DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement object deep inspector (#8456)

Browse source
This commit is contained in:
Ricardo Katz 2022-04-11 11:06:07 -03:00 • committed by GitHub
parent 5737f16663
commit 89ed571d2a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
15 changed files with 468 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
internal/ingress/controller/controller.go
View file

@ -41,6 +41,7 @@ import (
"k8s.io/ingress-nginx/internal/ingress/controller/ingressclass"
"k8s.io/ingress-nginx/internal/ingress/controller/store"
"k8s.io/ingress-nginx/internal/ingress/errors"
"k8s.io/ingress-nginx/internal/ingress/inspector"
"k8s.io/ingress-nginx/internal/ingress/metric/collectors"
"k8s.io/ingress-nginx/internal/k8s"
"k8s.io/ingress-nginx/internal/nginx"
@ -123,6 +124,7 @@ type Configuration struct {
InternalLoggerAddress string
IsChroot bool
DeepInspector bool
}
// GetPublishService returns the Service used to set the load-balancer status of Ingresses.
@ -237,7 +239,11 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error {
if !ing.DeletionTimestamp.IsZero() {
return nil
}
if n.cfg.DeepInspector {
if err := inspector.DeepInspect(ing); err != nil {
return fmt.Errorf("invalid object: %w", err)
}
}
// Do not attempt to validate an ingress that's not meant to be controlled by the current instance of the controller.
if ingressClass, err := n.store.GetIngressClass(ing, n.cfg.IngressClassConfiguration); ingressClass == "" {
klog.Warningf("ignoring ingress %v in %v based on annotation %v: %v", ing.Name, ing.ObjectMeta.Namespace, ingressClass, err)

2
internal/ingress/controller/controller_test.go
View file

@ -2396,6 +2396,7 @@ func newNGINXController(t *testing.T) *NGINXController {
clientSet,
channels.NewRingChannel(10),
false,
true,
&ingressclass.IngressClassConfiguration{
Controller: "k8s.io/ingress-nginx",
AnnotationValue: "nginx",
@ -2460,6 +2461,7 @@ func newDynamicNginxController(t *testing.T, setConfigMap func(string) *v1.Confi
clientSet,
channels.NewRingChannel(10),
false,
true,
&ingressclass.IngressClassConfiguration{
Controller: "k8s.io/ingress-nginx",
AnnotationValue: "nginx",

1
internal/ingress/controller/nginx.go
View file

@ -131,6 +131,7 @@ func NewNGINXController(config *Configuration, mc metric.Collector) *NGINXContro
config.Client,
n.updateCh,
config.DisableCatchAll,
config.DeepInspector,
config.IngressClassConfiguration)
n.syncQueue = task.NewTaskQueue(n.syncIngress)

15
internal/ingress/controller/store/store.go
View file

@ -42,6 +42,7 @@ import (
clientcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
"k8s.io/client-go/tools/cache"
"k8s.io/client-go/tools/record"
"k8s.io/ingress-nginx/internal/ingress/inspector"
"k8s.io/klog/v2"
"k8s.io/ingress-nginx/internal/file"
@ -247,6 +248,7 @@ func New(
client clientset.Interface,
updateCh *channels.RingChannel,
disableCatchAll bool,
deepInspector bool,
icConfig *ingressclass.IngressClassConfiguration) Storer {
store := &k8sStore{
@ -426,6 +428,12 @@ func New(
klog.InfoS("Found valid IngressClass", "ingress", klog.KObj(ing), "ingressclass", ic)
if deepInspector {
if err := inspector.DeepInspect(ing); err != nil {
klog.ErrorS(err, "received invalid ingress", "ingress", klog.KObj(ing))
return
}
}
if hasCatchAllIngressRule(ing.Spec) && disableCatchAll {
klog.InfoS("Ignoring add for catch-all ingress because of --disable-catch-all", "ingress", klog.KObj(ing))
return
@ -482,6 +490,13 @@ func New(
return
}
if deepInspector {
if err := inspector.DeepInspect(curIng); err != nil {
klog.ErrorS(err, "received invalid ingress", "ingress", klog.KObj(curIng))
return
}
}
store.syncIngress(curIng)
store.updateSecretIngressMap(curIng)
store.syncSecrets(curIng)

11
internal/ingress/controller/store/store_test.go
View file

@ -124,6 +124,7 @@ func TestStore(t *testing.T) {
clientSet,
updateCh,
false,
true,
DefaultClassConfig)
storer.Run(stopCh)
@ -204,6 +205,7 @@ func TestStore(t *testing.T) {
clientSet,
updateCh,
false,
true,
DefaultClassConfig)
storer.Run(stopCh)
@ -307,6 +309,7 @@ func TestStore(t *testing.T) {
clientSet,
updateCh,
false,
true,
DefaultClassConfig)
storer.Run(stopCh)
@ -422,6 +425,7 @@ func TestStore(t *testing.T) {
clientSet,
updateCh,
false,
true,
ingressClassconfig)
storer.Run(stopCh)
@ -551,6 +555,7 @@ func TestStore(t *testing.T) {
clientSet,
updateCh,
false,
true,
ingressClassconfig)
storer.Run(stopCh)
@ -650,6 +655,7 @@ func TestStore(t *testing.T) {
clientSet,
updateCh,
false,
true,
DefaultClassConfig)
storer.Run(stopCh)
@ -743,6 +749,7 @@ func TestStore(t *testing.T) {
clientSet,
updateCh,
false,
true,
DefaultClassConfig)
storer.Run(stopCh)
@ -828,6 +835,7 @@ func TestStore(t *testing.T) {
clientSet,
updateCh,
false,
true,
DefaultClassConfig)
storer.Run(stopCh)
@ -923,6 +931,7 @@ func TestStore(t *testing.T) {
clientSet,
updateCh,
false,
true,
DefaultClassConfig)
storer.Run(stopCh)
@ -1046,6 +1055,7 @@ func TestStore(t *testing.T) {
clientSet,
updateCh,
false,
true,
DefaultClassConfig)
storer.Run(stopCh)
@ -1166,6 +1176,7 @@ func TestStore(t *testing.T) {
clientSet,
updateCh,
false,
true,
DefaultClassConfig)
storer.Run(stopCh)

62
internal/ingress/inspector/ingress.go Normal file
View file

@ -0,0 +1,62 @@
/*
Copyright 2022 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package inspector
import (
"fmt"
networking "k8s.io/api/networking/v1"
)
// InspectIngress is used to do the deep inspection of an ingress object, walking through all
// of the spec fields and checking for matching strings and configurations that may represent
// an attempt to escape configs
func InspectIngress(ingress *networking.Ingress) error {
for _, rule := range ingress.Spec.Rules {
if rule.Host != "" {
if err := CheckRegex(rule.Host); err != nil {
return fmt.Errorf("invalid host in ingress %s/%s: %s", ingress.Namespace, ingress.Name, err)
}
}
if rule.HTTP != nil {
if err := inspectIngressRule(rule.HTTP); err != nil {
return fmt.Errorf("invalid rule in ingress %s/%s: %s", ingress.Namespace, ingress.Name, err)
}
}
}
for _, tls := range ingress.Spec.TLS {
if err := CheckRegex(tls.SecretName); err != nil {
return fmt.Errorf("invalid secret in ingress %s/%s: %s", ingress.Namespace, ingress.Name, err)
}
for _, host := range tls.Hosts {
if err := CheckRegex(host); err != nil {
return fmt.Errorf("invalid host in ingress tls config %s/%s: %s", ingress.Namespace, ingress.Name, err)
}
}
}
return nil
}
func inspectIngressRule(httprule *networking.HTTPIngressRuleValue) error {
for _, path := range httprule.Paths {
if err := CheckRegex(path.Path); err != nil {
return fmt.Errorf("invalid http path: %s", err)
}
}
return nil
}

99
internal/ingress/inspector/ingress_test.go Normal file
View file

@ -0,0 +1,99 @@
/*
Copyright 2022 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package inspector
import (
"testing"
networking "k8s.io/api/networking/v1"
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
func makeSimpleIngress(hostname string, paths ...string) *networking.Ingress {
newIngress := networking.Ingress{
ObjectMeta: v1.ObjectMeta{
Name: "test1",
Namespace: "default",
},
Spec: networking.IngressSpec{
Rules: []networking.IngressRule{
{
Host: hostname,
IngressRuleValue: networking.IngressRuleValue{
HTTP: &networking.HTTPIngressRuleValue{
Paths: []networking.HTTPIngressPath{},
},
},
},
},
},
}
prefix := networking.PathTypePrefix
for _, path := range paths {
newPath := networking.HTTPIngressPath{
Path: path,
PathType: &prefix,
}
newIngress.Spec.Rules[0].IngressRuleValue.HTTP.Paths = append(newIngress.Spec.Rules[0].IngressRuleValue.HTTP.Paths, newPath)
}
return &newIngress
}
func TestInspectIngress(t *testing.T) {
tests := []struct {
name string
hostname string
path []string
wantErr bool
}{
{
name: "invalid-path-etc",
hostname: "invalid.etc.com",
path: []string{
"/var/run/secrets",
"/mypage",
},
wantErr: true,
},
{
name: "invalid-path-etc",
hostname: "invalid.etc.com",
path: []string{
"/etc/nginx",
},
wantErr: true,
},
{
name: "invalid-path-etc",
hostname: "invalid.etc.com",
path: []string{
"/mypage",
},
wantErr: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ingress := makeSimpleIngress(tt.hostname, tt.path...)
if err := InspectIngress(ingress); (err != nil) != tt.wantErr {
t.Errorf("InspectIngress() error = %v, wantErr %v", err, tt.wantErr)
}
})
}
}

38
internal/ingress/inspector/inspector.go Normal file
View file

@ -0,0 +1,38 @@
/*
Copyright 2022 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package inspector
import (
corev1 "k8s.io/api/core/v1"
networking "k8s.io/api/networking/v1"
"k8s.io/klog/v2"
)
// DeepInspect is the function called by admissionwebhook and store syncer to check
// if an object contains invalid configurations that may represent a security risk,
// and returning an error in this case
func DeepInspect(obj interface{}) error {
switch obj.(type) {
case *networking.Ingress:
return InspectIngress(obj.(*networking.Ingress))
case *corev1.Service:
return InspectService(obj.(*corev1.Service))
default:
klog.Warningf("received invalid object to inspect: %T", obj)
return nil
}
}

53
internal/ingress/inspector/rules.go Normal file
View file

@ -0,0 +1,53 @@
/*
Copyright 2022 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package inspector
import (
"fmt"
"regexp"
)
var (
invalidAliasDirective = regexp.MustCompile(`\s*alias\s*.*;`)
invalidRootDirective = regexp.MustCompile(`\s*root\s*.*;`)
invalidEtcDir = regexp.MustCompile(`/etc/(passwd|shadow|group|nginx|ingress-controller)`)
invalidSecretsDir = regexp.MustCompile(`/var/run/secrets`)
invalidByLuaDirective = regexp.MustCompile(`.*_by_lua.*`)
invalidRegex = []regexp.Regexp{}
)
func init() {
invalidRegex = []regexp.Regexp{
*invalidAliasDirective,
*invalidRootDirective,
*invalidEtcDir,
*invalidSecretsDir,
*invalidByLuaDirective,
}
}
// CheckRegex receives a value/configuration and validates if it matches with one of the
// forbidden regexes.
func CheckRegex(value string) error {
for _, regex := range invalidRegex {
if regex.MatchString(value) {
return fmt.Errorf("invalid value found: %s", value)
}
}
return nil
}

66
internal/ingress/inspector/rules_test.go Normal file
View file

@ -0,0 +1,66 @@
/*
Copyright 2022 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package inspector
import "testing"
func TestCheckRegex(t *testing.T) {
tests := []struct {
name string
value string
wantErr bool
}{
{
name: "must refuse invalid root",
wantErr: true,
value: " root blabla/lala ;",
},
{
name: "must refuse invalid alias",
wantErr: true,
value: " alias blabla/lala ;",
},
{
name: "must refuse invalid attempt to call /etc",
wantErr: true,
value: "location /etc/nginx/lalala",
},
{
name: "must refuse invalid attempt to call k8s secret",
wantErr: true,
value: "ssl_cert /var/run/secrets/kubernetes.io/lalala; xpto",
},
{
name: "must refuse invalid attempt to call lua directives",
wantErr: true,
value: "set_by_lua lala",
},
{
name: "must pass with valid configuration",
wantErr: false,
value: "/test/mypage1",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if err := CheckRegex(tt.value); (err != nil) != tt.wantErr {
t.Errorf("CheckRegex() error = %v, wantErr %v", err, tt.wantErr)
}
})
}
}

26
internal/ingress/inspector/service.go Normal file
View file

@ -0,0 +1,26 @@
/*
Copyright 2022 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package inspector
import (
corev1 "k8s.io/api/core/v1"
)
// InspectService will be used to inspect service objects for possible invalid configurations
func InspectService(svc *corev1.Service) error {
return nil
}