Envoy skips calling rate limiting service when request header is not present

[ramaraochavali]

We have configured the rate limiting service with three request headers actions like

        "rate_limits": [
         {
          "stage": 0,
          "actions": [
           {
            "source_cluster": {}
           },
           {
            "destination_cluster": {}
           },
           {
            "request_headers": {
             "header_name": ":authority",
             "descriptor_key": "authority"
            }
           },
           {
            "request_headers": {
             "header_name": ":path",
             "descriptor_key": "path"
            }
           },
           {
            "request_headers": {
             "header_name": "custom-header",
             "descriptor_key": "custom"
            }
           },
          ]
         }
        ]
       }
      ]

If in a request the custom-header does not have a value, Envoy skips calling the rate limiting service.

Debugging it further, found that if any of the populateDescriptor call here returns false it skips adding the descriptor

envoy/source/common/router/router_ratelimit.cc

Line 121 in 5be15b3

RateLimit::Descriptor descriptor;

and

populateDescriptor implementation of RequestHeadersAction returns false if there is no value

envoy/source/common/router/router_ratelimit.cc

Line 41 in 5be15b3

if (!header_value) {

Since the descriptor list is empty, rate limit service is not called.

Is this expected behaviour? Should we not call rate limiting service with two headers as descriptor entries which have values rather than completely skipping it?

Should we simply add a descriptor if it has atleast one entry?

[mattklein123]

Agreed this feels like a bug to me.

[ramaraochavali]

@mattklein123 Can you please add "rohan07" to the org and assign this issue? He will fix it.

[repokitteh-read-only]

rohan7 cannot be assigned to this issue.

🐱

Caused by: a #10124 (comment) was created by @ramaraochavali.

see: more, trace.