// Without tls inspector, Envoy would not read the ALPN in the TLS handshake
		// HTTP inspector still may set it though
		input.Alpn = ""
	}

	// Apply listener filters
	if hasFilterOnPort(l, xdsfilters.HTTPInspector.Name, input.Port) {
		if alpn := protocolToAlpn(input.Protocol); alpn != "" && input.TLS == Plaintext {
			input.Alpn = alpn
		}
	}

		ListenerFilters: []*listener.ListenerFilter{
			xdsfilters.OriginalDestination,
			// TODO: This may affect the data path due to the server-first protocols triggering a time-out. Need exception filter.
			xdsfilters.HTTPInspector,
		},
		TrafficDirection: core.TrafficDirection_INBOUND,
		FilterChains:     chains,
		FilterChainMatcher: &matcher.Matcher{
			MatcherType: &matcher.Matcher_MatcherTree_{

	if needTLSInspector || needHTTPInspector {
		l.ListenerFilters = append(l.ListenerFilters, xdsfilters.TLSInspector)
	}

	if needHTTPInspector {
		l.ListenerFilters = append(l.ListenerFilters, xdsfilters.HTTPInspector)
		// Enable timeout only if they configure it and we have an HTTP inspector.
		// This is really unsafe, so hopefully not used...
		l.ListenerFiltersTimeout = builder.push.Mesh.ProtocolDetectionTimeout
	} else {

	t.Helper()
	if len(lfilters) != 2 {
		t.Fatalf("expected %d listener filter, found %d", 2, len(lfilters))
	}
	if lfilters[0].Name != wellknown.TLSInspector ||
		lfilters[1].Name != wellknown.HTTPInspector {
		t.Fatalf("expected listener filters not found, got %v", lfilters)
	}
}

func verifyHTTPFilterChainMatch(t *testing.T, fc *listener.FilterChain) {
	t.Helper()