multi-network: HBONE matching prefers hostname over VIP (#58512)

Author: stevenctl

pilot/pkg/networking/core/listener_waypoint.go

@@ -576,46 +576,54 @@ func (lb *ListenerBuilder) buildWaypointInternal(wls []model.WorkloadInfo, svcs
 		return nil
 	}()
 
-	l := &listener.Listener{
-		Name:              MainInternalName,
-		ListenerSpecifier: &listener.Listener_InternalListener{InternalListener: &listener.Listener_InternalListenerConfig{}},
-		ListenerFilters: []*listener.ListenerFilter{
-			xdsfilters.OriginalDestination,
-			httpInspector,
-		},
-		TrafficDirection: core.TrafficDirection_INBOUND,
-		FilterChains:     chains,
-		FilterChainMatcher: &matcher.Matcher{
-			MatcherType: &matcher.Matcher_MatcherTree_{
-				MatcherTree: &matcher.Matcher_MatcherTree{
-					Input: match.DestinationIP,
-					TreeType: &matcher.Matcher_MatcherTree_CustomMatch{
-						CustomMatch: &xds.TypedExtensionConfig{
-							Name:        "ip",
-							TypedConfig: protoconv.MessageToAny(ipMatcher),
-						},
+	// by default match IPs first
+	primaryMatcher := &matcher.Matcher{
+		MatcherType: &matcher.Matcher_MatcherTree_{
+			MatcherTree: &matcher.Matcher_MatcherTree{
+				Input: match.DestinationIP,
+				TreeType: &matcher.Matcher_MatcherTree_CustomMatch{
+					CustomMatch: &xds.TypedExtensionConfig{
+						Name:        "ip",
+						TypedConfig: protoconv.MessageToAny(ipMatcher),
 					},
 				},
 			},
 		},
 	}
 
+	// when multi-network is enabled, prefer the hostnames for matching
+	// VIPs may overlap across networks, especially auto-generated ServiceEntry VIPs
+	// and if we hit an incorrect VIP match we may attempt to route to the wrong service
 	if len(svcHostnameMap.Map) > 0 && features.EnableAmbientMultiNetwork {
-		l.FilterChainMatcher.OnNoMatch = &matcher.Matcher_OnMatch{
-			OnMatch: &matcher.Matcher_OnMatch_Matcher{
-				Matcher: &matcher.Matcher{
-					MatcherType: &matcher.Matcher_MatcherTree_{
-						MatcherTree: &matcher.Matcher_MatcherTree{
-							Input: match.AuthorityFilterStateInput,
-							TreeType: &matcher.Matcher_MatcherTree_ExactMatchMap{
-								ExactMatchMap: svcHostnameMap,
-							},
-						},
+		primaryMatcher = &matcher.Matcher{
+			OnNoMatch: &matcher.Matcher_OnMatch{
+				OnMatch: &matcher.Matcher_OnMatch_Matcher{
+					Matcher: primaryMatcher,
+				},
+			},
+			MatcherType: &matcher.Matcher_MatcherTree_{
+				MatcherTree: &matcher.Matcher_MatcherTree{
+					Input: match.AuthorityFilterStateInput,
+					TreeType: &matcher.Matcher_MatcherTree_ExactMatchMap{
+						ExactMatchMap: svcHostnameMap,
 					},
 				},
 			},
 		}
 	}
+
+	l := &listener.Listener{
+		Name:              MainInternalName,
+		ListenerSpecifier: &listener.Listener_InternalListener{InternalListener: &listener.Listener_InternalListenerConfig{}},
+		ListenerFilters: []*listener.ListenerFilter{
+			xdsfilters.OriginalDestination,
+			httpInspector,
+		},
+		TrafficDirection:   core.TrafficDirection_INBOUND,
+		FilterChains:       chains,
+		FilterChainMatcher: primaryMatcher,
+	}
+
 	if tlsInspector != nil {
 		l.ListenerFilters = append(l.ListenerFilters, tlsInspector)
 	}