envoyproxy / envoyproxy/envoy

tls_inspector listener_filter is automatically added when using http_inspector

Open
#10,272 5 comments 0 reactions 0 assignees View on GitHub
area/http help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
428

Description

*Description*:
When the http_inspector filter is used with a `filter_chain_match` rule using `application_protocols`, the tls_inspector listener_filter is automatically inserted as well.

*Repro steps*:
Run the following config:

```
---
node:
id: "id"
cluster: cluster
admin:
access_log_path: "admin_access.log"
address:
socket_address:
address: 0.0.0.0
port_value: 8080
cluster_manager:
outlier_detection:
event_log_path: "outlierevents.log"
static_resources:
listeners:
- name: mylistener
address:
socket_address:
address: 0.0.0.0
port_value: 80
listener_filters:
- name: envoy.listener.http_inspector
filter_chains:
- filter_chain_match:
application_protocols:
- "http/1.1"
- "http/1.0"
filters:
- name: envoy.http_connection_manager
config:
stat_prefix: stats
http_filters:
- name: envoy.router
route_config:
name: local_route
virtual_hosts:
- name: local_service
domains: "*"
routes:
- match:
prefix: "/"
direct_response:
status: 404
body:
inline_string: "Error!\n\n"
- filter_chain_match:
application_protocols:
- "h2c"
filters:
- name: envoy.http_connection_manager
config:
stat_prefix: stats
http_filters:
- name: envoy.router
route_config:
name: local_route
virtual_hosts:
- name: local_service
domains: "*"
routes:
- match:
prefix: "/"
route:
cluster: mycluster
clusters:
- name: mycluster
connect_timeout: 1s
type: STATIC
http2_protocol_options: {}
load_assignment:
cluster_name: mycluster
endpoints:
- lb_endpoints:
- endpoint:
address:
socket_address:
address: 127.0.0.1
port_value: 8001
```

*Logs*:
`[2020-03-05 13:00:32.620][26037][warning][config] [source/server/listener_impl.cc:299] adding listener '0.0.0.0:80': filter chain match rules require TLS Inspector listener filter, but it isn't configured, trying to inject it (this might fail if Envoy is compiled without it)`

Contributor guide

Open the contributing guide

Research direction

Start at source/server/listener_impl.cc near the warning shown in the logs, then trace how listener filters and filter-chain application_protocols matching are configured. Reproduce the supplied listener configuration and review the five-comment discussion for the intended behavior; done is a documented, agreed result for whether automatic TLS Inspector insertion should occur.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.