listener/main_internal           0     ALL   Cluster: inbound-vip|8000|http|httpbin.default.svc.cluster.local
listener/main_internal           0     ALL   Cluster: encap
listener/main_internal           0     ALL   Cluster: encap
listener/              0.0.0.0   15021 ALL   Inline Route: /healthz/ready*

NAME                                                              VHOST NAME            DOMAINS     MATCH     VIRTUAL SERVICE

			encap, context, err := SetupSender(
				uint16(kemID),
				uint16(kdfID),
				uint16(aeadID),
				pub,
				info,
			)
			if err != nil {
				t.Fatal(err)
			}

			expectedEncap := mustDecodeHex(t, setup["enc"])
			if !bytes.Equal(encap, expectedEncap) {
				t.Errorf("unexpected encapsulated key, got: %x, want %x", encap, expectedEncap)
			}

	// Creates "main_internal" cluster to route to the main internal listener.
	// Creates "encap" cluster to route to the encap listener.
	clusters = append(clusters, MainInternalCluster, EncapCluster)
	// Creates per-VIP load balancing upstreams.
	clusters = append(clusters, cb.buildWaypointInboundVIP(proxy, svcs)...)
	// Upstream of the "encap" listener.
	clusters = append(clusters, cb.buildWaypointConnectOriginate(proxy, push))

                      "typed_config": {
                        "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
                        "stat_prefix": "encap",
                        "cluster": "encap"
                      }
                    }
                  ],
                  "name": "direct-tcp"
                },
                {
                  "filters": [

	eaePRK := dh.kdf.LabeledExtract(dh.suiteID[:], nil, "eae_prk", dhKey)
	return dh.kdf.LabeledExpand(dh.suiteID[:], eaePRK, "shared_secret", kemContext, dh.nSecret)
}

func (dh *dhKEM) Encap(pubRecipient *ecdh.PublicKey) (sharedSecret []byte, encapPub []byte, err error) {
	var privEph *ecdh.PrivateKey
	if testingOnlyGenerateKey != nil {
		privEph, err = testingOnlyGenerateKey()
	} else {

	ConnectOriginate = "connect_originate"

	// EncapClusterName is the name of the cluster used for traffic to the connect_originate listener.
	EncapClusterName = "encap"

	// ConnectUpgradeType is the type of upgrade for HTTP CONNECT.
	ConnectUpgradeType = "CONNECT"
)

type waypointServices struct {
	services        map[host.Name]*model.Service
	orderedServices []*model.Service

				xdsfilters.ConnectAuthorityNetworkFilter,
			},
				lb.buildInboundNetworkFilters(cc)...),
			Name: "direct-tcp",
		}
		// TODO: maintains undesirable persistent HTTP connections to "encap"
		httpChain := &listener.FilterChain{
			Filters: append([]*listener.Filter{
				xdsfilters.ConnectAuthorityNetworkFilter,
			},
				lb.buildWaypointInboundHTTPFilters(nil, cc)...),
			Name: "direct-http",
		}

func (re *Regexp) doOnePass(ir io.RuneReader, ib []byte, is string, pos, ncap int, dstCap []int) []int {
	startCond := re.cond
	if startCond == ^syntax.EmptyOp(0) { // impossible
		return nil
	}

	m := newOnePassMachine()
	if cap(m.matchcap) < ncap {
		m.matchcap = make([]int, ncap)
	} else {
		m.matchcap = m.matchcap[:ncap]
	}

	matched := false
	for i := range m.matchcap {
		m.matchcap[i] = -1

		b.visited = b.visited[:visitedSize]
		clear(b.visited) // set to 0
	}

	if cap(b.cap) < ncap {
		b.cap = make([]int, ncap)
	} else {
		b.cap = b.cap[:ncap]
	}
	for i := range b.cap {
		b.cap[i] = -1
	}

	if cap(b.matchcap) < ncap {
		b.matchcap = make([]int, ncap)
	} else {
		b.matchcap = b.matchcap[:ncap]
	}
	for i := range b.matchcap {
		b.matchcap[i] = -1
	}
}

	}

	if cents := int32(getcpucap()); cents > 0 {
		// Convert from a percentage of CPUs to a number of CPUs,
		// rounding up to make use of a fractional CPU
		// e.g., 336% becomes 4 CPUs
		ncap := (cents + 99) / 100
		if ncap < n {
			return ncap
		}
	}

	return n
}

//go:nosplit
func getrctl(controlname, oldbuf, newbuf unsafe.Pointer, flags uint32) uintptr {