Skip to content

fix: return 500 error for invalid filters#7605

Merged
zirain merged 2 commits intoenvoyproxy:mainfrom
zhaohuabing:fix-7604
Dec 3, 2025
Merged

fix: return 500 error for invalid filters#7605
zirain merged 2 commits intoenvoyproxy:mainfrom
zhaohuabing:fix-7604

Conversation

@zhaohuabing
Copy link
Copy Markdown
Member

@zhaohuabing zhaohuabing commented Nov 26, 2025 •
edited
Loading

Currently, EG drops route rules with invalid filters, which results in 404 response when matching requests arrive. This PR changes the behavior to generate routes with a direct 500 response for those rules instead.

The new behavior aligns with the the Gateway API GET https://gateway-api.sigs.k8s.io/geps/gep-1364/

The GEP 1364 only mentions the case of InvalidKind custom filter, but other types of invalid filters should be treated in a similar way.

HTTPRoute with one Custom supported filter added that is not supported by the implementation. Our spec is currently unclear on what happens in this case, but custom HTTP Filters require the use of the ExtensionRef filter type, and the setting of the ExtensionRef field to the name, group, version, and kind of a custom resource that describes the filter. If that custom resource is not supported, it seems reasonable to say that this should be a reference failure, and be treated like other reference failures (Accepted will be set to true, ResolvedRefs to false with a InvalidKind Reason, and traffic that would have matched the filter should receive a 500 error.)

fix: #7604
release note: yes

@zhaohuabing zhaohuabing requested a review from a team as a code owner November 26, 2025 02:58
@zhaohuabing zhaohuabing marked this pull request as draft November 26, 2025 02:59
@codecov
Copy link
Copy Markdown

codecov Bot commented Nov 26, 2025 •
edited
Loading

Codecov Report

❌ Patch coverage is 74.19355% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.34%. Comparing base (4620106) to head (8d77e2b).
⚠️ Report is 504 commits behind head on main.

Files with missing lines Patch % Lines
internal/gatewayapi/route.go 74.19% 7 Missing and 1 partial ⚠️
Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #7605   +/-   ##
=======================================
  Coverage   72.34%   72.34%           
=======================================
  Files         232      232           
  Lines       34209    34238   +29     
=======================================
+ Hits        24749    24771   +22     
- Misses       7682     7689    +7     
  Partials     1778     1778

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@zhaohuabing zhaohuabing force-pushed the fix-7604 branch 2 times, most recently from eeb1992 to 7a3ae0a Compare November 26, 2025 03:24
@zhaohuabing zhaohuabing marked this pull request as ready for review November 26, 2025 03:46
@zhaohuabing zhaohuabing requested a review from arkodg November 27, 2025 06:24
arkodg
arkodg previously approved these changes Dec 2, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@arkodg arkodg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks

@arkodg arkodg requested review from a team December 2, 2025 01:45
zirain
zirain previously approved these changes Dec 2, 2025
View reviewed changes
@zhaohuabing @zirain
return 500 error for invalid filters
3aa56a9 
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
@zirain zirain enabled auto-merge (squash) December 2, 2025 07:50
@zhaohuabing zhaohuabing disabled auto-merge December 2, 2025 07:54
kkk777-7
kkk777-7 previously approved these changes Dec 2, 2025
View reviewed changes
@kkk777-7
Copy link
Copy Markdown
Member

kkk777-7 commented Dec 2, 2025

LGTM, thanks!

@zhaohuabing zhaohuabing dismissed stale reviews from kkk777-7, zirain, and arkodg via 8d77e2b December 3, 2025 00:39
@zirain zirain merged commit f719678 into envoyproxy:main Dec 3, 2025
32 checks passed
rudrakhp pushed a commit to rudrakhp/gateway that referenced this pull request Apr 15, 2026
@zhaohuabing @rudrakhp
fix: return 500 error for invalid filters (envoyproxy#7605)
9da5337 
return 500 error for invalid filters

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
rudrakhp added a commit that referenced this pull request Apr 16, 2026
@rudrakhp @felipesabadini
@jukie @cnvergence @zhaohuabing @aburanrbx @arkodg @stekole @kkk777-7
[release/v1.6] cherry-pick for v1.6.6 (#8761)
174c1d7 
* fix: avoid metric increments on no-op delete reconcile paths (#8480)

* fix: avoid metric increments on no-op delete reconcile paths

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>

* Update internal/infrastructure/kubernetes/infra_resource_test.go

Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>

* Update internal/infrastructure/kubernetes/infra_resource_test.go

Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>

---------

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: restore failure-path metric recording for delete and HPA reconcile (#8656)

Fixes #8651

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: helm secrets rbac for gateway namespace with watch list of namespaces (#8706)

* fix: helm secrets rbac for gateway namespace with watch list of namespaces

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* review update

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: handle network errors in rate limit e2e tests (#8446)

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: propagate the HTTPFilter translation errors to the outer layer (#7556)

* progate the HTTPFilter validation errors to the outer layer

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: return 500 error for invalid filters (#7605)

return 500 error for invalid filters

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: prevent configuring requestMirror filter and directResponse/RequestRedirect filter together (#7474)

* fix: prevent configuring RequestMirror and DirectResponse filters together

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

check redirect respose filter

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* fix lint

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix bug with grpcroute mirror filter (#8541)

* fix bug with grpcroute mirror filter

Signed-off-by: Adam Buran <aburan@roblox.com>

* add indexers test

Signed-off-by: Adam Buran <aburan@roblox.com>

* add release note

Signed-off-by: Adam Buran <aburan@roblox.com>

---------

Signed-off-by: Adam Buran <aburan@roblox.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: normalize CRLF line endings in htpasswd basic auth secrets (#8557)

Fixes #8554

Signed-off-by: stekole <stefan@sandnetworks.com>
Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: status for mirror backend (#8675)

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: set HTTPRoute Accepted condition as true with mixed invalid and valid rules (#7625)

* set HTTPRoute Accepted condition as true with mixed invalid and valid rules

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: basic auth validation (#8053)

* fix basic auth validation

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* [release/v1.6] fix gen check

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

---------

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Adam Buran <aburan@roblox.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: stekole <stefan@sandnetworks.com>
Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: Felipe Sabadini <fsabadini@hotmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: aburanrbx <aburan@roblox.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: stekole <30674956+stekole@users.noreply.github.com>
Co-authored-by: Kota Kimura <86363983+kkk777-7@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zirain zirain zirain approved these changes

@jukie jukie jukie approved these changes

@kkk777-7 kkk777-7 Awaiting requested review from kkk777-7

@arkodg arkodg Awaiting requested review from arkodg

Assignees

No one assigned

Labels

cherrypick/release-v1.6.6

Projects

None yet

Milestone

No milestone

6 participants

@zhaohuabing @kkk777-7 @zirain @arkodg @jukie @rudrakhp