}

  /**
   * Returns an integer representing an IPv4 address regardless of whether the supplied argument is
   * an IPv4 address or not.
   *
   * <p>IPv6 addresses are <b>coerced</b> to IPv4 addresses before being converted to integers.
   *
   * <p>As long as there are applications that assume that all IP addresses are IPv4 addresses and

		found := false
		for _, address := range addresses {
			if strings.EqualFold(address, l.Address) {
				found = true
			}
		}
		if !found {
			return false
		}
	}
	if l.Port != 0 && retrieveListenerPort(listener) != l.Port {
		return false
	}
	if l.Type != "" && !strings.EqualFold(retrieveListenerType(listener), l.Type) {
		return false
	}
	return true
}

}

/**
 * Returns the canonical address for [address]. If [address] is an IPv6 address that is mapped to an
 * IPv4 address, this returns the IPv4-mapped address. Otherwise, this returns [address].
 *
 * https://en.wikipedia.org/wiki/IPv6#IPv4-mapped_IPv6_addresses
 */
internal fun canonicalizeInetAddress(address: ByteArray): ByteArray {
  return when {
    isMappedIpv4Address(address) -> address.sliceArray(12 until 16)

    InetAddress addressV6_66_ff = InetAddress.getByName("2001:db8::66ff");
    InetAddress addressV6_67_0 = InetAddress.getByName("2001:db8::6700");

    InetAddress address = addressV6_66_0;
    for (int i = 0; i < 255; i++) {
      address = InetAddresses.increment(address);
    }
    assertEquals(addressV6_66_ff, address);

    address = InetAddresses.increment(address);
    assertEquals(addressV6_67_0, address);

    InetAddress addressV6_66_ff = InetAddress.getByName("2001:db8::66ff");
    InetAddress addressV6_67_0 = InetAddress.getByName("2001:db8::6700");

    InetAddress address = addressV6_66_0;
    for (int i = 0; i < 255; i++) {
      address = InetAddresses.increment(address);
    }
    assertEquals(addressV6_66_ff, address);

    address = InetAddresses.increment(address);
    assertEquals(addressV6_67_0, address);

    dnsResults =
      listOf(
        localhostIpv4,
        localhostIpv6,
        TestUtil.UNREACHABLE_ADDRESS_IPV4.address,
      )
    serverIpv4.protocols = listOf(Protocol.H2_PRIOR_KNOWLEDGE)
    serverIpv6.protocols = listOf(Protocol.H2_PRIOR_KNOWLEDGE)

    // Yield the first IP address so the second IP address completes first.
    val firstConnectLatch = CountDownLatch(1)
    val socketFactory =

  companion object {
    /**
     * A network that resolves only one IP address per host. Use this when testing route selection
     * fallbacks to prevent the host machine's various IP addresses from interfering.
     */
    private val SINGLE_INET_ADDRESS_DNS =
      Dns { hostname ->
        val addresses = Dns.SYSTEM.lookup(hostname)
        listOf(addresses[0])
      }

With this in mind, Ztunnel supports two xDS resources: `Address` and `Authorization`.

### Address Type

The primary configuration consumed by Ztunnel is the [`Address` resource](../../pkg/workloadapi/workload.proto).
As the name suggests, an `Address` represents a particular IP Address.
This can be a `Service` or a `Workload`.

The address type has the following goals:

    rather than the duration specified in the response's cache-control header.
 *  Fix: Verify certificate IP addresses in canonical form. When a server presents a TLS certificate
    containing an IP address we must match that address against the URL's IP address, even when the
    two addresses are encoded differently, such as `192.168.1.1` and `0::0:0:FFFF:C0A8:101`. Note

    response: Response,
    hostname: String,
    results: MutableList<InetAddress>,
    failures: MutableList<Exception>,
  ) {
    try {
      val addresses = readResponse(hostname, response)
      synchronized(results) {
        results.addAll(addresses)
      }
    } catch (e: Exception) {
      synchronized(failures) {
        failures.add(e)
      }
    }
  }