assertThat(result0).isEqualTo(plan1.connection)
    }

    taskFaker.runTasks()
    assertEvents(
      "take plan 0",
      "plan 0 TCP connecting...",
      "plan 0 TCP connected",
      "plan 0 TLS connecting...",
      "plan 0 needs follow-up",
      "plan 1 TCP connecting...",
      "plan 1 TCP connected",
      "plan 1 TLS connecting...",
      "plan 1 TLS connected",
    )

    // which can satisfy a larger policy
    val connection = routePlanner.plans.first().connection
    val http2Connection = connectHttp2(peer, connection, 5)
    setPolicy(pool, address, ConnectionPool.AddressPolicy(5))
    assertThat(pool.connectionCount()).isEqualTo(1)

    // Decrease the connection's max so that another connection is needed

		if f != event.NamespaceFormat && f != event.AccessFormat {
			return fmt.Errorf("unrecognized format value")
		}
	}

	if p.ConnectionString != "" {
		// No pq API doesn't help to validate connection string
		// prior connection, so no validation for now.
	} else {
		// Some fields need to be specified when ConnectionString is unspecified
		if p.Port == "" {
			return fmt.Errorf("unspecified port")
		}

	}
	errFatal(h1.Register(local, handler1))
	errFatal(h2.Register(local, handler2))

	errFatal(h1.Register(remote, handler1))
	errFatal(h2.Register(remote, handler2))

	// local to remote connection
	remoteConn := local.Connection(remoteHost)
	const testPayload = "Hello Grid World!"

	start := time.Now()
	req := testRequest{Num: 1, String: testPayload}
	resp, err := h1.Call(context.Background(), remoteConn, &req)

If there is no waypoint, ztunnel will enforce RBAC policies against the request.

If all checks pass, ztunnel will open a connection to the target. This will spoof the source IP (from `Forwarded` for waypoints, or the incoming IP otherwise).
Once the connection is established we return a 200 HTTP code, and bi-directionally copy data to/from the tunnel to the destination.

## Certificates

	case strings.Contains(err.Error(), http.ErrServerClosed.Error()):
		return true
	// Corner case, the server closed the connection with a keep-alive timeout
	// some requests are not retried internally, such as POST request with written body
	case strings.Contains(err.Error(), "server closed idle connection"):
		return true
	}

	return false
}

// Converts network error to storageErr. This function is

const DefaultTimeout = 10 * time.Second

const (
	offline = iota
	online
	closed
)

// NetworkError - error type in case of errors related to http/transport
// for ex. connection refused, connection reset, dns resolution failure etc.
// All errors returned by storage-rest-server (ex errFileNotFound, errDiskNotFound) are not considered to be network errors.
type NetworkError struct {
	Err error
}

		Hidden: true,
	},
	cli.DurationFlag{
		Name:   "conn-client-read-deadline",
		Usage:  "custom connection READ deadline for incoming requests",
		Hidden: true,
		EnvVar: "MINIO_CONN_CLIENT_READ_DEADLINE",
	},
	cli.DurationFlag{
		Name:   "conn-client-write-deadline",
		Usage:  "custom connection WRITE deadline for outgoing requests",
		Hidden: true,
		EnvVar: "MINIO_CONN_CLIENT_WRITE_DEADLINE",
	},

		return
	}

	// We have to establish a TLS connection and the
	// client must provide exactly one client certificate.
	// Otherwise, we don't have a certificate to verify or
	// the policy lookup would ambiguous.
	if r.TLS == nil {
		writeSTSErrorResponse(ctx, w, ErrSTSInsecureConnection, errors.New("No TLS connection attempt"))
		return
	}

	return l.GetValidatedDNUnderBaseDN(conn, userDN, l.LDAP.UserDNSearchBaseDistNames)
}

// GetValidatedGroupDN validates the given group DN. If conn is nil, creates a
// connection. The returned boolean is true iff the group DN is found under one
// of the configured LDAP base DNs.
func (l *Config) GetValidatedGroupDN(conn *ldap.Conn, groupDN string) (string, bool, error) {
	if conn == nil {