{"record":{"id":"3cd421993a0c55fc","repo":"grpc/grpc-go","slug":"rbac-nil-configuration-message-provided","errorCode":null,"errorMessage":"rbac: nil configuration message provided","messagePattern":"rbac: nil configuration message provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/rbac/rbac.go","lineNumber":131,"sourceCode":"\n\t// TODO(gregorycooke) - change the call chain to here so we have the filter\n\t// name to input here instead of an empty string. It will come from here:\n\t// https://github.com/grpc/grpc-go/blob/eff0942e95d93112921414aee758e619ec86f26f/xds/internal/xdsclient/xdsresource/unmarshal_lds.go#L199\n\tce, err := rbac.NewChainEngine([]*v3rbacpb.RBAC{rbacCfg.GetRules()}, \"\")\n\tif err != nil {\n\t\t// \"At this time, if the RBAC.action is Action.LOG then the policy will be\n\t\t// completely ignored, as if RBAC was not configured.\" - A41\n\t\tif rbacCfg.GetRules().GetAction() != v3rbacpb.RBAC_LOG {\n\t\t\treturn nil, fmt.Errorf(\"rbac: error constructing matching engine: %v\", err)\n\t\t}\n\t}\n\n\treturn config{chainEngine: ce}, nil\n}\n\nfunc (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {\n\tif cfg == nil {\n\t\treturn nil, fmt.Errorf(\"rbac: nil configuration message provided\")\n\t}\n\tm, ok := cfg.(*anypb.Any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"rbac: error parsing config %v: unknown type %T\", cfg, cfg)\n\t}\n\tmsg := new(rpb.RBAC)\n\tif err := m.UnmarshalTo(msg); err != nil {\n\t\treturn nil, fmt.Errorf(\"rbac: error parsing config %v: %v\", cfg, err)\n\t}\n\treturn parseConfig(msg)\n}\n\nfunc (builder) ParseFilterConfigOverride(override proto.Message) (httpfilter.FilterConfig, error) {\n\tif override == nil {\n\t\treturn nil, fmt.Errorf(\"rbac: nil configuration message provided\")\n\t}\n\tm, ok := override.(*anypb.Any)\n\tif !ok {","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/rbac/rbac.go#L113-L149","documentation":"ParseFilterConfig rejects a nil protobuf config message. The RBAC filter requires a non-nil listener-level config; a nil config means the xDS resource referenced an RBAC filter but supplied no typed_config.","triggerScenarios":"The LDS HTTP filter chain contains an RBAC filter entry whose typed_config is absent/nil when the builder's ParseFilterConfig is invoked.","commonSituations":"Control-plane misconfiguration emitting a filter entry without a body; a custom xDS server omitting the config field; partial resource during a rolling update.","solutions":["Ensure the RBAC filter entry in the LDS resource carries a typed_config Any wrapping envoy.extensions.filters.http.rbac.v3.RBAC.","Validate the LDS resource on the control plane before serving it (reject filter entries with no typed_config)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func ensureRBACFilterConfigPresent(filters []*hcmpb.HttpFilter) error {\n\tfor _, f := range filters {\n\t\tif isRBACFilter(f) && f.GetTypedConfig() == nil {\n\t\t\treturn fmt.Errorf(\"rbac filter %q has nil typed_config\", f.GetName())\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always emit a typed_config for every filter entry in LDS resources.","Reject filter entries with nil typed_config at the control-plane validation layer."],"tags":["rbac","xds","grpc","config-validation"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}