envoy
envoy copied to clipboard
uhv: header validators for H1 and H2 codecs
Commit Message: uhv: header validators for H1 and H2 codecs
Additional Description: This PR builds off the foundation laid in #21974 to add validators for H1 and H2. H3 and path normalization are intentionally out of scope for this PR and will be completed later.
Risk Level: Low
Testing: Build Envoy with --define uhv=enabled, configure a service with UHV enabled, and then test a valid and invalid request.
# config.yml, in the HCM section
typed_header_validation_config:
name: envoy.http.header_validators.envoy_default
typed_config:
"@type": type.googleapis.com/envoy.extensions.http.header_validators.envoy_default.v3.HeaderValidatorConfig
#
# UHV configuration
# uncomment any of the following:
#
# restrict_http_methods: true
# reject_headers_with_underscores: true
# http1_protocol_options: {allow_chunked_length: true}
#
# run tests
# valid request
http GET http://localhost:10000 X-Valid:ok
# invalid request
http GET http://localhost:10000 "X Invalid":bad
Fixes #19753 Docs Changes: Release Notes: Platform Specific Features:
CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @markdroth
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).
/wait on CI
@alyssawilk Can you rerun the failed CI job? CI is passing for me locally and I think the current failure is because a package couldn't be downloaded.
you should be able to yourself with /retest
Retrying Azure Pipelines: Retried failed jobs in: envoy-presubmit
/assign-from @envoyproxy/api-shepherds
@envoyproxy/api-shepherds assignee is @markdroth
@yanavlasov @adisuissa this looks ready for another round of review.
Looks good. A couple more comments I missed last time.
/wait
Amazing work here!
high level question: are we hooking these up to see where there are going to be behavioral differences? I feel like if we had this turned on for e2e a bunch of Yan and my comments would be obsoleted by test failures :-)
Yes, I think I can do PR that enables the default UHV based on the build flag. We can then merge that PR here and see the results.
/wait for Yan's toggle patch
/wait
/retest
Retrying Azure Pipelines: Retried failed jobs in: envoy-presubmit
/retest
Retrying Azure Pipelines: Retried failed jobs in: envoy-presubmit
Looks like CI is still unhappy?
/retest
Retrying Azure Pipelines: Retried failed jobs in: envoy-presubmit
/retest
Retrying Azure Pipelines: Retried failed jobs in: envoy-presubmit
/retest
Retrying Azure Pipelines: Retried failed jobs in: envoy-presubmit
/retest
Retrying Azure Pipelines: Retried failed jobs in: envoy-presubmit
@lizan could you give this an API stamp for the docs update?
@envoyproxy/api-shepherds - This optional validator (default, not enabled) has been approved by Yan, but who is willing to review this for an api stamp of approval?
I'm submitting this PR so we can proceed with follow-up work. If you have any more comments, please open Issues.
Looks like all comments were addressed. If we missed anything, please file an Issue and we will address in a followup PR.