Gorouter does not count 404s (route not found) as requests in metrics

Is this a security vulnerability?

No

Issue

Gorouter ignores unknown_route errors for the purpose of metrics. It does handle the request and returns a 404 to the client but it does not count that as a request that's been handled by gorouter, nor does it count the 404 as a responses_4xx value in metrics.

Affected Versions

All

Context

In production, we have HAProxy sitting in front of gorouter for TLS offloading. The 4xx status code metrics between HAProxy differ in that 404s coming from gorouter are recorded as 4xx errors in HAProxy but not in gorouter. There, the 404s are "invisible" on the metrics dashboards. We feel this is wrong, because even though there was no backend app that responded to the request, there still was a request and it should be counted as such.

Steps to Reproduce

1. Push some-app.cf-app.com
2. curl https://some-app.cf-app.com
3. curl -u <user:pwd> http://gorouter:8082/varz
4. Notice how the requests and responses_2xx metrics have increased
5. curl https://does-not-exist.cf-app.com
6. curl -u <user:pwd> http://gorouter:8082/varz
7. Notice how the requests and responses_4xx metrics have not increased

Expected result

requests and responses_4xx metrics should include 404 unknown_route requests.

Note:
By extension, this should also apply to these errors:

• 400 empty_host
• 400 invalid_cf_app_instance_header
• 503 no_endpoints
• 503 Connection Limit Reached

Current result

requests and responses_4xx remain the same

Possible Fix

The request handling is stopped early in the lookup handler if the request cannot be forwarded.
A likely solution will be to also record the correct metrics in this handler.