authProperties;
+
+ public CommonRequestCredential() {
+ this.authProperties = new HashMap<>();
+ }
+
+ @Override
+ public Object get(RequestAuthProperty propertyType) {
+ return authProperties.get(propertyType);
+ }
+
+ @Override
+ public void add(RequestAuthProperty propertyType, Object value) {
+ this.authProperties.put(propertyType, value);
+ }
+}
diff --git a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/RequestAuthProperty.java b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/RequestAuthProperty.java
new file mode 100644
index 000000000000..ad182bda6bd1
--- /dev/null
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/RequestAuthProperty.java
@@ -0,0 +1,280 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.xds.security.authz.rule;
+
+public enum RequestAuthProperty {
+
+ // Envoy LDS RbacFilter & JwtFilter props
+
+ /**
+ * Request header
+ * Rule attribution:principal
+ *
+ * Rule modification section：
+ *
+ * when:
+ * 1)rules:when (request.headers[xxx])
+ */
+ HEADER,
+
+ /**
+ * Direct request ip address
+ * Rule attribution:principal
+ *
+ * Rule modification section：
+ *
+ * from:
+ * 1)rules:from:source:ipBlocks
+ * 2)rules:from:source:notIpBlocks
+ *
+ * when:
+ * 1)rules:when (source.ip)
+ */
+ DIRECT_REMOTE_IP,
+
+ /**
+ * The original client IP address determined by the X-Forwarded-For request header or proxy protocol
+ * Rule attribution:principal
+ *
+ * Rule modification section：
+ *
+ * from:
+ * 1)rules:from:source:remoteIpBlocks
+ * 2)rules:from:source:notRemoteIpBlocks
+ *
+ * when:
+ * 1)rules:when (remote.ip)
+ */
+ REMOTE_IP,
+
+ REMOTE_PORT,
+
+ /**
+ * Identity in jwt = issuer + "/" + subject
+ * Rule attribution:principal
+ *
+ * Rule modification section：
+ *
+ * from:
+ * 1)rules:from:source:requestPrincipals
+ *
+ * when:
+ * 1)rules:when (request.auth.principal)
+ */
+ JWT_PRINCIPALS,
+
+ /**
+ * Audience in jwt
+ * Rule attribution:principal
+ *
+ * Rule modification section：
+ *
+ * when:
+ * 1)rules:when (request.auth.claims[xxx])
+ */
+ JWT_CLAIMS,
+
+ /**
+ * Azp in jwt: Authorized party - the party to which the ID Token was issued
+ * rule attribution:principal
+ *
+ * Rule modification section：
+ *
+ * when:
+ * 1)rules:when (request.auth.presenter)
+ */
+ JWT_PRESENTERS,
+
+ /**
+ * What should the requester's identity be
+ * Rule attribution:principal
+ *
+ * Rule modification section：
+ *
+ * from:
+ * 1)rules:from:source:principals
+ * 2)rules:from:source:notPrincipals
+ * 3)rules:from:namespaces
+ * Concatenate regular expressions as formal principals,for example：namespaces: ["namespace1"]-> .*
+ * /ns/namespace1/.*
+ * 4)rules:from:notNamespaces
+ *
+ * when:
+ * 1)rules:when (source.principal)
+ * 2)rules:when (source.namespace)
+ */
+ PRINCIPAL,
+
+ /**
+ * Server ip
+ * Rule attribution:permission
+ *
+ * Rule modification section：
+ *
+ * when:
+ * 1)rules:when (destination.ip)
+ */
+ DESTINATION_IP,
+
+ /**
+ * Server hosts
+ *
+ * Rule modification section：
+ *
+ * to:
+ * 1)rules:to:operation:hosts
+ * 2)rules:to:operation:notHosts
+ */
+ HOSTS,
+
+ /**
+ * Server url path
+ * Rule attribution:permission
+ *
+ * Rule modification section：
+ *
+ * to:
+ * 1)rules:to:operation:paths
+ * 2)rules:to:operation:notPaths
+ */
+ URL_PATH,
+
+ /**
+ * Server port
+ * Rule attribution:permission
+ *
+ * Rule modification section：
+ *
+ * to:
+ * 1)rules:to:operation:ports
+ * 2)rules:to:operation:notPorts
+ *
+ * when:
+ * 1)rules:when (destination.port)
+ */
+ DESTINATION_PORT,
+
+ /**
+ * Server methods
+ * Rule attribution:permission
+ *
+ * Rule modification section：
+ *
+ * to:
+ * 1)rules:to:operation:methods
+ * 2)rules:to:operation:notMethods
+ */
+ HTTP_METHOD,
+
+ /**
+ * Server sni : request.getServerName()
+ * Rule attribution:permission
+ *
+ * Rule modification section：
+ *
+ * when:
+ * 1)rules:when (connection.sni)
+ */
+ REQUESTED_SERVER_NAME,
+
+ // Downstream kubernetes environment props
+ /**
+ * consumer service account name
+ */
+ KUBE_SERVICE_PRINCIPAL,
+
+ /**
+ * consumer namespace
+ */
+ KUBE_SOURCE_NAMESPACE,
+
+ /**
+ * consumer service name
+ */
+ KUBE_SERVICE_NAME,
+
+ /**
+ * consumer pod name
+ */
+ KUBE_POD_NAME,
+
+ /**
+ * consumer pod id
+ */
+ KUBE_POD_ID,
+
+ /**
+ * consumer service uid
+ */
+ KUBE_SERVICE_UID,
+
+ /**
+ * consumer required provider service version
+ */
+ TARGET_VERSION,
+
+ /**
+ * consumer cluster name
+ */
+ KUBE_SOURCE_CLUSTER,
+
+ SOURCE_METADATA,
+
+ // Dubbo properties
+ /**
+ * consumer dubbo application name
+ */
+ REMOTE_APPLICATION,
+
+ /**
+ * consumer service group
+ */
+ REMOTE_GROUP,
+
+ // JWT rules
+ /**
+ * Audience in jwt
+ * Rule attribution:principal
+ *
+ * Rule modification section：
+ *
+ * when:
+ * 1)rules:when (request.auth.audiences)
+ */
+ JWT_AUDIENCES,
+
+ JWT_NAME,
+
+ JWT_ISSUER,
+
+ JWKS,
+
+ JWT_FROM_PARAMS,
+
+ JWT_FROM_HEADERS,
+
+ /**
+ * spiffe://{trust_domain}/{workload_identity}
+ */
+ SPIFFE_ID,
+ TRUST_DOMAIN,
+ WORKLOAD_ID,
+
+ // properties for internal use
+ DECODED_JWT,
+ CONNECTION_CREDENTIAL;
+}
diff --git a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/RuleMismatchException.java b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/RuleMismatchException.java
new file mode 100644
index 000000000000..d061444fc35a
--- /dev/null
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/RuleMismatchException.java
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.xds.security.authz.rule;
+
+import org.apache.dubbo.xds.security.api.AuthorizationException;
+
+public class RuleMismatchException extends AuthorizationException {
+ private String ruleType;
+
+ private String expectValue;
+
+ private String actualValue;
+
+ public RuleMismatchException(String ruleType, String expectValue, String actualValue) {
+ super("Authorization rule mismatch. Type:" + ruleType + ",expect:" + expectValue + ",actual:" + actualValue);
+ }
+}
diff --git a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/CustomMatcher.java b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/CustomMatcher.java
new file mode 100644
index 000000000000..24c4f9779867
--- /dev/null
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/CustomMatcher.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.xds.security.authz.rule.matcher;
+
+import org.apache.dubbo.xds.security.authz.rule.RequestAuthProperty;
+
+import java.util.function.Function;
+
+public class CustomMatcher implements Matcher {
+
+ private RequestAuthProperty property;
+
+ private Function matchFunction;
+
+ public CustomMatcher(RequestAuthProperty property, Function matchFunction) {
+ this.matchFunction = matchFunction;
+ this.property = property;
+ }
+
+ @Override
+ public boolean match(T actual) {
+ return matchFunction.apply(actual);
+ }
+
+ @Override
+ public RequestAuthProperty propType() {
+ return property;
+ }
+
+ @Override
+ public String toString() {
+ return "CustomMatcher{" + "property=" + property + ", matchFunction=" + matchFunction + '}';
+ }
+}
diff --git a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/IpMatcher.java b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/IpMatcher.java
new file mode 100644
index 000000000000..ba450410c0e2
--- /dev/null
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/IpMatcher.java
@@ -0,0 +1,110 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.xds.security.authz.rule.matcher;
+
+import org.apache.dubbo.common.logger.ErrorTypeAwareLogger;
+import org.apache.dubbo.common.logger.LoggerFactory;
+import org.apache.dubbo.common.utils.StringUtils;
+import org.apache.dubbo.xds.security.authz.rule.RequestAuthProperty;
+
+public class IpMatcher implements Matcher {
+
+ /**
+ * Prefix length in CIDR case
+ */
+ private final int prefixLen;
+
+ /**
+ * Ip address to be matched
+ */
+ private final String ipBinaryString;
+
+ private final RequestAuthProperty authProperty;
+
+ private static final ErrorTypeAwareLogger logger = LoggerFactory.getErrorTypeAwareLogger(IpMatcher.class);
+
+ public IpMatcher(int prefixLen, String ipString, RequestAuthProperty property) {
+ this.prefixLen = prefixLen;
+ this.ipBinaryString = ip2BinaryString(ipString);
+ this.authProperty = property;
+ }
+
+ /**
+ * @param ip dotted ip string,
+ * @return
+ */
+ public static String ip2BinaryString(String ip) {
+ try {
+ String[] ips = ip.split("\\.");
+ if (4 != ips.length) {
+ logger.error("99-0", "", "", "Error ip=" + ip);
+ return "";
+ }
+ long[] ipLong = new long[4];
+ for (int i = 0; i < 4; ++i) {
+ ipLong[i] = Long.parseLong(ips[i]);
+ if (ipLong[i] < 0 || ipLong[i] > 255) {
+ logger.error("99-0", "", "", "Error ip=" + ip);
+ return "";
+ }
+ }
+ return String.format(
+ "%32s",
+ Long.toBinaryString((ipLong[0] << 24) + (ipLong[1] << 16) + (ipLong[2] << 8) + ipLong[3]))
+ .replace(" ", "0");
+ } catch (Exception e) {
+ logger.error("", "", "", "Error ip=" + ip);
+ }
+ return "";
+ }
+
+ public boolean match(String object) {
+ if (StringUtils.isEmpty(ipBinaryString)) {
+ return false;
+ }
+ String ipBinary = ip2BinaryString(object);
+ if (StringUtils.isEmpty(ipBinary)) {
+ return false;
+ }
+ if (prefixLen <= 0) {
+ return ipBinaryString.equals(ipBinary);
+ }
+ if (ipBinaryString.length() >= prefixLen && ipBinary.length() >= prefixLen) {
+ return ipBinaryString.substring(0, prefixLen).equals(ipBinary.substring(0, prefixLen));
+ }
+ return false;
+ }
+
+ @Override
+ public RequestAuthProperty propType() {
+ return authProperty;
+ }
+
+ public int getPrefixLen() {
+ return prefixLen;
+ }
+
+ public String getIpBinaryString() {
+ return ipBinaryString;
+ }
+
+ @Override
+ public String toString() {
+ return "IpMatcher{" + "prefixLen=" + prefixLen + ", ipBinaryString='" + ipBinaryString + '\''
+ + ", authProperty=" + authProperty + '}';
+ }
+}
diff --git a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/KeyMatcher.java b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/KeyMatcher.java
new file mode 100644
index 000000000000..cf270a70c29e
--- /dev/null
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/KeyMatcher.java
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.xds.security.authz.rule.matcher;
+
+import org.apache.dubbo.xds.security.authz.rule.RequestAuthProperty;
+import org.apache.dubbo.xds.security.authz.rule.matcher.StringMatcher.MatchType;
+
+import java.util.Map;
+
+public class KeyMatcher implements Matcher> {
+
+ private String key;
+
+ private StringMatcher stringMatcher;
+
+ public KeyMatcher(MatchType matchType, String condition, RequestAuthProperty authProperty, String key) {
+ this.stringMatcher = new StringMatcher(matchType, condition, authProperty);
+ this.key = key;
+ }
+
+ public KeyMatcher(String key, StringMatcher stringMatcher) {
+ this.key = key;
+ this.stringMatcher = stringMatcher;
+ }
+
+ @Override
+ public boolean match(Map actual) {
+ if (actual == null) {
+ return this.stringMatcher.match(null);
+ }
+ String toMatch = actual.get(key);
+ if (toMatch == null) {
+ return false;
+ }
+ return this.stringMatcher.match(toMatch);
+ }
+
+ @Override
+ public RequestAuthProperty propType() {
+ return this.stringMatcher.propType();
+ }
+
+ @Override
+ public String toString() {
+ return "KeyMatcher{" + "key='" + key + '\'' + ", stringMatcher=" + stringMatcher + '}';
+ }
+}
diff --git a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/MapMatcher.java b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/MapMatcher.java
new file mode 100644
index 000000000000..ac9c4eb50238
--- /dev/null
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/MapMatcher.java
@@ -0,0 +1,58 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.xds.security.authz.rule.matcher;
+
+import org.apache.dubbo.xds.security.authz.rule.RequestAuthProperty;
+
+import java.util.Map;
+
+/**
+ * supports multiple keys and values
+ */
+public class MapMatcher implements Matcher> {
+
+ private Map> keyToMatchers;
+
+ private RequestAuthProperty property;
+
+ public MapMatcher(Map> matcherMap, RequestAuthProperty property) {
+ this.keyToMatchers = matcherMap;
+ this.property = property;
+ }
+
+ @Override
+ public boolean match(Map actualValues) {
+ for (String key : keyToMatchers.keySet()) {
+ Matcher matcher = keyToMatchers.get(key);
+ String actual = actualValues.get(key);
+ if (!matcher.match(actual)) {
+ return false;
+ }
+ }
+ return true;
+ }
+
+ @Override
+ public RequestAuthProperty propType() {
+ return property;
+ }
+
+ @Override
+ public String toString() {
+ return "MapMatcher{" + "keyToMatchers=" + keyToMatchers + ", property=" + property + '}';
+ }
+}
diff --git a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/Matcher.java b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/Matcher.java
new file mode 100644
index 000000000000..16b596b70bc2
--- /dev/null
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/Matcher.java
@@ -0,0 +1,28 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.xds.security.authz.rule.matcher;
+
+import org.apache.dubbo.xds.security.authz.rule.RequestAuthProperty;
+
+/**
+ * @param Type of the actual value to match.
+ */
+public interface Matcher {
+ boolean match(T actual);
+
+ RequestAuthProperty propType();
+}
diff --git a/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/Matchers.java b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/Matchers.java
new file mode 100644
index 000000000000..42d1b80d410c
--- /dev/null
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/xds/security/authz/rule/matcher/Matchers.java
@@ -0,0 +1,148 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.xds.security.authz.rule.matcher;
+
+import org.apache.dubbo.common.utils.StringUtils;
+import org.apache.dubbo.xds.security.authz.rule.RequestAuthProperty;
+import org.apache.dubbo.xds.security.authz.rule.matcher.StringMatcher.MatchType;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import io.envoyproxy.envoy.config.core.v3.CidrRange;
+import io.envoyproxy.envoy.config.route.v3.HeaderMatcher;
+import io.envoyproxy.envoy.type.matcher.v3.RegexMatcher;
+
+public class Matchers {
+
+ public static MapMatcher mapMatcher(
+ Map