api: add detectMisdirectedRequests to EnvoyProxy by mmmommm · Pull Request #9675 · envoyproxy/gateway

mmmommm · 2026-08-05T14:43:00Z

What this PR does / why we need it:

This is part 1 of 3 for #5879, adding API support for GEP-3567 misdirected request detection.

This PR adds the detectMisdirectedRequests field to EnvoyProxy and updates the generated API artifacts.

Follow-up PRs will add:

The IR/xDS implementation that returns 421 responses when the feature is enabled.
Conformance test enablement for HTTPRouteHTTPSListenerDetectMisdirectedRequests.

The field defaults to disabled, and this PR does not change runtime behavior. The implementation is intentionally left for a follow-up PR so this PR can focus on the API
shape: field name, type, placement, and documentation.

Which issue(s) this PR fixes:

Fixes #5879

PR Checklist

netlify · 2026-08-05T14:43:07Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`f6ae4f0`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a94ae1907b05d0008e929f3
😎 Deploy Preview	https://deploy-preview-9675--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-08-05T15:21:01Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.27%. Comparing base (3b80726) to head (f6ae4f0).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9675      +/-   ##
==========================================
- Coverage   81.29%   81.27%   -0.02%     
==========================================
  Files         263      263              
  Lines       40859    40859              
==========================================
- Hits        33216    33210       -6     
- Misses       7643     7649       +6

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

zirain · 2026-08-05T23:31:02Z

+	// Default: false
+	//
+	// +optional
+	DetectMisdirectedRequests *bool `json:"detectMisdirectedRequests,omitempty"`


can we have another top level fields for features like this may happen in the future?

Sounds good. How about a typed struct named features like following?

spec: features: detectMisdirectedRequests: true

@envoyproxy/gateway-maintainers wdyt?

Updated. I moved detectMisdirectedRequests under a typed features field.

I prefer OverlappingTLSHandling to this, and then we should define as enum to extend feature in the future.

// +kubebuilder:validation:Enum=DowngradeToHTTP1;Reject // +optional OverlappingTLSHandling *OverlappingTLSHandling

Thanks, I’m fine with the OverlappingTLSHandling name too.
Do you expect this to support three or more handling modes in the future?
Since this is currently just two states, enabled or disabled, I think a bool is reasonable. If we expect more handling modes soon, an enum would make sense.

Im not sure we'd like to add another option to this field in the future. But v1alpha1 must migrate to v1alpha2 if we'd like to add any mode since bool can only handle two states literally. Whereas if we goes with this as enum, we won't care about migration.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d851ccf213

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-06T07:22:57Z

+
+	// Features defines the features that are enabled for this EnvoyProxy.
+	// +optional
+	Features *EnvoyProxyFeatures `json:"features,omitempty"`


Add a release note for the new EnvoyProxy API

This introduces a user-visible EnvoyProxy API field, but the commit adds no fragment under release-notes/current/. When the next release notes are generated, this API addition will therefore be omitted; add a new_features/ fragment describing the new field and its currently disabled-by-default behavior.

Useful? React with 👍 / 👎.

mmmommm · 2026-08-06T08:20:43Z

Fixed Hugo Docs / docs-lint (pull_request) ci fails in #9684

sivchari · 2026-08-06T14:22:09Z

+
+	// Features defines the features that are enabled for this EnvoyProxy.
+	// +optional
+	Features *EnvoyProxyFeatures `json:"features,omitempty"`


This project is for envoy, so I think it's clearer.

Suggested change

Features *EnvoyProxyFeatures `json:"features,omitempty"`

ProxyFeatures *ProxyFeatures `json:"proxyFeatures,omitempty"`

sivchari · 2026-08-06T14:27:03Z

+	// +optional
+	Features *EnvoyProxyFeatures `json:"features,omitempty"`


Suggested change

// +optional

Features *EnvoyProxyFeatures `json:"features,omitempty"`

// +optional

// +kubebuilder:validation:MinProperties=1

Features EnvoyProxyFeatures `json:"features,omitempty"`

You can define this field without using pointer if you add MinProperties field = 1 since it doesn't admit zero value struct.

mmmommm · 2026-08-21T13:48:22Z

@arkodg @zhaohuabing
Could you please review this when you have some time?

arkodg · 2026-08-24T04:53:00Z

hey @zirain can you elaborate on #5879 (comment) ?

zirain · 2026-08-24T05:11:55Z

hey @zirain can you elaborate on #5879 (comment) ?

I'm not sure if it's reasonable to add a CTP in test/config/gatewayclass.yaml to enabled detectMisdirectedRequests for the conformance test, EnvoyProxy sounds good to me.

arkodg · 2026-08-24T05:13:47Z

imo the focus should be UX, ALPN lives in CTP should it makes sense for this behavior knob to live close to it

zirain · 2026-08-24T07:32:53Z

imo the focus should be UX, ALPN lives in CTP should it makes sense for this behavior knob to live close to it

I have no strong opinion on UX part, since I believe it should be default behavior.

mmmommm · 2026-08-30T22:18:31Z

To keep it next to alpnProtocols (as @arkodg suggested), I'll add detectMisdirectedRequests *bool to ClientTrafficPolicy.spec.tls. When it is enabled, the listener keeps HTTP/2 and returns 421 on an SNI/:authority mismatch, instead of downgrading ALPN.

I'd like to confirm a few things before implementing

Is the placement and name OK?
Should the default be on or off? (@zirain suggested it should be default behavior, though defaulting to on would change the current behavior for overlapping listeners.)

Signed-off-by: Kise Ryota <kiseryota.contact@gmail.com>

zhaohuabing · 2026-08-31T02:19:41Z

Is the placement and name OK?

How about making it more explicit?


OverlappingTLSHandling *OverlappingTLSHandling `json:"overlappingTLSHandling,omitempty"`

// +kubebuilder:validation:Enum=DowngradeToHTTP1;Reject
type OverlappingTLSHandling string

const (
      // Downgrade ALPN to http/1.1 so clients cannot coalesce. Default.
      OverlappingTLSHandlingDowngradeToHTTP1 OverlappingTLSHandling = "DowngradeToHTTP1"
      // Keep HTTP/2 and respond 421 Misdirected Request when the request
      // :authority does not match the SNI the connection was accepted on.
      OverlappingTLSHandlingReject OverlappingTLSHandling = "Reject"
)

Should the default be on or off?

I'd prefer to keep the existing behavior to avoid breaking change. If adding a CTP to pass comformance tests is not feasible, then we can make the default on and add a breaking change note to warn users who have old clients in production that don't understand 421 Misdirected Request, and ask them to turn it off with CTP.

arkodg · 2026-08-31T03:19:34Z

Is the placement and name OK?
+1
Should the default be on or off? (@zirain suggested it should be default behavior, though defaulting to on would change the current behavior for overlapping listeners.)

vote for off to avoid a breaking change

arkodg · 2026-08-31T03:20:06Z

Is the placement and name OK?

How about making it more explicit?
OverlappingTLSHandling *OverlappingTLSHandling `json:"overlappingTLSHandling,omitempty"`

// +kubebuilder:validation:Enum=DowngradeToHTTP1;Reject
type OverlappingTLSHandling string

const (
      // Downgrade ALPN to http/1.1 so clients cannot coalesce. Default.
      OverlappingTLSHandlingDowngradeToHTTP1 OverlappingTLSHandling = "DowngradeToHTTP1"
      // Keep HTTP/2 and respond 421 Misdirected Request when the request
      // :authority does not match the SNI the connection was accepted on.
      OverlappingTLSHandlingReject OverlappingTLSHandling = "Reject"
)
Should the default be on or off?

I'd prefer to keep the existing behavior to avoid breaking change. If adding a CTP to pass comformance tests is not feasible, then we can make the default on and add a breaking change note to warn users who have old clients in production that don't understand 421 Misdirected Request, and ask them to turn it off with CTP.

+1 to enum over bool

mmmommm · 2026-09-04T03:49:35Z

@arkodg @zhaohuabing
Thanks for the feedback, and sorry for the late reply.

Agreed on moving from a bool to an enum and no breaking change. I’ll go with OverlappingTLSHandling as suggested:


// +kubebuilder:validation:Enum=DowngradeToHTTP1;Reject
OverlappingTLSHandling *OverlappingTLSHandling

zirain · 2026-09-04T04:22:37Z

Is the placement and name OK?
+1
Should the default be on or off? (@zirain suggested it should be default behavior, though defaulting to on would change the current behavior for overlapping listeners.)

vote for off to avoid a breaking change

it should be default off it live in CTP.

zirain reviewed Aug 5, 2026

View reviewed changes

mmmommm force-pushed the feat/detect-misdirected-requests-api branch from 5646738 to d851ccf Compare August 6, 2026 07:13

mmmommm marked this pull request as ready for review August 6, 2026 07:19

mmmommm requested a review from a team as a code owner August 6, 2026 07:19

chatgpt-codex-connector Bot reviewed Aug 6, 2026

View reviewed changes

mmmommm force-pushed the feat/detect-misdirected-requests-api branch from d851ccf to 99eac78 Compare August 6, 2026 07:48

sivchari reviewed Aug 6, 2026

View reviewed changes

arkodg added this to the v1.10.0-rc.1 Release milestone Aug 24, 2026

mmmommm added 2 commits August 31, 2026 07:19

api: add detectMisdirectedRequests to EnvoyProxy

257758f

Signed-off-by: Kise Ryota <kiseryota.contact@gmail.com>

move DetectMisdirectedRequests under ClientTLSSettings

f6ae4f0

Signed-off-by: Kise Ryota <kiseryota.contact@gmail.com>

mmmommm force-pushed the feat/detect-misdirected-requests-api branch from e363de1 to f6ae4f0 Compare August 30, 2026 22:26

	Features *EnvoyProxyFeatures `json:"features,omitempty"`
	ProxyFeatures *ProxyFeatures `json:"proxyFeatures,omitempty"`

		// +optional
		Features *EnvoyProxyFeatures `json:"features,omitempty"`

Uh oh!

Conversation

mmmommm commented Aug 5, 2026

Uh oh!

netlify Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

codecov Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sivchari Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mmmommm commented Aug 6, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mmmommm commented Aug 21, 2026

Uh oh!

arkodg commented Aug 24, 2026

Uh oh!

zirain commented Aug 24, 2026

Uh oh!

arkodg commented Aug 24, 2026

Uh oh!

zirain commented Aug 24, 2026

Uh oh!

mmmommm commented Aug 30, 2026

Uh oh!

zhaohuabing commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arkodg commented Aug 31, 2026 • edited by zirain Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arkodg commented Aug 31, 2026

Uh oh!

mmmommm commented Sep 4, 2026

Uh oh!

zirain commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

netlify Bot commented Aug 5, 2026 •

edited

Loading

codecov Bot commented Aug 5, 2026 •

edited

Loading

sivchari Aug 7, 2026 •

edited

Loading

zhaohuabing commented Aug 31, 2026 •

edited

Loading

arkodg commented Aug 31, 2026 •

edited by zirain

Loading