Fix Istio-2020-010 #271

brian-avery · 2020-10-07T21:31:27Z

Fix Istio-2020-010

* docs: kick-off 1.13.5 release. (envoyproxy#12164) Signed-off-by: Piotr Sikora <piotrsikora@google.com> Signed-off-by: Yuchen Dai <silentdai@gmail.com> * Preserve LWS from the middle of HTTP1 header values that requ… (envoyproxy#12320) [http1] Preserve LWS from the middle of HTTP1 header values that require multiple dispatch calls to process (envoyproxy#10886) Correctly preserve linear whitespace in the middle of HTTP1 header values. The fix in 6a95a21 trimmed away both leading and trailing whitespace when accepting header value fragments which can result in inner LWS in header values being stripped away if the LWS lands at the beginning or end of a buffer slice. Signed-off-by: Antonio Vicente <avd@google.com> Signed-off-by: Yuchen Dai <silentdai@gmail.com> * http: header map security fixes for duplicate headers (#197) (#203) Previously header matching did not match on all headers for non-inline headers. This patch changes the default behavior to always logically match on all headers. Multiple individual headers will be logically concatenated with ',' similar to what is done with inline headers. This makes the behavior effectively consistent. This behavior can be temporary reverted by setting the runtime value "envoy.reloadable_features.header_match_on_all_headers" to "false". Targeted fixes have been additionally performed on the following extensions which make them consider all duplicate headers by default as a comma concatenated list: 1) Any extension using CEL matching on headers. 2) The header to metadata filter. 3) The JWT filter. 4) The Lua filter. Like primary header matching used in routing, RBAC, etc. this behavior can be disabled by setting the runtime value "envoy.reloadable_features.header_match_on_all_headers" to false. Finally, the setCopy() header map API previously only set the first header in the case of duplicate non-inline headers. setCopy() now behaves similiarly to the other set*() APIs and replaces all found headers with a single value. This may have had security implications in the extauth filter which uses this API. This behavior can be disabled by setting the runtime value "envoy.reloadable_features.http_set_copy_replace_all_headers" to false. Fixes https://github.com/envoyproxy/envoy-setec/issues/188 Signed-off-by: Matt Klein <mklein@lyft.com> Signed-off-by: Yuchen Dai <silentdai@gmail.com> * fixed compile Signed-off-by: Yuchen Dai <silentdai@gmail.com> * fix test Signed-off-by: Yuchen Dai <silentdai@gmail.com> Co-authored-by: Piotr Sikora <piotrsikora@google.com>

google-cla · 2020-10-07T21:31:30Z

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

What to do if you already signed the CLA

Individual signers

It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

lambdai · 2020-10-07T23:06:44Z

@googlebot I signed it!

google-cla · 2020-10-07T23:06:54Z

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

What to do if you already signed the CLA

Individual signers

It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

googlebot · 2020-10-07T23:07:21Z

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

What to do if you already signed the CLA

Individual signers

It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

google-cla · 2020-10-08T14:31:12Z

A Googler has manually verified that the CLAs look good.

(Googler, please make sure the reason for overriding the CLA status is clearly documented in these comments.)

ℹ️ Googlers: Go here for more info.

google-cla bot added the cla: no label Oct 7, 2020

istio-testing added the size/XL label Oct 7, 2020

lambdai approved these changes Oct 7, 2020

View reviewed changes

lambdai added cla: yes and removed cla: no labels Oct 8, 2020

istio-testing merged commit 936fdef into istio:release-1.5 Oct 8, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix Istio-2020-010 #271

Fix Istio-2020-010 #271

brian-avery commented Oct 7, 2020

google-cla bot commented Oct 7, 2020

lambdai commented Oct 7, 2020

google-cla bot commented Oct 7, 2020

googlebot commented Oct 7, 2020

google-cla bot commented Oct 8, 2020

Fix Istio-2020-010 #271

Fix Istio-2020-010 #271

Conversation

brian-avery commented Oct 7, 2020

google-cla bot commented Oct 7, 2020

What to do if you already signed the CLA

Individual signers

Corporate signers

lambdai commented Oct 7, 2020

google-cla bot commented Oct 7, 2020

What to do if you already signed the CLA

Individual signers

Corporate signers

googlebot commented Oct 7, 2020

What to do if you already signed the CLA

Individual signers

Corporate signers

google-cla bot commented Oct 8, 2020