Cherry-pick #9258 and #9332 into v1.83.x - #9335
Merged
Merged
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## v1.83.x #9335 +/- ##
===========================================
- Coverage 83.36% 83.24% -0.12%
===========================================
Files 421 421
Lines 34086 34119 +33
===========================================
- Hits 28415 28402 -13
- Misses 4247 4277 +30
- Partials 1424 1440 +16
🚀 New features to boost your workflow:
|
…c#9258) parseConfig only walks the top-level Permissions and Principals of each RBAC policy when it applies the A41 header-name rules, so a header matcher nested inside an and_rules, or_rules, or not_rule is never checked. A control plane can put a `:scheme` or `grpc-` prefixed matcher inside a nested rule to slip past the validation A41 says must reject it, and a nested `host` matcher never gets rewritten to `:authority`, so it silently fails to match the header grpc-go actually carries (a deny policy on a nested host matcher fails open). Walk the full permission and principal trees so both the :scheme/grpc- rejection and the host to :authority rewrite reach matchers at any depth. Doing it in parseConfig keeps the check in the one place that already owns A41 validation, and folds the two former top-level passes into a single recursive walk shared by permissions and principals. RELEASE NOTES: - xds/rbac: Fix a bug where nested `Principal` or `Permission` rules with `:scheme` or `grpc-` prefixed header matchers were not rejected, which could cause DENY rules to fail open. - xds/rbac: Fix a bug where the `host` header matcher was not being replaced with `:authority` in nested `Principal` or `Permission` rules. (cherry picked from commit 1f4c6f3)
The RBAC filter passes the name of a header matcher to the matching engine unchanged. The metadata that the engine matches against always has lowercase keys. A name that contains an uppercase character therefore matches no header, and the rule that holds it never fires. The policy parses, reports no error and looks active. A DENY policy written this way fails open. The A41 validation reads the same unnormalized name, so the rejection of :scheme and grpc- prefixed matchers misses the name Grpc-Status. A Host matcher also keeps its name, although A41 makes host and :authority equivalent. Lowercase the name in normalizeHeaderMatcher. That function already owns the A41 rules and already rewrites the name in place, so the matching engine, the :scheme and grpc- rejection, and the host alias all read one normalized name. Envoy holds each header matcher name in a LowerCaseString, grpc-java lowercases the name before it looks the header up, and authz/rbac_translator.go lowercases the name on the non-xDS path. The new test in test/xds shows the effect on an end user. A DENY policy on the header name User-Agent returns OK for every RPC before the change and PermissionDenied after it. The unit tests cover the name that the parse gives to the engine, the case of the :scheme and grpc- rejection, and the host alias, at the top level and inside a nested rule. RELEASE NOTES: - xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as `X-Role`, matched no header, which could cause DENY rules to fail open. - xds/rbac: Fix a bug where a `:scheme` or `grpc-` prefixed header matcher was accepted when its name was not lowercase. - xds/rbac: Fix a bug where a `Host` header matcher was not replaced with `:authority`. Co-authored-by: Markus Magnuson <331091+alimony@users.noreply.github.com> (cherry picked from commit db94828)
easwars
force-pushed
the
backport-v1.83.1
branch
from
August 19, 2026 06:26
8728624 to
0b093a6
Compare
eshitachandwani
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Original PRs: #9258 and #9332
RELEASE NOTES:
PrincipalorPermissionrules with:schemeorgrpc-prefixed header matchers were not rejected, which could cause DENY rules to fail open.hostheader matcher was not being replaced with:authorityin nestedPrincipalorPermissionrules.X-Role, matched no header, which could cause DENY rules to fail open.:schemeorgrpc-prefixed header matcher was accepted when its name was not lowercase.Hostheader matcher was not replaced with:authority.