b.logger.AppendDebugf("built %d HTTP filters for ALLOW action", len(configs.http))
		filters = append(filters, configs.http...)
	}
	return filters
}

// BuildTCP returns the TCP filters built from the authorization policy.
func (b Builder) BuildTCP() []*listener.Filter {
	b.logger = &AuthzLogger{}
	defer b.logger.Report()
	if b.option.IsCustomBuilder {

	}
	// TODO: not sure why it goes here
	filters = append(filters, authzCustomBuilder.BuildTCP()...)

	// Authn
	filters = extension.PopAppendNetwork(filters, wasm, extensions.PluginPhase_AUTHN)

	// Authz
	filters = extension.PopAppendNetwork(filters, wasm, extensions.PluginPhase_AUTHZ)
	filters = append(filters, authzBuilder.BuildTCP()...)

	// Stats

			policies := push.AuthzPolicies.ListAuthorizationPolicies(selectionOpts)
			g := New(tc.tdBundle, push, policies, option)
			if g == nil {
				t.Fatalf("failed to create generator")
			}
			got := g.BuildTCP()
			verify(t, convertTCP(got), baseDir, tc.want, true /* forTCP */)
		})
	}
}

func verify(t *testing.T, gots []proto.Message, baseDir string, wants []string, forTCP bool) {
	t.Helper()