Convert Pilot mesh ip attributes to BYTES (envoyproxy#496)

* Convert Pilot ip mesh attributes to bytes

* Update comment

* Update after review comment

src/envoy/mixer/integration_test/attributes.go

@@ -81,9 +81,10 @@ func Verify(b *attribute.MutableBag, json_results string) error {
 				}
 			} else {
 				if val, ok := b.Get(k); ok {
-					if val.(string) != v.(string) {
+				        val_string := fmt.Sprintf("%v", val)
+					if val_string != v.(string) {
 						return fmt.Errorf("attribute %+v value doesn't match. Actual %+v, expected %+v",
-							k, val.(string), v.(string))
+							k, val_string, v.(string))
 					}
 				} else {
 					return fmt.Errorf("attribute %+v is expected", k)

src/envoy/mixer/integration_test/check_report_test.go

@@ -23,6 +23,9 @@ import (
 const checkAttributesOkGet = `
 {
   "context.protocol": "http",
+  "mesh1.ip": "[1 1 1 1]",
+  "mesh2.ip": "[2 2 2 2]",
+  "mesh3.ip": "[3 3 3 3]",
   "request.host": "localhost:27070",
   "request.path": "/echo",
   "request.time": "*",
@@ -33,7 +36,7 @@ const checkAttributesOkGet = `
   "source.namespace": "XYZ11",
   "source.name": "source-name",
   "source.user": "source-user",
-  "source.ip": "*",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.name": "target-name",
   "target.user": "target-user",
@@ -54,6 +57,9 @@ const checkAttributesOkGet = `
 const reportAttributesOkGet = `
 {
   "context.protocol": "http",
+  "mesh1.ip": "[1 1 1 1]",
+  "mesh2.ip": "[2 2 2 2]",
+  "mesh3.ip": "[3 3 3 3]",
   "request.host": "localhost:27070",
   "request.path": "/echo",
   "request.time": "*",
@@ -64,7 +70,7 @@ const reportAttributesOkGet = `
   "source.namespace": "XYZ11",
   "source.name": "source-name",
   "source.user": "source-user",
-  "source.ip": "*",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.name": "target-name",
   "target.user": "target-user",
@@ -97,6 +103,9 @@ const reportAttributesOkGet = `
 const checkAttributesOkPost = `
 {
   "context.protocol": "http",
+  "mesh1.ip": "[1 1 1 1]",
+  "mesh2.ip": "[2 2 2 2]",
+  "mesh3.ip": "[3 3 3 3]",
   "request.host": "localhost:27070",
   "request.path": "/echo",
   "request.time": "*",
@@ -107,7 +116,7 @@ const checkAttributesOkPost = `
   "source.namespace": "XYZ11",
   "source.name": "source-name",
   "source.user": "source-user",
-  "source.ip": "*",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.name": "target-name",
   "target.user": "target-user",
@@ -128,6 +137,9 @@ const checkAttributesOkPost = `
 const reportAttributesOkPost = `
 {
   "context.protocol": "http",
+  "mesh1.ip": "[1 1 1 1]",
+  "mesh2.ip": "[2 2 2 2]",
+  "mesh3.ip": "[3 3 3 3]",
   "request.host": "localhost:27070",
   "request.path": "/echo",
   "request.time": "*",
@@ -138,7 +150,7 @@ const reportAttributesOkPost = `
   "source.namespace": "XYZ11",
   "source.name": "source-name",
   "source.user": "source-user",
-  "source.ip": "*",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.name": "target-name",
   "target.user": "target-user",

src/envoy/mixer/integration_test/disable_tcp_check_calls_test.go

@@ -24,7 +24,8 @@ const checkAttributesOkPost = `
 {
   "context.protocol": "tcp",
   "context.time": "*",
-  "source.ip": "*",
+  "mesh1.ip": "[1 1 1 1]",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.uid": "POD222",
   "target.namespace": "XYZ222"
@@ -36,11 +37,12 @@ const reportAttributesOkPost = `
 {
   "context.protocol": "tcp",
   "context.time": "*",
-  "source.ip": "*",
+  "mesh1.ip": "[1 1 1 1]",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.uid": "POD222",
   "target.namespace": "XYZ222",
-  "destination.ip": "*",
+  "destination.ip": "[127 0 0 1]",
   "destination.port": 28080,
   "connection.received.bytes": 178,
   "connection.received.bytes_total": 178,

src/envoy/mixer/integration_test/envoy_conf.go

@@ -48,6 +48,7 @@ type ConfParam struct {
 // A basic config
 const basicConfig = `
                   "mixer_attributes": {
+		      "mesh1.ip": "1.1.1.1",
                       "target.uid": "POD222",
                       "target.namespace": "XYZ222"
                   }
@@ -92,6 +93,7 @@ const networkFailClose = `
 // The default client proxy mixer config
 const defaultClientMixerConfig = `
                    "forward_attributes": {
+		      "mesh3.ip": "3.3.3.3",
                       "source.uid": "POD11",
                       "source.namespace": "XYZ11"
                    }
@@ -128,6 +130,7 @@ const envoyConfTempl = `
                       "opaque_config": {
 {{.MixerRouteFlags}}
                         "mixer_forward": "off",
+			"mixer_attributes.mesh2.ip": "2.2.2.2",
                         "mixer_attributes.target.user": "target-user",
                         "mixer_attributes.target.name": "target-name"
                       }

src/envoy/mixer/integration_test/failed_request_test.go

@@ -29,6 +29,9 @@ const (
 const checkAttributesMixerFail = `
 {
   "context.protocol": "http",
+  "mesh1.ip": "[1 1 1 1]",
+  "mesh2.ip": "[2 2 2 2]",
+  "mesh3.ip": "[3 3 3 3]",
   "request.host": "localhost:27070",
   "request.path": "/echo",
   "request.time": "*",
@@ -39,7 +42,7 @@ const checkAttributesMixerFail = `
   "source.namespace": "XYZ11",
   "source.name": "source-name",
   "source.user": "source-user",
-  "source.ip": "*",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.name": "target-name",
   "target.user": "target-user",
@@ -60,6 +63,9 @@ const checkAttributesMixerFail = `
 const reportAttributesMixerFail = `
 {
   "context.protocol": "http",
+  "mesh1.ip": "[1 1 1 1]",
+  "mesh2.ip": "[2 2 2 2]",
+  "mesh3.ip": "[3 3 3 3]",
   "request.host": "localhost:27070",
   "request.path": "/echo",
   "request.time": "*",
@@ -70,7 +76,7 @@ const reportAttributesMixerFail = `
   "source.namespace": "XYZ11",
   "source.name": "source-name",
   "source.user": "source-user",
-  "source.ip": "*",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.name": "target-name",
   "target.user": "target-user",
@@ -103,6 +109,9 @@ const reportAttributesMixerFail = `
 const reportAttributesBackendFail = `
 {
   "context.protocol": "http",
+  "mesh1.ip": "[1 1 1 1]",
+  "mesh2.ip": "[2 2 2 2]",
+  "mesh3.ip": "[3 3 3 3]",
   "request.host": "localhost:27070",
   "request.path": "/echo",
   "request.time": "*",
@@ -113,7 +122,7 @@ const reportAttributesBackendFail = `
   "source.namespace": "XYZ11",
   "source.name": "source-name",
   "source.user": "source-user",
-  "source.ip": "*",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.name": "target-name",
   "target.user": "target-user",

src/envoy/mixer/integration_test/report_batch_test.go

@@ -23,6 +23,9 @@ import (
 const reportAttributesOkGet = `
 {
   "context.protocol": "http",
+  "mesh1.ip": "[1 1 1 1]",
+  "mesh2.ip": "[2 2 2 2]",
+  "mesh3.ip": "[3 3 3 3]",
   "request.host": "localhost:27070",
   "request.path": "/echo",
   "request.time": "*",
@@ -33,7 +36,7 @@ const reportAttributesOkGet = `
   "source.namespace": "XYZ11",
   "source.name": "source-name",
   "source.user": "source-user",
-  "source.ip": "*",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.name": "target-name",
   "target.user": "target-user",
@@ -66,6 +69,9 @@ const reportAttributesOkGet = `
 const reportAttributesOkPost1 = `
 {
   "context.protocol": "http",
+  "mesh1.ip": "[1 1 1 1]",
+  "mesh2.ip": "[2 2 2 2]",
+  "mesh3.ip": "[3 3 3 3]",
   "request.host": "localhost:27070",
   "request.path": "/echo",
   "request.time": "*",
@@ -76,7 +82,7 @@ const reportAttributesOkPost1 = `
   "source.namespace": "XYZ11",
   "source.name": "source-name",
   "source.user": "source-user",
-  "source.ip": "*",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.name": "target-name",
   "target.user": "target-user",
@@ -109,6 +115,9 @@ const reportAttributesOkPost1 = `
 const reportAttributesOkPost2 = `
 {
   "context.protocol": "http",
+  "mesh1.ip": "[1 1 1 1]",
+  "mesh2.ip": "[2 2 2 2]",
+  "mesh3.ip": "[3 3 3 3]",
   "request.host": "localhost:27070",
   "request.path": "/echo",
   "request.time": "*",
@@ -119,7 +128,7 @@ const reportAttributesOkPost2 = `
   "source.namespace": "XYZ11",
   "source.name": "source-name",
   "source.user": "source-user",
-  "source.ip": "*",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.name": "target-name",
   "target.user": "target-user",

src/envoy/mixer/integration_test/tcp_filter_test.go

@@ -26,7 +26,8 @@ const checkAttributesOkPost = `
 {
   "context.protocol": "tcp",
   "context.time": "*",
-  "source.ip": "*",
+  "mesh1.ip": "[1 1 1 1]",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.uid": "POD222",
   "target.namespace": "XYZ222"
@@ -38,11 +39,12 @@ const reportAttributesOkPost = `
 {
   "context.protocol": "tcp",
   "context.time": "*",
-  "source.ip": "*",
+  "mesh1.ip": "[1 1 1 1]",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.uid": "POD222",
   "target.namespace": "XYZ222",
-  "destination.ip": "*",
+  "destination.ip": "[127 0 0 1]",
   "destination.port": 28080,
   "connection.received.bytes": 178,
   "connection.received.bytes_total": 178,
@@ -58,7 +60,8 @@ const reportAttributesFailPost = `
 {
   "context.protocol": "tcp",
   "context.time": "*",
-  "source.ip": "*",
+  "mesh1.ip": "[1 1 1 1]",
+  "source.ip": "[127 0 0 1]",
   "source.port": "*",
   "target.uid": "POD222",
   "target.namespace": "XYZ222",

src/envoy/mixer/mixer_control.cc

@@ -18,6 +18,8 @@
 #include "common/common/base64.h"
 #include "common/common/utility.h"
 
+#include <arpa/inet.h>
+
 using ::google::protobuf::util::Status;
 using StatusCode = ::google::protobuf::util::error::Code;
 using ::istio::mixer_client::Attributes;
@@ -65,6 +67,10 @@ const std::string kConnectionSendBytes = "connection.sent.bytes";
 const std::string kConnectionSendTotalBytes = "connection.sent.bytes_total";
 const std::string kConnectionDuration = "connection.duration";
 
+// Pilot mesh attributes with the suffix will be treated as ipv4.
+// They will use BYTES attribute type.
+const std::string kIPSuffix = ".ip";
+
 // Context attributes
 const std::string kContextProtocol = "context.protocol";
 const std::string kContextTime = "context.time";
@@ -277,11 +283,11 @@ void MixerControl::BuildHttpCheck(
     const std::string& source_user, const Utils::StringMap& route_attributes,
     const Network::Connection* connection) const {
   for (const auto& it : map_pb.map()) {
-    SetStringAttribute(it.first, it.second, &request_data->attributes);
+    SetMeshAttribute(it.first, it.second, &request_data->attributes);
   }
   for (const auto& attribute : route_attributes) {
-    SetStringAttribute(attribute.first, attribute.second,
-                       &request_data->attributes);
+    SetMeshAttribute(attribute.first, attribute.second,
+                     &request_data->attributes);
   }
   FillRequestHeaderAttributes(headers, &request_data->attributes);
 
@@ -304,8 +310,8 @@ void MixerControl::BuildHttpCheck(
     request_data->attributes.attributes[attribute.first] = attribute.second;
   }
   for (const auto& attribute : mixer_config_.mixer_attributes) {
-    SetStringAttribute(attribute.first, attribute.second,
-                       &request_data->attributes);
+    SetMeshAttribute(attribute.first, attribute.second,
+                     &request_data->attributes);
   }
 }
 
@@ -344,8 +350,8 @@ void MixerControl::BuildTcpCheck(HttpRequestDataPtr request_data,
     request_data->attributes.attributes[attribute.first] = attribute.second;
   }
   for (const auto& attribute : mixer_config_.mixer_attributes) {
-    SetStringAttribute(attribute.first, attribute.second,
-                       &request_data->attributes);
+    SetMeshAttribute(attribute.first, attribute.second,
+                     &request_data->attributes);
   }
 }
 
@@ -382,6 +388,32 @@ void MixerControl::BuildTcpReport(
       Attributes::TimeValue(std::chrono::system_clock::now());
 }
 
+// Mesh attributes from Pilot are all string type.
+// The attributes with ".ip" suffix will be treated
+// as ipv4 and use BYTES attribute type.
+void MixerControl::SetMeshAttribute(const std::string& name,
+                                    const std::string& value,
+                                    Attributes* attr) const {
+  // Check with ".ip" suffix,
+  if (name.length() <= kIPSuffix.length() ||
+      name.compare(name.length() - kIPSuffix.length(), kIPSuffix.length(),
+                   kIPSuffix) != 0) {
+    attr->attributes[name] = Attributes::StringValue(value);
+    return;
+  }
+
+  in_addr ipv4_bytes;
+  // Only IPV4 is supported for now.
+  if (inet_pton(AF_INET, value.c_str(), &ipv4_bytes) != 1) {
+    ENVOY_LOG(warn, "Could not convert to ipv4: attribute {}, value: {}", name,
+              value);
+    attr->attributes[name] = Attributes::StringValue(value);
+  } else {
+    attr->attributes[name] = Attributes::BytesValue(std::string(
+        reinterpret_cast<const char*>(&ipv4_bytes), sizeof(ipv4_bytes)));
+  }
+}
+
 }  // namespace Mixer
 }  // namespace Http
 }  // namespace Envoy

src/envoy/mixer/mixer_control.h

@@ -95,6 +95,10 @@ class MixerControl final : public ThreadLocal::ThreadLocalObject,
   }
 
  private:
+  // Set the mesh attributes from Pilot
+  void SetMeshAttribute(const std::string& name, const std::string& value,
+                        ::istio::mixer_client::Attributes* attr) const;
+
   // Envoy cluster manager for making gRPC calls.
   Upstream::ClusterManager& cm_;
   // The mixer client