block illegal calls in inpod mode #935
Conversation
Part of istio#928 This removes the obsolete call protections for inpod, and adds equivilents
howardjohn
added
the
release-notes-none
istio-testing
added
the
size/M
| @@ -12,6 +12,7 @@ | |||
| // See the License for the specific language governing permissions and | |||
| // limitations under the License. | |||
|
|
|||
| use std::collections::HashSet; | |||
There was a problem hiding this comment.
Is hash necessary? Could we just use a vec, sort it once during init and then efficiently search it without calculating hashes on the u16. Because its small we could probably just iterate for a match instead of sort/binary search even
There was a problem hiding this comment.
Probably not, but its just 1 instance with like 4 keys and we Arc it anyways so doesn't seem so bad?
There was a problem hiding this comment.
My guess is all that would be pretty close to a wash with just using a vanilla HashSet, and somewhat less readable.
There was a problem hiding this comment.
Yeah, if I start feeling froggy maybe I'll test it and let ya know.
| @@ -155,13 +157,19 @@ impl Proxy { | |||
| Self::from_inputs(pi, drain).await | |||
| } | |||
| pub(super) async fn from_inputs(mut pi: ProxyInputs, drain: Watch) -> Result<Self, Error> { | |||
| // illegal_ports are internal ports that clients are not authorized to send to | |||
| let mut illegal_ports: HashSet<u16> = HashSet::new(); | |||
There was a problem hiding this comment.
I feel like it would be nice to have a ProxyHandler type, have Proxies.handlers() and then be able to register all the illegal_ports for all handlers in a loop, but that might be overkill ATM.
(was gonna suggest maybe these ports should be in ProxyInfo but then I remembered that type is already overstuffed with random crap)
| @@ -12,6 +12,7 @@ | |||
| // See the License for the specific language governing permissions and | |||
| // limitations under the License. | |||
|
|
|||
| use std::collections::HashSet; | |||
There was a problem hiding this comment.
My guess is all that would be pretty close to a wash with just using a vanilla HashSet, and somewhat less readable.
Part of #928
This removes the obsolete call protections for inpod, and adds
equivilents