MIT License

Copyright (c) 2012-2020 Mat Ryer, Tyler Bunnell and contributors.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is

= vendor/github.com/stretchr/testify licensed under: =

MIT License

Copyright (c) 2012-2020 Mat Ryer, Tyler Bunnell and contributors.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

import org.checkerframework.checker.nullness.qual.Nullable;

/**
 * Funnels for common types. All implementations are serializable.
 *
 * @author Dimitris Andreou
 * @since 11.0
 */
@Beta
@ElementTypesAreNonnullByDefault
public final class Funnels {
  private Funnels() {}

  /** Returns a funnel that extracts the bytes from a {@code byte} array. */
  public static Funnel<byte[]> byteArrayFunnel() {
    return ByteArrayFunnel.INSTANCE;

 * Implementations for common types can be found in {@link Funnels}.
 *
 * <p>Note that serialization of {@linkplain BloomFilter bloom filters} requires the proper
 * serialization of funnels. When possible, it is recommended that funnels be implemented as a
 * single-element enum to maintain serialization guarantees. See Effective Java (2nd Edition), Item

        .addEqualityGroup(Funnels.longFunnel())
        .addEqualityGroup(Funnels.unencodedCharsFunnel())
        .addEqualityGroup(Funnels.stringFunnel(Charsets.UTF_8))
        .addEqualityGroup(Funnels.stringFunnel(Charsets.US_ASCII))
        .addEqualityGroup(
            Funnels.sequentialFunnel(Funnels.integerFunnel()),
            SerializableTester.reserialize(Funnels.sequentialFunnel(Funnels.integerFunnel())))

        .addEqualityGroup(Funnels.longFunnel())
        .addEqualityGroup(Funnels.unencodedCharsFunnel())
        .addEqualityGroup(Funnels.stringFunnel(Charsets.UTF_8))
        .addEqualityGroup(Funnels.stringFunnel(Charsets.US_ASCII))
        .addEqualityGroup(
            Funnels.sequentialFunnel(Funnels.integerFunnel()),
            SerializableTester.reserialize(Funnels.sequentialFunnel(Funnels.integerFunnel())))

   * That may happen later by the connection pool thread.
   */
  fun cancel()

  /**
   * Carries an exchange. This is usually a connection, but it could also be a connect plan for
   * CONNECT tunnels. Note that CONNECT tunnels are significantly less capable than connections.
   */
  interface Carrier {
    val route: Route

    fun trackFailure(
      call: RealCall,
      e: IOException?,
    )

    HashFn hf =
        new HashFn() {
          @Override
          public byte[] hash(byte[] input, int seed) {
            Hasher hasher = murmur3_128(seed).newHasher();
            Funnels.byteArrayFunnel().funnel(input, hasher);
            return hasher.hash().asBytes();
          }
        };
    // Murmur3F, MurmurHash3 for x64, 128-bit (MurmurHash3_x64_128)

    HashFn hf =
        new HashFn() {
          @Override
          public byte[] hash(byte[] input, int seed) {
            Hasher hasher = murmur3_128(seed).newHasher();
            Funnels.byteArrayFunnel().funnel(input, hasher);
            return hasher.hash().asBytes();
          }
        };
    // Murmur3F, MurmurHash3 for x64, 128-bit (MurmurHash3_x64_128)

effective policy is `PERMISSIVE` (the default), the ztunnel will open a vanilla TLS HBONE tunnel (NOTE: this is not mTLS) to the Waypoint proxy and forward the traffic over that connection without presenting a client certificate. Therefore, it is absolutely critical that the waypoint proxy not assume any identity from incoming connections, even if the ztunnel is hairpinning. In other words, all traffic over TLS HBONE tunnels must be considered to be untrusted. From there, traffic is returned to the ztunnel...