Skip to content

Commit cdf7037

Browse files
guoardguoard
authored
fix: prevent panic when sanitize is enabled without forwardClientIDHe… (#7162)
fix: prevent panic when sanitize is enabled without forwardClientIDHeader Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
1 parent 7471bae commit cdf7037

4 files changed

Lines changed: 87 additions & 2 deletions

File tree

‎internal/xds/translator/api_key_auth.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -160,8 +160,8 @@ func buildAPIKeyAuthFilterConfig(apiKeyAuth *ir.APIKeyAuth) *apikeyauthv3.ApiKey
160160
sanitize := ptr.Deref(apiKeyAuth.Sanitize, false)
161161
if clientIDHeader != "" || sanitize {
162162
apiKeyAuthProto.Forwarding = &apikeyauthv3.Forwarding{
163-
Header: *apiKeyAuth.ForwardClientIDHeader,
164-
HideCredentials: ptr.Deref(apiKeyAuth.Sanitize, false),
163+
Header: clientIDHeader,
164+
HideCredentials: sanitize,
165165
}
166166
}
167167

‎release-notes/current.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ bug fixes: |
3232
Fixed service account token handling in GatewayNamespaceMode to use SDS for properly refreshing expired token.
3333
Fixed handling of regex meta characters in prefix match replace for URL rewrite.
3434
Disabled the default emission of `x-envoy-ratelimited` headers from the rate limit filter; re-enable with the `enableEnvoyHeaders` setting in ClientTrafficPolicy.
35+
Fixed a nil pointer panic in the XDS translator when building API key authentication filter configurations with `sanitize` enabled and no `forwardClientIDHeader` set.
3536
Truncated Gateway API status condition messages to stay within Kubernetes limits and prevent update failures.
3637
3738
# Enhancements that improve performance.

‎test/e2e/testdata/api-key-auth.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,3 +167,37 @@ spec:
167167
credentialRefs:
168168
- name: "api-key-auth-users-secret-1"
169169
- name: "api-key-auth-users-secret-2"
170+
---
171+
apiVersion: gateway.networking.k8s.io/v1
172+
kind: HTTPRoute
173+
metadata:
174+
name: http-with-api-key-auth-header-sanitized-without-forward-client-id-header
175+
namespace: gateway-conformance-infra
176+
spec:
177+
parentRefs:
178+
- name: same-namespace
179+
rules:
180+
- matches:
181+
- path:
182+
type: Exact
183+
value: /api-key-auth-header-sanitized
184+
backendRefs:
185+
- name: infra-backend-v1
186+
port: 8080
187+
---
188+
apiVersion: gateway.envoyproxy.io/v1alpha1
189+
kind: SecurityPolicy
190+
metadata:
191+
name: api-key-auth-header-sanitized-without-forward-client-id-header
192+
namespace: gateway-conformance-infra
193+
spec:
194+
targetRefs:
195+
- group: gateway.networking.k8s.io
196+
kind: HTTPRoute
197+
name: http-with-api-key-auth-header-sanitized-without-forward-client-id-header
198+
apiKeyAuth:
199+
extractFrom:
200+
- headers: ["X-API-KEY"]
201+
credentialRefs:
202+
- name: "api-key-auth-users-secret-1"
203+
sanitize: true

‎test/e2e/tests/api_key_auth.go‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,56 @@ var APIKeyAuthTest = suite.ConformanceTest{
209209
Namespace: ns,
210210
}
211211

212+
http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
213+
})
214+
t.Run("api-key auth with header sanitized without forward client id header", func(t *testing.T) {
215+
ns := "gateway-conformance-infra"
216+
routeNN := types.NamespacedName{Name: "http-with-api-key-auth-header-sanitized-without-forward-client-id-header", Namespace: ns}
217+
gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
218+
gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
219+
220+
ancestorRef := gwapiv1a2.ParentReference{
221+
Group: gatewayapi.GroupPtr(gwapiv1.GroupName),
222+
Kind: gatewayapi.KindPtr(resource.KindGateway),
223+
Namespace: gatewayapi.NamespacePtr(gwNN.Namespace),
224+
Name: gwapiv1.ObjectName(gwNN.Name),
225+
}
226+
SecurityPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "api-key-auth-header-sanitized-without-forward-client-id-header", Namespace: ns}, suite.ControllerName, ancestorRef)
227+
228+
expectedResponse := http.ExpectedResponse{
229+
Request: http.Request{
230+
Path: "/api-key-auth-header-sanitized",
231+
Headers: map[string]string{
232+
"X-API-KEY": "key1",
233+
},
234+
},
235+
ExpectedRequest: &http.ExpectedRequest{
236+
Request: http.Request{
237+
Path: "/api-key-auth-header-sanitized",
238+
},
239+
AbsentHeaders: []string{"X-API-KEY"},
240+
},
241+
Response: http.Response{
242+
StatusCode: 200,
243+
},
244+
Namespace: ns,
245+
}
246+
247+
http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
248+
249+
expectedResponse = http.ExpectedResponse{
250+
Request: http.Request{
251+
Path: "/api-key-auth-header-sanitized",
252+
Headers: map[string]string{
253+
"X-API-KEY": "invalid",
254+
},
255+
},
256+
Response: http.Response{
257+
StatusCode: 401,
258+
},
259+
Namespace: ns,
260+
}
261+
212262
http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
213263
})
214264
},

0 commit comments

Comments
 (0)