iptables -t raw -A ISTIO_OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j CT --zone 1
iptables -t raw -A ISTIO_OUTPUT -p udp --sport 15053 -m owner --uid-owner 1337 -j CT --zone 2
iptables -t raw -A ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j CT --zone 1
iptables -t raw -A ISTIO_OUTPUT -p udp --sport 15053 -m owner --gid-owner 1337 -j CT --zone 2
ip6tables -t nat -N ISTIO_INBOUND
ip6tables -t nat -N ISTIO_REDIRECT

iptables -t raw -A ISTIO_OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j CT --zone 1
iptables -t raw -A ISTIO_OUTPUT -p udp --sport 15053 -m owner --uid-owner 1337 -j CT --zone 2
iptables -t raw -A ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j CT --zone 1
iptables -t raw -A ISTIO_OUTPUT -p udp --sport 15053 -m owner --gid-owner 1337 -j CT --zone 2
ip6tables -t nat -N ISTIO_INBOUND
ip6tables -t nat -N ISTIO_REDIRECT

	go func() { // func2
		var c chan int
		c <- 0
	}()
	go func() { // func3
		var c chan int
		<-c
	}()
	done1 := make(chan bool)
	go func() { // func4
		<-done1
	}()
	done2 := make(chan bool)
	go func() { // func5
		done2 <- true
	}()
	c1 := make(chan int)
	c2 := make(chan int)
	go func() { // func6
		select {
		case <-c1:
		case <-c2:
		}
	}()
	var mu sync.Mutex
	mu.Lock()

import (
	"fmt"
	"strings"
)

type Instance struct {
	Zone   string
	Region string
}

func (l Instance) String() string {
	return fmt.Sprintf("%s/%s", l.Region, l.Zone)
}

func Parse(s string) Instance {
	parts := strings.Split(s, "/")
	if len(parts) != 2 {
		panic("invalid locality string: " + s)
	}
	return Instance{
		Region: parts[0],
		Zone:   parts[1],
	}

	}
	inetaddr := func(ip IPAddr) Addr {
		switch net {
		case "tcp", "tcp4", "tcp6":
			return &TCPAddr{IP: ip.IP, Port: portnum, Zone: ip.Zone}
		case "udp", "udp4", "udp6":
			return &UDPAddr{IP: ip.IP, Port: portnum, Zone: ip.Zone}
		case "ip", "ip4", "ip6":
			return &IPAddr{IP: ip.IP, Zone: ip.Zone}
		default:
			panic("unexpected network: " + net)
		}
	}
	if host == "" {
		return addrList{inetaddr(IPAddr{})}, nil

	if offset < 0 {
		z.name += "-"
		offset *= -1
	} else {
		z.name += "+"
	}
	z.name += itoa.Itoa(offset / 60)
	min := offset % 60
	if min != 0 {
		z.name += ":" + itoa.Itoa(min)
	}
	localLoc.zone = []zone{z}

=== NAME  TestAddrStringAllocs
=== RUN   TestAddrStringAllocs/ipv6
=== NAME  TestAddrStringAllocs
=== RUN   TestAddrStringAllocs/ipv6+zone
=== NAME  TestAddrStringAllocs
=== RUN   TestAddrStringAllocs/ipv4-in-ipv6
=== NAME  TestAddrStringAllocs
=== RUN   TestAddrStringAllocs/ipv4-in-ipv6+zone
=== NAME  TestAddrStringAllocs
--- PASS: TestAddrStringAllocs (0.00s)
    --- PASS: TestAddrStringAllocs/zero (0.00s)

iptables -t raw -A ISTIO_OUTPUT -p udp --sport 15053 -m owner --uid-owner 1337 -j CT --zone 2
iptables -t raw -A ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j CT --zone 1
iptables -t raw -A ISTIO_OUTPUT -p udp --sport 15053 -m owner --gid-owner 1337 -j CT --zone 2
iptables -t raw -A ISTIO_OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j CT --zone 2

		return 0
	}

	// The "zone.cpu-cap" resource control, as described in
	// resource_controls(5), "sets a limit on the amount of CPU time that
	// can be used by a zone.  The unit used is the percentage of a single
	// CPU that can be used by all user threads in a zone, expressed as an
	// integer."  A C string of the name must be passed to getrctl(2).
	name := []byte("zone.cpu-cap\x00")

}

func (a *IPAddr) sockaddr(family int) (syscall.Sockaddr, error) {
	if a == nil {
		return nil, nil
	}
	return ipToSockaddr(family, a.IP, 0, a.Zone)
}

func (a *IPAddr) toLocal(net string) sockaddr {
	return &IPAddr{loopbackIP(net), a.Zone}
}

func (c *IPConn) readFrom(b []byte) (int, *IPAddr, error) {
	// TODO(cw,rsc): consider using readv if we know the family
	// type to avoid the header trim/copy