envoyproxy/envoy

tls_inspector listener_filter is automatically added when using http_inspector

Open

#10,272 opened on Mar 5, 2020

View on GitHub
 (5 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
area/httphelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Description: When the http_inspector filter is used with a filter_chain_match rule using application_protocols, the tls_inspector listener_filter is automatically inserted as well.

Repro steps: Run the following config:

---
node:
  id: "id"
  cluster: cluster
admin:
  access_log_path: "admin_access.log"
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 8080
cluster_manager:
  outlier_detection:
    event_log_path: "outlierevents.log"
static_resources:
  listeners:
  - name: mylistener
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 80
    listener_filters:
    - name: envoy.listener.http_inspector
    filter_chains:
    - filter_chain_match:
        application_protocols:
        - "http/1.1"
        - "http/1.0"
      filters:
      - name: envoy.http_connection_manager
        config:
          stat_prefix: stats
          http_filters:
          - name: envoy.router
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: "*"
              routes:
              - match:
                  prefix: "/"
                direct_response:
                  status: 404
                  body:
                    inline_string: "Error!\n\n"
    - filter_chain_match:
        application_protocols:
        - "h2c"
      filters:
      - name: envoy.http_connection_manager
        config:
          stat_prefix: stats
          http_filters:
          - name: envoy.router
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: "*"
              routes:
              - match:
                  prefix: "/"
                route:
                  cluster: mycluster
  clusters:
  - name: mycluster
    connect_timeout: 1s
    type: STATIC
    http2_protocol_options: {}
    load_assignment:
      cluster_name: mycluster
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: 127.0.0.1
                port_value: 8001

Logs: [2020-03-05 13:00:32.620][26037][warning][config] [source/server/listener_impl.cc:299] adding listener '0.0.0.0:80': filter chain match rules require TLS Inspector listener filter, but it isn't configured, trying to inject it (this might fail if Envoy is compiled without it)

Contributor guide