Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mesh gateway envoy config should have use_remote_address set to true #4506

Closed
wjrbetts opened this issue Jun 27, 2022 · 0 comments · Fixed by #4530
Closed

Mesh gateway envoy config should have use_remote_address set to true #4506

wjrbetts opened this issue Jun 27, 2022 · 0 comments · Fixed by #4530
Assignees
Labels
kind/bug A bug triage/accepted The issue was reviewed and is complete enough to start working on it

Comments

@wjrbetts
Copy link
Contributor

What happened?

The mesh gateway envoy proxy has the default value of false for use_remote_address in the HTTP connection manager config.

The documentation makes it clear that this should be set to true when the downstream is untrusted:
Screenshot 2022-06-27 at 09 52 07

and

Screenshot 2022-06-27 at 09 58 16

This affects how headers such as x-forwarded-for and x-forwarded-proto are treated.

For example, despite the fact that the connection with the downstream is TLS, our mesh gateway redirects the client because the x-forwarded-proto is (incorrectly) set to http by the client and we have require_tls set to all.

@wjrbetts wjrbetts added kind/bug A bug triage/pending This issue will be looked at on the next triage meeting labels Jun 27, 2022
@jakubdyszkiewicz jakubdyszkiewicz added triage/accepted The issue was reviewed and is complete enough to start working on it and removed triage/pending This issue will be looked at on the next triage meeting labels Jun 27, 2022
@jakubdyszkiewicz jakubdyszkiewicz self-assigned this Jun 30, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug A bug triage/accepted The issue was reviewed and is complete enough to start working on it
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants