Alibaba Cloud Service Mesh:Write a Wasm plug-in in Rust for an Envoy proxy in ASM

Create the project

Create a directory named rust-example, switch to it, and initialize a new Rust library:

mkdir rust-example && cd rust-example
cargo init --lib

Configure dependencies

Replace the contents of Cargo.toml with the following:

[package]
name = "rust-example"
version = "0.1.0"
edition = "2021"

[lib]
# Build as a C-compatible dynamic library so Envoy can load it
crate-type = ["cdylib"]

[dependencies]
log = "0.4.8"
proxy-wasm = "0.2.2"

The cdylib crate type produces a dynamic library compatible with the Wasm runtime. The two dependencies are:

• log -- Standard Rust logging facade for structured log output.

• proxy-wasm -- The Proxy-Wasm Rust SDK, which provides the trait definitions and host function bindings.

Implement the plug-in logic

The plug-in needs to:

1. Register a RootContext that tells Envoy this plug-in handles HTTP traffic.

2. For each incoming HTTP request, create an HttpContext that inspects request headers.

3. In the on_http_request_headers callback, check for the allow: true header. Block the request with HTTP 403 if the header is missing, or let it pass through if present.

Replace the contents of src/lib.rs with:

use log::info;
use proxy_wasm::traits::*;
use proxy_wasm::types::*;

proxy_wasm::main! {{
    proxy_wasm::set_log_level(LogLevel::Trace);
    proxy_wasm::set_root_context(|_| -> Box<dyn RootContext> { Box::new(HttpHeadersRoot) });
}}

struct HttpHeadersRoot;

// Inherit shared utility functions (property access, timers, etc.)
impl Context for HttpHeadersRoot {}

impl RootContext for HttpHeadersRoot {
    fn get_type(&self) -> Option<ContextType> {
        Some(ContextType::HttpContext)
    }

    fn create_http_context(&self, context_id: u32) -> Option<Box<dyn HttpContext>> {
        Some(Box::new(HttpHeaders { context_id }))
    }
}

struct HttpHeaders {
    context_id: u32,
}

impl Context for HttpHeaders {}

impl HttpContext for HttpHeaders {
    fn on_http_request_headers(&mut self, _: usize, _: bool) -> Action {
        info!("#{} wasm-rust: on_http_request_headers", self.context_id);

        match self.get_http_request_header("allow") {
            Some(allow) if allow == "true" => {
                Action::Continue
            }
            _ => {
                info!("#{} wasm-rust: allow header not found or is not true, deny by default", self.context_id);
                self.send_http_response(
                    403,
                    vec![("Content-Type", "text/plain")],
                    Some(b"Forbidden by ASM Wasm Plugin, rust version\n"),
                );
                Action::Pause
            }
        }
    }
}

The code breaks down as follows:

Compile the plug-in

Build the plug-in with the wasm32-wasi target:

cargo build --target wasm32-wasi --release

After a successful build, the Wasm binary is at:

target/wasm32-wasi/release/rust_example.wasm

Enable debug logging

Use the kubeconfig of the data plane cluster to enable Wasm debug logs on the gateway Pod:

kubectl -n istio-system exec <gateway-pod-name> -c istio-proxy -- \
  curl -XPOST "localhost:15000/logging?wasm=debug"

Replace <gateway-pod-name> with the actual name of your gateway Pod.

Test without the allow header

Send a request without the allow header:

curl <ASM-gateway-IP>/status/418

Expected output:

Forbidden by ASM Wasm Plugin, rust version

The plug-in blocks the request and returns HTTP 403.

Check gateway logs

Inspect the gateway Pod logs for entries similar to the following:

2024-09-05T08:33:31.079869Z  info  envoy wasm  wasm log istio-system.header-authorization: #2 wasm-rust: on_http_request_headers
2024-09-05T08:33:31.079943Z  info  envoy wasm  wasm log istio-system.header-authorization: #2 wasm-rust: allow header not found or is not true, deny by default
{"authority_for":"xx.xx.xx.xx","bytes_received":"0","bytes_sent":"43","downstream_local_address":"xx.xx.xx.xx:80","downstream_remote_address":"xx.xx.xx.xx:xxxxx","duration":"0","istio_policy_status":"-","method":"GET","path":"/status/418","protocol":"HTTP/1.1","request_id":"d5250d1a-54b3-406d-8bea-5a51b617b579","requested_server_name":"-","response_code":"403","response_flags":"-","route_name":"httpbin","start_time":"2024-09-05T08:33:31.079Z","trace_id":"-","upstream_cluster":"outbound|8000||httpbin.default.svc.cluster.local","upstream_host":"-","upstream_local_address":"-","upstream_response_time":"-","upstream_service_time":"-","upstream_transport_failure_reason":"-","user_agent":"curl/8.9.0-DEV","x_forwarded_for":"xx.xx.xx.xx"}

These log lines confirm the plug-in executed and denied the request.

Test with the allow header

Send a request with allow: true:

curl <ASM-gateway-IP>/status/418 -H "allow: true"

Expected output:

    -=[ teapot ]=-

       _...._
     .'  _ _ `.
    | ."` ^ `". _,
    \_;`"---"`|//
      |       ;/
      \_     _/
        `"""`

The request passes through to HTTPBin, which returns the standard HTTP 418 teapot response. The plug-in is working correctly.