"istio.io/istio/pkg/wellknown"
)

// redisOpTimeout is the default operation timeout for the Redis proxy filter.
var redisOpTimeout = 5 * time.Second

func buildMetadataExchangeNetworkFilters() []*listener.Filter {
	filterstack := make([]*listener.Filter, 0)
	// We add metadata exchange on inbound only; outbound is handled in cluster filter
	if features.MetadataExchange {
		filterstack = append(filterstack, xdsfilters.TCPListenerMx)
	}

func applyDynamicFilter[T controllers.ComparableObject](filter Filter, gvr schema.GroupVersionResource, ic *informerClient[T]) {
	if filter.ObjectFilter != nil {
		ic.filter = filter.ObjectFilter.Filter
		filter.ObjectFilter.AddHandler(func(added, removed sets.String) {
			ic.handlerMu.RLock()
			defer ic.handlerMu.RUnlock()
			if gvr == istiogvr.Namespace {
				// Namespace is special; we query all namespaces

									Sni:    "124",
									Filter: &networking.EnvoyFilter_ListenerMatch_FilterMatch{},
								},
							},
						},
					},
					Patch: &networking.EnvoyFilter_Patch{
						Operation: networking.EnvoyFilter_Patch_REMOVE,
					},
				},
			},
		}, error: "Envoy filter: filter match has no name to match on"},
		{name: "listener with sub filter match and invalid applyTo", in: &networking.EnvoyFilter{

        given:
        def queryService = createQueryServiceWithInstallations(versionRange(8, 12))

        when:
        def filter = createSpec(JavaLanguageVersion.of(versionToFind))
        def toolchain = queryService.findMatchingToolchain(filter)

        then:
        toolchain.languageVersion == JavaVersion.toVersion(versionToFind)

			in: "*",
			want: `
        and_ids:
          ids:
          - metadata:
              filter: envoy.filters.http.jwt_authn
              path:
              - key: payload
              - key: iss
              value:
                string_match:
                  safe_regex: {regex: .+}
          - metadata:
              filter: envoy.filters.http.jwt_authn
              path:
              - key: payload

			customPlugins: &v1.Plugins{
				Filter: v1.PluginSet{
					Enabled: []v1.Plugin{
						{Name: "CustomPlugin"},
					},
				},
			},
			defaultPlugins: &v1.Plugins{
				Filter: v1.PluginSet{
					Enabled: []v1.Plugin{
						{Name: "DefaultPlugin1"},
						{Name: "DefaultPlugin2"},
					},
				},
			},
			expectedPlugins: &v1.Plugins{
				Filter: v1.PluginSet{
					Enabled: []v1.Plugin{

		return false
	}

	return fcMatch.Filter != nil
}

// We assume that the parent listener and filter chain have already been matched
func networkFilterMatch(filter *listener.Filter, cp *model.EnvoyFilterConfigPatchWrapper) bool {
	if !hasNetworkFilterMatch(cp) {
		return true
	}

	return cp.Match.GetListener().FilterChain.Filter.Name == filter.Name
}

                Map.of("_default", List.of("QUERY1")),...

        return findFirst(source, filter) != null;
    }

    public static <T> boolean any(T[] source, Spec<? super T> filter) {
        return findFirst(source, filter) != null;
    }

    public static <T> Set<T> filter(Set<? extends T> set, Spec<? super T> filter) {
        return filter(set, new LinkedHashSet<T>(), filter);
    }

                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: rule[0]-from[0]-requestPrincipal[1]
                    - metadata:
                        filter: envoy.filters.http.jwt_authn