private var trailers: Headers? = null

  /** Returns true if this connection is closed. */
  val isClosed: Boolean
    get() = state == STATE_CLOSED

  override fun createRequestBody(
    request: Request,
    contentLength: Long,
  ): Sink {
    return when {
      request.body?.isDuplex() == true -> throw ProtocolException(
        "Duplex connections are not supported for HTTP/1",
      )

	fs.DurationVar(&o.config.IPVS.TCPTimeout.Duration, "ipvs-tcp-timeout", o.config.IPVS.TCPTimeout.Duration, "The timeout for idle IPVS TCP connections, 0 to leave as-is. (e.g. '5s', '1m', '2h22m').")
	fs.DurationVar(&o.config.IPVS.TCPFinTimeout.Duration, "ipvs-tcpfin-timeout", o.config.IPVS.TCPFinTimeout.Duration, "The timeout for IPVS TCP connections after receiving a FIN packet, 0 to leave as-is. (e.g. '5s', '1m', '2h22m').")

			//     (existing connections will be deleted on the next packet because sysctlExpireNoDestConn=1)
			// For other protocols, don't delete until all connections have expired)
			if utilipvs.IsRsGracefulTerminationNeeded(rsToDelete.VirtualServer.Protocol) && rs.ActiveConn+rs.InactiveConn != 0 {

            if (started) {
                throw new IllegalStateException("server connector cannot be started as it has already been started");
            }

            // Hold the lock until we actually start accepting connections for the case when stop is called from another
            // thread while we are in the middle here.

            Action<ConnectCompletion> connectEvent = new Action<ConnectCompletion>() {
                @Override

		// HTTP2 has a mechanism to detect broken connections by sending periodical pings.
		// HTTP1 only can have one persistent connection, and it will close all Idle connections
		// once the Kubelet heartbeat fails. However, since there are many edge cases that we can't
		// control, users can still opt-in to the previous behavior for closing the connections by

 * starting the proxy.
 *
 * Use {@link #start(SocksServer)} to start the proxy with an alternate implementation of {@link SocksServer} (for instance,
 * a {@link TestRecordingSocksServer}, which can record connections which would have been made).
 */
class SocksProxyServer extends ExternalResource {
    private PortAllocator portFinder = FixedAvailablePortAllocator.getInstance()
    private SocksServer socksServer
    private int port

chmod o+rx /usr/local/bin/{envoy,pilot-agent}

# pilot-agent and envoy may run with effective uid 0 in order to run envoy with
# CAP_NET_ADMIN, so any iptables rule matching on "-m owner --uid-owner
# istio-proxy" will not match connections from those processes anymore.
# Instead, rely on the process's effective gid being istio-proxy and create a
# "-m owner --gid-owner istio-proxy" iptables rule in istio-iptables.

     * the user has explicitly opted out from this protection.
     *
     * @param baseHost The host specified by the user.
     * @param allowInsecureProtocol If true, allows HTTP based connections.
     * @param insecureBaseHost Callback when the base host URL is insecure.
     * @param insecureRedirect Callback when the server returns an 30x redirect to an insecure server.
     */

// TCPDialFunc a function for establishing a TCP connection.
type TCPDialFunc func(dialer net.Dialer, ctx context.Context, address string) (net.Conn, error)

// Dialer is a replaceable set of functions for creating client-side connections for various protocols, allowing a test
// application to intercept the connection creation.
type Dialer struct {
	GRPC      GRPCDialFunc
	Websocket WebsocketDialFunc

  /**
   * Returns an iterator over the incident edges.
   *
   * @param thisNode The node that this all of the connections in this class are connected to.
   */
  Iterator<EndpointPair<N>> incidentEdgeIterator(N thisNode);

  /**
   * Returns the value associated with the edge connecting the origin node to {@code node}, or null
   * if there is no such edge.
   */
  @CheckForNull
  V value(N node);