Protocol:          networking.ListenerProtocolHTTP,
			TransportProtocol: xdsfilters.RawBufferTransportProtocol,
		},
		{
			// client side traffic could not be identified by the outbound listener, but sent over mTLS
			ApplicationProtocols: mtlsTCPWithMxcALPNs,
			// If client sends mTLS traffic, transport protocol will be set by the TLS inspector
			TransportProtocol: xdsfilters.TLSTransportProtocol,

	default:
		// Should not reach here.
		return ListenerProtocolAuto
	}
}

type TransportProtocol uint8

const (
	// TransportProtocolTCP is a TCP listener
	TransportProtocolTCP = iota
	// TransportProtocolQUIC is a QUIC listener
	TransportProtocolQUIC
)

func (tp TransportProtocol) String() string {
	switch tp {
	case TransportProtocolTCP:
		return "tcp"
	case TransportProtocolQUIC:

			3,
			"unknown",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			if got := TransportProtocol(tt.value).String(); got != tt.want {
				t.Errorf("Failed to get TransportProtocol.String :: got = %v, want %v", got, tt.want)
			}
		})
	}

	}
	for _, fc := range l.FilterChains {
		m := fc.FilterChainMatch
		if fc.FilterChainMatch == nil {
			continue
		}
		if m.TransportProtocol == xdsfilters.TLSTransportProtocol {
			t.Errorf("transport protocol set, but missing tls inspector: %v", Dump(t, l))
		}
		if m.TransportProtocol == "" && len(m.ServerNames) > 0 {
			t.Errorf("server names set, but missing tls inspector: %v", Dump(t, l))
		}

"metadata"
"service"
"vhost"
"gateway"
"filterChain"
"operation"
"value"
"filterClass"
"context"
"proxy"
"listener"
"routeConfiguration"
"cluster"
"applyTo"
"match"
"patch"
"transportProtocol"
"applicationProtocols"
"destinationPort"
"subFilter"
"bind"
"initialDelaySeconds"
"timeoutSeconds"
"periodSeconds"
"successThreshold"
"failureThreshold"
"tcpSocket"
"httpGet"
"exec"

	proxy *model.Proxy, mesh *meshconfig.MeshConfig, transportProtocol istionetworking.TransportProtocol, gatewayTCPServerWithTerminatingTLS bool,
) *auth.DownstreamTlsContext {
	alpnByTransport := util.ALPNHttp
	if transportProtocol == istionetworking.TransportProtocolQUIC {
		alpnByTransport = util.ALPNHttp3OverQUIC
	} else if transportProtocol == istionetworking.TransportProtocolTCP &&

func (configgen *ConfigGeneratorImpl) createGatewayHTTPFilterChainOpts(node *model.Proxy, port *networking.Port, server *networking.Server,
	routeName string, proxyConfig *meshconfig.ProxyConfig, transportProtocol istionetworking.TransportProtocol,
	push *model.PushContext,
) *filterChainOpts {
	serverProto := protocol.Parse(port.Protocol)
	ph := GetProxyHeadersFromProxyConfig(proxyConfig, istionetworking.ListenerClassGateway)

				ObjectTypes: &networking.EnvoyFilter_EnvoyConfigObjectMatch_Listener{
					Listener: &networking.EnvoyFilter_ListenerMatch{
						PortNumber:  80,
						FilterChain: &networking.EnvoyFilter_ListenerMatch_FilterChainMatch{TransportProtocol: "tls"},
					},
				},
			},
			Patch: &networking.EnvoyFilter_Patch{
				Operation: networking.EnvoyFilter_Patch_REMOVE,
			},
		},
		{
			ApplyTo: networking.EnvoyFilter_LISTENER,

func (cc inboundChainConfig) ToFilterChainMatch(opt FilterChainMatchOptions) *listener.FilterChainMatch {
	match := &listener.FilterChainMatch{}
	match.ApplicationProtocols = opt.ApplicationProtocols
	match.TransportProtocol = opt.TransportProtocol
	if cc.port.TargetPort > 0 {
		match.DestinationPort = &wrappers.UInt32Value{Value: cc.port.TargetPort}
	}
	return match
}

	descrs := []string{}
	if len(match.ServerNames) > 0 {
		descrs = append(descrs, fmt.Sprintf("SNI: %s", strings.Join(match.ServerNames, ",")))
	}
	if len(match.TransportProtocol) > 0 {
		descrs = append(descrs, fmt.Sprintf("Trans: %s", match.TransportProtocol))
	}

	if len(match.ApplicationProtocols) > 0 {
		found := false
		for protDescr, protocols := range protDescrs {