Envoy currently supports SO_ORIGINAL_DST and proxy protocol version 1 for supplying connection metadata (original connection destination, and source in case of proxy protocol). If both are configured, it is somewhat unclear what should be done, even though current implementation will search for alternative listener based on the SO_ORIGINAL_DST, but then use remote and destination information from proxy protocol when creating the connection.

It would be nice to make the listener optional functionality like these pluggable, allowing a listener to be configured with an explicitly specified set of "pre-connection filters" that process the incoming connection before a Connection object is created. This would also allow plugging in new connection metadata providers without adding new hard-wired options into the Listener implementation. Each "pre-connection" filter should have their own json configuration so that the main Listener configuration would not need to be extended for new kinds of metadata providers.

Further integrating SSL/TLS termination into this new plugin framework could allow SSL/TLS metadata to be provided from proxy protocol version 2 TLVs for Envoy logging and access control purposes.

This is not a "feature request" as such but intended to find out if any thoughts on this front are out there.