continue
			}
			lis.ListenerFilters, applied = insertBeforeFunc(
				lis.ListenerFilters,
				func(e *listener.ListenerFilter) (bool, *listener.ListenerFilter) {
					if listenerFilterMatch(e, lp) {
						return true, proto.Clone(lp.Value).(*listener.ListenerFilter)
					}
					return false, nil
				},
			)

				clusterName:       "inbound|8888||",
				port: model.ServiceInstancePort{
					ServicePort: &model.Port{},
				},
			}

			listenerFilters := NewListenerBuilder(cg.SetupProxy(nil), cg.PushContext()).buildInboundNetworkFilters(fcc)
			tcp := &tcp.TcpProxy{}
			listenerFilters[len(listenerFilters)-1].GetTypedConfig().UnmarshalTo(tcp)
			if tcp.StatPrefix != tt.expectedStatPrefix {

	}
}

func VerifyListener(t test.Failer, l *listener.Listener, lt ListenerTest) {
	t.Helper()
	haveFilters := []string{}
	for _, lf := range l.ListenerFilters {
		haveFilters = append(haveFilters, lf.Name)
	}

	// Check ListenerFilters

	if lt.Filters != nil {
		if lt.TotalMatch {
			assert.Equal(t, lt.Filters, haveFilters, l.Name+": listener filters should be equal")
		} else {

	// removed, but have not yet
	if needTLSInspector || needHTTPInspector {
		l.ListenerFilters = append(l.ListenerFilters, xdsfilters.TLSInspector)
	}

	if needHTTPInspector {
		l.ListenerFilters = append(l.ListenerFilters, xdsfilters.HTTPInspector)
		// Enable timeout only if they configure it and we have an HTTP inspector.
		// This is really unsafe, so hopefully not used...

	}
	lb.authzBuilder = oldBuilder
	accessLogBuilder.setListenerAccessLog(lb.push, lb.node, l, istionetworking.ListenerClassSidecarInbound)
	l.ListenerFilters = append(l.ListenerFilters, xdsfilters.OriginalDestination)
	// TODO: Exclude inspectors from some inbound ports.
	l.ListenerFilters = append(l.ListenerFilters, populateListenerFilters(lb.node, l, true)...)
	return []*listener.Listener{terminate, l}
}

			DefaultFilterChain: &listener.FilterChain{
				Filters: []*listener.Filter{
					{Name: "default-network-filter"},
					{Name: "default-network-filter-removed"},
				},
			},
			ListenerFilters: []*listener.ListenerFilter{
				{
					Name: "filter-to-be-removed",
				},
				{
					Name: "filter-before-replace",
				},
			},
		},
		{
			Name: "another-listener",
		},
		{

func validateInspector(t testing.TB, l *listener.Listener) {
	t.Helper()
	for _, lf := range l.ListenerFilters {
		if lf.Name == xdsfilters.TLSInspector.Name {
			return
		}
	}
	for _, fc := range l.FilterChains {
		m := fc.FilterChainMatch
		if fc.FilterChainMatch == nil {
			continue
		}

		} else {
			if !isHTTPFilterChain(l.FilterChains[0]) {
				t.Fatalf("expected http filter chain, found %s", l.FilterChains[1].Filters[0].Name)
			}
			if len(l.ListenerFilters) > 0 {
				t.Fatalf("expected %d listener filter, found %d", 0, len(l.ListenerFilters))
			}
		}
	}
}

func TestGetActualWildcardAndLocalHost(t *testing.T) {
	tests := []struct {
		name     string
		proxy    *model.Proxy

		}
	}
	l := &listener.Listener{
		Name:              MainInternalName,
		ListenerSpecifier: &listener.Listener_InternalListener{InternalListener: &listener.Listener_InternalListenerConfig{}},
		ListenerFilters: []*listener.ListenerFilter{
			xdsfilters.OriginalDestination,
			// TODO: This may affect the data path due to the server-first protocols triggering a time-out. Need exception filter.
			xdsfilters.HTTPInspector,
		},

	for _, l := range rc {
		res[l.Name] = l
	}
	return res
}

func ExtractListenerFilters(l *listener.Listener) map[string]*listener.ListenerFilter {
	res := map[string]*listener.ListenerFilter{}
	for _, lf := range l.ListenerFilters {
		res[lf.Name] = lf
	}
	return res
}

func ExtractFilterChain(name string, l *listener.Listener) *listener.FilterChain {