//
// Note, y is always non-negative.
//
// Note, ISELZ is intentionally not used in lower. Where possible, ISEL is converted to ISELZ in late lower
// after all the ISEL folding rules have been exercised.

((Rsh64U|Lsh64)x64 <t> x y)  => (ISEL [0] (S(R|L)D <t> x y) (MOVDconst [0])        (CMPUconst y [64]))
((Rsh64U|Lsh64)x32 <t> x y)  => (ISEL [0] (S(R|L)D <t> x y) (MOVDconst [0])        (CMPWUconst y [64]))

rules:
- destination: apimachinery
  branches:
  - name: master
    source:
      branch: master
      dirs:
      - staging/src/k8s.io/apimachinery
  - name: release-1.27
    go: 1.21.11
    source:
      branch: release-1.27
      dirs:
      - staging/src/k8s.io/apimachinery
  - name: release-1.28
    go: 1.21.11
    source:
      branch: release-1.28
      dirs:
      - staging/src/k8s.io/apimachinery

					rules[5],
				},
			},
			opts: ObjectOpts{
				IsLatest: true,
				UserTags: "key1=val1",
				Name:     "obj-1",
				Size:     1*humanize.MiByte - 1,
			},
			hasRules: true,
		},
		{ // PUT version with size based filters
			lc: Lifecycle{
				Rules: []Rule{
					rules[1],
					rules[2],
					rules[3],
					rules[4],
					rules[5],
				},
			},

			proxier.needFullSync = true
		}
	}()

	if !tryPartialSync {
		// Ensure that our jump rules (eg from PREROUTING to KUBE-SERVICES) exist.
		// We can't do this as part of the iptables-restore because we don't want
		// to specify/replace *all* of the rules in PREROUTING, etc.
		//
		// We need to create these rules when kube-proxy first starts, and we need
		// to recreate them if the utiliptables Monitor detects that iptables has

	{utiliptables.TableFilter, utiliptables.ChainForward, kubeForwardChain, "kubernetes forwarding rules"},
	{utiliptables.TableFilter, utiliptables.ChainInput, kubeNodePortChain, "kubernetes health check rules"},
	{utiliptables.TableFilter, utiliptables.ChainInput, kubeProxyFirewallChain, "kube-proxy firewall rules"},

  // Required.
  optional string expression = 2;
}

// MatchResources decides whether to run the admission control policy on an object based
// on whether it meets the match criteria.
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
// +structType=atomic
message MatchResources {
  // NamespaceSelector decides whether to run the admission control policy on an object based

	// on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
	// +listType=atomic
	Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`

	// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
	// allowed values are Ignore or Fail. Defaults to Fail.
	// +optional

	proxier.mu.Lock()
	defer proxier.mu.Unlock()

	// don't sync rules till we've received services and endpoints
	if !proxier.isInitialized() {
		proxier.logger.V(2).Info("Not syncing nftables until Services and Endpoints have been received from master")
		return
	}

	//
	// Below this point we will not return until we try to write the nftables rules.
	//

	// Keep track of how long syncs take.
	start := time.Now()

	exportTo map[host.Name]sets.Set[visibility.Instance]
	// Map of dest rule host and the merged destination rules for that host.
	// Only stores specific non-wildcard destination rules
	specificDestRules map[host.Name][]*ConsolidatedDestRule
	// Map of dest rule host and the merged destination rules for that host.
	// Only stores wildcard destination rules
	wildcardDestRules map[host.Name][]*ConsolidatedDestRule
}

	ps.initVirtualServices(env)

	t.Run("resolve shortname", func(t *testing.T) {
		rules := ps.VirtualServicesForGateway("ns1", gatewayName)
		if len(rules) != 3 {
			t.Fatalf("wanted 3 virtualservice for gateway %s, actually got %d", gatewayName, len(rules))
		}
		gotHTTPHosts := make([]string, 0)
		for _, r := range rules {
			vs := r.Spec.(*networking.VirtualService)
			for _, route := range vs.GetHttp() {