Add support for String Matcher in Header Matching

[costinm]

core] [Channel #7] ccResolverWrapper: reporting error to cc: received route is invalid: route name:"istio-safe-stability.v1--testecho.0"  match:{prefix:"/"  case_sensitive:{value:true}  headers:{name:"x-istio-cluster"  string_match:{exact:"outbound|8080||v1--testecho.istio-safe-stability.svc.cluster.local"}}}  route:{cluster:"outbound|8080||v1--testecho.istio-safe-stability.svc.cluster.local"  cluster_not_found_response_code:INTERNAL_SERVER_ERROR  timeout:{}  retry_policy:{retry_on:"connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes"  num_retries:{value:2}  retry_host_predicate:{name:"envoy.retry_host_predicates.previous_hosts"  typed_config:{type_url:"type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"}}  host_selection_retry_max_attempts:5  retriable_status_codes:503}  max_stream_duration:{max_stream_duration:{}}}  metadata:{filter_metadata:{key:"istio"  value:{fields:{key:"config"  value:{string_value:"/apis/networking.istio.io/v1alpha3/namespaces/istio-safe-stability/virtual-service/v1--testecho-0-istio-autogenerated-k8s-gateway"}}}}}  decorator:{operation:"v1--testecho.istio-safe-stability.svc.cluster.local:8080/*"} has an unrecognized header matcher: &{StringMatch:exact:"outbound|8080||v1--testecho.istio-safe-stability.svc.cluster.local"}

This is produced by a standard HttpRoute -

  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: gateway
  - group: gateway.networking.k8s.io
    kind: Service
    name: echo
  rules:
  - backendRefs:
    - group: ""
      kind: Service
      name: v1--testecho
      port: 8080
      weight: 1
    matches:
    - headers:
      - name: x-istio-cluster
        type: Exact
        value: outbound|8080||v1--testecho.istio-safe-stability.svc.cluster.local
      path:
        type: PathPrefix
        value: /

NOTE: if you are reporting is a potential security vulnerability or a crash,
please follow our CVE process at
https://github.com/grpc/proposal/blob/master/P4-grpc-cve-process.md instead of
filing an issue here.

Please see the FAQ in our main README.md, then answer the questions below
before submitting your issue.

What version of gRPC are you using?

v1.56.0-dev ( tried on older versions too )

What version of Go are you using (go version)?

What operating system (Linux, Windows, …) and version?

What did you do?

If possible, provide a recipe for reproducing the error.

What did you expect to see?

What did you see instead?

[costinm]

This may impact the other languages - in K8S Gateway/GAMMA 'exact' is the only supported header matcher in core ( plus a regex with unspecified syntax ). It is pretty bad as it prevents the use of the new API ( at least in Istio - but I suspect in any other XDS implementation )

[easwars]

We have had a couple of requests in the past to add support for StringMatch, and we ended up closing them saying this needs to be done across all languages. See #5917 and #5649.

We are having a cross-language discussion right now to see what it would take to add support for StringMatch and how to prioritize it compared to our other ongoing efforts. I'll update this issue once a decision is made. Thanks.

[easwars]

We will add support for this soon. Please see grpc/proposal#359.

[costinm]

Thanks - we have to add support for this and for all languages, otherwise we can't support Gateway/GAMMA ( or Istio ) API.

…

On Wed, May 3, 2023 at 12:33 PM Easwar Swaminathan ***@***.***> wrote: We will add support for this soon. Please see grpc/proposal#359 <grpc/proposal#359>. — Reply to this email directly, view it on GitHub <#6226 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAUR2QTR6Y7JBC5SNXYLTDXEKXJJANCNFSM6AAAAAAXNCPCEI> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[zasweq]

The PR is still in flight. We can kick off once proposal finally merged.

[wulianglongrd]

Do we need to implement StringMatcher for RBAC?

grpc-go/internal/xds/rbac/matchers.go

Line 267 in f2fbb0e

func newHeaderMatcher(headerMatcherConfig *v3route_componentspb.HeaderMatcher) (*headerMatcher, error) {

[zasweq]

Ah, yes we do. I spoke to the other languages and they have this for RBAC. Thanks for bringing this up. I'll file an issue.

[zasweq]

Filed #6369.

[zasweq]

Sent #6419 to add support for string matcher in RBAC header matching. Thanks for bringing this up.