grpc/grpc-java · error · ResourceInvalidException

FilterChain ${filterChainName} contains filter ${l4Filter.ge

Error message

FilterChain ${filterChainName} contains filter ${l4Filter.getName()} with unsupported typed_config type ${any.getTypeUrl()}

What it means

This message is thrown when the single filter's typed_config has a valid-looking type_url but the Any payload cannot be unpacked into an HttpConnectionManager protobuf - the serialized bytes are corrupt, truncated, or of a different message shape than the type_url claims. The ResourceInvalidException wraps the InvalidProtocolBufferException.

Source

Thrown at xds/src/main/java/io/grpc/xds/XdsListenerResource.java:253

    io.envoyproxy.envoy.config.listener.v3.Filter l4Filter = proto.getFiltersList().get(0);
    if (!l4Filter.hasTypedConfig()) {
      throw new ResourceInvalidException(
          "FilterChain " + filterChainName + " contains filter " + l4Filter.getName()
              + " without typed_config");
    }
    Any any = l4Filter.getTypedConfig();
    if (!any.getTypeUrl().equals(TYPE_URL_HTTP_CONNECTION_MANAGER)) {
      throw new ResourceInvalidException(
          "FilterChain " + filterChainName + " contains filter " + l4Filter.getName()
              + " with unsupported typed_config type " + any.getTypeUrl());
    }

    // Parse HCM.
    HttpConnectionManager hcmProto;
    try {
      hcmProto = any.unpack(HttpConnectionManager.class);
    } catch (InvalidProtocolBufferException e) {
      throw new ResourceInvalidException("FilterChain " + filterChainName + " with filter "
          + l4Filter.getName() + " failed to unpack message", e);
    }
    io.grpc.xds.HttpConnectionManager httpConnectionManager = parseHttpConnectionManager(
        hcmProto, filterRegistry, false /* isForClient */, args);

    // Parse Transport Socket.
    EnvoyServerProtoData.DownstreamTlsContext downstreamTlsContext = null;
    if (proto.hasTransportSocket()) {
      if (!TRANSPORT_SOCKET_NAME_TLS.equals(proto.getTransportSocket().getName())) {
        throw new ResourceInvalidException("transport-socket with name "
            + proto.getTransportSocket().getName() + " not supported.");
      }
      DownstreamTlsContext downstreamTlsContextProto;
      try {
        downstreamTlsContextProto =
            proto.getTransportSocket().getTypedConfig().unpack(DownstreamTlsContext.class);
      } catch (InvalidProtocolBufferException e) {
        throw new ResourceInvalidException("FilterChain " + filterChainName

View on GitHub (pinned to 64daddc1f3)

Solutions

Regenerate the typed_config so the bytes are a correctly serialized v3 HttpConnectionManager matching the type_url
Verify with a protobuf decoder (protoc --decode) that the Any payload parses as HttpConnectionManager
Align the management server's Envoy API versions with the gRPC xDS library's expected v3 schemas

Example fix

// before
Any any = Any.pack(v2Hcm); // v2 message under v3 type_url
// after
Any any = Any.pack(v3HttpConnectionManager);

Defensive patterns

Strategy: try-catch

Validate before calling

if (fc.getFiltersCount() == 1 && fc.getFilters(0).hasTypedConfig()
    && !fc.getFilters(0).getTypedConfig().getTypeUrl()
        .endsWith("v3.HttpConnectionManager")) {
  throw new IllegalArgumentException("Expected v3 HCM type_url");
}

Try / catch

try {
  listener = XdsListenerResource.parseServerSideListener(proto, ...);
} catch (ResourceInvalidException e) {
  if (e.getMessage().contains("failed to unpack message")) {
    logger.warn("HCM typed_config bytes are corrupt or version-mismatched", e);
  }
}

Prevention

Ensure type_url and serialized message version always match (v3)
Round-trip test management-server output through the same proto library
Reject resources in CI whose Any payloads fail protoc --decode

When it happens

Trigger: any.unpack(HttpConnectionManager.class) throws InvalidProtocolBufferException inside parseFilterChain because the typed_config bytes do not deserialize as the v3 HttpConnectionManager message.

Common situations: Type_url/bytes mismatch after control-plane proto upgrades (v2 bytes under v3 URL); corrupted Any payloads from custom marshaling; management server bugs emitting malformed Any.

Understand the failure class

Background: "cannot parse invalid wire-format data", "cannot unmarshal", "failed unmarshalling": protobuf unmarshal errors explained — this error's family across 10 libraries.

Related errors

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/a60a44edf9335a84. Report an issue: GitHub.