metadata:         util.BuildConfigInfoMetadata(cfg.Meta),
							sniHosts:         match.SniHosts,
							destinationCIDRs: destinationCIDRs,
							networkFilters:   lb.buildOutboundNetworkFilters(tls.Route, listenPort, cfg.Meta, false),
						})
						hasTLSMatch = true
					}
					matchHasBeenHandled.Insert(matchHash)
				}
			}
		}
	}

				ConfigNamespace: "not-default",
				Metadata:        &model.NodeMetadata{IdleTimeout: tt.istioMetaIdleTimeout},
			})
			lb := ListenerBuilder{node: proxy, push: cg.PushContext()}
			filters := lb.buildOutboundNetworkFilters(tt.routes, &model.Port{Port: 443},
				config.Meta{Name: "routing-config-for-example-com", Namespace: "not-default"}, false)

			tcpProxy := xdstest.ExtractTCPProxy(t, &listener.FilterChain{Filters: filters})

	default:
		filterstack = append(filterstack, tcpFilter)
	}

	return filterstack
}

// buildOutboundNetworkFilters generates a TCP proxy network filter for outbound
// connections. In addition, it generates protocol specific filters (e.g., Mongo
// filter).
func (lb *ListenerBuilder) buildOutboundNetworkFilters(
	routes []*networking.RouteDestination,
	port *model.Port, configMeta config.Meta, includeMx bool,

		for _, tcp := range vsvc.Tcp {
			if l4MultiMatch(tcp.Match, server, gateway) {
				includeMx := server.GetTls().GetMode() == networking.ServerTLSSettings_ISTIO_MUTUAL
				return lb.buildOutboundNetworkFilters(tcp.Route, port, v.Meta, includeMx)
			}
		}
	}

	return nil
}

// buildGatewayNetworkFiltersFromTLSRoutes builds tcp proxy routes for all VirtualServices with TLS blocks.