{"record":{"id":"4e50364ba261aa78","repo":"grpc/grpc-java","slug":"listener-proto-getname-cannot-have-listener-f","errorCode":null,"errorMessage":"Listener ${proto.getName()} cannot have listener_filters","messagePattern":"Listener (.+?) cannot have listener_filters","errorType":"validation","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsListenerResource.java","lineNumber":156,"sourceCode":"    }\n    return LdsUpdate.forTcpListener(parseServerSideListener(proto,\n        (TlsContextManager) args.getSecurityConfig(),\n        filterRegistry, certProviderInstances, args));\n  }\n\n  @VisibleForTesting\n  static EnvoyServerProtoData.Listener parseServerSideListener(\n      Listener proto, TlsContextManager tlsContextManager,\n      FilterRegistry filterRegistry, Set<String> certProviderInstances, XdsResourceType.Args args)\n      throws ResourceInvalidException {\n    TrafficDirection trafficDirection = proto.getTrafficDirection();\n    if (!trafficDirection.equals(TrafficDirection.INBOUND)\n        && !trafficDirection.equals(TrafficDirection.UNSPECIFIED)) {\n      throw new ResourceInvalidException(\n          \"Listener \" + proto.getName() + \" with invalid traffic direction: \" + trafficDirection);\n    }\n    if (!proto.getListenerFiltersList().isEmpty()) {\n      throw new ResourceInvalidException(\n          \"Listener \" + proto.getName() + \" cannot have listener_filters\");\n    }\n    if (proto.hasUseOriginalDst()) {\n      throw new ResourceInvalidException(\n          \"Listener \" + proto.getName() + \" cannot have use_original_dst set to true\");\n    }\n\n    String address = null;\n    SocketAddress socketAddress = null;\n    if (proto.getAddress().hasSocketAddress()) {\n      socketAddress = proto.getAddress().getSocketAddress();\n      address = socketAddress.getAddress();\n      if (address.isEmpty()) {\n        throw new ResourceInvalidException(\"Invalid address: Empty address is not allowed.\");\n      }\n      switch (socketAddress.getPortSpecifierCase()) {\n        case NAMED_PORT:\n          throw new ResourceInvalidException(\"NAMED_PORT is not supported in gRPC.\");","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsListenerResource.java#L138-L174","documentation":"gRPC server-side Listener parsing does not support Envoy's listener_filters (used e.g. for TLS inspector). If a Listener resource contains any listener_filters, it is rejected with this error naming the listener.","triggerScenarios":"A Listener sent to a gRPC server via LDS has a non-empty listener_filters list (commonly listener_filters containing envoy.filters.listener.tls_inspector); parseServerSideListener throws before further processing.","commonSituations":"Envoy-derived configurations (e.g. from an Envoy-based control plane) that rely on tls_inspector to sniff protocol; Istio/other meshes emitting their standard listener filter chain to gRPC server workloads; copy-pasted Envoy static configs.","solutions":["Remove listener_filters from Listeners targeted at gRPC servers (gRPC handles TLS via its own security config)","Reconfigure the control plane so gRPC server listeners contain only filter_chains gRPC supports","If TLS inspection is required, rely on gRPC's tls_context/chain-level config instead of Envoy filter chains","Re-push the corrected Listener resource so the update is ACKed"],"exampleFix":"// before\nlistener { name: \"inbound-9090\" listener_filters { name: \"envoy.filters.listener.tls_inspector\" } ... }\n// after\nlistener { name: \"inbound-9090\" ... }","handlingStrategy":"validation","validationCode":"// Control-plane side: reject listener_filters before publishing to gRPC servers\nif (!listener.getListenerFiltersList().isEmpty()) {\n  throw new IllegalArgumentException(\"Listener \" + listener.getName()\n      + \" cannot have listener_filters\");\n}","typeGuard":null,"tryCatchPattern":"// Client side: detect unsupported listener_filters from watcher errors\n@Override public void onError(Status error) {\n  if (error.getDescription().contains(\"cannot have listener_filters\")) {\n    logger.log(WARNING, \"Listener uses unsupported listener_filters: \" + error.getDescription());\n  }\n}","preventionTips":["Strip Envoy-only listener filters (e.g. tls_inspector) from listeners sent to gRPC servers","Handle TLS via gRPC security configuration (tls_context/SDS), not listener filters","Template server listeners specifically for gRPC rather than reusing Envoy templates","Run xDS interop/conformance tests on generated listener configs"],"tags":["grpc","xds","lds","listener-filters","unsupported-feature"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}