var (
	errInvalidInterface         = errors.New("invalid network interface")
	errInvalidInterfaceIndex    = errors.New("invalid network interface index")
	errInvalidInterfaceName     = errors.New("invalid network interface name")
	errNoSuchInterface          = errors.New("no such network interface")
	errNoSuchMulticastInterface = errors.New("no such multicast network interface")
)

          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.router
      proxy:
        proxyVersion: ^1\.19.*
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:

			}
			_, present := network[nodeName]
			if !present {
				if err := isServerResolvable(endpoint, 5*time.Second); err == nil {
					network[nodeName] = string(madmin.ItemOnline)
				} else {
					if xnet.IsNetworkOrHostDown(err, false) {
						network[nodeName] = string(madmin.ItemOffline)
					} else if xnet.IsNetworkOrHostDown(err, true) {
						network[nodeName] = "connection attempt timedout"
					}
				}
			}
		}
	}

network namespace processes always take the output path, while packets coming in from
outside the host network namespace (whether that's from an external host or from a pod
network namespace) arrive via `ingress` and take the input or forward path, depending on
the routing decision made after `prerouting`; packets destined for an IP which is assigned

	var ctrlCtxFn func(ctx context.Context, network, address string, c syscall.RawConn) error
	if sl.ListenConfig.Control != nil {
		ctrlCtxFn = func(ctx context.Context, network, address string, c syscall.RawConn) error {
			return sl.ListenConfig.Control(network, address, c)
		}
	}
	fd, err := internetSocket(ctx, sl.network, laddr, nil, syscall.SOCK_STREAM, proto, "listen", ctrlCtxFn)
	if err != nil {

	var ctrlCtxFn func(ctx context.Context, network, address string, c syscall.RawConn) error
	if sl.ListenConfig.Control != nil {
		ctrlCtxFn = func(ctx context.Context, network, address string, c syscall.RawConn) error {
			return sl.ListenConfig.Control(network, address, c)
		}
	}
	fd, err := unixSocket(ctx, sl.network, laddr, nil, "listen", ctrlCtxFn)
	if err != nil {
		return nil, err
	}

				if v.IP.Equal(targetAddr) {
					return true, nil
				}
			}
		}
	}
	return false, fmt.Errorf("no interface has the address %s", targetAddr)
}

// getPodNetNs finds the network namespace for a given pod. There is not a great way to do this. Network namespaces live
// under the procfs, /proc/<pid>/ns/net. In majority of cases, this is not used directly, but is rather bind mounted to

  namespace: istio-system
  labels:
    topology.istio.io/network: "network-1"
spec:
  gatewayClassName: istio-remote
  listeners:
  - name: istiod-grpc
    port: 15012
    protocol: TLS
    tls:
      mode: Passthrough
  - name: istiod-webhook
    port: 15017
    protocol: TLS
    tls:
      mode: Passthrough
  - name: cross-network
    hostname: "*.local"
    port: 15443
    protocol: TLS
    tls:

		Name:        "port",
		TypedConfig: protoconv.MessageToAny(&network.DestinationPortInput{}),
	}
	DestinationIP = &xds.TypedExtensionConfig{
		Name:        "ip",
		TypedConfig: protoconv.MessageToAny(&network.DestinationIPInput{}),
	}
	SourceIP = &xds.TypedExtensionConfig{
		Name:        "source-ip",
		TypedConfig: protoconv.MessageToAny(&network.SourceIPInput{}),
	}
	SNI = &xds.TypedExtensionConfig{
		Name:        "sni",

name: envoy.filters.network.ext_authz
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.network.ext_authz.v3.ExtAuthz
  failureModeAllow: true
  filterEnabledMetadata:
    filter: envoy.filters.network.rbac
    path:
    - key: istio_ext_authz_shadow_effective_policy_id
    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local