In order to demonstrate this bug, one can follow these steps:

Deploy a recent build from here:

https://gcsweb.istio.io/gcs/istio-prerelease/daily-build/release-0.8-20180530-09-15/

Apply a ServiceEntry to wikipedia.org

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: wikipedia-ext
spec:
  hosts:
  - wikipedia.org
  addresses:
  - 91.198.174.192/27
  - 103.102.166.224/27
  - 198.35.26.96/27
  - 208.80.153.224/27
  - 208.80.154.224/27
  ports:
  - number: 443
    protocol: TCP
    name: tcp-port
  resolution: NONE

(this snippet is taken from Control Egress TCP Traffic task)

Deploy the sleep sample

istioctl kube-inject -f ./samples/sleep/sleep.yaml

Curl from inside the sleep app to an external service other than wikipedia.org (e.g. www.google.com).
If one receives status 200 it's problem since the access should be forbidden.

kubectl exec -it $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep -- curl -o /dev/null -s -w "%{http_code}\n"  https://www.google.com

Retrieve the adsz through pilot's debug service.

kubectl exec -it $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c istio-proxy -- curl istio-pilot.istio-system:9093/debug/adsz

The relevant listener of sleep's proxy looks like:

{
  "name": "0.0.0.0_443",
  "address": {
    "socketAddress": {
      "address": "0.0.0.0",
      "portValue": 443
    }
  },
  "filterChains": [
    {
      "filters": [
        {
          "name": "envoy.tcp_proxy",
          "config": {
              "deprecated_v1": true,
              "value": {
                    "route_config": {
                          "routes": [
                                {
                                      "cluster": "outbound|443||wikipedia.org"
                                    }
                              ]
                        },
                    "stat_prefix": "outbound|tcp|443"
                  }
            }
        }
      ]
    }
  ],
  "deprecatedV1": {
    "bindToPort": false
  }
}

(The full response of adsz is attached here: adsz.txt)
Note the lack of destination_ip_list field that should restrict the access.

The relevant cluster is defined as follows:

{
  "name": "outbound|443||wikipedia.org",
  "type": "ORIGINAL_DST",
  "connectTimeout": "1.000s",
  "lbPolicy": "ORIGINAL_DST_LB",
  "circuitBreakers": {
    "thresholds": [
      {

      }
    ]
  }
}

TCP ServiceEntry mesh-external addresses are disregarded, allowing traffic to any IP #5916

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions