proxy1     cluster1     STALE        SYNCED      SYNCED      NOT SENT     SYNCED       istiod1     1.20
proxy2     cluster2     STALE        SYNCED      STALE       SYNCED       STALE        istiod2     1.19
proxy3     cluster3     NOT SENT     ERROR       STALE       NOT SENT     NOT SENT     istiod3     1.20

metadata:
  name: overlapping-in-two-matches
spec:
  hosts:
  - sample.baz.svc.cluster.local
  http:
  - name: "send product to sample.foo"
    match:
    - uri:
        prefix: "/api/v1/product"
      method:
        exact: GET
    route:
    - destination:
        host: sample.foo.svc.cluster.local
  - name: "send products to sample.bar"
    match:
    - uri:
        prefix: "/api/v1/products"
      method:

Currently, SNI is not set by Istio clients and ignored by Istio servers.
This makes identifying which certificate to use problematic for Ztunnel.
To handle this, requests to Ztunnel are sent to `DestinationPod:15008` and redirected to ztunnel, rather than `ZtunnelPod:15008`.
The original destination is then extracted to determined which certificate to use.

	counter++
	return 1 << shift
}

func Send(a, b chan uint) int {
	var i int

LOOP:
	for {
		select {
		case a <- GetValue():
			i++
			a = nil
		case b <- GetValue():
			i++
			b = nil
		default:
			break LOOP
		}
		shift++
	}
	return i
}

func main() {
	a := make(chan uint, 1)
	b := make(chan uint, 1)
	if v := Send(a, b); v != 2 {
		println("Send returned", v, "!= 2")

	// clientFinishedIsFirst is true if the client sent the first Finished
	// message during the most recent handshake. This is recorded because
	// the first transmitted Finished message is the tls-unique
	// channel-binding value.
	clientFinishedIsFirst bool

	// closeNotifyErr is any error from sending the alertCloseNotify record.
	closeNotifyErr error
	// closeNotifySent is true if the Conn attempted to send an
	// alertCloseNotify record.

NAME       CLUSTER      CDS       LDS        EDS        RDS          ECDS         ISTIOD      VERSION
proxy1     cluster1     STALE     SYNCED     SYNCED     NOT SENT     NOT SENT     istiod1     1.20

	go send(c)
	go recv(c)
}

// direct send to select recv
func test2(c int) {
	ca := mkchan(c, 4)

	changeNproc(4)
	go send(ca[0])
	go send(ca[1])
	go send(ca[2])
	go send(ca[3])

	changeNproc(1)
	go sel(ca[0], ca[1], ca[2], ca[3], nc, nc, nc, nc)
}

// select send to direct recv
func test3(c int) {
	ca := mkchan(c, 4)

	changeNproc(4)
	go recv(ca[0])
	go recv(ca[1])

func _[T any](ch T) {
	ch <- /* ERRORx `cannot send to ch .* no core type` */ 0
}

func _[T C0](ch T) {
	ch <- /* ERROR "cannot send to non-channel" */ 0
}

func _[T C1](ch T) {
	ch <- 0
}

func _[T C2](ch T) {
	ch  <-/* ERROR "cannot send to receive-only channel" */ 0
}

func _[T C3](ch T) {
	ch <- /* ERRORx `cannot send to ch .* no core type` */ 0
}

func _[T C4](ch T) {
	ch <- 0

// number of bytes actually sent.
func Sendmsg(fd int, p, oob []byte, to Sockaddr, flags int) (err error) {
	_, err = SendmsgN(fd, p, oob, to, flags)
	return
}

// SendmsgN sends a message on a socket to an address using the sendmsg system
// call. p contains the non-control data to send, and oob contains the "out of

			}
			u := evalOrig(v.ID, ancestor, semi, label)
			if semi[u] < semi[w] {
				semi[w] = semi[u]
			}
		}

		// add w to bucket[vertex[semi[w]]]
		// implement bucket as a linked list implemented
		// in a pair of arrays.
		vsw := vertex[semi[w]]
		bucketLink[w] = bucketHead[vsw]
		bucketHead[vsw] = w

		linkOrig(parent[w], w, ancestor)

		// step3 in TOPLAS paper