{"record":{"id":"55cbdc1ebae03337","repo":"grpc/grpc-java","slug":"listener-proto-getname-cannot-have-use-origin","errorCode":null,"errorMessage":"Listener ${proto.getName()} cannot have use_original_dst set to true","messagePattern":"Listener (.+?) cannot have use_original_dst set to true","errorType":"validation","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsListenerResource.java","lineNumber":160,"sourceCode":"  }\n\n  @VisibleForTesting\n  static EnvoyServerProtoData.Listener parseServerSideListener(\n      Listener proto, TlsContextManager tlsContextManager,\n      FilterRegistry filterRegistry, Set<String> certProviderInstances, XdsResourceType.Args args)\n      throws ResourceInvalidException {\n    TrafficDirection trafficDirection = proto.getTrafficDirection();\n    if (!trafficDirection.equals(TrafficDirection.INBOUND)\n        && !trafficDirection.equals(TrafficDirection.UNSPECIFIED)) {\n      throw new ResourceInvalidException(\n          \"Listener \" + proto.getName() + \" with invalid traffic direction: \" + trafficDirection);\n    }\n    if (!proto.getListenerFiltersList().isEmpty()) {\n      throw new ResourceInvalidException(\n          \"Listener \" + proto.getName() + \" cannot have listener_filters\");\n    }\n    if (proto.hasUseOriginalDst()) {\n      throw new ResourceInvalidException(\n          \"Listener \" + proto.getName() + \" cannot have use_original_dst set to true\");\n    }\n\n    String address = null;\n    SocketAddress socketAddress = null;\n    if (proto.getAddress().hasSocketAddress()) {\n      socketAddress = proto.getAddress().getSocketAddress();\n      address = socketAddress.getAddress();\n      if (address.isEmpty()) {\n        throw new ResourceInvalidException(\"Invalid address: Empty address is not allowed.\");\n      }\n      switch (socketAddress.getPortSpecifierCase()) {\n        case NAMED_PORT:\n          throw new ResourceInvalidException(\"NAMED_PORT is not supported in gRPC.\");\n        case PORT_VALUE:\n          address = address + \":\" + socketAddress.getPortValue();\n          break;\n        default:","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsListenerResource.java#L142-L178","documentation":"gRPC server-side Listener parsing rejects Listener resources with use_original_dst set to true, since original-destination redirection is an Envoy-side feature gRPC does not implement. The Listener is rejected with this error.","triggerScenarios":"An LDS Listener for a gRPC server has use_original_dst: true (often present in configs generated for transparent-proxy / iptables interception setups); parseServerSideListener throws.","commonSituations":"Mesh setups using transparent proxying (iptables REDIRECT with original_dst) whose control plane emits use_original_dst on server listeners; copy-pasted Envoy transparent-proxy configs; Istio-style sidecar configs applied to gRPC servers.","solutions":["Remove or set use_original_dst: false on Listeners delivered to gRPC servers","Configure the control plane to emit plain socket-address listeners for gRPC workloads","If transparent proxying is required, terminate original-dst handling in an Envoy proxy in front of the gRPC server instead","Re-push the corrected Listener so gRPC ACKs the update"],"exampleFix":"// before\nlistener { name: \"inbound-9090\" use_original_dst { value: true } ... }\n// after\nlistener { name: \"inbound-9090\" ... }","handlingStrategy":"validation","validationCode":"// Control-plane side: reject use_original_dst before publishing to gRPC servers\nif (listener.hasUseOriginalDst()) {\n  throw new IllegalArgumentException(\"Listener \" + listener.getName()\n      + \" cannot have use_original_dst set to true\");\n}","typeGuard":null,"tryCatchPattern":"// Client side: surface unsupported use_original_dst from watcher errors\n@Override public void onError(Status error) {\n  if (error.getDescription().contains(\"use_original_dst\")) {\n    logger.log(WARNING, \"Listener uses unsupported use_original_dst: \" + error.getDescription());\n  }\n}","preventionTips":["Clear use_original_dst on listeners generated for gRPC workloads","Handle transparent-proxy original-dst in an upstream Envoy hop instead of gRPC","Keep gRPC-specific listener templates separate from Envoy transparent-proxy templates","Include listener configs in control-plane config validation tests"],"tags":["grpc","xds","lds","original-dst","unsupported-feature"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}