fix: validate SDS URL

internal/gatewayapi/testdata/sds-invalid.in.yaml

@@ -76,6 +76,21 @@ backendTLSPolicies:
           - name: regular-ca-secret
             kind: Secret
         hostname: example.com
+  # Test case 4: Invalid SDS URL (should be rejected)
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-invalid-sds-url
+      namespace: default
+    spec:
+      targetRefs:
+        - kind: Service
+          name: service-4
+      validation:
+        caCertificateRefs:
+          - name: sds-ref-invalid-url
+            kind: Secret
+        hostname: example.com
 httpRoutes:
   - apiVersion: gateway.networking.k8s.io/v1
     kind: HTTPRoute
@@ -109,6 +124,13 @@ httpRoutes:
           backendRefs:
             - name: service-3
               port: 8080
+        - matches:
+            - path:
+                type: Exact
+                value: "/service4"
+          backendRefs:
+            - name: service-4
+              port: 8080
 services:
   - apiVersion: v1
     kind: Service
@@ -207,7 +229,8 @@ secrets:
       namespace: default
     type: gateway.envoyproxy.io/sds
     data:
-      url: L3Zhci9ydW4vc2VjcmV0cy93b3JrbG9hZC1zcGlmZmUtdWRzL3NvY2tldA==  # /var/run/secrets/workload-spiffe-uds/socket
+      # unix:///var/run/secrets/workload-spiffe-uds/socket
+      url: dW5peDovLy92YXIvcnVuL3NlY3JldHMvd29ya2xvYWQtc3BpZmZlLXVkcy9zb2NrZXQ=
       secretName: Uk9PVENB  # ROOTCA
   - apiVersion: v1
     kind: Secret
@@ -216,8 +239,19 @@ secrets:
       namespace: default
     type: gateway.envoyproxy.io/sds
     data:
-      url: L3Zhci9ydW4vc2VjcmV0cy93b3JrbG9hZC1zcGlmZmUtdWRzL3NvY2tldA==  # /var/run/secrets/workload-spiffe-uds/socket
+      # unix:///var/run/secrets/workload-spiffe-uds/socket
+      url: dW5peDovLy92YXIvcnVuL3NlY3JldHMvd29ya2xvYWQtc3BpZmZlLXVkcy9zb2NrZXQ=
       secretName: Uk9PVENBMg==  # ROOTCA2
+  # SDS reference secret with an invalid (scheme-less) URL
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      name: sds-ref-invalid-url
+      namespace: default
+    type: gateway.envoyproxy.io/sds
+    data:
+      url: L3Zhci9ydW4vc2VjcmV0cy93b3JrbG9hZC1zcGlmZmUtdWRzL3NvY2tldA==  # /var/run/secrets/workload-spiffe-uds/socket
+      secretName: Uk9PVENBMw==  # ROOTCA3
   # Regular secret with CA certificate
   - apiVersion: v1
     kind: Secret

internal/gatewayapi/testdata/sds-invalid.out.yaml

@@ -110,6 +110,44 @@ backendTLSPolicies:
         status: "False"
         type: ResolvedRefs
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    name: policy-invalid-sds-url
+    namespace: default
+  spec:
+    targetRefs:
+    - group: ""
+      kind: Service
+      name: service-4
+    validation:
+      caCertificateRefs:
+      - group: ""
+        kind: Secret
+        name: sds-ref-invalid-url
+      hostname: example.com
+  status:
+    ancestors:
+    - ancestorRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: 'Invalid SDS reference secret sds-ref-invalid-url: invalid URL in
+          SDS reference secret default/sds-ref-invalid-url: unsupported URL scheme:
+          .'
+        reason: NoValidCACertificate
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'Invalid SDS reference secret sds-ref-invalid-url: invalid URL in
+          SDS reference secret default/sds-ref-invalid-url: unsupported URL scheme:
+          .'
+        reason: InvalidCACertificateRef
+        status: "False"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
 backends:
 - apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: Backend
@@ -201,6 +239,13 @@ httpRoutes:
       - path:
           type: Exact
           value: /service3
+    - backendRefs:
+      - name: service-4
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /service4
   status:
     parents:
     - conditions:
@@ -214,6 +259,7 @@ httpRoutes:
           Failed to process route rule 0 backendRef 0: multiple SDS reference secrets are not supported.
           Failed to process route rule 1 backendRef 0: cannot mix SDS reference secrets with other CA certificate types.
           Failed to process route rule 2 backendRef 0: cannot mix SDS reference secrets with other CA certificate types.
+          Failed to process route rule 3 backendRef 0: invalid SDS reference secret sds-ref-invalid-url: invalid URL in SDS reference secret default/sds-ref-invalid-url: unsupported URL scheme: .
         reason: InvalidBackendTLS
         status: "False"
         type: ResolvedRefs
@@ -322,6 +368,19 @@ xdsIR:
           distinct: false
           exact: /service3
           name: ""
+      - directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: default
+        name: httproute/default/httproute-1/rule/3/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /service4
+          name: ""
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4

internal/gatewayapi/testdata/sds.in.yaml

@@ -80,8 +80,8 @@ secrets:
       namespace: envoy-gateway-system
     type: gateway.envoyproxy.io/sds
     data:
-      # /var/run/secrets/workload-spiffe-uds/socket
-      url: L3Zhci9ydW4vc2VjcmV0cy93b3JrbG9hZC1zcGlmZmUtdWRzL3NvY2tldA==
+      # unix:///var/run/secrets/workload-spiffe-uds/socket
+      url: dW5peDovLy92YXIvcnVuL3NlY3JldHMvd29ya2xvYWQtc3BpZmZlLXVkcy9zb2NrZXQ=
       secretName: ZGVmYXVsdA==  # base64 for "default"
   - apiVersion: v1
     kind: Secret
@@ -90,6 +90,6 @@ secrets:
       namespace: default
     type: gateway.envoyproxy.io/sds
     data:
-      # /var/run/secrets/workload-spiffe-uds/socket
-      url: L3Zhci9ydW4vc2VjcmV0cy93b3JrbG9hZC1zcGlmZmUtdWRzL3NvY2tldA==
+      # unix:///var/run/secrets/workload-spiffe-uds/socket
+      url: dW5peDovLy92YXIvcnVuL3NlY3JldHMvd29ya2xvYWQtc3BpZmZlLXVkcy9zb2NrZXQ=
       secretName: Uk9PVENB  # base64 for "ROOTCA"

internal/gatewayapi/testdata/sds.out.yaml

@@ -228,13 +228,15 @@ xdsIR:
               caCertificate:
                 name: policy-btls/default-ca
                 sds:
+                  address: /var/run/secrets/workload-spiffe-uds/socket
+                  scheme: unix
                   secretName: ROOTCA
-                  url: /var/run/secrets/workload-spiffe-uds/socket
               clientCertificates:
               - name: ""
                 sds:
+                  address: /var/run/secrets/workload-spiffe-uds/socket
+                  scheme: unix
                   secretName: default
-                  url: /var/run/secrets/workload-spiffe-uds/socket
               maxVersion: "1.3"
               minVersion: "1.2"
               sni: example.com

internal/ir/xds.go

@@ -28,6 +28,7 @@ import (
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 	httputils "github.com/envoyproxy/gateway/internal/utils/http"
+	netutil "github.com/envoyproxy/gateway/internal/utils/net"
 )
 
 const (
@@ -492,13 +493,23 @@ type TLSCertificate struct {
 type SDSConfig struct {
 	// SecretName is an identifier for the SDS configuration.
 	SecretName string `json:"secretName" yaml:"secretName"`
-	// URL is the URL of the SDS server
-	URL string `json:"url" yaml:"url"`
+	// Scheme is the communication scheme to use when connecting to the SDS server (e.g., "http", "https", or "unix").
+	Scheme string `json:"scheme" yaml:"scheme"`
+	// Address is the host and port of the SDS server
+	Address string `json:"address" yaml:"address"`
 
 	// TODO: support additional SDS configuration options
 	// such as TLS settings for the SDS server, or authentication credentials if needed.
 }
 
+func (s *SDSConfig) GetURL() string {
+	if s.Scheme == "" {
+		return s.Address
+	}
+
+	return fmt.Sprintf("%s://%s", s.Scheme, s.Address)
+}
+
 func NewSDSConfig(s *corev1.Secret) (*SDSConfig, error) {
 	sdsSecretName, hasSecretName := s.Data["secretName"]
 	sdsURLBytes, hasURL := s.Data["url"]
@@ -509,10 +520,15 @@ func NewSDSConfig(s *corev1.Secret) (*SDSConfig, error) {
 	if !hasURL || len(sdsURLBytes) == 0 {
 		return nil, fmt.Errorf("no url found in SDS reference secret %s/%s", s.Namespace, s.Name)
 	}
+	scheme, hostAndPort, err := netutil.ParseURL(string(sdsURLBytes)) // validate the URL format
+	if err != nil {
+		return nil, fmt.Errorf("invalid URL in SDS reference secret %s/%s: %w", s.Namespace, s.Name, err)
+	}
 
 	return &SDSConfig{
 		SecretName: string(sdsSecretName),
-		URL:        string(sdsURLBytes),
+		Scheme:     scheme,
+		Address:    hostAndPort,
 	}, nil
 }
 

internal/utils/net/url.go

@@ -0,0 +1,41 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+package net
+
+import (
+	"fmt"
+	"net/url"
+)
+
+// ParseURL return host and port if the URL is a valid HTTP, HTTPS or UDS,
+// return the scheme and host:port if it's valid.
+func ParseURL(urlStr string) (scheme, hostAndPort string, err error) {
+	u, err := url.Parse(urlStr)
+	if err != nil {
+		return "", "", fmt.Errorf("invalid URL: %w", err)
+	}
+
+	switch u.Scheme {
+	case "http", "https":
+		// TODO: support http and https scheme
+		return "", "", fmt.Errorf("unsupported URL scheme: %s", u.Scheme)
+	case "unix":
+		// For Unix Domain Socket, return the path as host, empty port.
+		// unix:///absolute/path has empty host and path="/absolute/path".
+		// unix://./relative/path (SPIFFE workload API format) has host="." and path="/relative/path";
+		// combine them so the caller receives "./relative/path".
+		if u.Host != "" && u.Host != "." {
+			return "", "", fmt.Errorf("unix URL must not contain a host, use unix:///absolute/path")
+		}
+		if u.Path == "" && u.Host != "." {
+			return "", "", fmt.Errorf("unix URL must contain a path")
+		}
+
+		return u.Scheme, u.Host + u.Path, nil
+	default:
+		return "", "", fmt.Errorf("unsupported URL scheme: %s", u.Scheme)
+	}
+}