wasm: add config setting to control StopIteration behavior by mpwarres · Pull Request #40213 · envoyproxy/envoy

mpwarres · 2025-07-12T02:04:38Z

Commit Message:

Add PluginConfig.allow_on_headers_stop_iteration config field to control the behavior of WasmFilter when plugin onRequestHeaders and onResponseHeaders callbacks return a value of FilterHeadersStatus::StopIteration.

If allow_on_headers_stop_iteration is false (the default), then in cases where a Wasm plugin onRequestHeaders or onResponseHeaders callback returns FilterHeadersStatus::StopIteration, WasmFilter will maintain its current behavior of translating that response code to FilterHeadersStatus::StopAllIterationAndWatermark.

If allow_on_headers_stop_iteration is true, then WasmFilter will avoid any translation of FilterHeadersStatus::StopIteration, and will pass it through to HCM unmodified, which allows Wasm plugins to inspect request or response body data before deciding how to handle/transform request or response headers.

For details, see Envoy Wasm / Proxy-Wasm support for FilterHeadersStatus::StopIteration. This PR implements Option B: WasmFilter config knob, building on proxy-wasm/proxy-wasm-cpp-host#434.

Note that this config knob is a stopgap until upcoming v0.3.0 of the Proxy-Wasm ABI adds more comprehensive support for StopIteration and body buffering, per proxy-wasm/spec#63.

Additional Description:

This change updates the proxy-wasm-cpp-host dependency since it depends on proxy-wasm/proxy-wasm-cpp-host#434, which was recently merged there.

Risk Level:

Low: default behavior is unchanged.

Testing:

Updated WasmFilter tests to exercise new functionality.

Docs Changes:

Added field documentation.

Release Notes:

Added changelog entry.

Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

Add PluginConfig.allow_on_headers_stop_iteration config field to control the behavior of WasmFilter when plugin onRequestHeaders and onResponseHeaders callbacks return a value of FilterHeadersStatus::StopIteration. Signed-off-by: Michael Warres <mpw@google.com>

repokitteh-read-only · 2025-07-12T02:04:51Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @wbpcode
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).
CC @envoyproxy/dependency-shepherds: Your approval is needed for changes made to (bazel/.*repos.*\.bzl)|(bazel/dependency_imports\.bzl)|(api/bazel/.*\.bzl)|(.*/requirements\.txt)|(.*\.patch).
envoyproxy/dependency-shepherds assignee is @phlax

🐱

Caused by: #40213 was opened by mpwarres.

see: more, trace.

Signed-off-by: Michael Warres <mpw@google.com>

… behavior (#434) Add protected ContextBase::allow_on_headers_stop_iteration_ field that can be used by host implementations to control whether or not ContextBase propagates FilterHeaderStatus::StopIteration returned by onRequestHeaders() or onResponseHeaders() without modification. Follow-on envoyproxy/envoy#40213 adds an option in Envoy WasmFilter PluginConfig that sets the value of this field. For details, see [Envoy Wasm / Proxy-Wasm support for FilterHeadersStatus::StopIteration](https://docs.google.com/document/d/1Whd1C0k-H2NHrPOmlAqqauFz6ObSTP017juJIYyciB0/edit?usp=sharing). This PR is one part of implementing [Option B: WasmFilter config knob](https://docs.google.com/document/d/1Whd1C0k-H2NHrPOmlAqqauFz6ObSTP017juJIYyciB0/edit?tab=t.0#bookmark=id.5wxldlapsp54). Note that default behavior of proxy-wasm-cpp-host and ContextBase is unchanged. --------- Signed-off-by: Michael Warres <mpw@google.com>

Signed-off-by: Michael Warres <mpw@google.com>

api/envoy/extensions/wasm/v3/wasm.proto

Signed-off-by: Michael Warres <mpw@google.com>

kyessenov

Please hide this field since it's going to be deprecated shortly. I think this should be in the release if possible.

For 0.3.0 onwards, do we need to worry about breaking the host somehow? The state machine becomes quite complicated once you allow stop-headers, continue-body.

Signed-off-by: Michael Warres <mpw@google.com>

phlax

/lgtm deps

wbpcode

/lgtm Thanks for the contribution.

repokitteh-read-only · 2025-07-15T02:07:25Z

please specify a single label can be specified

🐱

Caused by: a #40213 (review) was submitted by @wbpcode.

see: more, trace.

mpwarres · 2025-07-15T03:18:49Z

Thanks for the reviews!

… behavior (proxy-wasm#434) Add protected ContextBase::allow_on_headers_stop_iteration_ field that can be used by host implementations to control whether or not ContextBase propagates FilterHeaderStatus::StopIteration returned by onRequestHeaders() or onResponseHeaders() without modification. Follow-on envoyproxy/envoy#40213 adds an option in Envoy WasmFilter PluginConfig that sets the value of this field. For details, see [Envoy Wasm / Proxy-Wasm support for FilterHeadersStatus::StopIteration](https://docs.google.com/document/d/1Whd1C0k-H2NHrPOmlAqqauFz6ObSTP017juJIYyciB0/edit?usp=sharing). This PR is one part of implementing [Option B: WasmFilter config knob](https://docs.google.com/document/d/1Whd1C0k-H2NHrPOmlAqqauFz6ObSTP017juJIYyciB0/edit?tab=t.0#bookmark=id.5wxldlapsp54). Note that default behavior of proxy-wasm-cpp-host and ContextBase is unchanged. --------- Change-Id: I3dfe6cb850ec8e28ff69c0e07474affa4f80005c Co-developed-by: Cursor <noreply@cursor.com> Signed-off-by: Michael Warres <mpw@google.com>

… behavior (proxy-wasm#434) (#11) * fix: CI branch name master -> main (proxy-wasm#398) Signed-off-by: Martijn Stevenson <mstevenson@google.com> * fix: Bump Abseil to fix Linux build issues (proxy-wasm#400) Bump Abseil to fix Linux build issues Pick up this fix: abseil/abseil-cpp#1187 Bump past Envoy to pick up another fix found in fuzz tests: proxy-wasm#399 (comment) Signed-off-by: Martijn Stevenson <mstevenson@google.com> * fix: Update cargo-raze -> crate_universe (proxy-wasm#399) - Updated platforms for crate_universe compatibility - Supports upgrade to wasmsign2 - Includes workaround for Windows path length issue Signed-off-by: Martijn Stevenson <mstevenson@google.com> * fix: Move from unavailable macos-11 to macos-13 (proxy-wasm#401) See: https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#supported-runners-and-hardware-resources This does not fix proxy-wasm#384, but does resurface those errors. Signed-off-by: Martijn Stevenson <mstevenson@google.com> * chore: bump Bazel from 5.2.0 to 6.5.0 (proxy-wasm#402) Bump Bazel from 5.2.0 to 6.5.0 This breaks the s390x build which relied on an external Docker image. I made some strides in fixing s390x, but it's not yet working. Deferred to proxy-wasm#405. Signed-off-by: Martijn Stevenson <mstevenson@google.com> * chore: bump rules_python and rules_fuzzing (proxy-wasm#404) Upgrade rules_python (0.34.0) and rules_fuzzing (0.5.2) This requires extracting WORKSPACE phases into more phases: - dependencies -- py_repositories() and toolchains - dependencies_python() -- pip_parse module loading - dependencies_import() -- python/fuzzing/other deps The new structure roughly matches Envoy WORKSPACE: - envoy_dependencies() - envoy_dependencies_extra() -- not needed here - envoy_python_dependencies() - envoy_dependency_imports() Signed-off-by: Martijn Stevenson <mstevenson@google.com> * Update CI to use Ubuntu 22.04 / clang 14 (proxy-wasm#408) Signed-off-by: Martijn Stevenson <mstevenson@google.com> * Update rules_rust to v0.42.1 (with Rust v1.77.2). (proxy-wasm#410) * Update rules_rust * Update rust and vendor * rust_oom -> rg_oom * Change rust version --------- Signed-off-by: Keith Mattix II <keithmattix@microsoft.com> * Update wasmtime (v24.0.0) (proxy-wasm#406) Removes Wasmtime + Windows CI because rules_rust has recently dropped Windows: https://github.com/bazelbuild/rules_rust/blob/main/docs/index.md#supported-platforms Signed-off-by: Keith Mattix II <keithmattix@microsoft.com> * fix: Upgrade deprecated artifact upload/download handlers (proxy-wasm#415) Seen on proxy-wasm#380 CI: Error: This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v2`. Learn more: https://github.blog/changelog/2024-02-13-deprecation-notice-v1-and-v2-of-the-artifact-actions/ Signed-off-by: Martijn Stevenson <mstevenson@google.com> * bump wamr to 2.1.1 and able to consume precompiled content (proxy-wasm#380) - skip leading paddings in .aot section Signed-off-by: liang.he@intel.com <liang.he@intel.com> * compdb add the compdb support to the proxy_wasm_cpp_host (proxy-wasm#419) * compdb add the compdb support to the proxy_wasm_cpp_host Signed-off-by: wangbaiping <wbphub@gmail.com> * Fix references to prefix_wasm_api (proxy-wasm#420) Signed-off-by: Keith Mattix II <keithmattix@microsoft.com> * feat(go-sdk): add wasi hostcalls used by the Go SDK (proxy-wasm#427) The full Go sdk imports hostcalls not currently exported to the wasm module, making the wasm module fail on instantiation. Per discussion with the Go core maintainers, these functions do not need to be implemented, but they must be present. Signed-off-by: Matt Leon <mattleon@google.com> * chore: workflow runner fixes (proxy-wasm#436) Assorted changes to get workflows working again: - Update format workflows to use ubuntu-22.04 - Update windows-2019 to windows-2022 and add a missing <string> include needed to build with that - Enable manual triggering of workflows Fixes proxy-wasm#435 --------- Signed-off-by: Michael Warres <mpw@google.com> * feat: add knob to customise on{Request,Response}Headers StopIteration behavior (proxy-wasm#434) Add protected ContextBase::allow_on_headers_stop_iteration_ field that can be used by host implementations to control whether or not ContextBase propagates FilterHeaderStatus::StopIteration returned by onRequestHeaders() or onResponseHeaders() without modification. Follow-on envoyproxy/envoy#40213 adds an option in Envoy WasmFilter PluginConfig that sets the value of this field. For details, see [Envoy Wasm / Proxy-Wasm support for FilterHeadersStatus::StopIteration](https://docs.google.com/document/d/1Whd1C0k-H2NHrPOmlAqqauFz6ObSTP017juJIYyciB0/edit?usp=sharing). This PR is one part of implementing [Option B: WasmFilter config knob](https://docs.google.com/document/d/1Whd1C0k-H2NHrPOmlAqqauFz6ObSTP017juJIYyciB0/edit?tab=t.0#bookmark=id.5wxldlapsp54). Note that default behavior of proxy-wasm-cpp-host and ContextBase is unchanged. --------- Signed-off-by: Michael Warres <mpw@google.com> --------- Signed-off-by: Martijn Stevenson <mstevenson@google.com> Signed-off-by: Keith Mattix II <keithmattix@microsoft.com> Signed-off-by: liang.he@intel.com <liang.he@intel.com> Signed-off-by: wangbaiping <wbphub@gmail.com> Signed-off-by: Matt Leon <mattleon@google.com> Signed-off-by: Michael Warres <mpw@google.com> Co-authored-by: martijneken <mstevenson@google.com> Co-authored-by: Keith Mattix II <keithmattix2@gmail.com> Co-authored-by: Keith Mattix II <keithmattix@microsoft.com> Co-authored-by: liang.he <liang.he@intel.com> Co-authored-by: code <wbphub@gmail.com> Co-authored-by: Matt Leon <ml@mattleon.com> Co-authored-by: Michael Warres <mpw@google.com>

mpwarres requested a review from kyessenov as a code owner July 12, 2025 02:04

repokitteh-read-only bot added api deps Approval required for changes to Envoy's external dependencies labels Jul 12, 2025

repokitteh-read-only bot assigned wbpcode and phlax Jul 12, 2025

mpwarres added 2 commits July 12, 2025 15:53

run ./ci/do_ci.sh format

2845fc5

Signed-off-by: Michael Warres <mpw@google.com>

fix release_dates mismatch

fe3e66e

Signed-off-by: Michael Warres <mpw@google.com>

mpwarres mentioned this pull request Jul 13, 2025

feat: add knob to customise on{Request,Response}Headers StopIteration behavior proxy-wasm/proxy-wasm-cpp-host#434

Merged

mpwarres added 3 commits July 13, 2025 04:41

Merge branch 'main' into wasm-allow-on-headers-stop-iteration

c5aecb4

Signed-off-by: Michael Warres <mpw@google.com>

update proxy-wasm-cpp-host dependency to point to main branch

9239096

Signed-off-by: Michael Warres <mpw@google.com>

fix proxy-wasm-cpp-host release_date

8b8c174

Signed-off-by: Michael Warres <mpw@google.com>

wbpcode reviewed Jul 14, 2025

View reviewed changes

api/envoy/extensions/wasm/v3/wasm.proto Outdated Show resolved Hide resolved

repokitteh-read-only bot added the waiting label Jul 14, 2025

Merge branch 'main' into wasm-allow-on-headers-stop-iteration

241e2f9

Signed-off-by: Michael Warres <mpw@google.com>

kyessenov previously approved these changes Jul 14, 2025

View reviewed changes

address code review comments and add changelog note

3e9cc54

Signed-off-by: Michael Warres <mpw@google.com>

mpwarres dismissed kyessenov’s stale review via 3e9cc54 July 14, 2025 18:22

repokitteh-read-only bot removed the waiting label Jul 14, 2025

kyessenov approved these changes Jul 14, 2025

View reviewed changes

phlax approved these changes Jul 14, 2025

View reviewed changes

repokitteh-read-only bot removed the deps Approval required for changes to Envoy's external dependencies label Jul 14, 2025

wbpcode approved these changes Jul 15, 2025

View reviewed changes

repokitteh-read-only bot removed the api label Jul 15, 2025

phlax merged commit 274d68f into envoyproxy:main Jul 15, 2025
26 checks passed

botengyao mentioned this pull request Jul 16, 2025

Proposal: Envoy Support for Model Context Protocol (MCP) #39174

Open

huang195 mentioned this pull request Jul 19, 2025

Docker build doesn't work on macOS with Docker Desktop #40270

Closed

huang195 mentioned this pull request Jul 28, 2025

Adding AllowOnHeadersStopIteration field to EnvoyExtensionPolicy CRD to reflect upstream changes envoyproxy/gateway#6617

Open

alexsnaps mentioned this pull request Sep 29, 2025

delay ratelimit action when we need to eval requestBody Kuadrant/wasm-shim#221

Closed

eguzki mentioned this pull request Oct 1, 2025

Rate limiting at request body phase Kuadrant/wasm-shim#226

Open

zhaohuabing mentioned this pull request Mar 16, 2026

Support allowOnHeadersStopIteration in EnvoyExtensionPolicy Wasm spec envoyproxy/gateway#8382

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

wasm: add config setting to control StopIteration behavior#40213

wasm: add config setting to control StopIteration behavior#40213
phlax merged 8 commits intoenvoyproxy:mainfrom
mpwarres:wasm-allow-on-headers-stop-iteration

mpwarres commented Jul 12, 2025 •

edited

Loading

Uh oh!

repokitteh-read-only bot commented Jul 12, 2025

Uh oh!

Uh oh!

kyessenov left a comment

Uh oh!

phlax left a comment

Uh oh!

wbpcode left a comment

Uh oh!

repokitteh-read-only bot commented Jul 15, 2025

Uh oh!

mpwarres commented Jul 15, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

mpwarres commented Jul 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

repokitteh-read-only bot commented Jul 12, 2025

Uh oh!

Uh oh!

kyessenov left a comment

Choose a reason for hiding this comment

Uh oh!

phlax left a comment

Choose a reason for hiding this comment

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

repokitteh-read-only bot commented Jul 15, 2025

Uh oh!

mpwarres commented Jul 15, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mpwarres commented Jul 12, 2025 •

edited

Loading