Mutation rules do not allow specific header modifications from external processor

[DimitarHKostov]

Hi Envoy team,

we found the following issue: using external processor(with GRPC) we want to be able to modify the 'host' header, internal 'x-envoy-* headers etc. The two properties that we are interested in are 'allow-envoy'(for the internal envoy headers) and 'allow-all-routing'. After changing the values of the two properties to true we still can not add/override the mentioned headers from the external processor. Here is a code snippet with the configurations we use for the external processor:

externalProcessingFilterConfig, err := anypb.New(&extProc.ExternalProcessor{
ProcessingMode: processingMode,
MessageTimeout: durationpb.New(DefaultTimeoutInSeconds * time.Second),
GrpcService: &grpcService,
MutationRules: &mutation_rulesv3.HeaderMutationRules{
AllowEnvoy: &wrapperspb.BoolValue{Value: true},
AllowAllRouting: &wrapperspb.BoolValue{Value: true},
},
})

In the external processor server in the HeaderResponse -> CommonResponse -> HeaderMutation -> SetHeaders it says in the documentation: "Add or replace HTTP headers. Attempts to set the value of any “x-envoy“ header, and attempts to set the “:method“, “:authority“, “:scheme“, or “host“ headers will be ignored.". It seems that this contradicts with the MutationRules for the external processing filter. Here is a snippet of the configuration:

headersResponse := &pb.HeadersResponse{
Response: &pb.CommonResponse{
HeaderMutation: &pb.HeaderMutation{
SetHeaders: headersToSet, //in the docu for this field it says we can not override the desired headers
RemoveHeaders: headersToRemove,
},
ClearRouteCache: true,
},
}
processingResponse := &pb.ProcessingResponse{
Response: &pb.ProcessingResponse_RequestHeaders{
RequestHeaders: headersResponse,
},
}

return processingResponse

Do we miss something? Any help will be highly appreciated.

[adisuissa]

I think these types of headers are intentionally immutable.
cc @yanjunxiang-google @tyxia to confirm.

[yanjunxiang-google]

@DimitarHKostov
Do you have the envoy Ext_proc filter configured with allow_all_routing and allow_envoy?

envoy/api/envoy/config/common/mutation_rules/v3/mutation_rules.proto

Line 52 in 7850edd

google.protobuf.BoolValue allow_all_routing = 1;

[DimitarHKostov]

Yes, both are set to true. Is there a known issue in any version of envoy when it comes to this properties?

[yanjunxiang-google]

Let me try to reproduce the issue.

[yanjunxiang-google]

I created an test and it is ok to modify the host header and add x-envoy-xxx headers. Please check this PR:

#29886

Could you please let me know the ext_proc response you are sending back which contains the header mutation? I am thinking the header mutation in the ext_proc server response maybe not right.

BTW, if you want to modify the "host" header, you should just send back the "host" header with a new value, and leave the "append" to be false. That way the "host" header will be modified. You can not remove the "host" header, then add a new "host" header. "remove" operation is not allowed for "host" header.

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or "no stalebot" or other activity occurs. Thank you for your contributions.

[github-actions]

This issue has been automatically closed because it has not had activity in the last 37 days. If this issue is still valid, please ping a maintainer and ask them to label it as "help wanted" or "no stalebot". Thank you for your contributions.