ext_authz: added ability to detect partial request body data

api/envoy/config/filter/http/ext_authz/v2/ext_authz.proto

@@ -52,6 +52,8 @@ message ExtAuthz {
   bool use_alpha = 4 [deprecated = true];
 
   // Enables filter to buffer the client request body and send it within the authorization request.
+  // A ``x-envoy-auth-partial-body: 0|1`` metadata header will be added to the authorization
+  // request message indicating if the body data is partial.
   BufferSettings with_request_body = 5;
 }
 

docs/root/intro/version_history.rst

@@ -4,6 +4,7 @@ Version history
 1.11.0 (Pending)
 ================
 * dubbo_proxy: support the :ref:`Dubbo proxy filter <config_network_filters_dubbo_proxy>`.
+* ext_authz: added a `x-envoy-auth-partial-body` metadata header set to `0|1` indicating if there is a partial body sent in the authorization request message.
 * http: mitigated a race condition with the :ref:`delayed_close_timeout<envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.delayed_close_timeout>` where it could trigger while actively flushing a pending write buffer for a downstream connection.
 * redis: add support for zpopmax and zpopmin commands.
 * upstream: added :ref:`upstream_cx_pool_overflow <config_cluster_manager_cluster_stats>` for the connection pool circuit breaker.

source/common/http/headers.h

@@ -36,6 +36,7 @@ class HeaderValues {
   const LowerCaseString Cookie{"cookie"};
   const LowerCaseString Date{"date"};
   const LowerCaseString EnvoyAttemptCount{"x-envoy-attempt-count"};
+  const LowerCaseString EnvoyAuthPartialBody{"x-envoy-auth-partial-body"};
   const LowerCaseString EnvoyDegraded{"x-envoy-degraded"};
   const LowerCaseString EnvoyDownstreamServiceCluster{"x-envoy-downstream-service-cluster"};
   const LowerCaseString EnvoyDownstreamServiceNode{"x-envoy-downstream-service-node"};

source/extensions/filters/common/ext_authz/check_request_utils.cc

@@ -107,12 +107,15 @@ void CheckRequestUtils::setHttpRequest(
   auto mutable_headers = httpreq.mutable_headers();
   headers.iterate(
       [](const Envoy::Http::HeaderEntry& e, void* ctx) {
-        Envoy::Protobuf::Map<Envoy::ProtobufTypes::String, Envoy::ProtobufTypes::String>*
-            mutable_headers = static_cast<
-                Envoy::Protobuf::Map<Envoy::ProtobufTypes::String, Envoy::ProtobufTypes::String>*>(
-                ctx);
-        (*mutable_headers)[std::string(e.key().getStringView())] =
-            std::string(e.value().getStringView());
+        // Skip any client EnvoyAuthPartialBody header, which could interfere with internal use.
+        if (e.key().getStringView() != Http::Headers::get().EnvoyAuthPartialBody.get()) {
+          Envoy::Protobuf::Map<Envoy::ProtobufTypes::String, Envoy::ProtobufTypes::String>*
+              mutable_headers =
+                  static_cast<Envoy::Protobuf::Map<Envoy::ProtobufTypes::String,
+                                                   Envoy::ProtobufTypes::String>*>(ctx);
+          (*mutable_headers)[std::string(e.key().getStringView())] =
+              std::string(e.value().getStringView());
+        }
         return Envoy::Http::HeaderMap::Iterate::Continue;
       },
       mutable_headers);
@@ -124,6 +127,10 @@ void CheckRequestUtils::setHttpRequest(
     std::string data(length, 0);
     buffer->copyOut(0, length, &data[0]);
     httpreq.set_body(std::move(data));
+
+    // Add in a header to detect when a partial body is used.
+    (*mutable_headers)[Http::Headers::get().EnvoyAuthPartialBody.get()] =
+        length != buffer->length() ? "1" : "0";
   }
 }
 

test/extensions/filters/common/ext_authz/check_request_utils_test.cc

@@ -75,17 +75,24 @@ TEST_F(CheckRequestUtilsTest, BasicTcp) {
 
 // Verify that createHttpCheck's dependencies are invoked when it's called.
 // Verify that check request object has no request data.
+// Verify that a client supplied EnvoyAuthPartialBody will not affect the
+// CheckRequest call.
 TEST_F(CheckRequestUtilsTest, BasicHttp) {
   const uint64_t size = 0;
-  Http::HeaderMapImpl headers_;
   envoy::service::auth::v2::CheckRequest request_;
 
+  // A client supplied EnvoyAuthPartialBody header should be ignored.
+  Http::TestHeaderMapImpl request_headers{{Http::Headers::get().EnvoyAuthPartialBody.get(), "1"}};
+
   ExpectBasicHttp();
-  CheckRequestUtils::createHttpCheck(&callbacks_, headers_,
+  CheckRequestUtils::createHttpCheck(&callbacks_, request_headers,
                                      Protobuf::Map<ProtobufTypes::String, ProtobufTypes::String>(),
                                      request_, size);
   ASSERT_EQ(size, request_.attributes().request().http().body().size());
   EXPECT_EQ(buffer_->toString().substr(0, size), request_.attributes().request().http().body());
+  EXPECT_EQ(request_.attributes().request().http().headers().end(),
+            request_.attributes().request().http().headers().find(
+                Http::Headers::get().EnvoyAuthPartialBody.get()));
 }
 
 // Verify that check request object has only a portion of the request data.
@@ -100,6 +107,8 @@ TEST_F(CheckRequestUtilsTest, BasicHttpWithPartialBody) {
                                      request_, size);
   ASSERT_EQ(size, request_.attributes().request().http().body().size());
   EXPECT_EQ(buffer_->toString().substr(0, size), request_.attributes().request().http().body());
+  EXPECT_EQ("1", request_.attributes().request().http().headers().at(
+                     Http::Headers::get().EnvoyAuthPartialBody.get()));
 }
 
 // Verify that check request object has all the request data.
@@ -114,6 +123,8 @@ TEST_F(CheckRequestUtilsTest, BasicHttpWithFullBody) {
   ASSERT_EQ(buffer_->length(), request_.attributes().request().http().body().size());
   EXPECT_EQ(buffer_->toString().substr(0, buffer_->length()),
             request_.attributes().request().http().body());
+  EXPECT_EQ("0", request_.attributes().request().http().headers().at(
+                     Http::Headers::get().EnvoyAuthPartialBody.get()));
 }
 
 // Verify that createHttpCheck extract the proper attributes from the http request into CheckRequest