Repository: istio/istio
File: pilot/pkg/networking/core/listener_waypoint.go (Go)

Code before:
					Input: match.AuthorityFilterStateInput,
					TreeType: &matcher.Matcher_MatcherTree_ExactMatchMap{
						ExactMatchMap: svcHostnameMap,
					},
				},
			},
		}
	}

	l := &listener.Listener{
		Name:              MainInternalName,
		ListenerSpecifier: &listener.Listener_InternalListener{InternalListener: &listener.Listener_InternalListenerConfig{}},
		ListenerFilters: []*listener.ListenerFilter{
			xdsfilters.OriginalDestination,
			httpInspector,
		},
		TrafficDirection:   core.TrafficDirection_INBOUND,
		FilterChains:       chains,
		FilterChainMatcher: primaryMatcher,
	}

	if tlsInspector != nil {
		l.ListenerFilters = append(l.ListenerFilters, tlsInspector)
	}

	if features.EnableAmbientMultiNetwork && isEastWestGateway {
		// If there are no filter chains, populate a dummy one that never matches
		if len(l.FilterChains) == 0 {
			l.FilterChains = []*listener.FilterChain{{
				Name: model.VirtualInboundBlackholeFilterChainName,
				Filters: []*listener.Filter{{
					Name: wellknown.TCPProxy,
					ConfigType: &listener.Filter_TypedConfig{TypedConfig: protoconv.MessageToAny(&tcp.TcpProxy{
						StatPrefix:       util.BlackHoleCluster,
						ClusterSpecifier: &tcp.TcpProxy_Cluster{Cluster: util.BlackHoleCluster},
					})},
				}},
			}}
		}
	}

	accessLogBuilder.setListenerAccessLog(lb.push, lb.node, l, istionetworking.ListenerClassSidecarInbound)
	return l
}

func buildWaypointConnectOriginateListener(push *model.PushContext, proxy *model.Proxy) *listener.Listener {
	return buildConnectOriginateListener(push, proxy, istionetworking.ListenerClassSidecarInbound)
}

func buildWaypointForwardInnerConnectListener(push *model.PushContext, proxy *model.Proxy) *listener.Listener {
	return buildForwardInnerConnectListener(push, proxy, istionetworking.ListenerClassSidecarInbound)

Review comment (suggestion):
It's slightly unclear at a glance what this one is doing

```suggestion
        // take headers from the response and put them into filter state for consumption by WaypointListenerBaggagePeerMetadata
		tcpProxy.TunnelingConfig.PropagateResponseHeaders = true
```

Code after:
	tcpProxy := &tcp.TcpProxy{
		StatPrefix:       clusterName,
		ClusterSpecifier: &tcp.TcpProxy_Cluster{Cluster: clusterName},
	}
	if tunnel {
		tcpProxy.TunnelingConfig = &tcp.TcpProxy_TunnelingConfig{
			Hostname: "%DOWNSTREAM_LOCAL_ADDRESS%",
		}
		// Set access logs. These are filtered down to only connection establishment errors, to avoid double logs in most cases.
		accessLogBuilder.setHboneOriginationAccessLog(push, proxy, tcpProxy, class)
	} else {
		accessLogBuilder.setTCPAccessLogWithFilter(push, proxy, tcpProxy, class, nil, &accesslog.AccessLogFilter{
			FilterSpecifier: &accesslog.AccessLogFilter_ResponseFlagFilter{
				// UF: upstream failure, we couldn't connect. This is important to log at this layer, since the error details
				// are lost otherwise.
				ResponseFlagFilter: &accesslog.ResponseFlagFilter{Flags: []string{"UF"}},
			},
		})
	}

	var filters []*listener.Filter

	if features.EnableAmbientBaggage && tunnel {
		// Make headers from the response available in the filter state for
		// consumption by WaypointListenerBaggagePeerMetadata (peer_metadata filter).
		tcpProxy.TunnelingConfig.PropagateResponseHeaders = true
		tcpProxy.TunnelingConfig.HeadersToAdd = []*core.HeaderValueOption{
			{
				AppendAction: core.HeaderValueOption_OVERWRITE_IF_EXISTS_OR_ADD,
				Header: &core.HeaderValue{
					Key:   "baggage",
					Value: "%FILTER_STATE(io.istio.baggage:PLAIN)%",
				},
			},
		}
		filters = []*listener.Filter{xdsfilters.WaypointListenerBaggagePeerMetadata}
	}

	tcp := &listener.Filter{
		Name: wellknown.TCPProxy,
		ConfigType: &listener.Filter_TypedConfig{
			TypedConfig: protoconv.MessageToAny(tcpProxy),
		},
	}
	filters = append(filters, tcp)

	l := &listener.Listener{
		Name:              clusterName,
		UseOriginalDst:    wrappers.Bool(false),
		ListenerSpecifier: &listener.Listener_InternalListener{InternalListener: &listener.Listener_InternalListenerConfig{}},
		ListenerFilters: []*listener.ListenerFilter{