Line data    Source code

       1             : #pragma once
       2             : 
       3             : #include "envoy/config/config_provider.h"
       4             : #include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.h"
       5             : #include "envoy/http/early_header_mutation.h"
       6             : #include "envoy/http/filter.h"
       7             : #include "envoy/http/header_validator.h"
       8             : #include "envoy/http/original_ip_detection.h"
       9             : #include "envoy/http/request_id_extension.h"
      10             : #include "envoy/router/rds.h"
      11             : #include "envoy/router/scopes.h"
      12             : #include "envoy/stats/scope.h"
      13             : #include "envoy/tracing/tracer.h"
      14             : #include "envoy/type/v3/percent.pb.h"
      15             : 
      16             : #include "source/common/http/date_provider.h"
      17             : #include "source/common/local_reply/local_reply.h"
      18             : #include "source/common/network/utility.h"
      19             : #include "source/common/stats/symbol_table.h"
      20             : #include "source/common/tracing/tracer_config_impl.h"
      21             : 
      22             : namespace Envoy {
      23             : namespace Http {
      24             : 
      25             : /**
      26             :  * All stats for the connection manager. @see stats_macros.h
      27             :  */
      28             : #define ALL_HTTP_CONN_MAN_STATS(COUNTER, GAUGE, HISTOGRAM)                                         \
      29         274 :   COUNTER(downstream_cx_delayed_close_timeout)                                                     \
      30         274 :   COUNTER(downstream_cx_destroy)                                                                   \
      31         274 :   COUNTER(downstream_cx_destroy_active_rq)                                                         \
      32         274 :   COUNTER(downstream_cx_destroy_local)                                                             \
      33         274 :   COUNTER(downstream_cx_destroy_local_active_rq)                                                   \
      34         274 :   COUNTER(downstream_cx_destroy_remote)                                                            \
      35         274 :   COUNTER(downstream_cx_destroy_remote_active_rq)                                                  \
      36         274 :   COUNTER(downstream_cx_drain_close)                                                               \
      37         274 :   COUNTER(downstream_cx_http1_total)                                                               \
      38         274 :   COUNTER(downstream_cx_http2_total)                                                               \
      39         274 :   COUNTER(downstream_cx_http3_total)                                                               \
      40         274 :   COUNTER(downstream_cx_idle_timeout)                                                              \
      41         274 :   COUNTER(downstream_cx_max_duration_reached)                                                      \
      42         274 :   COUNTER(downstream_cx_max_requests_reached)                                                      \
      43         274 :   COUNTER(downstream_cx_overload_disable_keepalive)                                                \
      44         274 :   COUNTER(downstream_cx_protocol_error)                                                            \
      45         274 :   COUNTER(downstream_cx_rx_bytes_total)                                                            \
      46         274 :   COUNTER(downstream_cx_ssl_total)                                                                 \
      47         274 :   COUNTER(downstream_cx_total)                                                                     \
      48         274 :   COUNTER(downstream_cx_tx_bytes_total)                                                            \
      49         274 :   COUNTER(downstream_cx_upgrades_total)                                                            \
      50         274 :   COUNTER(downstream_flow_control_paused_reading_total)                                            \
      51         274 :   COUNTER(downstream_flow_control_resumed_reading_total)                                           \
      52         274 :   COUNTER(downstream_rq_1xx)                                                                       \
      53         274 :   COUNTER(downstream_rq_2xx)                                                                       \
      54         274 :   COUNTER(downstream_rq_3xx)                                                                       \
      55         274 :   COUNTER(downstream_rq_4xx)                                                                       \
      56         274 :   COUNTER(downstream_rq_5xx)                                                                       \
      57         274 :   COUNTER(downstream_rq_completed)                                                                 \
      58         274 :   COUNTER(downstream_rq_failed_path_normalization)                                                 \
      59         274 :   COUNTER(downstream_rq_http1_total)                                                               \
      60         274 :   COUNTER(downstream_rq_http2_total)                                                               \
      61         274 :   COUNTER(downstream_rq_http3_total)                                                               \
      62         274 :   COUNTER(downstream_rq_idle_timeout)                                                              \
      63         274 :   COUNTER(downstream_rq_non_relative_path)                                                         \
      64         274 :   COUNTER(downstream_rq_overload_close)                                                            \
      65         274 :   COUNTER(downstream_rq_redirected_with_normalized_path)                                           \
      66         274 :   COUNTER(downstream_rq_rejected_via_ip_detection)                                                 \
      67         274 :   COUNTER(downstream_rq_response_before_rq_complete)                                               \
      68         274 :   COUNTER(downstream_rq_rx_reset)                                                                  \
      69         274 :   COUNTER(downstream_rq_too_many_premature_resets)                                                 \
      70         274 :   COUNTER(downstream_rq_timeout)                                                                   \
      71         274 :   COUNTER(downstream_rq_header_timeout)                                                            \
      72         274 :   COUNTER(downstream_rq_too_large)                                                                 \
      73         274 :   COUNTER(downstream_rq_total)                                                                     \
      74         274 :   COUNTER(downstream_rq_tx_reset)                                                                  \
      75         274 :   COUNTER(downstream_rq_max_duration_reached)                                                      \
      76         274 :   COUNTER(downstream_rq_ws_on_non_ws_route)                                                        \
      77         274 :   COUNTER(rs_too_large)                                                                            \
      78         274 :   GAUGE(downstream_cx_active, Accumulate)                                                          \
      79         274 :   GAUGE(downstream_cx_http1_active, Accumulate)                                                    \
      80         274 :   GAUGE(downstream_cx_http2_active, Accumulate)                                                    \
      81         274 :   GAUGE(downstream_cx_http3_active, Accumulate)                                                    \
      82         274 :   GAUGE(downstream_cx_rx_bytes_buffered, Accumulate)                                               \
      83         274 :   GAUGE(downstream_cx_ssl_active, Accumulate)                                                      \
      84         274 :   GAUGE(downstream_cx_tx_bytes_buffered, Accumulate)                                               \
      85         274 :   GAUGE(downstream_cx_upgrades_active, Accumulate)                                                 \
      86         274 :   GAUGE(downstream_rq_active, Accumulate)                                                          \
      87         274 :   HISTOGRAM(downstream_cx_length_ms, Milliseconds)                                                 \
      88         274 :   HISTOGRAM(downstream_rq_time, Milliseconds)
      89             : 
      90             : /**
      91             :  * Wrapper struct for connection manager stats. @see stats_macros.h
      92             :  */
      93             : struct ConnectionManagerNamedStats {
      94             :   ALL_HTTP_CONN_MAN_STATS(GENERATE_COUNTER_STRUCT, GENERATE_GAUGE_STRUCT, GENERATE_HISTOGRAM_STRUCT)
      95             : };
      96             : 
      97             : struct ConnectionManagerStats {
      98             :   ConnectionManagerStats(ConnectionManagerNamedStats&& named_stats, const std::string& prefix,
      99             :                          Stats::Scope& scope)
     100             :       : named_(std::move(named_stats)), prefix_(prefix),
     101         310 :         prefix_stat_name_storage_(prefix, scope.symbolTable()), scope_(scope) {}
     102             : 
     103         547 :   Stats::StatName prefixStatName() const { return prefix_stat_name_storage_.statName(); }
     104             : 
     105             :   ConnectionManagerNamedStats named_;
     106             :   std::string prefix_;
     107             :   Stats::StatNameManagedStorage prefix_stat_name_storage_;
     108             :   Stats::Scope& scope_;
     109             : };
     110             : 
     111             : /**
     112             :  * Connection manager tracing specific stats. @see stats_macros.h
     113             :  */
     114             : #define CONN_MAN_TRACING_STATS(COUNTER)                                                            \
     115         274 :   COUNTER(random_sampling)                                                                         \
     116         274 :   COUNTER(service_forced)                                                                          \
     117         274 :   COUNTER(client_enabled)                                                                          \
     118         274 :   COUNTER(not_traceable)                                                                           \
     119         274 :   COUNTER(health_check)
     120             : 
     121             : /**
     122             :  * Wrapper struct for connection manager tracing stats. @see stats_macros.h
     123             :  */
     124             : struct ConnectionManagerTracingStats {
     125             :   CONN_MAN_TRACING_STATS(GENERATE_COUNTER_STRUCT)
     126             : };
     127             : 
     128             : using TracingConnectionManagerConfig = Tracing::ConnectionManagerTracingConfigImpl;
     129             : using TracingConnectionManagerConfigPtr = std::unique_ptr<TracingConnectionManagerConfig>;
     130             : 
     131             : /**
     132             :  * Connection manager per listener stats. @see stats_macros.h
     133             :  */
     134             : #define CONN_MAN_LISTENER_STATS(COUNTER)                                                           \
     135         238 :   COUNTER(downstream_rq_1xx)                                                                       \
     136         238 :   COUNTER(downstream_rq_2xx)                                                                       \
     137         238 :   COUNTER(downstream_rq_3xx)                                                                       \
     138         238 :   COUNTER(downstream_rq_4xx)                                                                       \
     139         238 :   COUNTER(downstream_rq_5xx)                                                                       \
     140         238 :   COUNTER(downstream_rq_completed)
     141             : 
     142             : /**
     143             :  * Wrapper struct for connection manager listener stats. @see stats_macros.h
     144             :  */
     145             : struct ConnectionManagerListenerStats {
     146             :   CONN_MAN_LISTENER_STATS(GENERATE_COUNTER_STRUCT)
     147             : };
     148             : 
     149             : /**
     150             :  * Configuration for how to forward client certs.
     151             :  */
     152             : enum class ForwardClientCertType {
     153             :   ForwardOnly,
     154             :   AppendForward,
     155             :   SanitizeSet,
     156             :   Sanitize,
     157             :   AlwaysForwardOnly
     158             : };
     159             : 
     160             : /**
     161             :  * Configuration for the fields of the client cert, used for populating the current client cert
     162             :  * information to the next hop.
     163             :  */
     164             : enum class ClientCertDetailsType { Cert, Chain, Subject, URI, DNS };
     165             : 
     166             : /**
     167             :  * Type that indicates how port should be stripped from Host header.
     168             :  */
     169             : enum class StripPortType {
     170             :   // Removes the port from host/authority header only if the port matches with the listener port.
     171             :   MatchingHost,
     172             :   // Removes any port from host/authority header.
     173             :   Any,
     174             :   // Keeps the port in host/authority header as is.
     175             :   None
     176             : };
     177             : 
     178             : /**
     179             :  * Configuration for what addresses should be considered internal beyond the defaults.
     180             :  */
     181             : class InternalAddressConfig {
     182             : public:
     183         492 :   virtual ~InternalAddressConfig() = default;
     184             :   virtual bool isInternalAddress(const Network::Address::Instance& address) const PURE;
     185             : };
     186             : 
     187             : /**
     188             :  * Determines if an address is internal based on whether it is an RFC1918 ip address.
     189             :  */
     190             : class DefaultInternalAddressConfig : public Http::InternalAddressConfig {
     191             : public:
     192         201 :   bool isInternalAddress(const Network::Address::Instance& address) const override {
     193         201 :     return Network::Utility::isInternalAddress(address);
     194         201 :   }
     195             : };
     196             : 
     197             : /**
     198             :  * Abstract configuration for the connection manager.
     199             :  */
     200             : class ConnectionManagerConfig {
     201             : public:
     202             :   using HttpConnectionManagerProto =
     203             :       envoy::extensions::filters::network::http_connection_manager::v3::HttpConnectionManager;
     204             : 
     205         492 :   virtual ~ConnectionManagerConfig() = default;
     206             : 
     207             :   /**
     208             :    * @return RequestIDExtensionSharedPtr The request id utilities instance to use.
     209             :    */
     210             :   virtual const RequestIDExtensionSharedPtr& requestIDExtension() PURE;
     211             : 
     212             :   /**
     213             :    *  @return const std::list<AccessLog::InstanceSharedPtr>& the access logs to write to.
     214             :    */
     215             :   virtual const std::list<AccessLog::InstanceSharedPtr>& accessLogs() PURE;
     216             : 
     217             :   /**
     218             :    * @return const absl::optional<std::chrono::milliseconds>& the interval to flush the access logs.
     219             :    */
     220             :   virtual const absl::optional<std::chrono::milliseconds>& accessLogFlushInterval() PURE;
     221             : 
     222             :   // If set to true, access log will be flushed when a new HTTP request is received, after request
     223             :   // headers have been evaluated, and before attempting to establish a connection with the upstream.
     224             :   virtual bool flushAccessLogOnNewRequest() PURE;
     225             : 
     226             :   virtual bool flushAccessLogOnTunnelSuccessfullyEstablished() const PURE;
     227             : 
     228             :   /**
     229             :    * Called to create a codec for the connection manager. This function will be called when the
     230             :    * first byte of application data is received. This is done to support handling of ALPN, protocol
     231             :    * detection, etc.
     232             :    * @param connection supplies the owning connection.
     233             :    * @param data supplies the currently available read data.
     234             :    * @param callbacks supplies the callbacks to install into the codec.
     235             :    * @param overload_manager supplies overload manager that the codec can
     236             :    * integrate with.
     237             :    * @return a codec or nullptr if no codec can be created.
     238             :    */
     239             :   virtual ServerConnectionPtr createCodec(Network::Connection& connection,
     240             :                                           const Buffer::Instance& data,
     241             :                                           ServerConnectionCallbacks& callbacks,
     242             :                                           Server::OverloadManager& overload_manager) PURE;
     243             : 
     244             :   /**
     245             :    * @return DateProvider& the date provider to use for
     246             :    */
     247             :   virtual DateProvider& dateProvider() PURE;
     248             : 
     249             :   /**
     250             :    * @return the time in milliseconds the connection manager will wait between issuing a "shutdown
     251             :    *         notice" to the time it will issue a full GOAWAY and not accept any new streams.
     252             :    */
     253             :   virtual std::chrono::milliseconds drainTimeout() const PURE;
     254             : 
     255             :   /**
     256             :    * @return FilterChainFactory& the HTTP level filter factory to build the connection's filter
     257             :    *         chain.
     258             :    */
     259             :   virtual FilterChainFactory& filterFactory() PURE;
     260             : 
     261             :   /**
     262             :    * @return whether the connection manager will generate a fresh x-request-id if the request does
     263             :    *         not have one.
     264             :    */
     265             :   virtual bool generateRequestId() const PURE;
     266             : 
     267             :   /**
     268             :    * @return whether the x-request-id should not be reset on edge entry inside mesh
     269             :    */
     270             :   virtual bool preserveExternalRequestId() const PURE;
     271             : 
     272             :   /**
     273             :    * @return whether the x-request-id should always be set in the response.
     274             :    */
     275             :   virtual bool alwaysSetRequestIdInResponse() const PURE;
     276             : 
     277             :   /**
     278             :    * @return optional idle timeout for incoming connection manager connections.
     279             :    */
     280             :   virtual absl::optional<std::chrono::milliseconds> idleTimeout() const PURE;
     281             : 
     282             :   /**
     283             :    * @return if the connection manager does routing base on router config, e.g. a Server::Admin impl
     284             :    * has no route config.
     285             :    */
     286             :   virtual bool isRoutable() const PURE;
     287             : 
     288             :   /**
     289             :    * @return optional maximum connection duration timeout for manager connections.
     290             :    */
     291             :   virtual absl::optional<std::chrono::milliseconds> maxConnectionDuration() const PURE;
     292             : 
     293             :   /**
     294             :    * @return maximum request headers size the connection manager will accept.
     295             :    */
     296             :   virtual uint32_t maxRequestHeadersKb() const PURE;
     297             : 
     298             :   /**
     299             :    * @return maximum number of request headers the codecs will accept.
     300             :    */
     301             :   virtual uint32_t maxRequestHeadersCount() const PURE;
     302             : 
     303             :   /**
     304             :    * @return per-stream idle timeout for incoming connection manager connections. Zero indicates a
     305             :    *         disabled idle timeout.
     306             :    */
     307             :   virtual std::chrono::milliseconds streamIdleTimeout() const PURE;
     308             : 
     309             :   /**
     310             :    * @return request timeout for incoming connection manager connections. Zero indicates
     311             :    *         a disabled request timeout.
     312             :    */
     313             :   virtual std::chrono::milliseconds requestTimeout() const PURE;
     314             : 
     315             :   /**
     316             :    * @return request header timeout for incoming connection manager connections. Zero indicates a
     317             :    *         disabled request header timeout.
     318             :    */
     319             :   virtual std::chrono::milliseconds requestHeadersTimeout() const PURE;
     320             : 
     321             :   /**
     322             :    * @return delayed close timeout for downstream HTTP connections. Zero indicates a disabled
     323             :    *         timeout. See http_connection_manager.proto for a detailed description of this timeout.
     324             :    */
     325             :   virtual std::chrono::milliseconds delayedCloseTimeout() const PURE;
     326             : 
     327             :   /**
     328             :    * @return maximum duration time to keep alive stream
     329             :    */
     330             :   virtual absl::optional<std::chrono::milliseconds> maxStreamDuration() const PURE;
     331             : 
     332             :   /**
     333             :    * @return Router::RouteConfigProvider* the configuration provider used to acquire a route
     334             :    *         config for each request flow. Pointer ownership is _not_ transferred to the caller of
     335             :    *         this function. This will return nullptr when scoped routing is enabled.
     336             :    */
     337             :   virtual Router::RouteConfigProvider* routeConfigProvider() PURE;
     338             : 
     339             :   /**
     340             :    * @return Config::ConfigProvider* the configuration provider used to acquire scoped routing
     341             :    * configuration for each request flow. Pointer ownership is _not_ transferred to the caller of
     342             :    * this function. This will return nullptr when scoped routing is not enabled.
     343             :    */
     344             :   virtual Config::ConfigProvider* scopedRouteConfigProvider() PURE;
     345             : 
     346             :   /**
     347             :    * @return OptRef<Router::ScopeKeyBuilder> the scope key builder to calculate the scope key.
     348             :    * This will return nullptr when scoped routing is not enabled.
     349             :    */
     350             :   virtual OptRef<const Router::ScopeKeyBuilder> scopeKeyBuilder() PURE;
     351             : 
     352             :   /**
     353             :    * @return const std::string& the server name to write into responses.
     354             :    */
     355             :   virtual const std::string& serverName() const PURE;
     356             : 
     357             :   /**
     358             :    * @return ServerHeaderTransformation the transformation to apply to Server response headers.
     359             :    */
     360             :   virtual HttpConnectionManagerProto::ServerHeaderTransformation
     361             :   serverHeaderTransformation() const PURE;
     362             : 
     363             :   /**
     364             :    * @return const absl::optional<std::string> the scheme name to write into requests.
     365             :    */
     366             :   virtual const absl::optional<std::string>& schemeToSet() const PURE;
     367             : 
     368             :   /**
     369             :    * @return ConnectionManagerStats& the stats to write to.
     370             :    */
     371             :   virtual ConnectionManagerStats& stats() PURE;
     372             : 
     373             :   /**
     374             :    * @return ConnectionManagerTracingStats& the stats to write to.
     375             :    */
     376             :   virtual ConnectionManagerTracingStats& tracingStats() PURE;
     377             : 
     378             :   /**
     379             :    * @return bool whether to use the remote address for populating XFF, determining internal request
     380             :    *         status, etc. or to assume that XFF will already be populated with the remote address.
     381             :    */
     382             :   virtual bool useRemoteAddress() const PURE;
     383             : 
     384             :   /**
     385             :    * @return InternalAddressConfig configuration for user defined internal addresses.
     386             :    */
     387             :   virtual const InternalAddressConfig& internalAddressConfig() const PURE;
     388             : 
     389             :   /**
     390             :    * @return uint32_t the number of trusted proxy hops in front of this Envoy instance, for
     391             :    *         the purposes of XFF processing.
     392             :    */
     393             :   virtual uint32_t xffNumTrustedHops() const PURE;
     394             : 
     395             :   /**
     396             :    * @return bool don't append the remote address to XFF? This overrides the behavior of
     397             :    *              useRemoteAddress() and may be used when XFF should not be modified but we still
     398             :    *              want to avoid trusting incoming XFF in remote IP determination.
     399             :    */
     400             :   virtual bool skipXffAppend() const PURE;
     401             : 
     402             :   /**
     403             :    * @return const absl::optional<std::string>& value of via header to add to requests and response
     404             :    *                                            headers if set.
     405             :    */
     406             :   virtual const std::string& via() const PURE;
     407             : 
     408             :   /**
     409             :    * @return ForwardClientCertType the configuration of how to forward the client cert information.
     410             :    */
     411             :   virtual ForwardClientCertType forwardClientCert() const PURE;
     412             : 
     413             :   /**
     414             :    * @return vector of ClientCertDetailsType the configuration of the current client cert's details
     415             :    * to be forwarded.
     416             :    */
     417             :   virtual const std::vector<ClientCertDetailsType>& setCurrentClientCertDetails() const PURE;
     418             : 
     419             :   /**
     420             :    * @return local address.
     421             :    * Gives richer information in case of internal requests.
     422             :    */
     423             :   virtual const Network::Address::Instance& localAddress() PURE;
     424             : 
     425             :   /**
     426             :    * @return custom user agent for internal requests for better debugging. Must be configured to
     427             :    *         be enabled. User agent will only overwritten if it doesn't already exist. If enabled,
     428             :    *         the same user agent will be written to the x-envoy-downstream-service-cluster header.
     429             :    */
     430             :   virtual const absl::optional<std::string>& userAgent() PURE;
     431             : 
     432             :   /**
     433             :    *  @return TracerSharedPtr Tracer to use.
     434             :    */
     435             :   virtual Tracing::TracerSharedPtr tracer() PURE;
     436             : 
     437             :   /**
     438             :    * @return tracing config.
     439             :    */
     440             :   virtual const TracingConnectionManagerConfig* tracingConfig() PURE;
     441             : 
     442             :   /**
     443             :    * @return ConnectionManagerListenerStats& the stats to write to.
     444             :    */
     445             :   virtual ConnectionManagerListenerStats& listenerStats() PURE;
     446             : 
     447             :   /**
     448             :    * @return bool supplies if the HttpConnectionManager should proxy the Expect: 100-Continue
     449             :    */
     450             :   virtual bool proxy100Continue() const PURE;
     451             : 
     452             :   /**
     453             :    * @return bool supplies if the HttpConnectionManager should handle invalid HTTP with a stream
     454             :    * error or connection error.
     455             :    */
     456             :   virtual bool streamErrorOnInvalidHttpMessaging() const PURE;
     457             : 
     458             :   /**
     459             :    * @return supplies the http1 settings.
     460             :    */
     461             :   virtual const Http::Http1Settings& http1Settings() const PURE;
     462             : 
     463             :   /**
     464             :    * @return if the HttpConnectionManager should normalize url following RFC3986
     465             :    */
     466             :   virtual bool shouldNormalizePath() const PURE;
     467             : 
     468             :   /**
     469             :    * @return if the HttpConnectionManager should merge two or more adjacent slashes in the path into
     470             :    * one.
     471             :    */
     472             :   virtual bool shouldMergeSlashes() const PURE;
     473             : 
     474             :   /**
     475             :    * @return port strip type from host/authority header.
     476             :    */
     477             :   virtual StripPortType stripPortType() const PURE;
     478             : 
     479             :   /**
     480             :    * @return the action HttpConnectionManager should take when receiving client request
     481             :    * headers containing underscore characters.
     482             :    */
     483             :   virtual envoy::config::core::v3::HttpProtocolOptions::HeadersWithUnderscoresAction
     484             :   headersWithUnderscoresAction() const PURE;
     485             : 
     486             :   /**
     487             :    * @return LocalReply configuration which supplies mapping for local reply generated by Envoy.
     488             :    */
     489             :   virtual const LocalReply::LocalReply& localReply() const PURE;
     490             : 
     491             :   /**
     492             :    * @return the action HttpConnectionManager should take when receiving client request
     493             :    * with URI path containing %2F, %2f, %5c or %5C sequences.
     494             :    */
     495             :   virtual envoy::extensions::filters::network::http_connection_manager::v3::HttpConnectionManager::
     496             :       PathWithEscapedSlashesAction
     497             :       pathWithEscapedSlashesAction() const PURE;
     498             : 
     499             :   /**
     500             :    * @return vector of OriginalIPDetectionSharedPtr original IP detection extensions.
     501             :    */
     502             :   virtual const std::vector<OriginalIPDetectionSharedPtr>&
     503             :   originalIpDetectionExtensions() const PURE;
     504             : 
     505             :   virtual const std::vector<EarlyHeaderMutationPtr>& earlyHeaderMutationExtensions() const PURE;
     506             : 
     507             :   /**
     508             :    * @return if the HttpConnectionManager should remove trailing host dot from host/authority
     509             :    * header.
     510             :    */
     511             :   virtual bool shouldStripTrailingHostDot() const PURE;
     512             :   /**
     513             :    * @return maximum requests for downstream.
     514             :    */
     515             :   virtual uint64_t maxRequestsPerConnection() const PURE;
     516             :   /**
     517             :    * @return the config describing if/how to write the Proxy-Status HTTP response header.
     518             :    * If nullptr, don't write the Proxy-Status HTTP response header.
     519             :    */
     520             :   virtual const HttpConnectionManagerProto::ProxyStatusConfig* proxyStatusConfig() const PURE;
     521             : 
     522             :   /**
     523             :    * Creates new header validator. This method always returns nullptr unless the `ENVOY_ENABLE_UHV`
     524             :    * pre-processor variable is defined.
     525             :    * @param protocol HTTP protocol version that is to be validated.
     526             :    * @return pointer to the header validator.
     527             :    *         If nullptr, header validation will not be done.
     528             :    */
     529             :   virtual ServerHeaderValidatorPtr makeHeaderValidator(Protocol protocol) PURE;
     530             : 
     531             :   /**
     532             :    * @return whether to append the x-forwarded-port header.
     533             :    */
     534             :   virtual bool appendXForwardedPort() const PURE;
     535             : 
     536             :   /**
     537             :    * @return whether the HCM will insert ProxyProtocolFilterState into the filter state at the
     538             :    *         Connection Lifetime.
     539             :    */
     540             :   virtual bool addProxyProtocolConnectionState() const PURE;
     541             : };
     542             : } // namespace Http
     543             : } // namespace Envoy