fix(translator): set ignoreCase for header matchers in extAuth (#3420)

fix: set ignoreCase for header matchers in extAuth Signed-off-by: haoqixu <hq.xu0o0@gmail.com>
envoyproxy · May 20, 2024 · 8206e11 · 8206e11
1 parent dedc446
commit 8206e11
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 0 deletions.
diff --git a/internal/xds/translator/extauth.go b/internal/xds/translator/extauth.go
@@ -113,6 +113,7 @@ func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
 			MatchPattern: &matcherv3.StringMatcher_Exact{
 				Exact: header,
 			},
+			IgnoreCase: true,
 		})
 	}
 
@@ -178,6 +179,7 @@ func httpService(http *ir.HTTPExtAuthService) *extauthv3.HttpService {
 			MatchPattern: &matcherv3.StringMatcher_Exact{
 				Exact: header,
 			},
+			IgnoreCase: true,
 		})
 	}
 

diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-auth.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
@@ -21,7 +21,9 @@
             allowedHeaders:
               patterns:
               - exact: header1
+                ignoreCase: true
               - exact: header2
+                ignoreCase: true
             grpcService:
               envoyGrpc:
                 authority: grpc-backend.default:9000
@@ -38,7 +40,9 @@
                 allowedUpstreamHeaders:
                   patterns:
                   - exact: header1
+                    ignoreCase: true
                   - exact: header2
+                    ignoreCase: true
               pathPrefix: /auth
               serverUri:
                 cluster: securitypolicy/default/policy-for-gateway-1/envoy-gateway/http-backend

diff --git a/...or/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml b/...or/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml
@@ -27,7 +27,9 @@
                 allowedUpstreamHeaders:
                   patterns:
                   - exact: header1
+                    ignoreCase: true
                   - exact: header2
+                    ignoreCase: true
               pathPrefix: /auth
               serverUri:
                 cluster: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
@@ -86,7 +88,9 @@
                 allowedUpstreamHeaders:
                   patterns:
                   - exact: header1
+                    ignoreCase: true
                   - exact: header2
+                    ignoreCase: true
               pathPrefix: /auth
               serverUri:
                 cluster: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend