tls_inspector listener_filter is automatically added when using http_inspector
- Dominant language
- C++
- Stars
- 28.9k
- Forks
- 5.6k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 428
Description
*Description*:
When the http_inspector filter is used with a `filter_chain_match` rule using `application_protocols`, the tls_inspector listener_filter is automatically inserted as well.
*Repro steps*:
Run the following config:
```
---
node:
id: "id"
cluster: cluster
admin:
access_log_path: "admin_access.log"
address:
socket_address:
address: 0.0.0.0
port_value: 8080
cluster_manager:
outlier_detection:
event_log_path: "outlierevents.log"
static_resources:
listeners:
- name: mylistener
address:
socket_address:
address: 0.0.0.0
port_value: 80
listener_filters:
- name: envoy.listener.http_inspector
filter_chains:
- filter_chain_match:
application_protocols:
- "http/1.1"
- "http/1.0"
filters:
- name: envoy.http_connection_manager
config:
stat_prefix: stats
http_filters:
- name: envoy.router
route_config:
name: local_route
virtual_hosts:
- name: local_service
domains: "*"
routes:
- match:
prefix: "/"
direct_response:
status: 404
body:
inline_string: "Error!\n\n"
- filter_chain_match:
application_protocols:
- "h2c"
filters:
- name: envoy.http_connection_manager
config:
stat_prefix: stats
http_filters:
- name: envoy.router
route_config:
name: local_route
virtual_hosts:
- name: local_service
domains: "*"
routes:
- match:
prefix: "/"
route:
cluster: mycluster
clusters:
- name: mycluster
connect_timeout: 1s
type: STATIC
http2_protocol_options: {}
load_assignment:
cluster_name: mycluster
endpoints:
- lb_endpoints:
- endpoint:
address:
socket_address:
address: 127.0.0.1
port_value: 8001
```
*Logs*:
`[2020-03-05 13:00:32.620][26037][warning][config] [source/server/listener_impl.cc:299] adding listener '0.0.0.0:80': filter chain match rules require TLS Inspector listener filter, but it isn't configured, trying to inject it (this might fail if Envoy is compiled without it)`
Contributor guide
Research direction
Start at source/server/listener_impl.cc near the warning shown in the logs, then trace how listener filters and filter-chain application_protocols matching are configured. Reproduce the supplied listener configuration and review the five-comment discussion for the intended behavior; done is a documented, agreed result for whether automatic TLS Inspector insertion should occur.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100