tree 5f7ee94a7e285889f2791277f399fe0f6cc84c5b
parent c197d7d724face21a64c29575f94aef2e1b40e20
author jprat <jprat@google.com> 1787674530 -0700
committer Copybara-Service <copybara-worker@google.com> 1787674566 -0700

Add `unknown_transfer_encoding` and `multiple_transfer_encoding_keys` defects and integration tests for `validate_transfer_encoding` flag.

Verifies the behavior of invalid `Transfer-Encoding` headers (multiple headers, unknown encodings, and identity encoding) under the `balsa_validate_transfer_encoding` flag.

**Invalid Requests (Multiple TE Keys / Unknown TE Value):**
Ensures that requests with multiple Transfer-Encoding keys or unknown values are handled correctly.
- Guard is ON: Rejection happens early in BalsaFrame (`400 Bad Request`) with details `http1.codec_error`.
- Guard is OFF: Request bypasses Balsa's strict check, but is caught and rejected later by Envoy's core codec (`400 Bad Request`) with details `http1.invalid_transfer_encoding`.
- Note on Defects: The newly added defects are NOT exported to Access Logs in either case because Balsa's early bailout prevents the visitor callbacks that copy defects to FilterState.

**Identity Transfer Encoding:**
Ensures that `Transfer-Encoding: identity` is allowed by BalsaFrame but ultimately rejected by Envoy's core codec as an invalid transfer encoding (`400 Bad Request`) regardless of Guard state as Envoy only allows `chunked` as the valid `Transfer-Encoding` value.

**Invalid Responses (Multiple TE Keys / Unknown TE Value):**
Ensures that responses from backends/upstreams with multiple TE keys or unknown values are handled correctly.
- Guard is ON: Response is rejected with `502` by BalsaFrame.
- Guard is OFF: Response is allowed by BalsaFrame early check, but Envoy core codec handles validation and rejects it later (`502`).

PiperOrigin-RevId: 970595413