const (
    // ListenerProtocolUnknown is an unknown type of listener.
    ListenerProtocolUnknown = iota
    // ListenerProtocolTCP is a TCP listener.
    ListenerProtocolTCP
    // ListenerProtocolHTTP is an HTTP listener.
    ListenerProtocolHTTP
    // ListenerProtocolAuto enables auto protocol detection
    ListenerProtocolAuto

    // Authn is the name of the authentication plugin passed through the command line
    Authn = "authn"
    // Authz is the name of the rbac plugin passed through the command line
    Authz = "authz"
    // Health is the name of the health plugin passed through the command line
    Health = "health"
    // Mixer is the name of the mixer plugin passed through the command line
    Mixer = "mixer"
)

type FilterChain struct {
    // FilterChainMatch is the match used to select the filter chain.
    FilterChainMatch *listener.FilterChainMatch
    // TLSContext is the TLS settings for this filter chains.
    TLSContext *auth.DownstreamTlsContext
    // ListenerFilters are the filters needed for the whole listener, not particular to this
    // filter chain.
    ListenerFilters []*listener.ListenerFilter
    // ListenerProtocol indicates whether this filter chain is for HTTP or TCP
    // Note that HTTP filter chains can also have network filters
    ListenerProtocol ListenerProtocol
    // HTTP is the set of HTTP filters for this filter chain
    HTTP []*http_conn.HttpFilter
    // TCP is the set of network (TCP) filters for this filter chain.
    TCP []*listener.Filter
}

type InputParams struct {
    // ListenerProtocol is the protocol/class of listener (TCP, HTTP etc.). Must be set.
    // This is valid only for the inbound listener
    // Outbound listeners could have multiple filter chains, where one filter chain could be
    // a HTTP connection manager with TLS context, while the other could be a tcp proxy with sni
    ListenerProtocol ListenerProtocol
    // ListenerCategory is the type of listener (sidecar_inbound, sidecar_outbound, gateway). Must be set
    ListenerCategory networking.EnvoyFilter_PatchContext

    // TODO: Remove me when listener match is in place
    DeprecatedListenerCategory networking.EnvoyFilter_DeprecatedListenerMatch_ListenerType

    // Env is the model environment. Must be set.
    Env *model.Environment
    // Node is the node the response is for.
    Node *model.Proxy
    // ServiceInstance is the service instance colocated with the listener (applies to sidecar).
    ServiceInstance *model.ServiceInstance
    // Service is the service colocated with the listener (applies to sidecar).
    // For outbound TCP listeners, it is the destination service.
    Service *model.Service
    // Port is the port for which the listener is being built
    // For outbound/inbound sidecars this is the service port (not endpoint port)
    // For inbound listener on gateway, this is the gateway server port
    Port *model.Port
    // Bind holds the listener IP or unix domain socket to which this listener is bound
    // if bind is using UDS, the port will be 0 with valid protocol and name
    Bind string
    // SidecarConfig holds the Sidecar CRD associated with this listener
    SidecarConfig *model.Config

    // Push holds stats and other information about the current push.
    Push *model.PushContext

    // Inbound cluster name. It's only used by newHTTPPassThroughFilterChain.
    // For other scenarios, the field is empty.
    InboundClusterName string
}

type ListenerProtocol int

type MutableObjects struct {
    // Listener is the listener being built. Must be initialized before Plugin methods are called.
    Listener *xdsapi.Listener

    // FilterChains is the set of filter chains that will be attached to Listener.
    FilterChains []FilterChain
}

type Plugin interface {
    // OnOutboundListener is called whenever a new outbound listener is added to the LDS output for a given service.
    // Can be used to add additional filters on the outbound path.
    OnOutboundListener(in *InputParams, mutable *MutableObjects) error

    // OnInboundListener is called whenever a new listener is added to the LDS output for a given service
    // Can be used to add additional filters.
    OnInboundListener(in *InputParams, mutable *MutableObjects) error

    // OnVirtualListener is called whenever a new virtual listener is added to the
    // LDS output for a given service
    // Can be used to add additional filters.
    OnVirtualListener(in *InputParams, mutable *MutableObjects) error

    // OnOutboundCluster is called whenever a new cluster is added to the CDS output.
    // This is called once per push cycle, and not for every sidecar/gateway, except for gateways with non-standard
    // operating modes.
    OnOutboundCluster(in *InputParams, cluster *xdsapi.Cluster)

    // OnInboundCluster is called whenever a new cluster is added to the CDS output.
    // Called for each sidecar
    OnInboundCluster(in *InputParams, cluster *xdsapi.Cluster)

    // OnOutboundRouteConfiguration is called whenever a new set of virtual hosts (a set of virtual hosts with routes) is
    // added to RDS in the outbound path.
    OnOutboundRouteConfiguration(in *InputParams, routeConfiguration *xdsapi.RouteConfiguration)

    // OnInboundRouteConfiguration is called whenever a new set of virtual hosts are added to the inbound path.
    OnInboundRouteConfiguration(in *InputParams, routeConfiguration *xdsapi.RouteConfiguration)

    // OnInboundFilterChains is called whenever a plugin needs to setup the filter chains, including relevant filter chain
    // configuration, like FilterChainMatch and TLSContext.
    OnInboundFilterChains(in *InputParams) []FilterChain
}