IP Filtering based on CIDRs

[josh-pritchard]

Right now we can do IP filtering with our existing RBAC functionality but it is somewhat limited and cannot do CIDR based filtering which is a big gap for users coming from nginx.

Maybe we will use a new dynamic module to implement this.

Additional context: #13083

[lgadban]

the envoy RBAC filter may support this when not using CEL, need to investigate as an option

[marvin-roesch]

Thanks for raising this issue! I had meant to create this myself, but haven't gotten around to it. With regards to implementation, this could indeed be done using Envoy's built-in RBAC filter. AFAICT, there are two ways to go about it:

1. Utilize the RBAC rules API and remote_ip (or direct_remote_ip, potentially configurable?) principals
2. Expand the current use of the RBAC matchers API and add an additional IP custom matcher with a SourceIPInput

The latter is probably easier and more desirable as it nicely slots into the existing CEL matcher usage and likely also will perform better for large sets of CIDRs.

The biggest questions that need to be answered, I think, are the API design and semantics for this. It probably makes the most sense to extend the existing AuthorizationPolicy type with an additional allowedCIDRs field that can be specified in addition to CEL expressions. Then semantically, the two different kind of matchers should be combined with an and_matcher on the Envoy side such that both some CIDR range and some CEL expression have to match simultaneously. Those semantics also would make sense to future extensions to the RBAC support, as each kind of matcher in an AuthorizationPolicy covers a different dimension of the inspected request.

Potentially there could also be an additional blockedCIDRs field that gets added to the ANDed predicates with a not_matcher to enable both allow- and blocklists.