http: migrate grpc_stats/jwt_authn/... to exception free

source/extensions/filters/http/grpc_stats/grpc_stats_filter.cc

@@ -314,7 +314,8 @@ class GrpcStatsFilter : public Http::PassThroughFilter {
 
 } // namespace
 
-Http::FilterFactoryCb GrpcStatsFilterConfigFactory::createFilterFactoryFromProtoTyped(
+absl::StatusOr<Http::FilterFactoryCb>
+GrpcStatsFilterConfigFactory::createFilterFactoryFromProtoTyped(
     const envoy::extensions::filters::http::grpc_stats::v3::FilterConfig& proto_config,
     const std::string&, Server::Configuration::FactoryContext& factory_context) {
 

source/extensions/filters/http/grpc_stats/grpc_stats_filter.h

@@ -30,12 +30,13 @@ struct GrpcStatsObject : public StreamInfo::FilterState::Object {
 };
 
 class GrpcStatsFilterConfigFactory
-    : public Common::FactoryBase<envoy::extensions::filters::http::grpc_stats::v3::FilterConfig> {
+    : public Common::ExceptionFreeFactoryBase<
+          envoy::extensions::filters::http::grpc_stats::v3::FilterConfig> {
 public:
-  GrpcStatsFilterConfigFactory() : FactoryBase("envoy.filters.http.grpc_stats") {}
+  GrpcStatsFilterConfigFactory() : ExceptionFreeFactoryBase("envoy.filters.http.grpc_stats") {}
 
 private:
-  Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
+  absl::StatusOr<Http::FilterFactoryCb> createFilterFactoryFromProtoTyped(
       const envoy::extensions::filters::http::grpc_stats::v3::FilterConfig& proto_config,
       const std::string&, Server::Configuration::FactoryContext&) override;
 };

source/extensions/filters/http/grpc_web/config.cc

@@ -9,7 +9,7 @@ namespace Extensions {
 namespace HttpFilters {
 namespace GrpcWeb {
 
-Http::FilterFactoryCb GrpcWebFilterConfig::createFilterFactoryFromProtoTyped(
+absl::StatusOr<Http::FilterFactoryCb> GrpcWebFilterConfig::createFilterFactoryFromProtoTyped(
     const envoy::extensions::filters::http::grpc_web::v3::GrpcWeb&, const std::string&,
     Server::Configuration::FactoryContext& factory_context) {
   return [&factory_context](Http::FilterChainFactoryCallbacks& callbacks) {

source/extensions/filters/http/grpc_web/config.h

@@ -10,13 +10,13 @@ namespace Extensions {
 namespace HttpFilters {
 namespace GrpcWeb {
 
-class GrpcWebFilterConfig
-    : public Common::FactoryBase<envoy::extensions::filters::http::grpc_web::v3::GrpcWeb> {
+class GrpcWebFilterConfig : public Common::ExceptionFreeFactoryBase<
+                                envoy::extensions::filters::http::grpc_web::v3::GrpcWeb> {
 public:
-  GrpcWebFilterConfig() : FactoryBase("envoy.filters.http.grpc_web") {}
+  GrpcWebFilterConfig() : ExceptionFreeFactoryBase("envoy.filters.http.grpc_web") {}
 
 private:
-  Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
+  absl::StatusOr<Http::FilterFactoryCb> createFilterFactoryFromProtoTyped(
       const envoy::extensions::filters::http::grpc_web::v3::GrpcWeb& proto_config,
       const std::string& stats_prefix,
       Server::Configuration::FactoryContext& factory_context) override;

source/extensions/filters/http/health_check/config.cc

@@ -15,7 +15,7 @@ namespace Extensions {
 namespace HttpFilters {
 namespace HealthCheck {
 
-Http::FilterFactoryCb HealthCheckFilterConfig::createFilterFactoryHelper(
+absl::StatusOr<Http::FilterFactoryCb> HealthCheckFilterConfig::createFilterFactoryHelper(
     const envoy::extensions::filters::http::health_check::v3::HealthCheck& proto_config,
     const std::string& stats_prefix, Server::Configuration::ServerFactoryContext& context,
     Stats::Scope& scope) {
@@ -30,7 +30,8 @@ Http::FilterFactoryCb HealthCheckFilterConfig::createFilterFactoryHelper(
   *header_match_data = Http::HeaderUtility::buildHeaderDataVector(proto_config.headers(), context);
 
   if (!pass_through_mode && cache_time_ms) {
-    throw EnvoyException("cache_time_ms must not be set when path_through_mode is disabled");
+    return absl::InvalidArgumentError(
+        "cache_time_ms must not be set when path_through_mode is disabled");
   }
 
   HealthCheckCacheManagerSharedPtr cache_manager;
@@ -44,7 +45,7 @@ Http::FilterFactoryCb HealthCheckFilterConfig::createFilterFactoryHelper(
     auto cluster_to_percentage = std::make_unique<ClusterMinHealthyPercentages>();
     for (const auto& item : proto_config.cluster_min_healthy_percentages()) {
       if (std::isnan(item.second.value())) {
-        throw EnvoyException(absl::StrCat(
+        return absl::InvalidArgumentError(absl::StrCat(
             "cluster_min_healthy_percentages contains a NaN value for cluster: ", item.first));
       }
       cluster_to_percentage->emplace(std::make_pair(item.first, item.second.value()));
@@ -61,7 +62,7 @@ Http::FilterFactoryCb HealthCheckFilterConfig::createFilterFactoryHelper(
   };
 }
 
-Http::FilterFactoryCb HealthCheckFilterConfig::createFilterFactoryFromProtoTyped(
+absl::StatusOr<Http::FilterFactoryCb> HealthCheckFilterConfig::createFilterFactoryFromProtoTyped(
     const envoy::extensions::filters::http::health_check::v3::HealthCheck& proto_config,
     const std::string& stats_prefix, Server::Configuration::FactoryContext& context) {
   return createFilterFactoryHelper(proto_config, stats_prefix, context.serverFactoryContext(),

source/extensions/filters/http/health_check/config.h

@@ -11,12 +11,13 @@ namespace HttpFilters {
 namespace HealthCheck {
 
 class HealthCheckFilterConfig
-    : public Common::FactoryBase<envoy::extensions::filters::http::health_check::v3::HealthCheck> {
+    : public Common::ExceptionFreeFactoryBase<
+          envoy::extensions::filters::http::health_check::v3::HealthCheck> {
 public:
-  HealthCheckFilterConfig() : FactoryBase("envoy.filters.http.health_check") {}
+  HealthCheckFilterConfig() : ExceptionFreeFactoryBase("envoy.filters.http.health_check") {}
 
 private:
-  Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
+  absl::StatusOr<Http::FilterFactoryCb> createFilterFactoryFromProtoTyped(
       const envoy::extensions::filters::http::health_check::v3::HealthCheck& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 
@@ -25,7 +26,7 @@ class HealthCheckFilterConfig
       const std::string& stats_prefix,
       Server::Configuration::ServerFactoryContext& context) override;
 
-  Http::FilterFactoryCb createFilterFactoryHelper(
+  absl::StatusOr<Http::FilterFactoryCb> createFilterFactoryHelper(
       const envoy::extensions::filters::http::health_check::v3::HealthCheck& proto_config,
       const std::string& stats_prefix, Server::Configuration::ServerFactoryContext& context,
       Stats::Scope& scope);

source/extensions/filters/http/jwt_authn/filter_config.cc

@@ -15,15 +15,19 @@ namespace JwtAuthn {
 
 FilterConfigImpl::FilterConfigImpl(
     envoy::extensions::filters::http::jwt_authn::v3::JwtAuthentication proto_config,
-    const std::string& stats_prefix, Server::Configuration::FactoryContext& context)
+    const std::string& stats_prefix, Server::Configuration::FactoryContext& context,
+    absl::Status& creation_status)
     : proto_config_(std::move(proto_config)),
       stats_(generateStats(stats_prefix, proto_config_.stat_prefix(), context.scope())),
       cm_(context.serverFactoryContext().clusterManager()),
       time_source_(context.serverFactoryContext().mainThreadDispatcher().timeSource()) {
 
   ENVOY_LOG(debug, "Loaded JwtAuthConfig: {}", proto_config_.DebugString());
 
-  jwks_cache_ = JwksCache::create(proto_config_, context, Common::JwksFetcher::create, stats_);
+  auto jwks_cache_or =
+      JwksCache::create(proto_config_, context, Common::JwksFetcher::create, stats_);
+  SET_AND_RETURN_IF_NOT_OK(jwks_cache_or.status(), creation_status);
+  jwks_cache_ = std::move(jwks_cache_or.value());
 
   // Validate provider URIs.
   // Note that the PGV well-known regex for URI is not implemented in C++, otherwise we could add a
@@ -34,50 +38,64 @@ FilterConfigImpl::FilterConfigImpl(
       absl::string_view provider_uri = provider_value.remote_jwks().http_uri().uri();
       Http::Utility::Url url;
       if (!url.initialize(provider_uri, /*is_connect=*/false)) {
-        throw EnvoyException(fmt::format("Provider '{}' has an invalid URI: '{}'",
-                                         std::get<0>(provider_pair), provider_uri));
+        creation_status = absl::InvalidArgumentError(fmt::format(
+            "Provider '{}' has an invalid URI: '{}'", std::get<0>(provider_pair), provider_uri));
+        return;
       }
     }
   }
 
   std::vector<std::string> names;
   for (const auto& it : proto_config_.requirement_map()) {
     names.push_back(it.first);
-    name_verifiers_.emplace(it.first,
-                            Verifier::create(it.second, proto_config_.providers(), *this));
+    auto verifier_or = Verifier::create(it.second, proto_config_.providers(), *this);
+    SET_AND_RETURN_IF_NOT_OK(verifier_or.status(), creation_status);
+    name_verifiers_.emplace(it.first, std::move(verifier_or.value()));
   }
   // sort is just for unit-test since protobuf map order is not deterministic.
   std::sort(names.begin(), names.end());
   all_requirement_names_ = absl::StrJoin(names, ",");
 
   for (const auto& rule : proto_config_.rules()) {
     switch (rule.requirement_type_case()) {
-    case RequirementRule::RequirementTypeCase::kRequires:
-      rule_pairs_.emplace_back(
-          Matcher::create(rule, context.serverFactoryContext()),
-          Verifier::create(rule.requires_(), proto_config_.providers(), *this));
+    case RequirementRule::RequirementTypeCase::kRequires: {
+      auto matcher_or = Matcher::create(rule, context.serverFactoryContext());
+      SET_AND_RETURN_IF_NOT_OK(matcher_or.status(), creation_status);
+      auto verifier_or = Verifier::create(rule.requires_(), proto_config_.providers(), *this);
+      SET_AND_RETURN_IF_NOT_OK(verifier_or.status(), creation_status);
+      rule_pairs_.emplace_back(std::move(matcher_or.value()), std::move(verifier_or.value()));
       break;
+    }
     case RequirementRule::RequirementTypeCase::kRequirementName: {
       // Use requirement_name to lookup requirement_map.
       auto map_it = proto_config_.requirement_map().find(rule.requirement_name());
       if (map_it == proto_config_.requirement_map().end()) {
-        throw EnvoyException(fmt::format("Wrong requirement_name: {}. It should be one of [{}]",
-                                         rule.requirement_name(), all_requirement_names_));
+        creation_status = absl::InvalidArgumentError(
+            fmt::format("Wrong requirement_name: {}. It should be one of [{}]",
+                        rule.requirement_name(), all_requirement_names_));
+        return;
       }
-      rule_pairs_.emplace_back(Matcher::create(rule, context.serverFactoryContext()),
-                               Verifier::create(map_it->second, proto_config_.providers(), *this));
+      auto matcher_or = Matcher::create(rule, context.serverFactoryContext());
+      SET_AND_RETURN_IF_NOT_OK(matcher_or.status(), creation_status);
+      auto verifier_or = Verifier::create(map_it->second, proto_config_.providers(), *this);
+      SET_AND_RETURN_IF_NOT_OK(verifier_or.status(), creation_status);
+      rule_pairs_.emplace_back(std::move(matcher_or.value()), std::move(verifier_or.value()));
     } break;
-    case RequirementRule::RequirementTypeCase::REQUIREMENT_TYPE_NOT_SET:
-      rule_pairs_.emplace_back(Matcher::create(rule, context.serverFactoryContext()), nullptr);
+    case RequirementRule::RequirementTypeCase::REQUIREMENT_TYPE_NOT_SET: {
+      auto matcher_or = Matcher::create(rule, context.serverFactoryContext());
+      SET_AND_RETURN_IF_NOT_OK(matcher_or.status(), creation_status);
+      rule_pairs_.emplace_back(std::move(matcher_or.value()), nullptr);
       break;
     }
+    }
   }
 
   if (proto_config_.has_filter_state_rules()) {
     filter_state_name_ = proto_config_.filter_state_rules().name();
     for (const auto& it : proto_config_.filter_state_rules().requires_()) {
-      filter_state_verifiers_.emplace(
-          it.first, Verifier::create(it.second, proto_config_.providers(), *this));
+      auto verifier_or = Verifier::create(it.second, proto_config_.providers(), *this);
+      SET_AND_RETURN_IF_NOT_OK(verifier_or.status(), creation_status);
+      filter_state_verifiers_.emplace(it.first, std::move(verifier_or.value()));
     }
   }
 }

source/extensions/filters/http/jwt_authn/filter_config.h

@@ -66,7 +66,8 @@ class FilterConfigImpl : public Logger::Loggable<Logger::Id::jwt>,
                          public AuthFactory {
 public:
   FilterConfigImpl(envoy::extensions::filters::http::jwt_authn::v3::JwtAuthentication proto_config,
-                   const std::string& stats_prefix, Server::Configuration::FactoryContext& context);
+                   const std::string& stats_prefix, Server::Configuration::FactoryContext& context,
+                   absl::Status& creation_status);
 
   ~FilterConfigImpl() override = default;
 

source/extensions/filters/http/jwt_authn/filter_factory.cc

@@ -22,29 +22,34 @@ using JwtVerify::Status;
 /**
  * Validate inline jwks, make sure they are the valid
  */
-void validateJwtConfig(const JwtAuthentication& proto_config, Api::Api& api) {
+absl::Status validateJwtConfig(const JwtAuthentication& proto_config, Api::Api& api) {
   for (const auto& [name, provider] : proto_config.providers()) {
-    const auto inline_jwks = THROW_OR_RETURN_VALUE(
-        Config::DataSource::read(provider.local_jwks(), true, api), std::string);
+    auto inline_jwks_or = Config::DataSource::read(provider.local_jwks(), true, api);
+    RETURN_IF_NOT_OK_REF(inline_jwks_or.status());
+    const auto& inline_jwks = inline_jwks_or.value();
     if (!inline_jwks.empty()) {
       auto jwks_obj = Jwks::createFrom(inline_jwks, Jwks::JWKS);
       if (jwks_obj->getStatus() != Status::Ok) {
-        throw EnvoyException(
+        return absl::InvalidArgumentError(
             fmt::format("Provider '{}' in jwt_authn config has invalid local jwks: {}", name,
                         JwtVerify::getStatusString(jwks_obj->getStatus())));
       }
     }
   }
+  return absl::OkStatus();
 }
 
 } // namespace
 
-Http::FilterFactoryCb
+absl::StatusOr<Http::FilterFactoryCb>
 FilterFactory::createFilterFactoryFromProtoTyped(const JwtAuthentication& proto_config,
                                                  const std::string& prefix,
                                                  Server::Configuration::FactoryContext& context) {
-  validateJwtConfig(proto_config, context.serverFactoryContext().api());
-  auto filter_config = std::make_shared<FilterConfigImpl>(proto_config, prefix, context);
+  RETURN_IF_NOT_OK(validateJwtConfig(proto_config, context.serverFactoryContext().api()));
+  absl::Status creation_status = absl::OkStatus();
+  auto filter_config =
+      std::make_shared<FilterConfigImpl>(proto_config, prefix, context, creation_status);
+  RETURN_IF_NOT_OK_REF(creation_status);
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
     callbacks.addStreamDecoderFilter(std::make_shared<Filter>(filter_config));
   };

source/extensions/filters/http/jwt_authn/filter_factory.h

@@ -14,14 +14,14 @@ namespace JwtAuthn {
 /**
  * Config registration for jwt_authn filter.
  */
-class FilterFactory
-    : public Common::FactoryBase<envoy::extensions::filters::http::jwt_authn::v3::JwtAuthentication,
-                                 envoy::extensions::filters::http::jwt_authn::v3::PerRouteConfig> {
+class FilterFactory : public Common::ExceptionFreeFactoryBase<
+                          envoy::extensions::filters::http::jwt_authn::v3::JwtAuthentication,
+                          envoy::extensions::filters::http::jwt_authn::v3::PerRouteConfig> {
 public:
-  FilterFactory() : FactoryBase("envoy.filters.http.jwt_authn") {}
+  FilterFactory() : ExceptionFreeFactoryBase("envoy.filters.http.jwt_authn") {}
 
 private:
-  Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
+  absl::StatusOr<Http::FilterFactoryCb> createFilterFactoryFromProtoTyped(
       const envoy::extensions::filters::http::jwt_authn::v3::JwtAuthentication& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;