Merge pull request #11293 from bisakhmondal/service_filter

expression validation of service-resolver subset filter

.changelog/11293.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: service-resolver subset filters are validated for valid go-bexpr syntax on write
+```

agent/structs/config_entry_discoverychain.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/hashicorp/go-bexpr"
 	"github.com/mitchellh/copystructure"
 	"github.com/mitchellh/hashstructure"
 
@@ -901,13 +902,18 @@ func (e *ServiceResolverConfigEntry) Validate() error {
 	}
 
 	if len(e.Subsets) > 0 {
-		for name := range e.Subsets {
+		for name, subset := range e.Subsets {
 			if name == "" {
 				return fmt.Errorf("Subset defined with empty name")
 			}
 			if err := validateServiceSubset(name); err != nil {
 				return fmt.Errorf("Subset %q is invalid: %v", name, err)
 			}
+			if subset.Filter != "" {
+				if _, err := bexpr.CreateEvaluator(subset.Filter, nil); err != nil {
+					return fmt.Errorf("Filter for subset %q is not a valid expression: %v", name, err)
+				}
+			}
 		}
 	}
 

agent/structs/config_entry_discoverychain_test.go

@@ -552,6 +552,17 @@ func TestServiceResolverConfigEntry(t *testing.T) {
 			},
 			validateErr: "Subset defined with empty name",
 		},
+		{
+			name: "invalid boolean expression subset filter",
+			entry: &ServiceResolverConfigEntry{
+				Kind: ServiceResolver,
+				Name: "test",
+				Subsets: map[string]ServiceResolverSubset{
+					"v1": {Filter: "random string"},
+				},
+			},
+			validateErr: `Filter for subset "v1" is not a valid expression`,
+		},
 		{
 			name: "default subset does not exist",
 			entry: &ServiceResolverConfigEntry{