drNs := r.Metadata.FullName.Namespace
	drName := r.Metadata.FullName.String()
	mode := dr.GetTrafficPolicy().GetTls().GetMode()
	if mode == v1alpha3.ClientTLSSettings_SIMPLE || mode == v1alpha3.ClientTLSSettings_MUTUAL {
		if dr.GetTrafficPolicy().GetTls().GetCaCertificates() == "" && !(dr.GetTrafficPolicy().GetTls().GetCredentialName() != "" && dr.WorkloadSelector != nil) {
			m := msg.NewNoServerCertificateVerificationDestinationLevel(r, drName,

// license that can be found in the LICENSE file.

//go:build aix || dragonfly || freebsd || linux || netbsd || solaris

package cgosotest

/*
extern int __thread tlsvar;
int *getTLS() { return &tlsvar; }
*/
import "C"

func init() {
	if v := *C.getTLS(); v != 12345 {
		println("got", v)
		panic("BAD TLS value")
	}

		verificationImpacted = verificationImpacted || checkVerify(dr.Spec.GetTrafficPolicy().GetTls())
		sniImpacted = sniImpacted || checkSNI(dr.Spec.GetTrafficPolicy().GetTls())
		for _, pl := range dr.Spec.GetTrafficPolicy().GetPortLevelSettings() {
			verificationImpacted = verificationImpacted || checkVerify(pl.GetTls())
			sniImpacted = sniImpacted || checkSNI(pl.GetTls())
		}
		for _, ss := range dr.Spec.Subsets {

				RouteRule:        "tcp",
				ServiceIndex:     i,
				DestinationIndex: j,
				Destination:      rd.GetDestination(),
			})
		}
	}
	for i, r := range vs.GetTls() {
		for j, rd := range r.GetRoute() {
			destinations = append(destinations, &AnnotatedDestination{
				RouteRule:        "tls",
				ServiceIndex:     i,
				DestinationIndex: j,

				m.Line = line
			}

			ctx.Report(gvk.Gateway, m)
			return true
		}

		for i, srv := range gw.GetServers() {
			tls := srv.GetTls()
			if tls == nil {
				continue
			}

			cn := tls.GetCredentialName()
			if cn == "" {
				continue
			}

			secret := ctx.Find(gvk.Secret, resource.NewShortOrFullName(gwNs, cn))

			}
			sanitizeServerHostNamespace(s, gatewayConfig.Namespace)
			gatewayNameForServer[s] = gatewayName
			log.Debugf("MergeGateways: gateway %q processing server %s :%v", gatewayName, s.Name, s.Hosts)

			cn := s.GetTls().GetCredentialName()
			if cn != "" && proxy.VerifiedIdentity != nil {
				rn := credentials.ToResourceName(cn)
				parse, _ := credentials.ParseResourceName(rn, proxy.VerifiedIdentity.Namespace, "", "")

	// 3. Once we support gRPC servers, we have no good way to detect if a server is implemented with xds.NewGrpcServer and will actually support our config
	// For these reasons, support only explicit tls configuration.
	switch policy.GetTls().GetMode() {
	case networking.ClientTLSSettings_DISABLE:
		// nothing to do
	case networking.ClientTLSSettings_SIMPLE:
		// TODO support this
	case networking.ClientTLSSettings_MUTUAL:
		// TODO support this

	util.AddSubsetToMetadata(subsetCluster.cluster.Metadata, subset.Name)
	subsetCluster.cluster.Metadata = util.AddALPNOverrideToMetadata(subsetCluster.cluster.Metadata, opts.policy.GetTls().GetMode())
	return subsetCluster.build()
}

// applyDestinationRule applies the destination rule if it exists for the Service.
// It returns the subset clusters if any created as it applies the destination rule.

				t.Errorf("got diff: `%v", diff)
			}

			if tc.enableAutoSni {
				if tc.destRule.GetTrafficPolicy().GetTls().Sni == "" {
					assert.Equal(t, ec.httpProtocolOptions.UpstreamHttpProtocolOptions.AutoSni, true)
				}

				if tc.destRule.GetTrafficPolicy().GetTls().GetInsecureSkipVerify().GetValue() {
					assert.Equal(t, ec.httpProtocolOptions.UpstreamHttpProtocolOptions.AutoSanValidation, false)

				}
			}
		}

		// check all hostname in vHostDedupMap and if is not exist with HttpsRedirect set to true
		// create VirtualHost to redirect
		for _, hostname := range server.Hosts {
			if !server.GetTls().GetHttpsRedirect() {
				continue
			}
			if vHost, exists := vHostDedupMap[host.Name(hostname)]; exists {
				vHost.RequireTls = route.VirtualHost_ALL
				continue
			}
			newVHost := &route.VirtualHost{