You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
we are using this SDK for attribute generation via dynamic expressions. We use expr_create to get a expression identifier via call_foreign_function("expr_create", Option::from(self.condition.as_bytes()));
We cache this id and reuse it for expr_eval when HttpContext on_log gets called.
The bug we now see is that expr_eval called via call_foreign_function with a non standard HTTP method crashes the expr_eval with InternalFailure (10) and thus panic:
The expression in question looks something like this:
request.url_path.startsWith('/some/sub/url/')
We use istio 1.19.7 in this setup and it seems that when the plugin panics it doesn't take down the envoy proxy. It just kills the listener so we end up with a practically half dead proxy which doesn't recover until we manually restart it.
I would like to see that call_foreign_function allows the developer to decide what states are ok and which are not. Currently it just panics when it thinks the outcome is not ok.
Edit:
More debugging found that in those cases url_path is not part of the request object (even though envoy docs say it should be present). So modifying the expression to has(request.url_path) && request.url_path.startsWith('/some/sub/url/') is a working workaround for this panic/crash
The text was updated successfully, but these errors were encountered:
Hi,
we are using this SDK for attribute generation via dynamic expressions. We use expr_create to get a expression identifier via
call_foreign_function("expr_create", Option::from(self.condition.as_bytes()));
We cache this id and reuse it for expr_eval when HttpContext on_log gets called.
The bug we now see is that expr_eval called via call_foreign_function with a non standard HTTP method crashes the expr_eval with InternalFailure (10) and thus panic:
The curl call to trigger this:
curl --location --request MBGR 'https://<URL redacted>/'
The expression in question looks something like this:
request.url_path.startsWith('/some/sub/url/')
We use istio 1.19.7 in this setup and it seems that when the plugin panics it doesn't take down the envoy proxy. It just kills the listener so we end up with a practically half dead proxy which doesn't recover until we manually restart it.
I would like to see that call_foreign_function allows the developer to decide what states are ok and which are not. Currently it just panics when it thinks the outcome is not ok.
Edit:
More debugging found that in those cases url_path is not part of the request object (even though envoy docs say it should be present). So modifying the expression to
has(request.url_path) && request.url_path.startsWith('/some/sub/url/')
is a working workaround for this panic/crashThe text was updated successfully, but these errors were encountered: