Repository: envoyproxy/envoy
File: api/envoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto (Protocol Buffers)

Code before:
  // Whether to automatically close connections after processing reverse tunnel requests.
  //
  // * When set to ``true``, connections are closed after acceptance or rejection.
  // * When set to ``false``, connections remain open for potential reuse.
  //
  // Defaults to ``false``.
  bool auto_close_connections = 2;

  // HTTP path to match for reverse tunnel requests.
  // If not specified, defaults to ``/reverse_connections/request``.
  string request_path = 3 [(validate.rules).string = {min_len: 1 max_len: 255 ignore_empty: true}];

  // HTTP method to match for reverse tunnel requests.
  // If not specified (``METHOD_UNSPECIFIED``), this defaults to ``GET``.
  config.core.v3.RequestMethod request_method = 4 [(validate.rules).enum = {defined_only: true}];

  // Optional validation configuration for node and cluster identifiers.
  // If specified, the filter validates the ``x-envoy-reverse-tunnel-node-id`` and
  // ``x-envoy-reverse-tunnel-cluster-id`` headers against expected values extracted
  // using format strings. Requests that fail validation are rejected with HTTP ``403 Forbidden``.
  Validation validation = 5;

  // Optional name for this reverse tunnel filter.
  // This can be used to identify the cluster and for cluster matching validation.
  // If not specified, no name is assigned to the filter.
  string name = 6 [(validate.rules).string = {max_len: 255 ignore_empty: true}];

  // Whether to enforce that the ``x-envoy-reverse-tunnel-upstream-cluster-name`` header
  // matches the configured reverse tunnel filter name.
  // When enabled, incoming reverse tunnel requests must have an upstream cluster name
  // that matches the ``name`` field. Requests with mismatched cluster names are rejected
  // with HTTP ``400 Bad Request``.
  // This field is only effective when ``name`` is configured.
  // Defaults to ``false``.
  bool enforce_cluster_match = 7;
}


Review comment (bug):
High-level question: where is this being used? is it just for debugging/logging?
If this is used for stats, should stats_prefix be used instead?

Code after:
  // Whether to automatically close connections after processing reverse tunnel requests.
  //
  // * When set to ``true``, connections are closed after acceptance or rejection.
  // * When set to ``false``, connections remain open for potential reuse.
  //
  // Defaults to ``false``.
  bool auto_close_connections = 2;

  // HTTP path to match for reverse tunnel requests.
  // If not specified, defaults to ``/reverse_connections/request``.
  string request_path = 3 [(validate.rules).string = {min_len: 1 max_len: 255 ignore_empty: true}];

  // HTTP method to match for reverse tunnel requests.
  // If not specified (``METHOD_UNSPECIFIED``), this defaults to ``GET``.
  config.core.v3.RequestMethod request_method = 4 [(validate.rules).enum = {defined_only: true}];

  // Optional validation configuration for node and cluster identifiers.
  // If specified, the filter validates the ``x-envoy-reverse-tunnel-node-id`` and
  // ``x-envoy-reverse-tunnel-cluster-id`` headers against expected values extracted
  // using format strings. Requests that fail validation are rejected with HTTP ``403 Forbidden``.
  Validation validation = 5;

  // Required cluster name for validating reverse tunnel connection initiations.
  // When set, the filter validates that the upstream cluster of the initiator envoy matches this name
  // via ``x-envoy-reverse-tunnel-upstream-cluster-name`` header. Connections with mismatched or missing
  // cluster names are rejected with HTTP ``400 Bad Request``. When empty, no cluster name validation is performed.
  string required_cluster_name = 6 [(validate.rules).string = {max_len: 255 ignore_empty: true}];
}