Common network matching inputs (proto)

extensions.matching.common_inputs.network.v3.DestinationIPInput

[extensions.matching.common_inputs.network.v3.DestinationIPInput proto]

Specifies that matching should be performed by the destination IP address.

This extension has the qualified name envoy.matching.inputs.destination_ip

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension categories:

This extension must be configured with one of the following type URLs:

extensions.matching.common_inputs.network.v3.DestinationPortInput

[extensions.matching.common_inputs.network.v3.DestinationPortInput proto]

Specifies that matching should be performed by the destination port.

This extension has the qualified name envoy.matching.inputs.destination_port

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension categories:

This extension must be configured with one of the following type URLs:

extensions.matching.common_inputs.network.v3.SourceIPInput

[extensions.matching.common_inputs.network.v3.SourceIPInput proto]

Specifies that matching should be performed by the source IP address.

This extension has the qualified name envoy.matching.inputs.source_ip

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension categories:

This extension must be configured with one of the following type URLs:

extensions.matching.common_inputs.network.v3.SourcePortInput

[extensions.matching.common_inputs.network.v3.SourcePortInput proto]

Specifies that matching should be performed by the source port.

This extension has the qualified name envoy.matching.inputs.source_port

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension categories:

This extension must be configured with one of the following type URLs:

extensions.matching.common_inputs.network.v3.DirectSourceIPInput

[extensions.matching.common_inputs.network.v3.DirectSourceIPInput proto]

Input that matches by the directly connected source IP address (this will only be different from the source IP address when using a listener filter that overrides the source address, such as the Proxy Protocol listener filter).

This extension has the qualified name envoy.matching.inputs.direct_source_ip

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension categories:

This extension must be configured with one of the following type URLs:

extensions.matching.common_inputs.network.v3.SourceTypeInput

[extensions.matching.common_inputs.network.v3.SourceTypeInput proto]

Input that matches by the source IP type. Specifies the source IP match type. The values include:

  • local - matches a connection originating from the same host,

This extension has the qualified name envoy.matching.inputs.source_type

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension categories:

This extension must be configured with one of the following type URLs:

extensions.matching.common_inputs.network.v3.ServerNameInput

[extensions.matching.common_inputs.network.v3.ServerNameInput proto]

Input that matches by the requested server name (e.g. SNI in TLS).

TLS Inspector provides the requested server name based on SNI, when TLS protocol is detected.

This extension has the qualified name envoy.matching.inputs.server_name

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension categories:

This extension must be configured with one of the following type URLs:

extensions.matching.common_inputs.network.v3.TransportProtocolInput

[extensions.matching.common_inputs.network.v3.TransportProtocolInput proto]

Input that matches by the transport protocol.

Suggested values include:

This extension has the qualified name envoy.matching.inputs.transport_protocol

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

This extension must be configured with one of the following type URLs:

extensions.matching.common_inputs.network.v3.ApplicationProtocolInput

[extensions.matching.common_inputs.network.v3.ApplicationProtocolInput proto]

List of quoted and comma-separated requested application protocols. The list consists of a single negotiated application protocol once the network stream is established.

Examples:

  • 'h2','http/1.1'

  • 'h2c'

Suggested values in the list include:

Attention

Currently, TLS Inspector provides application protocol detection based on the requested ALPN values.

However, the use of ALPN is pretty much limited to the HTTP/2 traffic on the Internet, and matching on values other than h2 is going to lead to a lot of false negatives, unless all connecting clients are known to use ALPN.

This extension has the qualified name envoy.matching.inputs.application_protocol

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

This extension must be configured with one of the following type URLs:

extensions.matching.common_inputs.network.v3.FilterStateInput

[extensions.matching.common_inputs.network.v3.FilterStateInput proto]

Input that matches by a specific filter state key. The value of the provided filter state key will be the raw string representation of the filter state object

This extension has the qualified name envoy.matching.inputs.filter_state

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

This extension must be configured with one of the following type URLs:

{
  "key": ...
}
key

(string, REQUIRED)