If there is no waypoint, ztunnel will enforce RBAC policies against the request.

If all checks pass, ztunnel will open a connection to the target. This will spoof the source IP (from `Forwarded` for waypoints, or the incoming IP otherwise).
Once the connection is established we return a 200 HTTP code, and bi-directionally copy data to/from the tunnel to the destination.

## Certificates

FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

  }

  @Test
  fun networkInterceptorsHaveConnectionAccess() {
    server.enqueue(MockResponse())
    val interceptor =
      Interceptor { chain: Interceptor.Chain ->
        val connection = chain.connection()
        assertThat(connection).isNotNull()
        chain.proceed(chain.request())
      }
    client =
      client.newBuilder()
        .addNetworkInterceptor(interceptor)
        .build()
    val request =

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE....

effective policy is `PERMISSIVE` (the default), the ztunnel will open a vanilla TLS HBONE tunnel (NOTE: this is not mTLS) to the Waypoint proxy and forward the traffic over that connection without presenting a client certificate. Therefore, it is absolutely critical that the waypoint proxy not assume any identity from incoming connections, even if the ztunnel is hairpinning. In other words, all traffic over TLS HBONE tunnels must be considered to be untrusted. From there, traffic is returned to the ztunnel...

          ioe: IOException,
        ) = TODO()

        override fun connectionAcquired(
          call: Call,
          connection: Connection,
        ) = TODO()

        override fun connectionReleased(
          call: Call,
          connection: Connection,
        ) = TODO()

        override fun requestHeadersStart(call: Call) = TODO()

        override fun requestHeadersEnd(

    assertThat(connectionAcquired2.connection).isSameAs(
      connectionAcquired1.connection,
    )
  }

  @Test
  fun multipleConnectionsFoundForSingleCall() {
    server.enqueue(
      MockResponse.Builder()
        .code(301)
        .addHeader("Location", "/foo")
        .addHeader("Connection", "Close")
        .build(),
    )
    server.enqueue(

            )
        )
    }

    id("${model.projectId}_TestPerformanceTest")
    name = "Test performance test tasks - Java8 Linux"
    description = "Tries to run an adhoc performance test without a database connection to verify this is still working"

    applyPerformanceTestSettings()
    artifactRules = individualPerformanceTestArtifactRules

    steps {
        killProcessStep(buildTypeThis, KILL_ALL_GRADLE_PROCESSES, os)

$ adb logcat '*:E' 'okhttp.Http2:D' 'okhttp.TaskRunner:D'
```

### HTTP/2 Frame Logging

This logs inbound (`<<`) and outbound (`>>`) frames for HTTP/2 connections.

```
[2020-01-01 00:00:00] >> CONNECTION 505249202a20485454502f322e300d0a0d0a534d0d0a0d0a
[2020-01-01 00:00:00] >> 0x00000000     6 SETTINGS
[2020-01-01 00:00:00] >> 0x00000000     4 WINDOW_UPDATE

FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE