{"record":{"id":"4f1e279a4be36910","repo":"grpc/grpc-java","slug":"listener-proto-getname-with-invalid-traffic-d","errorCode":null,"errorMessage":"Listener ${proto.getName()} with invalid traffic direction: ${trafficDirection}","messagePattern":"Listener (.+?) with invalid traffic direction: (.+?)","errorType":"validation","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsListenerResource.java","lineNumber":152,"sourceCode":"      throws ResourceInvalidException {\n    Set<String> certProviderInstances = null;\n    if (args.getBootstrapInfo() != null && args.getBootstrapInfo().certProviders() != null) {\n      certProviderInstances = args.getBootstrapInfo().certProviders().keySet();\n    }\n    return LdsUpdate.forTcpListener(parseServerSideListener(proto,\n        (TlsContextManager) args.getSecurityConfig(),\n        filterRegistry, certProviderInstances, args));\n  }\n\n  @VisibleForTesting\n  static EnvoyServerProtoData.Listener parseServerSideListener(\n      Listener proto, TlsContextManager tlsContextManager,\n      FilterRegistry filterRegistry, Set<String> certProviderInstances, XdsResourceType.Args args)\n      throws ResourceInvalidException {\n    TrafficDirection trafficDirection = proto.getTrafficDirection();\n    if (!trafficDirection.equals(TrafficDirection.INBOUND)\n        && !trafficDirection.equals(TrafficDirection.UNSPECIFIED)) {\n      throw new ResourceInvalidException(\n          \"Listener \" + proto.getName() + \" with invalid traffic direction: \" + trafficDirection);\n    }\n    if (!proto.getListenerFiltersList().isEmpty()) {\n      throw new ResourceInvalidException(\n          \"Listener \" + proto.getName() + \" cannot have listener_filters\");\n    }\n    if (proto.hasUseOriginalDst()) {\n      throw new ResourceInvalidException(\n          \"Listener \" + proto.getName() + \" cannot have use_original_dst set to true\");\n    }\n\n    String address = null;\n    SocketAddress socketAddress = null;\n    if (proto.getAddress().hasSocketAddress()) {\n      socketAddress = proto.getAddress().getSocketAddress();\n      address = socketAddress.getAddress();\n      if (address.isEmpty()) {\n        throw new ResourceInvalidException(\"Invalid address: Empty address is not allowed.\");","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsListenerResource.java#L134-L170","documentation":"When gRPC parses a server-side Listener (for server-side xDS / HTTP filter config), it requires traffic_direction to be INBOUND or UNSPECIFIED. Any other direction (e.g. OUTBOUND) is rejected with this ResourceInvalidException naming the listener.","triggerScenarios":"A Listener resource intended for server-side consumption arrives with traffic_direction = OUTBOUND (or another non-INBOUND value); parseServerSideListener throws and the LDS update is NACKed.","commonSituations":"Control plane reuses an outbound listener config for a gRPC server workload; Istio sidecar resources with wrong directionality applied to a server port; copy-pasted Envoy configs keeping OUTBOUND direction.","solutions":["Set the Listener's traffic_direction to INBOUND (or leave it UNSPECIFIED) on the management server for server workloads","Separate inbound and outbound listener resources so outbound ones are never sent to server-side subscriptions","Check the control plane's workload/port direction labeling (e.g. Istio sidecar scope) and fix the mismatch","Re-push the corrected Listener so the client ACKs"],"exampleFix":"// before\nlistener { name: \"inbound-9090\" traffic_direction: OUTBOUND ... }\n// after\nlistener { name: \"inbound-9090\" traffic_direction: INBOUND ... }","handlingStrategy":"validation","validationCode":"// Control-plane side: server-side listeners must be INBOUND/UNSPECIFIED\nio.envoyproxy.envoy.config.core.v3.TrafficDirection dir = listener.getTrafficDirection();\nif (!dir.equals(io.envoyproxy.envoy.config.core.v3.TrafficDirection.INBOUND)\n    && !dir.equals(io.envoyproxy.envoy.config.core.v3.TrafficDirection.UNSPECIFIED)) {\n  throw new IllegalArgumentException(\"Listener \" + listener.getName()\n      + \" with invalid traffic direction: \" + dir);\n}","typeGuard":null,"tryCatchPattern":"// Client side: catch direction mismatch via watcher error\n@Override public void onError(Status error) {\n  if (error.getDescription().contains(\"with invalid traffic direction\")) {\n    logger.log(WARNING, \"Server listener sent with wrong direction: \" + error.getDescription());\n  }\n}","preventionTips":["Generate server workloads' listeners with traffic_direction INBOUND","Keep outbound listeners on separate resource names/subscriptions from server-side LDS","Audit control-plane direction labeling per workload port","NACK-aware CI: run gRPC xDS interop tests against generated configs"],"tags":["grpc","xds","lds","traffic-direction","server-side"],"backgroundTag":"invalid-enum-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}