Jingming Guo <******@****.***> 1715374912 -0700

import (
	"net/http"
	"testing"

	"istio.io/istio/pkg/test/framework/components/prometheus"
)

func TestOutboundTrafficPolicy_AllowAny(t *testing.T) {
	cases := []*TestCase{
		{
			Name:     "HTTP Traffic",
			PortName: "http",
			Expected: Expected{
				Query: prometheus.Query{
					Metric:      "istio_requests_total",
					Aggregation: "sum",
					Labels: map[string]string{
						"reporter":                 "source",

	// FCM 3: ALPN [istio-peer-exchange, istio] Transport protocol: tls            --> TCP traffic from sidecar over TLS
	inboundPermissiveFilterChainMatchWithMxcOptions = []FilterChainMatchOptions{
		{
			// client side traffic was detected as HTTP by the outbound listener, sent over mTLS
			ApplicationProtocols: mtlsHTTPALPNs,
			// If client sends mTLS traffic, transport protocol will be set by the TLS inspector

  generated by them.

  This feature is intended primarily for use on VMs, where system administrators need
  to restrain interception of the outgoing traffic down to a few applications instead
  of intercepting all outgoing traffic.

  By default, as before, Istio Sidecar will intercept outgoing traffic from all processes,
  no matter what user groups they are running under.

	// a local pod.
	IfNotLocal() []string

	// IfLocalNFT returns nftables arguments that will match traffic from a local pod.
	IfLocalNFT() []string

	// IfNotLocalNFT returns nftables arguments that will match traffic that is not
	// from a local pod.
	IfNotLocalNFT() []string
}

type detectLocal struct {
	ifLocal       []string
	ifNotLocal    []string
	ifLocalNFT    []string

	flag.BindEnv(fs, constants.InboundCapturePort, "z",
		"Port to which all inbound TCP traffic to the pod/VM should be redirected to.",
		&cfg.InboundCapturePort)

	flag.BindEnv(fs, constants.InboundTunnelPort, "e",
		"Specify the istio tunnel port for inbound tcp traffic.",
		&cfg.InboundTunnelPort)

	flag.BindEnv(fs, constants.ProxyUID, "u",

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
- 37196
releaseNotes:
- |

	// HTTP2 declares that the port carries HTTP/2 traffic.
	HTTP2 Instance = "HTTP2"
	// HTTPS declares that the port carries HTTPS traffic.
	HTTPS Instance = "HTTPS"
	// TCP declares the port uses TCP.
	// This is the default protocol for a service port.
	TCP Instance = "TCP"
	// TLS declares that the port carries TLS traffic.
	// TLS traffic is assumed to contain SNI as part of the handshake.
	TLS Instance = "TLS"

        # the target port is needed to avoid the DENY policy also applying to
        # traffic through the eastwest-gateway. Since all eastwest-gateway
        # traffic is TCP, the policy will attempt to be as restrictive as
        # possible and block all traffic through the eastwest-gateway.
        ports: [ "18080", "18085" ]
        paths: ["/global-deny*"]
        notPaths: ["/global-deny/allow"]

zzoehiijh1ZpZuJ1-SzuVVupenv8r5yuCaFshs/edit#heading=h.dwbqvwmg6ud3))

When a ztunnel receives traffic (authenticated or not) from a workload, it will forward that traffic to the Waypoint proxy **after** applying any `TRANSPORT` layer policies (i.e. `Authorization`s). Thus, if the destination workload has at least the equivalent of a `STRICT` `PeerAuthentication`, unauthenticated traffic will be rejected before it reaches the Waypoint proxy. If the effective policy is `PERMISSIVE` (the default),...