}

  private fun connectHttp2(
    peer: MockHttp2Peer,
    realConnection: RealConnection,
    maxConcurrentStreams: Int,
  ): Http2Connection {
    // Write the mocking script.
    val settings1 = Settings()
    settings1[Settings.MAX_CONCURRENT_STREAMS] = maxConcurrentStreams
    peer.sendFrame().settings(settings1)
    peer.acceptFrame() // ACK
    peer.sendFrame().ping(false, 2, 0)

		if tc.certChain != nil {
			tlsInfo := credentials.TLSInfo{
				State: tls.ConnectionState{VerifiedChains: tc.certChain},
			}
			p := &peer.Peer{AuthInfo: tlsInfo}
			ctx = peer.NewContext(ctx, p)
		}
		if tc.fakeAuthInfo != nil {
			ctx = peer.NewContext(ctx, &peer.Peer{AuthInfo: tc.fakeAuthInfo})
		}

		result, err := auth.Authenticate(security.AuthContext{GrpcContext: ctx})
		if len(tc.authenticateErrMsg) > 0 {

		if c.certChain != nil {
			tlsInfo := credentials.TLSInfo{
				State: tls.ConnectionState{VerifiedChains: c.certChain},
			}
			p := &peer.Peer{Addr: c.ipAddr, AuthInfo: tlsInfo}
			ctx = peer.NewContext(ctx, p)
		}
		if c.fakeAuthInfo != nil {
			ctx = peer.NewContext(ctx, &peer.Peer{Addr: c.ipAddr, AuthInfo: c.fakeAuthInfo})
		}
		response, err := server.CreateCertificate(ctx, request)

		s, _ := status.FromError(err)

/**
 * <p>A messaging end-point with some remote, or otherwise unreliable, peer.</p>
 *
 * <p>This interface simply specializes the exceptions thrown by the methods of this connection.</p>
 */
public interface RemoteConnection<T> extends Connection<T> {
    /**
     * {@inheritDoc}
     *
     * @throws MessageIOException On failure to dispatch the message to the peer.
     */
    @Override

	}

	peer := &netFD{
		family:      ln.family,
		sotype:      ln.sotype,
		net:         ln.net,
		laddr:       ln.laddr,
		raddr:       fd.laddr,
		isConnected: true,
	}
	peer.fakeNetFD = newFakeNetFD(fd)
	peer.fakeNetFD.queue = newPacketQueue(defaultBuffer)
	defer func() {
		if fd.peer != peer {
			// Failed to connect; clean up.
			peer.Close()
		}
	}()

var (
	// peerProxiedRequestsTotal counts the number of requests that were proxied to a peer kube-apiserver.
	peerProxiedRequestsTotal = metrics.NewCounterVec(
		&metrics.CounterOpts{
			Subsystem:      subsystem,
			Name:           "rerouted_request_total",
			Help:           "Total number of requests that were proxied to a peer kube apiserver because the local apiserver was not capable of serving it",
			StabilityLevel: metrics.ALPHA,

apiVersion: release-notes/v2
kind: feature
area: security
issue:
  - 33809
releaseNotes:
  - |
    **Added** Auto mTLS support for workload level peer authentication. You no longer need to configure destination rule when servers are configured with workload level peer authentication policy. This can be disabled by setting ENABLE_AUTO_MTLS_CHECK_POLICIES to "false". 
docs:

				minIstioVersion string
			}{
				{
					name: "global mtls strict",
					configs: config.Sources{
						config.File("testdata/reachability/global-peer-authn.yaml.tmpl"),
						config.File("testdata/reachability/global-dr.yaml.tmpl"),
					}.WithParams(param.Params{
						mtlsModeParam:            model.MTLSStrict.String(),
						tlsModeParam:             "ISTIO_MUTUAL",

		return 0
	}
	tlsInfo := credentials.TLSInfo{
		State: tls.ConnectionState{VerifiedChains: certChain},
	}

	mockIPAddr := &net.IPAddr{IP: net.IPv4(192, 168, 1, 1)}
	p := &peer.Peer{Addr: mockIPAddr, AuthInfo: tlsInfo}

	ctx = peer.NewContext(ctx, p)

	_, _ = server.CreateCertificate(ctx, request)
	return 1

	// PeerCAFile is the ca bundle used by this kube-apiserver to verify peer apiservers'
	// serving certs when routing a request to the peer in the case the request can not be served
	// locally due to version skew.
	PeerCAFile string

	// PeerAdvertiseAddress is the IP for this kube-apiserver which is used by peer apiservers to route a request
	// to this apiserver. This happens in cases where the peer is not able to serve the request due to
	// version skew.