Skip to content

Incorrect header name validation in routing rules #766

Closed
@pleshakov

Description

@pleshakov

Describe the bug
Gateway API header validation is defined here
NKG validates header names using this rule, which is permissive and disallow values that make NGINX fail to reload.

However, NGINX when processing request headers, applies much stricter validation rules - only allows alpha-number chars and -. See this comment #717 (comment) Note: in NGINX, you can also allow undescores in headers, but we don't support that in NKG.

When NGINX encounter such headers, it drops them printing in the error log a message like below:

2023/06/16 22:44:05 [info] 70#70: *17 client sent invalid header line: "version%!:v2" while reading client request headers, client: 127.0.0.1, server: cafe.example.com, request: "GET /coffee HTTP/1.1", host: "cafe.example.com:8080"

So the routing rules with invalid headers will not work as expected

To Reproduce
Steps to reproduce the behavior:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: coffee
spec:
  parentRefs:
  - name: gateway
  hostnames:
  - "cafe.example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /coffee
    backendRefs:
    - name: coffee-v1-svc
      port: 80
  - matches:
    - path:
        type: PathPrefix
        value: /coffee
      headers:
      - name: version%! # valid from Gateway API and current NKG perspective
        value: v2
    - path:
        type: PathPrefix
        value: /coffee
      queryParams:
      - name: TEST
        value: v2
    backendRefs:
    - name: coffee-v2-svc
      port: 80

This request is not routed as expected (to v2), because NGINX will drop the header version%!

curl --resolve cafe.example.com:$GW_PORT:$GW_IP http://cafe.example.com:$GW_PORT/coffee -H 'version%!:v2'
Server address: 10.244.0.9:8080
Server name: coffee-v1-58f4c685db-jpsqk
Date: 16/Jun/2023:22:41:51 +0000
URI: /coffee
Request ID: 390384c7f082f2d03468594dec85f7e9

Expected behavior

Make NKG reject invalid from NGINX perspective header names so that the error is visible in the HTTPRoute status.

Your environment

  • NKG edge

Additional context
Add any other context about the problem here. Any log files you want to share.

Metadata

Metadata

Assignees

Labels

bugSomething isn't workinggood first issueGood for newcomers

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions