lds: Add listener_filter_chain.

api/lds.proto

@@ -103,6 +103,13 @@ message Listener {
 
   // The type of draining to perform at a listener-wide level.
   DrainType drain_type = 8;
+
+  // Listener filters have the opportunity to manipulate and augment the connection metadata that
+  // is used in connection filter chain matching, for example. These filters are run before any in
+  // :ref:`filter_chains <envoy_api_field_Listener.filter_chains>`. Order matters as the filters
+  // are processed sequentially right after a socket has been accepted by the listener, and before
+  // a connection is created.
+  repeated ListenerFilter listener_filters = 9;
 }
 
 message Filter {
@@ -205,3 +212,17 @@ message FilterChain {
   // [#not-implemented-hide:] See base.TransportSocket description.
   TransportSocket transport_socket = 6;
 }
+
+message ListenerFilter {
+  // The name of the filter to instantiate. The name must match a supported
+  // filter. The built-in filters are:
+  //
+  // [#comment:TODO(mattklein123): Auto generate the following list]
+  // * :ref:`envoy.original_dst <config_listener_filters_original_dst>`
+  // * :ref:`envoy.proxy_protocol <config_listener_filters_proxy_protocol>`
+  string name = 1 [(validate.rules).string.min_bytes = 1];
+
+  // Filter specific configuration which depends on the filter being
+  // instantiated. See the supported filters for further documentation.
+  google.protobuf.Struct config = 2;
+}

docs/root/configuration/listener_filters/original_dst_filter.rst

@@ -0,0 +1,10 @@
+.. _config_network_filters_echo:
+
+Echo
+====
+
+The echo is a trivial network filter mainly meant to demonstrate the network filter API. If
+installed it will echo (write) all received data back to the connected downstream client.
+
+* :ref:`v1 API reference <config_network_filters_echo_v1>`
+* :ref:`v2 API reference <envoy_api_field_Filter.name>`

docs/root/configuration/listener_filters/proxy_protocol_filter.rst

@@ -0,0 +1,13 @@
+.. _config_listener_filters_proxy_protocol:
+
+Proxy Protocol
+==============
+
+Proxy protocol filter processes the `PROXY protocol V1
+<http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt>`_ header added by some load balancers
+(e.g., AWL ELB) on new connections. With this the listener will assume that that remote address of
+the connection is the one specified in the header. If this filter is not used, Envoy will use the
+physical peer address of the connection as the remote address. Note that if the proxy protocol
+header is present, further handling of the connection may fail if this filter is not used.
+
+* :ref:`v2 API reference <envoy_api_field_ListenerFilter.name>`