From 41aea6521496d8a86a7cef842660997348e345c0 Mon Sep 17 00:00:00 2001
From: cskh <hui.kang@hashicorp.com>
Date: Wed, 24 Aug 2022 14:13:10 -0400
Subject: [PATCH] =?UTF-8?q?Fix:=20the=20inboundconnection=20limit=20filter?=
 =?UTF-8?q?=20should=20be=20placed=20in=20front=20of=20http=20co=E2=80=A6?=
 =?UTF-8?q?=20(#14325)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: the inboundconnection limit should be placed in front of http connection manager

Co-authored-by: Freddy <freddygv@users.noreply.github.com>
---
 agent/xds/listeners.go                        | 44 ++++++++++++-------
 ...ener-max-inbound-connections.latest.golden | 15 ++++---
 2 files changed, 36 insertions(+), 23 deletions(-)

diff --git a/agent/xds/listeners.go b/agent/xds/listeners.go
index 95b84c94ce..33c339c4d8 100644
--- a/agent/xds/listeners.go
+++ b/agent/xds/listeners.go
@@ -1214,16 +1214,38 @@ func (s *ResourceGenerator) makeInboundListener(cfgSnap *proxycfg.ConfigSnapshot
 			filterOpts.forwardClientPolicy = envoy_http_v3.HttpConnectionManager_APPEND_FORWARD
 		}
 	}
+
+	// If an inbound connect limit is set, inject a connection limit filter on each chain.
+	if cfg.MaxInboundConnections > 0 {
+		connectionLimitFilter, err := makeConnectionLimitFilter(cfg.MaxInboundConnections)
+		if err != nil {
+			return nil, err
+		}
+		l.FilterChains = []*envoy_listener_v3.FilterChain{
+			{
+				Filters: []*envoy_listener_v3.Filter{
+					connectionLimitFilter,
+				},
+			},
+		}
+	}
+
 	filter, err := makeListenerFilter(filterOpts)
 	if err != nil {
 		return nil, err
 	}
-	l.FilterChains = []*envoy_listener_v3.FilterChain{
-		{
-			Filters: []*envoy_listener_v3.Filter{
-				filter,
+
+	if len(l.FilterChains) > 0 {
+		// The list of FilterChains has already been initialized
+		l.FilterChains[0].Filters = append(l.FilterChains[0].Filters, filter)
+	} else {
+		l.FilterChains = []*envoy_listener_v3.FilterChain{
+			{
+				Filters: []*envoy_listener_v3.Filter{
+					filter,
+				},
 			},
-		},
+		}
 	}
 
 	err = s.finalizePublicListenerFromConfig(l, cfgSnap, cfg, useHTTPFilter)
@@ -1249,17 +1271,6 @@ func (s *ResourceGenerator) finalizePublicListenerFromConfig(l *envoy_listener_v
 		return nil
 	}
 
-	// If an inbound connect limit is set, inject a connection limit filter on each chain.
-	if proxyCfg.MaxInboundConnections > 0 {
-		filter, err := makeConnectionLimitFilter(proxyCfg.MaxInboundConnections)
-		if err != nil {
-			return nil
-		}
-		for idx := range l.FilterChains {
-			l.FilterChains[idx].Filters = append(l.FilterChains[idx].Filters, filter)
-		}
-	}
-
 	return nil
 }
 
@@ -1990,6 +2001,7 @@ func makeTCPProxyFilter(filterName, cluster, statPrefix string) (*envoy_listener
 
 func makeConnectionLimitFilter(limit int) (*envoy_listener_v3.Filter, error) {
 	cfg := &envoy_connection_limit_v3.ConnectionLimit{
+		StatPrefix:     "inbound_connection_limit",
 		MaxConnections: wrapperspb.UInt64(uint64(limit)),
 	}
 	return makeFilter("envoy.filters.network.connection_limit", cfg)
diff --git a/agent/xds/testdata/listeners/listener-max-inbound-connections.latest.golden b/agent/xds/testdata/listeners/listener-max-inbound-connections.latest.golden
index be3b83433a..cbfda69f56 100644
--- a/agent/xds/testdata/listeners/listener-max-inbound-connections.latest.golden
+++ b/agent/xds/testdata/listeners/listener-max-inbound-connections.latest.golden
@@ -73,6 +73,14 @@
                 "statPrefix": "connect_authz"
               }
             },
+            {
+              "name": "envoy.filters.network.connection_limit",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit",
+                "statPrefix": "inbound_connection_limit",
+                "maxConnections": "222"
+              }
+            },
             {
               "name": "envoy.filters.network.tcp_proxy",
               "typedConfig": {
@@ -80,13 +88,6 @@
                 "statPrefix": "public_listener",
                 "cluster": "local_app"
               }
-            },
-            {
-              "name": "envoy.filters.network.connection_limit",
-              "typedConfig": {
-                "@type": "type.googleapis.com/envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit",
-                "maxConnections": "222"
-              }
             }
           ],
           "transportSocket": {