#include "cilium/bpf_metadata.h"

#include <fmt/format.h>

#include <netinet/in.h>

#include <netinet/tcp.h>

#include <chrono>

#include <cstddef>

#include <cstdint>

#include <memory>

#include <string>

#include <utility>

#include <vector>

#include "envoy/api/io_error.h"

#include "envoy/common/exception.h"

#include "envoy/config/core/v3/socket_option.pb.h"

#include "envoy/network/address.h"

#include "envoy/network/filter.h"

#include "envoy/network/listen_socket.h"

#include "envoy/network/listener_filter_buffer.h"

#include "envoy/network/socket.h"

#include "envoy/registry/registry.h"

#include "envoy/server/factory_context.h"

#include "envoy/server/filter_config.h"

#include "envoy/singleton/manager.h"

#include "envoy/stream_info/filter_state.h"

#include "source/common/common/logger.h"

#include "source/common/common/utility.h"

#include "source/common/network/address_impl.h"

#include "source/common/network/socket_option_factory.h"

#include "source/common/network/socket_option_impl.h"

#include "source/common/network/utility.h"

#include "source/common/protobuf/protobuf.h"

#include "source/common/protobuf/utility.h"

#include "absl/strings/string_view.h"

#include "absl/types/optional.h"

#include "cilium/api/bpf_metadata.pb.h"

#include "cilium/api/bpf_metadata.pb.validate.h" // IWYU pragma: keep

#include "cilium/conntrack.h"

#include "cilium/filter_state_cilium_destination.h"

#include "cilium/filter_state_cilium_policy.h"

#include "cilium/host_map.h"

#include "cilium/ipcache.h"

#include "cilium/network_policy.h"

#include "cilium/policy_id.h"

#include "cilium/socket_option_cilium_mark.h"

#include "cilium/socket_option_ip_transparent.h"

namespace Envoy {

namespace Server {

namespace Configuration {

/**

 * Config registration for the bpf metadata filter. @see

 * NamedNetworkFilterConfigFactory.

 */

class BpfMetadataConfigFactory : public NamedListenerFilterConfigFactory {

public:

  // NamedListenerFilterConfigFactory

  Network::ListenerFilterFactoryCb createListenerFilterFactoryFromProto(

      const Protobuf::Message& proto_config,

      const Network::ListenerFilterMatcherSharedPtr& listener_filter_matcher,

    // Set the SO_MARK (Cilium Mark), IP_TRANSPARENT & SO_REUSEADDR for the listen socket.

    // For the listener socket, the BPF datapath is only interested

    // in whether the proxy is ingress, egress, or if there is no proxy at all.

    // SO_REUSEPORT for the listener socket is set via Envoy config

};

/**

 * Static registration for the bpf metadata filter. @see RegisterFactory.

 * Versioning started from 1.1.0 for Cilium version 1.12.0.

 */

REGISTER_FACTORY(BpfMetadataConfigFactory,

                 NamedListenerFilterConfigFactory){FACTORY_VERSION(1, 1, 0, {{}})};

/**

 * Config registration for the UDP bpf metadata filter. @see

 * NamedUdpListenerFilterConfigFactory.

 */

class UdpBpfMetadataConfigFactory : public NamedUdpListenerFilterConfigFactory {

public:

  // NamedUdpListenerFilterConfigFactory

  Network::UdpListenerFilterFactoryCb

  createFilterFactoryFromProto(const Protobuf::Message& proto_config,

    // Set the SO_MARK (Cilium Mark), IP_TRANSPARENT & SO_REUSEADDR for the listen socket.

    // For the listener socket, the BPF datapath is only interested

    // in whether the proxy is ingress, egress, or if there is no proxy at all.

    // SO_REUSEPORT for the listener socket is set via Envoy config

};

/**

 * Static registration for the UDP bpf metadata filter. @see RegisterFactory.

 */

REGISTER_FACTORY(UdpBpfMetadataConfigFactory,

                 NamedUdpListenerFilterConfigFactory){FACTORY_VERSION(1, 1, 0, {{}})};

} // namespace Configuration

} // namespace Server

namespace Cilium {

namespace BpfMetadata {

// Singleton registration via macro defined in envoy/singleton/manager.h

SINGLETON_MANAGER_REGISTRATION(cilium_bpf_conntrack);

SINGLETON_MANAGER_REGISTRATION(cilium_host_map);

SINGLETON_MANAGER_REGISTRATION(cilium_network_policy);

namespace {

std::shared_ptr<const Cilium::PolicyHostMap>

std::shared_ptr<const Cilium::NetworkPolicyMap>

} // namespace

Config::Config(const ::cilium::BpfMetadata& config,

               Server::Configuration::ListenerFactoryContext& context)

      ipv4_source_address_(

      ipv6_source_address_(

  // Note: all instances use the bpf root of the first filter with non-empty

  // bpf_root instantiated! Only try opening bpf maps if bpf root is explicitly

  // configured

          // Even if opening the global maps fail, local maps may still succeed

          // later.

      // bpf root may not change during runtime

  // Get the shared policy provider, or create it if not already created.

  // Note that the API config source is assumed to be the same for all filter

  // instances!

  // Only created if either ipcache_ or hosts_ map exists

    // subtract random jitter (0-1ms) if configured as at least 1ms

  // default destination identity to the world if needed

uint32_t Config::resolveSourceIdentity(const PolicyInstance& policy,

                                       const Network::Address::Ip* sip,

                                       const Network::Address::Ip* dip, bool ingress,

  // Resolve the source security ID from conntrack map, or from ip cache

      // non-local source should be in the global conntrack

  // Fall back to ipcache lookup if conntrack entry can not be located

// Returns a new IpAddressPair that fills the port from 'source_address'.

const Network::Address::Ip* Config::selectIpVersion(const Network::Address::IpVersion version,

  // Allow all traffic for egress without a policy when 'is_l7lb_' is true,

  // or if configured without bpf (npmap_ == nullptr).

  // This is the case for L7 LB listeners only. This is needed to allow traffic forwarded by Cilium

  // Ingress (which is implemented as an egress listener!).

absl::optional<Cilium::BpfMetadata::SocketMetadata>

  // Load the policy for the Pod that sends or receives traffic.

  // Might change later on for North/South L7LB traffic.

  // Use a pointer as we may need to change the policy in the case of "North/South L7 LB" below.

  // Resolve the source security ID from conntrack map, or from ip cache

  // Resolve the destination security ID for egress traffic

  // ingress_source_identity is non-zero when the egress path l7 LB should also enforce

  // the ingress path policy using the original source identity.

  // Use the configured IPv4/IPv6 Ingress IPs as starting point for the sources addresses

  // NOTE: As L7 LB does not use the original destination, there is a possibility of a 5-tuple

  // collision if the same source pod is communicating with the same backends on same destination

  // port directly, maybe via some other, non-L7 LB service. We keep the original source port number

  // to not allocate random source ports for the source pod in the host networking namespace that

  // could then blackhole existing connections between the source pod and the backend. This means

  // that the L7 LB backend connection may fail in case of a 5-tuple collision that the host

  // networking namespace is aware of.

    // In case of east/west, L7 LB is only used for egress, so the local

    // endpoint is the source, and the other node is the destination.

      // Local pod not found. Original source address can only be used for local pods.

    // Use original source address with L7 LB for local endpoint sources if requested, as policy

    // enforcement after the proxy depends on it (i.e., for "east/west" LB).

    // North/south L7 LB, assume the source security identity of the configured source addresses,

    // if any and policy for this identity exists.

    // Pick the local ingress source address of the same family as the incoming connection

      // IP family of the connection has no configured local ingress source address

    // Enforce pod policy only for local pods.

    // Enforce Ingress policy?

    // Resolve source identity for the Ingress address

      // No security ID available for the configured source IP

    // Original source address is never used for north/south LB

    // Otherwise only use the original source address if permitted and the destination is not

    // in the same node.

    //

    // If bpf root is not configured (npmap_ == nullptr) we assume all destinations are non-local!

    //

    // Original source address is not used

  // Evaluating proxylib L7 protocol for later usage in filter chain matching.

  // This requires the TLS inspector, if used, to run before us.

  // Note: This requires egress policy be known before upstream host selection,

  // so this feature only works with the original destination cluster.

  // This means that L7 LB does not work with the experimental Envoy Metadata

  // based policies (e.g., with MongoDB or MySQL filters).

  // Pass the metadata to an Envoy socket option we can retrieve later in other

  // Cilium filters.

    // Mark with source endpoint ID for east/west l7 LB. This causes the upstream packets to be

    // processed by the the source endpoint's policy enforcement in the datapath.

    // Mark with source identity

  // Cilium socket option is not set if this fails, which causes 500 response from our l7policy

  // filter. Our integration tests depend on this.

    // Setting proxy lib application protocol on downstream socket

    // Restoring original destination address on downstream socket

    // Make Cilium Policy data available to filters and upstream connection (Cilium TLS Wrapper) as

    // filter state.

    // Restoring original source address on the upstream socket

      // adding SO_MARK (Cilium mark) on the upstream socket

    // Setting IP_TRANSPARENT on upstream socket to be able to restore original source address

  // allow reuse of the original source address by setting SO_REUSEADDR.

  // This may by needed for retries to not fail on "address already in use"

  // when using a specific source address and port.

  // reuse port for forwarded client connections (SO_REUSEPORT)

  // Adding SocketOptions to the downstream socket. The function `setOption` is NOT executed

  // on the downstream socket itself - it's executed later on the corresponding upstream socket!

  // set keep alive socket options on accepted connection socket

  // (SO_KEEPALIVE, TCP_KEEPINTVL, TCP_KEEPIDLE)

Network::FilterStatus

} // namespace BpfMetadata

} // namespace Cilium

} // namespace Envoy