + //proxy_wasm::hostcalls::log(LogLevel::Critical, format!("h: {},p:{}",h,p).as_str()) |
| 141 | + // .ok(); |
| 142 | + |
| 143 | + //TODO: handle different types passed to json(modify config?) |
| 144 | + let b64_headers=base64::decode(h).unwrap(); |
| 145 | + let b64_payload=base64::decode(p).unwrap(); |
| 146 | + |
| 147 | + //proxy_wasm::hostcalls::log(LogLevel::Critical, format!("h64: {:?},p64:{:?}",b64_headers,b64_payload).as_str()) |
| 148 | + // .ok(); |
| 149 | + |
| 150 | + jwt.headers = serde_json::from_slice(&b64_headers).unwrap(); |
| 151 | + jwt.payload = serde_json::from_slice(&b64_payload).unwrap(); |
| 152 | + |
| 153 | + //proxy_wasm::hostcalls::log(LogLevel::Critical, format!("Jwt: {:?}",jwt).as_str()) |
| 154 | + // .ok(); |
| 155 | + |
| 156 | + jwt.modify_jwt(&self.config_jwt); |
| 157 | + |
| 158 | + let mut b64_header = base64::encode(serde_json::to_string(&jwt.headers).unwrap()); |
| 159 | + let mut b64_payload = base64::encode(serde_json::to_string(&jwt.payload).unwrap()); |
| 160 | + |
| 161 | + b64_header.pop(); |
| 162 | + b64_header.pop(); |
| 163 | + b64_payload.pop(); |
| 164 | + b64_payload.pop(); |
| 165 | + |
| 166 | + split_jwt[0] = b64_header; |
| 167 | + split_jwt[1] = b64_payload; |
| 168 | + let new_jwt = split_jwt.join("."); |
| 169 | + |
| 170 | + self.set_http_request_header("Authorization", Some(new_jwt.as_str())); |
| 171 | + |
| 172 | + // Initialising headers to send back |
| 173 | + let mut headers = CORS_HEADERS.to_vec(); |
| 174 | + |
| 175 | + /* |
| 176 | + if false { |
| 177 | + self.send_http_response( |
| 178 | + 429, |
| 179 | + headers, |
| 180 | + Some(b"Invalid plan name or duplicate plan names defined.\n"), |
| 181 | + ); |
| 182 | + return Action::Pause; |
| 183 | + } |
| 184 | + */ |
| 185 | + |
| 186 | + proxy_wasm::hostcalls::log(LogLevel::Debug, format!("jwt: {:?}", new_jwt).as_str()) |
| 187 | + .ok(); |
| 188 | + |
| 189 | + headers.append(&mut vec![("jwt_test", new_jwt.as_str())]); |
| 190 | + self.send_http_response(200, headers, Some(b"OK\n")); |
| 191 | + return Action::Pause; |
| 192 | + } |
| 193 | + |
| 194 | + self.send_http_response(401, CORS_HEADERS.to_vec(), Some(b"Unauthorized\n")); |
| 195 | + Action::Continue |
| 196 | + } |
| 197 | + |
| 198 | + fn on_http_response_headers(&mut self, _num_headers: usize) -> Action { |
| 199 | + self.set_http_response_header("x-app-serving", Some("rate-limit-filter")); |
| 200 | + proxy_wasm::hostcalls::log(LogLevel::Debug, format!("RESPONDING").as_str()).ok(); |
| 201 | + Action::Continue |
| 202 | + } |
| 203 | +} |
| 204 | + |
| 205 | +struct UpstreamCallRoot { |
| 206 | + config_jwt: ConfigJwt, |
| 207 | +} |
| 208 | + |
| 209 | +impl Context for UpstreamCallRoot {} |
| 210 | +impl<'a> RootContext for UpstreamCallRoot { |
| 211 | + //TODO: Revisit this once the read only feature is released in Istio 1.10 |
| 212 | + // Get Base64 encoded JSON from envoy config file when WASM VM starts |
| 213 | + fn on_vm_start(&mut self, _: usize) -> bool { |
| 214 | + if let Some(config_bytes) = self.get_configuration() { |
| 215 | + // bytestring passed by VM -> String of base64 encoded JSON |
| 216 | + let config_str = String::from_utf8(config_bytes).unwrap(); |
| 217 | + // String of base64 encoded JSON -> bytestring of decoded JSON |
| 218 | + let config_b64 = base64::decode(config_str).unwrap(); |
| 219 | + // bytestring of decoded JSON -> String of decoded JSON |
| 220 | + let json_str = String::from_utf8(config_b64).unwrap(); |
| 221 | + // Creating HashMap of pattern ("path name", "rule type") and saving into UpstreamCallRoot object |
| 222 | + self.config_jwt=serde_json::from_str(&json_str).unwrap(); |
| 223 | + proxy_wasm::hostcalls::log(LogLevel::Critical, format!("config: {:#?}", self.config_jwt).as_str()) |
| 224 | + .ok(); |
| 225 | + } |
| 226 | + true |
| 227 | + } |
| 228 | + |
| 229 | + fn create_http_context(&self, _: u32) -> Option<Box<dyn HttpContext>> { |
| 230 | + // creating UpstreamCall object for each new call |
| 231 | + Some(Box::new(UpstreamCall::new(&self.config_jwt))) |
| 232 | + } |
| 233 | + |
| 234 | + fn get_type(&self) -> Option<ContextType> { |
| 235 | + Some(ContextType::HttpContext) |
| 236 | + } |
| 237 | +} |
0 commit comments