<commit_before>.. _config_listener_filters_tls_inspector:

TLS Inspector
=============

TLS Inspector listener filter allows detecting whether the transport appears to be
TLS or plaintext, and if it is TLS, it detects the
`Server Name Indication <https://en.wikipedia.org/wiki/Server_Name_Indication>`_
and/or `Application-Layer Protocol Negotiation
<https://en.wikipedia.org/wiki/Application-Layer_Protocol_Negotiation>`_
from the client. This can be used to select a
:ref:`FilterChain <envoy_v3_api_msg_config.listener.v3.FilterChain>` via the
:ref:`server_names <envoy_v3_api_field_config.listener.v3.FilterChainMatch.server_names>` and/or
:ref:`application_protocols <envoy_v3_api_field_config.listener.v3.FilterChainMatch.application_protocols>`
of a :ref:`FilterChainMatch <envoy_v3_api_msg_config.listener.v3.FilterChainMatch>`.

* :ref:`SNI <faq_how_to_setup_sni>`
* :ref:`v3 API reference <envoy_v3_api_field_config.listener.v3.ListenerFilter.name>`
* This filter may be configured with the name *envoy.filters.listener.tls_inspector* or
  *type.googleapis.com/envoy.extensions.listeners.tls_inspector.v3.TlsInspector* as the
  `type_url <https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Any.FIELDS.string.google.protobuf.Any.type_url>`_.

Example
-------

A sample filter configuration could be:

.. code-block:: yaml

  listener_filters:
  - name: "envoy.filters.listener.tls_inspector"
    typed_config: {}

Or by specifying the `type_url <https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Any.FIELDS.string.google.protobuf.Any.type_url>`_
of the *typed_config*:

.. code-block:: yaml

  listener_filters:
  - name: "tls_inspector"
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.listeners.tls_inspector.v3.TlsInspector

Statistics
----------
<commit_msg>docs: fix type_url for v3.TlsInspector (#16290)<commit_after>.. _config_listener_filters_tls_inspector:

TLS Inspector
=============

TLS Inspector listener filter allows detecting whether the transport appears to be
TLS or plaintext, and if it is TLS, it detects the
`Server Name Indication <https://en.wikipedia.org/wiki/Server_Name_Indication>`_
and/or `Application-Layer Protocol Negotiation
<https://en.wikipedia.org/wiki/Application-Layer_Protocol_Negotiation>`_
from the client. This can be used to select a
:ref:`FilterChain <envoy_v3_api_msg_config.listener.v3.FilterChain>` via the
:ref:`server_names <envoy_v3_api_field_config.listener.v3.FilterChainMatch.server_names>` and/or
:ref:`application_protocols <envoy_v3_api_field_config.listener.v3.FilterChainMatch.application_protocols>`
of a :ref:`FilterChainMatch <envoy_v3_api_msg_config.listener.v3.FilterChainMatch>`.

* :ref:`SNI <faq_how_to_setup_sni>`
* :ref:`v3 API reference <envoy_v3_api_field_config.listener.v3.ListenerFilter.name>`
* This filter may be configured with the name *envoy.filters.listener.tls_inspector* or
  *type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector* as the
  `type_url <https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Any.FIELDS.string.google.protobuf.Any.type_url>`_.

Example
-------

A sample filter configuration could be:

.. code-block:: yaml

  listener_filters:
  - name: "envoy.filters.listener.tls_inspector"
    typed_config: {}

Or by specifying the `type_url <https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Any.FIELDS.string.google.protobuf.Any.type_url>`_
of the *typed_config*:

.. code-block:: yaml

  listener_filters:
  - name: "tls_inspector"
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector

Statistics
----------

{'fraction_non_alphanumeric': 0.12276550998948475, 'fraction_numerical': 0.008412197686645636, 'mean_word_length': 5.663747810858144, 'pattern_counts': {'":': 2, '<': 23, '<?xml version=': 0, '>': 23, 'https://': 8, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3835705', 'n_tokens_mistral': 1294, 'n_tokens_neox': 1238, 'n_words': 227}