envoy: envoy-[main,1.27]: ORIGINAL_DST cluster with TLS transport, crash in config validation mode
this issue cleared through security group and was advised to create a public one:
issue introduced as part of the 1.27 release and was working on the almost the same configuration since 1.18.
simplest way to reproduce it is to define HTTP upstream cluster with TLS upstream like follow:
...
- name: app_cluster
alt_stat_name: app
type: ORIGINAL_DST
lb_policy: CLUSTER_PROVIDED
original_dst_lb_config:
use_http_header: true
http_header_name: x-dst-host
typed_extension_protocol_options:
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
"@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
common_http_protocol_options:
max_requests_per_connection: 1
explicit_http_config:
http_protocol_options:
allow_chunked_length: true
override_stream_error_on_invalid_http_message: false
transport_socket:
name: envoy.transport_sockets.tls
typed_config:
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
common_tls_context:
tls_params:
tls_minimum_protocol_version: TLSv1_2
tls_maximum_protocol_version: TLSv1_3
run envoy in validation mode: envoy --mode validate -c envoy.yaml
following stack trace exposed:
14:27:50 #16 0.444 [2023-08-31 18:27:50.332][10][critical][backtrace] [external/envoy/source/server/backtrace.h:104] Caught Segmentation fault, suspect faulting address 0x0
14:27:50 #16 0.444 [2023-08-31 18:27:50.332][10][critical][backtrace] [external/envoy/source/server/backtrace.h:91] Backtrace (use tools/stack_decode.py to get line numbers):
14:27:50 #16 0.444 [2023-08-31 18:27:50.332][10][critical][backtrace] [external/envoy/source/server/backtrace.h:92] Envoy version: cc3dc27c51404f2f524893eba8a87316d76ab059/1.27.1-dev/Modified/RELEASE/BoringSSL
14:27:50 #16 0.444 [2023-08-31 18:27:50.332][10][critical][backtrace] [external/envoy/source/server/backtrace.h:98] #0: [0x7ff706922520]
14:27:50 #16 0.455 [2023-08-31 18:27:50.342][10][critical][backtrace] [external/envoy/source/server/backtrace.h:96] #1: Envoy::Extensions::TransportSockets::Tls::ClientSslSocketFactory::~ClientSslSocketFactory() [0x558683ecfb35]
14:27:50 #16 0.465 [2023-08-31 18:27:50.352][10][critical][backtrace] [external/envoy/source/server/backtrace.h:96] #2:
...
About this issue
- Original URL
- State: open
- Created 10 months ago
- Comments: 31 (12 by maintainers)
cc @kyessenov @lizan could you take a look at this issue please
np - ill take a look tomorrow
@pgeler ill close for now and we can consider backporting if anyone reports an issue
I can confirm the
mainaffected by the issue as well