config: enforcing terminal filters are the final filter in their respective chains

source/extensions/filters/network/http_connection_manager/BUILD

@@ -38,6 +38,7 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/common/router:rds_lib",
         "//source/common/router:scoped_rds_lib",
+        "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
     ],

source/extensions/filters/network/http_connection_manager/config.cc

@@ -24,6 +24,8 @@
 #include "common/router/rds_impl.h"
 #include "common/router/scoped_rds.h"
 
+#include "extensions/filters/http/well_known_names.h"
+
 namespace Envoy {
 namespace Extensions {
 namespace NetworkFilters {
@@ -306,6 +308,10 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
 
   const auto& filters = config.http_filters();
   for (int32_t i = 0; i < filters.size(); i++) {
+    if (filters[i].name() == HttpFilters::HttpFilterNames::get().Router &&
+        i != filters.size() - 1) {
+      throw EnvoyException(fmt::format("Error: envoy.router must be terminal filter."));
+    }
     processFilter(filters[i], i, "http", filter_factories_);
   }
 

source/server/BUILD

@@ -273,6 +273,7 @@ envoy_cc_library(
         "//source/common/network:utility_lib",
         "//source/common/protobuf:utility_lib",
         "//source/extensions/filters/listener:well_known_names",
+        "//source/extensions/filters/network:well_known_names",
         "//source/extensions/transport_sockets:well_known_names",
         "@envoy_api//envoy/admin/v2alpha:config_dump_cc",
         "@envoy_api//envoy/api/v2:lds_cc",

source/server/listener_manager_impl.cc

@@ -25,6 +25,7 @@
 #include "server/transport_socket_config_impl.h"
 
 #include "extensions/filters/listener/well_known_names.h"
+#include "extensions/filters/network/well_known_names.h"
 #include "extensions/transport_sockets/well_known_names.h"
 
 #include "absl/strings/match.h"
@@ -52,6 +53,11 @@ std::vector<Network::FilterFactoryCb> ProdListenerComponentFactory::createNetwor
     Configuration::FactoryContext& context) {
   std::vector<Network::FilterFactoryCb> ret;
   for (ssize_t i = 0; i < filters.size(); i++) {
+    if (filters[i].name() == Extensions::NetworkFilters::NetworkFilterNames::get().TcpProxy &&
+        i != filters.size() - 1) {
+      throw EnvoyException(
+          fmt::format("Error: envoy.tcp_proxy must be the terminal network filter."));
+    }
     const auto& proto_config = filters[i];
     const std::string& string_name = proto_config.name();
     ENVOY_LOG(debug, "  filter #{}:", i);

test/extensions/filters/network/http_connection_manager/config_test.cc

@@ -146,6 +146,36 @@ stat_prefix: router
       EnvoyException, "Didn't find a registered implementation for name: 'foo'");
 }
 
+TEST_F(HttpConnectionManagerConfigTest, RouterInverted) {
+  const std::string yaml_string = R"EOF(
+codec_type: http1
+server_name: foo
+stat_prefix: router
+route_config:
+  virtual_hosts:
+  - name: service
+    domains:
+    - "*"
+    routes:
+    - match:
+        prefix: "/"
+      route:
+        cluster: cluster
+http_filters:
+- name: envoy.router
+  config: {}
+- name: envoy.health_check
+  config:
+      pass_through_mode: false
+  )EOF";
+
+  EXPECT_THROW_WITH_MESSAGE(
+      HttpConnectionManagerConfig(parseHttpConnectionManagerFromV2Yaml(yaml_string), context_,
+                                  date_provider_, route_config_provider_manager_,
+                                  scoped_routes_config_provider_manager_),
+      EnvoyException, "Error: envoy.router must be terminal filter.");
+}
+
 TEST_F(HttpConnectionManagerConfigTest, MiscConfig) {
   const std::string yaml_string = R"EOF(
 codec_type: http1

test/server/listener_manager_impl_test.cc

@@ -449,6 +449,25 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, BadFilterConfig) {
                           EnvoyException, "foo: Cannot find field");
 }
 
+TEST_F(ListenerManagerImplWithRealFiltersTest, BadOrdering) {
+  const std::string yaml = R"EOF(
+address:
+  socket_address:
+    address: 127.0.0.1
+    port_value: 1234
+filter_chains:
+- filters:
+  - name: envoy.tcp_proxy
+    config: {}
+  - name: unknown_but_will_not_be_processed
+    config: {}
+  )EOF";
+
+  EXPECT_THROW_WITH_REGEX(manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), "", true),
+                          EnvoyException,
+                          "Error: envoy.tcp_proxy must be the terminal network filter.");
+}
+
 TEST_F(ListenerManagerImplWithRealFiltersTest, BadFilterName) {
   const std::string yaml = R"EOF(
 address: