Xiaopeng Han <******@****.***> 1654695840 +0800

				cfg.ProxyUID = "3,4"
			},
		},
		{
			"outbound-owner-groups",
			func(cfg *config.Config) {
				cfg.RedirectDNS = true
				cfg.OwnerGroupsInclude = "java,202"
			},
		},
		{
			"outbound-owner-groups-exclude",
			func(cfg *config.Config) {
				cfg.RedirectDNS = true
				cfg.OwnerGroupsExclude = "888,ftp"
			},
		},
		{
			"inbound-interception-mode",
			func(cfg *config.Config) {

				return cfg, err
			}
		}
	}

	switch speed := env.Get(EnvSpeed, kvs.GetWithDefault(Speed, DefaultKVS)); speed {
	case "fastest":
		cfg.Delay, cfg.MaxWait, cfg.Cycle = 0, 0, time.Second
	case "fast":
		cfg.Delay, cfg.MaxWait, cfg.Cycle = 1, 100*time.Millisecond, time.Minute
	case "default":
		cfg.Delay, cfg.MaxWait, cfg.Cycle = 2, time.Second, time.Minute
	case "slow":

type NetlinkDependencies interface {
	AddInpodMarkIPRule(cfg *Config) error
	DelInpodMarkIPRule(cfg *Config) error
	AddLoopbackRoutes(cfg *Config) error
	DelLoopbackRoutes(cfg *Config) error
}

func RealNlDeps() NetlinkDependencies {
	return &realDeps{}
}

type realDeps struct{}

func (r *realDeps) AddInpodMarkIPRule(cfg *Config) error {
	return AddInpodMarkIPRule(cfg)
}

// Option for a retry operation.
type Option func(cfg *config)

// Timeout sets the timeout for the entire retry operation.
func Timeout(timeout time.Duration) Option {
	return func(cfg *config) {
		cfg.timeout = timeout
	}
}

// Delay sets the delay between successive retry attempts.
func Delay(delay time.Duration) Option {
	return func(cfg *config) {
		cfg.delay = delay
		cfg.delayMax = delay
	}
}

		// Rate limiting should happen when deciding how many requests to serve.
		cfg.QPS = -1

		// Combine CAData from the config with any existing CA bundle provided
		if len(cfg.TLSClientConfig.CAData) > 0 {
			cfg.TLSClientConfig.CAData = append(cfg.TLSClientConfig.CAData, '\n')
		}
		cfg.TLSClientConfig.CAData = append(cfg.TLSClientConfig.CAData, cc.CABundle...)

		cfg.ContentConfig.NegotiatedSerializer = cm.negotiatedSerializer

}

// New - initialize new etcd client.
func New(cfg Config) (*clientv3.Client, error) {
	if !cfg.Enabled {
		return nil, nil
	}
	cli, err := clientv3.New(cfg.Config)
	if err != nil {
		return nil, err
	}
	cli.KV = namespace.NewKV(cli.KV, cfg.PathPrefix)
	cli.Watcher = namespace.NewWatcher(cli.Watcher, cfg.PathPrefix)
	cli.Lease = namespace.NewLease(cli.Lease, cfg.PathPrefix)
	return cli, nil
}

	return &udpProtocol{e: e}
}

func (c *udpProtocol) ForwardEcho(ctx context.Context, cfg *Config) (*proto.ForwardEchoResponse, error) {
	return doForward(ctx, cfg, c.e, c.makeRequest)
}

func (c *udpProtocol) makeRequest(ctx context.Context, cfg *Config, requestID int) (string, error) {
	conn, err := newUDPConnection(cfg)
	if err != nil {
		return "", err
	}
	defer func() { _ = conn.Close() }()

type declInfo struct {
	decl     *ast.FuncDecl
	cfg      *cfg.CFG // iff decl.Body != nil
	started  bool     // to break cycles
	noReturn bool
}

type litInfo struct {
	cfg      *cfg.CFG
	noReturn bool
}

// FuncDecl returns the control-flow graph for a named function.
// It returns nil if decl.Body==nil.
func (c *CFGs) FuncDecl(decl *ast.FuncDecl) *cfg.CFG {
	if decl.Body == nil {
		return nil
	}

}

// New creates a new endpoint Instance.
func New(cfg Config) (Instance, error) {
	if cfg.Port != nil {
		switch cfg.Port.Protocol {
		case protocol.HBONE:
			return newHBONE(cfg), nil
		case protocol.HTTP, protocol.HTTPS:
			return newHTTP(cfg), nil
		case protocol.HTTP2, protocol.GRPC:
			return newGRPC(cfg), nil
		case protocol.TCP:
			return newTCP(cfg), nil
		case protocol.UDP:
			return newUDP(cfg), nil