{"record":{"id":"3d66492a8209bc1d","repo":"grpc/grpc-java","slug":"httpconnectionmanager-with-original-ip-detection-e","errorCode":null,"errorMessage":"HttpConnectionManager with original_ip_detection_extensions unsupported","messagePattern":"HttpConnectionManager with original_ip_detection_extensions unsupported","errorType":"exception","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsListenerResource.java","lineNumber":503,"sourceCode":"        prefixRanges.build(),\n        ImmutableList.copyOf(proto.getApplicationProtocolsList()),\n        sourcePrefixRanges.build(),\n        sourceType,\n        ImmutableList.copyOf(proto.getSourcePortsList()),\n        ImmutableList.copyOf(proto.getServerNamesList()),\n        proto.getTransportProtocol());\n  }\n\n  @VisibleForTesting\n  static io.grpc.xds.HttpConnectionManager parseHttpConnectionManager(\n      HttpConnectionManager proto, FilterRegistry filterRegistry,\n      boolean isForClient, XdsResourceType.Args args) throws ResourceInvalidException {\n    if (proto.getXffNumTrustedHops() != 0) {\n      throw new ResourceInvalidException(\n          \"HttpConnectionManager with xff_num_trusted_hops unsupported\");\n    }\n    if (!proto.getOriginalIpDetectionExtensionsList().isEmpty()) {\n      throw new ResourceInvalidException(\"HttpConnectionManager with \"\n          + \"original_ip_detection_extensions unsupported\");\n    }\n    // Obtain max_stream_duration from Http Protocol Options.\n    long maxStreamDuration = 0;\n    if (proto.hasCommonHttpProtocolOptions()) {\n      HttpProtocolOptions options = proto.getCommonHttpProtocolOptions();\n      if (options.hasMaxStreamDuration()) {\n        maxStreamDuration = Durations.toNanos(options.getMaxStreamDuration());\n      }\n    }\n\n    // Parse http filters.\n    if (proto.getHttpFiltersList().isEmpty()) {\n      throw new ResourceInvalidException(\"Missing HttpFilter in HttpConnectionManager.\");\n    }\n    List<Filter.NamedFilterConfig> filterConfigs = new ArrayList<>();\n    Set<String> names = new HashSet<>();\n    for (int i = 0; i < proto.getHttpFiltersCount(); i++) {","sourceCodeStart":485,"sourceCodeEnd":521,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsListenerResource.java#L485-L521","documentation":"gRPC xDS does not support original_ip_detection_extensions on the HttpConnectionManager (custom IP detection via extension filters). Any non-empty list makes the resource invalid and XdsListenerResource throws ResourceInvalidException, NACKing the Listener.","triggerScenarios":"Listener's http_connection_manager has one or more entries in original_ip_detection_extensions, checked immediately after the xff_num_trusted_hops check in parseHttpConnectionManager.","commonSituations":"Envoy configs using custom header/IP detection extensions (e.g. for geo routing) reused as gRPC xDS listener resources, or control-plane generators that always emit detection extensions for cloud load balancer setups.","solutions":["Remove original_ip_detection_extensions from the http_connection_manager.","Perform custom client IP detection at the Envoy proxy layer rather than in resources consumed by gRPC.","Upgrade gRPC and check release notes in case support for this field was added."],"exampleFix":"// before\nhttp_connection_manager:\n  original_ip_detection_extensions: [{ name: envoy.http.original_ip_detection.custom_header }]\n// after\nhttp_connection_manager: {}","handlingStrategy":"validation","validationCode":"if (!hcm.getOriginalIpDetectionExtensionsList().isEmpty()) {\n  throw new IllegalArgumentException(\"original_ip_detection_extensions unsupported by grpc xds\");\n}","typeGuard":null,"tryCatchPattern":"try { applyResource(listener) } catch (ResourceInvalidException e) { if (e.getMessage().contains(\"original_ip_detection_extensions\")) resubmitWithoutExtensions(); }","preventionTips":["Omit original_ip_detection_extensions in gRPC-consumed HCMs","Do client IP detection at the upstream proxy instead","Add config linters that reject Envoy-only HCM fields for gRPC resources"],"tags":["grpc","xds","http","unsupported-feature"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}