Limit data read from socket or pass back data the socket needs (StartTLS)

I'm not overly sure this is a new feature or a bug in the way the system currently works with the StartTLS socket.

This issue occurred while handling MySQL data; the protocol dictates that an instruction is set to switch on encryption and then the TLS handshake is started, however if the downstream client has combined the two TCP packets for whatever reason then Envoy will pass both the instruction and the start of the handshake to the filter manager and so into the filter chain. This means triggering a startSecureTransport() call on the connection will just idle while it waits forever for a handshake packet.

If there was a way to pass the handshake back to the socket layer, or a way to limit the data read from the socket until this handshake phase has past it would avoid this issue.