traffic.sidecar.istio.io/excludeInboundPorts: 4,5,6
        traffic.sidecar.istio.io/excludeOutboundIPRanges: 10.96.0.2/24,10.96.0.3/24
        traffic.sidecar.istio.io/includeInboundPorts: ""
        traffic.sidecar.istio.io/includeOutboundIPRanges: ""
      creationTimestamp: null
      labels:
        app: traffic
        security.istio.io/tlsMode: istio

John Howard <******@****.***> 1709830758 -0800

Jingming Guo <******@****.***> 1715374912 -0700

    content: |
      Host header fallback for determining values for Prometheus `destination_service` labels has been disabled for all incoming traffic.
      Previously, this was disabled *only* for traffic arriving at Gateways. If you are relying on host header fallback behavior to properly

import (
	"net/http"
	"testing"

	"istio.io/istio/pkg/test/framework/components/prometheus"
)

func TestOutboundTrafficPolicy_AllowAny(t *testing.T) {
	cases := []*TestCase{
		{
			Name:     "HTTP Traffic",
			PortName: "http",
			Expected: Expected{
				Query: prometheus.Query{
					Metric:      "istio_requests_total",
					Aggregation: "sum",
					Labels: map[string]string{
						"reporter":                 "source",

	// FCM 3: ALPN [istio-peer-exchange, istio] Transport protocol: tls            --> TCP traffic from sidecar over TLS
	inboundPermissiveFilterChainMatchWithMxcOptions = []FilterChainMatchOptions{
		{
			// client side traffic was detected as HTTP by the outbound listener, sent over mTLS
			ApplicationProtocols: mtlsHTTPALPNs,
			// If client sends mTLS traffic, transport protocol will be set by the TLS inspector

  generated by them.

  This feature is intended primarily for use on VMs, where system administrators need
  to restrain interception of the outgoing traffic down to a few applications instead
  of intercepting all outgoing traffic.

  By default, as before, Istio Sidecar will intercept outgoing traffic from all processes,
  no matter what user groups they are running under.

upgradeNotes:
- title: Protocol Detection Timeout Changes
  content: |
    In order to support permissive mTLS traffic as well as [automatic protocol detection](istio.io/latest/docs/ops/configuration/traffic-management/protocol-selection/#automatic-protocol-selection),

	// a local pod.
	IfNotLocal() []string

	// IfLocalNFT returns nftables arguments that will match traffic from a local pod.
	IfLocalNFT() []string

	// IfNotLocalNFT returns nftables arguments that will match traffic that is not
	// from a local pod.
	IfNotLocalNFT() []string
}

type detectLocal struct {
	ifLocal       []string
	ifNotLocal    []string
	ifLocalNFT    []string

	flag.BindEnv(fs, constants.InboundCapturePort, "z",
		"Port to which all inbound TCP traffic to the pod/VM should be redirected to.",
		&cfg.InboundCapturePort)

	flag.BindEnv(fs, constants.InboundTunnelPort, "e",
		"Specify the istio tunnel port for inbound tcp traffic.",
		&cfg.InboundTunnelPort)

	flag.BindEnv(fs, constants.ProxyUID, "u",