Common Network Matching Inputs

extensions.matching.common_inputs.network.v3.DestinationIPInput

[extensions.matching.common_inputs.network.v3.DestinationIPInput proto]

Specifies that matching should be performed by the destination IP address.

This extension may be referenced by the qualified name envoy.matching.inputs.destination_ip

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

extensions.matching.common_inputs.network.v3.DestinationPortInput

[extensions.matching.common_inputs.network.v3.DestinationPortInput proto]

Specifies that matching should be performed by the destination port.

This extension may be referenced by the qualified name envoy.matching.inputs.destination_port

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

extensions.matching.common_inputs.network.v3.SourceIPInput

[extensions.matching.common_inputs.network.v3.SourceIPInput proto]

Specifies that matching should be performed by the source IP address.

This extension may be referenced by the qualified name envoy.matching.inputs.source_ip

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

extensions.matching.common_inputs.network.v3.SourcePortInput

[extensions.matching.common_inputs.network.v3.SourcePortInput proto]

Specifies that matching should be performed by the source port.

This extension may be referenced by the qualified name envoy.matching.inputs.source_port

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

extensions.matching.common_inputs.network.v3.DirectSourceIPInput

[extensions.matching.common_inputs.network.v3.DirectSourceIPInput proto]

Input that matches by the directly connected source IP address (this will only be different from the source IP address when using a listener filter that overrides the source address, such as the Proxy Protocol listener filter).

This extension may be referenced by the qualified name envoy.matching.inputs.direct_source_ip

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

extensions.matching.common_inputs.network.v3.SourceTypeInput

[extensions.matching.common_inputs.network.v3.SourceTypeInput proto]

Input that matches by the source IP type. Specifies the source IP match type. The values include:

  • local - matches a connection originating from the same host,

This extension may be referenced by the qualified name envoy.matching.inputs.source_type

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

extensions.matching.common_inputs.network.v3.ServerNameInput

[extensions.matching.common_inputs.network.v3.ServerNameInput proto]

Input that matches by the requested server name (e.g. SNI in TLS).

TLS Inspector provides the requested server name based on SNI, when TLS protocol is detected.

This extension may be referenced by the qualified name envoy.matching.inputs.server_name

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

extensions.matching.common_inputs.network.v3.TransportProtocolInput

[extensions.matching.common_inputs.network.v3.TransportProtocolInput proto]

Input that matches by the transport protocol.

Suggested values include:

This extension may be referenced by the qualified name envoy.matching.inputs.transport_protocol

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

extensions.matching.common_inputs.network.v3.ApplicationProtocolInput

[extensions.matching.common_inputs.network.v3.ApplicationProtocolInput proto]

List of quoted and comma-separated requested application protocols. The list consists of a single negotiated application protocol once the network stream is established.

Examples:

  • 'h2','http/1.1'

  • 'h2c'`

Suggested values in the list include:

Attention

Currently, TLS Inspector provides application protocol detection based on the requested ALPN values.

However, the use of ALPN is pretty much limited to the HTTP/2 traffic on the Internet, and matching on values other than h2 is going to lead to a lot of false negatives, unless all connecting clients are known to use ALPN.

This extension may be referenced by the qualified name envoy.matching.inputs.application_protocol

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category: