envoyproxy / envoyproxy/gateway

Unexpected additional characters on JWT Authentication

Offen
#2,615 4 Kommentare 0 Reaktionen 1 zugewiesene Person Beansprucht von @cpakulski Auf GitHub ansehen
kind/bug road-to-ga stale
Vorherrschende Sprache
Go
Sterne
3k
Forks
864
Ø Merge
2 T. 2 Std.
Gemergte PRs (30 T.)
140

Beschreibung

*Description*:
I observed an additional character of `?` under the JWT Authentication filter spec in the `provider` and `requirementMap` field names, whenever a corresponding HTTPRoute has a long name.
The `provider` name referred to a combination of `{HTTPRoute's namespace}/{HTTPRoute's name}/rule/{HTTPRoute's rules index}/match/{HTTPRoute's matches index}/{host}/{JWT Provider name}`, and whenever the total characters more than equal to 130 (CMIIW), the unexpected additional character of `?` appended in the prefix of its value.
For example:
```
HTTPRoute Name: httproute-with-long-name-like-superhero-agent-phil-coulson-the-shield-liaison-for-the-avengers
HTTPRoute Namespace: envoy-gateway-system
Rule Index: 0
Match Index: 0
Host: example.com
Provider Name: example
```
Envoy Gateway will generate the name like `envoy-gateway-system/ httproute-with-long-name-like-superhero-agent-phil-coulson-the-shield-liaison-for-the-avengers/rule/0/match/0/example_com/example`, and you will see the listener config in Envoy instance like below:

```
defaultFilterChain:
filters:
- name: envoy.filters.network.http_connection_manager
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager



httpFilters:
- name: envoy.filters.http.jwt_authn
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
providers:
? envoy-gateway-system/sample-with-hundred-and-thirty-characters-that-result-with-unexpected-character/rule/0/match/0/example_com/example:
claimToHeaders:
- claimName: name
headerName: x-name
remoteJwks:
cacheDuration: 300s
httpUri:
cluster: raw_githubusercontent_com_443
timeout: 5s
uri: https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/authn/jwks.json
requirementMap:
? envoy-gateway-system/sample-with-hundred-and-thirty-characters-that-result-with-unexpected-character/rule/0/match/0/example_com:
providerName: envoy-gateway-system/sample-with-hundred-and-thirty-characters-that-result-with-unexpected-character/rule/0/match/0/example_com/example
```

*Question*

1. I'm curious whether this behavior stems from Envoy's limitations and if so, whether it might pose issues down the line.
2. AFAIK, the HTTPRoute name has a limitation of 256 characters. Given this constraint and in alignment with point 1, it appears that Envoy Gateway may have a potential bug in this case.

*Repro steps*:
1. Create and apply HTTPRoute
```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: sample-with-hundred-and-thirty-characters-that-result-with-unexpected-character
namespace: envoy-gateway-system
spec:
hostnames:
- example.com
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: default-gateway
namespace: envoy-gateway-system
rules:
- backendRefs:
- group: ""
kind: Service
name: echoserver
namespace: testing
port: 80
weight: 100
matches:
- path:
type: PathPrefix
value: /testing2

```
4. Create and apply SecurityPolicy
```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: sample-with-hundred-and-thirty-characters-that-result-with-unexpected-character
namespace: envoy-gateway-system
spec:
jwt:
providers:
- claimToHeaders:
- claim: name
header: x-name
name: example
remoteJWKS:
uri: https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/authn/jwks.json
targetRef:
group: gateway.networking.k8s.io
kind: HTTPRoute
name: sample-with-hundred-and-thirty-characters-that-result-with-unexpected-character
namespace: envoy-gateway-system
```
5. Fetch LDS using `egctl` CLI
```bash
egctl c envoy-proxy listener -oyaml
```

>**Note**: If there are privacy concerns, sanitize the data prior to
sharing.

*Environment*:
latest

*Logs*:
>Include the access logs and the Envoy logs.

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.