Steven Landow <******@****.***> 1713392444 -0700

					},
					EnvironmentVariables: &wasmextension.EnvironmentVariables{
						KeyValues: map[string]string{
							"ISTIO_META_WASM_PLUGIN_RESOURCE_VERSION": "",
						},
					},
				},
			},
		},
	})
	networkFilter := protoconv.MessageToAny(&networkwasm.Wasm{
		Config: &wasmextension.PluginConfig{
			Name:          "istio-system.someNetworkFilter",
			Configuration: &anypb.Any{},
			Vm: &wasmextension.PluginConfig_VmConfig{

type PatchType string

const (
	Cluster        PatchType = "cluster"
	Listener       PatchType = "listener"
	ListenerFilter PatchType = "listenerfilter"
	FilterChain    PatchType = "filterchain"
	NetworkFilter  PatchType = "networkfilter"
	// nolint
	HttpFilter  PatchType = "httpfilter"
	Route       PatchType = "route"
	VirtualHost PatchType = "vhost"
)

var (
	patchType  = monitoring.CreateLabel("patch")

	for _, lp := range patches[networking.EnvoyFilter_NETWORK_FILTER] {
		if !commonConditionMatch(patchContext, lp) ||
			!listenerMatch(lis, lp) ||
			!filterChainMatch(lis, fc, lp) {
			IncrementEnvoyFilterMetric(lp.Key(), NetworkFilter, false)
			continue
		}
		applied := false
		if lp.Operation == networking.EnvoyFilter_Patch_ADD {
			fc.Filters = append(fc.Filters, proto.Clone(lp.Value).(*listener.Filter))
			applied = true

		httpFilterChainOpts.networkFilters = extension.PopAppendNetwork(httpFilterChainOpts.networkFilters, wasm, extensions.PluginPhase_AUTHN)
		httpFilterChainOpts.networkFilters = extension.PopAppendNetwork(httpFilterChainOpts.networkFilters, wasm, extensions.PluginPhase_AUTHZ)
		httpFilterChainOpts.networkFilters = extension.PopAppendNetwork(httpFilterChainOpts.networkFilters, wasm, extensions.PluginPhase_STATS)

	if want.TotalMatch {
		if want.NetworkFilters != nil {
			assert.Equal(t, want.NetworkFilters, haveNetwork, context("network filters should be equal"))
		}
		if want.HTTPFilters != nil {
			assert.Equal(t, want.HTTPFilters, haveHTTP, context("http should be equal"))
		}
	} else {
		if missing := sets.SortedList(sets.New(want.NetworkFilters...).Difference(sets.New(haveNetwork...))); len(missing) > 0 {

						out = append(out, &filterChainOpts{
							metadata:         util.BuildConfigInfoMetadata(cfg.Meta),
							sniHosts:         match.SniHosts,
							destinationCIDRs: destinationCIDRs,
							networkFilters:   lb.buildOutboundNetworkFilters(tls.Route, listenPort, cfg.Meta, false),
						})
						hasTLSMatch = true
					}
					matchHasBeenHandled.Insert(matchHash)
				}
			}
		}
	}

			}
			opt.networkFilters = extension.PopAppendNetwork(opt.networkFilters, wasm, extensions.PluginPhase_AUTHN)
			opt.networkFilters = extension.PopAppendNetwork(opt.networkFilters, wasm, extensions.PluginPhase_AUTHZ)
			opt.networkFilters = extension.PopAppendNetwork(opt.networkFilters, wasm, extensions.PluginPhase_STATS)
			opt.networkFilters = extension.PopAppendNetwork(opt.networkFilters, wasm, extensions.PluginPhase_UNSPECIFIED_PHASE)

	"istio.io/istio/pkg/config"
	"istio.io/istio/pkg/config/protocol"
	"istio.io/istio/pkg/config/schema/gvk"
	"istio.io/istio/pkg/network"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/test"
)

var networkFiltered = []networkFilterCase{
	{
		name:  "from_network1_cluster1a",
		proxy: makeProxy("network1", "cluster1a"),
		want: []xdstest.LocLbEpInfo{
			{
				LbEps: []xdstest.LbEpInfo{
					// 3 local endpoints on network1

					Type:           listenertest.MTLSHTTP,
					HTTPFilters:    httpFilters,
					NetworkFilters: httpNetworkFilters,
					TotalMatch:     true,
				},
				{
					Name:           "0.0.0.0_8080",
					Type:           listenertest.PlainTCP,
					HTTPFilters:    httpFilters,
					NetworkFilters: httpNetworkFilters,
					TotalMatch:     true,
				},
				{
					Name:           "0.0.0.0_1234",