Flags: flags,
		},
		Sockets: map[int]*nl.SocketHandle{
			unix.NETLINK_NETFILTER: {Socket: n.socket},
		},
		Data: []nl.NetlinkRequestData{
			// netfilter generic message
			// (definition: https://github.com/torvalds/linux/blob/v6.7/include/uapi/linux/netfilter/nfnetlink.h#L32-L38)
			&nl.Nfgenmsg{
				NfgenFamily: uint8(unix.AF_NETLINK),
				Version:     nl.NFNETLINK_V0,
				ResId:       0,
			},
		},
	}

# NFTables kube-proxy

This is an implementation of service proxying via the nftables API of
the kernel netfilter subsystem.

## General theory of netfilter

Packet flow through netfilter looks something like:

```text
             +================+      +=====================+
             | hostNetwork IP |      | hostNetwork process |
             +================+      +=====================+
                         ^                |

        def excluded = Stub(Task)
        def notExcluded = Stub(Task)
        def selectionResult = Stub(TaskSelectionResult)

        when:
        def filter = selector.getFilter(new TaskSelector.SelectionContext(Path.path(":a:b"), "type"), project1, "b", false)

        then:
        1 * projectConfigurer.configure(projectModel1)

        AntlrSourceDirectorySet antlrSourceSet = objectFactory.newInstance(DefaultAntlrSourceDirectorySet.class, objectFactory.sourceDirectorySet(name, displayName));
        antlrSourceSet.getFilter().include("**/*.g");
        antlrSourceSet.getFilter().include("**/*.g4");
        return antlrSourceSet;
    }

    : mlir::PassManager::IRPrinterConfig(
          print_module_scope, print_after_only_on_change,
          /*printAfterOnlyOnFailure=*/false, op_printing_flags),
      pass_filter_(GetFilter("MLIR_BRIDGE_LOG_PASS_FILTER")),
      string_filter_(GetFilter("MLIR_BRIDGE_LOG_STRING_FILTER")) {}

// Logs op to file with name of format
// `<log_counter>_mlir_bridge_<pass_name>_<file_suffix>.mlir`.

        allGroovy = objectFactory.sourceDirectorySet("all" + name, displayName + " Groovy source");
        allGroovy.source(groovy);
        allGroovy.getFilter().include("**/*.groovy");
    }

    private static GroovySourceDirectorySet createGroovySourceDirectorySet(String name, String displayName, ObjectFactory objectFactory) {

        scala = createScalaSourceDirectorySet("scala", displayName + " Scala source", objectFactory);
        allScala = objectFactory.sourceDirectorySet("allscala", displayName + " Scala source");
        allScala.getFilter().include("**/*.scala");
        allScala.source(scala);
    }

    private static ScalaSourceDirectorySet createScalaSourceDirectorySet(String name, String displayName, ObjectFactory objectFactory) {

// (definition: https://github.com/torvalds/linux/blob/v6.7/include/uapi/linux/netfilter/nfnetlink_acct.h#L9-L16)
const (
	// NFNL_MSG_ACCT_NEW
	cmdNew = 0
	// NFNL_MSG_ACCT_GET
	cmdGet = 1
)

// nf netlink nfacct attribute, these should strictly match with the ones defined in kernel headers.
// (definition: https://github.com/torvalds/linux/blob/v6.7/include/uapi/linux/netfilter/nfnetlink_acct.h#L24-L35)
const (
	// NFACCT_NAME
	attrName = 1

	// Linux does not support writing to /sys/module/nf_conntrack/parameters/hashsize
	// when the writer process is not in the initial network namespace
	// (https://github.com/torvalds/linux/blob/v4.10/net/netfilter/nf_conntrack_core.c#L1795-L1796).
	// Usually that's fine. But in some configurations such as with github.com/kinvolk/kubeadm-nspawn,
	// kube-proxy is in another netns.

    @Inject
    abstract protected ObjectFactory getObjectFactory();

    @Override
    public TestFramework createTestFramework(Test task) {
        return new TestNGTestFramework(task, (DefaultTestFilter) task.getFilter(), getObjectFactory());
    }

    @Override
    public Iterable<Dependency> getImplementationDependencies() {